6.1.184-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainerPATCH 217/303 ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chancel Liu <[email protected]>
[ Upstream commit d091132889c1378dd0944a72f86eae3e4da1e4fa ]
When the BCLK divider ratio is 1:1, fsl_sai_set_bclk() enables bypass mode by setting BYP, but never clears the bit. The BYP=1 value remains in the regcache, and is restored by regcache_sync() on the next runtime resume.
Since BYP=1 combined with BCD=1 immediately outputs the ungated MCLK as BCLK without waiting for BCE/TE/RE to be enabled, the clock is driven prematurely before the stream is fully configured, causing noise on some codecs.
Fix this by clearing BYP and BCI in fsl_sai_hw_free() taking into account sync mode and the opposite stream's state, so that the regcache holds BYP=0 before runtime suspend and regcache_sync() on resume will not restore bypass mode prematurely.
--- sound/soc/fsl/fsl_sai.c | 29 +++++++++++++++++++++++++---- 1 file changed, 25 insertions(+), 4 deletions(-)
sound/soc/fsl/fsl_sai.c +25 -4
@@ -716,6 +716,8 @@ static int fsl_sai_hw_free(struct snd_pcstruct fsl_sai *sai =snd_soc_dai_get_drvdata (cpu_dai);bool tx = substream->stream ==SNDRV_PCM_STREAM_PLAYBACK ;unsigned int ofs = sai->soc_data->reg_offset; +int adir = tx ?RX :TX ; +int dir = tx ?TX :RX ;/* Clear xMR to avoid channel swap with mclk_with_tere enabled case */ regmap_write (sai->regmap,FSL_SAI_xMR (tx),0 );
@@ -723,10 +725,29 @@ static int fsl_sai_hw_free(struct snd_pcregmap_update_bits (sai->regmap,FSL_SAI_xCR3 (tx, ofs),FSL_SAI_CR3_TRCE_MASK ,0 ); -if (!sai->is_consumer_mode && - sai->mclk_streams &BIT (substream->stream)) { -clk_disable_unprepare (sai->mclk_clk[sai->mclk_id[tx]]); - sai->mclk_streams &= ~BIT (substream->stream); +if (!sai->is_consumer_mode) { +bool adir_active = !!(sai->mclk_streams &BIT (!substream->stream)); +/* +* If opposite stream provides clocks for synchronous mode and +* it is inactive, Clear BYP and BCI +*/ +if (fsl_sai_dir_is_synced (sai, adir) && !adir_active) +regmap_update_bits (sai->regmap,FSL_SAI_xCR2 (!tx, ofs), +FSL_SAI_CR2_BCI |FSL_SAI_CR2_BYP ,0 ); +/* +* Clear BYP and BCI of current stream if either of: +* 1. current stream doesn't provide clocks for synchronous mode +* 2. current stream provides clocks for synchronous mode but no +* more stream is active. +*/ +if (!fsl_sai_dir_is_synced (sai, dir) || !adir_active) +regmap_update_bits (sai->regmap,FSL_SAI_xCR2 (tx, ofs), +FSL_SAI_CR2_BCI |FSL_SAI_CR2_BYP ,0 ); + +if (sai->mclk_streams &BIT (substream->stream)) { +clk_disable_unprepare (sai->mclk_clk[sai->mclk_id[tx]]); + sai->mclk_streams &= ~BIT (substream->stream); + } }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 218/303 libceph: fix two unsafe bare decodes in decode_lockers()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavitra Jha <[email protected]>
[ Upstream commit a109a556115271ca7896dcda7b4b7e45e156c227 ]
decode_lockers() in cls_lock_client.c contains two bare decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads:
1. ceph_decode_32(p) at the num_lockers field has no preceding bounds check. ceph_start_decoding() accepts struct_len=0 as valid -- the internal ceph_decode_need(p, end, 0, bad) always passes -- so when an OSD sends struct_len=0, ceph_start_decoding() returns success with p == end. The immediately following bare ceph_decode_32(p) then reads 4 bytes past the validated buffer boundary. The garbage value is passed directly to kzalloc_objs() as the locker count.
The sibling function decode_watchers() in osd_client.c already uses ceph_decode_32_safe() after its own ceph_start_decoding() call. decode_lockers() was the only site using the bare variant.
2. ceph_decode_8(p) after the decode_locker() loop has no preceding bounds check. If an OSD crafts num_lockers such that the loop advances p exactly to end, the subsequent bare ceph_decode_8(p) reads one byte past the validated buffer boundary. The result is passed directly into *type, which is used as a lock type discriminator by callers, giving an OSD-controlled one-byte OOB read with direct influence over the lock type field.
Fix both by replacing bare operations with their safe variants:
ceph_decode_32(p) -> ceph_decode_32_safe(p, end, *num_lockers,
err_inval)
ceph_decode_8(p) -> ceph_decode_8_safe(p, end, *type,
err_free_lockers)
The goto targets differ intentionally:
err_inval: is a new label returning -EINVAL directly. It is used for the pre-allocation failure path where *lockers is not yet allocated and must not be passed to ceph_free_lockers().
err_free_lockers: is the existing label. It is used for the post-allocation failure path where *lockers is allocated and must be freed.
ret is set to -EINVAL before ceph_decode_8_safe() so that err_free_lockers returns the correct error code on bounds violation. Without this, err_free_lockers would return a stale ret value (0 from the successful decode_locker() loop), silently swallowing the error.
-EINVAL is correct for both failure paths. The data received from the OSD is structurally malformed. -ENOMEM would misrepresent the failure class to callers and to stable@ backporters triaging error paths.
Attacker model: a malicious or compromised OSD in a multi-tenant Ceph deployment can trigger this against any kernel client that issues the lock.get_info class method (e.g. during RBD exclusive lock acquisition).
[ idryomov: trim changelog, formatting ]
--- net/ceph/cls_lock_client.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
net/ceph/cls_lock_client.c +6 -2
@@ -304,7 +304,7 @@ static int decode_lockers(void **p, voidif (ret)return ret; - *num_lockers =ceph_decode_32 (p); +ceph_decode_32_safe (p, end, *num_lockers, err_inval); *lockers =kcalloc (*num_lockers,sizeof (**lockers),GFP_NOIO );if (!*lockers)return -ENOMEM ;
@@ -315,7 +315,8 @@ static int decode_lockers(void **p, void goto err_free_lockers; } - *type =ceph_decode_8 (p); + ret = -EINVAL ; +ceph_decode_8_safe (p, end, *type, err_free_lockers); s =ceph_extract_encoded_string (p, end,NULL ,GFP_NOIO );if (IS_ERR (s)) { ret =PTR_ERR (s);
@@ -325,6 +326,9 @@ static int decode_lockers(void **p, void *tag = s;return 0 ; +err_inval: +return -EINVAL ; + err_free_lockers:ceph_free_lockers (*lockers, *num_lockers);return ret;
Greg Kroah-Hartman
maintainerPATCH 219/303 net: move skb_gro_receive_list from udp to core
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
[ Upstream commit 8928756d53d5b99dcd18073dc7738b8ebdbe7d96 ]
This helper function will be used for TCP fraglist GRO support
Stable-dep-of: e751256486d0 ("net: gro: fix double aggregation of flush-marked skbs")
--- include/net/gro.h | 1 + net/core/gro.c | 29 +++++++++++++++++++++++++++++ net/ipv4/udp_offload.c | 29 ----------------------------- 3 files changed, 30 insertions(+), 29 deletions(-)
include/net/gro.h +1 -0
@@ -424,6 +424,7 @@ static inline __wsum ip6_gro_compute_pse }int skb_gro_receive (struct sk_buff *p,struct sk_buff *skb); +int skb_gro_receive_list (struct sk_buff *p,struct sk_buff *skb);/* Pass the currently batched GRO_NORMAL SKBs up to the stack. */ static inline void gro_normal_list (struct napi_struct *napi)
net/core/gro.c +29 -0
@@ -295,6 +295,35 @@ done:return 0 ; } +int skb_gro_receive_list (struct sk_buff *p,struct sk_buff *skb) +{ +if (unlikely (p->len + skb->len >=65536 )) +return -E2BIG ; + +if (NAPI_GRO_CB (p)->last == p) +skb_shinfo (p)->frag_list = skb; +else +NAPI_GRO_CB (p)->last->next = skb; + +skb_pull (skb,skb_gro_offset (skb)); + +NAPI_GRO_CB (p)->last = skb; +NAPI_GRO_CB (p)->count++; + p->data_len += skb->len; + +/* sk ownership - if any - completely transferred to the aggregated packet */ + skb->destructor =NULL ; + skb->sk =NULL ; + p->truesize += skb->truesize; + p->len += skb->len; + +skb_shinfo (p)->flags |=skb_shinfo (skb)->flags &SKBFL_SHARED_FRAG ; + +NAPI_GRO_CB (skb)->same_flow =1 ; + +return 0 ; +} +static void napi_gro_complete (struct napi_struct *napi,struct sk_buff *skb) {
net/ipv4/udp_offload.c +0 -29
@@ -526,35 +526,6 @@ out:return segs; } -static int skb_gro_receive_list (struct sk_buff *p,struct sk_buff *skb) -{ -if (unlikely (p->len + skb->len >=65536 )) -return -E2BIG ; - -if (NAPI_GRO_CB (p)->last == p) -skb_shinfo (p)->frag_list = skb; -else -NAPI_GRO_CB (p)->last->next = skb; - -skb_pull (skb,skb_gro_offset (skb)); - -NAPI_GRO_CB (p)->last = skb; -NAPI_GRO_CB (p)->count++; - p->data_len += skb->len; - -/* sk ownership - if any - completely transferred to the aggregated packet */ - skb->destructor =NULL ; - skb->sk =NULL ; - p->truesize += skb->truesize; - p->len += skb->len; - -skb_shinfo (p)->flags |=skb_shinfo (skb)->flags &SKBFL_SHARED_FRAG ; - -NAPI_GRO_CB (skb)->same_flow =1 ; - -return 0 ; -} -#define UDP_GRO_CNT_MAX 64 static struct sk_buff *udp_gro_receive_segment(struct list_head *head,
Greg Kroah-Hartman
maintainerPATCH 220/303 net: gro: fix double aggregation of flush-marked skbs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shiming Cheng <[email protected]>
[ Upstream commit e751256486d0ded20f5a9f9863467f1dce65142f ]
Commit 0ab03f353d36 ("net-gro: Fix GRO flush when receiving a GSO packet.") added a flush check to skb_gro_receive(), but skb_gro_receive_list() lacks the same validation.
As a result, packets marked with NAPI_GRO_CB(skb)->flush may still be re-aggregated.
This allows already-GRO'd packets with existing frag_list to be re-aggregated into a new GRO session, corrupting the frag_list chain structure. When skb_segment() attempts to unpack these malformed packets, it encounters invalid state and triggers a kernel panic.
Scenario (Tethering/Device forwarding):
1. Driver: Generated aggregated packet P1 via LRO with frag_list
2. Dev A: Receives aggregated fraglist packet and flush flag set
3. Dev A: Re-enters GRO, skb_gro_receive_list() is called
4. Missing flush check allows re-aggregation despite flush flag
5. Frag_list chain becomes corrupted (loops or dangling refs)
6. Dev B: TX path calls skb_segment(), crashes on corrupted frag_list
Root cause in skb_segment():
The check at line ~4891:
if (hsize <= 0 && i >= nfrags && skb_headlen(list_skb) &&
(skb_headlen(list_skb) == len || sg)) { When frag_list is corrupted by double aggregation, when list_skb is a NULL pointer from skb->next, skb_headlen(list_skb) dereference NULL/corrupted pointers occurs.
Call Trace: skb_headlen(NULL skb) skb_segment tcp_gso_segment tcp4_gso_segment inet_gso_segment skb_mac_gso_segment __skb_gso_segment skb_gso_segment validate_xmit_skb validate_xmit_skb_list sch_direct_xmit qdisc_restart __qdisc_run qdisc_run net_tx_action
Fix: Add NAPI_GRO_CB(skb)->flush validation to the early-return check in skb_gro_receive_list(), matching the defensive programming pattern of skb_gro_receive().
--- net/core/gro.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/core/gro.c +3 -1
@@ -297,7 +297,9 @@ done:int skb_gro_receive_list (struct sk_buff *p,struct sk_buff *skb) { -if (unlikely (p->len + skb->len >=65536 )) +/* make sure to check flush flag and to not merge */ +if (unlikely (p->len + skb->len >=65536 || +NAPI_GRO_CB (skb)->flush))return -E2BIG ;if (NAPI_GRO_CB (p)->last == p)
Greg Kroah-Hartman
maintainerPATCH 221/303 net/sched: serialize qdisc_rtab_list against concurrent get/put
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aldo Ariel Panzardo <[email protected]>
[ Upstream commit f43ee0c0730d6191629b5ee1ceae27b1ebfdc047 ]
qdisc_get_rtab() and qdisc_put_rtab() mutate the process-global singly linked list qdisc_rtab_list and a plain non-atomic 'int refcnt' with no lock. This was only safe because every caller historically held the RTNL mutex, which serialized all rate-table lookups, inserts and frees.
That invariant no longer holds. cls_flower sets TCF_PROTO_OPS_DOIT_UNLOCKED, so tc_new_tfilter() keeps rtnl_held == false for it and sets TCA_ACT_FLAGS_NO_RTNL. That flag propagates through tcf_exts_validate_ex() -> tcf_action_init() -> tcf_action_init_1() -> tcf_police_init(), which calls qdisc_get_rtab()/qdisc_put_rtab() with the RTNL mutex NOT held. Two RTM_NEWTFILTER requests on different CPUs, each adding a flower filter with a police action carrying the same rate, then race on qdisc_rtab_list and on the non-atomic refcnt, leading to a use-after-free / double-free of the kmalloc-2k struct qdisc_rate_table. qdisc_rtab_list is a single global (not per-netns), so the corrupted object is shared system-wide.
BUG: KASAN: slab-use-after-free in qdisc_put_rtab+0x12f/0x160 qdisc_put_rtab+0x12f/0x160 tcf_police_init+0xda9/0x1590 tcf_action_init_1+0x460/0x6b0 tcf_action_init+0x439/0xa40 tcf_exts_validate_ex+0x42d/0x550 fl_change+0xddd/0x7da0 tc_new_tfilter+0xaa7/0x2420 rtnetlink_rcv_msg+0x95e/0xe90 which belongs to the cache kmalloc-2k of size 2048
Protect qdisc_rtab_list and the refcount with a dedicated spinlock. The (sleeping, GFP_KERNEL) allocation in qdisc_get_rtab() is performed before taking the lock; if a concurrent inserter added an identical table in the meantime the freshly allocated one is freed under the lock, so no duplicate is leaked. qdisc_put_rtab() now decrements the refcount and unlinks under the same lock.
--- net/sched/sch_api.c | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-)
net/sched/sch_api.c +19 -5
@@ -412,12 +412,13 @@ static __u8 __detect_linklayer(struct tc }static struct qdisc_rate_table *qdisc_rtab_list; +static DEFINE_SPINLOCK (qdisc_rtab_lock);struct qdisc_rate_table *qdisc_get_rtab (struct tc_ratespec *r,struct nlattr *tab,struct netlink_ext_ack *extack) { -struct qdisc_rate_table *rtab; +struct qdisc_rate_table *rtab, *new_rtab; if (tab == NULL || r->rate == 0 || r->cell_log == 0 || r->cell_log >= 32 ||
@@ -426,15 +427,20 @@ struct qdisc_rate_table *qdisc_get_rtab(return NULL ; } + new_rtab =kmalloc (sizeof (*new_rtab),GFP_KERNEL ); + +spin_lock (&qdisc_rtab_lock);for (rtab = qdisc_rtab_list; rtab; rtab = rtab->next) {if (!memcmp (&rtab->rate, r,sizeof (struct tc_ratespec )) && !memcmp (&rtab->data,nla_data (tab),1024 )) { rtab->refcnt++; +spin_unlock (&qdisc_rtab_lock); +kfree (new_rtab);return rtab; } } - rtab =kmalloc (sizeof (*rtab),GFP_KERNEL ); + rtab = new_rtab;if (rtab) { rtab->rate = *r; rtab->refcnt =1 ;
@@ -446,6 +452,7 @@ struct qdisc_rate_table *qdisc_get_rtab( }else {NL_SET_ERR_MSG (extack,"Failed to allocate new qdisc rate table" ); } +spin_unlock (&qdisc_rtab_lock);return rtab; }EXPORT_SYMBOL (qdisc_get_rtab);
@@ -454,18 +461,25 @@ void qdisc_put_rtab(struct qdisc_rate_ta {struct qdisc_rate_table *rtab, **rtabp; -if (!tab || --tab->refcnt) +if (!tab) +return ; + +spin_lock (&qdisc_rtab_lock); +if (--tab->refcnt) { +spin_unlock (&qdisc_rtab_lock);return ; + }for (rtabp = &qdisc_rtab_list; (rtab = *rtabp) !=NULL ; rtabp = &rtab->next) {if (rtab == tab) { *rtabp = rtab->next; -kfree (rtab); -return ; +break ; } } +spin_unlock (&qdisc_rtab_lock); +kfree (tab); }EXPORT_SYMBOL (qdisc_put_rtab);
Greg Kroah-Hartman
maintainerPATCH 222/303 ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ferry Meng <[email protected]>
[ Upstream commit af92ee994cc7f7e83a41c2025f32257a2f82a7ef ]
Commit 299f962c0b02 ("ksmbd: use check_add_overflow() to prevent u16 DACL size overflow") added check_add_overflow() guards that break out of the ACE-building loops in set_posix_acl_entries_dacl() when the accumulated DACL size would wrap past 65535.
However, each iteration allocates a struct smb_sid via kmalloc_obj() at the top of the loop and relies on the kfree(sid) call at the end of the loop body (the 'pass_same_sid' label in the first loop, and the explicit kfree at the tail of the second loop) to release it. The newly introduced 'break' statements bypass those kfree() calls, leaking the sid buffer every time an overflow is detected.
A malicious or malformed file with enough POSIX ACL entries to trip the overflow check will leak one or more struct smb_sid allocations on every request that touches the file's DACL, providing a trivial kernel memory exhaustion vector.
Free sid before breaking out of the loops to plug the leak.
Stable-dep-of: bbf0a8e93120 ("ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL")
--- fs/smb/server/smbacl.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
fs/smb/server/smbacl.c +9 -3
@@ -643,8 +643,10 @@ static void set_posix_acl_entries_dacl(s ntace = (struct smb_ace *)((char *)pndace + *size); ace_sz =fill_ace_for_sid (ntace, sid,ACCESS_ALLOWED , flags, pace->e_perm,0777 ); -if (check_add_overflow (*size, ace_sz, size)) +if (check_add_overflow (*size, ace_sz, size)) { +kfree (sid);break ; + } (*num_aces)++;if (pace->e_tag ==ACL_USER ) ntace->access_req |=
@@ -655,8 +657,10 @@ static void set_posix_acl_entries_dacl(s ntace = (struct smb_ace *)((char *)pndace + *size); ace_sz =fill_ace_for_sid (ntace, sid,ACCESS_ALLOWED ,0x03 , pace->e_perm,0777 ); -if (check_add_overflow (*size, ace_sz, size)) +if (check_add_overflow (*size, ace_sz, size)) { +kfree (sid);break ; + } (*num_aces)++;if (pace->e_tag ==ACL_USER ) ntace->access_req |=
@@ -698,8 +702,10 @@ posix_default_acl: ntace = (struct smb_ace *)((char *)pndace + *size); ace_sz =fill_ace_for_sid (ntace, sid,ACCESS_ALLOWED ,0x0b , pace->e_perm,0777 ); -if (check_add_overflow (*size, ace_sz, size)) +if (check_add_overflow (*size, ace_sz, size)) { +kfree (sid);break ; + } (*num_aces)++;if (pace->e_tag ==ACL_USER ) ntace->access_req |=
Greg Kroah-Hartman
maintainerPATCH 223/303 ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haofeng Li <[email protected]>
[ Upstream commit 47f0b34f6bc98ed85bfdc293e8f3e432ec24958d ]
set_ntacl_dacl() copies each ACE from the attacker-controlled stored security descriptor verbatim into the response DACL without checking sid.num_subauth. The ACE bytes (including an unchecked num_subauth) originate from an authenticated SMB2_SET_INFO(SecInfo=DACL) that is stored raw via ksmbd_vfs_set_sd_xattr(); parse_dacl() rejects a bad ACE with break rather than an error, so parse_sec_desc() still returns success and the malformed SD reaches the xattr intact.
On a subsequent SMB2_QUERY_INFO(SecInfo=DACL) for an inode carrying a POSIX access ACL, build_sec_desc() -> set_ntacl_dacl() -> set_posix_acl_entries_dacl() walks the copied ACEs and reads
ntace->sid.sub_auth[ntace->sid.num_subauth - 1]
with num_subauth taken straight from the stored SD. Since sub_auth[] is fixed at SID_MAX_SUB_AUTHORITIES (15), a crafted num_subauth (e.g.
255) drives an out-of-bounds heap read of ~1 KB with an offset fully controlled by an authenticated client.
The sibling functions already gate this field:
parse_dacl() -- num_subauth == 0 || > SID_MAX_SUB_AUTHORITIES parse_sid() -- num_subauth > SID_MAX_SUB_AUTHORITIES smb_copy_sid() -- min_t(u8, num_subauth, SID_MAX_SUB_AUTHORITIES)
set_ntacl_dacl() is the lone inconsistent path that omits the check.
Add the same num_subauth validation in set_ntacl_dacl() before copying the ACE, matching the gate already enforced by parse_dacl().
Stable-dep-of: bbf0a8e93120 ("ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL")
--- fs/smb/server/smbacl.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
fs/smb/server/smbacl.c +7 -1
@@ -740,12 +740,18 @@ static void set_ntacl_dacl(struct user_nif (nt_ace_size > aces_size)break ; +if (ntace->sid.num_subauth ==0 || + ntace->sid.num_subauth >SID_MAX_SUB_AUTHORITIES ) + goto next_ace; +memcpy ((char *)pndace + size, ntace, nt_ace_size);if (check_add_overflow (size, nt_ace_size, &size))break ; + num_aces++; + +next_ace: aces_size -= nt_ace_size; ntace = (struct smb_ace *)((char *)ntace + nt_ace_size); - num_aces++; } }
Greg Kroah-Hartman
maintainerPATCH 224/303 ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Guan <[email protected]>
[ Upstream commit bbf0a8e931204ecdab494a88d43b0a24a04285c5 ]
check_add_overflow() unconditionally writes the truncated sum into *d even on overflow, per its contract in include/linux/overflow.h. The four check_add_overflow() guards in set_posix_acl_entries_dacl() and set_ntacl_dacl() break out of the ACE-building loops on overflow, but the truncated *size is then consumed downstream at the end of set_ntacl_dacl():
pndacl->size = cpu_to_le16(le16_to_cpu(pndacl->size) + size);
This produces an on-wire NT ACL whose pndacl->size under-reports the bytes actually written by the preceding fill_ace_for_sid()/memcpy() calls, yielding a malformed ACL that can trigger out-of-bounds reads when re-parsed by clients or ksmbd itself.
Restore *size to its pre-addition value on each overflow branch (via *size -= ace_sz / size -= nt_ace_size) so that after the break, *size once again holds the cumulative size of the successfully-written ACEs. The committed ACL is then truncated-but-self-consistent rather than malformed.
The ksmbd DACL builders are the only check_add_overflow() sites found where an overflow path breaks out of a loop and the destination value is consumed afterward. The other nearby break-style cases either return -EINVAL on overflow (transport_ipc.c) or break without consuming the overflowed destination value afterward (buildid.c).
--- fs/smb/server/smbacl.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
fs/smb/server/smbacl.c +6 -1
@@ -644,6 +644,7 @@ static void set_posix_acl_entries_dacl(s ace_sz =fill_ace_for_sid (ntace, sid,ACCESS_ALLOWED , flags, pace->e_perm,0777 );if (check_add_overflow (*size, ace_sz, size)) { + *size -= ace_sz;kfree (sid);break ; }
@@ -658,6 +659,7 @@ static void set_posix_acl_entries_dacl(s ace_sz =fill_ace_for_sid (ntace, sid,ACCESS_ALLOWED ,0x03 , pace->e_perm,0777 );if (check_add_overflow (*size, ace_sz, size)) { + *size -= ace_sz;kfree (sid);break ; }
@@ -703,6 +705,7 @@ posix_default_acl: ace_sz =fill_ace_for_sid (ntace, sid,ACCESS_ALLOWED ,0x0b , pace->e_perm,0777 );if (check_add_overflow (*size, ace_sz, size)) { + *size -= ace_sz;kfree (sid);break ; }
@@ -745,8 +748,10 @@ static void set_ntacl_dacl(struct user_n goto next_ace;memcpy ((char *)pndace + size, ntace, nt_ace_size); -if (check_add_overflow (size, nt_ace_size, &size)) +if (check_add_overflow (size, nt_ace_size, &size)) { + size -= nt_ace_size;break ; + } num_aces++; next_ace:
Greg Kroah-Hartman
maintainerPATCH 225/303 super: fix emergency thaw deadlock on frozen block devices
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Brauner <[email protected]>
[ Upstream commit 749d7aa0377aae32af8c0a4ad43371e7bf830ab5 ]
do_thaw_all_callback() calls bdev_thaw() while holding sb->s_umount exclusively. If the block device was frozen via bdev_freeze() dropping the last block layer freeze reference calls fs_bdev_thaw() which reacquires s_umount:
do_thaw_all_callback(sb)
super_lock_excl(sb) # holds sb->s_umount
bdev_thaw(sb->s_bdev)
mutex_lock(&bdev->bd_fsfreeze_mutex)
# bd_fsfreeze_count drops 1 -> 0
bd_holder_ops->thaw == fs_bdev_thaw
get_bdev_super(bdev)
bdev_super_lock(bdev, true)
super_lock(sb, true)
down_write(&sb->s_umount) # same task: deadlockThe emergency thaw worker deadlocks against itself holding both s_umount and bd_fsfreeze_mutex. That fscks any subsequent unmount, freeze, or thaw of that filesystem and block device.
[ 81.878470] sysrq: Show Blocked State [ 81.880140] task:kworker/0:1 state:D stack:0 pid:11 tgid:11 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 81.884876] Workqueue: events do_thaw_all [ 81.886656] Call Trace: [ 81.887759] <TASK> [ 81.888763] __schedule+0x579/0x1420 [ 81.890372] schedule+0x3a/0x100 [ 81.891794] schedule_preempt_disabled+0x15/0x30 [ 81.893848] rwsem_down_write_slowpath+0x1ea/0x900 [ 81.895191] ? __pfx_do_thaw_all_callback+0x10/0x10 [ 81.896528] down_write+0xbd/0xc0 [ 81.897505] super_lock+0x91/0x180 [ 81.898457] ? __mutex_lock+0xa99/0x1140 [ 81.900748] ? __mutex_unlock_slowpath+0x1f/0x400 [ 81.902069] bdev_super_lock+0x5b/0x150 [ 81.903132] get_bdev_super+0x10/0x60 [ 81.904042] fs_bdev_thaw+0x23/0xf0 [ 81.904755] bdev_thaw+0x82/0x100 [ 81.905484] do_thaw_all_callback+0x2c/0x50 [ 81.906298] __iterate_supers+0x5d/0x130 [ 81.907067] do_thaw_all+0x20/0x40 [ 81.907739] process_one_work+0x206/0x5e0 [ 81.908545] worker_thread+0x1e2/0x3c0 [ 81.909339] ? __pfx_worker_thread+0x10/0x10 [ 81.910171] kthread+0xf4/0x130 [ 81.910799] ? __pfx_kthread+0x10/0x10 [ 81.911528] ret_from_fork+0x2e2/0x3b0 [ 81.912259] ? __pfx_kthread+0x10/0x10 [ 81.913010] ret_from_fork_asm+0x1a/0x30 [ 81.913806] </TASK>
bdev_super_lock() even documents the violated requirement with lockdep_assert_not_held(&sb->s_umount).
Acquiring bd_fsfreeze_mutex under s_umount also inverts the bd_fsfreeze_mutex vs. s_umount ordering established by bdev_{freeze,thaw}() and can thus ABBA against a concurrent block-layer freeze even when the recursive path isn't hit.
Fix this by not holding s_umount around the bdev_thaw() loop at all. Pin the superblock with an active reference instead as filesystems_freeze_callback() does. The active reference keeps the superblock from being shut down and so ->s_bdev stays valid without holding s_umount. The block-layer-held freeze is dropped by fs_bdev_thaw() with FREEZE_MAY_NEST | FREEZE_HOLDER_USERSPACE exactly as a regular unfreeze would and thaw_super_locked() handles filesystem-level freezes as before.
The emergency thaw path has deadlocked like this in one form or another for a long long time but the current exclusively-held shape dates back to commit [1] where thaw_bdev() already ended in thaw_super() with s_umount held by do_thaw_all_callback().
--- fs/super.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-)
fs/super.c +15 -4
@@ -1045,13 +1045,24 @@ void emergency_remount(void)static void do_thaw_all_callback (struct super_block *sb) { +bool active = false; + +down_write (&sb->s_umount); +if (sb->s_root && sb->s_flags &SB_BORN ) + active =atomic_inc_not_zero (&sb->s_active); +up_write (&sb->s_umount); +if (!active) +return ; + +/* thaw_bdev() acquires s_umount so it must not be held here */ +emergency_thaw_bdev (sb); +down_write (&sb->s_umount); -if (sb->s_root && sb->s_flags &SB_BORN ) { -emergency_thaw_bdev (sb); +if (sb->s_root && sb->s_flags &SB_BORN )thaw_super_locked (sb); - }else { +else up_write (&sb->s_umount); - } +deactivate_super (sb); }static void do_thaw_all (struct work_struct *work)
Greg Kroah-Hartman
maintainerPATCH 226/303 smb/server: rename include guard in smb_common.h
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: ChenXiaoSong <[email protected]>
[ Upstream commit 01ab0d1640e379f0a0d6602250b33ff2b45e9560 ]
Make the include guard more descriptive to avoid conflicts with include guards that may be used in the future.
Stable-dep-of: cfc0b8e5080a ("ksmbd: validate minimum PDU size for transform requests")
--- fs/smb/server/smb_common.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/smb/server/smb_common.h +3 -3
@@ -3,8 +3,8 @@* Copyright (C) 2018 Samsung Electronics Co., Ltd. */ -#ifndef __SMB_COMMON_H__ -#define __SMB_COMMON_H__ +#ifndef __SMB_SERVER_COMMON_H__ +#define __SMB_SERVER_COMMON_H__#include <linux/kernel.h>
@@ -426,4 +426,4 @@ static inline unsigned int get_rfc1002_l {return be32_to_cpu (*((__be32 *)buf)) &0xffffff ; } -#endif /* __SMB_COMMON_H__ */ +#endif /* __SMB_SERVER_COMMON_H__ */
Greg Kroah-Hartman
maintainerPATCH 227/303 ksmbd: rename smb2_get_msg to smb_get_msg
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
[ Upstream commit 0b444cfd8b74ebce421ccd96eac9c495e536c92e ]
With the removal of the RFC1002 length field from the SMB header, smb2_get_msg is now used to get the smb1 request from the request buffer. Since this function is no longer exclusive to smb2 and now supports smb1 as well, This patch rename it to smb_get_msg to better reflect its usage.
Stable-dep-of: cfc0b8e5080a ("ksmbd: validate minimum PDU size for transform requests")
--- fs/smb/server/auth.c | 4 +- fs/smb/server/connection.c | 2 - fs/smb/server/oplock.c | 8 ++--- fs/smb/server/smb2pdu.c | 70 ++++++++++++++++++++++----------------------- fs/smb/server/smb2pdu.h | 9 ----- fs/smb/server/smb_common.c | 6 +-- fs/smb/server/smb_common.h | 9 +++++ 7 files changed, 54 insertions(+), 54 deletions(-)
fs/smb/server/auth.c +2 -2
@@ -914,7 +914,7 @@ int ksmbd_gen_preauth_integrity_hash(str __u8 *pi_hash) {int rc; -struct smb2_hdr *rcv_hdr =smb2_get_msg (buf); +struct smb2_hdr *rcv_hdr =smb_get_msg (buf);char *all_bytes_msg = (char *)&rcv_hdr->ProtocolId;int msg_size =get_rfc1002_len (buf);struct ksmbd_crypto_ctx *ctx =NULL ;
@@ -1101,7 +1101,7 @@ int ksmbd_crypt_message(struct ksmbd_wor unsigned int nvec, int enc) {struct ksmbd_conn *conn = work->conn; -struct smb2_transform_hdr *tr_hdr =smb2_get_msg (iov[0 ].iov_base); +struct smb2_transform_hdr *tr_hdr =smb_get_msg (iov[0 ].iov_base);unsigned int assoc_data_len =sizeof (struct smb2_transform_hdr ) -20 ;int rc;DECLARE_CRYPTO_WAIT (wait);
fs/smb/server/connection.c +1 -1
@@ -396,7 +396,7 @@ int ksmbd_conn_handler_loop(void *p)if (!ksmbd_smb_request (conn))break ; -if (((struct smb2_hdr *)smb2_get_msg (conn->request_buf))->ProtocolId == +if (((struct smb2_hdr *)smb_get_msg (conn->request_buf))->ProtocolId ==SMB2_PROTO_NUMBER ) {if (pdu_size <SMB2_MIN_SUPPORTED_HEADER_SIZE )break ;
fs/smb/server/oplock.c +4 -4
@@ -671,7 +671,7 @@ static void __smb2_oplock_break_noti(str goto out; } - rsp_hdr =smb2_get_msg (work->response_buf); + rsp_hdr =smb_get_msg (work->response_buf);memset (rsp_hdr,0 ,sizeof (struct smb2_hdr ) +2 ); rsp_hdr->ProtocolId =SMB2_PROTO_NUMBER ; rsp_hdr->StructureSize =SMB2_HEADER_STRUCTURE_SIZE ;
@@ -685,7 +685,7 @@ static void __smb2_oplock_break_noti(str rsp_hdr->SessionId =0 ;memset (rsp_hdr->Signature,0 ,16 ); - rsp =smb2_get_msg (work->response_buf); + rsp =smb_get_msg (work->response_buf); rsp->StructureSize =cpu_to_le16 (24 ); if (!br_info->open_trunc &&
@@ -775,7 +775,7 @@ static void __smb2_lease_break_noti(stru goto out; } - rsp_hdr =smb2_get_msg (work->response_buf); + rsp_hdr =smb_get_msg (work->response_buf);memset (rsp_hdr,0 ,sizeof (struct smb2_hdr ) +2 ); rsp_hdr->ProtocolId =SMB2_PROTO_NUMBER ; rsp_hdr->StructureSize =SMB2_HEADER_STRUCTURE_SIZE ;
@@ -789,7 +789,7 @@ static void __smb2_lease_break_noti(stru rsp_hdr->SessionId =0 ;memset (rsp_hdr->Signature,0 ,16 ); - rsp =smb2_get_msg (work->response_buf); + rsp =smb_get_msg (work->response_buf); rsp->StructureSize =cpu_to_le16 (44 ); rsp->Epoch = br_info->epoch; rsp->Flags =0 ;
fs/smb/server/smb2pdu.c +35 -35
240 lines not on this page · raw message
fs/smb/server/smb2pdu.h +0 -9
@@ -525,13 +525,4 @@ int smb2_ioctl(struct ksmbd_work *work);int smb2_oplock_break (struct ksmbd_work *work);int smb2_notify (struct ksmbd_work *ksmbd_work); -/* -* Get the body of the smb2 message excluding the 4 byte rfc1002 headers -* from request/response buffer. -*/ -static inline void *smb2_get_msg (void *buf) -{ -return buf +4 ; -} -#endif /* _SMB2PDU_H */
fs/smb/server/smb_common.c +3 -3
@@ -163,7 +163,7 @@ bool ksmbd_smb_request(struct ksmbd_connif (conn->request_buf[0 ] !=0 )return false; - proto = (__le32 *)smb2_get_msg (conn->request_buf); + proto = (__le32 *)smb_get_msg (conn->request_buf);if (*proto ==SMB2_COMPRESSION_TRANSFORM_ID ) {pr_err_ratelimited ("smb2 compression not support yet" );return false;
@@ -259,14 +259,14 @@ int ksmbd_lookup_dialect_by_id(__le16 *cstatic int ksmbd_negotiate_smb_dialect (void *buf) {int smb_buf_length =get_rfc1002_len (buf); -__le32 proto = ((struct smb2_hdr *)smb2_get_msg (buf))->ProtocolId; +__le32 proto = ((struct smb2_hdr *)smb_get_msg (buf))->ProtocolId;if (proto ==SMB2_PROTO_NUMBER ) {struct smb2_negotiate_req *req;int smb2_neg_size = offsetof(struct smb2_negotiate_req , Dialects); - req = (struct smb2_negotiate_req *)smb2_get_msg (buf); + req = (struct smb2_negotiate_req *)smb_get_msg (buf);if (smb2_neg_size > smb_buf_length) goto err_out;
fs/smb/server/smb_common.h +9 -0
@@ -426,4 +426,13 @@ static inline unsigned int get_rfc1002_l {return be32_to_cpu (*((__be32 *)buf)) &0xffffff ; } + +/* +* Get the body of the smb message excluding the 4 byte rfc1002 headers +* from request/response buffer. +*/ +static inline void *smb_get_msg (void *buf) +{ +return buf +4 ; +}#endif /* __SMB_SERVER_COMMON_H__ */
Greg Kroah-Hartman
maintainerPATCH 228/303 smb/server: fix minimum SMB1 PDU size
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: ChenXiaoSong <[email protected]>
[ Upstream commit 3b9c30eb8f5aaad4a54cdfa470b74c0467cc71e8 ]
Since the RFC1002 header has been removed from struct smb_hdr, the minimum SMB1 PDU size should be updated as well.
Stable-dep-of: cfc0b8e5080a ("ksmbd: validate minimum PDU size for transform requests")
--- fs/smb/server/connection.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
fs/smb/server/connection.c +3 -2
@@ -305,7 +305,8 @@ bool ksmbd_conn_alive(struct ksmbd_connreturn true; } -#define SMB1_MIN_SUPPORTED_HEADER_SIZE (sizeof(struct smb_hdr)) +/* "+2" for BCC field (ByteCount, 2 bytes) */ +#define SMB1_MIN_SUPPORTED_PDU_SIZE (sizeof(struct smb_hdr) + 2)#define SMB2_MIN_SUPPORTED_HEADER_SIZE (sizeof(struct smb2_hdr) + 4)/**
@@ -365,7 +366,7 @@ int ksmbd_conn_handler_loop(void *p)if (pdu_size >MAX_STREAM_PROT_LEN )break ; -if (pdu_size <SMB1_MIN_SUPPORTED_HEADER_SIZE ) +if (pdu_size <SMB1_MIN_SUPPORTED_PDU_SIZE )break ;/* 4 for rfc1002 length field */
Greg Kroah-Hartman
maintainerPATCH 229/303 smb/server: fix minimum SMB2 PDU size
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: ChenXiaoSong <[email protected]>
[ Upstream commit 4c7d8eb9a79ae5400eac19c4f6f0815bff674452 ]
The minimum SMB2 PDU size should be updated to the size of struct smb2_pdu (that is, the size of struct smb2_hdr + 2).
Stable-dep-of: cfc0b8e5080a ("ksmbd: validate minimum PDU size for transform requests")
--- fs/smb/server/connection.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/smb/server/connection.c +2 -2
@@ -307,7 +307,7 @@ bool ksmbd_conn_alive(struct ksmbd_conn/* "+2" for BCC field (ByteCount, 2 bytes) */ #define SMB1_MIN_SUPPORTED_PDU_SIZE (sizeof(struct smb_hdr) + 2) -#define SMB2_MIN_SUPPORTED_HEADER_SIZE (sizeof(struct smb2_hdr) + 4) +#define SMB2_MIN_SUPPORTED_PDU_SIZE (sizeof(struct smb2_pdu))/** * ksmbd_conn_handler_loop() - session thread to listen on new smb requests
@@ -399,7 +399,7 @@ int ksmbd_conn_handler_loop(void *p)if (((struct smb2_hdr *)smb_get_msg (conn->request_buf))->ProtocolId ==SMB2_PROTO_NUMBER ) { -if (pdu_size <SMB2_MIN_SUPPORTED_HEADER_SIZE ) +if (pdu_size <SMB2_MIN_SUPPORTED_PDU_SIZE )break ; }
Greg Kroah-Hartman
maintainerPATCH 230/303 ksmbd: validate minimum PDU size for transform requests
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
[ Upstream commit cfc0b8e5080aec87700774e8568765eaa4b7b92b ]
The receive path applies the minimum SMB2 PDU size check only when ProtocolId is SMB2_PROTO_NUMBER. A packet carrying SMB2_TRANSFORM_PROTO_NUM bypasses the check even when the negotiated dialect does not provide transform handling.
On an SMB 2.1 connection, a short transform packet therefore reaches init_smb2_rsp_hdr(), which interprets the request as a full SMB2 header and reads beyond the request allocation. The copied fields can then be returned to the unauthenticated client.
Compression transforms are converted to ordinary SMB2 messages before protocol validation. After that conversion, validate ordinary SMB2 requests against SMB2_MIN_SUPPORTED_PDU_SIZE and require encryption transform requests to contain both a transform header and an SMB2 header. This rejects truncated requests before work allocation.
--- fs/smb/server/connection.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
fs/smb/server/connection.c +11 -5
@@ -308,6 +308,8 @@ bool ksmbd_conn_alive(struct ksmbd_conn/* "+2" for BCC field (ByteCount, 2 bytes) */ #define SMB1_MIN_SUPPORTED_PDU_SIZE (sizeof(struct smb_hdr) + 2)#define SMB2_MIN_SUPPORTED_PDU_SIZE (sizeof(struct smb2_pdu)) +#define SMB2_TRANSFORM_MIN_SUPPORTED_PDU_SIZE \ + (sizeof(struct smb2_transform_hdr) + sizeof(struct smb2_hdr))/** * ksmbd_conn_handler_loop() - session thread to listen on new smb requests
@@ -322,6 +324,7 @@ int ksmbd_conn_handler_loop(void *p)struct ksmbd_conn *conn = (struct ksmbd_conn *)p;struct ksmbd_transport *t = conn->transport;unsigned int pdu_size, max_allowed_pdu_size; +__le32 proto;char hdr_buf[4 ] = {0 ,};int size;
@@ -397,11 +400,14 @@ int ksmbd_conn_handler_loop(void *p)if (!ksmbd_smb_request (conn))break ; -if (((struct smb2_hdr *)smb_get_msg (conn->request_buf))->ProtocolId == -SMB2_PROTO_NUMBER ) { -if (pdu_size <SMB2_MIN_SUPPORTED_PDU_SIZE ) -break ; - } + proto = *(__le32 *)smb_get_msg (conn->request_buf); +if (proto ==SMB2_PROTO_NUMBER && + pdu_size <SMB2_MIN_SUPPORTED_PDU_SIZE ) +break ; + +if (proto ==SMB2_TRANSFORM_PROTO_NUM && + pdu_size <SMB2_TRANSFORM_MIN_SUPPORTED_PDU_SIZE ) +break ;if (!default_conn_ops.process_fn) {pr_err ("No connection request callback\n" );
Greg Kroah-Hartman
maintainerPATCH 231/303 mm/migrate_device: page_remove_rmap() -> folio_remove_rmap_pte()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Hildenbrand <[email protected]>
[ Upstream commit 5b205c7f2684764c8a9cc3442986623d4d6e87f1 ]
Let's convert migrate_vma_collect_pmd(). While at it, perform more folio conversion.
Stable-dep-of: 63867c82d0c0 ("mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE")
--- mm/migrate_device.c | 39 +++++++++++++++++++++------------------ 1 file changed, 21 insertions(+), 18 deletions(-)
mm/migrate_device.c +21 -18
@@ -114,6 +114,7 @@ again:for (; addr < end; addr +=PAGE_SIZE , ptep++) {unsigned long mpfn =0 , pfn; +struct folio *folio;struct page *page;swp_entry_t entry;pte_t pte;
@@ -175,41 +176,43 @@ again: }/* -* By getting a reference on the page we pin it and that blocks +* By getting a reference on the folio we pin it and that blocks * any kind of migration. Side effect is that it "freezes" the * pte. * -* We drop this reference after isolating the page from the lru -* for non device page (device page are not on the lru and thus +* We drop this reference after isolating the folio from the lru +* for non device folio (device folio are not on the lru and thus * can't be dropped from it). */ -get_page (page); + folio =page_folio (page); +folio_get (folio);/* -* We rely on trylock_page() to avoid deadlock between +* We rely on folio_trylock() to avoid deadlock between * concurrent migrations where each is waiting on the others -* page lock. If we can't immediately lock the page we fail this +* folio lock. If we can't immediately lock the folio we fail this * migration as it is only best effort anyway. * -* If we can lock the page it's safe to set up a migration entry -* now. In the common case where the page is mapped once in a +* If we can lock the folio it's safe to set up a migration entry +* now. In the common case where the folio is mapped once in a * single process setting up the migration entry now is an * optimisation to avoid walking the rmap later with * try_to_migrate(). */ -if (trylock_page (page)) { +if (folio_trylock (folio)) {bool anon_exclusive;pte_t swp_pte; -flush_cache_page (vma, addr,pte_pfn (*ptep)); - anon_exclusive =PageAnon (page) &&PageAnonExclusive (page); +flush_cache_page (vma, addr,pte_pfn (pte)); + anon_exclusive =folio_test_anon (folio) && +PageAnonExclusive (page);if (anon_exclusive) { pte =ptep_clear_flush (vma, addr, ptep);if (page_try_share_anon_rmap (page)) {set_pte_at (mm, addr, ptep, pte); -unlock_page (page); -put_page (page); +folio_unlock (folio); +folio_put (folio); mpfn =0 ; goto next; }
@@ -221,7 +224,7 @@ again:/* Set the dirty flag on the folio now the pte is gone. */ if (pte_dirty (pte)) -folio_mark_dirty (page_folio (page)); +folio_mark_dirty (folio);/* Setup special migration page table entry */ if (mpfn &MIGRATE_PFN_WRITE )
@@ -255,16 +258,16 @@ again:/* * This is like regular unmap: we remove the rmap and -* drop page refcount. Page won't be freed, as we took -* a reference just above. +* drop the folio refcount. The folio won't be freed, as +* we took a reference just above. */ page_remove_rmap (page, vma, false); -put_page (page); +folio_put (folio);if (pte_present (pte)) unmapped++; }else { -put_page (page); +folio_put (folio); mpfn =0 ; }
Greg Kroah-Hartman
maintainerPATCH 232/303 mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kefeng Wang <[email protected]>
[ Upstream commit 63867c82d0c0c2d182016a32b1cc0103116b0ea5 ]
pte_pfn() and pte_dirty() have undefined behaviour when called on a non-present PTE. In migrate_vma_collect_pmd(), these functions may be invoked on non-present entries (e.g., device-private entries), leading to potential crashes from pte_pfn() or incorrect dirty folio accounting from pte_dirty(). Fix both by guarding with pte_present() checks.
--- mm/migrate_device.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
mm/migrate_device.c +3 -2
@@ -203,7 +203,8 @@ again:bool anon_exclusive;pte_t swp_pte; -flush_cache_page (vma, addr,pte_pfn (pte)); +if (pte_present (pte)) +flush_cache_page (vma, addr,pte_pfn (pte)); anon_exclusive =folio_test_anon (folio) &&PageAnonExclusive (page);if (anon_exclusive) {
@@ -223,7 +224,7 @@ again: migrate->cpages++;/* Set the dirty flag on the folio now the pte is gone. */ -if (pte_dirty (pte)) +if (pte_present (pte) &&pte_dirty (pte))folio_mark_dirty (folio);/* Setup special migration page table entry */
Greg Kroah-Hartman
maintainerPATCH 233/303 erofs: tidy up internal.h
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gao Xiang <[email protected]>
[ Upstream commit 557afdd94cf853885ac3b5c218bdf49c021f7323 ]
Reorder internal.h code so that removing unneeded macros and more. No logic changes.
Stable-dep-of: c9b47e6b2311 ("erofs: cap LZMA stream pool size")
--- fs/erofs/internal.h | 83 +++++++++++++++++----------------------------------- 1 file changed, 28 insertions(+), 55 deletions(-)
fs/erofs/internal.h +28 -55
@@ -364,12 +364,6 @@ struct page *erofs_grab_cache_page_nowai readahead_gfp_mask(mapping) & ~__GFP_RECLAIM); } -extern const struct super_operations erofs_sops; -extern struct file_system_type erofs_fs_type; - -extern const struct address_space_operations erofs_raw_access_aops; -extern const struct address_space_operations z_erofs_aops; -enum { BH_Encoded = BH_PrivateStart, BH_FullMapped,
@@ -401,7 +395,6 @@ struct erofs_map_blocks {unsigned int m_flags; }; -/* Flags used by erofs_map_blocks_flatmode() */ #define EROFS_GET_BLOCKS_RAW 0x0001/* * Used to get the exact decompressed length, e.g. fiemap (consider lookback
@@ -419,24 +412,6 @@ enum {Z_EROFS_COMPRESSION_RUNTIME_MAX }; -/* zmap.c */ -extern const struct iomap_ops z_erofs_iomap_report_ops; - -#ifdef CONFIG_EROFS_FS_ZIP -int z_erofs_fill_inode (struct inode *inode); -int z_erofs_map_blocks_iter (struct inode *inode, -struct erofs_map_blocks *map, -int flags); -#else -static inline int z_erofs_fill_inode (struct inode *inode) {return -EOPNOTSUPP ; } -static inline int z_erofs_map_blocks_iter (struct inode *inode, -struct erofs_map_blocks *map, -int flags) -{ -return -EOPNOTSUPP ; -} -#endif /* !CONFIG_EROFS_FS_ZIP */ -struct erofs_map_dev {struct erofs_fscache *m_fscache;struct block_device *m_bdev;
@@ -447,8 +422,27 @@ struct erofs_map_dev {unsigned int m_deviceid; }; -/* data.c */ +extern struct file_system_type erofs_fs_type; +extern const struct super_operations erofs_sops; + +extern const struct address_space_operations erofs_raw_access_aops; +extern const struct address_space_operations z_erofs_aops; +extern const struct address_space_operations erofs_fscache_access_aops; + +extern const struct inode_operations erofs_generic_iops; +extern const struct inode_operations erofs_symlink_iops; +extern const struct inode_operations erofs_fast_symlink_iops; +extern const struct inode_operations erofs_dir_iops; +extern const struct file_operations erofs_file_fops; +extern const struct file_operations erofs_dir_fops; + +extern const struct iomap_ops z_erofs_iomap_report_ops; + +/* flags for erofs_fscache_register_cookie() */ +#define EROFS_REG_COOKIE_NEED_INODE 1 +#define EROFS_REG_COOKIE_NEED_NOEXIST 2 +void *erofs_read_metadata (struct super_block *sb,struct erofs_buf *buf,erofs_off_t *offset,int *lengthp);void erofs_unmap_metabuf (struct erofs_buf *buf);
@@ -463,7 +457,6 @@ int erofs_fiemap(struct inode *inode, stint erofs_map_blocks (struct inode *inode,struct erofs_map_blocks *map,int flags); -/* inode.c */ static inline unsigned long erofs_inode_hash (erofs_nid_t nid) {#if BITS_PER_LONG ==32
@@ -473,24 +466,13 @@ static inline unsigned long erofs_inode_#endif } -extern const struct inode_operations erofs_generic_iops; -extern const struct inode_operations erofs_symlink_iops; -extern const struct inode_operations erofs_fast_symlink_iops; -struct inode *erofs_iget (struct super_block *sb,erofs_nid_t nid);int erofs_getattr (struct user_namespace *mnt_userns,const struct path *path,struct kstat *stat,u32 request_mask,unsigned int query_flags); - -/* namei.c */ -extern const struct inode_operations erofs_dir_iops; -int erofs_namei (struct inode *dir,const struct qstr *name,erofs_nid_t *nid,unsigned int *d_type); -/* dir.c */ -extern const struct file_operations erofs_dir_fops; -static inline void *erofs_vm_map_ram (struct page **pages,unsigned int count) {int retried =0 ;
@@ -506,23 +488,19 @@ static inline void *erofs_vm_map_ram(strreturn NULL ; } -/* pcpubuf.c */ void *erofs_get_pcpubuf (unsigned int requiredpages);void erofs_put_pcpubuf (void *ptr);int erofs_pcpubuf_growsize (unsigned int nrpages);void erofs_pcpubuf_init (void );void erofs_pcpubuf_exit (void ); -/* sysfs.c */ int erofs_register_sysfs (struct super_block *sb);void erofs_unregister_sysfs (struct super_block *sb);int __init erofs_init_sysfs (void );void erofs_exit_sysfs (void ); -/* utils.c / zdata.c */ struct page *erofs_allocpage (struct page **pagepool,gfp_t gfp); -static inline void erofs_pagepool_add (struct page **pagepool, -struct page *page) +static inline void erofs_pagepool_add (struct page **pagepool,struct page *page) {set_page_private (page, (unsigned long )*pagepool); *pagepool = page;
@@ -546,6 +524,9 @@ int erofs_try_to_free_all_cached_pages(s struct erofs_workgroup *egrp);int erofs_try_to_free_cached_page (struct page *page);int z_erofs_parse_cfgs (struct super_block *sb,struct erofs_super_block *dsb); +int z_erofs_fill_inode (struct inode *inode); +int z_erofs_map_blocks_iter (struct inode *inode,struct erofs_map_blocks *map, +int flags);#else static inline void erofs_shrinker_register (struct super_block *sb) {}static inline void erofs_shrinker_unregister (struct super_block *sb) {}
@@ -553,6 +534,7 @@ static inline int erofs_init_shrinker(vostatic inline void erofs_exit_shrinker (void ) {}static inline int z_erofs_init_zip_subsystem (void ) {return 0 ; }static inline void z_erofs_exit_zip_subsystem (void ) {} +static inline int z_erofs_fill_inode (struct inode *inode) {return -EOPNOTSUPP ; }#endif /* !CONFIG_EROFS_FS_ZIP */ #ifdef CONFIG_EROFS_FS_ZIP_LZMA
@@ -561,23 +543,15 @@ void z_erofs_lzma_exit(void);#else static inline int z_erofs_lzma_init (void ) {return 0 ; }static inline int z_erofs_lzma_exit (void ) {return 0 ; } -#endif /* !CONFIG_EROFS_FS_ZIP */ +#endif /* !CONFIG_EROFS_FS_ZIP_LZMA */ -/* flags for erofs_fscache_register_cookie() */ -#define EROFS_REG_COOKIE_NEED_INODE 1 -#define EROFS_REG_COOKIE_NEED_NOEXIST 2 - -/* fscache.c */ #ifdef CONFIG_EROFS_FS_ONDEMAND int erofs_fscache_register_fs (struct super_block *sb);void erofs_fscache_unregister_fs (struct super_block *sb);struct erofs_fscache *erofs_fscache_register_cookie (struct super_block *sb, -char *name, -unsigned int flags); +char *name,unsigned int flags);void erofs_fscache_unregister_cookie (struct erofs_fscache *fscache); - -extern const struct address_space_operations erofs_fscache_access_aops;#else static inline int erofs_fscache_register_fs (struct super_block *sb) {
@@ -587,8 +561,7 @@ static inline void erofs_fscache_unregisstatic inline struct erofs_fscache *erofs_fscache_register_cookie (struct super_block *sb, -char *name, -unsigned int flags) +char *name,unsigned int flags) {return ERR_PTR (-EOPNOTSUPP ); }
Greg Kroah-Hartman
maintainerPATCH 234/303 erofs: maintain cookies of share domain in self-contained list
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jingbo Xu <[email protected]>
[ Upstream commit 2dfb8c3b122fad4504a92c34ba68f2fe4444b3f6 ]
We'd better not touch sb->s_inodes list and inode->i_count directly. Let's maintain cookies of share domain in a self-contained list in erofs.
Besides, relinquish cookie with the mutex held. Otherwise if a cookie is registered when the old cookie with the same name in the same domain has been removed from the list but not relinquished yet, fscache may complain "Duplicate cookie detected".
Stable-dep-of: c9b47e6b2311 ("erofs: cap LZMA stream pool size")
--- fs/erofs/fscache.c | 44 ++++++++++++++++++++------------------------ fs/erofs/internal.h | 4 ++++ 2 files changed, 24 insertions(+), 24 deletions(-)
fs/erofs/fscache.c +20 -24
@@ -9,6 +9,7 @@static DEFINE_MUTEX (erofs_domain_list_lock);static DEFINE_MUTEX (erofs_domain_cookies_lock);static LIST_HEAD (erofs_domain_list); +static LIST_HEAD (erofs_domain_cookies_list);static struct vfsmount *erofs_pseudo_mnt; static struct netfs_io_request *erofs_fscache_alloc_request(struct address_space *mapping,
@@ -389,8 +390,6 @@ const struct address_space_operations erstatic void erofs_fscache_domain_put (struct erofs_domain *domain) { -if (!domain) -return ;mutex_lock (&erofs_domain_list_lock);if (refcount_dec_and_test (&domain->ref)) {list_del (&domain->list);
@@ -505,6 +504,8 @@ struct erofs_fscache *erofs_fscache_acqu ctx =kzalloc (sizeof (*ctx),GFP_KERNEL );if (!ctx)return ERR_PTR (-ENOMEM ); +INIT_LIST_HEAD (&ctx->node); +refcount_set (&ctx->ref,1 ); cookie =fscache_acquire_cookie (volume,FSCACHE_ADV_WANT_CACHE_SIZE , name,strlen (name),NULL ,0 ,0 );
@@ -550,6 +551,7 @@ static void erofs_fscache_relinquish_coofscache_unuse_cookie (ctx->cookie,NULL ,NULL );fscache_relinquish_cookie (ctx->cookie, false);iput (ctx->inode); +iput (ctx->anon_inode);kfree (ctx->name);kfree (ctx); }
@@ -582,6 +584,7 @@ struct erofs_fscache *erofs_fscache_doma ctx->domain = domain; ctx->anon_inode = inode; +list_add (&ctx->node, &erofs_domain_cookies_list); inode->i_private = ctx;refcount_inc (&domain->ref);return ctx;
@@ -595,29 +598,23 @@ struct erofs_fscache *erofs_domain_regis char *name, unsigned int flags) { -struct inode *inode;struct erofs_fscache *ctx;struct erofs_domain *domain =EROFS_SB (sb)->domain; -struct super_block *psb = erofs_pseudo_mnt->mnt_sb;mutex_lock (&erofs_domain_cookies_lock); -spin_lock (&psb->s_inode_list_lock); -list_for_each_entry (inode, &psb->s_inodes, i_sb_list) { - ctx = inode->i_private; -if (!ctx || ctx->domain != domain ||strcmp (ctx->name, name)) +list_for_each_entry (ctx, &erofs_domain_cookies_list, node) { +if (ctx->domain != domain ||strcmp (ctx->name, name))continue ;if (!(flags &EROFS_REG_COOKIE_NEED_NOEXIST )) { -igrab (inode); +refcount_inc (&ctx->ref); }else {erofs_err (sb,"%s already exists in domain %s" , name, domain->domain_id); ctx =ERR_PTR (-EEXIST ); } -spin_unlock (&psb->s_inode_list_lock);mutex_unlock (&erofs_domain_cookies_lock);return ctx; } -spin_unlock (&psb->s_inode_list_lock); ctx =erofs_fscache_domain_init_cookie (sb, name, flags);mutex_unlock (&erofs_domain_cookies_lock);return ctx;
@@ -634,23 +631,22 @@ struct erofs_fscache *erofs_fscache_regivoid erofs_fscache_unregister_cookie (struct erofs_fscache *ctx) { -bool drop; -struct erofs_domain *domain; +struct erofs_domain *domain =NULL ;if (!ctx)return ; - domain = ctx->domain; -if (domain) { -mutex_lock (&erofs_domain_cookies_lock); - drop =atomic_read (&ctx->anon_inode->i_count) ==1 ; -iput (ctx->anon_inode); -mutex_unlock (&erofs_domain_cookies_lock); -if (!drop) -return ; - } +if (!ctx->domain) +return erofs_fscache_relinquish_cookie (ctx); -erofs_fscache_relinquish_cookie (ctx); -erofs_fscache_domain_put (domain); +mutex_lock (&erofs_domain_cookies_lock); +if (refcount_dec_and_test (&ctx->ref)) { + domain = ctx->domain; +list_del (&ctx->node); +erofs_fscache_relinquish_cookie (ctx); + } +mutex_unlock (&erofs_domain_cookies_lock); +if (domain) +erofs_fscache_domain_put (domain); }int erofs_fscache_register_fs (struct super_block *sb)
fs/erofs/internal.h +4 -0
@@ -108,7 +108,11 @@ struct erofs_fscache {struct fscache_cookie *cookie;struct inode *inode;struct inode *anon_inode; + +/* used for share domain mode */ struct erofs_domain *domain; +struct list_head node; +refcount_t ref;char *name; };
Greg Kroah-Hartman
maintainerPATCH 235/303 erofs: cap LZMA stream pool size
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <[email protected]>
[ Upstream commit c9b47e6b23114e939b17f818471c7a46e59006e7 ]
fs/erofs/decompressor_lzma.c sizes the module-global MicroLZMA stream pool from num_possible_cpus() when the lzma_streams module parameter is unset, then z_erofs_load_lzma_config() preallocates one image-supplied dictionary per stream, accepting dictionaries up to 8 MiB. On high-CPU systems, a small EROFS image can pin hundreds of MiB of vmalloc-backed decoder state until the erofs module is unloaded.
Impact: An EROFS image mounted by the system can pin up to 8 MiB of vmalloc memory per LZMA stream, either as intended or unexpectedly.
Bound the default stream count by a new CONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS option, default 16, so the worst-case default preallocation is 128 MiB if the number of CPUs is no less than 16 while preserving the existing per-image dictionary limit. An explicit lzma_streams module parameter is still honoured as-is, so administrators who deliberately size the pool are not affected.
--- fs/erofs/Kconfig | 14 ++++++++++++++ fs/erofs/decompressor_lzma.c | 3 ++- 2 files changed, 16 insertions(+), 1 deletion(-)
fs/erofs/Kconfig +14 -0
@@ -99,6 +99,20 @@ config EROFS_FS_ZIP_LZMA If unsure, say N. +config EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS + int "EROFS LZMA default maximum decompression streams" + depends on EROFS_FS_ZIP_LZMA + range 1 NR_CPUS + default 16 + help + By default EROFS allocates one LZMA decompression stream per CPU. + Each stream can hold a dictionary of up to 8 MiB taken from the + mounted image, so on systems with many CPUs this can reserve a lot + of memory. This caps the default; the lzma_streams module parameter + still overrides it. + + If unsure, keep the default of 16. + config EROFS_FS_ONDEMAND bool "EROFS fscache-based on-demand read support" depends on CACHEFILES_ONDEMAND && (EROFS_FS=m && FSCACHE || EROFS_FS=y && FSCACHE=y)
fs/erofs/decompressor_lzma.c +2 -1
@@ -53,7 +53,8 @@ int z_erofs_lzma_init(void)/* by default, use # of possible CPUs instead */ if (!z_erofs_lzma_nstrms) - z_erofs_lzma_nstrms =num_possible_cpus (); + z_erofs_lzma_nstrms = min_t(unsigned int, num_possible_cpus(), +CONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS );for (i =0 ; i < z_erofs_lzma_nstrms; ++i) {struct z_erofs_lzma *strm =kzalloc (sizeof (*strm),GFP_KERNEL );
Greg Kroah-Hartman
maintainerPATCH 236/303 Bluetooth: hci_sync: Introduce hci_cmd_sync_run/hci_cmd_sync_run_once
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit c898f6d7b093bd71e66569cd6797c87d4056f44b ]
This introduces hci_cmd_sync_run/hci_cmd_sync_run_once which acts like hci_cmd_sync_queue/hci_cmd_sync_queue_once but runs immediately when already on hdev->cmd_sync_work context.
Stable-dep-of: d0a7b48ad092 ("Bluetooth: mgmt: fix UAF in pair command cancellation")
--- include/net/bluetooth/hci_sync.h | 4 +++ net/bluetooth/hci_sync.c | 42 +++++++++++++++++++++++++++++++++++++-- 2 files changed, 44 insertions(+), 2 deletions(-)
include/net/bluetooth/hci_sync.h +4 -0
@@ -69,6 +69,10 @@ hci_cmd_sync_lookup_entry(struct hci_dev void *data, hci_cmd_sync_work_destroy_t destroy);int hci_cmd_sync_queue_once (struct hci_dev *hdev,hci_cmd_sync_work_func_t func,void *data,hci_cmd_sync_work_destroy_t destroy); +int hci_cmd_sync_run (struct hci_dev *hdev,hci_cmd_sync_work_func_t func, +void *data,hci_cmd_sync_work_destroy_t destroy); +int hci_cmd_sync_run_once (struct hci_dev *hdev,hci_cmd_sync_work_func_t func, +void *data,hci_cmd_sync_work_destroy_t destroy);void hci_cmd_sync_cancel_entry (struct hci_dev *hdev,struct hci_cmd_sync_work_entry *entry); bool hci_cmd_sync_dequeue(struct hci_dev *hdev, hci_cmd_sync_work_func_t func,
net/bluetooth/hci_sync.c +40 -2
60 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 237/303 Bluetooth: MGMT: Fix not generating command complete for MGMT_OP_DISCONNECT
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 227a0cdf4a028a73dc256d0f5144b4808d718893 ]
MGMT_OP_DISCONNECT can be called while mgmt_device_connected has not been called yet, which will cause the connection procedure to be aborted, so mgmt_device_disconnected shall still respond with command complete to MGMT_OP_DISCONNECT and just not emit MGMT_EV_DEVICE_DISCONNECTED since MGMT_EV_DEVICE_CONNECTED was never sent.
To fix this MGMT_OP_DISCONNECT is changed to work similarly to other command which do use hci_cmd_sync_queue and then use hci_conn_abort to disconnect and returns the result, in order for hci_conn_abort to be used from hci_cmd_sync context it now uses hci_cmd_sync_run_once.
Stable-dep-of: d0a7b48ad092 ("Bluetooth: mgmt: fix UAF in pair command cancellation")
--- net/bluetooth/mgmt.c | 84 +++++++++++++++++++++++++-------------------------- 1 file changed, 42 insertions(+), 42 deletions(-)
net/bluetooth/mgmt.c +42 -42
@@ -2956,7 +2956,12 @@ static int unpair_device_sync(struct hciif (!conn)return 0 ; -return hci_abort_conn_sync (hdev, conn,HCI_ERROR_REMOTE_USER_TERM ); +/* Disregard any possible error since the likes of hci_abort_conn_sync +* will clean up the connection no matter the error. +*/ +hci_abort_conn (conn,HCI_ERROR_REMOTE_USER_TERM ); + +return 0 ; } static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
@@ -3088,13 +3093,44 @@ unlock:return err; } +static void disconnect_complete (struct hci_dev *hdev,void *data,int err) +{ +struct mgmt_pending_cmd *cmd = data; + + cmd->cmd_complete (cmd,mgmt_status (err)); +mgmt_pending_free (cmd); +} + +static int disconnect_sync (struct hci_dev *hdev,void *data) +{ +struct mgmt_pending_cmd *cmd = data; +struct mgmt_cp_disconnect *cp = cmd->param; +struct hci_conn *conn; + +if (cp->addr.type ==BDADDR_BREDR ) + conn =hci_conn_hash_lookup_ba (hdev,ACL_LINK , + &cp->addr.bdaddr); +else + conn =hci_conn_hash_lookup_le (hdev, &cp->addr.bdaddr, +le_addr_type (cp->addr.type)); + +if (!conn) +return -ENOTCONN ; + +/* Disregard any possible error since the likes of hci_abort_conn_sync +* will clean up the connection no matter the error. +*/ +hci_abort_conn (conn,HCI_ERROR_REMOTE_USER_TERM ); + +return 0 ; +} +static int disconnect (struct sock *sk,struct hci_dev *hdev,void *data,u16 len) {struct mgmt_cp_disconnect *cp = data;struct mgmt_rp_disconnect rp;struct mgmt_pending_cmd *cmd; -struct hci_conn *conn;int err;bt_dev_dbg (hdev,"sock %p" , sk);
@@ -3117,27 +3153,7 @@ static int disconnect(struct sock *sk, s goto failed; } -if (pending_find (MGMT_OP_DISCONNECT , hdev)) { - err =mgmt_cmd_complete (sk, hdev->id,MGMT_OP_DISCONNECT , -MGMT_STATUS_BUSY , &rp,sizeof (rp)); - goto failed; - } - -if (cp->addr.type ==BDADDR_BREDR ) - conn =hci_conn_hash_lookup_ba (hdev,ACL_LINK , - &cp->addr.bdaddr); -else - conn =hci_conn_hash_lookup_le (hdev, &cp->addr.bdaddr, -le_addr_type (cp->addr.type)); - -if (!conn || conn->state ==BT_OPEN || conn->state ==BT_CLOSED ) { - err =mgmt_cmd_complete (sk, hdev->id,MGMT_OP_DISCONNECT , -MGMT_STATUS_NOT_CONNECTED , &rp, -sizeof (rp)); - goto failed; - } - - cmd =mgmt_pending_add (sk,MGMT_OP_DISCONNECT , hdev, data, len); + cmd =mgmt_pending_new (sk,MGMT_OP_DISCONNECT , hdev, data, len);if (!cmd) { err = -ENOMEM ; goto failed;
@@ -3145,9 +3161,10 @@ static int disconnect(struct sock *sk, s cmd->cmd_complete = generic_cmd_complete; - err =hci_disconnect (conn,HCI_ERROR_REMOTE_USER_TERM ); + err =hci_cmd_sync_queue (hdev, disconnect_sync, cmd, + disconnect_complete);if (err <0 ) -mgmt_pending_remove (cmd); +mgmt_pending_free (cmd); failed:hci_dev_unlock (hdev);
@@ -9695,18 +9712,6 @@ void mgmt_device_connected(struct hci_demgmt_event_skb (skb,NULL ); } -static void disconnect_rsp (struct mgmt_pending_cmd *cmd,void *data) -{ -struct sock **sk = data; - - cmd->cmd_complete (cmd,0 ); - - *sk = cmd->sk; -sock_hold (*sk); - -mgmt_pending_remove (cmd); -} -static void unpair_device_rsp (struct mgmt_pending_cmd *cmd,void *data) {struct hci_dev *hdev = data;
@@ -9747,8 +9752,6 @@ void mgmt_device_disconnected(struct hciif (link_type !=ACL_LINK && link_type !=LE_LINK )return ; -mgmt_pending_foreach (MGMT_OP_DISCONNECT , hdev, disconnect_rsp, &sk); -bacpy (&ev.addr.bdaddr, bdaddr); ev.addr.type =link_to_bdaddr (link_type, addr_type); ev.reason = reason;
@@ -9761,9 +9764,6 @@ void mgmt_device_disconnected(struct hciif (sk)sock_put (sk); - -mgmt_pending_foreach (MGMT_OP_UNPAIR_DEVICE , hdev, unpair_device_rsp, - hdev); } void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
Greg Kroah-Hartman
maintainerPATCH 238/303 Bluetooth: MGMT: Remove unused mgmt_pending_find_data
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Dr. David Alan Gilbert" <[email protected]>
[ Upstream commit 276af34d82f13bda0b2a4d9786c90b8bbf1cd064 ]
mgmt_pending_find_data() last use was removed in 2021 by
commit 5a7501374664 ("Bluetooth: hci_sync: Convert MGMT_OP_GET_CLOCK_INFO")
Remove it.
Stable-dep-of: d0a7b48ad092 ("Bluetooth: mgmt: fix UAF in pair command cancellation")
--- net/bluetooth/mgmt_util.c | 17 ----------------- net/bluetooth/mgmt_util.h | 4 ---- 2 files changed, 21 deletions(-)
net/bluetooth/mgmt_util.c +0 -17
@@ -229,23 +229,6 @@ struct mgmt_pending_cmd *mgmt_pending_fireturn NULL ; } -struct mgmt_pending_cmd *mgmt_pending_find_data (unsigned short channel, -u16 opcode, -struct hci_dev *hdev, -const void *data) -{ -struct mgmt_pending_cmd *cmd; - -list_for_each_entry (cmd, &hdev->mgmt_pending, list) { -if (cmd->user_data != data) -continue ; -if (cmd->opcode == opcode) -return cmd; - } - -return NULL ; -} -void mgmt_pending_foreach (u16 opcode,struct hci_dev *hdev,void (*cb)(struct mgmt_pending_cmd *cmd,void *data),void *data)
net/bluetooth/mgmt_util.h +0 -4
@@ -54,10 +54,6 @@ int mgmt_cmd_complete(struct sock *sk, ustruct mgmt_pending_cmd *mgmt_pending_find (unsigned short channel,u16 opcode,struct hci_dev *hdev); -struct mgmt_pending_cmd *mgmt_pending_find_data (unsigned short channel, -u16 opcode, -struct hci_dev *hdev, -const void *data);void mgmt_pending_foreach (u16 opcode,struct hci_dev *hdev,void (*cb)(struct mgmt_pending_cmd *cmd,void *data),void *data);
Greg Kroah-Hartman
maintainerPATCH 239/303 Bluetooth: MGMT: Protect mgmt_pending list with its own lock
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 6fe26f694c824b8a4dbf50c635bee1302e3f099c ]
This uses a mutex to protect from concurrent access of mgmt_pending list which can cause crashes like:
==================================================================
BUG: KASAN: slab-use-after-free in hci_sock_get_channel+0x60/0x68 net/bluetooth/hci_sock.c:91 Read of size 2 at addr ffff0000c48885b2 by task syz.4.334/7318 CPU: 0 UID: 0 PID: 7318 Comm: syz.4.334 Not tainted 6.15.0-rc7-syzkaller-g187899f4124a #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 print_address_description+0xa8/0x254 mm/kasan/report.c:408 print_report+0x68/0x84 mm/kasan/report.c:521 kasan_report+0xb0/0x110 mm/kasan/report.c:634 __asan_report_load2_noabort+0x20/0x2c mm/kasan/report_generic.c:379 hci_sock_get_channel+0x60/0x68 net/bluetooth/hci_sock.c:91 mgmt_pending_find+0x7c/0x140 net/bluetooth/mgmt_util.c:223 pending_find net/bluetooth/mgmt.c:947 [inline] remove_adv_monitor+0x44/0x1a4 net/bluetooth/mgmt.c:5445 hci_mgmt_cmd+0x780/0xc00 net/bluetooth/hci_sock.c:1712 hci_sock_sendmsg+0x544/0xbb0 net/bluetooth/hci_sock.c:1832 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg net/socket.c:727 [inline] sock_write_iter+0x25c/0x378 net/socket.c:1131 new_sync_write fs/read_write.c:591 [inline] vfs_write+0x62c/0x97c fs/read_write.c:684 ksys_write+0x120/0x210 fs/read_write.c:736 __do_sys_write fs/read_write.c:747 [inline] __se_sys_write fs/read_write.c:744 [inline] __arm64_sys_write+0x7c/0x90 fs/read_write.c:744 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x58/0x17c arch/arm64/kernel/entry-common.c:767 el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:786 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 Allocated by task 7037: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:68 kasan_save_alloc_info+0x44/0x54 mm/kasan/generic.c:562 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x9c/0xb4 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4327 [inline] __kmalloc_noprof+0x2fc/0x4c8 mm/slub.c:4339 kmalloc_noprof include/linux/slab.h:909 [inline] sk_prot_alloc+0xc4/0x1f0 net/core/sock.c:2198 sk_alloc+0x44/0x3ac net/core/sock.c:2254 bt_sock_alloc+0x4c/0x300 net/bluetooth/af_bluetooth.c:148 hci_sock_create+0xa8/0x194 net/bluetooth/hci_sock.c:2202 bt_sock_create+0x14c/0x24c net/bluetooth/af_bluetooth.c:132 __sock_create+0x43c/0x91c net/socket.c:1541 sock_create net/socket.c:1599 [inline] __sys_socket_create net/socket.c:1636 [inline] __sys_socket+0xd4/0x1c0 net/socket.c:1683 __do_sys_socket net/socket.c:1697 [inline] __se_sys_socket net/socket.c:1695 [inline] __arm64_sys_socket+0x7c/0x94 net/socket.c:1695 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x58/0x17c arch/arm64/kernel/entry-common.c:767 el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:786 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 Freed by task 6607: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:68 kasan_save_free_info+0x58/0x70 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x68/0x88 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2380 [inline] slab_free mm/slub.c:4642 [inline] kfree+0x17c/0x474 mm/slub.c:4841 sk_prot_free net/core/sock.c:2237 [inline] __sk_destruct+0x4f4/0x760 net/core/sock.c:2332 sk_destruct net/core/sock.c:2360 [inline] __sk_free+0x320/0x430 net/core/sock.c:2371 sk_free+0x60/0xc8 net/core/sock.c:2382 sock_put include/net/sock.h:1944 [inline] mgmt_pending_free+0x88/0x118 net/bluetooth/mgmt_util.c:290 mgmt_pending_remove+0xec/0x104 net/bluetooth/mgmt_util.c:298 mgmt_set_powered_complete+0x418/0x5cc net/bluetooth/mgmt.c:1355 hci_cmd_sync_work+0x204/0x33c net/bluetooth/hci_sync.c:334 process_one_work+0x7e8/0x156c kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x958/0xed8 kernel/workqueue.c:3400 kthread+0x5fc/0x75c kernel/kthread.c:464 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:847
Stable-dep-of: d0a7b48ad092 ("Bluetooth: mgmt: fix UAF in pair command cancellation")
--- include/net/bluetooth/hci_core.h | 1 net/bluetooth/hci_core.c | 1 net/bluetooth/mgmt.c | 101 ++++++++++++++++++--------------------- net/bluetooth/mgmt_util.c | 32 ++++++++++-- net/bluetooth/mgmt_util.h | 4 - 5 files changed, 80 insertions(+), 59 deletions(-)
include/net/bluetooth/hci_core.h +1 -0
@@ -543,6 +543,7 @@ struct hci_dev {struct hci_conn_hash conn_hash;struct list_head mesh_pending; +struct mutex mgmt_pending_lock;struct list_head mgmt_pending;struct list_head reject_list;struct list_head accept_list;
net/bluetooth/hci_core.c +1 -0
@@ -2513,6 +2513,7 @@ struct hci_dev *hci_alloc_dev_priv(int smutex_init (&hdev->lock);mutex_init (&hdev->req_lock); +mutex_init (&hdev->mgmt_pending_lock);ida_init (&hdev->unset_handle_ida);
net/bluetooth/mgmt.c +49 -52
331 lines not on this page · raw message
net/bluetooth/mgmt_util.c +27 -5
@@ -217,30 +217,47 @@ int mgmt_cmd_complete(struct sock *sk, ustruct mgmt_pending_cmd *mgmt_pending_find (unsigned short channel,u16 opcode,struct hci_dev *hdev) { -struct mgmt_pending_cmd *cmd; +struct mgmt_pending_cmd *cmd, *tmp; + +mutex_lock (&hdev->mgmt_pending_lock); -list_for_each_entry (cmd, &hdev->mgmt_pending, list) { +list_for_each_entry_safe (cmd, tmp, &hdev->mgmt_pending, list) {if (hci_sock_get_channel (cmd->sk) != channel)continue ; -if (cmd->opcode == opcode) + +if (cmd->opcode == opcode) { +mutex_unlock (&hdev->mgmt_pending_lock);return cmd; + } } +mutex_unlock (&hdev->mgmt_pending_lock); +return NULL ; } -void mgmt_pending_foreach (u16 opcode,struct hci_dev *hdev, +void mgmt_pending_foreach (u16 opcode,struct hci_dev *hdev,bool remove,void (*cb)(struct mgmt_pending_cmd *cmd,void *data),void *data) {struct mgmt_pending_cmd *cmd, *tmp; +mutex_lock (&hdev->mgmt_pending_lock); +list_for_each_entry_safe (cmd, tmp, &hdev->mgmt_pending, list) {if (opcode >0 && cmd->opcode != opcode)continue ; +if (remove) +list_del (&cmd->list); +cb (cmd, data); + +if (remove) +mgmt_pending_free (cmd); } + +mutex_unlock (&hdev->mgmt_pending_lock); } struct mgmt_pending_cmd *mgmt_pending_new(struct sock *sk, u16 opcode,
@@ -254,7 +271,7 @@ struct mgmt_pending_cmd *mgmt_pending_nereturn NULL ; cmd->opcode = opcode; - cmd->index = hdev->id; + cmd->hdev = hdev; cmd->param =kmemdup (data, len,GFP_KERNEL );if (!cmd->param) {
@@ -280,7 +297,9 @@ struct mgmt_pending_cmd *mgmt_pending_adif (!cmd)return NULL ; +mutex_lock (&hdev->mgmt_pending_lock);list_add_tail (&cmd->list, &hdev->mgmt_pending); +mutex_unlock (&hdev->mgmt_pending_lock);return cmd; }
@@ -294,7 +313,10 @@ void mgmt_pending_free(struct mgmt_pendivoid mgmt_pending_remove (struct mgmt_pending_cmd *cmd) { +mutex_lock (&cmd->hdev->mgmt_pending_lock);list_del (&cmd->list); +mutex_unlock (&cmd->hdev->mgmt_pending_lock); +mgmt_pending_free (cmd); }
net/bluetooth/mgmt_util.h +2 -2
@@ -33,7 +33,7 @@ struct mgmt_mesh_tx {struct mgmt_pending_cmd {struct list_head list;u16 opcode; -int index; +struct hci_dev *hdev;void *param;size_t param_len;struct sock *sk;
@@ -54,7 +54,7 @@ int mgmt_cmd_complete(struct sock *sk, ustruct mgmt_pending_cmd *mgmt_pending_find (unsigned short channel,u16 opcode,struct hci_dev *hdev); -void mgmt_pending_foreach (u16 opcode,struct hci_dev *hdev, +void mgmt_pending_foreach (u16 opcode,struct hci_dev *hdev,bool remove,void (*cb)(struct mgmt_pending_cmd *cmd,void *data),void *data); struct mgmt_pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
Greg Kroah-Hartman
maintainerPATCH 240/303 Bluetooth: mgmt: fix UAF in pair command cancellation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zihan Xi <[email protected]>
[ Upstream commit d0a7b48ad0921bd88effaee10bf970ab1d5d0ddd ]
The pairing completion and authentication failure callbacks look up the pending MGMT_OP_PAIR_DEVICE command by walking hdev->mgmt_pending. The lookup returned a command that was still linked on the shared pending list, without keeping mgmt_pending_lock held for the later dereference and removal.
A concurrent MGMT_OP_CANCEL_PAIR_DEVICE request can remove and free the same pending command before the callback uses it. The reverse race is also possible when cancel_pair_device() gets a command from pending_find() and a callback removes it before the cancel path dereferences it. This can lead to a use-after-free and a second list_del().
Make the pairing lookup helpers transfer ownership of the pending command by removing it from hdev->mgmt_pending while holding mgmt_pending_lock. The callbacks and cancel path then complete the command and free it directly, so racing paths cannot find or free the same command again. Take a temporary hci_conn reference in cancel_pair_device() because the command completion drops the reference stored in the pending command.
--- net/bluetooth/mgmt.c | 64 ++++++++++++++++++++++++++++++++++++--------------- 1 file changed, 46 insertions(+), 18 deletions(-)
net/bluetooth/mgmt.c +46 -18
@@ -3343,11 +3343,13 @@ static int set_io_capability(struct sock NULL, 0); } -static struct mgmt_pending_cmd *find_pairing (struct hci_conn *conn) +static struct mgmt_pending_cmd *remove_pairing (struct hci_conn *conn) {struct hci_dev *hdev = conn->hdev;struct mgmt_pending_cmd *cmd; +mutex_lock (&hdev->mgmt_pending_lock); +list_for_each_entry (cmd, &hdev->mgmt_pending, list) {if (cmd->opcode !=MGMT_OP_PAIR_DEVICE )continue ;
@@ -3355,9 +3357,39 @@ static struct mgmt_pending_cmd *find_paiif (cmd->user_data != conn)continue ; +list_del (&cmd->list); +mutex_unlock (&hdev->mgmt_pending_lock);return cmd; } +mutex_unlock (&hdev->mgmt_pending_lock); + +return NULL ; +} + +static struct mgmt_pending_cmd *remove_pairing_by_addr (struct hci_dev *hdev, +bdaddr_t *bdaddr) +{ +struct mgmt_pending_cmd *cmd; +struct hci_conn *conn; + +mutex_lock (&hdev->mgmt_pending_lock); + +list_for_each_entry (cmd, &hdev->mgmt_pending, list) { +if (cmd->opcode !=MGMT_OP_PAIR_DEVICE ) +continue ; + + conn = cmd->user_data; +if (bacmp (bdaddr, &conn->dst) !=0 ) +continue ; + +list_del (&cmd->list); +mutex_unlock (&hdev->mgmt_pending_lock); +return cmd; + } + +mutex_unlock (&hdev->mgmt_pending_lock); +return NULL ; }
@@ -3395,10 +3427,10 @@ void mgmt_smp_complete(struct hci_conn *u8 status = complete ?MGMT_STATUS_SUCCESS :MGMT_STATUS_FAILED ;struct mgmt_pending_cmd *cmd; - cmd =find_pairing (conn); + cmd =remove_pairing (conn);if (cmd) { cmd->cmd_complete (cmd, status); -mgmt_pending_remove (cmd); +mgmt_pending_free (cmd); } }
@@ -3408,14 +3440,14 @@ static void pairing_complete_cb(struct hBT_DBG ("status %u" , status); - cmd =find_pairing (conn); + cmd =remove_pairing (conn);if (!cmd) {BT_DBG ("Unable to find a pending command" );return ; } cmd->cmd_complete (cmd,mgmt_status (status)); -mgmt_pending_remove (cmd); +mgmt_pending_free (cmd); }static void le_pairing_complete_cb (struct hci_conn *conn,u8 status)
@@ -3427,14 +3459,14 @@ static void le_pairing_complete_cb(strucif (!status)return ; - cmd =find_pairing (conn); + cmd =remove_pairing (conn);if (!cmd) {BT_DBG ("Unable to find a pending command" );return ; } cmd->cmd_complete (cmd,mgmt_status (status)); -mgmt_pending_remove (cmd); +mgmt_pending_free (cmd); } static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
@@ -3602,23 +3634,17 @@ static int cancel_pair_device(struct soc goto unlock; } - cmd =pending_find (MGMT_OP_PAIR_DEVICE , hdev); + cmd =remove_pairing_by_addr (hdev, &addr->bdaddr);if (!cmd) { err =mgmt_cmd_status (sk, hdev->id,MGMT_OP_CANCEL_PAIR_DEVICE ,MGMT_STATUS_INVALID_PARAMS ); goto unlock; } - conn = cmd->user_data; - -if (bacmp (&addr->bdaddr, &conn->dst) !=0 ) { - err =mgmt_cmd_status (sk, hdev->id,MGMT_OP_CANCEL_PAIR_DEVICE , -MGMT_STATUS_INVALID_PARAMS ); - goto unlock; - } + conn =hci_conn_get (cmd->user_data); cmd->cmd_complete (cmd,MGMT_STATUS_CANCELLED ); -mgmt_pending_remove (cmd); +mgmt_pending_free (cmd); err =mgmt_cmd_complete (sk, hdev->id,MGMT_OP_CANCEL_PAIR_DEVICE ,0 , addr,sizeof (*addr));
@@ -3637,6 +3663,8 @@ static int cancel_pair_device(struct sochci_cmd_sync_queue (hdev, abort_conn_sync,ERR_PTR (conn->handle),NULL ); +hci_conn_put (conn); + unlock:hci_dev_unlock (hdev);return err;
@@ -9943,14 +9971,14 @@ void mgmt_auth_failed(struct hci_conn *c ev.addr.type =link_to_bdaddr (conn->type, conn->dst_type); ev.status = status; - cmd =find_pairing (conn); + cmd =remove_pairing (conn);mgmt_event (MGMT_EV_AUTH_FAILED , conn->hdev, &ev,sizeof (ev), cmd ? cmd->sk :NULL );if (cmd) { cmd->cmd_complete (cmd, status); -mgmt_pending_remove (cmd); +mgmt_pending_free (cmd); } }
Greg Kroah-Hartman
maintainerPATCH 241/303 mm/vmstat: fold stranded per-cpu node stats when a node comes online
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregory Price <[email protected]>
[ Upstream commit ea3034b2b00fa50c8d2518d0804c9d427bbafa86 ]
A per-node vmstat counter is pgdat->vm_stat[] plus per-cpu deltas. A balanced counter can sit split as global=+N / per-cpu=-N.
The folds reconciling the split only walk online nodes, so when try_offline_node() marks a node offline the per-cpu deltas are stranded.
A subsequent online resets the per-cpu area but not pgdat->vm_stat[], orphaning the +N permanently. All NR_VM_NODE_STAT_ITEMS are affected.
The existing code zeroes the per-cpu counters and causes a permanent skew. Fold the stranded deltas instead, before the node rejoins the online set. The node is not online yet and the hotplug lock is held, so the remote access to per-cpu values is safe.
Discovered when node compaction hung for a nearly empty node, as the math to determine throttling broke. Reproduced by repeated memory hotplug/unplug cycles on a node under pressure: NR_ISOLATED_ANON ratchets up and never returns to zero.
--- mm/page_alloc.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
mm/page_alloc.c +12 -4
@@ -7734,7 +7734,7 @@ void __ref free_area_init_core_hotplug(s {int nid = pgdat->node_id;enum zone_type z; -int cpu; +int cpu, i;pgdat_init_internals (pgdat);
@@ -7750,10 +7750,18 @@ void __ref free_area_init_core_hotplug(s pgdat->kswapd_order =0 ; pgdat->kswapd_highest_zoneidx =0 ; pgdat->node_start_pfn =0 ; -for_each_online_cpu (cpu) { -struct per_cpu_nodestat *p; - p =per_cpu_ptr (pgdat->per_cpu_nodestats, cpu); +/* +* Hot-unplug can leave per-cpu vmstat deltas unfolded (folders skip +* offline nodes) - reconcile this at online. Foreign access to counters +* is safe: the node is not online yet and we hold the hotplug lock. +*/ +for_each_possible_cpu (cpu) { +struct per_cpu_nodestat *p =per_cpu_ptr (pgdat->per_cpu_nodestats, cpu); + +for (i =0 ; i <NR_VM_NODE_STAT_ITEMS ; i++) +if (p->vm_node_stat_diff[i]) +node_page_state_add (p->vm_node_stat_diff[i], pgdat, i);memset (p,0 ,sizeof (*p)); }
Greg Kroah-Hartman
maintainerPATCH 242/303 overflow: Change DEFINE_FLEX to take __counted_by member
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit d8e45f2929b94099913eb66c3ebb18b5063e9421 ]
The norm should be flexible array structures with __counted_by annotations, so DEFINE_FLEX() is updated to expect that. Rename the non-annotated version to DEFINE_RAW_FLEX(), and update the few existing users. Additionally add selftests for the macros.
Stable-dep-of: cdc36db204ff ("Bluetooth: hci_sync: Fix advertising data UAFs")
--- include/linux/overflow.h | 68 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 68 insertions(+)
include/linux/overflow.h +68 -0
@@ -246,4 +246,72 @@ static inline size_t __must_check size_s sizeof(*(p)) + flex_array_size(p, member, count), \ size_add(sizeof(*(p)), flex_array_size(p, member, count))) +/** +* struct_size_t() - Calculate size of structure with trailing flexible array +* @type: structure type name. +* @member: Name of the array member. +* @count: Number of elements in the array. +* +* Calculates size of memory needed for structure @type followed by an +* array of @count number of @member elements. Prefer using struct_size() +* when possible instead, to keep calculations associated with a specific +* instance variable of type @type. +* +* Return: number of bytes needed or SIZE_MAX on overflow. +*/ +#define struct_size_t (type, member, count) \ + struct_size((type *)NULL, member, count) + +/** +* _DEFINE_FLEX() - helper macro for DEFINE_FLEX() family. +* Enables caller macro to pass (different) initializer. +* +* @type: structure type name, including "struct" keyword. +* @name: Name for a variable to define. +* @member: Name of the array member. +* @count: Number of elements in the array; must be compile-time const. +* @initializer: initializer expression (could be empty for no init). +*/ +#define _DEFINE_FLEX(type, name, member, count, initializer...) \ + _Static_assert(__builtin_constant_p(count), \ + "onstack flex array members require compile-time const count"); \ + union { \ + u8 bytes[struct_size_t(type, member, count)]; \ + type obj; \ + } name##_u initializer; \ + type *name = (type *)&name##_u + +/** +* DEFINE_RAW_FLEX() - Define an on-stack instance of structure with a trailing +* flexible array member, when it does not have a __counted_by annotation. +* +* @type: structure type name, including "struct" keyword. +* @name: Name for a variable to define. +* @member: Name of the array member. +* @count: Number of elements in the array; must be compile-time const. +* +* Define a zeroed, on-stack, instance of @type structure with a trailing +* flexible array member. +* Use __struct_size(@name) to get compile-time size of it afterwards. +*/ +#define DEFINE_RAW_FLEX (type, name, member, count) \ + _DEFINE_FLEX(type, name, member, count, = {}) + +/** +* DEFINE_FLEX() - Define an on-stack instance of structure with a trailing +* flexible array member. +* +* @TYPE: structure type name, including "struct" keyword. +* @NAME: Name for a variable to define. +* @MEMBER: Name of the array member. +* @COUNTER: Name of the __counted_by member. +* @COUNT: Number of elements in the array; must be compile-time const. +* +* Define a zeroed, on-stack, instance of @TYPE structure with a trailing +* flexible array member. +* Use __struct_size(@NAME) to get compile-time size of it afterwards. +*/ +#define DEFINE_FLEX (TYPE ,NAME ,MEMBER ,COUNTER ,COUNT ) \ + _DEFINE_FLEX(TYPE, NAME, MEMBER, COUNT, = { .obj.COUNTER = COUNT, }) +#endif /* __LINUX_OVERFLOW_H */
Greg Kroah-Hartman
maintainerPATCH 243/303 Bluetooth: hci_conn, hci_sync: Use __counted_by() to avoid -Wfamnae warnings
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Gustavo A. R. Silva" <[email protected]>
[ Upstream commit c4585edf708edb5277a3cc4b8581ccb833f3307d ]
Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions).
Also, -Wflex-array-member-not-at-end is coming in GCC-14, and we are getting ready to enable it globally.
So, use the DEFINE_FLEX() helper for multiple on-stack definitions of a flexible structure where the size of the flexible-array member is known at compile-time, and refactor the rest of the code, accordingly.
Notice that, due to the use of __counted_by() in struct hci_cp_le_create_cis, the for loop in function hci_cs_le_create_cis() had to be modified. Once the index i, through which cp->cis[i] is accessed, falls in the interval [0, cp->num_cis), cp->num_cis cannot be decremented all the way down to zero while accessing cp->cis[]:
net/bluetooth/hci_event.c:4310:
4310 for (i = 0; cp->num_cis; cp->num_cis--, i++) {
...4314 handle = __le16_to_cpu(cp->cis[i].cis_handle);
otherwise, only half (one iteration before cp->num_cis == i) or half plus one (one iteration before cp->num_cis < i) of the items in the array will be accessed before running into an out-of-bounds issue. So, in order to avoid this, set cp->num_cis to zero just after the for loop.
Also, make use of aux_num_cis variable to update cmd->num_cis after a list_for_each_entry_rcu() loop.
With these changes, fix the following warnings:net/bluetooth/hci_sync.c:1239:56: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] net/bluetooth/hci_sync.c:1415:51: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] net/bluetooth/hci_sync.c:1731:51: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] net/bluetooth/hci_sync.c:6497:45: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]
Stable-dep-of: cdc36db204ff ("Bluetooth: hci_sync: Fix advertising data UAFs")
--- net/bluetooth/hci_event.c | 3 +- net/bluetooth/hci_sync.c | 62 ++++++++++++++++++---------------------------- 2 files changed, 27 insertions(+), 38 deletions(-)
net/bluetooth/hci_event.c +2 -1
@@ -4205,7 +4205,7 @@ static void hci_cs_le_create_cis(structhci_dev_lock (hdev);/* Remove connection if command failed */ -for (i =0 ; cp->num_cis; cp->num_cis--, i++) { +for (i =0 ; i < cp->num_cis; i++) {struct hci_conn *conn;u16 handle;
@@ -4218,6 +4218,7 @@ static void hci_cs_le_create_cis(structhci_conn_del (conn); } } + cp->num_cis =0 ;hci_dev_unlock (hdev); }
net/bluetooth/hci_sync.c +25 -37
130 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 244/303 Bluetooth: hci_core: Fix not handling hdev->le_num_of_adv_sets=1
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit e77f43d531af41e9ce299eab10dcae8fa5dbc293 ]
If hdev->le_num_of_adv_sets is set to 1 it means that only handle 0x00 can be used, but since the MGMT interface instances start from 1 (instance 0 means all instances in case of MGMT_OP_REMOVE_ADVERTISING) the code needs to map the instance to handle otherwise users will not be able to advertise as instance 1 would attempt to use handle 0x01.
Stable-dep-of: cdc36db204ff ("Bluetooth: hci_sync: Fix advertising data UAFs")
--- include/net/bluetooth/hci_core.h | 1 + net/bluetooth/hci_core.c | 9 +++++++++ net/bluetooth/hci_sync.c | 17 ++++++++--------- 3 files changed, 18 insertions(+), 9 deletions(-)
include/net/bluetooth/hci_core.h +1 -0
@@ -242,6 +242,7 @@ struct adv_info {bool periodic;__u8 mesh;__u8 instance; +__u8 handle;__u32 flags;__u16 timeout;__u16 remaining_time;
net/bluetooth/hci_core.c +9 -0
@@ -1706,6 +1706,15 @@ struct adv_info *hci_add_adv_instance(st adv->pending = true; adv->instance = instance; + +/* If controller support only one set and the instance is set to +* 1 then there is no option other than using handle 0x00. +*/ +if (hdev->le_num_of_adv_sets ==1 && instance ==1 ) + adv->handle =0x00 ; +else + adv->handle = instance; +list_add (&adv->list, &hdev->adv_instances); hdev->adv_instance_cnt++; }
net/bluetooth/hci_sync.c +8 -9
@@ -1183,11 +1183,10 @@ static int hci_disable_ext_adv_instance_struct hci_cp_ext_adv_set *set;u8 data[sizeof (*cp) +sizeof (*set) *1 ];u8 size; +struct adv_info *adv =NULL ;/* If request specifies an instance that doesn't exist, fail */ if (instance >0 ) { -struct adv_info *adv; - adv =hci_find_adv_instance (hdev, instance);if (!adv)return -EINVAL ;
@@ -1206,7 +1205,7 @@ static int hci_disable_ext_adv_instance_ cp->num_of_sets = !!instance; cp->enable =0x00 ; - set->handle = instance; + set->handle = adv ? adv->handle : instance; size =sizeof (*cp) +sizeof (*set) * cp->num_of_sets;
@@ -1301,7 +1300,7 @@ static int hci_set_ext_adv_data_sync(str HCI_MAX_EXT_AD_LENGTH); pdu->length = len; - pdu->handle = instance; + pdu->handle = adv ? adv->handle : instance; pdu->operation =LE_SET_ADV_DATA_OP_COMPLETE ; pdu->frag_pref =LE_SET_ADV_DATA_NO_FRAG ;
@@ -1512,7 +1511,7 @@ static int hci_set_ext_scan_rsp_data_syn len =eir_create_scan_rsp (hdev, instance, pdu->data); - pdu->handle = instance; + pdu->handle = adv ? adv->handle : instance; pdu->length = len; pdu->operation =LE_SET_ADV_DATA_OP_COMPLETE ; pdu->frag_pref =LE_SET_ADV_DATA_NO_FRAG ;
@@ -1594,7 +1593,7 @@ int hci_enable_ext_advertising_sync(strumemset (set,0 ,sizeof (*set)); - set->handle = instance; + set->handle = adv ? adv->handle : instance;/* Set duration per instance since controller is responsible for * scheduling it.
@@ -1671,10 +1670,10 @@ static int hci_set_per_adv_data_sync(str DEFINE_FLEX(struct hci_cp_le_set_per_adv_data, pdu, data, length, HCI_MAX_PER_AD_LENGTH);u8 len; +struct adv_info *adv =NULL ;if (instance) { -struct adv_info *adv =hci_find_adv_instance (hdev, instance); - + adv =hci_find_adv_instance (hdev, instance);if (!adv || !adv->periodic)return 0 ; }
@@ -1682,7 +1681,7 @@ static int hci_set_per_adv_data_sync(str len =eir_create_per_adv_data (hdev, instance, pdu->data); pdu->length = len; - pdu->handle = instance; + pdu->handle = adv ? adv->handle : instance; pdu->operation =LE_SET_ADV_DATA_OP_COMPLETE ; return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_PER_ADV_DATA,
Greg Kroah-Hartman
maintainerPATCH 245/303 Bluetooth: hci_sync: Fix advertising data UAFs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengfeng Ye <[email protected]>
[ Upstream commit cdc36db204ffd97b947d64374cf23a210dc74777 ]
hci_find_adv_instance() returns an adv_info pointer that is valid only while hdev->lock is held. The advertising command-sync paths perform instance lookups without that lock and, in some cases, retain the pointer while waiting for a controller response.
An advertising termination event can therefore interleave as follows:
hci_cmd_sync_work hci_rx_work
hci_find_adv_instance()
__hci_cmd_sync_status()
wait for controller reply hci_dev_lock()
hci_remove_adv_instance()
kfree(adv)
adv->scan_rsp_changed = false
KASAN reported:
BUG: KASAN: slab-use-after-free in hci_set_ext_scan_rsp_data_sync+0x2e1/0x300 Write of size 1 at addr ffff88810a45d21d by task kworker/u17:0/88 Workqueue: hci0 hci_cmd_sync_work Call Trace: hci_set_ext_scan_rsp_data_sync+0x2e1/0x300 hci_schedule_adv_instance_sync+0x390/0x4c0 hci_cmd_sync_work+0x173/0x300 Allocated by task 87: hci_add_adv_instance+0x538/0xac0 add_advertising+0x885/0x1160 Freed by task 89: kfree+0x131/0x3c0 hci_remove_adv_instance+0x1d8/0x3b0 hci_le_ext_adv_term_evt+0x17b/0x730
Protect the instance lookup and payload construction in the extended advertising, scan response, and periodic advertising data paths. Snapshot the advertising parameters under hdev->lock, but release the lock before waiting for the controller.
Clear advertising-data dirty bits before issuing their commands and restore them after a failure using a fresh lookup. Likewise, update the reported transmit power through a fresh lookup after the parameter command completes. No adv_info pointer then survives an HCI command wait.
--- net/bluetooth/hci_sync.c | 131 ++++++++++++++++++++++++++++++++++------------- 1 file changed, 97 insertions(+), 34 deletions(-)
net/bluetooth/hci_sync.c +97 -34
@@ -1240,10 +1240,11 @@ static int hci_set_adv_set_random_addr_s }static int -hci_set_ext_adv_params_sync (struct hci_dev *hdev,struct adv_info *adv, +hci_set_ext_adv_params_sync (struct hci_dev *hdev,u8 instance,const struct hci_cp_le_set_ext_adv_params *cp,struct hci_rp_le_set_ext_adv_params *rp) { +struct adv_info *adv;struct sk_buff *skb; skb = __hci_cmd_sync(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS, sizeof(*cp),
@@ -1271,11 +1272,15 @@ hci_set_ext_adv_params_sync(struct hci_dif (!rp->status) { hdev->adv_addr_type = cp->own_addr_type; -if (!cp->handle) { +if (!instance) {/* Store in hdev for instance 0 */ hdev->adv_tx_power = rp->tx_power; - }else if (adv) { - adv->tx_power = rp->tx_power; + }else { +hci_dev_lock (hdev); + adv =hci_find_adv_instance (hdev, instance); +if (adv) + adv->tx_power = rp->tx_power; +hci_dev_unlock (hdev); } }
@@ -1291,9 +1296,13 @@ static int hci_set_ext_adv_data_sync(strint err;if (instance) { +hci_dev_lock (hdev); + adv =hci_find_adv_instance (hdev, instance); -if (!adv || !adv->adv_data_changed) +if (!adv || !adv->adv_data_changed) { +hci_dev_unlock (hdev);return 0 ; + } } len = eir_create_adv_data(hdev, instance, pdu->data,
@@ -1304,16 +1313,27 @@ static int hci_set_ext_adv_data_sync(str pdu->operation =LE_SET_ADV_DATA_OP_COMPLETE ; pdu->frag_pref =LE_SET_ADV_DATA_NO_FRAG ; +if (adv) { + adv->adv_data_changed = false; +hci_dev_unlock (hdev); + } + err =__hci_cmd_sync_status (hdev,HCI_OP_LE_SET_EXT_ADV_DATA ,struct_size (pdu, data, len), pdu,HCI_CMD_TIMEOUT ); -if (err) +if (err) { +if (instance) { +hci_dev_lock (hdev); + adv =hci_find_adv_instance (hdev, instance); +if (adv) + adv->adv_data_changed = true; +hci_dev_unlock (hdev); + } +return err; + } -/* Update data if the command succeed */ -if (adv) { - adv->adv_data_changed = false; - }else { +if (!instance) {memcpy (hdev->adv_data, pdu->data, len); hdev->adv_data_len = len; }
@@ -1367,22 +1387,22 @@ int hci_setup_ext_adv_instance_sync(strustruct adv_info *adv;bool secondary_adv; -if (instance >0 ) { - adv =hci_find_adv_instance (hdev, instance); -if (!adv) -return -EINVAL ; - }else { - adv =NULL ; - } -/* Updating parameters of an active instance will return a -* Command Disallowed error, so we must first disable the -* instance if it is active. +* Command Disallowed error, so disable it before taking a snapshot. */ -if (adv) { +if (instance >0 ) { err =hci_disable_ext_adv_instance_sync (hdev, instance);if (err)return err; + +hci_dev_lock (hdev); + adv =hci_find_adv_instance (hdev, instance); +if (!adv) { +hci_dev_unlock (hdev); +return -EINVAL ; + } + }else { + adv =NULL ; } flags =hci_adv_instance_flags (hdev, instance);
@@ -1393,8 +1413,11 @@ int hci_setup_ext_adv_instance_sync(stru connectable = (flags &MGMT_ADV_FLAG_CONNECTABLE ) ||mgmt_get_connectable (hdev); -if (!is_advertising_allowed (hdev, connectable)) +if (!is_advertising_allowed (hdev, connectable)) { +if (instance) +hci_dev_unlock (hdev);return -EPERM ; + }/* Set require_privacy to true only when non-connectable * advertising is used and it is not periodic.
@@ -1405,8 +1428,11 @@ int hci_setup_ext_adv_instance_sync(stru err =hci_get_random_address (hdev, require_privacy,adv_use_rpa (hdev, flags), adv, &own_addr_type, &random_addr); -if (err <0 ) +if (err <0 ) { +if (instance) +hci_dev_unlock (hdev);return err; + }memset (&cp,0 ,sizeof (cp));
@@ -1455,6 +1481,9 @@ int hci_setup_ext_adv_instance_sync(stru cp.channel_map = hdev->le_adv_channel_map; cp.handle = instance; +if (instance) +hci_dev_unlock (hdev); +if (flags &MGMT_ADV_FLAG_SEC_2M ) { cp.primary_phy =HCI_ADV_PHY_1M ; cp.secondary_phy =HCI_ADV_PHY_2M ;
@@ -1467,12 +1496,12 @@ int hci_setup_ext_adv_instance_sync(stru cp.secondary_phy =HCI_ADV_PHY_1M ; } - err =hci_set_ext_adv_params_sync (hdev, adv, &cp, &rp); + err =hci_set_ext_adv_params_sync (hdev, instance, &cp, &rp);if (err)return err;/* Update adv data as tx power is known now */ - err =hci_set_ext_adv_data_sync (hdev, cp.handle); + err =hci_set_ext_adv_data_sync (hdev, instance);if (err)return err;
@@ -1480,9 +1509,14 @@ int hci_setup_ext_adv_instance_sync(stru own_addr_type == ADDR_LE_DEV_RANDOM_RESOLVED) && bacmp(&random_addr, BDADDR_ANY)) {/* Check if random address need to be updated */ -if (adv) { -if (!bacmp (&random_addr, &adv->random_addr)) +if (instance) { +hci_dev_lock (hdev); + adv =hci_find_adv_instance (hdev, instance); +if (!adv || !bacmp (&random_addr, &adv->random_addr)) { +hci_dev_unlock (hdev);return 0 ; + } +hci_dev_unlock (hdev); }else {if (!bacmp (&random_addr, &hdev->random_addr))return 0 ;
@@ -1504,9 +1538,13 @@ static int hci_set_ext_scan_rsp_data_synint err;if (instance) { +hci_dev_lock (hdev); + adv =hci_find_adv_instance (hdev, instance); -if (!adv || !adv->scan_rsp_changed) +if (!adv || !adv->scan_rsp_changed) { +hci_dev_unlock (hdev);return 0 ; + } } len =eir_create_scan_rsp (hdev, instance, pdu->data);
@@ -1516,15 +1554,27 @@ static int hci_set_ext_scan_rsp_data_syn pdu->operation =LE_SET_ADV_DATA_OP_COMPLETE ; pdu->frag_pref =LE_SET_ADV_DATA_NO_FRAG ; +if (adv) { + adv->scan_rsp_changed = false; +hci_dev_unlock (hdev); + } + err =__hci_cmd_sync_status (hdev,HCI_OP_LE_SET_EXT_SCAN_RSP_DATA ,struct_size (pdu, data, len), pdu,HCI_CMD_TIMEOUT ); -if (err) +if (err) { +if (instance) { +hci_dev_lock (hdev); + adv =hci_find_adv_instance (hdev, instance); +if (adv) + adv->scan_rsp_changed = true; +hci_dev_unlock (hdev); + } +return err; + } -if (adv) { - adv->scan_rsp_changed = false; - }else { +if (!instance) {memcpy (hdev->scan_rsp_data, pdu->data, len); hdev->scan_rsp_data_len = len; }
@@ -1539,8 +1589,14 @@ static int __hci_set_scan_rsp_data_sync(memset (&cp,0 ,sizeof (cp)); +if (instance) +hci_dev_lock (hdev); + len =eir_create_scan_rsp (hdev, instance, cp.data); +if (instance) +hci_dev_unlock (hdev); +if (hdev->scan_rsp_data_len == len && !memcmp (cp.data, hdev->scan_rsp_data, len))return 0 ;
@@ -1673,9 +1729,13 @@ static int hci_set_per_adv_data_sync(strstruct adv_info *adv =NULL ;if (instance) { +hci_dev_lock (hdev); + adv =hci_find_adv_instance (hdev, instance); -if (!adv || !adv->periodic) +if (!adv || !adv->periodic) { +hci_dev_unlock (hdev);return 0 ; + } } len =eir_create_per_adv_data (hdev, instance, pdu->data);
@@ -1684,6 +1744,9 @@ static int hci_set_per_adv_data_sync(str pdu->handle = adv ? adv->handle : instance; pdu->operation =LE_SET_ADV_DATA_OP_COMPLETE ; +if (adv) +hci_dev_unlock (hdev); +return __hci_cmd_sync_status (hdev,HCI_OP_LE_SET_PER_ADV_DATA ,struct_size (pdu, data, len), pdu,HCI_CMD_TIMEOUT );
@@ -6215,7 +6278,7 @@ static int hci_le_ext_directed_advertisiif (err)return err; - err =hci_set_ext_adv_params_sync (hdev,NULL , &cp, &rp); + err =hci_set_ext_adv_params_sync (hdev,0 , &cp, &rp);if (err)return err;
Greg Kroah-Hartman
maintainerPATCH 246/303 ksmbd: conn lock to serialize smb2 negotiate
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
[ Upstream commit fe4ed2f09b492e3507615a053814daa8fafdecb1 ]
If client send parallel smb2 negotiate request on same connection, ksmbd_conn can be racy. smb2 negotiate handling that are not performance-related can be serialized with conn lock.
Stable-dep-of: cb469993b3a6 ("ksmbd: reject repeated SMB2 NEGOTIATE requests")
--- fs/smb/server/smb2pdu.c | 2 ++ 1 file changed, 2 insertions(+)
fs/smb/server/smb2pdu.c +2 -0
@@ -1126,6 +1126,7 @@ int smb2_handle_negotiate(struct ksmbd_wreturn rc; } +ksmbd_conn_lock (conn); smb2_buf_len =get_rfc1002_len (work->request_buf); smb2_neg_size = offsetof(struct smb2_negotiate_req , Dialects);if (smb2_neg_size > smb2_buf_len) {
@@ -1275,6 +1276,7 @@ int smb2_handle_negotiate(struct ksmbd_wksmbd_conn_set_need_negotiate (conn); err_out: +ksmbd_conn_unlock (conn);if (rc) rsp->hdr.Status =STATUS_INSUFFICIENT_RESOURCES ;
Greg Kroah-Hartman
maintainerPATCH 247/303 ksmbd: reject repeated SMB2 NEGOTIATE requests
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
[ Upstream commit cb469993b3a61a72653770856d37af616d72d05f ]
Unauthenticated client can send multiple successful SMB2 NEGOTIATE requests on one connection before SESSION_SETUP. While the connection is in KSMBD_SESS_NEED_SETUP, smb2_handle_negotiate() accepts another SMB3.1.1 NEGOTIATE and overwrites conn->preauth_info with a new allocation. Only the final allocation is freed when the connection is released, leaking one object for every additional successful request.
A repeated SMB2 NEGOTIATE after a dialect has been selected is a protocol violation. MS-SMB2 section 3.3.5.4 requires the server to disconnect without replying in this case. Set the connection exiting when rejecting the request, in addition to suppressing the response.
Reject SMB2 NEGOTIATE unless the connection is new or is waiting for the SMB2 NEGOTIATE that follows an SMB1 multi-protocol negotiate. Serialize both SMB1 and SMB2 negotiation paths under conn->srv_mutex, since they update connection-wide dialect and negotiation state.
Move the locking contract to ksmbd_smb_negotiate_common(), where the state and dialect are selected, and add ksmbd_conn_new() for consistent state access.
--- fs/smb/server/connection.h | 5 +++++ fs/smb/server/smb2pdu.c | 10 ++-------- fs/smb/server/smb_common.c | 37 ++++++++++++++++++++++++++++++------- 3 files changed, 37 insertions(+), 15 deletions(-)
fs/smb/server/connection.h +5 -0
@@ -182,6 +182,11 @@ void ksmbd_conn_unlock(struct ksmbd_conn* This is a hack. We will move status to a proper place once we land * a multi-sessions support. */ +static inline bool ksmbd_conn_new (struct ksmbd_conn *conn) +{ +return READ_ONCE (conn->status) ==KSMBD_SESS_NEW ; +} +static inline bool ksmbd_conn_good (struct ksmbd_conn *conn) {return READ_ONCE (conn->status) ==KSMBD_SESS_GOOD ;
fs/smb/server/smb2pdu.c +2 -8
@@ -1107,6 +1107,8 @@ static __le32 deassemble_neg_contexts(st* smb2_handle_negotiate() - handler for smb2 negotiate command * @work: smb work containing smb request buffer * +* The caller holds conn->srv_mutex. +* * Return: 0 */ int smb2_handle_negotiate (struct ksmbd_work *work)
@@ -1120,13 +1122,6 @@ int smb2_handle_negotiate(struct ksmbd_wksmbd_debug (SMB ,"Received negotiate request\n" ); conn->need_neg = false; -if (ksmbd_conn_good (conn)) { -pr_err ("conn->tcp_status is already in CifsGood State\n" ); - work->send_no_response =1 ; -return rc; - } - -ksmbd_conn_lock (conn); smb2_buf_len =get_rfc1002_len (work->request_buf); smb2_neg_size = offsetof(struct smb2_negotiate_req , Dialects);if (smb2_neg_size > smb2_buf_len) {
@@ -1276,7 +1271,6 @@ int smb2_handle_negotiate(struct ksmbd_wksmbd_conn_set_need_negotiate (conn); err_out: -ksmbd_conn_unlock (conn);if (rc) rsp->hdr.Status =STATUS_INSUFFICIENT_RESOURCES ;
fs/smb/server/smb_common.c +30 -7
@@ -585,23 +585,46 @@ int ksmbd_smb_negotiate_common(struct ksstruct ksmbd_conn *conn = work->conn;int ret; - conn->dialect = -ksmbd_negotiate_smb_dialect (work->request_buf); -ksmbd_debug (SMB ,"conn->dialect 0x%x\n" , conn->dialect); -if (command ==SMB2_NEGOTIATE_HE ) { +/* +* An SMB2 NEGOTIATE is valid for a new connection, or after an +* SMB1 multi-protocol negotiate has selected SMB2. Do not allow +* a second SMB2 NEGOTIATE to replace connection-wide state +* while a session setup is pending. KSMBD_SESS_NEED_RECONNECT +* is a transient session state and does not restart transport +* negotiation. +*/ +ksmbd_conn_lock (conn); +if (!ksmbd_conn_new (conn) && + !ksmbd_conn_need_negotiate (conn)) { + work->send_no_response =1 ; +ksmbd_conn_set_exiting (conn); +ksmbd_conn_unlock (conn); +return 0 ; + } + + conn->dialect = +ksmbd_negotiate_smb_dialect (work->request_buf); +ksmbd_debug (SMB ,"conn->dialect 0x%x\n" , conn->dialect); ret =smb2_handle_negotiate (work); +ksmbd_conn_unlock (conn);return ret; }if (command ==SMB_COM_NEGOTIATE ) { +ksmbd_conn_lock (conn); + conn->dialect = +ksmbd_negotiate_smb_dialect (work->request_buf); +ksmbd_debug (SMB ,"conn->dialect 0x%x\n" , conn->dialect);if (__smb2_negotiate (conn)) {init_smb3_11_server (conn); -init_smb2_neg_rsp (work); + ret =init_smb2_neg_rsp (work);ksmbd_debug (SMB ,"Upgrade to SMB2 negotiation\n" ); -return 0 ; + }else { + ret =smb_handle_negotiate (work); } -return smb_handle_negotiate (work); +ksmbd_conn_unlock (conn); +return ret; }pr_err ("Unknown SMB negotiation command: %u\n" , command);
Greg Kroah-Hartman
maintainerPATCH 248/303 igc: remove napi_synchronize() in igc_down()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Carlier <[email protected]>
[ Upstream commit 5ffab5b9589c50e4cfc0cf36ffd76c89422d4019 ]
When an AF_XDP zero-copy application is killed abruptly, the XSK pool is torn down but NAPI keeps polling. igc_clean_rx_irq_zc() then returns the full budget on every poll, so napi_complete_done() never clears NAPI_STATE_SCHED.
igc_down() calls napi_synchronize() before napi_disable(), so it spins forever waiting for that bit and the interface never goes down. Drop the napi_synchronize() and let napi_disable() do the job -- it sets NAPI_STATE_DISABLE, which forces the stuck poll to complete. Reorder it ahead of igc_set_queue_napi() so the NAPI mapping is cleared only after polling has stopped, matching the recent igb fix b1e067240379.
--- drivers/net/ethernet/intel/igc/igc_main.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/ethernet/intel/igc/igc_main.c +0 -1
@@ -5034,7 +5034,6 @@ void igc_down(struct igc_adapter *adaptefor (i =0 ; i < adapter->num_q_vectors; i++) {if (adapter->q_vector[i]) { -napi_synchronize (&adapter->q_vector[i]->napi);napi_disable (&adapter->q_vector[i]->napi); } }
Greg Kroah-Hartman
maintainerPATCH 249/303 net: pktgen: fix code style (WARNING: Block comments)
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Seiderer <[email protected]>
[ Upstream commit 870b856cb478bc02fffe4d89897e62c692efb09a ]
Fix checkpatch code style warnings:
WARNING: Block comments use a trailing */ on a separate line
+ * removal by worker thread */
WARNING: Block comments use * on subsequent lines
+ __u8 tos; /* six MSB of (former) IPv4 TOS
+ are for dscp codepoint */
WARNING: Block comments use a trailing */ on a separate line
+ are for dscp codepoint */
WARNING: Block comments use * on subsequent lines
+ __u8 traffic_class; /* ditto for the (former) Traffic Class in IPv6
+ (see RFC 3260, sec. 4) */
WARNING: Block comments use a trailing */ on a separate line
+ (see RFC 3260, sec. 4) */
WARNING: Block comments use * on subsequent lines
+ /* = {
+ 0x00, 0x80, 0xC8, 0x79, 0xB3, 0xCB,
WARNING: Block comments use * on subsequent lines
+ /* Field for thread to receive "posted" events terminate,
+ stop ifs etc. */
WARNING: Block comments use a trailing */ on a separate line
+ stop ifs etc. */
WARNING: Block comments should align the * on each line
+ * we go look for it ...
+*/
WARNING: Block comments use a trailing */ on a separate line
+ * we resolve the dst issue */
WARNING: Block comments use a trailing */ on a separate line
+ * with proc_create_data() */
Stable-dep-of: 817ff6efdb7f ("net: pktgen: fix proc entry use-after-free")
--- net/core/pktgen.c | 39 +++++++++++++++++++++++---------------- 1 file changed, 23 insertions(+), 16 deletions(-)
net/core/pktgen.c +23 -16
@@ -284,7 +284,8 @@ struct pktgen_dev {int pkt_overhead;/* overhead for MPLS, VLANs, IPSEC etc */ int nfrags;int removal_mark;/* non-zero => the device is marked for -* removal by worker thread */ +* removal by worker thread +*/ struct page *page;u64 delay;/* nano-seconds */
@@ -347,10 +348,12 @@ struct pktgen_dev {__u16 udp_dst_max;/* exclusive, dest UDP port */ /* DSCP + ECN */ -__u8 tos;/* six MSB of (former) IPv4 TOS -are for dscp codepoint */ -__u8 traffic_class;/* ditto for the (former) Traffic Class in IPv6 -(see RFC 3260, sec. 4) */ +__u8 tos;/* six MSB of (former) IPv4 TOS +* are for dscp codepoint +*/ +__u8 traffic_class;/* ditto for the (former) Traffic Class in IPv6 +* (see RFC 3260, sec. 4) +*/ /* IMIX */ unsigned int n_imix_entries;
@@ -390,12 +393,12 @@ struct pktgen_dev {__u8 hh[14 ];/* = { -0x00, 0x80, 0xC8, 0x79, 0xB3, 0xCB, - -We fill in SRC address later -0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -0x08, 0x00 -}; +* 0x00, 0x80, 0xC8, 0x79, 0xB3, 0xCB, +* +* We fill in SRC address later +* 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, +* 0x08, 0x00 +* }; */ __u16 pad;/* pad out the hh struct to an even 16 bytes */
@@ -459,7 +462,8 @@ struct pktgen_thread {char result[512 ];/* Field for thread to receive "posted" events terminate, -stop ifs etc. */ +* stop ifs etc. +*/ u32 control;int cpu;
@@ -2343,7 +2347,7 @@ static inline int f_pick(struct pktgen_d#ifdef CONFIG_XFRM /* If there was already an IPSEC SA, we keep it as is, else * we go look for it ... -*/ +*/ #define DUMMY_MARK 0static void get_ipsec_sa (struct pktgen_dev *pkt_dev,int flow) {
@@ -2647,7 +2651,8 @@ static int pktgen_output_ipsec(struct skif (!x)return 0 ;/* XXX: we dont support tunnel mode for now until -* we resolve the dst issue */ +* we resolve the dst issue +*/ if ((x->props.mode !=XFRM_MODE_TRANSPORT ) && (pkt_dev->spi ==0 ))return 0 ;
@@ -3712,7 +3717,8 @@ static int add_dev_to_thread(struct pktg* userspace on another CPU than the kthread. The if_lock() * is used here to sync with concurrent instances of * _rem_dev_from_if_list() invoked via kthread, which is also -* updating the if_list */ +* updating the if_list +*/ if_lock (t);if (pkt_dev->pg_thread) {
@@ -3909,7 +3915,8 @@ static int pktgen_remove_device(struct p/* Remove proc before if_list entry, because add_device uses * list to determine if interface already exist, avoid race -* with proc_create_data() */ +* with proc_create_data() +*/ proc_remove (pkt_dev->entry);/* And update the thread if_list */
Greg Kroah-Hartman
maintainerPATCH 250/303 net: pktgen: fix proc entry use-after-free
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengfeng Ye <[email protected]>
[ Upstream commit 817ff6efdb7f484ea547218e11e17d8e43daa3b4 ]
pktgen_change_name() replaces pkt_dev->entry while holding t->if_lock. pktgen_remove_device() removes the same entry before _rem_dev_from_if_list() takes that lock.
This allows the following interleaving:
CPU 0 (NETDEV_CHANGENAME) CPU 1 (kpktgend)
if_lock(t)
proc_remove(pkt_dev->entry)
proc_remove(pkt_dev->entry)
pkt_dev->entry = proc_create_data(...)
if_unlock(t)
The kthread can pass the stale proc_dir_entry to proc_remove() after the rename path has freed it. A reproducer with a widened race window reports:
BUG: KASAN: slab-use-after-free in proc_remove+0x78/0x80 Read of size 8 at addr ffff8881478fea70 by task kpktgend_0/67 Call Trace: proc_remove+0x78/0x80 pktgen_remove_device.isra.0+0x11c/0x4c0 pktgen_thread_worker+0x1214/0x6bc0 kthread+0x2c6/0x3b0 Allocated by task 95: __proc_create+0x204/0x790 proc_create_data+0x72/0xe0 pktgen_thread_write+0xd61/0x1510 Freed by task 28: kmem_cache_free+0xcb/0x3d0 proc_free_inode+0x5b/0x80 rcu_core+0x50a/0x1850 The buggy address belongs to the object at ffff8881478fea00 which belongs to the cache proc_dir_entry of size 192
Move proc_remove() into the if_lock-protected list removal helper. Keep it before list_del_rcu() to preserve the ordering required by add_device(). The rename path must then finish replacing the entry before removal, or it observes that the device is no longer on the list.
--- net/core/pktgen.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
net/core/pktgen.c +1 -3
@@ -3888,6 +3888,7 @@ static void _rem_dev_from_if_list(structstruct pktgen_dev *p;if_lock (t); +proc_remove (pkt_dev->entry);list_for_each_safe (q, n, &t->if_list) { p = list_entry(q, struct pktgen_dev, list);if (p == pkt_dev)
@@ -3917,9 +3918,6 @@ static int pktgen_remove_device(struct p* list to determine if interface already exist, avoid race * with proc_create_data() */ -proc_remove (pkt_dev->entry); - -/* And update the thread if_list */ _rem_dev_from_if_list (t, pkt_dev);#ifdef CONFIG_XFRM
Greg Kroah-Hartman
maintainerPATCH 251/303 veth: convert frag_list skbs before running XDP
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Fleming <[email protected]>
[ Upstream commit d0d6415963040c401e7a7e4e482a698ba52448cb ]
A frag_list skb can reach veth with data_len set but nr_frags zero. veth_convert_skb_to_xdp_buff() only converts skbs that are shared, locked, have frags[], or do not have enough headroom. It later uses skb_is_nonlinear() to decide whether to set XDP_FLAGS_HAS_FRAGS and xdp_frags_size.
That exposes frag_list data to XDP as if it were stored in frags[], but frags[] is empty. AF_XDP copy mode can then trust the bogus XDP fragment metadata, walk an empty fragment entry, and crash in memcpy() from __xsk_rcv().
Route non-linear skbs through skb_pp_cow_data() before exposing them to XDP, and only advertise XDP frags when the resulting skb has frags[]. skb_copy_bits() already handles frag_list input, and skb_pp_cow_data() builds frags[] output with skb_add_rx_frag(), which is the representation XDP multi-buffer expects.
--- drivers/net/veth.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/veth.c +2 -2
@@ -695,7 +695,7 @@ static int veth_convert_skb_to_xdp_buff(u32 frame_sz;if (skb_shared (skb) ||skb_head_is_locked (skb) || -skb_shinfo (skb)->nr_frags || +skb_is_nonlinear (skb) ||skb_headroom (skb) <XDP_PACKET_HEADROOM ) {u32 size, len, max_head_size, off;struct sk_buff *nskb;
@@ -770,7 +770,7 @@ static int veth_convert_skb_to_xdp_buff(xdp_prepare_buff (xdp, skb->head,skb_headroom (skb),skb_headlen (skb), true); -if (skb_is_nonlinear (skb)) { +if (skb_shinfo (skb)->nr_frags) {skb_shinfo (skb)->xdp_frags_size = skb->data_len;xdp_buff_set_frags_flag (xdp); }else {
Greg Kroah-Hartman
maintainerPATCH 252/303 ice: fix VF interrupts cleanup
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dawid Osuchowski <[email protected]>
[ Upstream commit fb096882095e5a8d6b5159e43793d4a38a0c5b1f ]
When a virtual function sends an IRQ map command, the PF will set up interrupts according to that request. However, because these interrupts are never reset, the next time Virtual Function initializes, the interrupts are still enabled for a given VF, which leads to performance degradation in certain cases due to interrupts being unexpectedly enabled and thus causing interrupt floods.
--- drivers/net/ethernet/intel/ice/ice_vf_lib.c | 27 ++++++++++++++++++++ drivers/net/ethernet/intel/ice/ice_vf_lib_private.h | 1 drivers/net/ethernet/intel/ice/ice_virtchnl.c | 21 +++++++++++++++ 3 files changed, 49 insertions(+)
drivers/net/ethernet/intel/ice/ice_vf_lib.c +27 -0
@@ -555,6 +555,30 @@ static void ice_notify_vf_reset(struct i }/** +* ice_reset_interrupts - clear all queue interrupt configuration for a VSI +* @vsi: the VSI whose interrupt registers should be cleared +* +* Zero the QINT_RQCTL and QINT_TQCTL registers for all allocated queues +* in the VSI. This clears the entire register including MSIX_INDX, ITR_INDX, +* CAUSE_ENA and NEXTQ fields, unlike ice_vf_dis_rxq_interrupt() which only +* clears the CAUSE_ENA bit. +*/ +void ice_reset_interrupts (struct ice_vsi *vsi) +{ +struct ice_pf *pf = vsi->back; +struct ice_hw *hw = &pf->hw; +int i; + +ice_for_each_alloc_rxq (vsi, i) +wr32 (hw,QINT_RQCTL (vsi->rxq_map[i]),0 ); + +ice_for_each_alloc_txq (vsi, i) +wr32 (hw,QINT_TQCTL (vsi->txq_map[i]),0 ); + +ice_flush (hw); +} + +/** * ice_reset_vf - Reset a particular VF * @vf: pointer to the VF structure * @flags: flags controlling behavior of the reset
@@ -623,6 +647,9 @@ int ice_reset_vf(struct ice_vf *vf, u32ice_dis_vf_qs (vf); +/* cleanup interrupt registers */ +ice_reset_interrupts (vsi); +/* Call Disable LAN Tx queue AQ whether or not queues are * enabled. This is needed for successful completion of VFR. */
drivers/net/ethernet/intel/ice/ice_vf_lib_private.h +1 -0
@@ -24,6 +24,7 @@#endif void ice_dis_vf_qs (struct ice_vf *vf); +void ice_reset_interrupts (struct ice_vsi *vsi);int ice_check_vf_init (struct ice_vf *vf);struct ice_port_info *ice_vf_get_port_info (struct ice_vf *vf);int ice_vsi_apply_spoofchk (struct ice_vsi *vsi,bool enable);
drivers/net/ethernet/intel/ice/ice_virtchnl.c +21 -0
@@ -1210,6 +1210,24 @@ static void ice_vf_ena_rxq_interrupt(str }/** +* ice_vf_dis_rxq_interrupt - disable Rx queue interrupt via QINT_RQCTL +* @vsi: VSI of the VF to configure +* @q_idx: VF queue index used to determine the queue in the PF's space +*/ +static void ice_vf_dis_rxq_interrupt (struct ice_vsi *vsi,u32 q_idx) +{ +struct ice_hw *hw = &vsi->back->hw; +u32 pfq = vsi->rxq_map[q_idx]; +u32 reg; + + reg =rd32 (hw,QINT_RQCTL (pfq)); + reg &= ~QINT_RQCTL_CAUSE_ENA_M ; +wr32 (hw,QINT_RQCTL (pfq), reg); + +ice_flush (hw); +} + +/** * ice_vc_ena_qs_msg * @vf: pointer to the VF info * @msg: pointer to the msg buffer
@@ -1402,6 +1420,8 @@ static int ice_vc_dis_qs_msg(struct ice_ goto error_param; } +for_each_set_bit (vf_q_id, &q_map,ICE_MAX_RSS_QS_PER_VF ) +ice_vf_dis_rxq_interrupt (vsi, vf_q_id);bitmap_zero (vf->rxq_ena,ICE_MAX_RSS_QS_PER_VF ); }else if (q_map) {for_each_set_bit (vf_q_id, &q_map,ICE_MAX_RSS_QS_PER_VF ) {
@@ -1422,6 +1442,7 @@ static int ice_vc_dis_qs_msg(struct ice_ goto error_param; } +ice_vf_dis_rxq_interrupt (vsi, vf_q_id);/* Clear enabled queues flag */ clear_bit (vf_q_id, vf->rxq_ena); }
Greg Kroah-Hartman
maintainerPATCH 253/303 ice: fix memory leak in ice_lbtest_prepare_rings()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dawei Feng <[email protected]>
[ Upstream commit 3a9de5590da4ffd9e9c541c4c4d492aa2b54cf6e ]
ice_lbtest_prepare_rings() frees Rx rings only when ice_vsi_start_all_rx_rings() fails. If ice_vsi_setup_rx_rings() fails after allocating some descriptors, or if ice_vsi_cfg_lan() fails after the Rx rings were prepared, the function reaches the Tx cleanup path without releasing the initialized Rx resources.
Fix this by adding separate unwind paths for Rx setup failure and LAN configuration failure. The Rx setup failure path releases the partially prepared Rx rings before freeing Tx rings, while later failures first undo the LAN Tx configuration and then release the Rx rings in reverse setup order.
The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1-rc7.
An x86_64 allyesconfig build showed no new warnings. As we do not have an Intel E800 Series adapter available to run the ethtool offline loopback selftest, no runtime testing was able to be performed.
--- drivers/net/ethernet/intel/ice/ice_ethtool.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/net/ethernet/intel/ice/ice_ethtool.c +5 -5
@@ -489,18 +489,18 @@ static int ice_lbtest_prepare_rings(stru status =ice_vsi_cfg (vsi);if (status) - goto err_setup_rx_ring; + goto err_cfg_lan; status =ice_vsi_start_all_rx_rings (vsi);if (status) - goto err_start_rx_ring; + goto err_cfg_lan;return status; -err_start_rx_ring: -ice_vsi_free_rx_rings (vsi); -err_setup_rx_ring: +err_cfg_lan:ice_vsi_stop_lan_tx_rings (vsi,ICE_NO_RESET ,0 ); +err_setup_rx_ring: +ice_vsi_free_rx_rings (vsi); err_setup_tx_ring:ice_vsi_free_tx_rings (vsi);
Greg Kroah-Hartman
maintainerPATCH 254/303 fsnotify: opt-in for permission events at file open time
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Goldstein <[email protected]>
[ Upstream commit a94204f4d48e28a711b7ed10399f749286c433e3 ]
Legacy inotify/fanotify listeners can add watches for events on inode, parent or mount and expect to get events (e.g. FS_MODIFY) on files that were already open at the time of setting up the watches.
fanotify permission events are typically used by Anti-malware sofware, that is watching the entire mount and it is not common to have more that one Anti-malware engine installed on a system.
To reduce the overhead of the fsnotify_file_perm() hooks on every file access, relax the semantics of the legacy FAN_ACCESS_PERM event to generate events only if there were *any* permission event listeners on the filesystem at the time that the file was opened.
The new semantic is implemented by extending the FMODE_NONOTIFY bit into two FMODE_NONOTIFY_* bits, that are used to store a mode for which of the events types to report.
This is going to apply to the new fanotify pre-content events in order to reduce the cost of the new pre-content event vfs hooks.
[Thanks to Bert Karwatzki <[email protected]> for reporting a bug in this code with CONFIG_FANOTIFY_ACCESS_PERMISSIONS disabled]
Stable-dep-of: db1856ea9196 ("binfmt_misc: restore write access when removing an entry")
--- include/linux/fs.h | 6 ++++++ 1 file changed, 6 insertions(+)
include/linux/fs.h +6 -0
@@ -185,6 +185,12 @@ typedef int (dio_iodone_t)(struct kiocb#define FMODE_BUF_WASYNC ((__force fmode_t)0x80000000)/* +* fsnotify pre-content events do not exist in this kernel, so a file is never +* watched by a pre-content event listener. +*/ +#define FMODE_FSNOTIFY_HSM (mode) 0 + +/* * Attribute flags. These should be or-ed together to figure out what * has been changed! */
Greg Kroah-Hartman
maintainerPATCH 255/303 fs: dont block write during exec on pre-content watched files
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Goldstein <[email protected]>
[ Upstream commit 0357ef03c94ef835bd44a0658b8edb672a9dbf51 ]
Commit 2a010c412853 ("fs: don't block i_writecount during exec") removed the legacy behavior of getting ETXTBSY on attempt to open and executable file for write while it is being executed.
This commit was reverted because an application that depends on this legacy behavior was broken by the change.
We need to allow HSM writing into executable files while executed to fill their content on-the-fly.
To that end, disable the ETXTBSY legacy behavior for files that are watched by pre-content events.
This change is not expected to cause regressions with existing systems which do not have any pre-content event listeners.
Stable-dep-of: db1856ea9196 ("binfmt_misc: restore write access when removing an entry")
--- fs/binfmt_elf.c | 4 ++-- fs/binfmt_elf_fdpic.c | 4 ++-- fs/exec.c | 6 +++--- include/linux/fs.h | 22 ++++++++++++++++++++++ kernel/fork.c | 12 ++++++------ 5 files changed, 35 insertions(+), 13 deletions(-)
fs/binfmt_elf.c +2 -2
@@ -1288,7 +1288,7 @@ out_free_interp: } reloc_func_desc = interp_load_addr; -allow_write_access (interpreter); +exe_file_allow_write_access (interpreter);fput (interpreter);kfree (interp_elf_ex);
@@ -1397,7 +1397,7 @@ out_free_dentry:kfree (interp_elf_ex);kfree (interp_elf_phdata); out_free_file: -allow_write_access (interpreter); +exe_file_allow_write_access (interpreter);if (interpreter)fput (interpreter); out_free_ph:
fs/binfmt_elf_fdpic.c +2 -2
@@ -398,7 +398,7 @@ static int load_elf_fdpic_binary(struct goto error; } -allow_write_access (interpreter); +exe_file_allow_write_access (interpreter);fput (interpreter); interpreter =NULL ; }
@@ -471,7 +471,7 @@ static int load_elf_fdpic_binary(struct error:if (interpreter) { -allow_write_access (interpreter); +exe_file_allow_write_access (interpreter);fput (interpreter); }kfree (interpreter_name);
fs/exec.c +3 -3
@@ -937,7 +937,7 @@ static struct file *do_open_execat(int f path_noexec(&file->f_path)) goto exit; - err =deny_write_access (file); + err =exe_file_deny_write_access (file);if (err) goto exit;
@@ -1520,7 +1520,7 @@ static void free_bprm(struct linux_binprabort_creds (bprm->cred); }if (bprm->file) { -allow_write_access (bprm->file); +exe_file_allow_write_access (bprm->file);fput (bprm->file); }if (bprm->executable)
@@ -1812,7 +1812,7 @@ static int exec_binprm(struct linux_binp bprm->file = bprm->interpreter; bprm->interpreter =NULL ; -allow_write_access (exec); +exe_file_allow_write_access (exec);if (unlikely (bprm->have_execfd)) {if (bprm->executable) {fput (exec);
include/linux/fs.h +22 -0
@@ -3115,6 +3115,28 @@ static inline void allow_write_access(stif (file)atomic_inc (&file_inode (file)->i_writecount); } + +/* +* Do not prevent write to executable file when watched by pre-content events. +* +* Note that FMODE_FSNOTIFY_HSM mode is set depending on pre-content watches at +* the time of file open and remains constant for entire lifetime of the file, +* so if pre-content watches are added post execution or removed before the end +* of the execution, it will not cause i_writecount reference leak. +*/ +static inline int exe_file_deny_write_access (struct file *exe_file) +{ +if (unlikely (FMODE_FSNOTIFY_HSM (exe_file->f_mode))) +return 0 ; +return deny_write_access (exe_file); +} +static inline void exe_file_allow_write_access (struct file *exe_file) +{ +if (unlikely (!exe_file ||FMODE_FSNOTIFY_HSM (exe_file->f_mode))) +return ; +allow_write_access (exe_file); +} +static inline bool inode_is_open_for_write (const struct inode *inode) {return atomic_read (&inode->i_writecount) >0 ;
kernel/fork.c +6 -6
@@ -576,8 +576,8 @@ static void dup_mm_exe_file(struct mm_st* We depend on the oldmm having properly denied write access to the * exe_file already. */ -if (exe_file &&deny_write_access (exe_file)) -pr_warn_once ("deny_write_access() failed in %s\n" , __func__); +if (exe_file &&exe_file_deny_write_access (exe_file)) +pr_warn_once ("exe_file_deny_write_access() failed in %s\n" , __func__); }#ifdef CONFIG_MMU
@@ -1279,13 +1279,13 @@ int set_mm_exe_file(struct mm_struct *mm* We expect the caller (i.e., sys_execve) to already denied * write access, so this is unlikely to fail. */ -if (unlikely (deny_write_access (new_exe_file))) +if (unlikely (exe_file_deny_write_access (new_exe_file)))return -EACCES ;get_file (new_exe_file); }rcu_assign_pointer (mm->exe_file, new_exe_file);if (old_exe_file) { -allow_write_access (old_exe_file); +exe_file_allow_write_access (old_exe_file);fput (old_exe_file); }return 0 ;
@@ -1327,7 +1327,7 @@ int replace_mm_exe_file(struct mm_struct }/* set the new file, lockless */ - ret =deny_write_access (new_exe_file); + ret =exe_file_deny_write_access (new_exe_file);if (ret)return -EACCES ;get_file (new_exe_file);
@@ -1339,7 +1339,7 @@ int replace_mm_exe_file(struct mm_struct* write access while someone might open the file writable. */ mmap_read_lock (mm); -allow_write_access (old_exe_file); +exe_file_allow_write_access (old_exe_file);fput (old_exe_file);mmap_read_unlock (mm); }
Greg Kroah-Hartman
maintainerPATCH 256/303 binfmt_misc: restore write access when removing an entry
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Brauner <[email protected]>
[ Upstream commit db1856ea9196cf6e015d12199a34c0b9313c7bfa ]
Registering an entry with the MISC_FMT_OPEN_FILE flag opens the interpreter via open_exec() which denies write access to it for as long as the entry exists. Removing the entry closes the interpreter file via filp_close() but never restores write access, leaving the inode's i_writecount permanently negative. Opening the interpreter for writing keeps failing with ETXTBSY long after the entry is gone until the inode is evicted from the inode cache.
Commit 90f601b497d7 ("binfmt_misc: restore write access before closing files opened by open_exec()") fixed the same imbalance in the error path of bm_register_write() but the actual removal path has been leaking the write denial since the introduction of the flag.
Restore write access in put_binfmt_handler() before closing the interpreter file.
--- fs/binfmt_misc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/binfmt_misc.c +3 -1
@@ -163,8 +163,10 @@ static Node *get_binfmt_handler(struct lstatic void put_binfmt_handler (Node *e) {if (refcount_dec_and_test (&e->users)) { -if (e->flags &MISC_FMT_OPEN_FILE ) +if (e->flags &MISC_FMT_OPEN_FILE ) { +exe_file_allow_write_access (e->interp_file);filp_close (e->interp_file,NULL ); + }kfree (e); } }
Greg Kroah-Hartman
maintainerPATCH 257/303 i2c: bcm-iproc: remove printout on handled timeouts
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <[email protected]>
[ Upstream commit 796e2c260187e32530cf343546ba1cdf2e2f5491 ]
I2C and SMBus timeouts are not something the user needs to be informed about on controller level. The client driver may know if that really is a problem and give more detailed information to the user. The controller should just pass this information upwards. Remove the printout.
Stable-dep-of: 98f2e9e6d6f9 ("i2c: iproc: reset bus after timeout if START_BUSY is stuck")
--- drivers/i2c/busses/i2c-bcm-iproc.c | 2 -- 1 file changed, 2 deletions(-)
drivers/i2c/busses/i2c-bcm-iproc.c +0 -2
@@ -811,8 +811,6 @@ static int bcm_iproc_i2c_xfer_wait(struc }if (!time_left && !iproc_i2c->xfer_is_done) { -dev_err (iproc_i2c->device,"transaction timed out\n" ); -/* flush both TX/RX FIFOs */ val =BIT (M_FIFO_RX_FLUSH_SHIFT ) |BIT (M_FIFO_TX_FLUSH_SHIFT );iproc_i2c_wr_reg (iproc_i2c,M_FIFO_CTRL_OFFSET , val);
Greg Kroah-Hartman
maintainerPATCH 258/303 i2c: iproc: reset bus after timeout if START_BUSY is stuck
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
[ Upstream commit 98f2e9e6d6f91a6abb43f166b244b428ba85fa2b ]
If a transaction times out, the START_BUSY signal can stay up, and subsequent transactaction attempts will fail as the bus is still considered busy.
I can easily trigger this by attempting to read from an address with no device, e.g. when running i2cdetect. After the first read times out, all subsequent read attempts return busy.
To get to a working state again, the controller needs to be reset to clear the START_BUSY signal. So check for START_BUSY still asserted on a timeout, and do reset in case it is,
This is also done by the original non-upstream iproc-smbus driver implementation [1].
Works around situations like:
bcm-iproc-2c 1803b000.i2c: transaction timed out
bcm-iproc-2c 1803b000.i2c: bus is busy
bcm-iproc-2c 1803b000.i2c: bus is busy
bcm-iproc-2c 1803b000.i2c: bus is busy
bcm-iproc-2c 1803b000.i2c: bus is busy
bcm-iproc-2c 1803b000.i2c: bus is busy
...where the bus never recovers after a timeout.
--- drivers/i2c/busses/i2c-bcm-iproc.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/i2c/busses/i2c-bcm-iproc.c +11 -0
@@ -811,6 +811,17 @@ static int bcm_iproc_i2c_xfer_wait(struc }if (!time_left && !iproc_i2c->xfer_is_done) { +/* +* The controller may fail to clear START_BUSY after a timeout, +* reset the controller to recover in that case. +*/ +if (!!(iproc_i2c_rd_reg (iproc_i2c,M_CMD_OFFSET ) & +BIT (M_CMD_START_BUSY_SHIFT ))) { +bcm_iproc_i2c_enable_disable (iproc_i2c, false); +bcm_iproc_i2c_init (iproc_i2c); +bcm_iproc_i2c_enable_disable (iproc_i2c, true); + } +/* flush both TX/RX FIFOs */ val =BIT (M_FIFO_RX_FLUSH_SHIFT ) |BIT (M_FIFO_TX_FLUSH_SHIFT );iproc_i2c_wr_reg (iproc_i2c,M_FIFO_CTRL_OFFSET , val);
Greg Kroah-Hartman
maintainerPATCH 259/303 can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
[ Upstream commit 68c5724ecd159992f76edb7b57dc508a44c8b7da ]
If the allocation of the SKB in gs_usb_receive_bulk_callback() fails, the driver returns from the callback without resubmitting the URB in order to receive further USB in URBs.
This results in a silent performance degradation which, if it occurs repeatedly, results in starvation of USB in traffic.
Instead of returning immediately, try to resend the URB. If this also fails, this is logged as an info message.
--- drivers/net/can/usb/gs_usb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/can/usb/gs_usb.c +2 -2
@@ -574,7 +574,7 @@ static void gs_usb_receive_bulk_callbackif (hf->flags &GS_CAN_FLAG_FD ) { skb =alloc_canfd_skb (dev->netdev, &cfd);if (!skb) -return ; + goto resubmit_urb; cfd->can_id =le32_to_cpu (hf->can_id); cfd->len =can_fd_dlc2len (hf->can_dlc);
@@ -587,7 +587,7 @@ static void gs_usb_receive_bulk_callback }else { skb =alloc_can_skb (dev->netdev, &cf);if (!skb) -return ; + goto resubmit_urb; cf->can_id =le32_to_cpu (hf->can_id);can_frame_set_cc_len (cf, hf->can_dlc, dev->can.ctrlmode);
Greg Kroah-Hartman
maintainerPATCH 260/303 drm/amd/pm: fix torn gpu metrics reads
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Wang <[email protected]>
[ Upstream commit 048f4541b71fb19645fb79d6e62e6e4da23a4035 ]
amdgpu_dpm_get_gpu_metrics() returns a pointer to the shared metrics cache after dropping adev->pm.mutex. The sysfs path then copies from that pointer. Another reader can refresh the cache in place during the copy and return a snapshot containing data from two generations.
Pass caller-provided storage through the DPM interface and copy the metrics while the mutex is held. This keeps the cache pointer private and makes each sysfs read observe one complete sample.
--- drivers/gpu/drm/amd/pm/amdgpu_dpm.c | 12 +++++++++--- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 8 +------- drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h | 3 ++- 3 files changed, 12 insertions(+), 11 deletions(-)
drivers/gpu/drm/amd/pm/amdgpu_dpm.c +9 -3
@@ -1209,17 +1209,23 @@ int amdgpu_dpm_set_power_profile_mode(streturn ret; } -int amdgpu_dpm_get_gpu_metrics (struct amdgpu_device *adev,void **table) +ssize_t amdgpu_dpm_get_gpu_metrics (struct amdgpu_device *adev,void *buf, +size_t size) {const struct amd_pm_funcs *pp_funcs = adev->powerplay.pp_funcs; -int ret =0 ; +void *table; +ssize_t ret;if (!pp_funcs->get_gpu_metrics)return 0 ;mutex_lock (&adev->pm.mutex); ret = pp_funcs->get_gpu_metrics (adev->powerplay.pp_handle, - table); + &table); +if (ret >0 ) { + ret =min_t (ssize_t, ret, size); +memcpy (buf, table, ret); + }mutex_unlock (&adev->pm.mutex);return ret;
drivers/gpu/drm/amd/pm/amdgpu_pm.c +1 -7
@@ -1705,7 +1705,6 @@ static ssize_t amdgpu_get_gpu_metrics(st {struct drm_device *ddev =dev_get_drvdata (dev);struct amdgpu_device *adev =drm_to_adev (ddev); -void *gpu_metrics;ssize_t size =0 ;int ret;
@@ -1720,15 +1719,10 @@ static ssize_t amdgpu_get_gpu_metrics(streturn ret; } - size =amdgpu_dpm_get_gpu_metrics (adev, &gpu_metrics); + size =amdgpu_dpm_get_gpu_metrics (adev, buf,PAGE_SIZE -1 );if (size <=0 ) goto out; -if (size >=PAGE_SIZE ) - size =PAGE_SIZE -1 ; - -memcpy (buf, gpu_metrics, size); - out:pm_runtime_mark_last_busy (ddev->dev);pm_runtime_put_autosuspend (ddev->dev);
drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h +2 -1
@@ -489,7 +489,8 @@ int amdgpu_dpm_get_power_profile_mode(st char *buf);int amdgpu_dpm_set_power_profile_mode (struct amdgpu_device *adev,long *input,uint32_t size); -int amdgpu_dpm_get_gpu_metrics (struct amdgpu_device *adev,void **table); +ssize_t amdgpu_dpm_get_gpu_metrics (struct amdgpu_device *adev,void *buf, +size_t size);int amdgpu_dpm_get_fan_control_mode (struct amdgpu_device *adev,uint32_t *fan_mode); int amdgpu_dpm_set_fan_speed_pwm(struct amdgpu_device *adev,
Greg Kroah-Hartman
maintainerPATCH 261/303 drm/amd/pm: fix pptable use-after-free
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Wang <[email protected]>
[ Upstream commit bb493058c35c8676e48269ab6732688ea733d23c ]
amdgpu_dpm_get_pp_table() returns a pointer to a driver-owned power table after dropping adev->pm.mutex. The sysfs path then copies from that pointer. A concurrent pp_table write can replace and free the allocation during the copy, causing a use-after-free.
Change the DPM interface to copy into caller-provided storage while the mutex is held. Keep the size-only query for attribute discovery without exposing the driver-owned pointer.
--- drivers/gpu/drm/amd/pm/amdgpu_dpm.c | 15 +++++++++++++-- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 8 +------- drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h | 3 ++- 3 files changed, 16 insertions(+), 10 deletions(-)
drivers/gpu/drm/amd/pm/amdgpu_dpm.c +13 -2
@@ -950,17 +950,28 @@ int amdgpu_dpm_dispatch_task(struct amdgreturn ret; } -int amdgpu_dpm_get_pp_table (struct amdgpu_device *adev,char **table) +int amdgpu_dpm_get_pp_table (struct amdgpu_device *adev,char *table, +size_t size) {const struct amd_pm_funcs *pp_funcs = adev->powerplay.pp_funcs; +char *pptable =NULL ;int ret =0 ; +if ((!table && size) || (table && !size)) +return -EINVAL ; +if (!pp_funcs->get_pp_table)return 0 ;mutex_lock (&adev->pm.mutex); ret = pp_funcs->get_pp_table (adev->powerplay.pp_handle, - table); + &pptable); +if (ret >0 && !pptable) { + ret = -EINVAL ; + }else if (ret >0 && table) { + ret =min_t (size_t, ret, size); +memcpy (table, pptable, ret); + }mutex_unlock (&adev->pm.mutex);return ret;
drivers/gpu/drm/amd/pm/amdgpu_pm.c +1 -7
@@ -532,7 +532,6 @@ static ssize_t amdgpu_get_pp_table(struc {struct drm_device *ddev =dev_get_drvdata (dev);struct amdgpu_device *adev =drm_to_adev (ddev); -char *table =NULL ;int size, ret;if (amdgpu_in_reset (adev))
@@ -546,7 +545,7 @@ static ssize_t amdgpu_get_pp_table(strucreturn ret; } - size =amdgpu_dpm_get_pp_table (adev, &table); + size =amdgpu_dpm_get_pp_table (adev, buf,PAGE_SIZE -1 );pm_runtime_mark_last_busy (ddev->dev);pm_runtime_put_autosuspend (ddev->dev);
@@ -554,11 +553,6 @@ static ssize_t amdgpu_get_pp_table(strucif (size <=0 )return size; -if (size >=PAGE_SIZE ) - size =PAGE_SIZE -1 ; - -memcpy (buf, table, size); -return size; }
drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h +2 -1
@@ -459,7 +459,8 @@ int amdgpu_dpm_get_pp_num_states(structint amdgpu_dpm_dispatch_task (struct amdgpu_device *adev,enum amd_pp_task task_id,enum amd_pm_state_type *user_state); -int amdgpu_dpm_get_pp_table (struct amdgpu_device *adev,char **table); +int amdgpu_dpm_get_pp_table (struct amdgpu_device *adev,char *table, +size_t size); int amdgpu_dpm_set_fine_grain_clk_vol(struct amdgpu_device *adev, uint32_t type, long *input,
Greg Kroah-Hartman
maintainerPATCH 262/303 can: rcar_canfd: Invert reset assert order
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit 41c13eaf39932fc79aa1ac245a9b97090fe23d5e ]
The two resets are asserted during cleanup in the same order as they were deasserted during probe. Invert the order to restore symmetry.
Stable-dep-of: bef9004c5b91 ("can: rcar_canfd: change the initializing flow for clocks and resets")
--- drivers/net/can/rcar/rcar_canfd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/can/rcar/rcar_canfd.c +2 -2
@@ -2035,8 +2035,8 @@ fail_mode: fail_clk:clk_disable_unprepare (gpriv->clkp); fail_reset: -reset_control_assert (gpriv->rstc1);reset_control_assert (gpriv->rstc2); +reset_control_assert (gpriv->rstc1); fail_dev:return err; }
@@ -2057,8 +2057,8 @@ static int rcar_canfd_remove(struct plat/* Enter global sleep mode */ rcar_canfd_set_bit (gpriv->base,RCANFD_GCTR ,RCANFD_GCTR_GSLPR );clk_disable_unprepare (gpriv->clkp); -reset_control_assert (gpriv->rstc1);reset_control_assert (gpriv->rstc2); +reset_control_assert (gpriv->rstc1);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 263/303 can: rcar_canfd: Use devm_clk_get_optional() for RAM clk
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <[email protected]>
[ Upstream commit eda3d6c8d784835cec86f42b3f8118c9eb0cc58c ]
Replace devm_clk_get_optional_enabled()->devm_clk_get_optional() as the RAM clk needs to be enabled in resume for proper operation in STR mode for RZ/G3E SoC.
Stable-dep-of: bef9004c5b91 ("can: rcar_canfd: change the initializing flow for clocks and resets")
--- drivers/net/can/rcar/rcar_canfd.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-)
drivers/net/can/rcar/rcar_canfd.c +18 -1
@@ -542,6 +542,7 @@ struct rcar_canfd_global {struct platform_device *pdev;/* Respective platform device */ struct clk *clkp;/* Peripheral clock */ struct clk *can_clk;/* fCAN clock */ +struct clk *clk_ram;/* Clock RAM */ enum rcar_canfd_fcanclk fcan;/* CANFD or Ext clock */ unsigned long channels_mask;/* Enabled channels mask */ bool fdmode;/* CAN FD or Classical CAN only mode */
@@ -1915,6 +1916,11 @@ static int rcar_canfd_probe(struct platf/* CANFD clock is further divided by (1/2) within the IP */ fcan_freq /=2 ; + gpriv->clk_ram =devm_clk_get_optional (&pdev->dev,"ram_clk" ); +if (IS_ERR (gpriv->clk_ram)) +return dev_err_probe (&pdev->dev,PTR_ERR (gpriv->clk_ram), +"cannot get ram clock\n" ); + addr =devm_platform_ioremap_resource (pdev,0 );if (IS_ERR (addr)) { err =PTR_ERR (addr);
@@ -1979,10 +1985,18 @@ static int rcar_canfd_probe(struct platf goto fail_reset; } +/* Enable RAM clock */ + err =clk_prepare_enable (gpriv->clk_ram); +if (err) { +dev_err (&pdev->dev,"failed to enable RAM clock: %pe\n" , +ERR_PTR (err)); + goto fail_clk; + } + err =rcar_canfd_reset_controller (gpriv);if (err) {dev_err (&pdev->dev,"reset controller failed\n" ); - goto fail_clk; + goto fail_ram_clk; }/* Controller in Global reset & Channel reset mode */
@@ -2032,6 +2046,8 @@ fail_channel:rcar_canfd_channel_remove (gpriv, ch); fail_mode:rcar_canfd_disable_global_interrupts (gpriv); +fail_ram_clk: +clk_disable_unprepare (gpriv->clk_ram); fail_clk:clk_disable_unprepare (gpriv->clkp); fail_reset:
@@ -2056,6 +2072,7 @@ static int rcar_canfd_remove(struct plat/* Enter global sleep mode */ rcar_canfd_set_bit (gpriv->base,RCANFD_GCTR ,RCANFD_GCTR_GSLPR ); +clk_disable_unprepare (gpriv->clk_ram);clk_disable_unprepare (gpriv->clkp);reset_control_assert (gpriv->rstc2);reset_control_assert (gpriv->rstc1);
Greg Kroah-Hartman
maintainerPATCH 264/303 can: rcar_canfd: Extract rcar_canfd_global_{,de}init()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit fa5f4ec8fff8bc587a2cbf7101303306e045c11f ]
Extract the code to (de)initialize global state into separate functions, for future reuse.
Stable-dep-of: bef9004c5b91 ("can: rcar_canfd: change the initializing flow for clocks and resets")
--- drivers/net/can/rcar/rcar_canfd.c | 182 +++++++++++++++++++++----------------- 1 file changed, 104 insertions(+), 78 deletions(-)
drivers/net/can/rcar/rcar_canfd.c +104 -78
@@ -1810,20 +1810,119 @@ static void rcar_canfd_channel_remove(st } } +static int rcar_canfd_global_init (struct rcar_canfd_global *gpriv) +{ +struct device *dev = &gpriv->pdev->dev; +u32 rule_entry =0 ; +u32 ch, sts; +int err; + + err =reset_control_reset (gpriv->rstc1); +if (err) +return err; + + err =reset_control_reset (gpriv->rstc2); +if (err) + goto fail_reset1; + +/* Enable peripheral clock for register access */ + err =clk_prepare_enable (gpriv->clkp); +if (err) { +dev_err (dev,"failed to enable peripheral clock: %pe\n" , +ERR_PTR (err)); + goto fail_reset2; + } + +/* Enable RAM clock */ + err =clk_prepare_enable (gpriv->clk_ram); +if (err) { +dev_err (dev, +"failed to enable RAM clock, error %d\n" , err); + goto fail_clk; + } + + err =rcar_canfd_reset_controller (gpriv); +if (err) { +dev_err (dev,"reset controller failed: %pe\n" ,ERR_PTR (err)); + goto fail_ram_clk; + } + +/* Controller in Global reset & Channel reset mode */ +rcar_canfd_configure_controller (gpriv); + +/* Configure per channel attributes */ +for_each_set_bit (ch, &gpriv->channels_mask, gpriv->max_channels) { +/* Configure Channel's Rx fifo */ +rcar_canfd_configure_rx (gpriv, ch); + +/* Configure Channel's Tx (Common) fifo */ +rcar_canfd_configure_tx (gpriv, ch); + +/* Configure receive rules */ +rcar_canfd_configure_afl_rules (gpriv, ch, rule_entry); + rule_entry +=RCANFD_CHANNEL_NUMRULES ; + } + +/* Configure common interrupts */ +rcar_canfd_enable_global_interrupts (gpriv); + +/* Start Global operation mode */ +rcar_canfd_update_bit (gpriv->base,RCANFD_GCTR ,RCANFD_GCTR_GMDC_MASK , +RCANFD_GCTR_GMDC_GOPM ); + +/* Verify mode change */ + err =readl_poll_timeout ((gpriv->base +RCANFD_GSTS ), sts, + !(sts &RCANFD_GSTS_GNOPM ),2 ,500000 ); +if (err) { +dev_err (dev,"global operational mode failed\n" ); + goto fail_mode; + } + +return 0 ; + +fail_mode: +rcar_canfd_disable_global_interrupts (gpriv); +fail_ram_clk: +clk_disable_unprepare (gpriv->clk_ram); +fail_clk: +clk_disable_unprepare (gpriv->clkp); +fail_reset2: +reset_control_assert (gpriv->rstc2); +fail_reset1: +reset_control_assert (gpriv->rstc1); +return err; +} + +static void rcar_canfd_global_deinit (struct rcar_canfd_global *gpriv,bool full) +{ +rcar_canfd_disable_global_interrupts (gpriv); + +if (full) { +rcar_canfd_reset_controller (gpriv); + +/* Enter global sleep mode */ +rcar_canfd_set_bit (gpriv->base,RCANFD_GCTR ,RCANFD_GCTR_GSLPR ); + } + +clk_disable_unprepare (gpriv->clk_ram); +clk_disable_unprepare (gpriv->clkp); +reset_control_assert (gpriv->rstc2); +reset_control_assert (gpriv->rstc1); +} +static int rcar_canfd_probe (struct platform_device *pdev) {void __iomem *addr; -u32 sts, ch, fcan_freq;struct rcar_canfd_global *gpriv;struct device_node *of_child;unsigned long channels_mask =0 ;int err, ch_irq, g_irq;int g_err_irq, g_recc_irq; -u32 rule_entry =0 ;bool fdmode = true;/* CAN FD only mode - default */ enum rcanfd_chip_id chip_id;int max_channels;char name[9 ] ="channelX" ; +u32 ch, fcan_freq;int i; chip_id = (uintptr_t )of_device_get_match_data (&pdev->dev);
@@ -1968,67 +2067,9 @@ static int rcar_canfd_probe(struct platf } } - err =reset_control_reset (gpriv->rstc1); + err =rcar_canfd_global_init (gpriv);if (err) - goto fail_dev; - err =reset_control_reset (gpriv->rstc2); -if (err) { -reset_control_assert (gpriv->rstc1); - goto fail_dev; - } - -/* Enable peripheral clock for register access */ - err =clk_prepare_enable (gpriv->clkp); -if (err) { -dev_err (&pdev->dev, -"failed to enable peripheral clock, error %d\n" , err); - goto fail_reset; - } - -/* Enable RAM clock */ - err =clk_prepare_enable (gpriv->clk_ram); -if (err) { -dev_err (&pdev->dev,"failed to enable RAM clock: %pe\n" , -ERR_PTR (err)); - goto fail_clk; - } - - err =rcar_canfd_reset_controller (gpriv); -if (err) { -dev_err (&pdev->dev,"reset controller failed\n" ); - goto fail_ram_clk; - } - -/* Controller in Global reset & Channel reset mode */ -rcar_canfd_configure_controller (gpriv); - -/* Configure per channel attributes */ -for_each_set_bit (ch, &gpriv->channels_mask, max_channels) { -/* Configure Channel's Rx fifo */ -rcar_canfd_configure_rx (gpriv, ch); - -/* Configure Channel's Tx (Common) fifo */ -rcar_canfd_configure_tx (gpriv, ch); - -/* Configure receive rules */ -rcar_canfd_configure_afl_rules (gpriv, ch, rule_entry); - rule_entry +=RCANFD_CHANNEL_NUMRULES ; - } - -/* Configure common interrupts */ -rcar_canfd_enable_global_interrupts (gpriv); - -/* Start Global operation mode */ -rcar_canfd_update_bit (gpriv->base,RCANFD_GCTR ,RCANFD_GCTR_GMDC_MASK , -RCANFD_GCTR_GMDC_GOPM ); - -/* Verify mode change */ - err =readl_poll_timeout ((gpriv->base +RCANFD_GSTS ), sts, - !(sts &RCANFD_GSTS_GNOPM ),2 ,500000 ); -if (err) { -dev_err (&pdev->dev,"global operational mode failed\n" ); goto fail_mode; - }for_each_set_bit (ch, &gpriv->channels_mask, max_channels) { err =rcar_canfd_channel_probe (gpriv, ch, fcan_freq);
@@ -2045,14 +2086,7 @@ fail_channel:for_each_set_bit (ch, &gpriv->channels_mask, max_channels)rcar_canfd_channel_remove (gpriv, ch); fail_mode: -rcar_canfd_disable_global_interrupts (gpriv); -fail_ram_clk: -clk_disable_unprepare (gpriv->clk_ram); -fail_clk: -clk_disable_unprepare (gpriv->clkp); -fail_reset: -reset_control_assert (gpriv->rstc2); -reset_control_assert (gpriv->rstc1); +rcar_canfd_global_deinit (gpriv, false); fail_dev:return err; }
@@ -2062,20 +2096,12 @@ static int rcar_canfd_remove(struct platstruct rcar_canfd_global *gpriv =platform_get_drvdata (pdev);u32 ch; -rcar_canfd_reset_controller (gpriv); -rcar_canfd_disable_global_interrupts (gpriv); -for_each_set_bit (ch, &gpriv->channels_mask, gpriv->max_channels) {rcar_canfd_disable_channel_interrupts (gpriv->ch[ch]);rcar_canfd_channel_remove (gpriv, ch); } -/* Enter global sleep mode */ -rcar_canfd_set_bit (gpriv->base,RCANFD_GCTR ,RCANFD_GCTR_GSLPR ); -clk_disable_unprepare (gpriv->clk_ram); -clk_disable_unprepare (gpriv->clkp); -reset_control_assert (gpriv->rstc2); -reset_control_assert (gpriv->rstc1); +rcar_canfd_global_deinit (gpriv, true);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 265/303 can: rcar_canfd: change the initializing flow for clocks and resets
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tu Nguyen <[email protected]>
[ Upstream commit bef9004c5b91debfceaea2841855a4ebe81ff2b3 ]
Testing CANFD on RZ/G3E shows that many registers do not reset to their initial values with the current flow of deasserting resets first and then enabling clocks.
Based on the HW manual, clocks should be supplied first and the resets deasserted afterward.
section 7.4.3 Procedure for Activating Modules: RZ/G2L section 4.4.9.3 Procedure for Starting up Units: RZ/G3E
So, update the order of the initializing flow for resets and clocks to match the hardware manual, resetting all CANFD registers to their initial values. Also update rcar_canfd_global_deinit() to assert resets before disabling clocks, so the teardown path mirrors the new init ordering.
--- drivers/net/can/rcar/rcar_canfd.c | 32 ++++++++++++++++---------------- 1 file changed, 16 insertions(+), 16 deletions(-)
drivers/net/can/rcar/rcar_canfd.c +16 -16
@@ -1817,20 +1817,12 @@ static int rcar_canfd_global_init(structu32 ch, sts;int err; - err =reset_control_reset (gpriv->rstc1); -if (err) -return err; - - err =reset_control_reset (gpriv->rstc2); -if (err) - goto fail_reset1; -/* Enable peripheral clock for register access */ err =clk_prepare_enable (gpriv->clkp);if (err) {dev_err (dev,"failed to enable peripheral clock: %pe\n" ,ERR_PTR (err)); - goto fail_reset2; +return err; }/* Enable RAM clock */
@@ -1841,10 +1833,18 @@ static int rcar_canfd_global_init(struct goto fail_clk; } + err =reset_control_reset (gpriv->rstc1); +if (err) + goto fail_ram_clk; + + err =reset_control_reset (gpriv->rstc2); +if (err) + goto fail_reset1; + err =rcar_canfd_reset_controller (gpriv);if (err) {dev_err (dev,"reset controller failed: %pe\n" ,ERR_PTR (err)); - goto fail_ram_clk; + goto fail_reset2; }/* Controller in Global reset & Channel reset mode */
@@ -1882,14 +1882,14 @@ static int rcar_canfd_global_init(struct fail_mode:rcar_canfd_disable_global_interrupts (gpriv); -fail_ram_clk: -clk_disable_unprepare (gpriv->clk_ram); -fail_clk: -clk_disable_unprepare (gpriv->clkp); fail_reset2:reset_control_assert (gpriv->rstc2); fail_reset1:reset_control_assert (gpriv->rstc1); +fail_ram_clk: +clk_disable_unprepare (gpriv->clk_ram); +fail_clk: +clk_disable_unprepare (gpriv->clkp);return err; }
@@ -1904,10 +1904,10 @@ static void rcar_canfd_global_deinit(strrcar_canfd_set_bit (gpriv->base,RCANFD_GCTR ,RCANFD_GCTR_GSLPR ); } -clk_disable_unprepare (gpriv->clk_ram); -clk_disable_unprepare (gpriv->clkp);reset_control_assert (gpriv->rstc2);reset_control_assert (gpriv->rstc1); +clk_disable_unprepare (gpriv->clk_ram); +clk_disable_unprepare (gpriv->clkp); }static int rcar_canfd_probe (struct platform_device *pdev)
Greg Kroah-Hartman
maintainerPATCH 266/303 drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre-Eric Pelloux-Prayer <[email protected]>
[ Upstream commit d8726ef11512754a68c0ab53c57634a569b8feff ]
The commit referenced below restarts the CS if the validation is still in progress. When debug_vm is enabled, all BOs from the CS are invalidated so we will hit an infinite loop.
To avoid that, defer BO invalidation to amdgpu_cs_parser_fini.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 30 ++++++++++++++++-------------- 1 file changed, 16 insertions(+), 14 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +16 -14
@@ -1153,19 +1153,6 @@ static int amdgpu_cs_vm_handling(struct job->vm_pd_addr =amdgpu_gmc_pd_addr (vm->root.bo); } -if (amdgpu_vm_debug) { -/* Invalidate all BOs to test for userspace bugs */ -amdgpu_bo_list_for_each_entry (e, p->bo_list) { -struct amdgpu_bo *bo =ttm_to_amdgpu_bo (e->tv.bo); - -/* ignore duplicates */ -if (!bo) -continue ; - -amdgpu_vm_bo_invalidate (adev, bo, false); - } - } -return 0 ; }
@@ -1325,6 +1312,8 @@ static int amdgpu_cs_submit(struct amdgp/* Cleanup the parser structure */ static void amdgpu_cs_parser_fini (struct amdgpu_cs_parser *parser) { +struct amdgpu_device *adev = parser->adev; +struct amdgpu_bo_list_entry *e;unsigned i;for (i =0 ; i < parser->num_post_deps; i++) {
@@ -1337,8 +1326,21 @@ static void amdgpu_cs_parser_fini(structif (parser->ctx)amdgpu_ctx_put (parser->ctx); -if (parser->bo_list) +if (parser->bo_list) { +if (amdgpu_vm_debug) { +/* Invalidate all BOs to test for userspace bugs */ +amdgpu_bo_list_for_each_entry (e, parser->bo_list) { +struct amdgpu_bo *bo =ttm_to_amdgpu_bo (e->tv.bo); + +/* ignore duplicates */ +if (!bo) +continue ; + +amdgpu_vm_bo_invalidate (adev, bo, false); + } + }amdgpu_bo_list_put (parser->bo_list); + }for (i =0 ; i < parser->nchunks; i++)kvfree (parser->chunks[i].kdata);
Greg Kroah-Hartman
maintainerPATCH 267/303 mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Lorenzo Stoakes (ARM)" <[email protected]>
[ Upstream commit 26444eb71465c9934d9d418ef69c43f61185329b ]
Patch series "mm: fix UAF caused by race between ptdump and vmap pgtable freeing", v6.
Kernel page table walkers fall into two broad categories - those ranges where no exclusion is required via walk_kernel_page_table_range_lockless() and those where exclusion is required via walk_kernel_page_table_range() or walk_page_range_debug().
The former category is used only by arm64 arch code operating on ranges it both wholly owns and does not concurrently write.
The latter category consists of kernel page table walkers operating on ranges that are wholly owned (but which need exclusion against concurrent writers).
The lock used for exclusion is the mmap lock, and for kernel ranges this is the mmap lock on init_mm.
ptdump is a special case being both the only user of walk_page_range_debug(), and the only case in which it walks ranges it does not own.
This presents a problem, as page tables may be freed under ptdump. And indeed there is a use-after-free bug in the kernel as a result, which this series addresses.
vmap promotes page tables to huge leaf entries where possible, freeing the lower page table when it does. It does this with no meaningful locks held against concurrent ptdump walks.
As a result, use-after-free can currently occur. This series addresses the issue by having the vmap huge promotion logic acquire the mmap read lock while both setting the huge page table entry and freeing the prior leaf page table.
The ptdump code already acquires the mmap write lock, so by doing so we ensure that the ptdump walker only ever observes either the huge page table entry or the existing page table entry, and nothing is freed underneath it.
A mitigation for this issue was already applied for arm64 in commit fa93b45fd397 ("arm64: Enable vmalloc-huge with ptdump"), which this series has to deal with carefully.
This mitigation resolves the issue by acquiring the mmap read lock on init_mm on vmap page table free if a ptdump is in progress.
However the fix in this series would cause a deadlock if we were to simply apply it for arm64 without also reverting the change.
This is because vmap may acquire the read lock before ptdump attempts to acquire the write lock, which then gets queued, and rwsem starvation rules mean that the (unacknowledged) nested mmap read lock in the arm64 code would also block, meaning the original read lock is never released and thus deadlock.
This series works around this by #ifndef CONFIG_ARM64'ing the mmap read lock in vmap logic, then partially reverting commit fa93b45fd397 ("arm64:
Enable vmalloc-huge with ptdump"), keeping the enablement of huge vmap support, and removing the ifdeffery with the partial revert patch.
There are related issues that are also addressed in this series:
* x86 page attribute logic, specifically Change Page Attributes (CPA), implements a feature whereby huge ranges can be collapsed into huge leaf entries. This can similarly cause a UAF when done in parallel with a ptdump walk, so similarly acquire the init_mm mmap lock to avoid this.
* The CPA logic allows concurrent page table manipulation and CPA collapse, meaning the former risks accessing a page table the latter frees. Fix this by acquiring mmap write lock on init_mm across the whole CPA collapse operation and read lock on the page table manipulation.
* x86 and arm64 permit walks of non-kernel mm's (both allowing efi mm walks, and in x86's case arbitrary mm's), so we ensure kernel mappings remain stable by locking the init_mm as well as the mm being walked.
The ordering of patches is established for both strict dependencies (the arm64 partial revert in particular has to be done after the vmap changes) and logical ones (the non-kernel mm fix only makes sense once the vmap/CPA fixes are in place).
This patch (of 3):
Currently there is a nasty race between ptdump and vmap when attempting to map a huge P4D, PUD or PMD entry:
* ptdump walks kernel page table ranges it doesn't own.
* When vmap maps ranges it tries to promotes existing ones to huge page tables in vmap_try_huge_[p4d,pud,pmd]() at P4D, PUD and PMD level, freeing the lower page table in [p4d,pud,pmd]_free_[pud,pmd,pte]_page() when it succeeds.
Both of these things can happen at the same time and as a result ptdump can access a freed page table, resulting in a use-after-free and memory corruption.
This is possible because while ptdump_walk_pgd() holds both the mem hotplug lock and the mmap write lock before invoking walk_page_range_debug(), vmap takes no relevant locks at all.
Fix this by holding the mmap read lock in vmap_try_huge_*() when freeing page tables.
The read lock is sufficient: ptdump is the only walker that must be excluded and it holds the mmap write lock. Other holders of the read lock may run concurrently, but each exclusively owns the range it operates on and cannot reach the page tables freed here.
We also hold the lock while assigning the huge page table entry, which means page table walkers observe only the huge or non-huge page table entry.
We use a trylock to prevent ptdump from blocking vmap making forward progress. This is fine because it's an optimisation in any case, and thus the vmap can safely proceed regardless.
All other kernel page table walkers that touch vmalloc ranges either exclusively own the memory walked or acquire the mmap lock, so this correctly excludes those walkers.
One wrinkle here is commit fa93b45fd397 ("arm64: Enable vmalloc-huge with ptdump"), which addresses the issue for arm64 only by explicitly acquiring the mmap read lock on kernel page table freeing should a concurrent ptdump be in progress.
This is problematic as vmap may acquire the mmap read lock prior to ptdump attempting to acquire an mmap write lock, leading to a deadlock when the mmap read lock is slept upon on page table freeing due to rwsem anti-starvation.
We work around this by predicating the mmap lock being taken on !CONFIG_ARM64 for the time being.
With this patch applied, a follow up will partially revert commit fa93b45fd397 ("arm64: Enable vmalloc-huge with ptdump") and at that stage remove the arm64 ifdeffery.
We also update walk_page_range_debug() to assert the mmap write lock unconditionally and update the comment here to reflect this change.
The issue has existed as long as ptdump was available and vmap freed page tables when promoting to a huge leaf entry, that is, since commit b6bdb7517c3d ("mm/vmalloc: add interfaces to free unmapped page table") for huge ioremap, and commit 121e6f3258fe ("mm/vmalloc: hugepage vmalloc mappings") for huge vmalloc.
Since the former is the earlier of the two we choose that for our Fixes tag.
We also define a guard class for mmap_read_trylock() so we can use cleanup.h to make the scope handling cleaner in the implementation.
This patch is based on work by David Carlier (linked), with gratitude!
--- mm/pagewalk.c | 10 ++++++++ mm/vmalloc.c | 71 ++++++++++++++++++++++++++++++++++++++++++++++++++++------ 2 files changed, 74 insertions(+), 7 deletions(-)
mm/pagewalk.c +10 -0
@@ -495,6 +495,8 @@ int walk_page_range(struct mm_struct *mm* not backed by VMAs. Because 'unusual' entries may be walked this function * will also not lock the PTEs for the pte_entry() callback. This is useful for * walking the kernel pages tables or page tables for firmware. +* +* The mmap write lock must be held. */ int walk_page_range_novma(struct mm_struct *mm, unsigned long start, unsigned long end, const struct mm_walk_ops *ops,
@@ -512,6 +514,14 @@ int walk_page_range_novma(struct mm_struif (start >= end || !walk.mm)return -EINVAL ; +/* +* When walking userland page tables, an mmap write lock must be held to +* account for munmap() downgrading to an mmap read lock when tearing +* down page tables. +* +* When walking kernel page tables, an mmap write lock must also be held +* to account for page table freeing on vmap huge page mapping. +*/ mmap_assert_write_locked (walk.mm);return walk_pgd_range (start, end, &walk);
mm/vmalloc.c +64 -7
112 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 268/303 veth: Introduce veth_xdp_buff wrapper for xdp_buff
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislav Fomichev <[email protected]>
[ Upstream commit fefb695a745f10247fd68f5561e6e3d85e1d7b59 ]
No functional changes. Boilerplate to allow stuffing more data after xdp_buff.
Stable-dep-of: cb6379feaaff ("veth: fix skb length accounting after XDP frag adjustment")
--- drivers/net/veth.c | 56 +++++++++++++++++++++++++++++------------------------ 1 file changed, 31 insertions(+), 25 deletions(-)
drivers/net/veth.c +31 -25
@@ -116,6 +116,10 @@ static struct { { "peer_ifindex" }, }; +struct veth_xdp_buff { +struct xdp_buff xdp; +}; +static int veth_get_link_ksettings (struct net_device *dev,struct ethtool_link_ksettings *cmd) {
@@ -586,23 +590,24 @@ static struct xdp_frame *veth_xdp_rcv_onrcu_read_lock (); xdp_prog =rcu_dereference (rq->xdp_prog);if (likely (xdp_prog)) { -struct xdp_buff xdp; +struct veth_xdp_buff vxbuf; +struct xdp_buff *xdp = &vxbuf.xdp;u32 act; -xdp_convert_frame_to_buff (frame, &xdp); - xdp.rxq = &rq->xdp_rxq; +xdp_convert_frame_to_buff (frame, xdp); + xdp->rxq = &rq->xdp_rxq; - act =bpf_prog_run_xdp (xdp_prog, &xdp); + act =bpf_prog_run_xdp (xdp_prog, xdp);switch (act) {case XDP_PASS : -if (xdp_update_frame_from_buff (&xdp, frame)) +if (xdp_update_frame_from_buff (xdp, frame)) goto err_xdp;break ;case XDP_TX : orig_frame = *frame; - xdp.rxq->mem = frame->mem; -if (unlikely (veth_xdp_tx (rq, &xdp, bq) <0 )) { + xdp->rxq->mem = frame->mem; +if (unlikely (veth_xdp_tx (rq, xdp, bq) <0 )) {trace_xdp_exception (rq->dev, xdp_prog, act); frame = &orig_frame; stats->rx_drops++;
@@ -613,8 +618,8 @@ static struct xdp_frame *veth_xdp_rcv_on goto xdp_xmit;case XDP_REDIRECT : orig_frame = *frame; - xdp.rxq->mem = frame->mem; -if (xdp_do_redirect (rq->dev, &xdp, xdp_prog)) { + xdp->rxq->mem = frame->mem; +if (xdp_do_redirect (rq->dev, xdp, xdp_prog)) { frame = &orig_frame; stats->rx_drops++; goto err_xdp;
@@ -793,7 +798,8 @@ static struct sk_buff *veth_xdp_rcv_skb( {void *orig_data, *orig_data_end;struct bpf_prog *xdp_prog; -struct xdp_buff xdp; +struct veth_xdp_buff vxbuf; +struct xdp_buff *xdp = &vxbuf.xdp;u32 act, metalen;int off;
@@ -807,22 +813,22 @@ static struct sk_buff *veth_xdp_rcv_skb( }__skb_push (skb, skb->data -skb_mac_header (skb)); -if (veth_convert_skb_to_xdp_buff (rq, &xdp, &skb)) +if (veth_convert_skb_to_xdp_buff (rq, xdp, &skb)) goto drop; - orig_data = xdp.data; - orig_data_end = xdp.data_end; + orig_data = xdp->data; + orig_data_end = xdp->data_end; - act =bpf_prog_run_xdp (xdp_prog, &xdp); + act =bpf_prog_run_xdp (xdp_prog, xdp);switch (act) {case XDP_PASS :break ;case XDP_TX : -veth_xdp_get (&xdp); +veth_xdp_get (xdp);consume_skb (skb); - xdp.rxq->mem = rq->xdp_mem; -if (unlikely (veth_xdp_tx (rq, &xdp, bq) <0 )) { + xdp->rxq->mem = rq->xdp_mem; +if (unlikely (veth_xdp_tx (rq, xdp, bq) <0 )) {trace_xdp_exception (rq->dev, xdp_prog, act); stats->rx_drops++; goto err_xdp;
@@ -831,10 +837,10 @@ static struct sk_buff *veth_xdp_rcv_skb(rcu_read_unlock (); goto xdp_xmit;case XDP_REDIRECT : -veth_xdp_get (&xdp); +veth_xdp_get (xdp);consume_skb (skb); - xdp.rxq->mem = rq->xdp_mem; -if (xdp_do_redirect (rq->dev, &xdp, xdp_prog)) { + xdp->rxq->mem = rq->xdp_mem; +if (xdp_do_redirect (rq->dev, xdp, xdp_prog)) { stats->rx_drops++; goto err_xdp; }
@@ -854,7 +860,7 @@ static struct sk_buff *veth_xdp_rcv_skb(rcu_read_unlock ();/* check if bpf_xdp_adjust_head was used */ - off = orig_data - xdp.data; + off = orig_data - xdp->data;if (off >0 )__skb_push (skb, off);else if (off <0 )
@@ -863,21 +869,21 @@ static struct sk_buff *veth_xdp_rcv_skb(skb_reset_mac_header (skb);/* check if bpf_xdp_adjust_tail was used */ - off = xdp.data_end - orig_data_end; + off = xdp->data_end - orig_data_end;if (off !=0 )__skb_put (skb, off);/* positive on grow, negative on shrink */ /* XDP frag metadata (e.g. nr_frags) are updated in eBPF helpers * (e.g. bpf_xdp_adjust_tail), we need to update data_len here. */ -if (xdp_buff_has_frags (&xdp)) +if (xdp_buff_has_frags (xdp)) skb->data_len =skb_shinfo (skb)->xdp_frags_size;else skb->data_len =0 ; skb->protocol =eth_type_trans (skb, rq->dev); - metalen = xdp.data - xdp.data_meta; + metalen = xdp->data - xdp->data_meta;if (metalen)skb_metadata_set (skb, metalen); out:
@@ -890,7 +896,7 @@ xdp_drop:return NULL ; err_xdp:rcu_read_unlock (); -xdp_return_buff (&xdp); +xdp_return_buff (xdp); xdp_xmit:return NULL ; }
Greg Kroah-Hartman
maintainerPATCH 269/303 veth: fix skb length accounting after XDP frag adjustment
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sun Jian <[email protected]>
[ Upstream commit cb6379feaaff11c4e1e79c26c745ffa23182768a ]
veth exposes non-linear skb fragments through an xdp_buff. If an XDP program adjusts the fragment area, veth_xdp_rcv_skb() copies xdp_frags_size back to skb->data_len but leaves skb->len containing the old fragment contribution.
After a fragment shrink, this makes skb_headlen() larger than the actual linear area. In the reproduced UDP receive path, __skb_datagram_iter() copied 1024 bytes past the actual linear tail to userspace, starting at struct skb_shared_info. The copied bytes included the affected skb's nr_frags, xdp_frags_size, and a kernel pointer from skb_shinfo(skb)->frags[0]. Real packet data was displaced by the same amount and truncated at the end.
Subtract the old data_len before replacing it and add the new data_len afterwards, keeping skb->len and skb->data_len synchronized.
Additionally, bpf_xdp_pull_data() can advance data_end while leaving frags present. The skb is then still non-linear, so the old __skb_put(skb, off) triggers SKB_LINEAR_ASSERT().
Use skb_set_tail_pointer() and update skb->len explicitly instead, following bpf_prog_run_generic_xdp(). Unlike __skb_put(), skb_set_tail_pointer() does not require a linear skb.
A 60000-byte UDP datagram on a veth pair with MTU 64000 was shortened by 1024 bytes from its fragment area. Before the fix, all 10 runs produced corrupted payloads. After the fix, all 10 runs matched the expected payload exactly. A forced-tailroom reproducer also exercises bpf_xdp_pull_data() with frags still present; the old code triggers SKB_LINEAR_ASSERT(), while this fix passes 10/10 runs.
--- drivers/net/veth.c | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-)
drivers/net/veth.c +14 -8
@@ -868,18 +868,24 @@ static struct sk_buff *veth_xdp_rcv_skb(skb_reset_mac_header (skb); -/* check if bpf_xdp_adjust_tail was used */ - off = xdp->data_end - orig_data_end; -if (off !=0 ) -__skb_put (skb, off);/* positive on grow, negative on shrink */ -/* XDP frag metadata (e.g. nr_frags) are updated in eBPF helpers -* (e.g. bpf_xdp_adjust_tail), we need to update data_len here. +* (e.g. bpf_xdp_adjust_tail). Remove the old fragment contribution +* from skb->len before updating data_len, then add the new one back. */ -if (xdp_buff_has_frags (xdp)) + skb->len -= skb->data_len; +if (xdp_buff_has_frags (xdp)) { skb->data_len =skb_shinfo (skb)->xdp_frags_size; -else + skb->len += skb->data_len; + }else { skb->data_len =0 ; + } + +/* Synchronize the skb tail with XDP's updated linear area. */ + off = xdp->data_end - orig_data_end; +if (off !=0 ) { +skb_set_tail_pointer (skb, xdp->data_end - xdp->data); + skb->len += off;/* positive on grow, negative on shrink */ + } skb->protocol =eth_type_trans (skb, rq->dev);
Greg Kroah-Hartman
maintainerPATCH 270/303 KVM: SVM: Serialize accesses to the owner and mirror list with separate lock
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Bonzini <[email protected]>
[ Upstream commit 1d78d33275ef2a16c6d080910b291d0a97a0e613 ]
Interaction between KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM and KVM_CAP_VM_COPY_ENC_CONTEXT_FROM can cause two separate issues:
- in sev_migrate_from(), when the destination KVM is a mirror, the mirror entry is moved from the source's list to the owner's mirror_vms list, without holding the owner's lock unlike other writers of the owner's mirror list (sev_vm_copy_enc_context_from(), sev_vm_destroy()). A concurrent COPY or destroy can race with sev_migrate_from() and corrupt the list.
- In sev_vm_destroy(), the *owner* is still active and could receive concurrently a KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM that causes sev->enc_context_owner to change. In this case the incorrect VM receives kvm_put_kvm().
The second issue needs particular care because the owner could disappear altogether (even though the race window is impossibly small) between reading it and locking it. There is thus no way to perform the checks under the owner lock without putting struct kvm under SLAB_TYPESAFE_BY_RCU (which would allow kvm_get_kvm_safe() under RCU critical section).
It is much simpler to just use a global lock, since the critical sections are so small and the new lock is always a leaf lock.
--- arch/x86/kvm/svm/sev.c | 34 +++++++++++++++++++++++++--------- arch/x86/kvm/svm/svm.h | 1 + 2 files changed, 26 insertions(+), 9 deletions(-)
arch/x86/kvm/svm/sev.c +25 -9
@@ -60,6 +60,8 @@ module_param_named(sev_es, sev_es_enablestatic u8 sev_enc_bit;static DECLARE_RWSEM (sev_deactivate_lock);static DEFINE_MUTEX (sev_bitmap_lock); +/* Protects kvm_sev_info's enc_context_owner, mirror_vms and mirror_entry. */ +static DEFINE_MUTEX (sev_mirror_lock);unsigned int max_sev_asid;static unsigned int min_sev_asid;static unsigned long sev_me_mask;
@@ -1686,18 +1688,18 @@ static void sev_migrate_from(struct kvm dst->asid = src->asid; dst->handle = src->handle; dst->pages_locked = src->pages_locked; - dst->enc_context_owner = src->enc_context_owner; dst->es_active = src->es_active; src->asid =0 ; src->active = false; src->handle =0 ; src->pages_locked =0 ; - src->enc_context_owner =NULL ; src->es_active = false;list_cut_before (&dst->regions_list, &src->regions_list, &src->regions_list); +mutex_lock (&sev_mirror_lock); +/* * If this VM has mirrors, "transfer" each mirror's refcount of the * source to the destination (this KVM). The caller holds a reference
@@ -1714,13 +1716,16 @@ static void sev_migrate_from(struct kvm* If this VM is a mirror, remove the old mirror from the owners list * and add the new mirror to the list. */ -if (is_mirroring_enc_context (dst_kvm)) { +if (is_mirroring_enc_context (src_kvm)) {struct kvm_sev_info *owner_sev_info = - &to_kvm_svm (dst->enc_context_owner)->sev_info; + &to_kvm_svm (src->enc_context_owner)->sev_info; + dst->enc_context_owner = src->enc_context_owner; + src->enc_context_owner =NULL ;list_del (&src->mirror_entry);list_add_tail (&dst->mirror_entry, &owner_sev_info->mirror_vms); } +mutex_unlock (&sev_mirror_lock);kvm_for_each_vcpu (i, dst_vcpu, dst_kvm) { dst_svm =to_svm (dst_vcpu);
@@ -2095,12 +2100,15 @@ int sev_vm_copy_enc_context_from(struct* disappear until we're done with it */ source_sev = &to_kvm_svm (source_kvm)->sev_info; -kvm_get_kvm (source_kvm); mirror_sev = &to_kvm_svm (kvm)->sev_info; -list_add_tail (&mirror_sev->mirror_entry, &source_sev->mirror_vms);/* Set enc_context_owner and copy its encryption context over */ +mutex_lock (&sev_mirror_lock); +kvm_get_kvm (source_kvm); +list_add_tail (&mirror_sev->mirror_entry, &source_sev->mirror_vms); mirror_sev->enc_context_owner = source_kvm; +mutex_unlock (&sev_mirror_lock); + mirror_sev->active = true; mirror_sev->asid = source_sev->asid; mirror_sev->fd = source_sev->fd;
@@ -2137,11 +2145,19 @@ void sev_vm_destroy(struct kvm *kvm)/* If this is a mirror_kvm release the enc_context_owner and skip sev cleanup */ if (is_mirroring_enc_context (kvm)) { -struct kvm *owner_kvm = sev->enc_context_owner; +struct kvm *owner_kvm; -mutex_lock (&owner_kvm->lock); +mutex_lock (&sev_mirror_lock); + owner_kvm = sev->enc_context_owner;list_del (&sev->mirror_entry); -mutex_unlock (&owner_kvm->lock); + sev->enc_context_owner =NULL ; + +/* +* The reference to owner_kvm cannot move after sev_mirror_lock is +* released. Release it before kvm_put_kvm() so that owner_kvm is +* never destroyed inside sev_mirror_lock. +*/ +mutex_unlock (&sev_mirror_lock);kvm_put_kvm (owner_kvm);return ; }
arch/x86/kvm/svm/svm.h +1 -0
@@ -89,6 +89,7 @@ struct kvm_sev_info {unsigned long pages_locked;/* Number of pages locked */ struct list_head regions_list;/* List of registered regions */ u64 ap_jump_table;/* SEV-ES AP Jump Table address */ +/* The three fields below are protected by sev_mirror_lock */ struct kvm *enc_context_owner;/* Owner of copied encryption context */ struct list_head mirror_vms;/* List of VMs mirroring */ struct list_head mirror_entry;/* Use as a list entry of mirrors */
Greg Kroah-Hartman
maintainerPATCH 271/303 openvswitch: use skb_ip_totlen in conntrack
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit ec84c955a0d06cef31664bae328d94be7a3e2f03 ]
IPv4 GSO packets may get processed in ovs_skb_network_trim(), and we need to use skb_ip_totlen() to get iph totlen.
Stable-dep-of: 8a7ed561671a ("net/sched: act_ct: fix sk_buff leak when the header checks reject a packet")
--- net/openvswitch/conntrack.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/openvswitch/conntrack.c +1 -1
@@ -1282,7 +1282,7 @@ static int ovs_skb_network_trim(struct sswitch (skb->protocol) {case htons (ETH_P_IP ): - len =ntohs (ip_hdr (skb)->tot_len); + len =skb_ip_totlen (skb);break ;case htons (ETH_P_IPV6 ): len =sizeof (struct ipv6hdr )
Greg Kroah-Hartman
maintainerPATCH 272/303 net: sched: use skb_ip_totlen and iph_totlen
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit 043e397e48c58b4442ea5124dc1bdc95367a0a33 ]
There are 1 action and 1 qdisc that may process IPv4 TCP GSO packets and access iph->tot_len, replace them with skb_ip_totlen() and iph_totlen() accordingly.
Note that we don't need to replace the one in tcf_csum_ipv4(), as it will return for TCP GSO packets in tcf_csum_ipv4_tcp().
Stable-dep-of: 8a7ed561671a ("net/sched: act_ct: fix sk_buff leak when the header checks reject a packet")
--- net/sched/act_ct.c | 2 +- net/sched/sch_cake.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
net/sched/act_ct.c +1 -1
@@ -789,7 +789,7 @@ static int tcf_ct_skb_network_trim(strucswitch (family) {case NFPROTO_IPV4 : - len =ntohs (ip_hdr (skb)->tot_len); + len =skb_ip_totlen (skb);break ;case NFPROTO_IPV6 : len =sizeof (struct ipv6hdr )
net/sched/sch_cake.c +1 -1
@@ -1269,7 +1269,7 @@ static struct sk_buff *cake_ack_filter(s iph_check->daddr != iph->daddr)continue ; - seglen =ntohs (iph_check->tot_len) - + seglen =iph_totlen (skb, iph_check) - (4 * iph_check->ihl); }else if (iph_check->version ==6 ) { ipv6h = (struct ipv6hdr *)iph;
Greg Kroah-Hartman
maintainerPATCH 273/303 openvswitch: move key and ovs_cb update out of handle_fragments
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit 1b83bf4489cbc47d88976291cc967a17adb8e118 ]
This patch has no functional changes and just moves key and ovs_cb update out of handle_fragments, and skb_clear_hash() and skb->ignore_df change into handle_fragments(), to make it easier to move the duplicate code from handle_fragments() into nf_conntrack_ovs later.
Note that it changes to pass info->family to handle_fragments() instead of key for the packet type check, as info->family is set according to key->eth.type in ovs_ct_copy_action() when creating the action.
Stable-dep-of: 8a7ed561671a ("net/sched: act_ct: fix sk_buff leak when the header checks reject a packet")
--- net/openvswitch/conntrack.c | 37 +++++++++++++++++++++++++------------ 1 file changed, 25 insertions(+), 12 deletions(-)
net/openvswitch/conntrack.c +25 -12
@@ -496,13 +496,12 @@ static int ovs_ct_helper(struct sk_buff/* Returns 0 on success, -EINPROGRESS if 'skb' is stolen, or other nonzero * value if 'skb' is freed. */ -static int handle_fragments (struct net *net,struct sw_flow_key *key, -u16 zone,struct sk_buff *skb) +static int handle_fragments (struct net *net,struct sk_buff *skb, +u16 zone,u8 family,u8 *proto,u16 *mru) { -struct ovs_skb_cb ovs_cb = *OVS_CB (skb);int err; -if (key->eth.type ==htons (ETH_P_IP )) { +if (family ==NFPROTO_IPV4 ) {enum ip_defrag_users user =IP_DEFRAG_CONNTRACK_IN + zone;memset (IPCB (skb),0 ,sizeof (struct inet_skb_parm ));
@@ -510,9 +509,9 @@ static int handle_fragments(struct net *if (err)return err; - ovs_cb.mru =IPCB (skb)->frag_max_size; + *mru =IPCB (skb)->frag_max_size;#if IS_ENABLED (CONFIG_NF_DEFRAG_IPV6 ) - } else if (key->eth.type == htons(ETH_P_IPV6)) { + } else if (family == NFPROTO_IPV6) {enum ip6_defrag_users user =IP6_DEFRAG_CONNTRACK_IN + zone;memset (IP6CB (skb),0 ,sizeof (struct inet6_skb_parm ));
@@ -523,22 +522,35 @@ static int handle_fragments(struct net *return err; } - key->ip.proto =ipv6_hdr (skb)->nexthdr; - ovs_cb.mru =IP6CB (skb)->frag_max_size; + *proto =ipv6_hdr (skb)->nexthdr; + *mru =IP6CB (skb)->frag_max_size;#endif }else {kfree_skb (skb);return -EPFNOSUPPORT ; } +skb_clear_hash (skb); + skb->ignore_df =1 ; + +return 0 ; +} + +static int ovs_ct_handle_fragments (struct net *net,struct sw_flow_key *key, +u16 zone,int family,struct sk_buff *skb) +{ +struct ovs_skb_cb ovs_cb = *OVS_CB (skb); +int err; + + err =handle_fragments (net, skb, zone, family, &key->ip.proto, &ovs_cb.mru); +if (err) +return err; +/* The key extracted from the fragment that completed this datagram * likely didn't have an L4 header, so regenerate it. */ ovs_flow_key_update_l3l4 (skb, key); - key->ip.frag =OVS_FRAG_TYPE_NONE ; -skb_clear_hash (skb); - skb->ignore_df =1 ; *OVS_CB (skb) = ovs_cb;return 0 ;
@@ -1318,7 +1330,8 @@ int ovs_ct_execute(struct net *net, strureturn err;if (key->ip.frag !=OVS_FRAG_TYPE_NONE ) { - err =handle_fragments (net, key, info->zone.id, skb); + err =ovs_ct_handle_fragments (net, key, info->zone.id, + info->family, skb);if (err)return err; }
Greg Kroah-Hartman
maintainerPATCH 274/303 net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunjung Ko <[email protected]>
[ Upstream commit 8a7ed561671aa6a911a2de99e59ef670a4d0b1df ]
tcf_ct_handle_fragments() runs its header sanity checks before handing anything to the defragmentation engine:
if (family == NFPROTO_IPV4) err = tcf_ct_ipv4_is_fragment(skb, &frag); else err = tcf_ct_ipv6_is_fragment(skb, &frag); if (err || !frag) return err;
tcf_ct_ipv4_is_fragment() returns -EINVAL or -ENOMEM; tcf_ct_ipv6_is_fragment() adds -EPROTO when ipv6_find_hdr() fails. None of them frees or queues the skb, so on that path the caller still owns it.
tcf_ct_act() however funnels every non-zero return into the ownership-transfer exit:
err = tcf_ct_handle_fragments(net, skb, family, p->zone, &defrag); if (err) goto out_frag; ... out_frag: if (err != -EINPROGRESS) tcf_action_inc_drop_qstats(&c->common); return TC_ACT_CONSUMED;
TC_ACT_CONSUMED means the action took ownership of the skb, so no caller frees it - sch_handle_ingress(), sch_handle_egress() and tcf_qevent_handle() all deliberately skip the free for that verdict. The skb is therefore orphaned: one sk_buff plus its data buffer is leaked per malformed packet, unbounded. Note the drop counter is already incremented for these errors, so the statistics claim a drop that never happens.
Three different ownership states reach out_frag: today - the skb may be queued by the defrag engine (-EINPROGRESS), already freed by nf_ct_handle_fragments(), or still owned by us. Tell the caller which of those it is, and free the packet ourselves in the last case, which restores the TC_ACT_SHOT behaviour that predated the Fixes: commit.
Reproduced on v7.2-rc6 with a 54-byte frame carrying a 40-byte IPv6 header with nexthdr = 0 (hop-by-hop) and nothing after it, on a clsact ingress chain with "action ct". kmemleak reports one leaked 232-byte skbuff_head_cache object plus its 704-byte data buffer per packet; with this patch it reports none.
--- net/sched/act_ct.c | 29 +++++++++++++++++++++++++---- 1 file changed, 25 insertions(+), 4 deletions(-)
net/sched/act_ct.c +25 -4
@@ -854,8 +854,15 @@ static int tcf_ct_ipv6_is_fragment(strucreturn 0 ; } +/* On error, tells the caller whether it still owns @skb and must free it +* itself. @skb is ours only when the header checks below reject the packet +* before it is handed to the defragmentation engine; once nf_ct_handle_ +* fragments() has been called the skb is either queued (-EINPROGRESS) or has +* already been freed by it. +*/ static int tcf_ct_handle_fragments (struct net *net,struct sk_buff *skb, -u8 family,u16 zone,bool *defrag) +u8 family,u16 zone,bool *defrag, +bool *skb_is_ours) {enum ip_conntrack_info ctinfo;struct tc_skb_cb cb;
@@ -872,8 +879,12 @@ static int tcf_ct_handle_fragments(struc err =tcf_ct_ipv4_is_fragment (skb, &frag); else err =tcf_ct_ipv6_is_fragment (skb, &frag); -if (err || !frag) +if (err) { + *skb_is_ours = true;return err; + } +if (!frag) +return 0 ; cb = *tc_skb_cb (skb);
@@ -1124,6 +1135,7 @@ static int tcf_ct_act(struct sk_buff *skstruct nf_hook_state state;int nh_ofs, err, retval;struct tcf_ct_params *p; +bool skb_is_ours = false;bool skip_add = false;bool defrag = false;struct nf_conn *ct;
@@ -1160,9 +1172,18 @@ static int tcf_ct_act(struct sk_buff *sk*/ nh_ofs =skb_network_offset (skb);skb_pull_rcsum (skb, nh_ofs); - err =tcf_ct_handle_fragments (net, skb, family, p->zone, &defrag); -if (err) + err =tcf_ct_handle_fragments (net, skb, family, p->zone, &defrag, + &skb_is_ours); +if (err) { +/* The skb is still ours only when the header checks rejected +* it; returning TC_ACT_CONSUMED for such a packet would leak +* it, since no caller frees an skb it was told it no longer +* owns. +*/ +if (skb_is_ours) + goto drop; goto out_frag; + } err =tcf_ct_skb_network_trim (skb, family);if (err)
Greg Kroah-Hartman
maintainerPATCH 275/303 netfilter: conntrack: sctp: use nf log infrastructure for invalid packets
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit f71cb8f45d092a1805e9ad474b6c6a17219cede5 ]
The conntrack logging facilities include useful info such as in/out interface names and packet headers.
Use those in more places instead of pr_debug calls. Furthermore, several pr_debug calls can be removed, they are useless on production machines due to the sheer volume of log messages.
Stable-dep-of: 2d19b95c9723 ("netfilter: nf_conntrack: defer invalid log until after unlock")
--- net/netfilter/nf_conntrack_proto_sctp.c | 44 ++++++++++---------------------- 1 file changed, 15 insertions(+), 29 deletions(-)
net/netfilter/nf_conntrack_proto_sctp.c +15 -29
@@ -152,7 +152,8 @@ for ((offset) = (dataoff) + sizeof(strucstatic int do_basic_checks (struct nf_conn *ct,const struct sk_buff *skb,unsigned int dataoff, -unsigned long *map) +unsigned long *map, +const struct nf_hook_state *state) {u_int32_t offset, count;struct sctp_chunkhdr _sch, *sch;
@@ -161,8 +162,6 @@ static int do_basic_checks(struct nf_con flag =0 ; for_each_sctp_chunk (skb, sch, _sch, offset, dataoff, count) { -pr_debug ("Chunk Num: %d Type: %d\n" , count, sch->type); -if (sch->type ==SCTP_CID_INIT || sch->type ==SCTP_CID_INIT_ACK || sch->type ==SCTP_CID_SHUTDOWN_COMPLETE )
@@ -177,7 +176,9 @@ static int do_basic_checks(struct nf_con sch->type == SCTP_CID_COOKIE_ECHO || flag) && count != 0) || !sch->length) { -pr_debug ("Basic checks failed\n" ); +nf_ct_l4proto_log_invalid (skb, ct, state, +"%s failed. chunk num %d, type %d, len %d flag %d\n" , + __func__, count, sch->type, sch->length, flag);return 1 ; }
@@ -185,7 +186,6 @@ static int do_basic_checks(struct nf_conset_bit (sch->type, map); } -pr_debug ("Basic checks passed\n" );return count ==0 ; }
@@ -195,64 +195,47 @@ static int sctp_new_state(enum ip_conntr {int i; -pr_debug ("Chunk type: %d\n" , chunk_type); -switch (chunk_type) {case SCTP_CID_INIT : -pr_debug ("SCTP_CID_INIT\n" ); i =0 ;break ;case SCTP_CID_INIT_ACK : -pr_debug ("SCTP_CID_INIT_ACK\n" ); i =1 ;break ;case SCTP_CID_ABORT : -pr_debug ("SCTP_CID_ABORT\n" ); i =2 ;break ;case SCTP_CID_SHUTDOWN : -pr_debug ("SCTP_CID_SHUTDOWN\n" ); i =3 ;break ;case SCTP_CID_SHUTDOWN_ACK : -pr_debug ("SCTP_CID_SHUTDOWN_ACK\n" ); i =4 ;break ;case SCTP_CID_ERROR : -pr_debug ("SCTP_CID_ERROR\n" ); i =5 ;break ;case SCTP_CID_COOKIE_ECHO : -pr_debug ("SCTP_CID_COOKIE_ECHO\n" ); i =6 ;break ;case SCTP_CID_COOKIE_ACK : -pr_debug ("SCTP_CID_COOKIE_ACK\n" ); i =7 ;break ;case SCTP_CID_SHUTDOWN_COMPLETE : -pr_debug ("SCTP_CID_SHUTDOWN_COMPLETE\n" ); i =8 ;break ;case SCTP_CID_HEARTBEAT : -pr_debug ("SCTP_CID_HEARTBEAT" ); i =9 ;break ;case SCTP_CID_HEARTBEAT_ACK : -pr_debug ("SCTP_CID_HEARTBEAT_ACK" ); i =10 ;break ;default :/* Other chunks like DATA or SACK do not change the state */ -pr_debug ("Unknown chunk type, Will stay in %s\n" , - sctp_conntrack_names[cur_state]); +pr_debug ("Unknown chunk type %d, Will stay in %s\n" , + chunk_type, sctp_conntrack_names[cur_state]);return cur_state; } -pr_debug ("dir: %d cur_state: %s chunk_type: %d new_state: %s\n" , - dir, sctp_conntrack_names[cur_state], chunk_type, - sctp_conntrack_names[sctp_conntracks[dir][i][cur_state]]); -return sctp_conntracks[dir][i][cur_state]; }
@@ -369,7 +352,7 @@ int nf_conntrack_sctp_packet(struct nf_cif (sh ==NULL ) goto out; -if (do_basic_checks (ct, skb, dataoff, map) !=0 ) +if (do_basic_checks (ct, skb, dataoff, map, state) !=0 ) goto out;if (!nf_ct_is_confirmed (ct)) {
@@ -392,7 +375,9 @@ int nf_conntrack_sctp_packet(struct nf_c !test_bit(SCTP_CID_HEARTBEAT, map) && !test_bit(SCTP_CID_HEARTBEAT_ACK, map) && sh->vtag != ct->proto.sctp.vtag[dir]) { -pr_debug ("Verification tag check failed\n" ); +nf_ct_l4proto_log_invalid (skb, ct, state, +"verification tag check failed %x vs %x for dir %d" , + sh->vtag, ct->proto.sctp.vtag[dir], dir); goto out; }
@@ -470,9 +455,10 @@ int nf_conntrack_sctp_packet(struct nf_c/* Invalid */ if (new_state ==SCTP_CONNTRACK_MAX ) { -pr_debug ("nf_conntrack_sctp: Invalid dir=%i ctype=%u " -"conntrack=%u\n" , - dir, sch->type, old_state); +nf_ct_l4proto_log_invalid (skb, ct, state, +"Invalid, old_state %d, dir %d, type %d" , + old_state, dir, sch->type); + goto out_unlock; }
Greg Kroah-Hartman
maintainerPATCH 276/303 netfilter: nf_conntrack: defer invalid log until after unlock
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zihan Xi <[email protected]>
[ Upstream commit 2d19b95c9723001f214f7a47d67b09f46238f200 ]
TCP and SCTP conntrack paths can emit invalid-packet logs while ct->lock is still held.
When invalid logging is routed to nfnetlink_log and conntrack export is enabled, the log path can re-enter conntrack netlink glue and dump the same conntrack again. Protocol attribute dumping may take ct->lock, so logging while holding that lock can deadlock.
Defer the TCP invalid logs by storing only the minimal log context while ct->lock is held and emitting the log after unlocking. Also make the TCP timeout-lowering invalid path return whether a log is needed, then emit that log after unlocking.
Do the same for the SCTP invalid state-transition log that can be reached while ct->lock is held.
Add a lockdep assertion to nf_ct_l4proto_log_invalid() so future callers that log invalid conntracks while holding ct->lock are caught outside TCP and SCTP as well.
--- net/netfilter/nf_conntrack_proto.c | 6 + net/netfilter/nf_conntrack_proto_sctp.c | 12 +- net/netfilter/nf_conntrack_proto_tcp.c | 132 +++++++++++++++++++++----------- 3 files changed, 102 insertions(+), 48 deletions(-)
net/netfilter/nf_conntrack_proto.c +6 -0
@@ -79,6 +79,12 @@ void nf_ct_l4proto_log_invalid(const strstruct net *net;va_list args; +/* nfnetlink_log may re-enter conntrack attribute dumping and try to +* take ct->lock again via helpers such as tcp_to_nlattr(), so invalid +* conntrack logs must only be emitted after dropping ct->lock. +*/ +lockdep_assert_not_held (&ct->lock); + net =nf_ct_net (ct);if (likely (net->ct.sysctl_log_invalid ==0 ))return ;
net/netfilter/nf_conntrack_proto_sctp.c +8 -4
@@ -340,10 +340,12 @@ int nf_conntrack_sctp_packet(struct nf_cstruct sctphdr _sctph;const struct sctp_chunkhdr *sch;struct sctp_chunkhdr _sch; +bool log_invalid = false;u_int32_t offset, count;unsigned int *timeouts;unsigned long map[256 /sizeof (unsigned long )] = {0 };bool ignore = false; +u8 invalid_type =0 ;if (sctp_error (skb, dataoff, state))return -NF_ACCEPT ;
@@ -455,10 +457,8 @@ int nf_conntrack_sctp_packet(struct nf_c/* Invalid */ if (new_state ==SCTP_CONNTRACK_MAX ) { -nf_ct_l4proto_log_invalid (skb, ct, state, -"Invalid, old_state %d, dir %d, type %d" , - old_state, dir, sch->type); - + log_invalid = true; + invalid_type = sch->type; goto out_unlock; }
@@ -533,6 +533,10 @@ int nf_conntrack_sctp_packet(struct nf_c out_unlock:spin_unlock_bh (&ct->lock); +if (log_invalid) +nf_ct_l4proto_log_invalid (skb, ct, state, +"Invalid, old_state %d, dir %d, type %d" , + old_state, dir, invalid_type); out:return -NF_ACCEPT ; }
net/netfilter/nf_conntrack_proto_tcp.c +88 -44
225 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 277/303 arm64: tegra: Add EL2 virtual timer interrupt for Tegra194
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jon Hunter <[email protected]>
[ Upstream commit a7c28483fd57dd0e1487024af70622315320774b ]
Commit d87773de9efe ("clocksource/drivers/arm_arch_timer: Default to EL2 virtual timer when running VHE") updated the ARM arch timer driver to use the virtual timer by default if the CPU is running at EL2 with VHE enabled. If the CPU is running at EL2 with VHE enabled but there is no interrupt provided for the virtual timer, then the following warning is displayed:
arch_timer: [Firmware Bug]: VHE-capable CPU without EL2 virtual timer
interrupt
This warning is observed on Tegra194 platforms. Tegra194 SoC includes NVIDIA Carmel ARM v8.2 CPUs and support an EL2 virtual timer. Fix the above warning by adding the PPI for the EL2 virtual timer interrupt for Tegra194.
--- arch/arm64/boot/dts/nvidia/tegra194.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/nvidia/tegra194.dtsi +2 -0
@@ -3166,6 +3166,8 @@ timer { <GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>, <GIC_PPI 10 + (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>, + <GIC_PPI 15 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>; interrupt-parent = <&gic>; always-on;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 278/303 crypto: ccm - Set rfc4309 maxauthsize from child
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit 438f4896f78f69ec73d5f32d2c024193f1223569 ]
Set the maxauthsize of rfc4309 using that of the child algorithm.
--- crypto/ccm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
crypto/ccm.c +1 -1
@@ -753,7 +753,7 @@ static int crypto_rfc4309_create(struct crypto_template *tmpl, inst->alg.ivsize =8 ; inst->alg.chunksize =crypto_aead_alg_chunksize (alg); - inst->alg.maxauthsize =16 ; + inst->alg.maxauthsize =crypto_aead_alg_maxauthsize (alg); inst->alg.base.cra_ctxsize =sizeof (struct crypto_rfc4309_ctx );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 279/303 netfilter: ipset: fix refcount race between list:set GC and swap
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei (Microsoft) <[email protected]>
[ Upstream commit 0c88868271653537ed443272dd8e7d13634d214b ]
__ip_set_put_byindex() resolved the index to a set pointer under RCU, then took ip_set_ref_lock in __ip_set_put() to decrement set->ref. ip_set_swap() holds that same lock while swapping both the ip_set_list slots and the two sets' ref counters, so it can interleave between the dereference and the lock acquisition, leaving the caller to decrement a set whose reference already moved to the other index and hit BUG_ON(set->ref == 0). list_set_gc() reaches this from timer softirq, which the nfnl mutex does not serialize against swap: an expiring list:set member calls list_set_del() -> ip_set_put_byindex() while IPSET_CMD_SWAP runs on the referenced sets.
Resolve the index and decrement under ip_set_ref_lock, as ip_set_swap() already does, keeping the refcount tied to the index rather than to a stale set pointer.
kernel BUG at net/netfilter/ipset/ip_set_core.c:685!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:ip_set_put_byindex (net/netfilter/ipset/ip_set_core.c:870) Call Trace: <IRQ> list_set_del (net/netfilter/ipset/ip_set_list_set.c:159) set_cleanup_entries (net/netfilter/ipset/ip_set_list_set.c:181) list_set_gc (net/netfilter/ipset/ip_set_list_set.c:578) call_timer_fn (kernel/time/timer.c:1748) __run_timers (kernel/time/timer.c:1799 kernel/time/timer.c:2374) run_timer_softirq (kernel/time/timer.c:2405) </IRQ> Kernel panic - not syncing: Fatal exception in interrupt
--- net/netfilter/ipset/ip_set_core.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-)
net/netfilter/ipset/ip_set_core.c +13 -6
@@ -679,11 +679,18 @@ __ip_set_get(struct ip_set *set) }static void -__ip_set_put (struct ip_set *set) +__ip_set_put_locked (struct ip_set *set) { -write_lock_bh (&ip_set_ref_lock); +lockdep_assert_held (&ip_set_ref_lock);BUG_ON (set->ref ==0 ); set->ref--; +} + +static void +__ip_set_put (struct ip_set *set) +{ +write_lock_bh (&ip_set_ref_lock); +__ip_set_put_locked (set);write_unlock_bh (&ip_set_ref_lock); }
@@ -856,11 +863,11 @@ __ip_set_put_byindex(struct ip_set_net *inst, ip_set_id_t index) {struct ip_set *set; -rcu_read_lock (); - set =rcu_dereference (inst->ip_set_list)[index]; +write_lock_bh (&ip_set_ref_lock); + set =ip_set (inst, index);if (set) -__ip_set_put (set); -rcu_read_unlock (); +__ip_set_put_locked (set); +write_unlock_bh (&ip_set_ref_lock); }void
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 280/303 netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Velichayshiy <[email protected]>
[ Upstream commit d02f592064347e0c1e0d84f24941ad338838cc48 ]
In nft_flow_rule_offload_abort(), WARN_ON_ONCE(err) is triggered on every error during rollback, including -ENOMEM. Memory allocation failures are expected under low-memory conditions and do not indicate a kernel bug.
Trace for example:nft_flow_offload_chain() // FLOW_BLOCK_BIND
nft_flow_block_chain()
nft_chain_offload_cmd()
nft_block_offload_cmd()
->ndo_setup_tc()
nsim_setup_tc()
flow_block_cb_setup_simple()
flow_block_cb_alloc() // fails to -ENOMEMThe warning was reproduced on the 5.10 stable kernel under memory pressure via fault injection, but the underlying bug exists in mainline as well, as demonstrated by the ENOMEM trace above. The following splat was triggered during nf_tables transaction processing:
WARNING: CPU: 0 PID: 8567 at net/netfilter/nf_tables_offload.c:532 nft_flow_rule_offload_abort net/netfilter/nf_tables_offload.c:532 [inline] WARNING: CPU: 0 PID: 8567 at net/netfilter/nf_tables_offload.c:532 nft_flow_rule_offload_commit+0x971/0xcd0 net/netfilter/nf_tables_offload.c:591 Modules linked in: CPU: 0 PID: 8567 Comm: syz-executor.0 Not tainted 5.10.260-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:nft_flow_rule_offload_abort net/netfilter/nf_tables_offload.c:532 [inline] RIP: 0010:nft_flow_rule_offload_commit+0x971/0xcd0 net/netfilter/nf_tables_offload.c:591 Call Trace: nf_tables_commit+0x3bd/0x4bd0 net/netfilter/nf_tables_api.c:8604 nfnetlink_rcv_batch+0xb1e/0x1f20 net/netfilter/nfnetlink.c:509 nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:579 [inline] nfnetlink_rcv+0x3b3/0x420 net/netfilter/nfnetlink.c:597 netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] netlink_unicast+0x6cd/0xa00 net/netfilter/af_netlink.c:1340 netlink_sendmsg+0x906/0xe10 net/netfilter/af_netlink.c:1919 sock_sendmsg_nosec net/socket.c:651 [inline] __sock_sendmsg+0x155/0x190 net/socket.c:663 ____sys_sendmsg+0x705/0x870 net/socket.c:2379 ___sys_sendmsg+0x100/0x170 net/socket.c:2433 __sys_sendmsg+0xe9/0x1c0 net/socket.c:2462 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x67/0xd1
Change the condition to WARN_ON_ONCE(err && err != -ENOMEM) so that warnings are only emitted for unexpected errors. This aligns with the common kernel practice of not warning on -ENOMEM.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- net/netfilter/nf_tables_offload.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nf_tables_offload.c +1 -1
@@ -550,7 +550,7 @@ static void nft_flow_rule_offload_abort(struct net *net,break ; } -if (WARN_ON_ONCE (err)) +if (WARN_ON_ONCE (err && err != -ENOMEM ))break ; } }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 281/303 netfilter: flowtable: publish GC-visible tuple last
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jérémy Jean <[email protected]>
[ Upstream commit 2014ac62df9d45bb9a004a043e85df7be09ed780 ]
nf_flow_table_iterate() only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe and free a flow while flow_offload_add() is still inserting the reply node. Publish the reply node first and the original node last so GC never sees a partially installed flow.
KASAN can trigger slab-use-after-free read and write reports in the flowtable/rhashtable path (rht_deferred_worker, jhash, flow_offload_del, flow_offload_lookup, etc.).
--- net/netfilter/nf_flow_table_core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
net/netfilter/nf_flow_table_core.c +4 -3
@@ -276,17 +276,18 @@ int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow) flow->timeout = nf_flowtable_time_stamp +flow_offload_get_timeout (flow); err =rhashtable_insert_fast (&flow_table->rhashtable, - &flow->tuplehash[0 ].node, + &flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY ].node, nf_flow_offload_rhash_params);if (err <0 )return err; +/* GC only iterates original-direction entries; publish original last. */ err =rhashtable_insert_fast (&flow_table->rhashtable, - &flow->tuplehash[1 ].node, + &flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL ].node, nf_flow_offload_rhash_params);if (err <0 ) {rhashtable_remove_fast (&flow_table->rhashtable, - &flow->tuplehash[0 ].node, + &flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY ].node, nf_flow_offload_rhash_params);return err; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 282/303 netfilter: ipset: fix list type element drift bug
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 4cbd69766b35a089664cadb1f613bb85f7ef77a9 ]
If list_set_uadd() calls list_set_replace() to swap an expired entry, the element count remains the same, therefore the increment must be elided.
--- net/netfilter/ipset/ip_set_list_set.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
net/netfilter/ipset/ip_set_list_set.c +5 -2
@@ -301,9 +301,12 @@ list_set_uadd(struct ip_set *set, void *value, const struct ip_set_ext *ext, e->set = set;INIT_LIST_HEAD (&e->list);list_set_init_extensions (set, ext, e); -if (n) +if (n) {list_set_replace (set, e, n); -else if (next) +return 0 ; + } + +if (next)list_add_tail_rcu (&e->list, &next->list);else if (prev)list_add_rcu (&e->list, &prev->list);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 283/303 netfilter: ipset: let destroy callbacks adjust ext mem size
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 490937b88cb592cc0c5367758edd700fd5abd15c ]
For bitmap this change makes no difference, because destructors are called synchronously.
List type however calls them via call_rcu() so accounting decrement can happen after list_set_flush() set ext_size to 0.
'set->elements = 0' can be removed for the same reason in the list type case, it calls 'set->elements--' for each element.
--- net/netfilter/ipset/ip_set_bitmap_gen.h | 2 +- net/netfilter/ipset/ip_set_list_set.c | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-)
net/netfilter/ipset/ip_set_bitmap_gen.h +1 -1
@@ -75,7 +75,7 @@ mtype_flush(struct ip_set *set)mtype_ext_cleanup (set);bitmap_zero (map->members, map->elements); set->elements =0 ; -atomic64_set (&set->ext_size,0 ); +DEBUG_NET_WARN_ON_ONCE (atomic64_read (&set->ext_size) >0 ); }/* Calculate the actual memory size of the set data */
net/netfilter/ipset/ip_set_list_set.c +1 -2
@@ -423,8 +423,7 @@ list_set_flush(struct ip_set *set)list_for_each_entry_safe (e, n, &map->members, list)list_set_del (set, e); - set->elements =0 ; -atomic64_set (&set->ext_size,0 ); +DEBUG_NET_WARN_ON_ONCE (set->elements >0 ); } static void
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 284/303 ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit e16e960d55a40d36bd7c2494cc005e757dc9a1ef ]
ipvlan devices inherit hard_header_len from phy_dev during ipvlan_init(), but leave needed_headroom and needed_tailroom set to 0.
When the underlying phy_dev (or stacked lower device) requires extra headroom or tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or veth with rx headroom), upper layers calculating packet headroom and tailroom fail to reserve sufficient space.
This can result in reallocation overhead, skb headroom underflows, or KASAN slab-use-after-free crashes when dev_hard_header() / ipvlan_hard_header() prepends header data or when lower devices append tailroom.
Fix this by:
1. Inheriting needed_headroom and needed_tailroom from phy_dev in ipvlan_init().
2. Propagating needed_headroom and needed_tailroom updates to attached ipvlans in ipvlan_device_event() when receiving NETDEV_FEAT_CHANGE events.
--- drivers/net/ipvlan/ipvlan_main.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ipvlan/ipvlan_main.c +4 -0
@@ -144,6 +144,8 @@ static int ipvlan_init(struct net_device *dev) dev->hw_enc_features |= dev->features;netif_inherit_tso_max (dev, phy_dev); dev->hard_header_len = phy_dev->hard_header_len; + dev->needed_headroom = phy_dev->needed_headroom; + dev->needed_tailroom = phy_dev->needed_tailroom;netdev_lockdep_set_classes (dev);
@@ -767,6 +769,8 @@ static int ipvlan_device_event(struct notifier_block *unused,case NETDEV_FEAT_CHANGE :list_for_each_entry (ipvlan, &port->ipvlans, pnode) {netif_inherit_tso_max (ipvlan->dev, dev); + ipvlan->dev->needed_headroom = dev->needed_headroom; + ipvlan->dev->needed_tailroom = dev->needed_tailroom;netdev_update_features (ipvlan->dev); }break ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 285/303 macvlan: inherit needed_headroom and needed_tailroom from lowerdev
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit cef51860becd9700217c81732ca1eb1ea6ed6fe1 ]
macvlan devices inherit hard_header_len from lowerdev during macvlan_init(), but leave needed_headroom and needed_tailroom set to 0.
When the underlying lowerdev requires extra headroom or tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or veth with rx headroom), upper layers calculating packet headroom and tailroom fail to reserve sufficient space.
This can result in reallocation overhead, skb headroom underflows, or KASAN slab-use-after-free crashes when dev_hard_header() / macvlan_hard_header() prepends header data or when lower devices append tailroom.
Fix this by:
1. Inheriting needed_headroom and needed_tailroom from lowerdev in macvlan_init().
2. Propagating needed_headroom and needed_tailroom updates to attached macvlans in macvlan_device_event() when receiving NETDEV_FEAT_CHANGE events.
--- drivers/net/macvlan.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/macvlan.c +4 -0
@@ -913,6 +913,8 @@ static int macvlan_init(struct net_device *dev) dev->hw_enc_features |= dev->features;netif_inherit_tso_max (dev, lowerdev); dev->hard_header_len = lowerdev->hard_header_len; + dev->needed_headroom = lowerdev->needed_headroom; + dev->needed_tailroom = lowerdev->needed_tailroom;macvlan_set_lockdep_class (dev); vlan->pcpu_stats = netdev_alloc_pcpu_stats(struct vlan_pcpu_stats);
@@ -1780,6 +1782,8 @@ static int macvlan_device_event(struct notifier_block *unused,case NETDEV_FEAT_CHANGE :list_for_each_entry (vlan, &port->vlans, list) {netif_inherit_tso_max (vlan->dev, dev); + vlan->dev->needed_headroom = dev->needed_headroom; + vlan->dev->needed_tailroom = dev->needed_tailroom;netdev_update_features (vlan->dev); }break ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 286/303 net: packet: fix wrong transport_header when sending VLAN-tagged frame
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <[email protected]>
[ Upstream commit 01fdecc0480d916c799dbee584833a4a37e94d06 ]
In packet_parse_headers(), when processing a VLAN-tagged frame, skb_set_network_header() is called to advance network_header past the VLAN tag to the inner protocol header. skb_probe_transport_header() is then called with skb->protocol still set to the outer VLAN EtherType (e.g. ETH_P_8021Q), while nhoff (derived from skb_network_offset()) already points past the VLAN tag to the inner protocol header.
In __skb_flow_dissect(), proto is initialized to ETH_P_8021Q and nhoff points past the VLAN tag. When the dissector hits case ETH_P_8021Q, it reads a struct vlan_hdr at nhoff via __skb_header_pointer(), but that offset contains the inner protocol header (e.g. an IP header). The bytes are misinterpreted as a VLAN header, yielding a garbage encapsulated EtherType that matches no known protocol. The dissector returns false, so skb_probe_transport_header() never calls skb_set_transport_header(), leaving transport_header at its uninitialized sentinel value (~0U).
Move skb_probe_transport_header() to before skb_set_network_header(). At the time skb_probe_transport_header() is called, network_header still points to the VLAN header, so nhoff correctly points to the VLAN header. The flow dissector can then parse the VLAN header, extract the inner EtherType, and advance nhoff to the inner protocol header, allowing transport_header to be set correctly.
--- net/packet/af_packet.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/packet/af_packet.c +2 -2
@@ -1985,13 +1985,13 @@ static void packet_parse_headers(struct sk_buff *skb, struct socket *sock) sock->type == SOCK_RAW) skb->protocol =dev_parse_header_protocol (skb); +skb_probe_transport_header (skb); +/* Move network header to the right position for VLAN tagged packets */ if (likely (skb->dev->type ==ARPHRD_ETHER ) &ð_type_vlan (skb->protocol) &&vlan_get_protocol_and_depth (skb, skb->protocol, &depth) !=0 )skb_set_network_header (skb, depth); - -skb_probe_transport_header (skb); }/*
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 287/303 net/tls: Fail tls_sw_splice_read() after a failed async decrypt
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit 976df67f463db1fddaf2a32fb04f57ad2891a23d ]
When an async decrypt fails, tls_decrypt_done() records the error in ctx->async_wait.err and calls tls_err_abort(), which stores it in sk_err. tls_sw_recvmsg() and tls_sw_read_sock() each read async_wait.err once they hold the reader lock and fail the call: a record that did not authenticate breaks the connection.
tls_sw_splice_read() has no such check, and sk_err does not stand in for one. tls_rx_rec_wait() tests sk_err only inside the loop it skips whenever a record is already parsed, and the first reader to reach sock_error() clears it, while async_wait.err persists. A splice therefore keeps delivering records on a connection that recvmsg() and read_sock() refuse to read.
Read async_wait.err in tls_sw_splice_read() as the other two readers do.
--- net/tls/tls_sw.c | 5 +++++ 1 file changed, 5 insertions(+)
net/tls/tls_sw.c +5 -0
@@ -2350,6 +2350,11 @@ ssize_t tls_sw_splice_read(struct socket *sock, loff_t *ppos,if (err <0 )return err; +/* If crypto failed the connection is broken */ + err = ctx->async_wait.err; +if (err) + goto splice_read_end; +if (!skb_queue_empty (&ctx->rx_list)) { skb =__skb_dequeue (&ctx->rx_list); }else {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 288/303 ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <[email protected]>
[ Upstream commit f12afefb7b01f94d6d66d397f323a9914edbf70e ]
The irq handlers take a struct device pointer and call dev_get_drvdata() to obtain the driver data. However, the driver data is only set at the end of probe, after devm_request_irq(), so an interrupt taken in between causes the handlers to pass a NULL pointer to readl() and crash.
Pass the private data directly as the devm_request_irq() argument instead of the device pointer, matching what the handlers expect.
--- sound/soc/xilinx/xlnx_formatter_pcm.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
sound/soc/xilinx/xlnx_formatter_pcm.c +4 -6
@@ -281,8 +281,7 @@ static irqreturn_t xlnx_mm2s_irq_handler(int irq, void *arg) {u32 val;void __iomem *reg; -struct device *dev = arg; -struct xlnx_pcm_drv_data *adata =dev_get_drvdata (dev); +struct xlnx_pcm_drv_data *adata = arg; reg = adata->mmio +XLNX_MM2S_OFFSET +XLNX_AUD_STS ; val =readl (reg);
@@ -300,8 +299,7 @@ static irqreturn_t xlnx_s2mm_irq_handler(int irq, void *arg) {u32 val;void __iomem *reg; -struct device *dev = arg; -struct xlnx_pcm_drv_data *adata =dev_get_drvdata (dev); +struct xlnx_pcm_drv_data *adata = arg; reg = adata->mmio +XLNX_S2MM_OFFSET +XLNX_AUD_STS ; val =readl (reg);
@@ -637,7 +635,7 @@ static int xlnx_formatter_pcm_probe(struct platform_device *pdev) } ret =devm_request_irq (dev, aud_drv_data->mm2s_irq, xlnx_mm2s_irq_handler,0 , -"xlnx_formatter_pcm_mm2s_irq" , dev); +"xlnx_formatter_pcm_mm2s_irq" , aud_drv_data);if (ret) {dev_err (dev,"xlnx audio mm2s irq request failed\n" ); goto clk_err;
@@ -664,7 +662,7 @@ static int xlnx_formatter_pcm_probe(struct platform_device *pdev) ret =devm_request_irq (dev, aud_drv_data->s2mm_irq, xlnx_s2mm_irq_handler,0 ,"xlnx_formatter_pcm_s2mm_irq" , - dev); + aud_drv_data);if (ret) {dev_err (dev,"xlnx audio s2mm irq request failed\n" ); goto clk_err;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 289/303 af_packet: Dont send zero-byte data in tpacket_snd().
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 6bcd76c134c55c697148acb5c0194e9666abdf84 ]
syzbot reported a WARNING in __dev_queue_xmit() triggered via tpacket_snd():
skb_assert_len
WARNING: at include/linux/skbuff.h:2753 skb_assert_len WARNING: at __dev_queue_xmit+0x21bc/0x4970 net/core/dev.c:4781 Call Trace: <TASK> dev_queue_xmit include/linux/netdevice.h:3448 [inline] packet_xmit+0x243/0x310 net/packet/af_packet.c:276 tpacket_snd net/packet/af_packet.c:2907 [inline] packet_sendmsg+0x28d6/0x4eb0 net/packet/af_packet.c:3134
When sending 0-byte packets via TPACKET ring buffer on devices with no hard header (e.g. dev->hard_header_len == 0), tpacket_fill_skb() populates an skb with skb->len == 0 and returns 0. tpacket_snd() then forwards this empty skb to packet_xmit(), causing __dev_queue_xmit() to hit skb_assert_len(skb).
Similar checks exist in packet_snd() via commit dc633700f00f ("net/af_packet: check len when min_header_len equals to 0") and in packet_sendmsg_spkt() via commit 6a341729fb31 ("af_packet: Don't send zero-byte data in packet_sendmsg_spkt().").
Return -EINVAL in tpacket_fill_skb() when skb->len is zero to reject zero-length packets in tpacket_snd().
--- net/packet/af_packet.c | 3 +++ 1 file changed, 3 insertions(+)
net/packet/af_packet.c +3 -0
@@ -2691,6 +2691,9 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb, len = ((to_write > len_max) ? len_max : to_write); } +if (unlikely (!skb->len)) +return -EINVAL ; +packet_parse_headers (skb, sock);return tp_len;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 290/303 net/sched: cls_u32: skip hash tables in u32_bind_class()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Changzhong <[email protected]>
[ Upstream commit 6d3724e616faf952c3adcf8414fc21a828ef3709 ]
u32_walk() enumerates both struct tc_u_hnode and struct tc_u_knode through the walker callback. u32_bind_class() unconditionally casts the passed fh to tc_u_knode and accesses &n->res, so when fh is actually a tc_u_hnode, which has no tcf_result member, this results in a slab-out-of-bounds read of res->classid in tc_cls_bind_class().
The issue can be reproduced with the following commands:
tc qdisc add dev lo root handle 1: hfsc
tc class add dev lo parent 1: classid 1:1 hfsc sc rate 1000kbit
tc filter add dev lo parent 1:1 protocol ip prio 1 u32 match u32 0 0 flowid 1:1 tc class add dev lo parent 1: classid 1:2 hfsc sc rate 2000kbit
Fix this by skipping hash tables via the TC_U32_KEY(handle) check.
--- net/sched/cls_u32.c | 3 +++ 1 file changed, 3 insertions(+)
net/sched/cls_u32.c +3 -0
@@ -1330,6 +1330,9 @@ static void u32_bind_class(void *fh, u32 classid, unsigned long cl, void *q, {struct tc_u_knode *n = fh; +if (TC_U32_KEY (n->handle) ==0 ) +return ; +tc_cls_bind_class (classid, cl, q, &n->res, base); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 291/303 net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siddharth Vadapalli <[email protected]>
[ Upstream commit 36a05d2820077bb3955acb8111e1041d39148037 ]
On the packet reception path, the ID of the MAC Port on which the packet was received, is embedded in the RX DMA Descriptor's metadata. The ID is extracted using the helper function cppi5_desc_get_tags_ids() which fills in the 16-bit Source Tag into the 'port_id' variable. However, it is only the lower 8-bits of the 16-bit Source Tag that represent the MAC Port ID, while the upper 8-bits are Hardware-Reserved and carry an arbitrary value. With the existing logic, sporadic kernel crash is observed due to the subsequent driver code accessing out-of-bound memory because of an invalid port_id.
Hence, fix the port_id extraction logic to use only the lower 8-bits of the Source Tag as the MAC Port ID.
--- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/ti/am65-cpsw-nuss.c +2 -0
@@ -727,6 +727,8 @@ static int am65_cpsw_nuss_rx_packets(struct am65_cpsw_common *common,k3_udma_glue_rx_cppi5_to_dma_addr (rx_chn->rx_chn, &buf_dma); pkt_len =cppi5_hdesc_get_pktlen (desc_rx);cppi5_desc_get_tags_ids (&desc_rx->hdr, &port_id,NULL ); +/* Port ID is contained in the lower 8-bits of the 16-bit Source Tag */ + port_id &=0xFF ;dev_dbg (dev,"%s rx port_id:%d\n" , __func__, port_id); port =am65_common_get_port (common, port_id); ndev = port->ndev;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 292/303 net/x25: fix use-after-free of the socket by its timers
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baul Lee <[email protected]>
commit 2195424c3da2ef1829a63b807e3a900a90e57d85 upstream.
The x25 timers are armed with mod_timer() and cancelled with timer_delete(), so a pending timer holds no reference on the socket and a cancel does not wait for a callback already running on another CPU.
x25_heartbeat_expiry() also rearms unconditionally, so it can reinstall sk->sk_timer after __x25_destroy_socket() has passed its cancel point. The following __sock_put() frees the socket while the timer is still queued, and the next expiry uses freed memory. KASAN reports a slab-use-after-free on the kmalloc-2k object freed by close().
timer_delete_sync() cannot be used here: x25_heartbeat_expiry() and x25_timer_expiry() both reach the cancels from inside the timer they would wait on, through __x25_destroy_socket() and x25_disconnect().
Arm the timers with sk_reset_timer() and cancel them with sk_stop_timer() so that an armed timer owns a reference, and release it in both expiry handlers. Rearm the heartbeat only while sk_hashed(sk) is still true, since __x25_destroy_socket() unlinks the socket before dropping it. Arm the deferred destroy timer the same way and drop its reference in x25_destroy_timer().
Reproduced on net with KASAN, with the heartbeat period shortened so the window recurs. With this patch the reproducer no longer triggers a report and /proc/net/x25 drains.
Discovered by XBOW, triaged by Baul Lee <[email protected]>
--- net/x25/af_x25.c | 4 ++-- net/x25/x25_timer.c | 25 ++++++++++++++++--------- 2 files changed, 18 insertions(+), 11 deletions(-)
net/x25/af_x25.c +2 -2
@@ -362,6 +362,7 @@ static void x25_destroy_timer(struct timstruct sock *sk =from_timer (sk, t, sk_timer);x25_destroy_socket_from_timer (sk); +sock_put (sk); }/*
@@ -397,9 +398,8 @@ static void __x25_destroy_socket(structif (sk_has_allocations (sk)) {/* Defer: outstanding buffers */ - sk->sk_timer.expires = jiffies +10 *HZ ; sk->sk_timer.function = x25_destroy_timer; -add_timer (&sk->sk_timer); +sk_reset_timer (sk, &sk->sk_timer, jiffies +10 *HZ ); }else {/* drop last reference so sock_put will free */ __sock_put (sk);
net/x25/x25_timer.c +16 -9
@@ -36,45 +36,45 @@ void x25_init_timers(struct sock *sk)void x25_start_heartbeat (struct sock *sk) { -mod_timer (&sk->sk_timer, jiffies +5 *HZ ); +sk_reset_timer (sk, &sk->sk_timer, jiffies +5 *HZ ); }void x25_stop_heartbeat (struct sock *sk) { -del_timer (&sk->sk_timer); +sk_stop_timer (sk, &sk->sk_timer); }void x25_start_t2timer (struct sock *sk) {struct x25_sock *x25 =x25_sk (sk); -mod_timer (&x25->timer, jiffies + x25->t2); +sk_reset_timer (sk, &x25->timer, jiffies + x25->t2); }void x25_start_t21timer (struct sock *sk) {struct x25_sock *x25 =x25_sk (sk); -mod_timer (&x25->timer, jiffies + x25->t21); +sk_reset_timer (sk, &x25->timer, jiffies + x25->t21); }void x25_start_t22timer (struct sock *sk) {struct x25_sock *x25 =x25_sk (sk); -mod_timer (&x25->timer, jiffies + x25->t22); +sk_reset_timer (sk, &x25->timer, jiffies + x25->t22); }void x25_start_t23timer (struct sock *sk) {struct x25_sock *x25 =x25_sk (sk); -mod_timer (&x25->timer, jiffies + x25->t23); +sk_reset_timer (sk, &x25->timer, jiffies + x25->t23); }void x25_stop_timer (struct sock *sk) { -del_timer (&x25_sk (sk)->timer); +sk_stop_timer (sk, &x25_sk (sk)->timer); }unsigned long x25_display_timer (struct sock *sk)
@@ -108,7 +108,7 @@ static void x25_heartbeat_expiry(struct sock_flag(sk, SOCK_DEAD))) {bh_unlock_sock (sk);x25_destroy_socket_from_timer (sk); -return ; + goto out; }break ;
@@ -120,8 +120,14 @@ static void x25_heartbeat_expiry(structbreak ; } restart_heartbeat: -x25_start_heartbeat (sk); +/* Do not rearm once __x25_destroy_socket() has unlinked the socket: +* it is past its cancel point and owns the teardown from there on. +*/ +if (sk_hashed (sk)) +x25_start_heartbeat (sk);bh_unlock_sock (sk); +out: +sock_put (sk); }/*
@@ -166,4 +172,5 @@ static void x25_timer_expiry(struct time }else x25_do_timer_expiry (sk);bh_unlock_sock (sk); +sock_put (sk); }
Greg Kroah-Hartman
maintainerPATCH 293/303 mm/huge_memory: fix huge_zero_pfn race
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Stoakes (ARM) <[email protected]>
commit 33192a26cddea7a7e4ca66e5c3eebd36fa8be2bb upstream.
Patch series "mm/huge_memory: fix huge_zero_pfn race", v2.
There is a subtle race in the reference-counted huge_zero_folio implementation.
The fast path atomic logic fails to account for the fact that the shrinker (which drops the final huge_zero_refcount pin) can overwrite huge_zero_pfn with the ~0UL sentinel value in shrink_huge_zero_folio_scan() after a racing get_huge_zero_folio() installed a valid value there.
This results in huge_zero_folio being correctly set but huge_zero_pfn being set incorrectly and thus is_huge_zero_pfn() and consequently is_huge_zero_pmd() will misidentify the huge zero folio as being an ordinary THP folio.
This can result in the huge zero folio being split and otherwise treated incorrectly.
The solution to this is very subtle as there is an atomic fast path, and thus ordering in weakly ordered architectures has to be treated very carefully.
The first commit fixes the issue by introducing a spinlock around huge_zero_[pfn, folio, refcount] write, with careful consideration paid to load/store ordering in the fast path. It is placed first and kept as small as possible so that it can be backported on its own.
The second commit is a pure cleanup which reworks the CONFIG_PERSISTENT_HUGE_ZERO_FOLIO logic to better separate the persistent logic from the dynamically allocated one.
This patch (of 2):
If !CONFIG_PERSISTENT_HUGE_ZERO_FOLIO, the huge_zero_folio is refcounted by huge_zero_refcount and returned by mm_get_huge_zero_folio().
When the caller is done with the huge zero page, its reference count is decremented. Only a shrinker can set the reference count to zero.
A race can unfortunately occur between a shrinker decrementing the reference count to zero and a concurrent page fault.
This is because shrink_huge_zero_folio_scan() might, if very unlucky, be preempted between setting huge_zero_refcount to zero and writing an invalid value.
During this time get_huge_zero_folio() could write to huge_zero_pfn before shrink_huge_zero_folio_scan() resumes.
In this event the huge zero folio will be persistently misidentified causing the THP code path to be entered inappropriately for the huge zero folio:
CPU 0 CPU 1
=======================================|=================================
shrink_huge_zero_folio_scan() |
atomic_cmpxchg() sets refcount to 0 |
xchg() sets huge_zero_folio to NULL | get_huge_zero_folio()
| | atomic_inc_not_zero() -> zero
preempted for a long time | Allocate new huge zero folio
| | Write valid huge_zero_folio
v | Write valid huge_zero_pfn Overwrite huge_zero_pfn with ~0UL <--- Invalid overwrite!
This results in is_huge_zero_pfn() and is_huge_zero_pmd() incorrectly returning false for a huge zero page which could result in issues like the huge zero folio being incorrectly split.
Note that the issue is with huge_zero_pfn not huge_zero_folio, as get_huge_zero_folio() uses cmpxchg() gated on huge_zero_folio being NULL with a retry loop and shrink_huge_zero_folio_scan() uses xchg() to set huge_zero_folio.
Fix the issue by introducing a spinlock, huge_zero_lock, to prevent concurrent write of huge_zero_folio, huge_zero_pfn and huge_zero_refcount.
There needs to be significant care taken here to ensure correctness:
The fast path in get_huge_zero_folio() uses atomic_inc_not_zero(), which is outside of the critical section, and means huge zero allocation is gated on zero huge_zero_refcount.
The fast path doesn't use huge_zero_lock, so the critical section is irrelevant to it.
So invariants are required - huge_zero_refcount MUST:
* Only be set in the huge_zero_lock critical section to ensure serialisation of huge_zero_pfn, huge_zero_folio and huge_zero_refcount writes.
* Be set non-zero only AFTER huge_zero_[pfn, folio] are set to valid values so installation of the huge zero folio on read page fault ensures concurrent is_huge_zero_*() calls correctly identify the huge zero folio.
* Be set zero only BEFORE huge_zero_[pfn, folio] are set to NULL and ~0UL respectively, and atomically.
Establish these by:
* Only setting huge_zero_refcount to zero or an absolute value in the huge_zero_lock critical section in get_huge_zero_folio() and shrink_huge_zero_folio_scan(), and always updating atomically there and elsewhere.
* Using atomic_set_release(&huge_zero_refcount) in get_huge_zero_folio() after huge_zero_[pfn, folio] are set. This is paired with atomic_inc_not_zero() to ensure atomic_inc_not_zero() only observes a non-zero value if huge_zero_[pfn, folio] are set.
* Using atomic_cmpxchg() in shrink_huge_zero_folio_scan() (as before) to ensure that it is set zero only when equal to 1 and set atomically.
* atomic_cmpxchg() being fully ordered ensures this is done prior to huge_zero_[folio, pfn] being set to NULL and ~0UL respectively.
Eliminate the retry loop in get_huge_zero_folio() as the atomic_cmpxchg() in shrink_huge_zero_folio_scan() is now performed under the lock, and replace with an equally locked atomic_inc() to set the reference count should the caller be raced on huge zero folio installation.
folio_put() naturally implies a full memory barrier so its ordering is maintained correctly.
The huge zero folio also cannot be released except when the shrinker does so as it is non-LRU and non-rmappable.
Note that only the huge zero shrinker (via shrink_huge_zero_folio_scan()) can actually set huge_zero_refcount to zero, which is the count of mm's which have at least one huge zero folio installed plus one shrinker pin.
Additionally convert a BUG_ON() to a VM_WARN_ON_ONCE().
--- mm/huge_memory.c | 43 +++++++++++++++++++++++++++++-------------- 1 file changed, 29 insertions(+), 14 deletions(-)
mm/huge_memory.c +29 -14
@@ -38,6 +38,7 @@#include <linux/sched/sysctl.h> #include <linux/memory-tiers.h> #include <linux/compat.h> +#include <linux/cleanup.h> #include <asm/tlb.h> #include <asm/pgalloc.h>
@@ -69,6 +70,7 @@ unsigned long transparent_hugepage_flagsstatic struct shrinker deferred_split_shrinker;static atomic_t huge_zero_refcount; +static DEFINE_SPINLOCK (huge_zero_lock);struct page *huge_zero_page__read_mostly ;unsigned long huge_zero_pfn__read_mostly = ~0UL ;
@@ -154,7 +156,8 @@ bool hugepage_vma_check(struct vm_area_sstatic bool get_huge_zero_page (void ) {struct page *zero_page; -retry: + +/* Paired with atomic_set_release(). */ if (likely (atomic_inc_not_zero (&huge_zero_refcount)))return true;
@@ -164,17 +167,22 @@ retry:count_vm_event (THP_ZERO_PAGE_ALLOC_FAILED );return false; } -preempt_disable (); -if (cmpxchg (&huge_zero_page,NULL , zero_page)) { -preempt_enable (); + +/* Paired with critical section in shrink_huge_zero_page_scan(). */ +spin_lock (&huge_zero_lock); +if (huge_zero_page) { +/* Somebody else already installed it. */ +atomic_inc (&huge_zero_refcount); +spin_unlock (&huge_zero_lock);__free_pages (zero_page,compound_order (zero_page)); - goto retry; +return true; } +WRITE_ONCE (huge_zero_page, zero_page);WRITE_ONCE (huge_zero_pfn,page_to_pfn (zero_page)); +/* Paired with atomic_inc_not_zero(). +1 for shrinker pin. */ +atomic_set_release (&huge_zero_refcount,2 ); +spin_unlock (&huge_zero_lock); -/* We take additional reference here. It will be put back by shrinker */ -atomic_set (&huge_zero_refcount,2 ); -preempt_enable ();count_vm_event (THP_ZERO_PAGE_ALLOC );return true; }
@@ -218,15 +226,22 @@ static unsigned long shrink_huge_zero_pastatic unsigned long shrink_huge_zero_page_scan (struct shrinker *shrink,struct shrink_control *sc) { -if (atomic_cmpxchg (&huge_zero_refcount,1 ,0 ) ==1 ) { -struct page *zero_page =xchg (&huge_zero_page,NULL ); -BUG_ON (zero_page ==NULL ); +struct page *zero_page; + +/* Paired with critical section in get_huge_zero_page(). */ + scoped_guard(spinlock, &huge_zero_lock) { +/* Paired with atomic_inc_not_zero() in get_huge_zero_page(). */ +if (atomic_cmpxchg (&huge_zero_refcount,1 ,0 ) !=1 ) +return 0 ; + + zero_page = huge_zero_page; +VM_WARN_ON_ONCE (!zero_page); +WRITE_ONCE (huge_zero_page,NULL );WRITE_ONCE (huge_zero_pfn, ~0UL ); -__free_pages (zero_page,compound_order (zero_page)); -return HPAGE_PMD_NR ; } -return 0 ; +__free_pages (zero_page,compound_order (zero_page)); +return HPAGE_PMD_NR ; }static struct shrinker huge_zero_page_shrinker = {
Greg Kroah-Hartman
maintainerPATCH 294/303 binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Brauner <[email protected]>
commit fa5990ca8fd917003e526036bcc50413edb9722c upstream.
For MISC_FMT_OPEN_FILE entries load_misc_binary() clones the registered interpreter file and denies write access to the clone via plain deny_write_access(). The clone is installed as bprm->interpreter and later released by the exec machinery through exe_file_allow_write_access() which skips the i_writecount increment for files with FMODE_FSNOTIFY_HSM set.
The deny and allow side can therefore come to different conclusions when pre-content watches are in play: if a pre-content watch is added to the interpreter after registration every subsequent exec through that entry takes a write denial on the clone that is never paired with a write allowance, driving the interpreter inode's i_writecount further down with each exec and leaving the interpreter unwritable even after the entry and all its users are gone.
Take the write denial via exe_file_deny_write_access() so both sides of the pairing base their decision on the same file mode, and propagate failure instead of silently ignoring it: an interpreter that is concurrently open for writing now fails the exec with ETXTBSY, exactly like an interpreter freshly opened via open_exec() would.
--- fs/binfmt_misc.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
fs/binfmt_misc.c +8 -2
@@ -220,8 +220,14 @@ static int load_misc_binary(struct linuxif (fmt->flags &MISC_FMT_OPEN_FILE ) { interp_file =file_clone_open (fmt->interp_file); -if (!IS_ERR (interp_file)) -deny_write_access (interp_file); +if (!IS_ERR (interp_file)) { +int err =exe_file_deny_write_access (interp_file); + +if (err) { +fput (interp_file); + interp_file =ERR_PTR (err); + } + } }else { interp_file =open_exec (fmt->interpreter); }
Greg Kroah-Hartman
maintainerPATCH 295/303 Bluetooth: hci_sync: Fix not using correct handle
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
commit 86fbd9f63a6b42b8f158361334f5a25762aea358 upstream.
When setting up an advertisement the code shall always attempt to use the handle set by the instance since it may not be equal to the instance ID.
--- net/bluetooth/hci_sync.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/bluetooth/hci_sync.c +1 -1
@@ -1479,7 +1479,7 @@ int hci_setup_ext_adv_instance_sync(stru cp.own_addr_type = own_addr_type; cp.channel_map = hdev->le_adv_channel_map; - cp.handle = instance; + cp.handle = adv ? adv->handle : instance;if (instance)hci_dev_unlock (hdev);
Greg Kroah-Hartman
maintainerPATCH 296/303 RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pedro Falcato <[email protected]>
commit c18646248fed07683d4cee8a8af933fc4fe83c0d upstream.
Ever since commit c2ff29e99a76 ("siw: Inline do_tcp_sendpages()"), we have been doing this:
static int siw_tcp_sendpages(struct socket *s, struct page **page, int offset,
size_t size)
[...]
/* Calculate the number of bytes we need to push, for this page
* specifically */
size_t bytes = min_t(size_t, PAGE_SIZE - offset, size);
/* If we can't splice it, then copy it in, as normal */
if (!sendpage_ok(page[i]))
msg.msg_flags &= ~MSG_SPLICE_PAGES;
/* Set the bvec pointing to the page, with len $bytes */
bvec_set_page(&bvec, page[i], bytes, offset);
/* Set the iter to $size, aka the size of the whole sendpages (!!!) */
iov_iter_bvec(&msg.msg_iter, ITER_SOURCE, &bvec, 1, size);
try_page_again:
lock_sock(sk);
/* Sendmsg with $size size (!!!) */
rv = tcp_sendmsg_locked(sk, &msg, size);This means we've been sending oversized iov_iters and tcp_sendmsg calls for a while. This has a been a benign bug because sendpage_ok() always returned true. With the recent slab allocator changes being slowly introduced into next (that disallow sendpage on large kmalloc allocations), we have recently hit out-of-bounds crashes, due to slight differences in iov_iter behavior between the MSG_SPLICE_PAGES and "regular" copy paths:
(MSG_SPLICE_PAGES)skb_splice_from_iter
iov_iter_extract_pages
iov_iter_extract_bvec_pages
uses i->nr_segs to correctly stop in its tracks before OoB'ing everywhere skb_splice_from_iter gets a "short" read
(!MSG_SPLICE_PAGES)skb_copy_to_page_nocache copy=iov_iter_count
[...]
copy_from_iter
/* this doesn't help */
if (unlikely(iter->count < len))
len = iter->count;
iterate_bvec
... and we run off the bvecsFix this by properly setting the iov_iter's byte count, plus sending the correct byte count to tcp_sendmsg_locked.
--- drivers/infiniband/sw/siw/siw_qp_tx.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/infiniband/sw/siw/siw_qp_tx.c +2 -3
@@ -339,18 +339,17 @@ static int siw_tcp_sendpages(struct socktcp_rate_check_app_limited (sk);bvec_set_page (&bvec, page[i], bytes, offset); -iov_iter_bvec (&msg.msg_iter,ITER_SOURCE , &bvec,1 , size); +iov_iter_bvec (&msg.msg_iter,ITER_SOURCE , &bvec,1 , bytes); try_page_again:lock_sock (sk); - rv =tcp_sendmsg_locked (sk, &msg, size); + rv =tcp_sendmsg_locked (sk, &msg, bytes);release_sock (sk);if (rv >0 ) { size -= rv; sent += rv;if (rv != bytes) { - offset += rv; bytes -= rv; goto try_page_again; }
Greg Kroah-Hartman
maintainerPATCH 297/303 usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrei Kuchynski <[email protected]>
commit fb0bf289f5d529336ef490c8273e88a8a8b29f69 upstream.
The commit 7aa7d4bf9d3f ("usb: typec: ucsi: Fix race condition and ordering in port unregistration") consolidated port teardown into the ucsi_unregister_port() helper. However, it introduced an ordering problem in the ucsi_init() error path.
Fix this by ensuring ucsi_unregister_port() is called before we unregister their corresponding lockdep keys.
--- drivers/usb/typec/ucsi/ucsi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/typec/ucsi/ucsi.c +2 -2
@@ -1390,11 +1390,11 @@ static int ucsi_init(struct ucsi *ucsi)return 0 ; err_unregister: +for (con = connector; con->port; con++) +ucsi_unregister_port (con);for (i =0 ; i < ucsi->cap.num_connectors; i++)lockdep_unregister_key (&connector[i].lock_key); -for (con = connector; con->port; con++) -ucsi_unregister_port (con);kfree (connector); err_reset:memset (&ucsi->cap,0 ,sizeof (ucsi->cap));
Greg Kroah-Hartman
maintainerPATCH 298/303 erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gao Xiang <[email protected]>
commit a64d500b0078e16e9abb25baca4dee1dbc9054fc upstream.
CONFIG_NR_CPUS doesn't define on some UP platforms (e.g. arm), so this can cause make oldconfig to loop indefinitely when CONFIG_SMP=n:
$ make ARCH=arm allmodconfig $ sed -i "/CONFIG_SMP=y/d" .config $ sed -i "/CONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS.*/d" .config
EROFS LZMA default maximum decompression streams (EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS) [0] (NEW) EROFS LZMA default maximum decompression streams (EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS) [0] (NEW)
...
Let's guard NR_CPUS with SMP instead of using a hardcoded arbitrary CPU uplimit here, similar to commit a3344078101c ("mm: make SPLIT_PTE_PTLOCKS depend on SMP").
The initial report from SJ Park was for m68k [1] (m68k is the only arch without NR_CPUS in Kconfig), and that got fixed in commit 1fd495ef09ee ("m68k: Define NR_CPUS to 1")
--- fs/erofs/Kconfig | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/erofs/Kconfig +2 -1
@@ -102,7 +102,8 @@ config EROFS_FS_ZIP_LZMA config EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS int "EROFS LZMA default maximum decompression streams" depends on EROFS_FS_ZIP_LZMA - range 1 NR_CPUS + range 1 NR_CPUS if SMP + range 1 1 if !SMP default 16 help By default EROFS allocates one LZMA decompression stream per CPU.
Greg Kroah-Hartman
maintainerPATCH 299/303 udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robert Mader <[email protected]>
commit 1d0e25c1ddf2063c499264fb2ba0fa6a3e4f8a00 upstream.
The message of commit 504e2b4ab97a ("dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning") says:
Quoted 4 lines
The CPU sync at map/unmap time is also redundant for udmabuf:
begin_cpu_udmabuf()andend_cpu_udmabuf()already perform explicit cache synchronization via dma_sync_sgtable_for_cpu/device() when CPU access is requested through the dma-buf interface.
This, however, does not apply to the first time begin_cpu_udmabuf() is called on an udmabuf, in which case the implementation previously relied on get_sg_table() to perform the cache synchronisation.
Ensure to call dma_sync_sgtable_for_cpu() in that case as well.
--- drivers/dma-buf/udmabuf.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/dma-buf/udmabuf.c +5 -4
@@ -127,21 +127,22 @@ static int begin_cpu_udmabuf(struct dma_ {struct udmabuf *ubuf = buf->priv;struct device *dev = ubuf->device->this_device; -int ret =0 ;if (!ubuf->sg) { ubuf->sg =get_sg_table (dev, buf, direction);if (IS_ERR (ubuf->sg)) { +int ret; + ret =PTR_ERR (ubuf->sg); ubuf->sg =NULL ; +return ret; }else { ubuf->sg_dir = direction; } - }else { -dma_sync_sgtable_for_cpu (dev, ubuf->sg, direction); } -return ret; +dma_sync_sgtable_for_cpu (dev, ubuf->sg, direction); +return 0 ; } static int end_cpu_udmabuf(struct dma_buf *buf,
Greg Kroah-Hartman
maintainerPATCH 300/303 Bluetooth: hci_sock: Prevent race in socket write iter and sock bind
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
commit 89bb613511cc21ed5ba6bddc1c9b9ae9c0dad392 upstream.
There is a potential race condition between sock bind and socket write iter. bind may free the same cmd via mgmt_pending before write iter sends the cmd, just as syzbot reported in UAF[1].
Here we use hci_dev_lock to synchronize the two, thereby avoiding the UAF mentioned in [1].
[1]
syzbot reported:
BUG: KASAN: slab-use-after-free in mgmt_pending_remove+0x3b/0x210 net/bluetooth/mgmt_util.c:316 Read of size 8 at addr ffff888077164818 by task syz.0.17/5989 Call Trace: mgmt_pending_remove+0x3b/0x210 net/bluetooth/mgmt_util.c:316 set_link_security+0x5c2/0x710 net/bluetooth/mgmt.c:1918 hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719 hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 sock_write_iter+0x279/0x360 net/socket.c:1195 Allocated by task 5989: mgmt_pending_add+0x35/0x140 net/bluetooth/mgmt_util.c:296 set_link_security+0x557/0x710 net/bluetooth/mgmt.c:1910 hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719 hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 sock_write_iter+0x279/0x360 net/socket.c:1195 Freed by task 5991: mgmt_pending_free net/bluetooth/mgmt_util.c:311 [inline] mgmt_pending_foreach+0x30d/0x380 net/bluetooth/mgmt_util.c:257 mgmt_index_removed+0x112/0x2f0 net/bluetooth/mgmt.c:9477 hci_sock_bind+0xbe9/0x1000 net/bluetooth/hci_sock.c:1314
--- net/bluetooth/hci_sock.c | 2 ++ 1 file changed, 2 insertions(+)
net/bluetooth/hci_sock.c +2 -0
@@ -1247,7 +1247,9 @@ static int hci_sock_bind(struct socket * goto done; } +hci_dev_lock (hdev);mgmt_index_removed (hdev); +hci_dev_unlock (hdev); err =hci_dev_open (hdev->id);if (err) {
Greg Kroah-Hartman
maintainerPATCH 301/303 Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <[email protected]>
commit a834a0b66ec6fb743377201a0f4229bb2503f4ce upstream.
hci_cmd_sync_run() may run the work immediately if called from existing sync work (otherwise it queues a new sync work). In this case it fails to call the destroy() function.
On immediate run, make it behave same way as if item was queued
successfully: call destroy, and return 0.
The only callsite is hci_abort_conn() via hci_cmd_sync_run_once(), and this changes its return value. However, its return value is not used except as the return value for hci_disconnect(), and nothing uses the return value of hci_disconnect(). Hence there should be no behavior change anywhere.
--- net/bluetooth/hci_sync.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
net/bluetooth/hci_sync.c +9 -2
@@ -820,8 +820,15 @@ int hci_cmd_sync_run(struct hci_dev *hdereturn -ENETDOWN ;/* If on cmd_sync_work then run immediately otherwise queue */ -if (current_work () == &hdev->cmd_sync_work) -return func (hdev, data); +if (current_work () == &hdev->cmd_sync_work) { +int err; + + err =func (hdev, data); +if (destroy) +destroy (hdev, data, err); + +return 0 ; + }return hci_cmd_sync_submit (hdev, func, data, destroy); }
Greg Kroah-Hartman
maintainerPATCH 302/303 Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <[email protected]>
commit 16cd66443957e4ad42155c6fec401012f600c6f8 upstream.
Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF.
Take hdev->lock for hci_conn lookup and hci_abort_conn(). Don't use RCU to ensure the conn is fully initialized at this point.
--- net/bluetooth/mgmt.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
net/bluetooth/mgmt.c +16 -0
@@ -2939,6 +2939,8 @@ static int unpair_device_sync(struct hcistruct mgmt_cp_unpair_device *cp = cmd->param;struct hci_conn *conn; +hci_dev_lock (hdev); +if (cp->addr.type ==BDADDR_BREDR ) conn =hci_conn_hash_lookup_ba (hdev,ACL_LINK , &cp->addr.bdaddr);
@@ -2946,6 +2948,11 @@ static int unpair_device_sync(struct hci conn =hci_conn_hash_lookup_le (hdev, &cp->addr.bdaddr,le_addr_type (cp->addr.type)); +if (conn) +hci_conn_get (conn); + +hci_dev_unlock (hdev); +if (!conn)return 0 ;
@@ -2953,6 +2960,7 @@ static int unpair_device_sync(struct hci* will clean up the connection no matter the error. */ hci_abort_conn (conn,HCI_ERROR_REMOTE_USER_TERM ); +hci_conn_put (conn);return 0 ; }
@@ -3100,6 +3108,8 @@ static int disconnect_sync(struct hci_destruct mgmt_cp_disconnect *cp = cmd->param;struct hci_conn *conn; +hci_dev_lock (hdev); +if (cp->addr.type ==BDADDR_BREDR ) conn =hci_conn_hash_lookup_ba (hdev,ACL_LINK , &cp->addr.bdaddr);
@@ -3107,6 +3117,11 @@ static int disconnect_sync(struct hci_de conn =hci_conn_hash_lookup_le (hdev, &cp->addr.bdaddr,le_addr_type (cp->addr.type)); +if (conn) +hci_conn_get (conn); + +hci_dev_unlock (hdev); +if (!conn)return -ENOTCONN ;
@@ -3114,6 +3129,7 @@ static int disconnect_sync(struct hci_de* will clean up the connection no matter the error. */ hci_abort_conn (conn,HCI_ERROR_REMOTE_USER_TERM ); +hci_conn_put (conn);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 303/303 Bluetooth: mgmt: fix pending command UAF in EIR updates
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zihan Xi <[email protected]>
commit 8f2f62855a41d1730fb9e8122912bd2c8d6bed5d upstream.
MGMT_OP_SET_LOCAL_NAME is handled asynchronously on powered controllers and can run set_name_sync(). When the controller is BR/EDR capable, set_name_sync() updates the local name and then rebuilds EIR data through eir_create(). The EIR builder walks hdev->uuids, but the UUID list can be changed and entries can be freed by MGMT_OP_ADD_UUID and MGMT_OP_REMOVE_UUID.
pending_eir_or_class() is meant to serialize management commands that can change EIR or the class of device, but it did not include MGMT_OP_SET_LOCAL_NAME. In addition, it walked hdev->mgmt_pending without hdev->mgmt_pending_lock even though pending commands are added and removed under that mutex. A racing command completion can therefore remove and free a pending command while pending_eir_or_class() is still inspecting it, leading to a use-after-free in the pending-command list or allowing a local name update to rebuild EIR while UUID entries are being removed.
Take hdev->mgmt_pending_lock while scanning hdev->mgmt_pending and treat MGMT_OP_SET_LOCAL_NAME as an EIR/class-affecting pending command on the powered asynchronous path. Check for a conflicting pending command before copying the new short name so a rejected SET_LOCAL_NAME request does not modify hdev->short_name.
--- net/bluetooth/mgmt.c | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-)
net/bluetooth/mgmt.c +18 -2
@@ -2544,18 +2544,28 @@ unlock:static bool pending_eir_or_class (struct hci_dev *hdev) {struct mgmt_pending_cmd *cmd; +bool pending = false; + +mutex_lock (&hdev->mgmt_pending_lock);list_for_each_entry (cmd, &hdev->mgmt_pending, list) {switch (cmd->opcode) {case MGMT_OP_ADD_UUID :case MGMT_OP_REMOVE_UUID :case MGMT_OP_SET_DEV_CLASS : +case MGMT_OP_SET_LOCAL_NAME :case MGMT_OP_SET_POWERED : -return true; + pending = true; +break ; } + +if (pending) +break ; } -return false; +mutex_unlock (&hdev->mgmt_pending_lock); + +return pending; }static const u8 bluetooth_base_uuid[] = {
@@ -3916,6 +3926,12 @@ static int set_local_name(struct sock *s goto failed; } +if (hdev_is_powered (hdev) &&pending_eir_or_class (hdev)) { + err =mgmt_cmd_status (sk, hdev->id,MGMT_OP_SET_LOCAL_NAME , +MGMT_STATUS_BUSY ); + goto failed; + } +memcpy (hdev->short_name, cp->short_name,sizeof (hdev->short_name));if (!hdev_is_powered (hdev)) {
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.184 release. There are 303 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.184-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Hi!
Quoted 4 lines
This is the start of the stable review cycle for the 6.1.184 release. There are 303 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
We see failure here, too:
drivers/mmc/host/atmel-mci.c: In function 'atmci_remove':
4522
15:52:00drivers/mmc/host/atmel-mci.c:2631:31: error: 'struct atmel_mci' has no member named 'bh_work' 4523
15:52:00
2631 | cancel_work_sync(&host->bh_work);
4524
15:52:00
| ^~
4525
15:52:00
make[4]: *** [scripts/Makefile.build:250: drivers/mmc/host/atmel-mci.o] Error 1 4526
15:52:00
make[4]: *** Waiting for unfinished jobs....
..looks same as 5.15 problem.
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/2776654125
Best regards,
Pavel
Jon Hunter
maintainerQuoted 26 lines · Pavel Machek
Hi!
Quoted 4 lines
This is the start of the stable review cycle for the 6.1.184 release. There are 303 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
We see failure here, too:
drivers/mmc/host/atmel-mci.c: In function 'atmci_remove':
4522
15:52:00drivers/mmc/host/atmel-mci.c:2631:31: error: 'structatmel_mci' has no member named 'bh_work' 4523
15:52:00
2631 |cancel_work_sync(&host->bh_work);
4524
15:52:00
| ^~
4525
15:52:00
make[4]: *** [scripts/Makefile.build:250:drivers/mmc/host/atmel-mci.o] Error 1 4526
15:52:00
make[4]: *** Waiting for unfinished jobs....
Quoted 3 lines
..looks same as 5.15 problem.
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/2776654125
I am seeing the same failure as well for v5.10, v5.15 and v6.1 FWIW.
Jon
Signature · 1 line
nvpublic
Greg Kroah-Hartman
maintainerQuoted 29 lines · Jon Hunter
Quoted 26 lines · Pavel Machek
Hi!
Quoted 4 lines
This is the start of the stable review cycle for the 6.1.184 release. There are 303 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
We see failure here, too:
drivers/mmc/host/atmel-mci.c: In function 'atmci_remove':
4522
15:52:00drivers/mmc/host/atmel-mci.c:2631:31: error: 'structatmel_mci' has no member named 'bh_work' 4523
15:52:00
2631 |cancel_work_sync(&host->bh_work);
4524
15:52:00
| ^~
4525
15:52:00
make[4]: *** [scripts/Makefile.build:250:drivers/mmc/host/atmel-mci.o] Error 1 4526
15:52:00
make[4]: *** Waiting for unfinished jobs....
Quoted 5 lines
Quoted 3 lines
..looks same as 5.15 problem.
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/2776654125
I am seeing the same failure as well for v5.10, v5.15 and v6.1 FWIW.
Now fixed for all of these, AND for 6.6, thanks.
greg k-h
# Librecast Test Results
020/020 [ OK ] liblcrq
010/010 [ OK ] libmld
120/120 [ OK ] liblibrecast
CPU/kernel: Linux auntie 6.1.184-rc1-01952-g1869cbab73f5 #1 SMP PREEMPT_DYNAMIC Thu Aug 20 19:51:21 -00 2026 x86_64 AMD Ryzen 9 9950X 16-Core Processor AuthenticAMD GNU/Linux
Quoted 8 lines · On Thu, 20 Aug 2026 16:52:16 +0200 Greg Kroah-Hartman…
This is the start of the stable review cycle for the 6.1.184 release. There are 303 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000. Anything received after that time might be too late.
Boot-tested under QEMU for Rust x86_64:
I don't see in my config the build issue reported by others.
Thanks!
Cheers,
Miguel
Am 20.08.2026 um 16:52 schrieb Greg Kroah-Hartman:
Quoted 4 lines
This is the start of the stable review cycle for the 6.1.184 release. There are 303 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. No dmesg oddities or regressions found.
Beste Grüße,
Peter Schneider
Signature · 8 lines
Climb the mountain not to plant your flag, but to embrace the challenge, enjoy the air and behold the view. Climb it so you can see the world, not so the world can see you. -- David McCullough Jr. OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244 Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc https://keys.mailvelope.com/pks/lookup?op=get&[email protected] https://keys.mailvelope.com/pks/lookup?op=get&[email protected]
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.184 release. There are 303 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.184 release. There are 303 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 10 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.184-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.184 release. There are 303 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.184-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.thanks,
greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.184 release. There are 303 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.