5.10.266-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 5.10.266-rc1 review
This is the start of the stable review cycle for the 5.10.266 release. There are 235 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.266-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.10.266-rc1
Johan Hovold <[email protected]>
USB: serial: keyspan_pda: fix information leak
Zhang Changzhong <[email protected]>
net: ethernet: ti: am65-cpsw: fix error handling in am65_cpsw_nuss_probe()
Andy Shevchenko <[email protected]>
i2c: smbus: Check for parent device before dereference
Robert Mader <[email protected]>
udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf()
Christian Brauner <[email protected]>
binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
Daming Li <[email protected]>
net: smc: fix splice entry lifetime imbalance in smc_rx_splice
Guangguan Wang <[email protected]>
net/smc: rdma write inline if qp has sufficient inline space
Siddharth Vadapalli <[email protected]>
net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
Grygorii Strashko <[email protected]>
net: ethernet: ti: am65-cpsw: add multi port support in mac-only mode
Grygorii Strashko <[email protected]>
net: ethernet: ti: am65-cpsw: move free desc queue mode selection in pdata
Grygorii Strashko <[email protected]>
net: ethernet: ti: am65-cpsw: move ale selection in pdata
Eric Dumazet <[email protected]>
af_packet: Don't send zero-byte data in tpacket_snd().
Rosen Penev <[email protected]>
ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers
Wei Fang <[email protected]>
net: packet: fix wrong transport_header when sending VLAN-tagged frame
Florian Westphal <[email protected]>
netfilter: ipset: fix list type element drift bug
Jérémy Jean <[email protected]>
netfilter: flowtable: publish GC-visible tuple last
Alexey Velichayshiy <[email protected]>
netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
Xiang Mei (Microsoft) <[email protected]>
netfilter: ipset: fix refcount race between list:set GC and swap
Herbert Xu <[email protected]>
crypto: ccm - Set rfc4309 maxauthsize from child
Jon Hunter <[email protected]>
arm64: tegra: Add EL2 virtual timer interrupt for Tegra194
Yangyu Chen <[email protected]>
net: atlantic: free stranded TX buffers on ring deinit
Lorenzo Stoakes (ARM) <[email protected]>
mm/ptdump: always stabilise against page table freeing using init_mm
Hyunjung Ko <[email protected]>
net/sched: act_gact, act_police: range check the fallback control action
Tejun Heo <[email protected]>
sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
Baul Lee <[email protected]>
ALSA: usx2y: bound the hwdep mmap fault offset
Takashi Iwai <[email protected]>
ALSA: usx2y: Fix potential leaks of uninitialized memory
Yang Wang <[email protected]>
drm/amd/pm: fix torn gpu metrics reads
Hongyan Xu <[email protected]>
hwmon: (npcm750-pwm-fan): stop fan timer on device detach
Marc Kleine-Budde <[email protected]>
can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure
Christian Brauner <[email protected]>
binfmt_misc: restore write access when removing an entry
Amir Goldstein <[email protected]>
fs: don't block write during exec on pre-content watched files
Amir Goldstein <[email protected]>
fsnotify: opt-in for permission events at file open time
Jonas Gorski <[email protected]>
i2c: iproc: reset bus after timeout if START_BUSY is stuck
Wolfram Sang <[email protected]>
i2c: bcm-iproc: remove printout on handled timeouts
Dawei Feng <[email protected]>
ice: fix memory leak in ice_lbtest_prepare_rings()
Dawid Osuchowski <[email protected]>
ice: fix VF interrupts cleanup
Ibrahim Hashimov <[email protected]>
scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write
Damien Le Moal <[email protected]>
scsi: scsi_debug: Rename zone type constants
Damien Le Moal <[email protected]>
scsi: sd: sd_zbc: Return early in sd_zbc_check_zoned_characteristics()
Damien Le Moal <[email protected]>
scsi: sd: sd_zbc: Use logical blocks as unit when querying zones
Bart Van Assche <[email protected]>
scsi: sd: sd_zbc: Improve source code documentation
Chengfeng Ye <[email protected]>
net: pktgen: fix proc entry use-after-free
Peter Seiderer <[email protected]>
net: pktgen: fix code style (WARNING: Block comments)
Gregory Price <[email protected]>
mm/vmstat: fold stranded per-cpu node stats when a node comes online
Sangho Lee <[email protected]>
Bluetooth: HIDP: reject frames without a transaction header
Luiz Augusto von Dentz <[email protected]>
skbuff: introduce skb_pull_data
Tengda Wu <[email protected]>
ftrace: Add global mutex to serialize trace_parser access
Christian Brauner <[email protected]>
super: fix emergency thaw deadlock on frozen block devices
Shiming Cheng <[email protected]>
net: gro: fix double aggregation of flush-marked skbs
Aldo Ariel Panzardo <[email protected]>
net/sched: serialize qdisc_rtab_list against concurrent get/put
Max Kellermann <[email protected]>
ceph: fix hanging __ceph_get_caps() with stale mds_wanted
Xiubo Li <[email protected]>
ceph: rename _to_client() to _to_fs_client()
Xiubo Li <[email protected]>
libceph: add doutc and *_client debug macros support
Pavitra Jha <[email protected]>
libceph: fix two unsafe bare decodes in decode_lockers()
Xiang Mei <[email protected]>
libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
Andy Shevchenko <[email protected]>
libceph: Amend checking to fix make W=1 build breakage
Max Kellermann <[email protected]>
ceph: avoid fs reclaim while using current->journal_info
Zhiling Zou <[email protected]>
sctp: avoid auth_enable sysctl UAF during netns teardown
Chenguang Zhao <[email protected]>
mptcp: decrement subflows counter on failed passive join
Paolo Abeni <[email protected]>
mptcp: fix subflow accounting on close
Hugo Villeneuve <[email protected]>
serial: sc16is7xx: implement gpio get_direction() callback
Hugo Villeneuve <[email protected]>
serial: sc16is7xx: fix regression with GPIO configuration
Hugo Villeneuve <[email protected]>
serial: sc16is7xx: remove obsolete out_thread label
Ilpo Järvinen <[email protected]>
serial: sc16is7xx: Fill in rs485_supported
Tomasz Moń <[email protected]>
sc16is7xx: Properly resume TX after stop
Michael Bommarito <[email protected]>
mptcp: only set DATA_FIN when a mapping is present
Jiangshan Yi <[email protected]>
serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms
Andy Shevchenko <[email protected]>
serial: 8250_mid: Remove unneeded test for ->setup() presence
Norbert Szetei <[email protected]>
ALSA: seq: close a re-opened queue timer in the destructor
Fan Wu <[email protected]>
wifi: brcmfmac: drain bus_reset work on device removal
Mirela Rabulea <[email protected]>
media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor()
Sakari Ailus <[email protected]>
media: v4l: async: Set owner for async sub-devices
Daniel Hodges <[email protected]>
wifi: ath6kl: fix use-after-free in aggr_reset_state()
Sakari Ailus <[email protected]>
media: imx219: Fix maximum frame length in lines
Jai Luthra <[email protected]>
media: i2c: imx219: Rename VTS to FRM_LENGTH
David Plowman <[email protected]>
media: i2c: imx219: Correct the minimum vblanking value
Laurent Pinchart <[email protected]>
media: i2c: imx219: Drop IMX219_VTS_* macros
Guangshuo Li <[email protected]>
media: marvell-cam: fix missing pci_disable_device() on remove
Jani Nikula <[email protected]>
drm/i915/hdcp: require monotonically increasing seq_num_v
David Carlier <[email protected]>
media: aspeed: fix missing of_reserved_mem_device_release() on probe failure
Bryam Vargas <[email protected]>
drm/virtio: bound EDID block reads to the response buffer
Dmitry Osipenko <[email protected]>
drm/virtio: Return proper error codes instead of -1
Thomas Zimmermann <[email protected]>
drm/tegra: fbdev: Remove offset into framebuffer memory
Jani Nikula <[email protected]>
drm/displayid: fix Tiled Display Topology ID size
Deepanshu Kartikey <[email protected]>
drm/virtio: use uninterruptible resv lock for plane updates
Christian König <[email protected]>
dma-buf/drivers: make reserving a shared slot mandatory v4
Ashutosh Desai <[email protected]>
drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers
Ashutosh Desai <[email protected]>
drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers
Cen Zhang <[email protected]>
usb: gadget: f_tcm: synchronize delayed set_alt with teardown
Ashutosh Desai <[email protected]>
drm/dp/mst: fix buffer overflows in sideband chunk accumulation
Venkatesh Srinivas <[email protected]>
KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN
David Matlack <[email protected]>
KVM: Introduce vcpu->wants_to_run
Sean Christopherson <[email protected]>
KVM: x86: Move "apicv_active" into "struct kvm_lapic"
Sean Christopherson <[email protected]>
KVM: x86: Check for in-kernel xAPIC when querying APICv for directed yield
Sean Christopherson <[email protected]>
KVM: x86: Drop @vcpu parameter from kvm_x86_ops.hwapic_isr_update()
Johan Hovold <[email protected]>
USB: serial: keyspan_pda: fix data loss on receive throttling
Johan Hovold <[email protected]>
USB: serial: keyspan_pda: clean up comments and whitespace
Johan Hovold <[email protected]>
USB: serial: keyspan_pda: add write-fifo support
Johan Hovold <[email protected]>
USB: serial: keyspan_pda: fix write implementation
Johan Hovold <[email protected]>
USB: serial: keyspan_pda: refactor write-room handling
Fan Wu <[email protected]>
usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown
Chunfeng Yun <[email protected]>
usb: gadget: bdc: fix checkpatch.pl spacing error
Reinette Chatre <[email protected]>
fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list
Dawei Feng <[email protected]>
octeontx2-pf: fix SQB pointer leak on init failure
Haoxiang Li <[email protected]>
net: ipa: fix SMEM state handle leaks in SMP2P init
Sabrina Dubroca <[email protected]>
espintcp: use sk_msg_free_partial to fix partial send
Breno Leitao <[email protected]>
bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()
Breno Leitao <[email protected]>
bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c
Rasmus Villemoes <[email protected]>
bootconfig: do not put quotes on cmdline items unless necessary
Runyu Xiao <[email protected]>
gpio: tegra: do not call pinctrl for GPIO direction
Bryam Vargas <[email protected]>
net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked
Vladimir Oltean <[email protected]>
net/sched: taprio: avoid calling child->ops->dequeue(child) twice
Maoyi Xie <[email protected]>
net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink
Maoyi Xie <[email protected]>
net: ipip: require CAP_NET_ADMIN in the device netns for changelink
Liu Jian <[email protected]>
net: Add helper function to parse netlink msg of ip_tunnel_encap
Dmitry Torokhov <[email protected]>
Input: ims-pcu - fix firmware leak in async update
Dmitry Torokhov <[email protected]>
firmware_loader: introduce __free() cleanup hanler
Guangshuo Li <[email protected]>
mmc: vub300: fix use-after-free on probe failure
Johan Hovold <[email protected]>
mmc: vub300: rename probe error labels
Johan Hovold <[email protected]>
mmc: vub300: fix use-after-free on disconnect
Maoyi Xie <[email protected]>
wifi: libertas_tf: fix use-after-free in lbtf_free_adapter()
Dmitry Torokhov <[email protected]>
Input: ims-pcu - fix race condition in reset_device sysfs callback
Mikulas Patocka <[email protected]>
dm-verity: make error counter atomic
Mikulas Patocka <[email protected]>
dm-integrity: don't increment hash_offset twice
Bryam Vargas <[email protected]>
scsi: target: Bound PR-OUT TransportID parsing to the received buffer
Maurizio Lombardi <[email protected]>
scsi: target: core: Generate correct identifiers for PR OUT transport IDs
Chaitanya Kulkarni <[email protected]>
scsi: target: core: pr: Initialize arrays at declaration time
Souvik Banerjee <[email protected]>
ovl: use linked upper dentry in copy-up tmpfile
Abdun Nihaal <[email protected]>
scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()
Michael Bommarito <[email protected]>
thunderbolt: Prevent XDomain delayed work use-after-free on disconnect
Mika Westerberg <[email protected]>
thunderbolt: Remove XDomain from the bus without holding tb->lock
Mika Westerberg <[email protected]>
thunderbolt: Keep XDomain reference during the lifetime of a service
Vincent Jardin <[email protected]>
i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)
Stefan Eichenberger <[email protected]>
i2c: imx: separate atomic, dma and non-dma use case
Frank Li <[email protected]>
dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK
Frank Li <[email protected]>
dmaengine: dw-edma: Remove unused irq field in struct dw_edma_chip
Gustavo Pimentel <[email protected]>
dmaengine: dw-edma: Improve the linked list and data blocks definition
Gustavo Pimentel <[email protected]>
PCI: Add pci_find_vsec_capability() to find a specific VSEC
Jarkko Sakkinen <[email protected]>
tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()
Fredric Cover <[email protected]>
smb: client: use kvzalloc() for megabyte buffer in simple fallocate
Miquel Raynal <[email protected]>
mtd: spi-nor: swp: Improve locking user experience
Michael Walle <[email protected]>
mtd: spi-nor: Fix spi_nor_try_unlock_all()
Tudor Ambarus <[email protected]>
mtd: spi-nor: Move Software Write Protection logic out of the core
Michael Walle <[email protected]>
mtd: spi-nor: intel: remove global protection flag
Michael Walle <[email protected]>
mtd: spi-nor: sst: remove global protection flag
Yiyang Chen <[email protected]>
taskstats: retain dead thread stats in TGID queries
Oleg Nesterov <[email protected]>
taskstats: fill_stats_for_tgid: use for_each_thread()
Maoyi Xie <[email protected]>
net: thunderbolt: Fix frags[] overflow by bounding frame_count
Florian Fuchs <[email protected]>
mtd: maps: vmu-flash: fix fault in unaligned fixup
Breno Leitao <[email protected]>
9p: skip nlink update in cacheless mode to fix WARN_ON
Vasiliy Kovalev <[email protected]>
net/9p: fix infinite loop in p9_client_rpc on fatal signal
Tristan Madani <[email protected]>
selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()
Casey Schaufler <[email protected]>
lsm: infrastructure management of the sock security
Ondrej Mosnacek <[email protected]>
lsm: use default hook return value in call_int_hook()
Florian Westphal <[email protected]>
netfilter: nft_set_pipapo: don't leak bad clone into future transaction
Florian Westphal <[email protected]>
netfilter: nft_set_pipapo: move cloning of match info to insert/removal path
Florian Westphal <[email protected]>
netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone
Florian Westphal <[email protected]>
netfilter: nft_set_pipapo: merge deactivate helper into caller
Florian Westphal <[email protected]>
netfilter: nft_set_pipapo: prepare walk function for on-demand clone
Florian Westphal <[email protected]>
netfilter: nft_set_pipapo: make pipapo_clone helper return NULL
Florian Westphal <[email protected]>
netfilter: nft_set_pipapo: use GFP_KERNEL for insertions
Junrui Luo <[email protected]>
jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()
Harshad Shirwadkar <[email protected]>
jbd2: add a helper to find out number of fast commit blocks
Pablo Neira Ayuso <[email protected]>
netfilter: nf_conntrack_sip: validate skb_dst() before accessing it
Florian Westphal <[email protected]>
netfilter: nf_conntrack_sip: remove net variable shadowing
Runyu Xiao <[email protected]>
octeontx2-vf: clear stale mailbox IRQ state before request_irq()
Cássio Gabriel <[email protected]>
ASoC: mediatek: mt8183: Check runtime resume during probe
Runyu Xiao <[email protected]>
octeontx2-pf: clear stale mailbox IRQ state before request_irq()
Subbaraya Sundeep <[email protected]>
octeontx2: Annotate mmio regions as __iomem
Wentao Liang <[email protected]>
mlxsw: fix refcount leak in mlxsw_sp_port_lag_join()
Petr Machata <[email protected]>
mlxsw: spectrum: On port enslavement to a LAG, join upper's bridges
Ido Schimmel <[email protected]>
mlxsw: spectrum: Apply RIF configuration when joining a LAG
David Howells <[email protected]>
rxrpc: Fix socket notification race
David Howells <[email protected]>
rxrpc: Fix notification vs call-release vs recvmsg
David Howells <[email protected]>
rxrpc: Fix recv-recv race of completed call
Li Xiasong <[email protected]>
tipc: restrict socket queue dumps in enqueue tracepoints
Li Daming <[email protected]>
rxrpc: serialize kernel accept preallocation with socket teardown
Tapio Reijonen <[email protected]>
serial: max310x: implement gpio_chip::get_direction()
Hugo Villeneuve <[email protected]>
serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch)
Xu Rao <[email protected]>
ALSA: hda: Fix cached processing coefficient verbs
Ricardo Robaina <[email protected]>
audit: fix recursive locking deadlock in audit_dupe_exe()
Ricardo Robaina <[email protected]>
audit: use 'unsigned int' instead of 'unsigned'
Jeff Layton <[email protected]>
audit: widen ino fields to u64
NeilBrown <[email protected]>
VFS/audit: introduce kern_path_parent() for audit
Bryam Vargas <[email protected]>
Input: mms114 - reject an oversized device packet size
Zhenhao Wan <[email protected]>
RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
Akhil R <[email protected]>
i2c: smbus: Use device_*() functions instead of of_*()
Akhil R <[email protected]>
device property: Add fwnode_irq_get_byname
Haoxiang Li <[email protected]>
i2c: davinci: Unregister cpufreq notifier on probe failure
Sebastian Alba Vives <[email protected]>
fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()
Mikhail Gavrilov <[email protected]>
dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning
Jason Gunthorpe <[email protected]>
udmabuf: Do not create malformed scatterlists
Matt Bobrowski <[email protected]>
bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
Chao Yu <[email protected]>
f2fs: fix UAF issue in f2fs_merge_page_bio()
Xiang Mei <[email protected]>
net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
Christoph Hellwig <[email protected]>
xfs: check v5 superblock features early
David Rosca <[email protected]>
drm/amdgpu: Fix UVD decode image min size calculation
David Rosca <[email protected]>
drm/amdgpu: Implement insert_end for VCE 3
David Rosca <[email protected]>
drm/amdgpu: Reject UVD message with dimensions above 4096
Candice Li <[email protected]>
drm/amdgpu: validate GEM_CREATE domain combinations
David Rosca <[email protected]>
drm/amdgpu: Reject UVD message with invalid number of h265 refs
Eric Farman <[email protected]>
s390/vfio_ccw: Fix out of bounds check on CCW array
Guangshuo Li <[email protected]>
drm/radeon: fix autosuspend cleanup during teardown
Pei Xiao <[email protected]>
mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition
Haibo Chen <[email protected]>
mmc: sdhci: make tuning_err a signed int
Myeonghun Pak <[email protected]>
mmc: sdhci: unmap the bounce buffer before device release
Zhan Xusheng <[email protected]>
mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit
Yiming Zhu <[email protected]>
ceph: fix MDS random selection readiness predicate
Raphael Zimmer <[email protected]>
libceph: Avoid using invalid osd indices from primary_temp
Dmitry Torokhov <[email protected]>
Input: sur40 - fix V4L error path cleanup
Dmitry Torokhov <[email protected]>
Input: sur40 - fix input device registration ordering
Ali Ahmet Memis <[email protected]>
openrisc: signal: do not restore privileged SR bits on sigreturn
Josh Poimboeuf <[email protected]>
ftrace: Fix off-by-one fentry site disable in ftrace_free_mem()
Pavitra Jha <[email protected]>
libceph: fix multiple unsafe decodes in decode_locker()
Thorsten Blum <[email protected]>
crypto: qce - fix error path in devm_qce_register_algs
Dmitry Torokhov <[email protected]>
Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
Dmitry Torokhov <[email protected]>
Input: synaptics-rmi4 - block s_input when F54 queue is busy
Bryam Vargas <[email protected]>
Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer
Dmitry Torokhov <[email protected]>
Input: synaptics-rmi4 - zero report size on F54 work error
George Wilson <[email protected]>
powerpc/pseries: lparcfg - fix kbuf[] underflow
Pengpeng Hou <[email protected]>
Input: iforce - validate input packet lengths
Zhefu Zhang <[email protected]>
Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard
Linmao Li <[email protected]>
Input: psxpad-spi - set driver data before use
Richard Davies <[email protected]>
Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
Dmitry Torokhov <[email protected]>
Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
George Wilson <[email protected]>
powerpc/pseries: pci - logic bug
Peter Ujfalusi <[email protected]>
ASoC: cs4265: sort the register default table
Hidayath Khan <[email protected]>
s390/qeth: validate user buffer length in SNMP and ARP query ioctls
Matthieu Baerts (NGI0) <[email protected]>
mptcp: options: reset DSS fields in case of unexpected size
Bryam Vargas <[email protected]>
selinux: do not cancel a policy conversion that never started
Bryam Vargas <[email protected]>
selinux: reject a class permission count below its inherited common
Bryam Vargas <[email protected]>
selinux: require every boolean value to be defined
Yizhou Zhao <[email protected]>
ipvs: separate destination availability state
Jiasheng Jiang <[email protected]>
media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization
Fullway Wang <[email protected]>
media: mtk-vcodec: potential null pointer deference in SCP
-------------
Diffstat:
Makefile | 4 +- arch/arm64/boot/dts/nvidia/tegra194.dtsi | 2 + arch/arm64/kvm/arm.c | 2 +- arch/mips/kvm/mips.c | 2 +- arch/openrisc/include/asm/processor.h | 2 + arch/openrisc/kernel/signal.c | 5 +- arch/powerpc/kvm/powerpc.c | 2 +- arch/powerpc/platforms/pseries/lparcfg.c | 2 +- arch/powerpc/platforms/pseries/pci.c | 2 +- arch/s390/kvm/kvm-s390.c | 2 +- arch/x86/include/asm/kvm_host.h | 3 +- arch/x86/kernel/cpu/resctrl/rdtgroup.c | 12 +- arch/x86/kvm/lapic.c | 41 +- arch/x86/kvm/lapic.h | 3 +- arch/x86/kvm/svm/avic.c | 4 +- arch/x86/kvm/svm/svm.h | 2 +- arch/x86/kvm/vmx/vmx.c | 9 +- arch/x86/kvm/x86.c | 19 +- crypto/ccm.c | 2 +- drivers/base/property.c | 29 ++ drivers/char/tpm/tpm_tis_core.c | 38 +- drivers/crypto/qce/core.c | 2 +- drivers/dma-buf/dma-resv.c | 8 +- drivers/dma-buf/udmabuf.c | 21 +- drivers/dma/dw-edma/dw-edma-core.c | 77 ++-- drivers/dma/dw-edma/dw-edma-core.h | 20 +- drivers/dma/dw-edma/dw-edma-pcie.c | 180 ++++++-- drivers/dma/dw-edma/dw-edma-v0-core.c | 76 ++-- drivers/fpga/dfl-afu-main.c | 3 + drivers/gpio/gpio-tegra.c | 18 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 21 + drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 2 +- drivers/gpu/drm/amd/amdgpu/vce_v3_0.c | 26 +- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 14 +- drivers/gpu/drm/drm_connector.c | 12 +- drivers/gpu/drm/drm_dp_mst_topology.c | 32 +- drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c | 2 +- drivers/gpu/drm/i915/display/intel_hdcp.c | 7 +- drivers/gpu/drm/i915/i915_vma.c | 2 +- drivers/gpu/drm/lima/lima_gem.c | 2 +- drivers/gpu/drm/msm/msm_gem_submit.c | 2 +- drivers/gpu/drm/nouveau/nouveau_fence.c | 2 +- drivers/gpu/drm/qxl/qxl_release.c | 2 +- drivers/gpu/drm/radeon/radeon_kms.c | 1 + drivers/gpu/drm/radeon/radeon_vm.c | 2 +- drivers/gpu/drm/tegra/fb.c | 8 +- drivers/gpu/drm/ttm/ttm_bo.c | 4 +- drivers/gpu/drm/ttm/ttm_execbuf_util.c | 4 +- drivers/gpu/drm/vc4/vc4_gem.c | 2 +- drivers/gpu/drm/vgem/vgem_fence.c | 2 +- drivers/gpu/drm/virtio/virtgpu_drv.h | 1 + drivers/gpu/drm/virtio/virtgpu_gem.c | 17 + drivers/gpu/drm/virtio/virtgpu_plane.c | 5 +- drivers/gpu/drm/virtio/virtgpu_vq.c | 9 +- drivers/hwmon/npcm750-pwm-fan.c | 11 + drivers/i2c/busses/i2c-bcm-iproc.c | 11 +- drivers/i2c/busses/i2c-davinci.c | 4 +- drivers/i2c/busses/i2c-imx.c | 126 +++-- drivers/i2c/i2c-core-base.c | 2 +- drivers/i2c/i2c-core-smbus.c | 15 +- drivers/i2c/i2c-smbus.c | 5 +- drivers/infiniband/ulp/rtrs/rtrs-srv.c | 5 +- drivers/input/joystick/iforce/iforce-packets.c | 11 +- drivers/input/joystick/iforce/iforce-usb.c | 3 + drivers/input/joystick/psxpad-spi.c | 1 + drivers/input/keyboard/atkbd.c | 8 + drivers/input/misc/ims-pcu.c | 7 +- drivers/input/mouse/focaltech.c | 2 +- drivers/input/rmi4/rmi_f54.c | 43 +- drivers/input/rmi4/rmi_f55.c | 4 +- drivers/input/touchscreen/mms114.c | 6 + drivers/input/touchscreen/sur40.c | 23 +- drivers/md/dm-integrity.c | 4 - drivers/md/dm-verity-target.c | 12 +- drivers/md/dm-verity.h | 2 +- drivers/media/i2c/imx219.c | 47 +- drivers/media/platform/aspeed-video.c | 1 + drivers/media/platform/marvell-ccic/cafe-driver.c | 1 + .../media/platform/mtk-vcodec/mtk_vcodec_fw_scp.c | 5 + drivers/media/v4l2-core/v4l2-async.c | 8 +- drivers/media/v4l2-core/v4l2-fwnode.c | 7 +- drivers/mmc/host/atmel-mci.c | 2 + drivers/mmc/host/omap_hsmmc.c | 2 +- drivers/mmc/host/sdhci.c | 16 + drivers/mmc/host/sdhci.h | 2 +- drivers/mmc/host/vub300.c | 36 +- drivers/mtd/maps/vmu-flash.c | 8 +- drivers/mtd/spi-nor/Makefile | 2 +- drivers/mtd/spi-nor/core.c | 406 +---------------- drivers/mtd/spi-nor/core.h | 5 + drivers/mtd/spi-nor/intel.c | 16 +- drivers/mtd/spi-nor/sst.c | 30 +- drivers/mtd/spi-nor/swp.c | 426 +++++++++++++++++ drivers/net/can/usb/gs_usb.c | 2 +- drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 25 + drivers/net/ethernet/aquantia/atlantic/aq_ring.h | 1 + drivers/net/ethernet/aquantia/atlantic/aq_vec.c | 2 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 10 +- drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c | 48 ++ .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 13 +- .../net/ethernet/marvell/octeontx2/nic/otx2_vf.c | 8 +- drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 109 ++++- drivers/net/ethernet/mellanox/mlxsw/spectrum.h | 4 + .../net/ethernet/mellanox/mlxsw/spectrum_router.c | 31 +- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 139 ++++-- drivers/net/ethernet/ti/am65-cpsw-nuss.h | 4 + drivers/net/ipa/ipa_smp2p.c | 30 +- drivers/net/thunderbolt.c | 8 +- drivers/net/wireless/ath/ath6kl/txrx.c | 2 +- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 13 + .../net/wireless/broadcom/brcm80211/brcmfmac/bus.h | 6 + .../wireless/broadcom/brcm80211/brcmfmac/core.c | 45 +- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 6 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.h | 1 + .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 3 + drivers/net/wireless/marvell/libertas_tf/main.c | 2 +- drivers/pci/pci.c | 30 ++ drivers/s390/cio/vfio_ccw_cp.c | 17 +- drivers/s390/net/qeth_core_main.c | 3 + drivers/s390/net/qeth_l3_main.c | 5 + drivers/scsi/lpfc/lpfc_init.c | 3 +- drivers/scsi/scsi_debug.c | 27 +- drivers/scsi/sd.h | 5 +- drivers/scsi/sd_zbc.c | 79 +++- drivers/target/target_core_fabric_lib.c | 146 ++++-- drivers/target/target_core_internal.h | 5 +- drivers/target/target_core_pr.c | 54 +-- drivers/thunderbolt/domain.c | 30 ++ drivers/thunderbolt/icm.c | 5 + drivers/thunderbolt/switch.c | 14 + drivers/thunderbolt/tb.c | 58 +-- drivers/thunderbolt/tb.h | 2 + drivers/thunderbolt/xdomain.c | 71 ++- drivers/tty/serial/8250/8250_mid.c | 6 +- drivers/tty/serial/max310x.c | 20 +- drivers/tty/serial/sc16is7xx.c | 192 ++++++-- drivers/usb/gadget/function/f_tcm.c | 192 ++++++-- drivers/usb/gadget/function/tcm.h | 13 + drivers/usb/gadget/udc/bdc/bdc_core.c | 20 + drivers/usb/gadget/udc/bdc/bdc_udc.c | 7 +- drivers/usb/serial/keyspan_pda.c | 471 ++++++++++--------- fs/9p/vfs_inode.c | 9 + fs/binfmt_elf.c | 4 +- fs/binfmt_elf_fdpic.c | 4 +- fs/binfmt_misc.c | 14 +- fs/ceph/addr.c | 24 +- fs/ceph/cache.c | 2 +- fs/ceph/caps.c | 53 ++- fs/ceph/dir.c | 20 +- fs/ceph/export.c | 10 +- fs/ceph/file.c | 33 +- fs/ceph/inode.c | 20 +- fs/ceph/ioctl.c | 8 +- fs/ceph/mds_client.c | 11 + fs/ceph/mds_client.h | 2 + fs/ceph/mdsmap.c | 2 +- fs/ceph/super.c | 22 +- fs/ceph/super.h | 8 +- fs/ceph/xattr.c | 8 +- fs/cifs/smb2ops.c | 4 +- fs/exec.c | 6 +- fs/f2fs/data.c | 2 +- fs/jbd2/journal.c | 10 +- fs/namei.c | 42 ++ fs/overlayfs/copy_up.c | 14 +- fs/super.c | 19 +- fs/xfs/libxfs/xfs_sb.c | 4 +- include/drm/drm_connector.h | 6 +- include/drm/drm_displayid.h | 2 +- include/linux/audit.h | 18 +- include/linux/bootconfig.h | 3 + include/linux/bpf_lsm.h | 4 + include/linux/ceph/ceph_debug.h | 38 ++ include/linux/dma-resv.h | 2 +- include/linux/dma/edma.h | 2 - include/linux/firmware.h | 3 + include/linux/fs.h | 28 ++ include/linux/i2c-smbus.h | 6 +- include/linux/jbd2.h | 9 +- include/linux/kvm_host.h | 1 + include/linux/lsm_hooks.h | 1 + include/linux/namei.h | 1 + include/linux/pci.h | 1 + include/linux/property.h | 1 + include/linux/skbuff.h | 2 + include/linux/thunderbolt.h | 3 + include/media/v4l2-async.h | 9 +- include/net/act_api.h | 20 + include/net/ip_tunnels.h | 3 + include/net/ip_vs.h | 7 + include/trace/events/rxrpc.h | 2 + include/uapi/linux/ip_vs.h | 6 - init/main.c | 39 -- kernel/audit.c | 2 +- kernel/audit.h | 32 +- kernel/audit_fsnotify.c | 39 +- kernel/audit_tree.c | 2 +- kernel/audit_watch.c | 42 +- kernel/auditfilter.c | 17 +- kernel/auditsc.c | 6 +- kernel/bpf/bpf_inode_storage.c | 10 + kernel/sched/psi.c | 6 + kernel/taskstats.c | 67 +-- kernel/trace/ftrace.c | 21 +- lib/bootconfig.c | 65 +++ lib/compat_audit.c | 12 +- mm/memory_hotplug.c | 15 +- mm/pagewalk.c | 8 + mm/ptdump.c | 7 + net/9p/client.c | 2 + net/bluetooth/hidp/core.c | 25 +- net/ceph/cls_lock_client.c | 21 +- net/ceph/osdmap.c | 9 +- net/core/pktgen.c | 43 +- net/core/skbuff.c | 28 +- net/ipv4/ip_tunnel_core.c | 35 ++ net/ipv4/ipip.c | 41 +- net/ipv6/ip6_tunnel.c | 40 +- net/ipv6/sit.c | 38 +- net/mptcp/options.c | 21 +- net/mptcp/protocol.c | 4 +- net/mptcp/protocol.h | 14 + net/mptcp/subflow.c | 12 +- net/netfilter/ipset/ip_set_core.c | 19 +- net/netfilter/ipset/ip_set_list_set.c | 7 +- net/netfilter/ipvs/ip_vs_conn.c | 4 +- net/netfilter/ipvs/ip_vs_core.c | 6 +- net/netfilter/ipvs/ip_vs_ctl.c | 4 +- net/netfilter/ipvs/ip_vs_dh.c | 4 +- net/netfilter/ipvs/ip_vs_lblc.c | 2 +- net/netfilter/ipvs/ip_vs_lblcr.c | 8 +- net/netfilter/nf_conntrack_sip.c | 10 +- net/netfilter/nf_flow_table_core.c | 7 +- net/netfilter/nf_tables_offload.c | 2 +- net/netfilter/nft_set_pipapo.c | 252 ++++++---- net/netfilter/nft_set_pipapo.h | 8 + net/packet/af_packet.c | 7 +- net/rxrpc/call_accept.c | 28 +- net/rxrpc/call_object.c | 27 +- net/rxrpc/recvmsg.c | 23 +- net/sched/act_gact.c | 5 + net/sched/act_police.c | 6 + net/sched/sch_api.c | 24 +- net/sched/sch_taprio.c | 12 +- net/sctp/protocol.c | 20 +- net/sctp/sysctl.c | 9 +- net/smc/af_smc.c | 3 +- net/smc/smc_rx.c | 12 +- net/smc/smc_tx.c | 17 +- net/tipc/socket.c | 6 +- net/xfrm/espintcp.c | 32 +- security/apparmor/include/net.h | 6 +- security/apparmor/lsm.c | 38 +- security/bpf/hooks.c | 3 + security/security.c | 506 +++++++++++++-------- security/selinux/hooks.c | 91 ++-- security/selinux/include/objsec.h | 5 + security/selinux/netlabel.c | 23 +- security/selinux/ss/policydb.c | 31 ++ security/selinux/ss/services.c | 4 +- security/smack/smack.h | 5 + security/smack/smack_lsm.c | 66 ++- security/smack/smack_netfilter.c | 8 +- sound/core/seq/seq_timer.c | 13 +- sound/hda/hdac_regmap.c | 4 +- sound/soc/codecs/cs4265.c | 4 +- sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 12 +- sound/soc/xilinx/xlnx_formatter_pcm.c | 10 +- sound/usb/usx2y/usX2Yhwdep.c | 10 +- sound/usb/usx2y/usbus428ctldefs.h | 2 + sound/usb/usx2y/usbusx2y.c | 2 +- sound/usb/usx2y/usx2yhwdeppcm.c | 15 +- virt/kvm/kvm_main.c | 3 + 276 files changed, 4340 insertions(+), 2447 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/235 media: mtk-vcodec: potential null pointer deference in SCP
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fullway Wang <[email protected]>
[ Upstream commit 53dbe08504442dc7ba4865c09b3bbf5fe849681b ]
The return value of devm_kzalloc() needs to be checked to avoid NULL pointer deference. This is similar to CVE-2022-3113.
[Andrey Troshin: backport fixs from
drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_scp.c to drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_scp.c]
--- drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_scp.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_scp.c +2 -0
@@ -65,6 +65,8 @@ struct mtk_vcodec_fw *mtk_vcodec_fw_scp_init(struct mtk_vcodec_dev *dev) } fw =devm_kzalloc (&dev->plat_dev->dev,sizeof (*fw),GFP_KERNEL ); +if (!fw) +return ERR_PTR (-ENOMEM ); fw->type =SCP ; fw->ops = &mtk_vcodec_rproc_msg; fw->scp = scp;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 2/235 media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiasheng Jiang <[email protected]>
[ Upstream commit 4936cd5817af35d23e4d283f48fa59a18ef481e4 ]
On Mediatek devices with a system companion processor (SCP) the mtk_scp structure has to be removed explicitly to avoid a resource leak. Free the structure in case the allocation of the firmware structure fails during the firmware initialization.
[Andrey Troshin: backport fixs from
drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_scp.c to drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_scp.c]
--- drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_scp.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_scp.c +4 -1
@@ -65,8 +65,11 @@ struct mtk_vcodec_fw *mtk_vcodec_fw_scp_init(struct mtk_vcodec_dev *dev) } fw =devm_kzalloc (&dev->plat_dev->dev,sizeof (*fw),GFP_KERNEL ); -if (!fw) +if (!fw) { +scp_put (scp);return ERR_PTR (-ENOMEM ); + } + fw->type =SCP ; fw->ops = &mtk_vcodec_rproc_msg; fw->scp = scp;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 3/235 ipvs: separate destination availability state
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yizhou Zhao <[email protected]>
commit cdcc4e46180df8161f4d2f3c6fd6beaf6990133d upstream.
IPVS configuration paths update destination availability while connection accounting updates destination overload state. The two independent states share dest->flags, so their read-modify-write updates can race and lose one another.
Keep OVERLOAD in flags, where the preceding patch serializes its updates with dst_lock, and move AVAILABLE to cflags. This keeps configuration- controlled availability out of the scheduler hot cacheline until a scheduler needs to check it. It also prevents availability updates from clobbering overload state.
The destination status bits are not exposed through the IPVS sockopt or netlink interfaces, so keep their definitions in the internal IPVS header.
Readers can still observe stale destination state; this does not provide a cross-field snapshot.
--- include/net/ip_vs.h | 7 +++++++ include/uapi/linux/ip_vs.h | 6 ------ net/netfilter/ipvs/ip_vs_conn.c | 4 ++-- net/netfilter/ipvs/ip_vs_core.c | 6 +++--- net/netfilter/ipvs/ip_vs_ctl.c | 4 ++-- net/netfilter/ipvs/ip_vs_dh.c | 4 ++-- net/netfilter/ipvs/ip_vs_lblc.c | 2 +- net/netfilter/ipvs/ip_vs_lblcr.c | 8 ++++---- 8 files changed, 21 insertions(+), 20 deletions(-)
include/net/ip_vs.h +7 -0
@@ -33,6 +33,12 @@#define IP_VS_HDR_INVERSE 1#define IP_VS_HDR_ICMP 2 +/* Destination Server Flags */ +#define IP_VS_DEST_F_OVERLOAD 0x0002/* server is overloaded */ + +/* Destination Server Config Flags */ +#define IP_VS_DEST_CF_AVAILABLE 0x0001/* server is available */ +/* Generic access of ipvs struct */ static inline struct netns_ipvs *net_ipvs (struct net * net) {
@@ -664,6 +670,7 @@ struct ip_vs_dest {volatile unsigned int flags;/* dest status flags */ atomic_t conn_flags;/* flags to copy to conn */ atomic_t weight;/* server weight */ +unsigned long cflags;/* config flags */ atomic_t last_weight;/* server latest weight */ __u16 tun_type;/* tunnel type */ __be16 tun_port;/* tunnel port */
include/uapi/linux/ip_vs.h +0 -6
@@ -28,12 +28,6 @@#define IP_VS_SVC_F_SCHED_SH_FALLBACK IP_VS_SVC_F_SCHED1/* SH fallback */ #define IP_VS_SVC_F_SCHED_SH_PORT IP_VS_SVC_F_SCHED2/* SH use port */ -/* -* Destination Server Flags -*/ -#define IP_VS_DEST_F_AVAILABLE 0x0001/* server is available */ -#define IP_VS_DEST_F_OVERLOAD 0x0002/* server is overloaded */ -/* * IPVS sync daemon states */
net/netfilter/ipvs/ip_vs_conn.c +2 -2
@@ -759,7 +759,7 @@ int ip_vs_check_template(struct ip_vs_conn *ct, struct ip_vs_dest *cdest)* Checking the dest server status. */ if ((dest ==NULL ) || - !(dest->flags &IP_VS_DEST_F_AVAILABLE ) || + !(dest->cflags &IP_VS_DEST_CF_AVAILABLE ) ||expire_quiescent_template (ipvs, dest) || (cdest && (dest != cdest))) { IP_VS_DBG_BUF(9, "check_template: dest not available for "
@@ -1402,7 +1402,7 @@ void ip_vs_expire_nodest_conn_flush(struct netns_ipvs *ipvs)continue ; dest = cp->dest; -if (!dest || (dest->flags &IP_VS_DEST_F_AVAILABLE )) +if (!dest || (dest->cflags &IP_VS_DEST_CF_AVAILABLE ))continue ;if (atomic_read (&cp->n_control))
net/netfilter/ipvs/ip_vs_core.c +3 -3
@@ -136,7 +136,7 @@ ip_vs_in_stats(struct ip_vs_conn *cp, struct sk_buff *skb)struct ip_vs_dest *dest = cp->dest;struct netns_ipvs *ipvs = cp->ipvs; -if (dest && (dest->flags &IP_VS_DEST_F_AVAILABLE )) { +if (dest && (dest->cflags &IP_VS_DEST_CF_AVAILABLE )) {struct ip_vs_cpu_stats *s;struct ip_vs_service *svc;
@@ -172,7 +172,7 @@ ip_vs_out_stats(struct ip_vs_conn *cp, struct sk_buff *skb)struct ip_vs_dest *dest = cp->dest;struct netns_ipvs *ipvs = cp->ipvs; -if (dest && (dest->flags &IP_VS_DEST_F_AVAILABLE )) { +if (dest && (dest->cflags &IP_VS_DEST_CF_AVAILABLE )) {struct ip_vs_cpu_stats *s;struct ip_vs_service *svc;
@@ -2096,7 +2096,7 @@ ip_vs_in(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, int }/* Check the server status */ -if (cp && cp->dest && !(cp->dest->flags &IP_VS_DEST_F_AVAILABLE )) { +if (cp && cp->dest && !(cp->dest->cflags &IP_VS_DEST_CF_AVAILABLE )) {/* the destination server is not available */ if (sysctl_expire_nodest_conn (ipvs)) {bool old_ct =ip_vs_conn_uses_old_conntrack (cp, skb);
net/netfilter/ipvs/ip_vs_ctl.c +2 -2
@@ -961,7 +961,7 @@ __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest, }/* set the dest status flags */ - dest->flags |=IP_VS_DEST_F_AVAILABLE ; + dest->cflags |=IP_VS_DEST_CF_AVAILABLE ;if (READ_ONCE (dest->u_threshold) != udest->u_threshold ||READ_ONCE (dest->l_threshold) != udest->l_threshold) {
@@ -1240,7 +1240,7 @@ static void __ip_vs_unlink_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest, int svcupd) { - dest->flags &= ~IP_VS_DEST_F_AVAILABLE ; + dest->cflags &= ~IP_VS_DEST_CF_AVAILABLE ;/* * Remove it from the d-linked destination list.
net/netfilter/ipvs/ip_vs_dh.c +2 -2
@@ -220,8 +220,8 @@ ip_vs_dh_schedule(struct ip_vs_service *svc, const struct sk_buff *skb, s = (struct ip_vs_dh_state *) svc->sched_data; dest =ip_vs_dh_get (svc->af, s, &iph->daddr); -if (!dest - || !(dest->flags &IP_VS_DEST_F_AVAILABLE ) +if (!dest || + !(dest->cflags &IP_VS_DEST_CF_AVAILABLE ) ||atomic_read (&dest->weight) <=0 ||is_overloaded (dest)) {ip_vs_scheduler_err (svc,"no destination available" );
net/netfilter/ipvs/ip_vs_lblc.c +1 -1
@@ -503,7 +503,7 @@ ip_vs_lblc_schedule(struct ip_vs_service *svc, const struct sk_buff *skb,*/ dest = en->dest; -if ((dest->flags &IP_VS_DEST_F_AVAILABLE ) && +if ((dest->cflags &IP_VS_DEST_CF_AVAILABLE ) &&atomic_read (&dest->weight) >0 && !is_overloaded (dest, svc)) goto out; }
net/netfilter/ipvs/ip_vs_lblcr.c +4 -4
@@ -170,8 +170,8 @@ static inline struct ip_vs_dest *ip_vs_dest_set_min(struct ip_vs_dest_set *set)if (least->flags &IP_VS_DEST_F_OVERLOAD )continue ; -if ((atomic_read (&least->weight) >0 ) - && (least->flags &IP_VS_DEST_F_AVAILABLE )) { +if ((atomic_read (&least->weight) >0 ) && + (least->cflags &IP_VS_DEST_CF_AVAILABLE )) { loh =ip_vs_dest_conn_overhead (least); goto nextstage; }
@@ -187,8 +187,8 @@ static inline struct ip_vs_dest *ip_vs_dest_set_min(struct ip_vs_dest_set *set) doh =ip_vs_dest_conn_overhead (dest);if (((__s64 )loh *atomic_read (&dest->weight) > - (__s64 )doh *atomic_read (&least->weight)) - && (dest->flags &IP_VS_DEST_F_AVAILABLE )) { + (__s64 )doh *atomic_read (&least->weight)) && + (dest->cflags &IP_VS_DEST_CF_AVAILABLE )) { least = dest; loh = doh; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 4/235 selinux: require every boolean value to be defined
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <[email protected]>
commit a93d37a09b863810653f93d371fb197457d59deb upstream.
p_bools.nprim comes from the policy image independently of how many booleans follow it, and cond_index_bool() fills bool_val_to_struct[] at value - 1, so a count larger than the values present leaves NULL entries. Every user of that array then walks it by index and dereferences each
entry: cond_evaluate_expr() on the access-vector path, security_get_bools() and security_get_bool_value() behind selinuxfs, and security_set_bools(). A sparse class value is absorbed by policydb_class_isvalid() and its siblings; booleans have no such predicate, and no consumer that could use one.
Reject a boolean value that no boolean defines, once, where the array is built. Conforming policies define every boolean they declare and are unaffected.
--- security/selinux/ss/policydb.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)
security/selinux/ss/policydb.c +19 -0
@@ -718,6 +718,7 @@ static inline void hash_eval(struct hashstatic int policydb_index (struct policydb *p) {int i, rc; +u32 v;if (p->mls_enabled) pr_debug("SELinux: %d users, %d roles, %d types, %d bools, %d sens, %d cats\n",
@@ -775,6 +776,24 @@ static int policydb_index(struct policydif (rc) goto out; } + +/* +* A sparse class value is absorbed by policydb_class_isvalid() and +* its siblings, but no such predicate exists for booleans: every +* user of bool_val_to_struct[] walks it by index and dereferences +* each entry -- cond_evaluate_expr(), the two getters and +* security_set_bools() -- so an unclaimed one has no consumer that +* can tolerate it. +*/ +for (v =0 ; v < p->p_bools.nprim; v++) { +if (!p->bool_val_to_struct[v]) { +pr_err ("SELinux: boolean %u is declared but not defined\n" , + v +1 ); + rc = -EINVAL ; + goto out; + } + } + rc =0 ; out:return rc;
Greg Kroah-Hartman
maintainerPATCH 5/235 selinux: reject a class permission count below its inherited common
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <[email protected]>
commit 9a82dcd98b6e6e11cfd162410967951f12152528 upstream.
security_get_permissions() maps an inherited common's permissions into an array sized by the class's own permissions.nprim, but class_read() takes that nprim verbatim from the policy image and never checks that it covers the common. A class that inherits a common of N permissions while declaring a smaller nprim is accepted, and on load the common's permissions are written past the class-sized array -- an out-of-bounds heap write.
Reject a class whose permission count is below its inherited common's. Well-formed policies, where the class count already includes the inherited permissions, are unaffected.
--- security/selinux/ss/policydb.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
security/selinux/ss/policydb.c +12 -0
@@ -1356,6 +1356,18 @@ static int class_read(struct policydb *p cladatum->comkey); goto bad; } + +/* +* security_get_permissions() maps the common's permissions +* into an array sized by this class's nprim, so a class must +* declare at least as many as the common it inherits. +*/ +if (cladatum->permissions.nprim < + cladatum->comdatum->permissions.nprim) { +pr_err ("SELinux: class %s has fewer permissions than common %s\n" , + key, cladatum->comkey); + goto bad; + } }for (i =0 ; i < nel; i++) { rc =perm_read (p, &cladatum->permissions, fp);
Greg Kroah-Hartman
maintainerPATCH 6/235 selinux: do not cancel a policy conversion that never started
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <[email protected]>
commit e5c0235a3c4e9eb047a16cd02323fe4ecf2f570e upstream.
sel_write_load() calls selinux_policy_cancel() when sel_make_policy_nodes() fails, and that helper dereferences the outgoing policy to cancel its sidtab conversion. On the first policy load there is no outgoing policy:security_load_policy() returns early for that case, before it converts anything, and state->policy is still NULL. A first load that fails while building the selinuxfs tree therefore takes a NULL dereference in selinux_policy_cancel(), reached from a write(2) to /sys/fs/selinux/load.
Skip the cancel when there is no old policy, mirroring the check security_load_policy() already makes before it converts.
--- security/selinux/ss/services.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
security/selinux/ss/services.c +3 -1
@@ -2194,7 +2194,9 @@ void selinux_policy_cancel(struct selinu oldpolicy =rcu_dereference_protected (state->policy,lockdep_is_held (&state->policy_mutex)); -sidtab_cancel_convert (oldpolicy->sidtab); +/* a first load has no outgoing policy and converted nothing */ +if (oldpolicy) +sidtab_cancel_convert (oldpolicy->sidtab);selinux_policy_free (load_state->policy);kfree (load_state->convert_data); }
Greg Kroah-Hartman
maintainerPATCH 7/235 mptcp: options: reset DSS fields in case of unexpected size
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit 35772b4981f38ba8059372cde8753e8e477e98ec upstream.
A remote peer could send a malformed DSS with a wrong size, followed by another DSS or MPC + Data. In this case, the first suboption will be ignored, but leaving some fields written, which could lead to inconsistency or access uninitialized data.
Explicitly reset the fields that could have been modified in case of unexpected size.
--- net/mptcp/options.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
net/mptcp/options.c +7 -1
@@ -175,8 +175,14 @@ static void mptcp_parse_option(const str* the checksum field MUST be ignored. */ if (opsize != expected_opsize && - opsize != expected_opsize +TCPOLEN_MPTCP_DSS_CHECKSUM ) + opsize != expected_opsize +TCPOLEN_MPTCP_DSS_CHECKSUM ) { + mp_opt->dsn64 =0 ; + mp_opt->use_map =0 ; + mp_opt->ack64 =0 ; + mp_opt->use_ack =0 ; + mp_opt->data_fin =0 ;break ; + } mp_opt->dss =1 ;
Greg Kroah-Hartman
maintainerPATCH 8/235 s390/qeth: validate user buffer length in SNMP and ARP query ioctls
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hidayath Khan <[email protected]>
commit d141f087b1af656f055d7c5793a3e87817ba0bbe upstream.
qeth_snmp_command() and qeth_l3_arp_query() allocate a buffer sized by a user-supplied length (udata_len) without checking a lower bound, then set udata_offset to a fixed non-zero value and pass both to a reply callback. The callback bounds-checks the copy with
if ((udata_len - udata_offset) < len)
Both fields are u32, so a udata_len smaller than udata_offset makes the subtraction wrap and the check pass, and the following memcpy() writes past the allocation. A udata_len of 0 also yields ZERO_SIZE_PTR from kzalloc(), which the existing NULL check does not catch.
Reject buffers smaller than udata_offset before allocating, so the callback subtraction can no longer underflow.
--- drivers/s390/net/qeth_core_main.c | 3 +++ drivers/s390/net/qeth_l3_main.c | 5 +++++ 2 files changed, 8 insertions(+)
drivers/s390/net/qeth_core_main.c +3 -0
@@ -4748,6 +4748,9 @@ static int qeth_snmp_command(struct qethif (req_len >QETH_BUFSIZE )return -EINVAL ; +if (qinfo.udata_len <sizeof (struct qeth_snmp_ureq_hdr )) +return -EINVAL ; + iob =qeth_get_adapter_cmd (card,IPA_SETADP_SET_SNMP_CONTROL , req_len);if (!iob)return -ENOMEM ;
drivers/s390/net/qeth_l3_main.c +5 -0
@@ -1435,6 +1435,11 @@ static int qeth_l3_arp_query(struct qeth rc = -EFAULT ; goto out; } + +if (qinfo.udata_len <QETH_QARP_ENTRIES_OFFSET ) { + rc = -EINVAL ; + goto out; + } qinfo.udata =kzalloc (qinfo.udata_len,GFP_KERNEL );if (!qinfo.udata) { rc = -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 9/235 ASoC: cs4265: sort the register default table
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <[email protected]>
commit e4fe3e046524e5de3c04c6eef3743780cbdc231c upstream.
reg_defaults must be sorted by ascending register address, as regcache_lookup_reg() locates entries in it with bsearch(). See commit fd80df352ba1 ("regcache: Add support for sorting defaults arrays").
cs4265_reg_defaults[] lists CS4265_INT_MASK (0x0e), CS4265_STATUS_MODE_MSB (0x0f) and CS4265_STATUS_MODE_LSB (0x10) after CS4265_SPDIF_CTL1 (0x11) and CS4265_SPDIF_CTL2 (0x12), so the binary search does not find those three entries. regcache_reg_needs_sync() then cannot compare them against their default and reports that a sync is needed, so they are written to the device on every regcache_sync() even when they were never touched.
Sort the table by register address.
--- sound/soc/codecs/cs4265.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/codecs/cs4265.c +2 -2
@@ -46,11 +46,11 @@ static const struct reg_default cs4265_r { CS4265_DAC_CHA_VOL, 0x00 }, { CS4265_DAC_CHB_VOL, 0x00 }, { CS4265_DAC_CTL2, 0xC0 }, - { CS4265_SPDIF_CTL1, 0x00 }, - { CS4265_SPDIF_CTL2, 0x00 }, { CS4265_INT_MASK, 0x00 }, { CS4265_STATUS_MODE_MSB, 0x00 }, { CS4265_STATUS_MODE_LSB, 0x00 }, + { CS4265_SPDIF_CTL1, 0x00 }, + { CS4265_SPDIF_CTL2, 0x00 }, };static bool cs4265_readable_register (struct device *dev,unsigned int reg)
Greg Kroah-Hartman
maintainerPATCH 10/235 powerpc/pseries: pci - logic bug
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: George Wilson <[email protected]>
commit 649c10bff5cb7a514bf299094833ec8c9190aac3 upstream.
The checks on num_vfs in pseries_pci_sriov_enable() are ANDed where OR was apparently intended. Change it to OR.
--- arch/powerpc/platforms/pseries/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/platforms/pseries/pci.c +1 -1
@@ -161,7 +161,7 @@ int pseries_pci_sriov_enable(struct pci_/* First integer stores max config */ max_config_vfs =of_read_number (&max_vfs[0 ],1 ); -if (max_config_vfs < num_vfs && num_vfs >MAX_VFS_FOR_MAP_PE ) { +if (max_config_vfs < num_vfs || num_vfs >MAX_VFS_FOR_MAP_PE ) { dev_err(&pdev->dev, "Num VFs %x > %x Configurable VFs\n", num_vfs, (num_vfs > MAX_VFS_FOR_MAP_PE) ?
Greg Kroah-Hartman
maintainerPATCH 11/235 Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
commit 6058f0fea10f3caf63a435677358d1b8e9325114 upstream.
During F55 sensor detection, the transmitter (TX) electrode count was incorrectly assigned the value of the receiver (RX) electrode count due to copy-paste typos.
This incorrect value was then propagated to the driver data and used by F54 to determine the diagnostics report size. On devices with more RX than TX electrodes, this inflated the perceived TX count, leading to incorrect report size calculations and potential out-of-bounds buffer accesses.
Fix the typos by correctly assigning the TX electrode counts.
--- drivers/input/rmi4/rmi_f55.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/input/rmi4/rmi_f55.c +2 -2
@@ -54,10 +54,10 @@ static int rmi_f55_detect(struct rmi_fun f55->num_tx_electrodes = f55->qry[F55_NUM_TX_OFFSET ]; f55->cfg_num_rx_electrodes = f55->num_rx_electrodes; - f55->cfg_num_tx_electrodes = f55->num_rx_electrodes; + f55->cfg_num_tx_electrodes = f55->num_tx_electrodes; drv_data->num_rx_electrodes = f55->cfg_num_rx_electrodes; - drv_data->num_tx_electrodes = f55->cfg_num_rx_electrodes; + drv_data->num_tx_electrodes = f55->cfg_num_tx_electrodes;if (f55->qry[F55_PHYS_CHAR_OFFSET ] &F55_CAP_SENSOR_ASSIGN ) {int i, total;
Greg Kroah-Hartman
maintainerPATCH 12/235 Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Davies <[email protected]>
commit 296736076b3fd078742651c719555a488624023a upstream.
Make finger2 (and also finger1) unsigned, so that if the finger index in the packet is 0 then subtracting 1 creates an array index which overflows above the existing check for FOC_MAX_FINGERS, as the existing comment says it should, instead of writing to state->fingers[-1].
--- drivers/input/mouse/focaltech.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/input/mouse/focaltech.c +1 -1
@@ -197,7 +197,7 @@ static void focaltech_process_rel_packet {struct focaltech_data *priv = psmouse->private;struct focaltech_hw_state *state = &priv->state; -int finger1, finger2; +unsigned int finger1, finger2; state->pressed = packet[0 ] >>7 ; finger1 = ((packet[0 ] >>4 ) &0x7 ) -1 ;
Greg Kroah-Hartman
maintainerPATCH 13/235 Input: psxpad-spi - set driver data before use
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linmao Li <[email protected]>
commit 732f38c36059e68ba3b4b89c56911d777fd3185c upstream.
psxpad_spi_suspend() retrieves the controller state with spi_get_drvdata(), but probe never stores it, so suspend dereferences a NULL pointer. Store it during probe.
--- drivers/input/joystick/psxpad-spi.c | 1 + 1 file changed, 1 insertion(+)
drivers/input/joystick/psxpad-spi.c +1 -0
@@ -366,6 +366,7 @@ static int psxpad_spi_probe(struct spi_dreturn err; } +spi_set_drvdata (spi, pad);pm_runtime_enable (&spi->dev);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 14/235 Input: atkbd - skip deactivate for Xiaomi Book Pro 14s internal keyboard
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhefu Zhang <[email protected]>
commit 3a046db33bb9f28b43a951a7a090db771dc0f8b3 upstream.
The internal keyboard of the Xiaomi Book Pro 14 does not work unless atkbd skips deactivating it at the end of atkbd_probe().
Using 'i8042.dumbkbd=1' also makes the keyboard work, but then the driver never writes to the keyboard at all, so the Caps Lock LED is lost. The atkbd_deactivate_fixup quirk fixes both without a boot parameter.
DMI: XIAOMI Xiaomi Book Pro 14/TM2424, BIOS XMAPT4B0P0909 05/06/2026
--- drivers/input/keyboard/atkbd.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/input/keyboard/atkbd.c +8 -0
@@ -1954,6 +1954,14 @@ static const struct dmi_system_id atkbd_ }, .callback = atkbd_deactivate_fixup, }, + { + /* Xiaomi Book Pro 14 (TM2424) */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "XIAOMI"), + DMI_MATCH(DMI_PRODUCT_NAME, "Xiaomi Book Pro 14"), + }, + .callback = atkbd_deactivate_fixup, + }, { } };
Greg Kroah-Hartman
maintainerPATCH 15/235 Input: iforce - validate input packet lengths
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
commit 5751c781d3c97ab6ce0e2a966156ed882152c415 upstream.
iforce_process_packet() reads fixed fields from joystick, wheel and status packets without first checking their lengths. In particular, the shared hats-and-buttons helper unconditionally reads data[6]. The status tail is a sequence of 16-bit effect addresses, but an incomplete final address is also consumed. A successful zero-length USB URB additionally reads the packet ID before the common parser is called.
Reject the zero-length USB transfer, require the seven-byte joystick and wheel prefixes and the two-byte status prefix, and consume only complete status-tail addresses.
--- drivers/input/joystick/iforce/iforce-packets.c | 11 ++++++++++- drivers/input/joystick/iforce/iforce-usb.c | 3 +++ 2 files changed, 13 insertions(+), 1 deletion(-)
drivers/input/joystick/iforce/iforce-packets.c +10 -1
@@ -161,6 +161,9 @@ void iforce_process_packet(struct iforceswitch (packet_id) {case 0x01 :/* joystick position data */ +if (len <7 ) +break ; +input_report_abs (dev,ABS_X , (__s16 )get_unaligned_le16 (data)); input_report_abs(dev, ABS_Y,
@@ -176,6 +179,9 @@ void iforce_process_packet(struct iforcebreak ;case 0x03 :/* wheel position data */ +if (len <7 ) +break ; +input_report_abs (dev,ABS_WHEEL , (__s16 )get_unaligned_le16 (data));input_report_abs (dev,ABS_GAS ,255 - data[2 ]);
@@ -187,6 +193,9 @@ void iforce_process_packet(struct iforcebreak ;case 0x02 :/* status report */ +if (len <2 ) +break ; +input_report_key (dev,BTN_DEAD , data[0 ] &0x02 );input_sync (dev);
@@ -206,7 +215,7 @@ void iforce_process_packet(struct iforce } } -for (j =3 ; j < len; j +=2 ) +for (j =3 ; j +sizeof (u16) <= len; j +=sizeof (u16))mark_core_as_ready (iforce,get_unaligned_le16 (data + j));break ;
drivers/input/joystick/iforce/iforce-usb.c +3 -0
@@ -159,6 +159,9 @@ static void iforce_usb_irq(struct urb *u goto exit; } +if (!urb->actual_length) + goto exit; +iforce_process_packet (iforce, iforce_usb->data_in[0 ], iforce_usb->data_in +1 , urb->actual_length -1 );
Greg Kroah-Hartman
maintainerPATCH 16/235 powerpc/pseries: lparcfg - fix kbuf[] underflow
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: George Wilson <[email protected]>
commit fb442a6673ff1046bf67754957d95880fdb394b5 upstream.
In lparcfg_write(), a count of 0 results in kbuf[] being indexed at -1. Check for count == 0 in the existing check for count > sizeof(kbuf) and return -EINVAL if true.
--- arch/powerpc/platforms/pseries/lparcfg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/platforms/pseries/lparcfg.c +1 -1
@@ -639,7 +639,7 @@ static ssize_t lparcfg_write(struct fileif (!firmware_has_feature (FW_FEATURE_SPLPAR ))return -EINVAL ; -if (count >sizeof (kbuf)) +if (count ==0 || count >sizeof (kbuf))return -EINVAL ;if (copy_from_user (kbuf, buf, count))
Greg Kroah-Hartman
maintainerPATCH 17/235 Input: synaptics-rmi4 - zero report size on F54 work error
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
commit dc76c3c8e8ad09362b8c1561f3928288c15cba2e upstream.
In rmi_f54_work(), if an error occurs during report request or command verification, the code jumped directly to the 'error' label, bypassing the 'abort' label where f54->report_size was normally zeroed out.
This left f54->report_size containing its previous successful payload size. If a user then altered the V4L2 format to a smaller size, and a subsequent run failed, rmi_f54_buffer_queue() would copy the stale, larger payload size into the shrunken V4L2 buffer, causing a heap buffer overflow.
Fix this by merging the 'abort' and 'error' labels into a single 'out' exit path, and ensuring that f54->report_size is always set to 0 on failure by checking for error and zeroing the local report_size first.
--- drivers/input/rmi4/rmi_f54.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/input/rmi4/rmi_f54.c +8 -8
@@ -541,7 +541,7 @@ static void rmi_f54_work(struct work_strdev_err (&fn->dev,"Bad report size, report type=%d\n" , f54->report_type); error = -EINVAL ; - goto error;/* retry won't help */ + goto out;/* retry won't help */ }/*
@@ -552,7 +552,7 @@ static void rmi_f54_work(struct work_str &command);if (error) {dev_err (&fn->dev,"Failed to read back command\n" ); - goto error; + goto out; }if (command &F54_GET_REPORT ) {if (time_after (jiffies, f54->timeout)) {
@@ -560,7 +560,7 @@ static void rmi_f54_work(struct work_str error = -ETIMEDOUT ; } report_size =0 ; - goto error; + goto out; }rmi_dbg (RMI_DEBUG_FN , &fn->dev,"Get report command completed, reading data\n" );
@@ -575,7 +575,7 @@ static void rmi_f54_work(struct work_str fifo, sizeof(fifo));if (error) {dev_err (&fn->dev,"Failed to set fifo start offset\n" ); - goto abort; + goto out; } error = rmi_read_block(fn->rmi_dev, fn->fd.data_base_addr +
@@ -584,16 +584,16 @@ static void rmi_f54_work(struct work_strif (error) {dev_err (&fn->dev,"%s: read [%d bytes] returned %d\n" , __func__, size, error); - goto abort; + goto out; } } -abort: - f54->report_size = error ?0 : report_size; -error: +out:if (error) report_size =0 ; + f54->report_size = report_size; +if (report_size ==0 && !error) {queue_delayed_work (f54->workqueue, &f54->work,msecs_to_jiffies (1 ));
Greg Kroah-Hartman
maintainerPATCH 18/235 Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <[email protected]>
commit 49c5adc2b7d6e43c5cf033e1c86fdb9c16ababb1 upstream.
rmi_f54_work() reads a diagnostics report from the device into f54->report_data, sizing the transfer with rmi_f54_get_report_size():
report_size = rmi_f54_get_report_size(f54);
...
for (i = 0; i < report_size; i += F54_REPORT_DATA_SIZE) {
int size = min(F54_REPORT_DATA_SIZE, report_size - i);
...
rmi_read_block(.., f54->report_data + i, size);
}report_data is allocated once at probe from F54's own electrode counts (array3_size(f54->num_tx_electrodes, f54->num_rx_electrodes, sizeof(u16))), but rmi_f54_get_report_size() computes the size from drv_data->num_*_electrodes when those are set, i.e. from the F55 function's electrode counts. Both counts come straight from device queries (F54 and F55 each report up to 255 electrodes) and nothing constrains the F55 counts to the F54 ones.
A malicious or malfunctioning RMI4 device that reports larger F55 electrode counts than its F54 counts makes report_size exceed the allocation, so the read loop writes past report_data (and the V4L2 dequeue memcpy() then reads past it). On conforming hardware the F55 configured electrodes are a subset of the F54 physical electrodes, so report_size never exceeds the buffer and well-behaved devices are unaffected.
Record the allocation size and reject a report that does not fit, mirroring the existing zero-size check.
--- drivers/input/rmi4/rmi_f54.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/input/rmi4/rmi_f54.c +10 -2
@@ -98,6 +98,7 @@ struct f54_data {enum rmi_f54_report_type report_type;u8 *report_data; +size_t max_report_size;int report_size;bool is_busy;
@@ -544,6 +545,13 @@ static void rmi_f54_work(struct work_str goto out;/* retry won't help */ } +if (report_size > f54->max_report_size) { +dev_err (&fn->dev,"Report size %d exceeds buffer size %zu\n" , + report_size, f54->max_report_size); + error = -EINVAL ; + goto out; + } +/* * Need to check if command has completed. * If not try again later.
@@ -674,8 +682,8 @@ static int rmi_f54_probe(struct rmi_func rx = f54->num_rx_electrodes; tx = f54->num_tx_electrodes; - f54->report_data =devm_kzalloc (&fn->dev, -array3_size (tx, rx,sizeof (u16)), + f54->max_report_size =array3_size (tx, rx,sizeof (u16)); + f54->report_data =devm_kzalloc (&fn->dev, f54->max_report_size,GFP_KERNEL );if (f54->report_data ==NULL )return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 19/235 Input: synaptics-rmi4 - block s_input when F54 queue is busy
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
commit fbfd76746adc16d64be29ff113f673b70bc3f5c2 upstream.
Changing the input (diagnostic report type) mid-stream changes the report size. Since V4L2 buffers are allocated based on the size at stream start, changing the input while streaming could lead to a heap buffer overflow if the new size is larger than the allocated buffers.
Prevent this by blocking VIDIOC_S_INPUT with -EBUSY if the V4L2 queue is busy (streaming).
--- drivers/input/rmi4/rmi_f54.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/input/rmi4/rmi_f54.c +6 -1
@@ -441,7 +441,12 @@ static int rmi_f54_set_input(struct f54_static int rmi_f54_vidioc_s_input (struct file *file,void *priv,unsigned int i) { -return rmi_f54_set_input (video_drvdata (file), i); +struct f54_data *f54 =video_drvdata (file); + +if (vb2_is_busy (&f54->queue)) +return -EBUSY ; + +return rmi_f54_set_input (f54, i); } static int rmi_f54_vidioc_g_input(struct file *file, void *priv,
Greg Kroah-Hartman
maintainerPATCH 20/235 Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
commit 8786d74bf50e6797b6f655eb381ef6b25451161f upstream.
Previously, rmi_f54_buffer_queue() waited for the worker thread to finish but ignored whether it succeeded. If the worker failed (e.g., due to a timeout or register read failure), the queue thread would silently return success, delivering stale or uninitialized memory to userspace.
Add a 'report_error' field to struct f54_data to store the worker's exit status. Check this field in rmi_f54_buffer_queue() after the worker finishes, and mark the buffer as VB2_BUF_STATE_ERROR if an error occurred.
--- drivers/input/rmi4/rmi_f54.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/input/rmi4/rmi_f54.c +8 -0
@@ -100,6 +100,7 @@ struct f54_data {u8 *report_data;size_t max_report_size;int report_size; +int report_error;bool is_busy;struct mutex status_mutex;
@@ -334,6 +335,12 @@ static void rmi_f54_buffer_queue(structmutex_lock (&f54->data_mutex); } +if (f54->report_error) { +dev_err (&f54->fn->dev,"Error acquiring report: %d\n" , f54->report_error); + state =VB2_BUF_STATE_ERROR ; + goto data_done; + } + ptr =vb2_plane_vaddr (vb,0 );if (!ptr) {dev_err (&f54->fn->dev,"Error acquiring frame ptr\n" );
@@ -606,6 +613,7 @@ out: report_size =0 ; f54->report_size = report_size; + f54->report_error = error;if (report_size ==0 && !error) { queue_delayed_work(f54->workqueue, &f54->work,
Greg Kroah-Hartman
maintainerPATCH 21/235 crypto: qce - fix error path in devm_qce_register_algs
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <[email protected]>
commit 9c75402286409f5e1a75e4a445555c84066f89db upstream.
If ops->register_algs() fails, the error path repeatedly calls the same ops->unregister_algs() from the failed registration. Use the loop index to unregister the previously registered algorithms instead.
--- drivers/crypto/qce/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/qce/core.c +1 -1
@@ -52,7 +52,7 @@ static int qce_register_algs(struct qce_ ret = ops->register_algs (qce);if (ret) {for (j = i -1 ; j >=0 ; j--) - ops->unregister_algs (qce); + qce_ops[j]->unregister_algs (qce);return ret; } }
Greg Kroah-Hartman
maintainerPATCH 22/235 libceph: fix multiple unsafe decodes in decode_locker()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavitra Jha <[email protected]>
commit 437b6551cfcc235eea1d735a874f9d421f555e17 upstream.
decode_locker() in cls_lock_client.c contains three unsafe decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads:
1. ceph_decode_copy() at the locker_id_t name field has no preceding bounds check. With p == end after ceph_start_decoding() accepts struct_len=0, this reads sizeof(ceph_entity_name) = 9 bytes past the validated buffer boundary.
2. *p += sizeof(struct ceph_timespec) after the locker_info_t header is an unchecked pointer advance. A malicious OSD can position p past end, causing all subsequent _safe checks to pass against a bogus boundary.
3. len = ceph_decode_32(p) has no preceding bounds check, and the immediately following *p += len is uncapped. A malicious OSD can send len=0xffffffff, advancing p gigabytes past end and escaping the decode window entirely.
Fix all three by replacing bare operations with their safe variants:
ceph_decode_copy -> ceph_decode_copy_safe *p += sizeof(...) -> ceph_decode_skip_n ceph_decode_32(p) -> ceph_decode_32_safe *p += len -> ceph_decode_skip_n
A new label is added to return -EINVAL on any bounds violation. -EINVAL is appropriate here: the data received from the OSD is structurally malformed, which is an invalid argument to the decode contract regardless of whether the caller or the wire is at fault.
Attacker model: a malicious or compromised OSD in a multi-tenant Ceph deployment can trigger this against any kernel client that issues the lock.get_info class method (e.g. during RBD exclusive lock acquisition) without any further privileges beyond OSD session establishment.
[ idryomov: use ceph_decode_skip_string() to skip description, trim
changelog ]
--- net/ceph/cls_lock_client.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
net/ceph/cls_lock_client.c +9 -4
@@ -253,7 +253,8 @@ static int decode_locker(void **p, voidif (ret)return ret; -ceph_decode_copy (p, &locker->id.name,sizeof (locker->id.name)); +ceph_decode_copy_safe (p, end, &locker->id.name, +sizeof (locker->id.name), bad); s =ceph_extract_encoded_string (p, end,NULL ,GFP_NOIO );if (IS_ERR (s))return PTR_ERR (s);
@@ -264,19 +265,23 @@ static int decode_locker(void **p, voidif (ret)return ret; - *p +=sizeof (struct ceph_timespec );/* skip expiration */ +/* skip expiration */ +ceph_decode_skip_n (p, end,sizeof (struct ceph_timespec ), bad); ret =ceph_decode_entity_addr (p, end, &locker->info.addr);if (ret)return ret; - len =ceph_decode_32 (p); - *p += len;/* skip description */ +/* skip description */ +ceph_decode_skip_string (p, end, bad);dout ("%s %s%llu cookie %s addr %s\n" , __func__,ENTITY_NAME (locker->id.name), locker->id.cookie,ceph_pr_addr (&locker->info.addr));return 0 ; + +bad: +return -EINVAL ; } static int decode_lockers(void **p, void *end, u8 *type, char **tag,
Greg Kroah-Hartman
maintainerPATCH 23/235 ftrace: Fix off-by-one fentry site disable in ftrace_free_mem()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <[email protected]>
commit 8b8292d6487c81bd57c2605a9b404b1cf8f1edfb upstream.
When a module's init text is freed, do_init_module() calls ftrace_free_mem() with a half-open [start, end) range. However the ftrace_cmp_recs() comparator treats the upper bound as inclusive, as all its other users do, passing 'ip + size - 1'. So ftrace_free_mem() can delete a record sitting exactly at 'end', which is outside the freed range.
For a kernel without CFI or IBT, the first record of a function is at the function start, which for the first function in a module is also the base of its text allocation. As the module allocator packs its regions, that address is often the 'end' passed by a neighboring module's do_init_module(), causing the first function's ftrace location to get disabled, preventing an attempt to livepatch it:
livepatch: failed to find location for function 'pcspkr_probe'
Convert the exclusive end to the inclusive 'end - 1' the comparator expects, and return early for an empty range to avoid the subtraction from underflowing when the init text size is zero.
--- kernel/trace/ftrace.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
kernel/trace/ftrace.c +5 -1
@@ -6844,7 +6844,8 @@ static void add_to_clear_hash_list(strucvoid ftrace_free_mem (struct module *mod,void *start_ptr,void *end_ptr) {unsigned long start = (unsigned long )(start_ptr); -unsigned long end = (unsigned long )(end_ptr); +/* end is inclusive and end_ptr is exclusive */ +unsigned long end = (unsigned long )(end_ptr) -1 ;struct ftrace_page **last_pg = &ftrace_pages_start;struct ftrace_page *tmp_page =NULL ;struct ftrace_page *pg;
@@ -6856,6 +6857,9 @@ void ftrace_free_mem(struct module *mod,INIT_LIST_HEAD (&clear_hash); +if (start_ptr >= end_ptr) +return ; + key.ip = start; key.flags = end;/* overload flags, as it is unsigned long */
Greg Kroah-Hartman
maintainerPATCH 24/235 openrisc: signal: do not restore privileged SR bits on sigreturn
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ali Ahmet Memis <[email protected]>
commit 32ef1b30ad736519f7a207bcc2986f3d4129d972 upstream.
restore_sigcontext() copies the whole supervision register (SR) from the signal frame and only clears SPR_SR_SM before the value is reloaded into the hardware SR (through ESR and l.rfe) on the return to user space. All other SR bits are left under user control.
An unprivileged task can thus return from a signal handler through a crafted sigframe that clears SPR_SR_DME. With the data MMU disabled the CPU performs no translation or protection on data accesses, so the task gains read and write access to arbitrary physical memory, a local privilege escalation. SPR_SR_IME, SPR_SR_SUMRA, SPR_SR_LEE, SPR_SR_EPH and the cache-enable bits are exposed the same way. The ptrace GPR regset already refuses any change to SR for exactly this reason.
Restore only the arithmetic flag bits (F, CY, OV) from the signal frame and take every privileged control bit from the SR the kernel saved on signal entry.
Verified with qemu-system-or1k -M or1k-sim: before this change an unprivileged PoC clears SPR_SR_DME in rt_sigreturn and writes a marker to physical address 0x03000000 (beyond the kernel's mem=32M); afterwards the same PoC receives SIGSEGV and physical memory is unchanged.
--- arch/openrisc/include/asm/processor.h | 2 ++ arch/openrisc/kernel/signal.c | 5 +++-- 2 files changed, 5 insertions(+), 2 deletions(-)
arch/openrisc/include/asm/processor.h +2 -0
@@ -26,6 +26,8 @@ | SPR_SR_DCE | SPR_SR_SM)#define USER_SR (SPR_SR_DME | SPR_SR_IME | SPR_SR_ICE \ | SPR_SR_DCE | SPR_SR_IEE | SPR_SR_TEE) +/* SR bits user space may change via sigreturn, the rest stay kernel owned */ +#define SPR_SR_USER_MASK (SPR_SR_F | SPR_SR_CY | SPR_SR_OV)/* * User space process size. This is hardcoded into a few places,
arch/openrisc/kernel/signal.c +3 -2
@@ -39,6 +39,7 @@ struct rt_sigframe {static int restore_sigcontext (struct pt_regs *regs,struct sigcontext __user *sc) { +unsigned long old_sr = regs->sr;int err =0 ;/* Always make any pending restarted system calls return -EINTR */
@@ -53,8 +54,8 @@ static int restore_sigcontext(struct pt_ err |=__copy_from_user (®s->pc, &sc->regs.pc,sizeof (unsigned long )); err |=__copy_from_user (®s->sr, &sc->regs.sr,sizeof (unsigned long )); -/* make sure the SM-bit is cleared so user-mode cannot fool us */ - regs->sr &= ~SPR_SR_SM ; +/* keep the privileged SR bits kernel owned, restore only user flags */ + regs->sr = (old_sr & ~SPR_SR_USER_MASK ) | (regs->sr &SPR_SR_USER_MASK ); regs->orig_gpr11 =-1 ;/* Avoid syscall restart checks */
Greg Kroah-Hartman
maintainerPATCH 25/235 Input: sur40 - fix input device registration ordering
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
commit 9da976eb649c9e2f588a4499410e4d8af687925f upstream.
In sur40_probe(), input_register_device() was previously called early before the V4L2 video device and vb2_queue components were fully initialized. If userspace opened the input device immediately upon registration, sur40_open() would trigger and start the sur40_poll() worker thread. This worker thread invokes sur40_process_video() and accesses the uninitialized vb2_queue structure, leading to a data race and potential system crash.
Furthermore, if V4L2 or video registration failed after input_register_device() succeeded, the error path fell through to calling input_free_device() on a successfully registered device instead of input_unregister_device(), corrupting input core state.
Move input_register_device() to the very end of sur40_probe(). This ensures the V4L2 and video queue structures are fully initialized before polling can start, and naturally resolves the error path bug since input_free_device() is now only called when input registration has not yet occurred.
To maintain strict LIFO (Last-In, First-Out) teardown ordering, also move input_unregister_device() to the very beginning of sur40_disconnect(). This guarantees that the input polling worker thread is stopped before V4L2 video components or control handlers are unregistered.
--- drivers/input/touchscreen/sur40.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-)
drivers/input/touchscreen/sur40.c +11 -10
@@ -725,21 +725,13 @@ static int sur40_probe(struct usb_interf goto err_free_input; } -/* register the polled input device */ - error =input_register_device (input); -if (error) { -dev_err (&interface->dev, -"Unable to register polled input device." ); - goto err_free_buffer; - } -/* register the video master device */ snprintf (sur40->v4l2.name,sizeof (sur40->v4l2.name),"%s" ,DRIVER_LONG ); error =v4l2_device_register (sur40->dev, &sur40->v4l2);if (error) {dev_err (&interface->dev,"Unable to register video master device." ); - goto err_unreg_v4l2; + goto err_free_buffer; }/* initialize the lock and subdevice */
@@ -798,6 +790,14 @@ static int sur40_probe(struct usb_interf goto err_unreg_video; } +/* register the polled input device */ + error =input_register_device (input); +if (error) { +dev_err (&interface->dev, +"Unable to register polled input device." ); + goto err_unreg_video; + } +/* we can register the device now, as it is ready */ usb_set_intfdata (interface, sur40);dev_dbg (&interface->dev,"%s is now attached\n" ,DRIVER_DESC );
@@ -823,11 +823,12 @@ static void sur40_disconnect(struct usb_ {struct sur40_state *sur40 =usb_get_intfdata (interface); +input_unregister_device (sur40->input); +v4l2_ctrl_handler_free (&sur40->hdl);video_unregister_device (&sur40->vdev);v4l2_device_unregister (&sur40->v4l2); -input_unregister_device (sur40->input);kfree (sur40->bulk_in_buffer);kfree (sur40);
Greg Kroah-Hartman
maintainerPATCH 26/235 Input: sur40 - fix V4L error path cleanup
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
commit 062dc4693e2c10d77de06f61e6f3faf37c0a8383 upstream.
In sur40_probe(), if video_register_device() fails, the error path jumps to err_unreg_video. This incorrectly attempts to unregister a video device that was never successfully registered, and fails to free the V4L2 control handler (v4l2_ctrl_handler_free) that was initialized immediately prior.
Fix this by introducing an err_free_ctrl label to properly free the V4L2 control handler and bypass video_unregister_device() when video device registration fails.
--- drivers/input/touchscreen/sur40.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/input/touchscreen/sur40.c +3 -1
@@ -787,7 +787,7 @@ static int sur40_probe(struct usb_interfif (error) {dev_err (&interface->dev,"Unable to register video subdevice." ); - goto err_unreg_video; + goto err_free_ctrl; }/* register the polled input device */
@@ -806,6 +806,8 @@ static int sur40_probe(struct usb_interf err_unreg_video:video_unregister_device (&sur40->vdev); +err_free_ctrl: +v4l2_ctrl_handler_free (&sur40->hdl); err_unreg_v4l2:v4l2_device_unregister (&sur40->v4l2); err_free_buffer:
Greg Kroah-Hartman
maintainerPATCH 27/235 libceph: Avoid using invalid osd indices from primary_temp
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raphael Zimmer <[email protected]>
commit 3660b98d1204b419f6a77e9a295f148dcf38d042 upstream.
A corrupted osdmap received from a Ceph monitor or OSD may contain osd indices in its pg_temp, primary_temp, pg_upmap, and pg_upmap_items parts that don't exist, i.e., that are greater than max_osd or smaller than CEPH_HOMELESS_OSD (-1). These indices are used to create the up and acting set in ceph_pg_to_up_acting_osds(), called from calc_target(). While most of these osd indices are checked, the one from primary_temp is not. Subsequently, this may lead to calc_target() returning this (potentially invalid) index as target osd for a (linger) request. Because the osd_state, osd_weight, and osd_addr arrays only contain max_osd entries (with indices 0 to max_osd -1), this leads to out-of-bounds accesses when trying to read values from these arrays.
This patch fixes the issue by adding a check to get_temp_osds(), so that only valid osd indices from primary_temp are used, and it falls back to using the primary from pg_temp or the up set if it is invalid.
[ idryomov: changelog ]
--- net/ceph/osdmap.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/ceph/osdmap.c +3 -2
@@ -2772,9 +2772,10 @@ static void get_temp_osds(struct ceph_os } } -/* primary_temp? */ +/* primary_temp? (shouldn't ever be a nonexistent or down OSD) */ pg =lookup_pg_mapping (&osdmap->primary_temp, pgid); -if (pg) +if (pg && !WARN_ON_ONCE (ceph_osd_is_down (osdmap, + pg->primary_temp.osd))) temp->primary = pg->primary_temp.osd; }
Greg Kroah-Hartman
maintainerPATCH 28/235 ceph: fix MDS random selection readiness predicate
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yiming Zhu <[email protected]>
commit 2c11c4bfdb7bd2808b3b3ac228e1f2d9bcf25457 upstream.
CEPH_MDS_IS_READY() is parsed so that the ternary expression can return true for an MDS entry with state 0 when it is not laggy. This allows the random selector to choose a down/DNE rank.
Group the ternary expression under the state check so zero-state ranks are not treated as ready.
--- fs/ceph/mdsmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ceph/mdsmap.c +1 -1
@@ -14,7 +14,7 @@#include "super.h" #define CEPH_MDS_IS_READY (i, ignore_laggy) \ - (m->m_info[i].state > 0 && ignore_laggy ? true : !m->m_info[i].laggy) + (m->m_info[i].state > 0 && (ignore_laggy ? true : !m->m_info[i].laggy))static int __mdsmap_get_random_mds (struct ceph_mdsmap *m,bool ignore_laggy) {
Greg Kroah-Hartman
maintainerPATCH 29/235 mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhan Xusheng <[email protected]>
commit f64ea900e4bda3055ef24a2c906f8d049cf1c3bd upstream.
omap_hsmmc_prepare_data() converts the command busy timeout to nanoseconds with:
timeout = req->cmd->busy_timeout * NSEC_PER_MSEC;
busy_timeout is an unsigned int (milliseconds) and timeout is a u64, but NSEC_PER_MSEC is 1000000L. On 32-bit builds the multiplication is performed in 32-bit arithmetic and wraps for busy_timeout values above ~4294 ms, before the result is assigned to the u64.
The driver does not set mmc->max_busy_timeout, so the core does not cap the busy timeout, and commands such as erase or SANITIZE (MMC_SANITIZE_TIMEOUT_MS is 240000 ms) can pass a busy_timeout far larger than 4294 ms. The wrapped, much smaller ns value is then programmed via set_data_timeout(), so the data timeout is set too short and the operation can time out prematurely.
Cast busy_timeout to u64 before the multiplication so the conversion is done in 64-bit arithmetic.
--- drivers/mmc/host/omap_hsmmc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mmc/host/omap_hsmmc.c +1 -1
@@ -1363,7 +1363,7 @@ omap_hsmmc_prepare_data(struct omap_hsmmif (req->data ==NULL ) {OMAP_HSMMC_WRITE (host->base,BLK ,0 );if (req->cmd->flags &MMC_RSP_BUSY ) { - timeout = req->cmd->busy_timeout *NSEC_PER_MSEC ; + timeout = (u64 )req->cmd->busy_timeout *NSEC_PER_MSEC ;/* * Set an arbitrary 100ms data timeout for commands with
Greg Kroah-Hartman
maintainerPATCH 30/235 mmc: sdhci: unmap the bounce buffer before device release
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <[email protected]>
commit 9e9f561269dff35e6f84ed21776ec37fd6360b03 upstream.
sdhci_allocate_bounce_buffer() allocates its buffer with devm_kmalloc() but maps it with dma_map_single(). The buffer is therefore released by devres without the streaming DMA mapping being unmapped.
Register a managed action after dma_map_single() succeeds so the mapping is removed before devres releases the buffer. The action is registered only for buffers allocated and mapped by the SDHCI core, leaving buffers provided by host drivers under their existing ownership.
--- drivers/mmc/host/sdhci.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
drivers/mmc/host/sdhci.c +16 -0
@@ -4103,6 +4103,14 @@ void __sdhci_read_caps(struct sdhci_host }EXPORT_SYMBOL_GPL (__sdhci_read_caps); +static void sdhci_unmap_bounce_buffer (void *data) +{ +struct sdhci_host *host = data; + +dma_unmap_single (mmc_dev (host->mmc), host->bounce_addr, + host->bounce_buffer_size,DMA_BIDIRECTIONAL ); +} +static void sdhci_allocate_bounce_buffer (struct sdhci_host *host) {struct mmc_host *mmc = host->mmc;
@@ -4153,6 +4161,14 @@ static void sdhci_allocate_bounce_buffer/* Again fall back to max_segs == 1 */ return ; host->bounce_buffer_size = bounce_size; + ret =devm_add_action_or_reset (mmc_dev (mmc), + sdhci_unmap_bounce_buffer, host); +if (ret) { +devm_kfree (mmc_dev (mmc), host->bounce_buffer); + host->bounce_buffer =NULL ; + host->bounce_buffer_size =0 ; +return ; + }/* Lie about this since we're bouncing */ mmc->max_segs = max_blocks;
Greg Kroah-Hartman
maintainerPATCH 31/235 mmc: sdhci: make tuning_err a signed int
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haibo Chen <[email protected]>
commit ae31bcc92bb42502bb7c9029e6dc7a824cf6cd14 upstream.
Coverity report INTEGER_OVERFLOW for host->tuning_err.
The tuning_err field in struct sdhci_host is used to store an error code for re-tuning, but it was declared as unsigned int. Several call sites store negative error codes into it and later compare against negative values:
- sdhci.c, sdhci-of-dwcmshc.c and sdhci-pci-gli.c assign it the
return value of __sdhci_execute_tuning()/__sdhci_execute_tuning_9750(),
both of which return a signed int (possibly a negative errno);
- sdhci-of-esdhc.c assigns host->tuning_err = -EAGAIN and later does
"ret = host->tuning_err; if (ret == -EAGAIN ...)"; - sdhci-of-dwcmshc.c prints it with the %d (signed) conversion.
Storing a negative errno in an unsigned int and reading it back as a signed int only happens to work because of two's-complement, same-width integer conversions. It is misleading and triggers sign-conversion warnings. All users treat the value either as a signed error code or as a boolean (zero / non-zero), so changing the type to a signed int is safe and makes the intent explicit.
--- drivers/mmc/host/sdhci.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mmc/host/sdhci.h +1 -1
@@ -594,7 +594,7 @@ struct sdhci_host {unsigned int tuning_count;/* Timer count for re-tuning */ unsigned int tuning_mode;/* Re-tuning mode supported by host */ -unsigned int tuning_err;/* Error code for re-tuning */ +int tuning_err;/* Error code for re-tuning */ #define SDHCI_TUNING_MODE_1 0#define SDHCI_TUNING_MODE_2 1#define SDHCI_TUNING_MODE_3 2
Greg Kroah-Hartman
maintainerPATCH 32/235 mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pei Xiao <[email protected]>
commit c125ee35a49a0518521b52b27631eef061b8719a upstream.
In atmci_probe, &host->bh_work is bound with atmci_work_func, and atmci_interrupt, atmci_timeout_timer and atmci_dma_complete can all queue this work on system_bh_wq.
If we remove the module, atmci_remove makes cleanup and the memory allocated for host with devm_kzalloc() is released after the remove callback returns, while the work mentioned above may still be pending or running. The sequence of operations that may lead to a UAF bug is as follows:
CPU0 CPU1
| atmci_interrupt
| queue_work(system_bh_wq,
| &host->bh_work)
atmci_remove |
atmci_cleanup_slot(...) |
atmci_writel(host, ATMCI_IDR, ~0UL) |
timer_delete_sync(&host->timer) |
dma_release_channel(host->dma.chan) |
free_irq(platform_get_irq(pdev, 0), host) |
| atmci_work_func
| // use host
// devm resources released after |
// remove returns, host is freed |
| // use host (use-after-free)Fix it by canceling the work after all the sources that can schedule it (IRQ handler, timeout timer and DMA completion callback) have been stopped, and before proceeding with the remaining cleanup in atmci_remove.
--- drivers/mmc/host/atmel-mci.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/mmc/host/atmel-mci.c +2 -0
@@ -2629,6 +2629,8 @@ static int atmci_remove(struct platform_free_irq (platform_get_irq (pdev,0 ), host); +cancel_work_sync (&host->bh_work); +clk_disable_unprepare (host->mck);pm_runtime_disable (&pdev->dev);
Greg Kroah-Hartman
maintainerPATCH 33/235 drm/radeon: fix autosuspend cleanup during teardown
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <[email protected]>
commit 587be7a17358ef8c0106775fcedae5a7bef50735 upstream.
radeon_driver_load_kms() calls pm_runtime_use_autosuspend() for PX devices, but radeon_driver_unload_kms() does not call the matching pm_runtime_dont_use_autosuspend() during teardown.
If the autosuspend delay is set to a negative value while autosuspend is enabled, the runtime PM core increments usage_count to prevent runtime suspend. Without calling pm_runtime_dont_use_autosuspend() during teardown, this reference is not dropped.
The documentation for pm_runtime_use_autosuspend() also notes that it is important to undo it with pm_runtime_dont_use_autosuspend() at driver exit time, unless runtime PM was initially enabled with devm_pm_runtime_enable().
Add the missing pm_runtime_dont_use_autosuspend() call to the driver unload path.
This issue was found by manual code inspection.
--- drivers/gpu/drm/radeon/radeon_kms.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/radeon/radeon_kms.c +1 -0
@@ -71,6 +71,7 @@ void radeon_driver_unload_kms(struct drmif (radeon_is_px (dev)) {pm_runtime_get_sync (dev->dev);pm_runtime_forbid (dev->dev); +pm_runtime_dont_use_autosuspend (dev->dev); }radeon_acpi_fini (rdev);
Greg Kroah-Hartman
maintainerPATCH 34/235 s390/vfio_ccw: Fix out of bounds check on CCW array
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Farman <[email protected]>
commit a005b7f1a491ffda61bff0fd0f6548f8986fb977 upstream.
The routine ccwchain_calc_length() counts the number of channel command words (CCWs) that are chained together in a single channel program, and rejects anything larger than CCWCHAIN_LEN_MAX (256) CCWs.
The loop itself is "do..while (count < 257)", and while the logic in is_cpa_within_range() correctly adjusts between the 0-index array of CCWs and the count of CCWs starting at 1, this means it would look at a possible 257th CCW before ending the loop and (correctly) returning an error.
Fix this by restructuring the loop to break as soon as 256 CCWs (thus indexes 0-255) are examined, without looking at memory outside the range.
--- drivers/s390/cio/vfio_ccw_cp.c | 17 +++++------------ 1 file changed, 5 insertions(+), 12 deletions(-)
drivers/s390/cio/vfio_ccw_cp.c +5 -12
@@ -371,11 +371,9 @@ static void ccwchain_cda_free(struct ccwstatic int ccwchain_calc_length (u64 iova,struct channel_program *cp) {struct ccw1 *ccw = cp->guest_cp; -int cnt =0 ; - - do { - cnt++; +int cnt; +for (cnt =1 ; cnt <=CCWCHAIN_LEN_MAX ; cnt++, ccw++) {/* * As we don't want to fail direct addressing even if the * orb specified one of the unsupported formats, we defer
@@ -393,15 +391,10 @@ static int ccwchain_calc_length(u64 iova* after the TIC, depending on the results of its operation. */ if (!ccw_is_chain (ccw) && !is_tic_within_range (ccw, iova, cnt)) -break ; - - ccw++; - }while (cnt <CCWCHAIN_LEN_MAX +1 ); - -if (cnt ==CCWCHAIN_LEN_MAX +1 ) - cnt = -EINVAL ; +return cnt; + } -return cnt; +return -EINVAL ; }static int tic_target_chain_exists (struct ccw1 *tic,struct channel_program *cp)
Greg Kroah-Hartman
maintainerPATCH 35/235 drm/amdgpu: Reject UVD message with invalid number of h265 refs
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Rosca <[email protected]>
commit 9fca434208f1f9ab977feac62df8ebb1cc7ce893 upstream.
Same change as for h264, avoids overflow later when calculating min dpb size.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c +3 -0
@@ -715,6 +715,9 @@ static int amdgpu_uvd_cs_msg_decode(stru image_size =ALIGN (image_size,256 ); num_dpb_buffer = (le32_to_cpu (msg[59 ]) &0xff ) +2 ; +if (num_dpb_buffer >17 ) +return -EINVAL ; + min_dpb_size = image_size * num_dpb_buffer; min_ctx_size = ((width +255 ) /16 ) * ((height +255 ) /16 ) *16 * num_dpb_buffer +52 *1024 ;
Greg Kroah-Hartman
maintainerPATCH 36/235 drm/amdgpu: validate GEM_CREATE domain combinations
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Candice Li <[email protected]>
commit 5e9d136ad74df4edec67e502ce267597064d8f86 upstream.
AMDGPU_GEM_CREATE checked domain bits against AMDGPU_GEM_DOMAIN_MASK, but did not validate domain combinations. Userspace could combine CPU|GTT|VRAM with DOORBELL, GDS, GWS, or OA, making amdgpu_bo_placement_from_domain() exceed AMDGPU_BO_MAX_PLACEMENTS and hit BUG_ON().
Allow combinations only within CPU/GTT/VRAM, and require non-CPU/GTT/ VRAM domains to be specified one at a time. Return -EINVAL for invalid combinations in amdgpu_gem_create_ioctl().
v2: Rename helper from amdgpu_gem_domain_valid() to
amdgpu_gem_are_domains_valid() (Christian)
--- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c +21 -0
@@ -197,6 +197,25 @@ out_unlock:ttm_eu_backoff_reservation (&ticket, &list); } +static bool amdgpu_gem_are_domains_valid (u32 domains) +{ +u32 normal =AMDGPU_GEM_DOMAIN_CPU | +AMDGPU_GEM_DOMAIN_GTT | +AMDGPU_GEM_DOMAIN_VRAM ; +/* Treat all non CPU/GTT/VRAM domains as special domains. */ +u32 special =AMDGPU_GEM_DOMAIN_MASK & ~normal; +u32 normal_mask = domains & normal; +u32 special_mask = domains & special; + +if (!special_mask) +return true; + +if (normal_mask) +return false; + +return !(special_mask & (special_mask -1 )); +} +/* * GEM ioctls. */
@@ -228,6 +247,8 @@ int amdgpu_gem_create_ioctl(struct drm_d/* reject invalid gem domains */ if (args->in.domains & ~AMDGPU_GEM_DOMAIN_MASK )return -EINVAL ; +if (!amdgpu_gem_are_domains_valid (args->in.domains)) +return -EINVAL ;if (!amdgpu_is_tmz (adev) && (flags &AMDGPU_GEM_CREATE_ENCRYPTED )) {DRM_NOTE_ONCE ("Cannot allocate secure buffer since TMZ is disabled\n" );
Greg Kroah-Hartman
maintainerPATCH 37/235 drm/amdgpu: Reject UVD message with dimensions above 4096
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Rosca <[email protected]>
commit 8c9aebcdd9f46f7a14b98d6ab18574b7a48fbb08 upstream.
Fixes potential overflow in DPB size calculations.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c +2 -2
@@ -567,8 +567,8 @@ static int amdgpu_uvd_cs_msg_decode(struunsigned image_size, tmp, min_dpb_size, num_dpb_buffer;unsigned min_ctx_size = ~0 ; -/* Reject invalid dimensions to prevent division by zero */ -if (width <16 || height <16 ) { +/* Reject invalid dimensions */ +if (width <16 || height <16 || width >4096 || height >4096 ) {dev_WARN_ONCE (adev->dev,1 ,"Invalid UVD decoding dimensions (%dx%d)!\n" , width, height);
Greg Kroah-Hartman
maintainerPATCH 38/235 drm/amdgpu: Implement insert_end for VCE 3
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Rosca <[email protected]>
commit d5ab4c6a64efef2d143a96df5357f59703cd703d upstream.
After a recent change VCE now hangs when VCE_CMD_END is emitted after a pipeline sync without VM flush.
Implement insert_end to correctly insert only one VCE_CMD_END per job.
--- drivers/gpu/drm/amd/amdgpu/vce_v3_0.c | 26 ++++++++++++++++++++++---- 1 file changed, 22 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/amdgpu/vce_v3_0.c +22 -4
@@ -846,6 +846,23 @@ static void vce_v3_0_ring_emit_ib(structamdgpu_ring_write (ring, ib->length_dw); } +static void vce_v3_0_ring_emit_fence (struct amdgpu_ring *ring,u64 addr, +u64 seq,unsigned flags) +{ +WARN_ON (flags &AMDGPU_FENCE_FLAG_64BIT ); + +amdgpu_ring_write (ring,VCE_CMD_FENCE ); +amdgpu_ring_write (ring, addr); +amdgpu_ring_write (ring,upper_32_bits (addr)); +amdgpu_ring_write (ring, seq); +amdgpu_ring_write (ring,VCE_CMD_TRAP ); +} + +static void vce_v3_0_ring_insert_end (struct amdgpu_ring *ring) +{ +amdgpu_ring_write (ring,VCE_CMD_END ); +} +static void vce_v3_0_emit_vm_flush (struct amdgpu_ring *ring,unsigned int vmid,uint64_t pd_addr) {
@@ -855,7 +872,6 @@ static void vce_v3_0_emit_vm_flush(strucamdgpu_ring_write (ring,VCE_CMD_FLUSH_TLB );amdgpu_ring_write (ring, vmid); -amdgpu_ring_write (ring,VCE_CMD_END ); }static void vce_v3_0_emit_pipeline_sync (struct amdgpu_ring *ring)
@@ -925,17 +941,19 @@ static const struct amdgpu_ring_funcs vc .set_wptr = vce_v3_0_ring_set_wptr, .parse_cs = amdgpu_vce_ring_parse_cs_vm, .emit_frame_size = -6 +/* vce_v3_0_emit_vm_flush */ +5 +/* vce_v3_0_emit_vm_flush */ 4 +/* vce_v3_0_emit_pipeline_sync */ - 6 + 6, /* amdgpu_vce_ring_emit_fence x2 vm fence */ +5 +5 +/* vce_v3_0_ring_emit_fence x2 vm fence */ + 1, /* vce_v3_0_ring_insert_end */ .emit_ib_size = 5, /* vce_v3_0_ring_emit_ib */ .emit_ib = vce_v3_0_ring_emit_ib, .emit_vm_flush = vce_v3_0_emit_vm_flush, .emit_pipeline_sync = vce_v3_0_emit_pipeline_sync, - .emit_fence = amdgpu_vce_ring_emit_fence, + .emit_fence = vce_v3_0_ring_emit_fence, .test_ring = amdgpu_vce_ring_test_ring, .test_ib = amdgpu_vce_ring_test_ib, .insert_nop = amdgpu_ring_insert_nop, + .insert_end = vce_v3_0_ring_insert_end, .pad_ib = amdgpu_ring_generic_pad_ib, .begin_use = amdgpu_vce_ring_begin_use, .end_use = amdgpu_vce_ring_end_use,
Greg Kroah-Hartman
maintainerPATCH 39/235 drm/amdgpu: Fix UVD decode image min size calculation
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Rosca <[email protected]>
commit b8bb9ba3f101a1b0011f785a577a4a0a38371174 upstream.
This needs to use pitch instead of width. Also reject pitch over 4096 to avoid overflow.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c +2 -2
@@ -728,7 +728,7 @@ static int amdgpu_uvd_cs_msg_decode(strureturn -EINVAL ; } -if (width > pitch) { +if (width > pitch || pitch >4096 ) {DRM_ERROR ("Invalid UVD decoding target pitch!\n" );return -EINVAL ; }
@@ -740,7 +740,7 @@ static int amdgpu_uvd_cs_msg_decode(stru } buf_sizes[0x1 ] = dpb_size; - buf_sizes[0x2 ] = image_size; + buf_sizes[0x2 ] = (pitch * height) *3 /2 ; buf_sizes[0x4 ] = min_ctx_size;/* store image width to adjust nb memory pstate */ adev->uvd.decode_image_width = width;
Greg Kroah-Hartman
maintainerPATCH 40/235 xfs: check v5 superblock features early
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
commit eb6b2cc1fc8ad566d746d128a559989ff0bba5cc upstream.
When working on a new features that reuses the existing pad in the superblock, I noticed that mounting such a file system on an old kernel logs a rather confusing warning:
XFS (vdc): Metadir superblock padding fields must be zero.
This is because we only validate the various feature fields in v5 superblocks after the common superblock validation helper is called.
Fix this by calling the feature validation first.
--- fs/xfs/libxfs/xfs_sb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/xfs/libxfs/xfs_sb.c +2 -2
@@ -804,10 +804,10 @@ xfs_sb_read_verify(* because _verify_common checks the on-disk values. */ __xfs_sb_from_disk (&sb, dsb, false); - error =xfs_validate_sb_common (mp, bp, &sb); + error =xfs_validate_sb_read (mp, &sb);if (error) goto out_error; - error =xfs_validate_sb_read (mp, &sb); + error =xfs_validate_sb_common (mp, bp, &sb); out_error:if (error == -EFSCORRUPTED || error == -EFSBADCRC )
Greg Kroah-Hartman
maintainerPATCH 41/235 net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <[email protected]>
commit 277740023def559a4a2ddc3e8e784ee37a0f16a9 upstream.
On the SMC-D client, slot 0 of ini->ism_dev[]/ini->ism_chid[] is reserved for an SMC-Dv1 device. smc_find_ism_v2_device_clnt() populates V2 entries starting at index 1, so when no V1 device is selected slot 0 is left in its kzalloc()'ed state with ism_dev[0] == NULL and ism_chid[0] == 0.
smc_v2_determine_accepted_chid() then matches the peer's CHID against the array starting from index 0 using the CHID alone. A malicious peer replying to a SMC-Dv2-only proposal with d1.chid == 0 matches the empty slot, ini->ism_selected becomes 0, and the subsequent ism_dev[0]->lgr_lock dereference in smc_conn_create() faults at offsetof(struct smcd_dev, lgr_lock) == 0x68:
BUG: KASAN: null-ptr-deref in _raw_spin_lock_bh+0x79/0xe0 Write of size 4 at addr 0000000000000068 by task exploit/144 Call Trace: _raw_spin_lock_bh smc_conn_create (net/smc/smc_core.c:1997) __smc_connect (net/smc/af_smc.c:1447) smc_connect (net/smc/af_smc.c:1720) __sys_connect __x64_sys_connect do_syscall_64
Require ism_dev[i] to be non-NULL before accepting a CHID match.
--- net/smc/af_smc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/smc/af_smc.c +2 -1
@@ -863,7 +863,8 @@ smc_v2_determine_accepted_chid(struct smint i;for (i =0 ; i < ini->ism_offered_cnt +1 ; i++) { -if (ini->ism_chid[i] ==ntohs (aclc->chid)) { +if (ini->ism_dev[i] && + ini->ism_chid[i] ==ntohs (aclc->chid)) { ini->ism_selected = i;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 42/235 f2fs: fix UAF issue in f2fs_merge_page_bio()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
commit edf7e9040fc52c922db947f9c6c36f07377c52ea upstream.
As JY reported in bugzilla [1],
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 pc : [0xffffffe51d249484] f2fs_is_cp_guaranteed+0x70/0x98 lr : [0xffffffe51d24adbc] f2fs_merge_page_bio+0x520/0x6d4 CPU: 3 UID: 0 PID: 6790 Comm: kworker/u16:3 Tainted: P B W OE 6.12.30-android16-5-maybe-dirty-4k #1 5f7701c9cbf727d1eebe77c89bbbeb3371e895e5 Tainted: [P]=PROPRIETARY_MODULE, [B]=BAD_PAGE, [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Workqueue: writeback wb_workfn (flush-254:49) Call trace: f2fs_is_cp_guaranteed+0x70/0x98 f2fs_inplace_write_data+0x174/0x2f4 f2fs_do_write_data_page+0x214/0x81c f2fs_write_single_data_page+0x28c/0x764 f2fs_write_data_pages+0x78c/0xce4 do_writepages+0xe8/0x2fc __writeback_single_inode+0x4c/0x4b4 writeback_sb_inodes+0x314/0x540 __writeback_inodes_wb+0xa4/0xf4 wb_writeback+0x160/0x448 wb_workfn+0x2f0/0x5dc process_scheduled_works+0x1c8/0x458 worker_thread+0x334/0x3f0 kthread+0x118/0x1ac ret_from_fork+0x10/0x20
[1] https://bugzilla.kernel.org/show_bug.cgi?id=220575
The panic was caused by UAF issue w/ below race condition:
kworker
- writepages
- f2fs_write_cache_pages
- f2fs_write_single_data_page
- f2fs_do_write_data_page
- f2fs_inplace_write_data
- f2fs_merge_page_bio
- add_inu_page
: cache page #1 into bio & cache bio in
io->bio_list
- f2fs_write_single_data_page
- f2fs_do_write_data_page
- f2fs_inplace_write_data
- f2fs_merge_page_bio
- add_inu_page
: cache page #2 into bio which is linked
in io->bio_list
write
- f2fs_write_begin
: write page #1
- f2fs_folio_wait_writeback
- f2fs_submit_merged_ipu_write
- f2fs_submit_write_bio
: submit bio which inclues page #1 and #2
software IRQ
- f2fs_write_end_io
- fscrypt_free_bounce_page
: freed bounced page which belongs to page #2
- inc_page_count( , WB_DATA_TYPE(data_folio), false)
: data_folio points to fio->encrypted_page
the bounced page can be freed before
accessing it in f2fs_is_cp_guarantee()
It can reproduce w/ below testcase:
Run below script in shell #1:
for ((i=1;i>0;i++)) do xfs_io -f /mnt/f2fs/enc/file \
-c "pwrite 0 32k" -c "fdatasync"
Run below script in shell #2:
for ((i=1;i>0;i++)) do xfs_io -f /mnt/f2fs/enc/file \
-c "pwrite 0 32k" -c "fdatasync"
So, in f2fs_merge_page_bio(), let's avoid using fio->encrypted_page after commit page into internal ipu cache.
--- fs/f2fs/data.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/f2fs/data.c +1 -1
@@ -968,7 +968,7 @@ alloc_new:if (fio->io_wbc)wbc_account_cgroup_owner (fio->io_wbc, fio->page,PAGE_SIZE ); -inc_page_count (fio->sbi,WB_DATA_TYPE (page)); +inc_page_count (fio->sbi,WB_DATA_TYPE (fio->page)); *fio->last_block = fio->new_blkaddr; *fio->bio = bio;
Greg Kroah-Hartman
maintainerPATCH 43/235 bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Bobrowski <[email protected]>
[ Upstream commit a6f0643e4f63cfaa0d5d4a69de4f132eac4b8fe4 ]
When CONFIG_BPF_LSM=y is set, BPF inode storage maps (BPF_MAP_TYPE_INODE_STORAGE) are compiled into the kernel. However, if the BPF LSM is not explicitly enabled at boot time (e.g. omitted from the "lsm=" boot parameter), lsm_prepare() is never executed for the BPF LSM.
Consequently, the BPF inode security blob offset (bpf_lsm_blob_sizes.lbs_inode) is never initialized and remains at its default compiled size of 8 bytes instead of being updated to a valid offset past the reserved struct rcu_head (typically 16 bytes or more).
When a privileged user creates and updates a BPF_MAP_TYPE_INODE_STORAGE map, bpf_inode() evaluates inode->i_security + 8. This erroneously aliases the struct rcu_head.func callback pointer at the beginning of the inode->i_security blob. During subsequent map element cleanup or inode destruction, writing NULL to owner_storage clears the queued RCU callback pointer. When rcu_do_batch() later executes the queued callback, it attempts an instruction fetch at address 0x0, triggering an immediate kernel panic.
Fix this by introducing a global bpf_lsm_initialized boolean flag marked with __ro_after_init. Set this flag to true inside bpf_lsm_init() when the LSM framework successfully registers the BPF LSM. Gate map allocation in inode_storage_map_alloc() on this flag, returning -EOPNOTSUPP if the BPF LSM is in turn uninitialized.
This fail-fast approach prevents userspace from allocating inode storage maps when the supporting BPF LSM infrastructure is absent, avoiding zombie map states.
--- include/linux/bpf_lsm.h | 4 ++++ kernel/bpf/bpf_inode_storage.c | 10 ++++++++++ security/bpf/hooks.c | 3 +++ 3 files changed, 17 insertions(+)
include/linux/bpf_lsm.h +4 -0
@@ -12,6 +12,8 @@#ifdef CONFIG_BPF_LSM +extern bool bpf_lsm_initialized__ro_after_init ; +#define LSM_HOOK (RET ,DEFAULT ,NAME , ...) \ RET bpf_lsm_##NAME(__VA_ARGS__);#include <linux/lsm_hook_defs.h>
@@ -41,6 +43,8 @@ void bpf_inode_storage_free(struct inode#else /* !CONFIG_BPF_LSM */ +#define bpf_lsm_initialized false +static inline int bpf_lsm_verify_prog (struct bpf_verifier_log *vlog,const struct bpf_prog *prog) {
kernel/bpf/bpf_inode_storage.c +10 -0
@@ -223,6 +223,16 @@ static struct bpf_map *inode_storage_map {struct bpf_local_storage_map *smap; +/* +* Do not allow allocation of BPF_MAP_TYPE_INODE_STORAGE if the BPF LSM +* was not initialized by the LSM framework at boot. Without proper +* initialization, the BPF inode security blob offset remains unprepared, +* causing bpf_inode() to calculate an invalid memory offset and corrupt +* inode->i_security. +*/ +if (!bpf_lsm_initialized) +return ERR_PTR (-EOPNOTSUPP ); + smap =bpf_local_storage_map_alloc (attr);if (IS_ERR (smap))return ERR_CAST (smap);
security/bpf/hooks.c +3 -0
@@ -6,6 +6,8 @@#include <linux/lsm_hooks.h> #include <linux/bpf_lsm.h> +bool bpf_lsm_initialized__ro_after_init ; + static struct security_hook_list bpf_lsm_hooks[] __lsm_ro_after_init = { #define LSM_HOOK(RET, DEFAULT, NAME, ...) \ LSM_HOOK_INIT(NAME, bpf_lsm_##NAME),
@@ -17,6 +19,7 @@ static struct security_hook_list bpf_lsmstatic int __init bpf_lsm_init (void ) {security_add_hooks (bpf_lsm_hooks,ARRAY_SIZE (bpf_lsm_hooks),"bpf" ); + bpf_lsm_initialized = true;pr_info ("LSM support for eBPF active\n" );return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 44/235 udmabuf: Do not create malformed scatterlists
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <[email protected]>
[ Upstream commit 5bf888673e0dda5a53220fa0c4956271a46c353c ]
Using a sg_set_folio() loop for every 4K results in a malformed scatterlist because sg_set_folio() has an issue with offsets > PAGE_SIZE and because scatterlist expects the creator to build a list which consolidates any physical contiguity.
sg_alloc_table_from_pages() creates a valid scatterlist directly from a struct page array, so go back to that.
Remove the offsets allocation and just store an array of tail pages as it did before the below commit. Everything wants that anyhow.
Stable-dep-of: 504e2b4ab97a ("dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning")
--- drivers/dma-buf/udmabuf.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/dma-buf/udmabuf.c +5 -3
@@ -66,14 +66,16 @@ static struct sg_table *get_sg_table(str0 , ubuf->pagecount <<PAGE_SHIFT , GFP_KERNEL);if (ret <0 ) - goto err; + goto err_alloc; + ret =dma_map_sgtable (dev, sg, direction,0 );if (ret <0 ) - goto err; + goto err_map;return sg; -err: +err_map:sg_free_table (sg); +err_alloc:kfree (sg);return ERR_PTR (ret); }
Greg Kroah-Hartman
maintainerPATCH 45/235 dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Gavrilov <[email protected]>
[ Upstream commit 504e2b4ab97a51d56d966cd36d0997ad30b65b2d ]
When CONFIG_DMA_API_DEBUG_SG is enabled, importing a udmabuf into a DRM driver (e.g. amdgpu for video playback in GNOME Videos / Showtime) triggers a spurious warning:
DMA-API: amdgpu 0000:03:00.0: cacheline tracking EEXIST, \
overlapping mappings aren't supported
WARNING: kernel/dma/debug.c:619 at add_dma_entry+0x473/0x5f0The call chain is:
amdgpu_cs_ioctl
-> amdgpu_ttm_backend_bind
-> dma_buf_map_attachment
-> [udmabuf] map_udmabuf -> get_sg_table
-> dma_map_sgtable(dev, sg, direction, 0) // attrs=0
-> debug_dma_map_sg -> add_dma_entry -> EEXISTThis happens because udmabuf builds a per-page scatter-gather list via sg_set_folio(). When begin_cpu_udmabuf() has already created an sg table mapped for the misc device, and an importer such as amdgpu maps the same pages for its own device via map_udmabuf(), the DMA debug infrastructure sees two active mappings whose physical addresses share cacheline boundaries and warns about the overlap.
The DMA_ATTR_SKIP_CPU_SYNC flag suppresses this check in add_dma_entry() because it signals that no CPU cache maintenance is performed at map/unmap time, making the cacheline overlap harmless.
All other major dma-buf exporters already pass this flag:
- drm_gem_map_dma_buf() passes DMA_ATTR_SKIP_CPU_SYNC
- amdgpu_dma_buf_map() passes DMA_ATTR_SKIP_CPU_SYNC
The CPU sync at map/unmap time is also redundant for udmabuf:begin_cpu_udmabuf() and end_cpu_udmabuf() already perform explicit cache synchronization via dma_sync_sgtable_for_cpu/device() when CPU access is requested through the dma-buf interface.
Pass DMA_ATTR_SKIP_CPU_SYNC to dma_map_sgtable() and dma_unmap_sgtable() in udmabuf to suppress the spurious warning and skip the redundant sync.
--- drivers/dma-buf/udmabuf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/dma-buf/udmabuf.c +2 -2
@@ -68,7 +68,7 @@ static struct sg_table *get_sg_table(strif (ret <0 ) goto err_alloc; - ret =dma_map_sgtable (dev, sg, direction,0 ); + ret =dma_map_sgtable (dev, sg, direction,DMA_ATTR_SKIP_CPU_SYNC );if (ret <0 ) goto err_map;return sg;
@@ -83,7 +83,7 @@ err_alloc:static void put_sg_table (struct device *dev,struct sg_table *sg,enum dma_data_direction direction) { -dma_unmap_sgtable (dev, sg, direction,0 ); +dma_unmap_sgtable (dev, sg, direction,DMA_ATTR_SKIP_CPU_SYNC );sg_free_table (sg);kfree (sg); }
Greg Kroah-Hartman
maintainerPATCH 46/235 fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Alba Vives <[email protected]>
[ Upstream commit fc3b071a7c8dc0f5d56defddf6e6fd5aaa3e1e27 ]
afu_ioctl_dma_map() accepts a 64-bit length from userspace via DFL_FPGA_PORT_DMA_MAP ioctl without an upper bound check. The value is passed to afu_dma_pin_pages() where npages is derived as length >> PAGE_SHIFT and passed to pin_user_pages_fast() which takes int nr_pages, causing implicit truncation if length is very large.
Validate map.length at the ioctl entry point before calling afu_dma_map_region(), rejecting values whose page count exceeds INT_MAX.
--- drivers/fpga/dfl-afu-main.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/fpga/dfl-afu-main.c +3 -0
@@ -707,6 +707,9 @@ afu_ioctl_dma_map(struct dfl_feature_plaif (map.argsz < minsz || map.flags)return -EINVAL ; +if (map.length >>PAGE_SHIFT > (u64 )INT_MAX ) +return -EINVAL ; + ret =afu_dma_map_region (pdata, map.user_addr, map.length, &map.iova);if (ret)return ret;
Greg Kroah-Hartman
maintainerPATCH 47/235 i2c: davinci: Unregister cpufreq notifier on probe failure
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
[ Upstream commit e43f32816a1b1fe5a86279411626fe3a9be56d45 ]
davinci_i2c_probe() registers a cpufreq transition notifier before adding the I2C adapter. If i2c_add_numbered_adapter() fails, the probe error path releases the device resources without unregistering the notifier.
Add a dedicated error path to unregister the cpufreq notifier after i2c_add_numbered_adapter() fails.
--- drivers/i2c/busses/i2c-davinci.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-davinci.c +3 -1
@@ -877,13 +877,15 @@ static int davinci_i2c_probe(struct plat adap->nr = pdev->id; r =i2c_add_numbered_adapter (adap);if (r) - goto err_unuse_clocks; + goto err_cpufreq;pm_runtime_mark_last_busy (dev->dev);pm_runtime_put_autosuspend (dev->dev);return 0 ; +err_cpufreq: +i2c_davinci_cpufreq_deregister (dev); err_unuse_clocks:pm_runtime_dont_use_autosuspend (dev->dev);pm_runtime_put_sync (dev->dev);
Greg Kroah-Hartman
maintainerPATCH 48/235 device property: Add fwnode_irq_get_byname
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhil R <[email protected]>
[ Upstream commit ca0acb511c21738b32386ce0f85c284b351d919e ]
Add fwnode_irq_get_byname() to get an interrupt by name from either ACPI table or Device Tree, whichever is used for enumeration.
In the ACPI case, this allow us to use 'interrupt-names' in _DSD which can be mapped to Interrupt() resource by index. The implementation is similar to 'interrupt-names' in the Device Tree.
Stable-dep-of: 158efa411c57 ("i2c: core: fix adapter probe deferral loop")
--- drivers/base/property.c | 29 +++++++++++++++++++++++++++++ include/linux/property.h | 1 + 2 files changed, 30 insertions(+)
drivers/base/property.c +29 -0
@@ -1043,6 +1043,35 @@ int fwnode_irq_get(const struct fwnode_hEXPORT_SYMBOL (fwnode_irq_get);/** +* fwnode_irq_get_byname - Get IRQ from a fwnode using its name +* @fwnode: Pointer to the firmware node +* @name: IRQ name +* +* Description: +* Find a match to the string @name in the 'interrupt-names' string array +* in _DSD for ACPI, or of_node for Device Tree. Then get the Linux IRQ +* number of the IRQ resource corresponding to the index of the matched +* string. +* +* Return: +* Linux IRQ number on success, or negative errno otherwise. +*/ +int fwnode_irq_get_byname (const struct fwnode_handle *fwnode,const char *name) +{ +int index; + +if (!name) +return -EINVAL ; + + index =fwnode_property_match_string (fwnode,"interrupt-names" , name); +if (index <0 ) +return index; + +return fwnode_irq_get (fwnode, index); +} +EXPORT_SYMBOL (fwnode_irq_get_byname); + +/** * fwnode_graph_get_next_endpoint - Get next endpoint firmware node * @fwnode: Pointer to the parent firmware node * @prev: Previous endpoint node or %NULL to get the first
include/linux/property.h +1 -0
@@ -120,6 +120,7 @@ struct fwnode_handle *fwnode_handle_get(void fwnode_handle_put (struct fwnode_handle *fwnode);int fwnode_irq_get (const struct fwnode_handle *fwnode,unsigned int index); +int fwnode_irq_get_byname (const struct fwnode_handle *fwnode,const char *name);unsigned int device_get_child_node_count (struct device *dev);
Greg Kroah-Hartman
maintainerPATCH 49/235 i2c: smbus: Use device_*() functions instead of of_*()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhil R <[email protected]>
[ Upstream commit a263a84088f689bf0c1552a510b25d0bcc45fcae ]
Change of_*() functions to device_*() for firmware agnostic usage. This allows to have the smbus_alert interrupt without any changes in the controller drivers using the ACPI table.
Stable-dep-of: 158efa411c57 ("i2c: core: fix adapter probe deferral loop")
--- drivers/i2c/i2c-core-base.c | 2 +- drivers/i2c/i2c-core-smbus.c | 11 ++++++----- drivers/i2c/i2c-smbus.c | 5 +++-- include/linux/i2c-smbus.h | 6 +++--- 4 files changed, 13 insertions(+), 11 deletions(-)
drivers/i2c/i2c-core-base.c +1 -1
@@ -1478,7 +1478,7 @@ static int i2c_register_adapter(struct i goto err_put_adap; } - res =of_i2c_setup_smbus_alert (adap); + res =i2c_setup_smbus_alert (adap);if (res) goto out_reg;
drivers/i2c/i2c-core-smbus.c +6 -5
@@ -14,6 +14,7 @@#include <linux/err.h> #include <linux/i2c.h> #include <linux/i2c-smbus.h> +#include <linux/property.h> #include <linux/slab.h> #include "i2c-core.h"
@@ -699,13 +700,13 @@ struct i2c_client *i2c_new_smbus_alert_d }EXPORT_SYMBOL_GPL (i2c_new_smbus_alert_device); -#if IS_ENABLED (CONFIG_I2C_SMBUS ) &&IS_ENABLED (CONFIG_OF ) -int of_i2c_setup_smbus_alert (struct i2c_adapter *adapter) +#if IS_ENABLED (CONFIG_I2C_SMBUS ) +int i2c_setup_smbus_alert (struct i2c_adapter *adapter) {int irq; - irq =of_property_match_string (adapter->dev.of_node,"interrupt-names" , -"smbus_alert" ); + irq =device_property_match_string (adapter->dev.parent,"interrupt-names" , +"smbus_alert" );if (irq == -EINVAL || irq == -ENODATA )return 0 ;else if (irq <0 )
@@ -713,5 +714,5 @@ int of_i2c_setup_smbus_alert(struct i2c_ return PTR_ERR_OR_ZERO(i2c_new_smbus_alert_device(adapter, NULL)); } -EXPORT_SYMBOL_GPL (of_i2c_setup_smbus_alert); +EXPORT_SYMBOL_GPL (i2c_setup_smbus_alert);#endif
drivers/i2c/i2c-smbus.c +3 -2
@@ -13,7 +13,7 @@#include <linux/interrupt.h> #include <linux/kernel.h> #include <linux/module.h> -#include <linux/of_irq.h> +#include <linux/property.h> #include <linux/slab.h> #include <linux/workqueue.h>
@@ -178,7 +178,8 @@ static int smbalert_probe(struct i2c_cliif (setup) { irq = setup->irq; }else { - irq =of_irq_get_byname (adapter->dev.of_node,"smbus_alert" ); + irq =fwnode_irq_get_byname (dev_fwnode (adapter->dev.parent), +"smbus_alert" );if (irq <=0 )return irq; }
include/linux/i2c-smbus.h +3 -3
@@ -30,10 +30,10 @@ struct i2c_client *i2c_new_smbus_alert_d struct i2c_smbus_alert_setup *setup);int i2c_handle_smbus_alert (struct i2c_client *ara); -#if IS_ENABLED (CONFIG_I2C_SMBUS ) &&IS_ENABLED (CONFIG_OF ) -int of_i2c_setup_smbus_alert (struct i2c_adapter *adap); +#if IS_ENABLED (CONFIG_I2C_SMBUS ) +int i2c_setup_smbus_alert (struct i2c_adapter *adap);#else -static inline int of_i2c_setup_smbus_alert (struct i2c_adapter *adap) +static inline int i2c_setup_smbus_alert (struct i2c_adapter *adap) {return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 50/235 RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhenhao Wan <[email protected]>
[ Upstream commit 963af8d97a8c6a117134a8d0db1415e0489200b1 ]
When the server answers an RTRS READ, rdma_write_sg() builds the source scatter/gather entry for the IB_WR_RDMA_WRITE that returns data to the peer. Its length is taken directly from the wire descriptor:
plist->length = le32_to_cpu(id->rd_msg->desc[0].len);
rd_msg points into the chunk buffer that the remote peer filled via RDMA-WRITE-WITH-IMM (rtrs_srv_rdma_done() -> process_io_req() -> process_read()), so desc[0].len is attacker-controlled and, before this change, was only rejected when zero. The source address is the fixed chunk start (dma_addr[msg_id]) and the source lkey is the PD-wide local_dma_lkey, which is not tied to the chunk's MR mapping, so the verbs layer does not constrain the transfer length to max_chunk_size. msg_id and off are bounded against queue_depth and max_chunk_size in rtrs_srv_rdma_done(), but desc[0].len is a separate field that was not checked against the chunk size.
A peer that advertises desc[0].len larger than max_chunk_size can make the posted RDMA write read past the chunk's mapped region. The resulting behaviour depends on the IOMMU configuration: with no IOMMU or in passthrough mode the read may extend into memory adjacent to the chunk and be returned to the peer, which can disclose host memory; with a translating IOMMU the out-of-range access is expected to fault and abort the connection. In either case the transfer exceeds what the protocol permits and is driven by a remote peer.
Reject a descriptor length above max_chunk_size, mirroring the existing off >= max_chunk_size bound in rtrs_srv_rdma_done(). Legitimate clients do not exceed it: the client sets desc[0].len to its MR length, which is capped at the negotiated max_io_size (max_chunk_size - MAX_HDR_SIZE).
--- drivers/infiniband/ulp/rtrs/rtrs-srv.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/infiniband/ulp/rtrs/rtrs-srv.c +3 -2
@@ -258,8 +258,9 @@ static int rdma_write_sg(struct rtrs_srv/* WR will fail with length error * if this is 0 */ -if (unlikely (plist->length ==0 )) { -rtrs_err (s,"Invalid RDMA-Write sg list length 0\n" ); +if (unlikely (plist->length ==0 || plist->length > max_chunk_size)) { +rtrs_err (s,"Invalid RDMA-Write sg list length %u\n" , + plist->length);return -EINVAL ; }
Greg Kroah-Hartman
maintainerPATCH 51/235 Input: mms114 - reject an oversized device packet size
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <[email protected]>
[ Upstream commit 66725039f7090afe14c31bd259e2059a68f04023 ]
mms114_interrupt() reads a packet of touch data from the device into a fixed-size on-stack buffer
struct mms114_touch touch[MMS114_MAX_TOUCH];
which holds MMS114_MAX_TOUCH (10) events of MMS114_EVENT_SIZE (8) bytes, i.e. 80 bytes. The length of the I2C read into it is taken verbatim from the device:
packet_size = mms114_read_reg(data, MMS114_PACKET_SIZE); if (packet_size <= 0) goto out; ... error = __mms114_read_reg(data, MMS114_INFORMATION, packet_size, (u8 *)touch);
packet_size is a single device register byte (0x0F) and the only check is the lower bound packet_size <= 0; it is never bounded against the size of touch[]. A malfunctioning, malicious or counterfeit controller (or an attacker tampering with the I2C bus) can report a packet_size of up to 255, so __mms114_read_reg() writes up to 175 bytes past the end of touch[] on the IRQ-thread stack: a stack out-of-bounds write that can overwrite the stack canary, saved registers and the return address.
A well-formed device never reports more than the buffer holds, so reject an oversized packet and drop the report, consistent with the handler's other error paths, rather than reading past the buffer.
--- drivers/input/touchscreen/mms114.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/input/touchscreen/mms114.c +6 -0
@@ -209,6 +209,12 @@ static irqreturn_t mms114_interrupt(intif (packet_size <=0 ) goto out; +if (packet_size >sizeof (touch)) { +dev_err (&data->client->dev,"Invalid packet size %d (max %zu)\n" , + packet_size,sizeof (touch)); + goto out; + } + touch_size = packet_size /MMS114_PACKET_NUM ; error = __mms114_read_reg(data, MMS114_INFORMATION, packet_size,
Greg Kroah-Hartman
maintainerPATCH 52/235 VFS/audit: introduce kern_path_parent() for audit
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
[ Upstream commit 76a53de6f7ff0641570364234fb4489f4d4fc8e9 ]
audit_alloc_mark() and audit_get_nd() both need to perform a path lookup getting the parent dentry (which must exist) and the final target (following a LAST_NORM name) which sometimes doesn't need to exist.
They don't need the parent to be locked, but use kern_path_locked() or kern_path_locked_negative() anyway. This is somewhat misleading to the casual reader.
This patch introduces a more targeted function, kern_path_parent(), which returns not holding locks. On success the "path" will be set to the parent, which must be found, and the return value is the dentry of the target, which might be negative.
This will clear the way to rename kern_path_locked() which is otherwise only used to prepare for removing something.
It also allows us to remove kern_path_locked_negative(), which is transformed into the new kern_path_parent().
Stable-dep-of: 81905b5acbe7 ("audit: fix recursive locking deadlock in audit_dupe_exe()")
--- fs/namei.c | 42 ++++++++++++++++++++++++++++++++++++++++++ include/linux/namei.h | 1 + kernel/audit.h | 4 ++-- kernel/audit_fsnotify.c | 11 ++++------- kernel/audit_watch.c | 9 ++++++--- 5 files changed, 55 insertions(+), 12 deletions(-)
fs/namei.c +42 -0
@@ -2439,6 +2439,48 @@ static struct filename *filename_parentareturn name; } +/** +* kern_path_parent: lookup path returning parent and target +* @name: path name +* @path: path to store parent in +* +* The path @name should end with a normal component, not "." or ".." or "/". +* A lookup is performed and if successful the parent information +* is store in @parent and the dentry is returned. +* +* The dentry maybe negative, the parent will be positive. +* +* Returns: dentry or error. +*/ +struct dentry *kern_path_parent (const char *name,struct path *path) +{ +struct filename *filename; +struct path parent_path; +struct dentry *d; +struct qstr last; +int type; + + filename =filename_parentat (AT_FDCWD ,getname_kernel (name),0 , + &parent_path, &last, &type); +if (IS_ERR (filename)) +return ERR_CAST (filename); +if (unlikely (type !=LAST_NORM )) { +path_put (&parent_path); + d =ERR_PTR (-EINVAL ); + goto out; + } + + d =lookup_one_len_unlocked (last.name, parent_path.dentry, last.len); +if (IS_ERR (d)) { +path_put (&parent_path); + goto out; + } + *path = parent_path; +out: +putname (filename); +return d; +} +/* does lookup, returns the object with parent locked */ struct dentry *kern_path_locked (const char *name,struct path *path) {
include/linux/namei.h +1 -0
@@ -61,6 +61,7 @@ static inline int user_path_at(int dfd, }extern int kern_path (const char *,unsigned ,struct path *); +struct dentry *kern_path_parent (const char *name,struct path *parent);extern struct dentry *kern_path_create (int ,const char *,struct path *,unsigned int );extern struct dentry *user_path_create (int ,const char __user *,struct path *,unsigned int );
kernel/audit.h +2 -2
@@ -271,8 +271,8 @@ extern struct audit_fsnotify_mark *auditextern char *audit_mark_path (struct audit_fsnotify_mark *mark);extern void audit_remove_mark (struct audit_fsnotify_mark *audit_mark);extern void audit_remove_mark_rule (struct audit_krule *krule); -extern int audit_mark_compare (struct audit_fsnotify_mark *mark, -unsigned long ino,dev_t dev); +extern int audit_mark_compare (struct audit_fsnotify_mark *mark,u64 ino, +dev_t dev);extern int audit_dupe_exe (struct audit_krule *new,struct audit_krule *old);extern int audit_exe_compare (struct task_struct *tsk,struct audit_fsnotify_mark *mark);
kernel/audit_fsnotify.c +4 -7
@@ -57,7 +57,7 @@ char *audit_mark_path(struct audit_fsnotreturn mark->path; } -int audit_mark_compare (struct audit_fsnotify_mark *mark,unsigned long ino,dev_t dev) +int audit_mark_compare (struct audit_fsnotify_mark *mark,u64 ino,dev_t dev) {if (mark->ino ==AUDIT_INO_UNSET )return 0 ;
@@ -76,17 +76,14 @@ struct audit_fsnotify_mark *audit_alloc_struct audit_fsnotify_mark *audit_mark;struct path path;struct dentry *dentry; -struct inode *inode;int ret;if (pathname[0 ] !='/' || pathname[len-1 ] =='/' )return ERR_PTR (-EINVAL ); - dentry =kern_path_locked (pathname, &path); + dentry =kern_path_parent (pathname, &path);if (IS_ERR (dentry)) -return (void *)dentry;/* returning an error */ - inode = path.dentry->d_inode; -inode_unlock (inode); +return ERR_CAST (dentry);/* returning an error */ audit_mark =kzalloc (sizeof (*audit_mark),GFP_KERNEL );if (unlikely (!audit_mark)) {
@@ -100,7 +97,7 @@ struct audit_fsnotify_mark *audit_alloc_audit_update_mark (audit_mark, dentry->d_inode); audit_mark->rule = krule; - ret =fsnotify_add_inode_mark (&audit_mark->mark, inode,0 ); + ret =fsnotify_add_inode_mark (&audit_mark->mark, path.dentry->d_inode,0 );if (ret <0 ) { audit_mark->path =NULL ;fsnotify_put_mark (&audit_mark->mark);
kernel/audit_watch.c +6 -3
@@ -243,7 +243,7 @@ static void audit_watch_log_rule_change(/* Update inode info in audit rules based on filesystem event. */ static void audit_update_watch (struct audit_parent *parent,const struct qstr *dname,dev_t dev, -unsigned long ino,unsigned invalidating) +u64 ino,unsigned int invalidating) {struct audit_watch *owatch, *nwatch, *nextw;struct audit_krule *r, *nextr;
@@ -346,15 +346,18 @@ static void audit_remove_parent_watches(/* Get path information necessary for adding watches. */ static int audit_get_nd (struct audit_watch *watch,struct path *parent) { -struct dentry *d =kern_path_locked (watch->path, parent); +struct dentry *d; + + d =kern_path_parent (watch->path, parent);if (IS_ERR (d))return PTR_ERR (d); +if (d_is_positive (d)) {/* update watch filter fields */ watch->dev = d->d_sb->s_dev; watch->ino =d_backing_inode (d)->i_ino; } -inode_unlock (d_backing_inode (parent->dentry)); +dput (d);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 53/235 audit: widen ino fields to u64
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <[email protected]>
[ Upstream commit 125dfa218134df7cc112667e92984de9d8cd0bf6 ]
inode->i_ino is being widened from unsigned long to u64. The audit subsystem uses unsigned long ino in struct fields, function parameters, and local variables that store inode numbers from arbitrary filesystems. On 32-bit platforms this truncates inode numbers that exceed 32 bits, which will cause incorrect audit log entries and broken watch/mark comparisons.
Widen all audit ino fields, parameters, and locals to u64, and update the inode format string from %lu to %llu to match.
Stable-dep-of: 81905b5acbe7 ("audit: fix recursive locking deadlock in audit_dupe_exe()")
--- include/linux/audit.h | 2 +- kernel/audit.h | 9 ++++----- kernel/audit_fsnotify.c | 2 +- kernel/audit_watch.c | 10 +++++----- kernel/auditsc.c | 4 ++-- 5 files changed, 13 insertions(+), 14 deletions(-)
include/linux/audit.h +1 -1
@@ -14,7 +14,7 @@#include <uapi/linux/audit.h> #include <uapi/linux/netfilter/nf_tables.h> -#define AUDIT_INO_UNSET ((unsigned long)-1) +#define AUDIT_INO_UNSET ((u64)-1)#define AUDIT_DEV_UNSET ((dev_t)-1)struct audit_sig_info {
kernel/audit.h +4 -5
@@ -71,7 +71,7 @@ struct audit_names {int name_len;/* number of chars to log */ bool hidden;/* don't log this record */ -unsigned long ino; +u64 ino;dev_t dev;umode_t mode;kuid_t uid;
@@ -209,9 +209,9 @@ extern int auditd_test_task(struct task_#define AUDIT_INODE_BUCKETS 32extern struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS ]; -static inline int audit_hash_ino (u32 ino) +static inline int audit_hash_ino (u64 ino) { -return (ino & (AUDIT_INODE_BUCKETS -1 )); +return ((u32 )ino & (AUDIT_INODE_BUCKETS -1 )); }/* Indicates that audit should log the full pathname. */
@@ -263,8 +263,7 @@ extern int audit_to_watch(struct audit_kextern int audit_add_watch (struct audit_krule *krule,struct list_head **list);extern void audit_remove_watch_rule (struct audit_krule *krule);extern char *audit_watch_path (struct audit_watch *watch); -extern int audit_watch_compare (struct audit_watch *watch,unsigned long ino, -dev_t dev); +extern int audit_watch_compare (struct audit_watch *watch,u64 ino,dev_t dev);extern struct audit_fsnotify_mark *audit_alloc_mark (struct audit_krule *krule,char *pathname,int len);
kernel/audit_fsnotify.c +1 -1
@@ -25,7 +25,7 @@*/ struct audit_fsnotify_mark {dev_t dev;/* associated superblock device */ -unsigned long ino;/* associated inode number */ +u64 ino;/* associated inode number */ char *path;/* insertion path */ struct fsnotify_mark mark;/* fsnotify mark on the inode */ struct audit_krule *rule;
kernel/audit_watch.c +5 -5
@@ -37,7 +37,7 @@ struct audit_watch {refcount_t count;/* reference count */ dev_t dev;/* associated superblock device */ char *path;/* insertion path */ -unsigned long ino;/* associated inode number */ +u64 ino;/* associated inode number */ struct audit_parent *parent;/* associated parent */ struct list_head wlist;/* entry in parent->watches list */ struct list_head rules;/* anchor for krule->rlist */
@@ -125,7 +125,7 @@ char *audit_watch_path(struct audit_watcreturn watch->path; } -int audit_watch_compare (struct audit_watch *watch,unsigned long ino,dev_t dev) +int audit_watch_compare (struct audit_watch *watch,u64 ino,dev_t dev) {return (watch->ino !=AUDIT_INO_UNSET ) && (watch->ino == ino) &&
@@ -284,7 +284,7 @@ static void audit_update_watch(struct aulist_del (&oentry->rule.list);audit_panic ("error updating watch, removing" ); }else { -int h =audit_hash_ino ((u32 )ino); +int h =audit_hash_ino (ino);/* * nentry->rule.watch == oentry->rule.watch so
@@ -438,7 +438,7 @@ int audit_add_watch(struct audit_krule *audit_add_to_parent (krule, parent); - h =audit_hash_ino ((u32 )watch->ino); + h =audit_hash_ino (watch->ino); *list = &audit_inode_hash[h]; error:path_put (&parent_path);
@@ -526,7 +526,7 @@ int audit_dupe_exe(struct audit_krule *nint audit_exe_compare (struct task_struct *tsk,struct audit_fsnotify_mark *mark) {struct file *exe_file; -unsigned long ino; +u64 ino;dev_t dev;/* only do exe filtering if we are recording @current events/records */
kernel/auditsc.c +2 -2
@@ -837,7 +837,7 @@ static enum audit_state audit_filter_sysstatic int audit_filter_inode_name (struct task_struct *tsk,struct audit_names *n,struct audit_context *ctx) { -int h =audit_hash_ino ((u32 )n->ino); +int h =audit_hash_ino (n->ino);struct list_head *list = &audit_inode_hash[h];struct audit_entry *e;enum audit_state state;
@@ -1431,7 +1431,7 @@ static void audit_log_name(struct audit_audit_log_format (ab," name=(null)" );if (n->ino !=AUDIT_INO_UNSET ) - audit_log_format(ab, " inode=%lu dev=%02x:%02x mode=%#ho ouid=%u ogid=%u rdev=%02x:%02x", + audit_log_format(ab, " inode=%llu dev=%02x:%02x mode=%#ho ouid=%u ogid=%u rdev=%02x:%02x", n->ino, MAJOR(n->dev), MINOR(n->dev),
Greg Kroah-Hartman
maintainerPATCH 54/235 audit: use unsigned int instead of unsigned
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Robaina <[email protected]>
[ Upstream commit 8b226771014beab1292081151a99530886ce54b4 ]
Address checkpatch.pl warning below, across the audit subsystem:
WARNING: Prefer 'unsigned int' to bare use of 'unsigned'
Minor cleanup, no functional changes.
Stable-dep-of: 81905b5acbe7 ("audit: fix recursive locking deadlock in audit_dupe_exe()")
--- include/linux/audit.h | 16 ++++++++-------- kernel/audit.c | 2 +- kernel/audit.h | 2 +- kernel/audit_tree.c | 2 +- kernel/auditfilter.c | 8 ++++---- kernel/auditsc.c | 2 +- lib/compat_audit.c | 12 ++++++------ 7 files changed, 22 insertions(+), 22 deletions(-)
include/linux/audit.h +8 -8
@@ -120,17 +120,17 @@ enum audit_nfcfgop {extern int is_audit_feature_set (int which); -extern int __init audit_register_class (int class,unsigned *list); -extern int audit_classify_syscall (int abi,unsigned syscall); +extern int __init audit_register_class (int class,unsigned int *list); +extern int audit_classify_syscall (int abi,unsigned int syscall);extern int audit_classify_arch (int arch);/* only for compat system calls */ -extern unsigned compat_write_class[]; -extern unsigned compat_read_class[]; -extern unsigned compat_dir_class[]; -extern unsigned compat_chattr_class[]; -extern unsigned compat_signal_class[]; +extern unsigned int compat_write_class[]; +extern unsigned int compat_read_class[]; +extern unsigned int compat_dir_class[]; +extern unsigned int compat_chattr_class[]; +extern unsigned int compat_signal_class[]; -extern int audit_classify_compat_syscall (int abi,unsigned syscall); +extern int audit_classify_compat_syscall (int abi,unsigned int syscall);/* audit_names->type values */ #define AUDIT_TYPE_UNKNOWN 0/* we don't know yet */
kernel/audit.c +1 -1
@@ -1989,7 +1989,7 @@ static void audit_log_vformat(struct aud* here and AUDIT_BUFSIZ is at least 1024, then we can * log everything that printk could have logged. */ avail =audit_expand (ab, -max_t (unsigned,AUDIT_BUFSIZ ,1 +len-avail)); + max_t(unsigned int, AUDIT_BUFSIZ, 1+len-avail));if (!avail) goto out_va_end; len =vsnprintf (skb_tail_pointer (skb), avail, fmt, args2);
kernel/audit.h +1 -1
@@ -217,7 +217,7 @@ static inline int audit_hash_ino(u64 ino/* Indicates that audit should log the full pathname. */ #define AUDIT_NAME_FULL -1 -extern int audit_match_class (int class,unsigned syscall); +extern int audit_match_class (int class,unsigned int syscall);extern int audit_comparator (const u32 left,const u32 op,const u32 right);extern int audit_uid_comparator (kuid_t left,u32 op,kuid_t right);extern int audit_gid_comparator (kgid_t left,u32 op,kgid_t right);
kernel/audit_tree.c +1 -1
@@ -33,7 +33,7 @@ struct audit_chunk {struct node {struct list_head list;struct audit_tree *owner; -unsigned index;/* index; upper bit indicates 'will prune' */ +unsigned int index;/* index; upper bit indicates 'will prune' */ } owners[]; };
kernel/auditfilter.c +4 -4
@@ -162,13 +162,13 @@ static inline int audit_to_inode(structstatic __u32 *classes[AUDIT_SYSCALL_CLASSES ]; -int __init audit_register_class (int class,unsigned *list) +int __init audit_register_class (int class,unsigned int *list) {__u32 *p =kcalloc (AUDIT_BITMASK_SIZE ,sizeof (__u32),GFP_KERNEL );if (!p)return -ENOMEM ;while (*list != ~0U ) { -unsigned n = *list++; +unsigned int n = *list++;if (n >=AUDIT_BITMASK_SIZE *32 -AUDIT_SYSCALL_CLASSES ) {kfree (p);return -EINVAL ;
@@ -183,7 +183,7 @@ int __init audit_register_class(int clasreturn 0 ; } -int audit_match_class (int class,unsigned syscall) +int audit_match_class (int class,unsigned int syscall) {if (unlikely (syscall >=AUDIT_BITMASK_SIZE *32 ))return 0 ;
@@ -234,7 +234,7 @@ static int audit_match_signal(struct aud/* Common user-space to kernel rule translation. */ static inline struct audit_entry *audit_to_entry_common (struct audit_rule_data *rule) { -unsigned listnr; +unsigned int listnr;struct audit_entry *entry;int i, err;
kernel/auditsc.c +1 -1
@@ -161,7 +161,7 @@ static const struct audit_nfcfgop_tab austatic int audit_match_perm (struct audit_context *ctx,int mask) { -unsigned n; +unsigned int n;if (unlikely (!ctx))return 0 ; n = ctx->major;
lib/compat_audit.c +6 -6
@@ -3,32 +3,32 @@#include <linux/types.h> #include <asm/unistd32.h> -unsigned compat_dir_class[] = { +unsigned int compat_dir_class[] = { #include <asm-generic/audit_dir_write.h> ~0U }; -unsigned compat_read_class[] = { +unsigned int compat_read_class[] = { #include <asm-generic/audit_read.h> ~0U }; -unsigned compat_write_class[] = { +unsigned int compat_write_class[] = { #include <asm-generic/audit_write.h> ~0U }; -unsigned compat_chattr_class[] = { +unsigned int compat_chattr_class[] = { #include <asm-generic/audit_change_attr.h> ~0U }; -unsigned compat_signal_class[] = { +unsigned int compat_signal_class[] = { #include <asm-generic/audit_signal.h> ~0U }; -int audit_classify_compat_syscall (int abi,unsigned syscall) +int audit_classify_compat_syscall (int abi,unsigned int syscall) {switch (syscall) {#ifdef __NR_open
Greg Kroah-Hartman
maintainerPATCH 55/235 audit: fix recursive locking deadlock in audit_dupe_exe()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Robaina <[email protected]>
[ Upstream commit 81905b5acbe77284734438df3fbec1158e6429a3 ]
A deadlock occurs in the audit subsystem when duplicating executable-related rules.
When a file is moved (e.g., via do_renameat2()), the VFS layer locks the parent directory (I_MUTEX_PARENT), which synchronously triggers an fsnotify_move event. If an existing executable audit rule matches the file being moved, the audit subsystem catches this event and calls audit_dupe_exe() to duplicate the watch and update the rule. Then, audit_alloc_mark() would call kern_path_parent() to resolve the path, leading to a blind attempt to acquire the exact same I_MUTEX_PARENT lock already held by the task, resulting in the following recursive locking deadlock:
============================================
WARNING: possible recursive locking detected 6.12.0-55.27.1.el10_0.x86_64+debug #1 Not tainted
--------------------------------------------
mv/5099 is trying to acquire lock:
ffff888132845358 (&inode->i_sb->s_type->i_mutex_dir_key/1){+.+.}-{3:3},
at: __kern_path_locked+0x10a/0x2f0
but task is already holding lock:
ffff888132846b58 (&inode->i_sb->s_type->i_mutex_dir_key/1){+.+.}-{3:3},
at: lock_two_directories+0x13f/0x2b0
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
---- lock(&inode->i_sb->s_type->i_mutex_dir_key/1);
lock(&inode->i_sb->s_type->i_mutex_dir_key/1);
*** DEADLOCK ***
May be due to missing lock nesting notation
6 locks held by mv/5099:
#0: ffff888112a9c440 (sb_writers#13)
at: do_renameat2+0x34c/0xbc0
#1: ffff888112a9c790 (&type->s_vfs_rename_key#3)
at: do_renameat2+0x415/0xbc0
#2: ffff888132846b58 (&inode->i_sb->s_type->i_mutex_dir_key/1)
at: lock_two_directories+0x13f/0x2b0
#3: ffff888132845358 (&inode->i_sb->s_type->i_mutex_dir_key/5)
at: lock_two_directories+0x175/0x2b0
#4: ffffffffb3a1fb10 (&fsnotify_mark_srcu)
at: fsnotify+0x454/0x28a0
#5: ffffffffaf886230 (audit_filter_mutex)
at: audit_update_watch+0x36/0x11e0
stack backtrace: Call Trace: <TASK> dump_stack_lvl+0x6f/0xb0 print_deadlock_bug.cold+0xbd/0xca validate_chain+0x83a/0xf00 __lock_acquire+0xcac/0x1d20 lock_acquire.part.0+0x11b/0x360 down_write_nested+0x9f/0x230 __kern_path_locked+0x10a/0x2f0 kern_path_locked+0x26/0x40 audit_alloc_mark+0xfb/0x4f0 audit_dupe_exe+0x6c/0xe0 audit_dupe_rule+0x6c2/0xc00 audit_update_watch+0x4cc/0x11e0 audit_watch_handle_event+0x12c/0x1b0 send_to_group+0x5d0/0x8b0 fsnotify+0x615/0x28a0 fsnotify_move+0x1d8/0x630 vfs_rename+0xdcd/0x1df0 do_renameat2+0x9d4/0xbc0 __x64_sys_renameat+0x192/0x260 do_syscall_64+0x92/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f0491fe8c4e Code: 0f 1f 40 00 48 8b 15 c1 e1 16 00 f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 49 89 ca b8 08 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 0a c3 66 0f 1f 84 00 00 00 00 00 48 8b 15 89 RSP: 002b:00007ffc7210bf38 EFLAGS: 00000246 ORIG_RAX: 0000000000000108 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0491fe8c4e RDX: 0000000000000003 RSI: 00007ffc7210e6c8 RDI: 00000000ffffff9c RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001 R10: 00005575eb2dae2a R11: 0000000000000246 R12: 00005575eb2dae2a R13: 00007ffc7210e6c8 R14: 0000000000000003 R15: 00000000ffffff9c </TASK>
The aforementioned deadlock can be consistently reproduced by running the script below:
audit-dupe-exe-deadlock.sh
--------------------------
#!/bin/bash
auditctl -D
mkdir -p /tmp/foo
touch /tmp/file
auditctl -a always,exit -F exe=/tmp/file -F path=/tmp/file -S all -k dr mv /tmp/file /tmp/foo/file
rm -Rf /tmp/foo
This patch fixes the issue by introducing struct audit_watch_ctx to pass the fsnotify event context down to audit_alloc_mark(). By utilizing the already-resolved directory inode provided by the event, we bypass the kern_path_parent() path resolution entirely, safely avoiding the recursive lock. Furthermore, it explicitly allows duplicate fsnotify marks (allow_dups = 1) during the rename update, allowing the new rule's mark to safely coexist with the old rule's mark until the old rule is freed.
P.S.: This issue was identified and reproduced during a comprehensive code coverage analysis of the audit subsystem. The full report is available at the link below:
https://people.redhat.com/rrobaina/audit-code-coverage-analysis.pdf
P.P.S: With the permission of both Ricardo and Nathan, I've squashed a fixup patch from Nathan that addresses a compile time error when CONFIG_AUDITSYSCALL=n.
--- kernel/audit.h | 17 ++++++++++++----- kernel/audit_fsnotify.c | 32 +++++++++++++++++++++++--------- kernel/audit_watch.c | 25 +++++++++++++++++-------- kernel/auditfilter.c | 9 +++++---- 4 files changed, 57 insertions(+), 26 deletions(-)
kernel/audit.h +12 -5
@@ -242,8 +242,13 @@ extern int audit_del_rule(struct audit_eextern void audit_free_rule_rcu (struct rcu_head *head);extern struct list_head audit_filter_list[]; -extern struct audit_entry *audit_dupe_rule (struct audit_krule *old); +struct audit_watch_ctx { +struct inode *dir; +struct inode *child; +}; +extern struct audit_entry *audit_dupe_rule (struct audit_krule *old, +struct audit_watch_ctx *ctx);extern void audit_log_d_path_exe (struct audit_buffer *ab,struct mm_struct *mm);
@@ -266,13 +271,15 @@ extern char *audit_watch_path(struct audextern int audit_watch_compare (struct audit_watch *watch,u64 ino,dev_t dev);extern struct audit_fsnotify_mark *audit_alloc_mark (struct audit_krule *krule, -char *pathname,int len); +char *pathname,int len, +struct audit_watch_ctx *ctx);extern char *audit_mark_path (struct audit_fsnotify_mark *mark);extern void audit_remove_mark (struct audit_fsnotify_mark *audit_mark);extern void audit_remove_mark_rule (struct audit_krule *krule);extern int audit_mark_compare (struct audit_fsnotify_mark *mark,u64 ino,dev_t dev); -extern int audit_dupe_exe (struct audit_krule *new,struct audit_krule *old); +extern int audit_dupe_exe (struct audit_krule *new,struct audit_krule *old, +struct audit_watch_ctx *ctx);extern int audit_exe_compare (struct task_struct *tsk,struct audit_fsnotify_mark *mark);
@@ -303,13 +310,13 @@ extern struct list_head *audit_killed_tr#define audit_watch_path (w) ""#define audit_watch_compare (w, i, d) 0 -#define audit_alloc_mark (k, p, l) (ERR_PTR(-EINVAL)) +#define audit_alloc_mark (k, p, l, c) (ERR_PTR(-EINVAL))#define audit_mark_path (m) ""#define audit_remove_mark (m)#define audit_remove_mark_rule (k)#define audit_mark_compare (m, i, d) 0#define audit_exe_compare (t, m) (-EINVAL) -#define audit_dupe_exe (n, o) (-EINVAL) +#define audit_dupe_exe (n, o, c) (-EINVAL)#define audit_remove_tree_rule (rule) BUG()#define audit_add_tree_rule (rule) -EINVAL
kernel/audit_fsnotify.c +23 -9
@@ -71,19 +71,30 @@ static void audit_update_mark(struct aud audit_mark->ino = inode ? inode->i_ino :AUDIT_INO_UNSET ; } -struct audit_fsnotify_mark *audit_alloc_mark (struct audit_krule *krule,char *pathname,int len) +struct audit_fsnotify_mark *audit_alloc_mark (struct audit_krule *krule,char *pathname, +int len,struct audit_watch_ctx *ctx) {struct audit_fsnotify_mark *audit_mark;struct path path;struct dentry *dentry; -int ret; +struct inode *dir, *child; +int ret, allow_dups;if (pathname[0 ] !='/' || pathname[len-1 ] =='/' )return ERR_PTR (-EINVAL ); - dentry =kern_path_parent (pathname, &path); -if (IS_ERR (dentry)) -return ERR_CAST (dentry);/* returning an error */ +if (!ctx) { + dentry =kern_path_parent (pathname, &path); +if (IS_ERR (dentry)) +return ERR_CAST (dentry);/* returning an error */ + dir =d_inode (path.dentry); + child =d_inode (dentry); + allow_dups =0 ; + }else { + dir = ctx->dir; + child = ctx->child; + allow_dups =1 ; + } audit_mark =kzalloc (sizeof (*audit_mark),GFP_KERNEL );if (unlikely (!audit_mark)) {
@@ -94,18 +105,21 @@ struct audit_fsnotify_mark *audit_alloc_fsnotify_init_mark (&audit_mark->mark, audit_fsnotify_group); audit_mark->mark.mask =AUDIT_FS_EVENTS ; audit_mark->path = pathname; -audit_update_mark (audit_mark, dentry->d_inode); audit_mark->rule = krule; - ret =fsnotify_add_inode_mark (&audit_mark->mark, path.dentry->d_inode,0 ); +audit_update_mark (audit_mark, child); + ret =fsnotify_add_inode_mark (&audit_mark->mark, dir, allow_dups); +if (ret <0 ) { audit_mark->path =NULL ;fsnotify_put_mark (&audit_mark->mark); audit_mark =ERR_PTR (ret); } out: -dput (dentry); -path_put (&path); +if (!ctx) { +dput (dentry); +path_put (&path); + }return audit_mark; }
kernel/audit_watch.c +17 -8
@@ -243,7 +243,8 @@ static void audit_watch_log_rule_change(/* Update inode info in audit rules based on filesystem event. */ static void audit_update_watch (struct audit_parent *parent,const struct qstr *dname,dev_t dev, -u64 ino,unsigned int invalidating) +u64 ino,unsigned int invalidating, +struct audit_watch_ctx *ctx) {struct audit_watch *owatch, *nwatch, *nextw;struct audit_krule *r, *nextr;
@@ -279,7 +280,7 @@ static void audit_update_watch(struct aulist_del (&oentry->rule.rlist);list_del_rcu (&oentry->list); - nentry =audit_dupe_rule (&oentry->rule); + nentry =audit_dupe_rule (&oentry->rule, ctx);if (IS_ERR (nentry)) {list_del (&oentry->rule.list);audit_panic ("error updating watch, removing" );
@@ -478,10 +479,17 @@ static int audit_watch_handle_event(struif (WARN_ON_ONCE (inode_mark->group != audit_watch_group))return 0 ; -if (mask & (FS_CREATE |FS_MOVED_TO ) && inode) -audit_update_watch (parent, dname, inode->i_sb->s_dev, inode->i_ino,0 ); -else if (mask & (FS_DELETE |FS_MOVED_FROM )) -audit_update_watch (parent, dname,AUDIT_DEV_UNSET ,AUDIT_INO_UNSET ,1 ); +if (mask & (FS_CREATE |FS_MOVED_TO ) && inode) { +struct audit_watch_ctx ctx = { .dir = dir, .child = inode }; + +audit_update_watch (parent, dname, inode->i_sb->s_dev, inode->i_ino,0 , + &ctx); + }else if (mask & (FS_DELETE |FS_MOVED_FROM )) { +struct audit_watch_ctx ctx = { .dir = dir, .child =NULL }; + +audit_update_watch (parent, dname,AUDIT_DEV_UNSET ,AUDIT_INO_UNSET ,1 , + &ctx); + }else if (mask & (FS_DELETE_SELF |FS_UNMOUNT |FS_MOVE_SELF ))audit_remove_parent_watches (parent);
@@ -504,7 +512,8 @@ static int __init audit_watch_init(void) }device_initcall (audit_watch_init); -int audit_dupe_exe (struct audit_krule *new,struct audit_krule *old) +int audit_dupe_exe (struct audit_krule *new,struct audit_krule *old, +struct audit_watch_ctx *ctx) {struct audit_fsnotify_mark *audit_mark;char *pathname;
@@ -513,7 +522,7 @@ int audit_dupe_exe(struct audit_krule *nif (!pathname)return -ENOMEM ; - audit_mark =audit_alloc_mark (new, pathname,strlen (pathname)); + audit_mark =audit_alloc_mark (new, pathname,strlen (pathname), ctx);if (IS_ERR (audit_mark)) {kfree (pathname);return PTR_ERR (audit_mark);
kernel/auditfilter.c +5 -4
@@ -582,7 +582,7 @@ static struct audit_entry *audit_data_to err =PTR_ERR (str); goto exit_free; } - audit_mark =audit_alloc_mark (&entry->rule, str, f_val); + audit_mark =audit_alloc_mark (&entry->rule, str, f_val,NULL );if (IS_ERR (audit_mark)) {kfree (str); err =PTR_ERR (audit_mark);
@@ -809,7 +809,8 @@ static inline int audit_dupe_lsm_field(s* rule with the new rule in the filterlist, then free the old rule. * The rlist element is undefined; list manipulations are handled apart from * the initial copy. */ -struct audit_entry *audit_dupe_rule (struct audit_krule *old) +struct audit_entry *audit_dupe_rule (struct audit_krule *old, +struct audit_watch_ctx *ctx) {u32 fcount = old->field_count;struct audit_entry *entry;
@@ -868,7 +869,7 @@ struct audit_entry *audit_dupe_rule(stru new->filterkey = fk;break ;case AUDIT_EXE : - err =audit_dupe_exe (new, old); + err =audit_dupe_exe (new, old, ctx);break ; }if (err) {
@@ -1400,7 +1401,7 @@ static int update_lsm_rule(struct audit_if (!security_audit_rule_known (r))return 0 ; - nentry =audit_dupe_rule (r); + nentry =audit_dupe_rule (r,NULL );if (entry->rule.exe)audit_remove_mark (entry->rule.exe);if (IS_ERR (nentry)) {
Greg Kroah-Hartman
maintainerPATCH 56/235 ALSA: hda: Fix cached processing coefficient verbs
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Rao <[email protected]>
[ Upstream commit f67be28fdf8b5d31ac1cc1152bb17250f9f8f513 ]
Intel HD Audio defines Coefficient Index and Processing Coefficient as separate audio widget controls in the Audio Widget Verb Definitions:
Coefficient Index selects the coefficient slot, while Processing Coefficient accesses the value at the selected slot.
hda_reg_read_coef() selects the slot with AC_VERB_SET_COEF_INDEX, but then uses AC_VERB_GET_COEF_INDEX for the value read. That reads back the selected index instead of the coefficient value. hda_reg_write_coef() has the same issue and builds the value write from AC_VERB_GET_COEF_INDEX instead of AC_VERB_SET_PROC_COEF.
This only affects the regmap coefficient cache path used by codecs that set codec->cache_coef. Direct coefficient helpers already use the normal SET_COEF_INDEX followed by GET_PROC_COEF or SET_PROC_COEF sequence, which is likely why this has not been noticed widely.
Use AC_VERB_GET_PROC_COEF for cached coefficient reads and AC_VERB_SET_PROC_COEF for cached coefficient writes.
--- sound/hda/hdac_regmap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/hda/hdac_regmap.c +2 -2
@@ -215,7 +215,7 @@ static int hda_reg_read_coef(struct hdac err =snd_hdac_exec_verb (codec, verb,0 ,NULL );if (err <0 )return err; - verb = (reg & ~0xfffff ) | (AC_VERB_GET_COEF_INDEX <<8 ); + verb = (reg & ~0xfffff ) | (AC_VERB_GET_PROC_COEF <<8 );return snd_hdac_exec_verb (codec, verb,0 , val); }
@@ -233,7 +233,7 @@ static int hda_reg_write_coef(struct hda err =snd_hdac_exec_verb (codec, verb,0 ,NULL );if (err <0 )return err; - verb = (reg & ~0xfffff ) | (AC_VERB_GET_COEF_INDEX <<8 ) | + verb = (reg & ~0xfffff ) | (AC_VERB_SET_PROC_COEF <<8 ) | (val &0xffff );return snd_hdac_exec_verb (codec, verb,0 ,NULL ); }
Greg Kroah-Hartman
maintainerPATCH 57/235 serial: max310x: replace bare use of unsigned with unsigned int (checkpatch)
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hugo Villeneuve <[email protected]>
[ Upstream commit 79b69eb09cf5b6a77e621b2838b7e0d38113debb ]
Fixes the following checkpatch warnings:
WARNING: Prefer 'unsigned int' to bare use of 'unsigned'
With this change, the affected functions now match the prototypes in struct gpio_chip.
Stable-dep-of: a483b1a91b33 ("serial: max310x: implement gpio_chip::get_direction()")
--- drivers/tty/serial/max310x.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/tty/serial/max310x.c +4 -4
@@ -1215,7 +1215,7 @@ static int __maybe_unused max310x_resume static SIMPLE_DEV_PM_OPS(max310x_pm_ops, max310x_suspend, max310x_resume);#ifdef CONFIG_GPIOLIB -static int max310x_gpio_get (struct gpio_chip *chip,unsigned offset) +static int max310x_gpio_get (struct gpio_chip *chip,unsigned int offset) {unsigned int val;struct max310x_port *s =gpiochip_get_data (chip);
@@ -1226,7 +1226,7 @@ static int max310x_gpio_get(struct gpio_return !!((val >>4 ) & (1 << (offset %4 ))); } -static void max310x_gpio_set (struct gpio_chip *chip,unsigned offset,int value) +static void max310x_gpio_set (struct gpio_chip *chip,unsigned int offset,int value) {struct max310x_port *s =gpiochip_get_data (chip);struct uart_port *port = &s->p[offset /4 ].port;
@@ -1235,7 +1235,7 @@ static void max310x_gpio_set(struct gpio value ? 1 << (offset % 4) : 0); } -static int max310x_gpio_direction_input (struct gpio_chip *chip,unsigned offset) +static int max310x_gpio_direction_input (struct gpio_chip *chip,unsigned int offset) {struct max310x_port *s =gpiochip_get_data (chip);struct uart_port *port = &s->p[offset /4 ].port;
@@ -1246,7 +1246,7 @@ static int max310x_gpio_direction_input( }static int max310x_gpio_direction_output (struct gpio_chip *chip, -unsigned offset,int value) +unsigned int offset,int value) {struct max310x_port *s =gpiochip_get_data (chip);struct uart_port *port = &s->p[offset /4 ].port;
Greg Kroah-Hartman
maintainerPATCH 58/235 serial: max310x: implement gpio_chip::get_direction()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tapio Reijonen <[email protected]>
[ Upstream commit a483b1a91b33b7533280e7c3efd2bc1275caef18 ]
It's strongly recommended for GPIO drivers to always implement the .get_direction() callback - even when the direction is tracked in software. The GPIO core emits a warning when the callback is missing and a user reads the direction of a line, e.g. via /sys/kernel/debug/gpio.
The MAX310X keeps the GPIO direction in the GPIOCFG register (a set bit selects output), which the existing direction_input/output callbacks already program, so the current direction can be read back directly.
--- drivers/tty/serial/max310x.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/tty/serial/max310x.c +12 -0
@@ -1235,6 +1235,17 @@ static void max310x_gpio_set(struct gpio value ? 1 << (offset % 4) : 0); } +static int max310x_gpio_get_direction (struct gpio_chip *chip,unsigned int offset) +{ +struct max310x_port *s =gpiochip_get_data (chip); +struct uart_port *port = &s->p[offset /4 ].port; +unsigned int val; + + val =max310x_port_read (port,MAX310X_GPIOCFG_REG ); + +return val &BIT (offset %4 ) ?GPIO_LINE_DIRECTION_OUT :GPIO_LINE_DIRECTION_IN ; +} +static int max310x_gpio_direction_input (struct gpio_chip *chip,unsigned int offset) {struct max310x_port *s =gpiochip_get_data (chip);
@@ -1441,6 +1452,7 @@ static int max310x_probe(struct device * s->gpio.owner =THIS_MODULE ; s->gpio.parent = dev; s->gpio.label = devtype->name; + s->gpio.get_direction = max310x_gpio_get_direction; s->gpio.direction_input = max310x_gpio_direction_input; s->gpio.get = max310x_gpio_get; s->gpio.direction_output= max310x_gpio_direction_output;
Greg Kroah-Hartman
maintainerPATCH 59/235 rxrpc: serialize kernel accept preallocation with socket teardown
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Daming <[email protected]>
[ Upstream commit dc175389b18c29a5303ee83169ec653adfae3e17 ]
rxrpc_kernel_charge_accept() reads rx->backlog without any socket/backlog synchronization and passes that raw pointer into rxrpc_service_prealloc_one(). A concurrent rxrpc_discard_prealloc() sets rx->backlog = NULL and frees the backlog rings, so a kernel preallocation worker can keep using a freed struct rxrpc_backlog while updating *_backlog_head/tail and array slots.
Serialize the state check and backlog lookup with the socket lock, and reject kernel preallocation once teardown has disabled listening or discarded the service backlog.
--- net/rxrpc/call_accept.c | 27 ++++++++++++++++++++------- 1 file changed, 20 insertions(+), 7 deletions(-)
net/rxrpc/call_accept.c +20 -7
@@ -481,14 +481,27 @@ int rxrpc_kernel_charge_accept(struct so unsigned long user_call_ID, gfp_t gfp, unsigned int debug_id) { - struct rxrpc_sock *rx = rxrpc_sk(sock->sk); -struct rxrpc_backlog *b = rx->backlog; + struct rxrpc_backlog *b; +struct rxrpc_sock *rx; +struct sock *sk; +int ret; -if (sock->sk->sk_state ==RXRPC_CLOSE ) -return -ESHUTDOWN ; + sk = sock->sk; + rx =rxrpc_sk (sk); -return rxrpc_service_prealloc_one (rx, b, notify_rx, - user_attach_call, user_call_ID, - gfp, debug_id); +lock_sock (sk); +if (sk->sk_state !=RXRPC_SERVER_LISTENING || !rx->backlog) { + ret = -ESHUTDOWN ; + goto out; + } + + b = rx->backlog; + ret =rxrpc_service_prealloc_one (rx, b, notify_rx, + user_attach_call, user_call_ID, + gfp, debug_id); + +out: +release_sock (sk); +return ret; }EXPORT_SYMBOL (rxrpc_kernel_charge_accept);
Greg Kroah-Hartman
maintainerPATCH 60/235 tipc: restrict socket queue dumps in enqueue tracepoints
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Xiasong <[email protected]>
[ Upstream commit acd7df8d955480a6f6e5bb809da67b1500cc3cf4 ]
tipc_sk_enqueue() runs with sk->sk_lock.slock held while the socket is owned by user context. The spinlock protects the backlog queue in this path, but it does not serialize against the socket owner consuming or purging sk_receive_queue.
KASAN reported:
CPU: 14 UID: 0 PID: 1050 Comm: tipc3 Not tainted 7.1.0-rc6+ #126 PREEMPT(lazy)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x76/0xa0 lib/dump_stack.c:123
print_report+0xce/0x5b0 mm/kasan/report.c:482
kasan_report+0xc6/0x100 mm/kasan/report.c:597
__asan_report_load4_noabort+0x14/0x30 mm/kasan/report_generic.c:380
tipc_skb_dump+0x1327/0x16f0 net/tipc/trace.c:73
tipc_list_dump+0x208/0x2e0 net/tipc/trace.c:187
tipc_sk_dump+0xaf6/0xd60 net/tipc/socket.c:3996
trace_event_raw_event_tipc_sk_class+0x312/0x5a0 net/tipc/trace.h:188
tipc_sk_rcv+0xb1d/0x1d50 net/tipc/socket.c:2497
tipc_node_xmit+0x1c3/0x1440 net/tipc/node.c:1689
__tipc_sendmsg+0x97a/0x1440 net/tipc/socket.c:1512
tipc_sendmsg+0x52/0x80 net/tipc/socket.c:1400
sock_sendmsg+0x2f6/0x3e0 net/socket.c:825
splice_to_socket+0x7f9/0x1010 fs/splice.c:884
do_splice+0xe21/0x2330 fs/splice.c:936
__do_splice+0x153/0x260 fs/splice.c:1431
__x64_sys_splice+0x150/0x230 fs/splice.c:1616
x64_sys_call+0xeb5/0x2790 arch/x86/entry/syscall_64.c:41
do_syscall_64+0xf3/0x620 arch/x86/entry/syscall_64.c:63
entry_SYSCALL_64_after_hwframe+0x76/0x7e arch/x86/entry/entry_64.S:130
RIP: 0033:0x71624e8aafe2
Code: 08 0f 85 71 3a ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 66 2e 0f 1f 84 00 00 00 00 00 66
RSP: 002b:0000716157ffed68 EFLAGS: 00000246 ORIG_RAX: 0000000000000113
RAX: ffffffffffffffda RBX: 0000716157fff6c0 RCX: 000071624e8aafe2
RDX: 000000000000005f RSI: 0000000000000000 RDI: 0000000000000066
RBP: 0000716157ffed90 R08: 0000000000008000 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffff00
R13: 0000000000000021 R14: 0000000000000000 R15: 00007fff89799c40
</TASK>The TIPC_DUMP_ALL tracepoints in tipc_sk_enqueue() also dump sk_receive_queue and can therefore dereference skbs that the socket owner has already dequeued or freed. Restrict these dumps to TIPC_DUMP_SK_BKLGQ, which matches the queue protected by the held spinlock.
Keep the change limited to the enqueue path, where the unsafe queue dump is reachable while the socket is owned by user context.
--- net/tipc/socket.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/tipc/socket.c +3 -3
@@ -2455,17 +2455,17 @@ static void tipc_sk_enqueue(struct sk_buatomic_set (dcnt,0 ); lim =rcvbuf_limit (sk, skb) +atomic_read (dcnt);if (likely (!sk_add_backlog (sk, skb, lim))) { -trace_tipc_sk_overlimit1 (sk, skb,TIPC_DUMP_ALL , +trace_tipc_sk_overlimit1 (sk, skb,TIPC_DUMP_SK_BKLGQ ,"bklg & rcvq >90% allocated!" );continue ; } -trace_tipc_sk_dump (sk, skb,TIPC_DUMP_ALL ,"err_overload!" ); +trace_tipc_sk_dump (sk, skb,TIPC_DUMP_SK_BKLGQ ,"err_overload!" );/* Overload => reject message back to sender */ onode =tipc_own_addr (sock_net (sk));atomic_inc (&sk->sk_drops);if (tipc_msg_reverse (onode, &skb,TIPC_ERR_OVERLOAD )) { -trace_tipc_sk_rej_msg (sk, skb,TIPC_DUMP_ALL , +trace_tipc_sk_rej_msg (sk, skb,TIPC_DUMP_SK_BKLGQ ,"@sk_enqueue!" );__skb_queue_tail (xmitq, skb); }
Greg Kroah-Hartman
maintainerPATCH 61/235 rxrpc: Fix recv-recv race of completed call
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit 962fb1f651c2cf2083e0c3ef53ba69e3b96d3fbc ]
If a call receives an event (such as incoming data), the call gets placed on the socket's queue and a thread in recvmsg can be awakened to go and process it. Once the thread has picked up the call off of the queue, further events will cause it to be requeued, and once the socket lock is dropped (recvmsg uses call->user_mutex to allow the socket to be used in parallel), a second thread can come in and its recvmsg can pop the call off the socket queue again.
In such a case, the first thread will be receiving stuff from the call and the second thread will be blocked on call->user_mutex. The first thread can, at this point, process both the event that it picked call for and the event that the second thread picked the call for and may see the call terminate - in which case the call will be "released", decoupling the call from the user call ID assigned to it (RXRPC_USER_CALL_ID in the control message).
The first thread will return okay, but then the second thread will wake up holding the user_mutex and, if it sees that the call has been released by the first thread, it will BUG thusly:
kernel BUG at net/rxrpc/recvmsg.c:474!
Fix this by just dequeuing the call and ignoring it if it is seen to be already released. We can't tell userspace about it anyway as the user call ID has become stale.
Stable-dep-of: e66f8f32f501 ("rxrpc: Fix socket notification race")
--- include/trace/events/rxrpc.h | 2 ++ net/rxrpc/call_accept.c | 1 + net/rxrpc/recvmsg.c | 19 +++++++++++++++++-- 3 files changed, 20 insertions(+), 2 deletions(-)
include/trace/events/rxrpc.h +2 -0
@@ -134,6 +134,7 @@ enum rxrpc_recvmsg_trace { rxrpc_recvmsg_return, rxrpc_recvmsg_terminal, rxrpc_recvmsg_to_be_accepted, + rxrpc_recvmsg_unqueue, rxrpc_recvmsg_wait, };
@@ -333,6 +334,7 @@ enum rxrpc_tx_point { EM(rxrpc_recvmsg_return, "RETN") \ EM(rxrpc_recvmsg_terminal, "TERM") \ EM(rxrpc_recvmsg_to_be_accepted, "TBAC") \ + EM(rxrpc_recvmsg_unqueue, "UNQU") \ E_(rxrpc_recvmsg_wait, "WAIT")#define rxrpc_rtt_tx_traces \
net/rxrpc/call_accept.c +1 -0
@@ -220,6 +220,7 @@ void rxrpc_discard_prealloc(struct rxrpc tail = b->call_backlog_tail;while (CIRC_CNT (head, tail, size) >0 ) {struct rxrpc_call *call = b->call_backlog[tail]; +rxrpc_see_call (call);rcu_assign_pointer (call->socket, rx);if (rx->discard_new_call) {_debug ("discard %lx" , call->user_call_ID);
net/rxrpc/recvmsg.c +17 -2
@@ -546,6 +546,16 @@ try_again:write_lock_bh (&rx->recvmsg_lock); l = rx->recvmsg_q.next; call = list_entry(l, struct rxrpc_call, recvmsg_link); + +rxrpc_see_call (call); +if (test_bit (RXRPC_CALL_RELEASED , &call->flags)) { +list_del_init (&call->recvmsg_link); +write_unlock_bh (&rx->recvmsg_lock); +release_sock (&rx->sk); +trace_rxrpc_recvmsg (call, rxrpc_recvmsg_unqueue,0 ,0 ,0 ,0 ); +rxrpc_put_call (call, rxrpc_call_put); + goto try_again; + }if (!(flags &MSG_PEEK ))list_del_init (&call->recvmsg_link);else
@@ -568,8 +578,13 @@ try_again:release_sock (&rx->sk); -if (test_bit (RXRPC_CALL_RELEASED , &call->flags)) -BUG (); +if (test_bit (RXRPC_CALL_RELEASED , &call->flags)) { +rxrpc_see_call (call); +mutex_unlock (&call->user_mutex); +if (!(flags &MSG_PEEK )) +rxrpc_put_call (call, rxrpc_call_put); + goto try_again; + }if (test_bit (RXRPC_CALL_HAS_USERID , &call->flags)) {if (flags &MSG_CMSG_COMPAT ) {
Greg Kroah-Hartman
maintainerPATCH 62/235 rxrpc: Fix notification vs call-release vs recvmsg
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit 2fd895842d49c23137ae48252dd211e5d6d8a3ed ]
When a call is released, rxrpc takes the spinlock and removes it from ->recvmsg_q in an effort to prevent racing recvmsg() invocations from seeing the same call. Now, rxrpc_recvmsg() only takes the spinlock when actually removing a call from the queue; it doesn't, however, take it in the lead up to that when it checks to see if the queue is empty. It *does* hold the socket lock, which prevents a recvmsg/recvmsg race - but this doesn't prevent sendmsg from ending the call because sendmsg() drops the socket lock and relies on the call->user_mutex.
Fix this by firstly removing the bit in rxrpc_release_call() that dequeues the released call and, instead, rely on recvmsg() to simply discard released calls (done in a preceding fix).
Secondly, rxrpc_notify_socket() is abandoned if the call is already marked as released rather than trying to be clever by setting both pointers in call->recvmsg_link to NULL to trick list_empty(). This isn't perfect and can still race, resulting in a released call on the queue, but recvmsg() will now clean that up.
Stable-dep-of: e66f8f32f501 ("rxrpc: Fix socket notification race")
--- net/rxrpc/call_object.c | 27 +++++++++++---------------- net/rxrpc/recvmsg.c | 4 ++++ 2 files changed, 15 insertions(+), 16 deletions(-)
net/rxrpc/call_object.c +11 -16
@@ -529,7 +529,6 @@ void rxrpc_release_call(struct rxrpc_soc {const void *here =__builtin_return_address (0 );struct rxrpc_connection *conn = call->conn; -bool put = false;_enter ("{%d,%d}" , call->debug_id,refcount_read (&call->ref));
@@ -547,23 +546,13 @@ void rxrpc_release_call(struct rxrpc_socrxrpc_put_call_slot (call);rxrpc_delete_call_timer (call); -/* Make sure we don't get any more notifications */ +/* Note that at this point, the call may still be on or may have been +* added back on to the socket receive queue. recvmsg() must discard +* released calls. The CALL_RELEASED flag should prevent further +* notifications. +*/ write_lock_bh (&rx->recvmsg_lock); - -if (!list_empty (&call->recvmsg_link)) { -_debug ("unlinking once-pending call %p { e=%lx f=%lx }" , - call, call->events, call->flags); -list_del (&call->recvmsg_link); - put = true; - } - -/* list_empty() must return false in rxrpc_notify_socket() */ - call->recvmsg_link.next =NULL ; - call->recvmsg_link.prev =NULL ; -write_unlock_bh (&rx->recvmsg_lock); -if (put) -rxrpc_put_call (call, rxrpc_call_put);write_lock (&rx->call_lock);
@@ -612,6 +601,12 @@ void rxrpc_release_calls_on_socket(strucrxrpc_put_call (call, rxrpc_call_put); } +while ((call =list_first_entry_or_null (&rx->recvmsg_q, + struct rxrpc_call, recvmsg_link))) { +list_del_init (&call->recvmsg_link); +rxrpc_put_call (call, rxrpc_call_put); + } +_leave ("" ); }
net/rxrpc/recvmsg.c +4 -0
@@ -29,6 +29,10 @@ void rxrpc_notify_socket(struct rxrpc_caif (!list_empty (&call->recvmsg_link))return ; +if (test_bit (RXRPC_CALL_RELEASED , &call->flags)) { +rxrpc_see_call (call); +return ; + }rcu_read_lock ();
Greg Kroah-Hartman
maintainerPATCH 63/235 rxrpc: Fix socket notification race
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit e66f8f32f50116670dbbee5bc9e692cd2cd0c8f8 ]
There's a race between rxrpc_recvmsg() and rxrpc_notify_socket(), whereby the latter's attempt to avoid disabling interrupts and taking the socket's recvmsg_lock if the call is already queued may happen simultaneously with the former's discarding of a call that has nothing queued.
Fix this by removing the shortcut. Note that this only affects userspace's use of AF_RXRPC; the AFS filesystem driver doesn't use the socket queue.
--- net/rxrpc/recvmsg.c | 2 -- 1 file changed, 2 deletions(-)
net/rxrpc/recvmsg.c +0 -2
@@ -27,8 +27,6 @@ void rxrpc_notify_socket(struct rxrpc_ca_enter ("%d" , call->debug_id); -if (!list_empty (&call->recvmsg_link)) -return ;if (test_bit (RXRPC_CALL_RELEASED , &call->flags)) {rxrpc_see_call (call);return ;
Greg Kroah-Hartman
maintainerPATCH 64/235 mlxsw: spectrum: Apply RIF configuration when joining a LAG
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 31e1de4f1242f338eaa62cc53d582116c83b9dd0 ]
In case a router interface (RIF) is configured for a LAG, make sure its configuration is applied on the new LAG member.
Stable-dep-of: 41c8c1d65b32 ("mlxsw: fix refcount leak in mlxsw_sp_port_lag_join()")
--- drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 17 ++++++++- drivers/net/ethernet/mellanox/mlxsw/spectrum.h | 4 ++ drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 31 +++++++++++++++--- 3 files changed, 45 insertions(+), 7 deletions(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum.c +15 -2
@@ -3550,7 +3550,8 @@ static int mlxsw_sp_port_lag_index_get(s }static int mlxsw_sp_port_lag_join (struct mlxsw_sp_port *mlxsw_sp_port, -struct net_device *lag_dev) +struct net_device *lag_dev, +struct netlink_ext_ack *extack) {struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;struct mlxsw_sp_upper *lag;
@@ -3586,8 +3587,20 @@ static int mlxsw_sp_port_lag_join(structif (mlxsw_sp_port->default_vlan->fid)mlxsw_sp_port_vlan_router_leave (mlxsw_sp_port->default_vlan); +/* Join a router interface configured on the LAG, if exists */ + err =mlxsw_sp_port_vlan_router_join (mlxsw_sp_port->default_vlan, + lag_dev, extack); +if (err) + goto err_router_join; +return 0 ; +err_router_join: + lag->ref_count--; + mlxsw_sp_port->lagged =0 ; +mlxsw_core_lag_mapping_clear (mlxsw_sp->core, lag_id, + mlxsw_sp_port->local_port); +mlxsw_sp_lag_col_port_remove (mlxsw_sp_port, lag_id); err_col_port_add:if (!lag->ref_count)mlxsw_sp_lag_destroy (mlxsw_sp, lag_id);
@@ -3920,7 +3933,7 @@ static int mlxsw_sp_netdevice_port_upper }else if (netif_is_lag_master (upper_dev)) {if (info->linking) { err =mlxsw_sp_port_lag_join (mlxsw_sp_port, - upper_dev); + upper_dev, extack); }else {mlxsw_sp_port_lag_col_dist_disable (mlxsw_sp_port); mlxsw_sp_port_lag_leave(mlxsw_sp_port,
drivers/net/ethernet/mellanox/mlxsw/spectrum.h +4 -0
@@ -665,6 +665,10 @@ mlxsw_sp_netdevice_ipip_ul_event(structstruct net_device *l3_dev, unsigned long event, struct netdev_notifier_info *info); +int +mlxsw_sp_port_vlan_router_join (struct mlxsw_sp_port_vlan *mlxsw_sp_port_vlan, +struct net_device *l3_dev, +struct netlink_ext_ack *extack);void mlxsw_sp_port_vlan_router_leave (struct mlxsw_sp_port_vlan *mlxsw_sp_port_vlan); void mlxsw_sp_rif_destroy_by_dev(struct mlxsw_sp *mlxsw_sp,
drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +26 -5
@@ -6676,9 +6676,9 @@ static void mlxsw_sp_rif_subport_put(str }static int -mlxsw_sp_port_vlan_router_join (struct mlxsw_sp_port_vlan *mlxsw_sp_port_vlan, -struct net_device *l3_dev, -struct netlink_ext_ack *extack) +__mlxsw_sp_port_vlan_router_join (struct mlxsw_sp_port_vlan *mlxsw_sp_port_vlan, +struct net_device *l3_dev, +struct netlink_ext_ack *extack) {struct mlxsw_sp_port *mlxsw_sp_port = mlxsw_sp_port_vlan->mlxsw_sp_port;struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
@@ -6743,6 +6743,27 @@ __mlxsw_sp_port_vlan_router_leave(structmlxsw_sp_rif_subport_put (rif); } +int +mlxsw_sp_port_vlan_router_join (struct mlxsw_sp_port_vlan *mlxsw_sp_port_vlan, +struct net_device *l3_dev, +struct netlink_ext_ack *extack) +{ +struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port_vlan->mlxsw_sp_port->mlxsw_sp; +struct mlxsw_sp_rif *rif; +int err =0 ; + +mutex_lock (&mlxsw_sp->router->lock); + rif =mlxsw_sp_rif_find_by_dev (mlxsw_sp, l3_dev); +if (!rif) + goto out; + + err =__mlxsw_sp_port_vlan_router_join (mlxsw_sp_port_vlan, l3_dev, + extack); +out: +mutex_unlock (&mlxsw_sp->router->lock); +return err; +} +void mlxsw_sp_port_vlan_router_leave (struct mlxsw_sp_port_vlan *mlxsw_sp_port_vlan) {
@@ -6767,8 +6788,8 @@ static int mlxsw_sp_inetaddr_port_vlan_eswitch (event) {case NETDEV_UP : -return mlxsw_sp_port_vlan_router_join (mlxsw_sp_port_vlan, - l3_dev, extack); +return __mlxsw_sp_port_vlan_router_join (mlxsw_sp_port_vlan, + l3_dev, extack);case NETDEV_DOWN :__mlxsw_sp_port_vlan_router_leave (mlxsw_sp_port_vlan);break ;
Greg Kroah-Hartman
maintainerPATCH 65/235 mlxsw: spectrum: On port enslavement to a LAG, join uppers bridges
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Machata <[email protected]>
[ Upstream commit 987c7782f0627e1c87617458806a7e6c1995678a ]
Currently it never happens that a netdevice that is already a bridge slave would suddenly become mlxsw upper. The only case where this might be possible as far as mlxsw is concerned, is with LAG netdevices. But if a LAG already has an upper, enslaving mlxsw port to that LAG is forbidden. Thus the only way to install a LAG between a bridge and a mlxsw port is by first enslaving the port to the LAG, and then enslaving that LAG to a bridge.
However in the following patches, the requirement that ports be only enslaved to masters without uppers, is going to be relaxed. It will therefore be necessary to join bridges of LAG uppers. Without this replay, the mlxsw bridge_port objects are not instantiated, which causes issues later, as a lot of code relies on their presence.
Therefore in this patch, when the first mlxsw physical netdevice is enslaved to a LAG, consider bridges upper to the LAG (both the direct master, if any, and any bridge masters of VLAN uppers), and have the relevant netdevices join their bridges.
Stable-dep-of: 41c8c1d65b32 ("mlxsw: fix refcount leak in mlxsw_sp_port_lag_join()")
--- drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 90 +++++++++++++++++++++++++ 1 file changed, 90 insertions(+)
drivers/net/ethernet/mellanox/mlxsw/spectrum.c +90 -0
@@ -3549,6 +3549,88 @@ static int mlxsw_sp_port_lag_index_get(sreturn -EBUSY ; } +static int mlxsw_sp_lag_uppers_bridge_join (struct mlxsw_sp_port *mlxsw_sp_port, +struct net_device *lag_dev, +struct netlink_ext_ack *extack) +{ +struct net_device *upper_dev; +struct net_device *master; +struct list_head *iter; +int done =0 ; +int err; + + master =netdev_master_upper_dev_get (lag_dev); +if (master &&netif_is_bridge_master (master)) { + err =mlxsw_sp_port_bridge_join (mlxsw_sp_port, lag_dev, master, + extack); +if (err) +return err; + } + +netdev_for_each_upper_dev_rcu (lag_dev, upper_dev, iter) { +if (!is_vlan_dev (upper_dev)) +continue ; + + master =netdev_master_upper_dev_get (upper_dev); +if (master &&netif_is_bridge_master (master)) { + err =mlxsw_sp_port_bridge_join (mlxsw_sp_port, + upper_dev, master, + extack); +if (err) + goto err_port_bridge_join; + } + + ++done; + } + +return 0 ; + +err_port_bridge_join: +netdev_for_each_upper_dev_rcu (lag_dev, upper_dev, iter) { +if (!is_vlan_dev (upper_dev)) +continue ; + + master =netdev_master_upper_dev_get (upper_dev); +if (!master || !netif_is_bridge_master (master)) +continue ; + +if (!done--) +break ; + +mlxsw_sp_port_bridge_leave (mlxsw_sp_port, upper_dev, master); + } + + master =netdev_master_upper_dev_get (lag_dev); +if (master &&netif_is_bridge_master (master)) +mlxsw_sp_port_bridge_leave (mlxsw_sp_port, lag_dev, master); + +return err; +} + +static void +mlxsw_sp_lag_uppers_bridge_leave (struct mlxsw_sp_port *mlxsw_sp_port, +struct net_device *lag_dev) +{ +struct net_device *upper_dev; +struct net_device *master; +struct list_head *iter; + +netdev_for_each_upper_dev_rcu (lag_dev, upper_dev, iter) { +if (!is_vlan_dev (upper_dev)) +continue ; + + master =netdev_master_upper_dev_get (upper_dev); +if (!master) +continue ; + +mlxsw_sp_port_bridge_leave (mlxsw_sp_port, upper_dev, master); + } + + master =netdev_master_upper_dev_get (lag_dev); +if (master) +mlxsw_sp_port_bridge_leave (mlxsw_sp_port, lag_dev, master); +} +static int mlxsw_sp_port_lag_join (struct mlxsw_sp_port *mlxsw_sp_port,struct net_device *lag_dev,struct netlink_ext_ack *extack)
@@ -3573,6 +3655,12 @@ static int mlxsw_sp_port_lag_join(struct err =mlxsw_sp_port_lag_index_get (mlxsw_sp, lag_id, &port_index);if (err)return err; + + err =mlxsw_sp_lag_uppers_bridge_join (mlxsw_sp_port, lag_dev, + extack); +if (err) + goto err_lag_uppers_bridge_join; + err =mlxsw_sp_lag_col_port_add (mlxsw_sp_port, lag_id, port_index);if (err) goto err_col_port_add;
@@ -3602,6 +3690,8 @@ err_router_join: mlxsw_sp_port->local_port);mlxsw_sp_lag_col_port_remove (mlxsw_sp_port, lag_id); err_col_port_add: +mlxsw_sp_lag_uppers_bridge_leave (mlxsw_sp_port, lag_dev); +err_lag_uppers_bridge_join:if (!lag->ref_count)mlxsw_sp_lag_destroy (mlxsw_sp, lag_id);return err;
Greg Kroah-Hartman
maintainerPATCH 66/235 mlxsw: fix refcount leak in mlxsw_sp_port_lag_join()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <[email protected]>
[ Upstream commit 41c8c1d65b32beacd8d916a22457b4f6e47f45af ]
When mlxsw_sp_port_lag_index_get() fails, mlxsw_sp_port_lag_join() returns an error without releasing the lag reference obtained by the earlier mlxsw_sp_lag_get(). All other error paths in the function jump to the cleanup label that ends with mlxsw_sp_lag_put(), so this is a single missed release.
Fix the leak by replacing the bare 'return err' with a goto to the existing error cleanup label, which will drop the reference safely.
--- drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum.c +1 -1
@@ -3654,7 +3654,7 @@ static int mlxsw_sp_port_lag_join(struct err =mlxsw_sp_port_lag_index_get (mlxsw_sp, lag_id, &port_index);if (err) -return err; + goto err_lag_uppers_bridge_join; err =mlxsw_sp_lag_uppers_bridge_join (mlxsw_sp_port, lag_dev, extack);
Greg Kroah-Hartman
maintainerPATCH 67/235 octeontx2: Annotate mmio regions as __iomem
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Subbaraya Sundeep <[email protected]>
[ Upstream commit d0976b43956ee8c8bd093223df9115bfcf63dfe5 ]
This patch removes unnecessary typecasts by marking the mbox_regions array as __iomem since it is used to store pointers to memory-mapped I/O (MMIO) regions. Also simplified the call to readq() in PF driver by removing redundant type casts.
Stable-dep-of: f918554fb724 ("octeontx2-pf: clear stale mailbox IRQ state before request_irq()")
--- drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +1 -1
@@ -593,7 +593,7 @@ static int otx2_pfvf_mbox_init(struct otif (!pf->mbox_pfvf_wq)return -ENOMEM ; - base =readq ((void __iomem *)((u64 )pf->reg_base +RVU_PF_VF_BAR4_ADDR )); + base =readq (pf->reg_base +RVU_PF_VF_BAR4_ADDR ); hwbase =ioremap_wc (base,MBOX_SIZE * pf->total_vfs);if (!hwbase) {
Greg Kroah-Hartman
maintainerPATCH 68/235 octeontx2-pf: clear stale mailbox IRQ state before request_irq()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <[email protected]>
[ Upstream commit f918554fb7246e89b98ef90abe80801f038258b3 ]
otx2_register_mbox_intr() currently installs the PF mailbox IRQ handler before clearing stale mailbox interrupt state. The function itself then comments that the local interrupt bits must be cleared first to avoid spurious interrupts, but that clear happens only after request_irq() has already exposed the handler to irq delivery.
A running system can reach this during PF mailbox interrupt registration while stale or latched RVU_PF_INT state is still present. If delivery happens in the request_irq()-to-clear window, otx2_pfaf_mbox_intr_handler() can run before local quiesce and touch the same pf->mbox and pf->mbox_wq carrier that probe and teardown later reuse or destroy.
Move the stale mailbox interrupt clear ahead of request_irq(), but keep interrupt enabling after the handler is installed. This closes the pre-clear early-IRQ window without creating a new enable-before-handler window.
--- drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +4 -4
@@ -979,6 +979,9 @@ static int otx2_register_mbox_intr(strucchar *irq_name;int err; +/* Clear stale mailbox interrupt state before installing the handler. */ +otx2_write64 (pf,RVU_PF_INT ,BIT_ULL (0 )); +/* Register mailbox interrupt handler */ irq_name = &hw->irq_name[RVU_PF_INT_VEC_AFPF_MBOX *NAME_SIZE ];snprintf (irq_name,NAME_SIZE ,"RVUPFAF Mbox" );
@@ -990,10 +993,7 @@ static int otx2_register_mbox_intr(strucreturn err; } -/* Enable mailbox interrupt for msgs coming from AF. -* First clear to avoid spurious interrupts, if any. -*/ -otx2_write64 (pf,RVU_PF_INT ,BIT_ULL (0 )); +/* Enable mailbox interrupt for msgs coming from AF. */ otx2_write64 (pf,RVU_PF_INT_ENA_W1S ,BIT_ULL (0 ));if (!probe_af)
Greg Kroah-Hartman
maintainerPATCH 69/235 ASoC: mediatek: mt8183: Check runtime resume during probe
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <[email protected]>
[ Upstream commit f0334fbfd107682d0c95f3f71e25f6127038e2b9 ]
The MT8183 AFE probe uses pm_runtime_get_sync() before reading hardware defaults into the regmap cache, but does not check whether runtime resume failed. If regmap_reinit_cache() then fails, the temporary runtime PM usage count is also not released.
Use pm_runtime_resume_and_get() so resume failures abort probe without leaking a usage count, and release the temporary reference before handling the regmap cache result.
--- sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
sound/soc/mediatek/mt8183/mt8183-afe-pcm.c +8 -4
@@ -1143,17 +1143,21 @@ static int mt8183_afe_pcm_dev_probe(stru/* enable clock for regcache get default value from hw */ afe_priv->pm_runtime_bypass_reg_ctl = true; -pm_runtime_get_sync (&pdev->dev); + ret =pm_runtime_resume_and_get (dev); +if (ret) { + afe_priv->pm_runtime_bypass_reg_ctl = false; + goto err_pm_disable; + } ret =regmap_reinit_cache (afe->regmap, &mt8183_afe_regmap_config); +pm_runtime_put_sync (dev); + afe_priv->pm_runtime_bypass_reg_ctl = false; +if (ret) {dev_err (dev,"regmap_reinit_cache fail, ret %d\n" , ret); goto err_pm_disable; } -pm_runtime_put_sync (&pdev->dev); - afe_priv->pm_runtime_bypass_reg_ctl = false; -regcache_cache_only (afe->regmap, true);regcache_mark_dirty (afe->regmap);
Greg Kroah-Hartman
maintainerPATCH 70/235 octeontx2-vf: clear stale mailbox IRQ state before request_irq()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <[email protected]>
[ Upstream commit 0b352f04b9be2c83c0240aa6dae7257fefa90464 ]
otx2vf_register_mbox_intr() currently installs the VF mailbox IRQ handler before clearing stale mailbox interrupt state. The code then says that local interrupt bits should be cleared first to avoid spurious interrupts, but that clear still happens only after request_irq() has already made the handler reachable.
A running system can reach this during VF mailbox interrupt registration while stale or latched RVU_VF_INT state is still present. If delivery happens in the request_irq()-to-clear window, otx2vf_vfaf_mbox_intr_handler() can run before local quiesce and touch the same vf->mbox and vf->mbox_wq carrier that probe and teardown later reuse or destroy.
Move the stale mailbox interrupt clear ahead of request_irq(), but keep interrupt enabling after the handler is installed. This closes the pre-clear early-IRQ window without creating a new enable-before-handler window.
--- drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c +4 -4
@@ -230,6 +230,9 @@ static int otx2vf_register_mbox_intr(strchar *irq_name;int err; +/* Clear stale mailbox interrupt state before installing the handler. */ +otx2_write64 (vf,RVU_VF_INT ,BIT_ULL (0 )); +/* Register mailbox interrupt handler */ irq_name = &hw->irq_name[RVU_VF_INT_VEC_MBOX *NAME_SIZE ];snprintf (irq_name,NAME_SIZE ,"RVUVFAF Mbox" );
@@ -241,10 +244,7 @@ static int otx2vf_register_mbox_intr(strreturn err; } -/* Enable mailbox interrupt for msgs coming from PF. -* First clear to avoid spurious interrupts, if any. -*/ -otx2_write64 (vf,RVU_VF_INT ,BIT_ULL (0 )); +/* Enable mailbox interrupt for msgs coming from PF. */ otx2_write64 (vf,RVU_VF_INT_ENA_W1S ,BIT_ULL (0 ));if (!probe_pf)
Greg Kroah-Hartman
maintainerPATCH 71/235 netfilter: nf_conntrack_sip: remove net variable shadowing
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 7970d6aaf710db166de98c5356a260089896fae5 ]
net is already set, derived from nf_conn.
I don't see how the device could be living in a different netns than the conntrack entry.
Remove the extra variable and re-use existing one.
Stable-dep-of: e5e24a365a5e ("netfilter: nf_conntrack_sip: validate skb_dst() before accessing it")
--- net/netfilter/nf_conntrack_sip.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/netfilter/nf_conntrack_sip.c +1 -2
@@ -948,9 +948,8 @@ static int set_expected_rtp_rtcp(struct saddr = &ct->tuplehash[!dir].tuple.src.u3; }else if (sip_external_media) {struct net_device *dev =skb_dst (skb)->dev; -struct net *net =dev_net (dev); -struct flowi fl;struct dst_entry *dst =NULL ; +struct flowi fl;memset (&fl,0 ,sizeof (fl));
Greg Kroah-Hartman
maintainerPATCH 72/235 netfilter: nf_conntrack_sip: validate skb_dst() before accessing it
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit e5e24a365a5e024efef63cc49abb345fbd4852c5 ]
tc ingress and openvswitch do not guarantee routing information to be available. These subsystems use the conntrack helper infrastructure, and the SIP helper relies on the skb_dst() to be present if sip_external_media is set to 1 (which is disabled by default as a module parameter).
This effectively disables the sip_external_media toggle for these subsystems without resulting in a crash.
--- net/netfilter/nf_conntrack_sip.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
net/netfilter/nf_conntrack_sip.c +5 -2
@@ -947,7 +947,6 @@ static int set_expected_rtp_rtcp(structreturn NF_ACCEPT ; saddr = &ct->tuplehash[!dir].tuple.src.u3; }else if (sip_external_media) { -struct net_device *dev =skb_dst (skb)->dev;struct dst_entry *dst =NULL ;struct flowi fl;
@@ -969,7 +968,11 @@ static int set_expected_rtp_rtcp(struct* through the same interface as the signalling peer. */ if (dst) { -bool external_media = (dst->dev == dev); +const struct dst_entry *this_dst =skb_dst (skb); +bool external_media = false; + +if (this_dst && dst->dev == this_dst->dev) + external_media = true;dst_release (dst);if (external_media)
Greg Kroah-Hartman
maintainerPATCH 73/235 jbd2: add a helper to find out number of fast commit blocks
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harshad Shirwadkar <[email protected]>
[ Upstream commit 9bd23c31f392bda88618008f27fd52ee9e0fac38 ]
Add a helper to read number of fast commit blocks from jbd2 superblock and also rename the JBD2_MIN_FC_BLKS to JBD2_DEFAULT_FAST_COMMIT_BLOCKS since this constant is just the default number of fast commit blocks to use in case number of fast commit blocks isn't set in jbd2 superblock.
Stable-dep-of: 289a2ca0c9b7 ("jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()")
--- fs/jbd2/journal.c | 8 ++------ include/linux/jbd2.h | 9 ++++++++- 2 files changed, 10 insertions(+), 7 deletions(-)
fs/jbd2/journal.c +2 -6
@@ -1884,9 +1884,7 @@ static int load_superblock(journal_t *joif (jbd2_has_feature_fast_commit (journal)) { journal->j_fc_last =be32_to_cpu (sb->s_maxlen); - num_fc_blocks =be32_to_cpu (sb->s_num_fc_blks); -if (!num_fc_blocks) - num_fc_blocks =JBD2_MIN_FC_BLOCKS ; + num_fc_blocks =jbd2_journal_get_num_fc_blks (sb);if (journal->j_last - num_fc_blocks >=JBD2_MIN_JOURNAL_BLOCKS ) journal->j_last = journal->j_fc_last - num_fc_blocks; journal->j_fc_first = journal->j_last +1 ;
@@ -2117,9 +2115,7 @@ jbd2_journal_initialize_fast_commit(jourjournal_superblock_t *sb = journal->j_superblock;unsigned long long num_fc_blks; - num_fc_blks =be32_to_cpu (sb->s_num_fc_blks); -if (num_fc_blks ==0 ) - num_fc_blks =JBD2_MIN_FC_BLOCKS ; + num_fc_blks =jbd2_journal_get_num_fc_blks (sb);if (journal->j_last - num_fc_blks <JBD2_MIN_JOURNAL_BLOCKS )return -ENOSPC ;
include/linux/jbd2.h +8 -1
@@ -68,7 +68,7 @@ extern void *jbd2_alloc(size_t size, gfpextern void jbd2_free (void *ptr,size_t size);#define JBD2_MIN_JOURNAL_BLOCKS 1024 -#define JBD2_MIN_FC_BLOCKS 256 +#define JBD2_DEFAULT_FAST_COMMIT_BLOCKS 256#ifdef __KERNEL__
@@ -1686,6 +1686,13 @@ static inline int jbd2_journal_has_csum_return journal->j_chksum_driver !=NULL ; } +static inline int jbd2_journal_get_num_fc_blks (journal_superblock_t *jsb) +{ +int num_fc_blocks =be32_to_cpu (jsb->s_num_fc_blks); + +return num_fc_blocks ? num_fc_blocks :JBD2_DEFAULT_FAST_COMMIT_BLOCKS ; +} +/* * Return number of free blocks in the log. Must be called under j_state_lock. */
Greg Kroah-Hartman
maintainerPATCH 74/235 jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <[email protected]>
[ Upstream commit 289a2ca0c9b7eae74f93fc213b0b971669b8683d ]
jbd2_journal_initialize_fast_commit() validates journal capacity by checking (journal->j_last - num_fc_blks < JBD2_MIN_JOURNAL_BLOCKS). Both j_last and num_fc_blks are unsigned, so when num_fc_blks exceeds j_last the subtraction wraps to a large value, bypassing the bounds check.
The resulting underflow corrupts j_last, j_fc_first, and j_free, leading to journal abort.
Fix by checking num_fc_blks against j_last before the subtraction, returning -EFSCORRUPTED.
--- fs/jbd2/journal.c | 2 ++ 1 file changed, 2 insertions(+)
fs/jbd2/journal.c +2 -0
@@ -2116,6 +2116,8 @@ jbd2_journal_initialize_fast_commit(jourunsigned long long num_fc_blks; num_fc_blks =jbd2_journal_get_num_fc_blks (sb); +if (num_fc_blks > journal->j_last) +return -EFSCORRUPTED ;if (journal->j_last - num_fc_blks <JBD2_MIN_JOURNAL_BLOCKS )return -ENOSPC ;
Greg Kroah-Hartman
maintainerPATCH 75/235 netfilter: nft_set_pipapo: use GFP_KERNEL for insertions
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 5b651783d80b97167ecd27dc6a4408c694873902 ]
An earlier attempt changed this to GFP_KERNEL, but the get helper is also called for get requests from userspace, which uses rcu.
Let the caller pass in the kmalloc flags to allow insertions to schedule if needed.
Stable-dep-of: 47e65eff5069 ("netfilter: nft_set_pipapo: don't leak bad clone into future transaction")
--- net/netfilter/nft_set_pipapo.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-)
net/netfilter/nft_set_pipapo.c +10 -7
@@ -505,6 +505,7 @@ out:* @data: Key data to be matched against existing elements * @genmask: If set, check that element is active in given genmask * @tstamp: timestamp to check for expired elements +* @gfp: the type of memory to allocate (see kmalloc). * * This is essentially the same as the lookup function, except that it matches * key data against the uncommitted copy and doesn't use preallocated maps for
@@ -515,7 +516,7 @@ out:static struct nft_pipapo_elem *pipapo_get (const struct net *net,const struct nft_set *set,const u8 *data,u8 genmask, -u64 tstamp) +u64 tstamp,gfp_t gfp) {struct nft_pipapo_elem *ret =ERR_PTR (-ENOENT );struct nft_pipapo *priv =nft_set_priv (set);
@@ -527,13 +528,13 @@ static struct nft_pipapo_elem *pipapo_geif (m->bsize_max ==0 )return ret; - res_map =kmalloc_array (m->bsize_max,sizeof (*res_map),GFP_ATOMIC ); + res_map =kmalloc_array (m->bsize_max,sizeof (*res_map), gfp);if (!res_map) { ret =ERR_PTR (-ENOMEM ); goto out; } - fill_map =kcalloc (m->bsize_max,sizeof (*res_map),GFP_ATOMIC ); + fill_map =kcalloc (m->bsize_max,sizeof (*res_map), gfp);if (!fill_map) { ret =ERR_PTR (-ENOMEM ); goto out;
@@ -608,7 +609,7 @@ static void *nft_pipapo_get(const struct const struct nft_set_elem *elem, unsigned int flags) { return pipapo_get(net, set, (const u8 *)elem->key.val.data, - nft_genmask_cur(net), get_jiffies_64()); + nft_genmask_cur(net), get_jiffies_64(), GFP_ATOMIC); }/**
@@ -1217,7 +1218,7 @@ static int nft_pipapo_insert(const strucelse end = start; - dup =pipapo_get (net, set, start, genmask, tstamp); + dup =pipapo_get (net, set, start, genmask, tstamp,GFP_KERNEL );if (!IS_ERR (dup)) {/* Check if we already have the same exact entry */ const struct nft_data *dup_key, *dup_end;
@@ -1239,7 +1240,8 @@ static int nft_pipapo_insert(const strucif (PTR_ERR (dup) == -ENOENT ) {/* Look for partially overlapping entries */ - dup =pipapo_get (net, set, end,nft_genmask_next (net), tstamp); + dup =pipapo_get (net, set, end,nft_genmask_next (net), tstamp, +GFP_KERNEL ); }if (PTR_ERR (dup) != -ENOENT ) {
@@ -1814,7 +1816,8 @@ static void *pipapo_deactivate(const str {struct nft_pipapo_elem *e; - e =pipapo_get (net, set, data,nft_genmask_next (net),nft_net_tstamp (net)); + e =pipapo_get (net, set, data,nft_genmask_next (net), +nft_net_tstamp (net),GFP_KERNEL );if (IS_ERR (e))return NULL ;
Greg Kroah-Hartman
maintainerPATCH 76/235 netfilter: nft_set_pipapo: make pipapo_clone helper return NULL
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 80efd2997fb9343a0283cf3cac5524a4595c8ff4 ]
Currently it returns an error pointer, but the only possible failure is ENOMEM.
After a followup patch, we'd need to discard the errno code, i.e.
x = pipapo_clone()
if (IS_ERR(x))
return NULL
or make more changes to fix up callers to expect IS_ERR() code from set->ops->deactivate().
So simplify this and make it return ptr-or-null.
Stable-dep-of: 47e65eff5069 ("netfilter: nft_set_pipapo: don't leak bad clone into future transaction")
--- net/netfilter/nft_set_pipapo.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
net/netfilter/nft_set_pipapo.c +7 -7
@@ -1318,7 +1318,7 @@ static int nft_pipapo_insert(const struc* pipapo_clone() - Clone matching data to create new working copy * @old: Existing matching data * -* Return: copy of matching data passed as 'old', error pointer on failure +* Return: copy of matching data passed as 'old' or NULL. */ static struct nft_pipapo_match *pipapo_clone (struct nft_pipapo_match *old) {
@@ -1329,7 +1329,7 @@ static struct nft_pipapo_match *pipapo_c new =kmalloc (sizeof (*new) +sizeof (*dst) * old->field_count,GFP_KERNEL );if (!new) -return ERR_PTR (-ENOMEM ); +return NULL ; new->field_count = old->field_count; new->bsize_max = old->bsize_max;
@@ -1403,7 +1403,7 @@ out_scratch:free_percpu (new->scratch);kfree (new); -return ERR_PTR (-ENOMEM ); +return NULL ; }/**
@@ -1743,7 +1743,7 @@ static void nft_pipapo_commit(const stru goto out; new_clone =pipapo_clone (priv->clone); -if (IS_ERR (new_clone)) +if (!new_clone) goto out; priv->dirty = false;
@@ -1769,7 +1769,7 @@ static void nft_pipapo_abort(const struc m =rcu_dereference (priv->match); new_clone =pipapo_clone (m); -if (IS_ERR (new_clone)) +if (!new_clone)return ; priv->dirty = false;
@@ -2214,8 +2214,8 @@ static int nft_pipapo_init(const struct/* Create an initial clone of matching data for next insertion */ priv->clone =pipapo_clone (m); -if (IS_ERR (priv->clone)) { - err =PTR_ERR (priv->clone); +if (!priv->clone) { + err = -ENOMEM ; goto out_free; }
Greg Kroah-Hartman
maintainerPATCH 77/235 netfilter: nft_set_pipapo: prepare walk function for on-demand clone
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 6c108d9bee448a850b03e682836bfe91fca645cb ]
The existing code uses iter->type to figure out what data is needed, the live copy (READ) or clone (UPDATE).
Without pending updates, priv->clone and priv->match will point to different memory locations, but they have identical content.
Future patch will make priv->clone == NULL if there are no pending changes, in this case we must copy the live data for the UPDATE case.
Currently this would require GFP_ATOMIC allocation. Split the walk function in two parts: one that does the walk and one that decides which data is needed.
In the UPDATE case, callers hold the transaction mutex so we do not need the rcu read lock. This allows to use GFP_KERNEL allocation while cloning.
Stable-dep-of: 47e65eff5069 ("netfilter: nft_set_pipapo: don't leak bad clone into future transaction")
--- net/netfilter/nft_set_pipapo.c | 64 ++++++++++++++++++++++++++--------------- 1 file changed, 41 insertions(+), 23 deletions(-)
net/netfilter/nft_set_pipapo.c +41 -23
@@ -2054,34 +2054,22 @@ static void nft_pipapo_remove(const stru }/** -* nft_pipapo_walk() - Walk over elements +* nft_pipapo_do_walk() - Walk over elements in m * @ctx: nftables API context * @set: nftables API set representation +* @m: matching data pointing to key mapping array * @iter: Iterator * * As elements are referenced in the mapping array for the last field, directly * scan that array: there's no need to follow rule mappings from the first -* field. +* field. @m is protected either by RCU read lock or by transaction mutex. */ -static void nft_pipapo_walk (const struct nft_ctx *ctx,struct nft_set *set, -struct nft_set_iter *iter) +static void nft_pipapo_do_walk (const struct nft_ctx *ctx,struct nft_set *set, +const struct nft_pipapo_match *m, +struct nft_set_iter *iter) { -struct nft_pipapo *priv =nft_set_priv (set); -struct nft_pipapo_match *m; -struct nft_pipapo_field *f; -int i, r; - -WARN_ON_ONCE (iter->type !=NFT_ITER_READ && - iter->type !=NFT_ITER_UPDATE ); - -rcu_read_lock (); -if (iter->type ==NFT_ITER_READ ) - m =rcu_dereference (priv->match); -else - m = priv->clone; - -if (unlikely (!m)) - goto out; +const struct nft_pipapo_field *f; +unsigned int i, r;for (i =0 , f = m->f; i < m->field_count -1 ; i++, f++) ;
@@ -2105,14 +2093,44 @@ static void nft_pipapo_walk(const struct iter->err = iter->fn (ctx, set, iter, &elem);if (iter->err <0 ) - goto out; +return ; cont: iter->count++; } +} -out: -rcu_read_unlock (); +/** +* nft_pipapo_walk() - Walk over elements +* @ctx: nftables API context +* @set: nftables API set representation +* @iter: Iterator +* +* Test if destructive action is needed or not, clone active backend if needed +* and call the real function to work on the data. +*/ +static void nft_pipapo_walk (const struct nft_ctx *ctx,struct nft_set *set, +struct nft_set_iter *iter) +{ +struct nft_pipapo *priv =nft_set_priv (set); +const struct nft_pipapo_match *m; + +switch (iter->type) { +case NFT_ITER_UPDATE : + m = priv->clone; +nft_pipapo_do_walk (ctx, set, m, iter); +break ; +case NFT_ITER_READ : +rcu_read_lock (); + m =rcu_dereference (priv->match); +nft_pipapo_do_walk (ctx, set, m, iter); +rcu_read_unlock (); +break ; +default : + iter->err = -EINVAL ; +WARN_ON_ONCE (1 ); +break ; + } }/**
Greg Kroah-Hartman
maintainerPATCH 78/235 netfilter: nft_set_pipapo: merge deactivate helper into caller
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit c5444786d0ea2417a5e2cee7bd67137fc8bad687 ]
Its the only remaining call site so there is no need for this to be separated anymore.
Stable-dep-of: 47e65eff5069 ("netfilter: nft_set_pipapo: don't leak bad clone into future transaction")
--- net/netfilter/nft_set_pipapo.c | 39 +++++++++------------------------------ 1 file changed, 9 insertions(+), 30 deletions(-)
net/netfilter/nft_set_pipapo.c +9 -30
@@ -1799,52 +1799,31 @@ static void nft_pipapo_activate(const st }/** -* pipapo_deactivate() - Check that element is in set, mark as inactive +* nft_pipapo_deactivate() - Search for element and make it inactive * @net: Network namespace * @set: nftables API set representation -* @data: Input key data -* @ext: nftables API extension pointer, used to check for end element -* -* This is a convenience function that can be called from both -* nft_pipapo_deactivate() and nft_pipapo_flush(), as they are in fact the same -* operation. +* @elem: nftables API element representation containing key data * * Return: deactivated element if found, NULL otherwise. */ -static void *pipapo_deactivate (const struct net *net,const struct nft_set *set, -const u8 *data,const struct nft_set_ext *ext) +static void *nft_pipapo_deactivate (const struct net *net, +const struct nft_set *set, +const struct nft_set_elem *elem) {struct nft_pipapo_elem *e; - e =pipapo_get (net, set, data,nft_genmask_next (net), -nft_net_tstamp (net),GFP_KERNEL ); + e =pipapo_get (net, set, (const u8 *)elem->key.val.data, +nft_genmask_next (net),nft_net_tstamp (net),GFP_KERNEL );if (IS_ERR (e))return NULL ;nft_set_elem_change_active (net, set, &e->ext); -return e; -} - -/** -* nft_pipapo_deactivate() - Call pipapo_deactivate() to make element inactive -* @net: Network namespace -* @set: nftables API set representation -* @elem: nftables API element representation containing key data -* -* Return: deactivated element if found, NULL otherwise. -*/ -static void *nft_pipapo_deactivate (const struct net *net, -const struct nft_set *set, -const struct nft_set_elem *elem) -{ -const struct nft_set_ext *ext =nft_set_elem_ext (set, elem->priv); - -return pipapo_deactivate (net, set, (const u8 *)elem->key.val.data, ext); +return &e->priv; }/** -* nft_pipapo_flush() - Call pipapo_deactivate() to make element inactive +* nft_pipapo_flush() - make element inactive * @net: Network namespace * @set: nftables API set representation * @elem: nftables API element representation containing key data
Greg Kroah-Hartman
maintainerPATCH 79/235 netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit a238106703ab4ae1090b86eba128815b8626d8f1 ]
The helper uses priv->clone unconditionally which will fail once we do the clone conditionally on first insert or removal.
'nft get element' from userspace needs to use priv->match since this runs from rcu read side lock section.
Prepare for this by passing the match backend data as argument.
Stable-dep-of: 47e65eff5069 ("netfilter: nft_set_pipapo: don't leak bad clone into future transaction")
--- net/netfilter/nft_set_pipapo.c | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-)
net/netfilter/nft_set_pipapo.c +15 -9
@@ -502,6 +502,7 @@ out:* pipapo_get() - Get matching element reference given key data * @net: Network namespace * @set: nftables API set representation +* @m: storage containing active/existing elements * @data: Key data to be matched against existing elements * @genmask: If set, check that element is active in given genmask * @tstamp: timestamp to check for expired elements
@@ -515,12 +516,11 @@ out:*/ static struct nft_pipapo_elem *pipapo_get (const struct net *net,const struct nft_set *set, +const struct nft_pipapo_match *m,const u8 *data,u8 genmask,u64 tstamp,gfp_t gfp) {struct nft_pipapo_elem *ret =ERR_PTR (-ENOENT ); -struct nft_pipapo *priv =nft_set_priv (set); -struct nft_pipapo_match *m = priv->clone;unsigned long *res_map, *fill_map =NULL ;struct nft_pipapo_field *f;int i;
@@ -608,7 +608,10 @@ out:static void *nft_pipapo_get (const struct net *net,const struct nft_set *set,const struct nft_set_elem *elem,unsigned int flags) { -return pipapo_get (net, set, (const u8 *)elem->key.val.data, +struct nft_pipapo *priv =nft_set_priv (set); +struct nft_pipapo_match *m =rcu_dereference (priv->match); + +return pipapo_get (net, set, m, (const u8 *)elem->key.val.data,nft_genmask_cur (net),get_jiffies_64 (),GFP_ATOMIC ); }
@@ -1218,7 +1221,7 @@ static int nft_pipapo_insert(const strucelse end = start; - dup =pipapo_get (net, set, start, genmask, tstamp,GFP_KERNEL ); + dup =pipapo_get (net, set, m, start, genmask, tstamp,GFP_KERNEL );if (!IS_ERR (dup)) {/* Check if we already have the same exact entry */ const struct nft_data *dup_key, *dup_end;
@@ -1240,7 +1243,7 @@ static int nft_pipapo_insert(const strucif (PTR_ERR (dup) == -ENOENT ) {/* Look for partially overlapping entries */ - dup =pipapo_get (net, set, end,nft_genmask_next (net), tstamp, + dup =pipapo_get (net, set, m, end,nft_genmask_next (net), tstamp,GFP_KERNEL ); }
@@ -1810,16 +1813,18 @@ static void *nft_pipapo_deactivate(constconst struct nft_set *set, const struct nft_set_elem *elem) { + const struct nft_pipapo *priv = nft_set_priv(set); +struct nft_pipapo_match *m = priv->clone;struct nft_pipapo_elem *e; - e =pipapo_get (net, set, (const u8 *)elem->key.val.data, + e =pipapo_get (net, set, m, (const u8 *)elem->key.val.data,nft_genmask_next (net),nft_net_tstamp (net),GFP_KERNEL );if (IS_ERR (e))return NULL ;nft_set_elem_change_active (net, set, &e->ext); -return &e->priv; +return e; }/**
@@ -1845,8 +1850,9 @@ static bool nft_pipapo_flush(const struc {struct nft_pipapo_elem *e = elem; -return pipapo_deactivate (net, set, (const u8 *)nft_set_ext_key (&e->ext), - &e->ext); +nft_set_elem_change_active (net, set, &e->ext); + +return true; }/**
Greg Kroah-Hartman
maintainerPATCH 80/235 netfilter: nft_set_pipapo: move cloning of match info to insert/removal path
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 3f1d886cc7c3525d4dbeee24bfa9bb3fe0d48ddc ]
This set type keeps two copies of the sets' content,
priv->match (live version, used to match from packet path) priv->clone (work-in-progress version of the 'future' priv->match).
All additions and removals are done on priv->clone. When transaction completes, priv->clone becomes priv->match and a new clone is allocated for use by next transaction.
Problem is that the cloning requires GFP_KERNEL allocations but we cannot fail at either commit or abort time.
This patch defers the clone until we get an insertion or removal request. This allows us to handle OOM situations correctly.
This also allows to remove ->dirty in a followup change:
If ->clone exists, ->dirty is always true
If ->clone is NULL, ->dirty is always false, no elements were added or removed (except catchall elements which are external to the specific set backend).
Stable-dep-of: 47e65eff5069 ("netfilter: nft_set_pipapo: don't leak bad clone into future transaction")
--- net/netfilter/nft_set_pipapo.c | 82 ++++++++++++++++++++++++++++++----------- 1 file changed, 61 insertions(+), 21 deletions(-)
net/netfilter/nft_set_pipapo.c +61 -21
@@ -1191,6 +1191,41 @@ static int pipapo_realloc_scratch(structreturn 0 ; } +static bool nft_pipapo_transaction_mutex_held (const struct nft_set *set) +{ +#ifdef CONFIG_PROVE_LOCKING +const struct net *net =read_pnet (&set->net); +struct nftables_pernet *nft_net =net_generic (net, nf_tables_net_id); + +return lockdep_is_held (&nft_net->commit_mutex); +#else +return true; +#endif +} + +static struct nft_pipapo_match *pipapo_clone (struct nft_pipapo_match *old); + +/** +* pipapo_maybe_clone() - Build clone for pending data changes, if not existing +* @set: nftables API set representation +* +* Return: newly created or existing clone, if any. NULL on allocation failure +*/ +static struct nft_pipapo_match *pipapo_maybe_clone (const struct nft_set *set) +{ +struct nft_pipapo *priv =nft_set_priv (set); +struct nft_pipapo_match *m; + +if (priv->clone) +return priv->clone; + + m =rcu_dereference_protected (priv->match, +nft_pipapo_transaction_mutex_held (set)); + priv->clone =pipapo_clone (m); + +return priv->clone; +} +/** * nft_pipapo_insert() - Validate and insert ranged elements * @net: Network namespace
@@ -1208,14 +1243,17 @@ static int nft_pipapo_insert(const strucunion nft_pipapo_map_bucket rulemap[NFT_PIPAPO_MAX_FIELDS ];const u8 *start = (const u8 *)elem->key.val.data, *end;struct nft_pipapo_elem *e = elem->priv, *dup; +struct nft_pipapo_match *m =pipapo_maybe_clone (set);struct nft_pipapo *priv =nft_set_priv (set); -struct nft_pipapo_match *m = priv->clone;u8 genmask =nft_genmask_next (net);u64 tstamp =nft_net_tstamp (net);struct nft_pipapo_field *f;const u8 *start_p, *end_p;int i, bsize_max, err =0 ; +if (!m) +return -ENOMEM ; +if (nft_set_ext_exists (ext,NFT_SET_EXT_KEY_END )) end = (const u8 *)nft_set_ext_key_end (ext)->data;else
@@ -1737,7 +1775,10 @@ static void pipapo_reclaim_match(structstatic void nft_pipapo_commit (const struct nft_set *set) {struct nft_pipapo *priv =nft_set_priv (set); -struct nft_pipapo_match *new_clone, *old; +struct nft_pipapo_match *old; + +if (!priv->clone) +return ;if (time_after_eq (jiffies, priv->last_gc +nft_set_gc_interval (set)))pipapo_gc_scan (set, priv->clone);
@@ -1745,18 +1786,13 @@ static void nft_pipapo_commit(const struif (!priv->dirty) goto out; - new_clone =pipapo_clone (priv->clone); -if (!new_clone) - goto out; - + old =rcu_replace_pointer (priv->match, priv->clone, +nft_pipapo_transaction_mutex_held (set)); + priv->clone =NULL ; priv->dirty = false; - old =rcu_access_pointer (priv->match); -rcu_assign_pointer (priv->match, priv->clone);if (old)call_rcu (&old->rcu, pipapo_reclaim_match); - - priv->clone = new_clone; out:pipapo_gc_queue (set); }
@@ -1764,21 +1800,15 @@ out:static void nft_pipapo_abort (const struct nft_set *set) {struct nft_pipapo *priv =nft_set_priv (set); -struct nft_pipapo_match *new_clone, *m;if (!priv->dirty)return ; - m =rcu_dereference (priv->match); - - new_clone =pipapo_clone (m); -if (!new_clone) +if (!priv->clone)return ; - priv->dirty = false; -pipapo_free_match (priv->clone); - priv->clone = new_clone; + priv->clone =NULL ; }/**
@@ -1813,10 +1843,15 @@ static void *nft_pipapo_deactivate(constconst struct nft_set *set, const struct nft_set_elem *elem) { - const struct nft_pipapo *priv = nft_set_priv(set); -struct nft_pipapo_match *m = priv->clone; + struct nft_pipapo_match *m = pipapo_maybe_clone(set);struct nft_pipapo_elem *e; +/* removal must occur on priv->clone, if we are low on memory +* we have no choice and must fail the removal request. +*/ +if (!m) +return NULL ; + e =pipapo_get (net, set, m, (const u8 *)elem->key.val.data,nft_genmask_next (net),nft_net_tstamp (net),GFP_KERNEL );if (IS_ERR (e))
@@ -2102,7 +2137,12 @@ static void nft_pipapo_walk(const structswitch (iter->type) {case NFT_ITER_UPDATE : - m = priv->clone; + m =pipapo_maybe_clone (set); +if (!m) { + iter->err = -ENOMEM ; +return ; + } +nft_pipapo_do_walk (ctx, set, m, iter);break ;case NFT_ITER_READ :
Greg Kroah-Hartman
maintainerPATCH 81/235 netfilter: nft_set_pipapo: dont leak bad clone into future transaction
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 47e65eff50691f0a5b79d325e28d83ec1da43bcf ]
On memory allocation failure the cloned nft_pipapo_match can enter a bad state:
- some fields can have their lookup tables resized while others did not
- bits might have been toggled
- scratch map can be undersized which also means m->bsize_max can be lower than what is required
This means that the next insertion in the same batch can trigger out-of-bounds writes.
Furthermore, a failure in the first can result in the bad clone to leak into the next transaction because the abort callback is never executed in this case (the upper layer saw an error and no attempt to allocate a transactional request was made).
Record a state for the nft_pipapo_match structure:
- NEW (pristine clone)
- MOD (modified clone with good state)
- ERR (potentially bogus content)
Then make it so that deletes and insertions fail when the clone entered ERR state.
In case the very first insert attempt results in an error, free the clone right away.
--- net/netfilter/nft_set_pipapo.c | 34 +++++++++++++++++++++++++++++----- net/netfilter/nft_set_pipapo.h | 8 ++++++++ 2 files changed, 37 insertions(+), 5 deletions(-)
net/netfilter/nft_set_pipapo.c +29 -5
@@ -342,6 +342,8 @@#include "nft_set_pipapo_avx2.h" #include "nft_set_pipapo.h" +static void nft_pipapo_abort (const struct nft_set *set); +/** * pipapo_refill() - For each set bit, set bits from selected mapping table item * @map: Bitmap to be scanned for set bits
@@ -1251,7 +1253,7 @@ static int nft_pipapo_insert(const strucconst u8 *start_p, *end_p;int i, bsize_max, err =0 ; -if (!m) +if (!m || m->state ==NFT_PIPAPO_CLONE_ERR )return -ENOMEM ;if (nft_set_ext_exists (ext,NFT_SET_EXT_KEY_END ))
@@ -1324,8 +1326,10 @@ static int nft_pipapo_insert(const strucelse ret =pipapo_expand (f, start, end, f->groups * f->bb); -if (ret <0 ) -return ret; +if (ret <0 ) { + err = ret; + goto abort; + }if (f->bsize > bsize_max) bsize_max = f->bsize;
@@ -1341,7 +1345,7 @@ static int nft_pipapo_insert(const struc err =pipapo_realloc_scratch (m, bsize_max);if (err) -return err; + goto abort; m->bsize_max = bsize_max; }else {
@@ -1352,7 +1356,26 @@ static int nft_pipapo_insert(const strucpipapo_map (m, rulemap, e); + m->state =NFT_PIPAPO_CLONE_MOD ;return 0 ; +abort: +WARN_ON_ONCE (m->state ==NFT_PIPAPO_CLONE_ERR ); + +/* Two rollback cases: +* 1) no previous changes. nft_pipapo_abort is not +* guaranteed to be invoked (there might be no further +* add/delete requests coming after this). +* +* 2) we had previous changes: there are transaction +* records pointing to this set. Leave the rollback to +* the transaction handling. +*/ +if (m->state ==NFT_PIPAPO_CLONE_NEW ) +nft_pipapo_abort (set);/* releases m */ +else + m->state =NFT_PIPAPO_CLONE_ERR ; + +return err; }/**
@@ -1427,6 +1450,7 @@ static struct nft_pipapo_match *pipapo_c dst++; } + new->state =NFT_PIPAPO_CLONE_NEW ;return new; out_mt:
@@ -1849,7 +1873,7 @@ static void *nft_pipapo_deactivate(const/* removal must occur on priv->clone, if we are low on memory * we have no choice and must fail the removal request. */ -if (!m) +if (!m || m->state ==NFT_PIPAPO_CLONE_ERR )return NULL ; e = pipapo_get(net, set, m, (const u8 *)elem->key.val.data,
net/netfilter/nft_set_pipapo.h +8 -0
@@ -142,9 +142,16 @@ struct nft_pipapo_scratch {unsigned long map[]; }; +enum nft_pipapo_clone_state { +NFT_PIPAPO_CLONE_NEW , +NFT_PIPAPO_CLONE_MOD , +NFT_PIPAPO_CLONE_ERR , +}; +/** * struct nft_pipapo_match - Data used for lookup and matching * @field_count Amount of fields in set +* @state: add/delete state; used from control plane * @scratch: Preallocated per-CPU maps for partial matching results * @bsize_max: Maximum lookup table bucket size of all fields, in longs * @rcu Matching data is swapped on commits
@@ -152,6 +159,7 @@ struct nft_pipapo_scratch {*/ struct nft_pipapo_match {int field_count; +enum nft_pipapo_clone_state state:8 ;struct nft_pipapo_scratch *__percpu *scratch;size_t bsize_max;struct rcu_head rcu;
Greg Kroah-Hartman
maintainerPATCH 82/235 lsm: use default hook return value in call_int_hook()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ondrej Mosnacek <[email protected]>
[ Upstream commit 260017f31a8c3879be5f9048a46f382b06c1923a ]
Change the definition of call_int_hook() to treat LSM_RET_DEFAULT(...) as the "continue" value instead of 0. To further simplify this macro, also drop the IRC argument and replace it with LSM_RET_DEFAULT(...).
After this the macro can be used in a couple more hooks, where similar logic is currently open-coded. At the same time, some other existing call_int_hook() users now need to be open-coded, but overall it's still a net simplification.
There should be no functional change resulting from this patch.
Stable-dep-of: 56acfeb10019 ("selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()")
--- security/security.c | 461 +++++++++++++++++++++++++++++----------------------- 1 file changed, 262 insertions(+), 199 deletions(-)
security/security.c +262 -199
@@ -710,14 +710,14 @@ static void __init lsm_early_task(structP ->hook.FUNC (__VA_ARGS__); \ } while (0) -#define call_int_hook (FUNC ,IRC , ...) ({ \ - int RC = IRC; \ +#define call_int_hook (FUNC , ...) ({ \ + int RC = LSM_RET_DEFAULT(FUNC); \ do { \ struct security_hook_list *P; \ \ hlist_for_each_entry(P, &security_hook_heads.FUNC, list) { \ RC = P->hook.FUNC(__VA_ARGS__); \ - if (RC != 0) \ + if (RC != LSM_RET_DEFAULT(FUNC)) \ break; \ } \ } while (0); \
@@ -728,35 +728,35 @@ static void __init lsm_early_task(structint security_binder_set_context_mgr (const struct cred *mgr) { -return call_int_hook (binder_set_context_mgr,0 , mgr); +return call_int_hook (binder_set_context_mgr, mgr); }int security_binder_transaction (const struct cred *from,const struct cred *to) { -return call_int_hook (binder_transaction,0 , from, to); +return call_int_hook (binder_transaction, from, to); }int security_binder_transfer_binder (const struct cred *from,const struct cred *to) { -return call_int_hook (binder_transfer_binder,0 , from, to); +return call_int_hook (binder_transfer_binder, from, to); }int security_binder_transfer_file (const struct cred *from,const struct cred *to,struct file *file) { -return call_int_hook (binder_transfer_file,0 , from, to, file); +return call_int_hook (binder_transfer_file, from, to, file); }int security_ptrace_access_check (struct task_struct *child,unsigned int mode) { -return call_int_hook (ptrace_access_check,0 , child, mode); +return call_int_hook (ptrace_access_check, child, mode); }int security_ptrace_traceme (struct task_struct *parent) { -return call_int_hook (ptrace_traceme,0 , parent); +return call_int_hook (ptrace_traceme, parent); } int security_capget(struct task_struct *target,
@@ -764,7 +764,7 @@ int security_capget(struct task_struct * kernel_cap_t *inheritable, kernel_cap_t *permitted) { -return call_int_hook (capget,0 , target, +return call_int_hook (capget, target, effective, inheritable, permitted); }
@@ -773,7 +773,7 @@ int security_capset(struct cred *new, coconst kernel_cap_t *inheritable, const kernel_cap_t *permitted) { - return call_int_hook(capset, 0, new, old, + return call_int_hook(capset, new, old,effective ,inheritable ,permitted ); }
@@ -782,27 +782,27 @@ int security_capable(const struct cred *int cap, unsigned int opts) { -return call_int_hook (capable,0 , cred, ns, cap, opts); + return call_int_hook(capable, cred, ns, cap, opts); }int security_quotactl (int cmds,int type,int id,struct super_block *sb) { -return call_int_hook (quotactl,0 , cmds, type, id, sb); +return call_int_hook (quotactl, cmds, type, id, sb); }int security_quota_on (struct dentry *dentry) { -return call_int_hook (quota_on,0 , dentry); +return call_int_hook (quota_on, dentry); }int security_syslog (int type) { -return call_int_hook (syslog,0 , type); +return call_int_hook (syslog, type); }int security_settime64 (const struct timespec64 *ts,const struct timezone *tz) { -return call_int_hook (settime,0 , ts, tz); +return call_int_hook (settime, ts, tz); }int security_vm_enough_memory_mm (struct mm_struct *mm,long pages)
@@ -830,19 +830,19 @@ int security_vm_enough_memory_mm(structint security_bprm_creds_for_exec (struct linux_binprm *bprm) { -return call_int_hook (bprm_creds_for_exec,0 , bprm); +return call_int_hook (bprm_creds_for_exec, bprm); }int security_bprm_creds_from_file (struct linux_binprm *bprm,struct file *file) { -return call_int_hook (bprm_creds_from_file,0 , bprm, file); +return call_int_hook (bprm_creds_from_file, bprm, file); }int security_bprm_check (struct linux_binprm *bprm) {int ret; - ret =call_int_hook (bprm_check_security,0 , bprm); + ret =call_int_hook (bprm_check_security, bprm);if (ret)return ret;return ima_bprm_check (bprm);
@@ -860,7 +860,7 @@ void security_bprm_committed_creds(strucint security_fs_context_dup (struct fs_context *fc,struct fs_context *src_fc) { -return call_int_hook (fs_context_dup,0 , fc, src_fc); +return call_int_hook (fs_context_dup, fc, src_fc); } int security_fs_context_parse_param(struct fs_context *fc,
@@ -883,7 +883,7 @@ int security_fs_context_parse_param(struint security_sb_alloc (struct super_block *sb) { -return call_int_hook (sb_alloc_security,0 , sb); +return call_int_hook (sb_alloc_security, sb); }void security_sb_free (struct super_block *sb)
@@ -902,46 +902,46 @@ EXPORT_SYMBOL(security_free_mnt_opts);int security_sb_eat_lsm_opts (char *options,void **mnt_opts) { -return call_int_hook (sb_eat_lsm_opts,0 , options, mnt_opts); +return call_int_hook (sb_eat_lsm_opts, options, mnt_opts); }EXPORT_SYMBOL (security_sb_eat_lsm_opts);int security_sb_remount (struct super_block *sb,void *mnt_opts) { -return call_int_hook (sb_remount,0 , sb, mnt_opts); +return call_int_hook (sb_remount, sb, mnt_opts); }EXPORT_SYMBOL (security_sb_remount);int security_sb_kern_mount (struct super_block *sb) { -return call_int_hook (sb_kern_mount,0 , sb); +return call_int_hook (sb_kern_mount, sb); }int security_sb_show_options (struct seq_file *m,struct super_block *sb) { -return call_int_hook (sb_show_options,0 , m, sb); +return call_int_hook (sb_show_options, m, sb); }int security_sb_statfs (struct dentry *dentry) { -return call_int_hook (sb_statfs,0 , dentry); +return call_int_hook (sb_statfs, dentry); }int security_sb_mount (const char *dev_name,const struct path *path,const char *type,unsigned long flags,void *data) { -return call_int_hook (sb_mount,0 , dev_name, path, type, flags, data); +return call_int_hook (sb_mount, dev_name, path, type, flags, data); }int security_sb_umount (struct vfsmount *mnt,int flags) { -return call_int_hook (sb_umount,0 , mnt, flags); +return call_int_hook (sb_umount, mnt, flags); }int security_sb_pivotroot (const struct path *old_path,const struct path *new_path) { -return call_int_hook (sb_pivotroot,0 , old_path, new_path); +return call_int_hook (sb_pivotroot, old_path, new_path); } int security_sb_set_mnt_opts(struct super_block *sb,
@@ -949,9 +949,17 @@ int security_sb_set_mnt_opts(struct supeunsigned long kern_flags, unsigned long *set_kern_flags) { - return call_int_hook(sb_set_mnt_opts, - mnt_opts ? -EOPNOTSUPP : 0, sb, -mnt_opts ,kern_flags ,set_kern_flags ); + struct security_hook_list *hp; +int rc = mnt_opts ? -EOPNOTSUPP :LSM_RET_DEFAULT (sb_set_mnt_opts); + +hlist_for_each_entry (hp, &security_hook_heads.sb_set_mnt_opts, + list) { + rc = hp->hook.sb_set_mnt_opts (sb, mnt_opts, kern_flags, + set_kern_flags); +if (rc !=LSM_RET_DEFAULT (sb_set_mnt_opts)) +break ; + } +return rc; }EXPORT_SYMBOL (security_sb_set_mnt_opts);
@@ -960,7 +968,7 @@ int security_sb_clone_mnt_opts(const strunsigned long kern_flags, unsigned long *set_kern_flags) { - return call_int_hook(sb_clone_mnt_opts, 0, oldsb, newsb, + return call_int_hook(sb_clone_mnt_opts, oldsb, newsb,kern_flags ,set_kern_flags ); }EXPORT_SYMBOL (security_sb_clone_mnt_opts);
@@ -968,20 +976,28 @@ EXPORT_SYMBOL(security_sb_clone_mnt_optsint security_add_mnt_opt (const char *option,const char *val,int len,void **mnt_opts) { -return call_int_hook (sb_add_mnt_opt, -EINVAL , - option, val, len, mnt_opts); +struct security_hook_list *hp; +int rc = -EINVAL ; + +hlist_for_each_entry (hp, &security_hook_heads.sb_add_mnt_opt, + list) { + rc = hp->hook.sb_add_mnt_opt (option, val, len, mnt_opts); +if (rc !=LSM_RET_DEFAULT (sb_add_mnt_opt)) +break ; + } +return rc; }EXPORT_SYMBOL (security_add_mnt_opt);int security_move_mount (const struct path *from_path,const struct path *to_path) { -return call_int_hook (move_mount,0 , from_path, to_path); +return call_int_hook (move_mount, from_path, to_path); }int security_path_notify (const struct path *path,u64 mask,unsigned int obj_type) { -return call_int_hook (path_notify,0 , path, mask, obj_type); +return call_int_hook (path_notify, path, mask, obj_type); }int security_inode_alloc (struct inode *inode)
@@ -990,7 +1006,7 @@ int security_inode_alloc(struct inode *iif (unlikely (rc))return rc; - rc =call_int_hook (inode_alloc_security,0 , inode); + rc =call_int_hook (inode_alloc_security, inode);if (unlikely (rc))security_inode_free (inode);return rc;
@@ -1026,8 +1042,17 @@ int security_dentry_init_security(struct const struct qstr *name, void **ctx, u32 *ctxlen) { - return call_int_hook(dentry_init_security, -EOPNOTSUPP, dentry, mode, -name ,ctx ,ctxlen ); + struct security_hook_list *hp; +int rc = -EOPNOTSUPP ; + +hlist_for_each_entry (hp, &security_hook_heads.dentry_init_security, + list) { + rc = hp->hook.dentry_init_security (dentry, mode, name, + ctx, ctxlen); +if (rc !=LSM_RET_DEFAULT (dentry_init_security)) +break ; + } +return rc; }EXPORT_SYMBOL (security_dentry_init_security);
@@ -1035,7 +1060,7 @@ int security_dentry_create_files_as(strustruct qstr *name, const struct cred *old, struct cred *new) { - return call_int_hook(dentry_create_files_as, 0, dentry, mode, + return call_int_hook(dentry_create_files_as, dentry, mode,name ,old ,new ); }EXPORT_SYMBOL (security_dentry_create_files_as);
@@ -1046,20 +1071,35 @@ int security_inode_init_security(struct {struct xattr new_xattrs[MAX_LSM_EVM_XATTR +1 ];struct xattr *lsm_xattr, *evm_xattr, *xattr; +struct security_hook_list *hp;int ret;if (unlikely (IS_PRIVATE (inode)))return 0 ; -if (!initxattrs) -return call_int_hook (inode_init_security, -EOPNOTSUPP , inode, - dir, qstr,NULL ,NULL ,NULL ); +if (!initxattrs) { + ret = -EOPNOTSUPP ; +hlist_for_each_entry (hp, &security_hook_heads.inode_init_security, + list) { + ret = hp->hook.inode_init_security (inode, dir, qstr, +NULL ,NULL ,NULL ); +if (ret !=LSM_RET_DEFAULT (inode_init_security)) +break ; + } +return ret; + }memset (new_xattrs,0 ,sizeof (new_xattrs)); lsm_xattr = new_xattrs; - ret =call_int_hook (inode_init_security, -EOPNOTSUPP , inode, dir, qstr, - &lsm_xattr->name, - &lsm_xattr->value, - &lsm_xattr->value_len); + ret = -EOPNOTSUPP ; +hlist_for_each_entry (hp, &security_hook_heads.inode_init_security, + list) { + ret = hp->hook.inode_init_security (inode, dir, qstr, + &lsm_xattr->name, + &lsm_xattr->value, + &lsm_xattr->value_len); +if (ret !=LSM_RET_DEFAULT (inode_init_security)) +break ; + }if (ret) goto out;
@@ -1079,10 +1119,19 @@ int security_old_inode_init_security(str const struct qstr *qstr, const char **name, void **value, size_t *len) { + struct security_hook_list *hp; +int rc = -EOPNOTSUPP ; +if (unlikely (IS_PRIVATE (inode)))return -EOPNOTSUPP ; - return call_int_hook(inode_init_security, -EOPNOTSUPP, inode, dir, -qstr ,name ,value ,len ); +hlist_for_each_entry (hp, &security_hook_heads.inode_init_security, + list) { + rc = hp->hook.inode_init_security (inode, dir, qstr, name, + value, len); +if (rc !=LSM_RET_DEFAULT (inode_init_security)) +break ; + } +return rc; }EXPORT_SYMBOL (security_old_inode_init_security);
@@ -1092,7 +1141,7 @@ int security_path_mknod(const struct pat {if (unlikely (IS_PRIVATE (d_backing_inode (dir->dentry))))return 0 ; -return call_int_hook (path_mknod,0 , dir, dentry, mode, dev); +return call_int_hook (path_mknod, dir, dentry, mode, dev); }EXPORT_SYMBOL (security_path_mknod);
@@ -1100,7 +1149,7 @@ int security_path_mkdir(const struct pat {if (unlikely (IS_PRIVATE (d_backing_inode (dir->dentry))))return 0 ; -return call_int_hook (path_mkdir,0 , dir, dentry, mode); +return call_int_hook (path_mkdir, dir, dentry, mode); }EXPORT_SYMBOL (security_path_mkdir);
@@ -1108,14 +1157,14 @@ int security_path_rmdir(const struct pat {if (unlikely (IS_PRIVATE (d_backing_inode (dir->dentry))))return 0 ; -return call_int_hook (path_rmdir,0 , dir, dentry); +return call_int_hook (path_rmdir, dir, dentry); }int security_path_unlink (const struct path *dir,struct dentry *dentry) {if (unlikely (IS_PRIVATE (d_backing_inode (dir->dentry))))return 0 ; -return call_int_hook (path_unlink,0 , dir, dentry); +return call_int_hook (path_unlink, dir, dentry); }EXPORT_SYMBOL (security_path_unlink);
@@ -1124,7 +1173,7 @@ int security_path_symlink(const struct p {if (unlikely (IS_PRIVATE (d_backing_inode (dir->dentry))))return 0 ; -return call_int_hook (path_symlink,0 , dir, dentry, old_name); +return call_int_hook (path_symlink, dir, dentry, old_name); } int security_path_link(struct dentry *old_dentry, const struct path *new_dir,
@@ -1132,7 +1181,7 @@ int security_path_link(struct dentry *ol {if (unlikely (IS_PRIVATE (d_backing_inode (old_dentry))))return 0 ; -return call_int_hook (path_link,0 , old_dentry, new_dir, new_dentry); +return call_int_hook (path_link, old_dentry, new_dir, new_dentry); } int security_path_rename(const struct path *old_dir, struct dentry *old_dentry,
@@ -1144,13 +1193,13 @@ int security_path_rename(const struct pareturn 0 ;if (flags &RENAME_EXCHANGE ) { -int err =call_int_hook (path_rename,0 , new_dir, new_dentry, +int err =call_int_hook (path_rename, new_dir, new_dentry, old_dir, old_dentry);if (err)return err; } -return call_int_hook (path_rename,0 , old_dir, old_dentry, new_dir, +return call_int_hook (path_rename, old_dir, old_dentry, new_dir, new_dentry); }EXPORT_SYMBOL (security_path_rename);
@@ -1159,26 +1208,26 @@ int security_path_truncate(const struct {if (unlikely (IS_PRIVATE (d_backing_inode (path->dentry))))return 0 ; -return call_int_hook (path_truncate,0 , path); +return call_int_hook (path_truncate, path); }int security_path_chmod (const struct path *path,umode_t mode) {if (unlikely (IS_PRIVATE (d_backing_inode (path->dentry))))return 0 ; -return call_int_hook (path_chmod,0 , path, mode); +return call_int_hook (path_chmod, path, mode); }int security_path_chown (const struct path *path,kuid_t uid,kgid_t gid) {if (unlikely (IS_PRIVATE (d_backing_inode (path->dentry))))return 0 ; -return call_int_hook (path_chown,0 , path, uid, gid); +return call_int_hook (path_chown, path, uid, gid); }int security_path_chroot (const struct path *path) { -return call_int_hook (path_chroot,0 , path); +return call_int_hook (path_chroot, path); }#endif
@@ -1186,7 +1235,7 @@ int security_inode_create(struct inode * {if (unlikely (IS_PRIVATE (dir)))return 0 ; -return call_int_hook (inode_create,0 , dir, dentry, mode); +return call_int_hook (inode_create, dir, dentry, mode); }EXPORT_SYMBOL_GPL (security_inode_create);
@@ -1195,14 +1244,14 @@ int security_inode_link(struct dentry *o {if (unlikely (IS_PRIVATE (d_backing_inode (old_dentry))))return 0 ; -return call_int_hook (inode_link,0 , old_dentry, dir, new_dentry); +return call_int_hook (inode_link, old_dentry, dir, new_dentry); }int security_inode_unlink (struct inode *dir,struct dentry *dentry) {if (unlikely (IS_PRIVATE (d_backing_inode (dentry))))return 0 ; -return call_int_hook (inode_unlink,0 , dir, dentry); +return call_int_hook (inode_unlink, dir, dentry); } int security_inode_symlink(struct inode *dir, struct dentry *dentry,
@@ -1210,14 +1259,14 @@ int security_inode_symlink(struct inode {if (unlikely (IS_PRIVATE (dir)))return 0 ; -return call_int_hook (inode_symlink,0 , dir, dentry, old_name); +return call_int_hook (inode_symlink, dir, dentry, old_name); }int security_inode_mkdir (struct inode *dir,struct dentry *dentry,umode_t mode) {if (unlikely (IS_PRIVATE (dir)))return 0 ; -return call_int_hook (inode_mkdir,0 , dir, dentry, mode); +return call_int_hook (inode_mkdir, dir, dentry, mode); }EXPORT_SYMBOL_GPL (security_inode_mkdir);
@@ -1225,14 +1274,14 @@ int security_inode_rmdir(struct inode *d {if (unlikely (IS_PRIVATE (d_backing_inode (dentry))))return 0 ; -return call_int_hook (inode_rmdir,0 , dir, dentry); +return call_int_hook (inode_rmdir, dir, dentry); }int security_inode_mknod (struct inode *dir,struct dentry *dentry,umode_t mode,dev_t dev) {if (unlikely (IS_PRIVATE (dir)))return 0 ; -return call_int_hook (inode_mknod,0 , dir, dentry, mode, dev); +return call_int_hook (inode_mknod, dir, dentry, mode, dev); } int security_inode_rename(struct inode *old_dir, struct dentry *old_dentry,
@@ -1244,13 +1293,13 @@ int security_inode_rename(struct inode *return 0 ;if (flags &RENAME_EXCHANGE ) { -int err =call_int_hook (inode_rename,0 , new_dir, new_dentry, +int err =call_int_hook (inode_rename, new_dir, new_dentry, old_dir, old_dentry);if (err)return err; } -return call_int_hook (inode_rename,0 , old_dir, old_dentry, +return call_int_hook (inode_rename, old_dir, old_dentry, new_dir, new_dentry); }
@@ -1258,7 +1307,7 @@ int security_inode_readlink(struct dentr {if (unlikely (IS_PRIVATE (d_backing_inode (dentry))))return 0 ; -return call_int_hook (inode_readlink,0 , dentry); +return call_int_hook (inode_readlink, dentry); } int security_inode_follow_link(struct dentry *dentry, struct inode *inode,
@@ -1266,14 +1315,14 @@ int security_inode_follow_link(struct de {if (unlikely (IS_PRIVATE (inode)))return 0 ; -return call_int_hook (inode_follow_link,0 , dentry, inode, rcu); +return call_int_hook (inode_follow_link, dentry, inode, rcu); }int security_inode_permission (struct inode *inode,int mask) {if (unlikely (IS_PRIVATE (inode)))return 0 ; -return call_int_hook (inode_permission,0 , inode, mask); +return call_int_hook (inode_permission, inode, mask); }int security_inode_setattr (struct dentry *dentry,struct iattr *attr)
@@ -1282,7 +1331,7 @@ int security_inode_setattr(struct dentryif (unlikely (IS_PRIVATE (d_backing_inode (dentry))))return 0 ; - ret =call_int_hook (inode_setattr,0 , dentry, attr); + ret =call_int_hook (inode_setattr, dentry, attr);if (ret)return ret;return evm_inode_setattr (dentry, attr);
@@ -1293,12 +1342,13 @@ int security_inode_getattr(const struct {if (unlikely (IS_PRIVATE (d_backing_inode (path->dentry))))return 0 ; -return call_int_hook (inode_getattr,0 , path); +return call_int_hook (inode_getattr, path); }int security_inode_setxattr (struct dentry *dentry,const char *name,const void *value,size_t size,int flags) { +struct security_hook_list *hp;int ret;if (unlikely (IS_PRIVATE (d_backing_inode (dentry))))
@@ -1307,8 +1357,14 @@ int security_inode_setxattr(struct dentr* SELinux and Smack integrate the cap call, * so assume that all LSMs supplying this call do so. */ - ret =call_int_hook (inode_setxattr,1 , dentry, name, value, size, - flags); + ret =1 ; +hlist_for_each_entry (hp, &security_hook_heads.inode_setxattr, + list) { + ret = hp->hook.inode_setxattr (dentry, name, value, size, + flags); +if (ret !=LSM_RET_DEFAULT (inode_setxattr)) +break ; + }if (ret ==1 ) ret =cap_inode_setxattr (dentry, name, value, size, flags);
@@ -1333,18 +1389,19 @@ int security_inode_getxattr(struct dentr {if (unlikely (IS_PRIVATE (d_backing_inode (dentry))))return 0 ; -return call_int_hook (inode_getxattr,0 , dentry, name); +return call_int_hook (inode_getxattr, dentry, name); }int security_inode_listxattr (struct dentry *dentry) {if (unlikely (IS_PRIVATE (d_backing_inode (dentry))))return 0 ; -return call_int_hook (inode_listxattr,0 , dentry); +return call_int_hook (inode_listxattr, dentry); }int security_inode_removexattr (struct dentry *dentry,const char *name) { +struct security_hook_list *hp;int ret;if (unlikely (IS_PRIVATE (d_backing_inode (dentry))))
@@ -1353,7 +1410,13 @@ int security_inode_removexattr(struct de* SELinux and Smack integrate the cap call, * so assume that all LSMs supplying this call do so. */ - ret =call_int_hook (inode_removexattr,1 , dentry, name); + ret =1 ; +hlist_for_each_entry (hp, &security_hook_heads.inode_removexattr, + list) { + ret = hp->hook.inode_removexattr (dentry, name); +if (ret !=LSM_RET_DEFAULT (inode_removexattr)) +break ; + }if (ret ==1 ) ret =cap_inode_removexattr (dentry, name);if (ret)
@@ -1366,12 +1429,12 @@ int security_inode_removexattr(struct deint security_inode_need_killpriv (struct dentry *dentry) { -return call_int_hook (inode_need_killpriv,0 , dentry); +return call_int_hook (inode_need_killpriv, dentry); }int security_inode_killpriv (struct dentry *dentry) { -return call_int_hook (inode_killpriv,0 , dentry); +return call_int_hook (inode_killpriv, dentry); }int security_inode_getsecurity (struct inode *inode,const char *name,void **buffer,bool alloc)
@@ -1415,7 +1478,7 @@ int security_inode_listsecurity(struct i {if (unlikely (IS_PRIVATE (inode)))return 0 ; -return call_int_hook (inode_listsecurity,0 , inode, buffer, buffer_size); +return call_int_hook (inode_listsecurity, inode, buffer, buffer_size); }EXPORT_SYMBOL (security_inode_listsecurity);
@@ -1426,7 +1489,7 @@ void security_inode_getsecid(struct inodint security_inode_copy_up (struct dentry *src,struct cred **new) { -return call_int_hook (inode_copy_up,0 , src, new); +return call_int_hook (inode_copy_up, src, new); }EXPORT_SYMBOL (security_inode_copy_up);
@@ -1454,14 +1517,14 @@ EXPORT_SYMBOL(security_inode_copy_up_xatint security_kernfs_init_security (struct kernfs_node *kn_dir,struct kernfs_node *kn) { -return call_int_hook (kernfs_init_security,0 , kn_dir, kn); +return call_int_hook (kernfs_init_security, kn_dir, kn); }int security_file_permission (struct file *file,int mask) {int ret; - ret =call_int_hook (file_permission,0 , file, mask); + ret =call_int_hook (file_permission, file, mask);if (ret)return ret;
@@ -1474,7 +1537,7 @@ int security_file_alloc(struct file *filif (rc)return rc; - rc =call_int_hook (file_alloc_security,0 , file); + rc =call_int_hook (file_alloc_security, file);if (unlikely (rc))security_file_free (file);return rc;
@@ -1495,7 +1558,7 @@ void security_file_free(struct file *filint security_file_ioctl (struct file *file,unsigned int cmd,unsigned long arg) { -return call_int_hook (file_ioctl,0 , file, cmd, arg); +return call_int_hook (file_ioctl, file, cmd, arg); }EXPORT_SYMBOL_GPL (security_file_ioctl);
@@ -1513,7 +1576,7 @@ EXPORT_SYMBOL_GPL(security_file_ioctl);int security_file_ioctl_compat (struct file *file,unsigned int cmd,unsigned long arg) { -return call_int_hook (file_ioctl_compat,0 , file, cmd, arg); +return call_int_hook (file_ioctl_compat, file, cmd, arg); }EXPORT_SYMBOL_GPL (security_file_ioctl_compat);
@@ -1556,7 +1619,7 @@ int security_mmap_file(struct file *fileunsigned long prot_adj =mmap_prot (file, prot);int ret; - ret =call_int_hook (mmap_file,0 , file, prot, prot_adj, flags); + ret =call_int_hook (mmap_file, file, prot, prot_adj, flags);if (ret)return ret;return ima_file_mmap (file, prot, prot_adj, flags);
@@ -1564,7 +1627,7 @@ int security_mmap_file(struct file *fileint security_mmap_addr (unsigned long addr) { -return call_int_hook (mmap_addr,0 , addr); +return call_int_hook (mmap_addr, addr); } int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot,
@@ -1572,7 +1635,7 @@ int security_file_mprotect(struct vm_are {int ret; - ret =call_int_hook (file_mprotect,0 , vma, reqprot, prot); + ret =call_int_hook (file_mprotect, vma, reqprot, prot);if (ret)return ret;return ima_file_mprotect (vma, prot);
@@ -1580,12 +1643,12 @@ int security_file_mprotect(struct vm_areint security_file_lock (struct file *file,unsigned int cmd) { -return call_int_hook (file_lock,0 , file, cmd); +return call_int_hook (file_lock, file, cmd); }int security_file_fcntl (struct file *file,unsigned int cmd,unsigned long arg) { -return call_int_hook (file_fcntl,0 , file, cmd, arg); +return call_int_hook (file_fcntl, file, cmd, arg); }void security_file_set_fowner (struct file *file)
@@ -1596,19 +1659,19 @@ void security_file_set_fowner(struct filint security_file_send_sigiotask (struct task_struct *tsk,struct fown_struct *fown,int sig) { -return call_int_hook (file_send_sigiotask,0 , tsk, fown, sig); +return call_int_hook (file_send_sigiotask, tsk, fown, sig); }int security_file_receive (struct file *file) { -return call_int_hook (file_receive,0 , file); +return call_int_hook (file_receive, file); }int security_file_open (struct file *file) {int ret; - ret =call_int_hook (file_open,0 , file); + ret =call_int_hook (file_open, file);if (ret)return ret;
@@ -1621,7 +1684,7 @@ int security_task_alloc(struct task_struif (rc)return rc; - rc =call_int_hook (task_alloc,0 , task, clone_flags); + rc =call_int_hook (task_alloc, task, clone_flags);if (unlikely (rc))security_task_free (task);return rc;
@@ -1642,7 +1705,7 @@ int security_cred_alloc_blank(struct creif (rc)return rc; - rc =call_int_hook (cred_alloc_blank,0 , cred, gfp); + rc =call_int_hook (cred_alloc_blank, cred, gfp);if (unlikely (rc))security_cred_free (cred);return rc;
@@ -1670,7 +1733,7 @@ int security_prepare_creds(struct cred *if (rc)return rc; - rc =call_int_hook (cred_prepare,0 , new, old, gfp); + rc =call_int_hook (cred_prepare, new, old, gfp);if (unlikely (rc))security_cred_free (new);return rc;
@@ -1690,19 +1753,19 @@ EXPORT_SYMBOL(security_cred_getsecid);int security_kernel_act_as (struct cred *new,u32 secid) { -return call_int_hook (kernel_act_as,0 , new, secid); +return call_int_hook (kernel_act_as, new, secid); }int security_kernel_create_files_as (struct cred *new,struct inode *inode) { -return call_int_hook (kernel_create_files_as,0 , new, inode); +return call_int_hook (kernel_create_files_as, new, inode); }int security_kernel_module_request (char *kmod_name) {int ret; - ret =call_int_hook (kernel_module_request,0 , kmod_name); + ret =call_int_hook (kernel_module_request, kmod_name);if (ret)return ret;return integrity_kernel_module_request (kmod_name);
@@ -1713,7 +1776,7 @@ int security_kernel_read_file(struct fil {int ret; - ret =call_int_hook (kernel_read_file,0 , file, id, contents); + ret =call_int_hook (kernel_read_file, file, id, contents);if (ret)return ret;return ima_read_file (file, id, contents);
@@ -1725,7 +1788,7 @@ int security_kernel_post_read_file(struc {int ret; - ret =call_int_hook (kernel_post_read_file,0 , file, buf, size, id); + ret =call_int_hook (kernel_post_read_file, file, buf, size, id);if (ret)return ret;return ima_post_read_file (file, buf, size, id);
@@ -1736,7 +1799,7 @@ int security_kernel_load_data(enum kerne {int ret; - ret =call_int_hook (kernel_load_data,0 , id, contents); + ret =call_int_hook (kernel_load_data, id, contents);if (ret)return ret;return ima_load_data (id, contents);
@@ -1749,7 +1812,7 @@ int security_kernel_post_load_data(char {int ret; - ret =call_int_hook (kernel_post_load_data,0 , buf, size, id, + ret =call_int_hook (kernel_post_load_data, buf, size, id, description);if (ret)return ret;
@@ -1760,28 +1823,28 @@ EXPORT_SYMBOL_GPL(security_kernel_post_lint security_task_fix_setuid (struct cred *new,const struct cred *old,int flags) { -return call_int_hook (task_fix_setuid,0 , new, old, flags); +return call_int_hook (task_fix_setuid, new, old, flags); }int security_task_fix_setgid (struct cred *new,const struct cred *old,int flags) { -return call_int_hook (task_fix_setgid,0 , new, old, flags); +return call_int_hook (task_fix_setgid, new, old, flags); }int security_task_setpgid (struct task_struct *p,pid_t pgid) { -return call_int_hook (task_setpgid,0 , p, pgid); +return call_int_hook (task_setpgid, p, pgid); }int security_task_getpgid (struct task_struct *p) { -return call_int_hook (task_getpgid,0 , p); +return call_int_hook (task_getpgid, p); }int security_task_getsid (struct task_struct *p) { -return call_int_hook (task_getsid,0 , p); +return call_int_hook (task_getsid, p); }void security_task_getsecid (struct task_struct *p,u32 *secid)
@@ -1793,50 +1856,50 @@ EXPORT_SYMBOL(security_task_getsecid);int security_task_setnice (struct task_struct *p,int nice) { -return call_int_hook (task_setnice,0 , p, nice); +return call_int_hook (task_setnice, p, nice); }int security_task_setioprio (struct task_struct *p,int ioprio) { -return call_int_hook (task_setioprio,0 , p, ioprio); +return call_int_hook (task_setioprio, p, ioprio); }int security_task_getioprio (struct task_struct *p) { -return call_int_hook (task_getioprio,0 , p); +return call_int_hook (task_getioprio, p); }int security_task_prlimit (const struct cred *cred,const struct cred *tcred,unsigned int flags) { -return call_int_hook (task_prlimit,0 , cred, tcred, flags); +return call_int_hook (task_prlimit, cred, tcred, flags); }int security_task_setrlimit (struct task_struct *p,unsigned int resource,struct rlimit *new_rlim) { -return call_int_hook (task_setrlimit,0 , p, resource, new_rlim); +return call_int_hook (task_setrlimit, p, resource, new_rlim); }int security_task_setscheduler (struct task_struct *p) { -return call_int_hook (task_setscheduler,0 , p); +return call_int_hook (task_setscheduler, p); }int security_task_getscheduler (struct task_struct *p) { -return call_int_hook (task_getscheduler,0 , p); +return call_int_hook (task_getscheduler, p); }int security_task_movememory (struct task_struct *p) { -return call_int_hook (task_movememory,0 , p); +return call_int_hook (task_movememory, p); }int security_task_kill (struct task_struct *p,struct kernel_siginfo *info,int sig,const struct cred *cred) { -return call_int_hook (task_kill,0 , p, info, sig, cred); +return call_int_hook (task_kill, p, info, sig, cred); } int security_task_prctl(int option, unsigned long arg2, unsigned long arg3,
@@ -1864,7 +1927,7 @@ void security_task_to_inode(struct task_int security_ipc_permission (struct kern_ipc_perm *ipcp,short flag) { -return call_int_hook (ipc_permission,0 , ipcp, flag); +return call_int_hook (ipc_permission, ipcp, flag); }void security_ipc_getsecid (struct kern_ipc_perm *ipcp,u32 *secid)
@@ -1879,7 +1942,7 @@ int security_msg_msg_alloc(struct msg_msif (unlikely (rc))return rc; - rc =call_int_hook (msg_msg_alloc_security,0 , msg); + rc =call_int_hook (msg_msg_alloc_security, msg);if (unlikely (rc))security_msg_msg_free (msg);return rc;
@@ -1898,7 +1961,7 @@ int security_msg_queue_alloc(struct kernif (unlikely (rc))return rc; - rc =call_int_hook (msg_queue_alloc_security,0 , msq); + rc =call_int_hook (msg_queue_alloc_security, msq);if (unlikely (rc))security_msg_queue_free (msq);return rc;
@@ -1913,24 +1976,24 @@ void security_msg_queue_free(struct kernint security_msg_queue_associate (struct kern_ipc_perm *msq,int msqflg) { -return call_int_hook (msg_queue_associate,0 , msq, msqflg); +return call_int_hook (msg_queue_associate, msq, msqflg); }int security_msg_queue_msgctl (struct kern_ipc_perm *msq,int cmd) { -return call_int_hook (msg_queue_msgctl,0 , msq, cmd); +return call_int_hook (msg_queue_msgctl, msq, cmd); }int security_msg_queue_msgsnd (struct kern_ipc_perm *msq,struct msg_msg *msg,int msqflg) { -return call_int_hook (msg_queue_msgsnd,0 , msq, msg, msqflg); +return call_int_hook (msg_queue_msgsnd, msq, msg, msqflg); }int security_msg_queue_msgrcv (struct kern_ipc_perm *msq,struct msg_msg *msg,struct task_struct *target,long type,int mode) { -return call_int_hook (msg_queue_msgrcv,0 , msq, msg, target, type, mode); +return call_int_hook (msg_queue_msgrcv, msq, msg, target, type, mode); }int security_shm_alloc (struct kern_ipc_perm *shp)
@@ -1939,7 +2002,7 @@ int security_shm_alloc(struct kern_ipc_pif (unlikely (rc))return rc; - rc =call_int_hook (shm_alloc_security,0 , shp); + rc =call_int_hook (shm_alloc_security, shp);if (unlikely (rc))security_shm_free (shp);return rc;
@@ -1954,17 +2017,17 @@ void security_shm_free(struct kern_ipc_pint security_shm_associate (struct kern_ipc_perm *shp,int shmflg) { -return call_int_hook (shm_associate,0 , shp, shmflg); +return call_int_hook (shm_associate, shp, shmflg); }int security_shm_shmctl (struct kern_ipc_perm *shp,int cmd) { -return call_int_hook (shm_shmctl,0 , shp, cmd); +return call_int_hook (shm_shmctl, shp, cmd); }int security_shm_shmat (struct kern_ipc_perm *shp,char __user *shmaddr,int shmflg) { -return call_int_hook (shm_shmat,0 , shp, shmaddr, shmflg); +return call_int_hook (shm_shmat, shp, shmaddr, shmflg); }int security_sem_alloc (struct kern_ipc_perm *sma)
@@ -1973,7 +2036,7 @@ int security_sem_alloc(struct kern_ipc_pif (unlikely (rc))return rc; - rc =call_int_hook (sem_alloc_security,0 , sma); + rc =call_int_hook (sem_alloc_security, sma);if (unlikely (rc))security_sem_free (sma);return rc;
@@ -1988,18 +2051,18 @@ void security_sem_free(struct kern_ipc_pint security_sem_associate (struct kern_ipc_perm *sma,int semflg) { -return call_int_hook (sem_associate,0 , sma, semflg); +return call_int_hook (sem_associate, sma, semflg); }int security_sem_semctl (struct kern_ipc_perm *sma,int cmd) { -return call_int_hook (sem_semctl,0 , sma, cmd); +return call_int_hook (sem_semctl, sma, cmd); }int security_sem_semop (struct kern_ipc_perm *sma,struct sembuf *sops,unsigned nsops,int alter) { -return call_int_hook (sem_semop,0 , sma, sops, nsops, alter); +return call_int_hook (sem_semop, sma, sops, nsops, alter); }void security_d_instantiate (struct dentry *dentry,struct inode *inode)
@@ -2038,12 +2101,12 @@ int security_setprocattr(const char *lsmint security_netlink_send (struct sock *sk,struct sk_buff *skb) { -return call_int_hook (netlink_send,0 , sk, skb); +return call_int_hook (netlink_send, sk, skb); }int security_ismaclabel (const char *name) { -return call_int_hook (ismaclabel,0 , name); +return call_int_hook (ismaclabel, name); }EXPORT_SYMBOL (security_ismaclabel);
@@ -2069,7 +2132,7 @@ EXPORT_SYMBOL(security_secid_to_secctx);int security_secctx_to_secid (const char *secdata,u32 seclen,u32 *secid) { *secid =0 ; -return call_int_hook (secctx_to_secid,0 , secdata, seclen, secid); +return call_int_hook (secctx_to_secid, secdata, seclen, secid); }EXPORT_SYMBOL (security_secctx_to_secid);
@@ -2087,13 +2150,13 @@ EXPORT_SYMBOL(security_inode_invalidate_int security_inode_notifysecctx (struct inode *inode,void *ctx,u32 ctxlen) { -return call_int_hook (inode_notifysecctx,0 , inode, ctx, ctxlen); +return call_int_hook (inode_notifysecctx, inode, ctx, ctxlen); }EXPORT_SYMBOL (security_inode_notifysecctx);int security_inode_setsecctx (struct dentry *dentry,void *ctx,u32 ctxlen) { -return call_int_hook (inode_setsecctx,0 , dentry, ctx, ctxlen); +return call_int_hook (inode_setsecctx, dentry, ctx, ctxlen); }EXPORT_SYMBOL (security_inode_setsecctx);
@@ -2120,14 +2183,14 @@ int security_post_notification(const strconst struct cred *cred, struct watch_notification *n) { - return call_int_hook(post_notification, 0, w_cred, cred, n); + return call_int_hook(post_notification, w_cred, cred, n); }#endif /* CONFIG_WATCH_QUEUE */ #ifdef CONFIG_KEY_NOTIFICATIONS int security_watch_key (struct key *key) { -return call_int_hook (watch_key,0 , key); +return call_int_hook (watch_key, key); }#endif
@@ -2135,93 +2198,93 @@ int security_watch_key(struct key *key)int security_unix_stream_connect (struct sock *sock,struct sock *other,struct sock *newsk) { -return call_int_hook (unix_stream_connect,0 , sock, other, newsk); +return call_int_hook (unix_stream_connect, sock, other, newsk); }EXPORT_SYMBOL (security_unix_stream_connect);int security_unix_may_send (struct socket *sock,struct socket *other) { -return call_int_hook (unix_may_send,0 , sock, other); +return call_int_hook (unix_may_send, sock, other); }EXPORT_SYMBOL (security_unix_may_send);int security_socket_create (int family,int type,int protocol,int kern) { -return call_int_hook (socket_create,0 , family, type, protocol, kern); +return call_int_hook (socket_create, family, type, protocol, kern); }int security_socket_post_create (struct socket *sock,int family,int type,int protocol,int kern) { -return call_int_hook (socket_post_create,0 , sock, family, type, +return call_int_hook (socket_post_create, sock, family, type, protocol, kern); }int security_socket_socketpair (struct socket *socka,struct socket *sockb) { -return call_int_hook (socket_socketpair,0 , socka, sockb); +return call_int_hook (socket_socketpair, socka, sockb); }EXPORT_SYMBOL (security_socket_socketpair);int security_socket_bind (struct socket *sock,struct sockaddr *address,int addrlen) { -return call_int_hook (socket_bind,0 , sock, address, addrlen); +return call_int_hook (socket_bind, sock, address, addrlen); }int security_socket_connect (struct socket *sock,struct sockaddr *address,int addrlen) { -return call_int_hook (socket_connect,0 , sock, address, addrlen); +return call_int_hook (socket_connect, sock, address, addrlen); }int security_socket_listen (struct socket *sock,int backlog) { -return call_int_hook (socket_listen,0 , sock, backlog); +return call_int_hook (socket_listen, sock, backlog); }int security_socket_accept (struct socket *sock,struct socket *newsock) { -return call_int_hook (socket_accept,0 , sock, newsock); +return call_int_hook (socket_accept, sock, newsock); }int security_socket_sendmsg (struct socket *sock,struct msghdr *msg,int size) { -return call_int_hook (socket_sendmsg,0 , sock, msg, size); +return call_int_hook (socket_sendmsg, sock, msg, size); }int security_socket_recvmsg (struct socket *sock,struct msghdr *msg,int size,int flags) { -return call_int_hook (socket_recvmsg,0 , sock, msg, size, flags); +return call_int_hook (socket_recvmsg, sock, msg, size, flags); }int security_socket_getsockname (struct socket *sock) { -return call_int_hook (socket_getsockname,0 , sock); +return call_int_hook (socket_getsockname, sock); }int security_socket_getpeername (struct socket *sock) { -return call_int_hook (socket_getpeername,0 , sock); +return call_int_hook (socket_getpeername, sock); }int security_socket_getsockopt (struct socket *sock,int level,int optname) { -return call_int_hook (socket_getsockopt,0 , sock, level, optname); +return call_int_hook (socket_getsockopt, sock, level, optname); }int security_socket_setsockopt (struct socket *sock,int level,int optname) { -return call_int_hook (socket_setsockopt,0 , sock, level, optname); +return call_int_hook (socket_setsockopt, sock, level, optname); }int security_socket_shutdown (struct socket *sock,int how) { -return call_int_hook (socket_shutdown,0 , sock, how); +return call_int_hook (socket_shutdown, sock, how); }int security_sock_rcv_skb (struct sock *sk,struct sk_buff *skb) { -return call_int_hook (socket_sock_rcv_skb,0 , sk, skb); +return call_int_hook (socket_sock_rcv_skb, sk, skb); }EXPORT_SYMBOL (security_sock_rcv_skb);
@@ -2264,7 +2327,7 @@ EXPORT_SYMBOL(security_socket_getpeersecint security_sk_alloc (struct sock *sk,int family,gfp_t priority) { -return call_int_hook (sk_alloc_security,0 , sk, family, priority); +return call_int_hook (sk_alloc_security, sk, family, priority); }void security_sk_free (struct sock *sk)
@@ -2300,7 +2363,7 @@ EXPORT_SYMBOL(security_sock_graft);int security_inet_conn_request (struct sock *sk,struct sk_buff *skb,struct request_sock *req) { -return call_int_hook (inet_conn_request,0 , sk, skb, req); +return call_int_hook (inet_conn_request, sk, skb, req); }EXPORT_SYMBOL (security_inet_conn_request);
@@ -2319,7 +2382,7 @@ EXPORT_SYMBOL(security_inet_conn_establiint security_secmark_relabel_packet (u32 secid) { -return call_int_hook (secmark_relabel_packet,0 , secid); +return call_int_hook (secmark_relabel_packet, secid); }EXPORT_SYMBOL (security_secmark_relabel_packet);
@@ -2337,7 +2400,7 @@ EXPORT_SYMBOL(security_secmark_refcount_int security_tun_dev_alloc_security (void **security) { -return call_int_hook (tun_dev_alloc_security,0 , security); +return call_int_hook (tun_dev_alloc_security, security); }EXPORT_SYMBOL (security_tun_dev_alloc_security);
@@ -2349,38 +2412,38 @@ EXPORT_SYMBOL(security_tun_dev_free_secuint security_tun_dev_create (void ) { -return call_int_hook (tun_dev_create,0 ); +return call_int_hook (tun_dev_create); }EXPORT_SYMBOL (security_tun_dev_create);int security_tun_dev_attach_queue (void *security) { -return call_int_hook (tun_dev_attach_queue,0 , security); +return call_int_hook (tun_dev_attach_queue, security); }EXPORT_SYMBOL (security_tun_dev_attach_queue);int security_tun_dev_attach (struct sock *sk,void *security) { -return call_int_hook (tun_dev_attach,0 , sk, security); +return call_int_hook (tun_dev_attach, sk, security); }EXPORT_SYMBOL (security_tun_dev_attach);int security_tun_dev_open (void *security) { -return call_int_hook (tun_dev_open,0 , security); +return call_int_hook (tun_dev_open, security); }EXPORT_SYMBOL (security_tun_dev_open);int security_sctp_assoc_request (struct sctp_endpoint *ep,struct sk_buff *skb) { -return call_int_hook (sctp_assoc_request,0 , ep, skb); +return call_int_hook (sctp_assoc_request, ep, skb); }EXPORT_SYMBOL (security_sctp_assoc_request);int security_sctp_bind_connect (struct sock *sk,int optname,struct sockaddr *address,int addrlen) { -return call_int_hook (sctp_bind_connect,0 , sk, optname, +return call_int_hook (sctp_bind_connect, sk, optname, address, addrlen); }EXPORT_SYMBOL (security_sctp_bind_connect);
@@ -2398,19 +2461,19 @@ EXPORT_SYMBOL(security_sctp_sk_clone);int security_ib_pkey_access (void *sec,u64 subnet_prefix,u16 pkey) { -return call_int_hook (ib_pkey_access,0 , sec, subnet_prefix, pkey); +return call_int_hook (ib_pkey_access, sec, subnet_prefix, pkey); }EXPORT_SYMBOL (security_ib_pkey_access);int security_ib_endport_manage_subnet (void *sec,const char *dev_name,u8 port_num) { -return call_int_hook (ib_endport_manage_subnet,0 , sec, dev_name, port_num); +return call_int_hook (ib_endport_manage_subnet, sec, dev_name, port_num); }EXPORT_SYMBOL (security_ib_endport_manage_subnet);int security_ib_alloc_security (void **sec) { -return call_int_hook (ib_alloc_security,0 , sec); +return call_int_hook (ib_alloc_security, sec); }EXPORT_SYMBOL (security_ib_alloc_security);
@@ -2427,14 +2490,14 @@ int security_xfrm_policy_alloc(struct xfstruct xfrm_user_sec_ctx *sec_ctx, gfp_t gfp) { -return call_int_hook (xfrm_policy_alloc_security,0 , ctxp, sec_ctx, gfp); + return call_int_hook(xfrm_policy_alloc_security, ctxp, sec_ctx, gfp); }EXPORT_SYMBOL (security_xfrm_policy_alloc);int security_xfrm_policy_clone (struct xfrm_sec_ctx *old_ctx,struct xfrm_sec_ctx **new_ctxp) { -return call_int_hook (xfrm_policy_clone_security,0 , old_ctx, new_ctxp); +return call_int_hook (xfrm_policy_clone_security, old_ctx, new_ctxp); }void security_xfrm_policy_free (struct xfrm_sec_ctx *ctx)
@@ -2445,25 +2508,25 @@ EXPORT_SYMBOL(security_xfrm_policy_free)int security_xfrm_policy_delete (struct xfrm_sec_ctx *ctx) { -return call_int_hook (xfrm_policy_delete_security,0 , ctx); +return call_int_hook (xfrm_policy_delete_security, ctx); }int security_xfrm_state_alloc (struct xfrm_state *x,struct xfrm_user_sec_ctx *sec_ctx) { -return call_int_hook (xfrm_state_alloc,0 , x, sec_ctx); +return call_int_hook (xfrm_state_alloc, x, sec_ctx); }EXPORT_SYMBOL (security_xfrm_state_alloc);int security_xfrm_state_alloc_acquire (struct xfrm_state *x,struct xfrm_sec_ctx *polsec,u32 secid) { -return call_int_hook (xfrm_state_alloc_acquire,0 , x, polsec, secid); +return call_int_hook (xfrm_state_alloc_acquire, x, polsec, secid); }int security_xfrm_state_delete (struct xfrm_state *x) { -return call_int_hook (xfrm_state_delete_security,0 , x); +return call_int_hook (xfrm_state_delete_security, x); }EXPORT_SYMBOL (security_xfrm_state_delete);
@@ -2474,7 +2537,7 @@ void security_xfrm_state_free(struct xfrint security_xfrm_policy_lookup (struct xfrm_sec_ctx *ctx,u32 fl_secid,u8 dir) { -return call_int_hook (xfrm_policy_lookup,0 , ctx, fl_secid, dir); +return call_int_hook (xfrm_policy_lookup, ctx, fl_secid, dir); } int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
@@ -2503,12 +2566,12 @@ int security_xfrm_state_pol_flow_match(sint security_xfrm_decode_session (struct sk_buff *skb,u32 *secid) { -return call_int_hook (xfrm_decode_session,0 , skb, secid,1 ); +return call_int_hook (xfrm_decode_session, skb, secid,1 ); }void security_skb_classify_flow (struct sk_buff *skb,struct flowi_common *flic) { -int rc =call_int_hook (xfrm_decode_session,0 , skb, &flic->flowic_secid, +int rc =call_int_hook (xfrm_decode_session, skb, &flic->flowic_secid,0 );BUG_ON (rc);
@@ -2522,7 +2585,7 @@ EXPORT_SYMBOL(security_skb_classify_flowint security_key_alloc (struct key *key,const struct cred *cred,unsigned long flags) { -return call_int_hook (key_alloc,0 , key, cred, flags); +return call_int_hook (key_alloc, key, cred, flags); }void security_key_free (struct key *key)
@@ -2533,13 +2596,13 @@ void security_key_free(struct key *key)int security_key_permission (key_ref_t key_ref,const struct cred *cred,enum key_need_perm need_perm) { -return call_int_hook (key_permission,0 , key_ref, cred, need_perm); +return call_int_hook (key_permission, key_ref, cred, need_perm); }int security_key_getsecurity (struct key *key,char **_buffer) { *_buffer =NULL ; -return call_int_hook (key_getsecurity,0 , key, _buffer); +return call_int_hook (key_getsecurity, key, _buffer); }#endif /* CONFIG_KEYS */
@@ -2549,13 +2612,13 @@ int security_key_getsecurity(struct keyint security_audit_rule_init (u32 field,u32 op,char *rulestr,void **lsmrule,gfp_t gfp) { -return call_int_hook (audit_rule_init,0 , field, op, rulestr, lsmrule, +return call_int_hook (audit_rule_init, field, op, rulestr, lsmrule, gfp); }int security_audit_rule_known (struct audit_krule *krule) { -return call_int_hook (audit_rule_known,0 , krule); +return call_int_hook (audit_rule_known, krule); }void security_audit_rule_free (void *lsmrule)
@@ -2565,30 +2628,30 @@ void security_audit_rule_free(void *lsmrint security_audit_rule_match (u32 secid,u32 field,u32 op,void *lsmrule) { -return call_int_hook (audit_rule_match,0 , secid, field, op, lsmrule); +return call_int_hook (audit_rule_match, secid, field, op, lsmrule); }#endif /* CONFIG_AUDIT */ #ifdef CONFIG_BPF_SYSCALL int security_bpf (int cmd,union bpf_attr *attr,unsigned int size) { -return call_int_hook (bpf,0 , cmd, attr, size); +return call_int_hook (bpf, cmd, attr, size); }int security_bpf_map (struct bpf_map *map,fmode_t fmode) { -return call_int_hook (bpf_map,0 , map, fmode); +return call_int_hook (bpf_map, map, fmode); }int security_bpf_prog (struct bpf_prog *prog) { -return call_int_hook (bpf_prog,0 , prog); +return call_int_hook (bpf_prog, prog); }int security_bpf_map_alloc (struct bpf_map *map) { -return call_int_hook (bpf_map_alloc_security,0 , map); +return call_int_hook (bpf_map_alloc_security, map); }int security_bpf_prog_alloc (struct bpf_prog_aux *aux) { -return call_int_hook (bpf_prog_alloc_security,0 , aux); +return call_int_hook (bpf_prog_alloc_security, aux); }void security_bpf_map_free (struct bpf_map *map) {
@@ -2602,19 +2665,19 @@ void security_bpf_prog_free(struct bpf_pint security_locked_down (enum lockdown_reason what) { -return call_int_hook (locked_down,0 , what); +return call_int_hook (locked_down, what); }EXPORT_SYMBOL (security_locked_down);#ifdef CONFIG_PERF_EVENTS int security_perf_event_open (struct perf_event_attr *attr,int type) { -return call_int_hook (perf_event_open,0 , attr, type); +return call_int_hook (perf_event_open, attr, type); }int security_perf_event_alloc (struct perf_event *event) { -return call_int_hook (perf_event_alloc,0 , event); +return call_int_hook (perf_event_alloc, event); }void security_perf_event_free (struct perf_event *event)
@@ -2624,11 +2687,11 @@ void security_perf_event_free(struct perint security_perf_event_read (struct perf_event *event) { -return call_int_hook (perf_event_read,0 , event); +return call_int_hook (perf_event_read, event); }int security_perf_event_write (struct perf_event *event) { -return call_int_hook (perf_event_write,0 , event); +return call_int_hook (perf_event_write, event); }#endif /* CONFIG_PERF_EVENTS */
Greg Kroah-Hartman
maintainerPATCH 83/235 lsm: infrastructure management of the sock security
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Casey Schaufler <[email protected]>
[ Upstream commit 2aff9d20d50ac45dd13a013ef5231f4fb8912356 ]
Move management of the sock->sk_security blob out of the individual security modules and into the security infrastructure. Instead of allocating the blobs from within the modules the modules tell the infrastructure how much space is required, and the space is allocated there.
Stable-dep-of: 56acfeb10019 ("selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()")
--- include/linux/lsm_hooks.h | 1 security/apparmor/include/net.h | 6 ++- security/apparmor/lsm.c | 38 +++++--------------- security/security.c | 47 ++++++++++++++++++++++++ security/selinux/hooks.c | 72 +++++++++++++++++--------------------- security/selinux/include/objsec.h | 5 ++ security/selinux/netlabel.c | 23 ++++++------ security/smack/smack.h | 5 ++ security/smack/smack_lsm.c | 66 ++++++++++++++++------------------ security/smack/smack_netfilter.c | 8 ++-- 10 files changed, 152 insertions(+), 119 deletions(-)
include/linux/lsm_hooks.h +1 -0
@@ -1563,6 +1563,7 @@ struct lsm_blob_sizes {int lbs_cred;int lbs_file;int lbs_inode; +int lbs_sock;int lbs_ipc;int lbs_msg_msg;int lbs_task;
security/apparmor/include/net.h +5 -1
@@ -51,8 +51,12 @@ struct aa_sk_ctx {struct aa_label *peer; }; -#define SK_CTX (X ) ((X)->sk_security)#define SOCK_ctx (X ) SOCK_INODE(X)->i_security +static inline struct aa_sk_ctx *aa_sock (const struct sock *sk) +{ +return sk->sk_security + apparmor_blob_sizes.lbs_sock; +} +#define DEFINE_AUDIT_NET (NAME ,OP ,SK ,F ,T ,P ) \ struct lsm_network_audit NAME ## _net = { .sk = (SK), \ .family = (F)}; \
security/apparmor/lsm.c +10 -28
@@ -767,32 +767,14 @@ static int apparmor_task_kill(struct tas }/** -* apparmor_sk_alloc_security - allocate and attach the sk_security field -*/ -static int apparmor_sk_alloc_security (struct sock *sk,int family,gfp_t flags) -{ -struct aa_sk_ctx *ctx; - - ctx =kzalloc (sizeof (*ctx), flags); -if (!ctx) -return -ENOMEM ; - -SK_CTX (sk) = ctx; - -return 0 ; -} - -/** * apparmor_sk_free_security - free the sk_security field */ static void apparmor_sk_free_security (struct sock *sk) { -struct aa_sk_ctx *ctx =SK_CTX (sk); +struct aa_sk_ctx *ctx =aa_sock (sk); -SK_CTX (sk) =NULL ;aa_put_label (ctx->label);aa_put_label (ctx->peer); -kfree (ctx); }/**
@@ -801,8 +783,8 @@ static void apparmor_sk_free_security(ststatic void apparmor_sk_clone_security (const struct sock *sk,struct sock *newsk) { -struct aa_sk_ctx *ctx =SK_CTX (sk); -struct aa_sk_ctx *new =SK_CTX (newsk); +struct aa_sk_ctx *ctx =aa_sock (sk); +struct aa_sk_ctx *new =aa_sock (newsk);if (new->label)aa_put_label (new->label);
@@ -858,7 +840,7 @@ static int apparmor_socket_post_create(s label =aa_get_current_label ();if (sock->sk) { -struct aa_sk_ctx *ctx =SK_CTX (sock->sk); +struct aa_sk_ctx *ctx =aa_sock (sock->sk);aa_put_label (ctx->label); ctx->label =aa_get_label (label);
@@ -1059,7 +1041,7 @@ static int apparmor_socket_shutdown(stru*/ static int apparmor_socket_sock_rcv_skb (struct sock *sk,struct sk_buff *skb) { -struct aa_sk_ctx *ctx =SK_CTX (sk); +struct aa_sk_ctx *ctx =aa_sock (sk);if (!skb->secmark)return 0 ;
@@ -1079,7 +1061,7 @@ static int apparmor_socket_sock_rcv_skb(static struct aa_label *sk_peer_label (struct sock *sk) { -struct aa_sk_ctx *ctx =SK_CTX (sk); +struct aa_sk_ctx *ctx =aa_sock (sk);if (ctx->peer)return ctx->peer;
@@ -1160,7 +1142,7 @@ static int apparmor_socket_getpeersec_dg*/ static void apparmor_sock_graft (struct sock *sk,struct socket *parent) { -struct aa_sk_ctx *ctx =SK_CTX (sk); +struct aa_sk_ctx *ctx =aa_sock (sk);if (!ctx->label) ctx->label =aa_get_current_label ();
@@ -1170,7 +1152,7 @@ static void apparmor_sock_graft(struct sstatic int apparmor_inet_conn_request (struct sock *sk,struct sk_buff *skb,struct request_sock *req) { -struct aa_sk_ctx *ctx =SK_CTX (sk); +struct aa_sk_ctx *ctx =aa_sock (sk);if (!skb->secmark)return 0 ;
@@ -1187,6 +1169,7 @@ struct lsm_blob_sizes apparmor_blob_size .lbs_cred = sizeof(struct aa_label *), .lbs_file = sizeof(struct aa_file_ctx), .lbs_task = sizeof(struct aa_task_ctx), + .lbs_sock = sizeof(struct aa_sk_ctx), }; static struct security_hook_list apparmor_hooks[] __lsm_ro_after_init = {
@@ -1223,7 +1206,6 @@ static struct security_hook_list apparmoLSM_HOOK_INIT (getprocattr, apparmor_getprocattr),LSM_HOOK_INIT (setprocattr, apparmor_setprocattr), -LSM_HOOK_INIT (sk_alloc_security, apparmor_sk_alloc_security),LSM_HOOK_INIT (sk_free_security, apparmor_sk_free_security), LSM_HOOK_INIT(sk_clone_security, apparmor_sk_clone_security),
@@ -1774,7 +1756,7 @@ static unsigned int apparmor_ip_postroutif (sk ==NULL )return NF_ACCEPT ; - ctx =SK_CTX (sk); + ctx =aa_sock (sk);if (!apparmor_secmark_check (ctx->label,OP_SENDMSG ,AA_MAY_SEND , skb->secmark, sk))return NF_ACCEPT ;
security/security.c +46 -1
78 lines not on this page · raw message
security/selinux/hooks.c +33 -39
239 lines not on this page · raw message
security/selinux/include/objsec.h +5 -0
@@ -189,4 +189,9 @@ static inline u32 current_sid(void) return tsec->sid; } +static inline struct sk_security_struct *selinux_sock (const struct sock *sock) +{ +return sock->sk_security + selinux_blob_sizes.lbs_sock; +} +#endif /* _SELINUX_OBJSEC_H_ */
security/selinux/netlabel.c +12 -11
@@ -17,6 +17,7 @@#include <linux/gfp.h> #include <linux/ip.h> #include <linux/ipv6.h> +#include <linux/lsm_hooks.h> #include <net/sock.h> #include <net/netlabel.h> #include <net/ip.h>
@@ -67,7 +68,7 @@ static int selinux_netlbl_sidlookup_cachstatic struct netlbl_lsm_secattr *selinux_netlbl_sock_genattr (struct sock *sk) {int rc; -struct sk_security_struct *sksec = sk->sk_security; +struct sk_security_struct *sksec =selinux_sock (sk);struct netlbl_lsm_secattr *secattr;if (sksec->nlbl_secattr !=NULL )
@@ -100,7 +101,7 @@ static struct netlbl_lsm_secattr *selinu const struct sock *sk, u32 sid) { -struct sk_security_struct *sksec = sk->sk_security; +struct sk_security_struct *sksec =selinux_sock (sk);struct netlbl_lsm_secattr *secattr = sksec->nlbl_secattr;if (secattr ==NULL )
@@ -235,7 +236,7 @@ int selinux_netlbl_skbuff_setsid(struct* being labeled by it's parent socket, if it is just exit */ sk =skb_to_full_sk (skb);if (sk !=NULL ) { -struct sk_security_struct *sksec = sk->sk_security; +struct sk_security_struct *sksec =selinux_sock (sk);if (sksec->nlbl_state !=NLBL_REQSKB )return 0 ;
@@ -273,7 +274,7 @@ int selinux_netlbl_sctp_assoc_request(st {int rc;struct netlbl_lsm_secattr secattr; -struct sk_security_struct *sksec = ep->base.sk->sk_security; +struct sk_security_struct *sksec =selinux_sock (ep->base.sk);struct sockaddr_in addr4;struct sockaddr_in6 addr6;
@@ -352,7 +353,7 @@ inet_conn_request_return:*/ void selinux_netlbl_inet_csk_clone (struct sock *sk,u16 family) { -struct sk_security_struct *sksec = sk->sk_security; +struct sk_security_struct *sksec =selinux_sock (sk);if (family ==PF_INET ) sksec->nlbl_state =NLBL_LABELED ;
@@ -370,8 +371,8 @@ void selinux_netlbl_inet_csk_clone(struc*/ void selinux_netlbl_sctp_sk_clone (struct sock *sk,struct sock *newsk) { -struct sk_security_struct *sksec = sk->sk_security; -struct sk_security_struct *newsksec = newsk->sk_security; +struct sk_security_struct *sksec =selinux_sock (sk); +struct sk_security_struct *newsksec =selinux_sock (newsk); newsksec->nlbl_state = sksec->nlbl_state; }
@@ -389,7 +390,7 @@ void selinux_netlbl_sctp_sk_clone(structint selinux_netlbl_socket_post_create (struct sock *sk,u16 family) {int rc; -struct sk_security_struct *sksec = sk->sk_security; +struct sk_security_struct *sksec =selinux_sock (sk);struct netlbl_lsm_secattr *secattr;if (family !=PF_INET && family !=PF_INET6 )
@@ -504,7 +505,7 @@ int selinux_netlbl_socket_setsockopt(str {int rc =0 ;struct sock *sk = sock->sk; -struct sk_security_struct *sksec = sk->sk_security; +struct sk_security_struct *sksec =selinux_sock (sk);struct netlbl_lsm_secattr secattr; if (selinux_netlbl_option(level, optname) &&
@@ -542,7 +543,7 @@ static int selinux_netlbl_socket_connect struct sockaddr *addr) {int rc; -struct sk_security_struct *sksec = sk->sk_security; +struct sk_security_struct *sksec =selinux_sock (sk);struct netlbl_lsm_secattr *secattr;/* connected sockets are allowed to disconnect when the address family
@@ -581,7 +582,7 @@ static int selinux_netlbl_socket_connectint selinux_netlbl_socket_connect_locked (struct sock *sk,struct sockaddr *addr) { -struct sk_security_struct *sksec = sk->sk_security; +struct sk_security_struct *sksec =selinux_sock (sk);if (sksec->nlbl_state !=NLBL_REQSKB && sksec->nlbl_state !=NLBL_CONNLABELED )
security/smack/smack.h +5 -0
@@ -358,6 +358,11 @@ static inline struct smack_known **smackreturn ipc->security + smack_blob_sizes.lbs_ipc; } +static inline struct socket_smack *smack_sock (const struct sock *sock) +{ +return sock->sk_security + smack_blob_sizes.lbs_sock; +} +/* * Is the directory transmuting? */
security/smack/smack_lsm.c +31 -35
233 lines not on this page · raw message
security/smack/smack_netfilter.c +4 -4
@@ -28,8 +28,8 @@ static unsigned int smack_ipv6_output(vostruct socket_smack *ssp;struct smack_known *skp; -if (sk && sk->sk_security) { - ssp = sk->sk_security; +if (sk) { + ssp =smack_sock (sk); skp = ssp->smk_out; skb->secmark = skp->smk_secid; }
@@ -46,8 +46,8 @@ static unsigned int smack_ipv4_output(vostruct socket_smack *ssp;struct smack_known *skp; -if (sk && sk->sk_security) { - ssp = sk->sk_security; +if (sk) { + ssp =smack_sock (sk); skp = ssp->smk_out; skb->secmark = skp->smk_secid; }
Greg Kroah-Hartman
maintainerPATCH 84/235 selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristan Madani <[email protected]>
[ Upstream commit 56acfeb10019e200ab6787d01f8d7cbe0f01526f ]
selinux_sctp_bind_connect() dereferences sk->sk_socket to pass a struct socket * to selinux_socket_bind() and selinux_socket_connect_helper(). However, when the hook is invoked from the ASCONF softirq path (sctp_process_asconf), there is no file reference guaranteeing that sk->sk_socket is non-NULL. The setsockopt callers (bindx, connectx, set_primary, sendmsg connect) hold a file reference and are not affected.
Both selinux_socket_bind() and selinux_socket_connect_helper() immediately resolve sock->sk, never using the struct socket * for anything else. Refactor the inner logic into helpers that take a struct sock * directly so that selinux_sctp_bind_connect() never needs to touch sk->sk_socket at all.
--- security/selinux/hooks.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-)
security/selinux/hooks.c +10 -9
@@ -4608,9 +4608,8 @@ static int selinux_socket_socketpair(strNeed to determine whether we should perform a name_bind permission check between the socket and the port number. */ -static int selinux_socket_bind (struct socket *sock,struct sockaddr *address,int addrlen) +static int __selinux_socket_bind (struct sock *sk,struct sockaddr *address,int addrlen) { -struct sock *sk = sock->sk;struct sk_security_struct *sksec =selinux_sock (sk);u16 family;int err;
@@ -4746,13 +4745,17 @@ err_af:return -EAFNOSUPPORT ; } +static int selinux_socket_bind (struct socket *sock,struct sockaddr *address,int addrlen) +{ +return __selinux_socket_bind (sock->sk, address, addrlen); +} +/* This supports connect(2) and SCTP connect services such as sctp_connectx(3) * and sctp_sendmsg(3) as described in Documentation/security/SCTP.rst */ -static int selinux_socket_connect_helper (struct socket *sock, +static int selinux_socket_connect_helper (struct sock *sk,struct sockaddr *address,int addrlen) { -struct sock *sk = sock->sk;struct sk_security_struct *sksec =selinux_sock (sk);int err;
@@ -4846,7 +4849,7 @@ static int selinux_socket_connect(structint err;struct sock *sk = sock->sk; - err =selinux_socket_connect_helper (sock, address, addrlen); + err =selinux_socket_connect_helper (sk, address, addrlen);if (err)return err;
@@ -5310,13 +5313,11 @@ static int selinux_sctp_bind_connect(strint len, err =0 , walk_size =0 ;void *addr_buf;struct sockaddr *addr; -struct socket *sock;if (!selinux_policycap_extsockclass ())return 0 ;/* Process one or more addresses that may be IPv4 or IPv6 */ - sock = sk->sk_socket; addr_buf = address;while (walk_size < addrlen) {
@@ -5345,14 +5346,14 @@ static int selinux_sctp_bind_connect(strcase SCTP_PRIMARY_ADDR :case SCTP_SET_PEER_PRIMARY_ADDR :case SCTP_SOCKOPT_BINDX_ADD : - err =selinux_socket_bind (sock, addr, len); + err =__selinux_socket_bind (sk, addr, len);break ;/* Connect checks */ case SCTP_SOCKOPT_CONNECTX :case SCTP_PARAM_SET_PRIMARY :case SCTP_PARAM_ADD_IP :case SCTP_SENDMSG_CONNECT : - err =selinux_socket_connect_helper (sock, addr, len); + err =selinux_socket_connect_helper (sk, addr, len);if (err)return err;
Greg Kroah-Hartman
maintainerPATCH 85/235 net/9p: fix infinite loop in p9_client_rpc on fatal signal
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasiliy Kovalev <[email protected]>
[ Upstream commit 6b4f48728faa8bb514368f7eacda05565dea8696 ]
When p9_client_rpc() is called with type P9_TFLUSH and the transport has no peer (e.g. fd transport backed by pipes with no 9p server), a fatal signal causes an infinite loop:
again:
err = io_wait_event_killable(req->wq, ...)
/* SIGKILL wakes the task, returns -ERESTARTSYS */
if (err == -ERESTARTSYS && c->status == Connected &&
type == P9_TFLUSH) {
sigpending = 1;
clear_thread_flag(TIF_SIGPENDING);
goto again;
}clear_thread_flag() clears TIF_SIGPENDING before jumping back to io_wait_event_killable(). signal_pending_state() checks TIF_SIGPENDING, finds it zero, and the task goes to sleep again. The task can only wake on the next signal delivery that calls signal_wake_up() and sets TIF_SIGPENDING again. When that happens the loop repeats, clears TIF_SIGPENDING, and sleeps again indefinitely.
This is triggered in practice by coredump_wait(): when a thread in a multi-threaded process causes a coredump (e.g. via SIGSYS from Syscall User Dispatch), coredump_wait() sends SIGKILL to all other threads and waits for them to call mm_release(). If one of those threads is blocked in p9_client_rpc() over an fd transport with no peer, it enters the P9_TFLUSH loop and never calls mm_release(), so coredump_wait() stalls forever:
INFO: task syz.0.18:676 blocked for more than 143 seconds.
Not tainted 6.12.77+ #1
task:syz.0.18 state:D stack:27600 pid:676 tgid:673 ppid:630 flags:0x00000004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5344 [inline]
__schedule+0xcb4/0x5d50 kernel/sched/core.c:6724
__schedule_loop kernel/sched/core.c:6801 [inline]
schedule+0xe5/0x350 kernel/sched/core.c:6816
schedule_timeout+0x253/0x290 kernel/time/timer.c:2593
do_wait_for_common kernel/sched/completion.c:95 [inline]
__wait_for_common+0x409/0x600 kernel/sched/completion.c:116
wait_for_common kernel/sched/completion.c:127 [inline]
wait_for_completion_state+0x1d/0x40 kernel/sched/completion.c:264
coredump_wait fs/coredump.c:448 [inline]
do_coredump+0x854/0x4350 fs/coredump.c:629
get_signal+0x1425/0x2730 kernel/signal.c:2903
arch_do_signal_or_restart+0x81/0x880 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0xf9/0x160 kernel/entry/common.c:218
do_syscall_64+0x102/0x220 arch/x86/entry/common.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>Fix: check fatal_signal_pending() before clearing TIF_SIGPENDING in the P9_TFLUSH retry loop. At that point TIF_SIGPENDING is still set, so fatal_signal_pending() works correctly. If a fatal signal is pending, jump to recalc_sigpending to restore TIF_SIGPENDING and return -ERESTARTSYS to the caller.
The same defect is present in stable kernels back to 5.4. On those kernels the infinite loop is broken earlier by a second SIGKILL from the parent process (e.g. kill_and_wait() retrying after a timeout), resulting in a zombie process and a shutdown delay rather than a permanent D-state hang, but the underlying flaw is the same.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Message-ID: <[email protected]>
--- net/9p/client.c | 2 ++ 1 file changed, 2 insertions(+)
net/9p/client.c +2 -0
@@ -771,6 +771,8 @@ again:if ((err == -ERESTARTSYS ) && (c->status == Connected) && (type ==P9_TFLUSH )) { +if (fatal_signal_pending (current)) + goto recalc_sigpending; sigpending =1 ;clear_thread_flag (TIF_SIGPENDING ); goto again;
Greg Kroah-Hartman
maintainerPATCH 86/235 9p: skip nlink update in cacheless mode to fix WARN_ON
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
[ Upstream commit 574aa0b4799470ac814479f1138d19efe6262255 ]
v9fs_dec_count() unconditionally calls drop_nlink() on regular files, even when the inode's nlink is already zero. In cacheless mode the client refetches inode metadata from the server (the source of truth) on every operation, so by the time v9fs_remove() returns, the locally cached nlink may already reflect the post-unlink value:
1. Client initiates unlink, server processes it and sets nlink to 0
2. Client refetches inode metadata (nlink=0) before unlink returns
3. Client's v9fs_remove() completes successfully
4. Client calls v9fs_dec_count() which calls drop_nlink() on nlink=0
This race is easily triggered under heavy unlink workloads, such as stress-ng's unlink stressor, producing the following warning:
WARNING: fs/inode.c:417 at drop_nlink+0x4c/0xc8 Call trace: drop_nlink+0x4c/0xc8 v9fs_remove+0x1e0/0x250 [9p] v9fs_vfs_unlink+0x20/0x38 [9p] vfs_unlink+0x13c/0x258 ...
In cacheless mode the server is authoritative and the inode is on its way out, so locally adjusting nlink buys nothing. Skip v9fs_dec_count() entirely when neither CACHE_META nor CACHE_LOOSE is set, which both avoids the warning and removes a class of nlink races (two concurrent unlinkers observing nlink > 0 and both calling drop_nlink()) that an nlink == 0 guard alone would only narrow rather than close.
Message-ID: <[email protected]>
--- fs/9p/vfs_inode.c | 9 +++++++++ 1 file changed, 9 insertions(+)
fs/9p/vfs_inode.c +9 -0
@@ -516,10 +516,19 @@ static int v9fs_at_to_dotl_flags(int fla* - ext4 (with dir_nlink feature enabled) sets nlink to 1 if a dir has more * than EXT4_LINK_MAX (65000) links. * +* In cacheless mode the server is the source of truth for nlink and the +* inode is going away immediately, so locally adjusting i_nlink buys +* nothing and races with concurrent metadata fetches that may already +* have observed the post-unlink value (nlink == 0). +* * @inode: inode whose nlink is being dropped */ static void v9fs_dec_count (struct inode *inode) { +struct v9fs_session_info *v9ses =v9fs_inode2v9ses (inode); + +if (v9ses->cache !=CACHE_LOOSE && v9ses->cache !=CACHE_FSCACHE ) +return ;if (!S_ISDIR (inode->i_mode) || inode->i_nlink >2 )drop_nlink (inode); }
Greg Kroah-Hartman
maintainerPATCH 87/235 mtd: maps: vmu-flash: fix fault in unaligned fixup
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fuchs <[email protected]>
[ Upstream commit 79d1661502c6e4b6f626185cef72cf2fa78116e1 ]
Use kzalloc_obj() / kzalloc_objs() to allocate the memcard structs, instead of kmalloc_obj() / kmalloc_objs() to prevent access to uninitialized data.
Fixes runtime error: Fault in unaligned fixup: 0000 [#1] at mtd_get_fact_prot_info.
--- drivers/mtd/maps/vmu-flash.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/mtd/maps/vmu-flash.c +3 -5
@@ -610,7 +610,7 @@ static int vmu_connect(struct maple_devi basic_flash_data =be32_to_cpu (mdev->devinfo.function_data[c -1 ]); - card =kmalloc (sizeof (struct memcard ),GFP_KERNEL ); + card = kzalloc_obj(struct memcard);if (!card) { error = -ENOMEM ; goto fail_nomem;
@@ -628,15 +628,13 @@ static int vmu_connect(struct maple_devi* Not sure there are actually any multi-partition devices in the * real world, but the hardware supports them, so, so will we */ - card->parts =kmalloc_array (card->partitions,sizeof (struct vmupart ), -GFP_KERNEL ); + card->parts = kzalloc_objs(struct vmupart, card->partitions);if (!card->parts) { error = -ENOMEM ; goto fail_partitions; } - card->mtd =kmalloc_array (card->partitions,sizeof (struct mtd_info ), -GFP_KERNEL ); + card->mtd = kzalloc_objs(struct mtd_info, card->partitions);if (!card->mtd) { error = -ENOMEM ; goto fail_mtd_info;
Greg Kroah-Hartman
maintainerPATCH 88/235 net: thunderbolt: Fix frags[] overflow by bounding frame_count
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maoyi Xie <[email protected]>
[ Upstream commit 55d9895f89970501fe126d1026b586b04a224c27 ]
tbnet_poll() assembles a multi-frame ThunderboltIP packet into one skb. The first frame goes into the skb linear area and every further frame is added as a page fragment.
skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page, hdr_size, frame_size, TBNET_RX_PAGE_SIZE - hdr_size);
A packet of frame_count frames therefore ends up with frame_count - 1 fragments. tbnet_check_frame() only bounds the peer supplied frame_count to TBNET_RING_SIZE / 4 (64), which is far above MAX_SKB_FRAGS (17 by default). A peer that sends a packet of 19 or more small frames pushes nr_frags past MAX_SKB_FRAGS, so skb_add_rx_frag() writes past skb_shinfo()->frags[] and corrupts memory after the shared info.
Tighten the start of packet bound to MAX_SKB_FRAGS + 1 so a packet can never produce more fragments than frags[] can hold. This matches the recent skb frags overflow fixes in other receive paths, for example f0813bcd2d9d ("net:
wwan: t7xx: fix potential skb->frags overflow in RX path") and 600dc40554dc ("net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()").
--- drivers/net/thunderbolt.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/net/thunderbolt.c +6 -2
@@ -724,8 +724,12 @@ static bool tbnet_check_frame(struct tbnreturn true; } -/* Start of packet, validate the frame header */ -if (frame_count ==0 || frame_count >TBNET_RING_SIZE /4 ) { +/* Start of packet, validate the frame header. tbnet_poll() puts the +* first frame in the skb linear area and every further frame in a page +* fragment, so a packet may not span more than MAX_SKB_FRAGS + 1 frames +* without overflowing skb_shinfo()->frags[]. +*/ +if (frame_count ==0 || frame_count >MAX_SKB_FRAGS +1 ) { net->stats.rx_length_errors++;return false; }
Greg Kroah-Hartman
maintainerPATCH 89/235 taskstats: fill_stats_for_tgid: use for_each_thread()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <[email protected]>
[ Upstream commit ed5378a387fd7c382497f2abcf4605e030b64044 ]
do/while_each_thread should be avoided when possible.
Plus I _think_ this change allows to avoid lock_task_sighand() but I am not sure, I forgot everything about taskstats. In any case, this code does not look right in that the same thread can be accounted twice:taskstats_exit() can account the exiting thread in signal->stats and drop ->siglock but this thread is still on the thread-group list, so lock_task_sighand() can't help.
Stable-dep-of: b3e4fbb04220 ("taskstats: retain dead thread stats in TGID queries")
--- kernel/taskstats.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
kernel/taskstats.c +2 -3
@@ -211,9 +211,8 @@ static int fill_stats_for_tgid(pid_t tgielse memset (stats,0 ,sizeof (*stats)); - tsk = first; start_time =ktime_get_ns (); - do { +for_each_thread (first, tsk) {if (tsk->exit_state)continue ;/*
@@ -236,7 +235,7 @@ static int fill_stats_for_tgid(pid_t tgi stats->nvcsw += tsk->nvcsw; stats->nivcsw += tsk->nivcsw; - }while_each_thread (first, tsk); + }unlock_task_sighand (first, &flags); rc =0 ;
Greg Kroah-Hartman
maintainerPATCH 90/235 taskstats: retain dead thread stats in TGID queries
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yiyang Chen <[email protected]>
[ Upstream commit b3e4fbb04220efc3bc022bcf31b5689d39c6b111 ]
Patch series "taskstats: fix TGID dead-thread stat retention", v3.
This series fixes a taskstats TGID aggregation bug where fields added in the TGID query path were not preserved after thread exit, and adds a kselftest covering the regression.
The first patch keeps the cached TGID aggregate used for dead threads in step with the fields already accumulated for live threads, and also fixes the final TGID exit notification emitted when group_dead is true.
The second patch adds a kselftest that verifies TGID CPU stats do not regress after a worker thread exits and has been reaped.
This patch (of 2):
fill_stats_for_tgid() builds TGID stats from two sources: the cached aggregate in signal->stats and a scan of the live threads in the group.
However, fill_tgid_exit() only accumulates delay accounting into signal->stats. This means that once a thread exits, TGID queries lose the fields that fill_stats_for_tgid() adds for live threads.
This gap was introduced incrementally by two earlier changes that extended fill_stats_for_tgid() but did not make the corresponding update to fill_tgid_exit():
- commit 8c733420bdd5 ("taskstats: add e/u/stime for TGID command") added ac_etime, ac_utime, and ac_stime to the TGID query path.
- commit b663a79c1915 ("taskstats: add context-switch counters") added nvcsw and nivcsw to the TGID query path.
As a result, those fields were accounted for live threads in TGID queries, but were dropped from the cached TGID aggregate after thread exit. The final TGID exit notification emitted when group_dead is true also copies that cached aggregate, so it loses the same fields.
Factor the per-task TGID accumulation into tgid_stats_add_task() and use it in both fill_stats_for_tgid() and fill_tgid_exit(). This keeps the cached aggregate used for dead threads aligned with the live-thread accumulation used by TGID queries.
--- kernel/taskstats.c | 62 ++++++++++++++++++++++++++++------------------------- 1 file changed, 33 insertions(+), 29 deletions(-)
kernel/taskstats.c +33 -29
@@ -188,13 +188,39 @@ static int fill_stats_for_pid(pid_t pid,return 0 ; } +static void tgid_stats_add_task (struct taskstats *stats, +struct task_struct *tsk,u64 now_ns) +{ +u64 delta, utime, stime; + +/* +* Each accounting subsystem calls its functions here to +* accumulate its per-task stats for tsk, into the per-tgid structure +* +* per-task-foo(stats, tsk); +*/ +delayacct_add_tsk (stats, tsk); + +/* calculate task elapsed time in nsec */ + delta = now_ns - tsk->start_time; +/* Convert to micro seconds */ +do_div (delta,NSEC_PER_USEC ); + stats->ac_etime += delta; + +task_cputime (tsk, &utime, &stime); + stats->ac_utime +=div_u64 (utime,NSEC_PER_USEC ); + stats->ac_stime +=div_u64 (stime,NSEC_PER_USEC ); + + stats->nvcsw += tsk->nvcsw; + stats->nivcsw += tsk->nivcsw; +} +static int fill_stats_for_tgid (pid_t tgid,struct taskstats *stats) {struct task_struct *tsk, *first;unsigned long flags;int rc = -ESRCH ; -u64 delta, utime, stime; -u64 start_time; +u64 now_ns;/* * Add additional stats from live tasks except zombie thread group
@@ -211,30 +237,12 @@ static int fill_stats_for_tgid(pid_t tgielse memset (stats,0 ,sizeof (*stats)); - start_time =ktime_get_ns (); + now_ns =ktime_get_ns ();for_each_thread (first, tsk) {if (tsk->exit_state)continue ; -/* -* Accounting subsystem can call its functions here to -* fill in relevant parts of struct taskstsats as follows -* -* per-task-foo(stats, tsk); -*/ -delayacct_add_tsk (stats, tsk); - -/* calculate task elapsed time in nsec */ - delta = start_time - tsk->start_time; -/* Convert to micro seconds */ -do_div (delta,NSEC_PER_USEC ); - stats->ac_etime += delta; - -task_cputime (tsk, &utime, &stime); - stats->ac_utime +=div_u64 (utime,NSEC_PER_USEC ); - stats->ac_stime +=div_u64 (stime,NSEC_PER_USEC ); - stats->nvcsw += tsk->nvcsw; - stats->nivcsw += tsk->nivcsw; +tgid_stats_add_task (stats, tsk, now_ns); }unlock_task_sighand (first, &flags);
@@ -253,18 +261,14 @@ out:static void fill_tgid_exit (struct task_struct *tsk) {unsigned long flags; +u64 now_ns;spin_lock_irqsave (&tsk->sighand->siglock, flags);if (!tsk->signal->stats) goto ret; -/* -* Each accounting subsystem calls its functions here to -* accumalate its per-task stats for tsk, into the per-tgid structure -* -* per-task-foo(tsk->signal->stats, tsk); -*/ -delayacct_add_tsk (tsk->signal->stats, tsk); + now_ns =ktime_get_ns (); +tgid_stats_add_task (tsk->signal->stats, tsk, now_ns); ret:spin_unlock_irqrestore (&tsk->sighand->siglock, flags);return ;
Greg Kroah-Hartman
maintainerPATCH 91/235 mtd: spi-nor: sst: remove global protection flag
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Walle <[email protected]>
[ Upstream commit a833383732116c2afe665520bbe6951999631ef1 ]
This is considered bad for the following reasons:
(1) We only support the block protection with BPn bits for write protection. Not all SST parts support this.
(2) Newly added flash chip will automatically inherit the "has locking" support and thus needs to explicitly tested. Better be opt-in instead of opt-out.
(3) There are already supported flashes which doesn't support the locking scheme. So I assume this wasn't properly tested before adding that chip; which enforces my previous argument that locking support should be an opt-in.
Remove the global flag and add individual flags to all flashes which supports BP locking. In particular the following flashes don't support the BP scheme:
- SST26VF016B
- SST26WF016B
- SST26VF064B
Stable-dep-of: e1d456b26bf2 ("mtd: spi-nor: swp: Improve locking user experience")
--- drivers/mtd/spi-nor/sst.c | 30 ++++++++++++------------------ 1 file changed, 12 insertions(+), 18 deletions(-)
drivers/mtd/spi-nor/sst.c +12 -18
@@ -11,27 +11,27 @@static const struct flash_info sst_parts[] = {/* SST -- large erase sizes are "overlays", "sectors" are 4K */ {"sst25vf040b" ,INFO (0xbf258d ,0 ,64 *1024 ,8 , -SECT_4K |SST_WRITE ) }, +SECT_4K |SST_WRITE |SPI_NOR_HAS_LOCK ) }, {"sst25vf080b" ,INFO (0xbf258e ,0 ,64 *1024 ,16 , -SECT_4K |SST_WRITE ) }, +SECT_4K |SST_WRITE |SPI_NOR_HAS_LOCK ) }, {"sst25vf016b" ,INFO (0xbf2541 ,0 ,64 *1024 ,32 , -SECT_4K |SST_WRITE ) }, +SECT_4K |SST_WRITE |SPI_NOR_HAS_LOCK ) }, {"sst25vf032b" ,INFO (0xbf254a ,0 ,64 *1024 ,64 , -SECT_4K |SST_WRITE ) }, +SECT_4K |SST_WRITE |SPI_NOR_HAS_LOCK ) }, {"sst25vf064c" ,INFO (0xbf254b ,0 ,64 *1024 ,128 , -SECT_4K |SPI_NOR_4BIT_BP ) }, +SECT_4K |SPI_NOR_4BIT_BP |SPI_NOR_HAS_LOCK ) }, {"sst25wf512" ,INFO (0xbf2501 ,0 ,64 *1024 ,1 , -SECT_4K |SST_WRITE ) }, +SECT_4K |SST_WRITE |SPI_NOR_HAS_LOCK ) }, {"sst25wf010" ,INFO (0xbf2502 ,0 ,64 *1024 ,2 , -SECT_4K |SST_WRITE ) }, +SECT_4K |SST_WRITE |SPI_NOR_HAS_LOCK ) }, {"sst25wf020" ,INFO (0xbf2503 ,0 ,64 *1024 ,4 , -SECT_4K |SST_WRITE ) }, - {"sst25wf020a" ,INFO (0x621612 ,0 ,64 *1024 ,4 ,SECT_4K ) }, - {"sst25wf040b" ,INFO (0x621613 ,0 ,64 *1024 ,8 ,SECT_4K ) }, +SECT_4K |SST_WRITE |SPI_NOR_HAS_LOCK ) }, + {"sst25wf020a" ,INFO (0x621612 ,0 ,64 *1024 ,4 ,SECT_4K |SPI_NOR_HAS_LOCK ) }, + {"sst25wf040b" ,INFO (0x621613 ,0 ,64 *1024 ,8 ,SECT_4K |SPI_NOR_HAS_LOCK ) }, {"sst25wf040" ,INFO (0xbf2504 ,0 ,64 *1024 ,8 , -SECT_4K |SST_WRITE ) }, +SECT_4K |SST_WRITE |SPI_NOR_HAS_LOCK ) }, {"sst25wf080" ,INFO (0xbf2505 ,0 ,64 *1024 ,16 , -SECT_4K |SST_WRITE ) }, +SECT_4K |SST_WRITE |SPI_NOR_HAS_LOCK ) }, {"sst26wf016b" ,INFO (0xbf2651 ,0 ,64 *1024 ,32 ,SECT_4K |SPI_NOR_DUAL_READ |SPI_NOR_QUAD_READ ) },
@@ -141,11 +141,6 @@ out:return ret; } -static void sst_default_init (struct spi_nor *nor) -{ - nor->flags |=SNOR_F_HAS_LOCK ; -} -static void sst_post_sfdp_fixups (struct spi_nor *nor) {if (nor->info->flags &SST_WRITE )
@@ -153,7 +148,6 @@ static void sst_post_sfdp_fixups(struct }static const struct spi_nor_fixups sst_fixups = { - .default_init = sst_default_init, .post_sfdp = sst_post_sfdp_fixups, };
Greg Kroah-Hartman
maintainerPATCH 92/235 mtd: spi-nor: intel: remove global protection flag
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Walle <[email protected]>
[ Upstream commit afcf93e9d63fc1e15935a2df9457f803394e4f20 ]
For the Atmel and SST parts this flag was already moved to individual flash parts because it is considered bad esp. because newer flash chips will automatically inherit the "has locking" support. While this won't likely be the case for the Intel parts, we do it for consistency reasons.
Stable-dep-of: e1d456b26bf2 ("mtd: spi-nor: swp: Improve locking user experience")
--- drivers/mtd/spi-nor/intel.c | 16 +++------------- 1 file changed, 3 insertions(+), 13 deletions(-)
drivers/mtd/spi-nor/intel.c +3 -13
@@ -10,23 +10,13 @@static const struct flash_info intel_parts[] = {/* Intel/Numonyx -- xxxs33b */ - {"160s33b" ,INFO (0x898911 ,0 ,64 *1024 ,32 ,0 ) }, - {"320s33b" ,INFO (0x898912 ,0 ,64 *1024 ,64 ,0 ) }, - {"640s33b" ,INFO (0x898913 ,0 ,64 *1024 ,128 ,0 ) }, -}; - -static void intel_default_init (struct spi_nor *nor) -{ - nor->flags |=SNOR_F_HAS_LOCK ; -} - -static const struct spi_nor_fixups intel_fixups = { - .default_init = intel_default_init, + {"160s33b" ,INFO (0x898911 ,0 ,64 *1024 ,32 ,SPI_NOR_HAS_LOCK ) }, + {"320s33b" ,INFO (0x898912 ,0 ,64 *1024 ,64 ,SPI_NOR_HAS_LOCK ) }, + {"640s33b" ,INFO (0x898913 ,0 ,64 *1024 ,128 ,SPI_NOR_HAS_LOCK ) }, };const struct spi_nor_manufacturer spi_nor_intel = { .name ="intel" , .parts = intel_parts, .nparts =ARRAY_SIZE (intel_parts), - .fixups = &intel_fixups, };
Greg Kroah-Hartman
maintainerPATCH 93/235 mtd: spi-nor: Move Software Write Protection logic out of the core
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tudor Ambarus <[email protected]>
[ Upstream commit c4c795105f2924c80752c30ffd3c7029a8e0ef28 ]
It makes the core file a bit smaller and provides better separation between the Software Write Protection features and the core logic. All the next generic software write protection features (e.g. Individual Block Protection) will reside in swp.c.
Stable-dep-of: e1d456b26bf2 ("mtd: spi-nor: swp: Improve locking user experience")
--- drivers/mtd/spi-nor/Makefile | 2 drivers/mtd/spi-nor/core.c | 406 ----------------------------------------- drivers/mtd/spi-nor/core.h | 5 drivers/mtd/spi-nor/swp.c | 421 +++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 431 insertions(+), 403 deletions(-) create mode 100644 drivers/mtd/spi-nor/swp.c
drivers/mtd/spi-nor/Makefile +1 -1
@@ -1,6 +1,6 @@ # SPDX-License-Identifier: GPL-2.0 -spi-nor-objs := core.o sfdp.o +spi-nor-objs := core.o sfdp.o swp.o spi-nor-objs += atmel.o spi-nor-objs += catalyst.o spi-nor-objs += eon.o
drivers/mtd/spi-nor/core.c +4 -402
442 lines not on this page · raw message
drivers/mtd/spi-nor/core.h +5 -0
@@ -409,6 +409,7 @@ void spi_nor_unlock_and_unprep(struct spint spi_nor_sr1_bit6_quad_enable (struct spi_nor *nor);int spi_nor_sr2_bit1_quad_enable (struct spi_nor *nor);int spi_nor_sr2_bit7_quad_enable (struct spi_nor *nor); +int spi_nor_read_sr (struct spi_nor *nor,u8 *sr);int spi_nor_write_sr_and_check (struct spi_nor *nor,u8 sr1);int spi_nor_xread_sr (struct spi_nor *nor,u8 *sr);
@@ -435,6 +436,10 @@ int spi_nor_post_bfpt_fixups(struct spi_const struct sfdp_bfpt *bfpt, struct spi_nor_flash_parameter *params); +void spi_nor_init_default_locking_ops (struct spi_nor *nor); +void spi_nor_try_unlock_all (struct spi_nor *nor); +void spi_nor_register_locking_ops (struct spi_nor *nor); +static struct spi_nor __maybe_unused *mtd_to_spi_nor (struct mtd_info *mtd) {return mtd->priv;
drivers/mtd/spi-nor/swp.c new file +421 -0
421 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 94/235 mtd: spi-nor: Fix spi_nor_try_unlock_all()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Walle <[email protected]>
[ Upstream commit 2e3a7476ec3989e77270b9481e76e137824b17c0 ]
Commit ff67592cbdfc ("mtd: spi-nor: Introduce spi_nor_set_mtd_info()") moved all initialization of the mtd fields at the end of spi_nor_scan(). Normally, the mtd info is only needed for the mtd ops on the device, with one exception: spi_nor_try_unlock_all(), which will also make use of the mtd->size parameter. With that commit, the size will always be zero because it is not initialized. Fix that by not using the size of the mtd_info struct, but use the size from struct spi_nor_flash_parameter.
Stable-dep-of: e1d456b26bf2 ("mtd: spi-nor: swp: Improve locking user experience")
--- drivers/mtd/spi-nor/swp.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-)
drivers/mtd/spi-nor/swp.c +6 -8
@@ -50,7 +50,6 @@ static u64 spi_nor_get_min_prot_length_sstatic void spi_nor_get_locked_range_sr (struct spi_nor *nor,u8 sr,loff_t *ofs,uint64_t *len) { -struct mtd_info *mtd = &nor->mtd;u64 min_prot_len;u8 mask =spi_nor_get_sr_bp_mask (nor);u8 tb_mask =spi_nor_get_sr_tb_mask (nor);
@@ -71,13 +70,13 @@ static void spi_nor_get_locked_range_sr( min_prot_len =spi_nor_get_min_prot_length_sr (nor); *len = min_prot_len << (bp -1 ); -if (*len > mtd->size) - *len = mtd->size; +if (*len > nor->params->size) + *len = nor->params->size;if (nor->flags &SNOR_F_HAS_SR_TB && sr & tb_mask) *ofs =0 ;else - *ofs = mtd->size - *len; + *ofs = nor->params->size - *len; }/*
@@ -150,7 +149,6 @@ static int spi_nor_is_unlocked_sr(struct*/ static int spi_nor_sr_lock (struct spi_nor *nor,loff_t ofs,uint64_t len) { -struct mtd_info *mtd = &nor->mtd;u64 min_prot_len;int ret, status_old, status_new;u8 mask =spi_nor_get_sr_bp_mask (nor);
@@ -175,7 +173,7 @@ static int spi_nor_sr_lock(struct spi_no can_be_bottom = false;/* If anything above us is unlocked, we can't use 'top' protection */ -if (!spi_nor_is_locked_sr (nor, ofs + len, mtd->size - (ofs + len), +if (!spi_nor_is_locked_sr (nor, ofs + len, nor->params->size - (ofs + len), status_old)) can_be_top = false;
@@ -187,11 +185,11 @@ static int spi_nor_sr_lock(struct spi_no/* lock_len: length of region that should end up locked */ if (use_top) - lock_len = mtd->size - ofs; + lock_len = nor->params->size - ofs;else lock_len = ofs + len; -if (lock_len == mtd->size) { +if (lock_len == nor->params->size) { val = mask; }else { min_prot_len =spi_nor_get_min_prot_length_sr (nor);
Greg Kroah-Hartman
maintainerPATCH 95/235 mtd: spi-nor: swp: Improve locking user experience
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miquel Raynal <[email protected]>
[ Upstream commit e1d456b26bf23e30db305a6184e8abd9ab68bbf2 ]
In the case of the first block being locked (or the few first blocks), if the user want to fully unlock the device it has two possibilities:
- either it asks to unlock the entire device, and this works;
- or it asks to unlock just the block(s) that are currently locked, which fails.
It fails because the conditions "can_be_top" and "can_be_bottom" are true. Indeed, in this case, we unlock everything, so the TB bit does not matter. However in the current implementation, use_top would be true (as this is the favourite option) and lock_len, which in practice should be reduced down to 0, is set to "nor->params->size - (ofs + len)" which is a positive number. This is wrong.
An easy way is to simply add an extra condition. In the unlock() path, if we can achieve the same result from both sides, it means we unlock everything and lock_len must simply be 0. A comment is added to clarify that logic.
--- drivers/mtd/spi-nor/swp.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/mtd/spi-nor/swp.c +9 -2
@@ -267,8 +267,15 @@ static int spi_nor_sr_unlock(struct spi_/* Prefer top, if both are valid */ use_top = can_be_top; -/* lock_len: length of region that should remain locked */ -if (use_top) +/* +* lock_len: length of region that should remain locked. +* +* When can_be_top and can_be_bottom booleans are true, both adjacent +* regions are unlocked, thus the entire flash can be unlocked. +*/ +if (can_be_top && can_be_bottom) + lock_len =0 ; +else if (use_top) lock_len = nor->params->size - (ofs + len);else lock_len = ofs;
Greg Kroah-Hartman
maintainerPATCH 96/235 smb: client: use kvzalloc() for megabyte buffer in simple fallocate
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fredric Cover <[email protected]>
[ Upstream commit 806c00c23e3ce8eae397a40ced536ef88ae4e012 ]
Currently in smb3_simple_fallocate_range(), a 1 MB buffer is allocated using kzalloc(). Under heavy memory fragmentation, a contiguous 1 MB block of physical memory (an order-8 allocation) may not be available, causing the allocation to fail.
This failure was observed during xfstests generic/013 on a 4GB RAM test machine running fsstress:
fsstress: page allocation failure: order:8,
mode:0x40dc0(GFP_KERNEL|__GFP_ZERO|__GFP_COMP),
nodemask=(null),cpuset=/,mems_allowed=0
Call Trace: <TASK> dump_stack_lvl+0x5d/0x80 warn_alloc+0x163/0x190 __alloc_pages_slowpath.constprop.0+0x71b/0x12f0 __alloc_frozen_pages_noprof+0x2f6/0x340 alloc_pages_mpol+0xb6/0x170 ___kmalloc_large_node+0xb3/0xd0 __kmalloc_large_noprof+0x1e/0xc0 smb3_simple_falloc.isra.0+0x62b/0x960 cifs_fallocate+0xed/0x180 vfs_fallocate+0x165/0x3c0 __x64_sys_fallocate+0x48/0xa0 do_syscall_64+0xe1/0x640 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK>
Node 0 Normal: 3375*4kB ... 7*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB
Since this scratch buffer does not require physically contiguous memory, switch the allocation to kvzalloc(). This retains the performance benefits of kmalloc() under normal conditions, while gracefully falling back to virtually contiguous memory when physical allocation fails.
--- fs/cifs/smb2ops.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/cifs/smb2ops.c +2 -2
@@ -3568,7 +3568,7 @@ static int smb3_simple_fallocate_range(uif (rc) goto out; - buf =kzalloc (1024 *1024 ,GFP_KERNEL ); + buf =kvzalloc (1024 *1024 ,GFP_KERNEL );if (buf ==NULL ) { rc = -ENOMEM ; goto out;
@@ -3635,7 +3635,7 @@ static int smb3_simple_fallocate_range(u out:kfree (out_data); -kfree (buf); +kvfree (buf);return rc; }
Greg Kroah-Hartman
maintainerPATCH 97/235 tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jarkko Sakkinen <[email protected]>
[ Upstream commit c0c9cfb3b75def8bf200a2d4db09015806acfeaf ]
wait_event_interruptible_timeout() evaluates its condition after setting the current task state to TASK_INTERRUPTIBLE.
With CONFIG_DEBUG_ATOMIC_SLEEP this triggers a warning when the IRQ wait path is used:
tpm_tis_status()
tpm_tis_spi_read_bytes()
tpm_tis_spi_transfer_full()
spi_bus_lock()
mutex_lock()Address this with the following measures:
1. Call wait_tpm_stat_cond() only while tasking is running.
2. Use wait_woken() to wait for changes.
--- drivers/char/tpm/tpm_tis_core.c | 38 ++++++++++++++++++++++++-------------- 1 file changed, 24 insertions(+), 14 deletions(-)
drivers/char/tpm/tpm_tis_core.c +24 -14
@@ -49,10 +49,11 @@ static int wait_for_tpm_stat(struct tpm_ bool check_cancel) {struct tpm_tis_data *priv =dev_get_drvdata (&chip->dev); +DEFINE_WAIT_FUNC (wait, woken_wake_function);unsigned long stop; -long rc;u8 status;bool canceled = false; +int ret;/* check current status */ status = chip->ops->status (chip);
@@ -62,23 +63,32 @@ static int wait_for_tpm_stat(struct tpm_ stop = jiffies + timeout;if (chip->flags &TPM_CHIP_FLAG_IRQ ) { + ret = -ETIME ; +add_wait_queue (queue, &wait); again: +if (wait_for_tpm_stat_cond (chip, mask, check_cancel, + &canceled)) { + ret = canceled ? -ECANCELED :0 ; + goto out; + } + timeout = stop - jiffies;if ((long )timeout <=0 ) -return -ETIME ; - rc =wait_event_interruptible_timeout (*queue, -wait_for_tpm_stat_cond (chip, mask, check_cancel, - &canceled), - timeout); -if (rc >0 ) { -if (canceled) -return -ECANCELED ; -return 0 ; - } -if (rc == -ERESTARTSYS &&freezing (current)) { -clear_thread_flag (TIF_SIGPENDING ); - goto again; + goto out; + +if (signal_pending (current)) { +if (freezing (current)) { +clear_thread_flag (TIF_SIGPENDING ); + goto again; + } + goto out; } + +wait_woken (&wait,TASK_INTERRUPTIBLE , timeout); + goto again; +out: +remove_wait_queue (queue, &wait); +return ret; } else { do { usleep_range(priv->timeout_min,
Greg Kroah-Hartman
maintainerPATCH 98/235 PCI: Add pci_find_vsec_capability() to find a specific VSEC
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gustavo Pimentel <[email protected]>
[ Upstream commit c124fd9a969acaa83f6dfa5e160a99a500af9e4b ]
Add pci_find_vsec_capability() to locate a Vendor-Specific Extended Capability with the specified VSEC ID.
The Vendor-Specific Extended Capability (VSEC) allows one or more proprietary capabilities defined by the vendor which aren't standard or shared between vendors.
Stable-dep-of: 8ffba0171c6b ("dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK")
--- drivers/pci/pci.c | 30 ++++++++++++++++++++++++++++++ include/linux/pci.h | 1 + 2 files changed, 31 insertions(+)
drivers/pci/pci.c +30 -0
@@ -691,6 +691,36 @@ int pci_find_ht_capability(struct pci_deEXPORT_SYMBOL_GPL (pci_find_ht_capability);/** +* pci_find_vsec_capability - Find a vendor-specific extended capability +* @dev: PCI device to query +* @vendor: Vendor ID for which capability is defined +* @cap: Vendor-specific capability ID +* +* If @dev has Vendor ID @vendor, search for a VSEC capability with +* VSEC ID @cap. If found, return the capability offset in +* config space; otherwise return 0. +*/ +u16 pci_find_vsec_capability (struct pci_dev *dev,u16 vendor,int cap) +{ +u16 vsec =0 ; +u32 header; + +if (vendor != dev->vendor) +return 0 ; + +while ((vsec =pci_find_next_ext_capability (dev, vsec, +PCI_EXT_CAP_ID_VNDR ))) { +if (pci_read_config_dword (dev, vsec +PCI_VNDR_HEADER , + &header) ==PCIBIOS_SUCCESSFUL && +PCI_VNDR_HEADER_ID (header) == cap) +return vsec; + } + +return 0 ; +} +EXPORT_SYMBOL_GPL (pci_find_vsec_capability); + +/** * pci_find_parent_resource - return resource region of parent bus of given * region * @dev: PCI device structure contains resources to be searched
include/linux/pci.h +1 -0
@@ -1101,6 +1101,7 @@ int pci_find_next_ext_capability(structint pci_find_ht_capability (struct pci_dev *dev,int ht_cap);int pci_find_next_ht_capability (struct pci_dev *dev,int pos,int ht_cap);struct pci_bus *pci_find_next_bus (const struct pci_bus *from); +u16 pci_find_vsec_capability (struct pci_dev *dev,u16 vendor,int cap);u64 pci_get_dsn (struct pci_dev *dev);
Greg Kroah-Hartman
maintainerPATCH 99/235 dmaengine: dw-edma: Improve the linked list and data blocks definition
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gustavo Pimentel <[email protected]>
[ Upstream commit 31fb8c1ff962d93ed5025f39a6a186207c9805eb ]
In the previous implementation, the driver assumed that there existed only two memory spaces that would equally distribute the amount of read/write channels.
This might not be the case on some other implementations, therefore this patch change this requirement so that each write/read channel has its own linked list and data space well defined, which allows different sizes and locations.
Stable-dep-of: 8ffba0171c6b ("dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK")
--- drivers/dma/dw-edma/dw-edma-core.c | 77 +++++++------- drivers/dma/dw-edma/dw-edma-core.h | 18 ++- drivers/dma/dw-edma/dw-edma-pcie.c | 181 ++++++++++++++++++++++++---------- drivers/dma/dw-edma/dw-edma-v0-core.c | 70 ++++++------- 4 files changed, 217 insertions(+), 129 deletions(-)
drivers/dma/dw-edma/dw-edma-core.c +38 -39
@@ -81,8 +81,13 @@ static struct dw_edma_chunk *dw_edma_all* - Even chunks originate CB equal to 1 */ chunk->cb = !(desc->chunks_alloc %2 ); - chunk->ll_region.paddr = dw->ll_region.paddr + chan->ll_off; - chunk->ll_region.vaddr = dw->ll_region.vaddr + chan->ll_off; +if (chan->dir ==EDMA_DIR_WRITE ) { + chunk->ll_region.paddr = dw->ll_region_wr[chan->id].paddr; + chunk->ll_region.vaddr = dw->ll_region_wr[chan->id].vaddr; + }else { + chunk->ll_region.paddr = dw->ll_region_rd[chan->id].paddr; + chunk->ll_region.vaddr = dw->ll_region_rd[chan->id].vaddr; + }if (desc->chunk) {/* Create and add new element into the linked list */
@@ -669,24 +674,13 @@ static int dw_edma_channel_setup(structstruct device *dev = chip->dev;struct dw_edma *dw = chip->dw;struct dw_edma_chan *chan; -size_t ll_chunk, dt_chunk;struct dw_edma_irq *irq;struct dma_device *dma; -u32 i, j, cnt, ch_cnt;u32 alloc, off_alloc; +u32 i, j, cnt;int err =0 ;u32 pos; - ch_cnt = dw->wr_ch_cnt + dw->rd_ch_cnt; - ll_chunk = dw->ll_region.sz; - dt_chunk = dw->dt_region.sz; - -/* Calculate linked list chunk for each channel */ - ll_chunk /=roundup_pow_of_two (ch_cnt); - -/* Calculate linked list chunk for each channel */ - dt_chunk /=roundup_pow_of_two (ch_cnt); -if (write) { i =0 ; cnt = dw->wr_ch_cnt;
@@ -712,20 +706,21 @@ static int dw_edma_channel_setup(struct chan->vc.chan.private = dt_region; chan->chip = chip; + chan->dw = dw; chan->id = j; chan->dir = write ?EDMA_DIR_WRITE :EDMA_DIR_READ ; chan->configured = false; chan->request =EDMA_REQ_NONE ; chan->status =EDMA_ST_IDLE ; - chan->ll_off = (ll_chunk * i); - chan->ll_max = (ll_chunk /EDMA_LL_SZ ) -1 ; - - chan->dt_off = (dt_chunk * i); +if (write) + chan->ll_max = (dw->ll_region_wr[j].sz /EDMA_LL_SZ ); +else + chan->ll_max = (dw->ll_region_rd[j].sz /EDMA_LL_SZ ); + chan->ll_max -=1 ; -dev_vdbg (dev,"L. List:\tChannel %s[%u] off=0x%.8lx, max_cnt=%u\n" , - write ?"write" :"read" , j, - chan->ll_off, chan->ll_max); +dev_vdbg (dev,"L. List:\tChannel %s[%u] max_cnt=%u\n" , + write ?"write" :"read" , j, chan->ll_max);if (dw->nr_irqs ==1 ) pos =0 ;
@@ -750,12 +745,15 @@ static int dw_edma_channel_setup(struct chan->vc.desc_free = vchan_free_desc;vchan_init (&chan->vc, dma); - dt_region->paddr = dw->dt_region.paddr + chan->dt_off; - dt_region->vaddr = dw->dt_region.vaddr + chan->dt_off; - dt_region->sz = dt_chunk; - -dev_vdbg (dev,"Data:\tChannel %s[%u] off=0x%.8lx\n" , - write ?"write" :"read" , j, chan->dt_off); +if (write) { + dt_region->paddr = dw->dt_region_wr[j].paddr; + dt_region->vaddr = dw->dt_region_wr[j].vaddr; + dt_region->sz = dw->dt_region_wr[j].sz; + }else { + dt_region->paddr = dw->dt_region_rd[j].paddr; + dt_region->vaddr = dw->dt_region_rd[j].vaddr; + dt_region->sz = dw->dt_region_rd[j].sz; + }dw_edma_v0_core_device_config (chan); }
@@ -824,7 +822,7 @@ static int dw_edma_irq_request(struct dwif (dw->nr_irqs ==1 ) {/* Common IRQ shared among all channels */ - irq = dw->ops->irq_vector (dev,0 ); + irq = dw->core->irq_vector (dev,0 ); err =request_irq (irq, dw_edma_interrupt_common,IRQF_SHARED , dw->name, &dw->irq[0 ]);if (err) {
@@ -847,7 +845,7 @@ static int dw_edma_irq_request(struct dwdw_edma_add_irq_mask (&rd_mask, *rd_alloc, dw->rd_ch_cnt);for (i =0 ; i < (*wr_alloc + *rd_alloc); i++) { - irq = dw->ops->irq_vector (dev, i); + irq = dw->core->irq_vector (dev, i); err = request_irq(irq, i < *wr_alloc ? dw_edma_interrupt_write :
@@ -885,19 +883,20 @@ int dw_edma_probe(struct dw_edma_chip *creturn -EINVAL ; dw = chip->dw; -if (!dw || !dw->irq || !dw->ops || !dw->ops->irq_vector) +if (!dw || !dw->irq || !dw->core || !dw->core->irq_vector)return -EINVAL ;raw_spin_lock_init (&dw->lock); -/* Find out how many write channels are supported by hardware */ - dw->wr_ch_cnt =dw_edma_v0_core_ch_count (dw,EDMA_DIR_WRITE ); -if (!dw->wr_ch_cnt) -return -EINVAL ; + dw->wr_ch_cnt =min_t (u16, dw->wr_ch_cnt, +dw_edma_v0_core_ch_count (dw,EDMA_DIR_WRITE )); + dw->wr_ch_cnt =min_t (u16, dw->wr_ch_cnt,EDMA_MAX_WR_CH ); + + dw->rd_ch_cnt =min_t (u16, dw->rd_ch_cnt, +dw_edma_v0_core_ch_count (dw,EDMA_DIR_READ )); + dw->rd_ch_cnt =min_t (u16, dw->rd_ch_cnt,EDMA_MAX_RD_CH ); -/* Find out how many read channels are supported by hardware */ - dw->rd_ch_cnt =dw_edma_v0_core_ch_count (dw,EDMA_DIR_READ ); -if (!dw->rd_ch_cnt) +if (!dw->wr_ch_cnt && !dw->rd_ch_cnt)return -EINVAL ; dev_vdbg(dev, "Channels:\twrite=%d, read=%d\n",
@@ -939,7 +938,7 @@ int dw_edma_probe(struct dw_edma_chip *c err_irq_free:for (i = (dw->nr_irqs -1 ); i >=0 ; i--) -free_irq (dw->ops->irq_vector (dev, i), &dw->irq[i]); +free_irq (dw->core->irq_vector (dev, i), &dw->irq[i]); dw->nr_irqs =0 ;
@@ -959,7 +958,7 @@ int dw_edma_remove(struct dw_edma_chip */* Free irqs */ for (i = (dw->nr_irqs -1 ); i >=0 ; i--) -free_irq (dw->ops->irq_vector (dev, i), &dw->irq[i]); +free_irq (dw->core->irq_vector (dev, i), &dw->irq[i]);/* Power management */ pm_runtime_disable (dev);
drivers/dma/dw-edma/dw-edma-core.h +12 -6
@@ -15,6 +15,8 @@#include "../virt-dma.h" #define EDMA_LL_SZ 24 +#define EDMA_MAX_WR_CH 8 +#define EDMA_MAX_RD_CH 8enum dw_edma_dir {EDMA_DIR_WRITE =0 ,
@@ -40,6 +42,7 @@ enum dw_edma_status {struct dw_edma_chan ;struct dw_edma_chunk ; +struct dw_edma ;struct dw_edma_burst {struct list_head list;
@@ -79,14 +82,12 @@ struct dw_edma_desc {struct dw_edma_chan {struct virt_dma_chan vc;struct dw_edma_chip *chip; +struct dw_edma *dw;int id;enum dw_edma_dir dir; -off_t ll_off;u32 ll_max; -off_t dt_off; -struct msi_msg msi;enum dw_edma_request request;
@@ -117,8 +118,10 @@ struct dw_edma {u16 rd_ch_cnt;struct dw_edma_region rg_region;/* Registers */ -struct dw_edma_region ll_region;/* Linked list */ -struct dw_edma_region dt_region;/* Data */ +struct dw_edma_region ll_region_wr[EDMA_MAX_WR_CH ]; +struct dw_edma_region ll_region_rd[EDMA_MAX_RD_CH ]; +struct dw_edma_region dt_region_wr[EDMA_MAX_WR_CH ]; +struct dw_edma_region dt_region_rd[EDMA_MAX_RD_CH ];struct dw_edma_irq *irq;int nr_irqs;
@@ -127,9 +130,12 @@ struct dw_edma {enum dw_edma_mode mode;struct dw_edma_chan *chan; -const struct dw_edma_core_ops *ops;raw_spinlock_t lock;/* Only for legacy */ + +struct dw_edma_chip *chip; + +const struct dw_edma_core_ops *core; };struct dw_edma_sg {
drivers/dma/dw-edma/dw-edma-pcie.c +132 -49
234 lines not on this page · raw message
drivers/dma/dw-edma/dw-edma-v0-core.c +35 -35
170 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 100/235 dmaengine: dw-edma: Remove unused irq field in struct dw_edma_chip
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Li <[email protected]>
[ Upstream commit 5a0e4529d9aee8ce348f628ad476c9ddb6cf457d ]
The "irq" field of struct dw_edma_chip was never used. Remove it.
Stable-dep-of: 8ffba0171c6b ("dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK")
--- drivers/dma/dw-edma/dw-edma-pcie.c | 1 - include/linux/dma/edma.h | 2 -- 2 files changed, 3 deletions(-)
drivers/dma/dw-edma/dw-edma-pcie.c +0 -1
@@ -175,7 +175,6 @@ static int dw_edma_pcie_probe(struct pci chip->dw = dw; chip->dev = dev; chip->id = pdev->devfn; - chip->irq = pdev->irq; dw->chip = chip; dw->version = pdata->version;
include/linux/dma/edma.h +0 -2
@@ -18,13 +18,11 @@ struct dw_edma;* struct dw_edma_chip - representation of DesignWare eDMA controller hardware * @dev: struct device of the eDMA controller * @id: instance ID -* @irq: irq line * @dw: struct dw_edma that is filed by dw_edma_probe() */ struct dw_edma_chip {struct device *dev;int id; -int irq;struct dw_edma *dw; };
Greg Kroah-Hartman
maintainerPATCH 101/235 dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Li <[email protected]>
[ Upstream commit 8ffba0171c6bbce5f093c6dba5a02c0805b31203 ]
The DONE_INT_MASK and ABORT_INT_MASK registers are shared by all DMA channels, and modifying them requires a read-modify-write sequence. Because this operation is not atomic, concurrent calls to dw_edma_v0_core_start() can introduce race conditions if two channels update these registers simultaneously.
Add a spinlock to serialize access to these registers and prevent race conditions.
--- drivers/dma/dw-edma/dw-edma-core.h | 2 +- drivers/dma/dw-edma/dw-edma-v0-core.c | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-)
drivers/dma/dw-edma/dw-edma-core.h +1 -1
@@ -131,7 +131,7 @@ struct dw_edma {struct dw_edma_chan *chan; -raw_spinlock_t lock;/* Only for legacy */ +raw_spinlock_t lock;/* Protect v0 shared registers */ struct dw_edma_chip *chip;
drivers/dma/dw-edma/dw-edma-v0-core.c +6 -0
@@ -237,6 +237,7 @@ void dw_edma_v0_core_start(struct dw_edm {struct dw_edma_chan *chan = chunk->chan;struct dw_edma *dw = chan->dw; +unsigned long flags;u32 tmp;dw_edma_v0_core_write_chunk (chunk);
@@ -245,6 +246,8 @@ void dw_edma_v0_core_start(struct dw_edm/* Enable engine */ SET_RW_32 (dw, chan->dir, engine_en,BIT (0 ));/* Interrupt unmask - done, abort */ +raw_spin_lock_irqsave (&dw->lock, flags); + tmp =GET_RW_32 (dw, chan->dir, int_mask); tmp &= ~FIELD_PREP (EDMA_V0_DONE_INT_MASK ,BIT (chan->id)); tmp &= ~FIELD_PREP (EDMA_V0_ABORT_INT_MASK ,BIT (chan->id));
@@ -253,6 +256,9 @@ void dw_edma_v0_core_start(struct dw_edm tmp =GET_RW_32 (dw, chan->dir, linked_list_err_en); tmp |=FIELD_PREP (EDMA_V0_LINKED_LIST_ERR_MASK ,BIT (chan->id));SET_RW_32 (dw, chan->dir, linked_list_err_en, tmp); + +raw_spin_unlock_irqrestore (&dw->lock, flags); +/* Channel control */ SET_CH_32 (dw, chan->dir, chan->id, ch_control1, (DW_EDMA_V0_CCS |DW_EDMA_V0_LLE ));
Greg Kroah-Hartman
maintainerPATCH 102/235 i2c: imx: separate atomic, dma and non-dma use case
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Eichenberger <[email protected]>
[ Upstream commit b460b15b3cc23ef3639cc51043bf8b2a70ca1878 ]
Separate the atomic, dma and non-dma use case as a preparation step for moving the non-dma use case to the isr to avoid rescheduling while a transfer is in progress.
Stable-dep-of: cb2fc3785769 ("i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)")
--- drivers/i2c/busses/i2c-imx.c | 107 ++++++++++++++++++++++++++++--------------- 1 file changed, 70 insertions(+), 37 deletions(-)
drivers/i2c/busses/i2c-imx.c +70 -37
@@ -717,6 +717,43 @@ static int i2c_imx_dma_write(struct imx_return i2c_imx_acked (i2c_imx); } +static int i2c_imx_prepare_read (struct imx_i2c_struct *i2c_imx, +struct i2c_msg *msgs,bool atomic, +bool use_dma) +{ +int result; +unsigned int temp =0 ; + +/* write slave address */ +imx_i2c_write_reg (i2c_8bit_addr_from_msg (msgs), i2c_imx,IMX_I2C_I2DR ); + result =i2c_imx_trx_complete (i2c_imx, atomic); +if (result) +return result; + result =i2c_imx_acked (i2c_imx); +if (result) +return result; + +dev_dbg (&i2c_imx->adapter.dev,"<%s> setup bus\n" , __func__); + +/* setup bus to read data */ + temp =imx_i2c_read_reg (i2c_imx,IMX_I2C_I2CR ); + temp &= ~I2CR_MTX ; + +/* +* Reset the I2CR_TXAK flag initially for SMBus block read since the +* length is unknown +*/ +if (msgs->len -1 ) + temp &= ~I2CR_TXAK ; +if (use_dma) + temp |=I2CR_DMAEN ; + +imx_i2c_write_reg (temp, i2c_imx,IMX_I2C_I2CR ); +imx_i2c_read_reg (i2c_imx,IMX_I2C_I2DR );/* dummy read */ + +return 0 ; +} +static int i2c_imx_dma_read (struct imx_i2c_struct *i2c_imx,struct i2c_msg *msgs,bool is_lastmsg) {
@@ -727,6 +764,11 @@ static int i2c_imx_dma_read(struct imx_istruct imx_i2c_dma *dma = i2c_imx->dma;struct device *dev = &i2c_imx->adapter.dev; + result =i2c_imx_prepare_read (i2c_imx, msgs, false, true); +if (result) +return result; + +dev_dbg (&i2c_imx->adapter.dev,"<%s> read data\n" , __func__); dma->chan_using = dma->chan_rx; dma->dma_transfer_dir =DMA_DEV_TO_MEM ;
@@ -837,50 +879,24 @@ static int i2c_imx_write(struct imx_i2c_return 0 ; } +static int i2c_imx_atomic_write (struct imx_i2c_struct *i2c_imx,struct i2c_msg *msgs) +{ +return i2c_imx_write (i2c_imx, msgs, true); +} +static int i2c_imx_read (struct imx_i2c_struct *i2c_imx,struct i2c_msg *msgs,bool is_lastmsg,bool atomic) {int i, result;unsigned int temp;int block_data = msgs->flags &I2C_M_RECV_LEN ; -int use_dma = i2c_imx->dma && msgs->flags &I2C_M_DMA_SAFE && - msgs->len >=DMA_THRESHOLD && !block_data; - -dev_dbg (&i2c_imx->adapter.dev, -"<%s> write slave address: addr=0x%x\n" , - __func__,i2c_8bit_addr_from_msg (msgs)); -/* write slave address */ -imx_i2c_write_reg (i2c_8bit_addr_from_msg (msgs), i2c_imx,IMX_I2C_I2DR ); - result =i2c_imx_trx_complete (i2c_imx, atomic); -if (result) -return result; - result =i2c_imx_acked (i2c_imx); + result =i2c_imx_prepare_read (i2c_imx, msgs, atomic, false);if (result)return result; -dev_dbg (&i2c_imx->adapter.dev,"<%s> setup bus\n" , __func__); - -/* setup bus to read data */ - temp =imx_i2c_read_reg (i2c_imx,IMX_I2C_I2CR ); - temp &= ~I2CR_MTX ; - -/* -* Reset the I2CR_TXAK flag initially for SMBus block read since the -* length is unknown -*/ -if ((msgs->len -1 ) || block_data) - temp &= ~I2CR_TXAK ; -if (use_dma) - temp |=I2CR_DMAEN ; -imx_i2c_write_reg (temp, i2c_imx,IMX_I2C_I2CR ); -imx_i2c_read_reg (i2c_imx,IMX_I2C_I2DR );/* dummy read */ -dev_dbg (&i2c_imx->adapter.dev,"<%s> read data\n" , __func__); -if (use_dma) -return i2c_imx_dma_read (i2c_imx, msgs, is_lastmsg); -/* read data */ for (i =0 ; i < msgs->len; i++) {u8 len =0 ;
@@ -947,6 +963,12 @@ static int i2c_imx_read(struct imx_i2c_sreturn 0 ; } +static int i2c_imx_atomic_read (struct imx_i2c_struct *i2c_imx,struct i2c_msg *msgs, +bool is_lastmsg) +{ +return i2c_imx_read (i2c_imx, msgs, is_lastmsg, true); +} +static int i2c_imx_xfer_common (struct i2c_adapter *adapter,struct i2c_msg *msgs,int num,bool atomic) {
@@ -954,6 +976,7 @@ static int i2c_imx_xfer_common(struct i2int result;bool is_lastmsg = false;struct imx_i2c_struct *i2c_imx =i2c_get_adapdata (adapter); +int use_dma =0 ;dev_dbg (&i2c_imx->adapter.dev,"<%s>\n" , __func__);
@@ -1008,15 +1031,25 @@ static int i2c_imx_xfer_common(struct i2 (temp &I2SR_SRW ?1 :0 ), (temp &I2SR_IIF ?1 :0 ), (temp & I2SR_RXAK ? 1 : 0));#endif + + use_dma = i2c_imx->dma && msgs[i].len >=DMA_THRESHOLD && + msgs[i].flags &I2C_M_DMA_SAFE ;if (msgs[i].flags &I2C_M_RD ) { - result =i2c_imx_read (i2c_imx, &msgs[i], is_lastmsg, atomic); +int block_data = msgs->flags &I2C_M_RECV_LEN ; + +if (atomic) + result =i2c_imx_atomic_read (i2c_imx, &msgs[i], is_lastmsg); +else if (use_dma && !block_data) + result =i2c_imx_dma_read (i2c_imx, &msgs[i], is_lastmsg); +else + result =i2c_imx_read (i2c_imx, &msgs[i], is_lastmsg, false); }else { -if (!atomic && - i2c_imx->dma && msgs[i].len >=DMA_THRESHOLD && - msgs[i].flags &I2C_M_DMA_SAFE ) +if (atomic) + result =i2c_imx_atomic_write (i2c_imx, &msgs[i]); +else if (use_dma) result =i2c_imx_dma_write (i2c_imx, &msgs[i]);else - result =i2c_imx_write (i2c_imx, &msgs[i], atomic); + result =i2c_imx_write (i2c_imx, &msgs[i], false); }if (result) goto fail0;
Greg Kroah-Hartman
maintainerPATCH 103/235 i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Jardin <[email protected]>
[ Upstream commit cb2fc37857693b55909fb77dc2c87cfbc1cdc476 ]
SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the atomic (polling) path rejects it as -EPROTO. Worse, it returns without a NACK+STOP: the next receive cycle has already started, so the target keeps holding SDA and the bus stays stuck until a power cycle for this i2c controller.
Reading I2DR to obtain the count likewise arms the next byte on the count > I2C_SMBUS_BLOCK_MAX path, which also returned -EPROTO directly and left the bus held.
Handle both: NACK the in-flight dummy byte (TXAK) and extend msgs->len so the existing last-byte handling emits STOP; the dummy byte is discarded. A count of 0 is a valid empty block read; a count above I2C_SMBUS_BLOCK_MAX is still reported as -EPROTO, but only after the bus has been released.
The interrupt-driven path has the same flaw from a later commit and is fixed separately, as it carries a different Fixes: tag and stable range.
--- drivers/i2c/busses/i2c-imx.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-)
drivers/i2c/busses/i2c-imx.c +16 -3
@@ -890,6 +890,7 @@ static int i2c_imx_read(struct imx_i2c_sint i, result;unsigned int temp;int block_data = msgs->flags &I2C_M_RECV_LEN ; +int block_err =0 ; result =i2c_imx_prepare_read (i2c_imx, msgs, atomic, false);if (result)
@@ -911,8 +912,20 @@ static int i2c_imx_read(struct imx_i2c_s*/ if ((!i) && block_data) { len =imx_i2c_read_reg (i2c_imx,IMX_I2C_I2DR ); -if ((len ==0 ) || (len >I2C_SMBUS_BLOCK_MAX )) -return -EPROTO ; +if ((len ==0 ) || (len >I2C_SMBUS_BLOCK_MAX )) { +/* +* SMBus 3.1 6.5.7: support count byte of 0. +* I2C_SMBUS_BLOCK_MAX case should not hold the SDA either. +*/ +if (len >I2C_SMBUS_BLOCK_MAX ) + block_err = -EPROTO ; + temp =imx_i2c_read_reg (i2c_imx,IMX_I2C_I2CR ); + temp |=I2CR_TXAK ; +imx_i2c_write_reg (temp, i2c_imx,IMX_I2C_I2CR ); + msgs->buf[0 ] =0 ; + msgs->len =2 ; +continue ; + }dev_dbg (&i2c_imx->adapter.dev,"<%s> read length: 0x%X\n" , __func__, len);
@@ -960,7 +973,7 @@ static int i2c_imx_read(struct imx_i2c_s"<%s> read byte: B%d=0x%X\n" , __func__, i, msgs->buf[i]); } -return 0 ; +return block_err; } static int i2c_imx_atomic_read(struct imx_i2c_struct *i2c_imx, struct i2c_msg *msgs,
Greg Kroah-Hartman
maintainerPATCH 104/235 thunderbolt: Keep XDomain reference during the lifetime of a service
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mika Westerberg <[email protected]>
[ Upstream commit 8b4060998637f06975fceee9b73845d8672d411e ]
This is needed because we release the service ID in tb_service_release() and the ID array is owned by the parent XDomain.
Stable-dep-of: 2c5d2d3c3f70 ("thunderbolt: Prevent XDomain delayed work use-after-free on disconnect")
--- drivers/thunderbolt/xdomain.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/thunderbolt/xdomain.c +2 -1
@@ -784,6 +784,7 @@ static void tb_service_release(struct deida_simple_remove (&xd->service_ids, svc->id);kfree (svc->key);kfree (svc); +tb_xdomain_put (xd); }struct device_type tb_service_type = {
@@ -892,7 +893,7 @@ static void enumerate_services(struct tb svc->id = id; svc->dev.bus = &tb_bus_type; svc->dev.type = &tb_service_type; - svc->dev.parent = &xd->dev; + svc->dev.parent =get_device (&xd->dev);dev_set_name (&svc->dev,"%s.%d" ,dev_name (&xd->dev), svc->id);if (device_register (&svc->dev)) {
Greg Kroah-Hartman
maintainerPATCH 105/235 thunderbolt: Remove XDomain from the bus without holding tb->lock
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mika Westerberg <[email protected]>
[ Upstream commit a8937f35cf39c39c64325aa84d0463d866850857 ]
Currently we call device_unregister() for services and the XDomain itself with tb->lock held. This prevents the service drivers from calling any functions that may take it. For this reason separate removing the XDomain from the topology data structures (where we need the lock) from unregistering the device from the bus (where remove callbacks of the drivers are being called).
Stable-dep-of: 2c5d2d3c3f70 ("thunderbolt: Prevent XDomain delayed work use-after-free on disconnect")
--- drivers/thunderbolt/domain.c | 30 +++++++++++++++++++++ drivers/thunderbolt/icm.c | 5 +++ drivers/thunderbolt/switch.c | 14 ++++++++++ drivers/thunderbolt/tb.c | 58 +++++++++++++++++++++--------------------- drivers/thunderbolt/tb.h | 2 + drivers/thunderbolt/xdomain.c | 48 ++++++++++++++++++++++------------ 6 files changed, 111 insertions(+), 46 deletions(-)
drivers/thunderbolt/domain.c +30 -0
@@ -823,6 +823,36 @@ int tb_domain_disconnect_all_paths(strucreturn bus_for_each_dev (&tb_bus_type,NULL , tb, disconnect_xdomain); } +struct unregister_context { +const struct tb *tb; +int n; +}; + +static int unregister_unplugged_xdomain (struct device *dev,void *data) +{ +struct unregister_context *ctx = data; +struct tb_xdomain *xd; + + xd =tb_to_xdomain (dev); +if (xd && xd->tb == ctx->tb && xd->is_unplugged) { +tb_xdomain_unregister (xd); + ctx->n++; + } +return 0 ; +} + +int tb_domain_unregister_unplugged_xdomains (struct tb *tb) +{ +struct unregister_context ctx; + + ctx.tb =tb_domain_get (tb); + ctx.n =0 ; +bus_for_each_dev (&tb_bus_type,NULL , &ctx, unregister_unplugged_xdomain); +tb_domain_put (tb); + +return ctx.n; +} +int tb_domain_init (void ) {int ret;
drivers/thunderbolt/icm.c +5 -0
@@ -695,6 +695,7 @@ static void remove_xdomain(struct tb_xdo sw =tb_to_switch (xd->dev.parent);tb_port_at (xd->route, sw)->xdomain =NULL ; + xd->is_unplugged = true;tb_xdomain_remove (xd); }
@@ -1682,6 +1683,8 @@ static void icm_handle_notification(strukfree (n->pkg);kfree (n); + +tb_domain_unregister_unplugged_xdomains (tb); } static void icm_handle_event(struct tb *tb, enum tb_cfg_pkg_type type,
@@ -2023,6 +2026,8 @@ static void icm_rescan_work(struct work_if (tb->root_switch)icm_free_unplugged_children (tb->root_switch);mutex_unlock (&tb->lock); + +tb_domain_unregister_unplugged_xdomains (tb); }static void icm_complete (struct tb *tb)
drivers/thunderbolt/switch.c +14 -0
@@ -2737,6 +2737,20 @@ int tb_switch_resume(struct tb_switch *stb_port_warn (port,"lost during suspend, disconnecting\n" );tb_sw_set_unplugged (port->remote->sw); + }else if (port->xdomain) { +/* +* If the user replaced the XDomain with +* another router, this will succeed in +* which case we must remove the XDomain +* before adding the new router. +*/ + err =tb_cfg_get_upstream_port (sw->tb->ctl, + port->xdomain->route); +if (err >0 ) { +tb_port_warn (port, +"XDomain was disconnected\n" ); + port->xdomain->is_unplugged = true; + } } } }
drivers/thunderbolt/tb.c +29 -29
100 lines not on this page · raw message
drivers/thunderbolt/tb.h +2 -0
@@ -623,6 +623,7 @@ int tb_domain_disconnect_pcie_paths(struint tb_domain_approve_xdomain_paths (struct tb *tb,struct tb_xdomain *xd);int tb_domain_disconnect_xdomain_paths (struct tb *tb,struct tb_xdomain *xd);int tb_domain_disconnect_all_paths (struct tb *tb); +int tb_domain_unregister_unplugged_xdomains (struct tb *tb);static inline struct tb *tb_domain_get (struct tb *tb) {
@@ -939,6 +940,7 @@ struct tb_xdomain *tb_xdomain_alloc(stru const uuid_t *remote_uuid);void tb_xdomain_add (struct tb_xdomain *xd);void tb_xdomain_remove (struct tb_xdomain *xd); +void tb_xdomain_unregister (struct tb_xdomain *xd);struct tb_xdomain *tb_xdomain_find_by_link_depth (struct tb *tb,u8 link,u8 depth);
drivers/thunderbolt/xdomain.c +31 -17
63 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 106/235 thunderbolt: Prevent XDomain delayed work use-after-free on disconnect
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <[email protected]>
[ Upstream commit 2c5d2d3c3f70cde2565d7b279b544893a2035842 ]
tb_xdp_handle_request() runs on system_wq and queues xd->state_work via queue_delayed_work() in three request handlers:PROPERTIES_CHANGED_REQUEST, UUID_REQUEST (via start_handshake), and LINK_STATE_CHANGE_REQUEST. Similarly, update_xdomain() queues xd->properties_changed_work when local properties change.
Concurrently, tb_xdomain_remove() calls stop_handshake() which does cancel_delayed_work_sync() on both delayed works. Later, tb_xdomain_unregister() calls device_unregister() which eventually frees the xdomain. Since commit 559c1e1e0134 ("thunderbolt: Run tb_xdp_handle_request() in system workqueue") moved the request handler off tb->wq, the handler and the remove path are no longer serialized. If queue_delayed_work() executes after cancel_delayed_work_sync() but before the xdomain is freed, the delayed work fires on a freed object.
Add xd->removing that tb_xdomain_remove() sets under xd->lock before calling stop_handshake(). Each external queue site holds the same lock and checks removing before calling queue_delayed_work(). This provides the mutual exclusion needed:
either the queue site acquires the lock first and queues work that the subsequent cancel will see, or the remove path acquires the lock first and the queue site observes removing == true and skips the queue.
--- drivers/thunderbolt/xdomain.c | 20 ++++++++++++++++---- include/linux/thunderbolt.h | 3 +++ 2 files changed, 19 insertions(+), 4 deletions(-)
drivers/thunderbolt/xdomain.c +16 -4
@@ -604,8 +604,12 @@ static void tb_xdp_handle_request(struct*/ xd =tb_xdomain_find_by_uuid_locked (tb, &xchg->src_uuid);if (xd) { -queue_delayed_work (tb->wq, &xd->get_properties_work, -msecs_to_jiffies (50 )); +mutex_lock (&xd->lock); +if (!xd->removing) +queue_delayed_work (tb->wq, + &xd->get_properties_work, +msecs_to_jiffies (50 )); +mutex_unlock (&xd->lock);tb_xdomain_put (xd); }
@@ -1369,6 +1373,10 @@ static int unregister_service(struct dev*/ void tb_xdomain_remove (struct tb_xdomain *xd) { +mutex_lock (&xd->lock); + xd->removing = true; +mutex_unlock (&xd->lock); +stop_handshake (xd);if (!device_is_registered (&xd->dev)) {
@@ -1646,8 +1654,12 @@ static int update_xdomain(struct device xd =tb_to_xdomain (dev);if (xd) { -queue_delayed_work (xd->tb->wq, &xd->properties_changed_work, -msecs_to_jiffies (50 )); +mutex_lock (&xd->lock); +if (!xd->removing) +queue_delayed_work (xd->tb->wq, + &xd->properties_changed_work, +msecs_to_jiffies (50 )); +mutex_unlock (&xd->lock); }return 0 ;
include/linux/thunderbolt.h +3 -0
@@ -181,6 +181,8 @@ void tb_unregister_property_dir(const ch* @device_name: Name of the device (or %NULL if not known) * @is_unplugged: The XDomain is unplugged * @resume: The XDomain is being resumed +* @removing: Set by tb_xdomain_remove() under @lock to prevent +* concurrent delayed work queueing * @needs_uuid: If the XDomain does not have @remote_uuid it will be * queried first * @transmit_path: HopID which the remote end expects us to transmit
@@ -225,6 +227,7 @@ struct tb_xdomain {const char *device_name;bool is_unplugged;bool resume; +bool removing;bool needs_uuid;u16 transmit_path;u16 transmit_ring;
Greg Kroah-Hartman
maintainerPATCH 107/235 scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <[email protected]>
[ Upstream commit 1bd28625e25be549ee7c47532e7c3ef91c682410 ]
The memory allocated for mboxq using mempool_alloc() is not freed in some of the early exit error paths. Fix that by moving the mempool_free() call to an earlier point after last use.
--- drivers/scsi/lpfc/lpfc_init.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/scsi/lpfc/lpfc_init.c +1 -2
@@ -6811,6 +6811,7 @@ lpfc_sli4_driver_resource_setup(struct l goto out_free_bsmbx; } } +mempool_free (mboxq, phba->mbox_mem_pool);/* * 1 for cmd, 1 for rsp, NVME adds an extra one
@@ -6932,8 +6933,6 @@ lpfc_sli4_driver_resource_setup(struct lif (!phba->lpfc_cmd_rsp_buf_pool) goto out_free_sg_dma_buf; -mempool_free (mboxq, phba->mbox_mem_pool); -/* Verify OAS is supported */ lpfc_sli4_oas_verify (phba);
Greg Kroah-Hartman
maintainerPATCH 108/235 ovl: use linked upper dentry in copy-up tmpfile
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Souvik Banerjee <[email protected]>
[ Upstream commit e348eecd4d8fa8d18a5157ff59f7be1dc59c5928 ]
ovl_copy_up_tmpfile() stores the disconnected O_TMPFILE dentry as the overlay's upper dentry reference via ovl_inode_update(). vfs_tmpfile() allocated this dentry via d_alloc(parentpath->dentry, &slash_name), so d_name is "/" and d_parent is c->workdir. Local upper filesystems (ext4, btrfs, xfs, ...) immediately rename it to "#<inum>" via d_mark_tmpfile() inside their ->tmpfile() op; FUSE and virtiofs do not, so both fields stay that way. Neither identifies the destination directory and filename where ovl_do_link() actually linked the file.
When the upper filesystem implements ->d_revalidate() (e.g. FUSE or virtiofs), ovl_revalidate_real() calls it with the dentry's parent inode and a snapshot of d_name. The server tries to look up "/" inside c->workdir, fails, and overlayfs reports -ESTALE.
This causes persistent ESTALE errors for any file that was copied up via the tmpfile path, breaking dpkg, apt, and other tools that do rename-over-existing on overlayfs with a FUSE/virtiofs upper.
Before commit 6b52243f633e ("ovl: fold copy-up helpers into callers"), the tmpfile copy-up path used a dedicated helper ovl_link_tmpfile() that captured the linked destination dentry returned by ovl_do_link():
err = ovl_do_link(temp, udir, upper);
...
if (!err)
*newdentry = dget(upper);and published it via ovl_inode_update(d_inode(c->dentry), newdentry). The fold inlined ovl_do_link() into ovl_copy_up_tmpfile() but dropped the dget(upper) capture, and rewrote the publish line as ovl_inode_update(d_inode(c->dentry), dget(temp)) — where temp is the disconnected O_TMPFILE dentry.
Fix by keeping a reference to the linked destination dentry after ovl_do_link() succeeds, and publishing that dentry at the existing ovl_inode_update() call site. The non-tmpfile/workdir path continues to publish the renamed temporary dentry.
Reproducer:
- Mount overlayfs with virtiofs (or a FUSE fs whose server advertises FUSE_TMPFILE) as upper
- Run: dpkg -i <any .deb>
- Observe: "error installing new file '...': Stale file handle"
--- fs/overlayfs/copy_up.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
fs/overlayfs/copy_up.c +10 -4
@@ -648,7 +648,7 @@ cleanup:static int ovl_copy_up_tmpfile (struct ovl_copy_up_ctx *c) {struct inode *udir =d_inode (c->destdir); -struct dentry *temp, *upper; +struct dentry *temp, *upper, *newdentry =NULL ;struct ovl_cu_creds cc;int err;
@@ -672,6 +672,14 @@ static int ovl_copy_up_tmpfile(struct ov err =PTR_ERR (upper);if (!IS_ERR (upper)) { err =ovl_do_link (temp, udir, upper); +if (!err) { +/* +* Record the linked dentry -- not the disconnected +* O_TMPFILE dentry -- so that ->d_revalidate() on +* the upper fs sees the real parent/name. +*/ + newdentry =dget (upper); + }dput (upper); }inode_unlock (udir);
@@ -681,9 +689,7 @@ static int ovl_copy_up_tmpfile(struct ovif (!c->metacopy)ovl_set_upperdata (d_inode (c->dentry)); -ovl_inode_update (d_inode (c->dentry), temp); - -return 0 ; +ovl_inode_update (d_inode (c->dentry), newdentry); out_dput:dput (temp);
Greg Kroah-Hartman
maintainerPATCH 109/235 scsi: target: core: pr: Initialize arrays at declaration time
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chaitanya Kulkarni <[email protected]>
[ Upstream commit 4db6dfe62c5f76ce9eef28967c2e2000efde10d5 ]
Avoids calling memset().
Stable-dep-of: d04a179085c2 ("scsi: target: Bound PR-OUT TransportID parsing to the received buffer")
--- drivers/target/target_core_pr.c | 36 +++++++++++++----------------------- 1 file changed, 13 insertions(+), 23 deletions(-)
drivers/target/target_core_pr.c +13 -23
@@ -895,9 +895,8 @@ static void core_scsi3_aptpl_reserve(struct se_node_acl *node_acl, struct t10_pr_registration *pr_reg) { - char i_buf[PR_REG_ISID_ID_LEN]; + char i_buf[PR_REG_ISID_ID_LEN] = { }; -memset (i_buf,0 ,PR_REG_ISID_ID_LEN );core_pr_dump_initiator_port (pr_reg, i_buf,PR_REG_ISID_ID_LEN );spin_lock (&dev->dev_reservation_lock);
@@ -927,12 +926,10 @@ static int __core_scsi3_check_aptpl_regi {struct t10_pr_registration *pr_reg, *pr_reg_tmp;struct t10_reservation *pr_tmpl = &dev->t10_pr; -unsigned char i_port[PR_APTPL_MAX_IPORT_LEN ]; -unsigned char t_port[PR_APTPL_MAX_TPORT_LEN ]; +unsigned char i_port[PR_APTPL_MAX_IPORT_LEN ] = { }; +unsigned char t_port[PR_APTPL_MAX_TPORT_LEN ] = { };u16 tpgt; -memset (i_port,0 ,PR_APTPL_MAX_IPORT_LEN ); -memset (t_port,0 ,PR_APTPL_MAX_TPORT_LEN );/* * Copy Initiator Port information from struct se_node_acl */
@@ -1022,9 +1019,8 @@ static void __core_scsi3_dump_registrati enum register_type register_type) {struct se_portal_group *se_tpg = nacl->se_tpg; -char i_buf[PR_REG_ISID_ID_LEN ]; +char i_buf[PR_REG_ISID_ID_LEN ] = { }; -memset (&i_buf[0 ],0 ,PR_REG_ISID_ID_LEN );core_pr_dump_initiator_port (pr_reg, i_buf,PR_REG_ISID_ID_LEN ); pr_debug("SPC-3 PR [%s] Service Action: REGISTER%s Initiator"
@@ -1203,10 +1199,10 @@ static struct t10_pr_registration *core_ struct se_session *sess) {struct se_portal_group *tpg = nacl->se_tpg; -unsigned char buf[PR_REG_ISID_LEN ], *isid_ptr =NULL ; +unsigned char buf[PR_REG_ISID_LEN ] = { }; +unsigned char *isid_ptr =NULL ;if (tpg->se_tpg_tfo->sess_get_initiator_sid !=NULL ) { -memset (&buf[0 ],0 ,PR_REG_ISID_LEN ); tpg->se_tpg_tfo->sess_get_initiator_sid (sess, &buf[0 ],PR_REG_ISID_LEN ); isid_ptr = &buf[0 ];
@@ -1284,11 +1280,10 @@ static void __core_scsi3_free_registratistruct t10_reservation *pr_tmpl = &dev->t10_pr;struct se_node_acl *nacl = pr_reg->pr_reg_nacl;struct se_dev_entry *deve; -char i_buf[PR_REG_ISID_ID_LEN ]; +char i_buf[PR_REG_ISID_ID_LEN ] = { };lockdep_assert_held (&pr_tmpl->registration_lock); -memset (i_buf,0 ,PR_REG_ISID_ID_LEN );core_pr_dump_initiator_port (pr_reg, i_buf,PR_REG_ISID_ID_LEN );if (!list_empty (&pr_reg->pr_reg_list))
@@ -2060,7 +2055,8 @@ core_scsi3_emulate_pro_register(struct sstruct se_portal_group *se_tpg;struct t10_pr_registration *pr_reg, *pr_reg_p, *pr_reg_tmp;struct t10_reservation *pr_tmpl = &dev->t10_pr; -unsigned char isid_buf[PR_REG_ISID_LEN ], *isid_ptr =NULL ; +unsigned char isid_buf[PR_REG_ISID_LEN ] = { }; +unsigned char *isid_ptr =NULL ;sense_reason_t ret =TCM_NO_SENSE ;int pr_holder =0 , type;
@@ -2071,7 +2067,6 @@ core_scsi3_emulate_pro_register(struct s se_tpg = se_sess->se_tpg;if (se_tpg->se_tpg_tfo->sess_get_initiator_sid) { -memset (&isid_buf[0 ],0 ,PR_REG_ISID_LEN ); se_tpg->se_tpg_tfo->sess_get_initiator_sid (se_sess, &isid_buf[0 ],PR_REG_ISID_LEN ); isid_ptr = &isid_buf[0 ];
@@ -2283,11 +2278,9 @@ core_scsi3_pro_reserve(struct se_cmd *cmstruct se_lun *se_lun = cmd->se_lun;struct t10_pr_registration *pr_reg, *pr_res_holder;struct t10_reservation *pr_tmpl = &dev->t10_pr; -char i_buf[PR_REG_ISID_ID_LEN ]; +char i_buf[PR_REG_ISID_ID_LEN ] = { };sense_reason_t ret; -memset (i_buf,0 ,PR_REG_ISID_ID_LEN ); -if (!se_sess || !se_lun) {pr_err ("SPC-3 PR: se_sess || struct se_lun is NULL!\n" );return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE ;
@@ -2458,12 +2451,11 @@ static void __core_scsi3_complete_pro_re int unreg) {const struct target_core_fabric_ops *tfo = se_nacl->se_tpg->se_tpg_tfo; -char i_buf[PR_REG_ISID_ID_LEN ]; +char i_buf[PR_REG_ISID_ID_LEN ] = { };int pr_res_type =0 , pr_res_scope =0 ;lockdep_assert_held (&dev->dev_reservation_lock); -memset (i_buf,0 ,PR_REG_ISID_ID_LEN );core_pr_dump_initiator_port (pr_reg, i_buf,PR_REG_ISID_ID_LEN );/* * Go ahead and release the current PR reservation holder.
@@ -2769,11 +2761,10 @@ static void __core_scsi3_complete_pro_pr {struct se_node_acl *nacl = pr_reg->pr_reg_nacl;const struct target_core_fabric_ops *tfo = nacl->se_tpg->se_tpg_tfo; -char i_buf[PR_REG_ISID_ID_LEN ]; +char i_buf[PR_REG_ISID_ID_LEN ] = { };lockdep_assert_held (&dev->dev_reservation_lock); -memset (i_buf,0 ,PR_REG_ISID_ID_LEN );core_pr_dump_initiator_port (pr_reg, i_buf,PR_REG_ISID_ID_LEN );/* * Do an implicit RELEASE of the existing reservation.
@@ -3159,7 +3150,7 @@ core_scsi3_emulate_pro_register_and_movestruct t10_reservation *pr_tmpl = &dev->t10_pr;unsigned char *buf;const unsigned char *initiator_str; -char *iport_ptr =NULL , i_buf[PR_REG_ISID_ID_LEN ]; +char *iport_ptr =NULL , i_buf[PR_REG_ISID_ID_LEN ] = { };u32 tid_len, tmp_tid_len;int new_reg =0 , type, scope, matching_iname;sense_reason_t ret;
@@ -3171,7 +3162,6 @@ core_scsi3_emulate_pro_register_and_movereturn TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE ; } -memset (i_buf,0 ,PR_REG_ISID_ID_LEN ); se_tpg = se_sess->se_tpg; tf_ops = se_tpg->se_tpg_tfo;/*
Greg Kroah-Hartman
maintainerPATCH 110/235 scsi: target: core: Generate correct identifiers for PR OUT transport IDs
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maurizio Lombardi <[email protected]>
[ Upstream commit 6e0f6aa44b68335df404a2df955055f416b5f2aa ]
Fix target_parse_pr_out_transport_id() to return a string representing the transport ID in a human-readable format (e.g., naa.xxxxxxxx...) for various SCSI protocol types (SAS, FCP, SRP, SBP).
Previously, the function returned a pointer to the raw binary buffer, which was incorrectly compared against human-readable strings, causing comparisons to fail. Now, the function writes a properly formatted string into a buffer provided by the caller. The output format depends on the transport protocol:
* SAS: 64-bit identifier, "naa." prefix.
* FCP: 64-bit identifier, colon separated values.
* SBP: 64-bit identifier, no prefix.
* SRP: 128-bit identifier, "0x" prefix.
* iSCSI: IQN string.
Stable-dep-of: d04a179085c2 ("scsi: target: Bound PR-OUT TransportID parsing to the received buffer")
--- drivers/target/target_core_fabric_lib.c | 63 ++++++++++++++++++++++++-------- drivers/target/target_core_internal.h | 4 +- drivers/target/target_core_pr.c | 18 +++++---- 3 files changed, 60 insertions(+), 25 deletions(-)
drivers/target/target_core_fabric_lib.c +48 -15
@@ -257,11 +257,41 @@ static int iscsi_get_pr_transport_id_lenreturn len; } -static char *iscsi_parse_pr_out_transport_id ( +static void sas_parse_pr_out_transport_id (char *buf,char *i_str) +{ +char hex[17 ] = {}; + +bin2hex (hex, buf +4 ,8 ); +snprintf (i_str,TRANSPORT_IQN_LEN ,"naa.%s" , hex); +} + +static void srp_parse_pr_out_transport_id (char *buf,char *i_str) +{ +char hex[33 ] = {}; + +bin2hex (hex, buf +8 ,16 ); +snprintf (i_str,TRANSPORT_IQN_LEN ,"0x%s" , hex); +} + +static void fcp_parse_pr_out_transport_id (char *buf,char *i_str) +{ +snprintf (i_str,TRANSPORT_IQN_LEN ,"%8phC" , buf +8 ); +} + +static void sbp_parse_pr_out_transport_id (char *buf,char *i_str) +{ +char hex[17 ] = {}; + +bin2hex (hex, buf +8 ,8 ); +snprintf (i_str,TRANSPORT_IQN_LEN ,"%s" , hex); +} + +static bool iscsi_parse_pr_out_transport_id (struct se_portal_group *se_tpg,char *buf,u32 *out_tid_len, -char **port_nexus_ptr) +char **port_nexus_ptr, +char *i_str) {char *p;int i;
@@ -282,7 +312,7 @@ static char *iscsi_parse_pr_out_transporif ((format_code !=0x00 ) && (format_code !=0x40 )) {pr_err ("Illegal format code: 0x%02x for iSCSI" " Initiator Transport ID\n" , format_code); -return NULL ; +return false; }/* * If the caller wants the TransportID Length, we set that value for the
@@ -306,7 +336,7 @@ static char *iscsi_parse_pr_out_transporpr_err ("Unable to locate \",i,0x\" separator" " for Initiator port identifier: %s\n" , &buf[4 ]); -return NULL ; +return false; } *p ='\0' ;/* Terminate iSCSI Name */ p +=5 ;/* Skip over ",i,0x" separator */
@@ -339,7 +369,8 @@ static char *iscsi_parse_pr_out_transpor }else *port_nexus_ptr =NULL ; -return &buf[4 ]; +strscpy (i_str, &buf[4 ],TRANSPORT_IQN_LEN ); +return true; } int target_get_pr_transport_id_len(struct se_node_acl *nacl,
@@ -387,33 +418,35 @@ int target_get_pr_transport_id(struct se } } -const char *target_parse_pr_out_transport_id (struct se_portal_group *tpg, -char *buf,u32 *out_tid_len,char **port_nexus_ptr) +bool target_parse_pr_out_transport_id (struct se_portal_group *tpg, +char *buf,u32 *out_tid_len,char **port_nexus_ptr,char *i_str) { -u32 offset; -switch (tpg->proto_id) {case SCSI_PROTOCOL_SAS :/* * Assume the FORMAT CODE 00b from spc4r17, 7.5.4.7 TransportID * for initiator ports using SCSI over SAS Serial SCSI Protocol. */ - offset =4 ; +sas_parse_pr_out_transport_id (buf, i_str);break ; -case SCSI_PROTOCOL_SBP :case SCSI_PROTOCOL_SRP : +srp_parse_pr_out_transport_id (buf, i_str); +break ;case SCSI_PROTOCOL_FCP : - offset =8 ; +fcp_parse_pr_out_transport_id (buf, i_str); +break ; +case SCSI_PROTOCOL_SBP : +sbp_parse_pr_out_transport_id (buf, i_str);break ;case SCSI_PROTOCOL_ISCSI :return iscsi_parse_pr_out_transport_id (tpg, buf, out_tid_len, - port_nexus_ptr); + port_nexus_ptr, i_str);default :pr_err ("Unknown proto_id: 0x%02x\n" , tpg->proto_id); -return NULL ; +return false; } *port_nexus_ptr =NULL ; *out_tid_len =24 ; -return buf + offset; +return true; }
drivers/target/target_core_internal.h +2 -2
@@ -102,8 +102,8 @@ int target_get_pr_transport_id_len(strucint target_get_pr_transport_id (struct se_node_acl *nacl,struct t10_pr_registration *pr_reg,int *format_code,unsigned char *buf); -const char *target_parse_pr_out_transport_id (struct se_portal_group *tpg, -char *buf,u32 *out_tid_len,char **port_nexus_ptr); +bool target_parse_pr_out_transport_id (struct se_portal_group *tpg, +char *buf,u32 *out_tid_len,char **port_nexus_ptr,char *i_str);/* target_core_hba.c */ struct se_hba *core_alloc_hba (const char *,u32 ,u32 );
drivers/target/target_core_pr.c +10 -8
@@ -1486,11 +1486,12 @@ core_scsi3_decode_spec_i_port(LIST_HEAD (tid_dest_list);struct pr_transport_id_holder *tidh_new, *tidh, *tidh_tmp;unsigned char *buf, *ptr, proto_ident; -const unsigned char *i_str =NULL ; +unsigned char i_str[TRANSPORT_IQN_LEN ];char *iport_ptr =NULL , i_buf[PR_REG_ISID_ID_LEN ];sense_reason_t ret;u32 tpdl, tid_len =0 ;u32 dest_rtpi =0 ; +bool tid_found;/* * Allocate a struct pr_transport_id_holder and setup the
@@ -1579,9 +1580,9 @@ core_scsi3_decode_spec_i_port( dest_rtpi = tmp_lun->lun_rtpi; iport_ptr =NULL ; - i_str =target_parse_pr_out_transport_id (tmp_tpg, - ptr, &tid_len, &iport_ptr); -if (!i_str) + tid_found =target_parse_pr_out_transport_id (tmp_tpg, + ptr, &tid_len, &iport_ptr, i_str); +if (!tid_found)continue ;/* * Determine if this SCSI device server requires that
@@ -3149,13 +3150,14 @@ core_scsi3_emulate_pro_register_and_movestruct t10_pr_registration *pr_reg, *pr_res_holder, *dest_pr_reg;struct t10_reservation *pr_tmpl = &dev->t10_pr;unsigned char *buf; -const unsigned char *initiator_str; +unsigned char initiator_str[TRANSPORT_IQN_LEN ];char *iport_ptr =NULL , i_buf[PR_REG_ISID_ID_LEN ] = { };u32 tid_len, tmp_tid_len;int new_reg =0 , type, scope, matching_iname;sense_reason_t ret;unsigned short rtpi;unsigned char proto_ident; +bool tid_found;if (!se_sess || !se_lun) {pr_err ("SPC-3 PR: se_sess || struct se_lun is NULL!\n" );
@@ -3274,9 +3276,9 @@ core_scsi3_emulate_pro_register_and_move ret =TCM_INVALID_PARAMETER_LIST ; goto out; } - initiator_str =target_parse_pr_out_transport_id (dest_se_tpg, - &buf[24 ], &tmp_tid_len, &iport_ptr); -if (!initiator_str) { + tid_found =target_parse_pr_out_transport_id (dest_se_tpg, + &buf[24 ], &tmp_tid_len, &iport_ptr, initiator_str); +if (!tid_found) {pr_err ("SPC-3 PR REGISTER_AND_MOVE: Unable to locate" " initiator_str from Transport ID\n" ); ret =TCM_INVALID_PARAMETER_LIST ;
Greg Kroah-Hartman
maintainerPATCH 111/235 scsi: target: Bound PR-OUT TransportID parsing to the received buffer
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <[email protected]>
[ Upstream commit d04a179085c262c9ed577d0a4cbc6482ff1fd9a3 ]
core_scsi3_decode_spec_i_port() and core_scsi3_emulate_register_and_move() hand the raw PERSISTENT RESERVE OUT parameter buffer to target_parse_pr_out_transport_id() without telling it how many bytes are valid. For an iSCSI TransportID (FORMAT CODE 01b), iscsi_parse_pr_out_transport_id() locates the ",i,0x" ISID separator with an unbounded strstr() (and on the error path prints the name with a further unbounded "%s"). An initiator can submit a TransportID whose iSCSI name contains neither a ",i,0x" substring nor a NUL terminator, filling the parameter list to its end, so the scan runs off the end of the buffer.
When the parameter list spans more than one page the buffer is a multi-page vmap (transport_kmap_data_sg()), so the over-read walks into the trailing vmalloc guard page and oopses (KASAN: vmalloc-out-of-bounds in strstr). It is reachable by any fabric that delivers a PR OUT to a device exported through an iSCSI TPG, including a guest via vhost-scsi.
Pass the number of received bytes down to the parser and validate the iSCSI TransportID's own self-described length (ADDITIONAL LENGTH + 4) once, up
front: reject it if it is below the spc4r17 minimum or larger than the received buffer, then bound the separator search, the ISID walk and the name copy by that length. This is the length check the callers already perform after the parse (core_scsi3_decode_spec_i_port() compares tid_len against tpdl, core_scsi3_emulate_register_and_move() validates it against data_length), moved ahead of the scan. Also drop the unbounded "%s" of the unterminated name.
Add per-format explicit name-length checks before copying into i_str, rather than silently truncating with min_t: for FORMAT CODE 00b reject if the descriptor body (tid_len - 4 bytes) cannot fit in i_str[TRANSPORT_IQN_LEN]; for FORMAT CODE 01b reject if the name portion (from &buf[4] up to the separator) cannot fit. Both checks make the bounds intent explicit at each format branch.
While here, also reject a FORMAT CODE 01b TransportID whose ",i,0x" separator sits at the very end of the descriptor: that leaves an empty ISID and points the returned port nexus pointer at buf + tid_len, one past the descriptor, which the registration code (__core_scsi3_locate_pr_reg(), __core_scsi3_alloc_registration()) then dereferences as the ISID string -- the same over-read of the parameter buffer for a malformed descriptor.
--- drivers/target/target_core_fabric_lib.c | 89 ++++++++++++++++++++++++-------- drivers/target/target_core_internal.h | 3 - drivers/target/target_core_pr.c | 4 - 3 files changed, 73 insertions(+), 23 deletions(-)
drivers/target/target_core_fabric_lib.c +69 -20
@@ -289,13 +289,24 @@ static void sbp_parse_pr_out_transport_istatic bool iscsi_parse_pr_out_transport_id (struct se_portal_group *se_tpg,char *buf, +u32 buf_len,u32 *out_tid_len,char **port_nexus_ptr,char *i_str) {char *p; +u32 tid_len;int i; -u8 format_code = (buf[0 ] &0xc0 ); +u8 format_code; + +/* +* The 4-byte iSCSI TransportID header (FORMAT CODE + 2-byte ADDITIONAL +* LENGTH) must be present before any of it can be parsed. +*/ +if (buf_len <4 ) +return false; + + format_code = buf[0 ] &0xc0 ;/* * Check for FORMAT CODE 00b or 01b from spc4r17, section 7.5.4.6: *
@@ -315,15 +326,17 @@ static bool iscsi_parse_pr_out_transportreturn false; }/* -* If the caller wants the TransportID Length, we set that value for the -* entire iSCSI Tarnsport ID now. +* Reconstruct the self-described TransportID length from the ADDITIONAL +* LENGTH field plus the 4-byte header. Reject it if it is below the +* spc4r17 section 7.5.4.6 minimum (ADDITIONAL LENGTH shall be at least +* 20) or if it runs past the bytes actually received, so that every +* access below stays inside the TransportID. */ -if (out_tid_len) { -/* The shift works thanks to integer promotion rules */ - *out_tid_len =get_unaligned_be16 (&buf[2 ]); -/* Add four bytes for iSCSI Transport ID header */ - *out_tid_len +=4 ; - } + tid_len =get_unaligned_be16 (&buf[2 ]) +4 ; +if (tid_len <24 || tid_len > buf_len) +return false; +if (out_tid_len) + *out_tid_len = tid_len;/* * Check for ',i,0x' separator between iSCSI Name and iSCSI Initiator
@@ -331,16 +344,32 @@ static bool iscsi_parse_pr_out_transport* format. */ if (format_code ==0x40 ) { - p =strstr (&buf[4 ],",i,0x" ); + p =strnstr (&buf[4 ],",i,0x" , tid_len -4 );if (!p) { -pr_err ("Unable to locate \",i,0x\" separator" -" for Initiator port identifier: %s\n" , - &buf[4 ]); +pr_err ("Unable to locate \",i,0x\" separator in iSCSI TransportID\n" ); +return false; + } +/* +* The iSCSI name runs from &buf[4] up to the separator; reject it +* if it cannot fit in i_str[TRANSPORT_IQN_LEN]. +*/ +if (p - &buf[4 ] >=TRANSPORT_IQN_LEN ) { +pr_err ("iSCSI Initiator port name too long in TransportID\n" );return false; } *p ='\0' ;/* Terminate iSCSI Name */ p +=5 ;/* Skip over ",i,0x" separator */ +/* +* The ISID must follow the separator. A ",i,0x" sitting at the +* very end of the TransportID leaves no ISID and would point the +* port nexus at buf + tid_len, i.e. past the descriptor, which +* the registration code then reads as the ISID string. +*/ +if (p >= buf + tid_len) { +pr_err ("Missing ISID in iSCSI Initiator port TransportID\n" ); +return false; + } *port_nexus_ptr = p;/* * Go ahead and do the lower case conversion of the received
@@ -348,7 +377,7 @@ static bool iscsi_parse_pr_out_transport* for comparison against the running iSCSI session's ISID from * iscsi_target.c:lio_sess_get_initiator_sid() */ -for (i =0 ; i <12 ; i++) { +for (i =0 ; i <12 && p < buf + tid_len; i++) {/* * The first ISCSI INITIATOR SESSION ID field byte * containing an ASCII null character terminates the
@@ -366,10 +395,22 @@ static bool iscsi_parse_pr_out_transport *p =tolower (*p); p++; } - }else +strscpy (i_str, &buf[4 ],TRANSPORT_IQN_LEN ); + }else { *port_nexus_ptr =NULL ; - -strscpy (i_str, &buf[4 ],TRANSPORT_IQN_LEN ); +/* +* FORMAT CODE 00b: the name occupies buf[4..tid_len-1]. The +* declared length tid_len - 4 must fit in i_str[TRANSPORT_IQN_LEN]. +* (For 01b the same tid_len bound would be over-restrictive: the +* descriptor also carries the separator and ISID, so a legal +* <=223-byte name gives tid_len up to 244.) +*/ +if (tid_len -4 >=TRANSPORT_IQN_LEN ) { +pr_err ("iSCSI Initiator port name too long in TransportID\n" ); +return false; + } +strscpy (i_str, &buf[4 ], tid_len -4 ); + }return true; }
@@ -419,8 +460,16 @@ int target_get_pr_transport_id(struct se }bool target_parse_pr_out_transport_id (struct se_portal_group *tpg, -char *buf,u32 *out_tid_len,char **port_nexus_ptr,char *i_str) +char *buf,u32 buf_len,u32 *out_tid_len, +char **port_nexus_ptr,char *i_str) { +/* +* The fixed-length SAS/SRP/FCP/SBP TransportIDs are 24 bytes; the iSCSI +* format is variable and bounds itself against buf_len below. +*/ +if (tpg->proto_id !=SCSI_PROTOCOL_ISCSI && buf_len <24 ) +return false; +switch (tpg->proto_id) {case SCSI_PROTOCOL_SAS :/*
@@ -439,8 +488,8 @@ bool target_parse_pr_out_transport_id(stsbp_parse_pr_out_transport_id (buf, i_str);break ;case SCSI_PROTOCOL_ISCSI : -return iscsi_parse_pr_out_transport_id (tpg, buf, out_tid_len, - port_nexus_ptr, i_str); +return iscsi_parse_pr_out_transport_id (tpg, buf, buf_len, + out_tid_len, port_nexus_ptr, i_str);default :pr_err ("Unknown proto_id: 0x%02x\n" , tpg->proto_id);return false;
drivers/target/target_core_internal.h +2 -1
@@ -103,7 +103,8 @@ int target_get_pr_transport_id(struct se struct t10_pr_registration *pr_reg, int *format_code, unsigned char *buf);bool target_parse_pr_out_transport_id (struct se_portal_group *tpg, -char *buf,u32 *out_tid_len,char **port_nexus_ptr,char *i_str); +char *buf,u32 buf_len,u32 *out_tid_len, +char **port_nexus_ptr,char *i_str);/* target_core_hba.c */ struct se_hba *core_alloc_hba (const char *,u32 ,u32 );
drivers/target/target_core_pr.c +2 -2
@@ -1581,7 +1581,7 @@ core_scsi3_decode_spec_i_port( iport_ptr =NULL ; tid_found =target_parse_pr_out_transport_id (tmp_tpg, - ptr, &tid_len, &iport_ptr, i_str); + ptr, tpdl, &tid_len, &iport_ptr, i_str);if (!tid_found)continue ;/*
@@ -3277,7 +3277,7 @@ core_scsi3_emulate_pro_register_and_move goto out; } tid_found =target_parse_pr_out_transport_id (dest_se_tpg, - &buf[24 ], &tmp_tid_len, &iport_ptr, initiator_str); + &buf[24 ], tid_len, &tmp_tid_len, &iport_ptr, initiator_str);if (!tid_found) {pr_err ("SPC-3 PR REGISTER_AND_MOVE: Unable to locate" " initiator_str from Transport ID\n" );
Greg Kroah-Hartman
maintainerPATCH 112/235 dm-integrity: dont increment hash_offset twice
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
[ Upstream commit edf025f083854f80032b73a1aad69a3c90db236f ]
hash_offset is already incremented in the loop "for (i = 0; i < to_copy; i++, ts--)". Do not increment it again.
--- drivers/md/dm-integrity.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/md/dm-integrity.c +0 -4
@@ -1377,10 +1377,6 @@ thorough_test: *metadata_offset =0 ; } -if (unlikely (!is_power_of_2 (ic->tag_size))) { - hash_offset = (hash_offset + to_copy) % ic->tag_size; - } - total_size -= to_copy; }while (unlikely (total_size));
Greg Kroah-Hartman
maintainerPATCH 113/235 dm-verity: make error counter atomic
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
[ Upstream commit 8ec4d9c5a5cf4b61fc087f871465b1f79b393325 ]
The error counter "v->corrupted_errs" was not atomic, thus it could be subject to race conditions. The call to dm_audit_log_target("max-corrupted-errors") may be skipped due to the races.
--- drivers/md/dm-verity-target.c | 12 +++++++----- drivers/md/dm-verity.h | 2 +- 2 files changed, 8 insertions(+), 6 deletions(-)
drivers/md/dm-verity-target.c +7 -5
@@ -217,14 +217,16 @@ static int verity_handle_err(struct dm_vchar *envp[] = { verity_env,NULL };const char *type_str ="" ;struct mapped_device *md =dm_table_get_md (v->ti->table); +int ce;/* Corruption should be visible in device status in all modes */ v->hash_failed =1 ; -if (v->corrupted_errs >=DM_VERITY_MAX_CORRUPTED_ERRS ) - goto out; - - v->corrupted_errs++; + ce =atomic_read (&v->corrupted_errs); +do { +if (ce >=DM_VERITY_MAX_CORRUPTED_ERRS ) + goto out; + }while (!atomic_try_cmpxchg (&v->corrupted_errs, &ce, ce +1 ));switch (type) {case DM_VERITY_BLOCK_TYPE_DATA :
@@ -240,7 +242,7 @@ static int verity_handle_err(struct dm_vDMERR_LIMIT ("%s: %s block %llu is corrupted" , v->data_dev->name, type_str, block); -if (v->corrupted_errs ==DM_VERITY_MAX_CORRUPTED_ERRS ) +if (ce +1 ==DM_VERITY_MAX_CORRUPTED_ERRS )DMERR ("%s: reached maximum errors" , v->data_dev->name); snprintf(verity_env, DM_VERITY_ENV_LENGTH, "%s=%d,%llu",
drivers/md/dm-verity.h +1 -1
@@ -55,7 +55,7 @@ struct dm_verity {unsigned int ahash_reqsize;/* the size of temporary space for crypto */ int hash_failed;/* set to 1 if hash of any block failed */ enum verity_mode mode;/* mode for handling verification errors */ -unsigned corrupted_errs;/* Number of errors for corrupted blocks */ +atomic_t corrupted_errs;/* Number of errors for corrupted blocks */ struct workqueue_struct *verify_wq;
Greg Kroah-Hartman
maintainerPATCH 114/235 Input: ims-pcu - fix race condition in reset_device sysfs callback
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
[ Upstream commit 411b8c4b274737c3bf08e1e025801161603cfffc ]
The ims_pcu_reset_device() sysfs callback calls ims_pcu_execute_command() without acquiring pcu->cmd_mutex. This can lead to data races and corruption of the shared command buffer if triggered concurrently with other commands.
Acquire pcu->cmd_mutex before calling ims_pcu_execute_command().
--- drivers/input/misc/ims-pcu.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/input/misc/ims-pcu.c +2 -0
@@ -1193,6 +1193,8 @@ static ssize_t ims_pcu_reset_device(strudev_info (pcu->dev,"Attempting to reset device\n" ); +guard (mutex)(&pcu->cmd_mutex); + error =ims_pcu_execute_command (pcu,PCU_RESET , &reset_byte,1 );if (error) { dev_info(pcu->dev,
Greg Kroah-Hartman
maintainerPATCH 115/235 wifi: libertas_tf: fix use-after-free in lbtf_free_adapter()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maoyi Xie <[email protected]>
[ Upstream commit aa6dcd5c8dd9ba1d7d0f60093bcda41c0d6d438d ]
lbtf_free_adapter() calls timer_delete(&priv->command_timer), which does not wait for a running command_timer_fn() callback. lbtf_free_adapter() runs on the teardown path right before ieee80211_free_hw() frees priv, both in lbtf_remove_card() and in the probe error path. command_timer is armed by mod_timer() in lbtf_cmd() whenever a firmware command is sent. command_timer_fn() dereferences priv. If a command times out as the device is removed, command_timer_fn() runs concurrently with teardown and dereferences priv after it has been freed.
This is the same use-after-free that commit 03cc8f90d053 ("wifi: libertas:
fix use-after-free in lbs_free_adapter()") fixed in the sibling libertas driver. The libertas_tf variant has the identical pattern and was left unchanged. Use timer_delete_sync() so any in-flight callback completes before priv is freed.
--- drivers/net/wireless/marvell/libertas_tf/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/marvell/libertas_tf/main.c +1 -1
@@ -174,7 +174,7 @@ static void lbtf_free_adapter(struct lbt {lbtf_deb_enter (LBTF_DEB_MAIN );lbtf_free_cmd_buffer (priv); -del_timer (&priv->command_timer); +timer_delete_sync (&priv->command_timer);lbtf_deb_leave (LBTF_DEB_MAIN ); }