6.18.57-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainercover 6.18.57-rc1 review
This is the start of the stable review cycle for the 6.18.57 release. There are 621 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 15 Oct 2026 11:28:22 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.57-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.18.57-rc1
Rafael J. Wysocki <[email protected]>
ACPI: scan: Use acpi_setup_gpe_for_wake() for buttons
Rafael J. Wysocki <[email protected]>
ACPI: scan: Do not mark button ACPI devices as wakeup-capable
Tejun Heo <[email protected]>
workqueue: Annotate alloc_workqueue_va() with __printf(1, 0)
Lizhi Hou <[email protected]>
accel/amdxdna: Fix crash when destroying a suspended hardware context
Lizhi Hou <[email protected]>
accel/amdxdna: Fix race condition when checking rpm_on
Lizhi Hou <[email protected]>
accel/amdxdna: Resume power for creating and destroying hardware context
Harald Freudenberger <[email protected]>
s390/zcrypt: Pad trailing CCA or EP11 message with zeros
Harald Freudenberger <[email protected]>
s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing
Harald Freudenberger <[email protected]>
s390/zcrypt: Improve EP11 CPRB length and overflow checks
Harald Freudenberger <[email protected]>
s390/zcrypt: Improve CCA CPRB length and overflow checks
Alexander Lobakin <[email protected]>
ice: fix broken Rx on VFs
Breno Leitao <[email protected]>
workqueue: fix devm_alloc_workqueue() va_list misuse
Hao Ge <[email protected]>
netfs: Fix missing alloc tagging of direct mempool allocations
Eric Dumazet <[email protected]>
net: fix backlog_unlock_irq_restore() vs CONFIG_PREEMPT_RT
Ming Qian <[email protected]>
media: verisilicon: Fix kernel panic due to __initconst misuse
David Howells <[email protected]>
netfs, afs: Fix symlink reading
Frank Sorenson <[email protected]>
cifs: consolidate time_last_write stamp into _cifsFileInfo_put()
Qu Wenruo <[email protected]>
btrfs: make sure EXTENT_BUFFER_READING is cleared under refs_lock
Osama Abdelkader <[email protected]>
drm/panthor: validate userspace queue count against initialized firmware slot count
Borislav Petkov (AMD) <[email protected]>
x86/CPU/AMD: Fix AMD TLBI Erratum #1718
Maíra Canal <[email protected]>
drm/vc4: Fix binner slot allocation failing on an idle GPU
Ilia Gavrilov <[email protected]>
vsock: Fix memory leak in vmci_transport_recv_dgram_cb()
Fernando Fernandez Mancera <[email protected]>
net: openvswitch: validate transport header presence in set_ipv6_addr
Vadim Fedorenko <[email protected]>
ptp: ocp: fix PCIe delay estimation calculation
Willem de Bruijn <[email protected]>
net/packet: call packet_parse_headers after virtio_net_hdr_to_skb
Petr Machata <[email protected]>
mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()
Li RongQing <[email protected]>
net/mlx5e: Order ICOSQ cc update after CQ doorbell
Tianyi Gao <[email protected]>
veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down
Gyeyoung Baek <[email protected]>
drm/imagination: Fix reference and vm_bo handling in remap()
Eric Dumazet <[email protected]>
flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()
Pavan Chebbi <[email protected]>
bnxt_en: Re-write the BARs following any type of PCIe errors
Lukas Wunner <[email protected]>
bnxt_en: Drop pci_save_state() after pci_restore_state()
Michael Chan <[email protected]>
bnxt_en: Delay for 5 seconds after AER DPC for all chips
Michael Chan <[email protected]>
bnxt_en: Fix driver init in kdump kernel
Michael Chan <[email protected]>
bnxt_en: Add bnxt_clear_bars() helper
Haishuang Yan <[email protected]>
pfcp: make sure the SEID is linear before reading it
Justin Chen <[email protected]>
net: bcmgenet: if UMAC was suspended in SW_RESET, restore it to SW_RESET
Or Har-Toov <[email protected]>
Revert "net/mlx5: E-Switch, preserve max tx speed on vport state modification"
Victor Nogueira <[email protected]>
net/sched: cls_route: reject change with no routing attribute
Haishuang Yan <[email protected]>
devlink: fix devlink_rel reference leak when notify work is pending
Quentin Freimanis <[email protected]>
net: sparx5: start the TOD counters on non-PTP lan969x variants
Eric Dumazet <[email protected]>
flow_dissector: avoid u16 truncation of skb->len when computing thoff
Waiman Long <[email protected]>
cgroup/cpuset: Call is_in_v2_mode() after acquiring cpuset_mutex in cpuset_handle_hotplug()
Han Gao <[email protected]>
spi: sg2044-nor: Honor SPI clock limits
Han Gao <[email protected]>
spi: sg2044-nor: Return transfer errors
Marek Szyprowski <[email protected]>
ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
Alvin Šipraga <[email protected]>
ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes
Alvin Šipraga <[email protected]>
ASoC: adau1372: allow sleepy powerdown GPIOs
Yingying Tang <[email protected]>
Revert "wifi: ath12k: add panic handler"
Devin Wittmayer <[email protected]>
wifi: mt76: mt792x: pick the SAR table layout from the table itself
Junjie Cao <[email protected]>
wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit
Devin Wittmayer <[email protected]>
wifi: mt76: mt7925: don't put the band auto marker in TGID
Nicolas Cavallari <[email protected]>
wifi: mt76: mt7915: disable rx napi when removing device
Tao Gong <[email protected]>
wifi: mt76: mt7996: fix struct mt7996_mcu_wed_rro_ba_delete_event layout
Aaron Ma <[email protected]>
wifi: mt76: mt7925: restore the legacy BSS after MLO teardown
Felix Fietkau <[email protected]>
wifi: mt76: use ALTX queue for packets to disassociated stations
Felix Fietkau <[email protected]>
wifi: mt76: route nullfunc frames to PSD/ALTX queue
Felix Fietkau <[email protected]>
wifi: mt76: account non-AQL frames per peer rather than per link
Felix Fietkau <[email protected]>
wifi: mt76: add PS buffering support for HW-managed TIM drivers
Felix Fietkau <[email protected]>
wifi: mac80211: add ieee80211_txq_aql_pending()
Felix Fietkau <[email protected]>
wifi: mac80211: add AQL support for multicast packets
David Bauer <[email protected]>
wifi: mt76: don't return TXQ when exceeding max non-AQL packets
Aurelien Jarno <[email protected]>
riscv: vector: Fix output operands in context save
Troy Mitchell <[email protected]>
riscv: vector: Fix data pointer constraints in context save/restore
Jakub Kicinski <[email protected]>
net: make dev_xdp_sb_prog_count() see programs attached through a link
Alan Previn <[email protected]>
drm/xe/mmio: Fix xe_mmio_wait32() to honor delay/sleep maximums
Filipe Manana <[email protected]>
btrfs: fix lost error return value in btrfs_listxattr()
Filipe Manana <[email protected]>
btrfs: fix xattr replace when multiple xattrs are packed in the same item
Yang Xiuwei <[email protected]>
btrfs: unlock inode and extent in caller when io_uring read extent fails
Yang Xiuwei <[email protected]>
btrfs: free iov when btrfs_uring_read_extent() fails
Yang Xiuwei <[email protected]>
btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio
Shin'ichiro Kawasaki <[email protected]>
zloop: zero out only the unread tail of short reads
Fuad Tabba <[email protected]>
arm64/boot: Don't set PMUv3p9 FGT2 bits without PMUv3
Sang-Hoon Choi <[email protected]>
nvmet: use the local P2P device on metadata allocation failure
Guixin Liu <[email protected]>
nvmet: return Invalid Field for invalid NSIDs feature 82h
Bryan Fraschetti <[email protected]>
ice: Restore Ordered MMIO Writes for Tx Doorbells
Mahantesh Salimath <[email protected]>
tee: optee: ffa: support shared memory offsets on large-page kernels
Rodrigo Zaiden <[email protected]>
tee: optee: fix kernel-doc warnings
Sang-Hoon Choi <[email protected]>
cxgb4/ch_ktls: disable softirqs around tid_list erases
Omar Ramadan <[email protected]>
amt: send the relay's General Query directly from the receive path
Jamal Hadi Salim <[email protected]>
net/sched: em_text: reject unterminated algo before autoload
Maíra Canal <[email protected]>
drm/vc4: Free the BO cache size list on teardown
Myeonghun Pak <[email protected]>
drm/aspeed: Balance the display clock enable on teardown
Sang-Hoon Choi <[email protected]>
gpio: exar: initialize the ID before registering its cleanup
Oleg Keri <[email protected]>
drm/dp: don't mark the AUX backlight enabled when enabling failed
Sai Teja Aluvala <[email protected]>
Bluetooth: btintel_pcie: Add shared HW reset for clean start
Ravindra <[email protected]>
Bluetooth: btintel_pcie: fix TX descriptor bounds check
Christian Brauner <[email protected]>
fs: don't let a migrating task hide its reference from do_umount()
Mateusz Guzik <[email protected]>
fs: move mntput_no_expire() slowpath into a dedicated routine
Christian Brauner <[email protected]>
mount: refuse MOVE_MOUNT_SET_GROUP on an unbindable mount
Vincent Jardin <[email protected]>
arm64: dts: lx2160a: fix the iic5 spi3 pinmux offset and value
Vincent Jardin <[email protected]>
arm64: dts: lx2160a: fix IIC1 pinmux submask rejected by pinctrl-single
Vincent Jardin <[email protected]>
arm64: dts: lx2160a: fix incorrect pinmux
Ze Tan <[email protected]>
smb/server: fix tree connection leak in smb2_tree_connect()
Namjae Jeon <[email protected]>
ksmbd: convert tree_conns_lock to rw_semaphore
Tetsuo Handa <[email protected]>
printk: Don't WARN on kthread_run failure.
Eduard Zingerman <[email protected]>
bpf: check_cond_jmp_op(): properly infer if register is null
Lorenzo Bianconi <[email protected]>
net: stmmac: fix dma mapping leak in stmmac_tso_xmit()
Eric Dumazet <[email protected]>
ipv6: mcast: use rcu_assign_pointer() for __rcu list updates
Yuyang Huang <[email protected]>
ipv6: mcast: annotate data-races around mca_users
Eduard Zingerman <[email protected]>
bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge
Eduard Zingerman <[email protected]>
bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks
Kumar Kartikeya Dwivedi <[email protected]>
bpf: Mark syscall helpers as sleepable
Steven Rostedt <[email protected]>
ring-buffer: Add checking nr_subbufs to persistent ring buffer validation
Masami Hiramatsu (Google) <[email protected]>
ring-buffer: Skip invalid sub-buffers when validating persistent ring buffer
Eduard Zingerman <[email protected]>
bpf: zero extend the result of an arena 32-bit cmpxchg
Eduard Zingerman <[email protected]>
bpf: don't rewrite bpf_fastcall patterns entered by a jump
Eduard Zingerman <[email protected]>
bpf: Don't infer non-NULL from a pointer with an unbounded offset
Ning Ding <[email protected]>
bpf: Keep refcount_acquire nullable for borrowed RCU kptrs
Kumar Kartikeya Dwivedi <[email protected]>
bpf: Mark NULL kptr stores precise
Kumar Kartikeya Dwivedi <[email protected]>
bpf: Preserve inner map identity in callback frames
Vincent Donnefort <[email protected]>
tracing: Fix subbuf resize races with trace_pipe_raw readers
Eduard Zingerman <[email protected]>
bpf: mark a NULL call argument precise
Fangyu Yu <[email protected]>
iommu/riscv: Serialize command queue publishing
Alexander Graf <[email protected]>
virtio_ring: fix stale descriptor flags after a failed packed add
Jia Jia <[email protected]>
vduse: validate virtqueue alignment
Jia Jia <[email protected]>
vhost: invalidate vring access on IOTLB transitions
Steven Rostedt <[email protected]>
tracing: Take trace_array reference when opening a tracer options file
Arunpravin Paneer Selvam <[email protected]>
drm/amdgpu: skip the VMID 0 flush for VRAM
Paulo Alcantara <[email protected]>
smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid
Paulo Alcantara <[email protected]>
smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()
Namjae Jeon <[email protected]>
ksmbd: fix maximum allowed access checks
Alexey Velichayshiy <[email protected]>
ksmbd: remove redundant DACL check in smb_check_perm_dacl
Val Packett <[email protected]>
remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3
Gou Hao <[email protected]>
powerpc/xive: propagate IPI init errors to prevent use-after-free
Gou Hao <[email protected]>
powerpc/xive: add error return value to xive_smp_probe()
Rafael J. Wysocki <[email protected]>
ACPI: bus: Introduce acpi_bus_get_primary_device()
Nitin Gote <[email protected]>
drm/xe: don't WARN on kernel job timeout when device already wedged
Chris Mason <[email protected]>
nfsd: convert nfsd_net boolean flags to unsigned long flags word
NeilBrown <[email protected]>
nfsd: use workqueue enable/disable APIs for v4_end_grace sync
Bryam Vargas <[email protected]>
dm-pcache: validate seg_id fields from persistent memory
Evgenii Burenchev <[email protected]>
drm/amd/display: Fix dangling pointer in plane reset function
Evgenii Burenchev <[email protected]>
drm/amd/display: Fix dangling pointer in CRTC reset function
Alex Bereza <[email protected]>
dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout
Jiri Olsa <[email protected]>
uprobes/x86: Move optimized uprobe from nop5 to nop10
Yiyang Chen <[email protected]>
bpf: Reject MEM_ALLOC BTF accesses past object bounds
Nicholas Dudar <[email protected]>
bpf: Reject writes through untrusted BTF pointers
Armin Wolf <[email protected]>
platform/x86: dell-wmi-base: Fix handling of ultra performance key
Nicholas Dudar <[email protected]>
bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max
Qing Ming <[email protected]>
usb: gadget: uac: validate rate list length before storing
Marco Scardovi <[email protected]>
platform/x86: asus-wmi: fix resource leaks on probe failure
Maher Azzouzi <[email protected]>
esp: do not unref managed frag pages in esp_ssg_unref()
Leon Romanovsky <[email protected]>
RDMA/rvt: Return NULL after port allocation failure
Reinette Chatre <[email protected]>
fs/resctrl: Fix UAF from worker threads when domains are removed
Dave Jiang <[email protected]>
cxl/features: Serialize multi-part Get/Set Feature transfers
Sudeep Holla <[email protected]>
firmware: arm_scmi: Fix SCMI device destroy lifetimes
Sudeep Holla <[email protected]>
firmware: arm_scmi: Fix OF node reference handling
Sudeep Holla <[email protected]>
firmware: arm_scmi: Clear SystemPower flag on create failure
Aditya Prakash Srivastava <[email protected]>
ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find()
Leon Hwang <[email protected]>
bpf: Fix WARNING in bpf_tracing_link_release
Justin Yeh <[email protected]>
pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip
Li Qiang <[email protected]>
scsi: ufs: core: Validate string descriptors
Bean Huo <[email protected]>
scsi: ufs: core: Convert string descriptor format macros to enum
Nicolin Chen <[email protected]>
iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc()
Gary Guo <[email protected]>
PCI: Fix UAF when probe runs concurrent to dyn ID removal
Gary Guo <[email protected]>
PCI: Fix dyn_id add TOCTOU
Gary Guo <[email protected]>
PCI: Make pci_match_one_device() match on ID instead of device
Leon Romanovsky <[email protected]>
RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry()
Guixin Liu <[email protected]>
nvmet: fix return status of RMI log page on allocation failure
Adrián Larumbe <[email protected]>
drm/panthor: Add vm_bind region with kbo range overlap check
Jeff Johnson <[email protected]>
wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event()
Abd-Alrhman Masalkhi <[email protected]>
md: remove REQ_NOWAIT support from raid1/10/456
Shayne Chen <[email protected]>
wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()
Eason Lai <[email protected]>
wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete
Felix Fietkau <[email protected]>
wifi: mt76: cancel reset and rc work on device unregister
Yonghong Song <[email protected]>
bpf: Reject >8 byte return values on return-reading trampoline paths
Felix Fietkau <[email protected]>
wifi: mt76: mt7996: clear stale link state on full reset
Will Deacon <[email protected]>
arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry
Zhao Li <[email protected]>
wifi: nl80211: clean up color-change beacon data on errors
Jason Huang <[email protected]>
wifi: brcmfmac: fix P2P action frame handling without device vif
Karl Mehltretter <[email protected]>
serial: core: do fallible allocations before the console can be registered
Karl Mehltretter <[email protected]>
serial: core: clear freed pointers on uart_register_driver() failure
Karl Mehltretter <[email protected]>
tty: skip cdev_del() when no cdev is registered
Haoxiang Li <[email protected]>
HID: logitech-hidpp: Fix FF device cleanup on init failure
Yang Xiuwei <[email protected]>
ublk: validate auto buf reg before taking uring_cmd
Ning Ding <[email protected]>
bpf: Invalidate RCU pointers after final spin unlock
Krzysztof Wilczyński <[email protected]>
PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers
Rafael J. Wysocki <[email protected]>
thermal: hwmon: Remove hwmon class device along with its parent
Cen Zhang <[email protected]>
ocfs2: o2hb: quiesce negotiate handlers and timeout work
Yufan Chen <[email protected]>
ocfs2/heartbeat: fix slot mapping rollback leaks on error paths
Jiri Olsa <[email protected]>
bpf: Clear buf on error in __bpf_get_task_stack
Jiri Olsa <[email protected]>
bpf: Remove trace_in argument from __bpf_get_stack
Jiri Olsa <[email protected]>
bpf: Factor callchain_finalize function from __bpf_get_stack
Jiri Olsa <[email protected]>
bpf: Factor callchain_store function from __bpf_get_stack
Harry Wentland <[email protected]>
drm/amd/display: Resize MST HDCP per-connector arrays to 32
Ray Wu <[email protected]>
drm/amd/display: disable replay when crc source is enabled
Yeoreum Yun <[email protected]>
coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable
Yang Xiuwei <[email protected]>
scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails
Bart Van Assche <[email protected]>
scsi: sd: Move the sd_config_discard() function definition
Bart Van Assche <[email protected]>
scsi: sd: Move the sd_remove() function definition
Uwe Kleine-König <[email protected]>
scsi: sd: Convert to SCSI bus methods
Uwe Kleine-König <[email protected]>
scsi: core: sysfs: Make use of bus callbacks
Uwe Kleine-König <[email protected]>
scsi: core: Pass a struct scsi_driver to scsi_{,un}register_driver()
Sun YangKai <[email protected]>
btrfs: check if root is readonly when setting posix acl
Miquel Sabaté Solà <[email protected]>
btrfs: apply the AUTO_K(V)FREE macros throughout the code
Johannes Thumshirn <[email protected]>
btrfs: zoned: flush active metadata block group at btree_writepages() start
Lu Baolu <[email protected]>
iommu/vt-d: Fix iopf_refcount leak on RID domain replacement
Nicolin Chen <[email protected]>
iommu: Pass in old domain to attach_dev callback functions
Chuck Lever <[email protected]>
NFS: Return a delegation the client fails to record
Ning Ding <[email protected]>
bpf: Compare iterator types during state pruning
Daniel Borkmann <[email protected]>
bpf, s390: Clear fetch destination on faulting arena atomic
Marek Szyprowski <[email protected]>
clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type
Maurizio Lombardi <[email protected]>
nvmet: fix max_qid race between configfs and controller allocation
Usama Arif <[email protected]>
blk-iolatency: clear delay state when freeing policy data
Usama Arif <[email protected]>
blk-iocost: clear delay state when freeing policy data
Yu Kuai <[email protected]>
blk-cgroup: delay freeing policy data after rcu grace period
Yiyang Chen <[email protected]>
bpf: Check pointer type for all atomic RMW paths
Yunseong Kim <[email protected]>
ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user()
Namjae Jeon <[email protected]>
ksmbd: serialize oplock close with pending break ownership
Ilan Dudnik <[email protected]>
ksmbd: defer publishing granted locks to prevent UAF/double-free race
Namjae Jeon <[email protected]>
ksmbd: safely discard unregistered deferred locks
Namjae Jeon <[email protected]>
ksmbd: detach blocked lock requests before freeing
Namjae Jeon <[email protected]>
ksmbd: scope session state changes to bound connections
Petr Oros <[email protected]>
dpll: fix NULL deref in dpll_device_ops() during teardown race
Anton Protopopov <[email protected]>
virtio_net: Fix resize of the RX ring
Sascha Bischoff <[email protected]>
irqchip/gic-v5: Clear per-CPU IRS data on teardown
Eric Dumazet <[email protected]>
ip6mr: do not clone dst in ip6mr_cache_report()
Nikolay Aleksandrov <[email protected]>
net: bridge: arp/nd proxy: fix reading neigh ha
Nikolay Aleksandrov <[email protected]>
vxlan: fix reading neigh ha
Jérémy Jean <[email protected]>
NFSv4.1: zero referring call lists before decoding
Jamal Hadi Salim <[email protected]>
net/sched: account classifier filter allocations to memcg
Bernd Schubert <[email protected]>
fuse: Fix the condition to enable over-io-uring
Pauli Virtanen <[email protected]>
Bluetooth: L2CAP: access chan->conn safely in get/setsockopt
Radek Podgorny <[email protected]>
Bluetooth: do not leak an hci_conn when a second LE connect is rejected
Long Li <[email protected]>
net: mana: Cap MSI-X vectors to the device MSI-X table size
Sai Krishna <[email protected]>
octeontx2-af: fix cn20k mailbox lifetime on repeated rvu_mbox_init()
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: skip double clone set expressions on element insert
Sean Christopherson <[email protected]>
KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped
Zeng Chi <[email protected]>
LoongArch: KVM: Validate MSI data before routing it to EIOINTC
Bibo Mao <[email protected]>
LoongArch: KVM: Get VM PMU capability from HW GCFG register
Jackson Lee <[email protected]>
media: chips-media: wave5: Resume device before setting EOS flag
Jesse Zhang <[email protected]>
drm/amdgpu: force complete the KIQ ring fences on reset
Jesse Zhang <[email protected]>
drm/amdgpu: force complete the MES ring fences on reset
Longlong Xia <[email protected]>
zram: fix out-of-bounds access in writeback_store()
Jeff Layton <[email protected]>
lockd, nfsd: RCU-protect nlmsvc_ops dispatch
Jeff Layton <[email protected]>
nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths
Xiubo Li <[email protected]>
ceph: fix UAF in check_new_map() on session freed during unlock
Frank Sorenson <[email protected]>
cifs: call pagecache_isize_extended() in cifs_setsize() when extending
Jan Kara <[email protected]>
ext2: Fix lost inode updates for IS_SYNC inodes
Pratyush Yadav (Google) <[email protected]>
kho: fix size calculation in kho_preserved_memory_reserve()
Chuck Lever <[email protected]>
SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2
Chuck Lever <[email protected]>
SUNRPC: Switch MIC token verification to crypto/krb5
Chuck Lever <[email protected]>
SUNRPC: Switch MIC token generation to crypto/krb5
Chuck Lever <[email protected]>
SUNRPC: Switch wrap token decryption to crypto/krb5
Chuck Lever <[email protected]>
SUNRPC: Switch wrap token encryption to crypto/krb5
Chuck Lever <[email protected]>
SUNRPC: Prepare crypto/krb5 encryption and checksum handles
Chuck Lever <[email protected]>
SUNRPC: Add errno-to-GSS status conversion helper
Chuck Lever <[email protected]>
SUNRPC: Add crypto/krb5 enctype lookup to krb5_ctx
Chuck Lever <[email protected]>
svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails
Chuck Lever <[email protected]>
svcrdma: wake sq waiters when the transport closes
Chuck Lever <[email protected]>
svcrdma: Add Write chunk WRs to the RPC's Send WR chain
Guidong Han <[email protected]>
RISC-V: KVM: Fix PMU event info array size overflow
Lukas Gerlach <[email protected]>
KVM: riscv: Fix Spectre-v1 in PMU counter access
Leon Romanovsky <[email protected]>
ntb: Store original DMA address for future release
Koichiro Den <[email protected]>
NTB: ntb_transport: Use ntb_get_dma_dev() for DMA buffers
Koichiro Den <[email protected]>
NTB: core: Add .get_dma_dev() callback to ntb_dev_ops
Eric Dumazet <[email protected]>
tipc: avoid busy looping in tipc_exit_net()
Thomas Zimmermann <[email protected]>
fbdev: Wrap user-invoked calls to fb_set_var() in helper
William Palacek <[email protected]>
drm/amdkfd: Add bounds check for CRAT subtype length
Yongqiang Sun <[email protected]>
drm/amdkfd: Fix infinite loop parsing CRAT with zero subtype length
Luxiao Xu <[email protected]>
bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie
Alex Deucher <[email protected]>
drm/amd/display: check if dml21_add_phantom_plane() is successful
Yuho Choi <[email protected]>
dmaengine: idxd: fix double free of wq, engine, and group structs
Michael Bommarito <[email protected]>
idpf: bound interrupt-vector register fill to the allocated array
Pauli Virtanen <[email protected]>
Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks
Prasanna Kumar T S M <[email protected]>
soc: xilinx: Fix race condition in event registration
Jay Buddhabhatti <[email protected]>
drivers: firmware: xilinx: Switch to new family code in zynqmp_pm_get_family_info()
Jay Buddhabhatti <[email protected]>
drivers: firmware: xilinx: Add unique family code for all platforms
David Carlier <[email protected]>
netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag
Weiming Shi <[email protected]>
btrfs: lzo: reject compressed segment that overflows the compressed input
Mostafa Saleh <[email protected]>
optee: ffa: Add NULL check in optee_ffa_lend_protmem
Hongjie Fang <[email protected]>
scsi: core: pair EH runtime PM get and put
Ralf Lici <[email protected]>
ovpn: defer key slot crypto freeing to workqueue
Julian Anastasov <[email protected]>
ipvs: revalidate ihl to prevent out-of-bounds access
Jakub Kicinski <[email protected]>
eth: bnxt: avoid deadlock when canceling IRQ affinity notifier
Jakub Kicinski <[email protected]>
eth: bnxt: decrease indent in bnxt_request_irq()
Mark Tomlinson <[email protected]>
gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock
Karthikeyan KS <[email protected]>
soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read
David Lee <[email protected]>
btrfs: lzo: reject inline extents without valid headers
Lizhi Hou <[email protected]>
accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages()
Lizhi Hou <[email protected]>
accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages()
Chengfeng Ye <[email protected]>
bpf: Fix netns reference imbalance in conntrack kfuncs
Linfeng Sun <[email protected]>
vhost_iotlb: bound map allocation in add_range
Steven Rostedt <[email protected]>
eventfs: Use children field for rcu head and add memory barriers
Dongjiang Zhu <[email protected]>
btrfs: skip global block reserve accounting for rescue mounts
Qu Wenruo <[email protected]>
btrfs: warn about extent buffer that can not be released
Qu Wenruo <[email protected]>
btrfs: only invalidate btree inode pages after all ebs are released
David Sterba <[email protected]>
btrfs: split btrfs_fs_closing() and change return type to bool
Carlos López <[email protected]>
KVM: arm64: vgic: Fix race between LPI release and re-registration
Xiang Mei (Microsoft) <[email protected]>
nexthop: take nh->lock for f6i_list walks in replace check and notify
Xiang Mei (Microsoft) <[email protected]>
nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush
Maciej Fijalkowski <[email protected]>
xsk: reclaim invalid Tx descriptors in ZC batch path
Maciej Fijalkowski <[email protected]>
xsk: provide sufficient space in pool->tx_descs
Cen Zhang (Microsoft) <[email protected]>
net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds
David Howells <[email protected]>
netfs: Fix folio_queue ENOMEM in writeback by adding a mempool
Pauli Virtanen <[email protected]>
Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYsKees Cook <[email protected]>
net: Convert proto_ops bind() callbacks to use sockaddr_unsized
Kriish Sharma <[email protected]>
hdlc_ppp: fix potential null pointer in ppp_cp_event logging
Pauli Virtanen <[email protected]>
Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback
Hariprasad Kelam <[email protected]>
octeontx2-af: Block VFs from clobbering special CGX PKIND state
Harald Freudenberger <[email protected]>
s390/zcrypt: Close speculative mem read possibility
Harald Freudenberger <[email protected]>
s390/zcrypt: Rework domain processing within zcrypt device driver
Harald Freudenberger <[email protected]>
s390/zcrypt: Move inline function rng_type6cprb_msgx from header to code
George Zhang <[email protected]>
drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport
Abd-Alrhman Masalkhi <[email protected]>
md/raid1,raid10: fix error-path detection with md_cloned_bio()
Abd-Alrhman Masalkhi <[email protected]>
md/raid1,raid10: fix bio accounting for split md cloned bios
Abd-Alrhman Masalkhi <[email protected]>
md/raid1,raid10: fix deadlock in read error recovery path
Abd-Alrhman Masalkhi <[email protected]>
md: replace wait loop with wait_event() in md_handle_request()
Miaoqing Pan <[email protected]>
wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic()
Wei Zhang <[email protected]>
wifi: ath12k: fix inconsistent arvif state in vdev_create error paths
Zhang Cen <[email protected]>
ocfs2: validate fast symlink target during inode read
David Windsor <[email protected]>
bpf: Reject sleepable BPF_LSM_CGROUP programs at load time
Bryam Vargas <[email protected]>
wifi: mac80211: bound S1G TIM PVB walk to the TIM element
Johannes Berg <[email protected]>
wifi: ieee80211: split S1G definitions out
Larysa Zaremba <[email protected]>
ixgbe: do not configure xps for XDP queues
Yun Zhou <[email protected]>
ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT
Zhang Yi <[email protected]>
ext4: add mext_check_validity() to do basic check
Li RongQing <[email protected]>
iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path
Dan Williams <[email protected]>
cxl/region: Block region delete during region creation
Pablo Neira Ayuso <[email protected]>
netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them
Weiming Shi <[email protected]>
netfilter: nft_fwd_netdev: use recursion counter in neigh egress path
Pablo Neira Ayuso <[email protected]>
netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding
Selvin Xavier <[email protected]>
RDMA/bnxt_re: Free CQ toggle page after firmware teardown
Selvin Xavier <[email protected]>
RDMA/bnxt_re: Add a max slot check for SQ
Eric Dumazet <[email protected]>
net: serialize netif_running() check in enqueue_to_backlog()
Eric Dumazet <[email protected]>
net: fully inline backlog_unlock_irq_restore()
Eric Dumazet <[email protected]>
net: optimize enqueue_to_backlog() for the fast path
Helen Koike <[email protected]>
fs/ntfs3: call _ntfs_bad_inode() when failing to rename
Konstantin Komarov <[email protected]>
fs/ntfs3: Reformat code and update terminology
Adrian Hunter <[email protected]>
i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev()
Abd-Alrhman Masalkhi <[email protected]>
md/raid1: fix writes_pending and barrier reference leaks on write failures
Abd-Alrhman Masalkhi <[email protected]>
md/raid10: fix writes_pending leak on write request failures
Yiyang Chen <[email protected]>
bpf: Guard conntrack opts error writes
Puranjay Mohan <[email protected]>
bpf: net: netfilter: drop dead NULL checks
Eric Dumazet <[email protected]>
tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy()
Boris Brezillon <[email protected]>
drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock
Michael Bommarito <[email protected]>
xen/pvcalls: bound backend response req_id before indexing rsp[]
Fengnan Chang <[email protected]>
iomap: release pages on atomic dio size mismatch
Shay Drory <[email protected]>
net/mlx5: LAG, Fix off-by-one in single-FDB error rollback
Cen Zhang <[email protected]>
Bluetooth: 6lowpan: avoid untracked enable work
Lizhi Hou <[email protected]>
accel/amdxdna: Fix VMA access race
Max Zhen <[email protected]>
accel/amdxdna: Refactor GEM BO handling and add helper APIs for address retrieval
Lizhi Hou <[email protected]>
accel/amdxdna: Fill invalid payload for failed command
Yuho Choi <[email protected]>
net/liquidio: drop cached VF pci_dev LUT
Doruk Tan Ozturk <[email protected]>
accel/amdxdna: reject user command submission without a command BO
Bryam Vargas <[email protected]>
ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD
Niklas Cassel <[email protected]>
ata: libata-core: Disable LPM on Silicon Motion MD619{H,G}XCLDE3TC
Zhao Li <[email protected]>
wifi: mac80211: validate extension-frame layout before RX
Jamal Hadi Salim <[email protected]>
net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains
Honglei Huang <[email protected]>
drm/amd/display: use kvzalloc to allocate struct dc
Cen Zhang <[email protected]>
wifi: cfg80211: use wiphy work for socket owner autodisconnect
Matt Bobrowski <[email protected]>
bpf: Fix UAF in sock clone early bailouts
Fushuai Wang <[email protected]>
bpf: Use rcu_read_lock_dont_migrate in bpf_sk_storage.c
Arvind Yadav <[email protected]>
drm/xe/guc: Keep scheduler timeline name alive
Arvind Yadav <[email protected]>
drm/xe/guc: Hold device ref until queue teardown completes
Ruoyu Wang <[email protected]>
bnxt_en: Handle partially initialized auxiliary devices
Pavan Chebbi <[email protected]>
fwctl/bnxt_en: Refactor aux bus functions to be more generic
Weiming Shi <[email protected]>
tipc: serialize udp bearer replicast list updates
Frank Sorenson <[email protected]>
cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths
Frank Sorenson <[email protected]>
cifs: prevent readdir from changing file size due to stale directory metadata
Satyanarayana K V P <[email protected]>
drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers
Nicholas Dudar <[email protected]>
LoongArch: BPF: Zero-extend signed ALU32 div/mod results
Emil Tantilov <[email protected]>
idpf: fix max_vport related crash on allocation error during init
Joonas Lahtinen <[email protected]>
drm/i915/gt: Fix NULL deref on sched_engine alloc failure
Harish Kasiviswanathan <[email protected]>
drm/amdgpu: Fix kernel panic during driver load failure
Namjae Jeon <[email protected]>
ksmbd: prevent path traversal bypass by restricting caseless retry
Ralph Boehme <[email protected]>
smb/client: fix chown/chgrp with SMB3 POSIX Extensions
Arjan van de Ven <[email protected]>
wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon
Sean Christopherson <[email protected]>
KVM: guest_memfd: Treat memslot binding offset+size as unsigned values
David Howells <[email protected]>
netfs: Fix zeropoint update where i_size > remote_i_size
Felix Gu <[email protected]>
drm/msm/adreno: Fix a reference leak in a6xx_gpu_init()
Jia Zhu <[email protected]>
erofs: fix metabuf leak in inode xattr initialization
Michael Bommarito <[email protected]>
net: hsr: defer node table free until after RCU readers
Zhao Li <[email protected]>
wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb
Sarika Sharma <[email protected]>
wifi: mac80211: fix missing RX bitrate update for mesh forwarding path
Florian Westphal <[email protected]>
netfilter: x_tables: allocate hook ops while under mutex
Florian Westphal <[email protected]>
netfilter: x_tables: allow initial table replace without emitting audit log message
David Howells <[email protected]>
netfs: Fix missing barriers when accessing stream->subrequests locklessly
David Howells <[email protected]>
afs: Fix the locking used by afs_get_link()
Hongling Zeng <[email protected]>
cachefiles: Fix error return when vfs_mkdir() fails
Keith Busch <[email protected]>
nvme-pci: fix dma_vecs leak on p2p memory
Keith Busch <[email protected]>
nvme-pci: fix dma mapping leak on data setup error
Rafael J. Wysocki <[email protected]>
ACPI: button: Fix ACPI GPE handler leak during removal
Rafael J. Wysocki <[email protected]>
ACPI: button: Tweak acpi_button_remove()
Rafael J. Wysocki <[email protected]>
ACPI: button: Convert the driver to a platform one
Rafael J. Wysocki <[email protected]>
ACPI: button: Adjust event notification routines
Jamal Hadi Salim <[email protected]>
net/sched: fix packet loop on netem when duplicate is on
Jamal Hadi Salim <[email protected]>
net: Introduce skb tc depth field to track packet loops
Mark Brown <[email protected]>
KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor
Christian König <[email protected]>
drm/amdgpu: fix amdgpu_hmm_range_get_pages
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: add hook transactions for device deletions
Mikhail Lobanov <[email protected]>
f2fs: read COW data with the original inode during atomic write
Hongling Zeng <[email protected]>
fbdev: omap2: fix use-after-free in omapfb_mmap
Hongling Zeng <[email protected]>
fbdev: omap2: fix inconsistent lock returns in omapfb_mmap
Krzysztof Kozlowski <[email protected]>
power: supply: max77705: Free allocated workqueue and fix removal order
Krzysztof Kozlowski <[email protected]>
power: supply: max77705: Drop duplicated IRQ error message
Krzysztof Kozlowski <[email protected]>
workqueue: devres: Add device-managed allocate workqueue
Morduan Zang <[email protected]>
net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind
Mikhail Gavrilov <[email protected]>
drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED
Johannes Berg <[email protected]>
wifi: cfg80211: enforce HE/EHT cap/oper consistency
Vadim Fedorenko <[email protected]>
ptp: ocp: fix resource freeing order
Andy Shevchenko <[email protected]>
ptp: ocp: Make ptp_ocp_unregister_ext() NULL-aware
Uday Shankar <[email protected]>
ublk: reset per-IO canceled flag on each fetch
Ritesh Harjani (IBM) <[email protected]>
powerpc/64s: Fix unmap race with PMD migration entries
Damien Riégel <[email protected]>
greybus: raw: fix use-after-free on cdev close
Yongpeng Yang <[email protected]>
f2fs: fix data loss caused by incorrect use of nat_entry flag
Michal Schmidt <[email protected]>
ice: fix double-free of tx_buf skb
Kohei Enju <[email protected]>
ice: fix potential NULL pointer deref in error path of ice_set_ringparam()
Keita Morisaki <[email protected]>
ice: fix race condition in TX timestamp ring cleanup
Alexander Lobakin <[email protected]>
ice: reshuffle and group Rx and Tx queue fields by cachelines
Hristo Venev <[email protected]>
ceph: put folios not suitable for writeback
Raphael Zimmer <[email protected]>
libceph: Fix potential out-of-bounds access in __ceph_x_decrypt()
Thomas Hellström <[email protected]>
drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failure
Thomas Hellström <[email protected]>
drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout failure
D. Wythe <[email protected]>
Revert "net/smc: Introduce TCP ULP support"
Sunil Khatri <[email protected]>
drm/amdgpu/userq: fix access to stale wptr mapping
Ritesh Harjani (IBM) <[email protected]>
pseries/papr-hvpipe: Fix race with interrupt handler
Christian Brauner <[email protected]>
papr-hvpipe: convert papr_hvpipe_dev_create_handle() to FD_PREPARE()
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Fix dc_link NULL handling in HPD init
Vishnu Reddy <[email protected]>
media: iris: fix use-after-free of fmt_src during MBPF check
Dmitry Baryshkov <[email protected]>
media: iris: turn platform caps into constants
Yosry Ahmed <[email protected]>
KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT
Seohyeon Maeng <[email protected]>
udf: fix partition descriptor append bookkeeping
Deepanshu Kartikey <[email protected]>
gfs2: fix memory leaks in gfs2_fill_super error path
Andreas Gruenbacher <[email protected]>
gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn
Andreas Gruenbacher <[email protected]>
gfs2: Get rid of delayed withdraws
Andreas Gruenbacher <[email protected]>
gfs2: Asynchronous withdraw
Andreas Gruenbacher <[email protected]>
gfs2: Add clean argument to lm_unmount hook
Andreas Gruenbacher <[email protected]>
gfs2: Clean up quotad timeout handling
Utkarsh Singh <[email protected]>
gfs2/sysfs: Replace sprintf/snprintf with sysfs_emit
Chen Ni <[email protected]>
ASoC: amd: acp-mach-common: Add missing error check for clock acquisition
Vladimir Riabchun <[email protected]>
scsi: qla2xxx: Completely fix fcport double free
Prathamesh Shete <[email protected]>
soc/tegra: pmc: Fix unsafe generic_handle_irq() call
Ming Qian <[email protected]>
media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC
Nicolas Dufresne <[email protected]>
media: v4l2-mem2mem: Add a kref to the v4l2_m2m_dev structure
Filipe Manana <[email protected]>
btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref()
Filipe Manana <[email protected]>
btrfs: remove 'reserved' argument from btrfs_pin_extent()
Qu Wenruo <[email protected]>
btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure()
Jori Koolstra <[email protected]>
hfs: Replace BUG_ON with error handling for CNID count checks
Cédric Bellegarde <[email protected]>
ASoC: qcom: q6asm: drop DSP responses for closed data streams
Srinivas Kandagatla <[email protected]>
ASoC: qcom: q6asm: handle the responses after closing
Nicholas Kazlauskas <[email protected]>
drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35
Nicholas Kazlauskas <[email protected]>
drm/amd/display: Rename FAMS2 global control lock to DMUB HW control lock
Joel Fernandes <[email protected]>
srcu: Use irq_work to start GP in tiny SRCU
Stanislav Kinsburskii <[email protected]>
mshv: Fix error handling in mshv_region_pin
Stanislav Kinsburskii <[email protected]>
mshv: Move region management to mshv_regions.c
Stanislav Kinsburskii <[email protected]>
mshv: Centralize guest memory region destruction
Stanislav Kinsburskii <[email protected]>
mshv: Refactor and rename memory region handling functions
Naman Jain <[email protected]>
static_call: allow using STATIC_CALL_TRAMP_STR() from assembly
Pauli Virtanen <[email protected]>
Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists
Takashi Iwai <[email protected]>
ALSA: ctxfi: Check the error for index mapping
Harin Lee <[email protected]>
ALSA: ctxfi: Refactor resource alloc for sparse mappings
Harin Lee <[email protected]>
ALSA: ctxfi: Use explicit output flag for DAIO resources
Harin Lee <[email protected]>
ALSA: ctxfi: Add hw parameter to daio_mgr_dao_init()
Oleh Konko <[email protected]>
Bluetooth: hci_event: move wake reason storage into validated event handlers
David Carlier <[email protected]>
net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path
Meghana Malladi <[email protected]>
net: ti: icssg-prueth: Make emac_run_xdp function independent of page
Meghana Malladi <[email protected]>
net: ti: icssg-prueth: Add functions to create and destroy Rx/Tx queues
Vadim Fedorenko <[email protected]>
ti: icssg: convert to ndo_hwtstamp API
Larysa Zaremba <[email protected]>
ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz
Larysa Zaremba <[email protected]>
ice: fix rxq info registering in mbuf packets
Michal Schmidt <[email protected]>
ice: fix crash in ethtool offline loopback test
Michal Kubiak <[email protected]>
ice: drop page splitting and recycling
Michal Kubiak <[email protected]>
ice: remove legacy Rx and construct SKB
Chaitanya Kulkarni <[email protected]>
blktrace: fix __this_cpu_read/write in preemptible context
Lizhi Hou <[email protected]>
accel/amdxdna: Fix NULL pointer dereference of mgmt_chann
Haotian Zhang <[email protected]>
PCI: endpoint: Add missing NULL check for alloc_workqueue()
Marco Crivellari <[email protected]>
PCI: Add WQ_PERCPU to alloc_workqueue() users
Lizhi Hou <[email protected]>
accel/amdxdna: Fix potential NULL pointer dereference in context cleanup
Lizhi Hou <[email protected]>
accel/amdxdna: Add hardware specific attributes
Lizhi Hou <[email protected]>
accel/amdxdna: Enhance runtime power management
Hengyu Liang <[email protected]>
ata: libata-scsi: do not lose CHECK CONDITION for failed ATAPI commands
Christian Brauner <[email protected]>
namespace: handle mount locking for automounts correctly
Christian Brauner <[email protected]>
namespace: never expire a locked mount
Christian Brauner <[email protected]>
namespace: refuse an automount below a mount that is in no namespace
Christian Brauner <[email protected]>
fcntl: refuse F_SET_RW_HINT on an immutable inode
Christian Brauner <[email protected]>
namei: don't reveal overmounted entries in refwalk
Christian Brauner <[email protected]>
namespace: unhash a dentry before detaching the mounts on it
Christian Brauner <[email protected]>
namespace: don't let a pseudo dentry become the root of a mount
Christian Brauner <[email protected]>
dcache: don't put a mountpoint on a dentry that's being removed
Christian Brauner <[email protected]>
namespace: check the mounts before reading their parents in pivot_root()
Christian Brauner <[email protected]>
namespace: remove the fsnotify marks of a mount namespace in process context
Christian Brauner <[email protected]>
namespace: look at the topmost mount for a mount namespace file
Christian Brauner <[email protected]>
namespace: check a recursive bind mount for mount namespace loops
Christian Brauner <[email protected]>
namespace: check a submount for references right before unmounting it
Christian Brauner <[email protected]>
namespace: queue a mount only once for mount notifications
Christian Brauner <[email protected]>
namespace: check the target before walking it in do_mount_setattr()
Christian Brauner <[email protected]>
fs: refuse fspick() on internal superblocks
Christian Brauner <[email protected]>
namespace: don't copy an unmounted mount tree
Christian Brauner <[email protected]>
namespace: don't inherit MNT_UMOUNT in clone_mnt()
Christian Brauner <[email protected]>
namespace: reset the old parent's ->overmount in mnt_change_mountpoint()
Christian Brauner <[email protected]>
fs: don't silently unmount busy mounts
Christian Brauner <[email protected]>
mount: keep a copied mount unbindable
Leo Li <[email protected]>
drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs
Jesse Zhang <[email protected]>
drm/amdgpu/userq: return the memdup_user() error for the user MQD
Jesse Zhang <[email protected]>
drm/amdgpu/userq: only accept doorbell BOs as queue doorbell
Mikhail Gavrilov <[email protected]>
drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks
Alex Deucher <[email protected]>
drm/amdgpu: make Mac FB workaround generic
Vitaly Prosyak <[email protected]>
drm/amdgpu: serialize vblank counter reads against GPU reset
Haojie Li <[email protected]>
drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info
Saleel Kudchadker <[email protected]>
drm/amdkfd: align SDMA doorbell base for shader doorbell writes
Thomas Hellström <[email protected]>
drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin
Thomas Hellström <[email protected]>
drm/xe: Fix shrinker accounting double-subtraction on nested external pins
Zack Rusin <[email protected]>
drm/vmwgfx: validate pitch coming from userspace
Wentao Liang <[email protected]>
drm/vc4: Fix firmware reference leak in vc4_drm_bind()
Fan Wu <[email protected]>
drm/vc4: drain the hangcheck timer and works on V3D unbind
Gyeyoung Baek <[email protected]>
drm/imagination: Size page table preallocation by device address
Krzysztof Karas <[email protected]>
drm/i915/gt: Unmask interrupts only when ACTIVE is true
Krzysztof Karas <[email protected]>
drm/i915/gem: Prevent overstepping exec array boundary
Sajal Gupta <[email protected]>
drm/gud: don't keep a connector without a CRTC as connector_state
Nguyen Ngoc Thang <[email protected]>
drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN
Palla Raghunath <[email protected]>
Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown
Maxim Skokov <[email protected]>
Bluetooth: RFCOMM: free the skb when the DLC has no owner
Aldo Ariel Panzardo <[email protected]>
Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()
Iaroslav Voitovych <[email protected]>
Bluetooth: MGMT: Fix status of pending commands flushed on power off
Chengfeng Ye <[email protected]>
Bluetooth: ISO: Serialize concurrent connect calls
Chengfeng Ye <[email protected]>
Bluetooth: ISO: Reject concurrent BIS listener setup
Chengfeng Ye <[email protected]>
Bluetooth: hci_sync: Fix command skb lifetime during scan setup
Chengfeng Ye <[email protected]>
Bluetooth: hci_sock: Serialize dead-device detachment
Runyu Xiao <[email protected]>
Bluetooth: btintel_pcie: use managed IRQ teardown
Zongmin Zhou <[email protected]>
riscv: hwprobe: use _BITULL() rather than BIT() in MIPS vendor uapi header
Ziyi Guo <[email protected]>
riscv: futex: untag the user pointer before the atomic access
Karl Mehltretter <[email protected]>
riscv: fix load_unaligned_zeropad() fixup for RV32
Zongmin Zhou <[email protected]>
riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE
Ziyi Guo <[email protected]>
riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp
Runyu Xiao <[email protected]>
scsi: qedi: Initialize callback state before registration
Shawn Lin <[email protected]>
pmdomain: rockchip: propagate subdomain add errors
Shawn Lin <[email protected]>
pmdomain: rockchip: fix clock leak on domain probe failure
Shawn Lin <[email protected]>
pmdomain: rockchip: don't ignore clock lookup errors on attach
Ming Qian <[email protected]>
pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains
Ridham Khurana <[email protected]>
regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4
Abhishek Ojha <[email protected]>
regulator: ltc3676: don't read the write-only HRST and CLIRQ registers
Shao-Fu Chen <[email protected]>
optee: register TEE devices only once fully initialized
Denis V. Lunev <[email protected]>
openvswitch: fix soft lockup in the netlink flow dump
Karl Bonde Torp <[email protected]>
nvme: fix swapped ZRASF zone state values for full and read only
Weiming Shi <[email protected]>
net: team: free skb when broadcast has no txable port
Weiming Shi <[email protected]>
net: team: stop reusing skb after queue override
Fredrik Nyberg <[email protected]>
net: usb: ax88179_178a: fix rx frame length for non-last packets
Daniel Machon <[email protected]>
net: sparx5: free the matchall entry on destroy
Josef Bacik <[email protected]>
net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()
Sebastien Royen <[email protected]>
net: dsa: microchip: fix KSZ8765 fiber detection
Zixuan Chai <[email protected]>
net: bridge: avoid recursive multicast port cleanup
Chengfeng Ye <[email protected]>
net/smc: protect clcsock lifetime in smc_getname
Quchaosheng <[email protected]>
net/packet: guard the ll header push in packet_rcv_spkt()
Guangshuo Li <[email protected]>
mmc: sdhci-sprd: disable runtime PM on remove
Yibo Tan <[email protected]>
mmc: mtk-sd: Cancel request timeout work on remove
Guangshuo Li <[email protected]>
mmc: cavium-thunderx: destroy slot platform devices on remove
Guangshuo Li <[email protected]>
mmc: cavium-octeon: destroy slot platform devices on remove
Mikulas Patocka <[email protected]>
dm: fix reading free memory in do_resume
Ma Xinmeng <[email protected]>
dm-snap: reject the transient exception store for snapshot-merge
Ben Cressey <[email protected]>
dm-integrity: fix buffer overflow in inline mode with large tag size
Ben Cressey <[email protected]>
dm-crypt: reject the lmk IV mode with AEAD ciphers
Mikhail Gavrilov <[email protected]>
mm: don't schedule deferred kernel page table freeing while booting
Nguyen Ngoc Thang <[email protected]>
memstick: rtsx_usb_ms: complete requests after eject instead of dropping them
Raj Ojha <[email protected]>
memstick: core: wait for request completion before freeing card
성병찬 <[email protected]>
KEYS: Fix add_key() race with keyring restriction
Karl Mehltretter <[email protected]>
keys: finalize persistent keyring timeout after link attempt
Tristan Madani <[email protected]>
ice: fix metadata_dst refcount handling on representor teardown
Xuanqiang Luo <[email protected]>
ice: fix use-after-free in dynamic port cleanup
Mingming Cao <[email protected]>
ibmveth: fix TX LTB and filter unwind on open-fail
Mingming Cao <[email protected]>
ibmveth: h_free logical LAN on open-fail after register
Joshua Washington <[email protected]>
gve: fix XSK buffer leak on error descriptor
Joshua Washington <[email protected]>
gve: fix XSK buffer leak when rings are stopped
Joshua Washington <[email protected]>
gve: fix napi_disable deadlock when attempting to disable XSK pools
Ridham Khurana <[email protected]>
gpio: xilinx: fix runtime PM leak on request error path
Fan Wu <[email protected]>
gpio: mpsse: fix race when arming the IRQ poll worker
Vishal Badole <[email protected]>
EDAC/amd64: Mask UMC chip select to the four implemented selects
Hui Peng <[email protected]>
sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute
Stephen Smalley <[email protected]>
selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts
Christian Göttsche <[email protected]>
selinux: fix data race on AVC latest_notif
Yong-Xuan Wang <[email protected]>
RISC-V: Clear HSTATUS.HU on CPU initialization
Johannes Berg <[email protected]>
Revert "wifi: libertas: reject short monitor TX frames"
Chengfeng Ye <[email protected]>
tipc: hold a reference to nodes found by link name
Yuqi Xu <[email protected]>
tipc: destroy topsrv workqueues before closing connections
Daehyeon Ko <[email protected]>
tcp: reject net_iov in zerocopy receive mapping hints
Marek Szyprowski <[email protected]>
swiotlb: fix default_swiotlb_limit() for non-growable default pool
Sabrina Dubroca <[email protected]>
strparser: make sure __strp_recv isn't running before tearing down the parser
Georgiy Osokin <[email protected]>
tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()
Josef Bacik <[email protected]>
xen/netfront: don't leak the skb when xennet_fill_frags() fails
Pavankumar Kondeti <[email protected]>
workqueue: Fix NULL current_pwq deref in chained work check
Jason A. Donenfeld <[email protected]>
wireguard: noise: reject response consumption after intermediate initiation
Ramses de Norre <[email protected]>
wireguard: queueing: preserve tstamp_type when encapsulating packet
Lu Huang <[email protected]>
wifi: mt76: mt7996: fix uninitialized buf read in mt7996_variant_fem_init()
Cristian Papa <[email protected]>
wifi: mt76: mt7603: initialize global station WCID
Michele Dionisio <[email protected]>
wifi: brcmfmac: fix P2P device removal race in brcmf_detach()
Daehyeon Ko <[email protected]>
vsock/virtio: account only unread bytes in read_skb()
Ji-Ze Hong (Peter Hong) <[email protected]>
usb: f81604: fix struct f81604_int_data size mismatch
Palla Raghunath <[email protected]>
dm ioctl: don't let data_start run past the buffer
Daehyeon Ko <[email protected]>
cipso: adjust cached option offsets when removing CIPSO
Waiman Long <[email protected]>
cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()
Wentao Liang <[email protected]>
btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()
Michael Garland <[email protected]>
ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P)
Karl Mehltretter <[email protected]>
arm64: irq: exclude the softirq stack switch from KCOV
Mohamed Yassine Jebabli <[email protected]>
ALSA: hda/tas2781: Accept V1 calibration data without CRC
Harin Lee <[email protected]>
ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers
Krzysztof Furman <[email protected]>
Input: xpad - add support for Corsair Novablade Pro
Bihaan Sen <[email protected]>
Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox
Haotian Zhang <[email protected]>
Input: ati_remote2 - fix type confusion in device attribute handlers
Daehyeon Ko <[email protected]>
ipv6: do not warn on route notification size race
Daehyeon Ko <[email protected]>
ipv4: do not warn on route notification size race
Daehyeon Ko <[email protected]>
ipv4: stop route notification sizing when nexthop group shrinks
Daehyeon Ko <[email protected]>
ipv4: stop exception dump when nexthop group shrinks
Daehyeon Ko <[email protected]>
ipv4: stop PMTU walk when nexthop group shrinks
Alice Ryhl <[email protected]>
rust_binder: reschedule node refcount update on thread exit
Michael S. Tsirkin <[email protected]>
ipv4: validate checksum_start before completing checksum
Ido Schimmel <[email protected]>
ipv6: Fix redirect exception creation for UDP/RAW sockets
Eric Biggers <[email protected]>
crypto: drbg - Fix ineffective sanity check
Daniel Golle <[email protected]>
net: dsa: mt7530: fix .get_stats64 sleeping in atomic context
Chao Yu <[email protected]>
f2fs: fix to reset all pinned status during fggc
Chao Yu <[email protected]>
f2fs: fix to shrink gc_lock coverage in f2fs_gc_range()
Eva Crystal <[email protected]>
accel/amdxdna: Bound the sync_bo flush range to the BO size
Donald Hunter <[email protected]>
ynl: fix schema check errors
Remy D. Farley <[email protected]>
doc/netlink: netlink-raw: Add max check
Paulo Alcantara <[email protected]>
netfs: zero the tail of a short DIO/unbuffered read
Dipayaan Roy <[email protected]>
net: mana: Skip WQ object destruction for uninitialized RXQ
Dipayaan Roy <[email protected]>
net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq()
Jerome Tollet <[email protected]>
net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
Jerome Tollet <[email protected]>
net/mlx5e: Prevent stale XSK buffer release on refill retry
Matthew Wilcox (Oracle) <[email protected]>
fs: Free any excess xarray nodes in clear_inode()
Eric Dumazet <[email protected]>
bnxt_en: fix DMA mapping length for padded small packets
-------------
Diffstat:
Documentation/driver-api/driver-model/devres.rst | 4 + Documentation/netlink/netlink-raw.yaml | 11 +- Documentation/netlink/specs/conntrack.yaml | 2 +- Documentation/netlink/specs/nftables.yaml | 2 +- Documentation/networking/af_xdp.rst | 54 +- Documentation/networking/strparser.rst | 2 +- Makefile | 4 +- arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi | 19 +- arch/arm64/include/asm/el2_setup.h | 5 +- arch/arm64/include/asm/kvm_host.h | 2 +- arch/arm64/kernel/Makefile | 3 + arch/arm64/kernel/ptrace.c | 50 ++ arch/arm64/kvm/hyp/include/hyp/switch.h | 16 +- arch/arm64/kvm/nested.c | 4 + arch/arm64/kvm/sys_regs.c | 11 +- arch/arm64/kvm/vgic/vgic-its.c | 24 +- arch/arm64/kvm/vgic/vgic.c | 18 +- arch/loongarch/include/asm/kvm_host.h | 8 + arch/loongarch/include/asm/loongarch.h | 2 + arch/loongarch/kvm/intc/pch_pic.c | 3 + arch/loongarch/kvm/vm.c | 40 +- arch/loongarch/net/bpf_jit.c | 8 +- arch/powerpc/include/asm/book3s/64/pgtable.h | 15 + arch/powerpc/include/asm/xive.h | 4 +- arch/powerpc/kernel/iommu.c | 5 +- arch/powerpc/mm/book3s64/pgtable.c | 13 +- arch/powerpc/platforms/powernv/smp.c | 8 +- arch/powerpc/platforms/pseries/papr-hvpipe.c | 59 +-- arch/powerpc/platforms/pseries/smp.c | 8 +- arch/powerpc/sysdev/xive/common.c | 10 +- arch/riscv/Kconfig.errata | 1 + arch/riscv/include/asm/cpufeature.h | 2 + arch/riscv/include/asm/futex.h | 2 + arch/riscv/include/asm/scs.h | 17 +- arch/riscv/include/asm/vector.h | 8 +- arch/riscv/include/uapi/asm/vendor/mips.h | 4 +- arch/riscv/kernel/cpufeature.c | 12 + arch/riscv/kernel/entry.S | 2 +- arch/riscv/kernel/setup.c | 2 + arch/riscv/kernel/smpboot.c | 2 + arch/riscv/kernel/suspend.c | 2 + arch/riscv/kvm/vcpu_pmu.c | 28 +- arch/riscv/mm/extable.c | 4 +- arch/s390/net/bpf_jit_comp.c | 11 + arch/x86/include/asm/cpufeatures.h | 4 + arch/x86/include/asm/kvm-x86-ops.h | 4 + arch/x86/include/asm/kvm_host.h | 6 + arch/x86/include/asm/tlb.h | 6 + arch/x86/kernel/cpu/amd.c | 4 + arch/x86/kernel/uprobes.c | 294 ++++++++--- arch/x86/kvm/mmu/mmu.c | 5 + arch/x86/kvm/svm/nested.c | 10 +- arch/x86/kvm/svm/sev.c | 80 ++- arch/x86/kvm/svm/svm.c | 13 +- arch/x86/kvm/svm/svm.h | 8 +- arch/x86/kvm/x86.c | 6 + block/bfq-cgroup.c | 9 +- block/blk-cgroup.h | 2 + block/blk-iocost.c | 21 +- block/blk-iolatency.c | 19 +- block/blk-throttle.c | 15 +- crypto/af_alg.c | 2 +- crypto/drbg.c | 11 +- drivers/accel/amdxdna/Makefile | 1 + drivers/accel/amdxdna/aie2_ctx.c | 76 ++- drivers/accel/amdxdna/aie2_message.c | 93 ++-- drivers/accel/amdxdna/aie2_pci.c | 88 ++-- drivers/accel/amdxdna/aie2_pci.h | 8 +- drivers/accel/amdxdna/aie2_pm.c | 17 +- drivers/accel/amdxdna/aie2_smu.c | 12 + drivers/accel/amdxdna/amdxdna_ctx.c | 98 ++-- drivers/accel/amdxdna/amdxdna_ctx.h | 3 + drivers/accel/amdxdna/amdxdna_gem.c | 97 ++-- drivers/accel/amdxdna/amdxdna_gem.h | 1 - drivers/accel/amdxdna/amdxdna_mailbox.c | 13 +- drivers/accel/amdxdna/amdxdna_pci_drv.c | 56 +- drivers/accel/amdxdna/amdxdna_pci_drv.h | 1 + drivers/accel/amdxdna/amdxdna_pm.c | 76 +++ drivers/accel/amdxdna/amdxdna_pm.h | 18 + drivers/accel/amdxdna/npu1_regs.c | 1 + drivers/accel/amdxdna/npu2_regs.c | 1 + drivers/accel/amdxdna/npu4_regs.c | 1 + drivers/accel/amdxdna/npu5_regs.c | 1 + drivers/accel/amdxdna/npu6_regs.c | 1 + drivers/acpi/bus.c | 54 +- drivers/acpi/button.c | 132 ++--- drivers/acpi/scan.c | 19 +- drivers/android/binder/node.rs | 20 +- drivers/android/binder/node/wrapper.rs | 34 +- drivers/ata/libata-core.c | 7 + drivers/ata/libata-scsi.c | 10 +- drivers/block/drbd/drbd_receiver.c | 4 +- drivers/block/ublk_drv.c | 103 ++-- drivers/block/zloop.c | 31 +- drivers/block/zram/zram_drv.c | 7 +- drivers/bluetooth/btintel_pcie.c | 17 +- drivers/clocksource/samsung_pwm_timer.c | 22 +- drivers/cxl/core/features.c | 3 + drivers/cxl/core/mbox.c | 1 + drivers/cxl/core/port.c | 2 +- drivers/cxl/core/region.c | 12 +- drivers/cxl/cxl.h | 4 +- drivers/dma/idxd/init.c | 36 +- drivers/dma/xilinx/xilinx_dma.c | 14 +- drivers/dpll/dpll_core.c | 12 +- drivers/dpll/dpll_netlink.c | 68 ++- drivers/edac/amd64_edac.c | 4 +- drivers/firmware/arm_scmi/bus.c | 95 ++-- drivers/firmware/arm_scmi/driver.c | 4 - drivers/firmware/xilinx/zynqmp.c | 68 ++- drivers/gpio/gpio-exar.c | 2 +- drivers/gpio/gpio-mpsse.c | 24 +- drivers/gpio/gpio-pca953x.c | 20 +- drivers/gpio/gpio-xilinx.c | 9 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 8 +- drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 77 +-- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 25 + drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 17 +- drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c | 14 +- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 5 + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 25 +- drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 13 +- drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 13 +- drivers/gpu/drm/amd/amdgpu/mes_userqueue.c | 91 ++-- drivers/gpu/drm/amd/amdkfd/kfd_crat.c | 17 + .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 32 +- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 7 + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 3 +- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c | 25 +- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 8 +- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c | 10 +- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.h | 8 +- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c | 2 + .../drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 32 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_replay.c | 7 + drivers/gpu/drm/amd/display/dc/core/dc.c | 35 +- .../gpu/drm/amd/display/dc/core/dc_hw_sequencer.c | 24 +- .../drm/amd/display/dc/dml2/dml21/dml21_utils.c | 15 +- .../dml21/src/dml2_core/dml2_core_dcn4_calcs.c | 31 +- .../drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c | 52 ++ .../drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.h | 4 + .../gpu/drm/amd/display/dc/hwss/dcn35/dcn35_init.c | 2 +- .../drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 18 +- .../drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.h | 4 +- .../drm/amd/display/dc/hwss/dcn401/dcn401_init.c | 4 +- drivers/gpu/drm/amd/display/dc/hwss/hw_sequencer.h | 10 +- .../amd/display/dc/resource/dcn32/dcn32_resource.c | 8 +- drivers/gpu/drm/aspeed/aspeed_gfx_drv.c | 5 +- drivers/gpu/drm/display/drm_dp_helper.c | 4 +- drivers/gpu/drm/drm_fb_helper.c | 6 +- drivers/gpu/drm/gud/gud_pipe.c | 1 + drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c | 2 +- .../gpu/drm/i915/gt/intel_execlists_submission.c | 19 +- drivers/gpu/drm/i915/gt/intel_rps.c | 3 +- drivers/gpu/drm/imagination/pvr_mmu.c | 25 +- drivers/gpu/drm/imagination/pvr_vm.c | 8 +- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 5 +- drivers/gpu/drm/panthor/panthor_mmu.c | 9 + drivers/gpu/drm/panthor/panthor_sched.c | 37 +- drivers/gpu/drm/ttm/ttm_bo.c | 16 +- drivers/gpu/drm/ttm/ttm_bo_util.c | 11 +- drivers/gpu/drm/ttm/ttm_resource.c | 13 + drivers/gpu/drm/vc4/vc4_bo.c | 1 + drivers/gpu/drm/vc4/vc4_drv.c | 5 +- drivers/gpu/drm/vc4/vc4_drv.h | 2 +- drivers/gpu/drm/vc4/vc4_gem.c | 8 +- drivers/gpu/drm/vc4/vc4_irq.c | 6 +- drivers/gpu/drm/vc4/vc4_v3d.c | 52 +- drivers/gpu/drm/vc4/vc4_validate.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c | 26 +- drivers/gpu/drm/xe/display/xe_fb_pin.c | 6 +- drivers/gpu/drm/xe/xe_bo.c | 139 +++-- drivers/gpu/drm/xe/xe_bo.h | 2 + drivers/gpu/drm/xe/xe_device.c | 2 +- drivers/gpu/drm/xe/xe_device_types.h | 2 +- drivers/gpu/drm/xe/xe_guc_exec_queue_types.h | 5 + drivers/gpu/drm/xe/xe_guc_submit.c | 74 ++- drivers/gpu/drm/xe/xe_guc_types.h | 2 - drivers/gpu/drm/xe/xe_migrate.c | 17 +- drivers/gpu/drm/xe/xe_migrate.h | 3 +- drivers/gpu/drm/xe/xe_mmio.c | 5 +- drivers/gpu/drm/xe/xe_module.c | 49 ++ drivers/gpu/drm/xe/xe_module.h | 5 + drivers/gpu/drm/xe/xe_pci.c | 6 + drivers/gpu/drm/xe/xe_sriov_vf_ccs.c | 14 +- drivers/hid/hid-logitech-hidpp.c | 23 +- drivers/hv/Makefile | 2 +- drivers/hv/mshv_regions.c | 177 +++++++ drivers/hv/mshv_root.h | 10 + drivers/hv/mshv_root_main.c | 225 ++------ drivers/hwtracing/coresight/coresight-etm4x-core.c | 51 +- drivers/i3c/master/mipi-i3c-hci/core.c | 37 +- drivers/i3c/master/mipi-i3c-hci/dma.c | 12 +- drivers/i3c/master/mipi-i3c-hci/hci.h | 1 + drivers/i3c/master/mipi-i3c-hci/ibi.h | 13 +- drivers/i3c/master/mipi-i3c-hci/pio.c | 7 +- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 9 +- drivers/infiniband/hw/bnxt_re/qplib_sp.h | 1 + drivers/infiniband/hw/cxgb4/mem.c | 46 +- drivers/infiniband/hw/erdma/erdma_cm.c | 4 +- drivers/infiniband/sw/rdmavt/vt.c | 4 +- drivers/infiniband/sw/siw/siw_cm.c | 6 +- drivers/input/joystick/xpad.c | 4 + drivers/input/misc/ati_remote2.c | 12 +- drivers/iommu/amd/iommu.c | 11 +- drivers/iommu/apple-dart.c | 9 +- .../iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c | 5 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 31 +- drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 54 +- drivers/iommu/arm/arm-smmu/arm-smmu.c | 9 +- drivers/iommu/arm/arm-smmu/qcom_iommu.c | 11 +- drivers/iommu/dma-iommu.c | 2 +- drivers/iommu/exynos-iommu.c | 11 +- drivers/iommu/fsl_pamu_domain.c | 12 +- drivers/iommu/intel/iommu.c | 23 +- drivers/iommu/intel/nested.c | 2 +- drivers/iommu/iommu.c | 25 +- drivers/iommu/iommufd/selftest.c | 2 +- drivers/iommu/ipmmu-vmsa.c | 10 +- drivers/iommu/msm_iommu.c | 11 +- drivers/iommu/mtk_iommu.c | 8 +- drivers/iommu/mtk_iommu_v1.c | 7 +- drivers/iommu/omap-iommu.c | 12 +- drivers/iommu/riscv/iommu.c | 111 ++-- drivers/iommu/rockchip-iommu.c | 20 +- drivers/iommu/s390-iommu.c | 13 +- drivers/iommu/sprd-iommu.c | 3 +- drivers/iommu/sun50i-iommu.c | 8 +- drivers/iommu/tegra-smmu.c | 10 +- drivers/iommu/virtio-iommu.c | 6 +- drivers/irqchip/irq-gic-v5-irs.c | 14 + drivers/isdn/mISDN/l1oip_core.c | 2 +- drivers/isdn/mISDN/socket.c | 4 +- drivers/md/dm-crypt.c | 7 +- drivers/md/dm-integrity.c | 4 +- drivers/md/dm-ioctl.c | 14 +- drivers/md/dm-pcache/cache.c | 4 + drivers/md/dm-pcache/cache.h | 14 + drivers/md/dm-pcache/cache_gc.c | 16 +- drivers/md/dm-pcache/cache_key.c | 11 + drivers/md/dm-pcache/cache_writeback.c | 20 +- drivers/md/dm-snap.c | 14 + drivers/md/md-bitmap.c | 9 +- drivers/md/md-bitmap.h | 2 +- drivers/md/md-linear.c | 1 + drivers/md/md-llbitmap.c | 10 +- drivers/md/md.c | 39 +- drivers/md/md.h | 5 + drivers/md/raid0.c | 1 + drivers/md/raid1-10.c | 8 +- drivers/md/raid1.c | 116 ++-- drivers/md/raid10.c | 143 ++--- drivers/md/raid5.c | 12 - .../platform/chips-media/wave5/wave5-vpu-dec.c | 19 + drivers/media/platform/qcom/iris/iris_ctrls.c | 2 +- .../platform/qcom/iris/iris_platform_common.h | 4 +- .../media/platform/qcom/iris/iris_platform_gen2.c | 4 +- .../platform/qcom/iris/iris_platform_qcs8300.h | 4 +- .../platform/qcom/iris/iris_platform_sm8250.c | 4 +- drivers/media/platform/qcom/iris/iris_vdec.c | 6 - drivers/media/platform/qcom/iris/iris_vdec.h | 1 - drivers/media/platform/qcom/iris/iris_venc.c | 6 - drivers/media/platform/qcom/iris/iris_venc.h | 1 - drivers/media/platform/qcom/iris/iris_vidc.c | 6 +- drivers/media/platform/verisilicon/hantro.h | 2 + drivers/media/platform/verisilicon/hantro_drv.c | 42 +- drivers/media/platform/verisilicon/imx8m_vpu_hw.c | 8 + drivers/media/v4l2-core/v4l2-mem2mem.c | 23 + drivers/memstick/core/memstick.c | 8 +- drivers/memstick/host/rtsx_usb_ms.c | 31 +- drivers/mmc/host/cavium-octeon.c | 5 +- drivers/mmc/host/cavium-thunderx.c | 5 +- drivers/mmc/host/mtk-sd.c | 1 + drivers/mmc/host/sdhci-sprd.c | 4 + drivers/net/amt.c | 48 +- drivers/net/can/usb/f81604.c | 2 +- drivers/net/dsa/microchip/ksz_common.h | 2 +- drivers/net/dsa/mt7530.c | 75 ++- drivers/net/dsa/mt7530.h | 8 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 346 +++++++----- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 23 +- drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c | 8 +- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +- drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c | 350 +++++++----- drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c | 11 + drivers/net/ethernet/cavium/liquidio/lio_main.c | 27 - .../net/ethernet/cavium/liquidio/octeon_device.h | 3 - .../net/ethernet/cavium/liquidio/octeon_mailbox.c | 33 +- .../chelsio/inline_crypto/ch_ktls/chcr_ktls.c | 4 +- drivers/net/ethernet/google/gve/gve_main.c | 8 +- drivers/net/ethernet/google/gve/gve_rx_dqo.c | 13 +- drivers/net/ethernet/ibm/ibmveth.c | 22 +- drivers/net/ethernet/intel/ice/devlink/port.c | 2 +- drivers/net/ethernet/intel/ice/ice.h | 7 +- drivers/net/ethernet/intel/ice/ice_base.c | 79 +-- drivers/net/ethernet/intel/ice/ice_dcb_lib.c | 2 +- drivers/net/ethernet/intel/ice/ice_eswitch.c | 2 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 11 +- drivers/net/ethernet/intel/ice/ice_lib.c | 19 +- drivers/net/ethernet/intel/ice/ice_main.c | 11 +- drivers/net/ethernet/intel/ice/ice_txrx.c | 266 ++-------- drivers/net/ethernet/intel/ice/ice_txrx.h | 149 ++---- drivers/net/ethernet/intel/ice/ice_xsk.c | 75 +-- drivers/net/ethernet/intel/ice/virt/queues.c | 6 +- drivers/net/ethernet/intel/idpf/idpf_dev.c | 2 +- drivers/net/ethernet/intel/idpf/idpf_vf_dev.c | 2 +- drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 12 +- drivers/net/ethernet/intel/idpf/idpf_virtchnl.h | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 3 +- drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 12 + drivers/net/ethernet/marvell/octeontx2/af/cgx.h | 1 + .../net/ethernet/marvell/octeontx2/af/cn20k/api.h | 1 + .../marvell/octeontx2/af/cn20k/mbox_init.c | 21 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 39 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 2 + .../net/ethernet/marvell/octeontx2/af/rvu_cgx.c | 79 +++ .../net/ethernet/marvell/octeontx2/af/rvu_nix.c | 22 +- .../net/ethernet/marvell/octeontx2/af/rvu_npc.c | 29 +- .../net/ethernet/mellanox/mlx5/core/en/xsk/rx.c | 2 + drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 13 +- .../ethernet/mellanox/mlx5/core/esw/adj_vport.c | 20 - drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/vport.c | 24 - drivers/net/ethernet/mellanox/mlxsw/spectrum.h | 2 + drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c | 10 +- .../net/ethernet/mellanox/mlxsw/spectrum_flower.c | 9 +- drivers/net/ethernet/microchip/sparx5/sparx5_ptp.c | 28 +- .../ethernet/microchip/sparx5/sparx5_tc_matchall.c | 1 + drivers/net/ethernet/microsoft/mana/gdma_main.c | 19 + drivers/net/ethernet/microsoft/mana/mana_en.c | 7 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 67 ++- drivers/net/ethernet/ti/icssg/icssg_common.c | 86 ++- drivers/net/ethernet/ti/icssg/icssg_prueth.c | 184 ++++--- drivers/net/ethernet/ti/icssg/icssg_prueth.h | 17 +- drivers/net/ethernet/ti/icssg/icssg_prueth_sr1.c | 4 +- drivers/net/ovpn/crypto.c | 10 +- drivers/net/ovpn/crypto.h | 4 +- drivers/net/ovpn/crypto_aead.c | 19 +- drivers/net/ovpn/crypto_aead.h | 1 - drivers/net/pfcp.c | 7 + drivers/net/ppp/pptp.c | 4 +- drivers/net/team/team_core.c | 16 +- drivers/net/team/team_mode_broadcast.c | 2 + drivers/net/usb/ax88179_178a.c | 6 +- drivers/net/veth.c | 1 + drivers/net/virtio_net.c | 14 + drivers/net/vxlan/vxlan_core.c | 20 +- drivers/net/wan/hdlc_ppp.c | 4 +- drivers/net/wireguard/noise.c | 7 +- drivers/net/wireguard/queueing.h | 2 + drivers/net/wireless/ath/ath12k/core.c | 33 +- drivers/net/wireless/ath/ath12k/core.h | 3 - drivers/net/wireless/ath/ath12k/dp_rx.c | 4 +- drivers/net/wireless/ath/ath12k/hif.h | 9 - drivers/net/wireless/ath/ath12k/mac.c | 7 +- drivers/net/wireless/ath/ath12k/pci.c | 8 - drivers/net/wireless/ath/ath12k/wmi.c | 16 + .../wireless/broadcom/brcm80211/brcmfmac/core.c | 27 +- .../net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 4 + drivers/net/wireless/marvell/libertas/tx.c | 7 - drivers/net/wireless/mediatek/mt76/channel.c | 98 ++-- drivers/net/wireless/mediatek/mt76/mt76.h | 10 + drivers/net/wireless/mediatek/mt76/mt7603/init.c | 1 + .../net/wireless/mediatek/mt76/mt76_connac_mcu.h | 1 + drivers/net/wireless/mediatek/mt76/mt7915/init.c | 8 + drivers/net/wireless/mediatek/mt76/mt7915/main.c | 2 + drivers/net/wireless/mediatek/mt76/mt7921/main.c | 3 + drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 3 +- drivers/net/wireless/mediatek/mt76/mt7925/main.c | 48 +- .../net/wireless/mediatek/mt76/mt792x_acpi_sar.c | 134 +++-- .../net/wireless/mediatek/mt76/mt792x_acpi_sar.h | 2 + drivers/net/wireless/mediatek/mt76/mt7996/init.c | 4 +- drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 3 + drivers/net/wireless/mediatek/mt76/mt7996/main.c | 1 + drivers/net/wireless/mediatek/mt76/mt7996/mcu.h | 3 + drivers/net/wireless/mediatek/mt76/tx.c | 101 +++- drivers/net/xen-netfront.c | 4 +- drivers/ntb/ntb_transport.c | 18 +- drivers/nvme/host/pci.c | 28 +- drivers/nvme/host/tcp.c | 2 +- drivers/nvme/target/admin-cmd.c | 12 +- drivers/nvme/target/core.c | 59 ++- drivers/nvme/target/fabrics-cmd.c | 2 +- drivers/nvme/target/nvmet.h | 6 + drivers/nvme/target/pci-epf.c | 2 +- drivers/nvme/target/pr.c | 4 + drivers/nvme/target/tcp.c | 2 +- drivers/pci/endpoint/functions/pci-epf-mhi.c | 2 +- drivers/pci/endpoint/functions/pci-epf-ntb.c | 9 +- drivers/pci/endpoint/functions/pci-epf-test.c | 2 +- drivers/pci/endpoint/functions/pci-epf-vntb.c | 9 +- drivers/pci/hotplug/pnv_php.c | 2 +- drivers/pci/hotplug/shpchp_core.c | 3 +- drivers/pci/pci-driver.c | 192 ++++--- drivers/pci/pci-sysfs.c | 15 + drivers/pci/pci.h | 41 +- drivers/pci/search.c | 8 +- drivers/pinctrl/mediatek/pinctrl-moore.c | 6 +- drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 14 +- drivers/pinctrl/mediatek/pinctrl-paris.c | 2 +- drivers/pinctrl/pinctrl-zynqmp.c | 7 +- drivers/platform/x86/asus-wmi.c | 6 +- drivers/platform/x86/dell/dell-wmi-base.c | 2 +- drivers/pmdomain/imx/imx8m-blk-ctrl.c | 15 + drivers/pmdomain/rockchip/pm-domains.c | 20 +- drivers/power/supply/max77705_charger.c | 30 +- drivers/ptp/ptp_ocp.c | 38 +- drivers/pwm/pwm-samsung.c | 22 +- drivers/regulator/ltc3676.c | 15 +- drivers/regulator/tps6594-regulator.c | 6 +- drivers/remoteproc/qcom_wcnss.c | 23 +- drivers/s390/crypto/zcrypt_api.c | 38 +- drivers/s390/crypto/zcrypt_msgtype6.c | 431 ++++++++++----- drivers/s390/crypto/zcrypt_msgtype6.h | 51 +- drivers/scsi/ch.c | 4 +- drivers/scsi/qedi/qedi_main.c | 3 +- drivers/scsi/qla2xxx/qla_iocb.c | 2 - drivers/scsi/scsi_error.c | 6 +- drivers/scsi/scsi_sysfs.c | 77 ++- drivers/scsi/sd.c | 213 ++++---- drivers/scsi/ses.c | 4 +- drivers/scsi/sr.c | 4 +- drivers/scsi/st.c | 4 +- drivers/soc/aspeed/aspeed-lpc-snoop.c | 29 +- drivers/soc/tegra/pmc.c | 104 ++-- drivers/soc/xilinx/xlnx_event_manager.c | 8 +- drivers/soc/xilinx/zynqmp_power.c | 53 +- drivers/spi/spi-sg2044-nor.c | 60 ++- drivers/staging/greybus/raw.c | 67 ++- drivers/target/iscsi/iscsi_target_login.c | 2 +- drivers/tee/optee/ffa_abi.c | 41 +- drivers/tee/optee/optee_msg.h | 50 +- drivers/tee/optee/optee_private.h | 120 +++-- drivers/tee/optee/smc_abi.c | 17 +- drivers/tee/tee_shm.c | 4 + drivers/thermal/thermal_hwmon.c | 89 ++-- drivers/tty/serial/serial_core.c | 33 +- drivers/tty/tty_io.c | 2 +- drivers/ufs/core/ufshcd-priv.h | 14 +- drivers/ufs/core/ufshcd.c | 40 +- drivers/usb/gadget/function/f_uac1.c | 13 +- drivers/usb/gadget/function/f_uac2.c | 13 +- drivers/vdpa/mlx5/core/mlx5_vdpa.h | 2 + drivers/vdpa/mlx5/core/mr.c | 5 +- drivers/vdpa/mlx5/core/resources.c | 11 +- drivers/vdpa/vdpa_sim/vdpa_sim.c | 14 +- drivers/vdpa/vdpa_user/iova_domain.c | 11 +- drivers/vdpa/vdpa_user/vduse_dev.c | 4 +- drivers/vhost/iotlb.c | 47 +- drivers/vhost/net.c | 2 + drivers/vhost/vdpa.c | 9 +- drivers/vhost/vhost.c | 65 ++- drivers/vhost/vhost.h | 1 + drivers/vhost/vsock.c | 2 + drivers/video/fbdev/core/fb_chrdev.c | 6 +- drivers/video/fbdev/core/fbcon.c | 2 - drivers/video/fbdev/core/fbmem.c | 13 + drivers/video/fbdev/core/fbsysfs.c | 4 +- drivers/video/fbdev/omap2/omapfb/omapfb-main.c | 11 +- drivers/video/fbdev/ps3fb.c | 5 +- drivers/video/fbdev/sh_mobile_lcdcfb.c | 5 +- drivers/virtio/virtio_ring.c | 19 +- drivers/xen/pvcalls-back.c | 2 +- drivers/xen/pvcalls-front.c | 88 +++- fs/afs/Makefile | 1 + fs/afs/dir.c | 68 +-- fs/afs/fsclient.c | 4 +- fs/afs/inode.c | 96 +--- fs/afs/internal.h | 34 +- fs/afs/rxrpc.c | 6 +- fs/afs/symlink.c | 278 ++++++++++ fs/afs/validation.c | 14 +- fs/afs/yfsclient.c | 4 +- fs/btrfs/acl.c | 29 +- fs/btrfs/bio.c | 8 +- fs/btrfs/block-group.c | 2 +- fs/btrfs/block-rsv.c | 19 +- fs/btrfs/delayed-inode.c | 15 +- fs/btrfs/disk-io.c | 82 ++- fs/btrfs/extent-tree.c | 52 +- fs/btrfs/extent-tree.h | 3 +- fs/btrfs/extent_io.c | 162 ++++-- fs/btrfs/extent_io.h | 6 + fs/btrfs/fs.h | 27 +- fs/btrfs/inode.c | 7 +- fs/btrfs/ioctl.c | 50 +- fs/btrfs/lzo.c | 14 +- fs/btrfs/qgroup.c | 3 +- fs/btrfs/raid-stripe-tree.c | 14 +- fs/btrfs/reflink.c | 7 +- fs/btrfs/relocation.c | 34 +- fs/btrfs/scrub.c | 4 +- fs/btrfs/send.c | 50 +- fs/btrfs/super.c | 3 +- fs/btrfs/tests/extent-io-tests.c | 3 +- fs/btrfs/tests/extent-map-tests.c | 6 +- fs/btrfs/tree-log.c | 43 +- fs/btrfs/volumes.c | 28 +- fs/btrfs/xattr.c | 15 +- fs/btrfs/zoned.c | 3 +- fs/cachefiles/namei.c | 7 +- fs/ceph/addr.c | 2 + fs/ceph/mds_client.c | 6 + fs/dcache.c | 4 +- fs/dlm/lowcomms.c | 6 +- fs/erofs/xattr.c | 6 +- fs/ext2/inode.c | 3 +- fs/ext2/xattr.c | 4 +- fs/ext4/ext4.h | 3 +- fs/ext4/inode.c | 35 +- fs/ext4/ioctl.c | 11 +- fs/ext4/move_extent.c | 102 ++-- fs/ext4/xattr.c | 2 +- fs/f2fs/data.c | 27 +- fs/f2fs/f2fs.h | 2 +- fs/f2fs/gc.c | 36 +- fs/f2fs/node.c | 2 + fs/f2fs/segment.c | 4 +- fs/fcntl.c | 3 + fs/fsopen.c | 3 + fs/fuse/dev_uring.c | 30 +- fs/fuse/inode.c | 4 - fs/gfs2/aops.c | 2 +- fs/gfs2/file.c | 2 +- fs/gfs2/glock.c | 10 +- fs/gfs2/glock.h | 2 +- fs/gfs2/glops.c | 13 +- fs/gfs2/incore.h | 2 +- fs/gfs2/lock_dlm.c | 22 +- fs/gfs2/log.c | 43 +- fs/gfs2/lops.c | 2 +- fs/gfs2/meta_io.c | 6 +- fs/gfs2/ops_fstype.c | 8 +- fs/gfs2/quota.c | 66 ++- fs/gfs2/recovery.c | 2 +- fs/gfs2/super.c | 14 +- fs/gfs2/sys.c | 34 +- fs/gfs2/trans.c | 2 +- fs/gfs2/util.c | 74 ++- fs/gfs2/util.h | 43 +- fs/hfs/dir.c | 15 +- fs/hfs/hfs_fs.h | 1 + fs/hfs/inode.c | 30 +- fs/hfs/mdb.c | 31 +- fs/hfs/super.c | 3 + fs/inode.c | 23 +- fs/iomap/direct-io.c | 1 + fs/lockd/svc.c | 4 +- fs/lockd/svc4proc.c | 4 +- fs/lockd/svcproc.c | 4 +- fs/lockd/svcsubs.c | 52 +- fs/mount.h | 6 +- fs/namei.c | 29 + fs/namespace.c | 232 +++++--- fs/netfs/buffered_read.c | 9 +- fs/netfs/internal.h | 1 + fs/netfs/main.c | 7 + fs/netfs/misc.c | 3 +- fs/netfs/objects.c | 30 +- fs/netfs/read_collect.c | 35 +- fs/netfs/read_pgpriv2.c | 2 +- fs/netfs/rolling_buffer.c | 22 +- fs/netfs/write_collect.c | 6 +- fs/netfs/write_issue.c | 13 +- fs/nfs/callback_xdr.c | 6 +- fs/nfs/delegation.c | 18 +- fs/nfsd/lockd.c | 6 +- fs/nfsd/netns.h | 20 +- fs/nfsd/nfs4proc.c | 2 +- fs/nfsd/nfs4recover.c | 12 +- fs/nfsd/nfs4state.c | 60 ++- fs/nfsd/nfsctl.c | 4 +- fs/nfsd/nfssvc.c | 45 +- fs/ntfs3/dir.c | 3 +- fs/ntfs3/file.c | 6 +- fs/ntfs3/frecord.c | 7 +- fs/ntfs3/inode.c | 19 +- fs/ntfs3/namei.c | 6 +- fs/ntfs3/ntfs_fs.h | 6 +- fs/ntfs3/super.c | 31 +- fs/ocfs2/cluster/heartbeat.c | 139 +++-- fs/ocfs2/cluster/tcp.c | 107 +++- fs/ocfs2/cluster/tcp.h | 1 + fs/ocfs2/inode.c | 23 + fs/pnode.c | 108 +++- fs/resctrl/monitor.c | 60 ++- fs/resctrl/rdtgroup.c | 48 +- fs/smb/client/cifsacl.c | 28 +- fs/smb/client/cifsfs.c | 1 + fs/smb/client/cifsglob.h | 1 + fs/smb/client/connect.c | 2 +- fs/smb/client/file.c | 65 ++- fs/smb/client/inode.c | 24 +- fs/smb/client/misc.c | 35 +- fs/smb/client/readdir.c | 17 +- fs/smb/server/connection.c | 37 +- fs/smb/server/connection.h | 6 +- fs/smb/server/mgmt/tree_connect.c | 33 +- fs/smb/server/mgmt/user_config.c | 11 + fs/smb/server/mgmt/user_session.c | 10 +- fs/smb/server/mgmt/user_session.h | 2 +- fs/smb/server/oplock.c | 81 ++- fs/smb/server/oplock.h | 1 + fs/smb/server/smb2pdu.c | 106 ++-- fs/smb/server/smbacl.c | 88 ++-- fs/smb/server/smbacl.h | 2 +- fs/smb/server/transport_tcp.c | 4 +- fs/smb/server/vfs.c | 2 +- fs/smb/server/vfs_cache.c | 8 +- fs/tracefs/event_inode.c | 24 + fs/tracefs/internal.h | 4 +- fs/udf/super.c | 4 +- include/acpi/acpi_bus.h | 6 + include/clocksource/samsung_pwm.h | 2 +- include/cxl/mailbox.h | 2 + include/drm/ttm/ttm_resource.h | 2 + include/kvm/arm_vgic.h | 3 - include/linux/bnxt/ulp.h | 25 +- include/linux/bpf.h | 5 +- include/linux/bpf_verifier.h | 2 + include/linux/compiler_types.h | 8 +- include/linux/fb.h | 2 + include/linux/firmware/xlnx-zynqmp.h | 18 +- include/linux/ieee80211-s1g.h | 575 ++++++++++++++++++++ include/linux/ieee80211.h | 585 +-------------------- include/linux/iommu.h | 3 +- include/linux/kvm_host.h | 1 + include/linux/list.h | 37 ++ include/linux/lockd/bind.h | 12 +- include/linux/mempool.h | 7 + include/linux/mount.h | 2 +- include/linux/net.h | 4 +- include/linux/netfilter/x_tables.h | 1 + include/linux/netfs.h | 1 + include/linux/ntb.h | 24 + include/linux/nvme.h | 4 +- include/linux/pci.h | 1 + include/linux/ring_buffer.h | 5 +- include/linux/rolling_buffer.h | 6 +- include/linux/skbuff.h | 2 + include/linux/socket.h | 17 + include/linux/srcutiny.h | 4 + include/linux/static_call_types.h | 4 + include/linux/sunrpc/svc_rdma.h | 14 +- include/linux/workqueue.h | 24 + include/media/v4l2-mem2mem.h | 21 + include/net/amt.h | 4 - include/net/bluetooth/hci_core.h | 2 + include/net/cfg80211.h | 3 +- include/net/inet_common.h | 2 +- include/net/ip.h | 7 + include/net/ip_vs.h | 2 +- include/net/ipv6.h | 2 +- include/net/mac80211.h | 14 +- include/net/netfilter/nf_dup_netdev.h | 37 ++ include/net/netfilter/nf_tables.h | 15 +- include/net/pkt_cls.h | 14 +- include/net/sock.h | 2 +- include/net/strparser.h | 10 +- include/net/xsk_buff_pool.h | 9 +- include/scsi/scsi_driver.h | 7 +- include/scsi/scsi_host.h | 7 +- include/ufs/ufshcd.h | 4 - kernel/bpf/bpf_struct_ops.c | 12 + kernel/bpf/btf.c | 17 +- kernel/bpf/stackmap.c | 120 +++-- kernel/bpf/syscall.c | 2 + kernel/bpf/trampoline.c | 7 + kernel/bpf/verifier.c | 215 ++++++-- kernel/cgroup/cpuset.c | 29 +- kernel/dma/swiotlb.c | 6 +- kernel/kexec_handover.c | 2 +- kernel/printk/nbcon.c | 2 +- kernel/printk/printk.c | 2 +- kernel/rcu/srcutiny.c | 19 +- kernel/trace/blktrace.c | 4 +- kernel/trace/ring_buffer.c | 260 +++++---- kernel/trace/ring_buffer_benchmark.c | 6 +- kernel/trace/trace.c | 156 +++--- kernel/trace/trace.h | 1 + kernel/workqueue.c | 51 +- mm/pgtable-generic.c | 20 +- net/9p/trans_fd.c | 2 +- net/appletalk/ddp.c | 2 +- net/atm/pvc.c | 4 +- net/atm/svc.c | 2 +- net/ax25/af_ax25.c | 2 +- net/bluetooth/6lowpan.c | 27 +- net/bluetooth/hci_conn.c | 17 +- net/bluetooth/hci_core.c | 4 + net/bluetooth/hci_event.c | 108 ++-- net/bluetooth/hci_sock.c | 4 +- net/bluetooth/hci_sync.c | 103 +++- net/bluetooth/iso.c | 56 +- net/bluetooth/l2cap_sock.c | 59 ++- net/bluetooth/mgmt.c | 2 +- net/bluetooth/rfcomm/core.c | 4 +- net/bluetooth/rfcomm/sock.c | 7 +- net/bluetooth/rfcomm/tty.c | 2 +- net/bluetooth/sco.c | 89 +++- net/bridge/br_arp_nd_proxy.c | 24 +- net/bridge/br_multicast.c | 23 +- net/bridge/netfilter/nf_conntrack_bridge.c | 10 +- net/can/isotp.c | 2 +- net/can/j1939/socket.c | 2 +- net/can/raw.c | 2 +- net/ceph/auth_x.c | 5 + net/core/bpf_sk_storage.c | 14 +- net/core/dev.c | 59 ++- net/core/filter.c | 4 +- net/core/flow_dissector.c | 11 +- net/core/skbuff.c | 6 +- net/core/sock.c | 5 +- net/devlink/core.c | 10 +- net/hsr/hsr_framereg.c | 6 +- net/ieee802154/socket.c | 4 +- net/ipv4/af_inet.c | 4 +- net/ipv4/cipso_ipv4.c | 8 + net/ipv4/esp4.c | 7 + net/ipv4/fib_semantics.c | 3 + net/ipv4/fib_trie.c | 2 - net/ipv4/ip_output.c | 10 +- net/ipv4/netfilter/arp_tables.c | 35 +- net/ipv4/netfilter/ip_tables.c | 41 +- net/ipv4/nexthop.c | 22 +- net/ipv4/route.c | 5 + net/ipv4/tcp.c | 2 + net/ipv4/udp_tunnel_core.c | 2 +- net/ipv6/af_inet6.c | 4 +- net/ipv6/esp6.c | 7 + net/ipv6/ip6_udp_tunnel.c | 2 +- net/ipv6/ip6mr.c | 3 +- net/ipv6/mcast.c | 31 +- net/ipv6/netfilter/ip6_tables.c | 38 +- net/ipv6/route.c | 4 +- net/iucv/af_iucv.c | 2 +- net/l2tp/l2tp_core.c | 4 +- net/llc/af_llc.c | 2 +- net/mac80211/debugfs.c | 13 +- net/mac80211/ieee80211_i.h | 2 + net/mac80211/main.c | 1 + net/mac80211/rx.c | 50 +- net/mac80211/sta_info.c | 17 +- net/mac80211/sta_info.h | 3 +- net/mac80211/status.c | 5 +- net/mac80211/tx.c | 70 ++- net/mac80211/util.c | 3 + net/mctp/af_mctp.c | 2 +- net/mctp/test/route-test.c | 2 +- net/mctp/test/utils.c | 2 +- net/mptcp/protocol.c | 6 +- net/mptcp/subflow.c | 2 +- net/netfilter/ipvs/ip_vs_core.c | 11 +- net/netfilter/ipvs/ip_vs_sync.c | 4 +- net/netfilter/ipvs/ip_vs_xmit.c | 3 +- net/netfilter/nf_conntrack_bpf.c | 113 ++-- net/netfilter/nf_dup_netdev.c | 31 +- net/netfilter/nf_flow_table_path.c | 3 +- net/netfilter/nf_tables_api.c | 320 +++++++---- net/netfilter/nfnetlink_queue.c | 7 + net/netfilter/nft_dynset.c | 25 +- net/netfilter/nft_fwd_netdev.c | 27 +- net/netfilter/x_tables.c | 77 ++- net/netfilter/xt_CHECKSUM.c | 6 +- net/netlink/af_netlink.c | 2 +- net/netrom/af_netrom.c | 2 +- net/nfc/llcp_sock.c | 4 +- net/openvswitch/actions.c | 7 +- net/openvswitch/datapath.c | 8 + net/packet/af_packet.c | 39 +- net/phonet/socket.c | 18 +- net/qrtr/af_qrtr.c | 2 +- net/qrtr/ns.c | 2 +- net/rds/bind.c | 2 +- net/rds/rds.h | 2 +- net/rds/tcp_connect.c | 2 +- net/rds/tcp_listen.c | 2 +- net/rose/af_rose.c | 2 +- net/rxrpc/af_rxrpc.c | 2 +- net/rxrpc/rxperf.c | 2 +- net/sched/cls_api.c | 6 +- net/sched/cls_basic.c | 6 +- net/sched/cls_bpf.c | 6 +- net/sched/cls_cgroup.c | 2 +- net/sched/cls_flow.c | 2 +- net/sched/cls_flower.c | 4 +- net/sched/cls_fw.c | 4 +- net/sched/cls_matchall.c | 4 +- net/sched/cls_route.c | 10 +- net/sched/cls_u32.c | 18 +- net/sched/em_text.c | 3 + net/sched/sch_cake.c | 2 +- net/sched/sch_drr.c | 2 +- net/sched/sch_dualpi2.c | 2 +- net/sched/sch_ets.c | 2 +- net/sched/sch_fq_codel.c | 2 +- net/sched/sch_fq_pie.c | 2 +- net/sched/sch_hfsc.c | 2 +- net/sched/sch_htb.c | 2 +- net/sched/sch_multiq.c | 2 +- net/sched/sch_netem.c | 7 +- net/sched/sch_prio.c | 2 +- net/sched/sch_qfq.c | 2 +- net/sched/sch_sfb.c | 2 +- net/sched/sch_sfq.c | 2 +- net/sctp/socket.c | 6 +- net/smc/af_smc.c | 100 +--- net/smc/smc.h | 2 +- net/socket.c | 6 +- net/strparser/strparser.c | 6 +- net/sunrpc/auth_gss/gss_krb5_crypto.c | 232 ++++++++ net/sunrpc/auth_gss/gss_krb5_internal.h | 20 + net/sunrpc/auth_gss/gss_krb5_mech.c | 96 +++- net/sunrpc/auth_gss/gss_krb5_seal.c | 45 +- net/sunrpc/auth_gss/gss_krb5_unseal.c | 39 +- net/sunrpc/clnt.c | 4 +- net/sunrpc/svcsock.c | 2 +- net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 4 +- net/sunrpc/xprtrdma/svc_rdma_rw.c | 100 +++- net/sunrpc/xprtrdma/svc_rdma_sendto.c | 16 +- net/sunrpc/xprtrdma/svc_rdma_transport.c | 32 +- net/sunrpc/xprtsock.c | 4 +- net/tipc/core.c | 4 +- net/tipc/node.c | 10 +- net/tipc/socket.c | 4 +- net/tipc/topsrv.c | 80 ++- net/tipc/udp_media.c | 75 +-- net/unix/af_unix.c | 4 +- net/vmw_vsock/af_vsock.c | 6 +- net/vmw_vsock/virtio_transport_common.c | 4 +- net/wireless/core.c | 7 +- net/wireless/core.h | 2 +- net/wireless/nl80211.c | 19 +- net/wireless/sme.c | 6 +- net/x25/af_x25.c | 2 +- net/xdp/xsk.c | 201 ++++++- net/xdp/xsk_buff_pool.c | 13 +- net/xdp/xsk_queue.h | 65 ++- net/xfrm/xfrm_output.c | 16 +- security/keys/key.c | 6 +- security/keys/persistent.c | 55 +- security/selinux/avc.c | 5 +- security/selinux/hooks.c | 9 +- sound/hda/codecs/side-codecs/tas2781_hda.c | 18 +- sound/pci/ctxfi/ctatc.c | 63 ++- sound/pci/ctxfi/ctatc.h | 4 - sound/pci/ctxfi/ctdaio.c | 97 ++-- sound/pci/ctxfi/ctdaio.h | 2 + sound/pci/ctxfi/cthardware.h | 2 +- sound/pci/ctxfi/cthw20k1.c | 2 +- sound/pci/ctxfi/cthw20k2.c | 2 +- sound/soc/amd/acp/acp-mach-common.c | 18 +- sound/soc/amd/yc/acp6x-mach.c | 7 + sound/soc/codecs/adau1372.c | 18 +- sound/soc/qcom/qdsp6/q6asm.c | 5 + sound/soc/samsung/i2s.c | 8 + tools/include/linux/static_call_types.h | 4 + .../bpf/progs/verifier_subprog_precision.c | 12 +- .../testing/selftests/bpf/test_kmods/bpf_testmod.c | 2 +- virt/kvm/guest_memfd.c | 12 +- virt/kvm/kvm_mm.h | 7 +- 861 files changed, 13310 insertions(+), 7485 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/621 bnxt_en: fix DMA mapping length for padded small packets
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit a51d233ccd4889aadb71dace863525cc2b00271e ]
Stefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412 NetXtreme-E NICs when transmitting packets on VLAN/macvlan interfaces:
DMAR: [DMA Read NO_PASID] Request device [18:00.0] fault addr 0xfc499000
[fault reason 0x06] PTE Read access is not set
bnxt_en 0000:18:00.0 eno1np0: Abandoning msg {0xb4 0x41a} len: 0 due to firmware status: 0x2000001
...
NETDEV WATCHDOG: eno1np0 (bnxt_en): transmit queue 0 timed out
The fault address (0xfc499000) is on an exact 4KB page boundary, pointing to a DMA read buffer overrun.
In bnxt_start_xmit(), packets smaller than BNXT_MIN_PKT_SIZE (52 bytes), such as 42-byte untagged ARP frames, are padded:
if (length < BNXT_MIN_PKT_SIZE) {
pad = BNXT_MIN_PKT_SIZE - length;
if (skb_pad(skb, pad))
goto tx_kick_pending;
length = BNXT_MIN_PKT_SIZE;
}
mapping = dma_map_single(&pdev->dev, skb->data, len, DMA_TO_DEVICE);
...
dma_unmap_len_set(tx_buf, len, len);However, 'len' was initialized earlier to skb_headlen(skb) (e.g. 42 bytes) and is left unadjusted after padding. Consequently, dma_map_single() and dma_unmap_len_set() map and track only 42 bytes.
Later, the hardware TX buffer descriptor is programmed with the padded length:
txbd->tx_bd_len_flags_type =
cpu_to_le32(((len + pad) << TX_BD_LEN_SHIFT) | flags |
TX_BD_FLAGS_PACKET_END);The NIC DMA engine is thus instructed to read 52 bytes from a region where only 42 bytes were DMA-mapped. If skb->data ends near the boundary of a 4KB page (within 'pad' bytes of the next page), the hardware DMA read overruns into the unmapped adjacent page, triggering an IOMMU fault.
This issue was exposed after commit 447cbe95ebb9 ("vlan: fix skb_under_panic and races when toggling HW VLAN offload") because reserving extra VLAN headroom rounded LL_RESERVED_SPACE from 48 up to 64 bytes, shifting skb->data offsets and potentially causing small frames to land right against page boundaries.
Fix this by using skb_put_padto(skb, BNXT_MIN_PKT_SIZE) in bnxt_start_xmit(), before skb_shinfo(skb)->nr_frags is sampled, because padding might linearize the skb.
This ensures skb->len and skb_headlen(skb) reflect the padded size so that dma_map_single() maps the full buffer and the descriptor length is consistent. This also removes the temporary 'pad' variable and masking logic.
The padding is done after the SW USO branch, otherwise bnxt_sw_udp_gso_xmit() would account the padding as UDP payload and send it in extra segments.
Note that SW USO segments are still not padded: with IPv4, a segment carrying less than 10 bytes of UDP payload (small gso_size, or a short last segment) is sent as a frame shorter than BNXT_MIN_PKT_SIZE. This is a separate issue, left for a followup patch.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 23 ++++++++++------------- 1 file changed, 10 insertions(+), 13 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +10 -13
@@ -474,7 +474,7 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev)struct netdev_queue *txq;int i;dma_addr_t mapping; -unsigned int length, pad =0 ; +unsigned int length;u32 len, free_size, vlan_tag_flags, cfa_action, flags;struct bnxt_ptp_cfg *ptp = bp->ptp_cfg;struct pci_dev *pdev = bp->pdev;
@@ -503,6 +503,14 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) goto tx_free; }#endif +/* Pad before skb_shinfo(skb)->nr_frags is sampled, because +* skb_put_padto() might linearize the skb. +*/ +if (skb_put_padto (skb,BNXT_MIN_PKT_SIZE )) { +/* SKB already freed. */ + goto tx_kick_pending; + } + free_size =bnxt_tx_avail (bp, txr);if (unlikely (free_size <skb_shinfo (skb)->nr_frags +2 )) {/* We must have raced with NAPI cleanup */
@@ -642,14 +650,6 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) } normal_tx: -if (length <BNXT_MIN_PKT_SIZE ) { - pad =BNXT_MIN_PKT_SIZE - length; -if (skb_pad (skb, pad)) -/* SKB already freed. */ - goto tx_kick_pending; - length =BNXT_MIN_PKT_SIZE ; - } - mapping =dma_map_single (&pdev->dev, skb->data, len,DMA_TO_DEVICE );if (unlikely (dma_mapping_error (&pdev->dev, mapping)))
@@ -732,10 +732,7 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) txbd->tx_bd_len_flags_type =cpu_to_le32 (flags); } - flags &= ~TX_BD_LEN ; - txbd->tx_bd_len_flags_type = -cpu_to_le32 (((len + pad) <<TX_BD_LEN_SHIFT ) | flags | -TX_BD_FLAGS_PACKET_END ); + txbd->tx_bd_len_flags_type |=cpu_to_le32 (TX_BD_FLAGS_PACKET_END );netdev_tx_sent_queue (txq, skb->len);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 2/621 fs: Free any excess xarray nodes in clear_inode()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox (Oracle) <[email protected]>
[ Upstream commit ee3f011250104129893d8e9599147e457d4d7280 ]
For many years we've had a hard to hit leak of xarray nodes. Hugh documented it well in commit 786b31121a2c. Recently people and syzbot have found ways to force it to happen with madvise. Rather than fix the leaks where they happen, just call xa_destroy() which has the side-effect of cycling the i_pages lock.
--- fs/inode.c | 23 ++++++++++------------- 1 file changed, 10 insertions(+), 13 deletions(-)
fs/inode.c +10 -13
@@ -745,21 +745,18 @@ void dump_mapping(const struct address_space *mapping)void clear_inode (struct inode *inode) {/* -* We have to cycle the i_pages lock here because reclaim can be in the -* process of removing the last page (in __filemap_remove_folio()) -* and we must not free the mapping under it. +* We have to cycle the i_pages lock here because reclaim +* can be in the process of removing the last page (in +* __filemap_remove_folio()) and we must not free the mapping +* under it. We also remove nodes which are empty; these +* can occur in two different ways. The first is that radix +* tree expansion can fail partway and the second is that THP +* collapse_file() can allocate some temporary nodes and not +* clean them up. */ -xa_lock_irq (&inode->i_data.i_pages); +xa_destroy (&inode->i_data.i_pages); +BUG_ON (inode->i_data.nrpages); -/* -* Almost always, mapping_empty(&inode->i_data) here; but there are -* two known and long-standing ways in which nodes may get left behind -* (when deep radix-tree node allocation failed partway; or when THP -* collapse_file() failed). Until those two known cases are cleaned up, -* or a cleanup function is called here, do not BUG_ON(!mapping_empty), -* nor even WARN_ON(!mapping_empty). -*/ -xa_unlock_irq (&inode->i_data.i_pages);BUG_ON (!list_empty (&inode->i_data.i_private_list));BUG_ON (!(inode->i_state &I_FREEING ));BUG_ON (inode->i_state &I_CLEAR );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 3/621 net/mlx5e: Prevent stale XSK buffer release on refill retry
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Tollet <[email protected]>
[ Upstream commit e01620844c5c88b6fcf819d171df8e3976a0e76f ]
When an XDP redirect to an AF_XDP socket fails because its RX ring is full, the XSK core frees the buffer. During the subsequent batched refill of a legacy cyclic RQ, mlx5e also releases the WQE's XSK buffer before allocating a replacement. If that refill succeeds only partially, a WQE left without a replacement retains its old buffer pointer.
The buffer can meanwhile be allocated to another WQE. A later refill retry can then free the live buffer through the stale pointer and publish the same UMEM frame twice.
Mark the WQE as released immediately after the driver-side free. The flag is already cleared when a replacement buffer is assigned, so refill retries no longer release stale pointers.
The failure is silent and produces no kernel warning or splat. A standalone legacy cyclic-RQ zero-copy libxsk reproducer, using 64-byte UDP traffic offered at 12 Mpps, detected it: stock stopped after 2,854,914 packets in 4.094 seconds, with 4,542 xdp_rx_ring_full events and 64 ownership/double-publication errors. With this change it processed 356,904,225 packets in 30 seconds despite 571,405 xdp_rx_ring_full events, with no ownership or data errors.
--- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +5 -2
@@ -383,8 +383,11 @@ static inline void mlx5e_free_rx_wqe(struct mlx5e_rq *rq,static void mlx5e_xsk_free_rx_wqe (struct mlx5e_wqe_frag_info *wi) { -if (!(wi->flags &BIT (MLX5E_WQE_FRAG_SKIP_RELEASE ))) -xsk_buff_free (*wi->xskp); +if (wi->flags &BIT (MLX5E_WQE_FRAG_SKIP_RELEASE )) +return ; + +xsk_buff_free (*wi->xskp); + wi->flags |=BIT (MLX5E_WQE_FRAG_SKIP_RELEASE ); }static void mlx5e_dealloc_rx_wqe (struct mlx5e_rq *rq,u16 ix)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 4/621 net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Tollet <[email protected]>
[ Upstream commit 63811edf512584c946e5e96b100e9e280703bbb5 ]
With AF_XDP on a striding RQ, mlx5e defers releasing XSK buffers until an MPWQE is refilled. If XSK allocation then returns -ENOMEM, actual_wq_head is not advanced and a later NAPI poll retries the same WQE.
mlx5e_free_rx_mpwqe() leaves each released slot marked as releasable. On retry it can therefore call xsk_buff_free() again through stale pointers after the frames have returned to the XSK pool and been reallocated.
Set all skip_release_bitmap bits in the common error path of mlx5e_xsk_alloc_rx_mpwqe(). This matches mlx5e_alloc_rx_mpwqe(). A successful allocation already clears the bitmap after replacing every buffer, so retries become idempotent without changing the success path.
Fault injection forced three consecutive failures for one selected MPWQE. Both an early allocation failure and a partial 8-of-16-buffer unwind released the original 16 XSK buffers only once. Each error left a full bitmap, the following NAPI retry skipped the release, and a later successful allocation cleared it. A 20-second AF_XDP zero-copy pressure run exercised 1,575,262 buffer allocation failures without invalid descriptors, WQE errors, or kernel warnings.
--- drivers/net/ethernet/mellanox/mlx5/core/en/xsk/rx.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/en/xsk/rx.c +2 -0
@@ -3,6 +3,7 @@#include "rx.h" #include "en/xdp.h" +#include <linux/bitmap.h> #include <net/xdp_sock_drv.h> #include <linux/filter.h>
@@ -153,6 +154,7 @@ int mlx5e_xsk_alloc_rx_mpwqe(struct mlx5e_rq *rq, u16 ix)xsk_buff_free (xsk_buffs[batch]); err: +bitmap_fill (wi->skip_release_bitmap, rq->mpwqe.pages_per_wqe); rq->stats->buff_alloc_err++;return -ENOMEM ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 5/621 net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dipayaan Roy <[email protected]>
[ Upstream commit e9e334f8063a991b4f648b8dbb8dac44cf810540 ]
When mana_create_rxq() fails at mana_create_wq_obj() or any step before xdp_rxq_info_reg() is called, the error path jumps to out: which calls mana_destroy_rxq(). mana_destroy_rxq() unconditionally calls xdp_rxq_info_unreg() on xilinx xdp_rxq that was never registered, triggering a WARN_ON in net/core/xdp.c:
mana 7870:00:00.0: HWC: Failed hw_channel req: 0xc000009a mana 7870:00:00.0 eth7: Failed to create RXQ: err = -71 Driver BUG
WARNING: CPU: 442 PID: 491615 at ../net/core/xdp.c:150 xdp_rxq_info_unreg+0x44/0x70 Modules linked in: tcp_bbr xsk_diag udp_diag raw_diag unix_diag af_packet_diag netlink_diag nf_tables nfnetlink tcp_diag inet_diag binfmt_misc rpcsec_gss_krb5 nfsv3 nfs_acl auth_rpcgss nfsv4 dns_resolver nfs lockd ext4 grace crc16 iscsi_tcp mbcache fscache libiscsi_tcp jbd2 netfs rpcrdma af_packet sunrpc rdma_ucm ib_iser rdma_cm iw_cm iscsi_ibft ib_cm iscsi_boot_sysfs libiscsi rfkill scsi_transport_iscsi mana_ib ib_uverbs ib_core mana hyperv_drm(X) drm_shmem_helper intel_rapl_msr drm_kms_helper intel_rapl_common syscopyarea nls_iso8859_1 sysfillrect intel_uncore_frequency_common nls_cp437 vfat fat nfit sysimgblt libnvdimm hv_netvsc(X) hv_utils(X) fb_sys_fops hv_balloon(X) joydev fuse drm dm_mod configfs ip_tables x_tables xfs libcrc32c sd_mod nvme nvme_core nvme_common t10_pi crc64_rocksoft_generic crc64_rocksoft crc64 hid_generic serio_raw pci_hyperv(X) hv_storvsc(X) scsi_transport_fc hyperv_keyboard(X) hid_hyperv(X) pci_hyperv_intf(X) crc32_pclmul crc32c_intel ghash_clmulni_intel aesni_intel crypto_simd cryptd hv_vmbus(X) softdog sg scsi_mod efivarfs Supported: Yes, External CPU: 442 PID: 491615 Comm: ethtool Kdump: loaded Tainted: G X 5.14.21-150500.55.136-default #1 SLE15-SP5 a627be1b53abbfd64ad16b2685e4308c52847f42 Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 07/25/2025 RIP: 0010:xdp_rxq_info_unreg+0x44/0x70 Code: e8 91 fe ff ff c7 43 0c 02 00 00 00 48 c7 03 00 00 00 00 5b c3 cc cc cc cc e9 58 3a 1c 00 48 c7 c7 f6 5f 19 97 e8 5c a4 7e ff <0f> 0b 83 7b 0c 01 74 ca 48 c7 c7 d9 5f 19 97 e8 48 a4 7e ff 0f 0b RSP: 0018:ff3df6c8f7207818 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ff30d89f94808a80 RCX: 0000000000000027 RDX: 0000000000000000 RSI: 0000000000000002 RDI: ff30d94bdcca2908 RBP: 0000000000080000 R08: ffffffff98ed11a0 R09: ff3df6c8f72077a0 R10: dead000000000100 R11: 000000000000000a R12: 0000000000000000 R13: 0000000000002000 R14: 0000000000040000 R15: ff30d89f94800000 FS: 00007fe6d8432b80(0000) GS:ff30d94bdcc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe6d81a89b1 CR3: 00000b3b6d578001 CR4: 0000000000371ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 Call Trace: <TASK> mana_destroy_rxq+0x5b/0x2f0 [mana 267acf7006bcb696095bba4d810643d1db3b9e94] mana_create_rxq.isra.55+0x3db/0x720 [mana 267acf7006bcb696095bba4d810643d1db3b9e94] ? simple_lookup+0x36/0x50 ? current_time+0x42/0x80 ? __d_free_external+0x30/0x30 mana_alloc_queues+0x32a/0x470 [mana 267acf7006bcb696095bba4d810643d1db3b9e94] ? _raw_spin_unlock+0xa/0x30 ? d_instantiate.part.29+0x2e/0x40 ? _raw_spin_unlock+0xa/0x30 ? debugfs_create_dir+0xe4/0x140 mana_attach+0x5c/0xf0 [mana 267acf7006bcb696095bba4d810643d1db3b9e94] mana_set_ringparam+0xd5/0x1a0 [mana 267acf7006bcb696095bba4d810643d1db3b9e94] ethnl_set_rings+0x292/0x320 genl_family_rcv_msg_doit.isra.15+0x11b/0x150 genl_rcv_msg+0xe3/0x1e0 ? rings_prepare_data+0x80/0x80 ? genl_family_rcv_msg_doit.isra.15+0x150/0x150 netlink_rcv_skb+0x50/0x100 genl_rcv+0x24/0x40 netlink_unicast+0x1b6/0x280 netlink_sendmsg+0x365/0x4d0 sock_sendmsg+0x5f/0x70 __sys_sendto+0x112/0x140 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x5b/0x80 ? handle_mm_fault+0xd7/0x290 ? do_user_addr_fault+0x2d8/0x740 ? exc_page_fault+0x67/0x150 entry_SYSCALL_64_after_hwframe+0x6b/0xd5 RIP: 0033:0x7fe6d8122f06 Code: 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 11 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 72 f3 c3 41 57 41 56 4d 89 c7 41 55 41 54 41 RSP: 002b:00007fff2b66b068 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 000055771123d2a0 RCX: 00007fe6d8122f06 RDX: 0000000000000034 RSI: 000055771123d3b0 RDI: 0000000000000003 RBP: 00007fff2b66b100 R08: 00007fe6d8203360 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000246 R12: 000055771123d350 R13: 000055771123d340 R14: 0000000000000000 R15: 00007fff2b66b2b0 </TASK>
Guard the xdp_rxq_info_unreg() call with xdp_rxq_info_is_reg() so that mana_destroy_rxq() is safe to call regardless of how far initialization progressed.
--- drivers/net/ethernet/microsoft/mana/mana_en.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/microsoft/mana/mana_en.c +3 -1
@@ -2535,7 +2535,9 @@ static void mana_destroy_rxq(struct mana_port_context *apc,napi_disable_locked (napi);netif_napi_del_locked (napi); } -xdp_rxq_info_unreg (&rxq->xdp_rxq); + +if (xdp_rxq_info_is_reg (&rxq->xdp_rxq)) +xdp_rxq_info_unreg (&rxq->xdp_rxq);mana_destroy_wq_obj (apc,GDMA_RQ , rxq->rxobj);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 6/621 net: mana: Skip WQ object destruction for uninitialized RXQ
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dipayaan Roy <[email protected]>
[ Upstream commit 2a1c691182823a5c149d502ac153e249ee697b4a ]
In mana_destroy_rxq(), mana_destroy_wq_obj() is called unconditionally even when the WQ object was never created (rxobj is still INVALID_MANA_HANDLE). When mana_create_rxq() fails before mana_create_wq_obj() succeeds, the error path calls mana_destroy_rxq() which sends a bogus destroy command to the hardware:
mana 7870:00:00.0: HWC: Failed hw_channel req: 0x1d
mana 7870:00:00.0: Failed to send mana message: -71, 0x1d
mana 7870:00:00.0 eth7: Failed to destroy WQ object: -71Guard mana_destroy_wq_obj() with an INVALID_MANA_HANDLE check so that mana_destroy_rxq() is safe to call at any stage of RXQ initialization.
--- drivers/net/ethernet/microsoft/mana/mana_en.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/microsoft/mana/mana_en.c +2 -1
@@ -2539,7 +2539,8 @@ static void mana_destroy_rxq(struct mana_port_context *apc,if (xdp_rxq_info_is_reg (&rxq->xdp_rxq))xdp_rxq_info_unreg (&rxq->xdp_rxq); -mana_destroy_wq_obj (apc,GDMA_RQ , rxq->rxobj); +if (rxq->rxobj !=INVALID_MANA_HANDLE ) +mana_destroy_wq_obj (apc,GDMA_RQ , rxq->rxobj);mana_deinit_cq (apc, &rxq->rx_cq);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 7/621 netfs: zero the tail of a short DIO/unbuffered read
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <[email protected]>
[ Upstream commit dd05add7b2b6004c5fa3a1f276f56d8668f86b65 ]
The buffered read collector zero-fills the tail of a short read that stops below the inode's i_size (netfs_clear_unread()), so a read that races an extending write still returns the expected number of bytes. The non-buffered collector path does no such thing: it just records how much was transferred.
Add the same zero-fill for the non-buffered case, gated onNETFS_SREQ_CLEAR_TAIL: a subreq's source sets that flag when a short result from it is known to be safe to treat as a hole, as opposed to NETFS_SREQ_HIT_EOF, which means the read genuinely ran off the end of the file and should be reported short as-is. Only CLEAR_TAIL should zero-fill here; a real EOF must stay a real short read.
No source currently sets CLEAR_TAIL on an unbuffered/DIO subrequest, so this is inert on its own -- a following change teaches cifs to set it in the one case that needs it.
--- fs/netfs/read_collect.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+)
fs/netfs/read_collect.c +24 -0
@@ -34,6 +34,22 @@ static void netfs_clear_unread(struct netfs_io_subrequest *subreq)__set_bit (NETFS_SREQ_HIT_EOF , &subreq->flags); } +static void netfs_clear_unread_dio (struct netfs_io_subrequest *subreq) +{ +unsigned long long pos = subreq->start + subreq->transferred; +struct netfs_io_request *rreq = subreq->rreq; +size_t fill; + +if (pos >= rreq->i_size) +return ; + + fill = min_t(unsigned long long, rreq->i_size - pos, + subreq->len - subreq->transferred); + +netfs_reset_iter (subreq); + subreq->transferred +=iov_iter_zero (fill, &subreq->io_iter); +} +/* * Flush, mark and unlock a folio that's now completely read. If we want to * cache the folio, we set the group to NETFS_FOLIO_COPY_TO_CACHE, mark it
@@ -259,6 +275,14 @@ static void netfs_collect_read_results(struct netfs_io_request *rreq) test_bit(NETFS_SREQ_HIT_EOF, &front->flags))netfs_read_unlock_folios (rreq, ¬es); }else { +if (!(notes &HIT_PENDING ) && + front->error ==0 && + transferred < front->len && +test_bit (NETFS_SREQ_CLEAR_TAIL , &front->flags)) { +netfs_clear_unread_dio (front); + transferred = front->transferred; +trace_netfs_sreq (front, netfs_sreq_trace_clear); + } stream->collected_to = front->start + transferred; rreq->collected_to = stream->collected_to; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 8/621 doc/netlink: netlink-raw: Add max check
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Remy D. Farley <[email protected]>
[ Upstream commit bf5a54bc0e3d8962474fcd611f1266eba036232f ]
Add definitions for max check and len-or-limit type, the same as in other specifications.
--- Documentation/netlink/netlink-raw.yaml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
Documentation/netlink/netlink-raw.yaml +10 -1
@@ -19,6 +19,12 @@ $defs: type: [ string, integer ] pattern: ^[0-9A-Za-z_-]+( - 1)?$ minimum: 0 + len-or-limit: + # literal int, const name, or limit based on fixed-width type + # e.g. u8-min, u16-max, etc. + type: [ string, integer ] + pattern: ^[0-9A-Za-z_-]+$ + minimum: 0 # Schema for specs title: Protocol
@@ -279,7 +285,10 @@ properties: type: string min: description: Min value for an integer attribute. - type: integer + $ref: '#/$defs/len-or-limit' + max: + description: Max value for an integer attribute. + $ref: '#/$defs/len-or-limit' min-len: description: Min length for a binary attribute. $ref: '#/$defs/len-or-define'
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 9/621 ynl: fix schema check errors
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Donald Hunter <[email protected]>
[ Upstream commit 1adc241f3940c172c8c674a62004d3c34b360ab3 ]
Fix two schema check errors that have lurked since the attribute name validation was made more strict:
not ok 2 conntrack.yaml schema validation 'labels mask' does not match '^[0-9a-z-]+$'
not ok 13 nftables.yaml schema validation 'set id' does not match '^[0-9a-z-]+$'
--- Documentation/netlink/specs/conntrack.yaml | 2 +- Documentation/netlink/specs/nftables.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
Documentation/netlink/specs/conntrack.yaml +1 -1
@@ -457,7 +457,7 @@ attribute-sets: name: labels type: binary - - name: labels mask + name: labels-mask type: binary - name: synproxy
Documentation/netlink/specs/nftables.yaml +1 -1
@@ -915,7 +915,7 @@ attribute-sets: type: string doc: Name of set to use - - name: set id + name: set-id type: u32 byte-order: big-endian doc: ID of set to use
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 10/621 accel/amdxdna: Bound the sync_bo flush range to the BO size
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eva Crystal <[email protected]>
[ Upstream commit dbc8fd7a03cbc0704e8e558a448015f620547a02 ]
amdxdna_drm_sync_bo_ioctl() passes the caller's offset and size to drm_clflush_virt_range() on the BO's kernel mapping without checking either against the BO size. The ioctl has no permission flags: any process that can open the accel node controls the offset. Any BO with a kernel mapping reaches that call: AMDXDNA_BO_DEV_HEAP, AMDXDNA_BO_DEV and AMDXDNA_BO_CMD. A DEV_HEAP is vmapped, so an offset equal to its size lands the flush on the vmap guard page.
Measured on 6.18.55 on an AMD Ryzen AI 9 365 NPU, firmware 1.0.0.63, as a non-root user with access to the accel node: unpatched, an offset equal to the 64 MiB DEV_HEAP size oopses in drm_clflush_virt_range() under amdxdna_drm_sync_bo_ioctl(), 2 of 2 runs; patched, the same call returns -EINVAL, 2 of 2, and an in-bounds sync returns 0, 2 of 2. DEV_HEAP is the type tested; DEV and CMD are by code reading.
Upstream bounds the range in amdxdna_flush_bo(), added by commit dbc8fd7a03cb ("accel/amdxdna: Add expandable device heap support"). This applies only that check: an offset at or past the BO's end, or an overflowing offset plus size, returns -EINVAL.
Deviations from upstream: that commit adds a feature and is too large for stable as a whole. It calls drm_WARN() when the check rejects a BO whose type is not AMDXDNA_BO_DEV, which userspace can trigger; this fix does not. Upstream bounds AMDXDNA_BO_DEV by the heap chunks it spans and flushes only the overlap, reporting no error for an offset past the end; 6.18 has one heap per client, so this fix uses the BO's own abo->mem.size and rejects such an offset instead. As in upstream, a size past the BO's end is clamped, not rejected.
Built from v6.18.55 with the test system's distro-derived config, DRM_ACCEL_AMDXDNA=m. The touched file also compiles W=1 clean.
--- drivers/accel/amdxdna/amdxdna_gem.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/accel/amdxdna/amdxdna_gem.c +9 -1
@@ -934,6 +934,7 @@ int amdxdna_drm_sync_bo_ioctl(struct drm_device *dev,struct amdxdna_drm_sync_bo *args = data;struct amdxdna_gem_obj *abo;struct drm_gem_object *gobj; +u64 end, size;int ret; gobj =drm_gem_object_lookup (filp, args->handle);
@@ -943,6 +944,13 @@ int amdxdna_drm_sync_bo_ioctl(struct drm_device *dev, } abo =to_xdna_obj (gobj); +if (args->offset >= abo->mem.size || +check_add_overflow (args->offset, args->size, &end)) { + ret = -EINVAL ; + goto put_obj; + } + size =min (abo->mem.size, end) - args->offset; + ret =amdxdna_gem_pin (abo);if (ret) {XDNA_ERR (xdna,"Pin BO %d failed, ret %d" , args->handle, ret);
@@ -955,7 +963,7 @@ int amdxdna_drm_sync_bo_ioctl(struct drm_device *dev,if (is_import_bo (abo))drm_clflush_sg (abo->base.sgt);else if (abo->mem.kva) -drm_clflush_virt_range (abo->mem.kva + args->offset, args->size); +drm_clflush_virt_range (abo->mem.kva + args->offset, size);else if (abo->base.pages)drm_clflush_pages (abo->base.pages, gobj->size >>PAGE_SHIFT );else
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 11/621 f2fs: fix to shrink gc_lock coverage in f2fs_gc_range()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 5d49025a4e596c4c9ac0c519ef9f9a2c91396856 ]
In f2fs_allocate_pinning_section(), we will hold gc_lock before calling f2fs_gc_range() to migrate section in conventional zone, we may suffer worse case because we may need to traverse and migrate multiple sections if we failed to move blocks in section due to lot of reasons: ENOMEM, fail to migrate block of pinfile, racing on i_gc_rwsem.
To avoid hold gc_lock for long time to block checkpoint, let's hold the lock and only try to migrate one section.
[ Chao Yu: backport to 6.12.y:
- drop file.c changes as f2fs_ioc_reserve_dev_alias() is not present in 6.12
- use f2fs_{down,up}_write(&sbi->gc_lock) as 6.12 lacks lock tracing
- use IS_CURSEC() in gc.c as cursec pinning is not present in 6.12 ]
[ Sasha: applied Chao's 6.12.y backport to 6.18.y; gc.c context uses
is_cursec(), which 6.18 has ]
--- fs/f2fs/f2fs.h | 2 +- fs/f2fs/gc.c | 33 ++++++++++++++++++++++++--------- fs/f2fs/segment.c | 4 +--- 3 files changed, 26 insertions(+), 13 deletions(-)
fs/f2fs/f2fs.h +1 -1
@@ -4189,7 +4189,7 @@ int f2fs_gc(struct f2fs_sb_info *sbi, struct f2fs_gc_control *gc_control);void f2fs_build_gc_manager (struct f2fs_sb_info *sbi);int f2fs_gc_range (struct f2fs_sb_info *sbi,unsigned int start_seg,unsigned int end_seg, -bool dry_run,unsigned int dry_run_sections); +bool dry_run,unsigned int dry_run_sections,bool lock);int f2fs_resize_fs (struct file *filp,__u64 block_count);int __init f2fs_create_garbage_collection_cache (void );void f2fs_destroy_garbage_collection_cache (void );
fs/f2fs/gc.c +24 -9
@@ -2121,7 +2121,7 @@ void f2fs_build_gc_manager(struct f2fs_sb_info *sbi)int f2fs_gc_range (struct f2fs_sb_info *sbi,unsigned int start_seg,unsigned int end_seg, -bool dry_run,unsigned int dry_run_sections) +bool dry_run,unsigned int dry_run_sections,bool lock) {unsigned int segno;unsigned int gc_secs = dry_run_sections;
@@ -2135,28 +2135,43 @@ int f2fs_gc_range(struct f2fs_sb_info *sbi, .ilist = LIST_HEAD_INIT(gc_list.ilist), .iroot = RADIX_TREE_INIT(gc_list.iroot, GFP_NOFS), }; +int err =0 ; + +if (lock) +f2fs_down_write (&sbi->gc_lock);/* * avoid migrating empty section, as it can be allocated by * log in parallel. */ if (!get_valid_blocks (sbi, segno, true)) -continue ; + goto next;if (is_cursec (sbi,GET_SEC_FROM_SEG (sbi, segno))) -continue ; + goto next;do_garbage_collect (sbi, segno, &gc_list,FG_GC , true, false);put_gc_inode (&gc_list); -if (!dry_run &&get_valid_blocks (sbi, segno, true)) -return -EAGAIN ; +if (!dry_run &&get_valid_blocks (sbi, segno, true)) { + err = -EAGAIN ; + goto next; + }if (dry_run && dry_run_sections && - !get_valid_blocks (sbi, segno, true) && --gc_secs ==0 ) -break ; + !get_valid_blocks (sbi, segno, true)) { + --gc_secs; + goto next; + }if (fatal_signal_pending (current)) -return -ERESTARTSYS ; + err = -ERESTARTSYS ; +next: +if (lock) +f2fs_up_write (&sbi->gc_lock); +if (err) +return err; +if (dry_run && dry_run_sections && !gc_secs) +return 0 ; }return 0 ;
@@ -2204,7 +2219,7 @@ static int free_segment_range(struct f2fs_sb_info *sbi, }/* do GC to move out valid blocks in the range */ - err =f2fs_gc_range (sbi, start, end, dry_run,0 ); + err =f2fs_gc_range (sbi, start, end, dry_run,0 , false);if (err || dry_run) goto out;
fs/f2fs/segment.c +1 -3
@@ -3359,10 +3359,8 @@ int f2fs_allocate_pinning_section(struct f2fs_sb_info *sbi)f2fs_unlock_op (sbi);if (f2fs_sb_has_blkzoned (sbi) && err == -EAGAIN && gc_required) { -f2fs_down_write (&sbi->gc_lock); err =f2fs_gc_range (sbi,0 , sbi->first_seq_zone_segno -1 , - true,ZONED_PIN_SEC_REQUIRED_COUNT ); -f2fs_up_write (&sbi->gc_lock); + true,ZONED_PIN_SEC_REQUIRED_COUNT , true);if (err)return err; err =f2fs_sync_fs (sbi->sb,1 );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 12/621 f2fs: fix to reset all pinned status during fggc
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 2b8704b6a8b2896ccad1f5941d9a3e2c5031a470 ]
Otherwise, the pinned status may affect latter flow of fggc.
--- fs/f2fs/gc.c | 3 +++ 1 file changed, 3 insertions(+)
fs/f2fs/gc.c +3 -0
@@ -2153,6 +2153,9 @@ int f2fs_gc_range(struct f2fs_sb_info *sbi,do_garbage_collect (sbi, segno, &gc_list,FG_GC , true, false);put_gc_inode (&gc_list); +/* reset all pinned status during fggc */ +f2fs_unpin_all_sections (sbi, true); +if (!dry_run &&get_valid_blocks (sbi, segno, true)) { err = -EAGAIN ; goto next;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 13/621 net: dsa: mt7530: fix .get_stats64 sleeping in atomic context
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Golle <[email protected]>
commit 07d99587396024932e02474c3a5bede71d108454 upstream.
The .get_stats64 callback runs in atomic context, but on MDIO-connected switches every register read acquires the MDIO bus mutex, which can sleep:
[ 12.645973] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:609 [ 12.654442] in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 759, name: grep [ 12.663377] preempt_count: 0, expected: 0 [ 12.667410] RCU nest depth: 1, expected: 0 [ 12.671511] INFO: lockdep is turned off. [ 12.675441] CPU: 0 UID: 0 PID: 759 Comm: grep Tainted: G S W 7.0.0+ #0 PREEMPT [ 12.675453] Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN [ 12.675456] Hardware name: Bananapi BPI-R64 (DT) [ 12.675459] Call trace: [ 12.675462] show_stack+0x14/0x1c (C) [ 12.675477] dump_stack_lvl+0x68/0x8c [ 12.675487] dump_stack+0x14/0x1c [ 12.675495] __might_resched+0x14c/0x220 [ 12.675504] __might_sleep+0x44/0x80 [ 12.675511] __mutex_lock+0x50/0xb10 [ 12.675523] mutex_lock_nested+0x20/0x30 [ 12.675532] mt7530_get_stats64+0x40/0x2ac [ 12.675542] dsa_user_get_stats64+0x2c/0x40 [ 12.675553] dev_get_stats+0x44/0x1e0 [ 12.675564] dev_seq_printf_stats+0x24/0xe0 [ 12.675575] dev_seq_show+0x14/0x3c [ 12.675583] seq_read_iter+0x37c/0x480 [ 12.675595] seq_read+0xd0/0xec [ 12.675605] proc_reg_read+0x94/0xe4 [ 12.675615] vfs_read+0x98/0x29c [ 12.675625] ksys_read+0x54/0xdc [ 12.675633] __arm64_sys_read+0x18/0x20 [ 12.675642] invoke_syscall.constprop.0+0x54/0xec [ 12.675653] do_el0_svc+0x3c/0xb4 [ 12.675662] el0_svc+0x38/0x200 [ 12.675670] el0t_64_sync_handler+0x98/0xdc [ 12.675679] el0t_64_sync+0x158/0x15c
For MDIO-connected switches, poll MIB counters asynchronously using a delayed workqueue every second and let .get_stats64 return the cached values under a spinlock. A mod_delayed_work() call on each read triggers an immediate refresh so counters stay responsive when queried more frequently.
MMIO-connected switches (MT7988, EN7581, AN7583) are not affected because their regmap does not sleep, so they continue to read MIB counters directly in .get_stats64.
--- drivers/net/dsa/mt7530.c | 75 ++++++++++++++++++++++++++++++++++++++-- drivers/net/dsa/mt7530.h | 8 +++++ 2 files changed, 80 insertions(+), 3 deletions(-)
drivers/net/dsa/mt7530.c +72 -3
@@ -25,6 +25,9 @@#include "mt7530.h" +#define MT7530_STATS_POLL_INTERVAL (1 * HZ) +#define MT7530_STATS_RATE_LIMIT (HZ / 10) +static struct mt753x_pcs *pcs_to_mt753x_pcs (struct phylink_pcs *pcs) { return container_of(pcs, struct mt753x_pcs, pcs);
@@ -888,10 +891,9 @@ static void mt7530_get_rmon_stats(struct dsa_switch *ds, int port, *ranges = mt7530_rmon_ranges; } -static void mt7530_get_stats64 (struct dsa_switch *ds,int port, -struct rtnl_link_stats64 *storage) +static void mt7530_read_port_stats64 (struct mt7530_priv *priv,int port, +struct rtnl_link_stats64 *storage) { -struct mt7530_priv *priv = ds->priv;uint64_t data;/* MIB counter doesn't provide a FramesTransmittedOK but instead
@@ -933,6 +935,54 @@ static void mt7530_get_stats64(struct dsa_switch *ds, int port, &storage->rx_crc_errors); } +static void mt7530_stats_refresh (struct mt7530_priv *priv) +{ +struct rtnl_link_stats64 stats = {}; +struct dsa_port *dp; +int port; + +dsa_switch_for_each_user_port (dp, priv->ds) { + port = dp->index; + +mt7530_read_port_stats64 (priv, port, &stats); + +spin_lock_bh (&priv->stats_lock); + priv->ports[port].stats = stats; + priv->stats_last = jiffies; +spin_unlock_bh (&priv->stats_lock); + } +} + +static void mt7530_stats_poll (struct work_struct *work) +{ + struct mt7530_priv *priv = container_of(work, struct mt7530_priv, + stats_work.work); + +mt7530_stats_refresh (priv); +schedule_delayed_work (&priv->stats_work, +MT7530_STATS_POLL_INTERVAL ); +} + +static void mt7530_get_stats64 (struct dsa_switch *ds,int port, +struct rtnl_link_stats64 *storage) +{ +struct mt7530_priv *priv = ds->priv; +bool refresh; + +if (priv->bus) { +spin_lock_bh (&priv->stats_lock); + *storage = priv->ports[port].stats; + refresh =time_after (jiffies, priv->stats_last + +MT7530_STATS_RATE_LIMIT ); +spin_unlock_bh (&priv->stats_lock); +if (refresh) +mod_delayed_work (system_percpu_wq, + &priv->stats_work,0 ); + }else { +mt7530_read_port_stats64 (priv, port, storage); + } +} +static void mt7530_get_eth_ctrl_stats (struct dsa_switch *ds,int port,struct ethtool_eth_ctrl_stats *ctrl_stats) {
@@ -3169,9 +3219,24 @@ mt753x_setup(struct dsa_switch *ds)if (ret && priv->irq_domain)mt7530_free_mdio_irq (priv); +if (!ret && priv->bus) { +mt7530_stats_refresh (priv); +schedule_delayed_work (&priv->stats_work, +MT7530_STATS_POLL_INTERVAL ); + } +return ret; } +static void +mt753x_teardown (struct dsa_switch *ds) +{ +struct mt7530_priv *priv = ds->priv; + +if (priv->bus) +cancel_delayed_work_sync (&priv->stats_work); +} +static int mt753x_set_mac_eee (struct dsa_switch *ds,int port,struct ethtool_keee *e) {
@@ -3290,6 +3355,7 @@ static int mt7988_setup(struct dsa_switch *ds)const struct dsa_switch_ops mt7530_switch_ops = { .get_tag_protocol = mtk_get_tag_protocol, .setup = mt753x_setup, + .teardown = mt753x_teardown, .preferred_default_local_cpu_port = mt753x_preferred_default_local_cpu_port, .get_strings = mt7530_get_strings, .get_ethtool_stats = mt7530_get_ethtool_stats,
@@ -3437,6 +3503,9 @@ mt7530_probe_common(struct mt7530_priv *priv) priv->ds->ops = &mt7530_switch_ops; priv->ds->phylink_mac_ops = &mt753x_phylink_mac_ops;mutex_init (&priv->reg_mutex); +spin_lock_init (&priv->stats_lock); +INIT_DELAYED_WORK (&priv->stats_work, mt7530_stats_poll); +dev_set_drvdata (dev, priv);return 0 ;
drivers/net/dsa/mt7530.h +8 -0
@@ -797,6 +797,7 @@ struct mt7530_fdb {* @pvid: The VLAN specified is to be considered a PVID at ingress. Any * untagged frames will be assigned to the related VLAN. * @sgmii_pcs: Pointer to PCS instance for SerDes ports +* @stats: Cached port statistics for MDIO-connected switches */ struct mt7530_port {bool enable;
@@ -804,6 +805,7 @@ struct mt7530_port {u32 pm;u16 pvid;struct phylink_pcs *sgmii_pcs; +struct rtnl_link_stats64 stats; };/* Port 5 mode definitions of the MT7530 switch */
@@ -876,6 +878,9 @@ struct mt753x_info {* @create_sgmii: Pointer to function creating SGMII PCS instance(s) * @active_cpu_ports: Holding the active CPU ports * @mdiodev: The pointer to the MDIO device structure +* @stats_lock: Protects cached per-port stats from concurrent access +* @stats_work: Delayed work for polling MIB counters on MDIO switches +* @stats_last: Jiffies timestamp of last MIB counter poll */ struct mt7530_priv {struct device *dev;
@@ -901,6 +906,9 @@ struct mt7530_priv {int (*create_sgmii)(struct mt7530_priv *priv);u8 active_cpu_ports;struct mdio_device *mdiodev; +spinlock_t stats_lock;/* protects cached stats counters */ +struct delayed_work stats_work; +unsigned long stats_last; };struct mt7530_hw_vlan_entry {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 14/621 crypto: drbg - Fix ineffective sanity check
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit 040ad83b0e8aa065fd2fc641cacba8491a8b186d upstream.
Fix drbg_healthcheck_sanity() to correctly check the return value of drbg_generate(). drbg_generate() returns 0 on success, or a negative errno value on failure. drbg_healthcheck_sanity() incorrectly assumed that it returned a positive value on success.
This didn't make the sanity check fail, but it made it ineffective.
--- crypto/drbg.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
crypto/drbg.c +5 -6
@@ -1986,7 +1986,6 @@ static int drbg_kcapi_seed(struct crypto_rng *tfm,*/ static inline int __init drbg_healthcheck_sanity (void ) { -int len =0 ;#define OUTBUFLEN 16unsigned char buf[OUTBUFLEN ];struct drbg_state *drbg =NULL ;
@@ -2030,12 +2029,12 @@ static inline int __init drbg_healthcheck_sanity(void) max_addtllen =drbg_max_addtl (drbg); max_request_bytes =drbg_max_request_bytes (drbg);drbg_string_fill (&addtl, buf, max_addtllen +1 ); -/* overflow addtllen with additonal info string */ - len =drbg_generate (drbg, buf,OUTBUFLEN , &addtl); -BUG_ON (0 < len); +/* overflow addtllen with additional info string */ + ret =drbg_generate (drbg, buf,OUTBUFLEN , &addtl); +BUG_ON (ret ==0 );/* overflow max_bits */ - len =drbg_generate (drbg, buf, (max_request_bytes +1 ),NULL ); -BUG_ON (0 < len); + ret =drbg_generate (drbg, buf, max_request_bytes +1 ,NULL ); +BUG_ON (ret ==0 );/* overflow max addtllen with personalization string */ ret =drbg_seed (drbg, &addtl, false);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 15/621 ipv6: Fix redirect exception creation for UDP/RAW sockets
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit cd51b74bdd0b75aedf255dc67306a16dd057f7ee ]
When an ICMP Redirect Message is matched to a socket, both IPv4 and IPv6 verify that the source IP of the ICMP packet is the current gateway for the quoted packet. Both also pass the socket's bound device as the expected nexthop device.
The difference is that IPv4 treats "oif=0" as "any", whereas IPv6 always requires an exact match (see ip6_redirect_nh_match()), since the gateway address is usually a link-local address.
Therefore, when an IPv6 UDP/RAW socket is not bound to a device, the above verification fails and an exception is not created. This also happens when the socket is bound to a VRF, as l3mdev_update_flow() resets the oif to 0.
Fix this by passing the ifindex of the ingress device as the expected nexthop device. This is consistent with the existing callers of ip6_redirect(). Note that for ICMPv6 Redirect Message packets the VRF driver does not reset skb->dev to the VRF device, so skb->dev is correct, even when it is a VRF port.
--- net/ipv6/route.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv6/route.c +1 -1
@@ -3257,7 +3257,7 @@ void ip6_redirect_no_header(struct sk_buff *skb, struct net *net, int oif)void ip6_sk_redirect (struct sk_buff *skb,struct sock *sk) { -ip6_redirect (skb,sock_net (sk), sk->sk_bound_dev_if, +ip6_redirect (skb,sock_net (sk), skb->dev->ifindex,READ_ONCE (sk->sk_mark),sk_uid (sk)); }EXPORT_SYMBOL_GPL (ip6_sk_redirect);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 16/621 ipv4: validate checksum_start before completing checksum
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael S. Tsirkin <[email protected]>
commit 6785011f8b16abf40b1e9d8b2e332232b3e68822 upstream.
If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief.
This was discovered and reported by Paulos, and has been reporoduced by others independently since.
We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum.
A more complete validation at input is forthcoming, but needs more work.
--- include/net/ip.h | 7 +++++++ net/bridge/netfilter/nf_conntrack_bridge.c | 10 +++++++--- net/ipv4/ip_output.c | 10 +++++++--- net/netfilter/nfnetlink_queue.c | 7 +++++++ net/netfilter/xt_CHECKSUM.c | 6 +++++- net/xfrm/xfrm_output.c | 16 +++++++++++----- 6 files changed, 44 insertions(+), 12 deletions(-)
include/net/ip.h +7 -0
@@ -74,6 +74,13 @@ static inline unsigned int ip_hdrlen(conreturn ip_hdr (skb)->ihl *4 ; } +static inline int ip_check_csum_start (const struct sk_buff *skb) +{ +if (unlikely (skb->csum_start < skb->network_header +ip_hdrlen (skb))) +return -EINVAL ; +return 0 ; +} +struct ipcm_cookie {struct sockcm_cookie sockc;__be32 addr;
net/bridge/netfilter/nf_conntrack_bridge.c +7 -3
@@ -40,9 +40,13 @@ static int nf_br_ip_fragment(struct netint err =0 ;/* for offloaded checksums cleanup checksum before fragmentation */ -if (skb->ip_summed ==CHECKSUM_PARTIAL && - (err =skb_checksum_help (skb))) - goto blackhole; +if (skb->ip_summed ==CHECKSUM_PARTIAL ) { + err =ip_check_csum_start (skb); +if (!err) + err =skb_checksum_help (skb); +if (err) + goto blackhole; + } iph =ip_hdr (skb);
net/ipv4/ip_output.c +7 -3
@@ -772,9 +772,13 @@ int ip_do_fragment(struct net *net, struint err =0 ;/* for offloaded checksums cleanup checksum before fragmentation */ -if (skb->ip_summed ==CHECKSUM_PARTIAL && - (err =skb_checksum_help (skb))) - goto fail; +if (skb->ip_summed ==CHECKSUM_PARTIAL ) { + err =ip_check_csum_start (skb); +if (!err) + err =skb_checksum_help (skb); +if (err) + goto fail; + }/* * Point into the IP datagram header.
net/netfilter/nfnetlink_queue.c +7 -0
@@ -33,6 +33,7 @@#include <linux/rhashtable.h> #include <linux/jhash.h> #include <net/gso.h> +#include <net/ip.h> #include <net/sock.h> #include <net/tcp_states.h> #include <net/netfilter/nf_queue.h>
@@ -653,6 +654,12 @@ nla_put_failure:static int nf_queue_checksum_help (struct sk_buff *entskb) { +if (entskb->protocol ==htons (ETH_P_IP )) { +if (!pskb_network_may_pull (entskb,sizeof (struct iphdr )) || +ip_check_csum_start (entskb)) +return -EINVAL ; + } +if (skb_csum_is_sctp (entskb))return skb_crc32c_csum_help (entskb);
net/netfilter/xt_CHECKSUM.c +5 -1
@@ -15,6 +15,7 @@#include <linux/netfilter_ipv4/ip_tables.h> #include <linux/netfilter_ipv6/ip6_tables.h> +#include <net/ip.h> MODULE_LICENSE ("GPL" );MODULE_AUTHOR ("Michael S. Tsirkin <[email protected]>" );
@@ -25,8 +26,11 @@ MODULE_ALIAS("ip6t_CHECKSUM");static unsigned int checksum_tg (struct sk_buff *skb,const struct xt_action_param *par) { -if (skb->ip_summed ==CHECKSUM_PARTIAL && !skb_is_gso (skb)) +if (skb->ip_summed ==CHECKSUM_PARTIAL && !skb_is_gso (skb)) { +if (xt_family (par) ==NFPROTO_IPV4 &&ip_check_csum_start (skb)) +return NF_DROP ;skb_checksum_help (skb); + }return XT_CONTINUE ; }
net/xfrm/xfrm_output.c +11 -5
@@ -816,16 +816,22 @@ int xfrm_output(struct sock *sk, struct }if (skb->ip_summed ==CHECKSUM_PARTIAL ) { - err =skb_checksum_help (skb); -if (err) { -XFRM_INC_STATS (net,LINUX_MIB_XFRMOUTERROR ); -kfree_skb (skb); -return err; +if (skb->protocol ==htons (ETH_P_IP )) { + err =ip_check_csum_start (skb); +if (err) + goto error; } + err =skb_checksum_help (skb); +if (err) + goto error; } out:return xfrm_output2 (net, sk, skb); +error: +XFRM_INC_STATS (net,LINUX_MIB_XFRMOUTERROR ); +kfree_skb (skb); +return err; }EXPORT_SYMBOL_GPL (xfrm_output);
Greg Kroah-Hartman
maintainerPATCH 17/621 rust_binder: reschedule node refcount update on thread exit
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alice Ryhl <[email protected]>
commit 2a74ccd1bcc170e66525f34e9de8652b57e2cf3d upstream.
When a thread exits via BINDER_THREAD_EXIT, its pending work items are cancelled. If a thread exits while holding a pending node refcount increment (e.g. pushed as deferred work to that thread), the refcount increment was previously dropped because Node::cancel() and NodeWrapper::cancel() were no-ops.
Dropping the refcount update leaves the node's delivery state and count state desynchronized, and userspace will not receive the notification, which can cause the node to never be freed from the process's nodes tree when all external references are dropped.
Fix this by implementing DeliverToRead::cancel() for Node and NodeWrapper to move the pending refcount update to the process's work queue on thread exit so another thread can deliver it to userspace.
[ Dropped first argument in calls to push_work() to adjust to the
existing form without mainline commit dbb17c9ea756 ("rust_binder: move (e)poll wait queue to Process"). - Miguel ]
--- drivers/android/binder/node.rs | 20 ++++++++++++++++--- drivers/android/binder/node/wrapper.rs | 34 ++++++++++++++++++++++++++++++++- 2 files changed, 50 insertions(+), 4 deletions(-)
drivers/android/binder/node.rs +17 -3
@@ -49,9 +49,9 @@ pub(crate) struct CouldNotDeliverCritica/// about to drop the weak reference, then the strong increment could be processed after the /// other thread has already exited, which would be too late. /// -/// Note that trying to create a `ListArc` to the node can succeed even if `has_normal_push` is +/// Note that trying to create a `ListArc` to the node can succeed even if `has_pushed_node` is /// set. This is because another thread might just have popped the node from a todo list, but not -/// yet called `do_work`. However, if `has_normal_push` is false, then creating a `ListArc` should +/// yet called `do_work`. However, if `has_pushed_node` is false, then creating a `ListArc` should /// always succeed. /// /// Like the other fields in `NodeInner`, the delivery state is protected by the process lock.
@@ -725,7 +725,21 @@ impl DeliverToRead for Node { self.do_work_locked (writer, owner_inner) } -fn cancel (self:DArc <Self >) {} +fn cancel (self:DArc <Self >) { +let _drop_outside_lock; +let mut owner_inner = self.owner.inner.lock (); + +// We only do something on BINDER_THREAD_EXIT, not process exit. +if owner_inner.is_dead { +return ; + } + +// If BINDER_THREAD_EXIT is invoked on a thread with a pending node refcount update, we +// should move ourselves to ensure the refcount update is still delivered. +if let Some (node) =ListArc ::try_from_arc_borrow (self.as_arc_borrow ()) { + _drop_outside_lock = owner_inner.push_work (node); + } + }fn should_sync_wakeup (&self) ->bool {false
drivers/android/binder/node/wrapper.rs +33 -1
@@ -57,7 +57,39 @@ impl DeliverToRead for NodeWrapper { node.do_work_locked (writer, owner_inner) } -fn cancel (self:DArc <Self >) {} +fn cancel (self:DArc <Self >) { +let _drop_outside_lock; +let node = &self.node; +let mut owner_inner = node.owner.inner.lock (); + +// We only do something on BINDER_THREAD_EXIT, not process exit. +if owner_inner.is_dead { +return ; + } + +// We transfer the responsibility of the node refcount update to the scheduled Node because +// NodeWrapper has no way to re-create the ListArc. +let inner = node.inner.access_mut (&mut owner_inner); + +let ds = &mut inner.delivery_state; +assert! (ds.has_pushed_wrapper); +assert! (ds.has_strong_zero2one); + ds.has_pushed_wrapper =false ; + +// We are changing the state to one where the Node is the strong zero2one update instead of +// the wrapper. + ds.has_weak_zero2one =false ; + +if !ds.has_pushed_node { +if let Some (node2) =ListArc ::try_from_arc_borrow (node.as_arc_borrow ()) { + ds.has_pushed_node =true ; + _drop_outside_lock = owner_inner.push_work (node2); + }else { +// This can't actually happen. + ds.has_strong_zero2one =false ; + } + } + }fn should_sync_wakeup (&self) ->bool {false
Greg Kroah-Hartman
maintainerPATCH 18/621 ipv4: stop PMTU walk when nexthop group shrinks
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daehyeon Ko <[email protected]>
commit 6619e01855e65ef35723685a557e3eb106f4ecf5 upstream.
Commit 7d3f3b4367f3 ("net: ipv4: Cache pmtu for all packet paths if multipath enabled") made __ip_rt_update_pmtu() update every path.
For nexthop objects, fib_info_num_path() and fib_info_nhc() independently load nh->nh_grp. RCU protects each group's lifetime but does not make the loads observe the same group. If replacement shrinks the group after the loop accepts an index, fib_info_nhc() returns NULL and update_or_create_fnhe() dereferences it.
A deterministic probe only widened the existing window between the real operations. On v7.2, an RTM_NEWNEXTHOP replacement published a one-member group after the PMTU reader accepted index 1 from a two-member group, producing:
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: update_or_create_fnhe+0x45/0x15b0
Stop when the indexed path is absent. Groups are dense, so no later index exists in that snapshot. The same real-writer window completed 114,423 PMTU iterations without an oops with this check. A reproducer is available on request.
Replacement requires CAP_NET_ADMIN in the network namespace. Where unprivileged user namespaces are permitted, a local user can obtain it in a new user and network namespace.
--- net/ipv4/route.c | 2 ++ 1 file changed, 2 insertions(+)
net/ipv4/route.c +2 -0
@@ -1080,6 +1080,8 @@ static void __ip_rt_update_pmtu(struct rfor (nhsel =0 ; nhsel <fib_info_num_path (res.fi); nhsel++) { nhc =fib_info_nhc (res.fi, nhsel); +if (!nhc) +break ;update_or_create_fnhe (nhc, fl4->daddr,0 , mtu, lock, jiffies + net->ipv4.ip_rt_mtu_expires); }
Greg Kroah-Hartman
maintainerPATCH 19/621 ipv4: stop exception dump when nexthop group shrinks
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daehyeon Ko <[email protected]>
commit 4f4afc07dcb2edd4f9afa36595373f8cdb9b58c2 upstream.
Commit 4ce5dc9316de ("inet: switch inet_dump_fib() to RCU protection") allowed IPv4 FIB dumps to run concurrently with nexthop replacement.
fib_dump_info_fnhe() uses fib_info_num_path() as the loop bound, then fib_info_nhc() independently reloads nh->nh_grp. If RTM_NEWNEXTHOP replaces a group with fewer paths between those loads, fib_info_nhc() returns NULL and the dump dereferences it through nhc_flags.
Stop the walk when the indexed path is absent. Nexthop groups are dense, so the current snapshot has no later path.
--- net/ipv4/route.c | 3 +++ 1 file changed, 3 insertions(+)
net/ipv4/route.c +3 -0
@@ -3168,6 +3168,9 @@ int fib_dump_info_fnhe(struct sk_buff *sstruct fnhe_hash_bucket *bucket;int err; +if (!nhc) +break ; +if (nhc->nhc_flags &RTNH_F_DEAD )continue ;
Greg Kroah-Hartman
maintainerPATCH 20/621 ipv4: stop route notification sizing when nexthop group shrinks
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daehyeon Ko <[email protected]>
commit d3daa33c7af92e38f2274bbd2576f58bfbaf89e6 upstream.
Commit 680aea08e78c ("net: ipv4: Emit notification when fib hardware flags are changed") added an RCU-only fib_nlmsg_size() call for asynchronous hardware flag notifications.
fib_nlmsg_size() checks fib_info_num_path() before each iteration, then fib_info_nhc() independently reloads nh->nh_grp. If RTM_NEWNEXTHOP replaces a group with fewer paths between those loads, fib_info_nhc() returns NULL and fib_nexthop_nlmsg_size() dereferences it.
Stop sizing when the indexed path is absent. Nexthop groups are dense, so the current snapshot has no later path.
--- net/ipv4/fib_semantics.c | 3 +++ 1 file changed, 3 insertions(+)
net/ipv4/fib_semantics.c +3 -0
@@ -544,6 +544,9 @@ size_t fib_nlmsg_size(struct fib_info *fstruct fib_nh_common *nhc =fib_info_nhc (fi, i);size_t nhsize; +if (!nhc) +break ; + nhsize =fib_nexthop_nlmsg_size (nhc, nhs !=1 );if (nhs !=1 )
Greg Kroah-Hartman
maintainerPATCH 21/621 ipv4: do not warn on route notification size race
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daehyeon Ko <[email protected]>
commit e02a5b6588161673ef75a4bc5cdfb62bd493374d upstream.
Commit 680aea08e78c ("net: ipv4: Emit notification when fib hardware flags are changed") added asynchronous route notifications for hardware flag changes.
fib_alias_hw_flags_set() sizes the skb with fib_nlmsg_size() and later fills it with fib_dump_info() while holding only RCU. With nexthop compatibility mode enabled, a concurrent replacement can grow the group between these independent snapshots. fib_dump_info() can then legitimately return -EMSGSIZE, so the warning does not prove a sizing bug.
Remove the warning. The existing error path still frees the skb and reports the error to listeners.
--- net/ipv4/fib_trie.c | 2 -- 1 file changed, 2 deletions(-)
net/ipv4/fib_trie.c +0 -2
@@ -1079,8 +1079,6 @@ void fib_alias_hw_flags_set(struct net * err =fib_dump_info (skb,0 ,0 ,RTM_NEWROUTE , fri,0 );if (err <0 ) { -/* -EMSGSIZE implies BUG in fib_nlmsg_size() */ -WARN_ON (err == -EMSGSIZE );kfree_skb (skb); goto errout; }
Greg Kroah-Hartman
maintainerPATCH 22/621 ipv6: do not warn on route notification size race
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daehyeon Ko <[email protected]>
commit c97426ec649d99596d8969e1a052c16b14b7b485 upstream.
fib6_info_hw_flags_set() sizes the skb with rt6_nlmsg_size() and later fills it with rt6_fill_node(). With nexthop compatibility mode enabled, a concurrent replacement can grow the group between these independent snapshots. rt6_fill_node() can then legitimately return -EMSGSIZE, so the warning does not prove a sizing bug.
Remove the warning. The existing error path still frees the skb and reports the error to listeners.
--- net/ipv6/route.c | 2 -- 1 file changed, 2 deletions(-)
net/ipv6/route.c +0 -2
@@ -6468,8 +6468,6 @@ void fib6_info_hw_flags_set(struct net * err =rt6_fill_node (net, skb, f6i,NULL ,NULL ,NULL ,0 ,RTM_NEWROUTE ,0 ,0 ,0 );if (err <0 ) { -/* -EMSGSIZE implies BUG in rt6_nlmsg_size() */ -WARN_ON (err == -EMSGSIZE );kfree_skb (skb); goto errout; }
Greg Kroah-Hartman
maintainerPATCH 23/621 Input: ati_remote2 - fix type confusion in device attribute handlers
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
commit f321cc430c49b6c1be0d53f2ef19d8342d8029cc upstream.
Previously, the channel_mask and mode_mask attributes were registered on the parent usb_device via sysfs_create_group(). When commit b20d6bf8014b ("Input: ati-remote2 - use driver core to instantiate device attributes") converted the driver to let the driver core manage them via dev_groups in struct usb_driver, the attributes moved to the bound usb_interface devices, but the show and store callbacks were not updated accordingly.
As a result, the callbacks still invoked to_usb_device() on a device pointer belonging to a struct usb_interface, producing an invalid usb_device pointer.
Use to_usb_interface() directly in the attribute handlers to obtain the interface and its driver data.
--- drivers/input/misc/ati_remote2.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-)
drivers/input/misc/ati_remote2.c +4 -8
@@ -672,8 +672,7 @@ static ssize_t ati_remote2_show_channel_struct device_attribute *attr, char *buf) { - struct usb_device *udev = to_usb_device(dev); -struct usb_interface *intf =usb_ifnum_to_if (udev,0 ); + struct usb_interface *intf = to_usb_interface(dev);struct ati_remote2 *ar2 =usb_get_intfdata (intf);return sprintf (buf,"0x%04x\n" , ar2->channel_mask);
@@ -683,8 +682,7 @@ static ssize_t ati_remote2_store_channelstruct device_attribute *attr, const char *buf, size_t count) { - struct usb_device *udev = to_usb_device(dev); -struct usb_interface *intf =usb_ifnum_to_if (udev,0 ); + struct usb_interface *intf = to_usb_interface(dev);struct ati_remote2 *ar2 =usb_get_intfdata (intf);unsigned int mask;int r;
@@ -720,8 +718,7 @@ static ssize_t ati_remote2_show_mode_masstruct device_attribute *attr, char *buf) { - struct usb_device *udev = to_usb_device(dev); -struct usb_interface *intf =usb_ifnum_to_if (udev,0 ); + struct usb_interface *intf = to_usb_interface(dev);struct ati_remote2 *ar2 =usb_get_intfdata (intf);return sprintf (buf,"0x%02x\n" , ar2->mode_mask);
@@ -731,8 +728,7 @@ static ssize_t ati_remote2_store_mode_mastruct device_attribute *attr, const char *buf, size_t count) { - struct usb_device *udev = to_usb_device(dev); -struct usb_interface *intf =usb_ifnum_to_if (udev,0 ); + struct usb_interface *intf = to_usb_interface(dev);struct ati_remote2 *ar2 =usb_get_intfdata (intf);unsigned int mask;int err;
Greg Kroah-Hartman
maintainerPATCH 24/621 Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bihaan Sen <[email protected]>
commit 41363c27b8509bd4efcba244803edac9ba25d1b5 upstream.
The 8BitDo Pro 2 Wired Controller for Xbox is already matched by the vendor-wide XPAD_XBOXONE_VENDOR(0x2dc8) entry, but a later hardware revision reports product ID 0x201e, which has no entry in the xpad_device table. The device therefore binds and functions but is exposed to userspace as "Generic X-Box pad".
Add the VID/PID pair so the controller is named correctly, and set MAP_SHARE_BUTTON to expose the share button as KEY_RECORD.
--- drivers/input/joystick/xpad.c | 1 + 1 file changed, 1 insertion(+)
drivers/input/joystick/xpad.c +1 -0
@@ -413,6 +413,7 @@ static const struct xpad_device { { 0x2993, 0x2001, "TECNO Pocket Go", 0, XTYPE_XBOX360 }, { 0x2dc8, 0x2000, "8BitDo Pro 2 Wired Controller fox Xbox", 0, XTYPE_XBOXONE }, { 0x2dc8, 0x200f, "8BitDo Ultimate 3-mode Controller for Xbox", MAP_SHARE_BUTTON, XTYPE_XBOXONE }, + { 0x2dc8, 0x201e, "8BitDo Pro 2 Wired Controller for Xbox", MAP_SHARE_BUTTON, XTYPE_XBOXONE }, { 0x2dc8, 0x3106, "8BitDo Ultimate Wireless / Pro 2 Wired Controller", 0, XTYPE_XBOX360 }, { 0x2dc8, 0x3109, "8BitDo Ultimate Wireless Bluetooth", 0, XTYPE_XBOX360 }, { 0x2dc8, 0x310a, "8BitDo Ultimate 2C Wireless Controller", 0, XTYPE_XBOX360 },
Greg Kroah-Hartman
maintainerPATCH 25/621 Input: xpad - add support for Corsair Novablade Pro
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Furman <[email protected]>
commit f9282b8aa85a8c97c50d656db75feb6d76fc7cbe upstream.
Add device IDs for the Corsair Novablade Pro leverless fight controller in both wired (0x2b1f) and 2.4 GHz receiver (0x2b2b) modes, and add Corsair's vendor ID to the Xbox 360 vendor match list.
Outside of its PS4/PS5 modes the controller uses the Xbox 360 protocol (vendor-specific class, subclass 93, protocol 1) on interface 0, which xpad does not currently bind, so no gamepad device is created. The PS4/PS5 modes present a standard HID gamepad and already work with hid-generic.
Tested on 7.2.5 with the 2.4 GHz receiver and wired.
--- drivers/input/joystick/xpad.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/input/joystick/xpad.c +3 -0
@@ -336,6 +336,8 @@ static const struct xpad_device { { 0x17ef, 0x6182, "Lenovo Legion Controller for Windows", 0, XTYPE_XBOX360 }, { 0x1949, 0x041a, "Amazon Game Controller", 0, XTYPE_XBOX360 }, { 0x1a86, 0xe310, "Legion Go S", 0, XTYPE_XBOX360 }, + { 0x1b1c, 0x2b1f, "Corsair Novablade Pro (Wired)", 0, XTYPE_XBOX360 }, + { 0x1b1c, 0x2b2b, "Corsair Novablade Pro (2.4 GHz Receiver)", 0, XTYPE_XBOX360 }, { 0x1bad, 0x0002, "Harmonix Rock Band Guitar", 0, XTYPE_XBOX360 }, { 0x1bad, 0x0003, "Harmonix Rock Band Drumkit", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 }, { 0x1bad, 0x0130, "Ion Drum Rocker", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 },
@@ -580,6 +582,7 @@ static const struct usb_device_id xpad_tXPAD_XBOX360_VENDOR (0x17ef ),/* Lenovo */ XPAD_XBOX360_VENDOR (0x1949 ),/* Amazon controllers */ XPAD_XBOX360_VENDOR (0x1a86 ),/* Nanjing Qinheng Microelectronics (WCH) */ +XPAD_XBOX360_VENDOR (0x1b1c ),/* Corsair controllers */ XPAD_XBOX360_VENDOR (0x1bad ),/* Harmonix Rock Band guitar and drums */ XPAD_XBOX360_VENDOR (0x1ee9 ),/* ZOTAC Technology Limited */ XPAD_XBOX360_VENDOR(0x20bc), /* BETOP wireless dongles */
Greg Kroah-Hartman
maintainerPATCH 26/621 ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harin Lee <[email protected]>
commit 593d46fc6af9a0178a46e77d6d24b20d2314165f upstream.
Commit e576e7843c0d ("ALSA: ctxfi: Simplify dao_clear_{left,right}_input() functions") centralized the DAO input mapper clearing logic indao_clear_input(), but omitted the kfree() calls.
It removes the mapper entries from the list and sets their pointers to NULL without freeing the allocated array. This leaks memory each time dao_clear_input() is called.
Store the base pointer of the allocation before clearing the mapper entries and free the array after removing entries from the list.
--- sound/pci/ctxfi/ctdaio.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
sound/pci/ctxfi/ctdaio.c +5 -1
@@ -214,14 +214,18 @@ static int dao_set_right_input(struct dastatic int dao_clear_input (struct dao *dao,unsigned int start,unsigned int end) { +struct imapper *entry;unsigned int i; -if (!dao->imappers[start]) + entry = dao->imappers[start]; +if (!entry)return 0 ; +for (i = start; i < end; i++) { dao->mgr->imap_delete (dao->mgr, dao->imappers[i]); dao->imappers[i] =NULL ; } +kfree (entry);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 27/621 ALSA: hda/tas2781: Accept V1 calibration data without CRC
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mohamed Yassine Jebabli <[email protected]>
commit 408249089c48df1a4d23f60b831be3f3c311e6d1 upstream.
Some Lenovo BIOSes (e.g. Legion Pro 7 16IRX9H, SSID 17aa:38cd) store valid V1 calibration data in the CALI_DATA EFI variable but leave the TimeStamp and CRC fields zeroed. The driver rejects such data, so the amplifiers always run with default parameters on these machines.
The rejection was silent until
commit 4fe238513407 ("ALSA: hda/tas2781: Move and unified the calibrated-data getting function for SPI and I2C into the tas2781_hda lib") turned it into "V1 CRC error".
The stored values are consistent (R0 = 3.82/3.83 ohm, 1/R0 matching within 1e-4), so accept V1 data when both TimeStamp and CRC are zero and the first device entry is non-zero, and emit a warning.
--- sound/hda/codecs/side-codecs/tas2781_hda.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
sound/hda/codecs/side-codecs/tas2781_hda.c +15 -3
@@ -139,9 +139,21 @@ static void tas2781_apply_calib(struct t*/ crc =crc32 (~0 , data,84 ) ^ ~0 ;if (crc != tmp_val[21 ]) { - cali_data->total_sz =0 ; -dev_err (p->dev,"%s: V1 CRC error\n" , __func__); -return ; +/* +* Some Lenovo BIOSes (e.g. Legion Pro 7 16IRX9H, +* SSID 17aa:38cd) store valid V1 calibration data +* but leave TimeStamp and CRC zeroed. +*/ +if (!tmp_val[20 ] && !tmp_val[21 ] && + tmp_val[0 ] && tmp_val[1 ]) { +dev_warn (p->dev, +"%s: V1 data without CRC, accepting\n" , + __func__); + }else { + cali_data->total_sz =0 ; +dev_err (p->dev,"%s: V1 CRC error\n" , __func__); +return ; + } }for (j = p->ndev -1 ; j >=0 ; j--) {
Greg Kroah-Hartman
maintainerPATCH 28/621 arm64: irq: exclude the softirq stack switch from KCOV
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <[email protected]>
commit a9cd14bfb0c113f1cd77be4349784663bec71bb4 upstream.
On IRQ exit, __irq_exit_rcu() drops HARDIRQ_OFFSET before calling invoke_softirq(). The arm64 do_softirq_own_stack() wrapper and its ____do_softirq() trampoline run before __do_softirq() establishes softirq context, so KCOV records their PCs in the interrupted task's coverage buffer. They also run outside softirq accounting when local_bh_enable() reaches do_softirq().
The IRQ-exit coverage makes the KCOV boot selftest fail even after the scheduler and timer coverage leaks are suppressed. The generic softirq.o is already excluded from KCOV, but that exclusion does not cover the separately compiled arm64 wrappers.
Exclude irq.o from KCOV instrumentation, as is already done for the arm64 entry code. This covers both wrappers even with compilers that lack the no_sanitize_coverage attribute. The softirq action functions remain instrumented for explicit remote coverage.
--- arch/arm64/kernel/Makefile | 3 +++ 1 file changed, 3 insertions(+)
arch/arm64/kernel/Makefile +3 -0
@@ -25,6 +25,9 @@ KASAN_SANITIZE_stacktrace.o := n KCOV_INSTRUMENT_entry-common.o := n KCOV_INSTRUMENT_idle.o := n +# Softirq stack switching can run outside interrupt context. +KCOV_INSTRUMENT_irq.o := n + # Object file lists. obj-y := debug-monitors.o entry.o irq.o fpsimd.o \ entry-common.o entry-fpsimd.o process.o ptrace.o \
Greg Kroah-Hartman
maintainerPATCH 29/621 ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P)
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Garland <[email protected]>
commit d0cb7a7b2a490c381ad97f53155d02a748b60dea upstream.
The Acer Aspire Go 15 (AG15-21P, board MDC Herbag2_MDU) has two PDM DMICs connected to the ACP. The BIOS does not set the AcpDmicConnected _DSD property, so the acp6x machine driver never registers the DMIC card. The existing Herbag_MDU entry does not match this board name, so add a DMI quirk for it.
Tested on BIOS V1.11: the acp6x DMIC capture device is registered and records audio on both channels.
--- sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/soc/amd/yc/acp6x-mach.c +7 -0
@@ -706,6 +706,13 @@ static const struct dmi_system_id yc_acp { .driver_data = &acp6x_card, .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"MDC" ), + DMI_MATCH(DMI_BOARD_NAME, "Herbag2_MDU"), + } + }, + { + .driver_data = &acp6x_card, + .matches = {DMI_MATCH (DMI_BOARD_VENDOR ,"System76" ), DMI_MATCH(DMI_PRODUCT_VERSION, "pang12"), }
Greg Kroah-Hartman
maintainerPATCH 30/621 btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <[email protected]>
commit 1fd742c7479961da6d0bb794ef8ac6b7b9442847 upstream.
When paths_from_inode() fails, scrub_print_warning_inode() jumps to err without dropping the reference taken by btrfs_get_fs_root(), leaking a reference to the root every time path resolution fails while printing scrub warnings. Every other error and success path of the function drops the reference.
Drop the reference on the paths_from_inode() failure path too.
--- fs/btrfs/scrub.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/btrfs/scrub.c +3 -1
@@ -551,8 +551,10 @@ static int scrub_print_warning_inode(u64 } ret =paths_from_inode (inum, ipath); -if (ret <0 ) +if (ret <0 ) { +btrfs_put_root (local_root); goto err; + }/* * we deliberately ignore the bit ipath might have been too small to
Greg Kroah-Hartman
maintainerPATCH 31/621 cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Waiman Long <[email protected]>
commit 23b1ab15ca91f2cffaf149d9bb0fafeb700c7db2 upstream.
With commit 2125c0034c5d ("cgroup/cpuset: Make cpuset hotplug processing synchronous"), the cpuset hotplug operation becomes synchronous. That commit also removes the code that handles race between cpuset_hotplug_work and cpu hotplug notifier with the assumption that race is now gone. Later commit 7a0aabd9ce69 ("cgroup/cpuset: Always use cpu_active_mask") updates the cpuset code to always use cpu_active_mask instead of cpu_online_mask in some places including guarantee_online_cpus() which is renamed to guarantee_active_cpus() in that commit.
In the case of CPU offline operation, cpu_active_mask is updated first in sched_cpu_deactivate() to remove the offline CPU before cpuset_handle_hotplug() is called to update the effective_cpus of the affected cpusets. The cpu_online_mask is updated after that near the end of the offline operation to remove the offline CPU. As a result, the race comes back and the top cpuset may not have any active CPU leading to NULL pointer dereference during the race window when guarantee_active_cpus() is called after cpu_active_mask is updated to remove the CPU to be torn down but before cpuset_handle_hotplug() is able to properly update the effective_cpus of the top cpuset.
Fix this by adding back the NULL cs check to avoid this problem.
--- kernel/cgroup/cpuset.c | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-)
kernel/cgroup/cpuset.c +18 -2
@@ -429,10 +429,26 @@ static void guarantee_active_cpus(structrcu_read_lock (); cs =task_cs (tsk); -while (!cpumask_intersects (cs->effective_cpus, pmask)) +while (!cpumask_intersects (cs->effective_cpus, pmask)) { cs =parent_cs (cs); - +if (unlikely (!cs)) { +/* +* The top cpuset doesn't have any active cpu as a +* consequence of a race between its caller and the cpu +* hotplug operation where cpu_active_mask is updated +* asynchronously before cpuset_handle_hotplug() is +* being called to adjust the effective_cpus of the +* affected cpusets. But we know the top cpuset's +* effective_cpus is on its way to be identical to +* cpu_active_mask minus the exclusive CPUs dedicated +* to other valid cpuset partitions. Just pass back +* the filtered cpu_active_mask in this case. +*/ + goto out_unlock; + } + }cpumask_and (pmask, pmask, cs->effective_cpus); +out_unlock:rcu_read_unlock (); }
Greg Kroah-Hartman
maintainerPATCH 32/621 cipso: adjust cached option offsets when removing CIPSO
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daehyeon Ko <[email protected]>
commit 6d25ffca055a77787c21a36b66c253f76239411b upstream.
cipso_v4_skbuff_delattr() removes the CIPSO bytes but does not adjust cached offsets for options that follow them.
For example, with a valid 10-byte CIPSO option followed by a seven-byte RR option, parsing records rr at offset 30. Removing CIPSO moves RR to offset 20, while the cached offset remains 30. Consumers such as ip_forward_options() and __ip_options_echo() then access the wrong bytes; the latter may interpret packet data as the option length and copy it into fixed-size option storage.
Mirror cipso_v4_delopt() and subtract cipso_len from the srr, rr, ts and router_alert offsets when they follow CIPSO. cipso_len is the distance the first memmove() shifts those options. The later header move and network-header reset relocate the bytes and their offset base together.
--- net/ipv4/cipso_ipv4.c | 8 ++++++++ 1 file changed, 8 insertions(+)
net/ipv4/cipso_ipv4.c +8 -0
@@ -2287,6 +2287,14 @@ int cipso_v4_skbuff_delattr(struct sk_bu new_hdr_len - new_hdr_len_actual); opt->optlen -= hdr_len_delta; +if (opt->srr > opt->cipso) + opt->srr -= cipso_len; +if (opt->rr > opt->cipso) + opt->rr -= cipso_len; +if (opt->ts > opt->cipso) + opt->ts -= cipso_len; +if (opt->router_alert > opt->cipso) + opt->router_alert -= cipso_len; opt->cipso =0 ; opt->is_changed =1 ;if (hdr_len_delta !=0 ) {
Greg Kroah-Hartman
maintainerPATCH 33/621 dm ioctl: dont let data_start run past the buffer
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Palla Raghunath <[email protected]>
commit 9b3fcf519d370df94a56f3b272d9eddffffa5be8 upstream.
struct dm_ioctl has seven bytes of trailing padding, so the smallest buffer userspace is allowed to ask for, offsetof(struct dm_ioctl, data), is seven bytes shorter than sizeof(struct dm_ioctl).
get_result_buffer() sets data_start to sizeof(struct dm_ioctl) without looking at how big the buffer actually is. Ask for the minimum and data_start ends up seven bytes past the end. Callers add it to data_size, and ctl_ioctl() copies that much back to userspace:
BUG: KASAN: slab-out-of-bounds in _copy_to_user+0xad/0xd0 Read of size 312 at addr ffff8880169e4c00 by task repro-dm/140 ctl_ioctl+0x5e3/0xcb0 dm_ctl_ioctl+0x25/0x40 allocated 305-byte region [ffff8880169e4c00, ffff8880169e4d31)
A DM_LIST_DEVICES with data_size set to 305 is enough to hit it, and the seven bytes that leak are whatever sat next to the allocation.
Clamp data_start to the buffer size.
Note that this is not a security bug because the out-of-bounds read can only be triggered by root.
--- drivers/md/dm-ioctl.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/md/dm-ioctl.c +8 -2
@@ -556,10 +556,16 @@ static void *get_result_buffer(struct dm { param->data_start =align_ptr (param +1 ) - (void *) param; -if (param->data_start < param_size) +if (param->data_start < param_size) { *len = param_size - param->data_start; -else + }else { +/* +* The buffer can be as small as offsetof(*param, data), which +* is less than sizeof(*param), so don't run off the end of it. +*/ *len =0 ; + param->data_start = param_size; + }return ((void *) param) + param->data_start; }
Greg Kroah-Hartman
maintainerPATCH 34/621 usb: f81604: fix struct f81604_int_data size mismatch
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ji-Ze Hong (Peter Hong) <[email protected]>
commit 7f85d1170575645f9f327062d78017a23b2714eb upstream.
The struct f81604_int_data defines 9 bytes of interrupt data:
- Byte 0: Status register (sr)
- Byte 1: Interrupt register (isrc)
- Byte 2: Interrupt enable register (ier)
- Byte 3: Arbitration lost capture (alc)
- Byte 4: Error code capture (ecc)
- Byte 5: Error warning limit register (ewlr)
- Byte 6: RX error counter (rxerr)
- Byte 7: TX error counter (txerr)
- Byte 8: Reserved (val)
The hardware sends exactly 9 bytes for the interrupt endpoint. However, the struct was defined with __aligned(4) attribute which caused the compiler to pad the struct to 12 bytes.
This causes a problem in f81604_read_int_callback() where the short URB check compares urb->actual_length against sizeof(*data). When sizeof(struct f81604_int_data) is 12 but the hardware only sends 9 bytes, the check fails and valid interrupt messages are discarded.
This results in the driver only being able to transmit once because the TX complete interrupt is never processed.
Fix this by removing the __aligned(4) attribute so the struct size matches the actual hardware data size of 9 bytes.
--- drivers/net/can/usb/f81604.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/can/usb/f81604.c +1 -1
@@ -169,7 +169,7 @@ struct f81604_int_data {u8 rxerr;u8 txerr;u8 val; -} __packed__aligned(4) ; +} __packed;struct f81604_sff {__be16 id;
Greg Kroah-Hartman
maintainerPATCH 35/621 vsock/virtio: account only unread bytes in read_skb()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daehyeon Ko <[email protected]>
commit a463f55c791b96cfd12df8b10ea737d45c80bb18 upstream.
After a partial stream receive, rx_bytes tracks the unread suffix while buf_used and peer credit still cover the whole packet. virtio_transport_read_skb() dequeues that packet but passes pkt_len for both counters, underflowing rx_bytes.
On a connected CID_LOCAL stream with an SK_SKB verdict, a 40-byte read from a 100-byte packet made SIOCINQ report -40, an empty recv return ELOOP, and poll report the empty socket readable. After verdict detach, receiving 40 bytes wrapped the counter to zero and hid those queued bytes until one more byte arrived. The fixed run kept the counter balanced and exposed all queued data immediately.
This was found during an LLM-assisted manual source audit of VSOCK receive accounting while re-evaluating virtio_transport_read_skb() after CVE-2024-50169.
Subtract only skb->len minus the VSOCK offset from rx_bytes. Retain the full packet length for buf_used and peer credit.
--- net/vmw_vsock/virtio_transport_common.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/vmw_vsock/virtio_transport_common.c +3 -1
@@ -1903,6 +1903,7 @@ int virtio_transport_read_skb(struct vsostruct sock *sk =sk_vsock (vsk);struct virtio_vsock_hdr *hdr;struct sk_buff *skb; +u32 bytes_read;u32 pkt_len;int off =0 ;int err;
@@ -1922,7 +1923,8 @@ int virtio_transport_read_skb(struct vso vvs->msg_count--; pkt_len =le32_to_cpu (hdr->len); -virtio_transport_dec_rx_pkt (vvs, pkt_len, pkt_len); + bytes_read = skb->len -VIRTIO_VSOCK_SKB_CB (skb)->offset; +virtio_transport_dec_rx_pkt (vvs, bytes_read, pkt_len);spin_unlock_bh (&vvs->rx_lock);virtio_transport_send_credit_update (vsk);
Greg Kroah-Hartman
maintainerPATCH 36/621 wifi: brcmfmac: fix P2P device removal race in brcmf_detach()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michele Dionisio <[email protected]>
commit 08a3f02fea636e97a7422d1512f76dacdb5b0887 upstream.
When the driver is removed while the user space process that created the P2P device (e.g. wpa_supplicant) is still exiting, the P2P device interface is removed twice and the kernel crashes.
The two paths are:
- wpa_supplicant, on exit, sends NL80211_CMD_DEL_INTERFACE for the P2P device. nl80211_del_interface() holds RTNL and the wiphy mutex and calls brcmf_p2p_del_vif(), which disables discovery and waits up to 1.5 s for BRCMF_E_IF_DEL. Then it calls brcmf_remove_interface(), which unregisters the wdev and frees the vif and the ifp.
- brcmf_detach() sets the bus down, so BRCMF_E_IF_DEL never arrives, and calls brcmf_remove_interface(ifp, false) for the same ifp. brcmf_p2p_ifp_removed() reads ifp->vif and then blocks on rtnl_lock(). When brcmf_p2p_del_vif() releases RTNL, it calls cfg80211_unregister_wdev() on the wdev that was already unregistered and freed.
The second list_del_rcu() of wdev->list faults on LIST_POISON2:
brcmfmac: brcmf_p2p_del_vif delete P2P vif
brcmfmac: brcmf_p2p_deinit_discovery enter
brcmfmac: brcmf_p2p_del_vif P2P: GO_NEG_PHASE status cleared
brcmfmac: brcmf_detach Enter
brcmfmac: brcmf_bus_change_state 1 -> 0
brcmfmac: brcmf_remove_interface Enter, bsscfgidx=1, ifidx=0
brcmfmac: brcmf_del_if Enter, bsscfgidx=1, ifidx=0
brcmfmac: brcmf_p2p_ifp_removed P2P: device interface removed [1.5 s later, brcmf_p2p_del_vif() timed out]
brcmfmac: brcmf_remove_interface Enter, bsscfgidx=1, ifidx=0
brcmfmac: brcmf_del_if Enter, bsscfgidx=1, ifidx=0
brcmfmac: brcmf_p2p_ifp_removed P2P: device interface removed
Unable to handle kernel paging request at virtual address dead000000000122 Internal error: Oops: 96000044 [#1] PREEMPT_RT SMP pc : _cfg80211_unregister_wdev+0x6c/0x264 [cfg80211] Call trace: _cfg80211_unregister_wdev+0x6c/0x264 [cfg80211] cfg80211_unregister_wdev+0x10/0x1c [cfg80211] brcmf_p2p_ifp_removed+0x84/0xb0 [brcmfmac] brcmf_remove_interface+0x1f4/0x254 [brcmfmac] brcmf_detach+0x88/0x180 [brcmfmac] brcmf_sdio_remove+0x90/0x7b0 [brcmfmac] brcmf_sdiod_remove+0x20/0xa0 [brcmfmac] brcmf_ops_sdio_remove+0xbc/0x12c [brcmfmac] sdio_bus_remove+0x38/0x144 device_release_driver_internal+0x1e8/0x2c0 device_release_driver+0x14/0x20 brcmf_sdio_bus_remove+0x2c/0x40 [brcmfmac] brcmf_fwvid_unregister_vendor+0xd8/0x170 [brcmfmac] __exit_compat+0x18/0x418 [brcmfmac_cyw] __arm64_sys_delete_module+0x1ac/0x244
The log was taken with debug=0x406 on an i.MX 8M Plus board with a CYW55513 (Sona IF513) on SDIO. The driver is the Ezurio backport of brcmfmac from v6.18.22 on a 5.4-rt kernel. The code involved is the same in mainline.
To reproduce:
1. Start wpa_supplicant on wlan0 and let it associate. It creates the P2P device (iw dev shows "type P2P-device").
2. Stop wpa_supplicant and remove the driver without waiting for wpa_supplicant to exit:
kill $(pidof wpa_supplicant)
rmmod brcmfmac_cyw brcmfmac
The crash is reproducible on that board.
For the interface without a netdev (the P2P device), take RTNL and the wiphy mutex in brcmf_detach() before reading iflist, and remove it with locked=true. If brcmf_p2p_del_vif() runs first, brcmf_detach() finds the slot empty. If brcmf_detach() runs first, nl80211 does not find the wdev any more. The interfaces with a netdev are removed as before, because brcmf_del_if() takes RTNL on its own for the primary interface.
--- drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 27 ++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +25 -2
@@ -1489,8 +1489,31 @@ void brcmf_detach(struct device *dev)brcmf_bus_change_state (bus_if,BRCMF_BUS_DOWN );/* make sure primary interface removed last */ for (i =BRCMF_MAX_IFS -1 ; i >-1 ; i--) { -if (drvr->iflist[i]) -brcmf_remove_interface (drvr->iflist[i], false); +struct brcmf_if *ifp = drvr->iflist[i]; + +if (!ifp) +continue ; + +if (ifp->ndev) { +brcmf_remove_interface (ifp, false); +continue ; + } + +/* The P2P device interface has no netdev. Its removal can +* race with NL80211_CMD_DEL_INTERFACE issued by a user space +* process that is exiting (e.g. wpa_supplicant), which ends +* in brcmf_p2p_del_vif() under RTNL and the wiphy mutex. If +* both paths remove the interface, the wdev is unregistered +* twice and the vif is used after being freed. Take the same +* locks and re-read iflist, so only one path removes it. +*/ +rtnl_lock (); +wiphy_lock (drvr->wiphy); + ifp = drvr->iflist[i]; +if (ifp) +brcmf_remove_interface (ifp, true); +wiphy_unlock (drvr->wiphy); +rtnl_unlock (); }brcmf_bus_stop (drvr->bus_if);
Greg Kroah-Hartman
maintainerPATCH 37/621 wifi: mt76: mt7603: initialize global station WCID
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Papa <[email protected]>
commit 456de496b53ae73e6e3020fec815dbdc88aa7c07 upstream.
mt7603 uses a driver-private global station WCID for frames that have neither a station nor a vif, including frames injected through a monitor interface. Unlike the core global WCID initialized by mt76_register_device(), this WCID is published without ever being passed to mt76_wcid_init().
Since commit 0335c034e726 ("wifi: mt76: fix race condition related to checking tx queue fill status"), mt76_tx() queues every such frame on the WCID's tx_pending or tx_offchannel queue and links its tx_list. The first injected frame therefore reaches __skb_queue_tail() with an uninitialized sk_buff_head and dereferences a NULL prev pointer.
Initialize the WCID before publishing it.
The fix was tested on an MT7603 PCIe device. Three wildcard probe requests were injected through a monitor interface. The hardware queue head and tail advanced from 0 to 3 and a second radio captured the third request over the air. No oops or reset occurred. After restoring AP mode, a 150 MB transfer also completed without a reset.
--- drivers/net/wireless/mediatek/mt76/mt7603/init.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/mediatek/mt76/mt7603/init.c +1 -0
@@ -230,6 +230,7 @@ mt7603_mac_init(struct mt7603_dev *dev)eth_broadcast_addr (bc_addr);mt7603_wtbl_init (dev,MT7603_WTBL_RESERVED ,-1 , bc_addr); +mt76_wcid_init (&dev->global_sta.wcid,0 ); dev->global_sta.wcid.idx =MT7603_WTBL_RESERVED ;rcu_assign_pointer (dev->mt76.wcid[MT7603_WTBL_RESERVED ], &dev->global_sta.wcid);
Greg Kroah-Hartman
maintainerPATCH 38/621 wifi: mt76: mt7996: fix uninitialized buf read in mt7996_variant_fem_init()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lu Huang <[email protected]>
commit 52f6a065e0810c739a5dabd33a58047f08100f50 upstream.
When the eFuse block covering MT7976C_EFUSE_OFFSET is invalid, mt7996_mcu_get_eeprom() returns -EINVAL without writing buf, but mt7996_variant_fem_init() tolerates -EINVAL and keeps running, so buf[idx] == 0xc reads uninitialized stack memory. A stale 0x0c byte misclassifies a 0x7976 aDie as 7976C, selects MT7996_FEM_INT and the wrong default EEPROM, overriding valid calibration data. Only consult the eFuse byte when the read succeeded; with an invalid eFuse, fall back to the three explicit aDie version checks.
--- drivers/net/wireless/mediatek/mt76/mt7996/init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt7996/init.c +1 -1
@@ -1178,7 +1178,7 @@ static int mt7996_variant_fem_init(struc adie_ver =u32_get_bits (regval,MT_ADIE_VERSION_MASK ); idx =MT7976C_EFUSE_OFFSET %MT7996_EEPROM_BLOCK_SIZE ; is_7976c = adie_ver ==0x8a10 || adie_ver ==0x8b00 || - adie_ver ==0x8c10 || buf[idx] ==0xc ; + adie_ver ==0x8c10 || (!ret && buf[idx] ==0xc ); adie_id =u32_get_bits (regval,MT_ADIE_CHIP_ID_MASK ); if (adie_id == 0x7975 || adie_id == 0x7979 ||
Greg Kroah-Hartman
maintainerPATCH 39/621 wireguard: queueing: preserve tstamp_type when encapsulating packet
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ramses de Norre <[email protected]>
commit 65ab9de4bdd4c05d8277cfc20ae0b9f5aff60897 upstream.
Sending traffic through a wireguard tunnel on a host using the fq qdisc fills the log with:
fq: likely mono tstamp with tstamp_type 0
An skb carries a timestamp in skb->tstamp and, separately, a skb->tstamp_type field recording which clock that timestamp came from. The two have to agree.
When wireguard encapsulates a packet it calls wg_reset_packet(), which clears the fields that must not leak from the inner packet into the tunnel packet. It does so in two steps:
skb_scrub_packet(skb, true); memset(&skb->headers, 0, sizeof(skb->headers));
skb_scrub_packet() deliberately keeps skb->tstamp when it holds a monotonic timestamp: that value is the time the packet is scheduled to be sent, and the qdisc still needs it. The memset then zeroes skb->tstamp_type, because that field sits inside the headers group while skb->tstamp does not. The packet therefore leaves wireguard carrying a monotonic timestamp labelled as a realtime one.
Nothing noticed until commit c4f796c4f16b ("net_sched: sch_fq: convert skb->tstamp if not monotonic"): fq used to assume every timestamp was monotonic. It now consults tstamp_type, spots the mismatch, warns, and falls back to treating the value as monotonic. Pacing still ends up correct, so the log spam is the actual problem.
Save tstamp_type before the memset and restore it when encapsulating, next to the hash fields that are already carried over this way. When decapsulating it stays zeroed, which is right: an incoming packet's timestamp is a realtime receive timestamp.
--- drivers/net/wireguard/queueing.h | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/wireguard/queueing.h +2 -0
@@ -78,12 +78,14 @@ static inline void wg_reset_packet(strucu8 l4_hash = skb->l4_hash;u8 sw_hash = skb->sw_hash;u32 hash = skb->hash; +u8 tstamp_type = skb->tstamp_type;skb_scrub_packet (skb, true);memset (&skb->headers,0 ,sizeof (skb->headers));if (encapsulating) { skb->l4_hash = l4_hash; skb->sw_hash = sw_hash; skb->hash = hash; + skb->tstamp_type = tstamp_type; } skb->queue_mapping =0 ; skb->nohdr =0 ;
Greg Kroah-Hartman
maintainerPATCH 40/621 wireguard: noise: reject response consumption after intermediate initiation
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason A. Donenfeld <[email protected]>
commit d0305f8d90029556260c6824b61c493c424eba9e upstream.
Two threads begin processing the identical response message, received twice. The first thread, A, runs. While it's running, the second one, B, gets partway through, and during that slow calculation, or even while blocking on down_write(), A completes and then also a handshake initiation that's already been queued up runs in thread C, which itself takes that same down_write(). The handshake initiation creation succeeds, and sets the state back to waiting-for-response, and calls up_write(), at which point thread B resumes, because either its finished its calculations or was finally allowed to acquire down_write(). Thread B then copies the state back to the peer, and begins a new session, using that state, which is the same session as the one made in thread A.
Thread A Thread B Thread C
down_read()
sA = handshake->state
memcpy(cA, handshake->crypto)up_read()
if (sA != 1)
goto failslow_crypto(cA)
down_read() sB = handshake->state memcpy(cB, handshake->crypto) up_read() if (sB != 1) goto fail slow_crypto(cB)
down_write()
if (sA != handshake->state)
goto fail
memcpy(handshake->crypto, cA)
handshake->state = 2up_write()down_write()
if (handshake->state != 2)
goto fail
derive_session(handshake->crypto)up_write()
down_write() slow_crypto(handshake->crypto) handshake->state = 1 up_write() down_write() if (sB != handshake->state) goto fail memcpy(handshake->crypto, cB) handshake->state = 2 up_write() down_write() if (handshake->state != 2) goto fail derive_session(handshake->crypto) up_write()
This seems basically impossible to hit in a meaningful way in practice, but ensure that it absolutely cannot happen by comparing the ephemeral private key that's on the stack with the latest one that the peer's handshake state has.
--- drivers/net/wireguard/noise.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/net/wireguard/noise.c +4 -3
@@ -784,10 +784,11 @@ wg_noise_handshake_consume_response(stru/* Success! Copy everything to peer */ down_write (&handshake->lock); -/* It's important to check that the state is still the same, while we -* have an exclusive lock. +/* Check that the state is the same and that this is still the +* initiation we started with, while we have an exclusive lock. */ -if (handshake->state != state) { +if (handshake->state != state || +crypto_memneq (handshake->ephemeral_private, ephemeral_private,NOISE_PUBLIC_KEY_LEN )) {up_write (&handshake->lock); goto fail; }
Greg Kroah-Hartman
maintainerPATCH 41/621 workqueue: Fix NULL current_pwq deref in chained work check
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavankumar Kondeti <[email protected]>
commit 980db94e3eeefdd8a1c46f86412c33a7f7806f51 upstream.
current_wq_worker() only tells us that %current is a kworker. It does not guarantee that the worker is currently executing a work item, as worker->current_pwq is populated only while process_one_work() is running the work function.
is_chained_work() can be reached while queueing on a draining or destroying workqueue. If a kworker outside work-item execution reaches that path, current_wq_worker() returns a worker but worker->current_pwq is NULL, and the chained-work test can fault before it emits the intended warning.
Guard the chained-work test with worker->current_pwq. A kworker without current_pwq is not executing work on the target workqueue, so the helper should return false and let the draining/destroying warning fire.
--- kernel/workqueue.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/workqueue.c +1 -1
@@ -2235,7 +2235,7 @@ static bool is_chained_work(struct workq* Return %true iff I'm a worker executing a work item on @wq. If * I'm @worker, it's safe to dereference it without locking. */ -return worker && worker->current_pwq->wq == wq; +return worker && worker->current_pwq && worker->current_pwq->wq == wq; }/*
Greg Kroah-Hartman
maintainerPATCH 42/621 xen/netfront: dont leak the skb when xennet_fill_frags() fails
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <[email protected]>
commit 93ccaf1c26e2133396173b76a071e59024daa622 upstream.
When a response chain has more slots than fit in the skb's frags, xennet_fill_frags() returns an error and xennet_poll() jumps to its error path. That path moves what's left on tmpq to errq to be freed, but the skb being filled was already dequeued from tmpq, so it's never freed. Each chain that overflows leaks the skb and the pages attached to it as frags, and the backend decides how many slots it sends.
Put the skb back on tmpq before taking the error path, like the xennet_set_skb_gso() failure just above it does.
--- drivers/net/xen-netfront.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/xen-netfront.c +3 -1
@@ -1346,8 +1346,10 @@ err: skb->data_len = rx->status; skb->len += rx->status; -if (unlikely (xennet_fill_frags (queue, skb, &tmpq))) +if (unlikely (xennet_fill_frags (queue, skb, &tmpq))) { +__skb_queue_head (&tmpq, skb); goto err; + }if (rx->flags & XEN_NETRXF_csum_blank) skb->ip_summed =CHECKSUM_PARTIAL ;
Greg Kroah-Hartman
maintainerPATCH 43/621 tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Georgiy Osokin <[email protected]>
commit b7f925fd5226deb953c8dcdc9677d3fcc2717c00 upstream.
tee_dyn_shm_alloc_helper() derives nr_pages from a caller-supplied size and passes it to alloc_pages_exact() without checking it. For size == 0 nr_pages is 0, and alloc_pages_exact(0) calls get_order(0), which is documented as undefined and returns BITS_PER_LONG - PAGE_SHIFT. The page allocator then trips its order > MAX_PAGE_ORDER warning and fails the allocation; on a panic_on_warn kernel that ends the boot.
This can be triggered by TEE_IOC_SHM_ALLOC with struct tee_ioctl_shm_alloc_data where size is 0.
Reject a zero page count, as register_shm_helper() already does for the register path.
--- drivers/tee/tee_shm.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/tee/tee_shm.c +4 -0
@@ -343,6 +343,10 @@ int tee_dyn_shm_alloc_helper(struct tee_unsigned int i;int rc =0 ; +/* get_order(0) is undefined and exceeds MAX_PAGE_ORDER. */ +if (!nr_pages) +return -EINVAL ; +/* * Ignore alignment since this is already going to be page aligned * and there's no need for any larger alignment.
Greg Kroah-Hartman
maintainerPATCH 44/621 strparser: make sure __strp_recv isnt running before tearing down the parser
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
commit 0984ebc631792acf8fff105112ee74a6b8f1efcc upstream.
The comment above strp_done() claims that if strp is stopped, strp_recv will no longer be called. That's only true if the caller has a mechanism (eg locking) to guarantee that strp_recv() calls that started before strp_stop() have completed by the time we call strp_done().
This adds a dummy lock_sock/release_sock pair to guarantee that any in-flight strp_recv() (which runs under either bh_lock_sock or lock_sock, depending if it's called from ->sk_data_ready or strp_work) has completed.
Only espintcp can be affected by this race condition, but this patch makes sure no future user of strp can have the bug.
This could crash on strp->sk ("general mode" of strp), but this mode has been here for 9 years and has never been used. It'll be gone soon, no point worrying about it.
Switch the stopped/paused/etc bits to u8's to avoid races between strp_stop() and strp_pause/unpause().
A reproducer has been published and turns the possible UAF into an exploit [1].
--- Documentation/networking/strparser.rst | 2 +- include/net/strparser.h | 10 +++++----- net/strparser/strparser.c | 6 +++++- 3 files changed, 11 insertions(+), 7 deletions(-)
Documentation/networking/strparser.rst +1 -1
@@ -77,7 +77,7 @@ Functions strp_done is called to release any resources held by the stream parser instance. This must be called after the stream processor - has been stopped. + has been stopped. The socket lock must not be held. ::
include/net/strparser.h +5 -5
@@ -91,11 +91,11 @@ static inline struct strp_msg *strp_msg(struct strparser {struct sock *sk; -u32 stopped :1 ; -u32 paused :1 ; -u32 aborted :1 ; -u32 interrupted :1 ; -u32 unrecov_intr :1 ; +u8 stopped; +u8 paused; +u8 aborted; +u8 interrupted; +u8 unrecov_intr;struct sk_buff **skb_nextp;struct sk_buff *skb_head;
net/strparser/strparser.c +5 -1
@@ -505,12 +505,16 @@ void strp_unpause(struct strparser *strpEXPORT_SYMBOL_GPL (strp_unpause);/* strp must already be stopped so that strp_recv will no longer be called. -* Note that strp_done is not called with the lower socket held. +* Note that strp_done must not be called with the lower socket held. */ void strp_done (struct strparser *strp) {WARN_ON (!strp->stopped); +lock_sock (strp->sk); +/* sync with pending strp_recv */ +release_sock (strp->sk); +cancel_delayed_work_sync (&strp->msg_timer_work);cancel_work_sync (&strp->work);
Greg Kroah-Hartman
maintainerPATCH 45/621 swiotlb: fix default_swiotlb_limit() for non-growable default pool
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <[email protected]>
commit 911655ab1dfb9d526978a75df3b210132620d30a upstream.
Commit ad96ce3252db ("swiotlb: determine potential physical address limit") changed default_swiotlb_limit() to return the maximum physical address that could ever be used by dynamically allocated pools, so that the value stays constant when CONFIG_SWIOTLB_DYNAMIC=y. However, io_tlb_default_mem.phys_limit is returned even when the default pool cannot grow, e.g. when swiotlb_init_remap() is called with a remap callback.
This breaks Xen dom0 on x86: pci_xen_swiotlb_init() passes SWIOTLB_ANY and xen_swiotlb_fixup(), so phys_limit is set to the top of dom0 memory, although xen_swiotlb_fixup() makes the default pool below the 32-bit boundary. xen_swiotlb_dma_supported() then rejects 32-bit DMA masks, even though the bounce buffer is perfectly usable by such devices.
Return phys_limit only if the default pool can actually grow, otherwise report the real end of the default pool, like in the !CONFIG_SWIOTLB_DYNAMIC case.
--- kernel/dma/swiotlb.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
kernel/dma/swiotlb.c +3 -3
@@ -1677,10 +1677,10 @@ phys_addr_t default_swiotlb_base(void)phys_addr_t default_swiotlb_limit (void ) {#ifdef CONFIG_SWIOTLB_DYNAMIC -return io_tlb_default_mem.phys_limit; -#else -return io_tlb_default_mem.defpool.end -1 ; +if (io_tlb_default_mem.can_grow) +return io_tlb_default_mem.phys_limit;#endif +return io_tlb_default_mem.defpool.end -1 ; }#ifdef CONFIG_DEBUG_FS
Greg Kroah-Hartman
maintainerPATCH 46/621 tcp: reject net_iov in zerocopy receive mapping hints
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daehyeon Ko <[email protected]>
commit 8b1f0af1fd5fd113432233ed8a3862ee7c30a84f upstream.
After copying a readable prefix, receive_fallback_to_copy() asks tcp_zerocopy_set_hint_for_skb() where page mapping can resume. If the next skb is unreadable, find_next_mappable_frag() passes its net_iov fragment to can_map_frag().
skb_frag_page() returns NULL for a net_iov, but can_map_frag() dereferences it in PageCompound(). A v7.2 KASAN run on a connected TCP socket with 64 readable bytes followed by a 4096-byte NET_IOV_DMABUF fragment reported:
BUG: KASAN: null-ptr-deref in can_map_frag tcp_zerocopy_receive -> can_map_frag Kernel panic - not syncing: KASAN: panic_on_warn set
The diagnostic inserted the net_iov directly because the test host has no devmem-capable NIC. Hardware end-to-end reachability remains untested and requires CONFIG_NET_DEVMEM plus a supported DMA-buf-bound RX queue.
Reject all net_iov fragments before skb_frag_page(). This covers both DMABUF and IOURING net_iov types while leaving page-backed checks unchanged. With the guard, the same queue copied the readable prefix, returned a 4096-byte skip hint, and completed without a fault.
--- net/ipv4/tcp.c | 2 ++ 1 file changed, 2 insertions(+)
net/ipv4/tcp.c +2 -0
@@ -1883,6 +1883,8 @@ static bool can_map_frag(const skb_frag_if (skb_frag_size (frag) !=PAGE_SIZE ||skb_frag_off (frag))return false; +if (skb_frag_is_net_iov (frag)) +return false; page =skb_frag_page (frag);
Greg Kroah-Hartman
maintainerPATCH 47/621 tipc: destroy topsrv workqueues before closing connections
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuqi Xu <[email protected]>
commit 3acdd44385bc7e2e57605e073691ce69cc5a960d upstream.
tipc_topsrv_stop() closed subscriber connections while the topology server's send and receive workqueues were still running. Socket callbacks and subscription events could then queue more work, and in-flight send/recv work could drop the last connection reference during the conn_idr walk.
That race produced several teardown failures: refcount_t addition on 0 from conn_get() on a connection whose release was blocked on idr_lock, a subsequent use-after-free in tipc_conn_close(), queue_work() on an already destroyed workqueue from the listener data-ready callback, and an RCU stall in tipc_topsrv_exit_net() while the walk spun under idr_lock.
Clear srv->listener under idr_lock so it acts as a shutdown flag, skip queue_work() once it is NULL, destroy the workqueues to flush in-flight work, and only then close the remaining connections. Refuse tipc_conn_lookup() after that flag is cleared, and drop idr_lock when the teardown walk finds no connection, so an in-flight subscription event cannot pin idr_in_use while the walk holds the lock.
v3 supersedes the narrower in-thread diff Tung Quang Nguyen posted on 2026-09-23. It keeps his teardown order and adds the lookup refusal and the empty-idr unlock.
--- net/tipc/topsrv.c | 80 +++++++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 65 insertions(+), 15 deletions(-)
net/tipc/topsrv.c +65 -15
@@ -55,7 +55,7 @@/** * struct tipc_topsrv - TIPC server structure * @conn_idr: identifier set of connection -* @idr_lock: protect the connection identifier set +* @idr_lock: protect the connection identifier set and listener * @idr_in_use: amount of allocated identifier entry * @net: network namespace instance * @awork: accept work item
@@ -218,6 +218,10 @@ static struct tipc_conn *tipc_conn_lookustruct tipc_conn *con;spin_lock_bh (&s->idr_lock); +if (!s->listener) { +spin_unlock_bh (&s->idr_lock); +return NULL ; + } con =idr_find (&s->conn_idr, conid);if (!connected (con) || !kref_get_unless_zero (&con->kref)) con =NULL ;
@@ -301,10 +305,20 @@ static void tipc_conn_send_to_sock(strucstatic void tipc_conn_send_work (struct work_struct *work) { struct tipc_conn *con = container_of(work, struct tipc_conn, swork); +struct tipc_topsrv *srv; + + srv = con->server; +spin_lock_bh (&srv->idr_lock); +if (!srv->listener) { +spin_unlock_bh (&srv->idr_lock); + goto out; + } +spin_unlock_bh (&srv->idr_lock);if (connected (con))tipc_conn_send_to_sock (con); +out:conn_put (con); }
@@ -334,8 +348,14 @@ void tipc_topsrv_queue_evt(struct net *nlist_add_tail (&e->list, &con->outqueue);spin_unlock_bh (&con->outqueue_lock); -if (queue_work (srv->send_wq, &con->swork)) -return ; +spin_lock_bh (&srv->idr_lock); +if (srv->listener) { +if (queue_work (srv->send_wq, &con->swork)) { +spin_unlock_bh (&srv->idr_lock); +return ; + } + } +spin_unlock_bh (&srv->idr_lock); err:conn_put (con); }
@@ -346,14 +366,20 @@ err:*/ static void tipc_conn_write_space (struct sock *sk) { +struct tipc_topsrv *srv;struct tipc_conn *con;read_lock_bh (&sk->sk_callback_lock); con = sk->sk_user_data;if (connected (con)) { -conn_get (con); -if (!queue_work (con->server->send_wq, &con->swork)) -conn_put (con); + srv = con->server; +spin_lock_bh (&srv->idr_lock); +if (srv->listener) { +conn_get (con); +if (!queue_work (srv->send_wq, &con->swork)) +conn_put (con); + } +spin_unlock_bh (&srv->idr_lock); }read_unlock_bh (&sk->sk_callback_lock); }
@@ -418,8 +444,17 @@ static int tipc_conn_rcv_from_sock(strucstatic void tipc_conn_recv_work (struct work_struct *work) { struct tipc_conn *con = container_of(work, struct tipc_conn, rwork); +struct tipc_topsrv *srv;int count =0 ; + srv = con->server; +spin_lock_bh (&srv->idr_lock); +if (!srv->listener) { +spin_unlock_bh (&srv->idr_lock); + goto out; + } +spin_unlock_bh (&srv->idr_lock); +while (connected (con)) {if (tipc_conn_rcv_from_sock (con))break ;
@@ -430,6 +465,7 @@ static void tipc_conn_recv_work(struct w count =0 ; } } +out:conn_put (con); }
@@ -438,6 +474,7 @@ static void tipc_conn_recv_work(struct w*/ static void tipc_conn_data_ready (struct sock *sk) { +struct tipc_topsrv *srv;struct tipc_conn *con;trace_sk_data_ready (sk);
@@ -445,9 +482,14 @@ static void tipc_conn_data_ready(structread_lock_bh (&sk->sk_callback_lock); con = sk->sk_user_data;if (connected (con)) { -conn_get (con); -if (!queue_work (con->server->rcv_wq, &con->rwork)) -conn_put (con); + srv = con->server; +spin_lock_bh (&srv->idr_lock); +if (srv->listener) { +conn_get (con); +if (!queue_work (srv->rcv_wq, &con->rwork)) +conn_put (con); + } +spin_unlock_bh (&srv->idr_lock); }read_unlock_bh (&sk->sk_callback_lock); }
@@ -503,8 +545,12 @@ static void tipc_topsrv_listener_data_reread_lock_bh (&sk->sk_callback_lock); srv = sk->sk_user_data; -if (srv) -queue_work (srv->rcv_wq, &srv->awork); +if (srv) { +spin_lock_bh (&srv->idr_lock); +if (srv->listener) +queue_work (srv->rcv_wq, &srv->awork); +spin_unlock_bh (&srv->idr_lock); + }read_unlock_bh (&sk->sk_callback_lock); }
@@ -701,22 +747,26 @@ static void tipc_topsrv_stop(struct netint id;spin_lock_bh (&srv->idr_lock); + srv->listener =NULL ; +spin_unlock_bh (&srv->idr_lock); +tipc_topsrv_work_stop (srv); + +spin_lock_bh (&srv->idr_lock);for (id =0 ; srv->idr_in_use; id++) { con =idr_find (&srv->conn_idr, id);if (con) { -conn_get (con);spin_unlock_bh (&srv->idr_lock);tipc_conn_close (con); -conn_put (con);spin_lock_bh (&srv->idr_lock); +continue ; } +spin_unlock_bh (&srv->idr_lock); +spin_lock_bh (&srv->idr_lock); }__module_get (lsock->ops->owner);__module_get (lsock->sk->sk_prot_creator->owner); - srv->listener =NULL ;spin_unlock_bh (&srv->idr_lock); -tipc_topsrv_work_stop (srv);sock_release (lsock);idr_destroy (&srv->conn_idr);kfree (srv);
Greg Kroah-Hartman
maintainerPATCH 48/621 tipc: hold a reference to nodes found by link name
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengfeng Ye <[email protected]>
commit 17e73bae400f6a434dc006e3bee92c94cf781954 upstream.
tipc_node_find_by_name() returns a node after dropping its RCU read lock without taking a reference. The LINK_SET, LINK_GET and LINK_RESET_STATS handlers then lock and access the node, racing with timer-driven cleanup of a down peer. Generic netlink serialization does not exclude the node timer.
The following interleaving can leave a handler using a freed node:
CPU 0: find the node under RCU and release the node read lock CPU 1: tipc_node_timeout() clears the links and unlinks the down node CPU 1: drop the list and timer references, queuing tipc_node_free() CPU 0: leave the RCU read-side critical section
CPU 1: complete the grace period and free the node
CPU 0: acquire the node lock through the stale pointer
LINK_SET also uses the node's media address after releasing the node lock, when passing queued packets to tipc_bearer_xmit().
KASAN on v7.3-rc5 reported:
BUG: KASAN: slab-use-after-free in _raw_read_lock_bh Write of size 4 at addr ffff88807e06f008 by task poc/92 Call Trace: _raw_read_lock_bh kernel/locking/spinlock.c:287 tipc_nl_node_set_link net/tipc/node.c:2475 genl_family_rcv_msg_doit net/netlink/genetlink.c:1114 genl_rcv_msg net/netlink/genetlink.c:1209 netlink_rcv_skb net/netlink/af_netlink.c:2575 Allocated by task 0: tipc_node_create net/tipc/node.c:539 tipc_node_check_dest net/tipc/node.c:1196 tipc_disc_rcv net/tipc/discover.c:252 Freed by task 92: kfree mm/slub.c:6801 rcu_core kernel/rcu/tree.c:2919 Last potentially related work creation: __call_rcu_common.constprop.0 kernel/rcu/tree.c:3181 tipc_node_timeout net/tipc/node.c:814
Acquire a reference to the selected node with kref_get_unless_zero() before leaving RCU, returning NULL if the node has already been released. Release that reference on every caller exit after the last node access, including transmission in LINK_SET. Keep the existing link lookup order and locking so concurrent link removal still takes the existing error paths.
--- net/tipc/node.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
net/tipc/node.c +9 -1
@@ -2419,8 +2419,11 @@ static struct tipc_node *tipc_node_find_ } }tipc_node_read_unlock (n); -if (found_node) +if (found_node) { +if (!kref_get_unless_zero (&found_node->kref)) + found_node =NULL ;break ; + } }rcu_read_unlock ();
@@ -2505,6 +2508,7 @@ out:tipc_node_read_unlock (node);tipc_bearer_xmit (net, bearer_id, &xmitq, &node->links[bearer_id].maddr,NULL ); +tipc_node_put (node);return res; }
@@ -2556,12 +2560,14 @@ int tipc_nl_node_get_link(struct sk_buff link = node->links[bearer_id].link;if (!link) {tipc_node_read_unlock (node); +tipc_node_put (node); err = -EINVAL ; goto err_free; } err =__tipc_nl_add_link (net, &msg, link,0 );tipc_node_read_unlock (node); +tipc_node_put (node);if (err) goto err_free; }
@@ -2632,11 +2638,13 @@ int tipc_nl_node_reset_link_stats(structif (!link) {spin_unlock_bh (&le->lock);tipc_node_read_unlock (node); +tipc_node_put (node);return -EINVAL ; }tipc_link_reset_stats (link);spin_unlock_bh (&le->lock);tipc_node_read_unlock (node); +tipc_node_put (node);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 49/621 Revert "wifi: libertas: reject short monitor TX frames"
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
commit 9727d1c4e1c971fc42b049b645fdda6852758835 upstream.
This reverts commit 13ff543e0b2c713aedeaadadde686686e949dc78.
The 'goto free' just made things worse, causing a spinlock to be handled incorrectly. Revert this for now.
--- drivers/net/wireless/marvell/libertas/tx.c | 7 ------- 1 file changed, 7 deletions(-)
drivers/net/wireless/marvell/libertas/tx.c +0 -7
@@ -117,13 +117,6 @@ netdev_tx_t lbs_hard_start_xmit(struct sif (priv->wdev->iftype ==NL80211_IFTYPE_MONITOR ) {struct tx_radiotap_hdr *rtap_hdr = (void *)skb->data; -if (skb->len <sizeof (*rtap_hdr) +4 +ETH_ALEN ) { -lbs_deb_tx ("tx err: short monitor frame %u\n" , skb->len); - dev->stats.tx_dropped++; - dev->stats.tx_errors++; - goto free; - } -/* set txpd fields from the radiotap header */ txpd->tx_control =cpu_to_le32 (convert_radiotap_rate_to_mv (rtap_hdr->rate));
Greg Kroah-Hartman
maintainerPATCH 50/621 RISC-V: Clear HSTATUS.HU on CPU initialization
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yong-Xuan Wang <[email protected]>
commit 6694612317e5225086e39ca1ba97ada2b1942e48 upstream.
The RISC-V privileged specification does not mandate HSTATUS reset values, leaving the HU bit potentially set after hardware reset. When HU=1, hypervisor instructions (HLV/HLVX/HSV) can execute in U-mode to access guest memory, which may cause unintended behavior if not explicitly controlled.
Clear HSTATUS.HU during CPU initialization to ensure hypervisor instructions are only available in HS-mode, preventing unexpected guest memory access from U-mode code.
--- arch/riscv/include/asm/cpufeature.h | 2 ++ arch/riscv/kernel/cpufeature.c | 12 ++++++++++++ arch/riscv/kernel/setup.c | 2 ++ arch/riscv/kernel/smpboot.c | 2 ++ arch/riscv/kernel/suspend.c | 2 ++ 5 files changed, 20 insertions(+)
arch/riscv/include/asm/cpufeature.h +2 -0
@@ -40,6 +40,8 @@ extern u32 thead_vlenb_of;void __init riscv_user_isa_enable (void ); +void riscv_clear_hypervisor_csr (void ); +#define _RISCV_ISA_EXT_DATA (_name, _id, _subset_exts, _subset_exts_size, _validate) { \ .name = #_name, \ .property = #_name, \
arch/riscv/kernel/cpufeature.c +12 -0
@@ -1135,6 +1135,18 @@ void __init riscv_user_isa_enable(void)pr_warn ("Zicbop disabled as it is unavailable on some harts\n" ); } +void riscv_clear_hypervisor_csr (void ) +{ +if (!riscv_has_extension_unlikely (RISCV_ISA_EXT_H )) +return ; + +/* +* Clear HSTATUS.HU to restrict hypervisor instructions to HS-mode. +* This prevents user-mode from executing HLV/HSV instructions. +*/ +csr_clear (CSR_HSTATUS ,HSTATUS_HU ); +} +#ifdef CONFIG_RISCV_ALTERNATIVE /* * Alternative patch sites consider 48 bits when determining when to patch
arch/riscv/kernel/setup.c +2 -0
@@ -371,6 +371,8 @@ void __init setup_arch(char **cmdline_p)if (!IS_ENABLED (CONFIG_RISCV_ISA_ZBB ) || !riscv_isa_extension_available (NULL ,ZBB ))static_branch_disable (&efficient_ffs_key); + +riscv_clear_hypervisor_csr (); }bool arch_cpu_is_hotpluggable (int cpu)
arch/riscv/kernel/smpboot.c +2 -0
@@ -232,6 +232,8 @@ asmlinkage __visible void smp_callin(voinuma_add_cpu (curr_cpuid); +riscv_clear_hypervisor_csr (); +pr_debug ("CPU%u: Booted secondary hartid %lu\n" , curr_cpuid,cpuid_to_hartid_map (curr_cpuid));
arch/riscv/kernel/suspend.c +2 -0
@@ -43,6 +43,8 @@ void suspend_save_csrs(struct suspend_covoid suspend_restore_csrs (struct suspend_context *context) { +riscv_clear_hypervisor_csr (); +csr_write (CSR_SCRATCH ,0 );if (riscv_has_extension_unlikely (RISCV_ISA_EXT_XLINUXENVCFG ))csr_write (CSR_ENVCFG , context->envcfg);
Re: [PATCH 6.18 050/621] RISC-V: Clear HSTATUS.HU on CPU initialization
Quoted 19 lines · On Tue, 13 Oct 2026 13:30:45 +0200 Greg Kroah-Hartman…
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yong-Xuan Wang <[email protected]>
commit
6694612317e5225086e39ca1ba97ada2b1942e48upstream.The RISC-V privileged specification does not mandate HSTATUS reset values, leaving the HU bit potentially set after hardware reset. When HU=1, hypervisor instructions (HLV/HLVX/HSV) can execute in U-mode to access guest memory, which may cause unintended behavior if not explicitly controlled.
Clear HSTATUS.HU during CPU initialization to ensure hypervisor instructions are only available in HS-mode, preventing unexpected guest memory access from U-mode code.
Quoted 7 lines
Signed-off-by Yong-Xuan Wang <[email protected]>Reviewed-by Samuel Holland <[email protected]>[[email protected]: capitalized RISCV_ISA_EXT_h to fix build; added stable cc]Signed-off-by Paul Walmsley <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>
Please see:
https://lore.kernel.org/stable/[email protected]/
Cheers,
Miguel
Greg Kroah-Hartman
maintainerPATCH 51/621 selinux: fix data race on AVC latest_notif
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Göttsche <[email protected]>
commit 1ca924044bf0de879a1648be93a56939652267d3 upstream.
avc_policy_seqno() reads latest_notif without holding notif_lock, while avc_latest_notif_update() can update it under that lock. KCSAN reports these concurrent accesses during policy boolean updates and permission checks.
Use READ_ONCE() for the lockless read and WRITE_ONCE() for the update. The spinlock continues to serialize the comparison and update against other writers. Reads made while holding notif_lock cannot race with a writer and can remain plain accesses.
This marks both sides of the intentional concurrent access and constrains compiler transformations, without suppressing checking with data_race().
--- security/selinux/avc.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
security/selinux/avc.c +3 -2
@@ -578,7 +578,7 @@ static int avc_latest_notif_update(u32 s } }else {if (seqno > selinux_avc.avc_cache.latest_notif) - selinux_avc.avc_cache.latest_notif = seqno; +WRITE_ONCE (selinux_avc.avc_cache.latest_notif, seqno); }spin_unlock_irqrestore (¬if_lock, flag);
@@ -1206,5 +1206,6 @@ int avc_has_perm(u32 ssid, u32 tsid, u16u32 avc_policy_seqno (void ) { -return selinux_avc.avc_cache.latest_notif; +/* Writers hold notif_lock; readers only sample the sequence number. */ +return READ_ONCE (selinux_avc.avc_cache.latest_notif); }
Greg Kroah-Hartman
maintainerPATCH 52/621 selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Smalley <[email protected]>
commit 28b7260548af3d35773477993ad4e4de41578dd7 upstream.
When an NFSv4 filesystem exported with security_label is mounted a second time, sget_fc() returns the existing superblock and nfs_get_root() calls security_sb_set_mnt_opts() again on it. Since the superblock is already SB_INITIALIZED, selinux_set_mnt_opts() takes an early exit without setting SECURITY_LSM_NATIVE_LABELS in *set_kern_flags. nfs_get_root() then sees kflags without SECURITY_LSM_NATIVE_LABELS set and clears NFS_CAP_SECURITY_LABEL on the shared nfs_server, silently disabling per-file labeling for both the new and the original mount.
Commit 3815a245b501 ("security/selinux: fix SECURITY_LSM_NATIVE_LABELS on reused superblock") fixed the same problem in selinux_sb_clone_mnt_opts(). The reused-superblock path for a plain second mount now goes through sb_set_mnt_opts rather than sb_clone_mnt_opts, so it needs the same treatment: on both SE_SBINITIALIZED early exits, set SECURITY_LSM_NATIVE_LABELS in *set_kern_flags when the superblock was already using SECURITY_FS_USE_NATVE.
--- security/selinux/hooks.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
security/selinux/hooks.c +8 -1
@@ -686,8 +686,12 @@ static int selinux_set_mnt_opts(struct s* will be used for both mounts) */ if ((sbsec->flags &SE_SBINITIALIZED ) && (sb->s_type->fs_flags &FS_BINARY_MOUNTDATA ) - && !opts) + && !opts) { +if ((kern_flags &SECURITY_LSM_NATIVE_LABELS ) && + sbsec->behavior ==SECURITY_FS_USE_NATIVE ) + *set_kern_flags |=SECURITY_LSM_NATIVE_LABELS ; goto out; + } root_isec =backing_inode_security_novalidate (root);
@@ -731,6 +735,9 @@ static int selinux_set_mnt_opts(struct s/* previously mounted with options, but not on this attempt? */ if ((sbsec->flags &SE_MNTMASK ) && !opts) goto out_double_mount; +if ((kern_flags &SECURITY_LSM_NATIVE_LABELS ) && + sbsec->behavior ==SECURITY_FS_USE_NATIVE ) + *set_kern_flags |=SECURITY_LSM_NATIVE_LABELS ; rc =0 ; goto out; }
Greg Kroah-Hartman
maintainerPATCH 53/621 sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Peng <[email protected]>
commit 538b529509c7ab0d909cb65bb7264edca1788d30 upstream.
When an SCTP stream output extension structure (streamoute) has not yet been allocated, sctp_getsockopt_pr_streamstatus() sets the local stack variables params.sprstat_abandoned_unsent = 0 and params.sprstat_abandoned_sent = 0, but then immediately jumps to 'out:', bypassing copy_to_user(). As a result, when an uninitialized user buffer is passed to getsockopt(SCTP_PR_STREAM_STATUS), the kernel returns success (0) without copying the zeroed stats back to user space, leaving uninitialized data in the user buffer.
Refactor the !streamoute check into an if-else chain so that when streamoute is NULL, params is zeroed and falls through to copy_to_user(), copying the zeroed stats to user space and setting retval = 0 once before returning.
Tested in QEMU against Linux 7.3.0-rc3 using an uninitialized sctp_prstatus user struct passed to getsockopt(SCTP_PR_STREAM_STATUS) on a freshly created stream: on the unfixed kernel the user struct contains uninitialized stack garbage; whereas with this fix applied, getsockopt() copies zeroed stats into user space and returns 0.
--- net/sctp/socket.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
net/sctp/socket.c +1 -5
@@ -7516,11 +7516,7 @@ static int sctp_getsockopt_pr_streamstat/* Not allocated yet, means all stats are 0 */ params.sprstat_abandoned_unsent =0 ; params.sprstat_abandoned_sent =0 ; - retval =0 ; - goto out; - } - -if (policy ==SCTP_PR_SCTP_ALL ) { + }else if (policy ==SCTP_PR_SCTP_ALL ) { params.sprstat_abandoned_unsent =0 ; params.sprstat_abandoned_sent =0 ;for (policy =0 ; policy <=SCTP_PR_INDEX (MAX ); policy++) {
Greg Kroah-Hartman
maintainerPATCH 54/621 EDAC/amd64: Mask UMC chip select to the four implemented selects
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vishal Badole <[email protected]>
commit 7484bc43ba6b8e189b482db5b75e7842890a82b1 upstream.
For DRAM ECC errors, the chip select value can be found in the MCA_SYND[ErrorInformation] field.
ErrorInformation[2:0] was first documented in Zen1. The 3 bit field implied that up to 8 chip selects may be used.
However, all Zen-based systems have only ever had up to 4 chip selects. So only bits [1:0] would contain a valid chip select value.
Future systems are redefining the field to ErrorInformation[1:0]. This matches the existing 'up to 4 chip selects' implementations. And it frees up the extra bit for other decoding.
Change the current chip select mask from 0x7 to 0x3 to prepare for the decode change.
--- drivers/edac/amd64_edac.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/edac/amd64_edac.c +2 -2
@@ -2796,13 +2796,13 @@ static inline void decode_bus_error(int* the instance_id. For example, instance_id=0xYXXXXX where Y is the channel * number. * -* For DRAM ECC errors, the Chip Select number is given in bits [2:0] of +* For DRAM ECC errors, the Chip Select number is given in bits [1:0] of * the MCA_SYND[ErrorInformation] field. */ static void umc_get_err_info (struct mce *m,struct err_info *err) { err->channel = (m->ipid &GENMASK (31 ,0 )) >>20 ; - err->csrow = m->synd &0x7 ; + err->csrow = m->synd &0x3 ; }static void decode_umc_error (int node_id,struct mce *m)
Greg Kroah-Hartman
maintainerPATCH 55/621 gpio: mpsse: fix race when arming the IRQ poll worker
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <[email protected]>
commit 7efa1a1953cd6b20b23a3524d5b4b81789c6ef25 upstream.
gpio_mpsse_irq_enable() arms the poll worker before publishing it:schedule_work() runs before the worker is added to priv->workers. If gpio_mpsse_disconnect() walks the list in that window it misses the worker, and once disconnect returns, the USB core frees mpsse_priv while the orphaned gpio_mpsse_poll() work keeps accessing it, causing a use-after-free.
Fix this by publishing and arming the worker in one irq_spin critical section. Teardown walks the same list under irq_spin, so a worker found on the list is guaranteed to be armed, and cancel_work_sync() handles it whether it is queued or running.
A worker armed after the disconnect walk would still be missed, so also set a new priv->dying flag under irq_spin before the teardown walk, and check it in the same critical section, freeing it via kfree_rcu() instead when the device is going away, since kfree() would be called with the IRQ core's raw spinlock held and may sleep on PREEMPT_RT. schedule_work() is safe to call with irq_spin held, and the next probe gets a fresh mpsse_priv, so the flag never needs to be cleared.
This issue was found by an in-house static analysis tool.
--- drivers/gpio/gpio-mpsse.c | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-)
drivers/gpio/gpio-mpsse.c +22 -2
@@ -10,6 +10,7 @@#include <linux/cleanup.h> #include <linux/gpio/driver.h> #include <linux/mutex.h> +#include <linux/rcupdate.h> #include <linux/spinlock.h> #include <linux/usb.h>
@@ -24,6 +25,7 @@ struct mpsse_priv {raw_spinlock_t irq_spin;/* protects worker list */ atomic_t irq_type[16 ];/* pin -> edge detection type */ atomic_t irq_enabled; +atomic_t dying;/* no new workers after disconnect */ int id;u8 gpio_outputs[2 ];/* Output states for GPIOs [L, H] */
@@ -46,6 +48,7 @@ struct mpsse_worker {atomic_t cancelled;struct list_head list;/* linked list */ struct list_head destroy;/* teardown linked list */ +struct rcu_head rcu;/* deferred free for dying path */ };struct bulk_desc {
@@ -515,10 +518,24 @@ static void gpio_mpsse_irq_enable(struct worker->priv = priv;INIT_LIST_HEAD (&worker->list);INIT_WORK (&worker->work, gpio_mpsse_poll); -schedule_work (&worker->work); - scoped_guard(raw_spinlock_irqsave, &priv->irq_spin) + scoped_guard(raw_spinlock_irqsave, &priv->irq_spin) { +if (atomic_read (&priv->dying)) { +/* +* Cannot kfree() here: this callback +* runs with the IRQ descriptor's raw +* spinlock held and kfree() may sleep +* on PREEMPT_RT. The worker is not +* yet published, so the deferred free +* is unobservable. +*/ +kfree_rcu (worker, rcu); +return ; + } +list_add (&worker->list, &priv->workers); +schedule_work (&worker->work); + } } }
@@ -705,6 +722,9 @@ static void gpio_mpsse_disconnect(struct {struct mpsse_priv *priv =usb_get_intfdata (intf); + scoped_guard(raw_spinlock_irqsave, &priv->irq_spin) +atomic_set (&priv->dying,1 ); +/* * Lock prevents double-free of worker from here and the teardown * step at the beginning of gpio_mpsse_poll
Greg Kroah-Hartman
maintainerPATCH 56/621 gpio: xilinx: fix runtime PM leak on request error path
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ridham Khurana <[email protected]>
commit ff82fc3a4a1d417dee1229681cc5285986edb1fa upstream.
pm_runtime_get_sync() leaves the usage counter incremented even when it fails, and xgpio_request() returns the error without dropping it.
gpiolib does not call ->free() when ->request() fails, so xgpio_free(), which holds the only matching pm_runtime_put(), never runs. The reference is leaked and the controller can no longer runtime-suspend, so its clock stays enabled.
Switch to pm_runtime_resume_and_get(), which only increments the usage counter on success.
--- drivers/gpio/gpio-xilinx.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-)
drivers/gpio/gpio-xilinx.c +1 -8
@@ -271,14 +271,7 @@ static void xgpio_save_regs(struct xgpiostatic int xgpio_request (struct gpio_chip *chip,unsigned int offset) { -int ret; - - ret =pm_runtime_get_sync (chip->parent); -/* -* If the device is already active pm_runtime_get() will return 1 on -* success, but gpio_request still needs to return 0. -*/ -return ret <0 ? ret :0 ; +return pm_runtime_resume_and_get (chip->parent); }static void xgpio_free (struct gpio_chip *chip,unsigned int offset)
Greg Kroah-Hartman
maintainerPATCH 57/621 gve: fix napi_disable deadlock when attempting to disable XSK pools
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Washington <[email protected]>
commit 0cb6939a4dfefa822007b7a71986e06bc4f61f54 upstream.
When disabling XSK pools, GVE calls the unlocked versions of napi_disable and napi_enable. However, the netdev lock has already been acquired before ndo_bpf is called because GVE supports queue management ops. Calling the unlocked versions of napi_disable/enable results in a deadlock when attempting to disable XSK pools, as the thread attempts to re-acquire a lock it already holds.
Update the NAPI calls to use the locked versions.
This issue was found in production.
--- drivers/net/ethernet/google/gve/gve_main.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/ethernet/google/gve/gve_main.c +4 -4
@@ -1663,17 +1663,17 @@ static int gve_xsk_pool_disable(struct n } napi_rx = &priv->ntfy_blocks[priv->rx[qid].ntfy_id].napi; -napi_disable (napi_rx);/* make sure current rx poll is done */ +napi_disable_locked (napi_rx);/* make sure current rx poll is done */ tx_qid =gve_xdp_tx_queue_id (priv, qid); napi_tx = &priv->ntfy_blocks[priv->tx[tx_qid].ntfy_id].napi; -napi_disable (napi_tx);/* make sure current tx poll is done */ +napi_disable_locked (napi_tx);/* make sure current tx poll is done */ gve_unreg_xsk_pool (priv, qid);smp_mb ();/* Make sure it is visible to the workers on datapath */ -napi_enable (napi_rx); -napi_enable (napi_tx); +napi_enable_locked (napi_rx); +napi_enable_locked (napi_tx);if (gve_is_gqi (priv)) {if (gve_rx_work_pending (&priv->rx[qid]))napi_schedule (napi_rx);
Greg Kroah-Hartman
maintainerPATCH 58/621 gve: fix XSK buffer leak when rings are stopped
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Washington <[email protected]>
commit 73670ddb91a4d22e1deb3efd962242de1ec48e90 upstream.
GVE does not free XSK buffers when resetting ring state as a part of stopping queues. This causes all XSK buffers which are posted to the NIC to be leaked.
Free XSK buffers attached to an allocated buf_state when stopping rings.
This issue was hit in production.
--- drivers/net/ethernet/google/gve/gve_rx_dqo.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/ethernet/google/gve/gve_rx_dqo.c +6 -0
@@ -113,6 +113,12 @@ static void gve_rx_reset_ring_dqo(struct gve_priv *priv, int idx)gve_free_to_page_pool (rx, bs, false); elsegve_free_qpl_page_dqo (bs ); + +if (gve_buf_state_is_allocated (rx, bs) && + bs->xsk_buff) { +xsk_buff_free (bs->xsk_buff); + bs->xsk_buff =NULL ; + } } }
Signature · 1 line
2.56.0
Greg Kroah-Hartman
maintainerPATCH 59/621 gve: fix XSK buffer leak on error descriptor
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Washington <[email protected]>
commit 9fed6a8ab8a5bacba2c709cb19d2dd6d2fa9112e upstream.
When the error bit is set in the RX completion descriptor, the buf_state and its attached buffer should be freed. In the case of AF_XDP ZC, the XSK buffer was not freed, leading to a leak.
This issue was caught by LLM.
--- drivers/net/ethernet/google/gve/gve_rx_dqo.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/net/ethernet/google/gve/gve_rx_dqo.c +6 -1
@@ -818,7 +818,12 @@ static int gve_rx_dqo(struct napi_struct }if (unlikely (compl_desc->rx_error)) { -gve_free_buffer (rx, buf_state); +if (buf_state->xsk_buff) { +xsk_buff_free (buf_state->xsk_buff); +gve_free_buf_state (rx, buf_state); + }else { +gve_free_buffer (rx, buf_state); + }return -EINVAL ; }
Greg Kroah-Hartman
maintainerPATCH 60/621 ibmveth: h_free logical LAN on open-fail after register
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mingming Cao <[email protected]>
commit af0524bf4ce1a4cbd2946aa81751582951cfcab5 upstream.
ibmveth_open() registers the logical LAN, then allocates the RX buffer pools. A pool failure jumps to out_free_buffer_pools without h_free_logical_lan(), so PHYP still owns the buffer-list page when it is unmapped. request_irq() failure already issued the hypercall before taking the same label.
Move that h_free to the shared post-register unwind so both paths deregister before the buffer list is unmapped.
--- drivers/net/ethernet/ibm/ibmveth.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/net/ethernet/ibm/ibmveth.c +3 -4
@@ -718,10 +718,6 @@ static int ibmveth_open(struct net_devicif (rc !=0 ) {netdev_err (netdev,"unable to request irq 0x%x, rc %d\n" , netdev->irq, rc); -do { - lpar_rc =h_free_logical_lan (adapter->vdev->unit_address); - }while (H_IS_LONG_BUSY (lpar_rc) || (lpar_rc ==H_BUSY )); - goto out_free_buffer_pools; }
@@ -737,6 +733,9 @@ static int ibmveth_open(struct net_devicreturn 0 ; out_free_buffer_pools: +do { + lpar_rc =h_free_logical_lan (adapter->vdev->unit_address); + }while (H_IS_LONG_BUSY (lpar_rc) || (lpar_rc ==H_BUSY ));while (--i >=0 ) {if (adapter->rx_buff_pool[i].active) ibmveth_free_buffer_pool(adapter,
Greg Kroah-Hartman
maintainerPATCH 61/621 ibmveth: fix TX LTB and filter unwind on open-fail
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mingming Cao <[email protected]>
commit 84bec0bf035258a1073ffd6f6dc8ea61806aa7d4 upstream.
out_free_buffer_pools reuses open()'s loop index for the TX LTB walk. After the pool unwind i is -1, so the TX buffers allocated earlier are leaked. request_irq() failure has the same leak.
The TX-fail goto on that walk also skips dma_unmap of the filter list (pre-existing since the LTB was added). Rewrite the TX walk to real_num_tx_queues with a pointer check, and unmap the filter list before those frees.
--- drivers/net/ethernet/ibm/ibmveth.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
drivers/net/ethernet/ibm/ibmveth.c +9 -6
@@ -553,10 +553,15 @@ static int ibmveth_rxq_harvest_buffer(ststatic void ibmveth_free_tx_ltb (struct ibmveth_adapter *adapter,int idx) { +void *ptr = adapter->tx_ltb_ptr[idx]; + +if (!ptr) +return ; + + adapter->tx_ltb_ptr[idx] =NULL ;dma_unmap_single (&adapter->vdev->dev, adapter->tx_ltb_dma[idx], adapter->tx_ltb_size,DMA_TO_DEVICE ); -kfree (adapter->tx_ltb_ptr[idx]); - adapter->tx_ltb_ptr[idx] =NULL ; +kfree (ptr); }static int ibmveth_allocate_tx_ltb (struct ibmveth_adapter *adapter,int idx)
@@ -667,7 +672,7 @@ static int ibmveth_open(struct net_devicfor (i =0 ; i < netdev->real_num_tx_queues; i++) {if (ibmveth_allocate_tx_ltb (adapter, i)) - goto out_free_tx_ltb; + goto out_unmap_filter_list; } adapter->rx_queue.index =0 ;
@@ -745,10 +750,8 @@ out_unmap_filter_list:dma_unmap_single (dev, adapter->filter_list_dma,4096 ,DMA_BIDIRECTIONAL ); -out_free_tx_ltb: -while (--i >=0 ) { +for (i = netdev->real_num_tx_queues -1 ; i >=0 ; i--)ibmveth_free_tx_ltb (adapter, i); - } out_unmap_buffer_list: dma_unmap_single(dev, adapter->buffer_list_dma, 4096,
Greg Kroah-Hartman
maintainerPATCH 62/621 ice: fix use-after-free in dynamic port cleanup
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xuanqiang Luo <[email protected]>
commit 1402fc67d2f4e2e1fc7bf8ee0825b8ad994557ff upstream.
ice_dealloc_dynamic_port() uses dyn_port->vsi->idx to erase the dynamic port from pf->dyn_ports. However, it frees the VSI before reading the index for the erase, resulting in a use-after-free.
Follow the reverse of the allocation order in ice_alloc_dynamic_port() by erasing the xarray entry before freeing the VSI.
--- drivers/net/ethernet/intel/ice/devlink/port.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/intel/ice/devlink/port.c +1 -1
@@ -590,8 +590,8 @@ static void ice_dealloc_dynamic_port(strxa_erase (&pf->sf_nums, devlink_port->attrs.pci_sf.sf);ice_eswitch_detach_sf (pf, dyn_port); -ice_vsi_free (dyn_port->vsi);xa_erase (&pf->dyn_ports, dyn_port->vsi->idx); +ice_vsi_free (dyn_port->vsi);kfree (dyn_port); }
Greg Kroah-Hartman
maintainerPATCH 63/621 ice: fix metadata_dst refcount handling on representor teardown
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristan Madani <[email protected]>
commit 58858b8f14803a7eeac297b3ce20f3b21bf2ff66 upstream.
ice_eswitch_release_repr() uses metadata_dst_free() to release the representor's metadata_dst. metadata_dst_free() directly frees the underlying memory without checking the dst_entry refcount.
When ice_eswitch_port_start_xmit() processes a packet, it takes a reference via dst_hold() and attaches the metadata_dst to the skb. If the representor is torn down while packets are still queued on the lower device (e.g. in a qdisc), the metadata_dst is freed while references are still held.
Use dst_release() instead, which correctly decrements the refcount and only frees the object when all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.
Other drivers sharing this pattern (nfp, airoha, bnxt) already use dst_release() for their metadata_dst lifecycle.
--- drivers/net/ethernet/intel/ice/ice_eswitch.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/intel/ice/ice_eswitch.c +1 -1
@@ -95,7 +95,7 @@ ice_eswitch_release_repr(struct ice_pf *return ;ice_vsi_update_security (vsi, ice_vsi_ctx_set_antispoof); -metadata_dst_free (repr->dst); +dst_release (&repr->dst->dst); repr->dst =NULL ;ice_fltr_add_mac_and_broadcast (vsi, repr->parent_mac,ICE_FWD_TO_VSI );
Greg Kroah-Hartman
maintainerPATCH 64/621 keys: finalize persistent keyring timeout after link attempt
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <[email protected]>
commit 25bf14f817168079f731975b8998fc2af380f29e upstream.
When no keyring exists for the requested UID, KEYCTL_GET_PERSISTENT creates and registers one before linking it to the requested destination. The configured timeout is set only after the destination link succeeds.
A destination restricted with KEYCTL_RESTRICT_KEYRING makes that link fail with -EPERM. With persistent_keyring_expiry set to 60 seconds, /proc/keys still reports the registered keyring's expiry as "perm".
The failed call therefore leaves a quota-exempt keyring in the namespace's hidden register, where it may remain until namespace teardown.
Rename the write-locked helper to key_get_or_create_persistent() and return the key reference through a result parameter. Return 0 when it creates a keyring and 1 when the retry finds an existing one. Return a negative error on failure. Another caller may create the keyring between the initial read-locked lookup and the retry under the write lock.
Set the timeout after permission checking and linking. Do this on success, or on failure if the call allocated the keyring. This leaves a new keyring collectible after failure without starting its timeout while linking is still in progress.
--- security/keys/persistent.c | 55 ++++++++++++++++++++++++++------------------- 1 file changed, 32 insertions(+), 23 deletions(-)
security/keys/persistent.c +32 -23
@@ -33,25 +33,31 @@ static int key_create_persistent_registe }/* -* Create the persistent keyring for the specified user. +* Get or create the persistent keyring for the specified user. * * Called with the namespace's sem locked for writing. +* +* Returns a boolean indicating whether the keyring already existed, +* or a negative error. On success, *persistent_ref holds a reference +* to the keyring. */ -static key_ref_t key_create_persistent (struct user_namespace *ns,kuid_t uid, -struct keyring_index_key *index_key) +static int key_get_or_create_persistent (struct user_namespace *ns,kuid_t uid, +struct keyring_index_key *index_key, +key_ref_t *persistent_ref) {struct key *persistent; -key_ref_t reg_ref, persistent_ref; +key_ref_t reg_ref;if (!ns->persistent_keyring_register) { -long err =key_create_persistent_register (ns); +int err =key_create_persistent_register (ns); +if (err <0 ) -return ERR_PTR (err); +return err; }else { reg_ref =make_key_ref (ns->persistent_keyring_register, true); - persistent_ref =find_key_to_update (reg_ref, index_key); -if (persistent_ref) -return persistent_ref; + *persistent_ref =find_key_to_update (reg_ref, index_key); +if (*persistent_ref) +return 1 ; } persistent = keyring_alloc(index_key->description,
@@ -61,9 +67,10 @@ static key_ref_t key_create_persistent(sKEY_ALLOC_NOT_IN_QUOTA ,NULL , ns->persistent_keyring_register);if (IS_ERR (persistent)) -return ERR_CAST (persistent); +return PTR_ERR (persistent); -return make_key_ref (persistent, true); + *persistent_ref =make_key_ref (persistent, true); +return 0 ; }/*
@@ -78,6 +85,7 @@ static long key_get_persistent(struct uskey_ref_t reg_ref, persistent_ref;char buf[32 ];long ret; +bool created = false;/* Look in the register if it exists */ memset (&index_key,0 ,sizeof (index_key));
@@ -100,23 +108,24 @@ static long key_get_persistent(struct us* also need to create the register. */ down_write (&ns->keyring_sem); - persistent_ref =key_create_persistent (ns, uid, &index_key); + ret =key_get_or_create_persistent (ns, uid, &index_key, + &persistent_ref);up_write (&ns->keyring_sem); -if (!IS_ERR (persistent_ref)) - goto found; - -return PTR_ERR (persistent_ref); +if (ret <0 ) +return ret; + created = ret ==0 ; found: + persistent =key_ref_to_ptr (persistent_ref); ret =key_task_permission (persistent_ref,current_cred (),KEY_NEED_LINK ); -if (ret ==0 ) { - persistent =key_ref_to_ptr (persistent_ref); +if (ret ==0 ) ret =key_link (key_ref_to_ptr (dest_ref), persistent); -if (ret ==0 ) { -key_set_timeout (persistent, persistent_keyring_expiry); - ret = persistent->serial; - } - } + +if (ret ==0 || created) +key_set_timeout (persistent, persistent_keyring_expiry); + +if (ret ==0 ) + ret = persistent->serial;key_ref_put (persistent_ref);return ret;
Greg Kroah-Hartman
maintainerPATCH 65/621 KEYS: Fix add_key() race with keyring restriction
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: 성병찬 <[email protected]>
commit dd3ea3fcba7c75493760cdbccd35f029597e8d5e upstream.
__key_create_or_update() snapshots keyring->restrict_link before taking the destination keyring's semaphore. keyring_restrict() installs a restriction while holding that semaphore.
This allows a writer to observe no restriction, wait for the keyring owner to install a reject-all restriction and return successfully, and then link a key using the stale NULL snapshot. The writer only needs write permission on the destination keyring.
Move the restrict_link read after __key_link_lock() and __key_link_begin(). The read and the subsequent restriction check are then serialized with restriction installation by keyring->sem.
The race was reproduced on v7.2.8 in 19 executions where restriction installation returned before the link completed. All 19 linked the key despite the reject-all restriction. With this change, 312 executions reached the same ordering and every add_key() call failed with -EPERM.
The issue was found by manual concurrency analysis assisted by AI-based analysis and independently verified with a QEMU reproducer and kernel instrumentation.
--- security/keys/key.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
security/keys/key.c +3 -3
@@ -840,9 +840,6 @@ static key_ref_t __key_create_or_update(key_check (keyring); -if (!(flags &KEY_ALLOC_BYPASS_RESTRICTION )) - restrict_link = keyring->restrict_link; - key_ref =ERR_PTR (-ENOTDIR );if (keyring->type != &key_type_keyring) goto error_put_type;
@@ -880,6 +877,9 @@ static key_ref_t __key_create_or_update( goto error_link_end; } +if (!(flags &KEY_ALLOC_BYPASS_RESTRICTION )) + restrict_link = keyring->restrict_link; +if (restrict_link && restrict_link->check) { ret = restrict_link->check (keyring, index_key.type, &prep.payload, restrict_link->key);
Greg Kroah-Hartman
maintainerPATCH 66/621 memstick: core: wait for request completion before freeing card
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raj Ojha <[email protected]>
commit aa0a37b5024d921e96ac4f8f487c8bfbf1f1a582 upstream.
In memstick_alloc_card() and memstick_set_rw_addr(), wait_for_completion_timeout() is used to wait for device identification and address configuration requests to complete.
The memstick subsystem does not provide an abort or cancellation callback in struct memstick_host for in-flight requests. If wait_for_completion_timeout() expires (for instance, when a USB transfer or command retry is delayed), memstick_alloc_card() returns an error and frees the memstick_dev structure via kfree(card).
However, the host controller driver (such as rtsx_usb_ms) is still running the request asynchronously in worker context. When the transfer eventually finishes, the driver writes into host->req->data, which points to memory inside the already freed card structure. This leads to a KASAN slab-use-after-free write:
BUG: KASAN: slab-use-after-free in ms_read_bytes+0x8fe/0x990 Write of size 1 at addr ffff88813c188079 by task kworker/1:5/5239 Workqueue: events rtsx_usb_ms_handle_req Call Trace: ms_read_bytes+0x8fe/0x990 drivers/memstick/host/rtsx_usb_ms.c:450 rtsx_usb_ms_issue_cmd drivers/memstick/host/rtsx_usb_ms.c:477 [inline] rtsx_usb_ms_handle_req+0x557/0x1a00 drivers/memstick/host/rtsx_usb_ms.c:531 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560 kthread+0x373/0x450 kernel/kthread.c:436 Allocated by task 1662: memstick_alloc_card drivers/memstick/core/memstick.c:383 [inline] memstick_check+0x2c1/0x10d0 drivers/memstick/core/memstick.c:452 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396 Freed by task 1662: kfree+0x20c/0x650 mm/slub.c:6792 memstick_alloc_card drivers/memstick/core/memstick.c:420 [inline] memstick_check+0x72b/0x10d0 drivers/memstick/core/memstick.c:452 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396
Host controller drivers (rtsx_usb_ms, jmb38x_ms, tifm_ms, r592) already implement their own hardware and bus timeouts, and callers in mspro_block and ms_block already rely on wait_for_completion() unconditionally.
Replace wait_for_completion_timeout() with wait_for_completion() in memstick_set_rw_addr() and memstick_alloc_card() so that the card structure is never freed while an asynchronous request is in flight.
--- drivers/memstick/core/memstick.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
drivers/memstick/core/memstick.c +2 -6
@@ -370,9 +370,7 @@ int memstick_set_rw_addr(struct memstick { card->next_request = h_memstick_set_rw_addr;memstick_new_req (card->host); -if (!wait_for_completion_timeout (&card->mrq_complete, -msecs_to_jiffies (500 ))) - card->current_mrq.error = -ETIMEDOUT ; +wait_for_completion (&card->mrq_complete);return card->current_mrq.error; }
@@ -406,9 +404,7 @@ static struct memstick_dev *memstick_all card->next_request = h_memstick_read_dev_id;memstick_new_req (host); -if (!wait_for_completion_timeout (&card->mrq_complete, -msecs_to_jiffies (500 ))) - card->current_mrq.error = -ETIMEDOUT ; +wait_for_completion (&card->mrq_complete);if (card->current_mrq.error) goto err_out;
Greg Kroah-Hartman
maintainerPATCH 67/621 memstick: rtsx_usb_ms: complete requests after eject instead of dropping them
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nguyen Ngoc Thang <[email protected]>
commit c96ca94425b076dc398d929366e378d1e22ec794 upstream.
memstick_check() can pass its host->removing check just before rtsx_usb_ms_drv_remove() sets eject/removing. Its next request is then silently dropped: rtsx_usb_ms_request() skips schedule_work() once eject is set, and drv_remove's cancel_work_sync() can also cancel a queued handle_req before it picks the request up. Nobody completes card->mrq_complete.
Once memstick core waits for requests without a timeout ("memstick: core:
wait for request completion before freeing card"), this hangs removal:memstick_check() never returns and memstick_remove_host() blocks in flush_workqueue():
INFO: task kworker/u10:3:65 blocked for more than 20 seconds. Workqueue: kmemstick memstick_check __wait_for_common memstick_check INFO: task kworker/1:1:33 blocked for more than 20 seconds. Workqueue: usb_hub_wq hub_event __flush_workqueue memstick_remove_host rtsx_usb_ms_drv_remove
Never drop a request. rtsx_usb_ms_request() always schedules handle_req, and handle_req fails requests with -ENOMEDIUM once eject is set, without touching the device. drv_remove flushes handle_req instead of cancelling it, and cancels it only after memstick_remove_host(), when no new request can arrive, so it cannot run on a freed host.
The host_mutex drain in drv_remove is removed: handle_req always leaves host->req NULL when it finishes, so the drain never had anything to do, and it would now race with handle_req.
--- drivers/memstick/host/rtsx_usb_ms.c | 31 +++++++++++-------------------- 1 file changed, 11 insertions(+), 20 deletions(-)
drivers/memstick/host/rtsx_usb_ms.c +11 -20
@@ -27,7 +27,6 @@ struct rtsx_usb_ms {struct memstick_host *msh;struct memstick_request *req; -struct mutex host_mutex;struct work_struct handle_req;struct delayed_work poll_card;
@@ -514,6 +513,13 @@ static void rtsx_usb_ms_handle_req(strucstruct memstick_host *msh = host->msh;int rc; +/* Fail requests after eject so their waiters are released. */ +if (host->eject) { +while (!memstick_next_req (msh, &host->req)) + host->req->error = -ENOMEDIUM ; +return ; + } +if (!host->req) {pm_runtime_get_sync (ms_dev (host)); do {
@@ -547,8 +553,7 @@ static void rtsx_usb_ms_request(struct mdev_dbg (ms_dev (host),"--> %s\n" , __func__); -if (!host->eject) -schedule_work (&host->handle_req); +schedule_work (&host->handle_req); } static int rtsx_usb_ms_set_param(struct memstick_host *msh,
@@ -781,7 +786,6 @@ static int rtsx_usb_ms_drv_probe(struct host->power_mode =MEMSTICK_POWER_OFF ;platform_set_drvdata (pdev, host); -mutex_init (&host->host_mutex);INIT_WORK (&host->handle_req, rtsx_usb_ms_handle_req);INIT_DELAYED_WORK (&host->poll_card, rtsx_usb_ms_poll_card);
@@ -812,27 +816,12 @@ static void rtsx_usb_ms_drv_remove(struc {struct rtsx_usb_ms *host =platform_get_drvdata (pdev);struct memstick_host *msh = host->msh; -int err; host->eject = true; msh->removing = true; -cancel_work_sync (&host->handle_req); +flush_work (&host->handle_req);cancel_delayed_work_sync (&host->poll_card); -mutex_lock (&host->host_mutex); -if (host->req) { -dev_dbg (ms_dev (host), -"%s: Controller removed during transfer\n" , -dev_name (&msh->dev)); - host->req->error = -ENOMEDIUM ; -do { - err =memstick_next_req (msh, &host->req); -if (!err) - host->req->error = -ENOMEDIUM ; - }while (!err); - } -mutex_unlock (&host->host_mutex); -/* Balance possible unbalanced usage count * e.g. unconditional module removal */
@@ -841,6 +830,8 @@ static void rtsx_usb_ms_drv_remove(strucpm_runtime_disable (ms_dev (host));memstick_remove_host (msh); +/* No card, no new requests; wait for the last failed one to finish. */ +cancel_work_sync (&host->handle_req);dev_dbg (ms_dev (host),": Realtek USB Memstick controller has been removed\n" );memstick_free_host (msh);
Greg Kroah-Hartman
maintainerPATCH 68/621 mm: dont schedule deferred kernel page table freeing while booting
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Gavrilov <[email protected]>
commit 2fb552b0bee70c24c092720028ab4620f5eb2646 upstream.
Booting with a boot-time function tracer and a filter, for example
ftrace=function ftrace_filter=pud_free_pmd_page
panics on 7.3-rc4 as soon as the tracer starts:
[ 23.531178] Starting tracer 'function' [ 23.675800] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000038: 0000 [#1] SMP KASAN NOPTI [ 23.819917] KASAN: null-ptr-deref in range [0x00000000000001c0-0x00000000000001c7] [ 23.964025] CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 7.3.0-rc4-fe2ec83746e5-with-fixes-v2+ #195 PREEMPT(undef) [ 24.252248] RIP: 0010:__queue_work+0xab/0xf00 [ 25.981629] Call Trace: [ 26.125727] <TASK> [ 26.413912] ? pagetable_free_kernel+0x20/0x120 [ 26.990283] queue_work_on+0x97/0xf0 [ 27.134382] __cpa_collapse_large_pages+0x501/0x6f0 [ 27.566662] cpa_flush+0x394/0x620 [ 27.998953] change_page_attr_set_clr+0x321/0x4a0 [ 29.151729] set_memory_rox+0xa2/0xf0 [ 29.584018] create_trampoline+0x431/0x6f0 ... [ 44.343347] Kernel panic - not syncing: Attempted to kill the idle task!
The boot-time tracer is started from early_trace_init(), which runs before workqueue_init_early(). Making its trampoline read-only splits a large page, and CPA collapses it again right away. The split table has been a kernel page table since commit 9e4a3ec3411b ("x86/mm/pat: Allocate split page tables as kernel page tables"), so the collapse frees it through pagetable_free_kernel(), which queues work on system_percpu_wq - still NULL at that point. That commit is correct in itself; it only lets CPA reach pagetable_free_kernel() before the workqueue that function relies on exists.
Keep putting the table on the list, but don't schedule the work while the system is still booting. A core_initcall schedules it once to free whatever was queued by then.
--- mm/pgtable-generic.c | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-)
mm/pgtable-generic.c +19 -1
@@ -436,12 +436,30 @@ static void kernel_pgtable_work_func(str __pagetable_free(pt); } +static void schedule_kernel_pgtable_free (void ) +{ +schedule_work (&kernel_pgtable_work.work); +} +void pagetable_free_kernel (struct ptdesc *pt) {spin_lock (&kernel_pgtable_work.lock);list_add (&pt->pt_list, &kernel_pgtable_work.list);spin_unlock (&kernel_pgtable_work.lock); -schedule_work (&kernel_pgtable_work.work); +/* +* The workqueue may not exist yet while the system is booting. +* kernel_pgtable_drain_early() schedules the work once it does. +*/ +if (system_state !=SYSTEM_BOOTING ) +schedule_kernel_pgtable_free (); +} + +static int __init kernel_pgtable_drain_early (void ) +{ +/* Free the kernel page tables queued while booting. */ +schedule_kernel_pgtable_free (); +return 0 ; } +core_initcall (kernel_pgtable_drain_early);#endif
Greg Kroah-Hartman
maintainerPATCH 69/621 dm-crypt: reject the lmk IV mode with AEAD ciphers
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Cressey <[email protected]>
commit 3195e0daf590683992edb4eed32269e569e04924 upstream.
A "capi:" table line that pairs an AEAD cipher with the lmk IV mode, for example "capi:gcm(aes)-lmk" with the integrity:28:aead option, causes an oops when it is loaded. lmk sets tfms_count to 64, but crypt_alloc_tfms_aead only allocates one transform, so crypt_setkey reads past the end of the tfms_aead array and calls crypto_aead_setkey on the values it finds there.
lmk exists for compatibility with Loop-AES, which uses CBC, so refuse it with an AEAD cipher rather than allocate 64 AEAD transforms. The check cannot go in crypt_iv_lmk_ctr with the other lmk checks, because the IV constructor runs after crypt_set_key.
Note that this is not a security bug because the memory corruption can only be triggered by root.
--- drivers/md/dm-crypt.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/md/dm-crypt.c +6 -1
@@ -2974,8 +2974,13 @@ static int crypt_ctr_cipher_new(struct d } } -if (*ivmode && !strcmp (*ivmode,"lmk" )) +if (*ivmode && !strcmp (*ivmode,"lmk" )) { +if (crypt_integrity_aead (cc)) { + ti->error ="AEAD transforms not supported for LMK" ; +return -EINVAL ; + } cc->tfms_count =64 ; + }if (*ivmode && !strcmp (*ivmode,"essiv" )) {if (!*ivopts) {
Greg Kroah-Hartman
maintainerPATCH 70/621 dm-integrity: fix buffer overflow in inline mode with large tag size
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Cressey <[email protected]>
commit 764b683a6180fd72c931c13fea98d383506a3475 upstream.
In inline mode, dm_integrity_check and dm_integrity_inline_recheck compute the checksum of each block into an on-stack buffer of HASH_MAX_DIGESTSIZE bytes. integrity_sector_checksum pads its result with zeroes up to the tag size, so if the tag size is larger than HASH_MAX_DIGESTSIZE, the padding runs past the end of the buffer. With CONFIG_STACKPROTECTOR the kernel panics in dm_integrity_check on the first read.
Enlarge both buffers to hold MAX_TAG_SIZE bytes, as commit b93b6643e9b5 ("dm integrity: fix a crash with unusually large tag size") did for integrity_metadata.
Note that this is not a security bug because the buffer overflow can only be triggered by root.
--- drivers/md/dm-integrity.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/md/dm-integrity.c +2 -2
@@ -2720,7 +2720,7 @@ static void dm_integrity_inline_recheck( outgoing_data = dio->integrity_payload +PAGE_SIZE ;while (dio->bio_details.bi_iter.bi_size) { -char digest[HASH_MAX_DIGESTSIZE ]; +char digest[MAX_T (size_t,HASH_MAX_DIGESTSIZE ,MAX_TAG_SIZE )];int r;struct bio_integrity_payload *bip;struct bio_vec bv;
@@ -2787,7 +2787,7 @@ static inline bool dm_integrity_check(stunsigned pos =0 ;while (dio->bio_details.bi_iter.bi_size) { -char digest[HASH_MAX_DIGESTSIZE ]; +char digest[MAX_T (size_t,HASH_MAX_DIGESTSIZE ,MAX_TAG_SIZE )];struct bio_vec bv =bio_iter_iovec (bio, dio->bio_details.bi_iter);char *mem =integrity_kmap (ic, bv.bv_page);integrity_sector_checksum (ic, &dio->ahash_req, dio->bio_details.bi_iter.bi_sector, mem, bv.bv_offset, digest);
Greg Kroah-Hartman
maintainerPATCH 71/621 dm-snap: reject the transient exception store for snapshot-merge
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Xinmeng <[email protected]>
commit fcbde6227fcc53c73f08c56b2539e462d545cac6 upstream.
snapshot_merge_next_chunks() calls s->store->type->prepare_merge() without checking it. The transient store ("N") implements neither prepare_merge nor commit_merge, and snapshot_ctr() validates those callbacks only on the handover path (__validate_exception_handover()), so a directly constructed snapshot-merge calls a NULL prepare_merge on resume:
snapshot_merge_resume -> snapshot_merge_next_chunks -> prepare_merge(...)
commit_merge() is NULL for the same reason. Userspace only issues documented device-mapper ioctls (CAP_SYS_ADMIN); this is a misconfiguration the kernel must reject rather than oops on.
Reject the combination in snapshot_ctr() at table-load time (-EINVAL), the same check the handover path already performs; this also covers the commit_merge() call site, which a guard local to the prepare_merge call would miss.
Tested on Linux v6.6.157 KASAN: unpatched, the dmsetup reproducer oopses in snapshot_merge_next_chunks(); with this patch, the table load fails with -EINVAL and no oops. Also present on v6.6.145; still present on the linux-dm tree (555f3d7be91a) and on torvalds/linux master (62f4c998b297) as of 2026-09-22.
Note that this is not a security bug because only root can trigger it.
--- drivers/md/dm-snap.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/md/dm-snap.c +14 -0
@@ -1298,6 +1298,20 @@ static int snapshot_ctr(struct dm_target goto bad_store; } +/* +* snapshot-merge requires the optional prepare_merge/commit_merge +* callbacks; the transient exception store does not implement them. +* The handover path checks this in __validate_exception_handover(), +* but a directly constructed snapshot-merge never goes through it. +*/ +if (dm_target_is_snapshot_merge (ti) && + (!s->store->type->prepare_merge || + !s->store->type->commit_merge)) { + ti->error ="Snapshot exception store does not support snapshot-merge." ; + r = -EINVAL ; + goto bad_hash_tables; + } + argv += args_used; argc -= args_used;
Greg Kroah-Hartman
maintainerPATCH 72/621 dm: fix reading free memory in do_resume
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
commit c9417c1c5269e2bd0570fbe53e4ec03a8d31f008 upstream.
When do_resume calls dm_table_get_mode(new_map), the call is done without holding any locks (it only holds a reference to the md). It may be possible that another concurrent ioctl on the same device will swap table after dm_swap_table and before dm_table_get_mode. In this case, dm_table_get_mode(new_map) reads freed memory.
This race condition was triggered by syzbot.
This commit fixes the race by reading mode of the new table before dm_swap_table. Note that new_map is also passed to dm_ima_need_measure, but this function doesn't attempt to dereference it, so this call should be safe.
Note that this is not a security bug because only root can trigger it and the commonly used tools such as lvm or cryptsetup do not call the ioctls concurrently, so that they can't trigger it acceidentally.
--- drivers/md/dm-ioctl.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/md/dm-ioctl.c +3 -1
@@ -1181,6 +1181,7 @@ static int do_resume(struct dm_ioctl *pa/* Do we need to load a new map ? */ if (new_map) {sector_t old_size, new_size; +blk_mode_t new_map_mode;/* Suspend if it isn't already suspended */ if (param->flags &DM_SKIP_LOCKFS_FLAG )
@@ -1208,6 +1209,7 @@ static int do_resume(struct dm_ioctl *pa } } + new_map_mode =dm_table_get_mode (new_map); old_size =dm_get_size (md); old_map =dm_swap_table (md, new_map);if (IS_ERR (old_map)) {
@@ -1220,7 +1222,7 @@ static int do_resume(struct dm_ioctl *paif (old_size && new_size && old_size != new_size) need_resize_uevent = true; -if (dm_table_get_mode (new_map) &BLK_OPEN_WRITE ) +if (new_map_mode &BLK_OPEN_WRITE )set_disk_ro (dm_disk (md),0 );else set_disk_ro (dm_disk (md),1 );
Greg Kroah-Hartman
maintainerPATCH 73/621 mmc: cavium-octeon: destroy slot platform devices on remove
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <[email protected]>
commit 0f4d4424fc1d651ec3fa63a0a8060ba9087eb0ec upstream.
octeon_mmc_probe() creates host->slot_pdev[i] with of_platform_device_create(), while octeon_mmc_remove() does not destroy the child platform devices.
The probe failure path removes each MMC slot and destroys its associated platform device, but the normal remove path only removes the MMC slot. As a result, the child platform devices remain registered after the Octeon MMC controller is removed.
Destroy each slot platform device during removal after cleaning up the corresponding MMC slot, matching the probe failure cleanup path.
This issue was found by manual code inspection.
--- drivers/mmc/host/cavium-octeon.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/mmc/host/cavium-octeon.c +4 -1
@@ -302,9 +302,12 @@ static void octeon_mmc_remove(struct plau64 dma_cfg;int i; -for (i =0 ; i <CAVIUM_MAX_MMC ; i++) +for (i =0 ; i <CAVIUM_MAX_MMC ; i++) {if (host->slot[i])cvm_mmc_of_slot_remove (host->slot[i]); +if (host->slot_pdev[i]) +of_platform_device_destroy (&host->slot_pdev[i]->dev,NULL ); + } dma_cfg =readq (host->dma_base +MIO_EMM_DMA_CFG (host)); dma_cfg &= ~MIO_EMM_DMA_CFG_EN ;
Greg Kroah-Hartman
maintainerPATCH 74/621 mmc: cavium-thunderx: destroy slot platform devices on remove
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <[email protected]>
commit 29ee8cf18a21b02cd0b2e35f741b61cd1fe3e14e upstream.
thunder_mmc_probe() creates host->slot_pdev[i] with of_platform_device_create(), while thunder_mmc_remove() does not destroy the child platform devices.
The probe failure path removes each MMC slot and destroys its associated platform device, but the normal remove path only removes the MMC slot. As a result, the child platform devices remain registered after the ThunderX MMC controller is removed.
Destroy each slot platform device during removal after cleaning up the corresponding MMC slot, matching the probe failure cleanup path. Keep an extra device reference around of_platform_device_destroy() as done in the existing error path.
This issue was found by manual code inspection.
--- drivers/mmc/host/cavium-thunderx.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/mmc/host/cavium-thunderx.c +4 -1
@@ -173,9 +173,12 @@ static void thunder_mmc_remove(struct pcu64 dma_cfg;int i; -for (i =0 ; i <CAVIUM_MAX_MMC ; i++) +for (i =0 ; i <CAVIUM_MAX_MMC ; i++) {if (host->slot[i])cvm_mmc_of_slot_remove (host->slot[i]); +if (host->slot_pdev[i]) +of_platform_device_destroy (&host->slot_pdev[i]->dev,NULL ); + } dma_cfg =readq (host->dma_base +MIO_EMM_DMA_CFG (host)); dma_cfg &= ~MIO_EMM_DMA_CFG_EN ;
Greg Kroah-Hartman
maintainerPATCH 75/621 mmc: mtk-sd: Cancel request timeout work on remove
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yibo Tan <[email protected]>
commit b38af5386a74416e898955443f2e26547b358cb2 upstream.
The driver queues req_timeout while a request is active. msdc_request_done() uses cancel_delayed_work(), which does not wait for a timeout callback that has already started.
The timeout callback calls mmc_request_done(), which wakes the request waiter, and then continues to use host->dev_comp and check the SDIO IRQ. During unbind, msdc_drv_remove() can return and the managed mmc_host can be freed before the callback finishes.
KASAN reported use-after-free accesses in msdc_request_done() and msdc_recheck_sdio_irq() in each of three unbind tests. The same tests completed without a kernel diagnostic after this change.
Call cancel_delayed_work_sync() after mmc_remove_host() has stopped new requests and before the driver releases the host resources.
--- drivers/mmc/host/mtk-sd.c | 1 + 1 file changed, 1 insertion(+)
drivers/mmc/host/mtk-sd.c +1 -0
@@ -3194,6 +3194,7 @@ static void msdc_drv_remove(struct platfplatform_set_drvdata (pdev,NULL );mmc_remove_host (mmc); +cancel_delayed_work_sync (&host->req_timeout);msdc_deinit_hw (host);msdc_gate_clock (host);
Greg Kroah-Hartman
maintainerPATCH 76/621 mmc: sdhci-sprd: disable runtime PM on remove
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <[email protected]>
commit e1c6c10a6a70a69e29b04fcc1ebe4b9bcbc7a49a upstream.
sdhci_sprd_probe() enables runtime PM, while sdhci_sprd_remove() does not perform the corresponding runtime PM cleanup.
The probe failure path disables runtime PM before disabling the clocks, but the normal remove path directly disables clocks that are also managed by the runtime PM callbacks. If the device is runtime suspended, those clocks may already be disabled.
Resume the device before removal, disable runtime PM and drop the temporary runtime PM reference before disabling the clocks.
This issue was found by manual code inspection.
--- drivers/mmc/host/sdhci-sprd.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/mmc/host/sdhci-sprd.c +4 -0
@@ -890,6 +890,10 @@ static void sdhci_sprd_remove(struct plastruct sdhci_host *host =platform_get_drvdata (pdev);struct sdhci_sprd_host *sprd_host =TO_SPRD_HOST (host); +pm_runtime_get_sync (&pdev->dev); +pm_runtime_disable (&pdev->dev); +pm_runtime_put_noidle (&pdev->dev); +sdhci_remove_host (host,0 );clk_disable_unprepare (sprd_host->clk_sdio);
Greg Kroah-Hartman
maintainerPATCH 77/621 net/packet: guard the ll header push in packet_rcv_spkt()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quchaosheng <[email protected]>
commit 28bc1ef699610ee09ce3d46a00552f5a0a0144bd upstream.
packet_rcv_spkt() restores the link layer header with
skb_push(skb, skb->data - skb_mac_header(skb));
That subtraction is only meaningful when the device actually has a link layer header. packet_rcv() and tpacket_rcv() both wrap it in dev_has_header(), which is also the predicate the block comment at the top of the file states the restore in terms of; packet_rcv_spkt() does not. commit d549699048b4 ("net/packet: fix packet receive on L3 devices without visible hard header") introduced the helper and changed the two call sites, and this one stayed behind.
A device without a visible ll header can leave skb->mac_header at the 0xFFFF sentinel that __alloc_skb() initialises it to. A CAN skb does:init_can_skb() sets pkt_type and ip_summed but does not reset the headers, and commit 9f10374bb024 ("can: remove private CAN skb headroom infrastructure") dropped the skb_reset_*_header() calls that used to be there. skb_mac_header() is then 0xFFFF, the length becomes a large negative number and skb_push() reports it through skb_under_panic() -- from softirq context, so it is a full system panic even with panic_on_oops=0:
skbuff: skb_under_panic: text:ffffffff8bd21bc1 len:-65455 put:-65471 head:... data:... tail:0x50 end:0x180 dev:can0 kernel BUG at net/core/skbuff.c:214!
RIP: 0010:skb_panic+0x50/0x60 Call Trace: <IRQ> skb_push+0x38/0x40 packet_rcv_spkt+0xe1/0x170 __netif_receive_skb_core.constprop.0+0x7e8/0xd30 ... Kernel panic - not syncing: Fatal exception in interrupt
The socket type is reachable: packet_create() accepts SOCK_PACKET alongside SOCK_RAW and SOCK_DGRAM behind the same CAP_NET_RAW check, and neither the socket length nor a capability check keeps it away from a CAN interface.
The missing skb_reset_*_header() calls in init_can_skb() are a regression in their own right and are being fixed separately, but a packet socket should not turn a link layer that did not initialise its mac header into a kernel panic. Guard the push the way the other two receive paths do.
Tested on v7.3-rc5 under QEMU with a slcan device on a pty, which is the driver RX path: vcan does not reproduce it, because can_send() resets the headers on the way out. One SOCK_PACKET socket bound to can0 and one frame written into the line discipline panics an unpatched kernel with the trace above; the same image with this patch prints no panic and powers off normally. Both kernels are this tree, defconfig plus CONFIG_CAN_SLCAN=y, differing only in this hunk.
--- net/packet/af_packet.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/packet/af_packet.c +2 -1
@@ -1910,7 +1910,8 @@ static int packet_rcv_spkt(struct sk_buf spkt = &PACKET_SKB_CB (skb)->sa.pkt; -skb_push (skb, skb->data -skb_mac_header (skb)); +if (dev_has_header (dev)) +skb_push (skb, skb->data -skb_mac_header (skb));/* * The SOCK_PACKET socket receives _all_ frames.
Greg Kroah-Hartman
maintainerPATCH 78/621 net/smc: protect clcsock lifetime in smc_getname
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengfeng Ye <[email protected]>
commit 64a6b36b0e1855288080bc5f89769f27d6dc03c8 upstream.
smc_getname() dereferences smc->clcsock without holding clcsock_release_lock. Link-group termination can release the CLC socket through smc_close_active_abort() while the SMC socket is still open, for example after shutdown(SHUT_WR).
A getsockname() caller can load smc->clcsock, then the termination worker can clear the pointer and call sock_release() before the caller accesses clcsock->ops or invokes getname(). This causes a use-after-free; if the worker clears the pointer before the load, it causes a NULL dereference. The syscall's file reference keeps the SMC socket alive but does not prevent asynchronous release of its CLC socket.
KASAN reported the following with test-only timing instrumentation:
BUG: KASAN: slab-use-after-free in smc_getname+0x19e/0x1b0 Read of size 8 at addr ffff888109abb4e0 by task poc/103 Call Trace: smc_getname+0x19e/0x1b0 do_getsockname+0xe5/0x170 __sys_getsockname+0x8c/0x100 Allocated by task 95: sock_alloc_inode+0x1e/0x280 sock_alloc+0x3d/0x240 __sock_create+0x7e/0x430 smc_create+0x121/0x240 Freed by task 0: kmem_cache_free+0xcc/0x340 rcu_core+0x50a/0x1850 Last potentially related work creation: evict+0x446/0x6c0 smc_clcsock_release+0xa8/0xd0 smc_close_active_abort+0x26a/0x3a0 __smc_lgr_terminate.part.0+0x137/0x2e0
Hold clcsock_release_lock across the pointer check and the getname() callback to serialize with smc_clcsock_release(). Return -EBADF if the CLC socket has already been released, preserving the existing peer state check and the callback's return value otherwise.
--- net/smc/af_smc.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
net/smc/af_smc.c +6 -1
@@ -2788,6 +2788,7 @@ int smc_getname(struct socket *sock, str int peer) {struct smc_sock *smc; +int rc = -EBADF ;if (peer && (sock->sk->sk_state !=SMC_ACTIVE ) && (sock->sk->sk_state !=SMC_APPCLOSEWAIT1 ))
@@ -2795,7 +2796,11 @@ int smc_getname(struct socket *sock, str smc =smc_sk (sock->sk); -return smc->clcsock->ops->getname (smc->clcsock, addr, peer); +mutex_lock (&smc->clcsock_release_lock); +if (smc->clcsock) + rc = smc->clcsock->ops->getname (smc->clcsock, addr, peer); +mutex_unlock (&smc->clcsock_release_lock); +return rc; }int smc_sendmsg (struct socket *sock,struct msghdr *msg,size_t len)
Greg Kroah-Hartman
maintainerPATCH 79/621 net: bridge: avoid recursive multicast port cleanup
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zixuan Chai <[email protected]>
commit 5158353121bae4f552cb677ce8c5c3ef52f93a0d upstream.
br_multicast_sg_del_exclude_ports() removes automatically added STAR_EXCL port groups by calling br_multicast_del_pg(). For S,G entries, that deletion calls back into br_multicast_sg_del_exclude_ports(), so a large number of STAR_EXCL ports consumes one kernel stack frame per port and can hit the stack guard page.
Keep the complete port-group deletion path for cleanup, but suppress the S,G exclude-port cleanup while that helper is already walking the same entry. Normal deletion callers retain the existing behavior.
--- net/bridge/br_multicast.c | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-)
net/bridge/br_multicast.c +18 -5
@@ -81,6 +81,10 @@ __br_multicast_add_group(struct net_brid bool blocked);static void br_multicast_find_del_pg (struct net_bridge *br,struct net_bridge_port_group *pg); +static void __br_multicast_del_pg (struct net_bridge_mdb_entry *mp, +struct net_bridge_port_group *pg, +struct net_bridge_port_group __rcu **pp, +bool sg_del_exclude_ports);static void __br_multicast_stop (struct net_bridge_mcast *brmctx); static int br_mc_disabled_update(struct net_device *dev, bool value,
@@ -458,7 +462,7 @@ static void br_multicast_sg_del_exclude_for (pp = &sgmp->ports; (p =mlock_dereference (*pp, sgmp->br)) !=NULL ;) {if (!(p->flags &MDB_PG_FLAGS_PERMANENT )) -br_multicast_del_pg (sgmp, p, pp); +__br_multicast_del_pg (sgmp, p, pp, false);else pp = &p->next; }
@@ -799,9 +803,10 @@ static void br_multicast_destroy_port_grkfree_rcu (pg, rcu); } -void br_multicast_del_pg (struct net_bridge_mdb_entry *mp, -struct net_bridge_port_group *pg, -struct net_bridge_port_group __rcu **pp) +static void __br_multicast_del_pg (struct net_bridge_mdb_entry *mp, +struct net_bridge_port_group *pg, +struct net_bridge_port_group __rcu **pp, +bool sg_del_exclude_ports) {struct net_bridge *br = pg->key.port->br;struct net_bridge_group_src *ent;
@@ -816,7 +821,8 @@ void br_multicast_del_pg(struct net_bridif (!br_multicast_is_star_g (&mp->addr)) {rhashtable_remove_fast (&br->sg_port_tbl, &pg->rhnode, br_sg_port_rht_params); -br_multicast_sg_del_exclude_ports (mp); +if (sg_del_exclude_ports) +br_multicast_sg_del_exclude_ports (mp); }else {br_multicast_star_g_handle_mode (pg,MCAST_INCLUDE ); }
@@ -828,6 +834,13 @@ void br_multicast_del_pg(struct net_bridmod_timer (&mp->timer, jiffies); } +void br_multicast_del_pg (struct net_bridge_mdb_entry *mp, +struct net_bridge_port_group *pg, +struct net_bridge_port_group __rcu **pp) +{ +__br_multicast_del_pg (mp, pg, pp, true); +} +static void br_multicast_find_del_pg (struct net_bridge *br,struct net_bridge_port_group *pg) {
Greg Kroah-Hartman
maintainerPATCH 80/621 net: dsa: microchip: fix KSZ8765 fiber detection
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastien Royen <[email protected]>
commit fc13ba44da197a186f2f4d77c5b7d73d0f99f053 upstream.
The KSZ8765 is similar to the KSZ8795 but has two fiber ports.
KSZ8_PORT_STATUS_0 is used to detect fiber mode. It is currently defined as 0x08, which is the Global Control 6 MIB Control register and has bit 7 defined as Flush Counter.
Set KSZ8_PORT_STATUS_0 to 0x18, which is the Port 1 Status 0 register where bit 7 is the Fiber Mode bit.
This issue was discovered when upgrading an embedded device from kernel 5.10 to 6.16. The device was using a KSZ8765 device tree configuration and the corresponding hardware, but during boot the kernel incorrectly detected it as a KSZ8795. The relevant boot messages were:
ksz-switch spi0.0: found switch: KSZ8795, rev 0
ksz-switch spi0.0: Device tree specifies chip KSZ8765 but found KSZ8795, please fix it!
--- drivers/net/dsa/microchip/ksz_common.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/microchip/ksz_common.h +1 -1
@@ -775,7 +775,7 @@ static inline bool ksz_is_sgmii_port(str#define KSZ88_FAMILY_ID 0x88#define KSZ8895_FAMILY_ID 0x95 -#define KSZ8_PORT_STATUS_0 0x08 +#define KSZ8_PORT_STATUS_0 0x18#define KSZ8_PORT_FIBER_MODE BIT(7)#define SW_CHIP_ID_M GENMASK(7, 4)
Greg Kroah-Hartman
maintainerPATCH 81/621 net: skbuff: dont leave stale bytes in skb_copy_and_csum_bits()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <[email protected]>
commit ab9414ed70bd783e902a85c350620dee269bcb2b upstream.
When skb_copy_and_csum_bits() reaches unreadable frags it returns 0 after copying only the linear part, and the rest of the caller's buffer is left as it was. The callers copy into a buffer that is about to go out on the wire: an ICMP error quoting the offending packet, or a driver's TX bounce buffer in skb_copy_and_csum_dev(). Neither buffer is zeroed beforehand, so whatever was in memory there gets sent.
Zero the part of the buffer we didn't fill. The checksum usually won't match the data any more, so the receiver will usually drop the packet, but either way it no longer carries anything it shouldn't. Only zero for a positive @len, a negative one from a broken caller must not turn into a huge memset().
--- net/core/skbuff.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
net/core/skbuff.c +5 -1
@@ -3582,8 +3582,12 @@ __wsum skb_copy_and_csum_bits(const stru pos = copy; } -if (!skb_frags_readable (skb)) +if (!skb_frags_readable (skb)) { +/* Don't hand the caller a buffer with stale bytes in it. */ +if (len >0 ) +memset (to,0 , len);return 0 ; + }for (i =0 ; i <skb_shinfo (skb)->nr_frags; i++) {int end;
Greg Kroah-Hartman
maintainerPATCH 82/621 net: sparx5: free the matchall entry on destroy
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Machon <[email protected]>
commit 2b82e16d6084cbc651e3c902198f1945408ee1a5 upstream.
sparx5_tc_matchall_replace() allocates a struct sparx5_mall_entry for every offloaded matchall filter and adds it to sparx5->mall_entries. sparx5_tc_matchall_destroy() removes the entry from the list, but never frees it, so the entry of every deleted mirror and goto matchall filter is leaked.
Free the entry after unlinking it.
The leak was discovered by an AI code review agent, and reproduced with kmemleak on a lan969x EV board (EV23X71A) by repeatedly adding and deleting matchall mirror and goto filters. With the fix, kmemleak no longer reports the leak.
--- drivers/net/ethernet/microchip/sparx5/sparx5_tc_matchall.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/microchip/sparx5/sparx5_tc_matchall.c +1 -0
@@ -160,6 +160,7 @@ static int sparx5_tc_matchall_destroy(st }list_del (&entry->list); +kfree (entry);return err; }
Greg Kroah-Hartman
maintainerPATCH 83/621 net: usb: ax88179_178a: fix rx frame length for non-last packets
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fredrik Nyberg <[email protected]>
commit 9b6c20f788472d2042717a3c2f1bc60b2b77083e upstream.
Commit 4ce62d5b2f7a ("net: usb: ax88179_178a: stop lying about skb->truesize") replaced skb_clone() with a copy into a new skb for every packet of a bulk-in transfer except the last one. The copy skips the 2-byte IP alignment pseudo header but still copies pkt_len bytes, and pkt_len includes that header. Each of these frames is therefore delivered with two extra trailing bytes: the 0xeeee pseudo header of the next slot when the frame ends on an 8-byte boundary, or slot padding otherwise. The last packet is still trimmed to pkt_len - 2.
IPv4 and IPv6 trim the extra bytes, so most traffic is unaffected. Anything that relies on the frame length is not. MACsec takes the ICV from the last 16 bytes and drops every such frame as InPktsNotValid. In our setup that was 0.2-1.2% of received MACsec frames, depending on how many frames shared a transfer, including service discovery multicast.
Allocate and copy pkt_len - 2 bytes, like the last-packet path.
--- drivers/net/usb/ax88179_178a.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/usb/ax88179_178a.c +3 -3
@@ -1463,11 +1463,11 @@ static int ax88179_rx_fixup(struct usbnereturn 1 ; } - ax_skb =netdev_alloc_skb_ip_align (dev->net, pkt_len); + ax_skb =netdev_alloc_skb_ip_align (dev->net, pkt_len -2 );if (!ax_skb)return 0 ; -skb_put (ax_skb, pkt_len); -memcpy (ax_skb->data, skb->data +2 , pkt_len); +skb_put (ax_skb, pkt_len -2 ); +memcpy (ax_skb->data, skb->data +2 , pkt_len -2 );ax88179_rx_checksum (ax_skb, pkt_hdr);usbnet_skb_return (dev, ax_skb);
Greg Kroah-Hartman
maintainerPATCH 84/621 net: team: stop reusing skb after queue override
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <[email protected]>
commit b7454f1940c5e6d92e753853c476a769e452f30a upstream.
A nonzero dev_queue_xmit() result does not return ownership of the skb. When an override port's qdisc drops it, the queue override helper used to try another port or the mode transmit op with the freed skb.
Return the handoff decision separately from transmit success. Select only the first override port under RCU and stop after handing it the skb, regardless of the lower transmit result. Keep the existing success and drop accounting.
BUG: KASAN: slab-use-after-free in sk_skb_reason_drop Write of size 4 by task poc/5040 sk_skb_reason_drop (net/core/skbuff.c:1240) dev_kfree_skb_any_reason (net/core/dev.c:3470) ab_transmit (drivers/net/team/team_mode_activebackup.c:49) team_xmit (drivers/net/team/team_core.c:1849) __dev_direct_xmit (net/core/dev.c:4934) Freed by task 5040: __tcf_kfree_skb_list (net/sched/sch_generic.c:43) __dev_queue_xmit (net/core/dev.c:4831) team_xmit (drivers/net/team/team_core.c:1846) Kernel panic - not syncing: KASAN: panic_on_warn set ...
--- drivers/net/team/team_core.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/net/team/team_core.c +8 -8
@@ -822,7 +822,8 @@ static struct list_head *__team_get_qom_/* * note: already called with rcu_read_lock */ -static bool team_queue_override_transmit (struct team *team,struct sk_buff *skb) +static bool team_queue_override_transmit (struct team *team,struct sk_buff *skb, +bool *tx_success) {struct list_head *qom_list;struct team_port *port;
@@ -830,11 +831,11 @@ static bool team_queue_override_transmitif (!team->queue_override_enabled || !skb->queue_mapping)return false; qom_list =__team_get_qom_list (team, skb->queue_mapping); -list_for_each_entry_rcu (port, qom_list, qom_list) { -if (!team_dev_queue_xmit (team, port, skb)) -return true; - } -return false; + port = list_first_or_null_rcu(qom_list, struct team_port, qom_list); +if (!port) +return false; + *tx_success = !team_dev_queue_xmit (team, port, skb); +return true; } static void __team_queue_override_port_del(struct team *team,
@@ -1700,8 +1701,7 @@ static netdev_tx_t team_xmit(struct sk_bbool tx_success;unsigned int len = skb->len; - tx_success =team_queue_override_transmit (team, skb); -if (!tx_success) +if (!team_queue_override_transmit (team, skb, &tx_success)) tx_success =READ_ONCE (team->ops.transmit)(team, skb);if (tx_success) {struct team_pcpu_stats *pcpu_stats;
Greg Kroah-Hartman
maintainerPATCH 85/621 net: team: free skb when broadcast has no txable port
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <[email protected]>
commit 489114c9ecae44e523361a4b3e610ee5ebd9189c upstream.
bc_transmit() sends the original skb through the last txable port. When no port is txable, it returns false without consuming the skb, but team_xmit() still returns NETDEV_TX_OK. AF_PACKET sends then retain the skb and its socket write-memory charge.
A TX-enabled, link-down port keeps the broadcast transmit op installed. Carrier can stay up through a second link-up, TX-disabled port or be forced on by userspace. Free the original skb on the no-port path while leaving the existing drop accounting intact.
Discovered by Sashiko during review of previous commit.
--- drivers/net/team/team_mode_broadcast.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/team/team_mode_broadcast.c +2 -0
@@ -37,6 +37,8 @@ static bool bc_transmit(struct team *tea ret = !team_dev_queue_xmit (team, last, skb);if (!sum_ret) sum_ret = ret; + }else { +dev_kfree_skb_any (skb); }return sum_ret; }
Greg Kroah-Hartman
maintainerPATCH 86/621 nvme: fix swapped ZRASF zone state values for full and read only
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Bonde Torp <[email protected]>
commit 564e46d9f6e87912effa03f123d37a511d520f09 upstream.
The Zone Management Receive command Zone Receive Action Specific (ZRASF) reporting option values for the Full and Read Only zone states are swapped compared to the NVM Express Zoned Namespace Command Set Specification, Revision 1.5, Figure 35:
- 5h lists the zones in the ZSF:Full state.
- 6h lists the zones in the ZSRO:Read Only state.
The nvmet ZNS backend uses these constants to map the ZRASF value received from the host to a block layer zone condition when filtering zones in Report Zones. Because of the swap, a host asking for full zones was given the read only zones, and a host asking for read only zones was given the full zones.
Swap the values of NVME_ZRASF_ZONE_STATE_FULL and NVME_ZRASF_ZONE_STATE_READONLY to match the specification.
--- include/linux/nvme.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/linux/nvme.h +2 -2
@@ -1255,8 +1255,8 @@ enum {NVME_ZRASF_ZONE_STATE_IMP_OPEN =0x02 ,NVME_ZRASF_ZONE_STATE_EXP_OPEN =0x03 ,NVME_ZRASF_ZONE_STATE_CLOSED =0x04 , -NVME_ZRASF_ZONE_STATE_READONLY =0x05 , -NVME_ZRASF_ZONE_STATE_FULL =0x06 , +NVME_ZRASF_ZONE_STATE_FULL =0x05 , +NVME_ZRASF_ZONE_STATE_READONLY =0x06 ,NVME_ZRASF_ZONE_STATE_OFFLINE =0x07 , NVME_REPORT_ZONE_PARTIAL = 1, };
Greg Kroah-Hartman
maintainerPATCH 87/621 openvswitch: fix soft lockup in the netlink flow dump
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis V. Lunev <[email protected]>
commit aaaaf87ea99b8766c9a8aa0e71aa42e6bc8a5320 upstream.
A production compute node carrying a few thousand datapath flows hit a soft lockup inside a single netlink flow dump and panicked.
ovs_flow_cmd_dump() calls ovs_flow_stats_get() for every flow it emits, and that releases stats->lock with spin_unlock_bh() once per CPU that has touched the flow. Every release is a local_bh_enable(), and each one runs the pending softirq backlog in the dumping thread's own context.
The skb bounds the flows one callback emits, but not the softirq work it absorbs. On a CPU that carries the box's packet load the backlog refills as fast as it drains, so the dumping thread becomes that CPU's softirq engine. It never sleeps and it has no reschedule point, so under voluntary preemption nothing can take the CPU away from it:
neither the ksoftirqd the kernel woke to take the work over, nor the stopper thread the softlockup detector dispatches to refresh its timestamp.
Hold BH off across the whole callback instead, the way ctnetlink_dump_table() does, so the nested spin_unlock_bh() stop draining softirqs. The loop already runs under rcu_read_lock() and cannot sleep. What it gives up is preemption under CONFIG_PREEMPT, since a BH-off region is not preemptible outside PREEMPT_RT. The region stays short: the skb caps the flows one callback emits, and empty buckets cost no skb space but are each visited once per dump, as the cursor only moves forward. The table grows on insert and shrinks only on flush, so the walk is bounded by the largest flow count the datapath has held. The softirq backlog the callback used to absorb has no bound at all.
--- net/openvswitch/datapath.c | 8 ++++++++ 1 file changed, 8 insertions(+)
net/openvswitch/datapath.c +8 -0
@@ -1529,6 +1529,12 @@ static int ovs_flow_cmd_dump(struct sk_breturn -ENODEV ; } +/* +* Not needed for safety. Stops every spin_unlock_bh() in +* ovs_flow_stats_get() from running the softirq backlog. +*/ +local_bh_disable (); + ti =rcu_dereference (dp->table.ti);for (;;) {struct sw_flow *flow;
@@ -1549,6 +1555,8 @@ static int ovs_flow_cmd_dump(struct sk_b cb->args[0 ] = bucket; cb->args[1 ] = obj; } + +local_bh_enable ();rcu_read_unlock ();return skb->len; }
Greg Kroah-Hartman
maintainerPATCH 88/621 optee: register TEE devices only once fully initialized
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shao-Fu Chen <[email protected]>
commit c108feca0a096f8db25d1b69130035025e9e936d upstream.
optee_probe() called tee_device_register() on both the client and the supplicant device before the rest of struct optee had been initialized.
tee_device_register() calls cdev_device_add(), which does two things at
once: it creates /dev/tee0 and /dev/teepriv0, and it links the device into the tee class so that class_find_device() can find it. From that moment on the device is reachable both from user space via tee_open() and from kernel space via tee_client_open_context(). The only gate in teedev_open() is tee_device_get(), which merely checks that teedev->desc is non-NULL, which was already set by tee_device_alloc(). Therefore, there is effectively no gate at all.
A context opened in that window can run against a struct optee where
- optee->call_queue.mutex is not initialized by optee_cq_init()
- optee->supp mutex and completions is not initialized by optee_supp_init()
- optee->rpmb_dev_mutex is not initialized yet,
- the message argument cache is not initialized by optee_shm_arg_cache_init()
- optee->ctx is still NULL
Any open session or invoke during this window takes uninitialized mutexes and dereferences a NULL pointer.
Fix it by moving both tee_device_register() calls down to the point where all of struct optee is set up.
--- drivers/tee/optee/ffa_abi.c | 16 ++++++++-------- drivers/tee/optee/smc_abi.c | 17 ++++++++--------- 2 files changed, 16 insertions(+), 17 deletions(-)
drivers/tee/optee/ffa_abi.c +8 -8
@@ -1094,14 +1094,6 @@ static int optee_ffa_probe(struct ffa_deoptee_set_dev_group (optee); - rc =tee_device_register (optee->teedev); -if (rc) - goto err_unreg_supp_teedev; - - rc =tee_device_register (optee->supp_teedev); -if (rc) - goto err_unreg_supp_teedev; - rc =rhashtable_init (&optee->ffa.global_ids, &shm_rhash_params);if (rc) goto err_unreg_supp_teedev;
@@ -1130,6 +1122,14 @@ static int optee_ffa_probe(struct ffa_deif (optee_ffa_protmem_pool_init (optee, sec_caps))pr_info ("Protected memory service not available\n" ); + rc =tee_device_register (optee->teedev); +if (rc) + goto err_unregister_devices; + + rc =tee_device_register (optee->supp_teedev); +if (rc) + goto err_unregister_devices; + rc =optee_enumerate_devices (PTA_CMD_GET_DEVICES );if (rc) goto err_unregister_devices;
drivers/tee/optee/smc_abi.c +8 -9
@@ -1840,14 +1840,6 @@ static int optee_probe(struct platform_doptee_set_dev_group (optee); - rc =tee_device_register (optee->teedev); -if (rc) - goto err_unreg_supp_teedev; - - rc =tee_device_register (optee->supp_teedev); -if (rc) - goto err_unreg_supp_teedev; -optee_cq_init (&optee->call_queue, thread_count);optee_supp_init (&optee->supp); optee->smc.memremaped_shm = memremaped_shm;
@@ -1907,6 +1899,14 @@ static int optee_probe(struct platform_dif (optee->smc.sec_caps &OPTEE_SMC_SEC_CAP_DYNAMIC_SHM )pr_info ("dynamic shared memory is enabled\n" ); + rc =tee_device_register (optee->teedev); +if (rc) + goto err_disable_shm_cache; + + rc =tee_device_register (optee->supp_teedev); +if (rc) + goto err_disable_shm_cache; + rc =optee_enumerate_devices (PTA_CMD_GET_DEVICES );if (rc) goto err_disable_shm_cache;
@@ -1933,7 +1933,6 @@ err_supp_uninit:optee_shm_arg_cache_uninit (optee);optee_supp_uninit (&optee->supp);mutex_destroy (&optee->call_queue.mutex); -err_unreg_supp_teedev:tee_device_unregister (optee->supp_teedev); err_unreg_teedev:tee_device_unregister (optee->teedev);
Greg Kroah-Hartman
maintainerPATCH 89/621 regulator: ltc3676: dont read the write-only HRST and CLIRQ registers
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abhishek Ojha <[email protected]>
commit 28c2388ee24cdbefbcc458fa41ef7bffaaa1cc83 upstream.
HRST (0x1e) and CLIRQ (0x1f) are write-only command strobes. Writing HRST triggers a hard reset of the chip and writing CLIRQ clears the interrupt; reading them returns nothing useful, and the read itself fires the command.
The result is that a plain register dump resets the board:
cat /sys/kernel/debug/regmap/2-003c/registers
walks every readable register, hits HRST, and the board reboots.
Split the callback back in two so HRST and CLIRQ stay writable but are no longer readable. The readable range is left unchanged (LTC3676_BUCK1 ... LTC3676_IRQSTAT).
--- drivers/regulator/ltc3676.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)
drivers/regulator/ltc3676.c +12 -3
@@ -232,7 +232,7 @@ static const struct regulator_desc ltc36 LTC3676_FIXED_REG(LDO4, ldo4, LDOB, 2), }; -static bool ltc3676_readable_writeable_reg (struct device *dev,unsigned int reg) +static bool ltc3676_writeable_reg (struct device *dev,unsigned int reg) {switch (reg) { case LTC3676_BUCK1 ... LTC3676_IRQSTAT:
@@ -243,6 +243,15 @@ static bool ltc3676_readable_writeable_rreturn false; } +static bool ltc3676_readable_reg (struct device *dev,unsigned int reg) +{ +switch (reg) { + case LTC3676_BUCK1 ... LTC3676_IRQSTAT: +return true; + } +return false; +} +static bool ltc3676_volatile_reg (struct device *dev,unsigned int reg) {switch (reg) {
@@ -255,8 +264,8 @@ static bool ltc3676_volatile_reg(structstatic const struct regmap_config ltc3676_regmap_config = { .reg_bits =8 , .val_bits =8 , - .writeable_reg = ltc3676_readable_writeable_reg, - .readable_reg = ltc3676_readable_writeable_reg, + .writeable_reg = ltc3676_writeable_reg, + .readable_reg = ltc3676_readable_reg, .volatile_reg = ltc3676_volatile_reg, .max_register =LTC3676_CLIRQ , .use_single_read = true,
Greg Kroah-Hartman
maintainerPATCH 90/621 regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ridham Khurana <[email protected]>
commit 2f15518682c779b1014552cb2ccb4a2052f85f27 upstream.
The TPS65224 BUCK2, BUCK3 and BUCK4 descriptors pass 4 as n_linear_ranges, but tps65224_bucks_2_3_4_ranges[] only has two entries, covering selectors 0x00-0x45.
The linear range helpers loop over n_linear_ranges entries, so any lookup of a selector above 0x45 reads past the end of the array and treats whatever follows it as two more ranges. This happens on the normal registration path when the core checks the voltage constraints against every selector. TPS652G1 uses the same descriptors and is affected too.
Use ARRAY_SIZE() so the count always matches the table.
--- drivers/regulator/tps6594-regulator.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/regulator/tps6594-regulator.c +3 -3
@@ -241,21 +241,21 @@ static const struct regulator_desc tps65 TPS65224_MASK_BUCKS_VSET, TPS6594_REG_BUCKX_CTRL(1), TPS6594_BIT_BUCK_EN, 0, 0, tps65224_bucks_2_3_4_ranges, - 4, 0, 0, NULL, 0, 0), + ARRAY_SIZE(tps65224_bucks_2_3_4_ranges), 0, 0, NULL, 0, 0),TPS6594_REGULATOR ("BUCK3" ,"buck3" ,TPS6594_BUCK_3 ,REGULATOR_VOLTAGE , tps6594_bucks_ops,TPS65224_MASK_BUCKS_VSET ,TPS6594_REG_BUCKX_VOUT_1 (2 ),TPS65224_MASK_BUCKS_VSET ,TPS6594_REG_BUCKX_CTRL (2 ),TPS6594_BIT_BUCK_EN ,0 ,0 , tps65224_bucks_2_3_4_ranges, -4 ,0 ,0 ,NULL ,0 ,0 ), +ARRAY_SIZE (tps65224_bucks_2_3_4_ranges),0 ,0 ,NULL ,0 ,0 ),TPS6594_REGULATOR ("BUCK4" ,"buck4" ,TPS6594_BUCK_4 ,REGULATOR_VOLTAGE , tps6594_bucks_ops,TPS65224_MASK_BUCKS_VSET ,TPS6594_REG_BUCKX_VOUT_1 (3 ),TPS65224_MASK_BUCKS_VSET ,TPS6594_REG_BUCKX_CTRL (3 ),TPS6594_BIT_BUCK_EN ,0 ,0 , tps65224_bucks_2_3_4_ranges, - 4, 0, 0, NULL, 0, 0), + ARRAY_SIZE(tps65224_bucks_2_3_4_ranges), 0, 0, NULL, 0, 0), }; static const struct tps6594_regulator_irq_type tps6594_buck1_irq_types[] = {
Greg Kroah-Hartman
maintainerPATCH 91/621 pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Qian <[email protected]>
commit 51c2db3ef0cb89a49ab7f47a40efd5d5b074ce8d upstream.
On i.MX8MP the VPU blk-ctrl exposes G1, G2 and VC8000E as three separate genpds, each serialized only by its own genpd lock, so their power_on and power_off callbacks can run concurrently on SMP.
The sequences are not independent: they share the VPUMIX bus domain, the VPU_NOC and the ADB400 handshake. On power up the GPC cannot ack-verify the ADB400 handshake - the ack only completes once blk-ctrl sets the bus clk-en bit - so it just waits a fixed delay instead of polling hskack. A sibling transition landing inside another domain's reset window disturbs that shared clock and handshake timing, the victim's reset does not take effect, and its block registers read back all zeros: the decoder times out or the encoder fails its format check.
Serialize the blk-ctrl reset sequence with a per-blk-ctrl mutex; the driver deliberately avoids a genpd hierarchy, so the genpd core gives no cross-sibling serialization.
--- drivers/pmdomain/imx/imx8m-blk-ctrl.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
drivers/pmdomain/imx/imx8m-blk-ctrl.c +15 -0
@@ -15,6 +15,7 @@#include <linux/pm_runtime.h> #include <linux/regmap.h> #include <linux/clk.h> +#include <linux/mutex.h> #include <dt-bindings/power/imx8mm-power.h> #include <dt-bindings/power/imx8mn-power.h>
@@ -34,6 +35,12 @@ struct imx8m_blk_ctrl {struct regmap *regmap;struct imx8m_blk_ctrl_domain *domains;struct genpd_onecell_data onecell_data; +/* +* Serializes the blk-ctrl reset/clock sequence across sibling domains; +* their transitions interact through the shared VPUMIX bus domain, +* VPU_NOC and the not-ack-verified ADB400 handshake (ERR050531). +*/ +struct mutex power_lock; };struct imx8m_blk_ctrl_domain_data {
@@ -98,6 +105,8 @@ static int imx8m_blk_ctrl_power_on(strucstruct imx8m_blk_ctrl *bc = domain->bc;int ret; +guard (mutex)(&bc->power_lock); +/* make sure bus domain is awake */ ret =pm_runtime_get_sync (bc->bus_power_dev);if (ret <0 ) {
@@ -164,6 +173,8 @@ static int imx8m_blk_ctrl_power_off(struconst struct imx8m_blk_ctrl_domain_data *data = domain->data;struct imx8m_blk_ctrl *bc = domain->bc; +guard (mutex)(&bc->power_lock); +/* put devices into reset and disable clocks */ if (data->mipi_phy_rst_mask)regmap_clear_bits (bc->regmap,BLK_MIPI_RESET_DIV , data->mipi_phy_rst_mask);
@@ -202,6 +213,10 @@ static int imx8m_blk_ctrl_probe(struct p bc->dev = dev; + ret =devm_mutex_init (dev, &bc->power_lock); +if (ret) +return ret; + bc_data =of_device_get_match_data (dev); base =devm_platform_ioremap_resource (pdev,0 );
Greg Kroah-Hartman
maintainerPATCH 92/621 pmdomain: rockchip: dont ignore clock lookup errors on attach
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shawn Lin <[email protected]>
commit 4c66c423593e26273ea0d644906ed007630c6f6d upstream.
rockchip_pd_attach_dev() treated every of_clk_get() error as the end of the clock list, so a clock that exists but is not available yet (e.g. -EPROBE_DEFER) was silently skipped and the device ended up without pm_clk management. Only -ENOENT means there are no more clocks.
--- drivers/pmdomain/rockchip/pm-domains.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
drivers/pmdomain/rockchip/pm-domains.c +13 -1
@@ -728,7 +728,19 @@ static int rockchip_pd_attach_dev(struct } i =0 ; -while ((clk =of_clk_get (dev->of_node, i++)) && !IS_ERR (clk)) { +while (1 ) { + clk =of_clk_get (dev->of_node, i++); +if (IS_ERR (clk)) { + error =PTR_ERR (clk); +if (error == -ENOENT ) +break ; + +dev_err (dev,"failed to get clock %d: %d\n" , i -1 , + error); +pm_clk_destroy (dev); +return error; + } +dev_dbg (dev,"adding clock '%pC' to list of PM clocks\n" , clk); error =pm_clk_add_clk (dev, clk);if (error) {
Greg Kroah-Hartman
maintainerPATCH 93/621 pmdomain: rockchip: fix clock leak on domain probe failure
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shawn Lin <[email protected]>
commit d8b3847770661b7109146e6479eeadcdab9cecf0 upstream.
When of_clk_get() failed in the middle of the loop, the references of the clocks acquired so far were leaked instead of being released by the error path.
--- drivers/pmdomain/rockchip/pm-domains.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pmdomain/rockchip/pm-domains.c +1 -1
@@ -823,7 +823,7 @@ static int rockchip_pm_add_one_domain(stdev_err (pmu->dev,"%pOFn: failed to get clk at index %d: %d\n" , node, i, error); -return error; + goto err_put_clocks; } }
Greg Kroah-Hartman
maintainerPATCH 94/621 pmdomain: rockchip: propagate subdomain add errors
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shawn Lin <[email protected]>
commit 4c0d69d677cf5b0065ebbb3ceb8ba66fddbec630 upstream.
rockchip_pm_add_subdomain() ignored the return value of its recursive call, so a failure deeper in the hierarchy was silently dropped and probe still succeeded with an incomplete domain tree.
--- drivers/pmdomain/rockchip/pm-domains.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/pmdomain/rockchip/pm-domains.c +3 -1
@@ -999,7 +999,9 @@ static int rockchip_pm_add_subdomain(str parent_domain->name, child_domain->name); } -rockchip_pm_add_subdomain (pmu, np); + error =rockchip_pm_add_subdomain (pmu, np); +if (error) +return error; }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 95/621 scsi: qedi: Initialize callback state before registration
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <[email protected]>
commit 85de8b3a5eaa23d153aff4c7c83dddbc949064c9 upstream.
qedi_get_protocol_tlv_data() can be called asynchronously by QED after qedi_ops->register_ops(). It takes stats_lock and reads ll2_mtu, but __qedi_probe() currently registers the callback before initializing the mutex and assigning the default MTU on the normal probe path.
Initialize the callback-visible state before registering qedi_cb_ops. Keep the recovery path from reinitializing state because it reuses the existing qedi context.
--- drivers/scsi/qedi/qedi_main.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/scsi/qedi/qedi_main.c +1 -2
@@ -2654,8 +2654,6 @@ retry_probe:snprintf (host_buf,sizeof (host_buf),"host_%d" , qedi->shost->host_no); qedi_ops->common->set_name (qedi->cdev, host_buf); - qedi_ops->register_ops (qedi->cdev, &qedi_cb_ops, qedi); -memset (¶ms,0 ,sizeof (params)); params.mtu =DEF_PATH_MTU +IPV6_HDR_LEN +TCP_HDR_LEN ; qedi->ll2_mtu =DEF_PATH_MTU ;
@@ -2672,6 +2670,7 @@ retry_probe:spin_lock_init (&qedi->task_idx_lock);mutex_init (&qedi->stats_lock); } + qedi_ops->register_ops (qedi->cdev, &qedi_cb_ops, qedi); qedi_ops->ll2->register_cb_ops (qedi->cdev, &qedi_ll2_cb_ops, qedi); qedi_ops->ll2->start (qedi->cdev, ¶ms);
Greg Kroah-Hartman
maintainerPATCH 96/621 riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ziyi Guo <[email protected]>
commit 4d0697f192975dab5985e921989be1d85cf580e9 upstream.
Under CONFIG_SHADOW_CALL_STACK, handle_exception() reloads the kernel shadow call stack pointer (gp) only when the trap came from userspace. It made that decision with scs_load_current_if_task_changed, which compares the trap-time tp (read back from sscratch into s5) against the current tp:
beq \prev, tp, _skip_scs
scs_load_current_skip_scs:
tp is a user-writable register. A user task that sets tp to the linear-map address of its own task_struct (¤t) before trapping makes the comparison succeed (can achieve by brute force with KASLR enable under our test), so the kernel skips scs_load_current and keeps running with the gp that userspace left in place. Under CONFIG_SHADOW_CALL_STACK gp is the shadow call stack pointer and load_global_pointer is a no-op, so the compiler-emitted
"sd ra, -8(gp)" / "ld ra, -8(gp)" in every non-leaf function then write to, and return through, an attacker-controlled address -- an unprivileged kernel arbitrary-write and control-flow-hijack primitive. The poisoned gp is saved to task_struct.scs_sp on return, so the reload is skipped on every subsequent entry as well.
Decide "came from userspace" from the hardware sstatus.SPP bit (already in s1 at this point) instead of from tp, mirroring the check that ret_from_exception already uses a few instructions later. SPP is written by hardware on trap entry and cannot be forged from U-mode. Legitimate behaviour is unchanged: user entries (SPP=0) reload the task shadow call stack, nested kernel entries (SPP=1) skip it.
--- arch/riscv/include/asm/scs.h | 17 +++++++++++++---- arch/riscv/kernel/entry.S | 2 +- 2 files changed, 14 insertions(+), 5 deletions(-)
arch/riscv/include/asm/scs.h +13 -4
@@ -4,6 +4,7 @@#ifdef __ASSEMBLER__#include <asm/asm-offsets.h> +#include <asm/csr.h> #ifdef CONFIG_SHADOW_CALL_STACK
@@ -23,9 +24,17 @@ REG_L gp, TASK_TI_SCS_SP(tp) .endm -/* Load task_scs_sp(current) to gp, but only if tp has changed. */ -.macro scs_load_current_if_task_changed prev - beq \prev, tp, _skip_scs +/* + * Load task_scs_sp(current) to gp, but only when the trap came from U-mode. + * The source privilege level is taken from the saved sstatus.SPP bit (written + * by hardware on trap entry), not by comparing tp. tp is a user-writable + * register, so gating the shadow call stack reload on it let a user task that + * set tp == ¤t skip the reload and run the kernel with an attacker + * controlled gp (the shadow call stack pointer). + */ +.macro scs_load_current_if_from_user status, tmp + andi \tmp, \status, SR_SPP + bnez \tmp, _skip_scs scs_load_current _skip_scs: .endm
@@ -43,7 +52,7 @@ _skip_scs: .endm .macro scs_load_current .endm -.macro scs_load_current_if_task_changed prev +.macro scs_load_current_if_from_user status, tmp .endm .macro scs_save_current .endm
arch/riscv/kernel/entry.S +1 -1
@@ -174,7 +174,7 @@ SYM_CODE_START(handle_exception) load_global_pointer /* Load the kernel shadow call stack pointer if coming from userspace */ - scs_load_current_if_task_changed s5 + scs_load_current_if_from_user s1, s5 #ifdef CONFIG_RISCV_ISA_V_PREEMPTIVE move a0, sp
Greg Kroah-Hartman
maintainerPATCH 97/621 riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zongmin Zhou <[email protected]>
commit 298510bbc7c3017c0faf481c6ea66f1065b657b4 upstream.
errata_probe_ghostwrite() only marks the CPU as vulnerable when it is called at the RISCV_ALTERNATIVES_EARLY_BOOT stage, and the mitigation in ghostwrite_enable_mitigation() only takes effect if the vulnerable state was recorded before the boot alternatives are patched.
The early boot stage is only executed when CONFIG_RISCV_ALTERNATIVE_EARLY is enabled, which currently is only selected by ERRATA_THEAD_MAE. In a kernel built with ERRATA_THEAD_GHOSTWRITE=y but ERRATA_THEAD_MAE=n, the early alternatives never run, so ghostwrite_state is never set to
VULNERABLE: ghostwrite_enable_mitigation() returns false, xtheadvector remains enabled, and sysfs reports "Not affected" on a vulnerable T-Head C9xx CPU.
Select RISCV_ALTERNATIVE_EARLY from ERRATA_THEAD_GHOSTWRITE so that the vulnerability is detected in the early boot stage and the default mitigation is applied.
--- arch/riscv/Kconfig.errata | 1 + 1 file changed, 1 insertion(+)
arch/riscv/Kconfig.errata +1 -0
@@ -145,6 +145,7 @@ config ERRATA_THEAD_PMU config ERRATA_THEAD_GHOSTWRITE bool "Apply T-Head Ghostwrite errata" depends on ERRATA_THEAD && RISCV_ISA_XTHEADVECTOR + select RISCV_ALTERNATIVE_EARLY default y help The T-Head C9xx cores have a vulnerability in the xtheadvector
Greg Kroah-Hartman
maintainerPATCH 98/621 riscv: fix load_unaligned_zeropad() fixup for RV32
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <[email protected]>
commit d4f25b097e46d82718bb737d4540c99b7ab0a408 upstream.
The fixup for load_unaligned_zeropad() runs when REG_L crosses into an unmapped page. REG_L is lw on RV32 and ld on RV64, but the fixup assumes an 8-byte load: it rounds the address down to 8 bytes and derives the shift from three address bits.
On RV32, a load starting in the last three bytes of a mapped page selects the word four bytes earlier and shifts it by 40, 48, or 56 bits, more than the register width. The caller gets earlier bytes instead of the string tail followed by zeroes. This affects RV32 MMU kernels built with RISCV_EFFICIENT_UNALIGNED_ACCESS=y, which selects DCACHE_WORD_ACCESS and lets dcache name hashing and comparison and strscpy() use this path.
Derive the alignment and offset masks from sizeof(data) instead of a fixed
8. This makes RV32 use the correct source word. RV64 code is unchanged: the complete extable.o is byte-for-byte identical before and after.
--- arch/riscv/mm/extable.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/riscv/mm/extable.c +2 -2
@@ -68,8 +68,8 @@ ex_handler_load_unaligned_zeropad(const addr =regs_get_gpr (regs, reg_addr *sizeof (unsigned long )); - offset = addr &0x7UL ; - addr &= ~0x7UL ; + offset = addr & (sizeof (data) -1 ); + addr &= ~(sizeof (data) -1 ); data = *(unsigned long *)addr >> (offset *8 );
Greg Kroah-Hartman
maintainerPATCH 99/621 riscv: futex: untag the user pointer before the atomic access
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ziyi Guo <[email protected]>
commit 405290be962b32eec842776fbe3bdf81f15b1676 upstream.
access_ok() checks untagged_addr(uaddr), but arch_futex_atomic_op_inuser() and futex_atomic_cmpxchg_inatomic() hand the raw uaddr to the inline asm amoswap/amoadd/.../lr.w+sc.w through the "+m" (*uaddr) operand. When the tagged address ABI is enabled (CONFIG_RISCV_ISA_SUPM, prctl PR_SET_TAGGED_ADDR_CTRL with PMLEN != 0), those two addresses differ: a user pointer whose top PMLEN bits hold a tag passes access_ok() after untagging, but the atomic is then performed on the still-tagged raw address.
Supervisor-mode data accesses are not subject to the U-mode pointer masking (that is governed by menvcfg.PMM, which the kernel does not set), so hardware does not strip the tag for the kernel's own access. With Sv57 and PMLEN=16 the tag bits overlap the canonical-address bits, so a tagged pointer can name a canonical kernel virtual address (e.g. in the linear map) whose untagged form is a valid user address. An unprivileged process can thus make FUTEX_WAKE_OP perform an atomic read-modify-write on an arbitrary kernel address, with the matching FUTEX_OP_CMP_* result serving as a read oracle.
get_user()/put_user()/raw_copy_{to,from}_user() already untag the pointer after the access_ok() check; do the same in the futex helpers so the atomic operates on the address that was actually validated.
--- arch/riscv/include/asm/futex.h | 2 ++ 1 file changed, 2 insertions(+)
arch/riscv/include/asm/futex.h +2 -0
@@ -40,6 +40,7 @@ arch_futex_atomic_op_inuser(int op, intif (!access_ok (uaddr,sizeof (u32)))return -EFAULT ; + uaddr =untagged_addr (uaddr);switch (op) {case FUTEX_OP_SET :
@@ -82,6 +83,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval,if (!access_ok (uaddr,sizeof (u32)))return -EFAULT ; + uaddr =untagged_addr (uaddr);__enable_user_access (); __asm__ __volatile__ (
Greg Kroah-Hartman
maintainerPATCH 100/621 riscv: hwprobe: use _BITULL() rather than BIT() in MIPS vendor uapi header
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zongmin Zhou <[email protected]>
commit edba6017c19f97ecc718fad6b50e0908392247ac upstream.
BIT() is a kernel-internal macro that is not available to userspace, but the MIPS vendor extension uapi header uses it without defining or including it. Any userspace program that includes this header and uses RISCV_HWPROBE_VENDOR_EXT_XMIPSEXECTL fails to build.
Use _BITULL(0) from linux/const.h instead, which keeps the value at 1, so there is no ABI change.
--- arch/riscv/include/uapi/asm/vendor/mips.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/riscv/include/uapi/asm/vendor/mips.h +3 -1
@@ -1,3 +1,5 @@/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ -#define RISCV_HWPROBE_VENDOR_EXT_XMIPSEXECTL BIT(0) +#include <linux/const.h> + +#define RISCV_HWPROBE_VENDOR_EXT_XMIPSEXECTL _BITULL(0)
Signature · 1 line
2.56.0
Greg Kroah-Hartman
maintainerPATCH 101/621 Bluetooth: btintel_pcie: use managed IRQ teardown
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <[email protected]>
commit 25016fe8c1ed0fccae107bd629089139ffbafe08 upstream.
The PCIe driver registers its MSI-X handlers with devm_request_threaded_irq(), but remove() uses free_irq() directly. The devres actions then retain registrations and attempt to release them again during device cleanup.
Use devm_free_irq() for the remove path and for already registered vectors when a later setup request fails. This removes the managed resource at the same time as the IRQ is released and keeps MSI-X vector teardown ordered after IRQ ownership is gone.
--- drivers/bluetooth/btintel_pcie.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/bluetooth/btintel_pcie.c +6 -2
@@ -1540,7 +1540,7 @@ static irqreturn_t btintel_pcie_irq_msixstatic int btintel_pcie_setup_irq (struct btintel_pcie_data *data) {int err; -int num_irqs, i; +int num_irqs, i, j;for (i =0 ; i <BTINTEL_PCIE_MSIX_VEC_MAX ; i++) data->msix_entries[i].entry = i;
@@ -1569,6 +1569,10 @@ static int btintel_pcie_setup_irq(structKBUILD_MODNAME , msix_entry);if (err) { +for (j =0 ; j < i; j++) +devm_free_irq (&data->pdev->dev, + data->msix_entries[j].vector, + &data->msix_entries[j]);pci_free_irq_vectors (data->pdev); data->alloc_vecs =0 ;return err;
@@ -2531,7 +2535,7 @@ static void btintel_pcie_remove(struct pstruct msix_entry *msix_entry; msix_entry = &data->msix_entries[i]; -free_irq (msix_entry->vector, msix_entry); +devm_free_irq (&pdev->dev, msix_entry->vector, msix_entry); }pci_free_irq_vectors (pdev);
Greg Kroah-Hartman
maintainerPATCH 102/621 Bluetooth: hci_sock: Serialize dead-device detachment
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengfeng Ye <[email protected]>
commit 381a0925c556a8d91a80a9b9e3e86651d60ffee3 upstream.
Rebinding an HCI socket after its controller is unregistered can race monitor control replay and crash the kernel. hci_sock_bind() clears hci_pi(sk)->hdev and drops the device reference under only the socket lock, whereas send_monitor_control_replay() holds hci_sk_list.lock for reading.
Replay can observe a non-NULL hdev, then bind can clear it and drop the last reference before create_monitor_ctrl_open() reads hdev->id. This can cause a NULL pointer dereference if the pointer is reloaded, or a use-after-free if the old pointer is retained.
The kernel reported:
KASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f] RIP: 0010:create_monitor_ctrl_open+0x579/0x800 Call Trace: hci_sock_bind+0xd96/0x1190 __sys_bind+0x166/0x200 __x64_sys_bind+0x6d/0xb0 do_syscall_64+0xdd/0x4a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f
The same missing serialization lets hci_send_to_sock() select a socket for the old device and queue its frame after bind has detached the socket or installed a new binding.
Take hci_sk_list.lock for writing when clearing the device pointer and resetting the socket state. This waits for existing replay and delivery readers to finish before detachment and prevents later readers from using the old binding. Keep hci_dev_put() outside the critical section because the final device release can sleep.
--- net/bluetooth/hci_sock.c | 2 ++ 1 file changed, 2 insertions(+)
net/bluetooth/hci_sock.c +2 -0
@@ -1225,8 +1225,10 @@ static int hci_sock_bind(struct socket **/ hdev =hci_pi (sk)->hdev;if (hdev &&hci_dev_test_flag (hdev,HCI_UNREGISTER )) { +write_lock (&hci_sk_list.lock);hci_pi (sk)->hdev =NULL ; sk->sk_state =BT_OPEN ; +write_unlock (&hci_sk_list.lock);hci_dev_put (hdev); } hdev =NULL ;
Greg Kroah-Hartman
maintainerPATCH 103/621 Bluetooth: hci_sync: Fix command skb lifetime during scan setup
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengfeng Ye <[email protected]>
commit 9af12272061d206af8bc3e40215cb694421ab73a upstream.
During PA sync scan setup, hci_le_set_ext_scan_param_sync() gets the address used for the PA_LINK lookup from hci_sent_cmd_data(). The returned pointer borrows storage from sent_cmd or req_skb, without holding a reference to either skb.
The scan worker runs on req_workqueue while hci_cmd_work() runs on the separate device workqueue. After the scan worker loads sent_cmd, the command worker can free and replace it before hci_sent_cmd_data() dereferences the skb. The command payload can also be freed between returning from the helper and comparing the address. The connection lookup's RCU critical section does not protect the command skb.
KASAN reported:
BUG: KASAN: slab-use-after-free in hci_sent_cmd_data+0x27c/0x2f0 Workqueue: hci0 hci_cmd_sync_work Call Trace: hci_sent_cmd_data+0x27c/0x2f0 hci_le_set_scan_param_sync+0x43a/0x850 hci_passive_scan_sync+0xb09/0x1460 hci_update_passive_scan_sync+0x47c/0x6e0 hci_le_pa_create_sync+0x200/0xa70 hci_cmd_sync_work+0x13c/0x290 Allocated by task 95: skb_clone+0x13f/0x340 hci_cmd_work+0x2a9/0x7e0 Freed by task 95: kmem_cache_free+0xba/0x3a0 hci_cmd_work+0x29c/0x7e0
Use hdev->lock to serialize the address snapshot with sent_cmd replacement. Protect req_skb replacement and completion cleanup with the same lock because the helper falls back to that skb. Copy the address before releasing the lock and use the copy for the existing RCU-protected connection lookup. Release the mutex before sending or waiting for commands, preserving the lookup and completion ordering.
--- net/bluetooth/hci_core.c | 4 ++++ net/bluetooth/hci_sync.c | 10 +++++++++- 2 files changed, 13 insertions(+), 1 deletion(-)
net/bluetooth/hci_core.c +4 -0
@@ -4152,9 +4152,11 @@ static int hci_send_cmd_sync(struct hci_bt_dev_dbg (hdev,"skb %p" , skb); +hci_dev_lock (hdev);kfree_skb (hdev->sent_cmd); hdev->sent_cmd =skb_clone (skb,GFP_KERNEL ); +hci_dev_unlock (hdev);if (!hdev->sent_cmd) {skb_queue_head (&hdev->cmd_q, skb);queue_work (hdev->workqueue, &hdev->cmd_work);
@@ -4175,8 +4177,10 @@ static int hci_send_cmd_sync(struct hci_if (READ_ONCE (hdev->req_status) ==HCI_REQ_PEND && !hci_dev_test_and_set_flag (hdev,HCI_CMD_PENDING )) { +hci_dev_lock (hdev);kfree_skb (hdev->req_skb); hdev->req_skb =skb_get (hdev->sent_cmd); +hci_dev_unlock (hdev); }return err;
net/bluetooth/hci_sync.c +9 -1
@@ -32,8 +32,10 @@ static void hci_cmd_sync_complete(structWRITE_ONCE (hdev->req_status,HCI_REQ_DONE );/* Free the request command so it is not used as response */ +hci_dev_lock (hdev);kfree_skb (hdev->req_skb); hdev->req_skb =NULL ; +hci_dev_unlock (hdev);if (skb) {struct sock *sk =hci_skb_sk (skb);
@@ -3055,15 +3057,21 @@ static int hci_le_set_ext_scan_param_syn*/ if (hci_dev_test_flag (hdev,HCI_PA_SYNC )) {struct hci_cp_le_add_to_accept_list *sent; +bdaddr_t bdaddr; +hci_dev_lock (hdev); sent =hci_sent_cmd_data (hdev,HCI_OP_LE_ADD_TO_ACCEPT_LIST ); +if (sent) +bacpy (&bdaddr, &sent->bdaddr); +hci_dev_unlock (hdev); +if (sent) {struct hci_conn *conn;rcu_read_lock (); conn =hci_conn_hash_lookup_ba (hdev,PA_LINK , - &sent->bdaddr); + &bdaddr);if (conn) {struct bt_iso_qos *qos = &conn->iso_qos;
Greg Kroah-Hartman
maintainerPATCH 104/621 Bluetooth: ISO: Reject concurrent BIS listener setup
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengfeng Ye <[email protected]>
commit 555ff78fa719f50ff4cdbdb40aa1acc6e8e327d3 upstream.
iso_sock_listen() drops the socket lock before calling iso_listen_bis() to preserve the hdev->lock ordering. Two concurrent listen() calls on the same broadcast socket can therefore both observe BT_BOUND. Caller A can attach connA and release the locks, then caller B can acquire them and attach connB before A publishes BT_LISTEN.
__iso_chan_add() checks whether connB already has a socket, but not whether the socket already has a connection. The second attachment overwrites iso_pi(sk)->conn, leaking the connA reference and leaving connA->sk intact. Socket teardown follows connB, so later events on connA can cause a stale socket access.
Recheck BT_BOUND and require iso_pi(sk)->conn to be NULL after taking both the HCI device and socket locks in iso_listen_bis(). The connection check also covers the interval between attachment and publication of BT_LISTEN. Reject a competing setup with -EBADFD through the existing unlock path before allocating another connection.
A recorded KASAN report from an instrumented kernel shows:
BUG: KASAN: slab-use-after-free in iso_sock_hold+0x119/0x1f0 Call Trace: iso_sock_hold+0x119/0x1f0 iso_conn_del+0xe4/0x270 hci_disconn_complete_evt+0x351/0x8c0 hci_event_packet+0x71b/0xb20 hci_rx_work+0x293/0x730 Allocated by task 93: sk_prot_alloc+0x113/0x220 sk_alloc+0x2b/0x6d0 bt_sock_alloc+0x29/0x370 iso_sock_alloc.constprop.0+0x19/0x300 iso_sock_create+0x94/0x100 Freed by task 93: kfree+0x121/0x3c0 __sk_destruct+0x42b/0x540 iso_sock_release+0x29d/0x340 __sock_release+0xa1/0x260 sock_close+0x10/0x20
--- net/bluetooth/iso.c | 5 +++++ 1 file changed, 5 insertions(+)
net/bluetooth/iso.c +5 -0
@@ -1221,6 +1221,11 @@ static int iso_listen_bis(struct sock *shci_dev_lock (hdev);lock_sock (sk); +if (sk->sk_state !=BT_BOUND ||iso_pi (sk)->conn) { + err = -EBADFD ; + goto unlock; + } +/* Fail if user set invalid QoS */ if (iso_pi (sk)->qos_user_set && !check_bcast_qos (&iso_pi (sk)->qos)) {iso_pi (sk)->qos = default_qos;
Greg Kroah-Hartman
maintainerPATCH 105/621 Bluetooth: ISO: Serialize concurrent connect calls
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengfeng Ye <[email protected]>
commit e32d80293a0e1a160d5e5101daa8c82148c07510 upstream.
iso_sock_connect() checks the socket state before taking the socket lock and drops the lock again before setting up a connection. Two callers can both pass the admission check while the socket is open or bound.
Caller A can copy its destination for route selection, then caller B can replace the socket destination before A binds or connects the CIS. A then uses B's destination with the route selected for its own request. B can also proceed after A attaches a connection and sets BT_CONNECT. For deferred BIS setup, B can bind a second BIS and overwrite iso_pi(sk)->conn, leaving the first connection's reference and conn->sk back-pointer stranded. Concurrent CIS connects can likewise replace the socket's connection. Later teardown only detaches the current connection, so a callback on the old connection can race with socket release and access a freed socket.
KASAN reported:
BUG: KASAN: slab-use-after-free in iso_sock_hold+0xf7/0x1b0 Call Trace: iso_sock_hold+0xf7/0x1b0 iso_conn_del+0x7b/0x1d0 iso_connect_cfm+0x186/0x16a0 hci_conn_failed+0x154/0x280 hci_abort_conn_sync+0x3dc/0x7d0 hci_cmd_sync_work+0x173/0x300 Allocated by task 121: sk_alloc+0x2b/0x6d0 bt_sock_alloc+0x29/0x370 iso_sock_alloc.constprop.0+0x19/0x300 iso_sock_create+0x94/0x100 Freed by task 121: kfree+0x121/0x3c0 __sk_destruct+0x42b/0x540 iso_sock_release+0x29d/0x340 __sock_release+0xa1/0x260
Check admission under the socket lock and mark the connect operation in progress before publishing its destination. Keep that flag set across route lookup and connection setup, rejecting another connect with -EBADFD before it can change the destination or attach a connection. Clear the flag after either helper returns, including on failure, so a failed setup can be retried.
A separate flag is needed because the socket lock must be released before acquiring the HCI device lock, while BT_CONNECT requires an attached connection. Keep the existing state transitions and the deferred CIS completion through iso_sock_recvmsg().
Reject an existing socket attachment in __iso_chan_add() before taking a new reference or publishing either pointer, so every caller preserves the connection association. Keep the same-socket, same-connection success case for deferred CIS setup. Reject an attached socket before BIS setup so a reusable BIS is not claimed before the attachment is rejected.
In CIS setup, reject a different HCI connection before iso_conn_add() and drop the per-attempt HCI hold directly. An unowned iso_conn may still carry another reference after detachment, so its destruction cannot be relied on to release that hold.
iso_listen_bis() creates a fresh PA HCI/ISO pair under the device lock, so the temporary iso_conn_put() frees the ISO candidate and drops its HCI hold on rejection. iso_conn_ready() uses a freshly allocated, unpublished child with no connection, making the socket-side rejection unreachable.
--- net/bluetooth/iso.c | 47 +++++++++++++++++++++++++++++++++++++---------- 1 file changed, 37 insertions(+), 10 deletions(-)
net/bluetooth/iso.c +37 -10
@@ -60,6 +60,7 @@ enum {BT_SK_BIG_SYNC ,BT_SK_PA_SYNC ,BT_SK_KILLED , + BT_SK_CONNECTING, }; struct iso_pinfo {
@@ -316,6 +317,9 @@ static int __iso_chan_add(struct iso_conreturn -EBUSY ; } +if (iso_pi (sk)->conn) +return -EISCONN ; +if (!conn->hcon) {BT_ERR ("conn->hcon missing" );return -EIO ;
@@ -376,6 +380,11 @@ static int iso_connect_bis(struct sock *hci_dev_lock (hdev);lock_sock (sk); +if (iso_pi (sk)->conn) { + err = -EISCONN ; + goto unlock; + } +if (!bis_capable (hdev)) { err = -EOPNOTSUPP ; goto unlock;
@@ -524,6 +533,13 @@ static int iso_connect_cis(struct sock * } } +/* The socket lock keeps the current attachment and its hcon stable. */ +if (iso_pi (sk)->conn &&iso_pi (sk)->conn->hcon != hcon) { +hci_conn_drop (hcon); + err = -EISCONN ; + goto unlock; + } + conn =iso_conn_add (hcon);if (!conn) {hci_conn_drop (hcon);
@@ -1150,17 +1166,26 @@ static int iso_sock_connect(struct socke addr->sa_family != AF_BLUETOOTH)return -EINVAL ; -if (sk->sk_state !=BT_OPEN && sk->sk_state !=BT_BOUND ) -return -EBADFD ; +lock_sock (sk); -if (sk->sk_type !=SOCK_SEQPACKET ) -return -EINVAL ; +if ((sk->sk_state !=BT_OPEN && sk->sk_state !=BT_BOUND ) || +test_bit (BT_SK_CONNECTING , &iso_pi (sk)->flags)) { + err = -EBADFD ; + goto done; + } + +if (sk->sk_type !=SOCK_SEQPACKET ) { + err = -EINVAL ; + goto done; + }/* Check if the address type is of LE type */ -if (!bdaddr_type_is_le (sa->iso_bdaddr_type)) -return -EINVAL ; +if (!bdaddr_type_is_le (sa->iso_bdaddr_type)) { + err = -EINVAL ; + goto done; + } -lock_sock (sk); +set_bit (BT_SK_CONNECTING , &iso_pi (sk)->flags);bacpy (&iso_pi (sk)->dst, &sa->iso_bdaddr);iso_pi (sk)->dst_type = sa->iso_bdaddr_type;
@@ -1172,16 +1197,18 @@ static int iso_sock_connect(struct sockeelse err =iso_connect_bis (sk); -if (err) -return err; -lock_sock (sk); +clear_bit (BT_SK_CONNECTING , &iso_pi (sk)->flags); +if (err) + goto done; +if (!test_bit (BT_SK_DEFER_SETUP , &bt_sk (sk)->flags)) { err =bt_sock_wait_state (sk,BT_CONNECTED ,sock_sndtimeo (sk, flags &O_NONBLOCK )); } +done:release_sock (sk);return err; }
Greg Kroah-Hartman
maintainerPATCH 106/621 Bluetooth: MGMT: Fix status of pending commands flushed on power off
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Iaroslav Voitovych <[email protected]>
commit 86ef0f58bdecdedb3a1240971c56d71b7e4ce3fc upstream.
cmd_complete_rsp() receives a struct cmd_lookup and, for a pending command that has no cmd_complete callback, falls through to cmd_status_rsp(cmd, data). cmd_status_rsp() reads data as a u8 *, so the status sent comes from the first byte of match->sk's representation, not from match->mgmt_status.
commit f53e1c9c726d ("Bluetooth: MGMT: Fix possible crash on mgmt_index_removed") changed the callers' data from &status to &match and updated the cmd_complete branch to match->mgmt_status, but left the fall-through passing data unchanged.
In mgmt_index_removed() match->sk is NULL, so every such command is answered with status 0x00 (Success) instead of MGMT_STATUS_INVALID_INDEX. In __mgmt_power_off() it is NULL too, unless a Set Powered command was pending: then settings_rsp() has stored that command's socket in match->sk, and the byte sent comes from the socket pointer. Either way the status the caller set, MGMT_STATUS_NOT_POWERED (or MGMT_STATUS_INVALID_INDEX when the device is being unregistered), is lost.
Pass the status the callers set.
This was seen on a QCA9377 laptop: bluetoothd's Start Discovery, pending when the adapter was powered off, was answered with Command Status 0x00 and no parameters, and bluetoothd 5.72 crashed on the zero-length success. BlueZ master has since added the length check on that path ("adapter: Fix crash on short start discovery reply", BlueZ a734b06059cb), but userspace should still be told Not Powered, not Success.
Tested on Ubuntu 7.0.0-31 with a virtual controller (hci_vhci):
power off is held in HCI Write Scan Enable while a Start Discovery is submitted, and the flush answers it with status 0x00 before this change and 0x0f (Not Powered) after.
--- net/bluetooth/mgmt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/bluetooth/mgmt.c +1 -1
@@ -1492,7 +1492,7 @@ static void cmd_complete_rsp(struct mgmtreturn ; } -cmd_status_rsp (cmd, data); +cmd_status_rsp (cmd, &match->mgmt_status); }static int generic_cmd_complete (struct mgmt_pending_cmd *cmd,u8 status)
Greg Kroah-Hartman
maintainerPATCH 107/621 Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aldo Ariel Panzardo <[email protected]>
commit 816fb1590a4c8cf8d05cd076057616be02e276f0 upstream.
sco_recv_scodata() upgrades the weak hcon->sco_data back-pointer to a strong reference under hdev->lock:
hci_dev_lock(hdev);
hcon = hci_conn_hash_lookup_handle(hdev, handle);
...
conn = sco_conn_hold_unless_zero(hcon->sco_data);
hci_dev_unlock(hdev);but the pointer is cleared from the other side without that lock. When the last sco_conn reference is dropped, sco_conn_free() ran
conn->hcon->sco_data = NULL;
with no hdev->lock held, so the RX path could read hcon->sco_data and call kref_get_unless_zero() on an sco_conn that was concurrently freed:
BUG: KASAN: slab-use-after-free in sco_conn_hold_unless_zero+0xbe/0x160
Write of size 4 by task kworker/u17:0
Workqueue: hci0 hci_rx_work
Call Trace:
sco_conn_hold_unless_zero+0xbe/0x160
sco_recv_scodata+0x13f/0x490
hci_rx_work+0x3af/0x730kref_get_unless_zero() only guards against a zero refcount, not against the backing memory already being freed.
Give hcon->sco_data an actual reference on the sco_conn it points to, so the object cannot be freed while the pointer is still installed, and only clear and drop it from sco_conn_del(), which runs under hdev->lock (its callers, sco_connect_cfm() and sco_disconn_cfm(), hold it). The reader in sco_recv_scodata() also takes hdev->lock, so the store and the read are now serialised: the RX path either observes NULL or a reference that is guaranteed to stay valid until it drops its own.
sco_conn_add() no longer hands its kref_init() reference to the caller as the connection's only reference; that initial reference is the one owned by hcon->sco_data, and callers get their own via sco_conn_hold().
Because the sco_conn can now outlive the socket (the association keeps it alive until the link goes down), the hci_conn can no longer be dropped from sco_conn_free() without regressing socket close: closing a connected SCO socket must still tear the link down. Move hci_conn ownership to the socket instead: __sco_chan_add() takes an hci_conn reference and it is released from sco_chan_del() and sco_sock_destruct(), exactly once. The sco_conn no longer owns an hci_conn reference, so sco_conn_add() stops consuming one and sco_connect() drops the hci_connect_sco() reference on every path; sco_connect_cfm() no longer needs its hci_conn_hold() dance.
--- net/bluetooth/sco.c | 87 ++++++++++++++++++++++++++++++++++++++-------------- 1 file changed, 65 insertions(+), 22 deletions(-)
net/bluetooth/sco.c +65 -22
@@ -86,12 +86,14 @@ static void sco_conn_free(struct kref *rif (conn->sk)sco_pi (conn->sk)->conn =NULL ; -if (conn->hcon) { - conn->hcon->sco_data =NULL ; -hci_conn_drop (conn->hcon); - } +/* hcon->sco_data is cleared and the association's reference on the +* sco_conn is dropped in sco_conn_del() under hdev->lock, and the +* hci_conn is now owned by the socket (held in __sco_chan_add() and +* dropped in sco_chan_del()/sco_sock_destruct()), so there is nothing +* left to release towards hcon here. +*/ -/* Ensure no more work items will run since hci_conn has been dropped */ +/* Ensure no more work items will run before the connection is freed */ disable_delayed_work_sync (&conn->timeout_work);kfree (conn);
@@ -190,25 +192,19 @@ static void sco_sock_clear_timer(struct }/* ---- SCO connections ---- */ -/* Consumes a reference on @hcon, which the returned sco_conn owns until it is -* freed. On failure (NULL return) the reference is left for the caller to drop. +/* Returns a new reference the caller must drop with sco_conn_put(). The +* hcon->sco_data association holds its own reference on the sco_conn for the +* connection's lifetime; it is dropped in sco_conn_del() under hdev->lock. +* @hcon is not consumed: the hci_conn reference is taken and owned by the +* socket in __sco_chan_add(). */ static struct sco_conn *sco_conn_add (struct hci_conn *hcon) {struct sco_conn *conn = hcon->sco_data; conn =sco_conn_hold_unless_zero (conn); -if (conn) { -if (!conn->hcon) { -sco_conn_lock (conn); - conn->hcon = hcon; -sco_conn_unlock (conn); - }else { -/* conn already owns a reference on hcon */ -hci_conn_drop (hcon); - } +if (conn)return conn; - } conn =kzalloc (sizeof (struct sco_conn ),GFP_KERNEL );if (!conn)
@@ -229,7 +225,10 @@ static struct sco_conn *sco_conn_add(strBT_DBG ("hcon %p conn %p" , hcon, conn); -return conn; +/* kref_init() above set the association reference owned by +* hcon->sco_data; hand the caller its own reference. +*/ +return sco_conn_hold (conn); }/* Delete channel.
@@ -244,6 +243,19 @@ static void sco_chan_del(struct sock *skBT_DBG ("sk %p, conn %p, err %d" , sk, conn, err);if (conn) { +struct hci_conn *hcon; + +sco_conn_lock (conn); + hcon = conn->hcon; +sco_conn_unlock (conn); + +/* Drop the socket's hci_conn reference BEFORE clearing +* conn->sk, so sco_conn_del() on another CPU cannot free +* the hci_conn while we still hold a pointer to it. +*/ +if (hcon) +hci_conn_drop (hcon); +sco_conn_lock (conn); conn->sk =NULL ;sco_conn_unlock (conn);
@@ -268,6 +280,13 @@ static void sco_conn_del(struct hci_connBT_DBG ("hcon %p conn %p, err %d" , hcon, conn, err); +/* Detach from the hci_conn and drop the association's reference. +* The caller holds hdev->lock, which serialises this against the +* read of hcon->sco_data in sco_recv_scodata(). +*/ + hcon->sco_data =NULL ; +sco_conn_put (conn); +sco_conn_lock (conn); sk =sco_sock_hold (conn);sco_conn_unlock (conn);
@@ -292,6 +311,11 @@ static void __sco_chan_add(struct sco_cosco_pi (sk)->conn =sco_conn_hold (conn); conn->sk = sk; +/* The socket owns an hci_conn reference for as long as it stays +* attached; it is dropped in sco_chan_del()/sco_sock_destruct(). +*/ +hci_conn_hold (conn->hcon); +if (parent)bt_accept_enqueue (parent, sk, true); }
@@ -373,6 +397,7 @@ static int sco_connect(struct sock *sk)if (sk->sk_state !=BT_OPEN && sk->sk_state !=BT_BOUND ) {release_sock (sk);sco_conn_put (conn); +hci_conn_drop (hcon); err = -EBADFD ; goto unlock; }
@@ -381,9 +406,13 @@ static int sco_connect(struct sock *sk)sco_conn_put (conn);if (err) {release_sock (sk); +hci_conn_drop (hcon); goto unlock; } +/* __sco_chan_add() took its own hci_conn reference; drop ours. */ +hci_conn_drop (hcon); +/* Update source addr of the socket */ bacpy (&sco_pi (sk)->src, &hcon->src);
@@ -497,9 +526,25 @@ static struct sock *sco_get_sock_listen(static void sco_sock_destruct (struct sock *sk) { +struct sco_conn *conn =sco_pi (sk)->conn; +BT_DBG ("sk %p" , sk); -sco_conn_put (sco_pi (sk)->conn); +/* If the channel was not already torn down via sco_chan_del(), drop +* the socket's own references here. +*/ +if (conn) { +struct hci_conn *hcon; + +sco_conn_lock (conn); + hcon = conn->hcon; +sco_conn_unlock (conn); + +if (hcon) +hci_conn_drop (hcon); +sco_pi (sk)->conn =NULL ; +sco_conn_put (conn); + }skb_queue_purge (&sk->sk_receive_queue);skb_queue_purge (&sk->sk_write_queue);
@@ -1511,12 +1556,10 @@ static void sco_connect_cfm(struct hci_cif (!status) {struct sco_conn *conn; - conn =sco_conn_add (hci_conn_hold (hcon)); + conn =sco_conn_add (hcon);if (conn) {sco_conn_ready (conn);sco_conn_put (conn); - }else { -hci_conn_drop (hcon); } }else sco_conn_del (hcon,bt_to_errno (status));
Greg Kroah-Hartman
maintainerPATCH 108/621 Bluetooth: RFCOMM: free the skb when the DLC has no owner
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxim Skokov <[email protected]>
commit 9d1afbf60ed53c5b051cd124153e0ae3078c8b93 upstream.
rfcomm_recv_data() hands the skb to d->data_ready() and returns 0 without freeing it, so the callback owns the skb from that point on. The tty implementation frees it when the DLC has been detached from its device:
static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc,
struct sk_buff *skb)
{
struct rfcomm_dev *dev = dlc->owner; if (!dev) {
kfree_skb(skb);
return;
}The socket implementation returns without freeing it, and the skb is leaked.
A connected DLC can have no owner: rfcomm_sock_destruct() clears d->owner, while the DLC itself stays on the session until it is closed. Data frames that arrive in that window still find d->state == BT_CONNECTED in rfcomm_recv_data() and are handed to the callback, one leaked skb each.
The leak does not stop on its own either. The remote runs out of credits only once RFCOMM_RX_THROTTLED is set, and for a socket the only place that sets it is rfcomm_sk_data_ready() itself, below the return. rfcomm_process_dlcs() keeps granting credits, so the remote keeps sending and the leak keeps growing.
Free the skb, as the tty side does.
--- net/bluetooth/rfcomm/sock.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/bluetooth/rfcomm/sock.c +4 -1
@@ -50,8 +50,11 @@ static void rfcomm_sock_kill(struct sockstatic void rfcomm_sk_data_ready (struct rfcomm_dlc *d,struct sk_buff *skb) {struct sock *sk = d->owner; -if (!sk) + +if (!sk) { +kfree_skb (skb);return ; + }atomic_add (skb->len, &sk->sk_rmem_alloc);skb_queue_tail (&sk->sk_receive_queue, skb);
Greg Kroah-Hartman
maintainerPATCH 109/621 Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Palla Raghunath <[email protected]>
commit 08e90633377f1b2567ab5ad6810b74c552246a07 upstream.
syzbot hit a NULL pointer dereference in rfcomm_dev_shutdown() when an RFCOMM tty is closed.
rfcomm_dev_add() puts the new device on rfcomm_dev_list first and only then registers the tty device and saves it in dev->tty_dev. If that registration fails, dev->tty_dev is never set at all. The device can be looked up in the meantime, so an open() of /dev/rfcommN gets through rfcomm_tty_install() and attaches to it. When that tty is closed again, rfcomm_dev_shutdown() uses dev->tty_dev without checking it:
Oops: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] RIP: 0010:rfcomm_dev_shutdown+0x48/0xb0 net/bluetooth/rfcomm/tty.c:131 Call Trace: tty_port_shutdown+0x1bf/0x220 drivers/tty/tty_port.c:372 tty_port_close+0x4e/0x150 drivers/tty/tty_port.c:705 tty_release+0x359/0x1670 drivers/tty/tty_io.c:1718 __fput+0x418/0xa50 fs/file_table.c:512
rfcomm_dev_destruct() already copes with a NULL dev->tty_dev. Add the same check to rfcomm_dev_shutdown(), so the tty device is only moved when it was actually registered.
--- net/bluetooth/rfcomm/tty.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/bluetooth/rfcomm/tty.c +1 -1
@@ -131,7 +131,7 @@ static void rfcomm_dev_shutdown(struct t { struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port); -if (dev->tty_dev->parent) +if (dev->tty_dev && dev->tty_dev->parent)device_move (dev->tty_dev,NULL ,DPM_ORDER_DEV_LAST );/* close the dlc */
Greg Kroah-Hartman
maintainerPATCH 110/621 drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nguyen Ngoc Thang <[email protected]>
commit 755c94d178b7e972bb766199d34e4ba4f63a89eb upstream.
__drm_fb_helper_initial_config_and_unlock() calls drm_client_modeset_probe() first, which already fills in each mode_set->mode/num_connectors for every connected output, and only afterwards calls drm_fb_helper_single_fb_probe() to create fb_helper->fb and wire it into those mode_sets via drm_setup_crtcs_fb().
If drm_fb_helper_single_fb_probe() fails with anything other than -EAGAIN (e.g. dev->driver->fbdev_probe() itself fails), the function bails out before drm_setup_crtcs_fb() runs and before setting fb_helper->deferred_setup. The client is left with mode_sets that have a mode and connectors but mode_set->fb == NULL, and nothing marks this fb_helper as needing a retry.
__drm_fb_helper_restore_fbdev_mode_unlocked() only skips committing when fb_helper->deferred_setup is set, so a later .restore() call (drm_lastclose() on process exit, in this report) commits the stale mode_set through drm_client_modeset_commit() -> drm_client_modeset_commit_atomic() -> __drm_atomic_helper_set_config(), which hits WARN_ON(!set->fb).
Mark fb_helper->deferred_setup on any drm_fb_helper_single_fb_probe() failure, not just -EAGAIN, so restore keeps skipping the commit until a later hotplug event successfully re-probes and re-populates mode_set->fb. The real error code is still returned to the caller unchanged.
--- drivers/gpu/drm/drm_fb_helper.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/drm_fb_helper.c +3 -3
@@ -1800,10 +1800,10 @@ __drm_fb_helper_initial_config_and_unloc ret =drm_fb_helper_single_fb_probe (fb_helper);if (ret <0 ) { -if (ret == -EAGAIN ) { - fb_helper->deferred_setup = true; +/* modesets are probed but fb_helper->fb isn't; defer restore too */ + fb_helper->deferred_setup = true; +if (ret == -EAGAIN ) ret =0 ; - }mutex_unlock (&fb_helper->lock); goto err_drm_fb_helper_release_info;
Greg Kroah-Hartman
maintainerPATCH 111/621 drm/gud: dont keep a connector without a CRTC as connector_state
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sajal Gupta <[email protected]>
commit 71ec70ea26e399eb8371fe9d2d5bf5dab09570fb upstream.
If the 'for_each_new_connector_in_state()' loop finishes without hitting the break, connector_state is left pointing at the last connector visited, which has no CRTC, instead of staying NULL.
That skips the "if (!connector_state)" fallback below the loop, which looks up the active connector when the state contains none. The function then carries on with a connector that is not driven.
Fix by resetting connector_state to NULL for each connector visited that has no CRTC, so that it is NULL when none was found and the fallback runs.
--- drivers/gpu/drm/gud/gud_pipe.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/gud/gud_pipe.c +1 -0
@@ -507,6 +507,7 @@ int gud_plane_atomic_check(struct drm_plfor_each_new_connector_in_state (state, connector, connector_state, i) {if (connector_state->crtc)break ; + connector_state =NULL ; }/*
Greg Kroah-Hartman
maintainerPATCH 112/621 drm/i915/gem: Prevent overstepping exec array boundary
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Karas <[email protected]>
commit ebe162db655881a38de43301151ff7ac940602b5 upstream.
It is possible for eb_relocate_parse_slow() to call kvfree() on entries outside the original exec array during following scenario inside eb_relocate_parse_slow():
1) eb_copy_relocations() allocates as many as eb->buffer_count copies for exec entries;
2) eb_parse() appends up to two VMAs, right after incrementing eb->buffer_count;
3) cleanup under "out" label uses this incremented buffer_count to release relocation pointers from exec array via kvfree(), not from VMA array.
To amend this problem, ensure that relocation cleanup uses the original exec object count, excluding the VMAs appended by the command parser.
--- drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c +1 -1
@@ -1765,6 +1765,7 @@ static int eb_reinit_userptr(struct i915 static noinline int eb_relocate_parse_slow(struct i915_execbuffer *eb) { +const unsigned int count = eb->buffer_count;bool have_copy = false;struct eb_vma *ev;int err =0 ;
@@ -1867,7 +1868,6 @@ err: out:if (have_copy) { -const unsigned int count = eb->buffer_count;unsigned int i;for (i =0 ; i < count; i++) {
Greg Kroah-Hartman
maintainerPATCH 113/621 drm/i915/gt: Unmask interrupts only when ACTIVE is true
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Karas <[email protected]>
commit 5346b1cec6afa4f9b4b49a9f84e3cfef95a3f7bb upstream.
There is a small race window between intel_rps_boost() reading a stale ACTIVE state and queuing rps->work, where ACTIVE may be changed via asynchronous calls triggered by wakeref drop. This means that rps_work() could be triggered after the GT has been parked, so unmasking RPS PM interrupts would happen without holding PM wakelock. This sequence of events may be observed during live_rc6_ctx_wa() selftest:
1) live_rc6_ctx_wa()
-> intel_engine_pm_put()
-> wakeref_put()
ASYNC1) wakeref_put() callback
-> __engine_park()
-> intel_gt_pm_put_async()
-> intel_gt_pm_put_async_untracked()
-> intel_wakeref_put_async()ASYNC2) wakeref_put_async() callback
-> __gt_park()
-> intel_rps_park()
-> intel_rps_clear_active() [clear ACTIVE]
WITH INTERRUPTS:
-> rps_disable_interrupts()
-> cancel_work_sync(rps->work)
-> rps_reset_interrupts() [rps->pm_iir = 0]
WITHOUT INTERRUPTS (TIMER mode):
-> rps_stop_timer()
-> cancel_work_sync(rps->work)2) live_rc6_ctx_wa()
-> intel_gt_wait_for_idle()
-> intel_gt_retire_requests_timeout()
-> dma_fence_wait_timeout()
-> ops->wait() [i915_fence_wait()]
-> i915_request_wait_timeout()
-> intel_rps_boost()
-> intel_rps_is_active() [check ACTIVE]
[OPEN RACE WINDOW]
-> queue_work(rps->work)
-> retire_requests()
-> i915_request_retire()
-> intel_rps_dec_waiters() [from 1 to 0]If ASYNC1 and ASYNC2 would execute during [OPEN RACE WINDOW], then:
3) rps_work() executes from the workqueue and may satisfy "(!pm_iir && !client_boost)" test (in TIMER mode rps->pm_iir is zeroed by an earlier rps_work() call or never gets a new value after previous intel_rps_unpark() event), so it jumps to "out" label, bypassing intel_rps_is_active() guard and executes gen6_gt_pm_unmask_irq();
4) GT is parked and runtime PM wakelock is dropped, so only a raw reference in __gt_park() -> intel_display_power_put_async() remains for 100ms, then the MMIO write in gen6_gt_pm_unmask_irq() detects missing wakelock via assert_rpm_wakelock_held() and emits "RPM wakelock ref not held during HW access" tainting kernel.
Commit 3e7abf814193 ("drm/i915: Extract GT render power state management") dropped the "if (rps->interrupts_enabled)" guard that gen6_pm_rps_work() had around this unmask in i915_irq.c. INTEL_RPS_ACTIVE brackets the same window, since it is set in intel_rps_unpark() before rps_enable_interrupts() and rps_start_timer() and cleared in intel_rps_park() before rps_stop_timer() and rps_disable_interrupts().
Skip unmasking when RPS is no longer active (reaching unmask operation is independent of INTERRUPT mode). This does not prevent RPS operation from resuming on the next unpark. In interrupt mode, intel_rps_unpark() calls rps_enable_interrupts(), which enables and unmasks the PM interrupts. In timer mode, it calls rps_start_timer(), restarting periodic engine-busyness evaluation. The timer generates software RPS events and queues rps_work() directly, independently of PM interrupt delivery. Neither mode requires the late worker to unmask interrupts while the GT is parked
--- drivers/gpu/drm/i915/gt/intel_rps.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/i915/gt/intel_rps.c +2 -1
@@ -1904,7 +1904,8 @@ static void rps_work(struct work_struct out:spin_lock_irq (gt->irq_lock); -gen6_gt_pm_unmask_irq (gt, rps->pm_events); +if (intel_rps_is_active (rps)) +gen6_gt_pm_unmask_irq (gt, rps->pm_events);spin_unlock_irq (gt->irq_lock); }
Greg Kroah-Hartman
maintainerPATCH 114/621 drm/imagination: Size page table preallocation by device address
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gyeyoung Baek <[email protected]>
commit 789f290b2e81d42820bddcb4010ffbc2ae2ded54 upstream.
Commit 0a8224058a58 ("drm/imagination: Fix page count for page table for map() interface") passed the device address to pvr_mmu_op_context_create(), but the preallocation is still sized from device_addr + sgt_offset with an exclusive end. The offset into the object's pages has no place in a device-virtual range, and the exclusive end allocates one table too many when the range ends on a table boundary.
Count the tables from device_addr and the inclusive end of the range.
The new calculation does not take page table indices into account. This fixes another issue with the previous implementation, where the difference between start and end indices could underflow when a mapping crossed a page table boundary. This would lead to the driver preallocating a huge number of MMU pages, exhausting system memory and triggering an out of memory panic.
--- drivers/gpu/drm/imagination/pvr_mmu.c | 25 ++++++++++++------------- 1 file changed, 12 insertions(+), 13 deletions(-)
drivers/gpu/drm/imagination/pvr_mmu.c +12 -13
@@ -2339,7 +2339,7 @@ void pvr_mmu_op_context_destroy(struct p* @ctx: MMU context associated with owning VM context. * @sgt: Scatter gather table containing pages pinned for use by this context. * @device_addr: Virtual device address at the start of the requested mapping. -* @sgt_offset: Start offset of the requested device-virtual memory mapping. +* @sgt_offset: Offset into @sgt of the start of the requested mapping. * @size: Size in bytes of the requested device-virtual memory mapping. For an * unmapping, this should be zero so that no page tables are allocated. *
@@ -2352,7 +2352,6 @@ struct pvr_mmu_op_context * pvr_mmu_op_context_create(struct pvr_mmu_context *ctx, struct sg_table *sgt, u64 device_addr, u64 sgt_offset, u64 size) { - u64 start_addr = device_addr + sgt_offset; int err; struct pvr_mmu_op_context *op_ctx =
@@ -2368,18 +2367,18 @@ pvr_mmu_op_context_create(struct pvr_mmuif (size) {/* -* The number of page table objects we need to prealloc is -* indicated by the mapping size, start address and the sizes -* of the areas mapped per PT or PD. The range calculation is -* identical to that for the index into a table for a device -* address, so we reuse those functions here. +* The page tables needed are set by the device-virtual range +* being mapped: one level 1 table per 1GiB region and one +* level 0 table per 2MiB region the range touches. Tables that +* already exist are not consumed, so this is an upper bound. */ -const u32 l1_start_idx =pvr_page_table_l2_idx (start_addr); -const u32 l1_end_idx =pvr_page_table_l2_idx (start_addr + size); -const u32 l1_count = l1_end_idx - l1_start_idx +1 ; -const u32 l0_start_idx =pvr_page_table_l1_idx (start_addr); -const u32 l0_end_idx =pvr_page_table_l1_idx (start_addr + size); -const u32 l0_count = l0_end_idx - l0_start_idx +1 ; +const u64 last_addr = device_addr + size -1 ; +const u64 l1_count = + (last_addr >>ROGUE_MMUCTRL_VADDR_PC_INDEX_SHIFT ) - + (device_addr >>ROGUE_MMUCTRL_VADDR_PC_INDEX_SHIFT ) +1 ; +const u64 l0_count = + (last_addr >>ROGUE_MMUCTRL_VADDR_PD_INDEX_SHIFT ) - + (device_addr >>ROGUE_MMUCTRL_VADDR_PD_INDEX_SHIFT ) +1 ;/* * Alloc and push page table entries until we have enough of
Greg Kroah-Hartman
maintainerPATCH 115/621 drm/vc4: drain the hangcheck timer and works on V3D unbind
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <[email protected]>
commit 94cf5971b1d04c6382437387c4dc3836cc7a1437 upstream.
Nothing stops the hangcheck timer that submitted jobs arm, or the job_done_work that the render-done interrupt queues, at teardown:vc4_irq_disable() cancels only overflow_mem_work, and vc4_gem_destroy() runs from the drm-managed release, after vc4_v3d_unbind() has already uninstalled the V3D interrupt and cleared vc4->v3d. A timer still armed by then reads V3D registers through the NULL vc4->v3d pointer, and the late callbacks run on the vc4_dev embedding them after it has been freed.
Drain them in vc4_v3d_unbind(): shut the timer down and cancel reset_work before the interrupt is taken down, because its vc4_irq_reset() re-enables it, then flush job_done_work so that completions queued at teardown still release their jobs.
This issue was found by an in-house static analysis tool.
--- drivers/gpu/drm/vc4/vc4_v3d.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/gpu/drm/vc4/vc4_v3d.c +8 -0
@@ -9,6 +9,7 @@#include <linux/component.h> #include <linux/platform_device.h> #include <linux/pm_runtime.h> +#include <linux/timer.h> #include "vc4_drv.h" #include "vc4_regs.h"
@@ -495,8 +496,15 @@ static void vc4_v3d_unbind(struct devicestruct drm_device *drm = data;struct vc4_dev *vc4 =to_vc4_dev (drm); +/* A straggler vc4_reset() re-enables the interrupt. */ +timer_shutdown_sync (&vc4->hangcheck.timer); +cancel_work_sync (&vc4->hangcheck.reset_work); +vc4_irq_uninstall (drm); +/* Flush rather than cancel, so queued completions release their jobs. */ +flush_work (&vc4->job_done_work); +/* Disable the binner's overflow memory address, so the next * driver probe (if any) doesn't try to reuse our old * allocation.
Greg Kroah-Hartman
maintainerPATCH 116/621 drm/vc4: Fix firmware reference leak in vc4_drm_bind()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <[email protected]>
commit b816da5d5df1461446a0a5f3fe2b4948a659a790 upstream.
The firmware reference obtained via rpi_firmware_get() is leaked when aperture_remove_all_conflicting_devices() fails, as the error label returns without putting it. This happens before the firmware is consumed and put further down in the function.
Put the firmware reference before jumping to err.
--- drivers/gpu/drm/vc4/vc4_drv.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/gpu/drm/vc4/vc4_drv.c +4 -1
@@ -361,8 +361,11 @@ static int vc4_drm_bind(struct device *d } ret =aperture_remove_all_conflicting_devices (driver->name); -if (ret) +if (ret) { +if (firmware) +rpi_firmware_put (firmware); goto err; + }if (firmware) { ret = rpi_firmware_property(firmware,
Greg Kroah-Hartman
maintainerPATCH 117/621 drm/vmwgfx: validate pitch coming from userspace
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zack Rusin <[email protected]>
commit 21bc51cb89ced74d6645a138cc2f21184bc75094 upstream.
Validate the pitch, alongside the box dimensions before trying to copy data from the underlying surface. Fixes possible out of bounds reads with cursor snooping.
--- drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-)
drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c +21 -5
@@ -324,6 +324,7 @@ void vmw_kms_cursor_snoop(struct vmw_surunsigned long kmap_num;SVGA3dCopyBox *box;u32 box_count; +u64 src_extent;void *virtual;bool is_iomem;struct vmw_dma_cmd {
@@ -335,6 +336,8 @@ void vmw_kms_cursor_snoop(struct vmw_survmw_surface_get_desc (VMW_CURSOR_SNOOP_FORMAT );const u32 image_pitch =VMW_CURSOR_SNOOP_WIDTH * desc->pitchBytesPerBlock; +BUILD_BUG_ON (sizeof (*srf->snooper.image) != desc->pitchBytesPerBlock); + cmd = container_of(header, struct vmw_dma_cmd, header);/* No snooper installed, nothing to copy */
@@ -372,8 +375,19 @@ void vmw_kms_cursor_snoop(struct vmw_surreturn ; } +if (box->w ==0 || box->h ==0 ) +return ; + + src_extent = (u64)(box->h -1 ) * cmd->dma.guest.pitch + + (u64 )box->w * desc->pitchBytesPerBlock; +if (src_extent > bo->base.size) { +DRM_ERROR ("Cursor snoop source of %llu bytes exceeds the %zu byte buffer\n" , + src_extent, bo->base.size); +return ; + } + kmap_offset = cmd->dma.guest.ptr.offset >>PAGE_SHIFT ; - kmap_num = (VMW_CURSOR_SNOOP_HEIGHT * image_pitch) >>PAGE_SHIFT ; + kmap_num =PFN_UP (src_extent); ret =ttm_bo_reserve (bo, true, false,NULL );if (unlikely (ret !=0 )) {
@@ -387,14 +401,16 @@ void vmw_kms_cursor_snoop(struct vmw_sur virtual =ttm_kmap_obj_virtual (&map, &is_iomem); -if (box->w ==VMW_CURSOR_SNOOP_WIDTH && cmd->dma.guest.pitch == image_pitch) { +if (box->w ==VMW_CURSOR_SNOOP_WIDTH && + box->h ==VMW_CURSOR_SNOOP_HEIGHT && + cmd->dma.guest.pitch == image_pitch) {memcpy (srf->snooper.image, virtual,VMW_CURSOR_SNOOP_HEIGHT * image_pitch); }else { -/* Image is unsigned pointer. */ +/* The destination stride is in pixels. */ for (i =0 ; i < box->h; i++) -memcpy (srf->snooper.image + i * image_pitch, - virtual + i * cmd->dma.guest.pitch, +memcpy (srf->snooper.image + i *VMW_CURSOR_SNOOP_WIDTH , + virtual + (size_t )i * cmd->dma.guest.pitch, box->w * desc->pitchBytesPerBlock); } srf->snooper.id++;
Greg Kroah-Hartman
maintainerPATCH 118/621 drm/xe: Fix shrinker accounting double-subtraction on nested external pins
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Hellström <[email protected]>
commit 83d5acca1f4f6132038ea88c72c5844f62e42d44 upstream.
xe_bo_pin_external() and xe_bo_unpin_external() support nested pins, since the underlying ttm_bo_pin()/ttm_bo_unpin() maintain a pin_count refcount rather than a boolean. However, the shrinker accounting calls xe_ttm_tt_account_subtract() and xe_ttm_tt_account_add() are invoked unconditionally on every pin_external()/unpin_external() call, instead of only on the transition into and out of the pinned state.
An external BO (dma-buf) can be pinned more than once while already pinned, for example when it has multiple attachments/importers, each independently calling xe_bo_pin_external(). Each such nested pin subtracts the BO's pages from the shrinker's accounting again, even though the BO's pages were already removed from consideration by the first pin. Symmetrically, each nested unpin adds them back again before the BO is actually unpinned. This desynchronizes the shrinker's page and object counts from reality, and since they are declared as signed long but interpreted as unsigned long in xe_shrinker_count(), the underflow can turn into an enormous shrinkable/purgeable page count, causing the shrinker to be invoked excessively under memory pressure.
Guard the accounting calls with the same pin-count transition checks already used to guard the pinned_link list maintenance, so accounting is only updated on the outermost pin and the final unpin.
While centralizing this logic into xe_bo_account_pin()/ xe_bo_account_unpin(), also close a second, related accounting gap affecting imported dma-bufs. For an imported bo's ttm_tt, xe's ttm_tt_populate hook (xe_ttm_tt_populate()) early-returns without calling xe_ttm_tt_account_add(), since TTM_TT_FLAG_EXTERNAL is set without TTM_TT_FLAG_EXTERNAL_MAPPABLE. However, TTM core's ttm_tt_populate() wrapper unconditionally marks the tt as populated on driver-hook success, so ttm_tt_is_populated() still reports true for it. xe_bo_account_pin()/xe_bo_account_unpin() trusted ttm_tt_is_populated() as a proxy for "these pages are accounted for by the shrinker", and would subtract/add pages for such a tt that were never added in the first place, again underflowing the shrinker's counts. This is reachable today via xe_bo_pin_external(), and would have become newly reachable via the fb-pin path once this patch routes __xe_pin_fb_vma() through xe_bo_pin_account() below, so fix it here rather than in a later patch, to avoid a commit in this series that introduces the regression before fixing it. Skip the accounting for imported bos, using the same EXTERNAL && !EXTERNAL_MAPPABLE test xe_ttm_tt_populate()/xe_ttm_tt_unpopulate() use to decide whether to act, via a new xe_ttm_bo_is_imported() helper (hoisted up from its only prior use site).
v2:
- Fix the critical issue caught by Sashiko AI review: the pin-count transition check introduced here was still bypassed by the fb-pin path (__xe_pin_fb_vma()/__xe_unpin_fb_vma()), which could leave a stale pinned_link entry and a permanent shrinker accounting leak when the fb-unpin performed the true last unpin. Addressed in a separate follow-up patch in this series rather than folded in here, since it is a distinct bug with its own Fixes: tag.
- Drop the unneeded local "last_unpin" variable in xe_bo_unpin_external(), restoring the original inline bo->ttm.pin_count == 1 check; it was a no-op rename not used by any of the new accounting helpers, and was going to be deleted again by the follow-up patch anyway.
v3:
- Exclude imported dma-bufs from the pin/unpin shrinker accounting, fixing another underflow caught by Sashiko AI review.
- Add a short comment on the backup-object pin site noting it's already populated/accounted at pin time, addressing (as a false-positive clarification, no code fix needed) a separate Medium-severity accounting-leak concern also caught by Sashiko AI review.
--- drivers/gpu/drm/xe/display/xe_fb_pin.c | 6 - drivers/gpu/drm/xe/xe_bo.c | 116 +++++++++++++++++++++++++-------- drivers/gpu/drm/xe/xe_bo.h | 2 3 files changed, 95 insertions(+), 29 deletions(-)
drivers/gpu/drm/xe/display/xe_fb_pin.c +3 -3
@@ -308,7 +308,7 @@ static struct i915_vma *__xe_pin_fb_vma(drm_exec_retry_on_contention (&exec);xe_validation_retry_on_oom (&ctx, &ret);if (!ret) -ttm_bo_pin (&bo->ttm); +xe_bo_pin_account (bo); }if (ret) goto err;
@@ -325,7 +325,7 @@ static struct i915_vma *__xe_pin_fb_vma( err_unpin:ttm_bo_reserve (&bo->ttm, false, false,NULL ); -ttm_bo_unpin (&bo->ttm); +xe_bo_unpin_account (bo);ttm_bo_unreserve (&bo->ttm); err:kfree (vma);
@@ -346,7 +346,7 @@ static void __xe_unpin_fb_vma(struct i91xe_ggtt_node_remove (vma->node, false);ttm_bo_reserve (&vma->bo->ttm, false, false,NULL ); -ttm_bo_unpin (&vma->bo->ttm); +xe_bo_unpin_account (vma->bo);ttm_bo_unreserve (&vma->bo->ttm);kfree (vma); }
drivers/gpu/drm/xe/xe_bo.c +90 -26
185 lines not on this page · raw message
drivers/gpu/drm/xe/xe_bo.h +2 -0
@@ -225,6 +225,8 @@ int xe_bo_pin_external(struct xe_bo *bo,int xe_bo_pin (struct xe_bo *bo,struct drm_exec *exec);void xe_bo_unpin_external (struct xe_bo *bo);void xe_bo_unpin (struct xe_bo *bo); +void xe_bo_pin_account (struct xe_bo *bo); +void xe_bo_unpin_account (struct xe_bo *bo);int xe_bo_validate (struct xe_bo *bo,struct xe_vm *vm,bool allow_res_evict,struct drm_exec *exec);
Greg Kroah-Hartman
maintainerPATCH 119/621 drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Hellström <[email protected]>
commit cf238c067eaae1cbfb00738e29219b9568d2313e upstream.
xe_bo_pin_external() and xe_bo_unpin_external() maintain the bo's pinned_link list membership in xe->pinned.late.external, based on whether the current call is the outermost pin or the final unpin. However, the same external bo's pin_count can also be raised and lowered directly by __xe_pin_fb_vma()/__xe_unpin_fb_vma(), which pin the bo as a display scanout buffer without going through xe_bo_pin_external()/xe_bo_unpin_external() at all, and have no notion of, or ownership over, pinned_link.
If a bo is pinned both externally (e.g. dma-buf export) and as an fb, and the external unpin happens first, xe_bo_unpin_external() correctly observes pin_count > 1 and leaves the bo on pinned_link. When the fb unpin later performs the true last unpin (pin_count 1 -> 0), it never touches pinned_link, leaving the bo linked on xe->pinned.late.external indefinitely. Once the bo is subsequently freed, this stale list entry points into freed memory, corrupting the list and risking a use-after-free the next time the list is walked or spliced.
The backup object pin/unpin sites in xe_bo_notifier_prepare_pinned()/ xe_bo_notifier_unprepare_pinned() have the same bypass characteristic, though they never add their bo to a pinned list, so are not affected by this particular list-corruption issue.
Move the pinned_link removal into xe_bo_account_unpin(), which already runs on every unpin path (kernel, external, framebuffer, backup object) right before the true 1 -> 0 pin_count transition. Since list_del_init() only operates on the node itself, this removal is list-agnostic and safe to perform regardless of which list (external or kernel_bo_present) the bo happens to be linked on, or which code path is performing the final unpin. Drop the now-redundant explicit list_del_init() calls in xe_bo_unpin_external() and xe_bo_unpin().
v2:
- New patch
v3:
- Rebased on changes to previous patch.
--- drivers/gpu/drm/xe/xe_bo.c | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-)
drivers/gpu/drm/xe/xe_bo.c +16 -9
@@ -466,12 +466,27 @@ static void xe_bo_account_pin(struct xe_* ttm_bo_unpin(), so that the check against the true 1->0 transition sees * the pin count that is about to be released. See xe_bo_account_pin() for * why imported bos are excluded. +* +* On the true last unpin, also removes @bo from whichever pinned-bo list +* (external or kernel_bo_present) it may currently be linked on, since a +* bo's final unpin can happen through a pin path (e.g. framebuffer, +* backup object) that has no notion of, or ownership over, that list. +* This is safe and list-agnostic: list_del_init() only needs the node +* itself, not knowledge of which list it is threaded through, and is a +* no-op if @bo is not linked. */ static void xe_bo_account_unpin (struct xe_bo *bo) {struct xe_device *xe =xe_bo_device (bo); +bool last_unpin = bo->ttm.pin_count ==1 ; + +if (last_unpin && !list_empty (&bo->pinned_link)) { +spin_lock (&xe->pinned.lock); +list_del_init (&bo->pinned_link); +spin_unlock (&xe->pinned.lock); + } -if (bo->ttm.pin_count ==1 && bo->ttm.ttm &&ttm_tt_is_populated (bo->ttm.ttm) && +if (last_unpin && bo->ttm.ttm &&ttm_tt_is_populated (bo->ttm.ttm) && !xe_ttm_bo_is_imported (&bo->ttm))xe_ttm_tt_account_add (xe, bo->ttm.ttm); }
@@ -2940,11 +2955,6 @@ void xe_bo_unpin_external(struct xe_bo *xe_assert (xe,xe_bo_is_pinned (bo));xe_assert (xe,xe_bo_is_user (bo)); -spin_lock (&xe->pinned.lock); -if (bo->ttm.pin_count ==1 && !list_empty (&bo->pinned_link)) -list_del_init (&bo->pinned_link); -spin_unlock (&xe->pinned.lock); -xe_bo_unpin_account (bo);/*
@@ -2963,10 +2973,7 @@ void xe_bo_unpin(struct xe_bo *bo)xe_assert (xe,xe_bo_is_pinned (bo));if (mem_type_is_vram (place->mem_type) || bo->flags &XE_BO_FLAG_GGTT ) { -spin_lock (&xe->pinned.lock);xe_assert (xe, !list_empty (&bo->pinned_link)); -list_del_init (&bo->pinned_link); -spin_unlock (&xe->pinned.lock);if (bo->backup_obj) {if (xe_bo_is_pinned (bo->backup_obj))
Greg Kroah-Hartman
maintainerPATCH 120/621 drm/amdkfd: align SDMA doorbell base for shader doorbell writes
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saleel Kudchadker <[email protected]>
commit f145d5b3f740de05d85257acdc82f6877180f5c6 upstream.
On GC 9.4.3, 9.4.4 and 9.5.0, doorbell writes issued from shaders are routed to an SDMA engine at 32-byte (4 doorbell index) granularity. SDMA engine doorbell ranges are 10 indices apart, so the range of every odd engine starts 2 indices into a 4-index block that begins in the previous engine's range. A shader ringing the doorbell of a queue on an odd engine therefore rings the previous engine instead. The intended queue never sees the doorbell, so its work stalls and the application hangs.
Align the per-engine doorbell base up to a 4-index boundary on these ASICs. Each engine only uses 4 of its 10 indices, so the aligned base plus the queue offset stays within the engine's range. Even engines are already aligned, so only the doorbell IDs of odd-engine queues change.
Only doorbells rung by the device itself are routed this way. Doorbell writes from the host, including the kernel's own SDMA rings, are not affected.
The doorbell ID of an SDMA queue is saved in CRIU checkpoints and checked again on restore. A checkpoint taken before this change that contains an SDMA queue on an odd engine will fail to restore with -EINVAL. This is intentional: the restored process still holds the old doorbell address, so accepting the stale ID would bring back the same stall.
Tested on MI300X with a shader-rung SDMA doorbell test: queues on odd engines hung before this change and complete with it.
v2: use u32 instead of uint32_t for the new locals (checkpatch)
v3: name the routing granularity, use dev->node_id, document the
layout invariants, describe impact
v4: express the granularity in doorbell indices, drop unrelated
cleanups, explain the CRIU restore behavior, add test note
--- drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 32 ++++++++++++++---- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 7 +++ 2 files changed, 33 insertions(+), 6 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c +26 -6
@@ -459,12 +459,32 @@ static int allocate_doorbell(struct qcm_* we need the physical sdma engine id in order to get the * correct doorbell offset. */ -uint32_t valid_id = idx_offset[qpd->dqm->dev->node_id * -get_num_all_sdma_engines (qpd->dqm) + - q->properties.sdma_engine_id] - + (q->properties.sdma_queue_id &1 ) - *KFD_QUEUE_DOORBELL_MIRROR_OFFSET - + (q->properties.sdma_queue_id >>1 ); +u32 engine_base = idx_offset[dev->node_id * +get_num_all_sdma_engines (qpd->dqm) + + q->properties.sdma_engine_id]; +u32 valid_id; + +/* +* With the aqua_vanjaram doorbell layout, a shader doorbell +* write whose 32-byte block starts in the previous engine's +* range rings that engine instead. Engine ranges are 10 +* indices apart (sdma_doorbell_range = 20 dwords, halved for +* 8-byte doorbells, in aqua_vanjaram_doorbell_index_init()), +* which puts odd engines 2 indices into a shared block. +* Aligning costs at most 2 indices, and 8 queues per engine use +* only 4 of the 10, so the aligned base stays in range. The +* 512-index mirror offset keeps the alignment. +*/ +if (KFD_GC_VERSION (dev) ==IP_VERSION (9 ,4 ,3 ) || +KFD_GC_VERSION (dev) ==IP_VERSION (9 ,4 ,4 ) || +KFD_GC_VERSION (dev) ==IP_VERSION (9 ,5 ,0 )) + engine_base =ALIGN (engine_base, +KFD_SDMA_SHADER_DOORBELL_GRANULARITY ); + + valid_id = engine_base + + (q->properties.sdma_queue_id &1 ) * +KFD_QUEUE_DOORBELL_MIRROR_OFFSET + + (q->properties.sdma_queue_id >>1 );if (restore_id && *restore_id != valid_id)return -EINVAL ;
drivers/gpu/drm/amd/amdkfd/kfd_priv.h +7 -0
@@ -132,6 +132,13 @@*/ #define KFD_QUEUE_DOORBELL_MIRROR_OFFSET 512 +/* +* On GC 9.4.3, 9.4.4 and 9.5.0, doorbell writes issued from shaders are +* routed to an SDMA engine at 32-byte granularity, i.e. 4 indices with the +* 8-byte SDMA doorbells used on SOC15. +*/ +#define KFD_SDMA_SHADER_DOORBELL_GRANULARITY 4 +/** * enum kfd_ioctl_flags - KFD ioctl flags * Various flags that can be set in &amdkfd_ioctl_desc.flags to control how
Greg Kroah-Hartman
maintainerPATCH 121/621 drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haojie Li <[email protected]>
commit e6895021a328594368a2a19406a53ffca1ce51c7 upstream.
When kzalloc fails for metadata_buffer in amdgpu_amdkfd_get_dmabuf_info(), the function returns -ENOMEM directly without calling dma_buf_put(), leaking the dma_buf reference obtained earlier via dma_buf_get().
Fix both issues by:
- Adding an error check after the first amdgpu_bo_get_metadata() call
- Replacing the direct return with r = -ENOMEM and goto out_put to ensure dma_buf_put() is called on all error paths
--- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c +6 -2
@@ -567,14 +567,18 @@ int amdgpu_amdkfd_get_dmabuf_info(struct/* first get metadata_size by buffer = NULL */ r =amdgpu_bo_get_metadata (bo,NULL ,0 , metadata_size,NULL ); +if (r) + goto out_put;/* user buf_size is bigger than bo metadata_size * allocate a buf at kernel space and copy */ if (*metadata_size <= buffer_size) { *metadata_buffer =kzalloc (*metadata_size,GFP_KERNEL ); -if (!*metadata_buffer) -return -ENOMEM ; +if (!*metadata_buffer) { + r = -ENOMEM ; + goto out_put; + } r =amdgpu_bo_get_metadata (bo, *metadata_buffer, *metadata_size,NULL , &metadata_flags);
Greg Kroah-Hartman
maintainerPATCH 122/621 drm/amdgpu: serialize vblank counter reads against GPU reset
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitaly Prosyak <[email protected]>
commit 1a6023edfbb5673f55fab6348f135fb3b1428ea5 upstream.
The vblank counter callback reads display registers and scanout position without holding reset_domain->sem. During GPU recovery, display commit work can call the callback while reset owns the semaphore for writing. The hardware access then triggers the lockdep_assert_held() in amdgpu_device_skip_hw_access() and sets TAINT_WARN when lockdep is enabled.
Try to acquire the reset semaphore for reading before accessing the hardware, and hold it across the counter and scanout-position reads. If reset is already in progress, return DRM's cached software vblank count instead. This avoids blocking behind reset and avoids accessing display hardware while it is being reset.
The cached count is less accurate than the hardware count, but is used only when reset prevents a safe hardware read. This addresses the reset-time warning from this vblank path; it does not suppress or fix unrelated lockdep warnings.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +5 -0
@@ -30,6 +30,7 @@#include <drm/amdgpu_drm.h> #include <drm/drm_drv.h> #include <drm/drm_fb_helper.h> +#include <drm/drm_vblank.h> #include "amdgpu_uvd.h" #include "amdgpu_vce.h" #include "atom.h"
@@ -1572,6 +1573,9 @@ u32 amdgpu_get_vblank_counter_kms(structDRM_ERROR ("Invalid crtc %u\n" , pipe);return -EINVAL ; } +if (!down_read_trylock (&adev->reset_domain->sem)) +return drm_crtc_vblank_count (crtc); +/* The hw increments its frame counter at start of vsync, not at start * of vblank, as is required by DRM core vblank counter handling.
@@ -1617,6 +1621,7 @@ u32 amdgpu_get_vblank_counter_kms(structDRM_DEBUG_VBL ("NULL mode info! Returned count may be wrong.\n" ); } +up_read (&adev->reset_domain->sem);return count; }
Greg Kroah-Hartman
maintainerPATCH 123/621 drm/amdgpu: make Mac FB workaround generic
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit c7f44ec5c4ec760e74351f1843dcb8322f67cbf6 upstream.
Rather than adding a case of every chip where this is seen just check if the FB is at 0 and the ssid is apple. This should cover all chips which fall into this case.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c +7 -10
@@ -1022,20 +1022,17 @@ void amdgpu_gmc_get_vbios_allocations(stcase CHIP_RENOIR : adev->mman.keep_stolen_vga_memory = true;break ; -case CHIP_POLARIS10 : -case CHIP_POLARIS11 : -case CHIP_POLARIS12 : -/* MacBookPros with switchable graphics put VRAM at 0 when -* the iGPU is enabled which results in cursor issues if -* the cursor ends up at 0. Reserve vram at 0 in that case. -*/ -if (adev->gmc.vram_start ==0 ) - adev->mman.keep_stolen_vga_memory = true; -break ;default : adev->mman.keep_stolen_vga_memory = false;break ; } +/* MacBookPros with switchable graphics put VRAM at 0 when +* the iGPU is enabled which results in cursor issues if +* the cursor ends up at 0. Reserve vram at 0 in that case. +*/ +if ((adev->pdev->subsystem_vendor ==PCI_VENDOR_ID_APPLE ) && + (adev->gmc.vram_start ==0 )) + adev->mman.keep_stolen_vga_memory = true;if (amdgpu_sriov_vf (adev) || !amdgpu_device_has_display_hardware (adev)) {
Greg Kroah-Hartman
maintainerPATCH 124/621 drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Gavrilov <[email protected]>
commit 16c64495859f13f75602f439588883f2a4a4d6a6 upstream.
Reading or writing a register through the amdgpu_regs2 debugfs file with GRBM bank selection, which umr does for every banked access (a single "umr -b x x x -r <reg>" is enough, as is the wave dump with "-O halt_waves"), makes lockdep report a circular locking dependency, after which lockdep stays off until reboot:
WARNING: possible circular locking dependency detected
umr/63306 is trying to acquire lock:
ffff8882cf4b8350 (&mm->mmap_lock){++++}-{4:4}, at: __might_fault+0x9b/0x140
but task is already holding lock:
ffff8881aec010d0 (&amdgpu_grbm_lock_key){+.+.}-{4:4}, at: amdgpu_debugfs_regs2_op.isra.0+0x20d/0xd00 [amdgpu]
...
Chain exists of:
&mm->mmap_lock --> &amdgpu_srbm_lock_key --> &amdgpu_grbm_lock_key
...
__might_fault+0xc5/0x140
amdgpu_debugfs_regs2_op.isra.0+0x441/0xd00 [amdgpu]
full_proxy_write+0x10e/0x1d0
vfs_write+0x1d0/0xf50
ksys_write+0x116/0x250amdgpu_debugfs_regs2_op() and amdgpu_debugfs_process_reg_op() call get_user()/put_user() for every dword while holding grbm_idx_mutex or srbm_mutex, and pm.mutex if requested, so a fault there takes mmap_lock inside those locks. The lock hierarchy in amdgpu_lockdep.c puts srbm_mutex and grbm_idx_mutex below notifier_lock, which amdgpu_cs_submit() takes with the BO reservations held, and dma_resv_lockdep() orders the reservations inside mmap_lock. So mmap_lock is outside grbm_idx_mutex and srbm_mutex, and these two debugfs paths nest it the other way round. The copies under the locks are as old as the bank selection in both files; commit 1d0f5838b126 ("drm/amdgpu: Add lockdep annotations for lock ordering validation") only made them visible to lockdep.
Copy the user buffer in before any of the locks is taken and the result out after all of them are dropped, as amdgpu_debugfs_wave_read(), amdgpu_debugfs_gpr_read() and amdgpu_debugfs_gprwave_read() already do. The buffer is sized by the count passed to read() or write(), so an access larger than PAGE_SIZE is now rejected with -EINVAL; umr reads and writes one register at a time. A fault on the user buffer of a write now fails with -EFAULT before any register is written, instead of after a partial write.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 77 ++++++++++++++++------------ 1 file changed, 46 insertions(+), 31 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +46 -31
@@ -114,6 +114,20 @@ static int amdgpu_debugfs_process_reg_o *pos &= (1UL <<22 ) -1 ; +if (size >PAGE_SIZE ) +return -EINVAL ; + +/* +* Access the user buffer only while none of the locks below are held: +* a fault takes mmap_lock, and grbm_idx_mutex and srbm_mutex nest +* inside it. +*/ + u32 *data __free(kfree) = kmalloc(size, GFP_KERNEL); +if (!data) +return -ENOMEM ; +if (!read &©_from_user (data, buf, size)) +return -EFAULT ; + r =pm_runtime_get_sync (adev_to_drm (adev)->dev);if (r <0 ) {pm_runtime_put_autosuspend (adev_to_drm (adev)->dev);
@@ -146,28 +160,16 @@ static int amdgpu_debugfs_process_reg_omutex_lock (&adev->pm.mutex);while (size) { -uint32_t value; - -if (read) { - value =RREG32 (*pos >>2 ); - r =put_user (value, (uint32_t *)buf); - }else { - r =get_user (value, (uint32_t *)buf); -if (!r) -amdgpu_mm_wreg_mmio_rlc (adev, *pos >>2 , value,0 ); - } -if (r) { - result = r; - goto end; - } +if (read) + data[result >>2 ] =RREG32 (*pos >>2 ); +else +amdgpu_mm_wreg_mmio_rlc (adev, *pos >>2 , data[result >>2 ],0 ); result +=4 ; - buf +=4 ; *pos +=4 ; size -=4 ; } -end:if (use_bank) {amdgpu_gfx_select_se_sh (adev,0xffffffff ,0xffffffff ,0xffffffff ,0 );mutex_unlock (&adev->grbm_idx_mutex);
@@ -183,6 +185,10 @@ end:pm_runtime_put_autosuspend (adev_to_drm (adev)->dev);amdgpu_virt_disable_access_debugfs (adev); + +if (read &©_to_user (buf, data, result)) +return -EFAULT ; +return result; }
@@ -233,11 +239,24 @@ static ssize_t amdgpu_debugfs_regs2_op(sstruct amdgpu_device *adev = rd->adev;ssize_t result =0 ;int r; -uint32_t value;if (size &0x3 || offset &0x3 )return -EINVAL ; +if (size >PAGE_SIZE ) +return -EINVAL ; + +/* +* Access the user buffer only while none of the locks below are held: +* a fault takes mmap_lock, and grbm_idx_mutex and srbm_mutex nest +* inside it. +*/ + u32 *data __free(kfree) = kmalloc(size, GFP_KERNEL); +if (!data) +return -ENOMEM ; +if (write_en &©_from_user (data, buf, size)) +return -EFAULT ; + r =pm_runtime_get_sync (adev_to_drm (adev)->dev);if (r <0 ) {pm_runtime_put_autosuspend (adev_to_drm (adev)->dev);
@@ -277,24 +296,16 @@ static ssize_t amdgpu_debugfs_regs2_op(smutex_lock (&adev->pm.mutex);while (size) { -if (!write_en) { - value =RREG32 (offset >>2 ); - r =put_user (value, (uint32_t *)buf); - }else { - r =get_user (value, (uint32_t *)buf); -if (!r) -amdgpu_mm_wreg_mmio_rlc (adev, offset >>2 , value, rd->id.xcc_id); - } -if (r) { - result = r; - goto end; - } +if (!write_en) + data[result >>2 ] =RREG32 (offset >>2 ); +else +amdgpu_mm_wreg_mmio_rlc (adev, offset >>2 , data[result >>2 ], + rd->id.xcc_id); offset +=4 ; size -=4 ; result +=4 ; - buf +=4 ; } -end: +if (rd->id.use_grbm) {amdgpu_gfx_select_se_sh (adev,0xffffffff ,0xffffffff ,0xffffffff , rd->id.xcc_id);mutex_unlock (&adev->grbm_idx_mutex);
@@ -314,6 +325,10 @@ end:pm_runtime_put_autosuspend (adev_to_drm (adev)->dev);amdgpu_virt_disable_access_debugfs (adev); + +if (!write_en &©_to_user (buf, data, result)) +return -EFAULT ; +return result; }