6.6.152-rc1 review
Greg Kroah-Hartman
maintainercover 6.6.152-rc1 review
This is the start of the stable review cycle for the 6.6.152 release. There are 156 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 19 Aug 2026 13:23:44 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.152-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.6.152-rc1
David Lechner <[email protected]>
regulator: devres: fix devm_regulator_get_enable_read_voltage() return
Dmitry Safonov <[email protected]>
net/tcp_sigpool: Use kref_get_unless_zero()
Dan Carpenter <[email protected]>
net/tcp_sigpool: Fix some off by one bugs
Xiang Mei (Microsoft) <[email protected]>
bpf: tcp: fix double sock release on batch realloc
Bryam Vargas <[email protected]>
thunderbolt: Bound the DROM dual link port number before indexing sw->ports
Qing Ming <[email protected]>
sctp: clear new_transport when removing a peer
Yuxiang Yang <[email protected]>
sctp: fix use-after-free of cached ASCONF chunk
Baul Lee <[email protected]>
sctp: keep chunk->transport in step with the list it is queued on
Xu Rao <[email protected]>
scsi: scsi_debug: Negate wrapped memcmp() result
Chengfeng Ye <[email protected]>
bpf, sockmap: Fix sk_redir use-after-free in send verdict
Tejun Heo <[email protected]>
sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
Zhan Xusheng <[email protected]>
fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()
Zhiling Zou <[email protected]>
ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
Yuejie Shi <[email protected]>
ipv6: fix Route Information option length validation
Tengda Wu <[email protected]>
ring-buffer: Use current_context for safe per-CPU buffer swap
Ahmad Byagowi <[email protected]>
ptp: ocp: Fix board ID over-read
Rafael J. Wysocki <[email protected]>
Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
Steven Rostedt <[email protected]>
eventfs: Use children field for rcu head and add memory barriers
Shuangpeng Bai <[email protected]>
eventfs: Fix use-after-free in eventfs_remove_rec()
Sean Christopherson <[email protected]>
KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page
Shuangpeng Bai <[email protected]>
smb: client: Fix use-after-free in cifs_try_adding_channels()
Jun Yang <[email protected]>
tipc: read le->link under the node lock in tipc_node_link_down()
chanyoung <[email protected]>
tls: don't leave a full plaintext sk_msg ring unpushed
Jun Yang <[email protected]>
vhost: reset the vring metadata cache on vring reconfiguration
Sun Jian <[email protected]>
veth: fix skb length accounting after XDP frag adjustment
Weiming Shi <[email protected]>
vsock/virtio: avoid refilling the RX queue after teardown
Weiming Shi <[email protected]>
vsock/virtio: read virtqueues under worker locks
Baul Lee <[email protected]>
vxlan: do not arm the ageing timer on a device that is down
Zhiling Zou <[email protected]>
xdp: reject clones that overrun skb_shared_info tailroom
Asad Kamal <[email protected]>
Revert "drm/amdgpu: fix aperture mapping leak"
Christian Brauner <[email protected]>
ovl: don't warn when the mount is completed from another user namespace
Hyunjung Ko <[email protected]>
net/sched: act_gact, act_police: range check the fallback control action
Hyunjung Ko <[email protected]>
net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
Yangyu Chen <[email protected]>
net: atlantic: free RX pages of consumed but not refilled buffers
Yangyu Chen <[email protected]>
net: atlantic: free stranded TX buffers on ring deinit
Zihan Xi <[email protected]>
netfilter: nf_conntrack: defer invalid log until after unlock
Zhiling Zou <[email protected]>
netfilter: bridge: release template ct on non-IP path
Kyle Zeng <[email protected]>
ipv6: prevent in6_dev_get() from resurrecting inet6_dev
Daming Li <[email protected]>
net: smc: fix splice entry lifetime imbalance in smc_rx_splice
Rik van Riel <[email protected]>
fbdev: bitblit: bound-check glyph index in bit_cursor()
Michael Wu <[email protected]>
tracing: Fix race between update_event_fields and, event_define_fields
Baul Lee <[email protected]>
ALSA: usx2y: bound the hwdep mmap fault offset
Takashi Iwai <[email protected]>
ALSA: usb: Fix UAF at delayed release of MIDI2 EPs
Hui Su <[email protected]>
ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
Eddie Lin <[email protected]>
misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
Junrui Luo <[email protected]>
misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
Ekansh Gupta <[email protected]>
misc: fastrpc: Remove buffer from list prior to unmap operation
Anandu Krishnan E <[email protected]>
misc: fastrpc: fix channel ctx ref leak when session alloc fails
Mariano Baragiola <[email protected]>
staging: rtl8723bs: validate monitor transmit frame lengths
Panagiotis Petrakopoulos <[email protected]>
staging: rtl8723bs: fix missing shared-key auth challenge length check
Muhammad Bilal <[email protected]>
staging: rtl8723bs: fix OOB read in WMM_param_handler()
Muhammad Bilal <[email protected]>
staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
Cunhao Lu <[email protected]>
serial: 8250_dma: Clear stale RX state on shutdown
Alexander Usyskin <[email protected]>
mei: pull kvfree out of spinlock
Chengfeng Ye <[email protected]>
ipv4: fix use-after-free in fib_nhc_update_mtu()
Zihan Xi <[email protected]>
ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
Michal Luczaj <[email protected]>
selftests/bpf: Adapt sockmap update error handling
Eric Biggers <[email protected]>
fscrypt: Replace mk_users keyring with simple list
Claudiu Beznea <[email protected]>
pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP
Nathan Chancellor <[email protected]>
fortify: Disable -Wstringop-overread in tests
Masahiro Yamada <[email protected]>
fortify: refactor test_fortify Makefile to fix some build problems
Keno Fischer <[email protected]>
futex: Prevent robust futex exit race some more
Harshal Dev <[email protected]>
dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk
Matthew Rosato <[email protected]>
KVM: s390: pci: Fix aisb calculation
Farhan Ali <[email protected]>
KVM: s390: pci: Fix resource leak on IRQ registration failure
Farhan Ali <[email protected]>
KVM: s390: pci: Fix missing error codes and memory unaccounting
Farhan Ali <[email protected]>
KVM: s390: pci: Fix memory accounting for pinned/unpinned pages
Baul Lee <[email protected]>
net: bridge: mrp: fix uninitialised bytes on the wire
Chengfeng Ye <[email protected]>
netfilter: ebt_nflog: pin the NFLOG backend
Zihan Xi <[email protected]>
mac802154: fix netdev use-after-free in beacon worker
Qihang Tang <[email protected]>
net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
Sergey V. Frolov <[email protected]>
net: octeontx2-pf: Fix UB in shift operation
Zijie Huang <[email protected]>
net/sched: reject overly deep qdisc hierarchies
Zhiling Zou <[email protected]>
net: openvswitch: reallocate update replies for mismatched IDs
Zihan Xi <[email protected]>
packet: synchronize pressure clearing with ring reconfiguration
Doruk Tan Ozturk <[email protected]>
net/packet: reset the MAC header on the packet-socket transmit path
Qihang Tang <[email protected]>
packet: use consistent hard_header_len in TX_RING send path
Qihang Tang <[email protected]>
packet: use consistent hard_header_len in non-ring send paths
Kyle Zeng <[email protected]>
ipvs: clear IPv4 options after rebasing tunnel ICMP errors
Julian Anastasov <[email protected]>
ipvs: properly update the overload flag on dest edit
Julian Anastasov <[email protected]>
ipvs: add totalconns for dest
Zhiling Zou <[email protected]>
ipvs: stop estimator after disabled calc phase
Lincoln Wallace <[email protected]>
ima: fix out-of-bounds read in xattr_verify()
Dmitry Torokhov <[email protected]>
Input: evdev - fix information leak in evdev_pass_values()
Joshua Rogers <[email protected]>
vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
Joshua Rogers <[email protected]>
vt: add permission check for KDSKBMETA ioctl
Yi Cong <[email protected]>
net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()
Sonali Pradhan <[email protected]>
usb: gadget: f_ncm: Use unsigned int for ndp_index
Pawel Laszczak <[email protected]>
usb: cdnsp: fix incorrect endian conversions for APB timeout register
Xu Rao <[email protected]>
thunderbolt: icm: Preserve USB4 proxy data-valid bit
Aleksandr Nogikh <[email protected]>
usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
Baul Lee <[email protected]>
ALSA: usb-audio: fix OOB write on Type II inbound URBs
Dmitry Torokhov <[email protected]>
Input: evdev - sanitize event type index when fetching event masks
Larisa Grigore <[email protected]>
spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers
Mehmet Fide <[email protected]>
net: fec: do not release NULL pages when RX buffer allocation fails
Qingshuang Fu <[email protected]>
hwmon: (ads7828) Fix external VREF regulator handling
David Lechner <[email protected]>
regulator: devres: add API for reference voltage supplies
Wilken Gottwalt <[email protected]>
hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination
Maximilian Immanuel Brandtner <[email protected]>
tls: don't abort the connection on signal-interrupted sends
Xin Long <[email protected]>
sctp: clear control chunk transport if it is being removed
Eric Dumazet <[email protected]>
net/atm: fix slab-out-of-bounds read in vcc_setsockopt()
Dmitry Safonov <[email protected]>
net/tcp: Add TCP-AO config and structures
Dmitry Safonov <[email protected]>
net/tcp: Prepare tcp_md5sig_pool for TCP-AO
Hongyan Xu <[email protected]>
ata: pata_sl82c105: fix bridge revision use-after-free
Fan XinRan <[email protected]>
net: thunderbolt: Tear down DMA paths before stopping the rings
Sidraya Jayagond <[email protected]>
net/smc: fix TOCTOU race between smc_listen_out() and listener close
Eric Dumazet <[email protected]>
net: remove WARN_ON_ONCE() from sk_mc_loop()
Pengpeng Hou <[email protected]>
net: prestera: validate firmware header length
Henry Martin <[email protected]>
net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
Jiayuan Chen <[email protected]>
tcp: fix TFO max_qlen accounting across reuseport migration
Qing Luo <[email protected]>
sctp: fix addip_serial increment on ASCONF_ACK allocation failure
Keegan Freyhof <[email protected]>
bnxt_en: Fix PTP PPS setting bug
Michael Chan <[email protected]>
bnxt_en: Disable EOP for TPA on all chips to prevent data corruption
Michael Chan <[email protected]>
bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips
Martin Kaiser <[email protected]>
selftests/ftrace: refactor eprobes test to fix argument checks
Guenter Roeck <[email protected]>
hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations
Rob Herring <[email protected]>
hwmon: (lm25066) Use i2c_get_match_data()
Qingshuang Fu <[email protected]>
hwmon: (nzxt-smart2) Check return value of init_device() in probe
Jamal Hadi Salim <[email protected]>
net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers
Xin Long <[email protected]>
net: sched: refine software bypass handling in tc_run
Jianbo Liu <[email protected]>
net: sched: cls_api: fix slab-use-after-free in fl_dump_key
Asbjørn Sloth Tønnesen <[email protected]>
net: sched: make skip_sw actually skip software
Asbjørn Sloth Tønnesen <[email protected]>
net: sched: cls_api: add filter counter
Asbjørn Sloth Tønnesen <[email protected]>
net: sched: cls_api: add skip_sw counter
Cen Zhang (Microsoft) <[email protected]>
net/openvswitch: check Ethernet header length in key_extract()
Toke Høiland-Jørgensen <[email protected]>
net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter
Xuanqiang Luo <[email protected]>
udp: fix potential use-after-free in tunnel segmentation
Nathan Gao <[email protected]>
tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss()
Yousef Alhouseen <[email protected]>
vhost/vdpa: reject overflowing PA map page counts on 32-bit
Jose Fernandez (Anthropic) <[email protected]>
bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
Jordan Rife <[email protected]>
bpf: tcp: Avoid socket skips and repeats during iteration
Jordan Rife <[email protected]>
bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items
Jordan Rife <[email protected]>
bpf: tcp: Get rid of st_bucket_done
Jordan Rife <[email protected]>
bpf: tcp: Make sure iter->batch always contains a full bucket snapshot
Jordan Rife <[email protected]>
bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch
Babanpreet Singh <[email protected]>
counter: microchip-tcb-capture: Fix DT channel validation
Michael Guralnik <[email protected]>
net/mlx5: fw_tracer, return NULL on create error
Or Har-Toov <[email protected]>
devlink: fix net namespace reference leak in reload
Jiawen Liu <[email protected]>
net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete
Jamal Hadi Salim <[email protected]>
net/sched: cls_route: fix fastmap use-after-free on filter
Mahanta Jambigi <[email protected]>
net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()
Yiyang Chen <[email protected]>
bpf: Preserve pointer state for commuted arithmetic
Dmitry Antipov <[email protected]>
btrfs: fix memory leak in btrfs_do_encoded_write()
Julian Anastasov <[email protected]>
ipvs: return the csum validation for forward hook
Julian Anastasov <[email protected]>
ipvs: avoid out-of-bounds write in ip_vs_nat_icmp
Jozsef Kadlecsik <[email protected]>
netfilter: ipset: switch ext_size to atomic64_t
Shay Drory <[email protected]>
net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock
Xiang Mei (Microsoft) <[email protected]>
bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
Fan Ye <[email protected]>
Revert "net: thunderbolt: Enable end-to-end flow control also in transmit"
Pengpeng Hou <[email protected]>
drm/bridge: ps8640: propagate AUX transfer register errors
Rosen Penev <[email protected]>
ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt
Yuho Choi <[email protected]>
ARM: npcm: Fix OF node refcount leaks in SMP setup
Anna Schumaker <[email protected]>
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
Harald Freudenberger <[email protected]>
s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()
Michal Luczaj <[email protected]>
selftests/bpf: Fail unbound UDP on sockmap update
Al Viro <[email protected]>
mount: honour SB_NOUSER in the new mount API
-------------
Diffstat:
.../bindings/crypto/qcom,inline-crypto-engine.yaml | 16 +- Documentation/driver-api/driver-model/devres.rst | 1 + Makefile | 4 +- arch/arm/boot/dts/broadcom/bcm-ns.dtsi | 2 +- arch/arm/mach-npcm/platsmp.c | 2 + arch/s390/kvm/pci.c | 86 +++-- arch/s390/kvm/pci.h | 2 + arch/x86/kvm/mmu/mmu.c | 3 + drivers/ata/pata_sl82c105.c | 4 +- drivers/counter/microchip-tcb-capture.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 35 +- drivers/gpu/drm/bridge/parade-ps8640.c | 27 +- drivers/hwmon/ads7828.c | 11 +- drivers/hwmon/corsair-psu.c | 4 +- drivers/hwmon/nzxt-smart2.c | 6 +- drivers/hwmon/pmbus/lm25066.c | 19 +- drivers/input/evdev.c | 27 +- drivers/misc/fastrpc.c | 19 +- drivers/misc/mei/client.c | 25 +- drivers/net/bonding/bond_alb.c | 10 +- drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 51 ++- drivers/net/ethernet/aquantia/atlantic/aq_ring.h | 1 + drivers/net/ethernet/aquantia/atlantic/aq_vec.c | 2 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 12 +- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 7 +- drivers/net/ethernet/freescale/fec_main.c | 11 +- drivers/net/ethernet/hisilicon/hix5hd2_gmac.c | 1 - .../net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 6 +- .../net/ethernet/marvell/prestera/prestera_pci.c | 3 + .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 16 +- .../net/ethernet/mellanox/mlx5/core/en/tc_priv.h | 1 + drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 4 +- drivers/net/thunderbolt/main.c | 33 +- drivers/net/usb/ax88179_178a.c | 4 +- drivers/net/veth.c | 22 +- drivers/net/vxlan/vxlan_core.c | 2 +- drivers/pinctrl/renesas/pinctrl-rzg2l.c | 4 +- drivers/ptp/ptp_ocp.c | 4 +- drivers/regulator/devres.c | 59 ++++ drivers/s390/crypto/zcrypt_ccamisc.c | 20 +- drivers/scsi/scsi_debug.c | 4 +- drivers/spi/spi-fsl-dspi.c | 13 +- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 3 + drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 2 +- drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 3 + drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 4 + drivers/thermal/thermal_hwmon.c | 3 +- drivers/thunderbolt/eeprom.c | 9 +- drivers/thunderbolt/icm.c | 2 +- drivers/tty/serial/8250/8250_dma.c | 12 +- drivers/tty/vt/keyboard.c | 5 +- drivers/tty/vt/vt_ioctl.c | 2 + drivers/usb/atm/cxacru.c | 2 + drivers/usb/cdns3/cdnsp-gadget.c | 4 +- drivers/usb/gadget/function/f_ncm.c | 2 +- drivers/vhost/vdpa.c | 9 +- drivers/vhost/vhost.c | 8 + drivers/video/fbdev/core/bitblit.c | 9 +- fs/btrfs/inode.c | 1 + fs/crypto/fscrypt_private.h | 32 +- fs/crypto/keyring.c | 212 +++++------ fs/crypto/policy.c | 2 +- fs/namespace.c | 5 + fs/nfs/nfs4proc.c | 5 + fs/overlayfs/super.c | 3 +- fs/smb/client/sess.c | 2 +- fs/tracefs/event_inode.c | 28 +- fs/tracefs/internal.h | 4 +- include/linux/netdevice.h | 11 +- include/linux/netfilter/ipset/ip_set.h | 2 +- include/linux/regulator/consumer.h | 7 + include/linux/tcp.h | 9 +- include/net/act_api.h | 19 + include/net/addrconf.h | 4 +- include/net/ip_vs.h | 41 +-- include/net/pkt_cls.h | 18 + include/net/route.h | 2 + include/net/sch_generic.h | 4 + include/net/tcp.h | 58 +-- include/net/tcp_ao.h | 90 +++++ include/uapi/linux/tcp.h | 2 + kernel/bpf/verifier.c | 15 +- kernel/futex/core.c | 82 +++-- kernel/sched/psi.c | 6 + kernel/trace/ring_buffer.c | 10 +- kernel/trace/trace_events.c | 2 + lib/.gitignore | 2 - lib/Makefile | 34 +- lib/test_fortify/.gitignore | 2 + lib/test_fortify/Makefile | 29 ++ net/atm/common.c | 14 +- net/bridge/br_mrp.c | 6 +- net/bridge/netfilter/ebt_nflog.c | 17 +- net/bridge/netfilter/nf_conntrack_bridge.c | 1 + net/core/dev.c | 13 + net/core/sock.c | 1 - net/core/xdp.c | 2 +- net/devlink/dev.c | 1 + net/ipv4/Kconfig | 17 + net/ipv4/Makefile | 1 + net/ipv4/fib_semantics.c | 101 +++--- net/ipv4/inet_connection_sock.c | 20 +- net/ipv4/route.c | 29 ++ net/ipv4/tcp.c | 145 ++------ net/ipv4/tcp_bpf.c | 2 + net/ipv4/tcp_input.c | 2 +- net/ipv4/tcp_ipv4.c | 390 ++++++++++++++------- net/ipv4/tcp_minisocks.c | 21 +- net/ipv4/tcp_sigpool.c | 357 +++++++++++++++++++ net/ipv4/udp_offload.c | 4 +- net/ipv6/ip6_tunnel.c | 3 + net/ipv6/route.c | 8 +- net/ipv6/tcp_ipv6.c | 60 ++-- net/mac802154/scan.c | 4 + net/ncsi/ncsi-netlink.c | 4 + net/netfilter/ipset/ip_set_bitmap_gen.h | 4 +- net/netfilter/ipset/ip_set_core.c | 6 +- net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipset/ip_set_list_set.c | 4 +- net/netfilter/ipvs/ip_vs_conn.c | 41 +-- net/netfilter/ipvs/ip_vs_core.c | 70 ++-- net/netfilter/ipvs/ip_vs_ctl.c | 77 +++- net/netfilter/ipvs/ip_vs_est.c | 10 +- net/netfilter/ipvs/ip_vs_lc.c | 4 +- net/netfilter/ipvs/ip_vs_proto_sctp.c | 4 +- net/netfilter/ipvs/ip_vs_proto_tcp.c | 2 - net/netfilter/ipvs/ip_vs_sync.c | 7 +- net/netfilter/ipvs/ip_vs_xmit.c | 2 +- net/netfilter/nf_conntrack_proto.c | 6 + net/netfilter/nf_conntrack_proto_sctp.c | 12 +- net/netfilter/nf_conntrack_proto_tcp.c | 132 ++++--- net/openvswitch/datapath.c | 29 +- net/openvswitch/flow.c | 11 +- net/packet/af_packet.c | 72 ++-- net/sched/act_ct.c | 29 +- net/sched/act_gact.c | 5 + net/sched/act_police.c | 6 + net/sched/cls_api.c | 47 ++- net/sched/cls_bpf.c | 2 + net/sched/cls_flower.c | 2 + net/sched/cls_matchall.c | 2 + net/sched/cls_route.c | 35 +- net/sched/cls_u32.c | 4 + net/sched/sch_api.c | 9 + net/sched/sch_cake.c | 1 - net/sctp/associola.c | 11 +- net/sctp/outqueue.c | 1 + net/sctp/sm_make_chunk.c | 3 +- net/sctp/sm_statefuns.c | 6 +- net/smc/af_smc.c | 3 +- net/smc/smc_llc.c | 3 +- net/smc/smc_rx.c | 19 +- net/tipc/node.c | 15 +- net/tls/tls_sw.c | 16 +- net/vmw_vsock/virtio_transport.c | 14 +- scripts/remove-stale-files | 2 + security/integrity/ima/ima_appraise.c | 9 +- sound/usb/endpoint.c | 6 +- sound/usb/midi2.c | 9 + sound/usb/usx2y/usX2Yhwdep.c | 2 + sound/usb/usx2y/usx2yhwdeppcm.c | 2 + .../selftests/bpf/prog_tests/sockmap_listen.c | 21 +- tools/testing/selftests/bpf/test_maps.c | 13 +- .../ftrace/test.d/dynevent/add_remove_eprobe.tc | 16 +- 166 files changed, 2407 insertions(+), 1036 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/156 mount: honour SB_NOUSER in the new mount API
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit 6dd3c6884cd9defb511284b566cef5ac8f657dbf ]
One should *not* be allowed to mount one of those, new API or not.
--- fs/namespace.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/namespace.c +5 -0
@@ -4050,6 +4050,11 @@ SYSCALL_DEFINE3(fsmount, int, fs_fd, unsigned int, flags, ret =PTR_ERR (newmount.mnt); goto err_unlock; } +if (newmount.mnt->mnt_sb->s_flags &SB_NOUSER ) { +mntput (newmount.mnt); + ret = -EINVAL ; + goto err_unlock; + } newmount.dentry =dget (fc->root); newmount.mnt->mnt_flags = mnt_flags;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 2/156 selftests/bpf: Fail unbound UDP on sockmap update
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Luczaj <[email protected]>
[ Upstream commit 203b06932777b9ad5085319389dea566f5c2ca63 ]
sockmap now rejects unbound UDP sockets. Adjust test_maps. While at it, check socket()'s return value.
This effectively reverts commit c39aa2159974 ("bpf, selftests: Fix test_maps now that sockmap supports UDP").
--- tools/testing/selftests/bpf/test_maps.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
tools/testing/selftests/bpf/test_maps.c +6 -7
@@ -752,16 +752,15 @@ static void test_sockmap(unsigned int tasks, void *data) goto out_sockmap; } -/* Test update with unsupported UDP socket */ +/* Test update with unsupported unbound UDP socket */ udp =socket (AF_INET ,SOCK_DGRAM ,0 ); - i =0 ; - err =bpf_map_update_elem (fd, &i, &udp,BPF_ANY ); -if (err) { -printf ("Failed socket update SOCK_DGRAM '%i:%i'\n" , - i, udp); +CHECK (udp <0 ,"socket(AF_INET, SOCK_DGRAM)" ,"errno:%d\n" , errno); + err =bpf_map_update_elem (fd, &(int ){0 }, &udp,BPF_ANY ); +close (udp); +if (!err) { +printf ("Unexpectedly succeeded unbound UDP update '0:%i'\n" , udp); goto out_sockmap; } -close (udp);/* Test update without programs */ for (i =0 ; i <6 ; i++) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 3/156 s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harald Freudenberger <[email protected]>
[ Upstream commit 01476391aecef36a3b789ee844357b22fbc90665 ]
The helper function _ip_cprb_helper() uses internal buffer memory for building and processing CPRBs. After use this buffer was never scrubbed which could lead to leaving for example clear key material in memory which could be exposed via tricky reuse of this same memory.
Extend the _ip_cprb_helper() function with another parameter 'scrub' used to steer scrubbing of this buffer. So now the caller has the opportunity to decide if scrubbing is needed or not.
Extend the clear key to secure key token import process in function cca_clr2cipherkey() to tell the helper function from above to scrub the cprb buffer when the clear key value is part of the request data.
Add explicit scrubbing on return from function cca_clr2cipherkey() for the random EXOR buffer and the cprb buffer.
Overall this cleans the internal used buffer in case of clear key import to prevent sensitive data to get exposed.
--- drivers/s390/crypto/zcrypt_ccamisc.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-)
drivers/s390/crypto/zcrypt_ccamisc.c +13 -7
@@ -946,7 +946,8 @@ static int _ip_cprb_helper(u16 cardnr, u16 domain,const u8 *clr_key_value, int clr_key_bit_size, u8 *key_token, - int *key_token_size) + int *key_token_size, + bool scrub) { int rc, n;u8 *mem, *ptr;
@@ -1087,7 +1088,7 @@ static int _ip_cprb_helper(u16 cardnr, u16 domain, *key_token_size = t->len; out: -free_cprbmem (mem,PARMBSIZE ,0 ); +free_cprbmem (mem,PARMBSIZE , scrub);return rc; }
@@ -1130,7 +1131,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags,* 4/4 COMPLETE the secure cipher key import */ rc =_ip_cprb_helper (card, dom,"AES " ,"FIRST " ,"MIN3PART" , - exorbuf, keybitsize, token, &tokensize); + exorbuf, keybitsize, token, &tokensize, + true);if (rc) { DEBUG_ERR( "%s clear key import 1/4 with CSNBKPI2 failed, rc=%d\n",
@@ -1138,7 +1140,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags, goto out; } rc =_ip_cprb_helper (card, dom,"AES " ,"ADD-PART" ,NULL , - clrkey, keybitsize, token, &tokensize); + clrkey, keybitsize, token, &tokensize, + true);if (rc) { DEBUG_ERR( "%s clear key import 2/4 with CSNBKPI2 failed, rc=%d\n",
@@ -1146,7 +1149,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags, goto out; } rc =_ip_cprb_helper (card, dom,"AES " ,"ADD-PART" ,NULL , - exorbuf, keybitsize, token, &tokensize); + exorbuf, keybitsize, token, &tokensize, + true);if (rc) { DEBUG_ERR( "%s clear key import 3/4 with CSNBKPI2 failed, rc=%d\n",
@@ -1154,7 +1158,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags, goto out; } rc =_ip_cprb_helper (card, dom,"AES " ,"COMPLETE" ,NULL , -NULL , keybitsize, token, &tokensize); +NULL , keybitsize, token, &tokensize, + true);if (rc) { DEBUG_ERR( "%s clear key import 4/4 with CSNBKPI2 failed, rc=%d\n",
@@ -1172,7 +1177,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags, *keybufsize = tokensize; out: -kfree (token); +memzero_explicit (exorbuf,sizeof (exorbuf)); +kfree_sensitive (token);return rc; }EXPORT_SYMBOL (cca_clr2cipherkey);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 4/156 NFS: Pin the struct nfs_server during a FREE_STATEID call
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anna Schumaker <[email protected]>
[ Upstream commit cf616096a0f3a2b60f7d68b6b39674a6867ded9c ]
Dan Aloni reports that he was able to hit a use-after-free bug if a FREE_STATEID operation gets delayed for whatever reason. Fix this by bumping the refcount of the 'struct nfs_server' object for the duration of the FREE_STATEID so it doesn't get cleaned up from underneath us while operations are still in flight.
--- fs/nfs/nfs4proc.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/nfs/nfs4proc.c +5 -0
@@ -10383,6 +10383,7 @@ static void nfs41_free_stateid_release(void *calldata)struct nfs_free_stateid_data *data = calldata;struct nfs_client *clp = data->server->nfs_client; +nfs_sb_deactive (data->server->super);nfs_put_client (clp);kfree (calldata); }
@@ -10424,6 +10425,10 @@ static int nfs41_free_stateid(struct nfs_server *server,if (!refcount_inc_not_zero (&clp->cl_count))return -EIO ; +if (!nfs_sb_active (server->super)) { +nfs_put_client (clp); +return -EIO ; + }nfs4_state_protect (server->nfs_client,NFS_SP4_MACH_CRED_STATEID , &task_setup.rpc_client, &msg);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 5/156 ARM: npcm: Fix OF node refcount leaks in SMP setup
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuho Choi <[email protected]>
[ Upstream commit 8eb052f48331474c2789d07b7f11165c323bd2f9 ]
npcm7xx_smp_boot_secondary() and npcm7xx_smp_prepare_cpus() look up the GCR and SCU nodes with of_find_compatible_node(). The returned nodes are used for of_iomap(), but the node references are never released.
of_iomap() does not consume the device node reference, and iounmap() only releases the MMIO mapping. Drop each node reference after the corresponding mapping attempt.
--- arch/arm/mach-npcm/platsmp.c | 2 ++ 1 file changed, 2 insertions(+)
arch/arm/mach-npcm/platsmp.c +2 -0
@@ -32,6 +32,7 @@ static int npcm7xx_smp_boot_secondary(unsigned int cpu, goto out; } gcr_base =of_iomap (gcr_np,0 ); +of_node_put (gcr_np);if (!gcr_base) {pr_err ("could not iomap gcr" ); ret = -ENOMEM ;
@@ -60,6 +61,7 @@ static void __init npcm7xx_smp_prepare_cpus(unsigned int max_cpus)return ; } scu_base =of_iomap (scu_np,0 ); +of_node_put (scu_np);if (!scu_base) {pr_err ("could not iomap scu" );return ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 6/156 ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <[email protected]>
[ Upstream commit bab4d538f8485e0d48538fcb82b285df3779278e ]
PCIe controller 2 has interrupts 0-4 mapping to GIC SPI 138-142. The mapping for interrupt 1 was incorrectly set to 138 due to a copy-paste error. Fix it to 139.
--- arch/arm/boot/dts/broadcom/bcm-ns.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/broadcom/bcm-ns.dtsi +1 -1
@@ -131,7 +131,7 @@ axi@18000000 { /* PCIe Controller 2 */ <0x00014000 0 &gic GIC_SPI 138 IRQ_TYPE_LEVEL_HIGH>, - <0x00014000 1 &gic GIC_SPI 138 IRQ_TYPE_LEVEL_HIGH>, + <0x00014000 1 &gic GIC_SPI 139 IRQ_TYPE_LEVEL_HIGH>, <0x00014000 2 &gic GIC_SPI 140 IRQ_TYPE_LEVEL_HIGH>, <0x00014000 3 &gic GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>, <0x00014000 4 &gic GIC_SPI 142 IRQ_TYPE_LEVEL_HIGH>,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 7/156 drm/bridge: ps8640: propagate AUX transfer register errors
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit 20697ecb299cd77b4cf8b28f655e56606b0472d8 ]
ps8640_aux_transfer_msg() programs the AUX address registers, starts the AUX transfer, waits for SWAUX_SEND to clear, and reads the AUX status register. Several of those regmap operations have return values, but the function only checks a stale ret after the status read.
Propagate failures from the address write, transfer start, completion poll, and status read. This avoids returning a transfer length when the bridge register transaction or AUX completion wait failed.
--- drivers/gpu/drm/bridge/parade-ps8640.c | 27 ++++++++++++++++++++------ 1 file changed, 21 insertions(+), 6 deletions(-)
drivers/gpu/drm/bridge/parade-ps8640.c +21 -6
@@ -258,8 +258,14 @@ static ssize_t ps8640_aux_transfer_msg(struct drm_dp_aux *aux, addr_len[PAGE0_SWAUX_LENGTH - base] = (len ==0 ) ?SWAUX_NO_PAYLOAD : ((len -1 ) &SWAUX_LENGTH_MASK ); -regmap_bulk_write (map,PAGE0_SWAUX_ADDR_7_0 , addr_len, -ARRAY_SIZE (addr_len)); + ret =regmap_bulk_write (map,PAGE0_SWAUX_ADDR_7_0 , addr_len, +ARRAY_SIZE (addr_len)); +if (ret) { +DRM_DEV_ERROR (dev, +"failed to write AUX address %#x, len %zu: %d\n" , + msg->address, len, ret); +return ret; + }if (len && (request ==DP_AUX_NATIVE_WRITE || request ==DP_AUX_I2C_WRITE )) {
@@ -275,13 +281,22 @@ static ssize_t ps8640_aux_transfer_msg(struct drm_dp_aux *aux, } } -regmap_write (map,PAGE0_SWAUX_CTRL ,SWAUX_SEND ); + ret =regmap_write (map,PAGE0_SWAUX_CTRL ,SWAUX_SEND ); +if (ret) { +DRM_DEV_ERROR (dev,"failed to start AUX transfer: %d\n" , ret); +return ret; + }/* Zero delay loop because i2c transactions are slow already */ -regmap_read_poll_timeout (map,PAGE0_SWAUX_CTRL , data, - !(data &SWAUX_SEND ),0 ,50 *1000 ); + ret =regmap_read_poll_timeout (map,PAGE0_SWAUX_CTRL , data, + !(data &SWAUX_SEND ),0 ,50 *1000 ); +if (ret) { +DRM_DEV_ERROR (dev,"failed to complete AUX transfer: %d\n" , + ret); +return ret; + } -regmap_read (map,PAGE0_SWAUX_STATUS , &data); + ret =regmap_read (map,PAGE0_SWAUX_STATUS , &data);if (ret) {DRM_DEV_ERROR (dev,"failed to read PAGE0_SWAUX_STATUS: %d\n" , ret);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 8/156 Revert "net: thunderbolt: Enable end-to-end flow control also in transmit"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Ye <[email protected]>
[ Upstream commit 1881f2efbf7f78dc0a79a387b29fde6ff56d3731 ]
This reverts commit a8065af3346ebd7c76ebc113451fb3ba94cf7769.
Per the USB4 spec, a Transmit Descriptor Ring with E2E flow control disabled does not require any credits to be available before the Host Interface Adapter Layer transmits a tunneled packet from it. Once E2E is enabled on that ring the controller must first obtain end-to-end credits.
The ASMedia ASM4242 USB4 host router (PCI 1b21:2425) never delivers those credits. The controller does accept the configuration: reading the ring OPTIONS register back right after tb_ring_start() returns exactly what was written, including RING_FLAG_E2E_FLOW_CONTROL (bit 28) and the E2E HopID field. No credit ever arrives though, so the Tx ring's hardware consumer index never advances and the link carries no traffic at all.
Measured on two hosts connected point to point, onboard ASM4242 on MSI X870E and X870, v6.17, stock drivers/net/thunderbolt/main.c with only this revert applied on top:
before: 100% packet loss to the peer; thunderbolt0 is up and the
XDomain handshake completes ("new host found"), but iperf3 fails with "No route to host" once the neighbour entry expires
after: 0% packet loss, 0.28 ms RTT; iperf3 4.21 Gb/s one way and
5.17 Gb/s the other (5 runs each, stddev <= 0.02), 1 retransmit in 10 s
An instrumented build additionally showed a frozen-Tx-consumer watchdog firing ~30k times in a 10 s window before this change.
Rx-side E2E is not touched by this revert, so peers that do return credits keep receive-side flow control.
ASMedia does not look like an isolated case. The out-of-tree thunderbolt-ibverbs project disables native E2E on AMD NHI by default, noting that "Strix Halo has reproduced TX completion wedges with multiple native E2E rings active" -- the same failure mode, on a different vendor. Since the driver has no way to tell in advance which host router returns the credits, going back to the previous behaviour looks safer than adding a quirk per affected part; Tx-side E2E can be reintroduced as an opt-in for controllers that are known to implement the credit return.
Note that the reverted commit was not fixing a reported problem, it was derived from the spec wording alone, so this revert is not expected to regress a known workload. Cc'ing the original author in case there was one.
--- drivers/net/thunderbolt/main.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
drivers/net/thunderbolt/main.c +7 -6
@@ -928,12 +928,8 @@ static int tbnet_open(struct net_device *dev)netif_carrier_off (dev); - flags =RING_FLAG_FRAME ; -/* Only enable full E2E if the other end supports it too */ -if (tbnet_e2e && net->svc->prtcstns &TBNET_E2E ) - flags |=RING_FLAG_E2E ; - - ring =tb_ring_alloc_tx (xd->tb->nhi,-1 ,TBNET_RING_SIZE , flags); + ring =tb_ring_alloc_tx (xd->tb->nhi,-1 ,TBNET_RING_SIZE , +RING_FLAG_FRAME );if (!ring) {netdev_err (dev,"failed to allocate Tx ring\n" );return -ENOMEM ;
@@ -952,6 +948,11 @@ static int tbnet_open(struct net_device *dev) sof_mask =BIT (TBIP_PDF_FRAME_START ); eof_mask =BIT (TBIP_PDF_FRAME_END ); + flags =RING_FLAG_FRAME ; +/* Only enable full E2E if the other end supports it too */ +if (tbnet_e2e && net->svc->prtcstns &TBNET_E2E ) + flags |=RING_FLAG_E2E ; + ring =tb_ring_alloc_rx (xd->tb->nhi,-1 ,TBNET_RING_SIZE , flags, net->tx_ring.ring->hop, sof_mask, eof_mask, tbnet_start_poll, net);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 9/156 bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei (Microsoft) <[email protected]>
[ Upstream commit 683c6ba6e58e6ed1037831ea97dd58d9c0e76b8d ]
bond_alb_monitor() reads primary_is_promisc under RCU, then drops RCU and takes RTNL via rtnl_trylock() before undoing the promiscuity it set on the active slave. In that window the active slave can change under RTNL (RTM_DELLINK -> __bond_release_one() -> bond_alb_handle_active_change()), which already drops the promiscuity and clears primary_is_promisc. The monitor still acts on the stale decision: if the slave was removed with no failover, curr_active_slave is now NULL and the deref faults; if it failed over, the stale dev_set_promiscuity(-1) underflows the new slave's promiscuity counter and pins it in IFF_PROMISC.
Oops: general protection fault, probably for non-canonical address ... KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] Workqueue: b42 bond_alb_monitor RIP: 0010:bond_alb_monitor (drivers/net/bonding/bond_alb.c:1600) process_one_work (kernel/workqueue.c:3322) worker_thread (kernel/workqueue.c:3486) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) Kernel panic - not syncing: Fatal exception
Re-check primary_is_promisc (and curr_active_slave) after taking RTNL so the monitor only undoes an increment it still owns. The other bonding monitors already re-read state under RTNL in their commit phase (bond_miimon_commit/bond_ab_arp_commit); bond_alb_monitor() was the only one acting on the pre-trylock decision.
--- drivers/net/bonding/bond_alb.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/net/bonding/bond_alb.c +6 -4
@@ -1535,8 +1535,8 @@ void bond_alb_monitor(struct work_struct *work) struct bonding *bond = container_of(work, struct bonding, alb_work.work);struct alb_bond_info *bond_info = &(BOND_ALB_INFO (bond)); +struct slave *slave, *curr;struct list_head *iter; -struct slave *slave;if (!bond_has_slaves (bond)) {atomic_set (&bond_info->tx_rebalance_counter,0 );
@@ -1598,9 +1598,11 @@ void bond_alb_monitor(struct work_struct *work)* because a slave was disabled then * it can now leave promiscuous mode. */ -dev_set_promiscuity (rtnl_dereference (bond->curr_active_slave)->dev, --1 ); - bond_info->primary_is_promisc =0 ; + curr =rtnl_dereference (bond->curr_active_slave); +if (bond_info->primary_is_promisc && curr) { +dev_set_promiscuity (curr->dev,-1 ); + bond_info->primary_is_promisc =0 ; + }rtnl_unlock ();rcu_read_lock ();
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 10/156 net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shay Drory <[email protected]>
[ Upstream commit 6ddfba2ea98db21b001e0e5c472499156224650c ]
In case __mlx5e_add_fdb_flow() fails in lower levels, the flow is deleted via mlx5e_tc_del_flow(), and mlx5e_tc_del_flow() is acquiring ESW devcom lock without condition. In addition, in case of peer_flow, __mlx5e_add_fdb_flow() is called while holding ESW devcom comp lock. This results in an AA deadlock.
To fix this, introduce a new PEER flag that is set on flows created as peer flows (the duplicate flows on peer devices), and check it in mlx5e_tc_del_flow() before acquiring ESW devcom lock.
Lockdep splat:
============================================
WARNING: possible recursive locking detected
============================================
Possible unsafe locking scenario:
CPU0
----
lock(&comp->lock_key#2);
lock(&comp->lock_key#2);
*** DEADLOCK ***
Call Trace:
<TASK>
dump_stack_lvl+0x69/0xa0
print_deadlock_bug.cold+0xbd/0xca
__lock_acquire+0x1671/0x2ec0
lock_acquire+0x10e/0x2e0
down_read+0x95/0x430
mlx5_devcom_for_each_peer_begin+0x4e/0xe0 [mlx5_core]
mlx5e_tc_del_flow+0x11d/0xa70 [mlx5_core]
mlx5e_flow_put+0x99/0x100 [mlx5_core]
__mlx5e_add_fdb_flow+0x409/0xf00 [mlx5_core]
mlx5e_configure_flower+0x2a86/0x4100 [mlx5_core]
mlx5e_rep_setup_tc_cls_flower+0x12f/0x1b0 [mlx5_core]
mlx5e_rep_setup_tc_cb+0x153/0x750 [mlx5_core]
tc_setup_cb_add+0x1dc/0x470
fl_change+0x2f4d/0x626d [cls_flower]
tc_new_tfilter+0x79b/0x2310
rtnetlink_rcv_msg+0x778/0xad0
do_syscall_64+0x70/0x960
entry_SYSCALL_64_after_hwframe+0x4b/0x53
</TASK>--- drivers/net/ethernet/mellanox/mlx5/core/en/tc_priv.h | 1 + drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en/tc_priv.h +1 -0
@@ -30,6 +30,7 @@ enum {MLX5E_TC_FLOW_FLAG_FAILED =MLX5E_TC_FLOW_BASE +9 ,MLX5E_TC_FLOW_FLAG_SAMPLE =MLX5E_TC_FLOW_BASE +10 ,MLX5E_TC_FLOW_FLAG_USE_ACT_STATS =MLX5E_TC_FLOW_BASE +11 , + MLX5E_TC_FLOW_FLAG_PEER = MLX5E_TC_FLOW_BASE + 12, }; struct mlx5e_tc_flow_parse_attr {
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +3 -1
@@ -2043,7 +2043,8 @@ static void mlx5e_tc_del_flow(struct mlx5e_priv *priv,if (mlx5e_is_eswitch_flow (flow)) {struct mlx5_devcom_comp_dev *devcom = flow->priv->mdev->priv.eswitch->devcom; -if (!mlx5_devcom_for_each_peer_begin (devcom)) { +if (flow_flag_test (flow,PEER ) || + !mlx5_devcom_for_each_peer_begin (devcom)) {mlx5e_tc_del_fdb_flow (priv, flow);return ; }
@@ -4489,6 +4490,7 @@ static int mlx5e_tc_add_fdb_peer_flow(struct flow_cls_offload *f,else in_mdev = priv->mdev; + flow_flags |=BIT (MLX5E_TC_FLOW_FLAG_PEER ); parse_attr = flow->attr->parse_attr; peer_flow = __mlx5e_add_fdb_flow(peer_priv, f, flow_flags, parse_attr->filter_dev,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 11/156 netfilter: ipset: switch ext_size to atomic64_t
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jozsef Kadlecsik <[email protected]>
[ Upstream commit 712a6f545c359b427daa9a5a782e30d2f8331e25 ]
The hash types do not acquire set->lock, they use 'region locking' where only part of the hash table is locked. Parallel inserts and deletes are possible and CPUs can race on ->ext_size update. Switch to atomic64_t.
This leaves another bug unresolved: there still can be a race on comment extension re-init. This will be handled in a later commit when converting to rhashtable backend.
--- include/linux/netfilter/ipset/ip_set.h | 2 +- net/netfilter/ipset/ip_set_bitmap_gen.h | 4 ++-- net/netfilter/ipset/ip_set_core.c | 6 +++--- net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipset/ip_set_list_set.c | 4 ++-- 5 files changed, 9 insertions(+), 9 deletions(-)
include/linux/netfilter/ipset/ip_set.h +1 -1
@@ -273,7 +273,7 @@ struct ip_set {/* Number of elements (vs timeout) */ u32 elements;/* Size of the dynamic extensions (vs timeout) */ -size_t ext_size; +atomic64_t ext_size;/* Element data size */ size_t dsize;/* Offsets to extensions in elements */
net/netfilter/ipset/ip_set_bitmap_gen.h +2 -2
@@ -75,7 +75,7 @@ mtype_flush(struct ip_set *set)mtype_ext_cleanup (set);bitmap_zero (map->members, map->elements); set->elements =0 ; - set->ext_size =0 ; +atomic64_set (&set->ext_size,0 ); }/* Calculate the actual memory size of the set data */
@@ -91,7 +91,7 @@ mtype_head(struct ip_set *set, struct sk_buff *skb) {const struct mtype *map = set->data;struct nlattr *nested; -size_t memsize =mtype_memsize (map, set->dsize) + set->ext_size; +size_t memsize =mtype_memsize (map, set->dsize) +atomic64_read (&set->ext_size); nested =nla_nest_start (skb,IPSET_ATTR_DATA );if (!nested)
net/netfilter/ipset/ip_set_core.c +3 -3
@@ -350,7 +350,7 @@ ip_set_init_comment(struct ip_set *set, struct ip_set_comment *comment,size_t len = ext->comment ?strlen (ext->comment) :0 ;if (unlikely (c)) { - set->ext_size -=sizeof (*c) +strlen (c->str) +1 ; +atomic64_sub (sizeof (*c) +strlen (c->str) +1 , &set->ext_size);rcu_assign_pointer (comment->c,NULL );kfree_rcu (c, rcu); }
@@ -362,7 +362,7 @@ ip_set_init_comment(struct ip_set *set, struct ip_set_comment *comment,if (unlikely (!c))return ;strscpy (c->str, ext->comment, len +1 ); - set->ext_size +=sizeof (*c) +strlen (c->str) +1 ; +atomic64_add (sizeof (*c) +strlen (c->str) +1 , &set->ext_size);rcu_assign_pointer (comment->c, c); }EXPORT_SYMBOL_GPL (ip_set_init_comment);
@@ -392,7 +392,7 @@ ip_set_comment_free(struct ip_set *set, void *ptr) c =rcu_dereference_protected (comment->c,1 );if (unlikely (!c))return ; - set->ext_size -=sizeof (*c) +strlen (c->str) +1 ; +atomic64_sub (sizeof (*c) +strlen (c->str) +1 , &set->ext_size);rcu_assign_pointer (comment->c,NULL );kfree_rcu (c, rcu); }
net/netfilter/ipset/ip_set_hash_gen.h +1 -1
@@ -1288,7 +1288,7 @@ mtype_head(struct ip_set *set, struct sk_buff *skb)rcu_read_lock_bh (); t =rcu_dereference_bh (h->table);mtype_ext_size (set, &elements, &ext_size); - memsize =mtype_ahash_memsize (h, t) + ext_size + set->ext_size; + memsize =mtype_ahash_memsize (h, t) + ext_size +atomic64_read (&set->ext_size); htable_bits = t->htable_bits;rcu_read_unlock_bh ();
net/netfilter/ipset/ip_set_list_set.c +2 -2
@@ -421,7 +421,7 @@ list_set_flush(struct ip_set *set)list_for_each_entry_safe (e, n, &map->members, list)list_set_del (set, e); set->elements =0 ; - set->ext_size =0 ; +atomic64_set (&set->ext_size,0 ); } static void
@@ -455,7 +455,7 @@ list_set_head(struct ip_set *set, struct sk_buff *skb) {const struct list_set *map = set->data;struct nlattr *nested; -size_t memsize =list_set_memsize (map, set->dsize) + set->ext_size; +size_t memsize =list_set_memsize (map, set->dsize) +atomic64_read (&set->ext_size); nested =nla_nest_start (skb,IPSET_ATTR_DATA );if (!nested)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 12/156 ipvs: avoid out-of-bounds write in ip_vs_nat_icmp
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Anastasov <[email protected]>
[ Upstream commit 646922a0379496154e8c8faca4f8e2fd9100cacc ]
Sashiko warns that local attacker can modify the packet while it is processed by IPVS. Some places read the IP ihl field multiple times which can cause out-of-bounds access. One such place is ip_vs_nat_icmp where we can write after the validated area.
Fix it by providing ciph argument just like it is done for IPv6 and use ciph->len as offset to the embedded transport header.
Modify some IPv4 header checks by reading the ihl field only once.
--- include/net/ip_vs.h | 2 +- net/netfilter/ipvs/ip_vs_core.c | 67 +++++++++++++++++---------------- net/netfilter/ipvs/ip_vs_xmit.c | 2 +- 3 files changed, 36 insertions(+), 35 deletions(-)
include/net/ip_vs.h +1 -1
@@ -1707,7 +1707,7 @@ static inline char ip_vs_fwd_tag(struct ip_vs_conn *cp)void ip_vs_nat_icmp (struct sk_buff *skb,struct ip_vs_protocol *pp,struct ip_vs_conn *cp,int dir,unsigned int toff, -bool has_ports); +bool has_ports,struct ip_vs_iphdr *ciph);#ifdef CONFIG_IP_VS_IPV6 void ip_vs_nat_icmp_v6(struct sk_buff *skb, struct ip_vs_protocol *pp,
net/netfilter/ipvs/ip_vs_core.c +34 -33
180 lines not on this page · raw message
net/netfilter/ipvs/ip_vs_xmit.c +1 -1
@@ -1551,7 +1551,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,if (skb_cow (skb, rt->dst.dev->hard_header_len)) goto tx_error; -ip_vs_nat_icmp (skb, pp, cp,0 , toff, has_ports); +ip_vs_nat_icmp (skb, pp, cp,0 , toff, has_ports, ciph);/* Another hack: avoid icmp_send in ip_fragment */ skb->ignore_df =1 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 13/156 ipvs: return the csum validation for forward hook
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Anastasov <[email protected]>
[ Upstream commit 99609cb0aa789c8d071050ce8579989551882cc6 ]
Sashiko notes that playing games with the skb dst and rt flags instead of providing hooknum is not a good idea when validating the checksums.
Also, skipping checksum validation for FORWARD packets risk silent data corruption, even if the only user is the FTP-CMD packets coming from the real server.
Sashiko also noticed that by using common checksum helper in the previous commit we actually fixed old bug where the TCP/UDP checksum for IPv6 on CHECKSUM_COMPLETE was not validated correctly.
--- include/net/ip_vs.h | 19 +++++-------------- net/netfilter/ipvs/ip_vs_proto_sctp.c | 2 +- 2 files changed, 6 insertions(+), 15 deletions(-)
include/net/ip_vs.h +5 -14
@@ -24,9 +24,7 @@#include <linux/netfilter.h> /* for union nf_inet_addr */ #include <linux/ip.h> #include <linux/ipv6.h> /* for struct ipv6hdr */ -#include <net/route.h> #include <net/ipv6.h> -#include <net/ip6_fib.h> #if IS_ENABLED (CONFIG_NF_CONNTRACK )#include <net/netfilter/nf_conntrack.h> #endif
@@ -1740,30 +1738,23 @@ static inline __wsum ip_vs_check_diff2(__be16 old, __be16 new, __wsum oldsum)return csum_partial (diff,sizeof (diff), oldsum); } -static inline bool ip_vs_checksum_needed (struct sk_buff *skb,int af) +static inline bool ip_vs_checksum_needed (struct sk_buff *skb) {/* Checksum unnecessary or already validated? */ if (skb_csum_unnecessary (skb))return false; -/* LOCAL_OUT ? */ -if (!skb->dev || skb->dev->flags &IFF_LOOPBACK ) +/* Locally generated ? */ +if (!skb->dev)return false; -/* !LOCAL_IN (FORWARD) ? */ -if (af ==AF_INET6 ) { -if (!(dst_rt6_info (skb_dst (skb))->rt6i_flags &RTF_LOCAL )) -return false; - }else { -if (!(skb_rtable (skb)->rt_flags &RTCF_LOCAL )) -return false; - }return true; }static inline bool ip_vs_checksum_common_check (struct sk_buff *skb,int offset,int proto,int af) { -if (!ip_vs_checksum_needed (skb, af)) +if (!ip_vs_checksum_needed (skb))return true; +/* Validate csum even for FORWARD */ return !nf_checksum (skb,NF_INET_LOCAL_IN , offset, proto, af); }
net/netfilter/ipvs/ip_vs_proto_sctp.c +1 -1
@@ -193,7 +193,7 @@ sctp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp,struct sctphdr *sh;__le32 cmp, val; -if (!ip_vs_checksum_needed (skb, af)) +if (!ip_vs_checksum_needed (skb))return 1 ; sh = (struct sctphdr *)(skb->data + sctphoff); cmp = sh->checksum;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 14/156 btrfs: fix memory leak in btrfs_do_encoded_write()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit d2a4e4e626b2f4670b69b430c357f03f53eb6632 ]
Local fuzzing of 6.12.94 has found the following memory leak:
Unreferenced object 0xffff888018050a80 (size 64):
comm "syz.0.17", pid 10297, jiffies 4294953601 hex dump (first 32 bytes):
00 10 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................
10 0a 05 18 80 88 ff ff 10 0a 05 18 80 88 ff ff ................
backtrace (crc a8a6fc29):
kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
slab_post_alloc_hook mm/slub.c:4152 [inline]
slab_alloc_node mm/slub.c:4197 [inline]
__kmalloc_cache_noprof+0x168/0x2c0 mm/slub.c:4358
kmalloc_noprof include/linux/slab.h:878 [inline]
extent_changeset_alloc fs/btrfs/extent_io.h:207 [inline]
qgroup_reserve_data+0x1c5/0x7d0 fs/btrfs/qgroup.c:4305
btrfs_qgroup_reserve_data+0x2e/0xb0 fs/btrfs/qgroup.c:4355
btrfs_do_encoded_write+0x92e/0x1040 fs/btrfs/inode.c:9746
btrfs_encoded_write fs/btrfs/file.c:1482 [inline]
btrfs_do_write_iter+0x280/0x610 fs/btrfs/file.c:1507
btrfs_ioctl_encoded_write+0x3d6/0x490 fs/btrfs/ioctl.c:4738
btrfs_ioctl+0x6f9/0xc90 fs/btrfs/ioctl.c:-1
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl+0xf9/0x170 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/common.c:47 [inline]
do_syscall_64+0xbe/0x1a0 arch/x86/entry/common.c:78
entry_SYSCALL_64_after_hwframe+0x77/0x7fUnreferenced object 0xffff888018050a00 (size 64):
comm "syz.0.17", pid 10297, jiffies 4294953601 hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 ff 0f 00 00 00 00 00 00 ................
90 0a 05 18 80 88 ff ff 90 0a 05 18 80 88 ff ff ................
backtrace (crc cb5c9580):
kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
slab_post_alloc_hook mm/slub.c:4152 [inline]
slab_alloc_node mm/slub.c:4197 [inline]
__kmalloc_cache_noprof+0x168/0x2c0 mm/slub.c:4358
kmalloc_noprof include/linux/slab.h:878 [inline]
kzalloc_noprof include/linux/slab.h:1014 [inline]
ulist_prealloc+0x9c/0x110 fs/btrfs/ulist.c:114
extent_changeset_prealloc fs/btrfs/extent_io.h:217 [inline]
__set_extent_bit+0x16b/0x1a70 fs/btrfs/extent-io-tree.c:1086
set_record_extent_bits+0x50/0x90 fs/btrfs/extent-io-tree.c:1821
qgroup_reserve_data+0x274/0x7d0 fs/btrfs/qgroup.c:4312
btrfs_qgroup_reserve_data+0x2e/0xb0 fs/btrfs/qgroup.c:4355
btrfs_do_encoded_write+0x92e/0x1040 fs/btrfs/inode.c:9746
btrfs_encoded_write fs/btrfs/file.c:1482 [inline]
btrfs_do_write_iter+0x280/0x610 fs/btrfs/file.c:1507
btrfs_ioctl_encoded_write+0x3d6/0x490 fs/btrfs/ioctl.c:4738
btrfs_ioctl+0x6f9/0xc90 fs/btrfs/ioctl.c:-1
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl+0xf9/0x170 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/common.c:47 [inline]
do_syscall_64+0xbe/0x1a0 arch/x86/entry/common.c:78
entry_SYSCALL_64_after_hwframe+0x77/0x7fFix this by freeing an extent changeset before returning from btrfs_do_encoded_write().
--- fs/btrfs/inode.c | 1 + 1 file changed, 1 insertion(+)
fs/btrfs/inode.c +1 -0
@@ -10640,6 +10640,7 @@ ssize_t btrfs_do_encoded_write(struct kiocb *iocb, struct iov_iter *from, }kvfree (pages); out: +extent_changeset_free (data_reserved);if (ret >=0 ) iocb->ki_pos += encoded->len;return ret;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 15/156 bpf: Preserve pointer state for commuted arithmetic
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yiyang Chen <[email protected]>
[ Upstream commit a4c6f804b44c5c790269b25e0e61cf4e9f117c86 ]
When scalar += pointer is handled in adjust_ptr_min_max_vals(), the destination register inherits the pointer state from the source pointer. Copying only selected fields is fragile because pointer provenance is tracked by several bpf_reg_state fields.
Use the caller's temporary offset register to preserve the scalar operand while replacing the destination with the full pointer state. This preserves the frame number for PTR_TO_STACK registers and keeps parent identity fields consistent.
--- kernel/bpf/verifier.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
kernel/bpf/verifier.c +8 -7
@@ -12657,11 +12657,12 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,break ; } -/* In case of 'scalar += pointer', dst_reg inherits pointer type and id. -* The id may be overwritten later if we create a new variable offset. +/* For 'scalar += pointer', dst_reg inherits the complete pointer +* register state. Individual fields may be adjusted later by pointer +* arithmetic. Callers guarantee that below does not overwrite off_reg. */ - dst_reg->type = ptr_reg->type; - dst_reg->id = ptr_reg->id; +if (dst_reg != ptr_reg) + *dst_reg = *ptr_reg;if (!check_reg_sane_offset (env, off_reg, ptr_reg->type) || !check_reg_sane_offset (env, ptr_reg, ptr_reg->type))
@@ -12729,7 +12730,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, }break ;case BPF_SUB : -if (dst_reg == off_reg) { +if (dst_reg != ptr_reg) {/* scalar -= pointer. Creates an unknown scalar */ verbose (env,"R%d tried to subtract pointer from scalar\n" , dst);
@@ -13588,8 +13589,8 @@ static int adjust_reg_min_max_vals(struct bpf_verifier_env *env, err =mark_chain_precision (env, insn->dst_reg);if (err)return err; -return adjust_ptr_min_max_vals (env, insn, - src_reg, dst_reg); + off_reg = *dst_reg; +return adjust_ptr_min_max_vals (env, insn, src_reg, &off_reg); } }else if (ptr_reg) {/* pointer += scalar */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 16/156 net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mahanta Jambigi <[email protected]>
[ Upstream commit 976245094925bab9bc39366b2e9ab44ffcde61d0 ]
The SMC_LLC_CONFIRM_LINK / SMC_LLC_ADD_LINK_CONT branch in smc_llc_event_handler() stores an incoming qentry into the local LLC flow without first checking whether a qentry is already pending. If a malicious or buggy peer sends a second CONFIRM_LINK or ADD_LINK_CONT request while a flow is active and flow->qentry is already set, smc_llc_flow_qentry_set() overwrites the pointer without freeing the previous allocation, leaking one kmalloc-96 object per spurious message.
The sibling SMC_LLC_DELETE_LINK branch already has the correct !flow->qentry guard. Apply the same guard to the CONFIRM_LINK/ADD_LINK_CONT branch so that a duplicate message when qentry is already occupied falls through to break and is freed by the kfree(qentry) at the out: label, rather than silently leaking the existing allocation.
The response direction (smc_llc_rx_response()) is unaffected: it already guards with flow->qentry at the equivalent site and drops duplicate responses correctly.
--- net/smc/smc_llc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/smc/smc_llc.c +2 -1
@@ -1918,7 +1918,8 @@ static void smc_llc_event_handler(struct smc_llc_qentry *qentry)return ;case SMC_LLC_CONFIRM_LINK :case SMC_LLC_ADD_LINK_CONT : -if (lgr->llc_flow_lcl.type !=SMC_LLC_FLOW_NONE ) { +if (lgr->llc_flow_lcl.type !=SMC_LLC_FLOW_NONE && + !lgr->llc_flow_lcl.qentry) {/* a flow is waiting for this message */ smc_llc_flow_qentry_set (&lgr->llc_flow_lcl, qentry);wake_up (&lgr->llc_msg_waiter);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 17/156 net/sched: cls_route: fix fastmap use-after-free on filter
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <[email protected]>
[ Upstream commit 47d7f7051253bdc02b1d245d87e38f16d31a74df ]
The route4 classifier maintains a 16-slot fastmap cache that stores raw struct route4_filter pointers indexed by (id, iif). The reader (route4_classify) populates this cache via route4_set_fastmap() for every classified packet that hits a filter. The writer (route4_delete, route4_change) clears the cache via route4_reset_fastmap() before RCU-deferred kfree of the filter.
This creates a UAF race:
1. Reader walks the RCU-protected bucket chain, finds filter f
2. Writer unlinks f, calls route4_reset_fastmap(), then tcf_queue_work()
3. Reader calls route4_set_fastmap() and writes f into the cache *after* the writer's reset, caching a pointer about to be freed
4. After the RCU grace period, kfree(f) executes
5. Next classified packet on the same (id, iif) tuple hits the stale
fastmap entry and reads f->res from freed memory
Reproduced with an mdelay(100) accelerator in route4_set_fastmap() and a concurrent add/delete stress test (provided by both zdi and Santosh). Both triggered KASAN slab-use-after-free reports in the route4 fastmap paths.
Fix:
Introduce a per-filter boolean dying flag to suppress stale fastmap republishing by in-flight readers.
--- net/sched/cls_route.c | 35 ++++++++++++++++++++++++++--------- 1 file changed, 26 insertions(+), 9 deletions(-)
net/sched/cls_route.c +26 -9
@@ -52,6 +52,7 @@ struct route4_filter {struct tcf_result res;struct tcf_exts exts;u32 handle; +bool dying;struct route4_bucket *bkt;struct tcf_proto *tp;struct rcu_work rwork;
@@ -66,9 +67,11 @@ static inline int route4_fastmap_hash(u32 id, int iif)static DEFINE_SPINLOCK (fastmap_lock);static void -route4_reset_fastmap (struct route4_head *head) +route4_reset_fastmap (struct route4_head *head,struct route4_filter *f) {spin_lock_bh (&fastmap_lock); +if (f) + f->dying = true;memset (head->fastmap,0 ,sizeof (head->fastmap));spin_unlock_bh (&fastmap_lock); }
@@ -81,9 +84,11 @@ route4_set_fastmap(struct route4_head *head, u32 id, int iif,/* fastmap updates must look atomic to aling id, iff, filter */ spin_lock_bh (&fastmap_lock); - head->fastmap[h].id = id; - head->fastmap[h].iif = iif; - head->fastmap[h].filter = f; +if (f ==ROUTE4_FAILURE || !f->dying) { + head->fastmap[h].id = id; + head->fastmap[h].iif = iif; + head->fastmap[h].filter = f; + }spin_unlock_bh (&fastmap_lock); }
@@ -297,6 +302,13 @@ static void route4_destroy(struct tcf_proto *tp, bool rtnl_held, next =rtnl_dereference (f->next);RCU_INIT_POINTER (b->ht[h2], next);tcf_unbind_filter (tp, &f->res); +/* Mark the filter dying under fastmap_lock so +* any in-flight reader that still holds it +* will skip the republish in route4_set_fastmap(). +*/ +spin_lock_bh (&fastmap_lock); + f->dying = true; +spin_unlock_bh (&fastmap_lock);if (tcf_exts_get_net (&f->exts))route4_queue_work (f);else
@@ -307,6 +319,11 @@ static void route4_destroy(struct tcf_proto *tp, bool rtnl_held,kfree_rcu (b, rcu); } } + +/* All filters are unlinked and marked dying, so no in-flight +* reader can republish a stale entry after this reset. +*/ +route4_reset_fastmap (head,NULL );kfree_rcu (head, rcu); }
@@ -334,11 +351,11 @@ static int route4_delete(struct tcf_proto *tp, void *arg, bool *last,/* unlink it */ RCU_INIT_POINTER (*fp,rtnl_dereference (f->next)); -/* Remove any fastmap lookups that might ref filter -* notice we unlink'd the filter so we can't get it -* back in the fastmap. +/* Clear any fastmap entries that may ref this filter and +* mark it dying so in-flight readers can't republish it +* after the reset. */ -route4_reset_fastmap (head); +route4_reset_fastmap (head, f);/* Delete it */ tcf_unbind_filter (tp, &f->res);
@@ -553,7 +570,7 @@ static int route4_change(struct net *net, struct sk_buff *in_skb, } } -route4_reset_fastmap (head); +route4_reset_fastmap (head, fold); *arg = f;if (fold) {tcf_unbind_filter (tp, &fold->res);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 18/156 net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiawen Liu <[email protected]>
[ Upstream commit f307a7dc32097c11413178fca437a10d20890bc2 ]
hix5hd2_dev_remove() calls netif_napi_del() before unregister_netdev(). This is not needed because free_netdev() deletes all NAPI instances attached to the net_device.
Remove the redundant call and let the networking core tear down the NAPI instance during unregister_netdev(). The probe error path still keeps its explicit netif_napi_del(), because the device has not been registered there.
--- drivers/net/ethernet/hisilicon/hix5hd2_gmac.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/ethernet/hisilicon/hix5hd2_gmac.c +0 -1
@@ -1287,7 +1287,6 @@ static int hix5hd2_dev_remove(struct platform_device *pdev)struct net_device *ndev =platform_get_drvdata (pdev);struct hix5hd2_priv *priv =netdev_priv (ndev); -netif_napi_del (&priv->napi);unregister_netdev (ndev);mdiobus_unregister (priv->bus);mdiobus_free (priv->bus);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 19/156 devlink: fix net namespace reference leak in reload
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Or Har-Toov <[email protected]>
[ Upstream commit 1c4dac9bf1d2ac31da63b794bdec697777cbd0fd ]
devlink_nl_reload_doit() calls devlink_netns_get(), which returns a net with a held reference. When the requested namespace differs from the current one and the reload action is not DRIVER_REINIT, the function returns -EOPNOTSUPP without releasing the reference. Add the missing put_net() on this error path.
--- net/devlink/dev.c | 1 + 1 file changed, 1 insertion(+)
net/devlink/dev.c +1 -0
@@ -505,6 +505,7 @@ int devlink_nl_cmd_reload(struct sk_buff *skb, struct genl_info *info) action != DEVLINK_RELOAD_ACTION_DRIVER_REINIT) {NL_SET_ERR_MSG_MOD (info->extack,"Changing namespace is only supported for reinit action" ); +put_net (dest_net);return -EOPNOTSUPP ; } }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 20/156 net/mlx5: fw_tracer, return NULL on create error
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Guralnik <[email protected]>
[ Upstream commit af39eb111ce6b5eba9c08513b62c4868eb7e7fd5 ]
Tracer creation can fail by returning either NULL or ERR_PTR. The return value is stored without a check on the device, and users treat ERR_PTR and NULL the same way.
This also causes a crash in the core dump logic, which is missing the ERR_PTR check and ends up dereferencing it, as shown in the trace below.
Switch tracer creation to return NULL on failure only, so callers only need a single NULL check.
Internal error: Oops: 0000000096000006 [#1] SMP Modules linked in: mlx5_ib ib_uverbs ib_core ipv6 mlx5_core CPU: 1 UID: 0 PID: 12 Comm: kworker/u16:0 Not tainted 6.19.7 #1 PREEMPT(none) Workqueue: mlx5_health0001:01:00.0 mlx5_fw_reporter_err_work [mlx5_core] pstate: a3400009 (NzCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : mlx5_fw_tracer_trigger_core_dump_general+0x58/0xe0 [mlx5_core] lr : mlx5_fw_tracer_trigger_core_dump_general+0x40/0xe0 [mlx5_core] sp : ffff800081cf3c40 x29: ffff800081cf3c90 x28: 0000000000000000 x27: 0000000000000000 x26: ffff000080018828 x25: 0000000000000000 x24: ffff000080304a05 x23: ffff800081cf3d80 x22: ffff0000847e01a0 x21: 0000000000000000 x20: ffff0000847e01a0 x19: ffffffffffffffa1 x18: ffff80008310bbf0 x17: ffff800080119650 x16: ffff80008010df54 x15: ffff80008010d4ac x14: ffff800079c202e4 x13: ffff80008002fe60 x12: ffff800080119650 x11: ffff80008010df54 x10: ffff80008010d4ac x9 : ffff800079c203d8 x8 : ffff800081cf3c88 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000008 x3 : 0000000000000030 x2 : 0000000000000008 x1 : 0000000000000000 x0 : 00000000c5c4000e Call trace: mlx5_fw_tracer_trigger_core_dump_general+0x58/0xe0 [mlx5_core] (P) mlx5_fw_reporter_dump+0x30/0x2e0 [mlx5_core] devlink_health_do_dump+0x9c/0x160 devlink_health_report+0x1c0/0x288 mlx5_fw_reporter_err_work+0xac/0xc0 [mlx5_core] process_one_work+0x15c/0x3d8 worker_thread+0x18c/0x320 kthread+0x148/0x228 ret_from_fork+0x10/0x20 Code: b9400000 5ac00800 7a401800 540003ca (3940a260) ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: Oops: Fatal exception SMP: stopping secondary CPUs Kernel Offset: disabled CPU features: 0x000000,00078031,75fce5a1,35fffe67 Memory Limit: none ---[ end Kernel panic - not syncing: Oops: Fatal exception ]---
--- .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c +7 -9
@@ -1050,13 +1050,11 @@ struct mlx5_fw_tracer *mlx5_fw_tracer_create(struct mlx5_core_dev *dev) tracer =kvzalloc (sizeof (*tracer),GFP_KERNEL );if (!tracer) -return ERR_PTR (-ENOMEM ); +return NULL ; tracer->work_queue =create_singlethread_workqueue ("mlx5_fw_tracer" ); -if (!tracer->work_queue) { - err = -ENOMEM ; +if (!tracer->work_queue) goto free_tracer; - } tracer->dev = dev;
@@ -1098,7 +1096,7 @@ struct mlx5_fw_tracer *mlx5_fw_tracer_create(struct mlx5_core_dev *dev)destroy_workqueue (tracer->work_queue); free_tracer:kvfree (tracer); -return ERR_PTR (err); +return NULL ; }static int fw_tracer_event (struct notifier_block *nb,unsigned long action,void *data);
@@ -1109,7 +1107,7 @@ int mlx5_fw_tracer_init(struct mlx5_fw_tracer *tracer)struct mlx5_core_dev *dev;int err; -if (IS_ERR_OR_NULL (tracer)) +if (!tracer)return 0 ;if (!tracer->str_db.loaded)
@@ -1159,7 +1157,7 @@ int mlx5_fw_tracer_init(struct mlx5_fw_tracer *tracer)/* Stop tracer + Cleanup HW resources */ void mlx5_fw_tracer_cleanup (struct mlx5_fw_tracer *tracer) { -if (IS_ERR_OR_NULL (tracer)) +if (!tracer)return ;mutex_lock (&tracer->state_lock);
@@ -1188,7 +1186,7 @@ void mlx5_fw_tracer_cleanup(struct mlx5_fw_tracer *tracer)/* Free software resources (Buffers, etc ..) */ void mlx5_fw_tracer_destroy (struct mlx5_fw_tracer *tracer) { -if (IS_ERR_OR_NULL (tracer)) +if (!tracer)return ;mlx5_core_dbg (tracer->dev,"FWTracer: Destroy\n" );
@@ -1240,7 +1238,7 @@ int mlx5_fw_tracer_reload(struct mlx5_fw_tracer *tracer)struct mlx5_core_dev *dev;int err; -if (IS_ERR_OR_NULL (tracer)) +if (!tracer)return 0 ; dev = tracer->dev;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 21/156 counter: microchip-tcb-capture: Fix DT channel validation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Babanpreet Singh <[email protected]>
[ Upstream commit f1a3a9946aab611dd2200c01ff122f64b033dad2 ]
mchp_tc_probe() reads the devicetree "reg" cell - a u32, per the API contract of of_property_read_u32_index() - into a signed int, so the bounds check "channel > 2" fails to reject cell values at or above 0x80000000: reinterpreted as a negative int, they compare below 2 and pass validation.
A malformed devicetree can therefore drive a negative channel into the ATMEL_TC_REG() offset arithmetic, making the driver access syscon regmap offsets outside the TC block's register window, and into the "t%d_clk" clock-name formatting, where it truncates clk_name (sized for "t0_clk".."t2_clk").
Declare channel as u32, matching the API contract; the unsigned comparison then rejects everything except channels 0..2. Adjust the format specifier to %u accordingly, which also resolves the W=1 warning that exposed the gap:
microchip-tcb-capture.c:520:56: warning: '%d' directive output may
be truncated writing between 1 and 11 bytes into a region of size 6 [-Wformat-truncation=]
note: directive argument in the range [-2147483648, 2]
No behavior change for well-formed devicetrees: channels 0..2 take identical paths before and after.
--- drivers/counter/microchip-tcb-capture.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/counter/microchip-tcb-capture.c +2 -2
@@ -309,7 +309,7 @@ static int mchp_tc_probe(struct platform_device *pdev)char clk_name[7 ];struct regmap *regmap;struct clk *clk[3 ]; -int channel; +u32 channel;int ret, i; counter =devm_counter_alloc (&pdev->dev,sizeof (*priv));
@@ -343,7 +343,7 @@ static int mchp_tc_probe(struct platform_device *pdev) priv->channel[i] = channel; -snprintf (clk_name,sizeof (clk_name),"t%d_clk" , channel); +snprintf (clk_name,sizeof (clk_name),"t%u_clk" , channel); clk[i] =of_clk_get_by_name (np->parent, clk_name);if (IS_ERR (clk[i])) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 22/156 bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jordan Rife <[email protected]>
[ Upstream commit 8271bec9fc1cfe522b1a18cacbefd6712a3d41c2 ]
Prepare for the next patch which needs to be able to choose either GFP_USER or GFP_NOWAIT for calls to bpf_iter_tcp_realloc_batch.
Stable-dep-of: e5fd3f514e27 ("bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()")
--- net/ipv4/tcp_ipv4.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
net/ipv4/tcp_ipv4.c +5 -4
@@ -2810,12 +2810,12 @@ static void bpf_iter_tcp_put_batch(struct bpf_tcp_iter_state *iter) }static int bpf_iter_tcp_realloc_batch (struct bpf_tcp_iter_state *iter, -unsigned int new_batch_sz) +unsigned int new_batch_sz,gfp_t flags) {struct sock **new_batch; new_batch =kvmalloc (sizeof (*new_batch) * new_batch_sz, -GFP_USER | __GFP_NOWARN); + flags | __GFP_NOWARN);if (!new_batch)return -ENOMEM ;
@@ -2927,7 +2927,8 @@ static struct sock *bpf_iter_tcp_batch(struct seq_file *seq)return sk; } -if (!resized && !bpf_iter_tcp_realloc_batch (iter, expected *3 /2 )) { +if (!resized && !bpf_iter_tcp_realloc_batch (iter, expected *3 /2 , +GFP_USER )) { resized = true; goto again; }
@@ -3355,7 +3356,7 @@ static int bpf_iter_init_tcp(void *priv_data, struct bpf_iter_aux_info *aux)if (err)return err; - err =bpf_iter_tcp_realloc_batch (iter,INIT_BATCH_SZ ); + err =bpf_iter_tcp_realloc_batch (iter,INIT_BATCH_SZ ,GFP_USER );if (err) {bpf_iter_fini_seq_net (priv_data);return err;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 23/156 bpf: tcp: Make sure iter->batch always contains a full bucket snapshot
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jordan Rife <[email protected]>
[ Upstream commit cdec67a489d4fdae3e83e04fca0419136a83c4c2 ]
Require that iter->batch always contains a full bucket snapshot. This invariant is important to avoid skipping or repeating sockets during iteration when combined with the next few patches. Before, there were two cases where a call to bpf_iter_tcp_batch may only capture part of a bucket:
1. When bpf_iter_tcp_realloc_batch() returns -ENOMEM.
2. When more sockets are added to the bucket while calling bpf_iter_tcp_realloc_batch(), making the updated batch size insufficient.
In cases where the batch size only covers part of a bucket, it is possible to forget which sockets were already visited, especially if we have to process a bucket in more than two batches. This forces us to choose between repeating or skipping sockets, so don't allow this:
1. Stop iteration and propagate -ENOMEM up to userspace if reallocation fails instead of continuing with a partial batch.
2. Try bpf_iter_tcp_realloc_batch() with GFP_USER just as before, but if we still aren't able to capture the full bucket, call bpf_iter_tcp_realloc_batch() again while holding the bucket lock to guarantee the bucket does not change. On the second attempt use GFP_NOWAIT since we hold onto the spin lock.
I did some manual testing to exercise the code paths where GFP_NOWAIT is used and where ERR_PTR(err) is returned. I used the realloc test cases included later in this series to trigger a scenario where a realloc happens inside bpf_iter_tcp_batch and made a small code tweak to force the first realloc attempt to allocate a too-small batch, thus requiring another attempt with GFP_NOWAIT. Some printks showed both reallocs with the tests passing:
Jun 27 00:00:53 crow kernel: again GFP_USER Jun 27 00:00:53 crow kernel: again GFP_NOWAIT Jun 27 00:00:53 crow kernel: again GFP_USER Jun 27 00:00:53 crow kernel: again GFP_NOWAIT
With this setup, I also forced each of the bpf_iter_tcp_realloc_batch calls to return -ENOMEM to ensure that iteration ends and that the read() in userspace fails.
Stable-dep-of: e5fd3f514e27 ("bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()")
--- net/ipv4/tcp_ipv4.c | 109 +++++++++++++++++++++++++++++++------------- 1 file changed, 77 insertions(+), 32 deletions(-)
net/ipv4/tcp_ipv4.c +77 -32
@@ -2819,7 +2819,7 @@ static int bpf_iter_tcp_realloc_batch(struct bpf_tcp_iter_state *iter,if (!new_batch)return -ENOMEM ; -bpf_iter_tcp_put_batch (iter); +memcpy (new_batch, iter->batch,sizeof (*iter->batch) * iter->end_sk);kvfree (iter->batch); iter->batch = new_batch; iter->max_sk = new_batch_sz;
@@ -2828,69 +2828,95 @@ static int bpf_iter_tcp_realloc_batch(struct bpf_tcp_iter_state *iter, }static unsigned int bpf_iter_tcp_listening_batch (struct seq_file *seq, -struct sock *start_sk) +struct sock **start_sk) { -struct inet_hashinfo *hinfo =seq_file_net (seq)->ipv4.tcp_death_row.hashinfo;struct bpf_tcp_iter_state *iter = seq->private; -struct tcp_iter_state *st = &iter->state;struct hlist_nulls_node *node;unsigned int expected =1 ;struct sock *sk; -sock_hold (start_sk); - iter->batch[iter->end_sk++] = start_sk; +sock_hold (*start_sk); + iter->batch[iter->end_sk++] = *start_sk; - sk =sk_nulls_next (start_sk); + sk =sk_nulls_next (*start_sk); + *start_sk =NULL ;sk_nulls_for_each_from (sk, node) {if (seq_sk_match (seq, sk)) {if (iter->end_sk < iter->max_sk) {sock_hold (sk); iter->batch[iter->end_sk++] = sk; + }else if (!*start_sk) { +/* Remember where we left off. */ + *start_sk = sk; } expected++; } } -spin_unlock (&hinfo->lhash2[st->bucket].lock);return expected; }static unsigned int bpf_iter_tcp_established_batch (struct seq_file *seq, -struct sock *start_sk) +struct sock **start_sk) { -struct inet_hashinfo *hinfo =seq_file_net (seq)->ipv4.tcp_death_row.hashinfo;struct bpf_tcp_iter_state *iter = seq->private; -struct tcp_iter_state *st = &iter->state;struct hlist_nulls_node *node;unsigned int expected =1 ;struct sock *sk; -sock_hold (start_sk); - iter->batch[iter->end_sk++] = start_sk; +sock_hold (*start_sk); + iter->batch[iter->end_sk++] = *start_sk; - sk =sk_nulls_next (start_sk); + sk =sk_nulls_next (*start_sk); + *start_sk =NULL ;sk_nulls_for_each_from (sk, node) {if (seq_sk_match (seq, sk)) {if (iter->end_sk < iter->max_sk) {sock_hold (sk); iter->batch[iter->end_sk++] = sk; + }else if (!*start_sk) { +/* Remember where we left off. */ + *start_sk = sk; } expected++; } } -spin_unlock_bh (inet_ehash_lockp (hinfo, st->bucket));return expected; } +static unsigned int bpf_iter_fill_batch (struct seq_file *seq, +struct sock **start_sk) +{ +struct bpf_tcp_iter_state *iter = seq->private; +struct tcp_iter_state *st = &iter->state; + +if (st->state ==TCP_SEQ_STATE_LISTENING ) +return bpf_iter_tcp_listening_batch (seq, start_sk); +else +return bpf_iter_tcp_established_batch (seq, start_sk); +} + +static void bpf_iter_tcp_unlock_bucket (struct seq_file *seq) +{ +struct inet_hashinfo *hinfo =seq_file_net (seq)->ipv4.tcp_death_row.hashinfo; +struct bpf_tcp_iter_state *iter = seq->private; +struct tcp_iter_state *st = &iter->state; + +if (st->state ==TCP_SEQ_STATE_LISTENING ) +spin_unlock (&hinfo->lhash2[st->bucket].lock); +else +spin_unlock_bh (inet_ehash_lockp (hinfo, st->bucket)); +} +static struct sock *bpf_iter_tcp_batch (struct seq_file *seq) {struct inet_hashinfo *hinfo =seq_file_net (seq)->ipv4.tcp_death_row.hashinfo;struct bpf_tcp_iter_state *iter = seq->private;struct tcp_iter_state *st = &iter->state;unsigned int expected; -bool resized = false;struct sock *sk; +int err;/* The st->bucket is done. Directly advance to the next * bucket instead of having the tcp_seek_last_pos() to skip
@@ -2907,33 +2933,52 @@ static struct sock *bpf_iter_tcp_batch(struct seq_file *seq) } } -again: -/* Get a new batch */ iter->cur_sk =0 ; iter->end_sk =0 ; - iter->st_bucket_done = false; + iter->st_bucket_done = true; sk =tcp_seek_last_pos (seq);if (!sk)return NULL ;/* Done */ -if (st->state ==TCP_SEQ_STATE_LISTENING ) - expected =bpf_iter_tcp_listening_batch (seq, sk); -else - expected =bpf_iter_tcp_established_batch (seq, sk); + expected =bpf_iter_fill_batch (seq, &sk); +if (likely (iter->end_sk == expected)) + goto done; -if (iter->end_sk == expected) { - iter->st_bucket_done = true; -return sk; - } +/* Batch size was too small. */ +bpf_iter_tcp_unlock_bucket (seq); +bpf_iter_tcp_put_batch (iter); + err =bpf_iter_tcp_realloc_batch (iter, expected *3 /2 , +GFP_USER ); +if (err) +return ERR_PTR (err); + + iter->cur_sk =0 ; + iter->end_sk =0 ; + + sk =tcp_seek_last_pos (seq); +if (!sk) +return NULL ;/* Done */ + + expected =bpf_iter_fill_batch (seq, &sk); +if (likely (iter->end_sk == expected)) + goto done; -if (!resized && !bpf_iter_tcp_realloc_batch (iter, expected *3 /2 , -GFP_USER )) { - resized = true; - goto again; +/* Batch size was still too small. Hold onto the lock while we try +* again with a larger batch to make sure the current bucket's size +* does not change in the meantime. +*/ + err =bpf_iter_tcp_realloc_batch (iter, expected,GFP_NOWAIT ); +if (err) { +bpf_iter_tcp_unlock_bucket (seq); +return ERR_PTR (err); } -return sk; + expected =bpf_iter_fill_batch (seq, &sk); +WARN_ON_ONCE (iter->end_sk != expected); +done: +bpf_iter_tcp_unlock_bucket (seq); +return iter->batch[0 ]; }static void *bpf_iter_tcp_seq_start (struct seq_file *seq,loff_t *pos)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 24/156 bpf: tcp: Get rid of st_bucket_done
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jordan Rife <[email protected]>
[ Upstream commit e25ab9b874a4bd8c6e3e5ce66cbe8a1dd4096e2e ]
Get rid of the st_bucket_done field to simplify TCP iterator state and logic. Before, st_bucket_done could be false if bpf_iter_tcp_batch returned a partial batch; however, with the last patch ("bpf: tcp: Make sure iter->batch always contains a full bucket snapshot"), st_bucket_done == true is equivalent to iter->cur_sk == iter->end_sk.
Stable-dep-of: e5fd3f514e27 ("bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()")
--- net/ipv4/tcp_ipv4.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-)
net/ipv4/tcp_ipv4.c +6 -8
@@ -2782,7 +2782,6 @@ struct bpf_tcp_iter_state {unsigned int end_sk;unsigned int max_sk;struct sock **batch; -bool st_bucket_done; };struct bpf_iter__tcp {
@@ -2805,8 +2804,10 @@ static int tcp_prog_seq_show(struct bpf_prog *prog, struct bpf_iter_meta *meta,static void bpf_iter_tcp_put_batch (struct bpf_tcp_iter_state *iter) { -while (iter->cur_sk < iter->end_sk) -sock_gen_put (iter->batch[iter->cur_sk++]); +unsigned int cur_sk = iter->cur_sk; + +while (cur_sk < iter->end_sk) +sock_gen_put (iter->batch[cur_sk++]); } static int bpf_iter_tcp_realloc_batch(struct bpf_tcp_iter_state *iter,
@@ -2923,7 +2924,7 @@ static struct sock *bpf_iter_tcp_batch(struct seq_file *seq)* one by one in the current bucket and eventually find out * it has to advance to the next bucket. */ -if (iter->st_bucket_done) { +if (iter->end_sk && iter->cur_sk == iter->end_sk) { st->offset =0 ; st->bucket++; if (st->state == TCP_SEQ_STATE_LISTENING &&
@@ -2935,7 +2936,6 @@ static struct sock *bpf_iter_tcp_batch(struct seq_file *seq) iter->cur_sk =0 ; iter->end_sk =0 ; - iter->st_bucket_done = true; sk =tcp_seek_last_pos (seq);if (!sk)
@@ -3083,10 +3083,8 @@ static void bpf_iter_tcp_seq_stop(struct seq_file *seq, void *v) (void )tcp_prog_seq_show (prog, &meta, v,0 ); } -if (iter->cur_sk < iter->end_sk) { +if (iter->cur_sk < iter->end_sk)bpf_iter_tcp_put_batch (iter); - iter->st_bucket_done = false; - } }static const struct seq_operations bpf_iter_tcp_seq_ops = {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 25/156 bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jordan Rife <[email protected]>
[ Upstream commit efeb820951ebf3778830256496ff72d00d135310 ]
Prepare for the next patch that tracks cookies between iterations by converting struct sock **batch to union bpf_tcp_iter_batch_item *batch inside struct bpf_tcp_iter_state.
Stable-dep-of: e5fd3f514e27 ("bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()")
--- net/ipv4/tcp_ipv4.c | 24 ++++++++++++++---------- 1 file changed, 14 insertions(+), 10 deletions(-)
net/ipv4/tcp_ipv4.c +14 -10
@@ -2776,12 +2776,16 @@ static int tcp4_seq_show(struct seq_file *seq, void *v) }#ifdef CONFIG_BPF_SYSCALL +union bpf_tcp_iter_batch_item { +struct sock *sk; +}; +struct bpf_tcp_iter_state {struct tcp_iter_state state;unsigned int cur_sk;unsigned int end_sk;unsigned int max_sk; -struct sock **batch; +union bpf_tcp_iter_batch_item *batch; }; struct bpf_iter__tcp {
@@ -2807,13 +2811,13 @@ static void bpf_iter_tcp_put_batch(struct bpf_tcp_iter_state *iter)unsigned int cur_sk = iter->cur_sk;while (cur_sk < iter->end_sk) -sock_gen_put (iter->batch[cur_sk++]); +sock_gen_put (iter->batch[cur_sk++].sk); }static int bpf_iter_tcp_realloc_batch (struct bpf_tcp_iter_state *iter,unsigned int new_batch_sz,gfp_t flags) { -struct sock **new_batch; +union bpf_tcp_iter_batch_item *new_batch; new_batch =kvmalloc (sizeof (*new_batch) * new_batch_sz, flags | __GFP_NOWARN);
@@ -2837,7 +2841,7 @@ static unsigned int bpf_iter_tcp_listening_batch(struct seq_file *seq,struct sock *sk;sock_hold (*start_sk); - iter->batch[iter->end_sk++] = *start_sk; + iter->batch[iter->end_sk++].sk = *start_sk; sk =sk_nulls_next (*start_sk); *start_sk =NULL ;
@@ -2845,7 +2849,7 @@ static unsigned int bpf_iter_tcp_listening_batch(struct seq_file *seq,if (seq_sk_match (seq, sk)) {if (iter->end_sk < iter->max_sk) {sock_hold (sk); - iter->batch[iter->end_sk++] = sk; + iter->batch[iter->end_sk++].sk = sk; }else if (!*start_sk) {/* Remember where we left off. */ *start_sk = sk;
@@ -2866,7 +2870,7 @@ static unsigned int bpf_iter_tcp_established_batch(struct seq_file *seq,struct sock *sk;sock_hold (*start_sk); - iter->batch[iter->end_sk++] = *start_sk; + iter->batch[iter->end_sk++].sk = *start_sk; sk =sk_nulls_next (*start_sk); *start_sk =NULL ;
@@ -2874,7 +2878,7 @@ static unsigned int bpf_iter_tcp_established_batch(struct seq_file *seq,if (seq_sk_match (seq, sk)) {if (iter->end_sk < iter->max_sk) {sock_hold (sk); - iter->batch[iter->end_sk++] = sk; + iter->batch[iter->end_sk++].sk = sk; }else if (!*start_sk) {/* Remember where we left off. */ *start_sk = sk;
@@ -2978,7 +2982,7 @@ static struct sock *bpf_iter_tcp_batch(struct seq_file *seq)WARN_ON_ONCE (iter->end_sk != expected); done:bpf_iter_tcp_unlock_bucket (seq); -return iter->batch[0 ]; +return iter->batch[0 ].sk; }static void *bpf_iter_tcp_seq_start (struct seq_file *seq,loff_t *pos)
@@ -3013,11 +3017,11 @@ static void *bpf_iter_tcp_seq_next(struct seq_file *seq, void *v, loff_t *pos)* st->bucket. See tcp_seek_last_pos(). */ st->offset++; -sock_gen_put (iter->batch[iter->cur_sk++]); +sock_gen_put (iter->batch[iter->cur_sk++].sk); }if (iter->cur_sk < iter->end_sk) - sk = iter->batch[iter->cur_sk]; + sk = iter->batch[iter->cur_sk].sk;else sk =bpf_iter_tcp_batch (seq);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 26/156 bpf: tcp: Avoid socket skips and repeats during iteration
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jordan Rife <[email protected]>
[ Upstream commit f5080f612a1c587bf636bb23d2a2f4de276d60e4 ]
Replace the offset-based approach for tracking progress through a bucket in the TCP table with one based on socket cookies. Remember the cookies of unprocessed sockets from the last batch and use this list to pick up where we left off or, in the case that the next socket disappears between reads, find the first socket after that point that still exists in the bucket and resume from there.
This approach guarantees that all sockets that existed when iteration began and continue to exist throughout will be visited exactly once. Sockets that are added to the table during iteration may or may not be seen, but if they are they will be seen exactly once.
Stable-dep-of: e5fd3f514e27 ("bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()")
--- net/ipv4/tcp_ipv4.c | 147 ++++++++++++++++++++++++++++++++++---------- 1 file changed, 115 insertions(+), 32 deletions(-)
net/ipv4/tcp_ipv4.c +115 -32
@@ -58,6 +58,7 @@#include <linux/times.h> #include <linux/slab.h> #include <linux/sched.h> +#include <linux/sock_diag.h> #include <net/net_namespace.h> #include <net/icmp.h>
@@ -2778,6 +2779,7 @@ static int tcp4_seq_show(struct seq_file *seq, void *v)#ifdef CONFIG_BPF_SYSCALL union bpf_tcp_iter_batch_item {struct sock *sk; +__u64 cookie; }; struct bpf_tcp_iter_state {
@@ -2808,10 +2810,19 @@ static int tcp_prog_seq_show(struct bpf_prog *prog, struct bpf_iter_meta *meta,static void bpf_iter_tcp_put_batch (struct bpf_tcp_iter_state *iter) { +union bpf_tcp_iter_batch_item *item;unsigned int cur_sk = iter->cur_sk; +__u64 cookie; -while (cur_sk < iter->end_sk) -sock_gen_put (iter->batch[cur_sk++].sk); +/* Remember the cookies of the sockets we haven't seen yet, so we can +* pick up where we left off next time around. +*/ +while (cur_sk < iter->end_sk) { + item = &iter->batch[cur_sk++]; + cookie =sock_gen_cookie (item->sk); +sock_gen_put (item->sk); + item->cookie = cookie; + } } static int bpf_iter_tcp_realloc_batch(struct bpf_tcp_iter_state *iter,
@@ -2832,6 +2843,106 @@ static int bpf_iter_tcp_realloc_batch(struct bpf_tcp_iter_state *iter,return 0 ; } +static struct sock *bpf_iter_tcp_resume_bucket (struct sock *first_sk, +union bpf_tcp_iter_batch_item *cookies, +int n_cookies) +{ +struct hlist_nulls_node *node; +struct sock *sk; +int i; + +for (i =0 ; i < n_cookies; i++) { + sk = first_sk; +sk_nulls_for_each_from (sk, node) +if (cookies[i].cookie ==atomic64_read (&sk->sk_cookie)) +return sk; + } + +return NULL ; +} + +static struct sock *bpf_iter_tcp_resume_listening (struct seq_file *seq) +{ +struct inet_hashinfo *hinfo =seq_file_net (seq)->ipv4.tcp_death_row.hashinfo; +struct bpf_tcp_iter_state *iter = seq->private; +struct tcp_iter_state *st = &iter->state; +unsigned int find_cookie = iter->cur_sk; +unsigned int end_cookie = iter->end_sk; +int resume_bucket = st->bucket; +struct sock *sk; + +if (end_cookie && find_cookie == end_cookie) + ++st->bucket; + + sk =listening_get_first (seq); + iter->cur_sk =0 ; + iter->end_sk =0 ; + +if (sk && st->bucket == resume_bucket && end_cookie) { + sk =bpf_iter_tcp_resume_bucket (sk, &iter->batch[find_cookie], + end_cookie - find_cookie); +if (!sk) { +spin_unlock (&hinfo->lhash2[st->bucket].lock); + ++st->bucket; + sk =listening_get_first (seq); + } + } + +return sk; +} + +static struct sock *bpf_iter_tcp_resume_established (struct seq_file *seq) +{ +struct inet_hashinfo *hinfo =seq_file_net (seq)->ipv4.tcp_death_row.hashinfo; +struct bpf_tcp_iter_state *iter = seq->private; +struct tcp_iter_state *st = &iter->state; +unsigned int find_cookie = iter->cur_sk; +unsigned int end_cookie = iter->end_sk; +int resume_bucket = st->bucket; +struct sock *sk; + +if (end_cookie && find_cookie == end_cookie) + ++st->bucket; + + sk =established_get_first (seq); + iter->cur_sk =0 ; + iter->end_sk =0 ; + +if (sk && st->bucket == resume_bucket && end_cookie) { + sk =bpf_iter_tcp_resume_bucket (sk, &iter->batch[find_cookie], + end_cookie - find_cookie); +if (!sk) { +spin_unlock_bh (inet_ehash_lockp (hinfo, st->bucket)); + ++st->bucket; + sk =established_get_first (seq); + } + } + +return sk; +} + +static struct sock *bpf_iter_tcp_resume (struct seq_file *seq) +{ +struct bpf_tcp_iter_state *iter = seq->private; +struct tcp_iter_state *st = &iter->state; +struct sock *sk =NULL ; + +switch (st->state) { +case TCP_SEQ_STATE_LISTENING : + sk =bpf_iter_tcp_resume_listening (seq); +if (sk) +break ; + st->bucket =0 ; + st->state =TCP_SEQ_STATE_ESTABLISHED ; + fallthrough; +case TCP_SEQ_STATE_ESTABLISHED : + sk =bpf_iter_tcp_resume_established (seq); +break ; + } + +return sk; +} +static unsigned int bpf_iter_tcp_listening_batch (struct seq_file *seq,struct sock **start_sk) {
@@ -2916,32 +3027,12 @@ static void bpf_iter_tcp_unlock_bucket(struct seq_file *seq)static struct sock *bpf_iter_tcp_batch (struct seq_file *seq) { -struct inet_hashinfo *hinfo =seq_file_net (seq)->ipv4.tcp_death_row.hashinfo;struct bpf_tcp_iter_state *iter = seq->private; -struct tcp_iter_state *st = &iter->state;unsigned int expected;struct sock *sk;int err; -/* The st->bucket is done. Directly advance to the next -* bucket instead of having the tcp_seek_last_pos() to skip -* one by one in the current bucket and eventually find out -* it has to advance to the next bucket. -*/ -if (iter->end_sk && iter->cur_sk == iter->end_sk) { - st->offset =0 ; - st->bucket++; -if (st->state ==TCP_SEQ_STATE_LISTENING && - st->bucket > hinfo->lhash2_mask) { - st->state =TCP_SEQ_STATE_ESTABLISHED ; - st->bucket =0 ; - } - } - - iter->cur_sk =0 ; - iter->end_sk =0 ; - - sk =tcp_seek_last_pos (seq); + sk =bpf_iter_tcp_resume (seq);if (!sk)return NULL ;/* Done */
@@ -2957,10 +3048,7 @@ static struct sock *bpf_iter_tcp_batch(struct seq_file *seq)if (err)return ERR_PTR (err); - iter->cur_sk =0 ; - iter->end_sk =0 ; - - sk =tcp_seek_last_pos (seq); + sk =bpf_iter_tcp_resume (seq);if (!sk)return NULL ;/* Done */
@@ -3012,11 +3100,6 @@ static void *bpf_iter_tcp_seq_next(struct seq_file *seq, void *v, loff_t *pos)* meta.seq_num is used instead. */ st->num++; -/* Move st->offset to the next sk in the bucket such that -* the future start() will resume at st->offset in -* st->bucket. See tcp_seek_last_pos(). -*/ - st->offset++;sock_gen_put (iter->batch[iter->cur_sk++].sk); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 27/156 bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jose Fernandez (Anthropic) <[email protected]>
[ Upstream commit e5fd3f514e27db1f05fbd72ba615d74941e23c51 ]
reqsk_queue_hash_req() publishes a TCP_NEW_SYN_RECV request_sock onto the ehash chain, drops the bucket lock, and only afterwards sets rsk_refcnt to 3.
Lockless readers such as __inet_lookup_established() handle this with refcount_inc_not_zero(), but bpf_iter_tcp_established_batch() uses plain sock_hold() while holding the bucket lock, on the assumption that the lock guarantees sk_refcnt > 0. That assumption does not hold for request_sock:
CPU 0 CPU 1
----- -----
tcp_conn_request()
reqsk_queue_hash_req()
inet_ehash_insert(req)
spin_lock(bucket)
__sk_nulls_add_node_rcu(req) // rsk_refcnt == 0
spin_unlock(bucket)
bpf_iter_tcp_established_batch()
spin_lock(bucket)
sock_hold(req) <-- addition on 0
spin_unlock(bucket)
refcount_set(&req->rsk_refcnt, 3) // clobbers saturated valuewhich surfaces as:
refcount_t: addition on 0; use-after-free.
WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x48/0x90, CPU#1 Call Trace: bpf_iter_tcp_established_batch+0x14e/0x170 bpf_iter_tcp_batch+0x53/0x200 bpf_iter_tcp_seq_next+0x27/0x70 bpf_seq_read+0x107/0x410 vfs_read+0xb9/0x380
The iterator's stolen reference is lost when the publishing CPU's refcount_set() overwrites the count, leaving the socket one reference short. When the last legitimate owner drops its reference the reqsk is freed while still reachable, leading to use-after-free.
This reproduces in seconds with tcp_syncookies=0, a handful of threads doing connect()/close() to a local listener while others read an iter/tcp link in a tight loop.
Use refcount_inc_not_zero() and skip the socket on failure. A skipped socket is still part of the bucket, so keep counting it in expected. The reallocations are sized from expected, and a request sock whose refcount gets published while the lock is held across the last realloc must already have room.
A skipped socket is counted in expected but never batched, so end_sk can be short of expected on a batch that is actually complete. Decide completeness by whether the walk left any socket behind instead. The WARN after the locked realloc checks the same, replacing an end_sk == expected check that could not hold on that path since commit cdec67a489d4 ("bpf: tcp: Make sure iter->batch always contains a full bucket snapshot").
If every matching socket in a bucket is mid-init (refcount 0), end_sk stays 0. Advance to the next bucket rather than returning a batch entry that was never filled this round.
--- net/ipv4/tcp_ipv4.c | 43 ++++++++++++++++++++++++------------------- 1 file changed, 24 insertions(+), 19 deletions(-)
net/ipv4/tcp_ipv4.c +24 -19
@@ -2977,24 +2977,24 @@ static unsigned int bpf_iter_tcp_established_batch(struct seq_file *seq, {struct bpf_tcp_iter_state *iter = seq->private;struct hlist_nulls_node *node; -unsigned int expected =1 ; -struct sock *sk; - -sock_hold (*start_sk); - iter->batch[iter->end_sk++].sk = *start_sk; +struct sock *sk = *start_sk; +unsigned int expected =0 ; - sk =sk_nulls_next (*start_sk); *start_sk =NULL ;sk_nulls_for_each_from (sk, node) { -if (seq_sk_match (seq, sk)) { -if (iter->end_sk < iter->max_sk) { -sock_hold (sk); - iter->batch[iter->end_sk++].sk = sk; - }else if (!*start_sk) { -/* Remember where we left off. */ - *start_sk = sk; - } - expected++; +if (!seq_sk_match (seq, sk)) +continue ; + expected++; +if (iter->end_sk < iter->max_sk) { +/* reqsk_queue_hash_req() inserts with sk_refcnt == 0 +* and refcount_set()s it after the bucket lock drops. +*/ +if (unlikely (!refcount_inc_not_zero (&sk->sk_refcnt))) +continue ; + iter->batch[iter->end_sk++].sk = sk; + }else if (!*start_sk) { +/* Remember where we left off. */ + *start_sk = sk; } }
@@ -3032,12 +3032,13 @@ static struct sock *bpf_iter_tcp_batch(struct seq_file *seq)struct sock *sk;int err; +again: sk =bpf_iter_tcp_resume (seq);if (!sk)return NULL ;/* Done */ expected =bpf_iter_fill_batch (seq, &sk); -if (likely (iter->end_sk == expected)) +if (likely (!sk)) goto done;/* Batch size was too small. */
@@ -3053,7 +3054,7 @@ static struct sock *bpf_iter_tcp_batch(struct seq_file *seq)return NULL ;/* Done */ expected =bpf_iter_fill_batch (seq, &sk); -if (likely (iter->end_sk == expected)) +if (likely (!sk)) goto done;/* Batch size was still too small. Hold onto the lock while we try
@@ -3066,10 +3067,14 @@ static struct sock *bpf_iter_tcp_batch(struct seq_file *seq)return ERR_PTR (err); } - expected =bpf_iter_fill_batch (seq, &sk); -WARN_ON_ONCE (iter->end_sk != expected); +bpf_iter_fill_batch (seq, &sk); +WARN_ON_ONCE (sk); done:bpf_iter_tcp_unlock_bucket (seq); +if (unlikely (!iter->end_sk)) { + ++iter->state.bucket; + goto again; + }return iter->batch[0 ].sk; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 28/156 vhost/vdpa: reject overflowing PA map page counts on 32-bit
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yousef Alhouseen <[email protected]>
[ Upstream commit 0619aaa34c0c2a2dcb07f0e9c8a34e7efb8c4cdf ]
vhost_vdpa_pa_map() adds the IOVA page offset to the user-controlled map size before computing the number of pages to pin. On 32-bit systems, where unsigned long is narrower than u64, that addition can overflow and the code can pin and map fewer pages than the requested IOTLB range.
Reject sizes that overflow the unsigned long page-count calculation.
Message-ID: <CAMuQ4bX-iDvcUOPPY+NLz95tkRJYwWqvzAr=U48uNaub_HZLGw@mail.gmail.com>
--- drivers/vhost/vdpa.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/vhost/vdpa.c +8 -1
@@ -998,6 +998,7 @@ static int vhost_vdpa_pa_map(struct vhost_vdpa *v,unsigned int gup_flags =FOLL_LONGTERM ;unsigned long npages, cur_base, map_pfn, last_pfn =0 ;unsigned long lock_limit, sz2pin, nchunks, i; +unsigned long page_offset;u64 start = iova;long pinned;int ret =0 ;
@@ -1010,7 +1011,13 @@ static int vhost_vdpa_pa_map(struct vhost_vdpa *v,if (perm &VHOST_ACCESS_WO ) gup_flags |=FOLL_WRITE ; - npages =PFN_UP (size + (iova & ~PAGE_MASK )); + page_offset = iova & ~PAGE_MASK ; +if (size >ULONG_MAX - page_offset) { + ret = -EINVAL ; + goto free; + } + + npages =PFN_UP (size + page_offset);if (!npages) { ret = -EINVAL ; goto free;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 29/156 tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Gao <[email protected]>
[ Upstream commit 0e125ecfe20c077625cf0be8d750d5c3abc0dce9 ]
Commit f5da7c45188e ("tcp: adjust rcvq_space after updating scaling ratio") replaced the direct window_clamp update in tcp_measure_rcv_mss() with a call to tcp_set_window_clamp(), a helper that implements the TCP_WINDOW_CLAMP setsockopt. As a side effect, the helper also shrinks rcv_ssthresh via __tcp_adjust_rcv_ssthresh().
As a result, each scaling_ratio decrease detected by tcp_measure_rcv_mss() also cuts rcv_ssthresh. Elsewhere in TCP, rcv_ssthresh is usually cut under memory pressure and grows via tcp_grow_window().
Flows whose segment sizes vary keep scaling_ratio oscillating, which leads to an unstable rcv_ssthresh: a dip of rcv_ssthresh only recovers via tcp_grow_window(), keeping the advertised window at a relatively low level even after the ratio itself has recovered, and can even stall the sender.
Observed on a customer's proxy gateway after upgrading from kernel 6.1 to 6.12: in the worst case, rcv_ssthresh was cut in half by a scaling_ratio dip. P99 latency jumped from <10ms on 6.1 to ~100ms on 6.12, and almost returned to the 6.1 level with this patch applied.
Restore the plain WRITE_ONCE() update of window_clamp, as introduced in commit a2cbb1603943 ("tcp: Update window clamping condition"), and keep the rcvq_space.space adjustment. Now rcv_ssthresh is decoupled from scaling_ratio changes in tcp_measure_rcv_mss().
--- net/ipv4/tcp_input.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/tcp_input.c +1 -1
@@ -252,7 +252,7 @@ static void tcp_measure_rcv_mss(struct sock *sk, const struct sk_buff *skb)struct tcp_sock *tp =tcp_sk (sk); val =tcp_win_from_space (sk, sk->sk_rcvbuf); -tcp_set_window_clamp (sk, val); +WRITE_ONCE (tp->window_clamp, val);if (tp->window_clamp < tp->rcvq_space.space) tp->rcvq_space.space = tp->window_clamp;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 30/156 udp: fix potential use-after-free in tunnel segmentation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xuanqiang Luo <[email protected]>
[ Upstream commit d0f86fb36eb260abd10007b62c9dcc1028e03e61 ]
__skb_udp_tunnel_segment() gets the UDP header before ensuring the tunnel header is in the skb head. If the pull reallocates skb->head, the saved UDP header pointer is no longer valid.
Get the UDP header after the pull to avoid a potential use-after-free.
--- net/ipv4/udp_offload.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/ipv4/udp_offload.c +3 -1
@@ -22,17 +22,19 @@ static struct sk_buff *__skb_udp_tunnel_segment(struct sk_buff *skb,int tnl_hlen =skb_inner_mac_header (skb) -skb_transport_header (skb);bool remcsum, need_csum, offload_csum, gso_partial;struct sk_buff *segs =ERR_PTR (-EINVAL ); -struct udphdr *uh =udp_hdr (skb);u16 mac_offset = skb->mac_header;__be16 protocol = skb->protocol;u16 mac_len = skb->mac_len;int udp_offset, outer_hlen; +struct udphdr *uh;__wsum partial;bool need_ipsec;if (unlikely (!pskb_may_pull (skb, tnl_hlen))) goto out; + uh =udp_hdr (skb); +/* Adjust partial header checksum to negate old length. * We cannot rely on the value contained in uh->len as it is * possible that the actual value exceeds the boundaries of the
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 31/156 net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toke Høiland-Jørgensen <[email protected]>
[ Upstream commit 2a33516f9ef59ad11844d4fc152f889449b5daf3 ]
The sch_cake ACK filter parses packets to find the TCP header and filter duplicated ACKs if the flow is backlogged. The parsing code contains a WARN_ON(1) which can be triggered by a malformed IP header in certain cases. Depending on the system configuration, this leads either to either spamming dmesg with warnings, or a panic if panic_on_warn is set.
The code already correctly skips the offending packet in the branch that triggers the warning, so the WARN_ON itself doesn't really serve any purpose. So just drop it altogether to avoid the inconvenient side effects.
--- net/sched/sch_cake.c | 1 - 1 file changed, 1 deletion(-)
net/sched/sch_cake.c +0 -1
@@ -1282,7 +1282,6 @@ static struct sk_buff *cake_ack_filter(struct cake_sched_data *q, seglen =ntohs (ipv6h_check->payload_len); }else { -WARN_ON (1 );/* shouldn't happen */ continue ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 32/156 net/openvswitch: check Ethernet header length in key_extract()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang (Microsoft) <[email protected]>
[ Upstream commit cf6f8b29befb92173659bcef6a441d274947bfae ]
When a packet arrives on an ARPHRD_NONE device (e.g. TUN), ovs_flow_key_extract() trusts the user-provided skb->protocol field: if it is ETH_P_TEB, the packet is classified as MAC_PROTO_ETHERNET and key_extract() is called without ensuring the skb has ETH_HLEN (14) bytes of linear data. key_extract() unconditionally pulls 2 * ETH_ALEN bytes for MAC addresses and parse_ethertype() pulls 2 more, either of which triggers a kernel BUG in __skb_pull() when the linear area is too small.
kernel BUG at include/linux/skbuff.h:2848!
RIP: 0010:key_extract+0xa7e/0xd90 net/openvswitch/flow.c:933 ovs_flow_key_extract+0x419/0xa70 ovs_vport_receive+0x222/0x390 netdev_frame_hook+0x3e0/0x630 tun_get_user+0x2d0c/0x38e0
Fixed by calling check_header() in key_extract() before accessing the Ethernet header.
--- net/openvswitch/flow.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
net/openvswitch/flow.c +7 -4
@@ -893,8 +893,6 @@ static int key_extract_l3l4(struct sk_buff *skb, struct sw_flow_key *key)* Ethernet header * @key: output flow key * -* The caller must ensure that skb->len >= ETH_HLEN. -* * Initializes @skb header fields as follows: * * - skb->mac_header: the L2 header.
@@ -914,8 +912,6 @@ static int key_extract_l3l4(struct sk_buff *skb, struct sw_flow_key *key)*/ static int key_extract (struct sk_buff *skb,struct sw_flow_key *key) { -struct ethhdr *eth; -/* Flags are always used as part of stats */ key->tp.flags =0 ;
@@ -930,6 +926,13 @@ static int key_extract(struct sk_buff *skb, struct sw_flow_key *key)skb_reset_network_header (skb); key->eth.type = skb->protocol; }else { +struct ethhdr *eth; +int err; + + err =check_header (skb,ETH_HLEN ); +if (unlikely (err)) +return err; + eth =eth_hdr (skb);ether_addr_copy (key->eth.src, eth->h_source);ether_addr_copy (key->eth.dst, eth->h_dest);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 33/156 net: sched: cls_api: add skip_sw counter
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asbjørn Sloth Tønnesen <[email protected]>
[ Upstream commit f631ef39d81956a2ee69d25039781ceae1162f62 ]
Maintain a count of skip_sw filters.
This counter is protected by the cb_lock, and is updated at the same time as offloadcnt.
Stable-dep-of: a347304b2ca1 ("net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers")
--- include/net/sch_generic.h | 1 + net/sched/cls_api.c | 4 ++++ 2 files changed, 5 insertions(+)
include/net/sch_generic.h +1 -0
@@ -477,6 +477,7 @@ struct tcf_block {struct flow_block flow_block;struct list_head owner_list;bool keep_dst; +atomic_t skipswcnt;/* Number of skip_sw filters */ atomic_t offloadcnt;/* Number of oddloaded filters */ unsigned int nooffloaddevcnt;/* Number of devs unable to do offload */ unsigned int lockeddevcnt;/* Number of devs that require rtnl lock. */
net/sched/cls_api.c +4 -0
@@ -3478,6 +3478,8 @@ static void tcf_block_offload_inc(struct tcf_block *block, u32 *flags)if (*flags &TCA_CLS_FLAGS_IN_HW )return ; *flags |=TCA_CLS_FLAGS_IN_HW ; +if (tc_skip_sw (*flags)) +atomic_inc (&block->skipswcnt);atomic_inc (&block->offloadcnt); }
@@ -3486,6 +3488,8 @@ static void tcf_block_offload_dec(struct tcf_block *block, u32 *flags)if (!(*flags &TCA_CLS_FLAGS_IN_HW ))return ; *flags &= ~TCA_CLS_FLAGS_IN_HW ; +if (tc_skip_sw (*flags)) +atomic_dec (&block->skipswcnt);atomic_dec (&block->offloadcnt); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 34/156 net: sched: cls_api: add filter counter
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asbjørn Sloth Tønnesen <[email protected]>
[ Upstream commit 2081fd3445fec6b9813c20e8b910c2abd6de31cb ]
Maintain a count of filters per block.
Counter updates are protected by cb_lock, which is also used to protect the offload counters.
Stable-dep-of: a347304b2ca1 ("net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers")
--- include/net/sch_generic.h | 2 ++ net/sched/cls_api.c | 19 +++++++++++++++++++ 2 files changed, 21 insertions(+)
include/net/sch_generic.h +2 -0
@@ -429,6 +429,7 @@ struct tcf_proto {*/ spinlock_t lock;bool deleting; +bool counted;refcount_t refcnt;struct rcu_head rcu;struct hlist_node destroy_ht_node;
@@ -477,6 +478,7 @@ struct tcf_block {struct flow_block flow_block;struct list_head owner_list;bool keep_dst; +atomic_t filtercnt;/* Number of filters */ atomic_t skipswcnt;/* Number of skip_sw filters */ atomic_t offloadcnt;/* Number of oddloaded filters */ unsigned int nooffloaddevcnt;/* Number of devs unable to do offload */
net/sched/cls_api.c +19 -0
@@ -410,12 +410,30 @@ static void tcf_proto_get(struct tcf_proto *tp)refcount_inc (&tp->refcnt); } +static void tcf_block_filter_cnt_update (struct tcf_block *block,bool *counted,bool add) +{ +lockdep_assert_not_held (&block->cb_lock); + +down_write (&block->cb_lock); +if (*counted != add) { +if (add) { +atomic_inc (&block->filtercnt); + *counted = true; + }else { +atomic_dec (&block->filtercnt); + *counted = false; + } + } +up_write (&block->cb_lock); +} +static void tcf_chain_put (struct tcf_chain *chain);static void tcf_proto_destroy (struct tcf_proto *tp,bool rtnl_held,bool sig_destroy,struct netlink_ext_ack *extack) { tp->ops->destroy (tp, rtnl_held, extack); +tcf_block_filter_cnt_update (tp->chain->block, &tp->counted, false);if (sig_destroy)tcf_proto_signal_destroyed (tp->chain, tp);tcf_chain_put (tp->chain);
@@ -2354,6 +2372,7 @@ static int tc_new_tfilter(struct sk_buff *skb, struct nlmsghdr *n, err = tp->ops->change (net, skb, tp, cl, t->tcm_handle, tca, &fh, flags, extack);if (err ==0 ) { +tcf_block_filter_cnt_update (block, &tp->counted, true);tfilter_notify (net, skb, n, tp, block, q, parent, fh,RTM_NEWTFILTER , false, rtnl_held, extack);tfilter_put (tp, fh);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 35/156 net: sched: make skip_sw actually skip software
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asbjørn Sloth Tønnesen <[email protected]>
[ Upstream commit 047f340b36fc550c0fc6a8947fc0a1f8e429e9ab ]
TC filters come in 3 variants:
- no flag (try to process in hardware, but fallback to software))
- skip_hw (do not process filter by hardware)
- skip_sw (do not process filter by software)
However skip_sw is implemented so that the skip_sw flag can first be checked, after it has been matched.
IMHO it's common when using skip_sw, to use it on all rules.
So if all filters in a block is skip_sw filters, then we can bail early, we can thus avoid having to match the filters, just to check for the skip_sw flag.
This patch adds a bypass, for when only TC skip_sw rules are used. The bypass is guarded by a static key, to avoid harming other workloads.
There are 3 ways that a packet from a skip_sw ruleset, can end up in the kernel path. Although the send packets to a non-existent chain way is only improved a few percents, then I believe it's worth optimizing the trap and fall-though use-cases.
+----------------------------+--------+--------+--------+ | Test description | Pre- | Post- | Rel. | | | kpps | kpps | chg. | +----------------------------+--------+--------+--------+ | basic forwarding + notrack | 3589.3 | 3587.9 | 1.00x | | switch to eswitch mode | 3081.8 | 3094.7 | 1.00x | | add ingress qdisc | 3042.9 | 3063.6 | 1.01x | | tc forward in hw / skip_sw |37024.7 |37028.4 | 1.00x | | tc forward in sw / skip_hw | 3245.0 | 3245.3 | 1.00x | +----------------------------+--------+--------+--------+ | tests with only skip_sw rules below: | +----------------------------+--------+--------+--------+ | 1 non-matching rule | 2694.7 | 3058.7 | 1.14x | | 1 n-m rule, match trap | 2611.2 | 3323.1 | 1.27x | | 1 n-m rule, goto non-chain | 2886.8 | 2945.9 | 1.02x | | 5 non-matching rules | 1958.2 | 3061.3 | 1.56x | | 5 n-m rules, match trap | 1911.9 | 3327.0 | 1.74x | | 5 n-m rules, goto non-chain| 2883.1 | 2947.5 | 1.02x | | 10 non-matching rules | 1466.3 | 3062.8 | 2.09x | | 10 n-m rules, match trap | 1444.3 | 3317.9 | 2.30x | | 10 n-m rules,goto non-chain| 2883.1 | 2939.5 | 1.02x | | 25 non-matching rules | 838.5 | 3058.9 | 3.65x | | 25 n-m rules, match trap | 824.5 | 3323.0 | 4.03x | | 25 n-m rules,goto non-chain| 2875.8 | 2944.7 | 1.02x | | 50 non-matching rules | 488.1 | 3054.7 | 6.26x | | 50 n-m rules, match trap | 484.9 | 3318.5 | 6.84x | | 50 n-m rules,goto non-chain| 2884.1 | 2939.7 | 1.02x | +----------------------------+--------+--------+--------+
perf top (25 n-m skip_sw rules - pre patch):
20.39% [kernel] [k] __skb_flow_dissect 16.43% [kernel] [k] rhashtable_jhash2 10.58% [kernel] [k] fl_classify 10.23% [kernel] [k] fl_mask_lookup 4.79% [kernel] [k] memset_orig 2.58% [kernel] [k] tcf_classify 1.47% [kernel] [k] __x86_indirect_thunk_rax 1.42% [kernel] [k] __dev_queue_xmit 1.36% [kernel] [k] nft_do_chain 1.21% [kernel] [k] __rcu_read_lock
perf top (25 n-m skip_sw rules - post patch):
5.12% [kernel] [k] __dev_queue_xmit 4.77% [kernel] [k] nft_do_chain 3.65% [kernel] [k] dev_gro_receive 3.41% [kernel] [k] check_preemption_disabled 3.14% [kernel] [k] mlx5e_skb_from_cqe_mpwrq_nonlinear 2.88% [kernel] [k] __netif_receive_skb_core.constprop.0 2.49% [kernel] [k] mlx5e_xmit 2.15% [kernel] [k] ip_forward 1.95% [kernel] [k] mlx5e_tc_restore_tunnel 1.92% [kernel] [k] vlan_gro_receive
Test setup:
DUT: Intel Xeon D-1518 (2.20GHz) w/ Nvidia/Mellanox ConnectX-6 Dx 2x100G Data rate measured on switch (Extreme X690), and DUT connected as a router on a stick, with pktgen and pktsink as VLANs. Pktgen-dpdk was in range 36.6-37.7 Mpps 64B packets across all tests. Full test data at https://files.fiberby.net/ast/2024/tc_skip_sw/v2_tests/
Stable-dep-of: a347304b2ca1 ("net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers")
--- include/net/pkt_cls.h | 9 +++++++++ include/net/sch_generic.h | 1 + net/core/dev.c | 10 ++++++++++ net/sched/cls_api.c | 18 ++++++++++++++++++ 4 files changed, 38 insertions(+)
include/net/pkt_cls.h +9 -0
@@ -72,6 +72,15 @@ static inline bool tcf_block_non_null_shared(struct tcf_block *block)return block && block->index; } +#ifdef CONFIG_NET_CLS_ACT +DECLARE_STATIC_KEY_FALSE (tcf_bypass_check_needed_key); + +static inline bool tcf_block_bypass_sw (struct tcf_block *block) +{ +return block && block->bypass_wanted; +} +#endif +static inline struct Qdisc *tcf_block_q (struct tcf_block *block) {WARN_ON (tcf_block_shared (block));
include/net/sch_generic.h +1 -0
@@ -478,6 +478,7 @@ struct tcf_block {struct flow_block flow_block;struct list_head owner_list;bool keep_dst; +bool bypass_wanted;atomic_t filtercnt;/* Number of filters */ atomic_t skipswcnt;/* Number of skip_sw filters */ atomic_t offloadcnt;/* Number of oddloaded filters */
net/core/dev.c +10 -0
@@ -2146,6 +2146,11 @@ void net_dec_egress_queue(void)EXPORT_SYMBOL_GPL (net_dec_egress_queue);#endif +#ifdef CONFIG_NET_CLS_ACT +DEFINE_STATIC_KEY_FALSE (tcf_bypass_check_needed_key); +EXPORT_SYMBOL (tcf_bypass_check_needed_key); +#endif +DEFINE_STATIC_KEY_FALSE (netstamp_needed_key);EXPORT_SYMBOL (netstamp_needed_key);#ifdef CONFIG_JUMP_LABEL
@@ -4030,6 +4035,11 @@ static int tc_run(struct tcx_entry *entry, struct sk_buff *skb)if (!miniq)return ret; +if (static_branch_unlikely (&tcf_bypass_check_needed_key)) { +if (tcf_block_bypass_sw (miniq->block)) +return ret; + } +tc_skb_cb (skb)->mru =0 ;tc_skb_cb (skb)->post_ct = false;
net/sched/cls_api.c +18 -0
@@ -410,6 +410,23 @@ static void tcf_proto_get(struct tcf_proto *tp)refcount_inc (&tp->refcnt); } +static void tcf_maintain_bypass (struct tcf_block *block) +{ +int filtercnt =atomic_read (&block->filtercnt); +int skipswcnt =atomic_read (&block->skipswcnt); +bool bypass_wanted = filtercnt >0 && filtercnt == skipswcnt; + +if (bypass_wanted != block->bypass_wanted) { +#ifdef CONFIG_NET_CLS_ACT +if (bypass_wanted) +static_branch_inc (&tcf_bypass_check_needed_key); +else +static_branch_dec (&tcf_bypass_check_needed_key); +#endif + block->bypass_wanted = bypass_wanted; + } +} +static void tcf_block_filter_cnt_update (struct tcf_block *block,bool *counted,bool add) {lockdep_assert_not_held (&block->cb_lock);
@@ -424,6 +441,7 @@ static void tcf_block_filter_cnt_update(struct tcf_block *block, bool *counted, *counted = false; } } +tcf_maintain_bypass (block);up_write (&block->cb_lock); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 36/156 net: sched: cls_api: fix slab-use-after-free in fl_dump_key
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianbo Liu <[email protected]>
[ Upstream commit 2ecd487b670fcbb1ad4893fff1af4aafdecb6023 ]
The filter counter is updated under the protection of cb_lock in the cited commit. While waiting for the lock, it's possible the filter is being deleted by other thread, and thus causes UAF when dump it.
Fix this issue by moving tcf_block_filter_cnt_update() after tfilter_put().
==================================================================
BUG: KASAN: slab-use-after-free in fl_dump_key+0x1d3e/0x20d0 [cls_flower] Read of size 4 at addr ffff88814f864000 by task tc/2973 CPU: 7 PID: 2973 Comm: tc Not tainted 6.9.0-rc2_for_upstream_debug_2024_04_02_12_41 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x7e/0xc0 print_report+0xc1/0x600 ? __virt_addr_valid+0x1cf/0x390 ? fl_dump_key+0x1d3e/0x20d0 [cls_flower] ? fl_dump_key+0x1d3e/0x20d0 [cls_flower] kasan_report+0xb9/0xf0 ? fl_dump_key+0x1d3e/0x20d0 [cls_flower] fl_dump_key+0x1d3e/0x20d0 [cls_flower] ? lock_acquire+0x1c2/0x530 ? fl_dump+0x172/0x5c0 [cls_flower] ? lockdep_hardirqs_on_prepare+0x400/0x400 ? fl_dump_key_options.part.0+0x10f0/0x10f0 [cls_flower] ? do_raw_spin_lock+0x12d/0x270 ? spin_bug+0x1d0/0x1d0 fl_dump+0x21d/0x5c0 [cls_flower] ? fl_tmplt_dump+0x1f0/0x1f0 [cls_flower] ? nla_put+0x15f/0x1c0 tcf_fill_node+0x51b/0x9a0 ? tc_skb_ext_tc_enable+0x150/0x150 ? __alloc_skb+0x17b/0x310 ? __build_skb_around+0x340/0x340 ? down_write+0x1b0/0x1e0 tfilter_notify+0x1a5/0x390 ? fl_terse_dump+0x400/0x400 [cls_flower] tc_new_tfilter+0x963/0x2170 ? tc_del_tfilter+0x1490/0x1490 ? print_usage_bug.part.0+0x670/0x670 ? lock_downgrade+0x680/0x680 ? security_capable+0x51/0x90 ? tc_del_tfilter+0x1490/0x1490 rtnetlink_rcv_msg+0x75e/0xac0 ? if_nlmsg_stats_size+0x4c0/0x4c0 ? lockdep_set_lock_cmp_fn+0x190/0x190 ? __netlink_lookup+0x35e/0x6e0 netlink_rcv_skb+0x12c/0x360 ? if_nlmsg_stats_size+0x4c0/0x4c0 ? netlink_ack+0x15e0/0x15e0 ? lockdep_hardirqs_on_prepare+0x400/0x400 ? netlink_deliver_tap+0xcd/0xa60 ? netlink_deliver_tap+0xcd/0xa60 ? netlink_deliver_tap+0x1c9/0xa60 netlink_unicast+0x43e/0x700 ? netlink_attachskb+0x750/0x750 ? lock_acquire+0x1c2/0x530 ? __might_fault+0xbb/0x170 netlink_sendmsg+0x749/0xc10 ? netlink_unicast+0x700/0x700 ? __might_fault+0xbb/0x170 ? netlink_unicast+0x700/0x700 __sock_sendmsg+0xc5/0x190 ____sys_sendmsg+0x534/0x6b0 ? import_iovec+0x7/0x10 ? kernel_sendmsg+0x30/0x30 ? __copy_msghdr+0x3c0/0x3c0 ? entry_SYSCALL_64_after_hwframe+0x46/0x4e ? lock_acquire+0x1c2/0x530 ? __virt_addr_valid+0x116/0x390 ___sys_sendmsg+0xeb/0x170 ? __virt_addr_valid+0x1ca/0x390 ? copy_msghdr_from_user+0x110/0x110 ? __delete_object+0xb8/0x100 ? __virt_addr_valid+0x1cf/0x390 ? do_sys_openat2+0x102/0x150 ? lockdep_hardirqs_on_prepare+0x284/0x400 ? do_sys_openat2+0x102/0x150 ? __fget_light+0x53/0x1d0 ? sockfd_lookup_light+0x1a/0x150 __sys_sendmsg+0xb5/0x140 ? __sys_sendmsg_sock+0x20/0x20 ? lock_downgrade+0x680/0x680 do_syscall_64+0x70/0x140 entry_SYSCALL_64_after_hwframe+0x46/0x4e RIP: 0033:0x7f98e3713367 Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 RSP: 002b:00007ffc74a64608 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 000000000047eae0 RCX: 00007f98e3713367 RDX: 0000000000000000 RSI: 00007ffc74a64670 RDI: 0000000000000003 RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000 R10: 00007f98e360c5e8 R11: 0000000000000246 R12: 00007ffc74a6a508 R13: 00000000660d518d R14: 0000000000484a80 R15: 00007ffc74a6a50b </TASK> Allocated by task 2973: kasan_save_stack+0x20/0x40 kasan_save_track+0x10/0x30 __kasan_kmalloc+0x77/0x90 fl_change+0x27a6/0x4540 [cls_flower] tc_new_tfilter+0x879/0x2170 rtnetlink_rcv_msg+0x75e/0xac0 netlink_rcv_skb+0x12c/0x360 netlink_unicast+0x43e/0x700 netlink_sendmsg+0x749/0xc10 __sock_sendmsg+0xc5/0x190 ____sys_sendmsg+0x534/0x6b0 ___sys_sendmsg+0xeb/0x170 __sys_sendmsg+0xb5/0x140 do_syscall_64+0x70/0x140 entry_SYSCALL_64_after_hwframe+0x46/0x4e Freed by task 283: kasan_save_stack+0x20/0x40 kasan_save_track+0x10/0x30 kasan_save_free_info+0x37/0x50 poison_slab_object+0x105/0x190 __kasan_slab_free+0x11/0x30 kfree+0x111/0x340 process_one_work+0x787/0x1490 worker_thread+0x586/0xd30 kthread+0x2df/0x3b0 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x11/0x20 Last potentially related work creation: kasan_save_stack+0x20/0x40 __kasan_record_aux_stack+0x9b/0xb0 insert_work+0x25/0x1b0 __queue_work+0x640/0xc90 rcu_work_rcufn+0x42/0x70 rcu_core+0x6a9/0x1850 __do_softirq+0x264/0x88f Second to last potentially related work creation: kasan_save_stack+0x20/0x40 __kasan_record_aux_stack+0x9b/0xb0 __call_rcu_common.constprop.0+0x6f/0xac0 queue_rcu_work+0x56/0x70 fl_mask_put+0x20d/0x270 [cls_flower] __fl_delete+0x352/0x6b0 [cls_flower] fl_delete+0x97/0x160 [cls_flower] tc_del_tfilter+0x7d1/0x1490 rtnetlink_rcv_msg+0x75e/0xac0 netlink_rcv_skb+0x12c/0x360 netlink_unicast+0x43e/0x700 netlink_sendmsg+0x749/0xc10 __sock_sendmsg+0xc5/0x190 ____sys_sendmsg+0x534/0x6b0 ___sys_sendmsg+0xeb/0x170 __sys_sendmsg+0xb5/0x140 do_syscall_64+0x70/0x140 entry_SYSCALL_64_after_hwframe+0x46/0x4e
Stable-dep-of: a347304b2ca1 ("net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers")
--- net/sched/cls_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sched/cls_api.c +1 -1
@@ -2390,10 +2390,10 @@ static int tc_new_tfilter(struct sk_buff *skb, struct nlmsghdr *n, err = tp->ops->change (net, skb, tp, cl, t->tcm_handle, tca, &fh, flags, extack);if (err ==0 ) { -tcf_block_filter_cnt_update (block, &tp->counted, true);tfilter_notify (net, skb, n, tp, block, q, parent, fh,RTM_NEWTFILTER , false, rtnl_held, extack);tfilter_put (tp, fh); +tcf_block_filter_cnt_update (block, &tp->counted, true);/* q pointer is NULL for shared blocks */ if (q) q->flags &= ~TCQ_F_CAN_BYPASS ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 37/156 net: sched: refine software bypass handling in tc_run
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit a12c76a03386e32413ae8eaaefa337e491880632 ]
This patch addresses issues with filter counting in block (tcf_block), particularly for software bypass scenarios, by introducing a more accurate mechanism using useswcnt.
Previously, filtercnt and skipswcnt were introduced by:
Commit 2081fd3445fe ("net: sched: cls_api: add filter counter") and Commit f631ef39d819 ("net: sched: cls_api: add skip_sw counter")
filtercnt tracked all tp (tcf_proto) objects added to a block, and skipswcnt counted tp objects with the skipsw attribute set.
The problem is: a single tp can contain multiple filters, some with skipsw and others without. The current implementation fails in the case:
When the first filter in a tp has skipsw, both skipswcnt and filtercnt are incremented, then adding a second filter without skipsw to the same tp does not modify these counters because tp->counted is already set.
This results in bypass software behavior based solely on skipswcnt equaling filtercnt, even when the block includes filters without skipsw. Consequently, filters without skipsw are inadvertently bypassed.
To address this, the patch introduces useswcnt in block to explicitly count tp objects containing at least one filter without skipsw. Key changes include:
Whenever a filter without skipsw is added, its tp is marked with usesw and counted in useswcnt. tc_run() now uses useswcnt to determine software bypass, eliminating reliance on filtercnt and skipswcnt.
This refined approach prevents software bypass for blocks containing mixed filters, ensuring correct behavior in tc_run().
Additionally, as atomic operations on useswcnt ensure thread safety and tp->lock guards access to tp->usesw and tp->counted, the broader lock down_write(&block->cb_lock) is no longer required in tc_new_tfilter(), and this resolves a performance regression caused by the filter counting mechanism during parallel filter insertions.
The improvement can be demonstrated using the following script:
# cat insert_tc_rules.sh
tc qdisc add dev ens1f0np0 ingress
for i in $(seq 16); do
taskset -c $i tc -b rules_$i.txt &
done
wait
Each of rules_$i.txt files above includes 100000 tc filter rules to a mlx5 driver NIC ens1f0np0.
Without this patch:
# time sh insert_tc_rules.sh
real 0m50.780s
user 0m23.556s
sys 4m13.032sWith this patch:
# time sh insert_tc_rules.sh
real 0m17.718s
user 0m7.807s
sys 3m45.050sStable-dep-of: a347304b2ca1 ("net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers")
--- include/net/pkt_cls.h | 13 +++++++-- include/net/sch_generic.h | 5 ++-- net/core/dev.c | 15 ++++++----- net/sched/cls_api.c | 57 ++++++++++++++++----------------------- net/sched/cls_bpf.c | 2 ++ net/sched/cls_flower.c | 2 ++ net/sched/cls_matchall.c | 2 ++ net/sched/cls_u32.c | 4 +++ 8 files changed, 55 insertions(+), 45 deletions(-)
include/net/pkt_cls.h +11 -2
@@ -73,11 +73,11 @@ static inline bool tcf_block_non_null_shared(struct tcf_block *block) }#ifdef CONFIG_NET_CLS_ACT -DECLARE_STATIC_KEY_FALSE (tcf_bypass_check_needed_key); +DECLARE_STATIC_KEY_FALSE (tcf_sw_enabled_key);static inline bool tcf_block_bypass_sw (struct tcf_block *block) { -return block && block->bypass_wanted; +return block && !atomic_read (&block->useswcnt); }#endif
@@ -759,6 +759,15 @@ tc_cls_common_offload_init(struct flow_cls_common_offload *cls_common, cls_common->extack = extack; } +static inline void tcf_proto_update_usesw (struct tcf_proto *tp,u32 flags) +{ +if (tp->usesw) +return ; +if (tc_skip_sw (flags) &&tc_in_hw (flags)) +return ; + tp->usesw = true; +} +#if IS_ENABLED (CONFIG_NET_TC_SKB_EXT )static inline struct tc_skb_ext *tc_skb_ext_alloc (struct sk_buff *skb) {
include/net/sch_generic.h +2 -3
@@ -430,6 +430,7 @@ struct tcf_proto {spinlock_t lock;bool deleting;bool counted; +bool usesw;refcount_t refcnt;struct rcu_head rcu;struct hlist_node destroy_ht_node;
@@ -478,9 +479,7 @@ struct tcf_block {struct flow_block flow_block;struct list_head owner_list;bool keep_dst; -bool bypass_wanted; -atomic_t filtercnt;/* Number of filters */ -atomic_t skipswcnt;/* Number of skip_sw filters */ +atomic_t useswcnt;atomic_t offloadcnt;/* Number of oddloaded filters */ unsigned int nooffloaddevcnt;/* Number of devs unable to do offload */ unsigned int lockeddevcnt;/* Number of devs that require rtnl lock. */
net/core/dev.c +9 -6
@@ -2147,8 +2147,8 @@ EXPORT_SYMBOL_GPL(net_dec_egress_queue);#endif #ifdef CONFIG_NET_CLS_ACT -DEFINE_STATIC_KEY_FALSE (tcf_bypass_check_needed_key); -EXPORT_SYMBOL (tcf_bypass_check_needed_key); +DEFINE_STATIC_KEY_FALSE (tcf_sw_enabled_key); +EXPORT_SYMBOL (tcf_sw_enabled_key);#endif DEFINE_STATIC_KEY_FALSE (netstamp_needed_key);
@@ -4035,10 +4035,13 @@ static int tc_run(struct tcx_entry *entry, struct sk_buff *skb)if (!miniq)return ret; -if (static_branch_unlikely (&tcf_bypass_check_needed_key)) { -if (tcf_block_bypass_sw (miniq->block)) -return ret; - } +/* Global bypass */ +if (!static_branch_likely (&tcf_sw_enabled_key)) +return ret; + +/* Block-wise bypass */ +if (tcf_block_bypass_sw (miniq->block)) +return ret;tc_skb_cb (skb)->mru =0 ;tc_skb_cb (skb)->post_ct = false;
net/sched/cls_api.c +23 -34
98 lines not on this page · raw message
net/sched/cls_bpf.c +2 -0
@@ -509,6 +509,8 @@ static int cls_bpf_change(struct net *net, struct sk_buff *in_skb,if (!tc_in_hw (prog->gen_flags)) prog->gen_flags |=TCA_CLS_FLAGS_NOT_IN_HW ; +tcf_proto_update_usesw (tp, prog->gen_flags); +if (oldprog) {idr_replace (&head->handle_idr, prog, handle);list_replace_rcu (&oldprog->link, &prog->link);
net/sched/cls_flower.c +2 -0
@@ -2374,6 +2374,8 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,if (!tc_in_hw (fnew->flags)) fnew->flags |=TCA_CLS_FLAGS_NOT_IN_HW ; +tcf_proto_update_usesw (tp, fnew->flags); +spin_lock (&tp->lock);/* tp was deleted concurrently. -EAGAIN will cause caller to lookup
net/sched/cls_matchall.c +2 -0
@@ -228,6 +228,8 @@ static int mall_change(struct net *net, struct sk_buff *in_skb,if (!tc_in_hw (new->flags)) new->flags |=TCA_CLS_FLAGS_NOT_IN_HW ; +tcf_proto_update_usesw (tp, new->flags); + *arg = head;rcu_assign_pointer (tp->root, new);return 0 ;
net/sched/cls_u32.c +4 -0
@@ -950,6 +950,8 @@ static int u32_change(struct net *net, struct sk_buff *in_skb,if (!tc_in_hw (new->flags)) new->flags |=TCA_CLS_FLAGS_NOT_IN_HW ; +tcf_proto_update_usesw (tp, new->flags); +u32_replace_knode (tp, tp_c, new);tcf_unbind_filter (tp, &n->res);tcf_exts_get_net (&n->exts);
@@ -1163,6 +1165,8 @@ static int u32_change(struct net *net, struct sk_buff *in_skb,if (!tc_in_hw (n->flags)) n->flags |=TCA_CLS_FLAGS_NOT_IN_HW ; +tcf_proto_update_usesw (tp, n->flags); + ins = &ht->ht[TC_U32_HASH (handle)];for (pins =rtnl_dereference (*ins); pins; ins = &pins->next, pins =rtnl_dereference (*ins))
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 38/156 net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <[email protected]>
[ Upstream commit a347304b2ca1a5377d5bd2d8a72e4b4f12afe648 ]
Another challenge with unlocked filters.
There is a short window in tc_new_tfilter where a tcf_proto can be found and briefly referenced by a totally unrelated, unlocked classifier's request and cause a race.
Feng created a poc which created this race with two threads, one creating a u32 filter and other a flower filter in the same chain/prio:
1. Both threads enter tc_new_tfilter, both find the chain empty, both drop filter_chain_lock
2. u32 finishes tcf_proto_create("u32") first, calls tcf_chain_tp_insert_unique() -> inserts u32_tp into the chain
3. flower finishes tcf_proto_create("flower") later, calls tcf_chain_tp_insert_unique() -> tcf_chain_tp_find() now sees u32_tp already there, takes a reference on it, destroys flower's own tp_new and returns u32_tp to the caller.
Flower then hits the kind mismatch check (because it requested for kind "flower" but tp->ops->kind is "u32") and goes through the errout path which calls tcf_proto_put() on u32_tp. If the u32 thread has already gone through its own errout (its change() call failed on the PoC's empty options) and dropped its create and insert refs, flower's put is the last one and drops u32_tp's refcnt to zero.
At this point tp->ops->destroy() runs in a context that never took rtnl_lock. When that happens, it might cause a UAF like the following (illustrated by the PoC):
[ +0.000710] BUG: KASAN: slab-use-after-free in u32_init (net/sched/cls_u32.c:393) [ +0.000281] Read of size 8 at addr ffff888120022f00 by task poc_feng_xue/524
Call Trace: u32_init (net/sched/cls_u32.c:393) tc_new_tfilter (net/sched/cls_api.c:2378) Allocated by task 526: u32_init (net/sched/cls_u32.c:378) tc_new_tfilter (net/sched/cls_api.c:2378) Freed by task 522: kfree u32_destroy (net/sched/cls_u32.c:662) tcf_proto_destroy (net/sched/cls_api.c:446) tcf_proto_put (net/sched/cls_api.c:459) tc_new_tfilter (net/sched/cls_api.c:2459)
Fix this by having tcf_proto_destroy() take rtnl_lock around tp->ops->destroy() for locked classifiers whenever rtnl is not held.
To explain why I used a temp variable "not_lockless" I'd like to point to a semi-related note on rtnl_held vs TCF_PROTO_OPS_DOIT_UNLOCKED (adding here for future cleanup if deemed necessary):
The rtnl_held parameter and the TCF_PROTO_OPS_DOIT_UNLOCKED flag are redundant sources of truth for whether rtnl_lock is held. Among the nine classifier destroy(..rtnl_held..) callbacks, only flower consults the rtnl_held parameter which it propagates to tc_setup_cb_destroy() and tc_setup_cb_call(). The other eight (u32, flow, bpf, cgroup, route, basic, fw, mall) ignore it entirely;-> those that call tc_setup_cb_destroy() (u32, bpf, mall) hardcode true always instead of forwarding the parameter.
A future cleanup should remove the rtnl_held parameter from the destroy callback signature entirely and have callers rely solely on their knowledge whether they are running in an unlocked context.
--- net/sched/cls_api.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
net/sched/cls_api.c +16 -1
@@ -443,7 +443,22 @@ static void tcf_chain_put(struct tcf_chain *chain);static void tcf_proto_destroy (struct tcf_proto *tp,bool rtnl_held,bool sig_destroy,struct netlink_ext_ack *extack) { - tp->ops->destroy (tp, rtnl_held, extack); +/* A locked classifier's destroy callback (e.g. u32_destroy) uses +* rtnl_dereference() and mutates shared structures (e.g. the +* tc_u_common hash list) that are only safe under rtnl_lock. When an +* unlocked classifier's request (e.g. flower on ingress) loses the +* tcf_chain_tp_insert_unique() race and ends up dropping the last +* reference on a locked classifier's proto, destroy() would run +* without rtnl held. Take it here in that case. +*/ +bool not_lockless = !rtnl_held && + !(tp->ops->flags &TCF_PROTO_OPS_DOIT_UNLOCKED ); + +if (not_lockless) +rtnl_lock (); + tp->ops->destroy (tp, rtnl_held || not_lockless, extack); +if (not_lockless) +rtnl_unlock ();tcf_proto_count_usesw (tp, false);if (sig_destroy)tcf_proto_signal_destroyed (tp->chain, tp);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 39/156 hwmon: (nzxt-smart2) Check return value of init_device() in probe
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qingshuang Fu <[email protected]>
[ Upstream commit d533882ce1060866a590257f2c77ee23eabef5b8 ]
The init_device() call in nzxt_smart2_hid_probe() can fail because it sends HID output reports to the hardware to detect fans and set the update interval. If the hardware is not responding or the HID reports fail, init_device() returns a negative error code.
However, the return value was ignored, causing the probe to continue and register an hwmon device even though the device was never properly initialized. This leads to an inconsistent state where the driver reports stale data or blocks on wait queues that will never be woken.
The same function's return value is already checked in the reset_resume() handler, confirming the author's intent that errors should be propagated.
Note that this fix was not possible before commit 59d104b54b0b ("hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop") because the out_hw_close error path was missing hid_device_io_stop(), which would have opened a use-after-free risk window.
--- drivers/hwmon/nzxt-smart2.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/hwmon/nzxt-smart2.c +5 -1
@@ -760,7 +760,11 @@ static int nzxt_smart2_hid_probe(struct hid_device *hdev,hid_device_io_start (hdev); -init_device (drvdata,UPDATE_INTERVAL_DEFAULT_MS ); + ret =init_device (drvdata,UPDATE_INTERVAL_DEFAULT_MS ); +if (ret) { +dev_err (&hdev->dev,"init_device failed: %d\n" , ret); + goto out_hw_close; + } drvdata->hwmon = hwmon_device_register_with_info(&hdev->dev, "nzxtsmart2", drvdata,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 40/156 hwmon: (lm25066) Use i2c_get_match_data()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Herring <[email protected]>
[ Upstream commit ac0c26bae662138eac9b49215e505b402f7e80e3 ]
Use preferred i2c_get_match_data() instead of of_match_device() and i2c_match_id() to get the driver match data. With this, adjust the includes to explicitly include the correct headers.
Adjust the 'chips' enum to not use 0, so that no match data can be distinguished from a valid enum value.
Stable-dep-of: 0dabe8a56f77 ("hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations")
--- drivers/hwmon/pmbus/lm25066.c | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-)
drivers/hwmon/pmbus/lm25066.c +3 -11
@@ -14,10 +14,10 @@#include <linux/slab.h> #include <linux/i2c.h> #include <linux/log2.h> -#include <linux/of_device.h> +#include <linux/of.h> #include "pmbus.h" -enum chips { lm25056, lm25066, lm5064, lm5066, lm5066i }; +enum chips { lm25056 =1 , lm25066, lm5064, lm5066, lm5066i };#define LM25066_READ_VAUX 0xd0#define LM25066_MFR_READ_IIN 0xd1
@@ -468,8 +468,6 @@ static int lm25066_probe(struct i2c_client *client)struct lm25066_data *data;struct pmbus_driver_info *info;const struct __coeff *coeff; -const struct of_device_id *of_id; -const struct i2c_device_id *i2c_id;if (!i2c_check_functionality (client->adapter,I2C_FUNC_SMBUS_READ_BYTE_DATA ))
@@ -484,14 +482,8 @@ static int lm25066_probe(struct i2c_client *client)if (config <0 )return config; - i2c_id =i2c_match_id (lm25066_id, client); + data->id = (enum chips )(unsigned long )i2c_get_match_data (client); - of_id =of_match_device (lm25066_of_match, &client->dev); -if (of_id && (unsigned long )of_id->data != i2c_id->driver_data) -dev_notice (&client->dev,"Device mismatch: %s in device tree, %s detected\n" , - of_id->name, i2c_id->name); - - data->id = i2c_id->driver_data; info = &data->info; info->pages =1 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 41/156 hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit 0dabe8a56f772f0ece46d2597799f412c277d874 ]
In lm25066_probe(), the PMBus coefficients for current and power are scaled based on the shunt resistor value. The calculation evaluates the multiplication using 32-bit arithmetic because info->m is an int and shunt is a u32:
static int lm25066_probe(struct i2c_client *client) {
...
info->m[PSC_CURRENT_IN] = info->m[PSC_CURRENT_IN] * shunt / 1000;
info->m[PSC_POWER] = info->m[PSC_POWER] * shunt / 1000;
...
}For large coefficients like 26882 (LM25056) or 15076 (LM5066i), a device tree shunt-resistor-micro-ohms value exceeding approximately 159,000 (159 mOhm, which is physically valid for low-current applications) causes the intermediate product to exceed UINT_MAX (4,294,967,295). This results in a silent wraparound before the division by 1000.
Furthermore, if the wrapped value has the most significant bit set, converting it back to the signed int info->m results in negative coefficients. This logic error leads to drastically corrupted current and power readings, which can cause erratic thermal or power management behavior in the system.
Fix the problem by using 64-bit operations for the multiply/divide operations. This can still overflow, but only for unreasonably large shunt resistor values.
--- drivers/hwmon/pmbus/lm25066.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/hwmon/pmbus/lm25066.c +3 -2
@@ -14,6 +14,7 @@#include <linux/slab.h> #include <linux/i2c.h> #include <linux/log2.h> +#include <linux/math.h> #include <linux/of.h> #include "pmbus.h"
@@ -540,8 +541,8 @@ static int lm25066_probe(struct i2c_client *client)if (of_property_read_u32 (client->dev.of_node,"shunt-resistor-micro-ohms" , &shunt)) shunt =1000 ; - info->m[PSC_CURRENT_IN ] = info->m[PSC_CURRENT_IN ] * shunt /1000 ; - info->m[PSC_POWER ] = info->m[PSC_POWER ] * shunt /1000 ; + info->m[PSC_CURRENT_IN ] =DIV_ROUND_CLOSEST_ULL ((u64 )info->m[PSC_CURRENT_IN ] * shunt,1000 ); + info->m[PSC_POWER ] =DIV_ROUND_CLOSEST_ULL ((u64 )info->m[PSC_POWER ] * shunt,1000 );#if IS_ENABLED (CONFIG_SENSORS_LM25066_REGULATOR )/* LM25056 doesn't support OPERATION */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 42/156 selftests/ftrace: refactor eprobes test to fix argument checks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Kaiser <[email protected]>
[ Upstream commit 6e3abef2a27e7402a94111c9eff85d887e64a309 ]
The add/remove eprobe test installs an eprobe for the openat syscall and runs ls. It checks the filenames that were opened by ls against a whitelist and a blacklist.
Commit 206b25c09080 ("tracing: eprobe: read the complete FILTER_PTR_STRING pointer") fixed access to some string fields in eprobes. This triggers test failures as the blacklist does not allow relative paths for the openat parameters.
What makes this test unstable is the fact that the openat calls vary a lot between different systems.
Refactor the test to make it more robust. "cd <directory>" will issue a chdir syscall with the target directory as parameter. Set an eprobe on the sys_enter_chdir event and filter for the exact directory name. Allow (fault) as fallback.
--- .../ftrace/test.d/dynevent/add_remove_eprobe.tc | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-)
tools/testing/selftests/ftrace/test.d/dynevent/add_remove_eprobe.tc +5 -11
@@ -1,16 +1,16 @@ #!/bin/sh # SPDX-License-Identifier: GPL-2.0 # description: Generic dynamic event - add/remove eprobe events -# requires: dynamic_events events/syscalls/sys_enter_openat "<attached-group>.<attached-event> [<args>]":README +# requires: dynamic_events events/syscalls/sys_enter_chdir "<attached-group>.<attached-event> [<args>]":README echo 0 > events/enable clear_dynamic_events SYSTEM="syscalls" -EVENT="sys_enter_openat" +EVENT="sys_enter_chdir" FIELD="filename" -EPROBE="eprobe_open" +EPROBE="eprobe_chdir" OPTIONS="file=+0(\$filename):ustring" echo "e:$EPROBE $SYSTEM/$EVENT $OPTIONS" >> dynamic_events
@@ -18,20 +18,14 @@ grep -q "$EPROBE" dynamic_events test -d events/eprobes/$EPROBE echo 1 > events/eprobes/$EPROBE/enable -ls +cd /sys/kernel/tracing echo 0 > events/eprobes/$EPROBE/enable -content=`grep '^ *ls-' trace | grep 'file='` -nocontent=`grep '^ *ls-' trace | grep 'file=' | grep -v -e '"/' -e '"."' -e '(fault)' ` || true - +content=`grep -e 'file="/sys/kernel/tracing"\|(fault)' trace` if [ -z "$content" ]; then exit_fail fi -if [ ! -z "$nocontent" ]; then - exit_fail -fi - echo "-:$EPROBE" >> dynamic_events ! grep -q "$EPROBE" dynamic_events
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 43/156 bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Chan <[email protected]>
[ Upstream commit 30f253f8d9a01d532fdb7ec6c8a9d4c15fe29241 ]
With End-of-Packet padding (EOP) set, the chip will disable Relaxed Ordering (RO) of TPA data packets. A TPA segment with EOP set will be padded to the next cache boundary and can potentially overwrite the beginning bytes of the next TPA segment when RO is enabled on 5760X. To prevent that, the chip disables RO for TPA when EOP is set.
To take advantge of RO and higher performance, do not set EOP on 5760X chips when TPA is enabled. Define a proper RX_BD_FLAGS_AGG_EOP constant to make it clear that we are setting EOP.
Stable-dep-of: c3faf548a00f ("bnxt_en: Disable EOP for TPA on all chips to prevent data corruption")
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 9 ++++++++- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 + 2 files changed, 9 insertions(+), 1 deletion(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +8 -1
@@ -3715,7 +3715,14 @@ static int bnxt_init_one_rx_ring(struct bnxt *bp, int ring_nr)if ((bp->flags &BNXT_FLAG_AGG_RINGS )) { type = ((u32 )BNXT_RX_PAGE_SIZE <<RX_BD_LEN_SHIFT ) | -RX_BD_TYPE_RX_AGG_BD |RX_BD_FLAGS_SOP ; +RX_BD_TYPE_RX_AGG_BD ; + +/* On P7, setting EOP will cause the chip to disable +* Relaxed Ordering (RO) for TPA data. Disable EOP for +* potentially higher performance with RO. +*/ +if (BNXT_CHIP_P5_AND_MINUS (bp) || !(bp->flags &BNXT_FLAG_TPA )) + type |=RX_BD_FLAGS_AGG_EOP ;bnxt_init_rxbd_pages (ring, type); }
drivers/net/ethernet/broadcom/bnxt/bnxt.h +1 -0
@@ -104,6 +104,7 @@ struct rx_bd {#define RX_BD_TYPE_48B_BD_SIZE (2 << 4)#define RX_BD_TYPE_64B_BD_SIZE (3 << 4)#define RX_BD_FLAGS_SOP (1 << 6) +#define RX_BD_FLAGS_AGG_EOP (1 << 6)#define RX_BD_FLAGS_EOP (1 << 7)#define RX_BD_FLAGS_BUFFERS (3 << 8)#define RX_BD_FLAGS_1_BUFFER_PACKET (0 << 8)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 44/156 bnxt_en: Disable EOP for TPA on all chips to prevent data corruption
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Chan <[email protected]>
[ Upstream commit c3faf548a00f4c17100cc9204746975fa46a73b9 ]
EOP (End of frame padding) on the AGG ring may cause overlapping of zero padding at the end of one segment with the next segment's data. If Relaxed Ordering (RO) is enabled, the zero padding may overwrite valid data in the next segment and corrupt the data. Older chips (P5 and older) do not automatically disable RO when EOP is enabled. On some ARM systems, data corruption was reported on 57508 (P5) chips with RO enabled.
Always disable EOP on all chips on the AGG rings when TPA is enabled to fix the data corruption.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +7 -4
@@ -3717,11 +3717,14 @@ static int bnxt_init_one_rx_ring(struct bnxt *bp, int ring_nr) type = ((u32 )BNXT_RX_PAGE_SIZE <<RX_BD_LEN_SHIFT ) |RX_BD_TYPE_RX_AGG_BD ; -/* On P7, setting EOP will cause the chip to disable -* Relaxed Ordering (RO) for TPA data. Disable EOP for -* potentially higher performance with RO. +/* Disable EOP if TPA is enabled to prevent overlapping zero +* padding with the next segment's data. On P7_PLUS, EOP will +* automatically disable Relaxed Ordering (RO) to prevent +* potential data corruption (and may degrade performance). On +* older chips, RO will not be automatically disabled and may +* cause corruption. */ -if (BNXT_CHIP_P5_AND_MINUS (bp) || !(bp->flags &BNXT_FLAG_TPA )) +if (!(bp->flags &BNXT_FLAG_TPA )) type |=RX_BD_FLAGS_AGG_EOP ;bnxt_init_rxbd_pages (ring, type);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 45/156 bnxt_en: Fix PTP PPS setting bug
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keegan Freyhof <[email protected]>
[ Upstream commit 80eaf88efec33ac77ed7726d066c4f2f932cc329 ]
The existing driver logic is always turning on PTP_CLK_REQ_PPS regardless of the "on" parameter passed to bnxt_ptp_enable(). During shutdown, PTP_CLK_REQ_PPS may be turned off and this bug will do the opposite and may trigger a PCIe PTM request TLP. On some systems this can trigger a PCIe AER.
Fix it by properly configuring PTP_CLK_REQ_PPS based on the "on" parameter.
--- drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c +5 -2
@@ -475,12 +475,15 @@ static int bnxt_ptp_enable(struct ptp_clock_info *ptp_info,return rc;case PTP_CLK_REQ_PPS :/* Configure PHC PPS IN */ - rc =bnxt_ptp_cfg_pin (bp,0 ,BNXT_PPS_PIN_PPS_IN ); + pin_id =0 ; +if (!on) +break ; + rc =bnxt_ptp_cfg_pin (bp, pin_id,BNXT_PPS_PIN_PPS_IN );if (rc)return rc; rc =bnxt_ptp_cfg_event (bp,BNXT_PPS_EVENT_INTERNAL );if (!rc) - ptp->pps_info.pins[0 ].event =BNXT_PPS_EVENT_INTERNAL ; + ptp->pps_info.pins[pin_id].event =BNXT_PPS_EVENT_INTERNAL ;return rc;default :netdev_err (ptp->bp->dev,"Unrecognized PIN function\n" );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 46/156 sctp: fix addip_serial increment on ASCONF_ACK allocation failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qing Luo <[email protected]>
[ Upstream commit aa2e13ae8d3cbe2c15ef4f7e971b2de0832794aa ]
In sctp_process_asconf(), when sctp_make_asconf_ack() fails to allocate the ASCONF_ACK chunk due to memory pressure, the code jumps to the done label where asoc->peer.addip_serial is unconditionally incremented.
This leaves the peer's ASCONF (serial N) unacknowledged while the local endpoint now expects serial N+1. When the peer retransmits serial N, it falls into the serial < addip_serial + 1 branch ,
which attempts to look up a cached ACK for serial N. No cached ACK exists since the allocation failed, so the retransmission is silently discarded. The peer eventually times out and ABORTs the association.
Move the addip_serial increment inside the if (asconf_ack) block so that the serial number is only advanced when the ASCONF_ACK is successfully created and cached. This way, on allocation failure, the serial number is unchanged and the peer's retransmitted ASCONF will be correctly re-processed.
--- net/sctp/sm_make_chunk.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/sctp/sm_make_chunk.c +1 -2
@@ -3354,12 +3354,11 @@ struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc, goto done; } done: - asoc->peer.addip_serial++; -/* If we are sending a new ASCONF_ACK hold a reference to it in assoc * after freeing the reference to old asconf ack if any. */ if (asconf_ack) { + asoc->peer.addip_serial++;sctp_chunk_hold (asconf_ack);list_add_tail (&asconf_ack->transmitted_list, &asoc->asconf_ack_list);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 47/156 tcp: fix TFO max_qlen accounting across reuseport migration
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <[email protected]>
[ Upstream commit a0ab2ba83e35159d81cec830a92e885ecf8139be ]
A listener's TCP_FASTOPEN max_qlen stops being accurate and lets through far more pending Fast Open requests than it was configured for.
This only shows up with SO_REUSEPORT listener migration, where closing a listener hands its still-pending TFO children over to a surviving one.
fastopenq.qlen is charged in tcp_fastopen_create_child() when the child is created and uncharged in reqsk_fastopen_remove() when the handshake completes. The uncharge follows rsk_listener of the request the child points at, and inet_reqsk_clone() has repointed the child at a new request owned by the new listener, so the ++ and the -- land on two different sockets. The new listener's qlen drifts negative and its limit no longer binds.
Charge the new listener during migration, like reqsk_queue_migrated() already does for queue->young and queue->qlen.
--- net/ipv4/inet_connection_sock.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-)
net/ipv4/inet_connection_sock.c +16 -4
@@ -930,11 +930,23 @@ static struct request_sock *inet_reqsk_clone(struct request_sock *req, nreq->rsk_listener = sk; -/* We need not acquire fastopenq->lock -* because the child socket is locked in inet_csk_listen_stop(). -*/ -if (sk->sk_protocol ==IPPROTO_TCP &&tcp_rsk (nreq)->tfo_listener) +if (sk->sk_protocol ==IPPROTO_TCP &&tcp_rsk (nreq)->tfo_listener) { +struct fastopen_queue *fastopenq; + +/* reqsk_fastopen_remove() will uncharge nreq->rsk_listener, +* that is @sk, so charge it here. Unlike the listener +* being closed, @sk is live and needs its lock. +*/ + fastopenq = &inet_csk (sk)->icsk_accept_queue.fastopenq; +spin_lock_bh (&fastopenq->lock); + fastopenq->qlen++; +spin_unlock_bh (&fastopenq->lock); + +/* We need not acquire fastopenq->lock +* because the child socket is locked in inet_csk_listen_stop(). +*/ rcu_assign_pointer (tcp_sk (nreq->sk)->fastopen_rsk, nreq); + }return nreq; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 48/156 net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henry Martin <[email protected]>
[ Upstream commit afa58b7384913c8773d837acdb07b035690ec5d2 ]
ncsi_send_cmd_nl() takes the number of bytes to copy from the attacker-controlled ncsi_pkt_hdr.length field of the in-band packet header, while the source buffer is the NCSI_ATTR_DATA netlink attribute whose readable size is nla_len() - sizeof(ncsi_pkt_hdr). The two length sources are never cross-checked: only nla_len() >= sizeof(struct ncsi_pkt_hdr) is enforced.
With hdr->length set larger than the attribute payload (up to 65535 against at most 2032 readable bytes), ncsi_cmd_handler_oem() copies past the end of the netlink attribute buffer with unsafe_memcpy(), leaking up to ~64KB of kernel heap memory into the transmitted NCSI command packet. The destination skb is sized by the declared payload, so the write side does not overflow - this is a pure OOB read / information leak, reachable with CAP_NET_ADMIN on systems with a registered NCSI device (e.g. OpenBMC on Aspeed BMC SoCs, where NET_NCSI=y is standard).
Reject commands whose declared payload extends past the end of the data attribute.
The issue was found by the autokbug dynamic kernel fuzzer at Tencent Yunding Lab.
--- net/ncsi/ncsi-netlink.c | 4 ++++ 1 file changed, 4 insertions(+)
net/ncsi/ncsi-netlink.c +4 -0
@@ -461,6 +461,10 @@ static int ncsi_send_cmd_nl(struct sk_buff *msg, struct genl_info *info) nca.req_flags =NCSI_REQ_FLAG_NETLINK_DRIVEN ; nca.info = info; nca.payload =ntohs (hdr->length); +if (nca.payload > len -sizeof (*hdr)) { + ret = -EINVAL ; + goto out_netlink; + } nca.data = data +sizeof (*hdr); ret =ncsi_xmit_cmd (&nca);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 49/156 net: prestera: validate firmware header length
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit 8ae344eb540af3f457179b52bc6061416752485c ]
prestera_fw_hdr_parse() reads the firmware header before checking that the firmware image contains that header.
Reject images shorter than struct prestera_fw_header before decoding the magic and version fields.
--- drivers/net/ethernet/marvell/prestera/prestera_pci.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/marvell/prestera/prestera_pci.c +3 -0
@@ -684,6 +684,9 @@ static int prestera_fw_hdr_parse(struct prestera_fw *fw)struct prestera_fw_header *hdr;u32 magic; +if (fw->bin->size <sizeof (*hdr)) +return -EINVAL ; + hdr = (struct prestera_fw_header *)fw->bin->data; magic =be32_to_cpu (hdr->magic_number);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 50/156 net: remove WARN_ON_ONCE() from sk_mc_loop()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit b8a39a09ae4eaae04309e1e38ed6a1101d967496 ]
sk_mc_loop() can be called for sockets that are neither AF_INET nor AF_INET6 (e.g. AF_PACKET sockets when sending packets via raw/packet socket over virtual devices such as VRF or ipvlan).
In such cases, sk_family is not AF_INET/AF_INET6 and sk_mc_loop() falls through the switch statement and triggers WARN_ON_ONCE(1).
Non-INET sockets do not support IP_MULTICAST_LOOP or IPV6_MULTICAST_LOOP options, so loopback should default to true without generating a warning.
--- net/core/sock.c | 1 - 1 file changed, 1 deletion(-)
net/core/sock.c +0 -1
@@ -776,7 +776,6 @@ bool sk_mc_loop(struct sock *sk)return inet6_sk (sk)->mc_loop;#endif } -WARN_ON_ONCE (1 );return true; }EXPORT_SYMBOL (sk_mc_loop);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 51/156 net/smc: fix TOCTOU race between smc_listen_out() and listener close
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sidraya Jayagond <[email protected]>
[ Upstream commit 185a4caeecabc150106deda1da170b09f2ad803f ]
smc_listen_out() reads lsmc->sk.sk_state without the listener lock, then acquires lock_sock_nested() only after the check passes. This opens a window where smc_close_active() can transition the listener to SMC_CLOSED, call smc_close_cleanup_listen() to drain the accept queue, and release the lock, all between the lockless read and the delayed lock acquisition:
smc_listen_work (smc_hs_wq) smc_close_active()
------------------------------- -------------------------
release_sock(child)
if (sk_state == SMC_LISTEN) TRUE
lock_sock(listener) sk_state = SMC_CLOSED smc_close_cleanup_listen() release_sock(listener) flush_work(tcp_listen_work)
lock_sock_nested(listener)
smc_accept_enqueue(listener, child) /* child enqueued on dead listener */
smc_close_active() flushes only tcp_listen_work. Work items already dispatched onto smc_hs_wq for the CLC handshake continue running unguarded. smc_accept_enqueue() takes a sock_hold() on the child that is never released, so the child smc_sock, its clcsock, and the reference all leak. A remote peer that opens TCP connections while the server calls close() can exhaust kernel memory.
Move lock_sock_nested() to before the sk_state check so that the test and the enqueue are atomic under the listener lock.
--- net/smc/af_smc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/smc/af_smc.c +2 -1
@@ -1921,11 +1921,12 @@ static void smc_listen_out(struct smc_sock *new_smc)atomic_dec (&lsmc->queued_smc_hs);release_sock (newsmcsk);/* lock in smc_listen_work() */ +lock_sock_nested (&lsmc->sk,SINGLE_DEPTH_NESTING );if (lsmc->sk.sk_state ==SMC_LISTEN ) { -lock_sock_nested (&lsmc->sk,SINGLE_DEPTH_NESTING );smc_accept_enqueue (&lsmc->sk, newsmcsk);release_sock (&lsmc->sk); }else {/* no longer listening */ +release_sock (&lsmc->sk);smc_close_non_accepted (newsmcsk); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 52/156 net: thunderbolt: Tear down DMA paths before stopping the rings
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan XinRan <[email protected]>
[ Upstream commit 68bf02b6b4ad3f748c6db71fd77b6c0402d252f4 ]
tbnet_tear_down() stops both rings and frees their frame buffers before calling tb_xdomain_disable_paths(). tb_ring_stop() zeroes the ring's descriptor base and tbnet_free_buffers() unmaps and frees the pages the frames sit in, so by the time __tb_path_deactivate_hop() polls the hop's 'pending' bit, anything still in flight has nowhere to drain to.
The teardown sequence has been in this order since the driver was added. The setup path has not: commit ff7cd07f3064 ("net: thunderbolt: Enable DMA paths only after rings are enabled") moved the path enable to the end of tbnet_connected_work() and documented why:
/* Both logins successful so enable the rings, high-speed DMA
* paths and start the network device queue.
*
* Note we enable the DMA paths last to make sure we have primed
* the Rx ring before any incoming packets are allowed to
* arrive.
*/
Teardown was never updated to match, so the rings and the paths now come down in the same order they go up instead of in reverse.
On an ASMedia ASM4242 host router the 'pending' bit then never clears:
every teardown burns the full 500 ms timeout and __tb_path_deactivate_hop() returns -ETIMEDOUT. Raising the timeout to 5 s does not help, so the hop is not slow to drain, it never drains at all.
The failure is invisible above the thunderbolt core. __tb_path_deactivate_hops() is void and only calls tb_port_warn(); tb_path_deactivate(), tb_tunnel_deactivate() and __tb_disconnect_xdomain_paths() are void as well, and tb_disconnect_xdomain_paths() ends in an unconditional "return 0". So tb_xdomain_disable_paths() reports success and the netdev_warn() below it never fires. Repeated teardowns eventually take the XDomain control channel down, after which the peer node is gone and only a power cycle brings the controller back.
Deactivating the paths first fixes it. Measured with kretprobes on a stock v6.17 tree with no other patches applied, on a link that was up and had just carried traffic:
before: __tb_path_deactivate_hop() returns 0 for the first hop, then
-ETIMEDOUT for the second 500335 us later
after: 0 for both, 525 us apart
Alternating the two orderings ABBA over three load levels, four teardowns per arm: every teardown failed before the change (21 of 21 that ran), none failed after (0 of 24). The before arms ran short because the link died partway through. The same split shows up when the interface is enslaved to a bond instead of just brought down, which is how I ran into this in the first place. Throughput and latency after the change are unchanged.
Hosts whose routers drain the hop despite the stale descriptor base see no functional difference, since the paths end up deactivated either way.
--- drivers/net/thunderbolt/main.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-)
drivers/net/thunderbolt/main.c +15 -5
@@ -389,11 +389,16 @@ static void tbnet_tear_down(struct tbnet *net, bool send_logout)break ; } -tb_ring_stop (net->rx_ring.ring); -tb_ring_stop (net->tx_ring.ring); -tbnet_free_buffers (&net->rx_ring); -tbnet_free_buffers (&net->tx_ring); - +/* Tear the paths down before stopping the rings. This mirrors +* tbnet_connected_work(), which enables the paths last so the +* Rx ring is primed before packets can arrive. Stopping a +* ring zeroes its descriptor base and tbnet_free_buffers() +* unmaps and frees the frame buffers, leaving anything still +* in flight with nowhere to drain to; +* __tb_path_deactivate_hop() then waits for the hop's +* 'pending' bit, which on some host routers never clears in +* that state. +*/ ret = tb_xdomain_disable_paths(net->xd, net->local_transmit_path, net->tx_ring.ring->hop,
@@ -402,6 +407,11 @@ static void tbnet_tear_down(struct tbnet *net, bool send_logout)if (ret)netdev_warn (net->dev,"failed to disable DMA paths\n" ); +tb_ring_stop (net->rx_ring.ring); +tb_ring_stop (net->tx_ring.ring); +tbnet_free_buffers (&net->rx_ring); +tbnet_free_buffers (&net->tx_ring); +tb_xdomain_release_in_hopid (net->xd, net->remote_transmit_path); net->remote_transmit_path =0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 53/156 ata: pata_sl82c105: fix bridge revision use-after-free
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongyan Xu <[email protected]>
[ Upstream commit 7700a31039cdc6715cb6cce7e7a664ee4e945f67 ]
pci_get_slot() returns a referenced PCI device. Commit 44c10138fd4b ("PCI: Change all drivers to use pci_device->revision") replaced a configuration-space read with direct access to the cached revision field, but left that access after pci_dev_put(). The bridge may therefore be freed before its revision is read.
Read the revision before dropping the reference.
--- drivers/ata/pata_sl82c105.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/ata/pata_sl82c105.c +3 -1
@@ -264,6 +264,7 @@ static struct ata_port_operations sl82c105_port_ops = {static int sl82c105_bridge_revision (struct pci_dev *pdev) {struct pci_dev *bridge; +u8 revision;/* * The bridge should be part of the same device, but function 0.
@@ -285,8 +286,9 @@ static int sl82c105_bridge_revision(struct pci_dev *pdev)/* * We need to find function 0's revision, not function 1 */ + revision = bridge->revision;pci_dev_put (bridge); -return bridge->revision; +return revision; }static void sl82c105_fixup (struct pci_dev *pdev)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 54/156 net/tcp: Prepare tcp_md5sig_pool for TCP-AO
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Safonov <[email protected]>
[ Upstream commit 8c73b26315aadb82218360d0a9a05e515f6e4118 ]
TCP-AO, similarly to TCP-MD5, needs to allocate tfms on a slow-path, which is setsockopt() and use crypto ahash requests on fast paths, which are RX/TX softirqs. Also, it needs a temporary/scratch buffer for preparing the hash.
Rework tcp_md5sig_pool in order to support other hashing algorithms than MD5. It will make it possible to share pre-allocated crypto_ahash descriptors and scratch area between all TCP hash users.
Internally tcp_sigpool calls crypto_clone_ahash() API over pre-allocated crypto ahash tfm. Kudos to Herbert, who provided this new crypto API.
I was a little concerned over GFP_ATOMIC allocations of ahash and crypto_request in RX/TX (see tcp_sigpool_start()), so I benchmarked both "backends" with different algorithms, using patched version of iperf3[2]. On my laptop with i7-7600U @ 2.80GHz:
clone-tfm per-CPU-requests TCP-MD5 2.25 Gbits/sec 2.30 Gbits/sec TCP-AO(hmac(sha1)) 2.53 Gbits/sec 2.54 Gbits/sec TCP-AO(hmac(sha512)) 1.67 Gbits/sec 1.64 Gbits/sec TCP-AO(hmac(sha384)) 1.77 Gbits/sec 1.80 Gbits/sec TCP-AO(hmac(sha224)) 1.29 Gbits/sec 1.30 Gbits/sec TCP-AO(hmac(sha3-512)) 481 Mbits/sec 480 Mbits/sec TCP-AO(hmac(md5)) 2.07 Gbits/sec 2.12 Gbits/sec TCP-AO(hmac(rmd160)) 1.01 Gbits/sec 995 Mbits/sec TCP-AO(cmac(aes128)) [not supporetd yet] 2.11 Gbits/sec
So, it seems that my concerns don't have strong grounds and per-CPU crypto_request allocation can be dropped/removed from tcp_sigpool once ciphers get crypto_clone_ahash() support.
[1]: https://lore.kernel.org/all/[email protected]/T/#u
[2]: https://github.com/0x7f454c46/iperf/tree/tcp-md5-ao
Stable-dep-of: d0c80dbb9704 ("net/atm: fix slab-out-of-bounds read in vcc_setsockopt()")
--- include/net/tcp.h | 50 ++++-- net/ipv4/Kconfig | 4 + net/ipv4/Makefile | 1 + net/ipv4/tcp.c | 145 +++------------- net/ipv4/tcp_ipv4.c | 97 ++++++----- net/ipv4/tcp_minisocks.c | 21 ++- net/ipv4/tcp_sigpool.c | 358 +++++++++++++++++++++++++++++++++++++++ net/ipv6/tcp_ipv6.c | 60 +++---- 8 files changed, 525 insertions(+), 211 deletions(-) create mode 100644 net/ipv4/tcp_sigpool.c
include/net/tcp.h +36 -14
@@ -1730,12 +1730,39 @@ union tcp_md5sum_block {#endif }; -/* - pool: digest algorithm, hash description and scratch buffer */ -struct tcp_md5sig_pool { -struct ahash_request *md5_req; -void *scratch; +/* +* struct tcp_sigpool - per-CPU pool of ahash_requests +* @scratch: per-CPU temporary area, that can be used between +* tcp_sigpool_start() and tcp_sigpool_end() to perform +* crypto request +* @req: pre-allocated ahash request +*/ +struct tcp_sigpool { +void *scratch; +struct ahash_request *req; }; +int tcp_sigpool_alloc_ahash (const char *alg,size_t scratch_size); +void tcp_sigpool_get (unsigned int id); +void tcp_sigpool_release (unsigned int id); +int tcp_sigpool_hash_skb_data (struct tcp_sigpool *hp, +const struct sk_buff *skb, +unsigned int header_len); + +/** +* tcp_sigpool_start - disable bh and start using tcp_sigpool_ahash +* @id: tcp_sigpool that was previously allocated by tcp_sigpool_alloc_ahash() +* @c: returned tcp_sigpool for usage (uninitialized on failure) +* +* Returns 0 on success, error otherwise. +*/ +int tcp_sigpool_start (unsigned int id,struct tcp_sigpool *c); +/** +* tcp_sigpool_end - enable bh and stop using tcp_sigpool +* @c: tcp_sigpool context that was returned by tcp_sigpool_start() +*/ +void tcp_sigpool_end (struct tcp_sigpool *c); +size_t tcp_sigpool_algo (unsigned int id,char *buf,size_t buf_len);/* - functions */ int tcp_v4_md5_hash_skb (char *md5_hash,const struct tcp_md5sig_key *key,const struct sock *sk,const struct sk_buff *skb);
@@ -1791,17 +1818,12 @@ tcp_inbound_md5_hash(const struct sock *sk, const struct sk_buff *skb,#define tcp_twsk_md5_key (twsk) NULL#endif -bool tcp_alloc_md5sig_pool (void ); - -struct tcp_md5sig_pool *tcp_get_md5sig_pool (void ); -static inline void tcp_put_md5sig_pool (void ) -{ -local_bh_enable (); -} +int tcp_md5_alloc_sigpool (void ); +void tcp_md5_release_sigpool (void ); +void tcp_md5_add_sigpool (void ); +extern int tcp_md5_sigpool_id; -int tcp_md5_hash_skb_data (struct tcp_md5sig_pool *,const struct sk_buff *, -unsigned int header_len); -int tcp_md5_hash_key (struct tcp_md5sig_pool *hp, +int tcp_md5_hash_key (struct tcp_sigpool *hp,const struct tcp_md5sig_key *key);/* From tcp_fastopen.c */
net/ipv4/Kconfig +4 -0
@@ -741,10 +741,14 @@ config DEFAULT_TCP_CONG default "bbr" if DEFAULT_BBR default "cubic" +config TCP_SIGPOOL + tristate + config TCP_MD5SIG bool "TCP: MD5 Signature Option support (RFC2385)" select CRYPTO select CRYPTO_MD5 + select TCP_SIGPOOL help RFC2385 specifies a method of giving MD5 protection to TCP sessions. Its main (only?) use is to protect BGP sessions between core routers
net/ipv4/Makefile +1 -0
@@ -62,6 +62,7 @@ obj-$(CONFIG_TCP_CONG_SCALABLE) += tcp_scalable.o obj-$(CONFIG_TCP_CONG_LP) += tcp_lp.o obj-$(CONFIG_TCP_CONG_YEAH) += tcp_yeah.o obj-$(CONFIG_TCP_CONG_ILLINOIS) += tcp_illinois.o +obj-$(CONFIG_TCP_SIGPOOL) += tcp_sigpool.o obj-$(CONFIG_NET_SOCK_MSG) += tcp_bpf.o obj-$(CONFIG_BPF_SYSCALL) += udp_bpf.o obj-$(CONFIG_NETLABEL) += cipso_ipv4.o
net/ipv4/tcp.c +28 -117
169 lines not on this page · raw message
net/ipv4/tcp_ipv4.c +56 -41
194 lines not on this page · raw message
net/ipv4/tcp_minisocks.c +15 -6
@@ -261,10 +261,9 @@ static void tcp_time_wait_init(struct sock *sk, struct tcp_timewait_sock *tcptw) tcptw->tw_md5_key =kmemdup (key,sizeof (*key),GFP_ATOMIC );if (!tcptw->tw_md5_key)return ; -if (!tcp_alloc_md5sig_pool ()) - goto out_free;if (!static_key_fast_inc_not_disabled (&tcp_md5_needed.key.key)) goto out_free; +tcp_md5_add_sigpool (); }return ; out_free:
@@ -348,16 +347,26 @@ void tcp_time_wait(struct sock *sk, int state, int timeo) }EXPORT_SYMBOL (tcp_time_wait); +#ifdef CONFIG_TCP_MD5SIG +static void tcp_md5_twsk_free_rcu (struct rcu_head *head) +{ +struct tcp_md5sig_key *key; + + key = container_of(head, struct tcp_md5sig_key, rcu); +kfree (key); +static_branch_slow_dec_deferred (&tcp_md5_needed); +tcp_md5_release_sigpool (); +} +#endif +void tcp_twsk_destructor (struct sock *sk) {#ifdef CONFIG_TCP_MD5SIG if (static_branch_unlikely (&tcp_md5_needed.key)) {struct tcp_timewait_sock *twsk =tcp_twsk (sk); -if (twsk->tw_md5_key) { -kfree_rcu (twsk->tw_md5_key, rcu); -static_branch_slow_dec_deferred (&tcp_md5_needed); - } +if (twsk->tw_md5_key) +call_rcu (&twsk->tw_md5_key->rcu, tcp_md5_twsk_free_rcu); }#endif }
net/ipv4/tcp_sigpool.c new file +358 -0
358 lines not on this page · raw message
net/ipv6/tcp_ipv6.c +27 -33
113 lines not on this page · raw message
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 55/156 net/tcp: Add TCP-AO config and structures
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Safonov <[email protected]>
[ Upstream commit c845f5f3590ef4669fe5464f8a42be6442cd174b ]
Introduce new kernel config option and common structures as well as helpers to be used by TCP-AO code.
Stable-dep-of: d0c80dbb9704 ("net/atm: fix slab-out-of-bounds read in vcc_setsockopt()")
--- include/linux/tcp.h | 9 +++- include/net/tcp.h | 8 +--- include/net/tcp_ao.h | 90 ++++++++++++++++++++++++++++++++++++++++ include/uapi/linux/tcp.h | 2 + net/ipv4/Kconfig | 13 ++++++ 5 files changed, 114 insertions(+), 8 deletions(-) create mode 100644 include/net/tcp_ao.h
include/linux/tcp.h +7 -2
@@ -445,13 +445,18 @@ struct tcp_sock {bool syn_smc;/* SYN includes SMC */ #endif -#ifdef CONFIG_TCP_MD5SIG -/* TCP AF-Specific parts; only used by MD5 Signature support so far */ +#if defined(CONFIG_TCP_MD5SIG ) || defined(CONFIG_TCP_AO ) +/* TCP AF-Specific parts; only used by TCP-AO/MD5 Signature support so far */ const struct tcp_sock_af_ops *af_specific; +#ifdef CONFIG_TCP_MD5SIG /* TCP MD5 Signature Option information */ struct tcp_md5sig_info __rcu *md5sig_info;#endif +#ifdef CONFIG_TCP_AO +struct tcp_ao_info __rcu *ao_info; +#endif +#endif /* TCP fastopen related information */ struct tcp_fastopen_request *fastopen_req;
include/net/tcp.h +2 -6
@@ -37,6 +37,7 @@#include <net/snmp.h> #include <net/ip.h> #include <net/tcp_states.h> +#include <net/tcp_ao.h> #include <net/inet_ecn.h> #include <net/dst.h> #include <net/mptcp.h>
@@ -1681,12 +1682,7 @@ static inline void tcp_clear_all_retrans_hints(struct tcp_sock *tp) tp->retransmit_skb_hint =NULL ; } -union tcp_md5_addr { -struct in_addr a4; -#if IS_ENABLED (CONFIG_IPV6 ) -struct in6_addr a6; -#endif -}; +#define tcp_md5_addr tcp_ao_addr/* - key database */ struct tcp_md5sig_key {
include/net/tcp_ao.h new file +90 -0
90 lines not on this page · raw message
include/uapi/linux/tcp.h +2 -0
@@ -360,6 +360,8 @@ struct tcp_diag_md5sig {__u8 tcpm_key[TCP_MD5SIG_MAXKEYLEN ]; }; +#define TCP_AO_MAXKEYLEN 80 +/* setsockopt(fd, IPPROTO_TCP, TCP_ZEROCOPY_RECEIVE, ...) */ #define TCP_RECEIVE_ZEROCOPY_FLAG_TLB_CLEAN_HINT 0x1
net/ipv4/Kconfig +13 -0
@@ -744,6 +744,19 @@ config DEFAULT_TCP_CONG config TCP_SIGPOOL tristate +config TCP_AO + bool "TCP: Authentication Option (RFC5925)" + select CRYPTO + select TCP_SIGPOOL + depends on 64BIT && IPV6 != m # seq-number extension needs WRITE_ONCE(u64) + help + TCP-AO specifies the use of stronger Message Authentication Codes (MACs), + protects against replays for long-lived TCP connections, and + provides more details on the association of security with TCP + connections than TCP MD5 (See RFC5925) + + If unsure, say N. + config TCP_MD5SIG bool "TCP: MD5 Signature Option support (RFC2385)" select CRYPTO
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 56/156 net/atm: fix slab-out-of-bounds read in vcc_setsockopt()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit d0c80dbb970439bd2eeb0e5effff8c16a5f4e1e3 ]
vcc_setsockopt() contained an ineffective optlen check:
if (__SO_LEVEL_MATCH(optname, level) && optlen != __SO_SIZE(optname))
return -EINVAL;
If __SO_LEVEL_MATCH(optname, level) evaluated to false (e.g. if the caller passed a mismatched level), the length check optlen != __SO_SIZE(optname) was short-circuited and bypassed. Execution then fell through to switch(optname), calling copy_from_sockptr() assuming optval contained sufficient space.
Furthermore, even if level matched, a cgroup BPF setsockopt filter could shrink optlen after entry. Because copy_from_sockptr() on kernel pointers uses memcpy(), this leads to a KASAN slab-out-of-bounds read when optlen is smaller than the expected structure size.
Fix this by using copy_safe_from_sockptr(), which unconditionally validates that optlen is at least the expected size before copying. Also change the local 'value' variable type from 'unsigned long' to 'int' so that SO_SETCLP matches its sizeof(int) ABI encoding on 64-bit systems.
--- net/atm/common.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
net/atm/common.c +9 -5
@@ -760,7 +760,7 @@ int vcc_setsockopt(struct socket *sock, int level, int optname, sockptr_t optval, unsigned int optlen) {struct atm_vcc *vcc; -unsigned long value; +int value;int error;if (__SO_LEVEL_MATCH (optname, level) && optlen !=__SO_SIZE (optname))
@@ -772,8 +772,10 @@ int vcc_setsockopt(struct socket *sock, int level, int optname, {struct atm_qos qos; -if (copy_from_sockptr (&qos, optval,sizeof (qos))) -return -EFAULT ; + error =copy_safe_from_sockptr (&qos,sizeof (qos), optval, + optlen); +if (error) +return error; error =check_qos (&qos);if (error)return error;
@@ -786,8 +788,10 @@ int vcc_setsockopt(struct socket *sock, int level, int optname,return 0 ; }case SO_SETCLP : -if (copy_from_sockptr (&value, optval,sizeof (value))) -return -EFAULT ; + error =copy_safe_from_sockptr (&value,sizeof (value), optval, + optlen); +if (error) +return error;if (value) vcc->atm_options |=ATM_ATMOPT_CLP ;else
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 57/156 sctp: clear control chunk transport if it is being removed
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit c9158ceaf27780ef64534ad72f44ffde3f8ccc49 ]
sctp_make_heartbeat_ack() caches the destination transport in chunk->transport without taking a reference. When src_out_of_asoc_ok is enabled, the HEARTBEAT ACK may remain queued on control_chunk_list instead of being transmitted immediately.
If the peer transport is removed while the chunk is still queued, sctp_assoc_rm_peer() drops the transport and schedules it for RCU freeing, but only clears cached transport pointers in out_chunk_list. The queued control chunk therefore retains a dangling transport pointer.
Once an ASCONF_ACK clears the suppression and the queued control chunk is transmitted, SCTP dereferences the stale transport pointer, leading to a use-after-free.
Fix this by also clearing chunk->transport for queued control chunks in control_chunk_list when removing the transport.
--- net/sctp/associola.c | 4 ++++ 1 file changed, 4 insertions(+)
net/sctp/associola.c +4 -0
@@ -573,6 +573,10 @@ void sctp_assoc_rm_peer(struct sctp_association *asoc,if (ch->transport == peer) ch->transport =NULL ; +list_for_each_entry (ch, &asoc->outqueue.control_chunk_list, list) +if (ch->transport == peer) + ch->transport =NULL ; + asoc->peer.transport_count--;sctp_ulpevent_notify_peer_addr_change (peer,SCTP_ADDR_REMOVED ,0 );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 58/156 tls: dont abort the connection on signal-interrupted sends
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maximilian Immanuel Brandtner <[email protected]>
[ Upstream commit af0e5cdd031f4f4a8f6d4160bfbda4f36872b0ed ]
When a signal interrupts a blocking send, tls_tx_records() treats the resulting -ERESTARTSYS as a transmission failure and marks the socket errored via tls_err_abort() with the raw error code. Later syscalls return the kernel-internal errno 512 (ERESTARTSYS) to userspace, as the signal it stems from is no longer pending during syscall exit and thus never translated.
An interrupted send is not a connection error: the partially sent record stays queued and is resent later. Interrupt error codes are therefore excluded from the abort in the same way as -EAGAIN.
--- net/tls/tls_sw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/tls/tls_sw.c +1 -1
@@ -458,7 +458,7 @@ int tls_tx_records(struct sock *sk, int flags) } tx_err: -if (rc <0 && rc != -EAGAIN ) +if (rc <0 && rc != -EAGAIN && rc != -EINTR && rc != -ERESTARTSYS )tls_err_abort (sk, rc);return rc;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 59/156 hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wilken Gottwalt <[email protected]>
[ Upstream commit 36c4d73ce05d1d8896c2669eb0730d35a02a2ec1 ]
In theory it could be possible that the REPLY_SIZE sized buffers for holding the vendor and product strings could be end up missing the null termination (for example by malicious hardware built on purpose) required by the seq_printf() call. That limits the debugfs printf calls to a maximum string length of REPLY_SIZE.
--- drivers/hwmon/corsair-psu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/hwmon/corsair-psu.c +2 -2
@@ -709,7 +709,7 @@ static int vendor_show(struct seq_file *seqf, void *unused) {struct corsairpsu_data *priv = seqf->private; -seq_printf (seqf,"%s\n" , priv->vendor); +seq_printf (seqf,"%.*s\n" ,REPLY_SIZE , priv->vendor);return 0 ; }
@@ -719,7 +719,7 @@ static int product_show(struct seq_file *seqf, void *unused) {struct corsairpsu_data *priv = seqf->private; -seq_printf (seqf,"%s\n" , priv->product); +seq_printf (seqf,"%.*s\n" ,REPLY_SIZE , priv->product);return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 60/156 regulator: devres: add API for reference voltage supplies
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
[ Upstream commit b250c20b64290808aa4b5cc6d68819a7ee28237f ]
A common use case for regulators is to supply a reference voltage to an analog input or output device. This adds a new devres API to get, enable, and get the voltage in a single call. This allows eliminating boilerplate code in drivers that use reference supplies in this way.
Stable-dep-of: fddb5ceaf901 ("hwmon: (ads7828) Fix external VREF regulator handling")
--- .../driver-api/driver-model/devres.rst | 1 + drivers/regulator/devres.c | 59 +++++++++++++++++++ include/linux/regulator/consumer.h | 7 +++ 3 files changed, 67 insertions(+)
Documentation/driver-api/driver-model/devres.rst +1 -0
@@ -426,6 +426,7 @@ REGULATOR devm_regulator_bulk_put() devm_regulator_get() devm_regulator_get_enable() + devm_regulator_get_enable_read_voltage() devm_regulator_get_enable_optional() devm_regulator_get_exclusive() devm_regulator_get_optional()
drivers/regulator/devres.c +59 -0
65 lines not on this page · raw message
include/linux/regulator/consumer.h +7 -0
@@ -209,6 +209,7 @@ struct regulator *__must_check devm_regulator_get_optional(struct device *dev, const char *id);int devm_regulator_get_enable (struct device *dev,const char *id);int devm_regulator_get_enable_optional (struct device *dev,const char *id); +int devm_regulator_get_enable_read_voltage (struct device *dev,const char *id);void regulator_put (struct regulator *regulator);void devm_regulator_put (struct regulator *regulator);
@@ -374,6 +375,12 @@ static inline int devm_regulator_get_enable_optional(struct device *dev,return 0 ; } +static inline int devm_regulator_get_enable_read_voltage (struct device *dev, +const char *id) +{ +return -ENODEV ; +} +static inline struct regulator *__must_check regulator_get_optional (struct device *dev,const char *id) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 61/156 hwmon: (ads7828) Fix external VREF regulator handling
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qingshuang Fu <[email protected]>
[ Upstream commit fddb5ceaf901b050ed2a1a7deeecbf97e003435a ]
The driver currently has two issues with the external VREF regulator handling in ads7828_probe():
1. All errors from devm_regulator_get_optional() are ignored, causing the driver to incorrectly fall back to internal VREF even for transient errors like -EPROBE_DEFER or genuine failures like -ENOMEM.
2. The external regulator is never enabled. The driver calls regulator_get_voltage() without first calling regulator_enable(), so the VREF pin may remain unpowered if the regulator is not configured as always-on.
Fix both issues by switching to devm_regulator_get_enable_read_voltage(), which handles regulator get, enable, and voltage read in one call. Only -ENODEV (no regulator specified in device tree) should trigger the fallback to internal VREF. All other errors are propagated to the caller.
--- drivers/hwmon/ads7828.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/hwmon/ads7828.c +6 -5
@@ -108,12 +108,11 @@ static int ads7828_probe(struct i2c_client *client)struct ads7828_data *data;struct device *hwmon_dev;unsigned int vref_mv =ADS7828_INT_VREF_MV ; -unsigned int vref_uv; +int vref_uv;bool diff_input = false;bool ext_vref = false;unsigned int regval;enum ads7828_chips chip; -struct regulator *reg; data =devm_kzalloc (dev,sizeof (struct ads7828_data ),GFP_KERNEL );if (!data)
@@ -127,9 +126,11 @@ static int ads7828_probe(struct i2c_client *client) }else if (dev->of_node) { diff_input =of_property_read_bool (dev->of_node,"ti,differential-input" ); - reg =devm_regulator_get_optional (dev,"vref" ); -if (!IS_ERR (reg)) { - vref_uv =regulator_get_voltage (reg); + vref_uv =devm_regulator_get_enable_read_voltage (dev,"vref" ); +if (vref_uv <0 ) { +if (vref_uv != -ENODEV ) +return vref_uv; + }else { vref_mv =DIV_ROUND_CLOSEST (vref_uv,1000 );if (vref_mv <ADS7828_EXT_VREF_MV_MIN || vref_mv >ADS7828_EXT_VREF_MV_MAX )
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 62/156 net: fec: do not release NULL pages when RX buffer allocation fails
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mehmet Fide <[email protected]>
fec_enet_alloc_rxq_buffers() leaves the loop as soon as page_pool_dev_alloc_pages() returns NULL and jumps to err_alloc, which calls fec_enet_free_buffers(). That helper walks the whole ring and hands every rx_skb_info[i].page to page_pool_put_full_page(), including the entries the allocation loop never reached. Those are still NULL, because the queue was allocated with kzalloc(), and page_pool_put_full_page() dereferences the page, so an open that runs out of memory oopses instead of returning -ENOMEM:
Unable to handle kernel NULL pointer dereference at virtual address 00000014 when read Internal error: Oops: 5 [#1] SMP ARM CPU: 0 PID: 384 Comm: connmand Not tainted 6.18.43 #1 Hardware name: Freescale Vybrid VF5xx/VF6xx (Device Tree) PC is at fec_enet_free_buffers+0xb0/0x2a8 Call trace: fec_enet_free_buffers from fec_enet_open+0x1e0/0x504 fec_enet_open from __dev_open+0x114/0x238 __dev_open from __dev_change_flags+0x190/0x208 __dev_change_flags from netif_change_flags+0x1c/0x58 netif_change_flags from dev_change_flags+0x44/0x74 dev_change_flags from devinet_ioctl+0x3a4/0x768
Seen on a Colibri VF50, 128 MiB of RAM, on the first ifup after boot.
Skip the entries that hold no page, and clear the ones that do after releasing them, so that a later failed open cannot release the same page a second time.
Mainline is not affected. Commit a2ae70c0efe4 ("net: fec: add fec_alloc_rxq_buffers_pp() to allocate buffers from page pool") replaced this loop with fec_free_rxq_buffers(), which skips and clears the empty entries. That commit is part of the XDP zero copy series and is not a stable candidate, so this is the equivalent minimal fix for 6.18.y.
--- drivers/net/ethernet/freescale/fec_main.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/net/ethernet/freescale/fec_main.c +9 -2
@@ -3322,8 +3322,15 @@ static void fec_enet_free_buffers(struct net_device *ndev)for (q =0 ; q < fep->num_rx_queues; q++) { rxq = fep->rx_queue[q]; -for (i =0 ; i < rxq->bd.ring_size; i++) -page_pool_put_full_page (rxq->page_pool, rxq->rx_skb_info[i].page, false); +for (i =0 ; i < rxq->bd.ring_size; i++) { +struct page *page = rxq->rx_skb_info[i].page; + +if (!page) +continue ; + +page_pool_put_full_page (rxq->page_pool, page, false); + rxq->rx_skb_info[i].page =NULL ; + }for (i =0 ; i <XDP_STATS_TOTAL ; i++) rxq->stats[i] =0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 63/156 spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larisa Grigore <[email protected]>
[ Upstream commit cac7e5054115fcc41b1cb050af8e8971f7c9b22b ]
Repacking multiple smaller words into larger ones to make use of the full FIFO doesn't save anything in DMA mode, so don't bother doing it.
--- drivers/spi/spi-fsl-dspi.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
drivers/spi/spi-fsl-dspi.c +7 -6
@@ -751,8 +751,12 @@ static void dspi_setup_accel(struct fsl_dspi *dspi)struct spi_transfer *xfer = dspi->cur_transfer;bool odd = !!(dspi->len &1 ); -/* No accel for frames not multiple of 8 bits at the moment */ -if (xfer->bits_per_word %8 ) +/* +* No accel for DMA transfers or frames not multiples of 8 bits at the +* moment. +*/ +if (dspi->devtype_data->trans_mode ==DSPI_DMA_MODE || + xfer->bits_per_word %8 ) goto no_accel;if (!odd && dspi->len <= dspi->devtype_data->fifo_size *2 ) {
@@ -761,10 +765,7 @@ static void dspi_setup_accel(struct fsl_dspi *dspi) dspi->oper_bits_per_word =8 ; }else {/* Start off with maximum supported by hardware */ -if (dspi->devtype_data->trans_mode ==DSPI_XSPI_MODE ) - dspi->oper_bits_per_word =32 ; -else - dspi->oper_bits_per_word =16 ; + dspi->oper_bits_per_word =32 ;/* * And go down only if the buffer can't be sent with
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 64/156 Input: evdev - sanitize event type index when fetching event masks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
commit 3abd29c61d2ef37c4102cf755b18be53bb9dbea6 upstream.
The user-supplied event type index passed to EVIOCGMASK / EVIOCSMASK ioctls is used to index the static counts array in evdev_get_mask_cnt() and client evmasks array in evdev_get_mask().
While the event type is architecturally bounded by EV_CNT, speculative execution may mispredict bounds checks and perform out-of-bounds loads.
Sanitize the event type index in evdev_get_mask_cnt() branchlessly using array_index_mask_nospec(). This clamps the index to 0 for safe array access and forces the returned count to 0 speculatively when the index is out of bounds.
We do not need additional array_index_nospec() calls in evdev_get_mask() because evdev_get_mask_cnt() speculatively forces the count (and resulting xfer_size) to 0 for out-of-bounds types, preventing any speculative memory access to client evmasks array.
--- drivers/input/evdev.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/input/evdev.c +4 -1
@@ -21,6 +21,7 @@#include <linux/init.h> #include <linux/input/mt.h> #include <linux/major.h> +#include <linux/nospec.h> #include <linux/device.h> #include <linux/cdev.h> #include "input-compat.h"
@@ -67,8 +68,10 @@ static size_t evdev_get_mask_cnt(unsigne [EV_SND] = SND_CNT, [EV_FF] = FF_CNT, }; +unsigned long mask =array_index_mask_nospec (type,EV_CNT ); -return (type <EV_CNT ) ? counts[type] :0 ; +/* Returns 0 for out-of-bounds types, including speculatively */ +return counts[type & mask] & mask; }/* requires the buffer lock to be held */
Greg Kroah-Hartman
maintainerPATCH 65/156 ALSA: usb-audio: fix OOB write on Type II inbound URBs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baul Lee <[email protected]>
commit 69ee44e1a23be62318189dc4b37fa4ad94053269 upstream.
data_ep_set_params() sizes each URB transfer buffer before it adds the Format Type II transfer delimiter:
u->packets = urb_packs; u->buffer_size = maxsize * u->packets; if (fmt->fmt_type == UAC_FORMAT_TYPE_II) u->packets++; /* for transfer delimiter */ u->urb = usb_alloc_urb(u->packets, GFP_KERNEL);
buffer_size is computed from the pre-increment packet count and never recomputed, so for a Type II endpoint the buffer is one packet short of the packet count the URB is built with.
prepare_inbound_urb() then lays out one iso frame per packet and never consults buffer_size:
offs = 0;
for (i = 0; i < urb_ctx->packets; i++) {
urb->iso_frame_desc[i].offset = offs;
urb->iso_frame_desc[i].length = ep->curpacksize;
offs += ep->curpacksize;
}
urb->transfer_buffer_length = offs;
urb->number_of_packets = urb_ctx->packets;The last descriptor therefore points one packet past the end of the transfer buffer, where the host controller writes device data on every inbound transfer. prepare_silent_urb() and prepare_playback_urb() bound their fill loops by ctx->buffer_size, so only capture is affected.
fmt_type comes from the device's audio streaming descriptors, so any device advertising a Type II capture format hits this once userspace sets hw_params on the stream.
KASAN on 7.2.0-rc5 (arm64) with a dummy_hcd/raw-gadget device, one report per inbound transfer:
BUG: KASAN: slab-out-of-bounds in dummy_timer Write of size 64 at addr ffff0000186171c0 by task cons02/166 __asan_memcpy dummy_timer hrtimer_run_softirq Allocated by task 166: usb_alloc_coherent snd_usb_endpoint_set_params The buggy address is located 0 bytes to the right of allocated 64-byte region [ffff000018617180, ffff0000186171c0)
Compute buffer_size after the delimiter packet has been accounted for, and bound the fill loop by buffer_size, as prepare_silent_urb() already does on the outbound side. This grows every Type II URB allocation by one maxsize packet.
Discovered by XBOW, triaged by Baul Lee <[email protected]>
--- sound/usb/endpoint.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
sound/usb/endpoint.c +4 -2
@@ -388,13 +388,15 @@ static int prepare_inbound_urb(struct sncase SND_USB_ENDPOINT_TYPE_DATA : offs =0 ;for (i =0 ; i < urb_ctx->packets; i++) { +if (offs + ep->curpacksize > urb_ctx->buffer_size) +break ; urb->iso_frame_desc[i].offset = offs; urb->iso_frame_desc[i].length = ep->curpacksize; offs += ep->curpacksize; } urb->transfer_buffer_length = offs; - urb->number_of_packets = urb_ctx->packets; + urb->number_of_packets = i;break ;case SND_USB_ENDPOINT_TYPE_SYNC :
@@ -1260,10 +1262,10 @@ static int data_ep_set_params(struct snd u->index = i; u->ep = ep; u->packets = urb_packs; - u->buffer_size = maxsize * u->packets;if (fmt->fmt_type ==UAC_FORMAT_TYPE_II ) u->packets++;/* for transfer delimiter */ + u->buffer_size = maxsize * u->packets; u->urb =usb_alloc_urb (u->packets,GFP_KERNEL );if (!u->urb) goto out_of_memory;
Greg Kroah-Hartman
maintainerPATCH 66/156 usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Nogikh <[email protected]>
commit c2f811314be351d86b6ab41e9297ae80d8da6f86 upstream.
If cxacru_cm() encounters an error while submitting or waiting for snd_urb, it aborts and returns the error without killing the already submitted rcv_urb. This leaves the rcv_urb active.
When this happens during initialization (e.g., in cxacru_atm_start()), the driver may ignore the error and proceed to call cxacru_poll_status(), which invokes cxacru_cm() again. Attempting to submit the still-active rcv_urb triggers a warning in usb_submit_urb():
cxacru 1-1:1.0: send of cm 0x84 failed (-104)
ATM dev 0: cxacru_atm_start: CHIP_ADSL_LINE_START returned -104
------------[ cut here ]------------ URB ffff88812658d200 submitted while active WARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0x79/0x18b0 drivers/usb/core/urb.c:379 ... Call Trace: <TASK> cxacru_cm+0x21a/0xf10 drivers/usb/atm/cxacru.c:631 cxacru_cm_get_array drivers/usb/atm/cxacru.c:722 [inline] cxacru_poll_status+0x178/0x1110 drivers/usb/atm/cxacru.c:828 cxacru_atm_start+0x185/0x360 drivers/usb/atm/cxacru.c:814 usbatm_atm_init+0x144/0x3a0 drivers/usb/atm/usbatm.c:927 usbatm_usb_probe+0x15cb/0x1db0 drivers/usb/atm/usbatm.c:1178 cxacru_usb_probe+0x17f/0x220 drivers/usb/atm/cxacru.c:1370
...
To fix this, ensure that rcv_urb is properly killed if cxacru_cm() aborts early. We can safely call usb_kill_urb() on rcv_urb in the error path, as it is safe to call even if the URB is not active (e.g., if it failed to submit in the first place, or if it already completed).
--- drivers/usb/atm/cxacru.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/atm/cxacru.c +2 -0
@@ -700,6 +700,8 @@ static int cxacru_cm(struct cxacru_data ret = offd;usb_dbg (instance->usbatm,"cm %#x\n" , cm); fail: +if (ret <0 ) +usb_kill_urb (instance->rcv_urb);mutex_unlock (&instance->cm_serialize); err:return ret;
Greg Kroah-Hartman
maintainerPATCH 67/156 thunderbolt: icm: Preserve USB4 proxy data-valid bit
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Rao <[email protected]>
commit e48844ece5e3ed1d1eb865f6da2b16f62cd9f86d upstream.
The ICM USB4 switch operation request encodes two values in request.data_len_valid: bit 4 marks the data payload valid, while bits 3:0 hold the payload length in dwords. A zero length with the valid bit set represents the full 16-dword data array.
icm_usb4_switch_op() sets the valid bit when a transmit payload is present. For payloads shorter than the full 16 dwords, it then assigns the length to the whole field and clears the valid bit that was just set. The payload is still copied into the request, but the descriptor sent to firmware marks that data as invalid.
This affects USB4 router operations that send short payloads through the firmware connection manager. In particular, USB4 NVM writes can send a short final block when the image size is not aligned to the 64-byte proxy payload size. Firmware may then ignore or reject that final block, while full 16-dword blocks are unaffected because they are encoded as length 0 with the valid bit set.
OR the short payload length into data_len_valid so the valid bit is preserved.
--- drivers/thunderbolt/icm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/thunderbolt/icm.c +1 -1
@@ -2291,7 +2291,7 @@ static int icm_usb4_switch_op(struct tb_if (tx_data_len) { request.data_len_valid |=ICM_USB4_SWITCH_DATA_VALID ;if (tx_data_len <ARRAY_SIZE (request.data)) - request.data_len_valid = + request.data_len_valid |= tx_data_len &ICM_USB4_SWITCH_DATA_LEN_MASK ;memcpy (request.data, tx_data, tx_data_len *sizeof (u32)); }
Greg Kroah-Hartman
maintainerPATCH 68/156 usb: cdnsp: fix incorrect endian conversions for APB timeout register
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawel Laszczak <[email protected]>
commit 50b303f3d0f7de543ee90d50879970783d06da33 upstream.
readl() already returns a CPU-endian value. Passing its return value to le32_to_cpu() is therefore redundant and causes an incorrect double byte swap on big-endian systems.
Similarly, writel() expects a CPU-endian value, so passing the result of cpu_to_le32() is incorrect.
Remove the unnecessary conversions and operate on the MMIO register value as a CPU-endian u32.
--- drivers/usb/cdns3/cdnsp-gadget.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/cdns3/cdnsp-gadget.c +2 -2
@@ -154,9 +154,9 @@ static void cdnsp_set_apb_timeout_value( offset =cdnsp_find_next_ext_cap (base, offset,D_XEC_PRE_REGS_CAP ); reg = base + offset +REG_CHICKEN_BITS_3_OFFSET ; - val =le32_to_cpu (readl (reg)); + val =readl (reg); val =CHICKEN_APB_TIMEOUT_SET (val, cdns->override_apb_timeout); -writel (cpu_to_le32 (val), reg); +writel (val, reg); }static void cdnsp_set_chicken_bits_2 (struct cdnsp_device *pdev,u32 bit)
Greg Kroah-Hartman
maintainerPATCH 69/156 usb: gadget: f_ncm: Use unsigned int for ndp_index
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sonali Pradhan <[email protected]>
commit 6b1c8a9403a26cb0fed7a648916c74dc236da591 upstream.
The variable ndp_index is declared as a signed integer, but it stores the return value of get_ncm(), which is unsigned.
A malicious host can supply a large offset that overflows the signed ndp_index, making it negative. Because ndp_index is compared against unsigned bounds, this negative value bypasses sanity checks and leads to an out-of-bounds read when calculating the address of the NDP block (ntb_ptr + ndp_index).
Fix this by changing ndp_index to unsigned int to ensure consistent unsigned comparisons throughout the function.
--- drivers/usb/gadget/function/f_ncm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/gadget/function/f_ncm.c +1 -1
@@ -1161,7 +1161,7 @@ static int ncm_unwrap_ntb(struct getherunsigned char *ntb_ptr = skb->data;__le16 *tmp;unsigned index, index2; -int ndp_index; +unsigned int ndp_index;unsigned dg_len, dg_len2;unsigned ndp_len;unsigned block_len;
Greg Kroah-Hartman
maintainerPATCH 70/156 net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yi Cong <[email protected]>
commit 1f428e30947395d9b9aacee03e25a4e6cfcad7a4 upstream.
When the interface has NETIF_F_SG enabled and skb_linearize() fails in ax88179_tx_fixup(), the function returns NULL without freeing the skb.
usbnet_start_xmit() treats a NULL return from tx_fixup() as a drop (info->flags does not set FLAG_MULTI_PACKET for this driver), jumping to the "drop" label where it does if (skb) dev_kfree_skb_any(skb). Because tx_fixup() returned NULL, the local skb variable in usbnet_start_xmit() is NULL, so the original skb is never freed — a memory leak on every TX frame whose linearization fails (i.e. under memory pressure).
Free the skb before returning, matching the error handling already used for the pskb_expand_head() failure path in the same function.
--- drivers/net/usb/ax88179_178a.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/usb/ax88179_178a.c +3 -1
@@ -1491,8 +1491,10 @@ ax88179_tx_fixup(struct usbnet *dev, str headroom =skb_headroom (skb) -8 ; -if ((dev->net->features &NETIF_F_SG ) &&skb_linearize (skb)) +if ((dev->net->features &NETIF_F_SG ) &&skb_linearize (skb)) { +dev_kfree_skb_any (skb);return NULL ; + }if ((skb_header_cloned (skb) || headroom <0 ) &&pskb_expand_head (skb, headroom <0 ?8 :0 ,0 ,GFP_ATOMIC )) {
Greg Kroah-Hartman
maintainerPATCH 71/156 vt: add permission check for KDSKBMETA ioctl
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Rogers <[email protected]>
commit a7ad0034453ba4c353f9b8f810ee2569de33d283 upstream.
KDSKBMETA modifies keyboard meta mode but lacks the !perm check that all other keyboard setter ioctls in vt_k_ioctl() enforce, allowing a process to change meta mode on a non-controlling console without authorization.
--- drivers/tty/vt/vt_ioctl.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/tty/vt/vt_ioctl.c +2 -0
@@ -408,6 +408,8 @@ static int vt_k_ioctl(struct tty_struct/* this could be folded into KDSKBMODE, but for compatibility reasons it is not so easy to fold KDGKBMETA into KDGKBMODE */ case KDSKBMETA : +if (!perm) +return -EPERM ;return vt_do_kdskbmeta (console, arg);case KDGKBMETA :
Greg Kroah-Hartman
maintainerPATCH 72/156 vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Rogers <[email protected]>
commit e25d47a526939ad44b75f778b8a7500562b84fc1 upstream.
kbd_keycode() reads vc->port.tty without acquiring a tty reference, racing against con_shutdown() which clears port.tty under a different lock. Use tty_port_tty_get()/tty_kref_put() to hold a proper reference for the duration the tty pointer is needed.
--- drivers/tty/vt/keyboard.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/tty/vt/keyboard.c +4 -1
@@ -1405,7 +1405,7 @@ static void kbd_keycode(unsigned int keystruct keyboard_notifier_param param = { .vc = vc, .value = keycode, .down = down };int rc; - tty = vc->port.tty; + tty =tty_port_tty_get (&vc->port);if (tty && (!tty->driver_data)) {/* No driver data? Strange. Okay we fix it then. */
@@ -1465,9 +1465,12 @@ static void kbd_keycode(unsigned int key* characters get aren't echoed locally. This makes key repeat * usable with slow applications and under heavy loads. */ +tty_kref_put (tty);return ; } +tty_kref_put (tty); + param.shift = shift_final = (shift_state | kbd->slockstate) ^ kbd->lockstate; param.ledstate = kbd->ledflagstate; key_map = key_maps[shift_final];
Greg Kroah-Hartman
maintainerPATCH 73/156 Input: evdev - fix information leak in evdev_pass_values()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
commit 90f305f2c7a30257c683e13f4bf7c798eea992a0 upstream.
In evdev_pass_values(), the input_event structure is allocated on the kernel stack and populated field-by-field. However, it is never fully initialized. On architectures where struct input_event contains explicit or implicit padding (such as the 32-bit __pad field on SPARC64), these padding bytes are left uninitialized.
When this event structure is subsequently passed to the client buffer and later copied to userspace, the uninitialized padding bytes leak kernel stack memory, potentially exposing sensitive information.
Similar issues exist in __evdev_queue_syn_dropped and __pass_event.
Fix this by explicitly zeroing the entire event structure with memset() before populating its fields. This ensures all padding bytes are cleared before the data crosses the security boundary.
--- drivers/input/evdev.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-)
drivers/input/evdev.c +12 -10
@@ -149,11 +149,11 @@ static void __evdev_queue_syn_dropped(ststruct timespec64 ts =ktime_to_timespec64 (ev_time[client->clk_type]);struct input_event ev; +memset (&ev,0 ,sizeof (ev)); ev.input_event_sec = ts.tv_sec; ev.input_event_usec = ts.tv_nsec /NSEC_PER_USEC ; ev.type =EV_SYN ; ev.code =SYN_DROPPED ; - ev.value =0 ; client->buffer[client->head++] = ev; client->head &= client->bufsize -1 ;
@@ -221,20 +221,20 @@ static void __pass_event(struct evdev_cl client->head &= client->bufsize -1 ;if (unlikely (client->head == client->tail)) { +struct input_event ev; + +memset (&ev,0 ,sizeof (ev)); + ev.input_event_sec = event->input_event_sec; + ev.input_event_usec = event->input_event_usec; + ev.type =EV_SYN ; + ev.code =SYN_DROPPED ; +/* * This effectively "drops" all unconsumed events, leaving * EV_SYN/SYN_DROPPED plus the newest event in the queue. */ client->tail = (client->head -2 ) & (client->bufsize -1 ); - - client->buffer[client->tail] = (struct input_event ) { - .input_event_sec = event->input_event_sec, - .input_event_usec = event->input_event_usec, - .type =EV_SYN , - .code =SYN_DROPPED , - .value =0 , - }; - + client->buffer[client->tail] = ev; client->packet_head = client->tail; }
@@ -256,6 +256,8 @@ static void evdev_pass_values(struct evdif (client->revoked)return ; +memset (&event,0 ,sizeof (event)); + ts =ktime_to_timespec64 (ev_time[client->clk_type]); event.input_event_sec = ts.tv_sec; event.input_event_usec = ts.tv_nsec /NSEC_PER_USEC ;
Greg Kroah-Hartman
maintainerPATCH 74/156 ima: fix out-of-bounds read in xattr_verify()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lincoln Wallace <[email protected]>
commit 5ff232d31106f45ac87c3b64e1d35a0667777797 upstream.
The digest-length check in xattr_verify() mixes int and size_t:
if (xattr_len - sizeof(xattr_value->type) - hash_start >= iint->ima_hash->length)
sizeof() yields size_t, so the usual arithmetic conversions promote the whole left-hand side to unsigned 64-bit before the subtraction runs. For a truncated xattr this underflows instead of going negative:
a 1-byte IMA_XATTR_DIGEST_NG xattr (xattr_len == 1, hash_start == 1) turns "1 - 1 - 1" into SIZE_MAX, which is trivially >= ima_hash->length. The check then passes and the following memcmp() reads iint->ima_hash->length bytes starting past the end of the buffer vfs_getxattr_alloc() allocated for it.
Nothing upstream clamps xattr_len back into a safe range first:ima_get_hash_algo() only special-cases xattr_len < 2 to pick a default algorithm, and evm_verifyxattr() returns INTEGRITY_UNKNOWN rather than failing when no HMAC key is loaded, so a truncated security.ima value reaches the length check as-is.
Rewrite the comparison so every operand stays a signed int and no implicit conversion to size_t can occur.
--- security/integrity/ima/ima_appraise.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
security/integrity/ima/ima_appraise.c +7 -2
@@ -304,8 +304,13 @@ static int xattr_verify(enum ima_hooks f }else {set_bit (IMA_DIGSIG , &iint->atomic_flags); } -if (xattr_len -sizeof (xattr_value->type) - hash_start >= - iint->ima_hash->length) +/* +* Use addition, not subtraction: sizeof() forces unsigned +* math and a short xattr_len would wrap around, bypassing +* this bounds check. +*/ +if (xattr_len >= (int )sizeof (xattr_value->type) + hash_start + + (int )iint->ima_hash->length)/* * xattr length may be longer. md5 hash in previous * version occupied 20 bytes in xattr, instead of 16
Greg Kroah-Hartman
maintainerPATCH 75/156 ipvs: stop estimator after disabled calc phase
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhiling Zou <[email protected]>
commit 558f67f1340f803a346ecd14a69c49653111c5f4 upstream.
IPVS estimator kthread 0 starts with zeroed chain and tick limits until its initial calculation phase completes. If network namespace teardown clears ipvs->enable during that phase, ip_vs_est_calc_phase() can return without installing positive limits.
The kthread can then continue into its main loop and drain est_temp_list with zero chain_max, tick_max and est_max_count values. Each enqueue consumes one available tick row, but est_count never reaches the zero est_max_count value. After all rows are consumed, the row lookup returns IPVS_EST_NTICKS and ip_vs_enqueue_estimator() writes past the ticks and tick_len arrays.
Exit kthread 0 after the calculation phase if the kthread is stopping or IPVS has been disabled. That keeps temporary estimators from being drained after the limits failed to initialize.
Estimator kthreads can now self-exit before teardown or reload stops kd->task. Keep an extra task reference after creation and release it with kthread_stop_put(), so kd->task remains valid until the stop paths consume that reference.
--- net/netfilter/ipvs/ip_vs_est.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
net/netfilter/ipvs/ip_vs_est.c +7 -3
@@ -186,8 +186,11 @@ static int ip_vs_estimation_kthread(void }/* kthread 0 will handle the calc phase */ -if (ipvs->est_calc_phase) +if (ipvs->est_calc_phase) {ip_vs_est_calc_phase (ipvs); +if (kthread_should_stop () || !READ_ONCE (ipvs->enable)) +return 0 ; + } }while (1 ) {
@@ -262,6 +265,7 @@ int ip_vs_est_kthread_start(struct netns kd->task =NULL ; goto out; } +get_task_struct (kd->task);set_user_nice (kd->task,sysctl_est_nice (ipvs));set_cpus_allowed_ptr (kd->task,sysctl_est_cpulist (ipvs));
@@ -277,7 +281,7 @@ void ip_vs_est_kthread_stop(struct ip_vs {if (kd->task) {pr_info ("stopping estimator thread %d...\n" , kd->id); -kthread_stop (kd->task); +kthread_stop_put (kd->task); kd->task =NULL ; } }
@@ -509,7 +513,7 @@ static void ip_vs_est_kthread_destroy(stif (kd) {if (kd->task) {pr_info ("stop unused estimator thread %d...\n" , kd->id); -kthread_stop (kd->task); +kthread_stop_put (kd->task); }ip_vs_stats_free (kd->calc_stats);kfree (kd);
Greg Kroah-Hartman
maintainerPATCH 76/156 ipvs: add totalconns for dest
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Anastasov <[email protected]>
commit 04d2feaed8d0103c498727191ba04001d5100e67 upstream.
Replace the inactconns dest counter with totalconns, now inactconns can be obtained from totalconns - activeconns. This reduces the atomic inc/dec ops for TCP/SCTP from 6 to 4 if the connection is established and then closed.
--- include/net/ip_vs.h | 17 ++++++++++++----- net/netfilter/ipvs/ip_vs_conn.c | 24 +++++++----------------- net/netfilter/ipvs/ip_vs_ctl.c | 10 +++++----- net/netfilter/ipvs/ip_vs_lc.c | 4 ++-- net/netfilter/ipvs/ip_vs_proto_sctp.c | 2 -- net/netfilter/ipvs/ip_vs_proto_tcp.c | 2 -- net/netfilter/ipvs/ip_vs_sync.c | 7 ++----- 7 files changed, 28 insertions(+), 38 deletions(-)
include/net/ip_vs.h +12 -5
@@ -736,7 +736,7 @@ struct ip_vs_dest {/* connection counters and thresholds */ atomic_t activeconns;/* active connections */ -atomic_t inactconns;/* inactive connections */ +atomic_t totalconns;/* total connections */ atomic_t persistconns;/* persistent connections */ __u32 u_threshold;/* upper threshold */ __u32 l_threshold;/* lower threshold */
@@ -1865,14 +1865,21 @@ void ip_vs_unregister_hooks(struct netnsstatic inline int ip_vs_dest_conn_overhead (struct ip_vs_dest *dest) { -/* We think the overhead of processing active connections is 256 +/* We think the overhead of processing active connections is 257 * times higher than that of inactive connections in average. (This -* 256 times might not be accurate, we will change it later) We +* 257 times might not be accurate, we will change it later) We * use the following formula to estimate the overhead now: -* dest->activeconns*256 + dest->inactconns +* dest->activeconns*256 + dest->totalconns */ return (atomic_read (&dest->activeconns) <<8 ) + -atomic_read (&dest->inactconns); +atomic_read (&dest->totalconns); +} + +static inline int +ip_vs_dest_inactconns (const struct ip_vs_dest *dest) +{ +return max (atomic_read (&dest->totalconns) - +atomic_read (&dest->activeconns),0 ); }#ifdef CONFIG_IP_VS_PROTO_TCP
net/netfilter/ipvs/ip_vs_conn.c +7 -17
@@ -569,12 +569,6 @@ static inline void ip_vs_bind_xmit_v6(st#endif -static inline int ip_vs_dest_totalconns (struct ip_vs_dest *dest) -{ -return atomic_read (&dest->activeconns) - +atomic_read (&dest->inactconns); -} -/* * Bind a connection entry with a virtual service destination * Called just after a new connection entry is created.
@@ -632,8 +626,7 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, s*/ if (!(flags &IP_VS_CONN_F_INACTIVE ))atomic_inc (&dest->activeconns); -else -atomic_inc (&dest->inactconns); +atomic_inc (&dest->totalconns); }else {/* It is a persistent connection/template, so increase the persistent connection counter */
@@ -641,7 +634,7 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, s }if (dest->u_threshold !=0 && -ip_vs_dest_totalconns (dest) >= dest->u_threshold) +atomic_read (&dest->totalconns) >= dest->u_threshold) dest->flags |=IP_VS_DEST_F_OVERLOAD ; }
@@ -723,13 +716,10 @@ static inline void ip_vs_unbind_dest(str/* Update the connection counters */ if (!(cp->flags &IP_VS_CONN_F_TEMPLATE )) { -/* It is a normal connection, so decrease the inactconns -or activeconns counter */ -if (cp->flags &IP_VS_CONN_F_INACTIVE ) { -atomic_dec (&dest->inactconns); - }else { +/* It is a normal connection, so decrease the counters */ +if (!(cp->flags &IP_VS_CONN_F_INACTIVE ))atomic_dec (&dest->activeconns); - } +atomic_dec (&dest->totalconns); }else {/* It is a persistent connection/template, so decrease the persistent connection counter */
@@ -737,10 +727,10 @@ static inline void ip_vs_unbind_dest(str }if (dest->l_threshold !=0 ) { -if (ip_vs_dest_totalconns (dest) < dest->l_threshold) +if (atomic_read (&dest->totalconns) < dest->l_threshold) dest->flags &= ~IP_VS_DEST_F_OVERLOAD ; }else if (dest->u_threshold !=0 ) { -if (ip_vs_dest_totalconns (dest) *4 < dest->u_threshold *3 ) +if (atomic_read (&dest->totalconns) *4 < dest->u_threshold *3 ) dest->flags &= ~IP_VS_DEST_F_OVERLOAD ; }else {if (dest->flags &IP_VS_DEST_F_OVERLOAD )
net/netfilter/ipvs/ip_vs_ctl.c +5 -5
@@ -1101,7 +1101,7 @@ ip_vs_new_dest(struct ip_vs_service *svc dest->port = udest->port;atomic_set (&dest->activeconns,0 ); -atomic_set (&dest->inactconns,0 ); +atomic_set (&dest->totalconns,0 );atomic_set (&dest->persistconns,0 );refcount_set (&dest->refcnt,1 );
@@ -2456,7 +2456,7 @@ static int ip_vs_info_seq_show(struct seip_vs_fwd_name (atomic_read (&dest->conn_flags)),atomic_read (&dest->weight),atomic_read (&dest->activeconns), - atomic_read(&dest->inactconns)); + ip_vs_dest_inactconns(dest)); else #endif seq_printf(seq,
@@ -2467,7 +2467,7 @@ static int ip_vs_info_seq_show(struct seip_vs_fwd_name (atomic_read (&dest->conn_flags)),atomic_read (&dest->weight),atomic_read (&dest->activeconns), - atomic_read(&dest->inactconns)); + ip_vs_dest_inactconns(dest)); } }
@@ -2953,7 +2953,7 @@ __ip_vs_get_dest_entries(struct netns_ip entry.u_threshold = dest->u_threshold; entry.l_threshold = dest->l_threshold; entry.activeconns =atomic_read (&dest->activeconns); - entry.inactconns =atomic_read (&dest->inactconns); + entry.inactconns =ip_vs_dest_inactconns (dest); entry.persistconns =atomic_read (&dest->persistconns);ip_vs_copy_stats (&kstats, &dest->stats);ip_vs_export_stats_user (&entry.stats, &kstats);
@@ -3557,7 +3557,7 @@ static int ip_vs_genl_fill_dest(struct snla_put_u32 (skb,IPVS_DEST_ATTR_ACTIVE_CONNS ,atomic_read (&dest->activeconns)) ||nla_put_u32 (skb,IPVS_DEST_ATTR_INACT_CONNS , -atomic_read (&dest->inactconns)) || +ip_vs_dest_inactconns (dest)) ||nla_put_u32 (skb,IPVS_DEST_ATTR_PERSIST_CONNS ,atomic_read (&dest->persistconns)) || nla_put_u16(skb, IPVS_DEST_ATTR_ADDR_FAMILY, dest->af))
net/netfilter/ipvs/ip_vs_lc.c +2 -2
@@ -31,7 +31,7 @@ ip_vs_lc_schedule(struct ip_vs_service */* * Simply select the server with the least number of -* (activeconns<<5) + inactconns +* (activeconns*256) + totalconns * Except whose weight is equal to zero. * If the weight is equal to zero, it means that the server is * quiesced, the existing connections to the server still get
@@ -57,7 +57,7 @@ ip_vs_lc_schedule(struct ip_vs_service *IP_VS_DBG_ADDR (least->af, &least->addr),ntohs (least->port),atomic_read (&least->activeconns), - atomic_read(&least->inactconns)); + ip_vs_dest_inactconns(least));return least; }
net/netfilter/ipvs/ip_vs_proto_sctp.c +0 -2
@@ -446,12 +446,10 @@ set_sctp_state(struct ip_vs_proto_data *if (!(cp->flags &IP_VS_CONN_F_INACTIVE ) && (next_state !=IP_VS_SCTP_S_ESTABLISHED )) {atomic_dec (&dest->activeconns); -atomic_inc (&dest->inactconns); cp->flags |=IP_VS_CONN_F_INACTIVE ; }else if ((cp->flags &IP_VS_CONN_F_INACTIVE ) && (next_state ==IP_VS_SCTP_S_ESTABLISHED )) {atomic_inc (&dest->activeconns); -atomic_dec (&dest->inactconns); cp->flags &= ~IP_VS_CONN_F_INACTIVE ; } }
net/netfilter/ipvs/ip_vs_proto_tcp.c +0 -2
@@ -527,12 +527,10 @@ set_tcp_state(struct ip_vs_proto_data *pif (!(cp->flags &IP_VS_CONN_F_INACTIVE ) && !tcp_state_active (new_state)) {atomic_dec (&dest->activeconns); -atomic_inc (&dest->inactconns); cp->flags |=IP_VS_CONN_F_INACTIVE ; }else if ((cp->flags &IP_VS_CONN_F_INACTIVE ) &&tcp_state_active (new_state)) {atomic_inc (&dest->activeconns); -atomic_dec (&dest->inactconns); cp->flags &= ~IP_VS_CONN_F_INACTIVE ; } }
net/netfilter/ipvs/ip_vs_sync.c +2 -5
@@ -879,13 +879,10 @@ static void ip_vs_proc_conn(struct netnsspin_lock_bh (&cp->lock);if ((cp->flags ^ flags) &IP_VS_CONN_F_INACTIVE && !(flags &IP_VS_CONN_F_TEMPLATE ) && dest) { -if (flags &IP_VS_CONN_F_INACTIVE ) { +if (flags &IP_VS_CONN_F_INACTIVE )atomic_dec (&dest->activeconns); -atomic_inc (&dest->inactconns); - }else { +else atomic_inc (&dest->activeconns); -atomic_dec (&dest->inactconns); - } } flags &=IP_VS_CONN_F_BACKUP_UPD_MASK ; flags |= cp->flags & ~IP_VS_CONN_F_BACKUP_UPD_MASK ;
Greg Kroah-Hartman
maintainerPATCH 77/156 ipvs: properly update the overload flag on dest edit
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Anastasov <[email protected]>
commit 8f843441c4e7eae8ea83491e8c203c2b192edcf5 upstream.
The upper/lower connection thresholds for dest can be changed, so use ip_vs_dest_update_overload() to properly update the dest overload flag.
The thresholds were not limited, fit them in the 0 .. INT_MAX range as already done in ipvsadm.
As the thresholds are also read when connections are created and expired, use WRITE_ONCE/READ_ONCE to access them.
As the lower threshold is optional, use (u - (u >> 2)) to calculate the 75% default value based on the upper threshold by preserving the integer rounding, as suggested by Yizhou Zhao.
Trigger flag update when totalconns reaches one of the thresholds and use dst_lock to serialize the updating.
--- include/net/ip_vs.h | 3 + net/netfilter/ipvs/ip_vs_conn.c | 27 +++++----------- net/netfilter/ipvs/ip_vs_ctl.c | 67 +++++++++++++++++++++++++++++++++++----- 3 files changed, 72 insertions(+), 25 deletions(-)
include/net/ip_vs.h +3 -0
@@ -740,6 +740,7 @@ struct ip_vs_dest {atomic_t persistconns;/* persistent connections */ __u32 u_threshold;/* upper threshold */ __u32 l_threshold;/* lower threshold */ +__u32 l_threshold_val;/* used lower threshold */ /* for destination cache */ spinlock_t dst_lock;/* lock of dst_cache */
@@ -1567,6 +1568,8 @@ static inline void ip_vs_dest_put_and_frkfree (dest); } +void ip_vs_dest_update_overload (struct ip_vs_dest *dest,int mode); +/* IPVS sync daemon data and function prototypes * (from ip_vs_sync.c) */
net/netfilter/ipvs/ip_vs_conn.c +10 -17
@@ -620,22 +620,22 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, s/* Update the connection counters */ if (!(flags &IP_VS_CONN_F_TEMPLATE )) { +int tc; +/* It is a normal connection, so modify the counters * according to the flags, later the protocol can * update them on state change */ if (!(flags &IP_VS_CONN_F_INACTIVE ))atomic_inc (&dest->activeconns); -atomic_inc (&dest->totalconns); + tc =atomic_inc_return (&dest->totalconns); +if (tc ==READ_ONCE (dest->u_threshold)) +ip_vs_dest_update_overload (dest,1 ); }else {/* It is a persistent connection/template, so increase the persistent connection counter */ atomic_inc (&dest->persistconns); } - -if (dest->u_threshold !=0 && -atomic_read (&dest->totalconns) >= dest->u_threshold) - dest->flags |=IP_VS_DEST_F_OVERLOAD ; }
@@ -716,27 +716,20 @@ static inline void ip_vs_unbind_dest(str/* Update the connection counters */ if (!(cp->flags &IP_VS_CONN_F_TEMPLATE )) { +int tc; +/* It is a normal connection, so decrease the counters */ if (!(cp->flags &IP_VS_CONN_F_INACTIVE ))atomic_dec (&dest->activeconns); -atomic_dec (&dest->totalconns); + tc =atomic_fetch_dec (&dest->totalconns); +if (tc ==READ_ONCE (dest->l_threshold_val)) +ip_vs_dest_update_overload (dest,-1 ); }else {/* It is a persistent connection/template, so decrease the persistent connection counter */ atomic_dec (&dest->persistconns); } -if (dest->l_threshold !=0 ) { -if (atomic_read (&dest->totalconns) < dest->l_threshold) - dest->flags &= ~IP_VS_DEST_F_OVERLOAD ; - }else if (dest->u_threshold !=0 ) { -if (atomic_read (&dest->totalconns) *4 < dest->u_threshold *3 ) - dest->flags &= ~IP_VS_DEST_F_OVERLOAD ; - }else { -if (dest->flags &IP_VS_DEST_F_OVERLOAD ) - dest->flags &= ~IP_VS_DEST_F_OVERLOAD ; - } -ip_vs_dest_put (dest); }
net/netfilter/ipvs/ip_vs_ctl.c +59 -8
103 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 78/156 ipvs: clear IPv4 options after rebasing tunnel ICMP errors
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kyle Zeng <[email protected]>
commit e0ba936287dfe9783426aac27e5fd76fe35b38c9 upstream.
ip_vs_in_icmp() rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmp_send(). However, IPCB(skb)->opt still describes the outer IPv4 header.
A timestamp option in the outer header can therefore leave an offset that points into the quoted transport header after the rebase. __ip_options_echo() treats a byte at that stale location as the option length and copies it into the fixed-size option storage on the __icmp_send() stack, causing a stack out-of-bounds write.
Clear the stale option metadata after resetting the network header. Keep the remaining control block fields, including the ingress interface used by the ICMP response path.
--- net/netfilter/ipvs/ip_vs_core.c | 1 + 1 file changed, 1 insertion(+)
net/netfilter/ipvs/ip_vs_core.c +1 -0
@@ -1768,6 +1768,7 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, sif (pskb_pull (skb, offset2) ==NULL ) goto ignore_tunnel;skb_reset_network_header (skb); +memset (&(IPCB (skb)->opt),0 ,sizeof (IPCB (skb)->opt));/* Ensure the IP header is present in headroom */ if (!pskb_may_pull (skb, hlen_orig)) goto ignore_tunnel;
Greg Kroah-Hartman
maintainerPATCH 79/156 packet: use consistent hard_header_len in non-ring send paths
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qihang Tang <[email protected]>
commit 03390aa32e669cc4ecd7d34108e2e1afc13d689d upstream.
packet_snd() reads dev->hard_header_len multiple times while allocating and constructing an skb. Device reconfiguration can change this value concurrently, for example through bonding device type changes.
For SOCK_RAW, packet_snd() can save a larger value in reserve and later allocate headroom using a smaller value. Moving skb->data back by reserve then places it before skb->head, and the following copy from userspace can attempt an out-of-bounds write.
packet_sendmsg_spkt() has the same issue because it calculates its reservation and header offset from separate reads before dropping the RCU read lock to allocate the skb.
Add LL_RESERVED_SPACE_EX() for callers that already saved a header length. Read hard_header_len once in packet_snd() and use it for allocation and construction. In packet_sendmsg_spkt(), preserve the allocation-time value through the device lookup retry.
The separate SOCK_DGRAM consistency problem between hard_header_len and header_ops->create is not addressed here.
--- include/linux/netdevice.h | 6 ++++-- net/packet/af_packet.c | 26 ++++++++++++++++---------- 2 files changed, 20 insertions(+), 12 deletions(-)
include/linux/netdevice.h +4 -2
@@ -301,9 +301,11 @@ struct hh_cache {* We could use other alignment values, but we must maintain the * relationship HH alignment <= LL alignment. */ -#define LL_RESERVED_SPACE (dev) \ - ((((dev)->hard_header_len + READ_ONCE((dev)->needed_headroom)) \ +#define LL_RESERVED_SPACE_EX (dev, hlen) \ + ((((hlen) + READ_ONCE((dev)->needed_headroom)) \ & ~(HH_DATA_MOD - 1)) + HH_DATA_MOD) +#define LL_RESERVED_SPACE (dev) \ + LL_RESERVED_SPACE_EX(dev, (dev)->hard_header_len)#define LL_RESERVED_SPACE_EXTRA (dev,extra) \ ((((dev)->hard_header_len + READ_ONCE((dev)->needed_headroom) + (extra)) \ & ~(HH_DATA_MOD - 1)) + HH_DATA_MOD)
net/packet/af_packet.c +16 -10
@@ -2005,8 +2005,9 @@ static int packet_sendmsg_spkt(struct sostruct net_device *dev;struct sockcm_cookie sockc;__be16 proto =0 ; -int err; +int hard_header_len;int extra_len =0 ; +int err;/* * Get and verify the address.
@@ -2049,14 +2050,18 @@ retry: extra_len =4 ;/* We're doing our own CRC */ } +/* Keep the allocation-time header length across retry. */ +if (!skb) + hard_header_len =READ_ONCE (dev->hard_header_len); + err = -EMSGSIZE ; -if (len > dev->mtu + dev->hard_header_len +VLAN_HLEN + extra_len) +if (len > dev->mtu + hard_header_len +VLAN_HLEN + extra_len) goto out_unlock;if (!skb) { -size_t reserved =LL_RESERVED_SPACE (dev); +size_t reserved =LL_RESERVED_SPACE_EX (dev, hard_header_len);int tlen = dev->needed_tailroom; -unsigned int hhlen = dev->header_ops ? dev->hard_header_len :0 ; +unsigned int hhlen = dev->header_ops ? hard_header_len :0 ;rcu_read_unlock (); skb =sock_wmalloc (sk, len + reserved + tlen,0 ,GFP_KERNEL );
@@ -2086,7 +2091,7 @@ retry: err = -EINVAL ; goto out_unlock; } -if (len > (dev->mtu + dev->hard_header_len + extra_len) && +if (len > (dev->mtu + hard_header_len + extra_len) && !packet_extra_vlan_len_allowed (dev, skb)) { err = -EMSGSIZE ; goto out_unlock;
@@ -3015,7 +3020,7 @@ static int packet_snd(struct socket *socint offset =0 ;struct packet_sock *po =pkt_sk (sk);int vnet_hdr_sz =READ_ONCE (po->vnet_hdr_sz); -int hlen, tlen, linear; +int hard_header_len, hlen, tlen, linear;int extra_len =0 ;/*
@@ -3056,8 +3061,9 @@ static int packet_snd(struct socket *soc goto out_unlock; } + hard_header_len =READ_ONCE (dev->hard_header_len);if (sock->type ==SOCK_RAW ) - reserve = dev->hard_header_len; + reserve = hard_header_len;if (vnet_hdr_sz) { err =packet_snd_vnet_parse (msg, &len, &vnet_hdr, vnet_hdr_sz);if (err)
@@ -3078,10 +3084,10 @@ static int packet_snd(struct socket *soc goto out_unlock; err = -ENOBUFS ; - hlen =LL_RESERVED_SPACE (dev); + hlen =LL_RESERVED_SPACE_EX (dev, hard_header_len); tlen = dev->needed_tailroom; linear =__virtio16_to_cpu (vio_le (), vnet_hdr.hdr_len); - linear =max (linear,min_t (int, len, dev->hard_header_len)); + linear =max (linear,min_t (int, len, hard_header_len)); skb =packet_alloc_skb (sk, hlen + tlen, hlen, len, linear, msg->msg_flags &MSG_DONTWAIT , &err);if (skb ==NULL )
@@ -3097,7 +3103,7 @@ static int packet_snd(struct socket *soc }else if (reserve) {skb_reserve (skb, -reserve);if (len < reserve +sizeof (struct ipv6hdr ) && - dev->min_header_len != dev->hard_header_len) + dev->min_header_len != hard_header_len)skb_reset_network_header (skb); }
Greg Kroah-Hartman
maintainerPATCH 80/156 packet: use consistent hard_header_len in TX_RING send path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qihang Tang <[email protected]>
commit 21b5953e7494c16a42e6cd8cf110e18d13ae4a6b upstream.
tpacket_snd() reads dev->hard_header_len independently for skb allocation and header construction in tpacket_fill_skb(). Concurrent netdevice reconfiguration can therefore make the reserved headroom smaller than the amount later pushed, or make copylen - hard_header_len negative.
Snapshot hard_header_len once before processing ring frames and use it for the frame limit, headroom allocation, copy length, and skb construction. Pass the snapshot to tpacket_fill_skb().
The separate SOCK_DGRAM consistency problem between hard_header_len and header_ops->create is not addressed here.
--- net/packet/af_packet.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-)
net/packet/af_packet.c +11 -8
@@ -2633,6 +2633,7 @@ static int packet_snd_vnet_parse(structstatic int tpacket_fill_skb (struct packet_sock *po,struct sk_buff *skb,void *frame,struct net_device *dev,void *data,int tp_len,__be16 proto,unsigned char *addr,int hlen,int copylen, +int hard_header_len,const struct sockcm_cookie *sockc) {union tpacket_uhdr ph;
@@ -2664,8 +2665,8 @@ static int tpacket_fill_skb(struct packe }else if (copylen) {int hdrlen =min_t (int, copylen, tp_len); -skb_push (skb, dev->hard_header_len); -skb_put (skb, copylen - dev->hard_header_len); +skb_push (skb, hard_header_len); +skb_put (skb, copylen - hard_header_len); err =skb_store_bits (skb,0 , data, hdrlen);if (unlikely (err))return err;
@@ -2796,7 +2797,7 @@ static int tpacket_snd(struct packet_socvoid *data;int len_sum =0 ;int status =TP_STATUS_AVAILABLE ; -int hlen, tlen, copylen =0 ; +int hard_header_len, hlen, tlen, copylen =0 ;long timeo;mutex_lock (&po->pg_vec_lock);
@@ -2843,8 +2844,9 @@ static int tpacket_snd(struct packet_soc goto out_put; } + hard_header_len =READ_ONCE (dev->hard_header_len);if (po->sk.sk_socket->type ==SOCK_RAW ) - reserve = dev->hard_header_len; + reserve = hard_header_len; size_max = po->tx_ring.frame_size - (po->tp_hdrlen -sizeof (struct sockaddr_ll ));
@@ -2881,7 +2883,7 @@ static int tpacket_snd(struct packet_soc goto tpacket_error; status =TP_STATUS_SEND_REQUEST ; - hlen =LL_RESERVED_SPACE (dev); + hlen =LL_RESERVED_SPACE_EX (dev, hard_header_len); tlen = dev->needed_tailroom;if (vnet_hdr_sz) { data += vnet_hdr_sz;
@@ -2899,10 +2901,10 @@ static int tpacket_snd(struct packet_soc vnet_hdr.hdr_len); has_vnet_hdr = true; } - copylen =max_t (int, copylen, dev->hard_header_len); + copylen =max_t (int, copylen, hard_header_len); skb =sock_alloc_send_skb (&po->sk, hlen + tlen +sizeof (struct sockaddr_ll ) + - (copylen - dev->hard_header_len), + (copylen - hard_header_len), !need_wait, &err);if (unlikely (skb ==NULL )) {
@@ -2912,7 +2914,8 @@ static int tpacket_snd(struct packet_soc goto out_status; } tp_len =tpacket_fill_skb (po, skb, ph, dev, data, tp_len, proto, - addr, hlen, copylen, &sockc); + addr, hlen, copylen, hard_header_len, + &sockc); if (likely(tp_len >= 0) && tp_len > dev->mtu + reserve && !vnet_hdr_sz &&
Greg Kroah-Hartman
maintainerPATCH 81/156 net/packet: reset the MAC header on the packet-socket transmit path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Doruk Tan Ozturk <[email protected]>
commit c2707480cfbf19c7619acc9c089d17f20869821f upstream.
packet_parse_headers() resets the MAC header only for a SOCK_RAW frame whose socket did not bind a protocol. A protocol-bound SOCK_RAW socket, any SOCK_DGRAM frame, and the legacy SOCK_PACKET path therefore leave skb->mac_header unset here.
For frames sent via __dev_queue_xmit() this is harmless: it resets the MAC header unconditionally. But the packet-socket PACKET_QDISC_BYPASS path uses dev_direct_xmit(), which does not, so the frame reaches ndo_start_xmit() with the MAC header unset. A driver that reads eth_hdr(skb) on transmit then dereferences skb->head + (u16)~0, an out-of-bounds access ~64 KiB past the head -- the same class fixed for one consumer in commit f5089008f90c ("macsec: do not read an unset MAC header in macsec_encrypt()").
packet_parse_headers() runs only on the transmit path, where skb->data points at the start of the L2 header for every packet-socket type regardless of its length: SOCK_RAW and SOCK_PACKET carry a user-supplied header and SOCK_DGRAM has one built by dev_hard_header(). Reset the MAC header unconditionally, mirroring __dev_queue_xmit(), so the frame is anchored on the bypass path too.
Found by 0sec (https://0sec.ai) using automated source analysis; verified against source and matched to the macsec KASAN report in f5089008f90c. Compile-tested.
--- net/packet/af_packet.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
net/packet/af_packet.c +4 -3
@@ -1976,11 +1976,12 @@ static void packet_parse_headers(struct {int depth; +/* On TX skb->data is the L2 header; anchor it for all socket types. */ +skb_reset_mac_header (skb); +if ((!skb->protocol || skb->protocol ==htons (ETH_P_ALL )) && - sock->type ==SOCK_RAW ) { -skb_reset_mac_header (skb); + sock->type ==SOCK_RAW ) skb->protocol =dev_parse_header_protocol (skb); - }/* Move network header to the right position for VLAN tagged packets */ if (likely(skb->dev->type == ARPHRD_ETHER) &&
Greg Kroah-Hartman
maintainerPATCH 82/156 packet: synchronize pressure clearing with ring reconfiguration
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zihan Xi <[email protected]>
commit 1a35da325cac4d5bcad76a2aa943408a6f1d9000 upstream.
packet_set_ring() updates the RX ring state under sk_receive_queue.lock, but used to publish the tpacket receive mode through po->prot_hook.func after releasing that lock. packet_poll() and packet_recvmsg() can then run the pressure clearing path after the ring has been cleared while still seeing tpacket_rcv, causing __packet_rcv_has_room() to dereference stale or NULL ring storage.
Move the existing receive hook assignment into the same sk_receive_queue.lock section as the ring state update. Keep the assignment otherwise unchanged, including on TX ring reconfiguration, to avoid adding behavior changes that are not required for the fix.
Serialize packet_recvmsg() pressure clearing with the same queue lock only after PACKET_SOCK_PRESSURE has been observed. If the flag is clear and the socket has moved away from tpacket_rcv, packet_set_ring() has already detached the socket and waited for synchronize_net(), so no new packet input can set the flag again.
packet_poll() already holds sk_receive_queue.lock, so it uses the new unlocked helper directly.
--- net/packet/af_packet.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-)
net/packet/af_packet.c +16 -4
@@ -1367,13 +1367,25 @@ static int packet_rcv_has_room(struct pareturn ret; } -static void packet_rcv_try_clear_pressure (struct packet_sock *po) +static void __packet_rcv_try_clear_pressure (struct packet_sock *po) {if (packet_sock_flag (po,PACKET_SOCK_PRESSURE ) &&__packet_rcv_has_room (po,NULL ) ==ROOM_NORMAL )packet_sock_flag_set (po,PACKET_SOCK_PRESSURE , false); } +static void packet_rcv_try_clear_pressure (struct packet_sock *po) +{ +struct sock *sk = &po->sk; + +if (!packet_sock_flag (po,PACKET_SOCK_PRESSURE )) +return ; + +spin_lock_bh (&sk->sk_receive_queue.lock); +__packet_rcv_try_clear_pressure (po); +spin_unlock_bh (&sk->sk_receive_queue.lock); +} +static void packet_sock_destruct (struct sock *sk) {skb_queue_purge (&sk->sk_error_queue);
@@ -4361,7 +4373,7 @@ static __poll_t packet_poll(struct file TP_STATUS_KERNEL)) mask |= EPOLLIN | EPOLLRDNORM; } -packet_rcv_try_clear_pressure (po); +__packet_rcv_try_clear_pressure (po);spin_unlock_bh (&sk->sk_receive_queue.lock);spin_lock_bh (&sk->sk_write_queue.lock);if (po->tx_ring.pg_vec) {
@@ -4601,14 +4613,14 @@ static int packet_set_ring(struct sock * rb->frame_max = (req->tp_frame_nr -1 ); rb->head =0 ; rb->frame_size = req->tp_frame_size; + po->prot_hook.func = (po->rx_ring.pg_vec) ? + tpacket_rcv : packet_rcv;spin_unlock_bh (&rb_queue->lock);swap (rb->pg_vec_order, order);swap (rb->pg_vec_len, req->tp_block_nr); rb->pg_vec_pages = req->tp_block_size/PAGE_SIZE ; - po->prot_hook.func = (po->rx_ring.pg_vec) ? - tpacket_rcv : packet_rcv;skb_queue_purge (rb_queue);if (atomic_long_read (&po->mapped)) pr_err("packet_mmap: vma is busy: %ld\n",
Greg Kroah-Hartman
maintainerPATCH 83/156 net: openvswitch: reallocate update replies for mismatched IDs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhiling Zou <[email protected]>
commit 5d1c224dd914579524a183a514c12b95095d12ce upstream.
ovs_flow_cmd_new() preallocates the optional reply skb before it takes ovs_mutex and before it knows which existing flow will be updated.
That is normally fine because the skb is sized from the request flow identifier. That identifier also becomes the inserted flow's identifier. For updates, however, a request with a UFID may miss the UFID lookup and then fall back to the flow key lookup. That lookup can legitimately find an existing key-identified flow. UFIDs are optional and the flow key is the primary identifier.
For echoed replies, ovs_flow_cmd_fill_info() writes the matched flow's identifier, not the request identifier used for the preallocation. A short request UFID can therefore leave too little room for the key identifier. The fill can then fail with -EMSGSIZE and hit the BUG_ON(error < 0) in the update path.
Once the update target has been resolved, reallocate the reply skb if the matched flow needs a larger reply than the request identifier allowed. Do this before replacing the actions so the request can still fail cleanly if the rare extra allocation fails.
--- net/openvswitch/datapath.c | 29 ++++++++++++++++++++++++++--- 1 file changed, 26 insertions(+), 3 deletions(-)
net/openvswitch/datapath.c +26 -3
@@ -1084,9 +1084,8 @@ static int ovs_flow_cmd_new(struct sk_bu error = -EEXIST ; goto err_unlock_ovs; } -/* The flow identifier has to be the same for flow updates. -* Look for any overlapping flow. -*/ + +/* Look for any overlapping flow. */ if (unlikely (!ovs_flow_cmp (flow, &match))) {if (ovs_identifier_is_key (&flow->id)) flow = ovs_flow_tbl_lookup_exact(&dp->table,
@@ -1098,6 +1097,30 @@ static int ovs_flow_cmd_new(struct sk_bu goto err_unlock_ovs; } } + +if (unlikely (reply)) { +size_t cur, req; + + cur =ovs_flow_cmd_msg_size (acts, &new_flow->id, + ufid_flags); + req =ovs_flow_cmd_msg_size (acts, &flow->id, + ufid_flags); +if (cur < req) { +struct sk_buff *resized; + + resized =ovs_flow_cmd_alloc_info (acts, + &flow->id, + info, false, + ufid_flags); +if (IS_ERR (resized)) { + error =PTR_ERR (resized); + goto err_unlock_ovs; + } +kfree_skb (reply); + reply = resized; + } + } +/* Update actions. */ old_acts =ovsl_dereference (flow->sf_acts);rcu_assign_pointer (flow->sf_acts, acts);
Greg Kroah-Hartman
maintainerPATCH 84/156 net/sched: reject overly deep qdisc hierarchies
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijie Huang <[email protected]>
commit dedd34b0f2310e28c5f6d4875cfbf4b7ed821c01 upstream.
Deep qdisc hierarchies can lead to excessive recursion in qdisc tree walkers and exhaust the kernel stack. The existing loop check does not cover the create-and-graft path, so a hierarchy can still be extended by creating a new child qdisc below an already deep parent.
Store the hierarchy depth in struct Qdisc and update it when qdiscs are grafted. Reject new child qdiscs once the parent is already at the maximum allowed depth.
--- include/net/sch_generic.h | 1 + net/sched/sch_api.c | 9 +++++++++ 2 files changed, 10 insertions(+)
include/net/sch_generic.h +1 -0
@@ -100,6 +100,7 @@ struct Qdisc {struct hlist_node hash;u32 handle;u32 parent; +int depth;struct netdev_queue *dev_queue;
net/sched/sch_api.c +9 -0
@@ -1066,6 +1066,9 @@ static int qdisc_graft(struct net_deviceunsigned int i, num_q, ingress;struct netdev_queue *dev_queue; +if (new) + new->depth =0 ; + ingress =0 ; num_q = dev->num_tx_queues; if ((q && q->flags & TCQ_F_INGRESS) ||
@@ -1163,9 +1166,15 @@ skip:NL_SET_ERR_MSG (extack,"STAB not supported on a non root" );return -EINVAL ; } +if (new && parent->depth >=7 ) { +NL_SET_ERR_MSG (extack,"Qdisc hierarchy is too deep" ); +return -E2BIG ; + } err = cops->graft (parent, cl, new, &old, extack);if (err)return err; +if (new) + new->depth = parent->depth +1 ;notify_and_destroy (net, skb, n, classid, old, new, extack); }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 85/156 net: octeontx2-pf: Fix UB in shift operation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey V. Frolov <[email protected]>
commit 7e2d693af0d4c05bddccb3541a0aabd69f4cb244 upstream.
In function otx2_get_egress_burst_cfg, when the parameter burst is 255 and the max mantissa is 255 (0xFFULL), burst_exp is set to ilog2(255) - 1, which equals 6.
This results in an unsigned wrap-around when calculating (1ULL << (*burst_exp - 7)), since *burst_exp - 7 becomes -1, which makes the shift operand 0xFFFFFFFF. This value is greater than the width of the left operand.
According to standard 6.5.7 p.3:
"The type of the result is that of the promoted left operand. If the value of the right operand is negative or is greater than or equal to the width of the promoted left operand, the behavior is undefined."
Fix the off-by-one boundary condition.
Add a WARN_ON(*burst_exp < 7) before the else branch as an explicit safeguard. This ensures that if max_mantissa ever changes in a way that reintroduces this condition, it will be immediately caught at runtime rather than silently triggering UB.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c +4 -2
@@ -72,10 +72,12 @@ static void otx2_get_egress_burst_cfg(stif (burst) { *burst_exp =ilog2 (burst) ?ilog2 (burst) -1 :0 ; tmp = burst -rounddown_pow_of_two (burst); -if (burst < max_mantissa) +if (burst <= max_mantissa) { *burst_mantissa = tmp *2 ; -else + }else { +WARN_ON (*burst_exp <7 ); *burst_mantissa = tmp / (1ULL << (*burst_exp -7 )); + } }else { *burst_exp =MAX_BURST_EXPONENT ; *burst_mantissa = max_mantissa;
Greg Kroah-Hartman
maintainerPATCH 86/156 net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qihang Tang <[email protected]>
commit 3b9a324e646d3657a8d9806dfbfe4f3e4066e882 upstream.
dev_validate_header() reads dev->hard_header_len directly when zero-padding short link layer headers for CAP_SYS_RAWIO holders:
if (capable(CAP_SYS_RAWIO)) {
memset(ll_header + len, 0, dev->hard_header_len - len);
return true;
}Packet send paths call dev_validate_header() on skbs whose headroom was allocated from an earlier hard_header_len read. If the device is reconfigured so that dev->hard_header_len increases before validation, the memset writes past the reserved buffer, an out-of-bounds write.
This out-of-bounds write is masked in some SOCK_RAW paths today because the same concurrent increase can first make skb_push() exceed the reserved headroom and trigger skb_under_panic(). Remove the zero-padding branch before making those hard_header_len reads consistent, so the snapshot fixes do not turn a loud panic into a silent overwrite.
This path is only reached for variable length L2 protocols, where len < hard_header_len but len >= min_header_len. No remaining in-tree variable length L2 protocol implements header_ops->validate, and the CAP_SYS_RAWIO bypass that zero-pads and accepts short headers has no real value beyond allowing testing of intentionally malformed input.
Drop the CAP_SYS_RAWIO branch. The remaining reads of dev->hard_header_len in dev_validate_header() are comparisons only and have no memory safety impact.
--- include/linux/netdevice.h | 5 ----- 1 file changed, 5 deletions(-)
include/linux/netdevice.h +0 -5
@@ -3199,11 +3199,6 @@ static inline bool dev_validate_header(cif (len < dev->min_header_len)return false; -if (capable (CAP_SYS_RAWIO )) { -memset (ll_header + len,0 , dev->hard_header_len - len); -return true; - } -if (dev->header_ops && dev->header_ops->validate)return dev->header_ops->validate (ll_header, len);
Greg Kroah-Hartman
maintainerPATCH 87/156 mac802154: fix netdev use-after-free in beacon worker
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zihan Xi <[email protected]>
commit 5f26a690e8efa54315e4922368daf54e0b8f5515 upstream.
mac802154_beacon_worker() reads local->beacon_req under RCU and derives the sub-interface from the request, but then drops the RCU read lock and continues to use both sdata and the embedded wpan_dev.
mac802154_stop_beacons_locked() cancels only pending beacon work, clears local->beacon_req and frees the request. A beacon worker that is already running can therefore continue after interface teardown and dereference the freed netdev private area.
The scan worker already pins the netdev before leaving RCU. Apply the same lifetime rule to the beacon worker: take a netdev reference while the request is still protected by RCU, and release it on all paths that continue after the reference is acquired.
--- net/mac802154/scan.c | 4 ++++ 1 file changed, 4 insertions(+)
net/mac802154/scan.c +4 -0
@@ -415,6 +415,7 @@ void mac802154_beacon_worker(struct work container_of(work, struct ieee802154_local, beacon_work.work);struct cfg802154_beacon_request *beacon_req;struct ieee802154_sub_if_data *sdata; +netdevice_tracker dev_tracker;struct wpan_dev *wpan_dev;u8 interval;int ret;
@@ -427,12 +428,14 @@ void mac802154_beacon_worker(struct work } sdata =IEEE802154_WPAN_DEV_TO_SUB_IF (beacon_req->wpan_dev); +netdev_hold (sdata->dev, &dev_tracker,GFP_ATOMIC );/* Wait an arbitrary amount of time in case we cannot use the device */ if (local->suspended || !ieee802154_sdata_running (sdata)) {rcu_read_unlock ();queue_delayed_work (local->mac_wq, &local->beacon_work,msecs_to_jiffies (1000 )); +netdev_put (sdata->dev, &dev_tracker);return ; }
@@ -450,6 +453,7 @@ void mac802154_beacon_worker(struct workif (interval <IEEE802154_ACTIVE_SCAN_DURATION )queue_delayed_work (local->mac_wq, &local->beacon_work, local->beacon_interval); +netdev_put (sdata->dev, &dev_tracker); } int mac802154_stop_beacons_locked(struct ieee802154_local *local,
Greg Kroah-Hartman
maintainerPATCH 88/156 netfilter: ebt_nflog: pin the NFLOG backend
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengfeng Ye <[email protected]>
commit 30825970339c107bacaf7f61af90fcdb1f597ca1 upstream.
nf_log_unregister() runs after the per-net teardown so its final RCU grace period also drains readers that obtained the logger from a per-net binding. However, ebt_nflog passes an explicit ULOG log type to nf_log_packet() without holding a reference on the selected logger module, unlike the xt_NFLOG and nft_log frontends.
An ebtables nflog rule can therefore remain callable while nfnetlink_log is unloaded. The resulting interleaving is:
CPU 0 CPU 1
nfnetlink_log_fini()
unregister_pernet_subsys()
kfree(nfnl_log_pernet(net))
ebt_nflog_tg()
nf_log_packet()
nfulnl_log_packet()
instance_lookup_get_rcu()The global ULOG logger is still registered at this point, so CPU 1 dereferences the per-net state after CPU 0 has freed it. KASAN reported:
BUG: KASAN: slab-use-after-free in instance_lookup_get_rcu Read of size 8 at addr ff110001052e6210 by task poc/92 Call Trace: instance_lookup_get_rcu+0x1ce/0x1f0 [nfnetlink_log] nfulnl_log_packet+0x248/0x2fb0 [nfnetlink_log] nf_log_packet+0x204/0x300 ebt_nflog_tg+0x351/0x550 ebt_do_table+0xedf/0x22b0 Allocated by task 90: __kmalloc_noprof+0x186/0x470 ops_init+0x6d/0x420 register_pernet_operations+0x2f6/0x670 register_pernet_subsys+0x23/0x40 Freed by task 93: kfree+0x131/0x3c0 ops_undo_list+0x3e3/0x700 unregister_pernet_operations+0x232/0x490 unregister_pernet_subsys+0x1c/0x30 nfnetlink_log_fini+0x34/0x450 [nfnetlink_log]
Acquire the ULOG logger module reference when an ebt_nflog rule is validated and release it when the rule is destroyed. Request the NFLOG backend for legacy callers when needed, matching xt_NFLOG. This prevents module teardown until all ebt_nflog rules have stopped using the logger.
--- net/bridge/netfilter/ebt_nflog.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
net/bridge/netfilter/ebt_nflog.c +16 -1
@@ -41,11 +41,25 @@ ebt_nflog_tg(struct sk_buff *skb, conststatic int ebt_nflog_tg_check (const struct xt_tgchk_param *par) {struct ebt_nflog_info *info = par->targinfo; +int ret;if (info->flags & ~EBT_NFLOG_MASK )return -EINVAL ; info->prefix[EBT_NFLOG_PREFIX_SIZE -1 ] ='\0' ; -return 0 ; + + ret =nf_logger_find_get (par->family,NF_LOG_TYPE_ULOG ); +if (ret !=0 && !par->nft_compat) { +request_module ("%s" ,"nfnetlink_log" ); + + ret =nf_logger_find_get (par->family,NF_LOG_TYPE_ULOG ); + } + +return ret; +} + +static void ebt_nflog_tg_destroy (const struct xt_tgdtor_param *par) +{ +nf_logger_put (par->family,NF_LOG_TYPE_ULOG ); }static struct xt_target ebt_nflog_tg_reg__read_mostly = {
@@ -54,6 +68,7 @@ static struct xt_target ebt_nflog_tg_reg .family = NFPROTO_BRIDGE, .target = ebt_nflog_tg, .checkentry = ebt_nflog_tg_check, + .destroy = ebt_nflog_tg_destroy, .targetsize = sizeof(struct ebt_nflog_info), .me = THIS_MODULE, };
Greg Kroah-Hartman
maintainerPATCH 89/156 net: bridge: mrp: fix uninitialised bytes on the wire
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baul Lee <[email protected]>
commit 63488dba65ef91373ef616575b32eb0eb21459f4 upstream.
br_mrp_alloc_test_skb() builds MRP test frames on an skb from dev_alloc_skb(), which does not clear the linear data area. On the MRA ring-role branch the sub-option TLV header is appended with
sub_tlv = skb_put(skb, sizeof(*sub_tlv)); sub_tlv->type = BR_MRP_SUB_TLV_HEADER_TEST_AUTO_MGR;
so sub_tlv->length is never written, and the two trailing alignment bytes are appended with a bare skb_put() that does not clear them either. The neighbouring oui and sub_opt regions are explicitly zeroed, so three uninitialised bytes are left in every MRA MRP_Test frame that goes out.
Put the sub-option TLV header and the alignment padding in a single skb_put_zero(), which clears both. The AUTO_MGR sub-TLV carries no payload, so the zeroed length field is already the value it should have.
--- net/bridge/br_mrp.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
net/bridge/br_mrp.c +2 -4
@@ -224,11 +224,9 @@ static struct sk_buff *br_mrp_alloc_test sub_opt =skb_put (skb,sizeof (*sub_opt));memset (sub_opt,0x0 ,sizeof (*sub_opt)); - sub_tlv =skb_put (skb,sizeof (*sub_tlv)); - sub_tlv->type =BR_MRP_SUB_TLV_HEADER_TEST_AUTO_MGR ; -/* 32 bit alligment shall be ensured therefore add 2 bytes */ -skb_put (skb,MRP_OPT_PADDING ); + sub_tlv =skb_put_zero (skb,sizeof (*sub_tlv) +MRP_OPT_PADDING ); + sub_tlv->type =BR_MRP_SUB_TLV_HEADER_TEST_AUTO_MGR ; }br_mrp_skb_tlv (skb,BR_MRP_TLV_HEADER_END ,0x0 );
Greg Kroah-Hartman
maintainerPATCH 90/156 KVM: s390: pci: Fix memory accounting for pinned/unpinned pages
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Farhan Ali <[email protected]>
[ Upstream commit 36f6999ecde3976731a8bfc0b8e667da6f593069 ]
The account_mem() and unaccount_mem() functions call get_uid() which increments the reference count of struct user_struct on every invocation. But we don't decrement the count by calling free_uid(). It also accounted/unaccounted the pages against the current->mm. But its possible the unaccount_mem() can be called from a different process context than the one that originally pinned the pages.
Let's fix this by storing the pinning process user_struct and mm_struct when accounting for pinned pages, and subsequently free these resources when the pages are unpinned.
--- arch/s390/kvm/pci.c | 48 ++++++++++++++++++++++++++++++++------------- arch/s390/kvm/pci.h | 2 ++ 2 files changed, 36 insertions(+), 14 deletions(-)
arch/s390/kvm/pci.c +34 -14
@@ -191,34 +191,54 @@ static int kvm_zpci_clear_airq(struct zpci_dev *zdev)return cc ? -EIO :0 ; } -static inline void unaccount_mem (unsigned long nr_pages) +static inline void unaccount_mem (struct kvm_zdev *kzdev,unsigned long nr_pages) { -struct user_struct *user =get_uid (current_user ()); +struct user_struct *user = kzdev->user_account; +struct mm_struct *mm_account = kzdev->mm_account; -if (user) +if (user) {atomic_long_sub (nr_pages, &user->locked_vm); -if (current->mm) -atomic64_sub (nr_pages, ¤t->mm->pinned_vm); +free_uid (user); + kzdev->user_account =NULL ; + } + +if (mm_account) { +atomic64_sub (nr_pages, &mm_account->pinned_vm); +mmdrop (mm_account); + kzdev->mm_account =NULL ; + } } -static inline int account_mem (unsigned long nr_pages) +static inline int account_mem (struct kvm_zdev *kzdev,unsigned long nr_pages) {struct user_struct *user =get_uid (current_user ());unsigned long page_limit, cur_pages, new_pages; +int rc =0 ; page_limit =rlimit (RLIMIT_MEMLOCK ) >>PAGE_SHIFT ; + cur_pages =atomic_long_read (&user->locked_vm);do { - cur_pages =atomic_long_read (&user->locked_vm); new_pages = cur_pages + nr_pages; -if (new_pages > page_limit) -return -ENOMEM ; - }while (atomic_long_cmpxchg (&user->locked_vm, cur_pages, - new_pages) != cur_pages); +if (new_pages > page_limit) { + rc = -ENOMEM ; + goto out; + } + }while (!atomic_long_try_cmpxchg (&user->locked_vm, &cur_pages, new_pages)); + +if (current->mm) { +mmgrab (current->mm); +atomic64_add (nr_pages, ¤t->mm->pinned_vm); + } -atomic64_add (nr_pages, ¤t->mm->pinned_vm); + kzdev->user_account = user; + kzdev->mm_account = current->mm;return 0 ; + +out: +free_uid (user); +return rc; } static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib *fib,
@@ -295,7 +315,7 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib *fib, }/* Account for pinned pages, roll back on failure */ -if (account_mem (pcount)) +if (account_mem (zdev->kzdev, pcount)) goto unpin2;/* AISB must be allocated before we can fill in GAITE */
@@ -424,7 +444,7 @@ static int kvm_s390_pci_aif_disable(struct zpci_dev *zdev, bool force) pcount++; }if (pcount >0 ) -unaccount_mem (pcount); +unaccount_mem (kzdev, pcount); out:mutex_unlock (&aift->aift_lock);
arch/s390/kvm/pci.h +2 -0
@@ -22,6 +22,8 @@ struct kvm_zdev {struct kvm *kvm;struct zpci_fib fib;struct list_head entry; +struct user_struct *user_account; +struct mm_struct *mm_account; };struct zpci_gaite {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 91/156 KVM: s390: pci: Fix missing error codes and memory unaccounting
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Farhan Ali <[email protected]>
[ Upstream commit f86842e4d6c482300f4567f492d512c9ccf5bc4f ]
In kvm_s390_pci_aif_enable() two error paths failed to set an error code, causing the function to return 0 on failure. It also failed to rollback memory accounting on failure. Fix both by propagating an error code on failure and calling unaccount_mem() in the cleanup path.
--- arch/s390/kvm/pci.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
arch/s390/kvm/pci.c +7 -2
@@ -315,14 +315,17 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib *fib, }/* Account for pinned pages, roll back on failure */ -if (account_mem (zdev->kzdev, pcount)) + rc =account_mem (zdev->kzdev, pcount); +if (rc) goto unpin2;/* AISB must be allocated before we can fill in GAITE */ mutex_lock (&aift->aift_lock); bit =airq_iv_alloc_bit (aift->sbv); -if (bit ==-1UL ) +if (bit ==-1UL ) { + rc = -ENOMEM ; goto unlock; + } zdev->aisb = bit;/* store the summary bit number */ zdev->aibv = airq_iv_create(msi_vecs, AIRQ_IV_DATA | AIRQ_IV_BITLOCK |
@@ -374,6 +377,8 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib *fib,airq_iv_free_bit (aift->sbv, zdev->aisb); zdev->aisb =0 ; unlock: +if (pcount >0 ) +unaccount_mem (zdev->kzdev, pcount);mutex_unlock (&aift->aift_lock); unpin2:if (fib->fmt0.sum ==1 )
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 92/156 KVM: s390: pci: Fix resource leak on IRQ registration failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Farhan Ali <[email protected]>
[ Upstream commit 5580c9858f1e00f60191eb09c3add359836d60b6 ]
Currently if kvm_zpci_set_airq() fails, kvm_s390_pci_aif_enable() returns the error code but doesn't do any resource cleanup thus leaking resources. Fix this by cleaning up all the resources such as the GAITE, AIBV, AISB and unpinning any pinned pages. While at it, remove dead code that stored FIB values that were never referenced.
As part of the cleanup, we are also holding the aift_lock a bit longer, as we hold the lock while executing the MPCIFC instruction. Though this is not strictly necessary, it means we don't have to drop and re-acquire in the error case.
--- arch/s390/kvm/pci.c | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-)
arch/s390/kvm/pci.c +21 -8
@@ -359,19 +359,32 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib *fib, aift->kzdev[zdev->aisb] = zdev->kzdev;spin_unlock_irq (&aift->gait_lock); -/* Update guest FIB for re-issue */ - fib->fmt0.aisbo = zdev->aisb &63 ; - fib->fmt0.aisb =virt_to_phys (aift->sbv->vector + (zdev->aisb /64 ) *8 ); - fib->fmt0.isc = gisc; -/* Save some guest fib values in the host for later use */ - zdev->kzdev->fib.fmt0.isc = fib->fmt0.isc; + zdev->kzdev->fib.fmt0.isc = gisc; zdev->kzdev->fib.fmt0.aibv = fib->fmt0.aibv; -mutex_unlock (&aift->aift_lock);/* Issue the clp to setup the irq now */ rc =kvm_zpci_set_airq (zdev); -return rc; +if (!rc) { +mutex_unlock (&aift->aift_lock); +return rc; + } + +/* Start cleanup */ + zdev->kzdev->fib.fmt0.isc =0 ; + zdev->kzdev->fib.fmt0.aibv =0 ; + +spin_lock_irq (&aift->gait_lock); + gaite->count--; + gaite->aisb =0 ; + gaite->gisc =0 ; + gaite->aisbo =0 ; + gaite->gisa =0 ; + aift->kzdev[zdev->aisb] =NULL ; +spin_unlock_irq (&aift->gait_lock); + +airq_iv_release (zdev->aibv); + zdev->aibv =NULL ; free_aisb:airq_iv_free_bit (aift->sbv, zdev->aisb);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 93/156 KVM: s390: pci: Fix aisb calculation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Rosato <[email protected]>
[ Upstream commit 0cfe660559e857d7c00ab86c73e4510ce069086f ]
The current implementation of aisb calculation will erroneously index via an unsigned long * as well as multiply by 8B for every 64-bits in the offset; only one or the other is required. This throws off aisb calculations once the number of devices exceeds 64, and can result in out-of-bounds access as well as failure to indicate summary bits associated with those devices in guests.
Fix this by converting to a physical address before applying the offset, as is already done in arch/s390/pci/pci_irq.c.
--- arch/s390/kvm/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/kvm/pci.c +1 -1
@@ -167,7 +167,7 @@ static int kvm_zpci_set_airq(struct zpci_dev *zdev) fib.fmt0.noi =airq_iv_end (zdev->aibv); fib.fmt0.aibv =virt_to_phys (zdev->aibv->vector); fib.fmt0.aibvo =0 ; - fib.fmt0.aisb =virt_to_phys (aift->sbv->vector + (zdev->aisb /64 ) *8 ); + fib.fmt0.aisb =virt_to_phys (aift->sbv->vector) + (zdev->aisb /64 ) *8 ; fib.fmt0.aisbo = zdev->aisb &63 ; fib.gd = zdev->gisa;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 94/156 dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harshal Dev <[email protected]>
[ Upstream commit e27264daac7d9ce892a2a5b4a864d6d9a3c9276a ]
The DT bindings for inline-crypto engine do not specify the UFS_PHY_GDSC power-domain and iface clock. Without enabling the iface clock and the associated power-domain the ICE hardware cannot function correctly and leads to unclocked hardware accesses being observed during probe.
Extend and fix the DT bindings for inline-crypto engine by allowing description of the iface clock and UFS_PHY_GDSC power-domain.
This patch has been adapted from the mentioned upstream commit to drop references to Eliza and Milos Qualcomm platforms which do not exist on the stable tree. Thus, patch now fixes the original commit which introduced the DT binding for Qualcomm inline-crypto engine.
--- .../crypto/qcom,inline-crypto-engine.yaml | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
Documentation/devicetree/bindings/crypto/qcom,inline-crypto-engine.yaml +15 -1
@@ -21,6 +21,16 @@ properties: maxItems: 1 clocks: + minItems: 1 + maxItems: 2 + + clock-names: + minItems: 1 + items: + - const: core + - const: iface + + power-domains: maxItems: 1 required:
@@ -38,6 +48,10 @@ examples: compatible = "qcom,sm8550-inline-crypto-engine", "qcom,inline-crypto-engine"; reg = <0x01d88000 0x8000>; - clocks = <&gcc GCC_UFS_PHY_ICE_CORE_CLK>; + clocks = <&gcc GCC_UFS_PHY_ICE_CORE_CLK>, + <&gcc GCC_UFS_PHY_AHB_CLK>; + clock-names = "core", + "iface"; + power-domains = <&gcc UFS_PHY_GDSC>; }; ...
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 95/156 futex: Prevent robust futex exit race some more
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keno Fischer <[email protected]>
commit 6d4514ca9cdf61fec4ec634cf50386f6f7e69748 upstream.
A robust futex unlock stores 0 over the whole futex value - wiping FUTEX_WAITERS - and wakes a single waiter. That wakeup is a one-shot
notification: the protocol relies on its recipient to either acquire the futex (and eventually unlock while aware of the remaining contention) or re-arm FUTEX_WAITERS before sleeping again. If the woken waiter is killed before it can do either, the kernel must jump in and wake the next task down the line.
This is a known complication of the futex protocol with a previous partial fix in commit ca16d5bee598 ("futex: Prevent robust futex exit race"). Unfortunately, that fix is insufficient.
If a third task re-acquired the futex through the uncontended fast path in the meantime, the notification is lost: robust exit processing sees that it is owned by another task and does nothing, while the new owner sees no FUTEX_WAITERS when it unlocks and wakes nobody. The remaining waiters sleep forever behind a free futex:
A owns the futex, B and C sleep in FUTEX_WAIT
uval == A | FUTEX_WAITERS
A robust unlock: store 0, FUTEX_WAKE(1) wakes B
uval == 0
D fast path acquire: cmpxchg(0 -> D)
uval == D, no FUTEX_WAITERS B killed before acting on the wakeup
B exit walk, pending op: owner D != B -> no action D unlock: no FUTEX_WAITERS -> no wake
C sleeps forever
This is clearly a shortcoming in the implementation, which fails to keep the FUTEX_WAITERS bit consistent.
Work around this by augmenting the robust list exit processing to also perform the extra wakeup if the futex word is owned by another thread but FUTEX_WAITERS is not set.
This does not fix the problem of a non-contended take over/release and free sequence, which has been discussed for years and has been addressed by commit 3ca9595d9fb6 ("futex: Add support for unlocking robust futexes") and subsequent changes, but failed to take the problem described above into account.
A more complete solution which is based on the in kernel unlock of contended robust futexes has been discussed in the context of this change and should show up in mainline sooner than later.
[ tglx: Amend change log slightly and fixup coding style ]
--- kernel/futex/core.c | 82 +++++++++++++++++++++++++++++++-------------- 1 file changed, 56 insertions(+), 26 deletions(-)
kernel/futex/core.c +56 -26
@@ -660,8 +660,11 @@ static int handle_futex_death(u32 __user *uaddr, struct task_struct *curr,return -1 ;/* -* Special case for regular (non PI) futexes. The unlock path in -* user space has two race scenarios: +* Special case for regular (non PI) futexes. Ordinarily, we do +* not perform any processing here unless the current thread was +* the owner of the futex (by the TID check below). +* +* However, the unlock path has three race scenarios: * * 1. The unlock path releases the user space futex value and * before it can execute the futex() syscall to wake up
@@ -670,41 +673,68 @@ static int handle_futex_death(u32 __user *uaddr, struct task_struct *curr,* 2. A woken up waiter is killed before it can acquire the * futex in user space. * -* In the second case, the wake up notification could be generated -* by the unlock path in user space after setting the futex value -* to zero or by the kernel after setting the OWNER_DIED bit below. +* 3. A woken up waiter is killed in user space after another +* thread has acquired the futex, but before it can set +* FUTEX_WAITERS. +* +* Note that, if userspace uses the FUTEX_ROBUST_UNLOCK flag, we +* will not see case 1 here. +* +* In the second and third case, the wake up notification could +* be generated from any of: +* +* i. An ordinary futex wakeup after unlock (with or +* without FUTEX_ROBUST_UNLOCK) +* ii. A robust wakeup from another thread's death +* iii. A previous round through this special case +* +* As a result, the futex world will be in one of four states: * -* In both cases the TID validation below prevents a wakeup of -* potential waiters which can cause these waiters to block -* forever. +* A. The futex word is 0 (unlocked) +* B. The futex word is owned by another thread +* (FUTEX_WAITERS is not set) +* C. The futex word is owned by another thread +* (FUTEX_WAITERS set) +* D. The futex's owner died and OWNER_DIED is set +* (the owner part of the word is 0) * -* In both cases the following conditions are met: +* The key issue is that the kernel usually (at least from +* sources ii. and iii. or when so requested by userspace from +* source i.) only ever wakes *one* waiter at a time. If this +* waiter dies before acquiring the futex (or setting the +* FUTEX_WAITERS bit), the kernel *must* still wake the next +* waiter down the line to uphold the futex invariants and +* avoid lost wakeups. Note we do not need to handle state C, +* as it does not matter to us whether *we* successfully set +* the bit or a third thread did so in the meantime. * -* 1) task->robust_list->list_op_pending != NULL -* @pending_op == true -* 2) The owner part of user space futex value == 0 +* Therefore, in these cases we must issue an additional +* futex_wake(). Note however that we *must not* set OWNER_DIED +* here. Our thread is *not* the owner of the futex. +* +* Thus to summarize, the conditions for needing the additional +* futex_wake() are: +* +* 1) @pending_op == true (the thread has not finished the +* mutex operation) +* 2) The futex word is in one of the states A, B or D * 3) Regular futex: @pi == false * -* If these conditions are met, it is safe to attempt waking up a -* potential waiter without touching the user space futex value and -* trying to set the OWNER_DIED bit. If the futex value is zero, -* the rest of the user space mutex state is consistent, so a woken -* waiter will just take over the uncontended futex. Setting the -* OWNER_DIED bit would create inconsistent state and malfunction -* of the user space owner died handling. Otherwise, the OWNER_DIED -* bit is already set, and the woken waiter is expected to deal with -* this. +* Note in particular that in all of the states A-D the owner +* portion of the futex word differs from our thread's TID +* (unless the actual owner has the same TID in another PID +* namespace, but we cannot currently distinguish that +* scenario), so this can be a special-case wakeup in the bail +* path of the ordinary TID check. */ owner = uval &FUTEX_TID_MASK ; -if (pending_op && !pi && !owner) { -futex_wake (uaddr,1 ,1 ,FUTEX_BITSET_MATCH_ANY ); +if (owner !=task_pid_vnr (curr)) { +if (pending_op && !pi && (!owner || !(uval &FUTEX_WAITERS ))) +futex_wake (uaddr,1 ,1 ,FUTEX_BITSET_MATCH_ANY );return 0 ; } -if (owner !=task_pid_vnr (curr)) -return 0 ; -/* * Ok, this dying thread is truly holding a futex * of interest. Set the OWNER_DIED bit atomically
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 96/156 fortify: refactor test_fortify Makefile to fix some build problems
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masahiro Yamada <[email protected]>
commit 4e9903b0861c9df3464b82db4a7025863bac1897 upstream.
There are some issues in the test_fortify Makefile code.
Problem 1: cc-disable-warning invokes compiler dozens of times
To see how many times the cc-disable-warning is evaluated, change this code:
$(call cc-disable-warning,fortify-source)
to:
$(call cc-disable-warning,$(shell touch /tmp/fortify-$$$$)fortify-source)
Then, build the kernel with CONFIG_FORTIFY_SOURCE=y. You will see a large number of '/tmp/fortify-<PID>' files created:
$ ls -1 /tmp/fortify-* | wc
80 80 1600This means the compiler was invoked 80 times just for checking the -Wno-fortify-source flag support.
$(call cc-disable-warning,fortify-source) should be added to a simple variable instead of a recursive variable.
Problem 2: do not recompile string.o when the test code is updated
The test cases are independent of the kernel. However, when the test code is updated, $(obj)/string.o is rebuilt and vmlinux is relinked due to this dependency:
$(obj)/string.o: $(obj)/$(TEST_FORTIFY_LOG)
always-y is suitable for building the log files.
Problem 3: redundant code
clean-files += $(addsuffix .o, $(TEST_FORTIFY_LOGS))
... is unneeded because the top Makefile globally cleans *.o files.
This commit fixes these issues and makes the code readable.
--- lib/.gitignore | 2 -- lib/Makefile | 34 +--------------------------------- lib/test_fortify/.gitignore | 2 ++ lib/test_fortify/Makefile | 28 ++++++++++++++++++++++++++++ scripts/remove-stale-files | 2 ++ 5 files changed, 33 insertions(+), 35 deletions(-) create mode 100644 lib/test_fortify/.gitignore create mode 100644 lib/test_fortify/Makefile
lib/.gitignore +0 -2
@@ -5,5 +5,3 @@ /gen_crc32table /gen_crc64table /oid_registry_data.c -/test_fortify.log -/test_fortify/*.log
lib/Makefile +1 -33
@@ -407,36 +407,4 @@ CFLAGS_longest_symbol_kunit.o += $(call cc-disable-warning, missing-prototypes) obj-$(CONFIG_GENERIC_LIB_DEVMEM_IS_ALLOWED) += devmem_is_allowed.o -# FORTIFY_SOURCE compile-time behavior tests -TEST_FORTIFY_SRCS = $(wildcard $(srctree)/$(src)/test_fortify/*-*.c) -TEST_FORTIFY_LOGS = $(patsubst $(srctree)/$(src)/%.c, %.log, $(TEST_FORTIFY_SRCS)) -TEST_FORTIFY_LOG = test_fortify.log - -quiet_cmd_test_fortify = TEST $@ - cmd_test_fortify = $(CONFIG_SHELL) $(srctree)/scripts/test_fortify.sh \ - $< $@ "$(NM)" $(CC) $(c_flags) \ - $(call cc-disable-warning,fortify-source) \ - -DKBUILD_EXTRA_WARN1 - -targets += $(TEST_FORTIFY_LOGS) -clean-files += $(TEST_FORTIFY_LOGS) -clean-files += $(addsuffix .o, $(TEST_FORTIFY_LOGS)) -$(obj)/test_fortify/%.log: $(src)/test_fortify/%.c \ - $(src)/test_fortify/test_fortify.h \ - $(srctree)/include/linux/fortify-string.h \ - $(srctree)/scripts/test_fortify.sh \ - FORCE - $(call if_changed,test_fortify) - -quiet_cmd_gen_fortify_log = GEN $@ - cmd_gen_fortify_log = cat </dev/null $(filter-out FORCE,$^) 2>/dev/null > $@ || true - -targets += $(TEST_FORTIFY_LOG) -clean-files += $(TEST_FORTIFY_LOG) -$(obj)/$(TEST_FORTIFY_LOG): $(addprefix $(obj)/, $(TEST_FORTIFY_LOGS)) FORCE - $(call if_changed,gen_fortify_log) - -# Fake dependency to trigger the fortify tests. -ifeq ($(CONFIG_FORTIFY_SOURCE),y) -$(obj)/string.o: $(obj)/$(TEST_FORTIFY_LOG) -endif +subdir-$(CONFIG_FORTIFY_SOURCE) += test_fortify
lib/test_fortify/.gitignore new file +2 -0
@@ -0,0 +1,2 @@ +# SPDX-License-Identifier: GPL-2.0-only +/*.log
lib/test_fortify/Makefile new file +28 -0
@@ -0,0 +1,28 @@ +# SPDX-License-Identifier: GPL-2.0 + +ccflags-y := $(call cc-disable-warning,fortify-source) + +quiet_cmd_test_fortify = TEST $@ + cmd_test_fortify = $(CONFIG_SHELL) $(srctree)/scripts/test_fortify.sh \ + $< $@ "$(NM)" $(CC) $(c_flags) -DKBUILD_EXTRA_WARN1 + +$(obj)/%.log: $(src)/%.c $(srctree)/scripts/test_fortify.sh \ + $(src)/test_fortify.h \ + $(srctree)/include/linux/fortify-string.h \ + FORCE + $(call if_changed,test_fortify) + +logs = $(patsubst $(srctree)/$(src)/%.c, %.log, $(wildcard $(srctree)/$(src)/*-*.c)) +targets += $(logs) + +quiet_cmd_gen_fortify_log = CAT $@ + cmd_gen_fortify_log = cat $(or $(real-prereqs),/dev/null) > $@ + +$(obj)/test_fortify.log: $(addprefix $(obj)/, $(logs)) FORCE + $(call if_changed,gen_fortify_log) + +always-y += test_fortify.log + +# Some architectures define __NO_FORTIFY if __SANITIZE_ADDRESS__ is undefined. +# Pass CFLAGS_KASAN to avoid warnings. +KASAN_SANITIZE := y
scripts/remove-stale-files +2 -0
@@ -39,3 +39,5 @@ rm -rf include/ksym find . -name '*.usyms' | xargs rm -f rm -f binkernel.spec + +rm -f lib/test_fortify.log
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 97/156 fortify: Disable -Wstringop-overread in tests
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
commit c1f3e770eec26d6f96dd6d2ea30555ba7c09a244 upstream.
clang recently added support for -Wstringop-overread [1], which is on by default like -Wfortify-source. This breaks the usage of -Werror in the fortify tests, resulting in the following false positive warnings in the kernel build:
warning: unsafe memcmp() usage lacked '__read_overflow2' warning in lib/test_fortify/read_overflow2-memcmp.c
warning: unsafe memcmp() usage lacked '__read_overflow' warning in lib/test_fortify/read_overflow-memcmp.c
warning: unsafe memchr() usage lacked '__read_overflow' warning in lib/test_fortify/read_overflow-memchr.c
Examining the fortify test logs shows a warning like the following in each of the failed logs:
In file included from lib/test_fortify/read_overflow2-memcmp.c:5:
lib/test_fortify/test_fortify.h:34:2: error: 'memcmp' reading 17 bytes from a region of size 16 [-Werror,-Wstringop-overread]
34 | TEST;
| ^
lib/test_fortify/read_overflow2-memcmp.c:3:2: note: expanded from macro 'TEST'
3 | memcmp(large, small, sizeof(small) + 1)
| ^1 error generated.
Disable -Wstringop-overread for the fortify tests, as it defeats the purpose of testing the Linux specific implementation of fortify, like -Wfortify-source.
--- lib/test_fortify/Makefile | 1 + 1 file changed, 1 insertion(+)
lib/test_fortify/Makefile +1 -0
@@ -1,6 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 ccflags-y := $(call cc-disable-warning,fortify-source) +ccflags-y += $(call cc-disable-warning,stringop-overread) quiet_cmd_test_fortify = TEST $@ cmd_test_fortify = $(CONFIG_SHELL) $(srctree)/scripts/test_fortify.sh \
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 98/156 pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <[email protected]>
commit c1492da3939c89372929e062d731f328f7693f1e upstream.
The pinctrl and GPIO core code make exceptions for the -ENOTSUPP error code. One such example is gpio_set_config_with_argument_optional(), which returns success when gpio_set_config_with_argument() returns -ENOTSUPP, but reports failure for all other error codes.
Returning -EOPNOTSUPP from the pinctrl driver on the unsupported pinctrl operation may lead to boot failures when pinctrl drivers implements struct gpio_chip::set_config, the system uses GPIO hogs, and the struct gpio_chip::set_config implementation returns -EOPNOTSUPP for the unsupported operations.
Return -ENOTSUPP for the unsupported pinctrl operation.
[claudiu.beznea: fixed conflict by dropping the code not present in
v6.6 stable]
--- drivers/pinctrl/renesas/pinctrl-rzg2l.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pinctrl/renesas/pinctrl-rzg2l.c +2 -2
@@ -710,7 +710,7 @@ static int rzg2l_pinctrl_pinconf_set(struct pinctrl_dev *pctldev, }default : -return -EOPNOTSUPP ; +return -ENOTSUPP ; } }
@@ -759,7 +759,7 @@ static int rzg2l_pinctrl_pinconf_group_get(struct pinctrl_dev *pctldev,/* Check config matching between to pin */ if (i && prev_config != *config) -return -EOPNOTSUPP ; +return -ENOTSUPP ; prev_config = *config; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 99/156 fscrypt: Replace mk_users keyring with simple list
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit 696c030e1e3438955aba443b308ee8b6faa3983e upstream.
Change mk_users (the set of user claims to an fscrypt master key) from a 'struct key' keyring to a simple linked list.
It's still a collection of 'struct key' for quota tracking. It was originally thought to be natural that a collection of 'struct key' should be held in a 'struct key' keyring. In reality, it's just been causing problems, similar to how using 'struct key' for the filesystem keyring caused problems and was removed in commit d7e7b9af104c ("fscrypt: stop using keyrings subsystem for fscrypt_master_key").
Commit d3a7bd420076 ("fscrypt: clear keyring before calling key_put()") fixed mk_users cleanup to be synchronous. But that apparently wasn't
enough: the keyring subsystem's redundant locking is still generating lockdep false positives due to the interaction with filesystem reclaim.
With the simple list, the redundant locking and lockdep issue goes away.
Of course, searching a linked list is linear-time whereas the 'struct key' keyring used a fancy constant-time associative array. But that's fine here, since in practice there's just one entry in the list. In fact the new code is much faster in practice, since it's much smaller and doesn't have to convert the kuid_t into a string to search for it.
--- fs/crypto/fscrypt_private.h | 32 ++++-- fs/crypto/keyring.c | 212 ++++++++++++++++-------------------- 2 files changed, 113 insertions(+), 131 deletions(-)
fs/crypto/fscrypt_private.h +22 -10
@@ -422,6 +422,19 @@ fscrypt_is_key_prepared(struct fscrypt_prepared_key *prep_key,/* keyring.c */ +/* +* fscrypt_master_key_user - a user's claim to a master key +*/ +struct fscrypt_master_key_user { +struct list_head link; +kuid_t uid; +/* +* This 'struct key' contains no secret. It exists solely to charge the +* appropriate user's key quota. +*/ +struct key *quota_key; +}; +/* * fscrypt_master_key_secret - secret key material of an in-use master key */
@@ -506,19 +519,18 @@ struct fscrypt_master_key {struct fscrypt_key_specifier mk_spec;/* -* Keyring which contains a key of type 'key_type_fscrypt_user' for each -* user who has added this key. Normally each key will be added by just -* one user, but it's possible that multiple users share a key, and in -* that case we need to keep track of those users so that one user can't -* remove the key before the others want it removed too. +* List of user claims to this key (struct fscrypt_master_key_user). +* Normally each key will be added by just one user, but it's possible +* that multiple users share a key, and in that case we need to keep +* track of those users so that one user can't remove the key before the +* others want it removed too. * -* This is NULL for v1 policy keys; those can only be added by root. +* Used only for v2 policy keys. v1 policy keys can be added only by +* root, so user tracking doesn't apply to them. * -* Locking: protected by ->mk_sem. (We don't just rely on the keyrings -* subsystem semaphore ->mk_users->sem, as we need support for atomic -* search+insert along with proper synchronization with ->mk_secret.) +* Locking: protected by ->mk_sem. */ -struct key *mk_users; +struct list_head mk_users;/* * List of inodes that were unlocked using this key. This allows the
fs/crypto/keyring.c +91 -121
331 lines not on this page · raw message
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 100/156 selftests/bpf: Adapt sockmap update error handling
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Luczaj <[email protected]>
[ Upstream commit 30581eda4a07ff15db623612cac578e81869e96f ]
Update sockmap_listen to accommodate the recent change in sockmap that rejects unbound UDP sockets.
TCP: Reject unbound and bound (unless established or listening).
UDP: Accept only bound sockets.
While at it, migrate to ASSERT_* and enforce reverse xmas tree.
--- .../selftests/bpf/prog_tests/sockmap_listen.c | 21 ++++++++++--------- 1 file changed, 11 insertions(+), 10 deletions(-)
tools/testing/selftests/bpf/prog_tests/sockmap_listen.c +11 -10
@@ -51,8 +51,8 @@ static void test_insert_opened(struct test_sockmap_listen *skel __always_unused, int family, int sotype, int mapfd) { u32 key = 0; -u64 value;int err, s; +u64 value; s =xsocket (family, sotype,0 );if (s ==-1 )
@@ -61,11 +61,8 @@ static void test_insert_opened(struct test_sockmap_listen *skel __always_unused, errno =0 ; value = s; err =bpf_map_update_elem (mapfd, &key, &value,BPF_NOEXIST ); -if (sotype ==SOCK_STREAM ) { -if (!err || errno !=EOPNOTSUPP ) -FAIL_ERRNO ("map_update: expected EOPNOTSUPP" ); - }else if (err) -FAIL_ERRNO ("map_update: expected success" ); +ASSERT_ERR (err,"map_update" ); +ASSERT_EQ (errno,EOPNOTSUPP ,"errno" );xclose (s); }
@@ -75,8 +72,8 @@ static void test_insert_bound(struct test_sockmap_listen *skel __always_unused,struct sockaddr_storage addr;socklen_t len;u32 key =0 ; -u64 value;int err, s; +u64 value;init_addr_loopback (family, &addr, &len);
@@ -91,8 +88,12 @@ static void test_insert_bound(struct test_sockmap_listen *skel __always_unused, errno =0 ; value = s; err =bpf_map_update_elem (mapfd, &key, &value,BPF_NOEXIST ); -if (!err || errno !=EOPNOTSUPP ) -FAIL_ERRNO ("map_update: expected EOPNOTSUPP" ); +if (sotype ==SOCK_STREAM ) { +ASSERT_ERR (err,"map_update" ); +ASSERT_EQ (errno,EOPNOTSUPP ,"errno" ); + }else { +ASSERT_OK (err,"map_update" ); + } close:xclose (s); }
@@ -1261,7 +1262,7 @@ static void test_ops(struct test_sockmap_listen *skel, struct bpf_map *map,/* insert */ TEST (test_insert_invalid),TEST (test_insert_opened), -TEST (test_insert_bound,SOCK_STREAM ), +TEST (test_insert_bound),TEST (test_insert),/* delete */ TEST(test_delete_after_insert),
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 101/156 ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zihan Xi <[email protected]>
commit 4ff9548d84945d2cbf9e4c207288063a200ea397 upstream.
fib_nlmsg_size() still estimates nexthop space as if every gateway is encoded as an IPv4 RTA_GATEWAY attribute. IPv4 routes can also carry an IPv6 gateway, which fib_nexthop_info() dumps as RTA_VIA.
As a result, route notifications can allocate an skb that is too small. fib_dump_info() then fails with -EMSGSIZE and rtmsg_fib() hits the WARN_ON() that marks such failures as a fib_nlmsg_size() bug. With panic_on_warn set, this becomes a kernel panic.
Mirror the actual nexthop dump layout in fib_nlmsg_size(): account for IPv6 nexthop gateways dumped as RTA_VIA, for the no-header rtnexthop layout used inside RTA_MULTIPATH, and for RTA_FLOW only when it is actually present.
--- net/ipv4/fib_semantics.c | 67 ++++++++++++++++++++++++++++++++++------------- 1 file changed, 49 insertions(+), 18 deletions(-)
net/ipv4/fib_semantics.c +49 -18
@@ -462,6 +462,34 @@ int ip_fib_check_default(__be32 gw, strureturn -1 ; } +static size_t fib_nexthop_nlmsg_size (const struct fib_nh_common *nhc, +bool skip_oif) +{ +size_t nhsize =0 ; + +switch (nhc->nhc_gw_family) { +case AF_INET : + nhsize +=nla_total_size (4 );/* RTA_GATEWAY */ +break ; +case AF_INET6 : + nhsize +=nla_total_size (sizeof (struct rtvia ) + +sizeof (struct in6_addr )); +break ; + } + +if (!skip_oif && nhc->nhc_dev) + nhsize +=nla_total_size (4 );/* RTA_OIF */ + +if (nhc->nhc_lwtstate) { +/* RTA_ENCAP */ + nhsize +=lwtunnel_get_encap_size (nhc->nhc_lwtstate); +/* RTA_ENCAP_TYPE */ + nhsize +=nla_total_size (2 ); + } + +return nhsize; +} +size_t fib_nlmsg_size (struct fib_info *fi) {size_t payload =NLMSG_ALIGN (sizeof (struct rtmsg ))
@@ -479,32 +507,35 @@ size_t fib_nlmsg_size(struct fib_info *f payload +=nla_total_size (4 );/* RTA_NH_ID */ if (nhs) { -size_t nh_encapsize =0 ; -/* Also handles the special case nhs == 1 */ - -/* each nexthop is packed in an attribute */ -size_t nhsize =nla_total_size (sizeof (struct rtnexthop )); +size_t mpsize =0 ;unsigned int i; -/* may contain flow and gateway attribute */ - nhsize +=2 *nla_total_size (4 ); - -/* grab encap info */ for (i =0 ; i <fib_info_num_path (fi); i++) {struct fib_nh_common *nhc =fib_info_nhc (fi, i); +size_t nhsize; + + nhsize =fib_nexthop_nlmsg_size (nhc, nhs !=1 ); -if (nhc->nhc_lwtstate) { -/* RTA_ENCAP_TYPE */ - nh_encapsize +=lwtunnel_get_encap_size ( - nhc->nhc_lwtstate); -/* RTA_ENCAP */ - nh_encapsize +=nla_total_size (2 ); +if (nhs !=1 ) + nhsize +=NLA_ALIGN (sizeof (struct rtnexthop )); + +#ifdef CONFIG_IP_ROUTE_CLASSID +if (nhc->nhc_family ==AF_INET ) { +struct fib_nh *nh; + + nh = container_of(nhc, struct fib_nh, nh_common); +if (nh->nh_tclassid) + nhsize +=nla_total_size (4 ); } +#endif +if (nhs ==1 ) + payload += nhsize; +else + mpsize += nhsize; } -/* all nexthops are packed in a nested attribute */ - payload +=nla_total_size ((nhs * nhsize) + nh_encapsize); - +if (nhs !=1 ) + payload +=nla_total_size (mpsize); }return payload;
Greg Kroah-Hartman
maintainerPATCH 102/156 ipv4: fix use-after-free in fib_nhc_update_mtu()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengfeng Ye <[email protected]>
commit bc5bde9ce3cc36502839dfe98e068f7303a50982 upstream.
fib_nhc_update_mtu() walks the nexthop exception table under RTNL, but RTNL does not serialize this walk with PMTU exception updates. The walk uses rcu_dereference_protected() with a constant true condition without holding fnhe_lock.
The following interleaving can therefore occur:
CPU 0 CPU 1
fib_nhc_update_mtu() update_or_create_fnhe()
load fnhe spin_lock_bh(&fnhe_lock)
fnhe_remove_oldest()
unlink fnhe kfree_rcu(fnhe, rcu)
<quiescent state>
access fnhe after grace period
KASAN reported:
BUG: KASAN: slab-use-after-free in fib_nhc_update_mtu+0x3df/0x410 Read of size 8 at addr ffff888107d49000 by task poc/90 Call Trace: fib_nhc_update_mtu+0x3df/0x410 fib_sync_mtu+0x7a/0xd0 fib_netdev_event+0x229/0x3f0 netif_set_mtu_ext+0x33a/0x570 dev_set_mtu+0x88/0x120
The same walk updates fnhe_pmtu and fnhe_mtu_locked. These fields form a pair and other writers serialize them with fnhe_lock. RCU alone prevents reclamation, but would still allow concurrent writers to leave a mixed pair.
Walk the table under RCU and acquire fnhe_lock only while updating each exception. RCU keeps the current entry alive while the short critical section serializes its paired PMTU fields. This avoids holding the global lock while scanning all 2048 buckets for every nexthop.
--- include/net/route.h | 2 ++ net/ipv4/fib_semantics.c | 34 +++++++++++----------------------- net/ipv4/route.c | 29 +++++++++++++++++++++++++++++ 3 files changed, 42 insertions(+), 23 deletions(-)
include/net/route.h +2 -0
@@ -244,6 +244,8 @@ int fib_dump_info_fnhe(struct sk_buff *s u32 table_id, struct fib_info *fi, int *fa_index, int fa_start, unsigned int flags); +void fnhe_update_pmtu (struct fib_nh_exception *fnhe,u32 new,u32 orig); +static inline void ip_rt_put (struct rtable *rt) {/* dst_release() accepts a NULL parameter.
net/ipv4/fib_semantics.c +11 -23
@@ -1957,42 +1957,30 @@ static int call_fib_nh_notifiers(structreturn NOTIFY_DONE ; } -/* Update the PMTU of exceptions when: -* - the new MTU of the first hop becomes smaller than the PMTU -* - the old MTU was the same as the PMTU, and it limited discovery of -* larger MTUs on the path. With that limit raised, we can now -* discover larger MTUs -* A special case is locked exceptions, for which the PMTU is smaller -* than the minimal accepted PMTU: -* - if the new MTU is greater than the PMTU, don't make any change -* - otherwise, unlock and set PMTU +/* Walk the exceptions of a nexthop after its first hop MTU changed. The +* chain is RCU protected here, while fnhe_update_pmtu() takes fnhe_lock +* for the update of each entry. */ void fib_nhc_update_mtu (struct fib_nh_common *nhc,u32 new,u32 orig) {struct fnhe_hash_bucket *bucket;int i; - bucket =rcu_dereference_protected (nhc->nhc_exceptions,1 ); +rcu_read_lock (); + bucket =rcu_dereference (nhc->nhc_exceptions);if (!bucket) -return ; + goto out;for (i =0 ; i <FNHE_HASH_SIZE ; i++) {struct fib_nh_exception *fnhe; -for (fnhe =rcu_dereference_protected (bucket[i].chain,1 ); +for (fnhe =rcu_dereference (bucket[i].chain); fnhe; - fnhe =rcu_dereference_protected (fnhe->fnhe_next,1 )) { -if (fnhe->fnhe_mtu_locked) { -if (new <= fnhe->fnhe_pmtu) { - fnhe->fnhe_pmtu = new; - fnhe->fnhe_mtu_locked = false; - } - }else if (new < fnhe->fnhe_pmtu || - orig == fnhe->fnhe_pmtu) { - fnhe->fnhe_pmtu = new; - } - } + fnhe =rcu_dereference (fnhe->fnhe_next)) +fnhe_update_pmtu (fnhe, new, orig); } +out: +rcu_read_unlock (); }void fib_sync_mtu (struct net_device *dev,u32 orig_mtu)
net/ipv4/route.c +29 -0
@@ -751,6 +751,35 @@ out_unlock:spin_unlock_bh (&fnhe_lock); } +/* Update the PMTU of an exception when: +* - the new MTU of the first hop becomes smaller than the PMTU +* - the old MTU was the same as the PMTU, and it limited discovery of +* larger MTUs on the path. With that limit raised, we can now +* discover larger MTUs +* A special case is locked exceptions, for which the PMTU is smaller +* than the minimal accepted PMTU: +* - if the new MTU is greater than the PMTU, don't make any change +* - otherwise, unlock and set PMTU +* +* fnhe_lock keeps fnhe_pmtu and fnhe_mtu_locked consistent against +* update_or_create_fnhe(), which sets both under the same lock. +*/ +void fnhe_update_pmtu (struct fib_nh_exception *fnhe,u32 new,u32 orig) +{ +spin_lock_bh (&fnhe_lock); + +if (fnhe->fnhe_mtu_locked) { +if (new <= fnhe->fnhe_pmtu) { + fnhe->fnhe_pmtu = new; + fnhe->fnhe_mtu_locked = false; + } + }else if (new < fnhe->fnhe_pmtu || orig == fnhe->fnhe_pmtu) { + fnhe->fnhe_pmtu = new; + } + +spin_unlock_bh (&fnhe_lock); +} +static void __ip_do_redirect (struct rtable *rt,struct sk_buff *skb,struct flowi4 *fl4,bool kill_route) {
Greg Kroah-Hartman
maintainerPATCH 103/156 mei: pull kvfree out of spinlock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Usyskin <[email protected]>
commit b0495bb58af06a7de4628c72d500e3d5e180d808 upstream.
The read buffer allocation was changed from kmalloc() to kvmalloc().
This buffer is part of mei_cl_cb structure that can be queued in rd_complete queue protected by spinlock.
Releasing the structure leads to errors like below when freeing buffer that allocated non-contiguous:
BUG: sleeping function called from invalid context at mm/vmalloc.c:3448
Separate mei_cl_cb structure dequeue and release to perform only dequeue under spinlock and push release out of spinlock.
--- drivers/misc/mei/client.c | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-)
drivers/misc/mei/client.c +15 -10
@@ -447,18 +447,24 @@ static void mei_io_tx_list_free_cl(struc }/** -* mei_io_list_free_fp - free cb from a list that matches file pointer +* mei_io_rd_list_free_fp - free cb from a rd_completed list that matches file pointer * -* @head: io list +* @cl: host client * @fp: file pointer (matching cb file object), may be NULL */ -static void mei_io_list_free_fp (struct list_head *head,const struct file *fp) +static void mei_io_rd_list_free_fp (struct mei_cl *cl,const struct file *fp) {struct mei_cl_cb *cb, *next; +LIST_HEAD (cmpl_list); -list_for_each_entry_safe (cb, next, head, list) +spin_lock (&cl->rd_completed_lock); +list_for_each_entry_safe (cb, next, &cl->rd_completed, list)if (!fp || fp == cb->fp) -mei_io_cb_free (cb); +list_move (&cb->list, &cmpl_list); +spin_unlock (&cl->rd_completed_lock); + +list_for_each_entry_safe (cb, next, &cmpl_list, list) +mei_io_cb_free (cb); }/**
@@ -587,9 +593,7 @@ int mei_cl_flush_queues(struct mei_cl *cmei_io_list_flush_cl (&cl->dev->ctrl_rd_list, cl);mei_cl_free_pending (cl); } -spin_lock (&cl->rd_completed_lock); -mei_io_list_free_fp (&cl->rd_completed, fp); -spin_unlock (&cl->rd_completed_lock); +mei_io_rd_list_free_fp (cl, fp);return 0 ; }
@@ -1426,7 +1430,7 @@ void mei_cl_add_rd_completed(struct mei_ }/** -* mei_cl_del_rd_completed - free read completed callback with lock +* mei_cl_del_rd_completed - unlink read completed callback with lock and free it * * @cl: host client * @cb: callback block
@@ -1435,8 +1439,9 @@ void mei_cl_add_rd_completed(struct mei_void mei_cl_del_rd_completed (struct mei_cl *cl,struct mei_cl_cb *cb) {spin_lock (&cl->rd_completed_lock); -mei_io_cb_free (cb); +list_del_init (&cb->list);spin_unlock (&cl->rd_completed_lock); +mei_io_cb_free (cb); }/**
Greg Kroah-Hartman
maintainerPATCH 104/156 serial: 8250_dma: Clear stale RX state on shutdown
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cunhao Lu <[email protected]>
commit e2fe6a0efecbef00e3ecc2db64dd5afa8c212b41 upstream.
serial8250_release_dma() terminates RX DMA and releases the channel, but leaves rx_running set. If the port is closed while an RX transfer is active, the stale state remains while rxchan is NULL until the channel is requested again on the next open.
The DesignWare BUSY workaround added by commit a7b9ce39fbe4 ("serial: 8250_dw: Ensure BUSY is deasserted") calls serial8250_rx_dma_flush() from the LCR write path during startup. This happens before serial8250_request_dma() obtains a new RX channel. On reopen, the stale rx_running state therefore makes the flush path pass a NULL channel to dmaengine_pause(), causing a kernel Oops.
Clear rx_running after terminating RX DMA, matching the TX cleanup. Also make the flush helper return if the DMA object or RX channel is not available so startup and teardown paths cannot pass a NULL channel to the DMAengine API.
--- drivers/tty/serial/8250/8250_dma.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/tty/serial/8250/8250_dma.c +7 -5
@@ -201,11 +201,12 @@ void serial8250_rx_dma_flush(struct uart {struct uart_8250_dma *dma = p->dma; -if (dma->rx_running) { -dmaengine_pause (dma->rxchan); -__dma_rx_complete (p); -dmaengine_terminate_async (dma->rxchan); - } +if (!dma || !dma->rxchan || !dma->rx_running) +return ; + +dmaengine_pause (dma->rxchan); +__dma_rx_complete (p); +dmaengine_terminate_async (dma->rxchan); }EXPORT_SYMBOL_GPL (serial8250_rx_dma_flush);
@@ -314,6 +315,7 @@ void serial8250_release_dma(struct uart_/* Release RX resources */ dmaengine_terminate_sync (dma->rxchan); + dma->rx_running =0 ;dma_free_coherent (dma->rxchan->device->dev, dma->rx_size, dma->rx_buf, dma->rx_addr);dma_release_channel (dma->rxchan);
Greg Kroah-Hartman
maintainerPATCH 105/156 staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <[email protected]>
commit 1c3e23e78862493e8cf1adad02b10ffcb8b9921c upstream.
rtw_get_wpa_ie() reads bytes at fixed offsets into a vendor-specific information element without checking that the element is long enough, causing an out-of-bounds read for a short trailing IE.
The function locates a vendor-specific IE (EID 221) with rtw_get_ie() and then compares a 4-byte OUI+type at pbuf + 2 and reads a 2-byte version word at pbuf + 6. Those accesses require the IE body to be at least 6 bytes, but rtw_get_ie() only guarantees that the element fits within the buffer; it does not enforce a minimum body length. A vendor-specific IE whose length byte is 0 to 5, placed at the end of the buffer, therefore makes these reads run past the end of the IE and past the end of the buffer itself.
The buffer holds information elements taken from received management frames and from the IE blob passed to rtw_cfg80211_set_wpa_ie(), which is kmemdup'd to its exact length, so the read can run off the end of the allocation.
The sibling helpers rtw_get_sec_ie(), rtw_get_wapi_ie() and rtw_get_wps_ie() in this file already reject too-short vendor-specific IEs before their OUI memcmp(); rtw_get_wpa_ie() was never brought in line with them, and needs a minimum of 6 rather than 4 bytes because of the version word. Add the missing length check.
--- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/staging/rtl8723bs/core/rtw_ieee80211.c +3 -0
@@ -371,6 +371,9 @@ unsigned char *rtw_get_wpa_ie(unsigned c pbuf =rtw_get_ie (pbuf,WLAN_EID_VENDOR_SPECIFIC , &len, limit_new);if (pbuf) { +if (len <6 ) + goto check_next_ie; +/* check if oui matches... */ if (memcmp ((pbuf +2 ), wpa_oui_type,sizeof (wpa_oui_type))) goto check_next_ie;
Greg Kroah-Hartman
maintainerPATCH 106/156 staging: rtl8723bs: fix OOB read in WMM_param_handler()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <[email protected]>
commit ae21407350151bddfd4fea7aa39bd0643c0ca9d3 upstream.
WMM_param_handler() copies a fixed-size WMM parameter element out of a received information element without checking that the element is long enough, causing an out-of-bounds read for a short WMM IE.
The handler reads sizeof(struct WMM_para_element) (18) bytes at pIE->data + 6, so it requires pIE->length to be at least 24 (WLAN_WMM_LEN), but it never validates the length. Two of its three callers reach it after matching only the WMM OUI: OnAssocRsp() in rtw_mlme_ext.c matches a 6-byte OUI, and join_cmd_hdl() matches a 4-byte OUI, before calling the handler. A vendor-specific IE carrying the WMM OUI but a length between 6 and 23, placed in an association response or in the IE blob handed to join_cmd_hdl(), passes the OUI check and then makes the memcmp() and memcpy() at pIE->data + 6 read past the end of the element. OnAssocRsp() parses a frame received from the AP, so this is reachable from a remote peer.
The remaining caller in rtw_wlan_util.c already guards the handler with "pIE->length == WLAN_WMM_LEN". Move the equivalent check into the handler itself so every caller is covered; the sibling IE handlers in the same parsing loop (HT_caps_handler(), HT_info_handler(), ERP_IE_handler()) likewise bound their accesses by pIE->length.
--- drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/staging/rtl8723bs/core/rtw_wlan_util.c +3 -0
@@ -731,6 +731,9 @@ int WMM_param_handler(struct adapter *pareturn false; } +if (pIE->length !=WLAN_WMM_LEN ) +return false; +if (!memcmp (&(pmlmeinfo->WMM_param), (pIE->data +6 ),sizeof (struct WMM_para_element )))return false;else
Greg Kroah-Hartman
maintainerPATCH 107/156 staging: rtl8723bs: fix missing shared-key auth challenge length check
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Panagiotis Petrakopoulos <[email protected]>
commit 2c56ef658ac8c6bca36bc5574715e8f717207c6c upstream.
The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chg_txt buffer.
In OnAuthClient() the length from rtw_get_ie() - up to 255 - is used to perform memcpy() into the 128-byte pmlmeinfo->chg_txt, so a malicious AP sending a malformed WLAN_EID_CHALLENGE element can overflow/underfill chg_txt by up to 127 bytes. It is reachable over the air, before association, during shared-key authentication. In the case of an overflow, the driver can write out of bounds. In the case of an underfill, the driver can echo stale buffer memory.
The challenge text is defined to be exactly 128 octets, which is already provided as the WLAN_AUTH_CHALLENGE_LEN define; require the element to be exactly that length before use.
--- drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c +1 -1
@@ -905,7 +905,7 @@ unsigned int OnAuthClient(struct adapter p =rtw_get_ie (pframe +WLAN_HDR_A3_LEN + _AUTH_IE_OFFSET_,WLAN_EID_CHALLENGE , (int *)&len, pkt_len -WLAN_HDR_A3_LEN - _AUTH_IE_OFFSET_); -if (!p) +if (!p || len !=WLAN_AUTH_CHALLENGE_LEN ) goto authclnt_fail;memcpy ((void *)(pmlmeinfo->chg_txt), (void *)(p +2 ), len);
Greg Kroah-Hartman
maintainerPATCH 108/156 staging: rtl8723bs: validate monitor transmit frame lengths
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mariano Baragiola <[email protected]>
commit 6829665d050983907b560173e49dcc6c11cb2730 upstream.
rtw_cfg80211_monitor_if_xmit_entry() removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains.
The data path also pulls the calculated 802.11, QoS and SNAP header span before confirming that the skb contains it. A truncated frame can therefore cause out-of-bounds reads or leave insufficient data for the Ethernet address writes.
Reject frames that do not contain the base 802.11 header and data frames that do not contain their complete calculated header span.
--- drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c +4 -0
@@ -2043,6 +2043,8 @@ static netdev_tx_t rtw_cfg80211_monitor_/* Skip the ratio tap header */ skb_pull (skb, rtap_len); +if (skb->len < dot11_hdr_len) + goto fail; dot11_hdr = (struct ieee80211_hdr *)skb->data; frame_control =le16_to_cpu (dot11_hdr->frame_control);
@@ -2055,6 +2057,8 @@ static netdev_tx_t rtw_cfg80211_monitor_ qos_len =2 ;if ((frame_control &0x0300 ) ==0x0300 ) dot11_hdr_len +=6 ; +if (skb->len < dot11_hdr_len + qos_len + snap_len) + goto fail;memcpy (dst_mac_addr, dot11_hdr->addr1,sizeof (dst_mac_addr));memcpy (src_mac_addr, dot11_hdr->addr2,sizeof (src_mac_addr));
Greg Kroah-Hartman
maintainerPATCH 109/156 misc: fastrpc: fix channel ctx ref leak when session alloc fails
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anandu Krishnan E <[email protected]>
commit 310f7868399668c6d99d88acc9c4cf3462e69d5b upstream.
fastrpc_channel_ctx_get() is called in fastrpc_device_open() before fastrpc_session_alloc(). If session alloc fails, the error path returns -EBUSY without calling fastrpc_channel_ctx_put(), leaking the reference. Fix by adding the missing put.
--- drivers/misc/fastrpc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/misc/fastrpc.c +1 -1
@@ -1644,7 +1644,7 @@ static int fastrpc_device_open(struct indev_err (&cctx->rpdev->dev,"No session available\n" );mutex_destroy (&fl->mutex);kfree (fl); - +fastrpc_channel_ctx_put (cctx);return -EBUSY ; }
Greg Kroah-Hartman
maintainerPATCH 110/156 misc: fastrpc: Remove buffer from list prior to unmap operation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ekansh Gupta <[email protected]>
commit 6102ceb4eab845743ee57acd3863fbd06e93c927 upstream.
fastrpc_req_munmap_impl() is called to unmap any buffer. The buffer is getting removed from the list after it is unmapped from DSP. This can create potential race conditions if multiple threads invoke unmap concurrently, where one thread may remove the entry from the list while another thread's unmap operation is still ongoing.
Fix this by removing the buffer entry from the list before calling the unmap operation. If the unmap fails, the entry is re-added to the list so that userspace can retry the unmap, or alternatively, the buffer will be cleaned up during device release when the DSP process is torn down and all DSP-side mappings are freed along with remaining buffers in the list.
--- drivers/misc/fastrpc.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
drivers/misc/fastrpc.c +10 -4
@@ -1872,9 +1872,6 @@ static int fastrpc_req_munmap_impl(struc &args[0]);if (!err) {dev_dbg (dev,"unmmap\tpt 0x%09lx OK\n" , buf->raddr); -spin_lock (&fl->lock); -list_del (&buf->node); -spin_unlock (&fl->lock);fastrpc_buf_free (buf); }else {dev_err (dev,"unmmap\tpt 0x%09lx ERROR\n" , buf->raddr);
@@ -1888,6 +1885,7 @@ static int fastrpc_req_munmap(struct fasstruct fastrpc_buf *buf =NULL , *iter, *b;struct fastrpc_req_munmap req;struct device *dev = fl->sctx->dev; +int err;if (copy_from_user (&req, argp,sizeof (req)))return -EFAULT ;
@@ -1895,6 +1893,7 @@ static int fastrpc_req_munmap(struct fasspin_lock (&fl->lock);list_for_each_entry_safe (iter, b, &fl->mmaps, node) {if ((iter->raddr == req.vaddrout) && (iter->size == req.size)) { +list_del (&iter->node); buf = iter;break ; }
@@ -1907,7 +1906,14 @@ static int fastrpc_req_munmap(struct fasreturn -EINVAL ; } -return fastrpc_req_munmap_impl (fl, buf); + err =fastrpc_req_munmap_impl (fl, buf); +if (err) { +spin_lock (&fl->lock); +list_add_tail (&buf->node, &fl->mmaps); +spin_unlock (&fl->lock); + } + +return err; }static int fastrpc_req_mmap (struct fastrpc_user *fl,char __user *argp)
Greg Kroah-Hartman
maintainerPATCH 111/156 misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <[email protected]>
commit b85a0e91d7d6cd06a53c881a46f749cfcef416a2 upstream.
When an invoke is interrupted by a signal, wait_for_completion_interruptible() returns -ERESTARTSYS and fastrpc_internal_invoke() moves every buffer from fl->mmaps onto cctx->invoke_interrupted_mmaps. This list_del()/list_add_tail() walk runs without holding fl->lock, the lock that serialises fl->mmaps in fastrpc_req_mmap() and fastrpc_req_munmap() everywhere else.
Take fl->lock around the move, matching every other fl->mmaps accessor.
--- drivers/misc/fastrpc.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/misc/fastrpc.c +2 -0
@@ -1275,10 +1275,12 @@ bail: }if (err == -ERESTARTSYS ) { +spin_lock (&fl->lock);list_for_each_entry_safe (buf, b, &fl->mmaps, node) {list_del (&buf->node);list_add_tail (&buf->node, &fl->cctx->invoke_interrupted_mmaps); } +spin_unlock (&fl->lock); }if (err)
Greg Kroah-Hartman
maintainerPATCH 112/156 misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eddie Lin <[email protected]>
commit 2fae94ee14f7fea11d3f95e10383a87c01d21518 upstream.
The 'ctx_idr' is initialized but never destroyed when the channel context is freed, leading to a memory leak. Add idr_destroy() to properly clean up the IDR resources.
--- drivers/misc/fastrpc.c | 1 + 1 file changed, 1 insertion(+)
drivers/misc/fastrpc.c +1 -0
@@ -468,6 +468,7 @@ static void fastrpc_channel_ctx_free(str cctx = container_of(ref, struct fastrpc_channel_ctx, refcount); +idr_destroy (&cctx->ctx_idr);kfree (cctx); }
Greg Kroah-Hartman
maintainerPATCH 113/156 ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Su <[email protected]>
commit 91542863abade2fd4f2b361991f5386ad9d19c8c upstream.
In test_ringbuffer()'s out_free cleanup loop, the check !rb_threads[cpu] only catches NULL entries and misses entries that hold an ERR_PTR.
rb_threads[] is static, so unassigned slots are NULL. But when kthread_run_on_cpu() fails for a cpu, it stores ERR_PTR(-ENOMEM) (or -EINTR) in rb_threads[cpu] before the creation loop jumps to out_free. That entry is non-NULL, so the old !ptr check does not break, and the cleanup proceeds to call kthread_stop() on the ERR_PTR. kthread_stop() then dereferences the bogus pointer, crashing the kernel during the late_initcall self-test.
crash logs:
BUG: kernel NULL pointer dereference, address: 000000000000001c Oops: 0002 [#1] SMP NOPTI CPU: 1 PID: 1 Comm: swapper/0 Not tainted 7.2.0-rc6-dirty #7 PREEMPT(lazy) RIP: 0010:kthread_stop+0x2e/0x220 RBX: fffffffffffffff4 CR2: 000000000000001c Call Trace: <TASK> test_ringbuffer+0x1ec/0x650 do_one_initcall+0x6c/0x2c0 kernel_init_freeable+0x21d/0x420 kernel_init+0x15/0x1c0 ret_from_fork+0x21b/0x320 </TASK> Kernel panic - not syncing: Fatal exception
--- kernel/trace/ring_buffer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/trace/ring_buffer.c +1 -1
@@ -6090,7 +6090,7 @@ static __init int test_ringbuffer(void) out_free:for_each_online_cpu (cpu) { -if (!rb_threads[cpu]) +if (IS_ERR_OR_NULL (rb_threads[cpu]))break ;kthread_stop (rb_threads[cpu]); }
Greg Kroah-Hartman
maintainerPATCH 114/156 ALSA: usb: Fix UAF at delayed release of MIDI2 EPs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit f8a80cfb68613fb7e6452b66447dbc63f435d140 upstream.
The recent fix for UAF in ump_to_endpoint() caused another UAF because it tries to dereference the UMP endpoint object, but this might be executed at a delayed context where the endpoint has been already released.
Add private_free to clear the associated data for avoiding the further dereference for delayed releases.
--- sound/usb/midi2.c | 9 +++++++++ 1 file changed, 9 insertions(+)
sound/usb/midi2.c +9 -0
@@ -695,6 +695,14 @@ static int parse_midi_2_0_endpoints(strureturn 0 ; } +static void free_ump_private_data (struct snd_ump_endpoint *ump) +{ +struct snd_usb_midi2_ump *rmidi = ump->private_data; + +if (rmidi) + rmidi->ump =NULL ; +} +static void free_all_midi2_umps (struct snd_usb_midi2_interface *umidi) {struct snd_usb_midi2_ump *rmidi;
@@ -745,6 +753,7 @@ static int create_midi2_ump(struct snd_u ump->private_data = rmidi; ump->ops = &snd_usb_midi_v2_ump_ops; + ump->private_free = free_ump_private_data; rmidi->eps[STR_IN ] = ep_in; rmidi->eps[STR_OUT ] = ep_out;
Greg Kroah-Hartman
maintainerPATCH 115/156 ALSA: usx2y: bound the hwdep mmap fault offset
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baul Lee <[email protected]>
commit 2ca1eea3cd17930daffe9e429a7c89232036ec24 upstream.
snd_us428ctls_vm_fault() turns the faulting page offset into a kernel address with no bound of any kind:
offset = vmf->pgoff << PAGE_SHIFT; vaddr = (char *)(...)->us428ctls_sharedmem + offset; page = virt_to_page(vaddr); get_page(page); vmf->page = page; return 0;
snd_us428ctls_mmap() checks only the length of the mapping, never the offset, and us428ctls_sharedmem is a single page from alloc_pages_exact(). For a character device file_mmap_size_max() returns ULONG_MAX, so the mm layer imposes no ceiling either. Every page offset above zero resolves to a struct page outside the object, and the handler installs it into the caller's address space read-write; the vma is not marked read-only.
The caller picks the page frame with a single mmap() argument and gets read-write access to a page of kernel memory it does not own; an offset that lands in an unpopulated vmemmap region oopses instead.
A process that can open the hwdep node of an attached US-X2Y reaches this after loading the FPGA image through the same node; no capability check is involved.
On 7.2.0-rc5 (arm64), mmap() with a large offset:
Unable to handle kernel paging request at virtual address fffffdffc45d5ac8 pc : snd_us428ctls_vm_fault+0x68/0x140 [snd_usb_usx2y] Call trace: snd_us428ctls_vm_fault+0x68/0x140 [snd_usb_usx2y] __do_fault __handle_mm_fault handle_mm_fault el0_da
Reject any offset outside the shared region. The pcm hwdep handler in usx2yhwdeppcm.c computes its address the same way and needs the same bound.
Discovered by XBOW, triaged by Baul Lee <[email protected]>
--- sound/usb/usx2y/usX2Yhwdep.c | 2 ++ sound/usb/usx2y/usx2yhwdeppcm.c | 2 ++ 2 files changed, 4 insertions(+)
sound/usb/usx2y/usX2Yhwdep.c +2 -0
@@ -29,6 +29,8 @@ static vm_fault_t snd_us428ctls_vm_fault vmf->pgoff); offset = vmf->pgoff <<PAGE_SHIFT ; +if (offset >=US428_SHAREDMEM_PAGES ) +return VM_FAULT_SIGBUS ; vaddr = (char *)((struct usx2ydev *)vmf->vma->vm_private_data)->us428ctls_sharedmem + offset; page =virt_to_page (vaddr);get_page (page);
sound/usb/usx2y/usx2yhwdeppcm.c +2 -0
@@ -676,6 +676,8 @@ static vm_fault_t snd_usx2y_hwdep_pcm_vmvoid *vaddr; offset = vmf->pgoff <<PAGE_SHIFT ; +if (offset >=USX2Y_HWDEP_PCM_PAGES ) +return VM_FAULT_SIGBUS ; vaddr = (char *)((struct usx2ydev *)vmf->vma->vm_private_data)->hwdep_pcm_shm + offset; vmf->page =virt_to_page (vaddr);get_page (vmf->page);
Greg Kroah-Hartman
maintainerPATCH 116/156 tracing: Fix race between update_event_fields and, event_define_fields
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Wu <[email protected]>
commit c3730b8373bb5059d735509b9e6a00d7eb337d7c upstream.
The following sequence may leads race between event_define_fields() and update_event_fields():
CPU0 (loads module A) CPU1 (loads module B)
=============================== ===============================
load_module(A) load_module(B)
notifier_call_chain notifier_call_chain
trace_module_notify trace_module_notify
mutex_lock(&event_mutex) trace_event_update_all()
trace_module_add_events(A) down_write(&trace_event_sem)
__register_event(call_A)
__add_event_to_tracers(call_A)
event_define_fields(call_A)
for each f: list_for_each_entry(field,
list_add(&f->link, &class->fields, link)
&class->fields) field = class->fields->next;Where access to the class->fields is not protected by the event_mutex in trace_event_update_all().
This produces the following panic:
Unable to handle kernel access ... at virtual address 0000000000000018
pc : update_event_fields+0xf8/0x368
Call trace:
update_event_fields+0xf8/0x368
trace_event_update_all+0x7c/0x2b4
trace_module_notify+0x4c/0x1dc
notifier_call_chain+0x84/0x168
blocking_notifier_call_chain_robust+0x64/0xd4
load_module+0x10c8/0x123c
__arm64_sys_finit_module+0x230/0x31cFix by taking event_mutex in trace_event_update_all() before trace_event_sem.
--- kernel/trace/trace_events.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/trace/trace_events.c +2 -0
@@ -3038,6 +3038,7 @@ void trace_event_eval_update(struct tracint last_i;int i; +mutex_lock (&event_mutex);down_write (&trace_event_sem);list_for_each_entry_safe (call, p, &ftrace_events, list) {/* events are usually grouped together with systems */
@@ -3071,6 +3072,7 @@ void trace_event_eval_update(struct traccond_resched (); }up_write (&trace_event_sem); +mutex_unlock (&event_mutex); } static bool event_in_systems(struct trace_event_call *call,
Greg Kroah-Hartman
maintainerPATCH 117/156 fbdev: bitblit: bound-check glyph index in bit_cursor()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rik van Riel <[email protected]>
commit e033cbf3975a8465f879ebd5989dc35b04423a4d upstream.
bit_cursor() fetches the glyph under the cursor with
c = scr_readw(vc_pos); src = vc_font.data + ((c & charmask) * w * height);
where charmask is 0x1ff when vc_hi_font_mask is set. The screen buffer value comes directly from scr_readw() and may be larger than the current font's glyph count.
Syzkaller triggers this via vcs_write(). The Call Trace shows vcs_write() in vc_screen.c writing an arbitrary 16-bit value with writev() to /dev/vcsa, which vcs_write_buf() in vc_screen.c stores via vcs_scr_writew() without checking charcount. The stored value is later read in bit_cursor() in bitblit.c.
When the font is changed from a font with 512 glyphs to a font with 256 glyphs, the screen buffer can retain characters with the high bit set from the previous mode, which could also produce the same out-of-bounds access.
BUG: KASAN: global-out-of-bounds in soft_cursor+0x378/0x6bc drivers/video/fbdev/core/softcursor.c:70 Read of size 16 at addr ffff800086c57970 Call Trace: soft_cursor+0x378/0x6bc drivers/video/fbdev/core/softcursor.c:70 bit_cursor+0xa90/0x1108 drivers/video/fbdev/core/bitblit.c:365 fbcon_cursor+0x344/0x498 drivers/video/fbdev/core/fbcon.c:1427 hide_cursor+0xdc/0x2d0 drivers/tty/vt/vt.c:883 update_region+0x100/0x18c drivers/tty/vt/vt.c:669 vcs_write+0x8ec/0xaf0 drivers/tty/vt/vc_screen.c:685
bit_putcs_aligned() and bit_putcs_unaligned() already clamp the glyph index to vc_font.charcount. Apply the same clamp in bit_cursor() after extracting the attribute and masking, before indexing fontdata.
The fix completes the bounds checking started in commit 18c4ef4e765a ("fbdev: bitblit: bound-check glyph index in bit_putcs*"), which missed the cursor path.
This change should be safe because the clamp reuses the existing contract from fbcon: charcount is maintained under console_lock in con_font_set() and fbcon_font_set(), and hi_font_mask is cleared when switching from 512 to 256 glyphs. When stale screen data with high bits remains after a font switch, or when vcs_write() stores an arbitrary value, clamping the index to 0 prevents the out-of-bounds read without changing cursor semantics — the same fallback bit_putcs uses.
--- drivers/video/fbdev/core/bitblit.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/video/fbdev/core/bitblit.c +7 -2
@@ -274,9 +274,14 @@ static void bit_cursor(struct vc_data *vif (!vc->vc_font.data)return ; - c =scr_readw ((u16 *) vc->vc_pos); + c =scr_readw ((u16 *) vc->vc_pos); attribute =get_attribute (info, c); - src = vc->vc_font.data + ((c & charmask) * (w * vc->vc_font.height)); + c &= charmask; + +/* Clamp to font size, same as bit_putcs_aligned() */ +if (c >= vc->vc_font.charcount) + c =0 ; + src = vc->vc_font.data + (c * (w * vc->vc_font.height));if (par->cursor_state.image.data != src || par->cursor_reset) {
Greg Kroah-Hartman
maintainerPATCH 118/156 net: smc: fix splice entry lifetime imbalance in smc_rx_splice
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daming Li <[email protected]>
commit 5d9686af2976741bbd79b150d1c9e60b81e7f12e upstream.
smc_rx_splice() passes pages to splice_to_pipe() before taking the references that cover the lifetime of each splice entry. In the VM-backed RMB path, splice_to_pipe() may drop unqueued entries through smc_rx_spd_release(), while queued entries are released later via the pipe buffer callback.
The old post-splice accounting also derives the number of queued VM pages from an offset mutated while building the descriptor, and a multi-page splice pairs one sock_hold() with multiple sock_put() calls.
Take the page and socket references for every candidate entry before splice_to_pipe(), and drop the matching private state, page reference, and socket reference from smc_rx_spd_release() for entries that never get queued. This fixes a refcount imbalance that can underflow page refcounts and trigger a use-after-free.
--- net/smc/smc_rx.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-)
net/smc/smc_rx.c +10 -9
@@ -150,7 +150,12 @@ static const struct pipe_buf_operationsstatic void smc_rx_spd_release (struct splice_pipe_desc *spd,unsigned int i) { +struct smc_spd_priv *priv = (struct smc_spd_priv *)spd->partial[i].private; +struct sock *sk = &priv->smc->sk; + +kfree (priv);put_page (spd->pages[i]); +sock_put (sk); } static int smc_rx_splice(struct pipe_inode_info *pipe, char *src, size_t len,
@@ -209,6 +214,10 @@ static int smc_rx_splice(struct pipe_ino offset =0 ; } } +for (i =0 ; i < nr_pages; i++) { +get_page (pages[i]); +sock_hold (&smc->sk); + } spd.nr_pages_max = nr_pages; spd.nr_pages = nr_pages; spd.pages = pages;
@@ -217,16 +226,8 @@ static int smc_rx_splice(struct pipe_ino spd.spd_release = smc_rx_spd_release; bytes =splice_to_pipe (pipe, &spd); -if (bytes >0 ) { -sock_hold (&smc->sk); -if (!lgr->is_smcd && smc->conn.rmb_desc->is_vm) { -for (i =0 ; i <PAGE_ALIGN (bytes + offset) /PAGE_SIZE ; i++) -get_page (pages[i]); - }else { -get_page (smc->conn.rmb_desc->pages); - } +if (bytes >0 )atomic_add (bytes, &smc->conn.splice_pending); - }kfree (priv);kfree (partial);kfree (pages);
Greg Kroah-Hartman
maintainerPATCH 119/156 ipv6: prevent in6_dev_get() from resurrecting inet6_dev
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kyle Zeng <[email protected]>
commit 0e243671bc7b8eaf00f83dd2f4367436dc0cff98 upstream.
in6_dev_get() reads dev->ip6_ptr under RCU and then unconditionally increments its refcount. Device teardown can clear the pointer and drop the last reference between these operations. The increment then resurrects an object whose RCU free has already been queued, so callers can use it after it is freed.
Use refcount_inc_not_zero() and return NULL when the object has already reached zero. RCU keeps the memory accessible through the attempted reference acquisition, and a successful increment pins the object for the caller.
An independent run on the exact unpatched 6f5156d7a31a (v7.2-rc3) kernel reproduced the invalid reference acquisition as UID 1000:
refcount_t: addition on 0; use-after-free.
ip6_mc_source+0xef4/0x17e0
It was followed by the corresponding reference underflow in ip6_mc_source(). The supplied trace from the same unpatched revision additionally shows the access after the RCU read-side section ends:
BUG: KASAN: slab-use-after-free in mutex_lock+0x76/0xe0 Write of size 8 at addr ffff888015b50240 by task poc/1219
Bug found and triaged by OpenAI Security Research and validated by Trail of Bits.
--- include/net/addrconf.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/net/addrconf.h +2 -2
@@ -370,8 +370,8 @@ static inline struct inet6_dev *in6_dev_rcu_read_lock (); idev =rcu_dereference (dev->ip6_ptr); -if (idev) -refcount_inc (&idev->refcnt); +if (idev && !refcount_inc_not_zero (&idev->refcnt)) + idev =NULL ;rcu_read_unlock ();return idev; }
Greg Kroah-Hartman
maintainerPATCH 120/156 netfilter: bridge: release template ct on non-IP path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhiling Zou <[email protected]>
commit d45cc8020d7c0a9f01dee42ff5c40bc14c9af72f upstream.
A bridge nftables ct zone set rule can attach a conntrack template to an skb before nf_ct_bridge_pre() sees it. For non-IPv4 and non-IPv6 EtherTypes, nf_ct_bridge_pre() currently overwrites skb->_nfct with IP_CT_UNTRACKED without releasing the existing template reference.
That makes the per-cpu template, and any temporary templates allocated for concurrent use, unreachable and leaks memory until the host runs out of slab.
Reset the skb conntrack state before marking the frame untracked so the existing template reference is dropped on the non-IP path.
--- net/bridge/netfilter/nf_conntrack_bridge.c | 1 + 1 file changed, 1 insertion(+)
net/bridge/netfilter/nf_conntrack_bridge.c +1 -0
@@ -281,6 +281,7 @@ static unsigned int nf_ct_bridge_pre(voi ret =nf_ct_br_defrag6 (skb, &bridge_state);break ;default : +nf_reset_ct (skb);nf_ct_set (skb,NULL ,IP_CT_UNTRACKED );return NF_ACCEPT ; }
Greg Kroah-Hartman
maintainerPATCH 121/156 netfilter: nf_conntrack: defer invalid log until after unlock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zihan Xi <[email protected]>
commit 2d19b95c9723001f214f7a47d67b09f46238f200 upstream.
TCP and SCTP conntrack paths can emit invalid-packet logs while ct->lock is still held.
When invalid logging is routed to nfnetlink_log and conntrack export is enabled, the log path can re-enter conntrack netlink glue and dump the same conntrack again. Protocol attribute dumping may take ct->lock, so logging while holding that lock can deadlock.
Defer the TCP invalid logs by storing only the minimal log context while ct->lock is held and emitting the log after unlocking. Also make the TCP timeout-lowering invalid path return whether a log is needed, then emit that log after unlocking.
Do the same for the SCTP invalid state-transition log that can be reached while ct->lock is held.
Add a lockdep assertion to nf_ct_l4proto_log_invalid() so future callers that log invalid conntracks while holding ct->lock are caught outside TCP and SCTP as well.
--- net/netfilter/nf_conntrack_proto.c | 6 + net/netfilter/nf_conntrack_proto_sctp.c | 12 +- net/netfilter/nf_conntrack_proto_tcp.c | 132 +++++++++++++++++++++----------- 3 files changed, 102 insertions(+), 48 deletions(-)
net/netfilter/nf_conntrack_proto.c +6 -0
@@ -79,6 +79,12 @@ void nf_ct_l4proto_log_invalid(const strstruct net *net;va_list args; +/* nfnetlink_log may re-enter conntrack attribute dumping and try to +* take ct->lock again via helpers such as tcp_to_nlattr(), so invalid +* conntrack logs must only be emitted after dropping ct->lock. +*/ +lockdep_assert_not_held (&ct->lock); + net =nf_ct_net (ct);if (likely (net->ct.sysctl_log_invalid ==0 ))return ;
net/netfilter/nf_conntrack_proto_sctp.c +8 -4
@@ -341,10 +341,12 @@ int nf_conntrack_sctp_packet(struct nf_cstruct sctphdr _sctph;const struct sctp_chunkhdr *sch;struct sctp_chunkhdr _sch; +bool log_invalid = false;u_int32_t offset, count;unsigned int *timeouts;unsigned long map[256 /sizeof (unsigned long )] = {0 };bool ignore = false; +u8 invalid_type =0 ;if (sctp_error (skb, dataoff, state))return -NF_ACCEPT ;
@@ -456,10 +458,8 @@ int nf_conntrack_sctp_packet(struct nf_c/* Invalid */ if (new_state ==SCTP_CONNTRACK_MAX ) { -nf_ct_l4proto_log_invalid (skb, ct, state, -"Invalid, old_state %d, dir %d, type %d" , - old_state, dir, sch->type); - + log_invalid = true; + invalid_type = sch->type; goto out_unlock; }
@@ -534,6 +534,10 @@ int nf_conntrack_sctp_packet(struct nf_c out_unlock:spin_unlock_bh (&ct->lock); +if (log_invalid) +nf_ct_l4proto_log_invalid (skb, ct, state, +"Invalid, old_state %d, dir %d, type %d" , + old_state, dir, invalid_type); out:return -NF_ACCEPT ; }
net/netfilter/nf_conntrack_proto_tcp.c +88 -44
225 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 122/156 net: atlantic: free stranded TX buffers on ring deinit
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yangyu Chen <[email protected]>
commit 452636ea5410a96e02ebaaf80b21e3620b98e0dd upstream.
aq_vec_deinit() drains the TX rings with a single aq_ring_tx_clean() call, which frees at most AQ_CFG_TX_CLEAN_BUDGET (256) descriptors and stops at hw_head, which no longer moves once aq_vec_stop() has stopped the hardware and NAPI. Completed descriptors beyond the budget and everything still posted in [hw_head, sw_tail) keep their skb or xdp_frame when the interface goes down: aq_vec_ring_free() then frees the buffer ring and the references are lost for good.
Today this is a silent memory leak on every interface down under TX/XDP_TX load. With the conversion of the RX path to page_pool posted for net-next it becomes much more visible: XDP_TX frames carry fragment references on the RX ring's page_pool, so a single stranded frame keeps the pool's inflight count above zero forever. page_pool_destroy() then never completes, the pool is leaked together with its pages, and "page_pool_release_retry() stalled pool shutdown" is warned every 60 seconds from that point on, on every ifdown, XDP detach or ring resize under XDP_TX load.
Bring back aq_ring_tx_deinit() as it was before the removal and use it for teardown again, with one extension: TX rings can hold xdp_frames nowadays, so release those too. They are returned with xdp_return_frame() since this runs in process context.
--- drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 29 +++++++++++++++++++++++ drivers/net/ethernet/aquantia/atlantic/aq_ring.h | 1 drivers/net/ethernet/aquantia/atlantic/aq_vec.c | 2 - 3 files changed, 31 insertions(+), 1 deletion(-)
drivers/net/ethernet/aquantia/atlantic/aq_ring.c +29 -0
@@ -336,6 +336,35 @@ out:return !!budget; } +void aq_ring_tx_deinit (struct aq_ring_s *self) +{ +if (!self) +return ; + +for (; self->sw_head != self->sw_tail; + self->sw_head =aq_ring_next_dx (self, self->sw_head)) { +struct aq_ring_buff_s *buff = &self->buff_ring[self->sw_head]; +struct device *ndev =aq_nic_get_dev (self->aq_nic); + +if (buff->is_mapped) { +if (buff->is_sop) { +dma_unmap_single (ndev, buff->pa, buff->len, +DMA_TO_DEVICE ); + }else { +dma_unmap_page (ndev, buff->pa, buff->len, +DMA_TO_DEVICE ); + } + } + +if (buff->is_eop) { +if (buff->skb) +dev_kfree_skb_any (buff->skb); +else if (buff->xdpf) +xdp_return_frame (buff->xdpf); + } + } +} +static void aq_rx_checksum (struct aq_ring_s *self,struct aq_ring_buff_s *buff,struct sk_buff *skb)
drivers/net/ethernet/aquantia/atlantic/aq_ring.h +1 -0
@@ -199,6 +199,7 @@ void aq_ring_update_queue_state(struct avoid aq_ring_queue_wake (struct aq_ring_s *ring);void aq_ring_queue_stop (struct aq_ring_s *ring);bool aq_ring_tx_clean (struct aq_ring_s *self); +void aq_ring_tx_deinit (struct aq_ring_s *self);int aq_xdp_xmit (struct net_device *dev,int num_frames,struct xdp_frame **frames,u32 flags); int aq_ring_rx_clean(struct aq_ring_s *self,
drivers/net/ethernet/aquantia/atlantic/aq_vec.c +1 -1
@@ -275,7 +275,7 @@ void aq_vec_deinit(struct aq_vec_s *selffor (i =0U ; self->tx_rings > i; ++i) { ring = self->ring[i]; -aq_ring_tx_clean (&ring[AQ_VEC_TX_ID ]); +aq_ring_tx_deinit (&ring[AQ_VEC_TX_ID ]);aq_ring_rx_deinit (&ring[AQ_VEC_RX_ID ]); }
Greg Kroah-Hartman
maintainerPATCH 123/156 net: atlantic: free RX pages of consumed but not refilled buffers
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yangyu Chen <[email protected]>
commit e8e7471ef686b6c002218fee9671cc61992ae01a upstream.
aq_ring_rx_deinit() only walks [sw_head, sw_tail), the region posted to hardware. Since the page reuse strategy was added, a cleaned RX buffer keeps its page (and its DMA mapping) in the ring for reuse, and refill is batched: aq_ring_rx_fill() returns early until AQ_CFG_RX_REFILL_THRES slots are free. Slots that were consumed but not yet reposted therefore sit in the complementary [sw_tail, sw_head) gap with a live page, and the deinit walk never visits them: up to a refill batch worth of pages and DMA mappings leak on every interface down.
Walk the whole ring instead and release whatever is still there. Also bail out if the buffer ring is already gone: a partial aq_ptp_ring_alloc() failure frees the ring but leaves aq_nic set, so aq_ptp_ring_deinit() still gets here on the unwind path.
--- drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-)
drivers/net/ethernet/aquantia/atlantic/aq_ring.c +18 -4
@@ -926,15 +926,29 @@ err_exit:void aq_ring_rx_deinit (struct aq_ring_s *self) { -if (!self) +unsigned int i; + +if (!self || !self->buff_ring)return ; -for (; self->sw_head != self->sw_tail; - self->sw_head =aq_ring_next_dx (self, self->sw_head)) { -struct aq_ring_buff_s *buff = &self->buff_ring[self->sw_head]; +/* Release every page still owned by the ring. +* +* Walking [sw_head, sw_tail) is not enough: refill is batched +* (aq_ring_rx_fill() waits for AQ_CFG_RX_REFILL_THRES free slots), +* so slots that were cleaned but not yet reposted accumulate in the +* [sw_tail, sw_head) gap, and they keep their page for reuse. Walk +* the whole ring and release whatever is left. +*/ +for (i =0 ; i < self->size; i++) { +struct aq_ring_buff_s *buff = &self->buff_ring[i]; + +if (!buff->rxdata.page) +continue ;aq_free_rxpage (&buff->rxdata,aq_nic_get_dev (self->aq_nic)); } + + self->sw_head = self->sw_tail; }void aq_ring_free (struct aq_ring_s *self)
Greg Kroah-Hartman
maintainerPATCH 124/156 net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunjung Ko <[email protected]>
commit 8a7ed561671aa6a911a2de99e59ef670a4d0b1df upstream.
tcf_ct_handle_fragments() runs its header sanity checks before handing anything to the defragmentation engine:
if (family == NFPROTO_IPV4) err = tcf_ct_ipv4_is_fragment(skb, &frag); else err = tcf_ct_ipv6_is_fragment(skb, &frag); if (err || !frag) return err;
tcf_ct_ipv4_is_fragment() returns -EINVAL or -ENOMEM; tcf_ct_ipv6_is_fragment() adds -EPROTO when ipv6_find_hdr() fails. None of them frees or queues the skb, so on that path the caller still owns it.
tcf_ct_act() however funnels every non-zero return into the ownership-transfer exit:
err = tcf_ct_handle_fragments(net, skb, family, p->zone, &defrag); if (err) goto out_frag; ... out_frag: if (err != -EINPROGRESS) tcf_action_inc_drop_qstats(&c->common); return TC_ACT_CONSUMED;
TC_ACT_CONSUMED means the action took ownership of the skb, so no caller frees it - sch_handle_ingress(), sch_handle_egress() and tcf_qevent_handle() all deliberately skip the free for that verdict. The skb is therefore orphaned: one sk_buff plus its data buffer is leaked per malformed packet, unbounded. Note the drop counter is already incremented for these errors, so the statistics claim a drop that never happens.
Three different ownership states reach out_frag: today - the skb may be queued by the defrag engine (-EINPROGRESS), already freed by nf_ct_handle_fragments(), or still owned by us. Tell the caller which of those it is, and free the packet ourselves in the last case, which restores the TC_ACT_SHOT behaviour that predated the Fixes: commit.
Reproduced on v7.2-rc6 with a 54-byte frame carrying a 40-byte IPv6 header with nexthdr = 0 (hop-by-hop) and nothing after it, on a clsact ingress chain with "action ct". kmemleak reports one leaked 232-byte skbuff_head_cache object plus its 704-byte data buffer per packet; with this patch it reports none.
--- net/sched/act_ct.c | 29 +++++++++++++++++++++++++---- 1 file changed, 25 insertions(+), 4 deletions(-)
net/sched/act_ct.c +25 -4
@@ -841,8 +841,15 @@ static int tcf_ct_ipv6_is_fragment(strucreturn 0 ; } +/* On error, tells the caller whether it still owns @skb and must free it +* itself. @skb is ours only when the header checks below reject the packet +* before it is handed to the defragmentation engine; once nf_ct_handle_ +* fragments() has been called the skb is either queued (-EINPROGRESS) or has +* already been freed by it. +*/ static int tcf_ct_handle_fragments (struct net *net,struct sk_buff *skb, -u8 family,u16 zone,bool *defrag) +u8 family,u16 zone,bool *defrag, +bool *skb_is_ours) {enum ip_conntrack_info ctinfo;struct tc_skb_cb cb;
@@ -860,8 +867,12 @@ static int tcf_ct_handle_fragments(struc err =tcf_ct_ipv4_is_fragment (skb, &frag); else err =tcf_ct_ipv6_is_fragment (skb, &frag); -if (err || !frag) +if (err) { + *skb_is_ours = true;return err; + } +if (!frag) +return 0 ; cb = *tc_skb_cb (skb); err =nf_ct_handle_fragments (net, skb, zone, family, &proto, &cb.mru);
@@ -971,6 +982,7 @@ TC_INDIRECT_SCOPE int tcf_ct_act(structint nh_ofs, err, retval;struct tcf_ct_params *p;bool add_helper = false; +bool skb_is_ours = false;bool skip_add = false;bool defrag = false;struct nf_conn *ct;
@@ -1006,9 +1018,18 @@ TC_INDIRECT_SCOPE int tcf_ct_act(struct*/ nh_ofs =skb_network_offset (skb);skb_pull_rcsum (skb, nh_ofs); - err =tcf_ct_handle_fragments (net, skb, family, p->zone, &defrag); -if (err) + err =tcf_ct_handle_fragments (net, skb, family, p->zone, &defrag, + &skb_is_ours); +if (err) { +/* The skb is still ours only when the header checks rejected +* it; returning TC_ACT_CONSUMED for such a packet would leak +* it, since no caller frees an skb it was told it no longer +* owns. +*/ +if (skb_is_ours) + goto drop; goto out_frag; + } err =nf_ct_skb_network_trim (skb, family);if (err)
Greg Kroah-Hartman
maintainerPATCH 125/156 net/sched: act_gact, act_police: range check the fallback control action
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunjung Ko <[email protected]>
commit 883b56ae58fe657d8497806c7059646e9ba6dbd0 upstream.
tcf_action_check_ctrlact() range checks the primary control action:
if (!opcode) ret = action > TC_ACT_VALUE_MAX ? -EINVAL : 0;
TC_ACT_VALUE_MAX is TC_ACT_TRAP, so kernel-internal verdicts above it cannot be set that way. But act_gact and act_police each carry a second, independent control action supplied by user space that never reaches that helper - TCA_GACT_PROB.paction and TCA_POLICE_RESULT. Both only reject TC_ACT_GOTO_CHAIN, so any other value is stored verbatim and returned verbatim from the action.
In particular user space can store TC_ACT_CONSUMED, which is TC_ACT_VALUE_MAX + 1 and is deliberately not part of the UAPI value range. That verdict tells every caller the action took ownership of the skb, so nobody frees it: sch_handle_ingress(), sch_handle_egress() and tcf_qevent_handle() all deliberately skip the free for it. The result is one leaked sk_buff plus its data buffer per packet traversing the filter, unbounded, for all traffic on the chain including kernel-generated packets.
Both are trivially deterministic. act_gact clamps tcfg_pval to >= 1, so with pval = 1 gact_determ() returns the fallback for every packet. act_police has no mandatory rate, so rate = 0 leaves tcfp_mtu = ~0 and tcf_police_mtu_check() always passes.
TC_ACT_CONSUMED was added by commit 720f22fed81b ("net: sched: refactor reinsert action"), after both goto-chain guards were written:
commit 9469f375ab09 ("net/sched: act_gact: disallow 'goto chain' on fallback control action") and
commit c08f5ed5d625 ("net/sched: act_police: disallow 'goto chain' on fallback control action"). Neither guard was widened when the new verdict appeared.
Factor the existing range test out of tcf_action_check_ctrlact() as tcf_action_valid() and apply it to both fallbacks. The helper cannot call tcf_action_check_ctrlact() directly because that also allocates a goto_chain, which is exactly what these two sites must not do.
Reproduced on v7.2-rc6: kmemleak reports one leaked 232-byte skbuff_head_cache object plus its 704-byte data buffer per packet. With this patch both configurations are rejected with -EINVAL and kmemleak reports none.
--- include/net/act_api.h | 19 +++++++++++++++++++ net/sched/act_gact.c | 5 +++++ net/sched/act_police.c | 6 ++++++ 3 files changed, 30 insertions(+)
include/net/act_api.h +19 -0
@@ -268,6 +268,25 @@ int tcf_action_check_ctrlact(int action,struct tcf_chain *tcf_action_set_ctrlact (struct tc_action *a,int action,struct tcf_chain *newchain); +/* Range check for a control action supplied by user space. +* +* This is the same test tcf_action_check_ctrlact() applies to the primary +* control action, factored out for the *fallback* control actions +* (act_gact's TCA_GACT_PROB.paction and act_police's TCA_POLICE_RESULT), +* which must not reach tcf_action_check_ctrlact() because they have no +* goto_chain to allocate. Without it, user space can store kernel-internal +* verdicts such as TC_ACT_CONSUMED, which is TC_ACT_VALUE_MAX + 1 and is +* deliberately not part of the UAPI value range. +*/ +static inline bool tcf_action_valid (int action) +{ +int opcode =TC_ACT_EXT_OPCODE (action); + +if (!opcode) +return action <=TC_ACT_VALUE_MAX ; +return opcode <=TC_ACT_EXT_OPCODE_MAX || action ==TC_ACT_UNSPEC ; +} +#ifdef CONFIG_INET DECLARE_STATIC_KEY_FALSE (tcf_frag_xmit_count);#endif
net/sched/act_gact.c +5 -0
@@ -89,6 +89,11 @@ static int tcf_gact_init(struct net *net p_parm =nla_data (tb[TCA_GACT_PROB ]);if (p_parm->ptype >=MAX_RAND )return -EINVAL ; +if (!tcf_action_valid (p_parm->paction)) { +NL_SET_ERR_MSG (extack, +"invalid fallback control action" ); +return -EINVAL ; + }if (TC_ACT_EXT_CMP (p_parm->paction,TC_ACT_GOTO_CHAIN )) {NL_SET_ERR_MSG (extack,"goto chain not allowed on fallback" );
net/sched/act_police.c +6 -0
@@ -128,6 +128,12 @@ static int tcf_police_init(struct net *nif (tb[TCA_POLICE_RESULT ]) { tcfp_result =nla_get_u32 (tb[TCA_POLICE_RESULT ]); +if (!tcf_action_valid (tcfp_result)) { +NL_SET_ERR_MSG (extack, +"invalid fallback control action" ); + err = -EINVAL ; + goto failure; + }if (TC_ACT_EXT_CMP (tcfp_result,TC_ACT_GOTO_CHAIN )) {NL_SET_ERR_MSG (extack,"goto chain not allowed on fallback" );
Greg Kroah-Hartman
maintainerPATCH 126/156 ovl: dont warn when the mount is completed from another user namespace
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Brauner <[email protected]>
commit 63981fc786daaa626cb14d9be1406f674d79f98f upstream.
fsopen() records the caller's user namespace in fc->user_ns and hands back an ordinary file descriptor. Nothing ties the task that calls fsconfig(FSCONFIG_CMD_CREATE) to the task that created the context. The fd is inherited across fork() and exec() and it can be passed over a unix socket.
Completing a context from another user namespace is allowed on purpose. vfs_cmd_create() authorizes the create with mount_capable(), which for FS_USERNS_MOUNT checks ns_capable(fc->user_ns, CAP_SYS_ADMIN), and that succeeds for a task holding CAP_SYS_ADMIN in an ancestor of fc->user_ns. So an unprivileged task can reach the WARN_ON() in ovl_fill_super():
create a user and a mount namespace in a child, call fsopen("overlay") there, send the fscontext fd to the parent and let the parent issue FSCONFIG_CMD_CREATE. Both namespaces come from a plain unshare(1) and no capability is needed anywhere:
WARNING: fs/overlayfs/super.c:1551 at ovl_fill_super+0x7b9/0x1e20 [overlay] CPU: 3 UID: 1000 PID: 3243376 Comm: fswarn Call Trace: get_tree_nodev+0x71/0xa0 ovl_get_tree+0x15/0x20 [overlay] vfs_get_tree+0x2a/0x100 vfs_cmd_create+0x60/0xf0 __do_sys_fsconfig+0x4b2/0x500
The child needs the mount namespace because fsopen() itself gates on may_mount(), which asks for CAP_SYS_ADMIN in the user namespace owning the caller's mount namespace. fsconfig() doesn't repeat that check.
It is a WARN_ON() and not a WARN_ON_ONCE(), so the condition can be raised in a loop to taint the kernel and flood the log, and it panics a kernel booted with panic_on_warn.
Keep refusing the mount and stop warning about it. ovl_parse_param() already spells a user namespace check this way for Opt_override_creds.
--- fs/overlayfs/super.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/overlayfs/super.c +2 -1
@@ -1345,7 +1345,8 @@ int ovl_fill_super(struct super_block *sint err; err = -EIO ; -if (WARN_ON (fc->user_ns !=current_user_ns ())) +/* The fscontext fd may have been passed to another user namespace. */ +if (fc->user_ns !=current_user_ns ()) goto out_err; sb->s_d_op = &ovl_dentry_operations;
Greg Kroah-Hartman
maintainerPATCH 127/156 Revert "drm/amdgpu: fix aperture mapping leak"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asad Kamal <[email protected]>
commit b96c529cd2551b78316a4afa3237b2ed96ba03c8 upstream.
devres teardown is LIFO. The aperture devres node was registered after the DRM device node, so devres_release_all() unmaps the aperture before the DRM device release callback fires amdgpu_device_fini_sw(). IP sw_fini callbacks (e.g. vcn_v4_0_sw_fini) write to fw_shared through a pointer derived from aper_base_kaddr, causing a kernel page fault on probe failure / rollback:
BUG: unable to handle page fault ... PMD 0
RIP: vcn_v4_0_sw_fini+0x7b/0x170 [amdgpu]
Call Trace:
amdgpu_device_fini_sw
amdgpu_driver_release_kms
devm_drm_dev_init_release
devres_release_allThis reverts commit d871e99879cb5fd1fa798b006b4888887e63a17a.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 35 +++++++++++++++-------------- 2 files changed, 21 insertions(+), 16 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +2 -0
@@ -3977,6 +3977,8 @@ static void amdgpu_device_unmap_mmio(striounmap (adev->rmmio); adev->rmmio =NULL ; +if (adev->mman.aper_base_kaddr) +iounmap (adev->mman.aper_base_kaddr); adev->mman.aper_base_kaddr =NULL ;/* Memory manager related */
drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +19 -16
@@ -1887,23 +1887,17 @@ int amdgpu_ttm_init(struct amdgpu_device/* Change the size here instead of the init above so only lpfn is affected */ amdgpu_ttm_set_buffer_funcs_status (adev, false);#ifdef CONFIG_64BIT -if (adev->gmc.xgmi.connected_to_cpu) { -void *kaddr =devm_memremap (adev->dev, adev->gmc.aper_base, - adev->gmc.visible_vram_size, -MEMREMAP_WB ); -if (IS_ERR (kaddr)) -return PTR_ERR (kaddr); - adev->mman.aper_base_kaddr = (__force void __iomem *)kaddr; - }else if (adev->gmc.is_app_apu) { +#ifdef CONFIG_X86 +if (adev->gmc.xgmi.connected_to_cpu) + adev->mman.aper_base_kaddr =ioremap_cache (adev->gmc.aper_base, + adev->gmc.visible_vram_size); +else if (adev->gmc.is_app_apu)DRM_DEBUG_DRIVER ("No need to ioremap when real vram size is 0\n" ); - }else { - adev->mman.aper_base_kaddr =devm_ioremap_wc (adev->dev, - adev->gmc.aper_base, - adev->gmc.visible_vram_size); -if (!adev->mman.aper_base_kaddr) -return -ENOMEM ; - } + else +#endif + adev->mman.aper_base_kaddr =ioremap_wc (adev->gmc.aper_base, + adev->gmc.visible_vram_size);#endif /*
@@ -2050,6 +2044,8 @@ int amdgpu_ttm_init(struct amdgpu_device*/ void amdgpu_ttm_fini (struct amdgpu_device *adev) { +int idx; +if (!adev->mman.initialized)return ;
@@ -2072,7 +2068,14 @@ void amdgpu_ttm_fini(struct amdgpu_devicamdgpu_ttm_fw_reserve_vram_fini (adev);amdgpu_ttm_drv_reserve_vram_fini (adev); - adev->mman.aper_base_kaddr =NULL ; +if (drm_dev_enter (adev_to_drm (adev), &idx)) { + +if (adev->mman.aper_base_kaddr) +iounmap (adev->mman.aper_base_kaddr); + adev->mman.aper_base_kaddr =NULL ; + +drm_dev_exit (idx); + }amdgpu_vram_mgr_fini (adev);amdgpu_gtt_mgr_fini (adev);
Greg Kroah-Hartman
maintainerPATCH 128/156 xdp: reject clones that overrun skb_shared_info tailroom
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhiling Zou <[email protected]>
commit e48e8edbef2eb824201495daa5234560f632b23c upstream.
xdpf_clone() clones broadcast copies into a single page and sets frame_sz to PAGE_SIZE. __xdp_build_skb_from_frame() later treats that page like a normal XDP frame and expects the usual skb_shared_info tailroom at the end of the buffer.
The current check only rejects frames whose linear xdp_frame header, headroom, and packet data exceed PAGE_SIZE. A source frame backed by a larger allocation can still satisfy that check while extending into the clone's required shared-info area. When such a clone is converted back into an skb, build_skb_around() places skb_shared_info over live packet bytes and later writes can corrupt XDP return metadata.
Reject clones unless their linear area fits inside SKB_WITH_OVERHEAD(PAGE_SIZE), matching the tailroom requirement already enforced by the XDP-to-skb conversion path.
--- net/core/xdp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/core/xdp.c +1 -1
@@ -674,7 +674,7 @@ struct xdp_frame *xdpf_clone(struct xdp_ headroom = xdpf->headroom +sizeof (*xdpf); totalsize = headroom + xdpf->len; -if (unlikely (totalsize >PAGE_SIZE )) +if (unlikely (totalsize >SKB_WITH_OVERHEAD (PAGE_SIZE )))return NULL ; page =dev_alloc_page ();if (!page)
Greg Kroah-Hartman
maintainerPATCH 129/156 vxlan: do not arm the ageing timer on a device that is down
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baul Lee <[email protected]>
commit b37971686ec59fb027fa4910ba16805e68fddb97 upstream.
vxlan_changelink() arms vxlan->age_timer whenever the requested ageing interval differs from the configured one:
if (conf.age_interval != vxlan->cfg.age_interval) mod_timer(&vxlan->age_timer, jiffies);
There is no netif_running() test, so the timer is armed even on a device that was never brought up. The only synchronous cancel in the driver is the timer_delete_sync() in vxlan_stop(), which is .ndo_stop. netif_close_many() drops devices without IFF_UP before __dev_close_many() runs, so that cancel is skipped for such a device.
vxlan_setup() sets dev->needs_free_netdev = true and age_timer is a member of struct vxlan_dev, so free_netdev() releases the allocation the timer lives in while it is still queued on a timer_base. expire_timers() unlinks the entry before it loads timer->function, so the timer core writes through the freed object's list pointers:
BUG: KASAN: slab-use-after-free in __run_timers+0x208/0x654 Write of size 8 at addr ffff00001adace68 by task true/192 __asan_store8+0x84/0xac __run_timers+0x208/0x654 run_timer_softirq+0x154/0x18c Allocated by task 189: alloc_netdev_mqs+0x64/0x720 rtnl_create_link+0x4ac/0x520 rtnl_newlink+0x758/0xd00 Freed by task 191: netdev_release+0x40/0x58 netdev_run_todo+0x4a4/0x8c0 rtnl_dellink+0x200/0x4e8
The rtnl operations involved are netns-scoped, so an unprivileged user can perform them in a new user and network namespace.
Arming the timer on a down device never had an effect: vxlan_cleanup() returns early on !netif_running(), and vxlan_open() arms the timer for any non-zero interval once the device is brought up. Add the missing test.
Discovered by XBOW, triaged by Baul Lee <[email protected]>
--- drivers/net/vxlan/vxlan_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/vxlan/vxlan_core.c +1 -1
@@ -4338,7 +4338,7 @@ static int vxlan_changelink(struct net_dif (change_igmp &&vxlan_addr_multicast (&dst->remote_ip)) err =vxlan_multicast_leave (vxlan); -if (conf.age_interval != vxlan->cfg.age_interval) +if (netif_running (dev) && conf.age_interval != vxlan->cfg.age_interval)mod_timer (&vxlan->age_timer, jiffies);netdev_adjacent_change_commit (dst->remote_dev, lowerdev, dev);
Greg Kroah-Hartman
maintainerPATCH 130/156 vsock/virtio: read virtqueues under worker locks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <[email protected]>
commit ebac8f6b1ef0e9278afe204b8692a7479988dace upstream.
Commit bd50c5dc182b ("vsock/virtio: add support for device suspend/resume") made the *_run flags transition from false to true when restore installs replacement virtqueues. The RX, TX and event workers read their virtqueue before locking and checking the corresponding flag, so a worker delayed across freeze and restore can observe the replacement queue's running state while retaining a pointer to the deleted queue.
Read each virtqueue under its mutex after checking the run flag, keeping the pointer and state in the same queue generation.
--- net/vmw_vsock/virtio_transport.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
net/vmw_vsock/virtio_transport.c +6 -5
@@ -257,12 +257,13 @@ static void virtio_transport_tx_work(strstruct virtqueue *vq;bool added = false; - vq = vsock->vqs[VSOCK_VQ_TX ];mutex_lock (&vsock->tx_lock);if (!vsock->tx_run) goto out; + vq = vsock->vqs[VSOCK_VQ_TX ]; + do { struct sk_buff *skb; unsigned int len;
@@ -362,13 +363,13 @@ static void virtio_transport_event_work( container_of(work, struct virtio_vsock, event_work);struct virtqueue *vq; - vq = vsock->vqs[VSOCK_VQ_EVENT ]; -mutex_lock (&vsock->event_lock);if (!vsock->event_run) goto out; + vq = vsock->vqs[VSOCK_VQ_EVENT ]; + do { struct virtio_vsock_event *event; unsigned int len;
@@ -487,13 +488,13 @@ static void virtio_transport_rx_work(str container_of(work, struct virtio_vsock, rx_work);struct virtqueue *vq; - vq = vsock->vqs[VSOCK_VQ_RX ]; -mutex_lock (&vsock->rx_lock);if (!vsock->rx_run) goto out; + vq = vsock->vqs[VSOCK_VQ_RX ]; + do { virtqueue_disable_cb(vq); for (;;) {
Greg Kroah-Hartman
maintainerPATCH 131/156 vsock/virtio: avoid refilling the RX queue after teardown
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <[email protected]>
commit a31e0ad444698d8aa7534a0f89fda543730f97a5 upstream.
Commit b917507e5ad9 ("vsock/virtio: stop workers during the .remove()") made the RX worker jump to its common exit when rx_run is clear. That exit still refills the RX queue when the buffer count is low, so work queued across virtio_vsock_vqs_del() can add buffers after the virtqueues have been deleted.
BUG: KASAN: slab-use-after-free in virtqueue_add_sgs Read of size 4 by task kworker/0:1 Workqueue: virtio_vsock virtio_transport_rx_work Call Trace: virtqueue_add_sgs (drivers/virtio/virtio_ring.c:2796) virtio_vsock_rx_fill (net/vmw_vsock/virtio_transport.c:332) virtio_transport_rx_work (net/vmw_vsock/virtio_transport.c:701) process_one_work (kernel/workqueue.c:3314) worker_thread (kernel/workqueue.c:3478) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) ... Freed by task 141: kfree (mm/slub.c:6566) vp_del_vq (drivers/virtio/virtio_pci_common.c:259) vp_del_vqs (drivers/virtio/virtio_pci_common.c:285) virtio_vsock_freeze (net/vmw_vsock/virtio_transport.c:912) virtio_device_freeze (drivers/virtio/virtio.c:658) virtio_pci_freeze (drivers/virtio/virtio_pci_common.c:601) pci_pm_freeze (drivers/pci/pci-driver.c:1098) device_suspend (drivers/base/power/main.c:1968) Kernel panic - not syncing: KASAN: panic_on_warn set ...
Jump to a no-refill exit when rx_run is clear, leaving the normal exit to replenish a running queue.
--- net/vmw_vsock/virtio_transport.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/vmw_vsock/virtio_transport.c +2 -1
@@ -491,7 +491,7 @@ static void virtio_transport_rx_work(strmutex_lock (&vsock->rx_lock);if (!vsock->rx_run) - goto out; + goto out_nofill; vq = vsock->vqs[VSOCK_VQ_RX ];
@@ -539,6 +539,7 @@ static void virtio_transport_rx_work(str out:if (vsock->rx_buf_nr < vsock->rx_buf_max_nr /2 )virtio_vsock_rx_fill (vsock); +out_nofill:mutex_unlock (&vsock->rx_lock); }
Greg Kroah-Hartman
maintainerPATCH 132/156 veth: fix skb length accounting after XDP frag adjustment
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sun Jian <[email protected]>
commit cb6379feaaff11c4e1e79c26c745ffa23182768a upstream.
veth exposes non-linear skb fragments through an xdp_buff. If an XDP program adjusts the fragment area, veth_xdp_rcv_skb() copies xdp_frags_size back to skb->data_len but leaves skb->len containing the old fragment contribution.
After a fragment shrink, this makes skb_headlen() larger than the actual linear area. In the reproduced UDP receive path, __skb_datagram_iter() copied 1024 bytes past the actual linear tail to userspace, starting at struct skb_shared_info. The copied bytes included the affected skb's nr_frags, xdp_frags_size, and a kernel pointer from skb_shinfo(skb)->frags[0]. Real packet data was displaced by the same amount and truncated at the end.
Subtract the old data_len before replacing it and add the new data_len afterwards, keeping skb->len and skb->data_len synchronized.
Additionally, bpf_xdp_pull_data() can advance data_end while leaving frags present. The skb is then still non-linear, so the old __skb_put(skb, off) triggers SKB_LINEAR_ASSERT().
Use skb_set_tail_pointer() and update skb->len explicitly instead, following bpf_prog_run_generic_xdp(). Unlike __skb_put(), skb_set_tail_pointer() does not require a linear skb.
A 60000-byte UDP datagram on a veth pair with MTU 64000 was shortened by 1024 bytes from its fragment area. Before the fix, all 10 runs produced corrupted payloads. After the fix, all 10 runs matched the expected payload exactly. A forced-tailroom reproducer also exercises bpf_xdp_pull_data() with frags still present; the old code triggers SKB_LINEAR_ASSERT(), while this fix passes 10/10 runs.
--- drivers/net/veth.c | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-)
drivers/net/veth.c +14 -8
@@ -902,18 +902,24 @@ static struct sk_buff *veth_xdp_rcv_skb(skb_reset_mac_header (skb); -/* check if bpf_xdp_adjust_tail was used */ - off = xdp->data_end - orig_data_end; -if (off !=0 ) -__skb_put (skb, off);/* positive on grow, negative on shrink */ -/* XDP frag metadata (e.g. nr_frags) are updated in eBPF helpers -* (e.g. bpf_xdp_adjust_tail), we need to update data_len here. +* (e.g. bpf_xdp_adjust_tail). Remove the old fragment contribution +* from skb->len before updating data_len, then add the new one back. */ -if (xdp_buff_has_frags (xdp)) + skb->len -= skb->data_len; +if (xdp_buff_has_frags (xdp)) { skb->data_len =skb_shinfo (skb)->xdp_frags_size; -else + skb->len += skb->data_len; + }else { skb->data_len =0 ; + } + +/* Synchronize the skb tail with XDP's updated linear area. */ + off = xdp->data_end - orig_data_end; +if (off !=0 ) { +skb_set_tail_pointer (skb, xdp->data_end - xdp->data); + skb->len += off;/* positive on grow, negative on shrink */ + } skb->protocol =eth_type_trans (skb, rq->dev);
Greg Kroah-Hartman
maintainerPATCH 133/156 vhost: reset the vring metadata cache on vring reconfiguration
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jun Yang <[email protected]>
commit de845981da67a6b049080c87e605130b0c30adc5 upstream.
vq->meta_iotlb[] caches the vhost_iotlb_map that backs each vring metadata region, and iotlb_access_ok() returns early on a cache hit, taking the hit as proof that the region has already been validated:
if (vhost_vq_meta_fetch(vq, addr, len, type)) return true;
The cache is reset on VHOST_IOTLB_UPDATE and VHOST_IOTLB_INVALIDATE, on device IOTLB (re)initialisation and on vq reset, but not when VHOST_SET_VRING_ADDR replaces vq->desc, vq->avail and vq->used, nor when VHOST_SET_VRING_NUM changes the region sizes.
With a device IOTLB attached both ioctls are accepted while the vq is live, and neither validates the addresses at ioctl time: vq_access_ok() and vq_log_used_access_ok() return true early because the addresses are GIOVAs, deferring validation to prefetch time. Once the cache has been populated that deferred validation no longer runs -- vq_meta_prefetch() hits the stale entry and returns true -- and vhost_vq_meta_fetch() keeps translating through the old mapping as
map->addr + addr - map->start
for an address the mapping no longer covers. vhost_copy_to_user() and vhost_copy_from_user() consume the result with __copy_to_user() and __copy_from_user(), which do not check it either, so a subsequent used ring update or descriptor fetch accesses memory outside the region the IOTLB actually maps.
Reset the metadata cache whenever the vring is reconfigured, so the new addresses are pushed back through iotlb_access_ok()'s slow path.
Message-ID: <[email protected]>
--- drivers/vhost/vhost.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/vhost/vhost.c +8 -0
@@ -1937,6 +1937,14 @@ static long vhost_vring_set_num_addr(strBUG (); } +/* +* The metadata cache holds the IOTLB mapping that backed the previous +* desc/avail/used addresses and vring size, both of which are being +* replaced here. iotlb_access_ok() takes a cache hit as proof that the +* region was validated, so the stale entries have to go. +*/ +__vhost_vq_meta_reset (vq); +mutex_unlock (&vq->mutex);return r;
Greg Kroah-Hartman
maintainerPATCH 134/156 tls: dont leave a full plaintext sk_msg ring unpushed
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: chanyoung <[email protected]>
commit 7bca91d63341274e857f4aeaad54d229405e93dc upstream.
When the copy path in tls_sw_sendmsg_locked() adds the fragment that fills the plaintext sk_msg ring, it does not set full_record, so the record is left full and unpushed. A later splice() then adds to an already full
ring: sk_msg_page_add() has no fullness check of its own, so sg.end wraps onto sg.start and the ring appears empty. Fragments added after that overwrite live entries, and sg.size no longer matches what is reachable between sg.start and sg.end, so pushing the record runs the scatterwalk off the end of the scatterlist.
An unprivileged user can trigger this on a loopback TCP socket with the "tls" ULP attached:
BUG: kernel NULL pointer dereference, address: 0000000000000008 RIP: 0010:memcpy_from_scatterwalk+0x32/0xc0 Call Trace: skcipher_walk_next+0x1d1/0x2c0 gcm_encrypt_aesni_avx+0x1e9/0x220 bpf_exec_tx_verdict+0x3bb/0x860 tls_sw_sendmsg+0xa1a/0xca0 __sys_sendto+0x1da/0x1f0
Set full_record in the copy path when the ring becomes full, and push a record that is already full on entry to the sendmsg loop.
--- net/tls/tls_sw.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
net/tls/tls_sw.c +14 -0
@@ -1116,6 +1116,14 @@ static int tls_sw_sendmsg_locked(structif (!sk_stream_memory_free (sk)) goto wait_for_sndbuf; +/* open record may be full if we couldn't push it in the last sendmsg call */ +if (sk_msg_full (msg_pl)) { + full_record = true; +sk_msg_trim (sk, msg_en, + msg_pl->sg.size + prot->overhead_size); + goto copied; + } + alloc_encrypted: ret =tls_alloc_encrypted_msg (sk, required_size);if (ret) {
@@ -1216,6 +1224,12 @@ fallback_to_reg_send: msg_pl, try_to_copy);if (ret <0 ) goto trim_sgl; + +if (sk_msg_full (msg_pl)) { + full_record = true; +sk_msg_trim (sk, msg_en, + msg_pl->sg.size + prot->overhead_size); + } }/* Open records defined only if successfully copied, otherwise
Greg Kroah-Hartman
maintainerPATCH 135/156 tipc: read le->link under the node lock in tipc_node_link_down()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jun Yang <[email protected]>
commit cba9ccb47e9fa4cc77692fb896cc5ab57a667882 upstream.
tipc_node_link_down() caches the link pointer before taking n->lock:
struct tipc_link *l = le->link; /* unlocked */
if (!l)
return;
tipc_node_write_lock(n);
if (!tipc_link_is_establishing(l)) { /* deref l */
...
tipc_link_reset(l); /* write into l */
if (delete) {
kfree(l);
le->link = NULL;The delete=true caller frees that very object under n->lock, so the lock does not protect the cached pointer against it:
- CPU A, delete=false: tipc_rcv() on TIPC_LINK_DOWN_EVT, or the link supervision timer via tipc_node_timeout(), reads l unlocked and then dereferences it under n->lock;
- CPU B, delete=true: netlink TIPC_NL_BEARER_DISABLE -> bearer_disable() -> tipc_node_delete_links() -> tipc_node_link_down(n, bearer_id, true) -> kfree(l).
The link is freed with plain kfree(), not kfree_rcu(), and for UDP bearers disable_media() only schedules the asynchronous cleanup_bearer() work, so its synchronize_net() runs after the links are already gone. An in-flight CPU A that has read l therefore dereferences freed memory once B frees it:
a use-after-free read in tipc_link_is_establishing(), and a use-after-free write via tipc_link_reset() on the establishing branch.
The following trace was captured on 7.2.0-rc5-00284-gaf39eb111ce6:
BUG: KASAN: slab-use-after-free in tipc_link_is_establishing (net/tipc/link.c:285) Read of size 4 at addr ffff88802e2aa068 by task swapper/2/0 tipc_link_is_establishing (net/tipc/link.c:285) tipc_node_link_down (net/tipc/node.c:1076) tipc_node_timeout (net/tipc/node.c:843) Allocated by task 9549: tipc_link_create (net/tipc/link.c:490) tipc_node_check_dest (net/tipc/node.c:1279) tipc_disc_rcv (net/tipc/discover.c:252) tipc_udp_recv (net/tipc/udp_media.c:389) Freed by task 9549: tipc_node_link_down (net/tipc/node.c:1084) tipc_node_delete_links (net/tipc/node.c:1320) bearer_disable (net/tipc/bearer.c:414) __tipc_nl_bearer_disable (net/tipc/bearer.c:992)
Move the le->link read inside tipc_node_write_lock(), so it is serialised against the kfree() in the delete path. A racing teardown now either has not run yet, and we see a valid link, or has already run, and we see NULL.
--- net/tipc/node.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
net/tipc/node.c +10 -5
@@ -1063,18 +1063,23 @@ static void __tipc_node_link_down(structstatic void tipc_node_link_down (struct tipc_node *n,int bearer_id,bool delete) { -struct tipc_link_entry *le = &n->links[bearer_id];struct tipc_media_addr *maddr =NULL ; -struct tipc_link *l = le->link;int old_bearer_id = bearer_id; +struct tipc_link_entry *le;struct sk_buff_head xmitq; - -if (!l) -return ; +struct tipc_link *l;__skb_queue_head_init (&xmitq); +/* Synchronize the link lookup with bearer teardown. */ tipc_node_write_lock (n); + le = &n->links[bearer_id]; + l = le->link; +if (!l) { +tipc_node_write_unlock_fast (n); +return ; + } +if (!tipc_link_is_establishing (l)) {__tipc_node_link_down (n, &bearer_id, &xmitq, &maddr); }else {
Greg Kroah-Hartman
maintainerPATCH 136/156 smb: client: Fix use-after-free in cifs_try_adding_channels()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuangpeng Bai <[email protected]>
commit 4986410316b1ae0e63c6ce418e4eb196723626e7 upstream.
cifs_try_adding_channels() takes a temporary reference to an interface before dropping iface_lock. If cifs_ses_add_channel() fails, it drops that reference and then increments iface->weight_fulfilled.
A concurrent interface list refresh can remove the list reference while channel creation is in progress. In that case, the failure-path kref_put() releases the last reference and frees iface. Updating weight_fulfilled afterward then accesses freed memory.
Increment weight_fulfilled before dropping the temporary reference, keeping iface alive for the final access.
--- fs/smb/client/sess.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/smb/client/sess.c +1 -1
@@ -271,9 +271,9 @@ int cifs_try_adding_channels(struct cifscifs_dbg (VFS ,"failed to open extra channel on iface:%pIS rc=%d\n" , &iface->sockaddr, rc); -kref_put (&iface->refcount, release_iface);/* failure to add chan should increase weight */ iface->weight_fulfilled++; +kref_put (&iface->refcount, release_iface);continue ; }
Greg Kroah-Hartman
maintainerPATCH 137/156 KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit 5ec42d57655c690234c14aece6dd3f209778c1d8 upstream.
Explicitly clear role.invalid when deriving a child shadow page's role from its parent to harden against bugs elsewhere in KVM, as violating KVM's invariant that invalid pages are NOT on the list of active MMU pages leads to use-after-free due to __kvm_mmu_prepare_zap_page() using list_add() instead of list_move() when processing an invalid shadow page, i.e. makes a bad situation far worse.
Yell loudly if the parent is invalid, as it means KVM has missed a validity check, i.e. KVM is attempting to map memory using an invalid/obsolete root, but continue on as the child is otherwise still a valid shadow page.
==================================================================
BUG: KASAN: slab-use-after-free in __kvm_mmu_get_shadow_page+0x1817/0x1860 [kvm] Write of size 8 at addr ff11000153dd1368 by task repro/853 CPU: 1 UID: 1000 PID: 853 Comm: repro Not tainted 7.2.0-rc2-3aec122bdcaf-next-vm #5 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Call Trace: <TASK> dump_stack_lvl+0x4b/0x70 print_report+0x153/0x49c kasan_report+0xbc/0xf0 __kvm_mmu_get_shadow_page+0x1817/0x1860 [kvm] mmu_alloc_root+0x141/0x320 [kvm] kvm_mmu_load+0x612/0x20f0 [kvm] kvm_arch_vcpu_ioctl_run+0x3dd5/0x6150 [kvm] kvm_vcpu_ioctl+0x5e4/0x10d0 [kvm] __x64_sys_ioctl+0x131/0x1b0 do_syscall_64+0x67/0x5f0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK> Allocated by task 853: kasan_save_stack+0x20/0x40 kasan_save_track+0x14/0x30 __kasan_slab_alloc+0x5f/0x70 kmem_cache_alloc_noprof+0xfe/0x2e0 __kvm_mmu_topup_memory_cache+0x135/0x530 [kvm] paging64_page_fault+0x318/0x1e30 [kvm] kvm_mmu_do_page_fault+0x21d/0x630 [kvm] kvm_mmu_page_fault+0x18c/0x17b0 [kvm] kvm_arch_vcpu_ioctl_run+0x1f35/0x6150 [kvm] kvm_vcpu_ioctl+0x5e4/0x10d0 [kvm] __x64_sys_ioctl+0x131/0x1b0 do_syscall_64+0x67/0x5f0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Freed by task 853: kasan_save_stack+0x20/0x40 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x43/0x70 kmem_cache_free+0xe2/0x400 kvm_mmu_commit_zap_page.part.0+0x1e2/0x310 [kvm] kvm_mmu_free_roots+0x283/0x560 [kvm] kvm_arch_vcpu_ioctl_run+0x33c8/0x6150 [kvm] kvm_vcpu_ioctl+0x5e4/0x10d0 [kvm] __x64_sys_ioctl+0x131/0x1b0 do_syscall_64+0x67/0x5f0 entry_SYSCALL_64_after_hwframe+0x4b/0x53
--- arch/x86/kvm/mmu/mmu.c | 3 +++ 1 file changed, 3 insertions(+)
arch/x86/kvm/mmu/mmu.c +3 -0
@@ -2299,6 +2299,9 @@ static union kvm_mmu_page_role kvm_mmu_c role.direct = direct; role.passthrough =0 ; +WARN_ON_ONCE (role.invalid); + role.invalid =0 ; +/* * If the guest has 4-byte PTEs then that means it's using 32-bit, * 2-level, non-PAE paging. KVM shadows such guests with PAE paging
Greg Kroah-Hartman
maintainerPATCH 138/156 eventfs: Fix use-after-free in eventfs_remove_rec()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuangpeng Bai <[email protected]>
commit fd73b691702170d37d66f4b0278530cea8ed419a upstream.
eventfs_remove_rec() recursively removes the child at the current loop position. After the recursive call returns, list_for_each_entry() advances by reading list.next from the removed child.
If free_ei() drops the final reference, release_ei() reuses the list/rcu union to queue an SRCU callback. The child may be freed before that read. The eventfs_mutex serializes list updates, but it does not keep the removed child alive or prevent the SRCU callback from running.
Use list_for_each_entry_safe() to save the next sibling before recursively removing the current child.
--- fs/tracefs/event_inode.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/tracefs/event_inode.c +2 -2
@@ -922,7 +922,7 @@ struct eventfs_inode *eventfs_create_eve*/ static void eventfs_remove_rec (struct eventfs_inode *ei,int level) { -struct eventfs_inode *ei_child; +struct eventfs_inode *ei_child, *tmp;/* * Check recursion depth. It should never be greater than 3:
@@ -935,7 +935,7 @@ static void eventfs_remove_rec(struct evreturn ;/* search for nested folders or files */ -list_for_each_entry (ei_child, &ei->children, list) +list_for_each_entry_safe (ei_child, tmp, &ei->children, list)eventfs_remove_rec (ei_child, level +1 );list_del_rcu (&ei->list);