6.1.184-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainercover 6.1.184-rc1 review
This is the start of the stable review cycle for the 6.1.184 release. There are 303 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.184-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.1.184-rc1
Zihan Xi <[email protected]>
Bluetooth: mgmt: fix pending command UAF in EIR updates
Pauli Virtanen <[email protected]>
Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync
Pauli Virtanen <[email protected]>
Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate
Edward Adam Davis <[email protected]>
Bluetooth: hci_sock: Prevent race in socket write iter and sock bind
Robert Mader <[email protected]>
udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf()
Gao Xiang <[email protected]>
erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms
Andrei Kuchynski <[email protected]>
usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path
Pedro Falcato <[email protected]>
RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_sync: Fix not using correct handle
Christian Brauner <[email protected]>
binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
Lorenzo Stoakes (ARM) <[email protected]>
mm/huge_memory: fix huge_zero_pfn race
Baul Lee <[email protected]>
net/x25: fix use-after-free of the socket by its timers
Siddharth Vadapalli <[email protected]>
net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
Zhang Changzhong <[email protected]>
net/sched: cls_u32: skip hash tables in u32_bind_class()
Eric Dumazet <[email protected]>
af_packet: Don't send zero-byte data in tpacket_snd().
Rosen Penev <[email protected]>
ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers
Chuck Lever <[email protected]>
net/tls: Fail tls_sw_splice_read() after a failed async decrypt
Wei Fang <[email protected]>
net: packet: fix wrong transport_header when sending VLAN-tagged frame
Eric Dumazet <[email protected]>
macvlan: inherit needed_headroom and needed_tailroom from lowerdev
Eric Dumazet <[email protected]>
ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
Florian Westphal <[email protected]>
netfilter: ipset: let destroy callbacks adjust ext mem size
Florian Westphal <[email protected]>
netfilter: ipset: fix list type element drift bug
Jérémy Jean <[email protected]>
netfilter: flowtable: publish GC-visible tuple last
Alexey Velichayshiy <[email protected]>
netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
Xiang Mei (Microsoft) <[email protected]>
netfilter: ipset: fix refcount race between list:set GC and swap
Herbert Xu <[email protected]>
crypto: ccm - Set rfc4309 maxauthsize from child
Jon Hunter <[email protected]>
arm64: tegra: Add EL2 virtual timer interrupt for Tegra194
Zihan Xi <[email protected]>
netfilter: nf_conntrack: defer invalid log until after unlock
Florian Westphal <[email protected]>
netfilter: conntrack: sctp: use nf log infrastructure for invalid packets
Hyunjung Ko <[email protected]>
net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
Xin Long <[email protected]>
openvswitch: move key and ovs_cb update out of handle_fragments
Xin Long <[email protected]>
net: sched: use skb_ip_totlen and iph_totlen
Xin Long <[email protected]>
openvswitch: use skb_ip_totlen in conntrack
Paolo Bonzini <[email protected]>
KVM: SVM: Serialize accesses to the owner and mirror list with separate lock
Sun Jian <[email protected]>
veth: fix skb length accounting after XDP frag adjustment
Stanislav Fomichev <[email protected]>
veth: Introduce veth_xdp_buff wrapper for xdp_buff
Lorenzo Stoakes (ARM) <[email protected]>
mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF
Pierre-Eric Pelloux-Prayer <[email protected]>
drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini
Tu Nguyen <[email protected]>
can: rcar_canfd: change the initializing flow for clocks and resets
Geert Uytterhoeven <[email protected]>
can: rcar_canfd: Extract rcar_canfd_global_{,de}init()
Biju Das <[email protected]>
can: rcar_canfd: Use devm_clk_get_optional() for RAM clk
Geert Uytterhoeven <[email protected]>
can: rcar_canfd: Invert reset assert order
Yang Wang <[email protected]>
drm/amd/pm: fix pptable use-after-free
Yang Wang <[email protected]>
drm/amd/pm: fix torn gpu metrics reads
Marc Kleine-Budde <[email protected]>
can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure
Jonas Gorski <[email protected]>
i2c: iproc: reset bus after timeout if START_BUSY is stuck
Wolfram Sang <[email protected]>
i2c: bcm-iproc: remove printout on handled timeouts
Christian Brauner <[email protected]>
binfmt_misc: restore write access when removing an entry
Amir Goldstein <[email protected]>
fs: don't block write during exec on pre-content watched files
Amir Goldstein <[email protected]>
fsnotify: opt-in for permission events at file open time
Dawei Feng <[email protected]>
ice: fix memory leak in ice_lbtest_prepare_rings()
Dawid Osuchowski <[email protected]>
ice: fix VF interrupts cleanup
Matt Fleming <[email protected]>
veth: convert frag_list skbs before running XDP
Chengfeng Ye <[email protected]>
net: pktgen: fix proc entry use-after-free
Peter Seiderer <[email protected]>
net: pktgen: fix code style (WARNING: Block comments)
David Carlier <[email protected]>
igc: remove napi_synchronize() in igc_down()
Namjae Jeon <[email protected]>
ksmbd: reject repeated SMB2 NEGOTIATE requests
Namjae Jeon <[email protected]>
ksmbd: conn lock to serialize smb2 negotiate
Chengfeng Ye <[email protected]>
Bluetooth: hci_sync: Fix advertising data UAFs
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_core: Fix not handling hdev->le_num_of_adv_sets=1
Gustavo A. R. Silva <[email protected]>
Bluetooth: hci_conn, hci_sync: Use __counted_by() to avoid -Wfamnae warnings
Kees Cook <[email protected]>
overflow: Change DEFINE_FLEX to take __counted_by member
Gregory Price <[email protected]>
mm/vmstat: fold stranded per-cpu node stats when a node comes online
Zihan Xi <[email protected]>
Bluetooth: mgmt: fix UAF in pair command cancellation
Luiz Augusto von Dentz <[email protected]>
Bluetooth: MGMT: Protect mgmt_pending list with its own lock
Dr. David Alan Gilbert <[email protected]>
Bluetooth: MGMT: Remove unused mgmt_pending_find_data
Luiz Augusto von Dentz <[email protected]>
Bluetooth: MGMT: Fix not generating command complete for MGMT_OP_DISCONNECT
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_sync: Introduce hci_cmd_sync_run/hci_cmd_sync_run_once
Michael Bommarito <[email protected]>
erofs: cap LZMA stream pool size
Jingbo Xu <[email protected]>
erofs: maintain cookies of share domain in self-contained list
Gao Xiang <[email protected]>
erofs: tidy up internal.h
Kefeng Wang <[email protected]>
mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE
David Hildenbrand <[email protected]>
mm/migrate_device: page_remove_rmap() -> folio_remove_rmap_pte()
Namjae Jeon <[email protected]>
ksmbd: validate minimum PDU size for transform requests
ChenXiaoSong <[email protected]>
smb/server: fix minimum SMB2 PDU size
ChenXiaoSong <[email protected]>
smb/server: fix minimum SMB1 PDU size
Namjae Jeon <[email protected]>
ksmbd: rename smb2_get_msg to smb_get_msg
ChenXiaoSong <[email protected]>
smb/server: rename include guard in smb_common.h
Christian Brauner <[email protected]>
super: fix emergency thaw deadlock on frozen block devices
Wentao Guan <[email protected]>
ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL
Haofeng Li <[email protected]>
ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl
Ferry Meng <[email protected]>
ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow
Aldo Ariel Panzardo <[email protected]>
net/sched: serialize qdisc_rtab_list against concurrent get/put
Shiming Cheng <[email protected]>
net: gro: fix double aggregation of flush-marked skbs
Felix Fietkau <[email protected]>
net: move skb_gro_receive_list from udp to core
Pavitra Jha <[email protected]>
libceph: fix two unsafe bare decodes in decode_lockers()
Chancel Liu <[email protected]>
ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP
Max Kellermann <[email protected]>
ceph: fix hanging __ceph_get_caps() with stale mds_wanted
Xiubo Li <[email protected]>
ceph: rename _to_client() to _to_fs_client()
Xiubo Li <[email protected]>
ceph: pass the mdsc to several helpers
Xiubo Li <[email protected]>
libceph: add doutc and *_client debug macros support
Xiang Mei <[email protected]>
libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
Andy Shevchenko <[email protected]>
libceph: Amend checking to fix make W=1 build breakage
Max Kellermann <[email protected]>
ceph: avoid fs reclaim while using current->journal_info
Zhiling Zou <[email protected]>
sctp: avoid auth_enable sysctl UAF during netns teardown
Geliang Tang <[email protected]>
mptcp: pm: userspace: fix use-after-free in get_local_id
Geliang Tang <[email protected]>
mptcp: pm: use addr entry for get_local_id
Geliang Tang <[email protected]>
mptcp: add mptcp_userspace_pm_lookup_addr helper
Geliang Tang <[email protected]>
mptcp: pm: avoid code duplication to lookup endp
Alexander Usyskin <[email protected]>
mei: bus: access mei_device under device_lock on cleanup
Kai Vehmanen <[email protected]>
ALSA: hda: codecs: hdmi: disable keep-alive before audio format change
LiangCheng Wang <[email protected]>
wifi: brcmfmac: set F2 blocksize to 256 for BCM43752
Gokul Sivakumar <[email protected]>
wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW)
Fan Wu <[email protected]>
wifi: brcmfmac: drain bus_reset work on device removal
Daniel Hodges <[email protected]>
wifi: ath6kl: fix use-after-free in aggr_reset_state()
Sakari Ailus <[email protected]>
media: imx219: Fix maximum frame length in lines
Jai Luthra <[email protected]>
media: i2c: imx219: Rename VTS to FRM_LENGTH
David Plowman <[email protected]>
media: i2c: imx219: Correct the minimum vblanking value
Laurent Pinchart <[email protected]>
media: i2c: imx219: Drop IMX219_VTS_* macros
Jani Nikula <[email protected]>
drm/i915/hdcp: check streams[] bounds before overflow
Jani Nikula <[email protected]>
drm/i915/hdcp: require monotonically increasing seq_num_v
Suraj Kandpal <[email protected]>
drm/i915/hdcp: Move to using intel_display in intel_hdcp
Jani Nikula <[email protected]>
drm/i915/vrr: require valid min/max vfreq for VRR
Ville Syrjälä <[email protected]>
drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable()
Timur Kristóf <[email protected]>
drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions
Thomas Zimmermann <[email protected]>
drm/tegra: fbdev: Remove offset into framebuffer memory
Jani Nikula <[email protected]>
drm/displayid: fix Tiled Display Topology ID size
Andrei Kuchynski <[email protected]>
usb: typec: ucsi: Fix race condition and ordering in port unregistration
Sergey Senozhatsky <[email protected]>
usb: typec: ucsi: split connector lock classes
Diogo Ivo <[email protected]>
usb: typec: ucsi: Only enable supported notifications
Cen Zhang <[email protected]>
usb: gadget: f_tcm: synchronize delayed set_alt with teardown
Vitor Soares <[email protected]>
drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS()
Guangshuo Li <[email protected]>
usb: musb: omap2430: Do not put borrowed of_node in probe
Johan Hovold <[email protected]>
usb: musb: omap2430: clean up probe error handling
Venkatesh Srinivas <[email protected]>
KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN
David Matlack <[email protected]>
KVM: Introduce vcpu->wants_to_run
Alex Williamson <[email protected]>
vfio/pci: Fix racy bitfields and tighten struct layout
Luiz Augusto von Dentz <[email protected]>
Bluetooth: HCI: Remove HCI_AMP support
Christophe JAILLET <[email protected]>
Bluetooth: Remove usage of the deprecated ida_simple_xx() API
Reinette Chatre <[email protected]>
fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list
Peng Fan <[email protected]>
pmdomain: imx: Fix i.MX8MP power notifier
Bryam Vargas <[email protected]>
ata: libata-core: Reject an invalid concurrent positioning ranges count
Dawei Feng <[email protected]>
octeontx2-pf: fix SQB pointer leak on init failure
Haoxiang Li <[email protected]>
net: ipa: fix SMEM state handle leaks in SMP2P init
Crystal Wood <[email protected]>
tracing/osnoise: Call synchronize_rcu() when unregistering
Uladzislau Rezki (Sony) <[email protected]>
tracing: Rename kvfree_rcu() to kvfree_rcu_mightsleep()
Théo Lebrun <[email protected]>
net: macb: drop in-flight Tx SKBs on close
Wentao Liang <[email protected]>
ipmi: fix refcount leak in i_ipmi_request()
Breno Leitao <[email protected]>
bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()
Breno Leitao <[email protected]>
bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c
Rasmus Villemoes <[email protected]>
bootconfig: do not put quotes on cmdline items unless necessary
Sabrina Dubroca <[email protected]>
espintcp: use sk_msg_free_partial to fix partial send
David Howells <[email protected]>
tcp_bpf, smc, tls, espintcp, siw: Reduce MSG_SENDPAGE_NOTLAST usage
David Howells <[email protected]>
siw: Inline do_tcp_sendpages()
David Howells <[email protected]>
espintcp: Inline do_tcp_sendpages()
David Howells <[email protected]>
tcp_bpf: Inline do_tcp_sendpages as it's now a wrapper around tcp_sendmsg
Bryam Vargas <[email protected]>
net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked
Vladimir Oltean <[email protected]>
net/sched: taprio: avoid calling child->ops->dequeue(child) twice
Junrui Luo <[email protected]>
octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF
Sergio Paracuellos <[email protected]>
gpio: mt7621: avoid corruption of shared interrupt trigger state
Runyu Xiao <[email protected]>
gpio: tegra: do not call pinctrl for GPIO direction
Bartosz Golaszewski <[email protected]>
treewide: rename pinctrl_gpio_direction_input_new()
Maoyi Xie <[email protected]>
net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink
Zihan Xi <[email protected]>
net/sched: act_ct: preserve tc_skb_cb across defragmentation
Dexuan Cui <[email protected]>
net: mana: Validate the packet length reported by the NIC
Thomas Gleixner <[email protected]>
locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()
Guangshuo Li <[email protected]>
mmc: vub300: fix use-after-free on probe failure
Johan Hovold <[email protected]>
mmc: vub300: rename probe error labels
Johan Hovold <[email protected]>
mmc: vub300: fix use-after-free on disconnect
Maoyi Xie <[email protected]>
wifi: libertas_tf: fix use-after-free in lbtf_free_adapter()
Dmitry Torokhov <[email protected]>
Input: ims-pcu - fix firmware leak in async update
Dmitry Torokhov <[email protected]>
firmware_loader: introduce __free() cleanup hanler
Mikulas Patocka <[email protected]>
dm-verity: make error counter atomic
Mikulas Patocka <[email protected]>
dm-integrity: don't increment hash_offset twice
Heinz Mauelshagen <[email protected]>
dm: remove unnecessary braces from single statement blocks
Heinz Mauelshagen <[email protected]>
dm: add missing empty lines
Heinz Mauelshagen <[email protected]>
dm crypt: correct 'foo*' to 'foo *'
Heinz Mauelshagen <[email protected]>
dm: fix trailing statements
Mikulas Patocka <[email protected]>
dm-verity: avoid double increment of &use_bh_wq_enabled
Souvik Banerjee <[email protected]>
ovl: use linked upper dentry in copy-up tmpfile
Jann Horn <[email protected]>
bpf,fork: wipe ->bpf_storage before bailouts that access it
Vincent Jardin <[email protected]>
i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)
Stefan Eichenberger <[email protected]>
i2c: imx: separate atomic, dma and non-dma use case
Michael Bommarito <[email protected]>
thunderbolt: Prevent XDomain delayed work use-after-free on disconnect
Yiyang Chen <[email protected]>
taskstats: retain dead thread stats in TGID queries
Oleg Nesterov <[email protected]>
taskstats: fill_stats_for_tgid: use for_each_thread()
Maoyi Xie <[email protected]>
net: thunderbolt: Fix frags[] overflow by bounding frame_count
Florian Fuchs <[email protected]>
mtd: maps: vmu-flash: fix fault in unaligned fixup
Breno Leitao <[email protected]>
9p: skip nlink update in cacheless mode to fix WARN_ON
Muchun Song <[email protected]>
mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE
Aneesh Kumar K.V <[email protected]>
mm/vmemmap/devdax: fix kernel crash when probing devdax devices
Mike Rapoport (IBM) <[email protected]>
mm: move most of core MM initialization to mm/mm_init.c
Michael Bommarito <[email protected]>
ntfs3: validate split-point offset in indx_insert_into_buffer
Konstantin Komarov <[email protected]>
fs/ntfs3: Undo critial modificatins to keep directory consistency
Fernando Fernandez Mancera <[email protected]>
netfilter: nft_objref: validate objref and objrefmap expressions
Yue Haibing <[email protected]>
netfilter: nf_tables: Remove unused nft_reduce_is_readonly()
Jeremy Sowden <[email protected]>
netfilter: bitwise: rename some boolean operation functions
Florian Westphal <[email protected]>
netfilter: nf_tables: drop unused 3rd argument from validate callback ops
Florian Westphal <[email protected]>
netfilter: nf_tables: pass context structure to nft_parse_register_load
Wasim Nazir <[email protected]>
remoteproc: qcom: Fix leak when custom dump_segments addition fails
Yogesh Lal <[email protected]>
remoteproc: qcom: pas: Adjust the phys addr wrt the mem region
Mukesh Ojha <[email protected]>
remoteproc: qcom: fix sparse warnings
Mukesh Ojha <[email protected]>
remoteproc: qcom: replace kstrdup with kstrndup
Tristan Madani <[email protected]>
selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()
Casey Schaufler <[email protected]>
lsm: infrastructure management of the sock security
Pablo Neira Ayuso <[email protected]>
netfilter: nf_conntrack_sip: validate skb_dst() before accessing it
Florian Westphal <[email protected]>
netfilter: nf_conntrack_sip: remove net variable shadowing
Florian Westphal <[email protected]>
netfilter: nft_set_pipapo: don't leak bad clone into future transaction
Florian Westphal <[email protected]>
netfilter: nft_set_pipapo: move cloning of match info to insert/removal path
Florian Westphal <[email protected]>
netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone
Florian Westphal <[email protected]>
netfilter: nft_set_pipapo: merge deactivate helper into caller
Florian Westphal <[email protected]>
netfilter: nft_set_pipapo: prepare walk function for on-demand clone
Florian Westphal <[email protected]>
netfilter: nft_set_pipapo: make pipapo_clone helper return NULL
Florian Westphal <[email protected]>
netfilter: nft_set_pipapo: move prove_locking helper around
Florian Westphal <[email protected]>
netfilter: nft_set_pipapo: use GFP_KERNEL for insertions
Sumanth Korikkar <[email protected]>
s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init()
Thomas Richter <[email protected]>
s390/cpum_cf: merge source files for CPU Measurement counter facility
Thomas Richter <[email protected]>
s390/cpum_cf: remove in-kernel counting facility interface
Thomas Richter <[email protected]>
s390/cpum_cf: move stccm_avail()
Thomas Richter <[email protected]>
s390/cpum_cf: move cpum_cf_ctrset_size()
Cássio Gabriel <[email protected]>
ASoC: mediatek: mt8192: Check runtime resume during probe
Tang Bin <[email protected]>
ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable
AngeloGioacchino Del Regno <[email protected]>
ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb
AngeloGioacchino Del Regno <[email protected]>
ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe()
AngeloGioacchino Del Regno <[email protected]>
ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable()
Peter Ujfalusi <[email protected]>
ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get
Cássio Gabriel <[email protected]>
ASoC: mediatek: mt8183: Check runtime resume during probe
Runyu Xiao <[email protected]>
octeontx2-vf: clear stale mailbox IRQ state before request_irq()
Runyu Xiao <[email protected]>
octeontx2-pf: clear stale mailbox IRQ state before request_irq()
Subbaraya Sundeep <[email protected]>
octeontx2: Annotate mmio regions as __iomem
Wentao Liang <[email protected]>
mlxsw: fix refcount leak in mlxsw_sp_port_lag_join()
Petr Machata <[email protected]>
mlxsw: spectrum: On port enslavement to a LAG, join upper's bridges
Jason Wang <[email protected]>
VDUSE: avoid leaking information to userspace
Eugenio Pérez <[email protected]>
vduse: take out allocations from vduse_dev_alloc_coherent
Eugenio Pérez <[email protected]>
vduse: remove unused vaddr parameter of vduse_domain_free_coherent
Sheng Zhao <[email protected]>
vduse: Use fixed 4KB bounce pages for non-4KB page size
Li Xiasong <[email protected]>
tipc: restrict socket queue dumps in enqueue tracepoints
Jiacheng Yu <[email protected]>
fbcon: Use correct type for vc_resize() return value
Thomas Zimmermann <[email protected]>
fbcon: Rename struct fbcon_ops to struct fbcon_par
Li Daming <[email protected]>
rxrpc: serialize kernel accept preallocation with socket teardown
Tapio Reijonen <[email protected]>
serial: max310x: implement gpio_chip::get_direction()
Hugo Villeneuve <[email protected]>
serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch)
Xu Rao <[email protected]>
ALSA: hda: Fix cached processing coefficient verbs
Zhang Heng <[email protected]>
ALSA: hda: conexant: Remove mic bias threshold override
Ricardo Robaina <[email protected]>
audit: fix recursive locking deadlock in audit_dupe_exe()
Ricardo Robaina <[email protected]>
audit: use 'unsigned int' instead of 'unsigned'
Jeff Layton <[email protected]>
audit: widen ino fields to u64
NeilBrown <[email protected]>
VFS/audit: introduce kern_path_parent() for audit
Bryam Vargas <[email protected]>
Input: mms114 - reject an oversized device packet size
Dmitry Torokhov <[email protected]>
Input: mms114 - fix touch indexing for MMS134S and MMS136
Haoxiang Li <[email protected]>
i2c: davinci: Unregister cpufreq notifier on probe failure
Sebastian Alba Vives <[email protected]>
fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()
Mikhail Gavrilov <[email protected]>
dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning
Jason Gunthorpe <[email protected]>
udmabuf: Do not create malformed scatterlists
Weinan Liu <[email protected]>
iommu/amd: Don't split flush for amd_iommu_domain_flush_all()
Matt Bobrowski <[email protected]>
bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
Pedro Falcato <[email protected]>
mm: do file ownership checks with the proper mount idmap
Alexandre Ghiti <[email protected]>
riscv: Don't use PGD entries for the linear mapping
Xiang Mei <[email protected]>
net: bonding: fix use-after-free in bond_xmit_broadcast()
Palmer Dabbelt <[email protected]>
RISC-V: Provide pgtable_l5_enabled on rv32
Christoph Hellwig <[email protected]>
xfs: check v5 superblock features early
Long Li <[email protected]>
xfs: don't swallow dquot recovery verification errors
Long Li <[email protected]>
xfs: fix ilock leak on error in xfs_dq_get_next_id
David Rosca <[email protected]>
drm/amdgpu: Fix UVD decode image min size calculation
David Rosca <[email protected]>
drm/amdgpu: Implement insert_end for VCE 3
David Rosca <[email protected]>
drm/amdgpu: Reject UVD message with dimensions above 4096
Candice Li <[email protected]>
drm/amdgpu: validate GEM_CREATE domain combinations
David Rosca <[email protected]>
drm/amdgpu: Reject UVD message with invalid number of h265 refs
Eric Farman <[email protected]>
s390/vfio_ccw: Fix out of bounds check on CCW array
Eric Farman <[email protected]>
s390/vfio_ccw: Ensure index for read/write regions are within range
Guangshuo Li <[email protected]>
drm/radeon: fix autosuspend cleanup during teardown
Pei Xiao <[email protected]>
mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition
Haibo Chen <[email protected]>
mmc: sdhci: make tuning_err a signed int
Myeonghun Pak <[email protected]>
mmc: sdhci: unmap the bounce buffer before device release
Zhan Xusheng <[email protected]>
mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit
Kefu Chai <[email protected]>
libceph: tolerate addrvecs with multiple entries of the same type
Yiming Zhu <[email protected]>
ceph: fix MDS random selection readiness predicate
Raphael Zimmer <[email protected]>
libceph: Avoid using invalid osd indices from primary_temp
Dmitry Torokhov <[email protected]>
Input: sur40 - fix V4L error path cleanup
Dmitry Torokhov <[email protected]>
Input: sur40 - fix input device registration ordering
Ali Ahmet Memis <[email protected]>
openrisc: signal: do not restore privileged SR bits on sigreturn
Josh Poimboeuf <[email protected]>
ftrace: Fix off-by-one fentry site disable in ftrace_free_mem()
Pavitra Jha <[email protected]>
libceph: fix multiple unsafe decodes in decode_locker()
Thorsten Blum <[email protected]>
crypto: qce - fix error path in devm_qce_register_algs
Dmitry Torokhov <[email protected]>
Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
Dmitry Torokhov <[email protected]>
Input: synaptics-rmi4 - block s_input when F54 queue is busy
Bryam Vargas <[email protected]>
Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer
Dmitry Torokhov <[email protected]>
Input: synaptics-rmi4 - zero report size on F54 work error
George Wilson <[email protected]>
powerpc/pseries: lparcfg - fix kbuf[] underflow
Pengpeng Hou <[email protected]>
Input: iforce - validate input packet lengths
Zhefu Zhang <[email protected]>
Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard
Linmao Li <[email protected]>
Input: psxpad-spi - set driver data before use
Richard Davies <[email protected]>
Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
Dmitry Torokhov <[email protected]>
Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
George Wilson <[email protected]>
powerpc/pseries: pci - logic bug
Dawid Wróbel <[email protected]>
ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses
Peter Ujfalusi <[email protected]>
ASoC: cs35l41: sort the register default table
Peter Ujfalusi <[email protected]>
ASoC: cs4265: sort the register default table
Hidayath Khan <[email protected]>
s390/qeth: validate user buffer length in SNMP and ARP query ioctls
Matthieu Baerts (NGI0) <[email protected]>
mptcp: options: reset DSS fields in case of unexpected size
Gang Yan <[email protected]>
selftests: mptcp: join: mark tests with data corruption as failed
Bryam Vargas <[email protected]>
selinux: do not cancel a policy conversion that never started
Bryam Vargas <[email protected]>
selinux: reject a class permission count below its inherited common
Bryam Vargas <[email protected]>
selinux: require every boolean value to be defined
Yizhou Zhao <[email protected]>
ipvs: separate destination availability state
Zhan Xusheng <[email protected]>
fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()
Chao Yu <[email protected]>
f2fs: fix UAF issue in f2fs_merge_page_bio()
Matthew Rosato <[email protected]>
KVM: s390: pci: Fix aisb calculation
Farhan Ali <[email protected]>
KVM: s390: pci: Fix resource leak on IRQ registration failure
Farhan Ali <[email protected]>
KVM: s390: pci: Fix missing error codes and memory unaccounting
Farhan Ali <[email protected]>
KVM: s390: pci: Fix memory accounting for pinned/unpinned pages
Jason Gunthorpe <[email protected]>
kernel/user: Allow user_struct::locked_vm to be usable for iommufd
Chao Shi <[email protected]>
block: stop the timeout timer when releasing a never added disk
-------------
Diffstat:
Makefile | 4 +- arch/arm64/boot/dts/nvidia/tegra194.dtsi | 2 + arch/arm64/kvm/arm.c | 2 +- arch/mips/kvm/mips.c | 2 +- arch/openrisc/include/asm/processor.h | 2 + arch/openrisc/kernel/signal.c | 5 +- arch/powerpc/kvm/powerpc.c | 2 +- arch/powerpc/platforms/pseries/lparcfg.c | 2 +- arch/powerpc/platforms/pseries/pci.c | 2 +- arch/riscv/include/asm/pgtable-32.h | 3 + arch/riscv/include/asm/pgtable.h | 1 - arch/riscv/kvm/vcpu.c | 2 +- arch/riscv/mm/init.c | 11 +- arch/s390/include/asm/cpu_mcf.h | 112 ------ arch/s390/kernel/Makefile | 2 +- arch/s390/kernel/perf_cpum_cf.c | 272 ++++++++++++- arch/s390/kernel/perf_cpum_cf_common.c | 233 ------------ arch/s390/kernel/perf_pai_ext.c | 2 +- arch/s390/kvm/kvm-s390.c | 2 +- arch/s390/kvm/pci.c | 86 +++-- arch/s390/kvm/pci.h | 2 + arch/x86/kernel/cpu/resctrl/rdtgroup.c | 12 +- arch/x86/kvm/lapic.c | 2 +- arch/x86/kvm/svm/sev.c | 34 +- arch/x86/kvm/svm/svm.h | 1 + arch/x86/kvm/x86.c | 4 +- block/genhd.c | 12 +- crypto/ccm.c | 2 +- drivers/ata/libata-core.c | 18 + drivers/ata/libata-scsi.c | 2 - drivers/ata/libata.h | 9 + drivers/bluetooth/btmrvl_main.c | 9 - drivers/bluetooth/btrsi.c | 1 - drivers/bluetooth/btsdio.c | 8 - drivers/bluetooth/btusb.c | 5 - drivers/bluetooth/hci_ldisc.c | 6 - drivers/bluetooth/hci_serdev.c | 5 - drivers/bluetooth/hci_uart.h | 1 - drivers/bluetooth/hci_vhci.c | 10 +- drivers/bluetooth/virtio_bt.c | 2 - drivers/char/ipmi/ipmi_msghandler.c | 8 + drivers/crypto/qce/core.c | 2 +- drivers/dma-buf/udmabuf.c | 21 +- drivers/fpga/dfl-afu-main.c | 3 + drivers/gpio/gpio-mt7621.c | 2 + drivers/gpio/gpio-mvebu.c | 4 +- drivers/gpio/gpio-pxa.c | 4 +- drivers/gpio/gpio-tegra.c | 18 +- drivers/gpio/gpio-vf610.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 30 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 21 ++ drivers/gpu/drm/amd/amdgpu/amdgpu_gtt_mgr.c | 30 +- drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 11 +- drivers/gpu/drm/amd/amdgpu/vce_v3_0.c | 26 +- drivers/gpu/drm/amd/pm/amdgpu_dpm.c | 27 +- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 16 +- drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h | 6 +- drivers/gpu/drm/bridge/cdns-dsi.c | 11 +- drivers/gpu/drm/drm_connector.c | 12 +- drivers/gpu/drm/i915/display/intel_display_core.h | 3 + drivers/gpu/drm/i915/display/intel_hdcp.c | 22 +- drivers/gpu/drm/i915/display/intel_vrr.c | 10 +- drivers/gpu/drm/i915/i915_driver.c | 3 + drivers/gpu/drm/radeon/radeon_kms.c | 1 + drivers/gpu/drm/tegra/fb.c | 8 +- drivers/i2c/busses/i2c-bcm-iproc.c | 11 +- drivers/i2c/busses/i2c-davinci.c | 4 +- drivers/i2c/busses/i2c-imx.c | 126 +++++-- drivers/infiniband/sw/siw/siw_qp_tx.c | 17 +- drivers/input/joystick/iforce/iforce-packets.c | 11 +- drivers/input/joystick/iforce/iforce-usb.c | 3 + drivers/input/joystick/psxpad-spi.c | 1 + drivers/input/keyboard/atkbd.c | 8 + drivers/input/misc/ims-pcu.c | 5 +- drivers/input/mouse/focaltech.c | 2 +- drivers/input/rmi4/rmi_f54.c | 43 ++- drivers/input/rmi4/rmi_f55.c | 4 +- drivers/input/touchscreen/mms114.c | 21 +- drivers/input/touchscreen/sur40.c | 23 +- drivers/iommu/amd/iommu.c | 3 +- drivers/md/dm-bufio.c | 9 + drivers/md/dm-cache-metadata.c | 6 + drivers/md/dm-cache-policy-internal.h | 3 + drivers/md/dm-cache-policy-smq.c | 2 + drivers/md/dm-cache-target.c | 12 +- drivers/md/dm-crypt.c | 20 +- drivers/md/dm-era-target.c | 10 +- drivers/md/dm-flakey.c | 4 +- drivers/md/dm-integrity.c | 182 +++++---- drivers/md/dm-io.c | 25 +- drivers/md/dm-ioctl.c | 18 +- drivers/md/dm-kcopyd.c | 2 + drivers/md/dm-log.c | 6 + drivers/md/dm-mpath.c | 3 + drivers/md/dm-rq.c | 2 + drivers/md/dm-snap-persistent.c | 23 +- drivers/md/dm-snap.c | 10 +- drivers/md/dm-stats.c | 24 +- drivers/md/dm-stripe.c | 10 +- drivers/md/dm-sysfs.c | 1 + drivers/md/dm-table.c | 3 +- drivers/md/dm-thin-metadata.c | 5 +- drivers/md/dm-thin.c | 5 + drivers/md/dm-verity-target.c | 24 +- drivers/md/dm-verity.h | 2 +- drivers/md/dm-writecache.c | 54 ++- drivers/md/persistent-data/dm-array.c | 4 + drivers/md/persistent-data/dm-bitset.c | 1 + drivers/md/persistent-data/dm-block-manager.c | 7 +- drivers/md/persistent-data/dm-btree-internal.h | 1 + drivers/md/persistent-data/dm-btree-remove.c | 5 + drivers/md/persistent-data/dm-btree-spine.c | 6 +- drivers/md/persistent-data/dm-btree.c | 10 + drivers/md/persistent-data/dm-space-map-common.c | 6 + drivers/md/persistent-data/dm-space-map-disk.c | 12 +- drivers/md/persistent-data/dm-space-map-metadata.c | 3 + .../md/persistent-data/dm-transaction-manager.c | 1 + drivers/media/i2c/imx219.c | 47 +-- drivers/misc/mei/bus.c | 16 +- drivers/mmc/host/atmel-mci.c | 2 + drivers/mmc/host/omap_hsmmc.c | 2 +- drivers/mmc/host/sdhci.c | 16 + drivers/mmc/host/sdhci.h | 2 +- drivers/mmc/host/vub300.c | 36 +- drivers/mtd/maps/vmu-flash.c | 8 +- drivers/net/bonding/bond_main.c | 2 +- drivers/net/can/rcar/rcar_canfd.c | 177 +++++---- drivers/net/can/usb/gs_usb.c | 4 +- drivers/net/ethernet/cadence/macb_main.c | 22 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 10 +- drivers/net/ethernet/intel/ice/ice_vf_lib.c | 27 ++ .../net/ethernet/intel/ice/ice_vf_lib_private.h | 1 + drivers/net/ethernet/intel/ice/ice_virtchnl.c | 21 ++ drivers/net/ethernet/intel/igc/igc_main.c | 1 - drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 14 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 + .../net/ethernet/marvell/octeontx2/af/rvu_cn10k.c | 9 + .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 14 +- .../net/ethernet/marvell/octeontx2/nic/otx2_vf.c | 13 +- drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 92 ++++- drivers/net/ethernet/microsoft/mana/mana_en.c | 13 + drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 + drivers/net/ipa/ipa_smp2p.c | 30 +- drivers/net/ipvlan/ipvlan_main.c | 4 + drivers/net/macvlan.c | 4 + drivers/net/thunderbolt.c | 8 +- drivers/net/veth.c | 78 ++-- drivers/net/wireless/ath/ath6kl/txrx.c | 2 +- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 16 +- .../net/wireless/broadcom/brcm80211/brcmfmac/bus.h | 6 + .../wireless/broadcom/brcm80211/brcmfmac/core.c | 45 ++- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 6 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 8 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.h | 1 + .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 3 + drivers/net/wireless/marvell/libertas_tf/main.c | 2 +- drivers/pinctrl/cirrus/pinctrl-lochnagar.c | 2 +- drivers/pinctrl/core.c | 15 +- drivers/pinctrl/intel/pinctrl-cherryview.c | 4 +- drivers/pinctrl/intel/pinctrl-intel.c | 4 +- drivers/pinctrl/intel/pinctrl-lynxpoint.c | 4 +- drivers/pinctrl/mediatek/pinctrl-moore.c | 4 +- drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 4 +- drivers/pinctrl/mediatek/pinctrl-paris.c | 4 +- drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c | 4 +- drivers/pinctrl/pinctrl-as3722.c | 4 +- drivers/pinctrl/pinctrl-axp209.c | 2 +- drivers/pinctrl/pinctrl-ingenic.c | 11 +- drivers/pinctrl/pinctrl-ocelot.c | 4 +- drivers/pinctrl/pinctrl-rk805.c | 4 +- drivers/pinctrl/pinctrl-st.c | 4 +- drivers/pinctrl/renesas/gpio.c | 4 +- drivers/pinctrl/stm32/pinctrl-stm32.c | 4 +- drivers/pinctrl/vt8500/pinctrl-wmt.c | 4 +- drivers/remoteproc/qcom_common.c | 31 +- drivers/remoteproc/qcom_common.h | 5 +- drivers/remoteproc/qcom_q6v5_pas.c | 20 +- drivers/s390/cio/vfio_ccw_async.c | 16 + drivers/s390/cio/vfio_ccw_chp.c | 15 + drivers/s390/cio/vfio_ccw_cp.c | 17 +- drivers/s390/cio/vfio_ccw_ops.c | 7 +- drivers/s390/net/qeth_core_main.c | 3 + drivers/s390/net/qeth_l3_main.c | 5 + drivers/soc/imx/imx8m-blk-ctrl.c | 27 +- drivers/thunderbolt/xdomain.c | 40 +- drivers/tty/serial/max310x.c | 20 +- drivers/usb/gadget/function/f_tcm.c | 192 ++++++++-- drivers/usb/gadget/function/tcm.h | 13 + drivers/usb/musb/omap2430.c | 25 +- drivers/usb/typec/ucsi/ucsi.c | 95 +++-- drivers/usb/typec/ucsi/ucsi.h | 1 + drivers/vdpa/vdpa_user/iova_domain.c | 161 +++++--- drivers/vdpa/vdpa_user/iova_domain.h | 13 +- drivers/vdpa/vdpa_user/vduse_dev.c | 16 +- drivers/video/fbdev/core/bitblit.c | 122 +++--- drivers/video/fbdev/core/fbcon.c | 420 ++++++++++----------- drivers/video/fbdev/core/fbcon.h | 6 +- drivers/video/fbdev/core/fbcon_ccw.c | 148 ++++---- drivers/video/fbdev/core/fbcon_cw.c | 148 ++++---- drivers/video/fbdev/core/fbcon_rotate.c | 44 +-- drivers/video/fbdev/core/fbcon_rotate.h | 6 +- drivers/video/fbdev/core/fbcon_ud.c | 164 ++++---- drivers/video/fbdev/core/softcursor.c | 18 +- drivers/video/fbdev/core/tileblit.c | 28 +- fs/9p/vfs_inode.c | 9 + fs/binfmt_elf.c | 4 +- fs/binfmt_elf_fdpic.c | 4 +- fs/binfmt_misc.c | 14 +- fs/ceph/addr.c | 20 +- fs/ceph/cache.c | 2 +- fs/ceph/caps.c | 70 ++-- fs/ceph/debugfs.c | 4 +- fs/ceph/dir.c | 24 +- fs/ceph/export.c | 10 +- fs/ceph/file.c | 35 +- fs/ceph/inode.c | 14 +- fs/ceph/ioctl.c | 8 +- fs/ceph/mds_client.c | 51 ++- fs/ceph/mds_client.h | 5 +- fs/ceph/mdsmap.c | 5 +- fs/ceph/snap.c | 18 +- fs/ceph/super.c | 22 +- fs/ceph/super.h | 13 +- fs/ceph/xattr.c | 12 +- fs/crypto/policy.c | 2 +- fs/erofs/Kconfig | 15 + fs/erofs/decompressor_lzma.c | 3 +- fs/erofs/fscache.c | 44 +-- fs/erofs/internal.h | 87 ++--- fs/exec.c | 6 +- fs/f2fs/data.c | 2 +- fs/namei.c | 43 +++ fs/ntfs3/index.c | 44 ++- fs/overlayfs/copy_up.c | 12 +- fs/smb/server/auth.c | 4 +- fs/smb/server/connection.c | 23 +- fs/smb/server/connection.h | 5 + fs/smb/server/oplock.c | 8 +- fs/smb/server/smb2pdu.c | 78 ++-- fs/smb/server/smb2pdu.h | 9 - fs/smb/server/smb_common.c | 43 ++- fs/smb/server/smb_common.h | 15 +- fs/smb/server/smbacl.c | 27 +- fs/super.c | 19 +- fs/xfs/libxfs/xfs_sb.c | 4 +- fs/xfs/xfs_dquot.c | 3 +- fs/xfs/xfs_dquot_item_recover.c | 2 +- include/drm/drm_connector.h | 6 +- include/drm/drm_displayid.h | 2 +- include/linux/audit.h | 6 +- include/linux/audit_arch.h | 12 +- include/linux/bootconfig.h | 3 + include/linux/bpf_lsm.h | 4 + include/linux/ceph/ceph_debug.h | 38 ++ include/linux/ceph/mdsmap.h | 5 +- include/linux/firmware.h | 3 + include/linux/fs.h | 33 ++ include/linux/kvm_host.h | 1 + include/linux/lsm_hooks.h | 1 + include/linux/mm.h | 12 + include/linux/mmc/sdio_ids.h | 2 +- include/linux/namei.h | 1 + include/linux/overflow.h | 68 ++++ include/linux/pinctrl/consumer.h | 13 +- include/linux/sched/user.h | 2 +- include/linux/thunderbolt.h | 3 + include/linux/vfio_pci_core.h | 13 +- include/net/bluetooth/hci.h | 114 ------ include/net/bluetooth/hci_core.h | 48 +-- include/net/bluetooth/hci_sync.h | 4 + include/net/gro.h | 1 + include/net/ip_vs.h | 7 + include/net/netfilter/nf_tables.h | 11 +- include/net/netfilter/nft_fib.h | 4 +- include/net/netfilter/nft_meta.h | 3 +- include/net/netfilter/nft_reject.h | 3 +- include/uapi/linux/ip_vs.h | 6 - include/uapi/linux/netfilter/nf_tables.h | 10 +- include/uapi/linux/virtio_bt.h | 1 - init/main.c | 39 -- kernel/audit.c | 2 +- kernel/audit.h | 32 +- kernel/audit_fsnotify.c | 39 +- kernel/audit_tree.c | 2 +- kernel/audit_watch.c | 42 ++- kernel/auditfilter.c | 17 +- kernel/auditsc.c | 6 +- kernel/bpf/bpf_inode_storage.c | 9 + kernel/fork.c | 20 +- kernel/locking/spinlock_rt.c | 27 +- kernel/taskstats.c | 67 ++-- kernel/trace/ftrace.c | 6 +- kernel/trace/trace_osnoise.c | 4 +- kernel/trace/trace_probe.c | 2 +- kernel/user.c | 1 + lib/bootconfig.c | 65 ++++ lib/compat_audit.c | 12 +- mm/huge_memory.c | 49 ++- mm/internal.h | 4 + mm/madvise.c | 3 +- mm/migrate_device.c | 42 ++- mm/mincore.c | 3 +- mm/mm_init.c | 150 ++++++++ mm/page_alloc.c | 160 +------- mm/pagewalk.c | 10 + mm/sparse-vmemmap.c | 3 +- mm/vmalloc.c | 75 +++- net/bluetooth/hci_conn.c | 24 +- net/bluetooth/hci_core.c | 145 ++----- net/bluetooth/hci_event.c | 150 +------- net/bluetooth/hci_sock.c | 11 +- net/bluetooth/hci_sync.c | 373 +++++++++--------- net/bluetooth/l2cap_core.c | 21 +- net/bluetooth/mgmt.c | 367 +++++++++--------- net/bluetooth/mgmt_util.c | 49 +-- net/bluetooth/mgmt_util.h | 8 +- net/bridge/netfilter/nft_reject_bridge.c | 3 +- net/ceph/cls_lock_client.c | 21 +- net/ceph/decode.c | 18 +- net/ceph/osdmap.c | 9 +- net/core/gro.c | 31 ++ net/core/pktgen.c | 43 ++- net/ipv4/netfilter/nft_dup_ipv4.c | 4 +- net/ipv4/tcp_bpf.c | 21 +- net/ipv4/udp_offload.c | 29 -- net/ipv6/ip6_tunnel.c | 3 + net/ipv6/netfilter/nft_dup_ipv6.c | 4 +- net/mptcp/options.c | 8 +- net/mptcp/pm.c | 9 +- net/mptcp/pm_netlink.c | 29 +- net/mptcp/pm_userspace.c | 87 +++-- net/mptcp/protocol.h | 6 +- net/netfilter/ipset/ip_set_bitmap_gen.h | 2 +- net/netfilter/ipset/ip_set_core.c | 19 +- net/netfilter/ipset/ip_set_list_set.c | 10 +- net/netfilter/ipvs/ip_vs_conn.c | 4 +- net/netfilter/ipvs/ip_vs_core.c | 6 +- net/netfilter/ipvs/ip_vs_ctl.c | 4 +- net/netfilter/ipvs/ip_vs_dh.c | 4 +- net/netfilter/ipvs/ip_vs_lblc.c | 2 +- net/netfilter/ipvs/ip_vs_lblcr.c | 8 +- net/netfilter/nf_conntrack_proto.c | 6 + net/netfilter/nf_conntrack_proto_sctp.c | 48 +-- net/netfilter/nf_conntrack_proto_tcp.c | 132 ++++--- net/netfilter/nf_conntrack_sip.c | 10 +- net/netfilter/nf_flow_table_core.c | 7 +- net/netfilter/nf_tables_api.c | 6 +- net/netfilter/nf_tables_offload.c | 2 +- net/netfilter/nft_bitwise.c | 38 +- net/netfilter/nft_byteorder.c | 2 +- net/netfilter/nft_cmp.c | 6 +- net/netfilter/nft_compat.c | 6 +- net/netfilter/nft_ct.c | 2 +- net/netfilter/nft_dup_netdev.c | 2 +- net/netfilter/nft_dynset.c | 4 +- net/netfilter/nft_exthdr.c | 2 +- net/netfilter/nft_fib.c | 3 +- net/netfilter/nft_flow_offload.c | 3 +- net/netfilter/nft_fwd_netdev.c | 9 +- net/netfilter/nft_hash.c | 2 +- net/netfilter/nft_immediate.c | 3 +- net/netfilter/nft_lookup.c | 5 +- net/netfilter/nft_masq.c | 7 +- net/netfilter/nft_meta.c | 8 +- net/netfilter/nft_nat.c | 11 +- net/netfilter/nft_objref.c | 41 +- net/netfilter/nft_osf.c | 3 +- net/netfilter/nft_payload.c | 2 +- net/netfilter/nft_queue.c | 5 +- net/netfilter/nft_range.c | 2 +- net/netfilter/nft_redir.c | 7 +- net/netfilter/nft_reject.c | 3 +- net/netfilter/nft_reject_inet.c | 3 +- net/netfilter/nft_reject_netdev.c | 3 +- net/netfilter/nft_rt.c | 3 +- net/netfilter/nft_set_pipapo.c | 259 ++++++++----- net/netfilter/nft_set_pipapo.h | 8 + net/netfilter/nft_socket.c | 3 +- net/netfilter/nft_synproxy.c | 3 +- net/netfilter/nft_tproxy.c | 7 +- net/netfilter/nft_xfrm.c | 3 +- net/openvswitch/conntrack.c | 39 +- net/packet/af_packet.c | 7 +- net/rxrpc/call_accept.c | 27 +- net/sched/act_ct.c | 41 +- net/sched/cls_u32.c | 3 + net/sched/sch_api.c | 24 +- net/sched/sch_cake.c | 2 +- net/sched/sch_taprio.c | 12 +- net/sctp/protocol.c | 20 +- net/sctp/sysctl.c | 9 +- net/smc/smc_tx.c | 6 +- net/tipc/socket.c | 6 +- net/tls/tls_device.c | 4 +- net/tls/tls_sw.c | 5 + net/x25/af_x25.c | 4 +- net/x25/x25_timer.c | 25 +- net/xfrm/espintcp.c | 42 +-- security/apparmor/include/net.h | 6 +- security/apparmor/lsm.c | 38 +- security/apparmor/net.c | 2 +- security/bpf/hooks.c | 3 + security/security.c | 47 ++- security/selinux/hooks.c | 95 +++-- security/selinux/include/objsec.h | 5 + security/selinux/netlabel.c | 23 +- security/selinux/ss/policydb.c | 31 ++ security/selinux/ss/services.c | 4 +- security/smack/smack.h | 5 + security/smack/smack_lsm.c | 70 ++-- security/smack/smack_netfilter.c | 4 +- sound/hda/hdac_regmap.c | 4 +- sound/pci/hda/patch_conexant.c | 3 - sound/pci/hda/patch_hdmi.c | 48 ++- sound/soc/codecs/cs35l41-lib.c | 2 +- sound/soc/codecs/cs4265.c | 4 +- sound/soc/codecs/lpass-wsa-macro.c | 8 +- sound/soc/fsl/fsl_sai.c | 29 +- sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 12 +- sound/soc/mediatek/mt8192/mt8192-afe-pcm.c | 118 +++--- sound/soc/sof/ipc3-control.c | 34 +- sound/soc/xilinx/xlnx_formatter_pcm.c | 10 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 4 +- virt/kvm/kvm_main.c | 3 + 424 files changed, 5764 insertions(+), 4185 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/303 block: stop the timeout timer when releasing a never added disk
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Shi <[email protected]>
[ Upstream commit 26cb8ebbfaf713c82e142d08828d4d765057633b ]
disk_release() undoes blk_mq_init_allocated_queue() for a disk whose probe failed before add_disk(), but it only calls blk_mq_exit_queue(). Nothing there stops q->timeout, and that timer rolls forward: it stays pending until it next expires, not until the last request completes. So if the driver issued any I/O before adding the disk, the request_queue is freed while still linked into a timer wheel bucket.
Commit 6f8191fdf41d ("block: simplify disk shutdown") dropped the blk_cleanup_queue() call that used to stop it. __del_gendisk() and blk_mq_destroy_queue() still do; only the probe failure path lost it.
nvme gets there because nvme_update_ns_info() submits Report Zones or FDP io-mgmt-recv on ns->queue before the disk is added, so a later failure - a concurrent reset setting NVME_CTRL_FROZEN, or device_add_disk() failing - lands in put_disk() with the timer armed:
BUG: KASAN: slab-use-after-free in detach_if_pending+0x30c/0x340 Write of size 8 at addr ffff888004d71310 by task kworker/u8:2/37 __timer_delete_sync+0x156/0x240 kernel/time/timer.c:1621 blk_sync_queue+0x22/0x40 block/blk-core.c:222 nvme_sync_queues+0x100/0x150 drivers/nvme/host/core.c:5362 nvme_reset_work+0x138/0x930 drivers/nvme/host/pci.c:3264 Allocated by task 34: __blk_mq_alloc_disk+0x33/0x100 block/blk-mq.c:4462 nvme_alloc_ns+0x290/0x3870 drivers/nvme/host/core.c:4146 Freed by task 0: blk_free_queue_rcu+0x3a/0x50 block/blk-core.c:254 rcu_core+0xc10/0x1730 kernel/rcu/tree.c:2857
The queue being synced there is ctrl->admin_q, only a victim sharing a timer wheel bucket with the freed queue's dangling entry; other runs tripped in enqueue_timer(), __run_timers() or blk_mq_timeout_work(). Failing nvme_alloc_ns() with a debug patch makes it deterministic: one leaked timer trips KASAN within seconds, while 1987 patched releases produced no splat.
Stop the timer and the queue work items before blk_mq_exit_queue(), like blk_mq_destroy_queue() does.
Found by FuzzNvme.
--- block/genhd.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
block/genhd.c +8 -4
@@ -1195,14 +1195,18 @@ static void disk_release(struct device *dev)/* * To undo the all initialization from blk_mq_init_allocated_queue in * case of a probe failure where add_disk is never called we have to -* call blk_mq_exit_queue here. We can't do this for the more common -* teardown case (yet) as the tagset can be gone by the time the disk -* is released once it was added. +* call blk_mq_exit_queue here, after stopping the timer and work items +* that I/O issued before add_disk may have left pending. We can't do +* this for the more common teardown case (yet) as the tagset can be +* gone by the time the disk is released once it was added. */ if (queue_is_mq (disk->queue) &&test_bit (GD_OWNS_QUEUE , &disk->state) && - !test_bit (GD_ADDED , &disk->state)) + !test_bit (GD_ADDED , &disk->state)) { +blk_sync_queue (disk->queue); +blk_mq_cancel_work_sync (disk->queue);blk_mq_exit_queue (disk->queue); + }blkcg_exit_disk (disk);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 2/303 kernel/user: Allow user_struct::locked_vm to be usable for iommufd
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <[email protected]>
[ Upstream commit ce5a23c835aa0f0a931b5bcde1e7811f951b0146 ]
Following the pattern of io_uring, perf, skb, and bpf, iommfd will use user->locked_vm for accounting pinned pages. Ensure the value is included in the struct and export free_uid() as iommufd is modular.
user->locked_vm is the good accounting to use for ulimit because it is per-user, and the security sandboxing of locked pages is not supposed to be per-process. Other places (vfio, vdpa and infiniband) have used mm->pinned_vm and/or mm->locked_vm for accounting pinned pages, but this is only per-process and inconsistent with the new FOLL_LONGTERM users in the kernel.
Concurrent work is underway to try to put this in a cgroup, so everything can be consistent and the kernel can provide a FOLL_LONGTERM limit that actually provides security.
--- include/linux/sched/user.h | 2 +- kernel/user.c | 1 + 2 files changed, 2 insertions(+), 1 deletion(-)
include/linux/sched/user.h +1 -1
@@ -25,7 +25,7 @@ struct user_struct {#if defined(CONFIG_PERF_EVENTS ) || defined(CONFIG_BPF_SYSCALL ) || \ defined(CONFIG_NET ) || defined(CONFIG_IO_URING ) || \ - defined(CONFIG_VFIO_PCI_ZDEV_KVM ) + defined(CONFIG_VFIO_PCI_ZDEV_KVM ) ||IS_ENABLED (CONFIG_IOMMUFD )atomic_long_t locked_vm;#endif #ifdef CONFIG_WATCH_QUEUE
kernel/user.c +1 -0
@@ -185,6 +185,7 @@ void free_uid(struct user_struct *up)if (refcount_dec_and_lock_irqsave (&up->__count, &uidhash_lock, &flags))free_user (up, flags); } +EXPORT_SYMBOL_GPL (free_uid);struct user_struct *alloc_uid (kuid_t uid) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 3/303 KVM: s390: pci: Fix memory accounting for pinned/unpinned pages
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Farhan Ali <[email protected]>
[ Upstream commit 36f6999ecde3976731a8bfc0b8e667da6f593069 ]
The account_mem() and unaccount_mem() functions call get_uid() which increments the reference count of struct user_struct on every invocation. But we don't decrement the count by calling free_uid(). It also accounted/unaccounted the pages against the current->mm. But its possible the unaccount_mem() can be called from a different process context than the one that originally pinned the pages.
Let's fix this by storing the pinning process user_struct and mm_struct when accounting for pinned pages, and subsequently free these resources when the pages are unpinned.
--- arch/s390/kvm/pci.c | 48 ++++++++++++++++++++++++++++++++------------- arch/s390/kvm/pci.h | 2 ++ 2 files changed, 36 insertions(+), 14 deletions(-)
arch/s390/kvm/pci.c +34 -14
@@ -191,34 +191,54 @@ static int kvm_zpci_clear_airq(struct zpci_dev *zdev)return cc ? -EIO :0 ; } -static inline void unaccount_mem (unsigned long nr_pages) +static inline void unaccount_mem (struct kvm_zdev *kzdev,unsigned long nr_pages) { -struct user_struct *user =get_uid (current_user ()); +struct user_struct *user = kzdev->user_account; +struct mm_struct *mm_account = kzdev->mm_account; -if (user) +if (user) {atomic_long_sub (nr_pages, &user->locked_vm); -if (current->mm) -atomic64_sub (nr_pages, ¤t->mm->pinned_vm); +free_uid (user); + kzdev->user_account =NULL ; + } + +if (mm_account) { +atomic64_sub (nr_pages, &mm_account->pinned_vm); +mmdrop (mm_account); + kzdev->mm_account =NULL ; + } } -static inline int account_mem (unsigned long nr_pages) +static inline int account_mem (struct kvm_zdev *kzdev,unsigned long nr_pages) {struct user_struct *user =get_uid (current_user ());unsigned long page_limit, cur_pages, new_pages; +int rc =0 ; page_limit =rlimit (RLIMIT_MEMLOCK ) >>PAGE_SHIFT ; + cur_pages =atomic_long_read (&user->locked_vm);do { - cur_pages =atomic_long_read (&user->locked_vm); new_pages = cur_pages + nr_pages; -if (new_pages > page_limit) -return -ENOMEM ; - }while (atomic_long_cmpxchg (&user->locked_vm, cur_pages, - new_pages) != cur_pages); +if (new_pages > page_limit) { + rc = -ENOMEM ; + goto out; + } + }while (!atomic_long_try_cmpxchg (&user->locked_vm, &cur_pages, new_pages)); + +if (current->mm) { +mmgrab (current->mm); +atomic64_add (nr_pages, ¤t->mm->pinned_vm); + } -atomic64_add (nr_pages, ¤t->mm->pinned_vm); + kzdev->user_account = user; + kzdev->mm_account = current->mm;return 0 ; + +out: +free_uid (user); +return rc; } static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib *fib,
@@ -295,7 +315,7 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib *fib, }/* Account for pinned pages, roll back on failure */ -if (account_mem (pcount)) +if (account_mem (zdev->kzdev, pcount)) goto unpin2;/* AISB must be allocated before we can fill in GAITE */
@@ -424,7 +444,7 @@ static int kvm_s390_pci_aif_disable(struct zpci_dev *zdev, bool force) pcount++; }if (pcount >0 ) -unaccount_mem (pcount); +unaccount_mem (kzdev, pcount); out:mutex_unlock (&aift->aift_lock);
arch/s390/kvm/pci.h +2 -0
@@ -22,6 +22,8 @@ struct kvm_zdev {struct kvm *kvm;struct zpci_fib fib;struct list_head entry; +struct user_struct *user_account; +struct mm_struct *mm_account; };struct zpci_gaite {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 4/303 KVM: s390: pci: Fix missing error codes and memory unaccounting
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Farhan Ali <[email protected]>
[ Upstream commit f86842e4d6c482300f4567f492d512c9ccf5bc4f ]
In kvm_s390_pci_aif_enable() two error paths failed to set an error code, causing the function to return 0 on failure. It also failed to rollback memory accounting on failure. Fix both by propagating an error code on failure and calling unaccount_mem() in the cleanup path.
--- arch/s390/kvm/pci.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
arch/s390/kvm/pci.c +7 -2
@@ -315,14 +315,17 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib *fib, }/* Account for pinned pages, roll back on failure */ -if (account_mem (zdev->kzdev, pcount)) + rc =account_mem (zdev->kzdev, pcount); +if (rc) goto unpin2;/* AISB must be allocated before we can fill in GAITE */ mutex_lock (&aift->aift_lock); bit =airq_iv_alloc_bit (aift->sbv); -if (bit ==-1UL ) +if (bit ==-1UL ) { + rc = -ENOMEM ; goto unlock; + } zdev->aisb = bit;/* store the summary bit number */ zdev->aibv = airq_iv_create(msi_vecs, AIRQ_IV_DATA | AIRQ_IV_BITLOCK |
@@ -374,6 +377,8 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib *fib,airq_iv_free_bit (aift->sbv, zdev->aisb); zdev->aisb =0 ; unlock: +if (pcount >0 ) +unaccount_mem (zdev->kzdev, pcount);mutex_unlock (&aift->aift_lock); unpin2:if (fib->fmt0.sum ==1 )
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 5/303 KVM: s390: pci: Fix resource leak on IRQ registration failure
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Farhan Ali <[email protected]>
[ Upstream commit 5580c9858f1e00f60191eb09c3add359836d60b6 ]
Currently if kvm_zpci_set_airq() fails, kvm_s390_pci_aif_enable() returns the error code but doesn't do any resource cleanup thus leaking resources. Fix this by cleaning up all the resources such as the GAITE, AIBV, AISB and unpinning any pinned pages. While at it, remove dead code that stored FIB values that were never referenced.
As part of the cleanup, we are also holding the aift_lock a bit longer, as we hold the lock while executing the MPCIFC instruction. Though this is not strictly necessary, it means we don't have to drop and re-acquire in the error case.
--- arch/s390/kvm/pci.c | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-)
arch/s390/kvm/pci.c +21 -8
@@ -359,19 +359,32 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib *fib, aift->kzdev[zdev->aisb] = zdev->kzdev;spin_unlock_irq (&aift->gait_lock); -/* Update guest FIB for re-issue */ - fib->fmt0.aisbo = zdev->aisb &63 ; - fib->fmt0.aisb =virt_to_phys (aift->sbv->vector + (zdev->aisb /64 ) *8 ); - fib->fmt0.isc = gisc; -/* Save some guest fib values in the host for later use */ - zdev->kzdev->fib.fmt0.isc = fib->fmt0.isc; + zdev->kzdev->fib.fmt0.isc = gisc; zdev->kzdev->fib.fmt0.aibv = fib->fmt0.aibv; -mutex_unlock (&aift->aift_lock);/* Issue the clp to setup the irq now */ rc =kvm_zpci_set_airq (zdev); -return rc; +if (!rc) { +mutex_unlock (&aift->aift_lock); +return rc; + } + +/* Start cleanup */ + zdev->kzdev->fib.fmt0.isc =0 ; + zdev->kzdev->fib.fmt0.aibv =0 ; + +spin_lock_irq (&aift->gait_lock); + gaite->count--; + gaite->aisb =0 ; + gaite->gisc =0 ; + gaite->aisbo =0 ; + gaite->gisa =0 ; + aift->kzdev[zdev->aisb] =NULL ; +spin_unlock_irq (&aift->gait_lock); + +airq_iv_release (zdev->aibv); + zdev->aibv =NULL ; free_aisb:airq_iv_free_bit (aift->sbv, zdev->aisb);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 6/303 KVM: s390: pci: Fix aisb calculation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Rosato <[email protected]>
[ Upstream commit 0cfe660559e857d7c00ab86c73e4510ce069086f ]
The current implementation of aisb calculation will erroneously index via an unsigned long * as well as multiply by 8B for every 64-bits in the offset; only one or the other is required. This throws off aisb calculations once the number of devices exceeds 64, and can result in out-of-bounds access as well as failure to indicate summary bits associated with those devices in guests.
Fix this by converting to a physical address before applying the offset, as is already done in arch/s390/pci/pci_irq.c.
--- arch/s390/kvm/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/kvm/pci.c +1 -1
@@ -167,7 +167,7 @@ static int kvm_zpci_set_airq(struct zpci_dev *zdev) fib.fmt0.noi =airq_iv_end (zdev->aibv); fib.fmt0.aibv =virt_to_phys (zdev->aibv->vector); fib.fmt0.aibvo =0 ; - fib.fmt0.aisb =virt_to_phys (aift->sbv->vector + (zdev->aisb /64 ) *8 ); + fib.fmt0.aisb =virt_to_phys (aift->sbv->vector) + (zdev->aisb /64 ) *8 ; fib.fmt0.aisbo = zdev->aisb &63 ; fib.gd = zdev->gisa;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 7/303 f2fs: fix UAF issue in f2fs_merge_page_bio()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
commit edf7e9040fc52c922db947f9c6c36f07377c52ea upstream.
As JY reported in bugzilla [1],
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 pc : [0xffffffe51d249484] f2fs_is_cp_guaranteed+0x70/0x98 lr : [0xffffffe51d24adbc] f2fs_merge_page_bio+0x520/0x6d4 CPU: 3 UID: 0 PID: 6790 Comm: kworker/u16:3 Tainted: P B W OE 6.12.30-android16-5-maybe-dirty-4k #1 5f7701c9cbf727d1eebe77c89bbbeb3371e895e5 Tainted: [P]=PROPRIETARY_MODULE, [B]=BAD_PAGE, [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Workqueue: writeback wb_workfn (flush-254:49) Call trace: f2fs_is_cp_guaranteed+0x70/0x98 f2fs_inplace_write_data+0x174/0x2f4 f2fs_do_write_data_page+0x214/0x81c f2fs_write_single_data_page+0x28c/0x764 f2fs_write_data_pages+0x78c/0xce4 do_writepages+0xe8/0x2fc __writeback_single_inode+0x4c/0x4b4 writeback_sb_inodes+0x314/0x540 __writeback_inodes_wb+0xa4/0xf4 wb_writeback+0x160/0x448 wb_workfn+0x2f0/0x5dc process_scheduled_works+0x1c8/0x458 worker_thread+0x334/0x3f0 kthread+0x118/0x1ac ret_from_fork+0x10/0x20
[1] https://bugzilla.kernel.org/show_bug.cgi?id=220575
The panic was caused by UAF issue w/ below race condition:
kworker
- writepages
- f2fs_write_cache_pages
- f2fs_write_single_data_page
- f2fs_do_write_data_page
- f2fs_inplace_write_data
- f2fs_merge_page_bio
- add_inu_page
: cache page #1 into bio & cache bio in
io->bio_list
- f2fs_write_single_data_page
- f2fs_do_write_data_page
- f2fs_inplace_write_data
- f2fs_merge_page_bio
- add_inu_page
: cache page #2 into bio which is linked
in io->bio_list
write
- f2fs_write_begin
: write page #1
- f2fs_folio_wait_writeback
- f2fs_submit_merged_ipu_write
- f2fs_submit_write_bio
: submit bio which inclues page #1 and #2
software IRQ
- f2fs_write_end_io
- fscrypt_free_bounce_page
: freed bounced page which belongs to page #2
- inc_page_count( , WB_DATA_TYPE(data_folio), false)
: data_folio points to fio->encrypted_page
the bounced page can be freed before
accessing it in f2fs_is_cp_guarantee()
It can reproduce w/ below testcase:
Run below script in shell #1:
for ((i=1;i>0;i++)) do xfs_io -f /mnt/f2fs/enc/file \
-c "pwrite 0 32k" -c "fdatasync"
Run below script in shell #2:
for ((i=1;i>0;i++)) do xfs_io -f /mnt/f2fs/enc/file \
-c "pwrite 0 32k" -c "fdatasync"
So, in f2fs_merge_page_bio(), let's avoid using fio->encrypted_page after commit page into internal ipu cache.
--- fs/f2fs/data.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/f2fs/data.c +1 -1
@@ -974,7 +974,7 @@ int f2fs_merge_page_bio(struct f2fs_io_info *fio)if (fio->io_wbc)wbc_account_cgroup_owner (fio->io_wbc, fio->page,PAGE_SIZE ); -inc_page_count (fio->sbi,WB_DATA_TYPE (page, false)); +inc_page_count (fio->sbi,WB_DATA_TYPE (fio->page, false)); *fio->last_block = fio->new_blkaddr; *fio->bio = bio;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 8/303 fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhan Xusheng <[email protected]>
commit cf6c993c0feca7984797e634deba3c80342e199a upstream.
fscrypt_ioctl_set_policy() calls inode_owner_or_capable() with &nop_mnt_idmap before allowing an encryption policy to be set, instead of the idmap of the mount the ioctl was issued on.
fscrypt is used by filesystems that support idmapped mounts (e.g. ext4, f2fs), so on such a mount this compares the caller's fsuid against the unmapped on-disk owner rather than the mapped owner: the actual owner can be wrongly denied with -EACCES and an unrelated caller wrongly allowed. Use file_mnt_idmap(filp) instead.
--- fs/crypto/policy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/crypto/policy.c +1 -1
@@ -494,7 +494,7 @@ int fscrypt_ioctl_set_policy(struct file *filp, const void __user *arg)return -EFAULT ; policy.version = version; -if (!inode_owner_or_capable (&init_user_ns, inode)) +if (!inode_owner_or_capable (file_mnt_user_ns (filp), inode))return -EACCES ; ret =mnt_want_write_file (filp);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 9/303 ipvs: separate destination availability state
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yizhou Zhao <[email protected]>
commit cdcc4e46180df8161f4d2f3c6fd6beaf6990133d upstream.
IPVS configuration paths update destination availability while connection accounting updates destination overload state. The two independent states share dest->flags, so their read-modify-write updates can race and lose one another.
Keep OVERLOAD in flags, where the preceding patch serializes its updates with dst_lock, and move AVAILABLE to cflags. This keeps configuration- controlled availability out of the scheduler hot cacheline until a scheduler needs to check it. It also prevents availability updates from clobbering overload state.
The destination status bits are not exposed through the IPVS sockopt or netlink interfaces, so keep their definitions in the internal IPVS header.
Readers can still observe stale destination state; this does not provide a cross-field snapshot.
--- include/net/ip_vs.h | 7 +++++++ include/uapi/linux/ip_vs.h | 6 ------ net/netfilter/ipvs/ip_vs_conn.c | 4 ++-- net/netfilter/ipvs/ip_vs_core.c | 6 +++--- net/netfilter/ipvs/ip_vs_ctl.c | 4 ++-- net/netfilter/ipvs/ip_vs_dh.c | 4 ++-- net/netfilter/ipvs/ip_vs_lblc.c | 2 +- net/netfilter/ipvs/ip_vs_lblcr.c | 8 ++++---- 8 files changed, 21 insertions(+), 20 deletions(-)
include/net/ip_vs.h +7 -0
@@ -33,6 +33,12 @@#define IP_VS_HDR_INVERSE 1#define IP_VS_HDR_ICMP 2 +/* Destination Server Flags */ +#define IP_VS_DEST_F_OVERLOAD 0x0002/* server is overloaded */ + +/* Destination Server Config Flags */ +#define IP_VS_DEST_CF_AVAILABLE 0x0001/* server is available */ +/* Generic access of ipvs struct */ static inline struct netns_ipvs *net_ipvs (struct net * net) {
@@ -664,6 +670,7 @@ struct ip_vs_dest {volatile unsigned int flags;/* dest status flags */ atomic_t conn_flags;/* flags to copy to conn */ atomic_t weight;/* server weight */ +unsigned long cflags;/* config flags */ atomic_t last_weight;/* server latest weight */ __u16 tun_type;/* tunnel type */ __be16 tun_port;/* tunnel port */
include/uapi/linux/ip_vs.h +0 -6
@@ -28,12 +28,6 @@#define IP_VS_SVC_F_SCHED_SH_FALLBACK IP_VS_SVC_F_SCHED1/* SH fallback */ #define IP_VS_SVC_F_SCHED_SH_PORT IP_VS_SVC_F_SCHED2/* SH use port */ -/* -* Destination Server Flags -*/ -#define IP_VS_DEST_F_AVAILABLE 0x0001/* server is available */ -#define IP_VS_DEST_F_OVERLOAD 0x0002/* server is overloaded */ -/* * IPVS sync daemon states */
net/netfilter/ipvs/ip_vs_conn.c +2 -2
@@ -759,7 +759,7 @@ int ip_vs_check_template(struct ip_vs_conn *ct, struct ip_vs_dest *cdest)* Checking the dest server status. */ if ((dest ==NULL ) || - !(dest->flags &IP_VS_DEST_F_AVAILABLE ) || + !(dest->cflags &IP_VS_DEST_CF_AVAILABLE ) ||expire_quiescent_template (ipvs, dest) || (cdest && (dest != cdest))) { IP_VS_DBG_BUF(9, "check_template: dest not available for "
@@ -1402,7 +1402,7 @@ void ip_vs_expire_nodest_conn_flush(struct netns_ipvs *ipvs)continue ; dest = cp->dest; -if (!dest || (dest->flags &IP_VS_DEST_F_AVAILABLE )) +if (!dest || (dest->cflags &IP_VS_DEST_CF_AVAILABLE ))continue ;if (atomic_read (&cp->n_control))
net/netfilter/ipvs/ip_vs_core.c +3 -3
@@ -124,7 +124,7 @@ ip_vs_in_stats(struct ip_vs_conn *cp, struct sk_buff *skb)struct ip_vs_dest *dest = cp->dest;struct netns_ipvs *ipvs = cp->ipvs; -if (dest && (dest->flags &IP_VS_DEST_F_AVAILABLE )) { +if (dest && (dest->cflags &IP_VS_DEST_CF_AVAILABLE )) {struct ip_vs_cpu_stats *s;struct ip_vs_service *svc;
@@ -160,7 +160,7 @@ ip_vs_out_stats(struct ip_vs_conn *cp, struct sk_buff *skb)struct ip_vs_dest *dest = cp->dest;struct netns_ipvs *ipvs = cp->ipvs; -if (dest && (dest->flags &IP_VS_DEST_F_AVAILABLE )) { +if (dest && (dest->cflags &IP_VS_DEST_CF_AVAILABLE )) {struct ip_vs_cpu_stats *s;struct ip_vs_service *svc;
@@ -2035,7 +2035,7 @@ ip_vs_in_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *state }/* Check the server status */ -if (cp && cp->dest && !(cp->dest->flags &IP_VS_DEST_F_AVAILABLE )) { +if (cp && cp->dest && !(cp->dest->cflags &IP_VS_DEST_CF_AVAILABLE )) {/* the destination server is not available */ if (sysctl_expire_nodest_conn (ipvs)) {bool old_ct =ip_vs_conn_uses_old_conntrack (cp, skb);
net/netfilter/ipvs/ip_vs_ctl.c +2 -2
@@ -962,7 +962,7 @@ __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest, }/* set the dest status flags */ - dest->flags |=IP_VS_DEST_F_AVAILABLE ; + dest->cflags |=IP_VS_DEST_CF_AVAILABLE ;if (READ_ONCE (dest->u_threshold) != udest->u_threshold ||READ_ONCE (dest->l_threshold) != udest->l_threshold) {
@@ -1238,7 +1238,7 @@ static void __ip_vs_unlink_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest, int svcupd) { - dest->flags &= ~IP_VS_DEST_F_AVAILABLE ; + dest->cflags &= ~IP_VS_DEST_CF_AVAILABLE ;/* * Remove it from the d-linked destination list.
net/netfilter/ipvs/ip_vs_dh.c +2 -2
@@ -220,8 +220,8 @@ ip_vs_dh_schedule(struct ip_vs_service *svc, const struct sk_buff *skb, s = (struct ip_vs_dh_state *) svc->sched_data; dest =ip_vs_dh_get (svc->af, s, &iph->daddr); -if (!dest - || !(dest->flags &IP_VS_DEST_F_AVAILABLE ) +if (!dest || + !(dest->cflags &IP_VS_DEST_CF_AVAILABLE ) ||atomic_read (&dest->weight) <=0 ||is_overloaded (dest)) {ip_vs_scheduler_err (svc,"no destination available" );
net/netfilter/ipvs/ip_vs_lblc.c +1 -1
@@ -503,7 +503,7 @@ ip_vs_lblc_schedule(struct ip_vs_service *svc, const struct sk_buff *skb,*/ dest = en->dest; -if ((dest->flags &IP_VS_DEST_F_AVAILABLE ) && +if ((dest->cflags &IP_VS_DEST_CF_AVAILABLE ) &&atomic_read (&dest->weight) >0 && !is_overloaded (dest, svc)) goto out; }
net/netfilter/ipvs/ip_vs_lblcr.c +4 -4
@@ -170,8 +170,8 @@ static inline struct ip_vs_dest *ip_vs_dest_set_min(struct ip_vs_dest_set *set)if (least->flags &IP_VS_DEST_F_OVERLOAD )continue ; -if ((atomic_read (&least->weight) >0 ) - && (least->flags &IP_VS_DEST_F_AVAILABLE )) { +if ((atomic_read (&least->weight) >0 ) && + (least->cflags &IP_VS_DEST_CF_AVAILABLE )) { loh =ip_vs_dest_conn_overhead (least); goto nextstage; }
@@ -187,8 +187,8 @@ static inline struct ip_vs_dest *ip_vs_dest_set_min(struct ip_vs_dest_set *set) doh =ip_vs_dest_conn_overhead (dest);if (((__s64 )loh *atomic_read (&dest->weight) > - (__s64 )doh *atomic_read (&least->weight)) - && (dest->flags &IP_VS_DEST_F_AVAILABLE )) { + (__s64 )doh *atomic_read (&least->weight)) && + (dest->cflags &IP_VS_DEST_CF_AVAILABLE )) { least = dest; loh = doh; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 10/303 selinux: require every boolean value to be defined
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <[email protected]>
commit a93d37a09b863810653f93d371fb197457d59deb upstream.
p_bools.nprim comes from the policy image independently of how many booleans follow it, and cond_index_bool() fills bool_val_to_struct[] at value - 1, so a count larger than the values present leaves NULL entries. Every user of that array then walks it by index and dereferences each
entry: cond_evaluate_expr() on the access-vector path, security_get_bools() and security_get_bool_value() behind selinuxfs, and security_set_bools(). A sparse class value is absorbed by policydb_class_isvalid() and its siblings; booleans have no such predicate, and no consumer that could use one.
Reject a boolean value that no boolean defines, once, where the array is built. Conforming policies define every boolean they declare and are unaffected.
--- security/selinux/ss/policydb.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)
security/selinux/ss/policydb.c +19 -0
@@ -712,6 +712,7 @@ static inline void hash_eval(struct hashstatic int policydb_index (struct policydb *p) {int i, rc; +u32 v;if (p->mls_enabled) pr_debug("SELinux: %d users, %d roles, %d types, %d bools, %d sens, %d cats\n",
@@ -769,6 +770,24 @@ static int policydb_index(struct policydif (rc) goto out; } + +/* +* A sparse class value is absorbed by policydb_class_isvalid() and +* its siblings, but no such predicate exists for booleans: every +* user of bool_val_to_struct[] walks it by index and dereferences +* each entry -- cond_evaluate_expr(), the two getters and +* security_set_bools() -- so an unclaimed one has no consumer that +* can tolerate it. +*/ +for (v =0 ; v < p->p_bools.nprim; v++) { +if (!p->bool_val_to_struct[v]) { +pr_err ("SELinux: boolean %u is declared but not defined\n" , + v +1 ); + rc = -EINVAL ; + goto out; + } + } + rc =0 ; out:return rc;
Greg Kroah-Hartman
maintainerPATCH 11/303 selinux: reject a class permission count below its inherited common
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <[email protected]>
commit 9a82dcd98b6e6e11cfd162410967951f12152528 upstream.
security_get_permissions() maps an inherited common's permissions into an array sized by the class's own permissions.nprim, but class_read() takes that nprim verbatim from the policy image and never checks that it covers the common. A class that inherits a common of N permissions while declaring a smaller nprim is accepted, and on load the common's permissions are written past the class-sized array -- an out-of-bounds heap write.
Reject a class whose permission count is below its inherited common's. Well-formed policies, where the class count already includes the inherited permissions, are unaffected.
--- security/selinux/ss/policydb.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
security/selinux/ss/policydb.c +12 -0
@@ -1350,6 +1350,18 @@ static int class_read(struct policydb *p cladatum->comkey); goto bad; } + +/* +* security_get_permissions() maps the common's permissions +* into an array sized by this class's nprim, so a class must +* declare at least as many as the common it inherits. +*/ +if (cladatum->permissions.nprim < + cladatum->comdatum->permissions.nprim) { +pr_err ("SELinux: class %s has fewer permissions than common %s\n" , + key, cladatum->comkey); + goto bad; + } }for (i =0 ; i < nel; i++) { rc =perm_read (p, &cladatum->permissions, fp);
Greg Kroah-Hartman
maintainerPATCH 12/303 selinux: do not cancel a policy conversion that never started
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <[email protected]>
commit e5c0235a3c4e9eb047a16cd02323fe4ecf2f570e upstream.
sel_write_load() calls selinux_policy_cancel() when sel_make_policy_nodes() fails, and that helper dereferences the outgoing policy to cancel its sidtab conversion. On the first policy load there is no outgoing policy:security_load_policy() returns early for that case, before it converts anything, and state->policy is still NULL. A first load that fails while building the selinuxfs tree therefore takes a NULL dereference in selinux_policy_cancel(), reached from a write(2) to /sys/fs/selinux/load.
Skip the cancel when there is no old policy, mirroring the check security_load_policy() already makes before it converts.
--- security/selinux/ss/services.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
security/selinux/ss/services.c +3 -1
@@ -2201,7 +2201,9 @@ void selinux_policy_cancel(struct selinu oldpolicy =rcu_dereference_protected (state->policy,lockdep_is_held (&state->policy_mutex)); -sidtab_cancel_convert (oldpolicy->sidtab); +/* a first load has no outgoing policy and converted nothing */ +if (oldpolicy) +sidtab_cancel_convert (oldpolicy->sidtab);selinux_policy_free (load_state->policy);kfree (load_state->convert_data); }
Greg Kroah-Hartman
maintainerPATCH 13/303 selftests: mptcp: join: mark tests with data corruption as failed
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gang Yan <[email protected]>
commit ca318e7bbb7723f57bcd9e69a2873b5884435552 upstream.
check_transfer() compares the input and output files byte-by-byte using cmp -l "$in" "$out" | while read .... Because the while-loop body runs in a subshell (the script sets neither lastpipe nor pipefail), the fail_test call inside it -- which sets the global ret/last_test_failed -- and the return 1 both act on the subshell, not on check_transfer().
check_transfer() thus always falls through to return 0, and any data corruption affecting only the payload (leaving the subflow/PM counters untouched) is silently reported as PASS.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +2 -2
@@ -500,7 +500,7 @@ check_transfer() mv "$tmpfile" "$out" tmpfile="" fi - cmp -l "$in" "$out" | while read -r i a b; do + while read -r i a b; do local sum=$((0${a} + 0${b})) if [ $check_invert -eq 0 ] || [ $sum -ne $((0xff)) ]; then echo "[ FAIL ] $what does not match (in, out):"
@@ -512,7 +512,7 @@ check_transfer() else echo "$what has inverted byte at ${i}" fi - done + done < <(cmp -l "$in" "$out") return 0 }
Greg Kroah-Hartman
maintainerPATCH 14/303 mptcp: options: reset DSS fields in case of unexpected size
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit 35772b4981f38ba8059372cde8753e8e477e98ec upstream.
A remote peer could send a malformed DSS with a wrong size, followed by another DSS or MPC + Data. In this case, the first suboption will be ignored, but leaving some fields written, which could lead to inconsistency or access uninitialized data.
Explicitly reset the fields that could have been modified in case of unexpected size.
--- net/mptcp/options.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
net/mptcp/options.c +7 -1
@@ -183,8 +183,14 @@ static void mptcp_parse_option(const str* RFC 8684 Section 3.3.0 checks later in subflow_data_ready */ if (opsize != expected_opsize && - opsize != expected_opsize +TCPOLEN_MPTCP_DSS_CHECKSUM ) + opsize != expected_opsize +TCPOLEN_MPTCP_DSS_CHECKSUM ) { + mp_opt->dsn64 =0 ; + mp_opt->use_map =0 ; + mp_opt->ack64 =0 ; + mp_opt->use_ack =0 ; + mp_opt->data_fin =0 ;break ; + } mp_opt->suboptions |=OPTION_MPTCP_DSS ;if (mp_opt->use_ack) {
Greg Kroah-Hartman
maintainerPATCH 15/303 s390/qeth: validate user buffer length in SNMP and ARP query ioctls
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hidayath Khan <[email protected]>
commit d141f087b1af656f055d7c5793a3e87817ba0bbe upstream.
qeth_snmp_command() and qeth_l3_arp_query() allocate a buffer sized by a user-supplied length (udata_len) without checking a lower bound, then set udata_offset to a fixed non-zero value and pass both to a reply callback. The callback bounds-checks the copy with
if ((udata_len - udata_offset) < len)
Both fields are u32, so a udata_len smaller than udata_offset makes the subtraction wrap and the check pass, and the following memcpy() writes past the allocation. A udata_len of 0 also yields ZERO_SIZE_PTR from kzalloc(), which the existing NULL check does not catch.
Reject buffers smaller than udata_offset before allocating, so the callback subtraction can no longer underflow.
--- drivers/s390/net/qeth_core_main.c | 3 +++ drivers/s390/net/qeth_l3_main.c | 5 +++++ 2 files changed, 8 insertions(+)
drivers/s390/net/qeth_core_main.c +3 -0
@@ -4708,6 +4708,9 @@ static int qeth_snmp_command(struct qethif (req_len >QETH_BUFSIZE )return -EINVAL ; +if (qinfo.udata_len <sizeof (struct qeth_snmp_ureq_hdr )) +return -EINVAL ; + iob =qeth_get_adapter_cmd (card,IPA_SETADP_SET_SNMP_CONTROL , req_len);if (!iob)return -ENOMEM ;
drivers/s390/net/qeth_l3_main.c +5 -0
@@ -1414,6 +1414,11 @@ static int qeth_l3_arp_query(struct qeth rc = -EFAULT ; goto out; } + +if (qinfo.udata_len <QETH_QARP_ENTRIES_OFFSET ) { + rc = -EINVAL ; + goto out; + } qinfo.udata =kzalloc (qinfo.udata_len,GFP_KERNEL );if (!qinfo.udata) { rc = -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 16/303 ASoC: cs4265: sort the register default table
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <[email protected]>
commit e4fe3e046524e5de3c04c6eef3743780cbdc231c upstream.
reg_defaults must be sorted by ascending register address, as regcache_lookup_reg() locates entries in it with bsearch(). See commit fd80df352ba1 ("regcache: Add support for sorting defaults arrays").
cs4265_reg_defaults[] lists CS4265_INT_MASK (0x0e), CS4265_STATUS_MODE_MSB (0x0f) and CS4265_STATUS_MODE_LSB (0x10) after CS4265_SPDIF_CTL1 (0x11) and CS4265_SPDIF_CTL2 (0x12), so the binary search does not find those three entries. regcache_reg_needs_sync() then cannot compare them against their default and reports that a sync is needed, so they are written to the device on every regcache_sync() even when they were never touched.
Sort the table by register address.
--- sound/soc/codecs/cs4265.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/codecs/cs4265.c +2 -2
@@ -46,11 +46,11 @@ static const struct reg_default cs4265_r { CS4265_DAC_CHA_VOL, 0x00 }, { CS4265_DAC_CHB_VOL, 0x00 }, { CS4265_DAC_CTL2, 0xC0 }, - { CS4265_SPDIF_CTL1, 0x00 }, - { CS4265_SPDIF_CTL2, 0x00 }, { CS4265_INT_MASK, 0x00 }, { CS4265_STATUS_MODE_MSB, 0x00 }, { CS4265_STATUS_MODE_LSB, 0x00 }, + { CS4265_SPDIF_CTL1, 0x00 }, + { CS4265_SPDIF_CTL2, 0x00 }, };static bool cs4265_readable_register (struct device *dev,unsigned int reg)
Greg Kroah-Hartman
maintainerPATCH 17/303 ASoC: cs35l41: sort the register default table
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <[email protected]>
commit d74aac116cfb2058b15df53996d23232b310f7ff upstream.
reg_defaults must be sorted by ascending register address, as regcache_lookup_reg() locates entries in it with bsearch(). See commit fd80df352ba1 ("regcache: Add support for sorting defaults arrays").
cs35l41_reg[] lists CS35L41_BSTCVRT_PEAK_CUR (0x3808) after CS35L41_BSTCVRT_COEFF (0x3810) and CS35L41_BSTCVRT_SLOPE_LBST (0x3814), so the binary search does not find those two entries. regcache_reg_needs_sync() then cannot compare them against their default and reports that a sync is needed, so they are written to the device on every regcache_sync() even when they were never touched.
Sort the table by register address.
--- sound/soc/codecs/cs35l41-lib.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/cs35l41-lib.c +1 -1
@@ -23,9 +23,9 @@ static const struct reg_default cs35l41_ { CS35L41_GPIO_PAD_CONTROL, 0x00000000 }, { CS35L41_GLOBAL_CLK_CTRL, 0x00000003 }, { CS35L41_TST_FS_MON0, 0x00020016 }, + { CS35L41_BSTCVRT_PEAK_CUR, 0x0000004A }, { CS35L41_BSTCVRT_COEFF, 0x00002424 }, { CS35L41_BSTCVRT_SLOPE_LBST, 0x00007500 }, - { CS35L41_BSTCVRT_PEAK_CUR, 0x0000004A }, { CS35L41_SP_ENABLES, 0x00000000 }, { CS35L41_SP_RATE_CTRL, 0x00000028 }, { CS35L41_SP_FORMAT, 0x18180200 },
Greg Kroah-Hartman
maintainerPATCH 18/303 ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dawid Wróbel <[email protected]>
commit 56f24311fd5607588a47e44675195a9efb200f29 upstream.
EAR SPKR PA Gain" and the four "WSA RX* Mux" controls are enumerated, but their get and put callbacks access the value through ucontrol->value.integer.value[0] (a long) instead of ucontrol->value.enumerated.item[0] (an unsigned int).
This same pattern was fixed in the sibling drivers by commit bcfe5f76cc40 ("ASoC: codecs: rx-macro: fix accessing array out of bounds for enum type") and
commit 0ea5eff7c606 ("ASoC: codecs: va-macro: fix accessing array out of bounds for enum type"), but wsa-macro was missed.
On 64-bit kernels with CONFIG_SND_CTL_DEBUG this trips the elem value sanity check and every read of these controls fails with -EINVAL.
--- sound/soc/codecs/lpass-wsa-macro.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
sound/soc/codecs/lpass-wsa-macro.c +4 -4
@@ -1856,7 +1856,7 @@ static int wsa_macro_ear_spkr_pa_gain_gestruct snd_soc_component *component =snd_soc_kcontrol_component (kcontrol);struct wsa_macro *wsa =snd_soc_component_get_drvdata (component); - ucontrol->value.integer.value[0 ] = wsa->ear_spkr_gain; + ucontrol->value.enumerated.item[0 ] = wsa->ear_spkr_gain;return 0 ; }
@@ -1867,7 +1867,7 @@ static int wsa_macro_ear_spkr_pa_gain_pustruct snd_soc_component *component =snd_soc_kcontrol_component (kcontrol);struct wsa_macro *wsa =snd_soc_component_get_drvdata (component); - wsa->ear_spkr_gain = ucontrol->value.integer.value[0 ]; + wsa->ear_spkr_gain = ucontrol->value.enumerated.item[0 ];return 0 ; }
@@ -1881,7 +1881,7 @@ static int wsa_macro_rx_mux_get(struct ssnd_soc_dapm_to_component (widget->dapm);struct wsa_macro *wsa =snd_soc_component_get_drvdata (component); - ucontrol->value.integer.value[0 ] = + ucontrol->value.enumerated.item[0 ] = wsa->rx_port_value[widget->shift];return 0 ; }
@@ -1895,7 +1895,7 @@ static int wsa_macro_rx_mux_put(struct ssnd_soc_dapm_to_component (widget->dapm);struct soc_enum *e = (struct soc_enum *)kcontrol->private_value;struct snd_soc_dapm_update *update =NULL ; -u32 rx_port_value = ucontrol->value.integer.value[0 ]; +u32 rx_port_value = ucontrol->value.enumerated.item[0 ];u32 bit_input;u32 aif_rst;struct wsa_macro *wsa =snd_soc_component_get_drvdata (component);
Greg Kroah-Hartman
maintainerPATCH 19/303 powerpc/pseries: pci - logic bug
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: George Wilson <[email protected]>
commit 649c10bff5cb7a514bf299094833ec8c9190aac3 upstream.
The checks on num_vfs in pseries_pci_sriov_enable() are ANDed where OR was apparently intended. Change it to OR.
--- arch/powerpc/platforms/pseries/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/platforms/pseries/pci.c +1 -1
@@ -159,7 +159,7 @@ static int pseries_pci_sriov_enable(stru/* First integer stores max config */ max_config_vfs =of_read_number (&max_vfs[0 ],1 ); -if (max_config_vfs < num_vfs && num_vfs >MAX_VFS_FOR_MAP_PE ) { +if (max_config_vfs < num_vfs || num_vfs >MAX_VFS_FOR_MAP_PE ) { dev_err(&pdev->dev, "Num VFs %x > %x Configurable VFs\n", num_vfs, (num_vfs > MAX_VFS_FOR_MAP_PE) ?
Greg Kroah-Hartman
maintainerPATCH 20/303 Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
commit 6058f0fea10f3caf63a435677358d1b8e9325114 upstream.
During F55 sensor detection, the transmitter (TX) electrode count was incorrectly assigned the value of the receiver (RX) electrode count due to copy-paste typos.
This incorrect value was then propagated to the driver data and used by F54 to determine the diagnostics report size. On devices with more RX than TX electrodes, this inflated the perceived TX count, leading to incorrect report size calculations and potential out-of-bounds buffer accesses.
Fix the typos by correctly assigning the TX electrode counts.
--- drivers/input/rmi4/rmi_f55.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/input/rmi4/rmi_f55.c +2 -2
@@ -54,10 +54,10 @@ static int rmi_f55_detect(struct rmi_fun f55->num_tx_electrodes = f55->qry[F55_NUM_TX_OFFSET ]; f55->cfg_num_rx_electrodes = f55->num_rx_electrodes; - f55->cfg_num_tx_electrodes = f55->num_rx_electrodes; + f55->cfg_num_tx_electrodes = f55->num_tx_electrodes; drv_data->num_rx_electrodes = f55->cfg_num_rx_electrodes; - drv_data->num_tx_electrodes = f55->cfg_num_rx_electrodes; + drv_data->num_tx_electrodes = f55->cfg_num_tx_electrodes;if (f55->qry[F55_PHYS_CHAR_OFFSET ] &F55_CAP_SENSOR_ASSIGN ) {int i, total;
Greg Kroah-Hartman
maintainerPATCH 21/303 Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Davies <[email protected]>
commit 296736076b3fd078742651c719555a488624023a upstream.
Make finger2 (and also finger1) unsigned, so that if the finger index in the packet is 0 then subtracting 1 creates an array index which overflows above the existing check for FOC_MAX_FINGERS, as the existing comment says it should, instead of writing to state->fingers[-1].
--- drivers/input/mouse/focaltech.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/input/mouse/focaltech.c +1 -1
@@ -197,7 +197,7 @@ static void focaltech_process_rel_packet {struct focaltech_data *priv = psmouse->private;struct focaltech_hw_state *state = &priv->state; -int finger1, finger2; +unsigned int finger1, finger2; state->pressed = packet[0 ] >>7 ; finger1 = ((packet[0 ] >>4 ) &0x7 ) -1 ;
Greg Kroah-Hartman
maintainerPATCH 22/303 Input: psxpad-spi - set driver data before use
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linmao Li <[email protected]>
commit 732f38c36059e68ba3b4b89c56911d777fd3185c upstream.
psxpad_spi_suspend() retrieves the controller state with spi_get_drvdata(), but probe never stores it, so suspend dereferences a NULL pointer. Store it during probe.
--- drivers/input/joystick/psxpad-spi.c | 1 + 1 file changed, 1 insertion(+)
drivers/input/joystick/psxpad-spi.c +1 -0
@@ -366,6 +366,7 @@ static int psxpad_spi_probe(struct spi_dreturn err; } +spi_set_drvdata (spi, pad);pm_runtime_enable (&spi->dev);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 23/303 Input: atkbd - skip deactivate for Xiaomi Book Pro 14s internal keyboard
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhefu Zhang <[email protected]>
commit 3a046db33bb9f28b43a951a7a090db771dc0f8b3 upstream.
The internal keyboard of the Xiaomi Book Pro 14 does not work unless atkbd skips deactivating it at the end of atkbd_probe().
Using 'i8042.dumbkbd=1' also makes the keyboard work, but then the driver never writes to the keyboard at all, so the Caps Lock LED is lost. The atkbd_deactivate_fixup quirk fixes both without a boot parameter.
DMI: XIAOMI Xiaomi Book Pro 14/TM2424, BIOS XMAPT4B0P0909 05/06/2026
--- drivers/input/keyboard/atkbd.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/input/keyboard/atkbd.c +8 -0
@@ -1939,6 +1939,14 @@ static const struct dmi_system_id atkbd_ }, .callback = atkbd_deactivate_fixup, }, + { + /* Xiaomi Book Pro 14 (TM2424) */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "XIAOMI"), + DMI_MATCH(DMI_PRODUCT_NAME, "Xiaomi Book Pro 14"), + }, + .callback = atkbd_deactivate_fixup, + }, { } };
Greg Kroah-Hartman
maintainerPATCH 24/303 Input: iforce - validate input packet lengths
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
commit 5751c781d3c97ab6ce0e2a966156ed882152c415 upstream.
iforce_process_packet() reads fixed fields from joystick, wheel and status packets without first checking their lengths. In particular, the shared hats-and-buttons helper unconditionally reads data[6]. The status tail is a sequence of 16-bit effect addresses, but an incomplete final address is also consumed. A successful zero-length USB URB additionally reads the packet ID before the common parser is called.
Reject the zero-length USB transfer, require the seven-byte joystick and wheel prefixes and the two-byte status prefix, and consume only complete status-tail addresses.
--- drivers/input/joystick/iforce/iforce-packets.c | 11 ++++++++++- drivers/input/joystick/iforce/iforce-usb.c | 3 +++ 2 files changed, 13 insertions(+), 1 deletion(-)
drivers/input/joystick/iforce/iforce-packets.c +10 -1
@@ -161,6 +161,9 @@ void iforce_process_packet(struct iforceswitch (packet_id) {case 0x01 :/* joystick position data */ +if (len <7 ) +break ; +input_report_abs (dev,ABS_X , (__s16 )get_unaligned_le16 (data)); input_report_abs(dev, ABS_Y,
@@ -176,6 +179,9 @@ void iforce_process_packet(struct iforcebreak ;case 0x03 :/* wheel position data */ +if (len <7 ) +break ; +input_report_abs (dev,ABS_WHEEL , (__s16 )get_unaligned_le16 (data));input_report_abs (dev,ABS_GAS ,255 - data[2 ]);
@@ -187,6 +193,9 @@ void iforce_process_packet(struct iforcebreak ;case 0x02 :/* status report */ +if (len <2 ) +break ; +input_report_key (dev,BTN_DEAD , data[0 ] &0x02 );input_sync (dev);
@@ -206,7 +215,7 @@ void iforce_process_packet(struct iforce } } -for (j =3 ; j < len; j +=2 ) +for (j =3 ; j +sizeof (u16) <= len; j +=sizeof (u16))mark_core_as_ready (iforce,get_unaligned_le16 (data + j));break ;
drivers/input/joystick/iforce/iforce-usb.c +3 -0
@@ -159,6 +159,9 @@ static void iforce_usb_irq(struct urb *u goto exit; } +if (!urb->actual_length) + goto exit; +iforce_process_packet (iforce, iforce_usb->data_in[0 ], iforce_usb->data_in +1 , urb->actual_length -1 );
Greg Kroah-Hartman
maintainerPATCH 25/303 powerpc/pseries: lparcfg - fix kbuf[] underflow
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: George Wilson <[email protected]>
commit fb442a6673ff1046bf67754957d95880fdb394b5 upstream.
In lparcfg_write(), a count of 0 results in kbuf[] being indexed at -1. Check for count == 0 in the existing check for count > sizeof(kbuf) and return -EINVAL if true.
--- arch/powerpc/platforms/pseries/lparcfg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/platforms/pseries/lparcfg.c +1 -1
@@ -729,7 +729,7 @@ static ssize_t lparcfg_write(struct fileif (!firmware_has_feature (FW_FEATURE_SPLPAR ))return -EINVAL ; -if (count >sizeof (kbuf)) +if (count ==0 || count >sizeof (kbuf))return -EINVAL ;if (copy_from_user (kbuf, buf, count))
Greg Kroah-Hartman
maintainerPATCH 26/303 Input: synaptics-rmi4 - zero report size on F54 work error
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
commit dc76c3c8e8ad09362b8c1561f3928288c15cba2e upstream.
In rmi_f54_work(), if an error occurs during report request or command verification, the code jumped directly to the 'error' label, bypassing the 'abort' label where f54->report_size was normally zeroed out.
This left f54->report_size containing its previous successful payload size. If a user then altered the V4L2 format to a smaller size, and a subsequent run failed, rmi_f54_buffer_queue() would copy the stale, larger payload size into the shrunken V4L2 buffer, causing a heap buffer overflow.
Fix this by merging the 'abort' and 'error' labels into a single 'out' exit path, and ensuring that f54->report_size is always set to 0 on failure by checking for error and zeroing the local report_size first.
--- drivers/input/rmi4/rmi_f54.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/input/rmi4/rmi_f54.c +8 -8
@@ -547,7 +547,7 @@ static void rmi_f54_work(struct work_strdev_err (&fn->dev,"Bad report size, report type=%d\n" , f54->report_type); error = -EINVAL ; - goto error;/* retry won't help */ + goto out;/* retry won't help */ }/*
@@ -558,7 +558,7 @@ static void rmi_f54_work(struct work_str &command);if (error) {dev_err (&fn->dev,"Failed to read back command\n" ); - goto error; + goto out; }if (command &F54_GET_REPORT ) {if (time_after (jiffies, f54->timeout)) {
@@ -566,7 +566,7 @@ static void rmi_f54_work(struct work_str error = -ETIMEDOUT ; } report_size =0 ; - goto error; + goto out; }rmi_dbg (RMI_DEBUG_FN , &fn->dev,"Get report command completed, reading data\n" );
@@ -581,7 +581,7 @@ static void rmi_f54_work(struct work_str fifo, sizeof(fifo));if (error) {dev_err (&fn->dev,"Failed to set fifo start offset\n" ); - goto abort; + goto out; } error = rmi_read_block(fn->rmi_dev, fn->fd.data_base_addr +
@@ -590,16 +590,16 @@ static void rmi_f54_work(struct work_strif (error) {dev_err (&fn->dev,"%s: read [%d bytes] returned %d\n" , __func__, size, error); - goto abort; + goto out; } } -abort: - f54->report_size = error ?0 : report_size; -error: +out:if (error) report_size =0 ; + f54->report_size = report_size; +if (report_size ==0 && !error) {queue_delayed_work (f54->workqueue, &f54->work,msecs_to_jiffies (1 ));
Greg Kroah-Hartman
maintainerPATCH 27/303 Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <[email protected]>
commit 49c5adc2b7d6e43c5cf033e1c86fdb9c16ababb1 upstream.
rmi_f54_work() reads a diagnostics report from the device into f54->report_data, sizing the transfer with rmi_f54_get_report_size():
report_size = rmi_f54_get_report_size(f54);
...
for (i = 0; i < report_size; i += F54_REPORT_DATA_SIZE) {
int size = min(F54_REPORT_DATA_SIZE, report_size - i);
...
rmi_read_block(.., f54->report_data + i, size);
}report_data is allocated once at probe from F54's own electrode counts (array3_size(f54->num_tx_electrodes, f54->num_rx_electrodes, sizeof(u16))), but rmi_f54_get_report_size() computes the size from drv_data->num_*_electrodes when those are set, i.e. from the F55 function's electrode counts. Both counts come straight from device queries (F54 and F55 each report up to 255 electrodes) and nothing constrains the F55 counts to the F54 ones.
A malicious or malfunctioning RMI4 device that reports larger F55 electrode counts than its F54 counts makes report_size exceed the allocation, so the read loop writes past report_data (and the V4L2 dequeue memcpy() then reads past it). On conforming hardware the F55 configured electrodes are a subset of the F54 physical electrodes, so report_size never exceeds the buffer and well-behaved devices are unaffected.
Record the allocation size and reject a report that does not fit, mirroring the existing zero-size check.
--- drivers/input/rmi4/rmi_f54.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/input/rmi4/rmi_f54.c +10 -2
@@ -104,6 +104,7 @@ struct f54_data {enum rmi_f54_report_type report_type;u8 *report_data; +size_t max_report_size;int report_size;bool is_busy;
@@ -550,6 +551,13 @@ static void rmi_f54_work(struct work_str goto out;/* retry won't help */ } +if (report_size > f54->max_report_size) { +dev_err (&fn->dev,"Report size %d exceeds buffer size %zu\n" , + report_size, f54->max_report_size); + error = -EINVAL ; + goto out; + } +/* * Need to check if command has completed. * If not try again later.
@@ -680,8 +688,8 @@ static int rmi_f54_probe(struct rmi_func rx = f54->num_rx_electrodes; tx = f54->num_tx_electrodes; - f54->report_data =devm_kzalloc (&fn->dev, -array3_size (tx, rx,sizeof (u16)), + f54->max_report_size =array3_size (tx, rx,sizeof (u16)); + f54->report_data =devm_kzalloc (&fn->dev, f54->max_report_size,GFP_KERNEL );if (f54->report_data ==NULL )return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 28/303 Input: synaptics-rmi4 - block s_input when F54 queue is busy
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
commit fbfd76746adc16d64be29ff113f673b70bc3f5c2 upstream.
Changing the input (diagnostic report type) mid-stream changes the report size. Since V4L2 buffers are allocated based on the size at stream start, changing the input while streaming could lead to a heap buffer overflow if the new size is larger than the allocated buffers.
Prevent this by blocking VIDIOC_S_INPUT with -EBUSY if the V4L2 queue is busy (streaming).
--- drivers/input/rmi4/rmi_f54.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/input/rmi4/rmi_f54.c +6 -1
@@ -447,7 +447,12 @@ static int rmi_f54_set_input(struct f54_static int rmi_f54_vidioc_s_input (struct file *file,void *priv,unsigned int i) { -return rmi_f54_set_input (video_drvdata (file), i); +struct f54_data *f54 =video_drvdata (file); + +if (vb2_is_busy (&f54->queue)) +return -EBUSY ; + +return rmi_f54_set_input (f54, i); } static int rmi_f54_vidioc_g_input(struct file *file, void *priv,
Greg Kroah-Hartman
maintainerPATCH 29/303 Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
commit 8786d74bf50e6797b6f655eb381ef6b25451161f upstream.
Previously, rmi_f54_buffer_queue() waited for the worker thread to finish but ignored whether it succeeded. If the worker failed (e.g., due to a timeout or register read failure), the queue thread would silently return success, delivering stale or uninitialized memory to userspace.
Add a 'report_error' field to struct f54_data to store the worker's exit status. Check this field in rmi_f54_buffer_queue() after the worker finishes, and mark the buffer as VB2_BUF_STATE_ERROR if an error occurred.
--- drivers/input/rmi4/rmi_f54.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/input/rmi4/rmi_f54.c +8 -0
@@ -106,6 +106,7 @@ struct f54_data {u8 *report_data;size_t max_report_size;int report_size; +int report_error;bool is_busy;struct mutex status_mutex;
@@ -340,6 +341,12 @@ static void rmi_f54_buffer_queue(structmutex_lock (&f54->data_mutex); } +if (f54->report_error) { +dev_err (&f54->fn->dev,"Error acquiring report: %d\n" , f54->report_error); + state =VB2_BUF_STATE_ERROR ; + goto data_done; + } + ptr =vb2_plane_vaddr (vb,0 );if (!ptr) {dev_err (&f54->fn->dev,"Error acquiring frame ptr\n" );
@@ -612,6 +619,7 @@ out: report_size =0 ; f54->report_size = report_size; + f54->report_error = error;if (report_size ==0 && !error) { queue_delayed_work(f54->workqueue, &f54->work,
Greg Kroah-Hartman
maintainerPATCH 30/303 crypto: qce - fix error path in devm_qce_register_algs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <[email protected]>
commit 9c75402286409f5e1a75e4a445555c84066f89db upstream.
If ops->register_algs() fails, the error path repeatedly calls the same ops->unregister_algs() from the failed registration. Use the loop index to unregister the previously registered algorithms instead.
--- drivers/crypto/qce/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/qce/core.c +1 -1
@@ -55,7 +55,7 @@ static int qce_register_algs(struct qce_ ret = ops->register_algs (qce);if (ret) {for (j = i -1 ; j >=0 ; j--) - ops->unregister_algs (qce); + qce_ops[j]->unregister_algs (qce);return ret; } }
Greg Kroah-Hartman
maintainerPATCH 31/303 libceph: fix multiple unsafe decodes in decode_locker()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavitra Jha <[email protected]>
commit 437b6551cfcc235eea1d735a874f9d421f555e17 upstream.
decode_locker() in cls_lock_client.c contains three unsafe decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads:
1. ceph_decode_copy() at the locker_id_t name field has no preceding bounds check. With p == end after ceph_start_decoding() accepts struct_len=0, this reads sizeof(ceph_entity_name) = 9 bytes past the validated buffer boundary.
2. *p += sizeof(struct ceph_timespec) after the locker_info_t header is an unchecked pointer advance. A malicious OSD can position p past end, causing all subsequent _safe checks to pass against a bogus boundary.
3. len = ceph_decode_32(p) has no preceding bounds check, and the immediately following *p += len is uncapped. A malicious OSD can send len=0xffffffff, advancing p gigabytes past end and escaping the decode window entirely.
Fix all three by replacing bare operations with their safe variants:
ceph_decode_copy -> ceph_decode_copy_safe *p += sizeof(...) -> ceph_decode_skip_n ceph_decode_32(p) -> ceph_decode_32_safe *p += len -> ceph_decode_skip_n
A new label is added to return -EINVAL on any bounds violation. -EINVAL is appropriate here: the data received from the OSD is structurally malformed, which is an invalid argument to the decode contract regardless of whether the caller or the wire is at fault.
Attacker model: a malicious or compromised OSD in a multi-tenant Ceph deployment can trigger this against any kernel client that issues the lock.get_info class method (e.g. during RBD exclusive lock acquisition) without any further privileges beyond OSD session establishment.
[ idryomov: use ceph_decode_skip_string() to skip description, trim
changelog ]
--- net/ceph/cls_lock_client.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
net/ceph/cls_lock_client.c +9 -4
@@ -259,7 +259,8 @@ static int decode_locker(void **p, voidif (ret)return ret; -ceph_decode_copy (p, &locker->id.name,sizeof (locker->id.name)); +ceph_decode_copy_safe (p, end, &locker->id.name, +sizeof (locker->id.name), bad); s =ceph_extract_encoded_string (p, end,NULL ,GFP_NOIO );if (IS_ERR (s))return PTR_ERR (s);
@@ -270,19 +271,23 @@ static int decode_locker(void **p, voidif (ret)return ret; - *p +=sizeof (struct ceph_timespec );/* skip expiration */ +/* skip expiration */ +ceph_decode_skip_n (p, end,sizeof (struct ceph_timespec ), bad); ret =ceph_decode_entity_addr (p, end, &locker->info.addr);if (ret)return ret; - len =ceph_decode_32 (p); - *p += len;/* skip description */ +/* skip description */ +ceph_decode_skip_string (p, end, bad);dout ("%s %s%llu cookie %s addr %s\n" , __func__,ENTITY_NAME (locker->id.name), locker->id.cookie,ceph_pr_addr (&locker->info.addr));return 0 ; + +bad: +return -EINVAL ; } static int decode_lockers(void **p, void *end, u8 *type, char **tag,
Greg Kroah-Hartman
maintainerPATCH 32/303 ftrace: Fix off-by-one fentry site disable in ftrace_free_mem()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <[email protected]>
commit 8b8292d6487c81bd57c2605a9b404b1cf8f1edfb upstream.
When a module's init text is freed, do_init_module() calls ftrace_free_mem() with a half-open [start, end) range. However the ftrace_cmp_recs() comparator treats the upper bound as inclusive, as all its other users do, passing 'ip + size - 1'. So ftrace_free_mem() can delete a record sitting exactly at 'end', which is outside the freed range.
For a kernel without CFI or IBT, the first record of a function is at the function start, which for the first function in a module is also the base of its text allocation. As the module allocator packs its regions, that address is often the 'end' passed by a neighboring module's do_init_module(), causing the first function's ftrace location to get disabled, preventing an attempt to livepatch it:
livepatch: failed to find location for function 'pcspkr_probe'
Convert the exclusive end to the inclusive 'end - 1' the comparator expects, and return early for an empty range to avoid the subtraction from underflowing when the init text size is zero.
--- kernel/trace/ftrace.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
kernel/trace/ftrace.c +5 -1
@@ -7384,7 +7384,8 @@ static void add_to_clear_hash_list(strucvoid ftrace_free_mem (struct module *mod,void *start_ptr,void *end_ptr) {unsigned long start = (unsigned long )(start_ptr); -unsigned long end = (unsigned long )(end_ptr); +/* end is inclusive and end_ptr is exclusive */ +unsigned long end = (unsigned long )(end_ptr) -1 ;struct ftrace_page **last_pg = &ftrace_pages_start;struct ftrace_page *tmp_page =NULL ;struct ftrace_page *pg;
@@ -7396,6 +7397,9 @@ void ftrace_free_mem(struct module *mod,INIT_LIST_HEAD (&clear_hash); +if (start_ptr >= end_ptr) +return ; + key.ip = start; key.flags = end;/* overload flags, as it is unsigned long */
Greg Kroah-Hartman
maintainerPATCH 33/303 openrisc: signal: do not restore privileged SR bits on sigreturn
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ali Ahmet Memis <[email protected]>
commit 32ef1b30ad736519f7a207bcc2986f3d4129d972 upstream.
restore_sigcontext() copies the whole supervision register (SR) from the signal frame and only clears SPR_SR_SM before the value is reloaded into the hardware SR (through ESR and l.rfe) on the return to user space. All other SR bits are left under user control.
An unprivileged task can thus return from a signal handler through a crafted sigframe that clears SPR_SR_DME. With the data MMU disabled the CPU performs no translation or protection on data accesses, so the task gains read and write access to arbitrary physical memory, a local privilege escalation. SPR_SR_IME, SPR_SR_SUMRA, SPR_SR_LEE, SPR_SR_EPH and the cache-enable bits are exposed the same way. The ptrace GPR regset already refuses any change to SR for exactly this reason.
Restore only the arithmetic flag bits (F, CY, OV) from the signal frame and take every privileged control bit from the SR the kernel saved on signal entry.
Verified with qemu-system-or1k -M or1k-sim: before this change an unprivileged PoC clears SPR_SR_DME in rt_sigreturn and writes a marker to physical address 0x03000000 (beyond the kernel's mem=32M); afterwards the same PoC receives SIGSEGV and physical memory is unchanged.
--- arch/openrisc/include/asm/processor.h | 2 ++ arch/openrisc/kernel/signal.c | 5 +++-- 2 files changed, 5 insertions(+), 2 deletions(-)
arch/openrisc/include/asm/processor.h +2 -0
@@ -26,6 +26,8 @@ | SPR_SR_DCE | SPR_SR_SM)#define USER_SR (SPR_SR_DME | SPR_SR_IME | SPR_SR_ICE \ | SPR_SR_DCE | SPR_SR_IEE | SPR_SR_TEE) +/* SR bits user space may change via sigreturn, the rest stay kernel owned */ +#define SPR_SR_USER_MASK (SPR_SR_F | SPR_SR_CY | SPR_SR_OV)/* * User space process size. This is hardcoded into a few places,
arch/openrisc/kernel/signal.c +3 -2
@@ -37,6 +37,7 @@ struct rt_sigframe {static int restore_sigcontext (struct pt_regs *regs,struct sigcontext __user *sc) { +unsigned long old_sr = regs->sr;int err =0 ;/* Always make any pending restarted system calls return -EINTR */
@@ -51,8 +52,8 @@ static int restore_sigcontext(struct pt_ err |=__copy_from_user (®s->pc, &sc->regs.pc,sizeof (unsigned long )); err |=__copy_from_user (®s->sr, &sc->regs.sr,sizeof (unsigned long )); -/* make sure the SM-bit is cleared so user-mode cannot fool us */ - regs->sr &= ~SPR_SR_SM ; +/* keep the privileged SR bits kernel owned, restore only user flags */ + regs->sr = (old_sr & ~SPR_SR_USER_MASK ) | (regs->sr &SPR_SR_USER_MASK ); regs->orig_gpr11 =-1 ;/* Avoid syscall restart checks */
Greg Kroah-Hartman
maintainerPATCH 34/303 Input: sur40 - fix input device registration ordering
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
commit 9da976eb649c9e2f588a4499410e4d8af687925f upstream.
In sur40_probe(), input_register_device() was previously called early before the V4L2 video device and vb2_queue components were fully initialized. If userspace opened the input device immediately upon registration, sur40_open() would trigger and start the sur40_poll() worker thread. This worker thread invokes sur40_process_video() and accesses the uninitialized vb2_queue structure, leading to a data race and potential system crash.
Furthermore, if V4L2 or video registration failed after input_register_device() succeeded, the error path fell through to calling input_free_device() on a successfully registered device instead of input_unregister_device(), corrupting input core state.
Move input_register_device() to the very end of sur40_probe(). This ensures the V4L2 and video queue structures are fully initialized before polling can start, and naturally resolves the error path bug since input_free_device() is now only called when input registration has not yet occurred.
To maintain strict LIFO (Last-In, First-Out) teardown ordering, also move input_unregister_device() to the very beginning of sur40_disconnect(). This guarantees that the input polling worker thread is stopped before V4L2 video components or control handlers are unregistered.
--- drivers/input/touchscreen/sur40.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-)
drivers/input/touchscreen/sur40.c +11 -10
@@ -725,21 +725,13 @@ static int sur40_probe(struct usb_interf goto err_free_input; } -/* register the polled input device */ - error =input_register_device (input); -if (error) { -dev_err (&interface->dev, -"Unable to register polled input device." ); - goto err_free_buffer; - } -/* register the video master device */ snprintf (sur40->v4l2.name,sizeof (sur40->v4l2.name),"%s" ,DRIVER_LONG ); error =v4l2_device_register (sur40->dev, &sur40->v4l2);if (error) {dev_err (&interface->dev,"Unable to register video master device." ); - goto err_unreg_v4l2; + goto err_free_buffer; }/* initialize the lock and subdevice */
@@ -798,6 +790,14 @@ static int sur40_probe(struct usb_interf goto err_unreg_video; } +/* register the polled input device */ + error =input_register_device (input); +if (error) { +dev_err (&interface->dev, +"Unable to register polled input device." ); + goto err_unreg_video; + } +/* we can register the device now, as it is ready */ usb_set_intfdata (interface, sur40);dev_dbg (&interface->dev,"%s is now attached\n" ,DRIVER_DESC );
@@ -823,11 +823,12 @@ static void sur40_disconnect(struct usb_ {struct sur40_state *sur40 =usb_get_intfdata (interface); +input_unregister_device (sur40->input); +v4l2_ctrl_handler_free (&sur40->hdl);video_unregister_device (&sur40->vdev);v4l2_device_unregister (&sur40->v4l2); -input_unregister_device (sur40->input);kfree (sur40->bulk_in_buffer);kfree (sur40);
Greg Kroah-Hartman
maintainerPATCH 35/303 Input: sur40 - fix V4L error path cleanup
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
commit 062dc4693e2c10d77de06f61e6f3faf37c0a8383 upstream.
In sur40_probe(), if video_register_device() fails, the error path jumps to err_unreg_video. This incorrectly attempts to unregister a video device that was never successfully registered, and fails to free the V4L2 control handler (v4l2_ctrl_handler_free) that was initialized immediately prior.
Fix this by introducing an err_free_ctrl label to properly free the V4L2 control handler and bypass video_unregister_device() when video device registration fails.
--- drivers/input/touchscreen/sur40.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/input/touchscreen/sur40.c +3 -1
@@ -787,7 +787,7 @@ static int sur40_probe(struct usb_interfif (error) {dev_err (&interface->dev,"Unable to register video subdevice." ); - goto err_unreg_video; + goto err_free_ctrl; }/* register the polled input device */
@@ -806,6 +806,8 @@ static int sur40_probe(struct usb_interf err_unreg_video:video_unregister_device (&sur40->vdev); +err_free_ctrl: +v4l2_ctrl_handler_free (&sur40->hdl); err_unreg_v4l2:v4l2_device_unregister (&sur40->v4l2); err_free_buffer:
Greg Kroah-Hartman
maintainerPATCH 36/303 libceph: Avoid using invalid osd indices from primary_temp
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raphael Zimmer <[email protected]>
commit 3660b98d1204b419f6a77e9a295f148dcf38d042 upstream.
A corrupted osdmap received from a Ceph monitor or OSD may contain osd indices in its pg_temp, primary_temp, pg_upmap, and pg_upmap_items parts that don't exist, i.e., that are greater than max_osd or smaller than CEPH_HOMELESS_OSD (-1). These indices are used to create the up and acting set in ceph_pg_to_up_acting_osds(), called from calc_target(). While most of these osd indices are checked, the one from primary_temp is not. Subsequently, this may lead to calc_target() returning this (potentially invalid) index as target osd for a (linger) request. Because the osd_state, osd_weight, and osd_addr arrays only contain max_osd entries (with indices 0 to max_osd -1), this leads to out-of-bounds accesses when trying to read values from these arrays.
This patch fixes the issue by adding a check to get_temp_osds(), so that only valid osd indices from primary_temp are used, and it falls back to using the primary from pg_temp or the up set if it is invalid.
[ idryomov: changelog ]
--- net/ceph/osdmap.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/ceph/osdmap.c +3 -2
@@ -2811,9 +2811,10 @@ static void get_temp_osds(struct ceph_os } } -/* primary_temp? */ +/* primary_temp? (shouldn't ever be a nonexistent or down OSD) */ pg =lookup_pg_mapping (&osdmap->primary_temp, pgid); -if (pg) +if (pg && !WARN_ON_ONCE (ceph_osd_is_down (osdmap, + pg->primary_temp.osd))) temp->primary = pg->primary_temp.osd; }
Greg Kroah-Hartman
maintainerPATCH 37/303 ceph: fix MDS random selection readiness predicate
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yiming Zhu <[email protected]>
commit 2c11c4bfdb7bd2808b3b3ac228e1f2d9bcf25457 upstream.
CEPH_MDS_IS_READY() is parsed so that the ternary expression can return true for an MDS entry with state 0 when it is not laggy. This allows the random selector to choose a down/DNE rank.
Group the ternary expression under the state check so zero-state ranks are not treated as ready.
--- fs/ceph/mdsmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ceph/mdsmap.c +1 -1
@@ -14,7 +14,7 @@#include "super.h" #define CEPH_MDS_IS_READY (i, ignore_laggy) \ - (m->m_info[i].state > 0 && ignore_laggy ? true : !m->m_info[i].laggy) + (m->m_info[i].state > 0 && (ignore_laggy ? true : !m->m_info[i].laggy))static int __mdsmap_get_random_mds (struct ceph_mdsmap *m,bool ignore_laggy) {
Greg Kroah-Hartman
maintainerPATCH 38/303 libceph: tolerate addrvecs with multiple entries of the same type
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kefu Chai <[email protected]>
commit 5a87925539acecfe88229bad76ab81bd75a7e3f5 upstream.
ceph_decode_entity_addrvec() rejects any addrvec containing more than one entry that matches the requested msgr type (LEGACY or MSGR2), logging "another match of type N in addrvec" and returning -EINVAL.
Some admin tooling (e.g. pveceph mon create from Proxmox VE) generates addrvecs with multiple same-type entries when public_network lists more than one CIDR: it picks one local IP per subnet and emits both a v2 and a v1 entry for each IP. Monmaps shaped this way cause:
libceph: mon0 (1)10.10.10.15:6789 session established
libceph: another match of type 1 in addrvec
libceph: problem decoding monmap, -22
No Ceph code uses the extra entries: since Nautilus, the userspace messenger (AsyncMessenger) unconditionally picks the first address of the requested type and ignores any subsequent matches.
Match that behavior: use the first matching entry and silently skip any subsequent ones. This is a compatibility fix for existing deployments and does not enable dual-stack or multi-subnet address selection.
[ idryomov: tweak ceph_decode_entity_addrvec() comment ]
--- net/ceph/decode.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
net/ceph/decode.c +9 -9
@@ -87,8 +87,9 @@ bad:EXPORT_SYMBOL (ceph_decode_entity_addr);/* -* Return addr of desired type (MSGR2 or LEGACY) or error. -* Make sure there is only one match. +* Return addr of desired type (MSGR2 or LEGACY) or error. In case of +* multiple matches, use the first one for compatibility with userspace +* messenger. * * Assume encoding with MSG_ADDR2. */
@@ -121,14 +122,13 @@ int ceph_decode_entity_addrvec(void **p,dout ("%s i %d addr %s\n" , __func__, i,ceph_pr_addr (&tmp_addr));if (tmp_addr.type == my_type) { -if (found) { -pr_err ("another match of type %d in addrvec\n" , -le32_to_cpu (my_type)); -return -EINVAL ; +if (!found) { +memcpy (addr, &tmp_addr,sizeof (*addr)); + found = true; + }else { +dout ("%s skipping extra match of type %d in addrvec\n" , + __func__,le32_to_cpu (my_type)); } - -memcpy (addr, &tmp_addr,sizeof (*addr)); - found = true; } }
Greg Kroah-Hartman
maintainerPATCH 39/303 mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhan Xusheng <[email protected]>
commit f64ea900e4bda3055ef24a2c906f8d049cf1c3bd upstream.
omap_hsmmc_prepare_data() converts the command busy timeout to nanoseconds with:
timeout = req->cmd->busy_timeout * NSEC_PER_MSEC;
busy_timeout is an unsigned int (milliseconds) and timeout is a u64, but NSEC_PER_MSEC is 1000000L. On 32-bit builds the multiplication is performed in 32-bit arithmetic and wraps for busy_timeout values above ~4294 ms, before the result is assigned to the u64.
The driver does not set mmc->max_busy_timeout, so the core does not cap the busy timeout, and commands such as erase or SANITIZE (MMC_SANITIZE_TIMEOUT_MS is 240000 ms) can pass a busy_timeout far larger than 4294 ms. The wrapped, much smaller ns value is then programmed via set_data_timeout(), so the data timeout is set too short and the operation can time out prematurely.
Cast busy_timeout to u64 before the multiplication so the conversion is done in 64-bit arithmetic.
--- drivers/mmc/host/omap_hsmmc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mmc/host/omap_hsmmc.c +1 -1
@@ -1358,7 +1358,7 @@ omap_hsmmc_prepare_data(struct omap_hsmmif (req->data ==NULL ) {OMAP_HSMMC_WRITE (host->base,BLK ,0 );if (req->cmd->flags &MMC_RSP_BUSY ) { - timeout = req->cmd->busy_timeout *NSEC_PER_MSEC ; + timeout = (u64 )req->cmd->busy_timeout *NSEC_PER_MSEC ;/* * Set an arbitrary 100ms data timeout for commands with
Greg Kroah-Hartman
maintainerPATCH 40/303 mmc: sdhci: unmap the bounce buffer before device release
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <[email protected]>
commit 9e9f561269dff35e6f84ed21776ec37fd6360b03 upstream.
sdhci_allocate_bounce_buffer() allocates its buffer with devm_kmalloc() but maps it with dma_map_single(). The buffer is therefore released by devres without the streaming DMA mapping being unmapped.
Register a managed action after dma_map_single() succeeds so the mapping is removed before devres releases the buffer. The action is registered only for buffers allocated and mapped by the SDHCI core, leaving buffers provided by host drivers under their existing ownership.
--- drivers/mmc/host/sdhci.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
drivers/mmc/host/sdhci.c +16 -0
@@ -4178,6 +4178,14 @@ void __sdhci_read_caps(struct sdhci_host }EXPORT_SYMBOL_GPL (__sdhci_read_caps); +static void sdhci_unmap_bounce_buffer (void *data) +{ +struct sdhci_host *host = data; + +dma_unmap_single (mmc_dev (host->mmc), host->bounce_addr, + host->bounce_buffer_size,DMA_BIDIRECTIONAL ); +} +static void sdhci_allocate_bounce_buffer (struct sdhci_host *host) {struct mmc_host *mmc = host->mmc;
@@ -4232,6 +4240,14 @@ static void sdhci_allocate_bounce_buffer } host->bounce_buffer_size = bounce_size; + ret =devm_add_action_or_reset (mmc_dev (mmc), + sdhci_unmap_bounce_buffer, host); +if (ret) { +devm_kfree (mmc_dev (mmc), host->bounce_buffer); + host->bounce_buffer =NULL ; + host->bounce_buffer_size =0 ; +return ; + }/* Lie about this since we're bouncing */ mmc->max_segs = max_blocks;
Greg Kroah-Hartman
maintainerPATCH 41/303 mmc: sdhci: make tuning_err a signed int
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haibo Chen <[email protected]>
commit ae31bcc92bb42502bb7c9029e6dc7a824cf6cd14 upstream.
Coverity report INTEGER_OVERFLOW for host->tuning_err.
The tuning_err field in struct sdhci_host is used to store an error code for re-tuning, but it was declared as unsigned int. Several call sites store negative error codes into it and later compare against negative values:
- sdhci.c, sdhci-of-dwcmshc.c and sdhci-pci-gli.c assign it the
return value of __sdhci_execute_tuning()/__sdhci_execute_tuning_9750(),
both of which return a signed int (possibly a negative errno);
- sdhci-of-esdhc.c assigns host->tuning_err = -EAGAIN and later does
"ret = host->tuning_err; if (ret == -EAGAIN ...)"; - sdhci-of-dwcmshc.c prints it with the %d (signed) conversion.
Storing a negative errno in an unsigned int and reading it back as a signed int only happens to work because of two's-complement, same-width integer conversions. It is misleading and triggers sign-conversion warnings. All users treat the value either as a signed error code or as a boolean (zero / non-zero), so changing the type to a signed int is safe and makes the intent explicit.
--- drivers/mmc/host/sdhci.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mmc/host/sdhci.h +1 -1
@@ -601,7 +601,7 @@ struct sdhci_host {unsigned int tuning_count;/* Timer count for re-tuning */ unsigned int tuning_mode;/* Re-tuning mode supported by host */ -unsigned int tuning_err;/* Error code for re-tuning */ +int tuning_err;/* Error code for re-tuning */ #define SDHCI_TUNING_MODE_1 0#define SDHCI_TUNING_MODE_2 1#define SDHCI_TUNING_MODE_3 2
Greg Kroah-Hartman
maintainerPATCH 42/303 mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pei Xiao <[email protected]>
commit c125ee35a49a0518521b52b27631eef061b8719a upstream.
In atmci_probe, &host->bh_work is bound with atmci_work_func, and atmci_interrupt, atmci_timeout_timer and atmci_dma_complete can all queue this work on system_bh_wq.
If we remove the module, atmci_remove makes cleanup and the memory allocated for host with devm_kzalloc() is released after the remove callback returns, while the work mentioned above may still be pending or running. The sequence of operations that may lead to a UAF bug is as follows:
CPU0 CPU1
| atmci_interrupt
| queue_work(system_bh_wq,
| &host->bh_work)
atmci_remove |
atmci_cleanup_slot(...) |
atmci_writel(host, ATMCI_IDR, ~0UL) |
timer_delete_sync(&host->timer) |
dma_release_channel(host->dma.chan) |
free_irq(platform_get_irq(pdev, 0), host) |
| atmci_work_func
| // use host
// devm resources released after |
// remove returns, host is freed |
| // use host (use-after-free)Fix it by canceling the work after all the sources that can schedule it (IRQ handler, timeout timer and DMA completion callback) have been stopped, and before proceeding with the remaining cleanup in atmci_remove.
--- drivers/mmc/host/atmel-mci.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/mmc/host/atmel-mci.c +2 -0
@@ -2628,6 +2628,8 @@ static int atmci_remove(struct platform_free_irq (platform_get_irq (pdev,0 ), host); +cancel_work_sync (&host->bh_work); +clk_disable_unprepare (host->mck);pm_runtime_disable (&pdev->dev);
Greg Kroah-Hartman
maintainerPATCH 43/303 drm/radeon: fix autosuspend cleanup during teardown
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <[email protected]>
commit 587be7a17358ef8c0106775fcedae5a7bef50735 upstream.
radeon_driver_load_kms() calls pm_runtime_use_autosuspend() for PX devices, but radeon_driver_unload_kms() does not call the matching pm_runtime_dont_use_autosuspend() during teardown.
If the autosuspend delay is set to a negative value while autosuspend is enabled, the runtime PM core increments usage_count to prevent runtime suspend. Without calling pm_runtime_dont_use_autosuspend() during teardown, this reference is not dropped.
The documentation for pm_runtime_use_autosuspend() also notes that it is important to undo it with pm_runtime_dont_use_autosuspend() at driver exit time, unless runtime PM was initially enabled with devm_pm_runtime_enable().
Add the missing pm_runtime_dont_use_autosuspend() call to the driver unload path.
This issue was found by manual code inspection.
--- drivers/gpu/drm/radeon/radeon_kms.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/radeon/radeon_kms.c +1 -0
@@ -72,6 +72,7 @@ void radeon_driver_unload_kms(struct drmif (radeon_is_px (dev)) {pm_runtime_get_sync (dev->dev);pm_runtime_forbid (dev->dev); +pm_runtime_dont_use_autosuspend (dev->dev); }radeon_acpi_fini (rdev);
Greg Kroah-Hartman
maintainerPATCH 44/303 s390/vfio_ccw: Ensure index for read/write regions are within range
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Farman <[email protected]>
commit 9f5f9a78fedc45bc29d6a0a64e3a3472361afae5 upstream.
The introduction of the capability chain rightly clamped the region indexes to the range of the capabilities itself, but neglected to do so for the existing read/write regions which should also be enforced.
--- drivers/s390/cio/vfio_ccw_async.c | 16 ++++++++++++++++ drivers/s390/cio/vfio_ccw_chp.c | 15 +++++++++++++++ drivers/s390/cio/vfio_ccw_ops.c | 7 +++---- 3 files changed, 34 insertions(+), 4 deletions(-)
drivers/s390/cio/vfio_ccw_async.c +16 -0
@@ -8,6 +8,7 @@*/ #include <linux/vfio.h> +#include <linux/nospec.h> #include "vfio_ccw_private.h"
@@ -24,11 +25,20 @@ static ssize_t vfio_ccw_async_region_reareturn -EINVAL ;mutex_lock (&private->io_mutex); + +if (i >= private->num_regions) { + ret = -EINVAL ; + goto out_unlock; + } + + i =array_index_nospec (i, private->num_regions); region = private->region[i].data;if (copy_to_user (buf, (void *)region + pos, count)) ret = -EFAULT ;else ret = count; + +out_unlock:mutex_unlock (&private->io_mutex);return ret; }
@@ -48,6 +58,12 @@ static ssize_t vfio_ccw_async_region_wriif (!mutex_trylock (&private->io_mutex))return -EAGAIN ; +if (i >= private->num_regions) { + ret = -EINVAL ; + goto out_unlock; + } + + i =array_index_nospec (i, private->num_regions); region = private->region[i].data;if (copy_from_user ((void *)region + pos, buf, count)) { ret = -EFAULT ;
drivers/s390/cio/vfio_ccw_chp.c +15 -0
@@ -9,6 +9,7 @@*/ #include <linux/slab.h> +#include <linux/nospec.h> #include <linux/vfio.h> #include "vfio_ccw_private.h"
@@ -25,6 +26,13 @@ static ssize_t vfio_ccw_schib_region_reareturn -EINVAL ;mutex_lock (&private->io_mutex); + +if (i >= private->num_regions) { + ret = -EINVAL ; + goto out; + } + + i =array_index_nospec (i, private->num_regions); region = private->region[i].data;if (cio_update_schib (private->sch)) {
@@ -96,6 +104,12 @@ static ssize_t vfio_ccw_crw_region_read(list_del (&crw->next);mutex_lock (&private->io_mutex); +if (i >= private->num_regions) { + ret = -EINVAL ; + goto out; + } + + i =array_index_nospec (i, private->num_regions); region = private->region[i].data;if (crw)
@@ -108,6 +122,7 @@ static ssize_t vfio_ccw_crw_region_read( region->crw =0 ; +out:mutex_unlock (&private->io_mutex);kfree (crw);
drivers/s390/cio/vfio_ccw_ops.c +3 -4
@@ -203,6 +203,7 @@ static ssize_t vfio_ccw_mdev_read(structreturn vfio_ccw_mdev_read_io_region (private, buf, count, ppos);default : index -=VFIO_CCW_NUM_REGIONS ; + index =array_index_nospec (index, private->num_regions);return private->region[index].ops->read (private, buf, count, ppos); }
@@ -255,6 +256,7 @@ static ssize_t vfio_ccw_mdev_write(strucreturn vfio_ccw_mdev_write_io_region (private, buf, count, ppos);default : index -=VFIO_CCW_NUM_REGIONS ; + index =array_index_nospec (index, private->num_regions);return private->region[index].ops->write (private, buf, count, ppos); }
@@ -297,11 +299,8 @@ static int vfio_ccw_mdev_get_region_info VFIO_CCW_NUM_REGIONS + private->num_regions)return -EINVAL ; - info->index =array_index_nospec (info->index, -VFIO_CCW_NUM_REGIONS + - private->num_regions); - i = info->index -VFIO_CCW_NUM_REGIONS ; + i =array_index_nospec (i, private->num_regions); info->offset =VFIO_CCW_INDEX_TO_OFFSET (info->index); info->size = private->region[i].size;
Greg Kroah-Hartman
maintainerPATCH 45/303 s390/vfio_ccw: Fix out of bounds check on CCW array
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Farman <[email protected]>
commit a005b7f1a491ffda61bff0fd0f6548f8986fb977 upstream.
The routine ccwchain_calc_length() counts the number of channel command words (CCWs) that are chained together in a single channel program, and rejects anything larger than CCWCHAIN_LEN_MAX (256) CCWs.
The loop itself is "do..while (count < 257)", and while the logic in is_cpa_within_range() correctly adjusts between the 0-index array of CCWs and the count of CCWs starting at 1, this means it would look at a possible 257th CCW before ending the loop and (correctly) returning an error.
Fix this by restructuring the loop to break as soon as 256 CCWs (thus indexes 0-255) are examined, without looking at memory outside the range.
--- drivers/s390/cio/vfio_ccw_cp.c | 17 +++++------------ 1 file changed, 5 insertions(+), 12 deletions(-)
drivers/s390/cio/vfio_ccw_cp.c +5 -12
@@ -413,11 +413,9 @@ static void ccwchain_cda_free(struct ccwstatic int ccwchain_calc_length (u64 iova,struct channel_program *cp) {struct ccw1 *ccw = cp->guest_cp; -int cnt =0 ; - - do { - cnt++; +int cnt; +for (cnt =1 ; cnt <=CCWCHAIN_LEN_MAX ; cnt++, ccw++) {/* * As we don't want to fail direct addressing even if the * orb specified one of the unsupported formats, we defer
@@ -435,15 +433,10 @@ static int ccwchain_calc_length(u64 iova* after the TIC, depending on the results of its operation. */ if (!ccw_is_chain (ccw) && !is_tic_within_range (ccw, iova, cnt)) -break ; - - ccw++; - }while (cnt <CCWCHAIN_LEN_MAX +1 ); - -if (cnt ==CCWCHAIN_LEN_MAX +1 ) - cnt = -EINVAL ; +return cnt; + } -return cnt; +return -EINVAL ; }static int tic_target_chain_exists (struct ccw1 *tic,struct channel_program *cp)
Greg Kroah-Hartman
maintainerPATCH 46/303 drm/amdgpu: Reject UVD message with invalid number of h265 refs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Rosca <[email protected]>
commit 9fca434208f1f9ab977feac62df8ebb1cc7ce893 upstream.
Same change as for h264, avoids overflow later when calculating min dpb size.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c +3 -0
@@ -778,6 +778,9 @@ static int amdgpu_uvd_cs_msg_decode(stru image_size =ALIGN (image_size,256 ); num_dpb_buffer = (le32_to_cpu (msg[59 ]) &0xff ) +2 ; +if (num_dpb_buffer >17 ) +return -EINVAL ; + min_dpb_size = image_size * num_dpb_buffer; min_ctx_size = ((width +255 ) /16 ) * ((height +255 ) /16 ) *16 * num_dpb_buffer +52 *1024 ;
Greg Kroah-Hartman
maintainerPATCH 47/303 drm/amdgpu: validate GEM_CREATE domain combinations
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Candice Li <[email protected]>
commit 5e9d136ad74df4edec67e502ce267597064d8f86 upstream.
AMDGPU_GEM_CREATE checked domain bits against AMDGPU_GEM_DOMAIN_MASK, but did not validate domain combinations. Userspace could combine CPU|GTT|VRAM with DOORBELL, GDS, GWS, or OA, making amdgpu_bo_placement_from_domain() exceed AMDGPU_BO_MAX_PLACEMENTS and hit BUG_ON().
Allow combinations only within CPU/GTT/VRAM, and require non-CPU/GTT/ VRAM domains to be specified one at a time. Return -EINVAL for invalid combinations in amdgpu_gem_create_ioctl().
v2: Rename helper from amdgpu_gem_domain_valid() to
amdgpu_gem_are_domains_valid() (Christian)
--- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c +21 -0
@@ -273,6 +273,25 @@ static const struct drm_gem_object_funcs .vm_ops = &amdgpu_gem_vm_ops, }; +static bool amdgpu_gem_are_domains_valid (u32 domains) +{ +u32 normal =AMDGPU_GEM_DOMAIN_CPU | +AMDGPU_GEM_DOMAIN_GTT | +AMDGPU_GEM_DOMAIN_VRAM ; +/* Treat all non CPU/GTT/VRAM domains as special domains. */ +u32 special =AMDGPU_GEM_DOMAIN_MASK & ~normal; +u32 normal_mask = domains & normal; +u32 special_mask = domains & special; + +if (!special_mask) +return true; + +if (normal_mask) +return false; + +return !(special_mask & (special_mask -1 )); +} +/* * GEM ioctls. */
@@ -304,6 +323,8 @@ int amdgpu_gem_create_ioctl(struct drm_d/* reject invalid gem domains */ if (args->in.domains & ~AMDGPU_GEM_DOMAIN_MASK )return -EINVAL ; +if (!amdgpu_gem_are_domains_valid (args->in.domains)) +return -EINVAL ;if (!amdgpu_is_tmz (adev) && (flags &AMDGPU_GEM_CREATE_ENCRYPTED )) {DRM_NOTE_ONCE ("Cannot allocate secure buffer since TMZ is disabled\n" );
Greg Kroah-Hartman
maintainerPATCH 48/303 drm/amdgpu: Reject UVD message with dimensions above 4096
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Rosca <[email protected]>
commit 8c9aebcdd9f46f7a14b98d6ab18574b7a48fbb08 upstream.
Fixes potential overflow in DPB size calculations.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c +2 -2
@@ -630,8 +630,8 @@ static int amdgpu_uvd_cs_msg_decode(struunsigned image_size, tmp, min_dpb_size, num_dpb_buffer;unsigned min_ctx_size = ~0 ; -/* Reject invalid dimensions to prevent division by zero */ -if (width <16 || height <16 ) { +/* Reject invalid dimensions */ +if (width <16 || height <16 || width >4096 || height >4096 ) {dev_WARN_ONCE (adev->dev,1 ,"Invalid UVD decoding dimensions (%dx%d)!\n" , width, height);
Greg Kroah-Hartman
maintainerPATCH 49/303 drm/amdgpu: Implement insert_end for VCE 3
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Rosca <[email protected]>
commit d5ab4c6a64efef2d143a96df5357f59703cd703d upstream.
After a recent change VCE now hangs when VCE_CMD_END is emitted after a pipeline sync without VM flush.
Implement insert_end to correctly insert only one VCE_CMD_END per job.
--- drivers/gpu/drm/amd/amdgpu/vce_v3_0.c | 26 ++++++++++++++++++++++---- 1 file changed, 22 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/amdgpu/vce_v3_0.c +22 -4
@@ -873,6 +873,23 @@ static void vce_v3_0_ring_emit_ib(structamdgpu_ring_write (ring, ib->length_dw); } +static void vce_v3_0_ring_emit_fence (struct amdgpu_ring *ring,u64 addr, +u64 seq,unsigned flags) +{ +WARN_ON (flags &AMDGPU_FENCE_FLAG_64BIT ); + +amdgpu_ring_write (ring,VCE_CMD_FENCE ); +amdgpu_ring_write (ring, addr); +amdgpu_ring_write (ring,upper_32_bits (addr)); +amdgpu_ring_write (ring, seq); +amdgpu_ring_write (ring,VCE_CMD_TRAP ); +} + +static void vce_v3_0_ring_insert_end (struct amdgpu_ring *ring) +{ +amdgpu_ring_write (ring,VCE_CMD_END ); +} +static void vce_v3_0_emit_vm_flush (struct amdgpu_ring *ring,unsigned int vmid,uint64_t pd_addr) {
@@ -882,7 +899,6 @@ static void vce_v3_0_emit_vm_flush(strucamdgpu_ring_write (ring,VCE_CMD_FLUSH_TLB );amdgpu_ring_write (ring, vmid); -amdgpu_ring_write (ring,VCE_CMD_END ); }static void vce_v3_0_emit_pipeline_sync (struct amdgpu_ring *ring)
@@ -952,17 +968,19 @@ static const struct amdgpu_ring_funcs vc .set_wptr = vce_v3_0_ring_set_wptr, .parse_cs = amdgpu_vce_ring_parse_cs_vm, .emit_frame_size = -6 +/* vce_v3_0_emit_vm_flush */ +5 +/* vce_v3_0_emit_vm_flush */ 4 +/* vce_v3_0_emit_pipeline_sync */ - 6 + 6, /* amdgpu_vce_ring_emit_fence x2 vm fence */ +5 +5 +/* vce_v3_0_ring_emit_fence x2 vm fence */ + 1, /* vce_v3_0_ring_insert_end */ .emit_ib_size = 5, /* vce_v3_0_ring_emit_ib */ .emit_ib = vce_v3_0_ring_emit_ib, .emit_vm_flush = vce_v3_0_emit_vm_flush, .emit_pipeline_sync = vce_v3_0_emit_pipeline_sync, - .emit_fence = amdgpu_vce_ring_emit_fence, + .emit_fence = vce_v3_0_ring_emit_fence, .test_ring = amdgpu_vce_ring_test_ring, .test_ib = amdgpu_vce_ring_test_ib, .insert_nop = amdgpu_ring_insert_nop, + .insert_end = vce_v3_0_ring_insert_end, .pad_ib = amdgpu_ring_generic_pad_ib, .begin_use = amdgpu_vce_ring_begin_use, .end_use = amdgpu_vce_ring_end_use,
Greg Kroah-Hartman
maintainerPATCH 50/303 drm/amdgpu: Fix UVD decode image min size calculation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Rosca <[email protected]>
commit b8bb9ba3f101a1b0011f785a577a4a0a38371174 upstream.
This needs to use pitch instead of width. Also reject pitch over 4096 to avoid overflow.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c +2 -2
@@ -791,7 +791,7 @@ static int amdgpu_uvd_cs_msg_decode(strureturn -EINVAL ; } -if (width > pitch) { +if (width > pitch || pitch >4096 ) {DRM_ERROR ("Invalid UVD decoding target pitch!\n" );return -EINVAL ; }
@@ -803,7 +803,7 @@ static int amdgpu_uvd_cs_msg_decode(stru } buf_sizes[0x1 ] = dpb_size; - buf_sizes[0x2 ] = image_size; + buf_sizes[0x2 ] = (pitch * height) *3 /2 ; buf_sizes[0x4 ] = min_ctx_size;/* store image width to adjust nb memory pstate */ adev->uvd.decode_image_width = width;
Greg Kroah-Hartman
maintainerPATCH 51/303 xfs: fix ilock leak on error in xfs_dq_get_next_id
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Long Li <[email protected]>
commit 63320a0f70f66f311f4bccff3af0719c2119f46c upstream.
xfs_dq_get_next_id() takes the quota inode ILOCK before calling xfs_iread_extents(). If xfs_iread_extents() fails, the function returns immediately without releasing the lock, leaking the quota inode ILOCK. This can leave the quota inode locked and cause subsequent quota operations to hang.
Fix this by jumping to a common unlock path on error instead of returning directly.
--- fs/xfs/xfs_dquot.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/xfs/xfs_dquot.c +2 -1
@@ -723,7 +723,7 @@ xfs_dq_get_next_id( lock_flags =xfs_ilock_data_map_shared (quotip); error =xfs_iread_extents (NULL , quotip,XFS_DATA_FORK );if (error) -return error; + goto out_unlock;if (xfs_iext_lookup_extent (quotip, "ip->i_df, start, &cur, &got)) {/* contiguous chunk, bump startoff for the id calculation */
@@ -734,6 +734,7 @@ xfs_dq_get_next_id( error = -ENOENT ; } +out_unlock:xfs_iunlock (quotip, lock_flags);return error;
Greg Kroah-Hartman
maintainerPATCH 52/303 xfs: dont swallow dquot recovery verification errors
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Long Li <[email protected]>
commit e2b4a856085e9bd939bde2dee0d08b1d41babde9 upstream.
xlog_recover_dquot_commit_pass2() validates the recovered dquot with xfs_dqblk_verify() and, on failure, sets error = -EFSCORRUPTED and jumps to out_release. But out_release unconditionally returns 0, so the corruption error is discarded: the caller xlog_recover_items_pass2() sees success, log recovery proceeds as if the dquot were valid, and the corrupt quota buffer can be written back to disk.
--- fs/xfs/xfs_dquot_item_recover.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/xfs/xfs_dquot_item_recover.c +1 -1
@@ -173,7 +173,7 @@ xlog_recover_dquot_commit_pass2( out_release:xfs_buf_relse (bp); -return 0 ; +return error; }const struct xlog_recover_item_ops xlog_dquot_item_ops = {
Greg Kroah-Hartman
maintainerPATCH 53/303 xfs: check v5 superblock features early
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
commit eb6b2cc1fc8ad566d746d128a559989ff0bba5cc upstream.
When working on a new features that reuses the existing pad in the superblock, I noticed that mounting such a file system on an old kernel logs a rather confusing warning:
XFS (vdc): Metadir superblock padding fields must be zero.
This is because we only validate the various feature fields in v5 superblocks after the common superblock validation helper is called.
Fix this by calling the feature validation first.
--- fs/xfs/libxfs/xfs_sb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/xfs/libxfs/xfs_sb.c +2 -2
@@ -864,10 +864,10 @@ xfs_sb_read_verify(* because _verify_common checks the on-disk values. */ __xfs_sb_from_disk (&sb, dsb, false); - error =xfs_validate_sb_common (mp, bp, &sb); + error =xfs_validate_sb_read (mp, &sb);if (error) goto out_error; - error =xfs_validate_sb_read (mp, &sb); + error =xfs_validate_sb_common (mp, bp, &sb); out_error:if (error == -EFSCORRUPTED || error == -EFSBADCRC )
Greg Kroah-Hartman
maintainerPATCH 54/303 RISC-V: Provide pgtable_l5_enabled on rv32
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Palmer Dabbelt <[email protected]>
commit 10128f8b1663a8bce27df051c750d116bb8cd737 upstream.
A few of the other page table level helpers are defined on rv32, but not pgtable_l5_enabled. This adds the definition as a constant and converts pgtable_l4_enabled to a constant as well.
[ Ben: Applies unchanged; needed by both 6.1.y and 6.6.y. Both trees took
commit e59e5e2754bf ("riscv: correct pt_level name via pgtable_l5/4_enabled") -- 6.1.y as of v6.1.64 -- without this prerequisite from the same series, so arch/riscv/mm/ptdump.c fails to build on rv32 whenever CONFIG_PTDUMP_CORE is enabled:
arch/riscv/mm/ptdump.c: In function 'ptdump_init':
arch/riscv/mm/ptdump.c:387:28: error: 'pgtable_l5_enabled' undeclared (first use in this function); did you mean 'pgtable_l4_enabled'?
Only pgtable_l5_enabled fails because pgtable_l4_enabled still has an unconditional extern in asm/pgtable.h; this patch removes that and provides both as constants for rv32. The only assignments to them, in disable_pgtable_l4/l5(), are already inside
#if defined(CONFIG_64BIT) && !defined(CONFIG_XIP_KERNEL), so making them const on rv32 is safe. v6.12 and later are unaffected. ]
--- arch/riscv/include/asm/pgtable-32.h | 3 +++ arch/riscv/include/asm/pgtable.h | 1 - arch/riscv/mm/init.c | 2 ++ 3 files changed, 5 insertions(+), 1 deletion(-)
arch/riscv/include/asm/pgtable-32.h +3 -0
@@ -33,4 +33,7 @@ _PAGE_WRITE | _PAGE_EXEC | \ _PAGE_USER | _PAGE_GLOBAL)) +static const __maybe_unused int pgtable_l4_enabled; +static const __maybe_unused int pgtable_l5_enabled; +#endif /* _ASM_RISCV_PGTABLE_32_H */
arch/riscv/include/asm/pgtable.h +0 -1
@@ -818,7 +818,6 @@ extern uintptr_t _dtb_early_pa;#define dtb_early_pa _dtb_early_pa#endif /* CONFIG_XIP_KERNEL */ extern u64 satp_mode; -extern bool pgtable_l4_enabled;void paging_init (void );void misc_mem_init (void );
arch/riscv/mm/init.c +2 -0
@@ -45,10 +45,12 @@ u64 satp_mode __ro_after_init = SATP_MOD#endif EXPORT_SYMBOL (satp_mode); +#ifdef CONFIG_64BIT bool pgtable_l4_enabled =IS_ENABLED (CONFIG_64BIT ) && !IS_ENABLED (CONFIG_XIP_KERNEL );bool pgtable_l5_enabled =IS_ENABLED (CONFIG_64BIT ) && !IS_ENABLED (CONFIG_XIP_KERNEL );EXPORT_SYMBOL (pgtable_l4_enabled);EXPORT_SYMBOL (pgtable_l5_enabled); +#endif phys_addr_t phys_ram_base__ro_after_init ;EXPORT_SYMBOL (phys_ram_base);
Greg Kroah-Hartman
maintainerPATCH 55/303 net: bonding: fix use-after-free in bond_xmit_broadcast()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <[email protected]>
commit 2884bf72fb8f03409e423397319205de48adca16 upstream.
bond_xmit_broadcast() reuses the original skb for the last slave (determined by bond_is_last_slave()) and clones it for others. Concurrent slave enslave/release can mutate the slave list during RCU-protected iteration, changing which slave is "last" mid-loop. This causes the original skb to be double-consumed (double-freed).
Replace the racy bond_is_last_slave() check with a simple index comparison (i + 1 == slaves_count) against the pre-snapshot slave count taken via READ_ONCE() before the loop. This preserves the zero-copy optimization for the last slave while making the "last" determination stable against concurrent list mutations.
The UAF can trigger the following crash:
==================================================================
BUG: KASAN: slab-use-after-free in skb_clone Read of size 8 at addr ffff888100ef8d40 by task exploit/147 CPU: 1 UID: 0 PID: 147 Comm: exploit Not tainted 7.0.0-rc3+ #4 PREEMPTLAZY Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:123) print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) kasan_report (mm/kasan/report.c:597) skb_clone (include/linux/skbuff.h:1724 include/linux/skbuff.h:1792 include/linux/skbuff.h:3396 net/core/skbuff.c:2108) bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5334) bond_start_xmit (drivers/net/bonding/bond_main.c:5567 drivers/net/bonding/bond_main.c:5593) dev_hard_start_xmit (include/linux/netdevice.h:5325 include/linux/netdevice.h:5334 net/core/dev.c:3871 net/core/dev.c:3887) __dev_queue_xmit (include/linux/netdevice.h:3601 net/core/dev.c:4838) ip6_finish_output2 (include/net/neighbour.h:540 include/net/neighbour.h:554 net/ipv6/ip6_output.c:136) ip6_finish_output (net/ipv6/ip6_output.c:208 net/ipv6/ip6_output.c:219) ip6_output (net/ipv6/ip6_output.c:250) ip6_send_skb (net/ipv6/ip6_output.c:1985) udp_v6_send_skb (net/ipv6/udp.c:1442) udpv6_sendmsg (net/ipv6/udp.c:1733) __sys_sendto (net/socket.c:730 net/socket.c:742 net/socket.c:2206) __x64_sys_sendto (net/socket.c:2209) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) </TASK> Allocated by task 147: Freed by task 147: The buggy address belongs to the object at ffff888100ef8c80 which belongs to the cache skbuff_head_cache of size 224
The buggy address is located 192 bytes inside of
freed 224-byte region [ffff888100ef8c80, ffff888100ef8d60)
Memory state around the buggy address:
ffff888100ef8c00: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
ffff888100ef8c80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888100ef8d00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
^
ffff888100ef8d80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
ffff888100ef8e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================--- drivers/net/bonding/bond_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/bonding/bond_main.c +1 -1
@@ -5345,7 +5345,7 @@ static netdev_tx_t bond_xmit_broadcast(sif (!(bond_slave_is_up (slave) && slave->link ==BOND_LINK_UP ))continue ; -if (bond_is_last_slave (bond, slave)) { +if (i +1 == slaves_count) { skb2 = skb; skb_used = true; }else {
Greg Kroah-Hartman
maintainerPATCH 56/303 riscv: Dont use PGD entries for the linear mapping
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandre Ghiti <[email protected]>
commit 629db01c64ff6cea08fc61b52426362689ef8618 upstream.
Propagating changes at this level is cumbersome as we need to go through all the page tables when that happens (either when changing the permissions or when splitting the mapping).
Note that this prevents the use of 4MB mapping for sv32 and 1GB mapping for sv39 in the linear mapping.
[ Ben: Only backport the RV32 guard. 6.1.y can build the RV32 linear mapping from PGD entries, and there is no splitting in __set_memory(). So a one-page permission change mutates 1024 pages.]
--- arch/riscv/mm/init.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
arch/riscv/mm/init.c +7 -2
@@ -668,8 +668,13 @@ void __init create_pgd_mapping(pgd_t *pgstatic uintptr_t __init best_map_size (phys_addr_t base,phys_addr_t size) { -/* Upgrade to PMD_SIZE mappings whenever possible */ -if ((base & (PMD_SIZE -1 )) || (size & (PMD_SIZE -1 ))) +/* +* Upgrade to PMD_SIZE mappings whenever possible. Not on 32-bit, +* where PMD_SIZE == PGDIR_SIZE: such a mapping is a PGD leaf entry +* that __set_memory() is unable to split. +*/ +if (!IS_ENABLED (CONFIG_64BIT ) || + (base & (PMD_SIZE -1 )) || (size & (PMD_SIZE -1 )))return PAGE_SIZE ;return PMD_SIZE ;
Greg Kroah-Hartman
maintainerPATCH 57/303 mm: do file ownership checks with the proper mount idmap
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pedro Falcato <[email protected]>
[ Upstream commit e187bc02f8fa4226d62814592cf064ee4557c470 ]
Ever since idmapped mounts were introduced, inode ownership checks (for side-channel protection) in mincore() and madvise(MADV_PAGEOUT) were done against the nop_mnt_idmap, which completely ignores the file's mount's idmap. This results in odd edgecases like:
1) mount/bind-mount with an idmap userA:userB:1
2) userB runs an owner_or_capable() check on file that is owned by userA on-disk/in-memory, but owned by userB after idmap translation
3) owner_or_capable() mysteriously fails as the correct idmap wasn't supplied
In the case of mincore/madvise MADV_PAGEOUT, this is usually benign, because file_permission(file, MAY_WRITE) will probably succeed, as it uses the proper idmap internally, but it does not need to be the case on e.g a 0444 file where even the owner itself doesn't have permissions to write to it.
Since this is clearly not trivial to get right, introduce a file_owner_or_capable() that can carry the correct semantics, and switch the various users in mm to it.
The issue was found by manual code inspection & an off-list discussion with Jan Kara.
--- include/linux/fs.h | 5 +++++ mm/madvise.c | 3 +-- mm/mincore.c | 3 +-- 3 files changed, 7 insertions(+), 4 deletions(-)
include/linux/fs.h +5 -0
@@ -2811,6 +2811,11 @@ static inline struct user_namespace *filreturn mnt_user_ns (file->f_path.mnt); } +static inline bool file_owner_or_capable (struct file *file) +{ +return inode_owner_or_capable (file_mnt_user_ns (file),file_inode (file)); +} +/** * is_idmapped_mnt - check whether a mount is mapped * @mnt: the mount to check
mm/madvise.c +1 -2
@@ -565,8 +565,7 @@ static inline bool can_do_pageout(struct* otherwise we'd be including shared non-exclusive mappings, which * opens a side channel. */ -return inode_owner_or_capable (&init_user_ns, -file_inode (vma->vm_file)) || +return file_owner_or_capable (vma->vm_file) ||file_permission (vma->vm_file,MAY_WRITE ) ==0 ; }
mm/mincore.c +1 -2
@@ -168,8 +168,7 @@ static inline bool can_do_mincore(struct* for writing; otherwise we'd be including shared non-exclusive * mappings, which opens a side channel. */ -return inode_owner_or_capable (&init_user_ns, -file_inode (vma->vm_file)) || +return file_owner_or_capable (vma->vm_file) ||file_permission (vma->vm_file,MAY_WRITE ) ==0 ; }
Greg Kroah-Hartman
maintainerPATCH 58/303 bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Bobrowski <[email protected]>
[ Upstream commit a6f0643e4f63cfaa0d5d4a69de4f132eac4b8fe4 ]
When CONFIG_BPF_LSM=y is set, BPF inode storage maps (BPF_MAP_TYPE_INODE_STORAGE) are compiled into the kernel. However, if the BPF LSM is not explicitly enabled at boot time (e.g. omitted from the "lsm=" boot parameter), lsm_prepare() is never executed for the BPF LSM.
Consequently, the BPF inode security blob offset (bpf_lsm_blob_sizes.lbs_inode) is never initialized and remains at its default compiled size of 8 bytes instead of being updated to a valid offset past the reserved struct rcu_head (typically 16 bytes or more).
When a privileged user creates and updates a BPF_MAP_TYPE_INODE_STORAGE map, bpf_inode() evaluates inode->i_security + 8. This erroneously aliases the struct rcu_head.func callback pointer at the beginning of the inode->i_security blob. During subsequent map element cleanup or inode destruction, writing NULL to owner_storage clears the queued RCU callback pointer. When rcu_do_batch() later executes the queued callback, it attempts an instruction fetch at address 0x0, triggering an immediate kernel panic.
Fix this by introducing a global bpf_lsm_initialized boolean flag marked with __ro_after_init. Set this flag to true inside bpf_lsm_init() when the LSM framework successfully registers the BPF LSM. Gate map allocation in inode_storage_map_alloc() on this flag, returning -EOPNOTSUPP if the BPF LSM is in turn uninitialized.
This fail-fast approach prevents userspace from allocating inode storage maps when the supporting BPF LSM infrastructure is absent, avoiding zombie map states.
--- include/linux/bpf_lsm.h | 4 ++++ kernel/bpf/bpf_inode_storage.c | 9 +++++++++ security/bpf/hooks.c | 3 +++ 3 files changed, 16 insertions(+)
include/linux/bpf_lsm.h +4 -0
@@ -13,6 +13,8 @@#ifdef CONFIG_BPF_LSM +extern bool bpf_lsm_initialized__ro_after_init ; +#define LSM_HOOK (RET ,DEFAULT ,NAME , ...) \ RET bpf_lsm_##NAME(__VA_ARGS__);#include <linux/lsm_hook_defs.h>
@@ -46,6 +48,8 @@ void bpf_lsm_find_cgroup_shim(const stru#else /* !CONFIG_BPF_LSM */ +#define bpf_lsm_initialized false +static inline bool bpf_lsm_is_sleepable_hook (u32 btf_id) {return false;
kernel/bpf/bpf_inode_storage.c +9 -0
@@ -205,6 +205,15 @@ static int notsupp_get_next_key(struct bstatic struct bpf_map *inode_storage_map_alloc (union bpf_attr *attr) { +/* +* Do not allow allocation of BPF_MAP_TYPE_INODE_STORAGE if the BPF LSM +* was not initialized by the LSM framework at boot. Without proper +* initialization, the BPF inode security blob offset remains unprepared, +* causing bpf_inode() to calculate an invalid memory offset and corrupt +* inode->i_security. +*/ +if (!bpf_lsm_initialized) +return ERR_PTR (-EOPNOTSUPP );return bpf_local_storage_map_alloc (attr, &inode_cache); }
security/bpf/hooks.c +3 -0
@@ -6,6 +6,8 @@#include <linux/lsm_hooks.h> #include <linux/bpf_lsm.h> +bool bpf_lsm_initialized__ro_after_init ; + static struct security_hook_list bpf_lsm_hooks[] __lsm_ro_after_init = { #define LSM_HOOK(RET, DEFAULT, NAME, ...) \ LSM_HOOK_INIT(NAME, bpf_lsm_##NAME),
@@ -18,6 +20,7 @@ static struct security_hook_list bpf_lsmstatic int __init bpf_lsm_init (void ) {security_add_hooks (bpf_lsm_hooks,ARRAY_SIZE (bpf_lsm_hooks),"bpf" ); + bpf_lsm_initialized = true;pr_info ("LSM support for eBPF active\n" );return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 59/303 iommu/amd: Dont split flush for amd_iommu_domain_flush_all()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weinan Liu <[email protected]>
[ Upstream commit 69fe699afe1afcb730164b86c228483c2da05f94 ]
We have observed multiple full invalidations occurring during device detach when we are done using the vfio-device.
blocked_domain_attach_device()
-> detach_device()
-> amd_iommu_domain_flush_all()
-> amd_iommu_domain_flush_pages(..., CMD_INV_IOMMU_ALL_PAGES_ADDRESS)
while (size != 0) {
-> __domain_flush_pages( flush_size /* power of 2 flush_size */)
-> domain_flush_pages_v1()
-> build_inv_iommu_pages()
-> build_inv_address()
}build_inv_address() will trigger a full invalidation if the chunk size > (1 << 51). Consequently, the guest will issue multiple full invalidations for a single call to amd_iommu_domain_flush_all()
Without this patch, we will see 10 time instead of 1 time full invalidations for every amd_iommu_domain_flush_all().
--- drivers/iommu/amd/iommu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/iommu/amd/iommu.c +2 -1
@@ -1395,7 +1395,8 @@ static void __domain_flush_pages(structstatic void domain_flush_pages (struct protection_domain *domain,u64 address,size_t size,int pde) { -if (likely (!amd_iommu_np_cache)) { +if (likely (!amd_iommu_np_cache) || + size >= (1ULL <<52 )) {__domain_flush_pages (domain, address, size, pde);return ; }
Greg Kroah-Hartman
maintainerPATCH 60/303 udmabuf: Do not create malformed scatterlists
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <[email protected]>
[ Upstream commit 5bf888673e0dda5a53220fa0c4956271a46c353c ]
Using a sg_set_folio() loop for every 4K results in a malformed scatterlist because sg_set_folio() has an issue with offsets > PAGE_SIZE and because scatterlist expects the creator to build a list which consolidates any physical contiguity.
sg_alloc_table_from_pages() creates a valid scatterlist directly from a struct page array, so go back to that.
Remove the offsets allocation and just store an array of tail pages as it did before the below commit. Everything wants that anyhow.
Stable-dep-of: 504e2b4ab97a ("dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning")
--- drivers/dma-buf/udmabuf.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/dma-buf/udmabuf.c +5 -3
@@ -72,14 +72,16 @@ static struct sg_table *get_sg_table(str0 , ubuf->pagecount <<PAGE_SHIFT , GFP_KERNEL);if (ret <0 ) - goto err; + goto err_alloc; + ret =dma_map_sgtable (dev, sg, direction,0 );if (ret <0 ) - goto err; + goto err_map;return sg; -err: +err_map:sg_free_table (sg); +err_alloc:kfree (sg);return ERR_PTR (ret); }
Greg Kroah-Hartman
maintainerPATCH 61/303 dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Gavrilov <[email protected]>
[ Upstream commit 504e2b4ab97a51d56d966cd36d0997ad30b65b2d ]
When CONFIG_DMA_API_DEBUG_SG is enabled, importing a udmabuf into a DRM driver (e.g. amdgpu for video playback in GNOME Videos / Showtime) triggers a spurious warning:
DMA-API: amdgpu 0000:03:00.0: cacheline tracking EEXIST, \
overlapping mappings aren't supported
WARNING: kernel/dma/debug.c:619 at add_dma_entry+0x473/0x5f0The call chain is:
amdgpu_cs_ioctl
-> amdgpu_ttm_backend_bind
-> dma_buf_map_attachment
-> [udmabuf] map_udmabuf -> get_sg_table
-> dma_map_sgtable(dev, sg, direction, 0) // attrs=0
-> debug_dma_map_sg -> add_dma_entry -> EEXISTThis happens because udmabuf builds a per-page scatter-gather list via sg_set_folio(). When begin_cpu_udmabuf() has already created an sg table mapped for the misc device, and an importer such as amdgpu maps the same pages for its own device via map_udmabuf(), the DMA debug infrastructure sees two active mappings whose physical addresses share cacheline boundaries and warns about the overlap.
The DMA_ATTR_SKIP_CPU_SYNC flag suppresses this check in add_dma_entry() because it signals that no CPU cache maintenance is performed at map/unmap time, making the cacheline overlap harmless.
All other major dma-buf exporters already pass this flag:
- drm_gem_map_dma_buf() passes DMA_ATTR_SKIP_CPU_SYNC
- amdgpu_dma_buf_map() passes DMA_ATTR_SKIP_CPU_SYNC
The CPU sync at map/unmap time is also redundant for udmabuf:begin_cpu_udmabuf() and end_cpu_udmabuf() already perform explicit cache synchronization via dma_sync_sgtable_for_cpu/device() when CPU access is requested through the dma-buf interface.
Pass DMA_ATTR_SKIP_CPU_SYNC to dma_map_sgtable() and dma_unmap_sgtable() in udmabuf to suppress the spurious warning and skip the redundant sync.
--- drivers/dma-buf/udmabuf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/dma-buf/udmabuf.c +2 -2
@@ -74,7 +74,7 @@ static struct sg_table *get_sg_table(strif (ret <0 ) goto err_alloc; - ret =dma_map_sgtable (dev, sg, direction,0 ); + ret =dma_map_sgtable (dev, sg, direction,DMA_ATTR_SKIP_CPU_SYNC );if (ret <0 ) goto err_map;return sg;
@@ -89,7 +89,7 @@ err_alloc:static void put_sg_table (struct device *dev,struct sg_table *sg,enum dma_data_direction direction) { -dma_unmap_sgtable (dev, sg, direction,0 ); +dma_unmap_sgtable (dev, sg, direction,DMA_ATTR_SKIP_CPU_SYNC );sg_free_table (sg);kfree (sg); }
Greg Kroah-Hartman
maintainerPATCH 62/303 fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Alba Vives <[email protected]>
[ Upstream commit fc3b071a7c8dc0f5d56defddf6e6fd5aaa3e1e27 ]
afu_ioctl_dma_map() accepts a 64-bit length from userspace via DFL_FPGA_PORT_DMA_MAP ioctl without an upper bound check. The value is passed to afu_dma_pin_pages() where npages is derived as length >> PAGE_SHIFT and passed to pin_user_pages_fast() which takes int nr_pages, causing implicit truncation if length is very large.
Validate map.length at the ioctl entry point before calling afu_dma_map_region(), rejecting values whose page count exceeds INT_MAX.
--- drivers/fpga/dfl-afu-main.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/fpga/dfl-afu-main.c +3 -0
@@ -720,6 +720,9 @@ afu_ioctl_dma_map(struct dfl_feature_plaif (map.argsz < minsz || map.flags)return -EINVAL ; +if (map.length >>PAGE_SHIFT > (u64 )INT_MAX ) +return -EINVAL ; + ret =afu_dma_map_region (pdata, map.user_addr, map.length, &map.iova);if (ret)return ret;
Greg Kroah-Hartman
maintainerPATCH 63/303 i2c: davinci: Unregister cpufreq notifier on probe failure
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
[ Upstream commit e43f32816a1b1fe5a86279411626fe3a9be56d45 ]
davinci_i2c_probe() registers a cpufreq transition notifier before adding the I2C adapter. If i2c_add_numbered_adapter() fails, the probe error path releases the device resources without unregistering the notifier.
Add a dedicated error path to unregister the cpufreq notifier after i2c_add_numbered_adapter() fails.
--- drivers/i2c/busses/i2c-davinci.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-davinci.c +3 -1
@@ -872,13 +872,15 @@ static int davinci_i2c_probe(struct plat adap->nr = pdev->id; r =i2c_add_numbered_adapter (adap);if (r) - goto err_unuse_clocks; + goto err_cpufreq;pm_runtime_mark_last_busy (dev->dev);pm_runtime_put_autosuspend (dev->dev);return 0 ; +err_cpufreq: +i2c_davinci_cpufreq_deregister (dev); err_unuse_clocks:pm_runtime_dont_use_autosuspend (dev->dev);pm_runtime_put_sync (dev->dev);
Greg Kroah-Hartman
maintainerPATCH 64/303 Input: mms114 - fix touch indexing for MMS134S and MMS136
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
[ Upstream commit a6ac4e24c1a8a533bb61035184fdcc7eede4cc8d ]
The MMS134S and MMS136 touch controllers have an event size of 6 bytes rather than 8 bytes. When __mms114_read_reg() reads the touch data packet from the device into the touch buffer, the events are packed tightly at 6-byte intervals. However, the driver iterates through the events using standard C array indexing (touch[index]), where each element is sizeof(struct mms114_touch) (8 bytes) apart. As a result, any touch events beyond the first one are read from incorrect offsets and parsed improperly.
Fix this by explicitly calculating the byte offset for each touch event based on the device's specific event size.
--- drivers/input/touchscreen/mms114.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/input/touchscreen/mms114.c +11 -4
@@ -196,7 +196,9 @@ static irqreturn_t mms114_interrupt(intstruct mms114_data *data = dev_id;struct input_dev *input_dev = data->input_dev;struct mms114_touch touch[MMS114_MAX_TOUCH ]; +struct mms114_touch *t;int packet_size; +int event_size;int touch_size;int index;int error;
@@ -214,17 +216,22 @@ static irqreturn_t mms114_interrupt(int/* MMS136 has slightly different event size */ if (data->type ==TYPE_MMS134S || data->type ==TYPE_MMS136 ) - touch_size = packet_size /MMS136_EVENT_SIZE ; + event_size =MMS136_EVENT_SIZE ;else - touch_size = packet_size /MMS114_EVENT_SIZE ; + event_size =MMS114_EVENT_SIZE ; + + touch_size = packet_size / event_size; error =__mms114_read_reg (data,MMS114_INFORMATION , packet_size, (u8 *)touch);if (error <0 ) goto out; -for (index =0 ; index < touch_size; index++) -mms114_process_mt (data, touch + index); +for (index =0 ; index < touch_size; index++) { + t = (struct mms114_touch *)((u8 *)touch + index * event_size); + +mms114_process_mt (data, t); + }input_mt_report_pointer_emulation (data->input_dev, true);input_sync (data->input_dev);
Greg Kroah-Hartman
maintainerPATCH 65/303 Input: mms114 - reject an oversized device packet size
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <[email protected]>
[ Upstream commit 66725039f7090afe14c31bd259e2059a68f04023 ]
mms114_interrupt() reads a packet of touch data from the device into a fixed-size on-stack buffer
struct mms114_touch touch[MMS114_MAX_TOUCH];
which holds MMS114_MAX_TOUCH (10) events of MMS114_EVENT_SIZE (8) bytes, i.e. 80 bytes. The length of the I2C read into it is taken verbatim from the device:
packet_size = mms114_read_reg(data, MMS114_PACKET_SIZE); if (packet_size <= 0) goto out; ... error = __mms114_read_reg(data, MMS114_INFORMATION, packet_size, (u8 *)touch);
packet_size is a single device register byte (0x0F) and the only check is the lower bound packet_size <= 0; it is never bounded against the size of touch[]. A malfunctioning, malicious or counterfeit controller (or an attacker tampering with the I2C bus) can report a packet_size of up to 255, so __mms114_read_reg() writes up to 175 bytes past the end of touch[] on the IRQ-thread stack: a stack out-of-bounds write that can overwrite the stack canary, saved registers and the return address.
A well-formed device never reports more than the buffer holds, so reject an oversized packet and drop the report, consistent with the handler's other error paths, rather than reading past the buffer.
--- drivers/input/touchscreen/mms114.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/input/touchscreen/mms114.c +6 -0
@@ -214,6 +214,12 @@ static irqreturn_t mms114_interrupt(intif (packet_size <=0 ) goto out; +if (packet_size >sizeof (touch)) { +dev_err (&data->client->dev,"Invalid packet size %d (max %zu)\n" , + packet_size,sizeof (touch)); + goto out; + } +/* MMS136 has slightly different event size */ if (data->type ==TYPE_MMS134S || data->type ==TYPE_MMS136 ) event_size =MMS136_EVENT_SIZE ;
Greg Kroah-Hartman
maintainerPATCH 66/303 VFS/audit: introduce kern_path_parent() for audit
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
[ Upstream commit 76a53de6f7ff0641570364234fb4489f4d4fc8e9 ]
audit_alloc_mark() and audit_get_nd() both need to perform a path lookup getting the parent dentry (which must exist) and the final target (following a LAST_NORM name) which sometimes doesn't need to exist.
They don't need the parent to be locked, but use kern_path_locked() or kern_path_locked_negative() anyway. This is somewhat misleading to the casual reader.
This patch introduces a more targeted function, kern_path_parent(), which returns not holding locks. On success the "path" will be set to the parent, which must be found, and the return value is the dentry of the target, which might be negative.
This will clear the way to rename kern_path_locked() which is otherwise only used to prepare for removing something.
It also allows us to remove kern_path_locked_negative(), which is transformed into the new kern_path_parent().
Stable-dep-of: 81905b5acbe7 ("audit: fix recursive locking deadlock in audit_dupe_exe()")
--- fs/namei.c | 43 +++++++++++++++++++++++++++++++++++++++++++ include/linux/namei.h | 1 + kernel/audit.h | 4 ++-- kernel/audit_fsnotify.c | 9 +++------ kernel/audit_watch.c | 9 ++++++--- 5 files changed, 55 insertions(+), 11 deletions(-)
fs/namei.c +43 -0
@@ -2599,6 +2599,49 @@ static struct dentry *__kern_path_lockedreturn d; } +/** +* kern_path_parent: lookup path returning parent and target +* @name: path name +* @path: path to store parent in +* +* The path @name should end with a normal component, not "." or ".." or "/". +* A lookup is performed and if successful the parent information +* is store in @parent and the dentry is returned. +* +* The dentry maybe negative, the parent will be positive. +* +* Returns: dentry or error. +*/ +struct dentry *kern_path_parent (const char *name,struct path *path) +{ +struct filename *filename =getname_kernel (name); +struct path parent_path; +struct dentry *d; +struct qstr last; +int type, error; + + error =filename_parentat (AT_FDCWD , filename,0 , &parent_path, &last, &type); +if (error) { + d =ERR_PTR (error); + goto out; + } +if (unlikely (type !=LAST_NORM )) { +path_put (&parent_path); + d =ERR_PTR (-EINVAL ); + goto out; + } + + d =lookup_one_len_unlocked (last.name, parent_path.dentry, last.len); +if (IS_ERR (d)) { +path_put (&parent_path); + goto out; + } + *path = parent_path; +out: +putname (filename); +return d; +} +struct dentry *kern_path_locked (const char *name,struct path *path) {struct filename *filename =getname_kernel (name);
include/linux/namei.h +1 -0
@@ -61,6 +61,7 @@ struct dentry *lookup_one_qstr_excl(consstruct dentry *base, unsigned int flags);extern int kern_path (const char *,unsigned ,struct path *); +struct dentry *kern_path_parent (const char *name,struct path *parent);extern struct dentry *kern_path_create (int ,const char *,struct path *,unsigned int );extern struct dentry *user_path_create (int ,const char __user *,struct path *,unsigned int );
kernel/audit.h +2 -2
@@ -279,8 +279,8 @@ extern struct audit_fsnotify_mark *auditextern char *audit_mark_path (struct audit_fsnotify_mark *mark);extern void audit_remove_mark (struct audit_fsnotify_mark *audit_mark);extern void audit_remove_mark_rule (struct audit_krule *krule); -extern int audit_mark_compare (struct audit_fsnotify_mark *mark, -unsigned long ino,dev_t dev); +extern int audit_mark_compare (struct audit_fsnotify_mark *mark,u64 ino, +dev_t dev);extern int audit_dupe_exe (struct audit_krule *new,struct audit_krule *old);extern int audit_exe_compare (struct task_struct *tsk,struct audit_fsnotify_mark *mark);
kernel/audit_fsnotify.c +3 -6
@@ -57,7 +57,7 @@ char *audit_mark_path(struct audit_fsnotreturn mark->path; } -int audit_mark_compare (struct audit_fsnotify_mark *mark,unsigned long ino,dev_t dev) +int audit_mark_compare (struct audit_fsnotify_mark *mark,u64 ino,dev_t dev) {if (mark->ino ==AUDIT_INO_UNSET )return 0 ;
@@ -76,17 +76,14 @@ struct audit_fsnotify_mark *audit_alloc_struct audit_fsnotify_mark *audit_mark;struct path path;struct dentry *dentry; -struct inode *inode;int ret;if (pathname[0 ] !='/' || pathname[len-1 ] =='/' )return ERR_PTR (-EINVAL ); - dentry =kern_path_locked (pathname, &path); + dentry =kern_path_parent (pathname, &path);if (IS_ERR (dentry))return ERR_CAST (dentry);/* returning an error */ - inode = path.dentry->d_inode; -inode_unlock (inode); audit_mark =kzalloc (sizeof (*audit_mark),GFP_KERNEL );if (unlikely (!audit_mark)) {
@@ -100,7 +97,7 @@ struct audit_fsnotify_mark *audit_alloc_audit_update_mark (audit_mark, dentry->d_inode); audit_mark->rule = krule; - ret =fsnotify_add_inode_mark (&audit_mark->mark, inode,0 ); + ret =fsnotify_add_inode_mark (&audit_mark->mark, path.dentry->d_inode,0 );if (ret <0 ) { audit_mark->path =NULL ;fsnotify_put_mark (&audit_mark->mark);
kernel/audit_watch.c +6 -3
@@ -244,7 +244,7 @@ static void audit_watch_log_rule_change(/* Update inode info in audit rules based on filesystem event. */ static void audit_update_watch (struct audit_parent *parent,const struct qstr *dname,dev_t dev, -unsigned long ino,unsigned invalidating) +u64 ino,unsigned int invalidating) {struct audit_watch *owatch, *nwatch, *nextw;struct audit_krule *r, *nextr;
@@ -347,15 +347,18 @@ static void audit_remove_parent_watches(/* Get path information necessary for adding watches. */ static int audit_get_nd (struct audit_watch *watch,struct path *parent) { -struct dentry *d =kern_path_locked (watch->path, parent); +struct dentry *d; + + d =kern_path_parent (watch->path, parent);if (IS_ERR (d))return PTR_ERR (d); +if (d_is_positive (d)) {/* update watch filter fields */ watch->dev = d->d_sb->s_dev; watch->ino =d_backing_inode (d)->i_ino; } -inode_unlock (d_backing_inode (parent->dentry)); +dput (d);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 67/303 audit: widen ino fields to u64
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <[email protected]>
[ Upstream commit 125dfa218134df7cc112667e92984de9d8cd0bf6 ]
inode->i_ino is being widened from unsigned long to u64. The audit subsystem uses unsigned long ino in struct fields, function parameters, and local variables that store inode numbers from arbitrary filesystems. On 32-bit platforms this truncates inode numbers that exceed 32 bits, which will cause incorrect audit log entries and broken watch/mark comparisons.
Widen all audit ino fields, parameters, and locals to u64, and update the inode format string from %lu to %llu to match.
Stable-dep-of: 81905b5acbe7 ("audit: fix recursive locking deadlock in audit_dupe_exe()")
--- include/linux/audit.h | 2 +- kernel/audit.h | 9 ++++----- kernel/audit_fsnotify.c | 2 +- kernel/audit_watch.c | 10 +++++----- kernel/auditsc.c | 4 ++-- 5 files changed, 13 insertions(+), 14 deletions(-)
include/linux/audit.h +1 -1
@@ -15,7 +15,7 @@#include <uapi/linux/audit.h> #include <uapi/linux/netfilter/nf_tables.h> -#define AUDIT_INO_UNSET ((unsigned long)-1) +#define AUDIT_INO_UNSET ((u64)-1)#define AUDIT_DEV_UNSET ((dev_t)-1)struct audit_sig_info {
kernel/audit.h +4 -5
@@ -75,7 +75,7 @@ struct audit_names {int name_len;/* number of chars to log */ bool hidden;/* don't log this record */ -unsigned long ino; +u64 ino;dev_t dev;umode_t mode;kuid_t uid;
@@ -219,9 +219,9 @@ extern int auditd_test_task(struct task_#define AUDIT_INODE_BUCKETS 32extern struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS ]; -static inline int audit_hash_ino (u32 ino) +static inline int audit_hash_ino (u64 ino) { -return (ino & (AUDIT_INODE_BUCKETS -1 )); +return ((u32 )ino & (AUDIT_INODE_BUCKETS -1 )); }/* Indicates that audit should log the full pathname. */
@@ -271,8 +271,7 @@ extern int audit_to_watch(struct audit_kextern int audit_add_watch (struct audit_krule *krule,struct list_head **list);extern void audit_remove_watch_rule (struct audit_krule *krule);extern char *audit_watch_path (struct audit_watch *watch); -extern int audit_watch_compare (struct audit_watch *watch,unsigned long ino, -dev_t dev); +extern int audit_watch_compare (struct audit_watch *watch,u64 ino,dev_t dev);extern struct audit_fsnotify_mark *audit_alloc_mark (struct audit_krule *krule,char *pathname,int len);
kernel/audit_fsnotify.c +1 -1
@@ -25,7 +25,7 @@*/ struct audit_fsnotify_mark {dev_t dev;/* associated superblock device */ -unsigned long ino;/* associated inode number */ +u64 ino;/* associated inode number */ char *path;/* insertion path */ struct fsnotify_mark mark;/* fsnotify mark on the inode */ struct audit_krule *rule;
kernel/audit_watch.c +5 -5
@@ -37,7 +37,7 @@ struct audit_watch {refcount_t count;/* reference count */ dev_t dev;/* associated superblock device */ char *path;/* insertion path */ -unsigned long ino;/* associated inode number */ +u64 ino;/* associated inode number */ struct audit_parent *parent;/* associated parent */ struct list_head wlist;/* entry in parent->watches list */ struct list_head rules;/* anchor for krule->rlist */
@@ -125,7 +125,7 @@ char *audit_watch_path(struct audit_watcreturn watch->path; } -int audit_watch_compare (struct audit_watch *watch,unsigned long ino,dev_t dev) +int audit_watch_compare (struct audit_watch *watch,u64 ino,dev_t dev) {return (watch->ino !=AUDIT_INO_UNSET ) && (watch->ino == ino) &&
@@ -285,7 +285,7 @@ static void audit_update_watch(struct aulist_del (&oentry->rule.list);audit_panic ("error updating watch, removing" ); }else { -int h =audit_hash_ino ((u32 )ino); +int h =audit_hash_ino (ino);/* * nentry->rule.watch == oentry->rule.watch so
@@ -439,7 +439,7 @@ int audit_add_watch(struct audit_krule *audit_add_to_parent (krule, parent); - h =audit_hash_ino ((u32 )watch->ino); + h =audit_hash_ino (watch->ino); *list = &audit_inode_hash[h]; error:path_put (&parent_path);
@@ -527,7 +527,7 @@ int audit_dupe_exe(struct audit_krule *nint audit_exe_compare (struct task_struct *tsk,struct audit_fsnotify_mark *mark) {struct file *exe_file; -unsigned long ino; +u64 ino;dev_t dev;/* only do exe filtering if we are recording @current events/records */
kernel/auditsc.c +2 -2
@@ -868,7 +868,7 @@ static void audit_filter_syscall(structstatic int audit_filter_inode_name (struct task_struct *tsk,struct audit_names *n,struct audit_context *ctx) { -int h =audit_hash_ino ((u32 )n->ino); +int h =audit_hash_ino (n->ino);struct list_head *list = &audit_inode_hash[h];struct audit_entry *e;enum audit_state state;
@@ -1545,7 +1545,7 @@ static void audit_log_name(struct audit_audit_log_format (ab," name=(null)" );if (n->ino !=AUDIT_INO_UNSET ) - audit_log_format(ab, " inode=%lu dev=%02x:%02x mode=%#ho ouid=%u ogid=%u rdev=%02x:%02x", + audit_log_format(ab, " inode=%llu dev=%02x:%02x mode=%#ho ouid=%u ogid=%u rdev=%02x:%02x", n->ino, MAJOR(n->dev), MINOR(n->dev),
Greg Kroah-Hartman
maintainerPATCH 68/303 audit: use unsigned int instead of unsigned
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Robaina <[email protected]>
[ Upstream commit 8b226771014beab1292081151a99530886ce54b4 ]
Address checkpatch.pl warning below, across the audit subsystem:
WARNING: Prefer 'unsigned int' to bare use of 'unsigned'
Minor cleanup, no functional changes.
Stable-dep-of: 81905b5acbe7 ("audit: fix recursive locking deadlock in audit_dupe_exe()")
--- include/linux/audit.h | 4 ++-- include/linux/audit_arch.h | 12 ++++++------ kernel/audit.c | 2 +- kernel/audit.h | 2 +- kernel/audit_tree.c | 2 +- kernel/auditfilter.c | 8 ++++---- kernel/auditsc.c | 2 +- lib/compat_audit.c | 12 ++++++------ 8 files changed, 22 insertions(+), 22 deletions(-)
include/linux/audit.h +2 -2
@@ -119,8 +119,8 @@ enum audit_nfcfgop { AUDIT_NFT_OP_INVALID, }; -extern int __init audit_register_class (int class,unsigned *list); -extern int audit_classify_syscall (int abi,unsigned syscall); +extern int __init audit_register_class (int class,unsigned int *list); +extern int audit_classify_syscall (int abi,unsigned int syscall);extern int audit_classify_arch (int arch);/* audit_names->type values */
include/linux/audit_arch.h +6 -6
@@ -21,13 +21,13 @@ enum auditsc_class_t {AUDITSC_NVALS /* count */ }; -extern int audit_classify_compat_syscall (int abi,unsigned syscall); +extern int audit_classify_compat_syscall (int abi,unsigned int syscall);/* only for compat system calls */ -extern unsigned compat_write_class[]; -extern unsigned compat_read_class[]; -extern unsigned compat_dir_class[]; -extern unsigned compat_chattr_class[]; -extern unsigned compat_signal_class[]; +extern unsigned int compat_write_class[]; +extern unsigned int compat_read_class[]; +extern unsigned int compat_dir_class[]; +extern unsigned int compat_chattr_class[]; +extern unsigned int compat_signal_class[];#endif
kernel/audit.c +1 -1
@@ -1990,7 +1990,7 @@ static void audit_log_vformat(struct aud* here and AUDIT_BUFSIZ is at least 1024, then we can * log everything that printk could have logged. */ avail =audit_expand (ab, -max_t (unsigned,AUDIT_BUFSIZ ,1 +len-avail)); + max_t(unsigned int, AUDIT_BUFSIZ, 1+len-avail));if (!avail) goto out_va_end; len =vsnprintf (skb_tail_pointer (skb), avail, fmt, args2);
kernel/audit.h +1 -1
@@ -227,7 +227,7 @@ static inline int audit_hash_ino(u64 ino/* Indicates that audit should log the full pathname. */ #define AUDIT_NAME_FULL -1 -extern int audit_match_class (int class,unsigned syscall); +extern int audit_match_class (int class,unsigned int syscall);extern int audit_comparator (const u32 left,const u32 op,const u32 right);extern int audit_uid_comparator (kuid_t left,u32 op,kuid_t right);extern int audit_gid_comparator (kgid_t left,u32 op,kgid_t right);
kernel/audit_tree.c +1 -1
@@ -33,7 +33,7 @@ struct audit_chunk {struct audit_node {struct list_head list;struct audit_tree *owner; -unsigned index;/* index; upper bit indicates 'will prune' */ +unsigned int index;/* index; upper bit indicates 'will prune' */ } owners[]; };
kernel/auditfilter.c +4 -4
@@ -165,13 +165,13 @@ static inline int audit_to_inode(structstatic __u32 *classes[AUDIT_SYSCALL_CLASSES ]; -int __init audit_register_class (int class,unsigned *list) +int __init audit_register_class (int class,unsigned int *list) {__u32 *p =kcalloc (AUDIT_BITMASK_SIZE ,sizeof (__u32),GFP_KERNEL );if (!p)return -ENOMEM ;while (*list != ~0U ) { -unsigned n = *list++; +unsigned int n = *list++;if (n >=AUDIT_BITMASK_SIZE *32 -AUDIT_SYSCALL_CLASSES ) {kfree (p);return -EINVAL ;
@@ -186,7 +186,7 @@ int __init audit_register_class(int clasreturn 0 ; } -int audit_match_class (int class,unsigned syscall) +int audit_match_class (int class,unsigned int syscall) {if (unlikely (syscall >=AUDIT_BITMASK_SIZE *32 ))return 0 ;
@@ -237,7 +237,7 @@ static int audit_match_signal(struct aud/* Common user-space to kernel rule translation. */ static inline struct audit_entry *audit_to_entry_common (struct audit_rule_data *rule) { -unsigned listnr; +unsigned int listnr;struct audit_entry *entry;int i, err;
kernel/auditsc.c +1 -1
@@ -147,7 +147,7 @@ static const struct audit_nfcfgop_tab austatic int audit_match_perm (struct audit_context *ctx,int mask) { -unsigned n; +unsigned int n;if (unlikely (!ctx))return 0 ;
lib/compat_audit.c +6 -6
@@ -4,32 +4,32 @@#include <linux/audit_arch.h> #include <asm/unistd32.h> -unsigned compat_dir_class[] = { +unsigned int compat_dir_class[] = { #include <asm-generic/audit_dir_write.h> ~0U }; -unsigned compat_read_class[] = { +unsigned int compat_read_class[] = { #include <asm-generic/audit_read.h> ~0U }; -unsigned compat_write_class[] = { +unsigned int compat_write_class[] = { #include <asm-generic/audit_write.h> ~0U }; -unsigned compat_chattr_class[] = { +unsigned int compat_chattr_class[] = { #include <asm-generic/audit_change_attr.h> ~0U }; -unsigned compat_signal_class[] = { +unsigned int compat_signal_class[] = { #include <asm-generic/audit_signal.h> ~0U }; -int audit_classify_compat_syscall (int abi,unsigned syscall) +int audit_classify_compat_syscall (int abi,unsigned int syscall) {switch (syscall) {#ifdef __NR_open
Greg Kroah-Hartman
maintainerPATCH 69/303 audit: fix recursive locking deadlock in audit_dupe_exe()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Robaina <[email protected]>
[ Upstream commit 81905b5acbe77284734438df3fbec1158e6429a3 ]
A deadlock occurs in the audit subsystem when duplicating executable-related rules.
When a file is moved (e.g., via do_renameat2()), the VFS layer locks the parent directory (I_MUTEX_PARENT), which synchronously triggers an fsnotify_move event. If an existing executable audit rule matches the file being moved, the audit subsystem catches this event and calls audit_dupe_exe() to duplicate the watch and update the rule. Then, audit_alloc_mark() would call kern_path_parent() to resolve the path, leading to a blind attempt to acquire the exact same I_MUTEX_PARENT lock already held by the task, resulting in the following recursive locking deadlock:
============================================
WARNING: possible recursive locking detected 6.12.0-55.27.1.el10_0.x86_64+debug #1 Not tainted
--------------------------------------------
mv/5099 is trying to acquire lock:
ffff888132845358 (&inode->i_sb->s_type->i_mutex_dir_key/1){+.+.}-{3:3},
at: __kern_path_locked+0x10a/0x2f0
but task is already holding lock:
ffff888132846b58 (&inode->i_sb->s_type->i_mutex_dir_key/1){+.+.}-{3:3},
at: lock_two_directories+0x13f/0x2b0
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
---- lock(&inode->i_sb->s_type->i_mutex_dir_key/1);
lock(&inode->i_sb->s_type->i_mutex_dir_key/1);
*** DEADLOCK ***
May be due to missing lock nesting notation
6 locks held by mv/5099:
#0: ffff888112a9c440 (sb_writers#13)
at: do_renameat2+0x34c/0xbc0
#1: ffff888112a9c790 (&type->s_vfs_rename_key#3)
at: do_renameat2+0x415/0xbc0
#2: ffff888132846b58 (&inode->i_sb->s_type->i_mutex_dir_key/1)
at: lock_two_directories+0x13f/0x2b0
#3: ffff888132845358 (&inode->i_sb->s_type->i_mutex_dir_key/5)
at: lock_two_directories+0x175/0x2b0
#4: ffffffffb3a1fb10 (&fsnotify_mark_srcu)
at: fsnotify+0x454/0x28a0
#5: ffffffffaf886230 (audit_filter_mutex)
at: audit_update_watch+0x36/0x11e0
stack backtrace: Call Trace: <TASK> dump_stack_lvl+0x6f/0xb0 print_deadlock_bug.cold+0xbd/0xca validate_chain+0x83a/0xf00 __lock_acquire+0xcac/0x1d20 lock_acquire.part.0+0x11b/0x360 down_write_nested+0x9f/0x230 __kern_path_locked+0x10a/0x2f0 kern_path_locked+0x26/0x40 audit_alloc_mark+0xfb/0x4f0 audit_dupe_exe+0x6c/0xe0 audit_dupe_rule+0x6c2/0xc00 audit_update_watch+0x4cc/0x11e0 audit_watch_handle_event+0x12c/0x1b0 send_to_group+0x5d0/0x8b0 fsnotify+0x615/0x28a0 fsnotify_move+0x1d8/0x630 vfs_rename+0xdcd/0x1df0 do_renameat2+0x9d4/0xbc0 __x64_sys_renameat+0x192/0x260 do_syscall_64+0x92/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f0491fe8c4e Code: 0f 1f 40 00 48 8b 15 c1 e1 16 00 f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 49 89 ca b8 08 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 0a c3 66 0f 1f 84 00 00 00 00 00 48 8b 15 89 RSP: 002b:00007ffc7210bf38 EFLAGS: 00000246 ORIG_RAX: 0000000000000108 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0491fe8c4e RDX: 0000000000000003 RSI: 00007ffc7210e6c8 RDI: 00000000ffffff9c RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001 R10: 00005575eb2dae2a R11: 0000000000000246 R12: 00005575eb2dae2a R13: 00007ffc7210e6c8 R14: 0000000000000003 R15: 00000000ffffff9c </TASK>
The aforementioned deadlock can be consistently reproduced by running the script below:
audit-dupe-exe-deadlock.sh
--------------------------
#!/bin/bash
auditctl -D
mkdir -p /tmp/foo
touch /tmp/file
auditctl -a always,exit -F exe=/tmp/file -F path=/tmp/file -S all -k dr mv /tmp/file /tmp/foo/file
rm -Rf /tmp/foo
This patch fixes the issue by introducing struct audit_watch_ctx to pass the fsnotify event context down to audit_alloc_mark(). By utilizing the already-resolved directory inode provided by the event, we bypass the kern_path_parent() path resolution entirely, safely avoiding the recursive lock. Furthermore, it explicitly allows duplicate fsnotify marks (allow_dups = 1) during the rename update, allowing the new rule's mark to safely coexist with the old rule's mark until the old rule is freed.
P.S.: This issue was identified and reproduced during a comprehensive code coverage analysis of the audit subsystem. The full report is available at the link below:
https://people.redhat.com/rrobaina/audit-code-coverage-analysis.pdf
P.P.S: With the permission of both Ricardo and Nathan, I've squashed a fixup patch from Nathan that addresses a compile time error when CONFIG_AUDITSYSCALL=n.
--- kernel/audit.h | 17 ++++++++++++----- kernel/audit_fsnotify.c | 32 +++++++++++++++++++++++--------- kernel/audit_watch.c | 25 +++++++++++++++++-------- kernel/auditfilter.c | 9 +++++---- 4 files changed, 57 insertions(+), 26 deletions(-)
kernel/audit.h +12 -5
@@ -250,8 +250,13 @@ extern int audit_del_rule(struct audit_eextern void audit_free_rule_rcu (struct rcu_head *head);extern struct list_head audit_filter_list[]; -extern struct audit_entry *audit_dupe_rule (struct audit_krule *old); +struct audit_watch_ctx { +struct inode *dir; +struct inode *child; +}; +extern struct audit_entry *audit_dupe_rule (struct audit_krule *old, +struct audit_watch_ctx *ctx);extern void audit_log_d_path_exe (struct audit_buffer *ab,struct mm_struct *mm);
@@ -274,13 +279,15 @@ extern char *audit_watch_path(struct audextern int audit_watch_compare (struct audit_watch *watch,u64 ino,dev_t dev);extern struct audit_fsnotify_mark *audit_alloc_mark (struct audit_krule *krule, -char *pathname,int len); +char *pathname,int len, +struct audit_watch_ctx *ctx);extern char *audit_mark_path (struct audit_fsnotify_mark *mark);extern void audit_remove_mark (struct audit_fsnotify_mark *audit_mark);extern void audit_remove_mark_rule (struct audit_krule *krule);extern int audit_mark_compare (struct audit_fsnotify_mark *mark,u64 ino,dev_t dev); -extern int audit_dupe_exe (struct audit_krule *new,struct audit_krule *old); +extern int audit_dupe_exe (struct audit_krule *new,struct audit_krule *old, +struct audit_watch_ctx *ctx);extern int audit_exe_compare (struct task_struct *tsk,struct audit_fsnotify_mark *mark);
@@ -311,13 +318,13 @@ extern struct list_head *audit_killed_tr#define audit_watch_path (w) ""#define audit_watch_compare (w, i, d) 0 -#define audit_alloc_mark (k, p, l) (ERR_PTR(-EINVAL)) +#define audit_alloc_mark (k, p, l, c) (ERR_PTR(-EINVAL))#define audit_mark_path (m) ""#define audit_remove_mark (m) do { } while (0)#define audit_remove_mark_rule (k) do { } while (0)#define audit_mark_compare (m, i, d) 0#define audit_exe_compare (t, m) (-EINVAL) -#define audit_dupe_exe (n, o) (-EINVAL) +#define audit_dupe_exe (n, o, c) (-EINVAL)#define audit_remove_tree_rule (rule) BUG()#define audit_add_tree_rule (rule) -EINVAL
kernel/audit_fsnotify.c +23 -9
@@ -71,19 +71,30 @@ static void audit_update_mark(struct aud audit_mark->ino = inode ? inode->i_ino :AUDIT_INO_UNSET ; } -struct audit_fsnotify_mark *audit_alloc_mark (struct audit_krule *krule,char *pathname,int len) +struct audit_fsnotify_mark *audit_alloc_mark (struct audit_krule *krule,char *pathname, +int len,struct audit_watch_ctx *ctx) {struct audit_fsnotify_mark *audit_mark;struct path path;struct dentry *dentry; -int ret; +struct inode *dir, *child; +int ret, allow_dups;if (pathname[0 ] !='/' || pathname[len-1 ] =='/' )return ERR_PTR (-EINVAL ); - dentry =kern_path_parent (pathname, &path); -if (IS_ERR (dentry)) -return ERR_CAST (dentry);/* returning an error */ +if (!ctx) { + dentry =kern_path_parent (pathname, &path); +if (IS_ERR (dentry)) +return ERR_CAST (dentry);/* returning an error */ + dir =d_inode (path.dentry); + child =d_inode (dentry); + allow_dups =0 ; + }else { + dir = ctx->dir; + child = ctx->child; + allow_dups =1 ; + } audit_mark =kzalloc (sizeof (*audit_mark),GFP_KERNEL );if (unlikely (!audit_mark)) {
@@ -94,18 +105,21 @@ struct audit_fsnotify_mark *audit_alloc_fsnotify_init_mark (&audit_mark->mark, audit_fsnotify_group); audit_mark->mark.mask =AUDIT_FS_EVENTS ; audit_mark->path = pathname; -audit_update_mark (audit_mark, dentry->d_inode); audit_mark->rule = krule; - ret =fsnotify_add_inode_mark (&audit_mark->mark, path.dentry->d_inode,0 ); +audit_update_mark (audit_mark, child); + ret =fsnotify_add_inode_mark (&audit_mark->mark, dir, allow_dups); +if (ret <0 ) { audit_mark->path =NULL ;fsnotify_put_mark (&audit_mark->mark); audit_mark =ERR_PTR (ret); } out: -dput (dentry); -path_put (&path); +if (!ctx) { +dput (dentry); +path_put (&path); + }return audit_mark; }
kernel/audit_watch.c +17 -8
@@ -244,7 +244,8 @@ static void audit_watch_log_rule_change(/* Update inode info in audit rules based on filesystem event. */ static void audit_update_watch (struct audit_parent *parent,const struct qstr *dname,dev_t dev, -u64 ino,unsigned int invalidating) +u64 ino,unsigned int invalidating, +struct audit_watch_ctx *ctx) {struct audit_watch *owatch, *nwatch, *nextw;struct audit_krule *r, *nextr;
@@ -280,7 +281,7 @@ static void audit_update_watch(struct aulist_del (&oentry->rule.rlist);list_del_rcu (&oentry->list); - nentry =audit_dupe_rule (&oentry->rule); + nentry =audit_dupe_rule (&oentry->rule, ctx);if (IS_ERR (nentry)) {list_del (&oentry->rule.list);audit_panic ("error updating watch, removing" );
@@ -479,10 +480,17 @@ static int audit_watch_handle_event(struif (WARN_ON_ONCE (inode_mark->group != audit_watch_group))return 0 ; -if (mask & (FS_CREATE |FS_MOVED_TO ) && inode) -audit_update_watch (parent, dname, inode->i_sb->s_dev, inode->i_ino,0 ); -else if (mask & (FS_DELETE |FS_MOVED_FROM )) -audit_update_watch (parent, dname,AUDIT_DEV_UNSET ,AUDIT_INO_UNSET ,1 ); +if (mask & (FS_CREATE |FS_MOVED_TO ) && inode) { +struct audit_watch_ctx ctx = { .dir = dir, .child = inode }; + +audit_update_watch (parent, dname, inode->i_sb->s_dev, inode->i_ino,0 , + &ctx); + }else if (mask & (FS_DELETE |FS_MOVED_FROM )) { +struct audit_watch_ctx ctx = { .dir = dir, .child =NULL }; + +audit_update_watch (parent, dname,AUDIT_DEV_UNSET ,AUDIT_INO_UNSET ,1 , + &ctx); + }else if (mask & (FS_DELETE_SELF |FS_UNMOUNT |FS_MOVE_SELF ))audit_remove_parent_watches (parent);
@@ -505,7 +513,8 @@ static int __init audit_watch_init(void) }device_initcall (audit_watch_init); -int audit_dupe_exe (struct audit_krule *new,struct audit_krule *old) +int audit_dupe_exe (struct audit_krule *new,struct audit_krule *old, +struct audit_watch_ctx *ctx) {struct audit_fsnotify_mark *audit_mark;char *pathname;
@@ -514,7 +523,7 @@ int audit_dupe_exe(struct audit_krule *nif (!pathname)return -ENOMEM ; - audit_mark =audit_alloc_mark (new, pathname,strlen (pathname)); + audit_mark =audit_alloc_mark (new, pathname,strlen (pathname), ctx);if (IS_ERR (audit_mark)) {kfree (pathname);return PTR_ERR (audit_mark);
kernel/auditfilter.c +5 -4
@@ -590,7 +590,7 @@ static struct audit_entry *audit_data_to err =PTR_ERR (str); goto exit_free; } - audit_mark =audit_alloc_mark (&entry->rule, str, f_val); + audit_mark =audit_alloc_mark (&entry->rule, str, f_val,NULL );if (IS_ERR (audit_mark)) {kfree (str); err =PTR_ERR (audit_mark);
@@ -817,7 +817,8 @@ static inline int audit_dupe_lsm_field(s* rule with the new rule in the filterlist, then free the old rule. * The rlist element is undefined; list manipulations are handled apart from * the initial copy. */ -struct audit_entry *audit_dupe_rule (struct audit_krule *old) +struct audit_entry *audit_dupe_rule (struct audit_krule *old, +struct audit_watch_ctx *ctx) {u32 fcount = old->field_count;struct audit_entry *entry;
@@ -876,7 +877,7 @@ struct audit_entry *audit_dupe_rule(stru new->filterkey = fk;break ;case AUDIT_EXE : - err =audit_dupe_exe (new, old); + err =audit_dupe_exe (new, old, ctx);break ; }if (err) {
@@ -1409,7 +1410,7 @@ static int update_lsm_rule(struct audit_if (!security_audit_rule_known (r))return 0 ; - nentry =audit_dupe_rule (r); + nentry =audit_dupe_rule (r,NULL );if (entry->rule.exe)audit_remove_mark (entry->rule.exe);if (IS_ERR (nentry)) {
Greg Kroah-Hartman
maintainerPATCH 70/303 ALSA: hda: conexant: Remove mic bias threshold override
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Heng <[email protected]>
[ Upstream commit f52524da7084c1a54683ae9fbc73e93fff19dd64 ]
Remove the mic bias current comparator threshold override (NID 0x1c, verb 0x320, value 0x010) from Conexant codec driver.
This override was originally intended to support volume up/down controls on headsets with inline remote controls, but it causes microphone detection failures on some headsets with impedance less than 1k ohm.
After consulting with the vendor's engineers, it was confirmed that this setting is board-specific and should be handled by BIOS/firmware rather than the generic codec driver, especially since inline remote support is not currently implemented.
--- sound/pci/hda/patch_conexant.c | 3 --- 1 file changed, 3 deletions(-)
sound/pci/hda/patch_conexant.c +0 -3
@@ -168,9 +168,6 @@ static void cx_fixup_headset_recog(struc {unsigned int mic_present; -/* fix some headset type recognize fail issue, such as EDIFIER headset */ -/* set micbias output current comparator threshold from 66% to 55%. */ -snd_hda_codec_write (codec,0x1c ,0 ,0x320 ,0x010 );/* set OFF voltage for DFET from -1.2V to -0.8V, set headset micbias register * value adjustment trim from 2.2K ohms to 2.0K ohms. */
Greg Kroah-Hartman
maintainerPATCH 71/303 ALSA: hda: Fix cached processing coefficient verbs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Rao <[email protected]>
[ Upstream commit f67be28fdf8b5d31ac1cc1152bb17250f9f8f513 ]
Intel HD Audio defines Coefficient Index and Processing Coefficient as separate audio widget controls in the Audio Widget Verb Definitions:
Coefficient Index selects the coefficient slot, while Processing Coefficient accesses the value at the selected slot.
hda_reg_read_coef() selects the slot with AC_VERB_SET_COEF_INDEX, but then uses AC_VERB_GET_COEF_INDEX for the value read. That reads back the selected index instead of the coefficient value. hda_reg_write_coef() has the same issue and builds the value write from AC_VERB_GET_COEF_INDEX instead of AC_VERB_SET_PROC_COEF.
This only affects the regmap coefficient cache path used by codecs that set codec->cache_coef. Direct coefficient helpers already use the normal SET_COEF_INDEX followed by GET_PROC_COEF or SET_PROC_COEF sequence, which is likely why this has not been noticed widely.
Use AC_VERB_GET_PROC_COEF for cached coefficient reads and AC_VERB_SET_PROC_COEF for cached coefficient writes.
--- sound/hda/hdac_regmap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/hda/hdac_regmap.c +2 -2
@@ -215,7 +215,7 @@ static int hda_reg_read_coef(struct hdac err =snd_hdac_exec_verb (codec, verb,0 ,NULL );if (err <0 )return err; - verb = (reg & ~0xfffff ) | (AC_VERB_GET_COEF_INDEX <<8 ); + verb = (reg & ~0xfffff ) | (AC_VERB_GET_PROC_COEF <<8 );return snd_hdac_exec_verb (codec, verb,0 , val); }
@@ -233,7 +233,7 @@ static int hda_reg_write_coef(struct hda err =snd_hdac_exec_verb (codec, verb,0 ,NULL );if (err <0 )return err; - verb = (reg & ~0xfffff ) | (AC_VERB_GET_COEF_INDEX <<8 ) | + verb = (reg & ~0xfffff ) | (AC_VERB_SET_PROC_COEF <<8 ) | (val &0xffff );return snd_hdac_exec_verb (codec, verb,0 ,NULL ); }
Greg Kroah-Hartman
maintainerPATCH 72/303 serial: max310x: replace bare use of unsigned with unsigned int (checkpatch)
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hugo Villeneuve <[email protected]>
[ Upstream commit 79b69eb09cf5b6a77e621b2838b7e0d38113debb ]
Fixes the following checkpatch warnings:
WARNING: Prefer 'unsigned int' to bare use of 'unsigned'
With this change, the affected functions now match the prototypes in struct gpio_chip.
Stable-dep-of: a483b1a91b33 ("serial: max310x: implement gpio_chip::get_direction()")
--- drivers/tty/serial/max310x.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/tty/serial/max310x.c +4 -4
@@ -1211,7 +1211,7 @@ static int __maybe_unused max310x_resume static SIMPLE_DEV_PM_OPS(max310x_pm_ops, max310x_suspend, max310x_resume);#ifdef CONFIG_GPIOLIB -static int max310x_gpio_get (struct gpio_chip *chip,unsigned offset) +static int max310x_gpio_get (struct gpio_chip *chip,unsigned int offset) {unsigned int val;struct max310x_port *s =gpiochip_get_data (chip);
@@ -1222,7 +1222,7 @@ static int max310x_gpio_get(struct gpio_return !!((val >>4 ) & (1 << (offset %4 ))); } -static void max310x_gpio_set (struct gpio_chip *chip,unsigned offset,int value) +static void max310x_gpio_set (struct gpio_chip *chip,unsigned int offset,int value) {struct max310x_port *s =gpiochip_get_data (chip);struct uart_port *port = &s->p[offset /4 ].port;
@@ -1231,7 +1231,7 @@ static void max310x_gpio_set(struct gpio value ? 1 << (offset % 4) : 0); } -static int max310x_gpio_direction_input (struct gpio_chip *chip,unsigned offset) +static int max310x_gpio_direction_input (struct gpio_chip *chip,unsigned int offset) {struct max310x_port *s =gpiochip_get_data (chip);struct uart_port *port = &s->p[offset /4 ].port;
@@ -1242,7 +1242,7 @@ static int max310x_gpio_direction_input( }static int max310x_gpio_direction_output (struct gpio_chip *chip, -unsigned offset,int value) +unsigned int offset,int value) {struct max310x_port *s =gpiochip_get_data (chip);struct uart_port *port = &s->p[offset /4 ].port;
Greg Kroah-Hartman
maintainerPATCH 73/303 serial: max310x: implement gpio_chip::get_direction()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tapio Reijonen <[email protected]>
[ Upstream commit a483b1a91b33b7533280e7c3efd2bc1275caef18 ]
It's strongly recommended for GPIO drivers to always implement the .get_direction() callback - even when the direction is tracked in software. The GPIO core emits a warning when the callback is missing and a user reads the direction of a line, e.g. via /sys/kernel/debug/gpio.
The MAX310X keeps the GPIO direction in the GPIOCFG register (a set bit selects output), which the existing direction_input/output callbacks already program, so the current direction can be read back directly.
--- drivers/tty/serial/max310x.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/tty/serial/max310x.c +12 -0
@@ -1231,6 +1231,17 @@ static void max310x_gpio_set(struct gpio value ? 1 << (offset % 4) : 0); } +static int max310x_gpio_get_direction (struct gpio_chip *chip,unsigned int offset) +{ +struct max310x_port *s =gpiochip_get_data (chip); +struct uart_port *port = &s->p[offset /4 ].port; +unsigned int val; + + val =max310x_port_read (port,MAX310X_GPIOCFG_REG ); + +return val &BIT (offset %4 ) ?GPIO_LINE_DIRECTION_OUT :GPIO_LINE_DIRECTION_IN ; +} +static int max310x_gpio_direction_input (struct gpio_chip *chip,unsigned int offset) {struct max310x_port *s =gpiochip_get_data (chip);
@@ -1439,6 +1450,7 @@ static int max310x_probe(struct device * s->gpio.owner =THIS_MODULE ; s->gpio.parent = dev; s->gpio.label = devtype->name; + s->gpio.get_direction = max310x_gpio_get_direction; s->gpio.direction_input = max310x_gpio_direction_input; s->gpio.get = max310x_gpio_get; s->gpio.direction_output= max310x_gpio_direction_output;
Greg Kroah-Hartman
maintainerPATCH 74/303 rxrpc: serialize kernel accept preallocation with socket teardown
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Daming <[email protected]>
[ Upstream commit dc175389b18c29a5303ee83169ec653adfae3e17 ]
rxrpc_kernel_charge_accept() reads rx->backlog without any socket/backlog synchronization and passes that raw pointer into rxrpc_service_prealloc_one(). A concurrent rxrpc_discard_prealloc() sets rx->backlog = NULL and frees the backlog rings, so a kernel preallocation worker can keep using a freed struct rxrpc_backlog while updating *_backlog_head/tail and array slots.
Serialize the state check and backlog lookup with the socket lock, and reject kernel preallocation once teardown has disabled listening or discarded the service backlog.
--- net/rxrpc/call_accept.c | 27 ++++++++++++++++++++------- 1 file changed, 20 insertions(+), 7 deletions(-)
net/rxrpc/call_accept.c +20 -7
@@ -481,14 +481,27 @@ int rxrpc_kernel_charge_accept(struct so unsigned long user_call_ID, gfp_t gfp, unsigned int debug_id) { - struct rxrpc_sock *rx = rxrpc_sk(sock->sk); -struct rxrpc_backlog *b = rx->backlog; + struct rxrpc_backlog *b; +struct rxrpc_sock *rx; +struct sock *sk; +int ret; -if (sock->sk->sk_state ==RXRPC_CLOSE ) -return -ESHUTDOWN ; + sk = sock->sk; + rx =rxrpc_sk (sk); -return rxrpc_service_prealloc_one (rx, b, notify_rx, - user_attach_call, user_call_ID, - gfp, debug_id); +lock_sock (sk); +if (sk->sk_state !=RXRPC_SERVER_LISTENING || !rx->backlog) { + ret = -ESHUTDOWN ; + goto out; + } + + b = rx->backlog; + ret =rxrpc_service_prealloc_one (rx, b, notify_rx, + user_attach_call, user_call_ID, + gfp, debug_id); + +out: +release_sock (sk); +return ret; }EXPORT_SYMBOL (rxrpc_kernel_charge_accept);
Greg Kroah-Hartman
maintainerPATCH 75/303 fbcon: Rename struct fbcon_ops to struct fbcon_par
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <[email protected]>
[ Upstream commit a6adbbc4c32a016146e117b1e9e5242724a75e10 ]
The type struct fbcon_ops contains fbcon state and callbacks. As the callbacks will be removed from struct fbcon_ops, rename the data type to struct fbcon_par. Also rename the variables from ops to par.
The _par postfix ("private access registers") is used throughout the fbdev subsystem for per-driver state. The fbcon pointer within struct fb_info is also named fbcon_par. Hence, the new naming fits existing practice.
v2:
- rename struct fbcon_ops to struct fbcon_par
- fix build for CONFIG_FB_TILEBITTING=n (kernel test robot)
- fix indention
Stable-dep-of: 84202754fb17 ("fbcon: Use correct type for vc_resize() return value")
--- drivers/video/fbdev/core/bitblit.c | 122 ++++----- drivers/video/fbdev/core/fbcon.c | 417 +++++++++++++++----------------- drivers/video/fbdev/core/fbcon.h | 6 drivers/video/fbdev/core/fbcon_ccw.c | 148 +++++------ drivers/video/fbdev/core/fbcon_cw.c | 148 +++++------ drivers/video/fbdev/core/fbcon_rotate.c | 44 +-- drivers/video/fbdev/core/fbcon_rotate.h | 6 drivers/video/fbdev/core/fbcon_ud.c | 164 ++++++------ drivers/video/fbdev/core/softcursor.c | 20 - drivers/video/fbdev/core/tileblit.c | 28 +- 10 files changed, 547 insertions(+), 556 deletions(-)
drivers/video/fbdev/core/bitblit.c +61 -61
@@ -261,10 +261,10 @@ static void bit_cursor(struct vc_data *v int fg, int bg) {struct fb_cursor cursor; -struct fbcon_ops *ops = info->fbcon_par; +struct fbcon_par *par = info->fbcon_par;unsigned short charmask = vc->vc_hi_font_mask ?0x1ff :0xff ;int w =DIV_ROUND_UP (vc->vc_font.width,8 ), c; -int y =real_y (ops->p, vc->state.y); +int y =real_y (par->p, vc->state.y);int attribute, use_sw = vc->vc_cursor_type &CUR_SW ;int err =1 ;char *src;
@@ -283,10 +283,10 @@ static void bit_cursor(struct vc_data *v c =0 ; src = vc->vc_font.data + (c * (w * vc->vc_font.height)); -if (ops->cursor_state.image.data != src || - ops->cursor_reset) { - ops->cursor_state.image.data = src; - cursor.set |=FB_CUR_SETIMAGE ; +if (par->cursor_state.image.data != src || + par->cursor_reset) { + par->cursor_state.image.data = src; + cursor.set |=FB_CUR_SETIMAGE ; }if (attribute) {
@@ -295,46 +295,46 @@ static void bit_cursor(struct vc_data *v dst =kmalloc_array (w, vc->vc_font.height,GFP_ATOMIC );if (!dst)return ; -kfree (ops->cursor_data); - ops->cursor_data = dst; +kfree (par->cursor_data); + par->cursor_data = dst;update_attr (dst, src, attribute, vc); src = dst; } -if (ops->cursor_state.image.fg_color != fg || - ops->cursor_state.image.bg_color != bg || - ops->cursor_reset) { - ops->cursor_state.image.fg_color = fg; - ops->cursor_state.image.bg_color = bg; +if (par->cursor_state.image.fg_color != fg || + par->cursor_state.image.bg_color != bg || + par->cursor_reset) { + par->cursor_state.image.fg_color = fg; + par->cursor_state.image.bg_color = bg; cursor.set |=FB_CUR_SETCMAP ; } -if ((ops->cursor_state.image.dx != (vc->vc_font.width * vc->state.x)) || - (ops->cursor_state.image.dy != (vc->vc_font.height * y)) || - ops->cursor_reset) { - ops->cursor_state.image.dx = vc->vc_font.width * vc->state.x; - ops->cursor_state.image.dy = vc->vc_font.height * y; +if ((par->cursor_state.image.dx != (vc->vc_font.width * vc->state.x)) || + (par->cursor_state.image.dy != (vc->vc_font.height * y)) || + par->cursor_reset) { + par->cursor_state.image.dx = vc->vc_font.width * vc->state.x; + par->cursor_state.image.dy = vc->vc_font.height * y; cursor.set |=FB_CUR_SETPOS ; } -if (ops->cursor_state.image.height != vc->vc_font.height || - ops->cursor_state.image.width != vc->vc_font.width || - ops->cursor_reset) { - ops->cursor_state.image.height = vc->vc_font.height; - ops->cursor_state.image.width = vc->vc_font.width; +if (par->cursor_state.image.height != vc->vc_font.height || + par->cursor_state.image.width != vc->vc_font.width || + par->cursor_reset) { + par->cursor_state.image.height = vc->vc_font.height; + par->cursor_state.image.width = vc->vc_font.width; cursor.set |=FB_CUR_SETSIZE ; } -if (ops->cursor_state.hot.x || ops->cursor_state.hot.y || - ops->cursor_reset) { - ops->cursor_state.hot.x = cursor.hot.y =0 ; +if (par->cursor_state.hot.x || par->cursor_state.hot.y || + par->cursor_reset) { + par->cursor_state.hot.x = cursor.hot.y =0 ; cursor.set |=FB_CUR_SETHOT ; }if (cursor.set &FB_CUR_SETSIZE || - vc->vc_cursor_type != ops->p->cursor_shape || - ops->cursor_state.mask ==NULL || - ops->cursor_reset) { + vc->vc_cursor_type != par->p->cursor_shape || + par->cursor_state.mask ==NULL || + par->cursor_reset) {char *mask =kmalloc_array (w, vc->vc_font.height,GFP_ATOMIC );int cur_height, size, i =0 ;u8 msk =0xff ;
@@ -342,13 +342,13 @@ static void bit_cursor(struct vc_data *vif (!mask)return ; -kfree (ops->cursor_state.mask); - ops->cursor_state.mask = mask; +kfree (par->cursor_state.mask); + par->cursor_state.mask = mask; - ops->p->cursor_shape = vc->vc_cursor_type; + par->p->cursor_shape = vc->vc_cursor_type; cursor.set |=FB_CUR_SETSHAPE ; -switch (CUR_SIZE (ops->p->cursor_shape)) { +switch (CUR_SIZE (par->p->cursor_shape)) {case CUR_NONE : cur_height =0 ;break ;
@@ -379,26 +379,26 @@ static void bit_cursor(struct vc_data *vswitch (mode) {case CM_ERASE : - ops->cursor_state.enable =0 ; + par->cursor_state.enable =0 ;break ;case CM_DRAW :case CM_MOVE :default : - ops->cursor_state.enable = (use_sw) ?0 :1 ; + par->cursor_state.enable = (use_sw) ?0 :1 ;break ; } cursor.image.data = src; - cursor.image.fg_color = ops->cursor_state.image.fg_color; - cursor.image.bg_color = ops->cursor_state.image.bg_color; - cursor.image.dx = ops->cursor_state.image.dx; - cursor.image.dy = ops->cursor_state.image.dy; - cursor.image.height = ops->cursor_state.image.height; - cursor.image.width = ops->cursor_state.image.width; - cursor.hot.x = ops->cursor_state.hot.x; - cursor.hot.y = ops->cursor_state.hot.y; - cursor.mask = ops->cursor_state.mask; - cursor.enable = ops->cursor_state.enable; + cursor.image.fg_color = par->cursor_state.image.fg_color; + cursor.image.bg_color = par->cursor_state.image.bg_color; + cursor.image.dx = par->cursor_state.image.dx; + cursor.image.dy = par->cursor_state.image.dy; + cursor.image.height = par->cursor_state.image.height; + cursor.image.width = par->cursor_state.image.width; + cursor.hot.x = par->cursor_state.hot.x; + cursor.hot.y = par->cursor_state.hot.y; + cursor.mask = par->cursor_state.mask; + cursor.enable = par->cursor_state.enable; cursor.image.depth =1 ; cursor.rop =ROP_XOR ;
@@ -408,31 +408,31 @@ static void bit_cursor(struct vc_data *vif (err)soft_cursor (info, &cursor); - ops->cursor_reset =0 ; + par->cursor_reset =0 ; }static int bit_update_start (struct fb_info *info) { -struct fbcon_ops *ops = info->fbcon_par; +struct fbcon_par *par = info->fbcon_par;int err; - err =fb_pan_display (info, &ops->var); - ops->var.xoffset = info->var.xoffset; - ops->var.yoffset = info->var.yoffset; - ops->var.vmode = info->var.vmode; + err =fb_pan_display (info, &par->var); + par->var.xoffset = info->var.xoffset; + par->var.yoffset = info->var.yoffset; + par->var.vmode = info->var.vmode;return err; } -void fbcon_set_bitops (struct fbcon_ops *ops) +void fbcon_set_bitops (struct fbcon_par *par) { - ops->bmove = bit_bmove; - ops->clear = bit_clear; - ops->putcs = bit_putcs; - ops->clear_margins = bit_clear_margins; - ops->cursor = bit_cursor; - ops->update_start = bit_update_start; - ops->rotate_font =NULL ; + par->bmove = bit_bmove; + par->clear = bit_clear; + par->putcs = bit_putcs; + par->clear_margins = bit_clear_margins; + par->cursor = bit_cursor; + par->update_start = bit_update_start; + par->rotate_font =NULL ; -if (ops->rotate) -fbcon_set_rotate (ops); +if (par->rotate) +fbcon_set_rotate (par); }
drivers/video/fbdev/core/fbcon.c +204 -213
1,057 lines not on this page · raw message
drivers/video/fbdev/core/fbcon.h +3 -3
@@ -50,7 +50,7 @@ struct fbcon_display {const struct fb_videomode *mode; }; -struct fbcon_ops { +struct fbcon_par {void (*bmove)(struct vc_data *vc,struct fb_info *info,int sy,int sx,int dy,int dx,int height,int width); void (*clear)(struct vc_data *vc, struct fb_info *info, int sy,
@@ -185,7 +185,7 @@ static inline u_short fb_scrollmode(stru#ifdef CONFIG_FB_TILEBLITTING extern void fbcon_set_tileops (struct vc_data *vc,struct fb_info *info);#endif -extern void fbcon_set_bitops (struct fbcon_ops *ops); +extern void fbcon_set_bitops (struct fbcon_par *par);extern int soft_cursor (struct fb_info *info,struct fb_cursor *cursor);#define FBCON_ATTRIBUTE_UNDERLINE 1
@@ -224,7 +224,7 @@ static inline int get_attribute(struct f (i == FB_ROTATE_UR || i == FB_ROTATE_UD) ? _r : _v; })#ifdef CONFIG_FRAMEBUFFER_CONSOLE_ROTATION -extern void fbcon_set_rotate (struct fbcon_ops *ops); +extern void fbcon_set_rotate (struct fbcon_par *par);#else #define fbcon_set_rotate (x) do {} while(0)#endif /* CONFIG_FRAMEBUFFER_CONSOLE_ROTATION */
drivers/video/fbdev/core/fbcon_ccw.c +74 -74
269 lines not on this page · raw message
drivers/video/fbdev/core/fbcon_cw.c +74 -74
269 lines not on this page · raw message
drivers/video/fbdev/core/fbcon_rotate.c +22 -22
90 lines not on this page · raw message
drivers/video/fbdev/core/fbcon_rotate.h +3 -3
@@ -90,7 +90,7 @@ static inline void rotate_ccw(const char } } -extern void fbcon_rotate_cw (struct fbcon_ops *ops); -extern void fbcon_rotate_ud (struct fbcon_ops *ops); -extern void fbcon_rotate_ccw (struct fbcon_ops *ops); +extern void fbcon_rotate_cw (struct fbcon_par *par); +extern void fbcon_rotate_ud (struct fbcon_par *par); +extern void fbcon_rotate_ccw (struct fbcon_par *par);#endif
drivers/video/fbdev/core/fbcon_ud.c +82 -82
299 lines not on this page · raw message
drivers/video/fbdev/core/softcursor.c +10 -10
@@ -21,7 +21,7 @@int soft_cursor (struct fb_info *info,struct fb_cursor *cursor) { -struct fbcon_ops *ops = info->fbcon_par; +struct fbcon_par *par = info->fbcon_par;unsigned int scan_align = info->pixmap.scan_align -1 ;unsigned int buf_align = info->pixmap.buf_align -1 ;unsigned int i, size, dsize, s_pitch, d_pitch;
@@ -34,19 +34,19 @@ int soft_cursor(struct fb_info *info, st s_pitch = (cursor->image.width +7 ) >>3 ; dsize = s_pitch * cursor->image.height; -if (dsize +sizeof (struct fb_image ) != ops->cursor_size) { -kfree (ops->cursor_src); - ops->cursor_size = dsize +sizeof (struct fb_image ); - - ops->cursor_src =kmalloc (ops->cursor_size,GFP_ATOMIC ); -if (!ops->cursor_src) { - ops->cursor_size =0 ; +if (dsize +sizeof (struct fb_image ) != par->cursor_size) { +kfree (par->cursor_src); + par->cursor_size = dsize +sizeof (struct fb_image ); + + par->cursor_src =kmalloc (par->cursor_size,GFP_ATOMIC ); +if (!par->cursor_src) { + par->cursor_size =0 ;return -ENOMEM ; } } - src = ops->cursor_src +sizeof (struct fb_image ); - image = (struct fb_image *)ops->cursor_src; + src = par->cursor_src +sizeof (struct fb_image ); + image = (struct fb_image *)par->cursor_src; *image = cursor->image; d_pitch = (s_pitch + scan_align) & ~scan_align;
drivers/video/fbdev/core/tileblit.c +14 -14
@@ -151,34 +151,34 @@ static void tile_cursor(struct vc_data *static int tile_update_start (struct fb_info *info) { -struct fbcon_ops *ops = info->fbcon_par; +struct fbcon_par *par = info->fbcon_par;int err; - err =fb_pan_display (info, &ops->var); - ops->var.xoffset = info->var.xoffset; - ops->var.yoffset = info->var.yoffset; - ops->var.vmode = info->var.vmode; + err =fb_pan_display (info, &par->var); + par->var.xoffset = info->var.xoffset; + par->var.yoffset = info->var.yoffset; + par->var.vmode = info->var.vmode;return err; }void fbcon_set_tileops (struct vc_data *vc,struct fb_info *info) {struct fb_tilemap map; -struct fbcon_ops *ops = info->fbcon_par; +struct fbcon_par *par = info->fbcon_par; - ops->bmove = tile_bmove; - ops->clear = tile_clear; - ops->putcs = tile_putcs; - ops->clear_margins = tile_clear_margins; - ops->cursor = tile_cursor; - ops->update_start = tile_update_start; + par->bmove = tile_bmove; + par->clear = tile_clear; + par->putcs = tile_putcs; + par->clear_margins = tile_clear_margins; + par->cursor = tile_cursor; + par->update_start = tile_update_start; -if (ops->p) { +if (par->p) { map.width = vc->vc_font.width; map.height = vc->vc_font.height; map.depth =1 ; map.length = vc->vc_font.charcount; - map.data = ops->p->fontdata; + map.data = par->p->fontdata; info->tileops->fb_settile (info, &map); } }
Greg Kroah-Hartman
maintainerPATCH 76/303 fbcon: Use correct type for vc_resize() return value
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiacheng Yu <[email protected]>
[ Upstream commit 84202754fb1727dc3ee87f47104e4162ecc8ba3a ]
The return value of vc_resize() is int, but fbcon_set_disp() stores it in an unsigned long variable. While the !ret check happens to work correctly by coincidence (negative values become large positive values), the types should match. Use int instead.
Eliminates the following W=3 warning:
drivers/video/fbdev/core/fbcon.c: In function 'fbcon_set_disp':
drivers/video/fbdev/core/fbcon.c:1494:14: warning: implicit conversion from 'int' to 'unsigned long' [-Wconversion]
--- drivers/video/fbdev/core/fbcon.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/video/fbdev/core/fbcon.c +1 -2
@@ -1354,8 +1354,7 @@ static void fbcon_set_disp(struct fb_infstruct vc_data **default_mode, *vc;struct vc_data *svc;struct fbcon_par *par = info->fbcon_par; -int rows, cols; -unsigned long ret =0 ; +int rows, cols, ret; p = &fb_display[unit];
Greg Kroah-Hartman
maintainerPATCH 77/303 tipc: restrict socket queue dumps in enqueue tracepoints
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Xiasong <[email protected]>
[ Upstream commit acd7df8d955480a6f6e5bb809da67b1500cc3cf4 ]
tipc_sk_enqueue() runs with sk->sk_lock.slock held while the socket is owned by user context. The spinlock protects the backlog queue in this path, but it does not serialize against the socket owner consuming or purging sk_receive_queue.
KASAN reported:
CPU: 14 UID: 0 PID: 1050 Comm: tipc3 Not tainted 7.1.0-rc6+ #126 PREEMPT(lazy)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x76/0xa0 lib/dump_stack.c:123
print_report+0xce/0x5b0 mm/kasan/report.c:482
kasan_report+0xc6/0x100 mm/kasan/report.c:597
__asan_report_load4_noabort+0x14/0x30 mm/kasan/report_generic.c:380
tipc_skb_dump+0x1327/0x16f0 net/tipc/trace.c:73
tipc_list_dump+0x208/0x2e0 net/tipc/trace.c:187
tipc_sk_dump+0xaf6/0xd60 net/tipc/socket.c:3996
trace_event_raw_event_tipc_sk_class+0x312/0x5a0 net/tipc/trace.h:188
tipc_sk_rcv+0xb1d/0x1d50 net/tipc/socket.c:2497
tipc_node_xmit+0x1c3/0x1440 net/tipc/node.c:1689
__tipc_sendmsg+0x97a/0x1440 net/tipc/socket.c:1512
tipc_sendmsg+0x52/0x80 net/tipc/socket.c:1400
sock_sendmsg+0x2f6/0x3e0 net/socket.c:825
splice_to_socket+0x7f9/0x1010 fs/splice.c:884
do_splice+0xe21/0x2330 fs/splice.c:936
__do_splice+0x153/0x260 fs/splice.c:1431
__x64_sys_splice+0x150/0x230 fs/splice.c:1616
x64_sys_call+0xeb5/0x2790 arch/x86/entry/syscall_64.c:41
do_syscall_64+0xf3/0x620 arch/x86/entry/syscall_64.c:63
entry_SYSCALL_64_after_hwframe+0x76/0x7e arch/x86/entry/entry_64.S:130
RIP: 0033:0x71624e8aafe2
Code: 08 0f 85 71 3a ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 66 2e 0f 1f 84 00 00 00 00 00 66
RSP: 002b:0000716157ffed68 EFLAGS: 00000246 ORIG_RAX: 0000000000000113
RAX: ffffffffffffffda RBX: 0000716157fff6c0 RCX: 000071624e8aafe2
RDX: 000000000000005f RSI: 0000000000000000 RDI: 0000000000000066
RBP: 0000716157ffed90 R08: 0000000000008000 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffff00
R13: 0000000000000021 R14: 0000000000000000 R15: 00007fff89799c40
</TASK>The TIPC_DUMP_ALL tracepoints in tipc_sk_enqueue() also dump sk_receive_queue and can therefore dereference skbs that the socket owner has already dequeued or freed. Restrict these dumps to TIPC_DUMP_SK_BKLGQ, which matches the queue protected by the held spinlock.
Keep the change limited to the enqueue path, where the unsafe queue dump is reachable while the socket is owned by user context.
--- net/tipc/socket.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/tipc/socket.c +3 -3
@@ -2458,17 +2458,17 @@ static void tipc_sk_enqueue(struct sk_buatomic_set (dcnt,0 ); lim =rcvbuf_limit (sk, skb) +atomic_read (dcnt);if (likely (!sk_add_backlog (sk, skb, lim))) { -trace_tipc_sk_overlimit1 (sk, skb,TIPC_DUMP_ALL , +trace_tipc_sk_overlimit1 (sk, skb,TIPC_DUMP_SK_BKLGQ ,"bklg & rcvq >90% allocated!" );continue ; } -trace_tipc_sk_dump (sk, skb,TIPC_DUMP_ALL ,"err_overload!" ); +trace_tipc_sk_dump (sk, skb,TIPC_DUMP_SK_BKLGQ ,"err_overload!" );/* Overload => reject message back to sender */ onode =tipc_own_addr (sock_net (sk));atomic_inc (&sk->sk_drops);if (tipc_msg_reverse (onode, &skb,TIPC_ERR_OVERLOAD )) { -trace_tipc_sk_rej_msg (sk, skb,TIPC_DUMP_ALL , +trace_tipc_sk_rej_msg (sk, skb,TIPC_DUMP_SK_BKLGQ ,"@sk_enqueue!" );__skb_queue_tail (xmitq, skb); }
Greg Kroah-Hartman
maintainerPATCH 78/303 vduse: Use fixed 4KB bounce pages for non-4KB page size
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sheng Zhao <[email protected]>
[ Upstream commit 3fc3068e7247c94dec08e93fea422a1bb649bfe5 ]
The allocation granularity of bounce pages is PAGE_SIZE. This may cause even small IO requests to occupy an entire bounce page exclusively. The kind of memory waste will be more significant when PAGE_SIZE is larger than 4KB (e.g. arm64 with 64KB pages).
So, optimize it by using fixed 4KB bounce maps and iova allocation granularity. A single IO request occupies at least a 4KB bounce page instead of the entire memory page of PAGE_SIZE.
Message-Id: <[email protected]>
Stable-dep-of: 9c1523803445 ("VDUSE: avoid leaking information to userspace")
--- drivers/vdpa/vdpa_user/iova_domain.c | 134 +++++++++++++++++++++++++---------- drivers/vdpa/vdpa_user/iova_domain.h | 5 + 2 files changed, 101 insertions(+), 38 deletions(-)
drivers/vdpa/vdpa_user/iova_domain.c +96 -38
@@ -103,19 +103,38 @@ void vduse_domain_clear_map(struct vdusestatic int vduse_domain_map_bounce_page (struct vduse_iova_domain *domain,u64 iova,u64 size,u64 paddr) { -struct vduse_bounce_map *map; +struct vduse_bounce_map *map, *head_map; +struct page *tmp_page;u64 last = iova + size -1 ;while (iova <= last) { - map = &domain->bounce_maps[iova >>PAGE_SHIFT ]; +/* +* When PAGE_SIZE is larger than 4KB, multiple adjacent bounce_maps will +* point to the same memory page of PAGE_SIZE. Since bounce_maps originate +* from IO requests, we may not be able to guarantee that the orig_phys +* values of all IO requests within the same 64KB memory page are contiguous. +* Therefore, we need to store them separately. +* +* Bounce pages are allocated on demand. As a result, it may occur that +* multiple bounce pages corresponding to the same 64KB memory page attempt +* to allocate memory simultaneously, so we use cmpxchg to handle this +* concurrency. +*/ + map = &domain->bounce_maps[iova >>BOUNCE_MAP_SHIFT ];if (!map->bounce_page) { - map->bounce_page =alloc_page (GFP_ATOMIC ); -if (!map->bounce_page) -return -ENOMEM ; + head_map = &domain->bounce_maps[(iova &PAGE_MASK ) >>BOUNCE_MAP_SHIFT ]; +if (!head_map->bounce_page) { + tmp_page =alloc_page (GFP_ATOMIC ); +if (!tmp_page) +return -ENOMEM ; +if (cmpxchg (&head_map->bounce_page,NULL , tmp_page)) +__free_page (tmp_page); + } + map->bounce_page = head_map->bounce_page; } map->orig_phys = paddr; - paddr +=PAGE_SIZE ; - iova +=PAGE_SIZE ; + paddr +=BOUNCE_MAP_SIZE ; + iova +=BOUNCE_MAP_SIZE ; }return 0 ; }
@@ -127,12 +146,17 @@ static void vduse_domain_unmap_bounce_pau64 last = iova + size -1 ;while (iova <= last) { - map = &domain->bounce_maps[iova >>PAGE_SHIFT ]; + map = &domain->bounce_maps[iova >>BOUNCE_MAP_SHIFT ]; map->orig_phys =INVALID_PHYS_ADDR ; - iova +=PAGE_SIZE ; + iova +=BOUNCE_MAP_SIZE ; } } +static unsigned int offset_in_bounce_page (dma_addr_t addr) +{ +return (addr & ~BOUNCE_MAP_MASK ); +} +static void do_bounce (phys_addr_t orig,void *addr,size_t size,enum dma_data_direction dir) {
@@ -162,7 +186,7 @@ static void vduse_domain_bounce(struct v enum dma_data_direction dir) {struct vduse_bounce_map *map; -unsigned int offset; +unsigned int offset, head_offset;void *addr;size_t sz;
@@ -170,16 +194,17 @@ static void vduse_domain_bounce(struct vreturn ;while (size) { - map = &domain->bounce_maps[iova >>PAGE_SHIFT ]; - offset =offset_in_page (iova); - sz =min_t (size_t,PAGE_SIZE - offset, size); + map = &domain->bounce_maps[iova >>BOUNCE_MAP_SHIFT ]; + head_offset =offset_in_page (iova); + offset =offset_in_bounce_page (iova); + sz =min_t (size_t,BOUNCE_MAP_SIZE - offset, size);if (WARN_ON (!map->bounce_page || map->orig_phys ==INVALID_PHYS_ADDR ))return ; addr =kmap_local_page (map->bounce_page); -do_bounce (map->orig_phys + offset, addr + offset, sz, dir); +do_bounce (map->orig_phys + offset, addr + head_offset, sz, dir);kunmap_local (addr); size -= sz; iova += sz;
@@ -214,7 +239,7 @@ vduse_domain_get_bounce_page(struct vdusstruct page *page =NULL ;read_lock (&domain->bounce_lock); - map = &domain->bounce_maps[iova >>PAGE_SHIFT ]; + map = &domain->bounce_maps[iova >>BOUNCE_MAP_SHIFT ];if (domain->user_bounce_pages || !map->bounce_page) goto out;
@@ -232,7 +257,7 @@ vduse_domain_free_kernel_bounce_pages(ststruct vduse_bounce_map *map;unsigned long pfn, bounce_pfns; - bounce_pfns = domain->bounce_size >>PAGE_SHIFT ; + bounce_pfns = domain->bounce_size >>BOUNCE_MAP_SHIFT ;for (pfn =0 ; pfn < bounce_pfns; pfn++) { map = &domain->bounce_maps[pfn];
@@ -242,7 +267,8 @@ vduse_domain_free_kernel_bounce_pages(stif (!map->bounce_page)continue ; -__free_page (map->bounce_page); +if (!((pfn <<BOUNCE_MAP_SHIFT ) & ~PAGE_MASK )) +__free_page (map->bounce_page); map->bounce_page =NULL ; } }
@@ -250,8 +276,12 @@ vduse_domain_free_kernel_bounce_pages(stint vduse_domain_add_user_bounce_pages (struct vduse_iova_domain *domain,struct page **pages,int count) { -struct vduse_bounce_map *map; -int i, ret; +struct vduse_bounce_map *map, *head_map; +int i, j, ret; +int inner_pages =PAGE_SIZE /BOUNCE_MAP_SIZE ; +int bounce_pfns = domain->bounce_size >>BOUNCE_MAP_SHIFT ; +struct page *head_page =NULL ; +bool need_copy;/* Now we don't support partial mapping */ if (count != (domain->bounce_size >>PAGE_SHIFT ))
@@ -263,17 +293,25 @@ int vduse_domain_add_user_bounce_pages(s goto out;for (i =0 ; i < count; i++) { - map = &domain->bounce_maps[i]; -if (map->bounce_page) { + need_copy = false; + head_map = &domain->bounce_maps[(i * inner_pages)]; + head_page = head_map->bounce_page; +for (j =0 ; j < inner_pages; j++) { +if ((i * inner_pages + j) >= bounce_pfns) +break ; + map = &domain->bounce_maps[(i * inner_pages + j)];/* Copy kernel page to user page if it's in use */ -if (map->orig_phys !=INVALID_PHYS_ADDR ) -memcpy_to_page (pages[i],0 , -page_address (map->bounce_page), -PAGE_SIZE ); -__free_page (map->bounce_page); +if ((head_page) && (map->orig_phys !=INVALID_PHYS_ADDR )) + need_copy = true; + map->bounce_page = pages[i]; } - map->bounce_page = pages[i];get_page (pages[i]); +if ((head_page) && (need_copy)) +memcpy_to_page (pages[i],0 , +page_address (head_page), +PAGE_SIZE ); +if (head_page) +__free_page (head_page); } domain->user_bounce_pages = true; ret =0 ;
@@ -285,8 +323,12 @@ out:void vduse_domain_remove_user_bounce_pages (struct vduse_iova_domain *domain) { -struct vduse_bounce_map *map; -unsigned long i, count; +struct vduse_bounce_map *map, *head_map; +unsigned long i, j, count; +int inner_pages =PAGE_SIZE /BOUNCE_MAP_SIZE ; +int bounce_pfns = domain->bounce_size >>BOUNCE_MAP_SHIFT ; +struct page *head_page =NULL ; +bool need_copy;write_lock (&domain->bounce_lock);if (!domain->user_bounce_pages)
@@ -296,18 +338,34 @@ void vduse_domain_remove_user_bounce_pagfor (i =0 ; i < count; i++) {struct page *page =NULL ; - map = &domain->bounce_maps[i]; -if (WARN_ON (!map->bounce_page)) + need_copy = false; + head_map = &domain->bounce_maps[(i * inner_pages)]; +if (WARN_ON (!head_map->bounce_page))continue ; + head_page = head_map->bounce_page; -/* Copy user page to kernel page if it's in use */ -if (map->orig_phys !=INVALID_PHYS_ADDR ) { +for (j =0 ; j < inner_pages; j++) { +if ((i * inner_pages + j) >= bounce_pfns) +break ; + map = &domain->bounce_maps[(i * inner_pages + j)]; +if (WARN_ON (!map->bounce_page)) +continue ; +/* Copy user page to kernel page if it's in use */ +if (map->orig_phys !=INVALID_PHYS_ADDR ) + need_copy = true; + } +if (need_copy) { page =alloc_page (GFP_ATOMIC | __GFP_NOFAIL);memcpy_from_page (page_address (page), - map->bounce_page,0 ,PAGE_SIZE ); + head_page,0 ,PAGE_SIZE ); + } +for (j =0 ; j < inner_pages; j++) { +if ((i * inner_pages + j) >= bounce_pfns) +break ; + map = &domain->bounce_maps[(i * inner_pages + j)]; + map->bounce_page = page; } -put_page (map->bounce_page); - map->bounce_page = page; +put_page (head_page); } domain->user_bounce_pages = false; out:
@@ -557,7 +615,7 @@ vduse_domain_create(unsigned long iova_lunsigned long pfn, bounce_pfns;int ret; - bounce_pfns =PAGE_ALIGN (bounce_size) >>PAGE_SHIFT ; + bounce_pfns =PAGE_ALIGN (bounce_size) >>BOUNCE_MAP_SHIFT ;if (iova_limit <= bounce_size)return NULL ;
@@ -589,7 +647,7 @@ vduse_domain_create(unsigned long iova_lrwlock_init (&domain->bounce_lock);spin_lock_init (&domain->iotlb_lock);init_iova_domain (&domain->stream_iovad, -PAGE_SIZE ,IOVA_START_PFN ); +BOUNCE_MAP_SIZE ,IOVA_START_PFN ); ret =iova_domain_init_rcaches (&domain->stream_iovad);if (ret) goto err_iovad_stream;
drivers/vdpa/vdpa_user/iova_domain.h +5 -0
@@ -20,6 +20,11 @@#define INVALID_PHYS_ADDR (~(phys_addr_t)0) +#define BOUNCE_MAP_SHIFT 12 +#define BOUNCE_MAP_SIZE (1 << BOUNCE_MAP_SHIFT) +#define BOUNCE_MAP_MASK (~(BOUNCE_MAP_SIZE - 1)) +#define BOUNCE_MAP_ALIGN (addr) (((addr) + BOUNCE_MAP_SIZE - 1) & ~(BOUNCE_MAP_SIZE - 1)) +struct vduse_bounce_map {struct page *bounce_page;u64 orig_phys;
Greg Kroah-Hartman
maintainerPATCH 79/303 vduse: remove unused vaddr parameter of vduse_domain_free_coherent
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eugenio Pérez <[email protected]>
[ Upstream commit 766e1749c0ef6a09651be9b8a8283d508c322b58 ]
We will modify the function in next patches so let's clean it first.
Message-Id: <[email protected]>
Stable-dep-of: 9c1523803445 ("VDUSE: avoid leaking information to userspace")
--- drivers/vdpa/vdpa_user/iova_domain.c | 3 +-- drivers/vdpa/vdpa_user/iova_domain.h | 3 +-- drivers/vdpa/vdpa_user/vduse_dev.c | 2 +- 3 files changed, 3 insertions(+), 5 deletions(-)
drivers/vdpa/vdpa_user/iova_domain.c +1 -2
@@ -514,8 +514,7 @@ err: }void vduse_domain_free_coherent (struct vduse_iova_domain *domain,size_t size, -void *vaddr,dma_addr_t dma_addr, -unsigned long attrs) +dma_addr_t dma_addr,unsigned long attrs) {struct iova_domain *iovad = &domain->consistent_iovad;struct vhost_iotlb_map *map;
drivers/vdpa/vdpa_user/iova_domain.h +1 -2
@@ -64,8 +64,7 @@ void *vduse_domain_alloc_coherent(struct gfp_t flag, unsigned long attrs);void vduse_domain_free_coherent (struct vduse_iova_domain *domain,size_t size, -void *vaddr,dma_addr_t dma_addr, -unsigned long attrs); +dma_addr_t dma_addr,unsigned long attrs);void vduse_domain_reset_bounce_map (struct vduse_iova_domain *domain);
drivers/vdpa/vdpa_user/vduse_dev.c +1 -1
@@ -836,7 +836,7 @@ static void vduse_dev_free_coherent(strustruct vduse_dev *vdev =dev_to_vduse (dev);struct vduse_iova_domain *domain = vdev->domain; -vduse_domain_free_coherent (domain, size, vaddr, dma_addr, attrs); +vduse_domain_free_coherent (domain, size, dma_addr, attrs); }static size_t vduse_dev_max_mapping_size (struct device *dev)
Greg Kroah-Hartman
maintainerPATCH 80/303 vduse: take out allocations from vduse_dev_alloc_coherent
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eugenio Pérez <[email protected]>
[ Upstream commit 489d76520612abf9a4ede4344349105406c91a73 ]
The function vduse_dev_alloc_coherent will be called under rwlock in next patches. Make it out of the lock to avoid increasing its fail rate.
Message-Id: <[email protected]>
Stable-dep-of: 9c1523803445 ("VDUSE: avoid leaking information to userspace")
--- drivers/vdpa/vdpa_user/iova_domain.c | 24 +++++++----------------- drivers/vdpa/vdpa_user/iova_domain.h | 5 ++--- drivers/vdpa/vdpa_user/vduse_dev.c | 14 ++++++++++---- 3 files changed, 19 insertions(+), 24 deletions(-)
drivers/vdpa/vdpa_user/iova_domain.c +7 -17
@@ -479,17 +479,15 @@ void vduse_domain_unmap_page(struct vdusvduse_domain_free_iova (iovad, dma_addr, size); } -void *vduse_domain_alloc_coherent (struct vduse_iova_domain *domain, -size_t size,dma_addr_t *dma_addr, -gfp_t flag,unsigned long attrs) +dma_addr_t vduse_domain_alloc_coherent (struct vduse_iova_domain *domain, +size_t size,void *orig) {struct iova_domain *iovad = &domain->consistent_iovad;unsigned long limit = domain->iova_limit;dma_addr_t iova =vduse_domain_alloc_iova (iovad, size, limit); -void *orig =alloc_pages_exact (size, flag); -if (!iova || !orig) - goto err; +if (!iova) +return DMA_MAPPING_ERROR ;spin_lock (&domain->iotlb_lock); if (vduse_iotlb_add_range(domain, (u64)iova, (u64)iova + size - 1,
@@ -500,17 +498,12 @@ void *vduse_domain_alloc_coherent(struct }spin_unlock (&domain->iotlb_lock); - *dma_addr = iova; +return iova; -return orig; err: - *dma_addr =DMA_MAPPING_ERROR ; -if (orig) -free_pages_exact (orig, size); -if (iova) -vduse_domain_free_iova (iovad, iova, size); +vduse_domain_free_iova (iovad, iova, size); -return NULL ; +return DMA_MAPPING_ERROR ; } void vduse_domain_free_coherent(struct vduse_iova_domain *domain, size_t size,
@@ -519,7 +512,6 @@ void vduse_domain_free_coherent(struct vstruct iova_domain *iovad = &domain->consistent_iovad;struct vhost_iotlb_map *map;struct vdpa_map_file *map_file; -phys_addr_t pa;spin_lock (&domain->iotlb_lock); map = vhost_iotlb_itree_first(domain->iotlb, (u64)dma_addr,
@@ -531,12 +523,10 @@ void vduse_domain_free_coherent(struct v map_file = (struct vdpa_map_file *)map->opaque;fput (map_file->file);kfree (map_file); - pa = map->addr;vhost_iotlb_map_free (domain->iotlb, map);spin_unlock (&domain->iotlb_lock);vduse_domain_free_iova (iovad, dma_addr, size); -free_pages_exact (phys_to_virt (pa), size); }static vm_fault_t vduse_domain_mmap_fault (struct vm_fault *vmf)
drivers/vdpa/vdpa_user/iova_domain.h +2 -3
@@ -59,9 +59,8 @@ void vduse_domain_unmap_page(struct vdus dma_addr_t dma_addr, size_t size, enum dma_data_direction dir, unsigned long attrs); -void *vduse_domain_alloc_coherent (struct vduse_iova_domain *domain, -size_t size,dma_addr_t *dma_addr, -gfp_t flag,unsigned long attrs); +dma_addr_t vduse_domain_alloc_coherent (struct vduse_iova_domain *domain, +size_t size,void *orig);void vduse_domain_free_coherent (struct vduse_iova_domain *domain,size_t size,dma_addr_t dma_addr,unsigned long attrs);
drivers/vdpa/vdpa_user/vduse_dev.c +10 -4
@@ -815,18 +815,23 @@ static void *vduse_dev_alloc_coherent(st {struct vduse_dev *vdev =dev_to_vduse (dev);struct vduse_iova_domain *domain = vdev->domain; -unsigned long iova;void *addr; *dma_addr =DMA_MAPPING_ERROR ; - addr =vduse_domain_alloc_coherent (domain, size, - (dma_addr_t *)&iova, flag, attrs); + + addr =alloc_pages_exact (size, flag);if (!addr)return NULL ; - *dma_addr = (dma_addr_t )iova; + *dma_addr =vduse_domain_alloc_coherent (domain, size, addr); +if (*dma_addr ==DMA_MAPPING_ERROR ) + goto err;return addr; + +err: +free_pages_exact (addr, size); +return NULL ; } static void vduse_dev_free_coherent(struct device *dev, size_t size,
@@ -837,6 +842,7 @@ static void vduse_dev_free_coherent(strustruct vduse_iova_domain *domain = vdev->domain;vduse_domain_free_coherent (domain, size, dma_addr, attrs); +free_pages_exact (vaddr, size); }static size_t vduse_dev_max_mapping_size (struct device *dev)
Greg Kroah-Hartman
maintainerPATCH 81/303 VDUSE: avoid leaking information to userspace
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Wang <[email protected]>
[ Upstream commit 9c1523803445ee0348f62b77793266dd981596e0 ]
The bounceing is not necessarily page aligned, so current VDUSE can leak kernel information through mapping bounce pages to userspace. Allocate bounce pages with __GFP_ZERO to avoid leaking information to userspace.
Message-ID: <[email protected]>
--- drivers/vdpa/vdpa_user/iova_domain.c | 2 +- drivers/vdpa/vdpa_user/vduse_dev.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/vdpa/vdpa_user/iova_domain.c +1 -1
@@ -124,7 +124,7 @@ static int vduse_domain_map_bounce_page(if (!map->bounce_page) { head_map = &domain->bounce_maps[(iova &PAGE_MASK ) >>BOUNCE_MAP_SHIFT ];if (!head_map->bounce_page) { - tmp_page =alloc_page (GFP_ATOMIC ); + tmp_page =alloc_page (GFP_ATOMIC | __GFP_ZERO);if (!tmp_page)return -ENOMEM ;if (cmpxchg (&head_map->bounce_page,NULL , tmp_page))
drivers/vdpa/vdpa_user/vduse_dev.c +1 -1
@@ -819,7 +819,7 @@ static void *vduse_dev_alloc_coherent(st *dma_addr =DMA_MAPPING_ERROR ; - addr =alloc_pages_exact (size, flag); + addr =alloc_pages_exact (size, flag | __GFP_ZERO);if (!addr)return NULL ;
Greg Kroah-Hartman
maintainerPATCH 82/303 mlxsw: spectrum: On port enslavement to a LAG, join uppers bridges
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Machata <[email protected]>
[ Upstream commit 987c7782f0627e1c87617458806a7e6c1995678a ]
Currently it never happens that a netdevice that is already a bridge slave would suddenly become mlxsw upper. The only case where this might be possible as far as mlxsw is concerned, is with LAG netdevices. But if a LAG already has an upper, enslaving mlxsw port to that LAG is forbidden. Thus the only way to install a LAG between a bridge and a mlxsw port is by first enslaving the port to the LAG, and then enslaving that LAG to a bridge.
However in the following patches, the requirement that ports be only enslaved to masters without uppers, is going to be relaxed. It will therefore be necessary to join bridges of LAG uppers. Without this replay, the mlxsw bridge_port objects are not instantiated, which causes issues later, as a lot of code relies on their presence.
Therefore in this patch, when the first mlxsw physical netdevice is enslaved to a LAG, consider bridges upper to the LAG (both the direct master, if any, and any bridge masters of VLAN uppers), and have the relevant netdevices join their bridges.
Stable-dep-of: 41c8c1d65b32 ("mlxsw: fix refcount leak in mlxsw_sp_port_lag_join()")
--- drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 90 +++++++++++++++++++++++++ 1 file changed, 90 insertions(+)
drivers/net/ethernet/mellanox/mlxsw/spectrum.c +90 -0
@@ -4357,6 +4357,88 @@ static int mlxsw_sp_port_lag_index_get(sreturn -EBUSY ; } +static int mlxsw_sp_lag_uppers_bridge_join (struct mlxsw_sp_port *mlxsw_sp_port, +struct net_device *lag_dev, +struct netlink_ext_ack *extack) +{ +struct net_device *upper_dev; +struct net_device *master; +struct list_head *iter; +int done =0 ; +int err; + + master =netdev_master_upper_dev_get (lag_dev); +if (master &&netif_is_bridge_master (master)) { + err =mlxsw_sp_port_bridge_join (mlxsw_sp_port, lag_dev, master, + extack); +if (err) +return err; + } + +netdev_for_each_upper_dev_rcu (lag_dev, upper_dev, iter) { +if (!is_vlan_dev (upper_dev)) +continue ; + + master =netdev_master_upper_dev_get (upper_dev); +if (master &&netif_is_bridge_master (master)) { + err =mlxsw_sp_port_bridge_join (mlxsw_sp_port, + upper_dev, master, + extack); +if (err) + goto err_port_bridge_join; + } + + ++done; + } + +return 0 ; + +err_port_bridge_join: +netdev_for_each_upper_dev_rcu (lag_dev, upper_dev, iter) { +if (!is_vlan_dev (upper_dev)) +continue ; + + master =netdev_master_upper_dev_get (upper_dev); +if (!master || !netif_is_bridge_master (master)) +continue ; + +if (!done--) +break ; + +mlxsw_sp_port_bridge_leave (mlxsw_sp_port, upper_dev, master); + } + + master =netdev_master_upper_dev_get (lag_dev); +if (master &&netif_is_bridge_master (master)) +mlxsw_sp_port_bridge_leave (mlxsw_sp_port, lag_dev, master); + +return err; +} + +static void +mlxsw_sp_lag_uppers_bridge_leave (struct mlxsw_sp_port *mlxsw_sp_port, +struct net_device *lag_dev) +{ +struct net_device *upper_dev; +struct net_device *master; +struct list_head *iter; + +netdev_for_each_upper_dev_rcu (lag_dev, upper_dev, iter) { +if (!is_vlan_dev (upper_dev)) +continue ; + + master =netdev_master_upper_dev_get (upper_dev); +if (!master) +continue ; + +mlxsw_sp_port_bridge_leave (mlxsw_sp_port, upper_dev, master); + } + + master =netdev_master_upper_dev_get (lag_dev); +if (master) +mlxsw_sp_port_bridge_leave (mlxsw_sp_port, lag_dev, master); +} +static int mlxsw_sp_port_lag_join (struct mlxsw_sp_port *mlxsw_sp_port,struct net_device *lag_dev,struct netlink_ext_ack *extack)
@@ -4381,6 +4463,12 @@ static int mlxsw_sp_port_lag_join(struct err =mlxsw_sp_port_lag_index_get (mlxsw_sp, lag_id, &port_index);if (err)return err; + + err =mlxsw_sp_lag_uppers_bridge_join (mlxsw_sp_port, lag_dev, + extack); +if (err) + goto err_lag_uppers_bridge_join; + err =mlxsw_sp_lag_col_port_add (mlxsw_sp_port, lag_id, port_index);if (err) goto err_col_port_add;
@@ -4410,6 +4498,8 @@ err_router_join: mlxsw_sp_port->local_port);mlxsw_sp_lag_col_port_remove (mlxsw_sp_port, lag_id); err_col_port_add: +mlxsw_sp_lag_uppers_bridge_leave (mlxsw_sp_port, lag_dev); +err_lag_uppers_bridge_join:if (!lag->ref_count)mlxsw_sp_lag_destroy (mlxsw_sp, lag_id);return err;
Greg Kroah-Hartman
maintainerPATCH 83/303 mlxsw: fix refcount leak in mlxsw_sp_port_lag_join()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <[email protected]>
[ Upstream commit 41c8c1d65b32beacd8d916a22457b4f6e47f45af ]
When mlxsw_sp_port_lag_index_get() fails, mlxsw_sp_port_lag_join() returns an error without releasing the lag reference obtained by the earlier mlxsw_sp_lag_get(). All other error paths in the function jump to the cleanup label that ends with mlxsw_sp_lag_put(), so this is a single missed release.
Fix the leak by replacing the bare 'return err' with a goto to the existing error cleanup label, which will drop the reference safely.
--- drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum.c +1 -1
@@ -4462,7 +4462,7 @@ static int mlxsw_sp_port_lag_join(struct err =mlxsw_sp_port_lag_index_get (mlxsw_sp, lag_id, &port_index);if (err) -return err; + goto err_lag_uppers_bridge_join; err =mlxsw_sp_lag_uppers_bridge_join (mlxsw_sp_port, lag_dev, extack);
Greg Kroah-Hartman
maintainerPATCH 84/303 octeontx2: Annotate mmio regions as __iomem
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Subbaraya Sundeep <[email protected]>
[ Upstream commit d0976b43956ee8c8bd093223df9115bfcf63dfe5 ]
This patch removes unnecessary typecasts by marking the mbox_regions array as __iomem since it is used to store pointers to memory-mapped I/O (MMIO) regions. Also simplified the call to readq() in PF driver by removing redundant type casts.
Stable-dep-of: f918554fb724 ("octeontx2-pf: clear stale mailbox IRQ state before request_irq()")
--- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 12 ++++++------ drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 3 +-- 2 files changed, 7 insertions(+), 8 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/rvu.c +6 -6
@@ -2329,7 +2329,7 @@ static inline void rvu_afvf_mbox_up_hand__rvu_mbox_up_handler (mwork,TYPE_AFVF ); } -static int rvu_get_mbox_regions (struct rvu *rvu,void **mbox_addr, +static int rvu_get_mbox_regions (struct rvu *rvu,void __iomem **mbox_addr,int num,int type,unsigned long *pf_bmap) {struct rvu_hwinfo *hw = rvu->hw;
@@ -2354,7 +2354,7 @@ static int rvu_get_mbox_regions(struct r bar4 =rvupf_read64 (rvu,RVU_PF_VF_BAR4_ADDR ); bar4 += region *MBOX_SIZE ; } - mbox_addr[region] = (void *)ioremap_wc (bar4,MBOX_SIZE ); + mbox_addr[region] =ioremap_wc (bar4,MBOX_SIZE );if (!mbox_addr[region]) goto error; }
@@ -2377,7 +2377,7 @@ static int rvu_get_mbox_regions(struct r RVU_AF_PF_BAR4_ADDR); bar4 += region *MBOX_SIZE ; } - mbox_addr[region] = (void *)ioremap_wc (bar4,MBOX_SIZE ); + mbox_addr[region] =ioremap_wc (bar4,MBOX_SIZE );if (!mbox_addr[region]) goto error; }
@@ -2385,7 +2385,7 @@ static int rvu_get_mbox_regions(struct r error:while (region--) -iounmap ((void __iomem *)mbox_addr[region]); +iounmap (mbox_addr[region]);return -ENOMEM ; }
@@ -2395,10 +2395,10 @@ static int rvu_mbox_init(struct rvu *rvu void (mbox_up_handler)(struct work_struct *)) {int err = -EINVAL , i, dir, dir_up; +void __iomem **mbox_regions;void __iomem *reg_base;struct rvu_work *mwork;unsigned long *pf_bmap; -void **mbox_regions;const char *name;u64 cfg;
@@ -2421,7 +2421,7 @@ static int rvu_mbox_init(struct rvu *rvumutex_init (&rvu->mbox_lock); - mbox_regions =kcalloc (num,sizeof (void *),GFP_KERNEL ); + mbox_regions =kcalloc (num,sizeof (void __iomem *),GFP_KERNEL );if (!mbox_regions) { err = -ENOMEM ; goto free_bitmap;
drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +1 -2
@@ -596,8 +596,7 @@ static int otx2_pfvf_mbox_init(struct ot base =pci_resource_start (pf->pdev,PCI_MBOX_BAR_NUM ) +MBOX_SIZE ; else - base =readq ((void __iomem *)((u64 )pf->reg_base + -RVU_PF_VF_BAR4_ADDR )); + base =readq (pf->reg_base +RVU_PF_VF_BAR4_ADDR ); hwbase =ioremap_wc (base,MBOX_SIZE * pf->total_vfs);if (!hwbase) {
Greg Kroah-Hartman
maintainerPATCH 85/303 octeontx2-pf: clear stale mailbox IRQ state before request_irq()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <[email protected]>
[ Upstream commit f918554fb7246e89b98ef90abe80801f038258b3 ]
otx2_register_mbox_intr() currently installs the PF mailbox IRQ handler before clearing stale mailbox interrupt state. The function itself then comments that the local interrupt bits must be cleared first to avoid spurious interrupts, but that clear happens only after request_irq() has already exposed the handler to irq delivery.
A running system can reach this during PF mailbox interrupt registration while stale or latched RVU_PF_INT state is still present. If delivery happens in the request_irq()-to-clear window, otx2_pfaf_mbox_intr_handler() can run before local quiesce and touch the same pf->mbox and pf->mbox_wq carrier that probe and teardown later reuse or destroy.
Move the stale mailbox interrupt clear ahead of request_irq(), but keep interrupt enabling after the handler is installed. This closes the pre-clear early-IRQ window without creating a new enable-before-handler window.
--- drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +4 -4
@@ -1026,6 +1026,9 @@ static int otx2_register_mbox_intr(strucchar *irq_name;int err; +/* Clear stale mailbox interrupt state before installing the handler. */ +otx2_write64 (pf,RVU_PF_INT ,BIT_ULL (0 )); +/* Register mailbox interrupt handler */ irq_name = &hw->irq_name[RVU_PF_INT_VEC_AFPF_MBOX *NAME_SIZE ];snprintf (irq_name,NAME_SIZE ,"RVUPFAF Mbox" );
@@ -1037,10 +1040,7 @@ static int otx2_register_mbox_intr(strucreturn err; } -/* Enable mailbox interrupt for msgs coming from AF. -* First clear to avoid spurious interrupts, if any. -*/ -otx2_write64 (pf,RVU_PF_INT ,BIT_ULL (0 )); +/* Enable mailbox interrupt for msgs coming from AF. */ otx2_write64 (pf,RVU_PF_INT_ENA_W1S ,BIT_ULL (0 ));if (!probe_af)
Greg Kroah-Hartman
maintainerPATCH 86/303 octeontx2-vf: clear stale mailbox IRQ state before request_irq()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <[email protected]>
[ Upstream commit 0b352f04b9be2c83c0240aa6dae7257fefa90464 ]
otx2vf_register_mbox_intr() currently installs the VF mailbox IRQ handler before clearing stale mailbox interrupt state. The code then says that local interrupt bits should be cleared first to avoid spurious interrupts, but that clear still happens only after request_irq() has already made the handler reachable.
A running system can reach this during VF mailbox interrupt registration while stale or latched RVU_VF_INT state is still present. If delivery happens in the request_irq()-to-clear window, otx2vf_vfaf_mbox_intr_handler() can run before local quiesce and touch the same vf->mbox and vf->mbox_wq carrier that probe and teardown later reuse or destroy.
Move the stale mailbox interrupt clear ahead of request_irq(), but keep interrupt enabling after the handler is installed. This closes the pre-clear early-IRQ window without creating a new enable-before-handler window.
--- drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c +8 -5
@@ -245,9 +245,15 @@ static int otx2vf_register_mbox_intr(str {struct otx2_hw *hw = &vf->hw;struct msg_req *req; +u64 mbox_int_mask;char *irq_name;int err; + mbox_int_mask =BIT_ULL (0 ); + +/* Clear stale mailbox interrupt state before installing the handler. */ +otx2_write64 (vf,RVU_VF_INT , mbox_int_mask); +/* Register mailbox interrupt handler */ irq_name = &hw->irq_name[RVU_VF_INT_VEC_MBOX *NAME_SIZE ];snprintf (irq_name,NAME_SIZE ,"RVUVFAF Mbox" );
@@ -259,11 +265,8 @@ static int otx2vf_register_mbox_intr(strreturn err; } -/* Enable mailbox interrupt for msgs coming from PF. -* First clear to avoid spurious interrupts, if any. -*/ -otx2_write64 (vf,RVU_VF_INT ,BIT_ULL (0 )); -otx2_write64 (vf,RVU_VF_INT_ENA_W1S ,BIT_ULL (0 )); +/* Enable mailbox interrupt for msgs coming from PF. */ +otx2_write64 (vf,RVU_VF_INT_ENA_W1S , mbox_int_mask);if (!probe_pf)return 0 ;
Greg Kroah-Hartman
maintainerPATCH 87/303 ASoC: mediatek: mt8183: Check runtime resume during probe
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <[email protected]>
[ Upstream commit f0334fbfd107682d0c95f3f71e25f6127038e2b9 ]
The MT8183 AFE probe uses pm_runtime_get_sync() before reading hardware defaults into the regmap cache, but does not check whether runtime resume failed. If regmap_reinit_cache() then fails, the temporary runtime PM usage count is also not released.
Use pm_runtime_resume_and_get() so resume failures abort probe without leaking a usage count, and release the temporary reference before handling the regmap cache result.
--- sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
sound/soc/mediatek/mt8183/mt8183-afe-pcm.c +8 -4
@@ -1143,17 +1143,21 @@ static int mt8183_afe_pcm_dev_probe(stru/* enable clock for regcache get default value from hw */ afe_priv->pm_runtime_bypass_reg_ctl = true; -pm_runtime_get_sync (&pdev->dev); + ret =pm_runtime_resume_and_get (dev); +if (ret) { + afe_priv->pm_runtime_bypass_reg_ctl = false; + goto err_pm_disable; + } ret =regmap_reinit_cache (afe->regmap, &mt8183_afe_regmap_config); +pm_runtime_put_sync (dev); + afe_priv->pm_runtime_bypass_reg_ctl = false; +if (ret) {dev_err (dev,"regmap_reinit_cache fail, ret %d\n" , ret); goto err_pm_disable; } -pm_runtime_put_sync (&pdev->dev); - afe_priv->pm_runtime_bypass_reg_ctl = false; -regcache_cache_only (afe->regmap, true);regcache_mark_dirty (afe->regmap);
Greg Kroah-Hartman
maintainerPATCH 88/303 ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <[email protected]>
[ Upstream commit fd46668d538993218eea19c6925c868ac0f2630c ]
The ipc_control_data buffer is allocated as kzalloc(max_size), where max_size covers the entire struct sof_ipc_ctrl_data including its flexible array payload. However, the bounds checks in bytes_ext_put and _bytes_ext_get compared user data lengths against max_size directly, ignoring that cdata->data sits at an offset of sizeof(struct sof_ipc_ctrl_data) bytes into the allocation.
This allowed writing up to sizeof(struct sof_ipc_ctrl_data) bytes past the end of the heap buffer from unprivileged userspace via the ALSA TLV kcontrol interface, and similarly allowed over-reading adjacent heap data on the get path.
Fix all bounds checks to subtract sizeof(*cdata) from max_size so they reflect the actual space available at the cdata->data offset. Also fix the error-path restore in bytes_ext_put which wrote to cdata->data instead of cdata, causing the same overflow.
--- sound/soc/sof/ipc3-control.c | 34 ++++++++++++++++++++++++---------- 1 file changed, 24 insertions(+), 10 deletions(-)
sound/soc/sof/ipc3-control.c +24 -10
@@ -363,10 +363,13 @@ static int sof_ipc3_bytes_ext_get(struct cdata->data->abi =SOF_ABI_VERSION ;/* check data size doesn't exceed max coming from topology */ -if (cdata->data->size > scontrol->max_size -sizeof (struct sof_abi_hdr )) { -dev_err_ratelimited (scomp->dev,"User data size %d exceeds max size %zu\n" , +if (cdata->data->size > scontrol->max_size -sizeof (*cdata) - +sizeof (struct sof_abi_hdr )) { +dev_err_ratelimited (scomp->dev, +"User data size %u exceeds max size %zu\n" , cdata->data->size, - scontrol->max_size -sizeof (struct sof_abi_hdr )); + scontrol->max_size -sizeof (*cdata) - +sizeof (struct sof_abi_hdr ));return -EINVAL ; }
@@ -412,9 +415,17 @@ static int sof_ipc3_bytes_ext_put(struct }/* be->max is coming from topology */ -if (header.length > scontrol->max_size) { -dev_err_ratelimited (scomp->dev,"Bytes data size %d exceeds max %zu\n" , - header.length, scontrol->max_size); +if (header.length > scontrol->max_size -sizeof (*cdata)) { +dev_err_ratelimited (scomp->dev,"Bytes data size %u exceeds max %zu\n" , + header.length, scontrol->max_size -sizeof (*cdata)); +return -EINVAL ; + } + +/* Ensure the data is large enough to contain the ABI header */ +if (header.length <sizeof (struct sof_abi_hdr )) { +dev_err_ratelimited (scomp->dev, +"Bytes data size %u less than ABI header %zu\n" , + header.length,sizeof (struct sof_abi_hdr ));return -EINVAL ; }
@@ -440,7 +451,7 @@ static int sof_ipc3_bytes_ext_put(struct }/* be->max has been verified to be >= sizeof(struct sof_abi_hdr) */ -if (cdata->data->size > scontrol->max_size -sizeof (struct sof_abi_hdr )) { +if (cdata->data->size > scontrol->max_size -sizeof (*cdata) -sizeof (struct sof_abi_hdr )) {dev_err_ratelimited (scomp->dev,"Mismatch in ABI data size (truncated?)\n" );return -EINVAL ; }
@@ -482,10 +493,13 @@ static int sof_ipc3_bytes_ext_volatile_greturn ret;/* check data size doesn't exceed max coming from topology */ -if (cdata->data->size > scontrol->max_size -sizeof (struct sof_abi_hdr )) { -dev_err_ratelimited (scomp->dev,"User data size %d exceeds max size %zu\n" , +if (cdata->data->size > scontrol->max_size -sizeof (*cdata) - +sizeof (struct sof_abi_hdr )) { +dev_err_ratelimited (scomp->dev, +"User data size %u exceeds max size %zu\n" , cdata->data->size, - scontrol->max_size -sizeof (struct sof_abi_hdr )); + scontrol->max_size -sizeof (*cdata) - +sizeof (struct sof_abi_hdr ));return -EINVAL ; }
Greg Kroah-Hartman
maintainerPATCH 89/303 ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit 7aaaa22de56ce0dae15fd9f42a69a1d1a7a6e078 ]
Switch from pm_runtime_enable() to devm_pm_runtime_enable(), allowing to remove all gotos from the probe function.
Stable-dep-of: e24d5dde56a5 ("ASoC: mediatek: mt8192: Check runtime resume during probe")
--- sound/soc/mediatek/mt8192/mt8192-afe-pcm.c | 46 ++++++++++------------------- 1 file changed, 17 insertions(+), 29 deletions(-)
sound/soc/mediatek/mt8192/mt8192-afe-pcm.c +17 -29
@@ -2221,21 +2221,20 @@ static int mt8192_afe_pcm_dev_probe(strureturn ret; } -pm_runtime_enable (&pdev->dev); -if (!pm_runtime_enabled (&pdev->dev)) - goto err_pm_disable; + ret =devm_pm_runtime_enable (&pdev->dev); +if (ret) +return ret;/* regmap init */ afe->regmap =syscon_node_to_regmap (dev->parent->of_node);if (IS_ERR (afe->regmap)) {dev_err (dev,"could not get regmap from parent\n" ); - ret =PTR_ERR (afe->regmap); - goto err_pm_disable; +return PTR_ERR (afe->regmap); } ret =regmap_attach_dev (dev, afe->regmap, &mt8192_afe_regmap_config);if (ret) {dev_warn (dev,"regmap_attach_dev fail, ret %d\n" , ret); - goto err_pm_disable; +return ret; }/* enable clock for regcache get default value from hw */
@@ -2245,7 +2244,7 @@ static int mt8192_afe_pcm_dev_probe(stru ret =regmap_reinit_cache (afe->regmap, &mt8192_afe_regmap_config);if (ret) {dev_err (dev,"regmap_reinit_cache fail, ret %d\n" , ret); - goto err_pm_disable; +return ret; }pm_runtime_put_sync (&pdev->dev);
@@ -2258,10 +2257,8 @@ static int mt8192_afe_pcm_dev_probe(stru afe->memif_size =MT8192_MEMIF_NUM ; afe->memif =devm_kcalloc (dev, afe->memif_size,sizeof (*afe->memif),GFP_KERNEL ); -if (!afe->memif) { - ret = -ENOMEM ; - goto err_pm_disable; - } +if (!afe->memif) +return -ENOMEM ;for (i =0 ; i < afe->memif_size; i++) { afe->memif[i].data = &memif_data[i];
@@ -2275,26 +2272,22 @@ static int mt8192_afe_pcm_dev_probe(stru afe->irqs_size =MT8192_IRQ_NUM ; afe->irqs =devm_kcalloc (dev, afe->irqs_size,sizeof (*afe->irqs),GFP_KERNEL ); -if (!afe->irqs) { - ret = -ENOMEM ; - goto err_pm_disable; - } +if (!afe->irqs) +return -ENOMEM ;for (i =0 ; i < afe->irqs_size; i++) afe->irqs[i].irq_data = &irq_data[i];/* request irq */ irq_id =platform_get_irq (pdev,0 ); -if (irq_id <0 ) { - ret = irq_id; - goto err_pm_disable; - } +if (irq_id <0 ) +return irq_id; ret =devm_request_irq (dev, irq_id, mt8192_afe_irq_handler,IRQF_TRIGGER_NONE ,"asys-isr" , (void *)afe);if (ret) {dev_err (dev,"could not request_irq for Afe_ISR_Handle\n" ); - goto err_pm_disable; +return ret; }/* init sub_dais */
@@ -2305,7 +2298,7 @@ static int mt8192_afe_pcm_dev_probe(struif (ret) {dev_warn (afe->dev,"dai register i %d fail, ret %d\n" , i, ret); - goto err_pm_disable; +return ret; } }
@@ -2314,7 +2307,7 @@ static int mt8192_afe_pcm_dev_probe(struif (ret) {dev_warn (afe->dev,"mtk_afe_combine_sub_dai fail, ret %d\n" , ret); - goto err_pm_disable; +return ret; }/* others */
@@ -2333,7 +2326,7 @@ static int mt8192_afe_pcm_dev_probe(stru &mt8192_afe_component, NULL, 0);if (ret) {dev_warn (dev,"err_platform\n" ); - goto err_pm_disable; +return ret; } ret = devm_snd_soc_register_component(&pdev->dev,
@@ -2342,15 +2335,10 @@ static int mt8192_afe_pcm_dev_probe(stru afe->num_dai_drivers);if (ret) {dev_warn (dev,"err_dai_component\n" ); - goto err_pm_disable; +return ret; }return 0 ; - -err_pm_disable: -pm_runtime_disable (&pdev->dev); - -return ret; }static int mt8192_afe_pcm_dev_remove (struct platform_device *pdev)
Greg Kroah-Hartman
maintainerPATCH 90/303 ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit 324c603a4efca7d1045e0bf3477ca54970eac72c ]
Simplify the probe function by switching error prints to return dev_err_probe(), lowering the lines count; while at it, also beautify some messages and change some others' level from warn to error.
Stable-dep-of: e24d5dde56a5 ("ASoC: mediatek: mt8192: Check runtime resume during probe")
--- sound/soc/mediatek/mt8192/mt8192-afe-pcm.c | 65 +++++++++-------------------- 1 file changed, 22 insertions(+), 43 deletions(-)
sound/soc/mediatek/mt8192/mt8192-afe-pcm.c +22 -43
@@ -2209,17 +2209,12 @@ static int mt8192_afe_pcm_dev_probe(stru/* reset controller to reset audio regs before regmap cache */ rstc =devm_reset_control_get_exclusive (dev,"audiosys" ); -if (IS_ERR (rstc)) { - ret =PTR_ERR (rstc); -dev_err (dev,"could not get audiosys reset:%d\n" , ret); -return ret; - } +if (IS_ERR (rstc)) +return dev_err_probe (dev,PTR_ERR (rstc),"could not get audiosys reset\n" ); ret =reset_control_reset (rstc); -if (ret) { -dev_err (dev,"failed to trigger audio reset:%d\n" , ret); -return ret; - } +if (ret) +return dev_err_probe (dev, ret,"failed to trigger audio reset\n" ); ret =devm_pm_runtime_enable (&pdev->dev);if (ret)
@@ -2227,25 +2222,21 @@ static int mt8192_afe_pcm_dev_probe(stru/* regmap init */ afe->regmap =syscon_node_to_regmap (dev->parent->of_node); -if (IS_ERR (afe->regmap)) { -dev_err (dev,"could not get regmap from parent\n" ); -return PTR_ERR (afe->regmap); - } +if (IS_ERR (afe->regmap)) +return dev_err_probe (dev,PTR_ERR (afe->regmap), +"could not get regmap from parent" ); + ret =regmap_attach_dev (dev, afe->regmap, &mt8192_afe_regmap_config); -if (ret) { -dev_warn (dev,"regmap_attach_dev fail, ret %d\n" , ret); -return ret; - } +if (ret) +return dev_err_probe (dev, ret,"regmap_attach_dev fail\n" );/* enable clock for regcache get default value from hw */ afe_priv->pm_runtime_bypass_reg_ctl = true;pm_runtime_get_sync (&pdev->dev); ret =regmap_reinit_cache (afe->regmap, &mt8192_afe_regmap_config); -if (ret) { -dev_err (dev,"regmap_reinit_cache fail, ret %d\n" , ret); -return ret; - } +if (ret) +return dev_err_probe (dev, ret,"regmap_reinit_cache fail\n" );pm_runtime_put_sync (&pdev->dev); afe_priv->pm_runtime_bypass_reg_ctl = false;
@@ -2285,30 +2276,22 @@ static int mt8192_afe_pcm_dev_probe(stru ret =devm_request_irq (dev, irq_id, mt8192_afe_irq_handler,IRQF_TRIGGER_NONE ,"asys-isr" , (void *)afe); -if (ret) { -dev_err (dev,"could not request_irq for Afe_ISR_Handle\n" ); -return ret; - } +if (ret) +return dev_err_probe (dev, ret,"could not request_irq for Afe_ISR_Handle\n" );/* init sub_dais */ INIT_LIST_HEAD (&afe->sub_dais);for (i =0 ; i <ARRAY_SIZE (dai_register_cbs); i++) { ret = dai_register_cbs[i](afe); -if (ret) { -dev_warn (afe->dev,"dai register i %d fail, ret %d\n" , - i, ret); -return ret; - } +if (ret) +return dev_err_probe (afe->dev, ret,"dai %d register fail" , i); }/* init dai_driver and component_driver */ ret =mtk_afe_combine_sub_dai (afe); -if (ret) { -dev_warn (afe->dev,"mtk_afe_combine_sub_dai fail, ret %d\n" , - ret); -return ret; - } +if (ret) +return dev_err_probe (afe->dev, ret,"mtk_afe_combine_sub_dai fail\n" );/* others */ afe->mtk_afe_hardware = &mt8192_afe_hardware;
@@ -2324,19 +2307,15 @@ static int mt8192_afe_pcm_dev_probe(stru/* register platform */ ret =devm_snd_soc_register_component (&pdev->dev, &mt8192_afe_component,NULL ,0 ); -if (ret) { -dev_warn (dev,"err_platform\n" ); -return ret; - } +if (ret) +return dev_err_probe (dev, ret,"Couldn't register AFE component\n" ); ret =devm_snd_soc_register_component (&pdev->dev, &mt8192_afe_pcm_component, afe->dai_drivers, afe->num_dai_drivers); -if (ret) { -dev_warn (dev,"err_dai_component\n" ); -return ret; - } +if (ret) +return dev_err_probe (dev, ret,"Couldn't register AFE-PCM component\n" );return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 91/303 ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit 1d2a6b3b5189b6c3e51f29e050aa9b2337b774e8 ]
Since the mtk-afe-platform-driver generic mtk_afe_pcm_platform now has a common .probe() callback, there is no reason to keep duplicating this function over and over in the SoC specific AFE-PCM drivers: switch over to register with the common bits instead.
Note that MT8186 was left out of this because it is registering some extra sinegen controls in the AFE-PCM probe callback and needs extra cleanups to be able to use the common bits.
Stable-dep-of: e24d5dde56a5 ("ASoC: mediatek: mt8192: Check runtime resume during probe")
--- sound/soc/mediatek/mt8192/mt8192-afe-pcm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/mediatek/mt8192/mt8192-afe-pcm.c +2 -2
@@ -2232,13 +2232,13 @@ static int mt8192_afe_pcm_dev_probe(stru/* enable clock for regcache get default value from hw */ afe_priv->pm_runtime_bypass_reg_ctl = true; -pm_runtime_get_sync (&pdev->dev); +pm_runtime_get_sync (dev); ret =regmap_reinit_cache (afe->regmap, &mt8192_afe_regmap_config);if (ret)return dev_err_probe (dev, ret,"regmap_reinit_cache fail\n" ); -pm_runtime_put_sync (&pdev->dev); +pm_runtime_put_sync (dev); afe_priv->pm_runtime_bypass_reg_ctl = false;regcache_cache_only (afe->regmap, true);
Greg Kroah-Hartman
maintainerPATCH 92/303 ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tang Bin <[email protected]>
[ Upstream commit 01981565c764c554cc96e2d30a71c42975171416 ]
Simplify the function mt8192_afe_pcm_dev_probe() by using local 'dev' instead of '&pdev->dev'.
Stable-dep-of: e24d5dde56a5 ("ASoC: mediatek: mt8192: Check runtime resume during probe")
--- sound/soc/mediatek/mt8192/mt8192-afe-pcm.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-)
sound/soc/mediatek/mt8192/mt8192-afe-pcm.c +8 -9
@@ -2178,27 +2178,26 @@ static int mt8192_afe_pcm_dev_probe(stru {struct mtk_base_afe *afe;struct mt8192_afe_private *afe_priv; -struct device *dev; +struct device *dev = &pdev->dev;struct reset_control *rstc;int i, ret, irq_id; - ret =dma_set_mask_and_coherent (&pdev->dev,DMA_BIT_MASK (34 )); + ret =dma_set_mask_and_coherent (dev,DMA_BIT_MASK (34 ));if (ret)return ret; - afe =devm_kzalloc (&pdev->dev,sizeof (*afe),GFP_KERNEL ); + afe =devm_kzalloc (dev,sizeof (*afe),GFP_KERNEL );if (!afe)return -ENOMEM ;platform_set_drvdata (pdev, afe); - afe->platform_priv =devm_kzalloc (&pdev->dev,sizeof (*afe_priv), + afe->platform_priv =devm_kzalloc (dev,sizeof (*afe_priv),GFP_KERNEL );if (!afe->platform_priv)return -ENOMEM ; afe_priv = afe->platform_priv; - afe->dev = &pdev->dev; - dev = afe->dev; + afe->dev = dev;/* init audio related clock */ ret =mt8192_init_clock (afe);
@@ -2216,7 +2215,7 @@ static int mt8192_afe_pcm_dev_probe(struif (ret)return dev_err_probe (dev, ret,"failed to trigger audio reset\n" ); - ret =devm_pm_runtime_enable (&pdev->dev); + ret =devm_pm_runtime_enable (dev);if (ret)return ret;
@@ -2305,12 +2304,12 @@ static int mt8192_afe_pcm_dev_probe(stru afe->runtime_suspend = mt8192_afe_runtime_suspend;/* register platform */ - ret =devm_snd_soc_register_component (&pdev->dev, + ret =devm_snd_soc_register_component (dev, &mt8192_afe_component,NULL ,0 );if (ret)return dev_err_probe (dev, ret,"Couldn't register AFE component\n" ); - ret =devm_snd_soc_register_component (&pdev->dev, + ret =devm_snd_soc_register_component (dev, &mt8192_afe_pcm_component, afe->dai_drivers, afe->num_dai_drivers);
Greg Kroah-Hartman
maintainerPATCH 93/303 ASoC: mediatek: mt8192: Check runtime resume during probe
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <[email protected]>
[ Upstream commit e24d5dde56a50946020b134fa8448869093db76a ]
The MT8192 AFE probe enables runtime PM temporarily while reinitializing the regmap cache from hardware, but it uses pm_runtime_get_sync() without checking the return value. If runtime resume fails, probe keeps going without the device necessarily being accessible, and pm_runtime_get_sync() may leave the PM usage count incremented.
The regmap_reinit_cache() failure path also returns before dropping the temporary PM reference and before clearing pm_runtime_bypass_reg_ctl.
Use pm_runtime_resume_and_get() so resume failures do not leak a usage count, and clear the temporary bypass flag after dropping the probe PM reference on all regmap_reinit_cache() outcomes.
--- sound/soc/mediatek/mt8192/mt8192-afe-pcm.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
sound/soc/mediatek/mt8192/mt8192-afe-pcm.c +8 -4
@@ -2231,15 +2231,19 @@ static int mt8192_afe_pcm_dev_probe(stru/* enable clock for regcache get default value from hw */ afe_priv->pm_runtime_bypass_reg_ctl = true; -pm_runtime_get_sync (dev); + ret =pm_runtime_resume_and_get (dev); +if (ret) { + afe_priv->pm_runtime_bypass_reg_ctl = false; +return dev_err_probe (dev, ret,"failed to resume device\n" ); + } ret =regmap_reinit_cache (afe->regmap, &mt8192_afe_regmap_config); -if (ret) -return dev_err_probe (dev, ret,"regmap_reinit_cache fail\n" ); -pm_runtime_put_sync (dev); afe_priv->pm_runtime_bypass_reg_ctl = false; +if (ret) +return dev_err_probe (dev, ret,"regmap_reinit_cache fail\n" ); +regcache_cache_only (afe->regmap, true);regcache_mark_dirty (afe->regmap);
Greg Kroah-Hartman
maintainerPATCH 94/303 s390/cpum_cf: move cpum_cf_ctrset_size()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Richter <[email protected]>
[ Upstream commit 345d2a4dcdb7d0f33ebd990a19aeb3f3f458817d ]
Function cpum_cf_ctrset_size() is defined in one source file and the only user is in another source file. Move this function to the source file where it is used and remove its prototype from the header file. No functional change.
Stable-dep-of: 49145bce5391 ("s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init()")
--- arch/s390/include/asm/cpu_mcf.h | 2 - arch/s390/kernel/perf_cpum_cf.c | 47 +++++++++++++++++++++++++++++++++ arch/s390/kernel/perf_cpum_cf_common.c | 46 -------------------------------- 3 files changed, 47 insertions(+), 48 deletions(-)
arch/s390/include/asm/cpu_mcf.h +0 -2
@@ -105,8 +105,6 @@ static inline int stccm_avail(void) return test_facility(142); } -size_t cpum_cf_ctrset_size (enum cpumf_ctr_set ctrset, -struct cpumf_ctr_info *info);int cfset_online_cpu (unsigned int cpu);int cfset_offline_cpu (unsigned int cpu);#endif /* _ASM_S390_CPU_MCF_H */
arch/s390/kernel/perf_cpum_cf.c +47 -0
53 lines not on this page · raw message
arch/s390/kernel/perf_cpum_cf_common.c +0 -46
52 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 95/303 s390/cpum_cf: move stccm_avail()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Richter <[email protected]>
[ Upstream commit 7a8f09ac1850b17ca0cc9e1e4d6621a64661347e ]
Function stccm_avail() is defined in a header file and the only user is one single source file. Move this function to the source file where it is also used and remove it from the header file. No functional change.
Stable-dep-of: 49145bce5391 ("s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init()")
--- arch/s390/include/asm/cpu_mcf.h | 6 ------ arch/s390/kernel/perf_cpum_cf.c | 6 ++++++ 2 files changed, 6 insertions(+), 6 deletions(-)
arch/s390/include/asm/cpu_mcf.h +0 -6
@@ -99,12 +99,6 @@ static inline void kernel_cpumcf_end(voi preempt_enable(); } -/* Return true if store counter set multiple instruction is available */ -static inline int stccm_avail (void ) -{ -return test_facility (142 ); -} -int cfset_online_cpu (unsigned int cpu);int cfset_offline_cpu (unsigned int cpu);#endif /* _ASM_S390_CPU_MCF_H */
arch/s390/kernel/perf_cpum_cf.c +6 -0
@@ -821,6 +821,12 @@ static struct pmu cpumf_pmu = { .read = cpumf_pmu_read, }; +/* Return true if store counter set multiple instruction is available */ +static inline int stccm_avail (void ) +{ +return test_facility (142 ); +} +static int cfset_init (void );static int __init cpumf_pmu_init (void ) {
Greg Kroah-Hartman
maintainerPATCH 96/303 s390/cpum_cf: remove in-kernel counting facility interface
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Richter <[email protected]>
[ Upstream commit ea53e6995f45e857fd34e4fbfbd436b5457da5f7 ]
Commit 17bebcc68eee ("s390/cpum_cf: Add minimal in-kernel interface for counter measurements") introduced a small in-kernel interface for CPU Measurement counter facility.
There are no users of this interface, therefore remove it.
The following functions are removed:
kernel_cpumcf_alert(),
kernel_cpumcf_begin(),
kernel_cpumcf_end(),
kernel_cpumcf_avail()
there is no need for them anymore.
With the removal of function kernel_cpumcf_alert(), also remove member alert in struct cpu_cf_events. Its purpose was to counter measurement alert interrupts for the in-kernel interface.
Stable-dep-of: 49145bce5391 ("s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init()")
--- arch/s390/include/asm/cpu_mcf.h | 17 ----------------- arch/s390/kernel/perf_cpum_cf.c | 2 +- arch/s390/kernel/perf_cpum_cf_common.c | 24 ------------------------ 3 files changed, 1 insertion(+), 42 deletions(-)
arch/s390/include/asm/cpu_mcf.h +0 -17
@@ -67,7 +67,6 @@ static inline int ctr_stcctm(enum cpumf_struct cpu_cf_events {struct cpumf_ctr_info info;atomic_t ctr_set[CPUMF_CTR_SET_MAX ]; -atomic64_t alert;u64 state;/* For perf_event_open SVC */ u64 dev_state;/* For /dev/hwctr */ unsigned int flags;
@@ -80,25 +79,9 @@ struct cpu_cf_events { }; DECLARE_PER_CPU(struct cpu_cf_events, cpu_cf_events); -bool kernel_cpumcf_avail (void );int __kernel_cpumcf_begin (void ); -unsigned long kernel_cpumcf_alert (int clear);void __kernel_cpumcf_end (void ); -static inline int kernel_cpumcf_begin (void ) -{ -if (!cpum_cf_avail ()) -return -ENODEV ; - -preempt_disable (); -return __kernel_cpumcf_begin (); -} -static inline void kernel_cpumcf_end (void ) -{ -__kernel_cpumcf_end (); -preempt_enable (); -} -int cfset_online_cpu (unsigned int cpu);int cfset_offline_cpu (unsigned int cpu);#endif /* _ASM_S390_CPU_MCF_H */
arch/s390/kernel/perf_cpum_cf.c +1 -1
@@ -832,7 +832,7 @@ static int __init cpumf_pmu_init(void) {int rc; -if (!kernel_cpumcf_avail ()) +if (!cpum_cf_avail ())return -ENODEV ;/* Setup s390dbf facility */
arch/s390/kernel/perf_cpum_cf_common.c +0 -24
@@ -27,7 +27,6 @@ DEFINE_PER_CPU(struct cpu_cf_events, cpu [CPUMF_CTR_SET_EXT] = ATOMIC_INIT(0), [CPUMF_CTR_SET_MT_DIAG ] =ATOMIC_INIT (0 ), }, - .alert = ATOMIC64_INIT(0), .state = 0, .dev_state = 0, .flags = 0,
@@ -67,9 +66,6 @@ static void cpumf_measurement_alert(struif (alert &CPU_MF_INT_CF_MTDA )pr_warn ("CPU[%i] MT counter data was lost\n" ,smp_processor_id ()); - -/* store alert for special handling by in-kernel users */ -atomic64_or (alert, &cpuhw->alert); }#define PMC_INIT 0
@@ -94,12 +90,6 @@ static void cpum_cf_setup_cpu(void *flaglcctl (0 ); } -bool kernel_cpumcf_avail (void ) -{ -return cpum_cf_initalized; -} -EXPORT_SYMBOL (kernel_cpumcf_avail); -/* Initialize the CPU-measurement counter facility */ int __kernel_cpumcf_begin (void ) {
@@ -112,20 +102,6 @@ int __kernel_cpumcf_begin(void) }EXPORT_SYMBOL (__kernel_cpumcf_begin); -/* Obtain the CPU-measurement alerts for the counter facility */ -unsigned long kernel_cpumcf_alert (int clear) -{ -struct cpu_cf_events *cpuhw =this_cpu_ptr (&cpu_cf_events); -unsigned long alert; - - alert =atomic64_read (&cpuhw->alert); -if (clear) -atomic64_set (&cpuhw->alert,0 ); - -return alert; -} -EXPORT_SYMBOL (kernel_cpumcf_alert); -/* Release the CPU-measurement counter facility */ void __kernel_cpumcf_end (void ) {
Greg Kroah-Hartman
maintainerPATCH 97/303 s390/cpum_cf: merge source files for CPU Measurement counter facility
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Richter <[email protected]>
[ Upstream commit 1e99c242acb2fc211aa9f57cd1060622e66bbf63 ]
With no in-kernel user, the source files can be merged.
Move all functions and the variable definitions to file perf_cpum_cf.c This file now contains all the necessary functions and definitions for the CPU Measurement counter facility device driver.
The files cpu_mcf.h and perf_cpum_cf_common.c are deleted.
Stable-dep-of: 49145bce5391 ("s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init()")
--- arch/s390/include/asm/cpu_mcf.h | 87 ------------- arch/s390/kernel/Makefile | 2 arch/s390/kernel/perf_cpum_cf.c | 214 +++++++++++++++++++++++++++++++-- arch/s390/kernel/perf_cpum_cf_common.c | 163 ------------------------- arch/s390/kernel/perf_pai_ext.c | 2 5 files changed, 208 insertions(+), 260 deletions(-) delete mode 100644 arch/s390/include/asm/cpu_mcf.h delete mode 100644 arch/s390/kernel/perf_cpum_cf_common.c
arch/s390/include/asm/cpu_mcf.h deleted +0 -87
@@ -1,87 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -/* -* Counter facility support definitions for the Linux perf -* -* Copyright IBM Corp. 2019 -* Author(s): Hendrik Brueckner <[email protected]> -*/ -#ifndef _ASM_S390_CPU_MCF_H -#define _ASM_S390_CPU_MCF_H - -#include <linux/perf_event.h> -#include <asm/cpu_mf.h> - -enum cpumf_ctr_set { -CPUMF_CTR_SET_BASIC =0 ,/* Basic Counter Set */ -CPUMF_CTR_SET_USER =1 ,/* Problem-State Counter Set */ -CPUMF_CTR_SET_CRYPTO =2 ,/* Crypto-Activity Counter Set */ -CPUMF_CTR_SET_EXT =3 ,/* Extended Counter Set */ -CPUMF_CTR_SET_MT_DIAG =4 ,/* MT-diagnostic Counter Set */ - -/* Maximum number of counter sets */ -CPUMF_CTR_SET_MAX , -}; - -#define CPUMF_LCCTL_ENABLE_SHIFT 16 -#define CPUMF_LCCTL_ACTCTL_SHIFT 0 - -static inline void ctr_set_enable (u64 *state,u64 ctrsets) -{ - *state |= ctrsets <<CPUMF_LCCTL_ENABLE_SHIFT ; -} - -static inline void ctr_set_disable (u64 *state,u64 ctrsets) -{ - *state &= ~(ctrsets <<CPUMF_LCCTL_ENABLE_SHIFT ); -} - -static inline void ctr_set_start (u64 *state,u64 ctrsets) -{ - *state |= ctrsets <<CPUMF_LCCTL_ACTCTL_SHIFT ; -} - -static inline void ctr_set_stop (u64 *state,u64 ctrsets) -{ - *state &= ~(ctrsets <<CPUMF_LCCTL_ACTCTL_SHIFT ); -} - -static inline int ctr_stcctm (enum cpumf_ctr_set set,u64 range,u64 *dest) -{ -switch (set) { -case CPUMF_CTR_SET_BASIC : -return stcctm (BASIC , range, dest); -case CPUMF_CTR_SET_USER : -return stcctm (PROBLEM_STATE , range, dest); -case CPUMF_CTR_SET_CRYPTO : -return stcctm (CRYPTO_ACTIVITY , range, dest); -case CPUMF_CTR_SET_EXT : -return stcctm (EXTENDED , range, dest); -case CPUMF_CTR_SET_MT_DIAG : -return stcctm (MT_DIAG_CLEARING , range, dest); -case CPUMF_CTR_SET_MAX : -return 3 ; - } -return 3 ; -} - -struct cpu_cf_events { -struct cpumf_ctr_info info; -atomic_t ctr_set[CPUMF_CTR_SET_MAX ]; -u64 state;/* For perf_event_open SVC */ -u64 dev_state;/* For /dev/hwctr */ -unsigned int flags; -size_t used;/* Bytes used in data */ -size_t usedss;/* Bytes used in start/stop */ -unsigned char start[PAGE_SIZE ];/* Counter set at event add */ -unsigned char stop[PAGE_SIZE ];/* Counter set at event delete */ -unsigned char data[PAGE_SIZE ];/* Counter set at /dev/hwctr */ -unsigned int sets;/* # Counter set saved in memory */ -}; -DECLARE_PER_CPU(struct cpu_cf_events, cpu_cf_events); - -int __kernel_cpumcf_begin (void ); -void __kernel_cpumcf_end (void ); - -int cfset_online_cpu (unsigned int cpu); -int cfset_offline_cpu (unsigned int cpu); -#endif /* _ASM_S390_CPU_MCF_H */
arch/s390/kernel/Makefile +1 -1
@@ -70,7 +70,7 @@ obj-$(CONFIG_KEXEC_FILE) += kexec_elf.o obj-$(CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT) += ima_arch.o -obj-$(CONFIG_PERF_EVENTS) += perf_event.o perf_cpum_cf_common.o +obj-$(CONFIG_PERF_EVENTS) += perf_event.o obj-$(CONFIG_PERF_EVENTS) += perf_cpum_cf.o perf_cpum_sf.o obj-$(CONFIG_PERF_EVENTS) += perf_cpum_cf_events.o perf_regs.o obj-$(CONFIG_PERF_EVENTS) += perf_pai_crypto.o perf_pai_ext.o
arch/s390/kernel/perf_cpum_cf.c +206 -8
286 lines not on this page · raw message
arch/s390/kernel/perf_cpum_cf_common.c deleted +0 -163
163 lines not on this page · raw message
arch/s390/kernel/perf_pai_ext.c +1 -1
@@ -16,8 +16,8 @@#include <linux/init.h> #include <linux/export.h> #include <linux/io.h> +#include <linux/perf_event.h> -#include <asm/cpu_mcf.h> #include <asm/ctl_reg.h> #include <asm/pai.h> #include <asm/debug.h>
Greg Kroah-Hartman
maintainerPATCH 98/303 s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sumanth Korikkar <[email protected]>
[ Upstream commit 49145bce539117db4b6e9e83c0e5ef528e361050 ]
ev variable is userspace controlled via event->attr.config and used as an array index after bounds checking, but without speculation barriers.
Add the missing array_index_nospec() call to prevent speculative execution.
--- arch/s390/kernel/perf_cpum_cf.c | 3 +++ 1 file changed, 3 insertions(+)
arch/s390/kernel/perf_cpum_cf.c +3 -0
@@ -17,6 +17,7 @@#include <linux/export.h> #include <linux/miscdevice.h> #include <linux/perf_event.h> +#include <linux/nospec.h> #include <asm/cpu_mf.h> #include <asm/hwctrset.h>
@@ -633,6 +634,7 @@ static int __hw_perf_event_init(struct pif (!is_userspace_event (ev)) {if (ev >=ARRAY_SIZE (cpumf_generic_events_user))return -EOPNOTSUPP ; + ev =array_index_nospec (ev,ARRAY_SIZE (cpumf_generic_events_user)); ev = cpumf_generic_events_user[ev]; } }else if (!attr->exclude_kernel && attr->exclude_user) {
@@ -643,6 +645,7 @@ static int __hw_perf_event_init(struct pif (!is_userspace_event (ev)) {if (ev >=ARRAY_SIZE (cpumf_generic_events_basic))return -EOPNOTSUPP ; + ev =array_index_nospec (ev,ARRAY_SIZE (cpumf_generic_events_basic)); ev = cpumf_generic_events_basic[ev]; } }
Greg Kroah-Hartman
maintainerPATCH 99/303 netfilter: nft_set_pipapo: use GFP_KERNEL for insertions
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 5b651783d80b97167ecd27dc6a4408c694873902 ]
An earlier attempt changed this to GFP_KERNEL, but the get helper is also called for get requests from userspace, which uses rcu.
Let the caller pass in the kmalloc flags to allow insertions to schedule if needed.
Stable-dep-of: 47e65eff5069 ("netfilter: nft_set_pipapo: don't leak bad clone into future transaction")
--- net/netfilter/nft_set_pipapo.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-)
net/netfilter/nft_set_pipapo.c +10 -7
@@ -505,6 +505,7 @@ out:* @data: Key data to be matched against existing elements * @genmask: If set, check that element is active in given genmask * @tstamp: timestamp to check for expired elements +* @gfp: the type of memory to allocate (see kmalloc). * * This is essentially the same as the lookup function, except that it matches * key data against the uncommitted copy and doesn't use preallocated maps for
@@ -515,7 +516,7 @@ out:static struct nft_pipapo_elem *pipapo_get (const struct net *net,const struct nft_set *set,const u8 *data,u8 genmask, -u64 tstamp) +u64 tstamp,gfp_t gfp) {struct nft_pipapo_elem *ret =ERR_PTR (-ENOENT );struct nft_pipapo *priv =nft_set_priv (set);
@@ -528,13 +529,13 @@ static struct nft_pipapo_elem *pipapo_geif (m->bsize_max ==0 )return ret; - res_map =kmalloc_array (m->bsize_max,sizeof (*res_map),GFP_ATOMIC ); + res_map =kmalloc_array (m->bsize_max,sizeof (*res_map), gfp);if (!res_map) { ret =ERR_PTR (-ENOMEM ); goto out; } - fill_map =kcalloc (m->bsize_max,sizeof (*res_map),GFP_ATOMIC ); + fill_map =kcalloc (m->bsize_max,sizeof (*res_map), gfp);if (!fill_map) { ret =ERR_PTR (-ENOMEM ); goto out;
@@ -609,7 +610,7 @@ static void *nft_pipapo_get(const struct const struct nft_set_elem *elem, unsigned int flags) { return pipapo_get(net, set, (const u8 *)elem->key.val.data, - nft_genmask_cur(net), get_jiffies_64()); + nft_genmask_cur(net), get_jiffies_64(), GFP_ATOMIC); }
@@ -1246,7 +1247,7 @@ static int nft_pipapo_insert(const strucelse end = start; - dup =pipapo_get (net, set, start, genmask, tstamp); + dup =pipapo_get (net, set, start, genmask, tstamp,GFP_KERNEL );if (!IS_ERR (dup)) {/* Check if we already have the same exact entry */ const struct nft_data *dup_key, *dup_end;
@@ -1268,7 +1269,8 @@ static int nft_pipapo_insert(const strucif (PTR_ERR (dup) == -ENOENT ) {/* Look for partially overlapping entries */ - dup =pipapo_get (net, set, end,nft_genmask_next (net), tstamp); + dup =pipapo_get (net, set, end,nft_genmask_next (net), tstamp, +GFP_KERNEL ); }if (PTR_ERR (dup) != -ENOENT ) {
@@ -1870,7 +1872,8 @@ static void *pipapo_deactivate(const str {struct nft_pipapo_elem *e; - e =pipapo_get (net, set, data,nft_genmask_next (net),nft_net_tstamp (net)); + e =pipapo_get (net, set, data,nft_genmask_next (net), +nft_net_tstamp (net),GFP_KERNEL );if (IS_ERR (e))return NULL ;
Greg Kroah-Hartman
maintainerPATCH 100/303 netfilter: nft_set_pipapo: move prove_locking helper around
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit a590f4760922acaa2d2b55a88004a38eecdd6412 ]
Preparation patch, the helper will soon get called from insert function too.
Stable-dep-of: 47e65eff5069 ("netfilter: nft_set_pipapo: don't leak bad clone into future transaction")
--- net/netfilter/nft_set_pipapo.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-)
net/netfilter/nft_set_pipapo.c +11 -11
@@ -1217,6 +1217,17 @@ static int pipapo_realloc_scratch(structreturn 0 ; } +static bool nft_pipapo_transaction_mutex_held (const struct nft_set *set) +{ +#ifdef CONFIG_PROVE_LOCKING +const struct net *net =read_pnet (&set->net); + +return lockdep_is_held (&nft_pernet (net)->commit_mutex); +#else +return true; +#endif +} +/** * nft_pipapo_insert() - Validate and insert ranged elements * @net: Network namespace
@@ -1803,17 +1814,6 @@ static void nft_pipapo_commit(struct nftpipapo_gc_queue (set); } -static bool nft_pipapo_transaction_mutex_held (const struct nft_set *set) -{ -#ifdef CONFIG_PROVE_LOCKING -const struct net *net =read_pnet (&set->net); - -return lockdep_is_held (&nft_pernet (net)->commit_mutex); -#else -return true; -#endif -} -static void nft_pipapo_abort (const struct nft_set *set) {struct nft_pipapo *priv =nft_set_priv (set);
Greg Kroah-Hartman
maintainerPATCH 101/303 netfilter: nft_set_pipapo: make pipapo_clone helper return NULL
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 80efd2997fb9343a0283cf3cac5524a4595c8ff4 ]
Currently it returns an error pointer, but the only possible failure is ENOMEM.
After a followup patch, we'd need to discard the errno code, i.e.
x = pipapo_clone()
if (IS_ERR(x))
return NULL
or make more changes to fix up callers to expect IS_ERR() code from set->ops->deactivate().
So simplify this and make it return ptr-or-null.
Stable-dep-of: 47e65eff5069 ("netfilter: nft_set_pipapo: don't leak bad clone into future transaction")
--- net/netfilter/nft_set_pipapo.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
net/netfilter/nft_set_pipapo.c +7 -7
@@ -1358,7 +1358,7 @@ static int nft_pipapo_insert(const struc* pipapo_clone() - Clone matching data to create new working copy * @old: Existing matching data * -* Return: copy of matching data passed as 'old', error pointer on failure +* Return: copy of matching data passed as 'old' or NULL. */ static struct nft_pipapo_match *pipapo_clone (struct nft_pipapo_match *old) {
@@ -1369,7 +1369,7 @@ static struct nft_pipapo_match *pipapo_c new =kmalloc (sizeof (*new) +sizeof (*dst) * old->field_count,GFP_KERNEL_ACCOUNT );if (!new) -return ERR_PTR (-ENOMEM ); +return NULL ; new->field_count = old->field_count; new->bsize_max = old->bsize_max;
@@ -1445,7 +1445,7 @@ out_scratch:free_percpu (new->scratch);kfree (new); -return ERR_PTR (-ENOMEM ); +return NULL ; }/**
@@ -1799,7 +1799,7 @@ static void nft_pipapo_commit(struct nftreturn ; new_clone =pipapo_clone (priv->clone); -if (IS_ERR (new_clone)) +if (!new_clone)return ; priv->dirty = false;
@@ -1825,7 +1825,7 @@ static void nft_pipapo_abort(const struc m =rcu_dereference_protected (priv->match,nft_pipapo_transaction_mutex_held (set)); new_clone =pipapo_clone (m); -if (IS_ERR (new_clone)) +if (!new_clone)return ; priv->dirty = false;
@@ -2267,8 +2267,8 @@ static int nft_pipapo_init(const struct/* Create an initial clone of matching data for next insertion */ priv->clone =pipapo_clone (m); -if (IS_ERR (priv->clone)) { - err =PTR_ERR (priv->clone); +if (!priv->clone) { + err = -ENOMEM ; goto out_free; }
Greg Kroah-Hartman
maintainerPATCH 102/303 netfilter: nft_set_pipapo: prepare walk function for on-demand clone
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 6c108d9bee448a850b03e682836bfe91fca645cb ]
The existing code uses iter->type to figure out what data is needed, the live copy (READ) or clone (UPDATE).
Without pending updates, priv->clone and priv->match will point to different memory locations, but they have identical content.
Future patch will make priv->clone == NULL if there are no pending changes, in this case we must copy the live data for the UPDATE case.
Currently this would require GFP_ATOMIC allocation. Split the walk function in two parts: one that does the walk and one that decides which data is needed.
In the UPDATE case, callers hold the transaction mutex so we do not need the rcu read lock. This allows to use GFP_KERNEL allocation while cloning.
Stable-dep-of: 47e65eff5069 ("netfilter: nft_set_pipapo: don't leak bad clone into future transaction")
--- net/netfilter/nft_set_pipapo.c | 60 ++++++++++++++++++++++++++--------------- 1 file changed, 39 insertions(+), 21 deletions(-)
net/netfilter/nft_set_pipapo.c +39 -21
@@ -2110,35 +2110,23 @@ static void nft_pipapo_remove(const stru }/** -* nft_pipapo_walk() - Walk over elements +* nft_pipapo_do_walk() - Walk over elements in m * @ctx: nftables API context * @set: nftables API set representation +* @m: matching data pointing to key mapping array * @iter: Iterator * * As elements are referenced in the mapping array for the last field, directly * scan that array: there's no need to follow rule mappings from the first -* field. +* field. @m is protected either by RCU read lock or by transaction mutex. */ -static void nft_pipapo_walk (const struct nft_ctx *ctx,struct nft_set *set, -struct nft_set_iter *iter) +static void nft_pipapo_do_walk (const struct nft_ctx *ctx,struct nft_set *set, +const struct nft_pipapo_match *m, +struct nft_set_iter *iter) { -struct nft_pipapo *priv =nft_set_priv (set); -const struct nft_pipapo_match *m;const struct nft_pipapo_field *f;int i, r; -WARN_ON_ONCE (iter->type !=NFT_ITER_READ && - iter->type !=NFT_ITER_UPDATE ); - -rcu_read_lock (); -if (iter->type ==NFT_ITER_READ ) - m =rcu_dereference (priv->match); -else - m = priv->clone; - -if (unlikely (!m)) - goto out; -for (i =0 , f = m->f; i < m->field_count -1 ; i++, f++) ;
@@ -2158,14 +2146,44 @@ static void nft_pipapo_walk(const struct iter->err = iter->fn (ctx, set, iter, &elem);if (iter->err <0 ) - goto out; +return ; cont: iter->count++; } +} -out: -rcu_read_unlock (); +/** +* nft_pipapo_walk() - Walk over elements +* @ctx: nftables API context +* @set: nftables API set representation +* @iter: Iterator +* +* Test if destructive action is needed or not, clone active backend if needed +* and call the real function to work on the data. +*/ +static void nft_pipapo_walk (const struct nft_ctx *ctx,struct nft_set *set, +struct nft_set_iter *iter) +{ +struct nft_pipapo *priv =nft_set_priv (set); +const struct nft_pipapo_match *m; + +switch (iter->type) { +case NFT_ITER_UPDATE : + m = priv->clone; +nft_pipapo_do_walk (ctx, set, m, iter); +break ; +case NFT_ITER_READ : +rcu_read_lock (); + m =rcu_dereference (priv->match); +nft_pipapo_do_walk (ctx, set, m, iter); +rcu_read_unlock (); +break ; +default : + iter->err = -EINVAL ; +WARN_ON_ONCE (1 ); +break ; + } }/**
Greg Kroah-Hartman
maintainerPATCH 103/303 netfilter: nft_set_pipapo: merge deactivate helper into caller
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit c5444786d0ea2417a5e2cee7bd67137fc8bad687 ]
Its the only remaining call site so there is no need for this to be separated anymore.
Stable-dep-of: 47e65eff5069 ("netfilter: nft_set_pipapo: don't leak bad clone into future transaction")
--- net/netfilter/nft_set_pipapo.c | 39 +++++++++------------------------------ 1 file changed, 9 insertions(+), 30 deletions(-)
net/netfilter/nft_set_pipapo.c +9 -30
@@ -1855,52 +1855,31 @@ static void nft_pipapo_activate(const st }/** -* pipapo_deactivate() - Check that element is in set, mark as inactive +* nft_pipapo_deactivate() - Search for element and make it inactive * @net: Network namespace * @set: nftables API set representation -* @data: Input key data -* @ext: nftables API extension pointer, used to check for end element -* -* This is a convenience function that can be called from both -* nft_pipapo_deactivate() and nft_pipapo_flush(), as they are in fact the same -* operation. +* @elem: nftables API element representation containing key data * * Return: deactivated element if found, NULL otherwise. */ -static void *pipapo_deactivate (const struct net *net,const struct nft_set *set, -const u8 *data,const struct nft_set_ext *ext) +static void *nft_pipapo_deactivate (const struct net *net, +const struct nft_set *set, +const struct nft_set_elem *elem) {struct nft_pipapo_elem *e; - e =pipapo_get (net, set, data,nft_genmask_next (net), -nft_net_tstamp (net),GFP_KERNEL ); + e =pipapo_get (net, set, (const u8 *)elem->key.val.data, +nft_genmask_next (net),nft_net_tstamp (net),GFP_KERNEL );if (IS_ERR (e))return NULL ;nft_set_elem_change_active (net, set, &e->ext); -return e; -} - -/** -* nft_pipapo_deactivate() - Call pipapo_deactivate() to make element inactive -* @net: Network namespace -* @set: nftables API set representation -* @elem: nftables API element representation containing key data -* -* Return: deactivated element if found, NULL otherwise. -*/ -static void *nft_pipapo_deactivate (const struct net *net, -const struct nft_set *set, -const struct nft_set_elem *elem) -{ -const struct nft_set_ext *ext =nft_set_elem_ext (set, elem->priv); - -return pipapo_deactivate (net, set, (const u8 *)elem->key.val.data, ext); +return &e->priv; }/** -* nft_pipapo_flush() - Call pipapo_deactivate() to make element inactive +* nft_pipapo_flush() - make element inactive * @net: Network namespace * @set: nftables API set representation * @elem: nftables API element representation containing key data
Greg Kroah-Hartman
maintainerPATCH 104/303 netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit a238106703ab4ae1090b86eba128815b8626d8f1 ]
The helper uses priv->clone unconditionally which will fail once we do the clone conditionally on first insert or removal.
'nft get element' from userspace needs to use priv->match since this runs from rcu read side lock section.
Prepare for this by passing the match backend data as argument.
Stable-dep-of: 47e65eff5069 ("netfilter: nft_set_pipapo: don't leak bad clone into future transaction")
--- net/netfilter/nft_set_pipapo.c | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-)
net/netfilter/nft_set_pipapo.c +15 -10
@@ -502,6 +502,7 @@ out:* pipapo_get() - Get matching element reference given key data * @net: Network namespace * @set: nftables API set representation +* @m: storage containing active/existing elements * @data: Key data to be matched against existing elements * @genmask: If set, check that element is active in given genmask * @tstamp: timestamp to check for expired elements
@@ -515,17 +516,15 @@ out:*/ static struct nft_pipapo_elem *pipapo_get (const struct net *net,const struct nft_set *set, +const struct nft_pipapo_match *m,const u8 *data,u8 genmask,u64 tstamp,gfp_t gfp) {struct nft_pipapo_elem *ret =ERR_PTR (-ENOENT ); -struct nft_pipapo *priv =nft_set_priv (set);unsigned long *res_map, *fill_map =NULL ; -const struct nft_pipapo_match *m;const struct nft_pipapo_field *f;int i; - m = priv->clone;if (m->bsize_max ==0 )return ret;
@@ -609,7 +608,10 @@ out:static void *nft_pipapo_get (const struct net *net,const struct nft_set *set,const struct nft_set_elem *elem,unsigned int flags) { -return pipapo_get (net, set, (const u8 *)elem->key.val.data, +struct nft_pipapo *priv =nft_set_priv (set); +struct nft_pipapo_match *m =rcu_dereference (priv->match); + +return pipapo_get (net, set, m, (const u8 *)elem->key.val.data,nft_genmask_cur (net),get_jiffies_64 (),GFP_ATOMIC ); }
@@ -1258,7 +1260,7 @@ static int nft_pipapo_insert(const strucelse end = start; - dup =pipapo_get (net, set, start, genmask, tstamp,GFP_KERNEL ); + dup =pipapo_get (net, set, m, start, genmask, tstamp,GFP_KERNEL );if (!IS_ERR (dup)) {/* Check if we already have the same exact entry */ const struct nft_data *dup_key, *dup_end;
@@ -1280,7 +1282,7 @@ static int nft_pipapo_insert(const strucif (PTR_ERR (dup) == -ENOENT ) {/* Look for partially overlapping entries */ - dup =pipapo_get (net, set, end,nft_genmask_next (net), tstamp, + dup =pipapo_get (net, set, m, end,nft_genmask_next (net), tstamp,GFP_KERNEL ); }
@@ -1866,16 +1868,18 @@ static void *nft_pipapo_deactivate(constconst struct nft_set *set, const struct nft_set_elem *elem) { + const struct nft_pipapo *priv = nft_set_priv(set); +struct nft_pipapo_match *m = priv->clone;struct nft_pipapo_elem *e; - e =pipapo_get (net, set, (const u8 *)elem->key.val.data, + e =pipapo_get (net, set, m, (const u8 *)elem->key.val.data,nft_genmask_next (net),nft_net_tstamp (net),GFP_KERNEL );if (IS_ERR (e))return NULL ;nft_set_elem_change_active (net, set, &e->ext); -return &e->priv; +return e; }/**
@@ -1901,8 +1905,9 @@ static bool nft_pipapo_flush(const struc {struct nft_pipapo_elem *e = elem; -return pipapo_deactivate (net, set, (const u8 *)nft_set_ext_key (&e->ext), - &e->ext); +nft_set_elem_change_active (net, set, &e->ext); + +return true; }/**
Greg Kroah-Hartman
maintainerPATCH 105/303 netfilter: nft_set_pipapo: move cloning of match info to insert/removal path
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 3f1d886cc7c3525d4dbeee24bfa9bb3fe0d48ddc ]
This set type keeps two copies of the sets' content,
priv->match (live version, used to match from packet path) priv->clone (work-in-progress version of the 'future' priv->match).
All additions and removals are done on priv->clone. When transaction completes, priv->clone becomes priv->match and a new clone is allocated for use by next transaction.
Problem is that the cloning requires GFP_KERNEL allocations but we cannot fail at either commit or abort time.
This patch defers the clone until we get an insertion or removal request. This allows us to handle OOM situations correctly.
This also allows to remove ->dirty in a followup change:
If ->clone exists, ->dirty is always true
If ->clone is NULL, ->dirty is always false, no elements were added or removed (except catchall elements which are external to the specific set backend).
Stable-dep-of: 47e65eff5069 ("netfilter: nft_set_pipapo: don't leak bad clone into future transaction")
--- net/netfilter/nft_set_pipapo.c | 70 ++++++++++++++++++++++++++++------------- 1 file changed, 49 insertions(+), 21 deletions(-)
net/netfilter/nft_set_pipapo.c +49 -21
@@ -1230,6 +1230,29 @@ static bool nft_pipapo_transaction_mutex#endif } +static struct nft_pipapo_match *pipapo_clone (struct nft_pipapo_match *old); + +/** +* pipapo_maybe_clone() - Build clone for pending data changes, if not existing +* @set: nftables API set representation +* +* Return: newly created or existing clone, if any. NULL on allocation failure +*/ +static struct nft_pipapo_match *pipapo_maybe_clone (const struct nft_set *set) +{ +struct nft_pipapo *priv =nft_set_priv (set); +struct nft_pipapo_match *m; + +if (priv->clone) +return priv->clone; + + m =rcu_dereference_protected (priv->match, +nft_pipapo_transaction_mutex_held (set)); + priv->clone =pipapo_clone (m); + +return priv->clone; +} +/** * nft_pipapo_insert() - Validate and insert ranged elements * @net: Network namespace
@@ -1247,14 +1270,17 @@ static int nft_pipapo_insert(const strucunion nft_pipapo_map_bucket rulemap[NFT_PIPAPO_MAX_FIELDS ];const u8 *start = (const u8 *)elem->key.val.data, *end;struct nft_pipapo_elem *e = elem->priv, *dup; +struct nft_pipapo_match *m =pipapo_maybe_clone (set);struct nft_pipapo *priv =nft_set_priv (set); -struct nft_pipapo_match *m = priv->clone;u8 genmask =nft_genmask_next (net);u64 tstamp =nft_net_tstamp (net);struct nft_pipapo_field *f;const u8 *start_p, *end_p;int i, bsize_max, err =0 ; +if (!m) +return -ENOMEM ; +if (nft_set_ext_exists (ext,NFT_SET_EXT_KEY_END )) end = (const u8 *)nft_set_ext_key_end (ext)->data;else
@@ -1792,7 +1818,10 @@ static void pipapo_reclaim_match(structstatic void nft_pipapo_commit (struct nft_set *set) {struct nft_pipapo *priv =nft_set_priv (set); -struct nft_pipapo_match *new_clone, *old; +struct nft_pipapo_match *old; + +if (!priv->clone) +return ;if (time_after_eq (jiffies, priv->last_gc +nft_set_gc_interval (set)))pipapo_gc_scan (set, priv->clone);
@@ -1800,40 +1829,29 @@ static void nft_pipapo_commit(struct nftif (!priv->dirty)return ; - new_clone =pipapo_clone (priv->clone); -if (!new_clone) -return ; - + old =rcu_replace_pointer (priv->match, priv->clone, +nft_pipapo_transaction_mutex_held (set)); + priv->clone =NULL ; priv->dirty = false; - old =rcu_access_pointer (priv->match); -rcu_assign_pointer (priv->match, priv->clone);if (old)call_rcu (&old->rcu, pipapo_reclaim_match); - priv->clone = new_clone; -pipapo_gc_queue (set); }static void nft_pipapo_abort (const struct nft_set *set) {struct nft_pipapo *priv =nft_set_priv (set); -struct nft_pipapo_match *new_clone, *m;if (!priv->dirty)return ; - m =rcu_dereference_protected (priv->match,nft_pipapo_transaction_mutex_held (set)); - - new_clone =pipapo_clone (m); -if (!new_clone) +if (!priv->clone)return ; - priv->dirty = false; -pipapo_free_match (priv->clone); - priv->clone = new_clone; + priv->clone =NULL ; }/**
@@ -1868,10 +1886,15 @@ static void *nft_pipapo_deactivate(constconst struct nft_set *set, const struct nft_set_elem *elem) { - const struct nft_pipapo *priv = nft_set_priv(set); -struct nft_pipapo_match *m = priv->clone; + struct nft_pipapo_match *m = pipapo_maybe_clone(set);struct nft_pipapo_elem *e; +/* removal must occur on priv->clone, if we are low on memory +* we have no choice and must fail the removal request. +*/ +if (!m) +return NULL ; + e =pipapo_get (net, set, m, (const u8 *)elem->key.val.data,nft_genmask_next (net),nft_net_tstamp (net),GFP_KERNEL );if (IS_ERR (e))
@@ -2154,7 +2177,12 @@ static void nft_pipapo_walk(const structswitch (iter->type) {case NFT_ITER_UPDATE : - m = priv->clone; + m =pipapo_maybe_clone (set); +if (!m) { + iter->err = -ENOMEM ; +return ; + } +nft_pipapo_do_walk (ctx, set, m, iter);break ;case NFT_ITER_READ :
Greg Kroah-Hartman
maintainerPATCH 106/303 netfilter: nft_set_pipapo: dont leak bad clone into future transaction
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 47e65eff50691f0a5b79d325e28d83ec1da43bcf ]
On memory allocation failure the cloned nft_pipapo_match can enter a bad state:
- some fields can have their lookup tables resized while others did not
- bits might have been toggled
- scratch map can be undersized which also means m->bsize_max can be lower than what is required
This means that the next insertion in the same batch can trigger out-of-bounds writes.
Furthermore, a failure in the first can result in the bad clone to leak into the next transaction because the abort callback is never executed in this case (the upper layer saw an error and no attempt to allocate a transactional request was made).
Record a state for the nft_pipapo_match structure:
- NEW (pristine clone)
- MOD (modified clone with good state)
- ERR (potentially bogus content)
Then make it so that deletes and insertions fail when the clone entered ERR state.
In case the very first insert attempt results in an error, free the clone right away.
--- net/netfilter/nft_set_pipapo.c | 34 +++++++++++++++++++++++++++++----- net/netfilter/nft_set_pipapo.h | 8 ++++++++ 2 files changed, 37 insertions(+), 5 deletions(-)
net/netfilter/nft_set_pipapo.c +29 -5
@@ -342,6 +342,8 @@#include "nft_set_pipapo_avx2.h" #include "nft_set_pipapo.h" +static void nft_pipapo_abort (const struct nft_set *set); +/** * pipapo_refill() - For each set bit, set bits from selected mapping table item * @map: Bitmap to be scanned for set bits
@@ -1278,7 +1280,7 @@ static int nft_pipapo_insert(const strucconst u8 *start_p, *end_p;int i, bsize_max, err =0 ; -if (!m) +if (!m || m->state ==NFT_PIPAPO_CLONE_ERR )return -ENOMEM ;if (nft_set_ext_exists (ext,NFT_SET_EXT_KEY_END ))
@@ -1351,8 +1353,10 @@ static int nft_pipapo_insert(const strucelse ret =pipapo_expand (f, start, end, f->groups * f->bb); -if (ret <0 ) -return ret; +if (ret <0 ) { + err = ret; + goto abort; + }if (f->bsize > bsize_max) bsize_max = f->bsize;
@@ -1368,7 +1372,7 @@ static int nft_pipapo_insert(const struc err =pipapo_realloc_scratch (m, bsize_max);if (err) -return err; + goto abort; m->bsize_max = bsize_max; }else {
@@ -1379,7 +1383,26 @@ static int nft_pipapo_insert(const strucpipapo_map (m, rulemap, e); + m->state =NFT_PIPAPO_CLONE_MOD ;return 0 ; +abort: +DEBUG_NET_WARN_ON_ONCE (m->state ==NFT_PIPAPO_CLONE_ERR ); + +/* Two rollback cases: +* 1) no previous changes. nft_pipapo_abort is not +* guaranteed to be invoked (there might be no further +* add/delete requests coming after this). +* +* 2) we had previous changes: there are transaction +* records pointing to this set. Leave the rollback to +* the transaction handling. +*/ +if (m->state ==NFT_PIPAPO_CLONE_NEW ) +nft_pipapo_abort (set);/* releases m */ +else + m->state =NFT_PIPAPO_CLONE_ERR ; + +return err; }/**
@@ -1456,6 +1479,7 @@ static struct nft_pipapo_match *pipapo_c dst++; } + new->state =NFT_PIPAPO_CLONE_NEW ;return new; out_mt:
@@ -1892,7 +1916,7 @@ static void *nft_pipapo_deactivate(const/* removal must occur on priv->clone, if we are low on memory * we have no choice and must fail the removal request. */ -if (!m) +if (!m || m->state ==NFT_PIPAPO_CLONE_ERR )return NULL ; e = pipapo_get(net, set, m, (const u8 *)elem->key.val.data,
net/netfilter/nft_set_pipapo.h +8 -0
@@ -142,9 +142,16 @@ struct nft_pipapo_scratch {unsigned long map[]; }; +enum nft_pipapo_clone_state { +NFT_PIPAPO_CLONE_NEW , +NFT_PIPAPO_CLONE_MOD , +NFT_PIPAPO_CLONE_ERR , +}; +/** * struct nft_pipapo_match - Data used for lookup and matching * @field_count Amount of fields in set +* @state: add/delete state; used from control plane * @scratch: Preallocated per-CPU maps for partial matching results * @bsize_max: Maximum lookup table bucket size of all fields, in longs * @rcu Matching data is swapped on commits
@@ -152,6 +159,7 @@ struct nft_pipapo_scratch {*/ struct nft_pipapo_match {int field_count; +enum nft_pipapo_clone_state state:8 ;struct nft_pipapo_scratch *__percpu *scratch;size_t bsize_max;struct rcu_head rcu;
Greg Kroah-Hartman
maintainerPATCH 107/303 netfilter: nf_conntrack_sip: remove net variable shadowing
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 7970d6aaf710db166de98c5356a260089896fae5 ]
net is already set, derived from nf_conn.
I don't see how the device could be living in a different netns than the conntrack entry.
Remove the extra variable and re-use existing one.
Stable-dep-of: e5e24a365a5e ("netfilter: nf_conntrack_sip: validate skb_dst() before accessing it")
--- net/netfilter/nf_conntrack_sip.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/netfilter/nf_conntrack_sip.c +1 -2
@@ -948,9 +948,8 @@ static int set_expected_rtp_rtcp(struct saddr = &ct->tuplehash[!dir].tuple.src.u3; }else if (sip_external_media) {struct net_device *dev =skb_dst (skb)->dev; -struct net *net =dev_net (dev); -struct flowi fl;struct dst_entry *dst =NULL ; +struct flowi fl;memset (&fl,0 ,sizeof (fl));
Greg Kroah-Hartman
maintainerPATCH 108/303 netfilter: nf_conntrack_sip: validate skb_dst() before accessing it
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit e5e24a365a5e024efef63cc49abb345fbd4852c5 ]
tc ingress and openvswitch do not guarantee routing information to be available. These subsystems use the conntrack helper infrastructure, and the SIP helper relies on the skb_dst() to be present if sip_external_media is set to 1 (which is disabled by default as a module parameter).
This effectively disables the sip_external_media toggle for these subsystems without resulting in a crash.
--- net/netfilter/nf_conntrack_sip.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
net/netfilter/nf_conntrack_sip.c +5 -2
@@ -947,7 +947,6 @@ static int set_expected_rtp_rtcp(structreturn NF_ACCEPT ; saddr = &ct->tuplehash[!dir].tuple.src.u3; }else if (sip_external_media) { -struct net_device *dev =skb_dst (skb)->dev;struct dst_entry *dst =NULL ;struct flowi fl;
@@ -969,7 +968,11 @@ static int set_expected_rtp_rtcp(struct* through the same interface as the signalling peer. */ if (dst) { -bool external_media = (dst->dev == dev); +const struct dst_entry *this_dst =skb_dst (skb); +bool external_media = false; + +if (this_dst && dst->dev == this_dst->dev) + external_media = true;dst_release (dst);if (external_media)
Greg Kroah-Hartman
maintainerPATCH 109/303 lsm: infrastructure management of the sock security
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Casey Schaufler <[email protected]>
[ Upstream commit 2aff9d20d50ac45dd13a013ef5231f4fb8912356 ]
Move management of the sock->sk_security blob out of the individual security modules and into the security infrastructure. Instead of allocating the blobs from within the modules the modules tell the infrastructure how much space is required, and the space is allocated there.
Stable-dep-of: 56acfeb10019 ("selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()")
--- include/linux/lsm_hooks.h | 1 security/apparmor/include/net.h | 6 ++- security/apparmor/lsm.c | 38 +++++-------------- security/apparmor/net.c | 2 - security/security.c | 47 +++++++++++++++++++++++ security/selinux/hooks.c | 76 +++++++++++++++++--------------------- security/selinux/include/objsec.h | 5 ++ security/selinux/netlabel.c | 23 ++++++----- security/smack/smack.h | 5 ++ security/smack/smack_lsm.c | 70 ++++++++++++++++------------------- security/smack/smack_netfilter.c | 4 +- 11 files changed, 155 insertions(+), 122 deletions(-)
include/linux/lsm_hooks.h +1 -0
@@ -1620,6 +1620,7 @@ struct lsm_blob_sizes {int lbs_cred;int lbs_file;int lbs_inode; +int lbs_sock;int lbs_superblock;int lbs_ipc;int lbs_msg_msg;
security/apparmor/include/net.h +5 -1
@@ -51,7 +51,11 @@ struct aa_sk_ctx {struct aa_label *peer; }; -#define SK_CTX (X ) ((X)->sk_security) +static inline struct aa_sk_ctx *aa_sock (const struct sock *sk) +{ +return sk->sk_security + apparmor_blob_sizes.lbs_sock; +} +#define SOCK_ctx (X ) SOCK_INODE(X)->i_security#define DEFINE_AUDIT_NET (NAME ,OP ,SK ,F ,T ,P ) \ struct lsm_network_audit NAME ## _net = { .sk = (SK), \
security/apparmor/lsm.c +10 -28
@@ -803,32 +803,14 @@ static int apparmor_task_kill(struct tas }/** -* apparmor_sk_alloc_security - allocate and attach the sk_security field -*/ -static int apparmor_sk_alloc_security (struct sock *sk,int family,gfp_t flags) -{ -struct aa_sk_ctx *ctx; - - ctx =kzalloc (sizeof (*ctx), flags); -if (!ctx) -return -ENOMEM ; - -SK_CTX (sk) = ctx; - -return 0 ; -} - -/** * apparmor_sk_free_security - free the sk_security field */ static void apparmor_sk_free_security (struct sock *sk) { -struct aa_sk_ctx *ctx =SK_CTX (sk); +struct aa_sk_ctx *ctx =aa_sock (sk); -SK_CTX (sk) =NULL ;aa_put_label (ctx->label);aa_put_label (ctx->peer); -kfree (ctx); }/**
@@ -837,8 +819,8 @@ static void apparmor_sk_free_security(ststatic void apparmor_sk_clone_security (const struct sock *sk,struct sock *newsk) { -struct aa_sk_ctx *ctx =SK_CTX (sk); -struct aa_sk_ctx *new =SK_CTX (newsk); +struct aa_sk_ctx *ctx =aa_sock (sk); +struct aa_sk_ctx *new =aa_sock (newsk);if (new->label)aa_put_label (new->label);
@@ -891,7 +873,7 @@ static int apparmor_socket_post_create(s label =aa_get_current_label ();if (sock->sk) { -struct aa_sk_ctx *ctx =SK_CTX (sock->sk); +struct aa_sk_ctx *ctx =aa_sock (sock->sk);aa_put_label (ctx->label); ctx->label =aa_get_label (label);
@@ -1090,7 +1072,7 @@ static int apparmor_socket_shutdown(stru*/ static int apparmor_socket_sock_rcv_skb (struct sock *sk,struct sk_buff *skb) { -struct aa_sk_ctx *ctx =SK_CTX (sk); +struct aa_sk_ctx *ctx =aa_sock (sk);if (!skb->secmark)return 0 ;
@@ -1110,7 +1092,7 @@ static int apparmor_socket_sock_rcv_skb(static struct aa_label *sk_peer_label (struct sock *sk) { -struct aa_sk_ctx *ctx =SK_CTX (sk); +struct aa_sk_ctx *ctx =aa_sock (sk);if (ctx->peer)return ctx->peer;
@@ -1194,7 +1176,7 @@ static int apparmor_socket_getpeersec_dg*/ static void apparmor_sock_graft (struct sock *sk,struct socket *parent) { -struct aa_sk_ctx *ctx =SK_CTX (sk); +struct aa_sk_ctx *ctx =aa_sock (sk);if (!ctx->label) ctx->label =aa_get_current_label ();
@@ -1204,7 +1186,7 @@ static void apparmor_sock_graft(struct sstatic int apparmor_inet_conn_request (const struct sock *sk,struct sk_buff *skb,struct request_sock *req) { -struct aa_sk_ctx *ctx =SK_CTX (sk); +struct aa_sk_ctx *ctx =aa_sock (sk);if (!skb->secmark)return 0 ;
@@ -1221,6 +1203,7 @@ struct lsm_blob_sizes apparmor_blob_size .lbs_cred = sizeof(struct aa_label *), .lbs_file = sizeof(struct aa_file_ctx), .lbs_task = sizeof(struct aa_task_ctx), + .lbs_sock = sizeof(struct aa_sk_ctx), }; static struct security_hook_list apparmor_hooks[] __lsm_ro_after_init = {
@@ -1257,7 +1240,6 @@ static struct security_hook_list apparmoLSM_HOOK_INIT (getprocattr, apparmor_getprocattr),LSM_HOOK_INIT (setprocattr, apparmor_setprocattr), -LSM_HOOK_INIT (sk_alloc_security, apparmor_sk_alloc_security),LSM_HOOK_INIT (sk_free_security, apparmor_sk_free_security), LSM_HOOK_INIT(sk_clone_security, apparmor_sk_clone_security),
@@ -1823,7 +1805,7 @@ static unsigned int apparmor_ip_postroutif (sk ==NULL )return NF_ACCEPT ; - ctx =SK_CTX (sk); + ctx =aa_sock (sk);if (!apparmor_secmark_check (ctx->label,OP_SENDMSG ,AA_MAY_SEND , skb->secmark, sk))return NF_ACCEPT ;
security/apparmor/net.c +1 -1
@@ -146,7 +146,7 @@ int aa_af_perm(struct aa_label *label, cstatic int aa_label_sk_perm (struct aa_label *label,const char *op,u32 request,struct sock *sk) { -struct aa_sk_ctx *ctx =SK_CTX (sk); +struct aa_sk_ctx *ctx =aa_sock (sk);int error =0 ;AA_BUG (!label);
security/security.c +46 -1
78 lines not on this page · raw message
security/selinux/hooks.c +35 -41
255 lines not on this page · raw message
security/selinux/include/objsec.h +5 -0
@@ -194,4 +194,9 @@ static inline struct superblock_security return superblock->s_security + selinux_blob_sizes.lbs_superblock; } +static inline struct sk_security_struct *selinux_sock (const struct sock *sock) +{ +return sock->sk_security + selinux_blob_sizes.lbs_sock; +} +#endif /* _SELINUX_OBJSEC_H_ */
security/selinux/netlabel.c +12 -11
@@ -17,6 +17,7 @@#include <linux/gfp.h> #include <linux/ip.h> #include <linux/ipv6.h> +#include <linux/lsm_hooks.h> #include <net/sock.h> #include <net/netlabel.h> #include <net/ip.h>
@@ -68,7 +69,7 @@ static int selinux_netlbl_sidlookup_cachstatic struct netlbl_lsm_secattr *selinux_netlbl_sock_genattr (struct sock *sk) {int rc; -struct sk_security_struct *sksec = sk->sk_security; +struct sk_security_struct *sksec =selinux_sock (sk);struct netlbl_lsm_secattr *secattr;if (sksec->nlbl_secattr !=NULL )
@@ -101,7 +102,7 @@ static struct netlbl_lsm_secattr *selinu const struct sock *sk, u32 sid) { -struct sk_security_struct *sksec = sk->sk_security; +struct sk_security_struct *sksec =selinux_sock (sk);struct netlbl_lsm_secattr *secattr = sksec->nlbl_secattr;if (secattr ==NULL )
@@ -236,7 +237,7 @@ int selinux_netlbl_skbuff_setsid(struct* being labeled by it's parent socket, if it is just exit */ sk =skb_to_full_sk (skb);if (sk !=NULL ) { -struct sk_security_struct *sksec = sk->sk_security; +struct sk_security_struct *sksec =selinux_sock (sk);if (sksec->nlbl_state !=NLBL_REQSKB )return 0 ;
@@ -274,7 +275,7 @@ int selinux_netlbl_sctp_assoc_request(st {int rc;struct netlbl_lsm_secattr secattr; -struct sk_security_struct *sksec = asoc->base.sk->sk_security; +struct sk_security_struct *sksec =selinux_sock (asoc->base.sk);struct sockaddr_in addr4;struct sockaddr_in6 addr6;
@@ -355,7 +356,7 @@ inet_conn_request_return:*/ void selinux_netlbl_inet_csk_clone (struct sock *sk,u16 family) { -struct sk_security_struct *sksec = sk->sk_security; +struct sk_security_struct *sksec =selinux_sock (sk);if (family ==PF_INET ) sksec->nlbl_state =NLBL_LABELED ;
@@ -373,8 +374,8 @@ void selinux_netlbl_inet_csk_clone(struc*/ void selinux_netlbl_sctp_sk_clone (struct sock *sk,struct sock *newsk) { -struct sk_security_struct *sksec = sk->sk_security; -struct sk_security_struct *newsksec = newsk->sk_security; +struct sk_security_struct *sksec =selinux_sock (sk); +struct sk_security_struct *newsksec =selinux_sock (newsk); newsksec->nlbl_state = sksec->nlbl_state; }
@@ -392,7 +393,7 @@ void selinux_netlbl_sctp_sk_clone(structint selinux_netlbl_socket_post_create (struct sock *sk,u16 family) {int rc; -struct sk_security_struct *sksec = sk->sk_security; +struct sk_security_struct *sksec =selinux_sock (sk);struct netlbl_lsm_secattr *secattr;if (family !=PF_INET && family !=PF_INET6 )
@@ -507,7 +508,7 @@ int selinux_netlbl_socket_setsockopt(str {int rc =0 ;struct sock *sk = sock->sk; -struct sk_security_struct *sksec = sk->sk_security; +struct sk_security_struct *sksec =selinux_sock (sk);struct netlbl_lsm_secattr secattr; if (selinux_netlbl_option(level, optname) &&
@@ -545,7 +546,7 @@ static int selinux_netlbl_socket_connect struct sockaddr *addr) {int rc; -struct sk_security_struct *sksec = sk->sk_security; +struct sk_security_struct *sksec =selinux_sock (sk);struct netlbl_lsm_secattr *secattr;/* connected sockets are allowed to disconnect when the address family
@@ -584,7 +585,7 @@ static int selinux_netlbl_socket_connectint selinux_netlbl_socket_connect_locked (struct sock *sk,struct sockaddr *addr) { -struct sk_security_struct *sksec = sk->sk_security; +struct sk_security_struct *sksec =selinux_sock (sk);if (sksec->nlbl_state !=NLBL_REQSKB && sksec->nlbl_state !=NLBL_CONNLABELED )
security/smack/smack.h +5 -0
@@ -361,6 +361,11 @@ static inline struct superblock_smack *sreturn superblock->s_security + smack_blob_sizes.lbs_superblock; } +static inline struct socket_smack *smack_sock (const struct sock *sock) +{ +return sock->sk_security + smack_blob_sizes.lbs_sock; +} +/* * Is the directory transmuting? */
security/smack/smack_lsm.c +33 -37
243 lines not on this page · raw message
security/smack/smack_netfilter.c +2 -2
@@ -26,8 +26,8 @@ static unsigned int smack_ip_output(voidstruct socket_smack *ssp;struct smack_known *skp; -if (sk && sk->sk_security) { - ssp = sk->sk_security; +if (sk) { + ssp =smack_sock (sk); skp = ssp->smk_out; skb->secmark = skp->smk_secid; }
Greg Kroah-Hartman
maintainerPATCH 110/303 selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristan Madani <[email protected]>
[ Upstream commit 56acfeb10019e200ab6787d01f8d7cbe0f01526f ]
selinux_sctp_bind_connect() dereferences sk->sk_socket to pass a struct socket * to selinux_socket_bind() and selinux_socket_connect_helper(). However, when the hook is invoked from the ASCONF softirq path (sctp_process_asconf), there is no file reference guaranteeing that sk->sk_socket is non-NULL. The setsockopt callers (bindx, connectx, set_primary, sendmsg connect) hold a file reference and are not affected.
Both selinux_socket_bind() and selinux_socket_connect_helper() immediately resolve sock->sk, never using the struct socket * for anything else. Refactor the inner logic into helpers that take a struct sock * directly so that selinux_sctp_bind_connect() never needs to touch sk->sk_socket at all.
--- security/selinux/hooks.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-)
security/selinux/hooks.c +10 -9
@@ -4678,9 +4678,8 @@ static int selinux_socket_socketpair(strNeed to determine whether we should perform a name_bind permission check between the socket and the port number. */ -static int selinux_socket_bind (struct socket *sock,struct sockaddr *address,int addrlen) +static int __selinux_socket_bind (struct sock *sk,struct sockaddr *address,int addrlen) { -struct sock *sk = sock->sk;struct sk_security_struct *sksec =selinux_sock (sk);u16 family;int err;
@@ -4816,13 +4815,17 @@ err_af:return -EAFNOSUPPORT ; } +static int selinux_socket_bind (struct socket *sock,struct sockaddr *address,int addrlen) +{ +return __selinux_socket_bind (sock->sk, address, addrlen); +} +/* This supports connect(2) and SCTP connect services such as sctp_connectx(3) * and sctp_sendmsg(3) as described in Documentation/security/SCTP.rst */ -static int selinux_socket_connect_helper (struct socket *sock, +static int selinux_socket_connect_helper (struct sock *sk,struct sockaddr *address,int addrlen) { -struct sock *sk = sock->sk;struct sk_security_struct *sksec =selinux_sock (sk);int err;
@@ -4916,7 +4919,7 @@ static int selinux_socket_connect(structint err;struct sock *sk = sock->sk; - err =selinux_socket_connect_helper (sock, address, addrlen); + err =selinux_socket_connect_helper (sk, address, addrlen);if (err)return err;
@@ -5439,13 +5442,11 @@ static int selinux_sctp_bind_connect(strint len, err =0 , walk_size =0 ;void *addr_buf;struct sockaddr *addr; -struct socket *sock;if (!selinux_policycap_extsockclass ())return 0 ;/* Process one or more addresses that may be IPv4 or IPv6 */ - sock = sk->sk_socket; addr_buf = address;while (walk_size < addrlen) {
@@ -5474,14 +5475,14 @@ static int selinux_sctp_bind_connect(strcase SCTP_PRIMARY_ADDR :case SCTP_SET_PEER_PRIMARY_ADDR :case SCTP_SOCKOPT_BINDX_ADD : - err =selinux_socket_bind (sock, addr, len); + err =__selinux_socket_bind (sk, addr, len);break ;/* Connect checks */ case SCTP_SOCKOPT_CONNECTX :case SCTP_PARAM_SET_PRIMARY :case SCTP_PARAM_ADD_IP :case SCTP_SENDMSG_CONNECT : - err =selinux_socket_connect_helper (sock, addr, len); + err =selinux_socket_connect_helper (sk, addr, len);if (err)return err;
Greg Kroah-Hartman
maintainerPATCH 111/303 remoteproc: qcom: replace kstrdup with kstrndup
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mukesh Ojha <[email protected]>
[ Upstream commit 9d5b9ad97f83b2390a6006eeb5ae5e48ec4298ce ]
Since, there is no guarantee that region.name will be 0-terminated from the firmware side, replace kstrdup with kstrndup.
Stable-dep-of: ecf9fc18e62c ("remoteproc: qcom: Fix leak when custom dump_segments addition fails")
--- drivers/remoteproc/qcom_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/remoteproc/qcom_common.c +1 -1
@@ -124,7 +124,7 @@ static int qcom_add_minidump_segments(stfor (i =0 ; i < seg_cnt; i++) {memcpy_fromio (®ion, ptr + i,sizeof (region));if (region.valid ==MD_REGION_VALID ) { - name =kstrdup (region.name,GFP_KERNEL ); + name =kstrndup (region.name,MAX_REGION_NAME_LENGTH -1 ,GFP_KERNEL );if (!name) {iounmap (ptr);return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 112/303 remoteproc: qcom: fix sparse warnings
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mukesh Ojha <[email protected]>
[ Upstream commit 2554dd0ac362738f588ba073d8333eb9b14f9587 ]
This patch try to address below sparse warnings.
drivers/remoteproc/qcom_common.c:126:27: warning: restricted __le32 degrades to integer drivers/remoteproc/qcom_common.c:133:32: warning: cast to restricted __le32 drivers/remoteproc/qcom_common.c:133:32: warning: cast from restricted __le64
Stable-dep-of: ecf9fc18e62c ("remoteproc: qcom: Fix leak when custom dump_segments addition fails")
--- drivers/remoteproc/qcom_common.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/remoteproc/qcom_common.c +2 -2
@@ -123,14 +123,14 @@ static int qcom_add_minidump_segments(stfor (i =0 ; i < seg_cnt; i++) {memcpy_fromio (®ion, ptr + i,sizeof (region)); -if (region.valid ==MD_REGION_VALID ) { +if (le32_to_cpu (region.valid) ==MD_REGION_VALID ) { name =kstrndup (region.name,MAX_REGION_NAME_LENGTH -1 ,GFP_KERNEL );if (!name) {iounmap (ptr);return -ENOMEM ; } da =le64_to_cpu (region.address); - size =le32_to_cpu (region.size); + size =le64_to_cpu (region.size);rproc_coredump_add_custom_segment (rproc, da, size,NULL , name); } }
Greg Kroah-Hartman
maintainerPATCH 113/303 remoteproc: qcom: pas: Adjust the phys addr wrt the mem region
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yogesh Lal <[email protected]>
[ Upstream commit a376c10d45a8e6ee5ea55791193f90625b35e156 ]
The minidump table in the toc contains physical addresses that may lie before the physical address of the first elf segment in relocatable images. This change adds a custom dump function for minidumps which calculates the offset into the carveout region using the start of the physical address instead of the start of the first elf segment.
Stable-dep-of: ecf9fc18e62c ("remoteproc: qcom: Fix leak when custom dump_segments addition fails")
--- drivers/remoteproc/qcom_common.c | 13 +++++++++---- drivers/remoteproc/qcom_common.h | 5 ++++- drivers/remoteproc/qcom_q6v5_pas.c | 20 +++++++++++++++++++- 3 files changed, 32 insertions(+), 6 deletions(-)
drivers/remoteproc/qcom_common.c +9 -4
@@ -101,7 +101,9 @@ static void qcom_minidump_cleanup(struct } } -static int qcom_add_minidump_segments (struct rproc *rproc,struct minidump_subsystem *subsystem) +static int qcom_add_minidump_segments (struct rproc *rproc,struct minidump_subsystem *subsystem, +void (*rproc_dumpfn_t)(struct rproc *rproc,struct rproc_dump_segment *segment, +void *dest,size_t offset,size_t size)) {struct minidump_region __iomem *ptr;struct minidump_region region;
@@ -131,7 +133,7 @@ static int qcom_add_minidump_segments(st } da =le64_to_cpu (region.address); size =le64_to_cpu (region.size); -rproc_coredump_add_custom_segment (rproc, da, size,NULL , name); +rproc_coredump_add_custom_segment (rproc, da, size, rproc_dumpfn_t, name); } }
@@ -139,7 +141,10 @@ static int qcom_add_minidump_segments(streturn 0 ; } -void qcom_minidump (struct rproc *rproc,unsigned int minidump_id) +void qcom_minidump (struct rproc *rproc,unsigned int minidump_id, +void (*rproc_dumpfn_t)(struct rproc *rproc, +struct rproc_dump_segment *segment,void *dest,size_t offset, +size_t size)) {int ret;struct minidump_subsystem *subsystem;
@@ -169,7 +174,7 @@ void qcom_minidump(struct rproc *rproc,return ; } - ret =qcom_add_minidump_segments (rproc, subsystem); + ret =qcom_add_minidump_segments (rproc, subsystem, rproc_dumpfn_t);if (ret) {dev_err (&rproc->dev,"Failed with error: %d while adding minidump entries\n" , ret); goto clean_minidump;
drivers/remoteproc/qcom_common.h +4 -1
@@ -33,7 +33,10 @@ struct qcom_rproc_ssr {struct qcom_ssr_subsystem *info; }; -void qcom_minidump (struct rproc *rproc,unsigned int minidump_id); +void qcom_minidump (struct rproc *rproc,unsigned int minidump_id, +void (*rproc_dumpfn_t)(struct rproc *rproc, +struct rproc_dump_segment *segment,void *dest,size_t offset, +size_t size));void qcom_add_glink_subdev (struct rproc *rproc,struct qcom_rproc_glink *glink,const char *ssr_name);
drivers/remoteproc/qcom_q6v5_pas.c +19 -1
@@ -86,6 +86,24 @@ struct qcom_adsp {struct qcom_scm_pas_metadata pas_metadata; }; +void adsp_segment_dump (struct rproc *rproc,struct rproc_dump_segment *segment, +void *dest,size_t offset,size_t size) +{ +struct qcom_adsp *adsp = rproc->priv; +int total_offset; + + total_offset = segment->da + segment->offset + offset - adsp->mem_phys; +if (total_offset <0 || total_offset + size > adsp->mem_size) { +dev_err (adsp->dev, +"invalid copy request for segment %pad with offset %zu and size %zu)\n" , + &segment->da, offset, size); +memset (dest,0xff , size); +return ; + } + +memcpy_fromio (dest, adsp->mem_region + total_offset, size); +} +static void adsp_minidump (struct rproc *rproc) {struct qcom_adsp *adsp = rproc->priv;
@@ -93,7 +111,7 @@ static void adsp_minidump(struct rproc *if (rproc->dump_conf ==RPROC_COREDUMP_DISABLED )return ; -qcom_minidump (rproc, adsp->minidump_id); +qcom_minidump (rproc, adsp->minidump_id, adsp_segment_dump); } static int adsp_pds_enable(struct qcom_adsp *adsp, struct device **pds,
Greg Kroah-Hartman
maintainerPATCH 114/303 remoteproc: qcom: Fix leak when custom dump_segments addition fails
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wasim Nazir <[email protected]>
[ Upstream commit ecf9fc18e62c58eae1ceb65dab2bccb8a724de2d ]
Free allocated minidump_region 'name' in qcom_add_minidump_segments() when failing before adding the region to 'dump_segments'. Otherwise, the 'name' is not tracked and is never freed by qcom_minidump_cleanup().
Return error when adding to 'dump_segments' fails.
--- drivers/remoteproc/qcom_common.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
drivers/remoteproc/qcom_common.c +10 -4
@@ -108,6 +108,7 @@ static int qcom_add_minidump_segments(ststruct minidump_region __iomem *ptr;struct minidump_region region;int seg_cnt, i; +int ret =0 ;dma_addr_t da;size_t size;char *name;
@@ -128,17 +129,22 @@ static int qcom_add_minidump_segments(stif (le32_to_cpu (region.valid) ==MD_REGION_VALID ) { name =kstrndup (region.name,MAX_REGION_NAME_LENGTH -1 ,GFP_KERNEL );if (!name) { -iounmap (ptr); -return -ENOMEM ; + ret = -ENOMEM ; +break ; } da =le64_to_cpu (region.address); size =le64_to_cpu (region.size); -rproc_coredump_add_custom_segment (rproc, da, size, rproc_dumpfn_t, name); + ret =rproc_coredump_add_custom_segment (rproc, da, size, rproc_dumpfn_t, + name); +if (ret) { +kfree (name); +break ; + } } }iounmap (ptr); -return 0 ; +return ret; } void qcom_minidump(struct rproc *rproc, unsigned int minidump_id,
Greg Kroah-Hartman
maintainerPATCH 115/303 netfilter: nf_tables: pass context structure to nft_parse_register_load
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 7ea0522ef81a335c2d3a0ab1c8a4fab9a23c4a03 ]
Mechanical transformation, no logical changes intended.
Stable-dep-of: d07955dd34ec ("netfilter: nft_fib: reject fib expression on the netdev egress hook")
--- include/net/netfilter/nf_tables.h | 3 ++- net/ipv4/netfilter/nft_dup_ipv4.c | 4 ++-- net/ipv6/netfilter/nft_dup_ipv6.c | 4 ++-- net/netfilter/nf_tables_api.c | 3 ++- net/netfilter/nft_bitwise.c | 4 ++-- net/netfilter/nft_byteorder.c | 2 +- net/netfilter/nft_cmp.c | 6 +++--- net/netfilter/nft_ct.c | 2 +- net/netfilter/nft_dup_netdev.c | 2 +- net/netfilter/nft_dynset.c | 4 ++-- net/netfilter/nft_exthdr.c | 2 +- net/netfilter/nft_fwd_netdev.c | 6 +++--- net/netfilter/nft_hash.c | 2 +- net/netfilter/nft_lookup.c | 2 +- net/netfilter/nft_masq.c | 4 ++-- net/netfilter/nft_meta.c | 2 +- net/netfilter/nft_nat.c | 8 ++++---- net/netfilter/nft_objref.c | 2 +- net/netfilter/nft_payload.c | 2 +- net/netfilter/nft_queue.c | 2 +- net/netfilter/nft_range.c | 2 +- net/netfilter/nft_redir.c | 4 ++-- net/netfilter/nft_tproxy.c | 4 ++-- 23 files changed, 39 insertions(+), 37 deletions(-)
include/net/netfilter/nf_tables.h +2 -1
@@ -252,7 +252,8 @@ static inline enum nft_registers nft_typint nft_parse_u32_check (const struct nlattr *attr,int max,u32 *dest);int nft_dump_register (struct sk_buff *skb,unsigned int attr,unsigned int reg); -int nft_parse_register_load (const struct nlattr *attr,u8 *sreg,u32 len); +int nft_parse_register_load (const struct nft_ctx *ctx, +const struct nlattr *attr,u8 *sreg,u32 len); int nft_parse_register_store(const struct nft_ctx *ctx, const struct nlattr *attr, u8 *dreg, const struct nft_data *data,
net/ipv4/netfilter/nft_dup_ipv4.c +2 -2
@@ -40,13 +40,13 @@ static int nft_dup_ipv4_init(const strucif (tb[NFTA_DUP_SREG_ADDR ] ==NULL )return -EINVAL ; - err =nft_parse_register_load (tb[NFTA_DUP_SREG_ADDR ], &priv->sreg_addr, + err =nft_parse_register_load (ctx, tb[NFTA_DUP_SREG_ADDR ], &priv->sreg_addr,sizeof (struct in_addr ));if (err <0 )return err;if (tb[NFTA_DUP_SREG_DEV ]) - err =nft_parse_register_load (tb[NFTA_DUP_SREG_DEV ], + err =nft_parse_register_load (ctx, tb[NFTA_DUP_SREG_DEV ], &priv->sreg_dev,sizeof (int ));return err;
net/ipv6/netfilter/nft_dup_ipv6.c +2 -2
@@ -38,13 +38,13 @@ static int nft_dup_ipv6_init(const strucif (tb[NFTA_DUP_SREG_ADDR ] ==NULL )return -EINVAL ; - err =nft_parse_register_load (tb[NFTA_DUP_SREG_ADDR ], &priv->sreg_addr, + err =nft_parse_register_load (ctx, tb[NFTA_DUP_SREG_ADDR ], &priv->sreg_addr,sizeof (struct in6_addr ));if (err <0 )return err;if (tb[NFTA_DUP_SREG_DEV ]) - err =nft_parse_register_load (tb[NFTA_DUP_SREG_DEV ], + err =nft_parse_register_load (ctx, tb[NFTA_DUP_SREG_DEV ], &priv->sreg_dev,sizeof (int ));return err;
net/netfilter/nf_tables_api.c +2 -1
@@ -10442,7 +10442,8 @@ static int nft_validate_register_load(enreturn 0 ; } -int nft_parse_register_load (const struct nlattr *attr,u8 *sreg,u32 len) +int nft_parse_register_load (const struct nft_ctx *ctx, +const struct nlattr *attr,u8 *sreg,u32 len) {u32 reg;int err;
net/netfilter/nft_bitwise.c +2 -2
@@ -172,7 +172,7 @@ static int nft_bitwise_init(const struct priv->len = len; - err =nft_parse_register_load (tb[NFTA_BITWISE_SREG ], &priv->sreg, + err =nft_parse_register_load (ctx, tb[NFTA_BITWISE_SREG ], &priv->sreg, priv->len);if (err <0 )return err;
@@ -365,7 +365,7 @@ static int nft_bitwise_fast_init(const sstruct nft_bitwise_fast_expr *priv =nft_expr_priv (expr);int err; - err =nft_parse_register_load (tb[NFTA_BITWISE_SREG ], &priv->sreg, + err =nft_parse_register_load (ctx, tb[NFTA_BITWISE_SREG ], &priv->sreg,sizeof (u32));if (err <0 )return err;
net/netfilter/nft_byteorder.c +1 -1
@@ -139,7 +139,7 @@ static int nft_byteorder_init(const stru priv->len = len; - err =nft_parse_register_load (tb[NFTA_BYTEORDER_SREG ], &priv->sreg, + err =nft_parse_register_load (ctx, tb[NFTA_BYTEORDER_SREG ], &priv->sreg, priv->len);if (err <0 )return err;
net/netfilter/nft_cmp.c +3 -3
@@ -83,7 +83,7 @@ static int nft_cmp_init(const struct nftif (err <0 )return err; - err =nft_parse_register_load (tb[NFTA_CMP_SREG ], &priv->sreg, desc.len); + err =nft_parse_register_load (ctx, tb[NFTA_CMP_SREG ], &priv->sreg, desc.len);if (err <0 )return err;
@@ -221,7 +221,7 @@ static int nft_cmp_fast_init(const strucif (err <0 )return err; - err =nft_parse_register_load (tb[NFTA_CMP_SREG ], &priv->sreg, desc.len); + err =nft_parse_register_load (ctx, tb[NFTA_CMP_SREG ], &priv->sreg, desc.len);if (err <0 )return err;
@@ -321,7 +321,7 @@ static int nft_cmp16_fast_init(const strif (err <0 )return err; - err =nft_parse_register_load (tb[NFTA_CMP_SREG ], &priv->sreg, desc.len); + err =nft_parse_register_load (ctx, tb[NFTA_CMP_SREG ], &priv->sreg, desc.len);if (err <0 )return err;
net/netfilter/nft_ct.c +1 -1
@@ -621,7 +621,7 @@ static int nft_ct_set_init(const struct } priv->len = len; - err =nft_parse_register_load (tb[NFTA_CT_SREG ], &priv->sreg, len); + err =nft_parse_register_load (ctx, tb[NFTA_CT_SREG ], &priv->sreg, len);if (err <0 ) goto err1;
net/netfilter/nft_dup_netdev.c +1 -1
@@ -40,7 +40,7 @@ static int nft_dup_netdev_init(const strif (tb[NFTA_DUP_SREG_DEV ] ==NULL )return -EINVAL ; -return nft_parse_register_load (tb[NFTA_DUP_SREG_DEV ], &priv->sreg_dev, +return nft_parse_register_load (ctx, tb[NFTA_DUP_SREG_DEV ], &priv->sreg_dev,sizeof (int )); }
net/netfilter/nft_dynset.c +2 -2
@@ -222,7 +222,7 @@ static int nft_dynset_init(const structreturn err; } - err =nft_parse_register_load (tb[NFTA_DYNSET_SREG_KEY ], &priv->sreg_key, + err =nft_parse_register_load (ctx, tb[NFTA_DYNSET_SREG_KEY ], &priv->sreg_key, set->klen);if (err <0 )return err;
@@ -233,7 +233,7 @@ static int nft_dynset_init(const structif (set->dtype ==NFT_DATA_VERDICT )return -EOPNOTSUPP ; - err =nft_parse_register_load (tb[NFTA_DYNSET_SREG_DATA ], + err =nft_parse_register_load (ctx, tb[NFTA_DYNSET_SREG_DATA ], &priv->sreg_data, set->dlen);if (err <0 )return err;
net/netfilter/nft_exthdr.c +1 -1
@@ -590,7 +590,7 @@ static int nft_exthdr_tcp_set_init(const priv->flags = flags; priv->op = op; -return nft_parse_register_load (tb[NFTA_EXTHDR_SREG ], &priv->sreg, +return nft_parse_register_load (ctx, tb[NFTA_EXTHDR_SREG ], &priv->sreg, priv->len); }
net/netfilter/nft_fwd_netdev.c +3 -3
@@ -52,7 +52,7 @@ static int nft_fwd_netdev_init(const strif (tb[NFTA_FWD_SREG_DEV ] ==NULL )return -EINVAL ; -return nft_parse_register_load (tb[NFTA_FWD_SREG_DEV ], &priv->sreg_dev, +return nft_parse_register_load (ctx, tb[NFTA_FWD_SREG_DEV ], &priv->sreg_dev,sizeof (int )); }
@@ -187,12 +187,12 @@ static int nft_fwd_neigh_init(const strureturn -EOPNOTSUPP ; } - err =nft_parse_register_load (tb[NFTA_FWD_SREG_DEV ], &priv->sreg_dev, + err =nft_parse_register_load (ctx, tb[NFTA_FWD_SREG_DEV ], &priv->sreg_dev,sizeof (int ));if (err <0 )return err; -return nft_parse_register_load (tb[NFTA_FWD_SREG_ADDR ], &priv->sreg_addr, +return nft_parse_register_load (ctx, tb[NFTA_FWD_SREG_ADDR ], &priv->sreg_addr, addr_len); }
net/netfilter/nft_hash.c +1 -1
@@ -91,7 +91,7 @@ static int nft_jhash_init(const struct n priv->len = len; - err =nft_parse_register_load (tb[NFTA_HASH_SREG ], &priv->sreg, len); + err =nft_parse_register_load (ctx, tb[NFTA_HASH_SREG ], &priv->sreg, len);if (err <0 )return err;
net/netfilter/nft_lookup.c +1 -1
@@ -111,7 +111,7 @@ static int nft_lookup_init(const structif (IS_ERR (set))return PTR_ERR (set); - err =nft_parse_register_load (tb[NFTA_LOOKUP_SREG ], &priv->sreg, + err =nft_parse_register_load (ctx, tb[NFTA_LOOKUP_SREG ], &priv->sreg, set->klen);if (err <0 )return err;
net/netfilter/nft_masq.c +2 -2
@@ -54,13 +54,13 @@ static int nft_masq_init(const struct nf }if (tb[NFTA_MASQ_REG_PROTO_MIN ]) { - err =nft_parse_register_load (tb[NFTA_MASQ_REG_PROTO_MIN ], + err =nft_parse_register_load (ctx, tb[NFTA_MASQ_REG_PROTO_MIN ], &priv->sreg_proto_min, plen);if (err <0 )return err;if (tb[NFTA_MASQ_REG_PROTO_MAX ]) { - err =nft_parse_register_load (tb[NFTA_MASQ_REG_PROTO_MAX ], + err =nft_parse_register_load (ctx, tb[NFTA_MASQ_REG_PROTO_MAX ], &priv->sreg_proto_max, plen);if (err <0 )
net/netfilter/nft_meta.c +1 -1
@@ -657,7 +657,7 @@ int nft_meta_set_init(const struct nft_c } priv->len = len; - err =nft_parse_register_load (tb[NFTA_META_SREG ], &priv->sreg, len); + err =nft_parse_register_load (ctx, tb[NFTA_META_SREG ], &priv->sreg, len);if (err <0 )return err;
net/netfilter/nft_nat.c +4 -4
@@ -213,13 +213,13 @@ static int nft_nat_init(const struct nft priv->family = family;if (tb[NFTA_NAT_REG_ADDR_MIN ]) { - err =nft_parse_register_load (tb[NFTA_NAT_REG_ADDR_MIN ], + err =nft_parse_register_load (ctx, tb[NFTA_NAT_REG_ADDR_MIN ], &priv->sreg_addr_min, alen);if (err <0 )return err;if (tb[NFTA_NAT_REG_ADDR_MAX ]) { - err =nft_parse_register_load (tb[NFTA_NAT_REG_ADDR_MAX ], + err =nft_parse_register_load (ctx, tb[NFTA_NAT_REG_ADDR_MAX ], &priv->sreg_addr_max, alen);if (err <0 )
@@ -233,13 +233,13 @@ static int nft_nat_init(const struct nft plen = sizeof_field(struct nf_nat_range, min_proto.all);if (tb[NFTA_NAT_REG_PROTO_MIN ]) { - err =nft_parse_register_load (tb[NFTA_NAT_REG_PROTO_MIN ], + err =nft_parse_register_load (ctx, tb[NFTA_NAT_REG_PROTO_MIN ], &priv->sreg_proto_min, plen);if (err <0 )return err;if (tb[NFTA_NAT_REG_PROTO_MAX ]) { - err =nft_parse_register_load (tb[NFTA_NAT_REG_PROTO_MAX ], + err =nft_parse_register_load (ctx, tb[NFTA_NAT_REG_PROTO_MAX ], &priv->sreg_proto_max, plen);if (err <0 )
net/netfilter/nft_objref.c +1 -1
@@ -143,7 +143,7 @@ static int nft_objref_map_init(const strif (!(set->flags &NFT_SET_OBJECT ))return -EINVAL ; - err =nft_parse_register_load (tb[NFTA_OBJREF_SET_SREG ], &priv->sreg, + err =nft_parse_register_load (ctx, tb[NFTA_OBJREF_SET_SREG ], &priv->sreg, set->klen);if (err <0 )return err;
net/netfilter/nft_payload.c +1 -1
@@ -847,7 +847,7 @@ static int nft_payload_set_init(const st } priv->csum_type = csum_type; -return nft_parse_register_load (tb[NFTA_PAYLOAD_SREG ], &priv->sreg, +return nft_parse_register_load (ctx, tb[NFTA_PAYLOAD_SREG ], &priv->sreg, priv->len); }
net/netfilter/nft_queue.c +1 -1
@@ -136,7 +136,7 @@ static int nft_queue_sreg_init(const strstruct nft_queue *priv =nft_expr_priv (expr);int err; - err =nft_parse_register_load (tb[NFTA_QUEUE_SREG_QNUM ], + err =nft_parse_register_load (ctx, tb[NFTA_QUEUE_SREG_QNUM ], &priv->sreg_qnum,sizeof (u32));if (err <0 )return err;
net/netfilter/nft_range.c +1 -1
@@ -83,7 +83,7 @@ static int nft_range_init(const struct n goto err2; } - err =nft_parse_register_load (tb[NFTA_RANGE_SREG ], &priv->sreg, + err =nft_parse_register_load (ctx, tb[NFTA_RANGE_SREG ], &priv->sreg, desc_from.len);if (err <0 ) goto err2;
net/netfilter/nft_redir.c +2 -2
@@ -50,13 +50,13 @@ static int nft_redir_init(const struct n plen = sizeof_field(struct nf_nat_range, min_proto.all);if (tb[NFTA_REDIR_REG_PROTO_MIN ]) { - err =nft_parse_register_load (tb[NFTA_REDIR_REG_PROTO_MIN ], + err =nft_parse_register_load (ctx, tb[NFTA_REDIR_REG_PROTO_MIN ], &priv->sreg_proto_min, plen);if (err <0 )return err;if (tb[NFTA_REDIR_REG_PROTO_MAX ]) { - err =nft_parse_register_load (tb[NFTA_REDIR_REG_PROTO_MAX ], + err =nft_parse_register_load (ctx, tb[NFTA_REDIR_REG_PROTO_MAX ], &priv->sreg_proto_max, plen);if (err <0 )
net/netfilter/nft_tproxy.c +2 -2
@@ -254,14 +254,14 @@ static int nft_tproxy_init(const struct }if (tb[NFTA_TPROXY_REG_ADDR ]) { - err =nft_parse_register_load (tb[NFTA_TPROXY_REG_ADDR ], + err =nft_parse_register_load (ctx, tb[NFTA_TPROXY_REG_ADDR ], &priv->sreg_addr, alen);if (err <0 )return err; }if (tb[NFTA_TPROXY_REG_PORT ]) { - err =nft_parse_register_load (tb[NFTA_TPROXY_REG_PORT ], + err =nft_parse_register_load (ctx, tb[NFTA_TPROXY_REG_PORT ], &priv->sreg_port,sizeof (u16));if (err <0 )return err;
Greg Kroah-Hartman
maintainerPATCH 116/303 netfilter: nf_tables: drop unused 3rd argument from validate callback ops
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit eaf9b2c875ece22768b78aa38da8b232e5de021b ]
Since commit a654de8fdc18 ("netfilter: nf_tables: fix chain dependency validation") the validate() callback no longer needs the return pointer argument.
Stable-dep-of: d07955dd34ec ("netfilter: nft_fib: reject fib expression on the netdev egress hook")
--- include/net/netfilter/nf_tables.h | 3 +-- include/net/netfilter/nft_fib.h | 4 +--- include/net/netfilter/nft_meta.h | 3 +-- include/net/netfilter/nft_reject.h | 3 +-- net/bridge/netfilter/nft_reject_bridge.c | 3 +-- net/netfilter/nf_tables_api.c | 3 +-- net/netfilter/nft_compat.c | 6 ++---- net/netfilter/nft_fib.c | 3 +-- net/netfilter/nft_flow_offload.c | 3 +-- net/netfilter/nft_fwd_netdev.c | 3 +-- net/netfilter/nft_immediate.c | 3 +-- net/netfilter/nft_lookup.c | 3 +-- net/netfilter/nft_masq.c | 3 +-- net/netfilter/nft_meta.c | 6 ++---- net/netfilter/nft_nat.c | 3 +-- net/netfilter/nft_osf.c | 3 +-- net/netfilter/nft_queue.c | 3 +-- net/netfilter/nft_redir.c | 3 +-- net/netfilter/nft_reject.c | 3 +-- net/netfilter/nft_reject_inet.c | 3 +-- net/netfilter/nft_reject_netdev.c | 3 +-- net/netfilter/nft_rt.c | 3 +-- net/netfilter/nft_socket.c | 3 +-- net/netfilter/nft_synproxy.c | 3 +-- net/netfilter/nft_tproxy.c | 3 +-- net/netfilter/nft_xfrm.c | 3 +-- 26 files changed, 28 insertions(+), 57 deletions(-)
include/net/netfilter/nf_tables.h +1 -2
@@ -932,8 +932,7 @@ struct nft_expr_ops {int (*dump)(struct sk_buff *skb,const struct nft_expr *expr);int (*validate)(const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data); +const struct nft_expr *expr);bool (*reduce)(struct nft_regs_track *track,const struct nft_expr *expr); bool (*gc)(struct net *net,
include/net/netfilter/nft_fib.h +1 -3
@@ -21,9 +21,7 @@ nft_fib_is_loopback(const struct sk_buffint nft_fib_dump (struct sk_buff *skb,const struct nft_expr *expr);int nft_fib_init (const struct nft_ctx *ctx,const struct nft_expr *expr,const struct nlattr *const tb[]); -int nft_fib_validate (const struct nft_ctx *ctx,const struct nft_expr *expr, -const struct nft_data **data); - +int nft_fib_validate (const struct nft_ctx *ctx,const struct nft_expr *expr);void nft_fib4_eval_type (const struct nft_expr *expr,struct nft_regs *regs,const struct nft_pktinfo *pkt);
include/net/netfilter/nft_meta.h +1 -2
@@ -41,8 +41,7 @@ void nft_meta_set_destroy(const struct n const struct nft_expr *expr);int nft_meta_set_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data); +const struct nft_expr *expr);bool nft_meta_get_reduce (struct nft_regs_track *track,const struct nft_expr *expr);
include/net/netfilter/nft_reject.h +1 -2
@@ -15,8 +15,7 @@ struct nft_reject {extern const struct nla_policy nft_reject_policy[];int nft_reject_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data); +const struct nft_expr *expr); int nft_reject_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
net/bridge/netfilter/nft_reject_bridge.c +1 -2
@@ -170,8 +170,7 @@ out: }static int nft_reject_bridge_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data) +const struct nft_expr *expr) {return nft_chain_validate_hooks (ctx->chain, (1 <<NF_BR_PRE_ROUTING ) | (1 <<NF_BR_LOCAL_IN ));
net/netfilter/nf_tables_api.c +1 -2
@@ -3538,7 +3538,6 @@ static void nf_tables_rule_release(constint nft_chain_validate (const struct nft_ctx *ctx,const struct nft_chain *chain) {struct nft_expr *expr, *last; -const struct nft_data *data;struct nft_rule *rule;int err;
@@ -3556,7 +3555,7 @@ int nft_chain_validate(const struct nft_/* This may call nft_chain_validate() recursively, * callers that do so must increment ctx->level. */ - err = expr->ops->validate (ctx, expr, &data); + err = expr->ops->validate (ctx, expr);if (err <0 )return err; }
net/netfilter/nft_compat.c +2 -4
@@ -350,8 +350,7 @@ nla_put_failure: }static int nft_target_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data) +const struct nft_expr *expr) {struct xt_target *target = expr->ops->data;unsigned int hook_mask =0 ;
@@ -610,8 +609,7 @@ static int nft_match_large_dump(struct s }static int nft_match_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data) +const struct nft_expr *expr) {struct xt_match *match = expr->ops->data;unsigned int hook_mask =0 ;
net/netfilter/nft_fib.c +1 -2
@@ -25,8 +25,7 @@ EXPORT_SYMBOL(nft_fib_policy); NFTA_FIB_F_MARK | NFTA_FIB_F_IIF | NFTA_FIB_F_OIF | \ NFTA_FIB_F_PRESENT) -int nft_fib_validate (const struct nft_ctx *ctx,const struct nft_expr *expr, -const struct nft_data **data) +int nft_fib_validate (const struct nft_ctx *ctx,const struct nft_expr *expr) {const struct nft_fib *priv =nft_expr_priv (expr);unsigned int hooks;
net/netfilter/nft_flow_offload.c +1 -2
@@ -392,8 +392,7 @@ out: }static int nft_flow_offload_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data) +const struct nft_expr *expr) {unsigned int hook_mask = (1 <<NF_INET_FORWARD );
net/netfilter/nft_fwd_netdev.c +1 -2
@@ -212,8 +212,7 @@ nla_put_failure: }static int nft_fwd_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data) +const struct nft_expr *expr) {return nft_chain_validate_hooks (ctx->chain, (1 <<NF_NETDEV_INGRESS ) | (1 <<NF_NETDEV_EGRESS ));
net/netfilter/nft_immediate.c +1 -2
@@ -243,8 +243,7 @@ nla_put_failure: }static int nft_immediate_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **d) +const struct nft_expr *expr) {const struct nft_immediate_expr *priv =nft_expr_priv (expr);struct nft_ctx *pctx = (struct nft_ctx *)ctx;
net/netfilter/nft_lookup.c +1 -2
@@ -200,8 +200,7 @@ nla_put_failure: }static int nft_lookup_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **d) +const struct nft_expr *expr) {const struct nft_lookup *priv =nft_expr_priv (expr);struct nft_set_iter iter;
net/netfilter/nft_masq.c +1 -2
@@ -26,8 +26,7 @@ static const struct nla_policy nft_masq_ };static int nft_masq_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data) +const struct nft_expr *expr) {int err;
net/netfilter/nft_meta.c +2 -4
@@ -581,8 +581,7 @@ static int nft_meta_get_validate_xfrm(co }static int nft_meta_get_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data) +const struct nft_expr *expr) {const struct nft_meta *priv =nft_expr_priv (expr);
@@ -600,8 +599,7 @@ static int nft_meta_get_validate(const s }int nft_meta_set_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data) +const struct nft_expr *expr) {struct nft_meta *priv =nft_expr_priv (expr);unsigned int hooks;
net/netfilter/nft_nat.c +1 -2
@@ -136,8 +136,7 @@ static const struct nla_policy nft_nat_p };static int nft_nat_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data) +const struct nft_expr *expr) {struct nft_nat *priv =nft_expr_priv (expr);int err;
net/netfilter/nft_osf.c +1 -2
@@ -117,8 +117,7 @@ nla_put_failure: }static int nft_osf_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data) +const struct nft_expr *expr) {unsigned int hooks;
net/netfilter/nft_queue.c +1 -2
@@ -69,8 +69,7 @@ static void nft_queue_sreg_eval(const st }static int nft_queue_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data) +const struct nft_expr *expr) { static const unsigned int supported_hooks = ((1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_IN) |
net/netfilter/nft_redir.c +1 -2
@@ -26,8 +26,7 @@ static const struct nla_policy nft_redir };static int nft_redir_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data) +const struct nft_expr *expr) {int err;
net/netfilter/nft_reject.c +1 -2
@@ -24,8 +24,7 @@ const struct nla_policy nft_reject_policEXPORT_SYMBOL_GPL (nft_reject_policy);int nft_reject_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data) +const struct nft_expr *expr) { return nft_chain_validate_hooks(ctx->chain, (1 << NF_INET_LOCAL_IN) |
net/netfilter/nft_reject_inet.c +1 -2
@@ -61,8 +61,7 @@ static void nft_reject_inet_eval(const s }static int nft_reject_inet_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data) +const struct nft_expr *expr) { return nft_chain_validate_hooks(ctx->chain, (1 << NF_INET_LOCAL_IN) |
net/netfilter/nft_reject_netdev.c +1 -2
@@ -145,8 +145,7 @@ out: }static int nft_reject_netdev_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data) +const struct nft_expr *expr) {return nft_chain_validate_hooks (ctx->chain, (1 <<NF_NETDEV_INGRESS )); }
net/netfilter/nft_rt.c +1 -2
@@ -160,8 +160,7 @@ nla_put_failure:return -1 ; } -static int nft_rt_validate (const struct nft_ctx *ctx,const struct nft_expr *expr, -const struct nft_data **data) +static int nft_rt_validate (const struct nft_ctx *ctx,const struct nft_expr *expr) {const struct nft_rt *priv =nft_expr_priv (expr);unsigned int hooks;
net/netfilter/nft_socket.c +1 -2
@@ -275,8 +275,7 @@ static bool nft_socket_reduce(struct nft }static int nft_socket_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data) +const struct nft_expr *expr) { if (ctx->family != NFPROTO_IPV4 && ctx->family != NFPROTO_IPV6 &&
net/netfilter/nft_synproxy.c +1 -2
@@ -247,8 +247,7 @@ static void nft_synproxy_eval(const stru }static int nft_synproxy_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data) +const struct nft_expr *expr) { if (ctx->family != NFPROTO_IPV4 && ctx->family != NFPROTO_IPV6 &&
net/netfilter/nft_tproxy.c +1 -2
@@ -313,8 +313,7 @@ static int nft_tproxy_dump(struct sk_buf }static int nft_tproxy_validate (const struct nft_ctx *ctx, -const struct nft_expr *expr, -const struct nft_data **data) +const struct nft_expr *expr) { if (ctx->family != NFPROTO_IPV4 && ctx->family != NFPROTO_IPV6 &&
net/netfilter/nft_xfrm.c +1 -2
@@ -229,8 +229,7 @@ static int nft_xfrm_get_dump(struct sk_breturn 0 ; } -static int nft_xfrm_validate (const struct nft_ctx *ctx,const struct nft_expr *expr, -const struct nft_data **data) +static int nft_xfrm_validate (const struct nft_ctx *ctx,const struct nft_expr *expr) {const struct nft_xfrm *priv =nft_expr_priv (expr);unsigned int hooks;
Greg Kroah-Hartman
maintainerPATCH 117/303 netfilter: bitwise: rename some boolean operation functions
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeremy Sowden <[email protected]>
[ Upstream commit a12143e6084c502fc3cfaa8b717bffc8c14cf806 ]
In the next patch we add support for doing AND, OR and XOR operations directly in the kernel, so rename some functions and an enum constant related to mask-and-xor boolean operations.
Stable-dep-of: d07955dd34ec ("netfilter: nft_fib: reject fib expression on the netdev egress hook")
--- include/uapi/linux/netfilter/nf_tables.h | 10 ++++++--- net/netfilter/nft_bitwise.c | 34 +++++++++++++++---------------- 2 files changed, 24 insertions(+), 20 deletions(-)
include/uapi/linux/netfilter/nf_tables.h +7 -3
@@ -541,16 +541,20 @@ enum nft_immediate_attributes {/** * enum nft_bitwise_ops - nf_tables bitwise operations * -* @NFT_BITWISE_BOOL: mask-and-xor operation used to implement NOT, AND, OR and -* XOR boolean operations +* @NFT_BITWISE_MASK_XOR: mask-and-xor operation used to implement NOT, AND, OR +* and XOR boolean operations * @NFT_BITWISE_LSHIFT: left-shift operation * @NFT_BITWISE_RSHIFT: right-shift operation */ enum nft_bitwise_ops { -NFT_BITWISE_BOOL , +NFT_BITWISE_MASK_XOR ,NFT_BITWISE_LSHIFT ,NFT_BITWISE_RSHIFT , }; +/* +* Old name for NFT_BITWISE_MASK_XOR. Retained for backwards-compatibility. +*/ +#define NFT_BITWISE_BOOL NFT_BITWISE_MASK_XOR/** * enum nft_bitwise_attributes - nf_tables bitwise expression netlink attributes
net/netfilter/nft_bitwise.c +17 -17
@@ -25,8 +25,8 @@ struct nft_bitwise {struct nft_data data; }; -static void nft_bitwise_eval_bool (u32 *dst,const u32 *src, -const struct nft_bitwise *priv) +static void nft_bitwise_eval_mask_xor (u32 *dst,const u32 *src, +const struct nft_bitwise *priv) {unsigned int i;
@@ -68,8 +68,8 @@ void nft_bitwise_eval(const struct nft_eu32 *dst = ®s->data[priv->dreg];switch (priv->op) { -case NFT_BITWISE_BOOL : -nft_bitwise_eval_bool (dst, src, priv); +case NFT_BITWISE_MASK_XOR : +nft_bitwise_eval_mask_xor (dst, src, priv);break ;case NFT_BITWISE_LSHIFT :nft_bitwise_eval_lshift (dst, src, priv);
@@ -90,8 +90,8 @@ static const struct nla_policy nft_bitwi [NFTA_BITWISE_DATA] = { .type = NLA_NESTED }, }; -static int nft_bitwise_init_bool (struct nft_bitwise *priv, -const struct nlattr *const tb[]) +static int nft_bitwise_init_mask_xor (struct nft_bitwise *priv, +const struct nlattr *const tb[]) {struct nft_data_desc mask = { .type =NFT_DATA_VALUE ,
@@ -186,7 +186,7 @@ static int nft_bitwise_init(const structif (tb[NFTA_BITWISE_OP ]) { priv->op =ntohl (nla_get_be32 (tb[NFTA_BITWISE_OP ]));switch (priv->op) { -case NFT_BITWISE_BOOL : +case NFT_BITWISE_MASK_XOR :case NFT_BITWISE_LSHIFT :case NFT_BITWISE_RSHIFT :break ;
@@ -194,12 +194,12 @@ static int nft_bitwise_init(const structreturn -EOPNOTSUPP ; } }else { - priv->op =NFT_BITWISE_BOOL ; + priv->op =NFT_BITWISE_MASK_XOR ; }switch (priv->op) { -case NFT_BITWISE_BOOL : - err =nft_bitwise_init_bool (priv, tb); +case NFT_BITWISE_MASK_XOR : + err =nft_bitwise_init_mask_xor (priv, tb);break ;case NFT_BITWISE_LSHIFT :case NFT_BITWISE_RSHIFT :
@@ -210,8 +210,8 @@ static int nft_bitwise_init(const structreturn err; } -static int nft_bitwise_dump_bool (struct sk_buff *skb, -const struct nft_bitwise *priv) +static int nft_bitwise_dump_mask_xor (struct sk_buff *skb, +const struct nft_bitwise *priv) {if (nft_data_dump (skb,NFTA_BITWISE_MASK , &priv->mask,NFT_DATA_VALUE , priv->len) <0 )
@@ -248,8 +248,8 @@ static int nft_bitwise_dump(struct sk_bureturn -1 ;switch (priv->op) { -case NFT_BITWISE_BOOL : - err =nft_bitwise_dump_bool (skb, priv); +case NFT_BITWISE_MASK_XOR : + err =nft_bitwise_dump_mask_xor (skb, priv);break ;case NFT_BITWISE_LSHIFT :case NFT_BITWISE_RSHIFT :
@@ -269,7 +269,7 @@ static int nft_bitwise_offload(struct nfconst struct nft_bitwise *priv =nft_expr_priv (expr);struct nft_offload_reg *reg = &ctx->regs[priv->dreg]; -if (priv->op !=NFT_BITWISE_BOOL ) +if (priv->op !=NFT_BITWISE_MASK_XOR )return -EOPNOTSUPP ; if (memcmp(&priv->xor, &zero, sizeof(priv->xor)) ||
@@ -405,7 +405,7 @@ nft_bitwise_fast_dump(struct sk_buff *skreturn -1 ;if (nla_put_be32 (skb,NFTA_BITWISE_LEN ,htonl (sizeof (u32))))return -1 ; -if (nla_put_be32 (skb,NFTA_BITWISE_OP ,htonl (NFT_BITWISE_BOOL ))) +if (nla_put_be32 (skb,NFTA_BITWISE_OP ,htonl (NFT_BITWISE_MASK_XOR )))return -1 ; data.data[0 ] = priv->mask;
@@ -500,7 +500,7 @@ nft_bitwise_select_ops(const struct nft_return &nft_bitwise_ops;if (tb[NFTA_BITWISE_OP ] && -ntohl (nla_get_be32 (tb[NFTA_BITWISE_OP ])) !=NFT_BITWISE_BOOL ) +ntohl (nla_get_be32 (tb[NFTA_BITWISE_OP ])) !=NFT_BITWISE_MASK_XOR )return &nft_bitwise_ops;return &nft_bitwise_fast_ops;
Greg Kroah-Hartman
maintainerPATCH 118/303 netfilter: nf_tables: Remove unused nft_reduce_is_readonly()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yue Haibing <[email protected]>
[ Upstream commit bf6788742b8d6c73de441e088a71de7154f0d4aa ]
Since commit 9e539c5b6d9c ("netfilter: nf_tables: disable expression reduction infra") this is unused.
Stable-dep-of: d07955dd34ec ("netfilter: nft_fib: reject fib expression on the netdev egress hook")
--- include/net/netfilter/nf_tables.h | 5 ----- 1 file changed, 5 deletions(-)
include/net/netfilter/nf_tables.h +0 -5
@@ -1773,11 +1773,6 @@ static inline u64 nft_net_tstamp(const s#define __NFT_REDUCE_READONLY 1UL#define NFT_REDUCE_READONLY (void *)__NFT_REDUCE_READONLY -static inline bool nft_reduce_is_readonly (const struct nft_expr *expr) -{ -return expr->ops->reduce ==NFT_REDUCE_READONLY ; -} -void nft_reg_track_update (struct nft_regs_track *track,const struct nft_expr *expr,u8 dreg,u8 len);void nft_reg_track_cancel (struct nft_regs_track *track,u8 dreg,u8 len);