6.1.191-rc1 review
Subsystems (12)
Greg Kroah-Hartman
maintainerPATCH 1184/1887 bpf: Fix UAF in sock clone early bailouts
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Bobrowski <[email protected]>
[ Upstream commit 7cbd0c4cebe4c9f678d15e6b9ba975e1155a107f ]
Similar to recent commit 9b51a6155d14 ("bpf,fork: wipe ->bpf_storage before bailouts that access it"), sk_clone() performs an initial shallow copy of the socket field ->sk_bpf_storage via sock_copy() for the cloned socket newsk.
If sk_clone() bails out early (e.g. if sk_filter_charge() fails) prior to calling bpf_sk_storage_clone(), newsk->sk_bpf_storage still points to the parent socket's BPF local storage. When newsk is subsequently freed via sk_free(), the deallocation path (__sk_destruct() -> bpf_sk_storage_free()) destroys the parent socket's BPF local storage, leading to a use-after-free (UAF) on the parent socket.
Fix this by resetting newsk->sk_bpf_storage to NULL immediately after sock_copy() in sk_clone(), and remove the now redundant initialization from bpf_sk_storage_clone().
--- net/core/bpf_sk_storage.c | 2 -- net/core/sock.c | 3 +++ 2 files changed, 3 insertions(+), 2 deletions(-)
net/core/bpf_sk_storage.c +0 -2
@@ -164,8 +164,6 @@ int bpf_sk_storage_clone(const struct sock *sk, struct sock *newsk)struct bpf_local_storage_elem *selem;int ret =0 ; -RCU_INIT_POINTER (newsk->sk_bpf_storage,NULL ); -rcu_read_lock (); sk_storage =rcu_dereference (sk->sk_bpf_storage);
net/core/sock.c +3 -0
@@ -2261,6 +2261,9 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)sock_copy (newsk, sk); newsk->sk_prot_creator = prot; +#ifdef CONFIG_BPF_SYSCALL +RCU_INIT_POINTER (newsk->sk_bpf_storage,NULL ); +#endif /* SANITY */ if (likely (newsk->sk_net_refcnt)) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1185/1887 firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mostafa Saleh <[email protected]>
[ Upstream commit 3383ffb7ef937317361713ffcc21921a7848511a ]
Sashiko (locally) reports multiple out-of-bound issues in ffa_setup_and_transmit:
1) Writing ep_mem_access->reserved can write out of bounds for FFA versions < 1.2 as ffa_emad_size_get() returns 16 bytes in that case while reserved has an offset of 24.
Instead of zeroing fields, memset the struct to zero first based on the FFA version.
2) Make sure there is enough size to write constituents.
While at it, convert the only sizeof() in the driver that uses a type instead of variable.
--- drivers/firmware/arm_ffa/driver.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/firmware/arm_ffa/driver.c +2 -2
@@ -554,7 +554,7 @@ ffa_setup_and_transmit(u32 func_id, void *buffer, u32 max_fragsize, constituents = buffer; } -if ((void *)constituents - buffer > max_fragsize) { +if ((void *)constituents +sizeof (*constituents) - buffer > max_fragsize) {pr_err ("Memory Region Fragment > Tx Buffer size\n" );return -EFAULT ; }
@@ -563,7 +563,7 @@ ffa_setup_and_transmit(u32 func_id, void *buffer, u32 max_fragsize, constituents->pg_cnt = args->sg->length /FFA_PAGE_SIZE ; constituents->reserved =0 ; constituents++; - frag_len +=sizeof (struct ffa_mem_region_addr_range ); + frag_len +=sizeof (*constituents); }while ((args->sg =sg_next (args->sg))); return ffa_transmit_fragment(func_id, addr, buf_sz, frag_len,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1186/1887 wifi: cfg80211: use wiphy work for socket owner autodisconnect
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang <[email protected]>
[ Upstream commit 0c2ed186bbe14304415476d6707b747dddcd8583 ]
nl80211_netlink_notify() walks the cfg80211 wireless device list when a NETLINK_GENERIC socket is released. If the socket owns a connection, the notifier queues the embedded wdev->disconnect_wk work item.
That work is a plain work_struct today. NETDEV_GOING_DOWN cancels it, but a NETLINK_URELEASE notifier that already observed conn_owner_nlportid can queue it after that cancel returns. _cfg80211_unregister_wdev() then removes the wdev from the list and waits for RCU readers, but synchronize_net() does not drain work queued by such a reader.
Make the autodisconnect work a wiphy_work instead. The callback already needs the wiphy mutex, and wiphy_work runs under that mutex. This lets teardown cancel pending autodisconnect work while holding the mutex, without a cancel_work_sync() vs. worker locking concern.
Also cancel the wiphy work after list_del_rcu() and synchronize_net(). Any NETLINK_URELEASE notifier that had already reached the wdev list has then either queued the work and it is removed, or can no longer find the wdev.
--- include/net/cfg80211.h | 2 +- net/wireless/core.c | 7 ++++--- net/wireless/core.h | 2 +- net/wireless/nl80211.c | 3 ++- net/wireless/sme.c | 6 ++---- 5 files changed, 10 insertions(+), 10 deletions(-)
include/net/cfg80211.h +1 -1
@@ -5917,7 +5917,7 @@ struct wireless_dev {enum ieee80211_bss_type conn_bss_type;u32 conn_owner_nlportid; -struct work_struct disconnect_wk; +struct wiphy_work disconnect_wk;u8 disconnect_bssid[ETH_ALEN ];struct list_head event_list;
net/wireless/core.c +4 -3
@@ -1216,6 +1216,7 @@ static void _cfg80211_unregister_wdev(struct wireless_dev *wdev,list_del_rcu (&wdev->list);synchronize_net (); rdev->devlist_generation++; +wiphy_work_cancel (wdev->wiphy, &wdev->disconnect_wk);cfg80211_mlme_purge_registrations (wdev);
@@ -1404,7 +1405,7 @@ void cfg80211_init_wdev(struct wireless_dev *wdev) wdev->iftype == NL80211_IFTYPE_ADHOC) && !wdev->use_4addr) wdev->netdev->priv_flags |= IFF_DONT_BRIDGE; -INIT_WORK (&wdev->disconnect_wk, cfg80211_autodisconnect_wk); +wiphy_work_init (&wdev->disconnect_wk, cfg80211_autodisconnect_wk); } void cfg80211_register_wdev(struct cfg80211_registered_device *rdev,
@@ -1512,9 +1513,9 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,wiphy_lock (&rdev->wiphy);cfg80211_leave (rdev, wdev);cfg80211_remove_links (wdev); -wiphy_unlock (&rdev->wiphy);/* since we just did cfg80211_leave() nothing to do there */ -cancel_work_sync (&wdev->disconnect_wk); +wiphy_work_cancel (wdev->wiphy, &wdev->disconnect_wk); +wiphy_unlock (&rdev->wiphy);break ;case NETDEV_DOWN :wiphy_lock (&rdev->wiphy);
net/wireless/core.h +1 -1
@@ -427,7 +427,7 @@ void __cfg80211_port_authorized(struct wireless_dev *wdev, const u8 *bssid, const u8 *td_bitmap, u8 td_bitmap_len);int cfg80211_mgd_wext_connect (struct cfg80211_registered_device *rdev,struct wireless_dev *wdev); -void cfg80211_autodisconnect_wk (struct work_struct *work); +void cfg80211_autodisconnect_wk (struct wiphy *wiphy,struct wiphy_work *work);/* SME implementation */ void cfg80211_conn_work (struct work_struct *work);
net/wireless/nl80211.c +2 -1
@@ -19798,7 +19798,8 @@ static int nl80211_netlink_notify(struct notifier_block * nb, wdev->nl_owner_dead = true;schedule_work (&rdev->destroy_work); }else if (wdev->conn_owner_nlportid == notify->portid) { -schedule_work (&wdev->disconnect_wk); +wiphy_work_queue (wdev->wiphy, + &wdev->disconnect_wk); }cfg80211_release_pmsr (wdev, notify->portid);
net/wireless/sme.c +2 -4
@@ -1557,13 +1557,12 @@ int cfg80211_disconnect(struct cfg80211_registered_device *rdev,* Used to clean up after the connection / connection attempt owner socket * disconnects */ -void cfg80211_autodisconnect_wk (struct work_struct *work) +void cfg80211_autodisconnect_wk (struct wiphy *wiphy,struct wiphy_work *work) {struct wireless_dev *wdev = container_of(work, struct wireless_dev, disconnect_wk); -struct cfg80211_registered_device *rdev =wiphy_to_rdev (wdev->wiphy); +struct cfg80211_registered_device *rdev =wiphy_to_rdev (wiphy); -wiphy_lock (wdev->wiphy);wdev_lock (wdev);if (wdev->conn_owner_nlportid) {
@@ -1602,5 +1601,4 @@ void cfg80211_autodisconnect_wk(struct work_struct *work) }wdev_unlock (wdev); -wiphy_unlock (wdev->wiphy); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1187/1887 wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peddolla Harshavardhan Reddy <[email protected]>
[ Upstream commit 2b0eab425e1f658d8fe1df7590e3b9af5959505e ]
When a netlink socket that owns a PMSR session is closed, cfg80211_release_pmsr() clears the request's nl_portid and queues pmsr_free_wk to call cfg80211_pmsr_process_abort() asynchronously.
If the interface tears down concurrently, cfg80211_pmsr_wdev_down() is called under wiphy_lock and calls cancel_work_sync(&pmsr_free_wk) to wait for any running work. The work function acquires wiphy_lock via guard(wiphy) before calling process_abort.
This is a deadlock: wdev_down holds wiphy_lock and blocks inside cancel_work_sync(); pmsr_free_wk blocks trying to acquire that same wiphy_lock. Neither thread can proceed.
The same deadlock is reachable from cfg80211_leave_locked(), which calls cfg80211_pmsr_wdev_down() for all interface types under wiphy_lock.
Fix this by converting pmsr_free_wk from a plain work_struct to a wiphy_work. The wiphy_work dispatcher holds wiphy_lock when running work items, so the explicit guard(wiphy) in the work function is no longer needed. wiphy_work_cancel() can be called safely while holding wiphy_lock - since wiphy_lock prevents the work from running concurrently, wiphy_work_cancel() never blocks, eliminating the deadlock.
Remove the cancel_work_sync() for pmsr_free_wk from the NETDEV_GOING_DOWN handler. cfg80211_leave(), called unconditionally just before it, already cancels any pending work under wiphy_lock via wiphy_work_cancel() inside cfg80211_pmsr_wdev_down().
--- include/net/cfg80211.h | 2 +- net/wireless/core.c | 4 ++-- net/wireless/core.h | 2 +- net/wireless/pmsr.c | 6 +++--- 4 files changed, 7 insertions(+), 7 deletions(-)
include/net/cfg80211.h +1 -1
@@ -5959,7 +5959,7 @@ struct wireless_dev {struct list_head pmsr_list;spinlock_t pmsr_lock; -struct work_struct pmsr_free_wk; +struct wiphy_work pmsr_free_wk;unsigned long unprot_beacon_reported;
net/wireless/core.c +2 -2
@@ -1201,7 +1201,7 @@ static void _cfg80211_unregister_wdev(struct wireless_dev *wdev,ASSERT_RTNL ();lockdep_assert_held (&rdev->wiphy.mtx); -flush_work (&wdev->pmsr_free_wk); +wiphy_work_flush (wdev->wiphy, &wdev->pmsr_free_wk);nl80211_notify_iface (rdev, wdev,NL80211_CMD_DEL_INTERFACE );
@@ -1383,7 +1383,7 @@ void cfg80211_init_wdev(struct wireless_dev *wdev)INIT_LIST_HEAD (&wdev->mgmt_registrations);INIT_LIST_HEAD (&wdev->pmsr_list);spin_lock_init (&wdev->pmsr_lock); -INIT_WORK (&wdev->pmsr_free_wk, cfg80211_pmsr_free_wk); +wiphy_work_init (&wdev->pmsr_free_wk, cfg80211_pmsr_free_wk);#ifdef CONFIG_CFG80211_WEXT wdev->wext.default_key =-1 ;
net/wireless/core.h +1 -1
@@ -575,7 +575,7 @@ cfg80211_bss_update(struct cfg80211_registered_device *rdev,void cfg80211_release_pmsr (struct wireless_dev *wdev,u32 portid);void cfg80211_pmsr_wdev_down (struct wireless_dev *wdev); -void cfg80211_pmsr_free_wk (struct work_struct *work); +void cfg80211_pmsr_free_wk (struct wiphy *wiphy,struct wiphy_work *work);void cfg80211_remove_link (struct wireless_dev *wdev,unsigned int link_id);void cfg80211_remove_links (struct wireless_dev *wdev);
net/wireless/pmsr.c +3 -3
@@ -635,7 +635,7 @@ static void cfg80211_pmsr_process_abort(struct wireless_dev *wdev) } } -void cfg80211_pmsr_free_wk (struct work_struct *work) +void cfg80211_pmsr_free_wk (struct wiphy *wiphy,struct wiphy_work *work) { struct wireless_dev *wdev = container_of(work, struct wireless_dev, pmsr_free_wk);
@@ -657,7 +657,7 @@ void cfg80211_pmsr_wdev_down(struct wireless_dev *wdev) }spin_unlock_bh (&wdev->pmsr_lock); -cancel_work_sync (&wdev->pmsr_free_wk); +wiphy_work_cancel (wdev->wiphy, &wdev->pmsr_free_wk);if (found)cfg80211_pmsr_process_abort (wdev);
@@ -672,7 +672,7 @@ void cfg80211_release_pmsr(struct wireless_dev *wdev, u32 portid)list_for_each_entry (req, &wdev->pmsr_list, list) {if (req->nl_portid == portid) { req->nl_portid =0 ; -schedule_work (&wdev->pmsr_free_wk); +wiphy_work_queue (wdev->wiphy, &wdev->pmsr_free_wk); } }spin_unlock_bh (&wdev->pmsr_lock);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1188/1887 wifi: mac80211: refactor populating mesh related fields in sinfo
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sarika Sharma <[email protected]>
[ Upstream commit e5328c14590d034dc586e56aaab88e966d06efa7 ]
Introduce the sta_set_mesh_sinfo() to populate mesh related fields in sinfo structure for station statistics.
This will allow for the simplified population of other fields in the sinfo structure for link level in a subsequent patch to add support for MLO station statistics.
No functionality changes added.
Stable-dep-of: aa2eb6252518 ("wifi: mac80211: defer link RX stats percpu free to RCU")
--- net/mac80211/sta_info.c | 64 ++++++++++++++++++++++------------------- 1 file changed, 35 insertions(+), 29 deletions(-)
net/mac80211/sta_info.c +35 -29
@@ -2498,6 +2498,39 @@ static inline u64 sta_get_stats_bytes(struct ieee80211_sta_rx_stats *rxstats)return value; } +#ifdef CONFIG_MAC80211_MESH +static void sta_set_mesh_sinfo (struct sta_info *sta, +struct station_info *sinfo) +{ +struct ieee80211_local *local = sta->sdata->local; + + sinfo->filled |=BIT_ULL (NL80211_STA_INFO_LLID ) | +BIT_ULL (NL80211_STA_INFO_PLID ) | +BIT_ULL (NL80211_STA_INFO_PLINK_STATE ) | +BIT_ULL (NL80211_STA_INFO_LOCAL_PM ) | +BIT_ULL (NL80211_STA_INFO_PEER_PM ) | +BIT_ULL (NL80211_STA_INFO_NONPEER_PM ) | +BIT_ULL (NL80211_STA_INFO_CONNECTED_TO_GATE ) | +BIT_ULL (NL80211_STA_INFO_CONNECTED_TO_AS ); + + sinfo->llid = sta->mesh->llid; + sinfo->plid = sta->mesh->plid; + sinfo->plink_state = sta->mesh->plink_state; +if (test_sta_flag (sta,WLAN_STA_TOFFSET_KNOWN )) { + sinfo->filled |=BIT_ULL (NL80211_STA_INFO_T_OFFSET ); + sinfo->t_offset = sta->mesh->t_offset; + } + sinfo->local_pm = sta->mesh->local_pm; + sinfo->peer_pm = sta->mesh->peer_pm; + sinfo->nonpeer_pm = sta->mesh->nonpeer_pm; + sinfo->connected_to_gate = sta->mesh->connected_to_gate; + sinfo->connected_to_as = sta->mesh->connected_to_as; + + sinfo->filled |=BIT_ULL (NL80211_STA_INFO_AIRTIME_LINK_METRIC ); + sinfo->airtime_link_metric =airtime_link_metric_get (local, sta); +} +#endif +void sta_set_sinfo (struct sta_info *sta,struct station_info *sinfo,bool tidstats) {
@@ -2681,31 +2714,10 @@ void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo,sta_set_tidstats (sta, &sinfo->pertid[i], i); } -if (ieee80211_vif_is_mesh (&sdata->vif)) {#ifdef CONFIG_MAC80211_MESH - sinfo->filled |=BIT_ULL (NL80211_STA_INFO_LLID ) | -BIT_ULL (NL80211_STA_INFO_PLID ) | -BIT_ULL (NL80211_STA_INFO_PLINK_STATE ) | -BIT_ULL (NL80211_STA_INFO_LOCAL_PM ) | -BIT_ULL (NL80211_STA_INFO_PEER_PM ) | -BIT_ULL (NL80211_STA_INFO_NONPEER_PM ) | -BIT_ULL (NL80211_STA_INFO_CONNECTED_TO_GATE ) | -BIT_ULL (NL80211_STA_INFO_CONNECTED_TO_AS ); - - sinfo->llid = sta->mesh->llid; - sinfo->plid = sta->mesh->plid; - sinfo->plink_state = sta->mesh->plink_state; -if (test_sta_flag (sta,WLAN_STA_TOFFSET_KNOWN )) { - sinfo->filled |=BIT_ULL (NL80211_STA_INFO_T_OFFSET ); - sinfo->t_offset = sta->mesh->t_offset; - } - sinfo->local_pm = sta->mesh->local_pm; - sinfo->peer_pm = sta->mesh->peer_pm; - sinfo->nonpeer_pm = sta->mesh->nonpeer_pm; - sinfo->connected_to_gate = sta->mesh->connected_to_gate; - sinfo->connected_to_as = sta->mesh->connected_to_as; +if (ieee80211_vif_is_mesh (&sdata->vif)) +sta_set_mesh_sinfo (sta, sinfo);#endif - } sinfo->bss_param.flags =0 ;if (sdata->vif.bss_conf.use_cts_prot)
@@ -2761,12 +2773,6 @@ void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo, sinfo->filled |=BIT_ULL (NL80211_STA_INFO_ACK_SIGNAL_AVG ); } - -if (ieee80211_vif_is_mesh (&sdata->vif)) { - sinfo->filled |=BIT_ULL (NL80211_STA_INFO_AIRTIME_LINK_METRIC ); - sinfo->airtime_link_metric = -airtime_link_metric_get (local, sta); - } }u32 sta_get_expected_throughput (struct sta_info *sta)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1189/1887 wifi: cfg80211: add link_station_info structure to support MLO statistics
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sarika Sharma <[email protected]>
[ Upstream commit d2329fff7e527e8b350086be2e7cbf0d190177a3 ]
Current implementation of NL80211_GET_STATION does not work for multi-link operation(MLO) since in case of MLO only deflink (or one of the links) is considered and not all links.
Therefore to support for MLO, add link_station_info structure to account link level statistics for station.
Additionally, add valid_links in station_info structure to indicate bitmap of valid links for MLO. This will be helpful to check the link related statistics during MLO.
Stable-dep-of: aa2eb6252518 ("wifi: mac80211: defer link RX stats percpu free to RCU")
--- include/net/cfg80211.h | 101 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 101 insertions(+)
include/net/cfg80211.h +101 -0
@@ -1858,6 +1858,99 @@ struct cfg80211_tid_stats {#define IEEE80211_MAX_CHAINS 4 +/** +* struct link_station_info - link station information +* +* Link station information filled by driver for get_station() and +* dump_station(). +* @filled: bit flag of flags using the bits of &enum nl80211_sta_info to +* indicate the relevant values in this struct for them +* @connected_time: time(in secs) since a link of station is last connected +* @inactive_time: time since last activity for link station(tx/rx) +* in milliseconds +* @assoc_at: bootime (ns) of the last association of link of station +* @rx_bytes: bytes (size of MPDUs) received from this link of station +* @tx_bytes: bytes (size of MPDUs) transmitted to this link of station +* @signal: The signal strength, type depends on the wiphy's signal_type. +* For CFG80211_SIGNAL_TYPE_MBM, value is expressed in _dBm_. +* @signal_avg: Average signal strength, type depends on the wiphy's +* signal_type. For CFG80211_SIGNAL_TYPE_MBM, value is expressed in _dBm_ +* @chains: bitmask for filled values in @chain_signal, @chain_signal_avg +* @chain_signal: per-chain signal strength of last received packet in dBm +* @chain_signal_avg: per-chain signal strength average in dBm +* @txrate: current unicast bitrate from this link of station +* @rxrate: current unicast bitrate to this link of station +* @rx_packets: packets (MSDUs & MMPDUs) received from this link of station +* @tx_packets: packets (MSDUs & MMPDUs) transmitted to this link of station +* @tx_retries: cumulative retry counts (MPDUs) for this link of station +* @tx_failed: number of failed transmissions (MPDUs) (retries exceeded, no ACK) +* @rx_dropped_misc: Dropped for un-specified reason. +* @bss_param: current BSS parameters +* @beacon_loss_count: Number of times beacon loss event has triggered. +* @expected_throughput: expected throughput in kbps (including 802.11 headers) +* towards this station. +* @rx_beacon: number of beacons received from this peer +* @rx_beacon_signal_avg: signal strength average (in dBm) for beacons received +* from this peer +* @rx_duration: aggregate PPDU duration(usecs) for all the frames from a peer +* @tx_duration: aggregate PPDU duration(usecs) for all the frames to a peer +* @airtime_weight: current airtime scheduling weight +* @pertid: per-TID statistics, see &struct cfg80211_tid_stats, using the last +* (IEEE80211_NUM_TIDS) index for MSDUs not encapsulated in QoS-MPDUs. +* Note that this doesn't use the @filled bit, but is used if non-NULL. +* @ack_signal: signal strength (in dBm) of the last ACK frame. +* @avg_ack_signal: average rssi value of ack packet for the no of msdu's has +* been sent. +* @rx_mpdu_count: number of MPDUs received from this station +* @fcs_err_count: number of packets (MPDUs) received from this station with +* an FCS error. This counter should be incremented only when TA of the +* received packet with an FCS error matches the peer MAC address. +* @addr: For MLO STA connection, filled with address of the link of station. +*/ +struct link_station_info { +u64 filled; +u32 connected_time; +u32 inactive_time; +u64 assoc_at; +u64 rx_bytes; +u64 tx_bytes; +s8 signal; +s8 signal_avg; + +u8 chains; +s8 chain_signal[IEEE80211_MAX_CHAINS ]; +s8 chain_signal_avg[IEEE80211_MAX_CHAINS ]; + +struct rate_info txrate; +struct rate_info rxrate; +u32 rx_packets; +u32 tx_packets; +u32 tx_retries; +u32 tx_failed; +u32 rx_dropped_misc; +struct sta_bss_parameters bss_param; + +u32 beacon_loss_count; + +u32 expected_throughput; + +u64 tx_duration; +u64 rx_duration; +u64 rx_beacon; +u8 rx_beacon_signal_avg; + +u16 airtime_weight; + +s8 ack_signal; +s8 avg_ack_signal; +struct cfg80211_tid_stats *pertid; + +u32 rx_mpdu_count; +u32 fcs_err_count; + +u8 addr[ETH_ALEN ]__aligned(2) ; +}; +/** * struct station_info - station information *
@@ -1924,6 +2017,11 @@ struct cfg80211_tid_stats {* received packet with an FCS error matches the peer MAC address. * @airtime_link_metric: mesh airtime link metric. * @connected_to_as: true if mesh STA has a path to authentication server +* @valid_links: bitmap of valid links, or 0 for non-MLO. Drivers fill this +* information in cfg80211_new_sta(), cfg80211_del_sta_sinfo(), +* get_station() and dump_station() callbacks. +* @links: reference to Link sta entries for MLO STA, all link specific +* information is accessed through links[link_id]. */ struct station_info {u64 filled;
@@ -1983,6 +2081,9 @@ struct station_info {u32 airtime_link_metric;u8 connected_to_as; + +u16 valid_links; +struct link_station_info *links[IEEE80211_MLD_MAX_NUM_LINKS ]; };/**
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1190/1887 wifi: mac80211: defer link RX stats percpu free to RCU
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maoyi Xie <[email protected]>
[ Upstream commit aa2eb62525188269cdd402a583b9a8ed94657ff0 ]
sta_remove_link() frees a removed MLO link's RX stats percpu buffer right away, but defers only the link container to RCU:
sta_info_free_link(&alloc->info); kfree_rcu(alloc, rcu_head);
The RX fast path reads link_sta under rcu_read_lock and writes the percpu stats. A reader that resolved link_sta before the removal keeps the pointer. The container stays alive from the kfree_rcu, so the read still works. But the percpu block it points to is already freed. This needs uses_rss. That is when pcpu_rx_stats exists.
The full STA teardown frees the deflink stats only after synchronize_net(). The link removal path had no such barrier. The race is hard to win in practice, but the free should still wait for RCU.
Free the link together with its data from a single RCU callback, so the percpu block is reclaimed only after readers drain.
--- net/mac80211/sta_info.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
net/mac80211/sta_info.c +11 -4
@@ -351,6 +351,15 @@ static void sta_info_free_link(struct link_sta_info *link_sta)free_percpu (link_sta->pcpu_rx_stats); } +static void sta_link_free_rcu (struct rcu_head *head) +{ +struct sta_link_alloc *alloc = + container_of(head, struct sta_link_alloc, rcu_head); + +sta_info_free_link (&alloc->info); +kfree (alloc); +} +static void sta_remove_link (struct sta_info *sta,unsigned int link_id,bool unhash) {
@@ -373,10 +382,8 @@ static void sta_remove_link(struct sta_info *sta, unsigned int link_id, sta->sta.valid_links &= ~BIT (link_id);RCU_INIT_POINTER (sta->link[link_id],NULL );RCU_INIT_POINTER (sta->sta.link[link_id],NULL ); -if (alloc) { -sta_info_free_link (&alloc->info); -kfree_rcu (alloc, rcu_head); - } +if (alloc) +call_rcu (&alloc->rcu_head, sta_link_free_rcu);ieee80211_sta_recalc_aggregates (&sta->sta); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1191/1887 RDMA/irdma: Prevent user-triggered null deref on QP create
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Moroni <[email protected]>
[ Upstream commit b9b0889071569d43623c260074e159cd8f26adb1 ]
Previously, the user QP creation path would only attempt to populate iwqp->iwpbl if the user-provided req.user_wqe_bufs field was non-zero. The problem is that iwqp->iwpbl is unconditionally dereferenced later on in irdma_setup_virt_qp.
While there was a check for iwqp->iwpbl != NULL, this check would only occur if req.user_wqe_bufs was non-zero. The end result is that a user could send a zero user_wqe_bufs value and trigger a null ptr deref.
Fix this by unconditionally calling irdma_get_pbl and bailing if it fails, similar to the CQ and SRQ paths.
--- drivers/infiniband/hw/irdma/verbs.c | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-)
drivers/infiniband/hw/irdma/verbs.c +10 -11
@@ -599,18 +599,17 @@ static int irdma_setup_umode_qp(struct ib_udata *udata, iwqp->ctx_info.qp_compl_ctx = req.user_compl_ctx; iwqp->user_mode =1 ; -if (req.user_wqe_bufs) { - info->qp_uk_init_info.legacy_mode = ucontext->legacy_mode; -spin_lock_irqsave (&ucontext->qp_reg_mem_list_lock, flags); - iwqp->iwpbl =irdma_get_pbl ((unsigned long )req.user_wqe_bufs, - &ucontext->qp_reg_mem_list); -spin_unlock_irqrestore (&ucontext->qp_reg_mem_list_lock, flags); + info->qp_uk_init_info.legacy_mode = ucontext->legacy_mode; -if (!iwqp->iwpbl) { - ret = -ENODATA ; -ibdev_dbg (&iwdev->ibdev,"VERBS: no pbl info\n" ); -return ret; - } +spin_lock_irqsave (&ucontext->qp_reg_mem_list_lock, flags); + iwqp->iwpbl =irdma_get_pbl ((unsigned long )req.user_wqe_bufs, + &ucontext->qp_reg_mem_list); +spin_unlock_irqrestore (&ucontext->qp_reg_mem_list_lock, flags); + +if (!iwqp->iwpbl) { + ret = -ENODATA ; +ibdev_dbg (&iwdev->ibdev,"VERBS: no pbl info\n" ); +return ret; }if (!ucontext->use_raw_attrs) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1192/1887 xfrm: fix stale skb->prev after async crypto steals a GSO segment
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Wozniak <[email protected]>
[ Upstream commit 3f4c3919baf0944ad96580467c302bc6c7758b00 ]
skb_gso_segment() leaves the segment list head with ->prev pointing at the last segment, an invariant validate_xmit_skb_list() relies on when it sets its tail pointer (tail = skb->prev).
When validate_xmit_xfrm() walks a GSO list and some segments are stolen by async crypto (->xmit() returns -EINPROGRESS), those segments are unlinked from the list but the head ->prev is never updated. If the last segment is the one stolen, the returned head still has ->prev pointing at it, even though it is now owned by the crypto engine and may be freed. validate_xmit_skb_list() later does tail->next = skb, writing through that stale pointer -- a use-after-free.
Repoint skb->prev at the last retained segment before returning.
--- net/xfrm/xfrm_device.c | 8 ++++++++ 1 file changed, 8 insertions(+)
net/xfrm/xfrm_device.c +8 -0
@@ -215,6 +215,14 @@ struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t featur pskb = skb2; } +/* skb_gso_segment() set skb->prev to the last segment, but async +* crypto may have stolen it above without updating ->prev. Repoint +* it at the last retained segment so validate_xmit_skb_list() does +* not chain onto a segment now owned by the crypto engine. +*/ +if (skb) + skb->prev = pskb; +return skb; }EXPORT_SYMBOL_GPL (validate_xmit_xfrm);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1193/1887 LoongArch: Fix address space mismatch in kexec command line lookup
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: George Guo <[email protected]>
[ Upstream commit 485ed44db5694d8d2e5027f63ad608e705286f30 ]
When searching the loaded segments for the "kexec" command line marker, the kexec_load(2) path (file_mode == 0) passes the user-space segment buffer straight to strncmp() through a bogus (char __user *) cast. This dereferences a user pointer in kernel context, which is wrong and is flagged by sparse:
arch/loongarch/kernel/machine_kexec.c:84:51: sparse: incorrect type in argument 2 (different address spaces) @@ expected char const * @@ got char [noderef] __user *
Here copy the marker-sized prefix of each segment into a small on-stack buffer with copy_from_user() before comparing, and skip segments that fault. The subsequent copy_from_user() that stages the full command line into the safe area is left unchanged.
--- arch/loongarch/kernel/machine_kexec.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
arch/loongarch/kernel/machine_kexec.c +4 -1
@@ -62,6 +62,7 @@ static void kexec_image_info(const struct kimage *kimage)int machine_kexec_prepare (struct kimage *kimage) {int i; +char head[8 ];char *bootloader ="kexec" ;void *cmdline_ptr = (void *)KEXEC_CMDLINE_ADDR ;
@@ -72,7 +73,9 @@ int machine_kexec_prepare(struct kimage *kimage)/* Find the command line */ for (i =0 ; i < kimage->nr_segments; i++) { -if (!strncmp (bootloader, (char __user *)kimage->segment[i].buf,strlen (bootloader))) { +if (copy_from_user (head, kimage->segment[i].buf,strlen (bootloader))) +continue ; +if (!strncmp (bootloader, head,strlen (bootloader))) {if (!copy_from_user (cmdline_ptr, kimage->segment[i].buf,COMMAND_LINE_SIZE )) kimage->arch.cmdline_ptr = (unsigned long )cmdline_ptr;break ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1194/1887 net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <[email protected]>
[ Upstream commit ec48b3be2c8595dd290be883dbd4fb8b2f9f5d5e ]
When a TC filter attached to a qdisc filter chain returns TC_ACT_REDIRECT (ex: via an eBPF program calling bpf_redirect() or an act_bpf action), the redirect was silently lost i.e no qdisc classify function handled TC_ACT_REDIRECT, so the packet fell through the switch and was enqueued normally instead of being redirected.
This has been broken since bpf_redirect() was introduced for TC in commit 27b29f63058d ("bpf: add bpf_redirect() helper"). We got lucky for a long time because bpf_net_context was a per-CPU variable that was always available.
commit 401cb7dae813 ("net: Reference bpf_redirect_info via task_struct on PREEMPT_RT.") turned bpf_net_context into a task_struct member that is only set up by explicit callers. Without a caller setting it up, bpf_redirect() itself crashes with a NULL pointer dereference in bpf_net_ctx_get_ri(). However, even with bpf_net_context available, TC_ACT_REDIRECT from qdisc filter chains cannot be honored without adding skb_do_redirect() calls to every qdisc classify function, which would require changes across net/sched/. Isolate it to ebpf core where it belongs.
Instead, add a tcf_classify_qdisc() inline helper in pkt_cls.h, as a wrapper around tcf_classify() for use by qdisc classify functions and tcf_qevent_handle(). When the classify verdict is TC_ACT_REDIRECT, the wrapper converts it to TC_ACT_SHOT, dropping the packet rather than letting it continue silently. Dropping is preferred over letting the packet through because the user immediately sees packet loss. Silently passing the packet through would hide the problem and leave the user wondering why their redirect is not working.
The clsact fast path, tc_run() continues to call tcf_classify() directly and is unaffected: TC_ACT_REDIRECT is returned as-is and handled by sch_handle_egress/ingress() calling skb_do_redirect() as before.
--- include/net/pkt_cls.h | 14 +++++++++++++- net/sched/sch_cake.c | 2 +- net/sched/sch_drr.c | 2 +- net/sched/sch_ets.c | 2 +- net/sched/sch_fq_codel.c | 2 +- net/sched/sch_fq_pie.c | 2 +- net/sched/sch_hfsc.c | 2 +- net/sched/sch_htb.c | 2 +- net/sched/sch_multiq.c | 2 +- net/sched/sch_prio.c | 2 +- net/sched/sch_qfq.c | 2 +- net/sched/sch_sfb.c | 2 +- net/sched/sch_sfq.c | 2 +- 13 files changed, 25 insertions(+), 13 deletions(-)
include/net/pkt_cls.h +13 -1
@@ -156,8 +156,20 @@ static inline int tcf_classify(struct sk_buff *skb, {return TC_ACT_UNSPEC ; } -#endif +static inline int tcf_classify_qdisc (struct sk_buff *skb, +const struct tcf_proto *tp, +struct tcf_result *res,bool compat_mode) +{ +int ret =tcf_classify (skb,NULL , tp, res, compat_mode); + +/* TC_ACT_REDIRECT from qdisc filter chains is not supported. +* Use BPF via tcx or mirred redirect instead. +*/ +if (unlikely (ret ==TC_ACT_REDIRECT )) + ret =TC_ACT_SHOT ; +return ret; +}static inline unsigned long __cls_set_class (unsigned long *clp,unsigned long cl)
net/sched/sch_cake.c +1 -1
@@ -1720,7 +1720,7 @@ static u32 cake_classify(struct Qdisc *sch, struct cake_tin_data **t, goto hash; *qerr =NET_XMIT_SUCCESS | __NET_XMIT_BYPASS; - result =tcf_classify (skb,NULL , filter, &res, false); + result =tcf_classify_qdisc (skb, filter, &res, false);if (result >=0 ) {#ifdef CONFIG_NET_CLS_ACT
net/sched/sch_drr.c +1 -1
@@ -312,7 +312,7 @@ static struct drr_class *drr_classify(struct sk_buff *skb, struct Qdisc *sch, *qerr =NET_XMIT_SUCCESS | __NET_XMIT_BYPASS; fl =rcu_dereference_bh (q->filter_list); - result =tcf_classify (skb,NULL , fl, &res, false); + result =tcf_classify_qdisc (skb, fl, &res, false);if (result >=0 ) {#ifdef CONFIG_NET_CLS_ACT switch (result) {
net/sched/sch_ets.c +1 -1
@@ -389,7 +389,7 @@ static struct ets_class *ets_classify(struct sk_buff *skb, struct Qdisc *sch, *qerr =NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;if (TC_H_MAJ (skb->priority) != sch->handle) { fl =rcu_dereference_bh (q->filter_list); - err =tcf_classify (skb,NULL , fl, &res, false); + err =tcf_classify_qdisc (skb, fl, &res, false);#ifdef CONFIG_NET_CLS_ACT switch (err) {case TC_ACT_STOLEN :
net/sched/sch_fq_codel.c +1 -1
@@ -91,7 +91,7 @@ static unsigned int fq_codel_classify(struct sk_buff *skb, struct Qdisc *sch,return fq_codel_hash (q, skb) +1 ; *qerr =NET_XMIT_SUCCESS | __NET_XMIT_BYPASS; - result =tcf_classify (skb,NULL , filter, &res, false); + result =tcf_classify_qdisc (skb, filter, &res, false);if (result >=0 ) {#ifdef CONFIG_NET_CLS_ACT switch (result) {
net/sched/sch_fq_pie.c +1 -1
@@ -95,7 +95,7 @@ static unsigned int fq_pie_classify(struct sk_buff *skb, struct Qdisc *sch,return fq_pie_hash (q, skb) +1 ; *qerr =NET_XMIT_SUCCESS | __NET_XMIT_BYPASS; - result =tcf_classify (skb,NULL , filter, &res, false); + result =tcf_classify_qdisc (skb, filter, &res, false);if (result >=0 ) {#ifdef CONFIG_NET_CLS_ACT switch (result) {
net/sched/sch_hfsc.c +1 -1
@@ -1152,7 +1152,7 @@ hfsc_classify(struct sk_buff *skb, struct Qdisc *sch, int *qerr) head = &q->root; drift =HFSC_CLASSIFY_MAX_DRIFT ; tcf =rcu_dereference_bh (q->root.filter_list); -while (tcf && (result =tcf_classify (skb,NULL , tcf, &res, false)) >=0 ) { +while (tcf && (result =tcf_classify_qdisc (skb, tcf, &res, false)) >=0 ) {#ifdef CONFIG_NET_CLS_ACT switch (result) {case TC_ACT_QUEUED :
net/sched/sch_htb.c +1 -1
@@ -240,7 +240,7 @@ static struct htb_class *htb_classify(struct sk_buff *skb, struct Qdisc *sch, } *qerr =NET_XMIT_SUCCESS | __NET_XMIT_BYPASS; -while (tcf && (result =tcf_classify (skb,NULL , tcf, &res, false)) >=0 ) { +while (tcf && (result =tcf_classify_qdisc (skb, tcf, &res, false)) >=0 ) {#ifdef CONFIG_NET_CLS_ACT switch (result) {case TC_ACT_QUEUED :
net/sched/sch_multiq.c +1 -1
@@ -36,7 +36,7 @@ multiq_classify(struct sk_buff *skb, struct Qdisc *sch, int *qerr)int err; *qerr =NET_XMIT_SUCCESS | __NET_XMIT_BYPASS; - err =tcf_classify (skb,NULL , fl, &res, false); + err =tcf_classify_qdisc (skb, fl, &res, false);#ifdef CONFIG_NET_CLS_ACT switch (err) {case TC_ACT_STOLEN :
net/sched/sch_prio.c +1 -1
@@ -39,7 +39,7 @@ prio_classify(struct sk_buff *skb, struct Qdisc *sch, int *qerr) *qerr =NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;if (TC_H_MAJ (skb->priority) != sch->handle) { fl =rcu_dereference_bh (q->filter_list); - err =tcf_classify (skb,NULL , fl, &res, false); + err =tcf_classify_qdisc (skb, fl, &res, false);#ifdef CONFIG_NET_CLS_ACT switch (err) {case TC_ACT_STOLEN :
net/sched/sch_qfq.c +1 -1
@@ -711,7 +711,7 @@ static struct qfq_class *qfq_classify(struct sk_buff *skb, struct Qdisc *sch, *qerr =NET_XMIT_SUCCESS | __NET_XMIT_BYPASS; fl =rcu_dereference_bh (q->filter_list); - result =tcf_classify (skb,NULL , fl, &res, false); + result =tcf_classify_qdisc (skb, fl, &res, false);if (result >=0 ) {#ifdef CONFIG_NET_CLS_ACT switch (result) {
net/sched/sch_sfb.c +1 -1
@@ -260,7 +260,7 @@ static bool sfb_classify(struct sk_buff *skb, struct tcf_proto *fl,struct tcf_result res;int result; - result =tcf_classify (skb,NULL , fl, &res, false); + result =tcf_classify_qdisc (skb, fl, &res, false);if (result >=0 ) {#ifdef CONFIG_NET_CLS_ACT switch (result) {
net/sched/sch_sfq.c +1 -1
@@ -171,7 +171,7 @@ static unsigned int sfq_classify(struct sk_buff *skb, struct Qdisc *sch,return sfq_hash (q, skb) +1 ; *qerr =NET_XMIT_SUCCESS | __NET_XMIT_BYPASS; - result =tcf_classify (skb,NULL , fl, &res, false); + result =tcf_classify_qdisc (skb, fl, &res, false);if (result >=0 ) {#ifdef CONFIG_NET_CLS_ACT switch (result) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1195/1887 drm/vc4: Prevent shader BO mappings from becoming writable
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linmao Li <[email protected]>
[ Upstream commit 0c9e6367639548307d3f578f6943ce72c9d39087 ]
vc4_gem_object_mmap() rejects a writable mapping of a validated shader BO, but leaves VM_MAYWRITE set. Userspace can map the BO read-only and then turn it writable with mprotect().
Validated shader BOs must stay read-only: the validator checks the instructions once and the GPU trusts them afterwards. A writable mapping lets userspace rewrite the code after validation, bypassing the validator.
Clear VM_MAYWRITE on the read-only path so the mapping cannot be upgraded, as i915 already does for its read-only objects.
--- drivers/gpu/drm/vc4/vc4_bo.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/gpu/drm/vc4/vc4_bo.c +7 -3
@@ -733,9 +733,13 @@ static int vc4_gem_object_mmap(struct drm_gem_object *obj, struct vm_area_struct {struct vc4_bo *bo =to_vc4_bo (obj); -if (bo->validated_shader && (vma->vm_flags &VM_WRITE )) { -DRM_DEBUG ("mmaping of shader BOs for writing not allowed.\n" ); -return -EINVAL ; +if (bo->validated_shader) { +if (vma->vm_flags &VM_WRITE ) { +DRM_DEBUG ("mmaping of shader BOs for writing not allowed.\n" ); +return -EINVAL ; + } + + vma->vm_flags &= ~VM_MAYWRITE ; }mutex_lock (&bo->madv_lock);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1196/1887 ovl: check access to copy_file_range source with src mounter creds
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Goldstein <[email protected]>
[ Upstream commit a1e0eb8f55cfe09bb31a202a388babc411292656 ]
Commit 5dae222a5ff0c ("vfs: allow copy_file_range to copy across devices") allowed filesystems that implement the copy_file_range() f_op to decide if they want to access cross-sb copy from/to the same fs type.
The same commit added checks to verify same sb copy for filesystems that implement ->copy_file_range() and do not support cross-sb copy at the time, namely, to ceph, fuse and nfs.
The two remaining fs which implement ->copy_file_range(), cifs and overlayfs started to support cross-sb copy from this time.
While overlayfs does support cross-sb copy when the two underlying files are on the same base fs, the copy operation on the two real files from two different overalyfs filesystems is performed with the mounter creds of the destination overlayfs and the read permission access hook for the source file was called with the wrong creds.
This could cause either deny of access to copy which would otherwise be allowed (e.g. with splice) or allow read access to file which would otherwise be denied.
Fix the latter case by explicitly verifying read access to source file with the source overlayfs mounter creds.
The former case remains a quirk of cross-sb overlayfs copy, but userspace could fall back to regular copy so no harm done.
--- fs/overlayfs/file.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-)
fs/overlayfs/file.c +18 -1
@@ -570,6 +570,7 @@ static loff_t ovl_copyfile(struct file *file_in, loff_t pos_in, struct file *file_out, loff_t pos_out, loff_t len, unsigned int flags, enum ovl_copyop op) { + struct inode *inode_in = file_inode(file_in);struct inode *inode_out =file_inode (file_out);struct fd real_in, real_out;const struct cred *old_cred;
@@ -594,7 +595,23 @@ static loff_t ovl_copyfile(struct file *file_in, loff_t pos_in, goto out_unlock; } - old_cred =ovl_override_creds (file_inode (file_out)->i_sb); +/* +* For cross-sb copy, vfs_copy_file_range() will verify read access with +* the mounter creds of the dest fs mounter, so we need to explicitly +* verify read access with the source mounter creds. +*/ +if (unlikely (inode_in->i_sb != inode_out->i_sb)) { + old_cred =ovl_override_creds (inode_in->i_sb); + ret =rw_verify_area (READ , real_in.file, &pos_in, len); +revert_creds (old_cred); +if (unlikely (ret)) { +fdput (real_in); +fdput (real_out); + goto out_unlock; + } + } + + old_cred =ovl_override_creds (inode_out->i_sb);switch (op) {case OVL_COPY : ret = vfs_copy_file_range(real_in.file, pos_in,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1197/1887 ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <[email protected]>
[ Upstream commit c2130f6553f4a5cbdc259de069600117a995f197 ]
The hand-rolled bit-scanning loop in the NCQ completion path has an infinite loop bug. When tag_mask has only high bits set (e.g. 0x80000000), the inner while loop left-shifts tag_mask until it overflows to 0. At that point !(0 & 1) is always true and 0 <<= 1 stays 0, causing an infinite loop in hardirq context with a spinlock held.
Replace the open-coded bit-scanning with __ffs() which correctly finds the least significant set bit and is bounded by the width of the argument.
--- drivers/ata/sata_dwc_460ex.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-)
drivers/ata/sata_dwc_460ex.c +2 -7
@@ -616,16 +616,11 @@ static irqreturn_t sata_dwc_isr(int irq, void *dev_instance) status = ap->ops->sff_check_status (ap);dev_dbg (ap->dev,"%s ATA status register=0x%x\n" , __func__, status); - tag =0 ; num_processed =0 ;while (tag_mask) { num_processed++; -while (!(tag_mask &0x00000001 )) { - tag++; - tag_mask <<=1 ; - } - - tag_mask &= (~0x00000001 ); + tag =__ffs (tag_mask); + tag_mask &= ~(1U << tag); qc =ata_qc_from_tag (ap, tag);if (unlikely (!qc)) {dev_err (ap->dev,"failed to get qc" );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1198/1887 s390/zcrypt: Fix buffer over-read in cca_cipher2protkey
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harald Freudenberger <[email protected]>
[ Upstream commit 36b230835b8a008266aad22168ca52afacc8a58d ]
Add validation of both the actual key buffer size and token length fields in all the cca_check_sec*token() functions. Additionally check in cca_gencipherkey() for possible underflow with returned key size.
The CCA token structures contain user-controlled len fields that were used in operations without proper validation against both the actual buffer size and minimum token structure size. An attacker could set this field larger than the actual buffer size, leading to reading beyond buffer boundaries. This may result in a kernel crash or exposure of memory via sending this as part of a request down to the crypto card. Also an attacker could have used a very small len value and thus enforce a buffer under-run which may produce similar effects as a over-read.
So now a key must
- key buf length must be at least sizeof the token struct
- the key len field inside the token must fit into the range of sizeof key token struct ... key buf length
--- drivers/s390/crypto/pkey_api.c | 15 ++++--- drivers/s390/crypto/zcrypt_ccamisc.c | 64 +++++++++++++++++++++++----- drivers/s390/crypto/zcrypt_ccamisc.h | 6 +-- 3 files changed, 65 insertions(+), 20 deletions(-)
drivers/s390/crypto/pkey_api.c +8 -7
@@ -273,7 +273,8 @@ static int pkey_verifykey(const struct pkey_seckey *seckey,int rc;/* check the secure key for valid AES secure key */ - rc =cca_check_secaeskeytoken (debug_info,3 , (u8 *)seckey,0 ); + rc =cca_check_secaeskeytoken (debug_info,3 , (u8 *)seckey, +sizeof (*seckey),0 );if (rc) goto out;if (pattributes)
@@ -688,7 +689,7 @@ static int pkey_verifykey2(const u8 *key, size_t keylen, hdr->version == TOKVER_CCA_AES) {struct secaeskeytoken *t = (struct secaeskeytoken *)key; - rc =cca_check_secaeskeytoken (debug_info,3 , key,0 ); + rc =cca_check_secaeskeytoken (debug_info,3 , key, keylen,0 );if (rc) goto out;if (ktype)
@@ -718,7 +719,7 @@ static int pkey_verifykey2(const u8 *key, size_t keylen, hdr->version == TOKVER_CCA_VLSC) {struct cipherkeytoken *t = (struct cipherkeytoken *)key; - rc =cca_check_secaescipherkey (debug_info,3 , key,0 ,1 ); + rc =cca_check_secaescipherkey (debug_info,3 , key, keylen,0 ,1 );if (rc) goto out;if (ktype)
@@ -801,12 +802,12 @@ static int pkey_keyblob2pkey2(const struct pkey_apqn *apqns, size_t nr_apqns,if (hdr->version ==TOKVER_CCA_AES ) {if (keylen !=sizeof (struct secaeskeytoken ))return -EINVAL ; -if (cca_check_secaeskeytoken (debug_info,3 , key,0 )) +if (cca_check_secaeskeytoken (debug_info,3 , key, keylen,0 ))return -EINVAL ; }else if (hdr->version ==TOKVER_CCA_VLSC ) {if (keylen < hdr->len || keylen >MAXCCAVLSCTOKENSIZE )return -EINVAL ; -if (cca_check_secaescipherkey (debug_info,3 , key,0 ,1 )) +if (cca_check_secaescipherkey (debug_info,3 , key, keylen,0 ,1 ))return -EINVAL ; }else { DEBUG_ERR("%s unknown CCA internal token version %d\n",
@@ -1070,13 +1071,13 @@ static int pkey_keyblob2pkey3(const struct pkey_apqn *apqns, size_t nr_apqns,/* CCA AES data key */ if (keylen !=sizeof (struct secaeskeytoken ))return -EINVAL ; -if (cca_check_secaeskeytoken (debug_info,3 , key,0 )) +if (cca_check_secaeskeytoken (debug_info,3 , key, keylen,0 ))return -EINVAL ; }else if (hdr->version ==TOKVER_CCA_VLSC ) {/* CCA AES cipher key */ if (keylen < hdr->len || keylen >MAXCCAVLSCTOKENSIZE )return -EINVAL ; -if (cca_check_secaescipherkey (debug_info,3 , key,0 ,1 )) +if (cca_check_secaescipherkey (debug_info,3 , key, keylen,0 ,1 ))return -EINVAL ; }else { DEBUG_ERR("%s unknown CCA internal token version %d\n",
drivers/s390/crypto/zcrypt_ccamisc.c +54 -10
141 lines not on this page · raw message
drivers/s390/crypto/zcrypt_ccamisc.h +3 -3
@@ -135,7 +135,7 @@ struct eccprivkeytoken {* also checked. Returns 0 on success or errno value on failure. */ int cca_check_secaeskeytoken (debug_info_t *dbg,int dbflvl, -const u8 *token,int keybitsize); +const u8 *token,u32 keysize,int keybitsize);/* * Simple check if the token is a valid CCA secure AES cipher key
@@ -145,8 +145,8 @@ int cca_check_secaeskeytoken(debug_info_t *dbg, int dbflvl,* Returns 0 on success or errno value on failure. */ int cca_check_secaescipherkey (debug_info_t *dbg,int dbflvl, -const u8 *token,int keybitsize, -int checkcpacfexport); +const u8 *token,u32 keysize, +int keybitsize,int checkcpacfexport);/* * Simple check if the token is a valid CCA secure ECC private
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1199/1887 wifi: ieee80211: validate MLE common info length
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Li <[email protected]>
[ Upstream commit 293baeae9b2434a3e432629d7720b5603db2d77e ]
ieee80211_mle_common_size() uses the first common-info octet as the common information length for all known MLE types. However, ieee80211_mle_size_ok() only validates that octet for Basic, Probe Request, and TDLS MLEs.
Reconfiguration MLEs also skipped the length octet when calculating the minimum common size, and Priority Access MLEs skipped validation of the advertised common information length.
Account for the Reconfiguration common-info length octet and validate the advertised common information length for all known MLE types. Keep unknown-type handling unchanged.
--- include/linux/ieee80211.h | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-)
include/linux/ieee80211.h +4 -8
@@ -4601,7 +4601,7 @@ static inline bool ieee80211_mle_size_ok(const u8 *data, u8 len)const struct ieee80211_multi_link_elem *mle = (const void *)data;u8 fixed =sizeof (*mle);u8 common =0 ; -bool check_common_len = false; +u8 common_len;u16 control;if (!data || len < fixed)
@@ -4612,7 +4612,6 @@ static inline bool ieee80211_mle_size_ok(const u8 *data, u8 len)switch (u16_get_bits (control,IEEE80211_ML_CONTROL_TYPE )) {case IEEE80211_ML_CONTROL_TYPE_BASIC : common +=sizeof (struct ieee80211_mle_basic_common_info ); - check_common_len = true;if (control &IEEE80211_MLC_BASIC_PRES_LINK_ID ) common +=1 ;if (control &IEEE80211_MLC_BASIC_PRES_BSS_PARAM_CH_CNT )
@@ -4630,15 +4629,14 @@ static inline bool ieee80211_mle_size_ok(const u8 *data, u8 len) common +=sizeof (struct ieee80211_mle_preq_common_info );if (control &IEEE80211_MLC_PREQ_PRES_MLD_ID ) common +=1 ; - check_common_len = true;break ;case IEEE80211_ML_CONTROL_TYPE_RECONF : + common +=1 ;if (control &IEEE80211_MLC_RECONF_PRES_MLD_MAC_ADDR ) common +=ETH_ALEN ;break ;case IEEE80211_ML_CONTROL_TYPE_TDLS : common +=sizeof (struct ieee80211_mle_tdls_common_info ); - check_common_len = true;break ;case IEEE80211_ML_CONTROL_TYPE_PRIO_ACCESS : common =ETH_ALEN +1 ;
@@ -4651,11 +4649,9 @@ static inline bool ieee80211_mle_size_ok(const u8 *data, u8 len)if (len < fixed + common)return false; -if (!check_common_len) -return true; + common_len = mle->variable[0 ]; -/* if present, common length is the first octet there */ -return mle->variable[0 ] >= common; +return common_len >= common && common_len <= len - fixed; }enum ieee80211_mle_subelems {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1200/1887 pmdomain: imx: Fix i.MX8MP VC8000E power up sequence
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <[email protected]>
[ Upstream commit 25e252bcf1593b420b12a7231d9dd64b885a2ae2 ]
Per errata[1]:
ERR050531: VPU_NOC power down handshake may hang during VC8000E/VPUMIX power up/down cycling.
Description: VC8000E reset de-assertion edge and AXI clock may have a timing issue.
Workaround: Set bit2 (vc8000e_clk_en) of BLK_CLK_EN_CSR to 0 to gate off both AXI clock and VC8000E clock sent to VC8000E and AXI clock sent to VPU_NOC m_v_2 interface during VC8000E power up(VC8000E reset is de-asserted by HW)
Add a bool variable is_errata_err050531 in
'struct imx8m_blk_ctrl_domain_data' to represent whether the workaround is needed. If is_errata_err050531 is true, first clear the clk before powering up gpc, then enable the clk after powering up gpc.
[1] https://www.nxp.com/webapp/Download?colCode=IMX8MP_1P33A
--- drivers/soc/imx/imx8m-blk-ctrl.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-)
drivers/soc/imx/imx8m-blk-ctrl.c +18 -1
@@ -59,6 +59,15 @@ struct imx8m_blk_ctrl_domain_data {* register. */ u32 mipi_phy_rst_mask; + +/* +* VC8000E reset de-assertion edge and AXI clock may have a timing issue. +* Workaround: Set bit2 (vc8000e_clk_en) of BLK_CLK_EN_CSR to 0 to gate off +* both AXI clock and VC8000E clock sent to VC8000E and AXI clock sent to +* VPU_NOC m_v_2 interface during VC8000E power up(VC8000E reset is +* de-asserted by HW) +*/ +bool is_errata_err050531; };#define DOMAIN_MAX_CLKS 4
@@ -115,7 +124,11 @@ static int imx8m_blk_ctrl_power_on(struct generic_pm_domain *genpd)dev_err (bc->dev,"failed to enable clocks\n" ); goto bus_put; } -regmap_set_bits (bc->regmap,BLK_CLK_EN , data->clk_mask); + +if (data->is_errata_err050531) +regmap_clear_bits (bc->regmap,BLK_CLK_EN , data->clk_mask); +else +regmap_set_bits (bc->regmap,BLK_CLK_EN , data->clk_mask);/* power up upstream GPC domain */ ret =pm_runtime_get_sync (domain->power_dev);
@@ -124,6 +137,9 @@ static int imx8m_blk_ctrl_power_on(struct generic_pm_domain *genpd) goto clk_disable; } +if (data->is_errata_err050531) +regmap_set_bits (bc->regmap,BLK_CLK_EN , data->clk_mask); +/* wait for reset to propagate */ udelay (5 );
@@ -514,6 +530,7 @@ static const struct imx8m_blk_ctrl_domain_data imx8mp_vpu_blk_ctl_domain_data[] .clk_mask = BIT(2), .path_names = (const char *[]){"vc8000e"}, .num_paths = 1, + .is_errata_err050531 = true, }, };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1201/1887 pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guoniu Zhou <[email protected]>
[ Upstream commit 99611233f8cda833169fa6487d5dacdf189e5cb0 ]
The MIPI DSI and CSI domains share control bits for clock and reset, which can lead to incorrect behavior if one domain disables the shared resource while the other is still active.
To fix the issue, introduce a shared MIPI PHY power domain to own the common resources and make DSI and CSI its subdomains. This ensures the shared bits are properly managed and not disabled while still in use.
--- drivers/soc/imx/imx93-blk-ctrl.c | 50 ++++++++++++++++++++++++++++++-- 1 file changed, 47 insertions(+), 3 deletions(-)
drivers/soc/imx/imx93-blk-ctrl.c +47 -3
@@ -47,6 +47,8 @@#define PRIO (X ) (X) +#define BLK_CTRL_NO_PARENT UINT_MAX +struct imx93_blk_ctrl_domain ;struct imx93_blk_ctrl {
@@ -73,6 +75,7 @@ struct imx93_blk_ctrl_domain_data {int num_clks;u32 rst_mask;u32 clk_mask; +u32 parent;int num_qos;struct imx93_blk_ctrl_qos qos[DOMAIN_MAX_QOS ]; };
@@ -272,18 +275,46 @@ static int imx93_blk_ctrl_probe(struct platform_device *pdev) bc->onecell_data.domains[i] = &domain->genpd; } +for (i =0 ; i < bc_data->num_domains; i++) { +struct imx93_blk_ctrl_domain *domain = &bc->domains[i]; +const struct imx93_blk_ctrl_domain_data *data = domain->data; + +if (data->parent ==BLK_CTRL_NO_PARENT ) +continue ; + + ret =pm_genpd_add_subdomain (&bc->domains[data->parent].genpd, + &domain->genpd); +if (ret) { +dev_err_probe (dev, ret,"failed to add subdomain %s\n" , + domain->genpd.name); + goto cleanup_links; + } + } +pm_runtime_enable (dev); ret =of_genpd_add_provider_onecell (dev->of_node, &bc->onecell_data);if (ret) {dev_err_probe (dev, ret,"failed to add power domain provider\n" ); - goto cleanup_pds; + goto cleanup_links; }dev_set_drvdata (dev, bc);return 0 ; +cleanup_links: +for (i =0 ; i < bc_data->num_domains; i++) { +struct imx93_blk_ctrl_domain *domain = &bc->domains[i]; + +if (domain->data->parent ==BLK_CTRL_NO_PARENT ) +continue ; + +pm_genpd_remove_subdomain (&bc->domains[domain->data->parent].genpd, + &domain->genpd); + } + i = bc_data->num_domains; + cleanup_pds:for (i--; i >=0 ; i--)pm_genpd_remove (&bc->domains[i].genpd);
@@ -314,8 +345,9 @@ static const struct imx93_blk_ctrl_domain_data imx93_media_blk_ctl_domain_data[] .name = "mediablk-mipi-dsi", .clk_names = (const char *[]){ "dsi" }, .num_clks = 1, - .rst_mask = BIT(11) | BIT(12), - .clk_mask = BIT(11) | BIT(12), + .rst_mask = BIT(11), + .clk_mask = BIT(11), + .parent = IMX93_MEDIABLK_PD_MIPI_PHY, }, [IMX93_MEDIABLK_PD_MIPI_CSI] = { .name = "mediablk-mipi-csi",
@@ -323,6 +355,7 @@ static const struct imx93_blk_ctrl_domain_data imx93_media_blk_ctl_domain_data[] .num_clks = 2, .rst_mask = BIT(9) | BIT(10), .clk_mask = BIT(9) | BIT(10), + .parent = IMX93_MEDIABLK_PD_MIPI_PHY, }, [IMX93_MEDIABLK_PD_PXP] = { .name = "mediablk-pxp",
@@ -330,6 +363,7 @@ static const struct imx93_blk_ctrl_domain_data imx93_media_blk_ctl_domain_data[] .num_clks = 1, .rst_mask = BIT(7) | BIT(8), .clk_mask = BIT(7) | BIT(8), + .parent = BLK_CTRL_NO_PARENT, .num_qos = 2, .qos = { {
@@ -351,6 +385,7 @@ static const struct imx93_blk_ctrl_domain_data imx93_media_blk_ctl_domain_data[] .num_clks = 2, .rst_mask = BIT(4) | BIT(5) | BIT(6), .clk_mask = BIT(4) | BIT(5) | BIT(6), + .parent = BLK_CTRL_NO_PARENT, .num_qos = 1, .qos = { {
@@ -367,6 +402,7 @@ static const struct imx93_blk_ctrl_domain_data imx93_media_blk_ctl_domain_data[] .num_clks = 1, .rst_mask = BIT(2) | BIT(3), .clk_mask = BIT(2) | BIT(3), + .parent = BLK_CTRL_NO_PARENT, .num_qos = 4, .qos = { {
@@ -392,6 +428,14 @@ static const struct imx93_blk_ctrl_domain_data imx93_media_blk_ctl_domain_data[] } } }, + [IMX93_MEDIABLK_PD_MIPI_PHY ] = { + .name ="mediablk-mipi-phy" , + .clk_names =NULL , + .num_clks =0 , + .rst_mask =BIT (12 ), + .clk_mask =BIT (12 ), + .parent =BLK_CTRL_NO_PARENT , + }, };static const struct regmap_range imx93_media_blk_ctl_yes_ranges[] = {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1202/1887 riscv: probes: save original sp in rethook trampoline
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Kaiser <[email protected]>
[ Upstream commit bc7b086a45521a986a49045907f017e3e46c763e ]
Reading a word from the stack in a kretprobe crashes a risc-v kernel.
$ cd /sys/kernel/tracing/ $ echo 'r n_tty_write $stack0' > dynamic_events $ echo 1 > events/kprobes/enable Unable to handle kernel paging request at virtual address 0000000200000128 ... [<ffffffff80016d16>] regs_get_kernel_stack_nth+0x26/0x38 [<ffffffff80177196>] process_fetch_insn+0x3ee/0x760 [<ffffffff80177836>] kretprobe_trace_func+0x116/0x1f0 [<ffffffff8017795a>] kretprobe_dispatcher+0x4a/0x58 [<ffffffff8013572e>] kretprobe_rethook_handler+0x5e/0x90 [<ffffffff80180838>] rethook_trampoline_handler+0x70/0x108 [<ffffffff8001ba32>] arch_rethook_trampoline_callback+0x12/0x1c [<ffffffff8001ba84>] arch_rethook_trampoline+0x48/0x94 [<ffffffff8067872a>] tty_write+0x1a/0x30
In regs_get_kernel_stack_nth, regs->sp contains an arbitrary value.
arch_rethook_trampoline saves the registers from the probed function in a struct pt_regs. sp is not saved. Instead, sp is decremented for arch_rethook_trampoline's local stack.
Fix this crash and save the original sp along with the other registers. Use a0 as a temporary register, it is overwritten anyway.
--- arch/riscv/kernel/probes/kprobes_trampoline.S | 3 +++ 1 file changed, 3 insertions(+)
arch/riscv/kernel/probes/kprobes_trampoline.S +3 -0
@@ -41,6 +41,9 @@ REG_S x29, PT_T4(sp) REG_S x30, PT_T5(sp) REG_S x31, PT_T6(sp) + /* save original sp */ + addi a0, sp, PT_SIZE_ON_STACK + REG_S a0, PT_SP(sp) .endm .macro restore_all_base_regs
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1203/1887 dm-verity: fix buffer overflow in FEC calculation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
[ Upstream commit 31d6e6c0ba8d5a7bd59660035a089307100c5e8e ]
There's a buffer overflow in dm-verity-fec:
if (neras && *neras <= v->fec->roots)
fio->erasures[(*neras)++] = i;
This allows *neras to reach roots + 1 (the post-increment pushes it past roots). This value is then passed as no_eras to decode_rs8(). Inside the RS decoder (lib/reed_solomon/decode_rs.c:113-121), the erasure locator polynomial loop writes lambda[j] where j can reach nroots + 1 — one element past the end of lambda[] (which is sized nroots + 1, valid indices 0..nroots). The out-of-bounds write lands on syn[0], corrupting the syndrome buffer.
--- drivers/md/dm-verity-fec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/md/dm-verity-fec.c +2 -2
@@ -272,7 +272,7 @@ static int fec_read_bufs(struct dm_verity *v, struct dm_verity_io *io, (unsigned long long)block, PTR_ERR(bbuf));/* assume the block is corrupted */ -if (neras && *neras <= v->fec->roots) +if (neras && *neras < v->fec->roots) fio->erasures[(*neras)++] = i;continue ;
@@ -290,7 +290,7 @@ static int fec_read_bufs(struct dm_verity *v, struct dm_verity_io *io,* skip if we have already found the theoretical * maximum number (i.e. fec->roots) of erasures */ -if (neras && *neras <= v->fec->roots && +if (neras && *neras < v->fec->roots &&fec_is_erasure (v, io, want_digest, bbuf)) fio->erasures[(*neras)++] = i; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1204/1887 dm ioctl: a small code cleanup in list_version_get_info
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
[ Upstream commit d043f9a1ca929eee76dac940b4ccfb5429e6098f ]
No need to modify info->vers if we overwrite it immediately.
Stable-dep-of: 76c6f845dc0c ("dm-ioctl: fix a possible overflow in list_version_get_info")
--- drivers/md/dm-ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/dm-ioctl.c +1 -1
@@ -695,7 +695,7 @@ static void list_version_get_info(struct target_type *tt, void *param)strcpy (info->vers->name, tt->name); info->old_vers = info->vers; - info->vers =align_ptr (((void *) ++info->vers) +strlen (tt->name) +1 ); + info->vers =align_ptr ((void *)(info->vers +1 ) +strlen (tt->name) +1 ); }static int __list_versions (struct dm_ioctl *param,size_t param_size,const char *name)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1205/1887 dm: avoid spaces before function arguments or in favour of tabs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heinz Mauelshagen <[email protected]>
[ Upstream commit 8ca817c43e12847be182e0bbff9b59398373a3b8 ]
Stable-dep-of: 76c6f845dc0c ("dm-ioctl: fix a possible overflow in list_version_get_info")
--- drivers/md/dm-bio-prison-v1.c | 6 ++-- drivers/md/dm-cache-target.c | 12 ++++---- drivers/md/dm-ebs-target.c | 2 +- drivers/md/dm-exception-store.h | 44 ++++++++++++++-------------- drivers/md/dm-ioctl.c | 52 ++++++++++++++++----------------- drivers/md/dm-kcopyd.c | 2 +- drivers/md/dm-path-selector.h | 27 +++++++++-------- drivers/md/dm-ps-queue-length.c | 4 +-- drivers/md/dm-ps-service-time.c | 8 ++--- drivers/md/dm-raid1.c | 2 +- drivers/md/dm-snap-persistent.c | 2 +- drivers/md/dm-snap-transient.c | 2 +- drivers/md/dm-snap.c | 6 ++-- drivers/md/dm-uevent.c | 2 +- 14 files changed, 84 insertions(+), 87 deletions(-)
drivers/md/dm-bio-prison-v1.c +3 -3
@@ -77,9 +77,9 @@ static void __setup_new_cell(struct dm_cell_key *key,struct bio *holder, struct dm_bio_prison_cell *cell) { - memcpy(&cell->key, key, sizeof(cell->key)); - cell->holder = holder; -bio_list_init (&cell->bios); + memcpy(&cell->key, key, sizeof(cell->key)); + cell->holder = holder; +bio_list_init (&cell->bios); } static int cmp_keys(struct dm_cell_key *lhs,
drivers/md/dm-cache-target.c +6 -6
@@ -180,14 +180,14 @@ static void continue_after_commit(struct batcher *b, struct continuation *k)*/ static void issue_after_commit (struct batcher *b,struct bio *bio) { -bool commit_scheduled; +bool commit_scheduled; -spin_lock_irq (&b->lock); - commit_scheduled = b->commit_scheduled; -bio_list_add (&b->bios, bio); -spin_unlock_irq (&b->lock); +spin_lock_irq (&b->lock); + commit_scheduled = b->commit_scheduled; +bio_list_add (&b->bios, bio); +spin_unlock_irq (&b->lock); -if (commit_scheduled) +if (commit_scheduled)async_commit (b); }
drivers/md/dm-ebs-target.c +1 -1
@@ -241,7 +241,7 @@ static void __ebs_process_bios(struct work_struct *ws)* <offset>: offset in 512 bytes sectors into <dev_path> * <ebs>: emulated block size in units of 512 bytes exposed to the upper layer * [<ubs>]: underlying block size in units of 512 bytes imposed on the lower layer; -* optional, if not supplied, retrieve logical block size from underlying device +* optional, if not supplied, retrieve logical block size from underlying device */ static int ebs_ctr (struct dm_target *ti,unsigned int argc,char **argv) {
drivers/md/dm-exception-store.h +22 -22
88 lines not on this page · raw message
drivers/md/dm-ioctl.c +25 -27
80 lines not on this page · raw message
drivers/md/dm-kcopyd.c +1 -1
@@ -604,7 +604,7 @@ static int run_pages_job(struct kcopyd_job *job)* of successful jobs. */ static int process_jobs (struct list_head *jobs,struct dm_kcopyd_client *kc, -int (*fn) (struct kcopyd_job *)) +int (*fn)(struct kcopyd_job *)) {struct kcopyd_job *job;int r, count =0 ;
drivers/md/dm-path-selector.h +13 -14
@@ -52,44 +52,43 @@ struct path_selector_type {/* * Constructs a path selector object, takes custom arguments */ -int (*create) (struct path_selector *ps,unsigned int argc,char **argv); -void (*destroy) (struct path_selector *ps); +int (*create)(struct path_selector *ps,unsigned int argc,char **argv); +void (*destroy)(struct path_selector *ps);/* * Add an opaque path object, along with some selector specific * path args (eg, path priority). */ -int (*add_path) (struct path_selector *ps,struct dm_path *path, -int argc,char **argv,char **error); +int (*add_path)(struct path_selector *ps,struct dm_path *path, +int argc,char **argv,char **error);/* * Chooses a path for this io, if no paths are available then * NULL will be returned. */ -struct dm_path *(*select_path) (struct path_selector *ps, -size_t nr_bytes); +struct dm_path *(*select_path)(struct path_selector *ps,size_t nr_bytes);/* * Notify the selector that a path has failed. */ -void (*fail_path) (struct path_selector *ps,struct dm_path *p); +void (*fail_path)(struct path_selector *ps,struct dm_path *p);/* * Ask selector to reinstate a path. */ -int (*reinstate_path) (struct path_selector *ps,struct dm_path *p); +int (*reinstate_path)(struct path_selector *ps,struct dm_path *p);/* * Table content based on parameters added in ps_add_path_fn * or path selector status */ -int (*status) (struct path_selector *ps,struct dm_path *path, -status_type_t type,char *result,unsigned int maxlen); +int (*status)(struct path_selector *ps,struct dm_path *path, +status_type_t type,char *result,unsigned int maxlen); -int (*start_io) (struct path_selector *ps,struct dm_path *path, -size_t nr_bytes); -int (*end_io) (struct path_selector *ps,struct dm_path *path, -size_t nr_bytes,u64 start_time); +int (*start_io)(struct path_selector *ps,struct dm_path *path, +size_t nr_bytes); +int (*end_io)(struct path_selector *ps,struct dm_path *path, +size_t nr_bytes,u64 start_time); };/* Register a path selector */
drivers/md/dm-ps-queue-length.c +2 -2
@@ -122,8 +122,8 @@ static int ql_add_path(struct path_selector *ps, struct dm_path *path,/* * Arguments: [<repeat_count>] -* <repeat_count>: The number of I/Os before switching path. -* If not given, default (QL_MIN_IO) is used. +* <repeat_count>: The number of I/Os before switching path. +* If not given, default (QL_MIN_IO) is used. */ if (argc >1 ) { *error ="queue-length ps: incorrect number of arguments" ;
drivers/md/dm-ps-service-time.c +4 -4
@@ -120,11 +120,11 @@ static int st_add_path(struct path_selector *ps, struct dm_path *path,/* * Arguments: [<repeat_count> [<relative_throughput>]] -* <repeat_count>: The number of I/Os before switching path. -* If not given, default (ST_MIN_IO) is used. -* <relative_throughput>: The relative throughput value of +* <repeat_count>: The number of I/Os before switching path. +* If not given, default (ST_MIN_IO) is used. +* <relative_throughput>: The relative throughput value of * the path among all paths in the path-group. -* The valid range: 0-<ST_MAX_RELATIVE_THROUGHPUT> +* The valid range: 0-<ST_MAX_RELATIVE_THROUGHPUT> * If not given, minimum value '1' is used. * If '0' is given, the path isn't selected while * other paths having a positive value are available.
drivers/md/dm-raid1.c +1 -1
@@ -583,7 +583,7 @@ static void do_reads(struct mirror_set *ms, struct bio_list *reads)* We do different things with the write io depending on the * state of the region that it's in: * -* SYNC: increment pending, use kcopyd to write to *all* mirrors +* SYNC: increment pending, use kcopyd to write to *all* mirrors * RECOVERING: delay the io until recovery completes * NOSYNC: increment pending, just write to the default mirror *---------------------------------------------------------------*/
drivers/md/dm-snap-persistent.c +1 -1
@@ -693,7 +693,7 @@ static int persistent_prepare_exception(struct dm_exception_store *store,static void persistent_commit_exception (struct dm_exception_store *store,struct dm_exception *e,int valid, -void (*callback) (void *,int success), +void (*callback)(void *,int success),void *callback_context) {unsigned int i;
drivers/md/dm-snap-transient.c +1 -1
@@ -53,7 +53,7 @@ static int transient_prepare_exception(struct dm_exception_store *store,static void transient_commit_exception (struct dm_exception_store *store,struct dm_exception *e,int valid, -void (*callback) (void *,int success), +void (*callback)(void *,int success),void *callback_context) {/* Just succeed */
drivers/md/dm-snap.c +3 -3
@@ -122,11 +122,11 @@ struct dm_snapshot {* The merge operation failed if this flag is set. * Failure modes are handled as follows: * - I/O error reading the header -* => don't load the target; abort. +* => don't load the target; abort. * - Header does not have "valid" flag set -* => use the origin; forget about the snapshot. +* => use the origin; forget about the snapshot. * - I/O error when reading exceptions -* => don't load the target; abort. +* => don't load the target; abort. * (We can't use the intermediate origin state.) * - I/O error while merging * => stop merging; set merge_failed; process I/O normally.
drivers/md/dm-uevent.c +1 -1
@@ -3,7 +3,7 @@* Device Mapper Uevent Support (dm-uevent) * * Copyright IBM Corporation, 2007 -* Author: Mike Anderson <[email protected]> +* Author: Mike Anderson <[email protected]> */ #include <linux/list.h> #include <linux/slab.h>
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1206/1887 dm-ioctl: fix a possible overflow in list_version_get_info
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
[ Upstream commit 76c6f845dc0c614304a6e6ee619b552f97cf24b3 ]
sizeof(tt->version) is 12 bytes, but the code writes 16 bytes into the output buffer - info->vers->version[0], info->vers->version[1], info->vers->version[2] and info->vers->next. This can cause buffer overflow.
Fix this buffer overflow by replacing "sizeof(tt->version)" with "sizeof(struct dm_target_versions)".
--- drivers/md/dm-ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/dm-ioctl.c +1 -1
@@ -678,7 +678,7 @@ static void list_version_get_info(struct target_type *tt, void *param)struct vers_iter *info = param;/* Check space - it might have changed since the first iteration */ -if ((char *)info->vers +sizeof (tt->version) +strlen (tt->name) +1 > info->end) { +if ((char *)info->vers +sizeof (struct dm_target_versions ) +strlen (tt->name) +1 > info->end) { info->flags =DM_BUFFER_FULL_FLAG ;return ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1207/1887 nvmet: Introduce nvmet_req_transfer_len()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
[ Upstream commit 43043c9b97258a008b3402cfbbf1c5d82151c77f ]
Add the new function nvmet_req_transfer_len() to parse a request command to extract the transfer length of the command. This function implementation relies on multiple helper functions for parsing I/O commands (nvmet_io_cmd_transfer_len()), admin commands (nvmet_admin_cmd_data_len()) and fabrics connect commands (nvmet_connect_cmd_data_len).
Stable-dep-of: 779575bc35c6 ("nvmet-auth: reject short AUTH_RECEIVE buffers")
--- drivers/nvme/target/admin-cmd.c | 21 +++++++++++++ drivers/nvme/target/core.c | 37 ++++++++++++++++++++++ drivers/nvme/target/discovery.c | 14 +++++++++ drivers/nvme/target/fabrics-cmd-auth.c | 14 +++++++-- drivers/nvme/target/fabrics-cmd.c | 43 ++++++++++++++++++++++++++ drivers/nvme/target/nvmet.h | 8 +++++ 6 files changed, 135 insertions(+), 2 deletions(-)
drivers/nvme/target/admin-cmd.c +21 -0
@@ -1011,6 +1011,27 @@ void nvmet_execute_keep_alive(struct nvmet_req *req)nvmet_req_complete (req, status); } +u32 nvmet_admin_cmd_data_len (struct nvmet_req *req) +{ +struct nvme_command *cmd = req->cmd; + +if (nvme_is_fabrics (cmd)) +return nvmet_fabrics_admin_cmd_data_len (req); +if (nvmet_is_disc_subsys (nvmet_req_subsys (req))) +return nvmet_discovery_cmd_data_len (req); + +switch (cmd->common.opcode) { +case nvme_admin_get_log_page: +return nvmet_get_log_page_len (cmd); +case nvme_admin_identify: +return NVME_IDENTIFY_DATA_SIZE ; +case nvme_admin_get_features: +return nvmet_feat_data_len (req,le32_to_cpu (cmd->common.cdw10)); +default : +return 0 ; + } +} +u16 nvmet_parse_admin_cmd (struct nvmet_req *req) {struct nvme_command *cmd = req->cmd;
drivers/nvme/target/core.c +37 -0
@@ -884,6 +884,33 @@ static inline u16 nvmet_io_cmd_check_access(struct nvmet_req *req)return 0 ; } +static u32 nvmet_io_cmd_transfer_len (struct nvmet_req *req) +{ +struct nvme_command *cmd = req->cmd; +u32 metadata_len =0 ; + +if (nvme_is_fabrics (cmd)) +return nvmet_fabrics_io_cmd_data_len (req); + +if (!req->ns) +return 0 ; + +switch (req->cmd->common.opcode) { +case nvme_cmd_read: +case nvme_cmd_write: +case nvme_cmd_zone_append: +if (req->sq->ctrl->pi_support &&nvmet_ns_has_pi (req->ns)) + metadata_len =nvmet_rw_metadata_len (req); +return nvmet_rw_data_len (req) + metadata_len; +case nvme_cmd_dsm: +return nvmet_dsm_len (req); +case nvme_cmd_zone_mgmt_recv: +return (le32_to_cpu (req->cmd->zmr.numd) +1 ) <<2 ; +default : +return 0 ; + } +} +static u16 nvmet_parse_io_cmd (struct nvmet_req *req) {struct nvme_command *cmd = req->cmd;
@@ -1008,6 +1035,16 @@ void nvmet_req_uninit(struct nvmet_req *req) }EXPORT_SYMBOL_GPL (nvmet_req_uninit); +size_t nvmet_req_transfer_len (struct nvmet_req *req) +{ +if (likely (req->sq->qid !=0 )) +return nvmet_io_cmd_transfer_len (req); +if (unlikely (!req->sq->ctrl)) +return nvmet_connect_cmd_data_len (req); +return nvmet_admin_cmd_data_len (req); +} +EXPORT_SYMBOL_GPL (nvmet_req_transfer_len); +bool nvmet_check_transfer_len (struct nvmet_req *req,size_t len) {if (unlikely (len != req->transfer_len)) {
drivers/nvme/target/discovery.c +14 -0
@@ -373,6 +373,20 @@ static void nvmet_execute_disc_get_features(struct nvmet_req *req)nvmet_req_complete (req, stat); } +u32 nvmet_discovery_cmd_data_len (struct nvmet_req *req) +{ +struct nvme_command *cmd = req->cmd; + +switch (cmd->common.opcode) { +case nvme_admin_get_log_page: +return nvmet_get_log_page_len (req->cmd); +case nvme_admin_identify: +return NVME_IDENTIFY_DATA_SIZE ; +default : +return 0 ; + } +} +u16 nvmet_parse_discovery_cmd (struct nvmet_req *req) {struct nvme_command *cmd = req->cmd;
drivers/nvme/target/fabrics-cmd-auth.c +12 -2
@@ -188,6 +188,11 @@ static u8 nvmet_auth_failure2(void *d)return data->rescode_exp; } +u32 nvmet_auth_send_data_len (struct nvmet_req *req) +{ +return le32_to_cpu (req->cmd->auth_send.tl); +} +void nvmet_execute_auth_send (struct nvmet_req *req) {struct nvmet_ctrl *ctrl = req->sq->ctrl;
@@ -215,7 +220,7 @@ void nvmet_execute_auth_send(struct nvmet_req *req) offsetof(struct nvmf_auth_send_command , spsp1); goto done; } - tl =le32_to_cpu (req->cmd->auth_send.tl); + tl =nvmet_auth_send_data_len (req);if (!tl) { status =NVME_SC_INVALID_FIELD |NVME_STATUS_DNR ; req->error_loc =
@@ -442,6 +447,11 @@ static void nvmet_auth_failure1(struct nvmet_req *req, void *d, int al) data->rescode_exp = req->sq->dhchap_status; } +u32 nvmet_auth_receive_data_len (struct nvmet_req *req) +{ +return le32_to_cpu (req->cmd->auth_receive.al); +} +void nvmet_execute_auth_receive (struct nvmet_req *req) {struct nvmet_ctrl *ctrl = req->sq->ctrl;
@@ -467,7 +477,7 @@ void nvmet_execute_auth_receive(struct nvmet_req *req) offsetof(struct nvmf_auth_receive_command , spsp1); goto done; } - al =le32_to_cpu (req->cmd->auth_receive.al); + al =nvmet_auth_receive_data_len (req);if (!al) { status =NVME_SC_INVALID_FIELD |NVME_STATUS_DNR ; req->error_loc =
drivers/nvme/target/fabrics-cmd.c +43 -0
61 lines not on this page · raw message
drivers/nvme/target/nvmet.h +8 -0
@@ -444,18 +444,24 @@ void nvmet_start_keep_alive_timer(struct nvmet_ctrl *ctrl);void nvmet_stop_keep_alive_timer (struct nvmet_ctrl *ctrl);u16 nvmet_parse_connect_cmd (struct nvmet_req *req); +u32 nvmet_connect_cmd_data_len (struct nvmet_req *req);void nvmet_bdev_set_limits (struct block_device *bdev,struct nvme_id_ns *id);u16 nvmet_bdev_parse_io_cmd (struct nvmet_req *req);u16 nvmet_file_parse_io_cmd (struct nvmet_req *req);u16 nvmet_bdev_zns_parse_io_cmd (struct nvmet_req *req); +u32 nvmet_admin_cmd_data_len (struct nvmet_req *req);u16 nvmet_parse_admin_cmd (struct nvmet_req *req); +u32 nvmet_discovery_cmd_data_len (struct nvmet_req *req);u16 nvmet_parse_discovery_cmd (struct nvmet_req *req);u16 nvmet_parse_fabrics_admin_cmd (struct nvmet_req *req); +u32 nvmet_fabrics_admin_cmd_data_len (struct nvmet_req *req);u16 nvmet_parse_fabrics_io_cmd (struct nvmet_req *req); +u32 nvmet_fabrics_io_cmd_data_len (struct nvmet_req *req);bool nvmet_req_init (struct nvmet_req *req,struct nvmet_cq *cq,struct nvmet_sq *sq,const struct nvmet_fabrics_ops *ops);void nvmet_req_uninit (struct nvmet_req *req); +size_t nvmet_req_transfer_len (struct nvmet_req *req);bool nvmet_check_transfer_len (struct nvmet_req *req,size_t len);bool nvmet_check_data_len_lte (struct nvmet_req *req,size_t data_len);void nvmet_req_complete (struct nvmet_req *req,u16 status);
@@ -701,7 +707,9 @@ static inline void nvmet_req_bio_put(struct nvmet_req *req, struct bio *bio) }#ifdef CONFIG_NVME_TARGET_AUTH +u32 nvmet_auth_send_data_len (struct nvmet_req *req);void nvmet_execute_auth_send (struct nvmet_req *req); +u32 nvmet_auth_receive_data_len (struct nvmet_req *req);void nvmet_execute_auth_receive (struct nvmet_req *req);int nvmet_auth_set_key (struct nvmet_host *host,const char *secret,bool set_ctrl);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1208/1887 nvmet-auth: reject short AUTH_RECEIVE buffers
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <[email protected]>
[ Upstream commit 779575bc35c687697ba69e904f2cd22e60112534 ]
nvmet_execute_auth_receive() trusts the AUTH_RECEIVE allocation length after checking only that it is nonzero and matches the transfer length. In the SUCCESS1 and FAILURE1/default states, that lets a remote NVMe-oF initiator reach the fixed-size DH-HMAC-CHAP response builders with a kmalloc() buffer shorter than the response, so nvmet_auth_success1() and nvmet_auth_failure1() write past the allocation; both only WARN_ON the short length and then format the message anyway.
Impact: A remote NVMe-oF initiator with access to an auth-enabled target can trigger a 16-byte heap out-of-bounds write via a one-byte AUTH_RECEIVE allocation length.
Compute the minimum response length for the current DH-HMAC-CHAP step in nvmet_auth_receive_data_len() and report a zero data length when the host-supplied allocation length is shorter, so the existing zero-length check in nvmet_execute_auth_receive() rejects the command before any builder runs. The SUCCESS1 minimum is sizeof(struct nvmf_auth_dhchap_success1_data) plus the HMAC hash length, because the response hash is written into the rval[] flexible-array tail, so the minimum is state dependent rather than a flat sizeof. CHALLENGE keeps its existing variable-length guard in nvmet_auth_challenge().
This is reachable only when in-band DH-HMAC-CHAP authentication is configured on the target.
--- drivers/nvme/target/fabrics-cmd-auth.c | 26 +++++++++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-)
drivers/nvme/target/fabrics-cmd-auth.c +25 -1
@@ -449,7 +449,31 @@ static void nvmet_auth_failure1(struct nvmet_req *req, void *d, int al)u32 nvmet_auth_receive_data_len (struct nvmet_req *req) { -return le32_to_cpu (req->cmd->auth_receive.al); +struct nvmet_ctrl *ctrl = req->sq->ctrl; +u32 al =le32_to_cpu (req->cmd->auth_receive.al); +u32 min_len; + +/* +* Reject too-short al before kmalloc(al), since the SUCCESS1 and +* FAILURE1/default builders write fixed response headers into it. +*/ +switch (req->sq->dhchap_step) { +case NVME_AUTH_DHCHAP_MESSAGE_CHALLENGE : +return al; +case NVME_AUTH_DHCHAP_MESSAGE_SUCCESS1 : + min_len =sizeof (struct nvmf_auth_dhchap_success1_data ); +if (req->sq->dhchap_c2) + min_len +=nvme_auth_hmac_hash_len (ctrl->shash_id); +break ; +default : + min_len =sizeof (struct nvmf_auth_dhchap_failure_data ); +break ; + } + +if (al < min_len) +return 0 ; + +return al; }void nvmet_execute_auth_receive (struct nvmet_req *req)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1209/1887 ACPI: battery: Pass battery hook pointer to hook callbacks
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
[ Upstream commit 878a82c23469d6626b27b44ade4d8f9438de51ab ]
Right now, is impossible for battery hook callbacks to access instance-specific data, forcing most drivers to provide some sort of global state. This however is difficult for drivers which can be instantiated multiple times and/or are hotplug-capable.
Pass a pointer to the battery hook to those callbacks for usage with container_of().
Stable-dep-of: 6e9cab2247e5 ("platform/x86: dell-laptop: fix missing cleanups in init error path")
--- drivers/acpi/battery.c | 8 ++++---- drivers/platform/x86/asus-wmi.c | 4 ++-- drivers/platform/x86/huawei-wmi.c | 4 ++-- drivers/platform/x86/lg-laptop.c | 4 ++-- drivers/platform/x86/system76_acpi.c | 4 ++-- drivers/platform/x86/thinkpad_acpi.c | 4 ++-- drivers/platform/x86/toshiba_acpi.c | 4 ++-- include/acpi/battery.h | 4 ++-- 8 files changed, 18 insertions(+), 18 deletions(-)
drivers/acpi/battery.c +4 -4
@@ -701,7 +701,7 @@ static void battery_hook_unregister_unlocked(struct acpi_battery_hook *hook)* de-register all the batteries that are registered. */ list_for_each_entry (battery, &acpi_battery_list, list) { - hook->remove_battery (battery->bat); + hook->remove_battery (battery->bat, hook); }list_del_init (&hook->list);
@@ -736,7 +736,7 @@ void battery_hook_register(struct acpi_battery_hook *hook)* its attributes. */ list_for_each_entry (battery, &acpi_battery_list, list) { -if (hook->add_battery (battery->bat)) { +if (hook->add_battery (battery->bat, hook)) {/* * If a add-battery returns non-zero, * the registration of the extension has failed,
@@ -774,7 +774,7 @@ static void battery_hook_add_battery(struct acpi_battery *battery)* during the battery module initialization. */ list_for_each_entry_safe (hook_node, tmp, &battery_hook_list, list) { -if (hook_node->add_battery (battery->bat)) { +if (hook_node->add_battery (battery->bat, hook_node)) {/* * The notification of the extensions has failed, to * prevent further errors we will unload the extension.
@@ -797,7 +797,7 @@ static void battery_hook_remove_battery(struct acpi_battery *battery)* custom attributes from the battery. */ list_for_each_entry (hook, &battery_hook_list, list) { - hook->remove_battery (battery->bat); + hook->remove_battery (battery->bat, hook); }/* Then, just remove the battery from the list */ list_del (&battery->list);
drivers/platform/x86/asus-wmi.c +2 -2
@@ -900,7 +900,7 @@ static ssize_t charge_control_end_threshold_show(struct device *device,static DEVICE_ATTR_RW (charge_control_end_threshold); -static int asus_wmi_battery_add (struct power_supply *battery) +static int asus_wmi_battery_add (struct power_supply *battery,struct acpi_battery_hook *hook) {/* The WMI method does not provide a way to specific a battery, so we * just assume it is the first battery.
@@ -927,7 +927,7 @@ static int asus_wmi_battery_add(struct power_supply *battery)return 0 ; } -static int asus_wmi_battery_remove (struct power_supply *battery) +static int asus_wmi_battery_remove (struct power_supply *battery,struct acpi_battery_hook *hook) {device_remove_file (&battery->dev, &dev_attr_charge_control_end_threshold);
drivers/platform/x86/huawei-wmi.c +2 -2
@@ -474,7 +474,7 @@ static DEVICE_ATTR_RW(charge_control_start_threshold);static DEVICE_ATTR_RW (charge_control_end_threshold);static DEVICE_ATTR_RW (charge_control_thresholds); -static int huawei_wmi_battery_add (struct power_supply *battery) +static int huawei_wmi_battery_add (struct power_supply *battery,struct acpi_battery_hook *hook) {int err =0 ;
@@ -489,7 +489,7 @@ static int huawei_wmi_battery_add(struct power_supply *battery)return err; } -static int huawei_wmi_battery_remove (struct power_supply *battery) +static int huawei_wmi_battery_remove (struct power_supply *battery,struct acpi_battery_hook *hook) {device_remove_file (&battery->dev, &dev_attr_charge_control_start_threshold);device_remove_file (&battery->dev, &dev_attr_charge_control_end_threshold);
drivers/platform/x86/lg-laptop.c +2 -2
@@ -522,7 +522,7 @@ static DEVICE_ATTR_RW(fn_lock);static DEVICE_ATTR_RW (charge_control_end_threshold);static DEVICE_ATTR_RW (battery_care_limit); -static int lg_battery_add (struct power_supply *battery) +static int lg_battery_add (struct power_supply *battery,struct acpi_battery_hook *hook) {if (device_create_file (&battery->dev, &dev_attr_charge_control_end_threshold))
@@ -531,7 +531,7 @@ static int lg_battery_add(struct power_supply *battery)return 0 ; } -static int lg_battery_remove (struct power_supply *battery) +static int lg_battery_remove (struct power_supply *battery,struct acpi_battery_hook *hook) {device_remove_file (&battery->dev, &dev_attr_charge_control_end_threshold);
drivers/platform/x86/system76_acpi.c +2 -2
@@ -254,7 +254,7 @@ static struct attribute *system76_battery_attrs[] = {ATTRIBUTE_GROUPS (system76_battery); -static int system76_battery_add (struct power_supply *battery) +static int system76_battery_add (struct power_supply *battery,struct acpi_battery_hook *hook) {// System76 EC only supports 1 battery if (strcmp (battery->desc->name,"BAT0" ) !=0 )
@@ -266,7 +266,7 @@ static int system76_battery_add(struct power_supply *battery)return 0 ; } -static int system76_battery_remove (struct power_supply *battery) +static int system76_battery_remove (struct power_supply *battery,struct acpi_battery_hook *hook) {device_remove_groups (&battery->dev, system76_battery_groups);return 0 ;
drivers/platform/x86/thinkpad_acpi.c +2 -2
@@ -10102,7 +10102,7 @@ ATTRIBUTE_GROUPS(tpacpi_battery);/* ACPI battery hooking */ -static int tpacpi_battery_add (struct power_supply *battery) +static int tpacpi_battery_add (struct power_supply *battery,struct acpi_battery_hook *hook) {int batteryid =tpacpi_battery_get_id (battery->desc->name);
@@ -10113,7 +10113,7 @@ static int tpacpi_battery_add(struct power_supply *battery)return 0 ; } -static int tpacpi_battery_remove (struct power_supply *battery) +static int tpacpi_battery_remove (struct power_supply *battery,struct acpi_battery_hook *hook) {device_remove_groups (&battery->dev, tpacpi_battery_groups);return 0 ;
drivers/platform/x86/toshiba_acpi.c +2 -2
@@ -3124,7 +3124,7 @@ static struct attribute *toshiba_acpi_battery_attrs[] = {ATTRIBUTE_GROUPS (toshiba_acpi_battery); -static int toshiba_acpi_battery_add (struct power_supply *battery) +static int toshiba_acpi_battery_add (struct power_supply *battery,struct acpi_battery_hook *hook) {if (toshiba_acpi ==NULL ) {pr_err ("Init order issue\n" );
@@ -3137,7 +3137,7 @@ static int toshiba_acpi_battery_add(struct power_supply *battery)return 0 ; } -static int toshiba_acpi_battery_remove (struct power_supply *battery) +static int toshiba_acpi_battery_remove (struct power_supply *battery,struct acpi_battery_hook *hook) {device_remove_groups (&battery->dev, toshiba_acpi_battery_groups);return 0 ;
include/acpi/battery.h +2 -2
@@ -12,8 +12,8 @@struct acpi_battery_hook {const char *name; -int (*add_battery)(struct power_supply *battery); -int (*remove_battery)(struct power_supply *battery); +int (*add_battery)(struct power_supply *battery,struct acpi_battery_hook *hook); +int (*remove_battery)(struct power_supply *battery,struct acpi_battery_hook *hook);struct list_head list; };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1210/1887 platform/x86: dell-smbios: Move request functions for reuse
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lyndon Sanche <[email protected]>
[ Upstream commit 33245680ae565aaa114d726bf407c8ff38e75e71 ]
Move the dell_send_request and dell_fill_request symbols into smbios-base so that they can be used in multiple modules.
Stable-dep-of: 6e9cab2247e5 ("platform/x86: dell-laptop: fix missing cleanups in init error path")
--- drivers/platform/x86/dell/dell-laptop.c | 23 ------------------ drivers/platform/x86/dell/dell-smbios-base.c | 25 ++++++++++++++++++++ drivers/platform/x86/dell/dell-smbios.h | 5 ++++ 3 files changed, 30 insertions(+), 23 deletions(-)
drivers/platform/x86/dell/dell-laptop.c +0 -23
@@ -361,29 +361,6 @@ static const struct dmi_system_id dell_quirks[] __initconst = { { } }; -static void dell_fill_request (struct calling_interface_buffer *buffer, -u32 arg0,u32 arg1,u32 arg2,u32 arg3) -{ -memset (buffer,0 ,sizeof (struct calling_interface_buffer )); - buffer->input[0 ] = arg0; - buffer->input[1 ] = arg1; - buffer->input[2 ] = arg2; - buffer->input[3 ] = arg3; -} - -static int dell_send_request (struct calling_interface_buffer *buffer, -u16 class,u16 select) -{ -int ret; - - buffer->cmd_class = class; - buffer->cmd_select = select; - ret =dell_smbios_call (buffer); -if (ret !=0 ) -return ret; -return dell_smbios_error (buffer->output[0 ]); -} -/* * Derived from information in smbios-wireless-ctl: *
drivers/platform/x86/dell/dell-smbios-base.c +25 -0
@@ -320,6 +320,31 @@ int dell_smbios_call(struct calling_interface_buffer *buffer) }EXPORT_SYMBOL_GPL (dell_smbios_call); +void dell_fill_request (struct calling_interface_buffer *buffer, +u32 arg0,u32 arg1,u32 arg2,u32 arg3) +{ +memset (buffer,0 ,sizeof (struct calling_interface_buffer )); + buffer->input[0 ] = arg0; + buffer->input[1 ] = arg1; + buffer->input[2 ] = arg2; + buffer->input[3 ] = arg3; +} +EXPORT_SYMBOL_GPL (dell_fill_request); + +int dell_send_request (struct calling_interface_buffer *buffer, +u16 class,u16 select) +{ +int ret; + + buffer->cmd_class = class; + buffer->cmd_select = select; + ret =dell_smbios_call (buffer); +if (ret !=0 ) +return ret; +return dell_smbios_error (buffer->output[0 ]); +} +EXPORT_SYMBOL_GPL (dell_send_request); +struct calling_interface_token *dell_smbios_find_token (int tokenid) {int i;
drivers/platform/x86/dell/dell-smbios.h +5 -0
@@ -62,6 +62,11 @@ int dell_smbios_call_filter(struct device *d, struct calling_interface_buffer *buffer);int dell_smbios_call (struct calling_interface_buffer *buffer); +void dell_fill_request (struct calling_interface_buffer *buffer, +u32 arg0,u32 arg1,u32 arg2,u32 arg3); +int dell_send_request (struct calling_interface_buffer *buffer, +u16 class,u16 select); +struct calling_interface_token *dell_smbios_find_token (int tokenid);enum dell_laptop_notifier_actions {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1211/1887 platform/x86: dell-laptop: fix missing cleanups in init error path
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
[ Upstream commit 6e9cab2247e5b243ae2d907ce7c948a8a9c8d61a ]
dell_init() initializes several resources after dell_setup_rfkill(), including the optional touchpad LED, keyboard backlight LED, battery hook, debugfs directory and dell-laptop notifier.
If a later LED or backlight registration fails, the error path only tears down the battery hook and rfkill resources. This leaves the notifier, debugfs directory, keyboard backlight LED and optional touchpad LED registered after dell_init() returns an error.
Add the missing cleanup calls before tearing down rfkill.
--- drivers/platform/x86/dell/dell-laptop.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/platform/x86/dell/dell-laptop.c +5 -0
@@ -2264,6 +2264,11 @@ static int __init dell_init(void)if (micmute_led_registered)led_classdev_unregister (&micmute_led_cdev); fail_led: +dell_laptop_unregister_notifier (&dell_laptop_notifier); +debugfs_remove_recursive (dell_laptop_dir); +kbd_led_exit (); +if (quirks && quirks->touchpad_led) +touchpad_led_exit ();dell_cleanup_rfkill (); fail_rfkill:platform_device_del (platform_device);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1212/1887 dmaengine: dw-edma-pcie: Reject devices without driver data
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <[email protected]>
[ Upstream commit 11d7cfe0c119691b2dafbb699bbca90258c678aa ]
dw_edma_pcie_probe() treats the PCI device ID driver_data as the template for the controller layout and copies it unconditionally. A device bound dynamically via sysfs can match the driver without that data, which leads to a NULL pointer dereference.
Reject such matches before enabling the device.
--- drivers/dma/dw-edma/dw-edma-pcie.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/dma/dw-edma/dw-edma-pcie.c +3 -0
@@ -151,6 +151,9 @@ static int dw_edma_pcie_probe(struct pci_dev *pdev,int err, nr_irqs;int i, mask; +if (!pdata) +return -ENODEV ; +/* Enable PCI device */ err =pcim_enable_device (pdev);if (err) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1213/1887 ocfs2: correct l_next_free_rec in online check
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Sun <[email protected]>
[ Upstream commit fdbb6cd96ed51da002bd9a5a142586a74a436784 ]
Correct the value of l_next_free_rec to l_count during the online check, as done in the check_el() function in ocfs2_tools.
Stable-dep-of: 452a8467be81 ("ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec")
--- fs/ocfs2/inode.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+)
fs/ocfs2/inode.c +24 -0
@@ -233,6 +233,20 @@ struct inode *ocfs2_iget(struct ocfs2_super *osb, u64 blkno, unsigned flags,return inode; } +static int ocfs2_dinode_has_extents (struct ocfs2_dinode *di) +{ +/* inodes flagged with other stuff in id2 */ +if (di->i_flags & (OCFS2_SUPER_BLOCK_FL |OCFS2_LOCAL_ALLOC_FL | +OCFS2_CHAIN_FL |OCFS2_DEALLOC_FL )) +return 0 ; +/* i_flags doesn't indicate when id2 is a fast symlink */ +if (S_ISLNK (di->i_mode) && di->i_size && di->i_clusters ==0 ) +return 0 ; +if (di->i_dyn_features &OCFS2_INLINE_DATA_FL ) +return 0 ; + +return 1 ; +}/* * here's how inodes get read from disk:
@@ -1728,6 +1742,16 @@ static int ocfs2_filecheck_repair_inode_block(struct super_block *sb, le32_to_cpu(di->i_fs_generation)); } +if (ocfs2_dinode_has_extents (di) && +le16_to_cpu (di->id2.i_list.l_next_free_rec) >le16_to_cpu (di->id2.i_list.l_count)) { + di->id2.i_list.l_next_free_rec = di->id2.i_list.l_count; + changed =1 ; +mlog (ML_ERROR , +"Filecheck: reset dinode #%llu: l_next_free_rec to %u\n" , + (unsigned long long )bh->b_blocknr, +le16_to_cpu (di->id2.i_list.l_next_free_rec)); + } +if (changed ||ocfs2_validate_meta_ecc (sb, bh->b_data, &di->i_check)) {ocfs2_compute_meta_ecc (sb, bh->b_data, &di->i_check);mark_buffer_dirty (bh);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1214/1887 ocfs2: add suballoc slot check in ocfs2_validate_inode_block()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit fe7a283b39160153b6d1bd7f61b0a9d5d44987a8 ]
In 'ocfs2_validate_inode_block()', add suballoc slot check similar to one in 'ocfs2_get_suballoc_slot_bit()', thus preventing an out-of-bounds accesses for 'local_system_inodes' in 'get_local_system_inode()'.
Most likely this fixes
https://syzkaller.appspot.com/bug?extid=a77d690840e60bc2ddd8 as well.
Stable-dep-of: 452a8467be81 ("ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec")
--- fs/ocfs2/inode.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/ocfs2/inode.c +8 -0
@@ -1577,6 +1577,14 @@ int ocfs2_validate_inode_block(struct super_block *sb, } } +if (le16_to_cpu (di->i_suballoc_slot) != (u16 )OCFS2_INVALID_SLOT && + (u32 )le16_to_cpu (di->i_suballoc_slot) >OCFS2_SB (sb)->max_slots -1 ) { + rc =ocfs2_error (sb,"Invalid dinode %llu: suballoc slot %u\n" , + (unsigned long long )bh->b_blocknr, +le16_to_cpu (di->i_suballoc_slot)); + goto bail; + } + rc =0 ; bail:
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1215/1887 ocfs2: add extra consistency checks for chain allocator dinodes
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit e1c70505ee8158c1108340d9cd67182ade93af4a ]
When validating chain allocator dinode in 'ocfs2_validate_inode_block()', add an extra checks whether a) the maximum amount of chain records in 'struct ocfs2_chain_list' matches the value calculated based on the filesystem block size, and b) the next free slot index is within the valid range.
Stable-dep-of: 452a8467be81 ("ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec")
--- fs/ocfs2/inode.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
fs/ocfs2/inode.c +17 -0
@@ -1585,6 +1585,23 @@ int ocfs2_validate_inode_block(struct super_block *sb, goto bail; } +if (le32_to_cpu (di->i_flags) &OCFS2_CHAIN_FL ) { +struct ocfs2_chain_list *cl = &di->id2.i_chain; + +if (le16_to_cpu (cl->cl_count) !=ocfs2_chain_recs_per_inode (sb)) { + rc =ocfs2_error (sb,"Invalid dinode %llu: chain list count %u\n" , + (unsigned long long )bh->b_blocknr, +le16_to_cpu (cl->cl_count)); + goto bail; + } +if (le16_to_cpu (cl->cl_next_free_rec) >le16_to_cpu (cl->cl_count)) { + rc =ocfs2_error (sb,"Invalid dinode %llu: chain list index %u\n" , + (unsigned long long )bh->b_blocknr, +le16_to_cpu (cl->cl_next_free_rec)); + goto bail; + } + } + rc =0 ; bail:
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1216/1887 ocfs2: validate i_refcount_loc when refcount flag is set
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepanshu Kartikey <[email protected]>
[ Upstream commit 688dab01c3bb14cb559878aaf7019bfba4a79275 ]
Add validation in ocfs2_validate_inode_block() to check that if an inode has OCFS2_HAS_REFCOUNT_FL set, it must also have a valid i_refcount_loc. A corrupted filesystem image can have this inconsistent state, which later triggers a BUG_ON in ocfs2_remove_refcount_tree() when the inode is being wiped during unlink.
Catch this corruption early during inode validation to fail gracefully instead of crashing the kernel.
Stable-dep-of: 452a8467be81 ("ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec")
--- fs/ocfs2/inode.c | 7 +++++++ 1 file changed, 7 insertions(+)
fs/ocfs2/inode.c +7 -0
@@ -1602,6 +1602,13 @@ int ocfs2_validate_inode_block(struct super_block *sb, } } +if ((le16_to_cpu (di->i_dyn_features) &OCFS2_HAS_REFCOUNT_FL ) && + !di->i_refcount_loc) { + rc =ocfs2_error (sb,"Inode #%llu has refcount flag but no i_refcount_loc\n" , + (unsigned long long )bh->b_blocknr); + goto bail; + } + rc =0 ; bail:
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1217/1887 ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Bridges <[email protected]>
[ Upstream commit 452a8467be8143747292218212671deeb186d2ae ]
[BUG]
On-disk corruption setting l_next_free_rec to 0 in an inode's embedded extent list triggers a UBSAN panic on the next write to that file.
[CAUSE]ocfs2_sum_rightmost_rec() computes
i = le16_to_cpu(el->l_next_free_rec) - 1
and accesses el->l_recs[i] without validating i. When l_next_free_rec is 0, i becomes -1; when l_next_free_rec exceeds l_count, i falls past the end of the array. Either case violates the __counted_by_le(l_count) annotation on l_recs[] and triggers UBSAN.
[FIX]
Validate the inode's embedded extent list when the inode is read, in ocfs2_validate_inode_block(): l_count must be non-zero and no larger than the inode block can hold, and l_next_free_rec must not exceed l_count. A corrupt list is rejected at read time, before the b-tree code can index l_recs[] out of bounds.
--- fs/ocfs2/inode.c | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+)
fs/ocfs2/inode.c +32 -0
@@ -1609,6 +1609,38 @@ int ocfs2_validate_inode_block(struct super_block *sb, goto bail; } +if (ocfs2_dinode_has_extents (di)) { +struct ocfs2_extent_list *el = &di->id2.i_list; +u16 count =le16_to_cpu (el->l_count); +u16 next_free =le16_to_cpu (el->l_next_free_rec); + +if (count ==0 ) { + rc =ocfs2_error (sb, +"Invalid dinode %llu: extent list l_count is zero\n" , + (unsigned long long )bh->b_blocknr); + goto bail; + } +/* +* The exact capacity depends on i_xattr_inline_size, another +* unvalidated on-disk field. Inline xattrs only shrink the +* list, so the no-xattr maximum is a safe upper bound that a +* valid l_count never exceeds. +*/ +if (count >ocfs2_extent_recs_per_inode (sb)) { + rc =ocfs2_error (sb, +"Invalid dinode %llu: extent list l_count %u exceeds max %u\n" , + (unsigned long long )bh->b_blocknr, count, +ocfs2_extent_recs_per_inode (sb)); + goto bail; + } +if (next_free > count) { + rc =ocfs2_error (sb, +"Invalid dinode %llu: extent list l_next_free_rec %u exceeds l_count %u\n" , + (unsigned long long )bh->b_blocknr, next_free, count); + goto bail; + } + } + rc =0 ; bail:
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1218/1887 mtd: maps: vmu-flash: fix fault in unaligned fixup
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fuchs <[email protected]>
[ Upstream commit 79d1661502c6e4b6f626185cef72cf2fa78116e1 ]
Use kzalloc_obj() / kzalloc_objs() to allocate the memcard structs, instead of kmalloc_obj() / kmalloc_objs() to prevent access to uninitialized data.
Fixes runtime error: Fault in unaligned fixup: 0000 [#1] at mtd_get_fact_prot_info.
--- drivers/mtd/maps/vmu-flash.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/mtd/maps/vmu-flash.c +5 -5
@@ -610,7 +610,7 @@ static int vmu_connect(struct maple_device *mdev) basic_flash_data =be32_to_cpu (mdev->devinfo.function_data[c -1 ]); - card =kmalloc (sizeof (struct memcard ),GFP_KERNEL ); + card =kzalloc (sizeof (struct memcard ),GFP_KERNEL );if (!card) { error = -ENOMEM ; goto fail_nomem;
@@ -628,15 +628,15 @@ static int vmu_connect(struct maple_device *mdev)* Not sure there are actually any multi-partition devices in the * real world, but the hardware supports them, so, so will we */ - card->parts =kmalloc_array (card->partitions,sizeof (struct vmupart ), -GFP_KERNEL ); + card->parts =kcalloc (card->partitions,sizeof (struct vmupart ), +GFP_KERNEL );if (!card->parts) { error = -ENOMEM ; goto fail_partitions; } - card->mtd =kmalloc_array (card->partitions,sizeof (struct mtd_info ), -GFP_KERNEL ); + card->mtd =kcalloc (card->partitions,sizeof (struct mtd_info ), +GFP_KERNEL );if (!card->mtd) { error = -ENOMEM ; goto fail_mtd_info;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1219/1887 fs: Remove NTFS classic
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox (Oracle) <[email protected]>
[ Upstream commit 7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89 ]
The replacement, NTFS3, was merged over two years ago. It is now time to remove the original from the tree as it is the last user of several APIs, and it is not worth changing.
--- CREDITS | 5 + Documentation/filesystems/index.rst | 1 - Documentation/filesystems/ntfs.rst | 466 ---- MAINTAINERS | 9 - fs/Kconfig | 1 - fs/Makefile | 1 - fs/ntfs/Kconfig | 80 - fs/ntfs/Makefile | 15 - fs/ntfs/aops.c | 1761 --------------- fs/ntfs/aops.h | 88 - fs/ntfs/attrib.c | 2624 ---------------------- fs/ntfs/attrib.h | 102 - fs/ntfs/bitmap.c | 179 -- fs/ntfs/bitmap.h | 104 - fs/ntfs/collate.c | 110 - fs/ntfs/collate.h | 36 - fs/ntfs/compress.c | 950 -------- fs/ntfs/debug.c | 159 -- fs/ntfs/debug.h | 57 - fs/ntfs/dir.c | 1538 ------------- fs/ntfs/dir.h | 34 - fs/ntfs/endian.h | 79 - fs/ntfs/file.c | 2006 ----------------- fs/ntfs/index.c | 440 ---- fs/ntfs/index.h | 134 -- fs/ntfs/inode.c | 3100 -------------------------- fs/ntfs/inode.h | 310 --- fs/ntfs/layout.h | 2421 -------------------- fs/ntfs/lcnalloc.c | 1000 --------- fs/ntfs/lcnalloc.h | 131 -- fs/ntfs/logfile.c | 849 ------- fs/ntfs/logfile.h | 295 --- fs/ntfs/malloc.h | 77 - fs/ntfs/mft.c | 2906 ------------------------ fs/ntfs/mft.h | 110 - fs/ntfs/mst.c | 189 -- fs/ntfs/namei.c | 391 ---- fs/ntfs/ntfs.h | 150 -- fs/ntfs/quota.c | 103 - fs/ntfs/quota.h | 21 - fs/ntfs/runlist.c | 1893 ---------------- fs/ntfs/runlist.h | 88 - fs/ntfs/super.c | 3194 --------------------------- fs/ntfs/sysctl.c | 69 - fs/ntfs/sysctl.h | 27 - fs/ntfs/time.h | 89 - fs/ntfs/types.h | 55 - fs/ntfs/unistr.c | 384 ---- fs/ntfs/upcase.c | 73 - fs/ntfs/usnjrnl.c | 70 - fs/ntfs/usnjrnl.h | 191 -- fs/ntfs/volume.h | 164 -- 52 files changed, 5 insertions(+), 29324 deletions(-) delete mode 100644 Documentation/filesystems/ntfs.rst delete mode 100644 fs/ntfs/Kconfig delete mode 100644 fs/ntfs/Makefile delete mode 100644 fs/ntfs/aops.c delete mode 100644 fs/ntfs/aops.h delete mode 100644 fs/ntfs/attrib.c delete mode 100644 fs/ntfs/attrib.h delete mode 100644 fs/ntfs/bitmap.c delete mode 100644 fs/ntfs/bitmap.h delete mode 100644 fs/ntfs/collate.c delete mode 100644 fs/ntfs/collate.h delete mode 100644 fs/ntfs/compress.c delete mode 100644 fs/ntfs/debug.c delete mode 100644 fs/ntfs/debug.h delete mode 100644 fs/ntfs/dir.c delete mode 100644 fs/ntfs/dir.h delete mode 100644 fs/ntfs/endian.h delete mode 100644 fs/ntfs/file.c delete mode 100644 fs/ntfs/index.c delete mode 100644 fs/ntfs/index.h delete mode 100644 fs/ntfs/inode.c delete mode 100644 fs/ntfs/inode.h delete mode 100644 fs/ntfs/layout.h delete mode 100644 fs/ntfs/lcnalloc.c delete mode 100644 fs/ntfs/lcnalloc.h delete mode 100644 fs/ntfs/logfile.c delete mode 100644 fs/ntfs/logfile.h delete mode 100644 fs/ntfs/malloc.h delete mode 100644 fs/ntfs/mft.c delete mode 100644 fs/ntfs/mft.h delete mode 100644 fs/ntfs/mst.c delete mode 100644 fs/ntfs/namei.c delete mode 100644 fs/ntfs/ntfs.h delete mode 100644 fs/ntfs/quota.c delete mode 100644 fs/ntfs/quota.h delete mode 100644 fs/ntfs/runlist.c delete mode 100644 fs/ntfs/runlist.h delete mode 100644 fs/ntfs/super.c delete mode 100644 fs/ntfs/sysctl.c delete mode 100644 fs/ntfs/sysctl.h delete mode 100644 fs/ntfs/time.h delete mode 100644 fs/ntfs/types.h delete mode 100644 fs/ntfs/unistr.c delete mode 100644 fs/ntfs/upcase.c delete mode 100644 fs/ntfs/usnjrnl.c delete mode 100644 fs/ntfs/usnjrnl.h delete mode 100644 fs/ntfs/volume.h
CREDITS +5 -0
@@ -67,6 +67,11 @@ D: dosfs, LILO, some fd features, ATM, various other hacks here and there S: Buenos Aires S: Argentina +NTFS FILESYSTEM +N: Anton Altaparmakov +E: [email protected] +D: NTFS filesystem + N: Tim Alpaerts E: [email protected] D: 802.2 class II logical link control layer,
Documentation/filesystems/index.rst +0 -1
@@ -99,7 +99,6 @@ Documentation for filesystem implementations. isofs nilfs2 nfs/index - ntfs ntfs3 ocfs2 ocfs2-online-filecheck
Documentation/filesystems/ntfs.rst deleted +0 -466
466 lines not on this page · raw message
MAINTAINERS +0 -9
@@ -14669,15 +14669,6 @@ W: https://github.com/davejiang/linux/wiki T: git https://github.com/davejiang/linux.git F: drivers/ntb/hw/intel/ -NTFS FILESYSTEM -M: Anton Altaparmakov <[email protected]> -L: [email protected] -S: Supported -W: http://www.tuxera.com/ -T: git git://git.kernel.org/pub/scm/linux/kernel/git/aia21/ntfs.git -F: Documentation/filesystems/ntfs.rst -F: fs/ntfs/ - NTFS3 FILESYSTEM M: Konstantin Komarov <[email protected]> L: [email protected]
fs/Kconfig +0 -1
@@ -150,7 +150,6 @@ menu "DOS/FAT/EXFAT/NT Filesystems" source "fs/fat/Kconfig" source "fs/exfat/Kconfig" -source "fs/ntfs/Kconfig" source "fs/ntfs3/Kconfig" endmenu
fs/Makefile +0 -1
@@ -96,7 +96,6 @@ obj-y += unicode/ obj-$(CONFIG_SYSV_FS) += sysv/ obj-$(CONFIG_SMBFS) += smb/ obj-$(CONFIG_HPFS_FS) += hpfs/ -obj-$(CONFIG_NTFS_FS) += ntfs/ obj-$(CONFIG_NTFS3_FS) += ntfs3/ obj-$(CONFIG_UFS_FS) += ufs/ obj-$(CONFIG_EFS_FS) += efs/
fs/ntfs/Kconfig deleted +0 -80
80 lines not on this page · raw message
fs/ntfs/Makefile deleted +0 -15
@@ -1,15 +0,0 @@ -# SPDX-License-Identifier: GPL-2.0 -# Rules for making the NTFS driver. - -obj-$(CONFIG_NTFS_FS) += ntfs.o - -ntfs-y := aops.o attrib.o collate.o compress.o debug.o dir.o file.o \ - index.o inode.o mft.o mst.o namei.o runlist.o super.o sysctl.o \ - unistr.o upcase.o - -ntfs-$(CONFIG_NTFS_RW) += bitmap.o lcnalloc.o logfile.o quota.o usnjrnl.o - -ccflags-y := -DNTFS_VERSION=\"2.1.32\" -ccflags-$(CONFIG_NTFS_DEBUG) += -DDEBUG -ccflags-$(CONFIG_NTFS_RW) += -DNTFS_RW -
fs/ntfs/aops.c deleted +0 -1761
1,761 lines not on this page · raw message
fs/ntfs/aops.h deleted +0 -88
88 lines not on this page · raw message
fs/ntfs/attrib.c deleted +0 -2624
543 lines not on this page · raw message
fs/ntfs/attrib.h deleted +0 -102
102 lines not on this page · raw message
fs/ntfs/bitmap.c deleted +0 -179
179 lines not on this page · raw message
fs/ntfs/bitmap.h deleted +0 -104
104 lines not on this page · raw message
fs/ntfs/collate.c deleted +0 -110
110 lines not on this page · raw message
fs/ntfs/compress.c deleted +0 -950
950 lines not on this page · raw message
fs/ntfs/debug.c deleted +0 -159
159 lines not on this page · raw message
fs/ntfs/debug.h deleted +0 -57
57 lines not on this page · raw message
fs/ntfs/dir.c deleted +0 -1538
1,538 lines not on this page · raw message
fs/ntfs/endian.h deleted +0 -79
79 lines not on this page · raw message
fs/ntfs/file.c deleted +0 -2006
2,006 lines not on this page · raw message
fs/ntfs/index.c deleted +0 -440
440 lines not on this page · raw message
fs/ntfs/index.h deleted +0 -134
134 lines not on this page · raw message
fs/ntfs/inode.c deleted +0 -3100
3,100 lines not on this page · raw message
fs/ntfs/inode.h deleted +0 -310
310 lines not on this page · raw message
fs/ntfs/layout.h deleted +0 -2421
2,421 lines not on this page · raw message
fs/ntfs/lcnalloc.c deleted +0 -1000
1,000 lines not on this page · raw message
fs/ntfs/lcnalloc.h deleted +0 -131
131 lines not on this page · raw message
fs/ntfs/logfile.c deleted +0 -849
849 lines not on this page · raw message
fs/ntfs/logfile.h deleted +0 -295
295 lines not on this page · raw message
fs/ntfs/malloc.h deleted +0 -77
77 lines not on this page · raw message
fs/ntfs/mft.c deleted +0 -2906
2,906 lines not on this page · raw message
fs/ntfs/mft.h deleted +0 -110
110 lines not on this page · raw message
fs/ntfs/mst.c deleted +0 -189
189 lines not on this page · raw message
fs/ntfs/namei.c deleted +0 -391
391 lines not on this page · raw message
fs/ntfs/ntfs.h deleted +0 -150
150 lines not on this page · raw message
fs/ntfs/quota.c deleted +0 -103
103 lines not on this page · raw message
fs/ntfs/runlist.c deleted +0 -1893
1,893 lines not on this page · raw message
fs/ntfs/runlist.h deleted +0 -88
88 lines not on this page · raw message
fs/ntfs/super.c deleted +0 -3194
3,194 lines not on this page · raw message
fs/ntfs/sysctl.c deleted +0 -69
69 lines not on this page · raw message
fs/ntfs/time.h deleted +0 -89
89 lines not on this page · raw message
fs/ntfs/types.h deleted +0 -55
55 lines not on this page · raw message
fs/ntfs/unistr.c deleted +0 -384
384 lines not on this page · raw message
fs/ntfs/upcase.c deleted +0 -73
73 lines not on this page · raw message
fs/ntfs/usnjrnl.c deleted +0 -70
70 lines not on this page · raw message
fs/ntfs/usnjrnl.h deleted +0 -191
191 lines not on this page · raw message
fs/ntfs/volume.h deleted +0 -164
164 lines not on this page · raw message
The rest of this diff is not shown. View the raw message.
Signature · 1 line
2.53.0
Part of the diff is not shown here. View the raw message.
Greg Kroah-Hartman
maintainerPATCH 1220/1887 mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepanshu Kartikey <[email protected]>
[ Upstream commit 15807d0ddde37407af72859426b654f3d1972b00 ]
In alloc_hugetlb_folio(), a single h_cg pointer is used for both the rsvd and non-rsvd hugetlb cgroup charges. When map_chg is set, hugetlb_cgroup_charge_cgroup_rsvd() stores the charged cgroup in h_cg, but the immediately following hugetlb_cgroup_charge_cgroup() overwrites h_cg with the non-rsvd cgroup pointer.
As a result, hugetlb_cgroup_commit_charge_rsvd() stores the wrong (non-rsvd) cgroup pointer into the folio's rsvd slot.
When the folio is later freed, free_huge_folio() unconditionally calls both hugetlb_cgroup_uncharge_folio() and hugetlb_cgroup_uncharge_folio_rsvd(). The rsvd uncharge reads back the wrong cgroup from the folio and decrements a counter that was never charged for that cgroup, causing a page_counter underflow:
page_counter underflow: -512 nr_pages=512
WARNING: mm/page_counter.c:61 at page_counter_cancel
Fix this by introducing a separate h_cg_rsvd pointer exclusively for the rsvd charge path, keeping the rsvd and non-rsvd charges fully independent through their charge, commit, and error uncharge paths.
--- mm/hugetlb.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
mm/hugetlb.c +5 -4
@@ -3083,7 +3083,8 @@ struct page *alloc_huge_page(struct vm_area_struct *vma,long map_chg, map_commit;long gbl_chg;int ret, idx; -struct hugetlb_cgroup *h_cg; +struct hugetlb_cgroup *h_cg =NULL ; +struct hugetlb_cgroup *h_cg_rsvd =NULL ;bool deferred_reserve; idx =hstate_index (h);
@@ -3116,7 +3117,7 @@ struct page *alloc_huge_page(struct vm_area_struct *vma, deferred_reserve = map_chg || avoid_reserve;if (deferred_reserve) { ret =hugetlb_cgroup_charge_cgroup_rsvd ( - idx,pages_per_huge_page (h), &h_cg); + idx,pages_per_huge_page (h), &h_cg_rsvd);if (ret) goto out_subpool_put; }
@@ -3154,7 +3155,7 @@ struct page *alloc_huge_page(struct vm_area_struct *vma,*/ if (deferred_reserve) {hugetlb_cgroup_commit_charge_rsvd (idx,pages_per_huge_page (h), - h_cg, page); + h_cg_rsvd, page); }spin_unlock_irq (&hugetlb_lock);
@@ -3190,7 +3191,7 @@ struct page *alloc_huge_page(struct vm_area_struct *vma, out_uncharge_cgroup_reservation:if (deferred_reserve)hugetlb_cgroup_uncharge_cgroup_rsvd (idx,pages_per_huge_page (h), - h_cg); + h_cg_rsvd); out_subpool_put:if (map_chg || avoid_reserve)hugepage_subpool_put_pages (spool,1 );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1221/1887 netfilter: nft_fib: reject fib expression on the netdev egress hook
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodor Arsenij Larionov-Trichkine <[email protected]>
[ Upstream commit d07955dd34ecae17d35d8c7d0a273a3fba653a8c ]
A fib expression in a netdev egress base chain dereferences nft_in(pkt), NULL on the transmit path, causing a NULL pointer dereference at eval. nft_fib_validate() masks the hook with NF_INET_* values, but netdev hook numbers are a separate enum that aliases them (NF_NETDEV_EGRESS == NF_INET_LOCAL_IN), so an egress chain passes validation and then faults.
Add nft_fib_netdev_validate() that limits each result/flag to the netdev hook where the device it reads exists: the input-device cases (OIF, OIFNAME, ADDRTYPE with F_IIF) to ingress, the output-device case (ADDRTYPE with F_OIF) to egress, ADDRTYPE with no device flag to both. Also restrict nft_fib_validate() to NFPROTO_IPV4/IPV6/INET so its NF_INET_* masks are not applied to another family's hooks.
--- net/netfilter/nft_fib.c | 9 +++++++++ net/netfilter/nft_fib_netdev.c | 29 ++++++++++++++++++++++++++++- 2 files changed, 37 insertions(+), 1 deletion(-)
net/netfilter/nft_fib.c +9 -0
@@ -30,6 +30,15 @@ int nft_fib_validate(const struct nft_ctx *ctx, const struct nft_expr *expr)const struct nft_fib *priv =nft_expr_priv (expr);unsigned int hooks; +switch (ctx->family) { +case NFPROTO_IPV4 : +case NFPROTO_IPV6 : +case NFPROTO_INET : +break ; +default : +return -EOPNOTSUPP ; + } +switch (priv->result) {case NFT_FIB_RESULT_OIF :case NFT_FIB_RESULT_OIFNAME :
net/netfilter/nft_fib_netdev.c +28 -1
@@ -50,6 +50,33 @@ static void nft_fib_netdev_eval(const struct nft_expr *expr, regs->verdict.code =NFT_BREAK ; } +static int nft_fib_netdev_validate (const struct nft_ctx *ctx, +const struct nft_expr *expr) +{ +const struct nft_fib *priv =nft_expr_priv (expr); +unsigned int hooks; + +switch (priv->result) { +case NFT_FIB_RESULT_OIF : +case NFT_FIB_RESULT_OIFNAME : + hooks = (1 <<NF_NETDEV_INGRESS ); +break ; +case NFT_FIB_RESULT_ADDRTYPE : +if (priv->flags &NFTA_FIB_F_IIF ) + hooks = (1 <<NF_NETDEV_INGRESS ); +else if (priv->flags &NFTA_FIB_F_OIF ) + hooks = (1 <<NF_NETDEV_EGRESS ); +else + hooks = (1 <<NF_NETDEV_INGRESS ) | + (1 <<NF_NETDEV_EGRESS ); +break ; +default : +return -EINVAL ; + } + +return nft_chain_validate_hooks (ctx->chain, hooks); +} +static struct nft_expr_type nft_fib_netdev_type;static const struct nft_expr_ops nft_fib_netdev_ops = { .type = &nft_fib_netdev_type,
@@ -57,7 +84,7 @@ static const struct nft_expr_ops nft_fib_netdev_ops = { .eval = nft_fib_netdev_eval, .init = nft_fib_init, .dump = nft_fib_dump, - .validate = nft_fib_validate, + .validate = nft_fib_netdev_validate, .reduce = nft_fib_reduce, };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1222/1887 netfilter: nft_lookup: fix catchall element handling with inverted lookups
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tamaki Yanagawa <[email protected]>
[ Upstream commit e6107a4c74b54cb33e3bce162a63048ae5a6b198 ]
nft_lookup_eval() decides whether a lookup matched (found) from the direct set lookup and priv->invert before falling back to the catchall element used by interval sets (e.g. nft_set_rbtree) for the open-ended default range. Since found is never recomputed after ext is replaced by the catchall lookup, inverted lookups (NFT_LOOKUP_F_INV, "!= @set") can wrongly match or wrongly skip the catchall element, producing the wrong verdict. Fold the catchall lookup into ext before computing found, matching the order already used by nft_objref_map_eval().
--- net/netfilter/nft_lookup.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
net/netfilter/nft_lookup.c +8 -6
@@ -64,14 +64,16 @@ void nft_lookup_eval(const struct nft_expr *expr,const struct net *net =nft_net (pkt);bool found; - found =nft_set_do_lookup (net, set, ®s->data[priv->sreg], &ext) ^ - priv->invert; + found =nft_set_do_lookup (net, set, ®s->data[priv->sreg], &ext);if (!found) { ext =nft_set_catchall_lookup (net, set); -if (!ext) { - regs->verdict.code =NFT_BREAK ; -return ; - } + found = !!ext; + } + + found ^= priv->invert; +if (!found) { + regs->verdict.code =NFT_BREAK ; +return ; }if (ext) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1223/1887 ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 3546deaa0c30a14c7cdb5dc8f2432cb428f0cd36 ]
When a timer is deleted and not re-armed in igmp_mod_timer(), or stopped in igmp_stop_timer(), the code currently decrements the reference counter of the multicast list entry @im using refcount_dec(&im->refcnt).
However, both functions can be called from the RCU reader path:
- igmp_mod_timer() via igmp_heard_query() -> for_each_pmc_rcu()
- igmp_stop_timer() via igmp_rcv() -> igmp_heard_report()
If the group im was concurrently removed from the list by ip_mc_dec_group(), its reference count might have already been decremented to 1.
In this case, timer_delete() succeeds, and refcount_dec() decrements the refcount from 1 to 0. Since refcount_dec() does not free the object when it hits 0 (unlike ip_ma_put()), the im structure is leaked.
Fix this by using ip_ma_put(im) instead of refcount_dec(&im->refcnt), and deferring the put until after the spinlock is released.
--- net/ipv4/igmp.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
net/ipv4/igmp.c +12 -2
@@ -201,13 +201,18 @@ static void ip_sf_list_clear_all(struct ip_sf_list *psf)static void igmp_stop_timer (struct ip_mc_list *im) { +bool put = false; +spin_lock_bh (&im->lock);if (del_timer (&im->timer)) -refcount_dec (&im->refcnt); + put = true; im->tm_running =0 ; im->reporter =0 ; im->unsolicit_count =0 ;spin_unlock_bh (&im->lock); + +if (put) +ip_ma_put (im); }/* It must be called with locked im->lock */
@@ -250,6 +255,8 @@ static void igmp_ifc_start_timer(struct in_device *in_dev, int delay)static void igmp_mod_timer (struct ip_mc_list *im,int max_delay) { +bool put = false; +spin_lock_bh (&im->lock); im->unsolicit_count =0 ;if (del_timer (&im->timer)) {
@@ -259,10 +266,13 @@ static void igmp_mod_timer(struct ip_mc_list *im, int max_delay)spin_unlock_bh (&im->lock);return ; } -refcount_dec (&im->refcnt); + put = true; }igmp_start_timer (im, max_delay);spin_unlock_bh (&im->lock); + +if (put) +ip_ma_put (im); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1224/1887 perf/x86/amd/core: Avoid enabling BRS from the SVM reload path
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sandipan Das <[email protected]>
[ Upstream commit 07c60dda9c059c09f83d42a3ebda2e7cc1cf3bc2 ]
Branch Sampling (BRS) and Last Branch Record (LBR) are mutually exclusive hardware features, and users of both are tracked via cpuc->lbr_users.
When SVM is toggled on a CPU, the host perf events are reprogrammed to update the HostOnly filter bit (set when virtualization is enabled, cleared when it is disabled). On PerfMonV2-capable processors, this reprogramming is performed by calling amd_pmu_enable_all() to rewrite the event selectors. However, amd_pmu_enable_all() also calls amd_brs_enable_all(), which enables BRS whenever cpuc->lbr_users > 0. Having active LBR events satisfies this gating on processors that have LBR but not BRS. The kernel then tries to set the BRS enable bit in DebugExtnCfg (MSR 0xc000010f). Since that bit is deprecated on such hardware, the write results in a #GP:
Call Trace: <IRQ> amd_pmu_enable_all+0x1d/0x90 amd_pmu_disable_virt+0x62/0xb0 kvm_arch_disable_virtualization_cpu+0xa/0x40 [kvm] hardware_disable_nolock+0x1a/0x30 [kvm] __flush_smp_call_function_queue+0x9b/0x410 __sysvec_call_function+0x18/0xc0 sysvec_call_function+0x69/0x90 </IRQ> <TASK> asm_sysvec_call_function+0x16/0x20 RIP: 0010:cpuidle_enter_state+0xc4/0x450 ? cpuidle_enter_state+0xb7/0x450 cpuidle_enter+0x29/0x40 cpuidle_idle_call+0xf5/0x160 do_idle+0x7b/0xe0 cpu_startup_entry+0x26/0x30 start_secondary+0x115/0x140 secondary_startup_64_no_verify+0x194/0x19b </TASK>
Fix this by ensuring that BRS is not enabled from the event selector reprogramming path even when cpuc->lbr_users > 0.
--- arch/x86/events/amd/core.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
arch/x86/events/amd/core.c +8 -4
@@ -719,13 +719,11 @@ static void amd_pmu_enable_event(struct perf_event *event)x86_pmu_enable_event (event); } -static void amd_pmu_enable_all (int added) +static void __amd_pmu_enable_all (void ) {struct cpu_hw_events *cpuc =this_cpu_ptr (&cpu_hw_events);int idx; -amd_brs_enable_all (); -for (idx =0 ; idx < x86_pmu.num_counters; idx++) {/* only activate events which are marked as active */ if (!test_bit (idx, cpuc->active_mask))
@@ -740,6 +738,12 @@ static void amd_pmu_enable_all(int added) } } +static void amd_pmu_enable_all (int added) +{ +amd_brs_enable_all (); +__amd_pmu_enable_all (); +} +static void amd_pmu_v2_enable_event (struct perf_event *event) {struct hw_perf_event *hwc = &event->hw;
@@ -1493,7 +1497,7 @@ static inline void amd_pmu_reload_virt(void)* set global enable bits once again */ amd_pmu_v2_disable_all (); -amd_pmu_enable_all (0 ); +__amd_pmu_enable_all ();amd_pmu_v2_enable_all (0 );return ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1225/1887 net/liquidio: drop cached VF pci_dev LUT
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuho Choi <[email protected]>
[ Upstream commit 5c0e3ba4f500fd4314ceb42f07f16bc445156431 ]
The PF SR-IOV enable path caches VF pci_dev pointers in dpiring_to_vfpcidev_lut[] by iterating with pci_get_device(). Those entries do not own a reference, because the iterator drops the previous device reference on each step. The cached pointer is then dereferenced later when handling OCTEON_VF_FLR_REQUEST.
Replace the cached VF mapping with runtime lookup on the mailbox DPI
ring: derive the VF index from q_no, resolve the VF via exported PCI IOV helpers, validate it with the PF pointer and VF ID, then issue pcie_flr() and drop the reference with pci_dev_put(). Remove the unused VF lookup table initialization and cleanup.
--- .../net/ethernet/cavium/liquidio/lio_main.c | 27 --------------- .../ethernet/cavium/liquidio/octeon_device.h | 3 -- .../ethernet/cavium/liquidio/octeon_mailbox.c | 33 ++++++++++++++++++- 3 files changed, 32 insertions(+), 31 deletions(-)
drivers/net/ethernet/cavium/liquidio/lio_main.c +0 -27
@@ -3801,9 +3801,7 @@ static int setup_nic_devices(struct octeon_device *octeon_dev)static int octeon_enable_sriov (struct octeon_device *oct) {unsigned int num_vfs_alloced = oct->sriov_info.num_vfs_alloced; -struct pci_dev *vfdev;int err; -u32 u;if (OCTEON_CN23XX_PF (oct) && num_vfs_alloced) { err = pci_enable_sriov(oct->pci_dev,
@@ -3816,23 +3814,6 @@ static int octeon_enable_sriov(struct octeon_device *oct)return err; } oct->sriov_info.sriov_enabled =1 ; - -/* init lookup table that maps DPI ring number to VF pci_dev -* struct pointer -*/ - u =0 ; - vfdev =pci_get_device (PCI_VENDOR_ID_CAVIUM , -OCTEON_CN23XX_VF_VID ,NULL ); -while (vfdev) { -if (vfdev->is_virtfn && - (vfdev->physfn == oct->pci_dev)) { - oct->sriov_info.dpiring_to_vfpcidev_lut[u] = - vfdev; - u += oct->sriov_info.rings_per_vf; - } - vfdev =pci_get_device (PCI_VENDOR_ID_CAVIUM , -OCTEON_CN23XX_VF_VID , vfdev); - } }return num_vfs_alloced;
@@ -3840,8 +3821,6 @@ static int octeon_enable_sriov(struct octeon_device *oct)static int lio_pci_sriov_disable (struct octeon_device *oct) { -int u; -if (pci_vfs_assigned (oct->pci_dev)) {dev_err (&oct->pci_dev->dev,"VFs are still assigned to VMs.\n" );return -EPERM ;
@@ -3849,12 +3828,6 @@ static int lio_pci_sriov_disable(struct octeon_device *oct)pci_disable_sriov (oct->pci_dev); - u =0 ; -while (u <MAX_POSSIBLE_VFS ) { - oct->sriov_info.dpiring_to_vfpcidev_lut[u] =NULL ; - u += oct->sriov_info.rings_per_vf; - } - oct->sriov_info.num_vfs_alloced =0 ;dev_info (&oct->pci_dev->dev,"oct->pf_num:%d disabled VFs\n" , oct->pf_num);
drivers/net/ethernet/cavium/liquidio/octeon_device.h +0 -3
@@ -390,9 +390,6 @@ struct octeon_sriov_info {struct lio_trusted_vf trusted_vf; -/*lookup table that maps DPI ring number to VF pci_dev struct pointer*/ -struct pci_dev *dpiring_to_vfpcidev_lut[MAX_POSSIBLE_VFS ]; -u64 vf_macaddr[MAX_POSSIBLE_VFS ];u16 vf_vlantci[MAX_POSSIBLE_VFS ];
drivers/net/ethernet/cavium/liquidio/octeon_mailbox.c +32 -1
@@ -26,6 +26,31 @@#include "octeon_mailbox.h" #include "cn23xx_pf_device.h" +static struct pci_dev *lio_vf_pci_dev_by_qno (struct octeon_device *oct,u32 q_no) +{ +struct pci_dev *vfdev =NULL ; +int vfidx; + +if (!oct->sriov_info.rings_per_vf) +return NULL ; + +if (q_no % oct->sriov_info.rings_per_vf) +return NULL ; + + vfidx = q_no / oct->sriov_info.rings_per_vf; +if (vfidx >= oct->sriov_info.num_vfs_alloced) +return NULL ; + +while ((vfdev =pci_get_device (PCI_VENDOR_ID_CAVIUM , +OCTEON_CN23XX_VF_VID , vfdev))) { +if (pci_physfn (vfdev) &&pci_physfn (vfdev) == oct->pci_dev && +pci_iov_vf_id (vfdev) == vfidx) +return vfdev; + } + +return NULL ; +} +/** * octeon_mbox_read: * @mbox: Pointer mailbox
@@ -237,6 +262,7 @@ static int octeon_mbox_process_cmd(struct octeon_mbox *mbox, struct octeon_mbox_cmd *mbox_cmd) {struct octeon_device *oct = mbox->oct_dev; +struct pci_dev *vfdev;switch (mbox_cmd->msg.s.cmd) {case OCTEON_VF_ACTIVE :
@@ -260,7 +286,12 @@ static int octeon_mbox_process_cmd(struct octeon_mbox *mbox,dev_info (&oct->pci_dev->dev,"got a request for FLR from VF that owns DPI ring %u\n" , mbox->q_no); -pcie_flr (oct->sriov_info.dpiring_to_vfpcidev_lut[mbox->q_no]); + vfdev =lio_vf_pci_dev_by_qno (oct, mbox->q_no); +if (!vfdev) +break ; + +pcie_flr (vfdev); +pci_dev_put (vfdev);break ;case OCTEON_PF_CHANGED_VF_MACADDR :
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1226/1887 Bluetooth: 6lowpan: avoid untracked enable work
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang <[email protected]>
[ Upstream commit 352a59dc1f4a41314b6f827c17e16af7ca88271a ]
lowpan_enable_set() allocates a temporary work item and schedules do_enable_set() on system_wq, then returns to debugfs. The debugfs active operation has ended at that point, but the worker still executes module text and manipulates enable_6lowpan and listen_chan.
bt_6lowpan_exit() removes the debugfs files and immediately closes and puts listen_chan. It has no pointer to the queued work item, so it cannot cancel or flush it before tearing down the state that the worker uses.
The buggy scenario involves two paths, with each column showing the order within that path:
debugfs enable write module exit
1. lowpan_enable_set() allocates 1. bt_6lowpan_exit() removes
set_enable work the debugfs file
2. schedule_work() queues 2. bt_6lowpan_exit() closes
do_enable_set() and puts listen_chan
3. the write operation returns 3. module teardown can continue
4. do_enable_set() later runs
against stale state
Run the enable state transition synchronously in lowpan_enable_set() instead. The simple debugfs setter can sleep, and this file already handles the 6LoWPAN control write synchronously under the same set_lock. Once the setter returns, debugfs removal covers the whole operation and exit can no longer race with an untracked work item.
Validation reproduced this kernel report:
BUG: KASAN: slab-use-after-free in do_enable_set+0x113/0x2e0 Workqueue: events do_enable_set [bluetooth_6lowpan] The buggy address belongs to the object at ffff888109cb8000
--- net/bluetooth/6lowpan.c | 27 ++++----------------------- 1 file changed, 4 insertions(+), 23 deletions(-)
net/bluetooth/6lowpan.c +4 -23
@@ -1062,23 +1062,15 @@ static void disconnect_all_peers(void) }while (nchans); } -struct set_enable { -struct work_struct work; -bool flag; -}; - -static void do_enable_set (struct work_struct *work) +static void do_enable_set (bool flag) { -struct set_enable *set_enable =container_of (work, - struct set_enable, work); - -if (!set_enable->flag || enable_6lowpan != set_enable->flag) +if (!flag || enable_6lowpan != flag)/* Disconnect existing connections if 6lowpan is * disabled */ disconnect_all_peers (); - enable_6lowpan = set_enable->flag; + enable_6lowpan = flag;mutex_lock (&set_lock);if (listen_chan) {
@@ -1088,22 +1080,11 @@ static void do_enable_set(struct work_struct *work) listen_chan =bt_6lowpan_listen ();mutex_unlock (&set_lock); - -kfree (set_enable); }static int lowpan_enable_set (void *data,u64 val) { -struct set_enable *set_enable; - - set_enable =kzalloc (sizeof (*set_enable),GFP_KERNEL ); -if (!set_enable) -return -ENOMEM ; - - set_enable->flag = !!val; -INIT_WORK (&set_enable->work, do_enable_set); - -schedule_work (&set_enable->work); +do_enable_set (!!val);return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1227/1887 net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <[email protected]>
[ Upstream commit 8b519cbcabe836a441369fbec1a8a6518a709251 ]
There is a TOCTOU race condition in flower lockless approach between sizing a flow_rule buffer and filling it. [email protected] reports:
The cls_flower classifier operates with TCF_PROTO_OPS_DOIT_UNLOCKED (fl_change runs without RTNL), while RTM_NEWACTION holds RTNL, so the independent locking domains make the race reachable in practice. KASAN confirms:
BUG: KASAN: slab-out-of-bounds in tcf_pedit_offload_act_setup+0x81b/0x930 Write of size 4 at addr ffff888001f27520 by task poc-toctou/312 The buggy address is located 0 bytes to the right of allocated 288-byte region [ffff888001f27400, ffff888001f27520) (cache kmalloc-512)
Note: The result is a heap OOB write attacker-controlled content into the adjacent slab object (requires CAP_NET_ADMIN).
The fix introduces reading tcfp_nkeys under act->tcfa_lock in all places using a new tcf_pedit_nkeys_locked() which replaces the old tcf_pedit_nkeys(). Additionally we close the remaining TOCTOU window between the sizing read and the fill reads by more careful accounting.
Rather than silently truncating the key count, which leads to incorrect action semantics offloaded to hardware and secondary OOB writes if the remaining capacity is zero or consumed by prior actions, we enforce remaining capacity checks and return -ENOSPC if the required space exceeds the remaining capacity.
--- include/net/tc_act/tc_pedit.h | 18 ++++++++---------- net/sched/act_api.c | 13 +++++++++---- net/sched/act_pedit.c | 11 ++++++++++- net/sched/cls_api.c | 22 +++++++++++++++++----- 4 files changed, 44 insertions(+), 20 deletions(-)
include/net/tc_act/tc_pedit.h +8 -10
@@ -36,17 +36,15 @@ static inline bool is_tcf_pedit(const struct tc_action *a)return false; } -static inline int tcf_pedit_nkeys (const struct tc_action *a) +/* Must be called with act->tcfa_lock held to ensure consistency of parallel +* reads of the same action's pedit keys (e.g. flow_offload count vs fill). +* Note, this is only used for pedit offload. +*/ +static inline int tcf_pedit_nkeys_locked (const struct tc_action *a) { -struct tcf_pedit_parms *parms; -int nkeys; - -rcu_read_lock (); - parms =to_pedit_parms (a); - nkeys = parms->tcfp_nkeys; -rcu_read_unlock (); - -return nkeys; +lockdep_assert_held (&a->tcfa_lock); +return rcu_dereference_protected (to_pedit (a)->parms, +lockdep_is_held (&a->tcfa_lock))->tcfp_nkeys; }static inline u32 tcf_pedit_htype (const struct tc_action *a,int index)
net/sched/act_api.c +9 -4
@@ -147,10 +147,15 @@ static void offload_action_hw_count_dec(struct tc_action *act,static unsigned int tcf_offload_act_num_actions_single (struct tc_action *act) { -if (is_tcf_pedit (act)) -return tcf_pedit_nkeys (act); -else -return 1 ; +unsigned int count; + +if (is_tcf_pedit (act)) { +spin_lock_bh (&act->tcfa_lock); + count =tcf_pedit_nkeys_locked (act); +spin_unlock_bh (&act->tcfa_lock); +return count; + } +return 1 ; }static bool tc_act_skip_hw (u32 flags)
net/sched/act_pedit.c +10 -1
@@ -556,9 +556,18 @@ static int tcf_pedit_offload_act_setup(struct tc_action *act, void *entry_data, {if (bind) {struct flow_action_entry *entry = entry_data; +int nkeys =tcf_pedit_nkeys_locked (act);int k; -for (k =0 ; k <tcf_pedit_nkeys (act); k++) { +/* If the required keys exceed the remaining capacity return +* -ENOSPC to abort the offload and fallback to software. +*/ +if (nkeys > *index_inc) { +NL_SET_ERR_MSG_MOD (extack,"Not enough space to offload all pedit keys" ); +return -ENOSPC ; + } + +for (k =0 ; k < nkeys; k++) {switch (tcf_pedit_cmd (act, k)) {case TCA_PEDIT_KEY_EX_CMD_SET : entry->id =FLOW_ACTION_MANGLE ;
net/sched/cls_api.c +17 -5
@@ -3631,12 +3631,21 @@ int tc_setup_action(struct flow_action *flow_action, entry = &flow_action->entries[j];spin_lock_bh (&act->tcfa_lock); + +/* Abort the offload if we have exhausted the allocated capacity */ +if (j >= flow_action->num_entries) { +NL_SET_ERR_MSG_MOD (extack,"Flow action buffer overflow" ); + err = -ENOSPC ; + goto err_out_locked; + } + err =tcf_act_get_cookie (entry, act);if (err) goto err_out_locked; - index =0 ; - err =tc_setup_offload_act (act, entry, &index, extack); + index = flow_action->num_entries - j; + err =tc_setup_offload_act (act, entry, &index, + extack);if (err) goto err_out_locked;
@@ -3682,10 +3691,13 @@ unsigned int tcf_exts_num_actions(struct tcf_exts *exts)int i;tcf_exts_for_each_action (i, act, exts) { -if (is_tcf_pedit (act)) - num_acts +=tcf_pedit_nkeys (act); -else +if (is_tcf_pedit (act)) { +spin_lock_bh (&act->tcfa_lock); + num_acts +=tcf_pedit_nkeys_locked (act); +spin_unlock_bh (&act->tcfa_lock); + }else { num_acts++; + } }return num_acts; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1228/1887 net/mlx5e: Fix publication race for priv->channel_stats[]
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Feng Liu <[email protected]>
[ Upstream commit 5a799714e8ca0bce9ea40694f49914cf1adbbaa9 ]
mlx5e_channel_stats_alloc() publishes a new entry to priv->channel_stats[] and then increments priv->stats_nch as a publication token, but neither store carries any memory barrier:
priv->channel_stats[ix] = kvzalloc_node(...); if (!priv->channel_stats[ix]) return -ENOMEM; priv->stats_nch++;
Concurrent readers compute the loop bound from priv->stats_nch and then dereference priv->channel_stats[i] using plain accesses, e.g.
for (i = 0; i < priv->stats_nch; i++) {
struct mlx5e_channel_stats *cs = priv->channel_stats[i];
... cs->rq.packets ...
}On weakly-ordered architectures (ARM, PowerPC, RISC-V) the writes to channel_stats[ix] and stats_nch may become visible to other CPUs out of program order. A reader can observe stats_nch == N while still seeing channel_stats[N-1] == NULL, leading to a NULL pointer dereference in the channel_stats loop.
This has been observed in production on BlueField-3 DPUs (arm64), where ovs-vswitchd queries netdev statistics over netlink during NIC bringup, racing mlx5e_open_channel() -> mlx5e_channel_stats_alloc() on another CPU:
Unable to handle kernel NULL pointer dereference at virtual address 0x840 Hardware name: BlueField-3 DPU pc : mlx5e_fold_sw_stats64+0x30/0x180 [mlx5_core] Call trace: mlx5e_fold_sw_stats64+0x30/0x180 [mlx5_core] dev_get_stats+0x50/0xc0 ovs_vport_get_stats+0x38/0xac [openvswitch] ovs_vport_cmd_fill_info+0x194/0x290 [openvswitch] ovs_vport_cmd_get+0xbc/0x10c [openvswitch] genl_family_rcv_msg_doit+0xd0/0x160 genl_rcv_msg+0xec/0x1f0 netlink_rcv_skb+0x64/0x130 genl_rcv+0x40/0x60 netlink_unicast+0x2fc/0x370 netlink_sendmsg+0x1dc/0x454 ... __arm64_sys_sendmsg+0x2c/0x40
Add mlx5e_stats_nch_write() and mlx5e_stats_nch_read() helpers in en.h that wrap the smp_store_release()/smp_load_acquire() pair on stats_nch. The release/acquire pair establishes the contract:
stats_nch == N => channel_stats[0..N-1] are visible and non-NULL.
Publish the stats_nch increment via mlx5e_stats_nch_write() in the writer (mlx5e_channel_stats_alloc()), and read stats_nch via mlx5e_stats_nch_read() in all readers: mlx5e RX/TX queue stats, mlx5e_get_base_stats(), ethtool channels stats, IPoIB stats, the sw_stats fold and the HV VHCA stats agent.
--- drivers/net/ethernet/mellanox/mlx5/core/en.h | 12 ++++++++++++ .../ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c | 10 ++++++---- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 5 +++-- drivers/net/ethernet/mellanox/mlx5/core/en_stats.c | 9 +++++---- .../net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c | 3 ++- 5 files changed, 28 insertions(+), 11 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en.h +12 -0
@@ -958,6 +958,18 @@ struct mlx5e_priv {struct mlx5e_mqprio_rl *mqprio_rl; }; +static inline u16 mlx5e_stats_nch_read (const struct mlx5e_priv *priv) +{ +/* Pairs with smp_store_release in mlx5e_stats_nch_write(). */ +return smp_load_acquire (&priv->stats_nch); +} + +static inline void mlx5e_stats_nch_write (struct mlx5e_priv *priv,u16 n) +{ +/* Pairs with smp_load_acquire in mlx5e_stats_nch_read(). */ +smp_store_release (&priv->stats_nch, n); +} +struct mlx5e_rx_handlers {mlx5e_fp_handle_rx_cqe handle_rx_cqe;mlx5e_fp_handle_rx_cqe handle_rx_cqe_mpwqe;
drivers/net/ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c +6 -4
@@ -33,9 +33,10 @@ mlx5e_hv_vhca_fill_ring_stats(struct mlx5e_priv *priv, int ch,static void mlx5e_hv_vhca_fill_stats (struct mlx5e_priv *priv,void *data,int buf_len) { +u16 nch =mlx5e_stats_nch_read (priv);int ch, i =0 ; -for (ch =0 ; ch < priv->stats_nch; ch++) { +for (ch =0 ; ch < nch; ch++) {void *buf = data + i; if (WARN_ON_ONCE(buf +
@@ -50,8 +51,9 @@ static void mlx5e_hv_vhca_fill_stats(struct mlx5e_priv *priv, void *data,static int mlx5e_hv_vhca_stats_buf_size (struct mlx5e_priv *priv) { -return (sizeof (struct mlx5e_hv_vhca_per_ring_stats ) * - priv->stats_nch); +u16 nch =mlx5e_stats_nch_read (priv); + +return sizeof (struct mlx5e_hv_vhca_per_ring_stats ) * nch; }static int mlx5e_hv_vhca_stats_buf_max_size (struct mlx5e_priv *priv)
@@ -106,7 +108,7 @@ static void mlx5e_hv_vhca_stats_control(struct mlx5_hv_vhca_agent *agent, sagent = &priv->stats_agent; block->version =MLX5_HV_VHCA_STATS_VERSION ; - block->rings = priv->stats_nch; + block->rings =mlx5e_stats_nch_read (priv);if (!block->command) {cancel_delayed_work_sync (&priv->stats_agent.work);
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +3 -2
@@ -2346,7 +2346,7 @@ static int mlx5e_channel_stats_alloc(struct mlx5e_priv *priv, int ix, int cpu) GFP_KERNEL, cpu_to_node(cpu));if (!priv->channel_stats[ix])return -ENOMEM ; - priv->stats_nch++; +mlx5e_stats_nch_write (priv, priv->stats_nch +1 );return 0 ; }
@@ -3595,9 +3595,10 @@ static int mlx5e_setup_tc(struct net_device *dev, enum tc_setup_type type,void mlx5e_fold_sw_stats64 (struct mlx5e_priv *priv,struct rtnl_link_stats64 *s) { +u16 nch =mlx5e_stats_nch_read (priv);int i; -for (i =0 ; i < priv->stats_nch; i++) { +for (i =0 ; i < nch; i++) {struct mlx5e_channel_stats *channel_stats = priv->channel_stats[i];struct mlx5e_rq_stats *xskrq_stats = &channel_stats->xskrq;struct mlx5e_rq_stats *rq_stats = &channel_stats->rq;
drivers/net/ethernet/mellanox/mlx5/core/en_stats.c +5 -4
@@ -517,6 +517,7 @@ static void mlx5e_stats_update_stats_rq_page_pool(struct mlx5e_channel *c)static MLX5E_DECLARE_STATS_GRP_OP_UPDATE_STATS (sw) {struct mlx5e_sw_stats *s = &priv->stats.sw; +u16 nch =mlx5e_stats_nch_read (priv);int i;memset (s,0 ,sizeof (*s));
@@ -524,7 +525,7 @@ static MLX5E_DECLARE_STATS_GRP_OP_UPDATE_STATS(sw)for (i =0 ; i < priv->channels.num; i++)/* for active channels only */ mlx5e_stats_update_stats_rq_page_pool (priv->channels.c[i]); -for (i =0 ; i < priv->stats_nch; i++) { +for (i =0 ; i < nch; i++) {struct mlx5e_channel_stats *channel_stats = priv->channel_stats[i];
@@ -2328,7 +2329,7 @@ static MLX5E_DECLARE_STATS_GRP_OP_UPDATE_STATS(ptp) { return; }static MLX5E_DECLARE_STATS_GRP_OP_NUM_STATS (channels) { -int max_nch = priv->stats_nch; +int max_nch =mlx5e_stats_nch_read (priv);return (NUM_RQ_STATS * max_nch) + (NUM_CH_STATS * max_nch) +
@@ -2341,8 +2342,8 @@ static MLX5E_DECLARE_STATS_GRP_OP_NUM_STATS(channels)static MLX5E_DECLARE_STATS_GRP_OP_FILL_STRS (channels) { +int max_nch =mlx5e_stats_nch_read (priv);bool is_xsk = priv->xsk.ever_used; -int max_nch = priv->stats_nch;int i, j, tc;for (i =0 ; i < max_nch; i++)
@@ -2383,8 +2384,8 @@ static MLX5E_DECLARE_STATS_GRP_OP_FILL_STRS(channels)static MLX5E_DECLARE_STATS_GRP_OP_FILL_STATS (channels) { +int max_nch =mlx5e_stats_nch_read (priv);bool is_xsk = priv->xsk.ever_used; -int max_nch = priv->stats_nch;int i, j, tc;for (i =0 ; i < max_nch; i++)
drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c +2 -1
@@ -114,10 +114,11 @@ void mlx5i_cleanup(struct mlx5e_priv *priv)static void mlx5i_grp_sw_update_stats (struct mlx5e_priv *priv) { +u16 nch =mlx5e_stats_nch_read (priv);struct rtnl_link_stats64 s = {};int i, j; -for (i =0 ; i < priv->stats_nch; i++) { +for (i =0 ; i < nch; i++) {struct mlx5e_channel_stats *channel_stats;struct mlx5e_rq_stats *rq_stats;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1229/1887 afs: Fix reinitialisation of the inode, in particular ->lock_work
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit 5597fbd1e7c161914f20315a726e54025b0fdadb ]
It seems that initalising afs_vnode::lock_work a single time in the slab's init function isn't sufficient for work_structs. This results in the DEBUG_OBJECTS debugging stuff producing a warning occasionally when running the generic/131 xfstest:
ODEBUG: activate not available (active state 0) object: 0000000016d8760f object type: work_struct hint: afs_lock_work+0x0/0x220
WARNING: lib/debugobjects.c:629 at debug_print_object+0x4b/0x90, CPU#3: locktest/7695 ... CPU: 3 UID: 0 PID: 7695 Comm: locktest Tainted: G S 7.1.0-build3+ #2771 PREEMPT ... RIP: 0010:debug_print_object+0x65/0x90 ... Call Trace: <TASK> ? __pfx_afs_lock_work+0x10/0x10 debug_object_activate+0x122/0x170 insert_work+0x25/0x60 __queue_work+0x2e0/0x340 queue_delayed_work_on+0x48/0x70 afs_fl_release_private+0x57/0x70 locks_release_private+0x5c/0xa0 locks_free_lock+0xe/0x20 posix_lock_inode+0x55f/0x5b0 locks_lock_inode_wait+0x81/0x140 ? file_write_and_wait_range+0x50/0x70 afs_lock+0xcd/0x110 fcntl_setlk+0x10d/0x260 do_fcntl+0x24e/0x5b0 __do_sys_fcntl+0x6a/0x90 do_syscall_64+0x11e/0x310 entry_SYSCALL_64_after_hwframe+0x71/0x79
Fix this by reinitialising ->lock_work after allocating an inode.
Also, flush ->lock_work when the inode is being evicted to make sure it's not still running.
--- fs/afs/inode.c | 1 + fs/afs/super.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-)
fs/afs/inode.c +1 -0
@@ -809,6 +809,7 @@ void afs_evict_inode(struct inode *inode) ASSERTCMP(inode->i_ino, ==, vnode->fid.vnode); +flush_delayed_work (&vnode->lock_work);truncate_inode_pages_final (&inode->i_data);afs_set_cache_aux (vnode, &aux);
fs/afs/super.c +1 -1
@@ -670,7 +670,6 @@ static void afs_i_init_once(void *_vnode)INIT_LIST_HEAD (&vnode->wb_keys);INIT_LIST_HEAD (&vnode->pending_locks);INIT_LIST_HEAD (&vnode->granted_locks); -INIT_DELAYED_WORK (&vnode->lock_work, afs_lock_work);INIT_LIST_HEAD (&vnode->cb_mmap_link);seqlock_init (&vnode->cb_lock); }
@@ -702,6 +701,7 @@ static struct inode *afs_alloc_inode(struct super_block *sb)init_rwsem (&vnode->rmdir_lock);INIT_WORK (&vnode->cb_work, afs_invalidate_mmap_work); +INIT_DELAYED_WORK (&vnode->lock_work, afs_lock_work);_leave (" = %p" , &vnode->netfs.inode);return &vnode->netfs.inode;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1230/1887 fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Brauner <[email protected]>
[ Upstream commit 539dce1144651f7976fa418e618b0b574bf15eeb ]
vfs_tmpfile() never checked that the caller's fsuid and fsgid map into the filesystem. On an idmapped mount whose idmapping does not cover the caller's fs{u,g}id, the ->tmpfile() instance initializes the new inode through inode_init_owner(), where mapped_fsuid()/mapped_fsgid() return INVALID_UID/INVALID_GID, and the tmpfile ends up owned by (uid_t)-1.
Every other creation path already refuses this: may_o_create() (O_CREAT) and may_create_dentry() (mkdir, mknod, symlink, link) bail out with -EOVERFLOW via fsuidgid_has_mapping() precisely so that an object cannot be created with an owner the filesystem cannot represent. An O_TMPFILE is no exception: it is created I_LINKABLE and linkat(2) can splice it into the namespace afterwards, so the same guarantee must hold.
Add the missing fsuidgid_has_mapping() check to vfs_tmpfile(). On a non-idmapped mount the caller's fs{u,g}id always map in the superblock's user namespace, so this is a no-op there and only takes effect on an idmapped mount that does not map the caller. It applies to every filesystem that sets FS_ALLOW_IDMAP and implements ->tmpfile() (tmpfs, ext4, btrfs, xfs, f2fs, ...), and to overlayfs, whose upper-layer tmpfile creation funnels through vfs_tmpfile() via backing_tmpfile_open().
--- fs/namei.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/namei.c +4 -0
@@ -3713,6 +3713,10 @@ static int vfs_tmpfile(struct user_namesint error;int open_flag = file->f_flags; +/* A tmpfile is I_LINKABLE, so guard its owner like may_o_create(). */ +if (!fsuidgid_has_mapping (dir->i_sb, mnt_userns)) +return -EOVERFLOW ; +/* we want directory to be writable */ error =inode_permission (mnt_userns, dir,MAY_WRITE |MAY_EXEC );if (error)
Greg Kroah-Hartman
maintainerPATCH 1231/1887 xen/pvcalls: bound backend response req_id before indexing rsp[]
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <[email protected]>
[ Upstream commit d33846c8dcc06b83b7acdeac1e8bfbb5c0c26cb2 ]
pvcalls_front_event_handler() takes req_id directly from the backend-supplied ring response and uses it to index the fixed-size bedata->rsp[] array for a memcpy() and a store, with no range check. A malicious or buggy backend can set req_id past PVCALLS_NR_RSP_PER_RING and drive an out-of-bounds write past the bedata allocation.
req_id was also declared int while the wire field rsp->req_id is u32, so a range check on the signed value alone is insufficient: a backend req_id of 0xffffffff becomes -1, passes a >= PVCALLS_NR_RSP_PER_RING test and indexes bedata->rsp[-1]. Declare req_id as u32 so a single bound covers both ends.
A backend that sends an out-of-range req_id has violated the wire protocol, so rather than silently dropping the response, log once and stop trusting the backend: set bedata->disabled. The event handler then ignores further responses, and the request paths that wait for a response return -EIO instead of blocking forever. This mirrors the fatal-error handling xen-netback uses (xenvif_fatal_tx_err()).
The pvcalls frontend currently trusts its backend, so this is not a classic-Xen security issue, but it matters for hardening PV frontends against malicious backends (confidential and disaggregated deployments).
Message-ID: <[email protected]>
--- drivers/xen/pvcalls-front.c | 88 ++++++++++++++++++++++++++++++++----- 1 file changed, 76 insertions(+), 12 deletions(-)
drivers/xen/pvcalls-front.c +76 -12
@@ -32,6 +32,7 @@ struct pvcalls_bedata {struct xen_pvcalls_front_ring ring;grant_ref_t ref;int irq; +bool disabled;struct list_head socket_mappings;spinlock_t socket_lock;
@@ -131,6 +132,20 @@ static inline int get_request(struct pvcalls_bedata *bedata, int *req_id)return 0 ; } +/* +* Wait for the backend's response to req_id, or for the frontend to be +* disabled because the backend violated the wire protocol. Returns 0 once +* the response has arrived, or -EIO if the frontend was disabled. +*/ +static int pvcalls_front_wait_rsp (struct pvcalls_bedata *bedata,u32 req_id) +{ +wait_event (bedata->inflight_req, +READ_ONCE (bedata->rsp[req_id].req_id) == req_id || +READ_ONCE (bedata->disabled)); + +return READ_ONCE (bedata->disabled) ? -EIO :0 ; +} +static bool pvcalls_front_write_todo (struct sock_mapping *map) {struct pvcalls_data_intf *intf = map->active.ring;
@@ -168,7 +183,8 @@ static irqreturn_t pvcalls_front_event_handler(int irq, void *dev_id)struct pvcalls_bedata *bedata;struct xen_pvcalls_response *rsp;uint8_t *src, *dst; -int req_id =0 , more =0 , done =0 ; +u32 req_id =0 ; +int more =0 , done =0 ;if (dev ==NULL )return IRQ_HANDLED ;
@@ -179,12 +195,31 @@ static irqreturn_t pvcalls_front_event_handler(int irq, void *dev_id)pvcalls_exit ();return IRQ_HANDLED ; } +if (READ_ONCE (bedata->disabled)) { +pvcalls_exit (); +return IRQ_HANDLED ; + } again:while (RING_HAS_UNCONSUMED_RESPONSES (&bedata->ring)) { rsp =RING_GET_RESPONSE (&bedata->ring, bedata->ring.rsp_cons); req_id = rsp->req_id; +if (req_id >=PVCALLS_NR_RSP_PER_RING ) { +/* +* The backend supplied a req_id that would index +* bedata->rsp[] out of bounds: a protocol violation +* from a malicious or buggy backend. Log once, stop +* trusting this backend and disable the frontend rather +* than silently dropping the response and continuing. +*/ +pr_err_once ("pvcalls: backend sent out-of-range req_id %u, disabling frontend\n" , + req_id); +WRITE_ONCE (bedata->disabled, true); + bedata->ring.rsp_cons++; + done =1 ; +break ; + }if (rsp->cmd ==PVCALLS_POLL ) {struct sock_mapping *map = (struct sock_mapping *)(uintptr_t ) rsp->u.poll.id;
@@ -217,7 +252,7 @@ static irqreturn_t pvcalls_front_event_handler(int irq, void *dev_id) }RING_FINAL_CHECK_FOR_RESPONSES (&bedata->ring, more); -if (more) +if (more && !READ_ONCE (bedata->disabled)) goto again;if (done)wake_up (&bedata->inflight_req);
@@ -322,8 +357,11 @@ int pvcalls_front_socket(struct socket *sock)if (notify)notify_remote_via_irq (bedata->irq); -wait_event (bedata->inflight_req, -READ_ONCE (bedata->rsp[req_id].req_id) == req_id); + ret =pvcalls_front_wait_rsp (bedata, req_id); +if (ret) { +pvcalls_exit (); +return ret; + }/* read req_id, then the content */ smp_rmb ();
@@ -469,8 +507,11 @@ int pvcalls_front_connect(struct socket *sock, struct sockaddr *addr,if (notify)notify_remote_via_irq (bedata->irq); -wait_event (bedata->inflight_req, -READ_ONCE (bedata->rsp[req_id].req_id) == req_id); + ret =pvcalls_front_wait_rsp (bedata, req_id); +if (ret) { +pvcalls_exit_sock (sock); +return ret; + }/* read req_id, then the content */ smp_rmb ();
@@ -700,8 +741,11 @@ int pvcalls_front_bind(struct socket *sock, struct sockaddr *addr, int addr_len)if (notify)notify_remote_via_irq (bedata->irq); -wait_event (bedata->inflight_req, -READ_ONCE (bedata->rsp[req_id].req_id) == req_id); + ret =pvcalls_front_wait_rsp (bedata, req_id); +if (ret) { +pvcalls_exit_sock (sock); +return ret; + }/* read req_id, then the content */ smp_rmb ();
@@ -749,8 +793,11 @@ int pvcalls_front_listen(struct socket *sock, int backlog)if (notify)notify_remote_via_irq (bedata->irq); -wait_event (bedata->inflight_req, -READ_ONCE (bedata->rsp[req_id].req_id) == req_id); + ret =pvcalls_front_wait_rsp (bedata, req_id); +if (ret) { +pvcalls_exit_sock (sock); +return ret; + }/* read req_id, then the content */ smp_rmb ();
@@ -806,6 +853,14 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags) } } +if (READ_ONCE (bedata->disabled)) { +clear_bit (PVCALLS_FLAG_ACCEPT_INFLIGHT , + (void *)&map->passive.flags); +wake_up (&map->passive.inflight_accept_req); +pvcalls_exit_sock (sock); +return -EIO ; + } + map2 =kzalloc (sizeof (*map2),GFP_KERNEL );if (map2 ==NULL ) { clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
@@ -867,10 +922,18 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags) }if (wait_event_interruptible (bedata->inflight_req, -READ_ONCE (bedata->rsp[req_id].req_id) == req_id)) { +READ_ONCE (bedata->rsp[req_id].req_id) == req_id || +READ_ONCE (bedata->disabled))) {pvcalls_exit_sock (sock);return -EINTR ; } +if (READ_ONCE (bedata->disabled)) { +clear_bit (PVCALLS_FLAG_ACCEPT_INFLIGHT , + (void *)&map->passive.flags); +wake_up (&map->passive.inflight_accept_req); +pvcalls_exit_sock (sock); +return -EIO ; + }/* read req_id, then the content */ smp_rmb ();
@@ -1039,7 +1102,8 @@ int pvcalls_front_release(struct socket *sock)notify_remote_via_irq (bedata->irq);wait_event (bedata->inflight_req, -READ_ONCE (bedata->rsp[req_id].req_id) == req_id); +READ_ONCE (bedata->rsp[req_id].req_id) == req_id || +READ_ONCE (bedata->disabled));if (map->active_socket) {/*
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1232/1887 ksmbd: reject undersized DACLs before parsing ACEs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haofeng Li <[email protected]>
[ Upstream commit 60908f7ebcd9b6cde74ad5711fab0f49c7970949 ]
parse_dacl() limits the attacker-controlled ACE count by comparing it with the number of minimal ACEs that fit in the DACL size. The DACL size field is 16 bits, but the expression subtracts sizeof(struct smb_acl). Because sizeof() is unsigned, a DACL size smaller than the ACL header underflows to a large size_t.
A malicious client can reach this with:
SMB2_SET_INFO (InfoType=SMB2_O_INFO_SECURITY)
-> smb2_set_info_sec()
-> set_info_sec()
-> parse_sec_desc()
-> parse_dacl()
-> init_acl_state(..., 0xffff)
-> init_acl_state(..., 0xffff)
-> kmalloc_objs(..., 0xffff)Thus a malformed security descriptor can make num_aces pass the guard and drive large temporary ACL state and pointer-array allocations.
Reject DACLs smaller than struct smb_acl before doing the subtraction, so the ACE count check cannot be bypassed by the underflow.
--- fs/smb/server/smbacl.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
fs/smb/server/smbacl.c +6 -1
@@ -387,6 +387,7 @@ static void parse_dacl(struct user_namespace *user_ns, {int i, ret;int num_aces =0 ; +u16 dacl_size;unsigned int acl_size;char *acl_base;struct smb_ace **ppace;
@@ -416,7 +417,11 @@ static void parse_dacl(struct user_namespace *user_ns,if (num_aces <=0 )return ; -if (num_aces > (le16_to_cpu (pdacl->size) -sizeof (struct smb_acl )) / + dacl_size =le16_to_cpu (pdacl->size); +if (dacl_size <sizeof (struct smb_acl )) +return ; + +if (num_aces > (dacl_size -sizeof (struct smb_acl )) / (offsetof(struct smb_ace , sid) + offsetof(struct smb_sid , sub_auth) +sizeof (__le16)))return ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1233/1887 sctp: fix addr_wq_timer race in sctp_free_addr_wq()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit 976c19de0f22a857ba0112f39635f8fd7a257568 ]
sctp_free_addr_wq() previously removed addr_wq_timer using timer_delete() while holding addr_wq_lock. However, timer_delete() does not guarantee that a currently running timer handler has completed.
This allows a race with sctp_addr_wq_timeout_handler(), where the handler may still run after addr_waitq has been freed, acquire addr_wq_lock, and access freed memory, leading to a use-after-free.
Fix this by calling timer_shutdown_sync() before taking addr_wq_lock. This guarantees that any in-flight timer handler has finished and prevents the timer from being re-armed during teardown, making subsequent cleanup safe.
--- net/sctp/protocol.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/sctp/protocol.c +2 -1
@@ -685,8 +685,9 @@ static void sctp_free_addr_wq(struct net *net)struct sctp_sockaddr_entry *addrw;struct sctp_sockaddr_entry *temp; +timer_shutdown_sync (&net->sctp.addr_wq_timer); +spin_lock_bh (&net->sctp.addr_wq_lock); -del_timer (&net->sctp.addr_wq_timer);list_for_each_entry_safe (addrw, temp, &net->sctp.addr_waitq, list) {list_del (&addrw->list);kfree (addrw);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1234/1887 sctp: add INIT verification after cookie unpacking
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit 414c5447fe6a200613dd46d7fdc8454622076cb1 ]
In SCTP handshake, the INIT chunk is initially processed by the server and embedded into the cookie carried in INIT-ACK. The client then returns this cookie via COOKIE-ECHO, where the server unpacks it and reconstructs the original INIT chunk.
When cookie authentication is enabled, the cookie contents are protected against tampering, so reusing the unpacked INIT without re-verification is safe.
However, when cookie authentication is disabled, the reconstructed INIT can no longer be trusted. In this case, the INIT must be explicitly validated after unpacking to avoid processing potentially tampered data.
Add sctp_verify_init() checks after cookie unpacking in COOKIE-ECHO processing paths (sctp_sf_do_5_1D_ce() and sctp_sf_do_5_2_4_dupcook()) when cookie_auth_enable is disabled. On failure, the new association is freed and the packet is discarded.
Also tighten cookie validation in sctp_unpack_cookie() by verifying the embedded chunk type is SCTP_CID_INIT before treating it as an INIT chunk.
Finally, update sctp_verify_init() to validate parameter bounds using the actual embedded INIT length instead of chunk->chunk_end, since the INIT stored in COOKIE-ECHO may not span the entire chunk buffer.
--- net/sctp/sm_make_chunk.c | 7 +++++-- net/sctp/sm_statefuns.c | 36 ++++++++++++++++++++++++++++++++---- 2 files changed, 37 insertions(+), 6 deletions(-)
net/sctp/sm_make_chunk.c +5 -2
@@ -1780,7 +1780,9 @@ struct sctp_association *sctp_unpack_cookie( cookie = chunk->subh.cookie_hdr; bear_cookie = &cookie->c; - ch = (struct sctp_chunkhdr *)(bear_cookie +1 ); + ch = (struct sctp_chunkhdr *)&bear_cookie->peer_init[0 ]; +if (ch->type !=SCTP_CID_INIT ) + goto malformed; chlen =ntohs (ch->length);if (chlen <sizeof (struct sctp_init_chunk )) goto malformed;
@@ -2338,7 +2340,8 @@ int sctp_verify_init(struct net *net, const struct sctp_endpoint *ep,* VIOLATION error. We build the ERROR chunk here and let the normal * error handling code build and send the packet. */ -if (param.v != (void *)chunk->chunk_end) +if (param.v != (void *)peer_init + +SCTP_PAD4 (ntohs (peer_init->chunk_hdr.length)))return sctp_process_inv_paramlength (asoc, param.p, chunk, errp);/* The only missing mandatory param possible today is
net/sctp/sm_statefuns.c +32 -4
@@ -707,11 +707,12 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net, struct sctp_cmd_seq *commands) {struct sctp_ulpevent *ev, *ai_ev =NULL , *auth_ev =NULL ; +struct sctp_chunk *err_chk_p =NULL ;struct sctp_association *new_asoc;struct sctp_init_chunk *peer_init;struct sctp_chunk *chunk = arg; -struct sctp_chunk *err_chk_p;struct sctp_chunk *repl; +enum sctp_cid cid;struct sock *sk;int error =0 ;
@@ -785,6 +786,19 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net, } } + peer_init = &chunk->subh.cookie_hdr->c.peer_init[0 ]; + cid = peer_init->chunk_hdr.type; +if (!sctp_sk (sk)->hmac && + !sctp_verify_init (net, ep, asoc, cid, peer_init, chunk, + &err_chk_p)) { +sctp_association_free (new_asoc); +if (err_chk_p) +sctp_chunk_free (err_chk_p); +return sctp_sf_pdiscard (net, ep, asoc, type, arg, commands); + } +if (err_chk_p) +sctp_chunk_free (err_chk_p); +if (security_sctp_assoc_request (new_asoc, chunk->head_skb ?: chunk->skb)) {sctp_association_free (new_asoc);return sctp_sf_pdiscard (net, ep, asoc, type, arg, commands);
@@ -798,8 +812,6 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net,/* This is a brand-new association, so these are not yet side * effects--it is safe to run them here. */ - peer_init = &chunk->subh.cookie_hdr->c.peer_init[0 ]; -if (!sctp_process_init (new_asoc, chunk, &chunk->subh.cookie_hdr->c.peer_addr, peer_init,GFP_ATOMIC ))
@@ -2217,10 +2229,12 @@ enum sctp_disposition sctp_sf_do_5_2_4_dupcook(void *arg, struct sctp_cmd_seq *commands) { + struct sctp_chunk *err_chk_p = NULL;struct sctp_association *new_asoc; +struct sctp_init_chunk *peer_init;struct sctp_chunk *chunk = arg;enum sctp_disposition retval; -struct sctp_chunk *err_chk_p; +enum sctp_cid cid;int error =0 ;char action;
@@ -2289,6 +2303,20 @@ enum sctp_disposition sctp_sf_do_5_2_4_dupcook(switch (action) {case 'A' :/* Association restart. */ case 'B' :/* Collision case B. */ + peer_init = &chunk->subh.cookie_hdr->c.peer_init[0 ]; + cid = peer_init->chunk_hdr.type; +if (!sctp_sk (ep->base.sk)->hmac && + !sctp_verify_init (net, ep, asoc, cid, peer_init, chunk, + &err_chk_p)) { +sctp_association_free (new_asoc); +if (err_chk_p) +sctp_chunk_free (err_chk_p); +return sctp_sf_pdiscard (net, ep, asoc, type, arg, + commands); + } +if (err_chk_p) +sctp_chunk_free (err_chk_p); + fallthrough;case 'D' :/* Collision case D. */ /* Update socket peer label if first association. */ if (security_sctp_assoc_request((struct sctp_association *)asoc,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1235/1887 tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 7116764ca53ff529335d7ab7c364a69f094b23a5 ]
TIPC UDP media bearer teardown calls dst_cache_destroy() on its replicast caches before calling synchronize_net() to wait for concurrent RCU readers (transmitters) to finish:
static void cleanup_bearer(struct work_struct *work) {
...
list_for_each_entry_safe(rcast, tmp, &ub->rcast.list, list) {
dst_cache_destroy(&rcast->dst_cache);
list_del_rcu(&rcast->list);
kfree_rcu(rcast, rcu);
}
...
dst_cache_destroy(&ub->rcast.dst_cache);
udp_tunnel_sock_release(ub->sk);
synchronize_net();...
}
This is highly buggy because dst_cache_destroy() immediately frees the per-CPU cache memory (free_percpu()) and releases the cached dst entries without any synchronization.
If a concurrent transmitter (e.g., tipc_udp_xmit()) is running on another CPU under RCU protection, it can call dst_cache_get() concurrently, leading to:
1. Use-After-Free on the per-CPU cache pointer itself (crash).
2. "rcuref - imbalanced put()" warning if it attempts to release a dst that was concurrently released by dst_cache_destroy().
Furthermore, calling kfree(ub) immediately after synchronize_net() without closing the socket first (or waiting after closing it) leaves a window where a concurrent receiver (tipc_udp_recv()) could start after synchronize_net(), access ub, and suffer a UAF when kfree(ub) runs.
To fix this, we must defer dst_cache_destroy() and kfree(ub) until after we have ensured that no more readers can see the bearer/socket and all existing readers have finished:
1. Defer rcast entry destruction (both dst_cache_destroy() and kfree()) to an RCU callback using call_rcu_hurry().
Using call_rcu_hurry() ensures the dst entries are released quickly.
2. Release the bearer socket using udp_tunnel_sock_release() (stops new receive readers).
3. Call synchronize_net() to wait for all outstanding RCU readers (both transmit and receive) to finish.
4. Now that it is safe, call dst_cache_destroy() on the main bearer cache, and free ub.
Note: 3) and 4) can be changed later in net-next to also use call_rcu_hurry() and get rid of the synchronize_net() latency.
--- net/tipc/udp_media.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
net/tipc/udp_media.c +11 -4
@@ -801,6 +801,14 @@ static int tipc_udp_enable(struct net *net, struct tipc_bearer *b,return err; } +static void rcast_free_rcu (struct rcu_head *rcu) +{ + struct udp_replicast *rcast = container_of(rcu, struct udp_replicast, rcu); + +dst_cache_destroy (&rcast->dst_cache); +kfree (rcast); +} +/* cleanup_bearer - break the socket/bearer association */ static void cleanup_bearer (struct work_struct *work) {
@@ -810,20 +818,19 @@ static void cleanup_bearer(struct work_struct *work)spin_lock_bh (&ub->rcast_lock);list_for_each_entry_safe (rcast, tmp, &ub->rcast.list, list) { -dst_cache_destroy (&rcast->dst_cache);list_del_rcu (&rcast->list); -kfree_rcu (rcast, rcu); +call_rcu (&rcast->rcu, rcast_free_rcu); } ub->disabled = true;spin_unlock_bh (&ub->rcast_lock); tn =tipc_net (sock_net (ub->ubsock->sk)); -dst_cache_destroy (&ub->rcast.dst_cache);udp_tunnel_sock_release (ub->ubsock); -/* Note: could use a call_rcu() to avoid another synchronize_net() */ synchronize_net (); + +dst_cache_destroy (&ub->rcast.dst_cache);atomic_dec (&tn->wq_count);kfree (ub); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1236/1887 net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit ecf69d4b43370c587e48d4d70289dbdb7e039d4d ]
Yue Sun reported a use-after-free and debugobjects warning in udp_tunnel_nic_device_sync_work() during concurrent device operations.
The workqueue core clears the internal pending bit before invoking the worker. At that point, a concurrent thread can queue the work again. When the already running worker eventually clears the work_pending flag to 0, it mistakenly clears the flag for the newly queued instance. udp_tunnel_nic_unregister() then observes work_pending as 0 and frees the structure while the second work item is still active in the queue, leading to UAF.
Fix this by returning early in udp_tunnel_nic_device_sync() if work_pending is already set, preventing redundant work queueing.
--- net/ipv4/udp_tunnel_nic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/udp_tunnel_nic.c +1 -1
@@ -301,7 +301,7 @@ udp_tunnel_nic_device_sync(struct net_device *dev, struct udp_tunnel_nic *utn)const struct udp_tunnel_nic_info *info = dev->udp_tunnel_nic_info;bool may_sleep; -if (!utn->need_sync) +if (!utn->need_sync || utn->work_pending)return ;/* Drivers which sleep in the callback need to update from
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1237/1887 netfilter: nft_compat: ebtables emulation must reject non-bridge targets
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 9dbba7e694ec045f21ede2f892fb42b81b4e1692 ]
xtables targets return netfilter verdicts: NF_ACCEPT, NF_DROP, and so on. ebtables targets return incompatible verdicts: EBT_ACCEPT,EBT_DROP, ... We cannot allow fallback to NFPROTO_UNSPEC.
ebtables doesn't permit this since11ff7288beb2 ("netfilter: ebtables: reject non-bridge targets") but that commit missed the nft_compat layer.
--- net/netfilter/nft_compat.c | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-)
net/netfilter/nft_compat.c +21 -3
@@ -389,6 +389,22 @@ static int nft_target_validate(const struct nft_ctx *ctx,return 0 ; } +static int nft_target_bridge_validate (const struct nft_ctx *ctx, +const struct nft_expr *expr) +{ +struct xt_target *target = expr->ops->data; + +/* Do not allow UNSPEC to stand-in for NFPROTO_BRIDGE +* targets: they are incompatible. ebtables targets return +* EBT_ACCEPT, DROP and so on which are not compatible with +* NF_ACCEPT, NF_DROP and so on. +*/ +if (target->family !=NFPROTO_BRIDGE ) +return -ENOENT ; + +return nft_target_validate (ctx, expr); +} + static void __nft_match_eval(const struct nft_expr *expr, struct nft_regs *regs, const struct nft_pktinfo *pkt,
@@ -916,14 +932,16 @@ nft_target_select_ops(const struct nft_ctx *ctx, ops->init = nft_target_init; ops->destroy = nft_target_destroy; ops->dump = nft_target_dump; - ops->validate = nft_target_validate; ops->data = target; ops->reduce =NFT_REDUCE_READONLY ; -if (family ==NFPROTO_BRIDGE ) +if (family ==NFPROTO_BRIDGE ) { ops->eval = nft_target_eval_bridge; -else + ops->validate = nft_target_bridge_validate; + }else { ops->eval = nft_target_eval_xt; + ops->validate = nft_target_validate; + }return ops; err:
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1238/1887 md/raid5: avoid R5_Overlap races while breaking stripe batches
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Cheng <[email protected]>
[ Upstream commit 55b77337bdd088c77461588e5ec094421b89911b ]
KCSAN report a race in break_stripe_batch_list() vs. raid5_make_request() on sh->dev[i].flags (plain word write vs. atomic bit op)..
and .. one possible scenario is:
CPU1 CPU2break_stripe_batch_list(sh1)
-> handle sh2
-> lock(sh2)
-> sh2->batch_head = NULL
-> unlock(sh2)
-> test_and_clear_bit(R5_Overlap, sh2->dev[i].flags) -> wake_up_bit(sh2->dev[i].flags)
raid5_make_request()
-> add_all_stripe_bios(sh2)
-> lock(sh2)
-> stripe_bio_overlaps(sh2) returns true
batch_head is NULL, so new bio overlap
exist bio on sh2 -> true
-> set_bit(R5_Overlap, sh2->dev[i].flags)
-> unlock(sh2)
-> wait_on_bit(sh2->dev[i].flags)-> sh2->dev[i].flags = sh1->dev[i].flags & ~R5_Overlap
No wait_up_bit(), CPU2 could be wait_on_bit() forever...
Fix by :
- Expand the protect zone.
- Use batch_head's device flag's snaphot when no held head_sh->stripe_lock.
- Move sh/head_sh->batch_head = NULL to the end of protected zone , and , any concurrent add_all_stripe_bios() grabs sh->stripe_lock now either:
- see batch_head != null, and , is rejected by stripe_bio_overlaps() under the lock (no R5_Overlap wait ) , or ,
- sees batch_head == NULL, only after dev[i].flags has already been set and the prior R5_Overlap waiters worken.
KCSAN report:
================================================
BUG: KCSAN: data-race in break_stripe_batch_list / raid5_make_request
write (marked) to 0xffff8e89c8117548 of 8 bytes by task 4042 on cpu 0:
raid5_make_request+0xea0/0x2930
md_handle_request+0x4a2/0xa40
md_submit_bio+0x109/0x1a0
__submit_bio+0x2ec/0x390
submit_bio_noacct_nocheck+0x457/0x710
submit_bio_noacct+0x2a7/0xc20
submit_bio+0x56/0x250
blkdev_direct_IO+0x54c/0xda0
blkdev_write_iter+0x38f/0x570
aio_write+0x22b/0x490
io_submit_one+0xa51/0xf70
__x64_sys_io_submit+0xf7/0x220
x64_sys_call+0x1907/0x1c60
do_syscall_64+0x130/0x570
entry_SYSCALL_64_after_hwframe+0x76/0x7e read to 0xffff8e89c8117548 of 8 bytes by task 4010 on cpu 5:
break_stripe_batch_list+0x249/0x480
handle_stripe_clean_event+0x720/0x9b0
handle_stripe+0x32fb/0x4500
handle_active_stripes.isra.0+0x6e0/0xa50
raid5d+0x7e0/0xba0
md_thread+0x15a/0x2d0
kthread+0x1e3/0x220
ret_from_fork+0x37a/0x410
ret_from_fork_asm+0x1a/0x30 value changed: 0x0000000000000019 -> 0x0000000000000099 --> R5_Overlap
--- drivers/md/raid5.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/md/raid5.c +7 -5
@@ -4958,25 +4958,27 @@ static void break_stripe_batch_list(struct stripe_head *head_sh, sh->check_state = head_sh->check_state; sh->reconstruct_state = head_sh->reconstruct_state;spin_lock_irq (&sh->stripe_lock); - sh->batch_head =NULL ; -spin_unlock_irq (&sh->stripe_lock);for (i =0 ; i < sh->disks; i++) {if (test_and_clear_bit (R5_Overlap, &sh->dev[i].flags)) do_wakeup =1 ; - sh->dev[i].flags = head_sh->dev[i].flags & + sh->dev[i].flags =READ_ONCE (head_sh->dev[i].flags) & (~((1 << R5_WriteError) | (1 << R5_Overlap))); } + sh->batch_head =NULL ; +spin_unlock_irq (&sh->stripe_lock); +if (handle_flags ==0 || sh->state & handle_flags)set_bit (STRIPE_HANDLE , &sh->state);raid5_release_stripe (sh); }spin_lock_irq (&head_sh->stripe_lock); - head_sh->batch_head =NULL ; -spin_unlock_irq (&head_sh->stripe_lock);for (i =0 ; i < head_sh->disks; i++)if (test_and_clear_bit (R5_Overlap, &head_sh->dev[i].flags)) do_wakeup =1 ; + head_sh->batch_head =NULL ; +spin_unlock_irq (&head_sh->stripe_lock); +if (head_sh->state & handle_flags)set_bit (STRIPE_HANDLE , &head_sh->state);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1239/1887 bpf: Guard conntrack opts error writes
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yiyang Chen <[email protected]>
[ Upstream commit 6f6183a39533d727deaa5061cadae6dd9e6744d0 ]
The conntrack lookup and allocation kfuncs take an opts pointer together with an opts__sz argument. The verifier checks only the memory range described by opts__sz, but the wrappers unconditionally write opts->error whenever the internal lookup or allocation helper returns an error.
For an invalid size smaller than the end of opts->error, that write can land outside the verifier-checked range. Keep returning NULL for invalid arguments, but only report the error through opts->error when the supplied size includes the field.
This preserves error reporting for the supported 12-byte and 16-byte layouts, and for other invalid sizes that still include opts->error.
--- net/netfilter/nf_conntrack_bpf.c | 39 +++++++++++--------------------- 1 file changed, 13 insertions(+), 26 deletions(-)
net/netfilter/nf_conntrack_bpf.c +13 -26
@@ -57,6 +57,15 @@ enum { NF_BPF_CT_OPTS_SZ = 12, }; +static void *bpf_ct_opts_result (struct bpf_ct_opts *opts,u32 opts__sz,void *ret) +{ +if (!IS_ERR (ret)) +return ret; + if (opts && opts__sz >= offsetofend(struct bpf_ct_opts, error)) + opts->error =PTR_ERR (ret); +return NULL ; +} +static int bpf_nf_ct_tuple_parse (struct bpf_sock_tuple *bpf_tuple,u32 tuple_len,u8 protonum,u8 dir,struct nf_conntrack_tuple *tuple)
@@ -261,13 +270,7 @@ bpf_xdp_ct_alloc(struct xdp_md *xdp_ctx, struct bpf_sock_tuple *bpf_tuple, nfct =__bpf_nf_ct_alloc_entry (dev_net (ctx->rxq->dev), bpf_tuple, tuple__sz, opts, opts__sz,10 ); -if (IS_ERR (nfct)) { -if (opts) - opts->error =PTR_ERR (nfct); -return NULL ; - } - -return (struct nf_conn___init *)nfct; +return (struct nf_conn___init *)bpf_ct_opts_result (opts, opts__sz, nfct); }/* bpf_xdp_ct_lookup - Lookup CT entry for the given tuple, and acquire a
@@ -296,12 +299,7 @@ bpf_xdp_ct_lookup(struct xdp_md *xdp_ctx, struct bpf_sock_tuple *bpf_tuple, caller_net =dev_net (ctx->rxq->dev); nfct =__bpf_nf_ct_lookup (caller_net, bpf_tuple, tuple__sz, opts, opts__sz); -if (IS_ERR (nfct)) { -if (opts) - opts->error =PTR_ERR (nfct); -return NULL ; - } -return nfct; +return bpf_ct_opts_result (opts, opts__sz, nfct); }/* bpf_skb_ct_alloc - Allocate a new CT entry
@@ -329,13 +327,7 @@ bpf_skb_ct_alloc(struct __sk_buff *skb_ctx, struct bpf_sock_tuple *bpf_tuple, net = skb->dev ?dev_net (skb->dev) :sock_net (skb->sk); nfct =__bpf_nf_ct_alloc_entry (net, bpf_tuple, tuple__sz, opts, opts__sz,10 ); -if (IS_ERR (nfct)) { -if (opts) - opts->error =PTR_ERR (nfct); -return NULL ; - } - -return (struct nf_conn___init *)nfct; +return (struct nf_conn___init *)bpf_ct_opts_result (opts, opts__sz, nfct); }/* bpf_skb_ct_lookup - Lookup CT entry for the given tuple, and acquire a
@@ -364,12 +356,7 @@ bpf_skb_ct_lookup(struct __sk_buff *skb_ctx, struct bpf_sock_tuple *bpf_tuple, caller_net = skb->dev ?dev_net (skb->dev) :sock_net (skb->sk); nfct =__bpf_nf_ct_lookup (caller_net, bpf_tuple, tuple__sz, opts, opts__sz); -if (IS_ERR (nfct)) { -if (opts) - opts->error =PTR_ERR (nfct); -return NULL ; - } -return nfct; +return bpf_ct_opts_result (opts, opts__sz, nfct); }/* bpf_ct_insert_entry - Add the provided entry into a CT map
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1240/1887 md/raid10: fix writes_pending and barrier reference leaks on discard failures
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abd-Alrhman Masalkhi <[email protected]>
[ Upstream commit 393d687131d8aa8c7e4de2cb494438e145d20fc2 ]
raid10_make_request() acquires a writes_pending reference with md_write_start() before calling raid10_handle_discard(). Several failure paths in raid10_handle_discard() complete the bio and return without releasing the corresponding reference, causing md_write_end() to be skipped.
Call md_write_end() before returning from these failure paths to keep writes_pending accounting balanced.
Additionally, discard split allocation failures can occur after wait_barrier() succeeds. Those paths return without calling allow_barrier(), leaking the associated barrier reference.
Release the barrier before returning from those paths.
--- drivers/md/raid10.c | 1 + 1 file changed, 1 insertion(+)
drivers/md/raid10.c +1 -0
@@ -1678,6 +1678,7 @@ static int raid10_handle_discard(struct mddev *mddev, struct bio *bio)if (!wait_barrier (conf, bio->bi_opf &REQ_NOWAIT )) {bio_wouldblock_error (bio); +md_write_end (mddev);return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1241/1887 md/raid10: Handle bio_split() errors
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Garry <[email protected]>
[ Upstream commit 4cf58d9529097328b669e3c8693ed21e3a041903 ]
Add proper bio_split() error handling. For any error, call raid_end_bio_io() and return. Except for discard, where we end the bio directly.
Stable-dep-of: e045d6ed33f8 ("md/raid10: fix writes_pending leak on write request failures")
--- drivers/md/raid10.c | 47 ++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 46 insertions(+), 1 deletion(-)
drivers/md/raid10.c +46 -1
@@ -1181,6 +1181,7 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio,int slot = r10_bio->read_slot;struct md_rdev *err_rdev =NULL ;gfp_t gfp =GFP_NOIO ; +int error;if (slot >=0 && r10_bio->devs[slot].rdev) {/*
@@ -1233,6 +1234,10 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio,if (max_sectors <bio_sectors (bio)) {struct bio *split =bio_split (bio, max_sectors, gfp, &conf->bio_split); +if (IS_ERR (split)) { + error =PTR_ERR (split); + goto err_handle; + }bio_chain (split, bio);allow_barrier (conf);submit_bio_noacct (bio);
@@ -1265,6 +1270,11 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, r10_bio->sector);submit_bio_noacct (read_bio);return ; +err_handle: +atomic_dec (&rdev->nr_pending); + bio->bi_status =errno_to_blk_status (error); +set_bit (R10BIO_Uptodate, &r10_bio->state); +raid_end_bio_io (r10_bio); } static void raid10_write_one_disk(struct mddev *mddev, struct r10bio *r10_bio,
@@ -1409,9 +1419,10 @@ static void raid10_write_request(struct mddev *mddev, struct bio *bio, struct r10bio *r10_bio) { struct r10conf *conf = mddev->private; - int i; + int i, k; sector_t sectors; int max_sectors; + int error; if ((mddev_is_clustered(mddev) && md_cluster_ops->area_resyncing(mddev, WRITE,
@@ -1547,6 +1558,10 @@ static void raid10_write_request(struct mddev *mddev, struct bio *bio,if (r10_bio->sectors <bio_sectors (bio)) {struct bio *split =bio_split (bio, r10_bio->sectors,GFP_NOIO , &conf->bio_split); +if (IS_ERR (split)) { + error =PTR_ERR (split); + goto err_handle; + }bio_chain (split, bio);allow_barrier (conf);submit_bio_noacct (bio);
@@ -1567,6 +1582,26 @@ static void raid10_write_request(struct mddev *mddev, struct bio *bio,raid10_write_one_disk (mddev, r10_bio, bio, true, i); }one_write_done (r10_bio); +return ; +err_handle: +for (k =0 ; k < i; k++) { +int d = r10_bio->devs[k].devnum; +struct md_rdev *rdev = conf->mirrors[d].rdev; +struct md_rdev *rrdev = conf->mirrors[d].replacement; + +if (r10_bio->devs[k].bio) { +rdev_dec_pending (rdev, mddev); + r10_bio->devs[k].bio =NULL ; + } +if (r10_bio->devs[k].repl_bio) { +rdev_dec_pending (rrdev, mddev); + r10_bio->devs[k].repl_bio =NULL ; + } + } + + bio->bi_status =errno_to_blk_status (error); +set_bit (R10BIO_Uptodate, &r10_bio->state); +raid_end_bio_io (r10_bio); }static void __make_request (struct mddev *mddev,struct bio *bio,int sectors)
@@ -1718,6 +1753,11 @@ static int raid10_handle_discard(struct mddev *mddev, struct bio *bio)if (remainder) { split_size = stripe_size - remainder; split =bio_split (bio, split_size,GFP_NOIO , &conf->bio_split); +if (IS_ERR (split)) { + bio->bi_status =errno_to_blk_status (PTR_ERR (split)); +bio_endio (bio); +return 0 ; + }bio_chain (split, bio);allow_barrier (conf);/* Resend the fist split part */
@@ -1728,6 +1768,11 @@ static int raid10_handle_discard(struct mddev *mddev, struct bio *bio)if (remainder) { split_size =bio_sectors (bio) - remainder; split =bio_split (bio, split_size,GFP_NOIO , &conf->bio_split); +if (IS_ERR (split)) { + bio->bi_status =errno_to_blk_status (PTR_ERR (split)); +bio_endio (bio); +return 0 ; + }bio_chain (split, bio);allow_barrier (conf);/* Resend the second split part */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1242/1887 md/raid10: fix writes_pending leak on write request failures
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abd-Alrhman Masalkhi <[email protected]>
[ Upstream commit e045d6ed33f8faa3e3dd6dc33c62ec01e3ad275d ]
raid10_make_request() acquires a writes_pending reference with md_write_start() before dispatching write requests. Several failure paths in raid10_write_request() complete the bio and return without reaching the normal write completion path, causing the corresponding md_write_end() to be skipped.
Make raid10_write_request() return a status indicating whether the write request was successfully queued. This allows raid10_make_request() to release the writes_pending reference with md_write_end() when a write request fails.
--- drivers/md/raid10.c | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-)
drivers/md/raid10.c +15 -8
@@ -1415,7 +1415,7 @@ static void wait_blocked_dev(struct mddev *mddev, struct r10bio *r10_bio) } } -static void raid10_write_request (struct mddev *mddev,struct bio *bio, +static bool raid10_write_request (struct mddev *mddev,struct bio *bio,struct r10bio *r10_bio) {struct r10conf *conf = mddev->private;
@@ -1432,7 +1432,7 @@ static void raid10_write_request(struct mddev *mddev, struct bio *bio,/* Bail out if REQ_NOWAIT is set for the bio */ if (bio->bi_opf &REQ_NOWAIT ) {bio_wouldblock_error (bio); -return ; +return false; }for (;;) { prepare_to_wait(&conf->wait_barrier,
@@ -1448,7 +1448,7 @@ static void raid10_write_request(struct mddev *mddev, struct bio *bio, sectors = r10_bio->sectors;if (!regular_request_wait (mddev, conf, bio, sectors)) {free_r10bio (r10_bio); -return ; +return false; } if (test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery) &&
@@ -1465,7 +1465,7 @@ static void raid10_write_request(struct mddev *mddev, struct bio *bio,if (bio->bi_opf &REQ_NOWAIT ) {allow_barrier (conf);bio_wouldblock_error (bio); -return ; +return false; }raid10_log (conf->mddev,"wait reshape metadata" ); wait_event(mddev->sb_wait,
@@ -1582,7 +1582,8 @@ static void raid10_write_request(struct mddev *mddev, struct bio *bio,raid10_write_one_disk (mddev, r10_bio, bio, true, i); }one_write_done (r10_bio); -return ; +return true; + err_handle:for (k =0 ; k < i; k++) {int d = r10_bio->devs[k].devnum;
@@ -1602,10 +1603,12 @@ static void raid10_write_request(struct mddev *mddev, struct bio *bio, bio->bi_status =errno_to_blk_status (error);set_bit (R10BIO_Uptodate, &r10_bio->state);raid_end_bio_io (r10_bio); +return false; } -static void __make_request (struct mddev *mddev,struct bio *bio,int sectors) +static bool __make_request (struct mddev *mddev,struct bio *bio,int sectors) { +bool ret;struct r10conf *conf = mddev->private;struct r10bio *r10_bio;
@@ -1622,10 +1625,13 @@ static void __make_request(struct mddev *mddev, struct bio *bio, int sectors)memset (r10_bio->devs,0 ,sizeof (r10_bio->devs[0 ]) * conf->geo.raid_disks); + ret = true;if (bio_data_dir (bio) ==READ )raid10_read_request (mddev, bio, r10_bio);else -raid10_write_request (mddev, bio, r10_bio); + ret =raid10_write_request (mddev, bio, r10_bio); + +return ret; }static void raid_end_discard_bio (struct r10bio *r10bio)
@@ -1979,7 +1985,8 @@ static bool raid10_make_request(struct mddev *mddev, struct bio *bio) sectors = chunk_sects - (bio->bi_iter.bi_sector & (chunk_sects -1 )); -__make_request (mddev, bio, sectors); +if (!__make_request (mddev, bio, sectors)) +md_write_end (mddev);/* In case raid10d snuck in to freeze_array */ wake_up_barrier (conf);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1243/1887 md/raid1: fix writes_pending and barrier reference leaks on write failures
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abd-Alrhman Masalkhi <[email protected]>
[ Upstream commit 8e065a1602511282fc0da2dc89445e0eb71a681c ]
raid1_make_request() acquires a writes_pending reference with md_write_start() before calling raid1_write_request(). Several failure paths in raid1_write_request() complete the bio and return without reaching the normal write completion path, causing the corresponding md_write_end() to be skipped.
Make raid1_write_request() return a status indicating whether the write request was successfully queued. This allows raid1_make_request() to call md_write_end() when raid1_write_request() fails.
Additionally, if wait_blocked_rdev() fails after wait_barrier() succeeds, the associated barrier reference is not released.
Call allow_barrier() before returning from that path to keep the barrier accounting balanced.
--- drivers/md/raid1.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/md/raid1.c +7 -5
@@ -1331,7 +1331,7 @@ static void raid1_read_request(struct mddev *mddev, struct bio *bio,submit_bio_noacct (read_bio); } -static void raid1_write_request (struct mddev *mddev,struct bio *bio, +static bool raid1_write_request (struct mddev *mddev,struct bio *bio,int max_write_sectors) {struct r1conf *conf = mddev->private;
@@ -1351,7 +1351,7 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio,DEFINE_WAIT (w);if (bio->bi_opf &REQ_NOWAIT ) {bio_wouldblock_error (bio); -return ; +return false; }for (;;) { prepare_to_wait(&conf->wait_barrier,
@@ -1373,7 +1373,7 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio,if (!wait_barrier (conf, bio->bi_iter.bi_sector, bio->bi_opf &REQ_NOWAIT )) {bio_wouldblock_error (bio); -return ; +return false; } r1_bio =alloc_r1bio (mddev, bio);
@@ -1476,7 +1476,7 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio,if (bio->bi_opf &REQ_NOWAIT ) {bio_wouldblock_error (bio); -return ; +return false; }raid1_log (mddev,"wait rdev %d blocked" , blocked_rdev->raid_disk);md_wait_for_blocked_rdev (blocked_rdev, mddev);
@@ -1580,6 +1580,7 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio,/* In case raid1d snuck in to freeze_array */ wake_up (&conf->wait_barrier); +return true; }static bool raid1_make_request (struct mddev *mddev,struct bio *bio)
@@ -1605,7 +1606,8 @@ static bool raid1_make_request(struct mddev *mddev, struct bio *bio)else {if (!md_write_start (mddev,bio))return false; -raid1_write_request (mddev, bio, sectors); +if (!raid1_write_request (mddev, bio, sectors)) +md_write_end (mddev); }return true; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1244/1887 nfs: use nfsi->rwsem to protect traversal of the file lock list
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Erkun <[email protected]>
[ Upstream commit 4837fb36219e6c08b666bc31a86841bad8526358 ]
Lingfeng identified a bug and suggested two solutions, but both appear to have issues.
Generally, we cannot release flc_lock while iterating over the file lock list to avoid use-after-free (UAF) problems with file locks. However, functions like nfs_delegation_claim_locks and nfs4_reclaim_locks cannot adhere to this rule because recover_lock or nfs4_lock_delegation_recall may take a long time. To resolve this, NFS switches to using nfsi->rwsem for the same protection, and nfs_reclaim_locks follows this approach. Although nfs_delegation_claim_locks uses so_delegreturn_mutex instead, this is inadequate since a single inode can have multiple nfs4_state instances. Therefore, the fix is to also use nfsi->rwsem in this case.
Furthermore, after commit c69899a17ca4 ("NFSv4: Update of VFS byte range lock must be atomic with the stateid update"), the functions nfs4_locku_done and nfs4_lock_done also break this rule because they call locks_lock_inode_wait without holding nfsi->rwsem. Simply adding this protection could cause many deadlocks, so instead, the call to locks_lock_inode_wait is moved into _nfs4_proc_setlk. Regarding the bug fixed by commit c69899a17ca4 ("NFSv4: Update of VFS byte range lock must be atomic with the stateid update"), it has been resolved after commit 0460253913e5 ("NFSv4: nfs4_do_open() is incorrectly triggering state recovery") because all slots are drained before calling nfs4_do_reclaim, which prevents concurrent stateid changes along this path. Also, nfs_delegation_claim_locks does not cause this concurrency either since when _nfs4_proc_setlk is called with NFS_DELEGATED_STATE, no RPC is sent, so nfs4_lock_done is not called. Therefore, nfs4_lock_delegation_recall from nfs_delegation_claim_locks is the first time the stateid is set.
--- fs/nfs/delegation.c | 9 ++++++++- fs/nfs/nfs4proc.c | 22 +++++++++++----------- include/linux/nfs_xdr.h | 1 - 3 files changed, 19 insertions(+), 13 deletions(-)
fs/nfs/delegation.c +8 -1
@@ -145,6 +145,7 @@ int nfs4_check_delegation(struct inode *inode, fmode_t flags)static int nfs_delegation_claim_locks (struct nfs4_state *state,const nfs4_stateid *stateid) {struct inode *inode = state->inode; +struct nfs_inode *nfsi =NFS_I (inode);struct file_lock *fl;struct file_lock_context *flctx = inode->i_flctx;struct list_head *list;
@@ -154,6 +155,9 @@ static int nfs_delegation_claim_locks(struct nfs4_state *state, const nfs4_state goto out; list = &flctx->flc_posix; + +/* Guard against reclaim and new lock/unlock calls */ +down_write (&nfsi->rwsem);spin_lock (&flctx->flc_lock); restart:list_for_each_entry (fl, list, fl_list) {
@@ -161,8 +165,10 @@ static int nfs_delegation_claim_locks(struct nfs4_state *state, const nfs4_statecontinue ;spin_unlock (&flctx->flc_lock); status =nfs4_lock_delegation_recall (fl, state, stateid); -if (status <0 ) +if (status <0 ) { +up_write (&nfsi->rwsem); goto out; + }spin_lock (&flctx->flc_lock); }if (list == &flctx->flc_posix) {
@@ -170,6 +176,7 @@ static int nfs_delegation_claim_locks(struct nfs4_state *state, const nfs4_state goto restart; }spin_unlock (&flctx->flc_lock); +up_write (&nfsi->rwsem); out:return status; }
fs/nfs/nfs4proc.c +11 -11
@@ -6961,7 +6961,6 @@ static void nfs4_locku_done(struct rpc_task *task, void *data)switch (task->tk_status) {case 0 :renew_lease (calldata->server, calldata->timestamp); -locks_lock_inode_wait (calldata->lsp->ls_state->inode, &calldata->fl);if (nfs4_update_lock_stateid (calldata->lsp, &calldata->res.stateid))break ;
@@ -7224,11 +7223,6 @@ static void nfs4_lock_done(struct rpc_task *task, void *calldata)case 0 :renew_lease (NFS_SERVER (d_inode (data->ctx->dentry)), data->timestamp); -if (data->arg.new_lock && !data->cancelled) { - data->fl.fl_flags &= ~(FL_SLEEP |FL_ACCESS ); -if (locks_lock_inode_wait (lsp->ls_state->inode, &data->fl) <0 ) - goto out_restart; - }if (data->arg.new_lock_owner !=0 ) {nfs_confirm_seqid (&lsp->ls_seqid,0 );nfs4_stateid_copy (&lsp->ls_stateid, &data->res.stateid);
@@ -7337,11 +7331,10 @@ static int _nfs4_do_setlk(struct nfs4_state *state, int cmd, struct file_lock *f msg.rpc_argp = &data->arg; msg.rpc_resp = &data->res; task_setup_data.callback_data = data; -if (recovery_type >NFS_LOCK_NEW ) { -if (recovery_type ==NFS_LOCK_RECLAIM ) - data->arg.reclaim =NFS_LOCK_RECLAIM ; - }else - data->arg.new_lock =1 ; + +if (recovery_type ==NFS_LOCK_RECLAIM ) + data->arg.reclaim =NFS_LOCK_RECLAIM ; + task =rpc_run_task (&task_setup_data);if (IS_ERR (task))return PTR_ERR (task);
@@ -7453,6 +7446,13 @@ static int _nfs4_proc_setlk(struct nfs4_state *state, int cmd, struct file_lockup_read (&nfsi->rwsem);mutex_unlock (&sp->so_delegreturn_mutex); status =_nfs4_do_setlk (state, cmd, request,NFS_LOCK_NEW ); +if (status) + goto out; + +down_read (&nfsi->rwsem); + request->fl_flags &= ~(FL_SLEEP |FL_ACCESS ); + status =locks_lock_inode_wait (state->inode, request); +up_read (&nfsi->rwsem); out: request->fl_flags = fl_flags;return status;
include/linux/nfs_xdr.h +0 -1
@@ -563,7 +563,6 @@ struct nfs_lock_args {struct nfs_lowner lock_owner; unsigned char block : 1; unsigned char reclaim : 1; - unsigned char new_lock : 1; unsigned char new_lock_owner : 1; };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1245/1887 soundwire: fix bug in sdw_add_element_group_count found by syzkaller
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baoli.Zhang <[email protected]>
[ Upstream commit f772ff5a0e6758fd412803c09e03ba3bca5f5878 ]
The original implementation caused an out-of-bounds memory access in the sdw_add_element_group_count for-loop when i == num.
for (i = 0; i <= num; i++) {
if (rate == group->rates[i] && lane == group->lanes[i])
...To fix this error, the function now checks for existing rate/lane entries in the group(a function parameter) using a for-loop before adding them.
No functional changes apart from this fix.
--- .../soundwire/generic_bandwidth_allocation.c | 31 +++++++++---------- 1 file changed, 14 insertions(+), 17 deletions(-)
drivers/soundwire/generic_bandwidth_allocation.c +14 -17
@@ -210,28 +210,25 @@ static int sdw_add_element_group_count(struct sdw_group *group,int num = group->count;int i; -for (i =0 ; i <= num; i++) { +for (i =0 ; i < num; i++) {if (rate == group->rates[i]) -break ; - -if (i != num) -continue ; - -if (group->count >= group->max_size) { -unsigned int *rates; +return 0 ; + } - group->max_size +=1 ; - rates =krealloc (group->rates, - (sizeof (int ) * group->max_size), -GFP_KERNEL ); -if (!rates) -return -ENOMEM ; - group->rates = rates; - } +if (group->count >= group->max_size) { +unsigned int *rates; - group->rates[group->count++] = rate; + group->max_size +=1 ; + rates =krealloc (group->rates, + (sizeof (int ) * group->max_size), +GFP_KERNEL ); +if (!rates) +return -ENOMEM ; + group->rates = rates; } + group->rates[group->count++] = rate; +return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1246/1887 RDMA/irdma: Replace waitqueue and flag with completion
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Moroni <[email protected]>
[ Upstream commit d9c8c45e6d2f438a3c8e643ae78b59454fa0fadd ]
The driver previously used a waitqueue along with an explicit request_done flag, but without proper barriers around request_done.
An earlier patch by Gui-Dong Han <[email protected]> attempted to fix this by adding the missing memory barriers. Rather than adding the barriers, this patch replaces the waitqueue+flag with a completion, which is designed for this exact purpose.
--- drivers/infiniband/hw/irdma/hw.c | 7 +++---- drivers/infiniband/hw/irdma/main.h | 3 +-- drivers/infiniband/hw/irdma/utils.c | 12 +++++------- 3 files changed, 9 insertions(+), 13 deletions(-)
drivers/infiniband/hw/irdma/hw.c +3 -4
@@ -994,9 +994,9 @@ static int irdma_create_cqp(struct irdma_pci_f *rf)INIT_LIST_HEAD (&cqp->cqp_avail_reqs);INIT_LIST_HEAD (&cqp->cqp_pending_reqs); -/* init the waitqueue of the cqp_requests and add them to the list */ +/* init the completion of the cqp_requests and add them to the list */ for (i =0 ; i < sqsize; i++) { -init_waitqueue_head (&cqp->cqp_requests[i].waitq); +init_completion (&cqp->cqp_requests[i].comp);list_add_tail (&cqp->cqp_requests[i].list, &cqp->cqp_avail_reqs); }init_waitqueue_head (&cqp->remove_wq);
@@ -2086,8 +2086,7 @@ void irdma_cqp_ce_handler(struct irdma_pci_f *rf, struct irdma_sc_cq *cq) cqp_request->compl_info.error = info.error;if (cqp_request->waiting) { -WRITE_ONCE (cqp_request->request_done, true); -wake_up (&cqp_request->waitq); +complete_all (&cqp_request->comp);irdma_put_cqp_request (&rf->cqp, cqp_request); }else {if (cqp_request->callback_fcn)
drivers/infiniband/hw/irdma/main.h +1 -2
@@ -153,13 +153,12 @@ struct irdma_cqp_compl_info {struct irdma_cqp_request {struct cqp_cmds_info info; -wait_queue_head_t waitq; +struct completion comp;struct list_head list;refcount_t refcnt;void (*callback_fcn)(struct irdma_cqp_request *cqp_request);void *param;struct irdma_cqp_compl_info compl_info; -bool request_done;/* READ/WRITE_ONCE macros operate on it */ bool waiting:1 ;bool dynamic:1 ; };
drivers/infiniband/hw/irdma/utils.c +5 -7
@@ -445,7 +445,7 @@ struct irdma_cqp_request *irdma_alloc_and_get_cqp_request(struct irdma_cqp *cqp,if (cqp_request) { cqp_request->dynamic = true;if (wait) -init_waitqueue_head (&cqp_request->waitq); +init_completion (&cqp_request->comp); } }if (!cqp_request) {
@@ -482,7 +482,7 @@ void irdma_free_cqp_request(struct irdma_cqp *cqp,if (cqp_request->dynamic) {kfree (cqp_request); }else { -WRITE_ONCE (cqp_request->request_done, false); +reinit_completion (&cqp_request->comp); cqp_request->callback_fcn =NULL ; cqp_request->waiting = false;
@@ -516,8 +516,7 @@ irdma_free_pending_cqp_request(struct irdma_cqp *cqp, {if (cqp_request->waiting) { cqp_request->compl_info.error = true; -WRITE_ONCE (cqp_request->request_done, true); -wake_up (&cqp_request->waitq); +complete_all (&cqp_request->comp); }wait_event_timeout (cqp->remove_wq,refcount_read (&cqp_request->refcnt) ==1 ,1000 );
@@ -571,9 +570,8 @@ static int irdma_wait_event(struct irdma_pci_f *rf, cqp_timeout.compl_cqp_cmds =atomic64_read (&rf->sc_dev.cqp->completed_ops); do { irdma_cqp_ce_handler(rf, &rf->ccq.sc_cq); - if (wait_event_timeout(cqp_request->waitq, - READ_ONCE(cqp_request->request_done), - msecs_to_jiffies(CQP_COMPL_WAIT_TIME_MS))) + if (wait_for_completion_timeout(&cqp_request->comp, + msecs_to_jiffies(CQP_COMPL_WAIT_TIME_MS))) break; irdma_check_cqp_progress(&cqp_timeout, &rf->sc_dev);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1247/1887 sockmap: Fix use-after-free in udp_bpf_recvmsg()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit c010995b29c8939c6aa69e3cb26f8dbee163d156 ]
syzbot reported use-after-free of struct sk_msg in sk_msg_recvmsg(). [0]
sk_msg_recvmsg() peeks sk_msg from psock->ingress_msg under a lock, but its processing is lockless.
Thus, sk_msg_recvmsg() must be serialised by callers, otherwise multiple threads could touch the same sk_msg.
For example, TCP uses lock_sock(), and AF_UNIX uses unix_sk(sk)->iolock.
Initially, udp_bpf_recvmsg() had used lock_sock(), but the cited commit removed it.
Let's serialise sk_msg_recvmsg() with lock_sock() in udp_bpf_recvmsg().
Note that holding spin_lock_bh(&sk->sk_receive_queue.lock) is not an option due to copy_page_to_iter() in sk_msg_recvmsg().
[0]:
BUG: KASAN: slab-use-after-free in sk_msg_recvmsg+0xb54/0xc30 net/core/skmsg.c:428 Read of size 4 at addr ffff88814cdcf000 by task syz.0.24/6020 CPU: 1 UID: 0 PID: 6020 Comm: syz.0.24 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 Call Trace: <TASK> dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xba/0x230 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 sk_msg_recvmsg+0xb54/0xc30 net/core/skmsg.c:428 udp_bpf_recvmsg+0x4bd/0xe00 net/ipv4/udp_bpf.c:84 inet_recvmsg+0x260/0x270 net/ipv4/af_inet.c:891 sock_recvmsg_nosec net/socket.c:1078 [inline] sock_recvmsg+0x1a8/0x270 net/socket.c:1100 ____sys_recvmsg+0x1e6/0x4a0 net/socket.c:2812 ___sys_recvmsg+0x215/0x590 net/socket.c:2854 do_recvmmsg+0x334/0x800 net/socket.c:2949 __sys_recvmmsg net/socket.c:3023 [inline] __do_sys_recvmmsg net/socket.c:3046 [inline] __se_sys_recvmmsg net/socket.c:3039 [inline] __x64_sys_recvmmsg+0x198/0x250 net/socket.c:3039 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fb319f9aeb9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fb31ad97028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b RAX: ffffffffffffffda RBX: 00007fb31a216090 RCX: 00007fb319f9aeb9 RDX: 0000000000000001 RSI: 0000200000000400 RDI: 0000000000000004 RBP: 00007fb31a008c1f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000040000021 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fb31a216128 R14: 00007fb31a216090 R15: 00007ffe21dd0a98 </TASK> Allocated by task 6019: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x3d1/0x6e0 mm/slub.c:5780 kmalloc_noprof include/linux/slab.h:957 [inline] kzalloc_noprof include/linux/slab.h:1094 [inline] alloc_sk_msg net/core/skmsg.c:510 [inline] sk_psock_skb_ingress_self+0x60/0x350 net/core/skmsg.c:612 sk_psock_verdict_apply net/core/skmsg.c:1038 [inline] sk_psock_verdict_recv+0x7d9/0x8d0 net/core/skmsg.c:1236 udp_read_skb+0x73e/0x7e0 net/ipv4/udp.c:2045 sk_psock_verdict_data_ready+0x12d/0x550 net/core/skmsg.c:1257 __udp_enqueue_schedule_skb+0xc54/0x10b0 net/ipv4/udp.c:1789 __udp_queue_rcv_skb net/ipv4/udp.c:2346 [inline] udp_queue_rcv_one_skb+0xac5/0x19c0 net/ipv4/udp.c:2475 __udp4_lib_mcast_deliver+0xc06/0xcf0 net/ipv4/udp.c:2585 __udp4_lib_rcv+0x10f6/0x2620 net/ipv4/udp.c:2724 ip_protocol_deliver_rcu+0x282/0x440 net/ipv4/ip_input.c:207 ip_local_deliver_finish+0x3bb/0x6f0 net/ipv4/ip_input.c:241 NF_HOOK+0x336/0x3c0 include/linux/netfilter.h:318 dst_input include/net/dst.h:474 [inline] ip_sublist_rcv_finish+0x221/0x2a0 net/ipv4/ip_input.c:584 ip_list_rcv_finish net/ipv4/ip_input.c:628 [inline] ip_sublist_rcv+0x5c6/0xa70 net/ipv4/ip_input.c:644 ip_list_rcv+0x3f1/0x450 net/ipv4/ip_input.c:678 __netif_receive_skb_list_ptype net/core/dev.c:6195 [inline] __netif_receive_skb_list_core+0x7e5/0x810 net/core/dev.c:6242 __netif_receive_skb_list net/core/dev.c:6294 [inline] netif_receive_skb_list_internal+0x995/0xcf0 net/core/dev.c:6385 netif_receive_skb_list+0x54/0x410 net/core/dev.c:6437 xdp_recv_frames net/bpf/test_run.c:269 [inline] xdp_test_run_batch net/bpf/test_run.c:350 [inline] bpf_test_run_xdp_live+0x1946/0x1cf0 net/bpf/test_run.c:379 bpf_prog_test_run_xdp+0x81c/0x1160 net/bpf/test_run.c:1396 bpf_prog_test_run+0x2c7/0x340 kernel/bpf/syscall.c:4703 __sys_bpf+0x5cb/0x920 kernel/bpf/syscall.c:6182 __do_sys_bpf kernel/bpf/syscall.c:6274 [inline] __se_sys_bpf kernel/bpf/syscall.c:6272 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:6272 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 6021: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2540 [inline] slab_free mm/slub.c:6674 [inline] kfree+0x1be/0x650 mm/slub.c:6882 kfree_sk_msg include/linux/skmsg.h:385 [inline] sk_msg_recvmsg+0xaa8/0xc30 net/core/skmsg.c:483 udp_bpf_recvmsg+0x4bd/0xe00 net/ipv4/udp_bpf.c:84 inet_recvmsg+0x260/0x270 net/ipv4/af_inet.c:891 sock_recvmsg_nosec net/socket.c:1078 [inline] sock_recvmsg+0x1a8/0x270 net/socket.c:1100 ____sys_recvmsg+0x1e6/0x4a0 net/socket.c:2812 ___sys_recvmsg+0x215/0x590 net/socket.c:2854 do_recvmmsg+0x334/0x800 net/socket.c:2949 __sys_recvmmsg net/socket.c:3023 [inline] __do_sys_recvmmsg net/socket.c:3046 [inline] __se_sys_recvmmsg net/socket.c:3039 [inline] __x64_sys_recvmmsg+0x198/0x250 net/socket.c:3039 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f
--- net/ipv4/udp_bpf.c | 9 +++++++++ 1 file changed, 9 insertions(+)
net/ipv4/udp_bpf.c +9 -0
@@ -51,7 +51,9 @@ static int udp_msg_wait_data(struct sock *sk, struct sk_psock *psock,sk_set_bit (SOCKWQ_ASYNC_WAITDATA , sk); ret =udp_msg_has_data (sk, psock);if (!ret) { +release_sock (sk);wait_woken (&wait,TASK_INTERRUPTIBLE , timeo); +lock_sock (sk); ret =udp_msg_has_data (sk, psock); }sk_clear_bit (SOCKWQ_ASYNC_WAITDATA , sk);
@@ -80,6 +82,7 @@ static int udp_bpf_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, goto out; } +lock_sock (sk); msg_bytes_ready: copied =sk_msg_recvmsg (sk, psock, msg, len, flags);if (!copied) {
@@ -91,11 +94,17 @@ static int udp_bpf_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,if (data) {if (psock_has_data (psock)) goto msg_bytes_ready; + +release_sock (sk); + ret =sk_udp_recvmsg (sk, msg, len, flags, addr_len); goto out; } copied = -EAGAIN ; } + +release_sock (sk); + ret = copied; out:sk_psock_put (sk, psock);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1248/1887 ALSA: seq: fifo: Use guard() for locking
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 68f014a58b6540847b0939a9a4023ed6eb834608 ]
We can simplify the code gracefully with new guard() macro and co for automatic cleanup of locks.
Only the code refactoring, and no functional changes.
Stable-dep-of: e546128291f8 ("ALSA: seq: avoid stale FIFO cells during resize")
--- sound/core/seq/seq_fifo.c | 55 +++++++++++++++++---------------------- 1 file changed, 24 insertions(+), 31 deletions(-)
sound/core/seq/seq_fifo.c +24 -31
@@ -88,12 +88,11 @@ void snd_seq_fifo_clear(struct snd_seq_fifo *f)atomic_set (&f->overflow,0 );snd_use_lock_sync (&f->use_lock); -spin_lock_irq (&f->lock); +guard (spinlock_irq)(&f->lock);/* drain the fifo */ while ((cell =fifo_cell_out (f)) !=NULL ) {snd_seq_cell_free (cell); } -spin_unlock_irq (&f->lock); }
@@ -102,7 +101,6 @@ int snd_seq_fifo_event_in(struct snd_seq_fifo *f, struct snd_seq_event *event) {struct snd_seq_event_cell *cell; -unsigned long flags;int err;if (snd_BUG_ON (!f))
@@ -118,15 +116,15 @@ int snd_seq_fifo_event_in(struct snd_seq_fifo *f, }/* append new cells to fifo */ -spin_lock_irqsave (&f->lock, flags); -if (f->tail !=NULL ) - f->tail->next = cell; - f->tail = cell; -if (f->head ==NULL ) - f->head = cell; - cell->next =NULL ; - f->cells++; -spin_unlock_irqrestore (&f->lock, flags); + scoped_guard(spinlock_irqsave, &f->lock) { +if (f->tail !=NULL ) + f->tail->next = cell; + f->tail = cell; +if (f->head ==NULL ) + f->head = cell; + cell->next =NULL ; + f->cells++; + }/* wakeup client */ if (waitqueue_active (&f->input_sleep))
@@ -199,16 +197,13 @@ int snd_seq_fifo_cell_out(struct snd_seq_fifo *f,void snd_seq_fifo_cell_putback (struct snd_seq_fifo *f,struct snd_seq_event_cell *cell) { -unsigned long flags; -if (cell) { -spin_lock_irqsave (&f->lock, flags); +guard (spinlock_irqsave)(&f->lock); cell->next = f->head; f->head = cell;if (!f->tail) f->tail = cell; f->cells++; -spin_unlock_irqrestore (&f->lock, flags); } }
@@ -239,17 +234,17 @@ int snd_seq_fifo_resize(struct snd_seq_fifo *f, int poolsize)return -ENOMEM ; } -spin_lock_irq (&f->lock); -/* remember old pool */ - oldpool = f->pool; - oldhead = f->head; -/* exchange pools */ - f->pool = newpool; - f->head =NULL ; - f->tail =NULL ; - f->cells =0 ; -/* NOTE: overflow flag is not cleared */ -spin_unlock_irq (&f->lock); + scoped_guard(spinlock_irq, &f->lock) { +/* remember old pool */ + oldpool = f->pool; + oldhead = f->head; +/* exchange pools */ + f->pool = newpool; + f->head =NULL ; + f->tail =NULL ; + f->cells =0 ; +/* NOTE: overflow flag is not cleared */ + }/* close the old pool and wait until all users are gone */ snd_seq_pool_mark_closing (oldpool);
@@ -268,16 +263,14 @@ int snd_seq_fifo_resize(struct snd_seq_fifo *f, int poolsize)/* get the number of unused cells safely */ int snd_seq_fifo_unused_cells (struct snd_seq_fifo *f) { -unsigned long flags;int cells;if (!f)return 0 ;snd_use_lock_use (&f->use_lock); -spin_lock_irqsave (&f->lock, flags); - cells =snd_seq_unused_cells (f->pool); -spin_unlock_irqrestore (&f->lock, flags); +scoped_guard (spinlock_irqsave, &f->lock) + cells = snd_seq_unused_cells(f->pool);snd_use_lock_free (&f->use_lock);return cells; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1249/1887 ALSA: seq: Clean up fifo locking with guard
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 9314e34e37292f2d3d43dcc8a7f54366b4c0811d ]
Yet more cleanup, now for seq_fifo.c about its refcount calls; the manual refcount calls (either snd_use_lock_*() or snd_seq_fifo_lock()) are replaced with guard(snd_seq_fifo).
Only code refactoring, and no behavior change.
Stable-dep-of: e546128291f8 ("ALSA: seq: avoid stale FIFO cells during resize")
--- sound/core/seq/seq_clientmgr.c | 3 +-- sound/core/seq/seq_fifo.c | 15 ++++----------- sound/core/seq/seq_fifo.h | 1 + 3 files changed, 6 insertions(+), 13 deletions(-)
sound/core/seq/seq_clientmgr.c +1 -2
@@ -439,7 +439,7 @@ static ssize_t snd_seq_read(struct file *file, char __user *buf, size_t count, cell =NULL ; err =0 ; -snd_seq_fifo_lock (fifo); +guard (snd_seq_fifo)(fifo);if (IS_ENABLED (CONFIG_SND_SEQ_UMP ) && client->midi_version >0 ) aligned_size =sizeof (struct snd_seq_ump_event );
@@ -498,7 +498,6 @@ static ssize_t snd_seq_read(struct file *file, char __user *buf, size_t count,if (err == -EAGAIN && result >0 ) err =0 ; } -snd_seq_fifo_unlock (fifo);return (err <0 ) ? err : result; }
sound/core/seq/seq_fifo.c +4 -11
@@ -106,12 +106,11 @@ int snd_seq_fifo_event_in(struct snd_seq_fifo *f,if (snd_BUG_ON (!f))return -EINVAL ; -snd_use_lock_use (&f->use_lock); +guard (snd_seq_fifo)(f); err =snd_seq_event_dup (f->pool, event, &cell,1 ,NULL ,NULL );/* always non-blocking */ if (err <0 ) {if ((err == -ENOMEM ) || (err == -EAGAIN ))atomic_inc (&f->overflow); -snd_use_lock_free (&f->use_lock);return err; }
@@ -130,8 +129,6 @@ int snd_seq_fifo_event_in(struct snd_seq_fifo *f,if (waitqueue_active (&f->input_sleep))wake_up (&f->input_sleep); -snd_use_lock_free (&f->use_lock); -return 0 ;/* success */ }
@@ -263,14 +260,10 @@ int snd_seq_fifo_resize(struct snd_seq_fifo *f, int poolsize)/* get the number of unused cells safely */ int snd_seq_fifo_unused_cells (struct snd_seq_fifo *f) { -int cells; -if (!f)return 0 ; -snd_use_lock_use (&f->use_lock); -scoped_guard (spinlock_irqsave, &f->lock) - cells = snd_seq_unused_cells(f->pool); -snd_use_lock_free (&f->use_lock); -return cells; +guard (snd_seq_fifo)(f); +guard (spinlock_irqsave)(&f->lock); +return snd_seq_unused_cells (f->pool); }
sound/core/seq/seq_fifo.h +1 -0
@@ -37,6 +37,7 @@ int snd_seq_fifo_event_in(struct snd_seq_fifo *f, struct snd_seq_event *event);/* lock fifo from release */ #define snd_seq_fifo_lock (fifo) snd_use_lock_use(&(fifo)->use_lock)#define snd_seq_fifo_unlock (fifo) snd_use_lock_free(&(fifo)->use_lock) +DEFINE_GUARD(snd_seq_fifo, struct snd_seq_fifo *, snd_seq_fifo_lock(_T), snd_seq_fifo_unlock(_T)) /* get a cell from fifo - fifo should be locked */int snd_seq_fifo_cell_out (struct snd_seq_fifo *f,struct snd_seq_event_cell **cellp,int nonblock);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1250/1887 ALSA: seq: avoid stale FIFO cells during resize
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang <[email protected]>
[ Upstream commit e546128291f8d688dcb931827e2efd2aa6c0734d ]
snd_seq_fifo_resize() still needs to publish the replacement pool before it waits for FIFO users. A blocking snd_seq_read() holds f->use_lock while it sleeps, so concurrent senders must be able to queue to the new pool and wake that reader instead of failing against a closing old pool.
However, snd_seq_fifo_event_in() duplicates an event before it takes f->lock, and snd_seq_read() can dequeue a cell and later call snd_seq_fifo_cell_putback() if copy_to_user() or snd_seq_expand_var_event() fails. If resize swaps f->pool and detaches oldhead in between, either path can relink an old-pool cell after the snapshot. That stale cell sits outside the drained oldhead list, keeps oldpool->counter elevated, and can leave snd_seq_pool_delete() waiting for the retired pool to drain.
Keep the existing swap-before-wait ordering in snd_seq_fifo_resize(), but reject stale cells before any FIFO relink. Revalidate event-in cells under f->lock and retry them against the published replacement pool, and free stale putback cells instead of linking them back into the FIFO.
The buggy scenario involves two paths, with each column showing the order within that path:
resize path: relink path:
1. Allocate newpool. 1. Take f->use_lock.
2. Swap f->pool to newpool and 2. Duplicate or dequeue an old-pool
detach oldhead. cell before oldpool closes.
3. Mark oldpool closing and 3. Reach a later relink point after
wait for FIFO users. resize published newpool.
4. Free oldhead and delete 4. Relink the old-pool cell after
oldpool. resize detached oldhead.
5. Drop f->use_lock.
The reproducer reports a resize ioctl blocked in the expected pool teardown path:
signal: resize iteration=98 target_pool=4 exceeded 250ms
(elapsed=251ms) diagnostic: resize_tid=651 wchan=snd_seq_pool_done diagnostic: resize_tid=651 stack= snd_seq_pool_done+0x5b/0x140 snd_seq_pool_delete+0x7a/0x90 snd_seq_fifo_resize+0x193/0x1e0 snd_seq_ioctl_set_client_pool+0x214/0x260 snd_seq_ioctl+0x119/0x540 __x64_sys_ioctl+0xd1/0x120 do_syscall_64+0xbb/0x2f0 entry_SYSCALL_64_after_hwframe+0x77/0x7f
A second run with larger pools hit the same target path:
signal: resize iteration=32 target_pool=64 exceeded 250ms
(elapsed=251ms) diagnostic: resize_tid=663 wchan=snd_seq_pool_done diagnostic: resize_tid=663 stack= snd_seq_pool_done+0x5b/0x140 snd_seq_pool_delete+0x7a/0x90 snd_seq_fifo_resize+0x193/0x1e0 snd_seq_ioctl_set_client_pool+0x214/0x260 snd_seq_ioctl+0x119/0x540 __x64_sys_ioctl+0xd1/0x120 do_syscall_64+0xbb/0x2f0 entry_SYSCALL_64_after_hwframe+0x77/0x7f
--- sound/core/seq/seq_fifo.c | 52 ++++++++++++++++++++++++++++----------- 1 file changed, 37 insertions(+), 15 deletions(-)
sound/core/seq/seq_fifo.c +37 -15
@@ -101,13 +101,17 @@ int snd_seq_fifo_event_in(struct snd_seq_fifo *f, struct snd_seq_event *event) {struct snd_seq_event_cell *cell; +struct snd_seq_pool *pool; +bool linked;int err;if (snd_BUG_ON (!f))return -EINVAL ;guard (snd_seq_fifo)(f); - err =snd_seq_event_dup (f->pool, event, &cell,1 ,NULL ,NULL );/* always non-blocking */ +retry: + pool =READ_ONCE (f->pool); + err =snd_seq_event_dup (pool, event, &cell,1 ,NULL ,NULL );/* always non-blocking */ if (err <0 ) {if ((err == -ENOMEM ) || (err == -EAGAIN ))atomic_inc (&f->overflow);
@@ -115,14 +119,24 @@ int snd_seq_fifo_event_in(struct snd_seq_fifo *f, }/* append new cells to fifo */ + linked = false; scoped_guard(spinlock_irqsave, &f->lock) { -if (f->tail !=NULL ) - f->tail->next = cell; - f->tail = cell; -if (f->head ==NULL ) - f->head = cell; - cell->next =NULL ; - f->cells++; +if (cell->pool == f->pool) { +if (f->tail) + f->tail->next = cell; + f->tail = cell; +if (!f->head) + f->head = cell; + cell->next =NULL ; + f->cells++; + linked = true; + } + } + +if (!linked) { +/* Retry against the replacement pool after resize publishes it. */ +snd_seq_cell_free (cell); + goto retry; }/* wakeup client */
@@ -194,13 +208,21 @@ int snd_seq_fifo_cell_out(struct snd_seq_fifo *f,void snd_seq_fifo_cell_putback (struct snd_seq_fifo *f,struct snd_seq_event_cell *cell) { +bool linked = false; +if (cell) { -guard (spinlock_irqsave)(&f->lock); - cell->next = f->head; - f->head = cell; -if (!f->tail) - f->tail = cell; - f->cells++; + scoped_guard(spinlock_irqsave, &f->lock) { +if (cell->pool == f->pool) { + cell->next = f->head; + f->head = cell; +if (!f->tail) + f->tail = cell; + f->cells++; + linked = true; + } + } +if (!linked) +snd_seq_cell_free (cell); } }
@@ -236,7 +258,7 @@ int snd_seq_fifo_resize(struct snd_seq_fifo *f, int poolsize) oldpool = f->pool; oldhead = f->head;/* exchange pools */ - f->pool = newpool; +WRITE_ONCE (f->pool, newpool); f->head =NULL ; f->tail =NULL ; f->cells =0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1251/1887 bnxt: fix head underflow on XDP head-grow
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Damato <[email protected]>
[ Upstream commit e26657fe3b85c068b01f42bb0c602f242d643ba9 ]
The xdp.py test test_xdp_native_adjst_head_grow_data crashes when run on a bnxt machine (and also crashes in NIPA).
It seems that the bug is an underflow in bnxt_rx_multi_page_skb, which builds the skb head:
napi_build_skb(data_ptr - bp->rx_offset, rxr->rx_page_size);
The problem with this expression is that in page mode, rx_offset is:
bp->rx_offset = NET_IP_ALIGN + XDP_PACKET_HEADROOM;
Which evaluates (at least on x86_64) to 258.
The test test_xdp_native_adjst_head_grow_data tests a case where the head is adjusted by -256.
When this test runs, data_ptr is shifted to frag_start + 2 (where frag_start = page_address(page) + offset).
Then, bnxt_rx_multi_page_skb is invoked and the napi_build_skb expression subtracts 258, landing at an address before frag_start. This could be either the previous fragment or the previous physical page when the offset is < 256 (e.g. if the fragment started at offset 0).
When the skb is freed, the page pool fragment reference is dropped on either the wrong page or the wrong frag of the right page. In either case, the corrupted reference count can lead to the page being prematurely recycled while still in use. Once (incorrectly) recycled, it can be handed out again and on driver teardown this would result in a double free.
The commit under fixes updated this code to handle the case where the native page size is >= 64k, but it unintentionally broke the head grow case.
To fix this, add an offset field to struct bnxt_sw_rx_bd, mirroring the existing offset field in struct bnxt_sw_rx_agg_bd. Populate it on allocation and preserve it on reuse.
In bnxt_rx_multi_page_skb, use the newly added offset field to compute the fragment start and pass that to napi_build_skb. Adjust the layout with skb_reserve.
There are two cases, the non-adjustment case and the adjustment case.
In both cases, the skb is built at page_address(page) + offset to account for the case where the native page size >= 64K and skb_reserve is called with data_ptr - (page_address(page) + offset). That difference equals bp->rx_offset when data_ptr was not moved, or bp->rx_offset + xdp_adjust when XDP adjusted the head.
Re-running the failing test with this commit applied causes the test to run successfully to completion.
The other rx_skb_func implementations don't have this issue.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 10 ++++++++-- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 + 2 files changed, 9 insertions(+), 2 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +8 -2
@@ -816,6 +816,7 @@ int bnxt_alloc_rx_data(struct bnxt *bp, struct bnxt_rx_ring_info *rxr, mapping += bp->rx_dma_offset; rx_buf->data = page; rx_buf->data_ptr =page_address (page) + offset + bp->rx_offset; + rx_buf->offset = offset; }else {u8 *data =__bnxt_alloc_rx_frag (bp, &mapping, gfp);
@@ -824,6 +825,7 @@ int bnxt_alloc_rx_data(struct bnxt *bp, struct bnxt_rx_ring_info *rxr, rx_buf->data = data; rx_buf->data_ptr = data + bp->rx_offset; + rx_buf->offset =0 ; } rx_buf->mapping = mapping;
@@ -844,6 +846,7 @@ void bnxt_reuse_rx_data(struct bnxt_rx_ring_info *rxr, u16 cons, void *data) prod_rx_buf->data_ptr = cons_rx_buf->data_ptr; prod_rx_buf->mapping = cons_rx_buf->mapping; + prod_rx_buf->offset = cons_rx_buf->offset; prod_bd = &rxr->rx_desc_ring[RX_RING (prod)][RX_IDX (prod)]; cons_bd = &rxr->rx_desc_ring[RX_RING (cons)][RX_IDX (cons)];
@@ -1014,8 +1017,11 @@ static struct sk_buff *bnxt_rx_multi_page_skb(struct bnxt *bp,struct page *page = data;u16 prod = rxr->rx_prod;struct sk_buff *skb; +void *frag_start;int err; + frag_start =page_address (page) + rxr->rx_buf_ring[cons].offset; + err =bnxt_alloc_rx_data (bp, rxr, prod,GFP_ATOMIC );if (unlikely (err)) {bnxt_reuse_rx_data (rxr, cons, data);
@@ -1024,13 +1030,13 @@ static struct sk_buff *bnxt_rx_multi_page_skb(struct bnxt *bp, dma_addr -= bp->rx_dma_offset;dma_unmap_page_attrs (&bp->pdev->dev, dma_addr,BNXT_RX_PAGE_SIZE , bp->rx_dir,DMA_ATTR_WEAK_ORDERING ); - skb =build_skb (data_ptr - bp->rx_offset,BNXT_RX_PAGE_SIZE ); + skb =build_skb (frag_start,BNXT_RX_PAGE_SIZE );if (!skb) {page_pool_recycle_direct (rxr->page_pool, page);return NULL ; }skb_mark_for_recycle (skb); -skb_reserve (skb, bp->rx_offset); +skb_reserve (skb, data_ptr - (u8 *)frag_start);__skb_put (skb, len);return skb;
drivers/net/ethernet/broadcom/bnxt/bnxt.h +1 -0
@@ -728,6 +728,7 @@ struct bnxt_sw_rx_bd {void *data;u8 *data_ptr;dma_addr_t mapping; +unsigned int offset; };struct bnxt_sw_rx_agg_bd {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1252/1887 ALSA: seq: Drop superfluous filter argument of get_event_dest_client()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 3531df81dca2f42accbc11821c5fa28e4104efd5 ]
All callers of get_event_dest_clienter() pass 0 to the filter argument, and it means that the check there is utterly redundant.
Drop the superfluous filter argument and its check as a code cleanup.
Stable-dep-of: efc86691e4d8 ("ALSA: seq: Fix kernel heap address leak in bounce_error_event()")
--- sound/core/seq/seq_clientmgr.c | 19 +++++++------------ 1 file changed, 7 insertions(+), 12 deletions(-)
sound/core/seq/seq_clientmgr.c +7 -12
@@ -68,7 +68,7 @@ static int bounce_error_event(struct snd_seq_client *client, int err, int atomic, int hop);static int snd_seq_deliver_single_event (struct snd_seq_client *client,struct snd_seq_event *event, -int filter,int atomic,int hop); +int atomic,int hop);/* */
@@ -515,10 +515,8 @@ static int check_port_perm(struct snd_seq_client_port *port, unsigned int flags)/* * check if the destination client is available, and return the pointer -* if filter is non-zero, client filter bitmap is tested. */ -static struct snd_seq_client *get_event_dest_client (struct snd_seq_event *event, -int filter) +static struct snd_seq_client *get_event_dest_client (struct snd_seq_event *event) {struct snd_seq_client *dest;
@@ -533,8 +531,6 @@ static struct snd_seq_client *get_event_dest_client(struct snd_seq_event *event,if ((dest->filter &SNDRV_SEQ_FILTER_USE_EVENT ) && !test_bit (event->type, dest->event_filter)) goto __not_avail; -if (filter && !(dest->filter & filter)) - goto __not_avail;return dest;/* ok - accessible */ __not_avail:
@@ -578,7 +574,7 @@ static int bounce_error_event(struct snd_seq_client *client, bounce_ev.data.quote.origin = event->dest; bounce_ev.data.quote.event = event; bounce_ev.data.quote.value = -err;/* use positive value */ - result =snd_seq_deliver_single_event (NULL , &bounce_ev,0 , atomic, hop +1 ); + result =snd_seq_deliver_single_event (NULL , &bounce_ev, atomic, hop +1 );if (result <0 ) { client->event_lost++;return result;
@@ -624,7 +620,7 @@ static int update_timestamp_of_queue(struct snd_seq_event *event,*/ static int snd_seq_deliver_single_event (struct snd_seq_client *client,struct snd_seq_event *event, -int filter,int atomic,int hop) +int atomic,int hop) {struct snd_seq_client *dest =NULL ;struct snd_seq_client_port *dest_port =NULL ;
@@ -633,7 +629,7 @@ static int snd_seq_deliver_single_event(struct snd_seq_client *client, direct =snd_seq_ev_is_direct (event); - dest =get_event_dest_client (event, filter); + dest =get_event_dest_client (event);if (dest ==NULL ) goto __skip; dest_port =snd_seq_port_use_ptr (dest, event->dest.port);
@@ -716,8 +712,7 @@ static int deliver_to_subscribers(struct snd_seq_client *client,/* convert time according to flag with subscription */ update_timestamp_of_queue (event, subs->info.queue, subs->info.flags &SNDRV_SEQ_PORT_SUBS_TIME_REAL ); - err =snd_seq_deliver_single_event (client, event, -0 , atomic, hop); + err =snd_seq_deliver_single_event (client, event, atomic, hop);if (err <0 ) {/* save first error that occurs and continue */ if (!result)
@@ -862,7 +857,7 @@ static int snd_seq_deliver_event(struct snd_seq_client *client, struct snd_seq_e result =port_broadcast_event (client, event, atomic, hop);#endif else - result =snd_seq_deliver_single_event (client, event,0 , atomic, hop); + result =snd_seq_deliver_single_event (client, event, atomic, hop);return result; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1253/1887 ALSA: seq: Fix kernel heap address leak in bounce_error_event()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: HanQuan <[email protected]>
[ Upstream commit efc86691e4d8083d9e380ea95042c2cf679f65fd ]
The comment above bounce_error_event() documents that user clients should receive SNDRV_SEQ_EVENT_BOUNCE with the original event embedded as variable-length data, while kernel clients should receive SNDRV_SEQ_EVENT_KERNEL_ERROR with a quoted kernel pointer.
However, the implementation unconditionally uses SNDRV_SEQ_EVENT_KERNEL_ERROR with data.quote.event set to the raw struct snd_seq_event pointer for all clients. When a bounce error event is delivered to a USER_CLIENT via snd_seq_read(), the kernel heap address in data.quote.event is exposed to userspace through copy_to_user() in the fixed-length branch.
This is a distinct leak path from the one addressed by commit 705dd6dcbc0e ("ALSA: seq: Clear variable event pointer on read"), which sanitizes data.ext.ptr in the variable-length branch of snd_seq_read(). The bounce_error_event() leak uses fixed-length events that take the else branch where no sanitization occurs.
Differentiate the bounce event by client type. For USER_CLIENT, send SNDRV_SEQ_EVENT_BOUNCE with SNDRV_SEQ_EVENT_LENGTH_VARIABLE and data.ext pointing to the original event. The variable-length path in snd_seq_event_dup() copies the event data into chained cells, and snd_seq_expand_var_event() copies only the content -- never the pointer -- to userspace. For KERNEL_CLIENT, keep the existing SNDRV_SEQ_EVENT_KERNEL_ERROR behavior with the quoted pointer.
--- sound/core/seq/seq_clientmgr.c | 32 +++++++++++++++++++++++++++----- 1 file changed, 27 insertions(+), 5 deletions(-)
sound/core/seq/seq_clientmgr.c +27 -5
@@ -564,16 +564,38 @@ static int bounce_error_event(struct snd_seq_client *client,/* set up quoted error */ memset (&bounce_ev,0 ,sizeof (bounce_ev)); - bounce_ev.type =SNDRV_SEQ_EVENT_KERNEL_ERROR ; - bounce_ev.flags =SNDRV_SEQ_EVENT_LENGTH_FIXED ; + +if (client->type ==USER_CLIENT ) { +/* +* For user clients, send SNDRV_SEQ_EVENT_BOUNCE with the +* original event embedded as variable-length data. This +* avoids exposing data.quote.event (a kernel pointer) to +* userspace. The variable-length path in snd_seq_event_dup() +* copies the event data from data.ext.ptr into chained cells, +* and snd_seq_expand_var_event() copies only the data content +* -- never the pointer -- to userspace. +*/ + bounce_ev.type =SNDRV_SEQ_EVENT_BOUNCE ; + bounce_ev.flags =SNDRV_SEQ_EVENT_LENGTH_VARIABLE ; + bounce_ev.data.ext.len =sizeof (struct snd_seq_event ); + bounce_ev.data.ext.ptr = (char *)event; + }else { +/* +* For kernel clients, quote the event pointer directly. +* Kernel consumers can safely dereference the pointer. +*/ + bounce_ev.type =SNDRV_SEQ_EVENT_KERNEL_ERROR ; + bounce_ev.flags =SNDRV_SEQ_EVENT_LENGTH_FIXED ; + bounce_ev.data.quote.origin = event->dest; + bounce_ev.data.quote.event = event; + bounce_ev.data.quote.value = -err;/* use positive value */ + } + bounce_ev.queue =SNDRV_SEQ_QUEUE_DIRECT ; bounce_ev.source.client =SNDRV_SEQ_CLIENT_SYSTEM ; bounce_ev.source.port =SNDRV_SEQ_PORT_SYSTEM_ANNOUNCE ; bounce_ev.dest.client = client->number; bounce_ev.dest.port = event->source.port; - bounce_ev.data.quote.origin = event->dest; - bounce_ev.data.quote.event = event; - bounce_ev.data.quote.value = -err;/* use positive value */ result =snd_seq_deliver_single_event (NULL , &bounce_ev, atomic, hop +1 );if (result <0 ) { client->event_lost++;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1254/1887 ASoC: topology: Check PCM and DAI name strings before use
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <[email protected]>
[ Upstream commit b7e44d1986d6671342c19b82192189ca5db5dab7 ]
Topology objects store several PCM and DAI names in fixed-size UAPI arrays. Other topology parser paths validate these fields with bounded strnlen() checks before using them as C strings, but the PCM and DAI paths still pass some fixed-size arrays directly to strlen(), devm_kstrdup(), DAI lookup, and diagnostic prints.
A malformed topology blob with a non-NUL-terminated PCM, DAI, or stream capability name can therefore make the parser read past the end of the fixed-size field.
Reject unterminated PCM and DAI name fields before consuming them as C strings.
--- sound/soc/soc-topology.c | 37 ++++++++++++++++++++++++++++++++++--- 1 file changed, 34 insertions(+), 3 deletions(-)
sound/soc/soc-topology.c +34 -3
@@ -1573,9 +1573,24 @@ static int soc_tplg_dapm_complete(struct soc_tplg *tplg)return 0 ; } +static int soc_tplg_check_name (const char *name) +{ +if (strnlen (name,SNDRV_CTL_ELEM_ID_NAME_MAXLEN ) == +SNDRV_CTL_ELEM_ID_NAME_MAXLEN ) +return -EINVAL ; + +return 0 ; +} +static int set_stream_info (struct soc_tplg *tplg,struct snd_soc_pcm_stream *stream,struct snd_soc_tplg_stream_caps *caps) { +int ret; + + ret =soc_tplg_check_name (caps->name); +if (ret) +return ret; + stream->stream_name =devm_kstrdup (tplg->dev, caps->name,GFP_KERNEL );if (!stream->stream_name)return -ENOMEM ;
@@ -1624,7 +1639,11 @@ static int soc_tplg_dai_create(struct soc_tplg *tplg,if (dai_drv ==NULL )return -ENOMEM ; -if (strlen (pcm->dai_name)) { + ret =soc_tplg_check_name (pcm->dai_name); +if (ret) + goto err; + +if (pcm->dai_name[0 ]) { dai_drv->name =devm_kstrdup (tplg->dev, pcm->dai_name,GFP_KERNEL );if (!dai_drv->name) { ret = -ENOMEM ;
@@ -1733,7 +1752,11 @@ static int soc_tplg_fe_link_create(struct soc_tplg *tplg, link->dobj.ops = tplg->ops; link->dobj.type =SND_SOC_DOBJ_DAI_LINK ; -if (strlen (pcm->pcm_name)) { + ret =soc_tplg_check_name (pcm->pcm_name); +if (ret) + goto err; + +if (pcm->pcm_name[0 ]) { link->name =devm_kstrdup (tplg->dev, pcm->pcm_name,GFP_KERNEL ); link->stream_name =devm_kstrdup (tplg->dev, pcm->pcm_name,GFP_KERNEL );if (!link->name || !link->stream_name) {
@@ -1743,7 +1766,11 @@ static int soc_tplg_fe_link_create(struct soc_tplg *tplg, } link->id =le32_to_cpu (pcm->pcm_id); -if (strlen (pcm->dai_name)) { + ret =soc_tplg_check_name (pcm->dai_name); +if (ret) + goto err; + +if (pcm->dai_name[0 ]) { link->cpus->dai_name =devm_kstrdup (tplg->dev, pcm->dai_name,GFP_KERNEL );if (!link->cpus->dai_name) { ret = -ENOMEM ;
@@ -2226,6 +2253,10 @@ static int soc_tplg_dai_config(struct soc_tplg *tplg,memset (&dai_component,0 ,sizeof (dai_component)); + ret =soc_tplg_check_name (d->dai_name); +if (ret) +return ret; + dai_component.dai_name = d->dai_name; dai =snd_soc_find_dai (&dai_component);if (!dai) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1255/1887 ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yun Zhou <[email protected]>
[ Upstream commit c143957520c6c9b5cd72e0de8b52b814f0c576fe ]
Reject the EXT4_IOC_MOVE_EXT ioctl early if the donor file does not belong to the same superblock as the original file. Currently, this validation is performed inside ext4_move_extents() by mext_check_validity(), but only after lock_two_nondirectories() has already acquired the inode locks. When the donor fd refers to a file on a different filesystem (e.g., overlayfs), this late validation creates a circular lock dependency:
CPU0 (overlayfs write) CPU1 (ext4 ioctl)
---- ----
inode_lock(ovl_inode)
mnt_want_write_file(filp)
sb_start_write(ext4_sb) [sb_writers]
backing_file_write_iter()
vfs_iter_write(real_file)
file_start_write(real_file)
sb_start_write(ext4_sb) [blocked by freeze]
lock_two_nondirectories()
inode_lock(ovl_inode) [blocked]
With a concurrent freeze operation holding sb_writers write side, this forms a deadlock cycle: CPU0 waits for freeze to complete, freeze waits for CPU1's sb_writers reader to exit, CPU1 waits for CPU0's inode lock.
Since EXT4_IOC_MOVE_EXT exchanges physical extents between two files, it fundamentally requires both files to reside on the same ext4 filesystem. Moving the superblock check before any lock acquisition is both semantically correct and eliminates the circular dependency by ensuring that cross-filesystem donor fds are rejected before sb_writers or inode locks are taken.
--- fs/ext4/ioctl.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/ext4/ioctl.c +5 -0
@@ -1348,6 +1348,11 @@ static long __ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) goto mext_out; } +if (file_inode (filp)->i_sb !=file_inode (donor.file)->i_sb) { + err = -EXDEV ; + goto mext_out; + } +if (ext4_has_feature_bigalloc (sb)) {ext4_msg (sb,KERN_ERR ,"Online defrag not supported with bigalloc" );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1256/1887 ext4: fix kernel BUG in ext4_write_inline_data_end
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aditya Prakash Srivastava <[email protected]>
[ Upstream commit ad09aa45965d3fafaf9963bc78109b73c0f9ac8d ]
When the data=journal mount option is used, the ext4_journalled_write_end() function incorrectly calls ext4_write_inline_data_end() without checking if the EXT4_STATE_MAY_INLINE_DATA flag is still set on the inode.
If a previous attempt to convert the inline data to an extent failed (e.g. due to ENOSPC), the EXT4_STATE_MAY_INLINE_DATA flag is cleared, but the EXT4_INODE_INLINE_DATA flag remains set. In this scenario, the next call to ext4_write_begin() will not prepare the inline data xattr for writing, but ext4_journalled_write_end() will incorrectly attempt to write to it, triggering a BUG_ON(pos + len > EXT4_I(inode)->i_inline_size) in ext4_write_inline_data() since i_inline_size was not expanded.
Fix this by ensuring that ext4_journalled_write_end() only calls ext4_write_inline_data_end() if the EXT4_STATE_MAY_INLINE_DATA flag is set, mirroring the behavior of ext4_write_end() and ext4_da_write_end().
--- fs/ext4/inode.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/ext4/inode.c +2 -1
@@ -1451,7 +1451,8 @@ static int ext4_journalled_write_end(struct file *file,BUG_ON (!ext4_handle_valid (handle)); -if (ext4_has_inline_data (inode)) +if (ext4_has_inline_data (inode) && +ext4_test_inode_state (inode,EXT4_STATE_MAY_INLINE_DATA ))return ext4_write_inline_data_end (inode, pos, len, copied, page);if (unlikely (copied < len) && !PageUptodate (page)) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1257/1887 ixgbe: do not configure xps for XDP queues
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larysa Zaremba <[email protected]>
[ Upstream commit 7bd4355272de34c2e90e34b72c5613736d03c32b ]
netif_set_xps_queue() should not be called for an XDP Tx queue, since such queues are not netdev-exposed. On systems with number of CPUs >=64, on E610 adapter, netdev is configured with maximum number queue pairs being 63 (due to MSI-X assignment), but configuring XDP results in 64 XDP queues.
So, during XDP program load, when netif_set_xps_queue() is called for the last XDP queue, we get a WARNING with a call trace and KASAN report afterwards (if enabled).
[ 2012.699800] WARNING: net/core/dev.c:2854 at __netif_set_xps_queue+0x116a/0x1e40, CPU#36: xdpsock/103668 [...] [ 2012.700029] RIP: 0010:__netif_set_xps_queue+0x116a/0x1e40 [ 2012.700035] Code: b6 34 06 48 89 f8 83 e0 07 83 c0 01 40 38 f0 7c 09 40 84 f6 0f 85 03 0a 00 00 0f b7 44 24 40 66 43 89 44 6a 18 e9 01 fb ff ff <0f> 0b e9 f2 ee ff ff 44 8b 44 24 44 45 85 c0 74 50 4d 85 e4 0f 84 [ 2012.700040] RSP: 0018:ffff8882369aeb28 EFLAGS: 00010246 [ 2012.700046] RAX: 0000000000000000 RBX: 000000000000003f RCX: 0000000000000000 [ 2012.700050] RDX: 1ffff1111da3d891 RSI: ffff888120e34250 RDI: ffff8888ed1ec488 [ 2012.700054] RBP: ffff888913281560 R08: 0000000000000000 R09: ffff8888ed1ec000 [ 2012.700058] R10: ffff8888a2e83180 R11: 0000000000000000 R12: 0000000000007fa8 [ 2012.700061] R13: 000000000000003f R14: ffff888120e34854 R15: ffff8889132817c8 [ 2012.700065] FS: 00007fc8ea9ff740(0000) GS:ffff88884cefe000(0000) knlGS:0000000000000000 [ 2012.700069] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2012.700073] CR2: 00007f81c8000020 CR3: 00000002299f8006 CR4: 00000000007726f0 [ 2012.700077] PKRU: 55555554 [ 2012.700080] Call Trace: [ 2012.700084] <TASK> [ 2012.700087] ? ktime_get+0x61/0x150 [ 2012.700097] ? usleep_range_state+0x133/0x1b0 [ 2012.700108] ? __pfx_usleep_range_state+0x10/0x10 [ 2012.700114] netif_set_xps_queue+0x31/0x50 [ 2012.700119] ixgbe_configure_tx_ring+0x472/0x920 [ixgbe] [...] [ 2012.700486] ixgbe_xdp+0x38f/0x750 [ixgbe]
[...]
[ 2012.701094] BUG: KASAN: slab-out-of-bounds in __netif_set_xps_queue+0x1ac5/0x1e40 [ 2012.701100] Write of size 4 at addr ffff88888d43cff8 by task xdpsock/103668
Skip XPS configuration for XDP Tx queues.
--- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +2 -1
@@ -3522,7 +3522,8 @@ void ixgbe_configure_tx_ring(struct ixgbe_adapter *adapter, }/* initialize XPS */ -if (!test_and_set_bit (__IXGBE_TX_XPS_INIT_DONE, &ring->state)) { +if (!ring_is_xdp (ring) && + !test_and_set_bit (__IXGBE_TX_XPS_INIT_DONE, &ring->state)) {struct ixgbe_q_vector *q_vector = ring->q_vector;if (q_vector)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1258/1887 btrfs: fix deadlock cloning inline extent when using flushoncommit
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit 532085d00eb54c074bdeae648b194765239f4d11 ]
In commit b48c980b6a7e ("btrfs: fix deadlock between reflink and transaction commit when using flushoncommit") a deadlock was fixed between reflinks and transaction commits when the fs is mounted with the flushoncommit option. This happened when we had to copy an inline extent's data to the destination file. However the issue was fixed only for the case where the destination offset is 0, it missed the case when the offset is greater than zero.
Fix this by ensuring we get i_size update whenever we copied an inline extent's data into the destination file.
Syzbot reported this with the following trace:
INFO: task kworker/u8:3:57 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u8:3 state:D stack:21600 pid:57 tgid:57 ppid:2 task_flags:0x4208160 flags:0x00080000
Workqueue: writeback wb_workfn (flush-btrfs-129)
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5402 [inline]
__schedule+0x16f9/0x5500 kernel/sched/core.c:7204
__schedule_loop kernel/sched/core.c:7283 [inline]
schedule+0x164/0x360 kernel/sched/core.c:7298
wait_extent_bit fs/btrfs/extent-io-tree.c:905 [inline]
btrfs_lock_extent_bits+0x59c/0x700 fs/btrfs/extent-io-tree.c:2008
btrfs_lock_extent fs/btrfs/extent-io-tree.h:152 [inline]
btrfs_invalidate_folio+0x440/0xc00 fs/btrfs/inode.c:7718
extent_writepage fs/btrfs/extent_io.c:1848 [inline]
extent_write_cache_pages fs/btrfs/extent_io.c:2552 [inline]
btrfs_writepages+0x12f3/0x2410 fs/btrfs/extent_io.c:2684
do_writepages+0x32e/0x550 mm/page-writeback.c:2571
__writeback_single_inode+0x133/0x10e0 fs/fs-writeback.c:1764
writeback_sb_inodes+0x97f/0x1980 fs/fs-writeback.c:2056
wb_writeback+0x445/0xb00 fs/fs-writeback.c:2241
wb_do_writeback fs/fs-writeback.c:2388 [inline]
wb_workfn+0x3fd/0xf20 fs/fs-writeback.c:2428
process_one_work+0x98b/0x1630 kernel/workqueue.c:3318
process_scheduled_works kernel/workqueue.c:3401 [inline]
worker_thread+0xb49/0x1140 kernel/workqueue.c:3482
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
INFO: task syz.0.145:8523 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.145 state:D stack:22752 pid:8523 tgid:8522 ppid:5850 task_flags:0x400140 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5402 [inline]
__schedule+0x16f9/0x5500 kernel/sched/core.c:7204
__schedule_loop kernel/sched/core.c:7283 [inline]
schedule+0x164/0x360 kernel/sched/core.c:7298
wb_wait_for_completion+0x3e8/0x790 fs/fs-writeback.c:227
__writeback_inodes_sb_nr+0x24c/0x2d0 fs/fs-writeback.c:2847
try_to_writeback_inodes_sb+0x9a/0xc0 fs/fs-writeback.c:2895
btrfs_start_delalloc_flush fs/btrfs/transaction.c:2182 [inline]
btrfs_commit_transaction+0x813/0x2fc0 fs/btrfs/transaction.c:2371
btrfs_sync_file+0xdf4/0x1230 fs/btrfs/file.c:1822
generic_write_sync include/linux/fs.h:2663 [inline]
btrfs_do_write_iter+0x6a9/0x840 fs/btrfs/file.c:1473
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x629/0xba0 fs/read_write.c:688
ksys_write+0x156/0x270 fs/read_write.c:740
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x15f/0x560 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5a0bdece59
RSP: 002b:00007f5a0b446028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f5a0c065fa0 RCX: 00007f5a0bdece59
RDX: 000000000000029f RSI: 0000200000000200 RDI: 0000000000000004
RBP: 00007f5a0be82d6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f5a0c066038 R14: 00007f5a0c065fa0 R15: 00007ffe149206b8
</TASK>
INFO: task syz.0.145:8539 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.145 state:D stack:23704 pid:8539 tgid:8522 ppid:5850 task_flags:0x400140 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5402 [inline]
__schedule+0x16f9/0x5500 kernel/sched/core.c:7204
__schedule_loop kernel/sched/core.c:7283 [inline]
schedule+0x164/0x360 kernel/sched/core.c:7298
wait_current_trans+0x39f/0x590 fs/btrfs/transaction.c:536
start_transaction+0xbd8/0x1820 fs/btrfs/transaction.c:716
clone_copy_inline_extent fs/btrfs/reflink.c:299 [inline]
btrfs_clone+0x1316/0x2540 fs/btrfs/reflink.c:574
btrfs_clone_files+0x271/0x3f0 fs/btrfs/reflink.c:795
btrfs_remap_file_range+0x76b/0x1320 fs/btrfs/reflink.c:948
vfs_clone_file_range+0x435/0x7b0 fs/remap_range.c:403
ioctl_file_clone fs/ioctl.c:239 [inline]
ioctl_file_clone_range fs/ioctl.c:257 [inline]
do_vfs_ioctl+0xe15/0x1540 fs/ioctl.c:544
__do_sys_ioctl fs/ioctl.c:595 [inline]
__se_sys_ioctl+0x82/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x15f/0x560 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5a0bdece59
RSP: 002b:00007f5a0b425028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f5a0c066090 RCX: 00007f5a0bdece59
RDX: 00002000000000c0 RSI: 000000004020940d RDI: 0000000000000004
RBP: 00007f5a0be82d6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f5a0c066128 R14: 00007f5a0c066090 R15: 00007ffe149206b8
</TASK>--- fs/btrfs/reflink.c | 109 ++++++++++++++++++++++++--------------------- 1 file changed, 57 insertions(+), 52 deletions(-)
fs/btrfs/reflink.c +57 -52
@@ -175,18 +175,12 @@ static int clone_copy_inline_extent(struct inode *dst,struct btrfs_drop_extents_args drop_args = {0 };int ret;struct btrfs_key key; +bool copied_inline_to_page = false;if (new_key->offset >0 ) { ret =copy_inline_to_page (BTRFS_I (dst), new_key->offset, inline_data, size, datal, comp_type); - -/* -* Increase the i_size before starting a transaction, see the -* comment at the copy_to_page label below. -*/ -if (ret ==0 && new_key->offset + datal >i_size_read (dst)) -i_size_write (dst, new_key->offset + datal); - + copied_inline_to_page = (ret ==0 ); goto out; }
@@ -286,6 +280,60 @@ static int clone_copy_inline_extent(struct inode *dst, ret =btrfs_inode_set_file_extent_range (BTRFS_I (dst),0 , aligned_end); out:if (!ret && !trans) { +if (copied_inline_to_page && + new_key->offset + datal >i_size_read (dst)) { +/* +* If we copied the inline extent data to a page/folio +* beyond the i_size of the destination inode, then we +* need to increase the i_size before we start a +* transaction to update the inode item. This is to +* prevent a deadlock when the flushoncommit mount +* option is used, which happens like this: +* +* 1) Task A clones an inline extent from inode X to an +* offset of inode Y that is beyond Y's current +* i_size. This means we copied the inline extent's +* data to a folio of inode Y that is beyond its EOF, +* using the call above to copy_inline_to_page(); +* +* 2) Task B starts a transaction commit and calls +* btrfs_start_delalloc_flush() to flush delalloc; +* +* 3) The delalloc flushing sees the new dirty folio of +* inode Y and when it attempts to flush it, it ends +* up at extent_writepage() and sees that the offset +* of the folio is beyond the i_size of inode Y, so +* it attempts to invalidate the folio by calling +* folio_invalidate(), which ends up at btrfs' folio +* invalidate callback - btrfs_invalidate_folio(). +* There it tries to lock the folio's range in inode +* Y's extent io tree, but it blocks since it's +* currently locked by task A - during reflink we +* lock the inodes and the source and destination +* ranges after flushing all delalloc and waiting for +* ordered extent completion - after that we don't +* expect to have dirty folios in the ranges, the +* exception is if we have to copy an inline extent's +* data (because the destination offset is not zero); +* +* 4) Task A then does the 'goto out' below and attempts +* to start a transaction to update the inode item, +* and then it's blocked since the current +* transaction is in the TRANS_STATE_COMMIT_START +* state. Therefore task A has to wait for the +* current transaction to become unblocked (its +* state >= TRANS_STATE_UNBLOCKED). +* +* This leads to a deadlock - the task committing the +* transaction waiting for the delalloc flushing which +* is blocked during folio invalidation on the inode's +* extent lock and the reflink task waiting for the +* current transaction to be unblocked so that it can +* start a new one to update the inode item (while +* holding the extent lock). +*/ +i_size_write (dst, new_key->offset + datal); + }/* * No transaction here means we copied the inline extent into a * page of the destination inode.
@@ -320,50 +368,7 @@ static int clone_copy_inline_extent(struct inode *dst, ret =copy_inline_to_page (BTRFS_I (dst), new_key->offset, inline_data, size, datal, comp_type); - -/* -* If we copied the inline extent data to a page/folio beyond the i_size -* of the destination inode, then we need to increase the i_size before -* we start a transaction to update the inode item. This is to prevent a -* deadlock when the flushoncommit mount option is used, which happens -* like this: -* -* 1) Task A clones an inline extent from inode X to an offset of inode -* Y that is beyond Y's current i_size. This means we copied the -* inline extent's data to a folio of inode Y that is beyond its EOF, -* using the call above to copy_inline_to_page(); -* -* 2) Task B starts a transaction commit and calls -* btrfs_start_delalloc_flush() to flush delalloc; -* -* 3) The delalloc flushing sees the new dirty folio of inode Y and when -* it attempts to flush it, it ends up at extent_writepage() and sees -* that the offset of the folio is beyond the i_size of inode Y, so -* it attempts to invalidate the folio by calling folio_invalidate(), -* which ends up at btrfs' folio invalidate callback - -* btrfs_invalidate_folio(). There it tries to lock the folio's range -* in inode Y's extent io tree, but it blocks since it's currently -* locked by task A - during reflink we lock the inodes and the -* source and destination ranges after flushing all delalloc and -* waiting for ordered extent completion - after that we don't expect -* to have dirty folios in the ranges, the exception is if we have to -* copy an inline extent's data (because the destination offset is -* not zero); -* -* 4) Task A then does the 'goto out' below and attempts to start a -* transaction to update the inode item, and then it's blocked since -* the current transaction is in the TRANS_STATE_COMMIT_START state. -* Therefore task A has to wait for the current transaction to become -* unblocked (its state >= TRANS_STATE_UNBLOCKED). -* -* This leads to a deadlock - the task committing the transaction -* waiting for the delalloc flushing which is blocked during folio -* invalidation on the inode's extent lock and the reflink task waiting -* for the current transaction to be unblocked so that it can start a -* a new one to update the inode item (while holding the extent lock). -*/ -if (ret ==0 && new_key->offset + datal >i_size_read (dst)) -i_size_write (dst, new_key->offset + datal); + copied_inline_to_page = (ret ==0 ); goto out; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1259/1887 RDMA/siw: Introduce siw_destroy_cep_sock
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guoqing Jiang <[email protected]>
[ Upstream commit d9a5b48681315a5881cea24bc8f384da02828e88 ]
Add one helper to simplify code a bit.
Stable-dep-of: ea4f6f6c5357 ("RDMA/siw: Fix endpoint/socket association handling")
--- drivers/infiniband/sw/siw/siw_cm.c | 26 ++++++++++++-------------- 1 file changed, 12 insertions(+), 14 deletions(-)
drivers/infiniband/sw/siw/siw_cm.c +12 -14
@@ -370,6 +370,15 @@ static void siw_free_cm_id(struct siw_cep *cep) cep->cm_id =NULL ; } +static void siw_destroy_cep_sock (struct siw_cep *cep) +{ +if (cep->sock) { +siw_socket_disassoc (cep->sock); +sock_release (cep->sock); + cep->sock =NULL ; + } +} +/* * siw_qp_cm_drop() *
@@ -427,14 +436,7 @@ void siw_qp_cm_drop(struct siw_qp *qp, int schedule) } cep->state =SIW_EPSTATE_CLOSED ; -if (cep->sock) { -siw_socket_disassoc (cep->sock); -/* -* Immediately close socket -*/ -sock_release (cep->sock); - cep->sock =NULL ; - } +siw_destroy_cep_sock (cep);if (cep->qp) { cep->qp =NULL ;siw_qp_put (qp);
@@ -1698,9 +1700,7 @@ int siw_accept(struct iw_cm_id *id, struct iw_cm_conn_param *params) error_unlock:up_write (&qp->state_lock); error: -siw_socket_disassoc (cep->sock); -sock_release (cep->sock); - cep->sock =NULL ; +siw_destroy_cep_sock (cep); cep->state =SIW_EPSTATE_CLOSED ;
@@ -1745,9 +1745,7 @@ int siw_reject(struct iw_cm_id *id, const void *pdata, u8 pd_len) cep->mpa.hdr.params.bits |=MPA_RR_FLAG_REJECT ;/* reject */ siw_send_mpareqrep (cep, pdata, pd_len); } -siw_socket_disassoc (cep->sock); -sock_release (cep->sock); - cep->sock =NULL ; +siw_destroy_cep_sock (cep); cep->state =SIW_EPSTATE_CLOSED ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1260/1887 RDMA/siw: Fix endpoint/socket association handling
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bernard Metzler <[email protected]>
[ Upstream commit ea4f6f6c53577fb3f05dbd78b15e586772d49831 ]
Disassociating a socket from an endpoint via siw_socket_disassoc() may release the last reference on that endpoint and free it. Therefore, don't clear the endpoints socket pointer after calling that function, but within.
This fixes a:
BUG: KASAN: slab-use-after-free in siw_cm_work_handler (drivers/infiniband/sw/siw/siw_cm.c:1053 drivers/infiniband/sw/siw/siw_cm.c:1075)
which occurred after processing a malformed MPA request during connection establishment, causing the new endpoint to be closed.
--- drivers/infiniband/sw/siw/siw_cm.c | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-)
drivers/infiniband/sw/siw/siw_cm.c +15 -15
@@ -93,6 +93,7 @@ static void siw_socket_disassoc(struct socket *s) cep =sk_to_cep (sk);if (cep) {siw_sk_restore_upcalls (sk, cep); + cep->sock =NULL ;siw_cep_put (cep); }else {pr_warn ("siw: cannot restore sk callbacks: no ep\n" );
@@ -372,10 +373,11 @@ static void siw_free_cm_id(struct siw_cep *cep)static void siw_destroy_cep_sock (struct siw_cep *cep) { -if (cep->sock) { -siw_socket_disassoc (cep->sock); -sock_release (cep->sock); - cep->sock =NULL ; +struct socket *s = cep->sock; + +if (s) { +siw_socket_disassoc (s); +sock_release (s); } }
@@ -1005,7 +1007,6 @@ static void siw_accept_newconn(struct siw_cep *cep)if (new_s) {siw_socket_disassoc (new_s);sock_release (new_s); - new_cep->sock =NULL ; }siw_dbg_cep (cep,"error %d\n" , rv); }
@@ -1157,6 +1158,8 @@ static void siw_cm_work_handler(struct work_struct *w)WARN (1 ,"Undefined CM work type: %d\n" , work->type); }if (release_cep) { +struct socket *s = cep->sock; + siw_dbg_cep(cep, "release: timer=%s, QP[%u]\n", cep->mpa_timer ? "y" : "n",
@@ -1182,10 +1185,9 @@ static void siw_cm_work_handler(struct work_struct *w) cep->qp =NULL ;siw_qp_put (qp); } -if (cep->sock) { -siw_socket_disassoc (cep->sock); -sock_release (cep->sock); - cep->sock =NULL ; +if (s) { +siw_socket_disassoc (s); +sock_release (s); }if (cep->cm_id) {siw_free_cm_id (cep);
@@ -1513,7 +1515,6 @@ int siw_connect(struct iw_cm_id *id, struct iw_cm_conn_param *params)if (cep) {siw_socket_disassoc (s);sock_release (s); - cep->sock =NULL ; cep->qp =NULL ;
@@ -1877,7 +1878,6 @@ int siw_create_listen(struct iw_cm_id *id, int backlog)siw_cep_set_inuse (cep);siw_free_cm_id (cep); - cep->sock =NULL ;siw_socket_disassoc (s); cep->state =SIW_EPSTATE_CLOSED ;
@@ -1898,6 +1898,7 @@ static void siw_drop_listeners(struct iw_cm_id *id)*/ list_for_each_safe (p, tmp, (struct list_head *)id->provider_data) { struct siw_cep *cep = list_entry(p, struct siw_cep, listenq); +struct socket *s = cep->sock;list_del (p);
@@ -1906,10 +1907,9 @@ static void siw_drop_listeners(struct iw_cm_id *id)siw_cep_set_inuse (cep);siw_free_cm_id (cep); -if (cep->sock) { -siw_socket_disassoc (cep->sock); -sock_release (cep->sock); - cep->sock =NULL ; +if (s) { +siw_socket_disassoc (s); +sock_release (s); } cep->state =SIW_EPSTATE_CLOSED ;siw_cep_set_free_and_put (cep);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1261/1887 netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 7d6a9cdb8d3a51d9cfe546a09a518ab3d2671549 ]
Add a refcount for struct nf_ct_timeout which is used by ct extension to set the custom ct timeout policy, this tells us that the ct timeout is being used by a conntrack entry. When the last conntrack entry drops the refcount on the ct timeout, the ct timeout is released.
Remove the refcount for control plane which controls if the ruleset refers to the timeout policy. After this update, it is possible to remove the ct timeout policy from nfnetlink_cttimeout immediately. This is for simplicity not to handle two refcounts on a single object.
Remove nf_queue_nf_hook_drop(): a packet sitting in nfqueue will just hold a reference to the nf_ct_timeout object until packet is reinjected, since this is part of the ct extension, this will be released by the time the conntrack is freed.
nf_ct_untimeout() is still called to clean up in a best effort basis:
the ct timeout on existing entries gets removed when the ct timeout goes away, but as long as the iptables ruleset still refers to the ct timeout through a template, new conntracks may keep attaching it and extend its lifetime until the rule is removed.
nf_ct_untimeout() is not called anymore from module removal path, this is unlikely to find timeouts give module refcount is bumped, and the new refcount already tracks the ct timeout policy use so it is released when unused.
--- include/net/netfilter/nf_conntrack_timeout.h | 27 ++++- net/netfilter/nf_conntrack_core.c | 6 +- net/netfilter/nf_conntrack_timeout.c | 27 ++++- net/netfilter/nfnetlink_cttimeout.c | 112 +++++++++---------- net/netfilter/nft_ct.c | 7 +- net/netfilter/xt_CT.c | 2 +- 6 files changed, 107 insertions(+), 74 deletions(-)
include/net/netfilter/nf_conntrack_timeout.h +25 -2
@@ -12,6 +12,7 @@#define CTNL_TIMEOUT_NAME_MAX 32struct nf_ct_timeout { +refcount_t refcnt;__u16 l3num;const struct nf_conntrack_l4proto *l4proto;struct rcu_head rcu;
@@ -22,6 +23,22 @@ struct nf_conn_timeout {struct nf_ct_timeout __rcu *timeout; }; +static inline void nf_ct_timeout_put (const struct nf_conn *ct) +{ +#ifdef CONFIG_NF_CONNTRACK_TIMEOUT +struct nf_conn_timeout *timeout_ext; +struct nf_ct_timeout *timeout; + + timeout_ext =nf_ct_ext_find (ct,NF_CT_EXT_TIMEOUT ); +if (!timeout_ext) +return ; + + timeout =rcu_dereference (timeout_ext->timeout); +if (timeout &&refcount_dec_and_test (&timeout->refcnt)) +kfree_rcu (timeout, rcu); +#endif +} +static inline unsigned int *nf_ct_timeout_data (const struct nf_conn_timeout *t) {
@@ -56,8 +73,14 @@ struct nf_conn_timeout *nf_ct_timeout_ext_add(struct nf_conn *ct,#ifdef CONFIG_NF_CONNTRACK_TIMEOUT struct nf_conn_timeout *timeout_ext; +if (!timeout) +return NULL ; + timeout_ext =nf_ct_ext_add (ct,NF_CT_EXT_TIMEOUT , gfp); -if (timeout_ext ==NULL ) +if (!timeout_ext || timeout_ext->timeout) +return NULL ; + +if (!refcount_inc_not_zero (&timeout->refcnt))return NULL ;rcu_assign_pointer (timeout_ext->timeout, timeout);
@@ -75,7 +98,7 @@ static inline unsigned int *nf_ct_timeout_lookup(const struct nf_conn *ct)struct nf_conn_timeout *timeout_ext; timeout_ext =nf_ct_timeout_find (ct); -if (timeout_ext) +if (timeout_ext &&rcu_access_pointer (timeout_ext->timeout)) timeouts =nf_ct_timeout_data (timeout_ext);#endif return timeouts;
net/netfilter/nf_conntrack_core.c +4 -2
@@ -1717,16 +1717,18 @@ void nf_conntrack_free(struct nf_conn *ct)*/ WARN_ON (refcount_read (&ct->ct_general.use) !=0 ); +rcu_read_lock ();if (ct->status &IPS_SRC_NAT_DONE ) {const struct nf_nat_hook *nat_hook; -rcu_read_lock (); nat_hook =rcu_dereference (nf_nat_hook);if (nat_hook) nat_hook->remove_nat_bysrc (ct); -rcu_read_unlock (); } +nf_ct_timeout_put (ct); +rcu_read_unlock (); +kfree (ct->ext);kmem_cache_free (nf_conntrack_cachep, ct); cnet =nf_ct_pernet (net);
net/netfilter/nf_conntrack_timeout.c +24 -3
@@ -25,17 +25,32 @@const struct nf_ct_timeout_hooks __rcu *nf_ct_timeout_hook__read_mostly ;EXPORT_SYMBOL_GPL (nf_ct_timeout_hook); +/* nf_ct_iterate_cleanup() holds the conntrack lock. */ static int untimeout (struct nf_conn *ct,void *timeout) {struct nf_conn_timeout *timeout_ext =nf_ct_timeout_find (ct);if (timeout_ext) { -const struct nf_ct_timeout *t; +struct nf_ct_timeout *t; - t =rcu_access_pointer (timeout_ext->timeout); +rcu_read_lock (); + t =rcu_dereference (timeout_ext->timeout); +if (!t) { +rcu_read_unlock (); +return 0 ; + } -if (!timeout || t == timeout) +if (!timeout || t == timeout) {RCU_INIT_POINTER (timeout_ext->timeout,NULL ); + +/* No race with nf_conntrack_free() which is called +* only after the conntrack has been removed from +* the hashes. +*/ +if (refcount_dec_and_test (&t->refcnt)) +kfree_rcu (t, rcu); + } +rcu_read_unlock (); }/* We are not intended to delete this conntrack. */
@@ -70,6 +85,8 @@ int nf_ct_set_timeout(struct net *net, struct nf_conn *ct,const char *errmsg =NULL ;int ret =0 ; +WARN_ON_ONCE (!nf_ct_is_template (ct)); +rcu_read_lock (); h =rcu_dereference (nf_ct_timeout_hook);if (!h) {
@@ -127,6 +144,8 @@ void nf_ct_destroy_timeout(struct nf_conn *ct)struct nf_conn_timeout *timeout_ext;const struct nf_ct_timeout_hooks *h; +WARN_ON_ONCE (!nf_ct_is_template (ct)); +rcu_read_lock (); h =rcu_dereference (nf_ct_timeout_hook);
@@ -139,6 +158,8 @@ void nf_ct_destroy_timeout(struct nf_conn *ct)if (t) h->timeout_put (t);RCU_INIT_POINTER (timeout_ext->timeout,NULL ); +if (t &&refcount_dec_and_test (&t->refcnt)) +kfree_rcu (t, rcu); } }rcu_read_unlock ();
net/netfilter/nfnetlink_cttimeout.c +50 -62
219 lines not on this page · raw message
net/netfilter/nft_ct.c +3 -4
@@ -910,8 +910,6 @@ static void nft_ct_timeout_obj_eval(struct nft_object *obj, } } -rcu_assign_pointer (timeout->timeout, priv->timeout); -/* adjust the timeout as per 'new' state. ct is unconfirmed, * so the current timestamp must not be added. */
@@ -962,6 +960,7 @@ static int nft_ct_timeout_obj_init(const struct nft_ctx *ctx, timeout->l3num = l3num; timeout->l4proto = l4proto; +refcount_set (&timeout->refcnt,1 ); ret =nf_ct_netns_get (ctx->net, ctx->family);if (ret <0 )
@@ -982,10 +981,10 @@ static void nft_ct_timeout_obj_destroy(const struct nft_ctx *ctx,struct nft_ct_timeout_obj *priv =nft_obj_data (obj);struct nf_ct_timeout *timeout = priv->timeout; -nf_queue_nf_hook_drop (ctx->net);nf_ct_untimeout (ctx->net, timeout);nf_ct_netns_put (ctx->net, ctx->family); -kfree_rcu (priv->timeout, rcu); +if (refcount_dec_and_test (&timeout->refcnt)) +kfree_rcu (priv->timeout, rcu); } static int nft_ct_timeout_obj_dump(struct sk_buff *skb,
net/netfilter/xt_CT.c +1 -1
@@ -284,7 +284,7 @@ static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par,struct nf_conn_help *help;if (ct) { -if (info->helper[0 ] || info->timeout[0 ]) +if (info->helper[0 ])nf_queue_nf_hook_drop (par->net); help =nfct_help (ct);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1262/1887 ocfs2: validate fast symlink target during inode read
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Cen <[email protected]>
[ Upstream commit e234973f286ed2e8961a24561ec91594ec3e3ff8 ]
ocfs2_validate_inode_block() already rejects several inconsistent self-contained dinodes before they are exposed to the rest of the filesystem. Fast symlinks need the same treatment.
A zero-cluster symlink is treated as a fast symlink and later read through page_get_link() and ocfs2_fast_symlink_read_folio(). That path uses strnlen() on the inline payload and then copies len + 1 bytes into the folio. If a corrupt dinode stores an i_size that does not fit the inline area or omits the terminating NUL at i_size, that copy reads past the end of the inode block buffer.
Reject zero-cluster symlink dinodes whose i_size exceeds the inline fast-symlink capacity or whose inline payload is not NUL-terminated exactly at i_size when the inode block is validated. This keeps malformed fast symlinks from reaching the read path.
Validation reproduced this kernel report:
KASAN use-after-free in ocfs2_fast_symlink_read_folio+0x12c/0x1f0
RIP: 0033:0x7f5c6d859aa7 Read of size 3905 Call trace: dump_stack_lvl+0x66/0xa0 (?:?) print_report+0xce/0x630 (?:?) ocfs2_fast_symlink_read_folio+0x12c/0x1f0 (fs/ocfs2/inode.c:?) srso_alias_return_thunk+0x5/0xfbef5 (?:?) __virt_addr_valid+0x19f/0x330 (?:?) kasan_report+0xe0/0x110 (?:?) kasan_check_range+0x105/0x1b0 (?:?) __asan_memcpy+0x23/0x60 (?:?) filemap_read_folio+0x27/0xe0 (?:?) filemap_read_folio+0x35/0xe0 (?:?) do_read_cache_folio+0x138/0x230 (?:?) __page_get_link+0x26/0x110 (?:?) page_get_link+0x2e/0x70 (?:?) vfs_readlink+0x15e/0x250 (?:?) touch_atime+0x4d/0x370 (?:?) do_readlinkat+0x186/0x200 (?:?) do_user_addr_fault+0x65a/0x890 (?:?) __x64_sys_readlink+0x46/0x60 (?:?) do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87) entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?)
--- fs/ocfs2/inode.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+)
fs/ocfs2/inode.c +23 -0
@@ -1585,6 +1585,29 @@ int ocfs2_validate_inode_block(struct super_block *sb, goto bail; } +if (S_ISLNK (le16_to_cpu (di->i_mode)) && + !le32_to_cpu (di->i_clusters)) { +int max_inline =ocfs2_fast_symlink_chars (sb); +u64 i_size =le64_to_cpu (di->i_size); + +if (i_size >= max_inline) { + rc =ocfs2_error (sb, +"Invalid dinode #%llu: fast symlink i_size %llu exceeds max %d\n" , + (unsigned long long )bh->b_blocknr, + (unsigned long long )i_size, + max_inline -1 ); + goto bail; + } + +if (strnlen ((char *)di->id2.i_symlink, i_size +1 ) != i_size) { + rc =ocfs2_error (sb, +"Invalid dinode #%llu: fast symlink is not NUL-terminated at i_size %llu\n" , + (unsigned long long )bh->b_blocknr, + (unsigned long long )i_size); + goto bail; + } + } +if (le32_to_cpu (di->i_flags) &OCFS2_CHAIN_FL ) {struct ocfs2_chain_list *cl = &di->id2.i_chain;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1263/1887 vhost: correct misleading printing information
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xianting Tian <[email protected]>
[ Upstream commit 76f408535aab39c33e0a1dcada9fba5631c65595 ]
Guest moved avail idx not used idx when we need to print log if '(vq->avail_idx - last_avail_idx) > vq->num', so fix it.
Message-Id: <[email protected]>
Stable-dep-of: 09861858a683 ("vhost: fix vhost_get_avail_idx for a non empty ring")
--- drivers/vhost/vhost.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/vhost/vhost.c +1 -1
@@ -2247,7 +2247,7 @@ int vhost_get_vq_desc(struct vhost_virtqueue *vq, vq->avail_idx =vhost16_to_cpu (vq, avail_idx);if (unlikely ((u16)(vq->avail_idx - last_avail_idx) > vq->num)) { -vq_err (vq,"Guest moved used index from %u to %u" , +vq_err (vq,"Guest moved avail index from %u to %u" , last_avail_idx, vq->avail_idx);return -EFAULT ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1264/1887 vhost: move smp_rmb() into vhost_get_avail_idx()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael S. Tsirkin <[email protected]>
[ Upstream commit 7ad4723976672b7d359403a555e0ce5c75529153 ]
All callers of vhost_get_avail_idx() use smp_rmb() to order the available ring entry read and avail_idx read.
Make vhost_get_avail_idx() call smp_rmb() itself whenever the avail_idx is accessed. This way, the callers don't need to worry about the memory barrier. As a side benefit, we also validate the index on all paths now, which will hopefully help prevent/catch earlier future bugs.
Note that current code is inconsistent in how the errors are handled. They are treated as an empty ring in some places, but as non-empty ring in other places. This patch doesn't attempt to change the existing behaviour.
No functional change intended.
Message-Id: <[email protected]>
Stable-dep-of: 09861858a683 ("vhost: fix vhost_get_avail_idx for a non empty ring")
--- drivers/vhost/vhost.c | 105 +++++++++++++++++------------------------- 1 file changed, 42 insertions(+), 63 deletions(-)
drivers/vhost/vhost.c +42 -63
@@ -1008,10 +1008,36 @@ static void vhost_dev_unlock_vqs(struct vhost_dev *d)mutex_unlock (&d->vqs[i]->mutex); } -static inline int vhost_get_avail_idx (struct vhost_virtqueue *vq, -__virtio16 *idx) +static inline int vhost_get_avail_idx (struct vhost_virtqueue *vq) { -return vhost_get_avail (vq, *idx, &vq->avail->idx); +__virtio16 idx; +int r; + + r =vhost_get_avail (vq, idx, &vq->avail->idx); +if (unlikely (r <0 )) { +vq_err (vq,"Failed to access available index at %p (%d)\n" , + &vq->avail->idx, r); +return r; + } + +/* Check it isn't doing very strange thing with available indexes */ + vq->avail_idx =vhost16_to_cpu (vq, idx); +if (unlikely ((u16)(vq->avail_idx - vq->last_avail_idx) > vq->num)) { +vq_err (vq,"Invalid available index change from %u to %u" , + vq->last_avail_idx, vq->avail_idx); +return -EINVAL ; + } + +/* We're done if there is nothing new */ +if (vq->avail_idx == vq->last_avail_idx) +return 0 ; + +/* +* We updated vq->avail_idx so we need a memory barrier between +* the index read above and the caller reading avail ring entries. +*/ +smp_rmb (); +return 1 ; } static inline int vhost_get_avail_head(struct vhost_virtqueue *vq,
@@ -2230,38 +2256,17 @@ int vhost_get_vq_desc(struct vhost_virtqueue *vq, {struct vring_desc desc;unsigned int i, head, found =0 ; -u16 last_avail_idx; -__virtio16 avail_idx; +u16 last_avail_idx = vq->last_avail_idx;__virtio16 ring_head;int ret, access; -/* Check it isn't doing very strange things with descriptor numbers. */ - last_avail_idx = vq->last_avail_idx; -if (vq->avail_idx == vq->last_avail_idx) { -if (unlikely (vhost_get_avail_idx (vq, &avail_idx))) { -vq_err (vq,"Failed to access avail idx at %p\n" , - &vq->avail->idx); -return -EFAULT ; - } - vq->avail_idx =vhost16_to_cpu (vq, avail_idx); - -if (unlikely ((u16)(vq->avail_idx - last_avail_idx) > vq->num)) { -vq_err (vq,"Guest moved avail index from %u to %u" , - last_avail_idx, vq->avail_idx); -return -EFAULT ; - } + ret =vhost_get_avail_idx (vq); +if (unlikely (ret <0 )) +return ret; -/* If there's nothing new since last we looked, return -* invalid. -*/ -if (vq->avail_idx == last_avail_idx) +if (!ret)return vq->num; - -/* Only get avail ring entries after they have been -* exposed by guest. -*/ -smp_rmb (); }/* Grab the next descriptor number they're advertising, and increment
@@ -2525,35 +2530,21 @@ EXPORT_SYMBOL_GPL(vhost_add_used_and_signal_n);/* return true if we're sure that avaiable ring is empty */ bool vhost_vq_avail_empty (struct vhost_dev *dev,struct vhost_virtqueue *vq) { -__virtio16 avail_idx;int r;if (vq->avail_idx != vq->last_avail_idx)return false; - r =vhost_get_avail_idx (vq, &avail_idx); -if (unlikely (r)) -return false; - - vq->avail_idx =vhost16_to_cpu (vq, avail_idx); -if (vq->avail_idx != vq->last_avail_idx) { -/* Since we have updated avail_idx, the following -* call to vhost_get_vq_desc() will read available -* ring entries. Make sure that read happens after -* the avail_idx read. -*/ -smp_rmb (); -return false; - } + r =vhost_get_avail_idx (vq); -return true; +/* Note: we treat error as non-empty here */ +return r ==0 ; }EXPORT_SYMBOL_GPL (vhost_vq_avail_empty);/* OK, now we need to know about added descriptors. */ bool vhost_enable_notify (struct vhost_dev *dev,struct vhost_virtqueue *vq) { -__virtio16 avail_idx;int r;if (!(vq->used_flags &VRING_USED_F_NO_NOTIFY ))
@@ -2577,25 +2568,13 @@ bool vhost_enable_notify(struct vhost_dev *dev, struct vhost_virtqueue *vq)/* They could have slipped one in as we were doing that: make * sure it's written, then check again. */ smp_mb (); - r =vhost_get_avail_idx (vq, &avail_idx); -if (r) { -vq_err (vq,"Failed to check avail idx at %p: %d\n" , - &vq->avail->idx, r); -return false; - } - vq->avail_idx =vhost16_to_cpu (vq, avail_idx); -if (vq->avail_idx != vq->last_avail_idx) { -/* Since we have updated avail_idx, the following -* call to vhost_get_vq_desc() will read available -* ring entries. Make sure that read happens after -* the avail_idx read. -*/ -smp_rmb (); -return true; - } + r =vhost_get_avail_idx (vq); +/* Note: we treat error as empty here */ +if (unlikely (r <0 )) +return false; -return false; +return r; }EXPORT_SYMBOL_GPL (vhost_enable_notify);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1265/1887 vhost: fix vhost_get_avail_idx for a non empty ring
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael S. Tsirkin <[email protected]>
[ Upstream commit 09861858a68342f851f71c669ac0f69865c32151 ]
vhost_get_avail_idx is supposed to report whether it has updated vq->avail_idx. Instead, it returns whether all entries have been consumed, which is usually the same. But not always - in drivers/vhost/net.c and when mergeable buffers have been enabled, the driver checks whether the combined entries are big enough to store an incoming packet. If not, the driver re-enables notifications with available entries still in the ring. The incorrect return value from vhost_get_avail_idx propagates through vhost_enable_notify and causes the host to livelock if the guest is not making progress, as vhost will immediately disable notifications and retry using the available entries.
This goes back to commit d3bb267bbdcb ("vhost: cache avail index in vhost_enable_notify()") which changed vhost_enable_notify() to compare the freshly read avail index against vq->last_avail_idx instead of the previously cached vq->avail_idx. Commit 7ad472397667 ("vhost: move smp_rmb() into vhost_get_avail_idx()") then carried over the same comparison when refactoring vhost_enable_notify() to call the unified vhost_get_avail_idx().
The obvious fix is to make vhost_get_avail_idx do what the comment says it does and report whether new entries have been added.
Message-Id: <559b04ae6ce52973c535dc47e461638b7f4c3d63.1772441455.git.mst@redhat.com>
--- drivers/vhost/vhost.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/vhost/vhost.c +7 -4
@@ -1011,6 +1011,7 @@ static void vhost_dev_unlock_vqs(struct vhost_dev *d)static inline int vhost_get_avail_idx (struct vhost_virtqueue *vq) {__virtio16 idx; +u16 avail_idx;int r; r =vhost_get_avail (vq, idx, &vq->avail->idx);
@@ -1021,17 +1022,19 @@ static inline int vhost_get_avail_idx(struct vhost_virtqueue *vq) }/* Check it isn't doing very strange thing with available indexes */ - vq->avail_idx =vhost16_to_cpu (vq, idx); -if (unlikely ((u16)(vq->avail_idx - vq->last_avail_idx) > vq->num)) { + avail_idx =vhost16_to_cpu (vq, idx); +if (unlikely ((u16)(avail_idx - vq->last_avail_idx) > vq->num)) {vq_err (vq,"Invalid available index change from %u to %u" , - vq->last_avail_idx, vq->avail_idx); + vq->last_avail_idx, avail_idx);return -EINVAL ; }/* We're done if there is nothing new */ -if (vq->avail_idx == vq->last_avail_idx) +if (avail_idx == vq->avail_idx)return 0 ; + vq->avail_idx = avail_idx; +/* * We updated vq->avail_idx so we need a memory barrier between * the index read above and the caller reading avail ring entries.
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1266/1887 nvmet-tcp: fix page fragment cache leak in error path
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geliang Tang <[email protected]>
[ Upstream commit 4dae393956093c807212918fd91a8fc70df15338 ]
In nvmet_tcp_alloc_queue(), when a connection is closed during the allocation process (e.g., nvmet_tcp_set_queue_sock() returns -ENOTCONN), the error handling jumps to out_destroy_sq and then to out_ida_remove without draining the page fragment cache.
Although nvmet_tcp_free_cmd() is called in some error paths to release individual page fragments, the underlying page cache reference held by queue->pf_cache is never released. The first allocation using pf_cache is the call to nvmet_tcp_alloc_cmd() for queue->connect, which happens after ida_alloc() returns successfully. This results in a page leak each time a connection fails during allocation, which could lead to memory exhaustion over time if connections are repeatedly opened and closed.
Fix this by calling page_frag_cache_drain() before freeing the queue structure in the out_ida_remove label.
--- drivers/nvme/target/tcp.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/nvme/target/tcp.c +8 -0
@@ -1744,6 +1744,14 @@ static int nvmet_tcp_alloc_queue(struct nvmet_tcp_port *port,nvmet_tcp_free_cmd (&queue->connect); out_ida_remove:ida_free (&nvmet_tcp_queue_ida, queue->idx); +/* +* Drain the page fragment cache if any allocations were done. +* The first allocation using pf_cache is nvmet_tcp_alloc_cmd() +* for queue->connect after ida_alloc(). +*/ +if (queue->pf_cache.va) +__page_frag_cache_drain (virt_to_head_page (queue->pf_cache.va), + queue->pf_cache.pagecnt_bias); out_free_queue:kfree (queue);return ret;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1267/1887 ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 7c349b4f2a603202fb8c363bd2774a22ac2fddf3 ]
The OSS sequencer processes the input MIDI bytes into a sequencer event to be dispatched later (in snd_seq_oss_midi_putc() called from snd_seq_oss_process_event()). When it's a SysEx data, the event record contains data.ext.ptr pointer to the original SysEx bytes, and the referred data is copied into the pool afterwards at dispatching. The problem is that, if the sequencer port gets closed concurrently before the dispatch, the OSS sequencer core also releases the resources (in snd_seq_oss_midi_check_exit_port()), while the pending event may hold a stale pointer, eventually leading to a UAF at a later dispatch.
Fortunately, there is already a refcounting mechanism (snd_use_lock_t) for the OSS MIDI device access, and for addressing the issue above, we just need to extend the refcount until the event gets dispatched.
This patch extends snd_seq_oss_process_event() to give back the refcount object, which is in turn released after calling the sequencer dispatcher with the given event in the caller side.
According to the original report, KASAN report as below:
KASAN slab-use-after-free in snd_seq_event_dup+0x40c/0x470
RIP: 0033:0x7f2cb66a6340 Read of size 6 Call trace: dump_stack_lvl+0x73/0xb0 (?:?) print_report+0xd1/0x650 (?:?) srso_alias_return_thunk+0x5/0xfbef5 (?:?) __virt_addr_valid+0x1a7/0x340 (?:?) kasan_complete_mode_report_info+0x64/0x200 (?:?) kasan_report+0xf7/0x130 (?:?) snd_seq_event_dup+0x40c/0x470 (?:?) kasan_check_range+0x10c/0x1c0 (?:?) __asan_memcpy+0x27/0x70 (?:?) snd_seq_event_dup+0x9/0x470 (?:?) snd_seq_client_enqueue_event+0x139/0x240 (?:?) _raw_spin_unlock_irqrestore+0x4b/0x60 (?:?) snd_seq_kernel_client_enqueue+0x102/0x120 (?:?) snd_seq_oss_write+0x416/0x4e0 (?:?) apparmor_file_permission+0x20/0x30 (?:?) odev_write+0x3b/0x60 (?:?) vfs_write+0x1ce/0x850 (?:?) lock_release+0xc8/0x2a0 (?:?) __kasan_check_write+0x18/0x20 (?:?) __mutex_unlock_slowpath+0x129/0x510 (?:?) ksys_write+0xe1/0x180 (?:?) mutex_unlock+0x16/0x20 (?:?) odev_ioctl+0x65/0xc0 (?:?) __x64_sys_write+0x46/0x60 (?:?) x64_sys_call+0x7d/0x20d0 (?:?) do_syscall_64+0xc1/0x360 (arch/x86/entry/syscall_64.c:87) entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?)
--- sound/core/seq/oss/seq_oss_event.c | 6 ++++-- sound/core/seq/oss/seq_oss_event.h | 3 ++- sound/core/seq/oss/seq_oss_ioctl.c | 5 ++++- sound/core/seq/oss/seq_oss_midi.c | 6 ++++-- sound/core/seq/oss/seq_oss_midi.h | 2 +- sound/core/seq/oss/seq_oss_rw.c | 5 ++++- 6 files changed, 19 insertions(+), 8 deletions(-)
sound/core/seq/oss/seq_oss_event.c +4 -2
@@ -39,8 +39,10 @@ static int set_echo_event(struct seq_oss_devinfo *dp, union evrec *rec, struct s*/ int -snd_seq_oss_process_event (struct seq_oss_devinfo *dp,union evrec *q,struct snd_seq_event *ev) +snd_seq_oss_process_event (struct seq_oss_devinfo *dp,union evrec *q, +struct snd_seq_event *ev,snd_use_lock_t **lockp) { + *lockp =NULL ;switch (q->s.code) {case SEQ_EXTENDED :return extended_event (dp, q, ev);
@@ -69,7 +71,7 @@ snd_seq_oss_process_event(struct seq_oss_devinfo *dp, union evrec *q, struct sndif (snd_seq_oss_midi_open (dp, q->s.dev,SNDRV_SEQ_OSS_FILE_WRITE ))break ;if (snd_seq_oss_midi_filemode (dp, q->s.dev) &SNDRV_SEQ_OSS_FILE_WRITE ) -return snd_seq_oss_midi_putc (dp, q->s.dev, q->s.parm1, ev); +return snd_seq_oss_midi_putc (dp, q->s.dev, q->s.parm1, ev, lockp);break ;case SEQ_ECHO :
sound/core/seq/oss/seq_oss_event.h +2 -1
@@ -91,7 +91,8 @@ union evrec {#define ev_is_long (ev) ((ev)->s.code >= 128)#define ev_length (ev) ((ev)->s.code >= 128 ? LONG_EVENT_SIZE : SHORT_EVENT_SIZE) -int snd_seq_oss_process_event (struct seq_oss_devinfo *dp,union evrec *q,struct snd_seq_event *ev); +int snd_seq_oss_process_event (struct seq_oss_devinfo *dp,union evrec *q, +struct snd_seq_event *ev,snd_use_lock_t **lockp);int snd_seq_oss_process_timer_event (struct seq_oss_timer *rec,union evrec *q);int snd_seq_oss_event_input (struct snd_seq_event *ev,int direct,void *private_data,int atomic,int hop);
sound/core/seq/oss/seq_oss_ioctl.c +4 -1
@@ -45,14 +45,17 @@ static int snd_seq_oss_oob_user(struct seq_oss_devinfo *dp, void __user *arg) {unsigned char ev[8 ];struct snd_seq_event tmpev; +snd_use_lock_t *lock =NULL ;if (copy_from_user (ev, arg,8 ))return -EFAULT ;memset (&tmpev,0 ,sizeof (tmpev));snd_seq_oss_fill_addr (dp, &tmpev, dp->addr.client, dp->addr.port); tmpev.time.tick =0 ; -if (!snd_seq_oss_process_event (dp, (union evrec *)ev, &tmpev)) { +if (!snd_seq_oss_process_event (dp, (union evrec *)ev, &tmpev, &lock)) {snd_seq_oss_dispatch (dp, &tmpev,0 ,0 ); +if (lock) +snd_use_lock_free (lock); }return 0 ; }
sound/core/seq/oss/seq_oss_midi.c +4 -2
@@ -639,7 +639,8 @@ send_midi_event(struct seq_oss_devinfo *dp, struct snd_seq_event *ev, struct seq* non-zero : invalid - ignored */ int -snd_seq_oss_midi_putc (struct seq_oss_devinfo *dp,int dev,unsigned char c,struct snd_seq_event *ev) +snd_seq_oss_midi_putc (struct seq_oss_devinfo *dp,int dev,unsigned char c, +struct snd_seq_event *ev,snd_use_lock_t **lockp) {struct seq_oss_midi *mdev;
@@ -648,7 +649,8 @@ snd_seq_oss_midi_putc(struct seq_oss_devinfo *dp, int dev, unsigned char c, strureturn -ENODEV ;if (snd_midi_event_encode_byte (mdev->coder, c, ev)) {snd_seq_oss_fill_addr (dp, ev, mdev->client, mdev->port); -snd_use_lock_free (&mdev->use_lock); +/* the caller must release this later */ + *lockp = &mdev->use_lock;return 0 ; }snd_use_lock_free (&mdev->use_lock);
sound/core/seq/oss/seq_oss_midi.h +1 -1
@@ -26,7 +26,7 @@ void snd_seq_oss_midi_open_all(struct seq_oss_devinfo *dp, int file_mode);int snd_seq_oss_midi_close (struct seq_oss_devinfo *dp,int dev);void snd_seq_oss_midi_reset (struct seq_oss_devinfo *dp,int dev);int snd_seq_oss_midi_putc (struct seq_oss_devinfo *dp,int dev,unsigned char c, -struct snd_seq_event *ev); +struct snd_seq_event *ev,snd_use_lock_t **lockp);int snd_seq_oss_midi_input (struct snd_seq_event *ev,int direct,void *private);int snd_seq_oss_midi_filemode (struct seq_oss_devinfo *dp,int dev);int snd_seq_oss_midi_make_info (struct seq_oss_devinfo *dp,int dev,struct midi_info *inf);
sound/core/seq/oss/seq_oss_rw.c +4 -1
@@ -154,6 +154,7 @@ insert_queue(struct seq_oss_devinfo *dp, union evrec *rec, struct file *opt) {int rc =0 ;struct snd_seq_event event; +snd_use_lock_t *lock =NULL ;/* if this is a timing event, process the current time */ if (snd_seq_oss_process_timer_event (dp->timer, rec))
@@ -165,7 +166,7 @@ insert_queue(struct seq_oss_devinfo *dp, union evrec *rec, struct file *opt) event.type =SNDRV_SEQ_EVENT_NOTEOFF ;snd_seq_oss_fill_addr (dp, &event, dp->addr.client, dp->addr.port); -if (snd_seq_oss_process_event (dp, rec, &event)) +if (snd_seq_oss_process_event (dp, rec, &event, &lock))return 0 ;/* invalid event - no need to insert queue */ event.time.tick =snd_seq_oss_timer_cur_tick (dp->timer);
@@ -174,6 +175,8 @@ insert_queue(struct seq_oss_devinfo *dp, union evrec *rec, struct file *opt)else rc =snd_seq_kernel_client_enqueue (dp->cseq, &event, opt, !is_nonblock_mode (dp->file_mode)); +if (lock) +snd_use_lock_free (lock);return rc; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1268/1887 RDMA/hns: Fix log flood after cmd_mbox failure
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lianfa Weng <[email protected]>
[ Upstream commit bbd97d71e53e551890e4115ad9de46b5f2ac0858 ]
hns_roce_cmd_mbox() is the command interface between driver and hardware. When hardware is abnormal, the unlimited error printings after hns_roce_cmd_mbox() failure will cause log flood and even system crash.
Replace ibdev_err() and ibdev_warn() with their ratelimited versions in the error handling path after hns_roce_cmd_mbox() (and its wrappers hns_roce_create_hw_ctx/hns_roce_destroy_hw_ctx) fails.
--- drivers/infiniband/hw/hns/hns_roce_cq.c | 6 +++--- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 18 +++++++++--------- drivers/infiniband/hw/hns/hns_roce_mr.c | 6 +++--- drivers/infiniband/hw/hns/hns_roce_srq.c | 2 +- 4 files changed, 16 insertions(+), 16 deletions(-)
drivers/infiniband/hw/hns/hns_roce_cq.c +3 -3
@@ -119,9 +119,9 @@ static int hns_roce_create_cqc(struct hns_roce_dev *hr_dev, ret =hns_roce_create_hw_ctx (hr_dev, mailbox,HNS_ROCE_CMD_CREATE_CQC , hr_cq->cqn);if (ret) -ibdev_err (ibdev, -"failed to send create cmd for CQ(0x%lx), ret = %d.\n" , - hr_cq->cqn, ret); +ibdev_err_ratelimited (ibdev, +"failed to send create cmd for CQ(0x%lx), ret = %d.\n" , + hr_cq->cqn, ret);hns_roce_free_cmd_mailbox (hr_dev, mailbox);
drivers/infiniband/hw/hns/hns_roce_hw_v2.c +9 -9
@@ -5852,9 +5852,9 @@ static int hns_roce_v2_modify_srq(struct ib_srq *ibsrq, HNS_ROCE_CMD_MODIFY_SRQC, srq->srqn);hns_roce_free_cmd_mailbox (hr_dev, mailbox);if (ret) { -ibdev_err (&hr_dev->ib_dev, -"failed to handle cmd of modifying SRQ, ret = %d.\n" , - ret); +ibdev_err_ratelimited (&hr_dev->ib_dev, +"failed to handle cmd of modifying SRQ, ret = %d.\n" , + ret);return ret; } }
@@ -5878,9 +5878,9 @@ static int hns_roce_v2_query_srq(struct ib_srq *ibsrq, struct ib_srq_attr *attr) ret =hns_roce_cmd_mbox (hr_dev,0 , mailbox->dma,HNS_ROCE_CMD_QUERY_SRQC , srq->srqn);if (ret) { -ibdev_err (&hr_dev->ib_dev, -"failed to process cmd of querying SRQ, ret = %d.\n" , - ret); +ibdev_err_ratelimited (&hr_dev->ib_dev, +"failed to process cmd of querying SRQ, ret = %d.\n" , + ret); goto out; }
@@ -5981,9 +5981,9 @@ static int hns_roce_v2_query_mpt(struct hns_roce_dev *hr_dev, u32 key, ret =hns_roce_cmd_mbox (hr_dev,0 , mailbox->dma,HNS_ROCE_CMD_QUERY_MPT ,key_to_hw_index (key));if (ret) { -ibdev_err (&hr_dev->ib_dev, -"failed to process cmd when querying MPT, ret = %d.\n" , - ret); +ibdev_err_ratelimited (&hr_dev->ib_dev, +"failed to process cmd when querying MPT, ret = %d.\n" , + ret); goto err_mailbox; }
drivers/infiniband/hw/hns/hns_roce_mr.c +3 -3
@@ -163,7 +163,7 @@ static int hns_roce_mr_enable(struct hns_roce_dev *hr_dev, ret =hns_roce_create_hw_ctx (hr_dev, mailbox,HNS_ROCE_CMD_CREATE_MPT , mtpt_idx & (hr_dev->caps.num_mtpts -1 ));if (ret) { -dev_err (dev,"failed to create mpt, ret = %d.\n" , ret); +dev_err_ratelimited (dev,"failed to create mpt, ret = %d.\n" , ret); goto err_page; }
@@ -291,7 +291,7 @@ struct ib_mr *hns_roce_rereg_user_mr(struct ib_mr *ibmr, int flags, u64 start, ret =hns_roce_destroy_hw_ctx (hr_dev,HNS_ROCE_CMD_DESTROY_MPT , mtpt_idx);if (ret) -ibdev_warn (ib_dev,"failed to destroy MPT, ret = %d.\n" , ret); +ibdev_warn_ratelimited (ib_dev,"failed to destroy MPT, ret = %d.\n" , ret); mr->enabled =0 ; mr->iova = virt_addr;
@@ -322,7 +322,7 @@ struct ib_mr *hns_roce_rereg_user_mr(struct ib_mr *ibmr, int flags, u64 start, ret =hns_roce_create_hw_ctx (hr_dev, mailbox,HNS_ROCE_CMD_CREATE_MPT , mtpt_idx);if (ret) { -ibdev_err (ib_dev,"failed to create MPT, ret = %d.\n" , ret); +ibdev_err_ratelimited (ib_dev,"failed to create MPT, ret = %d.\n" , ret); goto free_cmd_mbox; }
drivers/infiniband/hw/hns/hns_roce_srq.c +1 -1
@@ -103,7 +103,7 @@ static int hns_roce_create_srqc(struct hns_roce_dev *hr_dev, ret =hns_roce_create_hw_ctx (hr_dev, mailbox,HNS_ROCE_CMD_CREATE_SRQ , srq->srqn);if (ret) -ibdev_err (ibdev,"failed to config SRQC, ret = %d.\n" , ret); +ibdev_err_ratelimited (ibdev,"failed to config SRQC, ret = %d.\n" , ret); err_mbox:hns_roce_free_cmd_mailbox (hr_dev, mailbox);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1269/1887 seq_buf: Add seq_buf_do_printk() helper
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Senozhatsky <[email protected]>
[ Upstream commit 96928d9032a7c34f12a88df879665562bcebf59a ]
Sometimes we use seq_buf to format a string buffer, which we then pass to printk(). However, in certain situations the seq_buf string buffer can get too big, exceeding the PRINTKRB_RECORD_MAX bytes limit, and causing printk() to truncate the string.
Add a new seq_buf helper. This helper prints the seq_buf string buffer line by line, using \n as a delimiter, rather than passing the whole string buffer to printk() at once.
Stable-dep-of: f07883450eb1 ("tracing: Bound synthetic-field strings with seq_buf")
--- include/linux/seq_buf.h | 2 ++ lib/seq_buf.c | 32 ++++++++++++++++++++++++++++++++ 2 files changed, 34 insertions(+)
include/linux/seq_buf.h +2 -0
@@ -159,4 +159,6 @@ extern int seq_buf_bprintf(struct seq_buf *s, const char *fmt, const u32 *binary);#endif +void seq_buf_do_printk (struct seq_buf *s,const char *lvl); +#endif /* _LINUX_SEQ_BUF_H */
lib/seq_buf.c +32 -0
@@ -93,6 +93,38 @@ int seq_buf_printf(struct seq_buf *s, const char *fmt, ...) }EXPORT_SYMBOL_GPL (seq_buf_printf); +/** +* seq_buf_do_printk - printk seq_buf line by line +* @s: seq_buf descriptor +* @lvl: printk level +* +* printk()-s a multi-line sequential buffer line by line. The function +* makes sure that the buffer in @s is nul terminated and safe to read +* as a string. +*/ +void seq_buf_do_printk (struct seq_buf *s,const char *lvl) +{ +const char *start, *lf; + +if (s->size ==0 || s->len ==0 ) +return ; + +seq_buf_terminate (s); + + start = s->buffer; +while ((lf =strchr (start,'\n' ))) { +int len = lf - start +1 ; + +printk ("%s%.*s" , lvl, len, start); + start = ++lf; + } + +/* No trailing LF */ +if (start < s->buffer + s->len) +printk ("%s%s\n" , lvl, start); +} +EXPORT_SYMBOL_GPL (seq_buf_do_printk); +#ifdef CONFIG_BINARY_PRINTF /** * seq_buf_bprintf - Write the printf string from binary arguments
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1270/1887 tracing: Move readpos from seq_buf to trace_seq
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox (Oracle) <[email protected]>
[ Upstream commit d0ed46b60396cfa7e0056f55e1ce0b43c7db57b6 ]
To make seq_buf more lightweight as a string buf, move the readpos member from seq_buf to its container, trace_seq. That puts the responsibility of maintaining the readpos entirely in the tracing code. If some future users want to package up the readpos with a seq_buf, we can define a new struct then.
Stable-dep-of: f07883450eb1 ("tracing: Bound synthetic-field strings with seq_buf")
--- include/linux/seq_buf.h | 5 +---- include/linux/trace_seq.h | 2 ++ kernel/trace/trace.c | 10 +++++----- kernel/trace/trace_seq.c | 6 +++++- lib/seq_buf.c | 22 ++++++++++------------ 5 files changed, 23 insertions(+), 22 deletions(-)
include/linux/seq_buf.h +1 -4
@@ -14,19 +14,16 @@* @buffer: pointer to the buffer * @size: size of the buffer * @len: the amount of data inside the buffer -* @readpos: The next position to read in the buffer. */ struct seq_buf {char *buffer;size_t size;size_t len; -loff_t readpos; };static inline void seq_buf_clear (struct seq_buf *s) { s->len =0 ; - s->readpos =0 ; } static inline void
@@ -143,7 +140,7 @@ extern __printf(2, 0)int seq_buf_vprintf (struct seq_buf *s,const char *fmt,va_list args);extern int seq_buf_print_seq (struct seq_file *m,struct seq_buf *s);extern int seq_buf_to_user (struct seq_buf *s,char __user *ubuf, -int cnt); +size_t start,int cnt);extern int seq_buf_puts (struct seq_buf *s,const char *str);extern int seq_buf_putc (struct seq_buf *s,unsigned char c);extern int seq_buf_putmem (struct seq_buf *s,const void *mem,unsigned int len);
include/linux/trace_seq.h +2 -0
@@ -14,6 +14,7 @@struct trace_seq {char buffer[PAGE_SIZE ];struct seq_buf seq; +size_t readpos;int full; };
@@ -22,6 +23,7 @@ trace_seq_init(struct trace_seq *s) {seq_buf_init (&s->seq, s->buffer,PAGE_SIZE ); s->full =0 ; + s->readpos =0 ; }/**
kernel/trace/trace.c +5 -5
@@ -1692,15 +1692,15 @@ static ssize_t trace_seq_to_buffer(struct trace_seq *s, void *buf, size_t cnt) {int len; -if (trace_seq_used (s) <= s->seq.readpos) +if (trace_seq_used (s) <= s->readpos)return -EBUSY ; - len =trace_seq_used (s) - s->seq.readpos; + len =trace_seq_used (s) - s->readpos;if (cnt > len) cnt = len; -memcpy (buf, s->buffer + s->seq.readpos, cnt); +memcpy (buf, s->buffer + s->readpos, cnt); - s->seq.readpos += cnt; + s->readpos += cnt;return cnt; }
@@ -6936,7 +6936,7 @@ tracing_read_pipe(struct file *filp, char __user *ubuf,/* Now copy what we have to the user */ sret =trace_seq_to_user (&iter->seq, ubuf, cnt); -if (iter->seq.seq.readpos >=trace_seq_used (&iter->seq)) +if (iter->seq.readpos >=trace_seq_used (&iter->seq))trace_seq_init (&iter->seq);/*
kernel/trace/trace_seq.c +5 -1
@@ -369,8 +369,12 @@ EXPORT_SYMBOL_GPL(trace_seq_path);*/ int trace_seq_to_user (struct trace_seq *s,char __user *ubuf,int cnt) { +int ret;__trace_seq_init (s); -return seq_buf_to_user (&s->seq, ubuf, cnt); + ret =seq_buf_to_user (&s->seq, ubuf, s->readpos, cnt); +if (ret >0 ) + s->readpos += ret; +return ret; }EXPORT_SYMBOL_GPL (trace_seq_to_user);
lib/seq_buf.c +10 -12
@@ -324,23 +324,24 @@ int seq_buf_path(struct seq_buf *s, const struct path *path, const char *esc)* seq_buf_to_user - copy the sequence buffer to user space * @s: seq_buf descriptor * @ubuf: The userspace memory location to copy to +* @start: The first byte in the buffer to copy * @cnt: The amount to copy * * Copies the sequence buffer into the userspace memory pointed to -* by @ubuf. It starts from the last read position (@s->readpos) -* and writes up to @cnt characters or till it reaches the end of -* the content in the buffer (@s->len), which ever comes first. +* by @ubuf. It starts from @start and writes up to @cnt characters +* or until it reaches the end of the content in the buffer (@s->len), +* whichever comes first. * * On success, it returns a positive number of the number of bytes * it copied. * * On failure it returns -EBUSY if all of the content in the * sequence has been already read, which includes nothing in the -* sequence (@s->len == @s->readpos). +* sequence (@s->len == @start). * * Returns -EFAULT if the copy to userspace fails. */ -int seq_buf_to_user (struct seq_buf *s,char __user *ubuf,int cnt) +int seq_buf_to_user (struct seq_buf *s,char __user *ubuf,size_t start,int cnt) {int len;int ret;
@@ -350,20 +351,17 @@ int seq_buf_to_user(struct seq_buf *s, char __user *ubuf, int cnt) len =seq_buf_used (s); -if (len <= s->readpos) +if (len <= start)return -EBUSY ; - len -= s->readpos; + len -= start;if (cnt > len) cnt = len; - ret =copy_to_user (ubuf, s->buffer + s->readpos, cnt); + ret =copy_to_user (ubuf, s->buffer + start, cnt);if (ret == cnt)return -EFAULT ; - cnt -= ret; - - s->readpos += cnt; -return cnt; +return cnt - ret; }/**
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1271/1887 seq_buf: Introduce DECLARE_SEQ_BUF and seq_buf_str()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit dcc4e5728eeaeda84878ca0018758cff1abfca21 ]
Solve two ergonomic issues with struct seq_buf;
1) Too much boilerplate is required to initialize:
struct seq_buf s; char buf[32]; seq_buf_init(s, buf, sizeof(buf));
Instead, we can build this directly on the stack. Provide DECLARE_SEQ_BUF() macro to do this:
DECLARE_SEQ_BUF(s, 32);
2) %NUL termination is fragile and requires 2 steps to get a valid C String (and is a layering violation exposing the "internals" of seq_buf):
seq_buf_terminate(s); do_something(s->buffer);
Instead, we can just return s->buffer directly after terminating it in the refactored seq_buf_terminate(), now known as seq_buf_str():
do_something(seq_buf_str(s));
Stable-dep-of: f07883450eb1 ("tracing: Bound synthetic-field strings with seq_buf")
--- include/linux/seq_buf.h | 21 +++++++++++++++++---- kernel/trace/trace.c | 11 +---------- lib/seq_buf.c | 4 +--- 3 files changed, 19 insertions(+), 17 deletions(-)
include/linux/seq_buf.h +17 -4
@@ -21,9 +21,18 @@ struct seq_buf {size_t len; }; +#define DECLARE_SEQ_BUF (NAME ,SIZE ) \ + char __ ## NAME ## _buffer[SIZE] = ""; \ + struct seq_buf NAME = { \ + .buffer = &__ ## NAME ## _buffer, \ + .size = SIZE, \ + } +static inline void seq_buf_clear (struct seq_buf *s) { s->len =0 ; +if (s->size) + s->buffer[0 ] ='\0' ; } static inline void
@@ -69,8 +78,8 @@ static inline unsigned int seq_buf_used(struct seq_buf *s) }/** -* seq_buf_terminate - Make sure buffer is nul terminated -* @s: the seq_buf descriptor to terminate. +* seq_buf_str - get %NUL-terminated C string from seq_buf +* @s: the seq_buf handle * * This makes sure that the buffer in @s is nul terminated and * safe to read as a string.
@@ -81,16 +90,20 @@ static inline unsigned int seq_buf_used(struct seq_buf *s)* * After this function is called, s->buffer is safe to use * in string operations. +* +* Returns @s->buf after making sure it is terminated. */ -static inline void seq_buf_terminate (struct seq_buf *s) +static inline const char *seq_buf_str (struct seq_buf *s) {if (WARN_ON (s->size ==0 )) -return ; +return "" ;if (seq_buf_buffer_left (s)) s->buffer[s->len] =0 ;else s->buffer[s->size -1 ] =0 ; + +return s->buffer; }/**
kernel/trace/trace.c +1 -10
@@ -3745,15 +3745,6 @@ static bool trace_safe_str(struct trace_iterator *iter, const char *str,return false; } -static const char *show_buffer (struct trace_seq *s) -{ -struct seq_buf *seq = &s->seq; - -seq_buf_terminate (seq); - -return seq->buffer; -} -static DEFINE_STATIC_KEY_FALSE (trace_no_verify);static int test_can_verify_check (const char *fmt, ...)
@@ -3893,7 +3884,7 @@ void trace_check_vprintf(struct trace_iterator *iter, const char *fmt,*/ if (WARN_ONCE (!trace_safe_str (iter, str, star, len),"fmt: '%s' current_buffer: '%s'" , - fmt,show_buffer (&iter->seq))) { + fmt,seq_buf_str (&iter->seq.seq))) {int ret;/* Try to safely read the string */
lib/seq_buf.c +1 -3
@@ -109,9 +109,7 @@ void seq_buf_do_printk(struct seq_buf *s, const char *lvl)if (s->size ==0 || s->len ==0 )return ; -seq_buf_terminate (s); - - start = s->buffer; + start =seq_buf_str (s);while ((lf =strchr (start,'\n' ))) {int len = lf - start +1 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1272/1887 tracing: Bound synthetic-field strings with seq_buf
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit f07883450eb14d1cf020b55d9f3a7ec5683bcd26 ]
The synthetic field helpers build a prefixed synthetic variable name and a generated hist command in fixed MAX_FILTER_STR_VAL buffers. The current code appends those strings with raw strcat(), so long key lists, field names, or saved filters can run past the end of the staging buffers.
Build both strings with seq_buf and propagate -E2BIG if either the synthetic variable name or the generated command exceeds MAX_FILTER_STR_VAL. This keeps the existing tracing-side limit while using the helper intended for bounded command construction.
--- kernel/trace/trace_events_hist.c | 41 ++++++++++++++++++++++---------- 1 file changed, 29 insertions(+), 12 deletions(-)
kernel/trace/trace_events_hist.c +29 -12
@@ -8,6 +8,7 @@#include <linux/module.h> #include <linux/kallsyms.h> #include <linux/security.h> +#include <linux/seq_buf.h> #include <linux/mutex.h> #include <linux/slab.h> #include <linux/stacktrace.h>
@@ -2882,13 +2883,22 @@ find_synthetic_field_var(struct hist_trigger_data *target_hist_data, {struct hist_field *event_var;char *synthetic_name; +struct seq_buf s; synthetic_name =kzalloc (MAX_FILTER_STR_VAL ,GFP_KERNEL );if (!synthetic_name)return ERR_PTR (-ENOMEM ); -strcpy (synthetic_name,"synthetic_" ); -strcat (synthetic_name, field_name); +seq_buf_init (&s, synthetic_name,MAX_FILTER_STR_VAL ); +seq_buf_printf (&s,"synthetic_%s" , field_name); + +/* Terminate synthetic_name with a NUL. */ +seq_buf_str (&s); + +if (seq_buf_has_overflowed (&s)) { +kfree (synthetic_name); +return ERR_PTR (-E2BIG ); + } event_var =find_event_var (target_hist_data, system, event_name, synthetic_name);
@@ -2934,6 +2944,7 @@ create_field_var_hist(struct hist_trigger_data *target_hist_data,struct hist_field *key_field;struct hist_field *event_var;char *saved_filter; +struct seq_buf s;char *cmd;int ret;
@@ -2978,28 +2989,34 @@ create_field_var_hist(struct hist_trigger_data *target_hist_data,return ERR_PTR (-ENOMEM ); } +seq_buf_init (&s, cmd,MAX_FILTER_STR_VAL ); +/* Use the same keys as the compatible histogram */ -strcat (cmd,"keys=" ); +seq_buf_puts (&s,"keys=" );for_each_hist_key_field (i, hist_data) { key_field = hist_data->fields[i];if (!first) -strcat (cmd,"," ); -strcat (cmd, key_field->field->name); +seq_buf_putc (&s,',' ); +seq_buf_puts (&s, key_field->field->name); first = false; }/* Create the synthetic field variable specification */ -strcat (cmd,":synthetic_" ); -strcat (cmd, field_name); -strcat (cmd,"=" ); -strcat (cmd, field_name); +seq_buf_printf (&s,":synthetic_%s=%s" , field_name, field_name);/* Use the same filter as the compatible histogram */ saved_filter =find_trigger_filter (hist_data, file); -if (saved_filter) { -strcat (cmd," if " ); -strcat (cmd, saved_filter); +if (saved_filter) +seq_buf_printf (&s," if %s" , saved_filter); + +/* Terminate cmd with a NUL. */ +seq_buf_str (&s); + +if (seq_buf_has_overflowed (&s)) { +kfree (cmd); +kfree (var_hist); +return ERR_PTR (-E2BIG ); } var_hist->cmd =kstrdup (cmd,GFP_KERNEL );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1273/1887 IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prathamesh Deshpande <[email protected]>
[ Upstream commit e79389115b9d27287ff6230a9750675106ed7668 ]
mlx5_ib_alloc_transport_domain() allocates a transport domain and then may fail in mlx5_ib_enable_lb(). In that case, the allocated TD is leaked.
Fix this by deallocating the TD when mlx5_ib_enable_lb() returns an error. Also return 0 explicitly in the no-loopback-capability success branch, and move dev->lb.mutex initialization to mlx5_ib_stage_init_init().
--- drivers/infiniband/hw/mlx5/main.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
drivers/infiniband/hw/mlx5/main.c +8 -7
@@ -1743,9 +1743,13 @@ static int mlx5_ib_alloc_transport_domain(struct mlx5_ib_dev *dev, u32 *tdn,if ((MLX5_CAP_GEN (dev->mdev, port_type) !=MLX5_CAP_PORT_TYPE_ETH ) || (!MLX5_CAP_GEN (dev->mdev, disable_local_lb_uc) && !MLX5_CAP_GEN (dev->mdev, disable_local_lb_mc))) -return err; +return 0 ; + + err =mlx5_ib_enable_lb (dev, true, false); +if (err) +mlx5_cmd_dealloc_transport_domain (dev->mdev, *tdn, uid); -return mlx5_ib_enable_lb (dev, true, false); +return err; } static void mlx5_ib_dealloc_transport_domain(struct mlx5_ib_dev *dev, u32 tdn,
@@ -3635,6 +3639,8 @@ static int mlx5_ib_stage_init_init(struct mlx5_ib_dev *dev) dev->port[i].roce.last_port_state =IB_PORT_DOWN ; } +mutex_init (&dev->lb.mutex); + err =mlx5_ib_init_multiport_master (dev);if (err)return err;
@@ -3841,11 +3847,6 @@ static int mlx5_ib_stage_caps_init(struct mlx5_ib_dev *dev)if (err)return err; -if ((MLX5_CAP_GEN (dev->mdev, port_type) ==MLX5_CAP_PORT_TYPE_ETH ) && - (MLX5_CAP_GEN (dev->mdev, disable_local_lb_uc) || -MLX5_CAP_GEN (dev->mdev, disable_local_lb_mc))) -mutex_init (&dev->lb.mutex); -if (MLX5_CAP_GEN_64 (dev->mdev, general_obj_types) &MLX5_GENERAL_OBJ_TYPES_CAP_VIRTIO_NET_Q ) { err =mlx5_ib_init_var_table (dev);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1274/1887 dlm: fix add msg handle in send_queue ordered
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Aring <[email protected]>
[ Upstream commit d2248cb70c070f8f04762872772e155b59016f17 ]
In a benchmark scenario triggering a lot of requests that triggers a lot of DLM messages on the network it can be that the mh->seq is not ordered according the oldest seq number. This ordering is required by dlm_receive_ack as "before(mh->seq, seq)" will stop to check for older sequence numbers that are ordered in the tail of "node->send_queue".
The side effects of not having it correct ordered regarding "before(mh->seq, seq)" are refcounting issues and use-after free.
I only was able to reproduce this issue in a experimental DLM branch and a user space DLM benchmark that uses io_uring. After changing this I don't experienced any refcounting with the sending buffer issues anymore.
--- fs/dlm/midcomms.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/dlm/midcomms.c +2 -2
@@ -1040,10 +1040,10 @@ static void midcomms_new_msg_cb(void *data)atomic_inc (&mh->node->send_queue_cnt);spin_lock (&mh->node->send_queue_lock); +/* need to be locked with list_add_tail_rcu() because list is ordered */ + mh->seq = mh->node->seq_send++;list_add_tail_rcu (&mh->list, &mh->node->send_queue);spin_unlock (&mh->node->send_queue_lock); - - mh->seq = mh->node->seq_send++; } static struct dlm_msg *dlm_midcomms_get_msg_3_2(struct dlm_mhandle *mh, int nodeid,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1275/1887 OPP: Fix race between OPP addition and lookup
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Di Shen <[email protected]>
[ Upstream commit f5e1cc9a284bff2510981643a5bca4bc4c21b81a ]
A race exists between dev_pm_opp_add_dynamic() and dev_pm_opp_find_freq_exact():
CPU0 (add) CPU1 (lookup)
------------------------------- ------------------------------
_opp_add()
mutex_lock()
list_add(&new_opp->node, head)
mutex_unlock() _opp_table_find_key()
mutex_lock()
dev_pm_opp_get(opp)
kref_get()
mutex_unlock()
kref_init(&new_opp->kref)
dev_pm_opp_put()
kref_put_mutex()The newly added OPP is inserted into the list before its kref is initialized. A concurrent lookup can find this OPP and increment its reference count while it is still uninitialized, leading to refcount corruption and a potential premature free.
Fix this by initializing ->kref and ->opp_table before making the OPP visible via list_add(). This ensures any concurrent lookup observes a fully initialized object.
--- drivers/opp/core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/opp/core.c +3 -3
@@ -1993,12 +1993,12 @@ int _opp_add(struct device *dev, struct dev_pm_opp *new_opp,return ret; } -list_add (&new_opp->node, head); -mutex_unlock (&opp_table->lock); - new_opp->opp_table = opp_table;kref_init (&new_opp->kref); +list_add (&new_opp->node, head); +mutex_unlock (&opp_table->lock); +opp_debug_create_one (new_opp, opp_table);if (!_opp_supported_by_regulators (new_opp, opp_table)) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1276/1887 wifi: ath11k: cancel SSR work items during PCI shutdown
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Zhang <[email protected]>
[ Upstream commit 8c79aac429b583301f387374ff37c59be671df87 ]
A reboot can crash the kernel if it overlaps with WLAN firmware crash recovery (SSR). The crash is a NULL pointer dereference in the MHI teardown path while freeing DMA-backed MHI contexts.
Simplified trace:
dma_free_attrs
mhi_deinit_dev_ctxt [mhi]
ath11k_pci_power_down [ath11k_pci]
ath11k_pci_shutdown [ath11k_pci]
device_shutdown
kernel_restart
On the host side, SSR is driven by the MHI RDDM callback, which queues reset_work to perform device recovery. reset_work power-cycles the device by calling ath11k_hif_power_down() followed by ath11k_hif_power_up(). The power-down phase deinitializes MHI and frees DMA resources.
Shutdown/reboot runs fully asynchronously with this RDDM-driven SSR recovery flow. As a result, the shutdown path (ath11k_pci_shutdown() -> ath11k_pci_power_down()) can race with the SSR recovery sequence.
Fix this by canceling SSR-related work items during PCI shutdown, marking the device as unregistering, and serializing the RDDM callback path that checks and queues reset_work. This ensures that no new SSR recovery work can be queued once teardown has started, and that any in-flight recovery work is fully synchronized before device power-down, preventing MHI teardown and DMA resource freeing from running more than once.
Note: This issue only affects PCI/MHI-based devices. AHB-based ath11k devices do not queue reset_work in normal SSR flows.
Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-04866.5-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1
--- drivers/net/wireless/ath/ath11k/mhi.c | 2 ++ drivers/net/wireless/ath/ath11k/pci.c | 7 +++++++ 2 files changed, 9 insertions(+)
drivers/net/wireless/ath/ath11k/mhi.c +2 -0
@@ -329,8 +329,10 @@ static void ath11k_mhi_op_status_cb(struct mhi_controller *mhi_cntrl,ath11k_warn (ab,"firmware crashed: MHI_CB_SYS_ERROR\n" );break ;case MHI_CB_EE_RDDM : +spin_lock_bh (&ab->base_lock);if (!(test_bit (ATH11K_FLAG_UNREGISTERING , &ab->dev_flags)))queue_work (ab->workqueue_aux, &ab->reset_work); +spin_unlock_bh (&ab->base_lock);break ;default :break ;
drivers/net/wireless/ath/ath11k/pci.c +7 -0
@@ -972,6 +972,13 @@ static void ath11k_pci_shutdown(struct pci_dev *pdev)struct ath11k_pci *ab_pci =ath11k_pci_priv (ab);ath11k_pci_set_irq_affinity_hint (ab_pci,NULL ); + +spin_lock_bh (&ab->base_lock); +set_bit (ATH11K_FLAG_UNREGISTERING , &ab->dev_flags); +spin_unlock_bh (&ab->base_lock); + +cancel_work_sync (&ab->reset_work); +ath11k_pci_power_down (ab); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1277/1887 drm/radeon: fix integer overflow in radeon_align_pitch()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Werner Kasselman <[email protected]>
[ Upstream commit ce3b24eb3ee8f82de851535f516bf21f83e82259 ]
radeon_align_pitch() has the same kind of overflow issue as the old amdgpu helper: both the alignment round-up add and the final 'aligned * cpp' calculation can overflow signed int.
If that wraps, radeon_mode_dumb_create() can end up returning an invalid pitch or creating a zero-sized dumb buffer.
Fix this by using check_add_overflow() for the alignment round-up and check_mul_overflow() for the final pitch calculation, returning 0 on overflow. Also reject zero pitch and size in radeon_mode_dumb_create().
Found via AST-based call-graph analysis using sqry.
--- drivers/gpu/drm/radeon/radeon_fb.c | 9 +++++++-- drivers/gpu/drm/radeon/radeon_gem.c | 4 ++++ 2 files changed, 11 insertions(+), 2 deletions(-)
drivers/gpu/drm/radeon/radeon_fb.c +7 -2
@@ -25,6 +25,7 @@*/ #include <linux/module.h> +#include <linux/overflow.h> #include <linux/pci.h> #include <linux/pm_runtime.h> #include <linux/slab.h>
@@ -91,6 +92,7 @@ int radeon_align_pitch(struct radeon_device *rdev, int width, int cpp, bool tileint aligned = width;int align_large = (ASIC_IS_AVIVO (rdev)) || tiled;int pitch_mask =0 ; +int pitch;switch (cpp) {case 1 :
@@ -105,9 +107,12 @@ int radeon_align_pitch(struct radeon_device *rdev, int width, int cpp, bool tilebreak ; } - aligned += pitch_mask; +if (check_add_overflow (aligned, pitch_mask, &aligned)) +return 0 ; aligned &= ~pitch_mask; -return aligned * cpp; +if (check_mul_overflow (aligned, cpp, &pitch)) +return 0 ; +return pitch; }static void radeonfb_destroy_pinned_object (struct drm_gem_object *gobj)
drivers/gpu/drm/radeon/radeon_gem.c +4 -0
@@ -831,8 +831,12 @@ int radeon_mode_dumb_create(struct drm_file *file_priv, args->pitch =radeon_align_pitch (rdev, args->width,DIV_ROUND_UP (args->bpp,8 ),0 ); +if (!args->pitch) +return -EINVAL ; args->size = (u64 )args->pitch * args->height; args->size =ALIGN (args->size,PAGE_SIZE ); +if (!args->size) +return -EINVAL ; r = radeon_gem_object_create(rdev, args->size, 0, RADEON_GEM_DOMAIN_VRAM, 0,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1278/1887 drm/vmwgfx: reject DX_BIND_QUERY without a DX context
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zack Rusin <[email protected]>
[ Upstream commit 55ec09c9ce10b1272802c7ab6c1be2ea0dbc68db ]
vmw_cmd_dx_bind_query() unconditionally dereferences sw_context->dx_ctx_node->ctx. Userspace can trigger a NULL pointer dereference from any render-node fd by submitting an execbuf with dx_context_handle == SVGA3D_INVALID_ID and a SVGA_3D_CMD_DX_BIND_QUERY opcode in the command stream: dx_ctx_node is left NULL and the kernel oopses on the assignment. The same NULL is then re-read in vmw_resources_reserve() via vmw_context_get_dx_query_mob().
All sibling DX handlers fail-close on a missing dx_ctx_node using VMW_GET_CTX_NODE(). Use the same pattern here, returning -EINVAL up front before any relocation state is published.
--- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +5 -1
@@ -1282,9 +1282,13 @@ static int vmw_cmd_dx_bind_query(struct vmw_private *dev_priv, SVGA3dCmdHeader *header) {VMW_DECLARE_CMD_VAR (*cmd, SVGA3dCmdDXBindQuery); +struct vmw_ctx_validation_info *ctx_node =VMW_GET_CTX_NODE (sw_context);struct vmw_buffer_object *vmw_bo;int ret; +if (!ctx_node) +return -EINVAL ; + cmd =container_of (header,typeof (*cmd), header);/*
@@ -1298,7 +1302,7 @@ static int vmw_cmd_dx_bind_query(struct vmw_private *dev_priv,return ret; sw_context->dx_query_mob = vmw_bo; - sw_context->dx_query_ctx = sw_context->dx_ctx_node->ctx; + sw_context->dx_query_ctx = ctx_node->ctx;return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1279/1887 s390/zcrypt: Close speculative mem read possibility
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harald Freudenberger <[email protected]>
[ Upstream commit e935cd525af4c6ed2e2c6404aa27ca19c7f39ddb ]
The domain value is extracted from a given CCA or EP11 ioctl struct when a CPRB is about to be sent. Thus this is a user controlled value. Under some special conditions (custom device node used, administrative load) this value is used as an array index after bounds checking, but without speculation barrier.
Add the missing array_index_nospec() call to prevent speculative execution where this domain value is used.
--- drivers/s390/crypto/zcrypt_api.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/s390/crypto/zcrypt_api.c +3 -0
@@ -26,6 +26,7 @@#include <linux/cdev.h> #include <linux/ctype.h> #include <linux/capability.h> +#include <linux/nospec.h> #include <asm/debug.h> #define CREATE_TRACE_POINTS
@@ -929,6 +930,7 @@ static long _zcrypt_send_cprb(bool userspace, struct ap_perms *perms, tdom = *domain;if (perms != &ap_perms && tdom <AP_DOMAINS ) {if (ap_msg.flags &AP_MSG_FLAG_ADMIN ) { + tdom =array_index_nospec (tdom,AP_DOMAINS );if (!test_bit_inv (tdom, perms->adm)) { rc = -ENODEV ; goto out;
@@ -1121,6 +1123,7 @@ static long _zcrypt_send_ep11_cprb(bool userspace, struct ap_perms *perms,if (perms != &ap_perms && domain <AP_DOMAINS ) {if (ap_msg.flags &AP_MSG_FLAG_ADMIN ) { + domain =array_index_nospec (domain,AP_DOMAINS );if (!test_bit_inv (domain, perms->adm)) { rc = -ENODEV ; goto out_free;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1280/1887 octeontx2-af: Block VFs from clobbering special CGX PKIND state
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hariprasad Kelam <[email protected]>
[ Upstream commit 3bd438a58e910db5dc369aa25dfed1fc95f1b596 ]
PF and VF NIX LFs that share a CGX LMAC reuse the same hardware PKIND programming. When HiGig2 or EDSA parsing is enabled, a VF NIX LF alloc must not reset the LMAC RX PKIND or default TX parse config over the PF setup.
Add cgx_get_pkind() and rvu_cgx_is_pkind_config_permitted() so VFs skip cgx_set_pkind(), rvu_npc_set_pkind(), and NIX_AF_LFX_TX_PARSE_CFG updates when the LMAC is using NPC_RX_HIGIG_PKIND or NPC_RX_EDSA_PKIND.
--- .../net/ethernet/marvell/octeontx2/af/cgx.c | 12 +++ .../net/ethernet/marvell/octeontx2/af/cgx.h | 1 + .../net/ethernet/marvell/octeontx2/af/rvu.h | 2 + .../ethernet/marvell/octeontx2/af/rvu_cgx.c | 79 +++++++++++++++++++ .../ethernet/marvell/octeontx2/af/rvu_nix.c | 22 +++++- .../ethernet/marvell/octeontx2/af/rvu_npc.c | 29 ++++--- 6 files changed, 131 insertions(+), 14 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/cgx.c +12 -0
@@ -495,6 +495,18 @@ int cgx_set_pkind(void *cgxd, u8 lmac_id, int pkind)return 0 ; } +int cgx_get_pkind (void *cgxd,u8 lmac_id,int *pkind) +{ +struct cgx *cgx = cgxd; + +if (!is_lmac_valid (cgx, lmac_id)) +return -ENODEV ; + + *pkind =cgx_read (cgx, lmac_id,CGXX_CMRX_RX_ID_MAP ); + *pkind = *pkind &0x3F ; +return 0 ; +} +static u8 cgx_get_lmac_type (void *cgxd,int lmac_id) {struct cgx *cgx = cgxd;
drivers/net/ethernet/marvell/octeontx2/af/cgx.h +1 -0
@@ -136,6 +136,7 @@ int cgx_get_cgxid(void *cgxd);int cgx_get_lmac_cnt (void *cgxd);void *cgx_get_pdata (int cgx_id);int cgx_set_pkind (void *cgxd,u8 lmac_id,int pkind); +int cgx_get_pkind (void *cgxd,u8 lmac_id,int *pkind);int cgx_lmac_evh_register (struct cgx_event_cb *cb,void *cgxd,int lmac_id);int cgx_lmac_evh_unregister (void *cgxd,int lmac_id);int cgx_get_tx_stats (void *cgxd,int lmac_id,int idx,u64 *tx_stat);
drivers/net/ethernet/marvell/octeontx2/af/rvu.h +2 -0
@@ -868,6 +868,8 @@ void npc_read_mcam_entry(struct rvu *rvu, struct npc_mcam *mcam, int blkaddr, u16 src, struct mcam_entry *entry, u8 *intf, u8 *ena);bool is_cgx_config_permitted (struct rvu *rvu,u16 pcifunc); +bool rvu_cgx_check_permission_and_set_pkind (struct rvu *rvu,u16 pcifunc,int pkind); +bool rvu_cgx_is_pkind_config_permitted (struct rvu *rvu,u16 pcifunc);bool is_mac_feature_supported (struct rvu *rvu,int pf,int feature);u32 rvu_cgx_get_fifolen (struct rvu *rvu);void *rvu_first_cgx_pdata (struct rvu *rvu);
drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c +79 -0
82 lines not on this page · raw message
drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +18 -4
@@ -324,8 +324,8 @@ static int nix_interface_init(struct rvu *rvu, u16 pcifunc, int type, int nixlf, pfvf->tx_chan_cnt =1 ; rsp->tx_link = cgx_id * hw->lmac_per_cgx + lmac_id; -cgx_set_pkind (rvu_cgx_pdata (cgx_id, rvu), lmac_id, pkind); -rvu_npc_set_pkind (rvu, pkind, pfvf); +if (rvu_cgx_check_permission_and_set_pkind (rvu, pcifunc, pkind)) +rvu_npc_set_pkind (rvu, pkind, pfvf);break ;case NIX_INTF_TYPE_LBK :
@@ -1314,11 +1314,13 @@ int rvu_mbox_handler_nix_lf_alloc(struct rvu *rvu,struct nix_lf_alloc_req *req, struct nix_lf_alloc_rsp *rsp) { - int nixlf, qints, hwctx_size, intf, err, rc = 0; + int nixlf, qints, hwctx_size, intf, err, rc = 0, pf;struct rvu_hwinfo *hw = rvu->hw;u16 pcifunc = req->hdr.pcifunc; +u8 cgx_id =0 , lmac_id =0 ;struct rvu_block *block;struct rvu_pfvf *pfvf; +struct cgx *cgxd;u64 cfg, ctx_cfg;int blkaddr;
@@ -1486,8 +1488,20 @@ int rvu_mbox_handler_nix_lf_alloc(struct rvu *rvu,rvu_write64 (rvu, blkaddr,NIX_AF_LFX_RX_CFG (nixlf), req->rx_cfg);/* Configure pkind for TX parse config */ + + pf =rvu_get_pf (pcifunc); cfg =NPC_TX_DEF_PKIND ; -rvu_write64 (rvu, blkaddr,NIX_AF_LFX_TX_PARSE_CFG (nixlf), cfg); + +if (is_pf_cgxmapped (rvu, pf) &&is_vf (pcifunc)) { +rvu_get_cgx_lmac_id (rvu->pf2cgxlmac_map[pf], &cgx_id, &lmac_id); + cgxd =rvu_cgx_pdata (cgx_id, rvu); +mutex_lock (&cgxd->lock); +if (rvu_cgx_is_pkind_config_permitted (rvu, pcifunc)) +rvu_write64 (rvu, blkaddr,NIX_AF_LFX_TX_PARSE_CFG (nixlf), cfg); +mutex_unlock (&cgxd->lock); + }else { +rvu_write64 (rvu, blkaddr,NIX_AF_LFX_TX_PARSE_CFG (nixlf), cfg); + } intf =is_afvf (pcifunc) ?NIX_INTF_TYPE_LBK :NIX_INTF_TYPE_CGX ;if (is_sdp_pfvf (pcifunc))
drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c +19 -10
@@ -16,6 +16,7 @@#include "cgx.h" #include "npc_profile.h" #include "rvu_npc_hash.h" +#include "lmac_common.h" #define RSVD_MCAM_ENTRIES_PER_PF 3/* Broadcast, Promisc and AllMulticast */ #define RSVD_MCAM_ENTRIES_PER_NIXLF 1/* Ucast for LFs */
@@ -3337,10 +3338,11 @@ int rvu_npc_set_parse_mode(struct rvu *rvu, u16 pcifunc, u64 mode, u8 dir, {struct rvu_pfvf *pfvf =rvu_get_pfvf (rvu, pcifunc); -int blkaddr, nixlf, rc, intf_mode;int pf =rvu_get_pf (pcifunc); +int blkaddr, nixlf, rc, intf_mode; +u8 cgx_id =0 , lmac_id =0 ;u64 rxpkind, txpkind; -u8 cgx_id, lmac_id; +struct cgx *cgxd;/* use default pkind to disable edsa/higig */ rxpkind =rvu_npc_get_pkind (rvu, pf);
@@ -3364,12 +3366,8 @@ int rvu_npc_set_parse_mode(struct rvu *rvu, u16 pcifunc, u64 mode, u8 dir,/* rx pkind set req valid only for cgx mapped PFs */ if (!is_cgx_config_permitted (rvu, pcifunc))return 0 ; -rvu_get_cgx_lmac_id (rvu->pf2cgxlmac_map[pf], &cgx_id, &lmac_id); - - rc =cgx_set_pkind (rvu_cgx_pdata (cgx_id, rvu), lmac_id, - rxpkind); -if (rc) -return rc; +if (!rvu_cgx_check_permission_and_set_pkind (rvu, pcifunc, rxpkind)) +return -EINVAL ; }if (dir &PKIND_TX ) {
@@ -3378,8 +3376,19 @@ int rvu_npc_set_parse_mode(struct rvu *rvu, u16 pcifunc, u64 mode, u8 dir,if (rc)return rc; -rvu_write64 (rvu, blkaddr,NIX_AF_LFX_TX_PARSE_CFG (nixlf), - txpkind); +if (is_pf_cgxmapped (rvu, pf) &&is_vf (pcifunc)) { +rvu_get_cgx_lmac_id (rvu->pf2cgxlmac_map[pf], &cgx_id, + &lmac_id); + cgxd =rvu_cgx_pdata (cgx_id, rvu); +mutex_lock (&cgxd->lock); +if (rvu_cgx_is_pkind_config_permitted (rvu, pcifunc)) +rvu_write64 (rvu, blkaddr,NIX_AF_LFX_TX_PARSE_CFG (nixlf), + txpkind); +mutex_unlock (&cgxd->lock); + }else { +rvu_write64 (rvu, blkaddr,NIX_AF_LFX_TX_PARSE_CFG (nixlf), + txpkind); + } } pfvf->intf_mode = intf_mode;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1281/1887 Bluetooth: ISO: hold sk properly in iso_conn_ready
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <[email protected]>
[ Upstream commit 0d255e63fcf3f13a570d7ac11678fa1164ac015c ]
sk deref in iso_conn_ready must be done either under conn->lock, or holding a refcount, to avoid concurrent close. conn->sk is currently accessed without either:
[Task 1] [Task 2]
iso_sock_release
iso_conn_ready
sk = conn->sk
lock_sock(sk)
conn->sk = NULL
lock_sock(sk)
release_sock(sk)
iso_sock_kill(sk)
UAF on sk deref
Fix possible UAF by holding sk refcount in iso_conn_ready(). Also recheck after lock_sock that the socket is still valid. Adjust locking so conn->sk is cleared only under lock_sock.
--- net/bluetooth/iso.c | 27 +++++++++++++++++++++------ 1 file changed, 21 insertions(+), 6 deletions(-)
net/bluetooth/iso.c +21 -6
@@ -1463,14 +1463,11 @@ static void iso_sock_ready(struct sock *sk) {BT_DBG ("sk %p" , sk); -if (!sk) -return ; +lockdep_assert (lockdep_sock_is_held (sk)); -lock_sock (sk);iso_sock_clear_timer (sk); sk->sk_state =BT_CONNECTED ; sk->sk_state_change (sk); -release_sock (sk); }struct iso_list_data {
@@ -1488,14 +1485,32 @@ static bool iso_match_big(struct sock *sk, void *data)static void iso_conn_ready (struct iso_conn *conn) {struct sock *parent; -struct sock *sk = conn->sk; +struct sock *sk;struct hci_ev_le_big_sync_estabilished *ev;struct hci_conn *hcon;BT_DBG ("conn %p" , conn); +iso_conn_lock (conn); + sk =iso_sock_hold (conn); +iso_conn_unlock (conn); +if (sk) { -iso_sock_ready (conn->sk); +lock_sock (sk); + +/* conn->sk may have become NULL if racing with sk close, but +* due to held hdev->lock, it can't become different sk. +*/ +if (!conn->sk) { +release_sock (sk); +sock_put (sk); +return ; + } + +iso_sock_ready (sk); + +release_sock (sk); +sock_put (sk); }else { hcon = conn->hcon;if (!hcon)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1282/1887 net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 080695e6f005e2396f1207fd69d24c442cb230c6 ]
syzbot reported a memory leak [1] in the UDP tunnel NIC offload code.
When device registration fails (e.g. in register_netdevice()), netdev core unwinds by sending a single NETDEV_UNREGISTER notification. If work was queued during NETDEV_REGISTER (utn->work_pending is set), udp_tunnel_nic_unregister() returns early:
if (utn->work_pending) return;
Because failed registrations do not enter netdev_wait_allrefs_any(), no subsequent NETDEV_UNREGISTER rebroadcast will ever occur. As a result, the struct udp_tunnel_nic allocated in udp_tunnel_nic_alloc() is leaked permanently.
Fix this by removing the early return. Instead, synchronously cancel any pending work with cancel_delayed_work_sync() before freeing @utn.
To be able to call cancel_delayed_work_sync() while holding RTNL (the work also needs RTNL), switch udp_tunnel_nic_device_sync_work() to rtnl_trylock(). If RTNL is contended, requeue the work with a 1 jiffy delay (via queue_delayed_work()) to prevent high CPU contention while waiting for RTNL lock.
The utn->work_pending bookkeeping is no longer needed and is removed, as the workqueue core already tracks the pending/running state of the work.
[1]
BUG: memory leak
unreferenced object 0xffff888127d5f840 (size 96):
comm "syz-executor", pid 5806, jiffies 4294942188
backtrace (crc 99fdb6c8):
__kmalloc_noprof+0x3bf/0x550
udp_tunnel_nic_alloc net/ipv4/udp_tunnel_nic.c:756 [inline]
udp_tunnel_nic_register net/ipv4/udp_tunnel_nic.c:833 [inline]
udp_tunnel_nic_netdevice_event+0x804/0xab0 net/ipv4/udp_tunnel_nic.c:931
notifier_call_chain+0x59/0x160 kernel/notifier.c:85
call_netdevice_notifiers_info+0x7d/0xb0 net/core/dev.c:2250
register_netdevice+0xc10/0xeb0 net/core/dev.c:11478--- net/ipv4/udp_tunnel_nic.c | 34 ++++++++++++++++++---------------- 1 file changed, 18 insertions(+), 16 deletions(-)
net/ipv4/udp_tunnel_nic.c +18 -16
@@ -31,19 +31,17 @@ struct udp_tunnel_nic_table_entry {* @dev: netdev pointer * @need_sync: at least one port start changed * @need_replay: space was freed, we need a replay of all ports -* @work_pending: @work is currently scheduled * @n_tables: number of tables under @entries * @missed: bitmap of tables which overflown * @entries: table of tables of ports currently offloaded */ struct udp_tunnel_nic { -struct work_struct work; +struct delayed_work work;struct net_device *dev;u8 need_sync:1 ;u8 need_replay:1 ; -u8 work_pending:1 ;unsigned int n_tables;unsigned long missed;
@@ -301,7 +299,7 @@ udp_tunnel_nic_device_sync(struct net_device *dev, struct udp_tunnel_nic *utn)const struct udp_tunnel_nic_info *info = dev->udp_tunnel_nic_info;bool may_sleep; -if (!utn->need_sync || utn->work_pending) +if (!utn->need_sync)return ;/* Drivers which sleep in the callback need to update from
@@ -310,10 +308,8 @@ udp_tunnel_nic_device_sync(struct net_device *dev, struct udp_tunnel_nic *utn) may_sleep = info->flags &UDP_TUNNEL_NIC_INFO_MAY_SLEEP ;if (!may_sleep)__udp_tunnel_nic_device_sync (dev, utn); -if (may_sleep || utn->need_replay) { -queue_work (udp_tunnel_nic_workqueue, &utn->work); - utn->work_pending =1 ; - } +if (may_sleep || utn->need_replay) +queue_delayed_work (udp_tunnel_nic_workqueue, &utn->work,0 ); } static bool
@@ -705,10 +701,16 @@ udp_tunnel_nic_replay(struct net_device *dev, struct udp_tunnel_nic *utn)static void udp_tunnel_nic_device_sync_work (struct work_struct *work) {struct udp_tunnel_nic *utn = - container_of(work, struct udp_tunnel_nic, work); + container_of(work, struct udp_tunnel_nic, work.work); -rtnl_lock (); - utn->work_pending =0 ; +/* We cannot block on RTNL here, otherwise we would deadlock with +* udp_tunnel_nic_unregister() calling cancel_delayed_work_sync() +* while holding RTNL. Requeue with 1 jiffy delay if RTNL is contended. +*/ +if (!rtnl_trylock ()) { +queue_delayed_work (udp_tunnel_nic_workqueue, &utn->work,1 ); +return ; + }__udp_tunnel_nic_device_sync (utn->dev, utn);if (utn->need_replay)
@@ -727,7 +729,7 @@ udp_tunnel_nic_alloc(const struct udp_tunnel_nic_info *info,if (!utn)return NULL ; utn->n_tables = n_tables; -INIT_WORK (&utn->work, udp_tunnel_nic_device_sync_work); +INIT_DELAYED_WORK (&utn->work, udp_tunnel_nic_device_sync_work); utn->entries =kmalloc_array (n_tables,sizeof (void *),GFP_KERNEL );if (!utn->entries)
@@ -868,11 +870,11 @@ udp_tunnel_nic_unregister(struct net_device *dev, struct udp_tunnel_nic *utn)*/ udp_tunnel_nic_flush (dev, utn); -/* Wait for the work to be done using the state, netdev core will -* retry unregister until we give up our reference on this device. +/* Make sure no work is running or queued before freeing @utn. +* The work handler uses rtnl_trylock(), so it will not deadlock +* against the RTNL we are holding here. */ -if (utn->work_pending) -return ; +cancel_delayed_work_sync (&utn->work);udp_tunnel_nic_free (utn); release_dev:
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1283/1887 net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang (Microsoft) <[email protected]>
[ Upstream commit aef96eead2860cbfa371e4471d4f04412213b958 ]
u32_change() copies the user-provided tc_u32_sel.offshift (unsigned char, 0-255) into the kernel knode object without bounds validation. When a packet later hits u32_classify() with TC_U32_VAROFFSET set, it evaluates ntohs(offmask & *data) >> offshift where the left operand is a 16-bit value promoted to a 32-bit int. Any offshift >= 32 is undefined behavior per C11 6.5.7p3, triggerable by an unprivileged user via user/network namespaces.
UBSAN: shift-out-of-bounds in net/sched/cls_u32.c:236:43
shift exponent 32 is too large for 32-bit type int
Fix this by rejecting offshift >= 16 during filter creation in u32_change().
--- net/sched/cls_u32.c | 7 +++++++ 1 file changed, 7 insertions(+)
net/sched/cls_u32.c +7 -0
@@ -1128,6 +1128,13 @@ static int u32_change(struct net *net, struct sk_buff *in_skb, goto erridr; } +if (s->offshift >=16 ) { +NL_SET_ERR_MSG_MOD (extack, +"offshift must be less than 16" ); + err = -EINVAL ; + goto erridr; + } + n =kzalloc (struct_size (n, sel.keys, s->nkeys),GFP_KERNEL );if (n ==NULL ) { err = -ENOBUFS ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1284/1887 btrfs: skip global block reserve accounting for rescue mounts
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dongjiang Zhu <[email protected]>
[ Upstream commit 51a0e8399858621442807a26057bcd1cd3ced046 ]
[BUG]
Mounting with rescue=ibadroots after corrupting the block group tree root triggers a NULL pointer dereference:
BUG: kernel NULL pointer dereference, address: 0000000000000100 RIP: 0010:btrfs_update_global_block_rsv+0x9d/0x1c0 [btrfs] Call Trace: fill_dummy_bgs+0xd4/0x120 [btrfs] open_ctree+0xc6e/0x1ca0 [btrfs] btrfs_get_tree+0x50d/0xa40 [btrfs]
The same crash occurs with a corrupted raid stripe tree root, via btrfs_read_block_groups() instead of fill_dummy_bgs().
[CAUSE]
With rescue=ibadroots, btrfs_read_roots() allows the mount to continue when either root cannot be read, leaving the corresponding root pointer NULL while its on-disk feature bit remains set.
btrfs_update_global_block_rsv() then dereferences the missing root based on the feature bit alone.
[FIX]
Rescue mounts are fully read-only and cannot start transactions, so the global reserve is never consumed. Under btrfs_is_full_ro(), mark the reserve as full and return before performing the accounting.
And since we need to check if the fs is mount fully RO, export fs_is_full_ro() as btrfs_is_full_ro(), and move it to fs.h.
--- fs/btrfs/block-rsv.c | 19 +++++++++++++++++-- fs/btrfs/ctree.h | 9 +++++++++ fs/btrfs/disk-io.c | 11 +---------- 3 files changed, 27 insertions(+), 12 deletions(-)
fs/btrfs/block-rsv.c +17 -2
@@ -352,10 +352,25 @@ int btrfs_cond_migrate_bytes(struct btrfs_fs_info *fs_info,void btrfs_update_global_block_rsv (struct btrfs_fs_info *fs_info) {struct btrfs_block_rsv *block_rsv = &fs_info->global_block_rsv; -struct btrfs_space_info *sinfo = block_rsv->space_info; +struct btrfs_space_info *sinfo;struct btrfs_root *root, *tmp; -u64 num_bytes =btrfs_root_used (&fs_info->tree_root->root_item);unsigned int min_items =1 ; +u64 num_bytes; + +/* +* A full read-only mount (rescue options) cannot start transactions, +* so the global reserve is never consumed. Mark it as full and skip +* the accounting. +*/ +if (btrfs_is_full_ro (fs_info)) { +spin_lock (&block_rsv->lock); + block_rsv->full = true; +spin_unlock (&block_rsv->lock); +return ; + } + + sinfo = block_rsv->space_info; + num_bytes =btrfs_root_used (&fs_info->tree_root->root_item);/* * The global block rsv is based on the size of the extent tree, the
fs/btrfs/ctree.h +9 -0
@@ -1641,6 +1641,15 @@ enum {#define btrfs_test_opt (fs_info, opt) ((fs_info)->mount_opt & \ BTRFS_MOUNT_##opt) +static inline bool btrfs_is_full_ro (const struct btrfs_fs_info *fs_info) +{ +if (!sb_rdonly (fs_info->sb)) +return false; +if (unlikely (fs_info->mount_opt &BTRFS_MOUNT_FULL_RO_MASK )) +return true; +return false; +} + #define btrfs_set_and_info(fs_info, opt, fmt, args...) \ do { \ if (!btrfs_test_opt(fs_info, opt)) \
fs/btrfs/disk-io.c +1 -10
@@ -3417,15 +3417,6 @@ int btrfs_check_features(struct btrfs_fs_info *fs_info, bool is_rw_mount)return 0 ; } -static bool fs_is_full_ro (const struct btrfs_fs_info *fs_info) -{ -if (!sb_rdonly (fs_info->sb)) -return false; -if (unlikely (fs_info->mount_opt &BTRFS_MOUNT_FULL_RO_MASK )) -return true; -return false; -} -int __cold open_ctree (struct super_block *sb,struct btrfs_fs_devices *fs_devices,char *options) {
@@ -3808,7 +3799,7 @@ int __cold open_ctree(struct super_block *sb, struct btrfs_fs_devices *fs_device }/* If the fs has any rescue options, no transaction is allowed. */ -if (fs_is_full_ro (fs_info)) +if (btrfs_is_full_ro (fs_info))set_bit (BTRFS_FS_STATE_ERROR , &fs_info->fs_state); fs_info->fs_root =btrfs_get_fs_root (fs_info,BTRFS_FS_TREE_OBJECTID , true);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1285/1887 mm/ptdump: always stabilise against page table freeing using init_mm
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Stoakes (ARM) <[email protected]>
[ Upstream commit 27c32e5538344b13c1505a08861e04620c125d47 ]
Previous commits have established the invariant that kernel page table freeing is performed while an mmap read lock on init_mm is held, which fixes races between ptdump and kernel page table freeing over init_mm.
However, x86 and arm64 can perform a ptdump over an mm other than init_mm via ptdump_walk_pgd() and since kernel memory ranges are shared across non-kernel mm's, this means that the race still exists for these cases.
Fix this by acquiring a nested mmap write lock for init_mm in ptdump_walk_pgd().
This is safe as we take this after mmap write locking the mm, and nothing acquires the init_mm lock first before locking an arbitrary mm, so no deadlock is possible.
Also update walk_page_range_debug() to assert that init_mm is write locked, add a comment explaining why and remove some redundant code, and eliminate the unnecessary and confusing invocation of walk_kernel_page_table_range().
We can safely remove the non-NULL check for walk.mm, as the mmap lock asserts would NULL pointer deref if it was (and of course no callers do this).
The first point at which ptdump can race kernel page table freeing is commit b6bdb7517c3d ("mm/vmalloc: add interfaces to free unmapped page table"), so we target this in the Fixes tag.
--- mm/pagewalk.c | 8 ++++++++ mm/ptdump.c | 7 +++++++ 2 files changed, 15 insertions(+)
mm/pagewalk.c +8 -0
@@ -523,6 +523,14 @@ int walk_page_range_novma(struct mm_struct *mm, unsigned long start,* to account for page table freeing on vmap huge page mapping. */ mmap_assert_write_locked (walk.mm); +/* +* x86, arm64 ptdump allow walks of efi mm's and x86 ptdump allows walks +* of arbitrary mm's. +* +* However, they both must also hold the init_mm lock to account for +* concurrent kernel page table freeing. +*/ +mmap_assert_write_locked (&init_mm);return walk_pgd_range (start, end, &walk); }
mm/ptdump.c +7 -0
@@ -154,11 +154,18 @@ void ptdump_walk_pgd(struct ptdump_state *st, struct mm_struct *mm, pgd_t *pgd)get_online_mems ();mmap_write_lock (mm); +/* To stabilise kernel page tables we must hold the init_mm lock too. */ +if (mm != &init_mm) +mmap_write_lock_nested (&init_mm,SINGLE_DEPTH_NESTING ); +while (range->start != range->end) {walk_page_range_novma (mm, range->start, range->end, &ptdump_ops, pgd, st); range++; } + +if (mm != &init_mm) +mmap_write_unlock (&init_mm);mmap_write_unlock (mm);put_online_mems ();
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1286/1887 mm/page_table_check: skip special zero mappings
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhiling Zou <[email protected]>
[ Upstream commit 8db4bab826ccc9ec10fa41736a48031cd338d392 ]
page_table_check_set() and page_table_check_clear() account mappings based on PageAnon(). Shared zero-page PTEs and huge zero PMDs are special mappings, but page_table_check can still account them as file-backed pages.
An unprivileged process can populate enough zero mappings to overflow file_map_count and hit the existing BUG_ON(). The PTE path can do this with the shared zero page, and the PMD path can do the same with huge zero mappings.
Skip special zero mappings in the user page-table accounting paths. Keep the PTE-side pte_special() check, and identify huge zero PMDs from the mapped folio instead of pmd_special(). That covers architectures where pmd_special() is a no-op without adding huge_zero_pfn checks to the generic counter helpers.
--- mm/page_table_check.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-)
mm/page_table_check.c +16 -4
@@ -164,20 +164,31 @@ void __page_table_check_pte_clear(struct mm_struct *mm, unsigned long addr,if (&init_mm == mm)return ; -if (pte_user_accessible_page (pte)) { +if (pte_user_accessible_page (pte) && !pte_special (pte)) {page_table_check_clear (mm, addr,pte_pfn (pte),PAGE_SIZE >>PAGE_SHIFT ); } }EXPORT_SYMBOL (__page_table_check_pte_clear); +static inline bool page_table_check_huge_zero_pmd (pmd_t pmd) +{ +unsigned long pfn =pmd_pfn (pmd); + +if (!pfn_valid (pfn)) +return false; + +return is_huge_zero_page (pfn_to_page (pfn)); +} +void __page_table_check_pmd_clear (struct mm_struct *mm,unsigned long addr,pmd_t pmd) {if (&init_mm == mm)return ; -if (pmd_user_accessible_page (pmd)) { +if (pmd_user_accessible_page (pmd) && + !page_table_check_huge_zero_pmd (pmd)) {page_table_check_clear (mm, addr,pmd_pfn (pmd),PMD_SIZE >>PAGE_SHIFT ); }
@@ -204,7 +215,7 @@ void __page_table_check_pte_set(struct mm_struct *mm, unsigned long addr,return ;__page_table_check_pte_clear (mm, addr, *ptep); -if (pte_user_accessible_page (pte)) { +if (pte_user_accessible_page (pte) && !pte_special (pte)) {page_table_check_set (mm, addr,pte_pfn (pte),PAGE_SIZE >>PAGE_SHIFT ,pte_write (pte));
@@ -219,7 +230,8 @@ void __page_table_check_pmd_set(struct mm_struct *mm, unsigned long addr,return ;__page_table_check_pmd_clear (mm, addr, *pmdp); -if (pmd_user_accessible_page (pmd)) { +if (pmd_user_accessible_page (pmd) && + !page_table_check_huge_zero_pmd (pmd)) {page_table_check_set (mm, addr,pmd_pfn (pmd),PMD_SIZE >>PAGE_SHIFT ,pmd_write (pmd));
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1287/1887 selftests: tls: add getsockopt test
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit f27ad62fe38cf7c0a561628734f348217777127b ]
The kernel accepts fetching either just the version and cipher type, or exactly the per-cipher struct. Also check that getsockopt returns what we just passed to the kernel.
Stable-dep-of: 1c8629651cb5 ("tls: rx: restore msg_iter before TLS 1.3 optimistic retry")
--- tools/testing/selftests/net/tls.c | 35 +++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+)
tools/testing/selftests/net/tls.c +35 -0
@@ -29,6 +29,7 @@ static int fips_enabled;struct tls_crypto_info_keys {union { +struct tls_crypto_info crypto_info;struct tls12_crypto_info_aes_gcm_128 aes128;struct tls12_crypto_info_chacha20_poly1305 chacha20;struct tls12_crypto_info_sm4_gcm sm4gcm;
@@ -1460,6 +1461,40 @@ TEST_F(tls, shutdown_reuse)EXPECT_EQ (errno,EISCONN ); } +TEST_F(tls, getsockopt) +{ +struct tls_crypto_info_keys expect, get; +socklen_t len; + +/* get only the version/cipher */ + len =sizeof (struct tls_crypto_info ); +memrnd (&get,sizeof (get)); +EXPECT_EQ (getsockopt (self->fd,SOL_TLS ,TLS_TX , &get, &len),0 ); +EXPECT_EQ (len,sizeof (struct tls_crypto_info )); +EXPECT_EQ (get.crypto_info.version, variant->tls_version); +EXPECT_EQ (get.crypto_info.cipher_type, variant->cipher_type); + +/* get the full crypto_info */ +tls_crypto_info_init (variant->tls_version, variant->cipher_type, &expect); + len = expect.len; +memrnd (&get,sizeof (get)); +EXPECT_EQ (getsockopt (self->fd,SOL_TLS ,TLS_TX , &get, &len),0 ); +EXPECT_EQ (len, expect.len); +EXPECT_EQ (get.crypto_info.version, variant->tls_version); +EXPECT_EQ (get.crypto_info.cipher_type, variant->cipher_type); +EXPECT_EQ (memcmp (&get, &expect, expect.len),0 ); + +/* short get should fail */ + len =sizeof (struct tls_crypto_info ) -1 ; +EXPECT_EQ (getsockopt (self->fd,SOL_TLS ,TLS_TX , &get, &len),-1 ); +EXPECT_EQ (errno,EINVAL ); + +/* partial get of the cipher data should fail */ + len = expect.len -1 ; +EXPECT_EQ (getsockopt (self->fd,SOL_TLS ,TLS_TX , &get, &len),-1 ); +EXPECT_EQ (errno,EINVAL ); +} +FIXTURE (tls_err) {int fd, cfd;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 1288/1887 selftests: tls: add test with a partially invalid iov
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit dc54b813df63020e946ccdef35b64d4fa99fd622 ]
Make sure that we don't return more bytes than we actually received if the userspace buffer was bogus. We expect to receive at least the rest of rec1, and possibly some of rec2 (currently, we don't, but that would be ok).
Stable-dep-of: 1c8629651cb5 ("tls: rx: restore msg_iter before TLS 1.3 optimistic retry")
--- tools/testing/selftests/net/tls.c | 34 +++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+)
tools/testing/selftests/net/tls.c +34 -0
@@ -1495,6 +1495,40 @@ TEST_F(tls, getsockopt)EXPECT_EQ (errno,EINVAL ); } +TEST_F(tls, recv_efault) +{ +char *rec1 ="1111111111" ; +char *rec2 ="2222222222" ; +struct msghdr hdr = {}; +struct iovec iov[2 ]; +char recv_mem[12 ]; +int ret; + +if (self->notls) +SKIP (return,"no TLS support" ); + +EXPECT_EQ (send (self->fd, rec1,10 ,0 ),10 ); +EXPECT_EQ (send (self->fd, rec2,10 ,0 ),10 ); + + iov[0 ].iov_base = recv_mem; + iov[0 ].iov_len =sizeof (recv_mem); + iov[1 ].iov_base =NULL ;/* broken iov to make process_rx_list fail */ + iov[1 ].iov_len =1 ; + + hdr.msg_iovlen =2 ; + hdr.msg_iov = iov; + +EXPECT_EQ (recv (self->cfd, recv_mem,1 ,0 ),1 ); +EXPECT_EQ (recv_mem[0 ], rec1[0 ]); + + ret =recvmsg (self->cfd, &hdr,0 ); +EXPECT_LE (ret,sizeof (recv_mem)); +EXPECT_GE (ret,9 ); +EXPECT_EQ (memcmp (rec1, recv_mem,9 ),0 ); +if (ret >9 ) +EXPECT_EQ (memcmp (rec2, recv_mem +9 , ret -9 ),0 ); +} +FIXTURE (tls_err) {int fd, cfd;
Signature · 1 line
2.53.0