7.1.8-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 7.1.8-rc1 review
This is the start of the stable review cycle for the 7.1.8 release. There are 438 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 09 Aug 2026 14:33:46 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.8-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 7.1.8-rc1
Andrei Kuchynski <[email protected]>
usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path
Leo Li <[email protected]>
drm/amd/display: Exit idle optimizations before programming
Leo Li <[email protected]>
drm/amd/display: check GRPH_FLIP status before sending event
Jackson Lee <[email protected]>
media: chips-media: wave5: Support CBP profile
Matthew Brost <[email protected]>
drm/xe: Wait on external BO kernel fences in exec IOCTL
Thomas Hellström <[email protected]>
drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse]
Matthew Brost <[email protected]>
drm/xe: Set TTM device beneficial_order to 9 (2M)
Michal Wajdeczko <[email protected]>
drm/xe: Separate early xe_device initialization
Michal Wajdeczko <[email protected]>
drm/xe: Move xe->info.devid|revid initialization
Michal Wajdeczko <[email protected]>
drm/xe: Move xe->info.force_execlist initialization
Michal Wajdeczko <[email protected]>
drm/xe: Drop unused param from xe_device_create()
Andrei Kuchynski <[email protected]>
usb: typec: ucsi: Fix race condition and ordering in port unregistration
Sergey Senozhatsky <[email protected]>
usb: typec: ucsi: split connector lock classes
Ashutosh Dixit <[email protected]>
drm/xe/rtp: Ensure locking/ref counting for OA whitelists
Ashutosh Dixit <[email protected]>
drm/xe/oa: (De-)whitelist OA registers on OA stream open/release
Ashutosh Dixit <[email protected]>
drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt
Ashutosh Dixit <[email protected]>
drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs
Ashutosh Dixit <[email protected]>
drm/xe/rtp: Save OA nonpriv registers to register save/restore lists
Ashutosh Dixit <[email protected]>
drm/xe/rtp: Generalize whitelist_apply_to_hwe
Ashutosh Dixit <[email protected]>
drm/xe/rtp: Keep track of non-OA nonpriv slots
Ashutosh Dixit <[email protected]>
drm/xe/rtp: Maintain OA whitelists separately
Zack Rusin <[email protected]>
drm/vmwgfx: validate external BO copy bounds for both stride paths
Zack Rusin <[email protected]>
drm/vmwgfx: use check_add_overflow for shader size+offset bound
Zack Rusin <[email protected]>
drm/vmwgfx: enforce cursor size limits for MOB cursors
Zack Rusin <[email protected]>
drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure
Zack Rusin <[email protected]>
drm/vmwgfx: bound DMA command body size against suffix pointer
Zack Rusin <[email protected]>
drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
Zack Rusin <[email protected]>
drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
Zack Rusin <[email protected]>
drm/vmwgfx: take fman->lock around fence list mutation in fifo_down
Zack Rusin <[email protected]>
drm/vmwgfx: clamp dirty-page range with min, not max
Zack Rusin <[email protected]>
drm/vmwgfx: reject DX_BIND_QUERY without a DX context
Zack Rusin <[email protected]>
drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size
William Palacek <[email protected]>
drm/amdkfd: hold event_mutex while checkpointing CRIU events
David Francis <[email protected]>
drm/amdkfd: Handle invalid event type in CRIU event restore
William Palacek <[email protected]>
drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment
Vladimir Marioukhine <[email protected]>
drm/amdkfd: fix QID bit leak in pqm_create_queue()
Gang Ba <[email protected]>
drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE
Jiri Slaby (SUSE) <[email protected]>
drm/amd/display: use proper context for logging
Alan Swanson <[email protected]>
drm/amd/display: Silence link_dpms I2C retimer failures
Ray Wu <[email protected]>
drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames
George Zhang <[email protected]>
drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport
Alex Deucher <[email protected]>
drm/amd/display: check if dml21_add_phantom_plane() is successful
Yang Wang <[email protected]>
drm/amd/pm: use milliwatts for GPU power sensors
Yang Wang <[email protected]>
drm/amd/pm: hide pp_table sysfs on APUs
Yang Wang <[email protected]>
drm/amd/pm: fix pptable use-after-free
Yang Wang <[email protected]>
drm/amd/pm: fix torn gpu metrics reads
Harkirat Gill <[email protected]>
drm/amdgpu: cap GTT size to physical RAM on APUs
Candice Li <[email protected]>
drm/amdgpu: restore UMD profile pstate after runtime resume
Pierre-Eric Pelloux-Prayer <[email protected]>
drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini
Myeonghun Pak <[email protected]>
drm/mediatek: ovl_adaptor: balance component registrations
Guangshuo Li <[email protected]>
drm/mediatek: mtk_hdmi: Fix DDC adapter double put in v2
Osama Abdelkader <[email protected]>
drm/panthor: validate firmware interface structure sizes
Osama Abdelkader <[email protected]>
drm/panthor: reject firmware sections with oversized data
Laurent Pinchart <[email protected]>
drm/bridge: display-connector: Fix I2C adapter resource leak
Maíra Canal <[email protected]>
drm/vc4: Zero the tile state data array before each BIN job
Jose Maria Casanova Crespo <[email protected]>
drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size
Alexander Kaplan <[email protected]>
drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs
Avi Weiss <[email protected]>
can: ctucanfd: mark error-active controller status valid
Avi Weiss <[email protected]>
can: ctucanfd: handle bus error interrupts
Avi Weiss <[email protected]>
can: ctucanfd: unmap BAR0 using base address
Avi Weiss <[email protected]>
can: ctucanfd: use self-test mode for PRESUME_ACK
Pengpeng Hou <[email protected]>
can: ctucanfd: add missing MODULE_DEVICE_TABLE()
Pengpeng Hou <[email protected]>
can: peak_usb: validate uCAN receive record lengths
Maoyi Xie <[email protected]>
can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error
James Gao <[email protected]>
can: peak_usb: add bounds check for USB channel index
Pengpeng Hou <[email protected]>
can: softing: fw_parse(): validate firmware record spans
Tu Nguyen <[email protected]>
can: rcar_canfd: change the initializing flow for clocks and resets
Pengpeng Hou <[email protected]>
can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents
Abdun Nihaal <[email protected]>
can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams()
Tetsuo Handa <[email protected]>
can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking
Oleksij Rempel <[email protected]>
can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer
Oliver Hartkopp <[email protected]>
can: isotp: fix timer drain order, wakeup handling and tx_gen ordering
Marc Kleine-Budde <[email protected]>
can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure
Guangshuo Li <[email protected]>
can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure
Pengpeng Hou <[email protected]>
can: ems_usb: validate CPC message lengths
Lucas Martins Alves <[email protected]>
can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured
Liem <[email protected]>
i2c: imx: Cancel hrtimer before clearing slave pointer
Liem <[email protected]>
i2c: imx: Fix slave registration race and error handling
Carlos Song <[email protected]>
i2c: imx: mark I2C adapter when hardware is powered down
Jonas Gorski <[email protected]>
i2c: iproc: reset bus after timeout if START_BUSY is stuck
H. Nikolaus Schaller <[email protected]>
i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock
Wenmeng Liu <[email protected]>
i2c: qcom-cci: drop custom suspend/resume and rely on runtime PM helpers
Linmao Li <[email protected]>
i2c: spacemit: request IRQ after controller initialization
Dawei Feng <[email protected]>
ice: fix memory leak in ice_lbtest_prepare_rings()
Dawid Osuchowski <[email protected]>
ice: fix VF interrupts cleanup
Aaron Ma <[email protected]>
ice: wait for reset completion in ice_resume()
Ilya Maximets <[email protected]>
net: openvswitch: fix skb leak on flow key update failure during ct
Ilya Maximets <[email protected]>
net: openvswitch: fix skb leak on flow key update failure during recirculation
Ilya Maximets <[email protected]>
net: openvswitch: fix potential UAF on meter attach failure
Nava kishore Manne <[email protected]>
phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB
Nava kishore Manne <[email protected]>
phy: zynqmp: use read-modify-write for SERDES scrambler bypass
Nava kishore Manne <[email protected]>
phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask
Holger Dengler <[email protected]>
s390/zcrypt: Validate length for CCA ECC private key requests
Holger Dengler <[email protected]>
s390/zcrypt: Validate length for CCA AES cipher key requests
Harald Freudenberger <[email protected]>
s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()
Harald Freudenberger <[email protected]>
s390/zcrypt: Fix buffer over-read in cca_cipher2protkey
Harald Freudenberger <[email protected]>
s390/zcrypt: Close speculative mem read possibility
Harald Freudenberger <[email protected]>
s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs
Stefan Haberland <[email protected]>
s390/dasd: Fix undersized format-check buffer
Jan Höppner <[email protected]>
s390/dasd: Fix potential NULL pointer dereference
Aswin Karuvally <[email protected]>
s390/qeth: Check CAP_NET_ADMIN for private ioctls
Niklas Schnelle <[email protected]>
s390/pci: Fix s390_pci_mmio_write syscall error return without MIO
Jianing Li <[email protected]>
power: supply: max17040: handle missing status supplier
Sasha Finkelstein <[email protected]>
power: supply: macsmc: Support macOS 27 SMC firmware
Xu Rao <[email protected]>
power: supply: bq25890: fix the -10 C NTC lookup entry
Zhongqiu Han <[email protected]>
cpufreq: schedutil: Publish util hooks only after all sg_cpu are initialized
Abdun Nihaal <[email protected]>
cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()
Christian Loehle <[email protected]>
cpufreq: cppc: Sanitize lockless policy limit snapshots
Frank Sorenson <[email protected]>
cifs: add fscache_resize_cookie() to cifs_setsize()
Junjie Cao <[email protected]>
gpio: pch: use raw_spinlock_t for the register lock
bui duc phuc <[email protected]>
gpio: pca953x: fix cache_only and IRQ state on restore_context() failure
Daniel Golle <[email protected]>
gpiolib: tolerate gpio-hogs lacking a hogging state
Hardik Prakash <[email protected]>
i2c: designware: defer probe if child GpioInt controllers are not bound
Myeonghun Pak <[email protected]>
i2c: amd-mp2: Unregister callback on adapter add failure
Vincent Jardin <[email protected]>
hwmon: (pmbus/core) notify on the hwmon device, not the i2c client
Hongyan Xu <[email protected]>
hwmon: (npcm750-pwm-fan): stop fan timer on device detach
Asim Viladi Oglu Manizada <[email protected]>
sctp: prevent peer transport count overflow
Yuxiang Yang <[email protected]>
sctp: reject stale cookies with mismatched verification tags
Shawn Guo <[email protected]>
scsi: ufs: dt-bindings: Add missing mcq reg for qcom,sa8255p-ufshc
Ibrahim Hashimov <[email protected]>
scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write
Damien Le Moal <[email protected]>
scsi: libsas: terminate deferred commands on time out
Chris Gellermann <[email protected]>
selftests/clone3: fix wild pointer access of getline due to missing init
Chris Gellermann <[email protected]>
selftests/mm: fix potential wild pointer access of getline due to missing init
Vijaya Krishna Nivarthi <[email protected]>
spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure
Stanislaw Pal <[email protected]>
spi: spi-qpic-snand: write the feature value before executing SET_FEATURE
Masami Hiramatsu (Google) <[email protected]>
tracing/filters: Fix false positive match in regex_match_full()
Masami Hiramatsu (Google) <[email protected]>
tracing: Check return value of __register_event() in trace_module_add_events()
Ming Lei <[email protected]>
ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()
Eric Dumazet <[email protected]>
vxlan: use pskb_network_may_pull() in route_shortcircuit()
Eric Dumazet <[email protected]>
vxlan: use pskb_network_may_pull() for transmit path header pulls
Eric Dumazet <[email protected]>
vxlan: use neigh_ha_snapshot() in route_shortcircuit()
Eric Dumazet <[email protected]>
vxlan: unclone skb head before modifying eth header in route_shortcircuit()
Eric Dumazet <[email protected]>
vxlan: re-fetch eth header after route_shortcircuit()
Matt Fleming <[email protected]>
veth: convert frag_list skbs before running XDP
Breno Leitao <[email protected]>
uprobes: Fix NULL pointer dereference in hprobe_expire()
Michael Bommarito <[email protected]>
um: vector: fix use-after-free in vector_mmsg_rx()
Thorsten Blum <[email protected]>
powerpc/ps3: Fix map failure path in dma_ioc0_map_pages()
Jiakai Xu <[email protected]>
riscv/mm: use physical alignment for vmemmap_start_pfn
Chengfeng Ye <[email protected]>
net: pktgen: fix proc entry use-after-free
Zhiling Zou <[email protected]>
net: ipv6: clear suppressed fib6 rule result
Zhiling Zou <[email protected]>
net: bridge: stop fast-leave after deleting a port group
Breno Leitao <[email protected]>
mm: memcg: initialize *locked in memcg1_oom_prepare() stub
Link Lin <[email protected]>
mm/page_reporting: use system_freezable_wq to fix UAF during suspend
Kiryl Shutsemau (Meta) <[email protected]>
mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios
Kyumin Lee <[email protected]>
io_uring: preserve task restrictions across exec
Jens Axboe <[email protected]>
io_uring/net: initialize mshot_len for send
Christian Brauner <[email protected]>
binfmt_misc: don't leak the user namespace when the mount fails
Christian Brauner <[email protected]>
binfmt_misc: don't let an 'F' entry pin its own instance
Christian Brauner <[email protected]>
binfmt_misc: reject a flag character as the field delimiter
Christian Brauner <[email protected]>
binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
Christian Brauner <[email protected]>
binfmt_misc: restore write access when removing an entry
Zhao Li <[email protected]>
wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames
Zhao Li <[email protected]>
wifi: mac80211: fix tid_tx use-after-free on BA session stop
Pratik Vishwakarma <[email protected]>
x86/CPU/AMD: Carve out a Zen5 models range
Zihan Xi <[email protected]>
tipc: avoid use-after-free in poll trace queue dumps
Soeren Moch <[email protected]>
PCI: imx6: Keep i.MX6 Root Port MSI/MSI-X Capabilities with iMSI-RX to work around hardware bug
Carlo Caione <[email protected]>
of/address: Fix NULL bus dereference in of_pci_range_parser_one()
David Lee <[email protected]>
netfilter: ipset: do not update comments from kernel-side hash adds
Xuanqiang Luo <[email protected]>
net/smc: fix socket use-after-free during link group termination
Wei Liu <[email protected]>
mshv: fix hv_input_get_system_property struct
Namjae Jeon <[email protected]>
ksmbd: reject repeated SMB2 NEGOTIATE requests
Zhiling Zou <[email protected]>
ipvs: do not propagate one-packet flag to synced conns
David Carlier <[email protected]>
igc: remove napi_synchronize() in igc_down()
Matt Vollrath <[email protected]>
igbvf: Fix leak in TX DMA error cleanup
Xuanqiang Luo <[email protected]>
fou: Fix use-after-free in fou_create()
Dawei Feng <[email protected]>
e1000: fix memory leak in e1000_probe()
Md Sadre Alam <[email protected]>
dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+
Sonali Pradhan <[email protected]>
ALSA: usb-audio: Clamp frame size in implicit-feedback mode
Sonali Pradhan <[email protected]>
ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set
Baul Lee <[email protected]>
ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()
Baul Lee <[email protected]>
ALSA: usb-audio: fix stack info leak in RME Digiface status
Baul Lee <[email protected]>
ALSA: usb-audio: fix use-after-free in ump_to_endpoint()
Damien Le Moal <[email protected]>
ata: libata-scsi: schedule deferred atapi command
Damien Le Moal <[email protected]>
ata: libata-scsi: terminate deferred commands on time out
Niklas Cassel <[email protected]>
ata: libata-sata: fix ata_scsi_lpm_supported() iteration
Matt Vollrath <[email protected]>
ata: libata-eh: Increase STANDBY IMMEDIATE timeout
Haidar Lee <[email protected]>
ASoC: tas2562: fix broken entries in the volume lookup table
Haidar Lee <[email protected]>
ASoC: tas2562: fix DVC coefficient write order
Shengjiu Wang <[email protected]>
ASoC: fsl_easrc: fix m2m_init error path to use goto instead of bare return
Shengjiu Wang <[email protected]>
ASoC: fsl_asrc: fix m2m_init error path to use goto instead of bare return
Baul Lee <[email protected]>
ALSA: ump: fix double free of out_cvts on rawmidi error
Norbert Szetei <[email protected]>
ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes
Norbert Szetei <[email protected]>
ALSA: seq: Fix division by zero in initialize_timer()
Norbert Szetei <[email protected]>
ALSA: pcm: wake linked drain waiters on unlink
Xu Rao <[email protected]>
ALSA: lx6464es: fix period byte count for 16-bit streams
Eckhart Mohr <[email protected]>
ALSA: hda/realtek: Add quirk for TongFang X6SP45xU
Takashi Iwai <[email protected]>
ALSA: 6fire: Fix UAF at error handling during probe
David Howells <[email protected]>
afs: Fix UAF when sending a message
David Howells <[email protected]>
afs: Fix afs_fs_fetch_data() to subtract transferred from len
David Howells <[email protected]>
afs: Fix afs_fs_fetch_data() to set call->async
Xuanqiang Luo <[email protected]>
bpf: lwt: Fix dst reference leak on reroute failure
Sangho Lee <[email protected]>
Bluetooth: HIDP: validate numbered report payloads
Sangho Lee <[email protected]>
Bluetooth: HIDP: reject frames without a transaction header
Chengfeng Ye <[email protected]>
Bluetooth: hci_sync: Fix advertising data UAFs
Zihan Xi <[email protected]>
Bluetooth: mgmt: fix UAF in pair command cancellation
Aldo Ariel Panzardo <[email protected]>
Bluetooth: SCO: give the socket its own sco_conn reference
Zihan Xi <[email protected]>
Bluetooth: mgmt: fix pending command UAF in EIR updates
Greg Kroah-Hartman <[email protected]>
Bluetooth: btmtk: Fix short read errors in btmtk_usb_reg_read()
Greg Kroah-Hartman <[email protected]>
Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read()
Greg Kroah-Hartman <[email protected]>
Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req()
Luxiao Xu <[email protected]>
audit: fix potential use-after-free in audit_del_rule()
Zhan Xusheng <[email protected]>
audit: fix potential integer overflow in audit_log_n_string()
Charles Vosburgh <[email protected]>
sctp: validate Adaptation Indication parameter length
Hidayath Khan <[email protected]>
dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister
Farhan Ali <[email protected]>
KVM: s390: pci: Validate AIBV and AISB before pinning guest pages
Farhan Ali <[email protected]>
KVM: s390: pci: Fix NULL dereference on AIBV allocation failure
Farhan Ali <[email protected]>
KVM: s390: pci: Fix resource leak on IRQ registration failure
Farhan Ali <[email protected]>
KVM: s390: pci: Fix missing error codes and memory unaccounting
Farhan Ali <[email protected]>
KVM: s390: pci: Fix memory accounting for pinned/unpinned pages
Farhan Ali <[email protected]>
KVM: s390: pci: Reject adapter interrupt forwarding if already enabled
Sean Christopherson <[email protected]>
KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active
Paolo Bonzini <[email protected]>
KVM: VMX: add memory clobber to asm for VMX instructions
Raushan Patel <[email protected]>
tracing/fprobe: Roll back on enable_trace_fprobe() failure
Raushan Patel <[email protected]>
tracing/probes: Reject $arg0 in meta argument expansion
Weiming Shi <[email protected]>
KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs
Gregory Price <[email protected]>
mm/vmstat: fold stranded per-cpu node stats when a node comes online
Usama Arif <[email protected]>
userfaultfd: wait on source PMD during UFFDIO_MOVE
Xiangfeng Cai <[email protected]>
mm/hugetlb: fix list corruption in allocate_file_region_entries()
Zi Yan <[email protected]>
mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()
Kiryl Shutsemau (Meta) <[email protected]>
fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes
Kiryl Shutsemau (Meta) <[email protected]>
fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes
Jori Koolstra <[email protected]>
selftest: fix headers in fclog.c
Aboorva Devarajan <[email protected]>
mm/util: don't read __page_2 for order-1 folios in snapshot_page()
Kefeng Wang <[email protected]>
mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE
Joseph Qi <[email protected]>
ocfs2: fix boundary check in ocfs2_check_dir_entry() to use buffer offset
Guanghui Yang <[email protected]>
btrfs: zoned: fix missing chunk metadata reservation
Stanislav Kinsburskii <[email protected]>
lib: test_hmm: use device devt for coherent device range selection
Nathan Chancellor <[email protected]>
fortify: Disable -Wstringop-overread in tests
Benjamin Boortz <[email protected]>
pinctrl: bm1880: add missing select GENERIC_PINCONF
Michael Bommarito <[email protected]>
erofs: cap LZMA stream pool size
Mykola Lysenko <[email protected]>
btrfs: raid56: fix scrub read assembly submitting no reads
Karl Mehltretter <[email protected]>
pinctrl: devicetree: don't free uninitialized dev_name on error path
Benjamin Boortz <[email protected]>
pinctrl: microchip-sgpio: add missing select REGMAP_MMIO
Kiryl Shutsemau (Meta) <[email protected]>
mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()
Qi Zheng <[email protected]>
mm: mglru: fix stale batch updates after memcg reparenting
Christian Loehle <[email protected]>
ACPI: CPPC: Check all controls for fast switching
Nicolas Schier <[email protected]>
kbuild: Stop modifying $(objtree)/Makefile when building oot-kmods oos
Peiyang He <[email protected]>
iommu/iommufd: Fix IOPF group ownership UAF
Peiyang He <[email protected]>
iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace
Peiyang He <[email protected]>
iommufd: Reject DMABUF pages from the access pin path
Nicolin Chen <[email protected]>
iommufd/viommu: Publish a vDEVICE only after vdevice_init() succeeds
Nicolin Chen <[email protected]>
iommufd/viommu: Release the igroup lock on the vdevice_size error path
Masami Hiramatsu (Google) <[email protected]>
ring-buffer: Fix subbuf_ids memory leak in rb_allocate_cpu_buffer() error path
Stanislav Kinsburskii <[email protected]>
mshv: Publish VP to pt_vp_array before installing the file descriptor
Stanislav Kinsburskii <[email protected]>
mshv: Order pt_vp_array publish against irqfd assertion path
Stanislav Kinsburskii <[email protected]>
mshv: Fix missing error code on VP allocation failure
Stanislav Kinsburskii <[email protected]>
mshv: Fix level-triggered check on uninitialized data
Stanislav Kinsburskii <[email protected]>
mshv: Fix race in mshv_irqfd_deassign
Christoph Hellwig <[email protected]>
iomap: add a separate bio_set for iomap_split_ioend
Namjae Jeon <[email protected]>
ksmbd: use memcmp() to compare ClientGUIDs
Namjae Jeon <[email protected]>
ksmbd: fix use-after-free in __close_file_table_ids()
Namjae Jeon <[email protected]>
ksmbd: return success for deferred final close
Jerome Tollet <[email protected]>
drm/i915/hdmi: Poll for 200 msec for TMDS_Scrambler_Status
Denis V. Lunev <[email protected]>
qede: sync udp_tunnel ports outside qede_lock in the recovery path
Haibo Chen <[email protected]>
spi: spi-nxp-fspi: add per-SoC SDR/DTR clock rate limits for all supported SoCs
Gabriele Monaco <[email protected]>
sched/deadline: Use revised wakeup rule only for running dl_server
Suman Ghosh <[email protected]>
octeontx2-pf: Set correct sequence for carrier off and tx queue stop
Jiawen Wu <[email protected]>
net: libwx: fix FDIR ATR queue mismatch for software VLAN packets
Wei Fang <[email protected]>
ptp: netc: fix potential interrupt storm caused by incorrect unbind order
Aditya Garg <[email protected]>
net: mana: Return error code from mana_create_rxq()
Long Li <[email protected]>
net: mana: Create separate EQs for each vPort
Nazim Amirul <[email protected]>
net: stmmac: Fix E2E delay mechanism
Daniel Golle <[email protected]>
net: dsa: mt7530: error out on failed reads in MT7531 PHY polling
Daniel Golle <[email protected]>
net: dsa: mt7530: error out on failed reads in ATC/VTCR command polling
Daniel Golle <[email protected]>
net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend
Thomas Weißschuh <[email protected]>
riscv: vdso: Only try to install vDSO when present
Shuangpeng Bai <[email protected]>
ipv6: release fib6_null_entry on subtree failure
Vincent Donnefort <[email protected]>
ring-buffer: Fix reader page read offset for remote buffers
Karl Mehltretter <[email protected]>
riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove
Muhammad Bilal <[email protected]>
accel/qaic: use sizeof(*trans_hdr) for transaction length check
Anirudh Srinivasan <[email protected]>
riscv: drop __init from vec_check_unaligned_access_speed_all_cpus
Masami Hiramatsu (Google) <[email protected]>
tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions
Masami Hiramatsu (Google) <[email protected]>
tracing/mmiotrace: Reset dropped_count in mmio_reset_data()
Masami Hiramatsu (Google) <[email protected]>
fprobe: Fix module reference count leak on error in register_fprobe()
Himal Prasad Ghimiray <[email protected]>
drm/xe/pt: check no-DMA huge-pte cases before DMA segment test
Alexander Kaplan <[email protected]>
drm/i915/dp: Ignore the sink's DSC max FRL rate without a PCON DSC encoder
Minhong He <[email protected]>
can: isotp: check register_netdevice_notifier() error in module init
Chenguang Zhao <[email protected]>
net: sxgbe: check descriptor ring allocation failures
Chenguang Zhao <[email protected]>
net: sxgbe: free TX rings on RX allocation failure
Ao Sun <[email protected]>
scsi: ufs: core: Initialize hba->rpmbs list in ufshcd
Chandrakanth Patil <[email protected]>
scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit
Hariprasad Kelam <[email protected]>
octeontx2-af: Block VFs from clobbering special CGX PKIND state
Ratheesh Kannoth <[email protected]>
octeontx2: cn20k: Coordinate default rules with NIX LF lifecycle
Leon Romanovsky <[email protected]>
scsi: target: Clear cmd_cnt when initial counter enrollment fails
Benjamin Block <[email protected]>
scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req
Bart Van Assche <[email protected]>
scsi: ufs: core: Revert "Delegate the interrupt service routine to a threaded IRQ handler"
Guangshuo Li <[email protected]>
scsi: ufs: core: Cancel RTC work in active-active suspend
TanZheng <[email protected]>
scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE
Christian Marangi <[email protected]>
net: phylink: put link_gpio if phylink_create fails
Mauricio Faria de Oliveira <[email protected]>
x86/boot: Add volatile, clobbers and zero-length test in memcmp()
Pauli Virtanen <[email protected]>
Bluetooth: hci_sync: remove unnecessary hci_conn_get in create_conn_sync
Pauli Virtanen <[email protected]>
Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync
Pauli Virtanen <[email protected]>
Bluetooth: hci_sync: hold conn in hci_past_sync() callback
Pauli Virtanen <[email protected]>
Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback
Pauli Virtanen <[email protected]>
Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback
Pauli Virtanen <[email protected]>
Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks
Pauli Virtanen <[email protected]>
Bluetooth: hci_conn: hold conn reference in abort_conn_sync()
Zijun Hu <[email protected]>
Bluetooth: btintel: Validate length before parsing diagnostics TLV
Pauli Virtanen <[email protected]>
Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero
Pauli Virtanen <[email protected]>
Bluetooth: ISO: fix refcounting of iso_conn
Pauli Virtanen <[email protected]>
Bluetooth: ISO: ensure no dangling hcon references in iso_conn
Pauli Virtanen <[email protected]>
Bluetooth: ISO: avoid deadlocks in iso_sock_timeout
Pauli Virtanen <[email protected]>
Bluetooth: ISO: fix leaking sk after socket release
Pauli Virtanen <[email protected]>
Bluetooth: ISO: hold sk properly in iso_conn_ready
Pauli Virtanen <[email protected]>
Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis()
Pauli Virtanen <[email protected]>
Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos
Pauli Virtanen <[email protected]>
Bluetooth: ISO: lock sk in iso_connect_ind
Pauli Virtanen <[email protected]>
Bluetooth: ISO: lock sk in iso_sock_getname
Pauli Virtanen <[email protected]>
Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release
Jiale Yao <[email protected]>
Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp
Pauli Virtanen <[email protected]>
Bluetooth: ISO: clear iso_data always when detaching conn from hcon
Przemyslaw Korba <[email protected]>
ice: suppress DPLL errors during reset recovery
Yuho Choi <[email protected]>
idpf: Fix mailbox IRQ name leak on request failure
Joshua Hay <[email protected]>
idpf: adjust TxQ ring count minimum
Michael Bommarito <[email protected]>
idpf: bound interrupt-vector register fill to the allocated array
Guenter Roeck <[email protected]>
hwmon: (pmbus) Fix return value from pmbus_update_byte_data()
Chenguang Zhao <[email protected]>
net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller
David Howells <[email protected]>
netfs: Fix folio_queue ENOMEM in writeback by adding a mempool
Yichong Chen <[email protected]>
netfs: release readahead folios on iterator preparation failure
Yichong Chen <[email protected]>
netfs: handle single writeback rolling buffer allocation failure
Yichong Chen <[email protected]>
netfs: clear PG_private_2 on copy-to-cache append failure
Zhao Li <[email protected]>
wifi: mac80211: validate individual TWT params before driver setup
Eric Dumazet <[email protected]>
net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()
Cen Zhang (Microsoft) <[email protected]>
net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds
Thorsten Blum <[email protected]>
powerpc/boot: Fix treeboot-akebono CPU node lookup check
Thorsten Blum <[email protected]>
powerpc/boot: Fix treeboot-currituck CPU node lookup check
Thorsten Blum <[email protected]>
powerpc/boot: Fix simpleboot CPU node lookup check
Eric Joyner <[email protected]>
ethtool: Embed FEC hist ranges as buffer in struct
Yun Lu <[email protected]>
rtase: fix double free of multi-frag skb on DMA map failure
Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix PWM auto temp state array and bounds check
Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read
Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Use cached PWM frequency value
Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks
Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read()
Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread
Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix cache updated before hardware write on I2C error
Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors
Chenguang Zhao <[email protected]>
forcedeth: fix UAF of txrx_stats in nv_remove
Surendra Singh Chouhan <[email protected]>
ASoC: sophgo: return 1 on volume change in cv1800b_adc_volume_set()
David Corvaglia <[email protected]>
net: bridge: mrp: fix Option TLV length in MRP_Test frames
Guenter Roeck <[email protected]>
hwmon: (nct6775-core) Prevent access to unsupported weight registers
Eric Dumazet <[email protected]>
net: do not send ICMP/NDISC Redirects when peer allocation fails
Guenter Roeck <[email protected]>
hwmon: (nzxt-smart2) DMA-align output buffer
Guenter Roeck <[email protected]>
hwmon: (lm90) Only report alarms if driver is ready
Guenter Roeck <[email protected]>
hwmon: (sht3x) Fix unaligned accesses
Guenter Roeck <[email protected]>
hwmon: (ltc4282) Fix reading the minimum alarm voltage
Guenter Roeck <[email protected]>
hwmon: (ina2xx) Fix various overflow issues
Guenter Roeck <[email protected]>
hwmon: (nct6775-core) Fix number of temperature registers for NCT6116
Srikanth Boyapally <[email protected]>
spi: spi-cadence: Move TX FIFO full busy-wait into FIFO
wangdicheng <[email protected]>
ASoC: tas2781: Use correct calibration data for SINEGAIN2 register
Baochen Qiang <[email protected]>
wifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup()
Christian Loehle <[email protected]>
ACPI: CPPC: Skip writes to unsupported performance controls
Alex Tran <[email protected]>
gpio: gpio-by-pinctrl: Apply initial value in direction output wrapper
Gao Xiang <[email protected]>
erofs: ensure valid f_path for page cache sharing
Gao Xiang <[email protected]>
erofs: remove fscache backend entirely
Gao Xiang <[email protected]>
erofs: clean up erofs_ishare_fill_inode()
Dawei Feng <[email protected]>
smb: client: fix buffer leaks in SMB1 read and write
Xingui Yang <[email protected]>
scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race
HyeongJun An <[email protected]>
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer
HyeongJun An <[email protected]>
scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer
Mario Limonciello <[email protected]>
pinctrl-amd: Don't clear S4 wake bits at probe
Jonas Köppeler <[email protected]>
net/sched: sch_cake: skip clearing unused tins during rate adjustment
Maciej Fijalkowski <[email protected]>
xsk: reclaim invalid Tx descriptors in ZC batch path
Maciej Fijalkowski <[email protected]>
xsk: provide sufficient space in pool->tx_descs
Jason Xing <[email protected]>
xsk: drain continuation descs after overflow in xsk_build_skb()
Jason Xing <[email protected]>
xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx
John Ericson <[email protected]>
selftests/net/af_unix: test listen() rejects wrong socket states
John Ericson <[email protected]>
af_unix: fix listen() succeeding on sockets in the wrong state
Xiang Mei (Microsoft) <[email protected]>
nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush
Xiang Mei (Microsoft) <[email protected]>
nexthop: take nh->lock for f6i_list walks in replace check and notify
Xiang Mei <[email protected]>
rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()
Charles Keepax <[email protected]>
ASoC: SDCA: Ensure that Control Range is large enough for header
Charles Keepax <[email protected]>
ASoC: SDCA: Make UMP message size check more robust
Charles Keepax <[email protected]>
ASoC: SDCA: Always free firmware in FDL path
Charles Keepax <[email protected]>
ASoC: SDCA: Correct pointer passed to devm_acpi_table_put
Xiang Mei (Microsoft) <[email protected]>
netfilter: nft_payload: fix mask build for partial field offload
Julian Anastasov <[email protected]>
ipvs: clear the nfct flag under lock
Julian Anastasov <[email protected]>
ipvs: do not mangle ICMP replies for non-first fragments
Julian Anastasov <[email protected]>
ipvs: fix places with wrong packet offsets
Julian Anastasov <[email protected]>
ipvs: fix the checksum validations
Pablo Neira Ayuso <[email protected]>
netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: make nft_object rhltable per table
Julian Anastasov <[email protected]>
ipvs: adjust double hashing when fwd method changes
Michael Bommarito <[email protected]>
assoc_array: trim the final shortcut word using the current chunk end
Michael Bommarito <[email protected]>
keys: make keyring key-chunk byte order agree with keyring_diff_objects()
Michael Bommarito <[email protected]>
keys: fix out-of-bounds read in keyring_get_key_chunk()
Fabrice Derepas <[email protected]>
KEYS: trusted: dcp: fix key_len validation and calc_blob_len() return type
Alexandru Elisei <[email protected]>
KVM: arm64: Reject guest_memfd memslots when the VM has MTE
Vincent Donnefort <[email protected]>
KVM: arm64: Add missing hyp_enter when trapping sysreg
Vincent Donnefort <[email protected]>
KVM: arm64: Fix hyp_trace_desc allocation size in hyp_trace_load()
Vincent Donnefort <[email protected]>
KVM: arm64: Fix potential leak in hyp_trace_buffer_alloc_bpages_backing
Vincent Donnefort <[email protected]>
KVM: arm64: Fix hyp_trace clock disabling
Carlos López <[email protected]>
KVM: arm64: vgic: Mitigate potential LPI registration failure
Carlos López <[email protected]>
KVM: arm64: vgic: Fix race between LPI release and re-registration
Stanislav Kinsburskii <[email protected]>
mshv: Fix sleeping under spinlock in mshv_portid_alloc
Stanislav Kinsburskii <[email protected]>
mshv: Fix duplicate GSI detection for GSI 0
Sebastian Andrzej Siewior <[email protected]>
Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotation
Yi Xie <[email protected]>
mshv_vtl: fix fd leak in mshv_ioctl_create_vtl()
Ruoyu Wang <[email protected]>
drm/mediatek: Check CRTC state before freeing
Pablo Neira Ayuso <[email protected]>
netfilter: nf_conntrack_expect: add and use nf_ct_expect_related_pair()
Lorenzo Bianconi <[email protected]>
selftests: netfilter: nft_flowtable.sh: fix offload counter verification for tunnel tests
Xiang Mei <[email protected]>
netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()
Radhey Shyam Pandey <[email protected]>
phy: zynqmp: fix runtime PM leak on probe allocation failure
Radhey Shyam Pandey <[email protected]>
phy: zynqmp: fix clock error handling in xpsgtr_phy_init()
Tomas Glozar <[email protected]>
rtla/timerlat_top: Fix on-threshold actions firing on signal
Namjae Jeon <[email protected]>
ntfs: drop stale page-cache when shrinking a non-resident attr
Namjae Jeon <[email protected]>
ntfs: harden runlist realloc size calculations
Johannes Thumshirn <[email protected]>
btrfs: zoned: skip fully truncated ordered extents at zone finish
Qu Wenruo <[email protected]>
btrfs: raid56: fix an incorrect csum skip during scrub
Dongjiang Zhu <[email protected]>
btrfs: skip global block reserve accounting for rescue mounts
Qu Wenruo <[email protected]>
btrfs: warn about extent buffer that can not be released
Johannes Thumshirn <[email protected]>
btrfs: zoned: reset meta_write_pointer on zone reset
Johannes Thumshirn <[email protected]>
btrfs: zoned: fix deadlock between metadata writeback and transaction commit
Qu Wenruo <[email protected]>
btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag
Sang-Heon Jeon <[email protected]>
of: reserved_mem: prevent OOB when too many dynamic regions are defined
Uday Khare <[email protected]>
ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup
Uday Khare <[email protected]>
ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup
Krishna Kurapati <[email protected]>
phy: qcom: m31-eusb2: Fix return value of init call
Radhey Shyam Pandey <[email protected]>
ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources()
Rosen Penev <[email protected]>
ata: sata_mv: accept 1 or 2 resources in platform probe
Namjae Jeon <[email protected]>
ntfs: preserve RECALL_ON_OPEN on WSL special-file reparse points
Kuan-Ying Lee <[email protected]>
selftests/seccomp: Fix pointer type mismatch build error
Haofeng Li <[email protected]>
selftests/lkdtm: rename STACKLEAK_ERASING to KSTACK_ERASE
Abdun Nihaal <[email protected]>
gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe()
Nicolin Chen <[email protected]>
iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE
Yuho Choi <[email protected]>
dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()
Yuho Choi <[email protected]>
dmaengine: idxd: fix double free of wq, engine, and group structs
Hongling Zeng <[email protected]>
dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA
Konrad Dybcio <[email protected]>
pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151
Sneh Mankad <[email protected]>
pinctrl: qcom: Unconditionally mark gpio as wakeup enable
David Carlier <[email protected]>
dmaengine: switchtec-dma: fix FIELD_GET misuse when programming SE threshold
D Scott Phillips <[email protected]>
KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context
Michael Bommarito <[email protected]>
thunderbolt: Prevent XDomain delayed work use-after-free on disconnect
Michael Diesen <[email protected]>
ALSA: hda/realtek: Add quirk for HP Dragonfly Folio G3 2-in-1 (103c:8a05)
Harry Yoo (Oracle) <[email protected]>
mm/slab: prevent unbounded recursion in free path with new kmalloc type
Harry Yoo (Oracle) <[email protected]>
lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled()
Harry Yoo (Oracle) <[email protected]>
mm/slab: decouple SLAB_NO_SHEAVES from SLAB_NO_OBJ_EXT
Yehyeong Lee <[email protected]>
net: mpls: initialize rtm_tos in mpls_getroute()
-------------
Diffstat:
Documentation/arch/arm64/silicon-errata.rst | 4 + .../bindings/ufs/qcom,sa8255p-ufshc.yaml | 9 +- Documentation/filesystems/erofs.rst | 9 +- Documentation/networking/af_xdp.rst | 54 +- Documentation/virt/kvm/api.rst | 6 + Makefile | 12 +- arch/arm64/include/asm/kvm_hypevents.h | 1 + arch/arm64/kvm/arm.c | 25 +- arch/arm64/kvm/hyp/nvhe/hyp-main.c | 1 + arch/arm64/kvm/hyp_trace.c | 36 +- arch/arm64/kvm/mmu.c | 4 + arch/arm64/kvm/vgic/vgic-its.c | 25 +- arch/arm64/kvm/vgic/vgic-v3.c | 8 +- arch/arm64/kvm/vgic/vgic.c | 18 +- arch/powerpc/boot/simpleboot.c | 2 +- arch/powerpc/boot/treeboot-akebono.c | 2 +- arch/powerpc/boot/treeboot-currituck.c | 2 +- arch/powerpc/platforms/ps3/mm.c | 1 + arch/riscv/Makefile | 2 +- arch/riscv/kernel/unaligned_access_speed.c | 4 +- arch/riscv/mm/init.c | 7 +- arch/s390/kvm/pci.c | 107 +++- arch/s390/kvm/pci.h | 2 + arch/s390/pci/pci_mmio.c | 1 + arch/um/drivers/vector_kern.c | 3 + arch/x86/boot/string.c | 11 +- arch/x86/kernel/cpu/amd.c | 4 +- arch/x86/kvm/svm/avic.c | 8 - arch/x86/kvm/vmx/vmx_ops.h | 8 +- arch/x86/kvm/x86.c | 6 + drivers/accel/qaic/qaic_control.c | 2 +- drivers/acpi/cppc_acpi.c | 29 +- drivers/ata/ahci_ceva.c | 18 +- drivers/ata/libata-eh.c | 37 +- drivers/ata/libata-sata.c | 2 +- drivers/ata/libata-scsi.c | 119 +++- drivers/ata/libata.h | 3 +- drivers/ata/sata_mv.c | 2 +- drivers/block/ublk_drv.c | 9 + drivers/bluetooth/btintel.c | 3 + drivers/bluetooth/btmtk.c | 86 ++- drivers/bluetooth/btusb.c | 30 +- drivers/cpufreq/cppc_cpufreq.c | 35 +- drivers/cpufreq/powernow-k8.c | 1 + drivers/dibs/dibs_loopback.c | 47 +- drivers/dma/idxd/cdev.c | 4 +- drivers/dma/idxd/init.c | 36 +- drivers/dma/sun6i-dma.c | 11 +- drivers/dma/switchtec_dma.c | 2 +- drivers/gpio/gpio-by-pinctrl.c | 18 +- drivers/gpio/gpio-pca953x.c | 15 +- drivers/gpio/gpio-pch.c | 28 +- drivers/gpio/gpio-sloppy-logic-analyzer.c | 10 + drivers/gpio/gpiolib.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 39 +- drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 9 + drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 15 + drivers/gpu/drm/amd/amdgpu/amdgpu_eviction_fence.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 12 + drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 10 +- drivers/gpu/drm/amd/amdkfd/kfd_events.c | 23 +- .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 2 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 243 ++++++-- drivers/gpu/drm/amd/display/dc/core/dc.c | 45 ++ drivers/gpu/drm/amd/display/dc/dc.h | 1 + .../gpu/drm/amd/display/dc/dce/dce_clock_source.c | 20 +- .../drm/amd/display/dc/dml2_0/dml21/dml21_utils.c | 15 +- .../dml21/src/dml2_core/dml2_core_dcn4_calcs.c | 31 +- .../drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c | 16 +- drivers/gpu/drm/amd/display/dc/link/link_dpms.c | 16 +- drivers/gpu/drm/amd/include/kgd_pp_interface.h | 6 +- drivers/gpu/drm/amd/pm/amdgpu_dpm.c | 39 +- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 29 +- drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h | 6 +- .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 4 +- .../gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 4 +- .../gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c | 2 +- .../gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c | 5 +- drivers/gpu/drm/amd/pm/powerplay/inc/hwmgr.h | 5 + drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 2 +- .../drm/amd/pm/swsmu/smu11/cyan_skillfish_ppt.c | 6 +- drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c | 8 +- .../drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 7 +- drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c | 9 +- drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c | 5 +- drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c | 3 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 2 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_12_ppt.c | 3 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c | 4 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_5_ppt.c | 2 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 3 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 2 +- .../gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c | 2 +- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_0_ppt.c | 3 +- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 2 +- .../gpu/drm/amd/pm/swsmu/smu15/smu_v15_0_0_ppt.c | 3 +- .../gpu/drm/amd/pm/swsmu/smu15/smu_v15_0_8_ppt.c | 3 +- drivers/gpu/drm/bridge/display-connector.c | 11 +- drivers/gpu/drm/display/drm_dp_helper.c | 12 + drivers/gpu/drm/drm_exec.c | 6 +- drivers/gpu/drm/drm_gpuvm.c | 3 +- drivers/gpu/drm/i915/display/intel_ddi.c | 2 + drivers/gpu/drm/i915/display/intel_dp.c | 9 +- drivers/gpu/drm/i915/display/intel_hdmi.c | 26 + drivers/gpu/drm/i915/display/intel_hdmi.h | 2 + drivers/gpu/drm/mediatek/mtk_crtc.c | 6 +- drivers/gpu/drm/mediatek/mtk_disp_ovl_adaptor.c | 7 +- drivers/gpu/drm/mediatek/mtk_hdmi_v2.c | 8 - drivers/gpu/drm/panthor/panthor_fw.c | 47 +- drivers/gpu/drm/vc4/vc4_irq.c | 2 +- drivers/gpu/drm/vc4/vc4_validate.c | 29 +- drivers/gpu/drm/vmwgfx/ttm_object.c | 7 +- drivers/gpu/drm/vmwgfx/vmwgfx_blit.c | 39 +- drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c | 49 +- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 20 +- drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 13 +- drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 13 +- drivers/gpu/drm/vmwgfx/vmwgfx_vkms.c | 17 +- drivers/gpu/drm/xe/tests/xe_pci.c | 6 + drivers/gpu/drm/xe/xe_device.c | 56 +- drivers/gpu/drm/xe/xe_device.h | 4 +- drivers/gpu/drm/xe/xe_exec.c | 22 +- drivers/gpu/drm/xe/xe_gt_debugfs.c | 4 +- drivers/gpu/drm/xe/xe_hw_engine.c | 2 + drivers/gpu/drm/xe/xe_hw_engine_types.h | 8 + drivers/gpu/drm/xe/xe_oa.c | 7 + drivers/gpu/drm/xe/xe_oa_types.h | 3 + drivers/gpu/drm/xe/xe_pci.c | 15 +- drivers/gpu/drm/xe/xe_pt.c | 13 +- drivers/gpu/drm/xe/xe_reg_whitelist.c | 87 ++- drivers/gpu/drm/xe/xe_reg_whitelist.h | 4 + drivers/gpu/drm/xe/xe_vm.c | 3 +- drivers/hv/mshv_eventfd.c | 41 +- drivers/hv/mshv_irq.c | 2 +- drivers/hv/mshv_portid_table.c | 6 +- drivers/hv/mshv_root_main.c | 41 +- drivers/hv/mshv_vtl_main.c | 1 + drivers/hv/vmbus_drv.c | 13 +- drivers/hwmon/adt7470.c | 131 ++-- drivers/hwmon/ina2xx.c | 61 +- drivers/hwmon/lm90.c | 4 +- drivers/hwmon/ltc4282.c | 4 +- drivers/hwmon/nct6775-core.c | 20 +- drivers/hwmon/npcm750-pwm-fan.c | 11 + drivers/hwmon/nzxt-smart2.c | 2 +- drivers/hwmon/pmbus/pmbus_core.c | 7 +- drivers/hwmon/sht3x.c | 9 +- drivers/i2c/busses/i2c-amd-mp2-plat.c | 4 +- drivers/i2c/busses/i2c-bcm-iproc.c | 11 + drivers/i2c/busses/i2c-designware-platdrv.c | 80 +++ drivers/i2c/busses/i2c-imx.c | 54 +- drivers/i2c/busses/i2c-jz4780.c | 5 +- drivers/i2c/busses/i2c-k1.c | 10 +- drivers/i2c/busses/i2c-qcom-cci.c | 18 +- drivers/infiniband/hw/mana/main.c | 40 +- drivers/infiniband/hw/mana/mana_ib.h | 14 + drivers/infiniband/hw/mana/qp.c | 68 ++- .../iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c | 15 + drivers/iommu/io-pgfault.c | 24 +- drivers/iommu/iommufd/device.c | 2 +- drivers/iommu/iommufd/eventq.c | 2 + drivers/iommu/iommufd/pages.c | 3 + drivers/iommu/iommufd/viommu.c | 22 +- .../media/platform/chips-media/wave5/wave5-hw.c | 3 + .../platform/chips-media/wave5/wave5-vpu-enc.c | 5 +- .../platform/chips-media/wave5/wave5-vpuapi.h | 1 + drivers/net/can/c_can/c_can_main.c | 8 +- drivers/net/can/ctucanfd/ctucanfd_base.c | 14 +- drivers/net/can/ctucanfd/ctucanfd_pci.c | 3 +- drivers/net/can/rcar/rcar_canfd.c | 32 +- drivers/net/can/softing/softing_fw.c | 46 +- drivers/net/can/usb/ems_usb.c | 43 ++ drivers/net/can/usb/etas_es58x/es58x_core.c | 1 - drivers/net/can/usb/gs_usb.c | 4 +- drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 1 + drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 13 +- drivers/net/can/usb/peak_usb/pcan_usb_core.c | 1 - drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 40 +- drivers/net/can/usb/peak_usb/pcan_usb_pro.c | 20 +- drivers/net/dsa/mt7530-mdio.c | 11 +- drivers/net/dsa/mt7530.c | 86 ++- drivers/net/ethernet/intel/e1000/e1000_main.c | 2 +- drivers/net/ethernet/intel/ice/ice_dpll.c | 19 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 10 +- drivers/net/ethernet/intel/ice/ice_main.c | 10 + drivers/net/ethernet/intel/ice/ice_vf_lib.c | 27 + .../net/ethernet/intel/ice/ice_vf_lib_private.h | 1 + drivers/net/ethernet/intel/ice/virt/queues.c | 21 + drivers/net/ethernet/intel/idpf/idpf_dev.c | 2 +- drivers/net/ethernet/intel/idpf/idpf_lib.c | 2 +- drivers/net/ethernet/intel/idpf/idpf_txrx.c | 5 +- drivers/net/ethernet/intel/idpf/idpf_txrx.h | 2 +- drivers/net/ethernet/intel/idpf/idpf_vf_dev.c | 2 +- drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 5 +- drivers/net/ethernet/intel/idpf/idpf_virtchnl.h | 2 +- drivers/net/ethernet/intel/igbvf/netdev.c | 2 - drivers/net/ethernet/intel/igc/igc_main.c | 3 +- drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 12 + drivers/net/ethernet/marvell/octeontx2/af/cgx.h | 1 + drivers/net/ethernet/marvell/octeontx2/af/mbox.h | 1 + drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 2 + .../net/ethernet/marvell/octeontx2/af/rvu_cgx.c | 79 +++ .../net/ethernet/marvell/octeontx2/af/rvu_nix.c | 97 ++- .../net/ethernet/marvell/octeontx2/af/rvu_npc.c | 49 +- .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 8 +- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en.h | 1 - drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 7 - drivers/net/ethernet/mellanox/mlx5/core/en_stats.c | 19 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 143 +++-- drivers/net/ethernet/microsoft/mana/mana_ethtool.c | 23 +- drivers/net/ethernet/nvidia/forcedeth.c | 4 +- drivers/net/ethernet/qlogic/qede/qede_main.c | 44 +- drivers/net/ethernet/realtek/rtase/rtase_main.c | 3 + drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c | 14 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 3 +- drivers/net/ethernet/wangxun/libwx/wx_lib.c | 2 + drivers/net/phy/phylink.c | 29 +- drivers/net/veth.c | 4 +- drivers/net/vxlan/vxlan_core.c | 21 +- drivers/net/vxlan/vxlan_mdb.c | 4 +- drivers/net/wireless/ath/ath12k/mac.c | 5 +- .../net/wireless/marvell/mwifiex/11n_rxreorder.c | 2 +- drivers/of/address.c | 22 +- drivers/of/of_reserved_mem.c | 14 +- drivers/pci/controller/dwc/pci-imx6.c | 9 +- drivers/phy/qualcomm/phy-qcom-m31-eusb2.c | 2 +- drivers/phy/xilinx/phy-zynqmp.c | 62 +- drivers/pinctrl/Kconfig | 2 + drivers/pinctrl/devicetree.c | 4 + drivers/pinctrl/pinctrl-amd.c | 3 +- drivers/pinctrl/qcom/pinctrl-msm.c | 8 +- drivers/pinctrl/qcom/pinctrl-sc8280xp.c | 21 +- drivers/power/supply/bq25890_charger.c | 2 +- drivers/power/supply/macsmc-power.c | 52 +- drivers/power/supply/max17040_battery.c | 6 +- drivers/ptp/ptp_netc.c | 15 +- drivers/s390/block/dasd_eckd.c | 11 +- drivers/s390/block/dasd_ioctl.c | 2 +- drivers/s390/crypto/pkey_cca.c | 15 +- drivers/s390/crypto/zcrypt_api.c | 4 +- drivers/s390/crypto/zcrypt_ccamisc.c | 89 ++- drivers/s390/crypto/zcrypt_ccamisc.h | 6 +- drivers/s390/net/qeth_core_main.c | 3 + drivers/s390/scsi/zfcp_aux.c | 1 + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 10 +- drivers/scsi/libiscsi.c | 2 +- drivers/scsi/libiscsi_tcp.c | 8 +- drivers/scsi/libsas/sas_init.c | 37 +- drivers/scsi/libsas/sas_scsi_host.c | 15 + drivers/scsi/mpi3mr/mpi3mr_fw.c | 9 +- drivers/scsi/scsi_debug.c | 8 +- drivers/spi/spi-cadence.c | 26 +- drivers/spi/spi-nxp-fspi.c | 83 ++- drivers/spi/spi-qcom-qspi.c | 3 +- drivers/spi/spi-qpic-snand.c | 22 +- drivers/target/target_core_iblock.c | 6 +- drivers/target/target_core_transport.c | 12 +- drivers/thunderbolt/xdomain.c | 40 +- drivers/ufs/core/ufs-rpmb.c | 2 - drivers/ufs/core/ufshcd.c | 46 +- drivers/usb/typec/ucsi/ucsi.c | 88 +-- drivers/usb/typec/ucsi/ucsi.h | 1 + fs/afs/fsclient.c | 5 +- fs/afs/internal.h | 3 +- fs/binfmt_misc.c | 54 +- fs/btrfs/block-group.c | 34 +- fs/btrfs/block-rsv.c | 19 +- fs/btrfs/disk-io.c | 58 +- fs/btrfs/extent_io.c | 6 - fs/btrfs/extent_io.h | 6 + fs/btrfs/fs.h | 9 + fs/btrfs/raid56.c | 15 +- fs/btrfs/super.c | 8 +- fs/btrfs/zoned.c | 27 +- fs/erofs/Kconfig | 36 +- fs/erofs/Makefile | 1 - fs/erofs/data.c | 4 +- fs/erofs/decompressor_lzma.c | 3 +- fs/erofs/fscache.c | 664 --------------------- fs/erofs/inode.c | 2 +- fs/erofs/internal.h | 76 +-- fs/erofs/ishare.c | 101 ++-- fs/erofs/super.c | 94 +-- fs/erofs/zdata.c | 6 - fs/iomap/ioend.c | 21 +- fs/netfs/buffered_read.c | 10 +- fs/netfs/internal.h | 1 + fs/netfs/main.c | 7 + fs/netfs/objects.c | 30 +- fs/netfs/read_pgpriv2.c | 3 +- fs/netfs/rolling_buffer.c | 22 +- fs/netfs/write_issue.c | 15 +- fs/ntfs/attrib.c | 10 + fs/ntfs/namei.c | 3 +- fs/ntfs/runlist.c | 50 +- fs/ocfs2/dir.c | 5 +- fs/proc/task_mmu.c | 34 +- fs/smb/client/cifssmb.c | 12 +- fs/smb/client/inode.c | 1 + fs/smb/server/connection.h | 5 + fs/smb/server/smb2pdu.c | 14 +- fs/smb/server/smb_common.c | 37 +- fs/smb/server/vfs_cache.c | 6 +- include/acpi/cppc_acpi.h | 5 +- include/drm/drm_exec.h | 20 +- include/hyperv/hvhdk_mini.h | 3 +- include/kvm/arm_vgic.h | 3 - include/linux/alloc_tag.h | 3 + include/linux/dma/qcom_bam_dma.h | 21 +- include/linux/ethtool.h | 1 + include/linux/iommu.h | 5 + include/linux/libata.h | 6 +- include/linux/memcontrol.h | 25 + include/linux/netfilter/nf_conntrack_sip.h | 2 +- include/linux/netfs.h | 1 + include/linux/rolling_buffer.h | 6 +- include/linux/slab.h | 19 +- include/linux/thunderbolt.h | 3 + include/net/bluetooth/hci_core.h | 4 +- include/net/ip_vs.h | 45 +- include/net/mana/mana.h | 15 +- include/net/netfilter/nf_conntrack_expect.h | 3 + include/net/netfilter/nf_tables.h | 4 +- include/net/xdp_sock.h | 1 + include/net/xsk_buff_pool.h | 9 +- include/scsi/libsas.h | 3 +- io_uring/cancel.c | 2 +- io_uring/net.c | 1 + io_uring/tctx.c | 7 +- io_uring/tctx.h | 1 + kernel/audit.c | 11 +- kernel/auditfilter.c | 6 +- kernel/events/uprobes.c | 2 +- kernel/sched/cpufreq_schedutil.c | 11 + kernel/sched/deadline.c | 3 +- kernel/trace/fprobe.c | 6 +- kernel/trace/ring_buffer.c | 2 + kernel/trace/trace_events.c | 4 +- kernel/trace/trace_events_filter.c | 3 + kernel/trace/trace_fprobe.c | 12 +- kernel/trace/trace_mmiotrace.c | 13 +- kernel/trace/trace_probe.c | 6 +- lib/alloc_tag.c | 9 + lib/assoc_array.c | 3 +- lib/test_fortify/Makefile | 1 + lib/test_hmm.c | 2 +- mm/huge_memory.c | 14 +- mm/hugetlb.c | 12 +- mm/memcontrol-v1.h | 6 +- mm/migrate_device.c | 5 +- mm/mm_init.c | 15 +- mm/page_reporting.c | 6 +- mm/percpu-km.c | 2 +- mm/slab.h | 28 +- mm/slab_common.c | 13 + mm/slub.c | 97 ++- mm/util.c | 2 +- mm/vmscan.c | 11 +- net/bluetooth/hci_conn.c | 14 +- net/bluetooth/hci_sync.c | 220 ++++--- net/bluetooth/hidp/core.c | 30 +- net/bluetooth/iso.c | 273 ++++++--- net/bluetooth/l2cap_core.c | 5 + net/bluetooth/mgmt.c | 84 ++- net/bluetooth/sco.c | 22 +- net/bridge/br_mrp.c | 2 +- net/bridge/br_multicast.c | 1 + net/can/isotp.c | 334 ++++++++--- net/can/j1939/bus.c | 2 + net/can/j1939/j1939-priv.h | 3 + net/can/j1939/main.c | 8 +- net/can/j1939/transport.c | 4 +- net/core/lwt_bpf.c | 4 +- net/core/pktgen.c | 4 +- net/core/skbuff.c | 18 +- net/ipv4/fou_core.c | 2 +- net/ipv4/netfilter/nf_nat_h323.c | 22 +- net/ipv4/nexthop.c | 25 +- net/ipv4/route.c | 2 - net/ipv4/udp_tunnel_nic.c | 32 +- net/ipv6/fib6_rules.c | 1 + net/ipv6/ip6_fib.c | 1 + net/ipv6/ip6_output.c | 2 +- net/ipv6/ndisc.c | 2 + net/mac80211/agg-tx.c | 4 +- net/mac80211/s1g.c | 4 + net/mpls/af_mpls.c | 1 + net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipvs/ip_vs_app.c | 4 +- net/netfilter/ipvs/ip_vs_conn.c | 192 ++++-- net/netfilter/ipvs/ip_vs_core.c | 190 +++--- net/netfilter/ipvs/ip_vs_proto_sctp.c | 19 +- net/netfilter/ipvs/ip_vs_proto_tcp.c | 48 +- net/netfilter/ipvs/ip_vs_proto_udp.c | 54 +- net/netfilter/ipvs/ip_vs_xmit.c | 42 +- net/netfilter/nf_conntrack_expect.c | 35 +- net/netfilter/nf_conntrack_sip.c | 2 +- net/netfilter/nf_nat_sip.c | 22 +- net/netfilter/nf_tables_api.c | 34 +- net/netfilter/nft_payload.c | 12 +- net/netfilter/xt_hashlimit.c | 16 +- net/openvswitch/actions.c | 12 +- net/openvswitch/meter.c | 33 +- net/rds/tcp.c | 8 +- net/sched/cls_u32.c | 7 + net/sched/sch_cake.c | 8 +- net/sctp/associola.c | 3 + net/sctp/sm_make_chunk.c | 17 +- net/smc/smc_core.c | 2 +- net/tipc/socket.c | 2 +- net/unix/af_unix.c | 1 + net/xdp/xsk.c | 257 +++++++- net/xdp/xsk_buff_pool.c | 13 +- net/xdp/xsk_queue.h | 65 +- security/keys/keyring.c | 14 +- security/keys/trusted-keys/trusted_dcp.c | 15 +- sound/core/pcm_native.c | 7 + sound/core/seq/seq_timer.c | 9 +- sound/core/timer.c | 2 + sound/core/ump.c | 1 + sound/hda/codecs/realtek/alc269.c | 4 +- sound/pci/lx6464es/lx6464es.c | 5 +- sound/pci/lx6464es/lx_core.c | 5 +- sound/soc/codecs/max98090.c | 5 +- sound/soc/codecs/max98095.c | 5 +- sound/soc/codecs/tas2562.c | 30 +- sound/soc/codecs/tas2781-i2c.c | 4 +- sound/soc/fsl/fsl_asrc.c | 2 +- sound/soc/fsl/fsl_easrc.c | 2 +- sound/soc/sdca/sdca_device.c | 2 +- sound/soc/sdca/sdca_fdl.c | 5 +- sound/soc/sdca/sdca_functions.c | 2 + sound/soc/sdca/sdca_ump.c | 4 +- sound/soc/sophgo/cv1800b-sound-adc.c | 10 +- sound/usb/6fire/chip.c | 4 + sound/usb/endpoint.c | 14 +- sound/usb/midi.c | 2 + sound/usb/midi2.c | 4 +- sound/usb/mixer_quirks.c | 2 +- tools/testing/selftests/clone3/clone3_set_tid.c | 2 +- tools/testing/selftests/filesystems/fclog.c | 4 +- tools/testing/selftests/lkdtm/tests.txt | 2 +- tools/testing/selftests/mm/mlock-random-test.c | 2 +- tools/testing/selftests/mm/pagemap_ioctl.c | 56 +- tools/testing/selftests/net/af_unix/.gitignore | 1 + tools/testing/selftests/net/af_unix/Makefile | 1 + tools/testing/selftests/net/af_unix/unix_listen.c | 187 ++++++ .../selftests/net/netfilter/nft_flowtable.sh | 14 +- tools/testing/selftests/seccomp/seccomp_bpf.c | 3 +- tools/tracing/rtla/src/timerlat_top.c | 2 +- 455 files changed, 6043 insertions(+), 3365 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/438 net: mpls: initialize rtm_tos in mpls_getroute()
7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yehyeong Lee <[email protected]>
[ Upstream commit 295dd295e2137e10e9a5b1891d97e0f08de76f03 ]
mpls_getroute() builds the RTM_NEWROUTE reply to an RTM_GETROUTE request by filling a struct rtmsg allocated from an skb whose data area is not zeroed (alloc_skb(NLMSG_GOODSIZE, ...)). It sets every field of the header except rtm_tos:
r = nlmsg_data(nlh); r->rtm_family = AF_MPLS; r->rtm_dst_len = 20; r->rtm_src_len = 0; r->rtm_table = RT_TABLE_MAIN; r->rtm_type = RTN_UNICAST; r->rtm_scope = RT_SCOPE_UNIVERSE; r->rtm_protocol = rt->rt_protocol; r->rtm_flags = 0;
struct rtmsg has no padding, so the one uninitialised byte rtm_tos (offset 3) is copied straight to user space on recvmsg(), leaking a byte of uninitialised heap memory. This is in contrast to mpls_dump_route(), which fills the very same header and does set rtm_tos = 0.
Initialize rtm_tos to 0, matching mpls_dump_route().
Reproduced with KMSAN by adding an MPLS route and issuing a non-RTM_F_FIB_MATCH RTM_GETROUTE for its label:
BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x36c/0x33f0 _copy_to_iter+0x36c/0x33f0 __skb_datagram_iter+0x196/0x12c0 skb_copy_datagram_iter+0x5b/0x210 netlink_recvmsg+0x37b/0xef0 ... Uninit was created at: __alloc_skb+0x8ca/0x10e0 mpls_getroute+0x1280/0x3a40 rtnetlink_rcv_msg+0x1138/0x15a0 ... Byte 19 of 64 is uninitialized
(byte 19 = nlmsghdr(16) + rtmsg offset 3 = rtm_tos)
--- net/mpls/af_mpls.c | 1 + 1 file changed, 1 insertion(+)
net/mpls/af_mpls.c +1 -0
@@ -2541,6 +2541,7 @@ static int mpls_getroute(struct sk_buff *in_skb, struct nlmsghdr *in_nlh, r->rtm_family =AF_MPLS ; r->rtm_dst_len =20 ; r->rtm_src_len =0 ; + r->rtm_tos =0 ; r->rtm_table =RT_TABLE_MAIN ; r->rtm_type =RTN_UNICAST ; r->rtm_scope =RT_SCOPE_UNIVERSE ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 2/438 mm/slab: decouple SLAB_NO_SHEAVES from SLAB_NO_OBJ_EXT
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harry Yoo (Oracle) <[email protected]>
commit 982e31382d9a1a3c8c4e6a13702a53711f4efe9f upstream.
Bootstrap caches are created with SLAB_NO_OBJ_EXT to disallow sheaves and obj_exts.
To allow disabling obj_exts while allowing sheaves, decouple SLAB_NO_SHEAVES from SLAB_NO_OBJ_EXT. Bootstrap caches now have both SLAB_NO_SHEAVES and SLAB_NO_OBJ_EXT.
No functional change intended.
--- include/linux/slab.h | 13 +++++++++++-- mm/slub.c | 10 ++++++---- 2 files changed, 17 insertions(+), 6 deletions(-)
include/linux/slab.h +11 -2
@@ -58,10 +58,13 @@ enum _slab_flag_bits {#endif _SLAB_OBJECT_POISON, _SLAB_CMPXCHG_DOUBLE, +#ifdef CONFIG_SLAB_OBJ_EXT _SLAB_NO_OBJ_EXT, -#if defined(CONFIG_SLAB_OBJ_EXT) && defined(CONFIG_64BIT) +#ifdef CONFIG_64BIT _SLAB_OBJ_EXT_IN_OBJ,#endif +#endif + _SLAB_NO_SHEAVES, _SLAB_FLAGS_LAST_BIT };
@@ -239,8 +242,14 @@ enum _slab_flag_bits {#endif #define SLAB_TEMPORARY SLAB_RECLAIM_ACCOUNT/* Objects are short-lived */ -/* Slab created using create_boot_cache */ +/* Slab caches without obj_exts array */ +#ifdef CONFIG_SLAB_OBJ_EXT #define SLAB_NO_OBJ_EXT __SLAB_FLAG_BIT(_SLAB_NO_OBJ_EXT) +#else +#define SLAB_NO_OBJ_EXT __SLAB_FLAG_UNUSED +#endif + +#define SLAB_NO_SHEAVES __SLAB_FLAG_BIT(_SLAB_NO_SHEAVES)#if defined(CONFIG_SLAB_OBJ_EXT ) && defined(CONFIG_64BIT )#define SLAB_OBJ_EXT_IN_OBJ __SLAB_FLAG_BIT(_SLAB_OBJ_EXT_IN_OBJ)
mm/slub.c +6 -4
@@ -7724,12 +7724,12 @@ static unsigned int calculate_sheaf_capacity(struct kmem_cache *s,return 0 ;/* -* Bootstrap caches can't have sheaves for now (SLAB_NO_OBJ_EXT). +* Bootstrap caches can't have sheaves for now (SLAB_NO_SHEAVES). * SLAB_NOLEAKTRACE caches (e.g., kmemleak's object_cache) must not * have sheaves to avoid recursion when sheaf allocation triggers * kmemleak tracking. */ -if (s->flags & (SLAB_NO_OBJ_EXT |SLAB_NOLEAKTRACE )) +if (s->flags & (SLAB_NO_SHEAVES |SLAB_NOLEAKTRACE ))return 0 ;/*
@@ -8511,7 +8511,8 @@ void __init kmem_cache_init(void)create_boot_cache (kmem_cache_node,"kmem_cache_node" ,sizeof (struct kmem_cache_node ), -SLAB_HWCACHE_ALIGN |SLAB_NO_OBJ_EXT ,0 ,0 ); +SLAB_HWCACHE_ALIGN |SLAB_NO_SHEAVES |SLAB_NO_OBJ_EXT , +0 ,0 );hotplug_node_notifier (slab_memory_callback,SLAB_CALLBACK_PRI );
@@ -8521,7 +8522,8 @@ void __init kmem_cache_init(void)create_boot_cache (kmem_cache,"kmem_cache" , offsetof(struct kmem_cache , per_node) + nr_node_ids *sizeof (struct kmem_cache_per_node_ptrs ), -SLAB_HWCACHE_ALIGN |SLAB_NO_OBJ_EXT ,0 ,0 ); +SLAB_HWCACHE_ALIGN |SLAB_NO_SHEAVES |SLAB_NO_OBJ_EXT , +0 ,0 ); kmem_cache =bootstrap (&boot_kmem_cache); kmem_cache_node =bootstrap (&boot_kmem_cache_node);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 3/438 lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled()
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harry Yoo (Oracle) <[email protected]>
commit a37b0066a10aabf3c968b4566706fb866eaf9a85 upstream.
mem_alloc_profiling_enabled() tells whether memalloc profiling is currently enabled. However, even when this function returns false, it can be enabled later.
However, this is not enough. Some optimizations can be applied only when memalloc profiling is permanently disabled. For example, to skip the creation of KMALLOC_NO_OBJ_EXT caches at boot time, mem_profiling must be set to "never", "0" w/ debugging on, or have been shutdown so that it can no longer be enabled.
Introduce mem_alloc_profiling_permanently_disabled() for this purpose.
--- include/linux/alloc_tag.h | 3 +++ lib/alloc_tag.c | 9 +++++++++ 2 files changed, 12 insertions(+)
include/linux/alloc_tag.h +3 -0
@@ -134,6 +134,8 @@ static inline bool mem_alloc_profiling_enabled(void) &mem_alloc_profiling_key); } +bool mem_alloc_profiling_permanently_disabled (void ); +static inline struct alloc_tag_counters alloc_tag_read (struct alloc_tag *tag) {struct alloc_tag_counters v = {0 ,0 };
@@ -239,6 +241,7 @@ static inline bool alloc_tag_is_inaccurate(struct alloc_tag *tag)#define DEFINE_ALLOC_TAG (_alloc_tag)static inline bool mem_alloc_profiling_enabled (void ) {return false; } +static inline bool mem_alloc_profiling_permanently_disabled (void ) {return true; }static inline void alloc_tag_add (union codetag_ref *ref,struct alloc_tag *tag,size_t bytes) {}static inline void alloc_tag_sub (union codetag_ref *ref,size_t bytes) {}
lib/alloc_tag.c +9 -0
@@ -26,6 +26,15 @@ static bool mem_profiling_support = true;static bool mem_profiling_support;#endif +/* +* Memory allocation profiling is permanently disabled and cannot be enabled. +* Must be called after setup_early_mem_profiling(). +*/ +bool mem_alloc_profiling_permanently_disabled (void ) +{ +return !mem_profiling_support; +} +static struct codetag_type *alloc_tag_cttype;#ifdef CONFIG_ARCH_MODULE_NEEDS_WEAK_PER_CPU
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 4/438 mm/slab: prevent unbounded recursion in free path with new kmalloc type
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harry Yoo (Oracle) <[email protected]>
commit d9e6a7623938968e3752b67e37eaff097e559a54 upstream.
Commit 280ea9c3154b ("mm/slab: avoid allocating slabobj_ext array from its own slab") avoided recursive allocation of obj_exts from kmalloc caches of the same size, by bumping the obj_exts array's allocation size whenever the array size equals the size of the object being allocated.
However, as reported by Danielle Costantino and Shakeel Butt, even slabs from kmalloc caches of different sizes can form a cycle by allocating obj_exts arrays from each other [1]:
What happened: a KMALLOC_NORMAL slab's obj_exts array (used by allocation profiling / memcg accounting) is itself kmalloc()'d from a KMALLOC_NORMAL cache, so the "slab holds another slab's obj_exts array" relation can form cycles. With sizeof(struct slabobj_ext) == 16 and the host's geometry:
- kmalloc-512 has 64 objects/slab -> array is 64*16 == 1024 bytes,
served from kmalloc-1k;
- kmalloc-1k has 32 objects/slab -> array is 32*16 == 512 bytes, served from kmalloc-512.
A kmalloc-512 slab and a kmalloc-1k slab therefore hold each other's obj_exts array. Discarding one frees the other's array, which empties and discards that slab, which frees the first's array, and so on:
__free_slab() -> free_slab_obj_exts() -> kfree() -> discard_slab() -> __free_slab() recurses along the cycle until the stack is exhausted.
With memory allocation profiling, this allows unbounded recursion in the free path and led to a stack overflow on a production host in the Meta fleet [1]:
BUG: TASK stack guard page was hit Oops: stack guard page RIP: 0010:kfree+0x8/0x5d0 Call Trace: __free_slab+0x66/0xc0 kfree+0x3f0/0x5d0 ... ( ~125x __free_slab <-> kfree ) ... <kernel driver freeing a resource> do_syscall_64
It is proposed [1] to resolve this issue by always serving the obj_exts array allocation from kmalloc caches (or large kmalloc) of sizes larger than the object size. However, as pointed out by Vlastimil Babka [2], this can waste an excessive amount of memory as slabs from large kmalloc sizes (e.g. kmalloc-8k) generally need obj_exts arrays much smaller than the object size.
Therefore, rather than bumping the size, let us take a different approach; disallow formation of cycles between kmalloc types when allocating obj_exts arrays. Currently, all obj_exts arrays are served from normal kmalloc caches. Cycles cannot be created if obj_exts arrays of normal kmalloc caches are served from a special kmalloc type that can never have obj_exts arrays.
To achieve this, create a new kmalloc type called KMALLOC_NO_OBJ_EXT. KMALLOC_NO_OBJ_EXT caches are created with SLAB_NO_OBJ_EXT flag when either 1) memory allocation profiling is not permanently disabled, or 2) kmalloc types with a priority higher than KMALLOC_CGROUP are aliased with KMALLOC_NORMAL.
Sheaf bootstrapping for KMALLOC_NO_OBJ_EXT caches now must be deferred because allocation of a barn can trigger obj_exts array allocation of normal kmalloc caches when the KMALLOC_NO_OBJ_EXT cache for that size is not ready yet. For simplicity, perform bootstrapping of sheaves for all kmalloc caches later.
Introduce a new slab alloc flag, SLAB_ALLOC_NO_OBJ_EXT, to prevent allocation of obj_exts arrays, and let kmalloc_slab() override the type to KMALLOC_NO_OBJ_EXT when specified. Note that kmalloc_type() remains unchanged because kmalloc_flags() bypasses the kmalloc fastpath.
Do not pass SLAB_ALLOC_NO_RECURSE to kmalloc_flags() in alloc_slab_obj_exts() and instead use SLAB_ALLOC_NO_OBJ_EXT only when the objects are allocated from normal kmalloc caches. While this prevents unbounded recursive allocation of obj_exts, it allows KMALLOC_NO_OBJ_EXT caches to have sheaves.
Since sheaf allocations specify SLAB_ALLOC_NO_RECURSE that prevents allocation of both sheaves and obj_exts arrays, the recursion depth is bounded.
obj_exts arrays for non-kmalloc-normal caches can now have a valid tag. Do not call mark_obj_codetag_empty() when freeing an obj_exts array to avoid false warnings. KMALLOC_NO_OBJ_EXT don't need this as they never allocate those arrays.
[[email protected]: Backport notes:
- Fix a minor conflict due to missing partitioned kmalloc caches in 7.1.
- Use __GFP_NO_OBJ_EXT instead of SLAB_ALLOC_NO_OBJ_EXT since slab's internal alloc_flags do not exist in 7.1.
- Since there is no way to distinguish between no obj_exts vs. no recursion in 7.1 due to lack of SLAB_ALLOC_* flags, sheaves for normal kmalloc caches are allocated from kmalloc-no-objext-* unlike upstream.
Also, allocations from kmalloc-no-objext cannot allocate sheaves and may observe slightly higher contention. Only 7.1 has this problem as kmalloc caches don't have sheaves in LTS kernels.
- Apply the __GFP_NO_OBJ_EXT flag to the !allow_spin path in alloc_slab_obj_exts(). ]
--- include/linux/slab.h | 6 +++ mm/slab.h | 28 +++++++++++++- mm/slab_common.c | 13 +++++++ mm/slub.c | 87 +++++++++++++++----------------------------- 4 files changed, 75 insertions(+), 59 deletions(-)
include/linux/slab.h +6 -0
@@ -642,6 +642,9 @@ enum kmalloc_cache_type {#endif #ifndef CONFIG_MEMCG KMALLOC_CGROUP = KMALLOC_NORMAL, +#endif +#ifndef CONFIG_SLAB_OBJ_EXT +KMALLOC_NO_OBJ_EXT =KMALLOC_NORMAL , #endifKMALLOC_RANDOM_START =KMALLOC_NORMAL , KMALLOC_RANDOM_END = KMALLOC_RANDOM_START + RANDOM_KMALLOC_CACHES_NR,
@@ -655,6 +658,9 @@ enum kmalloc_cache_type {#endif #ifdef CONFIG_MEMCG KMALLOC_CGROUP, +#endif +#ifdef CONFIG_SLAB_OBJ_EXT +KMALLOC_NO_OBJ_EXT , #endifNR_KMALLOC_TYPES };
mm/slab.h +26 -2
@@ -365,9 +365,13 @@ static inline struct kmem_cache * kmalloc_slab(size_t size, kmem_buckets *b, gfp_t flags, unsigned long caller) { unsigned int index; +enum kmalloc_cache_type type =kmalloc_type (flags, caller); + +if (flags & __GFP_NO_OBJ_EXT) + type =KMALLOC_NO_OBJ_EXT ;if (!b) - b = &kmalloc_caches[kmalloc_type (flags, caller)]; + b = &kmalloc_caches[type];if (size <=192 ) index = kmalloc_size_index[size_index_elem (size)];else
@@ -402,7 +406,8 @@ static inline bool is_kmalloc_normal(struct kmem_cache *s) {if (!is_kmalloc_cache (s))return false; -return !(s->flags & (SLAB_CACHE_DMA |SLAB_ACCOUNT |SLAB_RECLAIM_ACCOUNT )); + +return !(s->flags & (SLAB_CACHE_DMA |SLAB_ACCOUNT |SLAB_RECLAIM_ACCOUNT |SLAB_NO_OBJ_EXT )); }bool __kfree_rcu_sheaf (struct kmem_cache *s,void *obj);
@@ -505,6 +510,25 @@ static inline void metadata_access_disable(void)kasan_enable_current (); } +/* +* Return true if KMALLOC_NORMAL caches may need obj_exts arrays. +* +* Memory allocation profiling requires obj_exts for all caches. +* Memcg usually doesn't need them for normal kmalloc caches, but kmalloc types +* with a priority higher than KMALLOC_CGROUP can be aliased with KMALLOC_NORMAL. +*/ +static inline bool need_kmalloc_no_objext (void ) +{ +if (!mem_alloc_profiling_permanently_disabled ()) +return true; + +if (!mem_cgroup_kmem_disabled () && + (KMALLOC_NORMAL ==KMALLOC_RECLAIM )) +return true; + +return false; +} +#ifdef CONFIG_SLAB_OBJ_EXT /*
mm/slab_common.c +13 -0
@@ -843,6 +843,12 @@ EXPORT_SYMBOL(kmalloc_size_roundup);#define KMALLOC_RANDOM_NAME (N , sz)#endif +#ifdef CONFIG_SLAB_OBJ_EXT +#define KMALLOC_NO_OBJ_EXT_NAME (sz) .name[KMALLOC_NO_OBJ_EXT] = "kmalloc-no-objext-" #sz, +#else +#define KMALLOC_NO_OBJ_EXT_NAME (sz) +#endif +#define INIT_KMALLOC_INFO (__size, __short_size) \ { \ .name[KMALLOC_NORMAL] = "kmalloc-" #__short_size, \
@@ -850,6 +856,7 @@ EXPORT_SYMBOL(kmalloc_size_roundup);KMALLOC_CGROUP_NAME (__short_size) \KMALLOC_DMA_NAME (__short_size ) \KMALLOC_RANDOM_NAME (RANDOM_KMALLOC_CACHES_NR , __short_size) \ +KMALLOC_NO_OBJ_EXT_NAME (__short_size) \ .size = __size, \ }
@@ -957,6 +964,12 @@ new_kmalloc_cache(int idx, enum kmalloc_cache_type type)return ; } flags |=SLAB_ACCOUNT ; + }else if (IS_ENABLED (CONFIG_SLAB_OBJ_EXT ) && type ==KMALLOC_NO_OBJ_EXT ) { +if (!need_kmalloc_no_objext ()) { + kmalloc_caches[type][idx] = kmalloc_caches[KMALLOC_NORMAL ][idx]; +return ; + } + flags |=SLAB_NO_OBJ_EXT |SLAB_NO_MERGE ; }else if (IS_ENABLED (CONFIG_ZONE_DMA ) && (type ==KMALLOC_DMA )) { flags |=SLAB_CACHE_DMA ; }
mm/slub.c +30 -57
141 lines not on this page · raw message
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 5/438 ALSA: hda/realtek: Add quirk for HP Dragonfly Folio G3 2-in-1 (103c:8a05)
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Diesen <[email protected]>
[ Upstream commit bed0c8084044364f5ac3f3e89e1bbad423f6b0d4 ]
The HP Dragonfly Folio G3 2-in-1 also ships with PCI SSID 103c:8a05. On this unit the ALC245 codec reports subsystem id 103c:8a06 - the SSID that is already covered by commit 0a10faad5ca5 ("ALSA: hda/realtek: add quirk for HP Dragonfly Folio G3 2-in-1") - while the PCI SSID that SND_PCI_QUIRK matches against is 103c:8a05:
snd_hda_codec_alc269 ehdaudio0D0: ALC245: picked fixup for PCI SSID 103c:8a05 cs35l41-hda spi1-CSC3551:00-cs35l41-hda.0: CS35L41 Bound - SSID: 103C8A06
The existing entry therefore never applies here, the four CS35L41 amplifiers on SPI are not registered and the internal speakers stay silent.
Add the same fixup that the 8a06 entry uses: the four amplifiers bind and the speaker mute LED (codec GPIO 0x04) works.
--- sound/hda/codecs/realtek/alc269.c | 1 + 1 file changed, 1 insertion(+)
sound/hda/codecs/realtek/alc269.c +1 -0
@@ -7086,6 +7086,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x103c ,0x89d3 ,"HP EliteBook 645 G9 (MB 89D2)" ,ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF ),SND_PCI_QUIRK (0x103c ,0x89da ,"HP Spectre x360 14t-ea100" ,ALC245_FIXUP_HP_SPECTRE_X360_EU0XXX ),SND_PCI_QUIRK (0x103c ,0x89e7 ,"HP Elite x2 G9" ,ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED ), +SND_PCI_QUIRK (0x103c ,0x8a05 ,"HP Dragonfly Folio G3 2-in-1" ,ALC245_FIXUP_CS35L41_SPI_4_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x8a06 ,"HP Dragonfly Folio G3 2-in-1" ,ALC245_FIXUP_CS35L41_SPI_4_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x8a0f ,"HP Pavilion 14-ec1xxx" ,ALC287_FIXUP_HP_GPIO_LED ), SND_PCI_QUIRK(0x103c, 0x8a1f, "HP Laptop 14s-dr5xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 6/438 thunderbolt: Prevent XDomain delayed work use-after-free on disconnect
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <[email protected]>
[ Upstream commit 2c5d2d3c3f70cde2565d7b279b544893a2035842 ]
tb_xdp_handle_request() runs on system_wq and queues xd->state_work via queue_delayed_work() in three request handlers:PROPERTIES_CHANGED_REQUEST, UUID_REQUEST (via start_handshake), and LINK_STATE_CHANGE_REQUEST. Similarly, update_xdomain() queues xd->properties_changed_work when local properties change.
Concurrently, tb_xdomain_remove() calls stop_handshake() which does cancel_delayed_work_sync() on both delayed works. Later, tb_xdomain_unregister() calls device_unregister() which eventually frees the xdomain. Since commit 559c1e1e0134 ("thunderbolt: Run tb_xdp_handle_request() in system workqueue") moved the request handler off tb->wq, the handler and the remove path are no longer serialized. If queue_delayed_work() executes after cancel_delayed_work_sync() but before the xdomain is freed, the delayed work fires on a freed object.
Add xd->removing that tb_xdomain_remove() sets under xd->lock before calling stop_handshake(). Each external queue site holds the same lock and checks removing before calling queue_delayed_work(). This provides the mutual exclusion needed:
either the queue site acquires the lock first and queues work that the subsequent cancel will see, or the remove path acquires the lock first and the queue site observes removing == true and skips the queue.
--- drivers/thunderbolt/xdomain.c | 40 ++++++++++++++++++++++++++--------- include/linux/thunderbolt.h | 3 +++ 2 files changed, 33 insertions(+), 10 deletions(-)
drivers/thunderbolt/xdomain.c +30 -10
@@ -785,9 +785,13 @@ static void tb_xdp_handle_request(struct work_struct *work)* the xdomain related to this connection as well in * case there is a change in services it offers. */ -if (xd &&device_is_registered (&xd->dev)) -queue_delayed_work (tb->wq, &xd->state_work, -msecs_to_jiffies (XDOMAIN_SHORT_TIMEOUT )); +if (xd) { +mutex_lock (&xd->lock); +if (!xd->removing &&device_is_registered (&xd->dev)) +queue_delayed_work (tb->wq, &xd->state_work, +msecs_to_jiffies (XDOMAIN_SHORT_TIMEOUT )); +mutex_unlock (&xd->lock); + }break ;case UUID_REQUEST_OLD :
@@ -800,8 +804,12 @@ static void tb_xdp_handle_request(struct work_struct *work)* received UUID request from the remote host. */ if (!ret && xd && xd->state ==XDOMAIN_STATE_ERROR ) { -dev_dbg (&xd->dev,"restarting handshake\n" ); -start_handshake (xd); +mutex_lock (&xd->lock); +if (!xd->removing) { +dev_dbg (&xd->dev,"restarting handshake\n" ); +start_handshake (xd); + } +mutex_unlock (&xd->lock); }break ;
@@ -829,9 +837,13 @@ static void tb_xdp_handle_request(struct work_struct *work) ret =tb_xdp_link_state_change_response (ctl, route, sequence,0 ); - xd->target_link_width = lsc->tlw; -queue_delayed_work (tb->wq, &xd->state_work, -msecs_to_jiffies (XDOMAIN_SHORT_TIMEOUT )); +mutex_lock (&xd->lock); +if (!xd->removing) { + xd->target_link_width = lsc->tlw; +queue_delayed_work (tb->wq, &xd->state_work, +msecs_to_jiffies (XDOMAIN_SHORT_TIMEOUT )); + } +mutex_unlock (&xd->lock); }else {tb_xdp_error_response (ctl, route, sequence,ERROR_NOT_READY );
@@ -2074,6 +2086,10 @@ void tb_xdomain_remove(struct tb_xdomain *xd) {tb_xdomain_debugfs_remove (xd); +mutex_lock (&xd->lock); + xd->removing = true; +mutex_unlock (&xd->lock); +stop_handshake (xd);device_for_each_child_reverse (&xd->dev, xd, unregister_service);
@@ -2484,8 +2500,12 @@ static int update_xdomain(struct device *dev, void *data) xd =tb_to_xdomain (dev);if (xd) { -queue_delayed_work (xd->tb->wq, &xd->properties_changed_work, -msecs_to_jiffies (50 )); +mutex_lock (&xd->lock); +if (!xd->removing) +queue_delayed_work (xd->tb->wq, + &xd->properties_changed_work, +msecs_to_jiffies (50 )); +mutex_unlock (&xd->lock); }return 0 ;
include/linux/thunderbolt.h +3 -0
@@ -209,6 +209,8 @@ enum tb_link_width {* @link_width: Width of the downstream facing link * @link_usb4: Downstream link is USB4 * @is_unplugged: The XDomain is unplugged +* @removing: Set by tb_xdomain_remove() under @lock to prevent +* concurrent delayed work queueing * @needs_uuid: If the XDomain does not have @remote_uuid it will be * queried first * @service_ids: Used to generate IDs for the services
@@ -257,6 +259,7 @@ struct tb_xdomain {enum tb_link_width link_width;bool link_usb4;bool is_unplugged; +bool removing;bool needs_uuid;struct ida service_ids;struct ida in_hopids;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 7/438 KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: D Scott Phillips <[email protected]>
commit 8a570b19b4b16a8a3b5ffa2b332bd5613110b2d8 upstream.
In the nested state, the physical interrupt has already been deactivated through the HW bit in the LR. The extra deactivation would be harmless but can hit an errata case on AmpereOne, so avoid it here.
On AmpereOne, deactivating a physical interrupt through ICC_DIR_EL1 or ICC_EOIR1_EL1 (depending on EOImode) which is not active, but is the highest priority pending interrupt causes the cpu to lose the interrupt pending state and also prevents the delivery of future interrupts.
--- Documentation/arch/arm64/silicon-errata.rst | 4 ++++ arch/arm64/kvm/vgic/vgic-v3.c | 8 +++++++- 2 files changed, 11 insertions(+), 1 deletion(-)
Documentation/arch/arm64/silicon-errata.rst +4 -0
@@ -55,10 +55,14 @@ stable kernels. +----------------+-----------------+-----------------+-----------------------------+ | Ampere | AmpereOne | AC03_CPU_38 | AMPERE_ERRATUM_AC03_CPU_38 | +----------------+-----------------+-----------------+-----------------------------+ +| Ampere | AmpereOne | AC03_CPU_57 | N/A | ++----------------+-----------------+-----------------+-----------------------------+ | Ampere | AmpereOne AC04 | AC04_CPU_10 | AMPERE_ERRATUM_AC03_CPU_38 | +----------------+-----------------+-----------------+-----------------------------+ | Ampere | AmpereOne AC04 | AC04_CPU_23 | AMPERE_ERRATUM_AC04_CPU_23 | +----------------+-----------------+-----------------+-----------------------------+ +| Ampere | AmpereOne AC04 | AC04_CPU_29 | N/A | ++----------------+-----------------+-----------------+-----------------------------+ +----------------+-----------------+-----------------+-----------------------------+ | ARM | Cortex-A510 | #2457168 | ARM64_ERRATUM_2457168 | +----------------+-----------------+-----------------+-----------------------------+
arch/arm64/kvm/vgic/vgic-v3.c +7 -1
@@ -275,7 +275,13 @@ void vgic_v3_deactivate(struct kvm_vcpu lr =vgic_v3_compute_lr (vcpu, irq) & ~ICH_LR_ACTIVE_BIT ; } -if (lr &ICH_LR_HW ) +/* +* In the nested state, the irq has already been deactivated via the HW +* bit in the LR. Deactivating again would be harmless except AmpereOne +* errata AC03_CPU_57, AC04_CPU_29 could cause irq delivery to break if +* the deactivation hits the highest priority pending irq. +*/ +if ((lr &ICH_LR_HW ) && !vgic_state_is_nested (vcpu))vgic_v3_deactivate_phys (FIELD_GET (ICH_LR_PHYS_ID_MASK , lr));vgic_v3_fold_lr (vcpu, lr);
Greg Kroah-Hartman
maintainerPATCH 8/438 dmaengine: switchtec-dma: fix FIELD_GET misuse when programming SE threshold
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Carlier <[email protected]>
[ Upstream commit 9d12eb98582fec2578d17e025b13740dcfb57d8e ]
FIELD_GET(SE_THRESH_MASK, thresh) extracts bits [31:23] from thresh and right-shifts them, which is the inverse of the intended operation. Since thresh is derived from se_buf_len / 2 (at most 255), bits [31:23] are always zero, so the SE threshold is never actually programmed into the register.
Use FIELD_PREP() instead to correctly left-shift thresh into bits [31:23] of the valid_en_se register, consistent with the FIELD_PREP usage for the perf tuner config just above.
--- drivers/dma/switchtec_dma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/dma/switchtec_dma.c +1 -1
@@ -1099,7 +1099,7 @@ static int switchtec_dma_chan_init(struct switchtec_dma_dev *swdma_dev,dev_dbg (&pdev->dev,"Channel %d: SE buffer count %d\n" , i, se_buf_len); thresh = se_buf_len /2 ; - valid_en_se |=FIELD_GET (SE_THRESH_MASK , thresh); + valid_en_se |=FIELD_PREP (SE_THRESH_MASK , thresh);writel (valid_en_se, &swdma_chan->mmio_chan_fw->valid_en_se);/* request irqs */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 9/438 pinctrl: qcom: Unconditionally mark gpio as wakeup enable
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sneh Mankad <[email protected]>
[ Upstream commit 859e02a369ab328a77dfcabf59562100e55f9c5c ]
GPIO interrupts that are wakeup capable need to be forwarded to wakeup capable parent irqchip. This is done via writing to it's wakeup_enable bit.
Currently the bit is set only for PDC irqchip by checking skip_wake_irqs. skip_wake_irqs is set to differentiate between parent irqchips MPM and PDC. It is set when the parent irqchip is PDC to inform pinctrl about skipping the IRQ setting up at TLMM.
However, the functionality to forward GPIO interrupts during SoC low power mode is needed regardless of which parent irqchip it is. Without the functionality it is impossible for MPM irqchip to detect the GPIO interrupt during SoC low power mode since for MPM irqchip the skip_wake_irqs is always false.
Remove skip_wake_irqs condition when setting wakeup enable bit to allow forwarding GPIO interrupts for SoCs using MPM irqchip too.
--- drivers/pinctrl/qcom/pinctrl-msm.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/pinctrl/qcom/pinctrl-msm.c +4 -4
@@ -1242,12 +1242,12 @@ static int msm_gpio_irq_reqres(struct irq_data *d)/* * If the wakeup_enable bit is present and marked as available for the * requested GPIO, it should be enabled when the GPIO is marked as -* wake irq in order to allow the interrupt event to be transfered to -* the PDC HW. +* wake irq in order to allow the interrupt event to be transferred to +* the PDC/MPM HW. * While the name implies only the wakeup event, it's also required for * the interrupt event. */ -if (test_bit (d->hwirq, pctrl->skip_wake_irqs) && g->intr_wakeup_present_bit) { +if (g->intr_wakeup_present_bit) {u32 intr_cfg;raw_spin_lock_irqsave (&pctrl->lock, flags);
@@ -1275,7 +1275,7 @@ static void msm_gpio_irq_relres(struct irq_data *d)unsigned long flags;/* Disable the wakeup_enable bit if it has been set in msm_gpio_irq_reqres() */ -if (test_bit (d->hwirq, pctrl->skip_wake_irqs) && g->intr_wakeup_present_bit) { +if (g->intr_wakeup_present_bit) {u32 intr_cfg;raw_spin_lock_irqsave (&pctrl->lock, flags);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 10/438 pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 437a8d2aa1aa442c4a176fdf4700a9b3bb0c8794 ]
Pins 143 and 151 were not included in the PDC wakeup map. They are normally used for PCIe2A and PCIe3a PERST# respectively, so they're unlikely to be excercised in practice, but still add them for the sake of completeness.
--- drivers/pinctrl/qcom/pinctrl-sc8280xp.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-)
drivers/pinctrl/qcom/pinctrl-sc8280xp.c +11 -10
@@ -1881,16 +1881,17 @@ static const struct msm_gpio_wakeirq_map sc8280xp_pdc_map[] = { { 126, 200 }, { 127, 225 }, { 128, 262 }, { 129, 201 }, { 130, 209 }, { 131, 173 }, { 132, 202 }, { 136, 210 }, { 138, 171 }, { 139, 226 }, { 140, 227 }, { 142, 228 }, - { 144, 229 }, { 145, 230 }, { 146, 231 }, { 148, 232 }, - { 149, 233 }, { 150, 234 }, { 152, 235 }, { 154, 212 }, - { 157, 213 }, { 161, 219 }, { 170, 236 }, { 171, 221 }, - { 174, 222 }, { 175, 237 }, { 176, 223 }, { 177, 170 }, - { 180, 238 }, { 181, 239 }, { 182, 240 }, { 183, 241 }, - { 184, 242 }, { 185, 243 }, { 190, 178 }, { 193, 184 }, - { 196, 185 }, { 198, 186 }, { 200, 174 }, { 201, 175 }, - { 205, 176 }, { 206, 177 }, { 208, 187 }, { 210, 198 }, - { 211, 199 }, { 212, 204 }, { 215, 205 }, { 220, 188 }, - { 221, 194 }, { 223, 195 }, { 225, 196 }, { 227, 197 }, + { 143, 261 }, { 144, 229 }, { 145, 230 }, { 146, 231 }, + { 148, 232 }, { 149, 233 }, { 150, 234 }, { 151, 264 }, + { 152, 235 }, { 154, 212 }, { 157, 213 }, { 161, 219 }, + { 170, 236 }, { 171, 221 }, { 174, 222 }, { 175, 237 }, + { 176, 223 }, { 177, 170 }, { 180, 238 }, { 181, 239 }, + { 182, 240 }, { 183, 241 }, { 184, 242 }, { 185, 243 }, + { 190, 178 }, { 193, 184 }, { 196, 185 }, { 198, 186 }, + { 200, 174 }, { 201, 175 }, { 205, 176 }, { 206, 177 }, + { 208, 187 }, { 210, 198 }, { 211, 199 }, { 212, 204 }, + { 215, 205 }, { 220, 188 }, { 221, 194 }, { 223, 195 }, + { 225, 196 }, { 227, 197 }, }; static struct msm_pinctrl_soc_data sc8280xp_pinctrl = {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 11/438 dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongling Zeng <[email protected]>
[ Upstream commit ab1150115e68a46b687eb38c1ab92782018c9f2c ]
When terminating DMA transfers, active descriptors are not properly reclaimed. Only cyclic descriptors were handled, leaving non-cyclic descriptors and their LLI chains to be permanently leaked.
Fix by using vchan_terminate_vdesc() which handles both cyclic and non-cyclic descriptors by adding them to desc_terminated queue for proper cleanup.
Add pchan->desc != pchan->done check to prevent double-adding completed descriptors, which would corrupt the list.
--- drivers/dma/sun6i-dma.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-)
drivers/dma/sun6i-dma.c +4 -7
@@ -945,16 +945,13 @@ static int sun6i_dma_terminate_all(struct dma_chan *chan)spin_lock_irqsave (&vchan->vc.lock, flags); -if (vchan->cyclic) { - vchan->cyclic = false; -if (pchan && pchan->desc) { -struct virt_dma_desc *vd = &pchan->desc->vd; -struct virt_dma_chan *vc = &vchan->vc; +if (pchan && pchan->desc && pchan->desc != pchan->done) { +struct virt_dma_desc *vd = &pchan->desc->vd; -list_add_tail (&vd->node, &vc->desc_completed); - } +vchan_terminate_vdesc (vd); } + vchan->cyclic = false;vchan_get_all_descriptors (&vchan->vc, &head);if (pchan) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 12/438 dmaengine: idxd: fix double free of wq, engine, and group structs
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuho Choi <[email protected]>
[ Upstream commit ec2d428b2e32dd157de8f86a86dd85c5b2c8f45c ]
The release callbacks for wq, engine, and group devices (idxd_conf_wq_release, idxd_conf_engine_release, idxd_conf_group_release) each call kfree() on the enclosing struct. The setup error paths and cleanup functions also call kfree() explicitly after put_device(), producing a double free whenever put_device() drops the reference count to zero and fires the release.
In the setup functions, device_initialize() is called before device_add(), so the reference count is exactly 1 at the error sites. put_device() unconditionally fires the release, which frees the struct; the subsequent explicit kfree() then operates on freed memory.
For idxd_setup_wqs(), the wq release callback also owns opcap_bmap and wqcfg. The error unwind additionally freed those fields explicitly before calling put_device(), causing further double frees on both.
Remove the redundant explicit kfree() calls from all setup error paths and cleanup functions for wq, engine, and group structs, delegating sole ownership of those allocations to the release callbacks.
--- drivers/dma/idxd/init.c | 36 +++++------------------------------- 1 file changed, 5 insertions(+), 31 deletions(-)
drivers/dma/idxd/init.c +5 -31
@@ -159,18 +159,12 @@ static void idxd_cleanup_interrupts(struct idxd_device *idxd)static void idxd_clean_wqs (struct idxd_device *idxd) { -struct idxd_wq *wq;struct device *conf_dev;int i;for (i =0 ; i < idxd->max_wqs; i++) { - wq = idxd->wqs[i]; -if (idxd->hw.wq_cap.op_config) -bitmap_free (wq->opcap_bmap); -kfree (wq->wqcfg); - conf_dev =wq_confdev (wq); + conf_dev =wq_confdev (idxd->wqs[i]);put_device (conf_dev); -kfree (wq); }bitmap_free (idxd->wq_enable_map);kfree (idxd->wqs);
@@ -212,7 +206,6 @@ static int idxd_setup_wqs(struct idxd_device *idxd) rc =dev_set_name (conf_dev,"wq%d.%d" , idxd->id, wq->id);if (rc <0 ) {put_device (conf_dev); -kfree (wq); goto err_unwind; }
@@ -227,7 +220,6 @@ static int idxd_setup_wqs(struct idxd_device *idxd) wq->wqcfg =kzalloc_node (idxd->wqcfg_size,GFP_KERNEL ,dev_to_node (dev));if (!wq->wqcfg) {put_device (conf_dev); -kfree (wq); rc = -ENOMEM ; goto err_unwind; }
@@ -235,9 +227,7 @@ static int idxd_setup_wqs(struct idxd_device *idxd)if (idxd->hw.wq_cap.op_config) { wq->opcap_bmap =bitmap_zalloc (IDXD_MAX_OPCAP_BITS ,GFP_KERNEL );if (!wq->opcap_bmap) { -kfree (wq->wqcfg);put_device (conf_dev); -kfree (wq); rc = -ENOMEM ; goto err_unwind; }
@@ -252,13 +242,8 @@ static int idxd_setup_wqs(struct idxd_device *idxd) err_unwind:while (--i >=0 ) { - wq = idxd->wqs[i]; -if (idxd->hw.wq_cap.op_config) -bitmap_free (wq->opcap_bmap); -kfree (wq->wqcfg); - conf_dev =wq_confdev (wq); + conf_dev =wq_confdev (idxd->wqs[i]);put_device (conf_dev); -kfree (wq); }bitmap_free (idxd->wq_enable_map);
@@ -270,15 +255,12 @@ static int idxd_setup_wqs(struct idxd_device *idxd)static void idxd_clean_engines (struct idxd_device *idxd) { -struct idxd_engine *engine;struct device *conf_dev;int i;for (i =0 ; i < idxd->max_engines; i++) { - engine = idxd->engines[i]; - conf_dev =engine_confdev (engine); + conf_dev =engine_confdev (idxd->engines[i]);put_device (conf_dev); -kfree (engine); }kfree (idxd->engines); }
@@ -313,7 +295,6 @@ static int idxd_setup_engines(struct idxd_device *idxd) rc =dev_set_name (conf_dev,"engine%d.%d" , idxd->id, engine->id);if (rc <0 ) {put_device (conf_dev); -kfree (engine); goto err; }
@@ -324,10 +305,8 @@ static int idxd_setup_engines(struct idxd_device *idxd) err:while (--i >=0 ) { - engine = idxd->engines[i]; - conf_dev =engine_confdev (engine); + conf_dev =engine_confdev (idxd->engines[i]);put_device (conf_dev); -kfree (engine); }kfree (idxd->engines);
@@ -336,13 +315,10 @@ static int idxd_setup_engines(struct idxd_device *idxd)static void idxd_clean_groups (struct idxd_device *idxd) { -struct idxd_group *group;int i;for (i =0 ; i < idxd->max_groups; i++) { - group = idxd->groups[i]; -put_device (group_confdev (group)); -kfree (group); +put_device (group_confdev (idxd->groups[i])); }kfree (idxd->groups); }
@@ -377,7 +353,6 @@ static int idxd_setup_groups(struct idxd_device *idxd) rc =dev_set_name (conf_dev,"group%d.%d" , idxd->id, group->id);if (rc <0 ) {put_device (conf_dev); -kfree (group); goto err; }
@@ -402,7 +377,6 @@ static int idxd_setup_groups(struct idxd_device *idxd)while (--i >=0 ) { group = idxd->groups[i];put_device (group_confdev (group)); -kfree (group); }kfree (idxd->groups);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 13/438 dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuho Choi <[email protected]>
[ Upstream commit ee1d7274102285d78a53161fc705a8d8cd40b066 ]
The failed_dev_add and failed_dev_name paths drop the file-device reference while wq->wq_lock is still held. If put_device(fdev) drops the last reference, idxd_file_dev_release() runs synchronously and tries to take wq->wq_lock again, deadlocking.
Those paths also fall through into the later ctx cleanup labels even though idxd_file_dev_release() owns that cleanup and frees ctx. This can make idxd_xa_pasid_remove(ctx) and kfree(ctx) operate on a freed context.
Move idxd_wq_get() before file-device setup can fail, since the release callback always calls idxd_wq_put(). Then unlock wq->wq_lock before put_device(fdev) and return directly from the file-device setup failure path, leaving ctx cleanup to the release callback.
--- drivers/dma/idxd/cdev.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/dma/idxd/cdev.c +3 -1
@@ -288,6 +288,7 @@ static int idxd_cdev_open(struct inode *inode, struct file *filp) fdev->parent =cdev_dev (idxd_cdev); fdev->bus = &dsa_bus_type; fdev->type = &idxd_cdev_file_type; +idxd_wq_get (wq); rc =dev_set_name (fdev,"file%d" , ctx->id);if (rc <0 ) {
@@ -301,13 +302,14 @@ static int idxd_cdev_open(struct inode *inode, struct file *filp) goto failed_dev_add; } -idxd_wq_get (wq);mutex_unlock (&wq->wq_lock);return 0 ; failed_dev_add: failed_dev_name: +mutex_unlock (&wq->wq_lock);put_device (fdev); +return rc; failed_ida: failed_set_pasid:if (device_user_pasid_enabled (idxd))
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 14/438 iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolin Chen <[email protected]>
[ Upstream commit c3b8ee84a965058b41275069d4696f37a8b14bf6 ]
arm_vsmmu_vsid_to_sid() maps a guest's vSID to a single physical Stream ID taken from master->streams[0], assuming a device has exactly one stream. A device with several streams gets only its first one mapped, so a guest vSID invalidation cannot reach the others' ATC and IOTLB entries; a device with none makes master->streams a ZERO_SIZE_PTR, read out of bounds.
Add an arm_vsmmu_vdevice_init() op to reject the vDEVICE with -EOPNOTSUPP when master->num_streams is not one, rather than mapping it silently.
--- .../iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c +15 -0
@@ -297,6 +297,20 @@ static int arm_vsmmu_vsid_to_sid(struct arm_vsmmu *vsmmu, u32 vsid, u32 *sid)return ret; } +static int arm_vsmmu_vdevice_init (struct iommufd_vdevice *vdev) +{ +struct device *dev =iommufd_vdevice_to_device (vdev); +struct arm_smmu_master *master =dev_iommu_priv_get (dev); + +/* +* arm_vsmmu_vsid_to_sid() maps a vSID to master->streams[0] alone, so +* more streams would leave the rest stale and none reads out of bounds. +*/ +if (master->num_streams !=1 ) +return -EOPNOTSUPP ; +return 0 ; +} +/* This is basically iommu_viommu_arm_smmuv3_invalidate in u64 for conversion */ struct arm_vsmmu_invalidation_cmd { union {
@@ -403,6 +417,7 @@ int arm_vsmmu_cache_invalidate(struct iommufd_viommu *viommu,static const struct iommufd_viommu_ops arm_vsmmu_ops = { .alloc_domain_nested = arm_vsmmu_alloc_domain_nested, .cache_invalidate = arm_vsmmu_cache_invalidate, + .vdevice_init = arm_vsmmu_vdevice_init, }; size_t arm_smmu_get_viommu_size(struct device *dev,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 15/438 gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe()
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <[email protected]>
[ Upstream commit 7a7baebd9f23ba4f24796775472b2fd00dcd95d9 ]
The memory allocated for priv->blob.data is not freed in the error paths that follow the fops_buf_size_set() call in gpio_la_poll_probe(), as well as in the remove function. Fix that by using device managed action to free the memory on remove.
--- drivers/gpio/gpio-sloppy-logic-analyzer.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/gpio/gpio-sloppy-logic-analyzer.c +10 -0
@@ -161,6 +161,13 @@ static int fops_buf_size_get(void *data, u64 *val)return 0 ; } +static void fops_buf_release (void *data) +{ +struct gpio_la_poll_priv *priv = data; + +vfree (priv->blob.data); +} +static int fops_buf_size_set (void *data,u64 val) {struct gpio_la_poll_priv *priv = data;
@@ -239,6 +246,9 @@ static int gpio_la_poll_probe(struct platform_device *pdev)return ret;fops_buf_size_set (priv,GPIO_LA_DEFAULT_BUF_SIZE ); + ret =devm_add_action_or_reset (dev, fops_buf_release, priv); +if (ret) +return ret; priv->descs =devm_gpiod_get_array (dev,"probe" ,GPIOD_IN );if (IS_ERR (priv->descs))
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 16/438 selftests/lkdtm: rename STACKLEAK_ERASING to KSTACK_ERASE
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haofeng Li <[email protected]>
[ Upstream commit b3a7aa9c0020ae549a0d4964867ff66d2bd61709 ]
Commit 57fbad15c2ee ("stackleak: Rename STACKLEAK to KSTACK_ERASE") renamed the LKDTM crash type and selftest configuration but missed the entry in tests.txt.
As a result, the selftest generates STACKLEAK_ERASING.sh, which run.sh skips because the LKDTM DIRECT trigger only exposes KSTACK_ERASE. Rename the test entry so the generated runner uses the registered crash type.
--- tools/testing/selftests/lkdtm/tests.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/lkdtm/tests.txt +1 -1
@@ -78,7 +78,7 @@ USERCOPY_STACK_FRAME_TO USERCOPY_STACK_FRAME_FROM USERCOPY_STACK_BEYOND USERCOPY_KERNEL -STACKLEAK_ERASING OK: the rest of the thread stack is properly erased +KSTACK_ERASE OK: the rest of the thread stack is properly erased CFI_FORWARD_PROTO CFI_BACKWARD call trace:|ok: control flow unchanged FORTIFY_STRSCPY detected buffer overflow
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 17/438 selftests/seccomp: Fix pointer type mismatch build error
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuan-Ying Lee <[email protected]>
[ Upstream commit 3421b9b056a6576d0ebac1030eafb48ad0544092 ]
We hit the following build error while running the seccomp selftests in our testing.
CC seccomp_bpfseccomp_bpf.c: In function ‘UPROBE_setup’:
seccomp_bpf.c:5175:74: error: pointer type mismatch in conditional expression [-Wincompatible-pointer-types] 5175 | offset = get_uprobe_offset(variant->uretprobe ? probed_uretprobe : probed_uprobe); | ^
seccomp_bpf.c:5175:57: note: first expression has type ‘int (*)(void)’
5175 | offset = get_uprobe_offset(variant->uretprobe ? probed_uretprobe : probed_uprobe); | ^~~~~~~~~~~~~~~~
seccomp_bpf.c:5175:76: note: second expression has type ‘int (__attribute__((nocf_check)) *)(void)’ 5175 | offset = get_uprobe_offset(variant->uretprobe ? probed_uretprobe : probed_uprobe); | ^~~~~~~~~~~~~
get_uprobe_offset() takes a 'const void *' argument, so cast both operands to 'void *'.
--- tools/testing/selftests/seccomp/seccomp_bpf.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/testing/selftests/seccomp/seccomp_bpf.c +2 -1
@@ -5178,7 +5178,8 @@ FIXTURE_SETUP(UPROBE)ASSERT_GE (bit,0 ); } - offset =get_uprobe_offset (variant->uretprobe ? probed_uretprobe : probed_uprobe); + offset =get_uprobe_offset (variant->uretprobe ? (void *)probed_uretprobe + : (void *)probed_uprobe);ASSERT_GE (offset,0 );if (variant->uretprobe)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 18/438 ntfs: preserve RECALL_ON_OPEN on WSL special-file reparse points
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
[ Upstream commit 523307b8516fc740895238af8473aa0630b3e088 ]
When creating a WSL special file (socket, fifo, character or block device), __ntfs_create() sets FILE_ATTRIBUTE_RECALL_ON_OPEN in ni->flags as valid_reparse_data() requires for these tags. This flag is intentionally absent from $FILE_NAME, so the subsequent reload
ni->flags = fn->file_attributes;
drops it from ni->flags, the authoritative copy written back to $STANDARD_INFORMATION. The on-disk file_attributes becomes 0x00000404 instead of 0x00040404, and after a remount valid_reparse_data() rejects the reparse point while fsck reports "$REPARSE_POINT data is corrupted".
Preserve the RECALL_ON_OPEN bit across the reload. Symlinks do not set that bit, so they are unaffected.
--- fs/ntfs/namei.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/ntfs/namei.c +2 -1
@@ -683,7 +683,8 @@ static struct ntfs_inode *__ntfs_create(struct mnt_idmap *idmap, struct inode *dmutex_unlock (&dir_ni->mrec_lock);mutex_unlock (&ni->mrec_lock); - ni->flags = fn->file_attributes; + ni->flags = fn->file_attributes | + (ni->flags &FILE_ATTRIBUTE_RECALL_ON_OPEN );/* Set the sequence number. */ vi->i_generation = ni->seq_no;set_nlink (vi,1 );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 19/438 ata: sata_mv: accept 1 or 2 resources in platform probe
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <[email protected]>
[ Upstream commit ef19a9cf037957fe3a35df8355c76ff0a63a0436 ]
Board files in arch/arm/plat-orion, arch/arm/mach-dove, arch/arm/mach-mv78xx0 and arch/arm/mach-orion5x still register the "sata_mv" device with two resources (IORESOURCE_MEM plus IORESOURCE_IRQ). Those devices are rejected with -EINVAL, so SATA no longer probes on legacy Marvell Orion/Kirkwood-style boards.
Accept both 1 resource (DT, IRQ fetched via platform_get_irq()) and 2 resources (legacy, IRQ supplied as a second resource) so both probing paths work.
--- drivers/ata/sata_mv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/ata/sata_mv.c +1 -1
@@ -4026,7 +4026,7 @@ static int mv_platform_probe(struct platform_device *pdev)/* * Simple resource validation .. */ -if (unlikely (pdev->num_resources !=1 )) { +if (unlikely (pdev->num_resources !=1 && pdev->num_resources !=2 )) {dev_err (&pdev->dev,"invalid number of resources\n" );return -EINVAL ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 20/438 ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources()
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Radhey Shyam Pandey <[email protected]>
[ Upstream commit 4d99a91574c420decab56cc880fad0dc15b8a7a3 ]
On phy_init() failure the error path fallsthrough to disable_rsts, which deasserts the controller reset and then enters disable_phys calling phy_power_off() on PHYs that were never powered on. That corrupts the PHY power_count and triggers an extra runtime PM put.
Use a separate exit_phys path that unwinds with phy_exit() only and falls through to disable_clks while the controller remains in reset. Reserve phy_power_off() for the phy_power_on() failure path only, and skip masked-out ports in both unwind loops.
On phy_power_on() failure re-assert the controller reset before disabling clocks and regulators, matching the teardown order used by ahci_platform_enable_resources() and ahci_platform_disable_resources().
--- drivers/ata/ahci_ceva.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-)
drivers/ata/ahci_ceva.c +14 -4
@@ -211,7 +211,7 @@ static int ceva_ahci_platform_enable_resources(struct ahci_host_priv *hpriv) rc =phy_init (hpriv->phys[i]);if (rc) - goto disable_rsts; + goto exit_phys; }/* De-assert the controller reset */
@@ -230,14 +230,24 @@ static int ceva_ahci_platform_enable_resources(struct ahci_host_priv *hpriv)return 0 ; -disable_rsts: -ahci_platform_deassert_rsts (hpriv); - disable_phys:while (--i >=0 ) { +if (ahci_ignore_port (hpriv, i)) +continue ; +phy_power_off (hpriv->phys[i]);phy_exit (hpriv->phys[i]); } +ahci_platform_assert_rsts (hpriv); + goto disable_clks; + +exit_phys: +while (--i >=0 ) { +if (ahci_ignore_port (hpriv, i)) +continue ; + +phy_exit (hpriv->phys[i]); + } disable_clks:ahci_platform_disable_clks (hpriv);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 21/438 phy: qcom: m31-eusb2: Fix return value of init call
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krishna Kurapati <[email protected]>
[ Upstream commit 361f533a2dce2c2841fe4dc0c9d85a67117edf95 ]
The init call currently returns success irrespective of any failures during repeater init or clock enablement. Return appropriate error value in the init call failure path.
--- drivers/phy/qualcomm/phy-qcom-m31-eusb2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/phy/qualcomm/phy-qcom-m31-eusb2.c +1 -1
@@ -221,7 +221,7 @@ static int m31eusb2_phy_init(struct phy *uphy) disable_vreg:regulator_bulk_disable (M31_EUSB_NUM_VREGS , phy->vregs); -return 0 ; +return ret; }static int m31eusb2_phy_exit (struct phy *uphy)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 22/438 ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uday Khare <[email protected]>
[ Upstream commit 317e21532e6ffa1de026bdbce5ba98e1b70ca5c6 ]
In max98095_probe(), the -EPROBE_DEFER check after devm_clk_get() is broken due to a missing IS_ERR() guard.
The code intends to return -EPROBE_DEFER only when the clock lookup fails with that specific error. However, without IS_ERR() the check:
if (PTR_ERR(max98095->mclk) == -EPROBE_DEFER)
is called unconditionally, including when devm_clk_get() succeeds and returns a valid pointer. Calling PTR_ERR() on a valid pointer reinterprets its address as a signed long; the result is arbitrary and is almost never equal to -EPROBE_DEFER, so the check silently does nothing in the success case. When devm_clk_get() fails with any error other than -EPROBE_DEFER the check is also skipped, leaving max98095->mclk holding an error pointer with no indication to the caller.
This means a deferred probe will never actually be triggered for this device, and any non-EPROBE_DEFER clock error is silently swallowed with the error pointer left in the mclk field.
Fix this by adding the missing IS_ERR() guard around the PTR_ERR() call, matching the pattern already used in the sibling max98088 and wm8960 drivers.
--- sound/soc/codecs/max98095.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
sound/soc/codecs/max98095.c +3 -2
@@ -1987,8 +1987,9 @@ static int max98095_probe(struct snd_soc_component *component)int ret =0 ; max98095->mclk =devm_clk_get (component->dev,"mclk" ); -if (PTR_ERR (max98095->mclk) == -EPROBE_DEFER ) -return -EPROBE_DEFER ; +if (IS_ERR (max98095->mclk)) +if (PTR_ERR (max98095->mclk) == -EPROBE_DEFER ) +return -EPROBE_DEFER ;/* reset the codec, the DSP core, and disable all interrupts */ max98095_reset (component);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 23/438 ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uday Khare <[email protected]>
[ Upstream commit a792ce0fad61a70793ec565743f11d6ca534de59 ]
In max98090_probe(), the -EPROBE_DEFER check after devm_clk_get() is broken due to a missing IS_ERR() guard.
The code intends to return -EPROBE_DEFER only when the clock lookup fails with that specific error. However, without IS_ERR() the check:
if (PTR_ERR(max98090->mclk) == -EPROBE_DEFER)
is called unconditionally, including when devm_clk_get() succeeds and returns a valid pointer. Calling PTR_ERR() on a valid pointer reinterprets its address as a signed long; the result is arbitrary and is almost never equal to -EPROBE_DEFER, so the check silently does nothing in the success case. When devm_clk_get() fails with any error other than -EPROBE_DEFER the check is also skipped, leaving max98090->mclk holding an error pointer with no indication to the caller.
This means a deferred probe will never actually be triggered for this device, and any non-EPROBE_DEFER clock error is silently swallowed with the error pointer left in the mclk field.
Fix this by adding the missing IS_ERR() guard around the PTR_ERR() call, matching the pattern already used in the sibling max98088 and wm8960 drivers.
--- sound/soc/codecs/max98090.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
sound/soc/codecs/max98090.c +3 -2
@@ -2424,8 +2424,9 @@ static int max98090_probe(struct snd_soc_component *component)dev_dbg (component->dev,"max98090_probe\n" ); max98090->mclk =devm_clk_get (component->dev,"mclk" ); -if (PTR_ERR (max98090->mclk) == -EPROBE_DEFER ) -return -EPROBE_DEFER ; +if (IS_ERR (max98090->mclk)) +if (PTR_ERR (max98090->mclk) == -EPROBE_DEFER ) +return -EPROBE_DEFER ; max98090->component = component;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 24/438 of: reserved_mem: prevent OOB when too many dynamic regions are defined
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sang-Heon Jeon <[email protected]>
[ Upstream commit db3dbdfea1b8f38774419c5c2c14e4b81c48708d ]
On boot, fdt_scan_reserved_mem() saves each dynamically-placed /reserved-memory subnode into a local array of size MAX_RESERVED_REGIONS.
If the device tree defines more than MAX_RESERVED_REGIONS dynamically-placed regions, fdt_scan_reserved_mem() writes past the end of the local array.
Add a bounds check that logs an error and skips the excess regions, restoring the original behavior.
--- drivers/of/of_reserved_mem.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
drivers/of/of_reserved_mem.c +11 -3
@@ -351,6 +351,7 @@ int __init fdt_scan_reserved_mem(void) err =__reserved_mem_reserve_reg (child, uname);if (!err) count++; +/* * Save the nodes for the dynamically-placed regions * into an array which will be used for allocation right
@@ -358,10 +359,17 @@ int __init fdt_scan_reserved_mem(void)* or marked as no-map. This is done to avoid dynamically * allocating from one of the statically-placed regions. */ -if (err == -ENOENT &&of_get_flat_dt_prop (child,"size" ,NULL )) { - dynamic_nodes[dynamic_nodes_cnt] = child; - dynamic_nodes_cnt++; +if (err != -ENOENT || !of_get_flat_dt_prop (child,"size" ,NULL )) +continue ; + +if (dynamic_nodes_cnt ==MAX_RESERVED_REGIONS ) { +pr_err ("too many defined dynamic regions, skip '%s'\n" , + uname); +continue ; } + + dynamic_nodes[dynamic_nodes_cnt] = child; + dynamic_nodes_cnt++; }for (int i =0 ; i < dynamic_nodes_cnt; i++) {const char *uname;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 25/438 btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qu Wenruo <[email protected]>
[ Upstream commit 6881f45d0eb541f2cee8c37c84b3860a23823bb3 ]
[BUG]
The following script can lead to unexpected qgroup rescan failure:
# mkfs.btrfs -f -O quota $dev
# mount $dev $mnt
# mount -o remount,rescue=ibadroots $mnt
^^^^^ This above command is expected to fail # btrfs quota rescan -w $mnt
^^^^^ The above qgroup rescan is not expected to fail# btrfs qgroup show $mnt WARNING: qgroup data inconsistent, rescan recommended Qgroupid Referenced Exclusive Path -------- ---------- --------- ---- 0/5 16.00KiB 16.00KiB <toplevel>
The above short script will be converted to a proper fstests case.
[CAUSE]
Inside btrfs_reconfigure(), if either btrfs_check_options() or btrfs_check_features() failed, we will always have BTRFS_FS_STATE_REMOUNTING set for the fs until the next successful remount.
That BTRFS_FS_STATE_REMOUNTING flag will interrupt several operations, including:
- Qgroup rescan
- Auto defrag
- Space reclaim
[FIX]
Change the error handling of btrfs_check_options() and btrfs_check_features() to goto restore label.
--- fs/btrfs/super.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
fs/btrfs/super.c +5 -3
@@ -1518,12 +1518,14 @@ static int btrfs_reconfigure(struct fs_context *fc)sync_filesystem (sb);set_bit (BTRFS_FS_STATE_REMOUNTING , &fs_info->fs_state); -if (!btrfs_check_options (fs_info, &ctx->mount_opt, fc->sb_flags)) -return -EINVAL ; +if (!btrfs_check_options (fs_info, &ctx->mount_opt, fc->sb_flags)) { + ret = -EINVAL ; + goto restore; + } ret =btrfs_check_features (fs_info, !(fc->sb_flags &SB_RDONLY ));if (ret <0 ) -return ret; + goto restore;btrfs_ctx_to_info (fs_info, ctx);btrfs_remount_begin (fs_info, old_ctx.mount_opt, fc->sb_flags);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 26/438 btrfs: zoned: fix deadlock between metadata writeback and transaction commit
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Thumshirn <[email protected]>
[ Upstream commit 1ebe51c29fa9755d5b2fea28727c051117907cf8 ]
When writing out metadata extent buffers in a zoned filesystem, btree_writepages() holds fs_info->zoned_meta_io_lock across the whole writeback loop, including the call to btrfs_check_meta_write_pointer() -> check_bg_is_active().
For the tree-log block group, check_bg_is_active() may fail to activate the zone and fall back to btrfs_zone_finish_one_bg() to free an active zone. That path waits for the running transaction to commit while still holding zoned_meta_io_lock, but the committer needs that same lock to write out the tree extents, so the two tasks deadlock:
Task A (kworker, metadata writeback) Task B (fsstress, transaction commit) ------------------------------------ ------------------------------------- wb_workfn() btrfs_commit_transaction(T)
btree_writepages() btrfs_write_and_wait_transaction()
btrfs_zoned_meta_io_lock() btrfs_write_marked_extents()
btrfs_check_meta_write_pointer() btree_writepages()
check_bg_is_active() [treelog_bg] btrfs_zoned_meta_io_lock()
btrfs_zone_finish_one_bg() <blocks on zoned_meta_io_lock,
btrfs_zone_finish() held by Task A>
do_zone_finish()
btrfs_inc_block_group_ro()
btrfs_wait_for_commit()
<blocks waiting for commit
of transaction T, done by
Task B>
The sibling branch in check_bg_is_active() already drops zoned_meta_io_lock around do_zone_finish() for this exact reason. Do the same in the tree-log
branch: release the lock around btrfs_zone_finish_one_bg() and re-acquire it afterwards. The lock only protects fs_info->active_{meta,system}_bg, which this branch does not touch, and ctx->zoned_bg keeps a reference to the block group across the unlock, so nothing is lost while the lock is dropped.
This hang occasionally reproduces with fstests generic/475 on a zoned btrfs filesystem.
--- fs/btrfs/zoned.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/btrfs/zoned.c +5 -1
@@ -2188,7 +2188,11 @@ static bool check_bg_is_active(struct btrfs_eb_write_context *ctx,if (fs_info->treelog_bg == block_group->start) {if (!btrfs_zone_activate (block_group)) { -int ret_fin =btrfs_zone_finish_one_bg (fs_info); +int ret_fin; + +btrfs_zoned_meta_io_unlock (fs_info); + ret_fin =btrfs_zone_finish_one_bg (fs_info); +btrfs_zoned_meta_io_lock (fs_info);if (ret_fin !=1 || !btrfs_zone_activate (block_group))return false;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 27/438 btrfs: zoned: reset meta_write_pointer on zone reset
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Thumshirn <[email protected]>
[ Upstream commit 5fabb1cf25d723274009d7b759545fd59f230c9d ]
btrfs_reset_unused_block_groups() resets a block group's zone and sets alloc_offset back to 0 so the space can be reused, but it leaves meta_write_pointer pointing at the previous end of the zone.
Once the block group is reactivated and reused for metadata, newly allocated tree blocks live before that stale write pointer. btrfs_check_meta_write_pointer() then sees them behind the write pointer, so they can never be written out in sequential order: the dirty extent buffers are stranded and pin their btree_inode folios until unmount.
Reset meta_write_pointer back to the start of the block group for metadata and system block groups.
--- fs/btrfs/zoned.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
fs/btrfs/zoned.c +11 -0
@@ -3196,6 +3196,17 @@ int btrfs_reset_unused_block_groups(struct btrfs_space_info *space_info, u64 num reclaimed = bg->alloc_offset; bg->zone_unusable = bg->length - bg->zone_capacity; bg->alloc_offset =0 ; +/* +* The zone was just reset to empty, so alloc_offset went back to +* the start of the zone. For metadata/system block groups the +* write pointer must follow it back to the start of the zone; +* otherwise it stays stale at the previous (finished) zone end, +* and metadata written into the reused zone would sit behind the +* write pointer, could never be written out in sequential order, +* and would be stranded (pinning its folio) until unmount. +*/ +if (bg->flags & (BTRFS_BLOCK_GROUP_METADATA |BTRFS_BLOCK_GROUP_SYSTEM )) + bg->meta_write_pointer = bg->start;/* * This holds because we currently reset fully used then freed * block group.
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 28/438 btrfs: warn about extent buffer that can not be released
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qu Wenruo <[email protected]>
[ Upstream commit 83f7e52b7ed1c3e03b79123e20b6f6adf8d886bb ]
When we unmount the fs or during mount failures, btrfs will call invalidate_inode_pages() to release all btree inode folios.
However that function can return -EBUSY if any folios can not be invalidated.
This can be caused by:
- Some extent buffers are still held by btrfs
This is a logic error, as we should release all tree root nodes during unmount and mount failure handling.
- Some extent buffers are under readahead and haven't yet finished These are much rarer but valid cases.
In that case we should wait for those extent buffers.
Introduce a new helper invalidate_and_check_btree_folios() which will:
- Call invalidate_inode_pages2() and catch its return value If it returned 0 as expected, that's great and we can call it a day.
- Otherwise go through each extent buffer in buffer_tree Increase the ref by one first for the eb we're checking. This is to ensure the eb won't be freed after the readahead is finished.
For ebs that still have EXTENT_BUFFER_READING flag, wait for them to finish first.
After waiting for the readahead, check the refs of the eb and if it's still dirty.
If the eb ref count is greater than 2 (one for the buffer tree, one held by us), it means we are still holding the extent buffer somewhere else, which is a code bug.
If the eb is still dirty, it means a bug in transaction handling, e.g. the bug fixed by patch "btrfs: only release the dirty pages io tree after successful writes".
For either case, show a warning message about the eb, including its bytenr, owner, refs and flags.
And if it's a debug build, also trigger WARN_ON_ONCE() so that fstests can properly catch such situation.
Stable-dep-of: 51a0e8399858 ("btrfs: skip global block reserve accounting for rescue mounts")
--- fs/btrfs/disk-io.c | 53 ++++++++++++++++++++++++++++++++++++++++++-- fs/btrfs/extent_io.c | 6 ----- fs/btrfs/extent_io.h | 6 +++++ 3 files changed, 57 insertions(+), 8 deletions(-)
fs/btrfs/disk-io.c +51 -2
@@ -3276,6 +3276,55 @@ static bool fs_is_full_ro(const struct btrfs_fs_info *fs_info)return false; } +/* +* Try to wait for any metadata readahead, and invalidate all btree folios. +* +* If the invalidation failed, report any dirty/held extent buffers. +*/ +static void invalidate_and_check_btree_folios (struct btrfs_fs_info *fs_info) +{ +unsigned long index =0 ; +struct extent_buffer *eb; +int ret; + + ret =invalidate_inode_pages2 (fs_info->btree_inode->i_mapping); +if (likely (ret ==0 )) +return ; + +/* +* Some btree pages can not be invalidated, this happens when some tree +* blocks are still held (either by readahead or some task is holding a ref). +*/ +rcu_read_lock (); +xa_for_each (&fs_info->buffer_tree, index, eb) { +/* Increase the ref so that the eb won't disappear. */ +if (!refcount_inc_not_zero (&eb->refs)) +continue ; +rcu_read_unlock (); + +/* Wait for any readahead first. */ +if (test_bit (EXTENT_BUFFER_READING , &eb->bflags)) +wait_on_bit_io (&eb->bflags,EXTENT_BUFFER_READING , +TASK_UNINTERRUPTIBLE ); +/* +* The refs threshold is 2, one held by us at the beginning +* of the loop, one for the ownership in the buffer tree. +*/ +if (unlikely (refcount_read (&eb->refs) >2 ||extent_buffer_under_io (eb))) { +WARN_ON_ONCE (IS_ENABLED (CONFIG_BTRFS_DEBUG )); +btrfs_warn (fs_info, +"unable to release extent buffer %llu owner %llu gen %llu refs %u flags 0x%lx" , + eb->start,btrfs_header_owner (eb), +btrfs_header_generation (eb), +refcount_read (&eb->refs), eb->bflags); + } +free_extent_buffer (eb); +rcu_read_lock (); + } +rcu_read_unlock (); +invalidate_inode_pages2 (fs_info->btree_inode->i_mapping); +} +int __cold open_ctree (struct super_block *sb,struct btrfs_fs_devices *fs_devices) {u32 sectorsize;
@@ -3706,7 +3755,7 @@ int __cold open_ctree(struct super_block *sb, struct btrfs_fs_devices *fs_deviceif (fs_info->data_reloc_root)btrfs_drop_and_free_fs_root (fs_info, fs_info->data_reloc_root);free_root_pointers (fs_info, true); -invalidate_inode_pages2 (fs_info->btree_inode->i_mapping); +invalidate_and_check_btree_folios (fs_info); fail_sb_buffer:btrfs_stop_all_workers (fs_info);
@@ -4445,7 +4494,7 @@ void __cold close_ctree(struct btrfs_fs_info *fs_info)* We must make sure there is not any read request to * submit after we stop all workers. */ -invalidate_inode_pages2 (fs_info->btree_inode->i_mapping); +invalidate_and_check_btree_folios (fs_info);btrfs_stop_all_workers (fs_info);/*
fs/btrfs/extent_io.c +0 -6
@@ -2877,12 +2877,6 @@ bool try_release_extent_mapping(struct folio *folio, gfp_t mask)return try_release_extent_state (io_tree, folio); } -static int extent_buffer_under_io (const struct extent_buffer *eb) -{ -return (test_bit (EXTENT_BUFFER_WRITEBACK , &eb->bflags) || -test_bit (EXTENT_BUFFER_DIRTY , &eb->bflags)); -} -static bool folio_range_has_eb (struct folio *folio) {struct btrfs_folio_state *bfs;
fs/btrfs/extent_io.h +6 -0
@@ -327,6 +327,12 @@ static inline bool extent_buffer_uptodate(const struct extent_buffer *eb)return test_bit (EXTENT_BUFFER_UPTODATE , &eb->bflags); } +static inline bool extent_buffer_under_io (const struct extent_buffer *eb) +{ +return (test_bit (EXTENT_BUFFER_WRITEBACK , &eb->bflags) || +test_bit (EXTENT_BUFFER_DIRTY , &eb->bflags)); +} +int memcmp_extent_buffer (const struct extent_buffer *eb,const void *ptrv,unsigned long start,unsigned long len); void read_extent_buffer(const struct extent_buffer *eb, void *dst,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 29/438 btrfs: skip global block reserve accounting for rescue mounts
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dongjiang Zhu <[email protected]>
[ Upstream commit 51a0e8399858621442807a26057bcd1cd3ced046 ]
[BUG]
Mounting with rescue=ibadroots after corrupting the block group tree root triggers a NULL pointer dereference:
BUG: kernel NULL pointer dereference, address: 0000000000000100 RIP: 0010:btrfs_update_global_block_rsv+0x9d/0x1c0 [btrfs] Call Trace: fill_dummy_bgs+0xd4/0x120 [btrfs] open_ctree+0xc6e/0x1ca0 [btrfs] btrfs_get_tree+0x50d/0xa40 [btrfs]
The same crash occurs with a corrupted raid stripe tree root, via btrfs_read_block_groups() instead of fill_dummy_bgs().
[CAUSE]
With rescue=ibadroots, btrfs_read_roots() allows the mount to continue when either root cannot be read, leaving the corresponding root pointer NULL while its on-disk feature bit remains set.
btrfs_update_global_block_rsv() then dereferences the missing root based on the feature bit alone.
[FIX]
Rescue mounts are fully read-only and cannot start transactions, so the global reserve is never consumed. Under btrfs_is_full_ro(), mark the reserve as full and return before performing the accounting.
And since we need to check if the fs is mount fully RO, export fs_is_full_ro() as btrfs_is_full_ro(), and move it to fs.h.
--- fs/btrfs/block-rsv.c | 19 +++++++++++++++++-- fs/btrfs/disk-io.c | 11 +---------- fs/btrfs/fs.h | 9 +++++++++ 3 files changed, 27 insertions(+), 12 deletions(-)
fs/btrfs/block-rsv.c +17 -2
@@ -322,10 +322,25 @@ void btrfs_block_rsv_add_bytes(struct btrfs_block_rsv *block_rsv,void btrfs_update_global_block_rsv (struct btrfs_fs_info *fs_info) {struct btrfs_block_rsv *block_rsv = &fs_info->global_block_rsv; -struct btrfs_space_info *sinfo = block_rsv->space_info; +struct btrfs_space_info *sinfo;struct btrfs_root *root, *tmp; -u64 num_bytes =btrfs_root_used (&fs_info->tree_root->root_item);unsigned int min_items =1 ; +u64 num_bytes; + +/* +* A full read-only mount (rescue options) cannot start transactions, +* so the global reserve is never consumed. Mark it as full and skip +* the accounting. +*/ +if (btrfs_is_full_ro (fs_info)) { +spin_lock (&block_rsv->lock); + block_rsv->full = true; +spin_unlock (&block_rsv->lock); +return ; + } + + sinfo = block_rsv->space_info; + num_bytes =btrfs_root_used (&fs_info->tree_root->root_item);/* * The global block rsv is based on the size of the extent tree, the
fs/btrfs/disk-io.c +1 -10
@@ -3267,15 +3267,6 @@ int btrfs_check_features(struct btrfs_fs_info *fs_info, bool is_rw_mount)return 0 ; } -static bool fs_is_full_ro (const struct btrfs_fs_info *fs_info) -{ -if (!sb_rdonly (fs_info->sb)) -return false; -if (unlikely (fs_info->mount_opt &BTRFS_MOUNT_FULL_RO_MASK )) -return true; -return false; -} -/* * Try to wait for any metadata readahead, and invalidate all btree folios. *
@@ -3432,7 +3423,7 @@ int __cold open_ctree(struct super_block *sb, struct btrfs_fs_devices *fs_deviceWRITE_ONCE (fs_info->fs_error, -EUCLEAN );/* If the fs has any rescue options, no transaction is allowed. */ -if (fs_is_full_ro (fs_info)) +if (btrfs_is_full_ro (fs_info))WRITE_ONCE (fs_info->fs_error, -EROFS );/* Set up fs_info before parsing mount options */
fs/btrfs/fs.h +9 -0
@@ -1146,6 +1146,15 @@ void __btrfs_clear_fs_compat_ro(struct btrfs_fs_info *fs_info, u64 flag,#define btrfs_test_opt (fs_info, opt) ((fs_info)->mount_opt & \ BTRFS_MOUNT_##opt) +static inline bool btrfs_is_full_ro (const struct btrfs_fs_info *fs_info) +{ +if (!sb_rdonly (fs_info->sb)) +return false; +if (unlikely (fs_info->mount_opt &BTRFS_MOUNT_FULL_RO_MASK )) +return true; +return false; +} +static inline bool btrfs_fs_closing (const struct btrfs_fs_info *fs_info) {return unlikely (test_bit (BTRFS_FS_CLOSING_START , &fs_info->flags));
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 30/438 btrfs: raid56: fix an incorrect csum skip during scrub
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qu Wenruo <[email protected]>
[ Upstream commit 330dcc553f282e8dc0b88c9495b4c296465364e1 ]
Commit 7425a2894019 ("btrfs: introduce btrfs_bio_for_each_block_all() helper") uses the new helper to replace the nested loop inside verify_bio_data_sectors(), which simplifies the code.
However that also changed the behavior of "continue" when a block has no data checksum.
Previously the "continue" would skip the old for() loop, which would also increase @total_sector_nr.
Now the "continue" will skip the new btrfs_bio_for_each_block_all() loop, which doesn't update @total_sector_nr.
This means if we hit a block that has no data checksum, we will skip all the remaining blocks no matter if they have data checksum. As @total_sector_nr will never be updated, and that test_bit() will always return false.
Fix it by increasing @total_sector_nr before calling "continue".
--- fs/btrfs/raid56.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/btrfs/raid56.c +3 -1
@@ -1679,8 +1679,10 @@ static void verify_bio_data_sectors(struct btrfs_raid_bio *rbio,continue ;/* No csum for this sector, skip to the next sector. */ -if (!test_bit (total_sector_nr, rbio->csum_bitmap)) +if (!test_bit (total_sector_nr, rbio->csum_bitmap)) { + total_sector_nr++;continue ; + } expected_csum = rbio->csum_buf + total_sector_nr * fs_info->csum_size;btrfs_calculate_block_csum_pages (fs_info, paddrs, csum_buf);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 31/438 btrfs: zoned: skip fully truncated ordered extents at zone finish
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Thumshirn <[email protected]>
[ Upstream commit ab602da96a915d42dcb1b0b322e8daea0f71b51f ]
A fully truncated ordered extent (truncated_len == 0) wrote no data, so its ->csum_list is empty and btrfs_finish_ordered_zoned() trips:
assertion failed: !list_empty(&ordered->csum_list), in fs/btrfs/zoned.c:2141
Since commit 66ff4d366e7e a short or cancelled direct IO write finishes the unsubmitted ordered extent as truncated with uptodate = true instead of setting BTRFS_ORDERED_IOERR, so it now reaches btrfs_finish_ordered_zoned() rather than being skipped by the IOERR check in btrfs_finish_ordered_io(). generic/208 hits this on a zoned filesystem.
Return early for these, like the BTRFS_ORDERED_PREALLOC case; there is no zone append result to record and btrfs_finish_one_ordered() skips them too.
--- fs/btrfs/zoned.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
fs/btrfs/zoned.c +10 -0
@@ -2136,6 +2136,16 @@ void btrfs_finish_ordered_zoned(struct btrfs_ordered_extent *ordered)if (test_bit (BTRFS_ORDERED_PREALLOC , &ordered->flags))return ; +/* +* A fully truncated ordered extent wrote no data and so has +* no zone append result to record. +*/ +if (test_bit (BTRFS_ORDERED_TRUNCATED , &ordered->flags) && + ordered->truncated_len ==0 ) { +ASSERT (list_empty (&ordered->csum_list)); +return ; + } +ASSERT (!list_empty (&ordered->csum_list)); sum = list_first_entry(&ordered->csum_list, struct btrfs_ordered_sum, list); logical = sum->logical;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 32/438 ntfs: harden runlist realloc size calculations
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
[ Upstream commit 8bed376124ab4505b70083a2b91f2c7ef6d51e24 ]
Add a shared helper to safely convert runlist element counts to byte sizes using overflow checks, and use it in both ntfs_rl_realloc() and ntfs_rl_realloc_nofail().
--- fs/ntfs/runlist.c | 50 +++++++++++++++++++++++++---------------------- 1 file changed, 27 insertions(+), 23 deletions(-)
fs/ntfs/runlist.c +27 -23
@@ -71,29 +71,46 @@ static inline void ntfs_rl_mc(struct runlist_element *dstbase, int dst,* On success, return a pointer to the newly allocated, or recycled, memory. * On error, return -errno. */ -struct runlist_element *ntfs_rl_realloc (struct runlist_element *rl, -int old_size,int new_size) +static inline struct runlist_element *ntfs_rl_realloc_gfp (struct runlist_element *rl, +int old_size,int new_size,gfp_t gfp) {struct runlist_element *new_rl; +size_t new_bytes; + +if (old_size <0 || new_size <0 ) +return ERR_PTR (-EINVAL ); - old_size = old_size *sizeof (*rl); - new_size = new_size *sizeof (*rl);if (old_size == new_size)return rl; - new_rl =kvzalloc (new_size,GFP_NOFS ); +if (check_mul_overflow (new_size,sizeof (*rl), &new_bytes)) +return ERR_PTR (-EINVAL ); + + new_rl =kvzalloc (new_bytes, gfp);if (unlikely (!new_rl))return ERR_PTR (-ENOMEM );if (likely (rl !=NULL )) { -if (unlikely (old_size > new_size)) - old_size = new_size; -memcpy (new_rl, rl, old_size); +size_t old_bytes; + +if (check_mul_overflow (old_size,sizeof (*rl), &old_bytes)) { +kvfree (new_rl); +return ERR_PTR (-EINVAL ); + } +if (unlikely (old_bytes > new_bytes)) + old_bytes = new_bytes; +memcpy (new_rl, rl, old_bytes);kvfree (rl); }return new_rl; } +struct runlist_element *ntfs_rl_realloc (struct runlist_element *rl, +int old_size,int new_size) +{ +return ntfs_rl_realloc_gfp (rl, old_size, new_size,GFP_NOFS ); +} +/* * ntfs_rl_realloc_nofail - Reallocate memory for runlists * @rl: original runlist
@@ -118,21 +135,8 @@ struct runlist_element *ntfs_rl_realloc(struct runlist_element *rl,static inline struct runlist_element *ntfs_rl_realloc_nofail (struct runlist_element *rl,int old_size,int new_size) { -struct runlist_element *new_rl; - - old_size = old_size *sizeof (*rl); - new_size = new_size *sizeof (*rl); -if (old_size == new_size) -return rl; - - new_rl =kvmalloc (new_size,GFP_NOFS | __GFP_NOFAIL); -if (likely (rl !=NULL )) { -if (unlikely (old_size > new_size)) - old_size = new_size; -memcpy (new_rl, rl, old_size); -kvfree (rl); - } -return new_rl; +return ntfs_rl_realloc_gfp (rl, old_size, new_size, +GFP_NOFS | __GFP_NOFAIL); }/*
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 33/438 ntfs: drop stale page-cache when shrinking a non-resident attr
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
[ Upstream commit 4e646ecd44759e552b0b9ccd995f3f608daab414 ]
ntfs_non_resident_attr_shrink() shrinks attribute sizes but fails to trim the page cache. This leaves orphaned dirty folios beyond the new end of the attribute, leading to writeback failures (-ENOENT), data loss, and $EA chain corruption.
Fix this by truncating the page cache to the new size immediately after updating the sizes, preventing writeback from flushing out-of-range folios.
--- fs/ntfs/attrib.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
fs/ntfs/attrib.c +10 -0
@@ -4292,6 +4292,16 @@ static int ntfs_non_resident_attr_shrink(struct ntfs_inode *ni, const s64 newsiz ni->initialized_size = newsize; ctx->attr->data.non_resident.initialized_size =cpu_to_le64 (newsize); } + +/* +* Drop any page-cache folios that now lie beyond the shrunk +* attribute. The clusters backing them have just been freed and the +* runlist truncated, so leaving stale dirty folios around makes a +* later writeback map a vcn past the new allocation, which fails with +* -ENOENT and loses the write. +*/ +truncate_inode_pages (VFS_I (ni)->i_mapping, newsize); +/* Update data size in the index. */ if (ni->type ==AT_DATA && ni->name ==AT_UNNAMED )NInoSetFileNameDirty (ni);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 34/438 rtla/timerlat_top: Fix on-threshold actions firing on signal
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomas Glozar <[email protected]>
[ Upstream commit fafb66e5903c2bcfc7b7e259042a8282f18a6faa ]
A bug was reported when rtla-timerlat-top tool performs on-threshold actions, even though no threshold was hit. This is reproduced even if no threshold is set at all:
$ rtla timerlat top -q -c 0 --on-threshold shell,command='echo BAD'
BAD
Timer Latency
...The bug is due to incorrect logic in timerlat_top_bpf_main_loop(). The loop uses timerlat_bpf_wait(), the return values of which are:
- > 0 (number of ringbuffer entries): at least 1 CPU hit threshold
- = 0: time out
- < 0: wait was interrupted by a signal
Commit 3138df6f0cd0 ("rtla/timerlat: Exit top main loop on any non-zero wait_retval") changed the condition for "threshold hit" from "wait_reval == 1" (exactly 1 CPU hit threshold) to "wait_retval != 0", to fix a race where multiple CPUs hit the threshold at the same time.
That also made it incorrectly include a signal (< 0), coming from either duration expired (SIGALRM) or user interrupt (SIGINT).
Check for wait_retval greater than zero in the if condition to cover all return values correctly.
--- tools/tracing/rtla/src/timerlat_top.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/tracing/rtla/src/timerlat_top.c +1 -1
@@ -821,7 +821,7 @@ timerlat_top_bpf_main_loop(struct osnoise_tool *tool)if (!params->quiet)timerlat_print_stats (tool); -if (wait_retval !=0 ) { +if (wait_retval >0 ) {/* Stopping requested by tracer */ retval =common_threshold_handler (tool);if (retval)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 35/438 phy: zynqmp: fix clock error handling in xpsgtr_phy_init()
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Radhey Shyam Pandey <[email protected]>
[ Upstream commit e4779e2a16d600892aaf743438f6ce8cc4eb3c4c ]
Propagate clk_prepare_enable() failures to the caller instead of returning success, and disable the reference clock on initialization error paths to avoid leaking clock references when phy_exit() is not called.
--- drivers/phy/xilinx/phy-zynqmp.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/phy/xilinx/phy-zynqmp.c +9 -4
@@ -658,12 +658,13 @@ static int xpsgtr_phy_init(struct phy *phy) {struct xpsgtr_phy *gtr_phy =phy_get_drvdata (phy);struct xpsgtr_dev *gtr_dev = gtr_phy->dev; -int ret =0 ; +int ret;mutex_lock (>r_dev->gtr_mutex);/* Configure and enable the clock when peripheral phy_init call */ -if (clk_prepare_enable (gtr_dev->clk[gtr_phy->refclk])) + ret =clk_prepare_enable (gtr_dev->clk[gtr_phy->refclk]); +if (ret) goto out;/* Skip initialization if not required. */
@@ -673,7 +674,7 @@ static int xpsgtr_phy_init(struct phy *phy)if (gtr_dev->tx_term_fix) { ret =xpsgtr_phy_tx_term_fix (gtr_phy);if (ret <0 ) - goto out; + goto out_disable_clk; gtr_dev->tx_term_fix = false; }
@@ -687,7 +688,7 @@ static int xpsgtr_phy_init(struct phy *phy)*/ ret =xpsgtr_configure_pll (gtr_phy);if (ret) - goto out; + goto out_disable_clk;xpsgtr_lane_set_protocol (gtr_phy);
@@ -705,6 +706,10 @@ static int xpsgtr_phy_init(struct phy *phy)break ; } + goto out; + +out_disable_clk: +clk_disable_unprepare (gtr_dev->clk[gtr_phy->refclk]); out:mutex_unlock (>r_dev->gtr_mutex);return ret;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 36/438 phy: zynqmp: fix runtime PM leak on probe allocation failure
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Radhey Shyam Pandey <[email protected]>
[ Upstream commit f3506e15cf72e94f62d5f2d173e5b7008f644cde ]
Allocate saved_regs before pm_runtime_resume_and_get() so a devm_kmalloc() failure does not leave an unreleased runtime PM usage counter.
--- drivers/phy/xilinx/phy-zynqmp.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/phy/xilinx/phy-zynqmp.c +6 -6
@@ -1044,6 +1044,12 @@ static int xpsgtr_probe(struct platform_device *pdev)return PTR_ERR (provider); } + gtr_dev->saved_regs =devm_kmalloc (gtr_dev->dev, +sizeof (save_reg_address), +GFP_KERNEL ); +if (!gtr_dev->saved_regs) +return -ENOMEM ; +pm_runtime_set_active (gtr_dev->dev);pm_runtime_enable (gtr_dev->dev);
@@ -1053,12 +1059,6 @@ static int xpsgtr_probe(struct platform_device *pdev)return ret; } - gtr_dev->saved_regs =devm_kmalloc (gtr_dev->dev, -sizeof (save_reg_address), -GFP_KERNEL ); -if (!gtr_dev->saved_regs) -return -ENOMEM ; -return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 37/438 netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <[email protected]>
[ Upstream commit db3d0e0e5d4bc5ab4fe445b9f413d1b486508ca5 ]
sip_help_tcp() stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdiff, but a single message can grow by more than S16_MAX while the packet stays under the 65535 enlarge_skb() limit: nf_nat_sip() rewrites every matching URI, and a long Contact list expands the message by tens of kilobytes. diff then wraps, and "datalen = datalen + diff - msglen" yields a huge unsigned datalen, so the next iteration's ct_sip_get_header() reads past the linearized skb tail.
Widen diff, tdiff and the seq_adjust hook to s32. Both are bounded by the 65535 byte packet limit, and the seqadj core is already s32 (nf_ct_seqadj_set() takes s32), so no previously accepted input is rejected.
BUG: KASAN: use-after-free in ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464) Read of size 1 at addr ffff888010800000 by task ksoftirqd/1/25 ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464) sip_help_tcp (net/netfilter/nf_conntrack_sip.c:1694) nf_confirm (net/netfilter/nf_conntrack_proto.c:183) nf_hook_slow (net/netfilter/core.c:619) ip6_output (net/ipv6/ip6_output.c:246) ip6_forward (net/ipv6/ip6_output.c:690) ipv6_rcv (net/ipv6/ip6_input.c:351) __netif_receive_skb_one_core (net/core/dev.c:6212) process_backlog (net/core/dev.c:6676) __napi_poll (net/core/dev.c:7735) net_rx_action (net/core/dev.c:7955) handle_softirqs (kernel/softirq.c:622) run_ksoftirqd (kernel/softirq.c:1076) ...
--- include/linux/netfilter/nf_conntrack_sip.h | 2 +- net/netfilter/nf_conntrack_sip.c | 2 +- net/netfilter/nf_nat_sip.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-)
include/linux/netfilter/nf_conntrack_sip.h +1 -1
@@ -115,7 +115,7 @@ struct nf_nat_sip_hooks { unsigned int *datalen);void (*seq_adjust)(struct sk_buff *skb, -unsigned int protoff,s16 off); +unsigned int protoff,s32 off); unsigned int (*expect)(struct sk_buff *skb, unsigned int protoff,
net/netfilter/nf_conntrack_sip.c +1 -1
@@ -1663,7 +1663,7 @@ static int sip_help_tcp(struct sk_buff *skb, unsigned int protoff,unsigned int matchoff, matchlen;unsigned int msglen, origlen;const char *dptr, *end; -s16 diff, tdiff =0 ; +s32 diff, tdiff =0 ;int ret =NF_ACCEPT ;unsigned long clen;bool term;
net/netfilter/nf_nat_sip.c +1 -1
@@ -321,7 +321,7 @@ static unsigned int nf_nat_sip(struct sk_buff *skb, unsigned int protoff, }static void nf_nat_sip_seq_adjust (struct sk_buff *skb,unsigned int protoff, -s16 off) +s32 off) {enum ip_conntrack_info ctinfo;struct nf_conn *ct =nf_ct_get (skb, &ctinfo);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 38/438 selftests: netfilter: nft_flowtable.sh: fix offload counter verification for tunnel tests
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <[email protected]>
[ Upstream commit 1d6123f87eebb5148844cd43045c6e598799720b ]
The IPIP and IP6IP6 tunnel tests call check_counters() to verify flowtable offloading occurred, but the flow-add rule only matches meta oif "veth1". When traffic is routed through a tunnel device, oif is the tunnel interface (tun0, tun6, etc.), not veth1, so the flow-add rule never fires, no flowtable entry is created, and counters stay at zero — producing a silent false pass. Fix by adding tunnel-specific flow-add rules for each tunnel interface. These match TCP dport 12345 traffic before the bare accept rule, set ct mark, add the flow to the flowtable, and increment routed_orig. The existing routed_repl rule on veth0 already handles the reply direction since decapsulated reply packets exit through the physical interface.
Also add check_counters() for the IP6IP6 non-VLAN and IP6IP6-over-VLAN tests which previously used a bare PASS message.
--- .../selftests/net/netfilter/nft_flowtable.sh | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
tools/testing/selftests/net/netfilter/nft_flowtable.sh +12 -2
@@ -617,7 +617,11 @@ ip -6 -net "$nsr2" route add default via fee1:3::1 ip -net "$ns2" route add default via 10.0.2.1 ip -6 -net "$ns2" route add default via dead:2::1 +ip netns exec "$nsr1" nft -a insert rule inet filter forward \ + 'meta oif tun0 tcp dport 12345 ct mark set 1 flow add @f1 counter name routed_orig accept' ip netns exec "$nsr1" nft -a insert rule inet filter forward 'meta oif tun0 accept' +ip netns exec "$nsr1" nft -a insert rule inet filter forward \ + 'meta oif tun6 tcp dport 12345 ct mark set 1 flow add @f1 counter name routed_orig accept' ip netns exec "$nsr1" nft -a insert rule inet filter forward 'meta oif tun6 accept' ip netns exec "$nsr1" nft -a insert rule inet filter forward \ 'meta oif "veth0" tcp sport 12345 ct mark set 1 flow add @f1 counter name routed_repl accept'
@@ -629,7 +633,7 @@ if ! test_tcp_forwarding_nat "$ns1" "$ns2" 1 "IPIP tunnel"; then fi if test_tcp_forwarding "$ns1" "$ns2" 1 6 "[dead:2::99]" 12345; then - echo "PASS: flow offload for ns1/ns2 IP6IP6 tunnel" + check_counters "flow offload for ns1/ns2 IP6IP6 tunnel" else echo "FAIL: flow offload for ns1/ns2 with IP6IP6 tunnel" 1>&2 ip netns exec "$nsr1" nft list ruleset
@@ -642,6 +646,8 @@ ip -net "$nsr1" link set veth1.10 up ip -net "$nsr1" addr add 192.168.20.1/24 dev veth1.10 ip -net "$nsr1" addr add fee1:4::1/64 dev veth1.10 nodad ip netns exec "$nsr1" sysctl net.ipv4.conf.veth1/10.forwarding=1 > /dev/null +ip netns exec "$nsr1" nft -a insert rule inet filter forward \ + 'meta oif veth1.10 tcp dport 12345 ct mark set 1 flow add @f1 counter name routed_orig accept' ip netns exec "$nsr1" nft -a insert rule inet filter forward 'meta oif veth1.10 accept' ip -net "$nsr1" link add name tun0.10 type ipip local 192.168.20.1 remote 192.168.20.2
@@ -649,6 +655,8 @@ ip -net "$nsr1" link set tun0.10 up ip -net "$nsr1" addr add 192.168.200.1/24 dev tun0.10 ip -net "$nsr1" route change default via 192.168.200.2 ip netns exec "$nsr1" sysctl net.ipv4.conf.tun0/10.forwarding=1 > /dev/null +ip netns exec "$nsr1" nft -a insert rule inet filter forward \ + 'meta oif tun0.10 tcp dport 12345 ct mark set 1 flow add @f1 counter name routed_orig accept' ip netns exec "$nsr1" nft -a insert rule inet filter forward 'meta oif tun0.10 accept' ip -net "$nsr1" link add name tun6.10 type ip6tnl local fee1:4::1 remote fee1:4::2 encaplimit none
@@ -656,6 +664,8 @@ ip -net "$nsr1" link set tun6.10 up ip -net "$nsr1" addr add fee1:5::1/64 dev tun6.10 nodad ip -6 -net "$nsr1" route delete default ip -6 -net "$nsr1" route add default via fee1:5::2 +ip netns exec "$nsr1" nft -a insert rule inet filter forward \ + 'meta oif tun6.10 tcp dport 12345 ct mark set 1 flow add @f1 counter name routed_orig accept' ip netns exec "$nsr1" nft -a insert rule inet filter forward 'meta oif tun6.10 accept' ip -net "$nsr2" link add link veth0 name veth0.10 type vlan id 10
@@ -683,7 +693,7 @@ if ! test_tcp_forwarding_nat "$ns1" "$ns2" 1 "IPIP tunnel over vlan"; then fi if test_tcp_forwarding "$ns1" "$ns2" 1 6 "[dead:2::99]" 12345; then - echo "PASS: flow offload for ns1/ns2 IP6IP6 tunnel over vlan" + check_counters "flow offload for ns1/ns2 IP6IP6 tunnel over vlan" else echo "FAIL: flow offload for ns1/ns2 with IP6IP6 tunnel over vlan" 1>&2 ip netns exec "$nsr1" nft list ruleset
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 39/438 netfilter: nf_conntrack_expect: add and use nf_ct_expect_related_pair()
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 4aa63842fc92de1bce59d4709a0d32e718890bb2 ]
Add a new function to insert a pair of expectations, this is required by the SIP and H323 NAT helpers. The spinlock is held to check if there is a slot for both expectations, in such case, insert them.
This removes the need for nf_ct_unexpect_related() inside the loop to find a pair of consecutive ports, otherwise inserting expectations whose dead flag is already set on can happen.
Bump master_help->expecting for the expectation class after checking if the expectation fits in the master expectation list, which is needed for this new _pair() function variant to run the eviction routine including the preallocated slot for the first expectation in the pair.
--- include/net/netfilter/nf_conntrack_expect.h | 3 ++ net/ipv4/netfilter/nf_nat_h323.c | 22 +++++-------- net/netfilter/nf_conntrack_expect.c | 35 ++++++++++++++++++++- net/netfilter/nf_nat_sip.c | 20 ++++-------- 4 files changed, 50 insertions(+), 30 deletions(-)
include/net/netfilter/nf_conntrack_expect.h +3 -0
@@ -161,6 +161,9 @@ static inline int nf_ct_expect_related(struct nf_conntrack_expect *expect,return nf_ct_expect_related_report (expect,0 ,0 , flags); } +int nf_ct_expect_related_pair (struct nf_conntrack_expect *expect[], +unsigned int flag); +struct nf_conn_help ;void nf_ct_expectation_gc (struct nf_conn_help *master_help);
net/ipv4/netfilter/nf_nat_h323.c +7 -15
@@ -182,6 +182,7 @@ static int nat_rtp_rtcp(struct sk_buff *skb, struct nf_conn *ct,struct nf_conntrack_expect *rtp_exp, struct nf_conntrack_expect *rtcp_exp) { + struct nf_conntrack_expect *rtp_pair[2] = { rtp_exp, rtcp_exp };struct nf_ct_h323_master *info =nfct_help_data (ct);int dir =CTINFO2DIR (ctinfo);int i;
@@ -227,22 +228,13 @@ static int nat_rtp_rtcp(struct sk_buff *skb, struct nf_conn *ct,int ret; rtp_exp->tuple.dst.u.udp.port =htons (nated_port); - ret =nf_ct_expect_related (rtp_exp,0 ); + rtcp_exp->tuple.dst.u.udp.port =htons (nated_port +1 ); + ret =nf_ct_expect_related_pair (rtp_pair,0 );if (ret ==0 ) { - rtcp_exp->tuple.dst.u.udp.port = -htons (nated_port +1 ); - ret =nf_ct_expect_related (rtcp_exp,0 ); -if (ret ==0 ) -break ; -else if (ret == -EBUSY ) { -nf_ct_unexpect_related (rtp_exp); -continue ; - }else if (ret <0 ) { -nf_ct_unexpect_related (rtp_exp); - nated_port =0 ; -break ; - } - }else if (ret != -EBUSY ) { +break ; + }else if (ret == -EBUSY ) { +continue ; + }else if (ret <0 ) { nated_port =0 ;break ; }
net/netfilter/nf_conntrack_expect.c +34 -1
@@ -426,7 +426,6 @@ static void nf_ct_expect_insert(struct nf_conntrack_expect *exp, exp->timeout += helper->expect_policy[exp->class].timeout *HZ ;hlist_add_head_rcu (&exp->lnode, &master_help->expectations); - master_help->expecting[exp->class]++;hlist_add_head_rcu (&exp->hnode, &nf_ct_expect_hash[h]); cnet =nf_ct_pernet (net);
@@ -533,6 +532,7 @@ int nf_ct_expect_related_report(struct nf_conntrack_expect *expect,if (ret <0 ) goto out; + master_help->expecting[expect->class]++;nf_ct_expect_insert (expect, master_help);nf_ct_expect_event_report (IPEXP_NEW , expect, portid, report);
@@ -545,6 +545,39 @@ int nf_ct_expect_related_report(struct nf_conntrack_expect *expect, }EXPORT_SYMBOL_GPL (nf_ct_expect_related_report); +int nf_ct_expect_related_pair (struct nf_conntrack_expect *expect[], +unsigned int flags) +{ +struct nf_conn_help *master_help; +int i, ret; + +spin_lock_bh (&nf_conntrack_expect_lock); + master_help =nfct_help (expect[0 ]->master); +if (!master_help || master_help !=nfct_help (expect[1 ]->master)) { + ret = -EINVAL ; + goto out; + } + +for (i =0 ; i <2 ; i++) { + ret =__nf_ct_expect_check (expect[i], master_help, flags); +if (ret <0 ) { +if (i ==1 ) + master_help->expecting[expect[0 ]->class]--; + goto out; + } + master_help->expecting[expect[i]->class]++; + } + +for (i =0 ; i <2 ; i++) { +nf_ct_expect_insert (expect[i], master_help); +nf_ct_expect_event_report (IPEXP_NEW , expect[i],0 ,0 ); + } +out: +spin_unlock_bh (&nf_conntrack_expect_lock); +return ret; +} +EXPORT_SYMBOL_GPL (nf_ct_expect_related_pair); +void nf_ct_expect_iterate_destroy (bool (*iter)(struct nf_conntrack_expect *e,void *data),void *data) {
net/netfilter/nf_nat_sip.c +6 -14
@@ -592,6 +592,7 @@ static unsigned int nf_nat_sdp_media(struct sk_buff *skb, unsigned int protoff,unsigned int medialen, union nf_inet_addr *rtp_addr) { + struct nf_conntrack_expect *rtp_pair[2] = { rtp_exp, rtcp_exp };enum ip_conntrack_info ctinfo;struct nf_conn *ct =nf_ct_get (skb, &ctinfo);enum ip_conntrack_dir dir =CTINFO2DIR (ctinfo);
@@ -622,24 +623,15 @@ static unsigned int nf_nat_sdp_media(struct sk_buff *skb, unsigned int protoff,int ret; rtp_exp->tuple.dst.u.udp.port =htons (port); - ret =nf_ct_expect_related (rtp_exp, -NF_CT_EXP_F_SKIP_MASTER ); -if (ret == -EBUSY ) -continue ; -else if (ret <0 ) { - port =0 ; -break ; - } rtcp_exp->tuple.dst.u.udp.port =htons (port +1 ); - ret =nf_ct_expect_related (rtcp_exp, -NF_CT_EXP_F_SKIP_MASTER ); + + ret =nf_ct_expect_related_pair (rtp_pair, +NF_CT_EXP_F_SKIP_MASTER );if (ret ==0 )break ; -else if (ret == -EBUSY ) { -nf_ct_unexpect_related (rtp_exp); +else if (ret == -EBUSY )continue ; - }else if (ret <0 ) { -nf_ct_unexpect_related (rtp_exp); +else if (ret <0 ) { port =0 ;break ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 40/438 drm/mediatek: Check CRTC state before freeing
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <[email protected]>
[ Upstream commit 233a4d3a39fc1585f5e271b2adab43c6af025ae0 ]
mtk_crtc_reset() destroys the current CRTC state only when crtc->state is non-NULL, but it always converts crtc->state to struct mtk_crtc_state and passes the result to kfree().
When reset is called without an existing state, container_of(NULL, ...) does not produce NULL. Keep the mtk state free in the same crtc->state guard as the helper state destruction.
This issue was found by a static analysis checker and confirmed by manual source review.
--- drivers/gpu/drm/mediatek/mtk_crtc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/mediatek/mtk_crtc.c +3 -3
@@ -153,10 +153,10 @@ static void mtk_crtc_reset(struct drm_crtc *crtc) {struct mtk_crtc_state *state; -if (crtc->state) +if (crtc->state) {__drm_atomic_helper_crtc_destroy_state (crtc->state); - -kfree (to_mtk_crtc_state (crtc->state)); +kfree (to_mtk_crtc_state (crtc->state)); + } crtc->state =NULL ; state =kzalloc_obj (*state);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 41/438 mshv_vtl: fix fd leak in mshv_ioctl_create_vtl()
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yi Xie <[email protected]>
[ Upstream commit ec08dd5b9ffa52980908805bdc8a55a8f1bc6667 ]
put_unused_fd() if anon_inode_getfile() fails.
--- drivers/hv/mshv_vtl_main.c | 1 + 1 file changed, 1 insertion(+)
drivers/hv/mshv_vtl_main.c +1 -0
@@ -129,6 +129,7 @@ mshv_ioctl_create_vtl(void __user *user_arg, struct device *module_dev) file =anon_inode_getfile ("mshv_vtl" , &mshv_vtl_fops, vtl,O_RDWR );if (IS_ERR (file)) { +put_unused_fd (fd);kfree (vtl);return PTR_ERR (file); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 42/438 Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotation
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <[email protected]>
[ Upstream commit 8c7ab779c8850f4dab8473463cca9a7d52fdaecc ]
lockdep_hardirq_threaded() is supposed to be used within IRQ core code and not within drivers. It is not obvious from within the driver, that this is the only interrupt service routing and that it is not shared handler.
Replace lockdep_hardirq_threaded() with a lockdep annotation limiting threaded context on PREEMPT_RT to __vmbus_isr().
--- drivers/hv/vmbus_drv.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/hv/vmbus_drv.c +12 -1
@@ -1384,8 +1384,19 @@ void vmbus_isr(void)if (IS_ENABLED (CONFIG_PREEMPT_RT )) {vmbus_irqd_wake (); }else { -lockdep_hardirq_threaded (); + static DEFINE_WAIT_OVERRIDE_MAP(vmbus_map, LD_WAIT_CONFIG); + +/* +* vmbus_isr is never force-threaded and always invoked at hard +* IRQ level. __vmbus_isr() below can acquire a spinlock_t +* which becomes a sleeping lock and must not be acquired in +* this context. Therefore on PREEMPT_RT this will be threaded +* via vmbus_irqd_wake(). On non-PREEMPT the annotation lets +* lockdep know that acquiring a spinlock_t is not an issue. +*/ +lock_map_acquire_try (&vmbus_map);__vmbus_isr (); +lock_map_release (&vmbus_map); } }EXPORT_SYMBOL_FOR_MODULES (vmbus_isr,"mshv_vtl" );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 43/438 mshv: Fix duplicate GSI detection for GSI 0
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislav Kinsburskii <[email protected]>
[ Upstream commit 649dd135491945afa544351e3e6d4a727de87020 ]
The duplicate routing entry check in mshv_update_routing_table() uses guest_irq_num != 0 to detect whether a GSI slot is already occupied. This fails for GSI 0 because its guest_irq_num is 0 both when the slot is unused (zero-initialized) and when legitimately assigned. As a result, duplicate entries for GSI 0 are silently accepted, with the second entry overwriting the first — corrupting the routing table without any error reported to userspace.
While GSI 0 (legacy timer) is unlikely to appear in MSI-based routing in practice, the check is semantically wrong — it conflates "uninitialized" with "GSI number 0." Use girq_entry_valid instead, which is explicitly set to true when an entry is populated and remains zero for unused slots regardless of the GSI number.
--- drivers/hv/mshv_irq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hv/mshv_irq.c +1 -1
@@ -51,7 +51,7 @@ int mshv_update_routing_table(struct mshv_partition *partition,/* * Allow only one to one mapping between GSI and MSI routing. */ -if (girq->guest_irq_num !=0 ) { +if (girq->girq_entry_valid) { r = -EINVAL ; goto out; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 44/438 mshv: Fix sleeping under spinlock in mshv_portid_alloc
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislav Kinsburskii <[email protected]>
[ Upstream commit a9708e550d11a53b22d932cdbfaa10c26346a2d0 ]
idr_alloc() is called with GFP_KERNEL inside idr_lock(), which holds a spinlock. GFP_KERNEL allows the allocator to sleep, triggering a sleeping-while-atomic bug.
Fix by using idr_preload(GFP_KERNEL) before taking the lock to pre-allocate memory in a sleepable context, then idr_alloc() with GFP_NOWAIT inside the spinlock-protected section.
--- drivers/hv/mshv_portid_table.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/hv/mshv_portid_table.c +4 -2
@@ -40,12 +40,14 @@ mshv_port_table_fini(void)int mshv_portid_alloc (struct port_table_info *info) { -int ret =0 ; +int ret; +idr_preload (GFP_KERNEL );idr_lock (&port_table_idr); ret =idr_alloc (&port_table_idr, info,PORTID_MIN , -PORTID_MAX ,GFP_KERNEL ); +PORTID_MAX ,GFP_NOWAIT );idr_unlock (&port_table_idr); +idr_preload_end ();return ret; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 45/438 KVM: arm64: vgic: Fix race between LPI release and re-registration
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos López <[email protected]>
[ Upstream commit cbfe2b24a1ea9de35032dbdd100fdc700f5be92d ]
Fix a potential race between decrementing an LPI's reference count and evicting that structure from the LPI xarray.
LPI structures are maintained in the VGIC LPI xarray (dist->lpi_xa). When the reference count of an LPI structure drops to zero, vgic_release_lpi_locked() removes the structure from the xarray and frees it under the xarray lock.
However, the release of an LPI can race with a concurrent LPI re-registration with the same INTID via vgic_add_lpi() on another CPU, since the reference count drop and the xarray eviction are not performed in a single atomic step. This can happen e.g. if the guest issues a DISCARD while the LPI is still referenced from a vCPU's active-pending list (ap_list), and the same INTID is re-mapped via MAPTI.
Particularly, vgic_release_lpi_locked() is called from two distinct
paths: direct release via vgic_put_irq(), and deferred release via vgic_release_deleted_lpis(). During direct release, the issue can result in deleting a newly registered LPI from the xarray:
CPU0 (Releasing LPI) CPU1 (Adding new LPI)
==================== =====================
vgic_put_irq()
__vgic_put_irq()
refcount_dec_and_test()
vgic_add_lpi()
xa_lock_irqsave()
old_irq = xa_load(.., intid)
vgic_try_get_irq_ref(old_irq) == false
new IRQ inserted --> __xa_store(.., intid, ..)
xa_unlock_irqrestore()
xa_lock_irqsave();
vgic_release_lpi_locked()
__xa_erase(.., irq->intid) <-- BUG: new IRQ is erased
kfree_rcu(old_irq)During the deferred release path, the old IRQ can be leaked:
CPU0 (Releasing LPI) CPU1 (Adding new LPI)
==================== =====================
vgic_put_irq_norelease()
__vgic_put_irq()
refcount_dec_and_test()
irq->pending_release = true
vgic_add_lpi()
xa_lock_irqsave()
old_irq = xa_load(.., intid)
vgic_try_get_irq_ref(oldirq) == false
BUG: old IRQ overwritten --> __xa_store(.., intid, ..)
xa_unlock_irqrestore() vgic_release_deleted_lpis()
xa_lock_irqsave()
xa_for_each() { .. } <-- old IRQ with pending_release = true
is gone, so it cannot be released
To fix the direct release path, move the reference count drop inside the xarray lock, making sure that vgic_add_lpi() never encounters the to-be-released LPI.
In the deferred release path, the refcount drop must happen under a raw spinlock, so the xarray lock cannot be grabbed, and the same solution does not work. Instead, update vgic_add_lpi(), so that if it evicts an LPI from the xarray, it takes on the responsibility of freeing it. Consequently, an LPI may now be freed concurrently after a deferred release drops the refcount, so accessing the pending_release field is no longer safe from use-after-free. Delete all uses of the flag, and update vgic_release_deleted_lpis() to identify orphaned LPIs purely based on their refcount.
--- arch/arm64/kvm/vgic/vgic-its.c | 24 ++++++++++++++++-------- arch/arm64/kvm/vgic/vgic.c | 18 ++++++++---------- include/kvm/arm_vgic.h | 3 --- 3 files changed, 24 insertions(+), 21 deletions(-)
arch/arm64/kvm/vgic/vgic-its.c +16 -8
@@ -116,18 +116,26 @@ static struct vgic_irq *vgic_add_lpi(struct kvm *kvm, u32 intid,kfree (irq); irq = oldirq; }else { - ret =xa_err (__xa_store (&dist->lpi_xa, intid, irq,0 )); - } - -xa_unlock_irqrestore (&dist->lpi_xa, flags); +/* +* The entry is either empty or contains a dead LPI (refcount=0) +* from the deferred release path, pending cleanup by +* vgic_release_deleted_lpis(). Evict and free it if present. +*/ + oldirq =__xa_store (&dist->lpi_xa, intid, irq,0 ); + ret =xa_err (oldirq); +if (ret) { +xa_unlock_irqrestore (&dist->lpi_xa, flags); +kfree (irq); -if (ret) { -xa_release (&dist->lpi_xa, intid); -kfree (irq); +return ERR_PTR (ret); + } -return ERR_PTR (ret); +if (oldirq && !WARN_ON_ONCE (refcount_read (&oldirq->refcount))) +kfree_rcu (oldirq, rcu); } +xa_unlock_irqrestore (&dist->lpi_xa, flags); +/* * We "cache" the configuration table entries in our struct vgic_irq's. * However we only have those structs for mapped IRQs, so we read in
arch/arm64/kvm/vgic/vgic.c +8 -10
@@ -147,11 +147,7 @@ static __must_check bool __vgic_put_irq(struct kvm *kvm, struct vgic_irq *irq)static __must_check bool vgic_put_irq_norelease (struct kvm *kvm,struct vgic_irq *irq) { -if (!__vgic_put_irq (kvm, irq)) -return false; - - irq->pending_release = true; -return true; +return __vgic_put_irq (kvm, irq); }void vgic_put_irq (struct kvm *kvm,struct vgic_irq *irq)
@@ -168,12 +164,14 @@ void vgic_put_irq(struct kvm *kvm, struct vgic_irq *irq)guard (spinlock_irqsave)(&dist->lpi_xa.xa_lock); } -if (!__vgic_put_irq (kvm, irq)) +if (!irq_is_lpi (kvm, irq->intid))return ; -xa_lock_irqsave (&dist->lpi_xa, flags); -vgic_release_lpi_locked (dist, irq); -xa_unlock_irqrestore (&dist->lpi_xa, flags); +if (refcount_dec_and_lock_irqsave (&irq->refcount, + &dist->lpi_xa.xa_lock, &flags)) { +vgic_release_lpi_locked (dist, irq); +xa_unlock_irqrestore (&dist->lpi_xa, flags); + } }static void vgic_release_deleted_lpis (struct kvm *kvm)
@@ -185,7 +183,7 @@ static void vgic_release_deleted_lpis(struct kvm *kvm)xa_lock_irqsave (&dist->lpi_xa, flags);xa_for_each (&dist->lpi_xa, intid, irq) { -if (irq->pending_release) +if (!refcount_read (&irq->refcount))vgic_release_lpi_locked (dist, irq); }
include/kvm/arm_vgic.h +0 -3
@@ -242,9 +242,6 @@ struct vgic_irq {* affinity reg (v3). */ - bool pending_release:1; /* Used for LPIs only, unreferenced IRQ -* pending a release */ - bool pending_latch:1; /* The pending latch state used to calculate* the pending state for both level * and edge triggered IRQs. */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 46/438 KVM: arm64: vgic: Mitigate potential LPI registration failure
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos López <[email protected]>
[ Upstream commit 21f12496fdd357ad4e1fcdd07dc80ab7378f7d24 ]
Mitigate a potential failure when inserting a new LPI into the VGIC LPI xarray.
When vgic_add_lpi() is preparing to register a new LPI, it pre-allocates an xarray entry using xa_reserve_irq(), so that it can later perform the insertion under the xarray lock without allocating.
However, since xa_reserve_irq() is called before acquiring such lock, there is a potential race where xa_reserve_irq() observes a populated entry, thus not performing the allocation, and another CPU removes that entry before the xarray lock is grabbed to perform the insertion.
CPU0 (Adding new LPI) CPU1 (Releasing LPI)
===================== ===================
vgic_add_lpi()
/* Entry populated, does not allocate */
xa_reserve_irq(.., intid, ..)
vgic_release_deleted_lpis()
xa_lock_irqsave()
vgic_release_lpi_locked()
xarray node freed --> __xa_erase(.., intid)
xa_unlock_irqrestore()
xa_lock_irqsave()
xa_load(.., intid) == NULL
vgic_try_get_irq_ref(NULL) == false
__xa_store(.., intid, irq, 0) <-- xarray node was freed, gfp=0
cannot allocate, returns -ENOMEMThis can happen e.g. if the guest issues a DISCARD while the LPI is still referenced from a vCPU's active-pending list (ap_list), and the same INTID is re-mapped via MAPTI.
Mitigate this by passing GFP_NOWAIT to __xa_store(), so that the allocation can happen under the lock in the rare case that this condition is hit. Add __GFP_ACCOUNT as well to match xa_reserve_irq()'s flags.
--- arch/arm64/kvm/vgic/vgic-its.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/arm64/kvm/vgic/vgic-its.c +2 -1
@@ -121,7 +121,8 @@ static struct vgic_irq *vgic_add_lpi(struct kvm *kvm, u32 intid,* from the deferred release path, pending cleanup by * vgic_release_deleted_lpis(). Evict and free it if present. */ - oldirq =__xa_store (&dist->lpi_xa, intid, irq,0 ); + oldirq =__xa_store (&dist->lpi_xa, intid, irq, +GFP_NOWAIT | __GFP_ACCOUNT); ret =xa_err (oldirq);if (ret) {xa_unlock_irqrestore (&dist->lpi_xa, flags);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 47/438 KVM: arm64: Fix hyp_trace clock disabling
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Donnefort <[email protected]>
[ Upstream commit bbece712cfc7f286b2908ac120dcf700279d87eb ]
Fix the disable path in hyp_trace_clock_enable(), which fell through to re-initialize and reschedule the clock after cancelling the work. Return early instead.
While at it, cleanup hyp_trace_clock::lock which is unused and hyp_trace_clock::running which is redundant: the trace_remote framework already serializes calls to the callback enable_tracing.
--- arch/arm64/kvm/hyp_trace.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
arch/arm64/kvm/hyp_trace.c +8 -8
@@ -37,8 +37,6 @@ static struct hyp_trace_clock {u32 shift;struct delayed_work work;struct completion ready; -struct mutex lock; -bool running; } hyp_clock;static void __hyp_clock_work (struct work_struct *work)
@@ -110,12 +108,9 @@ static void hyp_trace_clock_enable(struct hyp_trace_clock *hyp_clock, bool enabl {struct system_time_snapshot snap; -if (hyp_clock->running == enable) -return ; -if (!enable) {cancel_delayed_work_sync (&hyp_clock->work); - hyp_clock->running = false; +return ; }ktime_get_snapshot (&snap);
@@ -128,7 +123,6 @@ static void hyp_trace_clock_enable(struct hyp_trace_clock *hyp_clock, bool enablINIT_DELAYED_WORK (&hyp_clock->work, __hyp_clock_work);schedule_delayed_work (&hyp_clock->work,msecs_to_jiffies (CLOCK_INIT_MS ));wait_for_completion (&hyp_clock->ready); - hyp_clock->running = true; }/* Access to this struct within the trace_remote_callbacks are protected by the trace_remote lock */
@@ -304,9 +298,15 @@ static void hyp_trace_unload(struct trace_buffer_desc *desc, void *priv)static int hyp_trace_enable_tracing (bool enable,void *priv) { +int ret; +hyp_trace_clock_enable (&hyp_clock, enable); -return kvm_call_hyp_nvhe (__tracing_enable, enable); + ret =kvm_call_hyp_nvhe (__tracing_enable, enable); +if (ret) +hyp_trace_clock_enable (&hyp_clock, !enable); + +return ret; }static int hyp_trace_swap_reader_page (unsigned int cpu,void *priv)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 48/438 KVM: arm64: Fix potential leak in hyp_trace_buffer_alloc_bpages_backing
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Donnefort <[email protected]>
[ Upstream commit df7a9d376f7a388ecfacf8dfe0b5819ddfba6972 ]
In the very unlikely event of a failure in __map_hyp, the allocated backing pages are leaked in hyp_trace_buffer_alloc_bpages_backing(). Fix this by freeing the pages on error.
--- arch/arm64/kvm/hyp_trace.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
arch/arm64/kvm/hyp_trace.c +8 -1
@@ -154,6 +154,7 @@ static int hyp_trace_buffer_alloc_bpages_backing(struct hyp_trace_buffer *trace_int nr_bpages = (PAGE_ALIGN (size) /PAGE_SIZE ) +1 ;size_t backing_size;void *start; +int ret; backing_size =PAGE_ALIGN (sizeof (struct simple_buffer_page ) * nr_bpages *num_possible_cpus ());
@@ -162,10 +163,16 @@ static int hyp_trace_buffer_alloc_bpages_backing(struct hyp_trace_buffer *trace_if (!start)return -ENOMEM ; + ret =__map_hyp (start, backing_size); +if (ret) { +free_pages_exact (start, backing_size); +return ret; + } + trace_buffer->desc->bpages_backing_start = (unsigned long )start; trace_buffer->desc->bpages_backing_size = backing_size; -return __map_hyp (start, backing_size); +return ret; }static void hyp_trace_buffer_free_bpages_backing (struct hyp_trace_buffer *trace_buffer)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 49/438 KVM: arm64: Fix hyp_trace_desc allocation size in hyp_trace_load()
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Donnefort <[email protected]>
[ Upstream commit ca28278d10ec234592989ad370d58294b9d43e0f ]
The footprint calculated for struct hyp_trace_desc sizes only trace_buffer_desc and do not take into account the other fields. It worked so far thanks to the follow-up PAGE_ALIGN().
Fix the descriptor size and while at it, enforce an overflow check after PAGE_ALIGN().
--- arch/arm64/kvm/hyp_trace.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
arch/arm64/kvm/hyp_trace.c +7 -3
@@ -229,18 +229,22 @@ static int hyp_trace_buffer_share_hyp(struct hyp_trace_buffer *trace_buffer)static struct trace_buffer_desc *hyp_trace_load (unsigned long size,void *priv) {struct hyp_trace_buffer *trace_buffer = priv; +size_t desc_size, tb_desc_size;struct hyp_trace_desc *desc; -size_t desc_size;int ret;if (WARN_ON (trace_buffer->desc))return ERR_PTR (-EINVAL ); - desc_size =trace_buffer_desc_size (size,num_possible_cpus ()); + tb_desc_size =trace_buffer_desc_size (size,num_possible_cpus ()); + desc_size =size_add (tb_desc_size, offsetof(struct hyp_trace_desc , trace_buffer_desc));if (desc_size ==SIZE_MAX )return ERR_PTR (-E2BIG ); desc_size =PAGE_ALIGN (desc_size); +if (!desc_size) +return ERR_PTR (-E2BIG ); + desc = (struct hyp_trace_desc *)alloc_pages_exact (desc_size,GFP_KERNEL );if (!desc)return ERR_PTR (-ENOMEM );
@@ -256,7 +260,7 @@ static struct trace_buffer_desc *hyp_trace_load(unsigned long size, void *priv)if (ret) goto err_free_desc; - ret =trace_remote_alloc_buffer (&desc->trace_buffer_desc, desc_size, size, + ret =trace_remote_alloc_buffer (&desc->trace_buffer_desc, tb_desc_size, size, cpu_possible_mask);if (ret) goto err_free_backing;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 50/438 KVM: arm64: Add missing hyp_enter when trapping sysreg
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Donnefort <[email protected]>
[ Upstream commit e7821048e8d72a94b1fb7422f8b45aa374ff076f ]
Add a missing hypervisor event call for hyp_enter on sysreg trapping, causing an unbalanced hyp_enter/hyp_exit.
The enum hyp_enter_exit_reason is not ABI, so we can keep the ERET reasons at the end for clarity.
--- arch/arm64/include/asm/kvm_hypevents.h | 1 + arch/arm64/kvm/hyp/nvhe/hyp-main.c | 1 + arch/arm64/kvm/hyp_trace.c | 1 + 3 files changed, 3 insertions(+)
arch/arm64/include/asm/kvm_hypevents.h +1 -0
@@ -12,6 +12,7 @@enum hyp_enter_exit_reason {HYP_REASON_SMC ,HYP_REASON_HVC , +HYP_REASON_SYS ,HYP_REASON_PSCI ,HYP_REASON_HOST_ABORT ,HYP_REASON_GUEST_EXIT ,
arch/arm64/kvm/hyp/nvhe/hyp-main.c +1 -0
@@ -925,6 +925,7 @@ void handle_trap(struct kvm_cpu_context *host_ctxt)handle_host_mem_abort (host_ctxt);break ;case ESR_ELx_EC_SYS64: +trace_hyp_enter (host_ctxt,HYP_REASON_SYS );if (handle_host_mte (esr))break ; fallthrough;
arch/arm64/kvm/hyp_trace.c +1 -0
@@ -409,6 +409,7 @@ static const char *__hyp_enter_exit_reason_str(u8 reason)static const char strs[][12 ] = {"smc" ,"hvc" , +"sys" ,"psci" ,"host_abort" ,"guest_exit" ,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 51/438 KVM: arm64: Reject guest_memfd memslots when the VM has MTE
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandru Elisei <[email protected]>
[ Upstream commit 679d7201c1f09e37fa1c12ce28d84079c17fc87f ]
The user cannot use MTE on VMAs created by mapping a guest_memfd file, as arch_calc_vm_flag_bits() does not set VM_MTE_ALLOWED.
When creating a guest_memfd backed memslot, kvm_arch_prepare_memory_region() rejects the memslot if MTE is enabled for the VM and if guest_memfd has been mapped in a VMA that intersects the memslot.
However, the documentation for KVM_SET_USER_MEMORY_REGION2 explicitly states that the only condition for userspace_addr is for it to be a legal userspace address, but the mapping is not required to be valid nor populated at memslot creation.
If userspace sets userspace_addr to an address that hasn't been mapped, or if userspace_addr belongs to a VMA that isn't backed by the guest_memfd file, or if the VMA doesn't intersect the memslot, memslot creation is successful and KVM ends up with a VM with MTE and guest_memfd-backed memslots.
The same happens if the order is reversed: when userspace enables MTE, KVM does not check if memslots backed by guest_memfd are already present.
Fix both issues by rejecting guest_memfd-backed memslots when MTE is enabled, and by rejecting MTE when guest_memfd-backed memslots are already present.
--- Documentation/virt/kvm/api.rst | 6 ++++++ arch/arm64/kvm/arm.c | 25 +++++++++++++++++++------ arch/arm64/kvm/mmu.c | 4 ++++ 3 files changed, 29 insertions(+), 6 deletions(-)
Documentation/virt/kvm/api.rst +6 -0
@@ -8401,6 +8401,12 @@ When this capability is enabled all memory in memslots must be mapped as attempts to create a memslot with an invalid mmap will result in an -EINVAL return. +``guest_memfd``, even though it is an anonymous file, is not supported with MTE. +Attempting to create a memslot backed by ``guest_memfd`` when the MTE capability +is enabled, or attempting to enable the MTE capability after +``guest_memfd``-backed memslots have been created, will result in an -EINVAL +return. + When enabled the VMM may make use of the ``KVM_ARM_MTE_COPY_TAGS`` ioctl to perform a bulk copy of tags to/from the guest.
arch/arm64/kvm/arm.c +19 -6
@@ -148,14 +148,27 @@ int kvm_vm_ioctl_enable_cap(struct kvm *kvm,set_bit (KVM_ARCH_FLAG_RETURN_NISV_IO_ABORT_TO_USER , &kvm->arch.flags);break ; -case KVM_CAP_ARM_MTE : -mutex_lock (&kvm->lock); -if (system_supports_mte () && !kvm->created_vcpus) { - r =0 ; -set_bit (KVM_ARCH_FLAG_MTE_ENABLED , &kvm->arch.flags); +case KVM_CAP_ARM_MTE : { +struct kvm_memory_slot *memslot; +int bkt; + +guard (mutex)(&kvm->lock); +if (!system_supports_mte () || kvm->created_vcpus) +break ; + + r =0 ; +guard (mutex)(&kvm->slots_lock); +kvm_for_each_memslot (memslot, bkt,kvm_memslots (kvm)) { +if (kvm_slot_has_gmem (memslot)) { + r = -EINVAL ; +break ; + } } -mutex_unlock (&kvm->lock); +if (r ==0 ) +set_bit (KVM_ARCH_FLAG_MTE_ENABLED , &kvm->arch.flags);break ; + + }case KVM_CAP_ARM_SYSTEM_SUSPEND : r =0 ;set_bit (KVM_ARCH_FLAG_SYSTEM_SUSPEND_ENABLED , &kvm->arch.flags);
arch/arm64/kvm/mmu.c +4 -0
@@ -2625,6 +2625,10 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm,if (kvm_slot_has_gmem (new) && !kvm_memslot_is_gmem_only (new))return -EINVAL ; +/* guest_memfd is incompatible with MTE. */ +if (kvm_slot_has_gmem (new) &&kvm_has_mte (kvm)) +return -EINVAL ; + hva = new->userspace_addr; reg_end = hva + (new->npages <<PAGE_SHIFT );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 52/438 KEYS: trusted: dcp: fix key_len validation and calc_blob_len() return type
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabrice Derepas <[email protected]>
[ Upstream commit 35d661c98fe4733490f20b4311616a3c2c30abc0 ]
Two correctness and type-hygiene issues exist in the DCP trusted keys implementation.
First, trusted_dcp_unseal() reads p->key_len from a user-supplied blob without checking if it exceeds MAX_KEY_SIZE. If a crafted blob provides a payload_len larger than 128, the subsequent do_aead_crypto() call writes past the end of the p->key array into the adjacent p->blob buffer within the same struct trusted_key_payload -- the caller's own input, not unrelated kernel memory. While not exploitable, this violates strict array bounds and triggers static analyzers. Fix this by adding a validation check against MIN_KEY_SIZE and MAX_KEY_SIZE immediately after reading the length, matching the checks already done in trusted_core.c.
Second, calc_blob_len() calculates a sum in size_t that truncates to unsigned int on 64-bit platforms. Because the DCP hardware is only present on 32-bit i.MX SoC platforms, size_t and unsigned int are functionally equivalent in production, making this truncation harmless in practice. Nevertheless, updating the return type to size_t (and subsequently updating 'blen' in the seal/unseal paths) resolves type-narrowing warnings and improves overall code hygiene.
--- security/keys/trusted-keys/trusted_dcp.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
security/keys/trusted-keys/trusted_dcp.c +11 -4
@@ -69,7 +69,7 @@ static bool skip_zk_test;module_param_named (dcp_skip_zk_test, skip_zk_test, bool,0 );MODULE_PARM_DESC (dcp_skip_zk_test,"Don't test whether device keys are zero'ed" ); -static unsigned int calc_blob_len (unsigned int payload_len) +static size_t calc_blob_len (unsigned int payload_len) {return sizeof (struct dcp_blob_fmt ) + payload_len +DCP_BLOB_AUTHLEN ; }
@@ -200,7 +200,8 @@ static int encrypt_blob_key(u8 *plain_key, u8 *encrypted_key)static int trusted_dcp_seal (struct trusted_key_payload *p,char *datablob) {struct dcp_blob_fmt *b = (struct dcp_blob_fmt *)p->blob; -int blen, ret; +size_t blen; +int ret;u8 *plain_blob_key; blen =calc_blob_len (p->key_len);
@@ -242,7 +243,8 @@ static int trusted_dcp_seal(struct trusted_key_payload *p, char *datablob)static int trusted_dcp_unseal (struct trusted_key_payload *p,char *datablob) {struct dcp_blob_fmt *b = (struct dcp_blob_fmt *)p->blob; -int blen, ret; +size_t blen; +int ret;u8 *plain_blob_key =NULL ;if (b->fmt_version !=DCP_BLOB_VERSION ) {
@@ -253,9 +255,14 @@ static int trusted_dcp_unseal(struct trusted_key_payload *p, char *datablob) } p->key_len =le32_to_cpu (b->payload_len); +if (p->key_len <MIN_KEY_SIZE || p->key_len >MAX_KEY_SIZE ) { + ret = -EINVAL ; + goto out; + } + blen =calc_blob_len (p->key_len);if (blen != p->blob_len) { -pr_err ("DCP blob has bad length: %i != %i\n" , blen, +pr_err ("DCP blob has bad length: %zu != %u\n" , blen, p->blob_len); ret = -EINVAL ; goto out;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 53/438 keys: fix out-of-bounds read in keyring_get_key_chunk()
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <[email protected]>
[ Upstream commit 63918731f9ae25b5deb022f118e941e6dddfcef4 ]
For description-level chunks keyring_get_key_chunk() advances the read pointer by level * sizeof(long) past the inline prefix but only bounds-checks the prefix, so a long enough key description is read past its kmemdup(desc, desc_len + 1) allocation. Compute the full byte offset and bounds-check the description against it before reading.
The walk only reaches a description-level chunk when two keys collide through the hash, x, type and domain_tag chunks, so this is reached from an unprivileged add_key(2) with a crafted pair of same-type keys whose index hashes collide; KASAN reports a slab-out-of-bounds read.
--- security/keys/keyring.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
security/keys/keyring.c +5 -4
@@ -271,6 +271,7 @@ static unsigned long keyring_get_key_chunk(const void *data, int level)unsigned long chunk =0 ;const u8 *d;int desc_len = index_key->desc_len, n =sizeof (chunk); +unsigned int offset; level /=ASSOC_ARRAY_KEY_CHUNK_SIZE ;switch (level) {
@@ -284,12 +285,12 @@ static unsigned long keyring_get_key_chunk(const void *data, int level)return (unsigned long )index_key->domain_tag;default : level -=4 ; -if (desc_len <=sizeof (index_key->desc)) + offset =sizeof (index_key->desc) + level *sizeof (long ); +if (desc_len <= offset)return 0 ; - d = index_key->description +sizeof (index_key->desc); - d += level *sizeof (long ); - desc_len -=sizeof (index_key->desc); + d = index_key->description + offset; + desc_len -= offset;if (desc_len > n) desc_len = n; do {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 54/438 keys: make keyring key-chunk byte order agree with keyring_diff_objects()
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <[email protected]>
[ Upstream commit 58565eef0f8d861aae92abfb7658458d661cee17 ]
keyring_get_key_chunk() loads description bytes into the index chunk low address first, while keyring_diff_objects() numbers the first differing bit from the low end and folds the absolute byte index into the level without removing the inline-prefix offset the level already carries. The two disagree on byte order and bit position, so the array can be told two keys first differ at a bit that does not differ in the chunk the walker uses, letting crafted descriptions collide into one node.
Load the chunk in the order keyring_diff_objects() assumes and drop the inline-prefix length when folding the byte index into the level. This only changes the in-memory ordering used to place keys within a keyring; add, search and read of non-colliding keys are unaffected.
--- security/keys/keyring.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
security/keys/keyring.c +3 -2
@@ -293,9 +293,10 @@ static unsigned long keyring_get_key_chunk(const void *data, int level) desc_len -= offset;if (desc_len > n) desc_len = n; + d += desc_len;do { chunk <<=8 ; - chunk |= *d++; + chunk |= *--d; }while (--desc_len >0 );return chunk; }
@@ -376,7 +377,7 @@ static int keyring_diff_objects(const void *object, const void *data)return -1 ; differ_plus_i: - level += i; + level += i - (int )sizeof (a->desc); differ: i = level *8 +__ffs (seg_a ^ seg_b);return i;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 55/438 assoc_array: trim the final shortcut word using the current chunk end
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <[email protected]>
[ Upstream commit a82c8a05e86f3f84e09698f65b4515b5d04633f6 ]
assoc_array_walk() masks off the bits past shortcut->skip_to_level in the word that contains skip_to_level, gated onround_up(sc_level, ASSOC_ARRAY_KEY_CHUNK_SIZE) > skip_to_level.
That guard is wrong in two opposite ways:
- When sc_level is word-aligned (every word after the first) round_up() is a no-op, so the guard is sc_level > skip_to_level and never fires for the word that holds skip_to_level. A shortcut that spans more than one word and ends in the middle of its last word leaves that word untrimmed, and its stale high bits leak into the dissimilarity word and can steer the walk down the wrong descendant.
- When sc_level is unaligned (the first word) and skip_to_level sits on the next chunk boundary, sc_level + CHUNK would exceed skip_to_level and fire the trim with shift = skip_to_level & CHUNK_MASK == 0, which clears the whole dissimilarity word and makes a differing shortcut compare equal.
Use the end of the chunk that contains sc_level instead:
skip_to_level < round_down(sc_level, CHUNK) + CHUNK
For an aligned sc_level whose word holds skip_to_level this now fires (the first bug); for an unaligned sc_level with skip_to_level on the following boundary it does not, so shift is never 0 when the branch runs and the trim never clears the whole word.
--- lib/assoc_array.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
lib/assoc_array.c +2 -1
@@ -255,7 +255,8 @@ assoc_array_walk(const struct assoc_array *array, sc_segments = shortcut->index_key[sc_level >>ASSOC_ARRAY_KEY_CHUNK_SHIFT ]; dissimilarity = segments ^ sc_segments; -if (round_up (sc_level,ASSOC_ARRAY_KEY_CHUNK_SIZE ) > shortcut->skip_to_level) { +if (shortcut->skip_to_level <round_down (sc_level, +ASSOC_ARRAY_KEY_CHUNK_SIZE ) +ASSOC_ARRAY_KEY_CHUNK_SIZE ) {/* Trim segments that are beyond the shortcut */ int shift = shortcut->skip_to_level &ASSOC_ARRAY_KEY_CHUNK_MASK ; dissimilarity &= ~(ULONG_MAX << shift);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 56/438 ipvs: adjust double hashing when fwd method changes
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Anastasov <[email protected]>
[ Upstream commit 712d2993bea555f1f09cd53cbdb25714f28e85db ]
Synced conns can be created with one forwarding method and later updated with different one after the dest server is configured. This needs adjusting the hashing for node hn1 because only MASQ supports double hashing.
Modify conn_tab_lock() to support seeking for hash node hn0 together with adding for hn1. By this way we can safely modify the forwarding method and hn1.hash_key under bucket lock for the first node hn0. The forwarding method is also protected by cp->lock as it is part of cp->flags.
Fix the usage of stale idx/idx2 values in conn_tab_lock after jumping to the retry label. Instead, use idx/idx2 values just to order the locking for the old/new tables.
--- net/netfilter/ipvs/ip_vs_conn.c | 189 +++++++++++++++++++++++++------- 1 file changed, 147 insertions(+), 42 deletions(-)
net/netfilter/ipvs/ip_vs_conn.c +147 -42
@@ -70,25 +70,45 @@ static struct kmem_cache *ip_vs_conn_cachep __read_mostly;* bucket or hash table * - hash table resize works like rehash but always rehashes into new table * - bit lock on bucket serializes all operations that modify the chain +* - on resize, bucket from the old table is locked before bucket from the +* new table * - cp->lock protects conn fields like cp->flags, cp->dest */ -/* Lock conn_tab bucket for conn hash/unhash, not for rehash */ +/** +* conn_tab_lock - Lock conn_tab buckets for conn hash/unhash, not for rehash +* @t: hash table for hn0, new_tbl when new_hash=true +* @t2: hash table for hn1, new_tbl when new_hash2=true +* @cp: connection +* @hash_key: hash key for hn0 +* @hash_key2: hash key for hn1 +* @use2: using hn1 (double hashing) based on the forwarding method +* @new_hash: mode for hn0, hash node (true) or seek node (false) +* @new_hash2: mode for hn1, hash node (true) or seek node (false) +* @head_ret: returned head for hn0 +* @head2_ret: returned head for hn1 +* +* We support 3 modes: +* - seek mode for both nodes, used for unhashing +* - hash mode for both nodes, used for hashing +* - seek hn0 and hash hn1, used when forwarding method is changed +*/ static __always_inline void -conn_tab_lock (struct ip_vs_rht *t,struct ip_vs_conn *cp,u32 hash_key, -u32 hash_key2,bool use2,bool new_hash, -struct hlist_bl_head **head_ret,struct hlist_bl_head **head2_ret) +conn_tab_lock (struct ip_vs_rht *t,struct ip_vs_rht *t2,struct ip_vs_conn *cp, +u32 hash_key,u32 hash_key2,bool use2,bool new_hash, +bool new_hash2,struct hlist_bl_head **head_ret, +struct hlist_bl_head **head2_ret) {struct hlist_bl_head *head, *head2;u32 hash_key_new, hash_key_new2; -struct ip_vs_rht *t2 = t; -u32 idx, idx2; +int idx =0 , idx2 =0 ; + +/* Advance idx2 when new_hash is not set but hash_key2 +* is for new table +*/ +if (new_hash2 && use2 && t != t2) + idx2++; - idx = hash_key & t->mask; -if (use2) - idx2 = hash_key2 & t->mask; -else - idx2 = idx;if (!new_hash) {/* We need to lock the bucket in the right table */
@@ -100,46 +120,45 @@ conn_tab_lock(struct ip_vs_rht *t, struct ip_vs_conn *cp, u32 hash_key,* both nodes in different tables, use idx/idx2 * for proper lock ordering for heads. */ - idx = hash_key & t->mask; - idx |=IP_VS_RHT_TABLE_ID_MASK ; - } -if (use2) { -if (!ip_vs_rht_same_table (t2, hash_key2)) { -/* It is already moved to new table */ - t2 =rcu_dereference (t2->new_tbl); - idx2 = hash_key2 & t2->mask; - idx2 |=IP_VS_RHT_TABLE_ID_MASK ; - } - }else { - idx2 = idx; + idx++; } } +if (use2 && !new_hash2 && !ip_vs_rht_same_table (t2, hash_key2)) { +/* It is already moved to new table */ + t2 =rcu_dereference (t2->new_tbl); + idx2++; + } +if (!use2) + idx2 = idx; head = t->buckets + (hash_key & t->mask); head2 = use2 ? t2->buckets + (hash_key2 & t2->mask) : head; -local_bh_disable (); -/* Do not touch seqcount, this is a safe operation */ - -if (idx <= idx2) { +if (idx > idx2 || (head > head2 && idx == idx2)) { +hlist_bl_lock (head2);hlist_bl_lock (head); -if (head != head2) -hlist_bl_lock (head2); }else { -hlist_bl_lock (head2);hlist_bl_lock (head); +if (head != head2) +hlist_bl_lock (head2); }if (!new_hash) { +bool changed; +/* Ensure hash_key is read under lock */ hash_key_new =READ_ONCE (cp->hn0.hash_key); - hash_key_new2 =READ_ONCE (cp->hn1.hash_key); + changed = hash_key != hash_key_new; +if (use2 && !new_hash2) { + hash_key_new2 =READ_ONCE (cp->hn1.hash_key); + changed |= hash_key2 != hash_key_new2; + }else { + hash_key_new2 = hash_key2; + }/* Hash changed ? */ -if (hash_key != hash_key_new || - (hash_key2 != hash_key_new2 && use2)) { +if (changed) {if (head != head2)hlist_bl_unlock (head2);hlist_bl_unlock (head); -local_bh_enable (); hash_key = hash_key_new; hash_key2 = hash_key_new2; goto retry;
@@ -155,7 +174,6 @@ static inline void conn_tab_unlock(struct hlist_bl_head *head,if (head != head2)hlist_bl_unlock (head2);hlist_bl_unlock (head); -local_bh_enable (); }static void ip_vs_conn_expire (struct timer_list *t);
@@ -268,8 +286,9 @@ static inline int ip_vs_conn_hash(struct ip_vs_conn *cp) use2 = false; } -conn_tab_lock (t, cp, hash_key, hash_key2, use2, true/* new_hash */ , - &head, &head2); +local_bh_disable (); +conn_tab_lock (t, t, cp, hash_key, hash_key2, use2, true/* new_hash */ , + true/* new_hash2 */ , &head, &head2); cp->flags |=IP_VS_CONN_F_HASHED ;WRITE_ONCE (cp->hn0.hash_key, hash_key);
@@ -280,6 +299,7 @@ static inline int ip_vs_conn_hash(struct ip_vs_conn *cp)hlist_bl_add_head_rcu (&cp->hn1.node, head2);conn_tab_unlock (head, head2); +local_bh_enable (); ret =1 ;/* Schedule resizing if load increases */
@@ -306,18 +326,20 @@ static inline bool ip_vs_conn_unlink(struct ip_vs_conn *cp)return refcount_dec_if_one (&cp->refcnt);rcu_read_lock (); +local_bh_disable (); t =rcu_dereference (ipvs->conn_tab); hash_key =READ_ONCE (cp->hn0.hash_key); hash_key2 =READ_ONCE (cp->hn1.hash_key); use2 =ip_vs_conn_use_hash2 (cp); -conn_tab_lock (t, cp, hash_key, hash_key2, use2, false/* new_hash */ , - &head, &head2); +conn_tab_lock (t, t, cp, hash_key, hash_key2, use2, false/* new_hash */ , + false/* new_hash2 */ , &head, &head2);if (cp->flags &IP_VS_CONN_F_HASHED ) {/* Decrease refcnt and unlink conn only if we are last user */ -if (refcount_dec_if_one (&cp->refcnt)) { +if (use2 ==ip_vs_conn_use_hash2 (cp) && +refcount_dec_if_one (&cp->refcnt)) {hlist_bl_del_rcu (&cp->hn0.node);if (use2)hlist_bl_del_rcu (&cp->hn1.node);
@@ -328,6 +350,7 @@ static inline bool ip_vs_conn_unlink(struct ip_vs_conn *cp)conn_tab_unlock (head, head2); +local_bh_enable ();rcu_read_unlock ();return ret;
@@ -632,6 +655,7 @@ void ip_vs_conn_fill_cport(struct ip_vs_conn *cp, __be16 cport)int ntbl;int dir; +restart:/* No packets from inside, so we can do it in 2 steps. */ dir = use2 ?1 :0 ;
@@ -686,6 +710,23 @@ void ip_vs_conn_fill_cport(struct ip_vs_conn *cp, __be16 cport)/* Protect the cp->flags modification */ spin_lock_bh (&cp->lock); +/* Recheck the forwarding method under lock */ +if (use2 !=ip_vs_conn_use_hash2 (cp)) { + use2 = !use2; +if (use2) { +spin_unlock_bh (&cp->lock); +/* Restart with new use2 value */ + goto restart; + } +if (dir) { +/* Not started yet, so just skip dir 1 */ +spin_unlock_bh (&cp->lock); + dir--; + goto next_dir; + } +/* Just finish dir 0 */ + } +/* Lock seqcount only for the old bucket, even if we are on new table * because it affects the del operation, not the adding. */
@@ -752,6 +793,61 @@ void ip_vs_conn_fill_cport(struct ip_vs_conn *cp, __be16 cport) goto next_dir; } +/* Change forwarding method for hashed conn */ +static void ip_vs_conn_change_fwd_mask (struct ip_vs_conn *cp,u32 new_flags) +{ +struct netns_ipvs *ipvs = cp->ipvs; +struct hlist_bl_head *head, *head2; +u32 hash2, hash_key, hash_key2; +struct ip_vs_rht *t, *t2; + +/* See ip_vs_conn_use_hash2() for reference */ +if ((cp->flags &IP_VS_CONN_F_TEMPLATE ) || +/* No change in double hashing ? */ + (IP_VS_FWD_METHOD (cp) ==IP_VS_CONN_F_MASQ ) == + ((new_flags &IP_VS_CONN_F_FWD_MASK ) ==IP_VS_CONN_F_MASQ )) { + cp->flags = new_flags; +return ; + } + t =rcu_dereference (ipvs->conn_tab); +if (ip_vs_conn_use_hash2 (cp)) { +/* Stop double hashing */ + hash_key =READ_ONCE (cp->hn0.hash_key); + hash_key2 =READ_ONCE (cp->hn1.hash_key); + +conn_tab_lock (t, t, cp, hash_key, hash_key2, true/* use2 */ , + false/* new_hash */ , false/* new_hash2 */ , + &head, &head2); + +/* Keep both hash keys in same table */ + hash_key =READ_ONCE (cp->hn0.hash_key); +WRITE_ONCE (cp->hn1.hash_key, hash_key); +hlist_bl_del_rcu (&cp->hn1.node); + cp->flags = new_flags; + +conn_tab_unlock (head, head2); + }else { +/* Start double hashing */ + + hash_key =READ_ONCE (cp->hn0.hash_key); + + t2 =rcu_dereference (t->new_tbl); + hash2 =ip_vs_conn_hashkey_conn (t2, cp, true); + hash_key2 =ip_vs_rht_build_hash_key (t2, hash2); + +/* Change the forwarding method under locked hn0 */ +conn_tab_lock (t, t2, cp, hash_key, hash_key2, true/* use2 */ , + false/* new_hash */ , true/* new_hash2 */ , + &head, &head2); + +WRITE_ONCE (cp->hn1.hash_key, hash_key2); + cp->flags = new_flags; +hlist_bl_add_head_rcu (&cp->hn1.node, head2); + +conn_tab_unlock (head, head2); + } +} +/* Get default load factor to map conn_count/u_thresh to t->size */ static int ip_vs_conn_default_load_factor (struct netns_ipvs *ipvs) {
@@ -1021,9 +1117,18 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, struct ip_vs_dest *dest) conn_flags &= ~IP_VS_CONN_F_INACTIVE ;/* connections inherit forwarding method from dest */ flags &= ~(IP_VS_CONN_F_FWD_MASK |IP_VS_CONN_F_NOOUTPUT ); + flags |= conn_flags; +/* Changing forwarding method for hashed conn can +* happen only under locks +*/ +if (cp->flags &IP_VS_CONN_F_HASHED ) +ip_vs_conn_change_fwd_mask (cp, flags); +else + cp->flags = flags; + }else { + flags |= conn_flags; + cp->flags = flags; } - flags |= conn_flags; - cp->flags = flags; cp->dest = dest; IP_VS_DBG_BUF(7, "Bind-dest %s c:%s:%d v:%s:%d "
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 57/438 netfilter: nf_tables: make nft_object rhltable per table
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit f4f699790590bd0896c48a71e9232a65198f92f0 ]
The nft_object rhltable is global, this allows for accessing objects that are being dismangled from lookup path by other existing netns. Given the nft_obj_destroy() releases the object inmediately, this might lead to use-after-free of these objects that are being released. Make the existing rhltable per table to address this issue to deal with with the nft_rcv_nl_event() path too.
Update nft_obj_lookup() to take the table as non-const, otherwise, compiler complains when passing the objname_ht to rhltable_lookup().
--- include/net/netfilter/nf_tables.h | 4 +++- net/netfilter/nf_tables_api.c | 34 +++++++++++++++---------------- 2 files changed, 19 insertions(+), 19 deletions(-)
include/net/netfilter/nf_tables.h +3 -1
@@ -1294,6 +1294,7 @@ static inline void nft_use_inc_restore(u32 *use)* @sets: sets in the table * @objects: stateful objects in the table * @flowtables: flow tables in the table +* @objname_ht: hashtable for objects lookup by name * @hgenerator: handle generator state * @handle: table handle * @use: number of chain references to this table
@@ -1313,6 +1314,7 @@ struct nft_table {struct list_head sets;struct list_head objects;struct list_head flowtables; +struct rhltable objname_ht;u64 hgenerator;u64 handle;u32 use;
@@ -1400,7 +1402,7 @@ static inline void *nft_obj_data(const struct nft_object *obj)#define nft_expr_obj (expr) *((struct nft_object **)nft_expr_priv(expr))struct nft_object *nft_obj_lookup (const struct net *net, -const struct nft_table *table, +struct nft_table *table,const struct nlattr *nla,u32 objtype,u8 genmask);
net/netfilter/nf_tables_api.c +16 -18
@@ -45,8 +45,6 @@ enum { NFT_VALIDATE_DO, }; -static struct rhltable nft_objname_ht; -static u32 nft_chain_hash (const void *data,u32 len,u32 seed);static u32 nft_chain_hash_obj (const void *data,u32 len,u32 seed);static int nft_chain_hash_cmp (struct rhashtable_compare_arg *,const void *);
@@ -1635,6 +1633,10 @@ static int nf_tables_newtable(struct sk_buff *skb, const struct nfnl_info *info,if (err) goto err_chain_ht; + err =rhltable_init (&table->objname_ht, &nft_objname_ht_params); +if (err <0 ) + goto err_obj_ht; +INIT_LIST_HEAD (&table->chains);INIT_LIST_HEAD (&table->sets);INIT_LIST_HEAD (&table->objects);
@@ -1653,6 +1655,8 @@ static int nf_tables_newtable(struct sk_buff *skb, const struct nfnl_info *info,list_add_tail_rcu (&table->list, &nft_net->tables);return 0 ; err_trans: +rhltable_destroy (&table->objname_ht); +err_obj_ht:rhltable_destroy (&table->chains_ht); err_chain_ht:kfree (table->udata);
@@ -1819,6 +1823,7 @@ static void nf_tables_table_destroy(struct nft_table *table)return ;rhltable_destroy (&table->chains_ht); +rhltable_destroy (&table->objname_ht);kfree (table->name);kfree (table->udata);kfree (table);
@@ -8082,7 +8087,7 @@ void nft_unregister_obj(struct nft_object_type *obj_type)EXPORT_SYMBOL_GPL (nft_unregister_obj);struct nft_object *nft_obj_lookup (const struct net *net, -const struct nft_table *table, +struct nft_table *table,const struct nlattr *nla,u32 objtype,u8 genmask) {
@@ -8098,7 +8103,7 @@ struct nft_object *nft_obj_lookup(const struct net *net, !lockdep_commit_lock_is_held(net));rcu_read_lock (); - list =rhltable_lookup (&nft_objname_ht, &k, nft_objname_ht_params); + list =rhltable_lookup (&table->objname_ht, &k, nft_objname_ht_params);if (!list) goto out;
@@ -8376,7 +8381,7 @@ static int nf_tables_newobj(struct sk_buff *skb, const struct nfnl_info *info,if (err <0 ) goto err_trans; - err =rhltable_insert (&nft_objname_ht, &obj->rhlhead, + err =rhltable_insert (&table->objname_ht, &obj->rhlhead, nft_objname_ht_params);if (err <0 ) goto err_obj_ht;
@@ -8561,8 +8566,8 @@ nf_tables_getobj_single(u32 portid, const struct nfnl_info *info,struct netlink_ext_ack *extack = info->extack;u8 genmask =nft_genmask_cur (info->net);u8 family = info->nfmsg->nfgen_family; -const struct nft_table *table;struct net *net = info->net; +struct nft_table *table;struct nft_object *obj;struct sk_buff *skb2;u32 objtype;
@@ -10423,9 +10428,9 @@ static void nf_tables_commit_chain(struct net *net, struct nft_chain *chain)nf_tables_commit_chain_free_rules_old (g0); } -static void nft_obj_del (struct nft_object *obj) +static void nft_obj_del (struct nft_table *table,struct nft_object *obj) { -rhltable_remove (&nft_objname_ht, &obj->rhlhead, nft_objname_ht_params); +rhltable_remove (&table->objname_ht, &obj->rhlhead, nft_objname_ht_params);list_del_rcu (&obj->list); }
@@ -11110,7 +11115,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)break ;case NFT_MSG_DELOBJ :case NFT_MSG_DESTROYOBJ : -nft_obj_del (nft_trans_obj (trans)); +nft_obj_del (table,nft_trans_obj (trans));nf_tables_obj_notify (&ctx,nft_trans_obj (trans), trans->msg_type);break ;
@@ -11402,7 +11407,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)nft_trans_destroy (trans); }else {nft_use_dec_restore (&table->use); -nft_obj_del (nft_trans_obj (trans)); +nft_obj_del (table,nft_trans_obj (trans)); }break ;case NFT_MSG_DELOBJ :
@@ -12025,7 +12030,7 @@ static void __nft_release_table(struct net *net, struct nft_table *table)nft_set_destroy (&ctx, set); }list_for_each_entry_safe (obj, ne, &table->objects, list) { -nft_obj_del (obj); +nft_obj_del (table, obj);nft_use_dec (&table->use);nft_obj_destroy (&ctx, obj); }
@@ -12207,10 +12212,6 @@ static int __init nf_tables_module_init(void)if (err <0 ) goto err_netdev_notifier; - err =rhltable_init (&nft_objname_ht, &nft_objname_ht_params); -if (err <0 ) - goto err_rht_objname; - err =nft_offload_init ();if (err <0 ) goto err_offload;
@@ -12233,8 +12234,6 @@ static int __init nf_tables_module_init(void) err_netlink_notifier:nft_offload_exit (); err_offload: -rhltable_destroy (&nft_objname_ht); -err_rht_objname:unregister_netdevice_notifier (&nf_tables_flowtable_notifier); err_netdev_notifier:nf_tables_core_module_exit ();
@@ -12256,7 +12255,6 @@ static void __exit nf_tables_module_exit(void)unregister_pernet_subsys (&nf_tables_net_ops);cancel_work_sync (&trans_gc_work);rcu_barrier (); -rhltable_destroy (&nft_objname_ht);nf_tables_core_module_exit (); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 58/438 netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 305b63e1402267459fdabb183af4527f6799eebf ]
The XT_HASHLIMIT_RATE_MATCH flag mode changes the semantics of the dsthash_ent structure which represents an entry in the hashtable. There is a union area which uses a different layout to express the rate match mode.
Update .checkentry path to validate the XT_HASHLIMIT_RATE_MATCH mode flag is requested by two or more different rules that refer to the same hashtable. Otherwise, uninitialized access to the burst field in the union is possible.
Reject the use of the XT_HASHLIMIT_RATE_MATCH mode flag if set on by revision less than 3 too.
--- net/netfilter/xt_hashlimit.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
net/netfilter/xt_hashlimit.c +15 -1
@@ -117,6 +117,7 @@ struct xt_hashlimit_htable {refcount_t use;u_int8_t family;bool rnd_initialized; +bool ratematch;struct hashlimit_cfg3 cfg;/* config */
@@ -323,6 +324,7 @@ static int htable_create(struct net *net, struct hashlimit_cfg3 *cfg,kvfree (hinfo);return -ENOMEM ; } + hinfo->ratematch = !!(cfg->mode &XT_HASHLIMIT_RATE_MATCH );spin_lock_init (&hinfo->lock);switch (revision) {
@@ -872,7 +874,10 @@ static int hashlimit_mt_check_common(const struct xt_mtchk_param *par, }/* Check for overflow. */ -if (revision >=3 && cfg->mode &XT_HASHLIMIT_RATE_MATCH ) { +if (cfg->mode &XT_HASHLIMIT_RATE_MATCH ) { +if (revision <3 ) +return -EINVAL ; +if (cfg->avg ==0 || cfg->avg >U32_MAX ) {pr_info_ratelimited ("invalid rate\n" );return -ERANGE ;
@@ -905,6 +910,15 @@ static int hashlimit_mt_check_common(const struct xt_mtchk_param *par,mutex_unlock (&hashlimit_mutex);return ret; } + }else { +if ((cfg->mode &XT_HASHLIMIT_RATE_MATCH && + !(*hinfo)->ratematch) || + (!(cfg->mode &XT_HASHLIMIT_RATE_MATCH ) && + (*hinfo)->ratematch)) { +mutex_unlock (&hashlimit_mutex); +htable_put (*hinfo); +return -EINVAL ; + } }mutex_unlock (&hashlimit_mutex);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 59/438 ipvs: fix the checksum validations
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Anastasov <[email protected]>
[ Upstream commit e876b75b9020a97bbdc79721e7fc749024891c65 ]
ip_vs_in_icmp_v6() is missing checksum validation for ICMPv6 packets from clients. In fact, as for TCP/UDP we should validate the checksum for ICMP packets only when we mangle the packets on MASQ or on reply for tunnel.
Also, Sashiko points out that handle_response_icmp() being common for IPv4 and IPv6 is missing the pseudo-header calculation while validating ICMPv6 messages from real servers which is a problem if checksum is not validated by the hardware.
Fix the problems by creating ip_vs_checksum_common_check() helper and use it for TCP/UDP/ICMP both for IPv4 and IPv6. Rely on the nf_checksum() for validating the ICMP messages but use it also for TCP and UDP.
Use correct IP offset for IP_VS_DBG_RL_PKT for TCP/UDP/SCTP.
IPVS packets (TCP/UDP/SCTP/ICMP) do not need checksum validation on LOCAL_OUT (local clients or local real servers) and on FORWARD (traffic from servers on LAN). Do it only on LOCAL_IN, in case nf_checksum() is not called on PRE_ROUTING.
Also, ip_vs_checksum_complete() can be marked static.
--- include/net/ip_vs.h | 31 +++++++++++++++-- net/netfilter/ipvs/ip_vs_core.c | 20 +++++++++-- net/netfilter/ipvs/ip_vs_proto_sctp.c | 15 ++++---- net/netfilter/ipvs/ip_vs_proto_tcp.c | 44 +++++------------------ net/netfilter/ipvs/ip_vs_proto_udp.c | 50 ++++++--------------------- 5 files changed, 74 insertions(+), 86 deletions(-)
include/net/ip_vs.h +29 -2
@@ -25,7 +25,9 @@#include <linux/netfilter.h> /* for union nf_inet_addr */ #include <linux/ip.h> #include <linux/ipv6.h> /* for struct ipv6hdr */ +#include <net/route.h> #include <net/ipv6.h> +#include <net/ip6_fib.h> #if IS_ENABLED (CONFIG_NF_CONNTRACK )#include <net/netfilter/nf_conntrack.h> #endif
@@ -2044,8 +2046,6 @@ void ip_vs_nat_icmp_v6(struct sk_buff *skb, struct ip_vs_protocol *pp, struct ip_vs_conn *cp, int dir);#endif -__sum16 ip_vs_checksum_complete (struct sk_buff *skb,int offset); -static inline __wsum ip_vs_check_diff4 (__be32 old,__be32 new,__wsum oldsum) {__be32 diff[2 ] = { ~old, new };
@@ -2071,6 +2071,33 @@ static inline __wsum ip_vs_check_diff2(__be16 old, __be16 new, __wsum oldsum)return csum_partial (diff,sizeof (diff), oldsum); } +static inline bool ip_vs_checksum_needed (struct sk_buff *skb,int af) +{ +/* Checksum unnecessary or already validated? */ +if (skb_csum_unnecessary (skb)) +return false; +/* LOCAL_OUT ? */ +if (!skb->dev || skb->dev->flags &IFF_LOOPBACK ) +return false; +/* !LOCAL_IN (FORWARD) ? */ +if (af ==AF_INET6 ) { +if (!(dst_rt6_info (skb_dst (skb))->rt6i_flags &RTF_LOCAL )) +return false; + }else { +if (!(skb_rtable (skb)->rt_flags &RTCF_LOCAL )) +return false; + } +return true; +} + +static inline bool ip_vs_checksum_common_check (struct sk_buff *skb, +int offset,int proto,int af) +{ +if (!ip_vs_checksum_needed (skb, af)) +return true; +return !nf_checksum (skb,NF_INET_LOCAL_IN , offset, proto, af); +} +/* Forget current conntrack (unconfirmed) and attach notrack entry */ static inline void ip_vs_notrack (struct sk_buff *skb) {
net/netfilter/ipvs/ip_vs_core.c +17 -3
@@ -867,7 +867,7 @@ static int sysctl_nat_icmp_send(struct netns_ipvs *ipvs) { return 0; }#endif -__sum16 ip_vs_checksum_complete (struct sk_buff *skb,int offset) +static __sum16 ip_vs_checksum_complete (struct sk_buff *skb,int offset) {return csum_fold (skb_checksum (skb, offset, skb->len - offset,0 )); }
@@ -1038,13 +1038,14 @@ static int handle_response_icmp(int af, struct sk_buff *skb, unsigned int offset, unsigned int ihl, unsigned int hooknum) { + int iproto = af == AF_INET6 ? IPPROTO_ICMPV6 : IPPROTO_ICMP;unsigned int verdict =NF_DROP ;if (IP_VS_FWD_METHOD (cp) !=IP_VS_CONN_F_MASQ ) goto after_nat;/* Ensure the checksum is correct */ -if (!skb_csum_unnecessary (skb) &&ip_vs_checksum_complete (skb, ihl)) { +if (!ip_vs_checksum_common_check (skb, ihl, iproto, af)) {/* Failed checksum! */ IP_VS_DBG_BUF (1 ,"Forward ICMP: failed checksum from %s!\n" ,IP_VS_DBG_ADDR (af, snet));
@@ -1898,7 +1899,8 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related, verdict =NF_DROP ;/* Ensure the checksum is correct */ -if (!skb_csum_unnecessary (skb) &&ip_vs_checksum_complete (skb, ihl)) { +if ((IP_VS_FWD_METHOD (cp) ==IP_VS_CONN_F_MASQ || tunnel) && + !ip_vs_checksum_common_check (skb, ihl,IPPROTO_ICMP ,AF_INET )) {/* Failed checksum! */ IP_VS_DBG (1 ,"Incoming ICMP: failed checksum from %pI4!\n" , &iph->saddr);
@@ -2064,6 +2066,18 @@ static int ip_vs_in_icmp_v6(struct netns_ipvs *ipvs, struct sk_buff *skb, goto out; } + verdict =NF_DROP ; + +/* Ensure the checksum is correct */ +if (IP_VS_FWD_METHOD (cp) ==IP_VS_CONN_F_MASQ && + !ip_vs_checksum_common_check (skb, iph->len,IPPROTO_ICMPV6 , +AF_INET6 )) { +/* Failed checksum! */ +IP_VS_DBG (1 ,"Incoming ICMPv6: failed checksum from %pI6c!\n" , + &iph->saddr); + goto out; + } +/* do the statistics and put it back */ ip_vs_in_stats (cp, skb);
net/netfilter/ipvs/ip_vs_proto_sctp.c +9 -6
@@ -11,7 +11,7 @@static int sctp_csum_check (int af,struct sk_buff *skb,struct ip_vs_protocol *pp, -unsigned int sctphoff); +struct ip_vs_iphdr *iph); static int sctp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb,
@@ -109,7 +109,7 @@ sctp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,int ret;/* Some checks before mangling */ -if (!sctp_csum_check (cp->af, skb, pp, sctphoff)) +if (!sctp_csum_check (cp->af, skb, pp, iph))return 0 ;/* Call application helper if needed */
@@ -157,7 +157,7 @@ sctp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,int ret;/* Some checks before mangling */ -if (!sctp_csum_check (cp->af, skb, pp, sctphoff)) +if (!sctp_csum_check (cp->af, skb, pp, iph))return 0 ;/* Call application helper if needed */
@@ -187,19 +187,22 @@ sctp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,static int sctp_csum_check (int af,struct sk_buff *skb,struct ip_vs_protocol *pp, -unsigned int sctphoff) +struct ip_vs_iphdr *iph) { +unsigned int sctphoff = iph->len;struct sctphdr *sh;__le32 cmp, val; +if (!ip_vs_checksum_needed (skb, af)) +return 1 ; sh = (struct sctphdr *)(skb->data + sctphoff); cmp = sh->checksum; val =sctp_compute_cksum (skb, sctphoff);if (val != cmp) {/* CRC failure, dump it. */ -IP_VS_DBG_RL_PKT (0 , af, pp, skb,0 , -"Failed checksum for" ); +IP_VS_DBG_RL_PKT (0 , af, pp, skb, iph->off, +"Failed checksum for" );return 0 ; }return 1 ;
net/netfilter/ipvs/ip_vs_proto_tcp.c +8 -36
70 lines not on this page · raw message
net/netfilter/ipvs/ip_vs_proto_udp.c +11 -39
80 lines not on this page · raw message
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 60/438 ipvs: fix places with wrong packet offsets
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Anastasov <[email protected]>
[ Upstream commit 15cab31a3730e05f0767b922a7450e5d784b2607 ]
The offsets we use to packet headers and payloads should be based on skb->data. We even already respect non-zero network offset in ip_vs_fill_iph_skb() but some places do it wrongly and support only zero offset which is expected for the IP layer where IPVS has hooks.
Change all places that instead of skb->data use offsets based on the network header (skb_network_header, ip_hdr, etc) because this doubles the network offset as noted by Sashiko.
For ip_vs_nat_icmp_v6() we can even rely on the IPv6 header parsing done by the caller.
--- include/net/ip_vs.h | 15 +-- net/netfilter/ipvs/ip_vs_app.c | 4 +- net/netfilter/ipvs/ip_vs_core.c | 133 +++++++++++++------------- net/netfilter/ipvs/ip_vs_proto_sctp.c | 4 +- net/netfilter/ipvs/ip_vs_proto_tcp.c | 4 +- net/netfilter/ipvs/ip_vs_proto_udp.c | 4 +- net/netfilter/ipvs/ip_vs_xmit.c | 26 ++--- 7 files changed, 97 insertions(+), 93 deletions(-)
include/net/ip_vs.h +9 -6
@@ -1952,8 +1952,9 @@ int ip_vs_tunnel_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,int ip_vs_dr_xmit (struct sk_buff *skb,struct ip_vs_conn *cp,struct ip_vs_protocol *pp,struct ip_vs_iphdr *iph);int ip_vs_icmp_xmit (struct sk_buff *skb,struct ip_vs_conn *cp, -struct ip_vs_protocol *pp,int offset, -unsigned int hooknum,struct ip_vs_iphdr *iph); +struct ip_vs_protocol *pp,unsigned int toff, +unsigned int wlen,unsigned int hooknum, +struct ip_vs_iphdr *ciph);void ip_vs_dest_dst_rcu_free (struct rcu_head *head);#ifdef CONFIG_IP_VS_IPV6
@@ -1966,8 +1967,9 @@ int ip_vs_tunnel_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,int ip_vs_dr_xmit_v6 (struct sk_buff *skb,struct ip_vs_conn *cp,struct ip_vs_protocol *pp,struct ip_vs_iphdr *iph);int ip_vs_icmp_xmit_v6 (struct sk_buff *skb,struct ip_vs_conn *cp, -struct ip_vs_protocol *pp,int offset, -unsigned int hooknum,struct ip_vs_iphdr *iph); +struct ip_vs_protocol *pp,unsigned int toff, +unsigned int wlen,unsigned int hooknum, +struct ip_vs_iphdr *ciph);#endif #ifdef CONFIG_SYSCTL
@@ -2039,11 +2041,12 @@ static inline bool ip_vs_conn_use_hash2(struct ip_vs_conn *cp) }void ip_vs_nat_icmp (struct sk_buff *skb,struct ip_vs_protocol *pp, -struct ip_vs_conn *cp,int dir); +struct ip_vs_conn *cp,int dir,unsigned int toff);#ifdef CONFIG_IP_VS_IPV6 void ip_vs_nat_icmp_v6 (struct sk_buff *skb,struct ip_vs_protocol *pp, -struct ip_vs_conn *cp,int dir); +struct ip_vs_conn *cp,int dir,unsigned int toff, +struct ip_vs_iphdr *ciph);#endif static inline __wsum ip_vs_check_diff4 (__be32 old,__be32 new,__wsum oldsum)
net/netfilter/ipvs/ip_vs_app.c +2 -2
@@ -367,7 +367,7 @@ static inline int app_tcp_pkt_out(struct ip_vs_conn *cp, struct sk_buff *skb,if (skb_ensure_writable (skb, ipvsh->len +sizeof (*th)))return 0 ; - th = (struct tcphdr *)(skb_network_header (skb) + ipvsh->len); + th = (struct tcphdr *)(skb->data + ipvsh->len);/* * Remember seq number in case this pkt gets resized
@@ -443,7 +443,7 @@ static inline int app_tcp_pkt_in(struct ip_vs_conn *cp, struct sk_buff *skb,if (skb_ensure_writable (skb, ipvsh->len +sizeof (*th)))return 0 ; - th = (struct tcphdr *)(skb_network_header (skb) + ipvsh->len); + th = (struct tcphdr *)(skb->data + ipvsh->len);/* * Remember seq number in case this pkt gets resized
net/netfilter/ipvs/ip_vs_core.c +66 -67
332 lines not on this page · raw message
net/netfilter/ipvs/ip_vs_proto_sctp.c +2 -2
@@ -121,7 +121,7 @@ sctp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, payload_csum = true; } - sctph = (void *)skb_network_header (skb) + sctphoff; + sctph = (void *)skb->data + sctphoff;/* Only update csum if we really have to */ if (sctph->source != cp->vport || payload_csum ||
@@ -169,7 +169,7 @@ sctp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, payload_csum = true; } - sctph = (void *)skb_network_header (skb) + sctphoff; + sctph = (void *)skb->data + sctphoff;/* Only update csum if we really have to */ if (sctph->dest != cp->dport || payload_csum ||
net/netfilter/ipvs/ip_vs_proto_tcp.c +2 -2
@@ -179,7 +179,7 @@ tcp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, payload_csum = true; } - tcph = (void *)skb_network_header (skb) + tcphoff; + tcph = (void *)skb->data + tcphoff; tcph->source = cp->vport;/* Adjust TCP checksums */
@@ -260,7 +260,7 @@ tcp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, payload_csum = true; } - tcph = (void *)skb_network_header (skb) + tcphoff; + tcph = (void *)skb->data + tcphoff; tcph->dest = cp->dport;/*
net/netfilter/ipvs/ip_vs_proto_udp.c +2 -2
@@ -170,7 +170,7 @@ udp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, payload_csum = true; } - udph = (void *)skb_network_header (skb) + udphoff; + udph = (void *)skb->data + udphoff; udph->source = cp->vport;/*
@@ -254,7 +254,7 @@ udp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, payload_csum = true; } - udph = (void *)skb_network_header (skb) + udphoff; + udph = (void *)skb->data + udphoff; udph->dest = cp->dport;/*
net/netfilter/ipvs/ip_vs_xmit.c +14 -12
@@ -1502,8 +1502,9 @@ ip_vs_dr_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,*/ int ip_vs_icmp_xmit (struct sk_buff *skb,struct ip_vs_conn *cp, -struct ip_vs_protocol *pp,int offset,unsigned int hooknum, -struct ip_vs_iphdr *iph) +struct ip_vs_protocol *pp,unsigned int toff, +unsigned int wlen,unsigned int hooknum, +struct ip_vs_iphdr *ciph) {struct rtable *rt;/* Route to the other host */ int rc;
@@ -1515,7 +1516,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,translate address/port back */ if (IP_VS_FWD_METHOD (cp) !=IP_VS_CONN_F_MASQ ) {if (cp->packet_xmit) - rc = cp->packet_xmit (skb, cp, pp, iph); + rc = cp->packet_xmit (skb, cp, pp, ciph);else rc =NF_ACCEPT ;/* do not touch skb anymore */
@@ -1533,7 +1534,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,IP_VS_RT_MODE_LOCAL |IP_VS_RT_MODE_NON_LOCAL | IP_VS_RT_MODE_RDR : IP_VS_RT_MODE_NON_LOCAL; local =__ip_vs_get_out_rt (cp->ipvs, cp->af, skb, cp->dest, cp->daddr.ip, rt_mode, -NULL , iph); +NULL , ciph);if (local <0 ) goto tx_error; rt =skb_rtable (skb);
@@ -1565,13 +1566,13 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp, }/* copy-on-write the packet before mangling it */ -if (skb_ensure_writable (skb, offset)) +if (skb_ensure_writable (skb, wlen)) goto tx_error;if (skb_cow (skb, rt->dst.dev->hard_header_len)) goto tx_error; -ip_vs_nat_icmp (skb, pp, cp,0 ); +ip_vs_nat_icmp (skb, pp, cp,0 , toff);/* Another hack: avoid icmp_send in ip_fragment */ skb->ignore_df =1 ;
@@ -1587,8 +1588,9 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,#ifdef CONFIG_IP_VS_IPV6 int ip_vs_icmp_xmit_v6 (struct sk_buff *skb,struct ip_vs_conn *cp, -struct ip_vs_protocol *pp,int offset,unsigned int hooknum, -struct ip_vs_iphdr *ipvsh) +struct ip_vs_protocol *pp,unsigned int toff, +unsigned int wlen,unsigned int hooknum, +struct ip_vs_iphdr *ciph) {struct rt6_info *rt;/* Route to the other host */ int rc;
@@ -1600,7 +1602,7 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,translate address/port back */ if (IP_VS_FWD_METHOD (cp) !=IP_VS_CONN_F_MASQ ) {if (cp->packet_xmit) - rc = cp->packet_xmit (skb, cp, pp, ipvsh); + rc = cp->packet_xmit (skb, cp, pp, ciph);else rc =NF_ACCEPT ;/* do not touch skb anymore */
@@ -1617,7 +1619,7 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,IP_VS_RT_MODE_LOCAL |IP_VS_RT_MODE_NON_LOCAL | IP_VS_RT_MODE_RDR : IP_VS_RT_MODE_NON_LOCAL; local =__ip_vs_get_out_rt_v6 (cp->ipvs, cp->af, skb, cp->dest, - &cp->daddr.in6,NULL , ipvsh,0 , rt_mode); + &cp->daddr.in6,NULL , ciph,0 , rt_mode);if (local <0 ) goto tx_error; rt =dst_rt6_info (skb_dst (skb));
@@ -1649,13 +1651,13 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp, }/* copy-on-write the packet before mangling it */ -if (skb_ensure_writable (skb, offset)) +if (skb_ensure_writable (skb, wlen)) goto tx_error;if (skb_cow (skb, rt->dst.dev->hard_header_len)) goto tx_error; -ip_vs_nat_icmp_v6 (skb, pp, cp,0 ); +ip_vs_nat_icmp_v6 (skb, pp, cp,0 , toff, ciph);/* Another hack: avoid icmp_send in ip_fragment */ skb->ignore_df =1 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 61/438 ipvs: do not mangle ICMP replies for non-first fragments
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Anastasov <[email protected]>
[ Upstream commit 342e24a339b90e8e339a0f8c151ca479b8565661 ]
Sashiko warns that ip_vs_nat_icmp() unconditionally mangles the payload for embedded non-first IPv4 fragments. The problem is in the very old inverted pp->dont_defrag check which should not continue when embedded is a non-first TCP/UDP/SCTP fragment.
Check for embedded non-first fragment is also missing from ip_vs_out_icmp_v6(), it is needed before any connection lookups that expect ports after the network headers.
Drop the blocking code from ip_vs_in_icmp_v6() which prevents ICMPv6 from local clients to use non-MASQ forwarding.
--- include/net/ip_vs.h | 11 +++--- net/netfilter/ipvs/ip_vs_core.c | 61 ++++++++++++--------------------- net/netfilter/ipvs/ip_vs_xmit.c | 28 +++++++++++---- 3 files changed, 48 insertions(+), 52 deletions(-)
include/net/ip_vs.h +5 -6
@@ -1953,8 +1953,7 @@ int ip_vs_dr_xmit(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp, struct ip_vs_iphdr *iph);int ip_vs_icmp_xmit (struct sk_buff *skb,struct ip_vs_conn *cp,struct ip_vs_protocol *pp,unsigned int toff, -unsigned int wlen,unsigned int hooknum, -struct ip_vs_iphdr *ciph); +unsigned int hooknum,struct ip_vs_iphdr *ciph);void ip_vs_dest_dst_rcu_free (struct rcu_head *head);#ifdef CONFIG_IP_VS_IPV6
@@ -1968,8 +1967,7 @@ int ip_vs_dr_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp, struct ip_vs_iphdr *iph);int ip_vs_icmp_xmit_v6 (struct sk_buff *skb,struct ip_vs_conn *cp,struct ip_vs_protocol *pp,unsigned int toff, -unsigned int wlen,unsigned int hooknum, -struct ip_vs_iphdr *ciph); +unsigned int hooknum,struct ip_vs_iphdr *ciph);#endif #ifdef CONFIG_SYSCTL
@@ -2041,12 +2039,13 @@ static inline bool ip_vs_conn_use_hash2(struct ip_vs_conn *cp) }void ip_vs_nat_icmp (struct sk_buff *skb,struct ip_vs_protocol *pp, -struct ip_vs_conn *cp,int dir,unsigned int toff); +struct ip_vs_conn *cp,int dir,unsigned int toff, +bool has_ports);#ifdef CONFIG_IP_VS_IPV6 void ip_vs_nat_icmp_v6 (struct sk_buff *skb,struct ip_vs_protocol *pp,struct ip_vs_conn *cp,int dir,unsigned int toff, -struct ip_vs_iphdr *ciph); +bool has_ports,struct ip_vs_iphdr *ciph);#endif static inline __wsum ip_vs_check_diff4 (__be32 old,__be32 new,__wsum oldsum)
net/netfilter/ipvs/ip_vs_core.c +21 -40
161 lines not on this page · raw message
net/netfilter/ipvs/ip_vs_xmit.c +22 -6
@@ -1503,13 +1503,14 @@ ip_vs_dr_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,int ip_vs_icmp_xmit (struct sk_buff *skb,struct ip_vs_conn *cp,struct ip_vs_protocol *pp,unsigned int toff, -unsigned int wlen,unsigned int hooknum, -struct ip_vs_iphdr *ciph) +unsigned int hooknum,struct ip_vs_iphdr *ciph) {struct rtable *rt;/* Route to the other host */ int rc;int local;int rt_mode, was_input; +bool has_ports = false; +unsigned int wlen;/* The ICMP packet for VS/TUN, VS/DR and LOCALNODE will be forwarded directly here, because there is no need to
@@ -1565,6 +1566,13 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp, goto tx_error; } + wlen = ciph->len; +if (ciph->protocol ==IPPROTO_TCP || ciph->protocol ==IPPROTO_UDP || + ciph->protocol ==IPPROTO_SCTP ) { + wlen +=2 *sizeof (__u16);/* Also mangle ports */ + has_ports = true; + } +/* copy-on-write the packet before mangling it */ if (skb_ensure_writable (skb, wlen)) goto tx_error;
@@ -1572,7 +1580,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,if (skb_cow (skb, rt->dst.dev->hard_header_len)) goto tx_error; -ip_vs_nat_icmp (skb, pp, cp,0 , toff); +ip_vs_nat_icmp (skb, pp, cp,0 , toff, has_ports);/* Another hack: avoid icmp_send in ip_fragment */ skb->ignore_df =1 ;
@@ -1589,10 +1597,11 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,int ip_vs_icmp_xmit_v6 (struct sk_buff *skb,struct ip_vs_conn *cp,struct ip_vs_protocol *pp,unsigned int toff, -unsigned int wlen,unsigned int hooknum, -struct ip_vs_iphdr *ciph) +unsigned int hooknum,struct ip_vs_iphdr *ciph) { +bool has_ports = false;struct rt6_info *rt;/* Route to the other host */ +unsigned int wlen;int rc;int local;int rt_mode;
@@ -1650,6 +1659,13 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp, goto tx_error; } + wlen = ciph->len; +if (ciph->protocol ==IPPROTO_TCP || ciph->protocol ==IPPROTO_UDP || + ciph->protocol ==IPPROTO_SCTP ) { + wlen +=2 *sizeof (__u16);/* Also mangle ports */ + has_ports = true; + } +/* copy-on-write the packet before mangling it */ if (skb_ensure_writable (skb, wlen)) goto tx_error;
@@ -1657,7 +1673,7 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,if (skb_cow (skb, rt->dst.dev->hard_header_len)) goto tx_error; -ip_vs_nat_icmp_v6 (skb, pp, cp,0 , toff, ciph); +ip_vs_nat_icmp_v6 (skb, pp, cp,0 , toff, has_ports, ciph);/* Another hack: avoid icmp_send in ip_fragment */ skb->ignore_df =1 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 62/438 ipvs: clear the nfct flag under lock
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Anastasov <[email protected]>
[ Upstream commit da7d894c41d5910daae2b8ffa024c52ff0a4df6a ]
Sashiko warns that cp->flags should be changed under cp->lock
--- net/netfilter/ipvs/ip_vs_core.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
net/netfilter/ipvs/ip_vs_core.c +8 -2
@@ -2194,8 +2194,11 @@ ip_vs_in_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *state }if (resched) { -if (!old_ct) +if (!old_ct) { +spin_lock_bh (&cp->lock); cp->flags &= ~IP_VS_CONN_F_NFCT ; +spin_unlock_bh (&cp->lock); + }if (!atomic_read (&cp->n_control))ip_vs_conn_expire_now (cp);__ip_vs_conn_put (cp);
@@ -2211,8 +2214,11 @@ ip_vs_in_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *stateif (sysctl_expire_nodest_conn (ipvs)) {bool old_ct =ip_vs_conn_uses_old_conntrack (cp, skb); -if (!old_ct) +if (!old_ct) { +spin_lock_bh (&cp->lock); cp->flags &= ~IP_VS_CONN_F_NFCT ; +spin_unlock_bh (&cp->lock); + }ip_vs_conn_expire_now (cp);__ip_vs_conn_put (cp);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 63/438 netfilter: nft_payload: fix mask build for partial field offload
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei (Microsoft) <[email protected]>
[ Upstream commit 39e88f28fb32bf02bd4b525c24c842c9cff5663d ]
nft_payload_offload_mask() builds the offload match mask for a payload expression that covers only part of a header field. For a partial IPv6 address match (field_len = 16, priv_len = 1) that shift is 1 << 120, which is undefined on the 32-bit int operand. It also trims only one word, so the remaining words stay 0xffffffff (and when priv_len is a multiple of 4 the trim is skipped entirely), leaving the mask covering more bytes than the rule matches.
UBSAN: shift-out-of-bounds in net/netfilter/nft_payload.c:278:20 shift exponent 120 is too large for 32-bit type 'int' ...
The match is byte-granular and struct nft_data is zero-initialised, so the correct mask is simply the first priv_len bytes set to 0xff. Set those bytes directly and drop the word/shift trimming; this removes the undefined shift and no longer over-masks the trailing bytes.
--- net/netfilter/nft_payload.c | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-)
net/netfilter/nft_payload.c +1 -11
@@ -259,9 +259,7 @@ static int nft_payload_dump(struct sk_buff *skb,static bool nft_payload_offload_mask (struct nft_offload_reg *reg,u32 priv_len,u32 field_len) { -unsigned int remainder, delta, k;struct nft_data mask = {}; -__be32 remainder_mask;if (priv_len == field_len) {memset (®->mask,0xff , priv_len);
@@ -270,15 +268,7 @@ static bool nft_payload_offload_mask(struct nft_offload_reg *reg,return false; } -memset (&mask,0xff , field_len); - remainder = priv_len %sizeof (u32); -if (remainder) { - k = priv_len /sizeof (u32); - delta = field_len - priv_len; - remainder_mask =htonl (~((1 << (delta *BITS_PER_BYTE )) -1 )); - mask.data[k] = (__force u32 )remainder_mask; - } - +memset (&mask,0xff , priv_len);memcpy (®->mask, &mask, field_len);return true;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 64/438 ASoC: SDCA: Correct pointer passed to devm_acpi_table_put
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <[email protected]>
[ Upstream commit 6a50332e194f58b562d396ab772c34e8c9890c0f ]
devm_acpi_table_put() takes a struct acpi_table_header * but the value passed in is struct acpi_table_header ** so the value passed to acpi_put_table() is actually the pointer not the table itself.
Remove the extra reference to correct the passed value.
--- sound/soc/sdca/sdca_device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/sdca/sdca_device.c +1 -1
@@ -43,7 +43,7 @@ void sdca_lookup_swft(struct sdw_slave *slave)dev_info (&slave->dev,"SWFT not available\n" ); else devm_add_action_or_reset(&slave->dev, devm_acpi_table_put, - &slave->sdca_data.swft); + slave->sdca_data.swft); }EXPORT_SYMBOL_NS (sdca_lookup_swft,"SND_SOC_SDCA" );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 65/438 ASoC: SDCA: Always free firmware in FDL path
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <[email protected]>
[ Upstream commit 7f64ccc374b2fe1f6a169182e95ab8e104cae406 ]
In the case a disk firmware exists but is invalid and no SWFT firmware exists fdl_load_file() will return without calling release_firmware(). Update the code to call this to ensure the firmware is released on the error path.
--- sound/soc/sdca/sdca_fdl.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
sound/soc/sdca/sdca_fdl.c +4 -1
@@ -258,7 +258,8 @@ static int fdl_load_file(struct sdca_interrupt *interrupt,if (!swf) {dev_err (dev,"failed to locate SWF\n" ); -return -ENOENT ; + ret = -ENOENT ; + goto error; } dev_info(dev, "loading SWF: %x-%x-%x\n",
@@ -270,6 +271,8 @@ static int fdl_load_file(struct sdca_interrupt *interrupt,SDCA_CTL_XU_FDL_MESSAGEOFFSET , fdl_file->fdl_offset,SDCA_CTL_XU_FDL_MESSAGELENGTH , swf->data, swf->file_length - offsetof(struct acpi_sw_file, data)); + +error:release_firmware (firmware);return ret; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 66/438 ASoC: SDCA: Make UMP message size check more robust
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <[email protected]>
[ Upstream commit 556d872e7c2a0b570c5b0974813847ef0d0cd637 ]
If message offset was larger than the buffer length the size check will pass incorrectly. Refactor the check such that it is more robust to invalid sizes.
--- sound/soc/sdca/sdca_ump.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/sdca/sdca_ump.c +2 -2
@@ -141,7 +141,7 @@ int sdca_ump_read_message(struct device *dev,return ret; } -if (msg_len > buf_len - msg_offset) { +if (msg_offset + msg_len > buf_len) {dev_err (dev,"%s: message too big for UMP buffer: %d\n" , entity->label, msg_len);return -EINVAL ;
@@ -207,7 +207,7 @@ int sdca_ump_write_message(struct device *dev, buf_len =sdca_range (range,SDCA_MESSAGEOFFSET_BUFFER_LENGTH ,0 ); ump_mode =sdca_range (range,SDCA_MESSAGEOFFSET_UMP_MODE ,0 ); -if (msg_len > buf_len - msg_offset) { +if (msg_offset + msg_len > buf_len) {dev_err (dev,"%s: message too big for UMP buffer: %d\n" , entity->label, msg_len);return -EINVAL ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 67/438 ASoC: SDCA: Ensure that Control Range is large enough for header
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <[email protected]>
[ Upstream commit 951e921b039b793bef7050eaf5c5fb1a4a5341d1 ]
When reading the Ranges structure from an SDCA Control, ensure that the read data is large enough to encompass the required header before accessing it.
--- sound/soc/sdca/sdca_functions.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/sdca/sdca_functions.c +2 -0
@@ -847,6 +847,8 @@ static int find_sdca_control_range(struct device *dev,return 0 ; else if (num_range < 0) return num_range; + else if (num_range < 2 * sizeof(*limits)) + return -EINVAL; range_list =devm_kcalloc (dev, num_range,sizeof (*range_list),GFP_KERNEL );if (!range_list)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 68/438 rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <[email protected]>
[ Upstream commit 78f75d632f74b8de0f081a128588f7c37d0d1164 ]
rds_tcp_laddr_check() looks up a scoped IPv6 interface with dev_get_by_index_rcu(), drops the RCU read-side lock, and only then passes the bare struct net_device * into ipv6_chk_addr().
dev_get_by_index_rcu() only keeps the device alive within the same RCU read-side section. After rcu_read_unlock(), a concurrent RTM_DELLINK can free the net_device; ipv6_chk_addr() then dereferences the stale pointer in __ipv6_chk_addr_and_flags() (e.g. l3mdev_master_dev_rcu(dev)), reading freed memory.
Keep the RCU read-side lock held across the ipv6_chk_addr() call instead of dropping it right after the lookup, so the device cannot be freed while it is in use.
BUG: KASAN: slab-use-after-free in __ipv6_chk_addr_and_flags (... net/ipv6/addrconf.c:1998) Read of size 8 at addr ffff8880106ec000 by task exploit/153 Call Trace: ... kasan_report (mm/kasan/report.c:595) __ipv6_chk_addr_and_flags (... net/ipv6/addrconf.c:1998) ipv6_chk_addr (net/ipv6/addrconf.c:2031 net/ipv6/addrconf.c:1972) rds_tcp_laddr_check (net/rds/tcp.c:370) rds_bind (net/rds/bind.c:248) __sys_bind (net/socket.c:1920) __x64_sys_bind (net/socket.c:1956) do_syscall_64 (arch/x86/entry/syscall_64.c:63) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
--- net/rds/tcp.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
net/rds/tcp.c +5 -3
@@ -336,23 +336,25 @@ int rds_tcp_laddr_check(struct net *net, const struct in6_addr *addr,/* If the scope_id is specified, check only those addresses * hosted on the specified interface. */ +rcu_read_lock ();if (scope_id !=0 ) { -rcu_read_lock (); dev =dev_get_by_index_rcu (net, scope_id);/* scope_id is not valid... */ if (!dev) {rcu_read_unlock ();return -EADDRNOTAVAIL ; } -rcu_read_unlock (); }#if IS_ENABLED (CONFIG_IPV6 )if (ipv6_mod_enabled ()) { ret =ipv6_chk_addr (net, addr, dev,0 ); -if (ret) +if (ret) { +rcu_read_unlock ();return 0 ; + } }#endif +rcu_read_unlock ();return -EADDRNOTAVAIL ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 69/438 nexthop: take nh->lock for f6i_list walks in replace check and notify
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei (Microsoft) <[email protected]>
[ Upstream commit 072cd1f21819dedd2252e704d255de3b0cfc61a7 ]
fib6_check_nh_list() and __nexthop_replace_notify() walk nh->f6i_list during an RTNL-serialized nexthop replace without holding nh->lock. IPv6 RTM_NEWROUTE/RTM_DELROUTE run without RTNL and mutate that list under nh->lock (fib6_add_rt2node_nh(), fib6_purge_rt()), so both walks race a concurrent route delete that unlinks and frees a fib6_info:
BUG: KASAN: slab-use-after-free in rt6_fill_node.isra.0 (net/ipv6/route.c:5799) Read of size 4 at addr ffff888014607e64 by task exploit/143 rt6_fill_node.isra.0 (net/ipv6/route.c:5799) fib6_rt_update (net/ipv6/route.c:6412) __nexthop_replace_notify (net/ipv4/nexthop.c:2542) rtm_new_nexthop (net/ipv4/nexthop.c:2554) rtnetlink_rcv_msg (net/core/rtnetlink.c:7076) BUG: KASAN: slab-use-after-free in fib6_check_nh_list (net/ipv4/nexthop.c:1605) Read of size 8 at addr ffff888014a7d068 by task exploit/142 fib6_check_nh_list (net/ipv4/nexthop.c:1605) rtm_new_nexthop (net/ipv4/nexthop.c:2575) rtnetlink_rcv_msg (net/core/rtnetlink.c:7076)
Both walks only read the entries and take no tb6_lock, so protect them with nh->lock; fib6_rt_update() uses gfp_any(), which returns GFP_ATOMIC under the lock.
--- net/ipv4/nexthop.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
net/ipv4/nexthop.c +11 -2
@@ -1597,14 +1597,21 @@ static int fib6_check_nh_list(struct nexthop *old, struct nexthop *new, struct netlink_ext_ack *extack) {struct fib6_info *f6i; +int err =0 ;if (list_empty (&old->f6i_list))return 0 ; +spin_lock_bh (&old->lock);list_for_each_entry (f6i, &old->f6i_list, nh_list) { -if (check_src_addr (&f6i->fib6_src.addr, extack) <0 ) -return -EINVAL ; + err =check_src_addr (&f6i->fib6_src.addr, extack); +if (err) +break ; } +spin_unlock_bh (&old->lock); + +if (err) +return err;return fib6_check_nexthop (new,NULL , extack); }
@@ -2521,8 +2528,10 @@ static void __nexthop_replace_notify(struct net *net, struct nexthop *nh, fi->nh_updated = false; } +spin_lock_bh (&nh->lock);list_for_each_entry (f6i, &nh->f6i_list, nh_list)fib6_rt_update (net, f6i, info); +spin_unlock_bh (&nh->lock); }/* send RTM_NEWROUTE with REPLACE flag set for all FIB entries
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 70/438 nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei (Microsoft) <[email protected]>
[ Upstream commit 4787a6d2629b4e8c0b6bacab1f75c1660eca44d9 ]
nh_rt_cache_flush() walks nh->f6i_list during an RTNL-serialized nexthop replace without holding nh->lock, racing the unlocked IPv6 route add/delete that mutate the list under nh->lock and free fib6_info entries (nh_rt_cache_flush() is inlined into rtm_new_nexthop()):
BUG: KASAN: slab-use-after-free in nh_rt_cache_flush (net/ipv4/nexthop.c:2243) Read of size 8 at addr ffff888012953e18 by task exploit/146 nh_rt_cache_flush (net/ipv4/nexthop.c:2243) replace_nexthop (net/ipv4/nexthop.c:2610) rtm_new_nexthop (net/ipv4/nexthop.c:3323) rtnetlink_rcv_msg (net/core/rtnetlink.c:7076)
Unlike the other f6i_list walks, this one bumps each route's sernum via fib6_update_sernum_upto_root(), which needs tb6_lock; taking nh->lock around it would invert the established tb6_lock -> nh->lock order and deadlock. As the only purpose is to invalidate cached dsts, bump the IPv6 sernum for the whole netns with rt_genid_bump_ipv6() instead, mirroring the rt_cache_flush() already done for IPv4 just above.
--- net/ipv4/nexthop.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
net/ipv4/nexthop.c +6 -6
@@ -2223,18 +2223,18 @@ static void remove_nexthop(struct net *net, struct nexthop *nh,static void nh_rt_cache_flush (struct net *net,struct nexthop *nh,struct nexthop *replaced_nh) { -struct fib6_info *f6i;struct nh_group *nhg; +bool have_f6i;int i;if (!list_empty (&nh->fi_list))rt_cache_flush (net); -list_for_each_entry (f6i, &nh->f6i_list, nh_list) { -spin_lock_bh (&f6i->fib6_table->tb6_lock); -fib6_update_sernum_upto_root (net, f6i); -spin_unlock_bh (&f6i->fib6_table->tb6_lock); - } +spin_lock_bh (&nh->lock); + have_f6i = !list_empty (&nh->f6i_list); +spin_unlock_bh (&nh->lock); +if (have_f6i) +rt_genid_bump_ipv6 (net);/* if an IPv6 group was replaced, we have to release all old * dsts to make sure all refcounts are released
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 71/438 af_unix: fix listen() succeeding on sockets in the wrong state
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Ericson <[email protected]>
[ Upstream commit f0d9c3ffc2b5fc2ffacb56b3036155ce7a940a12 ]
Commit fd0a109a0f6b ("net, pidfs: prepare for handing out pidfds for reaped sk->sk_peer_pid") inserted a prepare_peercred() call between err = -EINVAL and the socket-state check in unix_listen(). Since prepare_peercred() leaves err at 0 on success, listen() on an AF_UNIX socket that is not in TCP_CLOSE or TCP_LISTEN state (e.g. one that is already connected) now silently returns success without doing anything, instead of failing with EINVAL as it did before.
--- net/unix/af_unix.c | 1 + 1 file changed, 1 insertion(+)
net/unix/af_unix.c +1 -0
@@ -823,6 +823,7 @@ static int unix_listen(struct socket *sock, int backlog)if (err) goto out;unix_state_lock (sk); + err = -EINVAL ;if (sk->sk_state !=TCP_CLOSE && sk->sk_state !=TCP_LISTEN ) goto out_unlock;if (backlog > sk->sk_max_ack_backlog)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 72/438 selftests/net/af_unix: test listen() rejects wrong socket states
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Ericson <[email protected]>
[ Upstream commit 7f57c650d08b8793bb551bdb33ad876535ef9fe8 ]
Add a regression test for the unix_listen() state check. The key case is listen() on a bound socket that has already been connected: it is no longer in TCP_CLOSE or TCP_LISTEN, so it must fail with EINVAL. A prepare_peercred() call slipped in ahead of that check once left err at 0 and made listen() silently succeed there instead; this guards against a repeat.
The neighbouring outcomes are covered too so they cannot regress the same
way: a bound socket in TCP_CLOSE listens fine, calling listen() again on a socket already in TCP_LISTEN is allowed, and an unbound socket fails with EINVAL.
Each case runs for both listenable socket types (SOCK_STREAM and SOCK_SEQPACKET) and both pathname and abstract addresses.
--- .../testing/selftests/net/af_unix/.gitignore | 1 + tools/testing/selftests/net/af_unix/Makefile | 1 + .../selftests/net/af_unix/unix_listen.c | 187 ++++++++++++++++++ 3 files changed, 189 insertions(+) create mode 100644 tools/testing/selftests/net/af_unix/unix_listen.c
tools/testing/selftests/net/af_unix/.gitignore +1 -0
@@ -6,3 +6,4 @@ scm_rights so_peek_off unix_connect unix_connreset +unix_listen
tools/testing/selftests/net/af_unix/Makefile +1 -0
@@ -14,6 +14,7 @@ TEST_GEN_PROGS := \ so_peek_off \ unix_connect \ unix_connreset \ + unix_listen \ # end of TEST_GEN_PROGS include ../../lib.mk
tools/testing/selftests/net/af_unix/unix_listen.c new file +187 -0
187 lines not on this page · raw message
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 73/438 xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Xing <[email protected]>
[ Upstream commit a3c8382ebce4780c6b3ace2c09bc342313ac0186 ]
This patch is inspired by the check[1] from sashiko. It says when overflow happens, the address of cq to be published is invalid. Actually the severer thing is the whole process of publishing the address of cq in this particular case is not right: it should truely publish the address and advance the cached_prod in cq as long as it reads descriptors from txq.
The following is the full analysis.xsk_drop_skb() is called in three places, which all discard a partially built multi-buffer skb:
1) xsk_build_skb() -EOVERFLOW error path: packet exceeds MAX_SKB_FRAGS
2) __xsk_generic_xmit() post-loop cleanup: an invalid descriptor in the TX ring prevents the partial packet from completing
3) xsk_release(): socket close while xs->skb holds an incomplete packet
In all three cases, the TX descriptors for the already-processed frags have been consumed from the TX ring (xskq_cons_release), and CQ slots have been reserved. However, xsk_drop_skb() calls xsk_consume_skb() which cancels the CQ reservations via xsk_cq_cancel_locked(). Since the buffer addresses never appear in the completion queue, userspace permanently loses track of these buffers.
Fix this by letting consume_skb() trigger the existing xsk_destruct_skb destructor, which already submits buffer addresses to the CQ via xsk_cq_submit_addr_locked().
Note that cancelling the descriptors back to the TX ring (via xskq_cons_cancel_n) is not a appropriate option because an oversized packet that always exceeds MAX_SKB_FRAGS would be retried indefinitely, which is an obviously deadlock bug in the TX path.
Also move the desc->addr assignment in xsk_build_skb() above the overflow check so that the current descriptor's address is recorded before a potential -EOVERFLOW jump to free_err, consistent with the zerocopy path in xsk_build_skb_zerocopy().
[1]: https://lore.kernel.org/all/[email protected]/
--- net/xdp/xsk.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
net/xdp/xsk.c +8 -5
@@ -793,8 +793,11 @@ static void xsk_consume_skb(struct sk_buff *skb)static void xsk_drop_skb (struct sk_buff *skb) { -xdp_sk (skb->sk)->tx->invalid_descs +=xsk_get_num_desc (skb); -xsk_consume_skb (skb); +struct xdp_sock *xs =xdp_sk (skb->sk); + + xs->tx->invalid_descs +=xsk_get_num_desc (skb); +consume_skb (skb); + xs->skb =NULL ; } static int xsk_skb_metadata(struct sk_buff *skb, void *buffer,
@@ -876,7 +879,7 @@ static struct sk_buff *xsk_build_skb_zerocopy(struct xdp_sock *xs,return ERR_PTR (-ENOMEM );/* in case of -EOVERFLOW that could happen below, -* xsk_consume_skb() will release this node as whole skb +* xsk_drop_skb() will release this node as whole skb * would be dropped, which implies freeing all list elements */ xsk_addr->addrs[xsk_addr->num_descs] = desc->addr;
@@ -968,6 +971,8 @@ static struct sk_buff *xsk_build_skb(struct xdp_sock *xs, goto free_err; } + xsk_addr->addrs[xsk_addr->num_descs] = desc->addr; +if (unlikely (nr_frags == (MAX_SKB_FRAGS -1 ) &&xp_mb_desc (desc))) { err = -EOVERFLOW ; goto free_err;
@@ -985,8 +990,6 @@ static struct sk_buff *xsk_build_skb(struct xdp_sock *xs,skb_add_rx_frag (skb, nr_frags, page,0 , len,PAGE_SIZE );refcount_add (PAGE_SIZE , &xs->sk.sk_wmem_alloc); - - xsk_addr->addrs[xsk_addr->num_descs] = desc->addr; } }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 74/438 xsk: drain continuation descs after overflow in xsk_build_skb()
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Xing <[email protected]>
[ Upstream commit bd44a6dcd4248883de90f5dad53ae80066e27096 ]
Fix generic xmit path multi-buffer logic when packets are either too big (count of descriptors exceed MAX_SKB_FRAGS) or an invalid descriptor is included in fragmented packet. Introduce xdp_sock::drain_cont and act upon this flag - when it is set, keep on consuming descriptors from AF_XDP Tx ring and put them directly onto Cq. Previously these descriptors were silently lost and could never be reached again.
--- include/net/xdp_sock.h | 1 + net/xdp/xsk.c | 45 +++++++++++++++++++++++++++++++++++++++--- 2 files changed, 43 insertions(+), 3 deletions(-)
include/net/xdp_sock.h +1 -0
@@ -80,6 +80,7 @@ struct xdp_sock {* call of __xsk_generic_xmit(). */ struct sk_buff *skb; +bool drain_cont;struct list_head map_list;/* Protects map_list */
net/xdp/xsk.c +42 -3
90 lines not on this page · raw message
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 75/438 xsk: provide sufficient space in pool->tx_descs
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej Fijalkowski <[email protected]>
[ Upstream commit 08c9a8e794b4694c100dafcb80e069e29ad81b64 ]
The temporary Tx descriptor array in an XSK buffer pool is currently sized from the Tx ring of the socket that creates the pool.
This is insufficient for shared-UMEM Tx. A later socket may have a larger Tx ring and submit a valid multi-buffer packet containing more descriptors than the first socket's ring, while still remaining within the device's xdp_zc_max_segs limit.
A packet-framed batch parser bounded by the temporary array cannot reach the end-of-packet descriptor in that case. It leaves the packet on the Tx ring and encounters the same packet on every subsequent attempt, stalling Tx processing for that socket.
Size the temporary descriptor array to the larger of the first Tx ring and the device's xdp_zc_max_segs capability. This keeps the array large enough to inspect one maximum-sized valid packet. Larger shared Tx rings do not require further resizing, as they can be processed over multiple batches.
Following commit will actually address the data path side.
--- include/net/xsk_buff_pool.h | 6 ++++-- net/xdp/xsk.c | 10 +++++++--- net/xdp/xsk_buff_pool.c | 12 ++++++++---- 3 files changed, 19 insertions(+), 9 deletions(-)
include/net/xsk_buff_pool.h +4 -2
@@ -102,12 +102,14 @@ struct xsk_buff_pool {/* AF_XDP core. */ struct xsk_buff_pool *xp_create_and_assign_umem (struct xdp_sock *xs, -struct xdp_umem *umem); +struct xdp_umem *umem, +u32 max_segs);int xp_assign_dev (struct xsk_buff_pool *pool,struct net_device *dev,u16 queue_id,u16 flags);int xp_assign_dev_shared (struct xsk_buff_pool *pool,struct xdp_sock *umem_xs,struct net_device *dev,u16 queue_id); -int xp_alloc_tx_descs (struct xsk_buff_pool *pool,struct xdp_sock *xs); +int xp_alloc_tx_descs (struct xsk_buff_pool *pool,struct xdp_sock *xs, +u32 max_segs);void xp_destroy (struct xsk_buff_pool *pool);void xp_get_pool (struct xsk_buff_pool *pool);bool xp_put_pool (struct xsk_buff_pool *pool);
net/xdp/xsk.c +7 -3
@@ -1524,7 +1524,8 @@ static int xsk_bind(struct socket *sock, struct sockaddr_unsized *addr, int addr* and/or device. */ xs->pool =xp_create_and_assign_umem (xs, - umem_xs->umem); + umem_xs->umem, + dev->xdp_zc_max_segs);if (!xs->pool) { err = -ENOMEM ;sockfd_put (sock);
@@ -1556,7 +1557,8 @@ static int xsk_bind(struct socket *sock, struct sockaddr_unsized *addr, int addr* utilizes */ if (xs->tx && !xs->pool->tx_descs) { - err =xp_alloc_tx_descs (xs->pool, xs); + err =xp_alloc_tx_descs (xs->pool, xs, + dev->xdp_zc_max_segs);if (err) {xp_put_pool (xs->pool); xs->pool =NULL ;
@@ -1574,7 +1576,9 @@ static int xsk_bind(struct socket *sock, struct sockaddr_unsized *addr, int addr goto out_unlock; }else {/* This xsk has its own umem. */ - xs->pool =xp_create_and_assign_umem (xs, xs->umem); + xs->pool =xp_create_and_assign_umem (xs, xs->umem, + dev->xdp_zc_max_segs); +if (!xs->pool) { err = -ENOMEM ; goto out_unlock;
net/xdp/xsk_buff_pool.c +8 -4
@@ -42,9 +42,12 @@ void xp_destroy(struct xsk_buff_pool *pool)kvfree (pool); } -int xp_alloc_tx_descs (struct xsk_buff_pool *pool,struct xdp_sock *xs) +int xp_alloc_tx_descs (struct xsk_buff_pool *pool,struct xdp_sock *xs, +u32 max_segs) { - pool->tx_descs =kvzalloc_objs (*pool->tx_descs, xs->tx->nentries); +u32 nentries =max (xs->tx->nentries, max_segs); + + pool->tx_descs =kvzalloc_objs (*pool->tx_descs, nentries);if (!pool->tx_descs)return -ENOMEM ;
@@ -52,7 +55,8 @@ int xp_alloc_tx_descs(struct xsk_buff_pool *pool, struct xdp_sock *xs) }struct xsk_buff_pool *xp_create_and_assign_umem (struct xdp_sock *xs, -struct xdp_umem *umem) +struct xdp_umem *umem, +u32 max_segs) {bool unaligned = umem->flags &XDP_UMEM_UNALIGNED_CHUNK_FLAG ;struct xsk_buff_pool *pool;
@@ -69,7 +73,7 @@ struct xsk_buff_pool *xp_create_and_assign_umem(struct xdp_sock *xs, goto out;if (xs->tx) -if (xp_alloc_tx_descs (pool, xs)) +if (xp_alloc_tx_descs (pool, xs, max_segs)) goto out; pool->chunk_mask = ~((u64 )umem->chunk_size -1 );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 76/438 xsk: reclaim invalid Tx descriptors in ZC batch path
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej Fijalkowski <[email protected]>
[ Upstream commit 72f2b4516faf55d4dfac2414649d3cffa5fd2c5e ]
The zero-copy Tx batch parser stops when it encounters an invalid descriptor. If this happens after one or more continuation descriptors, the Tx consumer can be advanced past fragments that are neither submitted to the driver nor returned to userspace through the completion ring.
A similar problem occurs when a packet exceeds xdp_zc_max_segs. The descriptors consumed up to the limit are released without completion, and the remaining continuation descriptors can subsequently be interpreted as the beginning of another packet.
Parse Tx batches in packet units and distinguish descriptors belonging to complete valid packets from descriptors consumed while draining an invalid or oversized packet. Return the former to the driver and append the latter to the CQ address area so userspace can reclaim their UMEM frames.
Treat a standalone invalid descriptor as a one-descriptor reclaim-only packet. Advancing the Tx-ring consumer releases the ring slot, but does not by itself return ownership of the referenced UMEM frame to userspace.
Once draining starts, continue until the packet's end-of-packet descriptor is consumed. Preserve the drain state on the socket when EOP has not yet been supplied, so draining can continue during a later call. Leave incomplete but otherwise valid packets on the Tx ring.
Shared-UMEM pools using multi-buffer Tx also need packet-framed parsing. Walk their Tx sockets one packet at a time, preserving the existing per-socket fairness scheme, instead of using the legacy one-descriptor fallback. Keep that fallback for shared pools that do not use multi-buffer Tx. Since the drain state is maintained per socket and both the singular and shared paths can resume an interrupted drain, changing the socket list from singular to shared requires no special bind-time transition.
CQ entries are positional, and drivers may complete only part of the Tx work returned by xsk_tx_peek_release_desc_batch(). Therefore, reclaim-only entries cannot be published immediately when earlier driver-visible descriptors are still outstanding.
Track the number of driver-visible CQ entries preceding the reclaim entries. Let xsk_tx_completed() publish partial hardware Tx completions, and publish the reclaim entries only after every earlier Tx descriptor has completed. Complete a reclaim-only batch immediately when there is no driver-visible work in front of it, and prevent another Tx batch from being appended while reclaim entries remain pending.
Also cap batch processing by the size of the pool's temporary descriptor array, as Tx rings belonging to sockets sharing a UMEM may have different sizes.
This ensures that every invalid Tx descriptor consumed by the ZC batch path is either submitted to the driver as part of a valid packet or returned to userspace without violating CQ completion ordering.
--- Documentation/networking/af_xdp.rst | 54 ++++---- include/net/xsk_buff_pool.h | 3 + net/xdp/xsk.c | 187 +++++++++++++++++++++++++--- net/xdp/xsk_buff_pool.c | 1 + net/xdp/xsk_queue.h | 65 +++++++--- 5 files changed, 248 insertions(+), 62 deletions(-)
Documentation/networking/af_xdp.rst +30 -24
@@ -43,12 +43,13 @@ UMEM also has two rings: the FILL ring and the COMPLETION ring. The FILL ring is used by the application to send down addr for the kernel to fill in with RX packet data. References to these frames will then appear in the RX ring once each packet has been received. The -COMPLETION ring, on the other hand, contains frame addr that the -kernel has transmitted completely and can now be used again by user -space, for either TX or RX. Thus, the frame addrs appearing in the -COMPLETION ring are addrs that were previously transmitted using the -TX ring. In summary, the RX and FILL rings are used for the RX path -and the TX and COMPLETION rings are used for the TX path. +COMPLETION ring, on the other hand, contains frame addresses from Tx +descriptors that the kernel has finished processing and that can now be +used again by user space, for either Tx or Rx. This includes frames whose +transmission has completed as well as frames referenced by invalid Tx +descriptors rejected by the kernel. A completion therefore returns +ownership of a frame to user space, but does not by itself guarantee that +the packet was successfully transmitted. The socket is then finally bound with a bind() call to a device and a specific queue id on that device, and it is not until bind is
@@ -169,14 +170,15 @@ chunks mode, then the incoming addr will be left untouched. UMEM Completion Ring ~~~~~~~~~~~~~~~~~~~~ -The COMPLETION Ring is used transfer ownership of UMEM frames from +The COMPLETION Ring is used to transfer ownership of UMEM frames from kernel-space to user-space. Just like the FILL ring, UMEM indices are -used. - -Frames passed from the kernel to user-space are frames that has been -sent (TX ring) and can be used by user-space again. - -The user application consumes UMEM addrs from this ring. +used. Frames passed from the kernel to user-space are frames referenced +by Tx descriptors that the kernel has finished processing and can be +used by user-space again. This includes both frames whose transmission +has completed and frames referenced by invalid Tx descriptors that were +rejected and reclaimed by the kernel. A completion entry does not +guarantee successful packet transmission. The user application consumes +UMEM addrs from this ring. RX Ring
@@ -504,21 +506,25 @@ will be treated as an invalid descriptor. These are the semantics for producing packets onto AF_XDP Tx ring consisting of multiple frames: -* When an invalid descriptor is found, all the other - descriptors/frames of this packet are marked as invalid and not - completed. The next descriptor is treated as the start of a new - packet, even if this was not the intent (because we cannot guess - the intent). As before, if your program is producing invalid - descriptors you have a bug that must be fixed. +* When an invalid descriptor is found, the complete packet is treated as + invalid. The kernel consumes descriptors through the descriptor marking + the end of the packet and returns all their frame addresses through the + COMPLETION ring. A standalone invalid descriptor is treated as a + one-descriptor invalid packet. The descriptor following the end of the + invalid packet is treated as the start of a new packet. As before, if + your program is producing invalid descriptors you have a bug that must + be fixed. Rejected descriptors are reported in the ``tx_invalid_descs`` + statistic. * Zero length descriptors are treated as invalid descriptors. * For copy mode, the maximum supported number of frames in a packet is - equal to CONFIG_MAX_SKB_FRAGS + 1. If it is exceeded, all - descriptors accumulated so far are dropped and treated as - invalid. To produce an application that will work on any system - regardless of this config setting, limit the number of frags to 18, - as the minimum value of the config is 17. + equal to CONFIG_MAX_SKB_FRAGS + 1. If it is exceeded, all descriptors + through the end of the oversized packet are consumed, treated as invalid, + and their frame addresses are returned through the COMPLETION ring. To + produce an application that will work on any system regardless of this + config setting, limit the number of frags to 18, as the minimum value of + the config is 17. * For zero-copy mode, the limit is up to what the NIC HW supports. Usually at least five on the NICs we have checked. We
include/net/xsk_buff_pool.h +3 -0
@@ -78,6 +78,9 @@ struct xsk_buff_pool {u32 chunk_size;u32 chunk_shift;u32 frame_len; +u32 tx_descs_nentries; +u32 reclaim_descs; +u32 tx_zc_pending_descs;u32 xdp_zc_max_segs;u8 tx_metadata_len;/* inherited from umem */ u8 cached_need_wakeup;
net/xdp/xsk.c +167 -20
216 lines not on this page · raw message
net/xdp/xsk_buff_pool.c +1 -0
@@ -51,6 +51,7 @@ int xp_alloc_tx_descs(struct xsk_buff_pool *pool, struct xdp_sock *xs,if (!pool->tx_descs)return -ENOMEM ; + pool->tx_descs_nentries = nentries;return 0 ; }
net/xdp/xsk_queue.h +47 -18
95 lines not on this page · raw message
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 77/438 net/sched: sch_cake: skip clearing unused tins during rate adjustment
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Köppeler <[email protected]>
[ Upstream commit a3729e0df005a936ceb3c2b0d167f01a2b03f970 ]
When cake_configure_rates() is called from the dequeue path with rate_adjust=true, it only needs to update the rate parameters. The loop that clears the unused tins is both unnecessary and harmful in this path:
- cake_clear_tin() overwrites q->cur_tin and q->cur_flow, which are actively used by cake_dequeue(), corrupting the dequeue state.
- iterating over the unused tins and their internal queues to purge packets adds needless overhead to the hot path.
Skip the entire loop when rate_adjust is set, as neither cake_clear_tin() nor the mtu_time update are needed when only the rate changes.
The clearing loop runs on every rate adjustment from the dequeue path, clearing (max_tins - cur_tins) tins each time, so the cost grows the fewer tins the configured mode actually uses. Testing cake_mq over veth (8 rx/tx queues, 2 Gbit limit) with flent's [1] rrul and tcp_nup tests and 32 TCP upstreams shows a large drop in loaded latency and a throughput gain, restoring behaviour to pre-15c2715a5264 levels:
+------------+------+------+-------+-------+---------+ | kernel | mode | test | base | load | tput | | | | | (ms) | (ms) | (Mbit) | +------------+------+------+-------+-------+---------+ | net-next | be | rrul | 0.810 | 11.78 | 1469.67 | | net-next | be | nup | 0.637 | 85.71 | 1243.15 | | net-next | ds3 | rrul | 0.397 | 15.28 | 1770.06 | | net-next | ds3 | nup | 0.351 | 15.98 | 1799.39 | +------------+------+------+-------+-------+---------+ | patched | be | rrul | 0.092 | 0.56 | 1873.40 | | patched | be | nup | 0.109 | 1.82 | 1869.12 | | patched | ds3 | rrul | 0.097 | 0.98 | 1866.10 | | patched | ds3 | nup | 0.101 | 0.51 | 1861.79 | +------------+------+------+-------+-------+---------+
The same trend holds on real hardware (IPQ8074A, 4 rx/tx queues, OpenWrt): in besteffort mode the tcp_nup loaded latency drops from ~470 ms to ~4 ms.
--- net/sched/sch_cake.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
net/sched/sch_cake.c +5 -3
@@ -2609,9 +2609,11 @@ static void cake_configure_rates(struct Qdisc *sch, u64 rate, bool rate_adjust)break ; } -for (c = qd->tin_cnt; c <CAKE_MAX_TINS ; c++) { -cake_clear_tin (sch, c); - qd->tins[c].cparams.mtu_time = qd->tins[ft].cparams.mtu_time; +if (!rate_adjust) { +for (c = qd->tin_cnt; c <CAKE_MAX_TINS ; c++) { +cake_clear_tin (sch, c); + qd->tins[c].cparams.mtu_time = qd->tins[ft].cparams.mtu_time; + } } qd->rate_ns = qd->tins[ft].tin_rate_ns;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 78/438 pinctrl-amd: Dont clear S4 wake bits at probe
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
[ Upstream commit ffe8a0c6b55285ceaf2f42fc20c3a0594d14f1e9 ]
commit 6bc3462a0f5e ("pinctrl: amd: Mask wake bits on probe again") introduced a regression where Wake-on-LAN no longer works after suspend or shutdown on some AMD platforms.
Firmware-programmed S4 wake bits for devices like PCIe NICs using PCI PME are cleared at probe, but nothing restores them. Unlike S0i3/S3 wake sources that use enable_irq_wake() -> amd_gpio_irq_set_wake(), PCIe PME does not use GPIO IRQ infrastructure and relies on firmware configuration.
The original intent of commit 6bc3462a0f5e ("pinctrl: amd: Mask wake bits on probe again") was to clear spurious wake bits left by firmware to prevent unwanted wakeups. However, S4 wake bits are used for hardware-level wake sources like WoL that bypass the kernel's IRQ wake API.
Fix by preserving S4 wake bits at probe and only clearing S0i3/S3 bits:
- Firmware-configured S4 wake sources (WoL) continue working
- Kernel maintains control of S3/S0i3 wake policy via set_wake()
- S3-only wake sources work correctly per commit f31f33dbb3ba ("pinctrl:
amd: Take suspend type into consideration which pins are non-wake")
The trade-off is that firmware-programmed spurious S4 wake bits remain set, but this is less problematic than breaking WoL.
--- drivers/pinctrl/pinctrl-amd.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/pinctrl/pinctrl-amd.c +1 -2
@@ -884,8 +884,7 @@ static void amd_gpio_irq_init(struct amd_gpio *gpio_dev)u32 pin_reg, mask;int i; - mask =BIT (WAKE_CNTRL_OFF_S0I3 ) |BIT (WAKE_CNTRL_OFF_S3 ) | -BIT (WAKE_CNTRL_OFF_S4 ); + mask =BIT (WAKE_CNTRL_OFF_S0I3 ) |BIT (WAKE_CNTRL_OFF_S3 );for (i =0 ; i < desc->npins; i++) {int pin = desc->pins[i].number;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 79/438 scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: HyeongJun An <[email protected]>
[ Upstream commit 98b87885de4b7f605533a2860685f5689fce8e82 ]
iscsi_scsi_cmd_rsp() copies the sense data of a SCSI Response from the target-supplied data segment. The segment carries a 2-byte sense length followed by the sense bytes, so it must hold 2 + senselen bytes, but the bounds check only requires datalen >= senselen:
senselen = get_unaligned_be16(data); if (datalen < senselen) goto invalid_datalen; memcpy(sc->sense_buffer, data + 2, min_t(uint16_t, senselen, SCSI_SENSE_BUFFERSIZE));
A target that returns a SCSI Response whose datalen equals senselen (with senselen <= SCSI_SENSE_BUFFERSIZE) makes the memcpy() from data + 2 read up to two bytes past the received data. Those bytes are stale conn->data contents and end up in the command's sense buffer, which is returned to userspace.
Account for the 2-byte sense length prefix in the check.
--- drivers/scsi/libiscsi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/libiscsi.c +1 -1
@@ -918,7 +918,7 @@ static void iscsi_scsi_cmd_rsp(struct iscsi_conn *conn, struct iscsi_hdr *hdr, } senselen =get_unaligned_be16 (data); -if (datalen < senselen) +if (datalen < senselen +2 ) goto invalid_datalen; memcpy(sc->sense_buffer, data + 2,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 80/438 scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: HyeongJun An <[email protected]>
[ Upstream commit c1dea15f819cded9b3faf58f8bec72323568b6e6 ]
iscsi_tcp_hdr_dissect() receives the data segment of several PDU types into the fixed-size conn->data buffer, which is allocated for ISCSI_DEF_MAX_RECV_SEG_LEN (8192) bytes. For the LOGIN_RSP, TEXT_RSP, REJECT and ASYNC_EVENT opcodes the dissect path already rejects a PDU whose DataSegmentLength exceeds that buffer.
The SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) path also copies its data segment (sense/response data) into conn->data via iscsi_tcp_data_recv_prep(), but it does so without the same check. The only upstream bound on in.datalen is conn->max_recv_dlength, the initiator's advertised MaxRecvDataSegmentLength, which is commonly negotiated well above 8192 (open-iscsi defaults to 262144). A target that returns a SCSI Response with a DataSegmentLength between 8193 and max_recv_dlength therefore overflows the 8192-byte conn->data buffer.
Once the same bound applies, ISCSI_OP_SCSI_CMD_RSP is handled exactly like those responses: bound the data segment, receive it into conn->data when present, and otherwise complete the PDU with no data. Fold the opcode into that case group rather than duplicating the check.
--- drivers/scsi/libiscsi_tcp.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-)
drivers/scsi/libiscsi_tcp.c +1 -7
@@ -752,13 +752,6 @@ iscsi_tcp_hdr_dissect(struct iscsi_conn *conn, struct iscsi_hdr *hdr) rc =__iscsi_complete_pdu (conn, hdr,NULL ,0 );spin_unlock (&conn->session->back_lock);break ; -case ISCSI_OP_SCSI_CMD_RSP : -if (tcp_conn->in.datalen) { -iscsi_tcp_data_recv_prep (tcp_conn); -return 0 ; - } - rc =iscsi_complete_pdu (conn, hdr,NULL ,0 ); -break ;case ISCSI_OP_R2T :if (ahslen) { rc =ISCSI_ERR_AHSLEN ;
@@ -766,6 +759,7 @@ iscsi_tcp_hdr_dissect(struct iscsi_conn *conn, struct iscsi_hdr *hdr) } rc =iscsi_tcp_r2t_rsp (conn, hdr);break ; +case ISCSI_OP_SCSI_CMD_RSP :case ISCSI_OP_LOGIN_RSP :case ISCSI_OP_TEXT_RSP :case ISCSI_OP_REJECT :
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 81/438 scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xingui Yang <[email protected]>
[ Upstream commit 3dbbbf656b850c9c8de05df6ad4a1dfc6ff02845 ]
Commit fbefe22811c3 ("scsi: libsas: Don't always drain event workqueue for HA resume") introduced sas_resume_ha_no_sync() to avoid a deadlock:
the PHYE_RESUME_TIMEOUT handler, running on the HA event workqueue, calls sas_deform_port() -> sas_destruct_devices(), which removes SCSI devices and waits for the host to become runtime-active. But the host cannot resume until sas_resume_ha() -> sas_drain_work() returns, and the drain is blocked on that very handler.
However skipping the drain reintroduces a race: hisi_sas returns from resume before all PHY UP work and libsas discovery work finish. The controller may then autosuspend while disks are still waking up. The disks issue IO to a suspended controller, the IO fails, and the disks get disabled.
Fix the deadlock at its source by moving the PHYE_RESUME_TIMEOUT notification to after sas_drain_work(). By then the host resume is about to complete, so device removal through device_link no longer blocks on the resume and the cycle is broken.
With the deadlock gone, restore sas_resume_ha() (the draining variant) in hisi_sas and remove sas_resume_ha_no_sync().
The reorder is safe for the other libsas consumers (isci, pm8001, aic94xx, mvsas). During suspend, sas_suspend_devices() calls sas_notify_lldd_dev_gone() for each device, which sets dev->lldd_dev to NULL. When scsi_unblock_requests re-enables I/O in resume, any I/O to a timed-out phy's disk is immediately rejected by the LLDD before reaching
hardware: isci returns SAS_DEVICE_UNKNOWN (mapped to DID_BAD_TARGET), and pm8001 returns SAS_PHY_DOWN (mapped to DID_NO_CONNECT). Both complete directly via scsi_done() without entering SCSI EH. This is identical in both the old and new ordering since lldd_dev_gone runs during suspend, before resume. The reorder only affects when the PHYE_RESUME_TIMEOUT handler runs (synchronized by sas_drain_work() vs. asynchronous after resume returns), not whether I/O can reach the device. aic94xx and mvsas do not register any PM ops and never reach this code path.
--- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 10 +------ drivers/scsi/libsas/sas_init.c | 37 +++++++++++++------------- include/scsi/libsas.h | 1 - 3 files changed, 19 insertions(+), 29 deletions(-)
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +1 -9
@@ -5261,15 +5261,7 @@ static int _resume_v3_hw(struct device *device)return rc; }phys_init_v3_hw (hisi_hba); - -/* -* If a directly-attached disk is removed during suspend, a deadlock -* may occur, as the PHYE_RESUME_TIMEOUT processing will require the -* hisi_hba->device to be active, which can only happen when resume -* completes. So don't wait for the HA event workqueue to drain upon -* resume. -*/ -sas_resume_ha_no_sync (sha); +sas_resume_ha (sha);clear_bit (HISI_SAS_RESETTING_BIT , &hisi_hba->flags);dev_warn (dev,"end of resuming controller\n" );
drivers/scsi/libsas/sas_init.c +18 -19
@@ -410,7 +410,7 @@ static void sas_resume_insert_broadcast_ha(struct sas_ha_struct *ha) } } -static void _sas_resume_ha (struct sas_ha_struct *ha,bool drain) +void sas_resume_ha (struct sas_ha_struct *ha) {const unsigned long tmo =msecs_to_jiffies (25000 );int i;
@@ -426,6 +426,23 @@ static void _sas_resume_ha(struct sas_ha_struct *ha, bool drain)dev_info (ha->dev,"waiting up to 25 seconds for %d phy%s to resume\n" , i, i >1 ?"s" :"" );wait_event_timeout (ha->eh_wait_q,phys_suspended (ha) ==0 , tmo); + +/* +* All phys are back up or timed out. Turn on I/O and drain +* pending work. +*/ +scsi_unblock_requests (ha->shost); +sas_drain_work (ha); + +/* +* Send PHYE_RESUME_TIMEOUT after sas_drain_work(). The handler +* calls sas_deform_port() -> sas_destruct_devices(), which removes +* SCSI devices and, for LLDDs using device_link() PM sync, waits +* for the host to be runtime-active. Sending it before the drain +* would deadlock: the drain waits for the handler, the handler +* waits for host resume, and host resume waits for the drain to +* finish. +*/ for (i =0 ; i < ha->num_phys; i++) {struct asd_sas_phy *phy = ha->sas_phy[i];
@@ -436,12 +453,6 @@ static void _sas_resume_ha(struct sas_ha_struct *ha, bool drain) } } -/* all phys are back up or timed out, turn on i/o so we can -* flush out disks that did not return -*/ -scsi_unblock_requests (ha->shost); -if (drain) -sas_drain_work (ha);clear_bit (SAS_HA_RESUMING , &ha->state);sas_queue_deferred_work (ha);
@@ -450,20 +461,8 @@ static void _sas_resume_ha(struct sas_ha_struct *ha, bool drain)*/ sas_resume_insert_broadcast_ha (ha); } - -void sas_resume_ha (struct sas_ha_struct *ha) -{ -_sas_resume_ha (ha, true); -}EXPORT_SYMBOL (sas_resume_ha); -/* A no-sync variant, which does not call sas_drain_ha(). */ -void sas_resume_ha_no_sync (struct sas_ha_struct *ha) -{ -_sas_resume_ha (ha, false); -} -EXPORT_SYMBOL (sas_resume_ha_no_sync); -void sas_suspend_ha (struct sas_ha_struct *ha) {int i;
include/scsi/libsas.h +0 -1
@@ -680,7 +680,6 @@ extern int sas_register_ha(struct sas_ha_struct *);extern int sas_unregister_ha (struct sas_ha_struct *);extern void sas_prep_resume_ha (struct sas_ha_struct *sas_ha);extern void sas_resume_ha (struct sas_ha_struct *sas_ha); -extern void sas_resume_ha_no_sync (struct sas_ha_struct *sas_ha);extern void sas_suspend_ha (struct sas_ha_struct *sas_ha);int sas_phy_reset (struct sas_phy *phy,int hard_reset);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 82/438 smb: client: fix buffer leaks in SMB1 read and write
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dawei Feng <[email protected]>
[ Upstream commit 6a3e16d60e81a4aa3056ab15617036cfbea2e07d ]
CIFSSMBRead(), CIFSSMBWrite() and CIFSSMBWrite2() allocate a request buffer before checking whether tcon->ses->server is NULL. If that defensive check ever fails, the helper returns -ECONNABORTED without releasing the request buffer.
Fix these leaks by releasing the allocated request buffer before returning from these error paths. Use cifs_small_buf_release() for the buffers allocated by small_smb_init() and cifs_buf_release() for the buffer allocated by smb_init().
The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1.1.
An x86_64 allyesconfig build showed no new warnings.
Runtime validation used a temporary fault-injection hook to force tcon->ses->server to NULL after request-buffer initialization. On the unfixed kernel, the harness observed two leaked small request buffers and one leaked large request buffer, with directed kmemleak dumps confirming the CIFS buffer allocation stacks. After the fix, no CIFS request-buffer deltas remained.
--- fs/smb/client/cifssmb.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
fs/smb/client/cifssmb.c +9 -3
@@ -1681,8 +1681,10 @@ CIFSSMBRead(const unsigned int xid, struct cifs_io_parms *io_parms, pSMB->hdr.PidHigh =cpu_to_le16 ((__u16)(pid >>16 ));/* tcon and ses pointer are checked in smb_init */ -if (tcon->ses->server ==NULL ) +if (!tcon->ses->server) { +cifs_small_buf_release (pSMB);return -ECONNABORTED ; + } pSMB->AndXCommand =0xFF ;/* none */ pSMB->Fid = netfid;
@@ -1796,8 +1798,10 @@ CIFSSMBWrite(const unsigned int xid, struct cifs_io_parms *io_parms, pSMB->hdr.PidHigh =cpu_to_le16 ((__u16)(pid >>16 ));/* tcon and ses pointer are checked in smb_init */ -if (tcon->ses->server ==NULL ) +if (!tcon->ses->server) { +cifs_buf_release (pSMB);return -ECONNABORTED ; + } pSMB->AndXCommand =0xFF ;/* none */ pSMB->Fid = netfid;
@@ -2077,8 +2081,10 @@ CIFSSMBWrite2(const unsigned int xid, struct cifs_io_parms *io_parms, pSMB->hdr.PidHigh =cpu_to_le16 ((__u16)(pid >>16 ));/* tcon and ses pointer are checked in smb_init */ -if (tcon->ses->server ==NULL ) +if (!tcon->ses->server) { +cifs_small_buf_release (pSMB);return -ECONNABORTED ; + } pSMB->AndXCommand =0xFF ;/* none */ pSMB->Fid = netfid;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 83/438 erofs: clean up erofs_ishare_fill_inode()
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gao Xiang <[email protected]>
[ Upstream commit 1ccc75909ca7c3b52163b408a3e1eb5453db013f ]
- Use the shorthand si to replace the overly long sharedinode;
- Introduce erofs_warn() and get rid of barely-used _erofs_printk();
- Get rid of the variable hash;
- Simplify error paths.
Stable-dep-of: 96b2dbbe58a1 ("erofs: ensure valid f_path for page cache sharing")
--- fs/erofs/internal.h | 2 ++ fs/erofs/ishare.c | 45 +++++++++++++++++++-------------------------- 2 files changed, 21 insertions(+), 26 deletions(-)
fs/erofs/internal.h +2 -0
@@ -23,6 +23,8 @@ __printf(2, 3) void _erofs_printk(struct super_block *sb, const char *fmt, ...);#define erofs_err (sb, fmt, ...) \ _erofs_printk(sb, KERN_ERR fmt "\n", ##__VA_ARGS__) +#define erofs_warn (sb, fmt, ...) \ + _erofs_printk(sb, KERN_WARNING fmt "\n", ##__VA_ARGS__)#define erofs_info (sb, fmt, ...) \ _erofs_printk(sb, KERN_INFO fmt "\n", ##__VA_ARGS__)
fs/erofs/ishare.c +19 -26
68 lines not on this page · raw message
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 84/438 erofs: remove fscache backend entirely
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gao Xiang <[email protected]>
[ Upstream commit c37460cd9b2fcb61ec66b7eb4fde737e65ec2a56 ]
EROFS over fscache was introduced to provide image lazy pulling functionality. After the feature landed, the fscache subsystem made netfs a new hard dependency, which is unexpected for a local filesystem and has an kernel-defined caching hierarchy which could be inflexible compared to the fanotify pre-content hooks. Therefore, this feature has been deprecated for almost two years.
As EROFS file-backed mounts and fanotify pre-content hooks both upstream for a while and already providing equivalent functionality (erofs-utils has supported fanotify pre-content hooks), let's remove the fscache backend now.
The main application of this feature is Nydus [1], and they plan to move to use fanotify pre-content hooks in the near future too.
I hope this patch can be merged into Linux 7.2, which is also motivated by newly found implementation issues [2][3] that are not worth investigating given the deprecation and limited development resources. The associated fscache/cachefiles cleanup patch will follow separately through the vfs tree (netfs) later: it seems fine since the codebase is isolated by CONFIG_CACHEFILES_ONDEMAND.
[1] https://github.com/dragonflyoss/nydus/blob/v2.1.0/docs/nydus-fscache.md
[2] https://github.com/dragonflyoss/nydus/pull/1824
[3] https://lore.kernel.org/r/[email protected]
Stable-dep-of: 96b2dbbe58a1 ("erofs: ensure valid f_path for page cache sharing")
--- Documentation/filesystems/erofs.rst | 9 +- fs/erofs/Kconfig | 21 +- fs/erofs/Makefile | 1 - fs/erofs/data.c | 4 +- fs/erofs/fscache.c | 664 ---------------------------- fs/erofs/inode.c | 2 +- fs/erofs/internal.h | 70 +-- fs/erofs/ishare.c | 2 +- fs/erofs/super.c | 94 +--- fs/erofs/zdata.c | 6 - 10 files changed, 26 insertions(+), 847 deletions(-) delete mode 100644 fs/erofs/fscache.c
Documentation/filesystems/erofs.rst +3 -6
@@ -127,12 +127,9 @@ dax A legacy option which is an alias for ``dax=always``. device=%s Specify a path to an extra device to be used together. directio (For file-backed mounts) Use direct I/O to access backing files, and asynchronous I/O will be enabled if supported. -fsid=%s Specify a filesystem image ID for Fscache back-end. -domain_id=%s Specify a trusted domain ID for fscache mode so that - different images with the same blobs, identified by blob IDs, - can share storage within the same trusted domain. - Also used for different filesystems with inode page sharing - enabled to share page cache within the trusted domain. +domain_id=%s Specify a trusted domain ID. Filesystems sharing the same + domain ID can share page cache across mounts when inode + page sharing is enabled. (not shown in mountinfo output) fsoffset=%llu Specify block-aligned filesystem offset for the primary device. inode_share Enable inode page sharing for this filesystem. Inodes with identical content within the same domain ID can share the
fs/erofs/Kconfig +1 -20
@@ -3,13 +3,11 @@ config EROFS_FS tristate "EROFS filesystem support" depends on BLOCK - select CACHEFILES if EROFS_FS_ONDEMAND select CRC32 select CRYPTO if EROFS_FS_ZIP_ACCEL select CRYPTO_DEFLATE if EROFS_FS_ZIP_ACCEL select FS_IOMAP select LZ4_DECOMPRESS if EROFS_FS_ZIP - select NETFS_SUPPORT if EROFS_FS_ONDEMAND select XXHASH if EROFS_FS_XATTR select XZ_DEC if EROFS_FS_ZIP_LZMA select XZ_DEC_MICROLZMA if EROFS_FS_ZIP_LZMA
@@ -109,9 +107,6 @@ config EROFS_FS_BACKED_BY_FILE be used to simplify error-prone lifetime management of unnecessary virtual block devices. - Note that this feature, along with ongoing fanotify pre-content - hooks, will eventually replace "EROFS over fscache." - If you don't want to enable this feature, say N. config EROFS_FS_ZIP
@@ -172,20 +167,6 @@ config EROFS_FS_ZIP_ACCEL If unsure, say N. -config EROFS_FS_ONDEMAND - bool "EROFS fscache-based on-demand read support (deprecated)" - depends on EROFS_FS - select FSCACHE - select CACHEFILES_ONDEMAND - help - This permits EROFS to use fscache-backed data blobs with on-demand - read support. - - It is now deprecated and scheduled to be removed from the kernel - after fanotify pre-content hooks are landed. - - If unsure, say N. - config EROFS_FS_PCPU_KTHREAD bool "EROFS per-cpu decompression kthread workers" depends on EROFS_FS_ZIP
@@ -207,7 +188,7 @@ config EROFS_FS_PCPU_KTHREAD_HIPRI config EROFS_FS_PAGE_CACHE_SHARE bool "EROFS page cache share support (experimental)" - depends on EROFS_FS && EROFS_FS_XATTR && !EROFS_FS_ONDEMAND + depends on EROFS_FS && EROFS_FS_XATTR help This enables page cache sharing among inodes with identical content fingerprints on the same machine.
fs/erofs/Makefile +0 -1
@@ -9,5 +9,4 @@ erofs-$(CONFIG_EROFS_FS_ZIP_DEFLATE) += decompressor_deflate.o erofs-$(CONFIG_EROFS_FS_ZIP_ZSTD) += decompressor_zstd.o erofs-$(CONFIG_EROFS_FS_ZIP_ACCEL) += decompressor_crypto.o erofs-$(CONFIG_EROFS_FS_BACKED_BY_FILE) += fileio.o -erofs-$(CONFIG_EROFS_FS_ONDEMAND) += fscache.o erofs-$(CONFIG_EROFS_FS_PAGE_CACHE_SHARE) += ishare.o
fs/erofs/data.c +1 -3
@@ -80,9 +80,7 @@ int erofs_init_metabuf(struct erofs_buf *buf, struct super_block *sb,if (erofs_is_fileio_mode (sbi)) { buf->file = sbi->dif0.file;/* some fs like FUSE needs it */ buf->mapping = buf->file->f_mapping; - }else if (erofs_is_fscache_mode (sb)) - buf->mapping = sbi->dif0.fscache->inode->i_mapping; -else + }else buf->mapping = sb->s_bdev->bd_mapping;return 0 ; }
fs/erofs/fscache.c deleted +0 -664
664 lines not on this page · raw message
fs/erofs/inode.c +1 -1
@@ -256,7 +256,7 @@ static int erofs_fill_inode(struct inode *inode) }mapping_set_large_folios (inode->i_mapping); - aops =erofs_get_aops (inode, false); + aops =erofs_get_aops (inode);if (IS_ERR (aops))return PTR_ERR (aops); inode->i_mapping->a_ops = aops;
fs/erofs/internal.h +1 -69
127 lines not on this page · raw message
fs/erofs/ishare.c +1 -1
@@ -45,7 +45,7 @@ bool erofs_ishare_fill_inode(struct inode *inode)struct erofs_inode_fingerprint fp;struct inode *si; - aops =erofs_get_aops (inode, true); + aops =erofs_get_aops (inode);if (IS_ERR (aops))return false;if (erofs_xattr_fill_inode_fingerprint (&fp, inode, sbi->domain_id))
fs/erofs/super.c +18 -76
226 lines not on this page · raw message
fs/erofs/zdata.c +0 -6
@@ -1714,8 +1714,6 @@ static void z_erofs_submit_queue(struct z_erofs_frontend *f, drain_io:if (erofs_is_fileio_mode (EROFS_SB (sb)))erofs_fileio_submit_bio (bio); -else if (erofs_is_fscache_mode (sb)) -erofs_fscache_submit_bio (bio);else submit_bio (bio);
@@ -1744,8 +1742,6 @@ static void z_erofs_submit_queue(struct z_erofs_frontend *f,if (!bio) {if (erofs_is_fileio_mode (EROFS_SB (sb))) bio =erofs_fileio_bio_alloc (&mdev); -else if (erofs_is_fscache_mode (sb)) - bio =erofs_fscache_bio_alloc (&mdev);else bio =bio_alloc (mdev.m_bdev,BIO_MAX_VECS ,REQ_OP_READ ,GFP_NOIO );
@@ -1774,8 +1770,6 @@ static void z_erofs_submit_queue(struct z_erofs_frontend *f,if (bio) {if (erofs_is_fileio_mode (EROFS_SB (sb)))erofs_fileio_submit_bio (bio); -else if (erofs_is_fscache_mode (sb)) -erofs_fscache_submit_bio (bio);else submit_bio (bio); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 85/438 erofs: ensure valid f_path for page cache sharing
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gao Xiang <[email protected]>
[ Upstream commit 96b2dbbe58a1ea5df8d29c2fe24b5f04715f4443 ]
Previously, backing files for page cache sharing were set up with f_path left as NULL (only f_inode was valid). It worked, but a recent mincore fix relies on f_path.mnt and crashes (found by "erofs/028" on 7.2-rc4):
BUG: kernel NULL pointer dereference, address: 0000000000000018 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 3 UID: 0 PID: 675528 Comm: fincore Not tainted 7.2.0-rc4-00002-g[]-dirty #1 PREEMPT(lazy) Hardware name: Red Hat KVM, BIOS 1.16.0-4.al8 04/01/2014 RIP: 0010:__do_sys_mincore+0xc0/0x2c0 ...
Specify valid paths using valid disconnected dentries together with erofs_ishare_mnt instead of leaving f_path empty, so they are more like real backing files in a pseudo filesystem and standard backing_file_open() can be used directly.
--- fs/erofs/Kconfig | 1 + fs/erofs/internal.h | 4 ++-- fs/erofs/ishare.c | 58 ++++++++++++++++++++++----------------------- 3 files changed, 31 insertions(+), 32 deletions(-)
fs/erofs/Kconfig +1 -0
@@ -189,6 +189,7 @@ config EROFS_FS_PCPU_KTHREAD_HIPRI config EROFS_FS_PAGE_CACHE_SHARE bool "EROFS page cache share support (experimental)" depends on EROFS_FS && EROFS_FS_XATTR + select FS_STACK help This enables page cache sharing among inodes with identical content fingerprints on the same machine.
fs/erofs/internal.h +2 -2
@@ -288,8 +288,8 @@ struct erofs_inode {struct erofs_inode_fingerprint fingerprint; spinlock_t ishare_lock; }; -/* for each real inode */ -struct inode *sharedinode; +/* for each real filesystem inode */ +struct dentry *sharedentry; };#endif /* the corresponding vfs inode */
fs/erofs/ishare.c +28 -30
114 lines not on this page · raw message
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 86/438 gpio: gpio-by-pinctrl: Apply initial value in direction output wrapper
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Tran <[email protected]>
[ Upstream commit 67ff4bf723c8bd1f1b10450fa3e8f55762418104 ]
After successfully configuring gpio pin as output, set the requested initial output value via the existing gpio set wrapper, so that the pin is not left at its previous level.
--- drivers/gpio/gpio-by-pinctrl.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
drivers/gpio/gpio-by-pinctrl.c +12 -6
@@ -28,12 +28,6 @@ static int pin_control_gpio_get_direction(struct gpio_chip *gc, unsigned int offreturn GPIO_LINE_DIRECTION_IN ; } -static int pin_control_gpio_direction_output (struct gpio_chip *chip, -unsigned int offset,int val) -{ -return pinctrl_gpio_direction_output (chip, offset); -} -static int pin_control_gpio_get (struct gpio_chip *chip,unsigned int offset) {unsigned long config;
@@ -56,6 +50,18 @@ static int pin_control_gpio_set(struct gpio_chip *chip, unsigned int offset,return pinctrl_gpio_set_config (chip, offset, config); } +static int pin_control_gpio_direction_output (struct gpio_chip *chip, +unsigned int offset,int val) +{ +int ret; + + ret =pinctrl_gpio_direction_output (chip, offset); +if (ret) +return ret; + +return pin_control_gpio_set (chip, offset, val); +} +static int pin_control_gpio_probe (struct platform_device *pdev) {struct device *dev = &pdev->dev;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 87/438 ACPI: CPPC: Skip writes to unsupported performance controls
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Loehle <[email protected]>
[ Upstream commit 47d4e945dff8139050473be4ab263a32e1da910c ]
MIN_PERF and MAX_PERF are optional CPPC controls. DESIRED_PERF is also optional with CPPC2 when autonomous selection is supported.
The cppc-cpufreq target callbacks populate both limits for every request without checking whether the controls are implemented. cppc_set_perf() consequently passes NULL register descriptors to cpc_write(). The writes fail width validation and their return values are ignored, so the failed access paths are repeated on every target request. An autonomous-only platform can take the same path for DESIRED_PERF.
Check that each performance control is supported before calling cpc_write().
--- drivers/acpi/cppc_acpi.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/acpi/cppc_acpi.c +4 -3
@@ -1940,16 +1940,17 @@ int cppc_set_perf(int cpu, struct cppc_perf_ctrls *perf_ctrls) cpc_desc->write_cmd_status =0 ; } -cpc_write (cpu, desired_reg, perf_ctrls->desired_perf); +if (CPC_SUPPORTED (desired_reg)) +cpc_write (cpu, desired_reg, perf_ctrls->desired_perf);/* * Only write if min_perf and max_perf not zero. Some drivers pass zero * value to min and max perf, but they don't mean to set the zero value, * they just don't want to write to those registers. */ -if (perf_ctrls->min_perf) +if (perf_ctrls->min_perf &&CPC_SUPPORTED (min_perf_reg))cpc_write (cpu, min_perf_reg, perf_ctrls->min_perf); -if (perf_ctrls->max_perf) +if (perf_ctrls->max_perf &&CPC_SUPPORTED (max_perf_reg))cpc_write (cpu, max_perf_reg, perf_ctrls->max_perf);if (CPC_IN_PCC (desired_reg) ||CPC_IN_PCC (min_perf_reg) ||CPC_IN_PCC (max_perf_reg))
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 88/438 wifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup()
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <[email protected]>
[ Upstream commit 47abd2ca281531deee38a3b3770d885e270e9fc9 ]
ath12k_mac_dp_peer_cleanup() clears the ML peer ID slot on the free_ml_peer_id_map bitmap by indexing it with dp_peer->peer_id. That is
wrong: dp_peer->peer_id for an MLO peer always carries the ATH12K_PEER_ML_ID_VALID bit (BIT(13)), so clear_bit() is invoked with index >= 0x2000, which is far outside the bitmap of ATH12K_MAX_MLO_PEERS
(256) bits and corrupts memory adjacent to ah->free_ml_peer_id_map. The intended bitmap entry also never gets cleared, so subsequent ath12k_peer_ml_alloc() calls eventually run out of IDs.
The ID without the VALID bit is what ath12k_peer_ml_alloc() returned and is stored in ahsta->ml_peer_id. Use that instead.
While there, also reset ahsta->ml_peer_id to ATH12K_MLO_PEER_ID_INVALID so the bitmap and ahsta->ml_peer_id stay in sync.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
--- drivers/net/wireless/ath/ath12k/mac.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/ath12k/mac.c +4 -1
@@ -1283,8 +1283,11 @@ void ath12k_mac_dp_peer_cleanup(struct ath12k_hw *ah)spin_lock_bh (&dp_hw->peer_lock);list_for_each_entry_safe (dp_peer, tmp, &dp_hw->dp_peers_list, list) {if (dp_peer->is_mlo) { +struct ath12k_sta *ahsta =ath12k_sta_to_ahsta (dp_peer->sta); +rcu_assign_pointer (dp_hw->dp_peers[dp_peer->peer_id],NULL ); -clear_bit (dp_peer->peer_id, ah->free_ml_peer_id_map); +clear_bit (ahsta->ml_peer_id, ah->free_ml_peer_id_map); + ahsta->ml_peer_id =ATH12K_MLO_PEER_ID_INVALID ; }list_move (&dp_peer->list, &peers);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 89/438 ASoC: tas2781: Use correct calibration data for SINEGAIN2 register
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: wangdicheng <[email protected]>
[ Upstream commit dd88cf6273de61f2f7206c2066af97798dbb38b0 ]
The SINEGAIN2_REG case in cali_reg_update() references t->sin_gn[] rather than t->sin_gn2[], causing the second pilot tone gain calibration to be programmed with the wrong register address.
These are distinct fields in struct fct_param_address and are populated from separate firmware parameters by the parser in tas2781-fmwlib.c.
--- sound/soc/codecs/tas2781-i2c.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/codecs/tas2781-i2c.c +2 -2
@@ -1308,8 +1308,8 @@ static void cali_reg_update(struct bulk_reg_val *p, t->sin_gn[2]);break ;case TAS2781_PRM_SINEGAIN2_REG : - reg =TASDEVICE_REG (t->sin_gn[0 ], t->sin_gn[1 ], - t->sin_gn[2 ]); + reg =TASDEVICE_REG (t->sin_gn2[0 ], t->sin_gn2[1 ], + t->sin_gn2[2 ]);break ;default : reg =0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 90/438 spi: spi-cadence: Move TX FIFO full busy-wait into FIFO
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srikanth Boyapally <[email protected]>
[ Upstream commit d9eadfce2fac49445db40808fe4d8259f20a9d2b ]
SPI host transfers could intermittently stall with spi_transfer timeouts. The TXFULL condition was checked only once in cdns_transfer_one() before cdns_spi_process_fifo(), so if the FIFO became full again during refill, writes could be dropped and the transfer would never complete.
Move the TXFULL busy-wait into the TX path of cdns_spi_process_fifo() so the 10µs back-off is applied per FIFO entry during filling, ensuring forward progress and eliminating spurious timeouts.
Restrict the delay to host mode using spi_controller_is_target(), the controller is passed into cdns_spi_process_fifo() so the check is made at the point of use. In target mode this delay must not run as it causes the target to miss its transfer window and corrupt data.
--- drivers/spi/spi-cadence.c | 26 ++++++++++++++++---------- 1 file changed, 16 insertions(+), 10 deletions(-)
drivers/spi/spi-cadence.c +16 -10
@@ -388,11 +388,13 @@ static inline void cdns_spi_writer(struct cdns_spi *xspi)/** * cdns_spi_process_fifo - Fills the TX FIFO, and drain the RX FIFO +* @ctlr: Pointer to the spi_controller structure * @xspi: Pointer to the cdns_spi structure * @ntx: Number of bytes to pack into the TX FIFO * @nrx: Number of bytes to drain from the RX FIFO */ -static void cdns_spi_process_fifo (struct cdns_spi *xspi,int ntx,int nrx) +static void cdns_spi_process_fifo (struct spi_controller *ctlr, +struct cdns_spi *xspi,int ntx,int nrx) { ntx =clamp (ntx,0 , xspi->tx_bytes); nrx =clamp (nrx,0 , xspi->rx_bytes);
@@ -407,6 +409,16 @@ static void cdns_spi_process_fifo(struct cdns_spi *xspi, int ntx, int nrx) }if (ntx) { +/* When xspi in busy condition, bytes may send failed, +* then spi control didn't work thoroughly, add one byte +* delay. Only in host mode; in target mode this delay +* causes data corruption as the target fails to prepare +* data in time. +*/ +if (!spi_controller_is_target (ctlr) && + (cdns_spi_read (xspi,CDNS_SPI_ISR ) &CDNS_SPI_IXR_TXFULL )) +udelay (10 ); +cdns_spi_writer (xspi); ntx--; }
@@ -460,14 +472,14 @@ static irqreturn_t cdns_spi_irq(int irq, void *dev_id)cdns_spi_write (xspi,CDNS_SPI_THLD ,1 );if (xspi->tx_bytes) { -cdns_spi_process_fifo (xspi, trans_cnt, trans_cnt); +cdns_spi_process_fifo (ctlr, xspi, trans_cnt, trans_cnt); }else {/* Fixed delay due to controller limitation with * RX_NEMPTY incorrect status * Xilinx AR:65885 contains more details */ udelay (10 ); -cdns_spi_process_fifo (xspi,0 , trans_cnt); +cdns_spi_process_fifo (ctlr, xspi,0 , trans_cnt);cdns_spi_write (xspi,CDNS_SPI_IDR ,CDNS_SPI_IXR_DEFAULT );spi_finalize_current_transfer (ctlr);
@@ -520,17 +532,11 @@ static int cdns_transfer_one(struct spi_controller *ctlr,cdns_spi_write (xspi,CDNS_SPI_THLD , xspi->tx_fifo_depth >>1 ); } -/* When xspi in busy condition, bytes may send failed, -* then spi control didn't work thoroughly, add one byte delay -*/ -if (cdns_spi_read (xspi,CDNS_SPI_ISR ) &CDNS_SPI_IXR_TXFULL ) -udelay (10 ); - xspi->n_bytes =cdns_spi_n_bytes (transfer); xspi->tx_bytes =DIV_ROUND_UP (xspi->tx_bytes, xspi->n_bytes); xspi->rx_bytes =DIV_ROUND_UP (xspi->rx_bytes, xspi->n_bytes); -cdns_spi_process_fifo (xspi, xspi->tx_fifo_depth,0 ); +cdns_spi_process_fifo (ctlr, xspi, xspi->tx_fifo_depth,0 );cdns_spi_write (xspi,CDNS_SPI_IER ,CDNS_SPI_IXR_DEFAULT );return transfer->len;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 91/438 hwmon: (nct6775-core) Fix number of temperature registers for NCT6116
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit b0e8adb2ccb43009796897ced09f91636685c9d3 ]
Unlike NCT6106, NCT6116 only has three temperature registers, and with it only three temperature source and temperature source configuration registers. The register addresses match those of NCT6106 and can be re-used.
The code used a separate array to list the temperature source registers for NCT6116, but used the size of the NCT6106 register array to set the number of registers. The NCT6106 register array provides six addresses, while the temperature source register array for NCT6116 only provides three addresses. This causes a KASAN report.
BUG: KASAN: global-out-of-bounds in nct6775_probe+0x936/0x46f0 [nct6775] Read of size 2 at addr ffffffffc19561a6 by task modprobe/954 ... Call Trace: dump_stack+0x7d/0xa7 print_address_description.constprop.0+0x1c/0x220 ? __kasan_kmalloc.constprop.0+0xc9/0xd0 ? __kmalloc_node_track_caller+0x194/0x5b0 ? nct6775_probe+0x936/0x46f0 [nct6775] ? nct6775_probe+0x936/0x46f0 [nct6775]
...
Fix the problem by hard-coding the number of temperature and temperature configuration registers to three for NCT6116. Drop the unnecessary NCT6116_REG_TEMP_SOURCE array and re-use NCT6106_REG_TEMP_SOURCE.
--- drivers/hwmon/nct6775-core.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/hwmon/nct6775-core.c +3 -5
@@ -846,8 +846,6 @@ static const u16 NCT6116_FAN_PULSE_SHIFT[] = { 0, 2, 4, 6, 6 };static const u16 NCT6116_REG_PWM [] = {0x119 ,0x129 ,0x139 ,0x199 ,0x1a9 };static const u16 NCT6116_REG_FAN_MODE [] = {0x113 ,0x123 ,0x133 ,0x193 ,0x1a3 };static const u16 NCT6116_REG_TEMP_SEL [] = {0x110 ,0x120 ,0x130 ,0x190 ,0x1a0 }; -static const u16 NCT6116_REG_TEMP_SOURCE [] = { -0xb0 ,0xb1 ,0xb2 };static const u16 NCT6116_REG_CRITICAL_TEMP [] = {0x11a ,0x12a ,0x13a ,0x19a ,0x1aa };
@@ -3652,7 +3650,7 @@ int nct6775_probe(struct device *dev, struct nct6775_data *data, = NCT6106_CRITICAL_PWM_ENABLE_MASK; data->REG_CRITICAL_PWM =NCT6116_REG_CRITICAL_PWM ; data->REG_TEMP_OFFSET =NCT6106_REG_TEMP_OFFSET ; - data->REG_TEMP_SOURCE =NCT6116_REG_TEMP_SOURCE ; + data->REG_TEMP_SOURCE =NCT6106_REG_TEMP_SOURCE ; data->REG_TEMP_SEL =NCT6116_REG_TEMP_SEL ; data->REG_WEIGHT_TEMP_SEL =NCT6106_REG_WEIGHT_TEMP_SEL ; data->REG_WEIGHT_TEMP[0 ] =NCT6106_REG_WEIGHT_TEMP_STEP ;
@@ -3666,13 +3664,13 @@ int nct6775_probe(struct device *dev, struct nct6775_data *data, reg_temp =NCT6106_REG_TEMP ; reg_temp_mon =NCT6106_REG_TEMP_MON ; - num_reg_temp =ARRAY_SIZE (NCT6106_REG_TEMP ); + num_reg_temp =3 ; num_reg_temp_mon =ARRAY_SIZE (NCT6106_REG_TEMP_MON ); num_reg_tsi_temp =ARRAY_SIZE (NCT6116_REG_TSI_TEMP ); reg_temp_over =NCT6106_REG_TEMP_OVER ; reg_temp_hyst =NCT6106_REG_TEMP_HYST ; reg_temp_config =NCT6106_REG_TEMP_CONFIG ; - num_reg_temp_config =ARRAY_SIZE (NCT6106_REG_TEMP_CONFIG ); + num_reg_temp_config =3 ; reg_temp_alternate =NCT6106_REG_TEMP_ALTERNATE ; reg_temp_crit =NCT6106_REG_TEMP_CRIT ; reg_temp_crit_l =NCT6106_REG_TEMP_CRIT_L ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 92/438 hwmon: (ina2xx) Fix various overflow issues
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit e6c80061ca239f45c0eaf7e47a91d6d6df9bd636 ]
Sashiko reports several integer overflow problems in the ina2xx driver caused by unbounded multiplications and inadequate types for intermediate calculations.
Specifically:
- In ina2xx_get_value(), the return type is changed from int to long. Intermediate calculations for current are now performed using 64-bit types to prevent 32-bit integer overflow before the division by 1000.
- When calculating power in ina2xx_get_value() and sy24655_average_power_read(), interim values are cast to u64 and clamped to LONG_MAX. This prevents overflow when regval or accumulator_24 is multiplied by power_lsb_uW.
- In ina226_alert_to_reg(), the clamping logic is rewritten using min_t(). This safely avoids integer overflows when scaling user-provided values for shunt voltage, bus voltage, power, and current limits.
--- drivers/hwmon/ina2xx.c | 61 ++++++++++++++++++++++++------------------ 1 file changed, 35 insertions(+), 26 deletions(-)
drivers/hwmon/ina2xx.c +35 -26
@@ -16,6 +16,7 @@#include <linux/i2c.h> #include <linux/init.h> #include <linux/kernel.h> +#include <linux/limits.h> #include <linux/module.h> #include <linux/property.h> #include <linux/regmap.h>
@@ -266,30 +267,34 @@ static u16 ina226_interval_to_reg(long interval)return FIELD_PREP (INA226_AVG_RD_MASK , avg_bits); } -static int ina2xx_get_value (struct ina2xx_data *data,u8 reg, -unsigned int regval) +static long ina2xx_get_value (struct ina2xx_data *data,u8 reg, +unsigned int regval) { -int val; +s64 val64; +long val;switch (reg) {case INA2XX_SHUNT_VOLTAGE :/* signed register */ - val = (s16 )regval >> data->config->shunt_voltage_shift; - val =DIV_ROUND_CLOSEST (val, data->config->shunt_div); + val =DIV_ROUND_CLOSEST ((s16 )regval >> data->config->shunt_voltage_shift, + data->config->shunt_div);break ;case INA2XX_BUS_VOLTAGE : - val = (regval >> data->config->bus_voltage_shift) * - data->config->bus_voltage_lsb; - val =DIV_ROUND_CLOSEST (val,1000 ); + val =DIV_ROUND_CLOSEST ((regval >> data->config->bus_voltage_shift) * + data->config->bus_voltage_lsb,1000 );break ;case INA2XX_POWER : - val = regval * data->power_lsb_uW; + val =min_t (u64, (u64 )regval * data->power_lsb_uW,LONG_MAX );break ;case INA2XX_CURRENT :/* signed register, result in mA */ - val = ((s16 )regval >> data->config->current_shift) * + val64 = (s64)((s16 )regval >> data->config->current_shift) * data->current_lsb_uA; - val =DIV_ROUND_CLOSEST (val,1000 ); +if (val64 <0 ) + val64 = -DIV_ROUND_CLOSEST_ULL (-val64,1000 ); +else + val64 =DIV_ROUND_CLOSEST_ULL (val64,1000 ); + val =clamp_val (val64,LONG_MIN ,LONG_MAX );break ;case INA2XX_CALIBRATION : val = regval;
@@ -378,27 +383,29 @@ static int ina2xx_read_init(struct device *dev, int reg, long *val)*/ static u16 ina226_alert_to_reg (struct ina2xx_data *data,int reg,long val) { +long limit; +switch (reg) {case INA2XX_SHUNT_VOLTAGE : - val =clamp_val (val,0 ,SHRT_MAX * data->config->shunt_div); - val *= data->config->shunt_div; - val <<= data->config->shunt_voltage_shift; -return clamp_val (val,0 ,SHRT_MAX ); + val =min_t (long, val,DIV_ROUND_CLOSEST (SHRT_MAX , data->config->shunt_div)); +return min_t (long, (val * data->config->shunt_div) << data->config->shunt_voltage_shift, +SHRT_MAX );case INA2XX_BUS_VOLTAGE : - val =clamp_val (val,0 ,200000 ); - val = (val *1000 ) << data->config->bus_voltage_shift; - val =DIV_ROUND_CLOSEST (val, data->config->bus_voltage_lsb); -return clamp_val (val,0 ,USHRT_MAX ); + val =min_t (long, val,130000 ); +return min_t (long, +DIV_ROUND_CLOSEST ((val *1000 ) << data->config->bus_voltage_shift, + data->config->bus_voltage_lsb), +USHRT_MAX );case INA2XX_POWER : - val =clamp_val (val,0 ,UINT_MAX - data->power_lsb_uW); - val =DIV_ROUND_CLOSEST (val, data->power_lsb_uW); -return clamp_val (val,0 ,USHRT_MAX ); + val =min_t (long, val,LONG_MAX - data->power_lsb_uW); +return min_t (long,DIV_ROUND_CLOSEST (val, data->power_lsb_uW),USHRT_MAX );case INA2XX_CURRENT : - val =clamp_val (val,INT_MIN /1000 ,INT_MAX /1000 ); + limit = (LONG_MAX - (data->current_lsb_uA /2 )) /1000 ; + val =min_t (long, val, limit);/* signed register, result in mA */ val =DIV_ROUND_CLOSEST (val *1000 , data->current_lsb_uA); - val <<= data->config->current_shift; -return clamp_val (val,SHRT_MIN ,SHRT_MAX ); + limit =SHRT_MAX >> data->config->current_shift; +return (u16)(min_t (long, val, limit) << data->config->current_shift);default :/* programmer goofed */ WARN_ON_ONCE (1 );
@@ -537,6 +544,7 @@ static int sy24655_average_power_read(struct ina2xx_data *data, u8 reg, long *vau8 template[6 ];int ret;long accumulator_24, sample_count; +u64 val64;/* 48-bit register read */ ret =i2c_smbus_read_i2c_block_data (data->client, reg,6 , template);
@@ -555,7 +563,8 @@ static int sy24655_average_power_read(struct ina2xx_data *data, u8 reg, long *vareturn 0 ; } - *val =DIV_ROUND_CLOSEST (accumulator_24, sample_count) * data->power_lsb_uW; + val64 = (u64 )DIV_ROUND_CLOSEST (accumulator_24, sample_count) * data->power_lsb_uW; + *val =min_t (u64, val64,LONG_MAX );return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 93/438 hwmon: (ltc4282) Fix reading the minimum alarm voltage
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit 00feb1cce93dab948a299b69753d99c681d45a0b ]
Coverity reports an out-of-bounds access when reading the minimum alarm voltage for the VGPIO channel. Add the missing return statement to fix the problem.
--- drivers/hwmon/ltc4282.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/hwmon/ltc4282.c +2 -2
@@ -375,8 +375,8 @@ static int ltc4282_read_in(struct ltc4282_state *st, u32 attr, long *val, channel, val);case hwmon_in_min_alarm:if (channel ==LTC4282_CHAN_VGPIO ) -ltc4282_read_alarm (st,LTC4282_ADC_ALERT_LOG , -LTC4282_GPIO_ALARM_L_MASK , val); +return ltc4282_read_alarm (st,LTC4282_ADC_ALERT_LOG , +LTC4282_GPIO_ALARM_L_MASK , val); return ltc4282_vdd_source_read_alm(st, LTC4282_VSOURCE_ALARM_L_MASK,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 94/438 hwmon: (sht3x) Fix unaligned accesses
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit f46d5ab43a572b84773015a76966f5da56fc1748 ]
Sashiko reports:
In sht3x_update_client(), the 16-bit temperature and humidity values are extracted from a stack-allocated byte array using be16_to_cpup(). The pointers passed to this function are calculated as buf and buf + 3. Since the difference between the two pointers is an odd number of bytes, at least one of them is guaranteed to be at an unaligned offset.
This will trigger an alignment fault on strict-alignment architectures such as ARMv5 or SPARC, resulting in a kernel panic.
Fix the problem by using get_unaligned_be16() instead of be16_to_cpup(), and put_unaligned_be16() instead of cpu_to_be16().
--- drivers/hwmon/sht3x.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/hwmon/sht3x.c +5 -4
@@ -21,6 +21,7 @@#include <linux/module.h> #include <linux/slab.h> #include <linux/jiffies.h> +#include <linux/unaligned.h> /* commands (high repeatability mode) */ static const unsigned char sht3x_cmd_measure_single_hpm[] = {0x24 ,0x00 };
@@ -276,9 +277,9 @@ static struct sht3x_data *sht3x_update_client(struct device *dev)if (ret) goto out; - val =be16_to_cpup ((__be16 *)buf); + val =get_unaligned_be16 (buf); data->temperature =sht3x_extract_temperature (val); - val =be16_to_cpup ((__be16 *)(buf +3 )); + val =get_unaligned_be16 (buf +3 ); data->humidity =sht3x_extract_humidity (val); data->last_update = jiffies; }
@@ -336,7 +337,7 @@ static int limits_update(struct sht3x_data *data)if (ret)return ret; - raw =be16_to_cpup ((__be16 *)buffer); + raw =get_unaligned_be16 (buffer); temperature =sht3x_extract_temperature ((raw &0x01ff ) <<7 ); humidity =sht3x_extract_humidity (raw &0xfe00 ); data->temperature_limits[index] = temperature;
@@ -389,7 +390,7 @@ static size_t limit_write(struct device *dev, raw = ((u32)(temperature +45000 ) *24543 ) >> (16 +7 ); raw |= ((humidity *42950 ) >>16 ) &0xfe00 ; - *((__be16 *)position) =cpu_to_be16 (raw); +put_unaligned_be16 (raw, position); position +=SHT3X_WORD_LEN ; *position = crc8(sht3x_crc8_table, position - SHT3X_WORD_LEN,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 95/438 hwmon: (lm90) Only report alarms if driver is ready
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit aa9429edf9fc0e90d6f4da19ea4b5495a54ab117 ]
Userspace can read sysfs attributes before driver registration is complete, immediately after devm_hwmon_device_register_with_info() has been called. At that time, data->hwmon_dev is not yet initialized. This can trigger a NULL pointer access since lm90_update_device() and with it lm90_update_alarms_locked() will be called. This call schedules report_work and lm90_report_alarms(), which passes the still-NULL data->hwmon_dev to hwmon_notify_event() and triggers a NULL pointer dereference.
Fix the problem by only scheduling the report and alert workers data->hwmon_dev is set.
--- drivers/hwmon/lm90.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/hwmon/lm90.c +2 -2
@@ -1194,7 +1194,7 @@ static int lm90_update_alarms_locked(struct lm90_data *data, bool force) check_enable = (client->irq || !(data->config_orig &0x80 )) && (data->config &0x80 ); -if (force || check_enable) +if (data->hwmon_dev && (force || check_enable))schedule_work (&data->report_work);/*
@@ -1202,7 +1202,7 @@ static int lm90_update_alarms_locked(struct lm90_data *data, bool force)* alarms are all clear, and alerts are currently disabled. * Otherwise (re)schedule worker if needed. */ -if (check_enable) { +if (check_enable && data->hwmon_dev) {if (!(data->current_alarms & data->alert_alarms)) {dev_dbg (&client->dev,"Re-enabling ALERT#\n" );lm90_update_confreg (data, data->config & ~0x80 );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 96/438 hwmon: (nzxt-smart2) DMA-align output buffer
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit 080bbf42faf77e6489ab30d5114c5f8f6ccbb1b8 ]
Sashiko reports:
When send_output_report() calls hid_hw_output_report(), the underlying USB HID core calls usb_interrupt_msg() which maps this buffer directly for DMA.
When the DMA mapping flushes or invalidates the cacheline, it will corrupt the adjacent variables (mutex, update_interval) that were modified concurrently by the CPU. This causes memory corruption due to cacheline sharing on non-coherent CPU architectures (such as ARM or MIPS). The DMA API debugging tool (CONFIG_DMA_API_DEBUG) will trigger runtime warnings for this violation.
Any operation that triggers send_output_report() (like setting a fan speed or updating the interval) causes the USB DMA mapping. On systems with non-coherent caches, this structural bug causes immediate and deterministic memory corruption.
Align the output buffer to ARCH_DMA_MINALIGN to fix the problem.
--- drivers/hwmon/nzxt-smart2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/nzxt-smart2.c +1 -1
@@ -203,7 +203,7 @@ struct drvdata {*/ struct mutex mutex;long update_interval; -u8 output_buffer[OUTPUT_REPORT_SIZE ]; +u8 output_buffer[OUTPUT_REPORT_SIZE ]__aligned(ARCH_DMA_MINALIGN) ; };static long scale_pwm_value (long val,long orig_max,long new_max)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 97/438 net: do not send ICMP/NDISC Redirects when peer allocation fails
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit dbc3791e3b2472e1ccc08947e0f83b443470ff4f ]
When inet_getpeer_v4() or inet_getpeer_v6() fails to allocate a peer entry under memory pressure or tree size caps, redirect handlers previously fell back to sending un-rate-limited ICMP/NDISC Redirect messages.
In IPv4, ip_rt_send_redirect() called icmp_send() directly when peer == NULL. In IPv6, ip6_forward() and ndisc_send_redirect() passed a NULL peer into inet_peer_xrlim_allow(), which returned true when peer == NULL.
Because ICMP/NDISC Redirects are not part of the default global rate limit mask (sysctl_icmp_ratemask), sending redirects when peer == NULL creates an un-rate-limited ICMP packet storm.
Fix this by failing closed in ip_rt_send_redirect(), ip6_forward(), and ndisc_send_redirect() when peer is NULL.
--- net/ipv4/route.c | 2 -- net/ipv6/ip6_output.c | 2 +- net/ipv6/ndisc.c | 2 ++ 3 files changed, 3 insertions(+), 3 deletions(-)
net/ipv4/route.c +0 -2
@@ -892,8 +892,6 @@ void ip_rt_send_redirect(struct sk_buff *skb) peer =inet_getpeer_v4 (net->ipv4.peers,ip_hdr (skb)->saddr, vif);if (!peer) {rcu_read_unlock (); -icmp_send (skb,ICMP_REDIRECT ,ICMP_REDIR_HOST , -rt_nexthop (rt,ip_hdr (skb)->daddr));return ; }
net/ipv6/ip6_output.c +1 -1
@@ -641,7 +641,7 @@ int ip6_forward(struct sk_buff *skb)/* Limit redirects both by destination (here) and by source (inside ndisc_send_redirect) */ -if (inet_peer_xrlim_allow (peer,1 *HZ )) +if (peer &&inet_peer_xrlim_allow (peer,1 *HZ ))ndisc_send_redirect (skb, target);rcu_read_unlock (); }else {
net/ipv6/ndisc.c +2 -0
@@ -1707,6 +1707,8 @@ void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target) } peer =inet_getpeer_v6 (net->ipv6.peers, &ipv6_hdr (skb)->saddr); +if (!peer) + goto release; ret =inet_peer_xrlim_allow (peer,1 *HZ );if (!ret)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 98/438 hwmon: (nct6775-core) Prevent access to unsupported weight registers
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit d0b704e569ac3b8416d8e02270cdc9bf830ed395 ]
Sashiko reports:
During initialization of the nct6116 chip, the driver sets data->pwm_num to 5. However, it assigns several NCT6106 register arrays (such as NCT6106_REG_WEIGHT_DUTY_STEP, NCT6106_REG_WEIGHT_TEMP_SEL, and NCT6106_REG_WEIGHT_TEMP_*) to data->REG_PWM and data->REG_WEIGHT_TEMP. These arrays only contain 3 elements.
In nct6775_update_pwm(), the driver iterates up to data->pwm_num. If data->has_pwm has bits 3 or 4 set (which is structurally possible for nct6116), the loop attempts to read elements at index 3 and 4 from these 3-element arrays. This results in a global out-of-bounds read, which can be caught by KASAN.
Furthermore, the driver uses these garbage out-of-bounds values as hardware register addresses for subsequent read and write operations. This leads to invalid hardware register access, potentially causing hardware misconfiguration or system crashes.
The underlying problem is that the chip does support up to five fan control channels, but only the first three support weight control. Fix the problem by extending the affected weight register arrays with zeroed fields. The driver uses zeroed register addresses to determine if a register is supported or not, and skips accesses for unsupported registers.
--- drivers/hwmon/nct6775-core.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/hwmon/nct6775-core.c +6 -6
@@ -791,12 +791,12 @@ static const u16 NCT6106_REG_TOLERANCE_H[] = { 0x112, 0x122, 0x132 };static const u16 NCT6106_REG_TARGET [] = {0x111 ,0x121 ,0x131 }; -static const u16 NCT6106_REG_WEIGHT_TEMP_SEL [] = {0x168 ,0x178 ,0x188 }; -static const u16 NCT6106_REG_WEIGHT_TEMP_STEP [] = {0x169 ,0x179 ,0x189 }; -static const u16 NCT6106_REG_WEIGHT_TEMP_STEP_TOL [] = {0x16a ,0x17a ,0x18a }; -static const u16 NCT6106_REG_WEIGHT_DUTY_STEP [] = {0x16b ,0x17b ,0x18b }; -static const u16 NCT6106_REG_WEIGHT_TEMP_BASE [] = {0x16c ,0x17c ,0x18c }; -static const u16 NCT6106_REG_WEIGHT_DUTY_BASE [] = {0x16d ,0x17d ,0x18d }; +static const u16 NCT6106_REG_WEIGHT_TEMP_SEL [] = {0x168 ,0x178 ,0x188 ,0 ,0 }; +static const u16 NCT6106_REG_WEIGHT_TEMP_STEP [] = {0x169 ,0x179 ,0x189 ,0 ,0 }; +static const u16 NCT6106_REG_WEIGHT_TEMP_STEP_TOL [] = {0x16a ,0x17a ,0x18a ,0 ,0 }; +static const u16 NCT6106_REG_WEIGHT_DUTY_STEP [] = {0x16b ,0x17b ,0x18b ,0 ,0 }; +static const u16 NCT6106_REG_WEIGHT_TEMP_BASE [] = {0x16c ,0x17c ,0x18c ,0 ,0 }; +static const u16 NCT6106_REG_WEIGHT_DUTY_BASE [] = {0x16d ,0x17d ,0x18d ,0 ,0 };static const u16 NCT6106_REG_AUTO_TEMP [] = {0x160 ,0x170 ,0x180 };static const u16 NCT6106_REG_AUTO_PWM [] = {0x164 ,0x174 ,0x184 };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 99/438 net: bridge: mrp: fix Option TLV length in MRP_Test frames
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Corvaglia <[email protected]>
[ Upstream commit 5546da86894d5906f131b05890705a7abf949d84 ]
oui is a pointer, so sizeof(oui) is the pointer size. The MRA Option TLV thus advertises a wrong length (15 vs 10 on x86_64), causing misparsing of the frame on peers. Fix is to replace with sizeof(*oui).
--- net/bridge/br_mrp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/bridge/br_mrp.c +1 -1
@@ -215,7 +215,7 @@ static struct sk_buff *br_mrp_alloc_test_skb(struct br_mrp *mrp,struct br_mrp_oui_hdr *oui =NULL ;u8 length; - length =sizeof (*sub_opt) +sizeof (*sub_tlv) +sizeof (oui) + + length =sizeof (*sub_opt) +sizeof (*sub_tlv) +sizeof (*oui) +MRP_OPT_PADDING ;br_mrp_skb_tlv (skb,BR_MRP_TLV_HEADER_OPTION , length);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 100/438 ASoC: sophgo: return 1 on volume change in cv1800b_adc_volume_set()
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Surendra Singh Chouhan <[email protected]>
[ Upstream commit f47064c970d3e920a27435454c02df310695f6e1 ]
cv1800b_adc_volume_set() serves as the .put callback for the "Internal I2S Capture Volume" control.
ALSA mixer control callbacks must return 1 when the register value is modified, 0 if unchanged, or a negative error code on failure. Returning 0 unconditionally causes ALSA core to assume the value was unchanged, suppressing SNDRV_CTL_EVENT_MASK_VALUE change notifications to userspace sound servers (e.g. PipeWire/PulseAudio).
Fix this by comparing the new register value with the existing register value. If unchanged, return 0; otherwise, write the updated value and return 1.
--- sound/soc/sophgo/cv1800b-sound-adc.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
sound/soc/sophgo/cv1800b-sound-adc.c +8 -2
@@ -251,16 +251,22 @@ static int cv1800b_adc_volume_set(struct snd_kcontrol *kcontrol,u32 v_left =clamp_t (u32, ucontrol->value.integer.value[0 ],0 ,24 );u32 v_right =clamp_t (u32, ucontrol->value.integer.value[1 ],0 ,24 ); -u32 val; +u32 val, old_val; val =readl (priv->regs +CV1800B_RXADC_ANA0 ); + old_val = val; + val =u32_replace_bits (val, cv1800b_gains[v_left],REG_COMB_LEFT_VOLUME ); val =u32_replace_bits (val, cv1800b_gains[v_right],REG_COMB_RIGHT_VOLUME ); + +if (val == old_val) +return 0 ; +writel (val, priv->regs +CV1800B_RXADC_ANA0 ); -return 0 ; +return 1 ; } static DECLARE_TLV_DB_SCALE(cv1800b_volume_tlv, 0, 200, 0);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 101/438 forcedeth: fix UAF of txrx_stats in nv_remove
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chenguang Zhao <[email protected]>
[ Upstream commit 22666ba1420164753d7b0f5a841986b25ace5435 ]
nv_remove() frees the per-CPU txrx_stats before unregister_netdev(). Until unregister completes, ndo_get_stats64, the NAPI/xmit data path, and nv_close()/drain may still access txrx_stats, leading to a use-after-free.
Free the stats only after unregister_netdev().
--- drivers/net/ethernet/nvidia/forcedeth.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/nvidia/forcedeth.c +2 -2
@@ -6187,10 +6187,10 @@ static void nv_remove(struct pci_dev *pci_dev)struct net_device *dev =pci_get_drvdata (pci_dev);struct fe_priv *np =netdev_priv (dev); -free_percpu (np->txrx_stats); -unregister_netdev (dev); +free_percpu (np->txrx_stats); +nv_restore_mac_addr (pci_dev);/* restore any phy related changes */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 102/438 hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Angelo Daros de Luca <[email protected]>
[ Upstream commit 625a2c02a1c04571232a746fe188b4d9a8d63edd ]
During adt7470_read_temperatures(), the driver temporarily switches the PWM channels to manual mode, performs the temperature collection, and then restores the original configuration registers.
However, if an I2C transaction fails at any point after entering manual mode, the function aborts and returns immediately. This leaves the configuration registers un-restored, permanently trapping the fans in manual mode.
Introduce a recovery path to ensure that the original PWM configuration registers are always restored, even when intermediate I2C operations fail.
--- drivers/hwmon/adt7470.c | 40 +++++++++++++++++++++++++++++----------- 1 file changed, 29 insertions(+), 11 deletions(-)
drivers/hwmon/adt7470.c +29 -11
@@ -205,11 +205,12 @@ static inline int adt7470_write_word_data(struct adt7470_data *data, unsigned in/* Probe for temperature sensors. Assumes lock is held */ static int adt7470_read_temperatures (struct adt7470_data *data) { -unsigned long res; +struct device *dev =regmap_get_device (data->regmap); +u8 pwm[ADT7470_FAN_COUNT ];unsigned int pwm_cfg[2 ]; -int err; +unsigned long res; +int err, err2;int i; -u8 pwm[ADT7470_FAN_COUNT ];/* save pwm[1-4] config register */ err =regmap_read (data->regmap,ADT7470_REG_PWM_CFG (0 ), &pwm_cfg[0 ]);
@@ -233,19 +234,19 @@ static int adt7470_read_temperatures(struct adt7470_data *data) err =regmap_update_bits (data->regmap,ADT7470_REG_PWM_CFG (2 ),ADT7470_PWM_AUTO_MASK ,0 );if (err <0 ) -return err; + goto out_restore;/* write pwm control to whatever it was */ err =regmap_bulk_write (data->regmap,ADT7470_REG_PWM (0 ), &pwm[0 ],ADT7470_PWM_COUNT );if (err <0 ) -return err; + goto out_restore;/* start reading temperature sensors */ err =regmap_update_bits (data->regmap,ADT7470_REG_CFG ,ADT7470_T05_STB_MASK ,ADT7470_T05_STB_MASK );if (err <0 ) -return err; + goto out_restore;/* Delay is 200ms * number of temp sensors. */ res = msleep_interruptible((data->num_temp_sensors >= 0 ?
@@ -256,13 +257,30 @@ static int adt7470_read_temperatures(struct adt7470_data *data) err =regmap_update_bits (data->regmap,ADT7470_REG_CFG ,ADT7470_T05_STB_MASK ,0 );if (err <0 ) -return err; + goto out_restore; +out_restore:/* restore pwm[1-4] config registers */ - err =regmap_write (data->regmap,ADT7470_REG_PWM_CFG (0 ), pwm_cfg[0 ]); -if (err <0 ) -return err; - err =regmap_write (data->regmap,ADT7470_REG_PWM_CFG (2 ), pwm_cfg[1 ]); + err2 =regmap_write (data->regmap,ADT7470_REG_PWM_CFG (0 ), pwm_cfg[0 ]); +if (err2 <0 ) { +dev_warn_ratelimited (dev, +"failed to restore PWM{1,2} config (%d)\n" , + err2); + +if (!err) + err = err2; + } + + err2 =regmap_write (data->regmap,ADT7470_REG_PWM_CFG (2 ), pwm_cfg[1 ]); +if (err2 <0 ) { +dev_warn_ratelimited (dev, +"failed to restore PWM{3,4} config (%d)\n" , + err2); + +if (!err) + err = err2; + } +if (err <0 )return err;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 103/438 hwmon: (adt7470) Fix cache updated before hardware write on I2C error
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Angelo Daros de Luca <[email protected]>
[ Upstream commit 05270bd38d9bf88a2f4c212246a8fa29f4032078 ]
adt7470_temp_write() and adt7470_pwm_write() update the driver's cached values (temp_min, temp_max, pwm_input, pwm_enable) before issuing the corresponding regmap_write(), and never check whether the write succeeded before committing that update. If the I2C transaction fails, the function correctly propagates the error to the caller, but the cache silently keeps the new value, which was never actually applied to the hardware. Subsequent reads then report a value that does not match the device state.
Reorder both write paths to update the cache only after a successful regmap_write(), so the cache always reflects what was actually written to the hardware.
--- drivers/hwmon/adt7470.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
drivers/hwmon/adt7470.c +9 -5
@@ -589,14 +589,16 @@ static int adt7470_temp_write(struct device *dev, u32 attr, int channel, long vaswitch (attr) {case hwmon_temp_min:mutex_lock (&data->lock); - data->temp_min[channel] = val; err =regmap_write (data->regmap,ADT7470_TEMP_MIN_REG (channel), val); +if (!err) + data->temp_min[channel] = val;mutex_unlock (&data->lock);break ;case hwmon_temp_max:mutex_lock (&data->lock); - data->temp_max[channel] = val; err =regmap_write (data->regmap,ADT7470_TEMP_MAX_REG (channel), val); +if (!err) + data->temp_max[channel] = val;mutex_unlock (&data->lock);break ;default :
@@ -831,9 +833,10 @@ static int adt7470_pwm_write(struct device *dev, u32 attr, int channel, long valcase hwmon_pwm_input: val =clamp_val (val,0 ,255 );mutex_lock (&data->lock); - data->pwm[channel] = val; err =regmap_write (data->regmap,ADT7470_REG_PWM (channel), - data->pwm[channel]); + val); +if (!err) + data->pwm[channel] = val;mutex_unlock (&data->lock);break ;case hwmon_pwm_enable:
@@ -847,10 +850,11 @@ static int adt7470_pwm_write(struct device *dev, u32 attr, int channel, long val val--;mutex_lock (&data->lock); - data->pwm_automatic[channel] = val; err =regmap_update_bits (data->regmap,ADT7470_REG_PWM_CFG (channel), pwm_auto_reg_mask, val ? pwm_auto_reg_mask :0 ); +if (!err) + data->pwm_automatic[channel] = val;mutex_unlock (&data->lock);break ;case hwmon_pwm_freq:
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 104/438 hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Angelo Daros de Luca <[email protected]>
[ Upstream commit cb0b7f9c43b0abbd422a7e4c2c85e91db429207c ]
When userspace configures 'auto_update_interval' to 0 via sysfs, the background kthread executes schedule_timeout_interruptible(0), which returns immediately.
If 'num_temp_sensors' is concurrently or previously set to 0, the msleep_interruptible() delay inside adt7470_read_temperatures() also becomes 0. This combination forces the background thread into a tight, unbounded busy-loop, hogging the CPU and flooding the I2C bus with a continuous stream of transactions.
Fix this vulnerability by raising the lower limit of the clamp_val in auto_update_interval_store() from 0 to 500 milliseconds. This guarantees a reasonable minimum sleep window between sensor updates, protecting the system from intentional or accidental I2C bus denial of service.
--- drivers/hwmon/adt7470.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/adt7470.c +1 -1
@@ -509,7 +509,7 @@ static ssize_t auto_update_interval_store(struct device *dev,if (kstrtol (buf,10 , &temp))return -EINVAL ; - temp =clamp_val (temp,0 ,60000 ); + temp =clamp_val (temp,500 ,60000 );mutex_lock (&data->lock); data->auto_update_interval = temp;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 105/438 hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read()
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Angelo Daros de Luca <[email protected]>
[ Upstream commit 1a18c79c4bc44cc5349c60e16b0b744dc6ec5f77 ]
During the conversion the alarm callback started interpreting the channel index as an alarm bitmask, resulting in incorrect alarm reporting. Compute the proper alarm bit instead.
--- drivers/hwmon/adt7470.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-)
drivers/hwmon/adt7470.c +17 -2
@@ -110,6 +110,21 @@ static const unsigned short normal_i2c[] = { 0x2C, 0x2E, 0x2F, I2C_CLIENT_END };#define ALARM2 (x) ((x) << 8) +/* TEMP1..TEMP7 (ch 0..6) are, respectively BIT(0)..BIT(6) of reg 0x41 and +* 0x72, or BIT(0)..BIT(6) of data->alarm. +* TEMP8..TEMP9 (ch 7..9) are, respectively BIT(0)..BIT(2) of reg 0x42 and +* 0x73, or BIT(8)..BIT(10) of data->alarm. +*/ +#define TEMP_ALARM_BIT (ch) ({ \ + typeof(ch) _ch = (ch); \ + (1 << (_ch < 7 ? _ch : _ch + 1)); \ +}) + +/* FAN1..FAN4 (ch 0..3) are respectively BIT(4)..BIT(7) in +* reg 0x42 and 0x73 or BIT(12)..BIT(15) in data->alarm. +*/ +#define FAN_ALARM_BIT (ch) (1 << (12 + (ch))) +#define ADT7470_VENDOR 0x41#define ADT7470_DEVICE 0x70/* datasheet only mentions a revision 2 */
@@ -569,7 +584,7 @@ static int adt7470_temp_read(struct device *dev, u32 attr, int channel, long *va *val =1000 * data->temp_max[channel];break ;case hwmon_temp_alarm: - *val = !!(data->alarm & channel); + *val = !!(data->alarm &TEMP_ALARM_BIT (channel));break ;default :return -EOPNOTSUPP ;
@@ -668,7 +683,7 @@ static int adt7470_fan_read(struct device *dev, u32 attr, int channel, long *val *val =0 ;break ;case hwmon_fan_alarm: - *val = !!(data->alarm & (1 << (12 + channel))); + *val = !!(data->alarm &FAN_ALARM_BIT (channel));break ;default :return -EOPNOTSUPP ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 106/438 hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Angelo Daros de Luca <[email protected]>
[ Upstream commit a3850231521b06bbbb18c8ebea100320c14a08be ]
The ADT7470_PWM3_AUTO_MASK and ADT7470_PWM4_AUTO_MASK macros are currently defined with swapped bit values.
According to Table 22 of the ADT7470 datasheet, the Fan Control Mode Configuration for register 0x69 follows the exact same bit position layout as register 0x68:
- 0x68 Bit[7] corresponds to BHVR1 (PWM1) -> 0x80
- 0x68 Bit[6] corresponds to BHVR2 (PWM2) -> 0x40
- 0x69 Bit[7] corresponds to BHVR3 (PWM3) -> 0x80
- 0x69 Bit[6] corresponds to BHVR4 (PWM4) -> 0x40
Consequently, PWM3 should use mask 0x80 and PWM4 should use 0x40.
This typo did not cause any functional bugs because these specific macros are never referenced in the driver code. Instead, the driver correctly applies the configuration by relying on the modulo parity of the channel index (e.g., channel % 2) to selectively apply either ADT7470_PWM1_AUTO_MASK (0x80) or ADT7470_PWM2_AUTO_MASK (0x40). Since the bit layout is identical between the two configuration registers, the hardware is currently configured correctly.
Fix the macro definitions to reflect the datasheet accurately and prevent future bugs or confusion during code review and refactoring. As this is a purely cosmetic fix with no functional impact, a backport to stable kernels is not necessary.
--- drivers/hwmon/adt7470.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/hwmon/adt7470.c +2 -2
@@ -70,8 +70,8 @@ static const unsigned short normal_i2c[] = { 0x2C, 0x2E, 0x2F, I2C_CLIENT_END };#define ADT7470_PWM1_AUTO_MASK 0x80#define ADT7470_PWM_AUTO_MASK 0xC0#define ADT7470_REG_PWM34_CFG 0x69 -#define ADT7470_PWM3_AUTO_MASK 0x40 -#define ADT7470_PWM4_AUTO_MASK 0x80 +#define ADT7470_PWM4_AUTO_MASK 0x40 +#define ADT7470_PWM3_AUTO_MASK 0x80#define ADT7470_REG_PWM_MIN_BASE_ADDR 0x6A#define ADT7470_REG_PWM_MIN_MAX_ADDR 0x6D#define ADT7470_REG_PWM_TEMP_MIN_BASE_ADDR 0x6E
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 107/438 hwmon: (adt7470) Use cached PWM frequency value
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Angelo Daros de Luca <[email protected]>
[ Upstream commit 60677cd4c28f44d5b307d3029dccece38fcce90f ]
adt7470_pwm_read() currently ignores failures returned by pwm1_freq_get(). If the register read fails, the negative error code is returned through *val while the function itself reports success, potentially exposing a negative PWM frequency through sysfs.
Fix this by using the cached PWM frequency maintained by the driver, eliminating the register access from the read path.
Apart from the corrected error propagation and using the cached value, no functional change is intended.
--- drivers/hwmon/adt7470.c | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-)
drivers/hwmon/adt7470.c +18 -2
@@ -182,6 +182,7 @@ struct adt7470_data {u8 pwm_min[ADT7470_PWM_COUNT ];s8 pwm_tmin[ADT7470_PWM_COUNT ];u8 pwm_auto_temp[ADT7470_PWM_COUNT ]; +u32 pwm_freq;struct task_struct *auto_update;unsigned int auto_update_interval;
@@ -756,7 +757,7 @@ static ssize_t force_pwm_max_store(struct device *dev, }/* These are the valid PWM frequencies to the nearest Hz */ -static const int adt7470_freq_map[] = { +static const u32 adt7470_freq_map[] = {11 ,15 ,22 ,29 ,35 ,44 ,59 ,88 ,1400 ,22500 };
@@ -796,7 +797,7 @@ static int adt7470_pwm_read(struct device *dev, u32 attr, int channel, long *val *val =1 + data->pwm_automatic[channel];break ;case hwmon_pwm_freq: - *val =pwm1_freq_get (dev); + *val = data->pwm_freq;break ;default :return -EOPNOTSUPP ;
@@ -809,12 +810,14 @@ static int pwm1_freq_set(struct device *dev, long freq) {struct adt7470_data *data =dev_get_drvdata (dev);unsigned int low_freq =ADT7470_CFG_LF ; +u32 closest_freq;int index;int err;/* Round the user value given to the closest available frequency */ index =find_closest (freq, adt7470_freq_map,ARRAY_SIZE (adt7470_freq_map)); + closest_freq = adt7470_freq_map[index];if (index >=8 ) { index -=8 ;
@@ -832,6 +835,10 @@ static int pwm1_freq_set(struct device *dev, long freq) err =regmap_update_bits (data->regmap,ADT7470_REG_CFG_2 ,ADT7470_FREQ_MASK , index <<ADT7470_FREQ_SHIFT ); +if (err <0 ) + goto out; + + data->pwm_freq = closest_freq; out:mutex_unlock (&data->lock);
@@ -1285,6 +1292,7 @@ static int adt7470_probe(struct i2c_client *client)struct device *dev = &client->dev;struct adt7470_data *data;struct device *hwmon_dev; +int freq_val;int err; data =devm_kzalloc (dev,sizeof (struct adt7470_data ),GFP_KERNEL );
@@ -1309,6 +1317,14 @@ static int adt7470_probe(struct i2c_client *client)if (err <0 )return err; + freq_val =pwm1_freq_get (dev); +if (freq_val <=0 ) { + err = freq_val <0 ? freq_val : -EINVAL ; +return err; + } + + data->pwm_freq = (u32 )freq_val; +/* Register sysfs hooks */ hwmon_dev = devm_hwmon_device_register_with_info(dev, client->name, data, &adt7470_chip_info,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 108/438 hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Angelo Daros de Luca <[email protected]>
[ Upstream commit 1b46fe9dc8f8de59310f37e6c5e5c0e05ded46c3 ]
If the fan data becomes 0 between the FAN_DATA_VALID() check and the FAN_PERIOD_TO_RPM() conversion, it will result in a divide-by-zero crash due to a race with a concurrent update of the cached fan value.
Fix a TOCTOU issue by reading fan data once.
--- drivers/hwmon/adt7470.c | 23 ++++++++++------------- 1 file changed, 10 insertions(+), 13 deletions(-)
drivers/hwmon/adt7470.c +10 -13
@@ -660,36 +660,33 @@ static ssize_t alarm_mask_store(struct device *dev,static int adt7470_fan_read (struct device *dev,u32 attr,int channel,long *val) {struct adt7470_data *data =adt7470_update_device (dev); +u16 fan_data;if (IS_ERR (data))return PTR_ERR (data);switch (attr) {case hwmon_fan_input: -if (FAN_DATA_VALID (data->fan[channel])) - *val =FAN_PERIOD_TO_RPM (data->fan[channel]); -else - *val =0 ; + fan_data =READ_ONCE (data->fan[channel]);break ;case hwmon_fan_min: -if (FAN_DATA_VALID (data->fan_min[channel])) - *val =FAN_PERIOD_TO_RPM (data->fan_min[channel]); -else - *val =0 ; + fan_data =READ_ONCE (data->fan_min[channel]);break ;case hwmon_fan_max: -if (FAN_DATA_VALID (data->fan_max[channel])) - *val =FAN_PERIOD_TO_RPM (data->fan_max[channel]); -else - *val =0 ; + fan_data =READ_ONCE (data->fan_max[channel]);break ;case hwmon_fan_alarm: *val = !!(data->alarm &FAN_ALARM_BIT (channel)); -break ; +return 0 ;default :return -EOPNOTSUPP ; } +if (FAN_DATA_VALID (fan_data)) + *val =FAN_PERIOD_TO_RPM (fan_data); +else + *val =0 ; +return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 109/438 hwmon: (adt7470) Fix PWM auto temp state array and bounds check
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Angelo Daros de Luca <[email protected]>
[ Upstream commit 92413f439d1ec5e55b73ede8d66a7b971cbd1ced ]
In pwm_auto_temp_store(), the parsed user input was missing bounds checks, allowing values > 0xF to overflow into the adjacent channel's bits. Furthermore, the value was being incorrectly written to the pwm_automatic state array instead of pwm_auto_temp.
Fix this by rejecting values > 0xF with -EINVAL, and assigning the value to the correct array only after a successful I2C write.
--- drivers/hwmon/adt7470.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/hwmon/adt7470.c +6 -1
@@ -1049,8 +1049,10 @@ static ssize_t pwm_auto_temp_store(struct device *dev,if (temp <0 )return temp; +if (temp >0xF ) +return -EINVAL ; +mutex_lock (&data->lock); - data->pwm_automatic[attr->index] = temp;if (!(attr->index %2 )) { mask =0xF0 ;
@@ -1061,6 +1063,9 @@ static ssize_t pwm_auto_temp_store(struct device *dev, } err =regmap_update_bits (data->regmap, pwm_auto_reg, mask, val); +if (!err) + data->pwm_auto_temp[attr->index] = temp; +mutex_unlock (&data->lock);return err <0 ? err : count;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 110/438 rtase: fix double free of multi-frag skb on DMA map failure
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yun Lu <[email protected]>
[ Upstream commit 6fb7b769d6ed6d1d2e02af4a80e57a2477f35086 ]
In rtase_start_xmit(), when the head buffer DMA mapping fails after rtase_xmit_frags() has mapped all fragments, the error path clears the fragment descriptors with rtase_tx_clear_range(), which frees the skb through the last-frag slot and accounts tx_dropped. Control then falls through to the common error label, which frees the same skb a second time and counts it again.
Return right after clearing the fragments when the skb owns frags; the no-frag case still drops through and frees the head skb once.
--- drivers/net/ethernet/realtek/rtase/rtase_main.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/realtek/rtase/rtase_main.c +3 -0
@@ -1620,6 +1620,9 @@ static netdev_tx_t rtase_start_xmit(struct sk_buff *skb, err_dma_1: ring->skbuff[entry] =NULL ;rtase_tx_clear_range (ring, ring->cur_idx +1 , frags); +if (frags) +/* the frags were cleared above, along with the skb */ +return NETDEV_TX_OK ; err_dma_0: tp->stats.tx_dropped++;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 111/438 ethtool: Embed FEC hist ranges as buffer in struct
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Joyner <[email protected]>
[ Upstream commit 97ac08560d236ca17f6606d9e671118e5eae5721 ]
When a driver's .get_fec_stats() handler is called and the driver supports FEC histogram stats, the driver supplies the histogram bin ranges via a pointer. This pointer is assigned while under the netdev ops lock in fec_prepare_data(), but the actual data is only read after the lock is released; so this allows the driver to change the ranges (e.g. from another .get_fec_stats() call) while the current call chain is reading them in fec_fill_reply().
Fix this by adding an ethtool core-owned buffer, ranges_buf, to struct ethtool_fec_hist. Drivers whose ranges are built dynamically (currently just mlx5) fill ranges_buf and then point the existing ranges pointer at it, giving ethtool a consistent copy that stays valid after the netdev ops lock is dropped and later in fec_fill_reply(). Drivers whose ranges are compile-time constants (bnxt, netdevsim) are unaffected by the potential race and keep setting the existing ranges pointer to their constant array, without making copies.
--- drivers/net/ethernet/mellanox/mlx5/core/en.h | 1 - .../net/ethernet/mellanox/mlx5/core/en_main.c | 7 ------- .../ethernet/mellanox/mlx5/core/en_stats.c | 19 +++++++++---------- include/linux/ethtool.h | 1 + 4 files changed, 10 insertions(+), 18 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en.h +0 -1
@@ -984,7 +984,6 @@ struct mlx5e_priv {struct mlx5e_mqprio_rl *mqprio_rl;struct dentry *dfs_root;struct mlx5_devcom_comp_dev *devcom; -struct ethtool_fec_hist_range *fec_ranges; };static inline u16 mlx5e_stats_nch_read (const struct mlx5e_priv *priv)
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +0 -7
@@ -6374,14 +6374,8 @@ int mlx5e_priv_init(struct mlx5e_priv *priv,if (!priv->channel_stats) goto err_free_tx_rates; - priv->fec_ranges =kzalloc_objs (*priv->fec_ranges,ETHTOOL_FEC_HIST_MAX ); -if (!priv->fec_ranges) - goto err_free_channel_stats; -return 0 ; -err_free_channel_stats: -kfree (priv->channel_stats); err_free_tx_rates:kfree (priv->tx_rates); err_free_txq2sq_stats:
@@ -6406,7 +6400,6 @@ void mlx5e_priv_cleanup(struct mlx5e_priv *priv)if (!priv->mdev)return ; -kfree (priv->fec_ranges);for (i =0 ; i < priv->stats_nch; i++)kvfree (priv->channel_stats[i]);kfree (priv->channel_stats);
drivers/net/ethernet/mellanox/mlx5/core/en_stats.c +9 -10
@@ -1551,7 +1551,7 @@ static bool fec_rs_validate_hist_type(int mode, int hist_type)static u8 fec_rs_histogram_fill_ranges (struct mlx5e_priv *priv,int mode, -const struct ethtool_fec_hist_range **ranges) +struct ethtool_fec_hist_range *ranges) {struct mlx5_core_dev *mdev = priv->mdev;u32 out[MLX5_ST_SZ_DW (pphcr_reg)] = {0 };
@@ -1559,8 +1559,6 @@ fec_rs_histogram_fill_ranges(struct mlx5e_priv *priv, int mode,int sz =MLX5_ST_SZ_BYTES (pphcr_reg);u8 hist_type, num_of_bins; -memset (priv->fec_ranges,0 , -ETHTOOL_FEC_HIST_MAX *sizeof (*priv->fec_ranges));MLX5_SET (pphcr_reg, in, local_port,1 );if (mlx5_core_access_reg (mdev, in, sz, out, sz,MLX5_REG_PPHCR ,0 ,0 ))return 0 ;
@@ -1576,12 +1574,11 @@ fec_rs_histogram_fill_ranges(struct mlx5e_priv *priv, int mode,for (int i =0 ; i < num_of_bins; i++) {void *bin_range =MLX5_ADDR_OF (pphcr_reg, out, bin_range[i]); - priv->fec_ranges[i].high =MLX5_GET (bin_range_layout, bin_range, - high_val); - priv->fec_ranges[i].low =MLX5_GET (bin_range_layout, bin_range, - low_val); + ranges[i].high =MLX5_GET (bin_range_layout, bin_range, + high_val); + ranges[i].low =MLX5_GET (bin_range_layout, bin_range, + low_val); } - *ranges = priv->fec_ranges;return num_of_bins; }
@@ -1623,10 +1620,12 @@ static void fec_set_histograms_stats(struct mlx5e_priv *priv, int mode,case MLX5E_FEC_LLRS_272_257_1 :case MLX5E_FEC_RS_544_514_INTERLEAVED_QUAD : num_of_bins = -fec_rs_histogram_fill_ranges (priv, mode, &hist->ranges); -if (num_of_bins) +fec_rs_histogram_fill_ranges (priv, mode, hist->ranges_buf); +if (num_of_bins) { + hist->ranges = hist->ranges_buf;return fec_rs_histogram_fill_stats (priv, num_of_bins, hist); + }break ;default :return ;
include/linux/ethtool.h +1 -0
@@ -560,6 +560,7 @@ struct ethtool_fec_hist {u64 per_lane[ETHTOOL_MAX_LANES ]; } values[ETHTOOL_FEC_HIST_MAX ];const struct ethtool_fec_hist_range *ranges; +struct ethtool_fec_hist_range ranges_buf[ETHTOOL_FEC_HIST_MAX ]; };/** * struct ethtool_fec_stats - statistics for IEEE 802.3 FEC
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 112/438 powerpc/boot: Fix simpleboot CPU node lookup check
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <[email protected]>
[ Upstream commit c824ab65685bb119c6c6a3a200b3428c72862d5a ]
fdt_node_offset_by_prop_value() returns a negative error code on failure - fix the check accordingly.
--- arch/powerpc/boot/simpleboot.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/boot/simpleboot.c +1 -1
@@ -68,7 +68,7 @@ void platform_init(unsigned long r3, unsigned long r4, unsigned long r5,/* finally, setup the timebase */ node =fdt_node_offset_by_prop_value (_dtb_start,-1 ,"device_type" ,"cpu" ,sizeof ("cpu" )); -if (!node) +if (node <0 )fatal ("Cannot find cpu node\n" ); timebase =fdt_getprop (_dtb_start, node,"timebase-frequency" , &size);if (timebase && (size ==4 ))
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 113/438 powerpc/boot: Fix treeboot-currituck CPU node lookup check
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <[email protected]>
[ Upstream commit 43863f6575d2211e8c5157fefb83ad0ad046aab4 ]
fdt_node_offset_by_prop_value() returns a negative error code on failure - fix the check accordingly.
--- arch/powerpc/boot/treeboot-currituck.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/boot/treeboot-currituck.c +1 -1
@@ -102,7 +102,7 @@ void platform_init(void) node =fdt_node_offset_by_prop_value (_dtb_start,-1 ,"device_type" ,"cpu" ,sizeof ("cpu" )); -if (!node) +if (node <0 )fatal ("Cannot find cpu node\n" ); timebase =fdt_getprop (_dtb_start, node,"timebase-frequency" , &size);if (timebase && (size ==4 ))
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 114/438 powerpc/boot: Fix treeboot-akebono CPU node lookup check
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <[email protected]>
[ Upstream commit b24fc8278b70a9d27ec801a427ab4de9b769d69a ]
fdt_node_offset_by_prop_value() returns a negative error code on failure - fix the check accordingly.
--- arch/powerpc/boot/treeboot-akebono.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/boot/treeboot-akebono.c +1 -1
@@ -146,7 +146,7 @@ void platform_init(char *userdata) node =fdt_node_offset_by_prop_value (_dtb_start,-1 ,"device_type" ,"cpu" ,sizeof ("cpu" )); -if (!node) +if (node <0 )fatal ("Cannot find cpu node\n" ); timebase =fdt_getprop (_dtb_start, node,"timebase-frequency" , &size);if (timebase && (size ==4 ))
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 115/438 net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang (Microsoft) <[email protected]>
[ Upstream commit aef96eead2860cbfa371e4471d4f04412213b958 ]
u32_change() copies the user-provided tc_u32_sel.offshift (unsigned char, 0-255) into the kernel knode object without bounds validation. When a packet later hits u32_classify() with TC_U32_VAROFFSET set, it evaluates ntohs(offmask & *data) >> offshift where the left operand is a 16-bit value promoted to a 32-bit int. Any offshift >= 32 is undefined behavior per C11 6.5.7p3, triggerable by an unprivileged user via user/network namespaces.
UBSAN: shift-out-of-bounds in net/sched/cls_u32.c:236:43
shift exponent 32 is too large for 32-bit type int
Fix this by rejecting offshift >= 16 during filter creation in u32_change().
--- net/sched/cls_u32.c | 7 +++++++ 1 file changed, 7 insertions(+)
net/sched/cls_u32.c +7 -0
@@ -1107,6 +1107,13 @@ static int u32_change(struct net *net, struct sk_buff *in_skb, goto erridr; } +if (s->offshift >=16 ) { +NL_SET_ERR_MSG_MOD (extack, +"offshift must be less than 16" ); + err = -EINVAL ; + goto erridr; + } + n =kzalloc_flex (*n, sel.keys, s->nkeys);if (n ==NULL ) { err = -ENOBUFS ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 116/438 net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 080695e6f005e2396f1207fd69d24c442cb230c6 ]
syzbot reported a memory leak [1] in the UDP tunnel NIC offload code.
When device registration fails (e.g. in register_netdevice()), netdev core unwinds by sending a single NETDEV_UNREGISTER notification. If work was queued during NETDEV_REGISTER (utn->work_pending is set), udp_tunnel_nic_unregister() returns early:
if (utn->work_pending) return;
Because failed registrations do not enter netdev_wait_allrefs_any(), no subsequent NETDEV_UNREGISTER rebroadcast will ever occur. As a result, the struct udp_tunnel_nic allocated in udp_tunnel_nic_alloc() is leaked permanently.
Fix this by removing the early return. Instead, synchronously cancel any pending work with cancel_delayed_work_sync() before freeing @utn.
To be able to call cancel_delayed_work_sync() while holding RTNL (the work also needs RTNL), switch udp_tunnel_nic_device_sync_work() to rtnl_trylock(). If RTNL is contended, requeue the work with a 1 jiffy delay (via queue_delayed_work()) to prevent high CPU contention while waiting for RTNL lock.
The utn->work_pending bookkeeping is no longer needed and is removed, as the workqueue core already tracks the pending/running state of the work.
[1]
BUG: memory leak
unreferenced object 0xffff888127d5f840 (size 96):
comm "syz-executor", pid 5806, jiffies 4294942188
backtrace (crc 99fdb6c8):
__kmalloc_noprof+0x3bf/0x550
udp_tunnel_nic_alloc net/ipv4/udp_tunnel_nic.c:756 [inline]
udp_tunnel_nic_register net/ipv4/udp_tunnel_nic.c:833 [inline]
udp_tunnel_nic_netdevice_event+0x804/0xab0 net/ipv4/udp_tunnel_nic.c:931
notifier_call_chain+0x59/0x160 kernel/notifier.c:85
call_netdevice_notifiers_info+0x7d/0xb0 net/core/dev.c:2250
register_netdevice+0xc10/0xeb0 net/core/dev.c:11478--- net/ipv4/udp_tunnel_nic.c | 32 +++++++++++++++++--------------- 1 file changed, 17 insertions(+), 15 deletions(-)
net/ipv4/udp_tunnel_nic.c +17 -15
@@ -32,13 +32,12 @@ struct udp_tunnel_nic_table_entry {* @lock: protects all fields * @need_sync: at least one port start changed * @need_replay: space was freed, we need a replay of all ports -* @work_pending: @work is currently scheduled * @n_tables: number of tables under @entries * @missed: bitmap of tables which overflown * @entries: table of tables of ports currently offloaded */ struct udp_tunnel_nic { -struct work_struct work; +struct delayed_work work;struct net_device *dev;
@@ -46,7 +45,6 @@ struct udp_tunnel_nic { u8 need_sync:1; u8 need_replay:1; - u8 work_pending:1;unsigned int n_tables;unsigned long missed;
@@ -301,11 +299,10 @@ __udp_tunnel_nic_device_sync(struct net_device *dev, struct udp_tunnel_nic *utn)static void udp_tunnel_nic_device_sync (struct net_device *dev,struct udp_tunnel_nic *utn) { -if (!utn->need_sync || utn->work_pending) +if (!utn->need_sync)return ; -queue_work (udp_tunnel_nic_workqueue, &utn->work); - utn->work_pending =1 ; +queue_delayed_work (udp_tunnel_nic_workqueue, &utn->work,0 ); } static bool
@@ -731,12 +728,17 @@ udp_tunnel_nic_replay(struct net_device *dev, struct udp_tunnel_nic *utn)static void udp_tunnel_nic_device_sync_work (struct work_struct *work) {struct udp_tunnel_nic *utn = - container_of(work, struct udp_tunnel_nic, work); + container_of(work, struct udp_tunnel_nic, work.work); -rtnl_lock (); +/* We cannot block on RTNL here, otherwise we would deadlock with +* udp_tunnel_nic_unregister() calling cancel_delayed_work_sync() +* while holding RTNL. Requeue with 1 jiffy delay if RTNL is contended. +*/ +if (!rtnl_trylock ()) { +queue_delayed_work (udp_tunnel_nic_workqueue, &utn->work,1 ); +return ; + }mutex_lock (&utn->lock); - - utn->work_pending =0 ;__udp_tunnel_nic_device_sync (utn->dev, utn);if (utn->need_replay)
@@ -757,7 +759,7 @@ udp_tunnel_nic_alloc(const struct udp_tunnel_nic_info *info,if (!utn)return NULL ; utn->n_tables = n_tables; -INIT_WORK (&utn->work, udp_tunnel_nic_device_sync_work); +INIT_DELAYED_WORK (&utn->work, udp_tunnel_nic_device_sync_work);mutex_init (&utn->lock);for (i =0 ; i < n_tables; i++) {
@@ -901,11 +903,11 @@ udp_tunnel_nic_unregister(struct net_device *dev, struct udp_tunnel_nic *utn)udp_tunnel_nic_flush (dev, utn);udp_tunnel_nic_unlock (dev); -/* Wait for the work to be done using the state, netdev core will -* retry unregister until we give up our reference on this device. +/* Make sure no work is running or queued before freeing @utn. +* The work handler uses rtnl_trylock(), so it will not deadlock +* against the RTNL we are holding here. */ -if (utn->work_pending) -return ; +cancel_delayed_work_sync (&utn->work);udp_tunnel_nic_free (utn); release_dev:
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 117/438 wifi: mac80211: validate individual TWT params before driver setup
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Li <[email protected]>
[ Upstream commit 0502d5077e419427d80f4d46ba95d0067f5fb916 ]
ieee80211_process_rx_twt_action() only partially validates a received S1G TWT setup frame before queueing it.
An individual agreement can therefore reach ieee80211_s1g_rx_twt_setup() with twt->length too short for the full struct ieee80211_twt_params.
The individual path passes twt to drv_add_twt_setup(). Both the tracepoint and the driver callback consume the complete parameters block, not merely req_type. Do not pass a short individual agreement to the driver. Broadcast agreements remain unchanged because they are rejected locally after accessing only req_type.
[edit commit message to not overclaim lack of validation nor
understate driver impact]
--- net/mac80211/s1g.c | 4 ++++ 1 file changed, 4 insertions(+)
net/mac80211/s1g.c +4 -0
@@ -101,6 +101,10 @@ ieee80211_s1g_rx_twt_setup(struct ieee80211_sub_if_data *sdata,struct ieee80211_twt_setup *twt = (void *)mgmt->u.action.s1g.variable;struct ieee80211_twt_params *twt_agrt = (void *)twt->params; +if (!(twt->control &IEEE80211_TWT_CONTROL_NEG_TYPE_BROADCAST ) && + twt->length <sizeof (twt->control) +sizeof (*twt_agrt)) +return ; + twt_agrt->req_type &=cpu_to_le16 (~IEEE80211_TWT_REQTYPE_REQUEST );/* broadcast TWT not supported yet */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 118/438 netfs: clear PG_private_2 on copy-to-cache append failure
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yichong Chen <[email protected]>
[ Upstream commit a81fc9266e1c5fef9ccf675a9b44b2f4ab464923 ]
netfs_pgpriv2_copy_to_cache() marks the folio with PG_private_2 before netfs_pgpriv2_copy_folio() appends it to the copy-to-cache rolling buffer.
If the append fails, the folio is not queued for cache writeback, so the PG_private_2 state and its reference must be released immediately.
--- fs/netfs/read_pgpriv2.c | 1 + 1 file changed, 1 insertion(+)
fs/netfs/read_pgpriv2.c +1 -0
@@ -54,6 +54,7 @@ static void netfs_pgpriv2_copy_folio(struct netfs_io_request *creq, struct folio/* Attach the folio to the rolling buffer. */ if (rolling_buffer_append (&creq->buffer, folio,0 ) <0 ) { +folio_end_private_2 (folio);clear_bit (NETFS_RREQ_FOLIO_COPY_TO_CACHE , &creq->flags);return ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 119/438 netfs: handle single writeback rolling buffer allocation failure
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yichong Chen <[email protected]>
[ Upstream commit 37a1c535c80c67d98668d190c7432f9ebda43310 ]
netfs_write_folio_single() takes an extra folio reference before appending the folio to the rolling buffer.
rolling_buffer_append() can fail if it cannot allocate another folio_queue. Check the return value and drop the extra folio reference before returning the error.
--- fs/netfs/write_issue.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
fs/netfs/write_issue.c +6 -1
@@ -731,6 +731,7 @@ static int netfs_write_folio_single(struct netfs_io_request *wreq,size_t iter_off =0 ;size_t fsize =folio_size (folio), flen;loff_t fpos =folio_pos (folio); +ssize_t ret;bool to_eof = false;bool no_debug = false;
@@ -759,7 +760,11 @@ static int netfs_write_folio_single(struct netfs_io_request *wreq,/* Attach the folio to the rolling buffer. */ folio_get (folio); -rolling_buffer_append (&wreq->buffer, folio,NETFS_ROLLBUF_PUT_MARK ); + ret =rolling_buffer_append (&wreq->buffer, folio,NETFS_ROLLBUF_PUT_MARK ); +if (ret <0 ) { +folio_put (folio); +return ret; + }/* Move the submission point forward to allow for write-streaming data * not starting at the front of the page. We don't do write-streaming
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 120/438 netfs: release readahead folios on iterator preparation failure
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yichong Chen <[email protected]>
[ Upstream commit 87eb3d272dcbcbbfe5c1576c10e5dc72810cf1f6 ]
netfs_prepare_read_iterator() batches readahead folios in put_batch so that the folio references can be dropped after the I/O iterator has been prepared.
If rolling_buffer_load_from_ra() fails after earlier folios have been batched, the function returns immediately and leaves those references held. Release the batch before returning the error.
--- fs/netfs/buffered_read.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/netfs/buffered_read.c +3 -1
@@ -102,8 +102,10 @@ static ssize_t netfs_prepare_read_iterator(struct netfs_io_subrequest *subreq, added =rolling_buffer_load_from_ra (&rreq->buffer, ractl, &put_batch); -if (added <0 ) +if (added <0 ) { +folio_batch_release (&put_batch);return added; + } rreq->submitted += added; }folio_batch_release (&put_batch);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 121/438 netfs: Fix folio_queue ENOMEM in writeback by adding a mempool
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit 1d78d56c43ef3768183e8370e7367b162700e049 ]
Fix the handling of folio_queue allocation failure in writeback by adding a mempool and passing in gfp_t flags to the rolling buffer functions that allocate memory, using the mempool if gfp != GFP_KERNEL.
This is then extended upwards and the gfp to be used for a request is stored in the netfs_io_request struct and is then used for both requests and subrequests, eliminating the sleeping loops there.
The failure caused:
folio != NULL
WARNING: fs/netfs/write_issue.c:603 at netfs_writepages+0x883/0xa10 fs/netfs/write_issue.c:603, CPU#3: syz.0.17/5919--- fs/netfs/buffered_read.c | 6 +++--- fs/netfs/internal.h | 1 + fs/netfs/main.c | 7 +++++++ fs/netfs/objects.c | 30 +++++++++++++++++------------- fs/netfs/read_pgpriv2.c | 2 +- fs/netfs/rolling_buffer.c | 22 +++++++++++++--------- fs/netfs/write_issue.c | 10 +++++----- include/linux/netfs.h | 1 + include/linux/rolling_buffer.h | 6 +++--- 9 files changed, 51 insertions(+), 34 deletions(-)
fs/netfs/buffered_read.c +3 -3
@@ -361,7 +361,7 @@ void netfs_readahead(struct readahead_control *ractl)netfs_rreq_expand (rreq, ractl); rreq->submitted = rreq->start; -if (rolling_buffer_init (&rreq->buffer, rreq->debug_id,ITER_DEST ) <0 ) +if (rolling_buffer_init (&rreq->buffer, rreq->debug_id,ITER_DEST , rreq->gfp) <0 ) goto cleanup_free;netfs_read_to_pagecache (rreq, ractl);
@@ -380,10 +380,10 @@ static int netfs_create_singular_buffer(struct netfs_io_request *rreq, struct fo {ssize_t added; -if (rolling_buffer_init (&rreq->buffer, rreq->debug_id,ITER_DEST ) <0 ) +if (rolling_buffer_init (&rreq->buffer, rreq->debug_id,ITER_DEST , rreq->gfp) <0 )return -ENOMEM ; - added =rolling_buffer_append (&rreq->buffer, folio, rollbuf_flags); + added =rolling_buffer_append (&rreq->buffer, folio, rollbuf_flags, rreq->gfp);if (added <0 )return added; rreq->submitted = rreq->start + added;
fs/netfs/internal.h +1 -0
@@ -43,6 +43,7 @@ extern struct list_head netfs_io_requests;extern spinlock_t netfs_proc_lock;extern mempool_t netfs_request_pool;extern mempool_t netfs_subrequest_pool; +extern mempool_t netfs_folioq_pool;#ifdef CONFIG_PROC_FS static inline void netfs_proc_add_rreq (struct netfs_io_request *rreq)
fs/netfs/main.c +7 -0
@@ -28,6 +28,7 @@ static struct kmem_cache *netfs_request_slab;static struct kmem_cache *netfs_subrequest_slab;mempool_t netfs_request_pool;mempool_t netfs_subrequest_pool; +mempool_t netfs_folioq_pool;#ifdef CONFIG_PROC_FS LIST_HEAD (netfs_io_requests);
@@ -108,6 +109,9 @@ static int __init netfs_init(void) {int ret = -ENOMEM ; +if (mempool_init_kmalloc_pool (&netfs_folioq_pool,100 ,sizeof (struct folio_queue )) <0 ) + goto error_folioq_pool; + netfs_request_slab = kmem_cache_create("netfs_request", sizeof(struct netfs_io_request), 0, SLAB_HWCACHE_ALIGN | SLAB_ACCOUNT,
@@ -160,6 +164,8 @@ static int __init netfs_init(void) error_reqpool:kmem_cache_destroy (netfs_request_slab); error_req: +mempool_exit (&netfs_folioq_pool); +error_folioq_pool:return ret; }fs_initcall (netfs_init);
@@ -172,5 +178,6 @@ static void __exit netfs_exit(void)kmem_cache_destroy (netfs_subrequest_slab);mempool_exit (&netfs_request_pool);kmem_cache_destroy (netfs_request_slab); +mempool_exit (&netfs_folioq_pool); }module_exit (netfs_exit);
fs/netfs/objects.c +17 -13
@@ -7,7 +7,6 @@#include <linux/slab.h> #include <linux/mempool.h> -#include <linux/delay.h> #include "internal.h" static void netfs_free_request (struct work_struct *work);
@@ -26,17 +25,23 @@ struct netfs_io_request *netfs_alloc_request(struct address_space *mapping,struct netfs_io_request *rreq;mempool_t *mempool = ctx->ops->request_pool ?: &netfs_request_pool;struct kmem_cache *cache = mempool->pool_data; +gfp_t gfp =GFP_KERNEL ;int ret; -for (;;) { - rreq =mempool_alloc (mempool,GFP_KERNEL ); -if (rreq) -break ; -msleep (10 ); +/* Writeback is part of memory reclaim and must not fail due to ENOMEM. */ +if (origin ==NETFS_WRITEBACK || origin ==NETFS_WRITEBACK_SINGLE ) { + gfp =GFP_NOFS ;/* Allows use of mempools. */ + + rreq =mempool_alloc (mempool, gfp); + }else { + rreq = mempool->alloc (gfp, mempool->pool_data); +if (!rreq) +return ERR_PTR (-ENOMEM ); }memset (rreq,0 ,kmem_cache_size (cache));INIT_WORK (&rreq->cleanup_work, netfs_free_request); + rreq->gfp = gfp; rreq->start = start; rreq->len = len; rreq->origin = origin;
@@ -200,13 +205,12 @@ struct netfs_io_subrequest *netfs_alloc_subrequest(struct netfs_io_request *rreqmempool_t *mempool = rreq->netfs_ops->subrequest_pool ?: &netfs_subrequest_pool;struct kmem_cache *cache = mempool->pool_data; -for (;;) { - subreq =mempool_alloc (rreq->netfs_ops->subrequest_pool ?: &netfs_subrequest_pool, -GFP_KERNEL ); -if (subreq) -break ; -msleep (10 ); - } +if (rreq->gfp ==GFP_KERNEL ) + subreq = mempool->alloc (rreq->gfp, mempool->pool_data); +else + subreq =mempool_alloc (mempool, rreq->gfp); +if (!subreq) +return NULL ;memset (subreq,0 ,kmem_cache_size (cache));INIT_WORK (&subreq->work,NULL );
fs/netfs/read_pgpriv2.c +1 -1
@@ -53,7 +53,7 @@ static void netfs_pgpriv2_copy_folio(struct netfs_io_request *creq, struct foliotrace_netfs_folio (folio, netfs_folio_trace_store_copy);/* Attach the folio to the rolling buffer. */ -if (rolling_buffer_append (&creq->buffer, folio,0 ) <0 ) { +if (rolling_buffer_append (&creq->buffer, folio,0 , creq->gfp) <0 ) {folio_end_private_2 (folio);clear_bit (NETFS_RREQ_FOLIO_COPY_TO_CACHE , &creq->flags);return ;
fs/netfs/rolling_buffer.c +13 -9
@@ -6,6 +6,7 @@*/ #include <linux/bitops.h> +#include <linux/mempool.h> #include <linux/pagemap.h> #include <linux/rolling_buffer.h> #include <linux/slab.h>
@@ -27,7 +28,10 @@ struct folio_queue *netfs_folioq_alloc(unsigned int rreq_id, gfp_t gfp, {struct folio_queue *fq; - fq =kmalloc_obj (*fq, gfp); +if (gfp ==GFP_KERNEL ) + fq = netfs_folioq_pool.alloc (gfp, netfs_folioq_pool.pool_data); +else + fq =mempool_alloc (&netfs_folioq_pool, gfp);if (fq) {netfs_stat (&netfs_n_folioq);folioq_init (fq, rreq_id);
@@ -50,7 +54,7 @@ void netfs_folioq_free(struct folio_queue *folioq, {trace_netfs_folioq (folioq, trace);netfs_stat_d (&netfs_n_folioq); -kfree (folioq); +mempool_free (folioq, &netfs_folioq_pool); }EXPORT_SYMBOL (netfs_folioq_free);
@@ -60,11 +64,11 @@ EXPORT_SYMBOL(netfs_folioq_free);* consumer. */ int rolling_buffer_init (struct rolling_buffer *roll,unsigned int rreq_id, -unsigned int direction) +unsigned int direction,gfp_t gfp) {struct folio_queue *fq; - fq =netfs_folioq_alloc (rreq_id,GFP_NOFS , netfs_trace_folioq_rollbuf_init); + fq =netfs_folioq_alloc (rreq_id, gfp, netfs_trace_folioq_rollbuf_init);if (!fq)return -ENOMEM ;
@@ -77,14 +81,14 @@ int rolling_buffer_init(struct rolling_buffer *roll, unsigned int rreq_id,/* * Add another folio_queue to a rolling buffer if there's no space left. */ -int rolling_buffer_make_space (struct rolling_buffer *roll) +int rolling_buffer_make_space (struct rolling_buffer *roll,gfp_t gfp) {struct folio_queue *fq, *head = roll->head;if (!folioq_full (head))return 0 ; - fq =netfs_folioq_alloc (head->rreq_id,GFP_NOFS , netfs_trace_folioq_make_space); + fq =netfs_folioq_alloc (head->rreq_id, gfp, netfs_trace_folioq_make_space);if (!fq)return -ENOMEM ; fq->prev = head;
@@ -122,7 +126,7 @@ ssize_t rolling_buffer_load_from_ra(struct rolling_buffer *roll,int nr, ix, to;ssize_t size =0 ; -if (rolling_buffer_make_space (roll) <0 ) +if (rolling_buffer_make_space (roll,GFP_KERNEL ) <0 )return -ENOMEM ; fq = roll->head;
@@ -153,12 +157,12 @@ ssize_t rolling_buffer_load_from_ra(struct rolling_buffer *roll,* Append a folio to the rolling buffer. */ ssize_t rolling_buffer_append (struct rolling_buffer *roll,struct folio *folio, -unsigned int flags) +unsigned int flags,gfp_t gfp) {ssize_t size =folio_size (folio);int slot; -if (rolling_buffer_make_space (roll) <0 ) +if (rolling_buffer_make_space (roll, gfp) <0 )return -ENOMEM ; slot =folioq_append (roll->head, folio);
fs/netfs/write_issue.c +5 -5
@@ -108,7 +108,7 @@ struct netfs_io_request *netfs_create_write_req(struct address_space *mapping, ictx =netfs_inode (wreq->inode);if (is_cacheable)fscache_begin_write_operation (&wreq->cache_resources,netfs_i_cookie (ictx)); -if (rolling_buffer_init (&wreq->buffer, wreq->debug_id,ITER_SOURCE ) <0 ) +if (rolling_buffer_init (&wreq->buffer, wreq->debug_id,ITER_SOURCE , wreq->gfp) <0 ) goto nomem; wreq->cleaned_to = wreq->start;
@@ -167,7 +167,7 @@ void netfs_prepare_write(struct netfs_io_request *wreq,*/ if (iov_iter_is_folioq (wreq_iter) && wreq_iter->folioq_slot >=folioq_nr_slots (wreq_iter->folioq)) -rolling_buffer_make_space (&wreq->buffer); +rolling_buffer_make_space (&wreq->buffer, wreq->gfp); subreq =netfs_alloc_subrequest (wreq); subreq->source = stream->source;
@@ -334,7 +334,7 @@ static int netfs_write_folio(struct netfs_io_request *wreq,_enter ("" ); -if (rolling_buffer_make_space (&wreq->buffer) <0 ) +if (rolling_buffer_make_space (&wreq->buffer, wreq->gfp) <0 )return -ENOMEM ;/* netfs_perform_write() may shift i_size around the page or from out
@@ -436,7 +436,7 @@ static int netfs_write_folio(struct netfs_io_request *wreq, }/* Attach the folio to the rolling buffer. */ -rolling_buffer_append (&wreq->buffer, folio,0 ); +rolling_buffer_append (&wreq->buffer, folio,0 , wreq->gfp);/* Move the submission point forward to allow for write-streaming data * not starting at the front of the page. We don't do write-streaming
@@ -760,7 +760,7 @@ static int netfs_write_folio_single(struct netfs_io_request *wreq,/* Attach the folio to the rolling buffer. */ folio_get (folio); - ret =rolling_buffer_append (&wreq->buffer, folio,NETFS_ROLLBUF_PUT_MARK ); + ret =rolling_buffer_append (&wreq->buffer, folio,NETFS_ROLLBUF_PUT_MARK , wreq->gfp);if (ret <0 ) {folio_put (folio);return ret;
include/linux/netfs.h +1 -0
@@ -253,6 +253,7 @@ struct netfs_io_request {unsigned long long cleaned_to;/* Position we've cleaned folios to */ unsigned long long abandon_to;/* Position to abandon folios to */ const struct folio *no_unlock_folio;/* Don't unlock this folio after read */ +gfp_t gfp;/* GFP flags to use */ unsigned int direct_bv_count;/* Number of elements in direct_bv[] */ unsigned int debug_id;unsigned int rsize;/* Maximum read size (0 for none) */
include/linux/rolling_buffer.h +3 -3
@@ -43,13 +43,13 @@ struct rolling_buffer_snapshot {#define ROLLBUF_MARK_2 BIT(1)int rolling_buffer_init (struct rolling_buffer *roll,unsigned int rreq_id, -unsigned int direction); -int rolling_buffer_make_space (struct rolling_buffer *roll); +unsigned int direction,gfp_t gfp); +int rolling_buffer_make_space (struct rolling_buffer *roll,gfp_t gfp);ssize_t rolling_buffer_load_from_ra (struct rolling_buffer *roll,struct readahead_control *ractl,struct folio_batch *put_batch);ssize_t rolling_buffer_append (struct rolling_buffer *roll,struct folio *folio, -unsigned int flags); +unsigned int flags,gfp_t gfp);struct folio_queue *rolling_buffer_delete_spent (struct rolling_buffer *roll);void rolling_buffer_clear (struct rolling_buffer *roll);
Signature · 1 line
2.53.0