6.1.183-rc1 review
Greg Kroah-Hartman
maintainercover 6.1.183-rc1 review
This is the start of the stable review cycle for the 6.1.183 release. There are 609 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 19 Aug 2026 13:23:44 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.183-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.1.183-rc1
Ahmad Khalifa <[email protected]>
hwmon: (nct6775) Fix non-existent ALARM warning
Ahmad Khalifa <[email protected]>
hwmon: (nct6775) Fix register for nct6799
David Lechner <[email protected]>
regulator: devres: fix devm_regulator_get_enable_read_voltage() return
Xiang Mei (Microsoft) <[email protected]>
bpf: tcp: fix double sock release on batch realloc
Bryam Vargas <[email protected]>
thunderbolt: Bound the DROM dual link port number before indexing sw->ports
Qing Ming <[email protected]>
sctp: clear new_transport when removing a peer
Yuxiang Yang <[email protected]>
sctp: fix use-after-free of cached ASCONF chunk
Baul Lee <[email protected]>
sctp: keep chunk->transport in step with the list it is queued on
Xu Rao <[email protected]>
scsi: scsi_debug: Negate wrapped memcmp() result
Chengfeng Ye <[email protected]>
bpf, sockmap: Fix sk_redir use-after-free in send verdict
Tejun Heo <[email protected]>
sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
Zhiling Zou <[email protected]>
ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
Yuejie Shi <[email protected]>
ipv6: fix Route Information option length validation
Tengda Wu <[email protected]>
ring-buffer: Use current_context for safe per-CPU buffer swap
Ahmad Byagowi <[email protected]>
ptp: ocp: Fix board ID over-read
Rafael J. Wysocki <[email protected]>
Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
Sean Christopherson <[email protected]>
KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page
Shuangpeng Bai <[email protected]>
smb: client: Fix use-after-free in cifs_try_adding_channels()
Jun Yang <[email protected]>
tipc: read le->link under the node lock in tipc_node_link_down()
Jun Yang <[email protected]>
vhost: reset the vring metadata cache on vring reconfiguration
Weiming Shi <[email protected]>
vsock/virtio: avoid refilling the RX queue after teardown
Weiming Shi <[email protected]>
vsock/virtio: read virtqueues under worker locks
Baul Lee <[email protected]>
vxlan: do not arm the ageing timer on a device that is down
Zhiling Zou <[email protected]>
xdp: reject clones that overrun skb_shared_info tailroom
Hyunjung Ko <[email protected]>
net/sched: act_gact, act_police: range check the fallback control action
Yangyu Chen <[email protected]>
net: atlantic: free RX pages of consumed but not refilled buffers
Yangyu Chen <[email protected]>
net: atlantic: free stranded TX buffers on ring deinit
Zhiling Zou <[email protected]>
netfilter: bridge: release template ct on non-IP path
Kyle Zeng <[email protected]>
ipv6: prevent in6_dev_get() from resurrecting inet6_dev
Daming Li <[email protected]>
net: smc: fix splice entry lifetime imbalance in smc_rx_splice
Rik van Riel <[email protected]>
fbdev: bitblit: bound-check glyph index in bit_cursor()
Michael Wu <[email protected]>
tracing: Fix race between update_event_fields and, event_define_fields
Baul Lee <[email protected]>
ALSA: usx2y: bound the hwdep mmap fault offset
Hui Su <[email protected]>
ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
Eddie Lin <[email protected]>
misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
Anandu Krishnan E <[email protected]>
misc: fastrpc: fix channel ctx ref leak when session alloc fails
Mariano Baragiola <[email protected]>
staging: rtl8723bs: validate monitor transmit frame lengths
Panagiotis Petrakopoulos <[email protected]>
staging: rtl8723bs: fix missing shared-key auth challenge length check
Muhammad Bilal <[email protected]>
staging: rtl8723bs: fix OOB read in WMM_param_handler()
Muhammad Bilal <[email protected]>
staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
Cunhao Lu <[email protected]>
serial: 8250_dma: Clear stale RX state on shutdown
Chengfeng Ye <[email protected]>
ipv4: fix use-after-free in fib_nhc_update_mtu()
Zihan Xi <[email protected]>
ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
Michal Luczaj <[email protected]>
selftests/bpf: Fail unbound UDP on sockmap update
Michal Luczaj <[email protected]>
selftests/bpf: Adapt sockmap update error handling
Eric Biggers <[email protected]>
fscrypt: Replace mk_users keyring with simple list
Zhu Yanjun <[email protected]>
RDMA/rxe: Fix a use-after-free problem in rxe_mmap
Claudiu Beznea <[email protected]>
pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP
Nathan Chancellor <[email protected]>
fortify: Disable -Wstringop-overread in tests
Masahiro Yamada <[email protected]>
fortify: refactor test_fortify Makefile to fix some build problems
Keno Fischer <[email protected]>
futex: Prevent robust futex exit race some more
Baul Lee <[email protected]>
net: bridge: mrp: fix uninitialised bytes on the wire
Chengfeng Ye <[email protected]>
netfilter: ebt_nflog: pin the NFLOG backend
Qihang Tang <[email protected]>
net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
Sergey V. Frolov <[email protected]>
net: octeontx2-pf: Fix UB in shift operation
Zijie Huang <[email protected]>
net/sched: reject overly deep qdisc hierarchies
Zhiling Zou <[email protected]>
net: openvswitch: reallocate update replies for mismatched IDs
Doruk Tan Ozturk <[email protected]>
net/packet: reset the MAC header on the packet-socket transmit path
Kyle Zeng <[email protected]>
ipvs: clear IPv4 options after rebasing tunnel ICMP errors
Julian Anastasov <[email protected]>
ipvs: properly update the overload flag on dest edit
Julian Anastasov <[email protected]>
ipvs: add totalconns for dest
Lincoln Wallace <[email protected]>
ima: fix out-of-bounds read in xattr_verify()
Dmitry Torokhov <[email protected]>
Input: evdev - fix information leak in evdev_pass_values()
Joshua Rogers <[email protected]>
vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
Joshua Rogers <[email protected]>
vt: add permission check for KDSKBMETA ioctl
Yi Cong <[email protected]>
net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()
Sonali Pradhan <[email protected]>
usb: gadget: f_ncm: Use unsigned int for ndp_index
Pawel Laszczak <[email protected]>
usb: cdnsp: fix incorrect endian conversions for APB timeout register
Xu Rao <[email protected]>
thunderbolt: icm: Preserve USB4 proxy data-valid bit
Aleksandr Nogikh <[email protected]>
usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
Baul Lee <[email protected]>
ALSA: usb-audio: fix OOB write on Type II inbound URBs
Dmitry Torokhov <[email protected]>
Input: evdev - sanitize event type index when fetching event masks
Larisa Grigore <[email protected]>
spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers
Sean Christopherson <[email protected]>
KVM: x86: Check for invalid/obsolete root *after* making MMU pages available
David Matlack <[email protected]>
KVM: x86/mmu: Rename __direct_map() to direct_map()
Qingshuang Fu <[email protected]>
hwmon: (ads7828) Fix external VREF regulator handling
David Lechner <[email protected]>
regulator: devres: add API for reference voltage supplies
Wilken Gottwalt <[email protected]>
hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination
Maximilian Immanuel Brandtner <[email protected]>
tls: don't abort the connection on signal-interrupted sends
Xin Long <[email protected]>
sctp: clear control chunk transport if it is being removed
Eric Dumazet <[email protected]>
net/atm: fix slab-out-of-bounds read in vcc_setsockopt()
Hongyan Xu <[email protected]>
ata: pata_sl82c105: fix bridge revision use-after-free
Fan XinRan <[email protected]>
net: thunderbolt: Tear down DMA paths before stopping the rings
Łukasz Patron <[email protected]>
net: qrtr: ns: Raise lookup limit to 128
Sidraya Jayagond <[email protected]>
net/smc: fix TOCTOU race between smc_listen_out() and listener close
Eric Dumazet <[email protected]>
net: remove WARN_ON_ONCE() from sk_mc_loop()
Pengpeng Hou <[email protected]>
net: prestera: validate firmware header length
Henry Martin <[email protected]>
net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
Jiayuan Chen <[email protected]>
tcp: fix TFO max_qlen accounting across reuseport migration
Qing Luo <[email protected]>
sctp: fix addip_serial increment on ASCONF_ACK allocation failure
Keegan Freyhof <[email protected]>
bnxt_en: Fix PTP PPS setting bug
Michael Chan <[email protected]>
bnxt_en: Disable EOP for TPA on all chips to prevent data corruption
Michael Chan <[email protected]>
bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips
Martin Kaiser <[email protected]>
selftests/ftrace: refactor eprobes test to fix argument checks
Guenter Roeck <[email protected]>
hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations
Rob Herring <[email protected]>
hwmon: (lm25066) Use i2c_get_match_data()
Qingshuang Fu <[email protected]>
hwmon: (nzxt-smart2) Check return value of init_device() in probe
Cen Zhang (Microsoft) <[email protected]>
net/openvswitch: check Ethernet header length in key_extract()
Toke Høiland-Jørgensen <[email protected]>
net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter
Xuanqiang Luo <[email protected]>
udp: fix potential use-after-free in tunnel segmentation
Yousef Alhouseen <[email protected]>
vhost/vdpa: reject overflowing PA map page counts on 32-bit
Jose Fernandez (Anthropic) <[email protected]>
bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
Jordan Rife <[email protected]>
bpf: tcp: Avoid socket skips and repeats during iteration
Jordan Rife <[email protected]>
bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items
Jordan Rife <[email protected]>
bpf: tcp: Get rid of st_bucket_done
Jordan Rife <[email protected]>
bpf: tcp: Make sure iter->batch always contains a full bucket snapshot
Jordan Rife <[email protected]>
bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch
Jian Wen <[email protected]>
tcp: add a scheduling point in established_get_first()
Babanpreet Singh <[email protected]>
counter: microchip-tcb-capture: Fix DT channel validation
Michael Guralnik <[email protected]>
net/mlx5: fw_tracer, return NULL on create error
Jiawen Liu <[email protected]>
net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete
Jamal Hadi Salim <[email protected]>
net/sched: cls_route: fix fastmap use-after-free on filter
Mahanta Jambigi <[email protected]>
net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()
Yiyang Chen <[email protected]>
bpf: Preserve pointer state for commuted arithmetic
Dmitry Antipov <[email protected]>
btrfs: fix memory leak in btrfs_do_encoded_write()
Julian Anastasov <[email protected]>
ipvs: return the csum validation for forward hook
Julian Anastasov <[email protected]>
ipvs: avoid out-of-bounds write in ip_vs_nat_icmp
Jozsef Kadlecsik <[email protected]>
netfilter: ipset: switch ext_size to atomic64_t
Xiang Mei (Microsoft) <[email protected]>
bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
Fan Ye <[email protected]>
Revert "net: thunderbolt: Enable end-to-end flow control also in transmit"
Yuho Choi <[email protected]>
ARM: npcm: Fix OF node refcount leaks in SMP setup
Anna Schumaker <[email protected]>
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
Harald Freudenberger <[email protected]>
s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()
Al Viro <[email protected]>
mount: honour SB_NOUSER in the new mount API
David Carlier <[email protected]>
Bluetooth: hci_conn: fix potential UAF in create_big_sync
Luiz Augusto von Dentz <[email protected]>
Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
Marco Elver <[email protected]>
Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
Junjie Cao <[email protected]>
gpio: pch: use raw_spinlock_t for the register lock
Tze Yee Ng <[email protected]>
firmware: stratix10-svc: fix memory leaks and list corruption bugs
Ilya Maximets <[email protected]>
net: openvswitch: fix skb leak on flow key update failure during recirculation
Kiryl Shutsemau (Meta) <[email protected]>
mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios
Kiryl Shutsemau (Meta) <[email protected]>
mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()
Niklas Cassel <[email protected]>
ata: ahci: Make ahci_ignore_port() handle empty mask_port_map
Damien Le Moal <[email protected]>
ata: libahci_platform: Do not set mask_port_map when not needed
HyeongJun An <[email protected]>
HID: logitech-dj: Fix maxfield check in DJ short report validation
Zack Rusin <[email protected]>
drm/vmwgfx: bound DMA command body size against suffix pointer
Zack Rusin <[email protected]>
drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
Zack Rusin <[email protected]>
drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
William Palacek <[email protected]>
drm/amdkfd: hold event_mutex while checkpointing CRIU events
David Francis <[email protected]>
drm/amdkfd: Handle invalid event type in CRIU event restore
Harkirat Gill <[email protected]>
drm/amdgpu: cap GTT size to physical RAM on APUs
Candice Li <[email protected]>
drm/amdgpu: restore UMD profile pstate after runtime resume
Maíra Canal <[email protected]>
drm/vc4: Zero the tile state data array before each BIN job
Jose Maria Casanova Crespo <[email protected]>
drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size
Alexander Kaplan <[email protected]>
drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs
Avi Weiss <[email protected]>
can: ctucanfd: mark error-active controller status valid
Avi Weiss <[email protected]>
can: ctucanfd: handle bus error interrupts
Avi Weiss <[email protected]>
can: ctucanfd: unmap BAR0 using base address
Avi Weiss <[email protected]>
can: ctucanfd: use self-test mode for PRESUME_ACK
Pengpeng Hou <[email protected]>
can: ctucanfd: add missing MODULE_DEVICE_TABLE()
Pengpeng Hou <[email protected]>
can: peak_usb: validate uCAN receive record lengths
Maoyi Xie <[email protected]>
can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error
James Gao <[email protected]>
can: peak_usb: add bounds check for USB channel index
Pengpeng Hou <[email protected]>
can: softing: fw_parse(): validate firmware record spans
Pengpeng Hou <[email protected]>
can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents
Abdun Nihaal <[email protected]>
can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams()
Tetsuo Handa <[email protected]>
can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking
Oleksij Rempel <[email protected]>
can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer
Guangshuo Li <[email protected]>
can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure
Pengpeng Hou <[email protected]>
can: ems_usb: validate CPC message lengths
Lucas Martins Alves <[email protected]>
can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured
Liem <[email protected]>
i2c: imx: Cancel hrtimer before clearing slave pointer
Liem <[email protected]>
i2c: imx: Fix slave registration race and error handling
H. Nikolaus Schaller <[email protected]>
i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock
Aaron Ma <[email protected]>
ice: wait for reset completion in ice_resume()
Ilya Maximets <[email protected]>
net: openvswitch: fix skb leak on flow key update failure during ct
Ilya Maximets <[email protected]>
net: openvswitch: fix potential UAF on meter attach failure
Nava kishore Manne <[email protected]>
phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB
Nava kishore Manne <[email protected]>
phy: zynqmp: use read-modify-write for SERDES scrambler bypass
Nava kishore Manne <[email protected]>
phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask
Holger Dengler <[email protected]>
s390/zcrypt: Validate length for CCA ECC private key requests
Holger Dengler <[email protected]>
s390/zcrypt: Validate length for CCA AES cipher key requests
Harald Freudenberger <[email protected]>
s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs
Jan Höppner <[email protected]>
s390/dasd: Fix potential NULL pointer dereference
Aswin Karuvally <[email protected]>
s390/qeth: Check CAP_NET_ADMIN for private ioctls
Xu Rao <[email protected]>
power: supply: bq25890: fix the -10 C NTC lookup entry
Abdun Nihaal <[email protected]>
cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()
bui duc phuc <[email protected]>
gpio: pca953x: fix cache_only and IRQ state on restore_context() failure
Myeonghun Pak <[email protected]>
i2c: amd-mp2: Unregister callback on adapter add failure
Hongyan Xu <[email protected]>
hwmon: (npcm750-pwm-fan): stop fan timer on device detach
Asim Viladi Oglu Manizada <[email protected]>
sctp: prevent peer transport count overflow
Yuxiang Yang <[email protected]>
sctp: reject stale cookies with mismatched verification tags
Ibrahim Hashimov <[email protected]>
scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write
Chris Gellermann <[email protected]>
selftests/clone3: fix wild pointer access of getline due to missing init
Masami Hiramatsu (Google) <[email protected]>
tracing/filters: Fix false positive match in regex_match_full()
Masami Hiramatsu (Google) <[email protected]>
tracing: Check return value of __register_event() in trace_module_add_events()
Ming Lei <[email protected]>
ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()
Eric Dumazet <[email protected]>
vxlan: use pskb_network_may_pull() in route_shortcircuit()
Eric Dumazet <[email protected]>
vxlan: use neigh_ha_snapshot() in route_shortcircuit()
Eric Dumazet <[email protected]>
vxlan: unclone skb head before modifying eth header in route_shortcircuit()
Eric Dumazet <[email protected]>
vxlan: re-fetch eth header after route_shortcircuit()
Michael Bommarito <[email protected]>
um: vector: fix use-after-free in vector_mmsg_rx()
Thorsten Blum <[email protected]>
powerpc/ps3: Fix map failure path in dma_ioc0_map_pages()
Zhiling Zou <[email protected]>
net: ipv6: clear suppressed fib6 rule result
Zhiling Zou <[email protected]>
net: bridge: stop fast-leave after deleting a port group
Link Lin <[email protected]>
mm/page_reporting: use system_freezable_wq to fix UAF during suspend
Christian Brauner <[email protected]>
binfmt_misc: reject a flag character as the field delimiter
Zhao Li <[email protected]>
wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames
Zihan Xi <[email protected]>
tipc: avoid use-after-free in poll trace queue dumps
David Lee <[email protected]>
netfilter: ipset: do not update comments from kernel-side hash adds
Xuanqiang Luo <[email protected]>
net/smc: fix socket use-after-free during link group termination
Zhiling Zou <[email protected]>
ipvs: do not propagate one-packet flag to synced conns
Matt Vollrath <[email protected]>
igbvf: Fix leak in TX DMA error cleanup
Dawei Feng <[email protected]>
e1000: fix memory leak in e1000_probe()
Md Sadre Alam <[email protected]>
dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+
Sonali Pradhan <[email protected]>
ALSA: usb-audio: Clamp frame size in implicit-feedback mode
Sonali Pradhan <[email protected]>
ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set
Baul Lee <[email protected]>
ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()
Haidar Lee <[email protected]>
ASoC: tas2562: fix broken entries in the volume lookup table
Haidar Lee <[email protected]>
ASoC: tas2562: fix DVC coefficient write order
Norbert Szetei <[email protected]>
ALSA: pcm: wake linked drain waiters on unlink
Xu Rao <[email protected]>
ALSA: lx6464es: fix period byte count for 16-bit streams
Takashi Iwai <[email protected]>
ALSA: 6fire: Fix UAF at error handling during probe
Xuanqiang Luo <[email protected]>
bpf: lwt: Fix dst reference leak on reroute failure
Sangho Lee <[email protected]>
Bluetooth: HIDP: validate numbered report payloads
Sangho Lee <[email protected]>
Bluetooth: HIDP: reject frames without a transaction header
Luxiao Xu <[email protected]>
audit: fix potential use-after-free in audit_del_rule()
Zhan Xusheng <[email protected]>
audit: fix potential integer overflow in audit_log_n_string()
Charles Vosburgh <[email protected]>
sctp: validate Adaptation Indication parameter length
Farhan Ali <[email protected]>
KVM: s390: pci: Validate AIBV and AISB before pinning guest pages
Farhan Ali <[email protected]>
KVM: s390: pci: Fix NULL dereference on AIBV allocation failure
Farhan Ali <[email protected]>
KVM: s390: pci: Reject adapter interrupt forwarding if already enabled
Sean Christopherson <[email protected]>
KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active
Xiangfeng Cai <[email protected]>
mm/hugetlb: fix list corruption in allocate_file_region_entries()
Zi Yan <[email protected]>
mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()
Benjamin Boortz <[email protected]>
pinctrl: bm1880: add missing select GENERIC_PINCONF
Karl Mehltretter <[email protected]>
pinctrl: devicetree: don't free uninitialized dev_name on error path
Benjamin Boortz <[email protected]>
pinctrl: microchip-sgpio: add missing select REGMAP_MMIO
Cen Zhang (Microsoft) <[email protected]>
rhashtable: clear stale iter->p on table restart
Kuniyuki Iwashima <[email protected]>
af_unix: Give up GC if MSG_PEEK intervened.
Pengfei Zhang <[email protected]>
ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump
Namjae Jeon <[email protected]>
ksmbd: fix use-after-free in __close_file_table_ids()
Namjae Jeon <[email protected]>
ksmbd: return success for deferred final close
Denis V. Lunev <[email protected]>
qede: sync udp_tunnel ports outside qede_lock in the recovery path
Suman Ghosh <[email protected]>
octeontx2-pf: Set correct sequence for carrier off and tx queue stop
Masami Hiramatsu (Google) <[email protected]>
tracing/mmiotrace: Reset dropped_count in mmio_reset_data()
Minhong He <[email protected]>
can: isotp: check register_netdevice_notifier() error in module init
Chenguang Zhao <[email protected]>
net: sxgbe: check descriptor ring allocation failures
Chenguang Zhao <[email protected]>
net: sxgbe: free TX rings on RX allocation failure
Leon Romanovsky <[email protected]>
scsi: target: Clear cmd_cnt when initial counter enrollment fails
Benjamin Block <[email protected]>
scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req
Christian Marangi <[email protected]>
net: phylink: put link_gpio if phylink_create fails
Jiale Yao <[email protected]>
Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp
Guenter Roeck <[email protected]>
hwmon: (pmbus) Fix return value from pmbus_update_byte_data()
Zhao Li <[email protected]>
wifi: mac80211: validate individual TWT params before driver setup
Thorsten Blum <[email protected]>
powerpc/boot: Fix treeboot-akebono CPU node lookup check
Thorsten Blum <[email protected]>
powerpc/boot: Fix treeboot-currituck CPU node lookup check
Thorsten Blum <[email protected]>
powerpc/boot: Fix simpleboot CPU node lookup check
Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix PWM auto temp state array and bounds check
Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read
Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Use cached PWM frequency value
Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks
Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read()
Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread
Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix cache updated before hardware write on I2C error
Luiz Angelo Daros de Luca <[email protected]>
hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors
Chenguang Zhao <[email protected]>
forcedeth: fix UAF of txrx_stats in nv_remove
David Corvaglia <[email protected]>
net: bridge: mrp: fix Option TLV length in MRP_Test frames
Guenter Roeck <[email protected]>
hwmon: (nct6775-core) Prevent access to unsupported weight registers
Eric Dumazet <[email protected]>
net: do not send ICMP/NDISC Redirects when peer allocation fails
Guenter Roeck <[email protected]>
hwmon: (nzxt-smart2) DMA-align output buffer
Guenter Roeck <[email protected]>
hwmon: (lm90) Only report alarms if driver is ready
Guenter Roeck <[email protected]>
hwmon: (nct6775-core) Fix number of temperature registers for NCT6116
Guenter Roeck <[email protected]>
hwmon: (nct6775) Fix access to temperature configuration registers
Ahmad Khalifa <[email protected]>
hwmon: (nct6775) Additional TEMP registers for nct6799
Ahmad Khalifa <[email protected]>
hwmon: (nct6775) Add support for 18 IN readings for nct6799
Ahmad Khalifa <[email protected]>
hwmon: (nct6775) Increase and reorder ALARM/BEEP bits
Ahmad Khalifa <[email protected]>
hwmon: (nct6775) Fix IN scaling factors for 6798/6799
Guenter Roeck <[email protected]>
hwmon: (nct6755) Add support for NCT6799D
Dawei Feng <[email protected]>
smb: client: fix buffer leaks in SMB1 read and write
Xingui Yang <[email protected]>
scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race
John Garry <[email protected]>
scsi: libsas: Delete struct scsi_core
Jason Yan <[email protected]>
scsi: libsas: Abort all in-flight requests when device is gone
HyeongJun An <[email protected]>
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer
HyeongJun An <[email protected]>
scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer
Mario Limonciello <[email protected]>
pinctrl-amd: Don't clear S4 wake bits at probe
Xiang Mei <[email protected]>
rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()
Ilia Gavrilov <[email protected]>
rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled
Xiang Mei (Microsoft) <[email protected]>
netfilter: nft_payload: fix mask build for partial field offload
Julian Anastasov <[email protected]>
ipvs: do not mangle ICMP replies for non-first fragments
Julian Anastasov <[email protected]>
ipvs: fix places with wrong packet offsets
Julian Anastasov <[email protected]>
ipvs: fix the checksum validations
Eric Dumazet <[email protected]>
ipv6: introduce dst_rt6_info() helper
Pablo Neira Ayuso <[email protected]>
netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH
Michael Bommarito <[email protected]>
assoc_array: trim the final shortcut word using the current chunk end
Michael Bommarito <[email protected]>
keys: make keyring key-chunk byte order agree with keyring_diff_objects()
Michael Bommarito <[email protected]>
keys: fix out-of-bounds read in keyring_get_key_chunk()
Ruoyu Wang <[email protected]>
drm/mediatek: Check CRTC state before freeing
Xiang Mei <[email protected]>
netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()
Radhey Shyam Pandey <[email protected]>
phy: zynqmp: fix runtime PM leak on probe allocation failure
Radhey Shyam Pandey <[email protected]>
phy: zynqmp: fix clock error handling in xpsgtr_phy_init()
Mike Looijmans <[email protected]>
phy-zynqmp: Postpone getting clock rate until actually needed
Sean Anderson <[email protected]>
phy: zynqmp: Allow variation in refclk rate
Uday Khare <[email protected]>
ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup
Uday Khare <[email protected]>
ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup
Radhey Shyam Pandey <[email protected]>
ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources()
Damien Le Moal <[email protected]>
ahci: Introduce ahci_ignore_port() helper
Josua Mayer <[email protected]>
ata: libahci_platform: support non-consecutive port numbers
Rosen Penev <[email protected]>
ata: sata_mv: accept 1 or 2 resources in platform probe
Hongling Zeng <[email protected]>
dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA
Konrad Dybcio <[email protected]>
pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151
Youssef Samir <[email protected]>
net: qrtr: ns: Raise node count limit to 512
Manivannan Sadhasivam <[email protected]>
net: qrtr: ns: Limit the maximum server registration per node
Benjamin Tissoires <[email protected]>
HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report
Lee Jones <[email protected]>
HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write
Lee Jones <[email protected]>
HID: logitech-dj: Standardise hid_report_enum variable nomenclature
Eddie Phillips <[email protected]>
gve: fix Rx queue stall on alloc failure
Ricardo Ribalda <[email protected]>
media: uvcvideo: Fix sequence number when no EOF
Isaac Scott <[email protected]>
media: uvcvideo: Implement dual stream quirk to fix loss of usb packets
Yehyeong Lee <[email protected]>
net: mpls: initialize rtm_tos in mpls_getroute()
Lorenzo Bianconi <[email protected]>
netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge()
Pablo Neira Ayuso <[email protected]>
netfilter: nf_conntrack_expect: restore helper propagation via expectation
SJ Park <[email protected]>
mm/damon/core: disallow overlapping input ranges for damon_set_regions()
SJ Park <[email protected]>
mm/damon/core: validate ranges in damon_set_regions()
Yitang Yang <[email protected]>
io_uring/rw: fix missing ERESTARTSYS conversion in read paths
Nikunj A Dadhania <[email protected]>
KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug
Wentao Guan <[email protected]>
bpf: drop bpf_lsm_getselfattr from hook list
Namjae Jeon <[email protected]>
exfat: validate cluster allocation bits of the allocation bitmap
Eric Biggers <[email protected]>
fscrypt: Avoid dynamic allocation in fscrypt_get_devices()
Kyle Zeng <[email protected]>
openvswitch: fix GSO userspace truncation underflow
Weiming Shi <[email protected]>
tipc: fix use-after-free of the discoverer in tipc_disc_rcv()
Weiming Shi <[email protected]>
ipv6: ndisc: fix NULL deref in accept_untracked_na()
Jacob Keller <[email protected]>
i40e: remove read access to debugfs files
Xie Bo <[email protected]>
RISC-V: KVM: Serialize virtual interrupt pending state updates
Ce Sun <[email protected]>
drm/amdgpu: invoke pm_genpd_remove() before freeing genpd
Boyuan Zhang <[email protected]>
drm/amdgpu: fix division by zero with invalid uvd dimensions
Boyuan Zhang <[email protected]>
drm/amdgpu/vce: fix integer overflow in image size
Alex Deucher <[email protected]>
drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()
Alex Deucher <[email protected]>
drm/amdgpu/gfx8: drop unecessary BUG_ON()
Alex Deucher <[email protected]>
drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON()
Alex Deucher <[email protected]>
drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON()
Yang Wang <[email protected]>
drm/amd/pm: make pp_features read-only when scpm is enabled
Daehyeon Ko <[email protected]>
tipc: clear sock->sk on the failed-insert path in tipc_sk_create()
Asim Viladi Oglu Manizada <[email protected]>
pppoe: reload header pointer after dev_hard_header()
Doruk Tan Ozturk <[email protected]>
mctp: serial: handle zero-length frames to prevent rx buffer overflow
Doruk Tan Ozturk <[email protected]>
mac802154: llsec: reject frames shorter than the authentication tag
Michael Bommarito <[email protected]>
ila: reload IPv6 header after pskb_may_pull in checksum adjust
Sergey Temerkhanov <[email protected]>
ice: use READ_ONCE() to access cached PHC time
James Montgomery <[email protected]>
ksmbd: defer destroy_previous_session() until after NTLM authentication
Raphael Zimmer <[email protected]>
rbd: Reset positive result codes to zero in object map update path
Jann Horn <[email protected]>
proc: Fix broken error paths for namespace links
Fan Wu <[email protected]>
net: hip04: fix RX buffer leak on build_skb failure
David Lee <[email protected]>
net/x25: fix use-after-free in x25_kill_by_neigh()
Bryam Vargas <[email protected]>
net/iucv: fix use-after-free of a severed iucv_path
Hidayath Khan <[email protected]>
net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()
Doruk Tan Ozturk <[email protected]>
geneve: require CAP_NET_ADMIN in the device netns for changelink
Sungmin Kang <[email protected]>
net: slip: serialize receive against buffer reallocation
Doruk Tan Ozturk <[email protected]>
vxlan: require CAP_NET_ADMIN in the device netns for changelink
Breno Leitao <[email protected]>
phonet: pep: fix use-after-free in pep_get_sb()
Lu Baolu <[email protected]>
iommu/vt-d: Disallow SVA if page walk is not coherent
Tengda Wu <[email protected]>
ftrace: Add global mutex to serialize trace_parser access
Eric Biggers <[email protected]>
fscrypt: Add missing superblock check in find_or_insert_direct_key()
Christian Brauner <[email protected]>
binfmt_elf_fdpic: only honour the first PT_INTERP
Douya Le <[email protected]>
libceph: remove debugfs files before client teardown
Douya Le <[email protected]>
libceph: reject zero bucket types in crush_decode
Raphael Zimmer <[email protected]>
libceph: Reject monmaps advertising zero monitors
Shuangpeng Bai <[email protected]>
libceph: refresh auth->authorizer_buf{,_len} after authorizer updateZhao Zhang <[email protected]>
libceph: guard missing CRUSH type name lookup
Raphael Zimmer <[email protected]>
libceph: Fix multiplication overflow in decode_new_up_state_weight()
Douya Le <[email protected]>
libceph: bound get_version reply decode to front len
Bryam Vargas <[email protected]>
ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()
Jun Yang <[email protected]>
sctp: don't free the ASCONF's own transport in DEL-IP processing
Michael Bommarito <[email protected]>
mptcp: only set DATA_FIN when a mapping is present
Chenguang Zhao <[email protected]>
mptcp: decrement subflows counter on failed passive join
Will Deacon <[email protected]>
Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates"
Will Deacon <[email protected]>
arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates
Masami Hiramatsu (Google) <[email protected]>
tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err()
Masami Hiramatsu (Google) <[email protected]>
tracing/probes: Fix potential underflow in LEN_OR_ZERO macro
Masami Hiramatsu (Google) <[email protected]>
tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args()
Masami Hiramatsu (Google) <[email protected]>
tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match()
deepakraog <[email protected]>
tracing: Fix resource leak on mmiotrace trace_pipe close
Steven Rostedt <[email protected]>
tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev
Guangshuo Li <[email protected]>
intel_th: fix MSC output device reference leak
Jiangshan Yi <[email protected]>
serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms
Hugo Villeneuve <[email protected]>
serial: sc16is7xx: implement gpio get_direction() callback
Ian Abbott <[email protected]>
comedi: comedi_parport: deal with premature interrupt
Nathan Chancellor <[email protected]>
x86/boot/compressed: Disable jump tables
Xu Rao <[email protected]>
cdrom: fix stack out-of-bounds read in CDROMVOLCTRL
Zixing Liu <[email protected]>
platform/loongarch: laptop: Explicitly reset bl_powered state when suspend
Christian Brauner <[email protected]>
binfmt_misc: set have_execfd only once the interpreter is opened
Christian Brauner <[email protected]>
exec: fix unsigned loop counter wrap in transfer_args_to_stack()
Chengfeng Ye <[email protected]>
Bluetooth: RFCOMM: Fix session UAF in set_termios
Chengfeng Ye <[email protected]>
Bluetooth: hci_sync: Protect UUID list traversal
MinJea Kim <[email protected]>
staging: rtl8723bs: fix inverted HT40 secondary channel offset
Moksh Panicker <[email protected]>
staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()
Fan Wu <[email protected]>
wifi: brcmfmac: make release_scratchbuffers idempotent
Devin Wittmayer <[email protected]>
wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses
Devin Wittmayer <[email protected]>
wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses
Huihui Huang <[email protected]>
wifi: wilc1000: validate assoc response length before subtracting header
Doruk Tan Ozturk <[email protected]>
wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper
Tristan Madani <[email protected]>
wifi: ath6kl: fix OOB access from firmware ADDBA window size
Norbert Szetei <[email protected]>
ALSA: seq: close a re-opened queue timer in the destructor
Johan Hovold <[email protected]>
media: vpif_capture: fix OF node reference imbalance
Hans Verkuil <[email protected]>
media: vivid: check for vb2_is_busy() when toggling caps
Hans Verkuil <[email protected]>
media: vivid: add vivid_update_reduced_fps()
Guangshuo Li <[email protected]>
media: vimc: fix reference leak on failed device registration
Guangshuo Li <[email protected]>
media: vidtv: fix reference leak on failed device registration
Zile Xiong <[email protected]>
media: vb2: use ssize_t for vb2_read/vb2_write
Pengpeng Hou <[email protected]>
media: v4l2-ctrls: validate HEVC active reference counts
Sergey Shtylyov <[email protected]>
media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete()
Myeonghun Pak <[email protected]>
media: ti: vpe: unwind v4l2 device registration on probe error
Hungyu Lin <[email protected]>
media: tegra-video: vi: fix invalid u32 return value in format lookup
Valery Borovsky <[email protected]>
media: sun4i-csi: Return queued buffers on start_streaming() failure
Myeonghun Pak <[email protected]>
media: stm32: dcmi: unregister notifier on probe failure
Ma Ke <[email protected]>
media: saa7134: Fix a possible memory leak in saa7134_video_init1
Valery Borovsky <[email protected]>
media: rtl2832_sdr: Return queued buffers on start_streaming() failure
Deepanshu Kartikey <[email protected]>
media: rtl2832: fix use-after-free in rtl2832_remove()
Myeonghun Pak <[email protected]>
media: radio-si476x: Unregister v4l2_device on probe failure
Valery Borovsky <[email protected]>
media: pwc: Return queued buffers on start_streaming() failure
Valery Borovsky <[email protected]>
media: pwc: Drain fill_buf on start_streaming() failure
Krzysztof Kozlowski <[email protected]>
media: pci: dm1105: Free allocated workqueue
Valery Borovsky <[email protected]>
media: msi2500: Return queued buffers on start_streaming() failure
Anand Moon <[email protected]>
media: meson: vdec: Fix memory leak in error path of vdec_open
Guangshuo Li <[email protected]>
media: marvell-cam: fix missing pci_disable_device() on remove
Wang Jun <[email protected]>
media: cx23885: add ioremap return check and cleanup
Johan Hovold <[email protected]>
media: cx231xx: fix devres lifetime
Pengpeng Hou <[email protected]>
media: cedrus: skip invalid H.264 reference list entries
Samuel Holland <[email protected]>
media: cedrus: Fix missing cleanup in error path
Myeonghun Pak <[email protected]>
media: cedrus: clean up media device on probe failure
Myeonghun Pak <[email protected]>
media: cec: seco: unregister adapter on IR probe failure
David Carlier <[email protected]>
media: aspeed: fix missing of_reserved_mem_device_release() on probe failure
Valery Borovsky <[email protected]>
media: airspy: Return queued buffers on start_streaming() failure
Ian Forbes <[email protected]>
drm/vmwgfx: Validate vmw_surface_metadata::array_size
Zhu Lingshan <[email protected]>
drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved
Timur Kristóf <[email protected]>
drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X)
Mario Limonciello <[email protected]>
drm/amdgpu: Fix VFCT bus number matching with soft filter
Joonas Lahtinen <[email protected]>
drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU
Joonas Lahtinen <[email protected]>
drm/i915/gem: Do not leak siblings[] on proto context error
Joonas Lahtinen <[email protected]>
drm/i915: Return NULL on error in active_instance
Alex Deucher <[email protected]>
drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON()
Alex Deucher <[email protected]>
drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON()
Alex Deucher <[email protected]>
drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON()
Bryam Vargas <[email protected]>
drm/virtio: bound EDID block reads to the response buffer
David Francis <[email protected]>
drm/amdkfd: Check bounds in allocate_event_notification_slot
Pavel Ondračka <[email protected]>
drm/radeon: fix r100_copy_blit for large BOs
Wentao Liang <[email protected]>
drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit()
Joonas Lahtinen <[email protected]>
drm/i915/gem: Add missing nospec on parallel submit slot
Timur Kristóf <[email protected]>
drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT
Ashutosh Desai <[email protected]>
drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers
Ashutosh Desai <[email protected]>
drm/dp/mst: fix buffer overflows in sideband chunk accumulation
Ashutosh Desai <[email protected]>
drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers
Sergey Shtylyov <[email protected]>
drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video()
Chengfeng Ye <[email protected]>
bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()
Li RongQing <[email protected]>
net: ipv6: fix dif and sdif mismatch in raw6_icmp_error
Alexei Lazar <[email protected]>
net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation
Alexei Lazar <[email protected]>
net/mlx5e: Report zero bandwidth for non-ETS traffic classes
Yael Chemla <[email protected]>
net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule
Aldo Ariel Panzardo <[email protected]>
net: qrtr: restrict socket creation to the initial network namespace
Chenguang Zhao <[email protected]>
hinic: remove unused ethtool RSS user configuration buffers
Eric Dumazet <[email protected]>
ppp: annotate data races in ppp_generic
Qingfang Deng <[email protected]>
ppp: enable TX scatter-gather
Qingfang Deng <[email protected]>
ppp: convert to percpu netstats
Qingfang Deng <[email protected]>
ppp: use IFF_NO_QUEUE in virtual interfaces
Eric Dumazet <[email protected]>
ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup
Suman Ghosh <[email protected]>
octeontx2-vf: set TC flower flag on MCAM entry allocation
Nazim Amirul <[email protected]>
net: stmmac: reset residual action in L3L4 filters on delete
Nazim Amirul <[email protected]>
net: stmmac: fix l3l4 filter rejecting unsupported offload requests
Cen Zhang (Microsoft) <[email protected]>
tipc: fix u16 MTU truncation in media and bearer MTU validation
Harshaka Narayana <[email protected]>
vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets
Qing Luo <[email protected]>
sctp: auth: verify auth requirement when auth_chunk is NULL
Eric Dumazet <[email protected]>
net: hsr: fix memory leak on slave unregistration by removing synced VLANs
Nikolay Aleksandrov <[email protected]>
net: bridge: vlan: fix vlan range dumps starting with pvid
Michael Bommarito <[email protected]>
amt: make the head writable before rewriting the L2 header
Michael Bommarito <[email protected]>
amt: re-read skb header pointers after every pull
Shelley Yang <[email protected]>
wifi: brcmfmac: fix 802.1X-SHA256 call trace warning
Lorenzo Bianconi <[email protected]>
wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv()
Ruoyu Wang <[email protected]>
wifi: mt76: mt7915: guard HE capability lookups
Helen Koike <[email protected]>
tipc: fix infinite loop in __tipc_nl_compat_dumpit
Xiang Mei (Microsoft) <[email protected]>
nexthop: initialize extack in nh_res_bucket_migrate()
Xiang Mei (Microsoft) <[email protected]>
gtp: check skb_pull_data() return in gtp1u_send_echo_resp()
Matthieu Baerts (NGI0) <[email protected]>
selftests: openvswitch: add config file
Matthieu Baerts (NGI0) <[email protected]>
selftests: af_unix: add USER_NS config
Kuniyuki Iwashima <[email protected]>
selftest: af_unix: Add Kconfig file.
Cen Zhang (Microsoft) <[email protected]>
sctp: validate stream count in sctp_process_strreset_inreq()
HanQuan <[email protected]>
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid
Prashanth Kumar KR <[email protected]>
amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN
Andrew Pope <[email protected]>
wifi: mac80211: recalculate TIM when a station enters power save
Li RongQing <[email protected]>
iommu/intel: Fix out-of-bounds memset in dmar_latency_disable()
Pengpeng Hou <[email protected]>
iommu/amd: Bound the early ACPI HID map
HE WEI (ギカク) <[email protected]>
wifi: mwifiex: bound uAP association event IEs to the event buffer
Ruoyu Wang <[email protected]>
wan: wanxl: Only reset hardware after BAR mapping
Ruoyu Wang <[email protected]>
nfp: Check resource mutex allocation
Guangshuo Li <[email protected]>
dpaa2-eth: put MAC endpoint device on disconnect
Vladimir Oltean <[email protected]>
net: dpaa2-eth: assign priv->mac after dpaa2_mac_connect() call
Guangshuo Li <[email protected]>
dpaa2-switch: put MAC endpoint device on disconnect
Aldo Ariel Panzardo <[email protected]>
rds: drop incoming messages that cross network namespace boundaries
Zhaolong Zhang <[email protected]>
bonding: fix devconf_all NULL dereference when IPv6 is disabled
David Lee <[email protected]>
net/packet: avoid fanout hook re-registration after unregister
Pengpeng Hou <[email protected]>
hwmon: occ: validate poll response sensor blocks
Yichong Chen <[email protected]>
smb: client: validate DFS referral PathConsumed
Eugene Shalygin <[email protected]>
hwmon: (asus-ec-sensors) add missed handle for ENOMEM
Eugene Shalygin <[email protected]>
hwmon: (asus-ec-sensors) fix EC read intervals
Eugene Shalygin <[email protected]>
hwmon: (asus-ec-sensors) fix looping over banks while reading from EC
Diego Fernando Mancera Gomez <[email protected]>
usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect
Shahar Tzarfati <[email protected]>
wifi: iwlwifi: mvm: fix read in wake packet notification handler
Shengjiu Wang <[email protected]>
ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI
Guanghui Yang <[email protected]>
btrfs: free mapping node on duplicate reloc root insert
You-Kai Zheng <[email protected]>
btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8
Tristan Madani <[email protected]>
wifi: carl9170: fix buffer overflow in rx_stream failover path
Tristan Madani <[email protected]>
wifi: carl9170: fix OOB read from off-by-two in TX status handler
Tristan Madani <[email protected]>
wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read
Tristan Madani <[email protected]>
wifi: ath6kl: fix OOB read from firmware IE lengths in connect event
Tristan Madani <[email protected]>
wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler
Ruoyu Wang <[email protected]>
firewire: net: Fix fragmented datagram reassembly
Manivannan Sadhasivam <[email protected]>
wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET
Dmitry Morgun <[email protected]>
wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()
Tzung-Bi Shih <[email protected]>
watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()
Guenter Roeck <[email protected]>
hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop
Guenter Roeck <[email protected]>
hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop
Edward Adam Davis <[email protected]>
hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop
Gaole Zhang <[email protected]>
wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin
Cheng Yongkang <[email protected]>
wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request
Xincheng Zhang <[email protected]>
usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits
Daniel Borkmann <[email protected]>
bpf: Fix ld_{abs,ind} failure path analysis in subprogs
Pawan Gupta <[email protected]>
bpf: Prefer dirty packs for eBPF allocations
Pawan Gupta <[email protected]>
bpf: Prefer packs that won't trigger an IBPB flush on allocation
Pawan Gupta <[email protected]>
bpf: Skip redundant IBPB in pack allocator
Pawan Gupta <[email protected]>
bpf: Restrict JIT predictor flush to cBPF
Pawan Gupta <[email protected]>
x86/bugs: Enable IBPB flush on BPF JIT allocation
Pawan Gupta <[email protected]>
bpf: Support for hardening against JIT spraying
Sasha Levin <[email protected]>
Revert "drm/amd/display: Add missing kdoc for ALLM parameters"
Doruk Tan Ozturk <[email protected]>
crypto: rsa-pkcs1pad: Don't WARN on an empty digest
Chukun Pan <[email protected]>
USB: serial: option: add TDTECH MT5710-CN
Johan Hovold <[email protected]>
USB: serial: keyspan_pda: fix data loss on receive throttling
Sunho Park <[email protected]>
USB: serial: io_edgeport: cap received transmit credits
Tim Pambor <[email protected]>
USB: serial: ftdi_sio: add support for E+H FXA291
Muhammad Bilal <[email protected]>
usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer
Fan Wu <[email protected]>
usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown
Sonali Pradhan <[email protected]>
usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()
Johan Hovold <[email protected]>
USB: gadget: fsl-udc: fix device name leak on probe failure
Johan Hovold <[email protected]>
USB: gadget: snps-udc: fix device name leak on probe failure
Melbin K Mathew <[email protected]>
usb: gadget: printer: fix infinite loop in printer_read()
Fan Wu <[email protected]>
usb: gadget: f_midi: cancel pending IN work before freeing the midi object
Jinchao Wang <[email protected]>
usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback
Xu Yang <[email protected]>
usb: chipidea: fix usage_count leak when autosuspend_delay is negative
Huang Wei <[email protected]>
USB: storage: add NO_ATA_1X quirk for Longmai USB Key
Huihui Huang <[email protected]>
wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()
Weiming Shi <[email protected]>
mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n
Xin Long <[email protected]>
sctp: fix auth_hmacs array size in struct sctp_cookie
Jamal Hadi Salim <[email protected]>
net/sched: act_tunnel_key: Defer dst_release to RCU callback
Emre Cecanpunar <[email protected]>
drm/i915/selftests: Fix GT PM sort comparators
Xiang Mei (Microsoft) <[email protected]>
ksmbd: validate compound request size before reading StructureSize2
Shuhao Fu <[email protected]>
can: j1939: fix lockless local-destination check
Michal Luczaj <[email protected]>
bpf, sockmap: Reject unhashed UDP sockets on sockmap update
Pengpeng Hou <[email protected]>
drm/i915/gt: use correct selftest config symbol
Huiwen He <[email protected]>
smb/client: handle overlapping allocated ranges in fallocate
Xiang Mei <[email protected]>
Bluetooth: qca: fix NVM tag length underflow in TLV parser
Takashi Iwai <[email protected]>
ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC
Rosen Penev <[email protected]>
ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts
Rosen Penev <[email protected]>
ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered
Bryam Vargas <[email protected]>
net/iucv: take a reference on the socket found in afiucv_hs_rcv()
Weiming Shi <[email protected]>
ipv4: fib: free fib_alias with kfree_rcu() on insert error path
Norbert Szetei <[email protected]>
ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF
Pushpendra Singh <[email protected]>
firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context
Uday Khare <[email protected]>
ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup
Vijendar Mukunda <[email protected]>
ASoC: amd: ps: fix wrong ACP version string in pci_request_regions()
Christian Hewitt <[email protected]>
ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop
HE WEI (ギカク) <[email protected]>
wifi: cfg80211: bound element ID read when checking non-inheritance
Runyu Xiao <[email protected]>
wifi: brcmfmac: initialize SDIO data work before cleanup
Cen Zhang <[email protected]>
wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock
Zhao Li <[email protected]>
wifi: cfg80211: reject unsupported PMSR FTM location requests
Zhao Li <[email protected]>
wifi: cfg80211: validate PMSR FTM preamble range
Zhao Li <[email protected]>
wifi: cfg80211: validate PMSR measurement type data
Zhao Li <[email protected]>
wifi: nl80211: validate nested MBSSID IE blobs
Zhao Li <[email protected]>
wifi: nl80211: free RNR data on MBSSID mismatch
Xiang Mei <[email protected]>
wifi: p54: validate RX frame length in p54_rx_eeprom_readback()
Dawei Feng <[email protected]>
wifi: libertas: fix memory leak in helper_firmware_cb()
Bryam Vargas <[email protected]>
wifi: mac80211_hwsim: clamp virtio RX length before skb_put
Abdun Nihaal <[email protected]>
wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one()
Cen Zhang <[email protected]>
wifi: cfg80211: cancel sched scan results work on unregister
Xiang Mei (Microsoft) <[email protected]>
xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert
Xiang Mei (Microsoft) <[email protected]>
xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()
Aleksandrova Alyona <[email protected]>
RDMA/irdma: Prevent overflows in memory contiguity checks
Malaya Kumar Rout <[email protected]>
selftests/alsa: Fix memory leak in find_controls error path
Ruoyu Wang <[email protected]>
RDMA/siw: publish QP after initialization
Guoqing Jiang <[email protected]>
RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp
Danila Chernetsov <[email protected]>
RDMA/hns: Fix potential integer overflow in mhop hem cleanup
Ruoyu Wang <[email protected]>
RDMA/erdma: initialize ret for empty receive WR lists
Or Gerlitz <[email protected]>
RDMA/cma: Fix hardware address comparison length in netevent callback
Unnathi Chalicheemala <[email protected]>
firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()
Filipe Manana <[email protected]>
btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots()
Xiang Mei <[email protected]>
btrfs: reject free space cache with more entries than pages
Pengpeng Hou <[email protected]>
mtd: nand: mtk-ecc: stop on ECC idle timeouts
Pengpeng Hou <[email protected]>
mtd: mtdswap: remove debugfs stats file on teardown
Michael Bommarito <[email protected]>
IB/mad: Drop unmatched RMPP responses before reassembly
Sumit Gupta <[email protected]>
arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234
Dmitry Torokhov <[email protected]>
Input: ims-pcu - fix logic error in packet reset
Seungjin Bae <[email protected]>
Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()
Chuck Lever <[email protected]>
xprtrdma: Clear receive-side ownership pointers on release
Mikko Perttunen <[email protected]>
gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings
Claudiu Beznea <[email protected]>
dmaengine: sh: rz-dmac: Move interrupt request after everything is set up
Oliver Hartkopp <[email protected]>
can: isotp: serialize TX state transitions under so->rx_lock
Oliver Hartkopp <[email protected]>
can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER
Oliver Hartkopp <[email protected]>
can: bcm: track a single source interface for ANYDEV timeout/throttle ops
Oliver Hartkopp <[email protected]>
can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()
Oliver Hartkopp <[email protected]>
can: bcm: fix stale rx/tx ops after device removal
Oliver Hartkopp <[email protected]>
can: bcm: add missing device refcount for CAN filter removal
Oliver Hartkopp <[email protected]>
can: bcm: validate frame length in bcm_rx_setup() for RTR replies
Oliver Hartkopp <[email protected]>
can: bcm: extend bcm_tx_lock usage for data and timer updates
Oliver Hartkopp <[email protected]>
can: bcm: fix CAN frame rx/tx statistics
Oliver Hartkopp <[email protected]>
can: bcm: add locking when updating filter and timer values
Phil Rosenthal <[email protected]>
KVM: x86/mmu: Fix use-after-free on vendor module reload
Hyunwoo Kim <[email protected]>
KVM: nVMX: Hide shadow VMCS right after VMCLEAR
Heiko Carstens <[email protected]>
seqlock: Allow UBSAN_ALIGNMENT to fail optimizing
Peter Zijlstra <[email protected]>
seqlock: Allow KASAN to fail optimizing
Peter Zijlstra <[email protected]>
seqlock: Cure some more scoped_seqlock() optimization fails
Sandipan Das <[email protected]>
perf/x86/amd/brs: Fix kernel address leakage
Kuniyuki Iwashima <[email protected]>
af_unix: Set gc_in_progress to true in unix_gc().
Guixiong Wei <[email protected]>
platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU hotplug
-------------
Diffstat:
Documentation/driver-api/driver-model/devres.rst | 1 + Makefile | 4 +- arch/arm/mach-npcm/platsmp.c | 2 + arch/arm64/boot/dts/nvidia/tegra234.dtsi | 24 +- arch/powerpc/boot/simpleboot.c | 2 +- arch/powerpc/boot/treeboot-akebono.c | 2 +- arch/powerpc/boot/treeboot-currituck.c | 2 +- arch/powerpc/platforms/ps3/mm.c | 1 + arch/riscv/include/asm/kvm_host.h | 10 +- arch/riscv/kvm/vcpu.c | 78 ++- arch/s390/kvm/pci.c | 28 +- arch/um/drivers/vector_kern.c | 3 + arch/x86/boot/compressed/Makefile | 1 + arch/x86/events/amd/brs.c | 10 +- arch/x86/include/asm/nospec-branch.h | 4 + arch/x86/kernel/cpu/bugs.c | 50 +- arch/x86/kvm/mmu/mmu.c | 73 +-- arch/x86/kvm/mmu/mmu_internal.h | 3 +- arch/x86/kvm/mmu/paging_tmpl.h | 14 +- arch/x86/kvm/svm/avic.c | 8 - arch/x86/kvm/svm/svm.c | 7 +- arch/x86/kvm/vmx/nested.c | 11 +- arch/x86/net/bpf_jit_comp.c | 3 +- crypto/rsa-pkcs1pad.c | 2 +- drivers/ata/ahci.h | 17 +- drivers/ata/ahci_brcm.c | 3 + drivers/ata/ahci_ceva.c | 24 +- drivers/ata/libahci.c | 1 + drivers/ata/libahci_platform.c | 38 +- drivers/ata/pata_sl82c105.c | 4 +- drivers/ata/sata_dwc_460ex.c | 8 +- drivers/ata/sata_mv.c | 2 +- drivers/block/rbd.c | 7 +- drivers/block/ublk_drv.c | 9 + drivers/bluetooth/btqca.c | 2 +- drivers/cdrom/cdrom.c | 1 + drivers/comedi/drivers/comedi_parport.c | 13 +- drivers/counter/microchip-tcb-capture.c | 4 +- drivers/cpufreq/powernow-k8.c | 1 + drivers/dma/sh/rz-dmac.c | 96 ++-- drivers/dma/sun6i-dma.c | 11 +- drivers/firewire/net.c | 37 +- drivers/firmware/arm_ffa/driver.c | 2 +- drivers/firmware/arm_scmi/notify.c | 6 +- drivers/firmware/stratix10-svc.c | 10 +- drivers/gpio/gpio-pca953x.c | 15 +- drivers/gpio/gpio-pch.c | 28 +- drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c | 45 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 15 + drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 30 ++ drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 8 + drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 17 +- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 13 +- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 13 +- drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 3 - drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 10 +- drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c | 4 +- drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_events.c | 26 +- .../amd/display/modules/info_packet/info_packet.c | 2 - drivers/gpu/drm/amd/pm/amdgpu_pm.c | 5 + drivers/gpu/drm/amd/pm/powerplay/hwmgr/hwmgr.c | 7 +- drivers/gpu/drm/display/drm_dp_helper.c | 12 + drivers/gpu/drm/display/drm_dp_mst_topology.c | 32 +- drivers/gpu/drm/i915/gem/i915_gem_context.c | 25 +- drivers/gpu/drm/i915/gt/intel_engine_user.c | 2 +- drivers/gpu/drm/i915/gt/selftest_gt_pm.c | 8 +- drivers/gpu/drm/i915/i915_active.c | 7 +- drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 6 +- drivers/gpu/drm/nouveau/nvkm/subdev/acr/base.c | 1 + drivers/gpu/drm/radeon/r100.c | 13 +- drivers/gpu/drm/rockchip/cdn-dp-reg.c | 2 + drivers/gpu/drm/vc4/vc4_irq.c | 2 +- drivers/gpu/drm/vc4/vc4_validate.c | 29 +- drivers/gpu/drm/virtio/virtgpu_vq.c | 3 +- drivers/gpu/drm/vmwgfx/ttm_object.c | 7 +- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 14 +- drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 22 +- drivers/gpu/host1x/bus.c | 4 +- drivers/hid/hid-logitech-dj.c | 28 +- drivers/hwmon/ads7828.c | 11 +- drivers/hwmon/adt7470.c | 131 +++-- drivers/hwmon/asus-ec-sensors.c | 18 +- drivers/hwmon/corsair-cpro.c | 1 + drivers/hwmon/corsair-psu.c | 5 +- drivers/hwmon/lm90.c | 4 +- drivers/hwmon/nct6775-core.c | 435 ++++++++++++----- drivers/hwmon/nct6775-i2c.c | 2 + drivers/hwmon/nct6775-platform.c | 41 +- drivers/hwmon/nct6775.h | 33 +- drivers/hwmon/npcm750-pwm-fan.c | 11 + drivers/hwmon/nzxt-smart2.c | 10 +- drivers/hwmon/occ/common.c | 38 +- drivers/hwmon/pmbus/lm25066.c | 19 +- drivers/hwmon/pmbus/pmbus_core.c | 2 +- drivers/hwtracing/intel_th/core.c | 10 - drivers/hwtracing/intel_th/msu.c | 2 + drivers/i2c/busses/i2c-amd-mp2-plat.c | 4 +- drivers/i2c/busses/i2c-imx.c | 9 +- drivers/i2c/busses/i2c-jz4780.c | 5 +- drivers/infiniband/core/addr.c | 6 +- drivers/infiniband/core/cma.c | 2 +- drivers/infiniband/core/mad.c | 30 ++ drivers/infiniband/hw/erdma/erdma_qp.c | 2 +- drivers/infiniband/hw/hns/hns_roce_hem.c | 2 +- drivers/infiniband/hw/irdma/verbs.c | 4 +- drivers/infiniband/sw/rxe/rxe_mmap.c | 19 +- drivers/infiniband/sw/siw/siw_verbs.c | 62 ++- drivers/input/evdev.c | 27 +- drivers/input/misc/ims-pcu.c | 32 +- drivers/iommu/amd/init.c | 6 + drivers/iommu/intel/perf.c | 2 +- drivers/iommu/intel/svm.c | 2 +- drivers/media/cec/platform/seco/seco-cec.c | 6 +- drivers/media/common/videobuf2/videobuf2-core.c | 12 +- drivers/media/dvb-frontends/rtl2832.c | 4 +- drivers/media/dvb-frontends/rtl2832_sdr.c | 19 +- drivers/media/pci/cx23885/cx23885-core.c | 14 +- drivers/media/pci/dm1105/dm1105.c | 1 + drivers/media/pci/saa7134/saa7134-video.c | 25 +- drivers/media/platform/aspeed/aspeed-video.c | 1 + drivers/media/platform/marvell/cafe-driver.c | 1 + drivers/media/platform/st/stm32/stm32-dcmi.c | 1 + drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c | 6 +- drivers/media/platform/ti/davinci/vpif_capture.c | 2 +- drivers/media/platform/ti/vpe/vpe.c | 3 +- drivers/media/radio/radio-si476x.c | 1 + drivers/media/test-drivers/vidtv/vidtv_bridge.c | 4 +- drivers/media/test-drivers/vimc/vimc-core.c | 1 + drivers/media/test-drivers/vivid/vivid-ctrls.c | 15 +- drivers/media/test-drivers/vivid/vivid-vid-cap.c | 38 +- drivers/media/test-drivers/vivid/vivid-vid-cap.h | 1 + drivers/media/test-drivers/vivid/vivid-vid-out.c | 6 + drivers/media/usb/airspy/airspy.c | 8 +- drivers/media/usb/cx231xx/cx231xx-cards.c | 16 +- drivers/media/usb/msi2500/msi2500.c | 32 +- drivers/media/usb/pwc/pwc-if.c | 13 +- drivers/media/usb/uvc/uvc_video.c | 76 ++- drivers/media/usb/uvc/uvcvideo.h | 4 + drivers/media/v4l2-core/v4l2-ctrls-core.c | 13 + drivers/media/v4l2-core/v4l2-ctrls-request.c | 14 +- drivers/misc/fastrpc.c | 3 +- drivers/mtd/mtdswap.c | 5 +- drivers/mtd/nand/ecc-mtk.c | 16 +- drivers/net/amt.c | 87 +++- drivers/net/bonding/bond_alb.c | 10 +- drivers/net/bonding/bond_main.c | 3 +- drivers/net/can/c_can/c_can_main.c | 8 +- drivers/net/can/ctucanfd/ctucanfd_base.c | 14 +- drivers/net/can/ctucanfd/ctucanfd_pci.c | 3 +- drivers/net/can/softing/softing_fw.c | 46 +- drivers/net/can/usb/ems_usb.c | 43 ++ drivers/net/can/usb/etas_es58x/es58x_core.c | 1 - drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 1 + drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 13 +- drivers/net/can/usb/peak_usb/pcan_usb_core.c | 1 - drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 40 +- drivers/net/can/usb/peak_usb/pcan_usb_pro.c | 20 +- drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 11 +- drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 51 +- drivers/net/ethernet/aquantia/atlantic/aq_ring.h | 1 + drivers/net/ethernet/aquantia/atlantic/aq_vec.c | 2 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 12 +- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 7 +- drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 22 +- .../net/ethernet/freescale/dpaa2/dpaa2-switch.c | 1 + drivers/net/ethernet/google/gve/gve.h | 3 + drivers/net/ethernet/google/gve/gve_main.c | 3 + drivers/net/ethernet/google/gve/gve_rx_dqo.c | 33 ++ drivers/net/ethernet/hisilicon/hip04_eth.c | 11 +- drivers/net/ethernet/hisilicon/hix5hd2_gmac.c | 1 - drivers/net/ethernet/huawei/hinic/hinic_dev.h | 2 - drivers/net/ethernet/huawei/hinic/hinic_ethtool.c | 21 - drivers/net/ethernet/intel/e1000/e1000_main.c | 2 +- drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 121 +---- drivers/net/ethernet/intel/ice/ice_main.c | 10 + drivers/net/ethernet/intel/ice/ice_ptp.c | 2 +- drivers/net/ethernet/intel/igbvf/netdev.c | 2 - .../ethernet/marvell/octeontx2/nic/otx2_flows.c | 1 + .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 2 +- .../net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 6 +- .../net/ethernet/marvell/prestera/prestera_pci.c | 3 + .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 16 +- drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 15 + .../ethernet/mellanox/mlx5/core/esw/acl/helper.c | 2 +- .../net/ethernet/mellanox/mlxsw/spectrum_span.c | 2 +- .../ethernet/netronome/nfp/nfpcore/nfp_resource.c | 3 + drivers/net/ethernet/nvidia/forcedeth.c | 4 +- drivers/net/ethernet/qlogic/qede/qede_main.c | 44 +- drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c | 14 +- drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 35 ++ drivers/net/geneve.c | 3 + drivers/net/gtp.c | 5 +- drivers/net/mctp/mctp-serial.c | 2 +- drivers/net/phy/phylink.c | 29 +- drivers/net/ppp/ppp_generic.c | 154 +++--- drivers/net/ppp/pppoe.c | 2 + drivers/net/ppp/pptp.c | 1 + drivers/net/slip/slip.c | 4 + drivers/net/thunderbolt.c | 33 +- drivers/net/usb/ax88179_178a.c | 4 +- drivers/net/vmxnet3/vmxnet3_drv.c | 22 +- drivers/net/vrf.c | 2 +- drivers/net/vxlan/vxlan_core.c | 22 +- drivers/net/wan/wanxl.c | 3 +- drivers/net/wireless/ath/ath11k/dp_rx.c | 3 + drivers/net/wireless/ath/ath11k/pci.c | 4 + drivers/net/wireless/ath/ath11k/qmi.c | 11 +- drivers/net/wireless/ath/ath6kl/txrx.c | 10 +- drivers/net/wireless/ath/ath6kl/wmi.c | 20 + drivers/net/wireless/ath/ath9k/hif_usb.c | 7 +- drivers/net/wireless/ath/carl9170/rx.c | 7 +- drivers/net/wireless/ath/carl9170/tx.c | 2 +- drivers/net/wireless/atmel/at76c50x-usb.c | 7 +- .../broadcom/brcm80211/brcmfmac/cfg80211.c | 2 +- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 8 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +- drivers/net/wireless/intel/ipw2x00/ipw2100.c | 8 +- drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 3 +- drivers/net/wireless/intersil/p54/txrx.c | 8 + drivers/net/wireless/mac80211_hwsim.c | 1 + drivers/net/wireless/marvell/libertas/firmware.c | 1 + .../net/wireless/marvell/mwifiex/11n_rxreorder.c | 2 +- drivers/net/wireless/marvell/mwifiex/tdls.c | 2 +- drivers/net/wireless/marvell/mwifiex/uap_event.c | 24 +- drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 6 + .../net/wireless/mediatek/mt76/mt76_connac_mcu.c | 2 + drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 18 +- drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 10 +- drivers/net/wireless/microchip/wilc1000/hif.c | 5 + drivers/phy/xilinx/phy-zynqmp.c | 127 +++-- drivers/pinctrl/Kconfig | 2 + drivers/pinctrl/devicetree.c | 4 + drivers/pinctrl/pinctrl-amd.c | 3 +- drivers/pinctrl/qcom/pinctrl-sc8280xp.c | 21 +- drivers/pinctrl/renesas/pinctrl-rzg2l.c | 4 +- drivers/platform/loongarch/loongson-laptop.c | 1 + .../uncore-frequency/uncore-frequency-common.c | 11 +- drivers/power/supply/bq25890_charger.c | 2 +- drivers/ptp/ptp_ocp.c | 4 +- drivers/regulator/devres.c | 59 +++ drivers/s390/block/dasd_ioctl.c | 2 +- drivers/s390/crypto/zcrypt_api.c | 2 +- drivers/s390/crypto/zcrypt_ccamisc.c | 26 +- drivers/s390/net/qeth_core.h | 4 +- drivers/s390/net/qeth_core_main.c | 3 + drivers/s390/scsi/zfcp_aux.c | 1 + drivers/scsi/aic94xx/aic94xx_hwi.c | 2 +- drivers/scsi/aic94xx/aic94xx_init.c | 6 +- drivers/scsi/hisi_sas/hisi_sas_main.c | 6 +- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 16 +- drivers/scsi/isci/host.h | 2 +- drivers/scsi/isci/init.c | 4 +- drivers/scsi/libiscsi.c | 2 +- drivers/scsi/libiscsi_tcp.c | 8 +- drivers/scsi/libsas/sas_ata.c | 8 +- drivers/scsi/libsas/sas_discover.c | 35 +- drivers/scsi/libsas/sas_expander.c | 2 +- drivers/scsi/libsas/sas_host_smp.c | 4 +- drivers/scsi/libsas/sas_init.c | 51 +- drivers/scsi/libsas/sas_phy.c | 8 +- drivers/scsi/libsas/sas_port.c | 6 +- drivers/scsi/libsas/sas_scsi_host.c | 14 +- drivers/scsi/mvsas/mv_init.c | 4 +- drivers/scsi/pm8001/pm8001_init.c | 2 +- drivers/scsi/scsi_debug.c | 12 +- drivers/spi/spi-fsl-dspi.c | 13 +- drivers/staging/media/meson/vdec/vdec.c | 4 +- drivers/staging/media/sunxi/cedrus/cedrus.c | 6 +- drivers/staging/media/sunxi/cedrus/cedrus_h264.c | 3 + drivers/staging/media/tegra-video/vi.c | 4 +- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 12 +- drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 2 +- drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 3 + drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 6 +- drivers/target/target_core_transport.c | 12 +- drivers/thermal/thermal_hwmon.c | 3 +- drivers/thunderbolt/eeprom.c | 9 +- drivers/thunderbolt/icm.c | 2 +- drivers/tty/serial/8250/8250_dma.c | 12 +- drivers/tty/serial/8250/8250_mid.c | 14 +- drivers/tty/serial/sc16is7xx.c | 12 + drivers/tty/vt/keyboard.c | 5 +- drivers/tty/vt/vt_ioctl.c | 2 + drivers/usb/atm/cxacru.c | 2 + drivers/usb/atm/ueagle-atm.c | 17 + drivers/usb/cdns3/cdnsp-gadget.c | 4 +- drivers/usb/chipidea/core.c | 1 + drivers/usb/gadget/function/f_midi.c | 1 + drivers/usb/gadget/function/f_ncm.c | 19 +- drivers/usb/gadget/function/f_printer.c | 23 +- drivers/usb/gadget/function/uvc_v4l2.c | 2 + drivers/usb/gadget/udc/bdc/bdc_core.c | 20 + drivers/usb/gadget/udc/bdc/bdc_udc.c | 7 +- drivers/usb/gadget/udc/dummy_hcd.c | 40 +- drivers/usb/gadget/udc/fsl_udc_core.c | 1 - drivers/usb/gadget/udc/snps_udc_core.c | 1 - drivers/usb/host/xhci-pci.c | 1 + drivers/usb/host/xhci.c | 15 +- drivers/usb/host/xhci.h | 1 + drivers/usb/serial/ftdi_sio.c | 2 + drivers/usb/serial/ftdi_sio_ids.h | 5 + drivers/usb/serial/io_edgeport.c | 3 +- drivers/usb/serial/keyspan_pda.c | 44 +- drivers/usb/serial/option.c | 1 + drivers/usb/storage/unusual_devs.h | 7 + drivers/vhost/vdpa.c | 9 +- drivers/vhost/vhost.c | 8 + drivers/video/fbdev/core/bitblit.c | 9 +- drivers/watchdog/watchdog_pretimeout.c | 2 + fs/binfmt_elf_fdpic.c | 4 + fs/binfmt_misc.c | 9 +- fs/btrfs/free-space-cache.c | 3 + fs/btrfs/inode.c | 1 + fs/btrfs/relocation.c | 2 + fs/ceph/caps.c | 1 + fs/crypto/fscrypt_private.h | 32 +- fs/crypto/inline_crypt.c | 57 +-- fs/crypto/keyring.c | 212 ++++----- fs/crypto/keysetup_v1.c | 8 +- fs/exec.c | 2 +- fs/exfat/balloc.c | 54 ++- fs/f2fs/super.c | 25 +- fs/namespace.c | 5 + fs/nfs/nfs4proc.c | 5 + fs/proc/namespaces.c | 4 +- fs/smb/client/cifssmb.c | 12 +- fs/smb/client/misc.c | 34 +- fs/smb/client/sess.c | 2 +- fs/smb/client/smb2ops.c | 25 +- fs/smb/server/smb2misc.c | 5 + fs/smb/server/smb2pdu.c | 9 +- fs/smb/server/vfs_cache.c | 6 +- include/linux/dma/qcom_bam_dma.h | 21 +- include/linux/filter.h | 15 +- include/linux/fscrypt.h | 18 +- include/linux/netdevice.h | 5 - include/linux/netfilter/ipset/ip_set.h | 2 +- include/linux/netfilter/nf_conntrack_sip.h | 2 +- include/linux/ppp_channel.h | 3 +- include/linux/regulator/consumer.h | 7 + include/linux/seqlock.h | 10 +- include/media/videobuf2-core.h | 8 +- include/net/act_api.h | 19 + include/net/addrconf.h | 4 +- include/net/af_unix.h | 1 + include/net/bluetooth/hci_core.h | 18 + include/net/bluetooth/l2cap.h | 1 + include/net/bluetooth/rfcomm.h | 3 + include/net/ip6_fib.h | 6 +- include/net/ip6_route.h | 11 +- include/net/ip_vs.h | 56 ++- include/net/neighbour.h | 8 +- include/net/netfilter/nf_conntrack_expect.h | 5 +- include/net/route.h | 2 + include/net/sch_generic.h | 1 + include/net/sctp/structs.h | 3 +- include/scsi/libsas.h | 8 +- include/uapi/linux/btrfs.h | 2 +- io_uring/rw.c | 28 +- kernel/audit.c | 11 +- kernel/auditfilter.c | 6 +- kernel/bpf/bpf_lsm.c | 1 - kernel/bpf/core.c | 68 ++- kernel/bpf/dispatcher.c | 2 +- kernel/bpf/verifier.c | 32 +- kernel/futex/core.c | 82 +++- kernel/sched/psi.c | 6 + kernel/trace/ftrace.c | 13 + kernel/trace/ring_buffer.c | 10 +- kernel/trace/trace_eprobe.c | 3 +- kernel/trace/trace_events.c | 6 +- kernel/trace/trace_events_filter.c | 3 + kernel/trace/trace_mmiotrace.c | 5 +- kernel/trace/trace_probe.c | 13 +- lib/.gitignore | 2 - lib/Makefile | 34 +- lib/assoc_array.c | 3 +- lib/rhashtable.c | 1 + lib/test_fortify/.gitignore | 2 + lib/test_fortify/Makefile | 29 ++ mm/damon/core.c | 13 + mm/huge_memory.c | 16 +- mm/hugetlb.c | 20 +- mm/page_reporting.c | 6 +- mm/percpu-km.c | 2 +- net/atm/common.c | 14 +- net/bluetooth/6lowpan.c | 20 +- net/bluetooth/hci_conn.c | 19 +- net/bluetooth/hci_sync.c | 13 +- net/bluetooth/hidp/core.c | 30 +- net/bluetooth/l2cap_core.c | 38 +- net/bluetooth/rfcomm/core.c | 17 + net/bluetooth/rfcomm/tty.c | 7 +- net/bridge/br_mrp.c | 8 +- net/bridge/br_multicast.c | 1 + net/bridge/br_netfilter_hooks.c | 6 +- net/bridge/br_netlink_tunnel.c | 3 +- net/bridge/br_private.h | 6 +- net/bridge/br_vlan.c | 10 +- net/bridge/br_vlan_options.c | 3 +- net/bridge/netfilter/ebt_nflog.c | 17 +- net/bridge/netfilter/nf_conntrack_bridge.c | 1 + net/can/bcm.c | 528 +++++++++++++++------ net/can/isotp.c | 295 +++++++++--- net/can/j1939/bus.c | 2 + net/can/j1939/j1939-priv.h | 3 + net/can/j1939/main.c | 8 +- net/can/j1939/transport.c | 22 +- net/ceph/auth_x.c | 9 +- net/ceph/ceph_common.c | 4 +- net/ceph/mon_client.c | 4 +- net/ceph/osdmap.c | 12 +- net/core/dst_cache.c | 2 +- net/core/filter.c | 2 +- net/core/lwt_bpf.c | 4 +- net/core/sock.c | 1 - net/core/sock_map.c | 2 + net/core/xdp.c | 2 +- net/hsr/hsr_slave.c | 2 + net/ipv4/fib_semantics.c | 101 ++-- net/ipv4/fib_trie.c | 2 +- net/ipv4/icmp.c | 18 +- net/ipv4/inet_connection_sock.c | 20 +- net/ipv4/ip_tunnel.c | 2 +- net/ipv4/nexthop.c | 2 +- net/ipv4/route.c | 31 +- net/ipv4/tcp_bpf.c | 4 +- net/ipv4/tcp_ipv4.c | 296 +++++++++--- net/ipv4/udp_offload.c | 4 +- net/ipv6/fib6_rules.c | 1 + net/ipv6/icmp.c | 8 +- net/ipv6/ila/ila_common.c | 12 + net/ipv6/ila/ila_lwt.c | 4 +- net/ipv6/ip6_fib.c | 17 +- net/ipv6/ip6_output.c | 20 +- net/ipv6/ip6_tunnel.c | 3 + net/ipv6/ip6mr.c | 2 +- net/ipv6/ndisc.c | 12 +- net/ipv6/ping.c | 2 +- net/ipv6/raw.c | 6 +- net/ipv6/route.c | 36 +- net/ipv6/tcp_ipv6.c | 4 +- net/ipv6/udp.c | 11 +- net/ipv6/xfrm6_policy.c | 3 +- net/iucv/af_iucv.c | 21 +- net/l2tp/l2tp_ip6.c | 2 +- net/l2tp/l2tp_ppp.c | 1 + net/mac80211/iface.c | 8 +- net/mac80211/rx.c | 2 + net/mac80211/s1g.c | 4 + net/mac802154/llsec.c | 5 + net/mpls/af_mpls.c | 4 + net/mpls/mpls_iptunnel.c | 2 +- net/mptcp/options.c | 12 +- net/mptcp/protocol.c | 1 + net/ncsi/ncsi-netlink.c | 4 + net/netfilter/ipset/ip_set_bitmap_gen.h | 4 +- net/netfilter/ipset/ip_set_core.c | 6 +- net/netfilter/ipset/ip_set_hash_gen.h | 4 +- net/netfilter/ipset/ip_set_list_set.c | 4 +- net/netfilter/ipvs/ip_vs_app.c | 4 +- net/netfilter/ipvs/ip_vs_conn.c | 44 +- net/netfilter/ipvs/ip_vs_core.c | 232 +++++---- net/netfilter/ipvs/ip_vs_ctl.c | 77 ++- net/netfilter/ipvs/ip_vs_lc.c | 4 +- net/netfilter/ipvs/ip_vs_proto_sctp.c | 21 +- net/netfilter/ipvs/ip_vs_proto_tcp.c | 50 +- net/netfilter/ipvs/ip_vs_proto_udp.c | 54 +-- net/netfilter/ipvs/ip_vs_sync.c | 7 +- net/netfilter/ipvs/ip_vs_xmit.c | 56 ++- net/netfilter/nf_conntrack_broadcast.c | 1 + net/netfilter/nf_conntrack_core.c | 7 +- net/netfilter/nf_conntrack_expect.c | 1 + net/netfilter/nf_conntrack_h323_main.c | 12 +- net/netfilter/nf_conntrack_helper.c | 5 + net/netfilter/nf_conntrack_netlink.c | 18 +- net/netfilter/nf_conntrack_sip.c | 4 +- net/netfilter/nf_flow_table_core.c | 8 +- net/netfilter/nf_flow_table_ip.c | 4 +- net/netfilter/nf_nat_sip.c | 2 +- net/netfilter/nft_payload.c | 12 +- net/netfilter/nft_rt.c | 2 +- net/netfilter/xt_hashlimit.c | 16 +- net/openvswitch/actions.c | 26 +- net/openvswitch/datapath.c | 54 ++- net/openvswitch/datapath.h | 2 +- net/openvswitch/flow.c | 11 +- net/openvswitch/meter.c | 33 +- net/openvswitch/vport.c | 2 +- net/packet/af_packet.c | 13 +- net/phonet/pep.c | 2 + net/qrtr/af_qrtr.c | 8 + net/qrtr/ns.c | 33 +- net/rds/ib.c | 4 + net/rds/ib_cm.c | 4 + net/rds/recv.c | 15 + net/rds/tcp.c | 14 +- net/sched/act_gact.c | 5 + net/sched/act_police.c | 6 + net/sched/act_tunnel_key.c | 14 +- net/sched/cls_route.c | 35 +- net/sched/sch_api.c | 9 + net/sched/sch_cake.c | 1 - net/sctp/associola.c | 14 +- net/sctp/auth.c | 2 +- net/sctp/ipv6.c | 2 +- net/sctp/outqueue.c | 1 + net/sctp/sm_make_chunk.c | 26 +- net/sctp/sm_statefuns.c | 8 +- net/sctp/stream.c | 6 +- net/smc/af_smc.c | 3 +- net/smc/smc_core.c | 2 +- net/smc/smc_llc.c | 3 +- net/smc/smc_rx.c | 19 +- net/sunrpc/xprtrdma/rpc_rdma.c | 4 + net/sunrpc/xprtrdma/verbs.c | 12 +- net/tipc/core.c | 5 + net/tipc/discover.c | 14 +- net/tipc/netlink.c | 6 +- net/tipc/netlink_compat.c | 4 + net/tipc/node.c | 15 +- net/tipc/socket.c | 3 +- net/tls/tls_sw.c | 2 +- net/unix/af_unix.c | 2 + net/unix/garbage.c | 81 ++-- net/vmw_vsock/virtio_transport.c | 14 +- net/wireless/core.c | 1 + net/wireless/nl80211.c | 20 +- net/wireless/pmsr.c | 21 +- net/wireless/scan.c | 2 +- net/x25/af_x25.c | 8 +- net/xfrm/xfrm_policy.c | 7 +- scripts/remove-stale-files | 2 + security/integrity/ima/ima_appraise.c | 9 +- security/keys/keyring.c | 14 +- sound/core/pcm_native.c | 7 + sound/core/seq/seq_timer.c | 13 +- sound/pci/lx6464es/lx6464es.c | 5 +- sound/pci/lx6464es/lx_core.c | 5 +- sound/soc/amd/ps/pci-ps.c | 2 +- sound/soc/codecs/bt-sco.c | 10 +- sound/soc/codecs/max98090.c | 5 +- sound/soc/codecs/max98095.c | 5 +- sound/soc/codecs/tas2562.c | 35 +- sound/soc/meson/aiu-fifo-spdif.c | 5 + sound/usb/6fire/chip.c | 4 + sound/usb/endpoint.c | 20 +- sound/usb/midi.c | 2 + sound/usb/quirks.c | 2 + sound/usb/usx2y/usX2Yhwdep.c | 2 + sound/usb/usx2y/usx2yhwdeppcm.c | 2 + tools/testing/selftests/alsa/mixer-test.c | 1 + .../selftests/bpf/prog_tests/sockmap_listen.c | 21 +- tools/testing/selftests/bpf/test_maps.c | 13 +- tools/testing/selftests/clone3/clone3_set_tid.c | 2 +- .../ftrace/test.d/dynevent/add_remove_eprobe.tc | 16 +- tools/testing/selftests/net/af_unix/config | 4 + tools/testing/selftests/net/openvswitch/config | 16 + 563 files changed, 6112 insertions(+), 2862 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/609 platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU hotplug
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guixiong Wei <[email protected]>
commit 6b63520ed14b17bbe9c2103debbd2152dde1fba3 upstream.
When the last CPU of a legacy uncore die goes offline, uncore_freq_remove_die_entry() clears control_cpu. During CPU hotplug re-add, uncore_freq_add_entry() still populates sysfs attributes before assigning the new control CPU. As a result, the current frequency read returns -ENXIO and current_freq_khz is omitted from the recreated sysfs group.
Assign control_cpu before the initial read paths and before create_attr_group() so sysfs recreation uses the new online CPU. If sysfs creation fails, restore control_cpu to -1 to keep the error path state consistent.
--- .../intel/uncore-frequency/uncore-frequency-common.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/platform/x86/intel/uncore-frequency/uncore-frequency-common.c +8 -3
@@ -197,13 +197,18 @@ int uncore_freq_add_entry(struct uncore_data *data, int cpu)sprintf (data->name,"package_%02d_die_%02d" , data->package_id, data->die_id); +/* +* Set the control CPU before any read path so entry recreation after CPU +* hotplug can populate read-only attributes from the new online CPU. +*/ + data->control_cpu = cpu;uncore_read (data, &data->initial_min_freq_khz, &data->initial_max_freq_khz); ret =create_attr_group (data, data->name); -if (!ret) { - data->control_cpu = cpu; +if (ret) + data->control_cpu =-1 ; +else data->valid = true; - } uncore_unlock:mutex_unlock (&uncore_lock);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 2/609 af_unix: Set gc_in_progress to true in unix_gc().
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit d82ba05263c69fa2437fe93e4e561cc40f4c03af ]
Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running:
Thread 1 Thread 2 Thread 3
-------- -------- --------
unix_schedule_gc() unix_schedule_gc()
`- if (!gc_in_progress) `- if (!gc_in_progress)
|- gc_in_progress = true |
`- queue_work() |
unix_gc() <----------------/ |
| |- gc_in_progress = true
... `- queue_work()
| |
`- gc_in_progress = false |
| unix_gc() <---------------------------------------------' |
... /* gc_in_progress == false */
|
`- gc_in_progress = false
unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK.
Let's set gc_in_progress to true in unix_gc().
[ Add setting gc_in_progress in __unix_gc(). Keep the existing
set in unix_gc() for wait_for_unix_gc() over-limit throttling. ]
--- net/unix/garbage.c | 2 ++ 1 file changed, 2 insertions(+)
net/unix/garbage.c +2 -0
@@ -560,6 +560,8 @@ static void __unix_gc(struct work_struct *work)struct sk_buff_head hitlist;struct sk_buff *skb; +WRITE_ONCE (gc_in_progress, true); +spin_lock (&unix_gc_lock);if (!unix_graph_maybe_cyclic) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 3/609 perf/x86/amd/brs: Fix kernel address leakage
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sandipan Das <[email protected]>
commit 47915e855fb38b42133e31ba917d99565f862154 upstream.
A user-only branch stack can contain branches that originate from the kernel. As a result, kernel addresses are exposed to user space even when PERF_SAMPLE_BRANCH_USER is requested. On AMD processors supporting X86_FEATURE_BRS (Zen 3 only), perf can still report entries such as SYSRET/interrupt returns for which the branch-from addresses are in the kernel.
E.g.
$ perf record -j any,u -c 4000 -e branch-brs -o - -- \
perf bench syscall basic --loop 1000 | \
perf script -i - -F brstack|tr ' ' '\n'| \
grep -E '0x[89a-f][0-9a-f]{15}' ...
0xffffffff810001c4/0x72e2e32955eb/-/-/-/0//-
0xffffffff810001c4/0x72e2d94a9821/-/-/-/0//-
0xffffffff810001c4/0x72e2d94ffa1b/-/-/-/0//-
...
BRS provides no hardware branch filtering, so privilege level filtering is performed entirely in software. However, amd_brs_match_plm() only validates the branch-to address against the requested privilege levels. For branches from the kernel to user space, the branch-from address is left unchecked and is leaked. Extend the software filter to also validate the branch-from address, so that any branch record whose branch-from address is in the kernel is dropped when PERF_SAMPLE_BRANCH_USER is requested.
--- arch/x86/events/amd/brs.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
arch/x86/events/amd/brs.c +5 -5
@@ -262,13 +262,13 @@ void amd_brs_disable_all(void)amd_brs_disable (); } -static bool amd_brs_match_plm (struct perf_event *event,u64 to) +static bool amd_brs_match_plm (struct perf_event *event,u64 from,u64 to) {int type = event->attr.branch_sample_type;int plm_k =PERF_SAMPLE_BRANCH_KERNEL |PERF_SAMPLE_BRANCH_HV ;int plm_u =PERF_SAMPLE_BRANCH_USER ; -if (!(type & plm_k) &&kernel_ip (to)) +if (!(type & plm_k) && (kernel_ip (to) ||kernel_ip (from)))return 0 ;if (!(type & plm_u) && !kernel_ip (to))
@@ -341,11 +341,11 @@ void amd_brs_drain(void)*/ to = (u64)(((s64 )to << shift) >> shift); -if (!amd_brs_match_plm (event, to)) -continue ; -rdmsrl (brs_from (brs_idx), from); +if (!amd_brs_match_plm (event, from, to)) +continue ; +perf_clear_branch_entry_bitfields (br+nr); br[nr].from = from;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 4/609 seqlock: Cure some more scoped_seqlock() optimization fails
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
commit 90dfeef1cd38dff19f8b3a752d13bfd79f0f7694 upstream.
Arnd reported an x86 randconfig using gcc-15 tripped over __scoped_seqlock_bug(). Turns out GCC chose not to inline the scoped_seqlock helper functions and as such was not able to optimize properly.
[ mingo: Clang fails the build too in some circumstances. ]
--- include/linux/seqlock.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/linux/seqlock.h +2 -2
@@ -1281,7 +1281,7 @@ struct ss_tmp {spinlock_t *lock_irqsave; }; -static inline void __scoped_seqlock_cleanup (struct ss_tmp *sst) +static __always_inline void __scoped_seqlock_cleanup(struct ss_tmp *sst) {if (sst->lock)spin_unlock (sst->lock);
@@ -1306,7 +1306,7 @@ static inline void __scoped_seqlock_bug(extern void __scoped_seqlock_bug (void );#endif -static inline void +static __always_inline void__scoped_seqlock_next (struct ss_tmp *sst,seqlock_t *lock,enum ss_state target) {switch (sst->state) {
Greg Kroah-Hartman
maintainerPATCH 5/609 seqlock: Allow KASAN to fail optimizing
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
commit b94d45b6bbb42571ec225d3be0e7457c8765a5b4 upstream.
Some KASAN builds are failing to properly optimize this code -- luckily we don't care about core quality for KASAN builds, so just exclude it.
--- include/linux/seqlock.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
include/linux/seqlock.h +4 -1
@@ -1291,11 +1291,14 @@ static __always_inline void __scoped_seqextern void __scoped_seqlock_invalid_target (void ); -#if defined(CONFIG_CC_IS_GCC ) &&CONFIG_GCC_VERSION <90000 +#if (defined(CONFIG_CC_IS_GCC ) &&CONFIG_GCC_VERSION <90000 ) || defined(CONFIG_KASAN )/* * For some reason some GCC-8 architectures (nios2, alpha) have trouble * determining that the ss_done state is impossible in __scoped_seqlock_next() * below. +* +* Similarly KASAN is known to confuse compilers enough to break this. But we +* don't care about code quality for KASAN builds anyway. */ static inline void __scoped_seqlock_bug (void ) { }#else
Greg Kroah-Hartman
maintainerPATCH 6/609 seqlock: Allow UBSAN_ALIGNMENT to fail optimizing
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
commit 88331c4ec23a28c1006ec532fa64763d4c695e90 upstream.
With gcc-15 and gcc-16 with UBSAN_ALIGNMENT enabled the compiler fails to inline and optimize __scoped_seqlock_bug() away on s390:
s390x-16.1.0-ld: kernel/sched/build_policy.o: in function `__scoped_seqlock_next':
/.../seqlock.h:1286:(.text+0x22030): undefined reference to `__scoped_seqlock_bug'
Fix this by adding UBSAN_ALIGNMENT to the list of config options where a not inlined empty __scoped_seqlock_bug() is allowed.
--- include/linux/seqlock.h | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
include/linux/seqlock.h +4 -3
@@ -1291,14 +1291,15 @@ static __always_inline void __scoped_seqextern void __scoped_seqlock_invalid_target (void ); -#if (defined(CONFIG_CC_IS_GCC ) &&CONFIG_GCC_VERSION <90000 ) || defined(CONFIG_KASAN ) +#if (defined(CONFIG_CC_IS_GCC ) &&CONFIG_GCC_VERSION <90000 ) || \ + defined(CONFIG_KASAN ) || defined(CONFIG_UBSAN_ALIGNMENT )/* * For some reason some GCC-8 architectures (nios2, alpha) have trouble * determining that the ss_done state is impossible in __scoped_seqlock_next() * below. * -* Similarly KASAN is known to confuse compilers enough to break this. But we -* don't care about code quality for KASAN builds anyway. +* Similarly KASAN and UBSAN_ALIGNMENT are known to confuse compilers enough +* to break this. But we don't care about code quality for such builds anyway. */ static inline void __scoped_seqlock_bug (void ) { }#else
Greg Kroah-Hartman
maintainerPATCH 7/609 KVM: nVMX: Hide shadow VMCS right after VMCLEAR
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <[email protected]>
commit 622ebfac01ba4f9c0060cebd41257fe46fc4a0b3 upstream.
free_nested() frees the shadow VMCS while vmcs01 still points to it. But because it is asynchronous with respect to loaded_vmcs_clear(), the vCPU might migrate before the pointer is cleared and __loaded_vmcs_clear() may then execute VMCLEAR.
The VMCS needs to stay attached until its explicit VMCLEAR completes, but then it can be hidden and the page safely freed.
--- arch/x86/kvm/vmx/nested.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
arch/x86/kvm/vmx/nested.c +9 -2
@@ -287,6 +287,7 @@ static void vmx_switch_vmcs(struct kvm_vstatic void free_nested (struct kvm_vcpu *vcpu) {struct vcpu_vmx *vmx =to_vmx (vcpu); +struct vmcs *shadow_vmcs;if (WARN_ON_ONCE (vmx->loaded_vmcs != &vmx->vmcs01))vmx_switch_vmcs (vcpu, &vmx->vmcs01);
@@ -304,9 +305,15 @@ static void free_nested(struct kvm_vcpu vmx->nested.current_vmptr =INVALID_GPA ;if (enable_shadow_vmcs) {vmx_disable_shadow_vmcs (vmx); -vmcs_clear (vmx->vmcs01.shadow_vmcs); -free_vmcs (vmx->vmcs01.shadow_vmcs); + +/* +* Keep the pointer visible until after VMCLEAR, so migration +* can clear an active shadow VMCS on the old CPU. +*/ + shadow_vmcs = vmx->vmcs01.shadow_vmcs; +vmcs_clear (shadow_vmcs); vmx->vmcs01.shadow_vmcs =NULL ; +free_vmcs (shadow_vmcs); }kfree (vmx->nested.cached_vmcs12); vmx->nested.cached_vmcs12 =NULL ;
Greg Kroah-Hartman
maintainerPATCH 8/609 KVM: x86/mmu: Fix use-after-free on vendor module reload
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phil Rosenthal <[email protected]>
commit 52f2f7c30126037975389aa04d24c506a5177c35 upstream.
mmu_destroy_caches() destroys pte_list_desc_cache and mmu_page_header_cache, but leaves both pointers unchanged. The pointers live in kvm.ko, and therefore survive when a vendor module is unloaded while kvm.ko remains loaded.
If creation of pte_list_desc_cache fails during a subsequent vendor module load, its assignment sets pte_list_desc_cache to NULL and the error path calls mmu_destroy_caches(). mmu_page_header_cache still points to the cache destroyed during the preceding vendor module unload. Passing that stale pointer to kmem_cache_destroy() causes a slab use-after-free.
Reproduce the issue on a v7.1.3 kernel with CONFIG_KASAN=y, CONFIG_KASAN_GENERIC=y, CONFIG_KVM=m, and CONFIG_KVM_INTEL=m. A one-shot test hook forces pte_list_desc_cache to NULL on the second invocation of kvm_mmu_vendor_module_init():
1. Load kvm.ko and kvm-intel.ko, creating both caches.
2. Unload only kvm_intel, leaving kvm.ko loaded.
3. Reload kvm_intel and force initialization through the -ENOMEM path.
KASAN reports:
BUG: KASAN: slab-use-after-free in kvm_mmu_vendor_module_init+0x5b/0x170 [kvm] ... kmem_cache_destroy+0x21/0x1d0 kvm_mmu_vendor_module_init+0x5b/0x170 [kvm] ... Allocated by task 16817: __kmem_cache_create_args+0x12c/0x3b0 __kmem_cache_create.constprop.0+0xb6/0xf0 [kvm] kvm_mmu_vendor_module_init+0x13b/0x170 [kvm] ... Freed by task 16820: kmem_cache_destroy+0x117/0x1d0 kvm_mmu_vendor_module_exit+0x21/0x30 [kvm]
Clear both pointers immediately after destroying their caches so that the stored state reflects the caches' lifetime and repeated cleanup is safe.
With the fix applied, the same injected vendor module reload fails with -ENOMEM as expected and produces no KASAN report.
Message-ID: <[email protected]>
--- arch/x86/kvm/mmu/mmu.c | 2 ++ 1 file changed, 2 insertions(+)
arch/x86/kvm/mmu/mmu.c +2 -0
@@ -6643,7 +6643,9 @@ static struct shrinker mmu_shrinker = {static void mmu_destroy_caches (void ) {kmem_cache_destroy (pte_list_desc_cache); + pte_list_desc_cache =NULL ;kmem_cache_destroy (mmu_page_header_cache); + mmu_page_header_cache =NULL ; }static int get_nx_huge_pages (char *buffer,const struct kernel_param *kp)
Greg Kroah-Hartman
maintainerPATCH 9/609 can: bcm: add locking when updating filter and timer values
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <[email protected]>
commit 749179c2e25b95d22499ed29096b3e02d6dfd2b4 upstream.
KCSAN detected a simultaneous access to timer values that can be overwritten in bcm_rx_setup() when updating timer and filter content while bcm_rx_handler(), bcm_rx_timeout_handler() or bcm_rx_thr_handler() run concurrently on incoming CAN traffic.
Protect the timer (ival1/ival2/kt_ival1/kt_ival2/kt_lastmsg) and filter (nframes/flags/frames/last_frames) updates in bcm_rx_setup() with a new per-op bcm_rx_update_lock, taken with the matching scope in the RX handlers. memcpy_from_msg() is staged into a temporary buffer before the lock is taken, since it can sleep and must not run under a spinlock.
hrtimer_cancel() is always called without bcm_rx_update_lock held, since bcm_rx_timeout_handler()/bcm_rx_thr_handler() take the same lock and a running callback would otherwise deadlock against the canceller.
Also close a related race: bcm_rx_setup() cleared the RTR flag in the stored reply frame's can_id as a separate, unprotected step after the frame content was already installed, so a concurrent bcm_rx_handler() could transmit a stale reply with CAN_RTR_FLAG still set. Fold that normalization into the initial frame preparation instead (on the staged buffer for updates, directly on op->frames pre-registration for new ops), so the installed frame is always atomically self-consistent.
bcm_rx_handler()'s RX_RTR_FRAME check now takes a lock-protected snapshot of op->flags before deciding whether to call bcm_can_tx(), but does not hold the lock across that call.
Also take a lock-protected snapshot of the currframe in bcm_can_tx() to avoid partly overwrites by content updates in bcm_tx_setup(). Finally check if a TX_RESET_MULTI_IDX/SETTIMER might have reset op->currframe between the two locked sections in bcm_can_tx().
Omit calling hrtimer_forward() with zero interval in bcm_rx_thr_handler(). kt_ival2 may have been concurrently cleared by bcm_rx_setup() before it cancels this timer, so check kt_ival2 inside the bcm_rx_update_lock.
--- net/can/bcm.c | 176 ++++++++++++++++++++++++++++++++++++++------------ 1 file changed, 133 insertions(+), 43 deletions(-)
net/can/bcm.c +133 -43
@@ -126,6 +126,7 @@ struct bcm_op {struct sock *sk;struct net_device *rx_reg_dev;spinlock_t bcm_tx_lock;/* protect currframe/count in runtime updates */ +spinlock_t bcm_rx_update_lock;/* protect filter/timer data updates */ };struct bcm_sock {
@@ -280,21 +281,27 @@ static int bcm_proc_show(struct seq_file *m, void *v)* bcm_can_tx - send the (next) CAN frame to the appropriate CAN interface * of the given bcm tx op */ -static void bcm_can_tx (struct bcm_op *op) +static void bcm_can_tx (struct bcm_op *op,struct canfd_frame *cf) {struct sk_buff *skb;struct net_device *dev; -struct canfd_frame *cf; +struct canfd_frame cframe; +bool cyclic = !cf; +unsigned int idx =0 ;int err;/* no target device? => exit */ if (!op->ifindex)return ; -/* read currframe under lock protection */ -spin_lock_bh (&op->bcm_tx_lock); - cf = op->frames + op->cfsiz * op->currframe; -spin_unlock_bh (&op->bcm_tx_lock); +if (cyclic) { +/* read currframe under lock protection */ +spin_lock_bh (&op->bcm_tx_lock); + idx = op->currframe; +memcpy (&cframe, op->frames + op->cfsiz * idx, op->cfsiz); + cf = &cframe; +spin_unlock_bh (&op->bcm_tx_lock); + } dev =dev_get_by_index (sock_net (op->sk), op->ifindex);if (!dev) {
@@ -323,14 +330,20 @@ static void bcm_can_tx(struct bcm_op *op)if (!err) op->frames_abs++; - op->currframe++; +/* only advance the cyclic sequence if nothing reset currframe while +* we were sending - a concurrent TX_RESET_MULTI_IDX means this +* frame's bookkeeping belongs to a sequence that no longer exists +*/ +if (!cyclic || op->currframe == idx) { + op->currframe++; -/* reached last frame? */ -if (op->currframe >= op->nframes) - op->currframe =0 ; +/* reached last frame? */ +if (op->currframe >= op->nframes) + op->currframe =0 ; -if (op->count >0 ) - op->count--; +if (op->count >0 ) + op->count--; + }spin_unlock_bh (&op->bcm_tx_lock); out:
@@ -429,7 +442,7 @@ static enum hrtimer_restart bcm_tx_timeout_handler(struct hrtimer *hrtimer)struct bcm_msg_head msg_head;if (op->kt_ival1 && (op->count >0 )) { -bcm_can_tx (op); +bcm_can_tx (op,NULL );if (!op->count && (op->flags &TX_COUNTEVT )) {/* create notification to user */
@@ -446,7 +459,7 @@ static enum hrtimer_restart bcm_tx_timeout_handler(struct hrtimer *hrtimer) } }else if (op->kt_ival2) { -bcm_can_tx (op); +bcm_can_tx (op,NULL ); } return bcm_tx_set_expiry(op, &op->timer) ?
@@ -585,6 +598,8 @@ static enum hrtimer_restart bcm_rx_timeout_handler(struct hrtimer *hrtimer) struct bcm_op *op = container_of(hrtimer, struct bcm_op, timer);struct bcm_msg_head msg_head; +spin_lock_bh (&op->bcm_rx_update_lock); +/* if user wants to be informed, when cyclic CAN-Messages come back */ if ((op->flags &RX_ANNOUNCE_RESUME ) && op->last_frames) {/* clear received CAN frames to indicate 'nothing received' */
@@ -601,6 +616,8 @@ static enum hrtimer_restart bcm_rx_timeout_handler(struct hrtimer *hrtimer) msg_head.can_id = op->can_id; msg_head.nframes =0 ; +spin_unlock_bh (&op->bcm_rx_update_lock); +bcm_send_to_user (op, &msg_head,NULL ,0 );return HRTIMER_NORESTART ;
@@ -649,15 +666,26 @@ static int bcm_rx_thr_flush(struct bcm_op *op)static enum hrtimer_restart bcm_rx_thr_handler (struct hrtimer *hrtimer) { struct bcm_op *op = container_of(hrtimer, struct bcm_op, thrtimer); +enum hrtimer_restart ret; -if (bcm_rx_thr_flush (op)) { +spin_lock_bh (&op->bcm_rx_update_lock); + +/* kt_ival2 may have been concurrently cleared by bcm_rx_setup() +* before it cancels this timer - never forward with a zero +* interval in that case. +*/ +if (bcm_rx_thr_flush (op) && op->kt_ival2) {hrtimer_forward_now (hrtimer, op->kt_ival2); -return HRTIMER_RESTART ; + ret =HRTIMER_RESTART ; }else {/* rearm throttle handling */ op->kt_lastmsg =0 ; -return HRTIMER_NORESTART ; + ret =HRTIMER_NORESTART ; } + +spin_unlock_bh (&op->bcm_rx_update_lock); + +return ret; }/*
@@ -667,7 +695,9 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data) {struct bcm_op *op = (struct bcm_op *)data;const struct canfd_frame *rxframe = (struct canfd_frame *)skb->data; +struct canfd_frame rtrframe;unsigned int i; +bool rtr_frame;if (op->can_id != rxframe->can_id)return ;
@@ -691,12 +721,23 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data)/* update statistics */ op->frames_abs++; -if (op->flags &RX_RTR_FRAME ) { +/* snapshot the flag under lock: op->flags/op->frames may be updated +* concurrently by bcm_rx_setup(). +*/ +spin_lock_bh (&op->bcm_rx_update_lock); + rtr_frame = op->flags &RX_RTR_FRAME ; +if (rtr_frame) +memcpy (&rtrframe, op->frames, op->cfsiz); +spin_unlock_bh (&op->bcm_rx_update_lock); + +if (rtr_frame) {/* send reply for RTR-request (placed in op->frames[0]) */ -bcm_can_tx (op); +bcm_can_tx (op, &rtrframe);return ; } +spin_lock_bh (&op->bcm_rx_update_lock); +if (op->flags &RX_FILTER_ID ) {/* the easiest case */ bcm_rx_update_and_send (op, op->last_frames, rxframe);
@@ -730,6 +771,8 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data) rx_starttimer:bcm_rx_starttimer (op); + +spin_unlock_bh (&op->bcm_rx_update_lock); }/*
@@ -1073,7 +1116,7 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,list_add_rcu (&op->list, &bo->tx_ops);if (op->flags &TX_ANNOUNCE ) -bcm_can_tx (op); +bcm_can_tx (op,NULL );if (op->flags &STARTTIMER )bcm_tx_start_timer (op);
@@ -1087,6 +1130,24 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,return err; } +static void bcm_rx_setup_rtr_check (struct bcm_msg_head *msg_head, +struct bcm_op *op,void *new_frames) +{ +/* funny feature in RX(!)_SETUP only for RTR-mode: +* copy can_id into frame BUT without RTR-flag to +* prevent a full-load-loopback-test ... ;-] +* normalize this on the staged buffer, before it is +* ever installed into op->frames. +*/ +if (msg_head->flags &RX_RTR_FRAME ) { +struct canfd_frame *frame0 = new_frames; + +if ((msg_head->flags &TX_CP_CAN_ID ) || + frame0->can_id == op->can_id) + frame0->can_id = op->can_id & ~CAN_RTR_FLAG ; + } +} +/* * bcm_rx_setup - create or update a bcm rx op (for bcm_sendmsg) */
@@ -1121,6 +1182,8 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,/* check the given can_id */ op =bcm_find_op (&bo->rx_ops, msg_head, ifindex);if (op) { +void *new_frames =NULL ; +/* update existing BCM operation */ /*
@@ -1132,19 +1195,48 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,return -E2BIG ;if (msg_head->nframes) { -/* update CAN frames content */ - err =memcpy_from_msg (op->frames, msg, +/* get new CAN frames content before locking */ + new_frames =kmalloc (msg_head->nframes * op->cfsiz, +GFP_KERNEL ); +if (!new_frames) +return -ENOMEM ; + + err =memcpy_from_msg (new_frames, msg, msg_head->nframes * op->cfsiz); -if (err <0 ) +if (err <0 ) { +kfree (new_frames);return err; + } -/* clear last_frames to indicate 'nothing received' */ -memset (op->last_frames,0 , msg_head->nframes * op->cfsiz); +bcm_rx_setup_rtr_check (msg_head, op, new_frames); } +spin_lock_bh (&op->bcm_rx_update_lock); op->nframes = msg_head->nframes; op->flags = msg_head->flags; +if (msg_head->nframes) { +/* update CAN frames content */ +memcpy (op->frames, new_frames, + msg_head->nframes * op->cfsiz); + +/* clear last_frames to indicate 'nothing received' */ +memset (op->last_frames,0 , + msg_head->nframes * op->cfsiz); + } + +if (msg_head->flags &SETTIMER ) { + op->ival1 = msg_head->ival1; + op->ival2 = msg_head->ival2; + op->kt_ival1 =bcm_timeval_to_ktime (msg_head->ival1); + op->kt_ival2 =bcm_timeval_to_ktime (msg_head->ival2); + op->kt_lastmsg =0 ; + } +spin_unlock_bh (&op->bcm_rx_update_lock); + +/* free temporary frames / kfree(NULL) is safe */ +kfree (new_frames); +/* Only an update -> do not call can_rx_register() */ do_rx_register =0 ;
@@ -1155,6 +1247,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,return -ENOMEM ;spin_lock_init (&op->bcm_tx_lock); +spin_lock_init (&op->bcm_rx_update_lock); op->can_id = msg_head->can_id; op->nframes = msg_head->nframes; op->cfsiz =CFSIZ (msg_head->flags);
@@ -1196,6 +1289,8 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,kfree (op);return err; } + +bcm_rx_setup_rtr_check (msg_head, op, op->frames); }/* bcm_can_tx / bcm_tx_timeout_handler needs this */
@@ -1223,29 +1318,22 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,/* check flags */ if (op->flags &RX_RTR_FRAME ) { -struct canfd_frame *frame0 = op->frames; -/* no timers in RTR-mode */ hrtimer_cancel (&op->thrtimer);hrtimer_cancel (&op->timer); - -/* -* funny feature in RX(!)_SETUP only for RTR-mode: -* copy can_id into frame BUT without RTR-flag to -* prevent a full-load-loopback-test ... ;-] -*/ -if ((op->flags &TX_CP_CAN_ID ) || - (frame0->can_id == op->can_id)) - frame0->can_id = op->can_id & ~CAN_RTR_FLAG ; - }else {if (op->flags &SETTIMER ) { -/* set timer value */ - op->ival1 = msg_head->ival1; - op->ival2 = msg_head->ival2; - op->kt_ival1 =bcm_timeval_to_ktime (msg_head->ival1); - op->kt_ival2 =bcm_timeval_to_ktime (msg_head->ival2); +/* set timers (locked) for newly created op */ +if (do_rx_register) { +spin_lock_bh (&op->bcm_rx_update_lock); + op->ival1 = msg_head->ival1; + op->ival2 = msg_head->ival2; + op->kt_ival1 =bcm_timeval_to_ktime (msg_head->ival1); + op->kt_ival2 =bcm_timeval_to_ktime (msg_head->ival2); + op->kt_lastmsg =0 ; +spin_unlock_bh (&op->bcm_rx_update_lock); + }/* disable an active timer due to zero value? */ if (!op->kt_ival1)
@@ -1255,9 +1343,11 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,* In any case cancel the throttle timer, flush * potentially blocked msgs and reset throttle handling */ - op->kt_lastmsg =0 ;hrtimer_cancel (&op->thrtimer); + +spin_lock_bh (&op->bcm_rx_update_lock);bcm_rx_thr_flush (op); +spin_unlock_bh (&op->bcm_rx_update_lock); }if ((op->flags &STARTTIMER ) && op->kt_ival1)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 10/609 can: bcm: fix CAN frame rx/tx statistics
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <[email protected]>
commit e6c24ba95fc3f1b5e1dcd28b1c6e59ef61a9daa5 upstream.
KCSAN detected a data race within the bcm_rx_handler() when two CAN frames have been simultaneously received and processed in a single rx op by two different CPUs.
Use atomic operations with (signed) long data types to access the statistics in the hot path to fix the KCSAN complaint.
Additionally simplify the update and check of statistics overflow by using the atomic operations in separate bcm_update_[rx|tx]_stats() functions. The rx variant runs under bcm_rx_update_lock to prevent races when resetting the two rx counters; the tx variant runs under bcm_tx_lock and only needs to guard its own counter's overflow.
As the rx path resets its values already at LONG_MAX / 100, there is no conflict between the two locking domains (bcm_rx_update_lock vs. bcm_tx_lock) even for ops that use both paths.
The rx statistics update and the frames_filtered update in bcm_rx_changed() were previously performed in two separate bcm_rx_update_lock sections. For an rx op subscribed on all interfaces (ifindex == 0), bcm_rx_handler() can run concurrently on different CPUs, so a counter reset by one CPU between these two sections could leave frames_filtered larger than frames_abs on another CPU, producing a bogus (even negative) reduction percentage in procfs. Update the statistics in the same critical section as bcm_rx_changed() to close this gap, which also removes the now unneeded extra lock/unlock pair around the traffic_flags calculation.
--- net/can/bcm.c | 67 ++++++++++++++++++++++++++++++++++----------------- 1 file changed, 45 insertions(+), 22 deletions(-)
net/can/bcm.c +45 -22
@@ -109,7 +109,7 @@ struct bcm_op {int ifindex;canid_t can_id;u32 flags; -unsigned long frames_abs, frames_filtered; +atomic_long_t frames_abs, frames_filtered;struct bcm_timeval ival1, ival2;struct hrtimer timer, thrtimer;ktime_t rx_stamp, kt_ival1, kt_ival2, kt_lastmsg;
@@ -216,10 +216,13 @@ static int bcm_proc_show(struct seq_file *m, void *v)list_for_each_entry_rcu (op, &bo->rx_ops, list) { -unsigned long reduction; +long reduction, frames_filtered, frames_abs; + + frames_filtered =atomic_long_read (&op->frames_filtered); + frames_abs =atomic_long_read (&op->frames_abs);/* print only active entries & prevent division by zero */ -if (!op->frames_abs) +if (!frames_abs)continue ; seq_printf(m, "rx_op: %03X %-5s ", op->can_id,
@@ -241,9 +244,9 @@ static int bcm_proc_show(struct seq_file *m, void *v) (long long)ktime_to_us(op->kt_ival2));seq_printf (m,"# recv %ld (%ld) => reduction: " , - op->frames_filtered, op->frames_abs); + frames_filtered, frames_abs); - reduction =100 - (op->frames_filtered *100 ) / op->frames_abs; + reduction =100 - (frames_filtered *100 ) / frames_abs;seq_printf (m,"%s%ld%%\n" , (reduction ==100 ) ?"near " :"" , reduction);
@@ -267,7 +270,8 @@ static int bcm_proc_show(struct seq_file *m, void *v)seq_printf (m,"t2=%lld " , (long long )ktime_to_us (op->kt_ival2)); -seq_printf (m,"# sent %ld\n" , op->frames_abs); +seq_printf (m,"# sent %ld\n" , +atomic_long_read (&op->frames_abs)); }seq_putc (m,'\n' );
@@ -277,6 +281,24 @@ static int bcm_proc_show(struct seq_file *m, void *v) }#endif /* CONFIG_PROC_FS */ +static void bcm_update_rx_stats (struct bcm_op *op) +{ +/* prevent overflow of the reduction% calculation in bcm_proc_show() */ +if (atomic_long_inc_return (&op->frames_abs) >LONG_MAX /100 ) { +atomic_long_set (&op->frames_filtered,0 ); +atomic_long_set (&op->frames_abs,0 ); + } +} + +static void bcm_update_tx_stats (struct bcm_op *op) +{ +/* tx_op has no reduction% calculation - use the full range and +* just keep the displayed counter non-negative on overflow +*/ +if (atomic_long_inc_return (&op->frames_abs) ==LONG_MAX ) +atomic_long_set (&op->frames_abs,0 ); +} +/* * bcm_can_tx - send the (next) CAN frame to the appropriate CAN interface * of the given bcm tx op
@@ -328,7 +350,7 @@ static void bcm_can_tx(struct bcm_op *op, struct canfd_frame *cf)spin_lock_bh (&op->bcm_tx_lock);if (!err) - op->frames_abs++; +bcm_update_tx_stats (op);/* only advance the cyclic sequence if nothing reset currframe while * we were sending - a concurrent TX_RESET_MULTI_IDX means this
@@ -473,12 +495,9 @@ static void bcm_rx_changed(struct bcm_op *op, struct canfd_frame *data) {struct bcm_msg_head head; -/* update statistics */ - op->frames_filtered++; - -/* prevent statistics overflow */ -if (op->frames_filtered >ULONG_MAX /100 ) - op->frames_filtered = op->frames_abs =0 ; +/* update statistics (frames_filtered <= frames_abs) */ +if (atomic_long_read (&op->frames_abs)) +atomic_long_inc (&op->frames_filtered);/* this element is not throttled anymore */ data->flags &= (BCM_CAN_FLAGS_MASK |RX_RECV );
@@ -718,25 +737,29 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data) op->rx_stamp = skb->tstamp;/* save originator for recvfrom() */ op->rx_ifindex = skb->dev->ifindex; -/* update statistics */ - op->frames_abs++; -/* snapshot the flag under lock: op->flags/op->frames may be updated -* concurrently by bcm_rx_setup(). -*/ +/* op->flags/op->frames may be updated concurrently by bcm_rx_setup() */ spin_lock_bh (&op->bcm_rx_update_lock); + rtr_frame = op->flags &RX_RTR_FRAME ; -if (rtr_frame) +if (rtr_frame) { +bcm_update_rx_stats (op); +/* snapshot RTR content under lock */ memcpy (&rtrframe, op->frames, op->cfsiz); -spin_unlock_bh (&op->bcm_rx_update_lock); +spin_unlock_bh (&op->bcm_rx_update_lock); -if (rtr_frame) {/* send reply for RTR-request (placed in op->frames[0]) */ bcm_can_tx (op, &rtrframe);return ; } -spin_lock_bh (&op->bcm_rx_update_lock); +/* update statistics in the same critical section as bcm_rx_changed() +* below: frames_filtered must never be checked/incremented against a +* frames_abs snapshot from a concurrent bcm_rx_handler() call on +* another CPU for the same (wildcard) op, or frames_filtered can end +* up larger than frames_abs. +*/ +bcm_update_rx_stats (op);if (op->flags &RX_FILTER_ID ) {/* the easiest case */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 11/609 can: bcm: extend bcm_tx_lock usage for data and timer updates
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <[email protected]>
commit 12ce799f7ab1e05bd8fbf79e46f403bfe5597ebc upstream.
Stage new CAN frame content for an existing tx op into a kmalloc()'d buffer and validate it there, mirroring the approach already used in bcm_rx_setup(). Only copy the validated data into op->frames while holding op->bcm_tx_lock, so bcm_can_tx() and bcm_tx_timeout_handler() can no longer observe a partially updated or unvalidated frame.
Add a missing error path for memcpy_from_msg() when copying CAN frame data from userspace.
Also move the kt_ival1/kt_ival2/ival1/ival2 updates in bcm_tx_setup() under op->bcm_tx_lock, and read kt_ival1/kt_ival2/count under the same lock in bcm_tx_set_expiry() and bcm_tx_timeout_handler(), closing the torn 64-bit ktime_t read on 32-bit platforms.
--- net/can/bcm.c | 104 ++++++++++++++++++++++++++++++++++++-------------- 1 file changed, 75 insertions(+), 29 deletions(-)
net/can/bcm.c +75 -29
@@ -125,7 +125,7 @@ struct bcm_op {struct canfd_frame last_sframe;struct sock *sk;struct net_device *rx_reg_dev; -spinlock_t bcm_tx_lock;/* protect currframe/count in runtime updates */ +spinlock_t bcm_tx_lock;/* protect tx data and timer updates */ spinlock_t bcm_rx_update_lock;/* protect filter/timer data updates */ };
@@ -440,12 +440,18 @@ static bool bcm_tx_set_expiry(struct bcm_op *op, struct hrtimer *hrt) {ktime_t ival; +spin_lock_bh (&op->bcm_tx_lock); +if (op->kt_ival1 && op->count) ival = op->kt_ival1; -else if (op->kt_ival2) +else if (op->kt_ival2) { ival = op->kt_ival2; -else + }else { +spin_unlock_bh (&op->bcm_tx_lock);return false; + } + +spin_unlock_bh (&op->bcm_tx_lock);hrtimer_set_expires (hrt,ktime_add (ktime_get (), ival));return true;
@@ -462,25 +468,47 @@ static enum hrtimer_restart bcm_tx_timeout_handler(struct hrtimer *hrtimer) { struct bcm_op *op = container_of(hrtimer, struct bcm_op, timer);struct bcm_msg_head msg_head; +bool tx_ival1, tx_ival2; + +/* snapshot kt_ival1/kt_ival2/count under lock to avoid torn +* ktime_t reads racing with concurrent bcm_tx_setup() updates +*/ +spin_lock_bh (&op->bcm_tx_lock); + tx_ival1 = op->kt_ival1 && (op->count >0 ); + tx_ival2 = !!op->kt_ival2; +spin_unlock_bh (&op->bcm_tx_lock); + +if (tx_ival1) { +u32 flags, count; +struct bcm_timeval ival1, ival2; -if (op->kt_ival1 && (op->count >0 )) {bcm_can_tx (op,NULL ); -if (!op->count && (op->flags &TX_COUNTEVT )) { +/* snapshot variables under lock to avoid torn reads racing +* with concurrent bcm_tx_setup() updates +*/ +spin_lock_bh (&op->bcm_tx_lock); + flags = op->flags; + count = op->count; + ival1 = op->ival1; + ival2 = op->ival2; +spin_unlock_bh (&op->bcm_tx_lock); + +if (!count && (flags &TX_COUNTEVT )) {/* create notification to user */ memset (&msg_head,0 ,sizeof (msg_head)); msg_head.opcode =TX_EXPIRED ; - msg_head.flags = op->flags; - msg_head.count = op->count; - msg_head.ival1 = op->ival1; - msg_head.ival2 = op->ival2; + msg_head.flags = flags; + msg_head.count = count; + msg_head.ival1 = ival1; + msg_head.ival2 = ival2; msg_head.can_id = op->can_id; msg_head.nframes =0 ;bcm_send_to_user (op, &msg_head,NULL ,0 ); } - }else if (op->kt_ival2) { + }else if (tx_ival2) {bcm_can_tx (op,NULL ); }
@@ -988,6 +1016,8 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,/* check the given can_id */ op =bcm_find_op (&bo->tx_ops, msg_head, ifindex);if (op) { +void *new_frames; +/* update existing BCM operation */ /*
@@ -998,11 +1028,23 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,if (msg_head->nframes > op->nframes)return -E2BIG ; -/* update CAN frames content */ +/* get new CAN frames content into a staging buffer before +* locking: validate and normalize the frames there so that +* bcm_can_tx() / bcm_tx_timeout_handler() never observe a +* partially updated or unvalidated frame in op->frames +*/ + new_frames =kmalloc (msg_head->nframes * op->cfsiz,GFP_KERNEL ); +if (!new_frames) +return -ENOMEM ; +for (i =0 ; i < msg_head->nframes; i++) { - cf = op->frames + op->cfsiz * i; + cf = new_frames + op->cfsiz * i; err =memcpy_from_msg ((u8 *)cf, msg, op->cfsiz); +if (err <0 ) { +kfree (new_frames); +return err; + }if (op->flags &CAN_FD_FRAME ) {if (cf->len >64 )
@@ -1012,36 +1054,38 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, err = -EINVAL ; } -if (err <0 ) +if (err <0 ) { +kfree (new_frames);return err; + }if (msg_head->flags &TX_CP_CAN_ID ) {/* copy can_id into frame */ cf->can_id = msg_head->can_id; } } + +spin_lock_bh (&op->bcm_tx_lock); + +/* update CAN frames content */ +memcpy (op->frames, new_frames, msg_head->nframes * op->cfsiz); + op->flags = msg_head->flags; -/* only lock for unlikely count/nframes/currframe changes */ if (op->nframes != msg_head->nframes || - op->flags &TX_RESET_MULTI_IDX || - op->flags &SETTIMER ) { - -spin_lock_bh (&op->bcm_tx_lock); + op->flags &TX_RESET_MULTI_IDX ) { +/* potentially update changed nframes */ + op->nframes = msg_head->nframes; +/* restart multiple frame transmission */ + op->currframe =0 ; + } -if (op->nframes != msg_head->nframes || - op->flags &TX_RESET_MULTI_IDX ) { -/* potentially update changed nframes */ - op->nframes = msg_head->nframes; -/* restart multiple frame transmission */ - op->currframe =0 ; - } +if (op->flags &SETTIMER ) + op->count = msg_head->count; -if (op->flags &SETTIMER ) - op->count = msg_head->count; +spin_unlock_bh (&op->bcm_tx_lock); -spin_unlock_bh (&op->bcm_tx_lock); - } +kfree (new_frames); }else {/* insert new BCM operation for the given can_id */
@@ -1118,10 +1162,12 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,if (op->flags &SETTIMER ) {/* set timer values */ +spin_lock_bh (&op->bcm_tx_lock); op->ival1 = msg_head->ival1; op->ival2 = msg_head->ival2; op->kt_ival1 =bcm_timeval_to_ktime (msg_head->ival1); op->kt_ival2 =bcm_timeval_to_ktime (msg_head->ival2); +spin_unlock_bh (&op->bcm_tx_lock);/* disable an active timer due to zero values? */ if (!op->kt_ival1 && !op->kt_ival2)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 12/609 can: bcm: validate frame length in bcm_rx_setup() for RTR replies
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <[email protected]>
commit 62ec41f364648be79d54d94d0d240ee326948afd upstream.
bcm_tx_setup() validates cf->len against the CAN/CAN FD DLC limits before installing frames for TX_SETUP, but bcm_rx_setup() never did the same for the RTR-reply frame configured via RX_SETUP with RX_RTR_FRAME.
--- net/can/bcm.c | 59 +++++++++++++++++++++++++++++++++++---------------- 1 file changed, 41 insertions(+), 18 deletions(-)
net/can/bcm.c +41 -18
@@ -1199,22 +1199,37 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,return err; } -static void bcm_rx_setup_rtr_check (struct bcm_msg_head *msg_head, -struct bcm_op *op,void *new_frames) +static int bcm_rx_setup_rtr_check (struct bcm_msg_head *msg_head, +struct bcm_op *op,void *new_frames) { +struct canfd_frame *frame0 = new_frames; + +if (!(msg_head->flags &RX_RTR_FRAME )) +return 0 ; + +/* this frame is sent out as-is by bcm_can_tx() whenever a matching +* remote request is received, so validate its length the same way +* bcm_tx_setup() validates TX_SETUP frames before installing it +*/ +if (msg_head->flags &CAN_FD_FRAME ) { +if (frame0->len >64 ) +return -EINVAL ; + }else { +if (frame0->len >8 ) +return -EINVAL ; + } +/* funny feature in RX(!)_SETUP only for RTR-mode: * copy can_id into frame BUT without RTR-flag to * prevent a full-load-loopback-test ... ;-] * normalize this on the staged buffer, before it is * ever installed into op->frames. */ -if (msg_head->flags &RX_RTR_FRAME ) { -struct canfd_frame *frame0 = new_frames; +if ((msg_head->flags &TX_CP_CAN_ID ) || + frame0->can_id == op->can_id) + frame0->can_id = op->can_id & ~CAN_RTR_FLAG ; -if ((msg_head->flags &TX_CP_CAN_ID ) || - frame0->can_id == op->can_id) - frame0->can_id = op->can_id & ~CAN_RTR_FLAG ; - } +return 0 ; }/*
@@ -1277,7 +1292,11 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,return err; } -bcm_rx_setup_rtr_check (msg_head, op, new_frames); + err =bcm_rx_setup_rtr_check (msg_head, op, new_frames); +if (err <0 ) { +kfree (new_frames); +return err; + } }spin_lock_bh (&op->bcm_rx_update_lock);
@@ -1350,16 +1369,12 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,if (msg_head->nframes) { err =memcpy_from_msg (op->frames, msg, msg_head->nframes * op->cfsiz); -if (err <0 ) { -if (op->frames != &op->sframe) -kfree (op->frames); -if (op->last_frames != &op->last_sframe) -kfree (op->last_frames); -kfree (op); -return err; - } +if (err <0 ) + goto free_op; -bcm_rx_setup_rtr_check (msg_head, op, op->frames); + err =bcm_rx_setup_rtr_check (msg_head, op, op->frames); +if (err <0 ) + goto free_op; }/* bcm_can_tx / bcm_tx_timeout_handler needs this */
@@ -1461,6 +1476,14 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, }return msg_head->nframes * op->cfsiz +MHSIZ ; + +free_op: +if (op->frames != &op->sframe) +kfree (op->frames); +if (op->last_frames != &op->last_sframe) +kfree (op->last_frames); +kfree (op); +return err; }/*
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 13/609 can: bcm: add missing device refcount for CAN filter removal
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <[email protected]>
commit d59948293ea34b6337ce2b5febab8510de70048c upstream.
sashiko-bot remarked a problem with a concurrent device unregistration in isotp.c which also is present in the bcm.c code. A former fix for raw.c commit c275a176e4b6 ("can: raw: add missing refcount for memory leak fix") introduced a netdevice_tracker which solves the issue for bcm.c too.
bcm_release(), bcm_delete_rx_op() and bcm_notifier() relied on dev_get_by_index(ifindex) to re-find the device for an rx_op before unregistering its filter. If a concurrent NETDEV_UNREGISTER has already unlisted the device from the ifindex table, that lookup fails and can_rx_unregister() is silently skipped, leaving a stale CAN filter pointing at the soon-to-be-freed bcm_op/socket.
Hold a netdev_hold()/netdev_put() tracked reference on op->rx_reg_dev from the moment the rx filter is registered in bcm_rx_setup() until it is unregistered in bcm_rx_unreg(), and use that reference directly in bcm_release() and bcm_delete_rx_op() instead of re-looking the device up by ifindex.
--- net/can/bcm.c | 44 ++++++++++++++++++++++++-------------------- 1 file changed, 24 insertions(+), 20 deletions(-)
net/can/bcm.c +24 -20
@@ -889,6 +889,7 @@ static void bcm_rx_unreg(struct net_device *dev, struct bcm_op *op)/* mark as removed subscription */ op->rx_reg_dev =NULL ; +dev_put (dev); }else printk (KERN_ERR "can-bcm: bcm_rx_unreg: registered device " "mismatch %p %p\n" , op->rx_reg_dev, dev);
@@ -919,17 +920,14 @@ static int bcm_delete_rx_op(struct list_head *ops, struct bcm_msg_head *mh,* Only remove subscriptions that had not * been removed due to NETDEV_UNREGISTER * in bcm_notifier() +* +* op->rx_reg_dev is a tracked reference taken +* when the subscription was registered, so it +* stays valid here even if a concurrent +* NETDEV_UNREGISTER already unlisted the dev. */ -if (op->rx_reg_dev) { -struct net_device *dev; - - dev =dev_get_by_index (sock_net (op->sk), - op->ifindex); -if (dev) { -bcm_rx_unreg (dev, op); -dev_put (dev); - } - } +if (op->rx_reg_dev) +bcm_rx_unreg (op->rx_reg_dev, op); }else can_rx_unregister(sock_net(op->sk), NULL, op->can_id,
@@ -1452,7 +1450,15 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, bcm_rx_handler, op, "bcm", sk); - op->rx_reg_dev = dev; +/* keep a reference so that a later +* unregister can safely reach the device even +* if a concurrent NETDEV_UNREGISTER has +* already unlisted it by ifindex +*/ +if (!err) { + op->rx_reg_dev = dev; +dev_hold (dev); + }dev_put (dev); }else {/* the requested device is gone - do not
@@ -1825,16 +1831,14 @@ static int bcm_release(struct socket *sock)* Only remove subscriptions that had not * been removed due to NETDEV_UNREGISTER * in bcm_notifier() +* +* op->rx_reg_dev is a tracked reference taken +* when the subscription was registered, so it +* stays valid here even if a concurrent +* NETDEV_UNREGISTER already unlisted the device. */ -if (op->rx_reg_dev) { -struct net_device *dev; - - dev =dev_get_by_index (net, op->ifindex); -if (dev) { -bcm_rx_unreg (dev, op); -dev_put (dev); - } - } +if (op->rx_reg_dev) +bcm_rx_unreg (op->rx_reg_dev, op); }else can_rx_unregister(net, NULL, op->can_id, REGMASK(op->can_id),
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 14/609 can: bcm: fix stale rx/tx ops after device removal
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <[email protected]>
commit 3b762c0d950383ab7a002686c9136b9aa55d2d70 upstream.
RX: an RX_SETUP update(!) for an existing op skipped can_rx_register() unconditionally, even when a concurrent NETDEV_UNREGISTER had already torn down its registration (op->rx_reg_dev == NULL). This silently did not re-enable frame delivery for that updated filter. bcm_rx_setup() now re-registers in that case, while leaving rx_ops with ifindex = 0 (all CAN devices) which never carry a tracked rx_reg_dev registered as-is.
TX: bcm_notify() only handled bo->rx_ops on NETDEV_UNREGISTER, leaving tx_ops with an active cyclic transmission re-arming its hrtimer indefinitely to execute bcm_tx_timeout_handler(). Cancelling the hrtimer prevents the runaway timer and any injection into a later reused ifindex, since nothing else calls bcm_can_tx() for the op until an explicit TX_SETUP update re-arms it.
Unlike bcm_rx_unreg(), which clears the tracked rx_reg_dev for rx_ops, the ifindex is intentionally left unchanged for tx_ops. bcm_tx_setup() always rejects ifindex 0, so clearing it would strand the op: neither a later TX_SETUP (bcm_find_op()) nor TX_DELETE (bcm_delete_tx_op()) could ever find it again, since both require an exact ifindex match.
--- net/can/bcm.c | 54 +++++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 44 insertions(+), 10 deletions(-)
net/can/bcm.c +44 -10
@@ -1239,6 +1239,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,struct bcm_sock *bo =bcm_sk (sk);struct bcm_op *op;int do_rx_register; +int new_op =0 ;int err =0 ;if ((msg_head->flags &RX_FILTER_ID ) || (!(msg_head->nframes))) {
@@ -1323,8 +1324,15 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,/* free temporary frames / kfree(NULL) is safe */ kfree (new_frames); -/* Only an update -> do not call can_rx_register() */ - do_rx_register =0 ; +/* Don't register a new CAN filter for the rx_op update unless +* a concurrent NETDEV_UNREGISTER notifier already tore down +* the previous registration. In this case the receiver needs +* to be re-registered here so that this update doesn't +* silently stop delivering frames for the given ifindex. +* Ops with ifindex = 0 (all CAN interfaces) never carry a +* tracked rx_reg_dev and stay registered as-is. +*/ + do_rx_register = (ifindex && !op->rx_reg_dev) ?1 :0 ; }else {/* insert new BCM operation for the given can_id */
@@ -1394,6 +1402,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,/* call can_rx_register() */ do_rx_register =1 ; + new_op =1 ; }/* if ((op = bcm_find_op(&bo->rx_ops, msg_head->can_id, ifindex))) */
@@ -1407,7 +1416,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,if (op->flags &SETTIMER ) {/* set timers (locked) for newly created op */ -if (do_rx_register) { +if (new_op) {spin_lock_bh (&op->bcm_rx_update_lock); op->ival1 = msg_head->ival1; op->ival2 = msg_head->ival2;
@@ -1437,7 +1446,10 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, HRTIMER_MODE_REL_SOFT); } -/* now we can register for can_ids, if we added a new bcm_op */ +/* now we can register for can_ids, if we added a new bcm_op +* or need to re-register after a NETDEV_UNREGISTER tore down +* the previous registration of an existing op +*/ if (do_rx_register) {if (ifindex) {struct net_device *dev;
@@ -1467,18 +1479,32 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, err = -ENODEV ; } - }else + }else { err =can_rx_register (sock_net (sk),NULL , op->can_id,REGMASK (op->can_id), bcm_rx_handler, op,"bcm" , sk); + } +if (err) { -/* this bcm rx op is broken -> remove it */ -bcm_remove_op (op); +/* newly created bcm rx op is broken -> remove it */ +if (new_op) { +bcm_remove_op (op); +return err; + } + +/* an existing op just stays unregistered. +* Cancel op->timer and (defensively) op->thrtimer. +* Other settings can't be reached until the next +* successful RX_SETUP. +*/ +hrtimer_cancel (&op->timer); +hrtimer_cancel (&op->thrtimer);return err; } -/* add this bcm_op to the list of the rx_ops */ -list_add_rcu (&op->list, &bo->rx_ops); +/* add a new bcm_op to the list of the rx_ops */ +if (new_op) +list_add_rcu (&op->list, &bo->rx_ops); }return msg_head->nframes * op->cfsiz +MHSIZ ;
@@ -1694,11 +1720,19 @@ static void bcm_notify(struct bcm_sock *bo, unsigned long msg,case NETDEV_UNREGISTER :lock_sock (sk); -/* remove device specific receive entries */ +/* rx_ops: remove device specific receive entries */ list_for_each_entry (op, &bo->rx_ops, list)if (op->rx_reg_dev == dev)bcm_rx_unreg (dev, op); +/* tx_ops: stop device specific cyclic transmissions on the +* vanishing ifindex. Cancelling the timer is enough to stop +* cyclic bcm_can_tx() calls as there is no re-arming. +*/ +list_for_each_entry (op, &bo->tx_ops, list) +if (op->ifindex == dev->ifindex) +hrtimer_cancel (&op->timer); +/* remove device reference, if this is our bound device */ if (bo->bound && bo->ifindex == dev->ifindex) {#if IS_ENABLED (CONFIG_PROC_FS )
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 15/609 can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <[email protected]>
commit 58fd6cbc8541216af1d7ed272ea7ac2b66d50fd8 upstream.
For an rx op subscribed on all interfaces (ifindex == 0), the same op is registered once in the shared per-netns wildcard filter list, so bcm_rx_handler() can run concurrently on different CPUs for frames arriving on different net devices.
op->rx_stamp and op->rx_ifindex were written before bcm_rx_update_lock was taken, allowing concurrent writers to race each other - including a torn store of the 64-bit rx_stamp on 32-bit platforms.
Beyond a torn store bcm_send_to_user() must report the timestamp/ifindex of the very same frame whose content it is delivering. So the assignment is placed in the same unbroken bcm_rx_update_lock section as the content comparison.
As a side effect, the RTR-request frame feature (which never reach bcm_send_to_user()) no longer updates rx_stamp/rx_ifindex, since only the notification path needs them.
--- net/can/bcm.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
net/can/bcm.c +8 -5
@@ -761,11 +761,6 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data)/* disable timeout */ hrtimer_cancel (&op->timer); -/* save rx timestamp */ - op->rx_stamp = skb->tstamp; -/* save originator for recvfrom() */ - op->rx_ifindex = skb->dev->ifindex; -/* op->flags/op->frames may be updated concurrently by bcm_rx_setup() */ spin_lock_bh (&op->bcm_rx_update_lock);
@@ -789,6 +784,14 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data)*/ bcm_update_rx_stats (op); +/* save rx timestamp and originator for recvfrom() under lock. +* For an op subscribed on all interfaces (ifindex == 0) +* bcm_rx_handler() can run concurrently on different CPUs so +* the CAN content and the meta data must be bundled correctly. +*/ + op->rx_stamp = skb->tstamp; + op->rx_ifindex = skb->dev->ifindex; +if (op->flags &RX_FILTER_ID ) {/* the easiest case */ bcm_rx_update_and_send (op, op->last_frames, rxframe);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 16/609 can: bcm: track a single source interface for ANYDEV timeout/throttle ops
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <[email protected]>
commit 2f5976f54a04e9f18b25283036ac3136be453b17 upstream.
An ANYDEV rx op (ifindex == 0) with an active RX timeout and/or throttle timer has no defined semantics when matching frames arrive from several interfaces: bcm_rx_handler() can run concurrently for the same op on different CPUs, racing hrtimer_cancel()/ bcm_rx_starttimer() against bcm_rx_timeout_handler() and causing spurious RX_TIMEOUT notifications and last_frames corruption. The same concurrency lets throttled multiplex frames from different interfaces clobber the single rx_ifindex/rx_stamp fields shared by the op.
Add op->if_detected to track the first interface that delivers a matching frame while a timeout/throttle timer is configured, and reject frames from any other interface for that op. The claim is decided in bcm_rx_handler() before hrtimer_cancel() touches op->timer, so a rejected frame can never disturb the claimed interface's watchdog. RTR-mode ops are excluded via RX_RTR_FRAME, independent of kt_ival1/kt_ival2, since those may briefly hold a stale value from an earlier non-RTR configuration.
The claim is released in bcm_notify() on NETDEV_UNREGISTER and in bcm_rx_setup() when SETTIMER reconfigures the timer values.
A (re-)claim is only possible on CAN devices in NETREG_REGISTERED dev->reg_state to cover the release in bcm_notify() where reg_state becomes NETREG_UNREGISTERING until synchronize_net().
--- net/can/bcm.c | 49 ++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 44 insertions(+), 5 deletions(-)
net/can/bcm.c +44 -5
@@ -114,6 +114,7 @@ struct bcm_op {struct hrtimer timer, thrtimer;ktime_t rx_stamp, kt_ival1, kt_ival2, kt_lastmsg;int rx_ifindex; +int if_detected;/* first received ifindex in ANYDEV rx_op mode */ int cfsiz;u32 count;u32 nframes;
@@ -758,6 +759,33 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data)return ; } +/* An ANYDEV op with an active RX timeout and/or throttle timer +* tracks a single source interface: claim the first interface that +* delivers a matching frame and reject frames from any other one, +* before hrtimer_cancel() below can touch op->timer - this avoids +* racing bcm_rx_timeout_handler() across concurrent interfaces. +* RX_RTR_FRAME ops are excluded, as kt_ival1/kt_ival2 may briefly +* hold a stale value from an earlier non-RTR configuration. +*/ +if (!op->ifindex) { +spin_lock_bh (&op->bcm_rx_update_lock); + +if (!(op->flags &RX_RTR_FRAME ) && + (op->kt_ival1 || op->kt_ival2)) { +/* don't claim to vanishing interface */ +if (!op->if_detected && + skb->dev->reg_state ==NETREG_REGISTERED ) + op->if_detected = skb->dev->ifindex; + +if (op->if_detected != skb->dev->ifindex) { +spin_unlock_bh (&op->bcm_rx_update_lock); +return ; + } + } + +spin_unlock_bh (&op->bcm_rx_update_lock); + } +/* disable timeout */ hrtimer_cancel (&op->timer);
@@ -784,10 +812,9 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data)*/ bcm_update_rx_stats (op); -/* save rx timestamp and originator for recvfrom() under lock. -* For an op subscribed on all interfaces (ifindex == 0) -* bcm_rx_handler() can run concurrently on different CPUs so -* the CAN content and the meta data must be bundled correctly. +/* save rx timestamp and originator for recvfrom() under lock: an +* ANYDEV op without an active timer can still run concurrently on +* different CPUs, so content and meta data must be bundled here. */ op->rx_stamp = skb->tstamp; op->rx_ifindex = skb->dev->ifindex;
@@ -1321,6 +1348,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, op->kt_ival1 =bcm_timeval_to_ktime (msg_head->ival1); op->kt_ival2 =bcm_timeval_to_ktime (msg_head->ival2); op->kt_lastmsg =0 ; + op->if_detected =0 ;/* reclaim ifindex in ANYDEV mode */ }spin_unlock_bh (&op->bcm_rx_update_lock);
@@ -1724,10 +1752,21 @@ static void bcm_notify(struct bcm_sock *bo, unsigned long msg,lock_sock (sk);/* rx_ops: remove device specific receive entries */ -list_for_each_entry (op, &bo->rx_ops, list) +list_for_each_entry (op, &bo->rx_ops, list) {if (op->rx_reg_dev == dev)bcm_rx_unreg (dev, op); +/* release an ANYDEV op's claim (see bcm_rx_handler()) +* on this now confirmed-gone interface. +*/ +if (!op->ifindex) { +spin_lock_bh (&op->bcm_rx_update_lock); +if (op->if_detected == dev->ifindex) + op->if_detected =0 ; +spin_unlock_bh (&op->bcm_rx_update_lock); + } + } +/* tx_ops: stop device specific cyclic transmissions on the * vanishing ifindex. Cancelling the timer is enough to stop * cyclic bcm_can_tx() calls as there is no re-arming.
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 17/609 can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <[email protected]>
commit 20bab8b88baac140ca3701116e1d486c7f51e311 upstream.
isotp_release() looked up the bound network device via dev_get_by_index() using the stored ifindex. During device unregistration the device is unlisted from the ifindex hash before the NETDEV_UNREGISTER notifier chain runs, so a concurrent isotp_release() could find no device, skip can_rx_unregister() entirely, and still proceed to free the socket. Since isotp_release() had already removed itself from the isotp notifier list at that point, isotp_notify() would never get a chance to clean up either, leaving a stale CAN filter that keeps pointing at the freed socket.
Fix this the same way raw.c already does: hold a tracked reference to the bound net_device in the socket (so->dev/so->dev_tracker) from bind() onward instead of re-resolving it from the ifindex, and serialize bind()/release() with rtnl_lock() so that so->dev is always consistent with what the NETDEV_UNREGISTER notifier sees. so->dev stays valid regardless of ifindex-hash unlisting, and is only ever cleared by whichever of isotp_release()/isotp_notify() gets there first, so the filter is always removed exactly once.
isotp_bind() now rejects a (re)bind with -EAGAIN while so->[tx|rx].state isn't ISOTP_IDLE yet, so a timer left running by a prior NETDEV_UNREGISTER can't act on a newly bound so->ifindex. Both checks share the same lock_sock() section, so there is no window in which a concurrent isotp_notify() clearing so->bound could be missed.
--- net/can/isotp.c | 88 +++++++++++++++++++++++++++++++++---------------- 1 file changed, 59 insertions(+), 29 deletions(-)
net/can/isotp.c +59 -29
@@ -137,6 +137,7 @@ struct isotp_sock {struct sock sk;int bound;int ifindex; +struct net_device *dev;canid_t txid;canid_t rxid;ktime_t tx_gap;
@@ -939,6 +940,14 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) goto err_event_drop; } +/* so->bound is only checked once above - a wakeup may have +* unbound/rebound the socket meanwhile, so re-validate it +*/ +if (!so->bound) { + err = -EADDRNOTAVAIL ; + goto err_out_drop; + } +if (!size || size >MAX_MSG_LENGTH ) { err = -EINVAL ; goto err_out_drop;
@@ -1164,28 +1173,30 @@ static int isotp_release(struct socket *sock)list_del (&so->notifier);spin_unlock (&isotp_notifier_lock); +rtnl_lock ();lock_sock (sk); -/* remove current filters & unregister */ -if (so->bound) { -if (so->ifindex) { -struct net_device *dev; - - dev =dev_get_by_index (net, so->ifindex); -if (dev) { -if (isotp_register_rxid (so)) -can_rx_unregister (net, dev, so->rxid, -SINGLE_MASK (so->rxid), - isotp_rcv, sk); - -can_rx_unregister (net, dev, so->txid, -SINGLE_MASK (so->txid), - isotp_rcv_echo, sk); -dev_put (dev); - } - } +/* remove current filters & unregister +* tracked reference so->dev is taken at bind() time with rtnl_lock +*/ +if (so->bound && so->dev) { +if (isotp_register_rxid (so)) +can_rx_unregister (net, so->dev, so->rxid, +SINGLE_MASK (so->rxid), + isotp_rcv, sk); + +can_rx_unregister (net, so->dev, so->txid, +SINGLE_MASK (so->txid), + isotp_rcv_echo, sk); +dev_put (so->dev); } + so->ifindex =0 ; + so->bound =0 ; + so->dev =NULL ; + +rtnl_unlock (); +/* Always wait for a grace period before touching the timers below. * A concurrent NETDEV_UNREGISTER may have already unregistered our * filters and cleared so->bound in isotp_notify() without waiting
@@ -1198,9 +1209,6 @@ static int isotp_release(struct socket *sock)hrtimer_cancel (&so->txtimer);hrtimer_cancel (&so->rxtimer); - so->ifindex =0 ; - so->bound =0 ; -sock_orphan (sk); sock->sk =NULL ;
@@ -1254,6 +1262,7 @@ static int isotp_bind(struct socket *sock, struct sockaddr *uaddr, int len)if (!addr->can_ifindex)return -ENODEV ; +rtnl_lock ();lock_sock (sk);if (so->bound) {
@@ -1261,6 +1270,17 @@ static int isotp_bind(struct socket *sock, struct sockaddr *uaddr, int len) goto out; } +/* A transmission or reception that outlived a previous binding +* (unbound by NETDEV_UNREGISTER) may still be draining; the FC/echo +* and RX watchdog timers bound how long this takes. Checked together +* with so->bound in the same lock_sock() section above, so there is +* no window in which a concurrent isotp_notify() could be missed. +*/ +if (so->tx.state !=ISOTP_IDLE || so->rx.state !=ISOTP_IDLE ) { + err = -EAGAIN ; + goto out; + } +/* ensure different CAN IDs when the rx_id is to be registered */ if (isotp_register_rxid (so) && rx_id == tx_id) { err = -EADDRNOTAVAIL ;
@@ -1273,14 +1293,12 @@ static int isotp_bind(struct socket *sock, struct sockaddr *uaddr, int len) goto out; }if (dev->type !=ARPHRD_CAN ) { -dev_put (dev); err = -ENODEV ; - goto out; + goto out_put_dev; } -if (dev->mtu < so->ll.mtu) { -dev_put (dev); +if (READ_ONCE (dev->mtu) < so->ll.mtu) { err = -EINVAL ; - goto out; + goto out_put_dev; }if (!(dev->flags &IFF_UP )) notify_enetdown =1 ;
@@ -1298,16 +1316,25 @@ static int isotp_bind(struct socket *sock, struct sockaddr *uaddr, int len)can_rx_register (net, dev, tx_id,SINGLE_MASK (tx_id), isotp_rcv_echo, sk,"isotpe" , sk); -dev_put (dev); -/* switch to new settings */ so->ifindex = ifindex; so->rxid = rx_id; so->txid = tx_id; so->bound =1 ; +/* bind() ok -> hold a reference for so->dev so that isotp_release() +* can safely reach the device later, even if a concurrent +* NETDEV_UNREGISTER has already unlisted it by ifindex. +*/ + so->dev = dev; +dev_hold (so->dev); + +out_put_dev: +/* remove potential reference from dev_get_by_index() */ +dev_put (dev); out:release_sock (sk); +rtnl_unlock ();if (notify_enetdown) { sk->sk_err =ENETDOWN ;
@@ -1510,7 +1537,7 @@ static void isotp_notify(struct isotp_sock *so, unsigned long msg,if (!net_eq (dev_net (dev),sock_net (sk)))return ; -if (so->ifindex != dev->ifindex) +if (so->dev != dev)return ;switch (msg) {
@@ -1526,10 +1553,12 @@ static void isotp_notify(struct isotp_sock *so, unsigned long msg,can_rx_unregister (dev_net (dev), dev, so->txid,SINGLE_MASK (so->txid), isotp_rcv_echo, sk); +dev_put (so->dev); } so->ifindex =0 ; so->bound =0 ; + so->dev =NULL ;release_sock (sk); sk->sk_err =ENODEV ;
@@ -1574,6 +1603,7 @@ static int isotp_init(struct sock *sk) so->ifindex =0 ; so->bound =0 ; + so->dev =NULL ; so->opt.flags =CAN_ISOTP_DEFAULT_FLAGS ; so->opt.ext_address =CAN_ISOTP_DEFAULT_EXT_ADDRESS ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 18/609 can: isotp: serialize TX state transitions under so->rx_lock
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <[email protected]>
commit cf070fe33bfbd1a4c21236078fadb35dd223a157 upstream.
The TX state machine (so->tx.state) is driven from three contexts:sendmsg() claiming and progressing a transfer, the RX path consuming Flow Control/echo frames, and two hrtimers timing out a stalled transfer. Mixing a lock-free cmpxchg() claim in sendmsg() with hrtimer_cancel() calls made under so->rx_lock elsewhere left windows where a frame or timer callback could act on a state that had already moved on, corrupting an unrelated transfer.
so->rx_lock now covers the full lifecycle of a TX claim: sendmsg() takes it to check so->tx.state is ISOTP_IDLE, switch it to ISOTP_SENDING, bump so->tx_gen and drain the previous transfer's timers - all as one critical section. isotp_rcv_fc()/isotp_rcv_cf() already run under this lock via isotp_rcv(), and isotp_rcv_echo() now takes it itself, so none of them can ever observe a transfer mid-claim. This also means a transfer can no longer be handed to sendmsg()'s cleanup paths (signal or send error) while another thread is concurrently claiming or finishing it, so those paths can cancel timers and reset the state unconditionally.
isotp_release() claims the socket the same way, so a racing sendmsg() sees a consistent ISOTP_SHUTDOWN and skips arming its timer or sending.
Only the hrtimer callbacks stay outside so->rx_lock, since they run under so->rx_lock's cancellation elsewhere and taking it themselves would deadlock. so->tx_gen lets them recognize whether the transfer they timed out is still the one currently active, so they don't report an error against a transfer that has since completed or been superseded.
--- net/can/isotp.c | 192 ++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 154 insertions(+), 38 deletions(-)
net/can/isotp.c +154 -38
@@ -142,7 +142,7 @@ struct isotp_sock {canid_t rxid;ktime_t tx_gap;ktime_t lastrxcf_tstamp; -struct hrtimer rxtimer, txtimer, txfrtimer; +struct hrtimer rxtimer, txtimer, txfrtimer, echotimer;struct can_isotp_options opt;struct can_isotp_fc_options rxfc, txfc;struct can_isotp_ll_options ll;
@@ -150,6 +150,7 @@ struct isotp_sock {u32 force_tx_stmin;u32 force_rx_stmin;u32 cfecho;/* consecutive frame echo tag */ +u32 tx_gen;/* generation, bumped per new tx transfer */ struct tpcon rx, tx;struct list_head notifier;wait_queue_head_t wait;
@@ -356,6 +357,15 @@ static int isotp_rcv_fc(struct isotp_sock *so, struct canfd_frame *cf, int ae)hrtimer_cancel (&so->txtimer); +/* isotp_tx_timeout() may have given up on this job while +* hrtimer_cancel() above waited for it to finish; so->rx_lock +* (held by our caller isotp_rcv()) rules out a concurrent claim, +* so a plain recheck is enough here. +*/ +if (so->tx.state !=ISOTP_WAIT_FC && + so->tx.state !=ISOTP_WAIT_FIRST_FC ) +return 1 ; +if ((cf->len < ae +FC_CONTENT_SZ ) || ((so->opt.flags &ISOTP_CHECK_PADDING ) &&check_pad (so, cf, ae +FC_CONTENT_SZ , so->opt.rxpad_content))) {
@@ -401,7 +411,7 @@ static int isotp_rcv_fc(struct isotp_sock *so, struct canfd_frame *cf, int ae) so->tx.bs =0 ; so->tx.state =ISOTP_SENDING ;/* send CF frame and enable echo timeout handling */ -hrtimer_start (&so->txtimer,ktime_set (ISOTP_ECHO_TIMEOUT ,0 ), +hrtimer_start (&so->echotimer,ktime_set (ISOTP_ECHO_TIMEOUT ,0 ),HRTIMER_MODE_REL_SOFT );isotp_send_cframe (so);break ;
@@ -544,6 +554,14 @@ static int isotp_rcv_cf(struct sock *sk, struct canfd_frame *cf, int ae,hrtimer_cancel (&so->rxtimer); +/* isotp_rx_timer_handler() may have raced us for so->rx.state +* while hrtimer_cancel() above waited for it to finish, already +* reporting ETIMEDOUT and resetting the reception; don't process +* this CF into a reassembly that has already been given up on. +*/ +if (so->rx.state !=ISOTP_WAIT_DATA ) +return 1 ; +/* CFs are never longer than the FF */ if (cf->len > so->rx.ll_dl)return 1 ;
@@ -833,20 +851,36 @@ static void isotp_rcv_echo(struct sk_buff *skb, void *data)struct canfd_frame *cf = (struct canfd_frame *)skb->data;/* only handle my own local echo CF/SF skb's (no FF!) */ -if (skb->sk != sk || so->cfecho != *(u32 *)cf->data) +if (skb->sk != sk)return ; +/* unlike isotp_rcv_fc()/isotp_rcv_cf(), not already under so->rx_lock +* (no isotp_rcv() caller here), so take it ourselves +*/ +spin_lock (&so->rx_lock); + +/* so->cfecho may since belong to a new transfer; recheck under lock */ +if (so->cfecho != *(u32 *)cf->data) + goto out_unlock; +/* cancel local echo timeout */ -hrtimer_cancel (&so->txtimer); +hrtimer_cancel (&so->echotimer);/* local echo skb with consecutive frame has been consumed */ so->cfecho =0 ; +/* claiming a transfer also takes so->rx_lock, so a plain recheck +* is enough: so->tx.state can't have flipped to ISOTP_SENDING for +* a new claim while we're still in here +*/ +if (so->tx.state !=ISOTP_SENDING ) + goto out_unlock; +if (so->tx.idx >= so->tx.len) {/* we are done */ so->tx.state =ISOTP_IDLE ;wake_up_interruptible (&so->wait); -return ; + goto out_unlock; }if (so->txfc.bs && so->tx.bs >= so->txfc.bs) {
@@ -854,53 +888,83 @@ static void isotp_rcv_echo(struct sk_buff *skb, void *data) so->tx.state =ISOTP_WAIT_FC ;hrtimer_start (&so->txtimer,ktime_set (ISOTP_FC_TIMEOUT ,0 ),HRTIMER_MODE_REL_SOFT ); -return ; + goto out_unlock; }/* no gap between data frames needed => use burst mode */ if (!so->tx_gap) {/* enable echo timeout handling */ -hrtimer_start (&so->txtimer,ktime_set (ISOTP_ECHO_TIMEOUT ,0 ), +hrtimer_start (&so->echotimer,ktime_set (ISOTP_ECHO_TIMEOUT ,0 ),HRTIMER_MODE_REL_SOFT );isotp_send_cframe (so); -return ; + goto out_unlock; }/* start timer to send next consecutive frame with correct delay */ hrtimer_start (&so->txfrtimer, so->tx_gap,HRTIMER_MODE_REL_SOFT ); + +out_unlock: +spin_unlock (&so->rx_lock); } -static enum hrtimer_restart isotp_tx_timer_handler (struct hrtimer *hrtimer) +/* shared by so->txtimer's and so->echotimer's callbacks. Both timers get +* cancelled under so->rx_lock elsewhere, so this must stay lock-free to +* avoid deadlocking with that; uses so->tx_gen instead to avoid tainting +* a new transfer with an error from the one that just timed out. +*/ +static enum hrtimer_restart isotp_tx_timeout (struct isotp_sock *so) { - struct isotp_sock *so = container_of(hrtimer, struct isotp_sock, - txtimer);struct sock *sk = &so->sk; +u32 gen =READ_ONCE (so->tx_gen); +u32 old_state =READ_ONCE (so->tx.state);/* don't handle timeouts in IDLE or SHUTDOWN state */ -if (so->tx.state ==ISOTP_IDLE || so->tx.state ==ISOTP_SHUTDOWN ) +if (old_state ==ISOTP_IDLE || old_state ==ISOTP_SHUTDOWN ) +return HRTIMER_NORESTART ; + +/* only claim the timeout if the state is still unchanged */ +if (cmpxchg (&so->tx.state, old_state,ISOTP_IDLE ) != old_state)return HRTIMER_NORESTART ;/* we did not get any flow control or echo frame in time */ -/* report 'communication error on send' */ - sk->sk_err =ECOMM ; -if (!sock_flag (sk,SOCK_DEAD )) -sk_error_report (sk); +if (READ_ONCE (so->tx_gen) == gen) { +/* report 'communication error on send' */ + sk->sk_err =ECOMM ; +if (!sock_flag (sk,SOCK_DEAD )) +sk_error_report (sk); + } -/* reset tx state */ - so->tx.state =ISOTP_IDLE ;wake_up_interruptible (&so->wait);return HRTIMER_NORESTART ; } +/* so->txtimer: fires when a Flow Control frame does not arrive in time */ +static enum hrtimer_restart isotp_tx_timer_handler (struct hrtimer *hrtimer) +{ + struct isotp_sock *so = container_of(hrtimer, struct isotp_sock, + txtimer); + +return isotp_tx_timeout (so); +} + +/* so->echotimer: fires when a sent CF/SF's local echo does not arrive */ +static enum hrtimer_restart isotp_echo_timer_handler (struct hrtimer *hrtimer) +{ + struct isotp_sock *so = container_of(hrtimer, struct isotp_sock, + echotimer); + +return isotp_tx_timeout (so); +} +static enum hrtimer_restart isotp_txfr_timer_handler (struct hrtimer *hrtimer) { struct isotp_sock *so = container_of(hrtimer, struct isotp_sock, txfrtimer);/* start echo timeout handling and cover below protocol error */ -hrtimer_start (&so->txtimer,ktime_set (ISOTP_ECHO_TIMEOUT ,0 ), +hrtimer_start (&so->echotimer,ktime_set (ISOTP_ECHO_TIMEOUT ,0 ),HRTIMER_MODE_REL_SOFT );/* cfecho should be consumed by isotp_rcv_echo() here */
@@ -920,13 +984,24 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)int ae = (so->opt.flags &CAN_ISOTP_EXTEND_ADDR ) ?1 :0 ;int wait_tx_done = (so->opt.flags &CAN_ISOTP_WAIT_TX_DONE ) ?1 :0 ;s64 hrtimer_sec =ISOTP_ECHO_TIMEOUT ; +struct hrtimer *tx_hrt = &so->echotimer; +u32 new_state =ISOTP_SENDING ;int off;int err;if (!so->bound || so->tx.state ==ISOTP_SHUTDOWN )return -EADDRNOTAVAIL ; -while (cmpxchg (&so->tx.state,ISOTP_IDLE ,ISOTP_SENDING ) !=ISOTP_IDLE ) { +/* claim the socket under so->rx_lock: this serializes the claim +* with the RX path and with sendmsg()'s own error paths below, so +* none of them can ever see a transfer mid-claim +*/ +for (;;) { +spin_lock_bh (&so->rx_lock); +if (READ_ONCE (so->tx.state) ==ISOTP_IDLE ) +break ; +spin_unlock_bh (&so->rx_lock); +/* we do not support multiple buffers - for now */ if (msg->msg_flags &MSG_DONTWAIT )return -EAGAIN ;
@@ -935,11 +1010,23 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)return -EADDRNOTAVAIL ;/* wait for complete transmission of current pdu */ - err =wait_event_interruptible (so->wait, so->tx.state ==ISOTP_IDLE ); + err =wait_event_interruptible (so->wait, + so->tx.state ==ISOTP_IDLE );if (err) - goto err_event_drop; +return err; } +/* new transfer: bump so->tx_gen and drain the old one's timers, +* still under the so->rx_lock we just claimed the socket with +*/ +WRITE_ONCE (so->tx.state,ISOTP_SENDING ); +WRITE_ONCE (so->tx_gen,READ_ONCE (so->tx_gen) +1 ); +hrtimer_cancel (&so->txtimer); +hrtimer_cancel (&so->echotimer); +hrtimer_cancel (&so->txfrtimer); + so->cfecho =0 ; +spin_unlock_bh (&so->rx_lock); +/* so->bound is only checked once above - a wakeup may have * unbound/rebound the socket meanwhile, so re-validate it */
@@ -1040,18 +1127,33 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) so->cfecho = *(u32 *)cf->data; }else {/* standard flow control check */ - so->tx.state =ISOTP_WAIT_FIRST_FC ; + new_state =ISOTP_WAIT_FIRST_FC ;/* start timeout for FC */ hrtimer_sec =ISOTP_FC_TIMEOUT ; + tx_hrt = &so->txtimer;/* no CF echo tag for isotp_rcv_echo() (FF-mode) */ so->cfecho =0 ; } } -hrtimer_start (&so->txtimer,ktime_set (hrtimer_sec,0 ), +spin_lock_bh (&so->rx_lock); +if (so->tx.state ==ISOTP_SHUTDOWN ) { +/* isotp_release() has since taken over and already drained +* our timers - don't send into a socket that's going away +*/ +spin_unlock_bh (&so->rx_lock); +kfree_skb (skb); +dev_put (dev); +wake_up_interruptible (&so->wait); +return -EADDRNOTAVAIL ; + } +/* WAIT_FIRST_FC for standard FF, else stays ISOTP_SENDING */ + so->tx.state = new_state; +hrtimer_start (tx_hrt,ktime_set (hrtimer_sec,0 ),HRTIMER_MODE_REL_SOFT ); +spin_unlock_bh (&so->rx_lock);/* send the first or only CAN frame */ cf->flags = so->ll.tx_flags;
@@ -1064,13 +1166,10 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)pr_notice_once ("can-isotp: %s: can_send_ret %pe\n" , __func__,ERR_PTR (err)); +spin_lock_bh (&so->rx_lock);/* no transmission -> no timeout monitoring */ -hrtimer_cancel (&so->txtimer); - -/* reset consecutive frame echo tag */ - so->cfecho =0 ; - - goto err_out_drop; +hrtimer_cancel (tx_hrt); + goto err_out_drop_locked; }if (wait_tx_done) {
@@ -1086,14 +1185,21 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)return size; +err_out_drop: +/* claimed but nothing sent yet - no timer to cancel */ +spin_lock_bh (&so->rx_lock); + goto err_out_drop_locked; err_event_drop: -/* got signal: force tx state machine to be idle */ - so->tx.state =ISOTP_IDLE ; +/* interrupted waiting on our own transfer - drain its timers */ +spin_lock_bh (&so->rx_lock);hrtimer_cancel (&so->txfrtimer);hrtimer_cancel (&so->txtimer); -err_out_drop: -/* drop this PDU and unlock a potential wait queue */ +hrtimer_cancel (&so->echotimer); +err_out_drop_locked: +/* release the claim; so->rx_lock still held from above */ + so->cfecho =0 ; so->tx.state =ISOTP_IDLE ; +spin_unlock_bh (&so->rx_lock);wake_up_interruptible (&so->wait);return err;
@@ -1155,13 +1261,20 @@ static int isotp_release(struct socket *sock) so =isotp_sk (sk); net =sock_net (sk); -/* wait for complete transmission of current pdu */ -while (wait_event_interruptible (so->wait, so->tx.state ==ISOTP_IDLE ) ==0 && -cmpxchg (&so->tx.state,ISOTP_IDLE ,ISOTP_SHUTDOWN ) !=ISOTP_IDLE ) +/* best-effort: wait for a running pdu to finish, but don't block on +* it forever - give up after the first signal +*/ +while (so->tx.state !=ISOTP_IDLE && +wait_event_interruptible (so->wait, so->tx.state ==ISOTP_IDLE ) ==0 ) ; -/* force state machines to be idle also when a signal occurred */ +/* claim the socket under so->rx_lock like sendmsg() does, so its +* claim can't race the forced ISOTP_SHUTDOWN below; force it +* unconditionally, even when a signal cut the wait above short +*/ +spin_lock_bh (&so->rx_lock); so->tx.state =ISOTP_SHUTDOWN ; +spin_unlock_bh (&so->rx_lock); so->rx.state =ISOTP_IDLE ;spin_lock (&isotp_notifier_lock);
@@ -1207,6 +1320,7 @@ static int isotp_release(struct socket *sock)hrtimer_cancel (&so->txfrtimer);hrtimer_cancel (&so->txtimer); +hrtimer_cancel (&so->echotimer);hrtimer_cancel (&so->rxtimer);sock_orphan (sk);
@@ -1629,6 +1743,8 @@ static int isotp_init(struct sock *sk) so->rxtimer.function = isotp_rx_timer_handler;hrtimer_init (&so->txtimer,CLOCK_MONOTONIC ,HRTIMER_MODE_REL_SOFT ); so->txtimer.function = isotp_tx_timer_handler; +hrtimer_init (&so->echotimer,CLOCK_MONOTONIC ,HRTIMER_MODE_REL_SOFT ); + so->echotimer.function = isotp_echo_timer_handler;hrtimer_init (&so->txfrtimer,CLOCK_MONOTONIC ,HRTIMER_MODE_REL_SOFT ); so->txfrtimer.function = isotp_txfr_timer_handler;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 19/609 dmaengine: sh: rz-dmac: Move interrupt request after everything is set up
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <[email protected]>
commit 731712403ddb39d1a76a11abf339a0615bc85de7 upstream.
Once the interrupt is requested, the interrupt handler may run immediately. Since the IRQ handler can access channel->ch_base, which is initialized only after requesting the IRQ, this may lead to invalid memory access. Likewise, the IRQ thread may access uninitialized data (the ld_free, ld_queue, and ld_active lists), which may also lead to issues.
Request the interrupts only after everything is set up. To keep the error path simpler, use dmam_alloc_coherent() instead of dma_alloc_coherent().
[tm: Kept the channel->irq field in rz_dmac_chan_probe() instead of
upstream's local irq variable, as commit 04e227718ab8 ("dmaengine: sh: rz-dmac: Make channel irq local") is not present in this tree. Likewise kept platform_get_irq_byname() instead of platform_get_irq_byname_optional() for the error IRQ in rz_dmac_probe(), as commit 6b3a6b6dc074 ("dmaengine: sh: rz_dmac: make error interrupt optional") is not present in this tree either; its early return on failure becomes a goto err jump to match the new call order.]
--- drivers/dma/sh/rz-dmac.c | 96 ++++++++++++++++------------------------ 1 file changed, 38 insertions(+), 58 deletions(-)
drivers/dma/sh/rz-dmac.c +38 -58
@@ -779,27 +779,6 @@ static int rz_dmac_chan_probe(struct rz_dmac *dmac, channel->index = index; channel->mid_rid = -EINVAL ; -/* Request the channel interrupt. */ -sprintf (pdev_irqname,"ch%u" , index); - channel->irq =platform_get_irq_byname (pdev, pdev_irqname); -if (channel->irq <0 ) -return channel->irq; - - irqname =devm_kasprintf (dmac->dev,GFP_KERNEL ,"%s:%u" , -dev_name (dmac->dev), index); -if (!irqname) -return -ENOMEM ; - - ret =devm_request_threaded_irq (dmac->dev, channel->irq, - rz_dmac_irq_handler, - rz_dmac_irq_handler_thread,0 , - irqname, channel); -if (ret) { -dev_err (dmac->dev,"failed to request IRQ %u (%d)\n" , - channel->irq, ret); -return ret; - } -/* Set io base address for each channel */ if (index <8 ) { channel->ch_base = dmac->base + CHANNEL_0_7_OFFSET +
@@ -812,9 +791,9 @@ static int rz_dmac_chan_probe(struct rz_dmac *dmac, }/* Allocate descriptors */ - lmdesc =dma_alloc_coherent (&pdev->dev, -sizeof (struct rz_lmdesc ) *DMAC_NR_LMDESC , - &channel->lmdesc.base_dma,GFP_KERNEL ); + lmdesc =dmam_alloc_coherent (&pdev->dev, +sizeof (struct rz_lmdesc ) *DMAC_NR_LMDESC , + &channel->lmdesc.base_dma,GFP_KERNEL );if (!lmdesc) {dev_err (&pdev->dev,"Can't allocate memory (lmdesc)\n" );return -ENOMEM ;
@@ -830,7 +809,26 @@ static int rz_dmac_chan_probe(struct rz_dmac *dmac,INIT_LIST_HEAD (&channel->ld_free);INIT_LIST_HEAD (&channel->ld_active); -return 0 ; +/* Request the channel interrupt. */ +sprintf (pdev_irqname,"ch%u" , index); + channel->irq =platform_get_irq_byname (pdev, pdev_irqname); +if (channel->irq <0 ) +return channel->irq; + + irqname =devm_kasprintf (dmac->dev,GFP_KERNEL ,"%s:%u" , +dev_name (dmac->dev), index); +if (!irqname) +return -ENOMEM ; + + ret =devm_request_threaded_irq (dmac->dev, channel->irq, + rz_dmac_irq_handler, + rz_dmac_irq_handler_thread,0 , + irqname, channel); +if (ret) +dev_err (dmac->dev,"failed to request IRQ %u (%d)\n" , + channel->irq, ret); + +return ret; }static int rz_dmac_parse_of (struct device *dev,struct rz_dmac *dmac)
@@ -857,7 +855,6 @@ static int rz_dmac_probe(struct platform_device *pdev)const char *irqname ="error" ;struct dma_device *engine;struct rz_dmac *dmac; -int channel_num;unsigned int i;int ret;int irq;
@@ -887,19 +884,6 @@ static int rz_dmac_probe(struct platform_device *pdev)if (IS_ERR (dmac->ext_base))return PTR_ERR (dmac->ext_base); -/* Register interrupt handler for error */ - irq =platform_get_irq_byname (pdev, irqname); -if (irq <0 ) -return irq; - - ret =devm_request_irq (&pdev->dev, irq, rz_dmac_irq_handler,0 , - irqname,NULL ); -if (ret) { -dev_err (&pdev->dev,"failed to request IRQ %u (%d)\n" , - irq, ret); -return ret; - } -/* Initialize the channels. */ INIT_LIST_HEAD (&dmac->engine.channels);
@@ -916,6 +900,21 @@ static int rz_dmac_probe(struct platform_device *pdev) goto err; } +/* Register interrupt handler for error */ + irq =platform_get_irq_byname (pdev, irqname); +if (irq <0 ) { + ret = irq; + goto err; + } + + ret =devm_request_irq (&pdev->dev, irq, rz_dmac_irq_handler,0 , + irqname,NULL ); +if (ret) { +dev_err (&pdev->dev,"failed to request IRQ %u (%d)\n" , + irq, ret); + goto err; + } +/* Register the DMAC as a DMA provider for DT. */ ret =of_dma_controller_register (pdev->dev.of_node, rz_dmac_of_xlate,NULL );
@@ -954,16 +953,6 @@ static int rz_dmac_probe(struct platform_device *pdev) dma_register_err:of_dma_controller_free (pdev->dev.of_node); err: - channel_num = i ? i -1 :0 ; -for (i =0 ; i < channel_num; i++) { -struct rz_dmac_chan *channel = &dmac->channels[i]; - -dma_free_coherent (&pdev->dev, -sizeof (struct rz_lmdesc ) *DMAC_NR_LMDESC , - channel->lmdesc.base, - channel->lmdesc.base_dma); - } -pm_runtime_put (&pdev->dev); err_pm_disable:pm_runtime_disable (&pdev->dev);
@@ -974,16 +963,7 @@ static int rz_dmac_probe(struct platform_device *pdev)static int rz_dmac_remove (struct platform_device *pdev) {struct rz_dmac *dmac =platform_get_drvdata (pdev); -unsigned int i; - -for (i =0 ; i < dmac->n_channels; i++) { -struct rz_dmac_chan *channel = &dmac->channels[i]; -dma_free_coherent (&pdev->dev, -sizeof (struct rz_lmdesc ) *DMAC_NR_LMDESC , - channel->lmdesc.base, - channel->lmdesc.base_dma); - }of_dma_controller_free (pdev->dev.of_node);dma_async_device_unregister (&dmac->engine);pm_runtime_put (&pdev->dev);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 20/609 gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikko Perttunen <[email protected]>
[ Upstream commit 266cddf7bd0f6c79b6c0633aef742a22bf70265b ]
__host1x_bo_unpin() drops the last reference to the mapping and frees it, so we can't dereference mapping afterwards. The cache itself outlives the mapping, so use the cache local variable instead.
--- drivers/gpu/host1x/bus.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/host1x/bus.c +2 -2
@@ -1025,10 +1025,10 @@ void host1x_bo_clear_cached_mappings(struct host1x_bo *bo)if (WARN_ON (!cache))continue ; -mutex_lock (&mapping->cache->lock); +mutex_lock (&cache->lock);WARN_ON (kref_read (&mapping->ref) !=1 );__host1x_bo_unpin (&mapping->ref); -mutex_unlock (&mapping->cache->lock); +mutex_unlock (&cache->lock); } }EXPORT_SYMBOL (host1x_bo_clear_cached_mappings);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 21/609 xprtrdma: Clear receive-side ownership pointers on release
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit 2ae8e7afbc63bf84243367f89eb43571f0345a74 ]
Three small ownership-state cleanups land the transport in a state that lets future reviewers reason about each pointer locally rather than tracing the whole reply path:
rpcrdma_rep_put() clears rep->rr_rqst before the rep enters rb_free_reps so that no rep on the free list still carries a stale rqst pointer. rpcrdma_reply_handler() and rpcrdma_unpin_rqst() are the only sites that set rr_rqst; rpcrdma_reply_handler() hands the rep through rpcrdma_rep_put(), and rpcrdma_unpin_rqst() NULLs rr_rqst directly because its error path abandons the rep for teardown cleanup rather than returning it to rb_free_reps.
rpcrdma_reply_put() NULLs req->rl_reply before calling rpcrdma_rep_put(). The previous order placed the rep on rb_free_reps while req->rl_reply still pointed at it; the window was harmless because xprt_rdma_free_slot() holds the req exclusively across the pair, but closing it makes the invariant 'rep on rb_free_reps implies no req references it' strictly checkable.
rpcrdma_sendctx_unmap() and rpcrdma_sendctx_cancel() clear req->rl_sendctx after dropping the sendctx pointer in the sendctx ring. Without this, req->rl_sendctx survives across Send completion and points at a sendctx that may already have been reassigned by rpcrdma_sendctx_get_locked() to a different req. No caller dereferences the stale pointer today -- rpcrdma_prepare_send_sges() overwrites it before the next Send -- but a NULL is a more honest representation of 'the Send is no longer outstanding' and lets the assertion patch that follows trip on any future regression.
--- net/sunrpc/xprtrdma/rpc_rdma.c | 4 ++++ net/sunrpc/xprtrdma/verbs.c | 12 ++++++++++-- 2 files changed, 14 insertions(+), 2 deletions(-)
net/sunrpc/xprtrdma/rpc_rdma.c +4 -0
@@ -542,6 +542,7 @@ void rpcrdma_sendctx_unmap(struct rpcrdma_sendctx *sc)rpcrdma_sendctx_dma_unmap (sc); sc->sc_req =NULL ; + req->rl_sendctx =NULL ;rpcrdma_req_put (req); }
@@ -550,8 +551,11 @@ void rpcrdma_sendctx_unmap(struct rpcrdma_sendctx *sc)*/ static void rpcrdma_sendctx_cancel (struct rpcrdma_sendctx *sc) { +struct rpcrdma_req *req = sc->sc_req; +rpcrdma_sendctx_dma_unmap (sc); sc->sc_req =NULL ; + req->rl_sendctx =NULL ; }/* Prepare an SGE for the RPC-over-RDMA transport header.
net/sunrpc/xprtrdma/verbs.c +10 -2
@@ -1067,9 +1067,15 @@ static struct rpcrdma_rep *rpcrdma_rep_get_locked(struct rpcrdma_buffer *buf)* @buf: buffer pool * @rep: rep to release * +* The rep's transient association with an rpc_rqst, established +* by rpcrdma_reply_handler() and torn down here, must not survive +* onto rb_free_reps: rpcrdma_post_recvs() pulls reps from the free +* list to re-post them, and a non-NULL rr_rqst on a free-listed rep +* would imply the rep is still referenced by a req. */ void rpcrdma_rep_put (struct rpcrdma_buffer *buf,struct rpcrdma_rep *rep) { + rep->rr_rqst =NULL ;llist_add (&rep->rr_node, &buf->rb_free_reps); }
@@ -1252,9 +1258,11 @@ rpcrdma_mr_get(struct rpcrdma_xprt *r_xprt)*/ void rpcrdma_reply_put (struct rpcrdma_buffer *buffers,struct rpcrdma_req *req) { -if (req->rl_reply) { -rpcrdma_rep_put (buffers, req->rl_reply); +struct rpcrdma_rep *rep = req->rl_reply; + +if (rep) { req->rl_reply =NULL ; +rpcrdma_rep_put (buffers, rep); }/* I2: rl_reply NULL after the put closes the * 'rep on rb_free_reps still referenced by req' window.
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 22/609 Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seungjin Bae <[email protected]>
[ Upstream commit 875115b82c295277b81b6dfee7debc725f44e854 ]
The ims_pcu_process_data() processes incoming URB data byte by byte. However, it fails to check if the read_pos index exceeds IMS_PCU_BUF_SIZE.
If a malicious USB device sends a packet larger than IMS_PCU_BUF_SIZE, read_pos will increment indefinitely. Moreover, since read_pos is located immediately after read_buf, the attacker can overwrite read_pos itself to arbitrarily control the index.
This manipulated read_pos is subsequently used in ims_pcu_handle_response() to copy data into cmd_buf, leading to a heap buffer overflow.
Specifically, an attacker can overwrite the cmd_done.wait.head located at offset 136 relative to cmd_buf in the ims_pcu_handle_response(). Consequently, when the driver calls complete(&pcu->cmd_done), it triggers a control flow hijack by using the manipulated pointer.
Fix this by adding a bounds check for read_pos before writing to read_buf. If the packet is too long, discard it, log a warning, and reset the parser state.
--- drivers/input/misc/ims-pcu.c | 32 ++++++++++++++++++++++++++------ 1 file changed, 26 insertions(+), 6 deletions(-)
drivers/input/misc/ims-pcu.c +26 -6
@@ -448,6 +448,14 @@ static void ims_pcu_handle_response(struct ims_pcu *pcu) } } +static void ims_pcu_reset_packet (struct ims_pcu *pcu) +{ + pcu->have_stx = true; + pcu->have_dle = false; + pcu->read_pos =0 ; + pcu->check_sum =0 ; +} +static void ims_pcu_process_data (struct ims_pcu *pcu,struct urb *urb) {int i;
@@ -460,6 +468,14 @@ static void ims_pcu_process_data(struct ims_pcu *pcu, struct urb *urb)continue ;if (pcu->have_dle) { +if (pcu->read_pos >=IMS_PCU_BUF_SIZE ) { +dev_warn (pcu->dev, +"Packet too long (%d bytes), discarding\n" , + pcu->read_pos); +ims_pcu_reset_packet (pcu); +continue ; + } + pcu->have_dle = false; pcu->read_buf[pcu->read_pos++] = data; pcu->check_sum += data;
@@ -472,10 +488,8 @@ static void ims_pcu_process_data(struct ims_pcu *pcu, struct urb *urb)dev_warn (pcu->dev,"Unexpected STX at byte %d, discarding old data\n" , pcu->read_pos); +ims_pcu_reset_packet (pcu); pcu->have_stx = true; - pcu->have_dle = false; - pcu->read_pos =0 ; - pcu->check_sum =0 ;break ;case IMS_PCU_PROTOCOL_DLE :
@@ -495,12 +509,18 @@ static void ims_pcu_process_data(struct ims_pcu *pcu, struct urb *urb)ims_pcu_handle_response (pcu); } - pcu->have_stx = false; - pcu->have_dle = false; - pcu->read_pos =0 ; +ims_pcu_reset_packet (pcu);break ;default : +if (pcu->read_pos >=IMS_PCU_BUF_SIZE ) { +dev_warn (pcu->dev, +"Packet too long (%d bytes), discarding\n" , + pcu->read_pos); +ims_pcu_reset_packet (pcu); +continue ; + } + pcu->read_buf[pcu->read_pos++] = data; pcu->check_sum += data;break ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 23/609 Input: ims-pcu - fix logic error in packet reset
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
[ Upstream commit 2c9b85a14abb4811e8d4773ccd13559e59792efb ]
ims_pcu_reset_packet() incorrectly sets have_stx to true, which implies that the start-of-packet delimiter has already been received. This causes the protocol parser to skip waiting for the next STX byte and potentially process garbage data.
Correctly set have_stx to false when resetting the packet state.
--- drivers/input/misc/ims-pcu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/input/misc/ims-pcu.c +1 -1
@@ -450,7 +450,7 @@ static void ims_pcu_handle_response(struct ims_pcu *pcu)static void ims_pcu_reset_packet (struct ims_pcu *pcu) { - pcu->have_stx = true; + pcu->have_stx = false; pcu->have_dle = false; pcu->read_pos =0 ; pcu->check_sum =0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 24/609 arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sumit Gupta <[email protected]>
[ Upstream commit 0dfa1e960f86e032007882b032c5cc7d14ebe73e ]
The Tegra234 SoC uses Cortex-A78AE cores, not Cortex-A78. Update the compatible string for all CPU nodes to match the actual hardware.
Tegra234 hardware reports:
# head /proc/cpuinfo | egrep 'implementer|part' CPU implementer : 0x41 CPU part : 0xd42
Which maps to (from arch/arm64/include/asm/cputype.h):
#define ARM_CPU_IMP_ARM 0x41
#define ARM_CPU_PART_CORTEX_A78AE 0xD42
--- arch/arm64/boot/dts/nvidia/tegra234.dtsi | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-)
arch/arm64/boot/dts/nvidia/tegra234.dtsi +12 -12
@@ -2659,7 +2659,7 @@ cpus { #size-cells = <0>; cpu0_0: cpu@0 { - compatible = "arm,cortex-a78"; + compatible = "arm,cortex-a78ae"; device_type = "cpu"; reg = <0x00000>;
@@ -2675,7 +2675,7 @@ cpu0_0: cpu@0 { }; cpu0_1: cpu@100 { - compatible = "arm,cortex-a78"; + compatible = "arm,cortex-a78ae"; device_type = "cpu"; reg = <0x00100>;
@@ -2691,7 +2691,7 @@ cpu0_1: cpu@100 { }; cpu0_2: cpu@200 { - compatible = "arm,cortex-a78"; + compatible = "arm,cortex-a78ae"; device_type = "cpu"; reg = <0x00200>;
@@ -2707,7 +2707,7 @@ cpu0_2: cpu@200 { }; cpu0_3: cpu@300 { - compatible = "arm,cortex-a78"; + compatible = "arm,cortex-a78ae"; device_type = "cpu"; reg = <0x00300>;
@@ -2723,7 +2723,7 @@ cpu0_3: cpu@300 { }; cpu1_0: cpu@10000 { - compatible = "arm,cortex-a78"; + compatible = "arm,cortex-a78ae"; device_type = "cpu"; reg = <0x10000>;
@@ -2739,7 +2739,7 @@ cpu1_0: cpu@10000 { }; cpu1_1: cpu@10100 { - compatible = "arm,cortex-a78"; + compatible = "arm,cortex-a78ae"; device_type = "cpu"; reg = <0x10100>;
@@ -2755,7 +2755,7 @@ cpu1_1: cpu@10100 { }; cpu1_2: cpu@10200 { - compatible = "arm,cortex-a78"; + compatible = "arm,cortex-a78ae"; device_type = "cpu"; reg = <0x10200>;
@@ -2771,7 +2771,7 @@ cpu1_2: cpu@10200 { }; cpu1_3: cpu@10300 { - compatible = "arm,cortex-a78"; + compatible = "arm,cortex-a78ae"; device_type = "cpu"; reg = <0x10300>;
@@ -2787,7 +2787,7 @@ cpu1_3: cpu@10300 { }; cpu2_0: cpu@20000 { - compatible = "arm,cortex-a78"; + compatible = "arm,cortex-a78ae"; device_type = "cpu"; reg = <0x20000>;
@@ -2803,7 +2803,7 @@ cpu2_0: cpu@20000 { }; cpu2_1: cpu@20100 { - compatible = "arm,cortex-a78"; + compatible = "arm,cortex-a78ae"; device_type = "cpu"; reg = <0x20100>;
@@ -2819,7 +2819,7 @@ cpu2_1: cpu@20100 { }; cpu2_2: cpu@20200 { - compatible = "arm,cortex-a78"; + compatible = "arm,cortex-a78ae"; device_type = "cpu"; reg = <0x20200>;
@@ -2835,7 +2835,7 @@ cpu2_2: cpu@20200 { }; cpu2_3: cpu@20300 { - compatible = "arm,cortex-a78"; + compatible = "arm,cortex-a78ae"; device_type = "cpu"; reg = <0x20300>;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 25/609 IB/mad: Drop unmatched RMPP responses before reassembly
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <[email protected]>
[ Upstream commit d2e52d610b9b09694261632340b801a421e0b0c5 ]
Kernel-handled RMPP receive processing starts reassembly for active DATA responses before the response is matched to an outstanding send. The normal match happens later, after ib_process_rmpp_recv_wc() has either assembled a complete message or consumed the segment.
That ordering lets an unsolicited response that routes to a kernel RMPP agent by the high TID bits allocate or extend RMPP receive state before the full TID and source address are checked against a real request. A reordered burst can therefore reach the receive-side insertion path even though the response would not match any send.
For kernel-handled RMPP DATA responses, require the existing ib_find_send_mad() match before entering RMPP reassembly. The matcher already checks the full TID, management class and source address/GID against the agent wait, backlog and in-flight send lists. If there is no match, drop the response without creating RMPP state.
This leaves the RMPP window behavior unchanged and only rejects responses that have no corresponding request.
--- drivers/infiniband/core/mad.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+)
drivers/infiniband/core/mad.c +30 -0
@@ -1778,6 +1778,24 @@ void ib_mark_mad_done(struct ib_mad_send_wr_private *mad_send_wr) &mad_send_wr->mad_agent_priv->done_list); } +static bool is_kernel_rmpp_data_response (struct ib_mad_agent_private *agent, +struct ib_mad_recv_wc *mad_recv_wc) +{ +const struct ib_mad_hdr *mad_hdr = &mad_recv_wc->recv_buf.mad->mad_hdr; +struct ib_rmpp_mad *rmpp_mad; + +if (!ib_mad_kernel_rmpp_agent (&agent->agent) || + !ib_response_mad (mad_hdr) || + !ib_is_mad_class_rmpp (mad_hdr->mgmt_class)) +return false; + + rmpp_mad = (struct ib_rmpp_mad *)mad_recv_wc->recv_buf.mad; + +return (ib_get_rmpp_flags (&rmpp_mad->rmpp_hdr) & +IB_MGMT_RMPP_FLAG_ACTIVE ) && + rmpp_mad->rmpp_hdr.rmpp_type ==IB_MGMT_RMPP_TYPE_DATA ; +} +static void ib_mad_complete_recv (struct ib_mad_agent_private *mad_agent_priv,struct ib_mad_recv_wc *mad_recv_wc) {
@@ -1796,6 +1814,18 @@ static void ib_mad_complete_recv(struct ib_mad_agent_private *mad_agent_priv, }list_add (&mad_recv_wc->recv_buf.list, &mad_recv_wc->rmpp_list); +if (is_kernel_rmpp_data_response (mad_agent_priv, mad_recv_wc)) { +spin_lock_irqsave (&mad_agent_priv->lock, flags); + mad_send_wr =ib_find_send_mad (mad_agent_priv, mad_recv_wc); +spin_unlock_irqrestore (&mad_agent_priv->lock, flags); + +if (!mad_send_wr) { +ib_free_recv_mad (mad_recv_wc); +deref_mad_agent (mad_agent_priv); +return ; + } + } +if (ib_mad_kernel_rmpp_agent (&mad_agent_priv->agent)) { mad_recv_wc =ib_process_rmpp_recv_wc (mad_agent_priv, mad_recv_wc);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 26/609 mtd: mtdswap: remove debugfs stats file on teardown
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit 66fb31358108d10245b9e4ef0eef3e7d9747055e ]
mtdswap_add_debugfs() creates an mtdswap_stats debugfs file under the per-MTD debugfs directory, but mtdswap_remove_dev() never removes it before freeing the mtdswap_dev.
Store the returned dentry and remove it during device teardown before the driver-private state is freed.
--- drivers/mtd/mtdswap.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/mtd/mtdswap.c +4 -1
@@ -125,6 +125,7 @@ struct mtdswap_dev {char *page_buf;char *oob_buf; +struct dentry *debugfs_stats; };struct mtdswap_oobdata {
@@ -1262,7 +1263,8 @@ static int mtdswap_add_debugfs(struct mtdswap_dev *d)if (IS_ERR_OR_NULL (root))return -1 ; -debugfs_create_file ("mtdswap_stats" ,S_IRUSR , root, d, &mtdswap_fops); + d->debugfs_stats =debugfs_create_file ("mtdswap_stats" ,0400 , root, + d, &mtdswap_fops);return 0 ; }
@@ -1463,6 +1465,7 @@ static void mtdswap_remove_dev(struct mtd_blktrans_dev *dev) {struct mtdswap_dev *d =MTDSWAP_MBD_TO_MTDSWAP (dev); +debugfs_remove (d->debugfs_stats);del_mtd_blktrans_dev (dev);mtdswap_cleanup (d);kfree (d);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 27/609 mtd: nand: mtk-ecc: stop on ECC idle timeouts
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit 16f7ec8d5dc100eafd2c8e06cd30340a30b104a1 ]
mtk_ecc_wait_idle() logs when the encoder or decoder does not become idle, but returns void. Callers can therefore configure a non-idle ECC engine or read parity bytes after an unconfirmed encoder idle state.
Return the idle poll result and propagate it from the enable and encode paths that require the engine to be idle before continuing.
--- drivers/mtd/nand/ecc-mtk.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
drivers/mtd/nand/ecc-mtk.c +12 -4
@@ -115,8 +115,8 @@ static int mt7622_ecc_regs[] = { [ECC_DECIRQ_STA] = 0x144, }; -static inline void mtk_ecc_wait_idle (struct mtk_ecc *ecc, -enum mtk_ecc_operation op) +static inline int mtk_ecc_wait_idle (struct mtk_ecc *ecc, +enum mtk_ecc_operation op) {struct device *dev = ecc->dev;u32 val;
@@ -128,6 +128,8 @@ static inline void mtk_ecc_wait_idle(struct mtk_ecc *ecc,if (ret)dev_warn (dev,"%s NOT idle\n" , op ==ECC_ENCODE ?"encoder" :"decoder" ); + +return ret; }static irqreturn_t mtk_ecc_irq (int irq,void *id)
@@ -304,7 +306,11 @@ int mtk_ecc_enable(struct mtk_ecc *ecc, struct mtk_ecc_config *config)return ret; } -mtk_ecc_wait_idle (ecc, op); + ret =mtk_ecc_wait_idle (ecc, op); +if (ret) { +mutex_unlock (&ecc->lock); +return ret; + } ret =mtk_ecc_config (ecc, config);if (ret) {
@@ -404,7 +410,9 @@ int mtk_ecc_encode(struct mtk_ecc *ecc, struct mtk_ecc_config *config,if (ret) goto timeout; -mtk_ecc_wait_idle (ecc,ECC_ENCODE ); + ret =mtk_ecc_wait_idle (ecc,ECC_ENCODE ); +if (ret) + goto timeout;/* Program ECC bytes to OOB: per sector oob = FDM + ECC + SPARE */ len = (config->strength * ecc->caps->parity_bits +7 ) >>3 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 28/609 btrfs: reject free space cache with more entries than pages
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <[email protected]>
[ Upstream commit a2d8d5647ed854e38f941741aea45b9eb15a6350 ]
When loading a v1 free space cache, __load_free_space_cache() takes num_entries and num_bitmaps straight from the on-disk btrfs_free_space_header. That header is stored in the tree_root under a key with type 0, which the tree-checker has no case for, so neither count is validated before the load trusts it.
The load loops num_entries times and maps the next page whenever the current one runs out, going through io_ctl_check_crc() -> io_ctl_map_page(), which does io_ctl->pages[io_ctl->index++]. But pages[] is allocated in io_ctl_init() from the cache inode's i_size, not from num_entries:
num_pages = DIV_ROUND_UP(i_size_read(inode), PAGE_SIZE); io_ctl->pages = kcalloc(num_pages, sizeof(struct page *), GFP_NOFS);
So if num_entries claims more records than the pages can hold, io_ctl->index runs off the end of pages[]. The write side never hits this because io_ctl_add_entry() and io_ctl_add_bitmap() both stop once io_ctl->index >= io_ctl->num_pages; the read side just never had the same check.
To trigger it, take a clean cache (num_entries = <N> here), set num_entries in the header to 0x10000, and fix up the leaf checksum so it still passes the tree-checker. The cache inode has i_size = 65536, so num_pages is 16 and pages[] is a 16-pointer (kmalloc-128) array. The load now tries to read 65536 entries, io_ctl->index walks up to 16, and pages[16] is read past the array:
BUG: KASAN: slab-out-of-bounds in io_ctl_check_crc (fs/btrfs/free-space-cache.c:420 fs/btrfs/free-space-cache.c:565) Read of size 8 at addr ffff88800c833a80 by task kworker/u8:3/58 io_ctl_check_crc (fs/btrfs/free-space-cache.c:420 fs/btrfs/free-space-cache.c:565) __load_free_space_cache (fs/btrfs/free-space-cache.c:655 fs/btrfs/free-space-cache.c:820) load_free_space_cache (fs/btrfs/free-space-cache.c:1017) caching_thread (fs/btrfs/block-group.c:880) btrfs_work_helper (fs/btrfs/async-thread.c:312) process_one_work worker_thread kthread ret_from_fork
free-space-cache.c:420 is io_ctl_map_page(), inlined into io_ctl_check_crc() at line 565, which is why that is the frame KASAN names. The out-of-bounds slot is then treated as a struct page and handed to crc32c(), so the bad read turns into a GP fault.
Add the missing check to io_ctl_check_crc(), which is where both the entry loop and the bitmap loop end up. When num_entries is too large the load now fails like any corrupt cache: __load_free_space_cache() drops it and rebuilds the free space from the extent tree, so a valid cache is never rejected.
--- fs/btrfs/free-space-cache.c | 3 +++ 1 file changed, 3 insertions(+)
fs/btrfs/free-space-cache.c +3 -0
@@ -569,6 +569,9 @@ static int io_ctl_check_crc(struct btrfs_io_ctl *io_ctl, int index)u32 crc = ~(u32 )0 ;unsigned offset =0 ; +if (index >= io_ctl->num_pages) +return -EIO ; +if (index ==0 ) offset =sizeof (u32) * io_ctl->num_pages;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 29/609 btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit ce6050bafb4e33377dc17fcc357736bfc351180c ]
If we have an unexpected reloc_root for our root, we jump to the out label but never drop the reference we obtained for root, resulting in a leak. Add a missing btrfs_put_root() call.
--- fs/btrfs/relocation.c | 1 + 1 file changed, 1 insertion(+)
fs/btrfs/relocation.c +1 -0
@@ -2045,6 +2045,7 @@ void merge_reloc_roots(struct reloc_control *rc)* corruption, e.g. bad reloc tree key offset. */ ret = -EINVAL ; +btrfs_put_root (root); goto out; } ret =merge_reloc_root (rc, root);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 30/609 firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Unnathi Chalicheemala <[email protected]>
[ Upstream commit 8ae5f8e4836667fcaffdf2e3c6068b0a8b364dd8 ]
ffa_partition_info_get() passes uuid_str directly to uuid_parse() without a NULL check. When a caller passes NULL, uuid_parse() -> __uuid_parse() -> uuid_is_valid() dereferences the pointer, causing a kernel panic:
| Unable to handle kernel NULL pointer dereference at virtual address | 0000000000000040 | pc : uuid_parse+0x40/0xac | lr : ffa_partition_info_get+0x1c/0x94 [arm_ffa]
Add a NULL guard before uuid_parse() so a NULL argument returns -ENODEV instead of crashing. Callers are expected to always supply a valid partition UUID, so NULL is not a supported input.
--- drivers/firmware/arm_ffa/driver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/firmware/arm_ffa/driver.c +1 -1
@@ -655,7 +655,7 @@ static int ffa_partition_info_get(const char *uuid_str,uuid_t uuid;struct ffa_partition_info *pbuf; -if (uuid_parse (uuid_str, &uuid)) { +if (!uuid_str ||uuid_parse (uuid_str, &uuid)) {pr_err ("invalid uuid (%s)\n" , uuid_str);return -ENODEV ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 31/609 RDMA/cma: Fix hardware address comparison length in netevent callback
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Or Gerlitz <[email protected]>
[ Upstream commit 18313833e2c6de222a4f6c072da759d0d5888528 ]
The cited commit hardcoded the hardware address comparison len to ETH_ALEN.
This breaks IPoIB, which uses 20-byte addresses. By truncating the memcmp, the CMA may incorrectly assume the target address is unchanged and fails to abort the stalled connection.
Fix this by replacing ETH_ALEN with the dynamic neigh->dev->addr_len to correctly evaluate the full address regardless of the link layer.
--- drivers/infiniband/core/cma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/core/cma.c +1 -1
@@ -5190,7 +5190,7 @@ static int cma_netevent_callback(struct notifier_block *self,list_for_each_entry (current_id, &ips_node->id_list, id_list_entry) {if (!memcmp (current_id->id.route.addr.dev_addr.dst_dev_addr, - neigh->ha,ETH_ALEN )) + neigh->ha, neigh->dev->addr_len))continue ;cma_id_get (current_id);if (!queue_work (cma_wq, ¤t_id->id.net_work))
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 32/609 RDMA/erdma: initialize ret for empty receive WR lists
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <[email protected]>
[ Upstream commit 2815a277c53e9a84784d6410cd55a9da5b33068d ]
erdma_post_recv() returns ret after walking the receive work request list. If the caller passes an empty list, the loop is skipped and ret is not assigned.
Initialize ret to 0 so an empty receive work request list returns success instead of stack data.
--- drivers/infiniband/hw/erdma/erdma_qp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/erdma/erdma_qp.c +1 -1
@@ -537,7 +537,7 @@ int erdma_post_recv(struct ib_qp *ibqp, const struct ib_recv_wr *recv_wr,const struct ib_recv_wr *wr = recv_wr;struct erdma_qp *qp =to_eqp (ibqp);unsigned long flags; -int ret; +int ret =0 ;spin_lock_irqsave (&qp->lock, flags);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 33/609 RDMA/hns: Fix potential integer overflow in mhop hem cleanup
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danila Chernetsov <[email protected]>
[ Upstream commit 9f0f2d2121f16d420199a82ac5bbc242269133b3 ]
In hns_roce_cleanup_mhop_hem_table(), the expression:
obj = i * buf_chunk_size / table->obj_size;
is evaluated using 32-bit unsigned arithmetic because 'buf_chunk_size' is u32 and the usual arithmetic conversions convert 'i' to unsigned int. The result is assigned to a u64 variable, but the multiplication may overflow before the assignment.
For sufficiently large HEM tables, this produces an incorrect object index passed to hns_roce_table_mhop_put().
Cast 'i' to u64 before the multiplication so that the intermediate calculation is performed with 64-bit arithmetic.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/infiniband/hw/hns/hns_roce_hem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/hns/hns_roce_hem.c +1 -1
@@ -907,7 +907,7 @@ static void hns_roce_cleanup_mhop_hem_table(struct hns_roce_dev *hr_dev, mhop.bt_chunk_size;for (i =0 ; i < table->num_hem; ++i) { - obj = i * buf_chunk_size / table->obj_size; + obj = (u64 )i * buf_chunk_size / table->obj_size;if (table->hem[i])hns_roce_table_mhop_put (hr_dev, table, obj,0 ); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 34/609 RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guoqing Jiang <[email protected]>
[ Upstream commit 788bbf4c2fc6e0c35bae9ed5068f484272539d3e ]
We can just check max_send_wr here given both max_send_wr and max_recv_wr are defined as u32 type, and we also need to ensure num_sqe (derived from max_send_wr) shouldn't be zero.
Stable-dep-of: bb27fcc67c42 ("RDMA/siw: publish QP after initialization")
--- drivers/infiniband/sw/siw/siw_verbs.c | 18 +++++------------- 1 file changed, 5 insertions(+), 13 deletions(-)
drivers/infiniband/sw/siw/siw_verbs.c +5 -13
@@ -336,11 +336,10 @@ int siw_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs, goto err_atomic; }/* -* NOTE: we allow for zero element SQ and RQ WQE's SGL's -* but not for a QP unable to hold any WQE (SQ + RQ) +* NOTE: we don't allow for a QP unable to hold any SQ WQE */ -if (attrs->cap.max_send_wr + attrs->cap.max_recv_wr ==0 ) { -siw_dbg (base_dev,"QP must have send or receive queue\n" ); +if (attrs->cap.max_send_wr ==0 ) { +siw_dbg (base_dev,"QP must have send queue\n" ); rv = -EINVAL ; goto err_atomic; }
@@ -360,21 +359,14 @@ int siw_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs,if (rv) goto err_atomic; - num_sqe = attrs->cap.max_send_wr; - num_rqe = attrs->cap.max_recv_wr;/* All queue indices are derived from modulo operations * on a free running 'get' (consumer) and 'put' (producer) * unsigned counter. Having queue sizes at power of two * avoids handling counter wrap around. */ -if (num_sqe) - num_sqe =roundup_pow_of_two (num_sqe); -else { -/* Zero sized SQ is not supported */ - rv = -EINVAL ; - goto err_out_xa; - } + num_sqe =roundup_pow_of_two (attrs->cap.max_send_wr); + num_rqe = attrs->cap.max_recv_wr;if (num_rqe) num_rqe =roundup_pow_of_two (num_rqe);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 35/609 RDMA/siw: publish QP after initialization
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <[email protected]>
[ Upstream commit bb27fcc67c429d97f785c92c35a6c5adebb05d7f ]
siw_create_qp() currently calls siw_qp_add() before the queues, CQ pointers, state, completion, and device list entry are ready. A QPN lookup can therefore reach a QP that is still being constructed.
Move siw_qp_add() to the end of siw_create_qp(), after QP initialization and before adding the QP to the siw device list.
--- drivers/infiniband/sw/siw/siw_verbs.c | 44 +++++++++++++++------------ 1 file changed, 24 insertions(+), 20 deletions(-)
drivers/infiniband/sw/siw/siw_verbs.c +24 -20
@@ -302,6 +302,7 @@ int siw_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs,struct siw_ucontext *uctx = rdma_udata_to_drv_context(udata, struct siw_ucontext, base_ucontext); +struct siw_uresp_create_qp uresp = {};unsigned long flags;int num_sqe, num_rqe, rv =0 ;size_t length;
@@ -355,11 +356,6 @@ int siw_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs,spin_lock_init (&qp->rq_lock);spin_lock_init (&qp->orq_lock); - rv =siw_qp_add (sdev, qp); -if (rv) - goto err_atomic; - -/* All queue indices are derived from modulo operations * on a free running 'get' (consumer) and 'put' (producer) * unsigned counter. Having queue sizes at power of two
@@ -377,14 +373,14 @@ int siw_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs,if (qp->sendq ==NULL ) { rv = -ENOMEM ; - goto err_out_xa; + goto err_out; }if (attrs->sq_sig_type !=IB_SIGNAL_REQ_WR ) {if (attrs->sq_sig_type ==IB_SIGNAL_ALL_WR ) qp->attrs.flags |=SIW_SIGNAL_ALL_WR ;else { rv = -EINVAL ; - goto err_out_xa; + goto err_out; } } qp->pd = pd;
@@ -410,7 +406,7 @@ int siw_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs,if (qp->recvq ==NULL ) { rv = -ENOMEM ; - goto err_out_xa; + goto err_out; } qp->attrs.rq_size = num_rqe; }
@@ -425,11 +421,8 @@ int siw_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs, qp->attrs.state =SIW_QP_STATE_IDLE ;if (udata) { -struct siw_uresp_create_qp uresp = {}; - uresp.num_sqe = num_sqe; uresp.num_rqe = num_rqe; - uresp.qp_id =qp_id (qp);if (qp->sendq) { length = num_sqe *sizeof (struct siw_sqe );
@@ -438,7 +431,7 @@ int siw_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs, length, &uresp.sq_key);if (!qp->sq_entry) { rv = -ENOMEM ; - goto err_out_xa; + goto err_out; } }
@@ -450,9 +443,23 @@ int siw_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs,if (!qp->rq_entry) { uresp.sq_key =SIW_INVAL_UOBJ_KEY ; rv = -ENOMEM ; - goto err_out_xa; + goto err_out; } } + } + qp->tx_cpu =siw_get_tx_cpu (sdev); +if (qp->tx_cpu <0 ) { + rv = -EINVAL ; + goto err_out; + } +init_completion (&qp->qp_free); + + rv =siw_qp_add (sdev, qp); +if (rv) + goto err_out_tx; + +if (udata) { + uresp.qp_id =qp_id (qp);if (udata->outlen <sizeof (uresp)) { rv = -EINVAL ;
@@ -462,22 +469,19 @@ int siw_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs,if (rv) goto err_out_xa; } - qp->tx_cpu =siw_get_tx_cpu (sdev); -if (qp->tx_cpu <0 ) { - rv = -EINVAL ; - goto err_out_xa; - } +INIT_LIST_HEAD (&qp->devq);spin_lock_irqsave (&sdev->lock, flags);list_add_tail (&qp->devq, &sdev->qp_list);spin_unlock_irqrestore (&sdev->lock, flags); -init_completion (&qp->qp_free); -return 0 ; err_out_xa:xa_erase (&sdev->qp_xa,qp_id (qp)); +err_out_tx: +siw_put_tx_cpu (qp->tx_cpu); +err_out:if (uctx) {rdma_user_mmap_entry_remove (qp->sq_entry);rdma_user_mmap_entry_remove (qp->rq_entry);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 36/609 selftests/alsa: Fix memory leak in find_controls error path
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Malaya Kumar Rout <[email protected]>
[ Upstream commit cb89f0c1aed02eb233c4271f76f830b37e222ff6 ]
In find_controls(), card_data is allocated with malloc() but when snd_ctl_open_lconf() fails, the code jumps to next_card without freeing the allocated memory. This results in a memory leak for each card where snd_ctl_open_lconf() fails.
Add free(card_data) before goto next_card to ensure proper cleanup of the allocated memory in the error path.
--- tools/testing/selftests/alsa/mixer-test.c | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/alsa/mixer-test.c +1 -0
@@ -130,6 +130,7 @@ static void find_controls(void)if (err <0 ) {ksft_print_msg ("Failed to get hctl for card %d: %s\n" , card,snd_strerror (err)); +free (card_data); goto next_card; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 37/609 RDMA/irdma: Prevent overflows in memory contiguity checks
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandrova Alyona <[email protected]>
[ Upstream commit 3cda0dfe8c651dcbb9e38977905d3d3b1750c4ab ]
irdma_check_mem_contiguous() and irdma_check_mr_contiguous() verify that PBL entries describe physically contiguous memory ranges.
Both functions calculate byte offsets using 32-bit operands. For example, with 4 KiB pages, pg_size * pg_idx overflows 32-bit arithmetic when pg_idx reaches 1048576. In the level-2 check, PBLE_PER_PAGE is 512, so i * pg_size * PBLE_PER_PAGE overflows when i reaches 2048.
These values are reachable in the driver. For MRs, palloc->total_cnt comes from iwmr->page_cnt, which is calculated by ib_umem_num_dma_blocks(). The MR size is limited by IRDMA_MAX_MR_SIZE, so a 4 GiB MR with 4 KiB pages can reach page_cnt of 1048576. PBLE resources do not exclude this value either: for gen3, the limit is based on avail_sds * MAX_PBLE_PER_SD, and MAX_PBLE_PER_SD is 0x40000, so 4 SDs are enough for 1048576 PBLEs.
Cast one operand to u64 before the multiplications so that the offset calculations are performed in 64-bit arithmetic.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/infiniband/hw/irdma/verbs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/infiniband/hw/irdma/verbs.c +2 -2
@@ -2336,7 +2336,7 @@ static bool irdma_check_mem_contiguous(u64 *arr, u32 npages, u32 pg_size)u32 pg_idx;for (pg_idx =0 ; pg_idx < npages; pg_idx++) { -if ((*arr + (pg_size * pg_idx)) != arr[pg_idx]) +if ((*arr + ((u64 )pg_size * pg_idx)) != arr[pg_idx])return false; }
@@ -2369,7 +2369,7 @@ static bool irdma_check_mr_contiguous(struct irdma_pble_alloc *palloc,for (i =0 ; i < lvl2->leaf_cnt; i++, leaf++) { arr = leaf->addr; -if ((*start_addr + (i * pg_size *PBLE_PER_PAGE )) != *arr) +if ((*start_addr + ((u64 )i * pg_size *PBLE_PER_PAGE )) != *arr)return false; ret =irdma_check_mem_contiguous (arr, leaf->cnt, pg_size);if (!ret)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 38/609 xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei (Microsoft) <[email protected]>
[ Upstream commit 136992de9bb91871084ae52d172610541c76e4d2 ]
On the error path where in6_dev_get(dev) returns NULL, xfrm6_fill_dst() releases the device reference with netdev_put() but leaves xdst->u.dst.dev set. dst_destroy() later calls netdev_put(dst->dev) again, so the same net_device reference is released twice, underflowing its refcount (ref_tracker WARNING + "unregister_netdevice: waiting for <dev> to become free").
Clear xdst->u.dst.dev after the netdev_put(), the same way the XFRM device-offload paths xfrm_dev_state_add() and xfrm_dev_policy_add() in net/xfrm/xfrm_device.c NULL ->dev when releasing the reference on error.
ref_tracker: reference already released.
ref_tracker: allocated in:
xfrm6_fill_dst (net/ipv6/xfrm6_policy.c:86)
...
udpv6_sendmsg (net/ipv6/udp.c:1696)
...
ref_tracker: freed in:
xfrm6_fill_dst (net/ipv6/xfrm6_policy.c:90)
...
WARNING: lib/ref_tracker.c:322 at ref_tracker_free+0x58b/0x780 dst_destroy (net/core/dst.c:115) rcu_core handle_softirqs ...
--- net/ipv6/xfrm6_policy.c | 1 + 1 file changed, 1 insertion(+)
net/ipv6/xfrm6_policy.c +1 -0
@@ -88,6 +88,7 @@ static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev, xdst->u.rt6.rt6i_idev =in6_dev_get (dev);if (!xdst->u.rt6.rt6i_idev) {netdev_put (dev, &xdst->u.dst.dev_tracker); + xdst->u.dst.dev =NULL ;return -ENODEV ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 39/609 xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei (Microsoft) <[email protected]>
[ Upstream commit f38f8cce2f7e79775b3db7e8a5eacda04ac908e4 ]
xfrm_hash_rebuild()'s first loop preallocates the bins/chains the reinsert loop needs, so the reinsert (after hlist_del_rcu()) cannot allocate or fail. But its guard is inverted: it skips policies with prefixlen < threshold and preallocates for the rest.
prefixlen < threshold is exactly when policy_hash_bysel() returns NULL and the reinsert takes the allocating xfrm_policy_inexact_insert() path. So the loop preallocates for the exact policies (which never allocate) and skips the inexact ones, whose bin/node is then allocated GFP_ATOMIC during reinsert. On failure the error path only WARN_ONCE()s and continues, leaving a poisoned bydst node; the next rebuild's hlist_del_rcu() dereferences LIST_POISON2 and takes a GPF. Reachable under memory pressure, deterministic via failslab.
Invert the guard so preallocation covers exactly the reinserted policies; the reinsert then allocates nothing and cannot fail.
Crash:
Oops: general protection fault, probably for non-canonical address 0xfbd59c0000000024: 0000 [#1] SMP KASAN NOPTI KASAN: maybe wild-memory-access in range [0xdead...] ... Workqueue: events xfrm_hash_rebuild RIP: 0010:xfrm_hash_rebuild+0x5b3/0x1190 RAX: dead000000000122 (LIST_POISON2 + offset) ... Call Trace: hlist_del_rcu (include/linux/rculist.h:599) xfrm_hash_rebuild (net/xfrm/xfrm_policy.c:1365) process_one_work (kernel/workqueue.c:3322) worker_thread (kernel/workqueue.c:3486) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) ... Kernel panic - not syncing: Fatal exception in interrupt
--- net/xfrm/xfrm_policy.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/xfrm/xfrm_policy.c +2 -2
@@ -1295,8 +1295,8 @@ static void xfrm_hash_rebuild(struct work_struct *work) } } -if (policy->selector.prefixlen_d < dbits || - policy->selector.prefixlen_s < sbits) +if (policy->selector.prefixlen_d >= dbits && + policy->selector.prefixlen_s >= sbits)continue ; bin =xfrm_policy_inexact_alloc_bin (policy, dir);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 40/609 wifi: cfg80211: cancel sched scan results work on unregister
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang <[email protected]>
[ Upstream commit edf0730be33696a1bd142792830d392129e495cc ]
cfg80211_sched_scan_results() can queue rdev->sched_scan_res_wk from a driver result notification while a scheduled scan request is present. The work callback recovers the containing cfg80211_registered_device and then locks the wiphy and walks the scheduled-scan request list.
wiphy_unregister() already makes the wiphy unreachable and drains rdev work items before cfg80211_dev_free() can release the object, but it does not drain sched_scan_res_wk. A queued or running result work item can therefore cross the unregister/free boundary and access freed rdev state.
The buggy scenario involves two paths, with each column showing the order within that path:
scheduled-scan result path: unregister/free path:
1. cfg80211_sched_scan_results() 1. interface teardown stops and
queues rdev->sched_scan_res_wk. removes the scheduled scan request.
2. cfg80211_wq starts the work 2. wiphy_unregister() drains other
item and recovers rdev. rdev work items.
3. The worker locks rdev->wiphy 3. cfg80211_dev_free() destroys and
and walks rdev state. frees rdev.
Cancel sched_scan_res_wk in wiphy_unregister() alongside the other rdev work items. cancel_work_sync() removes a pending result notification and waits for an already running callback, so cfg80211_dev_free() cannot free rdev while this work item is still active.
Validation reproduced this kernel report:
BUG: KASAN: use-after-free in cfg80211_sched_scan_results_wk+0x4a6/0x530 Workqueue: cfg80211 cfg80211_sched_scan_results_wk [cfg80211] Read of size 8 Call trace: dump_stack_lvl+0x66/0xa0 print_report+0xce/0x630 cfg80211_sched_scan_results_wk+0x4a6/0x530 srso_alias_return_thunk+0x5/0xfbef5 __virt_addr_valid+0x224/0x430 kasan_report+0xac/0xe0 lockdep_hardirqs_on_prepare+0xea/0x1a0 process_one_work+0x8d0/0x18f0 (kernel/workqueue.c:3212) lock_is_held_type+0x8f/0x100 worker_thread+0x5ad/0xfd0 __kthread_parkme+0xc6/0x200 kthread+0x31e/0x410 trace_hardirqs_on+0x1a/0x170 ret_from_fork+0x576/0x810 __switch_to+0x57e/0xe20 __switch_to_asm+0x33/0x70 ret_from_fork_asm+0x1a/0x30
--- net/wireless/core.c | 1 + 1 file changed, 1 insertion(+)
net/wireless/core.c +1 -0
@@ -1125,6 +1125,7 @@ void wiphy_unregister(struct wiphy *wiphy)/* this has nothing to do now but make sure it's gone */ cancel_work_sync (&rdev->wiphy_work); +cancel_work_sync (&rdev->sched_scan_res_wk);cancel_work_sync (&rdev->rfkill_block);cancel_work_sync (&rdev->conn_work);flush_work (&rdev->event_work);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 41/609 wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <[email protected]>
[ Upstream commit 0d388f62031dbabcba0f44bb91b59f10e88cac17 ]
The memory allocated in the ipw2100_alloc_device() function is not freed in some of the error paths in ipw2100_pci_init_one(). Fix that by converting the direct return into a goto to the error path return.
The error path when pci_enable_device() fails cannot jump to fail, since at this point priv is not set, so perform error handling inline.
--- drivers/net/wireless/intel/ipw2x00/ipw2100.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/wireless/intel/ipw2x00/ipw2100.c +4 -4
@@ -6183,6 +6183,8 @@ static int ipw2100_pci_init_one(struct pci_dev *pci_dev,if (err) { printk(KERN_WARNING DRV_NAME "Error calling pci_enable_device.\n"); +free_libipw (dev,0 ); +pci_iounmap (pci_dev, ioaddr);return err; }
@@ -6195,16 +6197,14 @@ static int ipw2100_pci_init_one(struct pci_dev *pci_dev,if (err) { printk(KERN_WARNING DRV_NAME "Error calling pci_set_dma_mask.\n"); -pci_disable_device (pci_dev); -return err; + goto fail; } err =pci_request_regions (pci_dev,DRV_NAME );if (err) { printk(KERN_WARNING DRV_NAME "Error calling pci_request_regions.\n"); -pci_disable_device (pci_dev); -return err; + goto fail; }/* We disable the RETRY_TIMEOUT register (0x41) to keep
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 42/609 wifi: mac80211_hwsim: clamp virtio RX length before skb_put
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <[email protected]>
[ Upstream commit 10a2b430f8f06ae14b9590b6f6faa6b588ef0654 ]
hwsim_virtio_rx_work() passes the virtqueue used-ring length reported by the device straight to skb_put() on a fixed-size receive skb. A backend reporting a length larger than the skb tailroom drives skb_put() past the buffer end and hits skb_over_panic() -- a host-triggerable guest panic (denial of service).
Clamp the length to the skb's available room before skb_put(). A conforming device never reports more than the posted buffer size, so valid frames are unaffected; a truncated over-report then fails the length/header checks in hwsim_virtio_handle_cmd() and is dropped, so truncating rather than dropping here cannot be turned into a parsing problem.
--- drivers/net/wireless/mac80211_hwsim.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/mac80211_hwsim.c +1 -0
@@ -5564,6 +5564,7 @@ static void hwsim_virtio_rx_work(struct work_struct *work) skb->data = skb->head;skb_reset_tail_pointer (skb); + len =min (len,skb_end_offset (skb));skb_put (skb, len);hwsim_virtio_handle_cmd (skb);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 43/609 wifi: libertas: fix memory leak in helper_firmware_cb()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dawei Feng <[email protected]>
[ Upstream commit 63c2391deefb31e1b801b7f32bd502ca4808639b ]
helper_firmware_cb() neglects to free the single-stage firmware image after a successful async load, leading to a memory leak in the USB firmware-download path.
Fix this memory leak by calling release_firmware() immediately after lbs_fw_loaded() returns.
The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in the current wireless tree.
An x86_64 allyesconfig build showed no new warnings. As we do not have compatible Libertas USB hardware for exercising this firmware-download path, no runtime testing was able to be performed.
--- drivers/net/wireless/marvell/libertas/firmware.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/marvell/libertas/firmware.c +1 -0
@@ -78,6 +78,7 @@ static void helper_firmware_cb(const struct firmware *firmware, void *context) }else {/* No main firmware needed for this helper --> success! */ lbs_fw_loaded (priv,0 , firmware,NULL ); +release_firmware (firmware); } }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 44/609 wifi: p54: validate RX frame length in p54_rx_eeprom_readback()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <[email protected]>
[ Upstream commit ebd6d37fa94bee929e0b4c9ca19fdf9b1dcf6cea ]
p54_rx_eeprom_readback() copies the requested EEPROM slice out of a device-supplied readback frame without checking that the skb actually holds that many bytes. Commit da1b9a55ff11 ("wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()") closed the destination overflow by copying a fixed priv->eeprom_slice_size (and rejecting a mismatched advertised len), but the source side is still unbounded: nothing verifies the frame is long enough to supply that many bytes.
A malicious USB device can send a short frame whose advertised len matches priv->eeprom_slice_size while the payload is truncated. The equality check passes and memcpy() reads past the end of the skb, leaking adjacent heap:
BUG: KASAN: slab-out-of-bounds in p54_rx (drivers/net/wireless/intersil/p54/txrx.c:507) Read of size 1016 at addr ffff88800f077114 by task swapper/0/0 Call Trace: <IRQ> ... __asan_memcpy (mm/kasan/shadow.c:105) p54_rx (drivers/net/wireless/intersil/p54/txrx.c:507) p54u_rx_cb (drivers/net/wireless/intersil/p54/p54usb.c:163) __usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1657) dummy_timer (drivers/usb/gadget/udc/dummy_hcd.c:2005) ... </IRQ> The buggy address belongs to the object at ffff88800f0770c0 which belongs to the cache skbuff_small_head of size 704 The buggy address is located 84 bytes inside of allocated 704-byte region [ffff88800f0770c0, ffff88800f077380)
Check that the slice fits in the skb before copying.
--- drivers/net/wireless/intersil/p54/txrx.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/net/wireless/intersil/p54/txrx.c +8 -0
@@ -499,11 +499,19 @@ static void p54_rx_eeprom_readback(struct p54_common *priv,if (le16_to_cpu (eeprom->v2.len) != priv->eeprom_slice_size)return ; +if (eeprom->v2.data + priv->eeprom_slice_size > +skb_tail_pointer (skb)) +return ; +memcpy (priv->eeprom, eeprom->v2.data, priv->eeprom_slice_size); }else {if (le16_to_cpu (eeprom->v1.len) != priv->eeprom_slice_size)return ; +if (eeprom->v1.data + priv->eeprom_slice_size > +skb_tail_pointer (skb)) +return ; +memcpy (priv->eeprom, eeprom->v1.data, priv->eeprom_slice_size); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 45/609 wifi: nl80211: free RNR data on MBSSID mismatch
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Li <[email protected]>
[ Upstream commit 07a95ec2b54774201fdf4ef7ffb0ca2ab19ed29c ]
nl80211_parse_beacon() rejects EMA RNR data when there are fewer RNR entries than MBSSID entries.
The rejected RNR allocation has not been attached to the beacon data yet, so free it before returning the error.
--- net/wireless/nl80211.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/wireless/nl80211.c +3 -1
@@ -5631,8 +5631,10 @@ static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,if (IS_ERR (rnr))return PTR_ERR (rnr); -if (rnr && rnr->cnt < bcn->mbssid_ies->cnt) +if (rnr && rnr->cnt < bcn->mbssid_ies->cnt) { +kfree (rnr);return -EINVAL ; + } bcn->rnr_ies = rnr; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 46/609 wifi: nl80211: validate nested MBSSID IE blobs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Li <[email protected]>
[ Upstream commit 7f4b01812323443b55e4c65381c9dc851ff009e3 ]
Validate each nested NL80211_ATTR_MBSSID_ELEMS entry as a well-formed information-element stream before storing it for beacon construction.
RNR parsing already validates each nested blob with validate_ie_attr() before storing it. Apply the same syntactic IE validation to MBSSID entries before counting and copying their data and length pointers.
--- net/wireless/nl80211.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
net/wireless/nl80211.c +10 -2
@@ -5433,7 +5433,8 @@ static int nl80211_parse_mbssid_config(struct wiphy *wiphy, }static struct cfg80211_mbssid_elems * -nl80211_parse_mbssid_elems (struct wiphy *wiphy,struct nlattr *attrs) +nl80211_parse_mbssid_elems (struct wiphy *wiphy,struct nlattr *attrs, +struct netlink_ext_ack *extack) {struct nlattr *nl_elems;struct cfg80211_mbssid_elems *elems;
@@ -5444,6 +5445,12 @@ nl80211_parse_mbssid_elems(struct wiphy *wiphy, struct nlattr *attrs)return ERR_PTR (-EINVAL );nla_for_each_nested (nl_elems, attrs, rem_elems) { +int ret; + + ret =validate_ie_attr (nl_elems, extack); +if (ret) +return ERR_PTR (ret); +if (num_elems >=255 )return ERR_PTR (-EINVAL ); num_elems++;
@@ -5615,7 +5622,8 @@ static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,if (attrs[NL80211_ATTR_MBSSID_ELEMS ]) {struct cfg80211_mbssid_elems *mbssid =nl80211_parse_mbssid_elems (&rdev->wiphy, - attrs[NL80211_ATTR_MBSSID_ELEMS ]); + attrs[NL80211_ATTR_MBSSID_ELEMS ], + extack);if (IS_ERR (mbssid))return PTR_ERR (mbssid);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 47/609 wifi: cfg80211: validate PMSR measurement type data
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Li <[email protected]>
[ Upstream commit 41aa973eb05922848dded26875c55ef982ac1c49 ]
PMSR request parsing accepts missing or duplicated measurement type entries in NL80211_PMSR_REQ_ATTR_DATA.
Track whether one measurement type was already provided, reject a second one immediately, and return an error if the request data block contains no measurement type at all.
--- net/wireless/pmsr.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-)
net/wireless/pmsr.c +17 -2
@@ -188,6 +188,7 @@ static int pmsr_parse_peer(struct cfg80211_registered_device *rdev, {struct nlattr *tb[NL80211_PMSR_PEER_ATTR_MAX +1 ];struct nlattr *req[NL80211_PMSR_REQ_ATTR_MAX +1 ]; +bool have_measurement_type = false;struct nlattr *treq;int err, rem;
@@ -240,6 +241,14 @@ static int pmsr_parse_peer(struct cfg80211_registered_device *rdev, }nla_for_each_nested (treq, req[NL80211_PMSR_REQ_ATTR_DATA ], rem) { +if (have_measurement_type) { +NL_SET_ERR_MSG_ATTR (info->extack, treq, +"multiple measurement types in request data" ); +return -EINVAL ; + } + + have_measurement_type = true; +switch (nla_type (treq)) {case NL80211_PMSR_TYPE_FTM : err =pmsr_parse_ftm (rdev, treq, out, info);
@@ -249,10 +258,16 @@ static int pmsr_parse_peer(struct cfg80211_registered_device *rdev, "unsupported measurement type"); err = -EINVAL ; } +if (err) +return err; } -if (err) -return err; +if (!have_measurement_type) { +NL_SET_ERR_MSG_ATTR (info->extack, + req[NL80211_PMSR_REQ_ATTR_DATA ], +"missing measurement type in request data" ); +return -EINVAL ; + }return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 48/609 wifi: cfg80211: validate PMSR FTM preamble range
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Li <[email protected]>
[ Upstream commit 36230936468f0ba4930e94aef496fc229d4bb951 ]
PMSR FTM request parsing accepts preamble values outside the enumerated nl80211 preamble range.
Reject out-of-range values before using them in the parser capability bit test using the policy.
--- net/wireless/nl80211.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/wireless/nl80211.c +3 -1
@@ -309,7 +309,9 @@ nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = {static const struct nla_policy nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX +1 ] = { [NL80211_PMSR_FTM_REQ_ATTR_ASAP ] = { .type =NLA_FLAG }, - [NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE ] = { .type =NLA_U32 }, + [NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE ] = +NLA_POLICY_RANGE (NLA_U32 ,NL80211_PREAMBLE_LEGACY , +NL80211_PREAMBLE_HE ), [NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP ] =NLA_POLICY_MAX (NLA_U8 ,15 ), [NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD ] = { .type =NLA_U16 },
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 49/609 wifi: cfg80211: reject unsupported PMSR FTM location requests
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Li <[email protected]>
[ Upstream commit 69ef6a7ec277f16d216be8da2b3cbe872786c999 ]
PMSR FTM location request flags are syntactically valid, but they must be rejected when the device capability does not advertise support for them.
Return an error immediately after rejecting unsupported LCI or civic location request bits so the request cannot reach the driver.
--- net/wireless/pmsr.c | 2 ++ 1 file changed, 2 insertions(+)
net/wireless/pmsr.c +2 -0
@@ -114,6 +114,7 @@ static int pmsr_parse_ftm(struct cfg80211_registered_device *rdev,NL_SET_ERR_MSG_ATTR (info->extack, tb[NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI ],"FTM: LCI request not supported" ); +return -EOPNOTSUPP ; } out->ftm.request_civicloc =
@@ -122,6 +123,7 @@ static int pmsr_parse_ftm(struct cfg80211_registered_device *rdev,NL_SET_ERR_MSG_ATTR (info->extack, tb[NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC ],"FTM: civic location request not supported" ); +return -EOPNOTSUPP ; } out->ftm.trigger_based =
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 50/609 wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang <[email protected]>
[ Upstream commit f3858d5b1432098c1936e03d6e03dd0e33facf60 ]
ieee80211_do_stop() removes AP_VLAN packets from the parent AP ps->bc_buf while holding ps->bc_buf.lock with IRQs disabled. It then calls ieee80211_free_txskb() before dropping the lock.
ieee80211_free_txskb() is not just a passive SKB release. For SKBs with TX status state it can report a dropped frame through cfg80211/nl80211, and that path can reach netlink tap transmit. This is the same reason the pending queue cleanup in ieee80211_do_stop() already unlinks SKBs under the queue lock and frees them after IRQ state is restored.
The buggy scenario involves two paths, with each column showing the order within that path:
AP_VLAN management TX: AP_VLAN stop: 1. attach ACK-status state 1. clear the running state 2. queue a multicast SKB on 2. take ps->bc_buf.lock with IRQs
parent ps->bc_buf disabled
3. unlink the AP_VLAN SKB
4. call ieee80211_free_txskb()
Unlink matching AP_VLAN SKBs from ps->bc_buf under the existing lock, but move them to a local free queue. Drop the lock and restore IRQ state before calling ieee80211_free_txskb().
WARNING: kernel/softirq.c:430 at __local_bh_enable_ip
--- net/mac80211/iface.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
net/mac80211/iface.c +7 -1
@@ -593,6 +593,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_doWARN_ON (!list_empty (&sdata->u.ap.vlans)); }else if (sdata->vif.type ==NL80211_IFTYPE_AP_VLAN ) {/* remove all packets in parent bc_buf pointing to this dev */ +__skb_queue_head_init (&freeq); ps = &sdata->bss->ps;spin_lock_irqsave (&ps->bc_buf.lock, flags);
@@ -600,10 +601,15 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_doif (skb->dev == sdata->dev) {__skb_unlink (skb, &ps->bc_buf); local->total_ps_buffered--; -ieee80211_free_txskb (&local->hw, skb); +__skb_queue_tail (&freeq, skb); } }spin_unlock_irqrestore (&ps->bc_buf.lock, flags); + + skb_queue_walk_safe(&freeq, skb, tmp) { +__skb_unlink (skb, &freeq); +ieee80211_free_txskb (&local->hw, skb); + } }if (going_down)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 51/609 wifi: brcmfmac: initialize SDIO data work before cleanup
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <[email protected]>
[ Upstream commit 2a665946e0407a05a3f81bd56a08553c446498e0 ]
brcmf_sdio_probe() stores the newly allocated bus in sdiodev->bus before allocating the ordered workqueue. If that allocation fails, the function jumps to fail and calls brcmf_sdio_remove().
brcmf_sdio_remove() unconditionally cancels bus->datawork. Initialize the work item before the first failure path that can reach brcmf_sdio_remove(), so the cleanup path always observes a valid work object.
This issue was found by our static analysis tool and then confirmed by manual review of the probe error path and the remove-time work drain. The problem pattern is an early setup failure that reaches a cleanup helper which cancels an embedded work item before its initializer has run.
A QEMU PoC forced alloc_ordered_workqueue() to fail at the same point in brcmf_sdio_probe(), before INIT_WORK(&bus->datawork) is reached. The resulting fail path calls brcmf_sdio_remove(), and DEBUG_OBJECTS reports the invalid work drain with brcmf_sdio_probe() and brcmf_sdio_remove() in the stack.
--- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c +1 -1
@@ -4451,6 +4451,7 @@ struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev) bus->sdiodev = sdiodev; sdiodev->bus = bus;skb_queue_head_init (&bus->glom); +INIT_WORK (&bus->datawork, brcmf_sdio_dataworker); bus->txbound =BRCMF_TXBOUND ; bus->rxbound =BRCMF_RXBOUND ; bus->txminmax =BRCMF_TXMINMAX ;
@@ -4464,7 +4465,6 @@ struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev) goto fail; }brcmf_sdiod_freezer_count (sdiodev); -INIT_WORK (&bus->datawork, brcmf_sdio_dataworker); bus->brcmf_wq = wq;/* attempt to attach to the dongle */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 52/609 wifi: cfg80211: bound element ID read when checking non-inheritance
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: HE WEI (ギカク) <[email protected]>
[ Upstream commit cb8afea4655ff004fa7feee825d5c79783525383 ]
cfg80211_is_element_inherited() reads the first data octet of the candidate element (id = elem->data[0]) to look it up in an extension non-inheritance list. It does so after testing elem->id, but without verifying that the element actually has a data octet. A zero-length extension element (WLAN_EID_EXTENSION with length 0) therefore makes it read one octet past the end of the element.
_ieee802_11_parse_elems_full() runs this check for every element of a frame once a non-inheritance context exists -- e.g. while parsing a per-STA profile of a Multi-Link element in a (re)association response, or a non-transmitted BSS profile -- so a crafted frame from an AP can trigger a one-octet slab-out-of-bounds read during element parsing:
BUG: KASAN: slab-out-of-bounds in cfg80211_is_element_inherited Read of size 1 ... in net/wireless/scan.c
Return early (treat the element as inherited) when an extension element carries no data, mirroring the existing handling of empty ID lists.
The bug was found by fuzzing ieee802_11_parse_elems_full() under KASAN.
--- net/wireless/scan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/wireless/scan.c +1 -1
@@ -240,7 +240,7 @@ bool cfg80211_is_element_inherited(const struct element *elem,return true;if (elem->id ==WLAN_EID_EXTENSION ) { -if (!ext_id_len) +if (!ext_id_len || !elem->datalen)return true; loop_len = ext_id_len; list = &non_inherit_elem->data[3 + id_len];
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 53/609 ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Hewitt <[email protected]>
[ Upstream commit 6b59c53c8adc2b522327407af5e1793a65b67e4b ]
The I2S FIFO soft-resets its fast domain on start (AIU_RST_SOFT bit 0 + AIU_I2S_SYNC read in aiu_fifo_i2s_trigger), mirroring the downstream vendor driver's audio_out_i2s_enable(). The S/PDIF FIFO has no equivalent:
it only toggles the IEC958 DCU, so a stale datapath FIFO can be replayed, producing the "machine gun noise" buffer underrun - on start when switching outputs, and on stop when playback ends. The latter is audible on devices with an always-on S/PDIF-fed DAC (e.g. the ES7144 on the WeTek Play2).
The vendor driver resets the IEC958 fast domain (AIU_RST_SOFT bit 2) on both enable and disable (audio_hw_958_enable), and when reconfiguring (audio_hw_958_reset clears AIU_958_DCU_FF_CTRL then resets). Do the same:
reset before enabling the DCU on start, and before disabling on stop.
--- sound/soc/meson/aiu-fifo-spdif.c | 5 +++++ 1 file changed, 5 insertions(+)
sound/soc/meson/aiu-fifo-spdif.c +5 -0
@@ -24,6 +24,7 @@#define AIU_MEM_IEC958_CONTROL_MODE_16BIT BIT(7)#define AIU_MEM_IEC958_CONTROL_MODE_LINEAR BIT(8)#define AIU_MEM_IEC958_BUF_CNTL_INIT BIT(0) +#define AIU_RST_SOFT_958_FAST BIT(2)#define AIU_FIFO_SPDIF_BLOCK 8
@@ -68,11 +69,15 @@ static int fifo_spdif_trigger(struct snd_pcm_substream *substream, int cmd,case SNDRV_PCM_TRIGGER_START :case SNDRV_PCM_TRIGGER_RESUME :case SNDRV_PCM_TRIGGER_PAUSE_RELEASE : +snd_soc_component_write (component,AIU_RST_SOFT , +AIU_RST_SOFT_958_FAST );fifo_spdif_dcu_enable (component, true);break ;case SNDRV_PCM_TRIGGER_SUSPEND :case SNDRV_PCM_TRIGGER_PAUSE_PUSH :case SNDRV_PCM_TRIGGER_STOP : +snd_soc_component_write (component,AIU_RST_SOFT , +AIU_RST_SOFT_958_FAST );fifo_spdif_dcu_enable (component, false);break ;default :
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 54/609 ASoC: amd: ps: fix wrong ACP version string in pci_request_regions()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vijendar Mukunda <[email protected]>
[ Upstream commit f7697ecf6eab9d4887dd731038b3dc405c7e755e ]
The driver handles ACP6.3/7.0/7.1/7.2 platforms but the region was claimed with the stale name "AMD ACP6.2 audio" left over from the original ACP6.2 driver. Correct it to "AMD ACP6.3 audio".
--- sound/soc/amd/ps/pci-ps.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/amd/ps/pci-ps.c +1 -1
@@ -163,7 +163,7 @@ static int snd_acp63_probe(struct pci_dev *pci,return -ENODEV ; } - ret =pci_request_regions (pci,"AMD ACP6.2 audio" ); + ret =pci_request_regions (pci,"AMD ACP6.3 audio" );if (ret <0 ) {dev_err (&pci->dev,"pci_request_regions failed\n" ); goto disable_pci;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 55/609 ASoC: tas2562: fix deprecated shut-down GPIO always cleared after lookup
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uday Khare <[email protected]>
[ Upstream commit 3238c634725afbb2a137fdda762208510828f71d ]
In tas2562_parse_dt(), the fallback lookup for the deprecated "shut-down" GPIO property is broken due to a missing pair of braces.
The code intends to reset sdz_gpio to NULL only when the lookup returns an error that is not -EPROBE_DEFER (so the driver gracefully continues without a GPIO). However, without braces the statement:
tas2562->sdz_gpio = NULL;
falls outside the IS_ERR() check and is executed unconditionally for every path through the if block, including a successful GPIO lookup.
This means any device using the deprecated 'shut-down' DT property will always have sdz_gpio == NULL after probe, making the GPIO completely non-functional.
Fix this by adding the missing braces to scope the NULL assignment inside the IS_ERR() branch, matching the pattern already used for the primary 'shutdown' GPIO lookup above.
--- sound/soc/codecs/tas2562.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
sound/soc/codecs/tas2562.c +3 -2
@@ -685,11 +685,12 @@ static int tas2562_parse_dt(struct tas2562_data *tas2562)if (tas2562->sdz_gpio ==NULL ) { tas2562->sdz_gpio =devm_gpiod_get_optional (dev,"shut-down" ,GPIOD_OUT_HIGH ); -if (IS_ERR (tas2562->sdz_gpio)) +if (IS_ERR (tas2562->sdz_gpio)) {if (PTR_ERR (tas2562->sdz_gpio) == -EPROBE_DEFER )return -EPROBE_DEFER ; - tas2562->sdz_gpio =NULL ; + tas2562->sdz_gpio =NULL ; + } }if (tas2562->model_id ==TAS2110 )
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 56/609 firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pushpendra Singh <[email protected]>
[ Upstream commit a4447c0693830d5ecadd6e755cb7fdc55d86aacc ]
The scmi_notify() function is called from interrupt context to queue received notification events onto a per-protocol kfifo. When the kfifo is full, it logs a warning via dev_warn() for every dropped event.
Under conditions where the platform sends a burst of SCMI notifications faster than the deferred worker can drain the queue, this results in a flood of dev_warn() calls from IRQ context. Each call acquires the console lock and may execute blocking console writes, causing the CPU to be held in interrupt context for an extended period and leading to observable system stalls.
Fix this by switching to dev_warn_ratelimited() to limit the frequency of log messages when the notification queue is full. This reduces console overhead in interrupt context and prevents CPU stalls caused by excessive logging, while still preserving diagnostic visibility.
--- drivers/firmware/arm_scmi/notify.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/firmware/arm_scmi/notify.c +3 -3
@@ -595,9 +595,9 @@ int scmi_notify(const struct scmi_handle *handle, u8 proto_id, u8 evt_id,return -EINVAL ; }if (kfifo_avail (&r_evt->proto->equeue.kfifo) <sizeof (eh) + len) { -dev_warn (handle->dev, -"queue full, dropping proto_id:%d evt_id:%d ts:%lld\n" , - proto_id, evt_id,ktime_to_ns (ts)); +dev_warn_ratelimited (handle->dev, +"queue full, dropping proto_id:%d evt_id:%d ts:%lld\n" , + proto_id, evt_id,ktime_to_ns (ts));return -ENOMEM ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 57/609 ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Norbert Szetei <[email protected]>
[ Upstream commit ec4215683e47424c9c4762fd3c60f552a3119142 ]
pppol2tp_recv() runs in the L2TP UDP-encap softirq RX path:
l2tp_udp_encap_recv() -> l2tp_recv_common() -> pppol2tp_recv()
-> ppp_input(&po->chan)
It runs under rcu_read_lock() holding only an l2tp_session reference and takes NO reference on the internal PPP channel (struct channel, chan->ppp) that ppp_input() dereferences.
The pppox socket is SOCK_RCU_FREE, so 'po' and the embedded ppp_channel are RCU-safe. But the internal struct channel is a separate allocation that ppp_release_channel() frees with a plain kfree():
close(data socket) -> pppol2tp_release() -> pppox_unbind_sock()
-> ppp_unregister_channel() -> ppp_release_channel() -> kfree(pch)
For a channel that is bound (PPPIOCGCHAN) but not attached to a ppp unit (no PPPIOCCONNECT, pch->ppp == NULL) and not bridged, teardown skips both ppp_disconnect_channel()'s synchronize_net() and ppp_unbridge_channels()'s synchronize_rcu(), so the kfree() has no grace period. rcu_read_lock() in pppol2tp_recv() does not protect against a plain kfree(), so an in-flight ppp_input() on one CPU can dereference the channel just freed by close() on another CPU.
The bug is reachable by an unprivileged user.
Defer the channel free to an RCU callback via call_rcu() so the grace period fences any in-flight ppp_input(). The disconnect and unbridge teardown paths already fence with synchronize_net()/synchronize_rcu(); call_rcu() does the same here without stalling the close() path.
--- drivers/net/ppp/ppp_generic.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
drivers/net/ppp/ppp_generic.c +15 -3
@@ -192,6 +192,7 @@ struct channel {struct list_head clist;/* link in list of channels per unit */ rwlock_t upl;/* protects `ppp' and 'bridge' */ struct channel __rcu *bridge;/* "bridged" ppp channel */ +struct rcu_head rcu;/* for RCU-deferred free of the channel */ #ifdef CONFIG_PPP_MULTILINK u8 avail;/* flag used in multilink stuff */ u8 had_frag;/* >= 1 fragments have been sent */
@@ -3555,6 +3556,18 @@ ppp_disconnect_channel(struct channel *pch)return err; } +/* Purge after the grace period: a late ppp_input() may still queue an +* skb on pch->file.rq before the last RCU reader drains. +*/ +static void ppp_release_channel_free (struct rcu_head *rcu) +{ + struct channel *pch = container_of(rcu, struct channel, rcu); + +skb_queue_purge (&pch->file.xq); +skb_queue_purge (&pch->file.rq); +kfree (pch); +} +/* * Free up the resources used by a ppp channel. */
@@ -3570,9 +3583,7 @@ static void ppp_destroy_channel(struct channel *pch)pr_err ("ppp: destroying undead channel %p !\n" , pch);return ; } -skb_queue_purge (&pch->file.xq); -skb_queue_purge (&pch->file.rq); -kfree (pch); +call_rcu (&pch->rcu, ppp_release_channel_free); } static void __exit ppp_cleanup(void)
@@ -3585,6 +3596,7 @@ static void __exit ppp_cleanup(void)device_destroy (ppp_class,MKDEV (PPP_MAJOR ,0 ));class_destroy (ppp_class);unregister_pernet_device (&ppp_net_ops); +rcu_barrier ();/* wait for RCU callbacks before module unload */ }/*
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 58/609 ipv4: fib: free fib_alias with kfree_rcu() on insert error path
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <[email protected]>
[ Upstream commit f2f152e94a67bc746afaf05a1b2702c195553112 ]
fib_table_insert() publishes new_fa into the leaf's fa_list with fib_insert_alias() before calling the fib entry notifiers. When a notifier fails, the error path removes new_fa with fib_remove_alias() (hlist_del_rcu) and frees it right away with kmem_cache_free().
fib_table_lookup() walks that list under rcu_read_lock() only, so a concurrent lookup that already reached new_fa keeps reading it after the free:
BUG: KASAN: slab-use-after-free in fib_table_lookup (net/ipv4/fib_trie.c:1601) Read of size 1 at addr ffff88810676d4eb by task exploit/297 Call Trace: fib_table_lookup (net/ipv4/fib_trie.c:1601) ip_route_output_key_hash_rcu (net/ipv4/route.c:2814) ip_route_output_key_hash (net/ipv4/route.c:2705) __ip4_datagram_connect (net/ipv4/datagram.c:49) udp_connect (net/ipv4/udp.c:2144) __sys_connect (net/socket.c:2167) __x64_sys_connect (net/socket.c:2173) do_syscall_64 entry_SYSCALL_64_after_hwframe which belongs to the cache ip_fib_alias of size 56
Triggering the error path needs CAP_NET_ADMIN and a registered fib notifier that can reject a route; a netdevsim device whose IPv4 FIB resource is exhausted is enough.
Free new_fa with alias_free_mem_rcu(), as fib_table_delete() already does for a fib_alias removed from the trie.
--- net/ipv4/fib_trie.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/fib_trie.c +1 -1
@@ -1390,7 +1390,7 @@ int fib_table_insert(struct net *net, struct fib_table *tb, out_remove_new_fa:fib_remove_alias (t, tp, l, new_fa); out_free_new_fa: -kmem_cache_free (fn_alias_kmem, new_fa); +alias_free_mem_rcu (new_fa); out:fib_release_info (fi); err:
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 59/609 net/iucv: take a reference on the socket found in afiucv_hs_rcv()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <[email protected]>
[ Upstream commit 4fa349156043dc119721d067329714179f501749 ]
afiucv_hs_rcv() looks up the destination socket under iucv_sk_list.lock, drops the lock, and then passes the socket to the afiucv_hs_callback_*() handlers without holding a reference. AF_IUCV sockets are not RCU-protected and are freed synchronously by iucv_sock_kill() -> sock_put(), so a concurrent close can free the socket in the window between read_unlock() and the handler, which then dereferences freed memory (for example sk->sk_data_ready() in afiucv_hs_callback_syn()).
Take a reference with sock_hold() while the socket is still on the list and release it with sock_put() once the handler has run.
--- net/iucv/af_iucv.c | 4 ++++ 1 file changed, 4 insertions(+)
net/iucv/af_iucv.c +4 -0
@@ -2090,6 +2090,8 @@ static int afiucv_hs_rcv(struct sk_buff *skb, struct net_device *dev, } } } +if (sk) +sock_hold (sk);read_unlock (&iucv_sk_list.lock);if (!iucv) sk =NULL ;
@@ -2139,6 +2141,8 @@ static int afiucv_hs_rcv(struct sk_buff *skb, struct net_device *dev,kfree_skb (skb); } +if (sk) +sock_put (sk);return err; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 60/609 ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <[email protected]>
[ Upstream commit 4bbc16a353a98023e5ddfca7c1fc0e49971cf4d0 ]
sata_dwc_enable_interrupts() is called before platform_get_irq() and ata_host_activate(), leaving the SATA controller's interrupt mask enabled without a registered handler. If a later step fails (irq request, phy init, etc.) or if the controller asserts an interrupt during probe, the irq line may fire with no handler, causing a spurious interrupt storm.
Move sata_dwc_enable_interrupts() after ata_host_activate() so that interrupts are only unmasked once the handler is registered and the core is fully initialized.
--- drivers/ata/sata_dwc_460ex.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/ata/sata_dwc_460ex.c +2 -3
@@ -1175,9 +1175,6 @@ static int sata_dwc_probe(struct platform_device *ofdev)/* Save dev for later use in dev_xxx() routines */ hsdev->dev = dev; -/* Enable SATA Interrupts */ -sata_dwc_enable_interrupts (hsdev); -/* Get SATA interrupt number */ irq =irq_of_parse_and_map (np,0 );if (irq ==NO_IRQ ) {
@@ -1210,6 +1207,8 @@ static int sata_dwc_probe(struct platform_device *ofdev)if (err)dev_err (dev,"failed to activate host" ); +/* Enable SATA Interrupts */ +sata_dwc_enable_interrupts (hsdev);return 0 ; error_out:
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 61/609 ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <[email protected]>
[ Upstream commit 66c4e310ad71f41e41736d33dd8a1fb5eaaec7f3 ]
clear_interrupt_bit() ignores the bit argument and performs a read-write-back of the entire INTPR register. If INTPR uses standard Write-1-to-Clear semantics, this clears every pending interrupt bit, not just the intended one. Coalesced interrupts (e.g. DMAT + NEWFP) would be cleared together, silently losing the second event.
Write only the specific bit to clear so that other pending interrupts are preserved.
--- drivers/ata/sata_dwc_460ex.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/ata/sata_dwc_460ex.c +1 -2
@@ -403,8 +403,7 @@ static void clear_serror(struct ata_port *ap)static void clear_interrupt_bit (struct sata_dwc_device *hsdev,u32 bit) { -sata_dwc_writel (&hsdev->sata_dwc_regs->intpr, -sata_dwc_readl (&hsdev->sata_dwc_regs->intpr)); +sata_dwc_writel (&hsdev->sata_dwc_regs->intpr, bit); }static u32 qcmd_tag_to_mask (u8 tag)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 62/609 ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 93b47e66cc6d6c6382d44b44f5e7f6fc3a7b38c3 ]
Salvador reported that the recent fix for applying the DSD quirk to Musical Fidelity devices broke for his M6s DAC model (2772:0502).
Although this is basically a firmware bug, the model in question is fairly old, and no further firmware update can be expected, so it'd be better to address in the driver side.
As an ad hoc workaround, skip the DSD quirk for this device by adding an empty quirk entry of 2772:0502; this essentially skips the later DSD quirk entry by the match with the vendor 2772.
--- sound/usb/quirks.c | 2 ++ 1 file changed, 2 insertions(+)
sound/usb/quirks.c +2 -0
@@ -2261,6 +2261,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { QUIRK_FLAG_DSD_RAW),DEVICE_FLG (0x2708 ,0x0002 ,/* Audient iD14 */ QUIRK_FLAG_IGNORE_CTL_ERROR ), +DEVICE_FLG (0x2772 ,0x0502 ,/* Musical Fidelity M6s DAC */ +0 ),/* for avoiding QUIRK_FLAG_DSD_RAW with vendor match */ DEVICE_FLG (0x2912 ,0x30c8 ,/* Audioengine D1 */ QUIRK_FLAG_GET_SAMPLE_RATE ), DEVICE_FLG(0x2a70, 0x1881, /* OnePlus Technology (Shenzhen) Co., Ltd. BE02T */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 63/609 Bluetooth: qca: fix NVM tag length underflow in TLV parser
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <[email protected]>
[ Upstream commit c90164ca0f7036942ba088eb7ea8d3f6c2352020 ]
In the TLV_TYPE_NVM branch of qca_tlv_check_data() the tag loop bound is "while (idx < length - sizeof(struct tlv_type_nvm))". "length" is a signed int from the firmware TLV header and sizeof(struct tlv_type_nvm) is a size_t (12), so "length" is converted to size_t and any firmware-supplied "length" < 12 makes the subtraction wrap to a huge value. The loop body then reads a 12-byte struct tlv_type_nvm past the end of the short vmalloc'd firmware buffer (and the EDL_TAG_ID_* handlers can write past it).
Rewrite the bound as "idx + sizeof(struct tlv_type_nvm) <= length"; both operands are non-negative, so it no longer underflows and a "length" too small for one record correctly skips the loop.
BUG: KASAN: vmalloc-out-of-bounds in qca_download_firmware.isra.0 (drivers/bluetooth/btqca.c:421) Read of size 2 at addr ffffc900000e5004 by task kworker/u9:0/52 Workqueue: hci0 hci_power_on Call Trace: ... kasan_report (mm/kasan/report.c:595) qca_download_firmware.isra.0 (drivers/bluetooth/btqca.c:421 drivers/bluetooth/btqca.c:617) qca_uart_setup (drivers/bluetooth/btqca.c:948) qca_setup (drivers/bluetooth/hci_qca.c:2029) hci_uart_setup (drivers/bluetooth/hci_ldisc.c:438) hci_dev_open_sync (net/bluetooth/hci_sync.c:5227) hci_power_on (net/bluetooth/hci_core.c:920) process_one_work (kernel/workqueue.c:3322) worker_thread (kernel/workqueue.c:3486) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
--- drivers/bluetooth/btqca.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/bluetooth/btqca.c +1 -1
@@ -430,7 +430,7 @@ static int qca_tlv_check_data(struct hci_dev *hdev, idx =0 ; data = tlv->data; -while (idx < length -sizeof (struct tlv_type_nvm )) { +while (idx +sizeof (struct tlv_type_nvm ) <= length) { tlv_nvm = (struct tlv_type_nvm *)(data + idx); tag_id =le16_to_cpu (tlv_nvm->tag_id);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 64/609 smb/client: handle overlapping allocated ranges in fallocate
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huiwen He <[email protected]>
[ Upstream commit b09ae45d85dc816987a71db9eebc54b0ae288e94 ]
smb3_simple_fallocate_range() can skip holes when an allocated range returned by the server starts before the current fallocate offset. The skipped hole is not zero-filled, but fallocate still returns success. A later write to that hole may therefore fail with ENOSPC.
The function queries allocated ranges so that it can preserve existing contents and write zeroes only into holes. However, the server may return a range that starts before the current fallocate offset.
For example, assume the fallocate request is [100, 400) and the only allocated range returned by the server is [0, 200):
Request: [100, 400)
Server range: [ 0, 200) allocated
Correct:
[100, 200) allocated data, skip
[200, 400) hole, zero-fill
Current:
[100, 300) skipped
[300, 400) zero-filled afterwardsThe current code adds the full server range length, 200, to the current offset 100 and moves to 300. As a result, the hole in [200, 300) is skipped without being zero-filled.
Fix this by advancing only over the part of the allocated range that overlaps the current fallocate offset. Ignore ranges that end before the current offset and reject ranges whose end offset overflows.
This also prevents a malformed range length from causing an out-of-bounds zero-buffer read.
--- fs/smb/client/smb2ops.c | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-)
fs/smb/client/smb2ops.c +18 -7
@@ -3655,6 +3655,7 @@ static int smb3_simple_fallocate_range(unsigned int xid,struct file_allocated_range_buffer in_data, *out_data =NULL , *tmp_data;u32 out_data_len;char *buf =NULL ; +u64 range_start, range_len, range_end;loff_t l;int rc;
@@ -3691,13 +3692,21 @@ static int smb3_simple_fallocate_range(unsigned int xid, goto out; } -if (off <le64_to_cpu (tmp_data->file_offset)) { + range_start =le64_to_cpu (tmp_data->file_offset); + range_len =le64_to_cpu (tmp_data->length); +if (check_add_overflow (range_start, range_len, &range_end) || + range_end >S64_MAX ) { + rc = -EINVAL ; + goto out; + } + +if (off < range_start) {/* * We are at a hole. Write until the end of the region * or until the next allocated data, * whichever comes next. */ - l =le64_to_cpu (tmp_data->file_offset) - off; + l = range_start - off;if (len < l) l = len; rc = smb3_simple_fallocate_write_range(xid, tcon,
@@ -3714,11 +3723,13 @@ static int smb3_simple_fallocate_range(unsigned int xid,* until the end of the data or the end of the region * we are supposed to fallocate, whichever comes first. */ - l =le64_to_cpu (tmp_data->length); -if (len < l) - l = len; - off += l; - len -= l; +if (off < range_end) { + l = range_end - off; +if (len < l) + l = len; + off += l; + len -= l; + } tmp_data = &tmp_data[1 ]; out_data_len -=sizeof (struct file_allocated_range_buffer );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 65/609 drm/i915/gt: use correct selftest config symbol
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit a82f1bb8191aec98a971a2196136016ef70c0880 ]
intel_engine_user.c checks CONFIG_DRM_I915_SELFTESTS before running the engine UABI isolation check. Kconfig defines DRM_I915_SELFTEST, without the trailing "S", and the rest of i915 uses CONFIG_DRM_I915_SELFTEST.
Because CONFIG_DRM_I915_SELFTESTS is not backed by any Kconfig symbol, the IS_ENABLED() test is always false. Use the existing selftest symbol so the debug/selftest guarded path can be reached when selftests are enabled.
This is a source-level fix. It does not claim dynamic hardware reproduction; the evidence is the Kconfig definition and the inconsistent guard in intel_engine_user.c.
--- drivers/gpu/drm/i915/gt/intel_engine_user.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/i915/gt/intel_engine_user.c +1 -1
@@ -239,7 +239,7 @@ void intel_engines_driver_register(struct drm_i915_private *i915) p = &prev->rb_right; } -if (IS_ENABLED (CONFIG_DRM_I915_SELFTESTS ) && +if (IS_ENABLED (CONFIG_DRM_I915_SELFTEST ) &&IS_ENABLED (CONFIG_DRM_I915_DEBUG_GEM )) {struct intel_engine_cs *engine;unsigned int isolation;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 66/609 bpf, sockmap: Reject unhashed UDP sockets on sockmap update
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Luczaj <[email protected]>
[ Upstream commit 66efd3368ae10d05e08fbe6425b50fdec7186ac7 ]
UDP sockets get SOCK_RCU_FREE set when (auto-)bound. This means sk_is_refcounted(unbound) = true, while sk_is_refcounted(bound) = false.
Because sockmap accepts unbound UDP sockets, a BPF program can increment a socket's refcount via lookup. If the socket is subsequently bound, the transition from unbound to bound causes bpf_sk_release() to skip the decrement of the refcount, causing a memory leak.
unreferenced object 0xffff88810bc2eb40 (size 1984):
comm "test_progs", pid 2451, jiffies 4295320596 hex dump (first 32 bytes):
7f 00 00 01 7f 00 00 01 d2 04 1b b7 04 d2 00 00 ................
02 00 01 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............
backtrace (crc bdee079d):
kmem_cache_alloc_noprof+0x557/0x660
sk_prot_alloc+0x69/0x240
sk_alloc+0x30/0x460
inet_create+0x2ce/0xf80
__sock_create+0x25b/0x5c0
__sys_socket+0x119/0x1d0
__x64_sys_socket+0x72/0xd0
do_syscall_64+0xa1/0x5f0
entry_SYSCALL_64_after_hwframe+0x76/0x7eInstead of special-casing for refcounted sockets, reject unhashed UDP sockets during sockmap updates, as there is no benefit to supporting those. This effectively reverts the commit under Fixes, with two exceptions:
1. sock_map_sk_state_allowed() maintains a fall-through return true.
2. In the spirit of commit b8b8315e39ff ("bpf, sockmap: Remove unhash handler for BPF sockmap usage"), the proto::unhash BPF handler is not reintroduced.
Historical note: this issue is related to commit 67312adc96b5 ("bpf: reject unhashed sockets in bpf_sk_assign").
--- net/core/sock_map.c | 2 ++ 1 file changed, 2 insertions(+)
net/core/sock_map.c +2 -0
@@ -542,6 +542,8 @@ static bool sock_map_sk_state_allowed(const struct sock *sk) {if (sk_is_tcp (sk))return (1 << sk->sk_state) & (TCPF_ESTABLISHED |TCPF_LISTEN ); +if (sk_is_udp (sk)) +return sk_hashed (sk);if (sk_is_stream_unix (sk))return (1 << sk->sk_state) &TCPF_ESTABLISHED ;return true;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 67/609 can: j1939: fix lockless local-destination check
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuhao Fu <[email protected]>
[ Upstream commit e4e8af62adab2fdcca230006f829407a953070cd ]
j1939_priv.ents[].nusers is documented as protected by priv->lock, and its updates already happen under that lock. j1939_can_recv() also reads it under read_lock_bh(). However, j1939_session_skb_queue() and j1939_tp_send() still read priv->ents[da].nusers without taking the lock.
Those transport-side checks decide whether to set J1939_ECU_LOCAL_DST, so they can race with j1939_local_ecu_get() and j1939_local_ecu_put() while userspace is binding or releasing sockets concurrently with TP traffic. This can misclassify TP/ETP sessions as local or remote and take the wrong transport path.
Fix both transport paths by routing the destination-locality check through a helper that reads ents[].nusers under read_lock_bh(&priv->lock).
--- net/can/j1939/transport.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-)
net/can/j1939/transport.c +14 -4
@@ -350,6 +350,18 @@ static void j1939_session_skb_drop_old(struct j1939_session *session) } } +static bool j1939_address_is_local (struct j1939_priv *priv,u8 addr) +{ +bool local = false; + +read_lock_bh (&priv->lock); +if (j1939_address_is_unicast (addr) && priv->ents[addr].nusers) + local = true; +read_unlock_bh (&priv->lock); + +return local; +} +void j1939_session_skb_queue (struct j1939_session *session,struct sk_buff *skb) {
@@ -358,8 +370,7 @@ void j1939_session_skb_queue(struct j1939_session *session,j1939_ac_fixup (priv, skb); -if (j1939_address_is_unicast (skcb->addr.da) && - priv->ents[skcb->addr.da].nusers) +if (j1939_address_is_local (priv, skcb->addr.da)) skcb->flags |=J1939_ECU_LOCAL_DST ; skcb->flags |=J1939_ECU_LOCAL_SRC ;
@@ -2021,8 +2032,7 @@ struct j1939_session *j1939_tp_send(struct j1939_priv *priv,return ERR_PTR (ret);/* fix DST flags, it may be used there soon */ -if (j1939_address_is_unicast (skcb->addr.da) && - priv->ents[skcb->addr.da].nusers) +if (j1939_address_is_local (priv, skcb->addr.da)) skcb->flags |=J1939_ECU_LOCAL_DST ;/* src is always local, I'm sending ... */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 68/609 ksmbd: validate compound request size before reading StructureSize2
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei (Microsoft) <[email protected]>
[ Upstream commit 15b38176fd1530372905c602fde51fe89ec8c877 ]
When ksmbd validates a compound (chained) SMB2 request, ksmbd_smb2_check_message() reads pdu->StructureSize2 without first checking that the compound element is large enough to contain it. StructureSize2 is a 2-byte field at offset 64 (__SMB2_HEADER_STRUCTURE_SIZE) from the start of each element.
The compound-walking logic only guarantees that a full 64-byte SMB2 header is present for the trailing element: when NextCommand is 0, len is reduced to the number of bytes remaining after next_smb2_rcv_hdr_off. A remote client can craft a compound request whose last element has exactly 64 bytes, so the 2-byte StructureSize2 read at offset 64 extends one byte past the receive buffer, producing a slab-out-of-bounds read.
BUG: KASAN: slab-out-of-bounds in ksmbd_smb2_check_message (fs/smb/server/smb2misc.c:402) Read of size 2 at addr ffff888012ae31ac by task kworker/0:1/14 The buggy address is located 172 bytes inside of allocated 173-byte region Workqueue: ksmbd-io handle_ksmbd_work Call Trace: ... kasan_report (mm/kasan/report.c:595) ksmbd_smb2_check_message (fs/smb/server/smb2misc.c:402) handle_ksmbd_work (fs/smb/server/server.c:119) process_one_work (kernel/workqueue.c:3314) worker_thread (kernel/workqueue.c:3397) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
Reject any compound element that is too small to hold StructureSize2 before dereferencing it.
--- fs/smb/server/smb2misc.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/smb/server/smb2misc.c +5 -0
@@ -400,6 +400,11 @@ int ksmbd_smb2_check_message(struct ksmbd_work *work)return 1 ; } +if (len < __SMB2_HEADER_STRUCTURE_SIZE +sizeof (__le16)) { +ksmbd_debug (SMB ,"Message is too small for StructureSize2\n" ); +return 1 ; + } +if (smb2_req_struct_sizes[command] != pdu->StructureSize2) { if (!(command == SMB2_OPLOCK_BREAK_HE && (le16_to_cpu(pdu->StructureSize2) == OP_BREAK_STRUCT_SIZE_20 ||
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 69/609 drm/i915/selftests: Fix GT PM sort comparators
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emre Cecanpunar <[email protected]>
[ Upstream commit 612978b83f45bf7018815209db5395d759db6f26 ]
Compare the sampled clock values instead of their addresses. Comparing addresses leaves the samples unsorted, preventing the code from discarding the minimum and maximum samples.
--- drivers/gpu/drm/i915/gt/selftest_gt_pm.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/i915/gt/selftest_gt_pm.c +4 -4
@@ -16,9 +16,9 @@ static int cmp_u64(const void *A, const void *B) {const u64 *a =A , *b =B ; -if (a < b) +if (*a < *b)return -1 ; -else if (a > b) +else if (*a > *b)return 1 ;else return 0 ;
@@ -28,9 +28,9 @@ static int cmp_u32(const void *A, const void *B) {const u32 *a =A , *b =B ; -if (a < b) +if (*a < *b)return -1 ; -else if (a > b) +else if (*a > *b)return 1 ;else return 0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 70/609 net/sched: act_tunnel_key: Defer dst_release to RCU callback
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <[email protected]>
[ Upstream commit f1f5c8a3955f8fda3f84ed883ac8daa1847e724c ]
Fix a race-condition use-after-free in tunnel_key_release_params().
The function releases the metadata_dst of the old params synchronously via dst_release() while deferring the params struct free with kfree_rcu(). A concurrent tunnel_key_act() reader on the datapath may still hold the old params pointer (under rcu_read_lock_bh) and proceed to call dst_clone(¶ms->tcft_enc_metadata->dst) after the writer's dst_release has already pushed the dst's rcuref to RCUREF_DEAD.
[email protected] produced a poc which i (and Victor) verified that KASAN reports:
==================================================================
BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 BUG: KASAN: slab-use-after-free in atomic_sub_return_release include/linux/atomic/atomic-instrumented.h:326 BUG: KASAN: slab-use-after-free in __rcuref_put include/linux/rcuref.h:109 BUG: KASAN: slab-use-after-free in rcuref_put include/linux/rcuref.h:173 BUG: KASAN: slab-use-after-free in dst_release+0x5b/0x370 net/core/dst.c:168 Write of size 4 at addr ffff88806158de40 by task poc/9388 CPU: 0 UID: 0 PID: 9388 Comm: poc Tainted: G W 7.1.0-rc7 #7 PREEMPT(lazy) Tainted: [W]=WARN Hardware name: QEMU Ubuntu 25.10 PC v2 (i440FX + PIIX, + 10.1 machine, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 print_report+0x139/0x4ad mm/kasan/report.c:482 kasan_report+0xe4/0x1d0 mm/kasan/report.c:595 check_region_inline mm/kasan/generic.c:186 kasan_check_range+0x125/0x200 mm/kasan/generic.c:200 instrument_atomic_read_write include/linux/instrumented.h:112 atomic_sub_return_release include/linux/atomic/atomic-instrumented.h:326 __rcuref_put include/linux/rcuref.h:109 rcuref_put include/linux/rcuref.h:173 dst_release+0x5b/0x370 net/core/dst.c:168 refdst_drop include/net/dst.h:272 skb_dst_drop include/net/dst.h:284 skb_release_head_state+0x293/0x400 net/core/skbuff.c:1163 skb_release_all net/core/skbuff.c:1187 [..] Allocated by task 9391: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 __kasan_kmalloc+0x9a/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 __do_kmalloc_node mm/slub.c:5296 __kmalloc_noprof+0x2f1/0x830 mm/slub.c:5308 kmalloc_noprof include/linux/slab.h:954 kzalloc_noprof include/linux/slab.h:1188 offload_action_alloc+0x2f/0x130 net/core/flow_offload.c:35 tcf_action_offload_add_ex+0x1ba/0x880 net/sched/act_api.c:258 tcf_action_offload_add net/sched/act_api.c:293 tcf_action_init+0x66e/0xa20 net/sched/act_api.c:1547 tcf_action_add+0xf6/0x5d0 net/sched/act_api.c:2101 [..] Freed by task 9391: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 __kasan_slab_free+0x6b/0x90 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 slab_free_hook mm/slub.c:2689 slab_free mm/slub.c:6251 kfree+0x21f/0x6b0 mm/slub.c:6566 tcf_action_offload_add_ex+0x4ad/0x880 net/sched/act_api.c:284 tcf_action_offload_add net/sched/act_api.c:293 tcf_action_init+0x66e/0xa20 net/sched/act_api.c:1547 tcf_action_add+0xf6/0x5d0 net/sched/act_api.c:2101 The buggy address belongs to the object at ffff88806158de00 which belongs to the cache kmalloc-256 of size 256
The buggy address is located 64 bytes inside of
freed 256-byte region [ffff88806158de00, ffff88806158df00)
The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88806158d600 pfn:0x6158c head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x4fff00000000240(workingset|head|node=1|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 04fff00000000240 ffff88801c841b40 ffffea0001856290 ffffea0001856190 raw: ffff88806158d600 0000000800100009 00000000f5000000 0000000000000000
head: 04fff00000000240 ffff88801c841b40 ffffea0001856290 ffffea0001856190
head: ffff88806158d600 0000000800100009 00000000f5000000 0000000000000000
head: 04fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 9391, tgid 9378 (poc), ts 123227323196, free_ts 0 set_page_owner include/linux/page_owner.h:32 post_alloc_hook+0xfe/0x140 mm/page_alloc.c:1853 prep_new_page mm/page_alloc.c:1861 get_page_from_freelist+0x110c/0x2fc0 mm/page_alloc.c:3941 __alloc_frozen_pages_noprof+0x263/0x2bc0 mm/page_alloc.c:5221 alloc_slab_page mm/slub.c:3278 allocate_slab mm/slub.c:3467 new_slab+0xa6/0x690 mm/slub.c:3525 refill_objects+0x271/0x420 mm/slub.c:7272 refill_sheaf mm/slub.c:2816 __pcs_replace_empty_main+0x373/0x630 mm/slub.c:4652 alloc_from_pcs mm/slub.c:4750 slab_alloc_node mm/slub.c:4884 __do_kmalloc_node mm/slub.c:5295 __kmalloc_noprof+0x66d/0x830 mm/slub.c:5308 kmalloc_noprof include/linux/slab.h:954 metadata_dst_alloc+0x26/0x90 net/core/dst.c:298 tun_rx_dst include/net/dst_metadata.h:144 __ip_tun_set_dst include/net/dst_metadata.h:208 tunnel_key_init+0xb01/0x1b90 net/sched/act_tunnel_key.c:451 tcf_action_init_1+0x46b/0x6c0 net/sched/act_api.c:1428 tcf_action_init+0x448/0xa20 net/sched/act_api.c:1503 tcf_action_add+0xf6/0x5d0 net/sched/act_api.c:2101
[..]
==================================================================
Fix by moving dst_release() into a custom RCU callback that runs after the grace period, matching the lifetime of the containing params struct. Readers in the datapath therefore always find a live rcuref when calling dst_clone().
--- net/sched/act_tunnel_key.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
net/sched/act_tunnel_key.c +10 -4
@@ -342,14 +342,20 @@ static const struct nla_policy tunnel_key_policy[TCA_TUNNEL_KEY_MAX + 1] = { [TCA_TUNNEL_KEY_ENC_TTL] = { .type = NLA_U8 }, }; -static void tunnel_key_release_params (struct tcf_tunnel_key_params *p) +static void tunnel_key_release_params_rcu (struct rcu_head *head) { -if (!p) -return ; +struct tcf_tunnel_key_params *p =container_of (head,typeof (*p), rcu); +if (p->tcft_action ==TCA_TUNNEL_KEY_ACT_SET )dst_release (&p->tcft_enc_metadata->dst); +kfree (p); +} -kfree_rcu (p, rcu); +static void tunnel_key_release_params (struct tcf_tunnel_key_params *p) +{ +if (!p) +return ; +call_rcu (&p->rcu, tunnel_key_release_params_rcu); } static int tunnel_key_init(struct net *net, struct nlattr *nla,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 71/609 sctp: fix auth_hmacs array size in struct sctp_cookie
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit e0b5252a59383b77d1b8dbeda00b7184dd95f4d3 ]
The auth_hmacs array in struct sctp_cookie is supposed to store a complete SCTP_AUTH_HMAC_ALGO parameter, which consists of a struct sctp_paramhdr followed by N HMAC identifiers.
However, the array size was calculated using an extra 2 bytes instead of sizeof(struct sctp_paramhdr), which is 4 bytes. When four HMAC identifiers are configured, the HMAC-ALGO parameter stored in the endpoint is larger than the auth_hmacs buffer in the cookie.
As a result, sctp_association_init() copies beyond the end of auth_hmacs when initializing the association, corrupting the adjacent auth_chunks field. This can lead to an invalid HMAC identifier being accepted and later cause an out-of-bounds read in sctp_auth_get_hmac().
Fix the array size calculation by including the full SCTP parameter header size.
--- include/net/sctp/structs.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
include/net/sctp/structs.h +2 -1
@@ -322,7 +322,8 @@ struct sctp_cookie {__u8 auth_random[sizeof (struct sctp_paramhdr ) +SCTP_AUTH_RANDOM_LENGTH ]; -__u8 auth_hmacs[SCTP_AUTH_NUM_HMACS *sizeof (__u16) +2 ]; +__u8 auth_hmacs[sizeof (struct sctp_paramhdr ) + +SCTP_AUTH_NUM_HMACS *sizeof (__u16)];__u8 auth_chunks[sizeof (struct sctp_paramhdr ) +SCTP_AUTH_MAX_CHUNKS ];/* This is a shim for my peer's INIT packet, followed by
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 72/609 mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <[email protected]>
[ Upstream commit 56d96fededd61192cd7cc8d2b0f36adfd59036c3 ]
On CONFIG_INET=n builds, mpls_valid_fib_dump_req() walks the parsed attribute table itself instead of calling ip_valid_fib_dump_req(). The RTA_OIF arm passes tb[RTA_OIF] to nla_get_u32() without checking it is present, so an RTM_GETROUTE dump for AF_MPLS with strict checking and no RTA_OIF hits a NULL dereference.
RTM_GETROUTE is RTNL_KIND_GET, which rtnetlink_rcv_msg() permits without CAP_NET_ADMIN, so an unprivileged user can trigger it.
Oops: general protection fault, probably for non-canonical address
0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: 0010:mpls_valid_fib_dump_req (net/mpls/af_mpls.c:2189)
Call Trace:
mpls_dump_routes (net/mpls/af_mpls.c:2236)
netlink_dump (net/netlink/af_netlink.c:2331)
__netlink_dump_start (net/netlink/af_netlink.c:2446)
rtnetlink_rcv_msg (net/core/rtnetlink.c:7033)
netlink_rcv_skb (net/netlink/af_netlink.c:2556)
netlink_unicast (net/netlink/af_netlink.c:1345)
netlink_sendmsg (net/netlink/af_netlink.c:1900)
__sock_sendmsg (net/socket.c:790)
____sys_sendmsg (net/socket.c:2684)
___sys_sendmsg (net/socket.c:2738)
__sys_sendmsg (net/socket.c:2770)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)Skip unset attributes, as ip_valid_fib_dump_req() does.
--- net/mpls/af_mpls.c | 3 +++ 1 file changed, 3 insertions(+)
net/mpls/af_mpls.c +3 -0
@@ -2139,6 +2139,9 @@ static int mpls_valid_fib_dump_req(struct net *net, const struct nlmsghdr *nlh,int ifindex;if (i ==RTA_OIF ) { +if (!tb[i]) +continue ; + ifindex =nla_get_u32 (tb[i]); filter->dev =__dev_get_by_index (net, ifindex);if (!filter->dev)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 73/609 wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huihui Huang <[email protected]>
commit 61a799ffd1e5a4fd3702d547828b7ff3d161468e upstream.
at76_guess_freq() checks only that the received frame is at least a bare 802.11 header (24 bytes) before subtracting the fixed management-body offset:
len -= el_off;
For both beacon and probe response frames, el_off is 36. If the frame is shorter than el_off, subtracting it causes the calculated IE length to wrap. The length is eventually passed to cfg80211_find_elem_match() as a very large unsigned value, so the element walk runs beyond the RX skb.
This path is reached from at76_rx_tasklet() while scanning. If the device delivers a truncated beacon or probe response, the oversized IE length causes an out-of-bounds read during scanning.
Skip the IE lookup if the frame does not reach the variable elements, before subtracting el_off.
--- drivers/net/wireless/atmel/at76c50x-usb.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/net/wireless/atmel/at76c50x-usb.c +5 -2
@@ -1527,13 +1527,16 @@ static inline int at76_guess_freq(structif (ieee80211_is_probe_resp (hdr->frame_control)) { el_off = offsetof(struct ieee80211_mgmt, u.probe_resp.variable); - el = ((struct ieee80211_mgmt *)hdr)->u.probe_resp.variable; }else if (ieee80211_is_beacon (hdr->frame_control)) { el_off = offsetof(struct ieee80211_mgmt, u.beacon.variable); - el = ((struct ieee80211_mgmt *)hdr)->u.beacon.variable; }else { goto exit; } + +if (len < el_off) + goto exit; + + el = priv->rx_skb->data + el_off; len -= el_off; el =cfg80211_find_ie (WLAN_EID_DS_PARAMS , el, len);
Greg Kroah-Hartman
maintainerPATCH 74/609 USB: storage: add NO_ATA_1X quirk for Longmai USB Key
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huang Wei <[email protected]>
commit 3b4ca2e01c1dd8c00b675b794732945f460a471b upstream.
The Longmai Technologies USB Key (0x04b4:0xb708) advertises itself as a SCSI/Bulk-only mass storage device but does not correctly handle ATA pass-through commands. When such a command (ATA_12 or ATA_16) is sent to the device it fails to respond and the transfer eventually times out, leaving the device unusable.
Add an unusual_devs entry for this device that sets the US_FL_NO_ATA_1X flag, so usb-storage short-circuits ATA pass-through commands and returns INVALID COMMAND OPERATION CODE (0x20 0x05 0x24 0x00) instead of forwarding them to the device.
Information about the device in /sys/kernel/debug/usb/devices:
T: Bus=02 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 12 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=06 Prot=50 MxPS=64 #Cfgs= 1 P: Vendor=04b4 ProdID=b708 Rev= 1.00 S: Manufacturer=Longmai Technologies S: Product=USB Key C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=100mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/storage/unusual_devs.h | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/usb/storage/unusual_devs.h +7 -0
@@ -395,6 +395,13 @@ UNUSUAL_DEV( 0x04b3, 0x4001, 0x0110, 0x USB_SC_DEVICE, USB_PR_CB, NULL, US_FL_MAX_SECTORS_MIN), +/* Reported by Ai Chao <[email protected]> */ +UNUSUAL_DEV (0x04b4 ,0xb708 ,0x0000 ,0xffff , +"Longmai Technologies" , +"USB Key" , +USB_SC_SCSI ,USB_PR_BULK ,NULL , + US_FL_NO_ATA_1X), +/* * Reported by Simon Levitt <[email protected]> * This entry needs Sub and Proto fields
Greg Kroah-Hartman
maintainerPATCH 75/609 usb: chipidea: fix usage_count leak when autosuspend_delay is negative
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <[email protected]>
commit fc3afb5728e297994863f8a2a01b88a920bbf53e upstream.
The probe() calls pm_runtime_use_autosuspend(), but remove() does not call pm_runtime_dont_use_autosuspend(). This can lead to a usage_count leak if autosuspend_delay is set to a negative value.
The pm_runtime_use_autosuspend() also notes that it's important to undo this with pm_runtime_dont_use_autosuspend() at driver exit time.
--- drivers/usb/chipidea/core.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/chipidea/core.c +1 -0
@@ -1251,6 +1251,7 @@ static int ci_hdrc_remove(struct platforusb_role_switch_unregister (ci->role_switch);if (ci->supports_runtime_pm) { +pm_runtime_dont_use_autosuspend (&pdev->dev);pm_runtime_get_sync (&pdev->dev);pm_runtime_disable (&pdev->dev);pm_runtime_put_noidle (&pdev->dev);
Greg Kroah-Hartman
maintainerPATCH 76/609 usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinchao Wang <[email protected]>
commit d5e5cd3654d2b5359a12ea6586120f05b28634ee upstream.
dummy_hcd embeds a single shared usb_request (dum->fifo_req) that the "emulated single-request FIFO" fast-path in dummy_queue() reuses for small IN transfers: it copies the caller's request into it (req->req = *_req) and queues it, treating list_empty(&fifo_req.queue) as "the slot is free".
The completion side (dummy_timer/transfer/nuke/dummy_dequeue) follows the standard pattern: list_del_init(&req->queue) unlinks the request, then the lock is dropped and usb_gadget_giveback_request() invokes req->complete(). But list_del_init() makes fifo_req.queue look empty *before* the completion callback returns, so a concurrent dummy_queue() on another CPU sees the slot as free, reuses fifo_req and runs req->req = *_req -- overwriting req->complete while dummy_timer is mid-calling it. The indirect call then jumps to a clobbered pointer, causing a general protection fault / page fault in dummy_timer (syzkaller extid faf3a6cf579fc65591ca). The clobbering write is an in-bounds memcpy on a live shared object, so KASAN cannot flag it.
Add a fifo_req_busy bit covering the shared request's whole lifetime:
set it in dummy_queue() when the FIFO fast-path takes fifo_req (making it the fast-path guard, replacing the list_empty(&fifo_req.queue) test), and clear it after the completion callback has returned, via a dummy_giveback() helper used at all four gadget-request giveback sites. The shared slot can no longer be reused until its completion callback has finished.
--- drivers/usb/gadget/udc/dummy_hcd.c | 40 ++++++++++++++++++++++++------------- 1 file changed, 27 insertions(+), 13 deletions(-)
drivers/usb/gadget/udc/dummy_hcd.c +27 -13
@@ -277,6 +277,7 @@ struct dummy { unsigned ints_enabled:1; unsigned udc_suspended:1; unsigned pullup:1; + unsigned fifo_req_busy:1;/* * HOST side support
@@ -328,6 +329,26 @@ static inline struct dummy *gadget_dev_t/* DEVICE/GADGET SIDE UTILITY ROUTINES */ +/* +* Give back a gadget request with dum->lock dropped around the callback. +* If @req is the shared fifo_req, clear fifo_req_busy afterward: the flag +* was set in dummy_queue() when the shared request was taken and must stay +* set until its completion callback has returned; list_del_init() alone +* makes the request look idle while the callback is still running. +* Caller holds dum->lock and has already done list_del_init() + status. +*/ +static void dummy_giveback (struct dummy *dum,struct usb_ep *_ep, +struct dummy_request *req) +{ +bool fifo = req == &dum->fifo_req; + +spin_unlock (&dum->lock); +usb_gadget_giveback_request (_ep, &req->req); +spin_lock (&dum->lock); +if (fifo) + dum->fifo_req_busy =0 ; +} +/* called with spinlock held */ static void nuke (struct dummy *dum,struct dummy_ep *ep) {
@@ -338,9 +359,7 @@ static void nuke(struct dummy *dum, strulist_del_init (&req->queue); req->req.status = -ESHUTDOWN ; -spin_unlock (&dum->lock); -usb_gadget_giveback_request (&ep->ep, &req->req); -spin_lock (&dum->lock); +dummy_giveback (dum, &ep->ep, req); } }
@@ -727,10 +746,11 @@ static int dummy_queue(struct usb_ep *_e/* implement an emulated single-request FIFO */ if (ep->desc && (ep->desc->bEndpointAddress &USB_DIR_IN ) && -list_empty (&dum->fifo_req.queue) && + !dum->fifo_req_busy &&list_empty (&ep->queue) && _req->length <=FIFO_SIZE ) { req = &dum->fifo_req; + dum->fifo_req_busy =1 ; req->req = *_req; req->req.buf = dum->fifo_buf;memcpy (dum->fifo_buf, _req->buf, _req->length);
@@ -784,9 +804,7 @@ static int dummy_dequeue(struct usb_ep *dev_dbg (udc_dev (dum),"dequeued req %p from %s, len %d buf %p\n" , req, _ep->name, _req->length, _req->buf); -spin_unlock (&dum->lock); -usb_gadget_giveback_request (_ep, _req); -spin_lock (&dum->lock); +dummy_giveback (dum, _ep, req); }spin_unlock_irqrestore (&dum->lock, flags);return retval;
@@ -1523,9 +1541,7 @@ top:if (req->req.status != -EINPROGRESS ) {list_del_init (&req->queue); -spin_unlock (&dum->lock); -usb_gadget_giveback_request (&ep->ep, &req->req); -spin_lock (&dum->lock); +dummy_giveback (dum, &ep->ep, req);/* requests might have been unlinked... */ rescan =1 ;
@@ -1909,9 +1925,7 @@ restart:dev_dbg (udc_dev (dum),"stale req = %p\n" , req); -spin_unlock (&dum->lock); -usb_gadget_giveback_request (&ep->ep, &req->req); -spin_lock (&dum->lock); +dummy_giveback (dum, &ep->ep, req); ep->already_seen =0 ; goto restart; }
Greg Kroah-Hartman
maintainerPATCH 77/609 usb: gadget: f_midi: cancel pending IN work before freeing the midi object
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <[email protected]>
commit 5650c18d93a1db7e27cb5a40b394747eb4686d5b upstream.
The f_midi driver embeds a work item (midi->work) whose handler, f_midi_in_work(), dereferences the enclosing struct f_midi through container_of(). This work is armed from two sites: f_midi_complete(), on a normal IN-endpoint completion, and f_midi_in_trigger(), on an ALSA rawmidi output-stream start.
Neither f_midi_disable() nor f_midi_unbind() cancels midi->work. f_midi_disable() only disables the endpoints and drains the in_req_fifo; it does not synchronize the work item, and the sound card is released asynchronously to the final free of the midi object.
The midi object is reference-counted (midi->free_ref) and is freed in f_midi_free() only once both the usb_function reference and the rawmidi private_data reference have been dropped. In f_midi_unbind(), f_midi_disable() runs before the sound card is released, so while the USB endpoints are already disabled the rawmidi device is still usable by an open substream. A concurrent userspace write on such a substream can reach f_midi_in_trigger() and queue midi->work again after f_midi_disable() has returned. A work item armed this way may still be pending when the last reference drops and f_midi_free() proceeds to kfree(midi), letting f_midi_in_work() dereference the struct after it has been freed, a use-after-free.
For this reason cancelling midi->work in f_midi_disable() would not be
sufficient: the ALSA trigger path can rearm the work after disable() returns. Cancelling at the refcount-zero free site is the boundary after which neither arming source can survive, because by then both references that keep the midi object alive have been dropped: the USB endpoints are already disabled and the rawmidi device has been released.
Fix this by calling cancel_work_sync(&midi->work) in the refcount-zero block of f_midi_free(), before the embedded work_struct is freed along with the rest of the structure. opts->lock is a sleeping mutex, so calling cancel_work_sync() under it is permitted, and the handler takes midi->transmit_lock rather than opts->lock, so no self-deadlock can occur while it waits for a running instance of the work to finish.
This issue was found by an in-house static analysis tool.
--- drivers/usb/gadget/function/f_midi.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/gadget/function/f_midi.c +1 -0
@@ -1302,6 +1302,7 @@ static void f_midi_free(struct usb_funct opts = container_of(f->fi, struct f_midi_opts, func_inst);mutex_lock (&opts->lock);if (!--midi->free_ref) { +cancel_work_sync (&midi->work);kfree (midi->id);kfifo_free (&midi->in_req_fifo);kfree (midi);
Greg Kroah-Hartman
maintainerPATCH 78/609 usb: gadget: printer: fix infinite loop in printer_read()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Melbin K Mathew <[email protected]>
commit c2e819be6a5c7f34344926b4bd7e3dfca58cf48a upstream.
printer_read() uses the same variable for the requested copy size and the number of bytes actually copied to user space. copy_to_user() returns the number of bytes not copied, so when it fails to copy anything, the computed copied length becomes zero.
In that case len, buf, current_rx_bytes and current_rx_buf are left unchanged. If RX data is available and the user buffer remains unwritable, the read loop can repeat indefinitely.
Track the copied length separately and return -EFAULT, or the number of bytes already copied, if an iteration makes no progress.
--- drivers/usb/gadget/function/f_printer.c | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-)
drivers/usb/gadget/function/f_printer.c +18 -5
@@ -430,7 +430,7 @@ printer_read(struct file *fd, char __use {struct printer_dev *dev = fd->private_data;unsigned long flags; -size_t size; +size_t size, not_copied, copied;size_t bytes_copied;struct usb_request *req;/* This is a pointer to the current USB rx request. */
@@ -523,10 +523,12 @@ printer_read(struct file *fd, char __useelse size = len; - size -=copy_to_user (buf, current_rx_buf, size); - bytes_copied += size; - len -= size; - buf += size; + not_copied =copy_to_user (buf, current_rx_buf, size); + copied = size - not_copied; + + bytes_copied += copied; + len -= copied; + buf += copied;spin_lock_irqsave (&dev->lock, flags);
@@ -541,6 +543,17 @@ printer_read(struct file *fd, char __useif (dev->interface <0 ) goto out_disabled; +if (!copied) { + dev->current_rx_req = current_rx_req; + dev->current_rx_bytes = current_rx_bytes; + dev->current_rx_buf = current_rx_buf; +spin_unlock_irqrestore (&dev->lock, flags); +mutex_unlock (&dev->lock_printer_io); +return bytes_copied ? bytes_copied : -EFAULT ; + } + + size = copied; +/* If we not returning all the data left in this RX request * buffer then adjust the amount of data left in the buffer. * Othewise if we are done with this RX request buffer then
Greg Kroah-Hartman
maintainerPATCH 79/609 USB: gadget: snps-udc: fix device name leak on probe failure
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 29a142d3e8b35ebc9e0bcc78f4bc26c9b6a9ac0b upstream.
The gadget device name is set by UDC core when registering the gadget and must not be set before to avoid leaking the name in intermediate error paths (e.g. when detecting an older chip revision).
--- drivers/usb/gadget/udc/snps_udc_core.c | 1 - 1 file changed, 1 deletion(-)
drivers/usb/gadget/udc/snps_udc_core.c +0 -1
@@ -3133,7 +3133,6 @@ int udc_probe(struct udc *dev)/* device struct setup */ dev->gadget.ops = &udc_ops; -dev_set_name (&dev->gadget.dev,"gadget" ); dev->gadget.name = name; dev->gadget.max_speed =USB_SPEED_HIGH ;
Greg Kroah-Hartman
maintainerPATCH 80/609 USB: gadget: fsl-udc: fix device name leak on probe failure
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 6b874d00c466e73c6448a89856407fe46b2f50e4 upstream.
The gadget device name is set by UDC core when registering the gadget and must not be set before to avoid leaking the name in intermediate error paths (e.g. on dma pool creation failure).
--- drivers/usb/gadget/udc/fsl_udc_core.c | 1 - 1 file changed, 1 deletion(-)
drivers/usb/gadget/udc/fsl_udc_core.c +0 -1
@@ -2466,7 +2466,6 @@ static int fsl_udc_probe(struct platform udc_controller->gadget.name = driver_name;/* Setup gadget.dev and register with kernel */ -dev_set_name (&udc_controller->gadget.dev,"gadget" ); udc_controller->gadget.dev.of_node = pdev->dev.of_node;if (!IS_ERR_OR_NULL (udc_controller->transceiver))
Greg Kroah-Hartman
maintainerPATCH 81/609 usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sonali Pradhan <[email protected]>
commit 1febec7e47cdcd01f43fb0211094e3010474666e upstream.
When unpacking host-supplied NTBs, ncm_unwrap_ntb() checks datagram length against frame_max but does not verify that the datagram fits within the declared block length. Additionally, when decoding multiple NTBs from a single socket buffer, subsequent block lengths are not checked against the actual remaining buffer data.
With these checks missing, a malicious USB host can specify datagram offsets and lengths that point beyond the block, or supply secondary NTB headers declaring lengths larger than the buffer. skb_put_data() then copies adjacent kernel memory from skb_shared_info into the network skb.
Fix this by verifying that sufficient buffer space remains for the NTB header before parsing, handling zero-length block declarations, ensuring that block lengths never exceed the remaining buffer space, and verifying that each datagram payload stays strictly within the block boundary.
--- drivers/usb/gadget/function/f_ncm.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-)
drivers/usb/gadget/function/f_ncm.c +13 -4
@@ -1190,6 +1190,10 @@ static int ncm_unwrap_ntb(struct getherint to_process = skb->len; parse_ntb: +if (to_process < (int )opts->nth_size) { +INFO (port->func.config->cdev,"Packet too small for headers\n" ); + goto err; + } tmp = (__le16 *)ntb_ptr;/* dwSignature */
@@ -1210,8 +1214,12 @@ parse_ntb: tmp++;/* skip wSequence */ block_len =get_ncm (&tmp, opts->block_length); +if (block_len ==0 ) + block_len = to_process; +/* (d)wBlockLength */ -if ((block_len < opts->nth_size + opts->ndp_size) || (block_len > ntb_max)) { +if ((block_len < opts->nth_size + opts->ndp_size) || (block_len > ntb_max) || + (block_len > to_process)) {INFO (port->func.config->cdev,"Bad block length: %#X\n" , block_len); goto err; }
@@ -1274,7 +1282,7 @@ parse_ntb: index = index2;/* wDatagramIndex[0] */ if ((index < opts->nth_size) || - (index > block_len - opts->dpe_size)) { + (index > block_len)) {INFO (port->func.config->cdev,"Bad index: %#X\n" , index); goto err;
@@ -1286,7 +1294,8 @@ parse_ntb:* ethernet hdr + crc or larger than max frame size */ if ((dg_len <14 + crc_len) || - (dg_len > frame_max)) { + (dg_len > frame_max) || + (dg_len > block_len - index)) {INFO (port->func.config->cdev,"Bad dgram length: %#X\n" , dg_len); goto err;
@@ -1311,7 +1320,7 @@ parse_ntb: dg_len2 =get_ncm (&tmp, opts->dgram_item_len);/* wDatagramIndex[1] */ -if (index2 > block_len - opts->dpe_size) { +if (index2 > block_len) {INFO (port->func.config->cdev,"Bad index: %#X\n" , index2); goto err;
Greg Kroah-Hartman
maintainerPATCH 82/609 usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <[email protected]>
commit 0583f2fbf8f86ae3a0ce054f96783dd83e65d9bb upstream.
The Broadcom BDC UDC driver registers its IRQ handler with devm_request_irq() in bdc_udc_init(), so the IRQ is released by devm only after bdc_remove() returns. devm releases resources in reverse LIFO order, but bdc_remove() runs bdc_udc_exit() and bdc_hw_exit() -> bdc_mem_free() manually before returning: bdc_udc_exit() tears down individual endpoint objects via bdc_free_ep(), while bdc_hw_exit() -> bdc_mem_free() frees and NULLs the DMA-coherent status-report ring (bdc->srr.sr_bds) and kfree()s bdc->bdc_ep_array. Both happen while the IRQ handler (bdc_udc_interrupt, requested with IRQF_SHARED) remains deliverable in the window up to the post-remove devm free_irq().
On receipt of a shared interrupt in that window, bdc_udc_interrupt() dereferences bdc->srr.sr_bds[bdc->srr.dqp_index] (NULL or freed DMA) and dispatches sr_handler callbacks that index into bdc_ep_array, causing a NULL-deref or use-after-free.
The same window affects the delayed_work bdc->func_wake_notify, which is armed from the IRQ handler via bdc_sr_uspc() -> handle_link_state_change() -> schedule_delayed_work() and may self-rearm from its own callback bdc_func_wake_timer(). No cancel exists anywhere in the driver, so a queued work item that fires after bdc_remove() returns and the bdc structure is devm-freed dereferences freed memory.
Replace devm_request_irq() with request_irq() and add an explicit free_irq(bdc->irq, bdc) in bdc_remove(). Clear BDC_GIE before free_irq() to stop the device from asserting interrupts, then free_irq() drains any in-flight handler, then cancel_delayed_work_sync() drains the func_wake_notify delayed work. This ordering ensures the IRQ handler and delayed work cannot interfere with the subsequent endpoint and DMA teardown in bdc_udc_exit() and bdc_hw_exit(). Wire the matching free_irq() into the bdc_udc_init() error path so the IRQ is released on probe failure, and route the bdc_init_ep() failure through err0 instead of returning directly.
This issue was found by an in-house static analysis tool.
--- drivers/usb/gadget/udc/bdc/bdc_core.c | 20 ++++++++++++++++++++ drivers/usb/gadget/udc/bdc/bdc_udc.c | 7 ++++--- 2 files changed, 24 insertions(+), 3 deletions(-)
drivers/usb/gadget/udc/bdc/bdc_core.c +20 -0
@@ -586,9 +586,29 @@ disable_clk:static int bdc_remove (struct platform_device *pdev) {struct bdc *bdc; +unsigned long flags; +u32 temp; bdc =platform_get_drvdata (pdev);dev_dbg (bdc->dev,"%s ()\n" , __func__); +/* +* Disable the device interrupt source before freeing the IRQ: +* clear BDC_GIE so the controller stops asserting interrupts, +* then free_irq drains any in-flight handler. +*/ +spin_lock_irqsave (&bdc->lock, flags); + temp =bdc_readl (bdc->regs,BDC_BDCSC ); + temp &= ~BDC_GIE ; +bdc_writel (bdc->regs,BDC_BDCSC , temp); +spin_unlock_irqrestore (&bdc->lock, flags); +free_irq (bdc->irq, bdc); +/* +* Drain func_wake_notify after free_irq: the IRQ handler arms this +* delayed_work via bdc_sr_uspc -> handle_link_state_change -> +* schedule_delayed_work (self-rearmed in bdc_func_wake_timer), so +* the IRQ must be released first to prevent re-arm after cancel. +*/ +cancel_delayed_work_sync (&bdc->func_wake_notify);bdc_udc_exit (bdc);bdc_hw_exit (bdc);bdc_phy_exit (bdc);
drivers/usb/gadget/udc/bdc/bdc_udc.c +4 -3
@@ -530,8 +530,8 @@ int bdc_udc_init(struct bdc *bdc) bdc->gadget.name =BRCM_BDC_NAME ; - ret =devm_request_irq (bdc->dev, bdc->irq, bdc_udc_interrupt, -IRQF_SHARED ,BRCM_BDC_NAME , bdc); + ret =request_irq (bdc->irq, bdc_udc_interrupt,IRQF_SHARED , +BRCM_BDC_NAME , bdc);if (ret) { dev_err(bdc->dev, "failed to request irq #%d %d\n",
@@ -542,7 +542,7 @@ int bdc_udc_init(struct bdc *bdc) ret =bdc_init_ep (bdc);if (ret) {dev_err (bdc->dev,"bdc init ep fail: %d\n" , ret); -return ret; + goto err0; } ret =usb_add_gadget_udc (bdc->dev, &bdc->gadget);
@@ -571,6 +571,7 @@ int bdc_udc_init(struct bdc *bdc) err1:usb_del_gadget_udc (&bdc->gadget); err0: +free_irq (bdc->irq, bdc);bdc_free_ep (bdc);return ret;
Greg Kroah-Hartman
maintainerPATCH 83/609 usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <[email protected]>
commit b70dc75e85ba968b7b76eebfe5d63000080b875b upstream.
uvc_send_response() builds the UVC control response from a user-supplied struct uvc_request_data:
req->length = min_t(unsigned int, uvc->event_length, data->length); ... memcpy(req->buf, data->data, req->length);
req->length is clamped to uvc->event_length, which is taken from the host control request wLength (up to UVC_MAX_REQUEST_SIZE, 64), and to data->length, which comes from the UVCIOC_SEND_RESPONSE ioctl and is only checked for being negative. The source buffer data->data is only 60 bytes, so a response with uvc->event_length and data->length both greater than 60 makes memcpy() read past the end of data->data.
Clamp req->length to sizeof(data->data) as well.
--- drivers/usb/gadget/function/uvc_v4l2.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/gadget/function/uvc_v4l2.c +2 -0
@@ -191,6 +191,8 @@ uvc_send_response(struct uvc_device *uvcreturn usb_ep_set_halt (cdev->gadget->ep0); req->length = min_t(unsigned int, uvc->event_length, data->length); +if (req->length >sizeof (data->data)) + req->length =sizeof (data->data); req->zero = data->length < uvc->event_length;memcpy (req->buf, data->data, req->length);
Greg Kroah-Hartman
maintainerPATCH 84/609 USB: serial: ftdi_sio: add support for E+H FXA291
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Pambor <[email protected]>
commit fad0fd120e29041b3e6cdf41bb12e3184fb524a2 upstream.
The Commubox FXA291 by Endress+Hauser AG is a USB serial converter based on FT232B which is used to communicate with field devices.
It enumerates using the FTDI vendor ID and a custom PID.
usb 1-9: New USB device found, idVendor=0403, idProduct=e510, bcdDevice= 4.00 usb 1-9: New USB device strings: Mfr=1, Product=2, SerialNumber=0 usb 1-9: Product: FXA291
usb 1-9: Manufacturer: Endress+Hauser
usb 1-9: SerialNumber: 00000000ftdi_sio 1-9:1.0: FTDI USB Serial Device converter detected
usb 1-9: Detected FT232B
usb 1-9: FTDI USB Serial Device converter now attached to ttyUSB0
--- drivers/usb/serial/ftdi_sio.c | 2 ++ drivers/usb/serial/ftdi_sio_ids.h | 5 +++++ 2 files changed, 7 insertions(+)
drivers/usb/serial/ftdi_sio.c +2 -0
@@ -1075,6 +1075,8 @@ static const struct usb_device_id id_tab { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602E_PID, 3) },/* Abacus Electrics */ { USB_DEVICE(FTDI_VID, ABACUS_OPTICAL_PROBE_PID) }, +/* Endress+Hauser AG devices */ + { USB_DEVICE(FTDI_VID, FTDI_EH_FXA291_PID) }, { } /* Terminating entry */ };
drivers/usb/serial/ftdi_sio_ids.h +5 -0
@@ -314,6 +314,11 @@#define FTDI_ELV_UIO88_PID 0xFB5F/* USB-I/O Interface (UIO 88) */ /* +* Endress+Hauser AG product ids (FTDI_VID) +*/ +#define FTDI_EH_FXA291_PID 0xE510 + +/* * EVER Eco Pro UPS (http://www.ever.com.pl/) */
Greg Kroah-Hartman
maintainerPATCH 85/609 USB: serial: io_edgeport: cap received transmit credits
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sunho Park <[email protected]>
commit faaddd811c5099f11a5f52e68a6b31a5898cda4f upstream.
The interrupt-status packet reports transmit credits returned by the device. edge_interrupt_callback() adds the 16-bit value to txCredits without checking maxTxCredits.
edge_write() uses txCredits minus the software FIFO count as the amount of data that fits. Since the FIFO is allocated with maxTxCredits bytes, txCredits exceeding maxTxCredits can cause OOB write in ring buffer.
Cap accumulated credits at maxTxCredits. Conforming devices should never hit the cap.
--- drivers/usb/serial/io_edgeport.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/serial/io_edgeport.c +2 -1
@@ -646,7 +646,8 @@ static void edge_interrupt_callback(struif (edge_port && edge_port->open) {spin_lock_irqsave (&edge_port->ep_lock, flags); - edge_port->txCredits += txCredits; + edge_port->txCredits =min (edge_port->txCredits + txCredits, + edge_port->maxTxCredits);spin_unlock_irqrestore (&edge_port->ep_lock, flags); dev_dbg(dev, "%s - txcredits for port%d = %d\n",
Greg Kroah-Hartman
maintainerPATCH 86/609 USB: serial: keyspan_pda: fix data loss on receive throttling
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 42a97c0480f96a2977e6d51ce512adc780f1ef5d upstream.
Killing the interrupt-in urb when the line disciple requests throttling may lead to data loss if an ongoing transfer is cancelled.
Instead set a flag to prevent the completion handler from resubmitting the urb until the port is unthrottled.
--- drivers/usb/serial/keyspan_pda.c | 44 +++++++++++++++++++++++++++++++-------- 1 file changed, 35 insertions(+), 9 deletions(-)
drivers/usb/serial/keyspan_pda.c +35 -9
@@ -35,6 +35,8 @@ struct keyspan_pda_private {struct work_struct unthrottle_work;struct usb_serial *serial;struct usb_serial_port *port; +bool throttled; +bool throttle_req; };static int keyspan_pda_write_start (struct usb_serial_port *port);
@@ -150,6 +152,7 @@ static void keyspan_pda_rx_interrupt(strint retval;int status = urb->status;struct keyspan_pda_private *priv; +bool throttled = false;unsigned long flags; priv =usb_get_serial_port_data (port);
@@ -211,16 +214,24 @@ static void keyspan_pda_rx_interrupt(str } exit: - retval =usb_submit_urb (urb,GFP_ATOMIC ); -if (retval) -dev_err (&port->dev, -"%s - usb_submit_urb failed with result %d\n" , - __func__, retval); +spin_lock_irqsave (&port->lock, flags); +if (priv->throttle_req) { + priv->throttled = true; + throttled = true; + } +spin_unlock_irqrestore (&port->lock, flags); + +if (!throttled) { + retval =usb_submit_urb (urb,GFP_ATOMIC ); +if (retval) +dev_err (&port->dev,"failed to resubmit in urb: %d\n" , retval); + } }static void keyspan_pda_rx_throttle (struct tty_struct *tty) {struct usb_serial_port *port = tty->driver_data; +struct keyspan_pda_private *priv =usb_get_serial_port_data (port);/* * Stop receiving characters. We just turn off the URB request, and
@@ -230,16 +241,29 @@ static void keyspan_pda_rx_throttle(stru* send an XOFF, although it might make sense to foist that off upon * the device too. */ -usb_kill_urb (port->interrupt_in_urb); +spin_lock_irq (&port->lock); + priv->throttle_req = true; +spin_unlock_irq (&port->lock); }static void keyspan_pda_rx_unthrottle (struct tty_struct *tty) {struct usb_serial_port *port = tty->driver_data; +struct keyspan_pda_private *priv =usb_get_serial_port_data (port); +bool throttled; +int ret; + +spin_lock_irq (&port->lock); + throttled = priv->throttled; + priv->throttled = false; + priv->throttle_req = false; +spin_unlock_irq (&port->lock); -/* just restart the receive interrupt URB */ -if (usb_submit_urb (port->interrupt_in_urb,GFP_KERNEL )) -dev_dbg (&port->dev,"usb_submit_urb(read urb) failed\n" ); +if (throttled) { + ret =usb_submit_urb (port->interrupt_in_urb,GFP_KERNEL ); +if (ret) +dev_err (&port->dev,"failed to submit in urb: %d\n" , ret); + } }static speed_t keyspan_pda_setbaud (struct usb_serial *serial,speed_t baud)
@@ -575,6 +599,8 @@ static int keyspan_pda_open(struct tty_sspin_lock_irq (&port->lock); priv->tx_room = rc; + priv->throttled = false; + priv->throttle_req = false;spin_unlock_irq (&port->lock); rc =usb_submit_urb (port->interrupt_in_urb,GFP_KERNEL );
Greg Kroah-Hartman
maintainerPATCH 87/609 USB: serial: option: add TDTECH MT5710-CN
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chukun Pan <[email protected]>
commit 55645e4f3c6022ffb160ad3617d2b624eaa38501 upstream.
Add support for the TDTECH MT5710-CN (5G redcap) module based on the Huawei HiSilicon Balong chip.
T: Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=3466 ProdID=3301 Rev=ff.ff S: Manufacturer=TD Tech Ltd. S: Product=TDTECH MT571X S: SerialNumber=0123456789ABCDEF C:* #Ifs= 6 Cfg#= 1 Atr=c0 MxPwr= 0mA A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0d Prot=00 I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0d Prot=00 Driver=cdc_ncm E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=01 Driver=cdc_ncm I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=01 Driver=cdc_ncm E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=13 Driver=option E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=12 Driver=option E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=1c Driver=option E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=14 Driver=option E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
Interface: ECM / NCM + DIAG + AT + SERIAL + GPS
--- drivers/usb/serial/option.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/option.c +1 -0
@@ -2497,6 +2497,7 @@ static const struct usb_device_id option .driver_info = RSVD(5) }, { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x1003, 0xff), /* Rolling RW135R-GL (laptop MBIM) */ .driver_info = RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(0x3466, 0x3301, 0xff) }, /* TDTECH MT5710-CN */ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for Global */ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0x00, 0x40) }, { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0xff, 0x40) },
Greg Kroah-Hartman
maintainerPATCH 88/609 crypto: rsa-pkcs1pad: Dont WARN on an empty digest
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Doruk Tan Ozturk <[email protected]>
KEYCTL_PKEY_VERIFY lets an unprivileged caller supply a zero-length digest (in_len == 0). keyctl_pkey_params_get_2() accepts the zero length and the request reaches pkcs1pad_verify(), where the empty digest is rejected but only after being passed through WARN_ON(!digest_size). The warning is therefore directly user-triggerable, and on kernels built with panic_on_warn=1 an unprivileged process can panic the machine -- a local denial of service. Reproduced as UID 65534 in a setuid sandbox.
Keep rejecting the invalid request with -EINVAL, but do not emit a warning for the user-controlled length.
Mainline does not contain this code path; commit 1e562deacecc ("crypto: rsassa-pkcs1 - Migrate to sig_alg backend") removed pkcs1pad_verify() in v6.13-rc1. This is a minimal fix for the affected stable branches. It applies as-is to 6.1.y, 6.6.y and 6.12.y (identical pkcs1pad_verify); the 5.10.y/5.15.y form is sent as a separate patch due to the older req->dst_len spelling.
Found by 0sec automated security-research tooling (https://0sec.ai).
--- crypto/rsa-pkcs1pad.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
crypto/rsa-pkcs1pad.c +1 -1
@@ -537,7 +537,7 @@ static int pkcs1pad_verify(struct akcipher_request *req)const unsigned int digest_size = req->dst_len;int err; -if (WARN_ON (req->dst) ||WARN_ON (!digest_size) || +if (WARN_ON (req->dst) || !digest_size || !ctx->key_size || sig_size != ctx->key_size)return -EINVAL ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 89/609 Revert "drm/amd/display: Add missing kdoc for ALLM parameters"
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
This reverts commit 7cb4e8ba78f96980a23be4414c8f22f417c814fa.
--- drivers/gpu/drm/amd/display/modules/info_packet/info_packet.c | 2 -- 1 file changed, 2 deletions(-)
drivers/gpu/drm/amd/display/modules/info_packet/info_packet.c +0 -2
@@ -445,8 +445,6 @@ void mod_build_vsc_infopacket(const struct dc_stream_state *stream,* * @stream: contains data we may need to construct VSIF (i.e. timing_3d_format, etc.) * @info_packet: output structure where to store VSIF -* @ALLMEnabled: indicates whether ALLM HF-VSIF should be generated -* @ALLMValue: ALLM bit value to advertise in HF-VSIF */ void mod_build_hf_vsif_infopacket (const struct dc_stream_state *stream,struct dc_info_packet *info_packet)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 90/609 bpf: Support for hardening against JIT spraying
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawan Gupta <[email protected]>
commit 96cce16e26dd02a8678f1e87f88a4b5cdb63b995 upstream.
The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are loaded and freed. When fresh code is written into space that a previous program occupied, an indirect jump into the new program can reuse a branch prediction left behind by the old one.
Flush the indirect branch predictors before reusing JIT memory so that indirect jumps into a newly written program don't reuse predictions from an old program that occupied the same space.
Introduce bpf_arch_pred_flush_enabled static key and bpf_arch_pred_flush static call for flushing the branch predictors on JIT memory reuse. Architectures that need a flush, can update it to a predictor flush function. By default, its a NOP and does not emit any CALL.
Allocations larger than a pack are not covered by this flush. That is safe because cBPF programs (the unprivileged attack surface) are bounded well below a pack size. Issue a warning if this assumption is ever violated while the flush is active.
--- include/linux/filter.h | 10 ++++++++++ kernel/bpf/core.c | 19 +++++++++++++++++++ 2 files changed, 29 insertions(+)
include/linux/filter.h +10 -0
@@ -21,6 +21,7 @@#include <linux/vmalloc.h> #include <linux/sockptr.h> #include <crypto/sha1.h> +#include <linux/static_call.h> #include <linux/u64_stats_sync.h> #include <net/sch_generic.h>
@@ -1058,6 +1059,15 @@ extern long bpf_jit_limit_max;typedef void (*bpf_jit_fill_hole_t )(void *area,unsigned int size); +/* +* Flush the indirect branch predictors before reusing JIT memory, so that +* indirect jumps into a newly written program don't reuse predictions left +* behind by an old program that occupied the same space. +*/ +void bpf_arch_pred_flush (void ); +DECLARE_STATIC_CALL (bpf_arch_pred_flush, bpf_arch_pred_flush); +DECLARE_STATIC_KEY_FALSE (bpf_pred_flush_enabled); +void bpf_jit_fill_hole_with_zero (void *area,unsigned int size); struct bpf_binary_header *
kernel/bpf/core.c +19 -0
@@ -35,6 +35,7 @@#include <linux/bpf_verifier.h> #include <linux/nodemask.h> #include <linux/nospec.h> +#include <linux/static_call.h> #include <asm/barrier.h> #include <asm/unaligned.h>
@@ -852,6 +853,15 @@ void bpf_jit_fill_hole_with_zero(void *area, unsigned int size)memset (area,0 , size); } +DEFINE_STATIC_CALL_NULL (bpf_arch_pred_flush, bpf_arch_pred_flush); + +/* +* Enabled once bpf_arch_pred_flush points at a real flush routine. Lets the +* pack allocator test "is a predictor flush wired up at all" with a cheap +* static branch instead of repeatedly querying the static call target. +*/ +DEFINE_STATIC_KEY_FALSE (bpf_pred_flush_enabled); +#define BPF_PROG_SIZE_TO_NBITS (size) (round_up(size, BPF_PROG_CHUNK_SIZE) / BPF_PROG_CHUNK_SIZE)static DEFINE_MUTEX (pack_mutex);
@@ -905,6 +915,14 @@ void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns)mutex_lock (&pack_mutex);if (size >BPF_PROG_PACK_SIZE ) { +/* +* Allocations larger than a pack get their own pages, and +* predictors are not flushed for such allocation. This is only +* safe because cBPF programs (the unprivileged attack surface) +* are bounded well below a pack size. +*/ +if (static_branch_unlikely (&bpf_pred_flush_enabled)) +pr_warn_once ("BPF: Predictors not flushed for allocations greater than BPF_PROG_PACK_SIZE\n" ); size =round_up (size,PAGE_SIZE ); ptr =module_alloc (size);if (ptr) {
@@ -929,6 +947,7 @@ void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns) pos =0 ; found_free_area: +static_call_cond (bpf_arch_pred_flush)();bitmap_set (pack->bitmap, pos, nbits); ptr = (void *)(pack->ptr) + (pos <<BPF_PROG_CHUNK_SHIFT );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 91/609 x86/bugs: Enable IBPB flush on BPF JIT allocation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawan Gupta <[email protected]>
commit a3af84b0fa00ead01fcd0e28b5d773ff25990a0d upstream.
Enable hardening against JIT spraying when Spectre-v2 mitigations are in use. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip enabling the IBPB flush if the BPF dispatcher is already using a retpoline sequence.
This hardening applies only when BPF-JIT is in use. Guard the enabling under CONFIG_BPF_JIT so that bugs.c still builds with CONFIG_BPF_JIT=n.
[ pawan: Use entry_ibpb() instead of write_ibpb(). JIT hardening enable
moved to spectre_v2_select_mitigation() because there is no spectre_v2_apply_mitigation()]
--- arch/x86/include/asm/nospec-branch.h | 4 ++ arch/x86/kernel/cpu/bugs.c | 50 +++++++++++++++++++++++++++++++---- 2 files changed, 49 insertions(+), 5 deletions(-)
arch/x86/include/asm/nospec-branch.h +4 -0
@@ -293,6 +293,10 @@ void srso_safe_ret(void);void srso_alias_safe_ret (void );void handle_interrupted_saferet (struct pt_regs *regs); +#ifdef CONFIG_BPF_JIT +extern void bpf_arch_ibpb (void ); +#endif +#ifdef CONFIG_X86_64 extern void clear_bhb_loop (void );#endif
arch/x86/kernel/cpu/bugs.c +45 -5
88 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 92/609 bpf: Restrict JIT predictor flush to cBPF
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawan Gupta <[email protected]>
commit 0bb99f2cfaae6822d734d69722de30af823efdf3 upstream.
Currently predictor flush on memory reuse is done for all BPF JIT allocations, but only cBPF programs can be loaded by an unprivileged user. eBPF is privileged by default, and flushing predictors for all CPUs on every eBPF reuse penalizes the common case for no security benefit.
eBPF allocations can be frequent on busy systems, only flush predictors for cBPF programs. Trampoline and dispatcher allocations also skip the flush as they are eBPF-only.
[pawan: backport dropped "was_classic" hunk for arches that do not
support pack allocator]
--- arch/x86/net/bpf_jit_comp.c | 3 ++- include/linux/filter.h | 5 +++-- kernel/bpf/core.c | 13 ++++++++----- kernel/bpf/dispatcher.c | 2 +- 4 files changed, 14 insertions(+), 9 deletions(-)
arch/x86/net/bpf_jit_comp.c +2 -1
@@ -2553,7 +2553,8 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)/* allocate module memory for x86 insns and extable */ header =bpf_jit_binary_pack_alloc (roundup (proglen, align) + extable_size, &image, align, &rw_header, &rw_image, - jit_fill_hole); + jit_fill_hole, +bpf_prog_was_classic (prog));if (!header) { prog = orig_prog; goto out_addrs;
include/linux/filter.h +3 -2
@@ -1082,7 +1082,7 @@ void bpf_jit_free(struct bpf_prog *fp);struct bpf_binary_header *bpf_jit_binary_pack_hdr (const struct bpf_prog *fp); -void *bpf_prog_pack_alloc (u32 size,bpf_jit_fill_hole_t bpf_fill_ill_insns); +void *bpf_prog_pack_alloc (u32 size,bpf_jit_fill_hole_t bpf_fill_ill_insns,bool was_classic);void bpf_prog_pack_free (struct bpf_binary_header *hdr);static inline bool bpf_prog_kallsyms_verify_off (const struct bpf_prog *fp)
@@ -1096,7 +1096,8 @@ bpf_jit_binary_pack_alloc(unsigned int proglen, u8 **ro_image,unsigned int alignment, struct bpf_binary_header **rw_hdr, u8 **rw_image, - bpf_jit_fill_hole_t bpf_fill_ill_insns); + bpf_jit_fill_hole_t bpf_fill_ill_insns, + bool was_classic);int bpf_jit_binary_pack_finalize (struct bpf_prog *prog,struct bpf_binary_header *ro_header,struct bpf_binary_header *rw_header);
kernel/bpf/core.c +8 -5
@@ -906,7 +906,7 @@ static struct bpf_prog_pack *alloc_new_pack(bpf_jit_fill_hole_t bpf_fill_ill_insreturn pack; } -void *bpf_prog_pack_alloc (u32 size,bpf_jit_fill_hole_t bpf_fill_ill_insns) +void *bpf_prog_pack_alloc (u32 size,bpf_jit_fill_hole_t bpf_fill_ill_insns,bool was_classic) {unsigned int nbits =BPF_PROG_SIZE_TO_NBITS (size);struct bpf_prog_pack *pack;
@@ -921,7 +921,7 @@ void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns)* safe because cBPF programs (the unprivileged attack surface) * are bounded well below a pack size. */ -if (static_branch_unlikely (&bpf_pred_flush_enabled)) +if (was_classic &&static_branch_unlikely (&bpf_pred_flush_enabled))pr_warn_once ("BPF: Predictors not flushed for allocations greater than BPF_PROG_PACK_SIZE\n" ); size =round_up (size,PAGE_SIZE ); ptr =module_alloc (size);
@@ -947,7 +947,9 @@ void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns) pos =0 ; found_free_area: -static_call_cond (bpf_arch_pred_flush)(); +/* Flush only for cBPF as it may contain a crafted gadget */ +if (static_branch_unlikely (&bpf_pred_flush_enabled) && was_classic) +static_call_cond (bpf_arch_pred_flush)();bitmap_set (pack->bitmap, pos, nbits); ptr = (void *)(pack->ptr) + (pos <<BPF_PROG_CHUNK_SHIFT );
@@ -1107,7 +1109,8 @@ bpf_jit_binary_pack_alloc(unsigned int proglen, u8 **image_ptr,unsigned int alignment, struct bpf_binary_header **rw_header, u8 **rw_image, - bpf_jit_fill_hole_t bpf_fill_ill_insns) + bpf_jit_fill_hole_t bpf_fill_ill_insns, + bool was_classic) { struct bpf_binary_header *ro_header;u32 size, hole, start;
@@ -1120,7 +1123,7 @@ bpf_jit_binary_pack_alloc(unsigned int proglen, u8 **image_ptr,if (bpf_jit_charge_modmem (size))return NULL ; - ro_header =bpf_prog_pack_alloc (size, bpf_fill_ill_insns); + ro_header =bpf_prog_pack_alloc (size, bpf_fill_ill_insns, was_classic);if (!ro_header) {bpf_jit_uncharge_modmem (size);return NULL ;
kernel/bpf/dispatcher.c +1 -1
@@ -145,7 +145,7 @@ void bpf_dispatcher_change_prog(struct bpf_dispatcher *d, struct bpf_prog *from,mutex_lock (&d->mutex);if (!d->image) { - d->image =bpf_prog_pack_alloc (PAGE_SIZE , bpf_jit_fill_hole_with_zero); + d->image =bpf_prog_pack_alloc (PAGE_SIZE , bpf_jit_fill_hole_with_zero, false);if (!d->image) goto out; d->rw_image =bpf_jit_alloc_exec (PAGE_SIZE );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 93/609 bpf: Skip redundant IBPB in pack allocator
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawan Gupta <[email protected]>
commit a23c1c5396a91680703360d1ee28a44657c503c4 upstream.
bpf_prog_pack_alloc() issues IBPB on all CPUs on every cBPF allocation, even when reusing chunks from an existing pack where no new memory was touched since the last IBPB.
Since IBPB on all CPUs is heavy, Dave Hansen suggested to track allocation since last IBPB, and only issue IBPB at reuse for the chunks that have not seen an IBPB since they were last freed.
Track per-pack whether an IBPB is needed via arch_flush_needed. Set it when allocating a chunk, reset on IBPB flush. On reuse, conditionally issue the flush. Since IBPB invalidates all BTB entries, clear the flag on all packs after flushing.
--- kernel/bpf/core.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
kernel/bpf/core.c +14 -1
@@ -845,6 +845,7 @@ int bpf_jit_add_poke_descriptor(struct bpf_prog *prog,struct bpf_prog_pack {struct list_head list;void *ptr; +bool arch_flush_needed;unsigned long bitmap[]; };
@@ -900,6 +901,8 @@ static struct bpf_prog_pack *alloc_new_pack(bpf_jit_fill_hole_t bpf_fill_ill_insbitmap_zero (pack->bitmap,BPF_PROG_PACK_SIZE /BPF_PROG_CHUNK_SIZE );list_add_tail (&pack->list, &pack_list); +if (static_branch_unlikely (&bpf_pred_flush_enabled)) + pack->arch_flush_needed = true;set_vm_flush_reset_perms (pack->ptr);set_memory_ro ((unsigned long )pack->ptr,BPF_PROG_PACK_SIZE /PAGE_SIZE );set_memory_x ((unsigned long )pack->ptr,BPF_PROG_PACK_SIZE /PAGE_SIZE );
@@ -948,8 +951,15 @@ void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns, bool found_free_area:/* Flush only for cBPF as it may contain a crafted gadget */ -if (static_branch_unlikely (&bpf_pred_flush_enabled) && was_classic) +if (static_branch_unlikely (&bpf_pred_flush_enabled) && + pack->arch_flush_needed && + was_classic) { +struct bpf_prog_pack *p; +static_call_cond (bpf_arch_pred_flush)(); +list_for_each_entry (p, &pack_list, list) + p->arch_flush_needed = false; + }bitmap_set (pack->bitmap, pos, nbits); ptr = (void *)(pack->ptr) + (pos <<BPF_PROG_CHUNK_SHIFT );
@@ -987,6 +997,9 @@ void bpf_prog_pack_free(struct bpf_binary_header *hdr) "bpf_prog_pack bug: missing bpf_arch_text_invalidate?\n");bitmap_clear (pack->bitmap, pos, nbits); + +if (static_branch_unlikely (&bpf_pred_flush_enabled)) + pack->arch_flush_needed = true;if (bitmap_find_next_zero_area (pack->bitmap,BPF_PROG_CHUNK_COUNT ,0 ,BPF_PROG_CHUNK_COUNT ,0 ) ==0 ) {list_del (&pack->list);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 94/609 bpf: Prefer packs that wont trigger an IBPB flush on allocation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawan Gupta <[email protected]>
commit a9b1f19a6a673ba06820898d0f1ad02883ea1639 upstream.
Currently BPF pack allocator picks the chunks from the first available pack. While this is okay, it naturally leads to more frequent flushes when there are multiple packs in the system that weren't used since the last flush.
As an optimization prefer allocating the new programs from packs that are unused since last flush. When all packs are dirty, allocation forces a flush and marks all packs clean.
Below are some future optimizations ideas:
1. Currently, the "dirty" tracking is only done at the pack-level. Flush frequency can further be reduced with chunk-level tracking. This requires a new bitmap per-pack to track the dirty state.
2. IBPB flush is done on all CPUs, even if only a single CPU ran the BPF program. On a system with hundreds of CPUs this could be a major bottleneck forcing hundreds of IPIs to deliver the flush. The solution is to track the CPUs where a BPF program ran, and issue IBPB only on those CPUs.
3. Avoid IBPB when flush is already done at other sources (e.g. context switch).
--- kernel/bpf/core.c | 27 ++++++++++++++++++++++++--- 1 file changed, 24 insertions(+), 3 deletions(-)
kernel/bpf/core.c +24 -3
@@ -912,8 +912,8 @@ static struct bpf_prog_pack *alloc_new_pack(bpf_jit_fill_hole_t bpf_fill_ill_insvoid *bpf_prog_pack_alloc (u32 size,bpf_jit_fill_hole_t bpf_fill_ill_insns,bool was_classic) {unsigned int nbits =BPF_PROG_SIZE_TO_NBITS (size); -struct bpf_prog_pack *pack; -unsigned long pos; +struct bpf_prog_pack *pack, *fallback_pack =NULL ; +unsigned long pos, fallback_pos =0 ;void *ptr =NULL ;mutex_lock (&pack_mutex);
@@ -939,8 +939,29 @@ void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns, boollist_for_each_entry (pack, &pack_list, list) { pos =bitmap_find_next_zero_area (pack->bitmap,BPF_PROG_CHUNK_COUNT ,0 , nbits,0 ); -if (pos <BPF_PROG_CHUNK_COUNT ) +if (pos >=BPF_PROG_CHUNK_COUNT ) +continue ; +/* Flush not enabled, use any pack */ +if (!static_branch_unlikely (&bpf_pred_flush_enabled)) goto found_free_area; +/* +* cBPF reuse of a dirty pack triggers a flush, so prefer a +* clean pack for cBPF. eBPF never flushes, so pick the first +* free pack, dirty or clean. +*/ +if (!was_classic || !pack->arch_flush_needed) + goto found_free_area; +if (!fallback_pack) { + fallback_pack = pack; + fallback_pos = pos; + } + } + +/* No preferred pack found */ +if (fallback_pack) { + pack = fallback_pack; + pos = fallback_pos; + goto found_free_area; } pack =alloc_new_pack (bpf_fill_ill_insns);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 95/609 bpf: Prefer dirty packs for eBPF allocations
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawan Gupta <[email protected]>
commit b72e29e0f7ee329d89f86db8700c8ea99b4a370a upstream.
The pack allocator only flushes predictors when reusing a dirty pack for cBPF, eBPF allocations never trigger a flush. Currently, eBPF picks the first free pack, which could be a clean pack. As an optimization, leaving a clean pack for cBPF can avoid flushes.
Prefer dirty packs for eBPF and keep clean packs free for cBPF. This mirrors the existing cBPF preference for clean packs: each program kind prefers the pack that avoids an extra flush, and falls back to the other kind only when no preferred pack has room. eBPF reuse of a dirty pack is harmless since eBPF being privileged does not flush.
--- kernel/bpf/core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
kernel/bpf/core.c +3 -3
@@ -946,10 +946,10 @@ void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns, bool goto found_free_area;/* * cBPF reuse of a dirty pack triggers a flush, so prefer a -* clean pack for cBPF. eBPF never flushes, so pick the first -* free pack, dirty or clean. +* clean pack for cBPF. eBPF never flushes, so steer it to a +* dirty pack and keep clean packs free for cBPF. */ -if (!was_classic || !pack->arch_flush_needed) +if (was_classic ^ pack->arch_flush_needed) goto found_free_area;if (!fallback_pack) { fallback_pack = pack;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 96/609 bpf: Fix ld_{abs,ind} failure path analysis in subprogs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
commit ee861486e377edc55361c08dcbceab3f6b6577bd upstream.
Usage of ld_{abs,ind} instructions got extended into subprogs some time ago via commit 09b28d76eac4 ("bpf: Add abnormal return checks."). These are only allowed in subprograms when the latter are BTF annotated and have scalar return types.
The code generator in bpf_gen_ld_abs() has an abnormal exit path (r0=0 + exit) from legacy cBPF times. While the enforcement is on scalar return types, the verifier must also simulate the path of abnormal exit if the packet data load via ld_{abs,ind} failed.
This is currently not the case. Fix it by having the verifier simulate both success and failure paths, and extend it in similar ways as we do for tail calls. The success path (r0=unknown, continue to next insn) is pushed onto stack for later validation and the r0=0 and return to the caller is done on the fall-through side.
[ Dropped visit_abnormal_return_insn changes: depends on 7.0 symbols from
e40f5a6bf88a ("bpf: correct stack liveness for tail calls");
Hunk1: adapted IS_ERR/PTR_ERR to !branch/-EFAULT to match push_stack() NULL-on-failure convention. ]
--- kernel/bpf/verifier.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
kernel/bpf/verifier.c +17 -0
@@ -10751,6 +10751,23 @@ static int check_ld_abs(struct bpf_verifier_env *env, struct bpf_insn *insn)mark_reg_unknown (env, regs,BPF_REG_0 );/* ld_abs load up to 32-bit skb data. */ regs[BPF_REG_0 ].subreg_def = env->insn_idx +1 ; +/* +* See bpf_gen_ld_abs() which emits a hidden BPF_EXIT with r0=0 +* which must be explored by the verifier when in a subprog. +*/ +if (env->cur_state->curframe) { +struct bpf_verifier_state *branch; + +mark_reg_scratched (env,BPF_REG_0 ); + branch =push_stack (env, env->insn_idx +1 , env->insn_idx, false); +if (!branch) +return -EFAULT ; +mark_reg_known_zero (env, regs,BPF_REG_0 ); + err =prepare_func_exit (env, &env->insn_idx); +if (err) +return err; + env->insn_idx--; + }return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 97/609 usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xincheng Zhang <[email protected]>
commit 1fc50f1ecde39feb4fccdaf4bc71aa6c0eb25c49 upstream.
The VIA VL805/806 xHCI controller advertises AC64, but fails to handle DMA addresses at or above 0x1000000000. On systems with large amounts of RAM, this can cause USB device failures when the controller is given DMA addresses beyond its usable address width.
Do not use XHCI_NO_64BIT_SUPPORT for this controller. That quirk clears the cached AC64 capability and limits DMA to 32 bits, causing unnecessary bouncing for addresses between 4GiB and 64GiB and hiding the controller's real AC64 capability from code that may need to distinguish register access width from usable DMA address width.
Track the usable DMA address width separately from the AC64 capability. Initialize the generic xhci->dma_mask_bits field to 64 and let PCI quirks reduce it for controllers with narrower DMA support. Set VIA VL805/806 to 36 bits so the DMA API only hands it addresses in the range it can handle while keeping HCCPARAMS1.AC64 visible.
--- drivers/usb/host/xhci-pci.c | 1 + drivers/usb/host/xhci.c | 15 ++++++++++----- drivers/usb/host/xhci.h | 1 + 3 files changed, 12 insertions(+), 5 deletions(-)
drivers/usb/host/xhci-pci.c +1 -0
@@ -337,6 +337,7 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)if (pdev->vendor ==PCI_VENDOR_ID_VIA && pdev->device ==PCI_DEVICE_ID_VIA_VL805 ) { xhci->quirks |=XHCI_LPM_SUPPORT ; xhci->quirks |=XHCI_TRB_OVERFETCH ; + xhci->dma_mask_bits =36 ; } if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
drivers/usb/host/xhci.c +10 -5
@@ -5394,6 +5394,7 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)if (xhci->hci_version >0x100 ) xhci->hcc_params2 =readl (&xhci->cap_regs->hcc_params2); + xhci->dma_mask_bits =64 ;/* xhci-plat or xhci-pci might have set max_interrupters already */ if ((!xhci->max_interrupters) || xhci->max_interrupters >HCS_MAX_INTRS (xhci->hcs_params1))
@@ -5434,12 +5435,16 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)if (xhci->quirks &XHCI_NO_64BIT_SUPPORT ) xhci->hcc_params &= ~BIT (0 ); -/* Set dma_mask and coherent_dma_mask to 64-bits, -* if xHC supports 64-bit addressing */ +/* +* Set dma_mask and coherent_dma_mask to 64-bits if xHC supports +* 64-bit addressing, unless a controller-specific quirk callback +* limits the usable address width. +*/ if (HCC_64BIT_ADDR (xhci->hcc_params) && - !dma_set_mask (dev,DMA_BIT_MASK (64 ))) { -xhci_dbg (xhci,"Enabling 64-bit DMA addresses.\n" ); -dma_set_coherent_mask (dev,DMA_BIT_MASK (64 )); + !dma_set_mask (dev,DMA_BIT_MASK (xhci->dma_mask_bits))) { +xhci_dbg (xhci,"Enabling %u-bit DMA addresses.\n" , + xhci->dma_mask_bits); +dma_set_coherent_mask (dev,DMA_BIT_MASK (xhci->dma_mask_bits)); }else {/* * This is to avoid error in cases where a 32-bit USB
drivers/usb/host/xhci.h +1 -0
@@ -1543,6 +1543,7 @@ struct xhci_hcd {int event_ring_max;/* 4KB min, 128MB max */ int page_size; +unsigned int dma_mask_bits;/* Valid values are 12 to 20, inclusive */ int page_shift;/* msi-x vectors */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 98/609 wifi: ath9k: hif_usb: dont dereference hif_dev after re-arming firmware request
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cheng Yongkang <[email protected]>
[ Upstream commit dad9f96945d77ecd4708f730c06ef54dcd8cc057 ]
ath9k_hif_request_firmware() re-arms an asynchronous firmware load via request_firmware_nowait(), passing hif_dev as the completion context, and then still dereferences hif_dev:
dev_info(&hif_dev->udev->dev, "ath9k_htc: Firmware %s requested\n", hif_dev->fw_name);
The re-armed callback ath9k_hif_usb_firmware_cb() runs on the "events" workqueue and, when the firmware is missing, walks the retry chain into ath9k_hif_usb_firmware_fail() -> complete_all(&hif_dev->fw_done). That releases the wait_for_completion(&hif_dev->fw_done) in a concurrent ath9k_hif_usb_disconnect(), which then kfree()s hif_dev. The trailing dev_info() in the frame that re-armed the request can therefore read freed memory (hif_dev->udev, the first field of struct hif_device_usb):
BUG: KASAN: slab-use-after-free in ath9k_hif_request_firmware Read of size 8 ... by task kworker/... ath9k_hif_request_firmware ath9k_hif_usb_firmware_cb drivers/net/wireless/ath/ath9k/hif_usb.c:1247 request_firmware_work_func Allocated by ...: ath9k_hif_usb_probe drivers/net/wireless/ath/ath9k/hif_usb.c Freed by ...: ath9k_hif_usb_disconnect -> kfree drivers/net/wireless/ath/ath9k/hif_usb.c
The fw_done barrier only makes disconnect wait for the firmware chain to *terminate*; it does not protect the outer ath9k_hif_request_firmware() frame that re-armed the request and keeps touching hif_dev afterwards.
Drop the post-request dev_info(): it is the only use of hif_dev after the async request is armed, and it is purely informational (the dev_err() on the failure path runs only when request_firmware_nowait() did not arm a callback, so hif_dev is still alive there).
This was first reported by syzbot as a single, non-reproduced crash that was later auto-obsoleted, and was independently rediscovered by the reFuzz fuzzer, which produced a C reproducer (USB-gadget connect/disconnect of an ath9k_htc device whose firmware download fails). The vulnerable code is unchanged and still present in v7.1-rc6, where the slab-use-after-free reproduces under KASAN once the (sub-microsecond) race window is widened.
--- drivers/net/wireless/ath/ath9k/hif_usb.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)
drivers/net/wireless/ath/ath9k/hif_usb.c +1 -6
@@ -1227,15 +1227,10 @@ static int ath9k_hif_request_firmware(struct hif_device_usb *hif_dev, ret =request_firmware_nowait (THIS_MODULE , true, hif_dev->fw_name, &hif_dev->udev->dev,GFP_KERNEL , hif_dev, ath9k_hif_usb_firmware_cb); -if (ret) { +if (ret)dev_err (&hif_dev->udev->dev,"ath9k_htc: Async request for firmware %s failed\n" , hif_dev->fw_name); -return ret; - } - -dev_info (&hif_dev->udev->dev,"ath9k_htc: Firmware %s requested\n" , - hif_dev->fw_name);return ret; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 99/609 wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gaole Zhang <[email protected]>
[ Upstream commit e8d85672dd7e2523f774caafba8f858384e18df7 ]
In ATH11K_QMI_EVENT_FW_READY, ATH11K_FLAG_REGISTERED is set unconditionally even when ath11k_core_qmi_firmware_ready() fails. This leaves the driver in an inconsistent state where initialization is considered complete although the firmware ready handling did not finish successfully. During the subsequent SSR, the driver enters the restart path based on this incorrect state and dereferences uninitialized srng members, resulting in a NULL pointer dereference.
Call trace: ath11k_hal_srng_access_begin+0xc/0x60 [ath11k] (P) ath11k_ce_cleanup_pipes+0x17c/0x180 [ath11k] ath11k_core_restart+0x40/0x168 [ath11k]
Fix this by:
- skipping firmware_ready if ATH11K_FLAG_REGISTERED is already set
- setting ATH11K_FLAG_REGISTERED only when firmware_ready succeeds
- setting ATH11K_FLAG_QMI_FAIL and aborting the FW_READY handling on error
Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.2.0.c2-00204-QCAMSLSWPLZ-1
--- drivers/net/wireless/ath/ath11k/qmi.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/net/wireless/ath/ath11k/qmi.c +8 -3
@@ -3235,9 +3235,14 @@ static void ath11k_qmi_driver_event_work(struct work_struct *work)clear_bit (ATH11K_FLAG_CRASH_FLUSH , &ab->dev_flags);clear_bit (ATH11K_FLAG_RECOVERY , &ab->dev_flags); -ath11k_core_qmi_firmware_ready (ab); -set_bit (ATH11K_FLAG_REGISTERED , &ab->dev_flags); - +if (!test_bit (ATH11K_FLAG_REGISTERED , &ab->dev_flags)) { + ret =ath11k_core_qmi_firmware_ready (ab); +if (ret) { +set_bit (ATH11K_FLAG_QMI_FAIL , &ab->dev_flags); +break ; + } +set_bit (ATH11K_FLAG_REGISTERED , &ab->dev_flags); + }break ;case ATH11K_QMI_EVENT_COLD_BOOT_CAL_DONE :break ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 100/609 hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
[ Upstream commit 9ab8656548cd737b98d0b19c4253aff8d68e97f4 ]
hid_hw_stop() does not stop the device IO.
This results in a race condition between hid_input_report() and the point immediately following the execution of hid_device_io_start() within corsairpsu_probe(). If the probe operation fails after "io start" has been initiated, this race condition will result in a uaf vulnerability [1].
CPU0 CPU1
==== ====corsairpsu_probe()
hid_device_io_start()
... unlock driver_input_lock
hid_hw_stop()
kfree(hidraw) __hid_input_report()
... acquire driver_input_lock hid_report_raw_event()
hidraw_report_event()
... access hidraw's list_lock // trigger uaf
Consequently, when corsairpsu_probe() fails and hid_hw_stop() needs to be executed, the io_started flag is first cleared while holding the driver_input_lock to prevent potential race conditions involving input reports.
[1]
BUG: KASAN: slab-use-after-free in rt_spin_lock+0x83/0x400 kernel/locking/spinlock_rt.c:56 Call Trace: hidraw_report_event+0x5d/0x3a0 drivers/hid/hidraw.c:577 hid_report_raw_event+0x311/0x1730 drivers/hid/hid-core.c:2076 __hid_input_report drivers/hid/hid-core.c:2152 [inline] hid_input_report+0x44e/0x580 drivers/hid/hid-core.c:2174 hid_irq_in+0x47e/0x6d0 drivers/hid/usbhid/hid-core.c:286 __usb_hcd_giveback_urb+0x3b3/0x5e0 drivers/usb/core/hcd.c:1657 dummy_timer+0x8a9/0x47d0 drivers/usb/gadget/udc/dummy_hcd.c:2005 Allocated by task 10: hidraw_connect+0x57/0x430 drivers/hid/hidraw.c:606 hid_connect+0x5bf/0x19d0 drivers/hid/hid-core.c:2277 hid_hw_start+0xa8/0x120 drivers/hid/hid-core.c:2387 corsairpsu_probe+0xd9/0x3c0 drivers/hwmon/corsair-psu.c:782 Freed by task 10: hidraw_disconnect+0x4f/0x60 drivers/hid/hidraw.c:662 hid_disconnect drivers/hid/hid-core.c:2362 [inline] hid_hw_stop+0x101/0x1e0 drivers/hid/hid-core.c:2407 corsairpsu_probe+0x327/0x3c0 drivers/hwmon/corsair-psu.c:826
Fix the problem by calling hid_device_io_stop() before calling hid_hw_stop().
[groeck: Updated subject and description;
call hid_device_io_stop() only if IO has been started]
--- drivers/hwmon/corsair-psu.c | 1 + 1 file changed, 1 insertion(+)
drivers/hwmon/corsair-psu.c +1 -0
@@ -769,6 +769,7 @@ static int corsairpsu_probe(struct hid_device *hdev, const struct hid_device_id fail_and_close:hid_hw_close (hdev); +hid_device_io_stop (hdev); fail_and_stop:hid_hw_stop (hdev);return ret;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 101/609 hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit 94c87871b051d7ad758828a805215a2ec194512a ]
Calling hid_hw_stop() does not stop the device IO.
This results in a race condition between hid_input_report() and the point immediately following the execution of hid_device_io_start() within the driver probe function. If the probe operation fails after "io start" has been initiated, this race condition will result in a UAF vulnerability.
Fix the problem by calling hid_device_io_stop() before calling hid_hw_stop().
--- drivers/hwmon/corsair-cpro.c | 1 + 1 file changed, 1 insertion(+)
drivers/hwmon/corsair-cpro.c +1 -0
@@ -558,6 +558,7 @@ static int ccp_probe(struct hid_device *hdev, const struct hid_device_id *id) out_hw_close:hid_hw_close (hdev); +hid_device_io_stop (hdev); out_hw_stop:hid_hw_stop (hdev);return ret;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 102/609 hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit 59d104b54b0b42e30fd2a68d24ee5c49dcc54d1e ]
Calling hid_hw_stop() does not stop the device IO.
This results in a race condition between hid_input_report() and the point immediately following the execution of hid_device_io_start() within the driver probe function. If the probe operation fails after "io start" has been initiated, this race condition will result in a UAF vulnerability.
Fix the problem by calling hid_device_io_stop() before calling hid_hw_stop().
--- drivers/hwmon/nzxt-smart2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/nzxt-smart2.c +1 -1
@@ -768,7 +768,7 @@ static int nzxt_smart2_hid_probe(struct hid_device *hdev, out_hw_close:hid_hw_close (hdev); - +hid_device_io_stop (hdev); out_hw_stop:hid_hw_stop (hdev);return ret;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 103/609 watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tzung-Bi Shih <[email protected]>
[ Upstream commit 7362ba0f9c96ac3ad6a2ca3995bd9fc9a28a8661 ]
When a watchdog governor is unregistered, it updates existing watchdog devices that were using this governor by falling back to default_gov.
If the governor being unregistered is currently set as default_gov, the default_gov is never cleared. This leads to 2 use-after-free issues:
1. New watchdog devices registered after this point will inherit the dangling default_gov.
2. Existing watchdog devices using the unregistered governor will have their wdd->gov reassigned to the dangling default_gov.
Fix the UAF by clearing default_gov if it matches the governor being unregistered.
--- drivers/watchdog/watchdog_pretimeout.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/watchdog/watchdog_pretimeout.c +2 -0
@@ -165,6 +165,8 @@ void watchdog_unregister_governor(struct watchdog_governor *gov) }spin_lock_irq (&pretimeout_lock); +if (default_gov == gov) + default_gov =NULL ;list_for_each_entry (p, &pretimeout_list, entry)if (p->wdd->gov == gov) p->wdd->gov = default_gov;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 104/609 wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Morgun <[email protected]>
[ Upstream commit 7f11e70629650ff6ea140984e5ce188b775b2683 ]
When the first entry in msdu_details has a zero buffer address, the code accesses msdu_details[i - 1] with i == 0, causing a buffer underflow.
Fix similarly to ath12k_wifi7_hal_rx_msdu_list_get() by adding a separate check for i == 0 before the main condition to prevent the out-of-bounds access.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/wireless/ath/ath11k/dp_rx.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/wireless/ath/ath11k/dp_rx.c +3 -0
@@ -4549,6 +4549,9 @@ static void ath11k_hal_rx_msdu_list_get(struct ath11k *ar, msdu_details = &msdu_link->msdu_link[0 ];for (i =0 ; i <HAL_RX_NUM_MSDU_DESC ; i++) { +if (!i &&FIELD_GET (BUFFER_ADDR_INFO0_ADDR , + msdu_details[i].buf_addr_info.info0) ==0 ) +break ;if (FIELD_GET (BUFFER_ADDR_INFO0_ADDR , msdu_details[i].buf_addr_info.info0) ==0 ) { msdu_desc_info = &msdu_details[i -1 ].rx_msdu_info;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 105/609 wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <[email protected]>
[ Upstream commit 0fe8010fc5b147607fc19ba010ba469afc95f35f ]
ath11k_pci_soc_global_reset() tries to reset the device by writing to the PCIE_SOC_GLOBAL_RESET register. But it doesn't do a read-back to ensure that the write gets flushed to the device before the delay.
This may lead to the delay on the host to be insufficient, if the posted write doesn't reach the device before the delay.
So add a read-back after writing to the PCIE_SOC_GLOBAL_RESET register and before the delay.
Compile tested only.
--- drivers/net/wireless/ath/ath11k/pci.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/wireless/ath/ath11k/pci.c +4 -0
@@ -180,6 +180,8 @@ static void ath11k_pci_soc_global_reset(struct ath11k_base *ab) val |=PCIE_SOC_GLOBAL_RESET_V ;ath11k_pcic_write32 (ab,PCIE_SOC_GLOBAL_RESET , val); +/* Flush the posted write to the device */ +ath11k_pcic_read32 (ab,PCIE_SOC_GLOBAL_RESET );/* TODO: exact time to sleep is uncertain */ delay =10 ;
@@ -189,6 +191,8 @@ static void ath11k_pci_soc_global_reset(struct ath11k_base *ab) val &= ~PCIE_SOC_GLOBAL_RESET_V ;ath11k_pcic_write32 (ab,PCIE_SOC_GLOBAL_RESET , val); +/* Flush the posted write to the device */ +ath11k_pcic_read32 (ab,PCIE_SOC_GLOBAL_RESET );mdelay (delay);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 106/609 firewire: net: Fix fragmented datagram reassembly
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <[email protected]>
[ Upstream commit d52a13adbb8ccbab99cd3bad36804e87d8b5c052 ]
fwnet_frag_new() keeps a sorted list of received fragments for a partial datagram. When a new fragment is adjacent to an existing fragment, the code checks whether the new fragment also closes the gap to the next or previous list entry.
Those neighbor lookups currently assume that the current fragment always has a real next or previous fragment. At a list edge, the next or previous entry is the list head, not a struct fwnet_fragment_info.
The gap checks also compare against the old edge of the current fragment instead of the edge after adding the new fragment. As a result, a fragment that bridges two existing ranges may leave two adjacent ranges unmerged, so fwnet_pd_is_complete() can miss a complete datagram.
Check for the list head before looking up the neighboring fragment, and compare the neighbor against the new fragment's far edge when deciding whether to merge all three ranges.
This issue was found by a static analysis checker and confirmed by manual source review.
--- drivers/firewire/net.c | 39 +++++++++++++++++++++------------------ 1 file changed, 21 insertions(+), 18 deletions(-)
drivers/firewire/net.c +21 -18
@@ -297,31 +297,34 @@ static struct fwnet_fragment_info *fwnet_frag_new(if (fi->offset + fi->len == offset) {/* The new fragment can be tacked on to the end */ /* Did the new fragment plug a hole? */ - fi2 =list_entry (fi->fi_link.next, - struct fwnet_fragment_info, fi_link); -if (fi->offset + fi->len == fi2->offset) { -/* glue fragments together */ - fi->len += len + fi2->len; -list_del (&fi2->fi_link); -kfree (fi2); - }else { - fi->len += len; +if (!list_is_last (&fi->fi_link, &pd->fi_list)) { + fi2 =list_next_entry (fi, fi_link); +if (offset + len == fi2->offset) { +/* glue fragments together */ + fi->len += len + fi2->len; +list_del (&fi2->fi_link); +kfree (fi2); + +return fi; + } } + fi->len += len;return fi; }if (offset + len == fi->offset) {/* The new fragment can be tacked on to the beginning */ /* Did the new fragment plug a hole? */ - fi2 =list_entry (fi->fi_link.prev, - struct fwnet_fragment_info, fi_link); -if (fi2->offset + fi2->len == fi->offset) { -/* glue fragments together */ - fi2->len += fi->len + len; -list_del (&fi->fi_link); -kfree (fi); - -return fi2; +if (!list_is_first (&fi->fi_link, &pd->fi_list)) { + fi2 =list_prev_entry (fi, fi_link); +if (fi2->offset + fi2->len == offset) { +/* glue fragments together */ + fi2->len += fi->len + len; +list_del (&fi->fi_link); +kfree (fi); + +return fi2; + } } fi->offset = offset; fi->len += len;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 107/609 wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristan Madani <[email protected]>
[ Upstream commit 3a21c89215cc18f1a97c5e5bfd1da6d4f3d44495 ]
The firmware-controlled num_msg field (u8, 0-255) drives the loop in ath6kl_wmi_tx_complete_event_rx() without validation against the buffer length. This allows out-of-bounds reads of up to 1020 bytes past the WMI event buffer when the firmware sends an inflated num_msg.
Add a check that the buffer is large enough to hold the fixed struct and the num_msg variable-length entries.
--- drivers/net/wireless/ath/ath6kl/wmi.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/net/wireless/ath/ath6kl/wmi.c +12 -0
@@ -484,6 +484,18 @@ static int ath6kl_wmi_tx_complete_event_rx(u8 *datap, int len) evt = (struct wmi_tx_complete_event *) datap; +if (len <sizeof (*evt)) { +ath6kl_dbg (ATH6KL_DBG_WMI ,"tx complete: invalid len %d\n" , + len); +return -EINVAL ; + } + +if (len <sizeof (*evt) + evt->num_msg *sizeof (struct tx_complete_msg_v1 )) { +ath6kl_dbg (ATH6KL_DBG_WMI ,"tx complete: invalid len %d for %u msgs\n" , + len, evt->num_msg); +return -EINVAL ; + } +ath6kl_dbg (ATH6KL_DBG_WMI ,"comp: %d %d %d\n" , evt->num_msg, evt->msg_len, evt->msg_type);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 108/609 wifi: ath6kl: fix OOB read from firmware IE lengths in connect event
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristan Madani <[email protected]>
[ Upstream commit 6b47b29730de3232b919d8362749f6814c5f2a33 ]
The firmware-controlled beacon_ie_len, assoc_req_len, and assoc_resp_len fields in ath6kl_wmi_connect_event_rx() are not validated against the buffer length. Their sum (up to 765) can exceed the actual WMI event data, causing out-of-bounds reads during IE parsing and state corruption of wmi->is_wmm_enabled.
Add a check that the total IE length fits within the buffer.
--- drivers/net/wireless/ath/ath6kl/wmi.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/net/wireless/ath/ath6kl/wmi.c +8 -0
@@ -874,6 +874,14 @@ static int ath6kl_wmi_connect_event_rx(struct wmi *wmi, u8 *datap, int len, ev = (struct wmi_connect_event *) datap; +if (len <sizeof (*ev) + ev->beacon_ie_len + + ev->assoc_req_len + ev->assoc_resp_len) { +ath6kl_dbg (ATH6KL_DBG_WMI , +"connect event: IE lengths %u+%u+%u exceed buffer %d\n" , + ev->beacon_ie_len, ev->assoc_req_len, + ev->assoc_resp_len, len); +return -EINVAL ; + }if (vif->nw_type ==AP_NETWORK ) {/* AP mode start/STA connected event */ struct net_device *dev = vif->ndev;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 109/609 wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristan Madani <[email protected]>
[ Upstream commit 4cde55b2feff9504d1f993ab80e84e7ccb62791c ]
When the firmware sends a command response with a length mismatch, carl9170_cmd_callback() logs the mismatch and calls carl9170_restart() but then falls through to memcpy(ar->readbuf, buffer + 4, len - 4). Since len comes from the firmware and can exceed ar->readlen, this copies more data than the readbuf was allocated for.
Bound the memcpy to min(len - 4, ar->readlen) so that the response is still completed -- avoiding repeated restarts from queued garbage -- while preventing an overread past the response buffer.
--- drivers/net/wireless/ath/carl9170/rx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/carl9170/rx.c +2 -1
@@ -150,7 +150,8 @@ static void carl9170_cmd_callback(struct ar9170 *ar, u32 len, void *buffer)spin_lock (&ar->cmd_lock);if (ar->readbuf) {if (len >=4 ) -memcpy (ar->readbuf, buffer +4 , len -4 ); +memcpy (ar->readbuf, buffer +4 , +min_t (u32, len -4 , ar->readlen)); ar->readbuf =NULL ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 110/609 wifi: carl9170: fix OOB read from off-by-two in TX status handler
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristan Madani <[email protected]>
[ Upstream commit a3f42f1049ad80c65560d2b078ad426c3134f78d ]
The bounds check in carl9170_tx_process_status() usesi > ((cmd->hdr.len / 2) + 1) which is off by two, allowing 2 extra iterations past valid _tx_status entries when the firmware- controlled hdr.ext exceeds hdr.len/2. Fix by using the correct comparison i >= (cmd->hdr.len / 2).
--- drivers/net/wireless/ath/carl9170/tx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/carl9170/tx.c +1 -1
@@ -693,7 +693,7 @@ void carl9170_tx_process_status(struct ar9170 *ar,unsigned int i;for (i =0 ; i < cmd->hdr.ext; i++) { -if (WARN_ON (i > ((cmd->hdr.len /2 ) +1 ))) { +if (WARN_ON (i >= (cmd->hdr.len /2 ))) {print_hex_dump_bytes ("UU:" ,DUMP_PREFIX_NONE , (void *) cmd, cmd->hdr.len +4 );break ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 111/609 wifi: carl9170: fix buffer overflow in rx_stream failover path
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristan Madani <[email protected]>
[ Upstream commit a1a21995c2e1cc2ca6b2226cfe4f5f018370182a ]
The failover continuation in carl9170_rx_stream() copies the full tlen from the second USB transfer instead of capping at rx_failover_missing bytes. When both transfers are near maximum size, the total exceeds the 65535-byte failover SKB, triggering skb_over_panic.
Limit the copy size to the missing byte count.
--- drivers/net/wireless/ath/carl9170/rx.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/carl9170/rx.c +3 -1
@@ -918,7 +918,9 @@ static void carl9170_rx_stream(struct ar9170 *ar, void *buf, unsigned int len) } } -skb_put_data (ar->rx_failover, tbuf, tlen); +skb_put_data (ar->rx_failover, tbuf, + min_t(unsigned int, tlen, + ar->rx_failover_missing)); ar->rx_failover_missing -= tlen;if (ar->rx_failover_missing <=0 ) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 112/609 btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: You-Kai Zheng <[email protected]>
[ Upstream commit b95181f3929ff98949fa9460ca93eccebbf2d7fc ]
The variable-sized buffer buf in struct btrfs_ioctl_search_args_v2 is declared as __u64[], but it holds a packed byte stream of search results, where all offsets into the buffer are in bytes.
Declaring buf as __u64[] makes it easy for user space to write incorrect pointer arithmetic: adding a byte offset directly to a __u64 pointer scales the offset by 8, landing at byte position offset*8 instead of offset.
This recently caused an infinite loop in btrfs-progs: the accessor read all-zero data from misaddressed items, which fed zeroed search keys back into the ioctl loop and spun forever. The issue was worked around at the time by disabling TREE_SEARCH_V2 entirely in btrfs-progs (d73e69824854:
"btrfs-progs: temporarily disable usage of v2 of search tree ioctl").
The kernel side already treats buf as a byte buffer, so change the declaration to __u8[] to match the actual semantics and prevent similar misuse in user space. The change is ABI compatible: both the structure size and alignment are unchanged.
--- include/uapi/linux/btrfs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/uapi/linux/btrfs.h +1 -1
@@ -568,7 +568,7 @@ struct btrfs_ioctl_search_args_v2 {__u64 buf_size;/* in - size of buffer * out - on EOVERFLOW: needed size * to store item */ -__u64 buf[];/* out - found items */ +__u8 buf[];/* out - found items */ };struct btrfs_ioctl_clone_range_args {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 113/609 btrfs: free mapping node on duplicate reloc root insert
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guanghui Yang <[email protected]>
[ Upstream commit 6a8269b6459ed870a8156c106a0f597383907872 ]
__add_reloc_root() allocates a mapping_node before inserting it into rc->reloc_root_tree. If rb_simple_insert() finds an existing entry, it returns the existing rb_node and leaves the newly allocated node unlinked.
The error path then returns -EEXIST without freeing the new node. Since the node was never inserted into reloc_root_tree, the later cleanup in put_reloc_control() cannot find it either.
Free the newly allocated node before returning -EEXIST.
The callers currently assert that -EEXIST should not happen, so this is a defensive cleanup for an unexpected duplicate insert path. If the path is ever reached, the local allocation should still be released.
--- fs/btrfs/relocation.c | 1 + 1 file changed, 1 insertion(+)
fs/btrfs/relocation.c +1 -0
@@ -645,6 +645,7 @@ static int __must_check __add_reloc_root(struct btrfs_root *root)btrfs_err (fs_info,"Duplicate root found for start=%llu while inserting into relocation tree" , node->bytenr); +kfree (node);return -EEXIST ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 114/609 ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengjiu Wang <[email protected]>
[ Upstream commit 0b604e886ece11b71c4daaeccc512c784b89b014 ]
The bt-sco-pcm-wb DAI uses the same stream_name strings as bt-sco-pcm ("Playback" and "Capture"). This causes duplicate DAPM AIF widget names within the same component, leading to debugfs warnings:
debugfs: 'Playback' already exists in 'dapm'
debugfs: 'Capture' already exists in 'dapm'
Give the wideband DAI distinct stream names ("WB Playback" and "WB Capture") and add corresponding DAPM AIF widgets and routes for them.
--- sound/soc/codecs/bt-sco.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
sound/soc/codecs/bt-sco.c +8 -2
@@ -17,11 +17,17 @@ static const struct snd_soc_dapm_widget bt_sco_widgets[] = { SND_SOC_NOPM, 0, 0),SND_SOC_DAPM_AIF_OUT ("BT_SCO_TX" ,"Capture" ,0 ,SND_SOC_NOPM ,0 ,0 ), +SND_SOC_DAPM_AIF_IN ("BT_SCO_RX_WB" ,"WB Playback" ,0 , +SND_SOC_NOPM ,0 ,0 ), +SND_SOC_DAPM_AIF_OUT ("BT_SCO_TX_WB" ,"WB Capture" ,0 , + SND_SOC_NOPM, 0, 0), };static const struct snd_soc_dapm_route bt_sco_routes[] = { {"BT_SCO_TX" ,NULL ,"RX" }, {"TX" ,NULL ,"BT_SCO_RX" }, + {"BT_SCO_TX_WB" ,NULL ,"RX" }, + {"TX" ,NULL ,"BT_SCO_RX_WB" }, }; static struct snd_soc_dai_driver bt_sco_dai[] = {
@@ -45,14 +51,14 @@ static struct snd_soc_dai_driver bt_sco_dai[] = { { .name = "bt-sco-pcm-wb", .playback = { - .stream_name = "Playback", + .stream_name = "WB Playback", .channels_min = 1, .channels_max = 1, .rates = SNDRV_PCM_RATE_8000 | SNDRV_PCM_RATE_16000, .formats = SNDRV_PCM_FMTBIT_S16_LE, }, .capture = { - .stream_name = "Capture", + .stream_name = "WB Capture", .channels_min = 1, .channels_max = 1, .rates = SNDRV_PCM_RATE_8000 | SNDRV_PCM_RATE_16000,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 115/609 wifi: iwlwifi: mvm: fix read in wake packet notification handler
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shahar Tzarfati <[email protected]>
[ Upstream commit 9d7657aae8c1579584c67b0b66114a6a98db8b2f ]
In iwl_mvm_wowlan_store_wake_pkt(), packet_len was initialized from notif->wake_packet_length before the explicit check that len >= sizeof(*notif).
Move the assignment of packet_len to after the size check so that notif->wake_packet_length is only accessed once the payload length has been validated.
--- drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/mvm/d3.c +2 -1
@@ -2627,7 +2627,7 @@ static int iwl_mvm_wowlan_store_wake_pkt(struct iwl_mvm *mvm, struct iwl_wowlan_status_data *status, u32 len) { -u32 data_size, packet_len =le32_to_cpu (notif->wake_packet_length); +u32 data_size, packet_len;if (len <sizeof (*notif)) {IWL_ERR (mvm,"Invalid WoWLAN wake packet notification!\n" );
@@ -2646,6 +2646,7 @@ static int iwl_mvm_wowlan_store_wake_pkt(struct iwl_mvm *mvm,return -EIO ; } + packet_len =le32_to_cpu (notif->wake_packet_length); data_size = len - offsetof(struct iwl_wowlan_wake_pkt_notif , wake_packet);/* data_size got the padding from the notification, remove it. */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 116/609 usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Diego Fernando Mancera Gomez <[email protected]>
[ Upstream commit 71132cedd1ecbc4032d76e9928c18a10f7e39b80 ]
uea_probe() distinguishes a pre-firmware device from a post-firmware one using the USB id (UEA_IS_PREFIRM()), and stores a different object as the interface data in each case: a 'struct completion' for a pre-firmware device (to be waited on in .disconnect()), or a 'struct usbatm_data' for a post-firmware one.
uea_disconnect() instead tells the two apart by the number of interfaces of the active configuration (a pre-firmware device exposes a single interface, ADI930 has 2 and eagle has 3), and casts the interface data accordingly.
Because the two handlers use different criteria, a crafted device that advertises a pre-firmware id together with a multi-interface descriptor (or a post-firmware id with a single interface) makes them disagree: the small 'struct completion' stored by uea_probe() is then passed to usbatm_usb_disconnect(), which casts it to 'struct usbatm_data' and takes instance->serialize, reading past the end of the allocation:
BUG: KASAN: slab-out-of-bounds in __mutex_lock+0x152a/0x1b80 Read of size 8 at addr ffff8880470e2c60 by task kworker/1:2/982 ... __mutex_lock+0x152a/0x1b80 usbatm_usb_disconnect+0x70/0x820 uea_disconnect+0x133/0x2c0 usb_unbind_interface+0x1dd/0x9e0 ... which belongs to the cache kmalloc-96 of size 96 The buggy address is located 0 bytes to the right of allocated 96-byte region [ffff8880470e2c00, ffff8880470e2c60)
Reject such inconsistent descriptors in uea_probe() so that both handlers always make the same pre/post-firmware decision.
--- drivers/usb/atm/ueagle-atm.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
drivers/usb/atm/ueagle-atm.c +17 -0
@@ -2591,6 +2591,7 @@ static struct usbatm_driver uea_usbatm_driver = {static int uea_probe (struct usb_interface *intf,const struct usb_device_id *id) {struct usb_device *usb =interface_to_usbdev (intf); +bool single_iface = usb->config->desc.bNumInterfaces ==1 ;int ret;uea_enters (usb);
@@ -2600,6 +2601,22 @@ static int uea_probe(struct usb_interface *intf, const struct usb_device_id *id)le16_to_cpu (usb->descriptor.bcdDevice), chip_name[UEA_CHIP_VERSION(id)]); +/* +* uea_probe() decides between the pre-firmware and post-firmware case +* from the USB id and stores a different object as interface data in +* each case: a struct completion for a pre-firmware device, a struct +* usbatm_data for a post-firmware one. uea_disconnect() instead tells +* the two apart by the number of interfaces (a pre-firmware device +* exposes a single interface, ADI930 has 2 and eagle has 3). A crafted +* device advertising a pre-firmware id together with a multi-interface +* descriptor (or the other way around) makes the two disagree, so that +* usbatm_usb_disconnect() treats the small completion object as a +* struct usbatm_data and reads out of bounds. Reject such inconsistent +* descriptors so both paths make the same decision. +*/ +if (UEA_IS_PREFIRM (id) != single_iface) +return -ENODEV ; +usb_reset_device (usb);if (UEA_IS_PREFIRM (id)) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 117/609 hwmon: (asus-ec-sensors) fix looping over banks while reading from EC
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eugene Shalygin <[email protected]>
[ Upstream commit e741d13cc2abfc6fccebe2008057aa52e285223e ]
Do not assume there are only bank 0 and bank 1 available, just use '!=' for bank comparison.
--- drivers/hwmon/asus-ec-sensors.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/asus-ec-sensors.c +1 -1
@@ -705,7 +705,7 @@ static int asus_ec_block_read(const struct device *dev, }for (ireg =0 ; ireg < ec->nr_registers; ireg++) { reg_bank =register_bank (ec->registers[ireg]); -if (reg_bank < bank) { +if (reg_bank != bank) {continue ; } ec_read(register_index(ec->registers[ireg]),
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 118/609 hwmon: (asus-ec-sensors) fix EC read intervals
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eugene Shalygin <[email protected]>
[ Upstream commit 60710b2af13b81da71b429d3f8b19dd70310729d ]
Take INITIAL_JIFFIES into account when setting up next update time.
--- drivers/hwmon/asus-ec-sensors.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/hwmon/asus-ec-sensors.c +4 -4
@@ -525,7 +525,7 @@ struct ec_sensors_data {/* sorted list of unique register banks */ u8 banks[ASUS_EC_MAX_BANK +1 ];/* in jiffies */ -unsigned long last_updated; +u64 next_update;struct lock_data lock_data;/* number of board EC sensors */ u8 nr_sensors;
@@ -794,13 +794,12 @@ static int get_cached_value_or_update(const struct device *dev,int sensor_index, struct ec_sensors_data *state, s32 *value) { - if (time_after(jiffies, state->last_updated + HZ)) { + if (time_after64(get_jiffies_64(), state->next_update)) { if (update_ec_sensors(dev, state)) { dev_err(dev, "update_ec_sensors() failure\n");return -EIO ; } - - state->last_updated = jiffies; + state->next_update =get_jiffies_64 () +HZ ; } *value = state->sensors[sensor_index].cached_value;
@@ -918,6 +917,7 @@ static int asus_ec_probe(struct platform_device *pdev)if (!ec_data)return -ENOMEM ; + ec_data->next_update =INITIAL_JIFFIES ;dev_set_drvdata (dev, ec_data); ec_data->board_info = pboard_info;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 119/609 hwmon: (asus-ec-sensors) add missed handle for ENOMEM
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eugene Shalygin <[email protected]>
[ Upstream commit 9813c1f49efeadbcb17e4a41972350ac783f9cac ]
Add missing return value check in the setup function.
--- drivers/hwmon/asus-ec-sensors.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/hwmon/asus-ec-sensors.c +5 -3
@@ -990,9 +990,11 @@ static int asus_ec_probe(struct platform_device *pdev)if (!nr_count[type])continue ; -asus_ec_hwmon_add_chan_info (asus_ec_hwmon_chan, dev, - nr_count[type], type, - hwmon_attributes[type]); + status =asus_ec_hwmon_add_chan_info (asus_ec_hwmon_chan, dev, + nr_count[type], type, + hwmon_attributes[type]); +if (status) +return status; *ptr_asus_ec_ci++ = asus_ec_hwmon_chan++; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 120/609 smb: client: validate DFS referral PathConsumed
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yichong Chen <[email protected]>
[ Upstream commit f6f5ee2aa33b350c671721b965251c42cebb962e ]
parse_dfs_referrals() validates that the response contains the fixed referral entry array and, on for-next, the per-referral string offsets. However, the response also contains a PathConsumed value that is later used for DFS path parsing.
If a malformed response provides a PathConsumed value larger than the search name, later DFS parsing can advance beyond the end of the path.
Validate PathConsumed against the search name length before storing it in the parsed referral.
--- fs/smb/client/misc.c | 34 +++++++++++++++++++++++++--------- 1 file changed, 25 insertions(+), 9 deletions(-)
fs/smb/client/misc.c +25 -9
@@ -913,6 +913,8 @@ parse_dfs_referrals(struct get_dfs_referral_rsp *rsp, u32 rsp_size,int i, rc =0 ;char *data_end;struct dfs_referral_level_3 *ref; +unsigned int path_consumed; +size_t search_name_len;if (rsp_size <sizeof (*rsp)) { cifs_dbg(VFS | ONCE,
@@ -960,6 +962,7 @@ parse_dfs_referrals(struct get_dfs_referral_rsp *rsp, u32 rsp_size, rc = -ENOMEM ; goto parse_DFS_referrals_exit; } + search_name_len =strlen (searchName);/* collect necessary data from referrals */ for (i =0 ; i < *num_of_nodes; i++) {
@@ -968,21 +971,34 @@ parse_dfs_referrals(struct get_dfs_referral_rsp *rsp, u32 rsp_size,struct dfs_info3_param *node = (*target_nodes)+i; node->flags =le32_to_cpu (rsp->DFSFlags); + path_consumed =le16_to_cpu (rsp->PathConsumed);if (is_unicode) { -__le16 *tmp =kmalloc (strlen (searchName)*2 +2 , -GFP_KERNEL ); -if (tmp ==NULL ) { +size_t search_name_utf16_len = search_name_len *2 +2 ; +__le16 *tmp; + +if (path_consumed > search_name_utf16_len) { + rc = -EINVAL ; + goto parse_DFS_referrals_exit; + } + + tmp =kmalloc (search_name_utf16_len,GFP_KERNEL ); +if (!tmp) { rc = -ENOMEM ; goto parse_DFS_referrals_exit; } -cifsConvertToUTF16 ((__le16 *) tmp, searchName, +cifsConvertToUTF16 ((__le16 *)tmp, searchName,PATH_MAX , nls_codepage, remap); - node->path_consumed =cifs_utf16_bytes (tmp, -le16_to_cpu (rsp->PathConsumed), - nls_codepage); + node->path_consumed =cifs_utf16_bytes (tmp, path_consumed, + nls_codepage);kfree (tmp); - }else - node->path_consumed =le16_to_cpu (rsp->PathConsumed); + }else { +if (path_consumed > search_name_len) { + rc = -EINVAL ; + goto parse_DFS_referrals_exit; + } + + node->path_consumed = path_consumed; + } node->server_type =le16_to_cpu (ref->ServerType); node->ref_flag =le16_to_cpu (ref->ReferralEntryFlags);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 121/609 hwmon: occ: validate poll response sensor blocks
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit 70e76e700fc6c46afb4e17aec099a1ea089b4a22 ]
The OCC poll response parser walks a counted list of sensor data blocks. It used the static backing-array capacity as the parse boundary, but a transport response makes only data_length bytes current and valid. A truncated response can therefore make the parser consume a block header or block extent outside the current response.
Use data_length as the parent boundary, prove the fixed poll header and each current block header before reading them, and prove the complete block before advancing. Keep parsed sensor metadata local until the complete response has passed validation, then publish it. Propagate malformed-response errors before publishing the OCC as active.
--- drivers/hwmon/occ/common.c | 38 ++++++++++++++++++++++++++++++-------- 1 file changed, 30 insertions(+), 8 deletions(-)
drivers/hwmon/occ/common.c +30 -8
@@ -1052,32 +1052,49 @@ static int occ_setup_sensor_attrs(struct occ *occ) }/* only need to do this once at startup, as OCC won't change sensors on us */ -static void occ_parse_poll_response (struct occ *occ) +static int occ_parse_poll_response (struct occ *occ) {unsigned int i, old_offset, offset =0 , size =0 ; +u16 data_length;struct occ_sensor *sensor; -struct occ_sensors *sensors = &occ->sensors; +struct occ_sensors parsed = {}; +struct occ_sensors *sensors = &parsed;struct occ_response *resp = &occ->resp;struct occ_poll_response *poll = (struct occ_poll_response *)&resp->data[0 ];struct occ_poll_response_header *header = &poll->header;struct occ_sensor_data_block *block = &poll->block; + data_length =get_unaligned_be16 (&resp->data_length); +if (data_length <sizeof (*header) || data_length >OCC_RESP_DATA_BYTES ) { +dev_err (occ->bus_dev,"invalid OCC poll response length %u\n" , + data_length); +return -EMSGSIZE ; + } +dev_info (occ->bus_dev,"OCC found, code level: %.16s\n" , header->occ_code_level);for (i =0 ; i < header->num_sensor_data_blocks; ++i) { block = (struct occ_sensor_data_block *)((u8 *)block + offset); +if (size +sizeof (*header) +sizeof (block->header) > + data_length) { +dev_err (occ->bus_dev, +"truncated OCC sensor block header\n" ); +return -EMSGSIZE ; + } + old_offset = offset; offset = (block->header.num_sensors * block->header.sensor_length) +sizeof (block->header); - size += offset;/* validate all the length/size fields */ -if ((size +sizeof (*header)) >=OCC_RESP_DATA_BYTES ) { -dev_warn (occ->bus_dev,"exceeded response buffer\n" ); -return ; +if (size +sizeof (*header) + offset > data_length) { +dev_err (occ->bus_dev, +"exceeded OCC poll response length\n" ); +return -EMSGSIZE ; } + size += offset; dev_dbg(occ->bus_dev, " %04x..%04x: %.4s (%d sensors)\n", old_offset, offset - 1, block->header.eye_catcher,
@@ -1107,6 +1124,9 @@ static void occ_parse_poll_response(struct occ *occ)dev_dbg (occ->bus_dev,"Max resp size: %u+%zd=%zd\n" , size,sizeof (*header), size +sizeof (*header)); + occ->sensors = parsed; + +return 0 ; }int occ_active (struct occ *occ,bool active)
@@ -1138,10 +1158,12 @@ int occ_active(struct occ *occ, bool active) goto unlock; } - occ->active = true; occ->next_update = jiffies +OCC_UPDATE_FREQUENCY ; -occ_parse_poll_response (occ); + rc =occ_parse_poll_response (occ); +if (rc) + goto unlock; + occ->active = true; rc =occ_setup_sensor_attrs (occ);if (rc) { dev_err(occ->bus_dev,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 122/609 net/packet: avoid fanout hook re-registration after unregister
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lee <[email protected]>
[ Upstream commit 50aff80475abd3533eef4320477037e6fcc6b56e ]
packet_set_ring() temporarily detaches a socket from packet delivery while reconfiguring its ring. It records the previous running state, clears po->num, unregisters the protocol hook when needed, drops po->bind_lock, and later restores po->num and re-registers the hook from the saved was_running value.
That unlocked window can race with NETDEV_UNREGISTER. The notifier can observe the socket as not running, skip __unregister_prot_hook(), and invalidate the per-socket binding by setting po->ifindex to -1 and clearing po->prot_hook.dev. A one-member fanout group can still retain its shared fanout hook device pointer. When packet_set_ring() resumes, re-registering solely from the stale was_running state can re-add the fanout hook after the device has been unregistered.
Treat po->ifindex == -1 as an invalidated binding after reacquiring po->bind_lock. This is distinct from ifindex 0, the normal unbound/wildcard state: ifindex -1 marks an existing device binding that was invalidated when the device was unregistered. Restore po->num as before, but do not re-register the hook if device unregister already detached the socket.
--- net/packet/af_packet.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
net/packet/af_packet.c +5 -1
@@ -4584,7 +4584,11 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,spin_lock (&po->bind_lock);WRITE_ONCE (po->num, num); -if (was_running) +/* +* NETDEV_UNREGISTER may have invalidated the binding while bind_lock +* was dropped above. Do not re-add a fanout hook to a dead device. +*/ +if (was_running &&READ_ONCE (po->ifindex) !=-1 )register_prot_hook (sk);spin_unlock (&po->bind_lock);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 123/609 bonding: fix devconf_all NULL dereference when IPv6 is disabled
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhaolong Zhang <[email protected]>
[ Upstream commit 1c975de3343cdef506f2eecc833cc1f14b0401c4 ]
When booting with the 'ipv6.disable=1' parameter, the devconf_all is never initialized because inet6_init() exits before addrconf_init() is called which initializes it. bond_send_validate(), however, will still call bond_ns_send_all() even ipv6 is indeed disabled. It will lead to NULL derefence of net->ipv6.devconf_all in ip6_pol_route().
BUG: kernel NULL pointer dereference, address: 000000000000000c [...] Workqueue: bond0 bond_arp_monitor [bonding] RIP: 0010:ip6_pol_route+0x69/0x480 [...] Call Trace: <TASK> ? srso_return_thunk+0x5/0x5f ? __pfx_ip6_pol_route_output+0x10/0x10 fib6_rule_lookup+0xfe/0x260 ? wakeup_preempt+0x8a/0x90 ? srso_return_thunk+0x5/0x5f ? srso_return_thunk+0x5/0x5f ? sched_balance_rq+0x369/0x810 ip6_route_output_flags+0xd7/0x170 bond_ns_send_all+0xde/0x280 [bonding] bond_ab_arp_probe+0x296/0x320 [bonding] ? srso_return_thunk+0x5/0x5f bond_activebackup_arp_mon+0xb4/0x2c0 [bonding] process_one_work+0x196/0x370 worker_thread+0x1af/0x320 ? srso_return_thunk+0x5/0x5f ? __pfx_worker_thread+0x10/0x10 kthread+0xe3/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x199/0x260 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>
Fix this by adding ipv6_mod_enabled() condition check in the caller.
--- drivers/net/bonding/bond_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/bonding/bond_main.c +2 -1
@@ -3415,7 +3415,8 @@ static void bond_send_validate(struct bonding *bond, struct slave *slave) {bond_arp_send_all (bond, slave);#if IS_ENABLED (CONFIG_IPV6 ) -bond_ns_send_all (bond, slave); +if (likely (ipv6_mod_enabled ())) +bond_ns_send_all (bond, slave);#endif }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 124/609 rds: drop incoming messages that cross network namespace boundaries
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aldo Ariel Panzardo <[email protected]>
[ Upstream commit 5521ae71e32a8069ed4ca6e792179dc57bc43ab2 ]
rds_find_bound() looks up the destination socket using a global rhashtable keyed solely on (addr, port, scope_id). Network namespaces are not part of the key, so a sender in netns A can deliver an incoming message (inc) to a socket that lives in a different netns B.
When this happens, inc->i_conn points to an rds_connection whose c_net is netns A, but the receiving rs lives in netns B. Once the child process that created netns A exits, cleanup_net() calls rds_loop_exit_net() -> rds_loop_kill_conns() -> rds_conn_destroy(), freeing that connection. If the survivor socket in netns B still holds the inc, any subsequent dereference of inc->i_conn is a use-after-free.
There are two dangerous sites in rds_clear_recv_queue():
1. inc->i_conn->c_lcong (offset 88 of freed rds_connection, size 200) read via rds_recv_rcvbuf_delta() -- confirmed by KASAN.
2. inc->i_conn->c_trans->inc_free(inc) (function pointer at offset 80) called via rds_inc_put() when the inc refcount reaches zero -- same race window, potential call-through-freed-object primitive.
The bug is reachable from unprivileged user namespaces (CLONE_NEWUSER + CLONE_NEWNET), available since Linux 3.8.
Fix this by rejecting the delivery in rds_recv_incoming() when the socket returned by rds_find_bound() belongs to a different network namespace than the connection that carried the message. Use the existing rds_conn_net() / sock_net() helpers and net_eq() for the comparison.
--- net/rds/recv.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
net/rds/recv.c +15 -0
@@ -365,6 +365,21 @@ void rds_recv_incoming(struct rds_connection *conn, struct in6_addr *saddr, goto out; } +/* +* rds_find_bound() uses a global (netns-agnostic) hash table. +* An RDS connection created in netns A can match a socket bound +* in the init netns, delivering inc cross-netns with inc->i_conn +* pointing into netns A. When cleanup_net() then frees that conn, +* any subsequent dereference of inc->i_conn is a use-after-free. +* Drop the inc if the receiving socket lives in a different netns. +*/ +if (!net_eq (sock_net (rds_rs_to_sk (rs)),rds_conn_net (conn))) { +rds_stats_inc (s_recv_drop_no_sock); +rds_sock_put (rs); + rs =NULL ; + goto out; + } +/* Process extension headers */ rds_recv_incoming_exthdrs (inc, rs);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 125/609 dpaa2-switch: put MAC endpoint device on disconnect
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <[email protected]>
[ Upstream commit 4c1eabbef7a1707635652e956e39db1269c3af2b ]
fsl_mc_get_endpoint() returns the MAC endpoint device with a reference taken through device_find_child(). The switch port connect path stores that device in mac->mc_dev and keeps it for the lifetime of the connected MAC object.
However, the disconnect path only closes the MAC and frees the dpaa2_mac object. It does not drop the endpoint device reference stored in mac->mc_dev, so every successful connect leaks that device reference when the MAC is later disconnected.
Drop the endpoint device reference before freeing the dpaa2_mac object.
--- drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c +1 -0
@@ -1514,6 +1514,7 @@ static void dpaa2_switch_port_disconnect_mac(struct ethsw_port_priv *port_priv)dpaa2_mac_disconnect (mac);dpaa2_mac_close (mac); +put_device (&mac->mc_dev->dev);kfree (mac); }
Signature · 1 line
2.53.0