* [PATCH AUTOSEL 6.6 02/20] ksmbd: override fsids for smb2_query_info()
2024-10-12 11:26 [PATCH AUTOSEL 6.6 01/20] ksmbd: override fsids for share path check Sasha Levin
@ 2024-10-12 11:26 ` Sasha Levin
2024-10-12 11:26 ` [PATCH AUTOSEL 6.6 03/20] usbnet: ipheth: race between ipheth_close and error handling Sasha Levin
` (17 subsequent siblings)
18 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2024-10-12 11:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Namjae Jeon, Sangsoo Lee, Steve French, Sasha Levin, sfrench, linux-cifs
From: Namjae Jeon <linkinjeon@kernel.org>
[ Upstream commit f6bd41280a44dcc2e0a25ed72617d25f586974a7 ]
Sangsoo reported that a DAC denial error occurred when accessing
files through the ksmbd thread. This patch override fsids for
smb2_query_info().
Reported-by: Sangsoo Lee <constant.lee@samsung.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/server/smb2pdu.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 646c874d151a8..cfc5c6dd880f8 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -5596,6 +5596,11 @@ int smb2_query_info(struct ksmbd_work *work)
ksmbd_debug(SMB, "GOT query info request\n");
+ if (ksmbd_override_fsids(work)) {
+ rc = -ENOMEM;
+ goto err_out;
+ }
+
switch (req->InfoType) {
case SMB2_O_INFO_FILE:
ksmbd_debug(SMB, "GOT SMB2_O_INFO_FILE\n");
@@ -5614,6 +5619,7 @@ int smb2_query_info(struct ksmbd_work *work)
req->InfoType);
rc = -EOPNOTSUPP;
}
+ ksmbd_revert_fsids(work);
if (!rc) {
rsp->StructureSize = cpu_to_le16(9);
@@ -5623,6 +5629,7 @@ int smb2_query_info(struct ksmbd_work *work)
le32_to_cpu(rsp->OutputBufferLength));
}
+err_out:
if (rc < 0) {
if (rc == -EACCES)
rsp->hdr.Status = STATUS_ACCESS_DENIED;
--
2.43.0
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH AUTOSEL 6.6 03/20] usbnet: ipheth: race between ipheth_close and error handling
2024-10-12 11:26 [PATCH AUTOSEL 6.6 01/20] ksmbd: override fsids for share path check Sasha Levin
2024-10-12 11:26 ` [PATCH AUTOSEL 6.6 02/20] ksmbd: override fsids for smb2_query_info() Sasha Levin
@ 2024-10-12 11:26 ` Sasha Levin
2024-10-12 11:26 ` [PATCH AUTOSEL 6.6 04/20] usbnet: ipheth: remove extraneous rx URB length check Sasha Levin
` (16 subsequent siblings)
18 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2024-10-12 11:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Oliver Neukum, Foster Snowhill, Georgi Valkov, David S . Miller,
Sasha Levin, edumazet, kuba, pabeni, linux-usb, netdev
From: Oliver Neukum <oneukum@suse.com>
[ Upstream commit e5876b088ba03a62124266fa20d00e65533c7269 ]
ipheth_sndbulk_callback() can submit carrier_work
as a part of its error handling. That means that
the driver must make sure that the work is cancelled
after it has made sure that no more URB can terminate
with an error condition.
Hence the order of actions in ipheth_close() needs
to be inverted.
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Foster Snowhill <forst@pen.gy>
Tested-by: Georgi Valkov <gvalkov@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/usb/ipheth.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
index 687d70cfc5563..6eeef10edadad 100644
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -475,8 +475,8 @@ static int ipheth_close(struct net_device *net)
{
struct ipheth_device *dev = netdev_priv(net);
- cancel_delayed_work_sync(&dev->carrier_work);
netif_stop_queue(net);
+ cancel_delayed_work_sync(&dev->carrier_work);
return 0;
}
--
2.43.0
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH AUTOSEL 6.6 04/20] usbnet: ipheth: remove extraneous rx URB length check
2024-10-12 11:26 [PATCH AUTOSEL 6.6 01/20] ksmbd: override fsids for share path check Sasha Levin
2024-10-12 11:26 ` [PATCH AUTOSEL 6.6 02/20] ksmbd: override fsids for smb2_query_info() Sasha Levin
2024-10-12 11:26 ` [PATCH AUTOSEL 6.6 03/20] usbnet: ipheth: race between ipheth_close and error handling Sasha Levin
@ 2024-10-12 11:26 ` Sasha Levin
2024-10-12 11:26 ` [PATCH AUTOSEL 6.6 05/20] usbnet: ipheth: drop RX URBs with no payload Sasha Levin
` (15 subsequent siblings)
18 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2024-10-12 11:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Foster Snowhill, Georgi Valkov, David S . Miller, Sasha Levin,
edumazet, kuba, pabeni, oneukum, linux-usb, netdev
From: Foster Snowhill <forst@pen.gy>
[ Upstream commit 655b46d7a39ac6f049698b27c1568c0f7ff85d1e ]
Rx URB length was already checked in ipheth_rcvbulk_callback_legacy()
and ipheth_rcvbulk_callback_ncm(), depending on the current mode.
The check in ipheth_rcvbulk_callback() was thus mostly a duplicate.
The only place in ipheth_rcvbulk_callback() where we care about the URB
length is for the initial control frame. These frames are always 4 bytes
long. This has been checked as far back as iOS 4.2.1 on iPhone 3G.
Remove the extraneous URB length check. For control frames, check for
the specific 4-byte length instead.
Signed-off-by: Foster Snowhill <forst@pen.gy>
Tested-by: Georgi Valkov <gvalkov@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/usb/ipheth.c | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)
diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
index 6eeef10edadad..017255615508f 100644
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -286,11 +286,6 @@ static void ipheth_rcvbulk_callback(struct urb *urb)
return;
}
- if (urb->actual_length <= IPHETH_IP_ALIGN) {
- dev->net->stats.rx_length_errors++;
- return;
- }
-
/* RX URBs starting with 0x00 0x01 do not encapsulate Ethernet frames,
* but rather are control frames. Their purpose is not documented, and
* they don't affect driver functionality, okay to drop them.
@@ -298,7 +293,8 @@ static void ipheth_rcvbulk_callback(struct urb *urb)
* URB received from the bulk IN endpoint.
*/
if (unlikely
- (((char *)urb->transfer_buffer)[0] == 0 &&
+ (urb->actual_length == 4 &&
+ ((char *)urb->transfer_buffer)[0] == 0 &&
((char *)urb->transfer_buffer)[1] == 1))
goto rx_submit;
--
2.43.0
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH AUTOSEL 6.6 05/20] usbnet: ipheth: drop RX URBs with no payload
2024-10-12 11:26 [PATCH AUTOSEL 6.6 01/20] ksmbd: override fsids for share path check Sasha Levin
` (2 preceding siblings ...)
2024-10-12 11:26 ` [PATCH AUTOSEL 6.6 04/20] usbnet: ipheth: remove extraneous rx URB length check Sasha Levin
@ 2024-10-12 11:26 ` Sasha Levin
2024-10-12 11:26 ` [PATCH AUTOSEL 6.6 06/20] usbnet: ipheth: do not stop RX on failing RX callback Sasha Levin
` (14 subsequent siblings)
18 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2024-10-12 11:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Foster Snowhill, David S . Miller, Sasha Levin, edumazet, kuba,
pabeni, oneukum, linux-usb, netdev
From: Foster Snowhill <forst@pen.gy>
[ Upstream commit 94d7eeb6c0ef0310992944f0d0296929816a2cb0 ]
On iPhone 15 Pro Max one can observe periodic URBs with no payload
on the "bulk in" (RX) endpoint. These don't seem to do anything
meaningful. Reproduced on iOS 17.5.1 and 17.6.
This behaviour isn't observed on iPhone 11 on the same iOS version. The
nature of these zero-length URBs is so far unknown.
Drop RX URBs with no payload.
Signed-off-by: Foster Snowhill <forst@pen.gy>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/usb/ipheth.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
index 017255615508f..f04c7bf796654 100644
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -286,6 +286,12 @@ static void ipheth_rcvbulk_callback(struct urb *urb)
return;
}
+ /* iPhone may periodically send URBs with no payload
+ * on the "bulk in" endpoint. It is safe to ignore them.
+ */
+ if (urb->actual_length == 0)
+ goto rx_submit;
+
/* RX URBs starting with 0x00 0x01 do not encapsulate Ethernet frames,
* but rather are control frames. Their purpose is not documented, and
* they don't affect driver functionality, okay to drop them.
--
2.43.0
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH AUTOSEL 6.6 06/20] usbnet: ipheth: do not stop RX on failing RX callback
2024-10-12 11:26 [PATCH AUTOSEL 6.6 01/20] ksmbd: override fsids for share path check Sasha Levin
` (3 preceding siblings ...)
2024-10-12 11:26 ` [PATCH AUTOSEL 6.6 05/20] usbnet: ipheth: drop RX URBs with no payload Sasha Levin
@ 2024-10-12 11:26 ` Sasha Levin
2024-10-12 11:26 ` [PATCH AUTOSEL 6.6 07/20] usbnet: ipheth: fix carrier detection in modes 1 and 4 Sasha Levin
` (13 subsequent siblings)
18 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2024-10-12 11:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Foster Snowhill, David S . Miller, Sasha Levin, edumazet, kuba,
pabeni, oneukum, linux-usb, netdev
From: Foster Snowhill <forst@pen.gy>
[ Upstream commit 74efed51e0a4d62f998f806c307778b47fc73395 ]
RX callbacks can fail for multiple reasons:
* Payload too short
* Payload formatted incorrecly (e.g. bad NCM framing)
* Lack of memory
None of these should cause the driver to seize up.
Make such failures non-critical and continue processing further
incoming URBs.
Signed-off-by: Foster Snowhill <forst@pen.gy>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/usb/ipheth.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
index f04c7bf796654..cdc72559790a6 100644
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -308,7 +308,6 @@ static void ipheth_rcvbulk_callback(struct urb *urb)
if (retval != 0) {
dev_err(&dev->intf->dev, "%s: callback retval: %d\n",
__func__, retval);
- return;
}
rx_submit:
--
2.43.0
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH AUTOSEL 6.6 07/20] usbnet: ipheth: fix carrier detection in modes 1 and 4
2024-10-12 11:26 [PATCH AUTOSEL 6.6 01/20] ksmbd: override fsids for share path check Sasha Levin
` (4 preceding siblings ...)
2024-10-12 11:26 ` [PATCH AUTOSEL 6.6 06/20] usbnet: ipheth: do not stop RX on failing RX callback Sasha Levin
@ 2024-10-12 11:26 ` Sasha Levin
2024-10-12 11:26 ` [PATCH AUTOSEL 6.6 08/20] kbuild: rust: skip -fmin-function-alignment in bindgen flags Sasha Levin
` (12 subsequent siblings)
18 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2024-10-12 11:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Foster Snowhill, Georgi Valkov, David S . Miller, Sasha Levin,
edumazet, kuba, pabeni, oneukum, linux-usb, netdev
From: Foster Snowhill <forst@pen.gy>
[ Upstream commit 67927a1b255d883881be9467508e0af9a5e0be9d ]
Apart from the standard "configurations", "interfaces" and "alternate
interface settings" in USB, iOS devices also have a notion of
"modes". In different modes, the device exposes a different set of
available configurations.
Depending on the iOS version, and depending on the current mode, the
length and contents of the carrier state control message differs:
* 1 byte (seen on iOS 4.2.1, 8.4):
* 03: carrier off (mode 0)
* 04: carrier on (mode 0)
* 3 bytes (seen on iOS 10.3.4, 15.7.6):
* 03 03 03: carrier off (mode 0)
* 04 04 03: carrier on (mode 0)
* 4 bytes (seen on iOS 16.5, 17.6):
* 03 03 03 00: carrier off (mode 0)
* 04 03 03 00: carrier off (mode 1)
* 06 03 03 00: carrier off (mode 4)
* 04 04 03 04: carrier on (mode 0 and 1)
* 06 04 03 04: carrier on (mode 4)
Before this change, the driver always used the first byte of the
response to determine carrier state.
From this larger sample, the first byte seems to indicate the number of
available USB configurations in the current mode (with the exception of
the default mode 0), and in some cases (namely mode 1 and 4) does not
correlate with the carrier state.
Previous logic erroneously counted `04 03 03 00` as "carrier on" and
`06 04 03 04` as "carrier off" on iOS versions that support mode 1 and
mode 4 respectively.
Only modes 0, 1 and 4 expose the USB Ethernet interfaces necessary for
the ipheth driver.
Check the second byte of the control message where possible, and fall
back to checking the first byte on older iOS versions.
Signed-off-by: Foster Snowhill <forst@pen.gy>
Tested-by: Georgi Valkov <gvalkov@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/usb/ipheth.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
index cdc72559790a6..46afb95ffabe3 100644
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -355,13 +355,14 @@ static int ipheth_carrier_set(struct ipheth_device *dev)
0x02, /* index */
dev->ctrl_buf, IPHETH_CTRL_BUF_SIZE,
IPHETH_CTRL_TIMEOUT);
- if (retval < 0) {
+ if (retval <= 0) {
dev_err(&dev->intf->dev, "%s: usb_control_msg: %d\n",
__func__, retval);
return retval;
}
- if (dev->ctrl_buf[0] == IPHETH_CARRIER_ON) {
+ if ((retval == 1 && dev->ctrl_buf[0] == IPHETH_CARRIER_ON) ||
+ (retval >= 2 && dev->ctrl_buf[1] == IPHETH_CARRIER_ON)) {
netif_carrier_on(dev->net);
if (dev->tx_urb->status != -EINPROGRESS)
netif_wake_queue(dev->net);
--
2.43.0
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH AUTOSEL 6.6 08/20] kbuild: rust: skip -fmin-function-alignment in bindgen flags
2024-10-12 11:26 [PATCH AUTOSEL 6.6 01/20] ksmbd: override fsids for share path check Sasha Levin
` (5 preceding siblings ...)
2024-10-12 11:26 ` [PATCH AUTOSEL 6.6 07/20] usbnet: ipheth: fix carrier detection in modes 1 and 4 Sasha Levin
@ 2024-10-12 11:26 ` Sasha Levin
2024-10-12 11:26 ` [PATCH AUTOSEL 6.6 09/20] rust: add intrinsics to fix `-Os` builds Sasha Levin
` (11 subsequent siblings)
18 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2024-10-12 11:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Zehui Xu, Alice Ryhl, Neal Gompa, Gary Guo, Miguel Ojeda,
Sasha Levin, alex.gaynor, rust-for-linux
From: Zehui Xu <zehuixu@whu.edu.cn>
[ Upstream commit 869b5016e94eced02f2cf99bf53c69b49adcee32 ]
GCC 14 recently added -fmin-function-alignment option and the
root Makefile uses it to replace -falign-functions when available.
However, this flag can cause issues when passed to the Rust
Makefile and affect the bindgen process. Bindgen relies on
libclang to parse C code, and currently does not support the
-fmin-function-alignment flag, leading to compilation failures
when GCC 14 is used.
This patch addresses the issue by adding -fmin-function-alignment
to the bindgen_skip_c_flags in rust/Makefile. This prevents the
flag from causing compilation issues.
[ Matthew and Gary confirm function alignment should not change
the ABI in a way that bindgen would care about, thus we did
not need the extra logic for bindgen from v2. - Miguel ]
Link: https://lore.kernel.org/linux-kbuild/20240222133500.16991-1-petr.pavlu@suse.com/
Signed-off-by: Zehui Xu <zehuixu@whu.edu.cn>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Reviewed-by: Neal Gompa <neal@gompa.dev>
Reviewed-by: Gary Guo <gary@garyguo.net>
Link: https://lore.kernel.org/r/20240731134346.10630-1-zehuixu@whu.edu.cn
[ Reworded title. - Miguel ]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
rust/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/rust/Makefile b/rust/Makefile
index e5619f25b55ca..060ba8cfa9149 100644
--- a/rust/Makefile
+++ b/rust/Makefile
@@ -288,7 +288,7 @@ bindgen_skip_c_flags := -mno-fp-ret-in-387 -mpreferred-stack-boundary=% \
-fno-reorder-blocks -fno-allow-store-data-races -fasan-shadow-offset=% \
-fzero-call-used-regs=% -fno-stack-clash-protection \
-fno-inline-functions-called-once -fsanitize=bounds-strict \
- -fstrict-flex-arrays=% \
+ -fstrict-flex-arrays=% -fmin-function-alignment=% \
--param=% --param asan-%
# Derived from `scripts/Makefile.clang`.
--
2.43.0
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH AUTOSEL 6.6 09/20] rust: add intrinsics to fix `-Os` builds
2024-10-12 11:26 [PATCH AUTOSEL 6.6 01/20] ksmbd: override fsids for share path check Sasha Levin
` (6 preceding siblings ...)
2024-10-12 11:26 ` [PATCH AUTOSEL 6.6 08/20] kbuild: rust: skip -fmin-function-alignment in bindgen flags Sasha Levin
@ 2024-10-12 11:26 ` Sasha Levin
2024-10-12 11:26 ` [PATCH AUTOSEL 6.6 10/20] net: ethernet: use ip_hdrlen() instead of bit shift Sasha Levin
` (10 subsequent siblings)
18 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2024-10-12 11:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Miguel Ojeda, Gary Guo, Alice Ryhl, Trevor Gross, Boqun Feng,
Sasha Levin, alex.gaynor, nathan, rust-for-linux, llvm
From: Miguel Ojeda <ojeda@kernel.org>
[ Upstream commit 02dfd63afe65f7bacad543ba2b10f77083ae7929 ]
Alice reported [1] that an arm64 build failed with:
ld.lld: error: undefined symbol: __extendsfdf2
>>> referenced by core.a6f5fc5794e7b7b3-cgu.0
>>> rust/core.o:(<f32>::midpoint) in archive vmlinux.a
>>> referenced by core.a6f5fc5794e7b7b3-cgu.0
>>> rust/core.o:(<f32>::midpoint) in archive vmlinux.a
ld.lld: error: undefined symbol: __truncdfsf2
>>> referenced by core.a6f5fc5794e7b7b3-cgu.0
>>> rust/core.o:(<f32>::midpoint) in archive vmlinux.a
Rust 1.80.0 or later together with `CONFIG_CC_OPTIMIZE_FOR_SIZE=y`
is what triggers it.
In addition, x86_64 builds also fail the same way.
Similarly, compiling with Rust 1.82.0 (currently in nightly) makes
another one appear, possibly due to the LLVM 19 upgrade there:
ld.lld: error: undefined symbol: __eqdf2
>>> referenced by core.20495ea57a9f069d-cgu.0
>>> rust/core.o:(<f64>::next_up) in archive vmlinux.a
>>> referenced by core.20495ea57a9f069d-cgu.0
>>> rust/core.o:(<f64>::next_down) in archive vmlinux.a
Gary adds [1]:
> Usually the fix on rustc side is to mark those functions as `#[inline]`
>
> All of {midpoint,next_up,next_down} are indeed unstable functions not
> marked as inline...
Fix all those by adding those intrinsics to our usual workaround.
[ Trevor quickly submitted a fix to upstream Rust [2] that has already
been merged, to be released in Rust 1.82.0 (2024-10-17). - Miguel ]
Cc: Gary Guo <gary@garyguo.net>
Reported-by: Alice Ryhl <aliceryhl@google.com>
Closes: https://rust-for-linux.zulipchat.com/#narrow/stream/x/topic/x/near/455637364 [1]
Reviewed-by: Trevor Gross <tmgross@umich.edu>
Tested-by: Alice Ryhl <aliceryhl@google.com>
Tested-by: Boqun Feng <boqun.feng@gmail.com>
Reviewed-by: Gary Guo <gary@garyguo.net>
Link: https://github.com/rust-lang/rust/pull/128749 [2]
Link: https://lore.kernel.org/r/20240806150619.192882-1-ojeda@kernel.org
[ Shortened Zulip link. - Miguel ]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
rust/Makefile | 4 ++--
rust/compiler_builtins.rs | 3 +++
2 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/rust/Makefile b/rust/Makefile
index 060ba8cfa9149..9e0939b8fa78b 100644
--- a/rust/Makefile
+++ b/rust/Makefile
@@ -411,8 +411,8 @@ rust-analyzer:
$(if $(KBUILD_EXTMOD),$(extmod_prefix),$(objtree))/rust-project.json
redirect-intrinsics = \
- __addsf3 __eqsf2 __gesf2 __lesf2 __ltsf2 __mulsf3 __nesf2 __unordsf2 \
- __adddf3 __ledf2 __ltdf2 __muldf3 __unorddf2 \
+ __addsf3 __eqsf2 __extendsfdf2 __gesf2 __lesf2 __ltsf2 __mulsf3 __nesf2 __truncdfsf2 __unordsf2 \
+ __adddf3 __eqdf2 __ledf2 __ltdf2 __muldf3 __unorddf2 \
__muloti4 __multi3 \
__udivmodti4 __udivti3 __umodti3
diff --git a/rust/compiler_builtins.rs b/rust/compiler_builtins.rs
index bba2922c6ef77..f14b8d7caf899 100644
--- a/rust/compiler_builtins.rs
+++ b/rust/compiler_builtins.rs
@@ -40,16 +40,19 @@ pub extern "C" fn $ident() {
define_panicking_intrinsics!("`f32` should not be used", {
__addsf3,
__eqsf2,
+ __extendsfdf2,
__gesf2,
__lesf2,
__ltsf2,
__mulsf3,
__nesf2,
+ __truncdfsf2,
__unordsf2,
});
define_panicking_intrinsics!("`f64` should not be used", {
__adddf3,
+ __eqdf2,
__ledf2,
__ltdf2,
__muldf3,
--
2.43.0
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH AUTOSEL 6.6 10/20] net: ethernet: use ip_hdrlen() instead of bit shift
2024-10-12 11:26 [PATCH AUTOSEL 6.6 01/20] ksmbd: override fsids for share path check Sasha Levin
` (7 preceding siblings ...)
2024-10-12 11:26 ` [PATCH AUTOSEL 6.6 09/20] rust: add intrinsics to fix `-Os` builds Sasha Levin
@ 2024-10-12 11:26 ` Sasha Levin
2024-10-12 11:26 ` [PATCH AUTOSEL 6.6 11/20] drm: panel-orientation-quirks: Add quirk for Ayn Loki Zero Sasha Levin
` (9 subsequent siblings)
18 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2024-10-12 11:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Moon Yeounsu, Christophe JAILLET, David S . Miller, Sasha Levin,
cooldavid, edumazet, kuba, pabeni, jacob.e.keller, netdev
From: Moon Yeounsu <yyyynoom@gmail.com>
[ Upstream commit 9a039eeb71a42c8b13408a1976e300f3898e1be0 ]
`ip_hdr(skb)->ihl << 2` is the same as `ip_hdrlen(skb)`
Therefore, we should use a well-defined function not a bit shift
to find the header length.
It also compresses two lines to a single line.
Signed-off-by: Moon Yeounsu <yyyynoom@gmail.com>
Reviewed-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/jme.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/drivers/net/ethernet/jme.c b/drivers/net/ethernet/jme.c
index 1732ec3c3dbdc..a718207988f2c 100644
--- a/drivers/net/ethernet/jme.c
+++ b/drivers/net/ethernet/jme.c
@@ -946,15 +946,13 @@ jme_udpsum(struct sk_buff *skb)
if (skb->protocol != htons(ETH_P_IP))
return csum;
skb_set_network_header(skb, ETH_HLEN);
- if ((ip_hdr(skb)->protocol != IPPROTO_UDP) ||
- (skb->len < (ETH_HLEN +
- (ip_hdr(skb)->ihl << 2) +
- sizeof(struct udphdr)))) {
+
+ if (ip_hdr(skb)->protocol != IPPROTO_UDP ||
+ skb->len < (ETH_HLEN + ip_hdrlen(skb) + sizeof(struct udphdr))) {
skb_reset_network_header(skb);
return csum;
}
- skb_set_transport_header(skb,
- ETH_HLEN + (ip_hdr(skb)->ihl << 2));
+ skb_set_transport_header(skb, ETH_HLEN + ip_hdrlen(skb));
csum = udp_hdr(skb)->check;
skb_reset_transport_header(skb);
skb_reset_network_header(skb);
--
2.43.0
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH AUTOSEL 6.6 11/20] drm: panel-orientation-quirks: Add quirk for Ayn Loki Zero
2024-10-12 11:26 [PATCH AUTOSEL 6.6 01/20] ksmbd: override fsids for share path check Sasha Levin
` (8 preceding siblings ...)
2024-10-12 11:26 ` [PATCH AUTOSEL 6.6 10/20] net: ethernet: use ip_hdrlen() instead of bit shift Sasha Levin
@ 2024-10-12 11:26 ` Sasha Levin
2024-10-12 11:26 ` [PATCH AUTOSEL 6.6 12/20] drm: panel-orientation-quirks: Add quirk for Ayn Loki Max Sasha Levin
` (8 subsequent siblings)
18 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2024-10-12 11:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Bouke Sybren Haarsma, Hans de Goede, Sasha Levin,
maarten.lankhorst, mripard, tzimmermann, airlied, daniel,
dri-devel
From: Bouke Sybren Haarsma <boukehaarsma23@gmail.com>
[ Upstream commit b86aa4140f6a8f01f35bfb05af60e01a55b48803 ]
Add quirk orientation for the Ayn Loki Zero.
This also has been tested/used by the JELOS team.
Signed-off-by: Bouke Sybren Haarsma <boukehaarsma23@gmail.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240728124731.168452-2-boukehaarsma23@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
index 5db52d6c5c35c..21f2f3abf90f0 100644
--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
+++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
@@ -208,6 +208,12 @@ static const struct dmi_system_id orientation_data[] = {
DMI_MATCH(DMI_BOARD_NAME, "KUN"),
},
.driver_data = (void *)&lcd1600x2560_rightside_up,
+ }, { /* AYN Loki Zero */
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ayn"),
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Loki Zero"),
+ },
+ .driver_data = (void *)&lcd1080x1920_leftside_up,
}, { /* Chuwi HiBook (CWI514) */
.matches = {
DMI_MATCH(DMI_BOARD_VENDOR, "Hampoo"),
--
2.43.0
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH AUTOSEL 6.6 12/20] drm: panel-orientation-quirks: Add quirk for Ayn Loki Max
2024-10-12 11:26 [PATCH AUTOSEL 6.6 01/20] ksmbd: override fsids for share path check Sasha Levin
` (9 preceding siblings ...)
2024-10-12 11:26 ` [PATCH AUTOSEL 6.6 11/20] drm: panel-orientation-quirks: Add quirk for Ayn Loki Zero Sasha Levin
@ 2024-10-12 11:26 ` Sasha Levin
2024-10-12 11:26 ` [PATCH AUTOSEL 6.6 13/20] net: phy: vitesse: repair vsc73xx autonegotiation Sasha Levin
` (7 subsequent siblings)
18 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2024-10-12 11:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Bouke Sybren Haarsma, Hans de Goede, Sasha Levin,
maarten.lankhorst, mripard, tzimmermann, airlied, daniel,
dri-devel
From: Bouke Sybren Haarsma <boukehaarsma23@gmail.com>
[ Upstream commit 2c71c8459c8ca66bd8f597effaac892ee8448a9f ]
Add quirk orientation for Ayn Loki Max model.
This has been tested by JELOS team that uses their
own patched kernel for a while now and confirmed by
users in the ChimeraOS discord servers.
Signed-off-by: Bouke Sybren Haarsma <boukehaarsma23@gmail.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240728124731.168452-3-boukehaarsma23@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
index 21f2f3abf90f0..df402f6c5dc98 100644
--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
+++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
@@ -208,6 +208,12 @@ static const struct dmi_system_id orientation_data[] = {
DMI_MATCH(DMI_BOARD_NAME, "KUN"),
},
.driver_data = (void *)&lcd1600x2560_rightside_up,
+ }, { /* AYN Loki Max */
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ayn"),
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Loki Max"),
+ },
+ .driver_data = (void *)&lcd1080x1920_leftside_up,
}, { /* AYN Loki Zero */
.matches = {
DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ayn"),
--
2.43.0
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH AUTOSEL 6.6 13/20] net: phy: vitesse: repair vsc73xx autonegotiation
2024-10-12 11:26 [PATCH AUTOSEL 6.6 01/20] ksmbd: override fsids for share path check Sasha Levin
` (10 preceding siblings ...)
2024-10-12 11:26 ` [PATCH AUTOSEL 6.6 12/20] drm: panel-orientation-quirks: Add quirk for Ayn Loki Max Sasha Levin
@ 2024-10-12 11:26 ` Sasha Levin
2024-10-12 11:26 ` [PATCH AUTOSEL 6.6 14/20] powerpc/mm: Fix boot warning with hugepages and CONFIG_DEBUG_VIRTUAL Sasha Levin
` (6 subsequent siblings)
18 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2024-10-12 11:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Pawel Dembicki, Linus Walleij, David S . Miller, Sasha Levin,
andrew, hkallweit1, edumazet, kuba, pabeni, netdev
From: Pawel Dembicki <paweldembicki@gmail.com>
[ Upstream commit de7a670f8defe4ed2115552ad23dea0f432f7be4 ]
When the vsc73xx mdio bus work properly, the generic autonegotiation
configuration works well.
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/phy/vitesse.c | 14 --------------
1 file changed, 14 deletions(-)
diff --git a/drivers/net/phy/vitesse.c b/drivers/net/phy/vitesse.c
index 897b979ec03c8..3b5fcaf0dd36d 100644
--- a/drivers/net/phy/vitesse.c
+++ b/drivers/net/phy/vitesse.c
@@ -237,16 +237,6 @@ static int vsc739x_config_init(struct phy_device *phydev)
return 0;
}
-static int vsc73xx_config_aneg(struct phy_device *phydev)
-{
- /* The VSC73xx switches does not like to be instructed to
- * do autonegotiation in any way, it prefers that you just go
- * with the power-on/reset defaults. Writing some registers will
- * just make autonegotiation permanently fail.
- */
- return 0;
-}
-
/* This adds a skew for both TX and RX clocks, so the skew should only be
* applied to "rgmii-id" interfaces. It may not work as expected
* on "rgmii-txid", "rgmii-rxid" or "rgmii" interfaces.
@@ -444,7 +434,6 @@ static struct phy_driver vsc82xx_driver[] = {
.phy_id_mask = 0x000ffff0,
/* PHY_GBIT_FEATURES */
.config_init = vsc738x_config_init,
- .config_aneg = vsc73xx_config_aneg,
.read_page = vsc73xx_read_page,
.write_page = vsc73xx_write_page,
}, {
@@ -453,7 +442,6 @@ static struct phy_driver vsc82xx_driver[] = {
.phy_id_mask = 0x000ffff0,
/* PHY_GBIT_FEATURES */
.config_init = vsc738x_config_init,
- .config_aneg = vsc73xx_config_aneg,
.read_page = vsc73xx_read_page,
.write_page = vsc73xx_write_page,
}, {
@@ -462,7 +450,6 @@ static struct phy_driver vsc82xx_driver[] = {
.phy_id_mask = 0x000ffff0,
/* PHY_GBIT_FEATURES */
.config_init = vsc739x_config_init,
- .config_aneg = vsc73xx_config_aneg,
.read_page = vsc73xx_read_page,
.write_page = vsc73xx_write_page,
}, {
@@ -471,7 +458,6 @@ static struct phy_driver vsc82xx_driver[] = {
.phy_id_mask = 0x000ffff0,
/* PHY_GBIT_FEATURES */
.config_init = vsc739x_config_init,
- .config_aneg = vsc73xx_config_aneg,
.read_page = vsc73xx_read_page,
.write_page = vsc73xx_write_page,
}, {
--
2.43.0
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH AUTOSEL 6.6 14/20] powerpc/mm: Fix boot warning with hugepages and CONFIG_DEBUG_VIRTUAL
2024-10-12 11:26 [PATCH AUTOSEL 6.6 01/20] ksmbd: override fsids for share path check Sasha Levin
` (11 preceding siblings ...)
2024-10-12 11:26 ` [PATCH AUTOSEL 6.6 13/20] net: phy: vitesse: repair vsc73xx autonegotiation Sasha Levin
@ 2024-10-12 11:26 ` Sasha Levin
2024-10-12 11:26 ` [PATCH AUTOSEL 6.6 15/20] wifi: mt76: mt7921: fix NULL pointer access in mt7921_ipv6_addr_change Sasha Levin
` (5 subsequent siblings)
18 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2024-10-12 11:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Christophe Leroy, Michael Ellerman, Sasha Levin, hbathini, arnd,
robh, thorsten.blum, bhe, rppt, mcgrof, tzimmermann,
kent.overstreet, linuxppc-dev
From: Christophe Leroy <christophe.leroy@csgroup.eu>
[ Upstream commit e7e846dc6c73fbc94ae8b4ec20d05627646416f2 ]
Booting with CONFIG_DEBUG_VIRTUAL leads to following warning when
passing hugepage reservation on command line:
Kernel command line: hugepagesz=1g hugepages=1 hugepagesz=64m hugepages=1 hugepagesz=256m hugepages=1 noreboot
HugeTLB: allocating 1 of page size 1.00 GiB failed. Only allocated 0 hugepages.
------------[ cut here ]------------
WARNING: CPU: 0 PID: 0 at arch/powerpc/include/asm/io.h:948 __alloc_bootmem_huge_page+0xd4/0x284
Modules linked in:
CPU: 0 PID: 0 Comm: swapper Not tainted 6.10.0-rc6-00396-g6b0e82791bd0-dirty #936
Hardware name: MPC8544DS e500v2 0x80210030 MPC8544 DS
NIP: c1020240 LR: c10201d0 CTR: 00000000
REGS: c13fdd30 TRAP: 0700 Not tainted (6.10.0-rc6-00396-g6b0e82791bd0-dirty)
MSR: 00021000 <CE,ME> CR: 44084288 XER: 20000000
GPR00: c10201d0 c13fde20 c130b560 e8000000 e8001000 00000000 00000000 c1420000
GPR08: 00000000 00028001 00000000 00000004 44084282 01066ac0 c0eb7c9c efffe149
GPR16: c0fc4228 0000005f ffffffff c0eb7d0c c0eb7cc0 c0eb7ce0 ffffffff 00000000
GPR24: c1441cec efffe153 e8001000 c14240c0 00000000 c1441d64 00000000 e8000000
NIP [c1020240] __alloc_bootmem_huge_page+0xd4/0x284
LR [c10201d0] __alloc_bootmem_huge_page+0x64/0x284
Call Trace:
[c13fde20] [c10201d0] __alloc_bootmem_huge_page+0x64/0x284 (unreliable)
[c13fde50] [c10207b8] hugetlb_hstate_alloc_pages+0x8c/0x3e8
[c13fdeb0] [c1021384] hugepages_setup+0x240/0x2cc
[c13fdef0] [c1000574] unknown_bootoption+0xfc/0x280
[c13fdf30] [c0078904] parse_args+0x200/0x4c4
[c13fdfa0] [c1000d9c] start_kernel+0x238/0x7d0
[c13fdff0] [c0000434] set_ivor+0x12c/0x168
Code: 554aa33e 7c042840 3ce0c142 80a7427c 5109a016 50caa016 7c9a2378 7fdcf378 4180000c 7c052040 41810160 7c095040 <0fe00000> 38c00000 40800108 3c60c0eb
---[ end trace 0000000000000000 ]---
This is due to virt_addr_valid() using high_memory before it is set.
high_memory is set in mem_init() using max_low_pfn, but max_low_pfn
is available long before, it is set in mem_topology_setup(). So just
like commit daa9ada2093e ("powerpc/mm: Fix boot crash with FLATMEM")
moved the setting of max_mapnr immediately after the call to
mem_topology_setup(), the same can be done for high_memory.
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/62b69c4baad067093f39e7e60df0fe27a86b8d2a.1723100702.git.christophe.leroy@csgroup.eu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/kernel/setup-common.c | 1 +
arch/powerpc/mm/mem.c | 2 --
2 files changed, 1 insertion(+), 2 deletions(-)
diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c
index 20f72cd1d8138..03eaad5949f14 100644
--- a/arch/powerpc/kernel/setup-common.c
+++ b/arch/powerpc/kernel/setup-common.c
@@ -950,6 +950,7 @@ void __init setup_arch(char **cmdline_p)
mem_topology_setup();
/* Set max_mapnr before paging_init() */
set_max_mapnr(max_pfn);
+ high_memory = (void *)__va(max_low_pfn * PAGE_SIZE);
/*
* Release secondary cpus out of their spinloops at 0x60 now that
diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c
index 07e8f4f1e07f8..9dbef559af4cb 100644
--- a/arch/powerpc/mm/mem.c
+++ b/arch/powerpc/mm/mem.c
@@ -287,8 +287,6 @@ void __init mem_init(void)
swiotlb_init(ppc_swiotlb_enable, ppc_swiotlb_flags);
#endif
- high_memory = (void *) __va(max_low_pfn * PAGE_SIZE);
-
kasan_late_init();
memblock_free_all();
--
2.43.0
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH AUTOSEL 6.6 15/20] wifi: mt76: mt7921: fix NULL pointer access in mt7921_ipv6_addr_change
2024-10-12 11:26 [PATCH AUTOSEL 6.6 01/20] ksmbd: override fsids for share path check Sasha Levin
` (12 preceding siblings ...)
2024-10-12 11:26 ` [PATCH AUTOSEL 6.6 14/20] powerpc/mm: Fix boot warning with hugepages and CONFIG_DEBUG_VIRTUAL Sasha Levin
@ 2024-10-12 11:26 ` Sasha Levin
2024-10-12 11:26 ` [PATCH AUTOSEL 6.6 16/20] Squashfs: sanity check symbolic link size Sasha Levin
` (4 subsequent siblings)
18 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2024-10-12 11:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Bert Karwatzki, Felix Fietkau, Kalle Valo, Sasha Levin, lorenzo,
ryder.lee, matthias.bgg, angelogioacchino.delregno, sean.wang,
deren.wu, mingyen.hsieh, johannes.berg, hao.zhang,
emmanuel.grumbach, leon.yen, linux-wireless, linux-arm-kernel,
linux-mediatek
From: Bert Karwatzki <spasswolf@web.de>
[ Upstream commit 479ffee68d59c599f8aed8fa2dcc8e13e7bd13c3 ]
When disabling wifi mt7921_ipv6_addr_change() is called as a notifier.
At this point mvif->phy is already NULL so we cannot use it here.
Signed-off-by: Bert Karwatzki <spasswolf@web.de>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://patch.msgid.link/20240812104542.80760-1-spasswolf@web.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7921/main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
index d8851cb5f400b..da17a29a4ce57 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
@@ -1095,7 +1095,7 @@ static void mt7921_ipv6_addr_change(struct ieee80211_hw *hw,
struct inet6_dev *idev)
{
struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
- struct mt792x_dev *dev = mvif->phy->dev;
+ struct mt792x_dev *dev = mt792x_hw_dev(hw);
struct inet6_ifaddr *ifa;
struct in6_addr ns_addrs[IEEE80211_BSS_ARP_ADDR_LIST_LEN];
struct sk_buff *skb;
--
2.43.0
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH AUTOSEL 6.6 16/20] Squashfs: sanity check symbolic link size
2024-10-12 11:26 [PATCH AUTOSEL 6.6 01/20] ksmbd: override fsids for share path check Sasha Levin
` (13 preceding siblings ...)
2024-10-12 11:26 ` [PATCH AUTOSEL 6.6 15/20] wifi: mt76: mt7921: fix NULL pointer access in mt7921_ipv6_addr_change Sasha Levin
@ 2024-10-12 11:26 ` Sasha Levin
2024-10-12 11:26 ` [PATCH AUTOSEL 6.6 17/20] of/irq: Prevent device address out-of-bounds read in interrupt map walk Sasha Levin
` (3 subsequent siblings)
18 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2024-10-12 11:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Phillip Lougher, Lizhi Xu, syzbot+24ac24ff58dc5b0d26b9,
Christian Brauner, Sasha Levin
From: Phillip Lougher <phillip@squashfs.org.uk>
[ Upstream commit 810ee43d9cd245d138a2733d87a24858a23f577d ]
Syzkiller reports a "KMSAN: uninit-value in pick_link" bug.
This is caused by an uninitialised page, which is ultimately caused
by a corrupted symbolic link size read from disk.
The reason why the corrupted symlink size causes an uninitialised
page is due to the following sequence of events:
1. squashfs_read_inode() is called to read the symbolic
link from disk. This assigns the corrupted value
3875536935 to inode->i_size.
2. Later squashfs_symlink_read_folio() is called, which assigns
this corrupted value to the length variable, which being a
signed int, overflows producing a negative number.
3. The following loop that fills in the page contents checks that
the copied bytes is less than length, which being negative means
the loop is skipped, producing an uninitialised page.
This patch adds a sanity check which checks that the symbolic
link size is not larger than expected.
--
Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
Link: https://lore.kernel.org/r/20240811232821.13903-1-phillip@squashfs.org.uk
Reported-by: Lizhi Xu <lizhi.xu@windriver.com>
Reported-by: syzbot+24ac24ff58dc5b0d26b9@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/000000000000a90e8c061e86a76b@google.com/
V2: fix spelling mistake.
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/squashfs/inode.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/fs/squashfs/inode.c b/fs/squashfs/inode.c
index 16bd693d0b3aa..d5918eba27e37 100644
--- a/fs/squashfs/inode.c
+++ b/fs/squashfs/inode.c
@@ -279,8 +279,13 @@ int squashfs_read_inode(struct inode *inode, long long ino)
if (err < 0)
goto failed_read;
- set_nlink(inode, le32_to_cpu(sqsh_ino->nlink));
inode->i_size = le32_to_cpu(sqsh_ino->symlink_size);
+ if (inode->i_size > PAGE_SIZE) {
+ ERROR("Corrupted symlink\n");
+ return -EINVAL;
+ }
+
+ set_nlink(inode, le32_to_cpu(sqsh_ino->nlink));
inode->i_op = &squashfs_symlink_inode_ops;
inode_nohighmem(inode);
inode->i_data.a_ops = &squashfs_symlink_aops;
--
2.43.0
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH AUTOSEL 6.6 17/20] of/irq: Prevent device address out-of-bounds read in interrupt map walk
2024-10-12 11:26 [PATCH AUTOSEL 6.6 01/20] ksmbd: override fsids for share path check Sasha Levin
` (14 preceding siblings ...)
2024-10-12 11:26 ` [PATCH AUTOSEL 6.6 16/20] Squashfs: sanity check symbolic link size Sasha Levin
@ 2024-10-12 11:26 ` Sasha Levin
2024-10-12 11:26 ` [PATCH AUTOSEL 6.6 18/20] lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() Sasha Levin
` (2 subsequent siblings)
18 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2024-10-12 11:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Stefan Wiehler, Rob Herring, Sasha Levin, saravanak, devicetree
From: Stefan Wiehler <stefan.wiehler@nokia.com>
[ Upstream commit b739dffa5d570b411d4bdf4bb9b8dfd6b7d72305 ]
When of_irq_parse_raw() is invoked with a device address smaller than
the interrupt parent node (from #address-cells property), KASAN detects
the following out-of-bounds read when populating the initial match table
(dyndbg="func of_irq_parse_* +p"):
OF: of_irq_parse_one: dev=/soc@0/picasso/watchdog, index=0
OF: parent=/soc@0/pci@878000000000/gpio0@17,0, intsize=2
OF: intspec=4
OF: of_irq_parse_raw: ipar=/soc@0/pci@878000000000/gpio0@17,0, size=2
OF: -> addrsize=3
==================================================================
BUG: KASAN: slab-out-of-bounds in of_irq_parse_raw+0x2b8/0x8d0
Read of size 4 at addr ffffff81beca5608 by task bash/764
CPU: 1 PID: 764 Comm: bash Tainted: G O 6.1.67-484c613561-nokia_sm_arm64 #1
Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.01-12.24.03-dirty 01/01/2023
Call trace:
dump_backtrace+0xdc/0x130
show_stack+0x1c/0x30
dump_stack_lvl+0x6c/0x84
print_report+0x150/0x448
kasan_report+0x98/0x140
__asan_load4+0x78/0xa0
of_irq_parse_raw+0x2b8/0x8d0
of_irq_parse_one+0x24c/0x270
parse_interrupts+0xc0/0x120
of_fwnode_add_links+0x100/0x2d0
fw_devlink_parse_fwtree+0x64/0xc0
device_add+0xb38/0xc30
of_device_add+0x64/0x90
of_platform_device_create_pdata+0xd0/0x170
of_platform_bus_create+0x244/0x600
of_platform_notify+0x1b0/0x254
blocking_notifier_call_chain+0x9c/0xd0
__of_changeset_entry_notify+0x1b8/0x230
__of_changeset_apply_notify+0x54/0xe4
of_overlay_fdt_apply+0xc04/0xd94
...
The buggy address belongs to the object at ffffff81beca5600
which belongs to the cache kmalloc-128 of size 128
The buggy address is located 8 bytes inside of
128-byte region [ffffff81beca5600, ffffff81beca5680)
The buggy address belongs to the physical page:
page:00000000230d3d03 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1beca4
head:00000000230d3d03 order:1 compound_mapcount:0 compound_pincount:0
flags: 0x8000000000010200(slab|head|zone=2)
raw: 8000000000010200 0000000000000000 dead000000000122 ffffff810000c300
raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffffff81beca5500: 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffffff81beca5580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffffff81beca5600: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffffff81beca5680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffffff81beca5700: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
==================================================================
OF: -> got it !
Prevent the out-of-bounds read by copying the device address into a
buffer of sufficient size.
Signed-off-by: Stefan Wiehler <stefan.wiehler@nokia.com>
Link: https://lore.kernel.org/r/20240812100652.3800963-1-stefan.wiehler@nokia.com
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/of/irq.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
diff --git a/drivers/of/irq.c b/drivers/of/irq.c
index c94203ce65bb3..8fd63100ba8f0 100644
--- a/drivers/of/irq.c
+++ b/drivers/of/irq.c
@@ -344,7 +344,8 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar
struct device_node *p;
const __be32 *addr;
u32 intsize;
- int i, res;
+ int i, res, addr_len;
+ __be32 addr_buf[3] = { 0 };
pr_debug("of_irq_parse_one: dev=%pOF, index=%d\n", device, index);
@@ -353,13 +354,19 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar
return of_irq_parse_oldworld(device, index, out_irq);
/* Get the reg property (if any) */
- addr = of_get_property(device, "reg", NULL);
+ addr = of_get_property(device, "reg", &addr_len);
+
+ /* Prevent out-of-bounds read in case of longer interrupt parent address size */
+ if (addr_len > (3 * sizeof(__be32)))
+ addr_len = 3 * sizeof(__be32);
+ if (addr)
+ memcpy(addr_buf, addr, addr_len);
/* Try the new-style interrupts-extended first */
res = of_parse_phandle_with_args(device, "interrupts-extended",
"#interrupt-cells", index, out_irq);
if (!res)
- return of_irq_parse_raw(addr, out_irq);
+ return of_irq_parse_raw(addr_buf, out_irq);
/* Look for the interrupt parent. */
p = of_irq_find_parent(device);
@@ -389,7 +396,7 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar
/* Check if there are any interrupt-map translations to process */
- res = of_irq_parse_raw(addr, out_irq);
+ res = of_irq_parse_raw(addr_buf, out_irq);
out:
of_node_put(p);
return res;
--
2.43.0
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH AUTOSEL 6.6 18/20] lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()
2024-10-12 11:26 [PATCH AUTOSEL 6.6 01/20] ksmbd: override fsids for share path check Sasha Levin
` (15 preceding siblings ...)
2024-10-12 11:26 ` [PATCH AUTOSEL 6.6 17/20] of/irq: Prevent device address out-of-bounds read in interrupt map walk Sasha Levin
@ 2024-10-12 11:26 ` Sasha Levin
2024-10-12 11:26 ` [PATCH AUTOSEL 6.6 19/20] net: hns3: use correct release function during uninitialization Sasha Levin
2024-10-12 11:26 ` [PATCH AUTOSEL 6.6 20/20] btrfs: update target inode's ctime on unlink Sasha Levin
18 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2024-10-12 11:26 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Kent Overstreet, Sasha Levin
From: Kent Overstreet <kent.overstreet@linux.dev>
[ Upstream commit b2f11c6f3e1fc60742673b8675c95b78447f3dae ]
If we need to increase the tree depth, allocate a new node, and then
race with another thread that increased the tree depth before us, we'll
still have a preallocated node that might be used later.
If we then use that node for a new non-root node, it'll still have a
pointer to the old root instead of being zeroed - fix this by zeroing it
in the cmpxchg failure path.
Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/generic-radix-tree.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/lib/generic-radix-tree.c b/lib/generic-radix-tree.c
index 7dfa88282b006..78f081d695d0b 100644
--- a/lib/generic-radix-tree.c
+++ b/lib/generic-radix-tree.c
@@ -131,6 +131,8 @@ void *__genradix_ptr_alloc(struct __genradix *radix, size_t offset,
if ((v = cmpxchg_release(&radix->root, r, new_root)) == r) {
v = new_root;
new_node = NULL;
+ } else {
+ new_node->children[0] = NULL;
}
}
--
2.43.0
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH AUTOSEL 6.6 19/20] net: hns3: use correct release function during uninitialization
2024-10-12 11:26 [PATCH AUTOSEL 6.6 01/20] ksmbd: override fsids for share path check Sasha Levin
` (16 preceding siblings ...)
2024-10-12 11:26 ` [PATCH AUTOSEL 6.6 18/20] lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() Sasha Levin
@ 2024-10-12 11:26 ` Sasha Levin
2024-10-12 11:26 ` [PATCH AUTOSEL 6.6 20/20] btrfs: update target inode's ctime on unlink Sasha Levin
18 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2024-10-12 11:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Peiyang Wang, Jijie Shao, Paolo Abeni, Sasha Levin, yisen.zhuang,
salil.mehta, davem, edumazet, kuba, horms, liuyonglong, lanhao,
shenjian15, chenhao418, netdev
From: Peiyang Wang <wangpeiyang1@huawei.com>
[ Upstream commit 7660833d217528c8f2385528951ab820a031e4e3 ]
pci_request_regions is called to apply for PCI I/O and memory resources
when the driver is initialized, Therefore, when the driver is uninstalled,
pci_release_regions should be used to release PCI I/O and memory resources
instead of pci_release_mem_regions is used to release memory reasouces
only.
Signed-off-by: Peiyang Wang <wangpeiyang1@huawei.com>
Signed-off-by: Jijie Shao <shaojijie@huawei.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
index c8059d96f64be..3b01447478159 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
@@ -11358,7 +11358,7 @@ static void hclge_pci_uninit(struct hclge_dev *hdev)
pcim_iounmap(pdev, hdev->hw.hw.io_base);
pci_free_irq_vectors(pdev);
- pci_release_mem_regions(pdev);
+ pci_release_regions(pdev);
pci_disable_device(pdev);
}
--
2.43.0
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH AUTOSEL 6.6 20/20] btrfs: update target inode's ctime on unlink
2024-10-12 11:26 [PATCH AUTOSEL 6.6 01/20] ksmbd: override fsids for share path check Sasha Levin
` (17 preceding siblings ...)
2024-10-12 11:26 ` [PATCH AUTOSEL 6.6 19/20] net: hns3: use correct release function during uninitialization Sasha Levin
@ 2024-10-12 11:26 ` Sasha Levin
18 siblings, 0 replies; 21+ messages in thread
From: Sasha Levin @ 2024-10-12 11:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jeff Layton, David Sterba, Sasha Levin, clm, josef, linux-btrfs
From: Jeff Layton <jlayton@kernel.org>
[ Upstream commit 3bc2ac2f8f0b78a13140fc72022771efe0c9b778 ]
Unlink changes the link count on the target inode. POSIX mandates that
the ctime must also change when this occurs.
According to https://pubs.opengroup.org/onlinepubs/9699919799/functions/unlink.html:
"Upon successful completion, unlink() shall mark for update the last data
modification and last file status change timestamps of the parent
directory. Also, if the file's link count is not 0, the last file status
change timestamp of the file shall be marked for update."
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: David Sterba <dsterba@suse.com>
[ add link to the opengroup docs ]
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/inode.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 5ddee801a8303..173b16ae510b0 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -4145,6 +4145,7 @@ static int __btrfs_unlink_inode(struct btrfs_trans_handle *trans,
btrfs_i_size_write(dir, dir->vfs_inode.i_size - name->len * 2);
inode_inc_iversion(&inode->vfs_inode);
+ inode_set_ctime_current(&inode->vfs_inode);
inode_inc_iversion(&dir->vfs_inode);
inode_set_ctime_current(&inode->vfs_inode);
dir->vfs_inode.i_mtime = inode_set_ctime_current(&dir->vfs_inode);
--
2.43.0
^ permalink raw reply [flat|nested] 21+ messages in thread