6.6.157-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainerPATCH 1256/1424 ksmbd: disconnect on SMB3 decryption failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
[ Upstream commit 12a6680ce59bcd431730c9f049caddb017964c64 ]
MS-SMB2 requires the server to disconnect a connection when an encrypted transform cannot be associated with a session or fails authenticated decryption. This includes an encrypted request that still carries a SessionId invalidated through PreviousSessionId.
Move the connection to EXITING and shut down its transport when decrypt_req() fails. Add the missing TCP shutdown callback so a receive blocked in kernel_recvmsg() is released; SMB Direct already provides the corresponding callback.
Plaintext requests using an invalidated SessionId do not take this path and continue to receive STATUS_USER_SESSION_DELETED.
--- fs/smb/server/connection.c | 16 ++++++++++++++++ fs/smb/server/connection.h | 1 + fs/smb/server/server.c | 4 +++- fs/smb/server/transport_tcp.c | 6 ++++++ 4 files changed, 26 insertions(+), 1 deletion(-)
fs/smb/server/connection.c +16 -0
@@ -255,6 +255,22 @@ void ksmbd_all_conn_set_status(u64 sess_id, u32 status)up_read (&conn_list_lock); } +void ksmbd_conn_abort (struct ksmbd_conn *conn) +{ +bool shutdown = false; + +spin_lock (&conn->request_lock); +if (!ksmbd_conn_exiting (conn) && !ksmbd_conn_releasing (conn)) { +ksmbd_conn_set_exiting (conn); + shutdown = true; + } +spin_unlock (&conn->request_lock); +wake_up_all (&conn->req_running_q); + +if (shutdown && conn->transport->ops->shutdown) + conn->transport->ops->shutdown (conn->transport); +} +void ksmbd_conn_wait_idle (struct ksmbd_conn *conn) {wait_event (conn->req_running_q,atomic_read (&conn->req_running) <2 );
fs/smb/server/connection.h +1 -0
@@ -165,6 +165,7 @@ struct ksmbd_conn *ksmbd_conn_alloc(void);void ksmbd_conn_free (struct ksmbd_conn *conn);struct ksmbd_conn *ksmbd_conn_get (struct ksmbd_conn *conn);void ksmbd_conn_put (struct ksmbd_conn *conn); +void ksmbd_conn_abort (struct ksmbd_conn *conn);int ksmbd_conn_wq_init (void );void ksmbd_conn_wq_destroy (void );bool ksmbd_conn_lookup_dialect (struct ksmbd_conn *c);
fs/smb/server/server.c +3 -1
@@ -170,8 +170,10 @@ static void __handle_ksmbd_work(struct ksmbd_work *work,if (conn->ops->is_transform_hdr && conn->ops->is_transform_hdr (work->request_buf)) { rc = conn->ops->decrypt_req (work); -if (rc <0 ) +if (rc <0 ) { +ksmbd_conn_abort (conn);return ; + } work->encrypted = true; }
fs/smb/server/transport_tcp.c +6 -0
@@ -468,6 +468,11 @@ static void ksmbd_tcp_disconnect(struct ksmbd_transport *t)atomic_dec (&active_num_conn); } +static void ksmbd_tcp_shutdown (struct ksmbd_transport *t) +{ +kernel_sock_shutdown (TCP_TRANS (t)->sock,SHUT_RDWR ); +} +static void tcp_destroy_socket (struct socket *ksmbd_socket) {int ret;
@@ -721,5 +726,6 @@ static struct ksmbd_transport_ops ksmbd_tcp_transport_ops = { .read = ksmbd_tcp_read, .writev = ksmbd_tcp_writev, .disconnect = ksmbd_tcp_disconnect, + .shutdown = ksmbd_tcp_shutdown, .free_transport = ksmbd_tcp_free_transport, };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1257/1424 ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hang Nan <[email protected]>
[ Upstream commit 79decd88dd3f0d42e7fb0689b1a7853bfa302459 ]
smb_check_perm_dacl() validates that the DACL fits inside the NT security descriptor, but then bounds its two ACE walks by the remaining NTSD length (acl_size) rather than the DACL's declared size (pdacl_size).
When pdacl->size is smaller than the trailing NTSD buffer, bytes after the declared DACL boundary - still inside the stored security descriptor - are parsed as ACEs during access checks. A crafted DACL can place an access-granting ACE beyond pdacl->size, and the current code accepts it during SMB2_CREATE access validation, while parse_dacl() and smb_inherit_dacl() stop at pdacl_size.
Bound both ACE walks by pdacl_size to match the DACL boundary semantics used elsewhere in the server.
Validation:
- semantic KUnit harness shows the post-boundary ACE is selected before the fix and rejected (EACCES) after it
- linux master (7.2-rc6), x86_64
--- fs/smb/server/smbacl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/smb/server/smbacl.c +2 -2
@@ -1418,7 +1418,7 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, const struct path *path,DELETE ; ace = (struct smb_ace *)((char *)pdacl +sizeof (struct smb_acl )); - aces_size = acl_size -sizeof (struct smb_acl ); + aces_size = pdacl_size -sizeof (struct smb_acl );for (i =0 ; i <le16_to_cpu (pdacl->num_aces); i++) {if (aces_size < offsetof(struct smb_ace , sid) +CIFS_SID_BASE_SIZE )
@@ -1442,7 +1442,7 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, const struct path *path,id_to_sid (uid, sid_type, &sid); ace = (struct smb_ace *)((char *)pdacl +sizeof (struct smb_acl )); - aces_size = acl_size -sizeof (struct smb_acl ); + aces_size = pdacl_size -sizeof (struct smb_acl );for (i =0 ; i <le16_to_cpu (pdacl->num_aces); i++) {if (aces_size < offsetof(struct smb_ace , sid) +CIFS_SID_BASE_SIZE )
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1258/1424 nfs: replace atomic bitops sequence with clear_and_wake_up_bit helper
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaud Bonnet <[email protected]>
[ Upstream commit 61461050da42401b484d03e0fdac02878d235fe6 ]
Commit 8236b0ae31c83 ("bdi: wake up concurrent wb_shutdown() callers.") introduces the clear_and_wake_up_bit() helper as a wrapper for the common clear -> barrier -> wake up bitops sequence.
Use the helper in nfs_clear_invalid_mapping as inode.c already relies on functions from <linux/wait_bit.h> and to homogenize with other subsystems.
--- fs/nfs/inode.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
fs/nfs/inode.c +1 -3
@@ -1376,9 +1376,7 @@ int nfs_clear_invalid_mapping(struct address_space *mapping) ret =nfs_invalidate_mapping (inode, mapping);trace_nfs_invalidate_mapping_exit (inode, ret); -clear_bit_unlock (NFS_INO_INVALIDATING , bitlock); -smp_mb__after_atomic (); -wake_up_bit (bitlock,NFS_INO_INVALIDATING ); +clear_and_wake_up_bit (NFS_INO_INVALIDATING , bitlock); out:return ret; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1259/1424 nfs: refactor pNFS functions using clear_and_wake_up_bit
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaud Bonnet <[email protected]>
[ Upstream commit 187bfc974eefa9e5d88a0b4ee9d08ae8fe485df4 ]
Commit 8236b0ae31c83 ("bdi: wake up concurrent wb_shutdown() callers.") introduces the clear_and_wake_up_bit() helper as a wrapper for the common clear -> barrier -> wake up bitops sequence.
The file pnfs.c has several helpers with identical contents. Thus they are replaced with the more recent clean_and_wake_up_bit() global helper which describes accurately its effects at the call and still specifies the cleared bit. This also homogenizes the code with other subsystems.
Since the helpers are no longer used after this, they can be safely removed.
--- fs/nfs/pnfs.c | 35 ++++++++++------------------------- 1 file changed, 10 insertions(+), 25 deletions(-)
fs/nfs/pnfs.c +10 -25
@@ -1967,15 +1967,6 @@ static bool pnfs_is_first_layoutget(struct pnfs_layout_hdr *lo)return test_bit (NFS_LAYOUT_FIRST_LAYOUTGET , &lo->plh_flags); } -static void pnfs_clear_first_layoutget (struct pnfs_layout_hdr *lo) -{ -unsigned long *bitlock = &lo->plh_flags; - -clear_bit_unlock (NFS_LAYOUT_FIRST_LAYOUTGET , bitlock); -smp_mb__after_atomic (); -wake_up_bit (bitlock,NFS_LAYOUT_FIRST_LAYOUTGET ); -} -static void _add_to_server_list (struct pnfs_layout_hdr *lo,struct nfs_server *server) {
@@ -2149,7 +2140,8 @@ pnfs_update_layout(struct inode *ino, iomode, lo, lseg, PNFS_UPDATE_LAYOUT_INVALID_OPEN);nfs4_schedule_stateid_recovery (server, ctx->state); -pnfs_clear_first_layoutget (lo); +clear_and_wake_up_bit (NFS_LAYOUT_FIRST_LAYOUTGET , + &lo->plh_flags);pnfs_put_layout_hdr (lo); goto lookup_again; }
@@ -2216,7 +2208,8 @@ pnfs_update_layout(struct inode *ino, }if (lseg) {if (first) -pnfs_clear_first_layoutget (lo); +clear_and_wake_up_bit (NFS_LAYOUT_FIRST_LAYOUTGET , + &lo->plh_flags);trace_pnfs_update_layout (ino, pos, count, iomode, lo, lseg,PNFS_UPDATE_LAYOUT_RETRY );pnfs_put_layout_hdr (lo);
@@ -2228,7 +2221,7 @@ pnfs_update_layout(struct inode *ino, out_put_layout_hdr:if (first) -pnfs_clear_first_layoutget (lo); +clear_and_wake_up_bit (NFS_LAYOUT_FIRST_LAYOUTGET , &lo->plh_flags);trace_pnfs_update_layout (ino, pos, count, iomode, lo, lseg,PNFS_UPDATE_LAYOUT_EXIT );pnfs_put_layout_hdr (lo);
@@ -2320,7 +2313,7 @@ static void _lgopen_prepare_attached(struct nfs4_opendata *data, lgp =pnfs_alloc_init_layoutget_args (ino, ctx, ¤t_stateid, &rng,nfs_io_gfp_mask ());if (!lgp) { -pnfs_clear_first_layoutget (lo); +clear_and_wake_up_bit (NFS_LAYOUT_FIRST_LAYOUTGET , &lo->plh_flags);nfs_layoutget_end (lo);pnfs_put_layout_hdr (lo);return ;
@@ -2424,7 +2417,8 @@ void nfs4_lgopen_release(struct nfs4_layoutget *lgp) {if (lgp !=NULL ) {if (lgp->lo) { -pnfs_clear_first_layoutget (lgp->lo); +clear_and_wake_up_bit (NFS_LAYOUT_FIRST_LAYOUTGET , + &lgp->lo->plh_flags);nfs_layoutget_end (lgp->lo); }pnfs_layoutget_free (lgp);
@@ -3146,15 +3140,6 @@ pnfs_generic_pg_readpages(struct nfs_pageio_descriptor *desc) }EXPORT_SYMBOL_GPL (pnfs_generic_pg_readpages); -static void pnfs_clear_layoutcommitting (struct inode *inode) -{ -unsigned long *bitlock = &NFS_I (inode)->flags; - -clear_bit_unlock (NFS_INO_LAYOUTCOMMITTING , bitlock); -smp_mb__after_atomic (); -wake_up_bit (bitlock,NFS_INO_LAYOUTCOMMITTING ); -} -/* * There can be multiple RW segments. */
@@ -3179,7 +3164,7 @@ static void pnfs_list_write_lseg_done(struct inode *inode, struct list_head *lispnfs_put_lseg (lseg); } -pnfs_clear_layoutcommitting (inode); +clear_and_wake_up_bit (NFS_INO_LAYOUTCOMMITTING , &NFS_I (inode)->flags); }void pnfs_set_lo_fail (struct pnfs_layout_segment *lseg)
@@ -3319,7 +3304,7 @@ pnfs_layoutcommit_inode(struct inode *inode, bool sync)spin_unlock (&inode->i_lock);kfree (data); clear_layoutcommitting: -pnfs_clear_layoutcommitting (inode); +clear_and_wake_up_bit (NFS_INO_LAYOUTCOMMITTING , &NFS_I (inode)->flags); goto out; }EXPORT_SYMBOL_GPL (pnfs_layoutcommit_inode);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1260/1424 NFSv4: remove callback IDR entry on client allocation failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <[email protected]>
[ Upstream commit d05c2007b3d84ccba11dc6e9cb3202768cc72f14 ]
nfs4_alloc_client() allocates an NFSv4.0 callback identifier before it finishes setting up the client. If any later initialization step fails, the error path frees the nfs_client directly with nfs_free_client(). That bypasses nfs_put_client(), which is where the callback IDR entry is removed during normal teardown.
A failed allocation can therefore leave cb_ident_idr pointing at a freed nfs_client. A later NFSv4.0 callback lookup by cb_ident would find the stale pointer and take a reference to it.
Make the callback IDR removal helper callable by the allocation failure path, and remove the callback identifier before freeing the client.
This was found by a local static-analysis checker for publish-before-free lifetime bugs and confirmed by manual inspection.
--- fs/nfs/client.c | 14 +++++++++++++- fs/nfs/internal.h | 1 + fs/nfs/nfs4client.c | 1 + 3 files changed, 15 insertions(+), 1 deletion(-)
fs/nfs/client.c +13 -1
@@ -208,9 +208,21 @@ static void nfs_cb_idr_remove_locked(struct nfs_client *clp) {struct nfs_net *nn =net_generic (clp->cl_net, nfs_net_id); -if (clp->cl_cb_ident) +if (clp->cl_cb_ident) {idr_remove (&nn->cb_ident_idr, clp->cl_cb_ident); + clp->cl_cb_ident =0 ; + } +} + +void nfs_cb_idr_remove (struct nfs_client *clp) +{ +struct nfs_net *nn =net_generic (clp->cl_net, nfs_net_id); + +spin_lock (&nn->nfs_client_lock); +nfs_cb_idr_remove_locked (clp); +spin_unlock (&nn->nfs_client_lock); } +EXPORT_SYMBOL_GPL (nfs_cb_idr_remove);static void pnfs_init_server (struct nfs_server *server) {
fs/nfs/internal.h +1 -0
@@ -218,6 +218,7 @@ void nfs_server_copy_userdata(struct nfs_server *, struct nfs_server *);extern void nfs_put_client (struct nfs_client *);extern void nfs_free_client (struct nfs_client *); +void nfs_cb_idr_remove (struct nfs_client *clp);extern struct nfs_client *nfs4_find_client_ident (struct net *,int );extern struct nfs_client * nfs4_find_client_sessionid(struct net *, const struct sockaddr *,
fs/nfs/nfs4client.c +1 -0
@@ -270,6 +270,7 @@ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init)return clp; error: +nfs_cb_idr_remove (clp);nfs_free_client (clp);return ERR_PTR (err); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1261/1424 clk: ti: use kcalloc() instead of kzalloc()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ethan Carter Edwards <[email protected]>
[ Upstream commit de517118c5d3482411fd88141093fa838bc0af77 ]
Use 2-factor multiplication argument form kcalloc() instead of kzalloc().
Stable-dep-of: 667f420c09f1 ("clk: ti: mux: resolve parent clocks by DT index, not by name")
--- drivers/clk/ti/mux.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/ti/mux.c +1 -1
@@ -180,7 +180,7 @@ static void of_mux_clk_setup(struct device_node *node)pr_err ("mux-clock %pOFn must have parents\n" , node);return ; } - parent_names =kzalloc ((sizeof (char *) * num_parents),GFP_KERNEL ); + parent_names =kcalloc (num_parents,sizeof (char *),GFP_KERNEL );if (!parent_names) goto cleanup;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1262/1424 clk: ti: mux: resolve parent clocks by DT index, not by name
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathieu Dubois-Briand <[email protected]>
[ Upstream commit 667f420c09f1417c9f07798e32432c901915209d ]
Resolve parent clocks by their index into the device tree "clocks" property rather than matching names as strings. Name-based matching is fragile because a clock's "clock-output-names" value in its provider node can differ from the name used to reference it in a consumer node, and because names must be globally unique across all clock providers.
On AM335x, this caused broken clock trees where some clocks failed to enable because their parents could not be found.
Replace of_clk_parent_fill() with a clk_parent_data array that sets .index to the array position.
--- drivers/clk/ti/mux.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-)
drivers/clk/ti/mux.c +11 -9
@@ -119,7 +119,7 @@ const struct clk_ops ti_clk_mux_ops = { };static struct clk *_register_mux (struct device_node *node,const char *name, -const char *const *parent_names, +const struct clk_parent_data *parent_data,u8 num_parents,unsigned long flags,struct clk_omap_reg *reg,u8 shift,u32 mask,s8 latch,u8 clk_mux_flags,u32 *table)
@@ -136,7 +136,7 @@ static struct clk *_register_mux(struct device_node *node, const char *name, init.name = name; init.ops = &ti_clk_mux_ops; init.flags = flags; - init.parent_names = parent_names; + init.parent_data = parent_data; init.num_parents = num_parents;/* struct clk_mux assignments */
@@ -167,24 +167,26 @@ static void of_mux_clk_setup(struct device_node *node)struct clk *clk;struct clk_omap_reg reg;unsigned int num_parents; -const char **parent_names; +struct clk_parent_data *parent_data;const char *name;u8 clk_mux_flags =0 ;u32 mask =0 ;u32 shift =0 ;s32 latch = -EINVAL ;u32 flags =CLK_SET_RATE_NO_REPARENT ; +int i; num_parents =of_clk_get_parent_count (node);if (num_parents <2 ) {pr_err ("mux-clock %pOFn must have parents\n" , node);return ; } - parent_names =kcalloc (num_parents,sizeof (char *),GFP_KERNEL ); -if (!parent_names) - goto cleanup; + parent_data =kcalloc (num_parents,sizeof (*parent_data),GFP_KERNEL ); +if (!parent_data) +return ; -of_clk_parent_fill (node, parent_names, num_parents); +for (i =0 ; i < num_parents; i++) + parent_data[i].index = i;if (ti_clk_get_reg_addr (node,0 , ®)) goto cleanup;
@@ -207,7 +209,7 @@ static void of_mux_clk_setup(struct device_node *node) mask = (1 <<fls (mask)) -1 ; name =ti_dt_clk_name (node); - clk =_register_mux (node, name, parent_names, num_parents, + clk =_register_mux (node, name, parent_data, num_parents, flags, ®, shift, mask, latch, clk_mux_flags,NULL );
@@ -215,7 +217,7 @@ static void of_mux_clk_setup(struct device_node *node)of_clk_add_provider (node, of_clk_src_simple_get, clk); cleanup: -kfree (parent_names); +kfree (parent_data); }CLK_OF_DECLARE (mux_clk,"ti,mux-clock" , of_mux_clk_setup);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1263/1424 octeontx2-af: initialize lmac_bmap in rvu_mcs_set_lmac_bmap()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <[email protected]>
[ Upstream commit 4b92a3710d4a1d850ed6421c773e735cdca69b07 ]
rvu_mcs_set_lmac_bmap() declares lmac_bmap without initializing it and only sets bits for valid lmacs with set_bit(), which ORs into the word without clearing it first. Bits for invalid or skipped ports keep whatever was on the stack, and the garbage is stored into mcs->hw->lmac_bmap.
Initialize lmac_bmap to 0 so only valid lmacs are marked.
Found with Clang's -Wconditional-uninitialized.
--- drivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c +1 -1
@@ -854,7 +854,7 @@ int rvu_mbox_handler_mcs_ctrl_pkt_rule_write(struct rvu *rvu,static void rvu_mcs_set_lmac_bmap (struct rvu *rvu) {struct mcs *mcs =mcs_get_pdata (0 ); -unsigned long lmac_bmap; +unsigned long lmac_bmap =0 ;int cgx, lmac, port;for (port =0 ; port < mcs->hw->lmac_cnt; port++) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1264/1424 net: kcm: Hold RCU read lock while running BPF parser
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junseo Lim <[email protected]>
[ Upstream commit b0346dd64e4905291cc9c479f2e6cf1884ced4e6 ]
kcm_parse_func_strparser() calls bpf_prog_run_pin_on_cpu() which prevents CPU migration, but does not establish an RCU read-side critical section. Consequently, BPF map operations can trigger WARN_ON_ONCE(!bpf_rcu_lock_held()) when called from the KCM strparser program.
Hold the RCU read lock while running the program.
--- net/kcm/kcmsock.c | 3 +++ 1 file changed, 3 insertions(+)
net/kcm/kcmsock.c +3 -0
@@ -5,6 +5,7 @@* Copyright (c) 2016 Tom Herbert <[email protected]> */ +#include <linux/rcupdate.h> #include <linux/bpf.h> #include <linux/errno.h> #include <linux/errqueue.h>
@@ -389,7 +390,9 @@ static int kcm_parse_func_strparser(struct strparser *strp, struct sk_buff *skb)struct bpf_prog *prog = psock->bpf_prog;int res; +rcu_read_lock (); res =bpf_prog_run_pin_on_cpu (prog, skb); +rcu_read_unlock ();return res; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1265/1424 net: dsa: b53: fix error propagation from b53_fdb_dump()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Oltean <[email protected]>
[ Upstream commit 4f1d06cf8aaa9d2cb18e5ee8835aff6177256bc6 ]
The blamed commit replaced "return ret" statements in b53_fdb_dump() with "break;" which jumps to the mutex_unlock() -> return 0 section.
This is notably problematic because it swallows errors from the b53_fdb_copy() -> cb() path, and this will result in FDB dump truncation when the netlink skb overflows - see commit 21b52fed928e ("net: dsa:
sja1105: fix broken backpressure in .port_fdb_dump").
Let's go back to "return ret". We don't need to preinitialize "ret" with 0, because the "do {} while" block guarantees we cannot reach the end of the function without at least once calling b53_arl_search_wait(), which will have initialized ret to some valid value.
--- drivers/net/dsa/b53/b53_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/b53/b53_common.c +1 -1
@@ -1894,7 +1894,7 @@ int b53_fdb_dump(struct dsa_switch *ds, int port,mutex_unlock (&priv->arl_mutex); -return 0 ; +return ret; }EXPORT_SYMBOL (b53_fdb_dump);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1266/1424 pppox: drain queued packets on channel handoff
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qingfang Deng <[email protected]>
[ Upstream commit 92c1bf630abf0af646562398eaa36f80b5ff677d ]
PPPIOCGCHAN both returns the channel index and marks a PPPOX socket as bound to generic PPP, despite its getter semantic. Packets received before that transition are queued on sk_receive_queue, but a bound socket is no longer readable. Such packets therefore remain queued until the socket is destroyed.
After marking a socket bound, wait for receive paths that observed the old state to finish queueing packets, and then drain the queue into generic PPP.
--- drivers/net/ppp/pppox.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
drivers/net/ppp/pppox.c +17 -0
@@ -74,7 +74,9 @@ int pppox_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)switch (cmd) {case PPPIOCGCHAN : { +struct sk_buff *skb;int index; + rc = -ENOTCONN ;if (!(sk->sk_state &PPPOX_CONNECTED ))break ;
@@ -85,7 +87,22 @@ int pppox_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)break ; rc =0 ; +/* PPPIOCGCHAN historically marks the userspace handoff to +* generic PPP; pppd then attaches the returned channel to +* /dev/ppp. +*/ sk->sk_state |=PPPOX_BOUND ; +/* Let lockless receive paths finish queueing against the old +* state. +*/ +synchronize_net (); +/* Drain packets queued before the handoff because a bound +* socket is no longer readable. +*/ +while ((skb =skb_dequeue (&sk->sk_receive_queue))) { +skb_orphan (skb); +ppp_input (&po->chan, skb); + }break ; }default :
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1267/1424 net: hsr: Use full string description when opening HSR network device
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukasz Majewski <[email protected]>
[ Upstream commit 10e52ad5ced2a7dcdb3fb18c9cef111d5f30471d ]
Up till now only single character ('A' or 'B') was used to provide information of HSR slave network device status.
As it is also possible and valid, that Interlink network device may be supported as well, the description must be more verbose. As a result the full string description is now used.
Stable-dep-of: 7f16289b91eb ("net: hsr: free learned nodes on device setup failure")
--- net/hsr/hsr_device.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
net/hsr/hsr_device.c +6 -7
@@ -139,30 +139,29 @@ static int hsr_dev_open(struct net_device *dev) {struct hsr_priv *hsr;struct hsr_port *port; -char designation; +const char *designation =NULL ; hsr =netdev_priv (dev); - designation ='\0' ;hsr_for_each_port_rtnl (hsr, port) {if (port->type ==HSR_PT_MASTER )continue ;switch (port->type) {case HSR_PT_SLAVE_A : - designation ='A' ; + designation ="Slave A" ;break ;case HSR_PT_SLAVE_B : - designation ='B' ; + designation ="Slave B" ;break ;default : - designation ='?' ; + designation ="Unknown" ; }if (!is_slave_up (port->dev)) -netdev_warn (dev,"Slave %c (%s) is not up; please bring it up to get a fully working HSR network\n" , +netdev_warn (dev,"%s (%s) is not up; please bring it up to get a fully working HSR network\n" , designation, port->dev->name); } -if (designation =='\0' ) +if (!designation)netdev_warn (dev,"No slave devices configured\n" );return 0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1268/1424 net: hsr: Provide RedBox support (HSR-SAN)
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukasz Majewski <[email protected]>
[ Upstream commit 5055cccfc2d1cc1a7306f6bcdcd0ee9521d707f5 ]
Introduce RedBox support (HSR-SAN to be more precise) for HSR networks. Following traffic reduction optimizations have been implemented:
- Do not send HSR supervisory frames to Port C (interlink)
- Do not forward to HSR ring frames addressed to Port C
- Do not forward to Port C frames from HSR ring
- Do not send duplicate HSR frame to HSR ring when destination is Port C
The corresponding patch to modify iptable2 sources has already been sent:
https://lore.kernel.org/netdev/[email protected]/T/
Testing procedure (veth and netns):
-----------------------------------
One shall run:linux-vanila/tools/testing/selftests/net/hsr/hsr_redbox.sh (Detailed description of the setup one can find in the test script file).
Testing procedure (real hardware):
----------------------------------
The EVB-KSZ9477 has been used for testing on net-next branch (SHA1: 5fc68320c1fb3c7d456ddcae0b4757326a043e6f).
Ports 4/5 were used for SW managed HSR (hsr1) as first hsr0 for ports 1/2 (with HW offloading for ksz9477) was created. Port 3 has been used as interlink port (single USB-ETH dongle).
Configuration - RedBox (EVB-KSZ9477):
if link set lan1 down;ip link set lan2 down
ip link add name hsr0 type hsr slave1 lan1 slave2 lan2 supervision 45 version 1 ip link add name hsr1 type hsr slave1 lan4 slave2 lan5 interlink lan3 supervision 45 version 1 ip link set lan4 up;ip link set lan5 up
ip link set lan3 up
ip addr add 192.168.0.11/24 dev hsr1
ip link set hsr1 up
Configuration - DAN-H (EVB-KSZ9477):
ip link set lan1 down;ip link set lan2 down
ip link add name hsr0 type hsr slave1 lan1 slave2 lan2 supervision 45 version 1 ip link add name hsr1 type hsr slave1 lan4 slave2 lan5 supervision 45 version 1 ip link set lan4 up;ip link set lan5 up
ip addr add 192.168.0.12/24 dev hsr1
ip link set hsr1 up
This approach uses only SW based HSR devices (hsr1).
-------------- ----------------- ------------
DAN-H Port5 | <------> | Port5 | |
Port4 | <------> | Port4 Port3 | <---> | PC
| | (RedBox) | | (USB-ETH)
EVB-KSZ9477 | | EVB-KSZ9477 | |
-------------- ----------------- ------------Stable-dep-of: 7f16289b91eb ("net: hsr: free learned nodes on device setup failure")
--- include/uapi/linux/if_link.h | 1 + net/hsr/hsr_device.c | 36 ++++++++++++++- net/hsr/hsr_device.h | 4 +- net/hsr/hsr_forward.c | 85 ++++++++++++++++++++++++++++++++---- net/hsr/hsr_framereg.c | 52 ++++++++++++++++++++++ net/hsr/hsr_framereg.h | 4 ++ net/hsr/hsr_main.h | 7 +++ net/hsr/hsr_netlink.c | 30 +++++++++++-- net/hsr/hsr_slave.c | 1 + 9 files changed, 204 insertions(+), 16 deletions(-)
include/uapi/linux/if_link.h +1 -0
@@ -1219,6 +1219,7 @@ enum {IFLA_HSR_PROTOCOL ,/* Indicate different protocol than * HSR. For example PRP. */ +IFLA_HSR_INTERLINK ,/* HSR interlink network device */ __IFLA_HSR_MAX, };
net/hsr/hsr_device.c +34 -2
@@ -153,6 +153,9 @@ static int hsr_dev_open(struct net_device *dev)case HSR_PT_SLAVE_B : designation ="Slave B" ;break ; +case HSR_PT_INTERLINK : + designation ="Interlink" ; +break ;default : designation ="Unknown" ; }
@@ -295,6 +298,7 @@ static void send_hsr_supervision_frame(struct hsr_port *master,struct hsr_priv *hsr = master->hsr;__u8 type =HSR_TLV_LIFE_CHECK ;struct hsr_sup_payload *hsr_sp; +struct hsr_sup_tlv *hsr_stlv;struct hsr_sup_tag *hsr_stag;struct sk_buff *skb;
@@ -337,6 +341,16 @@ static void send_hsr_supervision_frame(struct hsr_port *master, hsr_sp =skb_put (skb,sizeof (struct hsr_sup_payload ));ether_addr_copy (hsr_sp->macaddress_A, master->dev->dev_addr); +if (hsr->redbox) { + hsr_stlv =skb_put (skb,sizeof (struct hsr_sup_tlv )); + hsr_stlv->HSR_TLV_type =PRP_TLV_REDBOX_MAC ; + hsr_stlv->HSR_TLV_length =sizeof (struct hsr_sup_payload ); + +/* Payload: MacAddressRedBox */ + hsr_sp =skb_put (skb,sizeof (struct hsr_sup_payload )); +ether_addr_copy (hsr_sp->macaddress_A, hsr->macaddress_redbox); + } +if (skb_put_padto (skb,ETH_ZLEN )) {spin_unlock_bh (&hsr->seqnr_lock);return ;
@@ -418,6 +432,10 @@ void hsr_del_ports(struct hsr_priv *hsr)if (port)hsr_del_port (port); + port =hsr_port_get_hsr (hsr,HSR_PT_INTERLINK ); +if (port) +hsr_del_port (port); + port =hsr_port_get_hsr (hsr,HSR_PT_MASTER );if (port)hsr_del_port (port);
@@ -623,8 +641,8 @@ static const unsigned char def_multicast_addr[ETH_ALEN] __aligned(2) = { };int hsr_dev_finalize (struct net_device *hsr_dev,struct net_device *slave[2 ], -unsigned char multicast_spec,u8 protocol_version, -struct netlink_ext_ack *extack) +struct net_device *interlink,unsigned char multicast_spec, +u8 protocol_version,struct netlink_ext_ack *extack) {bool unregister = false;struct hsr_priv *hsr;
@@ -633,6 +651,7 @@ int hsr_dev_finalize(struct net_device *hsr_dev, struct net_device *slave[2], hsr =netdev_priv (hsr_dev);INIT_LIST_HEAD (&hsr->ports);INIT_LIST_HEAD (&hsr->node_db); +INIT_LIST_HEAD (&hsr->proxy_node_db);spin_lock_init (&hsr->list_lock);eth_hw_addr_set (hsr_dev, slave[0 ]->dev_addr);
@@ -658,6 +677,7 @@ int hsr_dev_finalize(struct net_device *hsr_dev, struct net_device *slave[2],/* Overflow soon to find bugs easier: */ hsr->sequence_nr =HSR_SEQNR_START ; hsr->sup_sequence_nr =HSR_SUP_SEQNR_START ; + hsr->interlink_sequence_nr =HSR_SEQNR_START ;timer_setup (&hsr->announce_timer, hsr_announce,0 );timer_setup (&hsr->prune_timer, hsr_prune_nodes,0 );
@@ -697,6 +717,18 @@ int hsr_dev_finalize(struct net_device *hsr_dev, struct net_device *slave[2],if (res) goto err_unregister; +if (interlink) { + res =hsr_add_port (hsr, interlink,HSR_PT_INTERLINK , extack); +if (res) + goto err_unregister; + + hsr->redbox = true; +ether_addr_copy (hsr->macaddress_redbox, interlink->dev_addr); +timer_setup (&hsr->prune_proxy_timer, hsr_prune_proxy_nodes,0 ); +mod_timer (&hsr->prune_proxy_timer, + jiffies +msecs_to_jiffies (PRUNE_PROXY_PERIOD )); + } +hsr_debugfs_init (hsr, hsr_dev);mod_timer (&hsr->prune_timer, jiffies +msecs_to_jiffies (PRUNE_PERIOD ));
net/hsr/hsr_device.h +2 -2
@@ -16,8 +16,8 @@void hsr_del_ports (struct hsr_priv *hsr);void hsr_dev_setup (struct net_device *dev);int hsr_dev_finalize (struct net_device *hsr_dev,struct net_device *slave[2 ], -unsigned char multicast_spec,u8 protocol_version, -struct netlink_ext_ack *extack); +struct net_device *interlink,unsigned char multicast_spec, +u8 protocol_version,struct netlink_ext_ack *extack);void hsr_check_carrier_and_operstate (struct hsr_priv *hsr);int hsr_get_max_mtu (struct hsr_priv *hsr);#endif /* __HSR_DEVICE_H */
net/hsr/hsr_forward.c +76 -9
136 lines not on this page · raw message
net/hsr/hsr_framereg.c +52 -0
76 lines not on this page · raw message
net/hsr/hsr_framereg.h +4 -0
@@ -46,6 +46,7 @@ int hsr_register_frame_out(struct hsr_port *port, struct hsr_node *node, u16 sequence_nr);void hsr_prune_nodes (struct timer_list *t); +void hsr_prune_proxy_nodes (struct timer_list *t); int hsr_create_self_node(struct hsr_priv *hsr, const unsigned char addr_a[ETH_ALEN],
@@ -67,6 +68,9 @@ void prp_handle_san_frame(bool san, enum hsr_port_type port, struct hsr_node *node);void prp_update_san_info (struct hsr_node *node,bool is_sup); +bool hsr_is_node_in_db (struct list_head *node_db, +const unsigned char addr[ETH_ALEN ]); +struct hsr_node {struct list_head mac_list;/* Protect R/W access to seq_out */
net/hsr/hsr_main.h +7 -0
@@ -21,6 +21,7 @@*/ #define HSR_LIFE_CHECK_INTERVAL 2000/* ms */ #define HSR_NODE_FORGET_TIME 60000/* ms */ +#define HSR_PROXY_NODE_FORGET_TIME 60000/* ms */ #define HSR_ANNOUNCE_INTERVAL 100/* ms */ #define HSR_ENTRY_FORGET_TIME 400/* ms */
@@ -35,6 +36,7 @@* HSR_NODE_FORGET_TIME? */ #define PRUNE_PERIOD 3000/* ms */ +#define PRUNE_PROXY_PERIOD 3000/* ms */ #define HSR_TLV_EOT 0/* End of TLVs */ #define HSR_TLV_ANNOUNCE 22#define HSR_TLV_LIFE_CHECK 23
@@ -192,11 +194,14 @@ struct hsr_priv {struct rcu_head rcu_head;struct list_head ports;struct list_head node_db;/* Known HSR nodes */ +struct list_head proxy_node_db;/* RedBox HSR proxy nodes */ struct hsr_self_node __rcu *self_node;/* MACs of slaves */ struct timer_list announce_timer;/* Supervision frame dispatch */ struct timer_list prune_timer; +struct timer_list prune_proxy_timer;int announce_count;u16 sequence_nr; +u16 interlink_sequence_nr;/* Interlink port seq_nr */ u16 sup_sequence_nr;/* For HSRv1 separate seq_nr for supervision */ enum hsr_version prot_version;/* Indicate if HSRv0, HSRv1 or PRPv1 */ spinlock_t seqnr_lock;/* locking for sequence_nr */
@@ -209,6 +214,8 @@ struct hsr_priv {* of lan_id */ bool fwd_offloaded;/* Forwarding offloaded to HW */ +bool redbox;/* Device supports HSR RedBox */ +unsigned char macaddress_redbox[ETH_ALEN ];unsigned char sup_multicast_addr[ETH_ALEN ]__aligned(sizeof(u16)) ;/* Align to u16 boundary to avoid unaligned access * in ether_addr_equal
net/hsr/hsr_netlink.c +27 -3
@@ -23,6 +23,7 @@ static const struct nla_policy hsr_policy[IFLA_HSR_MAX + 1] = { [IFLA_HSR_SUPERVISION_ADDR] = { .len = ETH_ALEN }, [IFLA_HSR_SEQ_NR] = { .type = NLA_U16 }, [IFLA_HSR_PROTOCOL] = { .type = NLA_U8 }, + [IFLA_HSR_INTERLINK] = { .type = NLA_U32 }, };/* Here, it seems a netdevice has already been allocated for us, and the
@@ -35,8 +36,8 @@ static int hsr_newlink(struct net *src_net, struct net_device *dev,enum hsr_version proto_version;unsigned char multicast_spec;u8 proto =HSR_PROTOCOL_HSR ; -struct net_device *link[2 ]; +struct net_device *link[2 ], *interlink =NULL ;if (!data) {NL_SET_ERR_MSG_MOD (extack,"No slave devices specified" );return -EINVAL ;
@@ -67,6 +68,20 @@ static int hsr_newlink(struct net *src_net, struct net_device *dev,return -EINVAL ; } +if (data[IFLA_HSR_INTERLINK ]) + interlink =__dev_get_by_index (src_net, +nla_get_u32 (data[IFLA_HSR_INTERLINK ])); + +if (interlink && interlink == link[0 ]) { +NL_SET_ERR_MSG_MOD (extack,"Interlink and Slave1 are the same" ); +return -EINVAL ; + } + +if (interlink && interlink == link[1 ]) { +NL_SET_ERR_MSG_MOD (extack,"Interlink and Slave2 are the same" ); +return -EINVAL ; + } +if (!data[IFLA_HSR_MULTICAST_SPEC ]) multicast_spec =0 ;else
@@ -96,10 +111,17 @@ static int hsr_newlink(struct net *src_net, struct net_device *dev, } } -if (proto ==HSR_PROTOCOL_PRP ) +if (proto ==HSR_PROTOCOL_PRP ) { proto_version =PRP_V1 ; +if (interlink) { +NL_SET_ERR_MSG_MOD (extack, +"Interlink only works with HSR" ); +return -EINVAL ; + } + } -return hsr_dev_finalize (dev, link, multicast_spec, proto_version, extack); +return hsr_dev_finalize (dev, link, interlink, multicast_spec, + proto_version, extack); }static void hsr_dellink (struct net_device *dev,struct list_head *head)
@@ -107,6 +129,7 @@ static void hsr_dellink(struct net_device *dev, struct list_head *head)struct hsr_priv *hsr =netdev_priv (dev);del_timer_sync (&hsr->prune_timer); +del_timer_sync (&hsr->prune_proxy_timer);del_timer_sync (&hsr->announce_timer);hsr_debugfs_term (hsr);
@@ -114,6 +137,7 @@ static void hsr_dellink(struct net_device *dev, struct list_head *head)hsr_del_self_node (hsr);hsr_del_nodes (&hsr->node_db); +hsr_del_nodes (&hsr->proxy_node_db);unregister_netdevice_queue (dev, head); }
net/hsr/hsr_slave.c +1 -0
@@ -55,6 +55,7 @@ static rx_handler_result_t hsr_handle_frame(struct sk_buff **pskb) protocol =eth_hdr (skb)->h_proto;if (!(port->dev->features &NETIF_F_HW_HSR_TAG_RM ) && + port->type !=HSR_PT_INTERLINK && hsr->proto_ops->invalid_dan_ingress_frame && hsr->proto_ops->invalid_dan_ingress_frame (protocol)) goto finish_pass;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1269/1424 net: hsr: free learned nodes on device setup failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Xie <[email protected]>
[ Upstream commit 7f16289b91eb316f170a6bd22d32e6c632f6a5b6 ]
hsr_dev_finalize() can fail after a lower-device RX handler has already been registered (slave A is added before the failable slave B and interlink adds). RX handlers run in softirq regardless of the master's state, so frames received in that window can learn dynamic nodes into node_db, and the error unwind never releases them.
Free both owned dynamic databases in the unwind, mirroring hsr_dellink(). proxy_node_db is provably empty on every current error exit (only interlink RX feeds it, and the interlink add is the last failable step) and is freed for symmetry. The order is safe:hsr_del_port() unregisters each RX handler with synchronize_net() before hsr_del_nodes() runs, which removes remaining entries with list_del_rcu() and defers their release with call_rcu() for readers already under RCU.
--- net/hsr/hsr_device.c | 2 ++ 1 file changed, 2 insertions(+)
net/hsr/hsr_device.c +2 -0
@@ -738,6 +738,8 @@ int hsr_dev_finalize(struct net_device *hsr_dev, struct net_device *slave[2],hsr_del_ports (hsr); err_add_master:hsr_del_self_node (hsr); +hsr_del_nodes (&hsr->node_db); +hsr_del_nodes (&hsr->proxy_node_db);if (unregister)unregister_netdevice (hsr_dev);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1270/1424 ipvs: fix integer overflow in ftp helper port/address parsing
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joas Antonio dos Santos <[email protected]>
[ Upstream commit e625a9477d12baaff4025c5f9989184a907ea8fc ]
ip_vs_ftp_get_addrport() accumulates decimal digits into a __u16 (hport) and into unsigned char (p[]) without checking for overflow. A crafted FTP PASV/EPSV response with an over-long port or address octet wraps the value, so the helper configures the data connection with a truncated port/address.
The netfilter conntrack FTP helper had the same defect, fixed in commit 2b413fc689ba ("netfilter: nf_conntrack_ftp: avoid u16 overflows"). Apply the equivalent fix here: widen the port accumulator to u32 and reject values above 65535, and reject address octets above 255.
--- net/netfilter/ipvs/ip_vs_ftp.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
net/netfilter/ipvs/ip_vs_ftp.c +8 -2
@@ -103,7 +103,7 @@ static int ip_vs_ftp_get_addrport(char *data, char *data_limit,char *s, c;unsigned char p[6 ];char edelim; -__u16 hport; +__u32 hport;int i =0 ;if (data_limit - data < plen) {
@@ -145,7 +145,11 @@ static int ip_vs_ftp_get_addrport(char *data, char *data_limit,return -1 ; c = *data;if (isdigit (c)) { - p[i] = p[i]*10 + c -'0' ; +unsigned int val = p[i] *10 + c -'0' ; + +if (val >255 ) +return -1 ; + p[i] = val; }else if (c ==',' && i <5 ) { i++; p[i] =0 ;
@@ -223,6 +227,8 @@ static int ip_vs_ftp_get_addrport(char *data, char *data_limit,if (!isdigit (*s))break ; hport = hport *10 + *s -'0' ; +if (hport >65535 ) +return -1 ; }if (s == data_limit || !hport || *s != edelim)return -1 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1271/1424 vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <[email protected]>
[ Upstream commit 984f831dda31b3a18f47454cf64989f65402879e ]
The VXLAN VNI filter entry policy declares the GROUP/GROUP6 address attributes as NLA_BINARY with only a maximum length, so validate_nla() accepts a payload shorter than the address. The GROUP consumer reads it with nla_get_in_addr(), an unconditional 4-byte load, so a short attribute over-reads up to 3 bytes of uninitialised slab data, which are stored into remote_ip and echoed back via RTM_GETTUNNEL, disclosing kernel memory.
Switch both entries to NLA_POLICY_EXACT_LEN() so the validator rejects any GROUP/GROUP6 that is not exactly 4 / 16 bytes; a valid address is always sent at full width.
--- drivers/net/vxlan/vxlan_vnifilter.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/net/vxlan/vxlan_vnifilter.c +2 -4
@@ -467,10 +467,8 @@ static int vxlan_vnifilter_dump(struct sk_buff *skb, struct netlink_callback *cbstatic const struct nla_policy vni_filter_entry_policy[VXLAN_VNIFILTER_ENTRY_MAX +1 ] = { [VXLAN_VNIFILTER_ENTRY_START ] = { .type =NLA_U32 }, [VXLAN_VNIFILTER_ENTRY_END ] = { .type =NLA_U32 }, - [VXLAN_VNIFILTER_ENTRY_GROUP ] = { .type =NLA_BINARY , - .len = sizeof_field(struct iphdr, daddr) }, - [VXLAN_VNIFILTER_ENTRY_GROUP6 ] = { .type =NLA_BINARY , - .len =sizeof (struct in6_addr ) }, + [VXLAN_VNIFILTER_ENTRY_GROUP] = NLA_POLICY_EXACT_LEN(sizeof_field(struct iphdr, daddr)), + [VXLAN_VNIFILTER_ENTRY_GROUP6 ] =NLA_POLICY_EXACT_LEN (sizeof (struct in6_addr )), };static const struct nla_policy vni_filter_policy[VXLAN_VNIFILTER_MAX +1 ] = {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1272/1424 net: dsa: mv88e6xxx: Fix PCS link check on CMODE read error
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <[email protected]>
[ Upstream commit 7b196e27ad58e612ad1c04b347d0c2135045aa14 ]
mv88e6352_pcs_link_check() ignores errors returned by port_get_cmode(). If the port status register read fails, mv88e6352_port_get_cmode() returns without setting cmode. The link check then compares an uninitialized value and may incorrectly treat the PCS as active.
Save the return value and fail the link check after releasing the register lock. marvell_c22_pcs_get_state() initializes the reported link state to down before calling the check, so a read failure is handled safely until a later poll succeeds.
This issue was found by a static analysis checker and confirmed by manual source review.
--- drivers/net/dsa/mv88e6xxx/pcs-6352.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/dsa/mv88e6xxx/pcs-6352.c +4 -1
@@ -305,13 +305,16 @@ static bool mv88e6352_pcs_link_check(struct marvell_c22_pcs *mpcs)struct mv88e6xxx_port *port = mpcs->port;struct mv88e6xxx_chip *chip = port->chip;u8 cmode; +int err;/* Port 4 can be in auto-media mode. Check that the port is * associated with the mpcs. */ mv88e6xxx_reg_lock (chip); - chip->info->ops->port_get_cmode (chip, port->port, &cmode); + err = chip->info->ops->port_get_cmode (chip, port->port, &cmode);mv88e6xxx_reg_unlock (chip); +if (err) +return false;return cmode ==MV88E6XXX_PORT_STS_CMODE_100BASEX || cmode == MV88E6XXX_PORT_STS_CMODE_1000BASEX ||
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1273/1424 tls: fix RX desync on overlapping skbs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maximilian Immanuel Brandtner <[email protected]>
[ Upstream commit 9466ef3ec972bee926731a766f73533dec590065 ]
The TCP receive queue can hold adjacent skbs whose sequence ranges overlap. The tls fast-path reads the record header with skb_copy_bits() by byte offset, which assumes skbs do not overlap, so a header split across the overlap is misread and the connection aborts (-EMSGSIZE/-EINVAL). tls_strp_check_queue_ok() detects such overlaps but only ran after the header was parsed, never covering the header itself.
Observed with parallel kTLS connections on:
- ConnectX-7 + IPsec crypto offload + GRO
- VirtIO (8 queues) + GRO
--- net/tls/tls_strp.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
net/tls/tls_strp.c +11 -5
@@ -430,9 +430,10 @@ static int tls_strp_read_copy(struct tls_strparser *strp, bool qshort)return 0 ; } -static bool tls_strp_check_queue_ok (struct tls_strparser *strp) +static bool tls_strp_check_queue_ok (struct tls_strparser *strp, +unsigned int len) { -unsigned int len = strp->stm.offset + strp->stm.full_len; +unsigned int remaining = strp->stm.offset + len;struct sk_buff *first, *skb;u32 seq;
@@ -443,9 +444,9 @@ static bool tls_strp_check_queue_ok(struct tls_strparser *strp)/* Make sure there's no duplicate data in the queue, * and the decrypted status matches. */ -while (skb->len < len) { +while (skb->len < remaining) { seq += skb->len; - len -= skb->len; + remaining -= skb->len; skb = skb->next;if (TCP_SKB_CB (skb)->seq != seq)
@@ -524,6 +525,11 @@ static int tls_strp_read_sock(struct tls_strparser *strp)tls_strp_load_anchor_with_queue (strp, inq);if (!strp->stm.full_len) { +if (inq <TLS_HEADER_SIZE ) +return tls_strp_read_copy (strp, true); +if (!tls_strp_check_queue_ok (strp,TLS_HEADER_SIZE )) +return tls_strp_read_copy (strp, false); + sz =tls_rx_msg_size (strp, strp->anchor);if (sz <0 )return sz;
@@ -534,7 +540,7 @@ static int tls_strp_read_sock(struct tls_strparser *strp)return tls_strp_read_copy (strp, true); } -if (!tls_strp_check_queue_ok (strp)) +if (!tls_strp_check_queue_ok (strp, strp->stm.full_len))return tls_strp_read_copy (strp, false);WRITE_ONCE (strp->msg_ready,1 );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1274/1424 net: bridge: vlan: fix inverted default vlan notification
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Aleksandrov <[email protected]>
[ Upstream commit 21040c7f931502070dcc66bb0f1aeed07dec032b ]
A notification should be emitted only when the vlan delete was successful and not otherwise. The proper check is if br/nbp_vlan_delete returned 0.
--- net/bridge/br_vlan.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/bridge/br_vlan.c +2 -2
@@ -1129,7 +1129,7 @@ int __br_vlan_set_default_pvid(struct net_bridge *br, u16 pvid,if (err) goto out; -if (br_vlan_delete (br, old_pvid)) +if (!br_vlan_delete (br, old_pvid))br_vlan_notify (br,NULL , old_pvid,0 ,RTM_DELVLAN );br_vlan_notify (br,NULL , pvid,0 ,RTM_NEWVLAN );__set_bit (0 , changed);
@@ -1151,7 +1151,7 @@ int __br_vlan_set_default_pvid(struct net_bridge *br, u16 pvid, &vlchange, extack);if (err) goto err_port; -if (nbp_vlan_delete (p, old_pvid)) +if (!nbp_vlan_delete (p, old_pvid))br_vlan_notify (br, p, old_pvid,0 ,RTM_DELVLAN );br_vlan_notify (p->br, p, pvid,0 ,RTM_NEWVLAN );__set_bit (p->port_no, changed);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1275/1424 cuse: wait for pending RCU callbacks on module exit
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
[ Upstream commit 4deb3edead0c0e172cc7349e8855d741d3c5e162 ]
Since commit 053fc4f755ad ("fuse: fix UAF in rcu pathwalks"), fuse_conn_put() frees the fuse_conn through call_rcu() rather than synchronously. For cuse, fc->release is cuse_fc_release(), which lives in the cuse module. If the module is removed before the RCU grace period ends, the callback jumps into freed module memory:
userspace / module unload | RCU softirq
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
close(/dev/cuse) |
cuse_channel_release() |
fuse_dev_release() |
fuse_conn_put(fch->conn) |
call_rcu(delayed_release) ------+---> callback queued
|
rmmod cuse |
cuse_exit() |
cuse_channel_destroy() |
... |
return |
|
<module text freed> |
| rcu_do_batch()
| delayed_release()
| fc->release()
| -> cuse_fc_release()
| ^^^ freed text!The freed module text is unmapped by vfree(), so the jump into the stale callback triggers a page-fault Oops. If the virtual address is subsequently reused, the callback could execute unrelated code (undefined behaviour).
Fix this by calling rcu_barrier() in cuse_exit() so that any pending fuse_conn release callback completes before the module is removed.
--- fs/fuse/cuse.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/fuse/cuse.c +5 -0
@@ -643,6 +643,11 @@ static void __exit cuse_exit(void) {misc_deregister (&cuse_miscdev);class_destroy (cuse_class); +/* +* Wait for pending call_rcu() callbacks that call back into +* this module via fc->release (cuse_fc_release). +*/ +rcu_barrier (); }module_init (cuse_init);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1276/1424 fs/ntfs3: fix out-of-bounds read in read_log_rec_buf()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <[email protected]>
[ Upstream commit de603b9d377fab57a5e6432fa84a9f36b32c1636 ]
read_log_rec_buf() copies a log record into a caller buffer starting at
u32 off = lsn_to_page_off(log, lsn) + log->record_header_len;
log->record_header_len (and log->data_off, used for the following pages) comes verbatim from the on-disk restart area and is only checked for 8-byte alignment in is_rst_area_valid(), so off can exceed log->page_size. "tail = log->page_size - off" then underflows and memcpy() reads past the page_size-sized buffer returned by read_log_page(), spilling adjacent slab memory into the replay buffer.
This is reachable by mounting a crafted NTFS image:
BUG: KASAN: slab-out-of-bounds in read_log_rec_buf+0x216/0x580 Read of size 64 at addr ffff88800a877ff8 by task exploit/127 read_log_rec_buf fs/ntfs3/fslog.c:2299 log_replay fs/ntfs3/fslog.c:4216 ntfs_loadlog_and_replay fs/ntfs3/fsntfs.c:324 ntfs_fill_super fs/ntfs3/super.c:1392 get_tree_bdev_flags fs/super.c:1694 __x64_sys_mount fs/namespace.c:4360 The buggy address is located 4088 bytes to the right of the 4096-byte region [ffff88800a876000, ffff88800a877000)
Reject an in-page offset outside the current page before the copy.
--- fs/ntfs3/fslog.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
fs/ntfs3/fslog.c +9 -1
@@ -2299,7 +2299,15 @@ static int read_log_rec_buf(struct ntfs_log *log,*/ for (;;) {bool usa_error; -u32 tail = log->page_size - off; +u32 tail; + +/* off comes from the on-disk restart area; bound it. */ +if (off > log->page_size) { + err = -EINVAL ; + goto out; + } + + tail = log->page_size - off;if (tail >= data_len) tail = data_len;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1277/1424 fs/ntfs3: validate ef->size covers the records name and value
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <[email protected]>
[ Upstream commit c22f91d82cb9a29d22bdffdce6c803467984ad0c ]
When an EA record has a non-zero ef->size, ntfs_read_ea() only checks that the record fits in the remaining buffer (ea_size > bytes), not that ef->size is large enough to hold the record's own name_len + 1 + elength.
A crafted image can pass validation with, e.g., ef->size = 24 but elength = 0xffff. ntfs_get_ea() then trusts elength and copies it out of the undersized record, reading past the kmalloc(info->size) allocation and leaking heap memory to userspace via getxattr():
BUG: KASAN: slab-out-of-bounds in ntfs_get_ea (fs/ntfs3/xattr.c:302) Read of size 65535 at addr ffff888100794550 by task exploit __asan_memcpy (mm/kasan/shadow.c:105) ntfs_get_ea (fs/ntfs3/xattr.c:302) ntfs_getxattr (fs/ntfs3/xattr.c:848) __vfs_getxattr (fs/xattr.c:441) vfs_getxattr (fs/xattr.c:474) do_getxattr (fs/xattr.c:800) path_getxattrat (fs/xattr.c:868) do_syscall_64 (arch/x86/entry/syscall_64.c:94)
The buggy address is located 80 bytes inside of
allocated 84-byte region in cache kmalloc-96
Compute the size the record needs and require ef->size to cover it.
--- fs/ntfs3/xattr.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-)
fs/ntfs3/xattr.c +12 -9
@@ -146,26 +146,29 @@ static int ntfs_read_ea(struct ntfs_inode *ni, struct EA_FULL **ea,for (off =0 ; off < size; off += ea_size) {const struct EA_FULL *ef =Add2Ptr (ea_p, off);u32 bytes = size - off; +size_t need;/* Check if we can use field ea->size. */ if (bytes <sizeof (ef->size)) goto out1; +/* Check if we can use fields ef->name_len and ef->elength. */ +if (bytes < offsetof(struct EA_FULL , name)) + goto out1; + +/* Size needed to hold this record's name and value. */ + need =struct_size (ef, name, +1 + ef->name_len +le16_to_cpu (ef->elength)); +if (ef->size) { ea_size =le32_to_cpu (ef->size); -if (ea_size > bytes) +/* ef->size must fit the list and cover the record. */ +if (ea_size > bytes || ea_size < need) goto out1;continue ; } -/* Check if we can use fields ef->name_len and ef->elength. */ -if (bytes < offsetof(struct EA_FULL , name)) - goto out1; - - ea_size =ALIGN (struct_size (ef, name, -1 + ef->name_len + -le16_to_cpu (ef->elength)), -4 ); + ea_size =ALIGN (need,4 );if (ea_size > bytes) goto out1; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1278/1424 fuse: convert to new timestamp accessors
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <[email protected]>
[ Upstream commit 3c0d5df2d03d797e66f6eef08859930a01d5d6ad ]
Convert to using the new inode timestamp accessor functions.
Stable-dep-of: 928f659a3e36 ("fuse: check for NULL root inode in fuse_fill_super_submount")
--- fs/fuse/control.c | 2 +- fs/fuse/dir.c | 10 +++++----- fs/fuse/inode.c | 29 ++++++++++++++--------------- fs/fuse/readdir.c | 6 ++++-- 4 files changed, 24 insertions(+), 23 deletions(-)
fs/fuse/control.c +1 -1
@@ -235,7 +235,7 @@ static struct dentry *fuse_ctl_add_dentry(struct dentry *parent, inode->i_mode = mode; inode->i_uid = fc->user_id; inode->i_gid = fc->group_id; - inode->i_atime = inode->i_mtime =inode_set_ctime_current (inode); +simple_inode_init_ts (inode);/* setting ->i_op to NULL is not allowed */ if (iop) inode->i_op = iop;
fs/fuse/dir.c +5 -5
@@ -1819,12 +1819,12 @@ int fuse_flush_times(struct inode *inode, struct fuse_file *ff)memset (&outarg,0 ,sizeof (outarg)); inarg.valid =FATTR_MTIME ; - inarg.mtime = inode->i_mtime.tv_sec; - inarg.mtimensec = inode->i_mtime.tv_nsec; + inarg.mtime =inode_get_mtime_sec (inode); + inarg.mtimensec =inode_get_mtime_nsec (inode);if (fm->fc->minor >=23 ) { inarg.valid |=FATTR_CTIME ; - inarg.ctime =inode_get_ctime (inode).tv_sec; - inarg.ctimensec =inode_get_ctime (inode).tv_nsec; + inarg.ctime =inode_get_ctime_sec (inode); + inarg.ctimensec =inode_get_ctime_nsec (inode); }if (ff) { inarg.valid |=FATTR_FH ;
@@ -1964,7 +1964,7 @@ int fuse_do_setattr(struct dentry *dentry, struct iattr *attr,/* the kernel maintains i_mtime locally */ if (trust_local_cmtime) {if (attr->ia_valid &ATTR_MTIME ) - inode->i_mtime = attr->ia_mtime; +inode_set_mtime_to_ts (inode, attr->ia_mtime);if (attr->ia_valid &ATTR_CTIME )inode_set_ctime_to_ts (inode, attr->ia_ctime);/* FIXME: clear I_DIRTY_SYNC? */
fs/fuse/inode.c +14 -15
@@ -220,12 +220,10 @@ void fuse_change_attributes_common(struct inode *inode, struct fuse_attr *attr, attr->mtimensec =min_t (u32, attr->mtimensec,NSEC_PER_SEC -1 ); attr->ctimensec =min_t (u32, attr->ctimensec,NSEC_PER_SEC -1 ); - inode->i_atime.tv_sec = attr->atime; - inode->i_atime.tv_nsec = attr->atimensec; +inode_set_atime (inode, attr->atime, attr->atimensec);/* mtime from server may be stale due to local buffered write */ if (!(cache_mask &STATX_MTIME )) { - inode->i_mtime.tv_sec = attr->mtime; - inode->i_mtime.tv_nsec = attr->mtimensec; +inode_set_mtime (inode, attr->mtime, attr->mtimensec); }if (!(cache_mask &STATX_CTIME )) {inode_set_ctime (inode, attr->ctime, attr->ctimensec);
@@ -308,12 +306,12 @@ void fuse_change_attributes(struct inode *inode, struct fuse_attr *attr, attr->size =i_size_read (inode);if (cache_mask &STATX_MTIME ) { - attr->mtime = inode->i_mtime.tv_sec; - attr->mtimensec = inode->i_mtime.tv_nsec; + attr->mtime =inode_get_mtime_sec (inode); + attr->mtimensec =inode_get_mtime_nsec (inode); }if (cache_mask &STATX_CTIME ) { - attr->ctime =inode_get_ctime (inode).tv_sec; - attr->ctimensec =inode_get_ctime (inode).tv_nsec; + attr->ctime =inode_get_ctime_sec (inode); + attr->ctimensec =inode_get_ctime_nsec (inode); } if ((attr_version != 0 && fi->attr_version > attr_version) ||
@@ -322,7 +320,7 @@ void fuse_change_attributes(struct inode *inode, struct fuse_attr *attr,return ; } - old_mtime = inode->i_mtime; + old_mtime =inode_get_mtime (inode);fuse_change_attributes_common (inode, attr, sx, attr_valid, cache_mask); oldsize = inode->i_size;
@@ -376,8 +374,7 @@ static void fuse_init_inode(struct inode *inode, struct fuse_attr *attr, { inode->i_mode = attr->mode &S_IFMT ; inode->i_size = attr->size; - inode->i_mtime.tv_sec = attr->mtime; - inode->i_mtime.tv_nsec = attr->mtimensec; +inode_set_mtime (inode, attr->mtime, attr->mtimensec);inode_set_ctime (inode, attr->ctime, attr->ctimensec);if (S_ISREG (inode->i_mode)) {fuse_init_common (inode);
@@ -1498,17 +1495,19 @@ EXPORT_SYMBOL_GPL(fuse_dev_free);static void fuse_fill_attr_from_inode (struct fuse_attr *attr,const struct fuse_inode *fi) { +struct timespec64 atime =inode_get_atime (&fi->inode); +struct timespec64 mtime =inode_get_mtime (&fi->inode);struct timespec64 ctime =inode_get_ctime (&fi->inode); *attr = (struct fuse_attr ){ .ino = fi->inode.i_ino, .size = fi->inode.i_size, .blocks = fi->inode.i_blocks, - .atime = fi->inode.i_atime.tv_sec, - .mtime = fi->inode.i_mtime.tv_sec, + .atime = atime.tv_sec, + .mtime = mtime.tv_sec, .ctime = ctime.tv_sec, - .atimensec = fi->inode.i_atime.tv_nsec, - .mtimensec = fi->inode.i_mtime.tv_nsec, + .atimensec = atime.tv_nsec, + .mtimensec = mtime.tv_nsec, .ctimensec = ctime.tv_nsec, .mode = fi->inode.i_mode, .nlink = fi->inode.i_nlink,
fs/fuse/readdir.c +4 -2
@@ -480,7 +480,7 @@ static int fuse_readdir_cached(struct file *file, struct dir_context *ctx)if (!fi->rdc.cached) {/* Starting cache? Set cache mtime. */ if (!ctx->pos && !fi->rdc.size) { - fi->rdc.mtime = inode->i_mtime; + fi->rdc.mtime =inode_get_mtime (inode); fi->rdc.iversion =inode_query_iversion (inode); }spin_unlock (&fi->rdc.lock);
@@ -492,8 +492,10 @@ static int fuse_readdir_cached(struct file *file, struct dir_context *ctx)* changed, and reset the cache if so. */ if (!ctx->pos) { +struct timespec64 mtime =inode_get_mtime (inode); +if (inode_peek_iversion (inode) != fi->rdc.iversion || - !timespec64_equal (&fi->rdc.mtime, &inode->i_mtime)) { + !timespec64_equal (&fi->rdc.mtime, &mtime)) {fuse_rdc_reset (inode); goto retry_locked; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1279/1424 fuse: use FUSE_ROOT_ID in fuse_get_root_inode()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <[email protected]>
[ Upstream commit 253e52437119719eb87293ef6852e13bb5ad0960 ]
...when calling fuse_iget().
Stable-dep-of: 928f659a3e36 ("fuse: check for NULL root inode in fuse_fill_super_submount")
--- fs/fuse/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/fuse/inode.c +1 -1
@@ -990,7 +990,7 @@ static struct inode *fuse_get_root_inode(struct super_block *sb, unsigned mode) attr.mode = mode; attr.ino =FUSE_ROOT_ID ; attr.nlink =1 ; -return fuse_iget (sb,1 ,0 , &attr,0 ,0 ); +return fuse_iget (sb,FUSE_ROOT_ID ,0 , &attr,0 ,0 ); }struct fuse_inode_handle {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1280/1424 fuse: support folios in struct fuse_args_pages and fuse_copy_pages()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joanne Koong <[email protected]>
[ Upstream commit a669c2df36db5fa7a2674ec5ae10548760702f99 ]
This adds support in struct fuse_args_pages and fuse_copy_pages() for using folios instead of pages for transferring data. Both folios and pages must be supported right now in struct fuse_args_pages and fuse_copy_pages() until all request types have been converted to use folios. Once all have been converted, then
struct fuse_args_pages and fuse_copy_pages() will only support folios.
Right now in fuse, all folios are one page (large folios are not yet supported). As such, copying folio->page is sufficient for copying the entire folio in fuse_copy_pages().
No functional changes.
Stable-dep-of: 928f659a3e36 ("fuse: check for NULL root inode in fuse_fill_super_submount")
--- fs/fuse/dev.c | 40 ++++++++++++++++++++++++++++++++-------- fs/fuse/fuse_i.h | 22 +++++++++++++++++++--- 2 files changed, 51 insertions(+), 11 deletions(-)
fs/fuse/dev.c +32 -8
@@ -974,17 +974,41 @@ static int fuse_copy_pages(struct fuse_copy_state *cs, unsigned nbytes,struct fuse_req *req = cs->req;struct fuse_args_pages *ap =container_of (req->args,typeof (*ap), args); +if (ap->uses_folios) { +for (i =0 ; i < ap->num_folios && (nbytes || zeroing); i++) { +int err; +unsigned int offset = ap->folio_descs[i].offset; +unsigned int count =min (nbytes, ap->folio_descs[i].length); +struct page *orig, *pagep; -for (i =0 ; i < ap->num_pages && (nbytes || zeroing); i++) { -int err; -unsigned int offset = ap->descs[i].offset; -unsigned int count =min (nbytes, ap->descs[i].length); + orig = pagep = &ap->folios[i]->page; - err =fuse_copy_page (cs, &ap->pages[i], offset, count, zeroing); -if (err) -return err; + err =fuse_copy_page (cs, &pagep, offset, count, zeroing); +if (err) +return err; + + nbytes -= count; + +/* +* fuse_copy_page may have moved a page from a pipe +* instead of copying into our given page, so update +* the folios if it was replaced. +*/ +if (pagep != orig) + ap->folios[i] =page_folio (pagep); + } + }else { +for (i =0 ; i < ap->num_pages && (nbytes || zeroing); i++) { +int err; +unsigned int offset = ap->descs[i].offset; +unsigned int count =min (nbytes, ap->descs[i].length); - nbytes -= count; + err =fuse_copy_page (cs, &ap->pages[i], offset, count, zeroing); +if (err) +return err; + + nbytes -= count; + } }return 0 ; }
fs/fuse/fuse_i.h +19 -3
@@ -266,6 +266,12 @@ struct fuse_page_desc {unsigned int offset; }; +/** FUSE folio descriptor */ +struct fuse_folio_desc { +unsigned int length; +unsigned int offset; +}; +struct fuse_args {uint64_t nodeid;uint32_t opcode;
@@ -290,9 +296,19 @@ struct fuse_args {struct fuse_args_pages {struct fuse_args args; -struct page **pages; -struct fuse_page_desc *descs; -unsigned int num_pages; +union { +struct { +struct page **pages; +struct fuse_page_desc *descs; +unsigned int num_pages; + }; +struct { +struct folio **folios; +struct fuse_folio_desc *folio_descs; +unsigned int num_folios; + }; + }; +bool uses_folios; };#define FUSE_ARGS (args) struct fuse_args args = {}
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1281/1424 fuse: convert readdir to use folios
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joanne Koong <[email protected]>
[ Upstream commit 02b78c7a7a0c72aee6f600a167e6adee9417ac0e ]
Convert readdir requests to use a folio instead of a page.
No functional changes.
Stable-dep-of: 928f659a3e36 ("fuse: check for NULL root inode in fuse_fill_super_submount")
--- fs/fuse/readdir.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-)
fs/fuse/readdir.c +11 -10
@@ -335,24 +335,25 @@ static int fuse_readdir_uncached(struct file *file, struct dir_context *ctx) {int plus;ssize_t res; -struct page *page; +struct folio *folio;struct inode *inode =file_inode (file);struct fuse_mount *fm =get_fuse_mount (inode);struct fuse_io_args ia = {};struct fuse_args_pages *ap = &ia.ap; -struct fuse_page_desc desc = { .length =PAGE_SIZE }; +struct fuse_folio_desc desc = { .length =PAGE_SIZE };u64 attr_version =0 ;bool locked; - page =alloc_page (GFP_KERNEL ); -if (!page) + folio =folio_alloc (GFP_KERNEL ,0 ); +if (!folio)return -ENOMEM ; plus =fuse_use_readdirplus (inode, ctx); ap->args.out_pages = true; - ap->num_pages =1 ; - ap->pages = &page; - ap->descs = &desc; + ap->uses_folios = true; + ap->num_folios =1 ; + ap->folios = &folio; + ap->folio_descs = &desc;if (plus) { attr_version =fuse_get_attr_version (fm->fc); fuse_read_args_fill(&ia, file, ctx->pos, PAGE_SIZE,
@@ -371,15 +372,15 @@ static int fuse_readdir_uncached(struct file *file, struct dir_context *ctx)if (ff->open_flags &FOPEN_CACHE_DIR )fuse_readdir_cache_end (file, ctx->pos); }else if (plus) { - res =parse_dirplusfile (page_address (page), res, + res =parse_dirplusfile (folio_address (folio), res, file, ctx, attr_version); }else { - res =parse_dirfile (page_address (page), res, file, + res =parse_dirfile (folio_address (folio), res, file, ctx); } } -__free_page (page); +folio_put (folio);fuse_invalidate_atime (inode);return res; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1282/1424 fuse: check attributes staleness on fuse_iget()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Tianci <[email protected]>
[ Upstream commit 69eb56f69efb866c791cc87fd7bf62adf2ffcbb3 ]
Function fuse_direntplus_link() might call fuse_iget() to initialize a new fuse_inode and change its attributes. If fi->attr_version is always initialized with 0, even if the attributes returned by the FUSE_READDIR request is staled, as the new fi->attr_version is 0, fuse_change_attributes will still set the staled attributes to inode. This wrong behaviour may cause file size inconsistency even when there is no changes from server-side.
To reproduce the issue, consider the following 2 programs (A and B) are running concurrently,
A B
---------------------------------- --------------------------------
{ /fusemnt/dir/f is a file path in a fuse mount, the size of f is 0. }
readdir(/fusemnt/dir) start
//Daemon set size 0 to f direntry
fallocate(f, 1024)
stat(f) // B see size 1024
echo 2 > /proc/sys/vm/drop_cachesreaddir(/fusemnt/dir) reply to kernel
Kernel set 0 to the I_NEW inode
stat(f) // B see size 0
In the above case, only program B is modifying the file size, however, B observes file size changing between the 2 'readonly' stat() calls. To fix this issue, we should make sure readdirplus still follows the rule of attr_version staleness checking even if the fi->attr_version is lost due to inode eviction.
To identify this situation, the new fc->evict_ctr is used to record whether the eviction of inodes occurs during the readdirplus request processing. If it does, the result of readdirplus may be inaccurate; otherwise, the result of readdirplus can be trusted. Although this may still lead to incorrect invalidation, considering the relatively low frequency of evict occurrences, it should be acceptable.
Stable-dep-of: 928f659a3e36 ("fuse: check for NULL root inode in fuse_fill_super_submount")
--- fs/fuse/dir.c | 11 +++++----- fs/fuse/fuse_i.h | 14 ++++++++++-- fs/fuse/inode.c | 56 +++++++++++++++++++++++++++++++++++++---------- fs/fuse/readdir.c | 15 ++++++++----- 4 files changed, 71 insertions(+), 25 deletions(-)
fs/fuse/dir.c +6 -5
@@ -366,7 +366,7 @@ int fuse_lookup_name(struct super_block *sb, u64 nodeid, const struct qstr *namestruct fuse_mount *fm =get_fuse_mount_super (sb);FUSE_ARGS (args);struct fuse_forget_link *forget; -u64 attr_version; +u64 attr_version, evict_ctr;int err; *inode =NULL ;
@@ -381,6 +381,7 @@ int fuse_lookup_name(struct super_block *sb, u64 nodeid, const struct qstr *name goto out; attr_version =fuse_get_attr_version (fm->fc); + evict_ctr =fuse_get_evict_ctr (fm->fc);fuse_lookup_init (fm->fc, &args, nodeid, name, outarg); err =fuse_simple_request (fm, &args);
@@ -398,7 +399,7 @@ int fuse_lookup_name(struct super_block *sb, u64 nodeid, const struct qstr *name *inode =fuse_iget (sb, outarg->nodeid, outarg->generation, &outarg->attr,ATTR_TIMEOUT (outarg), - attr_version); + attr_version, evict_ctr); err = -ENOMEM ;if (!*inode) {fuse_queue_forget (fm->fc, forget, outarg->nodeid,1 );
@@ -684,7 +685,7 @@ static int fuse_create_open(struct inode *dir, struct dentry *entry, ff->nodeid = outentry.nodeid; ff->open_flags = outopen.open_flags; inode =fuse_iget (dir->i_sb, outentry.nodeid, outentry.generation, - &outentry.attr,ATTR_TIMEOUT (&outentry),0 ); + &outentry.attr,ATTR_TIMEOUT (&outentry),0 ,0 );if (!inode) { flags &= ~(O_CREAT |O_EXCL |O_TRUNC );fuse_sync_release (NULL , ff, flags);
@@ -812,7 +813,7 @@ static int create_new_entry(struct fuse_mount *fm, struct fuse_args *args, goto out_put_forget_req; inode =fuse_iget (dir->i_sb, outarg.nodeid, outarg.generation, - &outarg.attr,ATTR_TIMEOUT (&outarg),0 ); + &outarg.attr,ATTR_TIMEOUT (&outarg),0 ,0 );if (!inode) {fuse_queue_forget (fm->fc, forget, outarg.nodeid,1 );return -ENOMEM ;
@@ -1980,7 +1981,7 @@ int fuse_do_setattr(struct dentry *dentry, struct iattr *attr,fuse_change_attributes_common (inode, &outarg.attr,NULL ,ATTR_TIMEOUT (&outarg), -fuse_get_cache_mask (inode)); +fuse_get_cache_mask (inode),0 ); oldsize = inode->i_size;/* see the comment in fuse_change_attributes() */ if (!is_wb || is_truncate)
fs/fuse/fuse_i.h +12 -2
@@ -858,6 +858,9 @@ struct fuse_conn {/** Version counter for attribute changes */ atomic64_t attr_version; +/** Version counter for evict inode */ +atomic64_t evict_ctr; +/** Called on final put */ void (*release)(struct fuse_conn *);
@@ -947,6 +950,11 @@ static inline u64 fuse_get_attr_version(struct fuse_conn *fc)return atomic64_read (&fc->attr_version); } +static inline u64 fuse_get_evict_ctr (struct fuse_conn *fc) +{ +return atomic64_read (&fc->evict_ctr); +} +static inline bool fuse_stale_inode (const struct inode *inode,int generation,struct fuse_attr *attr) {
@@ -1006,7 +1014,8 @@ extern const struct dentry_operations fuse_root_dentry_operations;*/ struct inode *fuse_iget (struct super_block *sb,u64 nodeid,int generation,struct fuse_attr *attr, -u64 attr_valid,u64 attr_version); +u64 attr_valid,u64 attr_version, +u64 evict_ctr);int fuse_lookup_name (struct super_block *sb,u64 nodeid,const struct qstr *name,struct fuse_entry_out *outarg,struct inode **inode);
@@ -1105,7 +1114,8 @@ void fuse_change_attributes(struct inode *inode, struct fuse_attr *attr,void fuse_change_attributes_common (struct inode *inode,struct fuse_attr *attr,struct fuse_statx *sx, -u64 attr_valid,u32 cache_mask); +u64 attr_valid,u32 cache_mask, +u64 evict_ctr);u32 fuse_get_cache_mask (struct inode *inode);
fs/fuse/inode.c +44 -12
124 lines not on this page · raw message
fs/fuse/readdir.c +9 -6
@@ -153,7 +153,7 @@ static int parse_dirfile(char *buf, size_t nbytes, struct file *file,static int fuse_direntplus_link (struct file *file,struct fuse_direntplus *direntplus, -u64 attr_version) +u64 attr_version,u64 evict_ctr) {struct fuse_entry_out *o = &direntplus->entry_out;struct fuse_dirent *dirent = &direntplus->dirent;
@@ -237,7 +237,7 @@ static int fuse_direntplus_link(struct file *file, }else { inode =fuse_iget (dir->i_sb, o->nodeid, o->generation, &o->attr,ATTR_TIMEOUT (o), - attr_version); + attr_version, evict_ctr);if (!inode) inode =ERR_PTR (-ENOMEM );
@@ -288,7 +288,8 @@ static void fuse_force_forget(struct file *file, u64 nodeid) }static int parse_dirplusfile (char *buf,size_t nbytes,struct file *file, -struct dir_context *ctx,u64 attr_version) +struct dir_context *ctx,u64 attr_version, +u64 evict_ctr) {struct fuse_direntplus *direntplus;struct fuse_dirent *dirent;
@@ -323,7 +324,7 @@ static int parse_dirplusfile(char *buf, size_t nbytes, struct file *file, buf += reclen; nbytes -= reclen; - ret =fuse_direntplus_link (file, direntplus, attr_version); + ret =fuse_direntplus_link (file, direntplus, attr_version, evict_ctr);if (ret)fuse_force_forget (file, direntplus->entry_out.nodeid); }
@@ -341,7 +342,7 @@ static int fuse_readdir_uncached(struct file *file, struct dir_context *ctx)struct fuse_io_args ia = {};struct fuse_args_pages *ap = &ia.ap;struct fuse_folio_desc desc = { .length =PAGE_SIZE }; -u64 attr_version =0 ; +u64 attr_version =0 , evict_ctr =0 ;bool locked; folio =folio_alloc (GFP_KERNEL ,0 );
@@ -356,6 +357,7 @@ static int fuse_readdir_uncached(struct file *file, struct dir_context *ctx) ap->folio_descs = &desc;if (plus) { attr_version =fuse_get_attr_version (fm->fc); + evict_ctr =fuse_get_evict_ctr (fm->fc);fuse_read_args_fill (&ia, file, ctx->pos,PAGE_SIZE ,FUSE_READDIRPLUS ); }else {
@@ -373,7 +375,8 @@ static int fuse_readdir_uncached(struct file *file, struct dir_context *ctx)fuse_readdir_cache_end (file, ctx->pos); }else if (plus) { res =parse_dirplusfile (folio_address (folio), res, - file, ctx, attr_version); + file, ctx, attr_version, + evict_ctr); }else { res =parse_dirfile (folio_address (folio), res, file, ctx);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1283/1424 fuse: check for NULL root inode in fuse_fill_super_submount
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
[ Upstream commit 928f659a3e3650978a5b4829cc982324f72b474b ]
fuse_iget() can return NULL when its inode allocation fails, but fuse_fill_super_submount() passed the result straight to get_fuse_inode() and decremented fi->nlookup without checking it:
root = fuse_iget(sb, parent_fi->nodeid, ...);
fi = get_fuse_inode(root);
fi->nlookup--;Inside fuse_iget() the inode allocation can fail and return NULL. The submount root takes the iget5_locked() path, whose alloc_inode() can fail under memory pressure (the auto-submount branch can fail the same way in new_inode() or fuse_alloc_submount_lookup()):
inode = iget5_locked(sb, nodeid, fuse_inode_eq, fuse_inode_set,
&nodeid);
if (!inode)
return NULL;A NULL root makes get_fuse_inode() a container_of() on NULL and the nlookup decrement a write to a bogus address, oopsing the mount. With CONFIG_KASAN the following null pointer dereference is reported when the root inode allocation of an auto-submount fails (e.g. under memory pressure):
==================================================================
BUG: KASAN: null-ptr-deref in fuse_get_tree_submount+0x656/0x8b0 Read of size 8 at addr 00000000000002b0 by task ls/942 CPU: 0 PID: 942 Comm: ls Tainted: G W 6.6 #15 Call Trace: <TASK> fuse_get_tree_submount+0x656/0x8b0 vfs_get_tree+0x48/0x140 fc_mount+0x13/0x50 fuse_dentry_automount+0x7a/0xb0 __traverse_mounts+0xca/0x330 step_into+0x339/0xac0 path_lookupat+0xc5/0x2f0 filename_lookup+0x163/0x2a0 vfs_statx+0xd5/0x200 do_statx+0x83/0xd0 __x64_sys_statx+0xa0/0xc0 do_syscall_64+0x37/0x90 entry_SYSCALL_64_after_hwframe+0x78/0xe2 </TASK> ==================================================================
Return -ENOMEM instead; the caller tears down the partially built superblock on error, matching the other error returns in this function.
--- fs/fuse/inode.c | 2 ++ 1 file changed, 2 insertions(+)
fs/fuse/inode.c +2 -0
@@ -1590,6 +1590,8 @@ static int fuse_fill_super_submount(struct super_block *sb,fuse_fill_attr_from_inode (&root_attr, parent_fi); root =fuse_iget (sb, parent_fi->nodeid,0 , &root_attr,0 ,0 ,fuse_get_evict_ctr (fm->fc)); +if (!root) +return -ENOMEM ;/* * This inode is just a duplicate, so it is not looked up and * its nlookup should not be incremented. fuse_iget() does
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1284/1424 ALSA: hda: Fix connection list comparison in proc output
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Rao <[email protected]>
[ Upstream commit c139e7e44f58a6f8ddc9d850ea9924d34963b5da ]
print_conn_list() compares the raw hardware connection list with the connection list cached by the HDA driver. When they differ, it prints an additional "In-driver Connection" line so that /proc/asound/card*/codec#* shows the topology actually used by the driver.
The comparison currently passes conn_len directly to memcmp(). However, conn_len is a number of connection-list entries, while memcmp() expects a size in bytes. Both list and conn are arrays of hda_nid_t, which is u16, so only half of the connection data is compared.
For example, for two-entry lists such as:
hardware: 0x0c 0x0d
cached: 0x0c 0x0e
conn_len is 2, and the current comparison checks only the first hda_nid_t. The lists are therefore incorrectly treated as identical even though the second connection differs.
This can happen legitimately when codec fixups replace a cached connection list with snd_hda_override_conn_list(). The codec routing used by the driver is not affected, but the proc output can hide the overridden driver-visible routing and provide misleading topology information during codec debugging.
Convert the entry count to a byte size so that memcmp() covers the complete connection list.
--- sound/pci/hda/hda_proc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/pci/hda/hda_proc.c +1 -1
@@ -624,7 +624,7 @@ static void print_conn_list(struct snd_info_buffer *buffer,/* Get Cache connections info */ cache_len =snd_hda_get_conn_list (codec, nid, &list);if (cache_len >=0 && (cache_len != conn_len || -memcmp (list, conn, conn_len) !=0 )) { +memcmp (list, conn, conn_len *sizeof (*conn)) !=0 )) {snd_iprintf (buffer," In-driver Connection: %d\n" , cache_len);if (cache_len >0 ) {snd_iprintf (buffer," " );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1285/1424 vxlan: mdb: Adjust function arguments
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit ff97d2a956a142bc0383f52560dd46e003c216dd ]
Adjust the function's arguments and rename it to allow it to be reused by future call sites that only have access to 'struct vxlan_mdb_entry_key', but not to 'struct vxlan_mdb_config'.
No functional changes intended.
Stable-dep-of: bc2dc66a6693 ("vxlan: mdb: Fix use-after-free in vxlan_mdb_flush()")
--- drivers/net/vxlan/vxlan_mdb.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/net/vxlan/vxlan_mdb.c +4 -6
@@ -371,12 +371,10 @@ static bool vxlan_mdb_is_valid_source(const struct nlattr *attr, __be16 proto,return true; } -static void vxlan_mdb_config_group_set (struct vxlan_mdb_config *cfg, -const struct br_mdb_entry *entry, -const struct nlattr *source_attr) +static void vxlan_mdb_group_set (struct vxlan_mdb_entry_key *group, +const struct br_mdb_entry *entry, +const struct nlattr *source_attr) { -struct vxlan_mdb_entry_key *group = &cfg->group; -switch (entry->addr.proto) {case htons (ETH_P_IP ): group->dst.sa.sa_family =AF_INET ;
@@ -504,7 +502,7 @@ static int vxlan_mdb_config_attrs_init(struct vxlan_mdb_config *cfg, entry->addr.proto, extack))return -EINVAL ; -vxlan_mdb_config_group_set (cfg, entry, mdbe_attrs[MDBE_ATTR_SOURCE ]); +vxlan_mdb_group_set (&cfg->group, entry, mdbe_attrs[MDBE_ATTR_SOURCE ]);/* rtnetlink code only validates that IPv4 group address is * multicast.
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1286/1424 vxlan: mdb: Factor out a helper for remote entry size calculation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 14c32a46d992412bc276b3365a0c3e5b8b1af9f2 ]
Currently, netlink notifications are sent for individual remote entries and not for the entire MDB entry itself.
Subsequent patches are going to add MDB get support which will require the VXLAN driver to reply with an entire MDB entry.
Therefore, as a preparation, factor out a helper to calculate the size of an individual remote entry. When determining the size of the reply this helper will be invoked for each remote entry in the MDB entry.
No functional changes intended.
Stable-dep-of: bc2dc66a6693 ("vxlan: mdb: Fix use-after-free in vxlan_mdb_flush()")
--- drivers/net/vxlan/vxlan_mdb.c | 28 +++++++++++++++++++--------- 1 file changed, 19 insertions(+), 9 deletions(-)
drivers/net/vxlan/vxlan_mdb.c +19 -9
@@ -936,23 +936,20 @@ vxlan_mdb_nlmsg_src_list_size(const struct vxlan_mdb_entry_key *group,return nlmsg_size; } -static size_t vxlan_mdb_nlmsg_size (const struct vxlan_dev *vxlan, -const struct vxlan_mdb_entry *mdb_entry, -const struct vxlan_mdb_remote *remote) +static size_t +vxlan_mdb_nlmsg_remote_size (const struct vxlan_dev *vxlan, +const struct vxlan_mdb_entry *mdb_entry, +const struct vxlan_mdb_remote *remote) {const struct vxlan_mdb_entry_key *group = &mdb_entry->key;struct vxlan_rdst *rd =rtnl_dereference (remote->rd);size_t nlmsg_size; - nlmsg_size =NLMSG_ALIGN (sizeof (struct br_port_msg )) + -/* MDBA_MDB */ -nla_total_size (0 ) + -/* MDBA_MDB_ENTRY */ -nla_total_size (0 ) +/* MDBA_MDB_ENTRY_INFO */ -nla_total_size (sizeof (struct br_mdb_entry )) + + nlmsg_size =nla_total_size (sizeof (struct br_mdb_entry )) +/* MDBA_MDB_EATTR_TIMER */ nla_total_size (sizeof (u32)); +/* MDBA_MDB_EATTR_SOURCE */ if (vxlan_mdb_is_sg (group)) nlmsg_size +=nla_total_size (vxlan_addr_size (&group->dst));
@@ -980,6 +977,19 @@ static size_t vxlan_mdb_nlmsg_size(const struct vxlan_dev *vxlan,return nlmsg_size; } +static size_t vxlan_mdb_nlmsg_size (const struct vxlan_dev *vxlan, +const struct vxlan_mdb_entry *mdb_entry, +const struct vxlan_mdb_remote *remote) +{ +return NLMSG_ALIGN (sizeof (struct br_port_msg )) + +/* MDBA_MDB */ +nla_total_size (0 ) + +/* MDBA_MDB_ENTRY */ +nla_total_size (0 ) + +/* Remote entry */ +vxlan_mdb_nlmsg_remote_size (vxlan, mdb_entry, remote); +} + static int vxlan_mdb_nlmsg_fill(const struct vxlan_dev *vxlan, struct sk_buff *skb, const struct vxlan_mdb_entry *mdb_entry,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1287/1424 bridge: add MDB get uAPI attributes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 83c1bbeb864f2a197603b91b3e0f748cca64543d ]
Add MDB get attributes that correspond to the MDB set attributes used in RTM_NEWMDB messages. Specifically, add 'MDBA_GET_ENTRY' which will hold a 'struct br_mdb_entry' and 'MDBA_GET_ENTRY_ATTRS' which will hold 'MDBE_ATTR_*' attributes that are used as indexes (source IP and source VNI).
An example request will look as follows:
[ struct nlmsghdr ]
[ struct br_port_msg ]
[ MDBA_GET_ENTRY ]
struct br_mdb_entry
[ MDBA_GET_ENTRY_ATTRS ]
[ MDBE_ATTR_SOURCE ]
struct in_addr / struct in6_addr
[ MDBE_ATTR_SRC_VNI ]
u32
Stable-dep-of: bc2dc66a6693 ("vxlan: mdb: Fix use-after-free in vxlan_mdb_flush()")
--- include/uapi/linux/if_bridge.h | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
include/uapi/linux/if_bridge.h +18 -0
@@ -723,6 +723,24 @@ enum { };#define MDBA_SET_ENTRY_MAX (__MDBA_SET_ENTRY_MAX - 1) +/* [MDBA_GET_ENTRY] = { +* struct br_mdb_entry +* [MDBA_GET_ENTRY_ATTRS] = { +* [MDBE_ATTR_SOURCE] +* struct in_addr / struct in6_addr +* [MDBE_ATTR_SRC_VNI] +* u32 +* } +* } +*/ +enum { +MDBA_GET_ENTRY_UNSPEC , +MDBA_GET_ENTRY , +MDBA_GET_ENTRY_ATTRS , + __MDBA_GET_ENTRY_MAX, +}; +#define MDBA_GET_ENTRY_MAX (__MDBA_GET_ENTRY_MAX - 1) +/* [MDBA_SET_ENTRY_ATTRS] = { * [MDBE_ATTR_xxx] * ...
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1288/1424 net: Add MDB get device operation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 62f47bf9e2c00eea457cad8fa43c24ed0282b37a ]
Add MDB net device operation that will be invoked by rtnetlink code in response to received RTM_GETMDB messages. Subsequent patches will implement the operation in the bridge and VXLAN drivers.
Stable-dep-of: bc2dc66a6693 ("vxlan: mdb: Fix use-after-free in vxlan_mdb_flush()")
--- include/linux/netdevice.h | 4 ++++ 1 file changed, 4 insertions(+)
include/linux/netdevice.h +4 -0
@@ -1594,6 +1594,10 @@ struct net_device_ops {int (*ndo_mdb_dump)(struct net_device *dev,struct sk_buff *skb,struct netlink_callback *cb); +int (*ndo_mdb_get)(struct net_device *dev, +struct nlattr *tb[],u32 portid, +u32 seq, +struct netlink_ext_ack *extack); int (*ndo_bridge_setlink)(struct net_device *dev, struct nlmsghdr *nlh, u16 flags,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1289/1424 vxlan: mdb: Add MDB get support
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 32d9673e96dc636cbfca2381b2c93b7a15dc3369 ]
Implement support for MDB get operation by looking up a matching MDB entry, allocating the skb according to the entry's size and then filling in the response.
Stable-dep-of: bc2dc66a6693 ("vxlan: mdb: Fix use-after-free in vxlan_mdb_flush()")
--- drivers/net/vxlan/vxlan_core.c | 1 + drivers/net/vxlan/vxlan_mdb.c | 150 ++++++++++++++++++++++++++++++ drivers/net/vxlan/vxlan_private.h | 2 + 3 files changed, 153 insertions(+)
drivers/net/vxlan/vxlan_core.c +1 -0
@@ -3182,6 +3182,7 @@ static const struct net_device_ops vxlan_netdev_ether_ops = { .ndo_mdb_add = vxlan_mdb_add, .ndo_mdb_del = vxlan_mdb_del, .ndo_mdb_dump = vxlan_mdb_dump, + .ndo_mdb_get = vxlan_mdb_get, .ndo_fill_metadata_dst = vxlan_fill_metadata_dst, };
drivers/net/vxlan/vxlan_mdb.c +150 -0
156 lines not on this page · raw message
drivers/net/vxlan/vxlan_private.h +2 -0
@@ -235,6 +235,8 @@ int vxlan_mdb_add(struct net_device *dev, struct nlattr *tb[], u16 nlmsg_flags, struct netlink_ext_ack *extack);int vxlan_mdb_del (struct net_device *dev,struct nlattr *tb[],struct netlink_ext_ack *extack); +int vxlan_mdb_get (struct net_device *dev,struct nlattr *tb[],u32 portid, +u32 seq,struct netlink_ext_ack *extack);struct vxlan_mdb_entry *vxlan_mdb_entry_skb_get (struct vxlan_dev *vxlan,struct sk_buff *skb,__be32 src_vni);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1290/1424 bridge: add MDB state mask uAPI attribute
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit e37a11fca41864c9f652ff81296b82e6f65a4242 ]
Currently, the 'state' field in 'struct br_port_msg' can be set to 1 if the MDB entry is permanent or 0 if it is temporary. Additional states might be added in the future.
In a similar fashion to 'NDA_NDM_STATE_MASK', add an MDB state mask uAPI attribute that will allow the upcoming bulk deletion API to bulk delete MDB entries with a certain state or any state.
Stable-dep-of: bc2dc66a6693 ("vxlan: mdb: Fix use-after-free in vxlan_mdb_flush()")
--- include/uapi/linux/if_bridge.h | 1 + 1 file changed, 1 insertion(+)
include/uapi/linux/if_bridge.h +1 -0
@@ -757,6 +757,7 @@ enum {MDBE_ATTR_VNI ,MDBE_ATTR_IFINDEX ,MDBE_ATTR_SRC_VNI , +MDBE_ATTR_STATE_MASK , __MDBE_ATTR_MAX, };#define MDBE_ATTR_MAX (__MDBE_ATTR_MAX - 1)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1291/1424 net: Add MDB bulk deletion device operation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 1a36e0f50f963465e9b2b980d250ab38b8fcd7a3 ]
Add MDB net device operation that will be invoked by rtnetlink code in response to received 'RTM_DELMDB' messages with the 'NLM_F_BULK' flag set. Subsequent patches will implement the operation in the bridge and VXLAN drivers.
Stable-dep-of: bc2dc66a6693 ("vxlan: mdb: Fix use-after-free in vxlan_mdb_flush()")
--- include/linux/netdevice.h | 6 ++++++ 1 file changed, 6 insertions(+)
include/linux/netdevice.h +6 -0
@@ -1307,6 +1307,9 @@ struct netdev_net_notifier {* int (*ndo_mdb_del)(struct net_device *dev, struct nlattr *tb[], * struct netlink_ext_ack *extack); * Deletes the MDB entry from dev. +* int (*ndo_mdb_del_bulk)(struct net_device *dev, struct nlattr *tb[], +* struct netlink_ext_ack *extack); +* Bulk deletes MDB entries from dev. * int (*ndo_mdb_dump)(struct net_device *dev, struct sk_buff *skb, * struct netlink_callback *cb); * Dumps MDB entries from dev. The first argument (marker) in the netlink
@@ -1591,6 +1594,9 @@ struct net_device_ops {int (*ndo_mdb_del)(struct net_device *dev,struct nlattr *tb[],struct netlink_ext_ack *extack); +int (*ndo_mdb_del_bulk)(struct net_device *dev, +struct nlattr *tb[], +struct netlink_ext_ack *extack);int (*ndo_mdb_dump)(struct net_device *dev,struct sk_buff *skb,struct netlink_callback *cb);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1292/1424 vxlan: mdb: Add MDB bulk deletion support
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 4cde72fead4cebb5b6b2fe9425904c2064739184 ]
Implement MDB bulk deletion support in the VXLAN driver, allowing MDB entries to be deleted in bulk according to provided parameters.
Stable-dep-of: bc2dc66a6693 ("vxlan: mdb: Fix use-after-free in vxlan_mdb_flush()")
--- drivers/net/vxlan/vxlan_core.c | 1 + drivers/net/vxlan/vxlan_mdb.c | 174 +++++++++++++++++++++++++----- drivers/net/vxlan/vxlan_private.h | 2 + 3 files changed, 153 insertions(+), 24 deletions(-)
drivers/net/vxlan/vxlan_core.c +1 -0
@@ -3181,6 +3181,7 @@ static const struct net_device_ops vxlan_netdev_ether_ops = { .ndo_fdb_get = vxlan_fdb_get, .ndo_mdb_add = vxlan_mdb_add, .ndo_mdb_del = vxlan_mdb_del, + .ndo_mdb_del_bulk = vxlan_mdb_del_bulk, .ndo_mdb_dump = vxlan_mdb_dump, .ndo_mdb_get = vxlan_mdb_get, .ndo_fill_metadata_dst = vxlan_fill_metadata_dst,
drivers/net/vxlan/vxlan_mdb.c +150 -24
198 lines not on this page · raw message
drivers/net/vxlan/vxlan_private.h +2 -0
@@ -235,6 +235,8 @@ int vxlan_mdb_add(struct net_device *dev, struct nlattr *tb[], u16 nlmsg_flags, struct netlink_ext_ack *extack);int vxlan_mdb_del (struct net_device *dev,struct nlattr *tb[],struct netlink_ext_ack *extack); +int vxlan_mdb_del_bulk (struct net_device *dev,struct nlattr *tb[], +struct netlink_ext_ack *extack);int vxlan_mdb_get (struct net_device *dev,struct nlattr *tb[],u32 portid,u32 seq,struct netlink_ext_ack *extack); struct vxlan_mdb_entry *vxlan_mdb_entry_skb_get(struct vxlan_dev *vxlan,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1293/1424 vxlan: mdb: Fix use-after-free in vxlan_mdb_flush()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baul Lee <[email protected]>
[ Upstream commit bc2dc66a6693a78f8c1e6ca2dbebd50f16e2c366 ]
vxlan_mdb_flush() iterates over the MDB entries using hlist_for_each_entry_safe(), which only tolerates the removal of the current entry. Contrary to the comment above the loop, the removal of an entry can trigger the removal of another entry.
Flushing the remotes of a (*, G) entry also removes the (S, G) entries that were created for its source list, once they are left without remotes:
vxlan_mdb_remotes_flush()
-> vxlan_mdb_remote_del()
-> vxlan_mdb_remote_srcs_del()
-> vxlan_mdb_remote_src_del()
-> vxlan_mdb_remote_src_fwd_del()
-> __vxlan_mdb_del()
-> vxlan_mdb_entry_put()Such an entry can be located after the (*, G) entry in the list, as vxlan_mdb_entry_get() returns an existing entry without moving it to the head of the list. This order is obtained by adding the (S, G) entry before the (*, G) entry, the latter with NLM_F_REPLACE, as the addition of the source otherwise fails with -EEXIST. The (S, G) entry is then the entry saved by hlist_for_each_entry_safe() and it is freed while the (*, G) entry is processed. The next iteration calls hlist_del() on it again, writing LIST_POISON1 to LIST_POISON2 [1].
Besides device deletion, the flush is also reachable from RTM_DELMDB with NLM_F_BULK.
Fix by re-reading the next entry after the remotes were flushed. The current entry cannot be removed by this flush, as source lists can only be configured on (*, G) entries and the removed entries are (S, G) entries. It is therefore still linked and its next pointer reflects the removals.
[1]
BUG: KASAN: wild-memory-access in vxlan_mdb_entry_put.part.0+0x328/0x588 Write of size 8 at addr dead000000000122 by task ip/327 CPU: 3 UID: 1000 PID: 327 Comm: ip Not tainted 7.2.0-rc7 #2 PREEMPT Call trace: vxlan_mdb_entry_put.part.0+0x328/0x588 vxlan_mdb_flush+0x1d8/0x25c vxlan_mdb_fini+0x8c/0x100 vxlan_uninit+0x1c/0x7c unregister_netdevice_many_notify+0x954/0xd4c rtnl_dellink+0x210/0x530 rtnetlink_rcv_msg+0x434/0x4d0 netlink_rcv_skb+0xc4/0x204 rtnetlink_rcv+0x18/0x24 netlink_unicast+0x4b8/0x548 netlink_sendmsg+0x29c/0x560 ____sys_sendmsg+0x390/0x3ec ___sys_sendmsg+0x114/0x188 __sys_sendmsg+0xf0/0x178 __arm64_sys_sendmsg+0x48/0x60 invoke_syscall.constprop.0+0x58/0x180 el0_svc_common.constprop.0+0x74/0x140 do_el0_svc+0x30/0x40 el0_svc+0x38/0x98 el0t_64_sync_handler+0xa0/0xe4 el0t_64_sync+0x198/0x19c
--- drivers/net/vxlan/vxlan_mdb.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/net/vxlan/vxlan_mdb.c +6 -3
@@ -1428,14 +1428,17 @@ static void vxlan_mdb_flush(struct vxlan_dev *vxlan,struct vxlan_mdb_entry *mdb_entry;struct hlist_node *tmp; -/* The removal of an entry cannot trigger the removal of another entry -* since entries are always added to the head of the list. -*/ hlist_for_each_entry_safe (mdb_entry, tmp, &vxlan->mdb_list, mdb_node) {if (desc->src_vni && desc->src_vni != mdb_entry->key.vni)continue ;vxlan_mdb_remotes_flush (vxlan, mdb_entry, desc); +/* The flush can remove the (S, G) entries created for the +* source list of this entry, including the one saved by +* hlist_for_each_entry_safe(), so re-read it while this entry +* is still linked. +*/ + tmp = mdb_entry->mdb_node.next;/* Entry will only be removed if its remotes list is empty. */ vxlan_mdb_entry_put (vxlan, mdb_entry); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1294/1424 8139cp: fix Rx and Tx not being disabled in cp_suspend
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <[email protected]>
[ Upstream commit cb7643b78d35392f0f434774d78b4c77b80f677f ]
On QEMU rtl8139 model, frames that arrive while the interface is suspended still end up in the stack after resume. With pm_test=devices, which keeps devices suspended for 5s, 200 frames sent to interface during that time and 50 frames after resume, eth0 reports 113 received frames.
cp_suspend() is supposed to stop receiver and the transmitter, but the mask is wrong: (~RxOn | ~TxOn) is ~0, nothing is cleared and Cmd still reads 0x0d when cp_suspend() returns.
Use ~(RxOn | TxOn) so both bits are actually cleared.
--- drivers/net/ethernet/realtek/8139cp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/realtek/8139cp.c +1 -1
@@ -2066,7 +2066,7 @@ static int __maybe_unused cp_suspend(struct device *device)/* Disable Rx and Tx */ cpw16 (IntrMask,0 ); -cpw8 (Cmd,cpr8 (Cmd) & (~RxOn | ~TxOn)); +cpw8 (Cmd,cpr8 (Cmd) & ~(RxOn | TxOn));spin_unlock_irqrestore (&cp->lock, flags);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1295/1424 net/smc: hash socket only after full initialisation in smc_sk_init()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mahanta Jambigi <[email protected]>
[ Upstream commit 8acf691d8017012e1476c30e7381513c1e929c94 ]
smc_sk_init() calls sk->sk_prot->hash(sk) before several fields are fully initialised: clcsock_release_lock, the saved clcsk_* callbacks, use_fallback/fallback_rsn, and conn.close_work. Once hash() returns the socket is visible to concurrent hash walkers, which can then observe uninitialised state.
Move hash(sk) to the end of smc_sk_init() so the socket is published only after it is fully constructed.
--- net/smc/af_smc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/smc/af_smc.c +1 -1
@@ -391,13 +391,13 @@ void smc_sk_init(struct net *net, struct sock *sk, int protocol)INIT_LIST_HEAD (&smc->accept_q);spin_lock_init (&smc->accept_q_lock);spin_lock_init (&smc->conn.send_lock); - sk->sk_prot->hash (sk);mutex_init (&smc->clcsock_release_lock);smc_init_saved_callbacks (smc); smc->limit_smc_hs = net->smc.limit_smc_hs; smc->use_fallback = false;/* assume rdma capability first */ smc->fallback_rsn =0 ;smc_close_init (smc); + sk->sk_prot->hash (sk); } static struct sock *smc_sock_alloc(struct net *net, struct socket *sock,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1296/1424 platform/x86: dell-wmi-sysman: Fix instance ID bounds
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: HyeongJun An <[email protected]>
[ Upstream commit 5ab078e3241da0beec2022254b5811a8a52cff84 ]
The get_instance_id() macro walks the per-type attribute array with 'i <= instances_count'. Each array is allocated with exactly instances_count entries, so the valid range is [0, instances_count) and the last iteration reads one element past the end. On a name miss that out-of-bounds attribute_name is handed to strcmp(), which reads on until it finds a NUL byte.
Every kobject in these ksets is built from an entry that was populated, so a miss does not look reachable from sysfs today. The bound is wrong either way and the read is out of bounds.
The matching macro in hp-bioscfg carried the same off-by-one and was corrected by commit 25150715e0b0 ("platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro"). That macro takes a kobject pointer out of the out-of-bounds element and dereferences it, so it could fault. This one reads a char array.
Use '<' to match the allocation.
--- drivers/platform/x86/dell/dell-wmi-sysman/dell-wmi-sysman.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/platform/x86/dell/dell-wmi-sysman/dell-wmi-sysman.h +1 -1
@@ -107,7 +107,7 @@ enum { static int get_##type##_instance_id(struct kobject *kobj) \ { \ int i; \ - for (i = 0; i <= wmi_priv.type##_instances_count; i++) { \ + for (i = 0; i < wmi_priv.type##_instances_count; i++) { \ if (!(strcmp(kobj->name, wmi_priv.type##_data[i].attribute_name)))\ return i; \ } \
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1297/1424 vsock: use sock_error() to consume sk_err after a failed connect
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nguyen Dinh Phi <[email protected]>
[ Upstream commit 96cbf89993091a163bfedec52a3bd683dc94b3b4 ]
vsock_connect() returns sk_err to userspace but does not clear it:
if (sk->sk_err) {
err = -sk->sk_err;For a blocking connect() the error has already been delivered as connect()'s return value, so leaving it set causes subsequent operations like poll()/epoll() to keep reporting POLLERR even though the connect failure was already delivered.
The error should be consumed once it has been returned to userspace. Switch to sock_error(), which reads and clears sk_err atomically, matching the behavior of other protocol implementations such as __inet_stream_connect().
--- net/vmw_vsock/af_vsock.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
net/vmw_vsock/af_vsock.c +2 -4
@@ -1605,12 +1605,10 @@ static int vsock_connect(struct socket *sock, struct sockaddr *addr,prepare_to_wait (sk_sleep (sk), &wait,TASK_INTERRUPTIBLE ); } -if (sk->sk_err) { - err = -sk->sk_err; + err =sock_error (sk); +if (err) { sk->sk_state =TCP_CLOSE ; sock->state =SS_UNCONNECTED ; - }else { - err =0 ; } out_wait:
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1298/1424 platform/x86: hp-bioscfg: fix password encoding bounds check
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <[email protected]>
[ Upstream commit e213939ed9e6e6badf7aa48c4c8dd9a9cdf00615 ]
The password PSWD_ENCODINGS parser reads password_obj[elem + pos_values] while copying the supported password encodings from the ACPI package.
The outer loop only guarantees that elem is within password_obj_count. The encoding count is bounded by MAX_ENCODINGS_SIZE, but that does not guarantee that the ACPI package contains enough entries for all elem + pos_values accesses.
A malformed package can therefore declare a non-zero encoding count without providing enough string objects, causing the parser to read past the ACPI package array and pass an out-of-bounds string pointer and length to hp_convert_hexstr_to_str().
Add the same computed-index bounds check used by the other offset-based package parsing loops before reading password_obj[elem + pos_values].
--- drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c +5 -0
@@ -361,6 +361,11 @@ static int hp_populate_password_elements_from_package(union acpi_object *passworcase PSWD_ENCODINGS : size =min_t (u32, password_data->encodings_size,MAX_ENCODINGS_SIZE );for (pos_values =0 ; pos_values < size; pos_values++) { +if (elem + pos_values >= password_obj_count) { +pr_err ("Error elem-objects package is too small\n" ); +return -EINVAL ; + } + ret =hp_convert_hexstr_to_str (password_obj[elem + pos_values].string.pointer, password_obj[elem + pos_values].string.length, &str_value, &value_len);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1299/1424 mlxbf-bootctl: fix the build error with FIELD_PREP()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Kulikov <[email protected]>
[ Upstream commit 46b14c6f11f558362391e308f4f184ee867ef58f ]
rsh_log_store() calls the FIELD_PREP() macro without including the required header file, resulting a build error:
CC drivers/platform/mellanox/mlxbf-bootctl.odrivers/platform/mellanox/mlxbf-bootctl.c: In function ‘rsh_log_store’:drivers/platform/mellanox/mlxbf-bootctl.c:429:16: error: implicit declaration of function ‘FIELD_PREP’ [-Wimplicit-function-declaration]
429 | data = FIELD_PREP(MLXBF_RSH_LOG_TYPE_MASK, MLXBF_RSH_LOG_TYPE_MSG);
| ^~~~~~~~~~Fix this by including the <linux/bitfield.h> file.
--- drivers/platform/mellanox/mlxbf-bootctl.c | 1 + 1 file changed, 1 insertion(+)
drivers/platform/mellanox/mlxbf-bootctl.c +1 -0
@@ -10,6 +10,7 @@#include <linux/acpi.h> #include <linux/arm-smccc.h> +#include <linux/bitfield.h> #include <linux/delay.h> #include <linux/if_ether.h> #include <linux/iopoll.h>
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1300/1424 bonding: initialize err for empty target lists
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <[email protected]>
[ Upstream commit 8ccc9bf9afeeb46a437081c07154fbf5964682b2 ]
Empty NLA_NESTED attributes are valid, and bonding uses them to clear the ARP and NS target lists. When either target attribute is empty, nla_for_each_nested() does not execute, so err retains an uninitialized value before it is tested. The request can consequently return an unpredictable error after clearing the targets.
Initialize err to zero so an empty target list completes successfully. Non-empty lists still propagate errors from __bond_opt_set() unchanged.
This issue was found by a static analysis checker and confirmed by manual source review.
--- drivers/net/bonding/bond_netlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/bonding/bond_netlink.c +1 -1
@@ -217,7 +217,7 @@ static int bond_changelink(struct net_device *bond_dev, struct nlattr *tb[],struct bonding *bond =netdev_priv (bond_dev);struct bond_opt_value newval;int miimon =0 ; -int err; +int err =0 ;if (!data)return 0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1301/1424 i3c: mipi-i3c-hci: Fix DAT/DCT entry sizes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jarkko Nikula <[email protected]>
[ Upstream commit 0676bfebf5766f0a60549f74ba597115028fa39c ]
MIPI I3C HCI specification v1.1 describes the ENTRY_SIZE field for the Device Address Table (DAT) and the Device Characteristics Table (DCT) section offset registers (DAT_SECTION_OFFSET and DCT_SECTION_OFFSET). That field is not documented in earlier version.
ENTRY_SIZE value 0 is meant to be backward compatible. For the DAT entry size it is interpreted as 2 DWORDs (8-bytes) and for the DCT entry size as 4 DWORDs (16-bytes). Values 1-15 are reserved for future use.
New version I believe fixes also the TABLE_SIZE field description. Before it was defined in DWORDs which I believe is incorrect since the DAT/DCT table entry structures, and sizes, are described having 8-bytes/16-bytes entries.
This is more clear in the specification v1.1 which states the TABLE_SIZE fields are interpreted as number of entries in the DAT/DCT tables. I believe this same holds also in earlier version, at least it makes more sense.
Fix code accordingly and let the DAT_entry_size and the DCT_entry_size variables carry the size as bytes. Which is how it is already interpreted in the dat_v1.c: hci_dat_v1_init().
Stable-dep-of: 308ecb824db3 ("i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode")
--- drivers/i3c/master/mipi-i3c-hci/core.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/i3c/master/mipi-i3c-hci/core.c +4 -4
@@ -610,17 +610,17 @@ static int i3c_hci_init(struct i3c_hci *hci) offset =FIELD_GET (DAT_TABLE_OFFSET , regval); hci->DAT_regs = offset ? hci->base_regs + offset :NULL ; hci->DAT_entries =FIELD_GET (DAT_TABLE_SIZE , regval); - hci->DAT_entry_size =FIELD_GET (DAT_ENTRY_SIZE , regval); + hci->DAT_entry_size =FIELD_GET (DAT_ENTRY_SIZE , regval) ?0 :8 ;dev_info (&hci->master.dev,"DAT: %u %u-bytes entries at offset %#x\n" , - hci->DAT_entries, hci->DAT_entry_size *4 , offset); + hci->DAT_entries, hci->DAT_entry_size, offset); regval =reg_read (DCT_SECTION ); offset =FIELD_GET (DCT_TABLE_OFFSET , regval); hci->DCT_regs = offset ? hci->base_regs + offset :NULL ; hci->DCT_entries =FIELD_GET (DCT_TABLE_SIZE , regval); - hci->DCT_entry_size =FIELD_GET (DCT_ENTRY_SIZE , regval); + hci->DCT_entry_size =FIELD_GET (DCT_ENTRY_SIZE , regval) ?0 :16 ;dev_info (&hci->master.dev,"DCT: %u %u-bytes entries at offset %#x\n" , - hci->DCT_entries, hci->DCT_entry_size *4 , offset); + hci->DCT_entries, hci->DCT_entry_size, offset); regval =reg_read (RING_HEADERS_SECTION ); offset =FIELD_GET (RING_HEADERS_OFFSET , regval);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1302/1424 i3c: mipi-i3c-hci: Fix number of DAT/DCT entries for HCI versions < 1.1
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jarkko Nikula <[email protected]>
[ Upstream commit be90ae1ba14a83962b33c4d4c854ef081186b0e4 ]
I was wrong about the TABLE_SIZE field description in the commit 0676bfebf576 ("i3c: mipi-i3c-hci: Fix DAT/DCT entry sizes").
For the MIPI I3C HCI versions 1.0 and earlier the TABLE_SIZE field in the registers DAT_SECTION_OFFSET and DCT_SECTION_OFFSET is indeed defined in DWORDs and not number of entries like it is defined in later versions.
Where above fix allowed driver initialization to continue the wrongly interpreted TABLE_SIZE field leads variables DAT_entries being twice and DCT_entries four times as big as they really are.
That in turn leads clearing the DAT table over the boundary in the dat_v1.c: hci_dat_v1_init().
So interprete the TABLE_SIZE field in DWORDs for HCI versions < 1.1 and fix number of DAT/DCT entries accordingly.
Stable-dep-of: 308ecb824db3 ("i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode")
--- drivers/i3c/master/mipi-i3c-hci/core.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/i3c/master/mipi-i3c-hci/core.c +8 -0
@@ -583,6 +583,7 @@ static irqreturn_t i3c_hci_irq_handler(int irq, void *dev_id)static int i3c_hci_init (struct i3c_hci *hci) {u32 regval, offset; +bool size_in_dwords;int ret;/* Validate HCI hardware version */
@@ -606,11 +607,16 @@ static int i3c_hci_init(struct i3c_hci *hci) hci->caps =reg_read (HC_CAPABILITIES );DBG ("caps = %#x" , hci->caps); + size_in_dwords = hci->version_major <1 || + (hci->version_major ==1 && hci->version_minor <1 ); + regval =reg_read (DAT_SECTION ); offset =FIELD_GET (DAT_TABLE_OFFSET , regval); hci->DAT_regs = offset ? hci->base_regs + offset :NULL ; hci->DAT_entries =FIELD_GET (DAT_TABLE_SIZE , regval); hci->DAT_entry_size =FIELD_GET (DAT_ENTRY_SIZE , regval) ?0 :8 ; +if (size_in_dwords) + hci->DAT_entries =4 * hci->DAT_entries / hci->DAT_entry_size;dev_info (&hci->master.dev,"DAT: %u %u-bytes entries at offset %#x\n" , hci->DAT_entries, hci->DAT_entry_size, offset);
@@ -619,6 +625,8 @@ static int i3c_hci_init(struct i3c_hci *hci) hci->DCT_regs = offset ? hci->base_regs + offset :NULL ; hci->DCT_entries =FIELD_GET (DCT_TABLE_SIZE , regval); hci->DCT_entry_size =FIELD_GET (DCT_ENTRY_SIZE , regval) ?0 :16 ; +if (size_in_dwords) + hci->DCT_entries =4 * hci->DCT_entries / hci->DCT_entry_size;dev_info (&hci->master.dev,"DCT: %u %u-bytes entries at offset %#x\n" , hci->DCT_entries, hci->DCT_entry_size, offset);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1303/1424 i3c: mipi-i3c-hci: Quieten initialization messages
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
[ Upstream commit 581d5b7953b8f24d2f379c8c56ceaa7d163488ce ]
The copious initialization messages are at most useful only for debugging. Change them from dev_info() or dev_notice() to dev_dbg().
Stable-dep-of: 308ecb824db3 ("i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode")
--- drivers/i3c/master/mipi-i3c-hci/core.c | 18 +++---- drivers/i3c/master/mipi-i3c-hci/dma.c | 4 +- drivers/i3c/master/mipi-i3c-hci/ext_caps.c | 55 ++++++++++------------ drivers/i3c/master/mipi-i3c-hci/pio.c | 16 +++---- 4 files changed, 45 insertions(+), 48 deletions(-)
drivers/i3c/master/mipi-i3c-hci/core.c +9 -9
@@ -617,8 +617,8 @@ static int i3c_hci_init(struct i3c_hci *hci) hci->DAT_entry_size =FIELD_GET (DAT_ENTRY_SIZE , regval) ?0 :8 ;if (size_in_dwords) hci->DAT_entries =4 * hci->DAT_entries / hci->DAT_entry_size; -dev_info (&hci->master.dev,"DAT: %u %u-bytes entries at offset %#x\n" , - hci->DAT_entries, hci->DAT_entry_size, offset); +dev_dbg (&hci->master.dev,"DAT: %u %u-bytes entries at offset %#x\n" , + hci->DAT_entries, hci->DAT_entry_size, offset); regval =reg_read (DCT_SECTION ); offset =FIELD_GET (DCT_TABLE_OFFSET , regval);
@@ -627,23 +627,23 @@ static int i3c_hci_init(struct i3c_hci *hci) hci->DCT_entry_size =FIELD_GET (DCT_ENTRY_SIZE , regval) ?0 :16 ;if (size_in_dwords) hci->DCT_entries =4 * hci->DCT_entries / hci->DCT_entry_size; -dev_info (&hci->master.dev,"DCT: %u %u-bytes entries at offset %#x\n" , - hci->DCT_entries, hci->DCT_entry_size, offset); +dev_dbg (&hci->master.dev,"DCT: %u %u-bytes entries at offset %#x\n" , + hci->DCT_entries, hci->DCT_entry_size, offset); regval =reg_read (RING_HEADERS_SECTION ); offset =FIELD_GET (RING_HEADERS_OFFSET , regval); hci->RHS_regs = offset ? hci->base_regs + offset :NULL ; -dev_info (&hci->master.dev,"Ring Headers at offset %#x\n" , offset); +dev_dbg (&hci->master.dev,"Ring Headers at offset %#x\n" , offset); regval =reg_read (PIO_SECTION ); offset =FIELD_GET (PIO_REGS_OFFSET , regval); hci->PIO_regs = offset ? hci->base_regs + offset :NULL ; -dev_info (&hci->master.dev,"PIO section at offset %#x\n" , offset); +dev_dbg (&hci->master.dev,"PIO section at offset %#x\n" , offset); regval =reg_read (EXT_CAPS_SECTION ); offset =FIELD_GET (EXT_CAPS_OFFSET , regval); hci->EXTCAPS_regs = offset ? hci->base_regs + offset :NULL ; -dev_info (&hci->master.dev,"Extended Caps at offset %#x\n" , offset); +dev_dbg (&hci->master.dev,"Extended Caps at offset %#x\n" , offset); ret =i3c_hci_parse_ext_caps (hci);if (ret)
@@ -713,7 +713,7 @@ static int i3c_hci_init(struct i3c_hci *hci) ret = -EIO ; }else { hci->io = &mipi_i3c_hci_dma; -dev_info (&hci->master.dev,"Using DMA\n" ); +dev_dbg (&hci->master.dev,"Using DMA\n" ); } }
@@ -725,7 +725,7 @@ static int i3c_hci_init(struct i3c_hci *hci) ret = -EIO ; }else { hci->io = &mipi_i3c_hci_pio; -dev_info (&hci->master.dev,"Using PIO\n" ); +dev_dbg (&hci->master.dev,"Using PIO\n" ); } }
drivers/i3c/master/mipi-i3c-hci/dma.c +2 -2
@@ -216,7 +216,7 @@ static int hci_dma_init(struct i3c_hci *hci) regval =rhs_reg_read (CONTROL ); nr_rings =FIELD_GET (MAX_HEADER_COUNT_CAP , regval); -dev_info (&hci->master.dev,"%d DMA rings available\n" , nr_rings); +dev_dbg (&hci->master.dev,"%d DMA rings available\n" , nr_rings);if (unlikely (nr_rings >8 )) {dev_err (&hci->master.dev,"number of rings should be <= 8\n" ); nr_rings =8 ;
@@ -232,7 +232,7 @@ static int hci_dma_init(struct i3c_hci *hci)for (i =0 ; i < rings->total; i++) {u32 offset =rhs_reg_read (RHn_OFFSET (i)); -dev_info (&hci->master.dev,"Ring %d at offset %#x\n" , i, offset); +dev_dbg (&hci->master.dev,"Ring %d at offset %#x\n" , i, offset); ret = -EINVAL ;if (!offset) goto err_out;
drivers/i3c/master/mipi-i3c-hci/ext_caps.c +26 -29
154 lines not on this page · raw message
drivers/i3c/master/mipi-i3c-hci/pio.c +8 -8
@@ -149,14 +149,14 @@ static int hci_pio_init(struct i3c_hci *hci)spin_lock_init (&pio->lock); size_val =pio_reg_read (QUEUE_SIZE ); -dev_info (&hci->master.dev,"CMD/RESP FIFO = %ld entries\n" , -FIELD_GET (CR_QUEUE_SIZE , size_val)); -dev_info (&hci->master.dev,"IBI FIFO = %ld bytes\n" , -4 *FIELD_GET (IBI_STATUS_SIZE , size_val)); -dev_info (&hci->master.dev,"RX data FIFO = %d bytes\n" , -4 * (2 <<FIELD_GET (RX_DATA_BUFFER_SIZE , size_val))); -dev_info (&hci->master.dev,"TX data FIFO = %d bytes\n" , -4 * (2 <<FIELD_GET (TX_DATA_BUFFER_SIZE , size_val))); +dev_dbg (&hci->master.dev,"CMD/RESP FIFO = %ld entries\n" , +FIELD_GET (CR_QUEUE_SIZE , size_val)); +dev_dbg (&hci->master.dev,"IBI FIFO = %ld bytes\n" , +4 *FIELD_GET (IBI_STATUS_SIZE , size_val)); +dev_dbg (&hci->master.dev,"RX data FIFO = %d bytes\n" , +4 * (2 <<FIELD_GET (RX_DATA_BUFFER_SIZE , size_val))); +dev_dbg (&hci->master.dev,"TX data FIFO = %d bytes\n" , +4 * (2 <<FIELD_GET (TX_DATA_BUFFER_SIZE , size_val)));/* * Let's initialize data thresholds to half of the actual FIFO size.
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1304/1424 i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
[ Upstream commit 11d17c2855bfc04550557017eae02e92f3eeab1c ]
The driver already uses managed resources, so convert the PIO data structure allocation to devm_zalloc(). Remove the manual kfree().
Stable-dep-of: 308ecb824db3 ("i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode")
--- drivers/i3c/master/mipi-i3c-hci/pio.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/i3c/master/mipi-i3c-hci/pio.c +1 -3
@@ -141,7 +141,7 @@ static int hci_pio_init(struct i3c_hci *hci)struct hci_pio_data *pio;u32 val, size_val, rx_thresh, tx_thresh, ibi_val; - pio =kzalloc (sizeof (*pio),GFP_KERNEL ); + pio =devm_kzalloc (hci->master.dev.parent,sizeof (*pio),GFP_KERNEL );if (!pio)return -ENOMEM ;
@@ -219,8 +219,6 @@ static void hci_pio_cleanup(struct i3c_hci *hci)BUG_ON (pio->curr_rx);BUG_ON (pio->curr_tx);BUG_ON (pio->curr_resp); -kfree (pio); - hci->io_data =NULL ; } }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1305/1424 i3c: mipi-i3c-hci: Refactor PIO register initialization
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
[ Upstream commit ca4d4682d353bf4e7e5db7b025e9ecd80bc67b27 ]
Move the PIO register setup logic out of hci_pio_init() into a new helper, __hci_pio_init(). This refactoring prepares for Runtime PM support by allowing PIO registers to be reinitialized independently after resume.
Stable-dep-of: 308ecb824db3 ("i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode")
--- drivers/i3c/master/mipi-i3c-hci/pio.c | 45 +++++++++++++++++---------- 1 file changed, 28 insertions(+), 17 deletions(-)
drivers/i3c/master/mipi-i3c-hci/pio.c +28 -17
@@ -136,27 +136,14 @@ struct hci_pio_data {u32 enabled_irqs; }; -static int hci_pio_init (struct i3c_hci *hci) +static void __hci_pio_init (struct i3c_hci *hci,u32 *size_val_ptr) { -struct hci_pio_data *pio;u32 val, size_val, rx_thresh, tx_thresh, ibi_val; - - pio =devm_kzalloc (hci->master.dev.parent,sizeof (*pio),GFP_KERNEL ); -if (!pio) -return -ENOMEM ; - - hci->io_data = pio; -spin_lock_init (&pio->lock); +struct hci_pio_data *pio = hci->io_data; size_val =pio_reg_read (QUEUE_SIZE ); -dev_dbg (&hci->master.dev,"CMD/RESP FIFO = %ld entries\n" , -FIELD_GET (CR_QUEUE_SIZE , size_val)); -dev_dbg (&hci->master.dev,"IBI FIFO = %ld bytes\n" , -4 *FIELD_GET (IBI_STATUS_SIZE , size_val)); -dev_dbg (&hci->master.dev,"RX data FIFO = %d bytes\n" , -4 * (2 <<FIELD_GET (RX_DATA_BUFFER_SIZE , size_val))); -dev_dbg (&hci->master.dev,"TX data FIFO = %d bytes\n" , -4 * (2 <<FIELD_GET (TX_DATA_BUFFER_SIZE , size_val))); +if (size_val_ptr) + *size_val_ptr = size_val;/* * Let's initialize data thresholds to half of the actual FIFO size.
@@ -202,6 +189,30 @@ static int hci_pio_init(struct i3c_hci *hci)/* Always accept error interrupts (will be activated on first xfer) */ pio->enabled_irqs =STAT_ALL_ERRORS ; +} + +static int hci_pio_init (struct i3c_hci *hci) +{ +struct hci_pio_data *pio; +u32 size_val; + + pio =devm_kzalloc (hci->master.dev.parent,sizeof (*pio),GFP_KERNEL ); +if (!pio) +return -ENOMEM ; + + hci->io_data = pio; +spin_lock_init (&pio->lock); + +__hci_pio_init (hci, &size_val); + +dev_dbg (&hci->master.dev,"CMD/RESP FIFO = %ld entries\n" , +FIELD_GET (CR_QUEUE_SIZE , size_val)); +dev_dbg (&hci->master.dev,"IBI FIFO = %ld bytes\n" , +4 *FIELD_GET (IBI_STATUS_SIZE , size_val)); +dev_dbg (&hci->master.dev,"RX data FIFO = %d bytes\n" , +4 * (2 <<FIELD_GET (RX_DATA_BUFFER_SIZE , size_val))); +dev_dbg (&hci->master.dev,"TX data FIFO = %d bytes\n" , +4 * (2 <<FIELD_GET (TX_DATA_BUFFER_SIZE , size_val)));return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1306/1424 i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jian-Ming Liao <[email protected]>
[ Upstream commit 308ecb824db329a8e22dd0b10f2a3411a6fbbde3 ]
In PIO mode initialization, STAT_IBI_STATUS_THLD was missing from pio->enabled_irqs. As a result, the host controller interrupt signal for IBI threshold was never enabled when transfer starts, preventing IBI status descriptors from being properly processed in PIO mode.
Include STAT_IBI_STATUS_THLD in pio->enabled_irqs so that the IBI threshold interrupt is activated alongside error interrupts upon the first transfer.
--- drivers/i3c/master/mipi-i3c-hci/pio.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/i3c/master/mipi-i3c-hci/pio.c +5 -2
@@ -187,8 +187,11 @@ static void __hci_pio_init(struct i3c_hci *hci, u32 *size_val_ptr)pio_reg_write (INTR_SIGNAL_ENABLE ,0x0 );pio_reg_write (INTR_STATUS_ENABLE ,0xffffffff ); -/* Always accept error interrupts (will be activated on first xfer) */ - pio->enabled_irqs =STAT_ALL_ERRORS ; +/* +* Always accept error interrupts and IBI threshold interrupt +* (will be activated on first xfer). +*/ + pio->enabled_irqs =STAT_ALL_ERRORS |STAT_IBI_STATUS_THLD ; }static int hci_pio_init (struct i3c_hci *hci)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1307/1424 virtio_balloon: disable indirect descriptors
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael S. Tsirkin <[email protected]>
[ Upstream commit 281eb4732aae5473141b84e106fe906c69b2ff3d ]
The page reporting callback submits an sg list to the reporting virtqueue. With VIRTIO_RING_F_INDIRECT_DESC negotiated and total_sg > 1 (which it typically is), virtqueue_add reports it to the host by allocating an indirect descriptor via kmalloc(GFP_KERNEL).
This is not pretty: the reporting worker isolates potentially hundreds of MB of free pages from the buddy allocator (reported pages are at least pageblock_order, and the sg can contain up to PAGE_REPORTING_CAPACITY entries of varying orders). As the result, very theoretically, the kmalloc might trigger OOM when we have in fact a ton of free memory.
Clear VIRTIO_RING_F_INDIRECT_DESC, to avoid using indirect descriptors.
Message-ID: <73fac8a629fd9aca7bb3265ac243a769c28af25d.1783232420.git.mst@redhat.com>
--- drivers/virtio/virtio_balloon.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/virtio/virtio_balloon.c +6 -0
@@ -7,6 +7,7 @@*/ #include <linux/virtio.h> +#include <uapi/linux/virtio_ring.h> #include <linux/virtio_balloon.h> #include <linux/swap.h> #include <linux/workqueue.h>
@@ -1095,6 +1096,11 @@ static int virtballoon_validate(struct virtio_device *vdev)else if (!virtio_has_feature (vdev,VIRTIO_BALLOON_F_PAGE_POISON ))__virtio_clear_bit (vdev,VIRTIO_BALLOON_F_REPORTING ); +/* +* Disable indirect descriptors to avoid memory allocation in +* virtqueue_add during page reporting. +*/ +__virtio_clear_bit (vdev,VIRTIO_RING_F_INDIRECT_DESC );__virtio_clear_bit (vdev,VIRTIO_F_ACCESS_PLATFORM );return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1308/1424 vdpa_sim: fix cleanup after worker creation failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linfeng Sun <[email protected]>
[ Upstream commit bd670e5dfd2b01fd9692f61fa1456434c54026a4 ]
vdpasim_create() leaves vdpasim->worker as an ERR_PTR when kthread_run_worker() fails. The error path then drops the device reference, which releases the partially initialized simulator.
vdpasim_free() unconditionally passes the worker pointer to kthread_destroy_worker(), so the ERR_PTR is dereferenced and can trigger a general protection fault.
Store the worker error, clear the pointer, and only clean up the worker when it was successfully initialized. Also make the release path tolerate partially initialized objects by guarding virtqueue and IOTLB cleanup, since the same release path can be reached from other initialization failures.
I found this bug myself, though the patch was written with AI assistance.
Message-ID: <[email protected]>
--- drivers/vdpa/vdpa_sim/vdpa_sim.c | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-)
drivers/vdpa/vdpa_sim/vdpa_sim.c +17 -8
@@ -229,8 +229,11 @@ struct vdpasim *vdpasim_create(struct vdpasim_dev_attr *dev_attr,kthread_init_work (&vdpasim->work, vdpasim_work_fn); vdpasim->worker =kthread_create_worker (0 ,"vDPA sim worker: %s" , dev_attr->name); -if (IS_ERR (vdpasim->worker)) +if (IS_ERR (vdpasim->worker)) { + ret =PTR_ERR (vdpasim->worker); + vdpasim->worker =NULL ; goto err_iommu; + }mutex_init (&vdpasim->mutex);spin_lock_init (&vdpasim->iommu_lock);
@@ -709,18 +712,24 @@ static void vdpasim_free(struct vdpa_device *vdpa)struct vdpasim *vdpasim =vdpa_to_sim (vdpa);int i; -kthread_cancel_work_sync (&vdpasim->work); -kthread_destroy_worker (vdpasim->worker); +if (vdpasim->worker) { +kthread_cancel_work_sync (&vdpasim->work); +kthread_destroy_worker (vdpasim->worker); + } -for (i =0 ; i < vdpasim->dev_attr.nvqs; i++) { -vringh_kiov_cleanup (&vdpasim->vqs[i].out_iov); -vringh_kiov_cleanup (&vdpasim->vqs[i].in_iov); +if (vdpasim->vqs) { +for (i =0 ; i < vdpasim->dev_attr.nvqs; i++) { +vringh_kiov_cleanup (&vdpasim->vqs[i].out_iov); +vringh_kiov_cleanup (&vdpasim->vqs[i].in_iov); + } } vdpasim->dev_attr.free (vdpasim); -for (i =0 ; i < vdpasim->dev_attr.nas; i++) -vhost_iotlb_reset (&vdpasim->iommu[i]); +if (vdpasim->iommu) { +for (i =0 ; i < vdpasim->dev_attr.nas; i++) +vhost_iotlb_reset (&vdpasim->iommu[i]); + }kfree (vdpasim->iommu);kfree (vdpasim->iommu_pt);kfree (vdpasim->vqs);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1309/1424 vdpa/mlx5: fix wrong list iterated in add_direct_chain error path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li RongQing <[email protected]>
[ Upstream commit 23ae56d9e74c122f95cae71ae3b9fc259fb88446 ]
In add_direct_chain(), newly allocated direct MR entries are added to the local list 'tmp', which is spliced into mr->head only on success. On the error path, the cleanup loop was incorrectly iterating over mr->head instead of tmp.
Fix by iterating over 'tmp' in the err_alloc cleanup path.
Message-ID: <[email protected]>
--- drivers/vdpa/mlx5/core/mr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/vdpa/mlx5/core/mr.c +1 -1
@@ -343,7 +343,7 @@ static int add_direct_chain(struct mlx5_vdpa_dev *mvdev, u64 start, u64 size, u8return 0 ; err_alloc: -list_for_each_entry_safe (dmr, n, &mr->head, list) { +list_for_each_entry_safe (dmr, n, &tmp, list) {list_del_init (&dmr->list);unmap_direct_mr (mvdev, dmr);kfree (dmr);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1310/1424 rtc: pcf8563: fix clock provider leak on unbind
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yi Ding <[email protected]>
[ Upstream commit 9c48a53685040bb0de45a640b34055cbbfc69d4f ]
pcf8563_clkout_register_clk() registers the CLKOUT clock provider with of_clk_add_provider(), but nothing ever unwinds it: there is no of_clk_del_provider() call and the driver has no remove callback. Each of_clk_add_provider() allocates a struct of_clk_provider, takes a reference on the OF node and adds an entry to the global of_clk_providers list, none of which is released when the device is unbound. Every bind/unbind (or module reload) therefore leaks a provider structure and an of_node reference.
The clock itself is already device-managed (devm_clk_register()); only the provider registration was not. Use devm_of_clk_add_hw_provider() so the provider is removed automatically on unbind. Tie it to the parent i2c device, whose OF node carries the #clock-cells and clock-output-names properties (the RTC class device has no OF node of its own).
--- drivers/rtc/rtc-pcf8563.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/rtc/rtc-pcf8563.c +3 -1
@@ -494,7 +494,9 @@ static struct clk *pcf8563_clkout_register_clk(struct pcf8563 *pcf8563) clk =devm_clk_register (&client->dev, &pcf8563->clkout_hw);if (!IS_ERR (clk)) -of_clk_add_provider (node, of_clk_src_simple_get, clk); +devm_of_clk_add_hw_provider (pcf8563->rtc->dev.parent, + of_clk_hw_simple_get, + &pcf8563->clkout_hw);return clk; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1311/1424 smb: client: fix request buffer leak in smb2_new_read_req()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christopher Lusk <[email protected]>
[ Upstream commit deb6468f4164640e4dc875f008aa449cf55987a5 ]
smb2_new_read_req() allocates the request buffer with smb2_plain_req_init() but only publishes it to the caller with *buf = req at the very end of the function. Two error returns sit in between:
rc = smb2_plain_req_init(SMB2_READ, io_parms->tcon, server, (void **) &req, total_len); if (rc) return rc; if (server == NULL) return -ECONNABORTED; [...] rdata->mr = smbd_register_mr(server->smbd_conn, &rdata->subreq.io_iter, true, need_invalidate); if (!rdata->mr) return -EAGAIN;
On either of them the buffer is neither released nor handed back, so it is leaked. The caller cannot clean up after it: smb2_async_readv() does 'goto out' on a non-zero return, which skips the cifs_small_buf_release(buf) at async_readv_out, and buf has not been assigned at that point in any case.
The write path has never had this problem. smb2_async_writev() registers the memory region inline and jumps to its release label instead of returning:
wdata->mr = smbd_register_mr(...);
if (!wdata->mr) {
rc = -EAGAIN;
goto async_writev_out;
}Commit b7972092199f ("cifs: smbd: Retry on memory registration failure") changed both sides from -ENOBUFS to -EAGAIN in a single patch, which puts the two shapes next to each other.
Only the -EAGAIN return is reachable in practice, because smb2_plain_req_init() calls smb2_reconnect() first and that already fails with -EIO when server is NULL, before anything is allocated. Both returns are given the same treatment here rather than leaving one of them correct only by accident.
Because -EAGAIN is a replayable error, the failure also reaches the retry block at the end of smb2_async_readv(), which marks the subrequest NETFS_SREQ_NEED_RETRY, so a failing registration can be retried rather than ending the I/O, and every attempt that reaches it leaks another buffer. smb2_should_replay() short-circuits on tcon->retry, so on a hard mount the attempt count is not bounded by the retrans setting.
Only the asynchronous read path is affected. The synchronous SMB2_read() caller passes rdata == NULL and the memory registration block is guarded on rdata.
The memory registration failure path was pointed out by the Sashiko AI reviewer while it was reviewing an unrelated patch to smb2_async_readv().
--- fs/smb/client/smb2pdu.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
fs/smb/client/smb2pdu.c +12 -4
@@ -4452,8 +4452,10 @@ smb2_new_read_req(void **buf, unsigned int *total_len,if (rc)return rc; -if (server ==NULL ) -return -ECONNABORTED ; +if (!server) { + rc = -ECONNABORTED ; + goto free_req; + } shdr = &req->hdr; shdr->Id.SyncId.ProcessId =cpu_to_le32 (io_parms->pid);
@@ -4482,8 +4484,10 @@ smb2_new_read_req(void **buf, unsigned int *total_len, rdata->mr =smbd_register_mr (server->smbd_conn, &rdata->iter, true, need_invalidate); -if (!rdata->mr) -return -EAGAIN ; +if (!rdata->mr) { + rc = -EAGAIN ; + goto free_req; + } req->Channel =SMB2_CHANNEL_RDMA_V1_INVALIDATE ;if (need_invalidate)
@@ -4526,6 +4530,10 @@ smb2_new_read_req(void **buf, unsigned int *total_len, *buf = req;return rc; + +free_req: +cifs_small_buf_release (req); +return rc; } static void
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1312/1424 rtc: zynqmp: Return optional clock lookup errors
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit 5904c4109554582ce8ded6a4dcfede48b21dbe4d ]
devm_clk_get_optional() returns NULL when the optional clock is absent, but returns an ERR_PTR when the clock provider lookup fails. Probe currently keeps the ERR_PTR and then passes it to clk_get_rate().
Return the lookup error instead. A truly absent optional clock still reaches the existing calibration fallback through clk_get_rate(NULL).
--- drivers/rtc/rtc-zynqmp.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/rtc/rtc-zynqmp.c +3 -4
@@ -320,10 +320,9 @@ static int xlnx_rtc_probe(struct platform_device *pdev)/* Getting the rtc info */ xrtcdev->rtc_clk =devm_clk_get_optional (&pdev->dev,"rtc" ); -if (IS_ERR (xrtcdev->rtc_clk)) { -if (PTR_ERR (xrtcdev->rtc_clk) != -EPROBE_DEFER ) -dev_warn (&pdev->dev,"Device clock not found.\n" ); - } +if (IS_ERR (xrtcdev->rtc_clk)) +return dev_err_probe (&pdev->dev,PTR_ERR (xrtcdev->rtc_clk), +"Failed to get rtc clock\n" ); xrtcdev->freq =clk_get_rate (xrtcdev->rtc_clk);if (!xrtcdev->freq) { ret = of_property_read_u32(pdev->dev.of_node, "calibration",
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1313/1424 irqchip/renesas-rzg2l: Fix loss of interrupt
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <[email protected]>
[ Upstream commit 50b10bd0c2d721ad38abd1abe3acdefb6caa0944 ]
rzg2l_clear_irq_int() and rzg2l_clear_tint_int() perform a read-modify-write on the ISCR/TSCR status registers to clear the bit for the interrupt just handled. Since these registers are write-0-to-clear per bit, this is racy:
If another interrupt's status bit gets set between the read and the write, that bit is written back as 0 by the software-constructed value, clearing an interrupt that hasn't been serviced yet and losing it.
This can be reproduced by triggering multiple interrupts at once, e.g.:
gpioset -c gpiochip0 355=0 353=0 328=0 352=0
Fix this by writing back only the bit being cleared, with all other bits set to 1, instead of read-modify-writing the whole register. Since 1-bits are left unchanged by hardware, concurrently-set status bits for other interrupts are preserved.
--- drivers/irqchip/irq-renesas-rzg2l.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/irqchip/irq-renesas-rzg2l.c +2 -2
@@ -100,7 +100,7 @@ static void rzg2l_clear_irq_int(struct rzg2l_irqc_priv *priv, unsigned int hwirq* falling/rising-edge. */ if ((iscr & bit) && (iitsr &IITSR_IITSEL_MASK (hw_irq))) { -writel_relaxed (iscr & ~bit, priv->base +ISCR ); +writel_relaxed (~bit, priv->base +ISCR );/* * Enforce that the posted write is flushed to prevent that the * just handled interrupt is raised again.
@@ -116,7 +116,7 @@ static void rzg2l_clear_tint_int(struct rzg2l_irqc_priv *priv, unsigned int hwir reg =readl_relaxed (priv->base +TSCR );if (reg & bit) { -writel_relaxed (reg & ~bit, priv->base +TSCR ); +writel_relaxed (~bit, priv->base +TSCR );/* * Enforce that the posted write is flushed to prevent that the * just handled interrupt is raised again.
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1314/1424 i2c: ocores: Disable clock on failed resume
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <[email protected]>
[ Upstream commit 43eb13f13385a1e7251978a1977ac61b99edef01 ]
ocores_i2c_resume() enables the controller clock before reinitializing the hardware. If the clock rate changed while the device was suspended, ocores_init() may reject the resulting prescaler. The callback then returns an error with the clock still enabled, while the controller itself remains disabled.
Disable and unprepare the clock when ocores_init() fails so the failed resume path balances the successful clk_prepare_enable() call.
This issue was found by a static analysis checker and confirmed by manual source review.
--- drivers/i2c/busses/i2c-ocores.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-ocores.c +5 -1
@@ -768,7 +768,11 @@ static int ocores_i2c_resume(struct device *dev) rate =clk_get_rate (i2c->clk) /1000 ;if (rate) i2c->ip_clock_khz = rate; -return ocores_init (dev, i2c); + ret =ocores_init (dev, i2c); +if (ret) +clk_disable_unprepare (i2c->clk); + +return ret; } static DEFINE_NOIRQ_DEV_PM_OPS(ocores_i2c_pm,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1315/1424 rtc: gamecube: check return value of devm_rtc_register_device()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linkai Gong <[email protected]>
[ Upstream commit ca45cfa74370644d371b552bef57938c19e3c80c ]
gamecube_rtc_probe() ignored the return value of devm_rtc_register_device() and always returned success. Propagate the error so probe fails when RTC registration fails.
--- drivers/rtc/rtc-gamecube.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/rtc/rtc-gamecube.c +1 -3
@@ -355,9 +355,7 @@ static int gamecube_rtc_probe(struct platform_device *pdev) rtc->range_max =U32_MAX ; rtc->ops = &gamecube_rtc_ops; -devm_rtc_register_device (rtc); - -return 0 ; +return devm_rtc_register_device (rtc); }static const struct of_device_id gamecube_rtc_of_match[] = {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1316/1424 prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bradley Morgan <[email protected]>
[ Upstream commit 5146e0688d86f0654263e4b0e4ff1719b4072f16 ]
prctl_set_auxv() copies the user vector into a stack buffer, forces AT_NULL on the last two entries there, and then copies only len bytes into mm->saved_auxv. Which is fine until the vector is shorter than the buffer, because then the forced terminator sits past the end of the copy and never lands in saved_auxv at all.
The code even says
/* Make sure the last entry is always AT_NULL */
and it does, just not in the part that gets copied.
So mm->saved_auxv keeps the stale tail from exec. Reproducing it is easy:
from a process with CAP_SYS_RESOURCE (just run it as root), call prctl(PR_SET_MM, PR_SET_MM_AUXV, ...) with a vector that has a couple of entries and no AT_NULL inside len (32 bytes on arm64), and then hexdump /proc/self/auxv, or gcore the process and look at the AUXV note with readelf -n. This is arm64, the new vector was just { AT_UID, 0x1111, AT_GID, 0x2222 }:
idx before (from exec) after the prctl
[0] AT_SYSINFO_EHDR 0x7ed1d6e000 AT_UID 0x1111 <- new
[1] AT_MINSIGSTKSZ 0x1270 AT_GID 0x2222 <- new
[2] AT_HWCAP 0x119fff AT_HWCAP 0x119fff <- stale
[3] AT_PAGESZ 0x1000 AT_PAGESZ 0x1000 <- stale
... 16 more entries ... <- stale
[20] AT_NULL 0x0 AT_NULL 0x021 entries before the prctl, still 21 after: the two new ones plus all 19 left over from exec.
Every consumer walks the vector until AT_NULL, so what they get now is a vector that never existed at exec, the head from the prctl glued onto the tail of the old binary. gdb and crash pull the AUXV note out of coredumps to find AT_PHDR, AT_ENTRY, AT_SYSINFO_EHDR and friends, and a mixed vector points them at the wrong layout. /proc/<pid>/auxv and PR_GET_AUXV hand the same mess out to live processes too. Nothing crashes, everything just quietly reads a frankenstein auxv.
And callers that terminate their own vector hide the whole thing, which is likely why nobody noticed since PR_SET_MM_AUXV landed in 2012. Nothing exciting security wise either, I mean it needs CAP_SYS_RESOURCE to begin with.
prctl_set_mm_map() right above already copies the whole buffer for exactly this reason, so just do the same here. user_auxv is zero initialized and only partially filled from userspace, so the rest is zeros and nothing leaks.
--- kernel/sys.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/sys.c +1 -1
@@ -2136,7 +2136,7 @@ static int prctl_set_auxv(struct mm_struct *mm, unsigned long addr,BUILD_BUG_ON (sizeof (user_auxv) !=sizeof (mm->saved_auxv));task_lock (current); -memcpy (mm->saved_auxv, user_auxv, len); +memcpy (mm->saved_auxv, user_auxv,sizeof (user_auxv));task_unlock (current);return 0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1317/1424 clk: ti: Make sure clk_init_data is fully initialized
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit 3ae1674975d48fb6d343d03ff7961abd6904af1a ]
The clk_init_data structure contains several mutually-exclusive members for different methods to specify the possible parents of a clock, prompting drivers to initialize only the members they need. However, not initializing all members may cause subtle issues, which are only exposed when CONFIG_INIT_STACK_ALL_PATTERN or CONFIG_INIT_STACK_NONE is enabled.
_register_mux() fills in init.parent_data, and assumes that init.parent_names is NULL. However, the latter is uninitialized, and thus may cause a crash.
Make sure all members are fully initialized, to fix such bugs, and to avoid future breakage when converting drivers to a different method for specifying the parents.
--- drivers/clk/ti/adpll.c | 4 ++-- drivers/clk/ti/divider.c | 2 +- drivers/clk/ti/mux.c | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-)
drivers/clk/ti/adpll.c +2 -2
@@ -481,7 +481,7 @@ static const struct clk_ops ti_adpll_ops = {static int ti_adpll_init_dco (struct ti_adpll_data *d) { -struct clk_init_data init; +struct clk_init_data init = {};struct clk *clock;const char *postfix;int width, err;
@@ -574,7 +574,7 @@ static int ti_adpll_init_clkout(struct ti_adpll_data *d, struct clk *clk1) {struct ti_adpll_clkout_data *co; -struct clk_init_data init; +struct clk_init_data init = {};struct clk_ops *ops;const char *parent_names[2 ];const char *child_name;
drivers/clk/ti/divider.c +1 -1
@@ -309,7 +309,7 @@ static struct clk *_register_divider(struct device_node *node,u32 flags, struct clk_omap_divider *div) { - struct clk_init_data init; + struct clk_init_data init = {};const char *parent_name;const char *name;
drivers/clk/ti/mux.c +1 -1
@@ -124,9 +124,9 @@ static struct clk *_register_mux(struct device_node *node, const char *name, struct clk_omap_reg *reg, u8 shift, u32 mask, s8 latch, u8 clk_mux_flags, u32 *table) { + struct clk_init_data init = {};struct clk_omap_mux *mux;struct clk *clk; -struct clk_init_data init;/* allocate the mux */ mux =kzalloc (sizeof (*mux),GFP_KERNEL );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1318/1424 clk: visconti: Make sure clk_init_data is fully initialized
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit 39c0e6c844a14945040cca4ccf6997792ab764c4 ]
The clk_init_data structure contains several mutually-exclusive members for different methods to specify the possible parents of a clock, prompting drivers to initialize only the members they need. However, not initializing all members may cause subtle issues, which are only exposed when CONFIG_INIT_STACK_ALL_PATTERN or CONFIG_INIT_STACK_NONE is enabled.
visconti_clk_register_gate() fills in init.parent_data, and assumes that init.parent_names is NULL. However, the latter in uninitialized, and thus may cause a crash.
Make sure all members are fully initialized, to fix such bugs, and to avoid future breakage when converting drivers to a different method for specifying the parents.
--- drivers/clk/visconti/clkc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/visconti/clkc.c +1 -1
@@ -81,9 +81,9 @@ static struct clk_hw *visconti_clk_register_gate(struct device *dev,u8 rs_idx, spinlock_t *lock) { + struct clk_init_data init = {};struct visconti_clk_gate *gate;struct clk_parent_data *pdata; -struct clk_init_data init;struct clk_hw *hw;int ret;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1319/1424 ALSA: control: Use automatic cleanup of kfree()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 1052d988226948493eb9730b3424308972eca5f4 ]
There are common patterns where a temporary buffer is allocated and freed at the exit, and those can be simplified with the recent cleanup mechanism via __free(kfree).
A caveat is that some allocations are memdup_user() and they return an error pointer instead of NULL. Those need special cares and the value has to be cleared with no_free_ptr() at the allocation error path.
Other than that, the conversions are straightforward.
No functional changes, only code refactoring.
Stable-dep-of: d736eba9c453 ("ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup")
--- sound/core/control.c | 23 +++++-------- sound/core/control_compat.c | 69 ++++++++++++++----------------------- 2 files changed, 34 insertions(+), 58 deletions(-)
sound/core/control.c +8 -15
@@ -932,7 +932,7 @@ EXPORT_SYMBOL(snd_ctl_find_id);static int snd_ctl_card_info (struct snd_card *card,struct snd_ctl_file * ctl,unsigned int cmd,void __user *arg) { -struct snd_ctl_card_info *info; + struct snd_ctl_card_info *info __free(kfree) = NULL; info =kzalloc (sizeof (*info),GFP_KERNEL );if (! info)
@@ -946,11 +946,8 @@ static int snd_ctl_card_info(struct snd_card *card, struct snd_ctl_file * ctl,strscpy (info->mixername, card->mixername,sizeof (info->mixername));strscpy (info->components, card->components,sizeof (info->components));up_read (&snd_ioctl_rwsem); -if (copy_to_user (arg, info,sizeof (struct snd_ctl_card_info ))) { -kfree (info); +if (copy_to_user (arg, info,sizeof (struct snd_ctl_card_info )))return -EFAULT ; - } -kfree (info);return 0 ; }
@@ -1339,12 +1336,10 @@ static int snd_ctl_elem_read_user(struct snd_card *card, result =snd_ctl_elem_read (card, control);if (result <0 ) - goto error; +return result;if (copy_to_user (_control, control,sizeof (*control))) - result = -EFAULT ; - error: -kfree (control); +return -EFAULT ;return result; }
@@ -1406,23 +1401,21 @@ static int snd_ctl_elem_write(struct snd_card *card, struct snd_ctl_file *file,static int snd_ctl_elem_write_user (struct snd_ctl_file *file,struct snd_ctl_elem_value __user *_control) { -struct snd_ctl_elem_value *control; + struct snd_ctl_elem_value *control __free(kfree) = NULL;struct snd_card *card;int result; control =memdup_user (_control,sizeof (*control));if (IS_ERR (control)) -return PTR_ERR (control); +return PTR_ERR (no_free_ptr (control)); card = file->card; result =snd_ctl_elem_write (card, file, control);if (result <0 ) - goto error; +return result;if (copy_to_user (_control, control,sizeof (*control))) - result = -EFAULT ; - error: -kfree (control); +return -EFAULT ;return result; }
sound/core/control_compat.c +26 -43
193 lines not on this page · raw message
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1320/1424 ALSA: control: Use guard() for locking
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 471be437be779a028040afc151972e3125b5b23c ]
We can simplify the code gracefully with new guard() macro and co for automatic cleanup of locks.
The lops calls under multiple rwsems are factored out as a simple macro, so that it can be called easily from snd_ctl_dev_register() and snd_ctl_dev_disconnect().
There are a few remaining explicit rwsem and spinlock calls, and those are the places where the lock downgrade happens or where the temporary unlock/relocking happens -- which guard() doens't cover well yet.
Only the code refactoring, and no functional changes.
Stable-dep-of: d736eba9c453 ("ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup")
--- sound/core/control.c | 431 ++++++++++++++---------------------- sound/core/control_compat.c | 18 +- 2 files changed, 176 insertions(+), 273 deletions(-)
sound/core/control.c +171 -260
@@ -44,7 +44,6 @@ static int snd_ctl_remove_locked(struct snd_card *card,static int snd_ctl_open (struct inode *inode,struct file *file) { -unsigned long flags;struct snd_card *card;struct snd_ctl_file *ctl;int i, err;
@@ -80,9 +79,8 @@ static int snd_ctl_open(struct inode *inode, struct file *file) ctl->preferred_subdevice[i] =-1 ; ctl->pid =get_pid (task_pid (current)); file->private_data = ctl; -write_lock_irqsave (&card->ctl_files_rwlock, flags); -list_add_tail (&ctl->list, &card->ctl_files); -write_unlock_irqrestore (&card->ctl_files_rwlock, flags); + scoped_guard(write_lock_irqsave, &card->ctl_files_rwlock) +list_add_tail (&ctl->list, &card->ctl_files);snd_card_unref (card);return 0 ;
@@ -98,21 +96,18 @@ static int snd_ctl_open(struct inode *inode, struct file *file)static void snd_ctl_empty_read_queue (struct snd_ctl_file * ctl) { -unsigned long flags;struct snd_kctl_event *cread; -spin_lock_irqsave (&ctl->read_lock, flags); +guard (spinlock_irqsave)(&ctl->read_lock);while (!list_empty (&ctl->events)) { cread =snd_kctl_event (ctl->events.next);list_del (&cread->list);kfree (cread); } -spin_unlock_irqrestore (&ctl->read_lock, flags); }static int snd_ctl_release (struct inode *inode,struct file *file) { -unsigned long flags;struct snd_card *card;struct snd_ctl_file *ctl;struct snd_kcontrol *control;
@@ -121,15 +116,17 @@ static int snd_ctl_release(struct inode *inode, struct file *file) ctl = file->private_data; file->private_data =NULL ; card = ctl->card; -write_lock_irqsave (&card->ctl_files_rwlock, flags); -list_del (&ctl->list); -write_unlock_irqrestore (&card->ctl_files_rwlock, flags); -down_write (&card->controls_rwsem); -list_for_each_entry (control, &card->controls, list) -for (idx =0 ; idx < control->count; idx++) -if (control->vd[idx].owner == ctl) - control->vd[idx].owner =NULL ; -up_write (&card->controls_rwsem); + + scoped_guard(write_lock_irqsave, &card->ctl_files_rwlock) +list_del (&ctl->list); + + scoped_guard(rwsem_write, &card->controls_rwsem) { +list_for_each_entry (control, &card->controls, list) +for (idx =0 ; idx < control->count; idx++) +if (control->vd[idx].owner == ctl) + control->vd[idx].owner =NULL ; + } +snd_fasync_free (ctl->fasync);snd_ctl_empty_read_queue (ctl);put_pid (ctl->pid);
@@ -152,7 +149,6 @@ static int snd_ctl_release(struct inode *inode, struct file *file)void snd_ctl_notify (struct snd_card *card,unsigned int mask,struct snd_ctl_elem_id *id) { -unsigned long flags;struct snd_ctl_file *ctl;struct snd_kctl_event *ev;
@@ -160,34 +156,34 @@ void snd_ctl_notify(struct snd_card *card, unsigned int mask,return ;if (card->shutdown)return ; -read_lock_irqsave (&card->ctl_files_rwlock, flags); + +guard (read_lock_irqsave)(&card->ctl_files_rwlock);#if IS_ENABLED (CONFIG_SND_MIXER_OSS ) card->mixer_oss_change_count++;#endif list_for_each_entry (ctl, &card->ctl_files, list) {if (!ctl->subscribed)continue ; -spin_lock (&ctl->read_lock); -list_for_each_entry (ev, &ctl->events, list) { -if (ev->id.numid == id->numid) { - ev->mask |= mask; - goto _found; + scoped_guard(spinlock, &ctl->read_lock) { +list_for_each_entry (ev, &ctl->events, list) { +if (ev->id.numid == id->numid) { + ev->mask |= mask; + goto _found; + } } + ev =kzalloc (sizeof (*ev),GFP_ATOMIC ); +if (ev) { + ev->id = *id; + ev->mask = mask; +list_add_tail (&ev->list, &ctl->events); + }else { +dev_err (card->dev,"No memory available to allocate event\n" ); + } +_found: +wake_up (&ctl->change_sleep); } - ev =kzalloc (sizeof (*ev),GFP_ATOMIC ); -if (ev) { - ev->id = *id; - ev->mask = mask; -list_add_tail (&ev->list, &ctl->events); - }else { -dev_err (card->dev,"No memory available to allocate event\n" ); - } - _found: -wake_up (&ctl->change_sleep); -spin_unlock (&ctl->read_lock);snd_kill_fasync (ctl->fasync,SIGIO ,POLL_IN ); } -read_unlock_irqrestore (&card->ctl_files_rwlock, flags); }EXPORT_SYMBOL (snd_ctl_notify);
@@ -210,10 +206,9 @@ void snd_ctl_notify_one(struct snd_card *card, unsigned int mask, id.index += ioff; id.numid += ioff;snd_ctl_notify (card, mask, &id); -down_read (&snd_ctl_layer_rwsem); +guard (rwsem_read)(&snd_ctl_layer_rwsem);for (lops = snd_ctl_layer; lops; lops = lops->next) lops->lnotify (card, mask, kctl, ioff); -up_read (&snd_ctl_layer_rwsem); }EXPORT_SYMBOL (snd_ctl_notify_one);
@@ -520,9 +515,9 @@ static int snd_ctl_add_replace(struct snd_card *card,if (snd_BUG_ON (!card || !kcontrol->info)) goto error; -down_write (&card->controls_rwsem); - err =__snd_ctl_add_replace (card, kcontrol, mode); -up_write (&card->controls_rwsem); +scoped_guard (rwsem_write, &card->controls_rwsem) + err = __snd_ctl_add_replace(card, kcontrol, mode); +if (err <0 ) goto error;return 0 ;
@@ -616,12 +611,8 @@ static inline int snd_ctl_remove_locked(struct snd_card *card,*/ int snd_ctl_remove (struct snd_card *card,struct snd_kcontrol *kcontrol) { -int ret; - -down_write (&card->controls_rwsem); - ret =snd_ctl_remove_locked (card, kcontrol); -up_write (&card->controls_rwsem); -return ret; +guard (rwsem_write)(&card->controls_rwsem); +return snd_ctl_remove_locked (card, kcontrol); }EXPORT_SYMBOL (snd_ctl_remove);
@@ -638,17 +629,12 @@ EXPORT_SYMBOL(snd_ctl_remove);int snd_ctl_remove_id (struct snd_card *card,struct snd_ctl_elem_id *id) {struct snd_kcontrol *kctl; -int ret; -down_write (&card->controls_rwsem); +guard (rwsem_write)(&card->controls_rwsem); kctl =snd_ctl_find_id_locked (card, id); -if (kctl ==NULL ) { -up_write (&card->controls_rwsem); +if (kctl ==NULL )return -ENOENT ; - } - ret =snd_ctl_remove_locked (card, kctl); -up_write (&card->controls_rwsem); -return ret; +return snd_ctl_remove_locked (card, kctl); }EXPORT_SYMBOL (snd_ctl_remove_id);
@@ -667,27 +653,18 @@ static int snd_ctl_remove_user_ctl(struct snd_ctl_file * file, {struct snd_card *card = file->card;struct snd_kcontrol *kctl; -int idx, ret; +int idx; -down_write (&card->controls_rwsem); +guard (rwsem_write)(&card->controls_rwsem); kctl =snd_ctl_find_id_locked (card, id); -if (kctl ==NULL ) { - ret = -ENOENT ; - goto error; - } -if (!(kctl->vd[0 ].access &SNDRV_CTL_ELEM_ACCESS_USER )) { - ret = -EINVAL ; - goto error; - } +if (kctl ==NULL ) +return -ENOENT ; +if (!(kctl->vd[0 ].access &SNDRV_CTL_ELEM_ACCESS_USER )) +return -EINVAL ;for (idx =0 ; idx < kctl->count; idx++) -if (kctl->vd[idx].owner !=NULL && kctl->vd[idx].owner != file) { - ret = -EBUSY ; - goto error; - } - ret =snd_ctl_remove_locked (card, kctl); -error: -up_write (&card->controls_rwsem); -return ret; +if (kctl->vd[idx].owner !=NULL && kctl->vd[idx].owner != file) +return -EBUSY ; +return snd_ctl_remove_locked (card, kctl); }/**
@@ -764,18 +741,15 @@ int snd_ctl_rename_id(struct snd_card *card, struct snd_ctl_elem_id *src_id,struct snd_kcontrol *kctl;int saved_numid; -down_write (&card->controls_rwsem); +guard (rwsem_write)(&card->controls_rwsem); kctl =snd_ctl_find_id_locked (card, src_id); -if (kctl ==NULL ) { -up_write (&card->controls_rwsem); +if (kctl ==NULL )return -ENOENT ; - } saved_numid = kctl->id.numid;remove_hash_entries (card, kctl); kctl->id = *dst_id; kctl->id.numid = saved_numid;add_hash_entries (card, kctl); -up_write (&card->controls_rwsem);return 0 ; }EXPORT_SYMBOL (snd_ctl_rename_id);
@@ -793,7 +767,7 @@ EXPORT_SYMBOL(snd_ctl_rename_id);void snd_ctl_rename (struct snd_card *card,struct snd_kcontrol *kctl,const char *name) { -down_write (&card->controls_rwsem); +guard (rwsem_write)(&card->controls_rwsem);remove_hash_entries (card, kctl);if (strscpy (kctl->id.name, name,sizeof (kctl->id.name)) <0 )
@@ -801,7 +775,6 @@ void snd_ctl_rename(struct snd_card *card, struct snd_kcontrol *kctl, name, kctl->id.name);add_hash_entries (card, kctl); -up_write (&card->controls_rwsem); }EXPORT_SYMBOL (snd_ctl_rename);
@@ -859,12 +832,8 @@ EXPORT_SYMBOL(snd_ctl_find_numid_locked);struct snd_kcontrol *snd_ctl_find_numid (struct snd_card *card,unsigned int numid) { -struct snd_kcontrol *kctl; - -down_read (&card->controls_rwsem); - kctl =snd_ctl_find_numid_locked (card, numid); -up_read (&card->controls_rwsem); -return kctl; +guard (rwsem_read)(&card->controls_rwsem); +return snd_ctl_find_numid_locked (card, numid); }EXPORT_SYMBOL (snd_ctl_find_numid);
@@ -920,12 +889,8 @@ EXPORT_SYMBOL(snd_ctl_find_id_locked);struct snd_kcontrol *snd_ctl_find_id (struct snd_card *card,const struct snd_ctl_elem_id *id) { -struct snd_kcontrol *kctl; - -down_read (&card->controls_rwsem); - kctl =snd_ctl_find_id_locked (card, id); -up_read (&card->controls_rwsem); -return kctl; +guard (rwsem_read)(&card->controls_rwsem); +return snd_ctl_find_id_locked (card, id); }EXPORT_SYMBOL (snd_ctl_find_id);
@@ -937,15 +902,15 @@ static int snd_ctl_card_info(struct snd_card *card, struct snd_ctl_file * ctl, info =kzalloc (sizeof (*info),GFP_KERNEL );if (! info)return -ENOMEM ; -down_read (&snd_ioctl_rwsem); - info->card = card->number; -strscpy (info->id, card->id,sizeof (info->id)); -strscpy (info->driver, card->driver,sizeof (info->driver)); -strscpy (info->name, card->shortname,sizeof (info->name)); -strscpy (info->longname, card->longname,sizeof (info->longname)); -strscpy (info->mixername, card->mixername,sizeof (info->mixername)); -strscpy (info->components, card->components,sizeof (info->components)); -up_read (&snd_ioctl_rwsem); + scoped_guard(rwsem_read, &snd_ioctl_rwsem) { + info->card = card->number; +strscpy (info->id, card->id,sizeof (info->id)); +strscpy (info->driver, card->driver,sizeof (info->driver)); +strscpy (info->name, card->shortname,sizeof (info->name)); +strscpy (info->longname, card->longname,sizeof (info->longname)); +strscpy (info->mixername, card->mixername,sizeof (info->mixername)); +strscpy (info->components, card->components,sizeof (info->components)); + }if (copy_to_user (arg, info,sizeof (struct snd_ctl_card_info )))return -EFAULT ;return 0 ;
@@ -957,37 +922,31 @@ static int snd_ctl_elem_list(struct snd_card *card,struct snd_kcontrol *kctl;struct snd_ctl_elem_id id;unsigned int offset, space, jidx; -int err =0 ; offset = list->offset; space = list->space; -down_read (&card->controls_rwsem); +guard (rwsem_read)(&card->controls_rwsem); list->count = card->controls_count; list->used =0 ; -if (space >0 ) { -list_for_each_entry (kctl, &card->controls, list) { -if (offset >= kctl->count) { - offset -= kctl->count; -continue ; - } -for (jidx = offset; jidx < kctl->count; jidx++) { -snd_ctl_build_ioff (&id, kctl, jidx); -if (copy_to_user (list->pids + list->used, &id, -sizeof (id))) { - err = -EFAULT ; - goto out; - } - list->used++; -if (!--space) - goto out; - } - offset =0 ; +if (!space) +return 0 ; +list_for_each_entry (kctl, &card->controls, list) { +if (offset >= kctl->count) { + offset -= kctl->count; +continue ; + } +for (jidx = offset; jidx < kctl->count; jidx++) { +snd_ctl_build_ioff (&id, kctl, jidx); +if (copy_to_user (list->pids + list->used, &id,sizeof (id))) +return -EFAULT ; + list->used++; +if (!--space) +return 0 ; } + offset =0 ; } - out: -up_read (&card->controls_rwsem); -return err; +return 0 ; } static int snd_ctl_elem_list_user(struct snd_card *card,
@@ -1235,16 +1194,12 @@ static int snd_ctl_elem_info(struct snd_ctl_file *ctl, {struct snd_card *card = ctl->card;struct snd_kcontrol *kctl; -int result; -down_read (&card->controls_rwsem); +guard (rwsem_read)(&card->controls_rwsem); kctl =snd_ctl_find_id_locked (card, &info->id); -if (kctl ==NULL ) - result = -ENOENT ; -else - result =__snd_ctl_elem_info (card, kctl, info, ctl); -up_read (&card->controls_rwsem); -return result; +if (!kctl) +return -ENOENT ; +return __snd_ctl_elem_info (card, kctl, info, ctl); } static int snd_ctl_elem_info_user(struct snd_ctl_file *ctl,
@@ -1276,19 +1231,15 @@ static int snd_ctl_elem_read(struct snd_card *card,const u32 pattern =0xdeadbeef ;int ret; -down_read (&card->controls_rwsem); +guard (rwsem_read)(&card->controls_rwsem); kctl =snd_ctl_find_id_locked (card, &control->id); -if (kctl ==NULL ) { - ret = -ENOENT ; - goto unlock; - } +if (!kctl) +return -ENOENT ; index_offset =snd_ctl_get_ioff (kctl, &control->id); vd = &kctl->vd[index_offset]; -if (!(vd->access &SNDRV_CTL_ELEM_ACCESS_READ ) || kctl->get ==NULL ) { - ret = -EPERM ; - goto unlock; - } +if (!(vd->access &SNDRV_CTL_ELEM_ACCESS_READ ) || !kctl->get) +return -EPERM ;snd_ctl_build_ioff (&control->id, kctl, index_offset);
@@ -1298,7 +1249,7 @@ static int snd_ctl_elem_read(struct snd_card *card, info.id = control->id; ret =__snd_ctl_elem_info (card, kctl, &info,NULL );if (ret <0 ) - goto unlock; +return ret;#endif if (!snd_ctl_skip_validation (&info))
@@ -1308,7 +1259,7 @@ static int snd_ctl_elem_read(struct snd_card *card, ret = kctl->get (kctl, control);snd_power_unref (card);if (ret <0 ) - goto unlock; +return ret;if (!snd_ctl_skip_validation (&info) &&sanity_check_elem_value (card, control, &info, pattern) <0 ) { dev_err(card->dev,
@@ -1316,12 +1267,9 @@ static int snd_ctl_elem_read(struct snd_card *card, control->id.iface, control->id.device, control->id.subdevice, control->id.name, control->id.index); - ret = -EINVAL ; - goto unlock; +return -EINVAL ; } -unlock: -up_read (&card->controls_rwsem); -return ret; +return 0 ; } static int snd_ctl_elem_read_user(struct snd_card *card,
@@ -1426,25 +1374,18 @@ static int snd_ctl_elem_lock(struct snd_ctl_file *file,struct snd_ctl_elem_id id;struct snd_kcontrol *kctl;struct snd_kcontrol_volatile *vd; -int result;if (copy_from_user (&id, _id,sizeof (id)))return -EFAULT ; -down_write (&card->controls_rwsem); +guard (rwsem_write)(&card->controls_rwsem); kctl =snd_ctl_find_id_locked (card, &id); -if (kctl ==NULL ) { - result = -ENOENT ; - }else { - vd = &kctl->vd[snd_ctl_get_ioff (kctl, &id)]; -if (vd->owner !=NULL ) - result = -EBUSY ; -else { - vd->owner = file; - result =0 ; - } - } -up_write (&card->controls_rwsem); -return result; +if (!kctl) +return -ENOENT ; + vd = &kctl->vd[snd_ctl_get_ioff (kctl, &id)]; +if (vd->owner) +return -EBUSY ; + vd->owner = file; +return 0 ; } static int snd_ctl_elem_unlock(struct snd_ctl_file *file,
@@ -1454,27 +1395,20 @@ static int snd_ctl_elem_unlock(struct snd_ctl_file *file,struct snd_ctl_elem_id id;struct snd_kcontrol *kctl;struct snd_kcontrol_volatile *vd; -int result;if (copy_from_user (&id, _id,sizeof (id)))return -EFAULT ; -down_write (&card->controls_rwsem); +guard (rwsem_write)(&card->controls_rwsem); kctl =snd_ctl_find_id_locked (card, &id); -if (kctl ==NULL ) { - result = -ENOENT ; - }else { - vd = &kctl->vd[snd_ctl_get_ioff (kctl, &id)]; -if (vd->owner ==NULL ) - result = -EINVAL ; -else if (vd->owner != file) - result = -EPERM ; -else { - vd->owner =NULL ; - result =0 ; - } - } -up_write (&card->controls_rwsem); -return result; +if (!kctl) +return -ENOENT ; + vd = &kctl->vd[snd_ctl_get_ioff (kctl, &id)]; +if (!vd->owner) +return -EINVAL ; +if (vd->owner != file) +return -EPERM ; + vd->owner =NULL ; +return 0 ; }struct user_element {
@@ -1764,11 +1698,9 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file, private_size = value_sizes[info->type] * info->count; alloc_size =compute_user_elem_size (private_size, count); -down_write (&card->controls_rwsem); -if (check_user_elem_overflow (card, alloc_size)) { - err = -ENOMEM ; - goto unlock; - } +guard (rwsem_write)(&card->controls_rwsem); +if (check_user_elem_overflow (card, alloc_size)) +return -ENOMEM ;/* * Keep memory object for this userspace control. After passing this
@@ -1778,13 +1710,12 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file,*/ err =snd_ctl_new (&kctl, count, access, file);if (err <0 ) - goto unlock; +return err;memcpy (&kctl->id, &info->id,sizeof (kctl->id)); ue =kzalloc (alloc_size,GFP_KERNEL );if (!ue) {kfree (kctl); - err = -ENOMEM ; - goto unlock; +return -ENOMEM ; } kctl->private_data = ue; kctl->private_free = snd_ctl_elem_user_free;
@@ -1802,7 +1733,7 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file, err =snd_ctl_elem_init_enum_names (ue);if (err <0 ) {snd_ctl_free_one (kctl); - goto unlock; +return err; } }
@@ -1822,7 +1753,7 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file, err =__snd_ctl_add_replace (card, kctl,CTL_ADD_EXCLUSIVE );if (err <0 ) {snd_ctl_free_one (kctl); - goto unlock; +return err; } offset =snd_ctl_get_ioff (kctl, &info->id);snd_ctl_build_ioff (&info->id, kctl, offset);
@@ -1833,9 +1764,7 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file,* applications because the field originally means PID of a process * which locks the element. */ - unlock: -up_write (&card->controls_rwsem); -return err; +return 0 ; } static int snd_ctl_elem_add_user(struct snd_ctl_file *file,
@@ -2037,34 +1966,29 @@ static long snd_ctl_ioctl(struct file *file, unsigned int cmd, unsigned long argcase SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS :return snd_ctl_subscribe_events (ctl, ip);case SNDRV_CTL_IOCTL_TLV_READ : -down_read (&ctl->card->controls_rwsem); - err =snd_ctl_tlv_ioctl (ctl, argp,SNDRV_CTL_TLV_OP_READ ); -up_read (&ctl->card->controls_rwsem); +scoped_guard (rwsem_read, &ctl->card->controls_rwsem) + err = snd_ctl_tlv_ioctl(ctl, argp, SNDRV_CTL_TLV_OP_READ);return err;case SNDRV_CTL_IOCTL_TLV_WRITE : -down_write (&ctl->card->controls_rwsem); - err =snd_ctl_tlv_ioctl (ctl, argp,SNDRV_CTL_TLV_OP_WRITE ); -up_write (&ctl->card->controls_rwsem); +scoped_guard (rwsem_write, &ctl->card->controls_rwsem) + err = snd_ctl_tlv_ioctl(ctl, argp, SNDRV_CTL_TLV_OP_WRITE);return err;case SNDRV_CTL_IOCTL_TLV_COMMAND : -down_write (&ctl->card->controls_rwsem); - err =snd_ctl_tlv_ioctl (ctl, argp,SNDRV_CTL_TLV_OP_CMD ); -up_write (&ctl->card->controls_rwsem); +scoped_guard (rwsem_write, &ctl->card->controls_rwsem) + err = snd_ctl_tlv_ioctl(ctl, argp, SNDRV_CTL_TLV_OP_CMD);return err;case SNDRV_CTL_IOCTL_POWER :return -ENOPROTOOPT ;case SNDRV_CTL_IOCTL_POWER_STATE :return put_user (SNDRV_CTL_POWER_D0 , ip) ? -EFAULT :0 ; } -down_read (&snd_ioctl_rwsem); + +guard (rwsem_read)(&snd_ioctl_rwsem);list_for_each_entry (p, &snd_control_ioctls, list) { err = p->fioctl (card, ctl, cmd, arg); -if (err != -ENOIOCTLCMD ) { -up_read (&snd_ioctl_rwsem); +if (err != -ENOIOCTLCMD )return err; - } } -up_read (&snd_ioctl_rwsem);dev_dbg (card->dev,"unknown ioctl = 0x%x\n" , cmd);return -ENOTTY ; }
@@ -2156,9 +2080,8 @@ static int _snd_ctl_register_ioctl(snd_kctl_ioctl_func_t fcn, struct list_head *if (pn ==NULL )return -ENOMEM ; pn->fioctl = fcn; -down_write (&snd_ioctl_rwsem); +guard (rwsem_write)(&snd_ioctl_rwsem);list_add_tail (&pn->list, lists); -up_write (&snd_ioctl_rwsem);return 0 ; }
@@ -2201,16 +2124,14 @@ static int _snd_ctl_unregister_ioctl(snd_kctl_ioctl_func_t fcn,if (snd_BUG_ON (!fcn))return -EINVAL ; -down_write (&snd_ioctl_rwsem); +guard (rwsem_write)(&snd_ioctl_rwsem);list_for_each_entry (p, lists, list) {if (p->fioctl == fcn) {list_del (&p->list); -up_write (&snd_ioctl_rwsem);kfree (p);return 0 ; } } -up_write (&snd_ioctl_rwsem);snd_BUG ();return -EINVAL ; }
@@ -2257,9 +2178,8 @@ int snd_ctl_get_preferred_subdevice(struct snd_card *card, int type) {struct snd_ctl_file *kctl;int subdevice =-1 ; -unsigned long flags; -read_lock_irqsave (&card->ctl_files_rwlock, flags); +guard (read_lock_irqsave)(&card->ctl_files_rwlock);list_for_each_entry (kctl, &card->ctl_files, list) {if (kctl->pid ==task_pid (current)) { subdevice = kctl->preferred_subdevice[type];
@@ -2267,7 +2187,6 @@ int snd_ctl_get_preferred_subdevice(struct snd_card *card, int type)break ; } } -read_unlock_irqrestore (&card->ctl_files_rwlock, flags);return subdevice; }EXPORT_SYMBOL_GPL (snd_ctl_get_preferred_subdevice);
@@ -2297,13 +2216,11 @@ int snd_ctl_request_layer(const char *module_name)if (module_name ==NULL )return 0 ; -down_read (&snd_ctl_layer_rwsem); -for (lops = snd_ctl_layer; lops; lops = lops->next) -if (strcmp (lops->module_name, module_name) ==0 ) -break ; -up_read (&snd_ctl_layer_rwsem); -if (lops) -return 0 ; + scoped_guard(rwsem_read, &snd_ctl_layer_rwsem) { +for (lops = snd_ctl_layer; lops; lops = lops->next) +if (strcmp (lops->module_name, module_name) ==0 ) +return 0 ; + }return request_module (module_name); }EXPORT_SYMBOL_GPL (snd_ctl_request_layer);
@@ -2320,16 +2237,15 @@ void snd_ctl_register_layer(struct snd_ctl_layer_ops *lops)struct snd_card *card;int card_number; -down_write (&snd_ctl_layer_rwsem); - lops->next = snd_ctl_layer; - snd_ctl_layer = lops; -up_write (&snd_ctl_layer_rwsem); + scoped_guard(rwsem_write, &snd_ctl_layer_rwsem) { + lops->next = snd_ctl_layer; + snd_ctl_layer = lops; + }for (card_number =0 ; card_number <SNDRV_CARDS ; card_number++) { card =snd_card_ref (card_number);if (card) { -down_read (&card->controls_rwsem); - lops->lregister (card); -up_read (&card->controls_rwsem); +scoped_guard (rwsem_read, &card->controls_rwsem) + lops->lregister(card);snd_card_unref (card); } }
@@ -2348,7 +2264,7 @@ void snd_ctl_disconnect_layer(struct snd_ctl_layer_ops *lops) {struct snd_ctl_layer_ops *lops2, *prev_lops2; -down_write (&snd_ctl_layer_rwsem); +guard (rwsem_write)(&snd_ctl_layer_rwsem);for (lops2 = snd_ctl_layer, prev_lops2 =NULL ; lops2; lops2 = lops2->next) {if (lops2 == lops) {if (!prev_lops2)
@@ -2359,7 +2275,6 @@ void snd_ctl_disconnect_layer(struct snd_ctl_layer_ops *lops) } prev_lops2 = lops2; } -up_write (&snd_ctl_layer_rwsem); }EXPORT_SYMBOL_GPL (snd_ctl_disconnect_layer);
@@ -2380,25 +2295,29 @@ static const struct file_operations snd_ctl_f_ops = .fasync = snd_ctl_fasync, }; +/* call lops under rwsems; called from snd_ctl_dev_*() below() */ +#define call_snd_ctl_lops (_card, _op) \ + do { \ + struct snd_ctl_layer_ops *lops; \ + guard(rwsem_read)(&(_card)->controls_rwsem); \ + guard(rwsem_read)(&snd_ctl_layer_rwsem); \ + for (lops = snd_ctl_layer; lops; lops = lops->next) \ + lops->_op(_card); \ + } while (0) +/* * registration of the control device */ static int snd_ctl_dev_register (struct snd_device *device) {struct snd_card *card = device->device_data; -struct snd_ctl_layer_ops *lops;int err; err =snd_register_device (SNDRV_DEVICE_TYPE_CONTROL , card,-1 , &snd_ctl_f_ops, card, card->ctl_dev);if (err <0 )return err; -down_read (&card->controls_rwsem); -down_read (&snd_ctl_layer_rwsem); -for (lops = snd_ctl_layer; lops; lops = lops->next) - lops->lregister (card); -up_read (&snd_ctl_layer_rwsem); -up_read (&card->controls_rwsem); +call_snd_ctl_lops (card, lregister);return 0 ; }
@@ -2409,23 +2328,15 @@ static int snd_ctl_dev_disconnect(struct snd_device *device) {struct snd_card *card = device->device_data;struct snd_ctl_file *ctl; -struct snd_ctl_layer_ops *lops; -unsigned long flags; -read_lock_irqsave (&card->ctl_files_rwlock, flags); -list_for_each_entry (ctl, &card->ctl_files, list) { -wake_up (&ctl->change_sleep); -snd_kill_fasync (ctl->fasync,SIGIO ,POLL_ERR ); + scoped_guard(read_lock_irqsave, &card->ctl_files_rwlock) { +list_for_each_entry (ctl, &card->ctl_files, list) { +wake_up (&ctl->change_sleep); +snd_kill_fasync (ctl->fasync,SIGIO ,POLL_ERR ); + } } -read_unlock_irqrestore (&card->ctl_files_rwlock, flags); - -down_read (&card->controls_rwsem); -down_read (&snd_ctl_layer_rwsem); -for (lops = snd_ctl_layer; lops; lops = lops->next) - lops->ldisconnect (card); -up_read (&snd_ctl_layer_rwsem); -up_read (&card->controls_rwsem); +call_snd_ctl_lops (card, ldisconnect);return snd_unregister_device (card->ctl_dev); }
@@ -2437,17 +2348,17 @@ static int snd_ctl_dev_free(struct snd_device *device)struct snd_card *card = device->device_data;struct snd_kcontrol *control; -down_write (&card->controls_rwsem); -while (!list_empty (&card->controls)) { - control =snd_kcontrol (card->controls.next); -__snd_ctl_remove (card, control, false); - } + scoped_guard(rwsem_write, &card->controls_rwsem) { +while (!list_empty (&card->controls)) { + control =snd_kcontrol (card->controls.next); +__snd_ctl_remove (card, control, false); + }#ifdef CONFIG_SND_CTL_FAST_LOOKUP -xa_destroy (&card->ctl_numids); -xa_destroy (&card->ctl_hash); +xa_destroy (&card->ctl_numids); +xa_destroy (&card->ctl_hash);#endif -up_write (&card->controls_rwsem); + }put_device (card->ctl_dev);return 0 ; }
sound/core/control_compat.c +5 -13
@@ -167,23 +167,18 @@ static int get_ctl_type(struct snd_card *card, struct snd_ctl_elem_id *id, struct snd_ctl_elem_info *info __free(kfree) = NULL;int err; -down_read (&card->controls_rwsem); +guard (rwsem_read)(&card->controls_rwsem); kctl =snd_ctl_find_id_locked (card, id); -if (! kctl) { -up_read (&card->controls_rwsem); +if (!kctl)return -ENOENT ; - } info =kzalloc (sizeof (*info),GFP_KERNEL ); -if (info ==NULL ) { -up_read (&card->controls_rwsem); +if (info ==NULL )return -ENOMEM ; - } info->id = *id; err =snd_power_ref_and_wait (card);if (!err) err = kctl->info (kctl, info);snd_power_unref (card); -up_read (&card->controls_rwsem);if (err >=0 ) { err = info->type; *countp = info->count;
@@ -451,16 +446,13 @@ static inline long snd_ctl_ioctl_compat(struct file *file, unsigned int cmd, uns#endif /* CONFIG_X86_X32_ABI */ } -down_read (&snd_ioctl_rwsem); +guard (rwsem_read)(&snd_ioctl_rwsem);list_for_each_entry (p, &snd_control_compat_ioctls, list) {if (p->fioctl) { err = p->fioctl (ctl->card, ctl, cmd, arg); -if (err != -ENOIOCTLCMD ) { -up_read (&snd_ioctl_rwsem); +if (err != -ENOIOCTLCMD )return err; - } } } -up_read (&snd_ioctl_rwsem);return -ENOIOCTLCMD ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1321/1424 ALSA: core: Add scoped cleanup helper for card references
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <[email protected]>
[ Upstream commit c6c6f0aec6fb4cbcc547bb265315fd76f18be731 ]
Several ALSA paths acquire temporary card references with snd_card_ref() and release them manually with snd_card_unref(). control_led.c already defines a local cleanup helper for this pattern, while other core paths still open-code the release.
Move the helper to the common ALSA core header and use it in control-layer card-reference paths. This makes the ownership rule explicit and avoids future missing-unref mistakes when adding early exits.
No functional change is intended.
Stable-dep-of: d736eba9c453 ("ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup")
--- include/sound/core.h | 2 ++ sound/core/control.c | 6 +++--- sound/core/control_led.c | 9 ++++----- 3 files changed, 9 insertions(+), 8 deletions(-)
include/sound/core.h +2 -0
@@ -314,6 +314,8 @@ static inline void snd_card_unref(struct snd_card *card)put_device (&card->card_dev); } +DEFINE_FREE(snd_card_unref, struct snd_card *, if (_T) snd_card_unref(_T)) +#define snd_card_set_dev (card, devptr) ((card)->dev = (devptr))/* device.c */
sound/core/control.c +3 -3
@@ -2234,7 +2234,6 @@ EXPORT_SYMBOL_GPL(snd_ctl_request_layer);*/ void snd_ctl_register_layer (struct snd_ctl_layer_ops *lops) { -struct snd_card *card;int card_number; scoped_guard(rwsem_write, &snd_ctl_layer_rwsem) {
@@ -2242,11 +2241,12 @@ void snd_ctl_register_layer(struct snd_ctl_layer_ops *lops) snd_ctl_layer = lops; }for (card_number =0 ; card_number <SNDRV_CARDS ; card_number++) { - card =snd_card_ref (card_number); + struct snd_card *card __free(snd_card_unref) = +snd_card_ref (card_number); +if (card) {scoped_guard (rwsem_read, &card->controls_rwsem) lops->lregister(card); -snd_card_unref (card); } } }
sound/core/control_led.c +4 -5
@@ -775,18 +775,17 @@ static int __init snd_ctl_led_init(void) static void __exit snd_ctl_led_exit(void) {struct snd_ctl_led *led; -struct snd_card *card;unsigned int group, card_number;snd_ctl_disconnect_layer (&snd_ctl_led_lops);for (card_number =0 ; card_number <SNDRV_CARDS ; card_number++) {if (!snd_ctl_led_card_valid[card_number])continue ; - card =snd_card_ref (card_number); -if (card) { + struct snd_card *card __free(snd_card_unref) = +snd_card_ref (card_number); + +if (card)snd_ctl_led_sysfs_remove (card); -snd_card_unref (card); - } }for (group =0 ; group <MAX_LED ; group++) { led = &snd_ctl_leds[group];
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1322/1424 ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit d736eba9c453fedce664fdf592c8b71ecff1932b ]
snd_ice1712_probe() performs multiple initialization steps after snd_card_new(), but directly returns on failures from later steps without releasing the ALSA card, causing resource leaks when probing fails.
Use snd_devm_card_new() together with scope-based cleanup via __free(snd_card_unref), and clear the card pointer after successful registration to keep it alive.
--- sound/pci/ice1712/ice1712.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
sound/pci/ice1712/ice1712.c +4 -3
@@ -2549,7 +2549,7 @@ static int snd_ice1712_probe(struct pci_dev *pci, const struct pci_device_id *pci_id) {static int dev; -struct snd_card *card; + struct snd_card *card __free(snd_card_unref) = NULL;struct snd_ice1712 *ice;int pcm_dev =0 , err;const struct snd_ice1712_card_info *const *tbl, *c;
@@ -2561,8 +2561,8 @@ static int snd_ice1712_probe(struct pci_dev *pci,return -ENOENT ; } - err =snd_card_new (&pci->dev, index[dev], id[dev],THIS_MODULE , -sizeof (*ice), &card); + err =snd_devm_card_new (&pci->dev, index[dev], id[dev],THIS_MODULE , +sizeof (*ice), &card);if (err <0 )return err; ice = card->private_data;
@@ -2666,6 +2666,7 @@ static int snd_ice1712_probe(struct pci_dev *pci,if (err <0 )return err;pci_set_drvdata (pci, card); + card =NULL ;/* probe succeeded, don't release as error */ dev++;return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1323/1424 RDMA/ucma: Allow path records to exactly fit the output buffer
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Serhat Kumral <[email protected]>
[ Upstream commit 8049741ac93acd3a590dac070e12571fddf0e294 ]
ucma_query_path() emits a path record only when the remaining output buffer is strictly larger than struct ib_path_rec_data. A buffer sized exactly for the response header and N complete records therefore gets only N - 1 records, while resp->num_paths still advertises N. A caller sizing its buffer for a single record gets a header claiming one path and no path data at all.
ucma_query_ib_service() in the same file computes the record count with a plain division and so accepts an exact fit; make ucma_query_path() behave the same way.
Current librdmacm is unaffected because it always sizes the response for six records while the kernel currently reports at most two paths. Other users of the UAPI that provide an exactly sized buffer can observe the truncated response.
--- drivers/infiniband/core/ucma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/core/ucma.c +1 -1
@@ -923,7 +923,7 @@ static ssize_t ucma_query_path(struct ucma_context *ctx, resp->num_paths = ctx->cm_id->route.num_pri_alt_paths;for (i =0 , out_len -=sizeof (*resp); - i < resp->num_paths && out_len >sizeof (struct ib_path_rec_data ); + i < resp->num_paths && out_len >=sizeof (struct ib_path_rec_data ); i++, out_len -=sizeof (struct ib_path_rec_data )) {struct sa_path_rec *rec = &ctx->cm_id->route.path_rec[i];
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1324/1424 xsk: Get rid of xdp_buff_xsk::orig_addr
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej Fijalkowski <[email protected]>
[ Upstream commit bea14124bacbe5c9366381e62635eed28ac892ae ]
Continue the process of dieting xdp_buff_xsk by removing orig_addr member. It can be calculated from xdp->data_hard_start where it was previously used, so it is not anything that has to be carried around in struct used widely in hot path.
This has been used for initializing xdp_buff_xsk::frame_dma during pool setup and as a shortcut in xp_get_handle() to retrieve address provided to xsk Rx queue.
Stable-dep-of: e37b2abca804 ("xsk: fix NULL pointer dereference in __xsk_rcv()")
--- include/net/xsk_buff_pool.h | 19 +++++++++++-------- net/xdp/xsk.c | 2 +- net/xdp/xsk_buff_pool.c | 4 +++- 3 files changed, 15 insertions(+), 10 deletions(-)
include/net/xsk_buff_pool.h +11 -8
@@ -27,7 +27,6 @@ struct xdp_buff_xsk {dma_addr_t dma;dma_addr_t frame_dma;struct xsk_buff_pool *pool; -u64 orig_addr;struct list_head list_node; };
@@ -119,7 +118,6 @@ void xp_free(struct xdp_buff_xsk *xskb);static inline void xp_init_xskb_addr (struct xdp_buff_xsk *xskb,struct xsk_buff_pool *pool,u64 addr) { - xskb->orig_addr = addr; xskb->xdp.data_hard_start = pool->addrs + addr + pool->headroom; }
@@ -224,14 +222,19 @@ static inline void xp_release(struct xdp_buff_xsk *xskb) xskb->pool->free_heads[xskb->pool->free_heads_cnt++] = xskb; } -static inline u64 xp_get_handle (struct xdp_buff_xsk *xskb) +static inline u64 xp_get_handle (struct xdp_buff_xsk *xskb, +struct xsk_buff_pool *pool) { -u64 offset = xskb->xdp.data - xskb->xdp.data_hard_start; +u64 orig_addr = xskb->xdp.data - pool->addrs; +u64 offset; - offset += xskb->pool->headroom; -if (!xskb->pool->unaligned) -return xskb->orig_addr + offset; -return xskb->orig_addr + (offset <<XSK_UNALIGNED_BUF_OFFSET_SHIFT ); +if (!pool->unaligned) +return orig_addr; + + offset = xskb->xdp.data - xskb->xdp.data_hard_start; + orig_addr -= offset; + offset += pool->headroom; +return orig_addr + (offset <<XSK_UNALIGNED_BUF_OFFSET_SHIFT ); }#endif /* XSK_BUFF_POOL_H_ */
net/xdp/xsk.c +1 -1
@@ -142,7 +142,7 @@ static int __xsk_rcv_zc(struct xdp_sock *xs, struct xdp_buff_xsk *xskb, u32 len,u64 addr;int err; - addr =xp_get_handle (xskb); + addr =xp_get_handle (xskb, xskb->pool); err =xskq_prod_reserve_desc (xs->rx, addr, len, flags);if (err) { xs->rx_queue_full++;
net/xdp/xsk_buff_pool.c +3 -1
@@ -424,8 +424,10 @@ static int xp_init_dma_info(struct xsk_buff_pool *pool, struct xsk_dma_map *dma_for (i =0 ; i < pool->heads_cnt; i++) {struct xdp_buff_xsk *xskb = &pool->heads[i]; +u64 orig_addr; -xp_init_xskb_dma (xskb, pool, dma_map->dma_pages, xskb->orig_addr); + orig_addr = xskb->xdp.data_hard_start - pool->addrs - pool->headroom; +xp_init_xskb_dma (xskb, pool, dma_map->dma_pages, orig_addr); } }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1325/1424 xsk: avoid double checking against rx queue being full
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej Fijalkowski <[email protected]>
[ Upstream commit f620af11c27b8ec9994a39fe968aa778112d1566 ]
Currently non-zc xsk rx path for multi-buffer case checks twice if xsk rx queue has enough space for producing descriptors:
1.
if (xskq_prod_nb_free(xs->rx, num_desc) < num_desc) {
xs->rx_queue_full++;
return -ENOBUFS;
}
2.
__xsk_rcv_zc(xs, xskb, copied - meta_len, rem ? XDP_PKT_CONTD : 0);
-> err = xskq_prod_reserve_desc(xs->rx, addr, len, flags);
-> if (xskq_prod_is_full(q))Second part is redundant as in 1. we already peeked onto rx queue and checked that there is enough space to produce given amount of descriptors.
Provide helper functions that will skip it and therefore optimize code.
Stable-dep-of: e37b2abca804 ("xsk: fix NULL pointer dereference in __xsk_rcv()")
--- net/xdp/xsk.c | 14 +++++++++++++- net/xdp/xsk_queue.h | 16 +++++++++++----- 2 files changed, 24 insertions(+), 6 deletions(-)
net/xdp/xsk.c +13 -1
@@ -153,6 +153,17 @@ static int __xsk_rcv_zc(struct xdp_sock *xs, struct xdp_buff_xsk *xskb, u32 len,return 0 ; } +static void __xsk_rcv_zc_safe (struct xdp_sock *xs,struct xdp_buff_xsk *xskb, +u32 len,u32 flags) +{ +u64 addr; + + addr =xp_get_handle (xskb, xskb->pool); +__xskq_prod_reserve_desc (xs->rx, addr, len, flags); + +xp_release (xskb); +} +static int xsk_rcv_zc (struct xdp_sock *xs,struct xdp_buff *xdp,u32 len) { struct xdp_buff_xsk *xskb = container_of(xdp, struct xdp_buff_xsk, xdp);
@@ -291,7 +302,8 @@ static int __xsk_rcv(struct xdp_sock *xs, struct xdp_buff *xdp, u32 len) rem -= copied; xskb = container_of(xsk_xdp, struct xdp_buff_xsk, xdp); -__xsk_rcv_zc (xs, xskb, copied - meta_len, rem ?XDP_PKT_CONTD :0 ); +__xsk_rcv_zc_safe (xs, xskb, copied - meta_len, + rem ?XDP_PKT_CONTD :0 ); meta_len =0 ; }while (rem);
net/xdp/xsk_queue.h +11 -5
@@ -405,20 +405,26 @@ static inline void xskq_prod_write_addr_batch(struct xsk_queue *q, struct xdp_de q->cached_prod = cached_prod; } -static inline int xskq_prod_reserve_desc (struct xsk_queue *q, -u64 addr,u32 len,u32 flags) +static inline void __xskq_prod_reserve_desc (struct xsk_queue *q, +u64 addr,u32 len,u32 flags) {struct xdp_rxtx_ring *ring = (struct xdp_rxtx_ring *)q->ring;u32 idx; -if (xskq_prod_is_full (q)) -return -ENOBUFS ; -/* A, matches D */ idx = q->cached_prod++ & q->ring_mask; ring->desc[idx].addr = addr; ring->desc[idx].len = len; ring->desc[idx].options = flags; +} + +static inline int xskq_prod_reserve_desc (struct xsk_queue *q, +u64 addr,u32 len,u32 flags) +{ +if (xskq_prod_is_full (q)) +return -ENOBUFS ; + +__xskq_prod_reserve_desc (q, addr, len, flags);return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1326/1424 xsk: fix NULL pointer dereference in __xsk_rcv()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang (Microsoft) <[email protected]>
[ Upstream commit e37b2abca80473e106176e41712a369fd2f72117 ]
In the __xsk_rcv() multi-buffer path, xsk_buff_alloc() is called in a loop without checking its return value. xsk_buff_can_alloc() only counts fill queue entries without validating their addresses, so it can succeed while xsk_buff_alloc() rejects all remaining entries and returns NULL.
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000 KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:__xsk_rcv+0x426/0xc20 (net/xdp/xsk.c:350) Call Trace: xsk_generic_rcv+0x26d/0x5f0 xdp_do_generic_redirect+0x3c5/0xcf0 do_xdp_generic+0x92f/0xe70 __netif_receive_skb_core.constprop.0+0xf7e/0x2b30
Fix this with a two-stage transaction. First allocate and stage all buffers required for the packet, recycling all staged buffers with xsk_buff_free() if any allocation fails. Only after this stage succeeds, copy the data, reserve the RX descriptors, and release the buffers in an error-free loop.
--- net/xdp/xsk.c | 30 +++++++++++++++++++++++++++--- 1 file changed, 27 insertions(+), 3 deletions(-)
net/xdp/xsk.c +27 -3
@@ -246,9 +246,11 @@ static int __xsk_rcv(struct xdp_sock *xs, struct xdp_buff *xdp, u32 len)u32 frame_size =__xsk_pool_get_rx_frame_size (xs->pool);void *copy_from =xsk_copy_xdp_start (xdp), *copy_to;u32 from_len, meta_len, rem, num_desc; -struct xdp_buff_xsk *xskb; +struct xdp_buff_xsk *xskb, *tmp;struct xdp_buff *xsk_xdp; +LIST_HEAD (xsk_buffs);skb_frag_t *frag; +u32 i; from_len = xdp->data_end - copy_from; meta_len = xdp->data - copy_from;
@@ -291,23 +293,45 @@ static int __xsk_rcv(struct xdp_sock *xs, struct xdp_buff *xdp, u32 len) frag = &sinfo->frags[0 ]; } +for (i =0 ; i < num_desc; i++) { + xsk_xdp =xsk_buff_alloc (xs->pool); +if (!xsk_xdp) + goto err_alloc; + + xskb = container_of(xsk_xdp, struct xdp_buff_xsk, xdp); +if (unlikely (!list_empty (&xskb->list_node))) + goto err_alloc; + +list_add_tail (&xskb->list_node, &xsk_buffs); + } +do {u32 to_len = frame_size + meta_len;u32 copied; - xsk_xdp =xsk_buff_alloc (xs->pool); + xskb = list_first_entry(&xsk_buffs, struct xdp_buff_xsk, + list_node); +list_del_init (&xskb->list_node); + xsk_xdp = &xskb->xdp; copy_to = xsk_xdp->data - meta_len; copied =xsk_copy_xdp (copy_to, ©_from, to_len, &from_len, &frag, rem); rem -= copied; - xskb = container_of(xsk_xdp, struct xdp_buff_xsk, xdp);__xsk_rcv_zc_safe (xs, xskb, copied - meta_len, rem ?XDP_PKT_CONTD :0 ); meta_len =0 ; }while (rem);return 0 ; + +err_alloc: +list_for_each_entry_safe (xskb, tmp, &xsk_buffs, list_node) { +list_del_init (&xskb->list_node); +xsk_buff_free (&xskb->xdp); + } + xs->rx_dropped++; +return -ENOMEM ; }static bool xsk_tx_writeable (struct xdp_sock *xs)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1327/1424 net: bridge: Reject descending VLAN tunnel ranges
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <[email protected]>
[ Upstream commit b74a072d8fb71d3c9ffba4a17d5943e63266fb38 ]
A pair of descending VLAN and tunnel IDs can pass the tunnel range span check. The VLAN subtraction produces a negative int, which is converted to unsigned when compared with the u32 tunnel ID subtraction. It can therefore equal the wrapped tunnel ID delta.
The range loop then performs no iterations. Since the batched notification handling added a post-loop error check, this leaves err uninitialized and makes the request's return value unpredictable.
Reject descending VLAN ranges before comparing the spans. Valid ascending and single-entry ranges remain unchanged, while malformed descending ranges consistently return -EINVAL.
This issue was found by a static analysis checker and confirmed by manual source review.
--- net/bridge/br_netlink_tunnel.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/bridge/br_netlink_tunnel.c +2 -1
@@ -302,7 +302,8 @@ int br_process_vlan_tunnel_info(const struct net_bridge *br,if (!(tinfo_last->flags &BRIDGE_VLAN_INFO_RANGE_BEGIN ))return -EINVAL ; -if ((tinfo_curr->vid - tinfo_last->vid) != +if (tinfo_curr->vid < tinfo_last->vid || + (tinfo_curr->vid - tinfo_last->vid) != (tinfo_curr->tunid - tinfo_last->tunid))return -EINVAL ; t = tinfo_last->tunid;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1328/1424 net: thunderbolt: Count delivered packets in rx_packets and rx_bytes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Ye <[email protected]>
[ Upstream commit c5ae83ee02c04487b1be1d143b791ec2caca888e ]
tbnet_poll() increments rx_packets once per received frame because that is the NAPI work unit, and then adds the same number to stats.rx_packets. An skb is handed to the stack only when the last frame of a packet arrives, so once the MTU exceeds TBNET_MAX_PAYLOAD_SIZE the statistic reports frames. tx_packets is bumped once per skb, so the two ends of a link
disagree: at MTU 65330 the receiver reports 16 times the packets its sender sent.
rx_bytes has the matching problem: frames of a packet that is later dropped mid-assembly are already accounted, so it does not correspond to rx_packets as documented. Account for both where the packet is completed, and leave the NAPI work counter alone.
--- drivers/net/thunderbolt/main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/thunderbolt/main.c +3 -3
@@ -907,9 +907,11 @@ static int tbnet_poll(struct napi_struct *napi, int budget)le32_to_cpu (net->rx_hdr.frame_count) -1 ; rx_packets++; - net->stats.rx_bytes += frame_size;if (last) { +/* Before eth_type_trans() pulls the Ethernet header. */ + net->stats.rx_packets++; + net->stats.rx_bytes += skb->len; skb->protocol =eth_type_trans (skb, net->dev);trace_tbnet_rx_skb (skb);napi_gro_receive (&net->napi, skb);
@@ -917,8 +919,6 @@ static int tbnet_poll(struct napi_struct *napi, int budget) } } - net->stats.rx_packets += rx_packets; -if (cleaned_count)tbnet_alloc_rx_buffers (net, cleaned_count);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1329/1424 forcedeth: stop the tx_timeout register dump past the requested window
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Czernohous <[email protected]>
[ Upstream commit cfa9178ce2e5b4f2e2a9e8b577a6cff841665aa0 ]
nv_tx_timeout() dumps the register window in rows of eight dwords:
for (i = 0; i <= np->register_size; i += 32) {
netdev_info(dev, "%3x: %08x ... %08x\n", i,
readl(base + i + 0), ..., readl(base + i + 28));The loop bound only checks the row's starting offset, so the final row reads a full 32 bytes from a position that is below the end of the window but too close to it. base is mapped with exactly that length:
np->base = ioremap(addr, np->register_size);
so the tail of that row is read from beyond the length the driver asked for. Per variant, the last iteration reads past register_size by:
NV_PCI_REGSZ_VER1 (0x270): row 0x260 reads to 0x27f, 16 bytes over NV_PCI_REGSZ_VER2 (0x2d4): row 0x2c0 reads to 0x2df, 12 bytes over NV_PCI_REGSZ_VER3 (0x604): row 0x600 reads to 0x61f, 28 bytes over
This happens on every supported device, not just one of them. Note that it is not a consequence of the sizes being odd: with i <= register_size the offending row is reached whatever the size, and a size that were a multiple of 32 would overrun by a full row rather than by a remainder.
To be precise about the severity: the reads stay inside the BAR. Memory BAR sizes are powers of two, the driver only accepts a region with pci_resource_len() >= register_size (forcedeth.c:5757-5762), and the next power of two at or above each register_size already covers the offending row: 0x400 for 0x270 and 0x2d4, 0x800 for 0x604. ioremap() also rounds the mapped length up to page granularity, so the reads land inside the mapping the CPU has as well. What they leave is the window the driver asked for, not the BAR and not the mapping. That is still a driver reading registers it did not ask for, and it is trivial to avoid, but nobody should expect a fault from it.
Changing <= to < is not enough: register_size is a length and every size above is larger than its last row start, so i still reaches the offending row. Check that the whole row fits instead.
The trade-off is that a partial trailing row is no longer dumped: 16 bytes for VER1, 20 for VER2, 4 for VER3. That seemed preferable to reading outside the requested window, and to open-coding a second, narrower dump for the remainder in what is a debug-only path. Extending the dump to cover the tail can be done on top if anyone misses those registers.
Only reachable with the debug_tx_timeout module parameter, which defaults to false. It has not been observed at runtime: forcing a genuine TX timeout on the reference machine is not something I can do safely, so this rests on the arithmetic above and on a build test, not on a reproduction. UBSAN does not catch it either, since these are MMIO reads rather than an array access. It was found by reading the function while fixing the saved_config_space off-by-one in nv_suspend() and nv_resume().
The dump was introduced with a fixed 0x400 bound while ioremap() mapped only NV_PCI_REGSZ (0x270), so it read about 0x190 bytes too far from the start. Commit 86a0f04387bf ("[PATCH] forcedeth: fix initialization") later replaced 0x400 with np->register_size, which shrank the overrun to the remainder but did not remove it.
--- drivers/net/ethernet/nvidia/forcedeth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/nvidia/forcedeth.c +1 -1
@@ -2754,7 +2754,7 @@ static void nv_tx_timeout(struct net_device *dev, unsigned int txqueue)netdev_info (dev,"Ring at %lx\n" , (unsigned long )np->ring_addr);netdev_info (dev,"Dumping tx registers\n" ); -for (i =0 ; i <= np->register_size; i +=32 ) { +for (i =0 ; i +32 <= np->register_size; i +=32 ) { netdev_info(dev, "%3x: %08x %08x %08x %08x " "%08x %08x %08x %08x\n",
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1330/1424 net: ipa: Convert to platform remove callback returning void
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit a92dbb9cdf0465d56c7e0fc5d674e6834f7c6a79 ]
The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks.
To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove().
Trivially convert this driver from always returning zero in the remove callback to the void returning variant.
Stable-dep-of: 6b9eaa61ff2d ("net: ipa: balance runtime PM reference on remove error")
--- drivers/net/ipa/ipa_main.c | 29 +++++++++++++---------------- 1 file changed, 13 insertions(+), 16 deletions(-)
drivers/net/ipa/ipa_main.c +13 -16
@@ -936,7 +936,7 @@ static int ipa_probe(struct platform_device *pdev)return ret; } -static int ipa_remove (struct platform_device *pdev) +static void ipa_remove (struct platform_device *pdev) {struct ipa *ipa =dev_get_drvdata (&pdev->dev);struct ipa_power *power = ipa->power;
@@ -959,8 +959,16 @@ static int ipa_remove(struct platform_device *pdev)usleep_range (USEC_PER_MSEC ,2 *USEC_PER_MSEC ); ret =ipa_modem_stop (ipa); } -if (ret) -return ret; +if (ret) { +/* +* Not cleaning up here properly might also yield a +* crash later on. As the device is still unregistered +* in this case, this might even yield a crash later on. +*/ +dev_err (dev,"Failed to stop modem (%pe), leaking resources\n" , +ERR_PTR (ret)); +return ; + }ipa_teardown (ipa); }
@@ -978,17 +986,6 @@ static int ipa_remove(struct platform_device *pdev)ipa_power_exit (power);dev_info (dev,"IPA driver removed" ); - -return 0 ; -} - -static void ipa_shutdown (struct platform_device *pdev) -{ -int ret; - - ret =ipa_remove (pdev); -if (ret) -dev_err (&pdev->dev,"shutdown: remove returned %d\n" , ret); }static const struct attribute_group *ipa_attribute_groups[] = {
@@ -1001,8 +998,8 @@ static const struct attribute_group *ipa_attribute_groups[] = {static struct platform_driver ipa_driver = { .probe = ipa_probe, - .remove = ipa_remove, - .shutdown = ipa_shutdown, + .remove_new = ipa_remove, + .shutdown = ipa_remove, .driver = { .name ="ipa" , .pm = &ipa_pm_ops,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1331/1424 net: ipa: balance runtime PM reference on remove error
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <[email protected]>
[ Upstream commit 6b9eaa61ff2df63c6eb35d5cd025e2cef0861d76 ]
ipa_remove() takes a runtime PM reference before accessing IPA hardware during teardown. If a concurrent modem start or stop keeps ipa_modem_stop() busy across both attempts, the callback intentionally returns without releasing the remaining resources because proceeding with teardown could crash. That return also skips the matching pm_runtime_put_noidle(), leaving the callback's usage-count reference held.
Drop only this runtime PM reference before returning. pm_runtime_put_noidle() does not request an idle transition, so the hardware and resources retained on this exceptional path remain untouched while the usage count stays balanced.
This issue was found by a static analysis checker and confirmed by manual source review.
--- drivers/net/ipa/ipa_main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/ipa/ipa_main.c +3 -3
@@ -961,12 +961,12 @@ static void ipa_remove(struct platform_device *pdev) }if (ret) {/* -* Not cleaning up here properly might also yield a -* crash later on. As the device is still unregistered -* in this case, this might even yield a crash later on. +* Continuing teardown after failing to stop the modem +* could crash, so leave the remaining resources allocated. */ dev_err (dev,"Failed to stop modem (%pe), leaking resources\n" ,ERR_PTR (ret)); +pm_runtime_put_noidle (dev);return ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1332/1424 net: add missing ref_tracker_dir_exit() to net_passive_dec()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
[ Upstream commit f85dc137aabf357bf3d9fe4c9712121039d83798 ]
I found that trying to read /sys/kernel/debug/ref_tracker/* causes NULL pointer dereference crash when alloc_netdev_mqs() via unshare() returned NULL, for commit 9ba74e6c9e9d ("net: add networking namespace refcount tracker") added ref_tracker_dir_exit(&net->refcnt_tracker) to only __put_net() path whereas commit 65b584f53611 ("ref_tracker: automatically register a file in debugfs for a ref_tracker_dir") added ref_tracker_dir_debugfs() to ref_tracker_dir_init() path.
Since preinit_net() calls ref_tracker_dir_init(&net->refcnt_tracker) and ref_tracker_dir_init(&net->notrefcnt_tracker), we need to make sure that both ref_tracker_dir_exit(&net->refcnt_tracker) and ref_tracker_dir_exit(&net->notrefcnt_tracker) are called before net_passive_dec() schedules for kmem_cache_free() via net_complete_free().
ref_tracker_dir_exit(&net->refcnt_tracker) is called via put_net() when ns_ref_put() returned true. But put_net() is not called when copy_net_ns() fails. Therefore, call ref_tracker_dir_exit() from net_passive_dec() if put_net() is not yet called.
--- net/core/net_namespace.c | 4 ++++ 1 file changed, 4 insertions(+)
net/core/net_namespace.c +4 -0
@@ -472,8 +472,12 @@ void net_passive_dec(struct net *net)if (refcount_dec_and_test (&net->passive)) {kfree (rcu_access_pointer (net->gen)); +#ifdef CONFIG_REF_TRACKER /* There should not be any trackers left there. */ ref_tracker_dir_exit (&net->notrefcnt_tracker); +if (!net->refcnt_tracker.dead) +ref_tracker_dir_exit (&net->refcnt_tracker); +#endif /* Wait for an extra rcu_barrier() before final free. */ llist_add (&net->defer_free_list, &defer_free_list);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1333/1424 inetpeer: randomize RB-tree node comparison using SipHash
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 2ee66e9487172fcd189bc52a767c30dad7141c09 ]
The inetpeer rate limiting system stores peer entries in a Red-Black tree keyed deterministically on the remote IP address. Because tree lookups walk the RB-tree using standard lexicographical comparisons (inetpeer_addr_cmp), an off-path adversary can predict the exact topology of the tree and the sequence of nodes traversed during lookups (the gc_stack candidate list).
By combining deterministic tree traversal with aggressive garbage collection (triggered when tree size exceeds inet_peer_threshold), an attacker can selectively force the eviction of targeted inet_peer nodes. When an evicted node is subsequently re-created upon receiving a new packet, its rate-limiting token bucket (rate_tokens, rate_last) is reset to full capacity. This creates a side-channel primitive allowing off-path attackers to bypass IP-keyed ICMP rate limits and infer open UDP ports (similar to SAD DNS style attacks).
Mitigate this by randomizing the RB-tree node comparison logic using SipHash with a secret key (inetpeer_hash_key) initialized via net_get_random_once(). Nodes are ordered in the tree by SipHash(addr, key) rather than raw IP addresses. Because the secret key is unknown to external entities, the tree layout and lookup traversal paths are unpredictable to off-path adversaries, breaking the deterministic eviction gadget.
Cache the computed 64-bit SipHash (hash) in struct inet_peer and compute the target hash (dhash) once at the beginning of inet_getpeer() to avoid recomputing SipHash at every step of the RB-tree walk.
--- include/net/inetpeer.h | 4 ++++ net/ipv4/inetpeer.c | 38 +++++++++++++++++++++++++++++++++++--- 2 files changed, 39 insertions(+), 3 deletions(-)
include/net/inetpeer.h +4 -0
@@ -35,6 +35,7 @@ struct inetpeer_addr {struct inet_peer {struct rb_node rb_node; +u64 hash;struct inetpeer_addr daddr;u32 metrics[RTAX_MAX ];
@@ -125,6 +126,9 @@ static inline int inetpeer_addr_cmp(const struct inetpeer_addr *a, {int i, n; +if (a->family != b->family) +return a->family < b->family ?-1 :1 ; +if (a->family ==AF_INET ) n =sizeof (a->a4) /sizeof (u32);else
net/ipv4/inetpeer.c +35 -3
@@ -22,6 +22,7 @@#include <net/ip.h> #include <net/inetpeer.h> #include <net/secure_seq.h> +#include <linux/siphash.h> /* * Theory of operations.
@@ -53,6 +54,34 @@*/ static struct kmem_cache *peer_cachep__ro_after_init ; +static siphash_aligned_key_t inetpeer_hash_key__read_mostly ; + +static u64 inetpeer_addr_hash (const struct inetpeer_addr *a) +{ +net_get_random_once (&inetpeer_hash_key,sizeof (inetpeer_hash_key)); + +if (a->family ==AF_INET ) +return siphash_2u32 ((__force u32 )a->a4.addr, a->a4.vif, + &inetpeer_hash_key); + +return siphash_4u32 ((__force u32 )a->a6.s6_addr32[0 ], + (__force u32 )a->a6.s6_addr32[1 ], + (__force u32 )a->a6.s6_addr32[2 ], + (__force u32 )a->a6.s6_addr32[3 ], + &inetpeer_hash_key); +} + +static int inetpeer_entry_cmp (u64 dhash, +const struct inetpeer_addr *daddr, +const struct inet_peer *p) +{ +if (dhash < p->hash) +return -1 ; +if (dhash > p->hash) +return 1 ; + +return inetpeer_addr_cmp (daddr, &p->daddr); +}void inet_peer_base_init (struct inet_peer_base *bp) {
@@ -89,6 +118,7 @@ void __init inet_initpeers(void)/* Called with rcu_read_lock() or base->lock held */ static struct inet_peer *lookup(const struct inetpeer_addr *daddr, + u64 dhash, struct inet_peer_base *base, unsigned int seq, struct inet_peer *gc_stack[],
@@ -110,7 +140,7 @@ static struct inet_peer *lookup(const struct inetpeer_addr *daddr,break ; parent = next; p = rb_entry(parent, struct inet_peer, rb_node); - cmp =inetpeer_addr_cmp (daddr, &p->daddr); + cmp =inetpeer_entry_cmp (dhash, daddr, p);if (cmp ==0 ) { now = jiffies;if (READ_ONCE (p->dtime) != now)
@@ -180,6 +210,7 @@ struct inet_peer *inet_getpeer(struct inet_peer_base *base, const struct inetpeer_addr *daddr) {struct inet_peer *p, *gc_stack[PEER_MAX_GC ]; +u64 dhash =inetpeer_addr_hash (daddr);struct rb_node **pp, *parent;unsigned int gc_cnt, seq;
@@ -187,7 +218,7 @@ struct inet_peer *inet_getpeer(struct inet_peer_base *base,* Because of a concurrent writer, we might not find an existing entry. */ seq =read_seqbegin (&base->lock); - p =lookup (daddr, base, seq,NULL , &gc_cnt, &parent, &pp); + p =lookup (daddr, dhash, base, seq,NULL , &gc_cnt, &parent, &pp);if (p)return p;
@@ -199,11 +230,12 @@ struct inet_peer *inet_getpeer(struct inet_peer_base *base,write_seqlock_bh (&base->lock); gc_cnt =0 ; - p =lookup (daddr, base, seq, gc_stack, &gc_cnt, &parent, &pp); + p =lookup (daddr, dhash, base, seq, gc_stack, &gc_cnt, &parent, &pp);if (!p) { p =kmem_cache_alloc (peer_cachep,GFP_ATOMIC );if (p) { p->daddr = *daddr; + p->hash = dhash; p->dtime = (__u32 )jiffies;refcount_set (&p->refcnt,1 );atomic_set (&p->rid,0 );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1334/1424 net/smc: free stashed qentry before overwrite in REQ_ADD_LINK to ADD_LINK transition
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mahanta Jambigi <[email protected]>
[ Upstream commit 036322025d6e440cb75fc6fecbba9a16b271a2ae ]
When smc_llc_event_handler() transitions the local LLC flow from SMC_LLC_FLOW_REQ_ADD_LINK to SMC_LLC_FLOW_ADD_LINK on arrival of an ADD_LINK request, it calls smc_llc_flow_qentry_set() unconditionally:
if (lgr->llc_flow_lcl.type == SMC_LLC_FLOW_REQ_ADD_LINK) {
lgr->llc_flow_lcl.type = SMC_LLC_FLOW_ADD_LINK;
smc_llc_flow_qentry_set(&lgr->llc_flow_lcl, qentry);
...
}A CONFIRM_LINK or ADD_LINK_CONT arriving while flow->type is SMC_LLC_FLOW_REQ_ADD_LINK is stashed into flow->qentry via the SMC_LLC_CONFIRM_LINK / SMC_LLC_ADD_LINK_CONT handler (which stores into flow->qentry for any non-NONE flow type). When the subsequent ADD_LINK arrives, the REQ_ADD_LINK branch overwrites flow->qentry with the new pointer without first freeing the stashed allocation, leaking one kmalloc object.
The stashed entry has no consumer: smc_llc_wait() is only called from llc_add_link_work, which is not yet scheduled while the flow type remains REQ_ADD_LINK. No waiter is sleeping on llc_msg_waiter at this point. It is safe to unconditionally free any stashed qentry before the overwrite.
Call smc_llc_flow_qentry_del() before smc_llc_flow_qentry_set() in the REQ_ADD_LINK branch. smc_llc_flow_qentry_del() already checks flow->qentry before freeing, so the normal path where no entry is stashed is a no-op.
--- net/smc/smc_llc.c | 2 ++ 1 file changed, 2 insertions(+)
net/smc/smc_llc.c +2 -0
@@ -1902,6 +1902,8 @@ static void smc_llc_event_handler(struct smc_llc_qentry *qentry)if (lgr->llc_flow_lcl.type ==SMC_LLC_FLOW_REQ_ADD_LINK ) {/* server started add_link processing */ +/* free any qentry stashed in REQ_ADD_LINK state */ +smc_llc_flow_qentry_del (&lgr->llc_flow_lcl); lgr->llc_flow_lcl.type =SMC_LLC_FLOW_ADD_LINK ;smc_llc_flow_qentry_set (&lgr->llc_flow_lcl, qentry);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1335/1424 net/smc: free pending qentry in smc_llc_flow_stop() before memset
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mahanta Jambigi <[email protected]>
[ Upstream commit 5ee0ceddc7785c6dcf4a8107fef01f0414a354f4 ]
smc_llc_flow_stop() resets a flow struct with a blind memset:
spin_lock_bh(&lgr->llc_flow_lock); memset(flow, 0, sizeof(*flow)); flow->type = SMC_LLC_FLOW_NONE; spin_unlock_bh(&lgr->llc_flow_lock);
If flow->qentry is non-NULL at this point the pointer is overwritten without the allocation being freed, leaking one kmalloc object.
A late-arriving duplicate CONFIRM_LINK or ADD_LINK_CONT message can set flow->qentry after the legitimate message has been consumed by the waiter via smc_llc_flow_qentry_clr() (which NULLs the pointer but leaves flow->type non-zero) but before the flow completes and smc_llc_flow_stop() runs. In that window the duplicate is stashed into flow->qentry, and then lost when smc_llc_flow_stop() zeros the struct.
Call smc_llc_flow_qentry_del() inside the lock before the memset. smc_llc_flow_qentry_del() already checks flow->qentry before freeing, so the normal case where no entry is pending is a no-op.
--- net/smc/smc_llc.c | 1 + 1 file changed, 1 insertion(+)
net/smc/smc_llc.c +1 -0
@@ -320,6 +320,7 @@ int smc_llc_flow_initiate(struct smc_link_group *lgr,void smc_llc_flow_stop (struct smc_link_group *lgr,struct smc_llc_flow *flow) {spin_lock_bh (&lgr->llc_flow_lock); +smc_llc_flow_qentry_del (flow);memset (flow,0 ,sizeof (*flow)); flow->type =SMC_LLC_FLOW_NONE ;spin_unlock_bh (&lgr->llc_flow_lock);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1336/1424 NFSv4.2: fix LAYOUTSTATS send buffer exhaustion
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <[email protected]>
[ Upstream commit c75ef2137e749f2673f0617cfdaae53b2bb7195a ]
encode_layoutstats_maxsz budgets XDR_QUADLEN(PNFS_LAYOUTSTATS_MAXSIZE), i.e. 256 bytes, for the layoutupdate4 body written by the layout driver. The flexfiles record can exceed that.
ff_layout_encode_ff_layoutupdate() emits, per data server, a netaddr4, an nfs_fh4, two ff_io_latency4, an nfstime4 and a bool. A data server whose filehandle is NFS_MAXFHSIZE bytes long already accounts for 132 of those bytes, and the two ff_io_latency4 at 64 bytes each, the nfstime4 and the bool add a further 144, so the body passes 256 bytes before the netaddr4 is encoded at all. encode_layoutstats() additionally writes the deviceid4 and the layoutupdate4 lou_type word, neither of which the macro accounts for.
The filehandle and the address are both chosen by the server, through LAYOUTGET and GETDEVICEINFO, so it can drive the encoder past the end of the send buffer. xdr_reserve_space() returns NULL once that happens, and the two ff_layout_encode_io_latency() calls run with dss_info->mirror->lock held, so a NULL return there leaves the lock permanently held.
Raise PNFS_LAYOUTSTATS_MAXSIZE to 384 so that the record fits inside the reservation.
--- include/linux/nfs_xdr.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/nfs_xdr.h +1 -1
@@ -348,7 +348,7 @@ struct nfs4_layoutreturn {struct nfs4_xdr_opaque_data ld_private; }; -#define PNFS_LAYOUTSTATS_MAXSIZE 256 +#define PNFS_LAYOUTSTATS_MAXSIZE 384struct nfs42_layoutstat_args ;struct nfs42_layoutstat_devinfo ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1337/1424 nfs: move the nfs4_data_server_cache into struct nfs_net
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <[email protected]>
[ Upstream commit d5fb22a7c585b12ec3e6cef150689f7386e8cfd0 ]
Since struct nfs4_pnfs_ds should not be shared between net namespaces, move from a global list of objects to a per-netns list and spinlock.
Stable-dep-of: 13c23c5cb977 ("NFSv4/pnfs: key the data server cache on the NFS version")
--- fs/nfs/client.c | 7 +++++++ fs/nfs/netns.h | 6 +++++- fs/nfs/pnfs_nfs.c | 31 +++++++++++++++++-------------- 3 files changed, 29 insertions(+), 15 deletions(-)
fs/nfs/client.c +7 -0
@@ -1244,6 +1244,10 @@ void nfs_clients_init(struct net *net)INIT_LIST_HEAD (&nn->nfs_volume_list);#if IS_ENABLED (CONFIG_NFS_V4 )idr_init (&nn->cb_ident_idr); +#endif +#if IS_ENABLED (CONFIG_NFS_V4_1 ) +INIT_LIST_HEAD (&nn->nfs4_data_server_cache); +spin_lock_init (&nn->nfs4_data_server_lock);#endif spin_lock_init (&nn->nfs_client_lock); nn->boot_time =ktime_get_real ();
@@ -1261,6 +1265,9 @@ void nfs_clients_exit(struct net *net)nfs_cleanup_cb_ident_idr (net);WARN_ON_ONCE (!list_empty (&nn->nfs_client_list));WARN_ON_ONCE (!list_empty (&nn->nfs_volume_list)); +#if IS_ENABLED (CONFIG_NFS_V4_1 ) +WARN_ON_ONCE (!list_empty (&nn->nfs4_data_server_cache)); +#endif }#ifdef CONFIG_PROC_FS
fs/nfs/netns.h +5 -1
@@ -31,7 +31,11 @@ struct nfs_net {unsigned short nfs_callback_tcpport;unsigned short nfs_callback_tcpport6;int cb_users[NFS4_MAX_MINOR_VERSION +1 ]; -#endif +#endif /* CONFIG_NFS_V4 */ +#if IS_ENABLED (CONFIG_NFS_V4_1 ) +struct list_head nfs4_data_server_cache; +spinlock_t nfs4_data_server_lock; +#endif /* CONFIG_NFS_V4_1 */ struct nfs_netns_client *nfs_client;spinlock_t nfs_client_lock;ktime_t boot_time;
fs/nfs/pnfs_nfs.c +17 -14
@@ -16,6 +16,7 @@#include "nfs4session.h" #include "internal.h" #include "pnfs.h" +#include "netns.h" #define NFSDBG_FACILITY NFSDBG_PNFS
@@ -551,14 +552,14 @@ EXPORT_SYMBOL_GPL(pnfs_generic_commit_pagelist);/* * Data server cache * -* Data servers can be mapped to different device ids. -* nfs4_pnfs_ds reference counting +* Data servers can be mapped to different device ids, but should +* never be shared between net namespaces. +* +* nfs4_pnfs_ds reference counting: * - set to 1 on allocation * - incremented when a device id maps a data server already in the cache. * - decremented when deviceid is removed from the cache. */ -static DEFINE_SPINLOCK (nfs4_ds_cache_lock); -static LIST_HEAD (nfs4_data_server_cache);/* Debug routines */ static void
@@ -651,12 +652,12 @@ _same_data_server_addrs_locked(const struct list_head *dsaddrs1,* Lookup DS by addresses. nfs4_ds_cache_lock is held */ static struct nfs4_pnfs_ds * -_data_server_lookup_locked (const struct net *net,const struct list_head *dsaddrs) +_data_server_lookup_locked (const struct nfs_net *nn,const struct list_head *dsaddrs) {struct nfs4_pnfs_ds *ds; -list_for_each_entry (ds, &nfs4_data_server_cache, ds_node) -if (ds->ds_net == net &&_same_data_server_addrs_locked (&ds->ds_addrs, dsaddrs)) +list_for_each_entry (ds, &nn->nfs4_data_server_cache, ds_node) +if (_same_data_server_addrs_locked (&ds->ds_addrs, dsaddrs))return ds;return NULL ; }
@@ -700,10 +701,11 @@ static void destroy_ds(struct nfs4_pnfs_ds *ds)void nfs4_pnfs_ds_put (struct nfs4_pnfs_ds *ds) { -if (refcount_dec_and_lock (&ds->ds_count, - &nfs4_ds_cache_lock)) { +struct nfs_net *nn =net_generic (ds->ds_net, nfs_net_id); + +if (refcount_dec_and_lock (&ds->ds_count, &nn->nfs4_data_server_lock)) {list_del_init (&ds->ds_node); -spin_unlock (&nfs4_ds_cache_lock); +spin_unlock (&nn->nfs4_data_server_lock);destroy_ds (ds); } }
@@ -765,6 +767,7 @@ nfs4_pnfs_remotestr(struct list_head *dsaddrs, gfp_t gfp_flags)struct nfs4_pnfs_ds *nfs4_pnfs_ds_add (const struct net *net,struct list_head *dsaddrs,gfp_t gfp_flags) { +struct nfs_net *nn =net_generic (net, nfs_net_id);struct nfs4_pnfs_ds *tmp_ds, *ds =NULL ;char *remotestr;
@@ -780,8 +783,8 @@ nfs4_pnfs_ds_add(const struct net *net, struct list_head *dsaddrs, gfp_t gfp_fla/* this is only used for debugging, so it's ok if its NULL */ remotestr =nfs4_pnfs_remotestr (dsaddrs, gfp_flags); -spin_lock (&nfs4_ds_cache_lock); - tmp_ds =_data_server_lookup_locked (net, dsaddrs); +spin_lock (&nn->nfs4_data_server_lock); + tmp_ds =_data_server_lookup_locked (nn, dsaddrs);if (tmp_ds ==NULL ) {INIT_LIST_HEAD (&ds->ds_addrs);list_splice_init (dsaddrs, &ds->ds_addrs);
@@ -790,7 +793,7 @@ nfs4_pnfs_ds_add(const struct net *net, struct list_head *dsaddrs, gfp_t gfp_flaINIT_LIST_HEAD (&ds->ds_node); ds->ds_net = net; ds->ds_clp =NULL ; -list_add (&ds->ds_node, &nfs4_data_server_cache); +list_add (&ds->ds_node, &nn->nfs4_data_server_cache);dprintk ("%s add new data server %s\n" , __func__, ds->ds_remotestr); }else {
@@ -802,7 +805,7 @@ nfs4_pnfs_ds_add(const struct net *net, struct list_head *dsaddrs, gfp_t gfp_fla refcount_read(&tmp_ds->ds_count)); ds = tmp_ds; } -spin_unlock (&nfs4_ds_cache_lock); +spin_unlock (&nn->nfs4_data_server_lock); out:return ds; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1338/1424 NFSv4/pnfs: key the data server cache on the NFS version
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <[email protected]>
[ Upstream commit 13c23c5cb977f66390795437fd3837887ce1fd75 ]
nfs4_pnfs_ds_add() keys the per-net data server cache on the multipath address set alone, and struct nfs4_pnfs_ds records no version. That suffices for the files layout driver, which always connects with version 4, but flexfiles takes its version tuple from GETDEVICEINFO per device, and one address can legitimately serve both NFSv3 and NFSv4.
Two deviceids on one address with different ds_versions[0].version therefore share a single nfs4_pnfs_ds, and whichever mirror connects first pins ds_clp to its own version. The other one is handed that client anyway, so it selects rpc_call_ops for a version the connection does not speak, and the mismatched sequence-slot handling dereferences NULL.
Add the version to the cache key so the two cannot alias, giving each version its own nfs4_pnfs_ds and connection while both mirrors stay usable. Only the major version is compared, since that is what selects rpc_call_ops and rpc_ops; v4.0 and v4.1 keep sharing a client. The files layout driver passes the 4 it already hardcodes at connect time.
--- fs/nfs/filelayout/filelayoutdev.c | 3 ++- fs/nfs/flexfilelayout/flexfilelayoutdev.c | 3 ++- fs/nfs/pnfs.h | 3 ++- fs/nfs/pnfs_nfs.c | 14 +++++++++----- 4 files changed, 15 insertions(+), 8 deletions(-)
fs/nfs/filelayout/filelayoutdev.c +2 -1
@@ -169,7 +169,8 @@ nfs4_fl_alloc_deviceid_node(struct nfs_server *server, struct pnfs_device *pdev, goto out_err_free_deviceid; } - dsaddr->ds_list[i] =nfs4_pnfs_ds_add (net, &dsaddrs, gfp_flags); + dsaddr->ds_list[i] =nfs4_pnfs_ds_add (net, &dsaddrs,4 , + gfp_flags);if (!dsaddr->ds_list[i]) goto out_err_drain_dsaddrs;
fs/nfs/flexfilelayout/flexfilelayoutdev.c +2 -1
@@ -149,7 +149,8 @@ nfs4_ff_alloc_deviceid_node(struct nfs_server *server, struct pnfs_device *pdev, new_ds->ds_versions = ds_versions; new_ds->ds_versions_cnt = version_count; - new_ds->ds =nfs4_pnfs_ds_add (net, &dsaddrs, gfp_flags); + new_ds->ds =nfs4_pnfs_ds_add (net, &dsaddrs, ds_versions[0 ].version, + gfp_flags);if (!new_ds->ds) goto out_err_drain_dsaddrs;
fs/nfs/pnfs.h +2 -1
@@ -62,6 +62,7 @@ struct nfs4_pnfs_ds {const struct net *ds_net;struct nfs_client *ds_clp;refcount_t ds_count; +u32 ds_version;/* cache key, with ds_addrs */ unsigned long ds_state;#define NFS4DS_CONNECTING 0/* ds is establishing connection */ };
@@ -407,7 +408,7 @@ void pnfs_generic_write_commit_done(struct rpc_task *task, void *data);void nfs4_pnfs_ds_put (struct nfs4_pnfs_ds *ds);struct nfs4_pnfs_ds *nfs4_pnfs_ds_add (const struct net *net,struct list_head *dsaddrs, -gfp_t gfp_flags); +u32 version,gfp_t gfp_flags);void nfs4_pnfs_v3_ds_connect_unload (void ); int nfs4_pnfs_ds_connect(struct nfs_server *mds_srv, struct nfs4_pnfs_ds *ds, struct nfs4_deviceid_node *devid, unsigned int timeo,
fs/nfs/pnfs_nfs.c +9 -5
@@ -649,15 +649,17 @@ _same_data_server_addrs_locked(const struct list_head *dsaddrs1, }/* -* Lookup DS by addresses. nfs4_ds_cache_lock is held +* Lookup DS by addresses and NFS version. nfs4_ds_cache_lock is held */ static struct nfs4_pnfs_ds * -_data_server_lookup_locked (const struct nfs_net *nn,const struct list_head *dsaddrs) +_data_server_lookup_locked (const struct nfs_net *nn, +const struct list_head *dsaddrs,u32 version) {struct nfs4_pnfs_ds *ds;list_for_each_entry (ds, &nn->nfs4_data_server_cache, ds_node) -if (_same_data_server_addrs_locked (&ds->ds_addrs, dsaddrs)) +if (ds->ds_version == version && +_same_data_server_addrs_locked (&ds->ds_addrs, dsaddrs))return ds;return NULL ; }
@@ -765,7 +767,8 @@ nfs4_pnfs_remotestr(struct list_head *dsaddrs, gfp_t gfp_flags)* uncached and return cached struct nfs4_pnfs_ds. */ struct nfs4_pnfs_ds * -nfs4_pnfs_ds_add (const struct net *net,struct list_head *dsaddrs,gfp_t gfp_flags) +nfs4_pnfs_ds_add (const struct net *net,struct list_head *dsaddrs,u32 version, +gfp_t gfp_flags) {struct nfs_net *nn =net_generic (net, nfs_net_id);struct nfs4_pnfs_ds *tmp_ds, *ds =NULL ;
@@ -784,7 +787,7 @@ nfs4_pnfs_ds_add(const struct net *net, struct list_head *dsaddrs, gfp_t gfp_fla remotestr =nfs4_pnfs_remotestr (dsaddrs, gfp_flags);spin_lock (&nn->nfs4_data_server_lock); - tmp_ds =_data_server_lookup_locked (nn, dsaddrs); + tmp_ds =_data_server_lookup_locked (nn, dsaddrs, version);if (tmp_ds ==NULL ) {INIT_LIST_HEAD (&ds->ds_addrs);list_splice_init (dsaddrs, &ds->ds_addrs);
@@ -793,6 +796,7 @@ nfs4_pnfs_ds_add(const struct net *net, struct list_head *dsaddrs, gfp_t gfp_flaINIT_LIST_HEAD (&ds->ds_node); ds->ds_net = net; ds->ds_clp =NULL ; + ds->ds_version = version;list_add (&ds->ds_node, &nn->nfs4_data_server_cache);dprintk ("%s add new data server %s\n" , __func__, ds->ds_remotestr);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1339/1424 rtc: pcf85363: Add error checking to regmap calls in probe()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cosmo Chou <[email protected]>
[ Upstream commit 78acddfde75177a27000f076e3e828743e38877e ]
The probe() function ignores errors returned by regmap operations. If an I2C transport error occurs (e.g., -ENXIO), the driver continues probing and may register a non-functional RTC device.
Propagate errors from all unchecked regmap calls in probe() using dev_err_probe().
--- drivers/rtc/rtc-pcf85363.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
drivers/rtc/rtc-pcf85363.c +12 -5
@@ -426,8 +426,8 @@ static int pcf85363_probe(struct i2c_client *client) err =pcf85363_load_capacitance (pcf85363, client->dev.of_node);if (err <0 ) -dev_warn (&client->dev,"failed to set xtal load capacitance: %d" , - err); +return dev_err_probe (&client->dev, err, +"failed to set xtal load capacitance\n" ); pcf85363->rtc->ops = &rtc_ops; pcf85363->rtc->range_min =RTC_TIMESTAMP_BEGIN_2000 ;
@@ -436,9 +436,16 @@ static int pcf85363_probe(struct i2c_client *client) wakeup_source =device_property_read_bool (&client->dev,"wakeup-source" );if (client->irq >0 || wakeup_source) { -regmap_write (pcf85363->regmap,CTRL_FLAGS ,0 ); -regmap_update_bits (pcf85363->regmap,CTRL_PIN_IO , -PIN_IO_INTAPM ,PIN_IO_INTA_OUT ); + err =regmap_write (pcf85363->regmap,CTRL_FLAGS ,0 ); +if (err) +return dev_err_probe (&client->dev, err, +"failed to clear flags\n" ); + + err =regmap_update_bits (pcf85363->regmap,CTRL_PIN_IO , +PIN_IO_INTAPM ,PIN_IO_INTA_OUT ); +if (err) +return dev_err_probe (&client->dev, err, +"failed to set interrupt pin mode\n" ); }if (client->irq >0 ) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1340/1424 scsi: qla2xxx: Fix an loop timeout test
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 11e48f5201fd86ffa038809dd9c41144d43ee2e4 ]
This loop timeout with "retries" set to -1, not 0. Fix the test for failure.
--- drivers/scsi/qla2xxx/qla_nx2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/qla2xxx/qla_nx2.c +1 -1
@@ -3507,7 +3507,7 @@ qla8044_poll_flash_status_reg(struct scsi_qla_host *vha)msleep (QLA8044_FLASH_STATUS_REG_POLL_DELAY ); } -if (!retries) +if (retries ==-1 ) ret_val =QLA_FUNCTION_FAILED ;return ret_val;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1341/1424 erofs: Fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS default logic
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit ab74edaeb1ae7c7194e79007e6afdfe788111a3f ]
When NR_CPUS is less than 16, or when SMP is disabled, the default value of 16 is invalid.
While actual configuration picks up a sensible and valid default (NR_CPUS or 1), "make savedefconfig" will still write a line like
CONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS=1
to the defconfig file, even if that matches the sensible default.
Avoid needlessly enlarging the defconfig files, and reduce churn for updating them, by specifying valid defaults depending on SMP and NR_CPUS.
While at it, make the prompt depend on SMP, as there is no point in asking the user about the maximum number of decompression streams if there is only one valid answer.
--- fs/erofs/Kconfig | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
fs/erofs/Kconfig +5 -3
@@ -101,11 +101,13 @@ config EROFS_FS_ZIP_LZMA If unsure, say N. config EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS - int "EROFS LZMA default maximum decompression streams" + int "EROFS LZMA default maximum decompression streams" if SMP depends on EROFS_FS_ZIP_LZMA range 1 NR_CPUS if SMP range 1 1 if !SMP - default 16 + default 16 if SMP && NR_CPUS >= 16 + default NR_CPUS if SMP + default 1 help By default EROFS allocates one LZMA decompression stream per CPU. Each stream can hold a dictionary of up to 8 MiB taken from the
@@ -113,7 +115,7 @@ config EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS of memory. This caps the default; the lzma_streams module parameter still overrides it. - If unsure, keep the default of 16. + If unsure, keep the suggested default (16 or lower). config EROFS_FS_ZIP_DEFLATE bool "EROFS DEFLATE compressed data support"
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1342/1424 Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <[email protected]>
[ Upstream commit d4bfa78fd67929b62b02013c107973e0c5b7aa9a ]
New sk should not be added to parent socket accept queue after last l2cap_sock_cleanup_listen() has run in l2cap_sock_teardown_cb() and state set to BT_CLOSED, as that can result to UAF on dereferencing the dangling parent reference.
l2cap_sock_new_connection_cb() may race with parent l2cap_chan teardown, due to chan->state accessed without consistent locking:
[Task 1] [Task 2]
l2cap_sock_release(parent) l2cap_connect
l2cap_sock_shutdown pchan = l2cap_global_chan_by_psm
l2cap_chan_lock(pchan)
l2cap_chan_close
l2cap_sock_teardown_cb
pchan->state = BT_CLOSED
l2cap_chan_unlock(pchan) ------> l2cap_chan_lock(pchan)
l2cap_new_connection
l2cap_sock_new_connection_cb
l2cap_chan_lock(pchan) <-------- l2cap_chan_unlock(pchan)
l2cap_sock_kill(parent) /* bt_sk(sk)->parent dangling */Fix by adding check for sk_state == BT_LISTEN after acquiring sk lock in l2cap_sock_new_connection_cb(). Add lock_sock() around sk_state writes where missing, to avoid data races.
Although the data races on pchan->state should be fixed too, this defensive sk_state check probably makes sense in any case.
--- net/bluetooth/l2cap_sock.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
net/bluetooth/l2cap_sock.c +13 -0
@@ -1523,6 +1523,11 @@ static int l2cap_sock_new_connection_cb(struct l2cap_chan *chan,lock_sock (parent); +if (parent->sk_state !=BT_LISTEN ) { +release_sock (parent); +return -EINVAL ; + } +/* Check for backlog size */ if (sk_acceptq_is_full (parent)) {BT_DBG ("backlog full %d" , parent->sk_ack_backlog);
@@ -1687,10 +1692,14 @@ static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state,if (!sk)return ; +lock_sock (sk); + sk->sk_state = state;if (err) sk->sk_err = err; + +release_sock (sk); } static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,
@@ -1766,6 +1775,8 @@ static void l2cap_sock_resume_cb(struct l2cap_chan *chan)if (!sk)return ; +lock_sock (sk); +if (test_and_clear_bit (FLAG_PENDING_SECURITY , &chan->flags)) { sk->sk_state =BT_CONNECTED ; chan->state =BT_CONNECTED ;
@@ -1773,6 +1784,8 @@ static void l2cap_sock_resume_cb(struct l2cap_chan *chan)clear_bit (BT_SK_SUSPEND , &bt_sk (sk)->flags); sk->sk_state_change (sk); + +release_sock (sk); }static void l2cap_sock_set_shutdown_cb (struct l2cap_chan *chan)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1343/1424 Bluetooth: mgmt: fix hdev->discovery.uuids NULL dereference
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Shpakovskiy <[email protected]>
[ Upstream commit 59eecbe2f2f38d8f3e1104bd11da97f9a2c58998 ]
'uuid_count' member of struct 'discovery_state' is assigned and read without any locks, so there is a chance of situation when uuid_count != 0, but uuids is NULL and there will be NULL pointer dereference.
Possible race:
'hci_update_passive_scan_sync'
'hci_discovery_filter_clear'
hdev->discovery.uuid_count = 0;
<----------------------preempted----------------------------->
'start_service_discovery'
// Set uuid_count to value != 0
hdev->discovery.uuid_count = uuid_count;
hdev->discovery.uuids = kmemdup(...);
<----------------------preempted----------------------------->
spin_lock(&hdev->discovery.lock);
kfree(hdev->discovery.uuids);
hdev->discovery.uuids = NULL;
spin_unlock(&hdev->discovery.lock);Now uuids == NULL and uuid_count != 0.
So 'mgmt_device_found' -> 'is_filter_match' -> 'eir_has_uuids' receives non consistent discovery state, where NULL dereference of uuids happens.
To fix it let's add discovery.lock around every read/write of uuid_count, uuids pair of struct members. It is also important to assign uuid_count value only after success kmemdup() allocation in start_service_discovery(), otherwise uuids is NULL, because kmemdup failed, but uuid_count is already assigned to non zero value.
The following panic happens:
[ ] ------------[ cut here ]------------
[ ] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
[ ] Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP [ ] CPU: 0 PID: 15056 Comm: kworker/u9:2
[ ] Workqueue: hci0 hci_rx_work
[ ] pstate: 10400009 (nzcV daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ ] pc : eir_has_uuids+0x2d8/0x590
[ ] lr : is_filter_match+0x258/0x320
...
[ ] Call trace:
[ ] eir_has_uuids+0x2d8/0x590 [ ] is_filter_match+0x258/0x320 [ ] mgmt_device_found+0x5b0/0xafc [ ] process_adv_report.part.0+0x8c8/0xf14 [ ] hci_le_adv_report_evt+0x338/0x3f0 [ ] hci_le_meta_evt+0x1f0/0x4c8 [ ] hci_event_packet+0x440/0xc9c [ ] hci_rx_work+0x44c/0xaf8 [ ] process_one_work+0x54c/0x103c [ ] worker_thread+0x6c4/0x10c4 [ ] kthread+0x274/0x2ec [ ] ret_from_fork+0x10/0x20
[ ] Code: 14000004 91004021 eb14003f 54000180 (f9400024) [ ] ---[ end trace 0000000000000000 ]---
--- include/net/bluetooth/hci_core.h | 2 +- net/bluetooth/mgmt.c | 18 +++++++++++++----- 2 files changed, 14 insertions(+), 6 deletions(-)
include/net/bluetooth/hci_core.h +1 -1
@@ -886,9 +886,9 @@ static inline void hci_discovery_filter_clear(struct hci_dev *hdev) hdev->discovery.result_filtering = false; hdev->discovery.report_invalid_rssi = true; hdev->discovery.rssi =HCI_RSSI_INVALID ; - hdev->discovery.uuid_count =0 ;spin_lock (&hdev->discovery.lock); + hdev->discovery.uuid_count =0 ;kfree (hdev->discovery.uuids); hdev->discovery.uuids =NULL ;spin_unlock (&hdev->discovery.lock);
net/bluetooth/mgmt.c +13 -5
@@ -6148,6 +6148,7 @@ static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,struct mgmt_pending_cmd *cmd;const u16 max_uuid_count = ((U16_MAX -sizeof (*cp)) /16 );u16 uuid_count, expected_len; +u8 (*uuids)[16 ] =NULL ;u8 status;int err;
@@ -6224,12 +6225,10 @@ static int start_service_discovery(struct sock *sk, struct hci_dev *hdev, hdev->discovery.result_filtering = true; hdev->discovery.type = cp->type; hdev->discovery.rssi = cp->rssi; - hdev->discovery.uuid_count = uuid_count;if (uuid_count >0 ) { - hdev->discovery.uuids =kmemdup (cp->uuids, uuid_count *16 , -GFP_KERNEL ); -if (!hdev->discovery.uuids) { + uuids =kmemdup (cp->uuids, uuid_count *sizeof (*uuids),GFP_KERNEL ); +if (!uuids) { err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_SERVICE_DISCOVERY, MGMT_STATUS_FAILED,
@@ -6239,6 +6238,11 @@ static int start_service_discovery(struct sock *sk, struct hci_dev *hdev, } } +spin_lock (&hdev->discovery.lock); + hdev->discovery.uuids = uuids; + hdev->discovery.uuid_count = uuid_count; +spin_unlock (&hdev->discovery.lock); + err =hci_cmd_sync_queue (hdev, start_discovery_sync, cmd, start_discovery_complete);if (err <0 ) {
@@ -10369,6 +10373,7 @@ static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir, !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))return false; +spin_lock (&hdev->discovery.lock);if (hdev->discovery.uuid_count !=0 ) {/* If a list of UUIDs is provided in filter, results with no * matching UUID should be dropped.
@@ -10377,9 +10382,12 @@ static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir, hdev->discovery.uuids) && !eir_has_uuids(scan_rsp, scan_rsp_len, hdev->discovery.uuid_count, - hdev->discovery.uuids)) + hdev->discovery.uuids)) { +spin_unlock (&hdev->discovery.lock);return false; + } } +spin_unlock (&hdev->discovery.lock);/* If duplicate filtering does not report RSSI changes, then restart * scanning to ensure updated result with updated RSSI values.
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1344/1424 Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <[email protected]>
[ Upstream commit 66d6ef18548ae6d7dd452b84115fc82c0a73a4ea ]
For L2CAP sockets without owning sk->sk_socket, reading l2cap_pi(sk)->chan may race against concurrent l2cap_sock_kill() -> l2cap_sock_put_chan(). This excludes simultaneous proto_ops callbacks, but access in l2cap_sock_cleanup_listen() has unsafe lockless read.
[Task 1] [Task 2 (hdev->workqueue)]
l2cap_sock_release(parent) l2cap_disconn_cfm
l2cap_sock_cleanup_listen l2cap_conn_del
bt_accept_dequeue l2cap_chan_del
lock_sock(sk) l2cap_sock_teardown_cb
bt_accept_unlink
bt_sk(sk)->parent = NULL
release_sock(sk) ----------------> lock_sock(sk)
parent = /* NULL */
lock_sock(sk) <--------------------- release_sock(sk)
sock_set_flag(sk, SOCK_ZAPPED)
l2cap_sock_close_cb
l2cap_sock_kill(sk)
l2cap_sock_put_chan
chan = READ l2cap_pi(sk)->chan l2cap_pi(sk)->chan = NULL
l2cap_chan_hold_unless_zero l2cap_put_chan(chan)
kref_get_unless_zero(&chan->ref)Task 1 may observe NULL which causes null-ptr-deref.
Fix the race by taking lock_sock() in l2cap_sock_kill() to synchronize with l2cap_sock_cleanup_listen(). hold_unless_zero() is not needed here, l2cap_pi(sk)->chan owns reference if it is non-NULL.
Clarify code comments vs. locking.
--- include/net/bluetooth/l2cap.h | 5 +++++ net/bluetooth/l2cap_sock.c | 23 +++++++++++++---------- 2 files changed, 18 insertions(+), 10 deletions(-)
include/net/bluetooth/l2cap.h +5 -0
@@ -696,7 +696,12 @@ struct l2cap_rx_busy {struct l2cap_pinfo {struct bt_sock bt; + +/* With owning sk_socket chan may be read without lock, other access +* should hold lock_sock. +*/ struct l2cap_chan *chan; +struct list_head rx_busy; };
net/bluetooth/l2cap_sock.c +13 -10
@@ -1268,7 +1268,12 @@ static void l2cap_sock_kill(struct sock *sk)BT_DBG ("sk %p state %s" , sk,state_to_string (sk->sk_state)); +/* Take lock to synchronize against access without owning sk->sk_socket, +* eg. in l2cap_sock_cleanup_listen(). proto_ops etc. don't need lock. +*/ +lock_sock (sk);l2cap_sock_put_chan (sk); +release_sock (sk);/* Kill poor orphan */ sock_set_flag (sk,SOCK_DEAD );
@@ -1471,14 +1476,10 @@ static void l2cap_sock_cleanup_listen(struct sock *parent)* establish sk_lock -> conn->lock and invert the established * conn->lock -> chan->lock -> sk_lock order (lockdep deadlock). * -* Instead, briefly take the child sk lock to fetch and pin its chan. -* l2cap_conn_del() reaches the chan free only via -* l2cap_chan_del() -> l2cap_sock_teardown_cb(), which itself takes -* the child sk lock; holding it across l2cap_chan_hold_unless_zero() -* therefore guarantees the chan cannot be freed while we read and -* pin it (hold_unless_zero() additionally skips a chan already past -* its last reference). We then drop the sk lock before taking -* chan->lock, so sk and chan locks are never held together. +* Instead, briefly take the child sk lock to synchronize vs. +* l2cap_sock_kill that puts l2cap_pi(sk)->chan. We then drop the sk +* lock before taking chan->lock, so sk and chan locks are never held +* together. * * Since we cannot call l2cap_chan_close() without conn->lock, * schedule l2cap_chan_timeout to close the channel; it already
@@ -1488,10 +1489,12 @@ static void l2cap_sock_cleanup_listen(struct sock *parent)struct l2cap_chan *chan;lock_sock_nested (sk,L2CAP_NESTING_NORMAL ); - chan =l2cap_chan_hold_unless_zero (l2cap_pi (sk)->chan); + chan =l2cap_pi (sk)->chan; +if (chan) +l2cap_chan_hold (chan);release_sock (sk);if (!chan) { -/* l2cap_conn_del() already tearing this child down */ +/* Already torn down */ sock_put (sk);continue ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1345/1424 Bluetooth: btmtk: Do not discard the subsystem reset timeout
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ismail Tarim <[email protected]>
[ Upstream commit 21b50c24843b51f88ac4316dd470d2803da0c42f ]
When the MTK_BT_RST_DONE poll times out, btmtk_usb_subsys_reset() logs "Reset timeout" and keeps the error in err, but err is then overwritten by the return value of the following btmtk_usb_id_get() call, so the timeout is never reported to the caller.
Commit 25b6d7593a3a ("Bluetooth: btmtk: introduce btmtk reset work") discarded the return value of the chip id read, so the function returned the timeout error as intended. Commit 3dcb122b3064 ("Bluetooth: btusb:
mediatek: return error for failed reg access") started assigning err at that call and silently dropped it.
Keep the timeout in a separate variable and return it, restoring the original behaviour without changing the control flow.
--- drivers/bluetooth/btmtk.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/bluetooth/btmtk.c +5 -2
@@ -822,6 +822,7 @@ static u32 btmtk_usb_reset_done(struct hci_dev *hdev)int btmtk_usb_subsys_reset (struct hci_dev *hdev,u32 dev_id) { +int reset_err =0 ;u32 val;int err;
@@ -920,8 +921,10 @@ int btmtk_usb_subsys_reset(struct hci_dev *hdev, u32 dev_id) err =readx_poll_timeout (btmtk_usb_reset_done, hdev, val, val &MTK_BT_RST_DONE ,20000 ,1000000 ); -if (err <0 ) +if (err <0 ) {bt_dev_err (hdev,"Reset timeout" ); + reset_err = err; + }if (dev_id ==0x7922 ) { err =btmtk_usb_uhw_reg_write (hdev,MTK_UDMA_INT_STA_BT ,0x000000FF );
@@ -933,7 +936,7 @@ int btmtk_usb_subsys_reset(struct hci_dev *hdev, u32 dev_id)if (err <0 || !val)bt_dev_err (hdev,"Can't get device id, subsys reset fail." ); -return err; +return reset_err; }EXPORT_SYMBOL_GPL (btmtk_usb_subsys_reset);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1346/1424 Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Lu <[email protected]>
[ Upstream commit 155e3003d1e614f85566b636973df7118e1b4851 ]
btmtksdio_tx_packet() prepends the MediaTek SDIO header with skb_push() and writes into that space after only checking the headroom size. On a cloned SKB that headroom belongs to a buffer shared with the other owner, which the driver has no right to write to.
Cloned SKBs do reach this path: hci_send_cmd_sync() keeps a clone of every HCI command in hdev->sent_cmd before handing the SKB to the driver, and l2cap_ertm_send() clones SKBs for retransmission.
Replace the open-coded headroom check with skb_cow_head(), which both guarantees the headroom and reallocates a private buffer when the SKB is cloned. The cost is one reallocation and copy per cloned packet, the usual price of this pattern in network drivers.
This has no observable effect on its own, as the driver only writes in front of skb->data where no other owner looks. It is a prerequisite for "Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path", which writes padding behind skb->tail, and carries the same Fixes: tag so that both are backported together.
--- drivers/bluetooth/btmtksdio.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
drivers/bluetooth/btmtksdio.c +6 -7
@@ -260,13 +260,12 @@ static int btmtksdio_tx_packet(struct btmtksdio_dev *bdev,struct mtkbtsdio_hdr *sdio_hdr;int err; -/* Make sure that there are enough rooms for SDIO header */ -if (unlikely (skb_headroom (skb) <sizeof (*sdio_hdr))) { - err =pskb_expand_head (skb,sizeof (*sdio_hdr),0 , -GFP_ATOMIC ); -if (err <0 ) -return err; - } +/* Make sure that the data buffer is not shared with anyone else and +* that there is enough room for the SDIO header +*/ + err =skb_cow_head (skb,sizeof (*sdio_hdr)); +if (err <0 ) +return err;/* Prepend MediaTek SDIO Specific Header */ skb_push (skb,sizeof (*sdio_hdr));
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1347/1424 Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Lu <[email protected]>
[ Upstream commit fa0ad2d277c7adead61d1c22411c55cea6990c2a ]
btmtksdio_tx_packet() rounds the transfer size up to the SDIO block size of 256 bytes, but hands the host controller the SKB buffer as is:
err = sdio_writesb(bdev->func, MTK_REG_CTDR, skb->data, round_up(skb->len, MTK_SDIO_BLOCK_SIZE));
Only skb->len bytes hold packet data, so the controller reads up to 255 bytes of uninitialised memory and sends it to the device over the SDIO bus. Depending on how much tailroom slack the SKB allocation happens to carry, that read can also extend past the end of the buffer.
Compute the padded length up front, ensure the SKB has tailroom for it, and zero-fill the padding with skb_put_zero(). skb->len then covers the padding, so sdio_writesb() no longer needs to round up. byte_tx keeps counting the header and the payload only, and the error path restores the SKB so that the caller can requeue it.
Writing behind skb->tail is only safe because the driver owns the buffer, which "Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX" ensures.
--- drivers/bluetooth/btmtksdio.c | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-)
drivers/bluetooth/btmtksdio.c +21 -5
@@ -258,6 +258,7 @@ static int btmtksdio_tx_packet(struct btmtksdio_dev *bdev, struct sk_buff *skb) {struct mtkbtsdio_hdr *sdio_hdr; +unsigned int len, pad_len;int err;/* Make sure that the data buffer is not shared with anyone else and
@@ -267,6 +268,18 @@ static int btmtksdio_tx_packet(struct btmtksdio_dev *bdev,if (err <0 )return err; +/* The transfer is rounded up to the SDIO block size, so the buffer +* has to provide tailroom for the padding as well +*/ + len = skb->len +sizeof (*sdio_hdr); + pad_len =round_up (len,MTK_SDIO_BLOCK_SIZE ) - len; + +if (unlikely (skb_tailroom (skb) < pad_len)) { + err =pskb_expand_head (skb,0 , pad_len,GFP_ATOMIC ); +if (err <0 ) +return err; + } +/* Prepend MediaTek SDIO Specific Header */ skb_push (skb,sizeof (*sdio_hdr));
@@ -275,19 +288,22 @@ static int btmtksdio_tx_packet(struct btmtksdio_dev *bdev, sdio_hdr->reserved =cpu_to_le16 (0 ); sdio_hdr->bt_type =hci_skb_pkt_type (skb); +/* Zero the padding so that no uninitialised memory is sent out */ +skb_put_zero (skb, pad_len); +clear_bit (BTMTKSDIO_HW_TX_READY , &bdev->tx_state); - err =sdio_writesb (bdev->func,MTK_REG_CTDR , skb->data, -round_up (skb->len,MTK_SDIO_BLOCK_SIZE )); + err =sdio_writesb (bdev->func,MTK_REG_CTDR , skb->data, skb->len);if (err <0 ) - goto err_skb_pull; + goto err_skb_restore; - bdev->hdev->stat.byte_tx += skb->len; + bdev->hdev->stat.byte_tx += len;kfree_skb (skb);return 0 ; -err_skb_pull: +err_skb_restore: +skb_trim (skb, len);skb_pull (skb,sizeof (*sdio_hdr));return err;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1348/1424 Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <[email protected]>
[ Upstream commit 44c98fd082eafd49d55a8a4077ff488175b2fe24 ]
rfcomm_apply_pn() accepts the MTU value from a remote PN (Parameter Negotiation) frame without checking for zero. When the remote peer sends an MTU of zero, d->mtu is set to 0. This causes the sendmsg path to enter an infinite loop when fragmenting data, as each fragment has size == min_t(size_t, len, 0) == 0, so the remaining length never decreases. The infinite allocation of zero-length skbs exhausts all system memory.
Fix by clamping d->mtu to RFCOMM_DEFAULT_MTU when the negotiated value is zero, consistent with the initial value assigned in rfcomm_dlc_alloc().
--- net/bluetooth/rfcomm/core.c | 4 ++++ 1 file changed, 4 insertions(+)
net/bluetooth/rfcomm/core.c +4 -0
@@ -1458,6 +1458,10 @@ static int rfcomm_apply_pn(struct rfcomm_dlc *d, int cr, struct rfcomm_pn *pn) d->mtu =__le16_to_cpu (pn->mtu); +/* MTU 0 causes an infinite loop when fragmenting in sendmsg */ +if (!d->mtu) + d->mtu =RFCOMM_DEFAULT_MTU ; +if (cr && d->mtu > s->mtu) d->mtu = s->mtu;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1349/1424 gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang (Microsoft) <[email protected]>
[ Upstream commit d989e22ae9802c52c56ad4284d0caf26696cf6ae ]
gtp_newlink()'s error path frees tid_hash and addr_hash without waiting for an RCU grace period after clearing sk_user_data. A concurrent gtp_encap_recv() in softirq may still hold the gtp_dev pointer obtained via rcu_dereference_sk_user_data() and access the freed memory.
BUG: KASAN: slab-use-after-free in gtp0_pdp_find+0x1f6/0x200 (gtp.c:152) Call Trace: <IRQ> gtp0_pdp_find+0x1f6/0x200 gtp_encap_recv+0x527/0x24b0 udp_queue_rcv_one_skb+0x75f/0xc10
Add synchronize_net() before the kfree calls in out_hashtable, which covers all error paths from both gtp_encap_enable() and gtp_create_sockets().
--- drivers/net/gtp.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/gtp.c +2 -0
@@ -1107,6 +1107,8 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev, out_encap:gtp_encap_disable (gtp); out_hashtable: +/* Wait for RCU readers that may still reference this gtp_dev. */ +synchronize_net ();kfree (gtp->addr_hash);kfree (gtp->tid_hash);return err;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1350/1424 net: qualcomm: rmnet: restore skb->dev on deaggregated frames
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <[email protected]>
[ Upstream commit a66734a1c5e36525ea07e9f4547fddc51e916de3 ]
rmnet_map_deaggregate() allocates each sub-frame with alloc_skb() and leaves skb->dev NULL. __rmnet_map_ingress_handler() assigns skb->dev = ep->egress_dev only on the data path, but a MAP command frame is dispatched to rmnet_map_command() before that, so rmnet_map_send_ack() runs netif_tx_lock(skb->dev) on a NULL device. An unprivileged user reaches this by unsharing a user+net namespace, creating an rmnet link over a tap device with INGRESS_DEAGGREGATION and INGRESS_MAP_COMMANDS, and writing an aggregated frame carrying a flow-control command to the tap fd.
Restore the assignment dropped by 378e25357ac7, so every skb leaving rmnet_map_deaggregate() has a valid device.
BUG: KASAN: null-ptr-deref in _raw_spin_lock (kernel/locking/spinlock.c:158) Write of size 4 at addr 00000000000004b4 by task exploit/144 Call Trace: _raw_spin_lock (kernel/locking/spinlock.c:158) netif_tx_lock (net/sched/sch_generic.c:497) rmnet_map_command (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c:67) rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:125) __netif_receive_skb_core.constprop.0 (net/core/dev.c:6103) ... __netif_receive_skb_one_core (net/core/dev.c:6214) netif_receive_skb (net/core/dev.c:6474) tun_get_user (drivers/net/tun.c:1966) tun_chr_write_iter (drivers/net/tun.c:2012) vfs_write (fs/read_write.c:687) ksys_write (fs/read_write.c:739) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Kernel panic - not syncing: Fatal exception in interrupt
--- drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c +1 -0
@@ -394,6 +394,7 @@ struct sk_buff *rmnet_map_deaggregate(struct sk_buff *skb,if (!skbn)return NULL ; + skbn->dev = skb->dev;skb_reserve (skbn,RMNET_MAP_DEAGGR_HEADROOM );skb_put (skbn, packet_len);memcpy (skbn->data, skb->data, packet_len);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1351/1424 octeontx2-af: Fix TL3/TL2 link config ENA clearing
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naveen Mamindlapalli <[email protected]>
[ Upstream commit 9edf8d4876e8a2471e66f54d36208eaff2858392 ]
Clear and restore the ENA bit for each TL3/TL2 link entry during SMQ flush instead of repeatedly using the same link index.
--- drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +5 -6
@@ -2252,8 +2252,8 @@ static int nix_smq_flush(struct rvu *rvu, int blkaddr,int pf =rvu_get_pf (pcifunc);u8 cgx_id =0 , lmac_id =0 ;u16 tl2_tl3_link_schq; -u8 link, link_level;u64 cfg, bmap =0 ; +u8 link_level;if (!is_rvu_otx2 (rvu)) {/* Skip SMQ flush if pkt count is zero */
@@ -2285,7 +2285,6 @@ static int nix_smq_flush(struct rvu *rvu, int blkaddr, link_level =rvu_read64 (rvu, blkaddr,NIX_AF_PSE_CHANNEL_LEVEL ) &0x01 ?NIX_TXSCH_LVL_TL3 :NIX_TXSCH_LVL_TL2 ; tl2_tl3_link_schq = smq_flush_ctx->smq_tree_ctx[link_level].schq; - link = smq_flush_ctx->smq_tree_ctx[NIX_TXSCH_LVL_TL1 ].schq;/* SMQ set enqueue xoff */ cfg =rvu_read64 (rvu, blkaddr,NIX_AF_SMQX_CFG (smq));
@@ -2295,13 +2294,13 @@ static int nix_smq_flush(struct rvu *rvu, int blkaddr,/* Clear all NIX_AF_TL3_TL2_LINK_CFG[ENA] for the TL3/TL2 queue */ for (i =0 ; i < (rvu->hw->cgx_links + rvu->hw->lbk_links); i++) { cfg =rvu_read64 (rvu, blkaddr, -NIX_AF_TL3_TL2X_LINKX_CFG (tl2_tl3_link_schq, link)); +NIX_AF_TL3_TL2X_LINKX_CFG (tl2_tl3_link_schq, i));if (!(cfg &BIT_ULL (12 )))continue ; bmap |=BIT_ULL (i); cfg &= ~BIT_ULL (12 );rvu_write64 (rvu, blkaddr, -NIX_AF_TL3_TL2X_LINKX_CFG (tl2_tl3_link_schq, link), cfg); +NIX_AF_TL3_TL2X_LINKX_CFG (tl2_tl3_link_schq, i), cfg); }/* Do SMQ flush and set enqueue xoff */
@@ -2322,10 +2321,10 @@ static int nix_smq_flush(struct rvu *rvu, int blkaddr,if (!(bmap &BIT_ULL (i)))continue ; cfg =rvu_read64 (rvu, blkaddr, -NIX_AF_TL3_TL2X_LINKX_CFG (tl2_tl3_link_schq, link)); +NIX_AF_TL3_TL2X_LINKX_CFG (tl2_tl3_link_schq, i)); cfg |=BIT_ULL (12 );rvu_write64 (rvu, blkaddr, -NIX_AF_TL3_TL2X_LINKX_CFG (tl2_tl3_link_schq, link), cfg); +NIX_AF_TL3_TL2X_LINKX_CFG (tl2_tl3_link_schq, i), cfg); }/* clear XOFF on TL2s */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1352/1424 net/rds: use wq_has_sleeper() in rds_cong_map_updated()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Allison Henderson <[email protected]>
[ Upstream commit d4f484661961636eb90d287050959e613795f73a ]
rds_cong_map_updated() runs after a peer's congestion map has been rewritten (by rds_tcp_cong_recv() and rds_ib_cong_recv(), or the clear-all in the loopback and IB send-completion paths). It bumps rds_cong_generation and then checks waitqueue_active() on map->m_waitq and on rds_poll_waitq to decide whether anyone needs waking. atomic_inc() carries no ordering and waitqueue_active() is a plain load, so nothing orders the map and generation stores before the wait queue reads. The waiters do the mirror image: rds_cong_wait() adds itself to m_waitq and then tests the port bit, and rds_poll() registers on rds_poll_waitq and then reads the generation. That is the store-buffering pattern described above waitqueue_active() in include/linux/wait.h - the updater can observe an empty wait queue while the waiter still observes the port as congested, and no wake-up is issued.
rds_cong_wait() is an interruptible sleep with no timeout, so a sender blocked on a congested port stays blocked until the next congestion update from that peer arrives or a signal is delivered. A poll() waiter misses the map-updated notification the same way.
Use wq_has_sleeper(), which is waitqueue_active() preceded by the required full barrier, as rds_tcp_state_change() already does for the same pattern.
--- net/rds/cong.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/rds/cong.c +2 -2
@@ -256,9 +256,9 @@ void rds_cong_map_updated(struct rds_cong_map *map, uint64_t portmask) map, &map->m_addr);rds_stats_inc (s_cong_update_received);atomic_inc (&rds_cong_generation); -if (waitqueue_active (&map->m_waitq)) +if (wq_has_sleeper (&map->m_waitq))wake_up (&map->m_waitq); -if (waitqueue_active (&rds_poll_waitq)) +if (wq_has_sleeper (&rds_poll_waitq))wake_up_all (&rds_poll_waitq);if (portmask && !list_empty (&rds_cong_monitor)) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1353/1424 cifs: fix clearing stats for fastest execution of each smb2 command
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Sorenson <[email protected]>
[ Upstream commit 48cab1fd5720508148673f59d8ed52c7c7fffca2 ]
The code to clear the 'fastest_cmd' statistics has a typo that repeatedly clears the stat for cmd 0, rather than iterating through each cmd. Fix the typo (0->i).
--- fs/smb/client/cifs_debug.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/smb/client/cifs_debug.c +1 -1
@@ -674,7 +674,7 @@ static ssize_t cifs_stats_proc_write(struct file *file,atomic_set (&server->smb2slowcmd[i],0 ); server->time_per_cmd[i] =0 ; server->slowest_cmd[i] =0 ; - server->fastest_cmd[0] = 0; + server->fastest_cmd[i] = 0; }#endif /* CONFIG_CIFS_STATS2 */ list_for_each_entry (ses, &server->smb_ses_list, smb_ses_list) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1354/1424 selftests/mm/cow: generalize do_run_with_thp() helper
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Roberts <[email protected]>
[ Upstream commit 12dc16b38463a671bc91dc2df10f3a014a27ff3b ]
do_run_with_thp() prepares (PMD-sized) THP memory into different states before running tests. With the introduction of multi-size THP, we would like to reuse this logic to also test those smaller THP sizes. So let's add a thpsize parameter which tells the function what size THP it should operate on.
A separate commit will utilize this change to add new tests for multi-size THP, where available.
Stable-dep-of: 4004c130c358 ("selftests/mm: skip COW tmpfile cases when fallocate() is unsupported")
--- tools/testing/selftests/mm/cow.c | 121 +++++++++++++++++-------------- 1 file changed, 67 insertions(+), 54 deletions(-)
tools/testing/selftests/mm/cow.c +67 -54
@@ -32,7 +32,7 @@static size_t pagesize;static int pagemap_fd; -static size_t thpsize; +static size_t pmdsize;static int nr_hugetlbsizes;static size_t hugetlbsizes[10 ];static int gup_fd;
@@ -734,7 +734,7 @@ enum thp_run { THP_RUN_PARTIAL_SHARED, }; -static void do_run_with_thp (test_fn fn,enum thp_run thp_run) +static void do_run_with_thp (test_fn fn,enum thp_run thp_run,size_t thpsize) {char *mem, *mmap_mem, *tmp, *mremap_mem =MAP_FAILED ;size_t size, mmap_size, mremap_size;
@@ -759,11 +759,11 @@ static void do_run_with_thp(test_fn fn, enum thp_run thp_run) }/* -* Try to populate a THP. Touch the first sub-page and test if we get -* another sub-page populated automatically. +* Try to populate a THP. Touch the first sub-page and test if +* we get the last sub-page populated automatically. */ mem[0 ] =0 ; -if (!pagemap_is_populated (pagemap_fd, mem + pagesize)) { +if (!pagemap_is_populated (pagemap_fd, mem + thpsize - pagesize)) {ksft_test_result_skip ("Did not get a THP populated\n" ); goto munmap; }
@@ -773,12 +773,14 @@ static void do_run_with_thp(test_fn fn, enum thp_run thp_run)switch (thp_run) {case THP_RUN_PMD :case THP_RUN_PMD_SWAPOUT : +assert (thpsize == pmdsize);break ;case THP_RUN_PTE :case THP_RUN_PTE_SWAPOUT :/* * Trigger PTE-mapping the THP by temporarily mapping a single -* subpage R/O. +* subpage R/O. This is a noop if the THP is not pmdsize (and +* therefore already PTE-mapped). */ ret =mprotect (mem + pagesize, pagesize,PROT_READ );if (ret) {
@@ -875,52 +877,60 @@ static void do_run_with_thp(test_fn fn, enum thp_run thp_run)munmap (mremap_mem, mremap_size); } -static void run_with_thp (test_fn fn,const char *desc) +static void run_with_thp (test_fn fn,const char *desc,size_t size) { -ksft_print_msg ("[RUN] %s ... with THP\n" , desc); -do_run_with_thp (fn,THP_RUN_PMD ); +ksft_print_msg ("[RUN] %s ... with THP (%zu kB)\n" , + desc, size /1024 ); +do_run_with_thp (fn,THP_RUN_PMD , size); } -static void run_with_thp_swap (test_fn fn,const char *desc) +static void run_with_thp_swap (test_fn fn,const char *desc,size_t size) { -ksft_print_msg ("[RUN] %s ... with swapped-out THP\n" , desc); -do_run_with_thp (fn,THP_RUN_PMD_SWAPOUT ); +ksft_print_msg ("[RUN] %s ... with swapped-out THP (%zu kB)\n" , + desc, size /1024 ); +do_run_with_thp (fn,THP_RUN_PMD_SWAPOUT , size); } -static void run_with_pte_mapped_thp (test_fn fn,const char *desc) +static void run_with_pte_mapped_thp (test_fn fn,const char *desc,size_t size) { -ksft_print_msg ("[RUN] %s ... with PTE-mapped THP\n" , desc); -do_run_with_thp (fn,THP_RUN_PTE ); +ksft_print_msg ("[RUN] %s ... with PTE-mapped THP (%zu kB)\n" , + desc, size /1024 ); +do_run_with_thp (fn,THP_RUN_PTE , size); } -static void run_with_pte_mapped_thp_swap (test_fn fn,const char *desc) +static void run_with_pte_mapped_thp_swap (test_fn fn,const char *desc,size_t size) { -ksft_print_msg ("[RUN] %s ... with swapped-out, PTE-mapped THP\n" , desc); -do_run_with_thp (fn,THP_RUN_PTE_SWAPOUT ); +ksft_print_msg ("[RUN] %s ... with swapped-out, PTE-mapped THP (%zu kB)\n" , + desc, size /1024 ); +do_run_with_thp (fn,THP_RUN_PTE_SWAPOUT , size); } -static void run_with_single_pte_of_thp (test_fn fn,const char *desc) +static void run_with_single_pte_of_thp (test_fn fn,const char *desc,size_t size) { -ksft_print_msg ("[RUN] %s ... with single PTE of THP\n" , desc); -do_run_with_thp (fn,THP_RUN_SINGLE_PTE ); +ksft_print_msg ("[RUN] %s ... with single PTE of THP (%zu kB)\n" , + desc, size /1024 ); +do_run_with_thp (fn,THP_RUN_SINGLE_PTE , size); } -static void run_with_single_pte_of_thp_swap (test_fn fn,const char *desc) +static void run_with_single_pte_of_thp_swap (test_fn fn,const char *desc,size_t size) { -ksft_print_msg ("[RUN] %s ... with single PTE of swapped-out THP\n" , desc); -do_run_with_thp (fn,THP_RUN_SINGLE_PTE_SWAPOUT ); +ksft_print_msg ("[RUN] %s ... with single PTE of swapped-out THP (%zu kB)\n" , + desc, size /1024 ); +do_run_with_thp (fn,THP_RUN_SINGLE_PTE_SWAPOUT , size); } -static void run_with_partial_mremap_thp (test_fn fn,const char *desc) +static void run_with_partial_mremap_thp (test_fn fn,const char *desc,size_t size) { -ksft_print_msg ("[RUN] %s ... with partially mremap()'ed THP\n" , desc); -do_run_with_thp (fn,THP_RUN_PARTIAL_MREMAP ); +ksft_print_msg ("[RUN] %s ... with partially mremap()'ed THP (%zu kB)\n" , + desc, size /1024 ); +do_run_with_thp (fn,THP_RUN_PARTIAL_MREMAP , size); } -static void run_with_partial_shared_thp (test_fn fn,const char *desc) +static void run_with_partial_shared_thp (test_fn fn,const char *desc,size_t size) { -ksft_print_msg ("[RUN] %s ... with partially shared THP\n" , desc); -do_run_with_thp (fn,THP_RUN_PARTIAL_SHARED ); +ksft_print_msg ("[RUN] %s ... with partially shared THP (%zu kB)\n" , + desc, size /1024 ); +do_run_with_thp (fn,THP_RUN_PARTIAL_SHARED , size); }static void run_with_hugetlb (test_fn fn,const char *desc,size_t hugetlbsize)
@@ -1091,15 +1101,15 @@ static void run_anon_test_case(struct test_case const *test_case)run_with_base_page (test_case->fn, test_case->desc);run_with_base_page_swap (test_case->fn, test_case->desc); -if (thpsize) { -run_with_thp (test_case->fn, test_case->desc); -run_with_thp_swap (test_case->fn, test_case->desc); -run_with_pte_mapped_thp (test_case->fn, test_case->desc); -run_with_pte_mapped_thp_swap (test_case->fn, test_case->desc); -run_with_single_pte_of_thp (test_case->fn, test_case->desc); -run_with_single_pte_of_thp_swap (test_case->fn, test_case->desc); -run_with_partial_mremap_thp (test_case->fn, test_case->desc); -run_with_partial_shared_thp (test_case->fn, test_case->desc); +if (pmdsize) { +run_with_thp (test_case->fn, test_case->desc, pmdsize); +run_with_thp_swap (test_case->fn, test_case->desc, pmdsize); +run_with_pte_mapped_thp (test_case->fn, test_case->desc, pmdsize); +run_with_pte_mapped_thp_swap (test_case->fn, test_case->desc, pmdsize); +run_with_single_pte_of_thp (test_case->fn, test_case->desc, pmdsize); +run_with_single_pte_of_thp_swap (test_case->fn, test_case->desc, pmdsize); +run_with_partial_mremap_thp (test_case->fn, test_case->desc, pmdsize); +run_with_partial_shared_thp (test_case->fn, test_case->desc, pmdsize); }for (i =0 ; i < nr_hugetlbsizes; i++) run_with_hugetlb(test_case->fn, test_case->desc,
@@ -1120,7 +1130,7 @@ static int tests_per_anon_test_case(void) {int tests =2 + nr_hugetlbsizes; -if (thpsize) +if (pmdsize) tests +=8 ;return tests; }
@@ -1329,7 +1339,7 @@ static void run_anon_thp_test_cases(void) {int i; -if (!thpsize) +if (!pmdsize)return ;ksft_print_msg ("[INFO] Anonymous THP tests\n" );
@@ -1338,13 +1348,13 @@ static void run_anon_thp_test_cases(void)struct test_case const *test_case = &anon_thp_test_cases[i];ksft_print_msg ("[RUN] %s\n" , test_case->desc); -do_run_with_thp (test_case->fn,THP_RUN_PMD ); +do_run_with_thp (test_case->fn,THP_RUN_PMD , pmdsize); } }static int tests_per_anon_thp_test_case (void ) { -return thpsize ?1 :0 ; +return pmdsize ?1 :0 ; }typedef void (*non_anon_test_fn )(char *mem,const char *smem,size_t size);
@@ -1419,7 +1429,7 @@ static void run_with_huge_zeropage(non_anon_test_fn fn, const char *desc) }/* For alignment purposes, we need twice the thp size. */ - mmap_size =2 * thpsize; + mmap_size =2 * pmdsize; mmap_mem =mmap (NULL , mmap_size,PROT_READ |PROT_WRITE ,MAP_PRIVATE |MAP_ANONYMOUS ,-1 ,0 );if (mmap_mem ==MAP_FAILED ) {
@@ -1434,11 +1444,11 @@ static void run_with_huge_zeropage(non_anon_test_fn fn, const char *desc) }/* We need a THP-aligned memory area. */ - mem = (char *)(((uintptr_t )mmap_mem + thpsize) & ~(thpsize -1 )); - smem = (char *)(((uintptr_t )mmap_smem + thpsize) & ~(thpsize -1 )); + mem = (char *)(((uintptr_t )mmap_mem + pmdsize) & ~(pmdsize -1 )); + smem = (char *)(((uintptr_t )mmap_smem + pmdsize) & ~(pmdsize -1 )); - ret =madvise (mem, thpsize,MADV_HUGEPAGE ); - ret |=madvise (smem, thpsize,MADV_HUGEPAGE ); + ret =madvise (mem, pmdsize,MADV_HUGEPAGE ); + ret |=madvise (smem, pmdsize,MADV_HUGEPAGE );if (ret) {ksft_test_result_fail ("MADV_HUGEPAGE failed\n" ); goto munmap;
@@ -1457,7 +1467,7 @@ static void run_with_huge_zeropage(non_anon_test_fn fn, const char *desc) goto munmap; } -fn (mem, smem, thpsize); +fn (mem, smem, pmdsize); munmap:munmap (mmap_mem, mmap_size);if (mmap_smem !=MAP_FAILED )
@@ -1650,7 +1660,7 @@ static void run_non_anon_test_case(struct non_anon_test_case const *test_case)run_with_zeropage (test_case->fn, test_case->desc);run_with_memfd (test_case->fn, test_case->desc);run_with_tmpfile (test_case->fn, test_case->desc); -if (thpsize) +if (pmdsize)run_with_huge_zeropage (test_case->fn, test_case->desc);for (i =0 ; i < nr_hugetlbsizes; i++) run_with_memfd_hugetlb(test_case->fn, test_case->desc,
@@ -1671,7 +1681,7 @@ static int tests_per_non_anon_test_case(void) {int tests =3 + nr_hugetlbsizes; -if (thpsize) +if (pmdsize) tests +=1 ;return tests; }
@@ -1683,10 +1693,13 @@ int main(int argc, char **argv)ksft_print_header (); pagesize =getpagesize (); - thpsize =read_pmd_pagesize (); -if (thpsize) + pmdsize =read_pmd_pagesize (); +if (pmdsize) { +ksft_print_msg ("[INFO] detected PMD size: %zu KiB\n" , + pmdsize /1024 );ksft_print_msg ("[INFO] detected THP size: %zu KiB\n" , - thpsize /1024 ); + pmdsize /1024 ); + } nr_hugetlbsizes =detect_hugetlb_page_sizes (hugetlbsizes,ARRAY_SIZE (hugetlbsizes));detect_huge_zeropage ();
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1355/1424 selftests: mm: cow: flag vmsplice() hugetlb tests as XFAIL
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Hildenbrand <[email protected]>
[ Upstream commit 4bf6a4ebc59201bcd12c932f25edda4c3e36e5df ]
Patch series "selftests: mm: cow: flag vmsplice() hugetlb tests as XFAIL".
The failing hugetlb vmsplice() COW tests keep confusing people, and having tests that have been failing for years and likely will keep failing for years to come because nobody cares enough is rather suboptimal. Let's mark them as XFAIL and document why fixing them is not that easy as it would appear at first sight.
More details can be found in [1], especially around how hugetlb pages cannot really be overcommitted, and why we don't particularly care about these vmsplice() leaks for hugetlb -- in contrast to ordinary memory.
[1] https://lore.kernel.org/all/[email protected]/
This patch (of 2):
The vmsplice() hugetlb tests have been failing right from the start, and we documented that in the introducing commit 7dad331be781 ("selftests/vm:anon_cow: hugetlb tests"):
Note that some tests cases still fail. This will, for example, be fixed once vmsplice properly uses FOLL_PIN instead of FOLL_GET for pinning. With 2 MiB and 1 GiB hugetlb on x86_64, the expected failures are:
Until vmsplice() is changed, these tests will likely keep failing: hugetlb COW reuse logic is harder to change, because using the same COW reuse logic as we use for !hugetlb could harm other (sane) users when running out of free hugetlb pages.
More details can be found in [1], especially around how hugetlb pages cannot really be overcommitted, and why we don't particularly care about these vmsplice() leaks for hugetlb -- in contrast to ordinary memory.
These (expected) failures keep confusing people, so flag them accordingly.
Before:
$ ./cow [...] Bail out! 8 out of 778 tests failed # Totals: pass:769 fail:8 xfail:0 xpass:0 skip:1 error:0 $ echo $? 1
After:
$ ./cow [...] # Totals: pass:769 fail:0 xfail:8 xpass:0 skip:1 error:0 $ echo $? 0
[1] https://lore.kernel.org/all/[email protected]/
Stable-dep-of: 4004c130c358 ("selftests/mm: skip COW tmpfile cases when fallocate() is unsupported")
--- tools/testing/selftests/mm/cow.c | 106 +++++++++++++++++++++---------- 1 file changed, 71 insertions(+), 35 deletions(-)
tools/testing/selftests/mm/cow.c +71 -35
@@ -165,7 +165,7 @@ static int child_vmsplice_memcmp_fn(char *mem, size_t size,typedef int (*child_fn )(char *mem,size_t size,struct comm_pipes *comm_pipes);static void do_test_cow_in_parent (char *mem,size_t size,bool do_mprotect, -child_fn fn) +child_fn fn,bool xfail) {struct comm_pipes comm_pipes;char buf;
@@ -213,33 +213,47 @@ static void do_test_cow_in_parent(char *mem, size_t size, bool do_mprotect, else ret = -EINVAL ; -ksft_test_result (!ret,"No leak from parent into child\n" ); +if (!ret) { +ksft_test_result_pass ("No leak from parent into child\n" ); + }else if (xfail) { +/* +* With hugetlb, some vmsplice() tests are currently expected to +* fail because (a) harder to fix and (b) nobody really cares. +* Flag them as expected failure for now. +*/ +ksft_test_result_xfail ("Leak from parent into child\n" ); + }else { +ksft_test_result_fail ("Leak from parent into child\n" ); + } close_comm_pipes:close_comm_pipes (&comm_pipes); } -static void test_cow_in_parent (char *mem,size_t size) +static void test_cow_in_parent (char *mem,size_t size,bool is_hugetlb) { -do_test_cow_in_parent (mem, size, false, child_memcmp_fn); +do_test_cow_in_parent (mem, size, false, child_memcmp_fn, false); } -static void test_cow_in_parent_mprotect (char *mem,size_t size) +static void test_cow_in_parent_mprotect (char *mem,size_t size,bool is_hugetlb) { -do_test_cow_in_parent (mem, size, true, child_memcmp_fn); +do_test_cow_in_parent (mem, size, true, child_memcmp_fn, false); } -static void test_vmsplice_in_child (char *mem,size_t size) +static void test_vmsplice_in_child (char *mem,size_t size,bool is_hugetlb) { -do_test_cow_in_parent (mem, size, false, child_vmsplice_memcmp_fn); +do_test_cow_in_parent (mem, size, false, child_vmsplice_memcmp_fn, + is_hugetlb); } -static void test_vmsplice_in_child_mprotect (char *mem,size_t size) +static void test_vmsplice_in_child_mprotect (char *mem,size_t size, +bool is_hugetlb) { -do_test_cow_in_parent (mem, size, true, child_vmsplice_memcmp_fn); +do_test_cow_in_parent (mem, size, true, child_vmsplice_memcmp_fn, + is_hugetlb); }static void do_test_vmsplice_in_parent (char *mem,size_t size, -bool before_fork) +bool before_fork,bool xfail) {struct iovec iov = { .iov_base = mem,
@@ -321,8 +335,18 @@ static void do_test_vmsplice_in_parent(char *mem, size_t size, } } -ksft_test_result (!memcmp (old, new, transferred), -"No leak from child into parent\n" ); +if (!memcmp (old, new, transferred)) { +ksft_test_result_pass ("No leak from child into parent\n" ); + }else if (xfail) { +/* +* With hugetlb, some vmsplice() tests are currently expected to +* fail because (a) harder to fix and (b) nobody really cares. +* Flag them as expected failure for now. +*/ +ksft_test_result_xfail ("Leak from child into parent\n" ); + }else { +ksft_test_result_fail ("Leak from child into parent\n" ); + } close_pipe:close (fds[0 ]);close (fds[1 ]);
@@ -333,14 +357,14 @@ static void do_test_vmsplice_in_parent(char *mem, size_t size,free (new); } -static void test_vmsplice_before_fork (char *mem,size_t size) +static void test_vmsplice_before_fork (char *mem,size_t size,bool is_hugetlb) { -do_test_vmsplice_in_parent (mem, size, true); +do_test_vmsplice_in_parent (mem, size, true, is_hugetlb); } -static void test_vmsplice_after_fork (char *mem,size_t size) +static void test_vmsplice_after_fork (char *mem,size_t size,bool is_hugetlb) { -do_test_vmsplice_in_parent (mem, size, false); +do_test_vmsplice_in_parent (mem, size, false, is_hugetlb); }#ifdef LOCAL_CONFIG_HAVE_LIBURING
@@ -495,12 +519,12 @@ static void do_test_iouring(char *mem, size_t size, bool use_fork)close_comm_pipes (&comm_pipes); } -static void test_iouring_ro (char *mem,size_t size) +static void test_iouring_ro (char *mem,size_t size,bool is_hugetlb) {do_test_iouring (mem, size, false); } -static void test_iouring_fork (char *mem,size_t size) +static void test_iouring_fork (char *mem,size_t size,bool is_hugetlb) {do_test_iouring (mem, size, true); }
@@ -644,37 +668,41 @@ static void do_test_ro_pin(char *mem, size_t size, enum ro_pin_test test,free (tmp); } -static void test_ro_pin_on_shared (char *mem,size_t size) +static void test_ro_pin_on_shared (char *mem,size_t size,bool is_hugetlb) {do_test_ro_pin (mem, size,RO_PIN_TEST_SHARED , false); } -static void test_ro_fast_pin_on_shared (char *mem,size_t size) +static void test_ro_fast_pin_on_shared (char *mem,size_t size,bool is_hugetlb) {do_test_ro_pin (mem, size,RO_PIN_TEST_SHARED , true); } -static void test_ro_pin_on_ro_previously_shared (char *mem,size_t size) +static void test_ro_pin_on_ro_previously_shared (char *mem,size_t size, +bool is_hugetlb) {do_test_ro_pin (mem, size,RO_PIN_TEST_PREVIOUSLY_SHARED , false); } -static void test_ro_fast_pin_on_ro_previously_shared (char *mem,size_t size) +static void test_ro_fast_pin_on_ro_previously_shared (char *mem,size_t size, +bool is_hugetlb) {do_test_ro_pin (mem, size,RO_PIN_TEST_PREVIOUSLY_SHARED , true); } -static void test_ro_pin_on_ro_exclusive (char *mem,size_t size) +static void test_ro_pin_on_ro_exclusive (char *mem,size_t size, +bool is_hugetlb) {do_test_ro_pin (mem, size,RO_PIN_TEST_RO_EXCLUSIVE , false); } -static void test_ro_fast_pin_on_ro_exclusive (char *mem,size_t size) +static void test_ro_fast_pin_on_ro_exclusive (char *mem,size_t size, +bool is_hugetlb) {do_test_ro_pin (mem, size,RO_PIN_TEST_RO_EXCLUSIVE , true); } -typedef void (*test_fn )(char *mem,size_t size); +typedef void (*test_fn )(char *mem,size_t size,bool hugetlb);static void do_run_with_base_page (test_fn fn,bool swapout) {
@@ -706,7 +734,7 @@ static void do_run_with_base_page(test_fn fn, bool swapout) } } -fn (mem, pagesize); +fn (mem, pagesize, false); munmap:munmap (mem, pagesize); }
@@ -870,7 +898,7 @@ static void do_run_with_thp(test_fn fn, enum thp_run thp_run, size_t thpsize)break ; } -fn (mem, size); +fn (mem, size, false); munmap:munmap (mmap_mem, mmap_size);if (mremap_mem !=MAP_FAILED )
@@ -963,7 +991,7 @@ static void run_with_hugetlb(test_fn fn, const char *desc, size_t hugetlbsize) }munmap (dummy, hugetlbsize); -fn (mem, hugetlbsize); +fn (mem, hugetlbsize, true); munmap:munmap (mem, hugetlbsize); }
@@ -1002,7 +1030,7 @@ static const struct test_case anon_test_cases[] = {*/ {"vmsplice() + unmap in child" , - test_vmsplice_in_child + test_vmsplice_in_child, },/* * vmsplice() test, but do an additional mprotect(PROT_READ)+
@@ -1010,7 +1038,7 @@ static const struct test_case anon_test_cases[] = {*/ {"vmsplice() + unmap in child with mprotect() optimization" , - test_vmsplice_in_child_mprotect + test_vmsplice_in_child_mprotect, },/* * vmsplice() [R/O GUP] in parent before fork(), unmap in parent after
@@ -1275,23 +1303,31 @@ static void do_test_anon_thp_collapse(char *mem, size_t size,close_comm_pipes (&comm_pipes); } -static void test_anon_thp_collapse_unshared (char *mem,size_t size) +static void test_anon_thp_collapse_unshared (char *mem,size_t size, +bool is_hugetlb) { +assert (!is_hugetlb);do_test_anon_thp_collapse (mem, size,ANON_THP_COLLAPSE_UNSHARED ); } -static void test_anon_thp_collapse_fully_shared (char *mem,size_t size) +static void test_anon_thp_collapse_fully_shared (char *mem,size_t size, +bool is_hugetlb) { +assert (!is_hugetlb);do_test_anon_thp_collapse (mem, size,ANON_THP_COLLAPSE_FULLY_SHARED ); } -static void test_anon_thp_collapse_lower_shared (char *mem,size_t size) +static void test_anon_thp_collapse_lower_shared (char *mem,size_t size, +bool is_hugetlb) { +assert (!is_hugetlb);do_test_anon_thp_collapse (mem, size,ANON_THP_COLLAPSE_LOWER_SHARED ); } -static void test_anon_thp_collapse_upper_shared (char *mem,size_t size) +static void test_anon_thp_collapse_upper_shared (char *mem,size_t size, +bool is_hugetlb) { +assert (!is_hugetlb);do_test_anon_thp_collapse (mem, size,ANON_THP_COLLAPSE_UPPER_SHARED ); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1356/1424 selftests/mm/cow: modify the incorrect checking parameters
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao Ge <[email protected]>
[ Upstream commit bf069012df19cf80b460a03c92bfe6320dc268b0 ]
In run_with_memfd_hugetlb(), some error handle have passed incorrect parameters. It should be "smem", but it was mistakenly written as "mem".
Let's fix it.
Stable-dep-of: 4004c130c358 ("selftests/mm: skip COW tmpfile cases when fallocate() is unsupported")
--- tools/testing/selftests/mm/cow.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
tools/testing/selftests/mm/cow.c +5 -5
@@ -1435,7 +1435,7 @@ static void run_with_zeropage(non_anon_test_fn fn, const char *desc) } smem =mmap (NULL , pagesize,PROT_READ ,MAP_PRIVATE |MAP_ANON ,-1 ,0 ); -if (mem ==MAP_FAILED ) { +if (smem ==MAP_FAILED ) {ksft_test_result_fail ("mmap() failed\n" ); goto munmap; }
@@ -1536,7 +1536,7 @@ static void run_with_memfd(non_anon_test_fn fn, const char *desc) goto close; } smem =mmap (NULL , pagesize,PROT_READ ,MAP_SHARED , fd,0 ); -if (mem ==MAP_FAILED ) { +if (smem ==MAP_FAILED ) {ksft_test_result_fail ("mmap() failed\n" ); goto munmap; }
@@ -1587,7 +1587,7 @@ static void run_with_tmpfile(non_anon_test_fn fn, const char *desc) goto close; } smem =mmap (NULL , pagesize,PROT_READ ,MAP_SHARED , fd,0 ); -if (mem ==MAP_FAILED ) { +if (smem ==MAP_FAILED ) {ksft_test_result_fail ("mmap() failed\n" ); goto munmap; }
@@ -1637,7 +1637,7 @@ static void run_with_memfd_hugetlb(non_anon_test_fn fn, const char *desc, goto close; } smem =mmap (NULL , hugetlbsize,PROT_READ ,MAP_SHARED , fd,0 ); -if (mem ==MAP_FAILED ) { +if (smem ==MAP_FAILED ) {ksft_test_result_fail ("mmap() failed\n" ); goto munmap; }
@@ -1649,7 +1649,7 @@ static void run_with_memfd_hugetlb(non_anon_test_fn fn, const char *desc,fn (mem, smem, hugetlbsize); munmap:munmap (mem, hugetlbsize); -if (mem !=MAP_FAILED ) +if (smem !=MAP_FAILED )munmap (smem, hugetlbsize); close:close (fd);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1357/1424 selftests/mm: report unique test names for each cow test
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <[email protected]>
[ Upstream commit 3f2d9a9ac544694e26c8faeb1a044c2bdcd0c793 ]
The kselftest framework uses the string logged when a test result is reported as the unique identifier for a test, using it to track test results between runs. The cow test completely fails to follow this pattern, it runs test functions repeatedly with various parameters with each result report from those functions being a string logging an error message which is fixed between runs.
Since the code already logs each test uniquely before it starts refactor to also print this to a buffer, then use that name as the test result. This isn't especially pretty but is relatively straightforward and is a great help to tooling.
Stable-dep-of: 4004c130c358 ("selftests/mm: skip COW tmpfile cases when fallocate() is unsupported")
--- tools/testing/selftests/mm/cow.c | 333 ++++++++++++++++++++----------- 1 file changed, 217 insertions(+), 116 deletions(-)
tools/testing/selftests/mm/cow.c +217 -116
@@ -78,9 +78,12 @@ struct comm_pipes {static int setup_comm_pipes (struct comm_pipes *comm_pipes) { -if (pipe (comm_pipes->child_ready) <0 ) +if (pipe (comm_pipes->child_ready) <0 ) { +ksft_perror ("pipe()" );return -errno; + }if (pipe (comm_pipes->parent_ready) <0 ) { +ksft_perror ("pipe()" );close (comm_pipes->child_ready[0 ]);close (comm_pipes->child_ready[1 ]);return -errno;
@@ -173,13 +176,14 @@ static void do_test_cow_in_parent(char *mem, size_t size, bool do_mprotect, ret =setup_comm_pipes (&comm_pipes);if (ret) { -ksft_test_result_fail ("pipe() failed\n" ); +log_test_result (KSFT_FAIL );return ; } ret =fork ();if (ret <0 ) { -ksft_test_result_fail ("fork() failed\n" ); +ksft_perror ("fork() failed" ); +log_test_result (KSFT_FAIL ); goto close_comm_pipes; }else if (!ret) {exit (fn (mem, size, &comm_pipes));
@@ -194,9 +198,18 @@ static void do_test_cow_in_parent(char *mem, size_t size, bool do_mprotect,* write-faults by directly mapping pages writable. */ ret =mprotect (mem, size,PROT_READ ); - ret |=mprotect (mem, size,PROT_READ |PROT_WRITE );if (ret) { -ksft_test_result_fail ("mprotect() failed\n" ); +ksft_perror ("mprotect() failed" ); +log_test_result (KSFT_FAIL ); +write (comm_pipes.parent_ready[1 ],"0" ,1 ); +wait (&ret); + goto close_comm_pipes; + } + + ret =mprotect (mem, size,PROT_READ |PROT_WRITE ); +if (ret) { +ksft_perror ("mprotect() failed" ); +log_test_result (KSFT_FAIL );write (comm_pipes.parent_ready[1 ],"0" ,1 );wait (&ret); goto close_comm_pipes;
@@ -214,16 +227,16 @@ static void do_test_cow_in_parent(char *mem, size_t size, bool do_mprotect, ret = -EINVAL ;if (!ret) { -ksft_test_result_pass ("No leak from parent into child\n" ); +log_test_result (KSFT_PASS ); }else if (xfail) {/* * With hugetlb, some vmsplice() tests are currently expected to * fail because (a) harder to fix and (b) nobody really cares. * Flag them as expected failure for now. */ -ksft_test_result_xfail ("Leak from parent into child\n" ); +log_test_result (KSFT_XFAIL ); }else { -ksft_test_result_fail ("Leak from parent into child\n" ); +log_test_result (KSFT_FAIL ); } close_comm_pipes:close_comm_pipes (&comm_pipes);
@@ -272,26 +285,29 @@ static void do_test_vmsplice_in_parent(char *mem, size_t size, ret =setup_comm_pipes (&comm_pipes);if (ret) { -ksft_test_result_fail ("pipe() failed\n" ); +log_test_result (KSFT_FAIL ); goto free; }if (pipe (fds) <0 ) { -ksft_test_result_fail ("pipe() failed\n" ); +ksft_perror ("pipe() failed" ); +log_test_result (KSFT_FAIL ); goto close_comm_pipes; }if (before_fork) { transferred =vmsplice (fds[1 ], &iov,1 ,0 );if (transferred <=0 ) { -ksft_test_result_fail ("vmsplice() failed\n" ); +ksft_print_msg ("vmsplice() failed\n" ); +log_test_result (KSFT_FAIL ); goto close_pipe; } } ret =fork ();if (ret <0 ) { -ksft_test_result_fail ("fork() failed\n" ); +ksft_perror ("fork() failed\n" ); +log_test_result (KSFT_FAIL ); goto close_pipe; }else if (!ret) {write (comm_pipes.child_ready[1 ],"0" ,1 );
@@ -305,7 +321,8 @@ static void do_test_vmsplice_in_parent(char *mem, size_t size,if (!before_fork) { transferred =vmsplice (fds[1 ], &iov,1 ,0 );if (transferred <=0 ) { -ksft_test_result_fail ("vmsplice() failed\n" ); +ksft_perror ("vmsplice() failed" ); +log_test_result (KSFT_FAIL );wait (&ret); goto close_pipe; }
@@ -314,7 +331,8 @@ static void do_test_vmsplice_in_parent(char *mem, size_t size,while (read (comm_pipes.child_ready[0 ], &buf,1 ) !=1 ) ;if (munmap (mem, size) <0 ) { -ksft_test_result_fail ("munmap() failed\n" ); +ksft_perror ("munmap() failed" ); +log_test_result (KSFT_FAIL ); goto close_pipe; }write (comm_pipes.parent_ready[1 ],"0" ,1 );
@@ -322,7 +340,8 @@ static void do_test_vmsplice_in_parent(char *mem, size_t size,/* Wait until the child is done writing. */ wait (&ret);if (!WIFEXITED (ret)) { -ksft_test_result_fail ("wait() failed\n" ); +ksft_perror ("wait() failed" ); +log_test_result (KSFT_FAIL ); goto close_pipe; }
@@ -330,22 +349,23 @@ static void do_test_vmsplice_in_parent(char *mem, size_t size,for (total =0 ; total < transferred; total += cur) { cur =read (fds[0 ], new + total, transferred - total);if (cur <0 ) { -ksft_test_result_fail ("read() failed\n" ); +ksft_perror ("read() failed" ); +log_test_result (KSFT_FAIL ); goto close_pipe; } }if (!memcmp (old, new, transferred)) { -ksft_test_result_pass ("No leak from child into parent\n" ); +log_test_result (KSFT_PASS ); }else if (xfail) {/* * With hugetlb, some vmsplice() tests are currently expected to * fail because (a) harder to fix and (b) nobody really cares. * Flag them as expected failure for now. */ -ksft_test_result_xfail ("Leak from child into parent\n" ); +log_test_result (KSFT_XFAIL ); }else { -ksft_test_result_fail ("Leak from child into parent\n" ); +log_test_result (KSFT_FAIL ); } close_pipe:close (fds[0 ]);
@@ -382,13 +402,14 @@ static void do_test_iouring(char *mem, size_t size, bool use_fork) ret =setup_comm_pipes (&comm_pipes);if (ret) { -ksft_test_result_fail ("pipe() failed\n" ); +log_test_result (KSFT_FAIL );return ; } file =tmpfile ();if (!file) { -ksft_test_result_fail ("tmpfile() failed\n" ); +ksft_perror ("tmpfile() failed" ); +log_test_result (KSFT_FAIL ); goto close_comm_pipes; } fd =fileno (file);
@@ -396,14 +417,16 @@ static void do_test_iouring(char *mem, size_t size, bool use_fork) tmp =malloc (size);if (!tmp) { -ksft_test_result_fail ("malloc() failed\n" ); +ksft_print_msg ("malloc() failed\n" ); +log_test_result (KSFT_FAIL ); goto close_file; }/* Skip on errors, as we might just lack kernel support. */ ret =io_uring_queue_init (1 , &ring,0 );if (ret <0 ) { -ksft_test_result_skip ("io_uring_queue_init() failed\n" ); +ksft_print_msg ("io_uring_queue_init() failed\n" ); +log_test_result (KSFT_SKIP ); goto free_tmp; }
@@ -418,7 +441,8 @@ static void do_test_iouring(char *mem, size_t size, bool use_fork) iov.iov_len = size; ret =io_uring_register_buffers (&ring, &iov,1 );if (ret) { -ksft_test_result_skip ("io_uring_register_buffers() failed\n" ); +ksft_print_msg ("io_uring_register_buffers() failed\n" ); +log_test_result (KSFT_SKIP ); goto queue_exit; }
@@ -429,7 +453,8 @@ static void do_test_iouring(char *mem, size_t size, bool use_fork)*/ ret =fork ();if (ret <0 ) { -ksft_test_result_fail ("fork() failed\n" ); +ksft_perror ("fork() failed" ); +log_test_result (KSFT_FAIL ); goto unregister_buffers; }else if (!ret) {write (comm_pipes.child_ready[1 ],"0" ,1 );
@@ -449,10 +474,17 @@ static void do_test_iouring(char *mem, size_t size, bool use_fork)* if the page is mapped R/O vs. R/W). */ ret =mprotect (mem, size,PROT_READ ); +if (ret) { +ksft_perror ("mprotect() failed" ); +log_test_result (KSFT_FAIL ); + goto unregister_buffers; + } +clear_softdirty (); - ret |=mprotect (mem, size,PROT_READ |PROT_WRITE ); + ret =mprotect (mem, size,PROT_READ |PROT_WRITE );if (ret) { -ksft_test_result_fail ("mprotect() failed\n" ); +ksft_perror ("mprotect() failed" ); +log_test_result (KSFT_FAIL ); goto unregister_buffers; } }
@@ -464,25 +496,29 @@ static void do_test_iouring(char *mem, size_t size, bool use_fork)memset (mem,0xff , size); sqe =io_uring_get_sqe (&ring);if (!sqe) { -ksft_test_result_fail ("io_uring_get_sqe() failed\n" ); +ksft_print_msg ("io_uring_get_sqe() failed\n" ); +log_test_result (KSFT_FAIL ); goto quit_child; }io_uring_prep_write_fixed (sqe, fd, mem, size,0 ,0 ); ret =io_uring_submit (&ring);if (ret <0 ) { -ksft_test_result_fail ("io_uring_submit() failed\n" ); +ksft_print_msg ("io_uring_submit() failed\n" ); +log_test_result (KSFT_FAIL ); goto quit_child; } ret =io_uring_wait_cqe (&ring, &cqe);if (ret <0 ) { -ksft_test_result_fail ("io_uring_wait_cqe() failed\n" ); +ksft_print_msg ("io_uring_wait_cqe() failed\n" ); +log_test_result (KSFT_FAIL ); goto quit_child; }if (cqe->res != size) { -ksft_test_result_fail ("write_fixed failed\n" ); +ksft_print_msg ("write_fixed failed\n" ); +log_test_result (KSFT_FAIL ); goto quit_child; }io_uring_cqe_seen (&ring, cqe);
@@ -492,15 +528,18 @@ static void do_test_iouring(char *mem, size_t size, bool use_fork)while (total < size) { cur =pread (fd, tmp + total, size - total, total);if (cur <0 ) { -ksft_test_result_fail ("pread() failed\n" ); +ksft_print_msg ("pread() failed\n" ); +log_test_result (KSFT_FAIL ); goto quit_child; } total += cur; }/* Finally, check if we read what we expected. */ -ksft_test_result (!memcmp (mem, tmp, size), -"Longterm R/W pin is reliable\n" ); +if (!memcmp (mem, tmp, size)) +log_test_result (KSFT_PASS ); +else +log_test_result (KSFT_FAIL ); quit_child:if (use_fork) {
@@ -548,19 +587,21 @@ static void do_test_ro_pin(char *mem, size_t size, enum ro_pin_test test,int ret;if (gup_fd <0 ) { -ksft_test_result_skip ("gup_test not available\n" ); +ksft_print_msg ("gup_test not available\n" ); +log_test_result (KSFT_SKIP );return ; } tmp =malloc (size);if (!tmp) { -ksft_test_result_fail ("malloc() failed\n" ); +ksft_print_msg ("malloc() failed\n" ); +log_test_result (KSFT_FAIL );return ; } ret =setup_comm_pipes (&comm_pipes);if (ret) { -ksft_test_result_fail ("pipe() failed\n" ); +log_test_result (KSFT_FAIL ); goto free_tmp; }
@@ -575,7 +616,8 @@ static void do_test_ro_pin(char *mem, size_t size, enum ro_pin_test test,*/ ret =fork ();if (ret <0 ) { -ksft_test_result_fail ("fork() failed\n" ); +ksft_perror ("fork() failed" ); +log_test_result (KSFT_FAIL ); goto close_comm_pipes; }else if (!ret) {write (comm_pipes.child_ready[1 ],"0" ,1 );
@@ -612,7 +654,8 @@ static void do_test_ro_pin(char *mem, size_t size, enum ro_pin_test test,clear_softdirty (); ret |=mprotect (mem, size,PROT_READ |PROT_WRITE );if (ret) { -ksft_test_result_fail ("mprotect() failed\n" ); +ksft_perror ("mprotect() failed" ); +log_test_result (KSFT_FAIL ); goto close_comm_pipes; }break ;
@@ -627,9 +670,11 @@ static void do_test_ro_pin(char *mem, size_t size, enum ro_pin_test test, ret =ioctl (gup_fd,PIN_LONGTERM_TEST_START , &args);if (ret) {if (errno ==EINVAL ) -ksft_test_result_skip ("PIN_LONGTERM_TEST_START failed\n" ); + ret =KSFT_SKIP ;else -ksft_test_result_fail ("PIN_LONGTERM_TEST_START failed\n" ); + ret =KSFT_FAIL ; +ksft_perror ("PIN_LONGTERM_TEST_START failed" ); +log_test_result (ret); goto wait; }
@@ -642,22 +687,26 @@ static void do_test_ro_pin(char *mem, size_t size, enum ro_pin_test test,*/ tmp_val = (__u64 )(uintptr_t )tmp; ret =ioctl (gup_fd,PIN_LONGTERM_TEST_READ , &tmp_val); -if (ret) -ksft_test_result_fail ("PIN_LONGTERM_TEST_READ failed\n" ); -else -ksft_test_result (!memcmp (mem, tmp, size), -"Longterm R/O pin is reliable\n" ); +if (ret) { +ksft_perror ("PIN_LONGTERM_TEST_READ failed" ); +log_test_result (KSFT_FAIL ); + }else { +if (!memcmp (mem, tmp, size)) +log_test_result (KSFT_PASS ); +else +log_test_result (KSFT_FAIL ); + } ret =ioctl (gup_fd,PIN_LONGTERM_TEST_STOP );if (ret) -ksft_print_msg ("[INFO] PIN_LONGTERM_TEST_STOP failed\n" ); +ksft_perror ("PIN_LONGTERM_TEST_STOP failed" ); wait:switch (test) {case RO_PIN_TEST_SHARED :write (comm_pipes.parent_ready[1 ],"0" ,1 );wait (&ret);if (!WIFEXITED (ret)) -ksft_print_msg ("[INFO] wait() failed\n" ); +ksft_perror ("wait() failed" );break ;default :break ;
@@ -712,14 +761,16 @@ static void do_run_with_base_page(test_fn fn, bool swapout) mem =mmap (NULL , pagesize,PROT_READ |PROT_WRITE ,MAP_PRIVATE |MAP_ANONYMOUS ,-1 ,0 );if (mem ==MAP_FAILED ) { -ksft_test_result_fail ("mmap() failed\n" ); +ksft_perror ("mmap() failed" ); +log_test_result (KSFT_FAIL );return ; } ret =madvise (mem, pagesize,MADV_NOHUGEPAGE );/* Ignore if not around on a kernel. */ if (ret && errno !=EINVAL ) { -ksft_test_result_fail ("MADV_NOHUGEPAGE failed\n" ); +ksft_perror ("MADV_NOHUGEPAGE failed" ); +log_test_result (KSFT_FAIL ); goto munmap; }
@@ -729,7 +780,8 @@ static void do_run_with_base_page(test_fn fn, bool swapout)if (swapout) {madvise (mem, pagesize,MADV_PAGEOUT );if (!pagemap_is_swapped (pagemap_fd, mem)) { -ksft_test_result_skip ("MADV_PAGEOUT did not work, is swap enabled?\n" ); +ksft_print_msg ("MADV_PAGEOUT did not work, is swap enabled?\n" ); +log_test_result (KSFT_SKIP ); goto munmap; } }
@@ -741,13 +793,13 @@ static void do_run_with_base_page(test_fn fn, bool swapout)static void run_with_base_page (test_fn fn,const char *desc) { -ksft_print_msg ("[RUN] %s ... with base page\n" , desc); +log_test_start ("%s ... with base page" , desc);do_run_with_base_page (fn, false); }static void run_with_base_page_swap (test_fn fn,const char *desc) { -ksft_print_msg ("[RUN] %s ... with swapped out base page\n" , desc); +log_test_start ("%s ... with swapped out base page" , desc);do_run_with_base_page (fn, true); }
@@ -773,7 +825,8 @@ static void do_run_with_thp(test_fn fn, enum thp_run thp_run, size_t thpsize) mmap_mem =mmap (NULL , mmap_size,PROT_READ |PROT_WRITE ,MAP_PRIVATE |MAP_ANONYMOUS ,-1 ,0 );if (mmap_mem ==MAP_FAILED ) { -ksft_test_result_fail ("mmap() failed\n" ); +ksft_perror ("mmap() failed" ); +log_test_result (KSFT_FAIL );return ; }
@@ -782,7 +835,8 @@ static void do_run_with_thp(test_fn fn, enum thp_run thp_run, size_t thpsize) ret =madvise (mem, thpsize,MADV_HUGEPAGE );if (ret) { -ksft_test_result_fail ("MADV_HUGEPAGE failed\n" ); +ksft_perror ("MADV_HUGEPAGE failed" ); +log_test_result (KSFT_FAIL ); goto munmap; }
@@ -792,7 +846,8 @@ static void do_run_with_thp(test_fn fn, enum thp_run thp_run, size_t thpsize)*/ mem[0 ] =0 ;if (!pagemap_is_populated (pagemap_fd, mem + thpsize - pagesize)) { -ksft_test_result_skip ("Did not get a THP populated\n" ); +ksft_print_msg ("Did not get a THP populated\n" ); +log_test_result (KSFT_SKIP ); goto munmap; }memset (mem,0 , thpsize);
@@ -812,12 +867,14 @@ static void do_run_with_thp(test_fn fn, enum thp_run thp_run, size_t thpsize)*/ ret =mprotect (mem + pagesize, pagesize,PROT_READ );if (ret) { -ksft_test_result_fail ("mprotect() failed\n" ); +ksft_perror ("mprotect() failed" ); +log_test_result (KSFT_FAIL ); goto munmap; } ret =mprotect (mem + pagesize, pagesize,PROT_READ |PROT_WRITE );if (ret) { -ksft_test_result_fail ("mprotect() failed\n" ); +ksft_perror ("mprotect() failed" ); +log_test_result (KSFT_FAIL ); goto munmap; }break ;
@@ -829,7 +886,8 @@ static void do_run_with_thp(test_fn fn, enum thp_run thp_run, size_t thpsize)*/ ret =madvise (mem + pagesize, thpsize - pagesize,MADV_DONTNEED );if (ret) { -ksft_test_result_fail ("MADV_DONTNEED failed\n" ); +ksft_perror ("MADV_DONTNEED failed" ); +log_test_result (KSFT_FAIL ); goto munmap; } size = pagesize;
@@ -843,13 +901,15 @@ static void do_run_with_thp(test_fn fn, enum thp_run thp_run, size_t thpsize) mremap_mem =mmap (NULL , mremap_size,PROT_NONE ,MAP_PRIVATE |MAP_ANONYMOUS ,-1 ,0 );if (mremap_mem ==MAP_FAILED ) { -ksft_test_result_fail ("mmap() failed\n" ); +ksft_perror ("mmap() failed" ); +log_test_result (KSFT_FAIL ); goto munmap; } tmp =mremap (mem + mremap_size, mremap_size, mremap_size,MREMAP_MAYMOVE |MREMAP_FIXED , mremap_mem);if (tmp != mremap_mem) { -ksft_test_result_fail ("mremap() failed\n" ); +ksft_perror ("mremap() failed" ); +log_test_result (KSFT_FAIL ); goto munmap; } size = mremap_size;
@@ -862,12 +922,14 @@ static void do_run_with_thp(test_fn fn, enum thp_run thp_run, size_t thpsize)*/ ret =madvise (mem + pagesize, thpsize - pagesize,MADV_DONTFORK );if (ret) { -ksft_test_result_fail ("MADV_DONTFORK failed\n" ); +ksft_perror ("MADV_DONTFORK failed" ); +log_test_result (KSFT_FAIL ); goto munmap; } ret =fork ();if (ret <0 ) { -ksft_test_result_fail ("fork() failed\n" ); +ksft_perror ("fork() failed" ); +log_test_result (KSFT_FAIL ); goto munmap; }else if (!ret) {exit (0 );
@@ -876,7 +938,8 @@ static void do_run_with_thp(test_fn fn, enum thp_run thp_run, size_t thpsize)/* Allow for sharing all pages again. */ ret =madvise (mem + pagesize, thpsize - pagesize,MADV_DOFORK );if (ret) { -ksft_test_result_fail ("MADV_DOFORK failed\n" ); +ksft_perror ("MADV_DOFORK failed" ); +log_test_result (KSFT_FAIL ); goto munmap; }break ;
@@ -890,7 +953,8 @@ static void do_run_with_thp(test_fn fn, enum thp_run thp_run, size_t thpsize)case THP_RUN_SINGLE_PTE_SWAPOUT :madvise (mem, size,MADV_PAGEOUT );if (!range_is_swapped (mem, size)) { -ksft_test_result_skip ("MADV_PAGEOUT did not work, is swap enabled?\n" ); +ksft_print_msg ("MADV_PAGEOUT did not work, is swap enabled?\n" ); +log_test_result (KSFT_SKIP ); goto munmap; }break ;
@@ -907,56 +971,56 @@ static void do_run_with_thp(test_fn fn, enum thp_run thp_run, size_t thpsize)static void run_with_thp (test_fn fn,const char *desc,size_t size) { -ksft_print_msg ("[RUN] %s ... with THP (%zu kB)\n" , +log_test_start ("%s ... with THP (%zu kB)" , desc, size /1024 );do_run_with_thp (fn,THP_RUN_PMD , size); }static void run_with_thp_swap (test_fn fn,const char *desc,size_t size) { -ksft_print_msg ("[RUN] %s ... with swapped-out THP (%zu kB)\n" , +log_test_start ("%s ... with swapped-out THP (%zu kB)" , desc, size /1024 );do_run_with_thp (fn,THP_RUN_PMD_SWAPOUT , size); }static void run_with_pte_mapped_thp (test_fn fn,const char *desc,size_t size) { -ksft_print_msg ("[RUN] %s ... with PTE-mapped THP (%zu kB)\n" , +log_test_start ("%s ... with PTE-mapped THP (%zu kB)" , desc, size /1024 );do_run_with_thp (fn,THP_RUN_PTE , size); }static void run_with_pte_mapped_thp_swap (test_fn fn,const char *desc,size_t size) { -ksft_print_msg ("[RUN] %s ... with swapped-out, PTE-mapped THP (%zu kB)\n" , +log_test_start ("%s ... with swapped-out, PTE-mapped THP (%zu kB)" , desc, size /1024 );do_run_with_thp (fn,THP_RUN_PTE_SWAPOUT , size); }static void run_with_single_pte_of_thp (test_fn fn,const char *desc,size_t size) { -ksft_print_msg ("[RUN] %s ... with single PTE of THP (%zu kB)\n" , +log_test_start ("%s ... with single PTE of THP (%zu kB)" , desc, size /1024 );do_run_with_thp (fn,THP_RUN_SINGLE_PTE , size); }static void run_with_single_pte_of_thp_swap (test_fn fn,const char *desc,size_t size) { -ksft_print_msg ("[RUN] %s ... with single PTE of swapped-out THP (%zu kB)\n" , +log_test_start ("%s ... with single PTE of swapped-out THP (%zu kB)" , desc, size /1024 );do_run_with_thp (fn,THP_RUN_SINGLE_PTE_SWAPOUT , size); }static void run_with_partial_mremap_thp (test_fn fn,const char *desc,size_t size) { -ksft_print_msg ("[RUN] %s ... with partially mremap()'ed THP (%zu kB)\n" , +log_test_start ("%s ... with partially mremap()'ed THP (%zu kB)" , desc, size /1024 );do_run_with_thp (fn,THP_RUN_PARTIAL_MREMAP , size); }static void run_with_partial_shared_thp (test_fn fn,const char *desc,size_t size) { -ksft_print_msg ("[RUN] %s ... with partially shared THP (%zu kB)\n" , +log_test_start ("%s ... with partially shared THP (%zu kB)" , desc, size /1024 );do_run_with_thp (fn,THP_RUN_PARTIAL_SHARED , size); }
@@ -966,14 +1030,15 @@ static void run_with_hugetlb(test_fn fn, const char *desc, size_t hugetlbsize)int flags =MAP_PRIVATE |MAP_ANONYMOUS |MAP_HUGETLB ;char *mem, *dummy; -ksft_print_msg ("[RUN] %s ... with hugetlb (%zu kB)\n" , desc, +log_test_start ("%s ... with hugetlb (%zu kB)" , desc, hugetlbsize /1024 ); flags |=__builtin_ctzll (hugetlbsize) <<MAP_HUGE_SHIFT ; mem =mmap (NULL , hugetlbsize,PROT_READ |PROT_WRITE , flags,-1 ,0 );if (mem ==MAP_FAILED ) { -ksft_test_result_skip ("need more free huge pages\n" ); +ksft_perror ("need more free huge pages" ); +log_test_result (KSFT_SKIP );return ; }
@@ -986,7 +1051,8 @@ static void run_with_hugetlb(test_fn fn, const char *desc, size_t hugetlbsize)*/ dummy =mmap (NULL , hugetlbsize,PROT_READ |PROT_WRITE , flags,-1 ,0 );if (dummy ==MAP_FAILED ) { -ksft_test_result_skip ("need more free huge pages\n" ); +ksft_perror ("need more free huge pages" ); +log_test_result (KSFT_SKIP ); goto munmap; }munmap (dummy, hugetlbsize);
@@ -1179,7 +1245,7 @@ static void do_test_anon_thp_collapse(char *mem, size_t size, ret =setup_comm_pipes (&comm_pipes);if (ret) { -ksft_test_result_fail ("pipe() failed\n" ); +log_test_result (KSFT_FAIL );return ; }
@@ -1189,12 +1255,14 @@ static void do_test_anon_thp_collapse(char *mem, size_t size,*/ ret =mprotect (mem + pagesize, pagesize,PROT_READ );if (ret) { -ksft_test_result_fail ("mprotect() failed\n" ); +ksft_perror ("mprotect() failed" ); +log_test_result (KSFT_FAIL ); goto close_comm_pipes; } ret =mprotect (mem + pagesize, pagesize,PROT_READ |PROT_WRITE );if (ret) { -ksft_test_result_fail ("mprotect() failed\n" ); +ksft_perror ("mprotect() failed" ); +log_test_result (KSFT_FAIL ); goto close_comm_pipes; }
@@ -1203,8 +1271,8 @@ static void do_test_anon_thp_collapse(char *mem, size_t size,/* Collapse before actually COW-sharing the page. */ ret =madvise (mem, size,MADV_COLLAPSE );if (ret) { -ksft_test_result_skip ("MADV_COLLAPSE failed: %s\n" , -strerror (errno)); +ksft_perror ("MADV_COLLAPSE failed" ); +log_test_result (KSFT_SKIP ); goto close_comm_pipes; }break ;
@@ -1215,7 +1283,8 @@ static void do_test_anon_thp_collapse(char *mem, size_t size,/* Don't COW-share the upper part of the THP. */ ret =madvise (mem + size /2 , size /2 ,MADV_DONTFORK );if (ret) { -ksft_test_result_fail ("MADV_DONTFORK failed\n" ); +ksft_perror ("MADV_DONTFORK failed" ); +log_test_result (KSFT_FAIL ); goto close_comm_pipes; }break ;
@@ -1223,7 +1292,8 @@ static void do_test_anon_thp_collapse(char *mem, size_t size,/* Don't COW-share the lower part of the THP. */ ret =madvise (mem, size /2 ,MADV_DONTFORK );if (ret) { -ksft_test_result_fail ("MADV_DONTFORK failed\n" ); +ksft_perror ("MADV_DONTFORK failed" ); +log_test_result (KSFT_FAIL ); goto close_comm_pipes; }break ;
@@ -1233,7 +1303,8 @@ static void do_test_anon_thp_collapse(char *mem, size_t size, ret =fork ();if (ret <0 ) { -ksft_test_result_fail ("fork() failed\n" ); +ksft_perror ("fork() failed" ); +log_test_result (KSFT_FAIL ); goto close_comm_pipes; }else if (!ret) {switch (test) {
@@ -1267,7 +1338,8 @@ static void do_test_anon_thp_collapse(char *mem, size_t size,*/ ret =madvise (mem, size,MADV_DOFORK );if (ret) { -ksft_test_result_fail ("MADV_DOFORK failed\n" ); +ksft_perror ("MADV_DOFORK failed" ); +log_test_result (KSFT_FAIL );write (comm_pipes.parent_ready[1 ],"0" ,1 );wait (&ret); goto close_comm_pipes;
@@ -1277,8 +1349,8 @@ static void do_test_anon_thp_collapse(char *mem, size_t size,/* Collapse before anyone modified the COW-shared page. */ ret =madvise (mem, size,MADV_COLLAPSE );if (ret) { -ksft_test_result_skip ("MADV_COLLAPSE failed: %s\n" , -strerror (errno)); +ksft_perror ("MADV_COLLAPSE failed" ); +log_test_result (KSFT_SKIP );write (comm_pipes.parent_ready[1 ],"0" ,1 );wait (&ret); goto close_comm_pipes;
@@ -1298,7 +1370,10 @@ static void do_test_anon_thp_collapse(char *mem, size_t size,else ret = -EINVAL ; -ksft_test_result (!ret,"No leak from parent into child\n" ); +if (!ret) +log_test_result (KSFT_PASS ); +else +log_test_result (KSFT_FAIL ); close_comm_pipes:close_comm_pipes (&comm_pipes); }
@@ -1383,7 +1458,7 @@ static void run_anon_thp_test_cases(void)for (i =0 ; i <ARRAY_SIZE (anon_thp_test_cases); i++) {struct test_case const *test_case = &anon_thp_test_cases[i]; -ksft_print_msg ("[RUN] %s\n" , test_case->desc); +log_test_start ("%s" , test_case->desc);do_run_with_thp (test_case->fn,THP_RUN_PMD , pmdsize); } }
@@ -1406,8 +1481,10 @@ static void test_cow(char *mem, const char *smem, size_t size)memset (mem,0xff , size);/* See if we still read the old values via the other mapping. */ -ksft_test_result (!memcmp (smem, old, size), -"Other mapping not modified\n" ); +if (!memcmp (smem, old, size)) +log_test_result (KSFT_PASS ); +else +log_test_result (KSFT_FAIL );free (old); }
@@ -1425,18 +1502,20 @@ static void run_with_zeropage(non_anon_test_fn fn, const char *desc) {char *mem, *smem, tmp; -ksft_print_msg ("[RUN] %s ... with shared zeropage\n" , desc); +log_test_start ("%s ... with shared zeropage" , desc); mem =mmap (NULL , pagesize,PROT_READ |PROT_WRITE ,MAP_PRIVATE |MAP_ANON ,-1 ,0 );if (mem ==MAP_FAILED ) { -ksft_test_result_fail ("mmap() failed\n" ); +ksft_perror ("mmap() failed" ); +log_test_result (KSFT_FAIL );return ; } smem =mmap (NULL , pagesize,PROT_READ ,MAP_PRIVATE |MAP_ANON ,-1 ,0 );if (smem ==MAP_FAILED ) { -ksft_test_result_fail ("mmap() failed\n" ); +ksft_perror ("mmap() failed" ); +log_test_result (KSFT_FAIL ); goto munmap; }
@@ -1457,10 +1536,11 @@ static void run_with_huge_zeropage(non_anon_test_fn fn, const char *desc)size_t mmap_size;int ret; -ksft_print_msg ("[RUN] %s ... with huge zeropage\n" , desc); +log_test_start ("%s ... with huge zeropage" , desc);if (!has_huge_zeropage) { -ksft_test_result_skip ("Huge zeropage not enabled\n" ); +ksft_print_msg ("Huge zeropage not enabled\n" ); +log_test_result (KSFT_SKIP );return ; }
@@ -1469,13 +1549,15 @@ static void run_with_huge_zeropage(non_anon_test_fn fn, const char *desc) mmap_mem =mmap (NULL , mmap_size,PROT_READ |PROT_WRITE ,MAP_PRIVATE |MAP_ANONYMOUS ,-1 ,0 );if (mmap_mem ==MAP_FAILED ) { -ksft_test_result_fail ("mmap() failed\n" ); +ksft_perror ("mmap() failed" ); +log_test_result (KSFT_FAIL );return ; } mmap_smem =mmap (NULL , mmap_size,PROT_READ ,MAP_PRIVATE |MAP_ANONYMOUS ,-1 ,0 );if (mmap_smem ==MAP_FAILED ) { -ksft_test_result_fail ("mmap() failed\n" ); +ksft_perror ("mmap() failed" ); +log_test_result (KSFT_FAIL ); goto munmap; }
@@ -1484,9 +1566,15 @@ static void run_with_huge_zeropage(non_anon_test_fn fn, const char *desc) smem = (char *)(((uintptr_t )mmap_smem + pmdsize) & ~(pmdsize -1 )); ret =madvise (mem, pmdsize,MADV_HUGEPAGE ); +if (ret !=0 ) { +ksft_perror ("madvise()" ); +log_test_result (KSFT_FAIL ); + goto munmap; + } ret |=madvise (smem, pmdsize,MADV_HUGEPAGE ); -if (ret) { -ksft_test_result_fail ("MADV_HUGEPAGE failed\n" ); +if (ret !=0 ) { +ksft_perror ("madvise()" ); +log_test_result (KSFT_FAIL ); goto munmap; }
@@ -1515,29 +1603,33 @@ static void run_with_memfd(non_anon_test_fn fn, const char *desc)char *mem, *smem, tmp;int fd; -ksft_print_msg ("[RUN] %s ... with memfd\n" , desc); +log_test_start ("%s ... with memfd" , desc); fd =memfd_create ("test" ,0 );if (fd <0 ) { -ksft_test_result_fail ("memfd_create() failed\n" ); +ksft_perror ("memfd_create() failed" ); +log_test_result (KSFT_FAIL );return ; }/* File consists of a single page filled with zeroes. */ if (fallocate (fd,0 ,0 , pagesize)) { -ksft_test_result_fail ("fallocate() failed\n" ); +ksft_perror ("fallocate() failed" ); +log_test_result (KSFT_FAIL ); goto close; }/* Create a private mapping of the memfd. */ mem =mmap (NULL , pagesize,PROT_READ |PROT_WRITE ,MAP_PRIVATE , fd,0 );if (mem ==MAP_FAILED ) { -ksft_test_result_fail ("mmap() failed\n" ); +ksft_perror ("mmap() failed" ); +log_test_result (KSFT_FAIL ); goto close; } smem =mmap (NULL , pagesize,PROT_READ ,MAP_SHARED , fd,0 );if (smem ==MAP_FAILED ) { -ksft_test_result_fail ("mmap() failed\n" ); +ksft_perror ("mmap() failed" ); +log_test_result (KSFT_FAIL ); goto munmap; }
@@ -1560,35 +1652,40 @@ static void run_with_tmpfile(non_anon_test_fn fn, const char *desc)FILE *file;int fd; -ksft_print_msg ("[RUN] %s ... with tmpfile\n" , desc); +log_test_start ("%s ... with tmpfile" , desc); file =tmpfile ();if (!file) { -ksft_test_result_fail ("tmpfile() failed\n" ); +ksft_perror ("tmpfile() failed" ); +log_test_result (KSFT_FAIL );return ; } fd =fileno (file);if (fd <0 ) { -ksft_test_result_skip ("fileno() failed\n" ); +ksft_perror ("fileno() failed" ); +log_test_result (KSFT_SKIP );return ; }/* File consists of a single page filled with zeroes. */ if (fallocate (fd,0 ,0 , pagesize)) { -ksft_test_result_fail ("fallocate() failed\n" ); +ksft_perror ("fallocate() failed" ); +log_test_result (KSFT_FAIL ); goto close; }/* Create a private mapping of the memfd. */ mem =mmap (NULL , pagesize,PROT_READ |PROT_WRITE ,MAP_PRIVATE , fd,0 );if (mem ==MAP_FAILED ) { -ksft_test_result_fail ("mmap() failed\n" ); +ksft_perror ("mmap() failed" ); +log_test_result (KSFT_FAIL ); goto close; } smem =mmap (NULL , pagesize,PROT_READ ,MAP_SHARED , fd,0 );if (smem ==MAP_FAILED ) { -ksft_test_result_fail ("mmap() failed\n" ); +ksft_perror ("mmap() failed" ); +log_test_result (KSFT_FAIL ); goto munmap; }
@@ -1612,20 +1709,22 @@ static void run_with_memfd_hugetlb(non_anon_test_fn fn, const char *desc,char *mem, *smem, tmp;int fd; -ksft_print_msg ("[RUN] %s ... with memfd hugetlb (%zu kB)\n" , desc, +log_test_start ("%s ... with memfd hugetlb (%zu kB)" , desc, hugetlbsize /1024 ); flags |=__builtin_ctzll (hugetlbsize) <<MFD_HUGE_SHIFT ; fd =memfd_create ("test" , flags);if (fd <0 ) { -ksft_test_result_skip ("memfd_create() failed\n" ); +ksft_perror ("memfd_create() failed" ); +log_test_result (KSFT_SKIP );return ; }/* File consists of a single page filled with zeroes. */ if (fallocate (fd,0 ,0 , hugetlbsize)) { -ksft_test_result_skip ("need more free huge pages\n" ); +ksft_perror ("need more free huge pages" ); +log_test_result (KSFT_SKIP ); goto close; }
@@ -1633,12 +1732,14 @@ static void run_with_memfd_hugetlb(non_anon_test_fn fn, const char *desc, mem =mmap (NULL , hugetlbsize,PROT_READ |PROT_WRITE ,MAP_PRIVATE , fd,0 );if (mem ==MAP_FAILED ) { -ksft_test_result_skip ("need more free huge pages\n" ); +ksft_perror ("need more free huge pages" ); +log_test_result (KSFT_SKIP ); goto close; } smem =mmap (NULL , hugetlbsize,PROT_READ ,MAP_SHARED , fd,0 );if (smem ==MAP_FAILED ) { -ksft_test_result_fail ("mmap() failed\n" ); +ksft_perror ("mmap() failed" ); +log_test_result (KSFT_FAIL ); goto munmap; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1358/1424 selftests/mm: skip COW tmpfile cases when fallocate() is unsupported
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Usama Anjum <[email protected]>
[ Upstream commit 4004c130c358b1561a55323b0e747f20f5133f7b ]
Patch series "selftests/mm: Handle unsupported and transient test conditions", v3.
Several MM selftests report failures when the test environment lacks an underlying prerequisite, such as fallocate() support, MADV_REMOVE, local page-cache semantics, or swap.
This series converts those unsupported cases to SKIP while preserving failures for unexpected errors. It also allows migration tests to retry transient move_pages() failures.
This patch (of 4):
The tmpfile-backed COW cases allocate a one-page file with fallocate() before exercising private and shared mappings. When the filesystem backing tmpfile() does not implement fallocate(), setup fails with EOPNOTSUPP and no COW behavior is exercised.
This occurs when the temporary directory resides on a filesystem with limited allocation support, such as NFSv3. Reporting a failure adds noise because the test prerequisite is absent rather than the COW implementation being broken.
Report EOPNOTSUPP as a skip. Continue treating every other fallocate() error as a failure so unexpected setup regressions remain visible.
--- tools/testing/selftests/mm/cow.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
tools/testing/selftests/mm/cow.c +7 -2
@@ -1670,8 +1670,13 @@ static void run_with_tmpfile(non_anon_test_fn fn, const char *desc)/* File consists of a single page filled with zeroes. */ if (fallocate (fd,0 ,0 , pagesize)) { -ksft_perror ("fallocate() failed" ); -log_test_result (KSFT_FAIL ); +if (errno ==EOPNOTSUPP ) { +ksft_print_msg ("fallocate() not supported by filesystem\n" ); +log_test_result (KSFT_SKIP ); + }else { +ksft_perror ("fallocate() failed" ); +log_test_result (KSFT_FAIL ); + } goto close; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1359/1424 maple_tree: fix argument name in header
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liam R. Howlett (Oracle) <[email protected]>
[ Upstream commit 00f67814a14e614b749ebe54076ef1e3e6454f2b ]
The mas_prev_range() function takes a min and not a max.
--- include/linux/maple_tree.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/maple_tree.h +1 -1
@@ -478,7 +478,7 @@ void mas_destroy(struct ma_state *mas);int mas_expected_entries (struct ma_state *mas,unsigned long nr_entries);void *mas_prev (struct ma_state *mas,unsigned long min); -void *mas_prev_range (struct ma_state *mas,unsigned long max); +void *mas_prev_range (struct ma_state *mas,unsigned long min);void *mas_next (struct ma_state *mas,unsigned long max);void *mas_next_range (struct ma_state *mas,unsigned long max);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1360/1424 net_sched: act_skbmod: use RCU in tcf_skbmod_dump()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 53df77e7859042a92914d664c860f65d9689f88d ]
Also storing tcf_action into struct tcf_skbmod_params makes sure there is no discrepancy in tcf_skbmod_act().
No longer block BH in tcf_skbmod_init() when acquiring tcf_lock.
Stable-dep-of: 81d0d1e64f30 ("net/sched: act_skbmod: fix length calculations and avoid invalid header warnings")
--- include/net/tc_act/tc_skbmod.h | 1 + net/sched/act_skbmod.c | 26 ++++++++++++-------------- 2 files changed, 13 insertions(+), 14 deletions(-)
include/net/tc_act/tc_skbmod.h +1 -0
@@ -12,6 +12,7 @@struct tcf_skbmod_params {struct rcu_head rcu;u64 flags;/*up to 64 types of operations; extend if needed */ +int action;u8 eth_dst[ETH_ALEN ];u16 eth_type;u8 eth_src[ETH_ALEN ];
net/sched/act_skbmod.c +12 -14
@@ -27,19 +27,18 @@ TC_INDIRECT_SCOPE int tcf_skbmod_act(struct sk_buff *skb, struct tcf_result *res) {struct tcf_skbmod *d =to_skbmod (a); -int action, max_edit_len, err;struct tcf_skbmod_params *p; +int max_edit_len, err;u64 flags;tcf_lastuse_update (&d->tcf_tm);bstats_update (this_cpu_ptr (d->common.cpu_bstats), skb); - action =READ_ONCE (d->tcf_action); -if (unlikely (action ==TC_ACT_SHOT )) + p =rcu_dereference_bh (d->skbmod_p); +if (unlikely (p->action ==TC_ACT_SHOT )) goto drop; max_edit_len =skb_mac_header_len (skb); - p =rcu_dereference_bh (d->skbmod_p); flags = p->flags;/* tcf_skbmod_init() guarantees "flags" to be one of the following:
@@ -85,7 +84,7 @@ TC_INDIRECT_SCOPE int tcf_skbmod_act(struct sk_buff *skb,INET_ECN_set_ce (skb); out: -return action; +return p->action; drop:qstats_overlimit_inc (this_cpu_ptr (d->common.cpu_qstats));
@@ -193,9 +192,9 @@ static int tcf_skbmod_init(struct net *net, struct nlattr *nla, } p->flags = lflags; - + p->action = parm->action;if (ovr) -spin_lock_bh (&d->tcf_lock); +spin_lock (&d->tcf_lock);/* Protected by tcf_lock if overwriting existing action. */ goto_ch =tcf_action_set_ctrlact (*a, parm->action, goto_ch); p_old =rcu_dereference_protected (d->skbmod_p,1 );
@@ -209,7 +208,7 @@ static int tcf_skbmod_init(struct net *net, struct nlattr *nla,rcu_assign_pointer (d->skbmod_p, p);if (ovr) -spin_unlock_bh (&d->tcf_lock); +spin_unlock (&d->tcf_lock);if (p_old)kfree_rcu (p_old, rcu);
@@ -248,10 +247,9 @@ static int tcf_skbmod_dump(struct sk_buff *skb, struct tc_action *a, opt.index = d->tcf_index; opt.refcnt =refcount_read (&d->tcf_refcnt) - ref, opt.bindcnt =atomic_read (&d->tcf_bindcnt) - bind; -spin_lock_bh (&d->tcf_lock); - opt.action = d->tcf_action; - p =rcu_dereference_protected (d->skbmod_p, -lockdep_is_held (&d->tcf_lock)); +rcu_read_lock (); + p =rcu_dereference (d->skbmod_p); + opt.action = p->action; opt.flags = p->flags;if (nla_put (skb,TCA_SKBMOD_PARMS ,sizeof (opt), &opt)) goto nla_put_failure;
@@ -269,10 +267,10 @@ static int tcf_skbmod_dump(struct sk_buff *skb, struct tc_action *a,if (nla_put_64bit (skb,TCA_SKBMOD_TM ,sizeof (t), &t,TCA_SKBMOD_PAD )) goto nla_put_failure; -spin_unlock_bh (&d->tcf_lock); +rcu_read_unlock ();return skb->len; nla_put_failure: -spin_unlock_bh (&d->tcf_lock); +rcu_read_unlock ();nlmsg_trim (skb, b);return -1 ; }
Signature · 1 line
2.53.0
Re: [PATCH 6.6 1360/1424] net_sched: act_skbmod: use RCU in tcf_skbmod_dump()
Please hold this patch unless a 6.6 backport of upstream commit 3016024d7514 ("net_sched: add back BH safety to tcf_lock") can also be included.
This patch replaces spin_lock_bh() with spin_lock() in tcf_skbmod_init(). A rate estimator can take the same lock from timer softirq context, so the timer can interrupt action replacement while it holds the lock and deadlock on it.
I reproduced this on 6.6.157-rc1 in QEMU with lockdep: after the estimator timer ran, replacing an indexed skbmod action reported inconsistent softirq locking on tcfa_lock between est_timer() and tcf_skbmod_init().
With only the skbmod hunk from 3016024d7514 applied, restoring spin_lock_bh()/spin_unlock_bh(), the same test produced no lockdep warning.
Thanks,
Karl
Greg Kroah-Hartman
maintainerRe: [PATCH 6.6 1360/1424] net_sched: act_skbmod: use RCU in tcf_skbmod_dump()
Quoted 9 lines · Karl Mehltretter
Please hold this patch unless a 6.6 backport of upstream commit
3016024d7514("net_sched: add back BH safety totcf_lock") can also be included.This patch replaces
spin_lock_bh()withspin_lock()intcf_skbmod_init(). A rate estimator can take the same lock from timer softirq context, so the timer can interrupt action replacement while it holds the lock and deadlock on it.
Quoted 7 lines
I reproduced this on 6.6.157-rc1 in QEMU with lockdep: after the estimator timer ran, replacing an indexed skbmod action reported inconsistent softirq locking on
tcfa_lockbetweenest_timer()andtcf_skbmod_init().With only the skbmod hunk from
3016024d7514applied, restoring spin_lock_bh()/spin_unlock_bh(), the same test produced no lockdep warning.
Thanks, I'll drop this for now from the 6.6 and older queues based on this review.
greg k-h
Greg Kroah-Hartman
maintainerPATCH 1361/1424 net/sched: act_skbmod: fix length calculations and avoid invalid header warnings
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 81d0d1e64f30d9989c829c0953cd6e6c68d9c5fb ]
syzbot reported a warning in skb_network_header_len() triggered by tcf_skbmod_act():
!skb_transport_header_was_set(skb)
WARNING: CPU: 0 PID: 14949 at include/linux/skbuff.h:3243 skb_network_header_len include/linux/skbuff.h:3243 [inline] WARNING: CPU: 0 PID: 14949 at net/sched/act_skbmod.c:55 tcf_skbmod_act+0xfe8/0x1810 net/sched/act_skbmod.c:55
There are a few issues in tcf_skbmod_act():
1. Calling skb_network_header_len() assumes skb->transport_header is set, which is not guaranteed when tcf_skbmod_act() runs at TC ingress.
2. Unconditionally calling skb_mac_header_len() at the beginning of tcf_skbmod_act() triggers a warning on L3 devices (e.g. TUN) where the MAC header is unset, evaluating to an underflowed garbage length.
3. On TC ingress, skb->data points to the network header. Adding the MAC header length to the IP header length causes skb_ensure_writable() to request more bytes than the actual IP packet length, dropping valid short packets (e.g. 28-byte UDP/IPv4 packets).
Fix these by:
- Using skb_network_offset(skb) + sizeof(struct iphdr/ipv6hdr) for SKBMOD_F_ECN so that the required length is correctly calculated on both ingress (offset == 0) and egress (offset == mac_len).
- Setting max_edit_len to ETH_HLEN for Ethernet header modifications after validating ARPHRD_ETHER.
--- net/sched/act_skbmod.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
net/sched/act_skbmod.c +8 -4
@@ -38,7 +38,6 @@ TC_INDIRECT_SCOPE int tcf_skbmod_act(struct sk_buff *skb,if (unlikely (p->action ==TC_ACT_SHOT )) goto drop; - max_edit_len =skb_mac_header_len (skb); flags = p->flags;/* tcf_skbmod_init() guarantees "flags" to be one of the following:
@@ -51,14 +50,19 @@ TC_INDIRECT_SCOPE int tcf_skbmod_act(struct sk_buff *skb,if (flags ==SKBMOD_F_ECN ) {switch (skb_protocol (skb, true)) {case cpu_to_be16 (ETH_P_IP ): + max_edit_len =sizeof (struct iphdr ); +break ;case cpu_to_be16 (ETH_P_IPV6 ): - max_edit_len +=skb_network_header_len (skb); + max_edit_len =sizeof (struct ipv6hdr );break ;default : goto out; } - }else if (!skb->dev || skb->dev->type !=ARPHRD_ETHER ) { - goto out; + max_edit_len +=skb_network_offset (skb); + }else { +if (!skb->dev || skb->dev->type !=ARPHRD_ETHER ) + goto out; + max_edit_len =ETH_HLEN ; } err =skb_ensure_writable (skb, max_edit_len);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1362/1424 net/sched: fq_codel: clamp default quantum and mtu
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <[email protected]>
[ Upstream commit d9ebd8f9aa8b2773235889cb903fafd61f2d8585 ]
fq_codel_init() sets q->quantum = psched_mtu(qdisc_dev(sch)) without clamping. A device with a huge MTU (e.g. dummy with max_mtu == 0 accepting MTU 2147483634) makes psched_mtu() return 0x80000000, which overflows the signed flow->deficit to INT_MIN in fq_codel_dequeue(), causing an infinite loop and soft lockup. Emulate fq_codel_change() and constrain to [256, FQ_CODEL_QUANTUM_MAX].
The same unclamped psched_mtu() is assigned to q->cparams.mtu a bit below, and fq_codel_change() never updates it. codel_should_drop() tests "*backlog <= params->mtu"; with mtu == 0x80000000 (~2 GiB) and the default 32 MiB memory_limit, the test is always true, so CoDel is silently and completely disabled (no drops, no ECN). Declare a single clamped mtu and assign both q->quantum and q->cparams.mtu from it, which also removes the double psched_mtu() call.
Conditions to recreate the bug: a device whose MTU (plus hard_header_len) wraps psched_mtu() into the sign bit (e.g. a dummy device with max_mtu == 0 accepting MTU 2147483634). Requires CAP_NET_ADMIN in a user namespace.
--- net/sched/sch_fq_codel.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/sched/sch_fq_codel.c +4 -2
@@ -495,6 +495,7 @@ static int fq_codel_init(struct Qdisc *sch, struct nlattr *opt, struct netlink_ext_ack *extack) {struct fq_codel_sched_data *q =qdisc_priv (sch); +u32 mtu;int i;int err;
@@ -502,13 +503,14 @@ static int fq_codel_init(struct Qdisc *sch, struct nlattr *opt, q->flows_cnt =1024 ; q->memory_limit =32 <<20 ;/* 32 MBytes */ q->drop_batch_size =64 ; - q->quantum =psched_mtu (qdisc_dev (sch)); + mtu =clamp_t (u32,psched_mtu (qdisc_dev (sch)),256 ,FQ_CODEL_QUANTUM_MAX ); + q->quantum = mtu;INIT_LIST_HEAD (&q->new_flows);INIT_LIST_HEAD (&q->old_flows);codel_params_init (&q->cparams);codel_stats_init (&q->cstats); q->cparams.ecn = true; - q->cparams.mtu =psched_mtu (qdisc_dev (sch)); + q->cparams.mtu = mtu;if (opt) { err =fq_codel_change (sch, opt, extack);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1363/1424 net/sched: sch_codel: clamp default mtu to avoid disabling CoDel
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <[email protected]>
[ Upstream commit 6439461f1618ae176c048673ad28bdb6c68efbfc ]
codel_init() sets q->params.mtu = psched_mtu(qdisc_dev(sch)) without clamping. A device with a huge MTU (e.g. dummy with max_mtu == 0 accepting MTU 2147483634) makes psched_mtu() return 0x80000000. In codel_should_drop() the test "*backlog <= params->mtu" then compares the backlog against ~2 GiB; with the default sch->limit of DEFAULT_CODEL_LIMIT (1000) packets the backlog can never reach it, so the test is always true and CoDel is silently and completely disabled i.e no drops, no ECN marking, codel degrades to a tail-drop FIFO. codel_change() never updates params.mtu, so the init path is the only place to clamp it. Constrain to [256, 1 << 20], matching the fq_codel bound; 256 is a sane floor that only makes CoDel slightly more willing to act on very small queues, which is the safe direction.
Conditions to recreate the bug: a device whose MTU (plus hard_header_len) wraps psched_mtu() into the sign bit (e.g. a dummy device with max_mtu == 0 accepting MTU 2147483634). Requires CAP_NET_ADMIN in a user namespace.
--- net/sched/sch_codel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sched/sch_codel.c +1 -1
@@ -228,7 +228,7 @@ static int codel_init(struct Qdisc *sch, struct nlattr *opt,codel_params_init (&q->params);codel_vars_init (&q->vars);codel_stats_init (&q->stats); - q->params.mtu =psched_mtu (qdisc_dev (sch)); + q->params.mtu =clamp_t (u32,psched_mtu (qdisc_dev (sch)),256 ,1 <<20 );if (opt) {int err =codel_change (sch, opt, extack);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1364/1424 net/sched: fq_pie: clamp default quantum to avoid signed overflow
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <[email protected]>
[ Upstream commit c86cd7ed0b0e44779a3d1683f03e4353baf4bdc9 ]
fq_pie_init() sets q->quantum = psched_mtu(qdisc_dev(sch)) without clamping. A device with a huge MTU (e.g. dummy with max_mtu == 0 accepting MTU 2147483634) makes psched_mtu() return 0x80000000, which overflows the signed flow->deficit to INT_MIN in fq_pie_qdisc_dequeue(), causing an infinite loop and soft lockup. Emulate fq_pie_policy which is already bounded to [1, 1 << 20]; clamp the default to [256, 1 << 20]. 256 matches fq_codel's floor and is a sane minimum for a DRR quantum.
Conditions to recreate the bug: a device whose MTU (plus hard_header_len) wraps psched_mtu() into the sign bit (e.g. a dummy device with max_mtu == 0 accepting MTU 2147483634). Requires CAP_NET_ADMIN in a user namespace.
--- net/sched/sch_fq_pie.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/sched/sch_fq_pie.c +2 -1
@@ -416,7 +416,8 @@ static int fq_pie_init(struct Qdisc *sch, struct nlattr *opt,pie_params_init (&q->p_params); sch->limit =10 *1024 ; q->p_params.limit = sch->limit; - q->quantum =psched_mtu (qdisc_dev (sch)); + q->quantum =clamp_t (u32,psched_mtu (qdisc_dev (sch)), +256 ,1 <<20 ); q->sch = sch; q->ecn_prob =10 ; q->flows_cnt =1024 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1365/1424 net/sched: hhf: clamp quantum before hhf_change() to avoid overflow
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <[email protected]>
[ Upstream commit 2164b512b97bb053e8ce4d6e95576f11bed6a005 ]
hhf_init() sets q->quantum = psched_mtu(qdisc_dev(sch)) with no overflow check. A device with a huge MTU (e.g. dummy with max_mtu == 0 accepting MTU 2147483634) makes weight * quantum overflow the signed deficit in hhf_dequeue(), spinning forever.
Clamp q->quantum before hhf_change() so both the opt and !opt paths see a sane quantum. Without this, bare "tc qdisc add ... hhf" succeeds with a clamped quantum but "tc qdisc add ... hhf limit 1000" (any option present) fails with -EINVAL because hhf_change() re-validates the unclamped default (sch_hhf.c:559). 256 matches fq_codel's floor and is a sane minimum for a DRR quantum.
Conditions to recreate the bug: a device whose MTU (plus hard_header_len) wraps psched_mtu() into the sign bit (e.g. a dummy device with max_mtu == 0 accepting MTU 2147483634). Requires CAP_NET_ADMIN in a user namespace.
--- net/sched/sch_hhf.c | 4 ++++ 1 file changed, 4 insertions(+)
net/sched/sch_hhf.c +4 -0
@@ -617,6 +617,10 @@ static int hhf_init(struct Qdisc *sch, struct nlattr *opt, q->hhf_evict_timeout =HZ ;/* 1 sec */ q->hhf_non_hh_weight =2 ; +if ((int )q->quantum <=0 || + (u64 )q->quantum * q->hhf_non_hh_weight >INT_MAX ) + q->quantum =256 ; +if (opt) {int err =hhf_change (sch, opt, extack);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1366/1424 net/sched: sfq: clamp quantum to avoid signed overflow soft lockup
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <[email protected]>
[ Upstream commit 816e90057ab1879562a5b7cc688e35bb9027ae97 ]
sfq_init() sets q->quantum = psched_mtu(qdisc_dev(sch)) (unsigned). A device with a huge MTU (e.g. dummy with max_mtu == 0 accepting MTU 2147483634) makes psched_mtu() return 0x80000000, so slot->allot = INT_MIN and INT_MIN + INT_MIN toggles between INT_MIN and 0 forever, spinning sfq_dequeue() under the qdisc lock.
Clamp the quantum to [256, 1 << 20] so the refill loop terminates. The lower bound also covers q->quantum == 0 (psched_mtu() returning 0), which spins sfq_dequeue() identically. sfq_change() already rejects a negative quantum, so only the init path was exposed.
Conditions to recreate the bug: a device whose MTU (plus hard_header_len) wraps psched_mtu() into the sign bit (e.g. a dummy device with max_mtu == 0 accepting MTU 2147483634). Requires CAP_NET_ADMIN in a user namespace.
--- net/sched/sch_sfq.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/sched/sch_sfq.c +2 -1
@@ -796,7 +796,8 @@ static int sfq_init(struct Qdisc *sch, struct nlattr *opt, q->tail =NULL ; q->divisor =SFQ_DEFAULT_HASH_DIVISOR ; q->maxflows =SFQ_DEFAULT_FLOWS ; - q->quantum =psched_mtu (qdisc_dev (sch)); + q->quantum =clamp_t (u32,psched_mtu (qdisc_dev (sch)), +256 ,1 <<20 ); q->perturb_period =0 ;get_random_bytes (&q->perturbation,sizeof (q->perturbation));
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1367/1424 net/sched: sch_teql: restore skb->dev on the slave failure path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Victor Nogueira <[email protected]>
[ Upstream commit dc4b95b8fee95113587e93ca116356032d271371 ]
teql_master_xmit() sets skb->dev = slave before calling the slave's ndo_start_xmit(), but never restores it when that transmit fails. The skb then walks on to the next slave still pointing at the previous one.
If a later slave has no resolved neighbour, teql_resolve() hands the skb to neigh_event_send(), which queues it on that neighbour's arp_queue with the stale skb->dev. skb->dev holds no reference, so deleting the previous slave frees the net_device while the skb is still queued. Whatever runs next on that skb - arp_error_report() on timeout, or neigh_direct_output() -> dev_queue_xmit() once the neighbour resolves - causes a UAF like the one below:
BUG: KASAN: slab-use-after-free in __icmp_send (net/ipv4/icmp.c:914 (discriminator 2)) Read of size 4 at addr ffff888106e100b0 by task flood_packet/527 CPU: 0 UID: 0 PID: 527 Comm: flood_packet Not tainted 7.2.0-rc6-g594d90519502 #1 PREEMPT(lazy) Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <IRQ> dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) print_report (mm/kasan/report.c:378 mm/kasan/report.c:482) ? __pfx__raw_spin_lock_irqsave (./include/asm-generic/qrwlock.h:122 (discriminator 4)) ? __icmp_send (net/ipv4/icmp.c:914 (discriminator 2)) kasan_report (mm/kasan/report.c:595) ? __icmp_send (net/ipv4/icmp.c:914 (discriminator 2)) __icmp_send (net/ipv4/icmp.c:914 (discriminator 2))
[...]ipv4_link_failure (net/ipv4/route.c:1251 net/ipv4/route.c:1258)
? __pfx_ipv4_link_failure (./include/linux/skbuff.h:4327)
? _raw_write_lock (./include/linux/instrumented.h:55 ./include/linux/atomic/atomic-instrumented.h:1301 ./include/asm-generic/qrwlock.h:98 ./include/linux/rwlock_api_smp.h:230 kernel/locking/spinlock.c:304) ? __pfx__raw_write_lock (kernel/locking/spinlock.c:175)arp_error_report (./include/net/dst.h:438 net/ipv4/arp.c:296)neigh_invalidate (net/core/neighbour.c:1077)neigh_timer_handler (net/core/neighbour.c:1169)
[...]
Allocated by task 505: kasan_save_stack (mm/kasan/common.c:57) kasan_save_track (mm/kasan/common.c:78) __kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415) __kvmalloc_node_noprof (./include/linux/kasan.h:263 mm/slub.c:5334 mm/slub.c:6905) alloc_netdev_mqs (net/core/dev.c:12055 (discriminator 2))
rtnl_create_link (net/core/rtnetlink.c:3721)rtnl_newlink (net/core/rtnetlink.c:3903 net/core/rtnetlink.c:4044 net/core/rtnetlink.c:4159) rtnetlink_rcv_msg (net/core/rtnetlink.c:7076)
[...]
Freed by task 536: kasan_save_stack (mm/kasan/common.c:57) kasan_save_track (mm/kasan/common.c:78) kasan_save_free_info (mm/kasan/generic.c:584) __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285) kfree (./include/linux/kasan.h:235 mm/slub.c:2677 mm/slub.c:6377 mm/slub.c:6692)
device_release (drivers/base/core.c:2636)kobject_put (lib/kobject.c:689 lib/kobject.c:720 ./include/linux/kref.h:65 lib/kobject.c:737) netdev_run_todo (net/core/dev.c:11756)rtnl_dellink (net/core/rtnetlink.c:157 ./include/linux/rtnetlink.h:135 net/core/rtnetlink.c:3651) rtnetlink_rcv_msg (net/core/rtnetlink.c:7076)
[...]
Fix this by restoring skb->dev to the master at the end of each slave's iteration.
--- net/sched/sch_teql.c | 1 + 1 file changed, 1 insertion(+)
net/sched/sch_teql.c +1 -0
@@ -377,6 +377,7 @@ static netdev_tx_t teql_master_xmit(struct sk_buff *skb, struct net_device *dev) nores =1 ;break ; } + skb->dev = dev;__skb_pull (skb,skb_network_offset (skb)); }while ((q =rcu_dereference (NEXT_SLAVE (q))) != start);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1368/1424 tpm: st33zp24: Return zero on status read failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <[email protected]>
[ Upstream commit 8b92687708f5ef980de01c2042dbd76d11f78547 ]
st33zp24_status() ignores the result of the transport read and returns data even when no byte was received. The I2C transport, for example, skips i2c_master_recv() when the register-select write is short or fails, leaving data uninitialized. The resulting stack value can be interpreted as TPM_STS flags and let status checks complete spuriously.
The status callback cannot propagate a transport error. Return zero unless recv() reports exactly one byte. With no status bits set, callers retry or take their existing timeout or error path instead of acting on an invalid status value.
This issue was found by a static analysis checker and confirmed by manual source review.
--- drivers/char/tpm/st33zp24/st33zp24.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/char/tpm/st33zp24/st33zp24.c +3 -1
@@ -93,7 +93,9 @@ static u8 st33zp24_status(struct tpm_chip *chip)struct st33zp24_dev *tpm_dev =dev_get_drvdata (&chip->dev);u8 data; - tpm_dev->ops->recv (tpm_dev->phy_id,TPM_STS , &data,1 ); +if (tpm_dev->ops->recv (tpm_dev->phy_id,TPM_STS , &data,1 ) !=1 ) +return 0 ; +return data; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1369/1424 tpm: st33zp24: Validate locality read result
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <[email protected]>
[ Upstream commit 264216889d39df509b9c8045df53529480b0b718 ]
check_locality() treats every nonzero transport return as success. SPI errors remain negative, while the I2C path can convert a negative write error through its byte-sized status variable. Either result is nonzero even though the TPM_ACCESS byte can remain unwritten, so indeterminate ACTIVE_LOCALITY and VALID bits can falsely report an active locality.
Require recv() to return exactly the requested byte before examining TPM_ACCESS. Transport errors and short reads now report an inactive locality, while successful reads retain the existing behavior.
This issue was found by a static analysis checker and confirmed by manual source review.
--- drivers/char/tpm/st33zp24/st33zp24.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/char/tpm/st33zp24/st33zp24.c +2 -2
@@ -106,10 +106,10 @@ static bool check_locality(struct tpm_chip *chip) {struct st33zp24_dev *tpm_dev =dev_get_drvdata (&chip->dev);u8 data; -u8 status; +int status; status = tpm_dev->ops->recv (tpm_dev->phy_id,TPM_ACCESS , &data,1 ); -if (status && (data & +if (status ==1 && (data & (TPM_ACCESS_ACTIVE_LOCALITY |TPM_ACCESS_VALID )) == (TPM_ACCESS_ACTIVE_LOCALITY |TPM_ACCESS_VALID ))return true;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1370/1424 apparmor: Replace sprintf/strcpy with scnprintf/strscpy in aa_policy_init
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <[email protected]>
[ Upstream commit b31d3f7385fbb49681d44e7104cfa033cba4b1e8 ]
strcpy() is deprecated and sprintf() does not perform bounds checking either. Although an overflow is unlikely, it's better to proactively avoid it by using the safer strscpy() and scnprintf(), respectively.
Additionally, unify memory allocation for 'hname' to simplify and improve aa_policy_init().
Stable-dep-of: 3daad923a868 ("apparmor: policy_int make sure list heads are initialized before fail path")
--- security/apparmor/lib.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-)
security/apparmor/lib.c +7 -9
@@ -448,19 +448,17 @@ bool aa_policy_init(struct aa_policy *policy, const char *prefix, const char *name, gfp_t gfp) { char *hname; +size_t hname_sz; + hname_sz = (prefix ?strlen (prefix) +2 :0 ) +strlen (name) +1 ;/* freed by policy_free */ -if (prefix) { - hname =aa_str_alloc (strlen (prefix) +strlen (name) +3 , gfp); -if (hname) -sprintf (hname,"%s//%s" , prefix, name); - }else { - hname =aa_str_alloc (strlen (name) +1 , gfp); -if (hname) -strcpy (hname, name); - } + hname =aa_str_alloc (hname_sz, gfp);if (!hname)return false; +if (prefix) +scnprintf (hname, hname_sz,"%s//%s" , prefix, name); +else +strscpy (hname, name, hname_sz); policy->hname = hname;/* base.name is a substring of fqname */ policy->name =basename (policy->hname);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1371/1424 apparmor: policy_int make sure list heads are initialized before fail path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Johansen <[email protected]>
[ Upstream commit 3daad923a8685adb66087e0d819559b7eb6ba975 ]
If profile create fails before policy_init is complete the list heads are not properly initialized causing profile_free() sanity checks to trigger the following splat.
AppArmor WARN aa_policy_destroy: (((!list_empty(&policy->profiles) && (&policy->profiles)->prev != ((void *) 0x122 + (0xdead000000000000UL))))):
WARNING: security/apparmor/lib.c:509 at aa_policy_destroy+0x164/0x1b0 security/apparmor/lib.c:509, CPU#0: syz.0.17/5541 Modules linked in: CPU: 0 UID: 0 PID: 5541 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:aa_policy_destroy+0x16b/0x1b0 security/apparmor/lib.c:509 Code: 85 ed 7e 4d e8 96 bc 37 fd 5b 41 5c 41 5e 41 5f 5d e9 19 27 4e 07 cc e8 83 bc 37 fd 48 8d 3d 0c f0 d3 0b 48 c7 c6 a4 eb 38 8e <67> 48 0f b9 3a e9 04 ff ff ff e8 66 bc 37 fd 48 8d 3d ff ef d3 0b RSP: 0018:ffffc9000345eaa0 EFLAGS: 00010293 RAX: ffffffff848f530d RBX: ffff88803f734800 RCX: ffff88801af2a580 RDX: 0000000000000000 RSI: ffffffff8e38eba4 RDI: ffffffff90634320 RBP: 0000000000000000 R08: 0000000000000cc0 R09: 00000000ffffffff R10: dffffc0000000000 R11: fffffbfff1d95913 R12: dead000000000122 R13: ffff88803f734800 R14: ffff88803f734828 R15: dffffc0000000000 FS: 00007f5f6a1836c0(0000) GS:ffff88808c519000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055d02407b048 CR3: 0000000012aa9000 CR4: 0000000000352ef0 Call Trace: <TASK> aa_free_profile+0x9d/0x9f0 security/apparmor/policy.c:334 aa_alloc_profile+0x1e4/0x3e0 security/apparmor/policy.c:416 unpack_profile security/apparmor/policy_unpack.c:1153 [inline] aa_unpack+0x17db/0x7430 security/apparmor/policy_unpack.c:1748 aa_replace_profiles+0x226/0x2a20 security/apparmor/policy.c:1183 policy_update+0x234/0x4a0 security/apparmor/apparmorfs.c:505 profile_load+0x1cb/0x320 security/apparmor/apparmorfs.c:522 vfs_write+0x296/0xba0 fs/read_write.c:685 ksys_write+0x150/0x270 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5f6939e0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5f6a183028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f5f69625fa0 RCX: 00007f5f6939e0d9 RDX: 0000000000000041 RSI: 0000200000000400 RDI: 0000000000000003 RBP: 00007f5f6a183090 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007f5f69626038 R14: 00007f5f69625fa0 R15: 00007ffe23725c18
--- security/apparmor/lib.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
security/apparmor/lib.c +2 -2
@@ -450,6 +450,8 @@ bool aa_policy_init(struct aa_policy *policy, const char *prefix,char *hname;size_t hname_sz; +INIT_LIST_HEAD (&policy->list); +INIT_LIST_HEAD (&policy->profiles); hname_sz = (prefix ?strlen (prefix) +2 :0 ) +strlen (name) +1 ;/* freed by policy_free */ hname =aa_str_alloc (hname_sz, gfp);
@@ -462,8 +464,6 @@ bool aa_policy_init(struct aa_policy *policy, const char *prefix, policy->hname = hname;/* base.name is a substring of fqname */ policy->name =basename (policy->hname); -INIT_LIST_HEAD (&policy->list); -INIT_LIST_HEAD (&policy->profiles);return true; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1372/1424 ASoC: dapm: Fix off-by-one check on the second enum channel
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: HyeongJun An <[email protected]>
[ Upstream commit 14511c9b54ceeeef487409d73947c89ee8563590 ]
The snd_soc_dapm_put_enum_double() rejects item[0] once it reaches e->items, but it lets item[1] be equal to it. Both go on to snd_soc_enum_item_to_val(), which indexes e->values with no bound of its own, so an enum with a value table reads one element past the end.
The indexing arrived with the MUX consolidation, which relaxed the item[1] check in the same hunk. The value MUX handler it deleted used
Quoted 1 line
= there, and the
snd_soc_put_enum_double()insoc-ops.cstill does.
Only adav80x pairs a value table with two shifts, and its second channel looks accidental, but the control does report two values. Writing three into it reads off the end of adav80x_mux_values. The core catches that only under CONFIG_SND_CTL_INPUT_VALIDATION, which defaults off.
--- sound/soc/soc-dapm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/soc-dapm.c +1 -1
@@ -3525,7 +3525,7 @@ int snd_soc_dapm_put_enum_double(struct snd_kcontrol *kcontrol, val =snd_soc_enum_item_to_val (e, item[0 ]) << e->shift_l; mask = e->mask << e->shift_l;if (e->shift_l != e->shift_r) { -if (item[1 ] > e->items) +if (item[1 ] >= e->items)return -EINVAL ; val |=snd_soc_enum_item_to_val (e, item[1 ]) << e->shift_r; mask |= e->mask << e->shift_r;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1373/1424 ceph: revalidate ki_pos for O_APPEND writes after cap acquisition
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiubo Li <[email protected]>
[ Upstream commit d2a8d446a09c74c8ddfe108b50dd791c889983fc ]
For O_APPEND writes, ki_pos is set to the current EOF via generic_write_checks() after fetching i_size from the MDS. However, ceph_get_caps() may need to wait for Fwx exclusive caps if the write extends the file (endoff > i_max_size). While waiting for Fwx, the previous Fwx holder (another client) may have already extended the file. When the MDS grants us Fwx, the cap grant message updates the local i_size, but ki_pos remains at the old EOF, causing the append write to land at a stale offset and overwrite data from the other client.
Fix by re-reading i_size_read(inode) after ceph_get_caps() returns. At this point we hold Fwx exclusive caps, no other client can modify the file, and i_size reflects the true EOF from the MDS cap grant. No extra MDS round-trip is needed. Only adjust ki_pos when the EOF has actually changed.
After adjusting ki_pos forward, the write range [pos, pos+count) may now exceed the i_max_size that was validated by ceph_get_caps() for the old range. Re-check against i_max_size and truncate the write if necessary to stay within the MDS-granted limit.
--- fs/ceph/file.c | 48 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+)
fs/ceph/file.c +48 -0
@@ -2343,6 +2343,54 @@ static ssize_t ceph_write_iter(struct kiocb *iocb, struct iov_iter *from)if (err <0 ) goto out; +/* +* For O_APPEND writes we may have waited for Fwx exclusive caps +* while the previous Fwx holder (another client) extended the +* file. i_size has been updated via the cap grant message from +* the MDS, but ki_pos is still the old EOF. Re-read i_size here +* (no extra MDS round-trip needed) and adjust ki_pos to the true +* EOF. Since we hold Fwx, no other client can change the file. +*/ +if (iocb->ki_flags &IOCB_APPEND ) { +loff_t cur_eof =i_size_read (inode); + +if (cur_eof != pos) { +doutc (cl, +"%p %llx.%llx O_APPEND: pos adjusted %lld -> %lld\n" , + inode,ceph_vinop (inode), pos, cur_eof); + iocb->ki_pos = cur_eof; + pos = cur_eof; +if (pos >= limit) { + err = -EFBIG ; + goto out_caps; + } +iov_iter_truncate (from, limit - pos); + count =iov_iter_count (from); + +/* +* ceph_get_caps() validated the old endoff +* against i_max_size; adjusting ki_pos forward +* may have shifted the write range beyond the +* granted max_size. Re-check and truncate if +* necessary. +*/ +spin_lock (&ci->i_ceph_lock); +if (pos + count > (loff_t )ci->i_max_size) { +loff_t max_size = ci->i_max_size; + +spin_unlock (&ci->i_ceph_lock); +if (pos >= max_size) { + err = -EFBIG ; + goto out_caps; + } +iov_iter_truncate (from, max_size - pos); + count =iov_iter_count (from); + }else { +spin_unlock (&ci->i_ceph_lock); + } + } + } + err =file_update_time (file);if (err) goto out_caps;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1374/1424 libceph: validate banner payload length
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Nogikh <[email protected]>
[ Upstream commit f374967fcdf04001c9b66df1c19106fa83cd91f7 ]
When parsing the Ceph messenger v2 protocol banner, the payload_len field is decoded from the banner prefix. If a client sends a banner with a payload_len of 0, the kernel sets up a 0-length socket read. This violates an invariant in the state machine, triggering a warning in populate_in_iter():
------------[ cut here ]------------ !iov_iter_count(&con->v2.in_iter) WARNING: net/ceph/messenger_v2.c:3129 at populate_in_iter net/ceph/messenger_v2.c:3129 [inline], CPU#1: kworker/1:3/5070 WARNING: net/ceph/messenger_v2.c:3129 at ceph_con_v2_try_read+0x6634/0x6810 net/ceph/messenger_v2.c:3159, CPU#1: kworker/1:3/5070 ... Call Trace: <TASK> ceph_con_workfn+0x1f5/0x14a0 net/ceph/messenger.c:1575 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK>
According to the msgr2 protocol specification, the banner payload is expected to contain at least two 64-bit integers (server_feat and server_req_feat). Therefore, payload_len must be at least 16 bytes.
Fix this by adding a check in process_banner_prefix() to reject a payload_len smaller than 16 bytes. This prevents the 0-length read and correctly aborts the connection with a protocol error.
--- net/ceph/messenger_v2.c | 5 +++++ 1 file changed, 5 insertions(+)
net/ceph/messenger_v2.c +5 -0
@@ -2176,6 +2176,11 @@ static int process_banner_prefix(struct ceph_connection *con) payload_len =ceph_decode_16 (&p);dout ("%s con %p payload_len %d\n" , __func__, con, payload_len); +if (payload_len <sizeof (u64) +sizeof (u64)) { + con->error_msg ="protocol error, bad banner payload len" ; +return -EINVAL ; + } +return prepare_read_banner_payload (con, payload_len); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1375/1424 samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-modify
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit d79fb758e7e2e7a181eab630c0545a56041c473d ]
ftrace_direct_init() assigns kthread_run()'s return value to simple_tsk without an IS_ERR() check. When kthread_run() fails it returns ERR_PTR(-ENOMEM), but init still returns 0, so the module loads with simple_tsk holding an error pointer. On unload, ftrace_direct_exit() then passes that ERR_PTR to kthread_stop(), leading to a null-pointer-dereference.
Check the return value of kthread_run() with IS_ERR(); on failure, unregister the ftrace direct call and propagate the error code.
--- samples/ftrace/ftrace-direct-modify.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
samples/ftrace/ftrace-direct-modify.c +9 -3
@@ -202,9 +202,15 @@ static int __init ftrace_direct_init(void)ftrace_set_filter_ip (&direct, (unsigned long ) my_ip,0 ,0 ); ret =register_ftrace_direct (&direct, my_tramp); -if (!ret) - simple_tsk =kthread_run (simple_thread,NULL ,"event-sample-fn" ); -return ret; +if (ret) +return ret; + simple_tsk =kthread_run (simple_thread,NULL ,"event-sample-fn" ); +if (IS_ERR (simple_tsk)) { +unregister_ftrace_direct (&direct, my_tramp, true); +return PTR_ERR (simple_tsk); + } + +return 0 ; } static void __exit ftrace_direct_exit(void)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1376/1424 samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 6727b7618f49401acf373fa3ec5712e2ec52e5cf ]
ftrace_direct_multi_init() assigns kthread_run()'s return value to simple_tsk without an IS_ERR() check. When kthread_run() fails it returns ERR_PTR(-ENOMEM), but init still returns 0, so the module loads with simple_tsk holding an error pointer. On unload, ftrace_direct_multi_exit() then passes that ERR_PTR to kthread_stop(), leading to a null-pointer-dereference.
Check the return value of kthread_run() with IS_ERR(); on failure, unregister the ftrace direct call and propagate the error code.
--- samples/ftrace/ftrace-direct-multi-modify.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
samples/ftrace/ftrace-direct-multi-modify.c +9 -3
@@ -224,9 +224,15 @@ static int __init ftrace_direct_multi_init(void) ret =register_ftrace_direct (&direct, my_tramp); -if (!ret) - simple_tsk =kthread_run (simple_thread,NULL ,"event-sample-fn" ); -return ret; +if (ret) +return ret; + simple_tsk =kthread_run (simple_thread,NULL ,"event-sample-fn" ); +if (IS_ERR (simple_tsk)) { +unregister_ftrace_direct (&direct, my_tramp, true); +return PTR_ERR (simple_tsk); + } + +return 0 ; } static void __exit ftrace_direct_multi_exit(void)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1377/1424 net: ethernet: sun4i-emac: Fix IRQ error handling
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: bui duc phuc <[email protected]>
[ Upstream commit 991c2be78257cba5bf53cf935fe70f8836964288 ]
irq_of_parse_and_map() returns 0 when parsing or mapping an IRQ fails. The current code checks for -ENXIO and therefore does not detect the failure.
Check for a zero return value and convert it to -ENXIO.
--- drivers/net/ethernet/allwinner/sun4i-emac.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/allwinner/sun4i-emac.c +2 -2
@@ -996,9 +996,9 @@ static int emac_probe(struct platform_device *pdev)/* fill in parameters for net-dev structure */ ndev->base_addr = (unsigned long )db->membase; ndev->irq =irq_of_parse_and_map (np,0 ); -if (ndev->irq == -ENXIO ) { +if (!ndev->irq) {netdev_err (ndev,"No irq resource\n" ); - ret = ndev->irq; + ret = -ENXIO ; goto out_iounmap; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1378/1424 net: stmmac: selftests: Pass the IP proto mask in the TC selftest
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxime Chevallier <[email protected]>
[ Upstream commit 9a56a27e6002e29a6707dc4238d469ec84c3a68e ]
The stmmac TC filtering rules have recently gained sanity checks to make sure the passed keys and their respective masks are aligned with the HW filtering abilities.
The stmmac selftests failed to pass the mask in the match data for L4 filtering tests, and are now failing consistently with -EINVAL :
$ ethtool -t eth1 [...] 23. L4 DA TCP Filtering -22 24. L4 SA TCP Filtering -22 25. L4 DA UDP Filtering -22 26. L4 SA UDP Filtering -22
Let's pass the ip_proto mask in the l4 filtering tests match data. Found on imx8mp, which now have passing L4 tests :
$ ethtool -t eth1 [...] 23. L4 DA TCP Filtering 0 24. L4 SA TCP Filtering 0 25. L4 DA UDP Filtering 0 26. L4 SA UDP Filtering 0
While at it, initialize the masks and keys to avoid re-using whatever was on the stack.
--- drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c +4 -2
@@ -1452,11 +1452,11 @@ static int __stmmac_test_l4filt(struct stmmac_priv *priv, u32 dst, u32 src,struct {struct flow_dissector_key_basic bkey;struct flow_dissector_key_ports key; - }__aligned(BITS_PER_LONG / 8) keys; + }__aligned(BITS_PER_LONG / 8) keys = { };struct {struct flow_dissector_key_basic bmask;struct flow_dissector_key_ports mask; - }__aligned(BITS_PER_LONG / 8) masks; + }__aligned(BITS_PER_LONG / 8) masks = { };unsigned long dummy_cookie =0xdeadbeef ;struct stmmac_packet_attrs attr = { };struct flow_dissector *dissector;
@@ -1509,6 +1509,8 @@ static int __stmmac_test_l4filt(struct stmmac_priv *priv, u32 dst, u32 src, keys.bkey.ip_proto = udp ?IPPROTO_UDP :IPPROTO_TCP ; keys.key.src =htons (src); keys.key.dst =htons (dst); +/* Match the full IP proto field */ + masks.bmask.ip_proto =0xff ; masks.mask.src = src_mask; masks.mask.dst = dst_mask;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1379/1424 virtio-net: Ensure that TCP packets dont overflow gso_segs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alice Mikityanska <[email protected]>
[ Upstream commit c27c449d455aafd9018a3cbab150f1c42c87923f ]
The user can specify any gso_size in a packet crafted with an AF_PACKET PACKET_VNET_HDR socket, even smaller than TCP_MIN_GSO_SIZE = 8. At the same time, GSO_MAX_SIZE = 8 * GSO_MAX_SEGS = 8 * 65535. When the user crafts a packet with gso_size < 8, there is a risk for partial GSO to overflow the 16-bit gso_segs field when dividing the SKB length by gso_size.
Adjust gso_size of TCP packets to be at least TCP_MIN_GSO_SIZE = 8. Keep gso_size of UDP GSO packets, as gso_size=1 is valid and explicitly tested at tools/testing/selftests/net/tun.c:649.
--- include/linux/virtio_net.h | 4 ++++ 1 file changed, 4 insertions(+)
include/linux/virtio_net.h +4 -0
@@ -6,6 +6,7 @@#include <linux/ip.h> #include <linux/ipv6.h> #include <linux/udp.h> +#include <net/tcp.h> #include <uapi/linux/tcp.h> #include <uapi/linux/virtio_net.h>
@@ -178,6 +179,9 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,if (skb->ip_summed ==CHECKSUM_PARTIAL && skb->csum_offset != offsetof(struct tcphdr , check))return -EINVAL ; + +BUILD_BUG_ON (TCP_MIN_GSO_SIZE *GSO_MAX_SEGS <GSO_MAX_SIZE ); + gso_size =max (gso_size,TCP_MIN_GSO_SIZE );break ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1380/1424 netfilter: nf_tables: move hardware offload step after building the chain blob
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit b1881d362e1924b66f6016c3efd28807032b41bf ]
Allocate the chain blob before the ruleset offload to reduce chances of entering an inconsistent state where the offloaded ruleset in the nic and the software ruleset differ.
--- net/netfilter/nf_tables_api.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
net/netfilter/nf_tables_api.c +10 -4
@@ -10214,10 +10214,6 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)return -EAGAIN ; } - err =nft_flow_rule_offload_commit (net); -if (err <0 ) -return err; -/* 1. Allocate space for next generation rules_gen_X[] */ list_for_each_entry_safe (trans, next, &nft_net->commit_list, list) {int ret;
@@ -10241,6 +10237,16 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) } } +/* must be last, so audit and chain blob set up does not leave hardware +* in consistent state. +*/ + err =nft_flow_rule_offload_commit (net); +if (err <0 ) { +nf_tables_commit_chain_prepare_cancel (net); +nf_tables_commit_audit_free (&adl); +return err; + } +/* step 2. Make rules_gen_X visible to packet path */ list_for_each_entry (table, &nft_net->tables, list) {list_for_each_entry (chain, &table->chains, list)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1381/1424 netfilter: xt_cgroup: Make it independent from net_cls
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Koutný <[email protected]>
[ Upstream commit 3ba0032afea888d0edebf5ece3c6b36417189b63 ]
The xt_group matching supports the default hierarchy since commit c38c4597e4bf3 ("netfilter: implement xt_cgroup cgroup2 path match"). The cgroup v1 matching (based on clsid) and cgroup v2 matching (based on path) are rather independent. Downgrade the Kconfig dependency to mere CONFIG_SOCK_GROUP_DATA so that xt_group can be built even without CONFIG_NET_CLS_CGROUP for path matching.
Also add a message for users when they attempt to specify any clsid.
Stable-dep-of: 793d9eda4821 ("netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited()")
--- net/netfilter/Kconfig | 2 +- net/netfilter/xt_cgroup.c | 17 +++++++++++++++++ 2 files changed, 18 insertions(+), 1 deletion(-)
net/netfilter/Kconfig +1 -1
@@ -1180,7 +1180,7 @@ config NETFILTER_XT_MATCH_CGROUP tristate '"control group" match support' depends on NETFILTER_ADVANCED depends on CGROUPS - select CGROUP_NET_CLASSID + select SOCK_CGROUP_DATA help Socket/process control group matching allows you to match locally generated packets based on which net_cls control group processes
net/netfilter/xt_cgroup.c +17 -0
@@ -23,6 +23,8 @@ MODULE_DESCRIPTION("Xtables: process control group matching");MODULE_ALIAS ("ipt_cgroup" );MODULE_ALIAS ("ip6t_cgroup" ); +#define NET_CLS_CLASSID_INVALID_MSG "xt_cgroup: classid invalid without net_cls cgroups\n" +static int cgroup_mt_check_v0 (const struct xt_mtchk_param *par) {struct xt_cgroup_info_v0 *info = par->matchinfo;
@@ -30,6 +32,11 @@ static int cgroup_mt_check_v0(const struct xt_mtchk_param *par)if (info->invert & ~1 )return -EINVAL ; +if (!IS_ENABLED (CONFIG_CGROUP_NET_CLASSID )) { +pr_info (NET_CLS_CLASSID_INVALID_MSG ); +return -EINVAL ; + } +return 0 ; }
@@ -51,6 +58,11 @@ static int cgroup_mt_check_v1(const struct xt_mtchk_param *par)return -EINVAL ; } +if (info->has_classid && !IS_ENABLED (CONFIG_CGROUP_NET_CLASSID )) { +pr_info (NET_CLS_CLASSID_INVALID_MSG ); +return -EINVAL ; + } + info->priv =NULL ;if (info->has_path) {if (strnlen (info->path,sizeof (info->path)) >=sizeof (info->path))
@@ -86,6 +98,11 @@ static int cgroup_mt_check_v2(const struct xt_mtchk_param *par)return -EINVAL ; } +if (info->has_classid && !IS_ENABLED (CONFIG_CGROUP_NET_CLASSID )) { +pr_info (NET_CLS_CLASSID_INVALID_MSG ); +return -EINVAL ; + } + info->priv =NULL ;if (info->has_path) {if (strnlen (info->path,sizeof (info->path)) >=sizeof (info->path))
Signature · 1 line
2.53.0