6.18.53-rc1 review
Subsystems (6)
Greg Kroah-Hartman
maintainerPATCH 424/1250 gpio: pisosr: Read "ngpios" as u32
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Herring (Arm) <[email protected]>
[ Upstream commit 4910aa198d25e5d1067236560ba34ab12bccc677 ]
The generic "ngpios" property is encoded as a normal uint32 cell. The pisosr driver stores it in the gpio_chip field, but reading it with a u16 helper does not match the DT property encoding.
Read "ngpios" as u32 and keep the existing assignment to the chip field.
--- drivers/gpio/gpio-pisosr.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpio/gpio-pisosr.c +3 -1
@@ -112,6 +112,7 @@ static int pisosr_gpio_probe(struct spi_device *spi) {struct device *dev = &spi->dev;struct pisosr_gpio *gpio; +u32 ngpios;int ret; gpio =devm_kzalloc (dev,sizeof (*gpio),GFP_KERNEL );
@@ -120,7 +121,8 @@ static int pisosr_gpio_probe(struct spi_device *spi) gpio->chip = template_chip; gpio->chip.parent = dev; -of_property_read_u16 (dev->of_node,"ngpios" , &gpio->chip.ngpio); +if (!of_property_read_u32 (dev->of_node,"ngpios" , &ngpios)) + gpio->chip.ngpio = ngpios; gpio->spi = spi;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 425/1250 spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: guoqi0226 <[email protected]>
[ Upstream commit f1b061b4d4c6cbf861319ba954caa80145cf018f ]
Prevent NULL pointer dereference when spi_get_device_id() returns NULL, which can happen when using driver_override without matching SPI ID entry.
--- drivers/spi/spi.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/spi/spi.c +5 -1
@@ -358,12 +358,16 @@ EXPORT_SYMBOL_GPL(spi_get_device_id);const void *spi_get_device_match_data (const struct spi_device *sdev) {const void *match; +const struct spi_device_id *id; match =device_get_match_data (&sdev->dev);if (match)return match; -return (const void *)spi_get_device_id (sdev)->driver_data; + id =spi_get_device_id (sdev); +if (!id) +return NULL ; +return (const void *)id->driver_data; }EXPORT_SYMBOL_GPL (spi_get_device_match_data);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 426/1250 ALSA: usb-audio: Add quirk flags for SC13A
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ai Chao <[email protected]>
[ Upstream commit 8956950dab22fbaefe92ca1980728165c5da793d ]
The SC13A ( VID 0x1ff7, PID 0x0f81) not support reading the current sample rate and results in an error message printed to kmsg. Set QUIRK_FLAG_GET_SAMPLE_RATE to skip the sample rate check.
Quirky device sample:
usb 3-5.2.4.1: new high-speed USB device number 11 using xhci_hcd usb 3-5.2.4.1: New USB device found, idVendor=1ff7, idProduct=0f81 usb 3-5.2.4.1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 3-5.2.4.1: Product: SC13A
usb 3-5.2.4.1: Manufacturer: Linux Foundation
usb 3-5.2.4.1: SerialNumber: 000002
usb 3-5.2.4.1: Found UVC 1.50 device SC13A (1ff7:0f81)
usb 3-5.2.4.1: 3:1: cannot get freq at ep 0x86
usb 3-5.2.4.1: Warning! Unlikely big volume range (=4096),
cval->res is probably wrong.
usb 3-5.2.4.1: [5] FU [Mic Capture Volume] ch = 1, val = 0/4096/1
usbcore: registered new interface driver snd-usb-audio usb 3-5.2.4.1: 3:1: cannot get freq at ep 0x86
usb 3-5.2.4.1: 3:1: cannot get freq at ep 0x86
--- sound/usb/quirks.c | 2 ++ 1 file changed, 2 insertions(+)
sound/usb/quirks.c +2 -0
@@ -2335,6 +2335,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_MIC_RES_16),DEVICE_FLG (0x1bcf ,0x2283 ,/* NexiGo N930AF FHD Webcam */ QUIRK_FLAG_GET_SAMPLE_RATE |QUIRK_FLAG_MIC_RES_16 ), +DEVICE_FLG (0x1ff7 ,0x0f81 ,/* SC13A Webcam */ +QUIRK_FLAG_GET_SAMPLE_RATE ),DEVICE_FLG (0x2040 ,0x7200 ,/* Hauppauge HVR-950Q */ QUIRK_FLAG_SHARE_MEDIA_DEVICE |QUIRK_FLAG_ALIGN_TRANSFER ), DEVICE_FLG(0x2040, 0x7201, /* Hauppauge HVR-950Q-MXL */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 427/1250 tls: reject the combination of TLS and sockmap
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 460e6486617c17dd19abe8f3fc67d9a6fa25f8ca ]
TLS and sockmap (BPF psock) integration hides a lot of latent bugs. Bugs which may be more or less relevant for real users but they are definitely exploitable.
We could not find anyone actively using this integration so let's reject this config. Adding a TLS socket to a sockmap was already rejected by sk_psock_init() through the inet_csk_has_ulp() check. We need to reject the attempts to configure the TLS keys (rather than adding the ULP itself) because checking prior to the ULP installation is tricky without risking a race with sockmap getting added in parallel (sockmap does not hold the socket lock).
This patch is a minimal rejection of the feature. Subsequent patch in the series will do a light dead code removal. Full cleanup would require a major rewrite of the Tx path, we don't need skmsg any more.
--- net/tls/tls_main.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
net/tls/tls_main.c +11 -0
@@ -620,6 +620,17 @@ static int do_tls_setsockopt_conf(struct sock *sk, sockptr_t optval,int rc =0 ;int conf; +/* TLS and sockmap are mutually exclusive. A socket already in a +* sockmap (i.e. with a psock attached) cannot be upgraded to TLS. +* sockmap rejects TLS sockets already (see sk_psock_init()). +*/ +rcu_read_lock (); +if (sk_psock (sk)) { +rcu_read_unlock (); +return -EINVAL ; + } +rcu_read_unlock (); +if (sockptr_is_null (optval) || (optlen <sizeof (*crypto_info)))return -EINVAL ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 428/1250 ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Galen Hassen <[email protected]>
[ Upstream commit f7c4968ae3af3e819428da5416c2dfd361473f5c ]
The Lenovo IdeaPad Slim 5 16AKP10 (PCI SSID 17aa:38b6) uses the Conexant SN6140 codec. The internal microphone is on pin 0x1a but the BIOS configures it with pin default 0x95a60120, which includes a jack detection bit that causes the kernel to treat it as an unplugged external mic rather than a fixed internal mic.
Add a pin config quirk that overrides pin 0x1a to 0x95a60130, setting the connectivity bits to indicate a fixed/always-connected device. This allows the internal microphone to be correctly identified and used.
--- sound/hda/codecs/conexant.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
sound/hda/codecs/conexant.c +12 -0
@@ -294,6 +294,7 @@ enum {CXT_FIXUP_HEADSET_MIC ,CXT_FIXUP_HP_MIC_NO_PRESENCE ,CXT_PINCFG_SWS_JS201D , +CXT_PINCFG_LENOVO_IDEAPAD_SLIM5_16AKP10 ,CXT_PINCFG_TOP_SPEAKER ,CXT_FIXUP_HP_A_U , CXT_FIXUP_ACER_SWIFT_HP,
@@ -831,6 +832,12 @@ static const struct hda_pintbl cxt_pincfg_lemote[] = { {} }; +/* Lenovo IdeaPad Slim 5 16AKP10 with SN6140 */ +static const struct hda_pintbl cxt_pincfg_lenovo_ideapad_slim5_16akp10[] = { + {0x1a ,0x95a60130 },/* Internal mic, fixed/always-connected */ + {} +}; +/* SuoWoSi/South-holding JS201D with sn6140 */ static const struct hda_pintbl cxt_pincfg_sws_js201d[] = { {0x16 ,0x03211040 },/* hp out */
@@ -1011,6 +1018,10 @@ static const struct hda_fixup cxt_fixups[] = { .type = HDA_FIXUP_PINS, .v.pins = cxt_pincfg_sws_js201d, }, + [CXT_PINCFG_LENOVO_IDEAPAD_SLIM5_16AKP10] = { + .type = HDA_FIXUP_PINS, + .v.pins = cxt_pincfg_lenovo_ideapad_slim5_16akp10, + }, [CXT_PINCFG_TOP_SPEAKER] = { .type = HDA_FIXUP_PINS, .v.pins = (const struct hda_pintbl []) {
@@ -1119,6 +1130,7 @@ static const struct hda_quirk cxt5066_fixups[] = {SND_PCI_QUIRK (0x17aa ,0x21da ,"Lenovo X220" ,CXT_PINCFG_LENOVO_TP410 ),SND_PCI_QUIRK (0x17aa ,0x21db ,"Lenovo X220-tablet" ,CXT_PINCFG_LENOVO_TP410 ),SND_PCI_QUIRK (0x17aa ,0x38af ,"Lenovo IdeaPad Z560" ,CXT_FIXUP_MUTE_LED_EAPD ), +SND_PCI_QUIRK (0x17aa ,0x38b6 ,"Lenovo IdeaPad Slim 5 16AKP10" ,CXT_PINCFG_LENOVO_IDEAPAD_SLIM5_16AKP10 ),SND_PCI_QUIRK (0x17aa ,0x3905 ,"Lenovo G50-30" ,CXT_FIXUP_STEREO_DMIC ),SND_PCI_QUIRK (0x17aa ,0x390b ,"Lenovo G50-80" ,CXT_FIXUP_STEREO_DMIC ), SND_PCI_QUIRK(0x17aa, 0x3975, "Lenovo U300s", CXT_FIXUP_STEREO_DMIC),
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 429/1250 leds: uleds: Return -EFAULT on copy_to_user() failure
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yousef Alhouseen <[email protected]>
[ Upstream commit 61ed78f55a46e12afd4b464c4ba736f55ff33c5e ]
uleds_read() copies the current brightness value to userspace but ignores copy_to_user() failures. It then clears the pending update and reports a successful full read even when no data was copied.
Return -EFAULT when the copy fails and leave the update pending so a later read can retry.
--- drivers/leds/uleds.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/leds/uleds.c +7 -4
@@ -148,10 +148,13 @@ static ssize_t uleds_read(struct file *file, char __user *buffer, size_t count, }else if (!udev->new_data && (file->f_flags &O_NONBLOCK )) { retval = -EAGAIN ; }else if (udev->new_data) { - retval =copy_to_user (buffer, &udev->brightness, -sizeof (udev->brightness)); - udev->new_data = false; - retval =sizeof (udev->brightness); +if (copy_to_user (buffer, &udev->brightness, +sizeof (udev->brightness))) { + retval = -EFAULT ; + }else { + udev->new_data = false; + retval =sizeof (udev->brightness); + } }mutex_unlock (&udev->mutex);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 430/1250 leds: pca9532: Dont stop blinking for non-zero brightness
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tobias Deiminger <[email protected]>
[ Upstream commit 0261683a4d31783d680e74b3ae5f22f6a62128cc ]
pca9532 unexpectedly stopped blinking when changing brightness to a non-zero value. To reproduce:
echo timer > /sys/class/leds/led-1/trigger # blinks echo 255 > /sys/class/leds/led-1/brightness # blinking stops, light on cat /sys/class/leds/led-1/trigger # still claims [timer]
According to Documentation/leds/leds-class.rst, only brightness = 0 shall be a stop condition:
Quoted 3 lines
You can change the brightness value of a LED independently of the timer trigger. However, if you set the brightness value to
LED_OFFit will also disable the timer trigger.
Therefore add a guard to continue blinking when brightness != LED_OFF, similar to how pca955x does it since 575f10dc64a2 ("leds: pca955x: Add HW blink support").
--- drivers/leds/leds-pca9532.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/leds/leds-pca9532.c +5 -3
@@ -182,11 +182,13 @@ static int pca9532_set_brightness(struct led_classdev *led_cdev,int err =0 ;struct pca9532_led *led =ldev_to_led (led_cdev); -if (value ==LED_OFF ) +if (value ==LED_OFF ) { led->state =PCA9532_OFF ; -else if (value ==LED_FULL ) + }else if (led->state ==PCA9532_PWM1 ) { +return 0 ;/* Non-zero brightness shall not stop HW blinking */ + }else if (value ==LED_FULL ) { led->state =PCA9532_ON ; -else { + }else { led->state =PCA9532_PWM0 ;/* Thecus: hardcode one pwm */ err =pca9532_calcpwm (led->client,PCA9532_PWM_ID_0 ,0 , value);if (err)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 431/1250 mfd: tps65219: Make poweroff handler conditional on system-power-controller
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akashdeep Kaur <[email protected]>
[ Upstream commit 104cd764a031bfe2ffe253adce9581384a78c16e ]
Currently, the TPS65219 driver unconditionally registers a poweroff handler. This causes issues on systems where a different component (such as TF-A firmware) should handle system poweroff instead.
Make the poweroff handler registration conditional based on the "system-power-controller" device tree property. This follows the standard kernel pattern where only the designated power controller registers for system poweroff operations.
On systems where the property is absent, the PMIC will not register a poweroff handler, allowing other poweroff mechanisms to function.
--- drivers/mfd/tps65219.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/mfd/tps65219.c +8 -6
@@ -541,13 +541,15 @@ static int tps65219_probe(struct i2c_client *client)return ret; } - ret =devm_register_power_off_handler (tps->dev, - tps65219_power_off_handler, - tps); -if (ret) { -dev_err (tps->dev,"failed to register power-off handler: %d\n" , ret); -return ret; +if (of_device_is_system_power_controller (tps->dev->of_node)) { + ret =devm_register_power_off_handler (tps->dev, + tps65219_power_off_handler, + tps); +if (ret) +return dev_err_probe (tps->dev, ret, +"Failed to register power-off handler\n" ); } +return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 432/1250 leds: trigger: gpio: Use GPIOD_FLAGS_BIT_NONEXCLUSIVE
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Piotr Kubik <[email protected]>
[ Upstream commit 26e15f2558f66b6747ef981df8054d0d92d01b60 ]
When a GPIO is shared between the LED trigger driver and another driver, the LED trigger driver needs to request the GPIO with GPIOD_FLAGS_BIT_NONEXCLUSIVE to allow both drivers to monitor the same GPIO pin.
Without this flag, if another driver has already claimed the GPIO, the LED trigger driver's gpiod_get_optional() call fails silently, and the LED trigger doesn't work.
This is needed for scenarios like:
- SFP module presence/status LED triggered by SFP Mod_ABS/Rx_LOS
Both GPIOs are also monitored by the SFP driver for module state management, so they need to be shared.
--- drivers/leds/trigger/ledtrig-gpio.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/leds/trigger/ledtrig-gpio.c +2 -1
@@ -86,7 +86,8 @@ static int gpio_trig_activate(struct led_classdev *led)* The generic property "trigger-sources" is followed, * and we hope that this is a GPIO. */ - gpio_data->gpiod =gpiod_get_optional (dev,"trigger-sources" ,GPIOD_IN ); + gpio_data->gpiod =gpiod_get_optional (dev,"trigger-sources" , +GPIOD_IN |GPIOD_FLAGS_BIT_NONEXCLUSIVE );if (IS_ERR (gpio_data->gpiod)) { ret =PTR_ERR (gpio_data->gpiod);kfree (gpio_data);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 433/1250 mfd: rsmu: Add 8a34002 support
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Bystrin <[email protected]>
[ Upstream commit d18fd55c780c2bae3d353024cab7f8746d3d9e91 ]
Add compatible string, i2c_devcie_id and spi_devcie_id to support 8a34002.
--- drivers/mfd/rsmu_i2c.c | 2 ++ drivers/mfd/rsmu_spi.c | 2 ++ 2 files changed, 4 insertions(+)
drivers/mfd/rsmu_i2c.c +2 -0
@@ -330,6 +330,7 @@ static void rsmu_i2c_remove(struct i2c_client *client)static const struct i2c_device_id rsmu_i2c_id[] = { {"8a34000" ,RSMU_CM }, {"8a34001" ,RSMU_CM }, + {"8a34002" ,RSMU_CM }, {"82p33810" ,RSMU_SABRE }, {"82p33811" ,RSMU_SABRE }, {"8v19n850" ,RSMU_SL },
@@ -341,6 +342,7 @@ MODULE_DEVICE_TABLE(i2c, rsmu_i2c_id);static const struct of_device_id rsmu_i2c_of_match[] = { { .compatible ="idt,8a34000" , .data = (void *)RSMU_CM }, { .compatible ="idt,8a34001" , .data = (void *)RSMU_CM }, + { .compatible ="idt,8a34002" , .data = (void *)RSMU_CM }, { .compatible ="idt,82p33810" , .data = (void *)RSMU_SABRE }, { .compatible ="idt,82p33811" , .data = (void *)RSMU_SABRE }, { .compatible ="idt,8v19n850" , .data = (void *)RSMU_SL },
drivers/mfd/rsmu_spi.c +2 -0
@@ -241,6 +241,7 @@ static void rsmu_spi_remove(struct spi_device *client)static const struct spi_device_id rsmu_spi_id[] = { {"8a34000" ,RSMU_CM }, {"8a34001" ,RSMU_CM }, + {"8a34002" ,RSMU_CM }, {"82p33810" ,RSMU_SABRE }, {"82p33811" ,RSMU_SABRE }, {}
@@ -250,6 +251,7 @@ MODULE_DEVICE_TABLE(spi, rsmu_spi_id);static const struct of_device_id rsmu_spi_of_match[] = { { .compatible ="idt,8a34000" , .data = (void *)RSMU_CM }, { .compatible ="idt,8a34001" , .data = (void *)RSMU_CM }, + { .compatible ="idt,8a34002" , .data = (void *)RSMU_CM }, { .compatible ="idt,82p33810" , .data = (void *)RSMU_SABRE }, { .compatible ="idt,82p33811" , .data = (void *)RSMU_SABRE }, {}
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 434/1250 drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaogang Chen <[email protected]>
[ Upstream commit 8242a8d9d7194d5ef8a8b38a5621ca0966a3ec15 ]
amdkfd driver needs allocate buffer to return bo metadata to user space. The buffer size is controlled by user currently. It is a potential security issue that hostile value (e.g. 2 GiB) lets any render-group user trigger order-MAX allocation/OOM in kernel context.
This patch first finds bo metadata size. If the size is smaller than user provided value drive can safely allocate buffer in kernel space and copy to user space buffer. If not, driver will let user know, not allocate and copy. User will redo with new buffer in user space.
This patch lets driver decide buffer allocation size to avoid potential hostile size from user space.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 23 ++++++++++++++++++---- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 10 ++-------- 3 files changed, 22 insertions(+), 13 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c +19 -4
@@ -528,7 +528,7 @@ uint32_t amdgpu_amdkfd_get_max_engine_clock_in_mhz(struct amdgpu_device *adev)int amdgpu_amdkfd_get_dmabuf_info (struct amdgpu_device *adev,int dma_buf_fd,struct amdgpu_device **dmabuf_adev, -uint64_t *bo_size,void *metadata_buffer, +uint64_t *bo_size,void **metadata_buffer,size_t buffer_size,uint32_t *metadata_size,uint32_t *flags,int8_t *xcp_id) {
@@ -563,9 +563,24 @@ int amdgpu_amdkfd_get_dmabuf_info(struct amdgpu_device *adev, int dma_buf_fd, *dmabuf_adev = adev;if (bo_size) *bo_size =amdgpu_bo_size (bo); -if (metadata_buffer) - r =amdgpu_bo_get_metadata (bo, metadata_buffer, buffer_size, - metadata_size, &metadata_flags); +if (metadata_buffer) { +/* first get metadata_size by buffer = NULL */ + r =amdgpu_bo_get_metadata (bo,NULL ,0 , + metadata_size,NULL ); + +/* user buf_size is bigger than bo metadata_size +* allocate a buf at kernel space and copy */ +if (*metadata_size <= buffer_size) { + *metadata_buffer =kzalloc (*metadata_size,GFP_KERNEL ); + +if (!*metadata_buffer) +return -ENOMEM ; + + r =amdgpu_bo_get_metadata (bo, *metadata_buffer, *metadata_size, +NULL , &metadata_flags); + }else + r = -EINVAL ; + }if (flags) { *flags = (bo->preferred_domains & AMDGPU_GEM_DOMAIN_VRAM) ? KFD_IOC_ALLOC_MEM_FLAGS_VRAM
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h +1 -1
@@ -255,7 +255,7 @@ uint64_t amdgpu_amdkfd_get_gpu_clock_counter(struct amdgpu_device *adev);uint32_t amdgpu_amdkfd_get_max_engine_clock_in_mhz (struct amdgpu_device *adev);int amdgpu_amdkfd_get_dmabuf_info (struct amdgpu_device *adev,int dma_buf_fd,struct amdgpu_device **dmabuf_adev, -uint64_t *bo_size,void *metadata_buffer, +uint64_t *bo_size,void **metadata_buffer,size_t buffer_size,uint32_t *metadata_size,uint32_t *flags,int8_t *xcp_id);int amdgpu_amdkfd_get_pcie_bandwidth_mbytes (struct amdgpu_device *adev,bool is_min);
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +2 -8
@@ -1525,16 +1525,10 @@ static int kfd_ioctl_get_dmabuf_info(struct file *filep,if (!dev)return -EINVAL ; -if (args->metadata_ptr) { - metadata_buffer =kzalloc (args->metadata_size,GFP_KERNEL ); -if (!metadata_buffer) -return -ENOMEM ; - } -/* Get dmabuf info from KGD */ r =amdgpu_amdkfd_get_dmabuf_info (dev->adev, args->dmabuf_fd, &dmabuf_adev, &args->size, - metadata_buffer, args->metadata_size, + &metadata_buffer, args->metadata_size, &args->metadata_size, &flags, &xcp_id);if (r) goto exit;
@@ -1546,7 +1540,7 @@ static int kfd_ioctl_get_dmabuf_info(struct file *filep, args->flags = flags;/* Copy metadata buffer to user mode */ -if (metadata_buffer) { +if (metadata_buffer && args->metadata_ptr) { r =copy_to_user ((void __user *)args->metadata_ptr, metadata_buffer, args->metadata_size);if (r !=0 )
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 435/1250 drm/amdkfd: check find_first_zero_bit before __set_bit on kfd->doorbell_bitmap
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaogang Chen <[email protected]>
[ Upstream commit 516bf737a5602875f6c28d1028967837c8edf2c0 ]
If inx from find_first_zero_bit is beyond range not need set doorbell_bitmap.
--- drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c +5 -3
@@ -153,14 +153,16 @@ void __iomem *kfd_get_kernel_doorbell(struct kfd_dev *kfd,u32 inx;mutex_lock (&kfd->doorbell_mutex); + inx =find_first_zero_bit (kfd->doorbell_bitmap,PAGE_SIZE /sizeof (u32)); +if (inx >=KFD_MAX_NUM_OF_QUEUES_PER_PROCESS ) { +mutex_unlock (&kfd->doorbell_mutex); +return NULL ; + }__set_bit (inx, kfd->doorbell_bitmap);mutex_unlock (&kfd->doorbell_mutex); -if (inx >=KFD_MAX_NUM_OF_QUEUES_PER_PROCESS ) -return NULL ; - *doorbell_off = amdgpu_doorbell_index_on_bar(kfd->adev, kfd->doorbells, inx,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 436/1250 drm/amdgpu: Use system unbound workqueue for soft IH ring
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit ba2977dcce72127986fbad76c4c67f134e2f69ae ]
Allow the kernel to dispatch the soft IH work on other CPUs.
Otherwise it can happen that the soft IH ring fills up before it actually starts processing anything, which can easily happen with retry page faults, in which case the CP repeatedly spams the CPU with a lot of interrupts.
This significantly improves retry page fault handling on GPUs that don't have the filter CAM and must rely on software based filtering.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c +1 -1
@@ -512,7 +512,7 @@ void amdgpu_irq_delegate(struct amdgpu_device *adev, unsigned int num_dw) {amdgpu_ih_ring_write (adev, &adev->irq.ih_soft, entry->iv_entry, num_dw); -schedule_work (&adev->irq.ih_soft_work); +queue_work (system_unbound_wq, &adev->irq.ih_soft_work); }/**
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 437/1250 ALSA: usb-audio: Add quirk for YAMAHA CDS3000
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Louis Colaco <[email protected]>
[ Upstream commit 348f69320e4db6ebec6940c81154bec4b9eb275a ]
This quirk is identical to the one for the Yamaha Steinberg UR22, here applied to a CD player that also uses the Steinberg USB interface. This quirk is necessary to avoid sporadic "clic" noise when using the DAC of the player.
--- sound/usb/quirks-table.h | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
sound/usb/quirks-table.h +14 -0
@@ -390,6 +390,20 @@ YAMAHA_DEVICE(0x105d, NULL), } } }, +{ +USB_DEVICE (0x0499 ,0x150d ), + QUIRK_DRIVER_INFO { +/* .vendor_name = "Yamaha", */ +/* .product_name = "CDS3000", */ + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(1) }, + { QUIRK_DATA_STANDARD_AUDIO(2) }, + { QUIRK_DATA_MIDI_YAMAHA(3) }, + { QUIRK_DATA_IGNORE(4) }, + QUIRK_COMPOSITE_END + } + } +}, {USB_DEVICE (0x0499 ,0x1718 ), QUIRK_DRIVER_INFO {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 438/1250 drm/amdkfd: Properly acquire queue buffers in CRIU restore
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Francis <[email protected]>
[ Upstream commit 20a5e7ffdfecddc34c60a6b4483f42acf3d8731d ]
When kfd_queue_acquire_buffers() was split off from set_queue_properties_from_user(), set_queue_properties_from_criu() was missed. Thus, set_queue_properties_from_criu() is not filling out the buffer fields of queue_properties, which can come up when subsequent code expects them to be non-null.
Add the proper call to kfd_queue_acquire_buffers(), and also use the right cast types in set_queue_properties_from_criu() (which were missed at the same time)
--- .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c +10 -2
@@ -974,8 +974,8 @@ static void set_queue_properties_from_criu(struct queue_properties *qp, qp->priority = q_data->priority; qp->queue_address = q_data->q_address; qp->queue_size = q_data->q_size; - qp->read_ptr = (uint32_t *) q_data->read_ptr_addr; - qp->write_ptr = (uint32_t *) q_data->write_ptr_addr; + qp->read_ptr = (void __user *)q_data->read_ptr_addr; + qp->write_ptr = (void __user *)q_data->write_ptr_addr; qp->eop_ring_buffer_address = q_data->eop_ring_buffer_address; qp->eop_ring_buffer_size = q_data->eop_ring_buffer_size; qp->ctx_save_restore_area_address = q_data->ctx_save_restore_area_address;
@@ -1064,10 +1064,18 @@ int kfd_criu_restore_queue(struct kfd_process *p,memset (&qp,0 ,sizeof (qp));set_queue_properties_from_criu (&qp, q_data,NUM_XCC (pdd->dev->adev->gfx.xcc_mask)); + ret =kfd_queue_acquire_buffers (pdd, &qp); +if (ret) { +pr_debug ("failed to acquire user queue buffers for CRIU\n" ); + goto exit; + } +print_queue_properties (&qp); ret =pqm_create_queue (&p->pqm, pdd->dev, &qp, &queue_id, q_data, mqd, ctl_stack,NULL );if (ret) { +kfd_queue_unref_bo_vas (pdd, &qp); +kfd_queue_release_buffers (pdd, &qp);pr_err ("Failed to create new queue err:%d\n" , ret); goto exit; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 439/1250 PCI: iproc: Protect root bus removal with rescan lock
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Zhang <[email protected]>
[ Upstream commit a6a64e150f12ad5391e0a0d60f6a3d119b06ce50 ]
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead to use-after-free issues or system crashes.
--- drivers/pci/controller/pcie-iproc.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pci/controller/pcie-iproc.c +2 -0
@@ -1540,8 +1540,10 @@ void iproc_pcie_remove(struct iproc_pcie *pcie) {struct pci_host_bridge *host =pci_host_bridge_from_priv (pcie); +pci_lock_rescan_remove ();pci_stop_root_bus (host->bus);pci_remove_root_bus (host->bus); +pci_unlock_rescan_remove ();iproc_pcie_msi_disable (pcie);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 440/1250 PCI: altera: Protect root bus removal with rescan lock
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Zhang <[email protected]>
[ Upstream commit a8759c8ac48c0419f5899e95a6ffc611b07c965b ]
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead to use-after-free issues or system crashes.
--- drivers/pci/controller/pcie-altera.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pci/controller/pcie-altera.c +2 -0
@@ -1075,8 +1075,10 @@ static void altera_pcie_remove(struct platform_device *pdev)struct altera_pcie *pcie =platform_get_drvdata (pdev);struct pci_host_bridge *bridge =pci_host_bridge_from_priv (pcie); +pci_lock_rescan_remove ();pci_stop_root_bus (bridge->bus);pci_remove_root_bus (bridge->bus); +pci_unlock_rescan_remove ();altera_pcie_irq_teardown (pcie); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 441/1250 PCI: rockchip: Protect root bus removal with rescan lock
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Zhang <[email protected]>
[ Upstream commit 0bd9611587bb494c33566d825fe34b2705e4b167 ]
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead to use-after-free issues or system crashes.
--- drivers/pci/controller/pcie-rockchip-host.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pci/controller/pcie-rockchip-host.c +2 -0
@@ -1012,8 +1012,10 @@ static void rockchip_pcie_remove(struct platform_device *pdev)struct rockchip_pcie *rockchip =dev_get_drvdata (dev);struct pci_host_bridge *bridge =pci_host_bridge_from_priv (rockchip); +pci_lock_rescan_remove ();pci_stop_root_bus (bridge->bus);pci_remove_root_bus (bridge->bus); +pci_unlock_rescan_remove ();irq_domain_remove (rockchip->irq_domain);rockchip_pcie_deinit_phys (rockchip);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 442/1250 PCI: mediatek: Protect root bus removal with rescan lock
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Zhang <[email protected]>
[ Upstream commit a29812a55da8d0dbeb071b26ac428c338e3fc389 ]
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead to use-after-free issues or system crashes.
--- drivers/pci/controller/pcie-mediatek.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pci/controller/pcie-mediatek.c +2 -0
@@ -1154,8 +1154,10 @@ static void mtk_pcie_remove(struct platform_device *pdev)struct mtk_pcie *pcie =platform_get_drvdata (pdev);struct pci_host_bridge *host =pci_host_bridge_from_priv (pcie); +pci_lock_rescan_remove ();pci_stop_root_bus (host->bus);pci_remove_root_bus (host->bus); +pci_unlock_rescan_remove ();mtk_pcie_free_resources (pcie);mtk_pcie_irq_teardown (pcie);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 443/1250 PCI: plda: Protect root bus removal with rescan lock
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Zhang <[email protected]>
[ Upstream commit 4e4f9745f016c1631d00a4035b06f6e75d449e01 ]
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead to use-after-free issues or system crashes.
--- drivers/pci/controller/plda/pcie-plda-host.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pci/controller/plda/pcie-plda-host.c +2 -0
@@ -672,8 +672,10 @@ EXPORT_SYMBOL_GPL(plda_pcie_host_init);void plda_pcie_host_deinit (struct plda_pcie_rp *port) { +pci_lock_rescan_remove ();pci_stop_root_bus (port->bridge->bus);pci_remove_root_bus (port->bridge->bus); +pci_unlock_rescan_remove ();plda_pcie_irq_domain_deinit (port);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 444/1250 perf: Fix addr_filter_ranges lifetime
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
[ Upstream commit e62d4192e593630f355094adc467058a05bdc935 ]
Lee Jia Jie reported that since event::addr_filter_ranges is used under RCU, it should be RCU freed.
--- kernel/events/core.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
kernel/events/core.c +1 -2
@@ -5168,6 +5168,7 @@ static void free_event_rcu(struct rcu_head *head)if (event->ns)put_pid_ns (event->ns);perf_event_free_filter (event); +kfree (event->addr_filter_ranges);kmem_cache_free (perf_event_cache, event); }
@@ -5614,8 +5615,6 @@ static void __free_event(struct perf_event *event)if (event->attach_state &PERF_ATTACH_CALLCHAIN )put_callchain_buffers (); -kfree (event->addr_filter_ranges); -if (event->attach_state &PERF_ATTACH_EXCLUSIVE )exclusive_event_destroy (event);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 445/1250 mailbox: imx: Use devm_pm_runtime_enable()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <[email protected]>
[ Upstream commit 1f602619e408b6e9655ee76656a2a5ab6e89c5e4 ]
sashiko complained about early usage of the device while probe isn't completed. This can be mitigated by delaying the pm_runtime_enable() into the removal path instead doing it early. This ensures that in an error case the device is removed (and imx_mu_shutdown()) before pm_runtime_disable() so we don't have to do this manually.
For the order to work, lets move devm_mbox_controller_register() until after the pm-runtime part. So the reverse order will be mbox-controller removal followed by disabling pm runtime.
Use devm_pm_runtime_enable(), remove manual pm_runtime_disable() invocations and move the pm_runtime handling in probe before devm_mbox_controller_register().
--- drivers/mailbox/imx-mailbox.c | 24 +++++++++++------------- 1 file changed, 11 insertions(+), 13 deletions(-)
drivers/mailbox/imx-mailbox.c +11 -13
@@ -936,38 +936,36 @@ static int imx_mu_probe(struct platform_device *pdev)platform_set_drvdata (pdev, priv); - ret =devm_mbox_controller_register (dev, &priv->mbox); -if (ret) + ret =devm_pm_runtime_enable (dev); +if (ret <0 ) goto disable_clk; -of_platform_populate (dev->of_node,NULL ,NULL , dev); - -pm_runtime_enable (dev); - ret =pm_runtime_resume_and_get (dev);if (ret <0 ) - goto disable_runtime_pm; + goto disable_clk; ret =pm_runtime_put_sync (dev);if (ret <0 ) - goto disable_runtime_pm; + goto disable_clk;clk_disable_unprepare (priv->clk); + ret =devm_mbox_controller_register (dev, &priv->mbox); +if (ret) + goto err_out; + +of_platform_populate (dev->of_node,NULL ,NULL , dev); +return 0 ; -disable_runtime_pm: -pm_runtime_disable (dev); disable_clk:clk_disable_unprepare (priv->clk); +err_out:return ret; }static void imx_mu_remove (struct platform_device *pdev) { -struct imx_mu_priv *priv =platform_get_drvdata (pdev); - -pm_runtime_disable (priv->dev); }static const struct imx_mu_dcfg imx_mu_cfg_imx6sx = {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 446/1250 md/raid5: account discard IO
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
[ Upstream commit 74ddbf98e2db646ec58f7e7731c936b7a4a470fe ]
Raid5 handles discard bios internally through make_discard_request() and never passes them through md_account_bio(). As a result, discard IO is missing the md-device iostat accounting that normal raid5 IO and discard IO in other raid levels get from md_account_bio().
Before accounting the bio, trim the request to the full data stripes that raid5 will actually discard. The first full stripe is the ceiling of the bio start divided by data-stripe sectors, and the last full stripe is the floor of the bio end divided by data-stripe sectors. Account that exact MD logical full-stripe range, then restore the original iterator so bio completion and iostat still cover the original request.
--- drivers/md/raid5.c | 33 +++++++++++++++++++++++---------- 1 file changed, 23 insertions(+), 10 deletions(-)
drivers/md/raid5.c +23 -10
@@ -5700,7 +5700,10 @@ static void make_discard_request(struct mddev *mddev, struct bio *bi) {struct r5conf *conf = mddev->private;sector_t logical_sector, last_sector; +sector_t first_stripe, last_stripe;struct stripe_head *sh; +struct bvec_iter bi_iter; +struct bio *orig_bi = bi;int stripe_sectors;/* We need to handle this when io_uring supports discard/trim */
@@ -5711,19 +5714,29 @@ static void make_discard_request(struct mddev *mddev, struct bio *bi)/* Skip discard while reshape is happening */ return ; - logical_sector = bi->bi_iter.bi_sector & ~((sector_t )RAID5_STRIPE_SECTORS (conf)-1 ); - last_sector =bio_end_sector (bi); - - bi->bi_next =NULL ; - stripe_sectors = conf->chunk_sectors * (conf->raid_disks - conf->max_degraded); - logical_sector =DIV_ROUND_UP_SECTOR_T (logical_sector, - stripe_sectors); -sector_div (last_sector, stripe_sectors); + first_stripe =DIV_ROUND_UP_SECTOR_T (bi->bi_iter.bi_sector, + stripe_sectors); + last_stripe =bio_end_sector (bi); +sector_div (last_stripe, stripe_sectors); + +if (first_stripe >= last_stripe) { +bio_endio (bi); +return ; + } + + bi_iter = bi->bi_iter; + bi->bi_iter.bi_sector = first_stripe * stripe_sectors; + bi->bi_iter.bi_size = ((last_stripe - first_stripe) * + stripe_sectors) <<9 ; +md_account_bio (mddev, &bi); + orig_bi->bi_iter = bi_iter; + bi->bi_iter = bi_iter; + bi->bi_next =NULL ; - logical_sector *= conf->chunk_sectors; - last_sector *= conf->chunk_sectors; + logical_sector = first_stripe * conf->chunk_sectors; + last_sector = last_stripe * conf->chunk_sectors;for (; logical_sector < last_sector; logical_sector +=RAID5_STRIPE_SECTORS (conf)) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 447/1250 mailbox: imx: Add a channel shutdown field
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <[email protected]>
[ Upstream commit 5ccea7eacb7786c358833634f45700365f6c1d99 ]
sashiko complained about possible teardown problem. The scenario
CPU 0 CPU 1
imx_mu_isr() imx_mu_shutdown()
imx_mu_xcr_rmw(priv, IMX_MU_RCR, 0, IMX_MU_xCR_RIEn(priv->dcfg->type, cp->idx));
imx_mu_specific_rx()
imx_mu_xcr_rmw(priv, IMX_MU_RCR, IMX_MU_xCR_RIEn(priv->dcfg->type, 0), 0);
free_irq()The RX event remains enabled because in this short window the RX event was disabled in ->shutdown() while the interrupt was active and then enabled again by the ISR while ->shutdown waited in free_irq().
This race requires timing and if happens can be problematic on shared handlers if the "removed" channel triggers an interrupt. In this case the irq-core will shutdown the interrupt with the "nobody cared" message.
Introduce imx_mu_con_priv::shutdown to signal that the channel is shutting down. This flag is set with the lock held (by imx_mu_xcr_clr_shut()). The unmask side uses imx_mu_xcr_set_act() which only enables the event if the channel has not been shutdown and serialises on the same lock.
--- drivers/mailbox/imx-mailbox.c | 40 +++++++++++++++++++++++++++++++---- 1 file changed, 36 insertions(+), 4 deletions(-)
drivers/mailbox/imx-mailbox.c +36 -4
@@ -82,6 +82,7 @@ struct imx_mu_con_priv {enum imx_mu_chan_type type;struct mbox_chan *chan;struct work_struct txdb_work; +bool shutdown; };struct imx_mu_priv {
@@ -221,6 +222,36 @@ static u32 imx_mu_xcr_rmw(struct imx_mu_priv *priv, enum imx_mu_xcr type, u32 sereturn val; } +static void imx_mu_xcr_clr_shut (struct imx_mu_priv *priv,struct imx_mu_con_priv *cp, +enum imx_mu_xcr type,u32 clr) +{ +unsigned long flags; +u32 val; + +spin_lock_irqsave (&priv->xcr_lock, flags); + cp->shutdown = true; + + val =imx_mu_read (priv, priv->dcfg->xCR[type]); + val &= ~clr; +imx_mu_write (priv, val, priv->dcfg->xCR[type]); +spin_unlock_irqrestore (&priv->xcr_lock, flags); +} + +static void imx_mu_xcr_set_act (struct imx_mu_priv *priv,struct imx_mu_con_priv *cp, +enum imx_mu_xcr type,u32 set) +{ +unsigned long flags; +u32 val; + +spin_lock_irqsave (&priv->xcr_lock, flags); +if (!cp->shutdown) { + val =imx_mu_read (priv, priv->dcfg->xCR[type]); + val |= set; +imx_mu_write (priv, val, priv->dcfg->xCR[type]); + } +spin_unlock_irqrestore (&priv->xcr_lock, flags); +} +static int imx_mu_generic_tx (struct imx_mu_priv *priv,struct imx_mu_con_priv *cp,void *data)
@@ -379,7 +410,7 @@ static int imx_mu_specific_rx(struct imx_mu_priv *priv, struct imx_mu_con_priv * *data++ =imx_mu_read (priv, priv->dcfg->xRR + (i % num_rr) *4 ); } -imx_mu_xcr_rmw (priv,IMX_MU_RCR ,IMX_MU_xCR_RIEn (priv->dcfg->type,0 ),0 ); +imx_mu_xcr_set_act (priv, cp,IMX_MU_RCR ,IMX_MU_xCR_RIEn (priv->dcfg->type,0 ));mbox_chan_received_data (cp->chan, (void *)priv->msg);return 0 ;
@@ -607,6 +638,7 @@ static int imx_mu_startup(struct mbox_chan *chan)return ret; } + cp->shutdown = false;switch (cp->type) {case IMX_MU_TYPE_RX :imx_mu_xcr_rmw (priv,IMX_MU_RCR ,IMX_MU_xCR_RIEn (priv->dcfg->type, cp->idx),0 );
@@ -641,13 +673,13 @@ static void imx_mu_shutdown(struct mbox_chan *chan)switch (cp->type) {case IMX_MU_TYPE_TX : -imx_mu_xcr_rmw (priv,IMX_MU_TCR ,0 ,IMX_MU_xCR_TIEn (priv->dcfg->type, cp->idx)); +imx_mu_xcr_clr_shut (priv, cp,IMX_MU_TCR ,IMX_MU_xCR_TIEn (priv->dcfg->type, cp->idx));break ;case IMX_MU_TYPE_RX : -imx_mu_xcr_rmw (priv,IMX_MU_RCR ,0 ,IMX_MU_xCR_RIEn (priv->dcfg->type, cp->idx)); +imx_mu_xcr_clr_shut (priv, cp,IMX_MU_RCR ,IMX_MU_xCR_RIEn (priv->dcfg->type, cp->idx));break ;case IMX_MU_TYPE_RXDB : -imx_mu_xcr_rmw (priv,IMX_MU_GIER ,0 ,IMX_MU_xCR_GIEn (priv->dcfg->type, cp->idx)); +imx_mu_xcr_clr_shut (priv, cp,IMX_MU_GIER ,IMX_MU_xCR_GIEn (priv->dcfg->type, cp->idx));break ;case IMX_MU_TYPE_RST :imx_mu_xcr_rmw (priv,IMX_MU_CR ,IMX_MU_xCR_RST (priv->dcfg->type),0 );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 448/1250 mailbox: imx: use devm_of_platform_populate()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <[email protected]>
[ Upstream commit dd1b321e8024fb01404fe163076c9010c5df8608 ]
The driver uses of_platform_populate() but does not remove the added devices on removal. This can lead to "double devices" on module removal followed by adding the module again.
Use devm_of_platform_populate() to remove the populated devices once the parent device is removed.
--- drivers/mailbox/imx-mailbox.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mailbox/imx-mailbox.c +1 -1
@@ -986,7 +986,7 @@ static int imx_mu_probe(struct platform_device *pdev)if (ret) goto err_out; -of_platform_populate (dev->of_node,NULL ,NULL , dev); +devm_of_platform_populate (dev);return 0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 449/1250 md/raid5: let stripe batch bm_seq comparison wrap-safe
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Cheng <[email protected]>
[ Upstream commit 00e93faf4cea9e8802ac5dfee0952d84fc95c40f ]
Once the 32-bit seq wraps, a newer bm_seq can look smaller than old, so .. covert to wrap-safe calculate way.
--- drivers/md/raid5.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/raid5.c +1 -1
@@ -996,7 +996,7 @@ static void stripe_add_to_batch_list(struct r5conf *conf,if (test_and_clear_bit (STRIPE_BIT_DELAY , &sh->state)) {int seq = sh->bm_seq;if (test_bit (STRIPE_BIT_DELAY , &sh->batch_head->state) && - sh->batch_head->bm_seq > seq) + sh->batch_head->bm_seq - seq >0 ) seq = sh->batch_head->bm_seq;set_bit (STRIPE_BIT_DELAY , &sh->batch_head->state); sh->batch_head->bm_seq = seq;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 450/1250 ALSA: hda/realtek: Add quirk for Lenovo Yoga 7 16IAP7
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Aherin <[email protected]>
[ Upstream commit b70f007a9fc665ee988683fd5085ab34e2c10ad3 ]
The Yoga 7 16IAP7 (board LNVNB161216, codec SSID 17aa:386a) has pin complex 0x17 (bass speakers) wrongly reported as unconnected, causing only one of four speaker pins (0x14) to be configured and resulting in mono/tinny audio.
SOF corrupts the PCI subsystem ID to 17aa:0000, preventing SND_PCI_QUIRK from matching. HDA_CODEC_QUIRK is used instead, which matches against codec->core.subsystem_id read directly from the HDA codec register and unaffected by the SOF bug.
Applies ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN, the same fixup used for the Yoga 7 14IAL7, which corrects pin 0x17's default configuration and enables both speaker pairs.
--- sound/hda/codecs/realtek/alc269.c | 1 + 1 file changed, 1 insertion(+)
sound/hda/codecs/realtek/alc269.c +1 -0
@@ -7449,6 +7449,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x17aa ,0x3865 ,"Lenovo 13X" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x17aa ,0x3866 ,"Lenovo 13X" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x17aa ,0x3869 ,"Lenovo Yoga7 14IAL7" ,ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN ), +HDA_CODEC_QUIRK (0x17aa ,0x386a ,"Lenovo Yoga 7 16IAP7" ,ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN ),HDA_CODEC_QUIRK (0x17aa ,0x386e ,"Legion Y9000X 2022 IAH7" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x17aa ,0x386e ,"Yoga Pro 7 14ARP8" ,ALC285_FIXUP_SPEAKER2_TO_DAC1 ), HDA_CODEC_QUIRK(0x17aa, 0x38a8, "Legion Pro 7 16ARX8H", ALC287_FIXUP_TAS2781_I2C), /* this must match before PCI SSID 17aa:386f below */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 451/1250 f2fs: validate inline dentry name lengths before conversion
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Moelius <[email protected]>
[ Upstream commit cfcd0e49a178b3dac2c0ece656079081dbf5da74 ]
Inline dentry conversion copies names out of the inline dentry area before checking that each recorded name length fits in the available filename slots.
A corrupted image can therefore make the conversion path read past the inline filename storage while building the regular dentry block.
Validate each inline dentry name length against the inline filename area before copying it.
--- fs/f2fs/inline.c | 7 +++++++ 1 file changed, 7 insertions(+)
fs/f2fs/inline.c +7 -0
@@ -506,6 +506,12 @@ static int f2fs_add_inline_entries(struct inode *dir, void *inline_dentry) bit_pos++;continue ; } +if (unlikely (le16_to_cpu (de->name_len) >F2FS_NAME_LEN || + bit_pos +GET_DENTRY_SLOTS (le16_to_cpu (de->name_len)) > + d.max)) { + err = -EFSCORRUPTED ; + goto punch_dentry_pages; + }/* * We only need the disk_name and hash to move the dentry.
@@ -526,6 +532,7 @@ static int f2fs_add_inline_entries(struct inode *dir, void *inline_dentry) bit_pos +=GET_DENTRY_SLOTS (le16_to_cpu (de->name_len)); }return 0 ; + punch_dentry_pages:truncate_inode_pages (&dir->i_data,0 );f2fs_truncate_blocks (dir,0 , false);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 452/1250 rtc: mv: add suspend/resume support for wakeup
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xue Lei <[email protected]>
[ Upstream commit 851d961ff248218f681c53cf0f7f08cf8201a117 ]
Add PM suspend/resume callbacks to enable/disable IRQ wake for the RTC alarm interrupt. This allows the RTC alarm to wake the system from STR (e.g. via rtcwake -m mem -s N).
Without this, the RTC IRQ is masked during suspend by the MPIC's IRQCHIP_MASK_ON_SUSPEND behavior, preventing alarm-based wakeup.
--- drivers/rtc/rtc-mv.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+)
drivers/rtc/rtc-mv.c +23 -0
@@ -301,6 +301,28 @@ static const struct of_device_id rtc_mv_of_match_table[] = {MODULE_DEVICE_TABLE (of, rtc_mv_of_match_table);#endif +#ifdef CONFIG_PM_SLEEP +static int mv_rtc_suspend (struct device *dev) +{ +struct rtc_plat_data *pdata =dev_get_drvdata (dev); + +if (device_may_wakeup (dev) && pdata->irq >=0 ) +enable_irq_wake (pdata->irq); +return 0 ; +} + +static int mv_rtc_resume (struct device *dev) +{ +struct rtc_plat_data *pdata =dev_get_drvdata (dev); + +if (device_may_wakeup (dev) && pdata->irq >=0 ) +disable_irq_wake (pdata->irq); +return 0 ; +} +#endif + +static SIMPLE_DEV_PM_OPS(mv_rtc_pm_ops, mv_rtc_suspend, mv_rtc_resume); +/* * mv_rtc_remove() lives in .exit.text. For drivers registered via * module_platform_driver_probe() this is ok because they cannot get unbound at
@@ -312,6 +334,7 @@ static struct platform_driver mv_rtc_driver __refdata = { .driver = { .name = "rtc-mv", .of_match_table = of_match_ptr(rtc_mv_of_match_table), + .pm = &mv_rtc_pm_ops, }, };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 453/1250 rtc: aspeed: add AST2700 compatible
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tommy Huang <[email protected]>
[ Upstream commit 3319cfeeb8c4047026f84df045c438f7bbd338a6 ]
Add support for matching the RTC controller on ASPEED AST2700 SoCs.
The AST2700 RTC controller is compatible with the existing ASPEED RTC driver implementation.
--- drivers/rtc/rtc-aspeed.c | 1 + 1 file changed, 1 insertion(+)
drivers/rtc/rtc-aspeed.c +1 -0
@@ -111,6 +111,7 @@ static const struct of_device_id aspeed_rtc_match[] = { { .compatible = "aspeed,ast2400-rtc", }, { .compatible = "aspeed,ast2500-rtc", }, { .compatible = "aspeed,ast2600-rtc", }, + { .compatible = "aspeed,ast2700-rtc", }, {} }; MODULE_DEVICE_TABLE(of, aspeed_rtc_match);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 454/1250 ksmbd: fix lease break and ack state handling
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
[ Upstream commit 5015191096db311759fef98769270336cd8b1324 ]
Do not skip valid lease states containing WRITE_CACHING when breaking level-II/read leases for writes and truncates.
Handle lease break acknowledgments according to the SMB2 rule that the acknowledged state must be a subset of the server's break target. Apply the acknowledged state directly and keep the break pending on failed ACKs.
--- fs/smb/server/oplock.c | 24 +++------ fs/smb/server/smb2pdu.c | 106 ++++++++++------------------------------ 2 files changed, 34 insertions(+), 96 deletions(-)
fs/smb/server/oplock.c +8 -16
@@ -1441,14 +1441,8 @@ void smb_break_all_levII_oplock(struct ksmbd_work *work, struct ksmbd_file *fp,continue ; } -if (brk_op->is_lease && (brk_op->o_lease->state & - (~(SMB2_LEASE_READ_CACHING_LE | -SMB2_LEASE_HANDLE_CACHING_LE )))) { -ksmbd_debug (OPLOCK ,"unexpected lease state(0x%x)\n" , - brk_op->o_lease->state); - goto next; - }else if (brk_op->level != -SMB2_OPLOCK_LEVEL_II ) { +if (!brk_op->is_lease && + brk_op->level !=SMB2_OPLOCK_LEVEL_II ) {ksmbd_debug (OPLOCK ,"unexpected oplock(0x%x)\n" , brk_op->level); goto next;
@@ -1500,15 +1494,13 @@ void smb_break_all_oplock(struct ksmbd_work *work, struct ksmbd_file *fp)*/ __u8 smb2_map_lease_to_oplock (__le32 lease_state) { -if (lease_state == (SMB2_LEASE_HANDLE_CACHING_LE | -SMB2_LEASE_READ_CACHING_LE | -SMB2_LEASE_WRITE_CACHING_LE )) { +if ((lease_state &SMB2_LEASE_WRITE_CACHING_LE ) && + (lease_state &SMB2_LEASE_HANDLE_CACHING_LE )) {return SMB2_OPLOCK_LEVEL_BATCH ; - }else if (lease_state !=SMB2_LEASE_WRITE_CACHING_LE && - lease_state &SMB2_LEASE_WRITE_CACHING_LE ) { -if (!(lease_state &SMB2_LEASE_HANDLE_CACHING_LE )) -return SMB2_OPLOCK_LEVEL_EXCLUSIVE ; - }else if (lease_state &SMB2_LEASE_READ_CACHING_LE ) { + }else if (lease_state &SMB2_LEASE_WRITE_CACHING_LE ) { +return SMB2_OPLOCK_LEVEL_EXCLUSIVE ; + }else if (lease_state & (SMB2_LEASE_READ_CACHING_LE | +SMB2_LEASE_HANDLE_CACHING_LE )) {return SMB2_OPLOCK_LEVEL_II ; }return 0 ;
fs/smb/server/smb2pdu.c +26 -80
147 lines not on this page · raw message
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 455/1250 ksmbd: validate SMB2 lease create contexts
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
[ Upstream commit b69be2c58615950ee7353b61a21acdf8508c0cbb ]
Validate SMB2 lease context lengths, requested lease state bits, and v2 flags before using the context. Return errors via ERR_PTR so CREATE can distinguish a missing lease context from a malformed one.
Also ignore lease v2 contexts for SMB 2.1, where they are not valid.
--- fs/smb/server/oplock.c | 33 ++++++++++++++++++++++++++++----- fs/smb/server/smb2pdu.c | 24 +++++++++++++++++++++++- 2 files changed, 51 insertions(+), 6 deletions(-)
fs/smb/server/oplock.c +28 -5
@@ -5,6 +5,7 @@*/ #include <linux/moduleparam.h> +#include <linux/err.h> #include "glob.h" #include "oplock.h"
@@ -19,6 +20,20 @@static LIST_HEAD (lease_table_list);static DEFINE_RWLOCK (lease_list_lock); +#define SMB2_LEASE_STATE_MASK_LE (SMB2_LEASE_READ_CACHING_LE | \ + SMB2_LEASE_HANDLE_CACHING_LE | \ + SMB2_LEASE_WRITE_CACHING_LE) + +static bool lease_state_valid (__le32 state) +{ +return !(state & ~SMB2_LEASE_STATE_MASK_LE ); +} + +static bool lease_v2_flags_valid (__le32 flags) +{ +return !(flags & ~SMB2_LEASE_FLAG_PARENT_LEASE_KEY_SET_LE ); +} +/** * alloc_opinfo() - allocate a new opinfo object for oplock info * @work: smb work
@@ -1568,12 +1583,14 @@ struct lease_ctx_info *parse_lease_state(void *open_req)struct lease_ctx_info *lreq; cc =smb2_find_context_vals (req,SMB2_CREATE_REQUEST_LEASE ,4 ); -if (IS_ERR_OR_NULL (cc)) +if (IS_ERR (cc)) +return ERR_CAST (cc); +if (!cc)return NULL ; lreq =kzalloc (sizeof (struct lease_ctx_info ),KSMBD_DEFAULT_GFP );if (!lreq) -return NULL ; +return ERR_PTR (-ENOMEM );if (sizeof (struct lease_context_v2 ) ==le32_to_cpu (cc->DataLength)) {struct create_lease_v2 *lc = (struct create_lease_v2 *)cc;
@@ -1587,11 +1604,14 @@ struct lease_ctx_info *parse_lease_state(void *open_req) lreq->flags = lc->lcontext.LeaseFlags; lreq->epoch = lc->lcontext.Epoch; lreq->duration = lc->lcontext.LeaseDuration; +if (!lease_state_valid (lreq->req_state) || + !lease_v2_flags_valid (lreq->flags)) + goto err_out;if (lreq->flags ==SMB2_LEASE_FLAG_PARENT_LEASE_KEY_SET_LE )memcpy (lreq->parent_lease_key, lc->lcontext.ParentLeaseKey,SMB2_LEASE_KEY_SIZE ); lreq->version =2 ; - }else { + }else if (sizeof (struct lease_context ) ==le32_to_cpu (cc->DataLength)) {struct create_lease *lc = (struct create_lease *)cc; if (le16_to_cpu(cc->DataOffset) + le32_to_cpu(cc->DataLength) <
@@ -1602,12 +1622,15 @@ struct lease_ctx_info *parse_lease_state(void *open_req) lreq->req_state = lc->lcontext.LeaseState; lreq->flags = lc->lcontext.LeaseFlags; lreq->duration = lc->lcontext.LeaseDuration; +if (!lease_state_valid (lreq->req_state)) + goto err_out; lreq->version =1 ; - } + }else + goto err_out;return lreq; err_out:kfree (lreq); -return NULL ; +return ERR_PTR (-EINVAL ); }/**
fs/smb/server/smb2pdu.c +23 -1
@@ -3004,6 +3004,17 @@ int smb2_open(struct ksmbd_work *work)if (server_conf.flags &KSMBD_GLOBAL_FLAG_DURABLE_HANDLE && req->CreateContextsOffset) { lc =parse_lease_state (req); +if (IS_ERR (lc)) { + rc =PTR_ERR (lc); + lc =NULL ; + goto err_out2; + } +if (lc && lc->version ==2 && conn->dialect <SMB30_PROT_ID ) { +kfree (lc); + lc =NULL ; +if (req_op_level ==SMB2_OPLOCK_LEVEL_LEASE ) + req_op_level =SMB2_OPLOCK_LEVEL_NONE ; + } rc =parse_durable_handle_context (work, req, lc, &dh_info);if (rc) {ksmbd_debug (SMB ,"error parsing durable handle context\n" );
@@ -3035,8 +3046,19 @@ int smb2_open(struct ksmbd_work *work) goto reconnected_fp; } - }else if (req_op_level ==SMB2_OPLOCK_LEVEL_LEASE ) + }else if (req_op_level ==SMB2_OPLOCK_LEVEL_LEASE ) { lc =parse_lease_state (req); +if (IS_ERR (lc)) { + rc =PTR_ERR (lc); + lc =NULL ; + goto err_out2; + } +if (lc && lc->version ==2 && conn->dialect <SMB30_PROT_ID ) { +kfree (lc); + lc =NULL ; + req_op_level =SMB2_OPLOCK_LEVEL_NONE ; + } + }if (le32_to_cpu (req->ImpersonationLevel) >le32_to_cpu (IL_DELEGATE )) { pr_err("Invalid impersonationlevel : 0x%x\n",
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 456/1250 ksmbd: align SMB2 oplock break ack handling
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
[ Upstream commit 80a56d4a826c6c84430286fcf7d8655f7c5b0868 ]
Handle SMB2 oplock break acknowledgments according to the server-side validation rules in MS-SMB2.
Return STATUS_INVALID_DEVICE_STATE when an ACK arrives while the open is not breaking, reject SMB2_OPLOCK_LEVEL_LEASE with STATUS_INVALID_PARAMETER, allow BATCH acknowledgments to EXCLUSIVE, and make invalid ACK levels fail with STATUS_INVALID_OPLOCK_PROTOCOL after lowering the oplock to NONE.
Update the successful response from the final granted oplock level instead of relying on the oplock transition helpers, which could turn invalid ACKs into successful responses.
--- fs/smb/server/smb2pdu.c | 104 ++++++++++++++++++---------------------- 1 file changed, 46 insertions(+), 58 deletions(-)
fs/smb/server/smb2pdu.c +46 -58
@@ -8718,11 +8718,10 @@ static void smb20_oplock_break_ack(struct ksmbd_work *work)struct smb2_oplock_break *rsp;struct ksmbd_file *fp;struct oplock_info *opinfo =NULL ; -__le32 err =0 ; -int ret =0 ; +__le32 status =STATUS_SUCCESS ; +int ret;u64 volatile_id, persistent_id;char req_oplevel =0 , rsp_oplevel =0 ; -unsigned int oplock_change_type;WORK_BUFFERS (work, req, rsp);
@@ -8748,71 +8747,55 @@ static void smb20_oplock_break_ack(struct ksmbd_work *work)return ; } -if (opinfo->level ==SMB2_OPLOCK_LEVEL_NONE ) { - rsp->hdr.Status =STATUS_INVALID_OPLOCK_PROTOCOL ; +if (opinfo->op_state !=OPLOCK_ACK_WAIT ) { +ksmbd_debug (SMB ,"unexpected oplock state 0x%x\n" , + opinfo->op_state); + status =STATUS_INVALID_DEVICE_STATE ; goto err_out; } -if (opinfo->op_state ==OPLOCK_STATE_NONE ) { -ksmbd_debug (SMB ,"unexpected oplock state 0x%x\n" , opinfo->op_state); - rsp->hdr.Status =STATUS_UNSUCCESSFUL ; +if (req_oplevel ==SMB2_OPLOCK_LEVEL_LEASE ) { + opinfo->level =SMB2_OPLOCK_LEVEL_NONE ; + status =STATUS_INVALID_PARAMETER ; goto err_out; } -if ((opinfo->level ==SMB2_OPLOCK_LEVEL_EXCLUSIVE || - opinfo->level ==SMB2_OPLOCK_LEVEL_BATCH ) && - (req_oplevel !=SMB2_OPLOCK_LEVEL_II && - req_oplevel !=SMB2_OPLOCK_LEVEL_NONE )) { - err =STATUS_INVALID_OPLOCK_PROTOCOL ; - oplock_change_type =OPLOCK_WRITE_TO_NONE ; - }else if (opinfo->level ==SMB2_OPLOCK_LEVEL_II && - req_oplevel !=SMB2_OPLOCK_LEVEL_NONE ) { - err =STATUS_INVALID_OPLOCK_PROTOCOL ; - oplock_change_type =OPLOCK_READ_TO_NONE ; - }else if (req_oplevel ==SMB2_OPLOCK_LEVEL_II || - req_oplevel ==SMB2_OPLOCK_LEVEL_NONE ) { - err =STATUS_INVALID_DEVICE_STATE ; -if ((opinfo->level ==SMB2_OPLOCK_LEVEL_EXCLUSIVE || - opinfo->level ==SMB2_OPLOCK_LEVEL_BATCH ) && - req_oplevel ==SMB2_OPLOCK_LEVEL_II ) { - oplock_change_type =OPLOCK_WRITE_TO_READ ; - }else if ((opinfo->level ==SMB2_OPLOCK_LEVEL_EXCLUSIVE || - opinfo->level ==SMB2_OPLOCK_LEVEL_BATCH ) && - req_oplevel ==SMB2_OPLOCK_LEVEL_NONE ) { - oplock_change_type =OPLOCK_WRITE_TO_NONE ; - }else if (opinfo->level ==SMB2_OPLOCK_LEVEL_II && - req_oplevel ==SMB2_OPLOCK_LEVEL_NONE ) { - oplock_change_type =OPLOCK_READ_TO_NONE ; - }else { - oplock_change_type =0 ; - } - }else { - oplock_change_type =0 ; +if (opinfo->level ==SMB2_OPLOCK_LEVEL_NONE ) { + status =STATUS_INVALID_OPLOCK_PROTOCOL ; + goto err_out; } -switch (oplock_change_type) { -case OPLOCK_WRITE_TO_READ : - ret =opinfo_write_to_read (opinfo); - rsp_oplevel =SMB2_OPLOCK_LEVEL_II ; -break ; -case OPLOCK_WRITE_TO_NONE : - ret =opinfo_write_to_none (opinfo); - rsp_oplevel =SMB2_OPLOCK_LEVEL_NONE ; -break ; -case OPLOCK_READ_TO_NONE : - ret =opinfo_read_to_none (opinfo); - rsp_oplevel =SMB2_OPLOCK_LEVEL_NONE ; -break ; -default : -pr_err ("unknown oplock change 0x%x -> 0x%x\n" , - opinfo->level, rsp_oplevel); +if (opinfo->level ==SMB2_OPLOCK_LEVEL_EXCLUSIVE && + req_oplevel !=SMB2_OPLOCK_LEVEL_II && + req_oplevel !=SMB2_OPLOCK_LEVEL_NONE ) { + opinfo->level =SMB2_OPLOCK_LEVEL_NONE ; + status =STATUS_INVALID_OPLOCK_PROTOCOL ; + goto err_out; } -if (ret <0 ) { - rsp->hdr.Status = err; +if (opinfo->level ==SMB2_OPLOCK_LEVEL_BATCH && + req_oplevel !=SMB2_OPLOCK_LEVEL_II && + req_oplevel !=SMB2_OPLOCK_LEVEL_NONE && + req_oplevel !=SMB2_OPLOCK_LEVEL_EXCLUSIVE ) { + opinfo->level =SMB2_OPLOCK_LEVEL_NONE ; + status =STATUS_INVALID_OPLOCK_PROTOCOL ; + goto err_out; + } + +if (opinfo->level ==SMB2_OPLOCK_LEVEL_II && + req_oplevel !=SMB2_OPLOCK_LEVEL_NONE ) { + opinfo->level =SMB2_OPLOCK_LEVEL_NONE ; + status =STATUS_INVALID_OPLOCK_PROTOCOL ; goto err_out; } +if (req_oplevel ==SMB2_OPLOCK_LEVEL_EXCLUSIVE ) + rsp_oplevel =SMB2_OPLOCK_LEVEL_NONE ; +else + rsp_oplevel = req_oplevel; + + opinfo->level = rsp_oplevel; + rsp->StructureSize =cpu_to_le16 (24 ); rsp->OplockLevel = rsp_oplevel; rsp->Reserved =0 ;
@@ -8820,11 +8803,16 @@ static void smb20_oplock_break_ack(struct ksmbd_work *work) rsp->VolatileFid = volatile_id; rsp->PersistentFid = persistent_id; ret =ksmbd_iov_pin_rsp (work, rsp,sizeof (struct smb2_oplock_break )); -if (ret) { +if (ret) +ksmbd_debug (SMB ,"failed to pin oplock break response: %d\n" , + ret); + goto out; + err_out: -smb2_set_err_rsp (work); - } + rsp->hdr.Status = status; +smb2_set_err_rsp (work); +out: opinfo->op_state =OPLOCK_STATE_NONE ;wake_up_interruptible_all (&opinfo->oplock_q);opinfo_put (opinfo);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 457/1250 ksmbd: use connection ClientGUID for lease lookup
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
[ Upstream commit fa111daae1a02dbff5693dfc12f368bccd9eb5f4 ]
MS-SMB2 defines the lease table lookup key as Connection.ClientGuid. Use the connection ClientGUID consistently when checking for same-client leases and duplicate lease keys.
Also preserve directory and parent lease metadata when copying an existing lease state to a new open.
--- fs/smb/server/oplock.c | 16 +++++++++------- fs/smb/server/oplock.h | 2 +- fs/smb/server/smb2pdu.c | 2 +- 3 files changed, 11 insertions(+), 9 deletions(-)
fs/smb/server/oplock.c +9 -7
@@ -520,7 +520,7 @@ static inline int compare_guid_key(struct oplock_info *opinfo,* Return: oplock(lease) object on success, otherwise NULL */ static struct oplock_info *same_client_has_lease (struct ksmbd_inode *ci, -char *client_guid, +const char *client_guid,struct lease_ctx_info *lctx) {int ret;
@@ -1051,7 +1051,7 @@ void destroy_lease_table(struct ksmbd_conn *conn)write_unlock (&lease_list_lock); } -int find_same_lease_key (struct ksmbd_session *sess,struct ksmbd_inode *ci, +int find_same_lease_key (struct ksmbd_conn *conn,struct ksmbd_inode *ci,struct lease_ctx_info *lctx) {struct oplock_info *opinfo;
@@ -1068,7 +1068,7 @@ int find_same_lease_key(struct ksmbd_session *sess, struct ksmbd_inode *ci, }list_for_each_entry (lb, &lease_table_list, l_entry) { -if (!memcmp (lb->client_guid, sess->ClientGUID, +if (!memcmp (lb->client_guid, conn->ClientGUID,SMB2_CLIENT_GUID_SIZE )) goto found; }
@@ -1084,7 +1084,7 @@ int find_same_lease_key(struct ksmbd_session *sess, struct ksmbd_inode *ci,rcu_read_unlock ();if (opinfo->o_fp->f_ci == ci) goto op_next; - err =compare_guid_key (opinfo, sess->ClientGUID, + err =compare_guid_key (opinfo, conn->ClientGUID, lctx->lease_key);if (err) { err = -EINVAL ;
@@ -1117,6 +1117,9 @@ static void copy_lease(struct oplock_info *op1, struct oplock_info *op2) lease2->flags = lease1->flags; lease2->epoch = lease1->epoch; lease2->version = lease1->version; + lease2->is_dir = lease1->is_dir; +memcpy (lease2->parent_lease_key, lease1->parent_lease_key, +SMB2_LEASE_KEY_SIZE ); } static void add_lease_global_list(struct oplock_info *opinfo,
@@ -1255,7 +1258,6 @@ int smb_grant_oplock(struct ksmbd_work *work, int req_op_level, u64 pid, struct ksmbd_file *fp, __u16 tid, struct lease_ctx_info *lctx, int share_ret) { - struct ksmbd_session *sess = work->sess; int err = 0;struct oplock_info *opinfo =NULL , *prev_opinfo =NULL ;struct ksmbd_inode *ci = fp->f_ci;
@@ -1298,12 +1300,12 @@ int smb_grant_oplock(struct ksmbd_work *work, int req_op_level, u64 pid,struct oplock_info *m_opinfo;/* is lease already granted ? */ - m_opinfo =same_client_has_lease (ci, sess->ClientGUID, + m_opinfo =same_client_has_lease (ci, work->conn->ClientGUID, lctx);if (m_opinfo) {copy_lease (m_opinfo, opinfo);if (atomic_read (&m_opinfo->breaking_cnt)) - opinfo->o_lease->flags = + opinfo->o_lease->flags |=SMB2_LEASE_FLAG_BREAK_IN_PROGRESS_LE ;opinfo_put (m_opinfo); goto out;
fs/smb/server/oplock.h +1 -1
@@ -116,7 +116,7 @@ void create_posix_rsp_buf(char *cc, struct ksmbd_file *fp);struct create_context *smb2_find_context_vals (void *open_req,const char *tag,int tag_len);struct oplock_info *lookup_lease_in_table (struct ksmbd_conn *conn,char *lease_key); -int find_same_lease_key (struct ksmbd_session *sess,struct ksmbd_inode *ci, +int find_same_lease_key (struct ksmbd_conn *conn,struct ksmbd_inode *ci,struct lease_ctx_info *lctx);void destroy_lease_table (struct ksmbd_conn *conn); void smb_send_parent_lease_break_noti(struct ksmbd_file *fp,
fs/smb/server/smb2pdu.c +1 -1
@@ -3533,7 +3533,7 @@ int smb2_open(struct ksmbd_work *work)ksmbd_debug (SMB ,"lease req for(%s) req oplock state 0x%x, lease state 0x%x\n" , name, req_op_level, lc->req_state); - rc =find_same_lease_key (sess, fp->f_ci, lc); + rc =find_same_lease_key (conn, fp->f_ci, lc);if (rc) goto err_out1; } else if (open_flags == O_RDONLY &&
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 458/1250 ksmbd: treat unnamed DATA stream as base file
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
[ Upstream commit 171b5d72dd80f99271c073c6e38d5263687c3b6d ]
The SMB path suffix :: names the unnamed data stream of the base file, not an alternate data stream backed by a DosStream xattr.
Canonicalize an empty stream name with an explicit type to a NULL stream name after parsing. This keeps the base filename produced by strsep() and lets open continue through the normal base-file path instead of looking for a non-existent empty stream xattr.
--- fs/smb/server/misc.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
fs/smb/server/misc.c +11 -3
@@ -121,7 +121,9 @@ int parse_stream_name(char *filename, char **stream_name, int *s_type)char *stream_type;char *s_name;int rc =0 ; +bool has_stream_type = false; + *stream_name =NULL ; s_name = filename; filename =strsep (&s_name,":" );ksmbd_debug (SMB ,"filename : %s, streams : %s\n" , filename, s_name);
@@ -137,14 +139,20 @@ int parse_stream_name(char *filename, char **stream_name, int *s_type)ksmbd_debug (SMB ,"stream name : %s, stream type : %s\n" , s_name, stream_type); -if (!strncasecmp ("$data" , stream_type,5 )) +if (!strncasecmp ("$data" , stream_type,5 )) { *s_type =DATA_STREAM ; -else if (!strncasecmp ("$index_allocation" , stream_type,17 )) + has_stream_type = true; + }else if (!strncasecmp ("$index_allocation" , stream_type,17 )) { *s_type =DIR_STREAM ; -else + has_stream_type = true; + }else { rc = -ENOENT ; + } } +if (has_stream_type && !s_name[0 ] && *s_type ==DATA_STREAM ) + goto out; + *stream_name = s_name; out:return rc;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 459/1250 ksmbd: apply create security descriptor first
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
[ Upstream commit ba3cf6ee4f0eacc1f8c607b80188e3b32ef5e0e3 ]
smb2.create.aclfile creates files with an SMB2_CREATE_SD_BUFFER create context and expects the resulting security descriptor to match the descriptor supplied by the client.
ksmbd currently tries to inherit the parent DACL first and only parses the SMB2_CREATE_SD_BUFFER context when DACL inheritance fails. If inheritance succeeds, the explicit security descriptor supplied on create is ignored. This breaks create requests that include owner/group information in the security descriptor.
Apply the create security descriptor first when the context is present. Fall back to the existing inherited/default ACL path only when no create security descriptor was supplied.
--- fs/smb/server/smb2pdu.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
fs/smb/server/smb2pdu.c +9 -7
@@ -3400,14 +3400,16 @@ int smb2_open(struct ksmbd_work *work)if (posix_acl_rc)ksmbd_debug (SMB ,"inherit posix acl failed : %d\n" , posix_acl_rc); -if (test_share_config_flag (work->tcon->share_conf, -KSMBD_SHARE_FLAG_ACL_XATTR )) { - rc =smb_inherit_dacl (conn, &path, sess->user->uid, - sess->user->gid); - } + rc =smb2_create_sd_buffer (work, req, &path); +if (rc && rc != -ENOENT ) + goto err_out; -if (rc) { - rc =smb2_create_sd_buffer (work, req, &path); +if (rc == -ENOENT ) { +if (test_share_config_flag (work->tcon->share_conf, +KSMBD_SHARE_FLAG_ACL_XATTR )) { + rc =smb_inherit_dacl (conn, &path, sess->user->uid, + sess->user->gid); + }if (rc) {if (posix_acl_rc) ksmbd_vfs_set_init_posix_acl(idmap,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 460/1250 ksmbd: deny renaming directory with open children
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
[ Upstream commit c841bd3d8dec33a000d6e31b7e7fafb22c39e4e9 ]
Windows denies renaming a directory while a file below that directory is still open. smb2.rename.rename_dir_openfile checks this by keeping a file handle open under the directory and then attempting to rename the directory handle. ksmbd did not check open children before calling vfs_rename(), so the rename incorrectly succeeded.
For non-POSIX clients, scan the global open file table for active handles whose dentries are below the directory being renamed. If any child is open, fail the rename with -EACCES so the client receives STATUS_ACCESS_DENIED.
--- fs/smb/server/vfs.c | 6 ++++++ fs/smb/server/vfs_cache.c | 25 +++++++++++++++++++++++++ fs/smb/server/vfs_cache.h | 1 + 3 files changed, 32 insertions(+)
fs/smb/server/vfs.c +6 -0
@@ -745,6 +745,12 @@ int ksmbd_vfs_rename(struct ksmbd_work *work, const struct path *old_path, goto out3; } +if (!work->tcon->posix_extensions &&d_is_dir (old_child) && +ksmbd_has_open_files (old_child)) { + err = -EACCES ; + goto out3; + } + parent_fp =ksmbd_lookup_fd_inode (old_child->d_parent);if (parent_fp) {if (parent_fp->daccess &FILE_DELETE_LE ) {
fs/smb/server/vfs_cache.c +25 -0
@@ -10,6 +10,7 @@#include <linux/vmalloc.h> #include <linux/kthread.h> #include <linux/freezer.h> +#include <linux/dcache.h> #include "glob.h" #include "vfs_cache.h"
@@ -649,6 +650,30 @@ struct ksmbd_file *ksmbd_lookup_fd_inode(struct dentry *dentry)return NULL ; } +bool ksmbd_has_open_files (struct dentry *dentry) +{ +struct ksmbd_file *fp; +unsigned int id; +bool ret = false; + +read_lock (&global_ft.lock); +idr_for_each_entry (global_ft.idr, fp, id) { +struct dentry *fp_dentry = fp->filp->f_path.dentry; + +if (fp->f_state !=FP_INITED ) +continue ; +if (fp_dentry == dentry) +continue ; +if (is_subdir (fp_dentry, dentry)) { + ret = true; +break ; + } + } +read_unlock (&global_ft.lock); + +return ret; +} +#define OPEN_ID_TYPE_VOLATILE_ID (0)#define OPEN_ID_TYPE_PERSISTENT_ID (1)
fs/smb/server/vfs_cache.h +1 -0
@@ -165,6 +165,7 @@ struct ksmbd_file *ksmbd_lookup_durable_fd(unsigned long long id);void ksmbd_put_durable_fd (struct ksmbd_file *fp);struct ksmbd_file *ksmbd_lookup_fd_cguid (char *cguid);struct ksmbd_file *ksmbd_lookup_fd_inode (struct dentry *dentry); +bool ksmbd_has_open_files (struct dentry *dentry);unsigned int ksmbd_open_durable_fd (struct ksmbd_file *fp);struct ksmbd_file *ksmbd_open_fd (struct ksmbd_work *work,struct file *filp);void ksmbd_launch_ksmbd_durable_scavenger (void );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 461/1250 ksmbd: start file id allocation at 1
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
[ Upstream commit 6b375be0b4e1be89e9a817880515311503a19114 ]
ksmbd allocates both the volatile id (per-session file table) and the persistent id (global file table) with idr_alloc_cyclic() starting at 0. The first open after the module loads therefore gets volatile id 0 and persistent id 0, and ksmbd returns an SMB2 FileId of {0, 0} in the create response.
Clients treat an all-zero FileId as a null handle. smbtorture's smb2_util_handle_empty() considers {0, 0} empty, so tests that guard the close with it (e.g. smb2.oplock.statopen1, smb2.lease.statopen*) never close that first handle. The leaked open keeps the inode's oplock count non-zero, so a later batch oplock request on the same file is downgraded to level II and the test fails.
Start the id allocation at 1 (KSMBD_START_FID) so no handle is ever assigned a {0, 0} FileId, matching the behaviour of other SMB servers.
--- fs/smb/server/vfs_cache.c | 3 ++- fs/smb/server/vfs_cache.h | 7 ++++++- 2 files changed, 8 insertions(+), 2 deletions(-)
fs/smb/server/vfs_cache.c +2 -1
@@ -698,7 +698,8 @@ static int __open_id(struct ksmbd_file_table *ft, struct ksmbd_file *fp,idr_preload (KSMBD_DEFAULT_GFP );write_lock (&ft->lock); - ret =idr_alloc_cyclic (ft->idr, fp,0 ,INT_MAX -1 ,GFP_NOWAIT ); + ret =idr_alloc_cyclic (ft->idr, fp,KSMBD_START_FID ,INT_MAX -1 , +GFP_NOWAIT );if (ret >=0 ) { id = ret; ret =0 ;
fs/smb/server/vfs_cache.h +6 -1
@@ -23,7 +23,12 @@#define FILE_GENERIC_WRITE 0x120116#define FILE_GENERIC_EXECUTE 0X1200a0 -#define KSMBD_START_FID 0 +/* +* Start volatile/persistent file id allocation at 1. A file id of 0 yields an +* SMB2 FileId of {0, 0}, which clients (e.g. Windows, Samba) treat as a null +* handle and never close, leaking the open on the server. +*/ +#define KSMBD_START_FID 1#define KSMBD_NO_FID (INT_MAX)#define SMB2_NO_FID (0xFFFFFFFFFFFFFFFFULL)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 462/1250 ksmbd: break RH leases before delete-on-close
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
[ Upstream commit 1f1083c36fa11c5d9011451c7b9ab380545c72ea ]
The delete paths only marked the opened file delete pending or delete-on-close. When another client still held a read/handle lease, no lease break was sent before the delete state changed.
smb2.lease.unlink uses a create request with FILE_DELETE_ON_CLOSE and expects the second client's unlink to break the first client's RH lease to R with ACK_REQUIRED set. SetInfo(FileDispositionInformation) has the same lease-breaking requirement.
Break level-II/read-handle leases before setting delete pending or delete-on-close so clients are notified before the file is removed.
--- fs/smb/server/smb2pdu.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
fs/smb/server/smb2pdu.c +7 -3
@@ -3551,8 +3551,10 @@ int smb2_open(struct ksmbd_work *work) goto err_out1; } -if (req->CreateOptions &FILE_DELETE_ON_CLOSE_LE ) +if (req->CreateOptions &FILE_DELETE_ON_CLOSE_LE ) { +smb_break_all_levII_oplock (work, fp,0 );ksmbd_fd_set_delete_on_close (fp, file_info); + }if (need_truncate) { rc =smb2_create_truncate (&fp->filp->f_path);
@@ -6469,7 +6471,8 @@ static int set_rename_info(struct ksmbd_work *work, struct ksmbd_file *fp,return smb2_rename (work, fp, rename_info, work->conn->local_nls); } -static int set_file_disposition_info (struct ksmbd_file *fp, +static int set_file_disposition_info (struct ksmbd_work *work, +struct ksmbd_file *fp,struct smb2_file_disposition_info *file_info) {struct inode *inode;
@@ -6484,6 +6487,7 @@ static int set_file_disposition_info(struct ksmbd_file *fp,if (S_ISDIR (inode->i_mode) &&ksmbd_vfs_empty_dir (fp) == -ENOTEMPTY )return -EBUSY ; +smb_break_all_levII_oplock (work, fp,0 );ksmbd_set_inode_pending_delete (fp); }else {ksmbd_clear_inode_pending_delete (fp);
@@ -6613,7 +6617,7 @@ static int smb2_set_info_file(struct ksmbd_work *work, struct ksmbd_file *fp,if (buf_len <sizeof (struct smb2_file_disposition_info ))return -EINVAL ; -return set_file_disposition_info (fp, +return set_file_disposition_info (work, fp, (struct smb2_file_disposition_info *)buffer); }case FILE_FULL_EA_INFORMATION :
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 463/1250 ksmbd: treat read-control opens as stat opens only for leases
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
[ Upstream commit be939e11c4724d1de3650e8bafd4c3583d9684b2 ]
A second open that requests only metadata-level access must not break the existing caching state. ksmbd already skips the break for such opens via fp->attrib_only (FILE_READ_ATTRIBUTES, FILE_WRITE_ATTRIBUTES and FILE_SYNCHRONIZE).
An open requesting only READ_CONTROL (reading the security descriptor) must be treated differently depending on the existing caching state. smbtorture smb2.lease.statopen4 expects a read-control open NOT to break a caching lease, while smb2.oplock.statopen1 expects the same open to break a batch oplock. So READ_CONTROL is a stat open for leases but not for oplocks.
Extend the stat-open break-skip in smb_grant_oplock() to also cover a read-control-only open, but only when the existing holder is a lease. The global fp->attrib_only flag (used for share-mode, rename and truncate decisions) is left unchanged so oplock behaviour is preserved.
--- fs/smb/server/oplock.c | 30 +++++++++++++++++++++++++++--- 1 file changed, 27 insertions(+), 3 deletions(-)
fs/smb/server/oplock.c +27 -3
@@ -208,6 +208,18 @@ void opinfo_put(struct oplock_info *opinfo)free_opinfo (opinfo); } +static bool ksmbd_inode_has_lease (struct ksmbd_inode *ci) +{ +struct oplock_info *opinfo =opinfo_get_list (ci); +bool is_lease; + +if (!opinfo) +return false; + is_lease = opinfo->is_lease; +opinfo_put (opinfo); +return is_lease; +} +static void opinfo_add (struct oplock_info *opinfo,struct ksmbd_file *fp) {struct ksmbd_inode *ci = fp->f_ci;
@@ -1288,10 +1300,22 @@ int smb_grant_oplock(struct ksmbd_work *work, int req_op_level, u64 pid,if (!opinfo_count (fp)) goto set_lev; -/* grant none-oplock if second open is trunc */ -if (fp->attrib_only && fp->cdoption !=FILE_OVERWRITE_IF_LE && +/* +* A stat open that only requests metadata access must not break the +* existing caching state. READ_CONTROL (reading the security +* descriptor) does not conflict with a lease, but it does conflict +* with an oplock, so only treat a read-control-only open as a stat +* open when the existing holder is a lease. +*/ +if (fp->cdoption !=FILE_OVERWRITE_IF_LE && fp->cdoption !=FILE_OVERWRITE_LE && - fp->cdoption !=FILE_SUPERSEDE_LE ) { + fp->cdoption !=FILE_SUPERSEDE_LE && + (fp->attrib_only || + (!(fp->daccess & ~(FILE_READ_ATTRIBUTES_LE | +FILE_WRITE_ATTRIBUTES_LE | +FILE_SYNCHRONIZE_LE | +FILE_READ_CONTROL_LE )) && +ksmbd_inode_has_lease (ci)))) { req_op_level =SMB2_OPLOCK_LEVEL_NONE ; goto set_lev; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 464/1250 PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Wilczyński <[email protected]>
[ Upstream commit 8857f6578b001bcf5f53c8c6a3936647f05291a8 ]
pci_proc_attach_device() creates procfs entries for PCI devices and is called from pci_bus_add_device(). It lazily creates the per-bus procfs directory (bus->procdir) via proc_mkdir() on first use, and returns early if proc_initialized is not yet set.
On x86 with ACPI, PCI enumeration occurs at subsys_initcall, before pci_proc_init() sets proc_initialized at device_initcall. The for_each_pci_dev() loop in pci_proc_init() then creates procfs entries for these already-enumerated devices, but runs without holding pci_rescan_remove_lock.
On ARM64 with devicetree, PCI host bridges probe at device_initcall. With async probing enabled, pci_bus_add_device() can run concurrently with pci_proc_init(), and both may call pci_proc_attach_device() for the same device or for different devices on the same bus. As pci_host_probe() holds pci_rescan_remove_lock while pci_proc_init() does not, there is no serialisation between the two paths.
When two threads concurrently call pci_proc_attach_device() for devices on the same bus, both observe bus->procdir as NULL and both call proc_mkdir(). The proc filesystem serialises directory creation internally, so only one caller succeeds. The other results in a warning like:
proc_dir_entry '000c:00/00.0' already registered
The caller receives NULL (duplicate entry) and unconditionally stores it to bus->procdir, corrupting the valid pointer set by the first caller.
Serialise access to proc_initialized, proc_bus_pci_dir, bus->procdir and dev->procent with a new mutex local to drivers/pci/proc.c, and store the created entries to bus->procdir and dev->procent only on success, so a failed creation can never overwrite a valid pointer.
Additionally, wrap the for_each_pci_dev() loop in pci_proc_init() with pci_lock_rescan_remove() to serialise against concurrent PCI bus operations, add an early return in pci_proc_attach_device() when dev->procent is already set to make the function idempotent, and clear bus->procdir in pci_proc_detach_bus() to prevent use of a dangling pointer after proc_remove().
--- drivers/pci/proc.c | 79 ++++++++++++++++++++++++++++++++-------------- 1 file changed, 56 insertions(+), 23 deletions(-)
drivers/pci/proc.c +56 -23
@@ -20,6 +20,7 @@#include "pci.h" static int proc_initialized;/* = 0 */ +static DEFINE_MUTEX (pci_proc_lock);static loff_t proc_bus_pci_lseek (struct file *file,loff_t off,int whence) {
@@ -430,40 +431,64 @@ static const struct seq_operations proc_bus_pci_devices_op = {static struct proc_dir_entry *proc_bus_pci_dir; -int pci_proc_attach_device (struct pci_dev *dev) +static int __pci_proc_attach_bus (struct pci_bus *bus) { -struct pci_bus *bus = dev->bus; -struct proc_dir_entry *e; +struct proc_dir_entry *dir;char name[16 ]; +lockdep_assert_held (&pci_proc_lock); +if (!proc_initialized)return -EACCES ; -if (!bus->procdir) { -if (pci_proc_domain (bus)) { -sprintf (name,"%04x:%02x" ,pci_domain_nr (bus), - bus->number); - }else { -sprintf (name,"%02x" , bus->number); - } - bus->procdir =proc_mkdir (name, proc_bus_pci_dir); -if (!bus->procdir) -return -ENOMEM ; - } +if (bus->procdir) +return 0 ; + +if (pci_proc_domain (bus)) +sprintf (name,"%04x:%02x" ,pci_domain_nr (bus), bus->number); +else +sprintf (name,"%02x" , bus->number); + + dir =proc_mkdir (name, proc_bus_pci_dir); +if (!dir) +return -ENOMEM ; + + bus->procdir = dir; + +return 0 ; +} + +int pci_proc_attach_device (struct pci_dev *dev) +{ +struct pci_bus *bus = dev->bus; +struct proc_dir_entry *entry; +char name[16 ]; +int ret; + +guard (mutex)(&pci_proc_lock); + +if (dev->procent) +return 0 ; + + ret =__pci_proc_attach_bus (bus); +if (ret) +return ret;sprintf (name,"%02x.%x" ,PCI_SLOT (dev->devfn),PCI_FUNC (dev->devfn)); - e =proc_create_data (name,S_IFREG |S_IRUGO |S_IWUSR , bus->procdir, - &proc_bus_pci_ops, dev); -if (!e) + entry =proc_create_data (name,S_IFREG |S_IRUGO |S_IWUSR , + bus->procdir, &proc_bus_pci_ops, dev); +if (!entry)return -ENOMEM ; -proc_set_size (e, dev->cfg_size); - dev->procent = e; + +proc_set_size (entry, dev->cfg_size); + dev->procent = entry;return 0 ; }int pci_proc_detach_device (struct pci_dev *dev) { +guard (mutex)(&pci_proc_lock);proc_remove (dev->procent); dev->procent =NULL ;return 0 ;
@@ -471,19 +496,27 @@ int pci_proc_detach_device(struct pci_dev *dev)int pci_proc_detach_bus (struct pci_bus *bus) { +guard (mutex)(&pci_proc_lock);proc_remove (bus->procdir); + bus->procdir =NULL ;return 0 ; }static int __init pci_proc_init (void ) {struct pci_dev *dev =NULL ; - proc_bus_pci_dir =proc_mkdir ("bus/pci" ,NULL ); -proc_create_seq ("devices" ,0 , proc_bus_pci_dir, - &proc_bus_pci_devices_op); - proc_initialized =1 ; + + scoped_guard(mutex, &pci_proc_lock) { + proc_bus_pci_dir =proc_mkdir ("bus/pci" ,NULL ); +proc_create_seq ("devices" ,0 , proc_bus_pci_dir, + &proc_bus_pci_devices_op); + proc_initialized =1 ; + } + +pci_lock_rescan_remove ();for_each_pci_dev (dev)pci_proc_attach_device (dev); +pci_unlock_rescan_remove ();return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 465/1250 PCI/sysfs: Use kstrtobool() to parse the ROM attribute input
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Wilczyński <[email protected]>
[ Upstream commit 92742802ecbf215a2b60dcfd326d2213595010f1 ]
pci_write_rom() controls access to the ROM content through the corresponding sysfs attribute, and treats the input as a request to disable only when it matches the string "0\n" exactly:
if ((off == 0) && (*buf == '0') && (count == 2))
The count == 2 condition encodes the trailing newline that echo(1) appends. This was found when userspace wrote "0" without a trailing newline aiming to disable access, which failed to match the condition above and enabled access instead. For example:
$ echo 0 > rom # "0\n", count 2, access disabled $ echo -n 0 > rom # "0", count 1, access enabled $ echo > rom # "", count 1, access enabled (likely not desirable)
Parse the input with kstrtobool(), which handles common boolean inputs such as "0", "1", "n", "y" or "off", "on", with or without a trailing newline, so both of the above disable access, and update the now stale comment.
As a side effect, input that does not parse as a boolean is rejected with -EINVAL rather than enabling access. The documented "0" and "1" continue to work as before, and rejecting malformed input brings the attribute in line with how sysfs attributes typically handle it.
--- drivers/pci/pci-sysfs.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/pci/pci-sysfs.c +6 -5
@@ -1338,18 +1338,19 @@ void __weak pci_remove_resource_files(struct pci_dev *dev) { return; }* @off: file offset * @count: number of byte in input * -* writing anything except 0 enables it +* Writing a boolean value enables or disables the ROM display. */ static ssize_t pci_write_rom (struct file *filp,struct kobject *kobj,const struct bin_attribute *bin_attr,char *buf,loff_t off,size_t count) {struct pci_dev *pdev =to_pci_dev (kobj_to_dev (kobj)); +bool enable; -if ((off ==0 ) && (*buf =='0' ) && (count ==2 )) - pdev->rom_attr_enabled =0 ; -else - pdev->rom_attr_enabled =1 ; +if (kstrtobool (buf, &enable)) +return -EINVAL ; + + pdev->rom_attr_enabled = enable;return count; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 466/1250 regulator: da9121: Use subvariant ids in the I2C table
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit 7ddbf1cde4a03e36e17d06fbc711870eb0b256d7 ]
da9121_i2c_probe() stores i2c_get_match_data() in chip->subvariant_id and da9121_assign_chip_model() switches on DA9121_SUBTYPE_* values. The OF table provides those subvariant values, but the I2C id table currently provides DA9121_TYPE_* values.
Make the I2C id table use the same subvariant namespace as the OF table so non-DT I2C matches feed the expected data type into the model assignment code.
--- drivers/regulator/da9121-regulator.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/regulator/da9121-regulator.c +9 -9
@@ -1166,15 +1166,15 @@ static void da9121_i2c_remove(struct i2c_client *i2c) }static const struct i2c_device_id da9121_i2c_id[] = { - {"da9121" ,DA9121_TYPE_DA9121_DA9130 }, - {"da9130" ,DA9121_TYPE_DA9121_DA9130 }, - {"da9217" ,DA9121_TYPE_DA9217 }, - {"da9122" ,DA9121_TYPE_DA9122_DA9131 }, - {"da9131" ,DA9121_TYPE_DA9122_DA9131 }, - {"da9220" ,DA9121_TYPE_DA9220_DA9132 }, - {"da9132" ,DA9121_TYPE_DA9220_DA9132 }, - {"da9141" ,DA9121_TYPE_DA9141 }, - {"da9142" ,DA9121_TYPE_DA9142 }, + {"da9121" ,DA9121_SUBTYPE_DA9121 }, + {"da9130" ,DA9121_SUBTYPE_DA9130 }, + {"da9217" ,DA9121_SUBTYPE_DA9217 }, + {"da9122" ,DA9121_SUBTYPE_DA9122 }, + {"da9131" ,DA9121_SUBTYPE_DA9131 }, + {"da9220" ,DA9121_SUBTYPE_DA9220 }, + {"da9132" ,DA9121_SUBTYPE_DA9132 }, + {"da9141" ,DA9121_SUBTYPE_DA9141 }, + {"da9142" ,DA9121_SUBTYPE_DA9142 }, {}, };MODULE_DEVICE_TABLE (i2c, da9121_i2c_id);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 467/1250 net: au1000: move free_irq out of the close-time spinlocked section
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <[email protected]>
[ Upstream commit f48763beab4eea41fc480c9702ec6eebe8d75e4f ]
au1000_close() calls free_irq() while aup->lock is still held with spin_lock_irqsave(). free_irq() can sleep because it takes the IRQ descriptor request mutex, so it does not belong inside the close-time spinlocked section.
This was found by our static analysis tool and then confirmed by manual review of the in-tree au1000_close() .ndo_stop path. The reviewed path keeps aup->lock held across the MAC reset, queue stop and free_irq(dev->irq, dev).
A directed runtime validation kept that ndo_stop carrier and the same free_irq(dev->irq, dev) operation under the driver lock. Lockdep reported "BUG: sleeping function called from invalid context" and "Invalid wait context" while free_irq() was taking desc->request_mutex, with au1000_close() and free_irq() on the stack.
Drop aup->lock before freeing the IRQ. The protected close-time work still stops the device and queue before IRQ teardown, but the sleepable IRQ core path now runs outside the spinlocked section.
--- drivers/net/ethernet/amd/au1000_eth.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/amd/au1000_eth.c +2 -1
@@ -943,9 +943,10 @@ static int au1000_close(struct net_device *dev)/* stop the device */ netif_stop_queue (dev); +spin_unlock_irqrestore (&aup->lock, flags); +/* disable the interrupt */ free_irq (dev->irq, dev); -spin_unlock_irqrestore (&aup->lock, flags);return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 468/1250 blk-cgroup: protect iterating blkgs with blkcg->lock in blkcg_print_stat()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
[ Upstream commit 25656304dabd26198ec69460c594a19d086ef099 ]
blkcg_print_one_stat() will be called for each blkg:
- access blkg->iostat, which is freed from rcu callback blkg_free_workfn();
- access policy data from pd_stat_fn(), which is freed from pd_free_fn(), while pd_free_fn() can be called by removing blkcg or deactivating policy;
Take blkcg->lock while iterating so the blkgs stay online and both blkg->iostat and policy data for activated policies stay valid. Use irq-safe locking because blkcg->lock can be nested under q->queue_lock, which is used from IRQ completion paths.
Prepare to convert protecting blkgs from request_queue with mutex.
--- block/blk-cgroup.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
block/blk-cgroup.c +3 -6
@@ -1241,13 +1241,10 @@ static int blkcg_print_stat(struct seq_file *sf, void *v)else css_rstat_flush (&blkcg->css); -rcu_read_lock (); -hlist_for_each_entry_rcu (blkg, &blkcg->blkg_list, blkcg_node) { -spin_lock_irq (&blkg->q->queue_lock); +guard (spinlock_irq)(&blkcg->lock); +hlist_for_each_entry (blkg, &blkcg->blkg_list, blkcg_node)blkcg_print_one_stat (blkg, sf); -spin_unlock_irq (&blkg->q->queue_lock); - } -rcu_read_unlock (); +return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 469/1250 rtc: bq32000: add delay between RTC reads
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adriana Stancu <[email protected]>
[ Upstream commit d4992b7050a10079bc760bdc5b8688e05a09dfc2 ]
When the RTC is used on systems without a interrupt line, userspace tools like hwclock fall back to a frequent polling loop to synchronize with the edge of the next second.
On the BQ32000, this aggressive polling can temporarly lock the register refresh cycle, because the continuous transfers prevent the hardware from updating the buffer. This results in stale data reads or select() timeouts in userspace.
This patch introduces a delay before reading the RTC registers in order to provide a sufficient idle time for the hardware to sync with the register buffer.
--- drivers/rtc/rtc-bq32k.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/rtc/rtc-bq32k.c +9 -0
@@ -16,6 +16,7 @@#include <linux/kstrtox.h> #include <linux/errno.h> #include <linux/bcd.h> +#include <linux/delay.h> #define BQ32K_SECONDS 0x00/* Seconds register address */ #define BQ32K_SECONDS_MASK 0x7F/* Mask over seconds value */
@@ -89,9 +90,17 @@ static int bq32k_write(struct device *dev, void *data, uint8_t off, uint8_t len)static int bq32k_rtc_read_time (struct device *dev,struct rtc_time *tm) { +struct i2c_client *client =to_i2c_client (dev);struct bq32k_regs regs;int error; +/* +* When the device doesn't have the interrupt connected, prevent +* userpace from polling the RTC registers too frequently. +*/ +if (client->irq <=0 ) +usleep_range (2000 ,2500 ); + error =bq32k_read (dev, ®s,0 ,sizeof (regs));if (error)return error;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 470/1250 eth: mlx5: fix macsec dependency
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 87ab8276ed24d688febfef4d0c1794896e778192 ]
Configurations with mlx5 built-in but macsec=m fail to link:
x86_64-linux-ld: drivers/infiniband/hw/mlx5/macsec.o: in function `mlx5r_add_gid_macsec_operations':
macsec.c:(.text+0x77d): undefined reference to `macsec_netdev_is_offloaded'
x86_64-linux-ld: drivers/infiniband/hw/mlx5/macsec.o: in function `mlx5r_del_gid_macsec_operations':
macsec.c:(.text+0xe81): undefined reference to `macsec_netdev_is_offloaded'
Fix the dependency so this configuration cannot happen.
--- drivers/net/ethernet/mellanox/mlx5/core/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/Kconfig +1 -1
@@ -143,7 +143,7 @@ config MLX5_CORE_IPOIB config MLX5_MACSEC bool "Connect-X support for MACSec offload" depends on MLX5_CORE_EN - depends on MACSEC + depends on MACSEC=y || MACSEC=MLX5_CORE default n help Build support for MACsec cryptography-offload acceleration in the NIC.
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 471/1250 ALSA: hda: Add Lenovo Legion 7i 16IAX7 17AA3874 quirk
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kamlesh Chhetty <[email protected]>
[ Upstream commit 6485da8579e2b0132630faa1ee2ac72ccaf01501 ]
Lenovo Legion 7i 16IAX7 systems with Realtek ALC287 codec SSID 17aa:3874 and CSC3551/CS35L41 speaker amps do not provide the required CS35L41 _DSD properties in ACPI.
Without a quirk, cs35l41-hda fails probing the amps with missing cirrus,dev-index / Platform not supported errors, leaving the built-in speakers silent.
This model is similar to the already-supported 17AA386F Legion 7i 16IAX7 variant. Add the Realtek ALC287 quirk to select ALC287_FIXUP_CS35L41_I2C_2 and add 17AA3874 to the CS35L41 property table using the same two-amp external-boost configuration.
Tested on a Lenovo Legion 7 16IAX7 with Ubuntu 7.0.0-22-generic. Both CSC3551 CS35L41 amps probe and bind, firmware loads, calibration applies, built-in speaker playback works, and the cirrus,dev-index failure is gone.
--- sound/hda/codecs/realtek/alc269.c | 1 + sound/hda/codecs/side-codecs/cs35l41_hda_property.c | 2 ++ 2 files changed, 3 insertions(+)
sound/hda/codecs/realtek/alc269.c +1 -0
@@ -7456,6 +7456,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {HDA_CODEC_QUIRK (0x17aa ,0x38a7 ,"Legion Pro 7 16ARX8H" ,ALC287_FIXUP_TAS2781_I2C ),/* this must match before PCI SSID 17aa:386f below */ SND_PCI_QUIRK (0x17aa ,0x386f ,"Legion Pro 7i 16IAX7" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x17aa ,0x3870 ,"Lenovo Yoga 7 14ARB7" ,ALC287_FIXUP_YOGA7_14ARB7_I2C ), +SND_PCI_QUIRK (0x17aa ,0x3874 ,"Legion 7i 16IAX7" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x17aa ,0x3877 ,"Lenovo Legion 7 Slim 16ARHA7" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x17aa ,0x3878 ,"Lenovo Legion 7 Slim 16ARHA7" ,ALC287_FIXUP_CS35L41_I2C_2 ), SND_PCI_QUIRK(0x17aa, 0x387d, "Yoga S780-16 pro Quad AAC", ALC287_FIXUP_TAS2781_I2C),
sound/hda/codecs/side-codecs/cs35l41_hda_property.c +2 -0
@@ -123,6 +123,7 @@ static const struct cs35l41_config cs35l41_config_table[] = { { "17AA3866", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, -1, -1, 0, 0, 0 }, { "17AA386E", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 2, -1, 0, 0, 0 }, { "17AA386F", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, -1, -1, 0, 0, 0 }, + { "17AA3874", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, -1, -1, 0, 0, 0 }, { "17AA3877", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, -1, -1, 0, 0, 0 }, { "17AA3878", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, -1, -1, 0, 0, 0 }, { "17AA38A9", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 2, -1, 0, 0, 0 },
@@ -548,6 +549,7 @@ static const struct cs35l41_prop_model cs35l41_prop_model_table[] = { { "CSC3551", "17AA3866", generic_dsd_config }, { "CSC3551", "17AA386E", generic_dsd_config }, { "CSC3551", "17AA386F", generic_dsd_config }, + { "CSC3551", "17AA3874", generic_dsd_config }, { "CSC3551", "17AA3877", generic_dsd_config }, { "CSC3551", "17AA3878", generic_dsd_config }, { "CSC3551", "17AA38A9", generic_dsd_config },
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 472/1250 fbdev: pm2fb: unwind WC setup on probe failure
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
[ Upstream commit 16eb19f0c90af03bda6ba66586d7bb0e9cf85b43 ]
Add arch_phys_wc_del() on error path to keep the write-combining setup balanced when later probe steps fail.
--- drivers/video/fbdev/pm2fb.c | 1 + 1 file changed, 1 insertion(+)
drivers/video/fbdev/pm2fb.c +1 -0
@@ -1711,6 +1711,7 @@ static int pm2fb_probe(struct pci_dev *pdev, const struct pci_device_id *id) err_exit_both:kfree (info->pixmap.addr); err_exit_pixmap: +arch_phys_wc_del (default_par->wc_cookie);iounmap (info->screen_base);release_mem_region (pm2fb_fix.smem_start, pm2fb_fix.smem_len); err_exit_mmio:
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 473/1250 ASoC: tas2781: Update default register address to TAS2563
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baojun Xu <[email protected]>
[ Upstream commit 64184f07e7516eb3ac1839387eb7cbe2dbeaa96f ]
The previous TAS2781 address is overwritten during calibration, so switching to the TAS2563 address is required.
--- include/sound/tas2781.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/sound/tas2781.h +2 -2
@@ -59,9 +59,9 @@#define TASDEVICE_CHECKSUM_REG TASDEVICE_REG(0x0, 0x0, 0x7e)/* XM_340 */ -#define TASDEVICE_XM_A1_REG TASDEVICE_REG(0x64, 0x63, 0x3c) +#define TASDEVICE_XM_A1_REG TASDEVICE_REG(0x64, 0x02, 0x4c)/* XM_341 */ -#define TASDEVICE_XM_A2_REG TASDEVICE_REG(0x64, 0x63, 0x38) +#define TASDEVICE_XM_A2_REG TASDEVICE_REG(0x64, 0x02, 0x64)/* Volume control */ #define TAS2563_DVC_LVL TASDEVICE_REG(0x00, 0x02, 0x0c)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 474/1250 spi: core: Abort active target transfer on controller suspend
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Praveen Talari <[email protected]>
[ Upstream commit c1bab046d4786c5b17aab7c5225bf0d4a2a2d19b ]
When an SPI controller operating in target mode has a transfer in progress at the time of system suspend, the suspend path proceeds without aborting the ongoing transfer. This can leave the hardware in an inconsistent state, potentially causing the system to hang or fail to resume cleanly.
Fix this by invoking the controller's target_abort callback from spi_controller_suspend() when the controller is in target mode and the callback is registered. This ensures any active target transfer is cleanly terminated before the controller is suspended.
--- drivers/spi/spi.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/spi/spi.c +3 -0
@@ -3503,6 +3503,9 @@ int spi_controller_suspend(struct spi_controller *ctlr) {int ret =0 ; +if (ctlr->cur_msg &&spi_controller_is_target (ctlr) && ctlr->target_abort) + ctlr->target_abort (ctlr); +/* Basically no-ops for non-queued controllers */ if (ctlr->queued) { ret =spi_stop_queue (ctlr);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 475/1250 btrfs: tree-checker: validate INODE_REFs namelen
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <[email protected]>
[ Upstream commit 3dc22abc21f5892406c09202fa2627196cc96967 ]
[BUG]
A crafted btrfs image can trigger the following crash:
BUG: unable to handle page fault for address: ffffd1dc42884000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page CPU: 9 UID: 0 PID: 1034 Comm: poc Not tainted 7.1.0-rc4-custom+ #383 PREEMPT(full) 46af0a92938a63be7132e0dfd71e62327c51d5c2 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022 RIP: 0010:memcpy+0xc/0x10 Call Trace: <TASK> read_extent_buffer+0xe4/0x100 [btrfs 3cf0785dd58fec8c5ff84633b772f17ce1f92a8f] btrfs_get_name+0x15e/0x1e0 [btrfs 3cf0785dd58fec8c5ff84633b772f17ce1f92a8f] reconnect_path+0x165/0x390 exportfs_decode_fh_raw+0x337/0x400 ? drop_caches_sysctl_handler+0xb0/0xb0 </TASK> ---[ end trace 0000000000000000 ]--- RIP: 0010:memcpy+0xc/0x10 Kernel panic - not syncing: Fatal exception
[CAUSE]
TThe crafted image has the following corrupted INODE_REF item:
item 9 key (258 INODE_REF 257) itemoff 11544 itemsize 4106
index 2 namelen 4096 name: d\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000The itemsize matches the namelen, but the namelen is 4096, way larger than normal name length limit (BTRFS_NAME_LEN, 255).
Meanwhile the memory of the @name is only 255 byte sized, this will cause out-of-boundary access, and cause the above crash.
[FIX]
Add extra namelen verification for INODE_REF, just like what we have done in ROOT_REF checks.
Now the crafted image can be rejected gracefully:
BTRFS critical (device dm-2): corrupt leaf: root=5 block=30572544 slot=14 ino=259, invalid inode ref name length, has 4096 expect [1, 255] BTRFS error (device dm-2): read time tree block corruption detected on logical 30572544 mirror 2
--- fs/btrfs/tree-checker.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/btrfs/tree-checker.c +6 -0
@@ -1813,6 +1813,12 @@ static int check_inode_ref(struct extent_buffer *leaf, iref = (struct btrfs_inode_ref *)ptr; namelen =btrfs_inode_ref_name_len (leaf, iref); +if (unlikely (namelen ==0 || namelen >BTRFS_NAME_LEN )) { +inode_ref_err (leaf, slot, +"invalid inode ref name length, has %u expect [1, %u]" , + namelen,BTRFS_NAME_LEN ); +return -EUCLEAN ; + }if (unlikely (ptr +sizeof (*iref) + namelen > end)) { inode_ref_err(leaf, slot, "inode ref overflow, ptr %lu end %lu namelen %u",
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 476/1250 drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gustavo Kenji Mendonça Kaneko <[email protected]>
[ Upstream commit 46f715a16989f4e7bbbc2eb41447051874b027f3 ]
malidp_runtime_pm_resume() calls clk_prepare_enable() three times without checking the return value. If any clock fails to enable, the driver silently proceeds with unclocked hardware, leading to undefined behavior.
Convert both the resume and suspend paths to use the clk_bulk API:clk_bulk_prepare_enable() in resume checks the return value and rolls back any successfully enabled clocks on failure; clk_bulk_disable_unprepare() in suspend keeps the two paths symmetric.
This issue was found by code review without access to Mali DP hardware.
--- drivers/gpu/drm/arm/malidp_drv.c | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-)
drivers/gpu/drm/arm/malidp_drv.c +16 -6
@@ -669,6 +669,11 @@ static int malidp_runtime_pm_suspend(struct device *dev)struct drm_device *drm =dev_get_drvdata (dev);struct malidp_drm *malidp =drm_to_malidp (drm);struct malidp_hw_device *hwdev = malidp->dev; +struct clk_bulk_data clks[] = { + { .clk = hwdev->pclk }, + { .clk = hwdev->aclk }, + { .clk = hwdev->mclk }, + };/* we can only suspend if the hardware is in config mode */ WARN_ON (!hwdev->hw->in_config_mode (hwdev));
@@ -676,9 +681,7 @@ static int malidp_runtime_pm_suspend(struct device *dev)malidp_se_irq_fini (hwdev);malidp_de_irq_fini (hwdev); hwdev->pm_suspended = true; -clk_disable_unprepare (hwdev->mclk); -clk_disable_unprepare (hwdev->aclk); -clk_disable_unprepare (hwdev->pclk); +clk_bulk_disable_unprepare (ARRAY_SIZE (clks), clks);return 0 ; }
@@ -688,10 +691,17 @@ static int malidp_runtime_pm_resume(struct device *dev)struct drm_device *drm =dev_get_drvdata (dev);struct malidp_drm *malidp =drm_to_malidp (drm);struct malidp_hw_device *hwdev = malidp->dev; +struct clk_bulk_data clks[] = { + { .clk = hwdev->pclk }, + { .clk = hwdev->aclk }, + { .clk = hwdev->mclk }, + }; +int err; + + err =clk_bulk_prepare_enable (ARRAY_SIZE (clks), clks); +if (err) +return err; -clk_prepare_enable (hwdev->pclk); -clk_prepare_enable (hwdev->aclk); -clk_prepare_enable (hwdev->mclk); hwdev->pm_suspended = false;malidp_de_irq_hw_init (hwdev);malidp_se_irq_hw_init (hwdev);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 477/1250 netfilter: nf_conntrack_expect: zero at allocation time
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 241ccd2fed9051db443aadce248fc0ab30f55e97 ]
There are occasional LLM hints wrt. leaking uninitialized data to userspace via ctnetlink. Just zero at allocation time, expectations are not frequently used these days.
Intentionally keeps _init as-is because we could theoretically support re-init, so add the missing exp->dir there.
--- net/netfilter/nf_conntrack_expect.c | 3 ++- net/netfilter/nf_conntrack_netlink.c | 11 +---------- 2 files changed, 3 insertions(+), 11 deletions(-)
net/netfilter/nf_conntrack_expect.c +2 -1
@@ -304,7 +304,7 @@ struct nf_conntrack_expect *nf_ct_expect_alloc(struct nf_conn *me) {struct nf_conntrack_expect *new; - new =kmem_cache_alloc (nf_ct_expect_cachep,GFP_ATOMIC ); + new =kmem_cache_zalloc (nf_ct_expect_cachep,GFP_ATOMIC );if (!new)return NULL ;
@@ -386,6 +386,7 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class,#if IS_ENABLED (CONFIG_NF_NAT )memset (&exp->saved_addr,0 ,sizeof (exp->saved_addr));memset (&exp->saved_proto,0 ,sizeof (exp->saved_proto)); + exp->dir =0 ;#endif }EXPORT_SYMBOL_GPL (nf_ct_expect_init);
net/netfilter/nf_conntrack_netlink.c +1 -10
@@ -3559,8 +3559,6 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,if (cda[CTA_EXPECT_FLAGS ]) { exp->flags =ntohl (nla_get_be32 (cda[CTA_EXPECT_FLAGS ])); exp->flags &= ~NF_CT_EXPECT_USERSPACE ; - }else { - exp->flags =0 ; }if (cda[CTA_EXPECT_FN ]) {const char *name =nla_data (cda[CTA_EXPECT_FN ]);
@@ -3572,8 +3570,7 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct, goto err_out; } exp->expectfn = expfn->expectfn; - }else - exp->expectfn =NULL ; + } exp->class = class; exp->master = ct;
@@ -3592,12 +3589,6 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct, exp, nf_ct_l3num(ct));if (err <0 ) goto err_out; -#if IS_ENABLED (CONFIG_NF_NAT ) - } else { -memset (&exp->saved_addr,0 ,sizeof (exp->saved_addr)); -memset (&exp->saved_proto,0 ,sizeof (exp->saved_proto)); - exp->dir =0 ; -#endif }return exp; err_out:
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 478/1250 ksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiang Liu <[email protected]>
[ Upstream commit d4d56b00c7df88cd5751e7415bdfabc9fdbc82a7 ]
ndr_encode_v4_ntacl() allocates sd_ndr.data via kzalloc() at entry. If any subsequent ndr_write_*() call returns error during encoding, the allocated sd_ndr.data won't be freed and causes memory leak.
Move kfree(sd_ndr.data) into out label to ensure the buffer gets released on all success and error return paths.
--- fs/smb/server/vfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/smb/server/vfs.c +1 -1
@@ -1572,8 +1572,8 @@ int ksmbd_vfs_set_sd_xattr(struct ksmbd_conn *conn,if (rc <0 )pr_err ("Failed to store XATTR ntacl :%d\n" , rc); -kfree (sd_ndr.data); out: +kfree (sd_ndr.data);kfree (acl_ndr.data);kfree (smb_acl);kfree (def_smb_acl);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 479/1250 ALSA: hda/realtek: Add quirk for HP Victus 16-e0xxx (88EE) to enable mute LED
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shubham Nayak <[email protected]>
[ Upstream commit 6c18817c01f6f76d9e2739903abde4d69397f2c6 ]
The mute LED on the HP Victus 16-e0xxx (board ID 88EE, ALC245 codec) does not function by default. Add the ALC245_FIXUP_HP_MUTE_LED_COEFBIT quirk to enable it. Tested on my HP Victus 16-e0xxx with kernel 7.1.2.
--- sound/hda/codecs/realtek/alc269.c | 1 + 1 file changed, 1 insertion(+)
sound/hda/codecs/realtek/alc269.c +1 -0
@@ -6807,6 +6807,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x103c ,0x88d1 ,"HP Pavilion 15-eh1xxx (mainboard 88D1)" ,ALC245_FIXUP_HP_MUTE_LED_V1_COEFBIT ),SND_PCI_QUIRK (0x103c ,0x88dd ,"HP Pavilion 15z-ec200" ,ALC285_FIXUP_HP_MUTE_LED ),SND_PCI_QUIRK (0x103c ,0x88eb ,"HP Victus 16-e0xxx" ,ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT ), +SND_PCI_QUIRK (0x103c ,0x88ee ,"HP Victus 16-e0xxx (MB 88EE)" ,ALC245_FIXUP_HP_MUTE_LED_COEFBIT ),SND_PCI_QUIRK (0x103c ,0x8902 ,"HP OMEN 16" ,ALC285_FIXUP_HP_MUTE_LED ),SND_PCI_QUIRK (0x103c ,0x890e ,"HP 255 G8 Notebook PC" ,ALC236_FIXUP_HP_MUTE_LED_COEFBIT2 ), SND_PCI_QUIRK(0x103c, 0x8919, "HP Pavilion Aero Laptop 13-be0xxx", ALC287_FIXUP_HP_GPIO_LED),
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 480/1250 drm/arm/komeda: fix error handling for clk_prepare_enable() and callers
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gustavo Kenji Mendonça Kaneko <[email protected]>
[ Upstream commit 6502eb8cfcd6f7bc5f1f8b73ee524112bd93319d ]
komeda_dev_resume() calls clk_prepare_enable() without checking the return value. If the clock fails to enable, the function returns 0 (success) while IRQs are enabled and IOMMU is connected on potentially unclocked hardware, causing undefined behavior on resume.
Propagate the error from clk_prepare_enable() and fix all call sites in komeda_drv.c that previously ignored the return value of komeda_dev_resume():
- komeda_platform_probe(): if resume fails, jump to err_destroy_mdev (skipping the suspend call, since the clock was never enabled)
- komeda_pm_resume(): propagate the error and skip drm_mode_config_helper_resume() on failure
This issue was found by code review without access to Komeda hardware.
--- drivers/gpu/drm/arm/display/komeda/komeda_dev.c | 6 +++++- drivers/gpu/drm/arm/display/komeda/komeda_drv.c | 14 +++++++++----- 2 files changed, 14 insertions(+), 6 deletions(-)
drivers/gpu/drm/arm/display/komeda/komeda_dev.c +5 -1
@@ -313,7 +313,11 @@ void komeda_dev_destroy(struct komeda_dev *mdev)int komeda_dev_resume (struct komeda_dev *mdev) { -clk_prepare_enable (mdev->aclk); +int err; + + err =clk_prepare_enable (mdev->aclk); +if (err) +return err; mdev->funcs->enable_irq (mdev);
drivers/gpu/drm/arm/display/komeda/komeda_drv.c +9 -5
@@ -74,8 +74,11 @@ static int komeda_platform_probe(struct platform_device *pdev) }pm_runtime_enable (dev); -if (!pm_runtime_enabled (dev)) -komeda_dev_resume (mdrv->mdev); +if (!pm_runtime_enabled (dev)) { + err =komeda_dev_resume (mdrv->mdev); +if (err) + goto err_destroy_mdev; + } mdrv->kms =komeda_kms_attach (mdrv->mdev);if (IS_ERR (mdrv->kms)) {
@@ -93,7 +96,7 @@ static int komeda_platform_probe(struct platform_device *pdev)pm_runtime_disable (dev); else komeda_dev_suspend(mdrv->mdev); - +err_destroy_mdev:komeda_dev_destroy (mdrv->mdev); free_mdrv:
@@ -139,11 +142,12 @@ static int __maybe_unused komeda_pm_suspend(struct device *dev)static int __maybe_unused komeda_pm_resume (struct device *dev) {struct komeda_drv *mdrv =dev_get_drvdata (dev); +int err =0 ;if (!pm_runtime_status_suspended (dev)) -komeda_dev_resume (mdrv->mdev); + err =komeda_dev_resume (mdrv->mdev); -return drm_mode_config_helper_resume (&mdrv->kms->base); +return err ? err :drm_mode_config_helper_resume (&mdrv->kms->base); }static const struct dev_pm_ops komeda_pm_ops = {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 481/1250 ksmbd: fix n.data memory leak in ksmbd_vfs_set_dos_attrib_xattr
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiang Liu <[email protected]>
[ Upstream commit 7ac657bb9c5c1b0f7bdf1fa6d3ad532f969be5cf ]
Free ndr buffer data when ndr_encode_dos_attr() returns error to avoid memory leak.
--- fs/smb/server/vfs.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
fs/smb/server/vfs.c +3 -2
@@ -1661,14 +1661,15 @@ int ksmbd_vfs_set_dos_attrib_xattr(struct mnt_idmap *idmap, err =ndr_encode_dos_attr (&n, da);if (err) -return err; + goto out; err =ksmbd_vfs_setxattr (idmap, path,XATTR_NAME_DOS_ATTRIBUTE , (void *)n.data, n.offset,0 , get_write);if (err)ksmbd_debug (SMB ,"failed to store dos attribute in xattr\n" ); -kfree (n.data); +out: +kfree (n.data);return err; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 482/1250 ksmbd: Fix acl.sd_buf memory leak and invalid sd_size error handling
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiang Liu <[email protected]>
[ Upstream commit d708a36634bb7b6f94d0e76d587d2ec50b2b93b5 ]
1. When ndr_decode_v4_ntacl() fails, the code jumped to free_n_data which only freed n.data, skipping kfree(acl.sd_buf) and leaking the buffer. Zero-initialize struct xattr_ntacl acl, reorder error labels to out_free to release acl.sd_buf on all error paths.
2. if (acl.sd_size < sizeof(struct smb_ntsd)) is true, original code returned success without freeing sd_buf and left stale *pntsd. Set rc = -EINVAL before jumping to out_free to return error code and free buffer.
--- fs/smb/server/vfs.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
fs/smb/server/vfs.c +3 -4
@@ -1589,7 +1589,7 @@ int ksmbd_vfs_get_sd_xattr(struct ksmbd_conn *conn,struct ndr n;struct inode *inode =d_inode (dentry);struct ndr acl_ndr = {0 }; -struct xattr_ntacl acl; +struct xattr_ntacl acl = {0 };struct xattr_smb_acl *smb_acl =NULL , *def_smb_acl =NULL ;__u8 cmp_hash[XATTR_SD_HASH_SIZE ] = {0 };
@@ -1600,7 +1600,7 @@ int ksmbd_vfs_get_sd_xattr(struct ksmbd_conn *conn, n.length = rc; rc =ndr_decode_v4_ntacl (&n, &acl);if (rc) - goto free_n_data; + goto out_free; smb_acl =ksmbd_vfs_make_xattr_posix_acl (idmap, inode,ACL_TYPE_ACCESS );
@@ -1626,6 +1626,7 @@ int ksmbd_vfs_get_sd_xattr(struct ksmbd_conn *conn, *pntsd = acl.sd_buf;if (acl.sd_size <sizeof (struct smb_ntsd )) {pr_err ("sd size is invalid\n" ); + rc = -EINVAL ; goto out_free; }
@@ -1645,8 +1646,6 @@ int ksmbd_vfs_get_sd_xattr(struct ksmbd_conn *conn,kfree (acl.sd_buf); *pntsd =NULL ; } - -free_n_data:kfree (n.data);return rc; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 483/1250 xen/front-pgdir-shbuf: free grant reference head on errors
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yousef Alhouseen <[email protected]>
[ Upstream commit 678d59219ce0ae883f04c96936222c6168ef1164 ]
grant_references() allocates a private grant-reference head before claiming references for the page directory and, for guest-owned buffers, the data pages. The success path frees the remaining head, but claim failures and grant_refs_for_buffer() errors return immediately.
Unwind through a common exit path so the private grant-reference head is released even when granting fails part-way through setup. The caller still tears down any references already stored in buf->grefs.
Message-ID: <[email protected]>
--- drivers/xen/xen-front-pgdir-shbuf.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/xen/xen-front-pgdir-shbuf.c +8 -4
@@ -447,8 +447,10 @@ static int grant_references(struct xen_front_pgdir_shbuf *buf)unsigned long frame; cur_ref =gnttab_claim_grant_reference (&priv_gref_head); -if (cur_ref <0 ) -return cur_ref; +if (cur_ref <0 ) { + ret = cur_ref; + goto out_free_refs; + } frame =xen_page_to_gfn (virt_to_page (buf->directory +PAGE_SIZE * i));
@@ -459,11 +461,13 @@ static int grant_references(struct xen_front_pgdir_shbuf *buf)if (buf->ops->grant_refs_for_buffer) { ret = buf->ops->grant_refs_for_buffer (buf, &priv_gref_head, j);if (ret) -return ret; + goto out_free_refs; } + ret =0 ; +out_free_refs:gnttab_free_grant_references (priv_gref_head); -return 0 ; +return ret; }/*
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 484/1250 freevxfs: dont BUG() on unknown typed-extent type
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Farhad Alemi <[email protected]>
[ Upstream commit 704d48d81dc41470e108811c32c577ada66192d4 ]
vxfs_bmap_typed() handles four typed-extent types and calls BUG() in its default case, so an on-disk typed extent with any other type value crashes the kernel. It is reachable from ioctl(FIBMAP) on a regular file:
kernel BUG at fs/freevxfs/vxfs_bmap.c:230!
RIP: vxfs_bmap_typed fs/freevxfs/vxfs_bmap.c:230 [inline]
vxfs_bmap1+0x128a/0x12d0 fs/freevxfs/vxfs_bmap.c:257Replace the BUG() with WARN_ON_ONCE() and return 0 -- the value vxfs_bmap_typed() already returns on failure (and from the DEV4 case above); vxfs_getblk() maps 0 to -EIO, so the ioctl fails cleanly.
--- fs/freevxfs/vxfs_bmap.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/freevxfs/vxfs_bmap.c +2 -1
@@ -227,7 +227,8 @@ vxfs_bmap_typed(struct inode *ip, long iblock)return 0 ; }default : -BUG (); +WARN_ON_ONCE (1 ); +return 0 ; } }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 485/1250 xen/gntalloc: validate grant count before allocation
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yousef Alhouseen <[email protected]>
[ Upstream commit 2299822f3f466b5dcad2377bf63986199f881a6b ]
gntalloc_ioctl_alloc() allocates the grant-id array before checking whether the requested count fits within the global grant limit. Counts above that limit cannot succeed, so reject them before the user-controlled allocation reaches kcalloc().
Use a subtraction-based check while holding gref_mutex so adding the requested count cannot wrap. Also cast the count before advancing the per-file index so the page-size multiplication is performed in 64-bit arithmetic.
Message-ID: <[email protected]>
--- drivers/xen/gntalloc.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
drivers/xen/gntalloc.c +11 -2
@@ -272,6 +272,7 @@ static long gntalloc_ioctl_alloc(struct gntalloc_file_private_data *priv,int rc =0 ;struct ioctl_gntalloc_alloc_gref op;uint32_t *gref_ids; +unsigned int limit_snapshot;pr_debug ("%s: priv %p\n" , __func__, priv);
@@ -280,6 +281,12 @@ static long gntalloc_ioctl_alloc(struct gntalloc_file_private_data *priv, goto out; } + limit_snapshot =READ_ONCE (limit); +if (op.count > limit_snapshot) { + rc = -ENOSPC ; + goto out; + } + gref_ids =kcalloc (op.count,sizeof (gref_ids[0 ]),GFP_KERNEL );if (!gref_ids) { rc = -ENOMEM ;
@@ -292,14 +299,16 @@ static long gntalloc_ioctl_alloc(struct gntalloc_file_private_data *priv,* are about to enforce, removing them here is a good idea. */ do_cleanup (); -if (gref_size + op.count > limit) { + limit_snapshot =READ_ONCE (limit); +if (gref_size > limit_snapshot || + op.count > limit_snapshot - gref_size) {mutex_unlock (&gref_mutex); rc = -ENOSPC ; goto out_free; } gref_size += op.count; op.index = priv->index; - priv->index += op.count *PAGE_SIZE ; + priv->index += (uint64_t )op.count *PAGE_SIZE ;mutex_unlock (&gref_mutex); rc =add_grefs (&op, gref_ids, priv);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 486/1250 cachefiles: Fix double fput
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit af6830cc12dfe86c832dccc9c9878a93aaa22f83 ]
Fix a double fput() in error handling in cachefiles_create_tmpfile().
--- fs/cachefiles/namei.c | 1 - 1 file changed, 1 deletion(-)
fs/cachefiles/namei.c +0 -1
@@ -499,7 +499,6 @@ struct file *cachefiles_create_tmpfile(struct cachefiles_object *object) ret = -EINVAL ;if (unlikely (!file->f_op->read_iter) ||unlikely (!file->f_op->write_iter)) { -fput (file);pr_notice ("Cache does not support read_iter and write_iter\n" ); goto err_unuse; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 487/1250 netfs: Fix decision whether to disallow write-streaming due to fscache use
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit b61cbeadaa83a712afb2f759aa7e65d43cdef322 ]
netfs_perform_write() buffers data by writing it into the pagecache for later writeback. If the folio it wants to write to isn't present, it uses "write streaming" in which is will store partial data in a non-uptodate, but dirty folio.
However, when fscache is in use, this is a potential problem as writes to the cache have to be aligned to the cache backend's DIO granularity, and so netfs_perform_write() attempts to suppress write-streaming in such a case, requiring the folio content to be fetched first unless the entire folio is going to be overwritten. This allows the content to be written to the cache too.
Unfortunately, the test netfs_perform_write() uses isn't correct because it doesn't take into account the fact that the object lookup is asynchronous and farmed off to a work queue, so there's a short window in which the cache is doing a lookup but the test fails because the answer is undefined.
This can be triggered by the generic/464 xfstest, and causes a warning to be emitted in cachefiles (in code not yet upstream) because it sees a write that doesn't have its bounds rounded out to DIO alignment.
Fix this by changing the condition to whether FSCACHE_COOKIE_IS_CACHING is set on a cookie rather than whether the cookie is marked enabled. Note that this is really just a hint as to whether we allow write streaming or not and no other aspects of the cookie or cache object are accessed.
Also apply the same fix to netfs_write_begin().
--- fs/netfs/buffered_read.c | 2 +- fs/netfs/buffered_write.c | 2 +- fs/netfs/internal.h | 12 ++++++++++++ 3 files changed, 14 insertions(+), 2 deletions(-)
fs/netfs/buffered_read.c +1 -1
@@ -660,7 +660,7 @@ int netfs_write_begin(struct netfs_inode *ctx,* within the cache granule containing the EOF, in which case we need * to preload the granule. */ -if (!netfs_is_cache_enabled (ctx) && +if (!netfs_is_cache_maybe_enabled (ctx) &&netfs_skip_folio_read (folio, pos, len, false)) {netfs_stat (&netfs_n_rh_write_zskip); goto have_folio_no_wait;
fs/netfs/buffered_write.c +1 -1
@@ -278,7 +278,7 @@ ssize_t netfs_perform_write(struct kiocb *iocb, struct iov_iter *iter,* caching service temporarily because the backing store got * culled. */ -if (netfs_is_cache_enabled (ctx)) { +if (netfs_is_cache_maybe_enabled (ctx)) {if (finfo) {netfs_stat (&netfs_n_wh_wstream_conflict); goto flush_content;
fs/netfs/internal.h +12 -0
@@ -239,6 +239,18 @@ static inline bool netfs_is_cache_enabled(struct netfs_inode *ctx)#endif } +static inline bool netfs_is_cache_maybe_enabled (struct netfs_inode *ctx) +{ +#if IS_ENABLED (CONFIG_FSCACHE ) +struct fscache_cookie *cookie = ctx->cache; + +return fscache_cookie_valid (cookie) && +test_bit (FSCACHE_COOKIE_IS_CACHING , &cookie->flags); +#else +return false; +#endif +} +/* * Get a ref on a netfs group attached to a dirty page (e.g. a ceph snap). */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 488/1250 ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jetha Chan <[email protected]>
[ Upstream commit e782d687d2f5bf8b8113dc48ba22cca4b472c252 ]
The Alienware m15 R7 AMD exposes an ACP6x DMIC path, but its DMI product name is not present in the Yellow Carp ACP quirk table. As a result, the ACP machine driver does not enable the DMIC card on this system.
Add the DMI product name for this machine. With this quirk applied, the kernel reports:
acp_yc_mach acp_yc_mach.0: Enabling ACP DMIC support via DMI
and ALSA exposes the ACP DMIC capture device:
card 3: acp6x
device 0: DMIC capture dmic-hifi-0
Tested on an Alienware m15 R7 AMD with product SKU 0B59.
--- sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/soc/amd/yc/acp6x-mach.c +7 -0
@@ -500,6 +500,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "Bravo 17 D7VF"), } }, + { + .driver_data = &acp6x_card, + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"Alienware" ), + DMI_MATCH(DMI_PRODUCT_NAME, "Alienware m15 R7 AMD"), + } + }, { .driver_data = &acp6x_card, .matches = {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 489/1250 drm/amdgpu: flush pending RCU callbacks on module unload
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Perry Yuan <[email protected]>
[ Upstream commit 67a654b41cfa73c3b83402c4a01b2689cad5b9bc ]
Call rcu_barrier() in module exit to wait for outstanding call_rcu() callbacks before freeing module text, preventing late callback execution in freed memory.
BUG: unable to handle page fault for address: ffffffffc1d59c40 PGD 6a12067 P4D 6a12067 PUD 6a14067 PMD 13698b067 PTE 0 Oops: 0010 [#1] SMP NOPTI RIP: 0010:0xffffffffc1d59c40 Code: Unable to access opcode bytes at RIP 0xffffffffc1d59c16. RSP: 0018:ffffc900198c0f28 EFLAGS: 00010286 RAX: ffffffffc1d59c40 RBX: ffff897c7d6b61c0 RCX: ffff88826aff4590 RDX: ffff8884d8b35490 RSI: ffffc900198c0f30 RDI: ffff88812af67290 RBP: 000000000000000a (DONE segment entries) R08: 0000000000000000 R09: 0000000000000100 R10: 0000000000000000 R11: ffffffff82a06100 R12: ffff88811a4e3700 R13: 0000000000000000 R14: ffff897c7d6b6270 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff897c7d680000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffc1d59c16 CR3: 00000104a980a001 CR4: 0000000002770ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <IRQ> ? rcu_do_batch+0x163/0x450 ? rcu_core+0x177/0x1c0 ? __do_softirq+0xc1/0x280 ? asm_call_irq_on_stack+0xf/0x20 </IRQ> ? do_softirq_own_stack+0x37/0x50 ? irq_exit_rcu+0xc4/0x100 ? sysvec_apic_timer_interrupt+0x36/0x80 ? asm_sysvec_apic_timer_interrupt+0x12/0x20 ? cpuidle_enter_state+0xd4/0x360 ? cpuidle_enter+0x29/0x40 ? cpuidle_idle_call+0x108/0x1a0 ? do_idle+0x77/0xf0 ? cpu_startup_entry+0x19/0x20 ? secondary_startup_64_no_verify+0xbf/0xcb
--- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +8 -0
@@ -3218,6 +3218,14 @@ static void __exit amdgpu_exit(void)amdgpu_userq_fence_slab_fini ();mmu_notifier_synchronize ();amdgpu_xcp_drv_release (); + +/* +* Flush outstanding call_rcu() callbacks before the +* module text is freed. Otherwise a grace period elapsing after +* unload invokes a callback in already-freed module memory and +* faults in rcu_do_batch(). +*/ +rcu_barrier (); }module_init (amdgpu_init);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 490/1250 ksmbd: fix credit charge calculation for SMB2 QUERY_INFO
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
[ Upstream commit 284dc80ff529a0b454f11b6c2fea0d5daf6f315f ]
smb2_validate_credit_charge() computes the credit charge a request is allowed to consume from the payload size:
CreditCharge = (max(SendPayloadSize, ResponsePayloadSize) - 1)/65536 + 1
For SMB2 QUERY_INFO, the server must validate CreditCharge based on the *maximum* of InputBufferLength and OutputBufferLength. ksmbd instead summed the two lengths, which overestimates the required charge.
As a result a single-credit QUERY_INFO whose InputBufferLength and OutputBufferLength each fit in 64KB but whose sum exceeds 64KB is rejected with STATUS_INVALID_PARAMETER, even though it is a valid request. IOCTL already uses max() of the request and response sizes; make QUERY_INFO consistent by feeding InputBufferLength as the request length and OutputBufferLength as the expected response length so that smb2_validate_credit_charge() takes their maximum.
--- fs/smb/server/smb2misc.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
fs/smb/server/smb2misc.c +7 -2
@@ -262,8 +262,12 @@ static int smb2_calc_size(void *buf, unsigned int *len)static inline int smb2_query_info_req_len (struct smb2_query_info_req *h) { -return le32_to_cpu (h->InputBufferLength) + -le32_to_cpu (h->OutputBufferLength); +return le32_to_cpu (h->InputBufferLength); +} + +static inline int smb2_query_info_resp_len (struct smb2_query_info_req *h) +{ +return le32_to_cpu (h->OutputBufferLength); }static inline int smb2_set_info_req_len (struct smb2_set_info_req *h)
@@ -309,6 +313,7 @@ static int smb2_validate_credit_charge(struct ksmbd_conn *conn,switch (hdr->Command) {case SMB2_QUERY_INFO : req_len =smb2_query_info_req_len (__hdr); + expect_resp_len =smb2_query_info_resp_len (__hdr);break ;case SMB2_SET_INFO : req_len =smb2_set_info_req_len (__hdr);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 491/1250 ALSA: usb-audio: caiaq: validate EP1 reply lengths
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit aba30af07d4fe499b50209801eba9da8a815522f ]
usb_ep1_command_reply_dispatch() uses buf[0] as a command byte and then reads command-specific fixed items from the same URB buffer. Several paths use buf + 1, buf[1], buf[2], or buf + 3 without first proving that urb->actual_length contains those bytes.
Add per-command length checks, use a payload length derived from the bytes after the command byte for the control-state copy, and reject short analog input payloads before the input helper reads fixed offsets from the EP1 reply.
--- sound/usb/caiaq/device.c | 17 ++++++++++++++--- sound/usb/caiaq/input.c | 6 ++++++ 2 files changed, 20 insertions(+), 3 deletions(-)
sound/usb/caiaq/device.c +14 -3
@@ -134,14 +134,22 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb)struct device *dev = &urb->dev->dev;struct snd_usb_caiaqdev *cdev = urb->context;unsigned char *buf = urb->transfer_buffer; +unsigned int payload_len; +unsigned int copy_len;if (urb->status || !cdev) {dev_warn (dev,"received EP1 urb->status = %i\n" , urb->status);return ; } +if (urb->actual_length <1 ) +return ; + + payload_len = urb->actual_length -1 ;switch (buf[0 ]) {case EP1_CMD_GET_DEVICE_INFO : +if (payload_len <sizeof (struct caiaq_device_spec )) +break ;memcpy (&cdev->spec, buf+1 ,sizeof (struct caiaq_device_spec )); cdev->spec.fw_version =le16_to_cpu (cdev->spec.fw_version); dev_dbg(dev, "device spec (firmware %d): audio: %d in, %d out, "
@@ -157,18 +165,21 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb)wake_up (&cdev->ep1_wait_queue);break ;case EP1_CMD_AUDIO_PARAMS : +if (payload_len <1 ) +break ; cdev->audio_parm_answer = buf[1 ];wake_up (&cdev->ep1_wait_queue);break ;case EP1_CMD_MIDI_READ : +if (urb->actual_length <3 || urb->actual_length -3 < buf[2 ]) +break ;snd_usb_caiaq_midi_handle_input (cdev, buf[1 ], buf +3 , buf[2 ]);break ;case EP1_CMD_READ_IO :if (cdev->chip.usb_id ==USB_ID (USB_VID_NATIVEINSTRUMENTS ,USB_PID_AUDIO8DJ )) { -if (urb->actual_length >sizeof (cdev->control_state)) - urb->actual_length =sizeof (cdev->control_state); -memcpy (cdev->control_state, buf +1 , urb->actual_length); + copy_len = min_t(unsigned int, payload_len, sizeof(cdev->control_state)); +memcpy (cdev->control_state, buf +1 , copy_len);wake_up (&cdev->ep1_wait_queue);break ; }
sound/usb/caiaq/input.c +6 -0
@@ -203,6 +203,8 @@ static void snd_caiaq_input_read_analog(struct snd_usb_caiaqdev *cdev,switch (cdev->chip.usb_id) {case USB_ID (USB_VID_NATIVEINSTRUMENTS ,USB_PID_RIGKONTROL2 ): +if (len <6 ) +return ;snd_caiaq_input_report_abs (cdev,ABS_X , buf,2 );snd_caiaq_input_report_abs (cdev,ABS_Y , buf,0 );snd_caiaq_input_report_abs (cdev,ABS_Z , buf,1 );
@@ -210,11 +212,15 @@ static void snd_caiaq_input_read_analog(struct snd_usb_caiaqdev *cdev,case USB_ID (USB_VID_NATIVEINSTRUMENTS ,USB_PID_RIGKONTROL3 ):case USB_ID (USB_VID_NATIVEINSTRUMENTS ,USB_PID_KORECONTROLLER ):case USB_ID (USB_VID_NATIVEINSTRUMENTS ,USB_PID_KORECONTROLLER2 ): +if (len <6 ) +return ;snd_caiaq_input_report_abs (cdev,ABS_X , buf,0 );snd_caiaq_input_report_abs (cdev,ABS_Y , buf,1 );snd_caiaq_input_report_abs (cdev,ABS_Z , buf,2 );break ;case USB_ID (USB_VID_NATIVEINSTRUMENTS ,USB_PID_TRAKTORKONTROLX1 ): +if (len <16 ) +return ;snd_caiaq_input_report_abs (cdev,ABS_HAT0X , buf,4 );snd_caiaq_input_report_abs (cdev,ABS_HAT0Y , buf,2 );snd_caiaq_input_report_abs (cdev,ABS_HAT1X , buf,6 );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 492/1250 wifi: ralink: RT2X00: init EEPROM properly
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Corentin Labbe <[email protected]>
[ Upstream commit 0a2581cbae9e442835f68d22044157db61cdf54d ]
I have an hostapd setup with a
01:00.0 Network controller: Ralink corp. RT2790 Wireless 802.11n 1T/2R PCIe
The setup work fine on 6.18.26-gentoo
It breaks on 6.18.33-gentoo (and still broken on 6.18.37)
I found an hint in dmesg:
On 6.18.26-gentoo I see:
May 31 15:48:45 trash01 kernel: ieee80211 phy0: rt2x00_set_rf: Info - RF chipset 0003 detected On 6.18.33-gentoo I see: May 31 15:22:57 trash01 kernel: ieee80211 phy0: rt2x00_set_rf: Info - RF chipset 0006 detected
The RF chipset seems badly detected.
The problem was the EEPROM which was badly initialized.
Probably the origin was in some PCI change but unfortunately I couldn't play to bisect/reboot often the board with this card to do it.
--- drivers/net/wireless/ralink/rt2x00/rt2400pci.c | 2 +- drivers/net/wireless/ralink/rt2x00/rt2500pci.c | 2 +- drivers/net/wireless/ralink/rt2x00/rt2800pci.c | 2 +- drivers/net/wireless/ralink/rt2x00/rt61pci.c | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-)
drivers/net/wireless/ralink/rt2x00/rt2400pci.c +1 -1
@@ -1429,7 +1429,7 @@ static irqreturn_t rt2400pci_interrupt(int irq, void *dev_instance)*/ static int rt2400pci_validate_eeprom (struct rt2x00_dev *rt2x00dev) { -struct eeprom_93cx6 eeprom; +struct eeprom_93cx6 eeprom = {};u32 reg;u16 word;u8 *mac;
drivers/net/wireless/ralink/rt2x00/rt2500pci.c +1 -1
@@ -1555,7 +1555,7 @@ static irqreturn_t rt2500pci_interrupt(int irq, void *dev_instance)*/ static int rt2500pci_validate_eeprom (struct rt2x00_dev *rt2x00dev) { -struct eeprom_93cx6 eeprom; +struct eeprom_93cx6 eeprom = {};u32 reg;u16 word;u8 *mac;
drivers/net/wireless/ralink/rt2x00/rt2800pci.c +1 -1
@@ -108,7 +108,7 @@ static void rt2800pci_eepromregister_write(struct eeprom_93cx6 *eeprom)static int rt2800pci_read_eeprom_pci (struct rt2x00_dev *rt2x00dev) { -struct eeprom_93cx6 eeprom; +struct eeprom_93cx6 eeprom = {};u32 reg; reg =rt2x00mmio_register_read (rt2x00dev,E2PROM_CSR );
drivers/net/wireless/ralink/rt2x00/rt61pci.c +1 -1
@@ -2298,7 +2298,7 @@ static irqreturn_t rt61pci_interrupt(int irq, void *dev_instance)*/ static int rt61pci_validate_eeprom (struct rt2x00_dev *rt2x00dev) { -struct eeprom_93cx6 eeprom; +struct eeprom_93cx6 eeprom = {};u32 reg;u16 word;u8 *mac;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 493/1250 wifi: mac80211: validate deauth frame length before reason access
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Li <[email protected]>
[ Upstream commit 4a360c6e18dfa9d70006c7247a6a8cc8dfe0d60f ]
ieee80211_rx_mgmt_deauth() reads the deauth reason code before checking that the fixed field is actually present in the received frame.
Validate the deauth frame length first and only then read the reason code.
--- net/mac80211/mlme.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/mac80211/mlme.c +4 -2
@@ -5008,13 +5008,15 @@ static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata, struct ieee80211_mgmt *mgmt, size_t len) {struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; -u16 reason_code =le16_to_cpu (mgmt->u.deauth.reason_code); +u16 reason_code;lockdep_assert_wiphy (sdata->local->hw.wiphy); -if (len <24 +2 ) + if (len < offsetofend(struct ieee80211_mgmt, u.deauth.reason_code))return ; + reason_code =le16_to_cpu (mgmt->u.deauth.reason_code); +if (!ether_addr_equal (mgmt->bssid, mgmt->sa)) {ieee80211_tdls_handle_disconnect (sdata, mgmt->sa, reason_code);return ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 494/1250 wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit 843fe9bc583b7686ca68312ac9319c9240a73c03 ]
rsi_hal_load_key() copies tx_mic_key and rx_mic_key from data[16] and data[24] whenever key data is present. Those offsets are only part of the 32-byte TKIP key layout. Shorter keys used by other ciphers, such as CCMP, do not provide those bytes, so the unconditional copies can read past the supplied key buffer.
Only copy the MIC keys for TKIP, and reject malformed TKIP keys that are shorter than the expected 32-byte layout.
--- drivers/net/wireless/rsi/rsi_91x_mgmt.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/wireless/rsi/rsi_91x_mgmt.c +4 -2
@@ -848,8 +848,10 @@ int rsi_hal_load_key(struct rsi_common *common, }else {memcpy (&set_key->key[0 ][0 ], data, key_len); } -memcpy (set_key->tx_mic_key, &data[16 ],8 ); -memcpy (set_key->rx_mic_key, &data[24 ],8 ); +if (cipher ==WLAN_CIPHER_SUITE_TKIP ) { +memcpy (set_key->tx_mic_key, &data[16 ],8 ); +memcpy (set_key->rx_mic_key, &data[24 ],8 ); + } }else {memset (&set_key[FRAME_DESC_SZ ],0 , frame_len -FRAME_DESC_SZ ); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 495/1250 wifi: libertas: reject short monitor TX frames
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit 13ff543e0b2c713aedeaadadde686686e949dc78 ]
In monitor mode, lbs_hard_start_xmit() casts skb->data to a radiotap TX header, skips that header, and then copies the 802.11 destination address from offset 4 in the remaining frame. The generic length check only rejects zero-length and oversized skbs, so a short monitor frame can be read past the end of the skb data.
Require enough bytes for the radiotap TX header and the destination address field before using the monitor-mode header layout.
--- drivers/net/wireless/marvell/libertas/tx.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/net/wireless/marvell/libertas/tx.c +7 -0
@@ -117,6 +117,13 @@ netdev_tx_t lbs_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)if (priv->wdev->iftype ==NL80211_IFTYPE_MONITOR ) {struct tx_radiotap_hdr *rtap_hdr = (void *)skb->data; +if (skb->len <sizeof (*rtap_hdr) +4 +ETH_ALEN ) { +lbs_deb_tx ("tx err: short monitor frame %u\n" , skb->len); + dev->stats.tx_dropped++; + dev->stats.tx_errors++; + goto free; + } +/* set txpd fields from the radiotap header */ txpd->tx_control =cpu_to_le32 (convert_radiotap_rate_to_mv (rtap_hdr->rate));
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 496/1250 wifi: cfg80211: validate assoc response length before status and IE access
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Li <[email protected]>
[ Upstream commit b760113aeca2e9362d56bf9e9263373ffe6c8eb3 ]
cfg80211_rx_assoc_resp() initialises the status and response-IE fields of cfg80211_connect_resp_params from the management frame before proving that the frame is long enough for those offsets. S1G and regular association responses also have different IE offsets, but the S1G path only patched resp_ie after the unsafe initialiser had already run.
Defer resp_ie, resp_ie_len, and status to after the link-iteration loop. Use a bool to remember whether the frame is S1G, then validate the appropriate minimum length and set all three fields in a single if/else block. Funnel short-frame and SME-reject cleanup through a shared free_bss label for the abandon paths.
--- net/wireless/mlme.c | 56 ++++++++++++++++++++++++++++----------------- 1 file changed, 35 insertions(+), 21 deletions(-)
net/wireless/mlme.c +35 -21
@@ -32,14 +32,10 @@ void cfg80211_rx_assoc_resp(struct net_device *dev, .timeout_reason = NL80211_TIMEOUT_UNSPECIFIED, .req_ie = data->req_ies, .req_ie_len = data->req_ies_len, - .resp_ie = mgmt->u.assoc_resp.variable, - .resp_ie_len = data->len - - offsetof(struct ieee80211_mgmt , - u.assoc_resp.variable), - .status = le16_to_cpu(mgmt->u.assoc_resp.status_code), .ap_mld_addr = data->ap_mld_addr, };unsigned int link_id; +bool is_s1g = false;for (link_id =0 ; link_id <ARRAY_SIZE (data->links); link_id++) { cr.links[link_id].status = data->links[link_id].status;
@@ -60,16 +56,32 @@ void cfg80211_rx_assoc_resp(struct net_device *dev,if (cr.links[link_id].bss->channel->band ==NL80211_BAND_S1GHZ ) {WARN_ON (link_id); - cr.resp_ie = (u8 *)&mgmt->u.s1g_assoc_resp.variable; - cr.resp_ie_len = data->len - - offsetof(struct ieee80211_mgmt , - u.s1g_assoc_resp.variable); + is_s1g = true; }if (cr.ap_mld_addr) cr.valid_links |=BIT (link_id); } +if (is_s1g) { +if (data->len < offsetof(struct ieee80211_mgmt , + u.s1g_assoc_resp.variable)) + goto free_bss; + cr.resp_ie = (u8 *)&mgmt->u.s1g_assoc_resp.variable; + cr.resp_ie_len = data->len - + offsetof(struct ieee80211_mgmt , + u.s1g_assoc_resp.variable); + }else { +if (data->len < offsetof(struct ieee80211_mgmt , + u.assoc_resp.variable)) + goto free_bss; + cr.resp_ie = mgmt->u.assoc_resp.variable; + cr.resp_ie_len = data->len - + offsetof(struct ieee80211_mgmt , + u.assoc_resp.variable); + } + cr.status =le16_to_cpu (mgmt->u.assoc_resp.status_code); +trace_cfg80211_send_rx_assoc (dev, data);/*
@@ -78,22 +90,24 @@ void cfg80211_rx_assoc_resp(struct net_device *dev,* and got a reject -- we only try again with an assoc * frame instead of reassoc. */ -if (cfg80211_sme_rx_assoc_resp (wdev, cr.status)) { -for (link_id =0 ; link_id <ARRAY_SIZE (data->links); link_id++) { -struct cfg80211_bss *bss = data->links[link_id].bss; - -if (!bss) -continue ; - -cfg80211_unhold_bss (bss_from_pub (bss)); -cfg80211_put_bss (wiphy, bss); - } -return ; - } +if (cfg80211_sme_rx_assoc_resp (wdev, cr.status)) + goto free_bss;nl80211_send_rx_assoc (rdev, dev, data);/* update current_bss etc., consumes the bss reference */ __cfg80211_connect_result (dev, &cr, cr.status ==WLAN_STATUS_SUCCESS ); +return ; + +free_bss: +for (link_id =0 ; link_id <ARRAY_SIZE (data->links); link_id++) { +struct cfg80211_bss *bss = data->links[link_id].bss; + +if (!bss) +continue ; + +cfg80211_unhold_bss (bss_from_pub (bss)); +cfg80211_put_bss (wiphy, bss); + } }EXPORT_SYMBOL (cfg80211_rx_assoc_resp);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 497/1250 ksmbd: find bound sessions during reauthentication
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
[ Upstream commit faf8578c77f3d846aca9cd882c293e03eafcc6df ]
A session bound to an additional connection is stored in the session channel list, but it is not added to that connection's local session table. After the binding exchange completes, conn->binding is cleared.
A later SESSION_SETUP reauthentication on the bound channel only searches the local session table. It fails to find the session and returns STATUS_USER_SESSION_DELETED instead of processing authentication and returning STATUS_LOGON_FAILURE for invalid credentials.
If the local lookup fails, look up the session globally and accept it only when the current connection is registered in its channel list. This keeps unbound connections from using the session while allowing reauthentication on an established channel.
This fixes smb2.session.bind_invalid_auth.
--- fs/smb/server/smb2pdu.c | 7 +++++++ 1 file changed, 7 insertions(+)
fs/smb/server/smb2pdu.c +7 -0
@@ -1795,6 +1795,13 @@ int smb2_sess_setup(struct ksmbd_work *work) }else { sess =ksmbd_session_lookup (conn,le64_to_cpu (req->hdr.SessionId)); +if (!sess) { + sess =ksmbd_session_lookup_slowpath (le64_to_cpu (req->hdr.SessionId)); +if (sess && !lookup_chann_list (sess, conn)) { +ksmbd_user_session_put (sess); + sess =NULL ; + } + }if (!sess) { rc = -ENOENT ; goto out_err;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 498/1250 ksmbd: mark invalid session responses as signed
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
[ Upstream commit 9e8ad620ddfde5a5f4ef58372e3805e9388cb0f4 ]
When a signed request uses a session that is not registered on the connection, ksmbd returns STATUS_USER_SESSION_DELETED before reaching the normal response signing path. The response therefore lacks SMB2_FLAGS_SIGNED.
Clients that require signing check this flag before handling STATUS_USER_SESSION_DELETED and replace the server status with STATUS_ACCESS_DENIED when it is absent. The protocol permits this error response to skip signature verification because the connection has no matching session key.
Preserve SMB2_FLAGS_SIGNED on the early error response when the request was signed. This lets the client propagate STATUS_USER_SESSION_DELETED. It fixes smb2.session.bind2.
--- fs/smb/server/server.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/smb/server/server.c +6 -0
@@ -197,6 +197,12 @@ static void __handle_ksmbd_work(struct ksmbd_work *work,else conn->ops->set_rsp_status (work,STATUS_USER_SESSION_DELETED ); +if (conn->ops->is_sign_req (work, conn->ops->get_cmd_val (work))) { +struct smb2_hdr *rsp_hdr; + + rsp_hdr =ksmbd_resp_buf_curr (work); + rsp_hdr->Flags |=SMB2_FLAGS_SIGNED ; + } goto send; }else if (rc >0 ) { rc = conn->ops->get_ksmbd_tcon (work);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 499/1250 ksmbd: validate SID namespace before mapping IDs
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
[ Upstream commit fbe0bb2b75eb3c61e8464486506253d1b471240b ]
sid_to_id() currently treats the last subauthority of any owner or group SID as a Unix uid or gid. For example, this maps Everyone (S-1-1-0) to uid 0 and BUILTIN\Users (S-1-5-32-545) to gid 545.
When an SMB2 CREATE security descriptor contains those SIDs, ksmbd attempts to change the newly created file to the bogus Unix ownership. notify_change() then returns -EPERM, which makes smb2.create.aclfile fail with NT_STATUS_SHARING_VIOLATION.
Validate the SID prefix before extracting its RID. Only server-domain owner SIDs and S-1-22-2 Unix group SIDs have local ID representations. Treat other valid Windows SIDs as unmapped so their original values can still be preserved in the NT ACL xattr.
--- fs/smb/server/smbacl.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-)
fs/smb/server/smbacl.c +17 -4
@@ -258,6 +258,7 @@ static int sid_to_id(struct mnt_idmap *idmap, struct smb_sid *psid, uint sidtype, struct smb_fattr *fattr) { + const struct smb_sid *sid_prefix;int rc = -EINVAL ;/*
@@ -279,6 +280,12 @@ static int sid_to_id(struct mnt_idmap *idmap,kuid_t uid;uid_t id; +/* Only the server domain RID has a local uid representation. */ + sid_prefix = &server_conf.domain_sid; +if (psid->num_subauth != sid_prefix->num_subauth +1 || +compare_sids (psid, sid_prefix)) +return -EINVAL ; + id =le32_to_cpu (psid->sub_auth[psid->num_subauth -1 ]); uid =KUIDT_INIT (id); uid =from_vfsuid (idmap, &init_user_ns,VFSUIDT_INIT (uid));
@@ -290,6 +297,12 @@ static int sid_to_id(struct mnt_idmap *idmap,kgid_t gid;gid_t id; +/* Local gids are represented by S-1-22-2-<gid>. */ + sid_prefix = &sid_unix_groups; +if (psid->num_subauth != sid_prefix->num_subauth +1 || +compare_sids (psid, sid_prefix)) +return -EINVAL ; + id =le32_to_cpu (psid->sub_auth[psid->num_subauth -1 ]); gid =KGIDT_INIT (id); gid =from_vfsgid (idmap, &init_user_ns,VFSGIDT_INIT (gid));
@@ -916,9 +929,9 @@ int parse_sec_desc(struct mnt_idmap *idmap, struct smb_ntsd *pntsd, rc =sid_to_id (idmap, owner_sid_ptr,SIDOWNER , fattr);if (rc) { -pr_err ("%s: Error %d mapping Owner SID to uid\n" , - __func__, rc); +ksmbd_debug (SMB ,"Owner SID has no Unix uid mapping\n" ); owner_sid_ptr =NULL ; + rc =0 ; } }
@@ -934,9 +947,9 @@ int parse_sec_desc(struct mnt_idmap *idmap, struct smb_ntsd *pntsd, } rc =sid_to_id (idmap, group_sid_ptr,SIDUNIX_GROUP , fattr);if (rc) { -pr_err ("%s: Error %d mapping Group SID to gid\n" , - __func__, rc); +ksmbd_debug (SMB ,"Group SID has no Unix gid mapping\n" ); group_sid_ptr =NULL ; + rc =0 ; } }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 500/1250 wifi: cfg80211: validate rx/tx MLME callback frame lengths before access
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Li <[email protected]>
[ Upstream commit d5e4586546974179feca305a94e07fac3e9727fe ]
cfg80211_rx_mlme_mgmt() and cfg80211_tx_mlme_mgmt() call tracepoints before rejecting frames shorter than the frame-control field. After that, they only require len >= 2 before dispatching into subtype handlers that assume their fixed fields are present.
The frames that trip this are not shorter than 2 bytes; they are short relative to their subtype. mwifiex is a concrete in-tree example on the length side: mwifiex_process_mgmt_packet() only requires a 4-address ieee80211_hdr plus the 2-byte firmware length prefix before handing the frame to cfg80211_rx_mlme_mgmt(). After stripping the length prefix and removing addr4, pkt_len can be exactly 24: a bare 3-address management header with no reason-code body. The existing WARN_ON(len < 2) does not fire on such a frame, and cfg80211_process_deauth() then reads u.deauth.reason_code as a two-byte access starting at offset 24, immediately past the 24-byte buffer.
Add a frame-control length gate, then validate each subtype's minimum frame size in an if/else-if chain that mirrors the dispatch logic. Trace only after the frame is known to be well-formed.
Side effects of this change:
- The WARN_ON(len < 2) is dropped. It only guarded the frame_control read, never the subtype fixed fields, and it does not fire on the frames that actually trigger the out-of-bounds read (which are >= 2). The len >= 2 check is kept as the guard before dereferencing frame_control, but without the warning: these are exported callbacks and a malformed frame from a driver should be dropped silently rather than backtraced.
- cfg80211_tx_mlme_mgmt() previously routed every non-deauth subtype through disassociation handling; it now silently ignores unrecognised subtypes.
--- net/wireless/mlme.c | 45 +++++++++++++++++++++++++++++++++++++-------- 1 file changed, 37 insertions(+), 8 deletions(-)
net/wireless/mlme.c +37 -8
@@ -164,19 +164,35 @@ void cfg80211_rx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len) {struct wireless_dev *wdev = dev->ieee80211_ptr;struct ieee80211_mgmt *mgmt = (void *)buf; +__le16 fc;lockdep_assert_wiphy (wdev->wiphy); -trace_cfg80211_rx_mlme_mgmt (dev, buf, len); +if (len <sizeof (fc)) +return ; + + fc = mgmt->frame_control; -if (WARN_ON (len <2 )) +if (ieee80211_is_auth (fc)) { + if (len < offsetofend(struct ieee80211_mgmt, u.auth.status_code)) +return ; + }else if (ieee80211_is_deauth (fc)) { + if (len < offsetofend(struct ieee80211_mgmt, u.deauth.reason_code)) +return ; + }else if (ieee80211_is_disassoc (fc)) { + if (len < offsetofend(struct ieee80211_mgmt, u.disassoc.reason_code)) +return ; + }else {return ; + } + +trace_cfg80211_rx_mlme_mgmt (dev, buf, len); -if (ieee80211_is_auth (mgmt->frame_control)) +if (ieee80211_is_auth (fc))cfg80211_process_auth (wdev, buf, len); -else if (ieee80211_is_deauth (mgmt->frame_control)) +else if (ieee80211_is_deauth (fc))cfg80211_process_deauth (wdev, buf, len, false); -else if (ieee80211_is_disassoc (mgmt->frame_control)) +else cfg80211_process_disassoc (wdev, buf, len, false); }EXPORT_SYMBOL (cfg80211_rx_mlme_mgmt);
@@ -229,15 +245,28 @@ void cfg80211_tx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len, {struct wireless_dev *wdev = dev->ieee80211_ptr;struct ieee80211_mgmt *mgmt = (void *)buf; +__le16 fc;lockdep_assert_wiphy (wdev->wiphy); -trace_cfg80211_tx_mlme_mgmt (dev, buf, len, reconnect); +if (len <sizeof (fc)) +return ; -if (WARN_ON (len <2 )) + fc = mgmt->frame_control; + +if (ieee80211_is_deauth (fc)) { + if (len < offsetofend(struct ieee80211_mgmt, u.deauth.reason_code)) +return ; + }else if (ieee80211_is_disassoc (fc)) { + if (len < offsetofend(struct ieee80211_mgmt, u.disassoc.reason_code)) +return ; + }else {return ; + } + +trace_cfg80211_tx_mlme_mgmt (dev, buf, len, reconnect); -if (ieee80211_is_deauth (mgmt->frame_control)) +if (ieee80211_is_deauth (fc))cfg80211_process_deauth (wdev, buf, len, reconnect);else cfg80211_process_disassoc (wdev, buf, len, reconnect);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 501/1250 wifi: mac80211: ibss: wait for in-flight TX on disconnect
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pagadala Yesu Anjaneyulu <[email protected]>
[ Upstream commit d0e69d9afa59b93c30294eba89b1f15f69e91105 ]
While leaving an IBSS in ieee80211_ibss_disconnect() mac80211 flushes stations, turns the carrier off and immediately tells the driver to leave as well. While there may be synchronize_net() in station flush and in this code later, packets can still be transmitted due to cross-CPU race conditions after carrier off is set. Therefore, it's possible for a race to happen where a TX to the driver occurs while or after telling it to leave the IBSS. This can be confusing to drivers, and in the case of iwlwifi leads to an attempt to use invalid queues.
Move netif_carrier_off() to occur before sta_info_flush() during IBSS disconnect, and add synchronize_net() if flushing didn't, so that the synchronize_net() always happens between turning the carrier off and telling the driver, avoiding this race.
--- net/mac80211/ibss.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
net/mac80211/ibss.c +3 -6
@@ -675,7 +675,9 @@ static void ieee80211_ibss_disconnect(struct ieee80211_sub_if_data *sdata) ifibss->state =IEEE80211_IBSS_MLME_SEARCH ; -sta_info_flush (sdata,-1 ); +netif_carrier_off (sdata->dev); +if (!sta_info_flush (sdata,-1 )) +synchronize_net ();spin_lock_bh (&ifibss->incomplete_lock);while (!list_empty (&ifibss->incomplete_stations)) {
@@ -689,8 +691,6 @@ static void ieee80211_ibss_disconnect(struct ieee80211_sub_if_data *sdata) }spin_unlock_bh (&ifibss->incomplete_lock); -netif_carrier_off (sdata->dev); - sdata->vif.cfg.ibss_joined = false; sdata->vif.cfg.ibss_creator = false; sdata->vif.bss_conf.enable_beacon = false;
@@ -717,7 +717,6 @@ static void ieee80211_csa_connection_drop_work(struct wiphy *wiphy, u.ibss.csa_connection_drop_work);ieee80211_ibss_disconnect (sdata); -synchronize_rcu ();skb_queue_purge (&sdata->skb_queue);/* trigger a scan to find another IBSS network to join */
@@ -1823,8 +1822,6 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)memset (&ifibss->ht_capa,0 ,sizeof (ifibss->ht_capa));memset (&ifibss->ht_capa_mask,0 ,sizeof (ifibss->ht_capa_mask)); -synchronize_rcu (); -skb_queue_purge (&sdata->skb_queue);timer_delete_sync (&sdata->u.ibss.timer);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 502/1250 gpio: dwapb: Mask interrupts at hardware initialization
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liang Hao <[email protected]>
[ Upstream commit aaf7766ba3b99a3834319e7cf939838afc705574 ]
GPIO interrupts may retain stale state across warm reboots when peripherals remain powered. If a GPIO line is not explicitly configured for interrupts, this can result in interrupt storms due to missing handlers.
Fix this by ensuring all interrupts are masked and disabled at hardware initialization time via the init_hw() callback. Pending interrupts are also cleared to start from a known-safe state.
Interrupts will be unmasked only when explicitly configured by userspace or kernel drivers.
--- drivers/gpio/gpio-dwapb.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
drivers/gpio/gpio-dwapb.c +17 -0
@@ -201,6 +201,22 @@ static void dwapb_toggle_trigger(struct dwapb_gpio *gpio, unsigned int offs)dwapb_write (gpio,GPIO_INT_POLARITY , pol); } +static int dwapb_irq_init_hw (struct gpio_chip *gc) +{ +struct dwapb_gpio *gpio =to_dwapb_gpio (gc); + +/* +* GPIO interrupts may retain stale state across warm reboots when +* peripherals stay powered. Force a known-safe state before the GPIO +* irqchip and irq domain are set up. +*/ +dwapb_write (gpio,GPIO_INTEN ,0 ); +dwapb_write (gpio,GPIO_INTMASK ,0xffffffff ); +dwapb_write (gpio,GPIO_PORTA_EOI ,0xffffffff ); + +return 0 ; +} +static u32 dwapb_do_irq (struct dwapb_gpio *gpio) {struct gpio_generic_chip *gen_gc = &gpio->ports[0 ].chip;
@@ -472,6 +488,7 @@ static void dwapb_configure_irqs(struct dwapb_gpio *gpio, girq = &gc->irq; girq->handler = handle_bad_irq; girq->default_type =IRQ_TYPE_NONE ; + girq->init_hw = dwapb_irq_init_hw; port->pirq = pirq;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 503/1250 wifi: libipw: fix key index receive bound checks
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit 74ed3669f26803b1761c1f55403062bea44c3466 ]
libipw_rx() reads skb->data[hdrlen + 3] to extract the WEP key index in both the software-decrypt key selection path and the hardware-decrypted IV/ICV strip path. In both places the existing guard only checks skb->len >= hdrlen + 3, which proves bytes up to hdrlen + 2 but not the byte at hdrlen + 3.
Require hdrlen + 4 bytes before reading that item in both paths. This is a local source-boundary check only; it does not change the key index semantics.
--- drivers/net/wireless/intel/ipw2x00/libipw_rx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/intel/ipw2x00/libipw_rx.c +2 -2
@@ -414,7 +414,7 @@ int libipw_rx(struct libipw_device *ieee, struct sk_buff *skb, ieee->host_mc_decrypt : ieee->host_decrypt;if (can_be_decrypted) { -if (skb->len >= hdrlen +3 ) { +if (skb->len >= hdrlen +4 ) {/* Top two-bits of byte 3 are the key index */ keyidx = skb->data[hdrlen +3 ] >>6 ; }
@@ -660,7 +660,7 @@ int libipw_rx(struct libipw_device *ieee, struct sk_buff *skb,int trimlen =0 ;/* Top two-bits of byte 3 are the key index */ -if (skb->len >= hdrlen +3 ) +if (skb->len >= hdrlen +4 ) keyidx = skb->data[hdrlen +3 ] >>6 ;/* To strip off any security data which appears before the
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 504/1250 netfilter: ipset: mark the rcu locked areas properly
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jozsef Kadlecsik <[email protected]>
[ Upstream commit 5d0c22e73656d050daffad10a2ba8765ce8441c8 ]
When we bump the uref counter, there's no need to keep the rcu lock because the referred hash table can't disappear. Also, from the same reason in mtype_gc we need the rcu lock and not a spinlock.
--- net/netfilter/ipset/ip_set_hash_gen.h | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-)
net/netfilter/ipset/ip_set_hash_gen.h +5 -8
@@ -569,9 +569,10 @@ mtype_gc(struct work_struct *work) set = gc->set; h = set->data; -spin_lock_bh (&set->lock); - t =ipset_dereference_set (h->table, set); +rcu_read_lock_bh (); + t =rcu_dereference_bh (h->table);atomic_inc (&t->uref); +rcu_read_unlock_bh (); numof_locks =ahash_numof_locks (t->htable_bits); r = gc->region++;if (r >= numof_locks) {
@@ -580,7 +581,6 @@ mtype_gc(struct work_struct *work) next_run = (IPSET_GC_PERIOD (set->timeout) *HZ ) / numof_locks;if (next_run <HZ /10 ) next_run =HZ /10 ; -spin_unlock_bh (&set->lock);mtype_gc_do (set, h, t, r);
@@ -860,15 +860,13 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext, key =HKEY (value, h->initval, t->htable_bits); r =ahash_region (key);atomic_inc (&t->uref); +rcu_read_unlock_bh (); elements = t->hregion[r].elements; maxelem = t->maxelem;if (elements >= maxelem) {u32 e; -if (SET_WITH_TIMEOUT (set)) { -rcu_read_unlock_bh (); +if (SET_WITH_TIMEOUT (set))mtype_gc_do (set, h, t, r); -rcu_read_lock_bh (); - } maxelem = h->maxelem; elements =0 ;for (e =0 ; e <ahash_numof_locks (t->htable_bits); e++)
@@ -876,7 +874,6 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext,if (elements >= maxelem &&SET_WITH_FORCEADD (set)) forceadd = true; } -rcu_read_unlock_bh ();spin_lock_bh (&t->hregion[r].lock); n =rcu_dereference_bh (hbucket (t, key));
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 505/1250 wifi: rsi: validate beacon length before fixed buffer copy
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit 8ecdeb8b8a33b22c597299043c0dcfce50beb9ea ]
rsi_prepare_beacon() copies the mac80211 beacon frame after FRAME_DESC_SZ into a management skb whose usable tailroom may be smaller than MAX_MGMT_PKT_SIZE after alignment.
Validate the beacon length against the actual tailroom before the copy and skb_put(). Leave ownership of the management skb with the caller on error, matching the existing rsi_send_beacon() cleanup path.
--- drivers/net/wireless/rsi/rsi_91x_hal.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/net/wireless/rsi/rsi_91x_hal.c +8 -0
@@ -431,6 +431,7 @@ int rsi_prepare_beacon(struct rsi_common *common, struct sk_buff *skb)struct ieee80211_vif *vif;struct sk_buff *mac_bcn;u8 vap_id =0 , i; +unsigned int tailroom;u16 tim_offset =0 ;for (i =0 ; i <RSI_MAX_VIFS ; i++) {
@@ -480,6 +481,13 @@ int rsi_prepare_beacon(struct rsi_common *common, struct sk_buff *skb)if (mac_bcn->data[tim_offset +2 ] ==0 ) bcn_frm->frame_info |=cpu_to_le16 (RSI_DATA_DESC_DTIM_BEACON ); + tailroom =skb_tailroom (skb); +if (tailroom <FRAME_DESC_SZ || + mac_bcn->len > tailroom -FRAME_DESC_SZ ) { +dev_kfree_skb (mac_bcn); +return -EMSGSIZE ; + } +memcpy (&skb->data[FRAME_DESC_SZ ], mac_bcn->data, mac_bcn->len);skb_put (skb, mac_bcn->len +FRAME_DESC_SZ );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 506/1250 ASoC: rt712-sdca: reset codec at io_init to fix silent headphone
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tianze Shao <[email protected]>
[ Upstream commit 4c9854ad3cdc7ce408453207f153bb910cc6f3c1 ]
On ThinkPad X1 Carbon Gen 13 (Lunar Lake, RT712-SDCA version VA) the 3.5mm headphone jack is silent after rebooting from Windows. rt712_sdca_va_io_init() gates rt712_sdca_calibration() on the persisted vendor SW_CONFIG1 flag, and io_init writes SW_CONFIG1=1 at the end regardless of whether the calibration succeeded. Across a warm reboot the codec keeps power, so SW_CONFIG1 stays unchanged, the calibration may be skipped, and the retained state can be invalid, leaving the headphone amp disabled.
This patch mimics the reset sequence in rt711-sdca.c, it adds an rt712_sdca_reset() helper, and calls it from io_init so the codec is reset before initialization. RT712_PARA_VERB_CTL, RT712_HIDDEN_REG_SW_RESET and RT712_HDA_LEGACY_RESET_CTL are already defined but were unused. The reset clears SW_CONFIG1 and the analog state so rt712_sdca_calibration() runs from a clean state and completes.
Problem reproducible: boot Windows (headphone is good) -> reboot to Linux (silent).
The reproducibility may depend on Windows' behaviour.
--- sound/soc/codecs/rt712-sdca.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
sound/soc/codecs/rt712-sdca.c +11 -0
@@ -1849,6 +1849,15 @@ static void rt712_sdca_vb_io_init(struct rt712_sdca_priv *rt712) } } +static void rt712_sdca_reset (struct rt712_sdca_priv *rt712) +{ +rt712_sdca_index_update_bits (rt712,RT712_VENDOR_REG , +RT712_PARA_VERB_CTL ,RT712_HIDDEN_REG_SW_RESET , +RT712_HIDDEN_REG_SW_RESET ); +rt712_sdca_index_update_bits (rt712,RT712_VENDOR_HDA_CTL , +RT712_HDA_LEGACY_RESET_CTL ,0x1 ,0x1 ); +} +int rt712_sdca_io_init (struct device *dev,struct sdw_slave *slave) {struct rt712_sdca_priv *rt712 =dev_get_drvdata (dev);
@@ -1876,6 +1885,8 @@ int rt712_sdca_io_init(struct device *dev, struct sdw_slave *slave)pm_runtime_get_noresume (&slave->dev); +rt712_sdca_reset (rt712); +rt712_sdca_index_read (rt712,RT712_VENDOR_REG ,RT712_JD_PRODUCT_NUM , &val); rt712->hw_id = (val &0xf000 ) >>12 ; rt712->version_id = (val &0x0f00 ) >>8 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 507/1250 cifs: Fix support for creating SFU socket
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pali Rohár <[email protected]>
[ Upstream commit dde3929e8d901ae9a7c29d0577ce9ca5cb4db35d ]
SFU sockets are natively supported by Interix 3.0 subsystem and also by later versions. It is part of Microsoft SFU (Windows Services for UNIX) and Microsoft SUA (Subsystem for UNIX-based Applications). They can be created and existing (stored on local disk or remote SMB share) can be recognized.
SFU sockets are recognized also by NFS server included in Windows Server. Windows NFS server versions since Windows Server 2012 uses new reparse point format for storing new sockets, but still can recognize this old format (also in the latest Windows Server 2022 version).
SFU-style socket is a regular file which has system attribute set and content of the file is one zero byte.
These SFU-style sockets are already recognized by Linux SMB client.
But Linux SMB client is currently creating new SFU socket in different format which is not compatible with all those SFU applications. Fix this by creating new sockets in correct SFU format which would be recognized by all SFU, SUA, NFS and existing Linux SMB clients.
This change affects only creating new sockets when mount option -o sfu is used.
--- fs/smb/client/smb2ops.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
fs/smb/client/smb2ops.c +3 -4
@@ -5345,10 +5345,9 @@ int __cifs_sfu_make_node(unsigned int xid, struct inode *inode, data = (u8 *)symname_utf16;break ;case S_IFSOCK : - type_len =8 ; -strscpy (type,"LnxSOCK" ); - data = (u8 *)&pdev; - data_len =sizeof (pdev); +/* SFU socket is system file with one zero byte */ + type_len =1 ; + type[0 ] ='\0' ;break ;case S_IFIFO : type_len =8 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 508/1250 smb/client: zero-initialize stack-allocated cifs_open_info_data
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: ChenXiaoSong <[email protected]>
[ Upstream commit 8fce4cf4369c766a3293a05419500cbfde72e60d ]
Stack-allocated cifs_open_info_data may contain random data. This can make some fields have wrong value if they are not set later.
--- fs/smb/client/link.c | 2 +- fs/smb/client/smb1ops.c | 2 +- fs/smb/client/smb2ops.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-)
fs/smb/client/link.c +1 -1
@@ -234,7 +234,7 @@ cifs_query_mf_symlink(unsigned int xid, struct cifs_tcon *tcon,struct cifs_open_parms oparms;struct cifs_io_parms io_parms = {0 };int buf_type =CIFS_NO_BUFFER ; -struct cifs_open_info_data query_data; +struct cifs_open_info_data query_data = {}; oparms = (struct cifs_open_parms ) { .tcon = tcon,
fs/smb/client/smb1ops.c +1 -1
@@ -791,7 +791,7 @@ smb_set_file_info(struct inode *inode, const char *full_path,struct cifs_open_parms oparms;struct cifsFileInfo *open_file;FILE_BASIC_INFO new_buf; -struct cifs_open_info_data query_data; +struct cifs_open_info_data query_data = {};__le64 write_time = buf->LastWriteTime;struct cifsInodeInfo *cinode =CIFS_I (inode);struct cifs_sb_info *cifs_sb =CIFS_SB (inode->i_sb);
fs/smb/client/smb2ops.c +1 -1
@@ -5296,7 +5296,7 @@ int __cifs_sfu_make_node(unsigned int xid, struct inode *inode, {struct TCP_Server_Info *server = tcon->ses->server;struct cifs_open_parms oparms; -struct cifs_open_info_data idata; +struct cifs_open_info_data idata = {};struct cifs_io_parms io_parms = {};struct cifs_sb_info *cifs_sb =CIFS_SB (inode->i_sb);struct cifs_fid fid;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 509/1250 ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Bowen <[email protected]>
[ Upstream commit 9064637fb2a80b43105900a47d414997630e5b6b ]
The internal speakers on the MECHREVO WUJIE Series are silent, while the headphone output works correctly.
The BIOS reports NID 0x1b on the Realtek ALC233 codec as unconnected with pin configuration 0x411111f0. However, the pin is connected to an internal speaker.
Overriding NID 0x1b with 0x90170150 makes the HDA generic parser detect both 0x14 and 0x1b as speaker outputs and restores internal speaker playback.
Add a pin configuration fixup for the affected PCI SSID c011:1d05.
Tested on a MECHREVO WUJIE Series laptop with board WUJIE Series-Lark4-LNL and firmware EM_LNL326_V1.0.23.
--- sound/hda/codecs/realtek/alc269.c | 9 +++++++++ 1 file changed, 9 insertions(+)
sound/hda/codecs/realtek/alc269.c +9 -0
@@ -3782,6 +3782,7 @@ enum {ALC275_FIXUP_DELL_XPS ,ALC293_FIXUP_LENOVO_SPK_NOISE ,ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY , +ALC233_FIXUP_WUJIE_SPEAKERS ,ALC233_FIXUP_LENOVO_L2MH_LOW_ENLED ,ALC255_FIXUP_DELL_SPK_NOISE , ALC225_FIXUP_DISABLE_MIC_VREF,
@@ -4032,6 +4033,13 @@ static void alc287_fixup_lenovo_yoga_book_9i(struct hda_codec *codec, }static const struct hda_fixup alc269_fixups[] = { + [ALC233_FIXUP_WUJIE_SPEAKERS ] = { + .type =HDA_FIXUP_PINS , + .v.pins = (const struct hda_pintbl []) { + {0x1b ,0x90170150 },/* internal speaker */ + { } + }, + }, [ALC269_FIXUP_GPIO2 ] = { .type =HDA_FIXUP_FUNC , .v.func = alc_fixup_gpio2,
@@ -7605,6 +7613,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x8086 ,0x2080 ,"Intel NUC 8 Rugged" ,ALC256_FIXUP_INTEL_NUC8_RUGGED ),SND_PCI_QUIRK (0x8086 ,0x2081 ,"Intel NUC 10" ,ALC256_FIXUP_INTEL_NUC10 ),SND_PCI_QUIRK (0x8086 ,0x3038 ,"Intel NUC 13" ,ALC295_FIXUP_CHROME_BOOK ), +SND_PCI_QUIRK (0xc011 ,0x1d05 ,"MECHREVO WUJIE Series" ,ALC233_FIXUP_WUJIE_SPEAKERS ),SND_PCI_QUIRK (0xf111 ,0x0001 ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0xf111 ,0x0006 ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ), SND_PCI_QUIRK(0xf111, 0x0009, "Framework Laptop", ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE),
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 510/1250 ALSA: hda/realtek - Add quirk for HP Victus 15-fa0xxx (MB 8A50)
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rohit Sinha <[email protected]>
[ Upstream commit 5c3f4b583c25911fad9890b463632761291f65ab ]
The mute LED on HP Victus 15-fa0xxx (board ID 8A50) uses ALC245 but requires a quirk to work. This patch enables the existing ALC245_FIXUP_HP_MUTE_LED_COEFBIT quirk for the device.
Tested on my HP Victus 15-fa0xxx. The LED behaviour works as intended.
--- sound/hda/codecs/realtek/alc269.c | 1 + 1 file changed, 1 insertion(+)
sound/hda/codecs/realtek/alc269.c +1 -0
@@ -6868,6 +6868,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x103c ,0x8a34 ,"HP Pavilion x360 2-in-1 Laptop 14-ek0xxx" ,ALC245_FIXUP_HP_MUTE_LED_COEFBIT ),SND_PCI_QUIRK (0x103c ,0x8a3d ,"HP Victus 15-fb0xxx (MB 8A3D)" ,ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT ),SND_PCI_QUIRK (0x103c ,0x8a4f ,"HP Victus 15-fa0xxx (MB 8A4F)" ,ALC245_FIXUP_HP_MUTE_LED_COEFBIT ), +SND_PCI_QUIRK (0x103c ,0x8a50 ,"HP Victus 15-fa0xxx (MB 8A50)" ,ALC245_FIXUP_HP_MUTE_LED_COEFBIT ),SND_PCI_QUIRK (0x103c ,0x8a6e ,"HP EDNA 360" ,ALC287_FIXUP_CS35L41_I2C_4 ),SND_PCI_QUIRK (0x103c ,0x8a74 ,"HP ProBook 440 G8 Notebook PC" ,ALC236_FIXUP_HP_GPIO_LED ), SND_PCI_QUIRK(0x103c, 0x8a75, "HP ProBook 450 G8 Notebook PC", ALC236_FIXUP_HP_GPIO_LED),
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 511/1250 ALSA: hda: cs35l56: Fail if wmfw file is missing
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <[email protected]>
[ Upstream commit 07ae060d35900977a93d4a05ec995b06c85c2552 ]
Fail cs35l56_hda_fw_load() and log an error if it didn't find a wmfw file and the BIOS didn't patch the firmware already. Also remove a section of code from cs35l56_hda_request_firmware_files() that attempted to find a .bin if a .wmfw was not found.
The CS35L56 ROM can only provide default audio in SoundWire mode. A wmfw is needed to enable I2S audio. Also none of the customer-specific .bin files are compatible with the ROM firmware. So a .wmfw file is always required.
--- sound/hda/codecs/side-codecs/cs35l56_hda.c | 30 +++++++--------------- 1 file changed, 9 insertions(+), 21 deletions(-)
sound/hda/codecs/side-codecs/cs35l56_hda.c +9 -21
@@ -516,20 +516,6 @@ static void cs35l56_hda_request_firmware_files(struct cs35l56_hda *cs35l56, NULL, "bin");return ; } - -/* -* Check for system-specific bin files without wmfw before -* falling back to generic firmware -*/ -if (amp_name) -cs35l56_hda_request_firmware_file (cs35l56, coeff_firmware, coeff_filename, - base_name, system_name, amp_name,"bin" ); -if (!*coeff_firmware) -cs35l56_hda_request_firmware_file (cs35l56, coeff_firmware, coeff_filename, - base_name, system_name,NULL ,"bin" ); - -if (*coeff_firmware) -return ; } ret = cs35l56_hda_request_firmware_file(cs35l56, wmfw_firmware, wmfw_filename,
@@ -615,13 +601,15 @@ static void cs35l56_hda_fw_load(struct cs35l56_hda *cs35l56) &wmfw_firmware, &wmfw_filename, &coeff_firmware, &coeff_filename); -/* -* If the BIOS didn't patch the firmware a bin file is mandatory to -* enable the ASP· -*/ -if (!coeff_firmware && firmware_missing) { -dev_err (cs35l56->base.dev,".bin file required but not found\n" ); - goto err_fw_release; +/* If the BIOS didn't patch the firmware a wmfw and bin file are mandatory */ +if (firmware_missing) { +if (!wmfw_firmware) { +dev_err (cs35l56->base.dev,".%s file required but not found\n" ,"wmfw" ); + goto err_fw_release; + }else if (!coeff_firmware) { +dev_err (cs35l56->base.dev,".%s file required but not found\n" ,"bin" ); + goto err_fw_release; + } }mutex_lock (&cs35l56->base.irq_lock);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 512/1250 cifs: Fix support for creating SFU fifo
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pali Rohár <[email protected]>
[ Upstream commit 608362facd2d0f2667f68b7f42207707d59a0071 ]
SFU fifos are natively supported (created and recognized) at least by:
- Microsoft POSIX subsystem
- OpenNT/Interix subsystem
- Microsoft SFU (Windows Services for UNIX)
- Microsoft SUA (Subsystem for UNIX-based Applications)
- Windows NFS server (up to the Windows Server 2008 R2)
Windows NFS server since Windows Server 2012 uses new reparse point format for storing new fifos, but still can recognize this old format (also in the latest Windows Server 2022 version).
SFU-style fifo is empty regular file which has system attribute set.
These SFU-style fifos are already recognized by Linux SMB client.
But Linux SMB client is currently creating new SFU fifos in different format which is not compatible with all those SFU-style consumers. Fix this by creating new fifos in correct SFU format which would be recognized by all those applications and also by existing Linux SMB clients.
This change affects only creating new fifos when mount option -o sfu is used.
--- fs/smb/client/smb2ops.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
fs/smb/client/smb2ops.c +2 -4
@@ -5350,10 +5350,8 @@ int __cifs_sfu_make_node(unsigned int xid, struct inode *inode, type[0 ] ='\0' ;break ;case S_IFIFO : - type_len =8 ; -strscpy (type,"LnxFIFO" ); - data = (u8 *)&pdev; - data_len =sizeof (pdev); +/* SFU fifo is system file which is empty */ + type_len =0 ;break ;default : rc = -EPERM ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 513/1250 btrfs: only account delalloc bytes for regular file inodes in btrfs_getattr()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Chen <[email protected]>
[ Upstream commit 9411aafdf352b8d72668732af5a37dcb27383e25 ]
btrfs_getattr() unconditionally reads BTRFS_I(inode)->new_delalloc_bytes and adds it (sector-aligned) to stat->blocks for every inode type. However, new_delalloc_bytes lives in a union with last_dir_index_offset:
union {
u64 new_delalloc_bytes; /* files only */
u64 last_dir_index_offset; /* directories only */
};
For a directory inode this memory holds last_dir_index_offset, which is set during directory logging (e.g. flush_dir_items_batch()) to the offset of the last logged BTRFS_DIR_INDEX_KEY. That offset grows with the number of entries ever created in the directory (dir indexes are monotonic and never reused), so it can be arbitrarily large.
As a result, after a directory has been logged (e.g. via an fsync that triggers directory logging), btrfs_getattr() reports inflated st_blocks for that directory. The inflation is purely in-core and disappears after the inode is evicted and reloaded (btrfs_alloc_inode() zeroes the union), e.g. after a remount.
Reproducer (on a btrfs filesystem):
D=/mnt/btrfs/d
mkdir -p $D
for i in $(seq 1 20000); do touch $D/f$i; done
sync # commit, push dir index high
touch $D/trigger # dirty the dir in a new transaction
xfs_io -c fsync $D # log the directory -> sets last_dir_index_offset
stat -c '%b' $D # st_blocks is now inflated (e.g. 40)
# umount + mount -> st_blocks drops back to the correct value
The evict path already knows this union is type-dependent and guards the corresponding WARN_ON with !S_ISDIR() in btrfs_destroy_inode(); only btrfs_getattr() was missing the equivalent check.
Only read new_delalloc_bytes for regular files, which are the only inodes that ever set it.
--- fs/btrfs/inode.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/btrfs/inode.c +2 -1
@@ -8166,7 +8166,8 @@ static int btrfs_getattr(struct mnt_idmap *idmap, stat->result_mask |=STATX_SUBVOL ;spin_lock (&BTRFS_I (inode)->lock); - delalloc_bytes =BTRFS_I (inode)->new_delalloc_bytes; + delalloc_bytes =S_ISREG (inode->i_mode) ? +BTRFS_I (inode)->new_delalloc_bytes :0 ; inode_bytes =inode_get_bytes (inode);spin_unlock (&BTRFS_I (inode)->lock); stat->blocks = (ALIGN(inode_bytes, blocksize) +
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 514/1250 btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit 83201804efa4a5168be754e1dfc9b2faee760cac ]
If during relocation we fail in insert_dirty_subvol() because btrfs_update_reloc_root() returned an error, we will leave a root's reloc_root field pointing to a reloc root that was freed instead of NULL, resulting later in a use-after-free, or double free attempt during unmount.
The sequence of steps is this:
1) During relocation the call to btrfs_update_reloc_root() in insert_dirty_subvol() fails, so insert_dirty_subvol() returns the error to merge_reloc_root() without adding the root to the list rc->dirty_subvol_roots;
2) Then merge_reloc_root() aborts the current transaction because insert_dirty_subvol() returned an error;
3) Up the call chain, merge_reloc_roots() gets the error, adds the reloc root for root X to the local reloc_roots list and jumps to the 'out' label, where it calls free_reloc_roots() to free all the reloc roots in the local reloc_roots list. This frees the reloc root for root X;
4) We go up the call chain to relocate_block_group() which calls clean_dirty_subvols() to go over dirty roots and set their ->reloc_root field to NULL, but root X is not in the dirty_subvol_roots list, so its ->reloc_root still points to a reloc root;
5) Relocation finishes, with an error and a transaction abort, but the ->reloc_root field for root X still points to the reloc root that was freed in step 3;
6) When unmounting the fs we end up calling:
btrfs_free_fs_roots()
btrfs_drop_and_free_fs_root()
--> calls btrfs_put_root() against root X's ->reloc_root
which is not NULL and points to the already freed reloc root in step 4 above
Resulting in a use-after-free to a double free attempt.
Syzbot reported this with the following dmesg/syslog:
[ 106.004389][ T5339] BTRFS error (device loop0 state A): Transaction aborted (error -5) [ 106.014266][ T5339] BTRFS: error (device loop0 state A) in merge_reloc_root:1655: errno=-5 IO failure [ 106.021891][ T1061] BTRFS error (device loop0 state A): error while writing out transaction: -5 [ 106.026964][ T1061] BTRFS warning (device loop0 state A): Skipping commit of aborted transaction. [ 106.033807][ T5340] BTRFS error (device loop0 state A): bdev /dev/loop0 errs: wr 3, rd 0, flush 0, corrupt 0, gen 0 [ 106.039265][ T1061] BTRFS: error (device loop0 state A) in cleanup_transaction:2067: errno=-5 IO failure [ 106.044382][ T5339] BTRFS info (device loop0 state EA): forced readonly [ 106.074329][ T5339] BTRFS: error (device loop0 state EA) in merge_reloc_roots:1887: errno=-5 IO failure [ 106.081004][ T5356] BTRFS info (device loop0 state EA): scrub: started on devid 1 [ 106.085611][ T5339] BTRFS info (device loop0 state EA): balance: ended with status: -30 [ 106.089517][ T5356] BTRFS info (device loop0 state EA): scrub: not finished on devid 1 with status: -30 [ 106.662365][ T5338] BTRFS info (device loop0 state EA): last unmount of filesystem 3a375e4e-b156-4d76-a2ad-16e198ce1409 [ 106.682946][ T5338] ================================================================== [ 106.686574][ T5338] BUG: KASAN: slab-use-after-free in btrfs_put_root+0x2f/0x250 [ 106.690090][ T5338] Write of size 4 at addr ffff88803f978630 by task syz.0.0/5338 [ 106.693173][ T5338] [ 106.694279][ T5338] CPU: 0 UID: 0 PID: 5338 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 106.694293][ T5338] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 106.694300][ T5338] Call Trace: [ 106.694308][ T5338] <TASK> [ 106.694314][ T5338] dump_stack_lvl+0xe8/0x150 [ 106.694331][ T5338] print_address_description+0x55/0x1e0 [ 106.694343][ T5338] ? btrfs_put_root+0x2f/0x250 [ 106.694358][ T5338] print_report+0x58/0x70 [ 106.694368][ T5338] kasan_report+0x117/0x150 [ 106.694384][ T5338] ? btrfs_put_root+0x2f/0x250 [ 106.694399][ T5338] kasan_check_range+0x264/0x2c0 [ 106.694416][ T5338] btrfs_put_root+0x2f/0x250 [ 106.694430][ T5338] btrfs_drop_and_free_fs_root+0x160/0x210 [ 106.694447][ T5338] btrfs_free_fs_roots+0x2f9/0x3c0 [ 106.694464][ T5338] ? __pfx_btrfs_free_fs_roots+0x10/0x10 [ 106.694479][ T5338] ? free_root_pointers+0x5bf/0x5f0 [ 106.694494][ T5338] close_ctree+0x798/0x12d0 [ 106.694511][ T5338] ? __pfx_close_ctree+0x10/0x10 [ 106.694526][ T5338] ? _raw_spin_unlock_irqrestore+0x74/0x80 [ 106.694599][ T5338] ? rcu_preempt_deferred_qs_irqrestore+0x906/0xbc0 [ 106.694620][ T5338] ? __rcu_read_unlock+0x83/0xe0 [ 106.694636][ T5338] ? btrfs_put_super+0x48/0x1c0 [ 106.694652][ T5338] ? __pfx_btrfs_put_super+0x10/0x10 [ 106.694667][ T5338] generic_shutdown_super+0x13d/0x2d0 [ 106.694682][ T5338] kill_anon_super+0x3b/0x70 [ 106.694695][ T5338] btrfs_kill_super+0x41/0x50 [ 106.694710][ T5338] deactivate_locked_super+0xbc/0x130 [ 106.694722][ T5338] cleanup_mnt+0x437/0x4d0 [ 106.694736][ T5338] ? _raw_spin_unlock_irq+0x23/0x50 [ 106.694752][ T5338] task_work_run+0x1d9/0x270 [ 106.694769][ T5338] ? __pfx_task_work_run+0x10/0x10 [ 106.694784][ T5338] ? do_raw_spin_unlock+0x4d/0x210 [ 106.694802][ T5338] do_exit+0x70f/0x22c0 [ 106.694817][ T5338] ? trace_irq_disable+0x3b/0x140 [ 106.694835][ T5338] ? __pfx_do_exit+0x10/0x10 [ 106.694848][ T5338] ? preempt_schedule_thunk+0x16/0x30 [ 106.694863][ T5338] ? preempt_schedule_common+0x82/0xd0 [ 106.694878][ T5338] ? preempt_schedule_thunk+0x16/0x30 [ 106.694892][ T5338] do_group_exit+0x21b/0x2d0 [ 106.694906][ T5338] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.694918][ T5338] __x64_sys_exit_group+0x3f/0x40 [ 106.694932][ T5338] x64_sys_call+0x221a/0x2240 [ 106.694944][ T5338] do_syscall_64+0x174/0x580 [ 106.694954][ T5338] ? clear_bhb_loop+0x40/0x90 [ 106.694967][ T5338] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.694978][ T5338] RIP: 0033:0x7f958ef9ce59 [ 106.694988][ T5338] Code: Unable to access opcode bytes at 0x7f958ef9ce2f. [ 106.694994][ T5338] RSP: 002b:00007fffd4058318 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 106.695008][ T5338] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f958ef9ce59 [ 106.695015][ T5338] RDX: 00007f958c3f8000 RSI: 0000000000000000 RDI: 0000000000000000 [ 106.695022][ T5338] RBP: 0000000000000003 R08: 0000000000000000 R09: 00007f958f1e73e0 [ 106.695028][ T5338] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 106.695034][ T5338] R13: 00007f958f1e73e0 R14: 0000000000000003 R15: 00007fffd40583d0 [ 106.695046][ T5338] </TASK> [ 106.695050][ T5338] [ 106.821635][ T5338] Allocated by task 1061: [ 106.823446][ T5338] kasan_save_track+0x3e/0x80 [ 106.825498][ T5338] __kasan_kmalloc+0x93/0xb0 [ 106.827381][ T5338] __kmalloc_cache_noprof+0x31c/0x660 [ 106.829525][ T5338] btrfs_alloc_root+0x75/0x930 [ 106.831458][ T5338] read_tree_root_path+0x127/0xb00 [ 106.833556][ T5338] btrfs_read_tree_root+0x34/0x60 [ 106.835553][ T5338] create_reloc_root+0x6b3/0xcb0 [ 106.837556][ T5338] btrfs_init_reloc_root+0x2ec/0x4b0 [ 106.839557][ T5338] record_root_in_trans+0x2ab/0x350 [ 106.841685][ T5338] btrfs_record_root_in_trans+0x15c/0x180 [ 106.844237][ T5338] start_transaction+0x39c/0x1820 [ 106.846638][ T5338] btrfs_finish_one_ordered+0x88e/0x2680 [ 106.849436][ T5338] btrfs_work_helper+0x37b/0xc20 [ 106.851549][ T5338] process_scheduled_works+0xb5d/0x1860 [ 106.853807][ T5338] worker_thread+0xa53/0xfc0 [ 106.855773][ T5338] kthread+0x389/0x470 [ 106.857548][ T5338] ret_from_fork+0x514/0xb70 [ 106.859493][ T5338] ret_from_fork_asm+0x1a/0x30 [ 106.861504][ T5338] [ 106.862527][ T5338] Freed by task 5339: [ 106.864224][ T5338] kasan_save_track+0x3e/0x80 [ 106.866180][ T5338] kasan_save_free_info+0x46/0x50 [ 106.868371][ T5338] __kasan_slab_free+0x5c/0x80 [ 106.870462][ T5338] kfree+0x1c5/0x640 [ 106.872180][ T5338] __del_reloc_root+0x341/0x3b0 [ 106.874290][ T5338] free_reloc_roots+0x5f/0x90 [ 106.876282][ T5338] merge_reloc_roots+0x73f/0x8a0 [ 106.878489][ T5338] relocate_block_group+0xbcc/0xe70 [ 106.880742][ T5338] do_nonremap_reloc+0xa8/0x5b0 [ 106.882885][ T5338] btrfs_relocate_block_group+0x7e6/0xc40 [ 106.885336][ T5338] btrfs_relocate_chunk+0x115/0x820 [ 106.887502][ T5338] __btrfs_balance+0x1db0/0x2ae0 [ 106.889543][ T5338] btrfs_balance+0xaf3/0x11b0 [ 106.891456][ T5338] btrfs_ioctl_balance+0x3d3/0x610 [ 106.893672][ T5338] __se_sys_ioctl+0xfc/0x170 [ 106.895530][ T5338] do_syscall_64+0x174/0x580 [ 106.897518][ T5338] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.900101][ T5338] [ 106.901123][ T5338] The buggy address belongs to the object at ffff88803f978000 [ 106.901123][ T5338] which belongs to the cache kmalloc-4k of size 4096 [ 106.906907][ T5338] The buggy address is located 1584 bytes inside of [ 106.906907][ T5338] freed 4096-byte region [ffff88803f978000, ffff88803f979000) [ 106.912980][ T5338] [ 106.914022][ T5338] The buggy address belongs to the physical page: [ 106.916716][ T5338] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3f978 [ 106.920390][ T5338] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 106.923834][ T5338] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff) [ 106.927104][ T5338] page_type: f5(slab) [ 106.928898][ T5338] raw: 04fff00000000040 ffff88801ac42140 dead000000000122 0000000000000000 [ 106.932507][ T5338] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 106.936193][ T5338] head: 04fff00000000040 ffff88801ac42140 dead000000000122 0000000000000000 [ 106.939856][ T5338] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 106.943601][ T5338] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 106.947268][ T5338] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 106.950988][ T5338] page dumped because: kasan: bad access detected [ 106.953710][ T5338] page_owner tracks the page as allocated [ 106.956198][ T5338] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 24, tgid 24 (kworker/u4:2), ts 105728970387, free_ts 29540875453 [ 106.964984][ T5338] post_alloc_hook+0x22d/0x280 [ 106.966956][ T5338] get_page_from_freelist+0x2593/0x2610 [ 106.969307][ T5338] __alloc_frozen_pages_noprof+0x18d/0x380 [ 106.971839][ T5338] allocate_slab+0x77/0x660 [ 106.973709][ T5338] refill_objects+0x339/0x3d0 [ 106.975696][ T5338] __pcs_replace_empty_main+0x321/0x720 [ 106.978136][ T5338] __kmalloc_node_track_caller_noprof+0x572/0x7b0 [ 106.981009][ T5338] __alloc_skb+0x2c1/0x7d0 [ 106.982983][ T5338] nsim_dev_trap_report_work+0x29a/0xb90 [ 106.985356][ T5338] process_scheduled_works+0xb5d/0x1860 [ 106.987710][ T5338] worker_thread+0xa53/0xfc0 [ 106.989847][ T5338] kthread+0x389/0x470 [ 106.991727][ T5338] ret_from_fork+0x514/0xb70 [ 106.993722][ T5338] ret_from_fork_asm+0x1a/0x30 [ 106.995900][ T5338] page last free pid 77 tgid 77 stack trace: [ 106.998479][ T5338] __free_frozen_pages+0xc1c/0xd30 [ 107.000819][ T5338] vfree+0x1d1/0x2f0 [ 107.002631][ T5338] delayed_vfree_work+0x55/0x80 [ 107.004848][ T5338] process_scheduled_works+0xb5d/0x1860 [ 107.007366][ T5338] worker_thread+0xa53/0xfc0 [ 107.009388][ T5338] kthread+0x389/0x470 [ 107.011177][ T5338] ret_from_fork+0x514/0xb70 [ 107.013313][ T5338] ret_from_fork_asm+0x1a/0x30 [ 107.015454][ T5338] [ 107.016460][ T5338] Memory state around the buggy address: [ 107.019052][ T5338] ffff88803f978500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 107.022691][ T5338] ffff88803f978580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 107.026264][ T5338] >ffff88803f978600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 107.029721][ T5338] ^ [ 107.032062][ T5338] ffff88803f978680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 107.035547][ T5338] ffff88803f978700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 107.038865][ T5338] ==================================================================
Fix this by resetting a root's ->reloc_root if we get an error while trying to merge a reloc root.
--- fs/btrfs/relocation.c | 42 +++++++++++++++++++++++++++++++++--------- 1 file changed, 33 insertions(+), 9 deletions(-)
fs/btrfs/relocation.c +33 -9
@@ -1457,6 +1457,17 @@ static int insert_dirty_subvol(struct btrfs_trans_handle *trans,return 0 ; } +static void clear_reloc_root (struct btrfs_root *root) +{ + root->reloc_root =NULL ; +/* +* Need barrier to ensure clear_bit() only happens after +* root->reloc_root = NULL. Pairs with have_reloc_root(). +*/ +smp_wmb (); +clear_bit (BTRFS_ROOT_DEAD_RELOC_TREE , &root->state); +} +static int clean_dirty_subvols (struct reloc_control *rc) {struct btrfs_root *root;
@@ -1471,13 +1482,7 @@ static int clean_dirty_subvols(struct reloc_control *rc)struct btrfs_root *reloc_root = root->reloc_root;list_del_init (&root->reloc_dirty_list); - root->reloc_root =NULL ; -/* -* Need barrier to ensure clear_bit() only happens after -* root->reloc_root = NULL. Pairs with have_reloc_root. -*/ -smp_wmb (); -clear_bit (BTRFS_ROOT_DEAD_RELOC_TREE , &root->state); +clear_reloc_root (root);if (reloc_root) {/* * btrfs_drop_snapshot drops our ref we hold for
@@ -1862,13 +1867,32 @@ void merge_reloc_roots(struct reloc_control *rc) goto out; } ret =merge_reloc_root (rc, root); -btrfs_put_root (root);if (ret) { -if (list_empty (&reloc_root->root_list)) +/* +* Clear the reloc root since below we will call +* free_reloc_roots(), otherwise we leave +* root->reloc_root pointing to a freed reloc +* root and trigger a use-after-free during +* unmount or elsewhere. +*/ +clear_reloc_root (root); +btrfs_put_root (root); +/* +* We are adding the reloc_root to the local +* reloc_roots list, so we add a ref for this +* list which will be dropped below by the call +* to free_reloc_roots(). +*/ +if (list_empty (&reloc_root->root_list)) {list_add_tail (&reloc_root->root_list, &reloc_roots); +btrfs_grab_root (reloc_root); + } +/* Now drop the ref for root->reloc_root. */ +btrfs_put_root (reloc_root); goto out; } +btrfs_put_root (root); }else {if (!IS_ERR (root)) {if (root->reloc_root == reloc_root) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 515/1250 spi: dw-dma: Wait for controller idle before completing Tx
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang YuWei <[email protected]>
[ Upstream commit 0bcd59706aeda8a5d48ba656bab74cb26f2b423e ]
dw_spi_dma_wait_tx_done() polls dw_spi_dma_tx_busy(), which only checks DW_SPI_SR_TF_EMPT. An empty TX FIFO merely means the last data word has been moved into the shift register; the transfer is not complete on the bus until DW_SPI_SR_BUSY is also cleared. As a result the wait can return while the controller is still shifting out the final word.
Any caller that tears down or reconfigures the controller right after the transfer can then lose the tail of the transfer.
The memory-operation path in spi-dw-core.c already waits for both DW_SPI_SR_BUSY == 0 and DW_SPI_SR_TF_EMPT == 1. Use the same completion condition in the DMA path so the transfer is guaranteed to be finished on the bus before the wait returns.
--- drivers/spi/spi-dw-dma.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/spi/spi-dw-dma.c +2 -1
@@ -281,7 +281,8 @@ static int dw_spi_dma_wait(struct dw_spi *dws, unsigned int len, u32 speed)static inline bool dw_spi_dma_tx_busy (struct dw_spi *dws) { -return !(dw_readl (dws,DW_SPI_SR ) &DW_SPI_SR_TF_EMPT ); +return (dw_readl (dws,DW_SPI_SR ) & + (DW_SPI_SR_BUSY |DW_SPI_SR_TF_EMPT )) !=DW_SPI_SR_TF_EMPT ; } static int dw_spi_dma_wait_tx_done(struct dw_spi *dws,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 516/1250 wifi: iwlwifi: mvm: validate sta_id in BA window status notif
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
[ Upstream commit 6aa77efaea9efea92e3090c35ad348fd759a3cf3 ]
BA_WINDOW_STATUS_NOTIFICATION_ID extracts a 5-bit sta_id from the firmware notification and uses it to index fw_id_to_mac_id[] without bounds checking. Validate sta_id before array access to prevent out-of-bounds indexing.
--- drivers/net/wireless/intel/iwlwifi/mvm/rx.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/wireless/intel/iwlwifi/mvm/rx.c +5 -0
@@ -1224,6 +1224,11 @@ void iwl_mvm_window_status_notif(struct iwl_mvm *mvm,/* get the station */ sta_id = (ratid &BA_WINDOW_STATUS_STA_ID_MSK ) >>BA_WINDOW_STATUS_STA_ID_POS ; +if (IWL_FW_CHECK (mvm, + sta_id >= mvm->fw->ucode_capa.num_stations, +"Invalid sta id (%d) in BA window status notification\n" , + sta_id)) +continue ; sta =rcu_dereference (mvm->fw_id_to_mac_id[sta_id]);if (IS_ERR_OR_NULL (sta))continue ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 517/1250 btrfs: fix reloc root cleanup in merge_reloc_roots()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit b78fe9563e2d5ae47805f1e5dc722c91fd30e1f8 ]
If the root we got has zero root refs in its root item, we are resetting the root's ->reloc_root without using barriers like we do everywhere else. Sashiko complained about this while reviewing another patch, and it's correct (see the Link tag below).
Also, we should not clear BTRFS_ROOT_DEAD_RELOC_TREE from the root unless the root points to the reloc root we have.
Fix this by using clear_reloc_root(), which issues the memory barrier after setting the root's ->reloc_root to NULL and before clearing the bit BTRFS_ROOT_DEAD_RELOC_TREE from the root.
--- fs/btrfs/relocation.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
fs/btrfs/relocation.c +2 -3
@@ -1896,11 +1896,10 @@ void merge_reloc_roots(struct reloc_control *rc) }else {if (!IS_ERR (root)) {if (root->reloc_root == reloc_root) { - root->reloc_root =NULL ; +clear_reloc_root (root); +/* Drop the ref for root->reloc_root. */ btrfs_put_root (reloc_root); } -clear_bit (BTRFS_ROOT_DEAD_RELOC_TREE , - &root->state);btrfs_put_root (root); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 518/1250 wifi: iwlwifi: mvm: validate mac_link_id in session protect notif
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
[ Upstream commit 71245daf7d58a3c407c7e1422facce13ff6a584b ]
Check the mac_id before accessing the vif_id_to_mac array.
--- drivers/net/wireless/intel/iwlwifi/mvm/time-event.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/wireless/intel/iwlwifi/mvm/time-event.c +5 -0
@@ -960,6 +960,11 @@ void iwl_mvm_rx_session_protect_notif(struct iwl_mvm *mvm,struct ieee80211_vif *vif;struct iwl_mvm_vif *mvmvif; +if (IWL_FW_CHECK (mvm, id >=ARRAY_SIZE (mvm->vif_id_to_mac), +"Invalid mac_link_id (%d) in session protect notif\n" , + id)) +return ; +rcu_read_lock ();/* note we use link ID == MAC ID */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 519/1250 wifi: iwlwifi: mvm: fix an off-by-1 boundary check
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
[ Upstream commit d77aff138c9ec6c8562f4c2c9f262d3d9c4b4cb8 ]
Before looking at the 11th byte, check the length is big enough.
--- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +1 -1
@@ -3529,7 +3529,7 @@ static void iwl_mvm_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy, elem =cfg80211_find_elem (WLAN_EID_EXT_CAPABILITY , ies->data, ies->len); -if (!elem || elem->datalen <10 || +if (!elem || elem->datalen <11 || !(elem->data[10 ] &WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT )) { data->tolerated = false;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 520/1250 wifi: iwlwifi: mvm: parse beacon notif per layout
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
[ Upstream commit b77c6f50b1f80414cb3f542ae72e532ed90fc7f7 ]
The beacon TX notification can arrive in different layouts, and fields must be read only after selecting the expected format.
Parse gp2 and TSF from the matching notification structure in each branch, and keep using the parsed gp2 for CSA countdown and debug output. Drop the obsolete cached gp2 field.
--- .../net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | 25 +++++++++++-------- .../net/wireless/intel/iwlwifi/mvm/mac80211.c | 1 - drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 3 --- 3 files changed, 15 insertions(+), 14 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c +15 -10
@@ -1504,49 +1504,54 @@ void iwl_mvm_rx_beacon_notif(struct iwl_mvm *mvm, {struct iwl_rx_packet *pkt =rxb_addr (rxb);unsigned int pkt_len =iwl_rx_packet_payload_len (pkt); -struct iwl_extended_beacon_notif *beacon = (void *)pkt->data; -struct iwl_extended_beacon_notif_v5 *beacon_v5 = (void *)pkt->data;struct ieee80211_vif *csa_vif;struct ieee80211_vif *tx_blocked_vif;struct agg_tx_status *agg_status; +u32 beacon_gp2;u16 status;lockdep_assert_held (&mvm->mutex); - mvm->ap_last_beacon_gp2 =le32_to_cpu (beacon->gp2); -if (!iwl_mvm_is_short_beacon_notif_supported (mvm)) { +struct iwl_extended_beacon_notif_v5 *beacon = (void *)pkt->data;struct iwl_tx_resp *beacon_notify_hdr = - &beacon_v5->beacon_notify_hdr; + &beacon->beacon_notify_hdr; -if (unlikely (pkt_len <sizeof (*beacon_v5))) +if (unlikely (pkt_len <sizeof (*beacon)))return ; - mvm->ibss_manager = beacon_v5->ibss_mgr_status !=0 ; + beacon_gp2 =le32_to_cpu (beacon->gp2); + + mvm->ibss_manager = beacon->ibss_mgr_status !=0 ; agg_status =iwl_mvm_get_agg_status (mvm, beacon_notify_hdr); status =le16_to_cpu (agg_status->status) &TX_STATUS_MSK ;IWL_DEBUG_RX (mvm,"beacon status %#x retries:%d tsf:0x%016llX gp2:0x%X rate:%d\n" , status, beacon_notify_hdr->failure_frame,le64_to_cpu (beacon->tsf), - mvm->ap_last_beacon_gp2, + beacon_gp2,le32_to_cpu (beacon_notify_hdr->initial_rate)); }else { +const struct iwl_extended_beacon_notif *beacon = + (void *)pkt->data; +if (unlikely (pkt_len <sizeof (*beacon)))return ; + beacon_gp2 =le32_to_cpu (beacon->gp2); + mvm->ibss_manager = beacon->ibss_mgr_status !=0 ; status =le32_to_cpu (beacon->status) &TX_STATUS_MSK ;IWL_DEBUG_RX (mvm,"beacon status %#x tsf:0x%016llX gp2:0x%X\n" , status,le64_to_cpu (beacon->tsf), - mvm->ap_last_beacon_gp2); + beacon_gp2); } csa_vif =rcu_dereference_protected (mvm->csa_vif,lockdep_is_held (&mvm->mutex));if (unlikely (csa_vif && csa_vif->bss_conf.csa_active)) -iwl_mvm_csa_count_down (mvm, csa_vif, mvm->ap_last_beacon_gp2, +iwl_mvm_csa_count_down (mvm, csa_vif, beacon_gp2, (status ==TX_STATUS_SUCCESS )); tx_blocked_vif = rcu_dereference_protected(mvm->csa_tx_blocked_vif,
drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +0 -1
@@ -3100,7 +3100,6 @@ void iwl_mvm_stop_ap_ibss_common(struct iwl_mvm *mvm, } mvmvif->ap_ibss_active = false; - mvm->ap_last_beacon_gp2 =0 ;if (vif->type ==NL80211_IFTYPE_AP && !vif->p2p) { iwl_mvm_vif_set_low_latency(mvmvif, false,
drivers/net/wireless/intel/iwlwifi/mvm/mvm.h +0 -3
@@ -1180,9 +1180,6 @@ struct iwl_mvm {struct ieee80211_vif __rcu *csa_tx_blocked_vif;u8 csa_tx_block_bcn_timeout; -/* system time of last beacon (for AP/GO interface) */ -u32 ap_last_beacon_gp2; -/* indicates that we transmitted the last beacon */ bool ibss_manager;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 521/1250 wifi: iwlwifi: mvm: fix sched scan IE sizing
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
[ Upstream commit 4f155d262b31b9b17e0f9856bdabe0968eb4930f ]
Scheduled scan built the probe request before iwl_mvm_scan_fits(), so oversized IEs could be copied into the fixed preq buffer before length validation. Move iwl_mvm_build_scan_probe() after the fits check.
Also advertise max_sched_scan_ie_len using iwl_mvm_max_scan_ie_len() so userspace limits account for driver-inserted DS/TPC bytes.
--- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 4 +--- drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 4 ++-- 2 files changed, 3 insertions(+), 5 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +1 -3
@@ -625,9 +625,7 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm) hw->wiphy->max_sched_scan_reqs =1 ; hw->wiphy->max_sched_scan_ssids =PROBE_OPTION_MAX ; hw->wiphy->max_match_sets =iwl_umac_scan_get_max_profiles (mvm->fw); -/* we create the 802.11 header and zero length SSID IE. */ - hw->wiphy->max_sched_scan_ie_len = -SCAN_OFFLOAD_PROBE_REQ_SIZE -24 -2 ; + hw->wiphy->max_sched_scan_ie_len =iwl_mvm_max_scan_ie_len (mvm); hw->wiphy->max_sched_scan_plans =IWL_MAX_SCHED_SCAN_PLANS ; hw->wiphy->max_sched_scan_plan_interval =U16_MAX ;
drivers/net/wireless/intel/iwlwifi/mvm/scan.c +2 -2
@@ -3148,8 +3148,6 @@ int iwl_mvm_sched_scan_start(struct iwl_mvm *mvm,if (ret)return ret; -iwl_mvm_build_scan_probe (mvm, vif, ies, ¶ms); -/* for 6 GHZ band only PSC channels need to be added */ for (i =0 ; i < params.n_channels; i++) {struct ieee80211_channel *channel = params.channels[i];
@@ -3183,6 +3181,8 @@ int iwl_mvm_sched_scan_start(struct iwl_mvm *mvm, goto out; } +iwl_mvm_build_scan_probe (mvm, vif, ies, ¶ms); + uid =iwl_mvm_build_scan_cmd (mvm, vif, &hcmd, ¶ms, type);if (uid <0 ) { ret = uid;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 522/1250 wifi: iwlwifi: pcie: null RX pointers after free
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
[ Upstream commit 2c79d7a7b583050c9f58041465cb46fe3483ab5d ]
When iwl_pcie_tx_init() fails after RX init, nic init unwinds via iwl_pcie_rx_free().
The freed RX members stayed non-NULL on the live transport object, so later teardown or retry could touch stale RX state. Set rx_pool, global_table, rxq, and alloc_page to NULL after free to make repeated cleanup and retry paths safe.
--- drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/rx.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/rx.c +7 -2
@@ -1,6 +1,6 @@// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause /* -* Copyright (C) 2003-2014, 2018-2024 Intel Corporation +* Copyright (C) 2003-2014, 2018-2024, 2026 Intel Corporation * Copyright (C) 2013-2015 Intel Mobile Communications GmbH * Copyright (C) 2016-2017 Intel Deutschland GmbH */
@@ -1241,11 +1241,16 @@ void iwl_pcie_rx_free(struct iwl_trans *trans) } }kfree (trans_pcie->rx_pool); + trans_pcie->rx_pool =NULL ;kfree (trans_pcie->global_table); + trans_pcie->global_table =NULL ;kfree (trans_pcie->rxq); + trans_pcie->rxq =NULL ; -if (trans_pcie->alloc_page) +if (trans_pcie->alloc_page) {__free_pages (trans_pcie->alloc_page, trans_pcie->rx_page_order); + trans_pcie->alloc_page =NULL ; + } } static void iwl_pcie_rx_move_to_allocator(struct iwl_rxq *rxq,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 523/1250 ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcel Kłos <[email protected]>
[ Upstream commit 728d34ebf91c0e80b63a66b237dd0dfc5a8e5b4d ]
The sound and microphone mute LEDs do not function on this newer revision of the board (8AB8) while they do on the older 880D models. I have verified this on another laptop which was manufactured before the one with the issue.
Added the ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED from a G9 model, which uses the same codec, to make it work. Tested on kernel version 7.1.3 on the aforementioned newer revision notebook.
--- sound/hda/codecs/realtek/alc269.c | 1 + 1 file changed, 1 insertion(+)
sound/hda/codecs/realtek/alc269.c +1 -0
@@ -6877,6 +6877,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x103c ,0x8aa3 ,"HP ProBook 450 G9 (MB 8AA1)" ,ALC236_FIXUP_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x8aa8 ,"HP EliteBook 640 G9 (MB 8AA6)" ,ALC236_FIXUP_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x8aab ,"HP EliteBook 650 G9 (MB 8AA9)" ,ALC236_FIXUP_HP_GPIO_LED ), +SND_PCI_QUIRK (0x103c ,0x8ab8 ,"HP EliteBook 830 G8 Notebook PC (MB 8AB8)" ,ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x8ab9 ,"HP EliteBook 840 G8 (MB 8AB8)" ,ALC285_FIXUP_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x8abb ,"HP ZBook Firefly 14 G9" ,ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED ), SND_PCI_QUIRK(0x103c, 0x8ad1, "HP EliteBook 840 14 inch G9 Notebook PC", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 524/1250 blk-cgroup: fix leaks and online flag on radix_tree_insert failure
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tao Cui <[email protected]>
[ Upstream commit dbbca20764382b4d411ec2918f4e278ffe547acc ]
When radix_tree_insert() fails in blkg_create(), the error path has two issues:
1. blkg->online is set to true unconditionally, even when the blkg was never fully inserted. Move the assignment inside the success block.
2. The error path calls blkg_put() without first calling percpu_ref_kill(). Because the refcount is still in percpu mode, percpu_ref_put() only does this_cpu_sub() without checking for zero, so blkg_release() is never triggered. This permanently leaks the blkg memory, its percpu iostat, policy data, the parent blkg reference, and the cgroup css reference — the latter preventing the cgroup from ever being destroyed.
Fix by replacing blkg_put() with percpu_ref_kill(), matching the pattern used in blkg_destroy().
--- block/blk-cgroup.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
block/blk-cgroup.c +2 -2
@@ -432,15 +432,15 @@ static struct blkcg_gq *blkg_create(struct blkcg *blkcg, struct gendisk *disk, blkg->pd[i]->online = true; } } + blkg->online = true; } - blkg->online = true;spin_unlock (&blkcg->lock);if (!ret)return blkg;/* @blkg failed fully initialized, use the usual release path */ -blkg_put (blkg); +percpu_ref_kill (&blkg->refcnt);return ERR_PTR (ret); err_put_css:
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 525/1250 smb/client: flush dirty data before punching a hole
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huiwen He <[email protected]>
[ Upstream commit d7d2adcd022baade5cab65ca492ce63421ce3a6e ]
Punching a hole after a large buffered write may leave the range reported as data. Reproduce it with:
xfs_io -f \
-c "pwrite -b 3m -S 0x61 0 3m" \
-c "fpunch 1m 1m" \
-c "seek -h 0" \
-c "seek -d 1m" \
/mnt/test/reproPunching 1 MiB at offset 1 MiB should produce:
0 1 MiB 2 MiB 3 MiB | DATA | HOLE | DATA | EOF
Instead, the entire file is reported as data. SEEK_HOLE(0) returns EOF, and SEEK_DATA(1M) returns 1M.
This happens because a dirty folio spanning the punched range can be written back after the punch and refill the hole.
Fix this by flushing and waiting for dirty data in the punched range before invalidating the page cache and issuing FSCTL_SET_ZERO_DATA.
The xfstests generic/539 pass against Samba/ksmbd with this change.
--- fs/smb/client/smb2ops.c | 9 +++++++++ 1 file changed, 9 insertions(+)
fs/smb/client/smb2ops.c +9 -0
@@ -3456,6 +3456,15 @@ static long smb3_punch_hole(struct file *file, struct cifs_tcon *tcon, goto out;filemap_invalidate_lock (inode->i_mapping); +/* +* Flush dirty data first, otherwise a dirty folio spanning the punched +* range may be written back after the ioctl and refill the hole. +*/ + rc =filemap_write_and_wait_range (inode->i_mapping, offset, + offset + len -1 ); +if (rc <0 ) + goto unlock; +/* * We implement the punch hole through ioctl, so we need remove the page * caches first, otherwise the data may be inconsistent with the server.
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 526/1250 ASoC: Intel: sof_sdw: Add quirks for new Dell laptops
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <[email protected]>
[ Upstream commit efd80de2de9d06ddf0eee55ca11b04e39bfc7cd8 ]
A couple of new Dell laptops are shipping using the sidecar amp configuration. Add the required kernel quirk to enable.
--- sound/soc/intel/boards/sof_sdw.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/intel/boards/sof_sdw.c +2 -0
@@ -805,6 +805,8 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { };static const struct snd_pci_quirk sof_sdw_ssid_quirk_table[] = { +SND_PCI_QUIRK (0x1028 ,0x0e53 ,"Dell XPS WCL" ,SOC_SDW_SIDECAR_AMPS ), +SND_PCI_QUIRK (0x1028 ,0x0e54 ,"Dell XPS PTL" ,SOC_SDW_SIDECAR_AMPS ),SND_PCI_QUIRK (0x1043 ,0x1e13 ,"ASUS Zenbook S14" ,SOC_SDW_CODEC_MIC ),SND_PCI_QUIRK (0x1043 ,0x1f43 ,"ASUS Zenbook S16" ,SOC_SDW_CODEC_MIC ),SND_PCI_QUIRK (0x17aa ,0x2347 ,"Lenovo P16" ,SOC_SDW_CODEC_MIC ),
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 527/1250 wifi: iwlwifi: mvm: validate TX_CMD response layout
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
[ Upstream commit 8d70881707b47353359df57df12f6de67fdacdd2 ]
TX_CMD parsing uses frame_count to walk status entries and then read the trailing SCD SSN. Make the minimum-length check follow that exact runtime layout calculation before parsing the payload.
For new TX API, reject TX_CMD responses with frame_count != 1 and warn/return in the aggregation handler to document that aggregated accounting is expected via BA notifications.
--- drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 34 +++++++++++++++++++++ 1 file changed, 34 insertions(+)
drivers/net/wireless/intel/iwlwifi/mvm/tx.c +34 -0
@@ -1581,6 +1581,17 @@ static inline u32 iwl_mvm_get_scd_ssn(struct iwl_mvm *mvm,return val &0xFFF ; } +static inline size_t iwl_mvm_tx_resp_min_len (struct iwl_mvm *mvm, +struct iwl_tx_resp *tx_resp) +{ +struct agg_tx_status *agg_status = +iwl_mvm_get_agg_status (mvm, tx_resp); + +/* The aggregate response ends with a trailing SCD SSN __le32 word. */ +return (u8 *)(agg_status + tx_resp->frame_count) - (u8 *)tx_resp + +sizeof (__le32); +} +static void iwl_mvm_rx_tx_cmd_single (struct iwl_mvm *mvm,struct iwl_rx_packet *pkt) {
@@ -1884,6 +1895,9 @@ static void iwl_mvm_rx_tx_cmd_agg(struct iwl_mvm *mvm,int queue =SEQ_TO_QUEUE (sequence);struct ieee80211_sta *sta; +if (WARN_ON_ONCE (iwl_mvm_has_new_tx_api (mvm))) +return ; +if (WARN_ON_ONCE (queue <IWL_MVM_DQA_MIN_DATA_QUEUE && (queue !=IWL_MVM_DQA_BSS_CLIENT_QUEUE )))return ;
@@ -1918,6 +1932,26 @@ void iwl_mvm_rx_tx_cmd(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb) {struct iwl_rx_packet *pkt =rxb_addr (rxb);struct iwl_tx_resp *tx_resp = (void *)pkt->data; +size_t min_len; + +if (IWL_FW_CHECK (mvm, !tx_resp->frame_count, +"invalid TX_CMD frame_count %u\n" , + tx_resp->frame_count)) +return ; + +if (IWL_FW_CHECK (mvm, +iwl_mvm_has_new_tx_api (mvm) && + tx_resp->frame_count !=1 , +"invalid TX_CMD frame_count %u for new TX API\n" , + tx_resp->frame_count)) +return ; + + min_len =iwl_mvm_tx_resp_min_len (mvm, tx_resp); +if (IWL_FW_CHECK (mvm,iwl_rx_packet_payload_len (pkt) < min_len, +"invalid TX_CMD len %u (frame_count %u, min %zu)\n" , +iwl_rx_packet_payload_len (pkt), tx_resp->frame_count, + min_len)) +return ;if (tx_resp->frame_count ==1 )iwl_mvm_rx_tx_cmd_single (mvm, pkt);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 528/1250 wifi: iwlwifi: mvm: fix a possible underflow
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
[ Upstream commit 0cb5260a1027a43f8cdb961e128f2ddd42e46832 ]
We shouldn't trust the firmware about the length of the wowlan packet.
--- drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/d3.c +15 -4
@@ -1516,6 +1516,10 @@ static void iwl_mvm_report_wakeup_reasons(struct iwl_mvm *mvm,if (WARN_ON_ONCE (truncated <0 )) truncated =0 ; +/* this would be a firmware bug */ +if (WARN_ON_ONCE (pktsize <sizeof (*hdr))) +return ; +if (ieee80211_is_data (hdr->frame_control)) {int hdrlen =ieee80211_hdrlen (hdr->frame_control);int ivlen =0 , icvlen =4 ;/* also FCS */
@@ -1524,10 +1528,6 @@ static void iwl_mvm_report_wakeup_reasons(struct iwl_mvm *mvm,if (!pkt) goto report; -skb_put_data (pkt, pktdata, hdrlen); - pktdata += hdrlen; - pktsize -= hdrlen; -if (ieee80211_has_protected (hdr->frame_control)) {/* * This is unlocked and using gtk_i(c)vlen,
@@ -1553,6 +1553,17 @@ static void iwl_mvm_report_wakeup_reasons(struct iwl_mvm *mvm, truncated =0 ; } +if (IWL_FW_CHECK (mvm, + pktsize <= hdrlen + ivlen + icvlen, +"pktsize is too small %d\n" , + pktsize)) { +kfree_skb (pkt); +return ; + } + +skb_put_data (pkt, pktdata, hdrlen); + pktdata += hdrlen; + pktsize -= hdrlen; pktsize -= ivlen + icvlen; pktdata += ivlen;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 529/1250 arm64: fixmap: Allow 256K early_ioremap() at any offset
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Peng <[email protected]>
[ Upstream commit 21fc7ec93f8b633b60d5bddef2f1529ff6b36185 ]
NR_FIX_BTMAPS is the per-slot page limit for early_ioremap(). Since __early_ioremap() maps the page-aligned physical range, a 256K request can require one extra page when the physical address is not page-aligned.
Reserve one extra page per slot so the 256K mapping budget is usable regardless of the initial page offset.
--- arch/arm64/include/asm/fixmap.h | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
arch/arm64/include/asm/fixmap.h +5 -1
@@ -78,8 +78,12 @@ enum fixed_addresses {/* * Temporary boot-time mappings, used by early_ioremap(), * before ioremap() is functional. +* +* Reserve one extra page so a 256K mapping may start at any +* offset within a page. early_ioremap() maps the page-aligned +* physical range, so the initial offset can consume an extra page. */ -#define NR_FIX_BTMAPS (SZ_256K / PAGE_SIZE) +#define NR_FIX_BTMAPS ((SZ_256K / PAGE_SIZE) + 1)#define FIX_BTMAPS_SLOTS 7#define TOTAL_FIX_BTMAPS (NR_FIX_BTMAPS * FIX_BTMAPS_SLOTS)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 530/1250 wifi: iwlwifi: mvm: add a check on the tid coming from the firmware
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
[ Upstream commit 0e4c0d83267261cf67ec9690856edf4a56bb7dfc ]
ba_notif->tid is a firmware-controlled u8 that is used directly as an array index into tid_data[] without any validation. Add a bounds check against IWL_MAX_TID_COUNT before dereferencing the array.
--- drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/wireless/intel/iwlwifi/mvm/tx.c +3 -0
@@ -2192,6 +2192,9 @@ void iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb) ba_notif = (void *)pkt->data; sta_id = ba_notif->sta_id; tid = ba_notif->tid; +if (IWL_FW_CHECK (mvm, tid >=ARRAY_SIZE (mvmsta->tid_data), +"invalid TID %d in BA notif\n" , tid)) +return ;/* "flow" corresponds to Tx queue */ txq =le16_to_cpu (ba_notif->scd_flow);/* "ssn" is start of block-ack Tx window, corresponds to index
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 531/1250 wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
[ Upstream commit 94d3982806c7f194b23484befde12934dda23064 ]
mvmsta->tid_data was indexed by the TFD loop counter 'i' instead of the actual TID value 'tid'. This writes lq_color into a random tid_data slot unrelated to the BA entry.
Since multi-TID blockack is not really in use, 'i' was always 0 and no harm was done.
Add a out-of-bound check before accessing the array.
--- drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/mvm/tx.c +7 -1
@@ -2171,8 +2171,14 @@ void iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)if (tid ==IWL_MGMT_TID ) tid =IWL_MAX_TID_COUNT ; +if (IWL_FW_CHECK (mvm, tid >= +ARRAY_SIZE (mvmsta->tid_data), +"invalid TID %d in compressed BA\n" , + tid)) +continue ; +if (mvmsta) - mvmsta->tid_data[i].lq_color = lq_color; + mvmsta->tid_data[tid].lq_color = lq_color; iwl_mvm_tx_reclaim(mvm, sta_id, tid, (int)(le16_to_cpu(ba_tfd->q_num)),
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 532/1250 arm64: kprobes: Allow reentering kprobes while single-stepping
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pu Hu <[email protected]>
[ Upstream commit 23f851ac0078a908bf3422d6467ebc1db5828c46 ]
A kprobe can be hit while another kprobe is in KPROBE_HIT_SS state. This can happen when tracing or perf code runs from the debug exception path while the first kprobe is preparing or executing its out-of-line single-step instruction.
Currently arm64 treats a kprobe hit in KPROBE_HIT_SS as unrecoverable, the same as a hit in KPROBE_REENTER. This is too strict. A hit in KPROBE_HIT_SS is still a one-level reentry and can be handled by saving the current kprobe state and setting up single-step for the new probe, just like reentry from KPROBE_HIT_ACTIVE or KPROBE_HIT_SSDONE.
The truly unrecoverable case is hitting another kprobe while already in KPROBE_REENTER, because the reentry save area has already been consumed.
Move KPROBE_HIT_SS to the recoverable reentry cases and leave KPROBE_REENTER as the unrecoverable nested reentry case.
This change also requires saving saved_irqflag in struct prev_kprobe. When a nested kprobe calls kprobes_save_local_irqflag(), it overwrites kcb->saved_irqflag with the currently masked DAIF value, losing the outer kprobe's original DAIF state. Without this fix, when the outer kprobe's single-step finishes, kprobes_restore_local_irqflag() applies the wrong DAIF mask and leaves interrupts permanently disabled.
Extend struct prev_kprobe with a saved_irqflag field and save/restore it alongside kp and status. This ensures the outer kprobe's original interrupt state is preserved across reentry.
This mirrors the x86 fix in commit 6a5022a56ac3 ("kprobes/x86: Allow to handle reentered kprobe on single-stepping").
--- arch/arm64/include/asm/kprobes.h | 6 ++++++ arch/arm64/kernel/probes/kprobes.c | 23 ++++++++++++++++++++++- 2 files changed, 28 insertions(+), 1 deletion(-)
arch/arm64/include/asm/kprobes.h +6 -0
@@ -26,6 +26,12 @@struct prev_kprobe {struct kprobe *kp;unsigned int status; + +/* +* The original DAIF state of the outer kprobe, saved here before +* a nested kprobe overwrites kcb->saved_irqflag during reentry. +*/ +unsigned long saved_irqflag; };/* per-cpu kprobe control block */
arch/arm64/kernel/probes/kprobes.c +22 -1
@@ -174,12 +174,27 @@ static void __kprobes save_previous_kprobe(struct kprobe_ctlblk *kcb) { kcb->prev_kprobe.kp =kprobe_running (); kcb->prev_kprobe.status = kcb->kprobe_status; + +/* +* Save the outer kprobe's original DAIF flags before the nested +* kprobe calls kprobes_save_local_irqflag() and overwrites +* kcb->saved_irqflag. Without this, the outer kprobe will restore +* the wrong DAIF state and leave interrupts permanently masked. +*/ + kcb->prev_kprobe.saved_irqflag = kcb->saved_irqflag; }static void __kprobes restore_previous_kprobe (struct kprobe_ctlblk *kcb) {__this_cpu_write (current_kprobe, kcb->prev_kprobe.kp); kcb->kprobe_status = kcb->prev_kprobe.status; + +/* +* Restore the outer kprobe's saved_irqflag so that when its +* single-step completes, kprobes_restore_local_irqflag() uses +* the correct original DAIF value. +*/ + kcb->saved_irqflag = kcb->prev_kprobe.saved_irqflag; }static void __kprobes set_current_kprobe (struct kprobe *p)
@@ -240,10 +255,16 @@ static int __kprobes reenter_kprobe(struct kprobe *p,switch (kcb->kprobe_status) {case KPROBE_HIT_SSDONE :case KPROBE_HIT_ACTIVE : +case KPROBE_HIT_SS : +/* +* A probe can be hit while another kprobe is preparing or +* executing its XOL single-step instruction. This is still a +* recoverable one-level reentry, so handle it in the same way as +* reentry from KPROBE_HIT_ACTIVE or KPROBE_HIT_SSDONE. +*/ kprobes_inc_nmissed_count (p);setup_singlestep (p, regs, kcb,1 );break ; -case KPROBE_HIT_SS :case KPROBE_REENTER :pr_warn ("Failed to recover from reentered kprobes.\n" );dump_kprobe (p);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 533/1250 drm/amd/pm/si: Dont schedule thermal work when queue isnt initialized
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit f8922d5a946699fc2bdc7660e6778bd6726bf8b8 ]
When DPM is turned off with the amdgpu.dpm=0 module parameter, the thermal work queue isn't initialized so we shouldn't schedule any work on it.
--- drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +1 -1
@@ -7690,7 +7690,7 @@ static int si_dpm_process_interrupt(struct amdgpu_device *adev,break ; } -if (queue_thermal) +if (queue_thermal && amdgpu_dpm)schedule_work (&adev->pm.dpm.thermal.work);return 0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 534/1250 ALSA: hda/realtek: Add quirk for HP Pavilion x360
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 02bbbf05d19f49c5cc9f249dd8844b2a7f2a2b8c ]
HP Pavilion x360 sets a bogus PCI SSID (103c:0000), hence the driver picks up a wrong quirk entry, resulting in an almost silent output. And yet, the existing quirk for x390 doesn't seem sufficing, and we need the extra setup for the amp.
This patch adds the quirk entry for the codec SSID (103c:8486) to initialize the amp via COEF verbs and chains to the existing quirk for another x360 model to address the silent output.
--- sound/hda/codecs/realtek/alc269.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
sound/hda/codecs/realtek/alc269.c +15 -0
@@ -3823,6 +3823,7 @@ enum {ALC256_FIXUP_HUAWEI_MACH_WX9_PINS ,ALC298_FIXUP_HUAWEI_MBX_STEREO ,ALC295_FIXUP_HP_X360 , +ALC295_FIXUP_HP_PAVILION_X360 ,ALC221_FIXUP_HP_HEADSET_MIC ,ALC285_FIXUP_LENOVO_HEADPHONE_NOISE , ALC295_FIXUP_HP_AUTO_MUTE,
@@ -5135,6 +5136,19 @@ static const struct hda_fixup alc269_fixups[] = { .chained = true, .chain_id =ALC269_FIXUP_HP_MUTE_LED_MIC3 }, + [ALC295_FIXUP_HP_PAVILION_X360] = { + .type = HDA_FIXUP_VERBS, + .v.verbs = (const struct hda_verb []) { +/* force amp gain and processing state */ + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x07 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x7770 }, + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x0d }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x3000 }, + {} + }, + .chained = true, + .chain_id =ALC295_FIXUP_HP_X360 + }, [ALC221_FIXUP_HP_HEADSET_MIC] = { .type = HDA_FIXUP_PINS, .v.pins = (const struct hda_pintbl []) {
@@ -6729,6 +6743,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x103c ,0x82c0 ,"HP G3 mini premium" ,ALC221_FIXUP_HP_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x103c ,0x83b9 ,"HP Spectre x360" ,ALC269_FIXUP_HP_MUTE_LED_MIC3 ),SND_PCI_QUIRK (0x103c ,0x841c ,"HP Pavilion 15-CK0xx" ,ALC269_FIXUP_HP_MUTE_LED_MIC3 ), +HDA_CODEC_QUIRK (0x103c ,0x8486 ,"HP Pavilion x360" ,ALC295_FIXUP_HP_PAVILION_X360 ),SND_PCI_QUIRK (0x103c ,0x8497 ,"HP Envy x360" ,ALC269_FIXUP_HP_MUTE_LED_MIC3 ),SND_PCI_QUIRK (0x103c ,0x84a6 ,"HP 250 G7 Notebook PC" ,ALC269_FIXUP_HP_LINE1_MIC1_LED ), SND_PCI_QUIRK(0x103c, 0x84ae, "HP 15-db0403ng", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 535/1250 wifi: iwlwifi: bound aligned TLV advance in FW parser
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
[ Upstream commit acad742714bdc70e7fd7f234323807c596828213 ]
Validate ALIGN(tlv_len, 4) against remaining parser length before consuming bytes from the firmware image.
This avoids length underflow on malformed TLVs.
--- drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
drivers/net/wireless/intel/iwlwifi/iwl-drv.c +11 -2
@@ -803,6 +803,7 @@ static int iwl_parse_tlv_firmware(struct iwl_drv *drv,u32 build, paging_mem_size;int num_of_cpus;bool usniffer_req = false; +size_t aligned_tlv_len;if (len <sizeof (*ucode)) {IWL_ERR (drv,"uCode has invalid length: %zd\n" , len);
@@ -851,8 +852,16 @@ static int iwl_parse_tlv_firmware(struct iwl_drv *drv, len, tlv_len);return -EINVAL ; } - len -=ALIGN (tlv_len,4 ); - data +=sizeof (*tlv) +ALIGN (tlv_len,4 ); + + aligned_tlv_len =ALIGN (tlv_len,4 ); +if (len < aligned_tlv_len) { +IWL_ERR (drv,"invalid aligned TLV len: %zd/%zu\n" , + len, aligned_tlv_len); +return -EINVAL ; + } + + len -= aligned_tlv_len; + data +=sizeof (*tlv) + aligned_tlv_len;switch (tlv_type) {case IWL_UCODE_TLV_INST :
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 536/1250 ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel C. Ribeiro <[email protected]>
[ Upstream commit f6d6a4147ace0c417035f65b021027c209c75190 ]
JBL Quantum650 Wireless (0ecb:2125) requires the same workaround that was used for JBL Quantum610 and Quantum810 for limiting the sample rate. Without it, the capture (microphone) stream fails to work. Setting the QUIRK_FLAG_FIXED_RATE flag, as done for the sibling models, makes both playback and capture work correctly.
--- sound/usb/quirks.c | 2 ++ 1 file changed, 2 insertions(+)
sound/usb/quirks.c +2 -0
@@ -2273,6 +2273,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIXER_PLAYBACK_MIN_MUTE),DEVICE_FLG (0x0ecb ,0x205c ,/* JBL Quantum610 Wireless */ QUIRK_FLAG_FIXED_RATE ), +DEVICE_FLG (0x0ecb ,0x2125 ,/* JBL Quantum650 Wireless */ +QUIRK_FLAG_FIXED_RATE ),DEVICE_FLG (0x0ecb ,0x2069 ,/* JBL Quantum810 Wireless */ QUIRK_FLAG_FIXED_RATE ), DEVICE_FLG(0x0fd9, 0x0008, /* Hauppauge HVR-950Q */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 537/1250 wifi: iwlwifi: acpi: validate WGDS table revision index
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
[ Upstream commit 954e821f42aaca56073ca830c5fd4bcf1a89048c ]
Check tbl_rev bounds before BIT(tbl_rev) to avoid undefined shifts when firmware reports an invalid revision value.
--- drivers/net/wireless/intel/iwlwifi/fw/acpi.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/wireless/intel/iwlwifi/fw/acpi.c +5 -0
@@ -761,6 +761,11 @@ int iwl_acpi_get_wgds_table(struct iwl_fw_runtime *fwrt) min_size, max_size, &tbl_rev);if (!IS_ERR (wifi_pkg)) { +if (tbl_rev <0 || + tbl_rev >=BITS_PER_BYTE * +sizeof (rev_data[idx].revisions)) +continue ; +if (!(BIT (tbl_rev) & rev_data[idx].revisions))continue ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 538/1250 ALSA: hda/realtek: Add HDA_CODEC_QUIRK for Samsung 750XBE/730XBE
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Heng <[email protected]>
[ Upstream commit 740b3c6780ec1f65aba2bc99a3f41d70bdb13477 ]
Add a codec SSID quirk for Samsung ELECTRONICS 750XBE/730XBE using HDA_CODEC_QUIRK() instead of SND_PCI_QUIRK(), because the alsa-info report from this device does not expose a PCI subsystem ID, only the HDA codec subsystem ID (0x144d:0xc824) is available.
This applies ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET to fix sound being very low and distorted on the headphone jack of this system.
--- sound/hda/codecs/realtek/alc269.c | 1 + 1 file changed, 1 insertion(+)
sound/hda/codecs/realtek/alc269.c +1 -0
@@ -7271,6 +7271,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x144d ,0xc1a6 ,"Samsung Galaxy Book Pro 360 (NP930QBD)" ,ALC298_FIXUP_SAMSUNG_AMP ),SND_PCI_QUIRK (0x144d ,0xc740 ,"Samsung Ativ book 8 (NP870Z5G)" ,ALC269_FIXUP_ATIV_BOOK_8 ),SND_PCI_QUIRK (0x144d ,0xc812 ,"Samsung Notebook Pen S (NT950SBE-X58)" ,ALC298_FIXUP_SAMSUNG_AMP ), +HDA_CODEC_QUIRK (0x144d ,0xc824 ,"Samsung ELECTRONICS (750XBE/730XBE)" ,ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET ),SND_PCI_QUIRK (0x144d ,0xc830 ,"Samsung Galaxy Book Ion (NT950XCJ-X716A)" ,ALC298_FIXUP_SAMSUNG_AMP ),SND_PCI_QUIRK (0x144d ,0xc832 ,"Samsung Galaxy Book Flex Alpha (NP730QCJ)" ,ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET ), SND_PCI_QUIRK(0x144d, 0xc876, "Samsung 730QED (NP730QED-KA2US)", ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 539/1250 wifi: mwifiex: replace one-element arrays with flexible array members
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Georgi Valkov <[email protected]>
[ Upstream commit 1cb5845a58d8e1f85d5766c6fbcbfddf96c212a1 ]
Replace deprecated one-element arrays with flexible array members. CONFIG_FORTIFY_SOURCE reports the following warning when one-element arrays are used as variable-length buffers:
sta_cmd.c:1033 mwifiex_sta_prepare_cmd
memcpy: detected field-spanning write (size 84) of single field "domain->triplet" at .../marvell/mwifiex/sta_cmd.c:1033 (size 3)
Convert affected structs to use flexible array members.
- Preserve existing wire layouts.
- Use DECLARE_FLEX_ARRAY() for structs inside affected unions.
Tested-on: WRT3200ACM, OpenWrt
--- drivers/net/wireless/marvell/mwifiex/fw.h | 18 +++++++++--------- drivers/net/wireless/marvell/mwifiex/join.c | 8 ++++---- drivers/net/wireless/marvell/mwifiex/sta_cmd.c | 2 +- 3 files changed, 14 insertions(+), 14 deletions(-)
drivers/net/wireless/marvell/mwifiex/fw.h +9 -9
@@ -823,7 +823,7 @@ struct chan_band_param_set {struct mwifiex_ie_types_chan_band_list_param_set {struct mwifiex_ie_types_header header; -struct chan_band_param_set chan_band_param[1 ]; +struct chan_band_param_set chan_band_param[]; } __packed;struct mwifiex_ie_types_rates_param_set {
@@ -886,7 +886,7 @@ struct mwifiex_ie_types_wildcard_ssid_params {#define TSF_DATA_SIZE 8struct mwifiex_ie_types_tsf_timestamp {struct mwifiex_ie_types_header header; -u8 tsf_data[1 ]; +u8 tsf_data[]; } __packed;struct mwifiex_cf_param_set {
@@ -903,8 +903,8 @@ struct mwifiex_ibss_param_set {struct mwifiex_ie_types_ss_param_set {struct mwifiex_ie_types_header header;union { -struct mwifiex_cf_param_set cf_param_set[1 ]; -struct mwifiex_ibss_param_set ibss_param_set[1 ]; + DECLARE_FLEX_ARRAY(struct mwifiex_cf_param_set, cf_param_set); + DECLARE_FLEX_ARRAY(struct mwifiex_ibss_param_set, ibss_param_set); } cf_ibss; } __packed;
@@ -922,8 +922,8 @@ struct mwifiex_ds_param_set {struct mwifiex_ie_types_phy_param_set {struct mwifiex_ie_types_header header;union { -struct mwifiex_fh_param_set fh_param_set[1 ]; -struct mwifiex_ds_param_set ds_param_set[1 ]; + DECLARE_FLEX_ARRAY(struct mwifiex_fh_param_set, fh_param_set); + DECLARE_FLEX_ARRAY(struct mwifiex_ds_param_set, ds_param_set); } fh_ds; } __packed;
@@ -1383,7 +1383,7 @@ struct host_cmd_ds_802_11_snmp_mib {__le16 query_type;__le16 oid;__le16 buf_size; -u8 value[1 ]; +u8 value[]; } __packed;struct mwifiex_rate_scope {
@@ -1551,7 +1551,7 @@ struct mwifiex_scan_cmd_config {* TLV_TYPE_CHANLIST, mwifiex_ie_types_chan_list_param_set * WLAN_EID_SSID, mwifiex_ie_types_ssid_param_set */ -u8 tlv_buf[1 ];/* SSID TLV(s) and ChanList TLVs are stored +u8 tlv_buf[];/* SSID TLV(s) and ChanList TLVs are stored here */ } __packed;
@@ -1683,7 +1683,7 @@ struct host_cmd_ds_802_11_bg_scan_query_rsp {struct mwifiex_ietypes_domain_param_set {struct mwifiex_ie_types_header header;u8 country_code[IEEE80211_COUNTRY_STRING_LEN ]; -struct ieee80211_country_ie_triplet triplet[1 ]; +struct ieee80211_country_ie_triplet triplet[]; } __packed;struct host_cmd_ds_802_11d_domain_info {
drivers/net/wireless/marvell/mwifiex/join.c +4 -4
@@ -421,15 +421,15 @@ int mwifiex_cmd_802_11_associate(struct mwifiex_private *priv, phy_tlv = (struct mwifiex_ie_types_phy_param_set *) pos; phy_tlv->header.type =cpu_to_le16 (WLAN_EID_DS_PARAMS ); - phy_tlv->header.len =cpu_to_le16 (sizeof (phy_tlv->fh_ds.ds_param_set)); -memcpy (&phy_tlv->fh_ds.ds_param_set, + phy_tlv->header.len =cpu_to_le16 (sizeof (*phy_tlv->fh_ds.ds_param_set)); +memcpy (phy_tlv->fh_ds.ds_param_set, &bss_desc->phy_param_set.ds_param_set.current_chan, -sizeof (phy_tlv->fh_ds.ds_param_set)); +sizeof (*phy_tlv->fh_ds.ds_param_set)); pos +=sizeof (phy_tlv->header) +le16_to_cpu (phy_tlv->header.len); ss_tlv = (struct mwifiex_ie_types_ss_param_set *) pos; ss_tlv->header.type =cpu_to_le16 (WLAN_EID_CF_PARAMS ); - ss_tlv->header.len =cpu_to_le16 (sizeof (ss_tlv->cf_ibss.cf_param_set)); + ss_tlv->header.len =cpu_to_le16 (sizeof (*ss_tlv->cf_ibss.cf_param_set)); pos +=sizeof (ss_tlv->header) +le16_to_cpu (ss_tlv->header.len);/* Get the common rates supported between the driver and the BSS Desc */
drivers/net/wireless/marvell/mwifiex/sta_cmd.c +1 -1
@@ -108,7 +108,7 @@ static int mwifiex_cmd_802_11_snmp_mib(struct mwifiex_private *priv, "cmd: SNMP_CMD: cmd_oid = 0x%x\n", cmd_oid); cmd->command =cpu_to_le16 (HostCmd_CMD_802_11_SNMP_MIB); cmd->size =cpu_to_le16 (sizeof (struct host_cmd_ds_802_11_snmp_mib ) - -1 +S_DS_GEN ); + +S_DS_GEN ); snmp_mib->oid =cpu_to_le16 ((u16 )cmd_oid);if (cmd_action == HostCmd_ACT_GEN_GET) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 540/1250 smb: client: bound dirent name against end of SMB response in cifs_filldir
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jay Vadayath <[email protected]>
[ Upstream commit f8cf09a53a0dc1da298e9dd0ba5f21710cf119d6 ]
cifs_filldir() copies the entry name out of an SMB1 TRANS2_FIND_FIRST / FIND_NEXT response using a length (de.namelen) supplied by the server. The kmalloc'd SMB response buffer is bounded, but nothing checks that de.name + de.namelen still lies inside that buffer before the eventual filldir64() -> verify_dirent_name() -> memchr() reads namelen bytes.
A hostile SMB1 server that returns an oversized FileNameLength in a directory entry therefore causes memchr() to read past the end of the response slab buffer. Reachable from any user who can list a directory on a CIFS mount served by an attacker-controlled server (getdents64() on the mounted directory):
BUG: KASAN: slab-out-of-bounds in memchr+0x71/0x80 Read of size 1 at addr ffff88800e0640cc by task poc/115 Call Trace: dump_stack_lvl+0x64/0x80 print_report+0xce/0x620 kasan_report+0xec/0x120 memchr+0x71/0x80 filldir64+0x4c/0x6a0 cifs_filldir.constprop.0+0x9bb/0x1e00 cifs_readdir+0x2101/0x3380 iterate_dir+0x19c/0x520 __x64_sys_getdents64+0x126/0x210 do_syscall_64+0x107/0x5a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Pass the end-of-response pointer down to cifs_filldir() and reject entries whose name would extend past that boundary.
This bug was discovered by Artiphishell's vTriage pipeline, which generated a userspace reproducer (an emulated hostile SMB1 server plus a getdents64() client) that reliably triggers the KASAN report on an unpatched kernel. The fix below was drafted with the Claude coding assistant; a userspace reproducer is available on request.
--- fs/smb/client/readdir.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
fs/smb/client/readdir.c +7 -2
@@ -949,7 +949,7 @@ static bool cifs_dir_emit(struct dir_context *ctx,static int cifs_filldir (char *find_entry,struct file *file,struct dir_context *ctx,char *scratch_buf,unsigned int max_len, -struct cached_fid *cfid) +char *end_of_smb,struct cached_fid *cfid) {struct cifsFileInfo *file_info = file->private_data;struct super_block *sb =file_inode (file)->i_sb;
@@ -970,6 +970,11 @@ static int cifs_filldir(char *find_entry, struct file *file,return -EINVAL ; } +if (de.name + de.namelen > end_of_smb) { +cifs_dbg (VFS ,"search entry name extends past end of SMB\n" ); +return -EINVAL ; + } +/* skip . and .. since we added them first */ if (cifs_entry_is_dot (&de, file_info->srch_inf.unicode))return 0 ;
@@ -1190,7 +1195,7 @@ int cifs_readdir(struct file *file, struct dir_context *ctx)*/ *tmp_buf =0 ; rc =cifs_filldir (current_entry, file, ctx, - tmp_buf, max_len, cfid); + tmp_buf, max_len, end_of_smb, cfid);if (rc) {if (rc >0 ) rc =0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 541/1250 regulator: core: clamp voltage constraints before applying apply_uV
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kamal Wadhwa <[email protected]>
[ Upstream commit a45cc646a3aa83eb4ab4c7ed2685785ea51dc5e6 ]
machine_constraints_voltage() currently applies apply_uV against the machine-supplied [min_uV, max_uV] range, and only afterwards clamps that range down to what the regulator can actually supply (via ops->list_voltage()).
If the machine-supplied range is wider than the regulator's actual range, apply_uV's rounding can pick a selector outside the (correct) clamped range, so the regulator ends up programmed outside its clamped min/max. At bring-up this shows up as a voltage read-back outside the clamped range.
Fix this by moving the clamping block ahead of the apply_uV block, so apply_uV always targets an already-clamped range. Whether apply_uV should run is decided from the unclamped constraints beforehand and stored in a local bool, since clamping must not itself change whether apply_uV fires.
No functional change to the clamping logic itself, only its position relative to apply_uV. Its early return 0 exits become fallthroughs since the apply_uV logic now follows it.
--- drivers/regulator/core.c | 163 +++++++++++++++++++++------------------ 1 file changed, 90 insertions(+), 73 deletions(-)
drivers/regulator/core.c +90 -73
@@ -1205,10 +1205,98 @@ static int machine_constraints_voltage(struct regulator_dev *rdev, {const struct regulator_ops *ops = rdev->desc->ops;int ret; +bool apply_uV; + +/* +* Decide up front, from the constraints as handed to us, whether +* apply_uV needs to run below. The clamping pass right after this +* may rewrite constraints->min_uV/max_uV (e.g. the fixed-voltage +* autoconfigure case), and we don't want that to change whether +* apply_uV fires. +*/ + apply_uV = rdev->constraints->apply_uV && + rdev->constraints->min_uV && rdev->constraints->max_uV; + +/* +* Constrain machine-level voltage specs to fit the actual range +* supported by this regulator before apply_uV (below) tries to +* force hardware to a value from that range: otherwise apply_uV +* can target a constraint value that doesn't correspond to any +* real voltage selector and fail registration outright, even +* though the clamping pass would have narrowed it to a value +* the regulator can actually hit. +*/ +if (ops->list_voltage && rdev->desc->n_voltages) { +int count = rdev->desc->n_voltages; +int i; +int min_uV =INT_MAX ; +int max_uV =INT_MIN ; +int cmin = constraints->min_uV; +int cmax = constraints->max_uV; + +/* it's safe to autoconfigure fixed-voltage supplies +* and the constraints are used by list_voltage. +*/ +if (count ==1 && !cmin) { + cmin =1 ; + cmax =INT_MAX ; + constraints->min_uV = cmin; + constraints->max_uV = cmax; + } + +/* voltage constraints are optional */ +if ((cmin ==0 ) && (cmax ==0 )) { +/* nothing more to do */ + +/* else require explicit machine-level constraints */ + }else if (cmin <=0 || cmax <=0 || cmax < cmin) { +rdev_err (rdev,"invalid voltage constraints\n" ); +return -EINVAL ; + +/* no need to loop voltages if range is continuous */ + }else if (rdev->desc->continuous_voltage_range) { +/* nothing more to do */ + + }else { +/* initial: [cmin..cmax] valid, [min_uV..max_uV] not */ +for (i =0 ; i < count; i++) { +int value; + + value = ops->list_voltage (rdev, i); +if (value <=0 ) +continue ; + +/* maybe adjust [min_uV..max_uV] */ +if (value >= cmin && value < min_uV) + min_uV = value; +if (value <= cmax && value > max_uV) + max_uV = value; + } + +/* final: [min_uV..max_uV] valid iff constraints valid */ +if (max_uV < min_uV) { +rdev_err (rdev, +"unsupportable voltage constraints %u-%uuV\n" , + min_uV, max_uV); +return -EINVAL ; + } + +/* use regulator's subset of machine constraints */ +if (constraints->min_uV < min_uV) { +rdev_dbg (rdev,"override min_uV, %d -> %d\n" , + constraints->min_uV, min_uV); + constraints->min_uV = min_uV; + } +if (constraints->max_uV > max_uV) { +rdev_dbg (rdev,"override max_uV, %d -> %d\n" , + constraints->max_uV, max_uV); + constraints->max_uV = max_uV; + } + } + }/* do we need to apply the constraint voltage */ -if (rdev->constraints->apply_uV && - rdev->constraints->min_uV && rdev->constraints->max_uV) { +if (apply_uV) {int target_min, target_max;int current_uV =regulator_get_voltage_rdev (rdev);
@@ -1263,77 +1351,6 @@ static int machine_constraints_voltage(struct regulator_dev *rdev, } } -/* constrain machine-level voltage specs to fit -* the actual range supported by this regulator. -*/ -if (ops->list_voltage && rdev->desc->n_voltages) { -int count = rdev->desc->n_voltages; -int i; -int min_uV =INT_MAX ; -int max_uV =INT_MIN ; -int cmin = constraints->min_uV; -int cmax = constraints->max_uV; - -/* it's safe to autoconfigure fixed-voltage supplies -* and the constraints are used by list_voltage. -*/ -if (count ==1 && !cmin) { - cmin =1 ; - cmax =INT_MAX ; - constraints->min_uV = cmin; - constraints->max_uV = cmax; - } - -/* voltage constraints are optional */ -if ((cmin ==0 ) && (cmax ==0 )) -return 0 ; - -/* else require explicit machine-level constraints */ -if (cmin <=0 || cmax <=0 || cmax < cmin) { -rdev_err (rdev,"invalid voltage constraints\n" ); -return -EINVAL ; - } - -/* no need to loop voltages if range is continuous */ -if (rdev->desc->continuous_voltage_range) -return 0 ; - -/* initial: [cmin..cmax] valid, [min_uV..max_uV] not */ -for (i =0 ; i < count; i++) { -int value; - - value = ops->list_voltage (rdev, i); -if (value <=0 ) -continue ; - -/* maybe adjust [min_uV..max_uV] */ -if (value >= cmin && value < min_uV) - min_uV = value; -if (value <= cmax && value > max_uV) - max_uV = value; - } - -/* final: [min_uV..max_uV] valid iff constraints valid */ -if (max_uV < min_uV) { -rdev_err (rdev, -"unsupportable voltage constraints %u-%uuV\n" , - min_uV, max_uV); -return -EINVAL ; - } - -/* use regulator's subset of machine constraints */ -if (constraints->min_uV < min_uV) { -rdev_dbg (rdev,"override min_uV, %d -> %d\n" , - constraints->min_uV, min_uV); - constraints->min_uV = min_uV; - } -if (constraints->max_uV > max_uV) { -rdev_dbg (rdev,"override max_uV, %d -> %d\n" , - constraints->max_uV, max_uV); - constraints->max_uV = max_uV; - } - } -return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 542/1250 wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ibrahim Hashimov <[email protected]>
[ Upstream commit 3dc723ac78a6e4fa0fd49e27e487ed319da40a9f ]
hwsim_tx_info_frame_received_nl() casts the HWSIM_ATTR_TX_INFO payload to a struct hwsim_tx_rate * and unconditionally reads IEEE80211_TX_MAX_RATES entries (8 bytes) from it. The policy only bounds the attribute from above (NLA_BINARY .len is a maximum) and the op sets GENL_DONT_VALIDATE_STRICT, so a short or zero-length attribute is accepted and the loop reads past the payload.
Require the exact length in the policy, so a malformed attribute is rejected before the handler runs.
--- drivers/net/wireless/virtual/mac80211_hwsim.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/wireless/virtual/mac80211_hwsim.c +3 -3
@@ -912,9 +912,9 @@ static const struct nla_policy hwsim_genl_policy[HWSIM_ATTR_MAX + 1] = { [HWSIM_ATTR_FLAGS] = { .type = NLA_U32 }, [HWSIM_ATTR_RX_RATE] = { .type = NLA_U32 }, [HWSIM_ATTR_SIGNAL] = { .type = NLA_U32 }, - [HWSIM_ATTR_TX_INFO] = { .type = NLA_BINARY, - .len =IEEE80211_TX_MAX_RATES * - sizeof(struct hwsim_tx_rate)}, + [HWSIM_ATTR_TX_INFO ] = +NLA_POLICY_EXACT_LEN (IEEE80211_TX_MAX_RATES * + sizeof(struct hwsim_tx_rate)), [HWSIM_ATTR_COOKIE] = { .type = NLA_U64 }, [HWSIM_ATTR_CHANNELS] = { .type = NLA_U32 }, [HWSIM_ATTR_RADIO_ID] = { .type = NLA_U32 },
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 543/1250 ksmbd: preserve VFS inherited POSIX ACL mask
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
[ Upstream commit e148e567a9252643baa125cb65d7ae9c2c6cf68a ]
The VFS initializes a child's POSIX ACL from the parent's default ACL and the requested creation mode. Do not mutate the parent ACL or overwrite the child's VFS-computed access and default ACLs afterwards.
This preserves restrictive ACL_MASK entries and prevents SMB object creation from widening effective permissions.
--- fs/smb/server/vfs.c | 26 +------------------------- 1 file changed, 1 insertion(+), 25 deletions(-)
fs/smb/server/vfs.c +1 -25
@@ -1971,10 +1971,6 @@ int ksmbd_vfs_inherit_posix_acl(struct mnt_idmap *idmap, const struct path *path, struct inode *parent_inode) { struct posix_acl *acls; -struct posix_acl_entry *pace; -struct dentry *dentry = path->dentry; -struct inode *inode =d_inode (dentry); -int rc, i;if (!IS_ENABLED (CONFIG_FS_POSIX_ACL ))return -EOPNOTSUPP ;
@@ -1982,27 +1978,7 @@ int ksmbd_vfs_inherit_posix_acl(struct mnt_idmap *idmap, acls =get_inode_acl (parent_inode,ACL_TYPE_DEFAULT );if (IS_ERR_OR_NULL (acls))return -ENOENT ; - pace = acls->a_entries; - -for (i =0 ; i < acls->a_count; i++, pace++) { -if (pace->e_tag ==ACL_MASK ) { - pace->e_perm =0x07 ; -break ; - } - } - - rc =set_posix_acl (idmap, dentry,ACL_TYPE_ACCESS , acls); -if (rc <0 ) -ksmbd_debug (SMB ,"Set posix acl(ACL_TYPE_ACCESS) failed, rc : %d\n" , - rc); -if (S_ISDIR (inode->i_mode)) { - rc =set_posix_acl (idmap, dentry,ACL_TYPE_DEFAULT , - acls); -if (rc <0 ) -ksmbd_debug (SMB ,"Set posix acl(ACL_TYPE_DEFAULT) failed, rc : %d\n" , - rc); - }posix_acl_release (acls); -return rc; +return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 544/1250 drm/gma500: return errors from Oaktrail HDMI I2C reads
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit 9b5ce5c496efd20c1c662cedba88465d39ec1f93 ]
xfer_read() waits for the HDMI I2C transaction to reach I2C_TRANSACTION_DONE, but it ignores both timeout and signal returns from wait_for_completion_interruptible_timeout(). If the interrupt never advances the transaction state, the loop can wait forever.
Return -ETIMEDOUT when the completion wait expires, propagate interrupted waits, and make the I2C master_xfer callback return the first transfer error instead of reporting a successful message count.
--- drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-)
drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c +16 -5
@@ -95,6 +95,7 @@ static int xfer_read(struct i2c_adapter *adap, struct i2c_msg *pmsg)struct oaktrail_hdmi_dev *hdmi_dev =i2c_get_adapdata (adap);struct hdmi_i2c_dev *i2c_dev = hdmi_dev->i2c_dev;u32 temp; +int ret; i2c_dev->status =I2C_STAT_INIT ; i2c_dev->msg = pmsg;
@@ -106,9 +107,14 @@ static int xfer_read(struct i2c_adapter *adap, struct i2c_msg *pmsg)HDMI_WRITE (HDMI_HI2CHCR , temp);HDMI_READ (HDMI_HI2CHCR ); -while (i2c_dev->status !=I2C_TRANSACTION_DONE ) -wait_for_completion_interruptible_timeout (&i2c_dev->complete, +while (i2c_dev->status !=I2C_TRANSACTION_DONE ) { + ret =wait_for_completion_interruptible_timeout (&i2c_dev->complete,10 *HZ ); +if (ret <0 ) +return ret; +if (!ret) +return -ETIMEDOUT ; + }return 0 ; }
@@ -127,7 +133,7 @@ static int oaktrail_hdmi_i2c_access(struct i2c_adapter *adap, {struct oaktrail_hdmi_dev *hdmi_dev =i2c_get_adapdata (adap);struct hdmi_i2c_dev *i2c_dev = hdmi_dev->i2c_dev; -int i; +int i, ret =0 ;mutex_lock (&i2c_dev->i2c_lock);
@@ -139,9 +145,11 @@ static int oaktrail_hdmi_i2c_access(struct i2c_adapter *adap,for (i =0 ; i < num; i++) {if (pmsg->len && pmsg->buf) {if (pmsg->flags &I2C_M_RD ) -xfer_read (adap, pmsg); + ret =xfer_read (adap, pmsg);else -xfer_write (adap, pmsg); + ret =xfer_write (adap, pmsg); +if (ret) +break ; } pmsg++;/* next message */ }
@@ -151,6 +159,9 @@ static int oaktrail_hdmi_i2c_access(struct i2c_adapter *adap,mutex_unlock (&i2c_dev->i2c_lock); +if (ret) +return ret; +return i; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 545/1250 phonet: check register_netdevice_notifier() error in phonet_device_init()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Minhong He <[email protected]>
[ Upstream commit d1ff66b66151c14b084e88040512a064b1c1e493 ]
phonet_device_init() registers a netdevice notifier before calling phonet_netlink_register(), but does not check whether notifier registration succeeded. On failure, netlink setup still proceeds and init may return success without the notifier in place.
Also, the existing phonet_netlink_register() failure path called phonet_device_exit(), which runs rtnl_unregister_all() even though rtnl_register_many() already unwound any partial registration. Calling the full exit helper on a partial init is not correct.
Check each registration error, including proc_create_net(), and unwind only the steps that have succeeded so far, in reverse order.
--- net/phonet/pn_dev.c | 30 ++++++++++++++++++++++++------ 1 file changed, 24 insertions(+), 6 deletions(-)
net/phonet/pn_dev.c +24 -6
@@ -350,16 +350,34 @@ static struct pernet_operations phonet_net_ops = {/* Initialize Phonet devices list */ int __init phonet_device_init (void ) { -int err =register_pernet_subsys (&phonet_net_ops); +int err; + + err =register_pernet_subsys (&phonet_net_ops);if (err)return err; -proc_create_net ("pnresource" ,0 , init_net.proc_net, &pn_res_seq_ops, -sizeof (struct seq_net_private )); -register_netdevice_notifier (&phonet_device_notifier); +if (!proc_create_net ("pnresource" ,0 , init_net.proc_net, + &pn_res_seq_ops,sizeof (struct seq_net_private ))) { + err = -ENOMEM ; + goto err_pernet; + } + + err =register_netdevice_notifier (&phonet_device_notifier); +if (err) + goto err_proc; + err =phonet_netlink_register ();if (err) -phonet_device_exit (); + goto err_notifier; + +return 0 ; + +err_notifier: +unregister_netdevice_notifier (&phonet_device_notifier); +err_proc: +remove_proc_entry ("pnresource" , init_net.proc_net); +err_pernet: +unregister_pernet_subsys (&phonet_net_ops);return err; }
@@ -367,8 +385,8 @@ void phonet_device_exit(void) {rtnl_unregister_all (PF_PHONET );unregister_netdevice_notifier (&phonet_device_notifier); -unregister_pernet_subsys (&phonet_net_ops);remove_proc_entry ("pnresource" , init_net.proc_net); +unregister_pernet_subsys (&phonet_net_ops); }int phonet_route_add (struct net_device *dev,u8 daddr)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 546/1250 ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Markus Lindner <[email protected]>
[ Upstream commit acd8aa3c4b91a38c8521000790890bc9d1083f1d ]
The Razer Barracuda X 2.4 GHz USB headset dongle (0x1532:0x0552) reports a minimum volume register value of cval->min = -16800.
In UAC 1/256 dB units, -16800 corresponds to -65.625 dB. However, stock ALSA misinterprets this raw integer as 1/100 dB units (-168.00 dB), causing user-space audio servers (PipeWire / PulseAudio) to map their volume curves against an incorrectly wide range.
Add an explicit usbmix_dB_map entry overriding Unit 2 to -6562 (-65.62 dB) to accurately report the physical hardware attenuation bounds.
--- sound/usb/mixer_maps.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
sound/usb/mixer_maps.c +15 -0
@@ -344,6 +344,16 @@ static const struct usbmix_name_map bose_soundlink_map[] = { { 0 } /* terminator */ }; +/* +* Razer Barracuda X 2.4: Firmware reports cval->min = -16800 in 1/256 dB units +* (-65.62 dB), which stock ALSA misinterprets as a -168 dB floor +*/ +static const struct usbmix_dB_map razer_barracuda_x_2_4_dB = {-6562 ,0 }; +static const struct usbmix_name_map razer_barracuda_x_2_4_map[] = { + {2 ,NULL , .dB = &razer_barracuda_x_2_4_dB }, + {0 }/* terminator */ +}; +/* Sennheiser Communications Headset [PC 8], the dB value is reported as -6 negative maximum */ static const struct usbmix_dB_map sennheiser_pc8_dB = {-9500 ,0 };static const struct usbmix_name_map sennheiser_pc8_map[] = {
@@ -689,6 +699,11 @@ static const struct usbmix_ctl_map usbmix_ctl_maps[] = { .id = USB_ID(0x17aa, 0x1046), .map = lenovo_p620_rear_map, }, + { +/* Razer Barracuda X 2.4 */ + .id = USB_ID(0x1532, 0x0552), + .map = razer_barracuda_x_2_4_map, + }, {/* Sennheiser Communications Headset [PC 8] */ .id = USB_ID(0x1395, 0x0025),
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 547/1250 ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Madhavender Singh <[email protected]>
[ Upstream commit bf4fc9f33ec21595143132a3e7fb8b5d2c2261cd ]
This laptop with an ALC236 codec requires theALC236_FIXUP_HP_MUTE_LED_COEFBIT2
fixup for its mute LED to function correctly.
Add the subsystem ID 0x103c:0x86c8 to the quirk table to apply this fixup.
--- sound/hda/codecs/realtek/alc269.c | 1 + 1 file changed, 1 insertion(+)
sound/hda/codecs/realtek/alc269.c +1 -0
@@ -6762,6 +6762,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x103c ,0x869d ,"HP" ,ALC236_FIXUP_HP_MUTE_LED ),SND_PCI_QUIRK (0x103c ,0x86c1 ,"HP Laptop 15-da3001TU" ,ALC236_FIXUP_HP_MUTE_LED_COEFBIT2 ),SND_PCI_QUIRK (0x103c ,0x86c7 ,"HP Envy AiO 32" ,ALC274_FIXUP_HP_ENVY_GPIO ), +SND_PCI_QUIRK (0x103c ,0x86c8 ,"HP Laptop 14s-dr1xxx" ,ALC236_FIXUP_HP_MUTE_LED_COEFBIT2 ),SND_PCI_QUIRK (0x103c ,0x86e7 ,"HP Spectre x360 15-eb0xxx" ,ALC285_FIXUP_HP_SPECTRE_X360_EB1 ),SND_PCI_QUIRK (0x103c ,0x863e ,"HP Spectre x360 15-df1xxx" ,ALC285_FIXUP_HP_SPECTRE_X360_DF1 ), SND_PCI_QUIRK(0x103c, 0x86e8, "HP Spectre x360 15-eb0xxx", ALC285_FIXUP_HP_SPECTRE_X360_EB1),
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 548/1250 ice: pass the return value of skb_checksum_help()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Swiatkowski <[email protected]>
[ Upstream commit 2d19302f628853742c4828381abbd668c1315598 ]
skb_checksum_help() can fail. Pass its return value back to the caller.
Commonize this software path in goto.
Instead of just returning error try calculating software checksum first. There is a check for TSO in checksum_sw_fb.
--- drivers/net/ethernet/intel/ice/ice_txrx.c | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-)
drivers/net/ethernet/intel/ice/ice_txrx.c +9 -11
@@ -2081,7 +2081,7 @@ int ice_tx_csum(struct ice_tx_buf *first, struct ice_tx_offload_params *off) ret =ipv6_skip_exthdr (skb, exthdr - skb->data, &l4_proto, &frag_off);if (ret <0 ) -return -1 ; + goto checksum_sw_fb; }/* define outer transport */
@@ -2100,11 +2100,7 @@ int ice_tx_csum(struct ice_tx_buf *first, struct ice_tx_offload_params *off) l4.hdr =skb_inner_network_header (skb);break ;default : -if (first->tx_flags &ICE_TX_FLAGS_TSO ) -return -1 ; - -skb_checksum_help (skb); -return 0 ; + goto checksum_sw_fb; }/* compute outer L3 header size */
@@ -2163,7 +2159,7 @@ int ice_tx_csum(struct ice_tx_buf *first, struct ice_tx_offload_params *off)ipv6_skip_exthdr (skb, exthdr - skb->data, &l4_proto, &frag_off); }else { -return -1 ; + goto checksum_sw_fb; }/* compute inner L3 header size */
@@ -2216,15 +2212,17 @@ int ice_tx_csum(struct ice_tx_buf *first, struct ice_tx_offload_params *off)break ;default : -if (first->tx_flags &ICE_TX_FLAGS_TSO ) -return -1 ; -skb_checksum_help (skb); -return 0 ; + goto checksum_sw_fb; } off->td_cmd |= cmd; off->td_offset |= offset;return 1 ; + +checksum_sw_fb: +if (first->tx_flags &ICE_TX_FLAGS_TSO ) +return -1 ; +return skb_checksum_help (skb); }/**
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 549/1250 powerpc/pseries: Ensure vpa,slb_shadow & dtl are unregistered during crash
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vaibhav Jain <[email protected]>
[ Upstream commit 810d07fb4cf7577847f85a6fd6273b69cad8d580 ]
Currently pseries_kexec_cpu_down() skips unregistering vpa, slb_shadow and dtl areas during a crash and kexec shutdown path. It was done to avoid doing an HCALL while crashing. However recently Anushree reported that during kernel crash while the kdump kernel was coming up, Hypervisor reported invalid values for 'vpa.yield_count' while it dispatching L2-KVM Guest vcpus. The error manifested as debug build Hypervisor assert triggering to indicate possible VPA corruption.
Looking at the kexec cpu offline path it was discovered that during crash kernel doesn't unregister the VPA/SLB-Shadow/DTL area with Hypervisor. Instead it re-allocates and re-registers these areas for cpus during boot. During kexec boot the previously allocated areas can get overwritten with new content without hypervisor knowledge. This creates a small window where while kexec kernel boots and the L2-VCPUs are being dispatched, Hypervisor may try to read/write to a wrong memory area which previously belonged to older VPA.
Fix this possible race and memory corruption by updating pseries_kexec_cpu_down() to also unregister vpa,slb_shadow & dtl areas during a kernel crash.
--- arch/powerpc/platforms/pseries/kexec.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
arch/powerpc/platforms/pseries/kexec.c +8 -5
@@ -20,12 +20,15 @@void pseries_kexec_cpu_down (int crash_shutdown,int secondary) {/* -* Don't risk a hypervisor call if we're crashing -* XXX: Why? The hypervisor is not crashing. It might be better -* to at least attempt unregister to avoid the hypervisor stepping -* on our memory. +* Ensure vpa/slb_shadow/dtl cleanup even while we are crashing. +* Why? The hypervisor is not crashing so at least attempt unregister to +* avoid the hypervisor stepping on our memory. If hypervisor or kexec +* kernel steps on the old memory allocated to these areas before the +* new kexec-kernel happens to allocate and register new areas, +* the hypervisor will see invalid content which may cause +* unexpected behavior. */ -if (firmware_has_feature (FW_FEATURE_SPLPAR ) && !crash_shutdown) { +if (firmware_has_feature (FW_FEATURE_SPLPAR )) {int ret;int cpu =smp_processor_id ();int hwcpu =hard_smp_processor_id ();
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 550/1250 cifs: validate idmap key payload length
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Qiang <[email protected]>
[ Upstream commit 455488cd5054bcc59db40fa1cc2c004031a5b2a5 ]
The cifs.idmap key type stores its payload length in key->datalen, which is limited to U16_MAX. Accepting a larger key payload truncates the recorded length and can make later users interpret the payload using inconsistent bounds.
Reject oversized preparsed payloads before allocating or copying them. This keeps key->datalen consistent with the stored data for both inline and separately allocated idmap payloads.
--- fs/smb/client/cifsacl.c | 3 +++ 1 file changed, 3 insertions(+)
fs/smb/client/cifsacl.c +3 -0
@@ -69,6 +69,9 @@ cifs_idmap_key_instantiate(struct key *key, struct key_preparsed_payload *prep) {char *payload; +if (prep->datalen >U16_MAX ) +return -EINVAL ; +/* * If the payload is less than or equal to the size of a pointer, then * an allocation here is wasteful. Just copy the data directly to the
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 551/1250 wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepanshu Kartikey <[email protected]>
[ Upstream commit a2f5286ca4f304d3fd469f01b96b518608912a5c ]
The KASAN allocation trace shows that a malformed IE buffer is stored via SIOCSIWGENIE (cfg80211_wext_siwgenie()) without any validation. The crash trace shows that a subsequent SIOCSIWESSID triggers a connection attempt which calls cfg80211_sme_get_conn_ies() to process the stored IE buffer, causing:
- An out-of-bounds read in skip_ie() which reads ies[pos+1] (the length byte) past the end of the 1-byte buffer.
- An integer underflow in the memcpy size argument when offs returned by ieee80211_ie_split() exceeds ies_len, causing unsigned subtraction to wrap to SIZE_MAX and triggering a fortify panic.
Fix this by validating the IE buffer in cfg80211_wext_siwgenie() before storing it.
--- net/wireless/wext-sme.c | 9 +++++++++ 1 file changed, 9 insertions(+)
net/wireless/wext-sme.c +9 -0
@@ -319,6 +319,15 @@ int cfg80211_wext_siwgenie(struct net_device *dev,return 0 ;if (ie_len) { +const struct element *elem; + +for_each_element (elem, extra, ie_len) { +/* nothing */ + } + +if (!for_each_element_completed (elem, extra, ie_len)) +return -EINVAL ; + ie =kmemdup (extra, ie_len,GFP_KERNEL );if (!ie)return -ENOMEM ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 552/1250 Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiale Yao <[email protected]>
[ Upstream commit b230e5bf501c5edaf2eb0991cb862ac142031d4b ]
rfcomm_recv_frame() casts skb->data to struct rfcomm_hdr and dereferences hdr->addr and hdr->ctrl without validating skb->len first. A truncated frame with skb->len less than the minimum header size causes an out-of-bounds read of uninitialized memory. Additionally, a zero-length frame causes skb->len-- to underflow to UINT_MAX, making skb_tail_pointer() read far past the buffer.
Commit 23882b828c3c ("Bluetooth: RFCOMM: validate skb length in MCC handlers") fixed the same class of missing-length-check bugs in the MCC sub-handlers, but the top-level rfcomm_recv_frame() was left unfixed. KMSAN reports:
BUG: KMSAN: uninit-value in rfcomm_run
...
Uninit was created at:
__alloc_skb+0x474/0xb60
vhci_write+0xe9/0x870Fix this by rejecting frames smaller than sizeof(struct rfcomm_hdr) + 1 (the minimum frame must have a 3-byte header and a 1-byte FCS).
--- net/bluetooth/rfcomm/core.c | 5 +++++ 1 file changed, 5 insertions(+)
net/bluetooth/rfcomm/core.c +5 -0
@@ -1817,6 +1817,11 @@ static struct rfcomm_session *rfcomm_recv_frame(struct rfcomm_session *s,return s; } +if (skb->len <sizeof (*hdr) +1 ) { +kfree_skb (skb); +return s; + } + dlci =__get_dlci (hdr->addr); type =__get_type (hdr->ctrl);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 553/1250 ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision)
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robert Abrahamse <[email protected]>
[ Upstream commit cee046679655b4822f76efc9658f19efee9ac979 ]
Add USB mixer mapping quirk for later revisions of the Corsair Virtuoso headset with USB IDs 0x1b1c:0x0a43 (wired) and 0x1b1c:0x0a44 (wireless). These devices exhibit the same mixer label collision as earlier Virtuoso variants: all controls are labelled "Headset", causing applications like PulseAudio to move the sidetone control instead of the main playback volume.
--- sound/usb/mixer_maps.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
sound/usb/mixer_maps.c +10 -0
@@ -638,6 +638,16 @@ static const struct usbmix_ctl_map usbmix_ctl_maps[] = { .id = USB_ID(0x1b1c, 0x0a42), .map = corsair_virtuoso_map, }, + { + /* Corsair Virtuoso (wired mode, later revision) */ + .id = USB_ID(0x1b1c, 0x0a43), + .map = corsair_virtuoso_map, + }, + { + /* Corsair Virtuoso (wireless mode, later revision) */ + .id = USB_ID(0x1b1c, 0x0a44), + .map = corsair_virtuoso_map, + }, { /* Corsair HS80 RGB Wireless (wired mode) */ .id = USB_ID(0x1b1c, 0x0a6a),
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 554/1250 ata: libata-core: Disable LPM on some WD drives
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <[email protected]>
[ Upstream commit 356d8241cf3c7b07a4a491dbab43b5a41513ca86 ]
According to a user report WDC WD100EFGX-68CPLN0 and WDC WD102KFBX-68M95N0 have problems with LPM.
--- drivers/ata/libata-core.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/ata/libata-core.c +8 -0
@@ -4372,6 +4372,14 @@ static const struct ata_dev_quirks_entry __ata_dev_quirks[] = { { "WDC WD3000JD-*", NULL, ATA_QUIRK_WD_BROKEN_LPM }, { "WDC WD3200JD-*", NULL, ATA_QUIRK_WD_BROKEN_LPM }, +/* +* WD drives with LPM issues (irrespective of supported SATA speeds). +* (Unlike ATA_QUIRK_WD_BROKEN_LPM, which is only applied if the drive +* exposes SATA Gen1 speed support, and SATA Gen1 speed support only.) +*/ + { "WDC WD100EFGX-68CPLN0", NULL, ATA_QUIRK_NOLPM }, + { "WDC WD102KFBX-68M95N0", NULL, ATA_QUIRK_NOLPM }, +/* * This sata dom device goes on a walkabout when the ATA_LOG_DIRECTORY * log page is accessed. Ensure we never ask for this log page with
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 555/1250 ALSA: hda/realtek: Add mute LED quirk for HP Victus 16-e0xxx (MB 88ED)
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: André Pragosa <[email protected]>
[ Upstream commit 630c45e92db44b738d1e9224c5f3c032c76a33ca ]
Add subsystem ID 103c:88ed to the existing HP Victus 16-e0xxx mute LED quirk list.
The HP Victus 16-e0xxx with subsystem ID 103c:88ed uses the same mute LED coefficient configuration as the already supported 103c:88eb variant.
The mute LED was verified by manually toggling coefficient index 0x0b (bit 3) using hda-verb. After adding the quirk, the LED is registered as hda::mute and follows the audio mute state.
--- sound/hda/codecs/realtek/alc269.c | 2 ++ 1 file changed, 2 insertions(+)
sound/hda/codecs/realtek/alc269.c +2 -0
@@ -6831,6 +6831,8 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x103c ,0x88d1 ,"HP Pavilion 15-eh1xxx (mainboard 88D1)" ,ALC245_FIXUP_HP_MUTE_LED_V1_COEFBIT ),SND_PCI_QUIRK (0x103c ,0x88dd ,"HP Pavilion 15z-ec200" ,ALC285_FIXUP_HP_MUTE_LED ),SND_PCI_QUIRK (0x103c ,0x88eb ,"HP Victus 16-e0xxx" ,ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT ), +SND_PCI_QUIRK (0x103c ,0x88ed ,"HP Victus 16-e0xxx (MB 88ED)" , +ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT ),SND_PCI_QUIRK (0x103c ,0x88ee ,"HP Victus 16-e0xxx (MB 88EE)" ,ALC245_FIXUP_HP_MUTE_LED_COEFBIT ),SND_PCI_QUIRK (0x103c ,0x8902 ,"HP OMEN 16" ,ALC285_FIXUP_HP_MUTE_LED ), SND_PCI_QUIRK(0x103c, 0x890e, "HP 255 G8 Notebook PC", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 556/1250 ata: libata-core: Disable LPM on WD Green 2.5 480GB
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <[email protected]>
[ Upstream commit d549df8a0ace611bff0a336a907f93420648b462 ]
According to a user report, the WD Green 2.5 480GB has problems with LPM.
--- drivers/ata/libata-core.c | 1 + 1 file changed, 1 insertion(+)
drivers/ata/libata-core.c +1 -0
@@ -4379,6 +4379,7 @@ static const struct ata_dev_quirks_entry __ata_dev_quirks[] = {*/ { "WDC WD100EFGX-68CPLN0", NULL, ATA_QUIRK_NOLPM }, { "WDC WD102KFBX-68M95N0", NULL, ATA_QUIRK_NOLPM }, + { "WD Green 2.5 480GB", NULL, ATA_QUIRK_NOLPM },/* * This sata dom device goes on a walkabout when the ATA_LOG_DIRECTORY
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 557/1250 Drivers: hv: vmbus: add VTL2 redirect connection ID
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hardik Garg <[email protected]>
[ Upstream commit 92d0593128023cf93ae61b7728dcc3062f8d514f ]
VMBus sends CHANNELMSG_INITIATE_CONTACT through a Hyper-V message connection ID. Older protocol versions use VMBUS_MESSAGE_CONNECTION_ID, while protocol version 5.0 and newer normally use VMBUS_MESSAGE_CONNECTION_ID_4.
For a VTL2 kernel using VMBus protocol 5.0 or newer, the host may expect INITIATE_CONTACT on either the redirect connection ID or VMBUS_MESSAGE_CONNECTION_ID_4. There is no capability indication that identifies which ID is active, so the driver must determine it at runtime.
During VMBus negotiation, the redirect ID is tried first because it is used by VTL2 configurations with VMBus redirection enabled. If the redirect ID is unavailable, the host rejects it synchronously with HV_STATUS_INVALID_CONNECTION_ID, allowing fallback to the standard ID.
Return a distinct error for an invalid Initiate Contact connection ID so this fallback does not mask other post-message failures or protocol-version rejections. Preserve the existing connection ID selection for older protocol versions or when running below VTL2.
--- drivers/hv/connection.c | 47 +++++++++++++++++++++++---------------- drivers/hv/hyperv_vmbus.h | 2 ++ 2 files changed, 30 insertions(+), 19 deletions(-)
drivers/hv/connection.c +28 -19
@@ -71,7 +71,8 @@ module_param(max_version, uint, S_IRUGO);MODULE_PARM_DESC (max_version,"Maximal VMBus protocol version which can be negotiated" ); -int vmbus_negotiate_version (struct vmbus_channel_msginfo *msginfo,u32 version) +static int vmbus_try_connection_id (struct vmbus_channel_msginfo *msginfo, +u32 version,u32 connection_id) {int ret =0 ;struct vmbus_channel_initiate_contact *msg;
@@ -86,20 +87,20 @@ int vmbus_negotiate_version(struct vmbus_channel_msginfo *msginfo, u32 version) msg->vmbus_version_requested = version;/* -* VMBus protocol 5.0 (VERSION_WIN10_V5) and higher require that we must -* use VMBUS_MESSAGE_CONNECTION_ID_4 for the Initiate Contact Message, -* and for subsequent messages, we must use the Message Connection ID -* field in the host-returned Version Response Message. And, with -* VERSION_WIN10_V5 and higher, we don't use msg->interrupt_page, but we -* tell the host explicitly that we still use VMBUS_MESSAGE_SINT(2) for -* compatibility. +* For VMBus protocol 5.0 (VERSION_WIN10_V5) and higher, use the +* caller-supplied connection_id for the Initiate Contact message so +* the caller can implement the required retry scheme. For subsequent +* messages, use the Message Connection ID field in the host-returned +* Version Response message. With VERSION_WIN10_V5 and higher, we don't +* use msg->interrupt_page, but tell the host explicitly that we still +* use VMBUS_MESSAGE_SINT(2) for compatibility. * * On old hosts, we should always use VMBUS_MESSAGE_CONNECTION_ID (1). */ if (version >=VERSION_WIN10_V5 ) { msg->msg_sint =VMBUS_MESSAGE_SINT ; msg->msg_vtl = ms_hyperv.vtl; - vmbus_connection.msg_conn_id =VMBUS_MESSAGE_CONNECTION_ID_4 ; + vmbus_connection.msg_conn_id = connection_id; }else { msg->interrupt_page =virt_to_phys (vmbus_connection.int_page); vmbus_connection.msg_conn_id =VMBUS_MESSAGE_CONNECTION_ID ;
@@ -161,6 +162,22 @@ int vmbus_negotiate_version(struct vmbus_channel_msginfo *msginfo, u32 version)return ret; } +int vmbus_negotiate_version (struct vmbus_channel_msginfo *msginfo,u32 version) +{ +int ret; + +/* Try the redirect ID first for VTL2 with VMBus protocol 5.0+. */ +if (version >=VERSION_WIN10_V5 && ms_hyperv.vtl ==2 ) { + ret =vmbus_try_connection_id (msginfo, version, +VMBUS_MESSAGE_CONNECTION_ID_REDIRECT ); +if (ret != -ENXIO ) +return ret; + } + +return vmbus_try_connection_id (msginfo, version, +VMBUS_MESSAGE_CONNECTION_ID_4 ); +} +/* * vmbus_connect - Sends a connect request on the partition service connection */
@@ -454,18 +471,10 @@ int vmbus_post_msg(void *buffer, size_t buflen, bool can_sleep)switch (ret) {case HV_STATUS_INVALID_CONNECTION_ID : -/* -* See vmbus_negotiate_version(): VMBus protocol 5.0 -* and higher require that we must use -* VMBUS_MESSAGE_CONNECTION_ID_4 for the Initiate -* Contact message, but on old hosts that only -* support VMBus protocol 4.0 or lower, here we get -* HV_STATUS_INVALID_CONNECTION_ID and we should -* return an error immediately without retrying. -*/ +/* Allow INITIATE_CONTACT to try another connection ID. */ hdr = buffer;if (hdr->msgtype ==CHANNELMSG_INITIATE_CONTACT ) -return -EINVAL ; +return -ENXIO ;/* * We could get this if we send messages too * frequently.
drivers/hv/hyperv_vmbus.h +2 -0
@@ -108,6 +108,8 @@ struct hv_input_post_message {enum {VMBUS_MESSAGE_CONNECTION_ID =1 ,VMBUS_MESSAGE_CONNECTION_ID_4 =4 , +/* VTL2 redirect connection ID for INITIATE_CONTACT. */ +VMBUS_MESSAGE_CONNECTION_ID_REDIRECT =0x800074 ,VMBUS_MESSAGE_PORT_ID =1 ,VMBUS_EVENT_CONNECTION_ID =2 ,VMBUS_EVENT_PORT_ID =2 ,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 558/1250 ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Heng <[email protected]>
[ Upstream commit 38417f5fc8e3323218c19bd7e419eec4fb0697bd ]
Add DMI quirk to enable ACP6x sound card for HP Victus by HP Laptop 16-e1xxx, which fixes microphone not working issue.
Without this quirk, the DMIC on acp6x device is not properly enabled, causing the microphone to not work.
--- sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/soc/amd/yc/acp6x-mach.c +7 -0
@@ -675,6 +675,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { DMI_MATCH(DMI_BOARD_NAME, "8E35"), } }, + { + .driver_data = &acp6x_card, + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"HP" ), + DMI_MATCH(DMI_PRODUCT_NAME, "Victus by HP Laptop 16-e1xxx"), + } + }, { .driver_data = &acp6x_card, .matches = {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 559/1250 vhost-scsi: flush backend after device ioctls
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jia Jia <[email protected]>
[ Upstream commit 22598f55a4c2b510b3df5e69e563387a963222ae ]
vhost-scsi translates guest response descriptors into userspace iovecs when commands are submitted. Target-core completes those commands asynchronously, so VHOST_SET_MEM_TABLE can replace the memory table while an in-flight command still retains response iovecs translated through the old table.
If the old mapping is reused after VHOST_SET_MEM_TABLE returns, command completion can write the response to an unrelated userspace object.
Flush the vhost-scsi backend after vhost_dev_ioctl() handles a device ioctl. This waits for in-flight commands that can still use the old response iovecs before the ioctl returns.
Message-ID: <[email protected]>
--- drivers/vhost/scsi.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/vhost/scsi.c +2 -1
@@ -2448,9 +2448,10 @@ vhost_scsi_ioctl(struct file *f,default :mutex_lock (&vs->dev.mutex); r =vhost_dev_ioctl (&vs->dev, ioctl, argp); -/* TODO: flush backend after dev ioctl. */ if (r == -ENOIOCTLCMD ) r =vhost_vring_ioctl (&vs->dev, ioctl, argp); +else +vhost_scsi_flush (vs);mutex_unlock (&vs->dev.mutex);return r; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 560/1250 hwmon: (corsair-psu) Fix linear11 calculation
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit c6c4234928d2eb4f61fecb61067e612d9bdbd2ff ]
In corsairpsu_linear11_to_int(), the mantissa is extracted using bitwise operations and cast to s16 before being shifted left:
static int corsairpsu_linear11_to_int(const u16 val, const int scale)
{
...
const int mant = (((s16)(val & 0x7ff)) << 5) >> 5;
...
}Due to C integer promotion rules, the masked value (which is always positive) is promoted to a 32-bit integer before the left shift. As a result, the sign bit is never extended to bit 31 of the promoted integer.
When the device hardware reports a negative temperature in Linear11 format (such as an ambient temperature probe reporting sub-zero), the negative mantissa is parsed incorrectly as a massive positive value. For example, -1 becomes 2047, which scales to 2047 degrees Celsius.
Fix the problem by type casting the result of the left shift operation to s16.
Another problem is left-shifting of negative values. In C, the result of left-shifting negative values is undefined. Use a multiplication instead to avoid the problem.
Also use a local s64 variable to store temporary results, change the return value type from int to long, and clamp the final value to LONG_MIN and LONG_MAX to avoid under- and overflow issues while retaining as much information as possible.
--- drivers/hwmon/corsair-psu.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-)
drivers/hwmon/corsair-psu.c +14 -9
@@ -140,13 +140,18 @@ struct corsairpsu_data { };/* some values are SMBus LINEAR11 data which need a conversion */ -static int corsairpsu_linear11_to_int (const u16 val,const int scale) +static long corsairpsu_linear11_to_long (const u16 val,const int scale) {const int exp = ((s16 )val) >>11 ; -const int mant = (((s16)(val &0x7ff )) <<5 ) >>5 ; -const int result = mant * scale; +const int mant = ((s16)((val &0x7ff ) <<5 )) >>5 ; +s64 result = mant * scale; -return (exp >=0 ) ? (result << exp) : (result >> -exp); +if (exp >=0 ) + result *= (int )(1UL << exp); +else + result >>= -exp; + +return clamp (result,LONG_MIN ,LONG_MAX ); }/* the micro-controller uses percentage values to control pwm */
@@ -271,13 +276,13 @@ static int corsairpsu_get_value(struct corsairpsu_data *priv, u8 cmd, u8 rail, lcase PSU_CMD_RAIL_AMPS :case PSU_CMD_TEMP0 :case PSU_CMD_TEMP1 : - *val =corsairpsu_linear11_to_int (tmp &0xFFFF ,1000 ); + *val =corsairpsu_linear11_to_long (tmp &0xFFFF ,1000 );break ;case PSU_CMD_FAN : - *val =corsairpsu_linear11_to_int (tmp &0xFFFF ,1 ); + *val =corsairpsu_linear11_to_long (tmp &0xFFFF ,1 );break ;case PSU_CMD_FAN_PWM_ENABLE : - *val =corsairpsu_linear11_to_int (tmp &0xFFFF ,1 ); + *val =corsairpsu_linear11_to_long (tmp &0xFFFF ,1 );/* * 0 = automatic mode, means the micro-controller controls the fan using a plan * which can be modified, but changing this plan is not supported by this
@@ -291,12 +296,12 @@ static int corsairpsu_get_value(struct corsairpsu_data *priv, u8 cmd, u8 rail, l *val =2 ;break ;case PSU_CMD_FAN_PWM : - *val =corsairpsu_linear11_to_int (tmp &0xFFFF ,1 ); + *val =corsairpsu_linear11_to_long (tmp &0xFFFF ,1 ); *val =corsairpsu_dutycycle_to_pwm (*val);break ;case PSU_CMD_RAIL_WATTS :case PSU_CMD_TOTAL_WATTS : - *val =corsairpsu_linear11_to_int (tmp &0xFFFF ,1000000 ); + *val =corsairpsu_linear11_to_long (tmp &0xFFFF ,1000000 );break ;case PSU_CMD_TOTAL_UPTIME :case PSU_CMD_UPTIME :
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 561/1250 ata: libata-core: Disable LPM on WDC WD141KFGX-68FH9N0
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <[email protected]>
[ Upstream commit 3971921a055330669b281962ff723d1abb76a58c ]
According to a user report, WDC WD141KFGX-68FH9N0 has problems with LPM.
--- drivers/ata/libata-core.c | 1 + 1 file changed, 1 insertion(+)
drivers/ata/libata-core.c +1 -0
@@ -4379,6 +4379,7 @@ static const struct ata_dev_quirks_entry __ata_dev_quirks[] = {*/ { "WDC WD100EFGX-68CPLN0", NULL, ATA_QUIRK_NOLPM }, { "WDC WD102KFBX-68M95N0", NULL, ATA_QUIRK_NOLPM }, + { "WDC WD141KFGX-68FH9N0", NULL, ATA_QUIRK_NOLPM }, { "WD Green 2.5 480GB", NULL, ATA_QUIRK_NOLPM },/*
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 562/1250 spi: dw: fix wrong RX_SAMPLE_DLY setting after resume
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jisheng Zhang <[email protected]>
[ Upstream commit 133c71b2c0bc976a4751f9e05ef7cdea67f964e5 ]
On platforms which need a non-zero rx sample delay, the RX_SAMPLE_DLY reg setting is lost after resume. The reason is that the reg may be reset to 0 after resuming, but dws->cur_rx_sample_dly doesn't know this fact. Fix this issue by clearing dws->cur_rx_sample_dly in dw_spi_shutdown_chip().
--- drivers/spi/spi-dw.h | 1 + 1 file changed, 1 insertion(+)
drivers/spi/spi-dw.h +1 -0
@@ -283,6 +283,7 @@ static inline void dw_spi_shutdown_chip(struct dw_spi *dws)dw_spi_enable_chip (dws,0 );dw_spi_set_clk (dws,0 ); dws->current_freq =0 ; + dws->cur_rx_sample_dly =0 ; }extern void dw_spi_set_cs (struct spi_device *spi,bool enable);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 563/1250 ASoC: rt5645: Perform the initial jack detect at probe
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rudi Heitbaum <[email protected]>
[ Upstream commit 54b279699279411c77c8afbc73b83c70740a7303 ]
The only initial jack detect is the rt5645_irq(0, rt5645) at the end of rt5645_set_jack_detect(). A card described with simple-audio-card has no machine driver to call that, so jack state is only ever sampled from an edge on hp-detect-gpios.
A headphone already in the socket at boot is therefore never noticed, and the card is silent with every mixer control set correctly. rt5645_jack_detect() is what force enables the "LDO2" and "Mic Det Power" supplies that the "HP amp" widget depends on, and what programs RT5645_CHARGE_PUMP away from its reset value, so without it "HP amp" cannot power up. Unplugging and replugging the jack is the only way to recover.
Do the detect at the end of the component probe when the driver owns a hp-detect GPIO and the codec's own jack detect is unused, which is the case that has no other trigger. A machine driver calling rt5645_set_jack_detect() later just repeats it.
--- sound/soc/codecs/rt5645.c | 4 ++++ 1 file changed, 4 insertions(+)
sound/soc/codecs/rt5645.c +4 -0
@@ -3497,6 +3497,10 @@ static int rt5645_probe(struct snd_soc_component *component)if (!rt5645->eq_param)return -ENOMEM ; +/* no machine driver to call rt5645_set_jack_detect(), so detect here */ +if (!rt5645->pdata.jd_mode && rt5645->gpiod_hp_det) +rt5645_irq (0 , rt5645); +return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 564/1250 scsi: core: Do not block on tag allocation in scsi_eh_lock_door()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zizhi Wo <[email protected]>
[ Upstream commit 732cb6bb37fd26863d5786522fb1997e7f5865b4 ]
scsi_eh_lock_door() is called from scsi_restart_operations() while the host is still in the SHOST_RECOVERY state, i.e. before the host is switched back to SHOST_RUNNING and scsi_run_host_queues() restarts the queues. It allocates a request via scsi_alloc_request() with no flags, so blk_mq_get_tag() may block waiting for a free sched tag when all tags are already in use.
Those tags can be held by commands that were just requeued by scsi_eh_flush_done_q() during error handling. Such commands cannot be dispatched until the host leaves SHOST_RECOVERY and scsi_run_host_queues() is called - which only happens *after* scsi_eh_lock_door() returns.
This forms a circular dependency:
- scsi_eh_lock_door(), running in the SCSI error handler thread, waits
for a sched tag held by a requeued command;
- the requeued command cannot complete and release its sched tag until the error handler thread leaves scsi_restart_operations() and restart the queues.
For devices with a single driver tag (e.g. USB storage) it is a guaranteed deadlock and I/O that can never be submitted. This problem has also been reproduced in our environment.
Locking the door is a best-effort operation, and scsi_eh_lock_door() already returns silently when the request allocation fails. Pass BLK_MQ_REQ_NOWAIT to scsi_alloc_request() so the allocation fails instead of blocking when no tag is available. This breaks the circular dependency and allows the error handler to finish restarting the queues, after which the pending commands are dispatched normally.
--- drivers/scsi/scsi_error.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/scsi_error.c +1 -1
@@ -2157,7 +2157,7 @@ static void scsi_eh_lock_door(struct scsi_device *sdev)struct scsi_cmnd *scmd;struct request *req; - req =scsi_alloc_request (sdev->request_queue,REQ_OP_DRV_IN ,0 ); + req =scsi_alloc_request (sdev->request_queue,REQ_OP_DRV_IN ,BLK_MQ_REQ_NOWAIT );if (IS_ERR (req))return ; scmd =blk_mq_rq_to_pdu (req);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 565/1250 ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lin Xianglin <[email protected]>
[ Upstream commit fe21db8c5e7c2a9815a9be54a1f5d556f905506e ]
The HyperX OMEN Gaming Laptop 16-ap1xxx (HP board 8F06) has an internal digital microphone array attached to the AMD ACP PDM controller, but the acp6x machine driver does not register the DMIC sound card because this board is missing from the DMI quirk table, leaving the internal microphone unusable.
Add a DMI quirk entry for the HP board "8F06" so the acp6x DMIC capture card gets registered.
--- sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/soc/amd/yc/acp6x-mach.c +7 -0
@@ -675,6 +675,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { DMI_MATCH(DMI_BOARD_NAME, "8E35"), } }, + { + .driver_data = &acp6x_card, + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"HP" ), + DMI_MATCH(DMI_BOARD_NAME, "8F06"), + } + }, { .driver_data = &acp6x_card, .matches = {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 566/1250 netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 33d1469b0124cc0baaea7a2032123b77a81e0940 ]
sashiko reports: "nfnl_log_net_exit() calls nf_log_unset(), which clears the logger pointer without an RCU grace period. Immediately after, ops_free_list() frees the per-net state while concurrent packets might still be executing nf_log_packet() under rcu_read_lock()."
Clear the pointer via .pre_exit to make sure rcu readers have completed before pernet storage is free'd. The change in nf_log_syslog.c is only done for consistency: it doesn't use pernet data.
--- net/netfilter/nf_log_syslog.c | 4 ++-- net/netfilter/nfnetlink_log.c | 13 +++++++++---- 2 files changed, 11 insertions(+), 6 deletions(-)
net/netfilter/nf_log_syslog.c +2 -2
@@ -1006,7 +1006,7 @@ static int __net_init nf_log_syslog_net_init(struct net *net)return ret; } -static void __net_exit nf_log_syslog_net_exit(struct net *net) +static void __net_exit nf_log_syslog_net_pre_exit(struct net *net) {nf_log_unset (net, &nf_ip_logger);nf_log_unset (net, &nf_arp_logger);
@@ -1017,7 +1017,7 @@ static void __net_exit nf_log_syslog_net_exit(struct net *net)static struct pernet_operations nf_log_syslog_net_ops = { .init = nf_log_syslog_net_init, - .exit = nf_log_syslog_net_exit, + .pre_exit = nf_log_syslog_net_pre_exit, };static int __init nf_log_syslog_init (void )
net/netfilter/nfnetlink_log.c +9 -4
@@ -1160,21 +1160,26 @@ static int __net_init nfnl_log_net_init(struct net *net)return 0 ; } -static void __net_exit nfnl_log_net_exit(struct net *net) +static void __net_exit nfnl_log_net_pre_exit(struct net *net) { -struct nfnl_log_net *log =nfnl_log_pernet (net); -unsigned int i; -#ifdef CONFIG_PROC_FS remove_proc_entry ("nfnetlink_log" , net->nf.proc_netfilter);#endif nf_log_unset (net, &nfulnl_logger); +} + +static void __net_exit nfnl_log_net_exit(struct net *net) +{ +struct nfnl_log_net *log =nfnl_log_pernet (net); +unsigned int i; +for (i =0 ; i <INSTANCE_BUCKETS ; i++)WARN_ON_ONCE (!hlist_empty (&log->instance_table[i])); }static struct pernet_operations nfnl_log_net_ops = { .init = nfnl_log_net_init, + .pre_exit = nfnl_log_net_pre_exit, .exit = nfnl_log_net_exit, .id = &nfnl_log_net_id, .size =sizeof (struct nfnl_log_net ),
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 567/1250 bpftool: Strip all -Wformat* flags from bootstrap libbpf build
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Nakryiko <[email protected]>
[ Upstream commit a954c9e3168cdf0c3cad07b43dfc8ca2945d773a ]
Commit 9080b97689db ("bpftool: Pass host flags to bootstrap libbpf") started building the bootstrap libbpf with HOST_CFLAGS, stripping the warning options that are unsuitable for that build by filtering out -W -Wall -Wextra -Wformat -Wformat-signedness.
HOST_CFLAGS inherits EXTRA_WARNINGS, which includes -Wformat-security and -Wformat-y2k. The filter drops -Wall and -Wformat (the latter being what actually enables -Wformat), but leaves those two -Wformat-* children in LIBBPF_BOOTSTRAP_CFLAGS. Building the bootstrap libbpf with it then warns:
cc1: warning: '-Wformat-y2k' ignored without '-Wformat'
cc1: warning: '-Wformat-security' ignored without '-Wformat'
The warning is easy to miss in an in-tree build: tools/lib/bpf/Makefile re-adds -Wall via "override CFLAGS += -Wall", which re-enables -Wformat for the libbpf objects, so only libbpf's feature-detection probe (which uses the passed CFLAGS verbatim) leaks the two warnings. The standalone libbpf Makefile (github.com/libbpf/libbpf, used by the bpftool mirror) instead uses "CFLAGS ?= ... -Wall", which the passed-in CFLAGS overrides, so -Wall is never re-added and every bootstrap object warns.
Use a -Wformat% wildcard in the filter-out so the orphaned children are removed together with the parent.
--- tools/bpf/bpftool/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/bpf/bpftool/Makefile +1 -1
@@ -94,7 +94,7 @@ HOST_CFLAGS := $(subst -I$(LIBBPF_INCLUDE),-I$(LIBBPF_BOOTSTRAP_INCLUDE),\ HOST_LDFLAGS := $(LDFLAGS) # Remove warnings for libbpf bootstrap build -LIBBPF_BOOTSTRAP_CFLAGS := $(filter-out -W -Wall -Wextra -Wformat -Wformat-signedness,$(HOST_CFLAGS)) +LIBBPF_BOOTSTRAP_CFLAGS := $(filter-out -W -Wall -Wextra -Wformat%,$(HOST_CFLAGS)) INSTALL ?= install RM ?= rm -f
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 568/1250 ksmbd: remove stale channels from all sessions on teardown
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gil Portnoy <[email protected]>
[ Upstream commit b10665730fbf6b5e45fe422badcbbc3f0df96ef5 ]
ksmbd_sessions_deregister() removes a connection's channels from other sessions' channel lists only while conn->binding is still set:
if (conn->binding) {
hash_for_each_safe(sessions_table, ...)
ksmbd_chann_del(conn, sess);
}conn->binding is a transient flag: it is cleared once a binding SESSION_SETUP completes, and also by a subsequent non-binding SESSION_SETUP on the same connection (a reauthentication on a bound channel, or a new SessionId==0 setup). A connection that has bound a channel into another session's ksmbd_chann_list and then clears conn->binding leaves that channel behind when it disconnects: the channel, whose chann->conn points at the now freed struct ksmbd_conn, stays on the owner session's list.
When the owning connection later tears down, the second loop dereferences the stale channel:
xa_for_each(&sess->ksmbd_chann_list, chann_id, chann) if (chann->conn != conn) ksmbd_conn_set_exiting(chann->conn); /* freed */
which is a use-after-free write into the freed ksmbd_conn (the same stale channel is also walked by show_proc_session() through /proc). The session is leaked as well, because its channel list never empties.
Remove the conn->binding gate so a connection always removes its channels from every session on teardown.
--- fs/smb/server/mgmt/user_session.c | 25 +++++++++++-------------- 1 file changed, 11 insertions(+), 14 deletions(-)
fs/smb/server/mgmt/user_session.c +11 -14
@@ -247,22 +247,19 @@ void ksmbd_sessions_deregister(struct ksmbd_conn *conn) {struct ksmbd_session *sess;unsigned long id; +struct hlist_node *tmp; +int bkt;down_write (&sessions_table_lock); -if (conn->binding) { -int bkt; -struct hlist_node *tmp; - -hash_for_each_safe (sessions_table, bkt, tmp, sess, hlist) { -if (!ksmbd_chann_del (conn, sess) && -xa_empty (&sess->ksmbd_chann_list)) { -hash_del (&sess->hlist); -down_write (&conn->session_lock); -xa_erase (&conn->sessions, sess->id); -up_write (&conn->session_lock); -if (atomic_dec_and_test (&sess->refcnt)) -ksmbd_session_destroy (sess); - } +hash_for_each_safe (sessions_table, bkt, tmp, sess, hlist) { +if (!ksmbd_chann_del (conn, sess) && +xa_empty (&sess->ksmbd_chann_list)) { +hash_del (&sess->hlist); +down_write (&conn->session_lock); +xa_erase (&conn->sessions, sess->id); +up_write (&conn->session_lock); +if (atomic_dec_and_test (&sess->refcnt)) +ksmbd_session_destroy (sess); } }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 569/1250 iommu/arm-smmu-v3: Disable implementations during devm teardown
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Guan <[email protected]>
The Tegra241 CMDQV teardown fix moved VINTF hardware deinitialization into the implementation device_disable() callback. However, its stable backport preceded the conversion to devm teardown and could only invoke the callback from the shutdown path.
Now that arm_smmu_disable_action() manages normal teardown, invoke the implementation callback there while the command queue is still alive. This prevents the subsequent implementation remove action from releasing resources while the CMDQV hardware remains active.
After ("iommu/arm-smmu-v3: Manage teardown with devm") merged in stable, now keep the shutdown path consistent with mainline, where disabling the base SMMU is sufficient.
It is a fix for stable tree commit to aligned with mainline, so no upstream commit id here.
--- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +2 -2
@@ -4180,6 +4180,8 @@ static void arm_smmu_disable_action(void *data) {struct arm_smmu_device *smmu = data; +if (smmu->impl_ops && smmu->impl_ops->device_disable) + smmu->impl_ops->device_disable (smmu);arm_smmu_device_disable (smmu); }
@@ -4961,8 +4963,6 @@ static void arm_smmu_device_shutdown(struct platform_device *pdev) {struct arm_smmu_device *smmu =platform_get_drvdata (pdev); -if (smmu->impl_ops && smmu->impl_ops->device_disable) - smmu->impl_ops->device_disable (smmu);arm_smmu_device_disable (smmu); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 570/1250 wifi: mt76: mt7921: validate CLC firmware records
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laxman Acharya Padhya <[email protected]>
[ Upstream commit 9417c5818a0146980c2608fda94c908e604eb033 ]
The CLC region is supplied by firmware, but the loader trusts the region count and each record length. A malformed image can make the region table pointer precede the firmware buffer, make the record loop fail to advance, or index phy->clc past its end. Validate the table and record bounds before dereferencing or copying.
--- .../net/wireless/mediatek/mt76/mt7921/mcu.c | 28 ++++++++++++++++--- 1 file changed, 24 insertions(+), 4 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7921/mcu.c +24 -4
@@ -418,7 +418,8 @@ static int mt7921_load_clc(struct mt792x_dev *dev, const char *fw_name)struct mt76_dev *mdev = &dev->mt76;struct mt792x_phy *phy = &dev->phy;const struct firmware *fw; -int ret, i, len, offset =0 ; +size_t clc_len, fw_data_len, len, offset =0 ; +int ret, i;u8 *clc_base =NULL , hw_encap =0 ; dev->phy.clc_chan_conf =0xff ;
@@ -444,13 +445,21 @@ static int mt7921_load_clc(struct mt792x_dev *dev, const char *fw_name) } hdr = (const void *)(fw->data + fw->size -sizeof (*hdr)); +if (hdr->n_region > (fw->size -sizeof (*hdr)) /sizeof (*region)) { +dev_err (mdev->dev,"Invalid firmware region table\n" ); + ret = -EINVAL ; + goto out; + } + fw_data_len = fw->size -sizeof (*hdr) - + hdr->n_region *sizeof (*region); +for (i =0 ; i < hdr->n_region; i++) { region = (const void *)((const u8 *)hdr - (hdr->n_region - i) *sizeof (*region)); len =le32_to_cpu (region->len);/* check if we have valid buffer size */ -if (offset + len > fw->size) { +if (len > fw_data_len - offset) {dev_err (mdev->dev,"Invalid firmware region\n" ); ret = -EINVAL ; goto out;
@@ -467,8 +476,19 @@ static int mt7921_load_clc(struct mt792x_dev *dev, const char *fw_name)if (!clc_base) goto out; -for (offset =0 ; offset < len; offset +=le32_to_cpu (clc->len)) { +for (offset =0 ; offset < len; offset += clc_len) { +if (len - offset <sizeof (*clc)) { + ret = -EINVAL ; + goto out; + } + clc = (const struct mt7921_clc *)(clc_base + offset); + clc_len =le32_to_cpu (clc->len); +if (clc_len <sizeof (*clc) || clc_len > len - offset || + clc->idx >=ARRAY_SIZE (phy->clc)) { + ret = -EINVAL ; + goto out; + }/* do not init buf again if chip reset triggered */ if (phy->clc[clc->idx])
@@ -480,7 +500,7 @@ static int mt7921_load_clc(struct mt792x_dev *dev, const char *fw_name)continue ; phy->clc[clc->idx] =devm_kmemdup (mdev->dev, clc, -le32_to_cpu (clc->len), + clc_len,GFP_KERNEL );if (!phy->clc[clc->idx]) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 571/1250 wifi: mt76: mt7921: skip unknown CLC firmware records
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laxman Acharya Padhya <[email protected]>
[ Upstream commit 1a296bfd3e775e515233f746218824fc7dd5ff16 ]
Treat an out-of-range CLC index as newer firmware rather than a malformed image. linux-firmware 20260810 ships MT7922 records with idx 3, and rejecting them made mt7921e fail to probe.
Keep the record-length checks, and report those as errors so a truncated table is visible instead of a silent retry loop.
--- drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7921/mcu.c +7 -2
@@ -478,18 +478,23 @@ static int mt7921_load_clc(struct mt792x_dev *dev, const char *fw_name)for (offset =0 ; offset < len; offset += clc_len) {if (len - offset <sizeof (*clc)) { +dev_err (mdev->dev,"Invalid CLC record\n" ); ret = -EINVAL ; goto out; } clc = (const struct mt7921_clc *)(clc_base + offset); clc_len =le32_to_cpu (clc->len); -if (clc_len <sizeof (*clc) || clc_len > len - offset || - clc->idx >=ARRAY_SIZE (phy->clc)) { +if (clc_len <sizeof (*clc) || clc_len > len - offset) { +dev_err (mdev->dev,"Invalid CLC record\n" ); ret = -EINVAL ; goto out; } +/* Newer firmware may add records this driver does not use yet */ +if (clc->idx >=ARRAY_SIZE (phy->clc)) +continue ; +/* do not init buf again if chip reset triggered */ if (phy->clc[clc->idx])continue ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 572/1250 leds: st1202: Validate pattern input before stopping the sequence
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manuel Fombuena <[email protected]>
[ Upstream commit fd2529ba8fb44cd4b56f1069363b949644b42cec ]
Input validation for pattern duration is performed inside the write loop, after the pattern sequence has already been stopped. If validation fails mid-loop the chip is left with the sequence stopped and partially written pattern data, with no recovery.
Move all input validation before the mutex and before any hardware interaction, so an invalid input leaves the chip state unchanged.
--- drivers/leds/leds-st1202.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/leds/leds-st1202.c +6 -4
@@ -238,6 +238,12 @@ static int st1202_led_pattern_set(struct led_classdev *ldev,if (len >ST1202_MAX_PATTERNS )return -EINVAL ; +for (int patt =0 ; patt < len; patt++) { +if (pattern[patt].delta_t <ST1202_MILLIS_PATTERN_DUR_MIN || + pattern[patt].delta_t >ST1202_MILLIS_PATTERN_DUR_MAX ) +return -EINVAL ; + } +guard (mutex)(&chip->lock); ret =st1202_write_reg (chip,ST1202_CONFIG_REG ,ST1202_CONFIG_REG_SHFT );
@@ -245,10 +251,6 @@ static int st1202_led_pattern_set(struct led_classdev *ldev,return ret;for (int patt =0 ; patt < len; patt++) { -if (pattern[patt].delta_t <ST1202_MILLIS_PATTERN_DUR_MIN || - pattern[patt].delta_t >ST1202_MILLIS_PATTERN_DUR_MAX ) -return -EINVAL ; - ret =st1202_pwm_pattern_write (chip, led->led_num, patt, pattern[patt].brightness);if (ret !=0 )return ret;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 573/1250 Bluetooth: btrtl: Add the support for RTL8761CUV
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Chou <[email protected]>
[ Upstream commit 4a23ce935f74d19df48d1906497fad1cef391392 ]
Add support for RTL8761CUV BT controller on the USB interface. Do not apply IC_MATCH_FL_HCIVER when hci_ver is 0 in the ic_id_table.
The device info from /sys/kernel/debug/usb/devices as below.
T: Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 13 Spd=12 MxCh= 0 D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0bda ProdID=c761 Rev= 2.00 S: Manufacturer=Realtek S: Product=Bluetooth Controller S: SerialNumber=10000 C:* #Ifs= 2 Cfg#= 1 Atr=a0 MxPwr=100mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms
--- drivers/bluetooth/btrtl.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
drivers/bluetooth/btrtl.c +15 -1
@@ -72,6 +72,7 @@ enum btrtl_chip_id {CHIP_ID_8851B =36 ,CHIP_ID_8922A =44 ,CHIP_ID_8852BT =47 , + CHIP_ID_8761C = 51, }; struct id_table {
@@ -230,6 +231,14 @@ static const struct id_table ic_id_table[] = { .cfg_name = "rtl_bt/rtl8761bu_config", .hw_info = "rtl8761bu" }, +/* 8761CU */ + { IC_INFO(RTL_ROM_LMP_8761A, 0x0e, 0, HCI_USB), + .config_needed = false, + .has_rom_version = true, + .fw_name = "rtl_bt/rtl8761cu_fw", + .cfg_name = "rtl_bt/rtl8761cu_config", + .hw_info = "rtl8761cu" }, + /* 8822C with UART interface */ { IC_INFO(RTL_ROM_LMP_8822B, 0xc, 0x8, HCI_UART), .config_needed = true,
@@ -344,7 +353,8 @@ static const struct id_table *btrtl_match_ic(u16 lmp_subver, u16 hci_rev, (ic_id_table[i].hci_rev != hci_rev))continue ;if ((ic_id_table[i].match_flags &IC_MATCH_FL_HCIVER ) && - (ic_id_table[i].hci_ver != hci_ver)) + (ic_id_table[i].hci_ver != hci_ver) && + (ic_id_table[i].hci_ver !=0 ))continue ;if ((ic_id_table[i].match_flags &IC_MATCH_FL_HCIBUS ) && (ic_id_table[i].hci_bus != hci_bus))
@@ -662,6 +672,7 @@ static int rtlbt_parse_firmware(struct hci_dev *hdev, { RTL_ROM_LMP_8851B, 36 }, /* 8851B */ { RTL_ROM_LMP_8922A, 44 }, /* 8922A */ { RTL_ROM_LMP_8852A, 47 }, /* 8852BT */ + { RTL_ROM_LMP_8761A, 51 }, /* 8761C */ };if (btrtl_dev->fw_len <=8 )
@@ -1306,6 +1317,7 @@ void btrtl_set_quirks(struct hci_dev *hdev, struct btrtl_device_info *btrtl_dev)case CHIP_ID_8851B :case CHIP_ID_8922A :case CHIP_ID_8852BT : +case CHIP_ID_8761C :hci_set_quirk (hdev,HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED );/* RTL8852C needs to transmit mSBC data continuously without
@@ -1525,6 +1537,8 @@ MODULE_FIRMWARE("rtl_bt/rtl8761b_fw.bin");MODULE_FIRMWARE ("rtl_bt/rtl8761b_config.bin" );MODULE_FIRMWARE ("rtl_bt/rtl8761bu_fw.bin" );MODULE_FIRMWARE ("rtl_bt/rtl8761bu_config.bin" ); +MODULE_FIRMWARE ("rtl_bt/rtl8761cu_fw.bin" ); +MODULE_FIRMWARE ("rtl_bt/rtl8761cu_config.bin" );MODULE_FIRMWARE ("rtl_bt/rtl8821a_fw.bin" );MODULE_FIRMWARE ("rtl_bt/rtl8821a_config.bin" );MODULE_FIRMWARE ("rtl_bt/rtl8821c_fw.bin" );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 574/1250 ppp_async: drop the errored frame instead of resetting its headroom
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vlatko Kosturjak <[email protected]>
[ Upstream commit 8dc5d98a16fa23c00999aecf10018c9f69fa5bf4 ]
ppp_receive_nonmp_frame() prepends a two-byte direction tag before running the pass/active BPF filters:
*(__be16 *)skb_push(skb, 2) = htons(PPP_FILTER_INBOUND_TAG);
Nothing on the receive path guarantees those two bytes of headroom. The frame-error path in ppp_async's process_input_packet() resets a reused skb's headroom to zero while claiming to restore it to a freshly allocated state - but a fresh skb from dev_alloc_skb() carries NET_SKB_PAD:
err:
if (skb) {
/* make skb appear as freshly allocated */
skb_trim(skb, 0);
skb_reserve(skb, - skb_headroom(skb));
}ap->rpkt still points at that skb, so the next frame is reassembled into it with no headroom at all. A peer that sends a bad-FCS frame followed by one beginning ff 03 then leaves a single byte of headroom by the time the filter tag is pushed, which lands one byte below skb->head:
skbuff: skb_under_panic: len:49 put:2 head:ffff888003c10000
data:ffff888003c0ffff tail:0x30 end:0x640 dev:<NULL> kernel BUG at net/core/skbuff.c:214! RIP: 0010:skb_panic+0x13e/0x230 Call Trace: skb_push+0xbd/0x100 ppp_receive_nonmp_frame+0x48a/0x1d10 ppp_input+0x4e9/0x2f80 ppp_async_process+0x2a/0xe0 tasklet_action_common+0x20f/0x8a0 handle_softirqs+0x18e/0x590 Kernel panic - not syncing: Fatal exception in interrupt
Zeroing the headroom violates the NET_SKB_PAD guarantee that dev_alloc_skb() gives the rest of the receive path. Besides the filter panic above, when CCP compression is enabled ppp_decompress_frame() hands skb->data - 2 to ->decompress()/->incomp(), which then reads out of bounds before skb->head for the same reason.
Rather than restore the headroom, drop the errored frame - as ppp_synctty already does on its error path - and clear ap->rpkt so the next frame is reassembled into a fresh skb with proper headroom. This is simpler and fixes both the filter under-panic and the CCP out-of-bounds read.
The original V1 of this patch made room in ppp_receive_nonmp_frame() with skb_cow_head(); Eric pointed out that fixing the root cause in the transport is the right approach.
Found by fuzzing the PPP receive path with a mutating peer on a pty; it is an interesting (remote) DoS: root configures PPP, the peer supplies two crashing frames. The reproducer (repro-ppp-skb.c, unchanged from v1) panics in about a second, and returns cleanly with this applied.
--- drivers/net/ppp/ppp_async.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
drivers/net/ppp/ppp_async.c +2 -5
@@ -812,11 +812,8 @@ process_input_packet(struct asyncppp *ap) err:/* frame had an error, remember that, reset SC_TOSS & SC_ESCAPE */ ap->state =SC_PREV_ERROR ; -if (skb) { -/* make skb appear as freshly allocated */ -skb_trim (skb,0 ); -skb_reserve (skb, -skb_headroom (skb)); - } +kfree_skb (skb); + ap->rpkt =NULL ; }/* Called when the tty driver has data for us. Runs parallel with the
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 575/1250 drop_monitor: perform u64_stats updates under IRQ-disabled section
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit fd098a23bf8fda7eae48db9b06e7c34fc4d228fa ]
In net_dm_packet_trace_kfree_skb_hit() and net_dm_hw_trap_packet_probe(), u64_stats_update_begin() / u64_stats_inc() / u64_stats_update_end() were called after spin_unlock_irqrestore(&...drop_queue.lock, flags), when local IRQs had already been re-enabled.
Tracepoint probes can execute in IRQ or softirq context. On 32-bit architectures, u64_stats_update_begin() disables preemption but not interrupts, relying on seqcount writes. If a nested interrupt occurs on the same CPU during the 64-bit stats update, the reentrant seqcount update can corrupt the seqcount state or stats value.
Fix this by performing the 64-bit per-CPU stats update before releasing drop_queue.lock via spin_unlock_irqrestore(), ensuring local interrupts remain disabled during the u64_stats update.
--- net/core/drop_monitor.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/core/drop_monitor.c +2 -2
@@ -531,10 +531,10 @@ static void net_dm_packet_trace_kfree_skb_hit(void *ignore,return ; unlock_free: -spin_unlock_irqrestore (&data->drop_queue.lock, flags);u64_stats_update_begin (&data->stats.syncp);u64_stats_inc (&data->stats.dropped);u64_stats_update_end (&data->stats.syncp); +spin_unlock_irqrestore (&data->drop_queue.lock, flags);consume_skb (nskb); }
@@ -1002,10 +1002,10 @@ net_dm_hw_trap_packet_probe(void *ignore, const struct devlink *devlink,return ; unlock_free: -spin_unlock_irqrestore (&hw_data->drop_queue.lock, flags);u64_stats_update_begin (&hw_data->stats.syncp);u64_stats_inc (&hw_data->stats.dropped);u64_stats_update_end (&hw_data->stats.syncp); +spin_unlock_irqrestore (&hw_data->drop_queue.lock, flags);net_dm_hw_metadata_free (n_hw_metadata); free:consume_skb (nskb);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 576/1250 drop_monitor: fix size calculations for 64-bit attributes
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 7089f7ab99c89f443c92d8fcc585e63f2727f0b3 ]
net_dm_packet_report_fill() and net_dm_hw_packet_report_fill() use nla_put_u64_64bit() to append 64-bit attributes (NET_DM_ATTR_PC and NET_DM_ATTR_TIMESTAMP).
On 32-bit architectures without CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS, nla_put_u64_64bit() may append a 4-byte NET_DM_ATTR_PAD attribute for 64-bit alignment.
However, net_dm_packet_report_size() and net_dm_hw_packet_report_size() used nla_total_size(sizeof(u64)) instead of nla_total_size_64bit(sizeof(u64)), budgeting 12 bytes instead of up to 16 bytes.
This under-estimation of SKB size can lead to an skb_over_panic() when __nla_reserve() or skb_put() is subsequently called.
Fix this by using nla_total_size_64bit(sizeof(u64)) in both size calculations.
--- net/core/drop_monitor.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/core/drop_monitor.c +3 -3
@@ -567,13 +567,13 @@ static size_t net_dm_packet_report_size(size_t payload_len)/* NET_DM_ATTR_ORIGIN */ nla_total_size (sizeof (u16)) +/* NET_DM_ATTR_PC */ -nla_total_size (sizeof (u64)) + +nla_total_size_64bit (sizeof (u64)) +/* NET_DM_ATTR_SYMBOL */ nla_total_size (NET_DM_MAX_SYMBOL_LEN +1 ) +/* NET_DM_ATTR_IN_PORT */ net_dm_in_port_size () +/* NET_DM_ATTR_TIMESTAMP */ -nla_total_size (sizeof (u64)) + +nla_total_size_64bit (sizeof (u64)) +/* NET_DM_ATTR_ORIG_LEN */ nla_total_size (sizeof (u32)) + /* NET_DM_ATTR_PROTO */
@@ -769,7 +769,7 @@ net_dm_hw_packet_report_size(size_t payload_len,/* NET_DM_ATTR_FLOW_ACTION_COOKIE */ net_dm_flow_action_cookie_size (hw_metadata) +/* NET_DM_ATTR_TIMESTAMP */ -nla_total_size (sizeof (u64)) + +nla_total_size_64bit (sizeof (u64)) +/* NET_DM_ATTR_ORIG_LEN */ nla_total_size (sizeof (u32)) + /* NET_DM_ATTR_PROTO */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 577/1250 net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yehyeong Lee <[email protected]>
[ Upstream commit 5e9c8baee0329fbefe7c67aea945e2a07f15e98b ]
net_dm_packet_report_fill() and net_dm_hw_packet_report_fill() open code the NET_DM_ATTR_PAYLOAD attribute to avoid zeroing the packet payload before overwriting it with skb_copy_bits().
skb_put() reserves nla_total_size(payload_len), i.e. the header plus the NLA_ALIGN() padding, but only payload_len bytes are copied in. When payload_len is not a multiple of 4 the 1-3 padding bytes are never initialized and are leaked to user space inside the netlink message.
KMSAN confirms the leak for the software path when the packet payload length is not 4-byte aligned:
BUG: KMSAN: kernel-infoleak in _copy_to_iter _copy_to_iter __skb_datagram_iter skb_copy_datagram_iter netlink_recvmsg sock_recvmsg __sys_recvfrom Uninit was created at: kmem_cache_alloc_node_noprof __alloc_skb net_dm_packet_work Bytes 173-175 of 176 are uninitialized
Use __nla_reserve(), which sets up the attribute header and zeroes the padding, instead of open coding the attribute construction.
--- net/core/drop_monitor.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
net/core/drop_monitor.c +2 -6
@@ -672,9 +672,7 @@ static int net_dm_packet_report_fill(struct sk_buff *msg, struct sk_buff *skb,if (nla_put_u16 (msg,NET_DM_ATTR_PROTO ,be16_to_cpu (skb->protocol))) goto nla_put_failure; - attr =skb_put (msg,nla_total_size (payload_len)); - attr->nla_type =NET_DM_ATTR_PAYLOAD ; - attr->nla_len =nla_attr_size (payload_len); + attr =__nla_reserve (msg,NET_DM_ATTR_PAYLOAD , payload_len);if (skb_copy_bits (skb,0 ,nla_data (attr), payload_len)) goto nla_put_failure;
@@ -832,9 +830,7 @@ static int net_dm_hw_packet_report_fill(struct sk_buff *msg,if (nla_put_u16 (msg,NET_DM_ATTR_PROTO ,be16_to_cpu (skb->protocol))) goto nla_put_failure; - attr =skb_put (msg,nla_total_size (payload_len)); - attr->nla_type =NET_DM_ATTR_PAYLOAD ; - attr->nla_len =nla_attr_size (payload_len); + attr =__nla_reserve (msg,NET_DM_ATTR_PAYLOAD , payload_len);if (skb_copy_bits (skb,0 ,nla_data (attr), payload_len)) goto nla_put_failure;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 578/1250 tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang (Microsoft) <[email protected]>
[ Upstream commit 47f42ff521b4eeb46e82f9a46a4783a99f7570d7 ]
In tipc_recvmsg(), the copy length is computed as:
copy = min_t(int, dlen - offset, buflen);
buflen is size_t but min_t(int, ...) casts it to int. When buflen exceeds INT_MAX (e.g. 0xFFFFFFFF via io_uring provided buffers), it wraps negative, wins the comparison, and the negative copy length propagates to simple_copy_to_iter() where int-to-size_t promotion makes it SIZE_MAX, triggering a WARN_ON. tipc_recvstream() has the same pattern.
Kernel panic - not syncing: kernel: panic_on_warn set ... RIP: 0010:simple_copy_to_iter+0x9e/0xd0 (net/core/datagram.c:521) Call Trace: __skb_datagram_iter+0x123/0x8b0 (net/core/datagram.c:402) skb_copy_datagram_iter+0x77/0x1a0 (net/core/datagram.c:534) tipc_recvmsg+0x3d7/0xe80 (net/tipc/socket.c:1934) io_recvmsg+0x47e/0xda0
Fix by changing min_t(int, ...) to min_t(size_t, ...) in both functions. The result is always <= (dlen - offset), which is bounded by TIPC maximum message size (0x1ffff bytes), so the implicit narrowing on assignment to int copy is always safe.
--- net/tipc/socket.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/tipc/socket.c +2 -2
@@ -1935,7 +1935,7 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m,if (likely (!err)) {int offset = skb_cb->bytes_read; - copy =min_t (int, dlen - offset, buflen); + copy =min_t (size_t, dlen - offset, buflen); rc =skb_copy_datagram_msg (skb, hlen + offset, m, copy);if (unlikely (rc)) goto exit;
@@ -2067,7 +2067,7 @@ static int tipc_recvstream(struct socket *sock, struct msghdr *m,/* Copy data if msg ok, otherwise return error/partial data */ if (likely (!err)) { offset = skb_cb->bytes_read; - copy =min_t (int, dlen - offset, buflen - copied); + copy =min_t (size_t, dlen - offset, buflen - copied); rc =skb_copy_datagram_msg (skb, hlen + offset, m, copy);if (unlikely (rc))break ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 579/1250 drm/vc4: hvs/v3d: Fix null dereference in unbind
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregor Herburger <[email protected]>
[ Upstream commit 7dc3680b7ffe01add3e9299fde8471d2dd53a8ae ]
The hvs and v3d drivers use dev_get_drvdata(master) in their unbind functions. Since the vc4-drm gets removed before its dependent drivers (vc4_hvs/vc4_v3d) the vc4_hvs_unbind/vc4_v3d_unbind functions try to get drvdata of its master and fails with a null dereference error.
Use the data pointer passed to the unbind functions directly instead of dev_get_drvdata(master). This avoids using potentially freed memory.
--- drivers/gpu/drm/vc4/vc4_hvs.c | 2 +- drivers/gpu/drm/vc4/vc4_v3d.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/vc4/vc4_hvs.c +1 -1
@@ -1751,7 +1751,7 @@ static int vc4_hvs_bind(struct device *dev, struct device *master, void *data)static void vc4_hvs_unbind (struct device *dev,struct device *master,void *data) { -struct drm_device *drm =dev_get_drvdata (master); +struct drm_device *drm = data;struct vc4_dev *vc4 =to_vc4_dev (drm);struct vc4_hvs *hvs = vc4->hvs;struct drm_mm_node *node, *next;
drivers/gpu/drm/vc4/vc4_v3d.c +1 -1
@@ -492,7 +492,7 @@ static int vc4_v3d_bind(struct device *dev, struct device *master, void *data)static void vc4_v3d_unbind (struct device *dev,struct device *master,void *data) { -struct drm_device *drm =dev_get_drvdata (master); +struct drm_device *drm = data;struct vc4_dev *vc4 =to_vc4_dev (drm);vc4_irq_uninstall (drm);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 580/1250 bpf: Reject redirect helpers without a bpf_net_context
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
[ Upstream commit 3f4920d165b29052255527d8ae7619e7ec132ece ]
The bpf_redirect*() helpers and skb_do_redirect() obtain the per-task bpf_redirect_info via bpf_net_ctx_get_ri(), which dereferences the current->bpf_net_context unconditionally. That context is established on the paths that run tc BPF such as sch_handle_{ingress,egress}(), *except* for the case where {cls,act}_bpf was attached to a proper qdisc. A program running from there reaches the NULL deref in two ways:
* It calls bpf_redirect() directly, which dereferences the context at the top of the helper:
tc qdisc add dev eth0 root handle 1: red limit 1MB min 10KB max 20KB \
avpkt 1000 burst 100 qevent early_drop block 10
tc filter add block 10 pref 1 bpf obj redirect.o
* It simply returns TC_ACT_REDIRECT without helper call: tcf_qevent_handle() then dispatches to skb_do_redirect(), which dereferences the context
Rather than extending bpf_net_context management into the qdisc path, make the redirect helpers refuse to operate when no context exists, and have tcf_qevent_handle() drop a TC_ACT_REDIRECT verdict instead of calling skb_do_redirect(). Previous behaviour was a crash, so nothing regresses by not supporting it.
--- net/core/filter.c | 17 +++++++++++------ net/sched/cls_api.c | 6 ++---- 2 files changed, 13 insertions(+), 10 deletions(-)
net/core/filter.c +11 -6
@@ -2551,11 +2551,13 @@ int skb_do_redirect(struct sk_buff *skb) BPF_CALL_2(bpf_redirect, u32, ifindex, u64, flags) { -struct bpf_redirect_info *ri =bpf_net_ctx_get_ri (); +struct bpf_redirect_info *ri; -if (unlikely (flags & (~(BPF_F_INGRESS ) |BPF_F_REDIRECT_INTERNAL ))) +if (unlikely (!bpf_net_ctx_get () || + (flags & (~(BPF_F_INGRESS ) |BPF_F_REDIRECT_INTERNAL ))))return TC_ACT_SHOT ; + ri =bpf_net_ctx_get_ri (); ri->flags = flags; ri->tgt_index = ifindex;
@@ -2572,11 +2574,12 @@ static const struct bpf_func_proto bpf_redirect_proto = { BPF_CALL_2(bpf_redirect_peer, u32, ifindex, u64, flags) { -struct bpf_redirect_info *ri =bpf_net_ctx_get_ri (); +struct bpf_redirect_info *ri; -if (unlikely (flags)) +if (unlikely (!bpf_net_ctx_get () || flags))return TC_ACT_SHOT ; + ri =bpf_net_ctx_get_ri (); ri->flags =BPF_F_PEER ; ri->tgt_index = ifindex;
@@ -2594,11 +2597,13 @@ static const struct bpf_func_proto bpf_redirect_peer_proto = { BPF_CALL_4(bpf_redirect_neigh, u32, ifindex, struct bpf_redir_neigh *, params, int, plen, u64, flags) { -struct bpf_redirect_info *ri =bpf_net_ctx_get_ri (); +struct bpf_redirect_info *ri; -if (unlikely ((plen && plen <sizeof (*params)) || flags)) +if (unlikely ((plen && plen <sizeof (*params)) || + !bpf_net_ctx_get () || flags))return TC_ACT_SHOT ; + ri =bpf_net_ctx_get_ri (); ri->flags =BPF_F_NEIGH | (plen ?BPF_F_NEXTHOP :0 ); ri->tgt_index = ifindex;
net/sched/cls_api.c +2 -4
@@ -4070,6 +4070,8 @@ struct sk_buff *tcf_qevent_handle(struct tcf_qevent *qe, struct Qdisc *sch, stru fl =rcu_dereference_bh (qe->filter_chain);switch (tcf_classify (skb,NULL , fl, &cl_res, false)) { +case TC_ACT_REDIRECT : + fallthrough;case TC_ACT_SHOT :qdisc_qstats_drop (sch);__qdisc_drop (skb, to_free);
@@ -4081,10 +4083,6 @@ struct sk_buff *tcf_qevent_handle(struct tcf_qevent *qe, struct Qdisc *sch, stru__qdisc_drop (skb, to_free); *ret = __NET_XMIT_STOLEN;return NULL ; -case TC_ACT_REDIRECT : -skb_do_redirect (skb); - *ret = __NET_XMIT_STOLEN; -return NULL ;case TC_ACT_CONSUMED : *ret = __NET_XMIT_STOLEN;return NULL ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 581/1250 Bluetooth: ISO: fix malformed ISO_END/CONT handling
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <[email protected]>
[ Upstream commit e054c1a6ae7310d2815778fddb87da616e11c255 ]
Core specification (Part C vol 4 sec 5.4.5) does not exclude empty ISO_CONT, ISO_END packets. We currently reject them if they are last.
If controller sends malformed sequence
ISO_START -> rx_len = 4, ISO_CONT skb->len 4, ISO_START
that ends payload in ISO_CONT, we leak conn->rx_skb. If controller sends too long ISO_END, we panic on skb_put. If controller sends too short ISO_END we accept it.
Fix by marking unfinished ISO_START via conn->rx_skb != NULL. Check skb->len properly before skb_put. Combine the ISO_CONT/END code paths as they require the same initial checks. Reject too short ISO_END packets.
--- net/bluetooth/iso.c | 31 ++++++++++++++++--------------- 1 file changed, 16 insertions(+), 15 deletions(-)
net/bluetooth/iso.c +16 -15
@@ -2543,7 +2543,7 @@ int iso_recv(struct hci_dev *hdev, u16 handle, struct sk_buff *skb, u16 flags)switch (pb) {case ISO_START :case ISO_SINGLE : -if (conn->rx_len) { +if (conn->rx_skb || conn->rx_len) {BT_ERR ("Unexpected start frame (len %d)" , skb->len);kfree_skb (conn->rx_skb); conn->rx_skb =NULL ;
@@ -2624,12 +2624,14 @@ int iso_recv(struct hci_dev *hdev, u16 handle, struct sk_buff *skb, u16 flags)break ;case ISO_CONT : -BT_DBG ("Cont: frag len %d (expecting %d)" , skb->len, +case ISO_END : +BT_DBG ("%s: frag len %d (expecting %d)" , + (pb ==ISO_END ) ?"End" :"Cont" , skb->len, conn->rx_len); -if (!conn->rx_len) { -BT_ERR ("Unexpected continuation frame (len %d)" , - skb->len); +if (!conn->rx_skb) { +BT_ERR ("Unexpected ISO %s frame (len %d)" , + (pb ==ISO_END ) ?"End" :"Cont" , skb->len); goto drop; }
@@ -2645,17 +2647,9 @@ int iso_recv(struct hci_dev *hdev, u16 handle, struct sk_buff *skb, u16 flags)skb_copy_from_linear_data (skb,skb_put (conn->rx_skb, skb->len), skb->len); conn->rx_len -= skb->len; -break ; -case ISO_END : -if (!conn->rx_len) { -BT_ERR ("Unexpected end frame (len %d)" , skb->len); - goto drop; - } - -skb_copy_from_linear_data (skb,skb_put (conn->rx_skb, skb->len), - skb->len); - conn->rx_len -= skb->len; +if (pb ==ISO_CONT ) +break ;if (!conn->rx_len) {struct sk_buff *rx_skb = conn->rx_skb;
@@ -2666,6 +2660,13 @@ int iso_recv(struct hci_dev *hdev, u16 handle, struct sk_buff *skb, u16 flags)*/ conn->rx_skb =NULL ;iso_recv_frame (conn, rx_skb); + }else { +BT_ERR ("ISO fragment incomplete (len %d, expected %d)" , + skb->len, conn->rx_len); +kfree_skb (conn->rx_skb); + conn->rx_skb =NULL ; + conn->rx_len =0 ; + goto drop; }break ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 582/1250 netfs: Fix barriering when walking subrequest list
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit 5c6ce05e406520290c1d89da97fb3cd70c09137d ]
Fix the barriering used when walking the subrequest list in retry as there's a possibility of seeing a subreq that's just been added by the application thread.
--- fs/netfs/read_retry.c | 7 ++++++- fs/netfs/write_retry.c | 7 ++++++- 2 files changed, 12 insertions(+), 2 deletions(-)
fs/netfs/read_retry.c +6 -1
@@ -98,7 +98,12 @@ static void netfs_retry_read_subrequests(struct netfs_io_request *rreq) goto abandon; } -list_for_each_continue (next, &stream->subrequests) { +for (;;) { +/* Read pointer to subreq before reading subreq state. */ + next =smp_load_acquire (&next->next); +if (next == &stream->subrequests) +break ; + subreq = list_entry(next, struct netfs_io_subrequest, rreq_link); if (subreq->start + subreq->transferred != start + len || test_bit(NETFS_SREQ_BOUNDARY, &subreq->flags) ||
fs/netfs/write_retry.c +6 -1
@@ -72,7 +72,12 @@ static void netfs_retry_write_stream(struct netfs_io_request *wreq, !test_bit(NETFS_SREQ_NEED_RETRY, &from->flags)) return; -list_for_each_continue (next, &stream->subrequests) { +for (;;) { +/* Read pointer to subreq before reading subreq state. */ + next =smp_load_acquire (&next->next); +if (next == &stream->subrequests) +break ; + subreq = list_entry(next, struct netfs_io_subrequest, rreq_link); if (subreq->start + subreq->transferred != start + len || test_bit(NETFS_SREQ_BOUNDARY, &subreq->flags) ||
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 583/1250 bpf: Mask pseudo pointer values in verifier logs
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nuoqi Gui <[email protected]>
[ Upstream commit 72a85e9464a5332fb2cd7efd26d9295275ceda2d ]
print_bpf_insn() masks ldimm64 immediates for pointer-bearing pseudo sources when pointer leaks are not allowed, but the mask only covers BPF_PSEUDO_MAP_FD and BPF_PSEUDO_MAP_VALUE.
BPF_PSEUDO_MAP_IDX, BPF_PSEUDO_MAP_IDX_VALUE, and BPF_PSEUDO_BTF_ID can also be resolved to kernel pointer values before the verifier log prints the instruction. Include them in the existing pointer classification so the log prints 0x0 instead of the rewritten address.
--- kernel/bpf/disasm.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
kernel/bpf/disasm.c +4 -1
@@ -323,7 +323,10 @@ void print_bpf_insn(const struct bpf_insn_cbs *cbs,*/ u64 imm = ((u64)(insn +1 )->imm <<32 ) | (u32 )insn->imm;bool is_ptr = insn->src_reg ==BPF_PSEUDO_MAP_FD || - insn->src_reg ==BPF_PSEUDO_MAP_VALUE ; + insn->src_reg ==BPF_PSEUDO_MAP_VALUE || + insn->src_reg ==BPF_PSEUDO_MAP_IDX || + insn->src_reg ==BPF_PSEUDO_MAP_IDX_VALUE || + insn->src_reg ==BPF_PSEUDO_BTF_ID ;char tmp[64 ];if (is_ptr && !allow_ptr_leaks)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 584/1250 sctp: fix err_chunk memory leaks in INIT handling
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit 9f58a0a4d6c2ed5d341bba64f058f15d1b0c36f2 ]
When sctp_verify_init() encounters unrecognized parameters, it allocates an err_chunk to report them. However, this chunk is leaked in several code paths:
1. In sctp_sf_do_5_1B_init(), if security_sctp_assoc_request() fails after sctp_verify_init() has populated err_chunk, the function returns immediately without freeing it.
2. In sctp_sf_do_unexpected_init(), the same leak occurs on the security_sctp_assoc_request() failure path.
3. In sctp_sf_do_unexpected_init(), on the success path after copying unrecognized parameters to the INIT-ACK, the function returns without freeing err_chunk, unlike sctp_sf_do_5_1B_init() which properly frees it.
Fix all three leaks by adding sctp_chunk_free(err_chunk) calls before returning in the error paths and on the success path in sctp_sf_do_unexpected_init().
--- net/sctp/sm_statefuns.c | 5 +++++ 1 file changed, 5 insertions(+)
net/sctp/sm_statefuns.c +5 -0
@@ -416,6 +416,8 @@ enum sctp_disposition sctp_sf_do_5_1B_init(struct net *net,/* Update socket peer label if first association. */ if (security_sctp_assoc_request (new_asoc, chunk->skb)) {sctp_association_free (new_asoc); +if (err_chunk) +sctp_chunk_free (err_chunk);return sctp_sf_pdiscard (net, ep, asoc, type, arg, commands); }
@@ -1620,6 +1622,8 @@ static enum sctp_disposition sctp_sf_do_unexpected_init(/* Update socket peer label if first association. */ if (security_sctp_assoc_request (new_asoc, chunk->skb)) {sctp_association_free (new_asoc); +if (err_chunk) +sctp_chunk_free (err_chunk);return sctp_sf_pdiscard (net, ep, asoc, type, arg, commands); }
@@ -1685,6 +1689,7 @@ static enum sctp_disposition sctp_sf_do_unexpected_init(* parameter type. */ sctp_addto_chunk (repl, len, unk_param); +sctp_chunk_free (err_chunk); }sctp_add_cmd_sf (commands,SCTP_CMD_NEW_ASOC ,SCTP_ASOC (new_asoc));
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 585/1250 md/raid10: fix writes_pending and barrier reference leaks on discard failures
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abd-Alrhman Masalkhi <[email protected]>
[ Upstream commit 393d687131d8aa8c7e4de2cb494438e145d20fc2 ]
raid10_make_request() acquires a writes_pending reference with md_write_start() before calling raid10_handle_discard(). Several failure paths in raid10_handle_discard() complete the bio and return without releasing the corresponding reference, causing md_write_end() to be skipped.
Call md_write_end() before returning from these failure paths to keep writes_pending accounting balanced.
Additionally, discard split allocation failures can occur after wait_barrier() succeeds. Those paths return without calling allow_barrier(), leaking the associated barrier reference.
Release the barrier before returning from those paths.
--- drivers/md/raid10.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/md/raid10.c +5 -0
@@ -1619,6 +1619,7 @@ static int raid10_handle_discard(struct mddev *mddev, struct bio *bio)if (!wait_barrier (conf, bio->bi_opf &REQ_NOWAIT )) {bio_wouldblock_error (bio); +md_write_end (mddev);return 0 ; }
@@ -1661,6 +1662,8 @@ static int raid10_handle_discard(struct mddev *mddev, struct bio *bio)if (IS_ERR (split)) { bio->bi_status =errno_to_blk_status (PTR_ERR (split));bio_endio (bio); +md_write_end (mddev); +allow_barrier (conf);return 0 ; }
@@ -1678,6 +1681,8 @@ static int raid10_handle_discard(struct mddev *mddev, struct bio *bio)if (IS_ERR (split)) { bio->bi_status =errno_to_blk_status (PTR_ERR (split));bio_endio (bio); +md_write_end (mddev); +allow_barrier (conf);return 0 ; }
Signature · 1 line
2.53.0