6.12.104-rc1 review
Greg Kroah-Hartman
maintainercover 6.12.104-rc1 review
This is the start of the stable review cycle for the 6.12.104 release. There are 181 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 19 Aug 2026 13:23:44 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.104-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.12.104-rc1
Xiang Mei (Microsoft) <[email protected]>
bpf: tcp: fix double sock release on batch realloc
Xu Rao <[email protected]>
thunderbolt: Fix bandwidth group reservation indexing
Bryam Vargas <[email protected]>
thunderbolt: Bound the DROM dual link port number before indexing sw->ports
Qing Ming <[email protected]>
sctp: clear new_transport when removing a peer
Yuxiang Yang <[email protected]>
sctp: fix use-after-free of cached ASCONF chunk
Baul Lee <[email protected]>
sctp: keep chunk->transport in step with the list it is queued on
Xu Rao <[email protected]>
scsi: scsi_debug: Negate wrapped memcmp() result
Chengfeng Ye <[email protected]>
bpf, sockmap: Fix sk_redir use-after-free in send verdict
Eric Biggers <[email protected]>
fsverity: Fix silent truncation in bpf_get_fsverity_digest()
Eric Biggers <[email protected]>
fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
Mimi Zohar <[email protected]>
ima: Instantiate file_truncate and path_truncate hooks
Tejun Heo <[email protected]>
sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
Zhan Xusheng <[email protected]>
fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()
Zhiling Zou <[email protected]>
ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
Yuejie Shi <[email protected]>
ipv6: fix Route Information option length validation
Tengda Wu <[email protected]>
ring-buffer: Use current_context for safe per-CPU buffer swap
Ahmad Byagowi <[email protected]>
ptp: ocp: Fix board ID over-read
Rafael J. Wysocki <[email protected]>
Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
Steven Rostedt <[email protected]>
eventfs: Use children field for rcu head and add memory barriers
Shuangpeng Bai <[email protected]>
eventfs: Fix use-after-free in eventfs_remove_rec()
Sean Christopherson <[email protected]>
KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page
Shuangpeng Bai <[email protected]>
smb: client: Fix use-after-free in cifs_try_adding_channels()
Jun Yang <[email protected]>
tipc: read le->link under the node lock in tipc_node_link_down()
chanyoung <[email protected]>
tls: don't leave a full plaintext sk_msg ring unpushed
Jun Yang <[email protected]>
vhost: reset the vring metadata cache on vring reconfiguration
Sun Jian <[email protected]>
veth: fix skb length accounting after XDP frag adjustment
Weiming Shi <[email protected]>
vsock/virtio: avoid refilling the RX queue after teardown
Weiming Shi <[email protected]>
vsock/virtio: read virtqueues under worker locks
Baul Lee <[email protected]>
vxlan: do not arm the ageing timer on a device that is down
Zhiling Zou <[email protected]>
xdp: reject clones that overrun skb_shared_info tailroom
Asad Kamal <[email protected]>
Revert "drm/amdgpu: fix aperture mapping leak"
Christian Brauner <[email protected]>
binfmt_misc: don't warn when the mount is completed from another user namespace
Christian Brauner <[email protected]>
ovl: don't warn when the mount is completed from another user namespace
Hyunjung Ko <[email protected]>
net/sched: act_gact, act_police: range check the fallback control action
Hyunjung Ko <[email protected]>
net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
Yangyu Chen <[email protected]>
net: atlantic: free RX pages of consumed but not refilled buffers
Yangyu Chen <[email protected]>
net: atlantic: free stranded TX buffers on ring deinit
Zihan Xi <[email protected]>
netfilter: nf_conntrack: defer invalid log until after unlock
Zhiling Zou <[email protected]>
netfilter: bridge: release template ct on non-IP path
Kyle Zeng <[email protected]>
ipv6: prevent in6_dev_get() from resurrecting inet6_dev
Daming Li <[email protected]>
net: smc: fix splice entry lifetime imbalance in smc_rx_splice
Lorenzo Stoakes (ARM) <[email protected]>
mm/huge_memory: fix huge_zero_pfn race
Vincent Donnefort <[email protected]>
ring-buffer: Prevent subbuf order change when resizing is disabled
Rik van Riel <[email protected]>
fbdev: bitblit: bound-check glyph index in bit_cursor()
Michael Wu <[email protected]>
tracing: Fix race between update_event_fields and, event_define_fields
Baul Lee <[email protected]>
ALSA: usx2y: bound the hwdep mmap fault offset
Takashi Iwai <[email protected]>
ALSA: usb: Fix UAF at delayed release of MIDI2 EPs
Hui Su <[email protected]>
ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
Eddie Lin <[email protected]>
misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
Junrui Luo <[email protected]>
misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
Ekansh Gupta <[email protected]>
misc: fastrpc: Remove buffer from list prior to unmap operation
Anandu Krishnan E <[email protected]>
misc: fastrpc: fix channel ctx ref leak when session alloc fails
Mariano Baragiola <[email protected]>
staging: rtl8723bs: validate monitor transmit frame lengths
Panagiotis Petrakopoulos <[email protected]>
staging: rtl8723bs: fix missing shared-key auth challenge length check
Muhammad Bilal <[email protected]>
staging: rtl8723bs: fix OOB read in WMM_param_handler()
Muhammad Bilal <[email protected]>
staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
Cunhao Lu <[email protected]>
serial: 8250_dma: Clear stale RX state on shutdown
Jan Sebastian Götte <[email protected]>
serial: qcom-geni: fix TX DMA buffer flush
Mathieu Dubois-Briand <[email protected]>
nvmem: layouts: Add fixed-layout driver
Alexander Usyskin <[email protected]>
mei: pull kvfree out of spinlock
Chengfeng Ye <[email protected]>
ipv4: fix use-after-free in fib_nhc_update_mtu()
Zihan Xi <[email protected]>
ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
Michal Luczaj <[email protected]>
selftests/bpf: Adapt sockmap update error handling
Michal Luczaj <[email protected]>
selftests/bpf: Ensure UDP sockets are bound
Claudiu Beznea <[email protected]>
pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP
Kees Cook <[email protected]>
kunit/fortify: Add back "volatile" for sizeof() constants
Kees Cook <[email protected]>
kunit/fortify: Replace "volatile" with OPTIMIZER_HIDE_VAR()
Keno Fischer <[email protected]>
futex: Prevent robust futex exit race some more
Ashish Kalra <[email protected]>
crypto: ccp - Abort doing SEV INIT if SNP INIT fails
Michael Roth <[email protected]>
crypto: ccp - Fix checks for SNP_VLEK_LOAD input buffer length
Ashish Kalra <[email protected]>
KVM: SVM: Add support to initialize SEV/SNP functionality in KVM
Ashish Kalra <[email protected]>
crypto: ccp - Add new SEV/SNP platform shutdown API
Harshal Dev <[email protected]>
dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk
Keith Busch <[email protected]>
blk-mq: reinsert cached request to the list
Keith Busch <[email protected]>
blk-mq: pop cached request if it is usable
Bart Van Assche <[email protected]>
block: Reorder the request allocation code in blk_mq_submit_bio()
Matthew Rosato <[email protected]>
KVM: s390: pci: Fix aisb calculation
Farhan Ali <[email protected]>
KVM: s390: pci: Fix resource leak on IRQ registration failure
Farhan Ali <[email protected]>
KVM: s390: pci: Fix missing error codes and memory unaccounting
Farhan Ali <[email protected]>
KVM: s390: pci: Fix memory accounting for pinned/unpinned pages
Baul Lee <[email protected]>
net: bridge: mrp: fix uninitialised bytes on the wire
Chengfeng Ye <[email protected]>
netfilter: ebt_nflog: pin the NFLOG backend
Zihan Xi <[email protected]>
mac802154: fix netdev use-after-free in beacon worker
Qihang Tang <[email protected]>
net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
Sergey V. Frolov <[email protected]>
net: octeontx2-pf: Fix UB in shift operation
Zijie Huang <[email protected]>
net/sched: reject overly deep qdisc hierarchies
Zhiling Zou <[email protected]>
net: openvswitch: reallocate update replies for mismatched IDs
Sun Jian <[email protected]>
net: fix skb length accounting after generic XDP frag adjustment
Zihan Xi <[email protected]>
packet: synchronize pressure clearing with ring reconfiguration
Doruk Tan Ozturk <[email protected]>
net/packet: reset the MAC header on the packet-socket transmit path
Qihang Tang <[email protected]>
packet: use consistent hard_header_len in TX_RING send path
Qihang Tang <[email protected]>
packet: use consistent hard_header_len in non-ring send paths
Kyle Zeng <[email protected]>
ipvs: clear IPv4 options after rebasing tunnel ICMP errors
Julian Anastasov <[email protected]>
ipvs: properly update the overload flag on dest edit
Julian Anastasov <[email protected]>
ipvs: add totalconns for dest
Zhiling Zou <[email protected]>
ipvs: stop estimator after disabled calc phase
Lincoln Wallace <[email protected]>
ima: fix out-of-bounds read in xattr_verify()
Dmitry Torokhov <[email protected]>
Input: evdev - fix information leak in evdev_pass_values()
Joshua Rogers <[email protected]>
vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
Joshua Rogers <[email protected]>
vt: add permission check for KDSKBMETA ioctl
Doruk Tan Ozturk <[email protected]>
net: usb: ipheth: fix carrier_work UAF on disconnect
Yi Cong <[email protected]>
net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()
Sonali Pradhan <[email protected]>
usb: gadget: f_ncm: Use unsigned int for ndp_index
Pawel Laszczak <[email protected]>
usb: cdnsp: fix incorrect endian conversions for APB timeout register
Xu Rao <[email protected]>
thunderbolt: icm: Preserve USB4 proxy data-valid bit
Aleksandr Nogikh <[email protected]>
usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
Baul Lee <[email protected]>
ALSA: usb-audio: fix OOB write on Type II inbound URBs
Dmitry Torokhov <[email protected]>
Input: evdev - sanitize event type index when fetching event masks
Guillaume Morin <[email protected]>
swapfile: call cond_resched() before locking si->lock
Mikhail Kshevetskiy <[email protected]>
mtd: spinand: repeat reading in regular mode if continuous reading fails
Mikhail Kshevetskiy <[email protected]>
mtd: spinand: try a regular dirmap if creating a dirmap for continuous reading fails
Mikhail Kshevetskiy <[email protected]>
mtd: spinand: fix direct mapping creation sizes
Larisa Grigore <[email protected]>
spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers
Mehmet Fide <[email protected]>
net: fec: do not release NULL pages when RX buffer allocation fails
Zeng Jingxiang <[email protected]>
mm/vmscan: wake up flushers conditionally to avoid cgroup OOM
Guenter Roeck <[email protected]>
hwmon: (ltc4282) Fix parsing adi,current-limit-sense-microvolt
Guenter Roeck <[email protected]>
hwmon: (ltc4282) Clamp negative current limits
Guenter Roeck <[email protected]>
hwmon: (ltc4282) Avoid overflow in maximum power calculation
Qingshuang Fu <[email protected]>
hwmon: (ads7828) Fix external VREF regulator handling
Wilken Gottwalt <[email protected]>
hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination
Maximilian Immanuel Brandtner <[email protected]>
tls: don't abort the connection on signal-interrupted sends
Xin Long <[email protected]>
sctp: clear control chunk transport if it is being removed
Eric Dumazet <[email protected]>
net/atm: fix slab-out-of-bounds read in vcc_setsockopt()
Hongyan Xu <[email protected]>
ata: pata_sl82c105: fix bridge revision use-after-free
Fan XinRan <[email protected]>
net: thunderbolt: Tear down DMA paths before stopping the rings
Sidraya Jayagond <[email protected]>
net/smc: fix TOCTOU race between smc_listen_out() and listener close
Eric Dumazet <[email protected]>
net: remove WARN_ON_ONCE() from sk_mc_loop()
Pengpeng Hou <[email protected]>
net: prestera: validate firmware header length
Henry Martin <[email protected]>
net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
Jiayuan Chen <[email protected]>
tcp: fix TFO max_qlen accounting across reuseport migration
Qing Luo <[email protected]>
sctp: fix addip_serial increment on ASCONF_ACK allocation failure
Keegan Freyhof <[email protected]>
bnxt_en: Fix PTP PPS setting bug
Shravya KN <[email protected]>
bnxt_en: Refresh VNIC default ring on queue restart if needed
Shravya KN <[email protected]>
bnxt_en: Determine and store default RX ring in vnic structure
Shravya KN <[email protected]>
bnxt_en: Move RSS table fill outside __bnxt_hwrm_vnic_set_rss()
Martin Kaiser <[email protected]>
selftests/ftrace: refactor eprobes test to fix argument checks
Guenter Roeck <[email protected]>
hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations
Qingshuang Fu <[email protected]>
hwmon: (nzxt-smart2) Check return value of init_device() in probe
Jamal Hadi Salim <[email protected]>
net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers
Cen Zhang (Microsoft) <[email protected]>
net/openvswitch: check Ethernet header length in key_extract()
Toke Høiland-Jørgensen <[email protected]>
net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter
Xuanqiang Luo <[email protected]>
udp: fix potential use-after-free in tunnel segmentation
Stanislav Fomichev <[email protected]>
xsk: require at least 16 bytes of TX metadata
Nathan Gao <[email protected]>
tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss()
Christian Borntraeger <[email protected]>
vdpa/mlx5: Fix buffer length in create_direct_keys()
Yousef Alhouseen <[email protected]>
vhost/vdpa: reject overflowing PA map page counts on 32-bit
Jose Fernandez (Anthropic) <[email protected]>
bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
Jordan Rife <[email protected]>
bpf: tcp: Avoid socket skips and repeats during iteration
Jordan Rife <[email protected]>
bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items
Jordan Rife <[email protected]>
bpf: tcp: Get rid of st_bucket_done
Jordan Rife <[email protected]>
bpf: tcp: Make sure iter->batch always contains a full bucket snapshot
Jordan Rife <[email protected]>
bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch
Babanpreet Singh <[email protected]>
counter: microchip-tcb-capture: Fix DT channel validation
Michael Guralnik <[email protected]>
net/mlx5: fw_tracer, return NULL on create error
Or Har-Toov <[email protected]>
devlink: fix net namespace reference leak in reload
Jiawen Liu <[email protected]>
net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete
Jamal Hadi Salim <[email protected]>
net/sched: cls_route: fix fastmap use-after-free on filter
Mahanta Jambigi <[email protected]>
net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()
Yiyang Chen <[email protected]>
bpf: Preserve pointer state for commuted arithmetic
Dmitry Antipov <[email protected]>
btrfs: fix memory leak in btrfs_do_encoded_write()
Matti Vaittinen <[email protected]>
watchdog: bd96801_wdt: Fix timeout for enabled WDG
Julian Anastasov <[email protected]>
ipvs: return the csum validation for forward hook
Julian Anastasov <[email protected]>
ipvs: avoid out-of-bounds write in ip_vs_nat_icmp
Jozsef Kadlecsik <[email protected]>
netfilter: ipset: switch ext_size to atomic64_t
Nikhil P. Rao <[email protected]>
pds_core: cancel pending PCI reset work on AER recovery
Nikhil P. Rao <[email protected]>
pds_core: keep the health thread stopped during reset
Shay Drory <[email protected]>
net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock
Satish Kharat <[email protected]>
enic: fix tx_hang_reset use-after-free on device removal
Xiang Mei (Microsoft) <[email protected]>
bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
Fan Ye <[email protected]>
Revert "net: thunderbolt: Enable end-to-end flow control also in transmit"
Jijie Shao <[email protected]>
net: hns3: fix speed configuration residue after driver reload
Pengpeng Hou <[email protected]>
drm/bridge: ps8640: propagate AUX transfer register errors
Rosen Penev <[email protected]>
ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt
Yuho Choi <[email protected]>
ARM: npcm: Fix OF node refcount leaks in SMP setup
Daniel Drake <[email protected]>
arm64: dts: broadcom: bcm2712: Remove non-functional EL2 virtual timer
Anna Schumaker <[email protected]>
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
Harald Freudenberger <[email protected]>
s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()
Ray Wu <[email protected]>
drm/amd/display: Check for tg ops in dce110_set_avmute
Ray Wu <[email protected]>
drm/amd/display: Add AV mute wait frames to dce110_set_avmute
Michal Luczaj <[email protected]>
selftests/bpf: Fail unbound UDP on sockmap update
Al Viro <[email protected]>
mount: honour SB_NOUSER in the new mount API
-------------
Diffstat:
.../bindings/crypto/qcom,inline-crypto-engine.yaml | 16 +- MAINTAINERS | 5 + Makefile | 4 +- arch/arm/boot/dts/broadcom/bcm-ns.dtsi | 2 +- arch/arm/mach-npcm/platsmp.c | 2 + arch/arm64/boot/dts/broadcom/bcm2712.dtsi | 2 - arch/s390/kvm/pci.c | 86 ++++-- arch/s390/kvm/pci.h | 2 + arch/x86/kvm/mmu/mmu.c | 3 + arch/x86/kvm/svm/sev.c | 12 + block/blk-mq.c | 38 +-- drivers/ata/pata_sl82c105.c | 4 +- drivers/counter/microchip-tcb-capture.c | 4 +- drivers/crypto/ccp/sev-dev.c | 17 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 35 +-- .../drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 24 +- drivers/gpu/drm/bridge/parade-ps8640.c | 27 +- drivers/hwmon/ads7828.c | 11 +- drivers/hwmon/corsair-psu.c | 4 +- drivers/hwmon/ltc4282.c | 20 +- drivers/hwmon/nzxt-smart2.c | 6 +- drivers/hwmon/pmbus/lm25066.c | 5 +- drivers/input/evdev.c | 27 +- drivers/misc/fastrpc.c | 19 +- drivers/misc/mei/client.c | 25 +- drivers/mtd/nand/spi/core.c | 74 ++++-- drivers/net/bonding/bond_alb.c | 10 +- drivers/net/ethernet/amd/pds_core/core.h | 1 + drivers/net/ethernet/amd/pds_core/main.c | 14 +- drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 51 +++- drivers/net/ethernet/aquantia/atlantic/aq_ring.h | 1 + drivers/net/ethernet/aquantia/atlantic/aq_vec.c | 2 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 50 ++-- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 7 +- drivers/net/ethernet/cisco/enic/enic_main.c | 5 +- drivers/net/ethernet/freescale/fec_main.c | 11 +- drivers/net/ethernet/hisilicon/hix5hd2_gmac.c | 1 - .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 6 +- .../net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 6 +- .../net/ethernet/marvell/prestera/prestera_pci.c | 3 + .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 16 +- .../net/ethernet/mellanox/mlx5/core/en/tc_priv.h | 1 + drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 4 +- drivers/net/thunderbolt/main.c | 33 ++- drivers/net/usb/ax88179_178a.c | 4 +- drivers/net/usb/ipheth.c | 11 +- drivers/net/veth.c | 22 +- drivers/net/vxlan/vxlan_core.c | 2 +- drivers/nvmem/core.c | 24 +- drivers/nvmem/internals.h | 2 + drivers/nvmem/layouts.c | 11 - drivers/nvmem/layouts/Makefile | 1 + drivers/nvmem/layouts/fixed-layout.c | 58 ++++ drivers/pinctrl/renesas/pinctrl-rzg2l.c | 4 +- drivers/ptp/ptp_ocp.c | 4 +- drivers/s390/crypto/zcrypt_ccamisc.c | 20 +- drivers/scsi/scsi_debug.c | 4 +- drivers/spi/spi-fsl-dspi.c | 13 +- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 3 + drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 2 +- drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 3 + drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 4 + drivers/thermal/thermal_hwmon.c | 3 +- drivers/thunderbolt/eeprom.c | 9 +- drivers/thunderbolt/icm.c | 2 +- drivers/thunderbolt/tb.c | 2 +- drivers/tty/serial/8250/8250_dma.c | 12 +- drivers/tty/serial/qcom_geni_serial.c | 43 +-- drivers/tty/vt/keyboard.c | 5 +- drivers/tty/vt/vt_ioctl.c | 2 + drivers/usb/atm/cxacru.c | 2 + drivers/usb/cdns3/cdnsp-gadget.c | 4 +- drivers/usb/gadget/function/f_ncm.c | 2 +- drivers/vdpa/mlx5/core/mr.c | 3 +- drivers/vhost/vdpa.c | 9 +- drivers/vhost/vhost.c | 8 + drivers/video/fbdev/core/bitblit.c | 9 +- drivers/watchdog/bd96801_wdt.c | 5 +- fs/binfmt_misc.c | 3 +- fs/btrfs/inode.c | 1 + fs/crypto/policy.c | 2 +- fs/namespace.c | 5 + fs/nfs/nfs4proc.c | 5 + fs/overlayfs/super.c | 3 +- fs/smb/client/sess.c | 2 +- fs/tracefs/event_inode.c | 28 +- fs/tracefs/internal.h | 4 +- fs/verity/measure.c | 15 +- include/linux/netdevice.h | 11 +- include/linux/netfilter/ipset/ip_set.h | 2 +- include/linux/nvmem-provider.h | 6 + include/linux/psp-sev.h | 3 + include/net/act_api.h | 19 ++ include/net/addrconf.h | 4 +- include/net/ip_vs.h | 41 +-- include/net/route.h | 2 + include/net/sch_generic.h | 1 + kernel/bpf/verifier.c | 15 +- kernel/futex/core.c | 85 ++++-- kernel/sched/psi.c | 6 + kernel/trace/ring_buffer.c | 12 +- kernel/trace/trace_events.c | 2 + lib/fortify_kunit.c | 139 +++++----- mm/huge_memory.c | 49 ++-- mm/swapfile.c | 2 +- mm/vmscan.c | 25 +- net/atm/common.c | 14 +- net/bridge/br_mrp.c | 6 +- net/bridge/netfilter/ebt_nflog.c | 17 +- net/bridge/netfilter/nf_conntrack_bridge.c | 1 + net/core/dev.c | 10 +- net/core/sock.c | 1 - net/core/xdp.c | 2 +- net/devlink/dev.c | 1 + net/ipv4/fib_semantics.c | 101 ++++--- net/ipv4/inet_connection_sock.c | 20 +- net/ipv4/route.c | 29 ++ net/ipv4/tcp_bpf.c | 2 + net/ipv4/tcp_input.c | 2 +- net/ipv4/tcp_ipv4.c | 293 +++++++++++++++------ net/ipv4/udp_offload.c | 4 +- net/ipv6/ip6_tunnel.c | 3 + net/ipv6/route.c | 8 +- net/mac802154/scan.c | 4 + net/ncsi/ncsi-netlink.c | 4 + net/netfilter/ipset/ip_set_bitmap_gen.h | 4 +- net/netfilter/ipset/ip_set_core.c | 6 +- net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipset/ip_set_list_set.c | 4 +- net/netfilter/ipvs/ip_vs_conn.c | 41 +-- net/netfilter/ipvs/ip_vs_core.c | 70 ++--- net/netfilter/ipvs/ip_vs_ctl.c | 77 +++++- net/netfilter/ipvs/ip_vs_est.c | 10 +- net/netfilter/ipvs/ip_vs_lc.c | 4 +- net/netfilter/ipvs/ip_vs_proto_sctp.c | 4 +- net/netfilter/ipvs/ip_vs_proto_tcp.c | 2 - net/netfilter/ipvs/ip_vs_sync.c | 7 +- net/netfilter/ipvs/ip_vs_xmit.c | 2 +- net/netfilter/nf_conntrack_proto.c | 6 + net/netfilter/nf_conntrack_proto_sctp.c | 12 +- net/netfilter/nf_conntrack_proto_tcp.c | 132 ++++++---- net/openvswitch/datapath.c | 29 +- net/openvswitch/flow.c | 11 +- net/packet/af_packet.c | 72 +++-- net/sched/act_ct.c | 29 +- net/sched/act_gact.c | 5 + net/sched/act_police.c | 6 + net/sched/cls_api.c | 17 +- net/sched/cls_route.c | 35 ++- net/sched/sch_api.c | 9 + net/sched/sch_cake.c | 1 - net/sctp/associola.c | 11 +- net/sctp/outqueue.c | 1 + net/sctp/sm_make_chunk.c | 3 +- net/sctp/sm_statefuns.c | 6 +- net/smc/af_smc.c | 3 +- net/smc/smc_llc.c | 3 +- net/smc/smc_rx.c | 19 +- net/tipc/node.c | 15 +- net/tls/tls_sw.c | 16 +- net/vmw_vsock/virtio_transport.c | 14 +- net/xdp/xdp_umem.c | 2 + security/integrity/ima/ima_appraise.c | 9 +- security/integrity/ima/ima_main.c | 39 +++ sound/usb/endpoint.c | 6 +- sound/usb/midi2.c | 9 + sound/usb/usx2y/usX2Yhwdep.c | 2 + sound/usb/usx2y/usx2yhwdeppcm.c | 2 + .../selftests/bpf/prog_tests/sockmap_basic.c | 6 +- .../selftests/bpf/prog_tests/sockmap_listen.c | 21 +- tools/testing/selftests/bpf/test_maps.c | 13 +- .../ftrace/test.d/dynevent/add_remove_eprobe.tc | 16 +- 174 files changed, 1957 insertions(+), 881 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/181 mount: honour SB_NOUSER in the new mount API
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit 6dd3c6884cd9defb511284b566cef5ac8f657dbf ]
One should *not* be allowed to mount one of those, new API or not.
--- fs/namespace.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/namespace.c +5 -0
@@ -4229,6 +4229,11 @@ SYSCALL_DEFINE3(fsmount, int, fs_fd, unsigned int, flags, ret =PTR_ERR (newmount.mnt); goto err_unlock; } +if (newmount.mnt->mnt_sb->s_flags &SB_NOUSER ) { +mntput (newmount.mnt); + ret = -EINVAL ; + goto err_unlock; + } newmount.dentry =dget (fc->root); newmount.mnt->mnt_flags = mnt_flags;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 2/181 selftests/bpf: Fail unbound UDP on sockmap update
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Luczaj <[email protected]>
[ Upstream commit 203b06932777b9ad5085319389dea566f5c2ca63 ]
sockmap now rejects unbound UDP sockets. Adjust test_maps. While at it, check socket()'s return value.
This effectively reverts commit c39aa2159974 ("bpf, selftests: Fix test_maps now that sockmap supports UDP").
--- tools/testing/selftests/bpf/test_maps.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
tools/testing/selftests/bpf/test_maps.c +6 -7
@@ -752,16 +752,15 @@ static void test_sockmap(unsigned int tasks, void *data) goto out_sockmap; } -/* Test update with unsupported UDP socket */ +/* Test update with unsupported unbound UDP socket */ udp =socket (AF_INET ,SOCK_DGRAM ,0 ); - i =0 ; - err =bpf_map_update_elem (fd, &i, &udp,BPF_ANY ); -if (err) { -printf ("Failed socket update SOCK_DGRAM '%i:%i'\n" , - i, udp); +CHECK (udp <0 ,"socket(AF_INET, SOCK_DGRAM)" ,"errno:%d\n" , errno); + err =bpf_map_update_elem (fd, &(int ){0 }, &udp,BPF_ANY ); +close (udp); +if (!err) { +printf ("Unexpectedly succeeded unbound UDP update '0:%i'\n" , udp); goto out_sockmap; } -close (udp);/* Test update without programs */ for (i =0 ; i <6 ; i++) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 3/181 drm/amd/display: Add AV mute wait frames to dce110_set_avmute
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ray Wu <[email protected]>
[ Upstream commit 443290d70b01e9c35830c300e3247c06581b594c ]
Port the three-frame wait logic from dcn30_set_avmute to dce110_set_avmute so that older DCN versions (1.0, 2.0) also wait for GCP packets to be sent out before proceeding.
This ensures HDMI sinks properly process the mute state, preventing garbled display after link re-establishment.
--- .../amd/display/dc/hwss/dce110/dce110_hwseq.c | 21 ++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +20 -1
@@ -1256,8 +1256,27 @@ void dce110_blank_stream(struct pipe_ctx *pipe_ctx)void dce110_set_avmute (struct pipe_ctx *pipe_ctx,bool enable) { -if (pipe_ctx !=NULL && pipe_ctx->stream_res.stream_enc !=NULL ) +if (pipe_ctx ==NULL || pipe_ctx->stream_res.stream_enc ==NULL ) +return ; + +if (dc_is_hdmi_signal (pipe_ctx->stream->signal)) { pipe_ctx->stream_res.stream_enc->funcs->set_avmute (pipe_ctx->stream_res.stream_enc, enable); + +/* Wait for three frames to make sure AV mute is sent out. +* Some HDMI sinks need additional GCP packets to properly +* process the mute state, especially after link re-establishment +* with HDMI 2.0 scrambling enabled. +*/ +if (enable && pipe_ctx->stream_res.tg->funcs->is_tg_enabled (pipe_ctx->stream_res.tg)) { +int i; + + pipe_ctx->stream_res.tg->funcs->wait_for_state (pipe_ctx->stream_res.tg,CRTC_STATE_VACTIVE ); +for (i =0 ; i <3 ; i++) { + pipe_ctx->stream_res.tg->funcs->wait_for_state (pipe_ctx->stream_res.tg,CRTC_STATE_VBLANK ); + pipe_ctx->stream_res.tg->funcs->wait_for_state (pipe_ctx->stream_res.tg,CRTC_STATE_VACTIVE ); + } + } + } }static enum audio_dto_source translate_to_dto_source (enum controller_id crtc_id)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 4/181 drm/amd/display: Check for tg ops in dce110_set_avmute
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ray Wu <[email protected]>
[ Upstream commit 3141e3d61469bba2624a91c5e2407f110b33b29e ]
Some older DCE timing generators do not implement is_tg_enabled in their ops table. Calling it unconditionally when waiting for AV mute frames causes a NULL pointer dereference on Southern Islands dGPUs when turning the display off over HDMI.
Check that tg and the required ops exist before waiting for frames.
--- drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +4 -1
@@ -1267,7 +1267,10 @@ void dce110_set_avmute(struct pipe_ctx *pipe_ctx, bool enable)* process the mute state, especially after link re-establishment * with HDMI 2.0 scrambling enabled. */ -if (enable && pipe_ctx->stream_res.tg->funcs->is_tg_enabled (pipe_ctx->stream_res.tg)) { +if (enable && pipe_ctx->stream_res.tg && + pipe_ctx->stream_res.tg->funcs->is_tg_enabled && + pipe_ctx->stream_res.tg->funcs->wait_for_state && + pipe_ctx->stream_res.tg->funcs->is_tg_enabled (pipe_ctx->stream_res.tg)) {int i; pipe_ctx->stream_res.tg->funcs->wait_for_state (pipe_ctx->stream_res.tg,CRTC_STATE_VACTIVE );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 5/181 s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harald Freudenberger <[email protected]>
[ Upstream commit 01476391aecef36a3b789ee844357b22fbc90665 ]
The helper function _ip_cprb_helper() uses internal buffer memory for building and processing CPRBs. After use this buffer was never scrubbed which could lead to leaving for example clear key material in memory which could be exposed via tricky reuse of this same memory.
Extend the _ip_cprb_helper() function with another parameter 'scrub' used to steer scrubbing of this buffer. So now the caller has the opportunity to decide if scrubbing is needed or not.
Extend the clear key to secure key token import process in function cca_clr2cipherkey() to tell the helper function from above to scrub the cprb buffer when the clear key value is part of the request data.
Add explicit scrubbing on return from function cca_clr2cipherkey() for the random EXOR buffer and the cprb buffer.
Overall this cleans the internal used buffer in case of clear key import to prevent sensitive data to get exposed.
--- drivers/s390/crypto/zcrypt_ccamisc.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-)
drivers/s390/crypto/zcrypt_ccamisc.c +13 -7
@@ -938,7 +938,8 @@ static int _ip_cprb_helper(u16 cardnr, u16 domain,const u8 *clr_key_value, int clr_key_bit_size, u8 *key_token, - int *key_token_size) + int *key_token_size, + bool scrub) { int rc, n;u8 *mem, *ptr;
@@ -1077,7 +1078,7 @@ static int _ip_cprb_helper(u16 cardnr, u16 domain, *key_token_size = t->len; out: -free_cprbmem (mem,PARMBSIZE ,0 ); +free_cprbmem (mem,PARMBSIZE , scrub);return rc; }
@@ -1120,28 +1121,32 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags,* 4/4 COMPLETE the secure cipher key import */ rc =_ip_cprb_helper (card, dom,"AES " ,"FIRST " ,"MIN3PART" , - exorbuf, keybitsize, token, &tokensize); + exorbuf, keybitsize, token, &tokensize, + true);if (rc) {ZCRYPT_DBF_ERR ("%s clear key import 1/4 with CSNBKPI2 failed, rc=%d\n" , __func__, rc); goto out; } rc =_ip_cprb_helper (card, dom,"AES " ,"ADD-PART" ,NULL , - clrkey, keybitsize, token, &tokensize); + clrkey, keybitsize, token, &tokensize, + true);if (rc) {ZCRYPT_DBF_ERR ("%s clear key import 2/4 with CSNBKPI2 failed, rc=%d\n" , __func__, rc); goto out; } rc =_ip_cprb_helper (card, dom,"AES " ,"ADD-PART" ,NULL , - exorbuf, keybitsize, token, &tokensize); + exorbuf, keybitsize, token, &tokensize, + true);if (rc) {ZCRYPT_DBF_ERR ("%s clear key import 3/4 with CSNBKPI2 failed, rc=%d\n" , __func__, rc); goto out; } rc =_ip_cprb_helper (card, dom,"AES " ,"COMPLETE" ,NULL , -NULL , keybitsize, token, &tokensize); +NULL , keybitsize, token, &tokensize, + true);if (rc) {ZCRYPT_DBF_ERR ("%s clear key import 4/4 with CSNBKPI2 failed, rc=%d\n" , __func__, rc);
@@ -1158,7 +1163,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags, *keybufsize = tokensize; out: -kfree (token); +memzero_explicit (exorbuf,sizeof (exorbuf)); +kfree_sensitive (token);return rc; }EXPORT_SYMBOL (cca_clr2cipherkey);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 6/181 NFS: Pin the struct nfs_server during a FREE_STATEID call
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anna Schumaker <[email protected]>
[ Upstream commit cf616096a0f3a2b60f7d68b6b39674a6867ded9c ]
Dan Aloni reports that he was able to hit a use-after-free bug if a FREE_STATEID operation gets delayed for whatever reason. Fix this by bumping the refcount of the 'struct nfs_server' object for the duration of the FREE_STATEID so it doesn't get cleaned up from underneath us while operations are still in flight.
--- fs/nfs/nfs4proc.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/nfs/nfs4proc.c +5 -0
@@ -10585,6 +10585,7 @@ static void nfs41_free_stateid_release(void *calldata)struct nfs_free_stateid_data *data = calldata;struct nfs_client *clp = data->server->nfs_client; +nfs_sb_deactive (data->server->super);nfs_put_client (clp);kfree (calldata); }
@@ -10626,6 +10627,10 @@ static int nfs41_free_stateid(struct nfs_server *server,if (!refcount_inc_not_zero (&clp->cl_count))return -EIO ; +if (!nfs_sb_active (server->super)) { +nfs_put_client (clp); +return -EIO ; + }nfs4_state_protect (server->nfs_client,NFS_SP4_MACH_CRED_STATEID , &task_setup.rpc_client, &msg);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 7/181 arm64: dts: broadcom: bcm2712: Remove non-functional EL2 virtual timer
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Drake <[email protected]>
[ Upstream commit 75952cfc7752c52a2b692b59d34ce160d3edabb2 ]
Commit d87773de9efe1 ("clocksource/drivers/arm_arch_timer: Default to EL2 virtual timer when running VHE") causes boot to hang on Raspberry Pi 5. The newly-selected EL2 virtual timer does not generate any interrupts, even though the GIC_DIST_ENABLE_SET flag has been confirmed set via readback.
It is highly unusual that this timer interrupt is non-operational because this is a standard GIC interrupt corresponding to a standard Cortex-A76 CPU timer. However, Broadcom have confirmed for this SoC:
Quoted 2 lines
the interrupt line was never connected in the first place as this was not identified as being a requirement
Remove the corresponding DeviceTree entry.
--- arch/arm64/boot/dts/broadcom/bcm2712.dtsi | 2 -- 1 file changed, 2 deletions(-)
arch/arm64/boot/dts/broadcom/bcm2712.dtsi +0 -2
@@ -279,8 +279,6 @@ IRQ_TYPE_LEVEL_LOW)>, <GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>, <GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(4) | - IRQ_TYPE_LEVEL_LOW)>, - <GIC_PPI 12 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>; }; };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 8/181 ARM: npcm: Fix OF node refcount leaks in SMP setup
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuho Choi <[email protected]>
[ Upstream commit 8eb052f48331474c2789d07b7f11165c323bd2f9 ]
npcm7xx_smp_boot_secondary() and npcm7xx_smp_prepare_cpus() look up the GCR and SCU nodes with of_find_compatible_node(). The returned nodes are used for of_iomap(), but the node references are never released.
of_iomap() does not consume the device node reference, and iounmap() only releases the MMIO mapping. Drop each node reference after the corresponding mapping attempt.
--- arch/arm/mach-npcm/platsmp.c | 2 ++ 1 file changed, 2 insertions(+)
arch/arm/mach-npcm/platsmp.c +2 -0
@@ -32,6 +32,7 @@ static int npcm7xx_smp_boot_secondary(unsigned int cpu, goto out; } gcr_base =of_iomap (gcr_np,0 ); +of_node_put (gcr_np);if (!gcr_base) {pr_err ("could not iomap gcr" ); ret = -ENOMEM ;
@@ -60,6 +61,7 @@ static void __init npcm7xx_smp_prepare_cpus(unsigned int max_cpus)return ; } scu_base =of_iomap (scu_np,0 ); +of_node_put (scu_np);if (!scu_base) {pr_err ("could not iomap scu" );return ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 9/181 ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <[email protected]>
[ Upstream commit bab4d538f8485e0d48538fcb82b285df3779278e ]
PCIe controller 2 has interrupts 0-4 mapping to GIC SPI 138-142. The mapping for interrupt 1 was incorrectly set to 138 due to a copy-paste error. Fix it to 139.
--- arch/arm/boot/dts/broadcom/bcm-ns.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/broadcom/bcm-ns.dtsi +1 -1
@@ -138,7 +138,7 @@ axi@18000000 { /* PCIe Controller 2 */ <0x00014000 0 &gic GIC_SPI 138 IRQ_TYPE_LEVEL_HIGH>, - <0x00014000 1 &gic GIC_SPI 138 IRQ_TYPE_LEVEL_HIGH>, + <0x00014000 1 &gic GIC_SPI 139 IRQ_TYPE_LEVEL_HIGH>, <0x00014000 2 &gic GIC_SPI 140 IRQ_TYPE_LEVEL_HIGH>, <0x00014000 3 &gic GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>, <0x00014000 4 &gic GIC_SPI 142 IRQ_TYPE_LEVEL_HIGH>,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 10/181 drm/bridge: ps8640: propagate AUX transfer register errors
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit 20697ecb299cd77b4cf8b28f655e56606b0472d8 ]
ps8640_aux_transfer_msg() programs the AUX address registers, starts the AUX transfer, waits for SWAUX_SEND to clear, and reads the AUX status register. Several of those regmap operations have return values, but the function only checks a stale ret after the status read.
Propagate failures from the address write, transfer start, completion poll, and status read. This avoids returning a transfer length when the bridge register transaction or AUX completion wait failed.
--- drivers/gpu/drm/bridge/parade-ps8640.c | 27 ++++++++++++++++++++------ 1 file changed, 21 insertions(+), 6 deletions(-)
drivers/gpu/drm/bridge/parade-ps8640.c +21 -6
@@ -258,8 +258,14 @@ static ssize_t ps8640_aux_transfer_msg(struct drm_dp_aux *aux, addr_len[PAGE0_SWAUX_LENGTH - base] = (len ==0 ) ?SWAUX_NO_PAYLOAD : ((len -1 ) &SWAUX_LENGTH_MASK ); -regmap_bulk_write (map,PAGE0_SWAUX_ADDR_7_0 , addr_len, -ARRAY_SIZE (addr_len)); + ret =regmap_bulk_write (map,PAGE0_SWAUX_ADDR_7_0 , addr_len, +ARRAY_SIZE (addr_len)); +if (ret) { +DRM_DEV_ERROR (dev, +"failed to write AUX address %#x, len %zu: %d\n" , + msg->address, len, ret); +return ret; + }if (len && (request ==DP_AUX_NATIVE_WRITE || request ==DP_AUX_I2C_WRITE )) {
@@ -275,13 +281,22 @@ static ssize_t ps8640_aux_transfer_msg(struct drm_dp_aux *aux, } } -regmap_write (map,PAGE0_SWAUX_CTRL ,SWAUX_SEND ); + ret =regmap_write (map,PAGE0_SWAUX_CTRL ,SWAUX_SEND ); +if (ret) { +DRM_DEV_ERROR (dev,"failed to start AUX transfer: %d\n" , ret); +return ret; + }/* Zero delay loop because i2c transactions are slow already */ -regmap_read_poll_timeout (map,PAGE0_SWAUX_CTRL , data, - !(data &SWAUX_SEND ),0 ,50 *1000 ); + ret =regmap_read_poll_timeout (map,PAGE0_SWAUX_CTRL , data, + !(data &SWAUX_SEND ),0 ,50 *1000 ); +if (ret) { +DRM_DEV_ERROR (dev,"failed to complete AUX transfer: %d\n" , + ret); +return ret; + } -regmap_read (map,PAGE0_SWAUX_STATUS , &data); + ret =regmap_read (map,PAGE0_SWAUX_STATUS , &data);if (ret) {DRM_DEV_ERROR (dev,"failed to read PAGE0_SWAUX_STATUS: %d\n" , ret);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 11/181 net: hns3: fix speed configuration residue after driver reload
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jijie Shao <[email protected]>
[ Upstream commit 3860d8748af315bfee6fe669fddc1fc17d3214db ]
After setting a 100G optical port to 40G via ethtool and reloading the driver, the port remains at 40G instead of reverting to the firmware default speed of 100G.
The commit referenced in Fixes: added two overwrites in hclge_init_ae_dev() for non-copper media, so that optical ports connected to forced-mode remotes inherit the firmware-preset autoneg and speed instead of the hardcoded defaults:
req_autoneg = mac.autoneg
req_speed = mac.speed (when autoneg disabled)
The autoneg overwrite keeps existing behavior:hclge_set_autoneg_speed_dup() already uses mac.autoneg (not req_autoneg) since it was introduced, so autoneg inheritance from firmware was already in place. This part is kept.
The speed overwrite, however, introduces the residue: mac.speed reflects whatever was last programmed into the MAC, and after unload firmware does not restore the MAC speed to the flash default. So if the user changed speed via ethtool in a prior load, mac.speed still carries that value on reload and req_speed inherits it.
Fix by dropping the req_speed overwrite only. req_speed keeps the firmware default value set in hclge_configure() (cfg.default_speed), so a reload reverts the speed to default, matching the expectation that a driver reload resets link configuration.
Trade-off: on optical ports whose firmware default speed does not match a forced-mode remote, reload now drops the link and the user must re-apply ethtool configuration. This is acceptable: a driver reload is expected to reset link configuration, not to inherit runtime state from before unload. The autoneg inheritance is left in place as established behavior; changing it is out of scope for this patch and would itself be a user-perceivable behavior change.
--- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +1 -5
@@ -11930,12 +11930,8 @@ static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev)if (ret) goto err_ptp_uninit; -if (hdev->hw.mac.media_type !=HNAE3_MEDIA_TYPE_COPPER ) { +if (hdev->hw.mac.media_type !=HNAE3_MEDIA_TYPE_COPPER ) hdev->hw.mac.req_autoneg = hdev->hw.mac.autoneg; -if (hdev->hw.mac.autoneg ==AUTONEG_DISABLE && - hdev->hw.mac.speed !=SPEED_UNKNOWN ) - hdev->hw.mac.req_speed = hdev->hw.mac.speed; - } ret =hclge_set_autoneg_speed_dup (hdev);if (ret) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 12/181 Revert "net: thunderbolt: Enable end-to-end flow control also in transmit"
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Ye <[email protected]>
[ Upstream commit 1881f2efbf7f78dc0a79a387b29fde6ff56d3731 ]
This reverts commit a8065af3346ebd7c76ebc113451fb3ba94cf7769.
Per the USB4 spec, a Transmit Descriptor Ring with E2E flow control disabled does not require any credits to be available before the Host Interface Adapter Layer transmits a tunneled packet from it. Once E2E is enabled on that ring the controller must first obtain end-to-end credits.
The ASMedia ASM4242 USB4 host router (PCI 1b21:2425) never delivers those credits. The controller does accept the configuration: reading the ring OPTIONS register back right after tb_ring_start() returns exactly what was written, including RING_FLAG_E2E_FLOW_CONTROL (bit 28) and the E2E HopID field. No credit ever arrives though, so the Tx ring's hardware consumer index never advances and the link carries no traffic at all.
Measured on two hosts connected point to point, onboard ASM4242 on MSI X870E and X870, v6.17, stock drivers/net/thunderbolt/main.c with only this revert applied on top:
before: 100% packet loss to the peer; thunderbolt0 is up and the
XDomain handshake completes ("new host found"), but iperf3 fails with "No route to host" once the neighbour entry expires
after: 0% packet loss, 0.28 ms RTT; iperf3 4.21 Gb/s one way and
5.17 Gb/s the other (5 runs each, stddev <= 0.02), 1 retransmit in 10 s
An instrumented build additionally showed a frozen-Tx-consumer watchdog firing ~30k times in a 10 s window before this change.
Rx-side E2E is not touched by this revert, so peers that do return credits keep receive-side flow control.
ASMedia does not look like an isolated case. The out-of-tree thunderbolt-ibverbs project disables native E2E on AMD NHI by default, noting that "Strix Halo has reproduced TX completion wedges with multiple native E2E rings active" -- the same failure mode, on a different vendor. Since the driver has no way to tell in advance which host router returns the credits, going back to the previous behaviour looks safer than adding a quirk per affected part; Tx-side E2E can be reintroduced as an opt-in for controllers that are known to implement the credit return.
Note that the reverted commit was not fixing a reported problem, it was derived from the spec wording alone, so this revert is not expected to regress a known workload. Cc'ing the original author in case there was one.
--- drivers/net/thunderbolt/main.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
drivers/net/thunderbolt/main.c +7 -6
@@ -928,12 +928,8 @@ static int tbnet_open(struct net_device *dev)netif_carrier_off (dev); - flags =RING_FLAG_FRAME ; -/* Only enable full E2E if the other end supports it too */ -if (tbnet_e2e && net->svc->prtcstns &TBNET_E2E ) - flags |=RING_FLAG_E2E ; - - ring =tb_ring_alloc_tx (xd->tb->nhi,-1 ,TBNET_RING_SIZE , flags); + ring =tb_ring_alloc_tx (xd->tb->nhi,-1 ,TBNET_RING_SIZE , +RING_FLAG_FRAME );if (!ring) {netdev_err (dev,"failed to allocate Tx ring\n" );return -ENOMEM ;
@@ -952,6 +948,11 @@ static int tbnet_open(struct net_device *dev) sof_mask =BIT (TBIP_PDF_FRAME_START ); eof_mask =BIT (TBIP_PDF_FRAME_END ); + flags =RING_FLAG_FRAME ; +/* Only enable full E2E if the other end supports it too */ +if (tbnet_e2e && net->svc->prtcstns &TBNET_E2E ) + flags |=RING_FLAG_E2E ; + ring =tb_ring_alloc_rx (xd->tb->nhi,-1 ,TBNET_RING_SIZE , flags, net->tx_ring.ring->hop, sof_mask, eof_mask, tbnet_start_poll, net);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 13/181 bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei (Microsoft) <[email protected]>
[ Upstream commit 683c6ba6e58e6ed1037831ea97dd58d9c0e76b8d ]
bond_alb_monitor() reads primary_is_promisc under RCU, then drops RCU and takes RTNL via rtnl_trylock() before undoing the promiscuity it set on the active slave. In that window the active slave can change under RTNL (RTM_DELLINK -> __bond_release_one() -> bond_alb_handle_active_change()), which already drops the promiscuity and clears primary_is_promisc. The monitor still acts on the stale decision: if the slave was removed with no failover, curr_active_slave is now NULL and the deref faults; if it failed over, the stale dev_set_promiscuity(-1) underflows the new slave's promiscuity counter and pins it in IFF_PROMISC.
Oops: general protection fault, probably for non-canonical address ... KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] Workqueue: b42 bond_alb_monitor RIP: 0010:bond_alb_monitor (drivers/net/bonding/bond_alb.c:1600) process_one_work (kernel/workqueue.c:3322) worker_thread (kernel/workqueue.c:3486) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) Kernel panic - not syncing: Fatal exception
Re-check primary_is_promisc (and curr_active_slave) after taking RTNL so the monitor only undoes an increment it still owns. The other bonding monitors already re-read state under RTNL in their commit phase (bond_miimon_commit/bond_ab_arp_commit); bond_alb_monitor() was the only one acting on the pre-trylock decision.
--- drivers/net/bonding/bond_alb.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/net/bonding/bond_alb.c +6 -4
@@ -1535,8 +1535,8 @@ void bond_alb_monitor(struct work_struct *work) struct bonding *bond = container_of(work, struct bonding, alb_work.work);struct alb_bond_info *bond_info = &(BOND_ALB_INFO (bond)); +struct slave *slave, *curr;struct list_head *iter; -struct slave *slave;if (!bond_has_slaves (bond)) {atomic_set (&bond_info->tx_rebalance_counter,0 );
@@ -1598,9 +1598,11 @@ void bond_alb_monitor(struct work_struct *work)* because a slave was disabled then * it can now leave promiscuous mode. */ -dev_set_promiscuity (rtnl_dereference (bond->curr_active_slave)->dev, --1 ); - bond_info->primary_is_promisc =0 ; + curr =rtnl_dereference (bond->curr_active_slave); +if (bond_info->primary_is_promisc && curr) { +dev_set_promiscuity (curr->dev,-1 ); + bond_info->primary_is_promisc =0 ; + }rtnl_unlock ();rcu_read_lock ();
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 14/181 enic: fix tx_hang_reset use-after-free on device removal
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Satish Kharat <[email protected]>
[ Upstream commit ec680ea4ba1bca92a767fb7e7869758bfdd886e3 ]
enic_remove() cancels the reset and change_mtu_work items but does not cancel tx_hang_reset. A TX timeout that fires while the device is being removed can schedule enic_tx_hang_reset() so that it runs after free_netdev(), resulting in a use-after-free.
cancel_work_sync() alone is not sufficient here: the still-live watchdog and notify paths can re-schedule these work items in the window between the cancel and unregister_netdev(). Use disable_work_sync(), which cancels the work and blocks any subsequent schedule_work() from requeuing it, and apply it to the reset and change_mtu_work items as well so the same requeue race is closed for all teardown work.
--- drivers/net/ethernet/cisco/enic/enic_main.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/ethernet/cisco/enic/enic_main.c +3 -2
@@ -3141,8 +3141,9 @@ static void enic_remove(struct pci_dev *pdev)if (netdev) {struct enic *enic =netdev_priv (netdev); -cancel_work_sync (&enic->reset); -cancel_work_sync (&enic->change_mtu_work); +disable_work_sync (&enic->reset); +disable_work_sync (&enic->tx_hang_reset); +disable_work_sync (&enic->change_mtu_work);unregister_netdev (netdev);enic_dev_deinit (enic);vnic_dev_close (enic->vdev);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 15/181 net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shay Drory <[email protected]>
[ Upstream commit 6ddfba2ea98db21b001e0e5c472499156224650c ]
In case __mlx5e_add_fdb_flow() fails in lower levels, the flow is deleted via mlx5e_tc_del_flow(), and mlx5e_tc_del_flow() is acquiring ESW devcom lock without condition. In addition, in case of peer_flow, __mlx5e_add_fdb_flow() is called while holding ESW devcom comp lock. This results in an AA deadlock.
To fix this, introduce a new PEER flag that is set on flows created as peer flows (the duplicate flows on peer devices), and check it in mlx5e_tc_del_flow() before acquiring ESW devcom lock.
Lockdep splat:
============================================
WARNING: possible recursive locking detected
============================================
Possible unsafe locking scenario:
CPU0
----
lock(&comp->lock_key#2);
lock(&comp->lock_key#2);
*** DEADLOCK ***
Call Trace:
<TASK>
dump_stack_lvl+0x69/0xa0
print_deadlock_bug.cold+0xbd/0xca
__lock_acquire+0x1671/0x2ec0
lock_acquire+0x10e/0x2e0
down_read+0x95/0x430
mlx5_devcom_for_each_peer_begin+0x4e/0xe0 [mlx5_core]
mlx5e_tc_del_flow+0x11d/0xa70 [mlx5_core]
mlx5e_flow_put+0x99/0x100 [mlx5_core]
__mlx5e_add_fdb_flow+0x409/0xf00 [mlx5_core]
mlx5e_configure_flower+0x2a86/0x4100 [mlx5_core]
mlx5e_rep_setup_tc_cls_flower+0x12f/0x1b0 [mlx5_core]
mlx5e_rep_setup_tc_cb+0x153/0x750 [mlx5_core]
tc_setup_cb_add+0x1dc/0x470
fl_change+0x2f4d/0x626d [cls_flower]
tc_new_tfilter+0x79b/0x2310
rtnetlink_rcv_msg+0x778/0xad0
do_syscall_64+0x70/0x960
entry_SYSCALL_64_after_hwframe+0x4b/0x53
</TASK>--- drivers/net/ethernet/mellanox/mlx5/core/en/tc_priv.h | 1 + drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en/tc_priv.h +1 -0
@@ -30,6 +30,7 @@ enum {MLX5E_TC_FLOW_FLAG_FAILED =MLX5E_TC_FLOW_BASE +9 ,MLX5E_TC_FLOW_FLAG_SAMPLE =MLX5E_TC_FLOW_BASE +10 ,MLX5E_TC_FLOW_FLAG_USE_ACT_STATS =MLX5E_TC_FLOW_BASE +11 , + MLX5E_TC_FLOW_FLAG_PEER = MLX5E_TC_FLOW_BASE + 12, }; struct mlx5e_tc_flow_parse_attr {
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +3 -1
@@ -2161,7 +2161,8 @@ static void mlx5e_tc_del_flow(struct mlx5e_priv *priv,if (mlx5e_is_eswitch_flow (flow)) {struct mlx5_devcom_comp_dev *devcom = flow->priv->mdev->priv.eswitch->devcom; -if (!mlx5_devcom_for_each_peer_begin (devcom)) { +if (flow_flag_test (flow,PEER ) || + !mlx5_devcom_for_each_peer_begin (devcom)) {mlx5e_tc_del_fdb_flow (priv, flow);return ; }
@@ -4605,6 +4606,7 @@ static int mlx5e_tc_add_fdb_peer_flow(struct flow_cls_offload *f,else in_mdev = priv->mdev; + flow_flags |=BIT (MLX5E_TC_FLOW_FLAG_PEER ); parse_attr = flow->attr->parse_attr; peer_flow = __mlx5e_add_fdb_flow(peer_priv, f, flow_flags, parse_attr->filter_dev,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 16/181 pds_core: keep the health thread stopped during reset
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikhil P. Rao <[email protected]>
[ Upstream commit cd09971dcc1c499ae0879010a00e9dba87abdc4f ]
Commit d9407ff11809 ("pds_core: Prevent health thread from running during reset/remove") stops the health thread with cancel_work_sync() before a reset, but a devcmd timeout during pdsc_fw_down() re-queues health_work, so pdsc_health_thread() runs again mid-reset and double allocates the core DMA queues via pdsc_fw_up().
Only the reset path is affected: on remove PDSC_S_STOPPING_DRIVER gates the health thread and the workqueue is destroyed.
Use disable_work_sync() to cancel health_work and block further queue_work() on it, and enable_work() in pdsc_restart_health_thread() to re-allow it after the reset.
disable_work_sync() keeps a disable depth, so every disable must be matched by one enable. pdsc_reset_prepare() stops the health thread and pdsc_reset_done() restarts it. On the AER path pdsc_pci_error_detected() calls pdsc_reset_prepare(), then pdsc_pci_error_resume() re-inits via pci_reset_function_locked() (pds_core has no .slot_reset handler), which runs the pair again - stopping the thread twice but restarting it once. Gate the disable and enable on a health_stopped flag so each fires at most once per stopped/running transition.
--- drivers/net/ethernet/amd/pds_core/core.h | 1 + drivers/net/ethernet/amd/pds_core/main.c | 10 ++++++++-- 2 files changed, 9 insertions(+), 2 deletions(-)
drivers/net/ethernet/amd/pds_core/core.h +1 -0
@@ -170,6 +170,7 @@ struct pdsc {struct timer_list wdtimer;unsigned int wdtimer_period;struct work_struct health_work; +bool health_stopped;struct devlink_health_reporter *fw_reporter;u32 fw_recoveries;
drivers/net/ethernet/amd/pds_core/main.c +8 -2
@@ -464,8 +464,10 @@ static void pdsc_stop_health_thread(struct pdsc *pdsc)return ;timer_shutdown_sync (&pdsc->wdtimer); -if (pdsc->health_work.func) -cancel_work_sync (&pdsc->health_work); +if (pdsc->health_work.func && !pdsc->health_stopped) { +disable_work_sync (&pdsc->health_work); + pdsc->health_stopped = true; + } }static void pdsc_restart_health_thread (struct pdsc *pdsc)
@@ -473,6 +475,10 @@ static void pdsc_restart_health_thread(struct pdsc *pdsc)if (pdsc->pdev->is_virtfn)return ; +if (pdsc->health_stopped) { +enable_work (&pdsc->health_work); + pdsc->health_stopped = false; + }timer_setup (&pdsc->wdtimer, pdsc_wdtimer_cb,0 );mod_timer (&pdsc->wdtimer, jiffies +1 ); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 17/181 pds_core: cancel pending PCI reset work on AER recovery
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikhil P. Rao <[email protected]>
[ Upstream commit 57d635329d799b79096155cdf47ee0013d6780d1 ]
pdsc_check_pci_health() queues pci_reset_work when it sees a broken PCI connection, and nothing cancels it. When the PCI core starts AER recovery, pdsc_pci_error_detected() runs pdsc_reset_prepare() and recovers the device, but a pci_reset_work queued just before is left pending. If it runs after recovery released the device lock, it resets a device the driver now considers healthy, bouncing the link for no reason.
Cancel pci_reset_work in pdsc_pci_error_detected() after pdsc_reset_prepare(), which has already stopped the health thread so it cannot requeue the work. cancel_work_sync() is safe under the device lock here because pdsc_pci_reset_thread() uses pci_try_reset_function(), which returns instead of blocking on the lock. Only PFs initialize pci_reset_work, so guard the cancel with !is_virtfn.
--- drivers/net/ethernet/amd/pds_core/main.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/amd/pds_core/main.c +4 -0
@@ -550,7 +550,11 @@ static pci_ers_result_t pdsc_pci_error_detected(struct pci_dev *pdev, pci_channel_state_t error) {if (error == pci_channel_io_frozen) { +struct pdsc *pdsc =pci_get_drvdata (pdev); +pdsc_reset_prepare (pdev); +if (!pdev->is_virtfn) +cancel_work_sync (&pdsc->pci_reset_work);return PCI_ERS_RESULT_NEED_RESET ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 18/181 netfilter: ipset: switch ext_size to atomic64_t
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jozsef Kadlecsik <[email protected]>
[ Upstream commit 712a6f545c359b427daa9a5a782e30d2f8331e25 ]
The hash types do not acquire set->lock, they use 'region locking' where only part of the hash table is locked. Parallel inserts and deletes are possible and CPUs can race on ->ext_size update. Switch to atomic64_t.
This leaves another bug unresolved: there still can be a race on comment extension re-init. This will be handled in a later commit when converting to rhashtable backend.
--- include/linux/netfilter/ipset/ip_set.h | 2 +- net/netfilter/ipset/ip_set_bitmap_gen.h | 4 ++-- net/netfilter/ipset/ip_set_core.c | 6 +++--- net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipset/ip_set_list_set.c | 4 ++-- 5 files changed, 9 insertions(+), 9 deletions(-)
include/linux/netfilter/ipset/ip_set.h +1 -1
@@ -273,7 +273,7 @@ struct ip_set {/* Number of elements (vs timeout) */ u32 elements;/* Size of the dynamic extensions (vs timeout) */ -size_t ext_size; +atomic64_t ext_size;/* Element data size */ size_t dsize;/* Offsets to extensions in elements */
net/netfilter/ipset/ip_set_bitmap_gen.h +2 -2
@@ -77,7 +77,7 @@ mtype_flush(struct ip_set *set)mtype_ext_cleanup (set);bitmap_zero (map->members, map->elements); set->elements =0 ; - set->ext_size =0 ; +atomic64_set (&set->ext_size,0 ); }/* Calculate the actual memory size of the set data */
@@ -93,7 +93,7 @@ mtype_head(struct ip_set *set, struct sk_buff *skb) {const struct mtype *map = set->data;struct nlattr *nested; -size_t memsize =mtype_memsize (map, set->dsize) + set->ext_size; +size_t memsize =mtype_memsize (map, set->dsize) +atomic64_read (&set->ext_size); nested =nla_nest_start (skb,IPSET_ATTR_DATA );if (!nested)
net/netfilter/ipset/ip_set_core.c +3 -3
@@ -350,7 +350,7 @@ ip_set_init_comment(struct ip_set *set, struct ip_set_comment *comment,size_t len = ext->comment ?strlen (ext->comment) :0 ;if (unlikely (c)) { - set->ext_size -=sizeof (*c) +strlen (c->str) +1 ; +atomic64_sub (sizeof (*c) +strlen (c->str) +1 , &set->ext_size);rcu_assign_pointer (comment->c,NULL );kfree_rcu (c, rcu); }
@@ -362,7 +362,7 @@ ip_set_init_comment(struct ip_set *set, struct ip_set_comment *comment,if (unlikely (!c))return ;strscpy (c->str, ext->comment, len +1 ); - set->ext_size +=sizeof (*c) +strlen (c->str) +1 ; +atomic64_add (sizeof (*c) +strlen (c->str) +1 , &set->ext_size);rcu_assign_pointer (comment->c, c); }EXPORT_SYMBOL_GPL (ip_set_init_comment);
@@ -392,7 +392,7 @@ ip_set_comment_free(struct ip_set *set, void *ptr) c =rcu_dereference_protected (comment->c,1 );if (unlikely (!c))return ; - set->ext_size -=sizeof (*c) +strlen (c->str) +1 ; +atomic64_sub (sizeof (*c) +strlen (c->str) +1 , &set->ext_size);rcu_assign_pointer (comment->c,NULL );kfree_rcu (c, rcu); }
net/netfilter/ipset/ip_set_hash_gen.h +1 -1
@@ -1289,7 +1289,7 @@ mtype_head(struct ip_set *set, struct sk_buff *skb)rcu_read_lock_bh (); t =rcu_dereference_bh (h->table);mtype_ext_size (set, &elements, &ext_size); - memsize =mtype_ahash_memsize (h, t) + ext_size + set->ext_size; + memsize =mtype_ahash_memsize (h, t) + ext_size +atomic64_read (&set->ext_size); htable_bits = t->htable_bits;rcu_read_unlock_bh ();
net/netfilter/ipset/ip_set_list_set.c +2 -2
@@ -421,7 +421,7 @@ list_set_flush(struct ip_set *set)list_for_each_entry_safe (e, n, &map->members, list)list_set_del (set, e); set->elements =0 ; - set->ext_size =0 ; +atomic64_set (&set->ext_size,0 ); } static void
@@ -455,7 +455,7 @@ list_set_head(struct ip_set *set, struct sk_buff *skb) {const struct list_set *map = set->data;struct nlattr *nested; -size_t memsize =list_set_memsize (map, set->dsize) + set->ext_size; +size_t memsize =list_set_memsize (map, set->dsize) +atomic64_read (&set->ext_size); nested =nla_nest_start (skb,IPSET_ATTR_DATA );if (!nested)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 19/181 ipvs: avoid out-of-bounds write in ip_vs_nat_icmp
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Anastasov <[email protected]>
[ Upstream commit 646922a0379496154e8c8faca4f8e2fd9100cacc ]
Sashiko warns that local attacker can modify the packet while it is processed by IPVS. Some places read the IP ihl field multiple times which can cause out-of-bounds access. One such place is ip_vs_nat_icmp where we can write after the validated area.
Fix it by providing ciph argument just like it is done for IPv6 and use ciph->len as offset to the embedded transport header.
Modify some IPv4 header checks by reading the ihl field only once.
--- include/net/ip_vs.h | 2 +- net/netfilter/ipvs/ip_vs_core.c | 67 +++++++++++++++++---------------- net/netfilter/ipvs/ip_vs_xmit.c | 2 +- 3 files changed, 36 insertions(+), 35 deletions(-)
include/net/ip_vs.h +1 -1
@@ -1707,7 +1707,7 @@ static inline char ip_vs_fwd_tag(struct ip_vs_conn *cp)void ip_vs_nat_icmp (struct sk_buff *skb,struct ip_vs_protocol *pp,struct ip_vs_conn *cp,int dir,unsigned int toff, -bool has_ports); +bool has_ports,struct ip_vs_iphdr *ciph);#ifdef CONFIG_IP_VS_IPV6 void ip_vs_nat_icmp_v6(struct sk_buff *skb, struct ip_vs_protocol *pp,
net/netfilter/ipvs/ip_vs_core.c +34 -33
180 lines not on this page · raw message
net/netfilter/ipvs/ip_vs_xmit.c +1 -1
@@ -1577,7 +1577,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,if (skb_cow (skb, rt->dst.dev->hard_header_len)) goto tx_error; -ip_vs_nat_icmp (skb, pp, cp,0 , toff, has_ports); +ip_vs_nat_icmp (skb, pp, cp,0 , toff, has_ports, ciph);/* Another hack: avoid icmp_send in ip_fragment */ skb->ignore_df =1 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 20/181 ipvs: return the csum validation for forward hook
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Anastasov <[email protected]>
[ Upstream commit 99609cb0aa789c8d071050ce8579989551882cc6 ]
Sashiko notes that playing games with the skb dst and rt flags instead of providing hooknum is not a good idea when validating the checksums.
Also, skipping checksum validation for FORWARD packets risk silent data corruption, even if the only user is the FTP-CMD packets coming from the real server.
Sashiko also noticed that by using common checksum helper in the previous commit we actually fixed old bug where the TCP/UDP checksum for IPv6 on CHECKSUM_COMPLETE was not validated correctly.
--- include/net/ip_vs.h | 19 +++++-------------- net/netfilter/ipvs/ip_vs_proto_sctp.c | 2 +- 2 files changed, 6 insertions(+), 15 deletions(-)
include/net/ip_vs.h +5 -14
@@ -24,9 +24,7 @@#include <linux/netfilter.h> /* for union nf_inet_addr */ #include <linux/ip.h> #include <linux/ipv6.h> /* for struct ipv6hdr */ -#include <net/route.h> #include <net/ipv6.h> -#include <net/ip6_fib.h> #if IS_ENABLED (CONFIG_NF_CONNTRACK )#include <net/netfilter/nf_conntrack.h> #endif
@@ -1740,30 +1738,23 @@ static inline __wsum ip_vs_check_diff2(__be16 old, __be16 new, __wsum oldsum)return csum_partial (diff,sizeof (diff), oldsum); } -static inline bool ip_vs_checksum_needed (struct sk_buff *skb,int af) +static inline bool ip_vs_checksum_needed (struct sk_buff *skb) {/* Checksum unnecessary or already validated? */ if (skb_csum_unnecessary (skb))return false; -/* LOCAL_OUT ? */ -if (!skb->dev || skb->dev->flags &IFF_LOOPBACK ) +/* Locally generated ? */ +if (!skb->dev)return false; -/* !LOCAL_IN (FORWARD) ? */ -if (af ==AF_INET6 ) { -if (!(dst_rt6_info (skb_dst (skb))->rt6i_flags &RTF_LOCAL )) -return false; - }else { -if (!(skb_rtable (skb)->rt_flags &RTCF_LOCAL )) -return false; - }return true; }static inline bool ip_vs_checksum_common_check (struct sk_buff *skb,int offset,int proto,int af) { -if (!ip_vs_checksum_needed (skb, af)) +if (!ip_vs_checksum_needed (skb))return true; +/* Validate csum even for FORWARD */ return !nf_checksum (skb,NF_INET_LOCAL_IN , offset, proto, af); }
net/netfilter/ipvs/ip_vs_proto_sctp.c +1 -1
@@ -193,7 +193,7 @@ sctp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp,struct sctphdr *sh;__le32 cmp, val; -if (!ip_vs_checksum_needed (skb, af)) +if (!ip_vs_checksum_needed (skb))return 1 ; sh = (struct sctphdr *)(skb->data + sctphoff); cmp = sh->checksum;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 21/181 watchdog: bd96801_wdt: Fix timeout for enabled WDG
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matti Vaittinen <[email protected]>
[ Upstream commit 1246aa2b6ccc8944676bd24ff3e37cc56b93b51b ]
When watchdog is enabled at the probe time, the bd96801 driver retrieves the timeout configuration from the registers to set-up the heart-beat values.
As Sashiko pointed out at
https://lore.kernel.org/all/[email protected]/
the timeout values are incorrectly computed in driver, resulting wrong heartbeat. This leads to devere problems if watchdog was enabled at probe time.
According to the data-sheet, the "too fast" ping limit is configured as multiple of FASTNG_MIN. Furthermore, the "too slow" ping limit is configured as multiples of "too fast" timeout. The FASTNG_MIN is set to 11, meaning 1.1 mS and "too fast" and "too slow" limits are computed from this. Hence, converting the limits to mS should be done by dividing by 10, not by dividing by USEC_PER_MSEC.
Fix this by dividing the timeout values with correct scaling factor.
While at it, fix whitespace problem (double empty line).
--- drivers/watchdog/bd96801_wdt.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/watchdog/bd96801_wdt.c +2 -3
@@ -169,7 +169,6 @@ static int bd96801_set_wdt_mode(struct wdtbd96801 *w, unsigned int hw_margin,int fastng, slowng, type, ret, reg, mask;struct device *dev = w->dev; -if (hw_margin_min *1000 >FASTNG_MAX_US ) {dev_err (dev,"Unsupported fast timeout %u uS [max %u]\n" , hw_margin_min *1000 ,FASTNG_MAX_US );
@@ -258,10 +257,10 @@ static int bd96801_set_heartbeat_from_hw(struct wdtbd96801 *w, fast =FASTNG_MIN << sel; sel = (val &BD96801_WD_RATIO_MASK ) +1 ; - w->wdt.max_hw_heartbeat_ms = (fast << sel) /USEC_PER_MSEC ; + w->wdt.max_hw_heartbeat_ms = (fast << sel) /10 ;if ((conf_reg &BD96801_WD_TYPE_MASK ) ==BD96801_WD_TYPE_WIN ) - w->wdt.min_hw_heartbeat_ms = fast /USEC_PER_MSEC ; + w->wdt.min_hw_heartbeat_ms = fast /10 ;return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 22/181 btrfs: fix memory leak in btrfs_do_encoded_write()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit d2a4e4e626b2f4670b69b430c357f03f53eb6632 ]
Local fuzzing of 6.12.94 has found the following memory leak:
Unreferenced object 0xffff888018050a80 (size 64):
comm "syz.0.17", pid 10297, jiffies 4294953601 hex dump (first 32 bytes):
00 10 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................
10 0a 05 18 80 88 ff ff 10 0a 05 18 80 88 ff ff ................
backtrace (crc a8a6fc29):
kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
slab_post_alloc_hook mm/slub.c:4152 [inline]
slab_alloc_node mm/slub.c:4197 [inline]
__kmalloc_cache_noprof+0x168/0x2c0 mm/slub.c:4358
kmalloc_noprof include/linux/slab.h:878 [inline]
extent_changeset_alloc fs/btrfs/extent_io.h:207 [inline]
qgroup_reserve_data+0x1c5/0x7d0 fs/btrfs/qgroup.c:4305
btrfs_qgroup_reserve_data+0x2e/0xb0 fs/btrfs/qgroup.c:4355
btrfs_do_encoded_write+0x92e/0x1040 fs/btrfs/inode.c:9746
btrfs_encoded_write fs/btrfs/file.c:1482 [inline]
btrfs_do_write_iter+0x280/0x610 fs/btrfs/file.c:1507
btrfs_ioctl_encoded_write+0x3d6/0x490 fs/btrfs/ioctl.c:4738
btrfs_ioctl+0x6f9/0xc90 fs/btrfs/ioctl.c:-1
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl+0xf9/0x170 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/common.c:47 [inline]
do_syscall_64+0xbe/0x1a0 arch/x86/entry/common.c:78
entry_SYSCALL_64_after_hwframe+0x77/0x7fUnreferenced object 0xffff888018050a00 (size 64):
comm "syz.0.17", pid 10297, jiffies 4294953601 hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 ff 0f 00 00 00 00 00 00 ................
90 0a 05 18 80 88 ff ff 90 0a 05 18 80 88 ff ff ................
backtrace (crc cb5c9580):
kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
slab_post_alloc_hook mm/slub.c:4152 [inline]
slab_alloc_node mm/slub.c:4197 [inline]
__kmalloc_cache_noprof+0x168/0x2c0 mm/slub.c:4358
kmalloc_noprof include/linux/slab.h:878 [inline]
kzalloc_noprof include/linux/slab.h:1014 [inline]
ulist_prealloc+0x9c/0x110 fs/btrfs/ulist.c:114
extent_changeset_prealloc fs/btrfs/extent_io.h:217 [inline]
__set_extent_bit+0x16b/0x1a70 fs/btrfs/extent-io-tree.c:1086
set_record_extent_bits+0x50/0x90 fs/btrfs/extent-io-tree.c:1821
qgroup_reserve_data+0x274/0x7d0 fs/btrfs/qgroup.c:4312
btrfs_qgroup_reserve_data+0x2e/0xb0 fs/btrfs/qgroup.c:4355
btrfs_do_encoded_write+0x92e/0x1040 fs/btrfs/inode.c:9746
btrfs_encoded_write fs/btrfs/file.c:1482 [inline]
btrfs_do_write_iter+0x280/0x610 fs/btrfs/file.c:1507
btrfs_ioctl_encoded_write+0x3d6/0x490 fs/btrfs/ioctl.c:4738
btrfs_ioctl+0x6f9/0xc90 fs/btrfs/ioctl.c:-1
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl+0xf9/0x170 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/common.c:47 [inline]
do_syscall_64+0xbe/0x1a0 arch/x86/entry/common.c:78
entry_SYSCALL_64_after_hwframe+0x77/0x7fFix this by freeing an extent changeset before returning from btrfs_do_encoded_write().
--- fs/btrfs/inode.c | 1 + 1 file changed, 1 insertion(+)
fs/btrfs/inode.c +1 -0
@@ -9684,6 +9684,7 @@ ssize_t btrfs_do_encoded_write(struct kiocb *iocb, struct iov_iter *from, }kvfree (folios); out: +extent_changeset_free (data_reserved);if (ret >=0 ) iocb->ki_pos += encoded->len;return ret;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 23/181 bpf: Preserve pointer state for commuted arithmetic
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yiyang Chen <[email protected]>
[ Upstream commit a4c6f804b44c5c790269b25e0e61cf4e9f117c86 ]
When scalar += pointer is handled in adjust_ptr_min_max_vals(), the destination register inherits the pointer state from the source pointer. Copying only selected fields is fragile because pointer provenance is tracked by several bpf_reg_state fields.
Use the caller's temporary offset register to preserve the scalar operand while replacing the destination with the full pointer state. This preserves the frame number for PTR_TO_STACK registers and keeps parent identity fields consistent.
--- kernel/bpf/verifier.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
kernel/bpf/verifier.c +8 -7
@@ -13565,11 +13565,12 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,return -EACCES ; } -/* In case of 'scalar += pointer', dst_reg inherits pointer type and id. -* The id may be overwritten later if we create a new variable offset. +/* For 'scalar += pointer', dst_reg inherits the complete pointer +* register state. Individual fields may be adjusted later by pointer +* arithmetic. Callers guarantee that below does not overwrite off_reg. */ - dst_reg->type = ptr_reg->type; - dst_reg->id = ptr_reg->id; +if (dst_reg != ptr_reg) + *dst_reg = *ptr_reg;if (!check_reg_sane_offset (env, off_reg, ptr_reg->type) || !check_reg_sane_offset (env, ptr_reg, ptr_reg->type))
@@ -13631,7 +13632,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, }break ;case BPF_SUB : -if (dst_reg == off_reg) { +if (dst_reg != ptr_reg) {/* scalar -= pointer. Creates an unknown scalar */ verbose (env,"R%d tried to subtract pointer from scalar\n" , dst);
@@ -14490,8 +14491,8 @@ static int adjust_reg_min_max_vals(struct bpf_verifier_env *env, err =mark_chain_precision (env, insn->dst_reg);if (err)return err; -return adjust_ptr_min_max_vals (env, insn, - src_reg, dst_reg); + off_reg = *dst_reg; +return adjust_ptr_min_max_vals (env, insn, src_reg, &off_reg); } }else if (ptr_reg) {/* pointer += scalar */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 24/181 net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mahanta Jambigi <[email protected]>
[ Upstream commit 976245094925bab9bc39366b2e9ab44ffcde61d0 ]
The SMC_LLC_CONFIRM_LINK / SMC_LLC_ADD_LINK_CONT branch in smc_llc_event_handler() stores an incoming qentry into the local LLC flow without first checking whether a qentry is already pending. If a malicious or buggy peer sends a second CONFIRM_LINK or ADD_LINK_CONT request while a flow is active and flow->qentry is already set, smc_llc_flow_qentry_set() overwrites the pointer without freeing the previous allocation, leaking one kmalloc-96 object per spurious message.
The sibling SMC_LLC_DELETE_LINK branch already has the correct !flow->qentry guard. Apply the same guard to the CONFIRM_LINK/ADD_LINK_CONT branch so that a duplicate message when qentry is already occupied falls through to break and is freed by the kfree(qentry) at the out: label, rather than silently leaking the existing allocation.
The response direction (smc_llc_rx_response()) is unaffected: it already guards with flow->qentry at the equivalent site and drops duplicate responses correctly.
--- net/smc/smc_llc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/smc/smc_llc.c +2 -1
@@ -1918,7 +1918,8 @@ static void smc_llc_event_handler(struct smc_llc_qentry *qentry)return ;case SMC_LLC_CONFIRM_LINK :case SMC_LLC_ADD_LINK_CONT : -if (lgr->llc_flow_lcl.type !=SMC_LLC_FLOW_NONE ) { +if (lgr->llc_flow_lcl.type !=SMC_LLC_FLOW_NONE && + !lgr->llc_flow_lcl.qentry) {/* a flow is waiting for this message */ smc_llc_flow_qentry_set (&lgr->llc_flow_lcl, qentry);wake_up (&lgr->llc_msg_waiter);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 25/181 net/sched: cls_route: fix fastmap use-after-free on filter
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <[email protected]>
[ Upstream commit 47d7f7051253bdc02b1d245d87e38f16d31a74df ]
The route4 classifier maintains a 16-slot fastmap cache that stores raw struct route4_filter pointers indexed by (id, iif). The reader (route4_classify) populates this cache via route4_set_fastmap() for every classified packet that hits a filter. The writer (route4_delete, route4_change) clears the cache via route4_reset_fastmap() before RCU-deferred kfree of the filter.
This creates a UAF race:
1. Reader walks the RCU-protected bucket chain, finds filter f
2. Writer unlinks f, calls route4_reset_fastmap(), then tcf_queue_work()
3. Reader calls route4_set_fastmap() and writes f into the cache *after* the writer's reset, caching a pointer about to be freed
4. After the RCU grace period, kfree(f) executes
5. Next classified packet on the same (id, iif) tuple hits the stale
fastmap entry and reads f->res from freed memory
Reproduced with an mdelay(100) accelerator in route4_set_fastmap() and a concurrent add/delete stress test (provided by both zdi and Santosh). Both triggered KASAN slab-use-after-free reports in the route4 fastmap paths.
Fix:
Introduce a per-filter boolean dying flag to suppress stale fastmap republishing by in-flight readers.
--- net/sched/cls_route.c | 35 ++++++++++++++++++++++++++--------- 1 file changed, 26 insertions(+), 9 deletions(-)
net/sched/cls_route.c +26 -9
@@ -52,6 +52,7 @@ struct route4_filter {struct tcf_result res;struct tcf_exts exts;u32 handle; +bool dying;struct route4_bucket *bkt;struct tcf_proto *tp;struct rcu_work rwork;
@@ -66,9 +67,11 @@ static inline int route4_fastmap_hash(u32 id, int iif)static DEFINE_SPINLOCK (fastmap_lock);static void -route4_reset_fastmap (struct route4_head *head) +route4_reset_fastmap (struct route4_head *head,struct route4_filter *f) {spin_lock_bh (&fastmap_lock); +if (f) + f->dying = true;memset (head->fastmap,0 ,sizeof (head->fastmap));spin_unlock_bh (&fastmap_lock); }
@@ -81,9 +84,11 @@ route4_set_fastmap(struct route4_head *head, u32 id, int iif,/* fastmap updates must look atomic to aling id, iff, filter */ spin_lock_bh (&fastmap_lock); - head->fastmap[h].id = id; - head->fastmap[h].iif = iif; - head->fastmap[h].filter = f; +if (f ==ROUTE4_FAILURE || !f->dying) { + head->fastmap[h].id = id; + head->fastmap[h].iif = iif; + head->fastmap[h].filter = f; + }spin_unlock_bh (&fastmap_lock); }
@@ -297,6 +302,13 @@ static void route4_destroy(struct tcf_proto *tp, bool rtnl_held, next =rtnl_dereference (f->next);RCU_INIT_POINTER (b->ht[h2], next);tcf_unbind_filter (tp, &f->res); +/* Mark the filter dying under fastmap_lock so +* any in-flight reader that still holds it +* will skip the republish in route4_set_fastmap(). +*/ +spin_lock_bh (&fastmap_lock); + f->dying = true; +spin_unlock_bh (&fastmap_lock);if (tcf_exts_get_net (&f->exts))route4_queue_work (f);else
@@ -307,6 +319,11 @@ static void route4_destroy(struct tcf_proto *tp, bool rtnl_held,kfree_rcu (b, rcu); } } + +/* All filters are unlinked and marked dying, so no in-flight +* reader can republish a stale entry after this reset. +*/ +route4_reset_fastmap (head,NULL );kfree_rcu (head, rcu); }
@@ -334,11 +351,11 @@ static int route4_delete(struct tcf_proto *tp, void *arg, bool *last,/* unlink it */ RCU_INIT_POINTER (*fp,rtnl_dereference (f->next)); -/* Remove any fastmap lookups that might ref filter -* notice we unlink'd the filter so we can't get it -* back in the fastmap. +/* Clear any fastmap entries that may ref this filter and +* mark it dying so in-flight readers can't republish it +* after the reset. */ -route4_reset_fastmap (head); +route4_reset_fastmap (head, f);/* Delete it */ tcf_unbind_filter (tp, &f->res);
@@ -558,7 +575,7 @@ static int route4_change(struct net *net, struct sk_buff *in_skb, } } -route4_reset_fastmap (head); +route4_reset_fastmap (head, fold); *arg = f;if (fold) {tcf_unbind_filter (tp, &fold->res);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 26/181 net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiawen Liu <[email protected]>
[ Upstream commit f307a7dc32097c11413178fca437a10d20890bc2 ]
hix5hd2_dev_remove() calls netif_napi_del() before unregister_netdev(). This is not needed because free_netdev() deletes all NAPI instances attached to the net_device.
Remove the redundant call and let the networking core tear down the NAPI instance during unregister_netdev(). The probe error path still keeps its explicit netif_napi_del(), because the device has not been registered there.
--- drivers/net/ethernet/hisilicon/hix5hd2_gmac.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/ethernet/hisilicon/hix5hd2_gmac.c +0 -1
@@ -1282,7 +1282,6 @@ static void hix5hd2_dev_remove(struct platform_device *pdev)struct net_device *ndev =platform_get_drvdata (pdev);struct hix5hd2_priv *priv =netdev_priv (ndev); -netif_napi_del (&priv->napi);unregister_netdev (ndev);mdiobus_unregister (priv->bus);mdiobus_free (priv->bus);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 27/181 devlink: fix net namespace reference leak in reload
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Or Har-Toov <[email protected]>
[ Upstream commit 1c4dac9bf1d2ac31da63b794bdec697777cbd0fd ]
devlink_nl_reload_doit() calls devlink_netns_get(), which returns a net with a held reference. When the requested namespace differs from the current one and the reload action is not DRIVER_REINIT, the function returns -EOPNOTSUPP without releasing the reference. Add the missing put_net() on this error path.
--- net/devlink/dev.c | 1 + 1 file changed, 1 insertion(+)
net/devlink/dev.c +1 -0
@@ -579,6 +579,7 @@ int devlink_nl_reload_doit(struct sk_buff *skb, struct genl_info *info) action != DEVLINK_RELOAD_ACTION_DRIVER_REINIT) {NL_SET_ERR_MSG_MOD (info->extack,"Changing namespace is only supported for reinit action" ); +put_net (dest_net);return -EOPNOTSUPP ; } }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 28/181 net/mlx5: fw_tracer, return NULL on create error
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Guralnik <[email protected]>
[ Upstream commit af39eb111ce6b5eba9c08513b62c4868eb7e7fd5 ]
Tracer creation can fail by returning either NULL or ERR_PTR. The return value is stored without a check on the device, and users treat ERR_PTR and NULL the same way.
This also causes a crash in the core dump logic, which is missing the ERR_PTR check and ends up dereferencing it, as shown in the trace below.
Switch tracer creation to return NULL on failure only, so callers only need a single NULL check.
Internal error: Oops: 0000000096000006 [#1] SMP Modules linked in: mlx5_ib ib_uverbs ib_core ipv6 mlx5_core CPU: 1 UID: 0 PID: 12 Comm: kworker/u16:0 Not tainted 6.19.7 #1 PREEMPT(none) Workqueue: mlx5_health0001:01:00.0 mlx5_fw_reporter_err_work [mlx5_core] pstate: a3400009 (NzCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : mlx5_fw_tracer_trigger_core_dump_general+0x58/0xe0 [mlx5_core] lr : mlx5_fw_tracer_trigger_core_dump_general+0x40/0xe0 [mlx5_core] sp : ffff800081cf3c40 x29: ffff800081cf3c90 x28: 0000000000000000 x27: 0000000000000000 x26: ffff000080018828 x25: 0000000000000000 x24: ffff000080304a05 x23: ffff800081cf3d80 x22: ffff0000847e01a0 x21: 0000000000000000 x20: ffff0000847e01a0 x19: ffffffffffffffa1 x18: ffff80008310bbf0 x17: ffff800080119650 x16: ffff80008010df54 x15: ffff80008010d4ac x14: ffff800079c202e4 x13: ffff80008002fe60 x12: ffff800080119650 x11: ffff80008010df54 x10: ffff80008010d4ac x9 : ffff800079c203d8 x8 : ffff800081cf3c88 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000008 x3 : 0000000000000030 x2 : 0000000000000008 x1 : 0000000000000000 x0 : 00000000c5c4000e Call trace: mlx5_fw_tracer_trigger_core_dump_general+0x58/0xe0 [mlx5_core] (P) mlx5_fw_reporter_dump+0x30/0x2e0 [mlx5_core] devlink_health_do_dump+0x9c/0x160 devlink_health_report+0x1c0/0x288 mlx5_fw_reporter_err_work+0xac/0xc0 [mlx5_core] process_one_work+0x15c/0x3d8 worker_thread+0x18c/0x320 kthread+0x148/0x228 ret_from_fork+0x10/0x20 Code: b9400000 5ac00800 7a401800 540003ca (3940a260) ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: Oops: Fatal exception SMP: stopping secondary CPUs Kernel Offset: disabled CPU features: 0x000000,00078031,75fce5a1,35fffe67 Memory Limit: none ---[ end Kernel panic - not syncing: Oops: Fatal exception ]---
--- .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c +7 -9
@@ -1025,13 +1025,11 @@ struct mlx5_fw_tracer *mlx5_fw_tracer_create(struct mlx5_core_dev *dev) tracer =kvzalloc (sizeof (*tracer),GFP_KERNEL );if (!tracer) -return ERR_PTR (-ENOMEM ); +return NULL ; tracer->work_queue =create_singlethread_workqueue ("mlx5_fw_tracer" ); -if (!tracer->work_queue) { - err = -ENOMEM ; +if (!tracer->work_queue) goto free_tracer; - } tracer->dev = dev;
@@ -1073,7 +1071,7 @@ struct mlx5_fw_tracer *mlx5_fw_tracer_create(struct mlx5_core_dev *dev)destroy_workqueue (tracer->work_queue); free_tracer:kvfree (tracer); -return ERR_PTR (err); +return NULL ; }static int fw_tracer_event (struct notifier_block *nb,unsigned long action,void *data);
@@ -1084,7 +1082,7 @@ int mlx5_fw_tracer_init(struct mlx5_fw_tracer *tracer)struct mlx5_core_dev *dev;int err; -if (IS_ERR_OR_NULL (tracer)) +if (!tracer)return 0 ;if (!tracer->str_db.loaded)
@@ -1134,7 +1132,7 @@ int mlx5_fw_tracer_init(struct mlx5_fw_tracer *tracer)/* Stop tracer + Cleanup HW resources */ void mlx5_fw_tracer_cleanup (struct mlx5_fw_tracer *tracer) { -if (IS_ERR_OR_NULL (tracer)) +if (!tracer)return ;mutex_lock (&tracer->state_lock);
@@ -1163,7 +1161,7 @@ void mlx5_fw_tracer_cleanup(struct mlx5_fw_tracer *tracer)/* Free software resources (Buffers, etc ..) */ void mlx5_fw_tracer_destroy (struct mlx5_fw_tracer *tracer) { -if (IS_ERR_OR_NULL (tracer)) +if (!tracer)return ;mlx5_core_dbg (tracer->dev,"FWTracer: Destroy\n" );
@@ -1215,7 +1213,7 @@ int mlx5_fw_tracer_reload(struct mlx5_fw_tracer *tracer)struct mlx5_core_dev *dev;int err; -if (IS_ERR_OR_NULL (tracer)) +if (!tracer)return 0 ; dev = tracer->dev;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 29/181 counter: microchip-tcb-capture: Fix DT channel validation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Babanpreet Singh <[email protected]>
[ Upstream commit f1a3a9946aab611dd2200c01ff122f64b033dad2 ]
mchp_tc_probe() reads the devicetree "reg" cell - a u32, per the API contract of of_property_read_u32_index() - into a signed int, so the bounds check "channel > 2" fails to reject cell values at or above 0x80000000: reinterpreted as a negative int, they compare below 2 and pass validation.
A malformed devicetree can therefore drive a negative channel into the ATMEL_TC_REG() offset arithmetic, making the driver access syscon regmap offsets outside the TC block's register window, and into the "t%d_clk" clock-name formatting, where it truncates clk_name (sized for "t0_clk".."t2_clk").
Declare channel as u32, matching the API contract; the unsigned comparison then rejects everything except channels 0..2. Adjust the format specifier to %u accordingly, which also resolves the W=1 warning that exposed the gap:
microchip-tcb-capture.c:520:56: warning: '%d' directive output may
be truncated writing between 1 and 11 bytes into a region of size 6 [-Wformat-truncation=]
note: directive argument in the range [-2147483648, 2]
No behavior change for well-formed devicetrees: channels 0..2 take identical paths before and after.
--- drivers/counter/microchip-tcb-capture.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/counter/microchip-tcb-capture.c +2 -2
@@ -309,7 +309,7 @@ static int mchp_tc_probe(struct platform_device *pdev)char clk_name[7 ];struct regmap *regmap;struct clk *clk[3 ]; -int channel; +u32 channel;int ret, i; counter =devm_counter_alloc (&pdev->dev,sizeof (*priv));
@@ -343,7 +343,7 @@ static int mchp_tc_probe(struct platform_device *pdev) priv->channel[i] = channel; -snprintf (clk_name,sizeof (clk_name),"t%d_clk" , channel); +snprintf (clk_name,sizeof (clk_name),"t%u_clk" , channel); clk[i] =of_clk_get_by_name (np->parent, clk_name);if (IS_ERR (clk[i])) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 30/181 bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jordan Rife <[email protected]>
[ Upstream commit 8271bec9fc1cfe522b1a18cacbefd6712a3d41c2 ]
Prepare for the next patch which needs to be able to choose either GFP_USER or GFP_NOWAIT for calls to bpf_iter_tcp_realloc_batch.
Stable-dep-of: e5fd3f514e27 ("bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()")
--- net/ipv4/tcp_ipv4.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
net/ipv4/tcp_ipv4.c +5 -4
@@ -3032,12 +3032,12 @@ static void bpf_iter_tcp_put_batch(struct bpf_tcp_iter_state *iter) }static int bpf_iter_tcp_realloc_batch (struct bpf_tcp_iter_state *iter, -unsigned int new_batch_sz) +unsigned int new_batch_sz,gfp_t flags) {struct sock **new_batch; new_batch =kvmalloc (sizeof (*new_batch) * new_batch_sz, -GFP_USER | __GFP_NOWARN); + flags | __GFP_NOWARN);if (!new_batch)return -ENOMEM ;
@@ -3149,7 +3149,8 @@ static struct sock *bpf_iter_tcp_batch(struct seq_file *seq)return sk; } -if (!resized && !bpf_iter_tcp_realloc_batch (iter, expected *3 /2 )) { +if (!resized && !bpf_iter_tcp_realloc_batch (iter, expected *3 /2 , +GFP_USER )) { resized = true; goto again; }
@@ -3578,7 +3579,7 @@ static int bpf_iter_init_tcp(void *priv_data, struct bpf_iter_aux_info *aux)if (err)return err; - err =bpf_iter_tcp_realloc_batch (iter,INIT_BATCH_SZ ); + err =bpf_iter_tcp_realloc_batch (iter,INIT_BATCH_SZ ,GFP_USER );if (err) {bpf_iter_fini_seq_net (priv_data);return err;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 31/181 bpf: tcp: Make sure iter->batch always contains a full bucket snapshot
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jordan Rife <[email protected]>
[ Upstream commit cdec67a489d4fdae3e83e04fca0419136a83c4c2 ]
Require that iter->batch always contains a full bucket snapshot. This invariant is important to avoid skipping or repeating sockets during iteration when combined with the next few patches. Before, there were two cases where a call to bpf_iter_tcp_batch may only capture part of a bucket:
1. When bpf_iter_tcp_realloc_batch() returns -ENOMEM.
2. When more sockets are added to the bucket while calling bpf_iter_tcp_realloc_batch(), making the updated batch size insufficient.
In cases where the batch size only covers part of a bucket, it is possible to forget which sockets were already visited, especially if we have to process a bucket in more than two batches. This forces us to choose between repeating or skipping sockets, so don't allow this:
1. Stop iteration and propagate -ENOMEM up to userspace if reallocation fails instead of continuing with a partial batch.
2. Try bpf_iter_tcp_realloc_batch() with GFP_USER just as before, but if we still aren't able to capture the full bucket, call bpf_iter_tcp_realloc_batch() again while holding the bucket lock to guarantee the bucket does not change. On the second attempt use GFP_NOWAIT since we hold onto the spin lock.
I did some manual testing to exercise the code paths where GFP_NOWAIT is used and where ERR_PTR(err) is returned. I used the realloc test cases included later in this series to trigger a scenario where a realloc happens inside bpf_iter_tcp_batch and made a small code tweak to force the first realloc attempt to allocate a too-small batch, thus requiring another attempt with GFP_NOWAIT. Some printks showed both reallocs with the tests passing:
Jun 27 00:00:53 crow kernel: again GFP_USER Jun 27 00:00:53 crow kernel: again GFP_NOWAIT Jun 27 00:00:53 crow kernel: again GFP_USER Jun 27 00:00:53 crow kernel: again GFP_NOWAIT
With this setup, I also forced each of the bpf_iter_tcp_realloc_batch calls to return -ENOMEM to ensure that iteration ends and that the read() in userspace fails.
Stable-dep-of: e5fd3f514e27 ("bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()")
--- net/ipv4/tcp_ipv4.c | 109 +++++++++++++++++++++++++++++++------------- 1 file changed, 77 insertions(+), 32 deletions(-)
net/ipv4/tcp_ipv4.c +77 -32
@@ -3041,7 +3041,7 @@ static int bpf_iter_tcp_realloc_batch(struct bpf_tcp_iter_state *iter,if (!new_batch)return -ENOMEM ; -bpf_iter_tcp_put_batch (iter); +memcpy (new_batch, iter->batch,sizeof (*iter->batch) * iter->end_sk);kvfree (iter->batch); iter->batch = new_batch; iter->max_sk = new_batch_sz;
@@ -3050,69 +3050,95 @@ static int bpf_iter_tcp_realloc_batch(struct bpf_tcp_iter_state *iter, }static unsigned int bpf_iter_tcp_listening_batch (struct seq_file *seq, -struct sock *start_sk) +struct sock **start_sk) { -struct inet_hashinfo *hinfo =seq_file_net (seq)->ipv4.tcp_death_row.hashinfo;struct bpf_tcp_iter_state *iter = seq->private; -struct tcp_iter_state *st = &iter->state;struct hlist_nulls_node *node;unsigned int expected =1 ;struct sock *sk; -sock_hold (start_sk); - iter->batch[iter->end_sk++] = start_sk; +sock_hold (*start_sk); + iter->batch[iter->end_sk++] = *start_sk; - sk =sk_nulls_next (start_sk); + sk =sk_nulls_next (*start_sk); + *start_sk =NULL ;sk_nulls_for_each_from (sk, node) {if (seq_sk_match (seq, sk)) {if (iter->end_sk < iter->max_sk) {sock_hold (sk); iter->batch[iter->end_sk++] = sk; + }else if (!*start_sk) { +/* Remember where we left off. */ + *start_sk = sk; } expected++; } } -spin_unlock (&hinfo->lhash2[st->bucket].lock);return expected; }static unsigned int bpf_iter_tcp_established_batch (struct seq_file *seq, -struct sock *start_sk) +struct sock **start_sk) { -struct inet_hashinfo *hinfo =seq_file_net (seq)->ipv4.tcp_death_row.hashinfo;struct bpf_tcp_iter_state *iter = seq->private; -struct tcp_iter_state *st = &iter->state;struct hlist_nulls_node *node;unsigned int expected =1 ;struct sock *sk; -sock_hold (start_sk); - iter->batch[iter->end_sk++] = start_sk; +sock_hold (*start_sk); + iter->batch[iter->end_sk++] = *start_sk; - sk =sk_nulls_next (start_sk); + sk =sk_nulls_next (*start_sk); + *start_sk =NULL ;sk_nulls_for_each_from (sk, node) {if (seq_sk_match (seq, sk)) {if (iter->end_sk < iter->max_sk) {sock_hold (sk); iter->batch[iter->end_sk++] = sk; + }else if (!*start_sk) { +/* Remember where we left off. */ + *start_sk = sk; } expected++; } } -spin_unlock_bh (inet_ehash_lockp (hinfo, st->bucket));return expected; } +static unsigned int bpf_iter_fill_batch (struct seq_file *seq, +struct sock **start_sk) +{ +struct bpf_tcp_iter_state *iter = seq->private; +struct tcp_iter_state *st = &iter->state; + +if (st->state ==TCP_SEQ_STATE_LISTENING ) +return bpf_iter_tcp_listening_batch (seq, start_sk); +else +return bpf_iter_tcp_established_batch (seq, start_sk); +} + +static void bpf_iter_tcp_unlock_bucket (struct seq_file *seq) +{ +struct inet_hashinfo *hinfo =seq_file_net (seq)->ipv4.tcp_death_row.hashinfo; +struct bpf_tcp_iter_state *iter = seq->private; +struct tcp_iter_state *st = &iter->state; + +if (st->state ==TCP_SEQ_STATE_LISTENING ) +spin_unlock (&hinfo->lhash2[st->bucket].lock); +else +spin_unlock_bh (inet_ehash_lockp (hinfo, st->bucket)); +} +static struct sock *bpf_iter_tcp_batch (struct seq_file *seq) {struct inet_hashinfo *hinfo =seq_file_net (seq)->ipv4.tcp_death_row.hashinfo;struct bpf_tcp_iter_state *iter = seq->private;struct tcp_iter_state *st = &iter->state;unsigned int expected; -bool resized = false;struct sock *sk; +int err;/* The st->bucket is done. Directly advance to the next * bucket instead of having the tcp_seek_last_pos() to skip
@@ -3129,33 +3155,52 @@ static struct sock *bpf_iter_tcp_batch(struct seq_file *seq) } } -again: -/* Get a new batch */ iter->cur_sk =0 ; iter->end_sk =0 ; - iter->st_bucket_done = false; + iter->st_bucket_done = true; sk =tcp_seek_last_pos (seq);if (!sk)return NULL ;/* Done */ -if (st->state ==TCP_SEQ_STATE_LISTENING ) - expected =bpf_iter_tcp_listening_batch (seq, sk); -else - expected =bpf_iter_tcp_established_batch (seq, sk); + expected =bpf_iter_fill_batch (seq, &sk); +if (likely (iter->end_sk == expected)) + goto done; -if (iter->end_sk == expected) { - iter->st_bucket_done = true; -return sk; - } +/* Batch size was too small. */ +bpf_iter_tcp_unlock_bucket (seq); +bpf_iter_tcp_put_batch (iter); + err =bpf_iter_tcp_realloc_batch (iter, expected *3 /2 , +GFP_USER ); +if (err) +return ERR_PTR (err); + + iter->cur_sk =0 ; + iter->end_sk =0 ; + + sk =tcp_seek_last_pos (seq); +if (!sk) +return NULL ;/* Done */ + + expected =bpf_iter_fill_batch (seq, &sk); +if (likely (iter->end_sk == expected)) + goto done; -if (!resized && !bpf_iter_tcp_realloc_batch (iter, expected *3 /2 , -GFP_USER )) { - resized = true; - goto again; +/* Batch size was still too small. Hold onto the lock while we try +* again with a larger batch to make sure the current bucket's size +* does not change in the meantime. +*/ + err =bpf_iter_tcp_realloc_batch (iter, expected,GFP_NOWAIT ); +if (err) { +bpf_iter_tcp_unlock_bucket (seq); +return ERR_PTR (err); } -return sk; + expected =bpf_iter_fill_batch (seq, &sk); +WARN_ON_ONCE (iter->end_sk != expected); +done: +bpf_iter_tcp_unlock_bucket (seq); +return iter->batch[0 ]; }static void *bpf_iter_tcp_seq_start (struct seq_file *seq,loff_t *pos)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 32/181 bpf: tcp: Get rid of st_bucket_done
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jordan Rife <[email protected]>
[ Upstream commit e25ab9b874a4bd8c6e3e5ce66cbe8a1dd4096e2e ]
Get rid of the st_bucket_done field to simplify TCP iterator state and logic. Before, st_bucket_done could be false if bpf_iter_tcp_batch returned a partial batch; however, with the last patch ("bpf: tcp: Make sure iter->batch always contains a full bucket snapshot"), st_bucket_done == true is equivalent to iter->cur_sk == iter->end_sk.
Stable-dep-of: e5fd3f514e27 ("bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()")
--- net/ipv4/tcp_ipv4.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-)
net/ipv4/tcp_ipv4.c +6 -8
@@ -3004,7 +3004,6 @@ struct bpf_tcp_iter_state {unsigned int end_sk;unsigned int max_sk;struct sock **batch; -bool st_bucket_done; };struct bpf_iter__tcp {
@@ -3027,8 +3026,10 @@ static int tcp_prog_seq_show(struct bpf_prog *prog, struct bpf_iter_meta *meta,static void bpf_iter_tcp_put_batch (struct bpf_tcp_iter_state *iter) { -while (iter->cur_sk < iter->end_sk) -sock_gen_put (iter->batch[iter->cur_sk++]); +unsigned int cur_sk = iter->cur_sk; + +while (cur_sk < iter->end_sk) +sock_gen_put (iter->batch[cur_sk++]); } static int bpf_iter_tcp_realloc_batch(struct bpf_tcp_iter_state *iter,
@@ -3145,7 +3146,7 @@ static struct sock *bpf_iter_tcp_batch(struct seq_file *seq)* one by one in the current bucket and eventually find out * it has to advance to the next bucket. */ -if (iter->st_bucket_done) { +if (iter->end_sk && iter->cur_sk == iter->end_sk) { st->offset =0 ; st->bucket++; if (st->state == TCP_SEQ_STATE_LISTENING &&
@@ -3157,7 +3158,6 @@ static struct sock *bpf_iter_tcp_batch(struct seq_file *seq) iter->cur_sk =0 ; iter->end_sk =0 ; - iter->st_bucket_done = true; sk =tcp_seek_last_pos (seq);if (!sk)
@@ -3305,10 +3305,8 @@ static void bpf_iter_tcp_seq_stop(struct seq_file *seq, void *v) (void )tcp_prog_seq_show (prog, &meta, v,0 ); } -if (iter->cur_sk < iter->end_sk) { +if (iter->cur_sk < iter->end_sk)bpf_iter_tcp_put_batch (iter); - iter->st_bucket_done = false; - } }static const struct seq_operations bpf_iter_tcp_seq_ops = {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 33/181 bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jordan Rife <[email protected]>
[ Upstream commit efeb820951ebf3778830256496ff72d00d135310 ]
Prepare for the next patch that tracks cookies between iterations by converting struct sock **batch to union bpf_tcp_iter_batch_item *batch inside struct bpf_tcp_iter_state.
Stable-dep-of: e5fd3f514e27 ("bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()")
--- net/ipv4/tcp_ipv4.c | 24 ++++++++++++++---------- 1 file changed, 14 insertions(+), 10 deletions(-)
net/ipv4/tcp_ipv4.c +14 -10
@@ -2998,12 +2998,16 @@ static int tcp4_seq_show(struct seq_file *seq, void *v) }#ifdef CONFIG_BPF_SYSCALL +union bpf_tcp_iter_batch_item { +struct sock *sk; +}; +struct bpf_tcp_iter_state {struct tcp_iter_state state;unsigned int cur_sk;unsigned int end_sk;unsigned int max_sk; -struct sock **batch; +union bpf_tcp_iter_batch_item *batch; }; struct bpf_iter__tcp {
@@ -3029,13 +3033,13 @@ static void bpf_iter_tcp_put_batch(struct bpf_tcp_iter_state *iter)unsigned int cur_sk = iter->cur_sk;while (cur_sk < iter->end_sk) -sock_gen_put (iter->batch[cur_sk++]); +sock_gen_put (iter->batch[cur_sk++].sk); }static int bpf_iter_tcp_realloc_batch (struct bpf_tcp_iter_state *iter,unsigned int new_batch_sz,gfp_t flags) { -struct sock **new_batch; +union bpf_tcp_iter_batch_item *new_batch; new_batch =kvmalloc (sizeof (*new_batch) * new_batch_sz, flags | __GFP_NOWARN);
@@ -3059,7 +3063,7 @@ static unsigned int bpf_iter_tcp_listening_batch(struct seq_file *seq,struct sock *sk;sock_hold (*start_sk); - iter->batch[iter->end_sk++] = *start_sk; + iter->batch[iter->end_sk++].sk = *start_sk; sk =sk_nulls_next (*start_sk); *start_sk =NULL ;
@@ -3067,7 +3071,7 @@ static unsigned int bpf_iter_tcp_listening_batch(struct seq_file *seq,if (seq_sk_match (seq, sk)) {if (iter->end_sk < iter->max_sk) {sock_hold (sk); - iter->batch[iter->end_sk++] = sk; + iter->batch[iter->end_sk++].sk = sk; }else if (!*start_sk) {/* Remember where we left off. */ *start_sk = sk;
@@ -3088,7 +3092,7 @@ static unsigned int bpf_iter_tcp_established_batch(struct seq_file *seq,struct sock *sk;sock_hold (*start_sk); - iter->batch[iter->end_sk++] = *start_sk; + iter->batch[iter->end_sk++].sk = *start_sk; sk =sk_nulls_next (*start_sk); *start_sk =NULL ;
@@ -3096,7 +3100,7 @@ static unsigned int bpf_iter_tcp_established_batch(struct seq_file *seq,if (seq_sk_match (seq, sk)) {if (iter->end_sk < iter->max_sk) {sock_hold (sk); - iter->batch[iter->end_sk++] = sk; + iter->batch[iter->end_sk++].sk = sk; }else if (!*start_sk) {/* Remember where we left off. */ *start_sk = sk;
@@ -3200,7 +3204,7 @@ static struct sock *bpf_iter_tcp_batch(struct seq_file *seq)WARN_ON_ONCE (iter->end_sk != expected); done:bpf_iter_tcp_unlock_bucket (seq); -return iter->batch[0 ]; +return iter->batch[0 ].sk; }static void *bpf_iter_tcp_seq_start (struct seq_file *seq,loff_t *pos)
@@ -3235,11 +3239,11 @@ static void *bpf_iter_tcp_seq_next(struct seq_file *seq, void *v, loff_t *pos)* st->bucket. See tcp_seek_last_pos(). */ st->offset++; -sock_gen_put (iter->batch[iter->cur_sk++]); +sock_gen_put (iter->batch[iter->cur_sk++].sk); }if (iter->cur_sk < iter->end_sk) - sk = iter->batch[iter->cur_sk]; + sk = iter->batch[iter->cur_sk].sk;else sk =bpf_iter_tcp_batch (seq);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 34/181 bpf: tcp: Avoid socket skips and repeats during iteration
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jordan Rife <[email protected]>
[ Upstream commit f5080f612a1c587bf636bb23d2a2f4de276d60e4 ]
Replace the offset-based approach for tracking progress through a bucket in the TCP table with one based on socket cookies. Remember the cookies of unprocessed sockets from the last batch and use this list to pick up where we left off or, in the case that the next socket disappears between reads, find the first socket after that point that still exists in the bucket and resume from there.
This approach guarantees that all sockets that existed when iteration began and continue to exist throughout will be visited exactly once. Sockets that are added to the table during iteration may or may not be seen, but if they are they will be seen exactly once.
Stable-dep-of: e5fd3f514e27 ("bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()")
--- net/ipv4/tcp_ipv4.c | 147 ++++++++++++++++++++++++++++++++++---------- 1 file changed, 115 insertions(+), 32 deletions(-)
net/ipv4/tcp_ipv4.c +115 -32
@@ -58,6 +58,7 @@#include <linux/times.h> #include <linux/slab.h> #include <linux/sched.h> +#include <linux/sock_diag.h> #include <net/net_namespace.h> #include <net/icmp.h>
@@ -3000,6 +3001,7 @@ static int tcp4_seq_show(struct seq_file *seq, void *v)#ifdef CONFIG_BPF_SYSCALL union bpf_tcp_iter_batch_item {struct sock *sk; +__u64 cookie; }; struct bpf_tcp_iter_state {
@@ -3030,10 +3032,19 @@ static int tcp_prog_seq_show(struct bpf_prog *prog, struct bpf_iter_meta *meta,static void bpf_iter_tcp_put_batch (struct bpf_tcp_iter_state *iter) { +union bpf_tcp_iter_batch_item *item;unsigned int cur_sk = iter->cur_sk; +__u64 cookie; -while (cur_sk < iter->end_sk) -sock_gen_put (iter->batch[cur_sk++].sk); +/* Remember the cookies of the sockets we haven't seen yet, so we can +* pick up where we left off next time around. +*/ +while (cur_sk < iter->end_sk) { + item = &iter->batch[cur_sk++]; + cookie =sock_gen_cookie (item->sk); +sock_gen_put (item->sk); + item->cookie = cookie; + } } static int bpf_iter_tcp_realloc_batch(struct bpf_tcp_iter_state *iter,
@@ -3054,6 +3065,106 @@ static int bpf_iter_tcp_realloc_batch(struct bpf_tcp_iter_state *iter,return 0 ; } +static struct sock *bpf_iter_tcp_resume_bucket (struct sock *first_sk, +union bpf_tcp_iter_batch_item *cookies, +int n_cookies) +{ +struct hlist_nulls_node *node; +struct sock *sk; +int i; + +for (i =0 ; i < n_cookies; i++) { + sk = first_sk; +sk_nulls_for_each_from (sk, node) +if (cookies[i].cookie ==atomic64_read (&sk->sk_cookie)) +return sk; + } + +return NULL ; +} + +static struct sock *bpf_iter_tcp_resume_listening (struct seq_file *seq) +{ +struct inet_hashinfo *hinfo =seq_file_net (seq)->ipv4.tcp_death_row.hashinfo; +struct bpf_tcp_iter_state *iter = seq->private; +struct tcp_iter_state *st = &iter->state; +unsigned int find_cookie = iter->cur_sk; +unsigned int end_cookie = iter->end_sk; +int resume_bucket = st->bucket; +struct sock *sk; + +if (end_cookie && find_cookie == end_cookie) + ++st->bucket; + + sk =listening_get_first (seq); + iter->cur_sk =0 ; + iter->end_sk =0 ; + +if (sk && st->bucket == resume_bucket && end_cookie) { + sk =bpf_iter_tcp_resume_bucket (sk, &iter->batch[find_cookie], + end_cookie - find_cookie); +if (!sk) { +spin_unlock (&hinfo->lhash2[st->bucket].lock); + ++st->bucket; + sk =listening_get_first (seq); + } + } + +return sk; +} + +static struct sock *bpf_iter_tcp_resume_established (struct seq_file *seq) +{ +struct inet_hashinfo *hinfo =seq_file_net (seq)->ipv4.tcp_death_row.hashinfo; +struct bpf_tcp_iter_state *iter = seq->private; +struct tcp_iter_state *st = &iter->state; +unsigned int find_cookie = iter->cur_sk; +unsigned int end_cookie = iter->end_sk; +int resume_bucket = st->bucket; +struct sock *sk; + +if (end_cookie && find_cookie == end_cookie) + ++st->bucket; + + sk =established_get_first (seq); + iter->cur_sk =0 ; + iter->end_sk =0 ; + +if (sk && st->bucket == resume_bucket && end_cookie) { + sk =bpf_iter_tcp_resume_bucket (sk, &iter->batch[find_cookie], + end_cookie - find_cookie); +if (!sk) { +spin_unlock_bh (inet_ehash_lockp (hinfo, st->bucket)); + ++st->bucket; + sk =established_get_first (seq); + } + } + +return sk; +} + +static struct sock *bpf_iter_tcp_resume (struct seq_file *seq) +{ +struct bpf_tcp_iter_state *iter = seq->private; +struct tcp_iter_state *st = &iter->state; +struct sock *sk =NULL ; + +switch (st->state) { +case TCP_SEQ_STATE_LISTENING : + sk =bpf_iter_tcp_resume_listening (seq); +if (sk) +break ; + st->bucket =0 ; + st->state =TCP_SEQ_STATE_ESTABLISHED ; + fallthrough; +case TCP_SEQ_STATE_ESTABLISHED : + sk =bpf_iter_tcp_resume_established (seq); +break ; + } + +return sk; +} +static unsigned int bpf_iter_tcp_listening_batch (struct seq_file *seq,struct sock **start_sk) {
@@ -3138,32 +3249,12 @@ static void bpf_iter_tcp_unlock_bucket(struct seq_file *seq)static struct sock *bpf_iter_tcp_batch (struct seq_file *seq) { -struct inet_hashinfo *hinfo =seq_file_net (seq)->ipv4.tcp_death_row.hashinfo;struct bpf_tcp_iter_state *iter = seq->private; -struct tcp_iter_state *st = &iter->state;unsigned int expected;struct sock *sk;int err; -/* The st->bucket is done. Directly advance to the next -* bucket instead of having the tcp_seek_last_pos() to skip -* one by one in the current bucket and eventually find out -* it has to advance to the next bucket. -*/ -if (iter->end_sk && iter->cur_sk == iter->end_sk) { - st->offset =0 ; - st->bucket++; -if (st->state ==TCP_SEQ_STATE_LISTENING && - st->bucket > hinfo->lhash2_mask) { - st->state =TCP_SEQ_STATE_ESTABLISHED ; - st->bucket =0 ; - } - } - - iter->cur_sk =0 ; - iter->end_sk =0 ; - - sk =tcp_seek_last_pos (seq); + sk =bpf_iter_tcp_resume (seq);if (!sk)return NULL ;/* Done */
@@ -3179,10 +3270,7 @@ static struct sock *bpf_iter_tcp_batch(struct seq_file *seq)if (err)return ERR_PTR (err); - iter->cur_sk =0 ; - iter->end_sk =0 ; - - sk =tcp_seek_last_pos (seq); + sk =bpf_iter_tcp_resume (seq);if (!sk)return NULL ;/* Done */
@@ -3234,11 +3322,6 @@ static void *bpf_iter_tcp_seq_next(struct seq_file *seq, void *v, loff_t *pos)* meta.seq_num is used instead. */ st->num++; -/* Move st->offset to the next sk in the bucket such that -* the future start() will resume at st->offset in -* st->bucket. See tcp_seek_last_pos(). -*/ - st->offset++;sock_gen_put (iter->batch[iter->cur_sk++].sk); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 35/181 bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jose Fernandez (Anthropic) <[email protected]>
[ Upstream commit e5fd3f514e27db1f05fbd72ba615d74941e23c51 ]
reqsk_queue_hash_req() publishes a TCP_NEW_SYN_RECV request_sock onto the ehash chain, drops the bucket lock, and only afterwards sets rsk_refcnt to 3.
Lockless readers such as __inet_lookup_established() handle this with refcount_inc_not_zero(), but bpf_iter_tcp_established_batch() uses plain sock_hold() while holding the bucket lock, on the assumption that the lock guarantees sk_refcnt > 0. That assumption does not hold for request_sock:
CPU 0 CPU 1
----- -----
tcp_conn_request()
reqsk_queue_hash_req()
inet_ehash_insert(req)
spin_lock(bucket)
__sk_nulls_add_node_rcu(req) // rsk_refcnt == 0
spin_unlock(bucket)
bpf_iter_tcp_established_batch()
spin_lock(bucket)
sock_hold(req) <-- addition on 0
spin_unlock(bucket)
refcount_set(&req->rsk_refcnt, 3) // clobbers saturated valuewhich surfaces as:
refcount_t: addition on 0; use-after-free.
WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x48/0x90, CPU#1 Call Trace: bpf_iter_tcp_established_batch+0x14e/0x170 bpf_iter_tcp_batch+0x53/0x200 bpf_iter_tcp_seq_next+0x27/0x70 bpf_seq_read+0x107/0x410 vfs_read+0xb9/0x380
The iterator's stolen reference is lost when the publishing CPU's refcount_set() overwrites the count, leaving the socket one reference short. When the last legitimate owner drops its reference the reqsk is freed while still reachable, leading to use-after-free.
This reproduces in seconds with tcp_syncookies=0, a handful of threads doing connect()/close() to a local listener while others read an iter/tcp link in a tight loop.
Use refcount_inc_not_zero() and skip the socket on failure. A skipped socket is still part of the bucket, so keep counting it in expected. The reallocations are sized from expected, and a request sock whose refcount gets published while the lock is held across the last realloc must already have room.
A skipped socket is counted in expected but never batched, so end_sk can be short of expected on a batch that is actually complete. Decide completeness by whether the walk left any socket behind instead. The WARN after the locked realloc checks the same, replacing an end_sk == expected check that could not hold on that path since commit cdec67a489d4 ("bpf: tcp: Make sure iter->batch always contains a full bucket snapshot").
If every matching socket in a bucket is mid-init (refcount 0), end_sk stays 0. Advance to the next bucket rather than returning a batch entry that was never filled this round.
--- net/ipv4/tcp_ipv4.c | 43 ++++++++++++++++++++++++------------------- 1 file changed, 24 insertions(+), 19 deletions(-)
net/ipv4/tcp_ipv4.c +24 -19
@@ -3199,24 +3199,24 @@ static unsigned int bpf_iter_tcp_established_batch(struct seq_file *seq, {struct bpf_tcp_iter_state *iter = seq->private;struct hlist_nulls_node *node; -unsigned int expected =1 ; -struct sock *sk; - -sock_hold (*start_sk); - iter->batch[iter->end_sk++].sk = *start_sk; +struct sock *sk = *start_sk; +unsigned int expected =0 ; - sk =sk_nulls_next (*start_sk); *start_sk =NULL ;sk_nulls_for_each_from (sk, node) { -if (seq_sk_match (seq, sk)) { -if (iter->end_sk < iter->max_sk) { -sock_hold (sk); - iter->batch[iter->end_sk++].sk = sk; - }else if (!*start_sk) { -/* Remember where we left off. */ - *start_sk = sk; - } - expected++; +if (!seq_sk_match (seq, sk)) +continue ; + expected++; +if (iter->end_sk < iter->max_sk) { +/* reqsk_queue_hash_req() inserts with sk_refcnt == 0 +* and refcount_set()s it after the bucket lock drops. +*/ +if (unlikely (!refcount_inc_not_zero (&sk->sk_refcnt))) +continue ; + iter->batch[iter->end_sk++].sk = sk; + }else if (!*start_sk) { +/* Remember where we left off. */ + *start_sk = sk; } }
@@ -3254,12 +3254,13 @@ static struct sock *bpf_iter_tcp_batch(struct seq_file *seq)struct sock *sk;int err; +again: sk =bpf_iter_tcp_resume (seq);if (!sk)return NULL ;/* Done */ expected =bpf_iter_fill_batch (seq, &sk); -if (likely (iter->end_sk == expected)) +if (likely (!sk)) goto done;/* Batch size was too small. */
@@ -3275,7 +3276,7 @@ static struct sock *bpf_iter_tcp_batch(struct seq_file *seq)return NULL ;/* Done */ expected =bpf_iter_fill_batch (seq, &sk); -if (likely (iter->end_sk == expected)) +if (likely (!sk)) goto done;/* Batch size was still too small. Hold onto the lock while we try
@@ -3288,10 +3289,14 @@ static struct sock *bpf_iter_tcp_batch(struct seq_file *seq)return ERR_PTR (err); } - expected =bpf_iter_fill_batch (seq, &sk); -WARN_ON_ONCE (iter->end_sk != expected); +bpf_iter_fill_batch (seq, &sk); +WARN_ON_ONCE (sk); done:bpf_iter_tcp_unlock_bucket (seq); +if (unlikely (!iter->end_sk)) { + ++iter->state.bucket; + goto again; + }return iter->batch[0 ].sk; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 36/181 vhost/vdpa: reject overflowing PA map page counts on 32-bit
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yousef Alhouseen <[email protected]>
[ Upstream commit 0619aaa34c0c2a2dcb07f0e9c8a34e7efb8c4cdf ]
vhost_vdpa_pa_map() adds the IOVA page offset to the user-controlled map size before computing the number of pages to pin. On 32-bit systems, where unsigned long is narrower than u64, that addition can overflow and the code can pin and map fewer pages than the requested IOTLB range.
Reject sizes that overflow the unsigned long page-count calculation.
Message-ID: <CAMuQ4bX-iDvcUOPPY+NLz95tkRJYwWqvzAr=U48uNaub_HZLGw@mail.gmail.com>
--- drivers/vhost/vdpa.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/vhost/vdpa.c +8 -1
@@ -1102,6 +1102,7 @@ static int vhost_vdpa_pa_map(struct vhost_vdpa *v,unsigned int gup_flags =FOLL_LONGTERM ;unsigned long npages, cur_base, map_pfn, last_pfn =0 ;unsigned long lock_limit, sz2pin, nchunks, i; +unsigned long page_offset;u64 start = iova;long pinned;int ret =0 ;
@@ -1114,7 +1115,13 @@ static int vhost_vdpa_pa_map(struct vhost_vdpa *v,if (perm &VHOST_ACCESS_WO ) gup_flags |=FOLL_WRITE ; - npages =PFN_UP (size + (iova & ~PAGE_MASK )); + page_offset = iova & ~PAGE_MASK ; +if (size >ULONG_MAX - page_offset) { + ret = -EINVAL ; + goto free; + } + + npages =PFN_UP (size + page_offset);if (!npages) { ret = -EINVAL ; goto free;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 37/181 vdpa/mlx5: Fix buffer length in create_direct_keys()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Borntraeger <[email protected]>
[ Upstream commit 727e1f569855df83579edbd73dcb4a0723543a12 ]
We have seen in our CI the following KASAN message:
BUG: KASAN: slab-out-of-bounds in cmd_exec+0x550/0xca0 [mlx5_core] Read of size 272 at addr 0000000176795020 by task qemu-system-s39/82764 [...] [<000011388ab3a7a0>] cmd_exec+0x550/0xca0 [mlx5_core] [<000011388ab3b61c>] mlx5_cmd_exec_cb+0x25c/0x4f0 [mlx5_core] [<000011388b21e82e>] mlx5_vdpa_exec_async_cmds+0x22e/0x5e0 [mlx5_vdpa] [<000011388b21fd44>] create_direct_keys+0x954/0xef0 [mlx5_vdpa]
[...]
The buggy address is located 4128 bytes inside of allocated 4384-byte region [0000000176794000, 0000000176795120)
So in essence we read 16 bytes beyond 4384-byte allocation. create_direct_keys calculates the pointer and length for in and out buffers.
The size calculation for in includes the entire structure size (out + in + mtt[]) but the pointer passed to cmd_exec points only to the 'in' field, skipping the 'out' field.
This causes mlx5_copy_to_msg() to read beyond the allocated buffer by sizeof(out) bytes when copying command data.
Properly calculate the input size to match the pointer and allocation size.
Message-ID: <[email protected]>
--- drivers/vdpa/mlx5/core/mr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/vdpa/mlx5/core/mr.c +2 -1
@@ -234,7 +234,8 @@ static int create_direct_keys(struct mlx5_vdpa_dev *mvdev, struct mlx5_vdpa_mr * cmds[i].out = cmd_mem->out; cmds[i].outlen =sizeof (cmd_mem->out); cmds[i].in = cmd_mem->in; - cmds[i].inlen =struct_size (cmd_mem, mtt, mttcount); + cmds[i].inlen =struct_size (cmd_mem, mtt, mttcount) - + offsetof(struct mlx5_create_mkey_mem , in);fill_create_direct_mr (mvdev, dmr, cmd_mem);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 38/181 tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Gao <[email protected]>
[ Upstream commit 0e125ecfe20c077625cf0be8d750d5c3abc0dce9 ]
Commit f5da7c45188e ("tcp: adjust rcvq_space after updating scaling ratio") replaced the direct window_clamp update in tcp_measure_rcv_mss() with a call to tcp_set_window_clamp(), a helper that implements the TCP_WINDOW_CLAMP setsockopt. As a side effect, the helper also shrinks rcv_ssthresh via __tcp_adjust_rcv_ssthresh().
As a result, each scaling_ratio decrease detected by tcp_measure_rcv_mss() also cuts rcv_ssthresh. Elsewhere in TCP, rcv_ssthresh is usually cut under memory pressure and grows via tcp_grow_window().
Flows whose segment sizes vary keep scaling_ratio oscillating, which leads to an unstable rcv_ssthresh: a dip of rcv_ssthresh only recovers via tcp_grow_window(), keeping the advertised window at a relatively low level even after the ratio itself has recovered, and can even stall the sender.
Observed on a customer's proxy gateway after upgrading from kernel 6.1 to 6.12: in the worst case, rcv_ssthresh was cut in half by a scaling_ratio dip. P99 latency jumped from <10ms on 6.1 to ~100ms on 6.12, and almost returned to the 6.1 level with this patch applied.
Restore the plain WRITE_ONCE() update of window_clamp, as introduced in commit a2cbb1603943 ("tcp: Update window clamping condition"), and keep the rcvq_space.space adjustment. Now rcv_ssthresh is decoupled from scaling_ratio changes in tcp_measure_rcv_mss().
--- net/ipv4/tcp_input.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/tcp_input.c +1 -1
@@ -247,7 +247,7 @@ static void tcp_measure_rcv_mss(struct sock *sk, const struct sk_buff *skb)struct tcp_sock *tp =tcp_sk (sk); val =tcp_win_from_space (sk, sk->sk_rcvbuf); -tcp_set_window_clamp (sk, val); +WRITE_ONCE (tp->window_clamp, val);if (tp->window_clamp < tp->rcvq_space.space) tp->rcvq_space.space = tp->window_clamp;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 39/181 xsk: require at least 16 bytes of TX metadata
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislav Fomichev <[email protected]>
[ Upstream commit 1bb30b181d9f0484e141f8411e15ed906d5c6780 ]
AF_XDP accepts a TX metadata length as small as eight bytes, but every supported request needs the flags plus at least one eight-byte request field. Such short metadata also lets the kernel read beyond the registered area.
Require 16 bytes rather than sizeof(struct xsk_tx_metadata) to preserve compatibility with applications that do not use launch-time metadata.
--- net/xdp/xdp_umem.c | 2 ++ 1 file changed, 2 insertions(+)
net/xdp/xdp_umem.c +2 -0
@@ -209,6 +209,8 @@ static int xdp_umem_reg(struct xdp_umem *umem, struct xdp_umem_reg *mr)if (mr->flags &XDP_UMEM_TX_METADATA_LEN ) {if (mr->tx_metadata_len >=256 || mr->tx_metadata_len %8 )return -EINVAL ; +if (mr->tx_metadata_len <16 ) +return -EINVAL ; umem->tx_metadata_len = mr->tx_metadata_len; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 40/181 udp: fix potential use-after-free in tunnel segmentation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xuanqiang Luo <[email protected]>
[ Upstream commit d0f86fb36eb260abd10007b62c9dcc1028e03e61 ]
__skb_udp_tunnel_segment() gets the UDP header before ensuring the tunnel header is in the skb head. If the pull reallocates skb->head, the saved UDP header pointer is no longer valid.
Get the UDP header after the pull to avoid a potential use-after-free.
--- net/ipv4/udp_offload.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/ipv4/udp_offload.c +3 -1
@@ -22,17 +22,19 @@ static struct sk_buff *__skb_udp_tunnel_segment(struct sk_buff *skb,int tnl_hlen =skb_inner_mac_header (skb) -skb_transport_header (skb);bool remcsum, need_csum, offload_csum, gso_partial;struct sk_buff *segs =ERR_PTR (-EINVAL ); -struct udphdr *uh =udp_hdr (skb);u16 mac_offset = skb->mac_header;__be16 protocol = skb->protocol;u16 mac_len = skb->mac_len;int udp_offset, outer_hlen; +struct udphdr *uh;__wsum partial;bool need_ipsec;if (unlikely (!pskb_may_pull (skb, tnl_hlen))) goto out; + uh =udp_hdr (skb); +/* Adjust partial header checksum to negate old length. * We cannot rely on the value contained in uh->len as it is * possible that the actual value exceeds the boundaries of the
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 41/181 net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toke Høiland-Jørgensen <[email protected]>
[ Upstream commit 2a33516f9ef59ad11844d4fc152f889449b5daf3 ]
The sch_cake ACK filter parses packets to find the TCP header and filter duplicated ACKs if the flow is backlogged. The parsing code contains a WARN_ON(1) which can be triggered by a malformed IP header in certain cases. Depending on the system configuration, this leads either to either spamming dmesg with warnings, or a panic if panic_on_warn is set.
The code already correctly skips the offending packet in the branch that triggers the warning, so the WARN_ON itself doesn't really serve any purpose. So just drop it altogether to avoid the inconvenient side effects.
--- net/sched/sch_cake.c | 1 - 1 file changed, 1 deletion(-)
net/sched/sch_cake.c +0 -1
@@ -1265,7 +1265,6 @@ static struct sk_buff *cake_ack_filter(struct cake_sched_data *q, seglen =ntohs (ipv6h_check->payload_len); }else { -WARN_ON (1 );/* shouldn't happen */ continue ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 42/181 net/openvswitch: check Ethernet header length in key_extract()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang (Microsoft) <[email protected]>
[ Upstream commit cf6f8b29befb92173659bcef6a441d274947bfae ]
When a packet arrives on an ARPHRD_NONE device (e.g. TUN), ovs_flow_key_extract() trusts the user-provided skb->protocol field: if it is ETH_P_TEB, the packet is classified as MAC_PROTO_ETHERNET and key_extract() is called without ensuring the skb has ETH_HLEN (14) bytes of linear data. key_extract() unconditionally pulls 2 * ETH_ALEN bytes for MAC addresses and parse_ethertype() pulls 2 more, either of which triggers a kernel BUG in __skb_pull() when the linear area is too small.
kernel BUG at include/linux/skbuff.h:2848!
RIP: 0010:key_extract+0xa7e/0xd90 net/openvswitch/flow.c:933 ovs_flow_key_extract+0x419/0xa70 ovs_vport_receive+0x222/0x390 netdev_frame_hook+0x3e0/0x630 tun_get_user+0x2d0c/0x38e0
Fixed by calling check_header() in key_extract() before accessing the Ethernet header.
--- net/openvswitch/flow.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
net/openvswitch/flow.c +7 -4
@@ -893,8 +893,6 @@ static int key_extract_l3l4(struct sk_buff *skb, struct sw_flow_key *key)* Ethernet header * @key: output flow key * -* The caller must ensure that skb->len >= ETH_HLEN. -* * Initializes @skb header fields as follows: * * - skb->mac_header: the L2 header.
@@ -914,8 +912,6 @@ static int key_extract_l3l4(struct sk_buff *skb, struct sw_flow_key *key)*/ static int key_extract (struct sk_buff *skb,struct sw_flow_key *key) { -struct ethhdr *eth; -/* Flags are always used as part of stats */ key->tp.flags =0 ;
@@ -930,6 +926,13 @@ static int key_extract(struct sk_buff *skb, struct sw_flow_key *key)skb_reset_network_header (skb); key->eth.type = skb->protocol; }else { +struct ethhdr *eth; +int err; + + err =check_header (skb,ETH_HLEN ); +if (unlikely (err)) +return err; + eth =eth_hdr (skb);ether_addr_copy (key->eth.src, eth->h_source);ether_addr_copy (key->eth.dst, eth->h_dest);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 43/181 net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <[email protected]>
[ Upstream commit a347304b2ca1a5377d5bd2d8a72e4b4f12afe648 ]
Another challenge with unlocked filters.
There is a short window in tc_new_tfilter where a tcf_proto can be found and briefly referenced by a totally unrelated, unlocked classifier's request and cause a race.
Feng created a poc which created this race with two threads, one creating a u32 filter and other a flower filter in the same chain/prio:
1. Both threads enter tc_new_tfilter, both find the chain empty, both drop filter_chain_lock
2. u32 finishes tcf_proto_create("u32") first, calls tcf_chain_tp_insert_unique() -> inserts u32_tp into the chain
3. flower finishes tcf_proto_create("flower") later, calls tcf_chain_tp_insert_unique() -> tcf_chain_tp_find() now sees u32_tp already there, takes a reference on it, destroys flower's own tp_new and returns u32_tp to the caller.
Flower then hits the kind mismatch check (because it requested for kind "flower" but tp->ops->kind is "u32") and goes through the errout path which calls tcf_proto_put() on u32_tp. If the u32 thread has already gone through its own errout (its change() call failed on the PoC's empty options) and dropped its create and insert refs, flower's put is the last one and drops u32_tp's refcnt to zero.
At this point tp->ops->destroy() runs in a context that never took rtnl_lock. When that happens, it might cause a UAF like the following (illustrated by the PoC):
[ +0.000710] BUG: KASAN: slab-use-after-free in u32_init (net/sched/cls_u32.c:393) [ +0.000281] Read of size 8 at addr ffff888120022f00 by task poc_feng_xue/524
Call Trace: u32_init (net/sched/cls_u32.c:393) tc_new_tfilter (net/sched/cls_api.c:2378) Allocated by task 526: u32_init (net/sched/cls_u32.c:378) tc_new_tfilter (net/sched/cls_api.c:2378) Freed by task 522: kfree u32_destroy (net/sched/cls_u32.c:662) tcf_proto_destroy (net/sched/cls_api.c:446) tcf_proto_put (net/sched/cls_api.c:459) tc_new_tfilter (net/sched/cls_api.c:2459)
Fix this by having tcf_proto_destroy() take rtnl_lock around tp->ops->destroy() for locked classifiers whenever rtnl is not held.
To explain why I used a temp variable "not_lockless" I'd like to point to a semi-related note on rtnl_held vs TCF_PROTO_OPS_DOIT_UNLOCKED (adding here for future cleanup if deemed necessary):
The rtnl_held parameter and the TCF_PROTO_OPS_DOIT_UNLOCKED flag are redundant sources of truth for whether rtnl_lock is held. Among the nine classifier destroy(..rtnl_held..) callbacks, only flower consults the rtnl_held parameter which it propagates to tc_setup_cb_destroy() and tc_setup_cb_call(). The other eight (u32, flow, bpf, cgroup, route, basic, fw, mall) ignore it entirely;-> those that call tc_setup_cb_destroy() (u32, bpf, mall) hardcode true always instead of forwarding the parameter.
A future cleanup should remove the rtnl_held parameter from the destroy callback signature entirely and have callers rely solely on their knowledge whether they are running in an unlocked context.
--- net/sched/cls_api.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
net/sched/cls_api.c +16 -1
@@ -443,7 +443,22 @@ static void tcf_chain_put(struct tcf_chain *chain);static void tcf_proto_destroy (struct tcf_proto *tp,bool rtnl_held,bool sig_destroy,struct netlink_ext_ack *extack) { - tp->ops->destroy (tp, rtnl_held, extack); +/* A locked classifier's destroy callback (e.g. u32_destroy) uses +* rtnl_dereference() and mutates shared structures (e.g. the +* tc_u_common hash list) that are only safe under rtnl_lock. When an +* unlocked classifier's request (e.g. flower on ingress) loses the +* tcf_chain_tp_insert_unique() race and ends up dropping the last +* reference on a locked classifier's proto, destroy() would run +* without rtnl held. Take it here in that case. +*/ +bool not_lockless = !rtnl_held && + !(tp->ops->flags &TCF_PROTO_OPS_DOIT_UNLOCKED ); + +if (not_lockless) +rtnl_lock (); + tp->ops->destroy (tp, rtnl_held || not_lockless, extack); +if (not_lockless) +rtnl_unlock ();tcf_proto_count_usesw (tp, false);if (sig_destroy)tcf_proto_signal_destroyed (tp->chain, tp);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 44/181 hwmon: (nzxt-smart2) Check return value of init_device() in probe
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qingshuang Fu <[email protected]>
[ Upstream commit d533882ce1060866a590257f2c77ee23eabef5b8 ]
The init_device() call in nzxt_smart2_hid_probe() can fail because it sends HID output reports to the hardware to detect fans and set the update interval. If the hardware is not responding or the HID reports fail, init_device() returns a negative error code.
However, the return value was ignored, causing the probe to continue and register an hwmon device even though the device was never properly initialized. This leads to an inconsistent state where the driver reports stale data or blocks on wait queues that will never be woken.
The same function's return value is already checked in the reset_resume() handler, confirming the author's intent that errors should be propagated.
Note that this fix was not possible before commit 59d104b54b0b ("hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop") because the out_hw_close error path was missing hid_device_io_stop(), which would have opened a use-after-free risk window.
--- drivers/hwmon/nzxt-smart2.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/hwmon/nzxt-smart2.c +5 -1
@@ -760,7 +760,11 @@ static int nzxt_smart2_hid_probe(struct hid_device *hdev,hid_device_io_start (hdev); -init_device (drvdata,UPDATE_INTERVAL_DEFAULT_MS ); + ret =init_device (drvdata,UPDATE_INTERVAL_DEFAULT_MS ); +if (ret) { +dev_err (&hdev->dev,"init_device failed: %d\n" , ret); + goto out_hw_close; + } drvdata->hwmon = hwmon_device_register_with_info(&hdev->dev, "nzxtsmart2", drvdata,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 45/181 hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit 0dabe8a56f772f0ece46d2597799f412c277d874 ]
In lm25066_probe(), the PMBus coefficients for current and power are scaled based on the shunt resistor value. The calculation evaluates the multiplication using 32-bit arithmetic because info->m is an int and shunt is a u32:
static int lm25066_probe(struct i2c_client *client) {
...
info->m[PSC_CURRENT_IN] = info->m[PSC_CURRENT_IN] * shunt / 1000;
info->m[PSC_POWER] = info->m[PSC_POWER] * shunt / 1000;
...
}For large coefficients like 26882 (LM25056) or 15076 (LM5066i), a device tree shunt-resistor-micro-ohms value exceeding approximately 159,000 (159 mOhm, which is physically valid for low-current applications) causes the intermediate product to exceed UINT_MAX (4,294,967,295). This results in a silent wraparound before the division by 1000.
Furthermore, if the wrapped value has the most significant bit set, converting it back to the signed int info->m results in negative coefficients. This logic error leads to drastically corrupted current and power readings, which can cause erratic thermal or power management behavior in the system.
Fix the problem by using 64-bit operations for the multiply/divide operations. This can still overflow, but only for unreasonably large shunt resistor values.
--- drivers/hwmon/pmbus/lm25066.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/hwmon/pmbus/lm25066.c +3 -2
@@ -14,6 +14,7 @@#include <linux/slab.h> #include <linux/i2c.h> #include <linux/log2.h> +#include <linux/math.h> #include <linux/of.h> #include "pmbus.h"
@@ -540,8 +541,8 @@ static int lm25066_probe(struct i2c_client *client)if (of_property_read_u32 (client->dev.of_node,"shunt-resistor-micro-ohms" , &shunt)) shunt =1000 ; - info->m[PSC_CURRENT_IN ] = info->m[PSC_CURRENT_IN ] * shunt /1000 ; - info->m[PSC_POWER ] = info->m[PSC_POWER ] * shunt /1000 ; + info->m[PSC_CURRENT_IN ] =DIV_ROUND_CLOSEST_ULL ((u64 )info->m[PSC_CURRENT_IN ] * shunt,1000 ); + info->m[PSC_POWER ] =DIV_ROUND_CLOSEST_ULL ((u64 )info->m[PSC_POWER ] * shunt,1000 );#if IS_ENABLED (CONFIG_SENSORS_LM25066_REGULATOR )/* LM25056 doesn't support OPERATION */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 46/181 selftests/ftrace: refactor eprobes test to fix argument checks
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Kaiser <[email protected]>
[ Upstream commit 6e3abef2a27e7402a94111c9eff85d887e64a309 ]
The add/remove eprobe test installs an eprobe for the openat syscall and runs ls. It checks the filenames that were opened by ls against a whitelist and a blacklist.
Commit 206b25c09080 ("tracing: eprobe: read the complete FILTER_PTR_STRING pointer") fixed access to some string fields in eprobes. This triggers test failures as the blacklist does not allow relative paths for the openat parameters.
What makes this test unstable is the fact that the openat calls vary a lot between different systems.
Refactor the test to make it more robust. "cd <directory>" will issue a chdir syscall with the target directory as parameter. Set an eprobe on the sys_enter_chdir event and filter for the exact directory name. Allow (fault) as fallback.
--- .../ftrace/test.d/dynevent/add_remove_eprobe.tc | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-)
tools/testing/selftests/ftrace/test.d/dynevent/add_remove_eprobe.tc +5 -11
@@ -1,16 +1,16 @@ #!/bin/sh # SPDX-License-Identifier: GPL-2.0 # description: Generic dynamic event - add/remove eprobe events -# requires: dynamic_events events/syscalls/sys_enter_openat "<attached-group>.<attached-event> [<args>]":README +# requires: dynamic_events events/syscalls/sys_enter_chdir "<attached-group>.<attached-event> [<args>]":README echo 0 > events/enable clear_dynamic_events SYSTEM="syscalls" -EVENT="sys_enter_openat" +EVENT="sys_enter_chdir" FIELD="filename" -EPROBE="eprobe_open" +EPROBE="eprobe_chdir" OPTIONS="file=+0(\$filename):ustring" echo "e:$EPROBE $SYSTEM/$EVENT $OPTIONS" >> dynamic_events
@@ -18,20 +18,14 @@ grep -q "$EPROBE" dynamic_events test -d events/eprobes/$EPROBE echo 1 > events/eprobes/$EPROBE/enable -ls +cd /sys/kernel/tracing echo 0 > events/eprobes/$EPROBE/enable -content=`grep '^ *ls-' trace | grep 'file='` -nocontent=`grep '^ *ls-' trace | grep 'file=' | grep -v -e '"/' -e '"."' -e '(fault)' ` || true - +content=`grep -e 'file="/sys/kernel/tracing"\|(fault)' trace` if [ -z "$content" ]; then exit_fail fi -if [ ! -z "$nocontent" ]; then - exit_fail -fi - echo "-:$EPROBE" >> dynamic_events ! grep -q "$EPROBE" dynamic_events
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 47/181 bnxt_en: Move RSS table fill outside __bnxt_hwrm_vnic_set_rss()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shravya KN <[email protected]>
[ Upstream commit 1d0fc6c7ea49994b8ff50d02979d1e4207ec6c4f ]
This is a refactor patch with no change in behavior. The caller will now fill the RSS table before calling __bnxt_hwrm_vnic_set_rss(). In the next patch, we'll add code to determine the default ring for the VNIC when we fill the RSS table.
Stable-dep-of: 0b137529a899 ("bnxt_en: Refresh VNIC default ring on queue restart if needed")
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +7 -7
@@ -6367,6 +6367,9 @@ static void bnxt_fill_hw_rss_tbl(struct bnxt *bp, struct bnxt_vnic_info *vnic)bool no_rss = !(vnic->flags &BNXT_VNIC_RSS_FLAG );u16 i, j; +if (!vnic->rss_table) +return ; +/* Fill the RSS indirection table with ring group ids */ for (i =0 , j =0 ; i <HW_HASH_INDEX_SIZE ; i++) {if (!no_rss)
@@ -6406,13 +6409,8 @@ static void __bnxt_hwrm_vnic_set_rss(struct bnxt *bp, struct hwrm_vnic_rss_cfg_input *req, struct bnxt_vnic_info *vnic) { - if (bp->flags & BNXT_FLAG_CHIP_P5_PLUS) { -bnxt_fill_hw_rss_tbl_p5 (bp, vnic); -if (bp->flags &BNXT_FLAG_CHIP_P7 ) - req->flags |=VNIC_RSS_CFG_REQ_FLAGS_IPSEC_HASH_TYPE_CFG_SUPPORT ; - } else { -bnxt_fill_hw_rss_tbl (bp, vnic); - } + if (bp->flags & BNXT_FLAG_CHIP_P7) + req->flags |= VNIC_RSS_CFG_REQ_FLAGS_IPSEC_HASH_TYPE_CFG_SUPPORT;if (bp->rss_hash_delta) { req->hash_type =cpu_to_le32 (bp->rss_hash_delta);
@@ -6464,6 +6462,7 @@ static int bnxt_hwrm_vnic_set_rss_p5(struct bnxt *bp,if (!set_rss)return hwrm_req_send (bp, req); +bnxt_fill_hw_rss_tbl_p5 (bp, vnic);__bnxt_hwrm_vnic_set_rss (bp, req, vnic); ring_tbl_map = vnic->rss_table_dma_addr; nr_ctxs =bnxt_get_nr_rss_ctxs (bp, bp->rx_nr_rings);
@@ -10299,6 +10298,7 @@ static int __bnxt_setup_vnic(struct bnxt *bp, struct bnxt_vnic_info *vnic) } skip_rss_ctx: +bnxt_fill_hw_rss_tbl (bp, vnic);/* configure default vnic, ring grp */ rc =bnxt_hwrm_vnic_cfg (bp, vnic);if (rc) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 48/181 bnxt_en: Determine and store default RX ring in vnic structure
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shravya KN <[email protected]>
[ Upstream commit 53f01cd594e223aabb538d5288e60111523c96f2 ]
Each VNIC has a default RX ring. The purpose of the default RX ring is to provide a destination for any packets that cannot be parsed by the RSS logic. Up until now, the default RX ring is always Ring 0.
We neglected to take care of this default RX ring when adding the queue restart feature. If ring 0 (default ring) is re-started, it may now have a new FW ring ID after freeing the old one and allocating a new one. The VNIC now may have a stale default ring and it may generate an internal exception. This exception may appear in dmesg:
FW reported unknown error type 10
The best way to resolve this issue is to use a more appropriate ring for the default ring instead of always ring 0. Ring 0 may not even be in the RSS table, especially on a new RSS context.
This patch adds the logic to determine and store the proper default RX ring for a VNIC. For an RSS VNIC, the default ring is the lowest ring number in the RSS table. The next patch will add proper logic to update the VNIC if the default ring changes after queue restart.
Stable-dep-of: 0b137529a899 ("bnxt_en: Refresh VNIC default ring on queue restart if needed")
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 33 +++++++++++++++-------- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 + 2 files changed, 23 insertions(+), 11 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +22 -11
@@ -6365,25 +6365,36 @@ int bnxt_get_nr_rss_ctxs(struct bnxt *bp, int rx_rings)static void bnxt_fill_hw_rss_tbl (struct bnxt *bp,struct bnxt_vnic_info *vnic) {bool no_rss = !(vnic->flags &BNXT_VNIC_RSS_FLAG ); -u16 i, j; +u16 i, j, min_j = bp->rx_nr_rings -1 ;if (!vnic->rss_table) -return ; + goto skip_rss_tbl;/* Fill the RSS indirection table with ring group ids */ for (i =0 , j =0 ; i <HW_HASH_INDEX_SIZE ; i++) {if (!no_rss) j = bp->rss_indir_tbl[i]; + min_j =min (j, min_j); vnic->rss_table[i] =cpu_to_le16 (vnic->fw_grp_ids[j]); } + +skip_rss_tbl: +if (vnic->rss_table && !no_rss) + vnic->default_rx_ring = min_j; +else if (vnic->flags &BNXT_VNIC_RFS_FLAG ) + vnic->default_rx_ring = vnic->vnic_id -1 ; +else if ((vnic->vnic_id ==1 ) &&BNXT_CHIP_TYPE_NITRO_A0 (bp)) + vnic->default_rx_ring = bp->rx_nr_rings -1 ; +else + vnic->default_rx_ring =0 ; }static void bnxt_fill_hw_rss_tbl_p5 (struct bnxt *bp,struct bnxt_vnic_info *vnic) { +u16 tbl_size, i, min_j = bp->rx_nr_rings -1 ;__le16 *ring_tbl = vnic->rss_table;struct bnxt_rx_ring_info *rxr; -u16 tbl_size, i; tbl_size =bnxt_get_rxfh_indir_size (bp->dev);
@@ -6396,6 +6407,7 @@ static void bnxt_fill_hw_rss_tbl_p5(struct bnxt *bp, j =ethtool_rxfh_context_indir (vnic->rss_ctx)[i]; else j = bp->rss_indir_tbl[i]; + min_j =min (j, min_j); rxr = &bp->rx_ring[j]; ring_id = rxr->rx_ring_struct.fw_ring_id;
@@ -6403,6 +6415,7 @@ static void bnxt_fill_hw_rss_tbl_p5(struct bnxt *bp, ring_id =bnxt_cp_ring_for_rx (bp, rxr); *ring_tbl++ =cpu_to_le16 (ring_id); } + vnic->default_rx_ring = min_j; } static void
@@ -6600,8 +6613,9 @@ int bnxt_hwrm_vnic_cfg(struct bnxt *bp, struct bnxt_vnic_info *vnic)return rc;if (bp->flags &BNXT_FLAG_CHIP_P5_PLUS ) { -struct bnxt_rx_ring_info *rxr = &bp->rx_ring[0 ]; +struct bnxt_rx_ring_info *rxr; + rxr = &bp->rx_ring[vnic->default_rx_ring]; req->default_rx_ring_id =cpu_to_le16 (rxr->rx_ring_struct.fw_ring_id); req->default_cmpl_ring_id =
@@ -6634,13 +6648,7 @@ int bnxt_hwrm_vnic_cfg(struct bnxt *bp, struct bnxt_vnic_info *vnic) req->cos_rule =cpu_to_le16 (0xffff ); } -if (vnic->flags &BNXT_VNIC_RSS_FLAG ) - ring =0 ; -else if (vnic->flags &BNXT_VNIC_RFS_FLAG ) - ring = vnic->vnic_id -1 ; -else if ((vnic->vnic_id ==1 ) &&BNXT_CHIP_TYPE_NITRO_A0 (bp)) - ring = bp->rx_nr_rings -1 ; - + ring = vnic->default_rx_ring; grp_idx = bp->rx_ring[ring].bnapi->index; req->dflt_ring_grp =cpu_to_le16 (bp->grp_info[grp_idx].fw_grp_id); req->lb_rule =cpu_to_le16 (0xffff );
@@ -10604,6 +10612,9 @@ static int bnxt_setup_nitroa0_vnic(struct bnxt *bp)return rc; } +/* Setup the proper default RX ring */ +bnxt_fill_hw_rss_tbl (bp, vnic); + rc =bnxt_hwrm_vnic_cfg (bp, vnic);if (rc) { netdev_err(bp->dev, "Cannot allocate special vnic for NS2 A0: %x\n",
drivers/net/ethernet/broadcom/bnxt/bnxt.h +1 -0
@@ -1300,6 +1300,7 @@ struct bnxt_vnic_info {#define BNXT_VNIC_RSSCTX_FLAG 0x40struct ethtool_rxfh_context *rss_ctx;u32 vnic_id; +u16 default_rx_ring; };struct bnxt_rss_ctx {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 49/181 bnxt_en: Refresh VNIC default ring on queue restart if needed
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shravya KN <[email protected]>
[ Upstream commit 0b137529a8997caf67190ca1d71ba8bbdb44fbfb ]
When a queue is restarted, refresh VNIC_CFG for all VNICs whose default RX ring is the restarted ring. This will eliminate this possible FW warning caused by a stale default ring in the VNIC:
FW reported unknown error type 10
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +5 -0
@@ -10531,6 +10531,11 @@ static int bnxt_set_vnic_mru_p5(struct bnxt *bp, struct bnxt_vnic_info *vnic, vnic->vnic_id, rc);return rc; } +if (rxr_id == vnic->default_rx_ring) { + rc =bnxt_hwrm_vnic_cfg (bp, vnic); +if (rc) +return rc; + } } vnic->mru = mru; bnxt_hwrm_vnic_update(bp, vnic,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 50/181 bnxt_en: Fix PTP PPS setting bug
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keegan Freyhof <[email protected]>
[ Upstream commit 80eaf88efec33ac77ed7726d066c4f2f932cc329 ]
The existing driver logic is always turning on PTP_CLK_REQ_PPS regardless of the "on" parameter passed to bnxt_ptp_enable(). During shutdown, PTP_CLK_REQ_PPS may be turned off and this bug will do the opposite and may trigger a PCIe PTM request TLP. On some systems this can trigger a PCIe AER.
Fix it by properly configuring PTP_CLK_REQ_PPS based on the "on" parameter.
--- drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c +5 -2
@@ -494,12 +494,15 @@ static int bnxt_ptp_enable(struct ptp_clock_info *ptp_info,return rc;case PTP_CLK_REQ_PPS :/* Configure PHC PPS IN */ - rc =bnxt_ptp_cfg_pin (bp,0 ,BNXT_PPS_PIN_PPS_IN ); + pin_id =0 ; +if (!on) +break ; + rc =bnxt_ptp_cfg_pin (bp, pin_id,BNXT_PPS_PIN_PPS_IN );if (rc)return rc; rc =bnxt_ptp_cfg_event (bp,BNXT_PPS_EVENT_INTERNAL );if (!rc) - ptp->pps_info.pins[0 ].event =BNXT_PPS_EVENT_INTERNAL ; + ptp->pps_info.pins[pin_id].event =BNXT_PPS_EVENT_INTERNAL ;return rc;default :netdev_err (ptp->bp->dev,"Unrecognized PIN function\n" );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 51/181 sctp: fix addip_serial increment on ASCONF_ACK allocation failure
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qing Luo <[email protected]>
[ Upstream commit aa2e13ae8d3cbe2c15ef4f7e971b2de0832794aa ]
In sctp_process_asconf(), when sctp_make_asconf_ack() fails to allocate the ASCONF_ACK chunk due to memory pressure, the code jumps to the done label where asoc->peer.addip_serial is unconditionally incremented.
This leaves the peer's ASCONF (serial N) unacknowledged while the local endpoint now expects serial N+1. When the peer retransmits serial N, it falls into the serial < addip_serial + 1 branch ,
which attempts to look up a cached ACK for serial N. No cached ACK exists since the allocation failed, so the retransmission is silently discarded. The peer eventually times out and ABORTs the association.
Move the addip_serial increment inside the if (asconf_ack) block so that the serial number is only advanced when the ASCONF_ACK is successfully created and cached. This way, on allocation failure, the serial number is unchanged and the peer's retransmitted ASCONF will be correctly re-processed.
--- net/sctp/sm_make_chunk.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/sctp/sm_make_chunk.c +1 -2
@@ -3354,12 +3354,11 @@ struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc, goto done; } done: - asoc->peer.addip_serial++; -/* If we are sending a new ASCONF_ACK hold a reference to it in assoc * after freeing the reference to old asconf ack if any. */ if (asconf_ack) { + asoc->peer.addip_serial++;sctp_chunk_hold (asconf_ack);list_add_tail (&asconf_ack->transmitted_list, &asoc->asconf_ack_list);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 52/181 tcp: fix TFO max_qlen accounting across reuseport migration
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <[email protected]>
[ Upstream commit a0ab2ba83e35159d81cec830a92e885ecf8139be ]
A listener's TCP_FASTOPEN max_qlen stops being accurate and lets through far more pending Fast Open requests than it was configured for.
This only shows up with SO_REUSEPORT listener migration, where closing a listener hands its still-pending TFO children over to a surviving one.
fastopenq.qlen is charged in tcp_fastopen_create_child() when the child is created and uncharged in reqsk_fastopen_remove() when the handshake completes. The uncharge follows rsk_listener of the request the child points at, and inet_reqsk_clone() has repointed the child at a new request owned by the new listener, so the ++ and the -- land on two different sockets. The new listener's qlen drifts negative and its limit no longer binds.
Charge the new listener during migration, like reqsk_queue_migrated() already does for queue->young and queue->qlen.
--- net/ipv4/inet_connection_sock.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-)
net/ipv4/inet_connection_sock.c +16 -4
@@ -987,11 +987,23 @@ static struct request_sock *inet_reqsk_clone(struct request_sock *req, nreq->rsk_listener = sk; -/* We need not acquire fastopenq->lock -* because the child socket is locked in inet_csk_listen_stop(). -*/ -if (sk->sk_protocol ==IPPROTO_TCP &&tcp_rsk (nreq)->tfo_listener) +if (sk->sk_protocol ==IPPROTO_TCP &&tcp_rsk (nreq)->tfo_listener) { +struct fastopen_queue *fastopenq; + +/* reqsk_fastopen_remove() will uncharge nreq->rsk_listener, +* that is @sk, so charge it here. Unlike the listener +* being closed, @sk is live and needs its lock. +*/ + fastopenq = &inet_csk (sk)->icsk_accept_queue.fastopenq; +spin_lock_bh (&fastopenq->lock); + fastopenq->qlen++; +spin_unlock_bh (&fastopenq->lock); + +/* We need not acquire fastopenq->lock +* because the child socket is locked in inet_csk_listen_stop(). +*/ rcu_assign_pointer (tcp_sk (nreq->sk)->fastopen_rsk, nreq); + }return nreq; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 53/181 net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henry Martin <[email protected]>
[ Upstream commit afa58b7384913c8773d837acdb07b035690ec5d2 ]
ncsi_send_cmd_nl() takes the number of bytes to copy from the attacker-controlled ncsi_pkt_hdr.length field of the in-band packet header, while the source buffer is the NCSI_ATTR_DATA netlink attribute whose readable size is nla_len() - sizeof(ncsi_pkt_hdr). The two length sources are never cross-checked: only nla_len() >= sizeof(struct ncsi_pkt_hdr) is enforced.
With hdr->length set larger than the attribute payload (up to 65535 against at most 2032 readable bytes), ncsi_cmd_handler_oem() copies past the end of the netlink attribute buffer with unsafe_memcpy(), leaking up to ~64KB of kernel heap memory into the transmitted NCSI command packet. The destination skb is sized by the declared payload, so the write side does not overflow - this is a pure OOB read / information leak, reachable with CAP_NET_ADMIN on systems with a registered NCSI device (e.g. OpenBMC on Aspeed BMC SoCs, where NET_NCSI=y is standard).
Reject commands whose declared payload extends past the end of the data attribute.
The issue was found by the autokbug dynamic kernel fuzzer at Tencent Yunding Lab.
--- net/ncsi/ncsi-netlink.c | 4 ++++ 1 file changed, 4 insertions(+)
net/ncsi/ncsi-netlink.c +4 -0
@@ -461,6 +461,10 @@ static int ncsi_send_cmd_nl(struct sk_buff *msg, struct genl_info *info) nca.req_flags =NCSI_REQ_FLAG_NETLINK_DRIVEN ; nca.info = info; nca.payload =ntohs (hdr->length); +if (nca.payload > len -sizeof (*hdr)) { + ret = -EINVAL ; + goto out_netlink; + } nca.data = data +sizeof (*hdr); ret =ncsi_xmit_cmd (&nca);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 54/181 net: prestera: validate firmware header length
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit 8ae344eb540af3f457179b52bc6061416752485c ]
prestera_fw_hdr_parse() reads the firmware header before checking that the firmware image contains that header.
Reject images shorter than struct prestera_fw_header before decoding the magic and version fields.
--- drivers/net/ethernet/marvell/prestera/prestera_pci.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/marvell/prestera/prestera_pci.c +3 -0
@@ -684,6 +684,9 @@ static int prestera_fw_hdr_parse(struct prestera_fw *fw)struct prestera_fw_header *hdr;u32 magic; +if (fw->bin->size <sizeof (*hdr)) +return -EINVAL ; + hdr = (struct prestera_fw_header *)fw->bin->data; magic =be32_to_cpu (hdr->magic_number);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 55/181 net: remove WARN_ON_ONCE() from sk_mc_loop()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit b8a39a09ae4eaae04309e1e38ed6a1101d967496 ]
sk_mc_loop() can be called for sockets that are neither AF_INET nor AF_INET6 (e.g. AF_PACKET sockets when sending packets via raw/packet socket over virtual devices such as VRF or ipvlan).
In such cases, sk_family is not AF_INET/AF_INET6 and sk_mc_loop() falls through the switch statement and triggers WARN_ON_ONCE(1).
Non-INET sockets do not support IP_MULTICAST_LOOP or IPV6_MULTICAST_LOOP options, so loopback should default to true without generating a warning.
--- net/core/sock.c | 1 - 1 file changed, 1 deletion(-)
net/core/sock.c +0 -1
@@ -773,7 +773,6 @@ bool sk_mc_loop(const struct sock *sk)return inet6_test_bit (MC6_LOOP , sk);#endif } -WARN_ON_ONCE (1 );return true; }EXPORT_SYMBOL (sk_mc_loop);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 56/181 net/smc: fix TOCTOU race between smc_listen_out() and listener close
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sidraya Jayagond <[email protected]>
[ Upstream commit 185a4caeecabc150106deda1da170b09f2ad803f ]
smc_listen_out() reads lsmc->sk.sk_state without the listener lock, then acquires lock_sock_nested() only after the check passes. This opens a window where smc_close_active() can transition the listener to SMC_CLOSED, call smc_close_cleanup_listen() to drain the accept queue, and release the lock, all between the lockless read and the delayed lock acquisition:
smc_listen_work (smc_hs_wq) smc_close_active()
------------------------------- -------------------------
release_sock(child)
if (sk_state == SMC_LISTEN) TRUE
lock_sock(listener) sk_state = SMC_CLOSED smc_close_cleanup_listen() release_sock(listener) flush_work(tcp_listen_work)
lock_sock_nested(listener)
smc_accept_enqueue(listener, child) /* child enqueued on dead listener */
smc_close_active() flushes only tcp_listen_work. Work items already dispatched onto smc_hs_wq for the CLC handshake continue running unguarded. smc_accept_enqueue() takes a sock_hold() on the child that is never released, so the child smc_sock, its clcsock, and the reference all leak. A remote peer that opens TCP connections while the server calls close() can exhaust kernel memory.
Move lock_sock_nested() to before the sk_state check so that the test and the enqueue are atomic under the listener lock.
--- net/smc/af_smc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/smc/af_smc.c +2 -1
@@ -1933,11 +1933,12 @@ static void smc_listen_out(struct smc_sock *new_smc)atomic_dec (&lsmc->queued_smc_hs);release_sock (newsmcsk);/* lock in smc_listen_work() */ +lock_sock_nested (&lsmc->sk,SINGLE_DEPTH_NESTING );if (lsmc->sk.sk_state ==SMC_LISTEN ) { -lock_sock_nested (&lsmc->sk,SINGLE_DEPTH_NESTING );smc_accept_enqueue (&lsmc->sk, newsmcsk);release_sock (&lsmc->sk); }else {/* no longer listening */ +release_sock (&lsmc->sk);smc_close_non_accepted (newsmcsk); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 57/181 net: thunderbolt: Tear down DMA paths before stopping the rings
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan XinRan <[email protected]>
[ Upstream commit 68bf02b6b4ad3f748c6db71fd77b6c0402d252f4 ]
tbnet_tear_down() stops both rings and frees their frame buffers before calling tb_xdomain_disable_paths(). tb_ring_stop() zeroes the ring's descriptor base and tbnet_free_buffers() unmaps and frees the pages the frames sit in, so by the time __tb_path_deactivate_hop() polls the hop's 'pending' bit, anything still in flight has nowhere to drain to.
The teardown sequence has been in this order since the driver was added. The setup path has not: commit ff7cd07f3064 ("net: thunderbolt: Enable DMA paths only after rings are enabled") moved the path enable to the end of tbnet_connected_work() and documented why:
/* Both logins successful so enable the rings, high-speed DMA
* paths and start the network device queue.
*
* Note we enable the DMA paths last to make sure we have primed
* the Rx ring before any incoming packets are allowed to
* arrive.
*/
Teardown was never updated to match, so the rings and the paths now come down in the same order they go up instead of in reverse.
On an ASMedia ASM4242 host router the 'pending' bit then never clears:
every teardown burns the full 500 ms timeout and __tb_path_deactivate_hop() returns -ETIMEDOUT. Raising the timeout to 5 s does not help, so the hop is not slow to drain, it never drains at all.
The failure is invisible above the thunderbolt core. __tb_path_deactivate_hops() is void and only calls tb_port_warn(); tb_path_deactivate(), tb_tunnel_deactivate() and __tb_disconnect_xdomain_paths() are void as well, and tb_disconnect_xdomain_paths() ends in an unconditional "return 0". So tb_xdomain_disable_paths() reports success and the netdev_warn() below it never fires. Repeated teardowns eventually take the XDomain control channel down, after which the peer node is gone and only a power cycle brings the controller back.
Deactivating the paths first fixes it. Measured with kretprobes on a stock v6.17 tree with no other patches applied, on a link that was up and had just carried traffic:
before: __tb_path_deactivate_hop() returns 0 for the first hop, then
-ETIMEDOUT for the second 500335 us later
after: 0 for both, 525 us apart
Alternating the two orderings ABBA over three load levels, four teardowns per arm: every teardown failed before the change (21 of 21 that ran), none failed after (0 of 24). The before arms ran short because the link died partway through. The same split shows up when the interface is enslaved to a bond instead of just brought down, which is how I ran into this in the first place. Throughput and latency after the change are unchanged.
Hosts whose routers drain the hop despite the stale descriptor base see no functional difference, since the paths end up deactivated either way.
--- drivers/net/thunderbolt/main.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-)
drivers/net/thunderbolt/main.c +15 -5
@@ -389,11 +389,16 @@ static void tbnet_tear_down(struct tbnet *net, bool send_logout)break ; } -tb_ring_stop (net->rx_ring.ring); -tb_ring_stop (net->tx_ring.ring); -tbnet_free_buffers (&net->rx_ring); -tbnet_free_buffers (&net->tx_ring); - +/* Tear the paths down before stopping the rings. This mirrors +* tbnet_connected_work(), which enables the paths last so the +* Rx ring is primed before packets can arrive. Stopping a +* ring zeroes its descriptor base and tbnet_free_buffers() +* unmaps and frees the frame buffers, leaving anything still +* in flight with nowhere to drain to; +* __tb_path_deactivate_hop() then waits for the hop's +* 'pending' bit, which on some host routers never clears in +* that state. +*/ ret = tb_xdomain_disable_paths(net->xd, net->local_transmit_path, net->tx_ring.ring->hop,
@@ -402,6 +407,11 @@ static void tbnet_tear_down(struct tbnet *net, bool send_logout)if (ret)netdev_warn (net->dev,"failed to disable DMA paths\n" ); +tb_ring_stop (net->rx_ring.ring); +tb_ring_stop (net->tx_ring.ring); +tbnet_free_buffers (&net->rx_ring); +tbnet_free_buffers (&net->tx_ring); +tb_xdomain_release_in_hopid (net->xd, net->remote_transmit_path); net->remote_transmit_path =0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 58/181 ata: pata_sl82c105: fix bridge revision use-after-free
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongyan Xu <[email protected]>
[ Upstream commit 7700a31039cdc6715cb6cce7e7a664ee4e945f67 ]
pci_get_slot() returns a referenced PCI device. Commit 44c10138fd4b ("PCI: Change all drivers to use pci_device->revision") replaced a configuration-space read with direct access to the cached revision field, but left that access after pci_dev_put(). The bridge may therefore be freed before its revision is read.
Read the revision before dropping the reference.
--- drivers/ata/pata_sl82c105.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/ata/pata_sl82c105.c +3 -1
@@ -264,6 +264,7 @@ static struct ata_port_operations sl82c105_port_ops = {static int sl82c105_bridge_revision (struct pci_dev *pdev) {struct pci_dev *bridge; +u8 revision;/* * The bridge should be part of the same device, but function 0.
@@ -285,8 +286,9 @@ static int sl82c105_bridge_revision(struct pci_dev *pdev)/* * We need to find function 0's revision, not function 1 */ + revision = bridge->revision;pci_dev_put (bridge); -return bridge->revision; +return revision; }static void sl82c105_fixup (struct pci_dev *pdev)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 59/181 net/atm: fix slab-out-of-bounds read in vcc_setsockopt()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit d0c80dbb970439bd2eeb0e5effff8c16a5f4e1e3 ]
vcc_setsockopt() contained an ineffective optlen check:
if (__SO_LEVEL_MATCH(optname, level) && optlen != __SO_SIZE(optname))
return -EINVAL;
If __SO_LEVEL_MATCH(optname, level) evaluated to false (e.g. if the caller passed a mismatched level), the length check optlen != __SO_SIZE(optname) was short-circuited and bypassed. Execution then fell through to switch(optname), calling copy_from_sockptr() assuming optval contained sufficient space.
Furthermore, even if level matched, a cgroup BPF setsockopt filter could shrink optlen after entry. Because copy_from_sockptr() on kernel pointers uses memcpy(), this leads to a KASAN slab-out-of-bounds read when optlen is smaller than the expected structure size.
Fix this by using copy_safe_from_sockptr(), which unconditionally validates that optlen is at least the expected size before copying. Also change the local 'value' variable type from 'unsigned long' to 'int' so that SO_SETCLP matches its sizeof(int) ABI encoding on 64-bit systems.
--- net/atm/common.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
net/atm/common.c +9 -5
@@ -760,7 +760,7 @@ int vcc_setsockopt(struct socket *sock, int level, int optname, sockptr_t optval, unsigned int optlen) {struct atm_vcc *vcc; -unsigned long value; +int value;int error;if (__SO_LEVEL_MATCH (optname, level) && optlen !=__SO_SIZE (optname))
@@ -772,8 +772,10 @@ int vcc_setsockopt(struct socket *sock, int level, int optname, {struct atm_qos qos; -if (copy_from_sockptr (&qos, optval,sizeof (qos))) -return -EFAULT ; + error =copy_safe_from_sockptr (&qos,sizeof (qos), optval, + optlen); +if (error) +return error; error =check_qos (&qos);if (error)return error;
@@ -786,8 +788,10 @@ int vcc_setsockopt(struct socket *sock, int level, int optname,return 0 ; }case SO_SETCLP : -if (copy_from_sockptr (&value, optval,sizeof (value))) -return -EFAULT ; + error =copy_safe_from_sockptr (&value,sizeof (value), optval, + optlen); +if (error) +return error;if (value) vcc->atm_options |=ATM_ATMOPT_CLP ;else
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 60/181 sctp: clear control chunk transport if it is being removed
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit c9158ceaf27780ef64534ad72f44ffde3f8ccc49 ]
sctp_make_heartbeat_ack() caches the destination transport in chunk->transport without taking a reference. When src_out_of_asoc_ok is enabled, the HEARTBEAT ACK may remain queued on control_chunk_list instead of being transmitted immediately.
If the peer transport is removed while the chunk is still queued, sctp_assoc_rm_peer() drops the transport and schedules it for RCU freeing, but only clears cached transport pointers in out_chunk_list. The queued control chunk therefore retains a dangling transport pointer.
Once an ASCONF_ACK clears the suppression and the queued control chunk is transmitted, SCTP dereferences the stale transport pointer, leading to a use-after-free.
Fix this by also clearing chunk->transport for queued control chunks in control_chunk_list when removing the transport.
--- net/sctp/associola.c | 4 ++++ 1 file changed, 4 insertions(+)
net/sctp/associola.c +4 -0
@@ -573,6 +573,10 @@ void sctp_assoc_rm_peer(struct sctp_association *asoc,if (ch->transport == peer) ch->transport =NULL ; +list_for_each_entry (ch, &asoc->outqueue.control_chunk_list, list) +if (ch->transport == peer) + ch->transport =NULL ; + asoc->peer.transport_count--;sctp_ulpevent_notify_peer_addr_change (peer,SCTP_ADDR_REMOVED ,0 );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 61/181 tls: dont abort the connection on signal-interrupted sends
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maximilian Immanuel Brandtner <[email protected]>
[ Upstream commit af0e5cdd031f4f4a8f6d4160bfbda4f36872b0ed ]
When a signal interrupts a blocking send, tls_tx_records() treats the resulting -ERESTARTSYS as a transmission failure and marks the socket errored via tls_err_abort() with the raw error code. Later syscalls return the kernel-internal errno 512 (ERESTARTSYS) to userspace, as the signal it stems from is no longer pending during syscall exit and thus never translated.
An interrupted send is not a connection error: the partially sent record stays queued and is resent later. Interrupt error codes are therefore excluded from the abort in the same way as -EAGAIN.
--- net/tls/tls_sw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/tls/tls_sw.c +1 -1
@@ -458,7 +458,7 @@ int tls_tx_records(struct sock *sk, int flags) } tx_err: -if (rc <0 && rc != -EAGAIN ) +if (rc <0 && rc != -EAGAIN && rc != -EINTR && rc != -ERESTARTSYS )tls_err_abort (sk, rc);return rc;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 62/181 hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wilken Gottwalt <[email protected]>
[ Upstream commit 36c4d73ce05d1d8896c2669eb0730d35a02a2ec1 ]
In theory it could be possible that the REPLY_SIZE sized buffers for holding the vendor and product strings could be end up missing the null termination (for example by malicious hardware built on purpose) required by the seq_printf() call. That limits the debugfs printf calls to a maximum string length of REPLY_SIZE.
--- drivers/hwmon/corsair-psu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/hwmon/corsair-psu.c +2 -2
@@ -709,7 +709,7 @@ static int vendor_show(struct seq_file *seqf, void *unused) {struct corsairpsu_data *priv = seqf->private; -seq_printf (seqf,"%s\n" , priv->vendor); +seq_printf (seqf,"%.*s\n" ,REPLY_SIZE , priv->vendor);return 0 ; }
@@ -719,7 +719,7 @@ static int product_show(struct seq_file *seqf, void *unused) {struct corsairpsu_data *priv = seqf->private; -seq_printf (seqf,"%s\n" , priv->product); +seq_printf (seqf,"%.*s\n" ,REPLY_SIZE , priv->product);return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 63/181 hwmon: (ads7828) Fix external VREF regulator handling
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qingshuang Fu <[email protected]>
[ Upstream commit fddb5ceaf901b050ed2a1a7deeecbf97e003435a ]
The driver currently has two issues with the external VREF regulator handling in ads7828_probe():
1. All errors from devm_regulator_get_optional() are ignored, causing the driver to incorrectly fall back to internal VREF even for transient errors like -EPROBE_DEFER or genuine failures like -ENOMEM.
2. The external regulator is never enabled. The driver calls regulator_get_voltage() without first calling regulator_enable(), so the VREF pin may remain unpowered if the regulator is not configured as always-on.
Fix both issues by switching to devm_regulator_get_enable_read_voltage(), which handles regulator get, enable, and voltage read in one call. Only -ENODEV (no regulator specified in device tree) should trigger the fallback to internal VREF. All other errors are propagated to the caller.
--- drivers/hwmon/ads7828.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/hwmon/ads7828.c +6 -5
@@ -106,12 +106,11 @@ static int ads7828_probe(struct i2c_client *client)struct ads7828_data *data;struct device *hwmon_dev;unsigned int vref_mv =ADS7828_INT_VREF_MV ; -unsigned int vref_uv; +int vref_uv;bool diff_input = false;bool ext_vref = false;unsigned int regval;enum ads7828_chips chip; -struct regulator *reg; data =devm_kzalloc (dev,sizeof (struct ads7828_data ),GFP_KERNEL );if (!data)
@@ -125,9 +124,11 @@ static int ads7828_probe(struct i2c_client *client) }else if (dev->of_node) { diff_input =of_property_read_bool (dev->of_node,"ti,differential-input" ); - reg =devm_regulator_get_optional (dev,"vref" ); -if (!IS_ERR (reg)) { - vref_uv =regulator_get_voltage (reg); + vref_uv =devm_regulator_get_enable_read_voltage (dev,"vref" ); +if (vref_uv <0 ) { +if (vref_uv != -ENODEV ) +return vref_uv; + }else { vref_mv =DIV_ROUND_CLOSEST (vref_uv,1000 );if (vref_mv <ADS7828_EXT_VREF_MV_MIN || vref_mv >ADS7828_EXT_VREF_MV_MAX )
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 64/181 hwmon: (ltc4282) Avoid overflow in maximum power calculation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit edd11a94335747423569500a194c6eaa915f2963 ]
During device initialization in ltc4282_set_max_limits(), the calculation of the maximum power limit can suffer from a 32-bit integer overflow.
static int ltc4282_set_max_limits(struct ltc4282_state *st)
{
...
st->power_max = DIV_ROUND_CLOSEST(st->vsense_max * DECA * MILLI,
st->rsense) * st->vfs_out;
...
}The result of DIV_ROUND_CLOSEST() evaluates to a 32-bit unsigned integer on 32-bit architectures. This result is then multiplied by st->vfs_out, which is a 16-bit unsigned integer. According to C promotion rules, since both operands are 32-bit or smaller, the multiplication is performed in 32-bit precision.
If the device is configured with a low sense resistor value via the device tree (for example, 100 nano-ohms, resulting in st->rsense = 1) and the voltage is high, the division result can reach 343,750,000 and st->vfs_out can be 33,280. The product of these values is approximately 11.44 trillion, which exceeds the maximum capacity of a 32-bit integer and overflows before being stored in st->power_max.
This overflow causes a truncated value to be assigned to st->power_max and written to the hardware limit register. An incorrect maximum power limit can trigger spurious power-bad faults or alarms, which may lead to the shutdown of the monitored power rail.
Avoid the problem by calculating and storing the maximum power using 64-bit variables.
--- drivers/hwmon/ltc4282.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/hwmon/ltc4282.c +6 -6
@@ -142,7 +142,7 @@ struct ltc4282_state {*/ struct ltc4282_cache in0_1_cache[LTC4282_CHAN_VGPIO ];u32 vsense_max; -long power_max; +s64 power_max;u32 rsense;u16 vdd;u16 vfs_out;
@@ -621,13 +621,12 @@ static int ltc4282_read(struct device *dev, enum hwmon_sensor_types type, }static int ltc4282_write_power_byte (const struct ltc4282_state *st,u32 reg, -long val) +s64 val) {u32 power;u64 temp; -if (val > st->power_max) - val = st->power_max; + val =clamp (val,0 , st->power_max); temp = val *int_pow (U8_MAX ,2 ) * st->rsense; power = DIV64_U64_ROUND_CLOSEST(temp,
@@ -637,7 +636,7 @@ static int ltc4282_write_power_byte(const struct ltc4282_state *st, u32 reg, }static int ltc4282_write_power_word (const struct ltc4282_state *st,u32 reg, -long val) +u64 val) {u64 temp =int_pow (U16_MAX ,2 ) * st->rsense, temp_2;__be16 __raw;
@@ -1254,7 +1253,8 @@ static int ltc4282_set_max_limits(struct ltc4282_state *st)return ret;/* Power is given by ISENSE * Vout. */ - st->power_max =DIV_ROUND_CLOSEST (st->vsense_max *DECA *MILLI , st->rsense) * st->vfs_out; + st->power_max =DIV_ROUND_CLOSEST_ULL ((u64 )st->vsense_max *DECA *MILLI , + st->rsense) * st->vfs_out; ret =ltc4282_write_power_byte (st,LTC4282_POWER_MAX , st->power_max);if (ret)return ret;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 65/181 hwmon: (ltc4282) Clamp negative current limits
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit e253dd5f9f6d875a317895bf43ec9534ed7523cb ]
When a negative value is passed to ltc4282_write_curr(), the signed long val is cast directly to u64:
drivers/hwmon/ltc4282.c:ltc4282_write_curr() {
/* need to pass it in millivolt */
u32 in = DIV_ROUND_CLOSEST_ULL((u64)val * st->rsense, DECA * MICRO);
...
}This cast converts negative inputs into large positive values. The subsequent division result overflows the u32 in variable, truncating to a pseudo-random positive value. When this is passed to ltc4282_write_voltage_byte(), it is clamped to the maximum limit instead of zero.
Clamp val to 0 and to the maximum supported upper limit before the cast and assign the result to a 64-bit temporary variable before the division to avoid the underflow and an also possible overflow.
--- drivers/hwmon/ltc4282.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/hwmon/ltc4282.c +5 -1
@@ -15,6 +15,7 @@#include <linux/hwmon-sysfs.h> #include <linux/i2c.h> #include <linux/math.h> +#include <linux/math64.h> #include <linux/minmax.h> #include <linux/module.h> #include <linux/mod_devicetable.h>
@@ -945,8 +946,11 @@ static int ltc4282_curr_reset_hist(struct ltc4282_state *st)static int ltc4282_write_curr (struct ltc4282_state *st,u32 attr,long val) { +s32 ulimit =min_t (u64,INT_MAX , +div_u64 ((u64 )INT_MAX *DECA *MICRO , st->rsense)); +u64 val64 =clamp (val,0 , ulimit);/* need to pass it in millivolt */ -u32 in =DIV_ROUND_CLOSEST_ULL ((u64 )val * st->rsense,DECA *MICRO ); +u32 in =DIV_ROUND_CLOSEST_ULL (val64 * st->rsense,DECA *MICRO );switch (attr) {case hwmon_curr_max:
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 66/181 hwmon: (ltc4282) Fix parsing adi,current-limit-sense-microvolt
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit 335698fd7f60b6707b21fda725f97f35fa956b07 ]
ltc4282_parse_dt() evaluates the wrong variable when parsing the current limit.
When the adi,current-limit-sense-microvolt property is parsed into st->vsense_max, the subsequent switch statement evaluates the unrelated val variable instead of st->vsense_max:
drivers/hwmon/ltc4282.c:ltc4282_parse_dt() {
...
ret = device_property_read_u32(dev, "adi,current-limit-sense-microvolt",
&st->vsense_max);
if (!ret) {
int reg_val;
switch (val) {
case 12500:
reg_val = 0;
break;
...
}Because val holds a small integer representing vin_mode (from 0 to 3), it never matches any of the valid current limit cases.
This causes it to always fall through to the default error case, return -EINVAL, and aborts probe initialization for any device tree using this property.
Validate st->vsense_max instead to fix the problem.
--- drivers/hwmon/ltc4282.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/ltc4282.c +1 -1
@@ -1425,7 +1425,7 @@ static int ltc4282_setup(struct ltc4282_state *st, struct device *dev)if (!ret) {int reg_val; -switch (val) { +switch (st->vsense_max) {case 12500 : reg_val =0 ;break ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 67/181 mm/vmscan: wake up flushers conditionally to avoid cgroup OOM
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zeng Jingxiang <[email protected]>
[ Upstream commit 1bc542c6a0d1444559ab75823a89a94d244bf933 ]
Commit 14aa8b2d5c2e ("mm/mglru: don't sync disk for each aging cycle") removed the opportunity to wake up flushers during the MGLRU page reclamation process can lead to an increased likelihood of triggering OOM when encountering many dirty pages during reclamation on MGLRU.
This leads to premature OOM if there are too many dirty pages in cgroup:
Killed
dd invoked oom-killer: gfp_mask=0x101cca(GFP_HIGHUSER_MOVABLE|__GFP_WRITE), order=0, oom_score_adj=0
Call Trace: <TASK> dump_stack_lvl+0x5f/0x80 dump_stack+0x14/0x20 dump_header+0x46/0x1b0 oom_kill_process+0x104/0x220 out_of_memory+0x112/0x5a0 mem_cgroup_out_of_memory+0x13b/0x150 try_charge_memcg+0x44f/0x5c0 charge_memcg+0x34/0x50 __mem_cgroup_charge+0x31/0x90 filemap_add_folio+0x4b/0xf0 __filemap_get_folio+0x1a4/0x5b0 ? srso_return_thunk+0x5/0x5f ? __block_commit_write+0x82/0xb0 ext4_da_write_begin+0xe5/0x270 generic_perform_write+0x134/0x2b0 ext4_buffered_write_iter+0x57/0xd0 ext4_file_write_iter+0x76/0x7d0 ? selinux_file_permission+0x119/0x150 ? srso_return_thunk+0x5/0x5f ? srso_return_thunk+0x5/0x5f vfs_write+0x30c/0x440 ksys_write+0x65/0xe0 __x64_sys_write+0x1e/0x30 x64_sys_call+0x11c2/0x1d50 do_syscall_64+0x47/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e
memory: usage 308224kB, limit 308224kB, failcnt 2589
swap: usage 0kB, limit 9007199254740988kB, failcnt 0
...
file_dirty 303247360
file_writeback 0
...
oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test, mems_allowed=0,oom_memcg=/test,task_memcg=/test,task=dd,pid=4404,uid=0 Memory cgroup out of memory: Killed process 4404 (dd) total-vm:10512kB, anon-rss:1152kB, file-rss:1824kB, shmem-rss:0kB, UID:0 pgtables:76kB oom_score_adj:0
The flusher wake up was removed to decrease SSD wearing, but if we are seeing all dirty folios at the tail of an LRU, not waking up the flusher could lead to thrashing easily. So wake it up when a memcg is about to OOM due to dirty caches.
I did run the build kernel test[1] on V6, with -j16 1G memcg on my local branch:
Without the patch(10 times):
user 1449.394
system 368.78 372.58 363.03 362.31 360.84 372.70 368.72 364.94 373.51 366.58 (avg 367.399)
real 164.883
With the V6 patch(10 times):
user 1447.525
system 360.87 360.63 372.39 364.09 368.49 365.15 359.93 362.04 359.72 354.60 (avg 362.79)
real 164.514
Test results show that this patch has about 1% performance improvement, which should be caused by noise.
--- mm/vmscan.c | 25 ++++++++++++++++++++++--- 1 file changed, 22 insertions(+), 3 deletions(-)
mm/vmscan.c +22 -3
@@ -4313,6 +4313,7 @@ static bool sort_folio(struct lruvec *lruvec, struct folio *folio, struct scan_c int tier_idx) {bool success; +bool dirty, writeback;int gen =folio_lru_gen (folio);int type =folio_is_file_lru (folio);int zone =folio_zonenum (folio);
@@ -4358,9 +4359,17 @@ static bool sort_folio(struct lruvec *lruvec, struct folio *folio, struct scan_creturn true; } + dirty =folio_test_dirty (folio); + writeback =folio_test_writeback (folio); +if (type ==LRU_GEN_FILE && dirty) { + sc->nr.file_taken += delta; +if (!writeback) + sc->nr.unqueued_dirty += delta; + } +/* waiting for writeback */ -if (folio_test_locked (folio) ||folio_test_writeback (folio) || - (type ==LRU_GEN_FILE &&folio_test_dirty (folio))) { +if (folio_test_locked (folio) || writeback || + (type ==LRU_GEN_FILE && dirty)) { gen =folio_inc_gen (lruvec, folio, true);list_move (&folio->lru, &lrugen->folios[gen][type][zone]);return true;
@@ -4476,7 +4485,8 @@ static int scan_folios(struct lruvec *lruvec, struct scan_control *sc,trace_mm_vmscan_lru_isolate (sc->reclaim_idx, sc->order,MAX_LRU_BATCH , scanned, skipped, isolated, type ?LRU_INACTIVE_FILE :LRU_INACTIVE_ANON ); - +if (type ==LRU_GEN_FILE ) + sc->nr.file_taken += isolated;/* * There might not be eligible folios due to reclaim_idx. Check the * remaining to prevent livelock if it's not making progress.
@@ -4610,6 +4620,7 @@ static int evict_folios(struct lruvec *lruvec, struct scan_control *sc, int swapreturn scanned; retry: reclaimed =shrink_folio_list (&list, pgdat, sc, &stat, false); + sc->nr.unqueued_dirty += stat.nr_unqueued_dirty; sc->nr_reclaimed += reclaimed; trace_mm_vmscan_lru_shrink_inactive(pgdat->node_id, scanned, reclaimed, &stat, sc->priority,
@@ -4821,6 +4832,13 @@ static bool try_to_shrink_lruvec(struct lruvec *lruvec, struct scan_control *sc)cond_resched (); } +/* +* If too many file cache in the coldest generation can't be evicted +* due to being dirty, wake up the flusher. +*/ +if (sc->nr.unqueued_dirty && sc->nr.unqueued_dirty == sc->nr.file_taken) +wakeup_flusher_threads (WB_REASON_VMSCAN ); +/* whether this lruvec should be rotated */ return nr_to_scan <0 ; }
@@ -5966,6 +5984,7 @@ static void shrink_node(pg_data_t *pgdat, struct scan_control *sc)bool reclaimable = false;if (lru_gen_enabled () &&root_reclaim (sc)) { +memset (&sc->nr,0 ,sizeof (sc->nr));lru_gen_shrink_node (pgdat, sc);return ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 68/181 net: fec: do not release NULL pages when RX buffer allocation fails
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mehmet Fide <[email protected]>
fec_enet_alloc_rxq_buffers() leaves the loop as soon as page_pool_dev_alloc_pages() returns NULL and jumps to err_alloc, which calls fec_enet_free_buffers(). That helper walks the whole ring and hands every rx_skb_info[i].page to page_pool_put_full_page(), including the entries the allocation loop never reached. Those are still NULL, because the queue was allocated with kzalloc(), and page_pool_put_full_page() dereferences the page, so an open that runs out of memory oopses instead of returning -ENOMEM:
Unable to handle kernel NULL pointer dereference at virtual address 00000014 when read Internal error: Oops: 5 [#1] SMP ARM CPU: 0 PID: 384 Comm: connmand Not tainted 6.18.43 #1 Hardware name: Freescale Vybrid VF5xx/VF6xx (Device Tree) PC is at fec_enet_free_buffers+0xb0/0x2a8 Call trace: fec_enet_free_buffers from fec_enet_open+0x1e0/0x504 fec_enet_open from __dev_open+0x114/0x238 __dev_open from __dev_change_flags+0x190/0x208 __dev_change_flags from netif_change_flags+0x1c/0x58 netif_change_flags from dev_change_flags+0x44/0x74 dev_change_flags from devinet_ioctl+0x3a4/0x768
Seen on a Colibri VF50, 128 MiB of RAM, on the first ifup after boot.
Skip the entries that hold no page, and clear the ones that do after releasing them, so that a later failed open cannot release the same page a second time.
Mainline is not affected. Commit a2ae70c0efe4 ("net: fec: add fec_alloc_rxq_buffers_pp() to allocate buffers from page pool") replaced this loop with fec_free_rxq_buffers(), which skips and clears the empty entries. That commit is part of the XDP zero copy series and is not a stable candidate, so this is the equivalent minimal fix for 6.18.y.
--- drivers/net/ethernet/freescale/fec_main.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/net/ethernet/freescale/fec_main.c +9 -2
@@ -3323,8 +3323,15 @@ static void fec_enet_free_buffers(struct net_device *ndev)for (q =0 ; q < fep->num_rx_queues; q++) { rxq = fep->rx_queue[q]; -for (i =0 ; i < rxq->bd.ring_size; i++) -page_pool_put_full_page (rxq->page_pool, rxq->rx_skb_info[i].page, false); +for (i =0 ; i < rxq->bd.ring_size; i++) { +struct page *page = rxq->rx_skb_info[i].page; + +if (!page) +continue ; + +page_pool_put_full_page (rxq->page_pool, page, false); + rxq->rx_skb_info[i].page =NULL ; + }for (i =0 ; i <XDP_STATS_TOTAL ; i++) rxq->stats[i] =0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 69/181 spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larisa Grigore <[email protected]>
[ Upstream commit cac7e5054115fcc41b1cb050af8e8971f7c9b22b ]
Repacking multiple smaller words into larger ones to make use of the full FIFO doesn't save anything in DMA mode, so don't bother doing it.
--- drivers/spi/spi-fsl-dspi.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
drivers/spi/spi-fsl-dspi.c +7 -6
@@ -746,8 +746,12 @@ static void dspi_setup_accel(struct fsl_dspi *dspi)struct spi_transfer *xfer = dspi->cur_transfer;bool odd = !!(dspi->len &1 ); -/* No accel for frames not multiple of 8 bits at the moment */ -if (xfer->bits_per_word %8 ) +/* +* No accel for DMA transfers or frames not multiples of 8 bits at the +* moment. +*/ +if (dspi->devtype_data->trans_mode ==DSPI_DMA_MODE || + xfer->bits_per_word %8 ) goto no_accel;if (!odd && dspi->len <= dspi->devtype_data->fifo_size *2 ) {
@@ -756,10 +760,7 @@ static void dspi_setup_accel(struct fsl_dspi *dspi) dspi->oper_bits_per_word =8 ; }else {/* Start off with maximum supported by hardware */ -if (dspi->devtype_data->trans_mode ==DSPI_XSPI_MODE ) - dspi->oper_bits_per_word =32 ; -else - dspi->oper_bits_per_word =16 ; + dspi->oper_bits_per_word =32 ;/* * And go down only if the buffer can't be sent with
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 70/181 mtd: spinand: fix direct mapping creation sizes
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Kshevetskiy <[email protected]>
[ Upstream commit e4a0cf9f1d90e6888e5373da3314f761024f6c97 ]
Continuous mode is only supported for data reads, thus writing requires only single flash page mapping.
--- drivers/mtd/nand/spi/core.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/mtd/nand/spi/core.c +7 -7
@@ -1036,18 +1036,13 @@ static int spinand_create_dirmap(struct spinand_device *spinand, unsigned int plane) {struct nand_device *nand =spinand_to_nand (spinand); -struct spi_mem_dirmap_info info = { - .length =nanddev_page_size (nand) + -nanddev_per_page_oobsize (nand), - }; +struct spi_mem_dirmap_info info = {0 };struct spi_mem_dirmap_desc *desc; -if (spinand->cont_read_possible) - info.length =nanddev_eraseblock_size (nand); -/* The plane number is passed in MSB just above the column address */ info.offset = plane <<fls (nand->memorg.pagesize); + info.length =nanddev_page_size (nand) +nanddev_per_page_oobsize (nand); info.op_tmpl = *spinand->op_templates.update_cache; desc =devm_spi_mem_dirmap_create (&spinand->spimem->spi->dev, spinand->spimem, &info);
@@ -1056,6 +1051,8 @@ static int spinand_create_dirmap(struct spinand_device *spinand, spinand->dirmaps[plane].wdesc = desc; +if (spinand->cont_read_possible) + info.length =nanddev_eraseblock_size (nand); info.op_tmpl = *spinand->op_templates.read_cache; desc =devm_spi_mem_dirmap_create (&spinand->spimem->spi->dev, spinand->spimem, &info);
@@ -1071,6 +1068,7 @@ static int spinand_create_dirmap(struct spinand_device *spinand,return 0 ; } + info.length =nanddev_page_size (nand) +nanddev_per_page_oobsize (nand); info.op_tmpl = *spinand->op_templates.update_cache; info.op_tmpl.data.ecc = true; desc = devm_spi_mem_dirmap_create(&spinand->spimem->spi->dev,
@@ -1080,6 +1078,8 @@ static int spinand_create_dirmap(struct spinand_device *spinand, spinand->dirmaps[plane].wdesc_ecc = desc; +if (spinand->cont_read_possible) + info.length =nanddev_eraseblock_size (nand); info.op_tmpl = *spinand->op_templates.read_cache; info.op_tmpl.data.ecc = true; desc = devm_spi_mem_dirmap_create(&spinand->spimem->spi->dev,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 71/181 mtd: spinand: try a regular dirmap if creating a dirmap for continuous reading fails
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Kshevetskiy <[email protected]>
[ Upstream commit 004f8ea0d9917398aabff7388b3bf62a84a4088b ]
Continuous reading may result in multiple flash pages reading in one operation. Typically only one flash page has read/written (a little bit more than 2-4 Kb), but continuous reading requires the spi controller to read up to 512 Kb in one operation without toggling CS in beetween.
Roughly speaking spi controllers can be divided on 2 categories:
* spi controllers without dirmap acceleration support
* spi controllers with dirmap acceleration support
Firt of them will have issues with continuous reading if restriction on the transfer length is implemented in the adjust_op_size() handler. Second group often supports acceleration of single page only reading. Thus enabling of continuous reading can break flash reading.
This patch tries to create dirmap for continuous reading first and fallback to regular reading if spi controller refuses to create it.
--- drivers/mtd/nand/spi/core.c | 43 ++++++++++++++++++++++++++++++------- 1 file changed, 35 insertions(+), 8 deletions(-)
drivers/mtd/nand/spi/core.c +35 -8
@@ -1032,6 +1032,39 @@ static int spinand_mtd_block_isreserved(struct mtd_info *mtd, loff_t offs)return ret; } +static struct spi_mem_dirmap_desc *spinand_create_rdesc ( +struct spinand_device *spinand, +struct spi_mem_dirmap_info *info) +{ +struct nand_device *nand =spinand_to_nand (spinand); +struct spi_mem_dirmap_desc *desc =NULL ; + +if (spinand->cont_read_possible) { +/* +* spi controller may return an error if info->length is +* too large +*/ + info->length =nanddev_eraseblock_size (nand); + desc =devm_spi_mem_dirmap_create (&spinand->spimem->spi->dev, + spinand->spimem, info); + } + +if (IS_ERR_OR_NULL (desc)) { +/* +* continuous reading is not supported by flash or +* its spi controller, use regular reading +*/ + spinand->cont_read_possible = false; + + info->length =nanddev_page_size (nand) + +nanddev_per_page_oobsize (nand); + desc =devm_spi_mem_dirmap_create (&spinand->spimem->spi->dev, + spinand->spimem, info); + } + +return desc; +} +static int spinand_create_dirmap (struct spinand_device *spinand,unsigned int plane) {
@@ -1051,11 +1084,8 @@ static int spinand_create_dirmap(struct spinand_device *spinand, spinand->dirmaps[plane].wdesc = desc; -if (spinand->cont_read_possible) - info.length =nanddev_eraseblock_size (nand); info.op_tmpl = *spinand->op_templates.read_cache; - desc =devm_spi_mem_dirmap_create (&spinand->spimem->spi->dev, - spinand->spimem, &info); + desc =spinand_create_rdesc (spinand, &info);if (IS_ERR (desc))return PTR_ERR (desc);
@@ -1078,12 +1108,9 @@ static int spinand_create_dirmap(struct spinand_device *spinand, spinand->dirmaps[plane].wdesc_ecc = desc; -if (spinand->cont_read_possible) - info.length =nanddev_eraseblock_size (nand); info.op_tmpl = *spinand->op_templates.read_cache; info.op_tmpl.data.ecc = true; - desc =devm_spi_mem_dirmap_create (&spinand->spimem->spi->dev, - spinand->spimem, &info); + desc =spinand_create_rdesc (spinand, &info);if (IS_ERR (desc))return PTR_ERR (desc);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 72/181 mtd: spinand: repeat reading in regular mode if continuous reading fails
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Kshevetskiy <[email protected]>
[ Upstream commit 010dc7f2dd6a0078ade3f88f627ed5fbf45ceb94 ]
Continuous reading may result in multiple flash pages reading in one operation. Unfortunately, not all spinand controllers support such large reading. They will read less data. Unfortunately, the operation can't be continued.
In this case:
* disable continuous reading on this (not good enough) spi controller
* repeat reading in regular mode.
--- drivers/mtd/nand/spi/core.c | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-)
drivers/mtd/nand/spi/core.c +21 -4
@@ -427,8 +427,16 @@ static int spinand_read_from_cache_op(struct spinand_device *spinand,* Dirmap accesses are allowed to toggle the CS. * Toggling the CS during a continuous read is forbidden. */ -if (nbytes && req->continuous) -return -EIO ; +if (nbytes && req->continuous) { +/* +* Spi controller with broken support of continuous +* reading was detected. Disable future use of +* continuous reading and return -EAGAIN to retry +* reading within regular mode. +*/ + spinand->cont_read_possible = false; +return -EAGAIN ; + } }if (req->datalen)
@@ -849,10 +857,19 @@ static int spinand_mtd_read(struct mtd_info *mtd, loff_t from, old_stats = mtd->ecc_stats; -if (spinand_use_cont_read (mtd, from, ops)) +if (spinand_use_cont_read (mtd, from, ops)) { ret =spinand_mtd_continuous_page_read (mtd, from, ops, &max_bitflips); -else +if (ret == -EAGAIN && !spinand->cont_read_possible) { +/* +* Spi controller with broken support of continuous +* reading was detected (see spinand_read_from_cache_op()), +* repeat reading in regular mode. +*/ + ret =spinand_mtd_regular_page_read (mtd, from, ops, &max_bitflips); + } + }else { ret =spinand_mtd_regular_page_read (mtd, from, ops, &max_bitflips); + }if (ops->stats) { ops->stats->uncorrectable_errors +=
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 73/181 swapfile: call cond_resched() before locking si->lock
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Morin <[email protected]>
The 6.12 backport of commit 66366d291f66 ("mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockup"), added a cond_resched() after locking si->lock. Move cond_resched() before spin_lock().
--- mm/swapfile.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/swapfile.c +1 -1
@@ -770,11 +770,11 @@ static void swap_reclaim_full_clusters(struct swap_info_struct *si, bool force) } offset++; } +cond_resched ();spin_lock (&si->lock);if (to_scan <=0 )break ; -cond_resched (); } }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 74/181 Input: evdev - sanitize event type index when fetching event masks
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
commit 3abd29c61d2ef37c4102cf755b18be53bb9dbea6 upstream.
The user-supplied event type index passed to EVIOCGMASK / EVIOCSMASK ioctls is used to index the static counts array in evdev_get_mask_cnt() and client evmasks array in evdev_get_mask().
While the event type is architecturally bounded by EV_CNT, speculative execution may mispredict bounds checks and perform out-of-bounds loads.
Sanitize the event type index in evdev_get_mask_cnt() branchlessly using array_index_mask_nospec(). This clamps the index to 0 for safe array access and forces the returned count to 0 speculatively when the index is out of bounds.
We do not need additional array_index_nospec() calls in evdev_get_mask() because evdev_get_mask_cnt() speculatively forces the count (and resulting xfer_size) to 0 for out-of-bounds types, preventing any speculative memory access to client evmasks array.
--- drivers/input/evdev.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/input/evdev.c +4 -1
@@ -21,6 +21,7 @@#include <linux/init.h> #include <linux/input/mt.h> #include <linux/major.h> +#include <linux/nospec.h> #include <linux/device.h> #include <linux/cdev.h> #include "input-compat.h"
@@ -67,8 +68,10 @@ static size_t evdev_get_mask_cnt(unsigne [EV_SND] = SND_CNT, [EV_FF] = FF_CNT, }; +unsigned long mask =array_index_mask_nospec (type,EV_CNT ); -return (type <EV_CNT ) ? counts[type] :0 ; +/* Returns 0 for out-of-bounds types, including speculatively */ +return counts[type & mask] & mask; }/* requires the buffer lock to be held */
Greg Kroah-Hartman
maintainerPATCH 75/181 ALSA: usb-audio: fix OOB write on Type II inbound URBs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baul Lee <[email protected]>
commit 69ee44e1a23be62318189dc4b37fa4ad94053269 upstream.
data_ep_set_params() sizes each URB transfer buffer before it adds the Format Type II transfer delimiter:
u->packets = urb_packs; u->buffer_size = maxsize * u->packets; if (fmt->fmt_type == UAC_FORMAT_TYPE_II) u->packets++; /* for transfer delimiter */ u->urb = usb_alloc_urb(u->packets, GFP_KERNEL);
buffer_size is computed from the pre-increment packet count and never recomputed, so for a Type II endpoint the buffer is one packet short of the packet count the URB is built with.
prepare_inbound_urb() then lays out one iso frame per packet and never consults buffer_size:
offs = 0;
for (i = 0; i < urb_ctx->packets; i++) {
urb->iso_frame_desc[i].offset = offs;
urb->iso_frame_desc[i].length = ep->curpacksize;
offs += ep->curpacksize;
}
urb->transfer_buffer_length = offs;
urb->number_of_packets = urb_ctx->packets;The last descriptor therefore points one packet past the end of the transfer buffer, where the host controller writes device data on every inbound transfer. prepare_silent_urb() and prepare_playback_urb() bound their fill loops by ctx->buffer_size, so only capture is affected.
fmt_type comes from the device's audio streaming descriptors, so any device advertising a Type II capture format hits this once userspace sets hw_params on the stream.
KASAN on 7.2.0-rc5 (arm64) with a dummy_hcd/raw-gadget device, one report per inbound transfer:
BUG: KASAN: slab-out-of-bounds in dummy_timer Write of size 64 at addr ffff0000186171c0 by task cons02/166 __asan_memcpy dummy_timer hrtimer_run_softirq Allocated by task 166: usb_alloc_coherent snd_usb_endpoint_set_params The buggy address is located 0 bytes to the right of allocated 64-byte region [ffff000018617180, ffff0000186171c0)
Compute buffer_size after the delimiter packet has been accounted for, and bound the fill loop by buffer_size, as prepare_silent_urb() already does on the outbound side. This grows every Type II URB allocation by one maxsize packet.
Discovered by XBOW, triaged by Baul Lee <[email protected]>
--- sound/usb/endpoint.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
sound/usb/endpoint.c +4 -2
@@ -388,13 +388,15 @@ static int prepare_inbound_urb(struct sncase SND_USB_ENDPOINT_TYPE_DATA : offs =0 ;for (i =0 ; i < urb_ctx->packets; i++) { +if (offs + ep->curpacksize > urb_ctx->buffer_size) +break ; urb->iso_frame_desc[i].offset = offs; urb->iso_frame_desc[i].length = ep->curpacksize; offs += ep->curpacksize; } urb->transfer_buffer_length = offs; - urb->number_of_packets = urb_ctx->packets; + urb->number_of_packets = i;break ;case SND_USB_ENDPOINT_TYPE_SYNC :
@@ -1263,10 +1265,10 @@ static int data_ep_set_params(struct snd u->index = i; u->ep = ep; u->packets = urb_packs; - u->buffer_size = maxsize * u->packets;if (fmt->fmt_type ==UAC_FORMAT_TYPE_II ) u->packets++;/* for transfer delimiter */ + u->buffer_size = maxsize * u->packets; u->urb =usb_alloc_urb (u->packets,GFP_KERNEL );if (!u->urb) goto out_of_memory;
Greg Kroah-Hartman
maintainerPATCH 76/181 usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Nogikh <[email protected]>
commit c2f811314be351d86b6ab41e9297ae80d8da6f86 upstream.
If cxacru_cm() encounters an error while submitting or waiting for snd_urb, it aborts and returns the error without killing the already submitted rcv_urb. This leaves the rcv_urb active.
When this happens during initialization (e.g., in cxacru_atm_start()), the driver may ignore the error and proceed to call cxacru_poll_status(), which invokes cxacru_cm() again. Attempting to submit the still-active rcv_urb triggers a warning in usb_submit_urb():
cxacru 1-1:1.0: send of cm 0x84 failed (-104)
ATM dev 0: cxacru_atm_start: CHIP_ADSL_LINE_START returned -104
------------[ cut here ]------------ URB ffff88812658d200 submitted while active WARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0x79/0x18b0 drivers/usb/core/urb.c:379 ... Call Trace: <TASK> cxacru_cm+0x21a/0xf10 drivers/usb/atm/cxacru.c:631 cxacru_cm_get_array drivers/usb/atm/cxacru.c:722 [inline] cxacru_poll_status+0x178/0x1110 drivers/usb/atm/cxacru.c:828 cxacru_atm_start+0x185/0x360 drivers/usb/atm/cxacru.c:814 usbatm_atm_init+0x144/0x3a0 drivers/usb/atm/usbatm.c:927 usbatm_usb_probe+0x15cb/0x1db0 drivers/usb/atm/usbatm.c:1178 cxacru_usb_probe+0x17f/0x220 drivers/usb/atm/cxacru.c:1370
...
To fix this, ensure that rcv_urb is properly killed if cxacru_cm() aborts early. We can safely call usb_kill_urb() on rcv_urb in the error path, as it is safe to call even if the URB is not active (e.g., if it failed to submit in the first place, or if it already completed).
--- drivers/usb/atm/cxacru.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/atm/cxacru.c +2 -0
@@ -700,6 +700,8 @@ static int cxacru_cm(struct cxacru_data ret = offd;usb_dbg (instance->usbatm,"cm %#x\n" , cm); fail: +if (ret <0 ) +usb_kill_urb (instance->rcv_urb);mutex_unlock (&instance->cm_serialize); err:return ret;
Greg Kroah-Hartman
maintainerPATCH 77/181 thunderbolt: icm: Preserve USB4 proxy data-valid bit
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Rao <[email protected]>
commit e48844ece5e3ed1d1eb865f6da2b16f62cd9f86d upstream.
The ICM USB4 switch operation request encodes two values in request.data_len_valid: bit 4 marks the data payload valid, while bits 3:0 hold the payload length in dwords. A zero length with the valid bit set represents the full 16-dword data array.
icm_usb4_switch_op() sets the valid bit when a transmit payload is present. For payloads shorter than the full 16 dwords, it then assigns the length to the whole field and clears the valid bit that was just set. The payload is still copied into the request, but the descriptor sent to firmware marks that data as invalid.
This affects USB4 router operations that send short payloads through the firmware connection manager. In particular, USB4 NVM writes can send a short final block when the image size is not aligned to the 64-byte proxy payload size. Firmware may then ignore or reject that final block, while full 16-dword blocks are unaffected because they are encoded as length 0 with the valid bit set.
OR the short payload length into data_len_valid so the valid bit is preserved.
--- drivers/thunderbolt/icm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/thunderbolt/icm.c +1 -1
@@ -2291,7 +2291,7 @@ static int icm_usb4_switch_op(struct tb_if (tx_data_len) { request.data_len_valid |=ICM_USB4_SWITCH_DATA_VALID ;if (tx_data_len <ARRAY_SIZE (request.data)) - request.data_len_valid = + request.data_len_valid |= tx_data_len &ICM_USB4_SWITCH_DATA_LEN_MASK ;memcpy (request.data, tx_data, tx_data_len *sizeof (u32)); }
Greg Kroah-Hartman
maintainerPATCH 78/181 usb: cdnsp: fix incorrect endian conversions for APB timeout register
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawel Laszczak <[email protected]>
commit 50b303f3d0f7de543ee90d50879970783d06da33 upstream.
readl() already returns a CPU-endian value. Passing its return value to le32_to_cpu() is therefore redundant and causes an incorrect double byte swap on big-endian systems.
Similarly, writel() expects a CPU-endian value, so passing the result of cpu_to_le32() is incorrect.
Remove the unnecessary conversions and operate on the MMIO register value as a CPU-endian u32.
--- drivers/usb/cdns3/cdnsp-gadget.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/cdns3/cdnsp-gadget.c +2 -2
@@ -154,9 +154,9 @@ static void cdnsp_set_apb_timeout_value( offset =cdnsp_find_next_ext_cap (base, offset,D_XEC_PRE_REGS_CAP ); reg = base + offset +REG_CHICKEN_BITS_3_OFFSET ; - val =le32_to_cpu (readl (reg)); + val =readl (reg); val =CHICKEN_APB_TIMEOUT_SET (val, cdns->override_apb_timeout); -writel (cpu_to_le32 (val), reg); +writel (val, reg); }static void cdnsp_set_chicken_bits_2 (struct cdnsp_device *pdev,u32 bit)
Greg Kroah-Hartman
maintainerPATCH 79/181 usb: gadget: f_ncm: Use unsigned int for ndp_index
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sonali Pradhan <[email protected]>
commit 6b1c8a9403a26cb0fed7a648916c74dc236da591 upstream.
The variable ndp_index is declared as a signed integer, but it stores the return value of get_ncm(), which is unsigned.
A malicious host can supply a large offset that overflows the signed ndp_index, making it negative. Because ndp_index is compared against unsigned bounds, this negative value bypasses sanity checks and leads to an out-of-bounds read when calculating the address of the NDP block (ntb_ptr + ndp_index).
Fix this by changing ndp_index to unsigned int to ensure consistent unsigned comparisons throughout the function.
--- drivers/usb/gadget/function/f_ncm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/gadget/function/f_ncm.c +1 -1
@@ -1171,7 +1171,7 @@ static int ncm_unwrap_ntb(struct getherunsigned char *ntb_ptr = skb->data;__le16 *tmp;unsigned index, index2; -int ndp_index; +unsigned int ndp_index;unsigned dg_len, dg_len2;unsigned ndp_len;unsigned block_len;
Greg Kroah-Hartman
maintainerPATCH 80/181 net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yi Cong <[email protected]>
commit 1f428e30947395d9b9aacee03e25a4e6cfcad7a4 upstream.
When the interface has NETIF_F_SG enabled and skb_linearize() fails in ax88179_tx_fixup(), the function returns NULL without freeing the skb.
usbnet_start_xmit() treats a NULL return from tx_fixup() as a drop (info->flags does not set FLAG_MULTI_PACKET for this driver), jumping to the "drop" label where it does if (skb) dev_kfree_skb_any(skb). Because tx_fixup() returned NULL, the local skb variable in usbnet_start_xmit() is NULL, so the original skb is never freed — a memory leak on every TX frame whose linearization fails (i.e. under memory pressure).
Free the skb before returning, matching the error handling already used for the pskb_expand_head() failure path in the same function.
--- drivers/net/usb/ax88179_178a.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/usb/ax88179_178a.c +3 -1
@@ -1493,8 +1493,10 @@ ax88179_tx_fixup(struct usbnet *dev, str headroom =skb_headroom (skb) -8 ; -if ((dev->net->features &NETIF_F_SG ) &&skb_linearize (skb)) +if ((dev->net->features &NETIF_F_SG ) &&skb_linearize (skb)) { +dev_kfree_skb_any (skb);return NULL ; + }if ((skb_header_cloned (skb) || headroom <0 ) &&pskb_expand_head (skb, headroom <0 ?8 :0 ,0 ,GFP_ATOMIC )) {
Greg Kroah-Hartman
maintainerPATCH 81/181 net: usb: ipheth: fix carrier_work UAF on disconnect
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Doruk Tan Ozturk <[email protected]>
commit fde39b8a521780391fb4e5bda2c0aa4928947f12 upstream.
ipheth_sndbulk_callback() re-arms the carrier-check work on any non-zero URB status:
else schedule_delayed_work(&dev->carrier_work, 0);
Nothing ties that to the interface being up, so the work can be armed again after ipheth_close() has already drained it, and stay armed until the netdev whose private area embeds it is freed.
On unplug with a TX URB in flight, ipheth_disconnect() drains the work through unregister_netdev() -> ipheth_close() -> cancel_delayed_work_sync() and only then calls ipheth_kill_urbs(). usb_kill_urb() completes the in-flight TX URB with -ENOENT, so ipheth_sndbulk_callback() runs after the drain and re-arms carrier_work.
The same completion also re-arms the work if the interface is only brought down while a TX URB is in flight, and ipheth_carrier_check_work() then keeps re-queueing itself once a second. unregister_netdev() does not call ipheth_close() for an already-down interface, so nothing drains it on the later unplug either.
In both cases free_netdev() frees the netdev while carrier_work is still pending, and ipheth_carrier_check_work() dereferences freed memory.
Tie the work to the interface state instead of chasing the completion:
disable it in ipheth_close() and enable it in ipheth_open(), so a schedule_delayed_work() from the URB completion is a no-op whenever the interface is not up. disable_delayed_work_sync() also waits for a running instance, so it fully replaces the cancel_delayed_work_sync() it takes the place of. The work starts out disabled in ipheth_probe() so the enable/disable counts balance from the first open.
Reproduced under KASAN on linux-next (next-20260731) with dummy_hcd and raw-gadget standing in for the device, driving the second path above (the interface is already down, so unregister_netdev() does not call ipheth_close()): 15 of 15 unpatched boots report a slab-use-after-free in __run_timers(), freed by ipheth_disconnect() and re-armed from ipheth_sndbulk_callback() via queue_delayed_work_on(). The same trigger on a kernel differing only by this patch reports 0 of 15, and the carrier check still functions across open/close cycles.
The reproducer needs an attached USB device that stops draining bulk OUT, plus a link down and unplug, driven as root. It is not a privilege boundary crossing and no exploit primitive was developed.
Found by 0sec (https://0sec.ai).
--- drivers/net/usb/ipheth.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/net/usb/ipheth.c +10 -1
@@ -490,6 +490,7 @@ static int ipheth_open(struct net_deviceif (retval)return retval; +enable_delayed_work (&dev->carrier_work);schedule_delayed_work (&dev->carrier_work,IPHETH_CARRIER_CHECK_TIMEOUT );return retval; }
@@ -499,7 +500,11 @@ static int ipheth_close(struct net_devicstruct ipheth_device *dev =netdev_priv (net);netif_stop_queue (net); -cancel_delayed_work_sync (&dev->carrier_work); +/* A TX URB can still complete with an error after this point and +* try to re-arm the carrier work. Disable it instead of cancelling +* it, so that such a schedule_delayed_work() is a no-op. +*/ +disable_delayed_work_sync (&dev->carrier_work);return 0 ; }
@@ -633,6 +638,10 @@ static int ipheth_probe(struct usb_inter }INIT_DELAYED_WORK (&dev->carrier_work, ipheth_carrier_check_work); +/* Armed only between ipheth_open() and ipheth_close(). Start out +* disabled so the enable/disable counts balance from the first open. +*/ +disable_delayed_work (&dev->carrier_work); retval =ipheth_alloc_urbs (dev);if (retval) {
Greg Kroah-Hartman
maintainerPATCH 82/181 vt: add permission check for KDSKBMETA ioctl
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Rogers <[email protected]>
commit a7ad0034453ba4c353f9b8f810ee2569de33d283 upstream.
KDSKBMETA modifies keyboard meta mode but lacks the !perm check that all other keyboard setter ioctls in vt_k_ioctl() enforce, allowing a process to change meta mode on a non-controlling console without authorization.
--- drivers/tty/vt/vt_ioctl.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/tty/vt/vt_ioctl.c +2 -0
@@ -408,6 +408,8 @@ static int vt_k_ioctl(struct tty_struct/* this could be folded into KDSKBMODE, but for compatibility reasons it is not so easy to fold KDGKBMETA into KDGKBMODE */ case KDSKBMETA : +if (!perm) +return -EPERM ;return vt_do_kdskbmeta (console, arg);case KDGKBMETA :
Greg Kroah-Hartman
maintainerPATCH 83/181 vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Rogers <[email protected]>
commit e25d47a526939ad44b75f778b8a7500562b84fc1 upstream.
kbd_keycode() reads vc->port.tty without acquiring a tty reference, racing against con_shutdown() which clears port.tty under a different lock. Use tty_port_tty_get()/tty_kref_put() to hold a proper reference for the duration the tty pointer is needed.
--- drivers/tty/vt/keyboard.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/tty/vt/keyboard.c +4 -1
@@ -1403,7 +1403,7 @@ static void kbd_keycode(unsigned int keystruct keyboard_notifier_param param = { .vc = vc, .value = keycode, .down = down };int rc; - tty = vc->port.tty; + tty =tty_port_tty_get (&vc->port);if (tty && (!tty->driver_data)) {/* No driver data? Strange. Okay we fix it then. */
@@ -1463,9 +1463,12 @@ static void kbd_keycode(unsigned int key* characters get aren't echoed locally. This makes key repeat * usable with slow applications and under heavy loads. */ +tty_kref_put (tty);return ; } +tty_kref_put (tty); + param.shift = shift_final = (shift_state | kbd->slockstate) ^ kbd->lockstate; param.ledstate = kbd->ledflagstate; key_map = key_maps[shift_final];
Greg Kroah-Hartman
maintainerPATCH 84/181 Input: evdev - fix information leak in evdev_pass_values()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
commit 90f305f2c7a30257c683e13f4bf7c798eea992a0 upstream.
In evdev_pass_values(), the input_event structure is allocated on the kernel stack and populated field-by-field. However, it is never fully initialized. On architectures where struct input_event contains explicit or implicit padding (such as the 32-bit __pad field on SPARC64), these padding bytes are left uninitialized.
When this event structure is subsequently passed to the client buffer and later copied to userspace, the uninitialized padding bytes leak kernel stack memory, potentially exposing sensitive information.
Similar issues exist in __evdev_queue_syn_dropped and __pass_event.
Fix this by explicitly zeroing the entire event structure with memset() before populating its fields. This ensures all padding bytes are cleared before the data crosses the security boundary.
--- drivers/input/evdev.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-)
drivers/input/evdev.c +12 -10
@@ -149,11 +149,11 @@ static void __evdev_queue_syn_dropped(ststruct timespec64 ts =ktime_to_timespec64 (ev_time[client->clk_type]);struct input_event ev; +memset (&ev,0 ,sizeof (ev)); ev.input_event_sec = ts.tv_sec; ev.input_event_usec = ts.tv_nsec /NSEC_PER_USEC ; ev.type =EV_SYN ; ev.code =SYN_DROPPED ; - ev.value =0 ; client->buffer[client->head++] = ev; client->head &= client->bufsize -1 ;
@@ -221,20 +221,20 @@ static void __pass_event(struct evdev_cl client->head &= client->bufsize -1 ;if (unlikely (client->head == client->tail)) { +struct input_event ev; + +memset (&ev,0 ,sizeof (ev)); + ev.input_event_sec = event->input_event_sec; + ev.input_event_usec = event->input_event_usec; + ev.type =EV_SYN ; + ev.code =SYN_DROPPED ; +/* * This effectively "drops" all unconsumed events, leaving * EV_SYN/SYN_DROPPED plus the newest event in the queue. */ client->tail = (client->head -2 ) & (client->bufsize -1 ); - - client->buffer[client->tail] = (struct input_event ) { - .input_event_sec = event->input_event_sec, - .input_event_usec = event->input_event_usec, - .type =EV_SYN , - .code =SYN_DROPPED , - .value =0 , - }; - + client->buffer[client->tail] = ev; client->packet_head = client->tail; }
@@ -256,6 +256,8 @@ static void evdev_pass_values(struct evdif (client->revoked)return ; +memset (&event,0 ,sizeof (event)); + ts =ktime_to_timespec64 (ev_time[client->clk_type]); event.input_event_sec = ts.tv_sec; event.input_event_usec = ts.tv_nsec /NSEC_PER_USEC ;
Greg Kroah-Hartman
maintainerPATCH 85/181 ima: fix out-of-bounds read in xattr_verify()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lincoln Wallace <[email protected]>
commit 5ff232d31106f45ac87c3b64e1d35a0667777797 upstream.
The digest-length check in xattr_verify() mixes int and size_t:
if (xattr_len - sizeof(xattr_value->type) - hash_start >= iint->ima_hash->length)
sizeof() yields size_t, so the usual arithmetic conversions promote the whole left-hand side to unsigned 64-bit before the subtraction runs. For a truncated xattr this underflows instead of going negative:
a 1-byte IMA_XATTR_DIGEST_NG xattr (xattr_len == 1, hash_start == 1) turns "1 - 1 - 1" into SIZE_MAX, which is trivially >= ima_hash->length. The check then passes and the following memcmp() reads iint->ima_hash->length bytes starting past the end of the buffer vfs_getxattr_alloc() allocated for it.
Nothing upstream clamps xattr_len back into a safe range first:ima_get_hash_algo() only special-cases xattr_len < 2 to pick a default algorithm, and evm_verifyxattr() returns INTEGRITY_UNKNOWN rather than failing when no HMAC key is loaded, so a truncated security.ima value reaches the length check as-is.
Rewrite the comparison so every operand stays a signed int and no implicit conversion to size_t can occur.
--- security/integrity/ima/ima_appraise.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
security/integrity/ima/ima_appraise.c +7 -2
@@ -302,8 +302,13 @@ static int xattr_verify(enum ima_hooks f }else {set_bit (IMA_DIGSIG , &iint->atomic_flags); } -if (xattr_len -sizeof (xattr_value->type) - hash_start >= - iint->ima_hash->length) +/* +* Use addition, not subtraction: sizeof() forces unsigned +* math and a short xattr_len would wrap around, bypassing +* this bounds check. +*/ +if (xattr_len >= (int )sizeof (xattr_value->type) + hash_start + + (int )iint->ima_hash->length)/* * xattr length may be longer. md5 hash in previous * version occupied 20 bytes in xattr, instead of 16
Greg Kroah-Hartman
maintainerPATCH 86/181 ipvs: stop estimator after disabled calc phase
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhiling Zou <[email protected]>
commit 558f67f1340f803a346ecd14a69c49653111c5f4 upstream.
IPVS estimator kthread 0 starts with zeroed chain and tick limits until its initial calculation phase completes. If network namespace teardown clears ipvs->enable during that phase, ip_vs_est_calc_phase() can return without installing positive limits.
The kthread can then continue into its main loop and drain est_temp_list with zero chain_max, tick_max and est_max_count values. Each enqueue consumes one available tick row, but est_count never reaches the zero est_max_count value. After all rows are consumed, the row lookup returns IPVS_EST_NTICKS and ip_vs_enqueue_estimator() writes past the ticks and tick_len arrays.
Exit kthread 0 after the calculation phase if the kthread is stopping or IPVS has been disabled. That keeps temporary estimators from being drained after the limits failed to initialize.
Estimator kthreads can now self-exit before teardown or reload stops kd->task. Keep an extra task reference after creation and release it with kthread_stop_put(), so kd->task remains valid until the stop paths consume that reference.
--- net/netfilter/ipvs/ip_vs_est.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
net/netfilter/ipvs/ip_vs_est.c +7 -3
@@ -187,8 +187,11 @@ static int ip_vs_estimation_kthread(void }/* kthread 0 will handle the calc phase */ -if (ipvs->est_calc_phase) +if (ipvs->est_calc_phase) {ip_vs_est_calc_phase (ipvs); +if (kthread_should_stop () || !READ_ONCE (ipvs->enable)) +return 0 ; + } }while (1 ) {
@@ -263,6 +266,7 @@ int ip_vs_est_kthread_start(struct netns kd->task =NULL ; goto out; } +get_task_struct (kd->task);set_user_nice (kd->task,sysctl_est_nice (ipvs));set_cpus_allowed_ptr (kd->task,sysctl_est_cpulist (ipvs));
@@ -278,7 +282,7 @@ void ip_vs_est_kthread_stop(struct ip_vs {if (kd->task) {pr_info ("stopping estimator thread %d...\n" , kd->id); -kthread_stop (kd->task); +kthread_stop_put (kd->task); kd->task =NULL ; } }
@@ -510,7 +514,7 @@ static void ip_vs_est_kthread_destroy(stif (kd) {if (kd->task) {pr_info ("stop unused estimator thread %d...\n" , kd->id); -kthread_stop (kd->task); +kthread_stop_put (kd->task); }ip_vs_stats_free (kd->calc_stats);kfree (kd);
Greg Kroah-Hartman
maintainerPATCH 87/181 ipvs: add totalconns for dest
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Anastasov <[email protected]>
commit 04d2feaed8d0103c498727191ba04001d5100e67 upstream.
Replace the inactconns dest counter with totalconns, now inactconns can be obtained from totalconns - activeconns. This reduces the atomic inc/dec ops for TCP/SCTP from 6 to 4 if the connection is established and then closed.
--- include/net/ip_vs.h | 17 ++++++++++++----- net/netfilter/ipvs/ip_vs_conn.c | 24 +++++++----------------- net/netfilter/ipvs/ip_vs_ctl.c | 10 +++++----- net/netfilter/ipvs/ip_vs_lc.c | 4 ++-- net/netfilter/ipvs/ip_vs_proto_sctp.c | 2 -- net/netfilter/ipvs/ip_vs_proto_tcp.c | 2 -- net/netfilter/ipvs/ip_vs_sync.c | 7 ++----- 7 files changed, 28 insertions(+), 38 deletions(-)
include/net/ip_vs.h +12 -5
@@ -736,7 +736,7 @@ struct ip_vs_dest {/* connection counters and thresholds */ atomic_t activeconns;/* active connections */ -atomic_t inactconns;/* inactive connections */ +atomic_t totalconns;/* total connections */ atomic_t persistconns;/* persistent connections */ __u32 u_threshold;/* upper threshold */ __u32 l_threshold;/* lower threshold */
@@ -1865,14 +1865,21 @@ void ip_vs_unregister_hooks(struct netnsstatic inline int ip_vs_dest_conn_overhead (struct ip_vs_dest *dest) { -/* We think the overhead of processing active connections is 256 +/* We think the overhead of processing active connections is 257 * times higher than that of inactive connections in average. (This -* 256 times might not be accurate, we will change it later) We +* 257 times might not be accurate, we will change it later) We * use the following formula to estimate the overhead now: -* dest->activeconns*256 + dest->inactconns +* dest->activeconns*256 + dest->totalconns */ return (atomic_read (&dest->activeconns) <<8 ) + -atomic_read (&dest->inactconns); +atomic_read (&dest->totalconns); +} + +static inline int +ip_vs_dest_inactconns (const struct ip_vs_dest *dest) +{ +return max (atomic_read (&dest->totalconns) - +atomic_read (&dest->activeconns),0 ); }#ifdef CONFIG_IP_VS_PROTO_TCP
net/netfilter/ipvs/ip_vs_conn.c +7 -17
@@ -570,12 +570,6 @@ static inline void ip_vs_bind_xmit_v6(st#endif -static inline int ip_vs_dest_totalconns (struct ip_vs_dest *dest) -{ -return atomic_read (&dest->activeconns) - +atomic_read (&dest->inactconns); -} -/* * Bind a connection entry with a virtual service destination * Called just after a new connection entry is created.
@@ -633,8 +627,7 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, s*/ if (!(flags &IP_VS_CONN_F_INACTIVE ))atomic_inc (&dest->activeconns); -else -atomic_inc (&dest->inactconns); +atomic_inc (&dest->totalconns); }else {/* It is a persistent connection/template, so increase the persistent connection counter */
@@ -642,7 +635,7 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, s }if (dest->u_threshold !=0 && -ip_vs_dest_totalconns (dest) >= dest->u_threshold) +atomic_read (&dest->totalconns) >= dest->u_threshold) dest->flags |=IP_VS_DEST_F_OVERLOAD ; }
@@ -724,13 +717,10 @@ static inline void ip_vs_unbind_dest(str/* Update the connection counters */ if (!(cp->flags &IP_VS_CONN_F_TEMPLATE )) { -/* It is a normal connection, so decrease the inactconns -or activeconns counter */ -if (cp->flags &IP_VS_CONN_F_INACTIVE ) { -atomic_dec (&dest->inactconns); - }else { +/* It is a normal connection, so decrease the counters */ +if (!(cp->flags &IP_VS_CONN_F_INACTIVE ))atomic_dec (&dest->activeconns); - } +atomic_dec (&dest->totalconns); }else {/* It is a persistent connection/template, so decrease the persistent connection counter */
@@ -738,10 +728,10 @@ static inline void ip_vs_unbind_dest(str }if (dest->l_threshold !=0 ) { -if (ip_vs_dest_totalconns (dest) < dest->l_threshold) +if (atomic_read (&dest->totalconns) < dest->l_threshold) dest->flags &= ~IP_VS_DEST_F_OVERLOAD ; }else if (dest->u_threshold !=0 ) { -if (ip_vs_dest_totalconns (dest) *4 < dest->u_threshold *3 ) +if (atomic_read (&dest->totalconns) *4 < dest->u_threshold *3 ) dest->flags &= ~IP_VS_DEST_F_OVERLOAD ; }else {if (dest->flags &IP_VS_DEST_F_OVERLOAD )
net/netfilter/ipvs/ip_vs_ctl.c +5 -5
@@ -1101,7 +1101,7 @@ ip_vs_new_dest(struct ip_vs_service *svc dest->port = udest->port;atomic_set (&dest->activeconns,0 ); -atomic_set (&dest->inactconns,0 ); +atomic_set (&dest->totalconns,0 );atomic_set (&dest->persistconns,0 );refcount_set (&dest->refcnt,1 );
@@ -2456,7 +2456,7 @@ static int ip_vs_info_seq_show(struct seip_vs_fwd_name (atomic_read (&dest->conn_flags)),atomic_read (&dest->weight),atomic_read (&dest->activeconns), - atomic_read(&dest->inactconns)); + ip_vs_dest_inactconns(dest)); else #endif seq_printf(seq,
@@ -2467,7 +2467,7 @@ static int ip_vs_info_seq_show(struct seip_vs_fwd_name (atomic_read (&dest->conn_flags)),atomic_read (&dest->weight),atomic_read (&dest->activeconns), - atomic_read(&dest->inactconns)); + ip_vs_dest_inactconns(dest)); } }
@@ -2953,7 +2953,7 @@ __ip_vs_get_dest_entries(struct netns_ip entry.u_threshold = dest->u_threshold; entry.l_threshold = dest->l_threshold; entry.activeconns =atomic_read (&dest->activeconns); - entry.inactconns =atomic_read (&dest->inactconns); + entry.inactconns =ip_vs_dest_inactconns (dest); entry.persistconns =atomic_read (&dest->persistconns);ip_vs_copy_stats (&kstats, &dest->stats);ip_vs_export_stats_user (&entry.stats, &kstats);
@@ -3557,7 +3557,7 @@ static int ip_vs_genl_fill_dest(struct snla_put_u32 (skb,IPVS_DEST_ATTR_ACTIVE_CONNS ,atomic_read (&dest->activeconns)) ||nla_put_u32 (skb,IPVS_DEST_ATTR_INACT_CONNS , -atomic_read (&dest->inactconns)) || +ip_vs_dest_inactconns (dest)) ||nla_put_u32 (skb,IPVS_DEST_ATTR_PERSIST_CONNS ,atomic_read (&dest->persistconns)) || nla_put_u16(skb, IPVS_DEST_ATTR_ADDR_FAMILY, dest->af))
net/netfilter/ipvs/ip_vs_lc.c +2 -2
@@ -31,7 +31,7 @@ ip_vs_lc_schedule(struct ip_vs_service */* * Simply select the server with the least number of -* (activeconns<<5) + inactconns +* (activeconns*256) + totalconns * Except whose weight is equal to zero. * If the weight is equal to zero, it means that the server is * quiesced, the existing connections to the server still get
@@ -57,7 +57,7 @@ ip_vs_lc_schedule(struct ip_vs_service *IP_VS_DBG_ADDR (least->af, &least->addr),ntohs (least->port),atomic_read (&least->activeconns), - atomic_read(&least->inactconns)); + ip_vs_dest_inactconns(least));return least; }
net/netfilter/ipvs/ip_vs_proto_sctp.c +0 -2
@@ -446,12 +446,10 @@ set_sctp_state(struct ip_vs_proto_data *if (!(cp->flags &IP_VS_CONN_F_INACTIVE ) && (next_state !=IP_VS_SCTP_S_ESTABLISHED )) {atomic_dec (&dest->activeconns); -atomic_inc (&dest->inactconns); cp->flags |=IP_VS_CONN_F_INACTIVE ; }else if ((cp->flags &IP_VS_CONN_F_INACTIVE ) && (next_state ==IP_VS_SCTP_S_ESTABLISHED )) {atomic_inc (&dest->activeconns); -atomic_dec (&dest->inactconns); cp->flags &= ~IP_VS_CONN_F_INACTIVE ; } }
net/netfilter/ipvs/ip_vs_proto_tcp.c +0 -2
@@ -527,12 +527,10 @@ set_tcp_state(struct ip_vs_proto_data *pif (!(cp->flags &IP_VS_CONN_F_INACTIVE ) && !tcp_state_active (new_state)) {atomic_dec (&dest->activeconns); -atomic_inc (&dest->inactconns); cp->flags |=IP_VS_CONN_F_INACTIVE ; }else if ((cp->flags &IP_VS_CONN_F_INACTIVE ) &&tcp_state_active (new_state)) {atomic_inc (&dest->activeconns); -atomic_dec (&dest->inactconns); cp->flags &= ~IP_VS_CONN_F_INACTIVE ; } }
net/netfilter/ipvs/ip_vs_sync.c +2 -5
@@ -879,13 +879,10 @@ static void ip_vs_proc_conn(struct netnsspin_lock_bh (&cp->lock);if ((cp->flags ^ flags) &IP_VS_CONN_F_INACTIVE && !(flags &IP_VS_CONN_F_TEMPLATE ) && dest) { -if (flags &IP_VS_CONN_F_INACTIVE ) { +if (flags &IP_VS_CONN_F_INACTIVE )atomic_dec (&dest->activeconns); -atomic_inc (&dest->inactconns); - }else { +else atomic_inc (&dest->activeconns); -atomic_dec (&dest->inactconns); - } } flags &=IP_VS_CONN_F_BACKUP_UPD_MASK ; flags |= cp->flags & ~IP_VS_CONN_F_BACKUP_UPD_MASK ;
Greg Kroah-Hartman
maintainerPATCH 88/181 ipvs: properly update the overload flag on dest edit
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Anastasov <[email protected]>
commit 8f843441c4e7eae8ea83491e8c203c2b192edcf5 upstream.
The upper/lower connection thresholds for dest can be changed, so use ip_vs_dest_update_overload() to properly update the dest overload flag.
The thresholds were not limited, fit them in the 0 .. INT_MAX range as already done in ipvsadm.
As the thresholds are also read when connections are created and expired, use WRITE_ONCE/READ_ONCE to access them.
As the lower threshold is optional, use (u - (u >> 2)) to calculate the 75% default value based on the upper threshold by preserving the integer rounding, as suggested by Yizhou Zhao.
Trigger flag update when totalconns reaches one of the thresholds and use dst_lock to serialize the updating.
--- include/net/ip_vs.h | 3 + net/netfilter/ipvs/ip_vs_conn.c | 27 +++++----------- net/netfilter/ipvs/ip_vs_ctl.c | 67 +++++++++++++++++++++++++++++++++++----- 3 files changed, 72 insertions(+), 25 deletions(-)
include/net/ip_vs.h +3 -0
@@ -740,6 +740,7 @@ struct ip_vs_dest {atomic_t persistconns;/* persistent connections */ __u32 u_threshold;/* upper threshold */ __u32 l_threshold;/* lower threshold */ +__u32 l_threshold_val;/* used lower threshold */ /* for destination cache */ spinlock_t dst_lock;/* lock of dst_cache */
@@ -1567,6 +1568,8 @@ static inline void ip_vs_dest_put_and_frkfree (dest); } +void ip_vs_dest_update_overload (struct ip_vs_dest *dest,int mode); +/* IPVS sync daemon data and function prototypes * (from ip_vs_sync.c) */
net/netfilter/ipvs/ip_vs_conn.c +10 -17
@@ -621,22 +621,22 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, s/* Update the connection counters */ if (!(flags &IP_VS_CONN_F_TEMPLATE )) { +int tc; +/* It is a normal connection, so modify the counters * according to the flags, later the protocol can * update them on state change */ if (!(flags &IP_VS_CONN_F_INACTIVE ))atomic_inc (&dest->activeconns); -atomic_inc (&dest->totalconns); + tc =atomic_inc_return (&dest->totalconns); +if (tc ==READ_ONCE (dest->u_threshold)) +ip_vs_dest_update_overload (dest,1 ); }else {/* It is a persistent connection/template, so increase the persistent connection counter */ atomic_inc (&dest->persistconns); } - -if (dest->u_threshold !=0 && -atomic_read (&dest->totalconns) >= dest->u_threshold) - dest->flags |=IP_VS_DEST_F_OVERLOAD ; }
@@ -717,27 +717,20 @@ static inline void ip_vs_unbind_dest(str/* Update the connection counters */ if (!(cp->flags &IP_VS_CONN_F_TEMPLATE )) { +int tc; +/* It is a normal connection, so decrease the counters */ if (!(cp->flags &IP_VS_CONN_F_INACTIVE ))atomic_dec (&dest->activeconns); -atomic_dec (&dest->totalconns); + tc =atomic_fetch_dec (&dest->totalconns); +if (tc ==READ_ONCE (dest->l_threshold_val)) +ip_vs_dest_update_overload (dest,-1 ); }else {/* It is a persistent connection/template, so decrease the persistent connection counter */ atomic_dec (&dest->persistconns); } -if (dest->l_threshold !=0 ) { -if (atomic_read (&dest->totalconns) < dest->l_threshold) - dest->flags &= ~IP_VS_DEST_F_OVERLOAD ; - }else if (dest->u_threshold !=0 ) { -if (atomic_read (&dest->totalconns) *4 < dest->u_threshold *3 ) - dest->flags &= ~IP_VS_DEST_F_OVERLOAD ; - }else { -if (dest->flags &IP_VS_DEST_F_OVERLOAD ) - dest->flags &= ~IP_VS_DEST_F_OVERLOAD ; - } -ip_vs_dest_put (dest); }
net/netfilter/ipvs/ip_vs_ctl.c +59 -8
103 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 89/181 ipvs: clear IPv4 options after rebasing tunnel ICMP errors
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kyle Zeng <[email protected]>
commit e0ba936287dfe9783426aac27e5fd76fe35b38c9 upstream.
ip_vs_in_icmp() rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmp_send(). However, IPCB(skb)->opt still describes the outer IPv4 header.
A timestamp option in the outer header can therefore leave an offset that points into the quoted transport header after the rebase. __ip_options_echo() treats a byte at that stale location as the option length and copies it into the fixed-size option storage on the __icmp_send() stack, causing a stack out-of-bounds write.
Clear the stale option metadata after resetting the network header. Keep the remaining control block fields, including the ingress interface used by the ICMP response path.
--- net/netfilter/ipvs/ip_vs_core.c | 1 + 1 file changed, 1 insertion(+)
net/netfilter/ipvs/ip_vs_core.c +1 -0
@@ -1772,6 +1772,7 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, sif (pskb_pull (skb, offset2) ==NULL ) goto ignore_tunnel;skb_reset_network_header (skb); +memset (&(IPCB (skb)->opt),0 ,sizeof (IPCB (skb)->opt));/* Ensure the IP header is present in headroom */ if (!pskb_may_pull (skb, hlen_orig)) goto ignore_tunnel;
Greg Kroah-Hartman
maintainerPATCH 90/181 packet: use consistent hard_header_len in non-ring send paths
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qihang Tang <[email protected]>
commit 03390aa32e669cc4ecd7d34108e2e1afc13d689d upstream.
packet_snd() reads dev->hard_header_len multiple times while allocating and constructing an skb. Device reconfiguration can change this value concurrently, for example through bonding device type changes.
For SOCK_RAW, packet_snd() can save a larger value in reserve and later allocate headroom using a smaller value. Moving skb->data back by reserve then places it before skb->head, and the following copy from userspace can attempt an out-of-bounds write.
packet_sendmsg_spkt() has the same issue because it calculates its reservation and header offset from separate reads before dropping the RCU read lock to allocate the skb.
Add LL_RESERVED_SPACE_EX() for callers that already saved a header length. Read hard_header_len once in packet_snd() and use it for allocation and construction. In packet_sendmsg_spkt(), preserve the allocation-time value through the device lookup retry.
The separate SOCK_DGRAM consistency problem between hard_header_len and header_ops->create is not addressed here.
--- include/linux/netdevice.h | 6 ++++-- net/packet/af_packet.c | 26 ++++++++++++++++---------- 2 files changed, 20 insertions(+), 12 deletions(-)
include/linux/netdevice.h +4 -2
@@ -297,9 +297,11 @@ struct hh_cache {* We could use other alignment values, but we must maintain the * relationship HH alignment <= LL alignment. */ -#define LL_RESERVED_SPACE (dev) \ - ((((dev)->hard_header_len + READ_ONCE((dev)->needed_headroom)) \ +#define LL_RESERVED_SPACE_EX (dev, hlen) \ + ((((hlen) + READ_ONCE((dev)->needed_headroom)) \ & ~(HH_DATA_MOD - 1)) + HH_DATA_MOD) +#define LL_RESERVED_SPACE (dev) \ + LL_RESERVED_SPACE_EX(dev, (dev)->hard_header_len)#define LL_RESERVED_SPACE_EXTRA (dev,extra) \ ((((dev)->hard_header_len + READ_ONCE((dev)->needed_headroom) + (extra)) \ & ~(HH_DATA_MOD - 1)) + HH_DATA_MOD)
net/packet/af_packet.c +16 -10
@@ -2005,8 +2005,9 @@ static int packet_sendmsg_spkt(struct sostruct net_device *dev;struct sockcm_cookie sockc;__be16 proto =0 ; -int err; +int hard_header_len;int extra_len =0 ; +int err;/* * Get and verify the address.
@@ -2049,14 +2050,18 @@ retry: extra_len =4 ;/* We're doing our own CRC */ } +/* Keep the allocation-time header length across retry. */ +if (!skb) + hard_header_len =READ_ONCE (dev->hard_header_len); + err = -EMSGSIZE ; -if (len > dev->mtu + dev->hard_header_len +VLAN_HLEN + extra_len) +if (len > dev->mtu + hard_header_len +VLAN_HLEN + extra_len) goto out_unlock;if (!skb) { -size_t reserved =LL_RESERVED_SPACE (dev); +size_t reserved =LL_RESERVED_SPACE_EX (dev, hard_header_len);int tlen = dev->needed_tailroom; -unsigned int hhlen = dev->header_ops ? dev->hard_header_len :0 ; +unsigned int hhlen = dev->header_ops ? hard_header_len :0 ;rcu_read_unlock (); skb =sock_wmalloc (sk, len + reserved + tlen,0 ,GFP_KERNEL );
@@ -2086,7 +2091,7 @@ retry: err = -EINVAL ; goto out_unlock; } -if (len > (dev->mtu + dev->hard_header_len + extra_len) && +if (len > (dev->mtu + hard_header_len + extra_len) && !packet_extra_vlan_len_allowed (dev, skb)) { err = -EMSGSIZE ; goto out_unlock;
@@ -3008,7 +3013,7 @@ static int packet_snd(struct socket *socint offset =0 ;struct packet_sock *po =pkt_sk (sk);int vnet_hdr_sz =READ_ONCE (po->vnet_hdr_sz); -int hlen, tlen, linear; +int hard_header_len, hlen, tlen, linear;int extra_len =0 ;/*
@@ -3049,8 +3054,9 @@ static int packet_snd(struct socket *soc goto out_unlock; } + hard_header_len =READ_ONCE (dev->hard_header_len);if (sock->type ==SOCK_RAW ) - reserve = dev->hard_header_len; + reserve = hard_header_len;if (vnet_hdr_sz) { err =packet_snd_vnet_parse (msg, &len, &vnet_hdr, vnet_hdr_sz);if (err)
@@ -3071,10 +3077,10 @@ static int packet_snd(struct socket *soc goto out_unlock; err = -ENOBUFS ; - hlen =LL_RESERVED_SPACE (dev); + hlen =LL_RESERVED_SPACE_EX (dev, hard_header_len); tlen = dev->needed_tailroom; linear =__virtio16_to_cpu (vio_le (), vnet_hdr.hdr_len); - linear =max (linear,min_t (int, len, dev->hard_header_len)); + linear =max (linear,min_t (int, len, hard_header_len)); skb =packet_alloc_skb (sk, hlen + tlen, hlen, len, linear, msg->msg_flags &MSG_DONTWAIT , &err);if (skb ==NULL )
@@ -3090,7 +3096,7 @@ static int packet_snd(struct socket *soc }else if (reserve) {skb_reserve (skb, -reserve);if (len < reserve +sizeof (struct ipv6hdr ) && - dev->min_header_len != dev->hard_header_len) + dev->min_header_len != hard_header_len)skb_reset_network_header (skb); }
Greg Kroah-Hartman
maintainerPATCH 91/181 packet: use consistent hard_header_len in TX_RING send path
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qihang Tang <[email protected]>
commit 21b5953e7494c16a42e6cd8cf110e18d13ae4a6b upstream.
tpacket_snd() reads dev->hard_header_len independently for skb allocation and header construction in tpacket_fill_skb(). Concurrent netdevice reconfiguration can therefore make the reserved headroom smaller than the amount later pushed, or make copylen - hard_header_len negative.
Snapshot hard_header_len once before processing ring frames and use it for the frame limit, headroom allocation, copy length, and skb construction. Pass the snapshot to tpacket_fill_skb().
The separate SOCK_DGRAM consistency problem between hard_header_len and header_ops->create is not addressed here.
--- net/packet/af_packet.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-)
net/packet/af_packet.c +11 -8
@@ -2626,6 +2626,7 @@ static int packet_snd_vnet_parse(structstatic int tpacket_fill_skb (struct packet_sock *po,struct sk_buff *skb,void *frame,struct net_device *dev,void *data,int tp_len,__be16 proto,unsigned char *addr,int hlen,int copylen, +int hard_header_len,const struct sockcm_cookie *sockc) {union tpacket_uhdr ph;
@@ -2657,8 +2658,8 @@ static int tpacket_fill_skb(struct packe }else if (copylen) {int hdrlen =min_t (int, copylen, tp_len); -skb_push (skb, dev->hard_header_len); -skb_put (skb, copylen - dev->hard_header_len); +skb_push (skb, hard_header_len); +skb_put (skb, copylen - hard_header_len); err =skb_store_bits (skb,0 , data, hdrlen);if (unlikely (err))return err;
@@ -2789,7 +2790,7 @@ static int tpacket_snd(struct packet_socvoid *data;int len_sum =0 ;int status =TP_STATUS_AVAILABLE ; -int hlen, tlen, copylen =0 ; +int hard_header_len, hlen, tlen, copylen =0 ;long timeo;mutex_lock (&po->pg_vec_lock);
@@ -2836,8 +2837,9 @@ static int tpacket_snd(struct packet_soc goto out_put; } + hard_header_len =READ_ONCE (dev->hard_header_len);if (po->sk.sk_socket->type ==SOCK_RAW ) - reserve = dev->hard_header_len; + reserve = hard_header_len; size_max = po->tx_ring.frame_size - (po->tp_hdrlen -sizeof (struct sockaddr_ll ));
@@ -2874,7 +2876,7 @@ static int tpacket_snd(struct packet_soc goto tpacket_error; status =TP_STATUS_SEND_REQUEST ; - hlen =LL_RESERVED_SPACE (dev); + hlen =LL_RESERVED_SPACE_EX (dev, hard_header_len); tlen = dev->needed_tailroom;if (vnet_hdr_sz) { data += vnet_hdr_sz;
@@ -2892,10 +2894,10 @@ static int tpacket_snd(struct packet_soc vnet_hdr.hdr_len); has_vnet_hdr = true; } - copylen =max_t (int, copylen, dev->hard_header_len); + copylen =max_t (int, copylen, hard_header_len); skb =sock_alloc_send_skb (&po->sk, hlen + tlen +sizeof (struct sockaddr_ll ) + - (copylen - dev->hard_header_len), + (copylen - hard_header_len), !need_wait, &err);if (unlikely (skb ==NULL )) {
@@ -2905,7 +2907,8 @@ static int tpacket_snd(struct packet_soc goto out_status; } tp_len =tpacket_fill_skb (po, skb, ph, dev, data, tp_len, proto, - addr, hlen, copylen, &sockc); + addr, hlen, copylen, hard_header_len, + &sockc); if (likely(tp_len >= 0) && tp_len > dev->mtu + reserve && !vnet_hdr_sz &&
Greg Kroah-Hartman
maintainerPATCH 92/181 net/packet: reset the MAC header on the packet-socket transmit path
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Doruk Tan Ozturk <[email protected]>
commit c2707480cfbf19c7619acc9c089d17f20869821f upstream.
packet_parse_headers() resets the MAC header only for a SOCK_RAW frame whose socket did not bind a protocol. A protocol-bound SOCK_RAW socket, any SOCK_DGRAM frame, and the legacy SOCK_PACKET path therefore leave skb->mac_header unset here.
For frames sent via __dev_queue_xmit() this is harmless: it resets the MAC header unconditionally. But the packet-socket PACKET_QDISC_BYPASS path uses dev_direct_xmit(), which does not, so the frame reaches ndo_start_xmit() with the MAC header unset. A driver that reads eth_hdr(skb) on transmit then dereferences skb->head + (u16)~0, an out-of-bounds access ~64 KiB past the head -- the same class fixed for one consumer in commit f5089008f90c ("macsec: do not read an unset MAC header in macsec_encrypt()").
packet_parse_headers() runs only on the transmit path, where skb->data points at the start of the L2 header for every packet-socket type regardless of its length: SOCK_RAW and SOCK_PACKET carry a user-supplied header and SOCK_DGRAM has one built by dev_hard_header(). Reset the MAC header unconditionally, mirroring __dev_queue_xmit(), so the frame is anchored on the bypass path too.
Found by 0sec (https://0sec.ai) using automated source analysis; verified against source and matched to the macsec KASAN report in f5089008f90c. Compile-tested.
--- net/packet/af_packet.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
net/packet/af_packet.c +4 -3
@@ -1976,11 +1976,12 @@ static void packet_parse_headers(struct {int depth; +/* On TX skb->data is the L2 header; anchor it for all socket types. */ +skb_reset_mac_header (skb); +if ((!skb->protocol || skb->protocol ==htons (ETH_P_ALL )) && - sock->type ==SOCK_RAW ) { -skb_reset_mac_header (skb); + sock->type ==SOCK_RAW ) skb->protocol =dev_parse_header_protocol (skb); - }/* Move network header to the right position for VLAN tagged packets */ if (likely(skb->dev->type == ARPHRD_ETHER) &&
Greg Kroah-Hartman
maintainerPATCH 93/181 packet: synchronize pressure clearing with ring reconfiguration
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zihan Xi <[email protected]>
commit 1a35da325cac4d5bcad76a2aa943408a6f1d9000 upstream.
packet_set_ring() updates the RX ring state under sk_receive_queue.lock, but used to publish the tpacket receive mode through po->prot_hook.func after releasing that lock. packet_poll() and packet_recvmsg() can then run the pressure clearing path after the ring has been cleared while still seeing tpacket_rcv, causing __packet_rcv_has_room() to dereference stale or NULL ring storage.
Move the existing receive hook assignment into the same sk_receive_queue.lock section as the ring state update. Keep the assignment otherwise unchanged, including on TX ring reconfiguration, to avoid adding behavior changes that are not required for the fix.
Serialize packet_recvmsg() pressure clearing with the same queue lock only after PACKET_SOCK_PRESSURE has been observed. If the flag is clear and the socket has moved away from tpacket_rcv, packet_set_ring() has already detached the socket and waited for synchronize_net(), so no new packet input can set the flag again.
packet_poll() already holds sk_receive_queue.lock, so it uses the new unlocked helper directly.
--- net/packet/af_packet.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-)
net/packet/af_packet.c +16 -4
@@ -1367,13 +1367,25 @@ static int packet_rcv_has_room(struct pareturn ret; } -static void packet_rcv_try_clear_pressure (struct packet_sock *po) +static void __packet_rcv_try_clear_pressure (struct packet_sock *po) {if (packet_sock_flag (po,PACKET_SOCK_PRESSURE ) &&__packet_rcv_has_room (po,NULL ) ==ROOM_NORMAL )packet_sock_flag_set (po,PACKET_SOCK_PRESSURE , false); } +static void packet_rcv_try_clear_pressure (struct packet_sock *po) +{ +struct sock *sk = &po->sk; + +if (!packet_sock_flag (po,PACKET_SOCK_PRESSURE )) +return ; + +spin_lock_bh (&sk->sk_receive_queue.lock); +__packet_rcv_try_clear_pressure (po); +spin_unlock_bh (&sk->sk_receive_queue.lock); +} +static void packet_sock_destruct (struct sock *sk) {skb_queue_purge (&sk->sk_error_queue);
@@ -4357,7 +4369,7 @@ static __poll_t packet_poll(struct file TP_STATUS_KERNEL)) mask |= EPOLLIN | EPOLLRDNORM; } -packet_rcv_try_clear_pressure (po); +__packet_rcv_try_clear_pressure (po);spin_unlock_bh (&sk->sk_receive_queue.lock);spin_lock_bh (&sk->sk_write_queue.lock);if (po->tx_ring.pg_vec) {
@@ -4597,14 +4609,14 @@ static int packet_set_ring(struct sock * rb->frame_max = (req->tp_frame_nr -1 ); rb->head =0 ; rb->frame_size = req->tp_frame_size; + po->prot_hook.func = (po->rx_ring.pg_vec) ? + tpacket_rcv : packet_rcv;spin_unlock_bh (&rb_queue->lock);swap (rb->pg_vec_order, order);swap (rb->pg_vec_len, req->tp_block_nr); rb->pg_vec_pages = req->tp_block_size/PAGE_SIZE ; - po->prot_hook.func = (po->rx_ring.pg_vec) ? - tpacket_rcv : packet_rcv;skb_queue_purge (rb_queue);if (atomic_long_read (&po->mapped)) pr_err("packet_mmap: vma is busy: %ld\n",
Greg Kroah-Hartman
maintainerPATCH 94/181 net: fix skb length accounting after generic XDP frag adjustment
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sun Jian <[email protected]>
commit 33f2b2eb33d666ecac68031e0f31424fb70528db upstream.
Generic XDP exposes non-linear skb fragments through an xdp_buff. If an XDP program adjusts the fragment area, bpf_prog_run_generic_xdp() copies xdp_frags_size back to skb->data_len but leaves skb->len containing the old fragment contribution.
After a fragment shrink, this makes skb_headlen() larger than the actual linear area. In the reproduced UDP receive path, __skb_datagram_iter() copied 1024 bytes past the actual linear tail to userspace, starting at struct skb_shared_info. The copied bytes included the affected skb's nr_frags, xdp_frags_size and a kernel pointer from skb_shinfo(skb)->frags[0]. Real packet data was displaced by the same amount and truncated at the end.
Subtract the old data_len before replacing it and add the new data_len afterwards, keeping skb->len and skb->data_len synchronized.
A 60000-byte UDP datagram on a veth pair with MTU 64000 was shortened by 1024 bytes from its fragment area. Before the fix, all 10 runs produced corrupted payloads. After the fix, all 10 runs matched the expected payload exactly.
--- net/core/dev.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
net/core/dev.c +7 -3
@@ -5116,12 +5116,16 @@ u32 bpf_prog_run_generic_xdp(struct sk_b }/* XDP frag metadata (e.g. nr_frags) are updated in eBPF helpers -* (e.g. bpf_xdp_adjust_tail), we need to update data_len here. +* (e.g. bpf_xdp_adjust_tail). Remove the old fragment contribution +* from skb->len before updating data_len, then add the new one back. */ -if (xdp_buff_has_frags (xdp)) + skb->len -= skb->data_len; +if (xdp_buff_has_frags (xdp)) { skb->data_len =skb_shinfo (skb)->xdp_frags_size; -else + skb->len += skb->data_len; + }else { skb->data_len =0 ; + }/* check if XDP changed eth hdr such SKB needs update */ eth = (struct ethhdr *)xdp->data;
Greg Kroah-Hartman
maintainerPATCH 95/181 net: openvswitch: reallocate update replies for mismatched IDs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhiling Zou <[email protected]>
commit 5d1c224dd914579524a183a514c12b95095d12ce upstream.
ovs_flow_cmd_new() preallocates the optional reply skb before it takes ovs_mutex and before it knows which existing flow will be updated.
That is normally fine because the skb is sized from the request flow identifier. That identifier also becomes the inserted flow's identifier. For updates, however, a request with a UFID may miss the UFID lookup and then fall back to the flow key lookup. That lookup can legitimately find an existing key-identified flow. UFIDs are optional and the flow key is the primary identifier.
For echoed replies, ovs_flow_cmd_fill_info() writes the matched flow's identifier, not the request identifier used for the preallocation. A short request UFID can therefore leave too little room for the key identifier. The fill can then fail with -EMSGSIZE and hit the BUG_ON(error < 0) in the update path.
Once the update target has been resolved, reallocate the reply skb if the matched flow needs a larger reply than the request identifier allowed. Do this before replacing the actions so the request can still fail cleanly if the rare extra allocation fails.
--- net/openvswitch/datapath.c | 29 ++++++++++++++++++++++++++--- 1 file changed, 26 insertions(+), 3 deletions(-)
net/openvswitch/datapath.c +26 -3
@@ -1083,9 +1083,8 @@ static int ovs_flow_cmd_new(struct sk_bu error = -EEXIST ; goto err_unlock_ovs; } -/* The flow identifier has to be the same for flow updates. -* Look for any overlapping flow. -*/ + +/* Look for any overlapping flow. */ if (unlikely (!ovs_flow_cmp (flow, &match))) {if (ovs_identifier_is_key (&flow->id)) flow = ovs_flow_tbl_lookup_exact(&dp->table,
@@ -1097,6 +1096,30 @@ static int ovs_flow_cmd_new(struct sk_bu goto err_unlock_ovs; } } + +if (unlikely (reply)) { +size_t cur, req; + + cur =ovs_flow_cmd_msg_size (acts, &new_flow->id, + ufid_flags); + req =ovs_flow_cmd_msg_size (acts, &flow->id, + ufid_flags); +if (cur < req) { +struct sk_buff *resized; + + resized =ovs_flow_cmd_alloc_info (acts, + &flow->id, + info, false, + ufid_flags); +if (IS_ERR (resized)) { + error =PTR_ERR (resized); + goto err_unlock_ovs; + } +kfree_skb (reply); + reply = resized; + } + } +/* Update actions. */ old_acts =ovsl_dereference (flow->sf_acts);rcu_assign_pointer (flow->sf_acts, acts);
Greg Kroah-Hartman
maintainerPATCH 96/181 net/sched: reject overly deep qdisc hierarchies
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijie Huang <[email protected]>
commit dedd34b0f2310e28c5f6d4875cfbf4b7ed821c01 upstream.
Deep qdisc hierarchies can lead to excessive recursion in qdisc tree walkers and exhaust the kernel stack. The existing loop check does not cover the create-and-graft path, so a hierarchy can still be extended by creating a new child qdisc below an already deep parent.
Store the hierarchy depth in struct Qdisc and update it when qdiscs are grafted. Reject new child qdiscs once the parent is already at the maximum allowed depth.
--- include/net/sch_generic.h | 1 + net/sched/sch_api.c | 9 +++++++++ 2 files changed, 10 insertions(+)
include/net/sch_generic.h +1 -0
@@ -101,6 +101,7 @@ struct Qdisc {struct hlist_node hash;u32 handle;u32 parent; +int depth;struct netdev_queue *dev_queue;
net/sched/sch_api.c +9 -0
@@ -1095,6 +1095,9 @@ static int qdisc_graft(struct net_deviceunsigned int i, num_q, ingress;struct netdev_queue *dev_queue; +if (new) + new->depth =0 ; + ingress =0 ; num_q = dev->num_tx_queues; if ((q && q->flags & TCQ_F_INGRESS) ||
@@ -1192,9 +1195,15 @@ skip:NL_SET_ERR_MSG (extack,"STAB not supported on a non root" );return -EINVAL ; } +if (new && parent->depth >=7 ) { +NL_SET_ERR_MSG (extack,"Qdisc hierarchy is too deep" ); +return -E2BIG ; + } err = cops->graft (parent, cl, new, &old, extack);if (err)return err; +if (new) + new->depth = parent->depth +1 ;notify_and_destroy (net, skb, n, classid, old, new, extack); }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 97/181 net: octeontx2-pf: Fix UB in shift operation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey V. Frolov <[email protected]>
commit 7e2d693af0d4c05bddccb3541a0aabd69f4cb244 upstream.
In function otx2_get_egress_burst_cfg, when the parameter burst is 255 and the max mantissa is 255 (0xFFULL), burst_exp is set to ilog2(255) - 1, which equals 6.
This results in an unsigned wrap-around when calculating (1ULL << (*burst_exp - 7)), since *burst_exp - 7 becomes -1, which makes the shift operand 0xFFFFFFFF. This value is greater than the width of the left operand.
According to standard 6.5.7 p.3:
"The type of the result is that of the promoted left operand. If the value of the right operand is negative or is greater than or equal to the width of the promoted left operand, the behavior is undefined."
Fix the off-by-one boundary condition.
Add a WARN_ON(*burst_exp < 7) before the else branch as an explicit safeguard. This ensures that if max_mantissa ever changes in a way that reintroduces this condition, it will be immediately caught at runtime rather than silently triggering UB.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c +4 -2
@@ -78,10 +78,12 @@ static void otx2_get_egress_burst_cfg(stif (burst) { *burst_exp =ilog2 (burst) ?ilog2 (burst) -1 :0 ; tmp = burst -rounddown_pow_of_two (burst); -if (burst < max_mantissa) +if (burst <= max_mantissa) { *burst_mantissa = tmp *2 ; -else + }else { +WARN_ON (*burst_exp <7 ); *burst_mantissa = tmp / (1ULL << (*burst_exp -7 )); + } }else { *burst_exp =MAX_BURST_EXPONENT ; *burst_mantissa = max_mantissa;
Greg Kroah-Hartman
maintainerPATCH 98/181 net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qihang Tang <[email protected]>
commit 3b9a324e646d3657a8d9806dfbfe4f3e4066e882 upstream.
dev_validate_header() reads dev->hard_header_len directly when zero-padding short link layer headers for CAP_SYS_RAWIO holders:
if (capable(CAP_SYS_RAWIO)) {
memset(ll_header + len, 0, dev->hard_header_len - len);
return true;
}Packet send paths call dev_validate_header() on skbs whose headroom was allocated from an earlier hard_header_len read. If the device is reconfigured so that dev->hard_header_len increases before validation, the memset writes past the reserved buffer, an out-of-bounds write.
This out-of-bounds write is masked in some SOCK_RAW paths today because the same concurrent increase can first make skb_push() exceed the reserved headroom and trigger skb_under_panic(). Remove the zero-padding branch before making those hard_header_len reads consistent, so the snapshot fixes do not turn a loud panic into a silent overwrite.
This path is only reached for variable length L2 protocols, where len < hard_header_len but len >= min_header_len. No remaining in-tree variable length L2 protocol implements header_ops->validate, and the CAP_SYS_RAWIO bypass that zero-pads and accepts short headers has no real value beyond allowing testing of intentionally malformed input.
Drop the CAP_SYS_RAWIO branch. The remaining reads of dev->hard_header_len in dev_validate_header() are comparisons only and have no memory safety impact.
--- include/linux/netdevice.h | 5 ----- 1 file changed, 5 deletions(-)
include/linux/netdevice.h +0 -5
@@ -3191,11 +3191,6 @@ static inline bool dev_validate_header(cif (len < dev->min_header_len)return false; -if (capable (CAP_SYS_RAWIO )) { -memset (ll_header + len,0 , dev->hard_header_len - len); -return true; - } -if (dev->header_ops && dev->header_ops->validate)return dev->header_ops->validate (ll_header, len);
Greg Kroah-Hartman
maintainerPATCH 99/181 mac802154: fix netdev use-after-free in beacon worker
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zihan Xi <[email protected]>
commit 5f26a690e8efa54315e4922368daf54e0b8f5515 upstream.
mac802154_beacon_worker() reads local->beacon_req under RCU and derives the sub-interface from the request, but then drops the RCU read lock and continues to use both sdata and the embedded wpan_dev.
mac802154_stop_beacons_locked() cancels only pending beacon work, clears local->beacon_req and frees the request. A beacon worker that is already running can therefore continue after interface teardown and dereference the freed netdev private area.
The scan worker already pins the netdev before leaving RCU. Apply the same lifetime rule to the beacon worker: take a netdev reference while the request is still protected by RCU, and release it on all paths that continue after the reference is acquired.
--- net/mac802154/scan.c | 4 ++++ 1 file changed, 4 insertions(+)
net/mac802154/scan.c +4 -0
@@ -415,6 +415,7 @@ void mac802154_beacon_worker(struct work container_of(work, struct ieee802154_local, beacon_work.work);struct cfg802154_beacon_request *beacon_req;struct ieee802154_sub_if_data *sdata; +netdevice_tracker dev_tracker;struct wpan_dev *wpan_dev;u8 interval;int ret;
@@ -427,12 +428,14 @@ void mac802154_beacon_worker(struct work } sdata =IEEE802154_WPAN_DEV_TO_SUB_IF (beacon_req->wpan_dev); +netdev_hold (sdata->dev, &dev_tracker,GFP_ATOMIC );/* Wait an arbitrary amount of time in case we cannot use the device */ if (local->suspended || !ieee802154_sdata_running (sdata)) {rcu_read_unlock ();queue_delayed_work (local->mac_wq, &local->beacon_work,msecs_to_jiffies (1000 )); +netdev_put (sdata->dev, &dev_tracker);return ; }
@@ -450,6 +453,7 @@ void mac802154_beacon_worker(struct workif (interval <IEEE802154_ACTIVE_SCAN_DURATION )queue_delayed_work (local->mac_wq, &local->beacon_work, local->beacon_interval); +netdev_put (sdata->dev, &dev_tracker); } int mac802154_stop_beacons_locked(struct ieee802154_local *local,
Greg Kroah-Hartman
maintainerPATCH 100/181 netfilter: ebt_nflog: pin the NFLOG backend
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengfeng Ye <[email protected]>
commit 30825970339c107bacaf7f61af90fcdb1f597ca1 upstream.
nf_log_unregister() runs after the per-net teardown so its final RCU grace period also drains readers that obtained the logger from a per-net binding. However, ebt_nflog passes an explicit ULOG log type to nf_log_packet() without holding a reference on the selected logger module, unlike the xt_NFLOG and nft_log frontends.
An ebtables nflog rule can therefore remain callable while nfnetlink_log is unloaded. The resulting interleaving is:
CPU 0 CPU 1
nfnetlink_log_fini()
unregister_pernet_subsys()
kfree(nfnl_log_pernet(net))
ebt_nflog_tg()
nf_log_packet()
nfulnl_log_packet()
instance_lookup_get_rcu()The global ULOG logger is still registered at this point, so CPU 1 dereferences the per-net state after CPU 0 has freed it. KASAN reported:
BUG: KASAN: slab-use-after-free in instance_lookup_get_rcu Read of size 8 at addr ff110001052e6210 by task poc/92 Call Trace: instance_lookup_get_rcu+0x1ce/0x1f0 [nfnetlink_log] nfulnl_log_packet+0x248/0x2fb0 [nfnetlink_log] nf_log_packet+0x204/0x300 ebt_nflog_tg+0x351/0x550 ebt_do_table+0xedf/0x22b0 Allocated by task 90: __kmalloc_noprof+0x186/0x470 ops_init+0x6d/0x420 register_pernet_operations+0x2f6/0x670 register_pernet_subsys+0x23/0x40 Freed by task 93: kfree+0x131/0x3c0 ops_undo_list+0x3e3/0x700 unregister_pernet_operations+0x232/0x490 unregister_pernet_subsys+0x1c/0x30 nfnetlink_log_fini+0x34/0x450 [nfnetlink_log]
Acquire the ULOG logger module reference when an ebt_nflog rule is validated and release it when the rule is destroyed. Request the NFLOG backend for legacy callers when needed, matching xt_NFLOG. This prevents module teardown until all ebt_nflog rules have stopped using the logger.
--- net/bridge/netfilter/ebt_nflog.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
net/bridge/netfilter/ebt_nflog.c +16 -1
@@ -41,11 +41,25 @@ ebt_nflog_tg(struct sk_buff *skb, conststatic int ebt_nflog_tg_check (const struct xt_tgchk_param *par) {struct ebt_nflog_info *info = par->targinfo; +int ret;if (info->flags & ~EBT_NFLOG_MASK )return -EINVAL ; info->prefix[EBT_NFLOG_PREFIX_SIZE -1 ] ='\0' ; -return 0 ; + + ret =nf_logger_find_get (par->family,NF_LOG_TYPE_ULOG ); +if (ret !=0 && !par->nft_compat) { +request_module ("%s" ,"nfnetlink_log" ); + + ret =nf_logger_find_get (par->family,NF_LOG_TYPE_ULOG ); + } + +return ret; +} + +static void ebt_nflog_tg_destroy (const struct xt_tgdtor_param *par) +{ +nf_logger_put (par->family,NF_LOG_TYPE_ULOG ); }static struct xt_target ebt_nflog_tg_reg__read_mostly = {
@@ -54,6 +68,7 @@ static struct xt_target ebt_nflog_tg_reg .family = NFPROTO_BRIDGE, .target = ebt_nflog_tg, .checkentry = ebt_nflog_tg_check, + .destroy = ebt_nflog_tg_destroy, .targetsize = sizeof(struct ebt_nflog_info), .me = THIS_MODULE, };
Greg Kroah-Hartman
maintainerPATCH 101/181 net: bridge: mrp: fix uninitialised bytes on the wire
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baul Lee <[email protected]>
commit 63488dba65ef91373ef616575b32eb0eb21459f4 upstream.
br_mrp_alloc_test_skb() builds MRP test frames on an skb from dev_alloc_skb(), which does not clear the linear data area. On the MRA ring-role branch the sub-option TLV header is appended with
sub_tlv = skb_put(skb, sizeof(*sub_tlv)); sub_tlv->type = BR_MRP_SUB_TLV_HEADER_TEST_AUTO_MGR;
so sub_tlv->length is never written, and the two trailing alignment bytes are appended with a bare skb_put() that does not clear them either. The neighbouring oui and sub_opt regions are explicitly zeroed, so three uninitialised bytes are left in every MRA MRP_Test frame that goes out.
Put the sub-option TLV header and the alignment padding in a single skb_put_zero(), which clears both. The AUTO_MGR sub-TLV carries no payload, so the zeroed length field is already the value it should have.
--- net/bridge/br_mrp.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
net/bridge/br_mrp.c +2 -4
@@ -224,11 +224,9 @@ static struct sk_buff *br_mrp_alloc_test sub_opt =skb_put (skb,sizeof (*sub_opt));memset (sub_opt,0x0 ,sizeof (*sub_opt)); - sub_tlv =skb_put (skb,sizeof (*sub_tlv)); - sub_tlv->type =BR_MRP_SUB_TLV_HEADER_TEST_AUTO_MGR ; -/* 32 bit alligment shall be ensured therefore add 2 bytes */ -skb_put (skb,MRP_OPT_PADDING ); + sub_tlv =skb_put_zero (skb,sizeof (*sub_tlv) +MRP_OPT_PADDING ); + sub_tlv->type =BR_MRP_SUB_TLV_HEADER_TEST_AUTO_MGR ; }br_mrp_skb_tlv (skb,BR_MRP_TLV_HEADER_END ,0x0 );
Greg Kroah-Hartman
maintainerPATCH 102/181 KVM: s390: pci: Fix memory accounting for pinned/unpinned pages
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Farhan Ali <[email protected]>
[ Upstream commit 36f6999ecde3976731a8bfc0b8e667da6f593069 ]
The account_mem() and unaccount_mem() functions call get_uid() which increments the reference count of struct user_struct on every invocation. But we don't decrement the count by calling free_uid(). It also accounted/unaccounted the pages against the current->mm. But its possible the unaccount_mem() can be called from a different process context than the one that originally pinned the pages.
Let's fix this by storing the pinning process user_struct and mm_struct when accounting for pinned pages, and subsequently free these resources when the pages are unpinned.
--- arch/s390/kvm/pci.c | 48 ++++++++++++++++++++++++++++++++------------- arch/s390/kvm/pci.h | 2 ++ 2 files changed, 36 insertions(+), 14 deletions(-)
arch/s390/kvm/pci.c +34 -14
@@ -191,34 +191,54 @@ static int kvm_zpci_clear_airq(struct zpci_dev *zdev)return cc ? -EIO :0 ; } -static inline void unaccount_mem (unsigned long nr_pages) +static inline void unaccount_mem (struct kvm_zdev *kzdev,unsigned long nr_pages) { -struct user_struct *user =get_uid (current_user ()); +struct user_struct *user = kzdev->user_account; +struct mm_struct *mm_account = kzdev->mm_account; -if (user) +if (user) {atomic_long_sub (nr_pages, &user->locked_vm); -if (current->mm) -atomic64_sub (nr_pages, ¤t->mm->pinned_vm); +free_uid (user); + kzdev->user_account =NULL ; + } + +if (mm_account) { +atomic64_sub (nr_pages, &mm_account->pinned_vm); +mmdrop (mm_account); + kzdev->mm_account =NULL ; + } } -static inline int account_mem (unsigned long nr_pages) +static inline int account_mem (struct kvm_zdev *kzdev,unsigned long nr_pages) {struct user_struct *user =get_uid (current_user ());unsigned long page_limit, cur_pages, new_pages; +int rc =0 ; page_limit =rlimit (RLIMIT_MEMLOCK ) >>PAGE_SHIFT ; + cur_pages =atomic_long_read (&user->locked_vm);do { - cur_pages =atomic_long_read (&user->locked_vm); new_pages = cur_pages + nr_pages; -if (new_pages > page_limit) -return -ENOMEM ; - }while (atomic_long_cmpxchg (&user->locked_vm, cur_pages, - new_pages) != cur_pages); +if (new_pages > page_limit) { + rc = -ENOMEM ; + goto out; + } + }while (!atomic_long_try_cmpxchg (&user->locked_vm, &cur_pages, new_pages)); + +if (current->mm) { +mmgrab (current->mm); +atomic64_add (nr_pages, ¤t->mm->pinned_vm); + } -atomic64_add (nr_pages, ¤t->mm->pinned_vm); + kzdev->user_account = user; + kzdev->mm_account = current->mm;return 0 ; + +out: +free_uid (user); +return rc; } static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib *fib,
@@ -295,7 +315,7 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib *fib, }/* Account for pinned pages, roll back on failure */ -if (account_mem (pcount)) +if (account_mem (zdev->kzdev, pcount)) goto unpin2;/* AISB must be allocated before we can fill in GAITE */
@@ -424,7 +444,7 @@ static int kvm_s390_pci_aif_disable(struct zpci_dev *zdev, bool force) pcount++; }if (pcount >0 ) -unaccount_mem (pcount); +unaccount_mem (kzdev, pcount); out:mutex_unlock (&aift->aift_lock);
arch/s390/kvm/pci.h +2 -0
@@ -22,6 +22,8 @@ struct kvm_zdev {struct kvm *kvm;struct zpci_fib fib;struct list_head entry; +struct user_struct *user_account; +struct mm_struct *mm_account; };struct zpci_gaite {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 103/181 KVM: s390: pci: Fix missing error codes and memory unaccounting
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Farhan Ali <[email protected]>
[ Upstream commit f86842e4d6c482300f4567f492d512c9ccf5bc4f ]
In kvm_s390_pci_aif_enable() two error paths failed to set an error code, causing the function to return 0 on failure. It also failed to rollback memory accounting on failure. Fix both by propagating an error code on failure and calling unaccount_mem() in the cleanup path.
--- arch/s390/kvm/pci.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
arch/s390/kvm/pci.c +7 -2
@@ -315,14 +315,17 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib *fib, }/* Account for pinned pages, roll back on failure */ -if (account_mem (zdev->kzdev, pcount)) + rc =account_mem (zdev->kzdev, pcount); +if (rc) goto unpin2;/* AISB must be allocated before we can fill in GAITE */ mutex_lock (&aift->aift_lock); bit =airq_iv_alloc_bit (aift->sbv); -if (bit ==-1UL ) +if (bit ==-1UL ) { + rc = -ENOMEM ; goto unlock; + } zdev->aisb = bit;/* store the summary bit number */ zdev->aibv = airq_iv_create(msi_vecs, AIRQ_IV_DATA | AIRQ_IV_BITLOCK |
@@ -374,6 +377,8 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib *fib,airq_iv_free_bit (aift->sbv, zdev->aisb); zdev->aisb =0 ; unlock: +if (pcount >0 ) +unaccount_mem (zdev->kzdev, pcount);mutex_unlock (&aift->aift_lock); unpin2:if (fib->fmt0.sum ==1 )
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 104/181 KVM: s390: pci: Fix resource leak on IRQ registration failure
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Farhan Ali <[email protected]>
[ Upstream commit 5580c9858f1e00f60191eb09c3add359836d60b6 ]
Currently if kvm_zpci_set_airq() fails, kvm_s390_pci_aif_enable() returns the error code but doesn't do any resource cleanup thus leaking resources. Fix this by cleaning up all the resources such as the GAITE, AIBV, AISB and unpinning any pinned pages. While at it, remove dead code that stored FIB values that were never referenced.
As part of the cleanup, we are also holding the aift_lock a bit longer, as we hold the lock while executing the MPCIFC instruction. Though this is not strictly necessary, it means we don't have to drop and re-acquire in the error case.
--- arch/s390/kvm/pci.c | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-)
arch/s390/kvm/pci.c +21 -8
@@ -359,19 +359,32 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib *fib, aift->kzdev[zdev->aisb] = zdev->kzdev;spin_unlock_irq (&aift->gait_lock); -/* Update guest FIB for re-issue */ - fib->fmt0.aisbo = zdev->aisb &63 ; - fib->fmt0.aisb =virt_to_phys (aift->sbv->vector + (zdev->aisb /64 ) *8 ); - fib->fmt0.isc = gisc; -/* Save some guest fib values in the host for later use */ - zdev->kzdev->fib.fmt0.isc = fib->fmt0.isc; + zdev->kzdev->fib.fmt0.isc = gisc; zdev->kzdev->fib.fmt0.aibv = fib->fmt0.aibv; -mutex_unlock (&aift->aift_lock);/* Issue the clp to setup the irq now */ rc =kvm_zpci_set_airq (zdev); -return rc; +if (!rc) { +mutex_unlock (&aift->aift_lock); +return rc; + } + +/* Start cleanup */ + zdev->kzdev->fib.fmt0.isc =0 ; + zdev->kzdev->fib.fmt0.aibv =0 ; + +spin_lock_irq (&aift->gait_lock); + gaite->count--; + gaite->aisb =0 ; + gaite->gisc =0 ; + gaite->aisbo =0 ; + gaite->gisa =0 ; + aift->kzdev[zdev->aisb] =NULL ; +spin_unlock_irq (&aift->gait_lock); + +airq_iv_release (zdev->aibv); + zdev->aibv =NULL ; free_aisb:airq_iv_free_bit (aift->sbv, zdev->aisb);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 105/181 KVM: s390: pci: Fix aisb calculation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Rosato <[email protected]>
[ Upstream commit 0cfe660559e857d7c00ab86c73e4510ce069086f ]
The current implementation of aisb calculation will erroneously index via an unsigned long * as well as multiply by 8B for every 64-bits in the offset; only one or the other is required. This throws off aisb calculations once the number of devices exceeds 64, and can result in out-of-bounds access as well as failure to indicate summary bits associated with those devices in guests.
Fix this by converting to a physical address before applying the offset, as is already done in arch/s390/pci/pci_irq.c.
--- arch/s390/kvm/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/kvm/pci.c +1 -1
@@ -167,7 +167,7 @@ static int kvm_zpci_set_airq(struct zpci_dev *zdev) fib.fmt0.noi =airq_iv_end (zdev->aibv); fib.fmt0.aibv =virt_to_phys (zdev->aibv->vector); fib.fmt0.aibvo =0 ; - fib.fmt0.aisb =virt_to_phys (aift->sbv->vector + (zdev->aisb /64 ) *8 ); + fib.fmt0.aisb =virt_to_phys (aift->sbv->vector) + (zdev->aisb /64 ) *8 ; fib.fmt0.aisbo = zdev->aisb &63 ; fib.gd = zdev->gisa;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 106/181 block: Reorder the request allocation code in blk_mq_submit_bio()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
[ Upstream commit 44e41381591dc5b4ea67a9f170b4ec85c817586e ]
Help the CPU branch predictor in case of a cache hit by handling the cache hit scenario first.
Stable-dep-of: dc278e9bf2b9 ("blk-mq: pop cached request if it is usable")
--- block/blk-mq.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
block/blk-mq.c +3 -3
@@ -3121,12 +3121,12 @@ void blk_mq_submit_bio(struct bio *bio) } new_request: -if (!rq) { +if (rq) { +blk_mq_use_cached_rq (rq, plug, bio); + }else { rq =blk_mq_get_new_requests (q, plug, bio, nr_segs);if (unlikely (!rq)) goto queue_exit; - }else { -blk_mq_use_cached_rq (rq, plug, bio); }trace_block_getrq (bio);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 107/181 blk-mq: pop cached request if it is usable
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keith Busch <[email protected]>
[ Upstream commit dc278e9bf2b9513a763353e6b9cc21e0f532954e ]
When submitting a bio to blk-mq, if the task should sleep after peeking a cached request, but before it pops it, the plug flushes and calls blk_mq_free_plug_rqs, freeing the cached_rqs. This creates a use-after-free bug. Fix this by popping the cached request before any possible blocking calls if it is suitable for use.
Popping this request first holds a queue reference, so avoid any serialization races with queue freezes and can safely proceed with dispatching that request to the driver. This potentially increases a timing window from when a driver wants to freeze its queue to when requests stop being dispatched. That scenario is off the fast path though, and drivers need to appropriately handle requests during a freeze request anyway.
The downside is the popped element needs to be individually freed when we performed a bio plug merge. The cached request would have had to be freed later anyway, but this patch does it inline with building the plug list instead of after flushing it.
--- block/blk-mq.c | 34 +++++++++------------------------- 1 file changed, 9 insertions(+), 25 deletions(-)
block/blk-mq.c +9 -25
@@ -2989,7 +2989,7 @@ static struct request *blk_mq_get_new_requests(struct request_queue *q,/* * Check if there is a suitable cached request and return it. */ -static struct request *blk_mq_peek_cached_request (struct blk_plug *plug, +static struct request *blk_mq_get_cached_request (struct blk_plug *plug,struct request_queue *q,blk_opf_t opf) {enum hctx_type type =blk_mq_get_hctx_type (opf);
@@ -3005,27 +3005,10 @@ static struct request *blk_mq_peek_cached_request(struct blk_plug *plug,return NULL ;if (op_is_flush (rq->cmd_flags) !=op_is_flush (opf))return NULL ; +rq_list_pop (&plug->cached_rqs);return rq; } -static void blk_mq_use_cached_rq (struct request *rq,struct blk_plug *plug, -struct bio *bio) -{ -if (rq_list_pop (&plug->cached_rqs) != rq) -WARN_ON_ONCE (1 ); - -/* -* If any qos ->throttle() end up blocking, we will have flushed the -* plug and hence killed the cached_rq list as well. Pop this entry -* before we throttle. -*/ -rq_qos_throttle (rq->q, bio); - -blk_mq_rq_time_init (rq,0 ); - rq->cmd_flags = bio->bi_opf; -INIT_LIST_HEAD (&rq->queuelist); -} -static bool bio_unaligned (const struct bio *bio,struct request_queue *q) {unsigned int bs_mask =queue_logical_block_size (q) -1 ;
@@ -3063,7 +3046,7 @@ void blk_mq_submit_bio(struct bio *bio)/* * If the plug has a cached request for this queue, try to use it. */ - rq =blk_mq_peek_cached_request (plug, q, bio->bi_opf); + rq =blk_mq_get_cached_request (plug, q, bio->bi_opf);/* * A BIO that was released from a zone write plug has already been
@@ -3122,7 +3105,10 @@ void blk_mq_submit_bio(struct bio *bio) new_request:if (rq) { -blk_mq_use_cached_rq (rq, plug, bio); +rq_qos_throttle (rq->q, bio); +blk_mq_rq_time_init (rq,blk_time_get_ns ()); + rq->cmd_flags = bio->bi_opf; +INIT_LIST_HEAD (&rq->queuelist); }else { rq =blk_mq_get_new_requests (q, plug, bio, nr_segs);if (unlikely (!rq))
@@ -3165,12 +3151,10 @@ void blk_mq_submit_bio(struct bio *bio)return ; queue_exit: -/* -* Don't drop the queue reference if we were trying to use a cached -* request and thus didn't acquire one. -*/ if (!rq)blk_queue_exit (q); +else +blk_mq_free_request (rq); }#ifdef CONFIG_BLK_MQ_STACKING
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 108/181 blk-mq: reinsert cached request to the list
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keith Busch <[email protected]>
[ Upstream commit b051bb6bf0a231117036aa607cadf55be8e63910 ]
A previous commit removed an optimization out of caution for a scenario that turns out not to be real: all the "queue_exit" goto's are safe to reinsert the request into the cached_rq's plug list as they are either from a non-blocking path, or a successful merge that already holds the queue reference. This optimization is most needed for small sequential workloads that successfully merge into larger requests.
--- block/blk-mq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
block/blk-mq.c +1 -1
@@ -3154,7 +3154,7 @@ void blk_mq_submit_bio(struct bio *bio)if (!rq)blk_queue_exit (q);else -blk_mq_free_request (rq); +rq_list_add_head (&plug->cached_rqs, rq); }#ifdef CONFIG_BLK_MQ_STACKING
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 109/181 dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harshal Dev <[email protected]>
[ Upstream commit e27264daac7d9ce892a2a5b4a864d6d9a3c9276a ]
The DT bindings for inline-crypto engine do not specify the UFS_PHY_GDSC power-domain and iface clock. Without enabling the iface clock and the associated power-domain the ICE hardware cannot function correctly and leads to unclocked hardware accesses being observed during probe.
Extend and fix the DT bindings for inline-crypto engine by allowing description of the iface clock and UFS_PHY_GDSC power-domain.
This patch has been adapted from the mentioned upstream commit to drop references to Eliza and Milos Qualcomm platforms which do not exist on the stable tree. Thus, patch now fixes the original commit which introduced the DT binding for Qualcomm inline-crypto engine.
--- .../crypto/qcom,inline-crypto-engine.yaml | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
Documentation/devicetree/bindings/crypto/qcom,inline-crypto-engine.yaml +15 -1
@@ -25,6 +25,16 @@ properties: maxItems: 1 clocks: + minItems: 1 + maxItems: 2 + + clock-names: + minItems: 1 + items: + - const: core + - const: iface + + power-domains: maxItems: 1 required:
@@ -42,6 +52,10 @@ examples: compatible = "qcom,sm8550-inline-crypto-engine", "qcom,inline-crypto-engine"; reg = <0x01d88000 0x8000>; - clocks = <&gcc GCC_UFS_PHY_ICE_CORE_CLK>; + clocks = <&gcc GCC_UFS_PHY_ICE_CORE_CLK>, + <&gcc GCC_UFS_PHY_AHB_CLK>; + clock-names = "core", + "iface"; + power-domains = <&gcc UFS_PHY_GDSC>; }; ...
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 110/181 crypto: ccp - Add new SEV/SNP platform shutdown API
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ashish Kalra <[email protected]>
commit f7b86e0e75bc234751cb7a82d888083a57ef28b2 upstream.
Add new API interface to do SEV/SNP platform shutdown when KVM module is unloaded.
--- drivers/crypto/ccp/sev-dev.c | 9 +++++++++ include/linux/psp-sev.h | 3 +++ 2 files changed, 12 insertions(+)
drivers/crypto/ccp/sev-dev.c +9 -0
@@ -2444,6 +2444,15 @@ static void sev_firmware_shutdown(struct sev_device *sev)mutex_unlock (&sev_cmd_mutex); } +void sev_platform_shutdown (void ) +{ +if (!psp_master || !psp_master->sev_data) +return ; + +sev_firmware_shutdown (psp_master->sev_data); +} +EXPORT_SYMBOL_GPL (sev_platform_shutdown); +void sev_dev_destroy (struct psp_device *psp) {struct sev_device *sev = psp->sev_data;
include/linux/psp-sev.h +3 -0
@@ -947,6 +947,7 @@ int sev_do_cmd(int cmd, void *data, int *psp_ret);void *psp_copy_user_blob (u64 uaddr,u32 len);void *snp_alloc_firmware_page (gfp_t mask);void snp_free_firmware_page (void *addr); +void sev_platform_shutdown (void );#else /* !CONFIG_CRYPTO_DEV_SP_PSP */
@@ -981,6 +982,8 @@ static inline void *snp_alloc_firmware_page(gfp_t mask)static inline void snp_free_firmware_page (void *addr) { } +static inline void sev_platform_shutdown (void ) { } +#endif /* CONFIG_CRYPTO_DEV_SP_PSP */ #endif /* __PSP_SEV_H__ */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 111/181 KVM: SVM: Add support to initialize SEV/SNP functionality in KVM
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ashish Kalra <[email protected]>
commit 6f1d5a3513c2370bbd6115dd430906bc2f4bdc53 upstream.
Move platform initialization of SEV/SNP from CCP driver probe time to KVM module load time so that KVM can do SEV/SNP platform initialization explicitly if it actually wants to use SEV/SNP functionality.
Add support for KVM to explicitly call into the CCP driver at load time to initialize SEV/SNP. If required, this behavior can be altered with KVM module parameters to not do SEV/SNP platform initialization at module load time. Additionally, a corresponding SEV/SNP platform shutdown is invoked during KVM module unload time.
Continue to support SEV deferred initialization as the user may have the file containing SEV persistent data for SEV INIT_EX available only later after module load/init.
--- arch/x86/kvm/svm/sev.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
arch/x86/kvm/svm/sev.c +12 -0
@@ -2972,6 +2972,7 @@ void __init sev_set_cpu_caps(void)void __init sev_hardware_setup (void ) {unsigned int eax, ebx, ecx, edx, sev_asid_count, sev_es_asid_count; +struct sev_platform_init_args init_args = {0 };bool sev_snp_supported = false;bool sev_es_supported = false;bool sev_supported = false;
@@ -3088,6 +3089,15 @@ void __init sev_hardware_setup(void) sev_supported_vmsa_features =0 ;if (sev_es_debug_swap_enabled) sev_supported_vmsa_features |=SVM_SEV_FEAT_DEBUG_SWAP ; + +if (!sev_enabled) +return ; + +/* +* Do both SNP and SEV initialization at KVM module load. +*/ + init_args.probe = true; +sev_platform_init (&init_args); }void sev_hardware_unsetup (void )
@@ -3103,6 +3113,8 @@ void sev_hardware_unsetup(void)misc_cg_set_capacity (MISC_CG_RES_SEV ,0 );misc_cg_set_capacity (MISC_CG_RES_SEV_ES ,0 ); + +sev_platform_shutdown (); }int sev_cpu_init (struct svm_cpu_data *sd)
Signature · 1 line
2.53.0
Re: [PATCH 6.12 111/181] KVM: SVM: Add support to initialize SEV/SNP functionality in KVM
Hi Jack, Greg, Sasha,
Quoted 49 lines · Greg Kroah-Hartman
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ashish Kalra <[email protected]>
commit
6f1d5a3513c2370bbd6115dd430906bc2f4bdc53upstream.Move platform initialization of SEV/SNP from CCP driver probe time to KVM module load time so that KVM can do SEV/SNP platform initialization explicitly if it actually wants to use SEV/SNP functionality.
Add support for KVM to explicitly call into the CCP driver at load time to initialize SEV/SNP. If required, this behavior can be altered with KVM module parameters to not do SEV/SNP platform initialization at module load time. Additionally, a corresponding SEV/SNP platform shutdown is invoked during KVM module unload time.
Continue to support SEV deferred initialization as the user may have the file containing SEV persistent data for SEV
INIT_EXavailable only later after module load/init.Suggested-by Sean Christopherson <[email protected]>Reviewed-by Tom Lendacky <[email protected]>Signed-off-by Ashish Kalra <[email protected]>Signed-off-by Herbert Xu <[email protected]>Signed-off-by Jack Wang <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- arch/x86/kvm/svm/sev.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)arch/x86/kvm/svm/sev.c +2
-0@@ -2972,6 +2972,7 @@ void __init sev_set_cpu_caps(void)void __init sev_hardware_setup (void ) {unsigned int eax, ebx, ecx, edx, sev_asid_count, sev_es_asid_count; +struct sev_platform_init_args init_args = {0 };bool sev_snp_supported = false;bool sev_es_supported = false;bool sev_supported = false;@@ -3088,6 +3089,15 @@ void __init sev_hardware_setup(void) sev_supported_vmsa_features =0 ;if (sev_es_debug_swap_enabled) sev_supported_vmsa_features |=SVM_SEV_FEAT_DEBUG_SWAP ; +
arch/x86/kvm/svm/sev.c void __init sev_hardware_setup(void) · line 3102
Quoted 10 lines
arch/x86/kvm/svm/sev.c +8
-0+if (!sev_enabled) +return ; + +/* +* Do both SNP and SEV initialization at KVM module load. +*/ + init_args.probe = true; +sev_platform_init (&init_args); }
I ran an AI-assisted backport review and checked the finding against 6.12.y. The backport appears to be missing the ordering used upstream when kvm_amd is built-in.
Upstream ensures that the PSP driver is ready before KVM continues:
if (IS_BUILTIN(CONFIG_KVM_AMD) && sev_module_init()) goto out;
It also initializes the SNP RMP table from AMD IOMMU initialization:
if (snp_rmptable_init()) goto disable_snp;
6.12.y has no sev_module_init() call and still initializes the RMP table through a later initcall:
device_initcall(snp_rmptable_init);
The backport can therefore reach:
init_args.probe = true; sev_platform_init(&init_args);
before the PSP device exists. The call returns -ENODEV and its result is
ignored. KVM can then enable SVM before SNP/RMP setup has completed. Since bb1c84647025 removed probe-time platform initialization, this can leave encrypted guests unable to start.
The relevant upstream commits are:
435b344a7042 ("crypto: ccp: Add external API interface for PSP module initialization") 44e70718df4f ("KVM: SVM: Ensure PSP module is initialized if KVM module is built-in") 409f45387c93 ("x86/sev: Fix broken SNP support with KVM module built-in")
https://lore.kernel.org/stable/[email protected]/
Could the KVM maintainers confirm whether 6.12.y needs this full series ? Probably could be done after this cycle, but still noting it here.
thanks,
Harshit
Quoted 10 lines
arch/x86/kvm/svm/sev.c +2
-0void sev_hardware_unsetup (void )@@ -3103,6 +3113,8 @@ void sev_hardware_unsetup(void)misc_cg_set_capacity (MISC_CG_RES_SEV ,0 );misc_cg_set_capacity (MISC_CG_RES_SEV_ES ,0 ); + +sev_platform_shutdown (); }int sev_cpu_init (struct svm_cpu_data *sd)
Re: [PATCH 6.12 111/181] KVM: SVM: Add support to initialize SEV/SNP functionality in KVM
Hi Harshit,
Quoted 86 lines · Harshit Mogalapalli
Hi Jack, Greg, Sasha,
Quoted 49 lines · Greg Kroah-Hartman
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ashish Kalra <[email protected]>
commit
6f1d5a3513c2370bbd6115dd430906bc2f4bdc53upstream.Move platform initialization of SEV/SNP from CCP driver probe time to KVM module load time so that KVM can do SEV/SNP platform initialization explicitly if it actually wants to use SEV/SNP functionality.
Add support for KVM to explicitly call into the CCP driver at load time to initialize SEV/SNP. If required, this behavior can be altered with KVM module parameters to not do SEV/SNP platform initialization at module load time. Additionally, a corresponding SEV/SNP platform shutdown is invoked during KVM module unload time.
Continue to support SEV deferred initialization as the user may have the file containing SEV persistent data for SEV
INIT_EXavailable only later after module load/init.Suggested-by Sean Christopherson <[email protected]>Reviewed-by Tom Lendacky <[email protected]>Signed-off-by Ashish Kalra <[email protected]>Signed-off-by Herbert Xu <[email protected]>Signed-off-by Jack Wang <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- arch/x86/kvm/svm/sev.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)arch/x86/kvm/svm/sev.c +2
-0@@ -2972,6 +2972,7 @@ void __init sev_set_cpu_caps(void)void __init sev_hardware_setup (void ) {unsigned int eax, ebx, ecx, edx, sev_asid_count, sev_es_asid_count; +struct sev_platform_init_args init_args = {0 };bool sev_snp_supported = false;bool sev_es_supported = false;bool sev_supported = false;@@ -3088,6 +3089,15 @@ void __init sev_hardware_setup(void) sev_supported_vmsa_features =0 ;if (sev_es_debug_swap_enabled) sev_supported_vmsa_features |=SVM_SEV_FEAT_DEBUG_SWAP ; +arch/x86/kvm/svm/sev.c void __init sev_hardware_setup(void) · line 3102
Quoted 10 lines
arch/x86/kvm/svm/sev.c +8
-0+if (!sev_enabled) +return ; + +/* +* Do both SNP and SEV initialization at KVM module load. +*/ + init_args.probe = true; +sev_platform_init (&init_args); }I ran an AI-assisted backport review and checked the finding against 6.12.y. The backport appears to be missing the ordering used upstream when
kvm_amdis built-in.Upstream ensures that the PSP driver is ready before KVM continues:
if (IS_BUILTIN(CONFIG_KVM_AMD) && sev_module_init()) goto out;It also initializes the SNP RMP table from AMD IOMMU initialization:
if (snp_rmptable_init()) goto disable_snp;6.12.y has no
sev_module_init()call and still initializes the RMP table through a later initcall:device_initcall(snp_rmptable_init);The backport can therefore reach:
Quoted 8 lines
init_args.probe = true; sev_platform_init(&init_args);before the PSP device exists. The call returns
-ENODEVand its result is ignored. KVM can then enable SVM before SNP/RMP setup has completed. Sincebb1c84647025removed probe-time platform initialization, this can leave encrypted guests unable to start.
That looks like the case, we only use kvm as module, didn't hit the issue.
Quoted 9 lines
The relevant upstream commits are:
435b344a7042("crypto: ccp: Add external API interface for PSP module initialization")44e70718df4f("KVM: SVM: Ensure PSP module is initialized if KVM module is built-in")409f45387c93("x86/sev: Fix broken SNP support with KVM module built-in")
Quoted 5 lines
https://lore.kernel.org/stable/[email protected]/
Could the KVM maintainers confirm whether 6.12.y needs this full series ? Probably could be done after this cycle, but still noting it here.
+1
Quoted 3 lines
thanks,
Harshit
Thanks!
Quoted 11 lines
Quoted 10 lines
arch/x86/kvm/svm/sev.c +2
-0void sev_hardware_unsetup (void )@@ -3103,6 +3113,8 @@ void sev_hardware_unsetup(void)misc_cg_set_capacity (MISC_CG_RES_SEV ,0 );misc_cg_set_capacity (MISC_CG_RES_SEV_ES ,0 ); + +sev_platform_shutdown (); }int sev_cpu_init (struct svm_cpu_data *sd)
Re: [PATCH 6.12 111/181] KVM: SVM: Add support to initialize SEV/SNP functionality in KVM
Quoted 4 lines · Jinpu Wang
Hi Harshit,
On Wed, Aug 19, 2026 at 9:12 AM Harshit Mogalapalli <[email protected]> wrote:
...
Quoted 26 lines
Quoted 26 lines
Quoted 26 lines
arch/x86/kvm/svm/sev.c +10
-0@@ -2972,6 +2972,7 @@ void __init sev_set_cpu_caps(void)void __init sev_hardware_setup (void ) {unsigned int eax, ebx, ecx, edx, sev_asid_count, sev_es_asid_count; +struct sev_platform_init_args init_args = {0 };bool sev_snp_supported = false;bool sev_es_supported = false;bool sev_supported = false;@@ -3088,6 +3089,15 @@ void __init sev_hardware_setup(void) sev_supported_vmsa_features =0 ;if (sev_es_debug_swap_enabled) sev_supported_vmsa_features |=SVM_SEV_FEAT_DEBUG_SWAP ; + +if (!sev_enabled) +return ; + +/* +* Do both SNP and SEV initialization at KVM module load. +*/ + init_args.probe = true; +sev_platform_init (&init_args); }
...
Quoted 14 lines
That looks like the case, we only use kvm as module, didn't hit the issue.
Quoted 13 lines
The relevant upstream commits are:
435b344a7042("crypto: ccp: Add external API interface for PSP module initialization")44e70718df4f("KVM: SVM: Ensure PSP module is initialized if KVM module is built-in")409f45387c93("x86/sev: Fix broken SNP support with KVM module built-in")https://lore.kernel.org/stable/[email protected]/
Could the KVM maintainers confirm whether 6.12.y needs this full series?
Yes, we should also backport the above fixes to 6.12.y.
Quoted 1 line
Quoted 1 line
Probably could be done after this cycle, but still noting it here.
Yes, sadly this patch is needed to make SNP usable for *any* configuration, due to bb1c84647025 ("crypto: ccp - Move SEV/SNP Platform initialization to KVM") already being in 6.12.
Sasha Levin
maintainerRe: [PATCH 6.12 111/181] KVM: SVM: Add support to initialize SEV/SNP functionality in KVM
Quoted 7 lines
Quoted 5 lines
Quoted 5 lines
435b344a7042("crypto: ccp: Add external API interface for PSP module initialization")44e70718df4f("KVM: SVM: Ensure PSP module is initialized if KVM module is built-in")409f45387c93("x86/sev: Fix broken SNP support with KVM module built-in")Yes, we should also backport the above fixes to 6.12.y.
The first two are queued for 6.12.
409f45387c93 ("x86/sev: Fix broken SNP support with KVM module built-in") does not apply there. 6.12 predates the segmented-RMP rework, so snp_rmptable_init() still uses probed_rmp_base/memremap() and the commit needs seven prerequisites, six of them the v6.14-rc1 segmented-RMP/RMPREAD series. That is hardware enablement, not stable material, so I don't want to pull it in as a dependency.
Could someone send a tested 6.12.y-specific backport of 409f45387c93? I'll hold 6.12 until it shows up.
Signature · 2 lines
Thanks, Sasha
cover x86/sev: Make SNP usable with KVM=y
Tested SEV, SEV-ES, and SEV-SNP, with KVM as modules and fully built-in.
Ashish Kalra (1):
x86/sev: Fix broken SNP support with KVM module built-in
Gao Shiyuan (1):
iommu/amd: remove return value of amd_iommu_detect
arch/x86/include/asm/sev.h | 2 ++ arch/x86/virt/svm/sev.c | 21 ++++++--------------- drivers/iommu/amd/init.c | 36 ++++++++++++++++++++++++++++++------ include/linux/amd-iommu.h | 4 ++-- 4 files changed, 40 insertions(+), 23 deletions(-)
base-commit: f717995cb7dcd8998ab15516b8006aea09cfde0d
Signature · 1 line
2.55.0.970.g62bdec98f9-goog
PATCH 1/2 iommu/amd: remove return value of amd_iommu_detect
From: Gao Shiyuan <[email protected]>
[ Upstream commit 5bb494d5cbb9a3403ba8b1c8bc145b42fc119078 ]
The return value of amd_iommu_detect is not used, so remove it and is consistent with other iommu detect functions.
--- drivers/iommu/amd/init.c | 10 ++++------ include/linux/amd-iommu.h | 4 ++-- 2 files changed, 6 insertions(+), 8 deletions(-)
drivers/iommu/amd/init.c +4 -6
@@ -3484,25 +3484,23 @@ static bool amd_iommu_sme_check(void)* IOMMUs * ****************************************************************************/ -int __init amd_iommu_detect (void ) +void __init amd_iommu_detect (void ) {int ret;if (no_iommu || (iommu_detected && !gart_iommu_aperture)) -return -ENODEV ; +return ;if (!amd_iommu_sme_check ()) -return -ENODEV ; +return ; ret =iommu_go_to_state (IOMMU_IVRS_DETECTED );if (ret) -return ret; +return ; amd_iommu_detected = true; iommu_detected =1 ; x86_init.iommu.iommu_init = amd_iommu_init; - -return 1 ; }/****************************************************************************
include/linux/amd-iommu.h +2 -2
@@ -31,11 +31,11 @@ struct amd_iommu_pi_data {struct task_struct ;struct pci_dev ; -extern int amd_iommu_detect (void ); +extern void amd_iommu_detect (void );#else /* CONFIG_AMD_IOMMU */ -static inline int amd_iommu_detect (void ) {return -ENODEV ; } +static inline void amd_iommu_detect (void ) { }#endif /* CONFIG_AMD_IOMMU */
Signature · 1 line
2.55.0.970.g62bdec98f9-goog
PATCH 2/2 x86/sev: Fix broken SNP support with KVM module built-in
In reply to Sean ChristophersonFrom: Ashish Kalra <[email protected]>
[ Upstream commit 409f45387c937145adeeeebc6d6032c2ec232b35 ]
Fix issues with enabling SNP host support and effectively SNP support which is broken with respect to the KVM module being built-in.
SNP host support is enabled in snp_rmptable_init() which is invoked as device_initcall(). SNP check on IOMMU is done during IOMMU PCI init (IOMMU_PCI_INIT stage). And for that reason snp_rmptable_init() is currently invoked via device_initcall() and cannot be invoked via subsys_initcall() as core IOMMU subsystem gets initialized via subsys_initcall().
Now, if kvm_amd module is built-in, it gets initialized before SNP host support is enabled in snp_rmptable_init() :
[ 10.131811] kvm_amd: TSC scaling supported [ 10.136384] kvm_amd: Nested Virtualization enabled [ 10.141734] kvm_amd: Nested Paging enabled [ 10.146304] kvm_amd: LBR virtualization supported [ 10.151557] kvm_amd: SEV enabled (ASIDs 100 - 509) [ 10.156905] kvm_amd: SEV-ES enabled (ASIDs 1 - 99) [ 10.162256] kvm_amd: SEV-SNP enabled (ASIDs 1 - 99) [ 10.171508] kvm_amd: Virtual VMLOAD VMSAVE supported [ 10.177052] kvm_amd: Virtual GIF supported ... ... [ 10.201648] kvm_amd: in svm_enable_virtualization_cpu
And then svm_x86_ops->enable_virtualization_cpu() (svm_enable_virtualization_cpu) programs MSR_VM_HSAVE_PA as following:wrmsrl(MSR_VM_HSAVE_PA, sd->save_area_pa);
So VM_HSAVE_PA is non-zero before SNP support is enabled on all CPUs.
snp_rmptable_init() gets invoked after svm_enable_virtualization_cpu() as following :
...
[ 11.256138] kvm_amd: in svm_enable_virtualization_cpu ... [ 11.264918] SEV-SNP: in snp_rmptable_init
This triggers a #GP exception in snp_rmptable_init() when snp_enable() is invoked to set SNP_EN in SYSCFG MSR:
[ 11.294289] unchecked MSR access error: WRMSR to 0xc0010010 (tried to write 0x0000000003fc0000) at rIP: 0xffffffffaf5d5c28 (native_write_msr+0x8/0x30) ... [ 11.294404] Call Trace: [ 11.294482] <IRQ> [ 11.294513] ? show_stack_regs+0x26/0x30 [ 11.294522] ? ex_handler_msr+0x10f/0x180 [ 11.294529] ? search_extable+0x2b/0x40 [ 11.294538] ? fixup_exception+0x2dd/0x340 [ 11.294542] ? exc_general_protection+0x14f/0x440 [ 11.294550] ? asm_exc_general_protection+0x2b/0x30 [ 11.294557] ? __pfx_snp_enable+0x10/0x10 [ 11.294567] ? native_write_msr+0x8/0x30 [ 11.294570] ? __snp_enable+0x5d/0x70 [ 11.294575] snp_enable+0x19/0x20 [ 11.294578] __flush_smp_call_function_queue+0x9c/0x3a0 [ 11.294586] generic_smp_call_function_single_interrupt+0x17/0x20 [ 11.294589] __sysvec_call_function+0x20/0x90 [ 11.294596] sysvec_call_function+0x80/0xb0 [ 11.294601] </IRQ> [ 11.294603] <TASK> [ 11.294605] asm_sysvec_call_function+0x1f/0x30 ... [ 11.294631] arch_cpu_idle+0xd/0x20 [ 11.294633] default_idle_call+0x34/0xd0 [ 11.294636] do_idle+0x1f1/0x230 [ 11.294643] ? complete+0x71/0x80 [ 11.294649] cpu_startup_entry+0x30/0x40 [ 11.294652] start_secondary+0x12d/0x160 [ 11.294655] common_startup_64+0x13e/0x141 [ 11.294662] </TASK>
This #GP exception is getting triggered due to the following errata for AMD family 19h Models 10h-1Fh Processors:
Processor may generate spurious #GP(0) Exception on WRMSR instruction:
Description:
The Processor will generate a spurious #GP(0) Exception on a WRMSR instruction if the following conditions are all met:
- the target of the WRMSR is a SYSCFG register.
- the write changes the value of SYSCFG.SNPEn from 0 to 1.
- One of the threads that share the physical core has a non-zero value in the VM_HSAVE_PA MSR.
The document being referred to above:
https://www.amd.com/content/dam/amd/en/documents/processor-tech-docs/revision-guides/57095-PUB_1_01.pdf
To summarize, with kvm_amd module being built-in, KVM/SVM initialization happens before host SNP is enabled and this SVM initialization sets VM_HSAVE_PA to non-zero, which then triggers a #GP when SYSCFG.SNPEn is being set and this will subsequently cause SNP_INIT(_EX) to fail with INVALID_CONFIG error as SYSCFG[SnpEn] is not set on all CPUs.
Essentially SNP host enabling code should be invoked before KVM initialization, which is currently not the case when KVM is built-in.
Add fix to call snp_rmptable_init() early from iommu_snp_enable() directly and not invoked via device_initcall() which enables SNP host support before KVM initialization with kvm_amd module built-in.
Add additional handling for iommu=off or amd_iommu=off options.
Note that IOMMUs need to be enabled for SNP initialization, therefore, if host SNP support is enabled but late IOMMU initialization fails then that will cause PSP driver's SNP_INIT to fail as IOMMU SNP sanity checks in SNP firmware will fail with invalid configuration error as below:
[ 9.723114] ccp 0000:23:00.1: sev enabled [ 9.727602] ccp 0000:23:00.1: psp enabled [ 9.732527] ccp 0000:a2:00.1: enabling device (0000 -> 0002) [ 9.739098] ccp 0000:a2:00.1: no command queues available [ 9.745167] ccp 0000:a2:00.1: psp enabled [ 9.805337] ccp 0000:23:00.1: SEV-SNP: failed to INIT rc -5, error 0x3 [ 9.866426] ccp 0000:23:00.1: SEV API:1.53 build:5
Message-ID: <138b520fb83964782303b43ade4369cd181fdd9c.1739226950.git.ashish.kalra@amd.com>
--- arch/x86/include/asm/sev.h | 2 ++ arch/x86/virt/svm/sev.c | 21 ++++++--------------- drivers/iommu/amd/init.c | 34 ++++++++++++++++++++++++++++++---- 3 files changed, 38 insertions(+), 19 deletions(-)
arch/x86/include/asm/sev.h +2 -0
@@ -440,6 +440,7 @@ static inline void snp_update_svsm_ca(void) { }#ifdef CONFIG_KVM_AMD_SEV bool snp_probe_rmptable_info (void ); +int snp_rmptable_init (void );int snp_lookup_rmpentry (u64 pfn,bool *assigned,int *level);void snp_dump_hva_rmpentry (unsigned long address);int psmash (u64 pfn);
@@ -450,6 +451,7 @@ void kdump_sev_callback(void);void snp_fixup_e820_tables (void );#else static inline bool snp_probe_rmptable_info (void ) {return false; } +static inline int snp_rmptable_init (void ) {return -ENOSYS ; }static inline int snp_lookup_rmpentry (u64 pfn,bool *assigned,int *level) {return -ENODEV ; }static inline void snp_dump_hva_rmpentry (unsigned long address) {}static inline int psmash (u64 pfn) {return -ENODEV ; }
arch/x86/virt/svm/sev.c +6 -15
@@ -189,7 +189,7 @@ void __init snp_fixup_e820_tables(void)* described in the SNP_INIT_EX firmware command description in the SNP * firmware ABI spec. */ -static int __init snp_rmptable_init (void ) +int __init snp_rmptable_init (void ) {u64 max_rmp_pfn, calc_rmp_sz, rmptable_size, rmp_end, val;void *rmptable_start;
@@ -197,11 +197,11 @@ static int __init snp_rmptable_init(void)if (!cc_platform_has (CC_ATTR_HOST_SEV_SNP ))return 0 ; -if (!amd_iommu_snp_en) - goto nosnp; +if (WARN_ON_ONCE (!amd_iommu_snp_en)) +return -ENOSYS ;if (!probed_rmp_size) - goto nosnp; +return -ENOSYS ; rmp_end = probed_rmp_base + probed_rmp_size -1 ;
@@ -218,13 +218,13 @@ static int __init snp_rmptable_init(void)if (calc_rmp_sz > probed_rmp_size) {pr_err ("Memory reserved for the RMP table does not cover full system RAM (expected 0x%llx got 0x%llx)\n" , calc_rmp_sz, probed_rmp_size); - goto nosnp; +return -ENOSYS ; } rmptable_start =memremap (probed_rmp_base, probed_rmp_size,MEMREMAP_WB );if (!rmptable_start) {pr_err ("Failed to map RMP table\n" ); - goto nosnp; +return -ENOSYS ; }/*
@@ -261,17 +261,8 @@ static int __init snp_rmptable_init(void) crash_kexec_post_notifiers = true;return 0 ; - -nosnp: -cc_platform_clear (CC_ATTR_HOST_SEV_SNP ); -return -ENOSYS ; } -/* -* This must be called after the IOMMU has been initialized. -*/ -device_initcall (snp_rmptable_init); -static struct rmpentry *get_rmpentry (u64 pfn) {if (WARN_ON_ONCE (pfn > rmptable_max_pfn))
drivers/iommu/amd/init.c +30 -4
@@ -3219,7 +3219,7 @@ static bool __init detect_ivrs(void)return true; } -static void iommu_snp_enable (void ) +static __init void iommu_snp_enable (void ) {#ifdef CONFIG_KVM_AMD_SEV if (!cc_platform_has (CC_ATTR_HOST_SEV_SNP ))
@@ -3244,6 +3244,14 @@ static void iommu_snp_enable(void) goto disable_snp; } +/* +* Enable host SNP support once SNP support is checked on IOMMU. +*/ +if (snp_rmptable_init ()) { +pr_warn ("SNP: RMP initialization failed, SNP cannot be supported.\n" ); + goto disable_snp; + } +pr_info ("IOMMU SNP support enabled.\n" );return ;
@@ -3381,6 +3389,19 @@ static int __init iommu_go_to_state(enum iommu_init_state state) ret =state_next (); } +/* +* SNP platform initilazation requires IOMMUs to be fully configured. +* If the SNP support on IOMMUs has NOT been checked, simply mark SNP +* as unsupported. If the SNP support on IOMMUs has been checked and +* host SNP support enabled but RMP enforcement has not been enabled +* in IOMMUs, then the system is in a half-baked state, but can limp +* along as all memory should be Hypervisor-Owned in the RMP. WARN, +* but leave SNP as "supported" to avoid confusing the kernel. +*/ +if (ret &&cc_platform_has (CC_ATTR_HOST_SEV_SNP ) && + !WARN_ON_ONCE (amd_iommu_snp_en)) +cc_platform_clear (CC_ATTR_HOST_SEV_SNP ); +return ret; }
@@ -3489,18 +3510,23 @@ void __init amd_iommu_detect(void)int ret;if (no_iommu || (iommu_detected && !gart_iommu_aperture)) -return ; + goto disable_snp;if (!amd_iommu_sme_check ()) -return ; + goto disable_snp; ret =iommu_go_to_state (IOMMU_IVRS_DETECTED );if (ret) -return ; + goto disable_snp; amd_iommu_detected = true; iommu_detected =1 ; x86_init.iommu.iommu_init = amd_iommu_init; +return ; + +disable_snp: +if (cc_platform_has (CC_ATTR_HOST_SEV_SNP )) +cc_platform_clear (CC_ATTR_HOST_SEV_SNP ); }/****************************************************************************
Signature · 1 line
2.55.0.970.g62bdec98f9-goog
Re: [PATCH 6.12.y 0/2] x86/sev: Make SNP usable with KVM=y
In reply to Sean ChristophersonQuoted 1 line
Tested SEV, SEV-ES, and SEV-SNP, with KVM as modules and fully built-in.
Queued the series for 6.12, thanks.
Signature · 2 lines
Thanks, Sasha
Sasha Levin
maintainerRe: [PATCH 6.12 111/181] KVM: SVM: Add support to initialize SEV/SNP functionality in KVM
In reply to Harshit MogalapalliQuoted 7 lines · Harshit Mogalapalli
The relevant upstream commits are:
435b344a7042("crypto: ccp: Add external API interface for PSP module initialization")44e70718df4f("KVM: SVM: Ensure PSP module is initialized if KVM module is built-in")409f45387c93("x86/sev: Fix broken SNP support with KVM module built-in")
The finding is correct, thanks for digging into it. Queued the first two for 6.12 - they go in as a unit, since the second is the only caller of the helper the first adds, and the tree would not link with just one.
The third is a separable pre-existing fix rather than a prerequisite: the RMP-init ordering has been wrong on 6.12 for CONFIG_KVM_AMD=y since the SNP host support landed, independent of either backport, and it conflicts on this tree. Backports are welcome :)
Signature · 2 lines
Thanks, Sasha
Greg Kroah-Hartman
maintainerPATCH 112/181 crypto: ccp - Fix checks for SNP_VLEK_LOAD input buffer length
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Roth <[email protected]>
commit ed53a5050f42a3243a7ed8dfa49030e54034b952 upstream.
The SNP_VLEK_LOAD IOCTL currently fails due to sev_cmd_buffer_len() returning the default expected buffer length of 0 instead of the correct value, which would be sizeof(struct sev_user_data_snp_vlek_load). Add specific handling for SNP_VLEK_LOAD so the correct expected size is returned.
[Jack: sev_cmd_buffer_len() in queue/6.12 does not yet have the
SEV_CMD_SNP_FEATURE_INFO case the upstream context line matched against (it lands in a later, unrelated commit not queued here), so the new SEV_CMD_SNP_VLEK_LOAD case was placed directly after SEV_CMD_SNP_COMMIT instead. No functional difference from upstream.]
--- drivers/crypto/ccp/sev-dev.c | 1 + 1 file changed, 1 insertion(+)
drivers/crypto/ccp/sev-dev.c +1 -0
@@ -226,6 +226,7 @@ static int sev_cmd_buffer_len(int cmd)case SEV_CMD_SNP_GUEST_REQUEST :return sizeof (struct sev_data_snp_guest_request );case SEV_CMD_SNP_CONFIG :return sizeof (struct sev_user_data_snp_config );case SEV_CMD_SNP_COMMIT :return sizeof (struct sev_data_snp_commit ); +case SEV_CMD_SNP_VLEK_LOAD :return sizeof (struct sev_user_data_snp_vlek_load );default :return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 113/181 crypto: ccp - Abort doing SEV INIT if SNP INIT fails
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ashish Kalra <[email protected]>
commit 6131e119f5799bec55535530fa2fc44f5c7be1f1 upstream.
If SNP host support (SYSCFG.SNPEn) is set, then the RMP table must be initialized before calling SEV INIT.
In other words, if SNP_INIT(_EX) is not issued or fails then SEV INIT will fail if SNP host support (SYSCFG.SNPEn) is enabled.
--- drivers/crypto/ccp/sev-dev.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
drivers/crypto/ccp/sev-dev.c +2 -5
@@ -1118,7 +1118,7 @@ static int __sev_snp_init_locked(int *error)if (!sev_version_greater_or_equal (SNP_MIN_API_MAJOR ,SNP_MIN_API_MINOR )) {dev_dbg (sev->dev,"SEV-SNP support requires firmware version >= %d:%d\n" ,SNP_MIN_API_MAJOR ,SNP_MIN_API_MINOR ); -return 0 ; +return -EOPNOTSUPP ; }/* SNP_INIT requires MSR_VM_HSAVE_PA to be cleared on all CPUs. */
@@ -1357,12 +1357,9 @@ static int _sev_platform_init_locked(struct sev_platform_init_args *args) rc =__sev_snp_init_locked (&args->error);if (rc && rc != -ENODEV ) { -/* -* Don't abort the probe if SNP INIT failed, -* continue to initialize the legacy SEV firmware. -*/ dev_err (sev->dev,"SEV-SNP: failed to INIT rc %d, error %#x\n" , rc, args->error); +return rc; }/* Defer legacy SEV/SEV-ES support if allowed by caller/module. */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 114/181 futex: Prevent robust futex exit race some more
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keno Fischer <[email protected]>
commit 6d4514ca9cdf61fec4ec634cf50386f6f7e69748 upstream.
A robust futex unlock stores 0 over the whole futex value - wiping FUTEX_WAITERS - and wakes a single waiter. That wakeup is a one-shot
notification: the protocol relies on its recipient to either acquire the futex (and eventually unlock while aware of the remaining contention) or re-arm FUTEX_WAITERS before sleeping again. If the woken waiter is killed before it can do either, the kernel must jump in and wake the next task down the line.
This is a known complication of the futex protocol with a previous partial fix in commit ca16d5bee598 ("futex: Prevent robust futex exit race"). Unfortunately, that fix is insufficient.
If a third task re-acquired the futex through the uncontended fast path in the meantime, the notification is lost: robust exit processing sees that it is owned by another task and does nothing, while the new owner sees no FUTEX_WAITERS when it unlocks and wakes nobody. The remaining waiters sleep forever behind a free futex:
A owns the futex, B and C sleep in FUTEX_WAIT
uval == A | FUTEX_WAITERS
A robust unlock: store 0, FUTEX_WAKE(1) wakes B
uval == 0
D fast path acquire: cmpxchg(0 -> D)
uval == D, no FUTEX_WAITERS B killed before acting on the wakeup
B exit walk, pending op: owner D != B -> no action D unlock: no FUTEX_WAITERS -> no wake
C sleeps forever
This is clearly a shortcoming in the implementation, which fails to keep the FUTEX_WAITERS bit consistent.
Work around this by augmenting the robust list exit processing to also perform the extra wakeup if the futex word is owned by another thread but FUTEX_WAITERS is not set.
This does not fix the problem of a non-contended take over/release and free sequence, which has been discussed for years and has been addressed by commit 3ca9595d9fb6 ("futex: Add support for unlocking robust futexes") and subsequent changes, but failed to take the problem described above into account.
A more complete solution which is based on the in kernel unlock of contended robust futexes has been discussed in the context of this change and should show up in mainline sooner than later.
[ tglx: Amend change log slightly and fixup coding style ]
--- kernel/futex/core.c | 85 +++++++++++++++++++++++++++++++-------------- 1 file changed, 58 insertions(+), 27 deletions(-)
kernel/futex/core.c +58 -27
@@ -674,8 +674,11 @@ static int handle_futex_death(u32 __user *uaddr, struct task_struct *curr,return -1 ;/* -* Special case for regular (non PI) futexes. The unlock path in -* user space has two race scenarios: +* Special case for regular (non PI) futexes. Ordinarily, we do +* not perform any processing here unless the current thread was +* the owner of the futex (by the TID check below). +* +* However, the unlock path has three race scenarios: * * 1. The unlock path releases the user space futex value and * before it can execute the futex() syscall to wake up
@@ -684,42 +687,70 @@ static int handle_futex_death(u32 __user *uaddr, struct task_struct *curr,* 2. A woken up waiter is killed before it can acquire the * futex in user space. * -* In the second case, the wake up notification could be generated -* by the unlock path in user space after setting the futex value -* to zero or by the kernel after setting the OWNER_DIED bit below. +* 3. A woken up waiter is killed in user space after another +* thread has acquired the futex, but before it can set +* FUTEX_WAITERS. +* +* Note that, if userspace uses the FUTEX_ROBUST_UNLOCK flag, we +* will not see case 1 here. +* +* In the second and third case, the wake up notification could +* be generated from any of: +* +* i. An ordinary futex wakeup after unlock (with or +* without FUTEX_ROBUST_UNLOCK) +* ii. A robust wakeup from another thread's death +* iii. A previous round through this special case +* +* As a result, the futex world will be in one of four states: +* +* A. The futex word is 0 (unlocked) +* B. The futex word is owned by another thread +* (FUTEX_WAITERS is not set) +* C. The futex word is owned by another thread +* (FUTEX_WAITERS set) +* D. The futex's owner died and OWNER_DIED is set +* (the owner part of the word is 0) * -* In both cases the TID validation below prevents a wakeup of -* potential waiters which can cause these waiters to block -* forever. +* The key issue is that the kernel usually (at least from +* sources ii. and iii. or when so requested by userspace from +* source i.) only ever wakes *one* waiter at a time. If this +* waiter dies before acquiring the futex (or setting the +* FUTEX_WAITERS bit), the kernel *must* still wake the next +* waiter down the line to uphold the futex invariants and +* avoid lost wakeups. Note we do not need to handle state C, +* as it does not matter to us whether *we* successfully set +* the bit or a third thread did so in the meantime. * -* In both cases the following conditions are met: +* Therefore, in these cases we must issue an additional +* futex_wake(). Note however that we *must not* set OWNER_DIED +* here. Our thread is *not* the owner of the futex. * -* 1) task->robust_list->list_op_pending != NULL -* @pending_op == true -* 2) The owner part of user space futex value == 0 +* Thus to summarize, the conditions for needing the additional +* futex_wake() are: +* +* 1) @pending_op == true (the thread has not finished the +* mutex operation) +* 2) The futex word is in one of the states A, B or D * 3) Regular futex: @pi == false * -* If these conditions are met, it is safe to attempt waking up a -* potential waiter without touching the user space futex value and -* trying to set the OWNER_DIED bit. If the futex value is zero, -* the rest of the user space mutex state is consistent, so a woken -* waiter will just take over the uncontended futex. Setting the -* OWNER_DIED bit would create inconsistent state and malfunction -* of the user space owner died handling. Otherwise, the OWNER_DIED -* bit is already set, and the woken waiter is expected to deal with -* this. +* Note in particular that in all of the states A-D the owner +* portion of the futex word differs from our thread's TID +* (unless the actual owner has the same TID in another PID +* namespace, but we cannot currently distinguish that +* scenario), so this can be a special-case wakeup in the bail +* path of the ordinary TID check. */ owner = uval &FUTEX_TID_MASK ; -if (pending_op && !pi && !owner) { -futex_wake (uaddr,FLAGS_SIZE_32 |FLAGS_SHARED ,1 , -FUTEX_BITSET_MATCH_ANY ); +if (owner !=task_pid_vnr (curr)) { +if (pending_op && !pi && (!owner || !(uval &FUTEX_WAITERS ))) { +futex_wake (uaddr,FLAGS_SIZE_32 |FLAGS_SHARED ,1 , +FUTEX_BITSET_MATCH_ANY ); + }return 0 ; } -if (owner !=task_pid_vnr (curr)) -return 0 ; -/* * Ok, this dying thread is truly holding a futex * of interest. Set the OWNER_DIED bit atomically
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 115/181 kunit/fortify: Replace "volatile" with OPTIMIZER_HIDE_VAR()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
commit 6ee149f61bcce39692f0335a01e99355d4cec8da upstream.
It does seem that using "volatile" isn't going to be sane compared to using OPTIMIZER_HIDE_VAR() going forward. Some strange interactions[1] with the sanitizers have been observed in the self-test code, so replace the logic.
--- lib/fortify_kunit.c | 139 ++++++++++++++++++++++++-------------------- 1 file changed, 77 insertions(+), 62 deletions(-)
lib/fortify_kunit.c +77 -62
@@ -394,8 +394,6 @@ struct fortify_padding {char buf[32 ];unsigned long bytes_after; }; -/* Force compiler into not being able to resolve size at compile-time. */ -static volatile int unconst;static void fortify_test_strlen (struct kunit *test) {
@@ -520,57 +518,56 @@ static void fortify_test_strncpy(struct kunit *test) {struct fortify_padding pad = { };char src[] ="Copy me fully into a small buffer and I will overflow!" ; +size_t sizeof_buf =sizeof (pad.buf); + +OPTIMIZER_HIDE_VAR (sizeof_buf);/* Destination is %NUL-filled to start with. */ KUNIT_EXPECT_EQ (test, pad.bytes_before,0 ); -KUNIT_EXPECT_EQ (test, pad.buf[sizeof (pad.buf) -1 ],'\0' ); -KUNIT_EXPECT_EQ (test, pad.buf[sizeof (pad.buf) -2 ],'\0' ); -KUNIT_EXPECT_EQ (test, pad.buf[sizeof (pad.buf) -3 ],'\0' ); +KUNIT_EXPECT_EQ (test, pad.buf[sizeof_buf -1 ],'\0' ); +KUNIT_EXPECT_EQ (test, pad.buf[sizeof_buf -2 ],'\0' ); +KUNIT_EXPECT_EQ (test, pad.buf[sizeof_buf -3 ],'\0' );KUNIT_EXPECT_EQ (test, pad.bytes_after,0 );/* Legitimate strncpy() 1 less than of max size. */ -KUNIT_ASSERT_TRUE (test,strncpy (pad.buf, src, -sizeof (pad.buf) + unconst -1 ) +KUNIT_ASSERT_TRUE (test,strncpy (pad.buf, src, sizeof_buf -1 ) == pad.buf);KUNIT_EXPECT_EQ (test, fortify_write_overflows,0 );/* Only last byte should be %NUL */ -KUNIT_EXPECT_EQ (test, pad.buf[sizeof (pad.buf) -1 ],'\0' ); -KUNIT_EXPECT_NE (test, pad.buf[sizeof (pad.buf) -2 ],'\0' ); -KUNIT_EXPECT_NE (test, pad.buf[sizeof (pad.buf) -3 ],'\0' ); +KUNIT_EXPECT_EQ (test, pad.buf[sizeof_buf -1 ],'\0' ); +KUNIT_EXPECT_NE (test, pad.buf[sizeof_buf -2 ],'\0' ); +KUNIT_EXPECT_NE (test, pad.buf[sizeof_buf -3 ],'\0' );/* Legitimate (though unterminated) max-size strncpy. */ -KUNIT_ASSERT_TRUE (test,strncpy (pad.buf, src, -sizeof (pad.buf) + unconst) +KUNIT_ASSERT_TRUE (test,strncpy (pad.buf, src, sizeof_buf) == pad.buf);KUNIT_EXPECT_EQ (test, fortify_write_overflows,0 );/* No trailing %NUL -- thanks strncpy API. */ -KUNIT_EXPECT_NE (test, pad.buf[sizeof (pad.buf) -1 ],'\0' ); -KUNIT_EXPECT_NE (test, pad.buf[sizeof (pad.buf) -2 ],'\0' ); -KUNIT_EXPECT_NE (test, pad.buf[sizeof (pad.buf) -2 ],'\0' ); +KUNIT_EXPECT_NE (test, pad.buf[sizeof_buf -1 ],'\0' ); +KUNIT_EXPECT_NE (test, pad.buf[sizeof_buf -2 ],'\0' ); +KUNIT_EXPECT_NE (test, pad.buf[sizeof_buf -2 ],'\0' );/* But we will not have gone beyond. */ KUNIT_EXPECT_EQ (test, pad.bytes_after,0 );/* Now verify that FORTIFY is working... */ -KUNIT_ASSERT_TRUE (test,strncpy (pad.buf, src, -sizeof (pad.buf) + unconst +1 ) +KUNIT_ASSERT_TRUE (test,strncpy (pad.buf, src, sizeof_buf +1 ) == pad.buf);/* Should catch the overflow. */ KUNIT_EXPECT_EQ (test, fortify_write_overflows,1 ); -KUNIT_EXPECT_NE (test, pad.buf[sizeof (pad.buf) -1 ],'\0' ); -KUNIT_EXPECT_NE (test, pad.buf[sizeof (pad.buf) -2 ],'\0' ); -KUNIT_EXPECT_NE (test, pad.buf[sizeof (pad.buf) -2 ],'\0' ); +KUNIT_EXPECT_NE (test, pad.buf[sizeof_buf -1 ],'\0' ); +KUNIT_EXPECT_NE (test, pad.buf[sizeof_buf -2 ],'\0' ); +KUNIT_EXPECT_NE (test, pad.buf[sizeof_buf -2 ],'\0' );/* And we will not have gone beyond. */ KUNIT_EXPECT_EQ (test, pad.bytes_after,0 );/* And further... */ -KUNIT_ASSERT_TRUE (test,strncpy (pad.buf, src, -sizeof (pad.buf) + unconst +2 ) +KUNIT_ASSERT_TRUE (test,strncpy (pad.buf, src, sizeof_buf +2 ) == pad.buf);/* Should catch the overflow. */ KUNIT_EXPECT_EQ (test, fortify_write_overflows,2 ); -KUNIT_EXPECT_NE (test, pad.buf[sizeof (pad.buf) -1 ],'\0' ); -KUNIT_EXPECT_NE (test, pad.buf[sizeof (pad.buf) -2 ],'\0' ); -KUNIT_EXPECT_NE (test, pad.buf[sizeof (pad.buf) -2 ],'\0' ); +KUNIT_EXPECT_NE (test, pad.buf[sizeof_buf -1 ],'\0' ); +KUNIT_EXPECT_NE (test, pad.buf[sizeof_buf -2 ],'\0' ); +KUNIT_EXPECT_NE (test, pad.buf[sizeof_buf -2 ],'\0' );/* And we will not have gone beyond. */ KUNIT_EXPECT_EQ (test, pad.bytes_after,0 ); }
@@ -579,55 +576,56 @@ static void fortify_test_strscpy(struct kunit *test) {struct fortify_padding pad = { };char src[] ="Copy me fully into a small buffer and I will overflow!" ; +size_t sizeof_buf =sizeof (pad.buf); +size_t sizeof_src =sizeof (src); + +OPTIMIZER_HIDE_VAR (sizeof_buf); +OPTIMIZER_HIDE_VAR (sizeof_src);/* Destination is %NUL-filled to start with. */ KUNIT_EXPECT_EQ (test, pad.bytes_before,0 ); -KUNIT_EXPECT_EQ (test, pad.buf[sizeof (pad.buf) -1 ],'\0' ); -KUNIT_EXPECT_EQ (test, pad.buf[sizeof (pad.buf) -2 ],'\0' ); -KUNIT_EXPECT_EQ (test, pad.buf[sizeof (pad.buf) -3 ],'\0' ); +KUNIT_EXPECT_EQ (test, pad.buf[sizeof_buf -1 ],'\0' ); +KUNIT_EXPECT_EQ (test, pad.buf[sizeof_buf -2 ],'\0' ); +KUNIT_EXPECT_EQ (test, pad.buf[sizeof_buf -3 ],'\0' );KUNIT_EXPECT_EQ (test, pad.bytes_after,0 );/* Legitimate strscpy() 1 less than of max size. */ -KUNIT_ASSERT_EQ (test,strscpy (pad.buf, src, -sizeof (pad.buf) + unconst -1 ), +KUNIT_ASSERT_EQ (test,strscpy (pad.buf, src, sizeof_buf -1 ), -E2BIG );KUNIT_EXPECT_EQ (test, fortify_write_overflows,0 );/* Keeping space for %NUL, last two bytes should be %NUL */ -KUNIT_EXPECT_EQ (test, pad.buf[sizeof (pad.buf) -1 ],'\0' ); -KUNIT_EXPECT_EQ (test, pad.buf[sizeof (pad.buf) -2 ],'\0' ); -KUNIT_EXPECT_NE (test, pad.buf[sizeof (pad.buf) -3 ],'\0' ); +KUNIT_EXPECT_EQ (test, pad.buf[sizeof_buf -1 ],'\0' ); +KUNIT_EXPECT_EQ (test, pad.buf[sizeof_buf -2 ],'\0' ); +KUNIT_EXPECT_NE (test, pad.buf[sizeof_buf -3 ],'\0' );/* Legitimate max-size strscpy. */ -KUNIT_ASSERT_EQ (test,strscpy (pad.buf, src, -sizeof (pad.buf) + unconst), +KUNIT_ASSERT_EQ (test,strscpy (pad.buf, src, sizeof_buf), -E2BIG );KUNIT_EXPECT_EQ (test, fortify_write_overflows,0 );/* A trailing %NUL will exist. */ -KUNIT_EXPECT_EQ (test, pad.buf[sizeof (pad.buf) -1 ],'\0' ); -KUNIT_EXPECT_NE (test, pad.buf[sizeof (pad.buf) -2 ],'\0' ); -KUNIT_EXPECT_NE (test, pad.buf[sizeof (pad.buf) -2 ],'\0' ); +KUNIT_EXPECT_EQ (test, pad.buf[sizeof_buf -1 ],'\0' ); +KUNIT_EXPECT_NE (test, pad.buf[sizeof_buf -2 ],'\0' ); +KUNIT_EXPECT_NE (test, pad.buf[sizeof_buf -2 ],'\0' );/* Now verify that FORTIFY is working... */ -KUNIT_ASSERT_EQ (test,strscpy (pad.buf, src, -sizeof (pad.buf) + unconst +1 ), +KUNIT_ASSERT_EQ (test,strscpy (pad.buf, src, sizeof_buf +1 ), -E2BIG );/* Should catch the overflow. */ KUNIT_EXPECT_EQ (test, fortify_write_overflows,1 ); -KUNIT_EXPECT_EQ (test, pad.buf[sizeof (pad.buf) -1 ],'\0' ); -KUNIT_EXPECT_NE (test, pad.buf[sizeof (pad.buf) -2 ],'\0' ); -KUNIT_EXPECT_NE (test, pad.buf[sizeof (pad.buf) -2 ],'\0' ); +KUNIT_EXPECT_EQ (test, pad.buf[sizeof_buf -1 ],'\0' ); +KUNIT_EXPECT_NE (test, pad.buf[sizeof_buf -2 ],'\0' ); +KUNIT_EXPECT_NE (test, pad.buf[sizeof_buf -2 ],'\0' );/* And we will not have gone beyond. */ KUNIT_EXPECT_EQ (test, pad.bytes_after,0 );/* And much further... */ -KUNIT_ASSERT_EQ (test,strscpy (pad.buf, src, -sizeof (src) *2 + unconst), +KUNIT_ASSERT_EQ (test,strscpy (pad.buf, src, sizeof_src *2 ), -E2BIG );/* Should catch the overflow. */ KUNIT_EXPECT_EQ (test, fortify_write_overflows,2 ); -KUNIT_EXPECT_EQ (test, pad.buf[sizeof (pad.buf) -1 ],'\0' ); -KUNIT_EXPECT_NE (test, pad.buf[sizeof (pad.buf) -2 ],'\0' ); -KUNIT_EXPECT_NE (test, pad.buf[sizeof (pad.buf) -2 ],'\0' ); +KUNIT_EXPECT_EQ (test, pad.buf[sizeof_buf -1 ],'\0' ); +KUNIT_EXPECT_NE (test, pad.buf[sizeof_buf -2 ],'\0' ); +KUNIT_EXPECT_NE (test, pad.buf[sizeof_buf -2 ],'\0' );/* And we will not have gone beyond. */ KUNIT_EXPECT_EQ (test, pad.bytes_after,0 ); }
@@ -767,7 +765,9 @@ static void fortify_test_strlcat(struct kunit *test)struct fortify_padding pad = { };char src[sizeof (pad.buf)] = { };int i, partial; -int len =sizeof (pad.buf) + unconst; +int len =sizeof (pad.buf); + +OPTIMIZER_HIDE_VAR (len);/* Fill 15 bytes with valid characters. */ partial =sizeof (src) /2 -1 ;
@@ -857,28 +857,32 @@ struct fortify_zero_sized {#define __fortify_test (memfunc) \ static void fortify_test_##memfunc(struct kunit *test) \ { \ - struct fortify_zero_sized zero = { }; \ + struct fortify_zero_sized empty = { }; \ struct fortify_padding pad = { }; \ char srcA[sizeof(pad.buf) + 2]; \ char srcB[sizeof(pad.buf) + 2]; \ - size_t len = sizeof(pad.buf) + unconst; \ + size_t len = sizeof(pad.buf); \ + size_t zero = 0; \ + \ + OPTIMIZER_HIDE_VAR(len); \ + OPTIMIZER_HIDE_VAR(zero); \ \ memset(srcA, 'A', sizeof(srcA)); \ KUNIT_ASSERT_EQ(test, srcA[0], 'A'); \ memset(srcB, 'B', sizeof(srcB)); \ KUNIT_ASSERT_EQ(test, srcB[0], 'B'); \ \ - memfunc(pad.buf, srcA, 0 + unconst); \ + memfunc(pad.buf, srcA, zero); \ KUNIT_EXPECT_EQ(test, pad.buf[0], '\0'); \ KUNIT_EXPECT_EQ(test, fortify_read_overflows, 0); \ KUNIT_EXPECT_EQ(test, fortify_write_overflows, 0); \ - memfunc(pad.buf + 1, srcB, 1 + unconst); \ + memfunc(pad.buf + 1, srcB, zero + 1); \ KUNIT_EXPECT_EQ(test, pad.buf[0], '\0'); \ KUNIT_EXPECT_EQ(test, pad.buf[1], 'B'); \ KUNIT_EXPECT_EQ(test, pad.buf[2], '\0'); \ KUNIT_EXPECT_EQ(test, fortify_read_overflows, 0); \ KUNIT_EXPECT_EQ(test, fortify_write_overflows, 0); \ - memfunc(pad.buf, srcA, 1 + unconst); \ + memfunc(pad.buf, srcA, zero + 1); \ KUNIT_EXPECT_EQ(test, pad.buf[0], 'A'); \ KUNIT_EXPECT_EQ(test, pad.buf[1], 'B'); \ KUNIT_EXPECT_EQ(test, fortify_read_overflows, 0); \
@@ -904,10 +908,10 @@ static void fortify_test_##memfunc(struct kunit *test) \/* Reset error counter. */ \ fortify_write_overflows =0 ; \/* Copy nothing into nothing: no errors. */ \ -memfunc (zero.buf, srcB,0 + unconst); \ +memfunc (empty.buf, srcB, zero); \KUNIT_EXPECT_EQ (test, fortify_read_overflows,0 ); \KUNIT_EXPECT_EQ (test, fortify_write_overflows,0 ); \ -memfunc (zero.buf, srcB,1 + unconst); \ +memfunc (empty.buf, srcB, zero +1 ); \KUNIT_EXPECT_EQ (test, fortify_read_overflows,0 ); \KUNIT_EXPECT_EQ (test, fortify_write_overflows,1 ); \ }
@@ -919,7 +923,9 @@ static void fortify_test_memscan(struct kunit *test)char haystack[] ="Where oh where is my memory range?" ;char *mem = haystack +strlen ("Where oh where is " );char needle ='m' ; -size_t len =sizeof (haystack) + unconst; +size_t len =sizeof (haystack); + +OPTIMIZER_HIDE_VAR (len);KUNIT_ASSERT_PTR_EQ (test,memscan (haystack, needle, len), mem);
@@ -938,7 +944,9 @@ static void fortify_test_memchr(struct kunit *test)char haystack[] ="Where oh where is my memory range?" ;char *mem = haystack +strlen ("Where oh where is " );char needle ='m' ; -size_t len =sizeof (haystack) + unconst; +size_t len =sizeof (haystack); + +OPTIMIZER_HIDE_VAR (len);KUNIT_ASSERT_PTR_EQ (test,memchr (haystack, needle, len), mem);
@@ -957,7 +965,9 @@ static void fortify_test_memchr_inv(struct kunit *test)char haystack[] ="Where oh where is my memory range?" ;char *mem = haystack +1 ;char needle ='W' ; -size_t len =sizeof (haystack) + unconst; +size_t len =sizeof (haystack); + +OPTIMIZER_HIDE_VAR (len);/* Normal search is okay. */ KUNIT_ASSERT_PTR_EQ(test, memchr_inv(haystack, needle, len),
@@ -976,8 +986,11 @@ static void fortify_test_memcmp(struct kunit *test) {char one[] ="My mind is going ..." ;char two[] ="My mind is going ... I can feel it." ; -size_t one_len =sizeof (one) + unconst -1 ; -size_t two_len =sizeof (two) + unconst -1 ; +size_t one_len =sizeof (one) -1 ; +size_t two_len =sizeof (two) -1 ; + +OPTIMIZER_HIDE_VAR (one_len); +OPTIMIZER_HIDE_VAR (two_len);/* We match the first string (ignoring the %NUL). */ KUNIT_ASSERT_EQ (test,memcmp (one, two, one_len),0 );
@@ -998,7 +1011,9 @@ static void fortify_test_kmemdup(struct kunit *test) {char src[] ="I got Doom running on it!" ;char *copy; -size_t len =sizeof (src) + unconst; +size_t len =sizeof (src); + +OPTIMIZER_HIDE_VAR (len);/* Copy is within bounds. */ copy =kmemdup (src, len,GFP_KERNEL );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 116/181 kunit/fortify: Add back "volatile" for sizeof() constants
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
commit 10299c07c94aa0997fa43523b53301e713a6415d upstream.
It seems the Clang can see through OPTIMIZER_HIDE_VAR when the constant is coming from sizeof. Adding "volatile" back to these variables solves this false positive without reintroducing the issues that originally led to switching to OPTIMIZER_HIDE_VAR in the first place[1].
--- lib/fortify_kunit.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
lib/fortify_kunit.c +2 -2
@@ -986,8 +986,8 @@ static void fortify_test_memcmp(struct kunit *test) {char one[] ="My mind is going ..." ;char two[] ="My mind is going ... I can feel it." ; -size_t one_len =sizeof (one) -1 ; -size_t two_len =sizeof (two) -1 ; +volatile size_t one_len =sizeof (one) -1 ; +volatile size_t two_len =sizeof (two) -1 ;OPTIMIZER_HIDE_VAR (one_len);OPTIMIZER_HIDE_VAR (two_len);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 117/181 pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <[email protected]>
commit c1492da3939c89372929e062d731f328f7693f1e upstream.
The pinctrl and GPIO core code make exceptions for the -ENOTSUPP error code. One such example is gpio_set_config_with_argument_optional(), which returns success when gpio_set_config_with_argument() returns -ENOTSUPP, but reports failure for all other error codes.
Returning -EOPNOTSUPP from the pinctrl driver on the unsupported pinctrl operation may lead to boot failures when pinctrl drivers implements struct gpio_chip::set_config, the system uses GPIO hogs, and the struct gpio_chip::set_config implementation returns -EOPNOTSUPP for the unsupported operations.
Return -ENOTSUPP for the unsupported pinctrl operation.
--- drivers/pinctrl/renesas/pinctrl-rzg2l.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pinctrl/renesas/pinctrl-rzg2l.c +2 -2
@@ -1478,7 +1478,7 @@ static int rzg2l_pinctrl_pinconf_set(struct pinctrl_dev *pctldev,break ;default : -return -EOPNOTSUPP ; +return -ENOTSUPP ; } }
@@ -1560,7 +1560,7 @@ static int rzg2l_pinctrl_pinconf_group_get(struct pinctrl_dev *pctldev,/* Check config matching between to pin */ if (i && prev_config != *config) -return -EOPNOTSUPP ; +return -ENOTSUPP ; prev_config = *config; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 118/181 selftests/bpf: Ensure UDP sockets are bound
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Luczaj <[email protected]>
[ Upstream commit fe3ff273767ef22fe8a7cb3816f264927c190e50 ]
Update sockmap_basic tests to bind sockets before they are used. This accommodates the recent change in sockmap that rejects unbound UDP sockets.
--- tools/testing/selftests/bpf/prog_tests/sockmap_basic.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
tools/testing/selftests/bpf/prog_tests/sockmap_basic.c +3 -3
@@ -703,7 +703,7 @@ static void test_sockmap_many_socket(void)return ; } - udp =xsocket (AF_INET ,SOCK_DGRAM |SOCK_NONBLOCK ,0 ); + udp =socket_loopback (AF_INET ,SOCK_DGRAM |SOCK_NONBLOCK );if (udp <0 ) {close (dgram);close (tcp);
@@ -772,7 +772,7 @@ static void test_sockmap_many_maps(void)return ; } - udp =xsocket (AF_INET ,SOCK_DGRAM |SOCK_NONBLOCK ,0 ); + udp =socket_loopback (AF_INET ,SOCK_DGRAM |SOCK_NONBLOCK );if (udp <0 ) {close (dgram);close (tcp);
@@ -843,7 +843,7 @@ static void test_sockmap_same_sock(void)return ; } - udp =xsocket (AF_INET ,SOCK_DGRAM |SOCK_NONBLOCK ,0 ); + udp =socket_loopback (AF_INET ,SOCK_DGRAM |SOCK_NONBLOCK );if (udp <0 ) {close (dgram);close (tcp);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 119/181 selftests/bpf: Adapt sockmap update error handling
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Luczaj <[email protected]>
[ Upstream commit 30581eda4a07ff15db623612cac578e81869e96f ]
Update sockmap_listen to accommodate the recent change in sockmap that rejects unbound UDP sockets.
TCP: Reject unbound and bound (unless established or listening).
UDP: Accept only bound sockets.
While at it, migrate to ASSERT_* and enforce reverse xmas tree.
--- .../selftests/bpf/prog_tests/sockmap_listen.c | 21 ++++++++++--------- 1 file changed, 11 insertions(+), 10 deletions(-)
tools/testing/selftests/bpf/prog_tests/sockmap_listen.c +11 -10
@@ -53,8 +53,8 @@ static void test_insert_opened(struct test_sockmap_listen *skel __always_unused, int family, int sotype, int mapfd) { u32 key = 0; -u64 value;int err, s; +u64 value; s =xsocket (family, sotype,0 );if (s ==-1 )
@@ -63,11 +63,8 @@ static void test_insert_opened(struct test_sockmap_listen *skel __always_unused, errno =0 ; value = s; err =bpf_map_update_elem (mapfd, &key, &value,BPF_NOEXIST ); -if (sotype ==SOCK_STREAM ) { -if (!err || errno !=EOPNOTSUPP ) -FAIL_ERRNO ("map_update: expected EOPNOTSUPP" ); - }else if (err) -FAIL_ERRNO ("map_update: expected success" ); +ASSERT_ERR (err,"map_update" ); +ASSERT_EQ (errno,EOPNOTSUPP ,"errno" );xclose (s); }
@@ -77,8 +74,8 @@ static void test_insert_bound(struct test_sockmap_listen *skel __always_unused,struct sockaddr_storage addr;socklen_t len =0 ;u32 key =0 ; -u64 value;int err, s; +u64 value;init_addr_loopback (family, &addr, &len);
@@ -93,8 +90,12 @@ static void test_insert_bound(struct test_sockmap_listen *skel __always_unused, errno =0 ; value = s; err =bpf_map_update_elem (mapfd, &key, &value,BPF_NOEXIST ); -if (!err || errno !=EOPNOTSUPP ) -FAIL_ERRNO ("map_update: expected EOPNOTSUPP" ); +if (sotype ==SOCK_STREAM ) { +ASSERT_ERR (err,"map_update" ); +ASSERT_EQ (errno,EOPNOTSUPP ,"errno" ); + }else { +ASSERT_OK (err,"map_update" ); + } close:xclose (s); }
@@ -1289,7 +1290,7 @@ static void test_ops(struct test_sockmap_listen *skel, struct bpf_map *map,/* insert */ TEST (test_insert_invalid),TEST (test_insert_opened), -TEST (test_insert_bound,SOCK_STREAM ), +TEST (test_insert_bound),TEST (test_insert),/* delete */ TEST(test_delete_after_insert),
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 120/181 ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zihan Xi <[email protected]>
commit 4ff9548d84945d2cbf9e4c207288063a200ea397 upstream.
fib_nlmsg_size() still estimates nexthop space as if every gateway is encoded as an IPv4 RTA_GATEWAY attribute. IPv4 routes can also carry an IPv6 gateway, which fib_nexthop_info() dumps as RTA_VIA.
As a result, route notifications can allocate an skb that is too small. fib_dump_info() then fails with -EMSGSIZE and rtmsg_fib() hits the WARN_ON() that marks such failures as a fib_nlmsg_size() bug. With panic_on_warn set, this becomes a kernel panic.
Mirror the actual nexthop dump layout in fib_nlmsg_size(): account for IPv6 nexthop gateways dumped as RTA_VIA, for the no-header rtnexthop layout used inside RTA_MULTIPATH, and for RTA_FLOW only when it is actually present.
--- net/ipv4/fib_semantics.c | 67 ++++++++++++++++++++++++++++++++++------------- 1 file changed, 49 insertions(+), 18 deletions(-)
net/ipv4/fib_semantics.c +49 -18
@@ -462,6 +462,34 @@ int ip_fib_check_default(__be32 gw, strureturn -1 ; } +static size_t fib_nexthop_nlmsg_size (const struct fib_nh_common *nhc, +bool skip_oif) +{ +size_t nhsize =0 ; + +switch (nhc->nhc_gw_family) { +case AF_INET : + nhsize +=nla_total_size (4 );/* RTA_GATEWAY */ +break ; +case AF_INET6 : + nhsize +=nla_total_size (sizeof (struct rtvia ) + +sizeof (struct in6_addr )); +break ; + } + +if (!skip_oif && nhc->nhc_dev) + nhsize +=nla_total_size (4 );/* RTA_OIF */ + +if (nhc->nhc_lwtstate) { +/* RTA_ENCAP */ + nhsize +=lwtunnel_get_encap_size (nhc->nhc_lwtstate); +/* RTA_ENCAP_TYPE */ + nhsize +=nla_total_size (2 ); + } + +return nhsize; +} +size_t fib_nlmsg_size (struct fib_info *fi) {size_t payload =NLMSG_ALIGN (sizeof (struct rtmsg ))
@@ -479,32 +507,35 @@ size_t fib_nlmsg_size(struct fib_info *f payload +=nla_total_size (4 );/* RTA_NH_ID */ if (nhs) { -size_t nh_encapsize =0 ; -/* Also handles the special case nhs == 1 */ - -/* each nexthop is packed in an attribute */ -size_t nhsize =nla_total_size (sizeof (struct rtnexthop )); +size_t mpsize =0 ;unsigned int i; -/* may contain flow and gateway attribute */ - nhsize +=2 *nla_total_size (4 ); - -/* grab encap info */ for (i =0 ; i <fib_info_num_path (fi); i++) {struct fib_nh_common *nhc =fib_info_nhc (fi, i); +size_t nhsize; + + nhsize =fib_nexthop_nlmsg_size (nhc, nhs !=1 ); -if (nhc->nhc_lwtstate) { -/* RTA_ENCAP_TYPE */ - nh_encapsize +=lwtunnel_get_encap_size ( - nhc->nhc_lwtstate); -/* RTA_ENCAP */ - nh_encapsize +=nla_total_size (2 ); +if (nhs !=1 ) + nhsize +=NLA_ALIGN (sizeof (struct rtnexthop )); + +#ifdef CONFIG_IP_ROUTE_CLASSID +if (nhc->nhc_family ==AF_INET ) { +struct fib_nh *nh; + + nh = container_of(nhc, struct fib_nh, nh_common); +if (nh->nh_tclassid) + nhsize +=nla_total_size (4 ); } +#endif +if (nhs ==1 ) + payload += nhsize; +else + mpsize += nhsize; } -/* all nexthops are packed in a nested attribute */ - payload +=nla_total_size ((nhs * nhsize) + nh_encapsize); - +if (nhs !=1 ) + payload +=nla_total_size (mpsize); }return payload;
Greg Kroah-Hartman
maintainerPATCH 121/181 ipv4: fix use-after-free in fib_nhc_update_mtu()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengfeng Ye <[email protected]>
commit bc5bde9ce3cc36502839dfe98e068f7303a50982 upstream.
fib_nhc_update_mtu() walks the nexthop exception table under RTNL, but RTNL does not serialize this walk with PMTU exception updates. The walk uses rcu_dereference_protected() with a constant true condition without holding fnhe_lock.
The following interleaving can therefore occur:
CPU 0 CPU 1
fib_nhc_update_mtu() update_or_create_fnhe()
load fnhe spin_lock_bh(&fnhe_lock)
fnhe_remove_oldest()
unlink fnhe kfree_rcu(fnhe, rcu)
<quiescent state>
access fnhe after grace period
KASAN reported:
BUG: KASAN: slab-use-after-free in fib_nhc_update_mtu+0x3df/0x410 Read of size 8 at addr ffff888107d49000 by task poc/90 Call Trace: fib_nhc_update_mtu+0x3df/0x410 fib_sync_mtu+0x7a/0xd0 fib_netdev_event+0x229/0x3f0 netif_set_mtu_ext+0x33a/0x570 dev_set_mtu+0x88/0x120
The same walk updates fnhe_pmtu and fnhe_mtu_locked. These fields form a pair and other writers serialize them with fnhe_lock. RCU alone prevents reclamation, but would still allow concurrent writers to leave a mixed pair.
Walk the table under RCU and acquire fnhe_lock only while updating each exception. RCU keeps the current entry alive while the short critical section serializes its paired PMTU fields. This avoids holding the global lock while scanning all 2048 buckets for every nexthop.
--- include/net/route.h | 2 ++ net/ipv4/fib_semantics.c | 34 +++++++++++----------------------- net/ipv4/route.c | 29 +++++++++++++++++++++++++++++ 3 files changed, 42 insertions(+), 23 deletions(-)
include/net/route.h +2 -0
@@ -258,6 +258,8 @@ int fib_dump_info_fnhe(struct sk_buff *s u32 table_id, struct fib_info *fi, int *fa_index, int fa_start, unsigned int flags); +void fnhe_update_pmtu (struct fib_nh_exception *fnhe,u32 new,u32 orig); +static inline void ip_rt_put (struct rtable *rt) {/* dst_release() accepts a NULL parameter.
net/ipv4/fib_semantics.c +11 -23
@@ -1956,42 +1956,30 @@ static int call_fib_nh_notifiers(structreturn NOTIFY_DONE ; } -/* Update the PMTU of exceptions when: -* - the new MTU of the first hop becomes smaller than the PMTU -* - the old MTU was the same as the PMTU, and it limited discovery of -* larger MTUs on the path. With that limit raised, we can now -* discover larger MTUs -* A special case is locked exceptions, for which the PMTU is smaller -* than the minimal accepted PMTU: -* - if the new MTU is greater than the PMTU, don't make any change -* - otherwise, unlock and set PMTU +/* Walk the exceptions of a nexthop after its first hop MTU changed. The +* chain is RCU protected here, while fnhe_update_pmtu() takes fnhe_lock +* for the update of each entry. */ void fib_nhc_update_mtu (struct fib_nh_common *nhc,u32 new,u32 orig) {struct fnhe_hash_bucket *bucket;int i; - bucket =rcu_dereference_protected (nhc->nhc_exceptions,1 ); +rcu_read_lock (); + bucket =rcu_dereference (nhc->nhc_exceptions);if (!bucket) -return ; + goto out;for (i =0 ; i <FNHE_HASH_SIZE ; i++) {struct fib_nh_exception *fnhe; -for (fnhe =rcu_dereference_protected (bucket[i].chain,1 ); +for (fnhe =rcu_dereference (bucket[i].chain); fnhe; - fnhe =rcu_dereference_protected (fnhe->fnhe_next,1 )) { -if (fnhe->fnhe_mtu_locked) { -if (new <= fnhe->fnhe_pmtu) { - fnhe->fnhe_pmtu = new; - fnhe->fnhe_mtu_locked = false; - } - }else if (new < fnhe->fnhe_pmtu || - orig == fnhe->fnhe_pmtu) { - fnhe->fnhe_pmtu = new; - } - } + fnhe =rcu_dereference (fnhe->fnhe_next)) +fnhe_update_pmtu (fnhe, new, orig); } +out: +rcu_read_unlock (); }void fib_sync_mtu (struct net_device *dev,u32 orig_mtu)
net/ipv4/route.c +29 -0
@@ -739,6 +739,35 @@ out_unlock:spin_unlock_bh (&fnhe_lock); } +/* Update the PMTU of an exception when: +* - the new MTU of the first hop becomes smaller than the PMTU +* - the old MTU was the same as the PMTU, and it limited discovery of +* larger MTUs on the path. With that limit raised, we can now +* discover larger MTUs +* A special case is locked exceptions, for which the PMTU is smaller +* than the minimal accepted PMTU: +* - if the new MTU is greater than the PMTU, don't make any change +* - otherwise, unlock and set PMTU +* +* fnhe_lock keeps fnhe_pmtu and fnhe_mtu_locked consistent against +* update_or_create_fnhe(), which sets both under the same lock. +*/ +void fnhe_update_pmtu (struct fib_nh_exception *fnhe,u32 new,u32 orig) +{ +spin_lock_bh (&fnhe_lock); + +if (fnhe->fnhe_mtu_locked) { +if (new <= fnhe->fnhe_pmtu) { + fnhe->fnhe_pmtu = new; + fnhe->fnhe_mtu_locked = false; + } + }else if (new < fnhe->fnhe_pmtu || orig == fnhe->fnhe_pmtu) { + fnhe->fnhe_pmtu = new; + } + +spin_unlock_bh (&fnhe_lock); +} +static void __ip_do_redirect (struct rtable *rt,struct sk_buff *skb,struct flowi4 *fl4,bool kill_route) {
Greg Kroah-Hartman
maintainerPATCH 122/181 mei: pull kvfree out of spinlock
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Usyskin <[email protected]>
commit b0495bb58af06a7de4628c72d500e3d5e180d808 upstream.
The read buffer allocation was changed from kmalloc() to kvmalloc().
This buffer is part of mei_cl_cb structure that can be queued in rd_complete queue protected by spinlock.
Releasing the structure leads to errors like below when freeing buffer that allocated non-contiguous:
BUG: sleeping function called from invalid context at mm/vmalloc.c:3448
Separate mei_cl_cb structure dequeue and release to perform only dequeue under spinlock and push release out of spinlock.
--- drivers/misc/mei/client.c | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-)
drivers/misc/mei/client.c +15 -10
@@ -447,18 +447,24 @@ static void mei_io_tx_list_free_cl(struc }/** -* mei_io_list_free_fp - free cb from a list that matches file pointer +* mei_io_rd_list_free_fp - free cb from a rd_completed list that matches file pointer * -* @head: io list +* @cl: host client * @fp: file pointer (matching cb file object), may be NULL */ -static void mei_io_list_free_fp (struct list_head *head,const struct file *fp) +static void mei_io_rd_list_free_fp (struct mei_cl *cl,const struct file *fp) {struct mei_cl_cb *cb, *next; +LIST_HEAD (cmpl_list); -list_for_each_entry_safe (cb, next, head, list) +spin_lock (&cl->rd_completed_lock); +list_for_each_entry_safe (cb, next, &cl->rd_completed, list)if (!fp || fp == cb->fp) -mei_io_cb_free (cb); +list_move (&cb->list, &cmpl_list); +spin_unlock (&cl->rd_completed_lock); + +list_for_each_entry_safe (cb, next, &cmpl_list, list) +mei_io_cb_free (cb); }/**
@@ -587,9 +593,7 @@ int mei_cl_flush_queues(struct mei_cl *cmei_io_list_flush_cl (&cl->dev->ctrl_rd_list, cl);mei_cl_free_pending (cl); } -spin_lock (&cl->rd_completed_lock); -mei_io_list_free_fp (&cl->rd_completed, fp); -spin_unlock (&cl->rd_completed_lock); +mei_io_rd_list_free_fp (cl, fp);return 0 ; }
@@ -1426,7 +1430,7 @@ void mei_cl_add_rd_completed(struct mei_ }/** -* mei_cl_del_rd_completed - free read completed callback with lock +* mei_cl_del_rd_completed - unlink read completed callback with lock and free it * * @cl: host client * @cb: callback block
@@ -1435,8 +1439,9 @@ void mei_cl_add_rd_completed(struct mei_void mei_cl_del_rd_completed (struct mei_cl *cl,struct mei_cl_cb *cb) {spin_lock (&cl->rd_completed_lock); -mei_io_cb_free (cb); +list_del_init (&cb->list);spin_unlock (&cl->rd_completed_lock); +mei_io_cb_free (cb); }/**
Greg Kroah-Hartman
maintainerPATCH 123/181 nvmem: layouts: Add fixed-layout driver
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathieu Dubois-Briand <[email protected]>
commit b5be879519291f139fa7b365fd0dbc84710e4919 upstream.
Current implementation isn't working well when device tree nodes have a phandle on a fixed-layout nvmem node. As the fixed layout is handled in nvmem core, no driver is ever associated with the layout, and the device consumer driver probe is deferred indefinitely.
Remove the specific handling of fixed-layout and add a layout driver. This makes the fixed-layout similar to all other layouts, fixing the whole issue.
--- MAINTAINERS | 5 +++ drivers/nvmem/core.c | 24 +------------- drivers/nvmem/internals.h | 2 + drivers/nvmem/layouts.c | 11 ------ drivers/nvmem/layouts/Makefile | 1 drivers/nvmem/layouts/fixed-layout.c | 58 +++++++++++++++++++++++++++++++++++ include/linux/nvmem-provider.h | 6 +++ 7 files changed, 74 insertions(+), 33 deletions(-) create mode 100644 drivers/nvmem/layouts/fixed-layout.c
MAINTAINERS +5 -0
@@ -8849,6 +8849,11 @@ F: drivers/base/firmware_loader/ F: rust/kernel/firmware.rs F: include/linux/firmware.h +FIXED-LAYOUT NVMEM LAYOUT DRIVER +M: Mathieu Dubois-Briand <[email protected]> +S: Maintained +F: drivers/nvmem/layouts/fixed-layout.c + FLEXTIMER FTM-QUADDEC DRIVER M: Patrick Havelange <[email protected]> L: [email protected]
drivers/nvmem/core.c +2 -22
@@ -811,7 +811,7 @@ static int nvmem_validate_keepouts(strucreturn 0 ; } -static int nvmem_add_cells_from_dt (struct nvmem_device *nvmem,struct device_node *np) +int nvmem_add_cells_from_dt (struct nvmem_device *nvmem,struct device_node *np) {struct device *dev = &nvmem->dev;struct device_node *child;
@@ -863,29 +863,13 @@ static int nvmem_add_cells_from_dt(strucreturn 0 ; } +EXPORT_SYMBOL_GPL (nvmem_add_cells_from_dt);static int nvmem_add_cells_from_legacy_of (struct nvmem_device *nvmem) {return nvmem_add_cells_from_dt (nvmem, nvmem->dev.of_node); } -static int nvmem_add_cells_from_fixed_layout (struct nvmem_device *nvmem) -{ -struct device_node *layout_np; -int err =0 ; - - layout_np =of_nvmem_layout_get_container (nvmem); -if (!layout_np) -return 0 ; - -if (of_device_is_compatible (layout_np,"fixed-layout" )) - err =nvmem_add_cells_from_dt (nvmem, layout_np); - -of_node_put (layout_np); - -return err; -} -int nvmem_layout_register (struct nvmem_layout *layout) {int ret;
@@ -1038,10 +1022,6 @@ struct nvmem_device *nvmem_register(cons goto err_remove_cells; } - rval =nvmem_add_cells_from_fixed_layout (nvmem); -if (rval) - goto err_remove_cells; -dev_dbg (&nvmem->dev,"Registering nvmem device %s\n" , config->name); rval =device_add (&nvmem->dev);
drivers/nvmem/internals.h +2 -0
@@ -35,6 +35,8 @@ struct nvmem_device {bool sysfs_cells_populated; }; +int nvmem_add_cells_from_dt (struct nvmem_device *nvmem,struct device_node *np); +#if IS_ENABLED (CONFIG_OF )int nvmem_layout_bus_register (void );void nvmem_layout_bus_unregister (void );
drivers/nvmem/layouts.c +0 -11
@@ -125,11 +125,6 @@ static int nvmem_layout_create_device(streturn 0 ; } -static const struct of_device_id of_nvmem_layout_skip_table[] = { - { .compatible ="fixed-layout" , }, - {} -}; -static int nvmem_layout_bus_populate (struct nvmem_device *nvmem,struct device_node *layout_dn) {
@@ -142,12 +137,6 @@ static int nvmem_layout_bus_populate(strreturn 0 ; } -/* Fixed layouts are parsed manually somewhere else for now */ -if (of_match_node (of_nvmem_layout_skip_table, layout_dn)) { -pr_debug ("%s() - skipping %pOF node\n" , __func__, layout_dn); -return 0 ; - } -if (of_node_check_flag (layout_dn,OF_POPULATED_BUS )) {pr_debug ("%s() - skipping %pOF, already populated\n" , __func__, layout_dn);
drivers/nvmem/layouts/Makefile +1 -0
@@ -3,6 +3,7 @@ # Makefile for nvmem layouts. # +obj-$(CONFIG_NVMEM_LAYOUTS) += fixed-layout.o obj-$(CONFIG_NVMEM_LAYOUT_SL28_VPD) += sl28vpd.o obj-$(CONFIG_NVMEM_LAYOUT_ONIE_TLV) += onie-tlv.o obj-$(CONFIG_NVMEM_LAYOUT_U_BOOT_ENV) += u-boot-env.o
drivers/nvmem/layouts/fixed-layout.c new file +58 -0
58 lines not on this page · raw message
include/linux/nvmem-provider.h +6 -0
@@ -238,6 +238,12 @@ static inline int nvmem_layout_register(static inline void nvmem_layout_unregister (struct nvmem_layout *layout) {} +static inline int nvmem_add_cells_from_dt (struct nvmem_device *nvmem, +struct device_node *np) +{ +return -EOPNOTSUPP ; +} +#endif /* CONFIG_NVMEM */ #if IS_ENABLED (CONFIG_NVMEM ) &&IS_ENABLED (CONFIG_OF )
Greg Kroah-Hartman
maintainerPATCH 124/181 serial: qcom-geni: fix TX DMA buffer flush
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Sebastian Götte <[email protected]>
commit e3c04834ae1ab5e9cfbe8ac54ec734aa4774249d upstream.
When transmit flushing a qcom-geni UART during an ongoing TX DMA, the UART gets stuck infinitely repeating corrupted TX DMA frames.
The DMA-mode uart_ops does not provide a flush_buffer callback, so an in-flight transfer can complete after serial core has reset the transmit kfifo, underflowing its length and resubmitting page-sized transfers indefinitely. Add one that stops the transfer and clears tx_remaining and tx_queued.
The stop path was also broken: it unmapped the buffer while the serial engine could still read it, and never reset the TX DMA state machine. Cancel the main sequencer command first, then reset the state machine and wait for it before unmapping. Drop the early return so a pending mapping is also cleaned up when the main command is inactive.
The bug can be triggered from userspace with a large write immediately followed by TCOFLUSH. A following tcdrain will hang forever. The bug was reproduced and this fix was validated on Arduino Uno Q (QRB2210) using /dev/ttyHS1.
--- drivers/tty/serial/qcom_geni_serial.c | 43 +++++++++++++++++----------------- 1 file changed, 22 insertions(+), 21 deletions(-)
drivers/tty/serial/qcom_geni_serial.c +22 -21
@@ -145,6 +145,7 @@ static const struct uart_ops qcom_geni_ustatic struct uart_driver qcom_geni_console_driver;static struct uart_driver qcom_geni_uart_driver; +static void qcom_geni_serial_stop_tx_dma (struct uart_port *uport);static void __qcom_geni_serial_cancel_tx_cmd (struct uart_port *uport);static void qcom_geni_serial_cancel_tx_cmd (struct uart_port *uport);static int qcom_geni_serial_port_setup (struct uart_port *uport);
@@ -600,35 +601,34 @@ static unsigned int qcom_geni_serial_tx_return !readl (uport->membase +SE_GENI_TX_FIFO_STATUS ); } +static void qcom_geni_serial_flush_buffer_dma (struct uart_port *uport) +{ +struct qcom_geni_serial_port *port =to_dev_port (uport); + +qcom_geni_serial_stop_tx_dma (uport); + port->tx_remaining =0 ; + port->tx_queued =0 ; +} +static void qcom_geni_serial_stop_tx_dma (struct uart_port *uport) {struct qcom_geni_serial_port *port =to_dev_port (uport); -bool done; -if (!qcom_geni_serial_main_active (uport)) -return ; +if (qcom_geni_serial_main_active (uport)) +__qcom_geni_serial_cancel_tx_cmd (uport);if (port->tx_dma_addr) { +writel (1 , uport->membase +SE_DMA_TX_FSM_RST ); +if (!qcom_geni_serial_poll_bit (uport,SE_DMA_TX_IRQ_STAT , +TX_RESET_DONE , true)) +dev_err_ratelimited (uport->dev,"TX DMA reset failed" ); +writel (TX_RESET_DONE |TX_DMA_DONE , + uport->membase +SE_DMA_TX_IRQ_CLR ); +geni_se_tx_dma_unprep (&port->se, port->tx_dma_addr, port->tx_remaining); port->tx_dma_addr =0 ; - port->tx_remaining =0 ; } - -geni_se_cancel_m_cmd (&port->se); - - done =qcom_geni_serial_poll_bit (uport,SE_GENI_M_IRQ_STATUS , -M_CMD_CANCEL_EN , true); -if (!done) { -geni_se_abort_m_cmd (&port->se); - done =qcom_geni_serial_poll_bit (uport,SE_GENI_M_IRQ_STATUS , -M_CMD_ABORT_EN , true); -if (!done) -dev_err_ratelimited (uport->dev,"M_CMD_ABORT_EN not set" ); -writel (M_CMD_ABORT_EN , uport->membase +SE_GENI_M_IRQ_CLEAR ); - } - -writel (M_CMD_CANCEL_EN , uport->membase +SE_GENI_M_IRQ_CLEAR ); }static void qcom_geni_serial_start_tx_dma (struct uart_port *uport)
@@ -1140,7 +1140,7 @@ static void qcom_geni_serial_shutdown(stuart_port_unlock_irq (uport); } -static void qcom_geni_serial_flush_buffer (struct uart_port *uport) +static void qcom_geni_serial_flush_buffer_fifo (struct uart_port *uport) {qcom_geni_serial_cancel_tx_cmd (uport); }
@@ -1614,7 +1614,7 @@ static const struct uart_ops qcom_geni_c .request_port = qcom_geni_serial_request_port, .config_port = qcom_geni_serial_config_port, .shutdown = qcom_geni_serial_shutdown, - .flush_buffer = qcom_geni_serial_flush_buffer, + .flush_buffer = qcom_geni_serial_flush_buffer_fifo, .type = qcom_geni_serial_get_type, .set_mctrl = qcom_geni_serial_set_mctrl, .get_mctrl = qcom_geni_serial_get_mctrl,
@@ -1637,6 +1637,7 @@ static const struct uart_ops qcom_geni_u .request_port = qcom_geni_serial_request_port, .config_port = qcom_geni_serial_config_port, .shutdown = qcom_geni_serial_shutdown, + .flush_buffer = qcom_geni_serial_flush_buffer_dma, .type = qcom_geni_serial_get_type, .set_mctrl = qcom_geni_serial_set_mctrl, .get_mctrl = qcom_geni_serial_get_mctrl,
Greg Kroah-Hartman
maintainerPATCH 125/181 serial: 8250_dma: Clear stale RX state on shutdown
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cunhao Lu <[email protected]>
commit e2fe6a0efecbef00e3ecc2db64dd5afa8c212b41 upstream.
serial8250_release_dma() terminates RX DMA and releases the channel, but leaves rx_running set. If the port is closed while an RX transfer is active, the stale state remains while rxchan is NULL until the channel is requested again on the next open.
The DesignWare BUSY workaround added by commit a7b9ce39fbe4 ("serial: 8250_dw: Ensure BUSY is deasserted") calls serial8250_rx_dma_flush() from the LCR write path during startup. This happens before serial8250_request_dma() obtains a new RX channel. On reopen, the stale rx_running state therefore makes the flush path pass a NULL channel to dmaengine_pause(), causing a kernel Oops.
Clear rx_running after terminating RX DMA, matching the TX cleanup. Also make the flush helper return if the DMA object or RX channel is not available so startup and teardown paths cannot pass a NULL channel to the DMAengine API.
--- drivers/tty/serial/8250/8250_dma.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/tty/serial/8250/8250_dma.c +7 -5
@@ -211,11 +211,12 @@ void serial8250_rx_dma_flush(struct uart {struct uart_8250_dma *dma = p->dma; -if (dma->rx_running) { -dmaengine_pause (dma->rxchan); -__dma_rx_complete (p); -dmaengine_terminate_async (dma->rxchan); - } +if (!dma || !dma->rxchan || !dma->rx_running) +return ; + +dmaengine_pause (dma->rxchan); +__dma_rx_complete (p); +dmaengine_terminate_async (dma->rxchan); }EXPORT_SYMBOL_GPL (serial8250_rx_dma_flush);
@@ -324,6 +325,7 @@ void serial8250_release_dma(struct uart_/* Release RX resources */ dmaengine_terminate_sync (dma->rxchan); + dma->rx_running =0 ;dma_free_coherent (dma->rxchan->device->dev, dma->rx_size, dma->rx_buf, dma->rx_addr);dma_release_channel (dma->rxchan);
Greg Kroah-Hartman
maintainerPATCH 126/181 staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <[email protected]>
commit 1c3e23e78862493e8cf1adad02b10ffcb8b9921c upstream.
rtw_get_wpa_ie() reads bytes at fixed offsets into a vendor-specific information element without checking that the element is long enough, causing an out-of-bounds read for a short trailing IE.
The function locates a vendor-specific IE (EID 221) with rtw_get_ie() and then compares a 4-byte OUI+type at pbuf + 2 and reads a 2-byte version word at pbuf + 6. Those accesses require the IE body to be at least 6 bytes, but rtw_get_ie() only guarantees that the element fits within the buffer; it does not enforce a minimum body length. A vendor-specific IE whose length byte is 0 to 5, placed at the end of the buffer, therefore makes these reads run past the end of the IE and past the end of the buffer itself.
The buffer holds information elements taken from received management frames and from the IE blob passed to rtw_cfg80211_set_wpa_ie(), which is kmemdup'd to its exact length, so the read can run off the end of the allocation.
The sibling helpers rtw_get_sec_ie(), rtw_get_wapi_ie() and rtw_get_wps_ie() in this file already reject too-short vendor-specific IEs before their OUI memcmp(); rtw_get_wpa_ie() was never brought in line with them, and needs a minimum of 6 rather than 4 bytes because of the version word. Add the missing length check.
--- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/staging/rtl8723bs/core/rtw_ieee80211.c +3 -0
@@ -372,6 +372,9 @@ unsigned char *rtw_get_wpa_ie(unsigned c pbuf =rtw_get_ie (pbuf,WLAN_EID_VENDOR_SPECIFIC , &len, limit_new);if (pbuf) { +if (len <6 ) + goto check_next_ie; +/* check if oui matches... */ if (memcmp ((pbuf +2 ), wpa_oui_type,sizeof (wpa_oui_type))) goto check_next_ie;
Greg Kroah-Hartman
maintainerPATCH 127/181 staging: rtl8723bs: fix OOB read in WMM_param_handler()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <[email protected]>
commit ae21407350151bddfd4fea7aa39bd0643c0ca9d3 upstream.
WMM_param_handler() copies a fixed-size WMM parameter element out of a received information element without checking that the element is long enough, causing an out-of-bounds read for a short WMM IE.
The handler reads sizeof(struct WMM_para_element) (18) bytes at pIE->data + 6, so it requires pIE->length to be at least 24 (WLAN_WMM_LEN), but it never validates the length. Two of its three callers reach it after matching only the WMM OUI: OnAssocRsp() in rtw_mlme_ext.c matches a 6-byte OUI, and join_cmd_hdl() matches a 4-byte OUI, before calling the handler. A vendor-specific IE carrying the WMM OUI but a length between 6 and 23, placed in an association response or in the IE blob handed to join_cmd_hdl(), passes the OUI check and then makes the memcmp() and memcpy() at pIE->data + 6 read past the end of the element. OnAssocRsp() parses a frame received from the AP, so this is reachable from a remote peer.
The remaining caller in rtw_wlan_util.c already guards the handler with "pIE->length == WLAN_WMM_LEN". Move the equivalent check into the handler itself so every caller is covered; the sibling IE handlers in the same parsing loop (HT_caps_handler(), HT_info_handler(), ERP_IE_handler()) likewise bound their accesses by pIE->length.
--- drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/staging/rtl8723bs/core/rtw_wlan_util.c +3 -0
@@ -730,6 +730,9 @@ int WMM_param_handler(struct adapter *pareturn false; } +if (pIE->length !=WLAN_WMM_LEN ) +return false; +if (!memcmp (&(pmlmeinfo->WMM_param), (pIE->data +6 ),sizeof (struct WMM_para_element )))return false;else
Greg Kroah-Hartman
maintainerPATCH 128/181 staging: rtl8723bs: fix missing shared-key auth challenge length check
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Panagiotis Petrakopoulos <[email protected]>
commit 2c56ef658ac8c6bca36bc5574715e8f717207c6c upstream.
The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chg_txt buffer.
In OnAuthClient() the length from rtw_get_ie() - up to 255 - is used to perform memcpy() into the 128-byte pmlmeinfo->chg_txt, so a malicious AP sending a malformed WLAN_EID_CHALLENGE element can overflow/underfill chg_txt by up to 127 bytes. It is reachable over the air, before association, during shared-key authentication. In the case of an overflow, the driver can write out of bounds. In the case of an underfill, the driver can echo stale buffer memory.
The challenge text is defined to be exactly 128 octets, which is already provided as the WLAN_AUTH_CHALLENGE_LEN define; require the element to be exactly that length before use.
--- drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c +1 -1
@@ -904,7 +904,7 @@ unsigned int OnAuthClient(struct adapter p =rtw_get_ie (pframe +WLAN_HDR_A3_LEN + _AUTH_IE_OFFSET_,WLAN_EID_CHALLENGE , (int *)&len, pkt_len -WLAN_HDR_A3_LEN - _AUTH_IE_OFFSET_); -if (!p) +if (!p || len !=WLAN_AUTH_CHALLENGE_LEN ) goto authclnt_fail;memcpy ((void *)(pmlmeinfo->chg_txt), (void *)(p +2 ), len);
Greg Kroah-Hartman
maintainerPATCH 129/181 staging: rtl8723bs: validate monitor transmit frame lengths
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mariano Baragiola <[email protected]>
commit 6829665d050983907b560173e49dcc6c11cb2730 upstream.
rtw_cfg80211_monitor_if_xmit_entry() removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains.
The data path also pulls the calculated 802.11, QoS and SNAP header span before confirming that the skb contains it. A truncated frame can therefore cause out-of-bounds reads or leave insufficient data for the Ethernet address writes.
Reject frames that do not contain the base 802.11 header and data frames that do not contain their complete calculated header span.
--- drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c +4 -0
@@ -2041,6 +2041,8 @@ static netdev_tx_t rtw_cfg80211_monitor_/* Skip the ratio tap header */ skb_pull (skb, rtap_len); +if (skb->len < dot11_hdr_len) + goto fail; dot11_hdr = (struct ieee80211_hdr *)skb->data; frame_control =le16_to_cpu (dot11_hdr->frame_control);
@@ -2053,6 +2055,8 @@ static netdev_tx_t rtw_cfg80211_monitor_ qos_len =2 ;if ((frame_control &0x0300 ) ==0x0300 ) dot11_hdr_len +=6 ; +if (skb->len < dot11_hdr_len + qos_len + snap_len) + goto fail;memcpy (dst_mac_addr, dot11_hdr->addr1,sizeof (dst_mac_addr));memcpy (src_mac_addr, dot11_hdr->addr2,sizeof (src_mac_addr));
Greg Kroah-Hartman
maintainerPATCH 130/181 misc: fastrpc: fix channel ctx ref leak when session alloc fails
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anandu Krishnan E <[email protected]>
commit 310f7868399668c6d99d88acc9c4cf3462e69d5b upstream.
fastrpc_channel_ctx_get() is called in fastrpc_device_open() before fastrpc_session_alloc(). If session alloc fails, the error path returns -EBUSY without calling fastrpc_channel_ctx_put(), leaking the reference. Fix by adding the missing put.
--- drivers/misc/fastrpc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/misc/fastrpc.c +1 -1
@@ -1643,7 +1643,7 @@ static int fastrpc_device_open(struct indev_err (&cctx->rpdev->dev,"No session available\n" );mutex_destroy (&fl->mutex);kfree (fl); - +fastrpc_channel_ctx_put (cctx);return -EBUSY ; }
Greg Kroah-Hartman
maintainerPATCH 131/181 misc: fastrpc: Remove buffer from list prior to unmap operation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ekansh Gupta <[email protected]>
commit 6102ceb4eab845743ee57acd3863fbd06e93c927 upstream.
fastrpc_req_munmap_impl() is called to unmap any buffer. The buffer is getting removed from the list after it is unmapped from DSP. This can create potential race conditions if multiple threads invoke unmap concurrently, where one thread may remove the entry from the list while another thread's unmap operation is still ongoing.
Fix this by removing the buffer entry from the list before calling the unmap operation. If the unmap fails, the entry is re-added to the list so that userspace can retry the unmap, or alternatively, the buffer will be cleaned up during device release when the DSP process is torn down and all DSP-side mappings are freed along with remaining buffers in the list.
--- drivers/misc/fastrpc.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
drivers/misc/fastrpc.c +10 -4
@@ -1871,9 +1871,6 @@ static int fastrpc_req_munmap_impl(struc &args[0]);if (!err) {dev_dbg (dev,"unmmap\tpt 0x%09lx OK\n" , buf->raddr); -spin_lock (&fl->lock); -list_del (&buf->node); -spin_unlock (&fl->lock);fastrpc_buf_free (buf); }else {dev_err (dev,"unmmap\tpt 0x%09lx ERROR\n" , buf->raddr);
@@ -1887,6 +1884,7 @@ static int fastrpc_req_munmap(struct fasstruct fastrpc_buf *buf =NULL , *iter, *b;struct fastrpc_req_munmap req;struct device *dev = fl->sctx->dev; +int err;if (copy_from_user (&req, argp,sizeof (req)))return -EFAULT ;
@@ -1894,6 +1892,7 @@ static int fastrpc_req_munmap(struct fasspin_lock (&fl->lock);list_for_each_entry_safe (iter, b, &fl->mmaps, node) {if ((iter->raddr == req.vaddrout) && (iter->size == req.size)) { +list_del (&iter->node); buf = iter;break ; }
@@ -1906,7 +1905,14 @@ static int fastrpc_req_munmap(struct fasreturn -EINVAL ; } -return fastrpc_req_munmap_impl (fl, buf); + err =fastrpc_req_munmap_impl (fl, buf); +if (err) { +spin_lock (&fl->lock); +list_add_tail (&buf->node, &fl->mmaps); +spin_unlock (&fl->lock); + } + +return err; }static int fastrpc_req_mmap (struct fastrpc_user *fl,char __user *argp)
Greg Kroah-Hartman
maintainerPATCH 132/181 misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <[email protected]>
commit b85a0e91d7d6cd06a53c881a46f749cfcef416a2 upstream.
When an invoke is interrupted by a signal, wait_for_completion_interruptible() returns -ERESTARTSYS and fastrpc_internal_invoke() moves every buffer from fl->mmaps onto cctx->invoke_interrupted_mmaps. This list_del()/list_add_tail() walk runs without holding fl->lock, the lock that serialises fl->mmaps in fastrpc_req_mmap() and fastrpc_req_munmap() everywhere else.
Take fl->lock around the move, matching every other fl->mmaps accessor.
--- drivers/misc/fastrpc.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/misc/fastrpc.c +2 -0
@@ -1279,10 +1279,12 @@ bail: }if (err == -ERESTARTSYS ) { +spin_lock (&fl->lock);list_for_each_entry_safe (buf, b, &fl->mmaps, node) {list_del (&buf->node);list_add_tail (&buf->node, &fl->cctx->invoke_interrupted_mmaps); } +spin_unlock (&fl->lock); }if (err)