mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-11-13 07:31:07 +00:00
1,385,869 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Samasth Norway Ananda
|
1a194e6c8e |
fbcon: fix integer overflow in fbcon_do_set_font
Fix integer overflow vulnerabilities in fbcon_do_set_font() where font
size calculations could overflow when handling user-controlled font
parameters.
The vulnerabilities occur when:
1. CALC_FONTSZ(h, pitch, charcount) performs h * pith * charcount
multiplication with user-controlled values that can overflow.
2. FONT_EXTRA_WORDS * sizeof(int) + size addition can also overflow
3. This results in smaller allocations than expected, leading to buffer
overflows during font data copying.
Add explicit overflow checking using check_mul_overflow() and
check_add_overflow() kernel helpers to safety validate all size
calculations before allocation.
Signed-off-by: Samasth Norway Ananda <samasth.norway.ananda@oracle.com>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes:
|
||
Paulo Alcantara
|
1cf9f2a6a5 |
smb: client: handle unlink(2) of files open by different clients
In order to identify whether a certain file is open by a different client, start the unlink process by sending a compound request of CREATE(DELETE_ON_CLOSE) + CLOSE with only FILE_SHARE_DELETE bit set in smb2_create_req::ShareAccess. If the file is currently open, then the server will fail the request with STATUS_SHARING_VIOLATION, in which case we'll map it to -EBUSY, so __cifs_unlink() will fall back to silly-rename the file. This fixes the following case where open(O_CREAT) fails with -ENOENT (STATUS_DELETE_PENDING) due to file still open by a different client. * Before patch $ mount.cifs //srv/share /mnt/1 -o ...,nosharesock $ mount.cifs //srv/share /mnt/2 -o ...,nosharesock $ cd /mnt/1 $ touch foo $ exec 3<>foo $ cd /mnt/2 $ rm foo $ touch foo touch: cannot touch 'foo': No such file or directory $ exec 3>&- * After patch $ mount.cifs //srv/share /mnt/1 -o ...,nosharesock $ mount.cifs //srv/share /mnt/2 -o ...,nosharesock $ cd /mnt/1 $ touch foo $ exec 3<>foo $ cd /mnt/2 $ rm foo $ touch foo $ exec 3>&- Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org> Reviewed-by: David Howells <dhowells@redhat.com> Cc: Frank Sorenson <sorenson@redhat.com> Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French <stfrench@microsoft.com> |
||
Stefan Metzmacher
|
f7f8925017 |
smb: server: use disable_work_sync in transport_rdma.c
This makes it safer during the disconnect and avoids
requeueing.
It's ok to call disable_work[_sync]() more than once.
Cc: Namjae Jeon <linkinjeon@kernel.org>
Cc: Steve French <smfrench@gmail.com>
Cc: Tom Talpey <tom@talpey.com>
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Fixes:
|
||
|
Stefan Metzmacher
|
1cde0a74a7 |
smb: server: don't use delayed_work for post_recv_credits_work
If we are using a hardcoded delay of 0 there's no point in
using delayed_work it only adds confusion.
The client also uses a normal work_struct and now
it is easier to move it to the common smbdirect_socket.
Cc: Namjae Jeon <linkinjeon@kernel.org>
Cc: Steve French <smfrench@gmail.com>
Cc: Tom Talpey <tom@talpey.com>
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Fixes:
|
||
Linus Torvalds
|
07e27ad163 | Linux 6.17-rc7 v6.17-rc7 | ||
Peter Hilber
|
cde7e7c3f8 |
MAINTAINERS, mailmap: Update address for Peter Hilber
Going forward, I will use another Qualcomm address, peter.hilber@oss.qualcomm.com. Map past contributions on behalf of Qualcomm to the new address as well. Signed-off-by: Peter Hilber <peter.hilber@oss.qualcomm.com> Message-Id: <20250826130015.6218-1-peter.hilber@oss.qualcomm.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> |
||
Alyssa Ross
|
a05e4e935a |
virtio_config: clarify output parameters
This was ambiguous enough for a broken patch (
|
||
Ashwini Sahu
|
d6d673dd1e |
uapi: vduse: fix typo in comment
Fix a spelling mistake in vduse.h: "regsion" → "region" in the documentation for struct vduse_iova_info. No functional change. Signed-off-by: Ashwini Sahu <ashwini@wisig.com> Message-Id: <20250908095645.610336-1-ashwini@wisig.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> |
||
Sebastian Andrzej Siewior
|
afe16653e0 |
vhost: Take a reference on the task in struct vhost_task.
vhost_task_create() creates a task and keeps a reference to its
task_struct. That task may exit early via a signal and its task_struct
will be released.
A pending vhost_task_wake() will then attempt to wake the task and
access a task_struct which is no longer there.
Acquire a reference on the task_struct while creating the thread and
release the reference while the struct vhost_task itself is removed.
If the task exits early due to a signal, then the vhost_task_wake() will
still access a valid task_struct. The wake is safe and will be skipped
in this case.
Fixes:
|
||
|
Linus Torvalds
|
2d5bd41a45 |
Fixes to the Allwinner and Renesas clk drivers:
- Do the math properly in Allwinner's ccu_mp_recalc_rate() so
clk rates aren't bogus
- Fix a clock domain regression on Renesas R-Car M1A, R-Car H1,
and RZ/A1 by registering the domain after the pmdomain bus is
registered instead of before
-----BEGIN PGP SIGNATURE-----
iQJIBAABCAAyFiEE9L57QeeUxqYDyoaDrQKIl8bklSUFAmjQMOcUHHN3Ym95ZEBj
aHJvbWl1bS5vcmcACgkQrQKIl8bklSUc8hAAhD9IfvCRRwK9iaDBELJLyAqDh5w/
VlfthOukmfw9npSbth16uFvhFDYku7CnRIlCLbJBcQdvQYirC9GDqlApPlw90LLg
RfEaIkKTN67FuRcSZe8KdzzXjbwaaWWEFbFlXdUKse4g2hTR8JFeVDwFszHeeb5G
MZcBaUOp64HumFpUIHx/Evv4eGd3COBL83I/HRQnaElM52tY1Gzmkh1stO6OChmJ
GlYjswereBpSg7UUq1Lh01ARRePz4+IWd7Ybz4ETs6KD0ffCZmJBPpvHOGNBiCfb
e45C/e9h430KOpOaQCD6PCm3Gs8xb9sOGkpfEv862i4vhSI4uB6kAzCbcoC+xoQW
llf7wYl+M+H7QWdEsSUQpNYUicj3dcE0i/QKwM/OpaRefYwZmewfgaVOs1/0X0QT
eqJpCVLXrU2J4yQIBlrKtDXG3H8DSy24EOxXuExuPX/i/tOtKwVIxcR/BkiRAbrH
7KSMpOObx5NwDCkLzTxcY4Q9Mf6b7TgvNMn/XuqNCERUeVqy/AMKwnQytzTdFf/g
xPKoLPvIg7mhUconneXo3xicZYrGNrO00cyGCKmZUfP02gktcIERk+QQlIYKQl4b
QTWZwRdIT4jIanGSa65uWF8rwXz1s4mhEgSM/ynYLJeZMAgcShjoxQjDCOztq+pv
++rrc7meg7Ty/zw=
=gwf2
-----END PGP SIGNATURE-----
Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux
Pull clk fixes from Stephen Boyd:
"Fixes to the Allwinner and Renesas clk drivers:
- Do the math properly in Allwinner's ccu_mp_recalc_rate() so clk
rates aren't bogus
- Fix a clock domain regression on Renesas R-Car M1A, R-Car H1,
and RZ/A1 by registering the domain after the pmdomain bus is
registered instead of before"
* tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:
clk: sunxi-ng: mp: Fix dual-divider clock rate readback
clk: renesas: mstp: Add genpd OF provider at postcore_initcall()
|
||
|
Linus Torvalds
|
f975f08c2e |
for-6.17-rc6-tag
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE8rQSAMVO+zA4DBdWxWXV+ddtWDsFAmjPff0ACgkQxWXV+ddt WDvaVRAAqcPlR07B5Y1S+73JlqVXx5g9S77uarkn48FS5OGJ97ad7NFF79LdFKaQ d5OpD2aZRzi+XLQTlD7Wz9udmr2OvHLnTih6E6KOa7ukL+bJMsK6CXw4usLW5ke0 nHNPNCLnEtIbQ5hKFpsjfsUrJaNtGcFNoWlnkl0iG1E0vjJQFBYqTNzBytv/ygc/ jVDdoftA7vqnUeXemVGhnfvLqyP5g374jnUB3CIejMQfzSJXCS07DXwmn/eeRoxl HdJre+kjavV3WL/fvAqq0f6wEBlYRXXiLUnSt2xRr5a70svy0eWhx8ggE6gBqlyR fo4UC8hsETZdQAW35ZgUfJBtUVqx+bwNLZ5xVFlDKv8uix7B9x7Fgcmhsin+GovN JowBYe28FTctU4x3IBqyweXZOn2815HvvZlIbU/D9jVSB7RSQ/2nUKAec1tYBk2G dy9TRxxE+N3/csJ3J+VqvFEMnGorVDN1GBXFPwIgy2OTpNi6dM7s3909lO2ebp2+ Kw2vBFtwEVdGk7ZkYVkHtsPa/Rn+uXLSCp+m08eqIJKTPxbTn2W6XXsoptHt5iXL t43oRP/wq9qUKgYJUd8242nQp/Sf+zEvIjHYDpbsDHajPsTfUo0nuCN8ZojceWat RRJclWk7KXdicQT4JiWp19mQakn9gjM+vOoMriGZwRf4ZGkO1PE= =Oj5R -----END PGP SIGNATURE----- Merge tag 'for-6.17-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull a few more btrfs fixes from David Sterba: - in tree-checker, fix wrong size of check for inode ref item - in ref-verify, handle combination of mount options that allow partially damaged extent tree (reported by syzbot) - additional validation of compression mount option to catch invalid string as level * tag 'for-6.17-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: reject invalid compression level btrfs: ref-verify: handle damaged extent root tree btrfs: tree-checker: fix the incorrect inode ref size check |
||
|
Linus Torvalds
|
fce24200cb |
SCSI fixes on 20250920
One driver fix for a dma error checking thinko. Signed-off-by: James E.J. Bottomley <James.Bottomley@HansenPartnership.com> -----BEGIN PGP SIGNATURE----- iLgEABMIAGAWIQTnYEDbdso9F2cI+arnQslM7pishQUCaM7RqhsUgAAAAAAEAA5t YW51MiwyLjUrMS4xMSwyLDImHGphbWVzLmJvdHRvbWxleUBoYW5zZW5wYXJ0bmVy c2hpcC5jb20ACgkQ50LJTO6YrIXidgEAyXqRDw3Vune8kX3/aSSijXdAnCo9nDSl xIpAPmQg8qIA/2StUFuc9W6Z2hhdW2YUlwNMR9nCBDi2/yUv/XoS/Eah =yK2v -----END PGP SIGNATURE----- Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fix from James Bottomley: "One driver fix for a dma error checking thinko" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE |
||
|
Linus Torvalds
|
0f46486981 |
firewire fixes for v6.17-rc7
When new structures and events were added to UAPI in v6.5 kernel, the required update to the subsystem ABI version returned to userspace client was overlooked. The version is now updated. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQQE66IEYNDXNBPeGKSsLtaWM8LwEwUCaM9RHwAKCRCsLtaWM8Lw EwiHAQD+RXwJsg55IjUA6e3BLrADjbW1o00ApqX9FfFiAJ8zbAD+MKJHbqq9qYML emSz7Kh+bXEWPCn4RGEP7Hs04njhiAM= =8l0A -----END PGP SIGNATURE----- Merge tag 'firewire-fixes-6.17-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull firewire fix from Takashi Sakamoto: "When new structures and events were added to UAPI in v6.5 kernel, the required update to the subsystem ABI version returned to userspace client was overlooked. The version is now updated" * tag 'firewire-fixes-6.17-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: firewire: core: fix overlooked update of subsystem ABI version |
||
|
Linus Torvalds
|
3b08f56fbb |
Fix a SEV-SNP regression when CONFIG_KVM_AMD_SEV is disabled.
Signed-off-by: Ingo Molnar <mingo@kernel.org> -----BEGIN PGP SIGNATURE----- iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmjOZQ0RHG1pbmdvQGtl cm5lbC5vcmcACgkQEnMQ0APhK1i0PBAAv855cFr65Ux3xAwrKbxEb/3yVVe9d5US Eut7CxnR/10FYJq1dRYCdc4yrmHk/f8hVXIPBrWCijrVsg7uwYFcq7+dd8nUqP1t YB1ozIi1Ma4pGePJb4POBrSYbBsdMOsnFwHAod9QdfmIcmxbdlUr8J2K/MZ/u+tV bFiBFH3TtqcG89P+ZbFgK7udVvQDghLBdI3iqtsXTO0C0EaqJO85+8HBvNp8FFuC pebRC8INs/Hn/tEx8sykG2jPgREDU9Hft3O1l+YIqhKIxkeevl5ifqpUfotAkXh9 TWm/FecLHph7jk3m/KofKK8osforuKirPp1OG7X3M7eudmuQdkrHc0irxCIxl8Hs fg42HnH1iLQMxWSWcVXOxB5+6m2Z3+ugm+jd3eTDG5VuTAtEvs28yYjZx9xgNGjl jWazG3FeJVE1/xJXHnNdl/52lH0twU7e0Bwn8xrK+liH4YvhZP3A0YVVJ9+pUU8O VQrd2N4fL+bQ/S2aBtRBgphHX2JU18w7hrco+s1oiMIA9OREBto9unb7rYWrAcV4 CJnd1Dat3882UqANEg4Exa5Oqd0IWKW76HeRevyxw2OW3kVaLHJQOE832/hOKW7u 0THCaANUNW9s6dYDCuosM6HsQ2fvQNy6VU4fDbEYynMlRyflGHgLbKh9Mkvigihk grpYvfpEhLM= =WPmk -----END PGP SIGNATURE----- Merge tag 'x86-urgent-2025-09-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fix from Ingo Molnar: "Fix a SEV-SNP regression when CONFIG_KVM_AMD_SEV is disabled" * tag 'x86-urgent-2025-09-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/sev: Guard sev_evict_cache() with CONFIG_AMD_MEM_ENCRYPT |
||
|
Sebastian Andrzej Siewior
|
b549113738 |
futex: Prevent use-after-free during requeue-PI
syzbot managed to trigger the following race:
T1 T2
futex_wait_requeue_pi()
futex_do_wait()
schedule()
futex_requeue()
futex_proxy_trylock_atomic()
futex_requeue_pi_prepare()
requeue_pi_wake_futex()
futex_requeue_pi_complete()
/* preempt */
* timeout/ signal wakes T1 *
futex_requeue_pi_wakeup_sync() // Q_REQUEUE_PI_LOCKED
futex_hash_put()
// back to userland, on stack futex_q is garbage
/* back */
wake_up_state(q->task, TASK_NORMAL);
In this scenario futex_wait_requeue_pi() is able to leave without using
futex_q::lock_ptr for synchronization.
This can be prevented by reading futex_q::task before updating the
futex_q::requeue_state. A reference on the task_struct is not needed
because requeue_pi_wake_futex() is invoked with a spinlock_t held which
implies a RCU read section.
Even if T1 terminates immediately after, the task_struct will remain valid
during T2's wake_up_state(). A READ_ONCE on futex_q::task before
futex_requeue_pi_complete() is enough because it ensures that the variable
is read before the state is updated.
Read futex_q::task before updating the requeue state, use it for the
following wakeup.
Fixes:
|
||
Luiz Augusto von Dentz
|
9e622804d5 |
Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync
This fixes the following UFA in hci_acl_create_conn_sync where a
connection still pending is command submission (conn->state == BT_OPEN)
maybe freed, also since this also can happen with the likes of
hci_le_create_conn_sync fix it as well:
BUG: KASAN: slab-use-after-free in hci_acl_create_conn_sync+0x5ef/0x790 net/bluetooth/hci_sync.c:6861
Write of size 2 at addr ffff88805ffcc038 by task kworker/u11:2/9541
CPU: 1 UID: 0 PID: 9541 Comm: kworker/u11:2 Not tainted 6.16.0-rc7 #3 PREEMPT(full)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
Workqueue: hci3 hci_cmd_sync_work
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xca/0x230 mm/kasan/report.c:480
kasan_report+0x118/0x150 mm/kasan/report.c:593
hci_acl_create_conn_sync+0x5ef/0x790 net/bluetooth/hci_sync.c:6861
hci_cmd_sync_work+0x210/0x3a0 net/bluetooth/hci_sync.c:332
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 home/kwqcheii/source/fuzzing/kernel/kasan/linux-6.16-rc7/arch/x86/entry/entry_64.S:245
</TASK>
Allocated by task 123736:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4359
kmalloc_noprof include/linux/slab.h:905 [inline]
kzalloc_noprof include/linux/slab.h:1039 [inline]
__hci_conn_add+0x233/0x1b30 net/bluetooth/hci_conn.c:939
hci_conn_add_unset net/bluetooth/hci_conn.c:1051 [inline]
hci_connect_acl+0x16c/0x4e0 net/bluetooth/hci_conn.c:1634
pair_device+0x418/0xa70 net/bluetooth/mgmt.c:3556
hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719
hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839
sock_sendmsg_nosec net/socket.c:712 [inline]
__sock_sendmsg+0x219/0x270 net/socket.c:727
sock_write_iter+0x258/0x330 net/socket.c:1131
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x54b/0xa90 fs/read_write.c:686
ksys_write+0x145/0x250 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 103680:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x62/0x70 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2381 [inline]
slab_free mm/slub.c:4643 [inline]
kfree+0x18e/0x440 mm/slub.c:4842
device_release+0x9c/0x1c0
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x22b/0x480 lib/kobject.c:737
hci_conn_cleanup net/bluetooth/hci_conn.c:175 [inline]
hci_conn_del+0x8ff/0xcb0 net/bluetooth/hci_conn.c:1173
hci_conn_complete_evt+0x3c7/0x1040 net/bluetooth/hci_event.c:3199
hci_event_func net/bluetooth/hci_event.c:7477 [inline]
hci_event_packet+0x7e0/0x1200 net/bluetooth/hci_event.c:7531
hci_rx_work+0x46a/0xe80 net/bluetooth/hci_core.c:4070
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 home/kwqcheii/source/fuzzing/kernel/kasan/linux-6.16-rc7/arch/x86/entry/entry_64.S:245
Last potentially related work creation:
kasan_save_stack+0x3e/0x60 mm/kasan/common.c:47
kasan_record_aux_stack+0xbd/0xd0 mm/kasan/generic.c:548
insert_work+0x3d/0x330 kernel/workqueue.c:2183
__queue_work+0xbd9/0xfe0 kernel/workqueue.c:2345
queue_delayed_work_on+0x18b/0x280 kernel/workqueue.c:2561
pairing_complete+0x1e7/0x2b0 net/bluetooth/mgmt.c:3451
pairing_complete_cb+0x1ac/0x230 net/bluetooth/mgmt.c:3487
hci_connect_cfm include/net/bluetooth/hci_core.h:2064 [inline]
hci_conn_failed+0x24d/0x310 net/bluetooth/hci_conn.c:1275
hci_conn_complete_evt+0x3c7/0x1040 net/bluetooth/hci_event.c:3199
hci_event_func net/bluetooth/hci_event.c:7477 [inline]
hci_event_packet+0x7e0/0x1200 net/bluetooth/hci_event.c:7531
hci_rx_work+0x46a/0xe80 net/bluetooth/hci_core.c:4070
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 home/kwqcheii/source/fuzzing/kernel/kasan/linux-6.16-rc7/arch/x86/entry/entry_64.S:245
Fixes:
|
||
|
Luiz Augusto von Dentz
|
2e12868317 |
Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue
This fixes the following UAF caused by not properly locking hdev when
processing HCI_EV_NUM_COMP_PKTS:
BUG: KASAN: slab-use-after-free in hci_conn_tx_dequeue+0x1be/0x220 net/bluetooth/hci_conn.c:3036
Read of size 4 at addr ffff8880740f0940 by task kworker/u11:0/54
CPU: 1 UID: 0 PID: 54 Comm: kworker/u11:0 Not tainted 6.16.0-rc7 #3 PREEMPT(full)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
Workqueue: hci1 hci_rx_work
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xca/0x230 mm/kasan/report.c:480
kasan_report+0x118/0x150 mm/kasan/report.c:593
hci_conn_tx_dequeue+0x1be/0x220 net/bluetooth/hci_conn.c:3036
hci_num_comp_pkts_evt+0x1c8/0xa50 net/bluetooth/hci_event.c:4404
hci_event_func net/bluetooth/hci_event.c:7477 [inline]
hci_event_packet+0x7e0/0x1200 net/bluetooth/hci_event.c:7531
hci_rx_work+0x46a/0xe80 net/bluetooth/hci_core.c:4070
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 home/kwqcheii/source/fuzzing/kernel/kasan/linux-6.16-rc7/arch/x86/entry/entry_64.S:245
</TASK>
Allocated by task 54:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4359
kmalloc_noprof include/linux/slab.h:905 [inline]
kzalloc_noprof include/linux/slab.h:1039 [inline]
__hci_conn_add+0x233/0x1b30 net/bluetooth/hci_conn.c:939
le_conn_complete_evt+0x3d6/0x1220 net/bluetooth/hci_event.c:5628
hci_le_enh_conn_complete_evt+0x189/0x470 net/bluetooth/hci_event.c:5794
hci_event_func net/bluetooth/hci_event.c:7474 [inline]
hci_event_packet+0x78c/0x1200 net/bluetooth/hci_event.c:7531
hci_rx_work+0x46a/0xe80 net/bluetooth/hci_core.c:4070
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 home/kwqcheii/source/fuzzing/kernel/kasan/linux-6.16-rc7/arch/x86/entry/entry_64.S:245
Freed by task 9572:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x62/0x70 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2381 [inline]
slab_free mm/slub.c:4643 [inline]
kfree+0x18e/0x440 mm/slub.c:4842
device_release+0x9c/0x1c0
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x22b/0x480 lib/kobject.c:737
hci_conn_cleanup net/bluetooth/hci_conn.c:175 [inline]
hci_conn_del+0x8ff/0xcb0 net/bluetooth/hci_conn.c:1173
hci_abort_conn_sync+0x5d1/0xdf0 net/bluetooth/hci_sync.c:5689
hci_cmd_sync_work+0x210/0x3a0 net/bluetooth/hci_sync.c:332
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 home/kwqcheii/source/fuzzing/kernel/kasan/linux-6.16-rc7/arch/x86/entry/entry_64.S:245
Fixes:
|
||
|
Luiz Augusto von Dentz
|
1488af7b8b |
Bluetooth: hci_sync: Fix hci_resume_advertising_sync
hci_resume_advertising_sync is suppose to resume all instance paused by
hci_pause_advertising_sync, this logic is used for procedures are only
allowed when not advertising, but instance 0x00 was not being
re-enabled.
Fixes:
|
||
Calvin Owens
|
1c5091a9b4 |
Bluetooth: Fix build after header cleanup
Some Kconfig dependencies are needed after my recent cleanup, since
the core code has its own option.
Since btmtksdio does not actually call h4_recv_buf(), move the
definitions it uses outside the BT_HCIUART_H4 gate in hci_uart.h to
avoid adding a dependency for btmtksdio.
The rest I touched (bpa10x, btmtkuart, and btnxpuart) do really call
h4_recv_buf(), so the dependency is required, add it for them.
Fixes: 0e272fc7e17d ("Bluetooth: remove duplicate h4_recv_buf() in header")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202508300413.OnIedvRh-lkp@intel.com/
Signed-off-by: Calvin Owens <calvin@wbinvd.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
|
||
Christian Loehle
|
8ffe28b4e8 |
cpufreq: Initialize cpufreq-based invariance before subsys
commit |
||
Stephen Boyd
|
764c921bf0 |
Allwinner Clock Fixes for 6.17
One fix for the clock rate readback on the recently added dual divider clocks. -----BEGIN PGP SIGNATURE----- iQJCBAABCgAsFiEE2nN1m/hhnkhOWjtHOJpUIZwPJDAFAmjLizUOHHdlbnNAY3Np ZS5vcmcACgkQOJpUIZwPJDAyBhAAzKWMcB/v0Q+g0mm5Q39DR6kn5qjNhiT6CxWz btVQAVgplIjCrC4ULfCBPtxCQn58pZnjGziXCIYMqIhtvbJcqenhntk9AKYOyuMf Yh/9RYb19QCPB3nS0rOv+TzHQwwzLi194+AyzBWFcJ8qirZUrUNwm88PMNr0sQck gpaHdWWh6p2KvXe6ZeiBkBZNucne22rynljW+3kil5BE6EiX3qGivXwEPqYRlpFT NgNCQwcAIa+cYzoDBA9vsEgNF3zFELxCj0y812pUD6rG8/vzbp9pycuSjRm7qc3g wfKEgPQEy7rch8YCpKjdEVXhJgk4HmBGBQRCEUJ72tc+NSKtCeJYVKyYsWOk07ER jJdoI8m2wnVhHMFJPGl6n9Dysbp3Lqv/tqlJym0KpcQR4dtwfp7KmG1Givriinpm H/Ve6DqqTwIeYie0/1NpCEmWxYrZMuACO3N0nuJStJS2o9qQQ4Eu5Vv+MglgweSe Ib4Fi+2C05lUQ7Mra45MmpH/Hs0Rjtte9emWWd3chwhRZb3eG1jDxA+Kt3wAWHQL O6ScjoczviXa3BuPH7W/S5MUejK2hqB36cc2sQjV/MJHijZ+Wl4WHwG1E6dQ6jyD wExTiVE/r/wj5tI577MWsKQT6V5n2u7IlwJ03qNol/4R9huYvbRBgim9Qit3SdLB hmaYKVk= =ae+r -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQJIBAABCAAyFiEE9L57QeeUxqYDyoaDrQKIl8bklSUFAmjOLW0UHHN3Ym95ZEBj aHJvbWl1bS5vcmcACgkQrQKIl8bklSVPMQ//eur+V3iEv2EUrPqansskYKZmNFHM VMHru23wT3vBpF4jG9/krXUfCekLKftuuDE0OpQG3UnvTgitUmwABM+E7s1CPwu5 iEVNuwbNpRVlCWaeozOBiqZZka1eVEl7WwQqfvu9YBSi3PKOOmU9+67zkYuVbnDj 80b2KbrjiOV2rB64vYZVCBKQl4ZLvwf6AYxg6FGKeHcf4DhRKUjc5uFvvkgiuLTY 1bdtgpN5t7mnT/Qiw/btcY/ku6g4VIfzHdC5MC0EnIhIGKlhTqNDbQTu6I7O4kC7 HV5AhYHq5kIelwJ/z+UGEq8VIHj59ToDByATbNDtnKSQp36OLRDN6F79pImUI8ig B47/tzfdEStvqfcBNvltsUnZocinDQQOhuyf7tJU5PFoTxVjJ4z+4ad645c+GEMD hkJcenmKj9FxSuTMV7LmuwAd1DnCXVxNtPacbMddrrJ2f0DGWbIkwvaRsFieQwSx jJSurBqZ7YMuC2UJN2b0GmCoC4LYDCrOB3cORgyLoGqVohz4LKOpRKMwAC01FiE7 YPabQiNAHDbmlHJth8qlRMBTHBMP5hZ/qyKYsJs+aWKaB69XrSqxVlawlMS3ZhbM WnlpDRHAlWyGeCaAcH9GlNuDZu+jAQDGNV1G8BOhaSZkzbR4cENrIpGOdRM3evPf XG1VPXVhSfOGlfk= =a0Dy -----END PGP SIGNATURE----- Merge tag 'sunxi-clk-fixes-for-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into clk-fixes Pull an Allwinner clk driver fix from Chen-Yu Tsai: - One fix for the clock rate readback on the recently added dual divider clocks * tag 'sunxi-clk-fixes-for-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: clk: sunxi-ng: mp: Fix dual-divider clock rate readback |
||
Takashi Sakamoto
|
853a57ba26 |
firewire: core: fix overlooked update of subsystem ABI version
In kernel v6.5, several functions were added to the cdev layer. This
required updating the default version of subsystem ABI up to 6, but
this requirement was overlooked.
This commit updates the version accordingly.
Fixes:
|
||
Petr Malat
|
b65678cacc |
ethernet: rvu-af: Remove slash from the driver name
Having a slash in the driver name leads to EIO being returned while
reading /sys/module/rvu_af/drivers content.
Remove DRV_STRING as it's not used anywhere.
Fixes:
|
||
Sidraya Jayagond
|
a35c04de25 |
net/smc: fix warning in smc_rx_splice() when calling get_page()
smc_lo_register_dmb() allocates DMB buffers with kzalloc(), which are
later passed to get_page() in smc_rx_splice(). Since kmalloc memory is
not page-backed, this triggers WARN_ON_ONCE() in get_page() and prevents
holding a refcount on the buffer. This can lead to use-after-free if
the memory is released before splice_to_pipe() completes.
Use folio_alloc() instead, ensuring DMBs are page-backed and safe for
get_page().
WARNING: CPU: 18 PID: 12152 at ./include/linux/mm.h:1330 smc_rx_splice+0xaf8/0xe20 [smc]
CPU: 18 UID: 0 PID: 12152 Comm: smcapp Kdump: loaded Not tainted 6.17.0-rc3-11705-g9cf4672ecfee #10 NONE
Hardware name: IBM 3931 A01 704 (z/VM 7.4.0)
Krnl PSW : 0704e00180000000 000793161032696c (smc_rx_splice+0xafc/0xe20 [smc])
R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:2 PM:0 RI:0 EA:3
Krnl GPRS: 0000000000000000 001cee80007d3001 00077400000000f8 0000000000000005
0000000000000001 001cee80007d3006 0007740000001000 001c000000000000
000000009b0c99e0 0000000000001000 001c0000000000f8 001c000000000000
000003ffcc6f7c88 0007740003e98000 0007931600000005 000792969b2ff7b8
Krnl Code: 0007931610326960: af000000 mc 0,0
0007931610326964: a7f4ff43 brc 15,00079316103267ea
#0007931610326968: af000000 mc 0,0
>000793161032696c: a7f4ff3f brc 15,00079316103267ea
0007931610326970: e320f1000004 lg %r2,256(%r15)
0007931610326976: c0e53fd1b5f5 brasl %r14,000793168fd5d560
000793161032697c: a7f4fbb5 brc 15,00079316103260e6
0007931610326980: b904002b lgr %r2,%r11
Call Trace:
smc_rx_splice+0xafc/0xe20 [smc]
smc_rx_splice+0x756/0xe20 [smc])
smc_rx_recvmsg+0xa74/0xe00 [smc]
smc_splice_read+0x1ce/0x3b0 [smc]
sock_splice_read+0xa2/0xf0
do_splice_read+0x198/0x240
splice_file_to_pipe+0x7e/0x110
do_splice+0x59e/0xde0
__do_splice+0x11a/0x2d0
__s390x_sys_splice+0x140/0x1f0
__do_syscall+0x122/0x280
system_call+0x6e/0x90
Last Breaking-Event-Address:
smc_rx_splice+0x960/0xe20 [smc]
---[ end trace 0000000000000000 ]---
Fixes:
|
||
Wang Liang
|
1091860a16 |
net: tun: Update napi->skb after XDP process
The syzbot report a UAF issue: BUG: KASAN: slab-use-after-free in skb_reset_mac_header include/linux/skbuff.h:3150 [inline] BUG: KASAN: slab-use-after-free in napi_frags_skb net/core/gro.c:723 [inline] BUG: KASAN: slab-use-after-free in napi_gro_frags+0x6e/0x1030 net/core/gro.c:758 Read of size 8 at addr ffff88802ef22c18 by task syz.0.17/6079 CPU: 0 UID: 0 PID: 6079 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Call Trace: <TASK> dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 skb_reset_mac_header include/linux/skbuff.h:3150 [inline] napi_frags_skb net/core/gro.c:723 [inline] napi_gro_frags+0x6e/0x1030 net/core/gro.c:758 tun_get_user+0x28cb/0x3e20 drivers/net/tun.c:1920 tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1996 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x5c9/0xb30 fs/read_write.c:686 ksys_write+0x145/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Allocated by task 6079: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:330 [inline] __kasan_mempool_unpoison_object+0xa0/0x170 mm/kasan/common.c:558 kasan_mempool_unpoison_object include/linux/kasan.h:388 [inline] napi_skb_cache_get+0x37b/0x6d0 net/core/skbuff.c:295 __alloc_skb+0x11e/0x2d0 net/core/skbuff.c:657 napi_alloc_skb+0x84/0x7d0 net/core/skbuff.c:811 napi_get_frags+0x69/0x140 net/core/gro.c:673 tun_napi_alloc_frags drivers/net/tun.c:1404 [inline] tun_get_user+0x77c/0x3e20 drivers/net/tun.c:1784 tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1996 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x5c9/0xb30 fs/read_write.c:686 ksys_write+0x145/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 6079: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:243 [inline] __kasan_slab_free+0x5b/0x80 mm/kasan/common.c:275 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2422 [inline] slab_free mm/slub.c:4695 [inline] kmem_cache_free+0x18f/0x400 mm/slub.c:4797 skb_pp_cow_data+0xdd8/0x13e0 net/core/skbuff.c:969 netif_skb_check_for_xdp net/core/dev.c:5390 [inline] netif_receive_generic_xdp net/core/dev.c:5431 [inline] do_xdp_generic+0x699/0x11a0 net/core/dev.c:5499 tun_get_user+0x2523/0x3e20 drivers/net/tun.c:1872 tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1996 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x5c9/0xb30 fs/read_write.c:686 ksys_write+0x145/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f After commit |
||
|
Linus Torvalds
|
cd89d48737 |
six smb3.1.1 client fixes, all for stable
-----BEGIN PGP SIGNATURE----- iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmjNtKkACgkQiiy9cAdy T1GEJAv+ND+WIVxXHdzECUfKHqoL4wBhnum68aitMB2nDM9izGUrctEDAtx1HQf5 GYV/e5qvzoV6HNvTQRmkwLzdsRGSutGSf/Mn9avp6QJIZsz9TM/FTgRdP9TgjDbR gdPC3RRBK6xzod2EcbDidM3n49iZA7lQ1iLffy82npcJg3k/34Pe/at2ray2+BnH tAupJtcpTEaoxtbsmTH5SVcS0L6ofMBi+dSppDPrrTCx/0hujt8lKP1BDa0MYtdd s7QErzEj/1V/UwlzItYI6oamhF37/uIYWyvey3MaHWiuwOw2rpCnsomZefNvzQTg VesXFgbLiOmCnKlGflLooDkLhXXLAHeG9e5RWJ6UXJalD671yYY6QgcC6f0FOTCE ziF/mk5H0NvXbEErJL8a6lSnqM7uzpSIxEch9pMkJLVlYxYsH9T3lSsELhD5bKeg 01bMGN0BE5df5WAz6tzJ56QyQJUcxWP+46Yo/8r0eLm92pDOMm205sChnwZxxVkd VY0i3GsK =BbST -----END PGP SIGNATURE----- Merge tag '6.17-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - Two unlink fixes: one for rename and one for deferred close - Four smbdirect/RDMA fixes: fix buffer leak in negotiate, two fixes for races in smbd_destroy, fix offset and length checks in recv_done * tag '6.17-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path smb: client: fix file open check in __cifs_unlink() smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) smb: client: use disable[_delayed]_work_sync in smbdirect.c smb: client: fix filename matching of deferred files smb: client: let recv_done verify data_offset, data_length and remaining_data_length |
||
|
Linus Torvalds
|
497b9a7b8d |
IOMMU Fixes for Linux v6.17-rc6
Including: - Fixes for memory leak and memory corruption bugs on S390 and AMD-Vi. - Race condition fix in AMD-Vi page table code and S390 device attach code. - Intel VT-d: Fix alignment checks in __domain_mapping(). - AMD-Vi: Fix potentially incorrect DTE settings when device has aliases. -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEr9jSbILcajRFYWYyK/BELZcBGuMFAmjNaFkACgkQK/BELZcB GuPEZw//U0Y64dlIPfWwVp1EgZqeaLlSVChtdvtuOMECZFeziqsEUV+nHlknONyi jIJbDkS8eV80TOi83Wk5Z/42W05v/tFC/oD8vkyoT4jGCF7m2oyTuIFj1gBhXvUU 9ZYGCS+CcnGw5WRJau3UeKT8CkUw5z4VCUotYPQpN/S+FK6WwMeUCBz3d/vLIoBC 7OMC2XMBcMWYtqwansHWEfPnywEeTy5M/NW8FHEQd/wrxMSW0n3xHoia+6LQHAPF Dr347xeAaYQ3wqEtlbPFPXDYrmiIPq8DiTZslCvYfpdYY15DPA00r/FRq9Q5dmFL eQuLdcW86DDgbjyfZmRReYZv2o6vyMfOFBS5o2wrfBzOrqDiUwbyV/V/yxs30Gc1 ZNWuKzzI8eOcv+9kkmxafShMhMJx1hJ08sMVUYgFXl3UUe4oQe7o6qRbaHDwcTjM +eMfP4Y4YiQtIMdosCKrnFiryb6IXu91f6WwiBZiiiW2JO8XuW8idJ9RMToNfkPI HyZRlRO5dO3cedu0lr8xWaS3/g9QDltXTJFpbF5UDX6XeTvn7D5CGQsSglNQ4spM 1BOaH7KdALaq7irOSxXwXuD+XsvwDm3uhFvx0cK3LMYzJFiy+h8dqlL6yzEu5clM LihyHkhCQJgDECVoykNKAX0J4HMZmY5+YRfEOLxuaBN7yUwVxgc= =hreJ -----END PGP SIGNATURE----- Merge tag 'iommu-fixes-v6.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux Pull iommu fixes from Joerg Roedel: - Fixes for memory leak and memory corruption bugs on S390 and AMD-Vi - Race condition fix in AMD-Vi page table code and S390 device attach code - Intel VT-d: Fix alignment checks in __domain_mapping() - AMD-Vi: Fix potentially incorrect DTE settings when device has aliases * tag 'iommu-fixes-v6.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: iommu/amd/pgtbl: Fix possible race while increase page table level iommu/amd: Fix alias device DTE setting iommu/s390: Make attach succeed when the device was surprise removed iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() iommu/s390: Fix memory corruption when using identity domain iommu/amd: Fix ivrs_base memleak in early_amd_iommu_init() |
||
|
Linus Torvalds
|
1522b530ac |
block-6.17-20250918
-----BEGIN PGP SIGNATURE----- iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmjMlsUQHGF4Ym9lQGtl cm5lbC5kawAKCRD301j7KXHgpph+D/9/aXD4SrIOjRRZNDb0HIw5ySOJ36fHIfQU 6M+DqVOOa+srY9Ja1zH9NJxcZ7Z9hUJKD9KMZd3mGSDuGCR8VTP/DZqYLjCpJmaO 6m2Bn0Uc90iCAoialOEErPMWMmcJgapjupaeiRKcGvkLbDPUSKX/tHsNPrI9fK/t bxdeSZ8971DNC4DAEd0mnBDqgBz4JQa+YfSoLb9OM57LshEjExn8vhUUeu5De4Ek wZ5aQ44/1hZAWWMSCWFWvnxTXYc6B2McZgUT3fY6MR2jdgAdmCgXy0TfXxDwbwG9 cbiFOsM1gCLWXywPS4pAOnw2N6t/Qb6RUv5JPGQbayredSqjxGFBYhS9zYM0cZPu tRtsPsCD4GJSEjY/meBGNGFB3G2cqo7IcnrWw86hAh4PLJc8Ov0kVAmS91lGsgjg qRJLJlS5Xoic021ccPSHAXg4/nynudDrYbn8AOVu8voMawAOi9/JCHQWgLb4siiJ O3CT7NQPZr/UunM7qhux6odyWppCHre3QyUvLf8btIIlrgf9dcwWyflbgiJ//iHt oNCHAF2h180S+Y791OcnFvNPO1zYVe1rE53XAZOky9/Cc6B0Jxelc4WUQufrbeBK Ug+EtAXSHGdvZkOwniuZoNpcU4Q5xOFhe9fmDArLSCc5Qh9VHH7lmt788SF/TLQ3 SptiosZe9A== =Zbhj -----END PGP SIGNATURE----- Merge tag 'block-6.17-20250918' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: "A set of fixes for an issue with md array assembly and drbd for devices supporting write zeros" * tag 'block-6.17-20250918' of git://git.kernel.dk/linux: drbd: init queue_limits->max_hw_wzeroes_unmap_sectors parameter md: init queue_limits->max_hw_wzeroes_unmap_sectors parameter |
||
|
Linus Torvalds
|
0d64ebf676 |
io_uring-6.17-20250919
-----BEGIN PGP SIGNATURE----- iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmjNXgQQHGF4Ym9lQGtl cm5lbC5kawAKCRD301j7KXHgpgFnEACusY6hGBWCPaEoG492zYBPDAJy+2aqGQsH FFuk/ZeO4iUEnnirTPDIgbkJYvIn7zcETWd+bh8gyB2ix4HxLEF/0j//rrigedit smHtvAfeWQVv6aMS7HTBjra5CazjDAp8+TxlfKuuThMjkCRysF35MLiSNSmztgGK OCOiiJcZM7oUq+vNrf+J2H2siG2qnZvqInfBsNDsbqu1WiRfEdh0vN8YEEV3ndjB TeXDQIekYiWoGNbuZ+/MNYQhoTDoAtAM5z4P0ksxPA/oTZ9w1IwlxqmHPWNPXYZL GtKYb2Oj5G6hR06PjjmLWiSgWvfotCC0jLzbSra56kNFtSI2fmJa9S/Sah/CKPIY F1Jokf2Ji0BmTNPm78Euv+Fk+ekBY/lWPEGuzrTpNh+/7pjCtQprsxbUgfJRxGKf 5iGid5qcUds4OyFfUrP8HGA6nzgjC9CywFO22jOmS8769rXXOhyY5mX4Av4Hpwsk tVmx2Zrfc0WMqB1jR2L3tHHuOOvghKG6BDQAazjjNNXCjxb3b07MKGiBBA3eoLwb uFhphtyHW+h28JJzIXZhTPSui/MYoksCQfZd7X8bLN51SR6zJxSREularIxcupJj gU4kx3SiH0Irvra2KoAu+wZMoBGCjpPR7vnuRFBbcPw8nzd36cp9u7Z7X5O4Lq8R lJpuVZkGxA== =0LDC -----END PGP SIGNATURE----- Merge tag 'io_uring-6.17-20250919' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: - Fix for a regression introduced in the io-wq worker creation logic. - Remove the allocation cache for the msg_ring io_kiocb allocations. I have a suspicion that there's a bug there, and since we just fixed one in that area, let's just yank the use of that cache entirely. It's not that important, and it kills some code. - Treat a closed ring like task exiting in that any requests that trigger post that condition should just get canceled. Doesn't fix any real issues, outside of having tasks being able to rely on that guarantee. - Fix for a bug in the network zero-copy notification mechanism, where a comparison for matching tctx/ctx for notifications was buggy in that it didn't correctly compare with the previous notification. * tag 'io_uring-6.17-20250919' of git://git.kernel.dk/linux: io_uring: fix incorrect io_kiocb reference in io_link_skb io_uring/msg_ring: kill alloc_cache for io_kiocb allocations io_uring: include dying ring in task_work "should cancel" state io_uring/io-wq: fix `max_workers` breakage and `nr_workers` underflow |
||
|
Linus Torvalds
|
0903d0985a |
gpio fixes for v6.17-rc7
- fix an ACPI I2C HID driver breakage due to not initializing a structure on the stack and passing garbage down to GPIO core - ignore touchpad wakeup on GPD G1619-05 - fix debouncing configuration when looking up GPIOs in ACPI -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEFp3rbAvDxGAT0sefEacuoBRx13IFAmjNMroACgkQEacuoBRx 13IvUxAA13JV3H8rd2eoYFnSRNIGRdZdNJspNl7u7+uhXdjdWNDg80SNq/5TbrOp CsCnTMvPZ2zmuxgM/LLgEMqyXrkzHI2JL4uiIMito8EY/Dbs+FEawav9Xjf9SDJ7 THar8bIINAuP4VFYi8nSbUdJj81gI0vblnp5XaFPKuy6Z4ePkwT/Jhu7sGqHO7QF c+SypCoff8gWOB2SdwQV/Z+csG8uSzYNQARtxzQZXF5dqwpxIoj41bfOi3+mv9WT lW8T+3xQaGQIE6cJ+4v4kV2bEoXRAgMBWPLUAsn+szA6mSgOObcg9PdCgPQ+4KKt nVj0ncL6GsT5FQHrEZ39wfMZFX2ti62q6VE0c9RRcgrh17Q2Mt6ACg0+DOwO4aSh Uz5fym7Mami72oz+9V5RFUyxU/RcZpXg3/qEPWlpyAJ31/3xgh4KkUotGvOuXrri Bk+3l+3Ef1+DHRHy2A6GzQe0kFPPj5Jhrmzyqwm+dWYPxBHf7I62JXNvLxdwksDh YRXnUH3m7D43u/YiCuxCrrclnZ6VAelwgcTCXg5MD4G1KfswX8iax+qT2i4bqTwe cTyHFO8RH2cAxSR+wJHSerOQ/zEsRT8+lnaxGwmCVuuGJtATrcTrzAyMbOqan6iZ /zOnmec2H1Gj51LGyHS+NaO7gwQUlTBTcInuM3nnYe2qFjEnc04= =6FbZ -----END PGP SIGNATURE----- Merge tag 'gpio-fixes-for-v6.17-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - fix an ACPI I2C HID driver breakage due to not initializing a structure on the stack and passing garbage down to GPIO core - ignore touchpad wakeup on GPD G1619-05 - fix debouncing configuration when looking up GPIOs in ACPI * tag 'gpio-fixes-for-v6.17-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpiolib: acpi: initialize acpi_gpio_info struct gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-05 gpiolib: acpi: Program debounce when finding GPIO |
||
|
Linus Torvalds
|
ffa7119cd1 |
MMC host:
- mvsdio: Fix dma_unmap_sg() nents value - sdhci: Fix clock management for UHS-II - sdhci-pci-gli: Fix initialization of UHS-II for GL9767 -----BEGIN PGP SIGNATURE----- iQJLBAABCgA1FiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmjNMrgXHHVsZi5oYW5z c29uQGxpbmFyby5vcmcACgkQ/iaEJXNYjCkARg//Uhtnaqiy7KN2fxmV7Pa181O6 YN0TvjDBFT2vtChZFwJWAKrDjMphrRRf0yEcvF6u7O/BKQJEDjzM6A5cDs2rw4sZ 6uQuVAf8o1WaFdlz1M9mI+YFi4gHMhjuuJ6PtcphfT59GrN9T4qJZZY7hxs2xFVl RX7Jxe9Nuye+fKhs0fdyA/aiRiWLW3p31pTglnCtPeUNvUBl99TQWTDHgOKRoqsT ZuXespd8MZQqodIAQAOA2YoiL8/9kw+PZHU/TC9GyMCeQ4NPBHbarkp+1Kc2yZFW WKkUdH+BJ8L6vco6lXXPBWU3eI3dpr6dyEtPcZ7tHVL52UK7jcO4o/wN4uj1uajG SkfAHG8QFFeNYbSLZojwZ0ATKnqVA8HJwvVV6MYqThSZ1CLPYQfckoAihHuKnX5G 18g9oEXlb7tgEAZdoflHJxfYNWQMNI6WKIYuD/MiN4CHMEuZehLIVT/GdfnFw+bS t3/PTz793KP5GXp9dxK4eysPdMBVBOUiy+PEEd/UmlePXChWvfFZnYp2tYvUX6MF xCPblVUAiEiPqJum/6G9q3Mjia8NzfPVUZ+iGs0+1ioQA+I9VRk71S77Ber9yxFy LIJY1oMNZcMAKwPHNgdVRC0GrJlgDFz9X5QMxPZDYdO7WiQNUFzUGdHeoMoJzMTV gwzG8DwY0bRcy+SiHAg= =+dn4 -----END PGP SIGNATURE----- Merge tag 'mmc-v6.17-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC host fixes from Ulf Hansson: - mvsdio: Fix dma_unmap_sg() nents value - sdhci: Fix clock management for UHS-II - sdhci-pci-gli: Fix initialization of UHS-II for GL9767 * tag 'mmc-v6.17-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: sdhci-pci-gli: GL9767: Fix initializing the UHS-II interface during a power-on mmc: sdhci-uhs2: Fix calling incorrect sdhci_set_clock() function mmc: sdhci: Move the code related to setting the clock from sdhci_set_ios_common() into sdhci_set_ios() mmc: mvsdio: Fix dma_unmap_sg() nents value |
||
Stéphane Grosjean
|
c443be70aa |
can: peak_usb: fix shift-out-of-bounds issue
Explicitly uses a 64-bit constant when the number of bits used for its
shifting is 32 (which is the case for PC CAN FD interfaces supported by
this driver).
Signed-off-by: Stéphane Grosjean <stephane.grosjean@hms-networks.com>
Link: https://patch.msgid.link/20250918132413.30071-1-stephane.grosjean@free.fr
Reported-by: Marc Kleine-Budde <mkl@pengutronix.de>
Closes: https://lore.kernel.org/20250917-aboriginal-refined-honeybee-82b1aa-mkl@pengutronix.de
Fixes:
|
||
|
Linus Torvalds
|
46d2affdfb |
pmdomain core:
- Restore behaviour for disabling unused PM domains and introduce the
GENPD_FLAG_NO_STAY_ON configuration bit
pmdomain providers:
- renesas: Don't keep unused PM domains powered-on
- rockchip: Fix regulator dependency with GENPD_FLAG_NO_STAY_ON
-----BEGIN PGP SIGNATURE-----
iQJLBAABCgA1FiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmjNLxYXHHVsZi5oYW5z
c29uQGxpbmFyby5vcmcACgkQ/iaEJXNYjCkGTQ/+I6wcwPYp9gtaFG3zD1NU6uSt
tlPR7kHbHNHdJluXWeTwzGLOfuF+cwgihHuKz1bXDIIN/8bHuVxGl7+c+LTsnAVA
fmzzMi2pTvghSq0JZDmasoOs3Jg2N/wWJpj8BBXoy+DocH/wgff8oHEN2cw62ND6
9c/vMFGznPJn3qQ1gx5Q8e/G75qogW9qru0dIrCRARGx5kzZ+HAY0v6HGyLP5mDi
Eln6Ae4XJZ8tpTp2V/DBG9PTunl7MJyqhVdsthC1lKeoUz76ZALIMx7uyzOJScEn
uxmP3ycoYpQnmSyx8SdDSnHBDrfaR7DwzINcAma/amJhIWhFozbNgiMdfZXqc+R0
ZwN6RsneDAYM1URzW9ryyJAhEyCkjjEHCAjBa61fSrS03Ewq9EDLz/rsRFws0Ti1
A/87SKWsX0IZuT2IkMr9/tlkjhxOmHdCF4lInO4OVmhNm4oWhhQfXC/1j4abhWqL
px2YhBkFI7gyITIpd9YkH1C28Ba3fEvmmU71Qvd4/VdBVax5W0AdGqY7ykhAb0BG
S/1UteR3gyYs9yuCpjtDIUQkSsPx5bu9yLbe3L/t7UzLFHPOZhLy4EomLejJN7D5
a6PyaZ27VnquhkmQUh+z+Qrm1gZGPujCiVQmKJxM4Q14ALsJ2n0jDf8eV35zc/rH
U8AIFfwSyzofyVBVh28=
=IyPH
-----END PGP SIGNATURE-----
Merge tag 'pmdomain-v6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm
Pull pmdomain fixes from Ulf Hansson:
"pmdomain core:
- Restore behaviour for disabling unused PM domains and introduce the
GENPD_FLAG_NO_STAY_ON configuration bit
pmdomain providers:
- renesas: Don't keep unused PM domains powered-on
- rockchip: Fix regulator dependency with GENPD_FLAG_NO_STAY_ON"
* tag 'pmdomain-v6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm:
pmdomain: renesas: rmobile-sysc: Don't keep unused PM domains powered-on
pmdomain: renesas: rcar-gen4-sysc: Don't keep unused PM domains powered-on
pmdomain: renesas: rcar-sysc: Don't keep unused PM domains powered-on
pmdomain: rockchip: Fix regulator dependency with GENPD_FLAG_NO_STAY_ON
pmdomain: core: Restore behaviour for disabling unused PM domains
pmdomain: renesas: rcar-sysc: Make rcar_sysc_onecell_np __initdata
|
||
|
Linus Torvalds
|
39879e3a41 |
LoongArch fixes for v6.17-rc7
-----BEGIN PGP SIGNATURE----- iQJKBAABCAA0FiEEzOlt8mkP+tbeiYy5AoYrw/LiJnoFAmjMFIQWHGNoZW5odWFj YWlAa2VybmVsLm9yZwAKCRAChivD8uImeljpD/9U5QOKD2EpTpRJ2gaOxvAQe3r7 GRqA8Y5wSHDL//eg3/gyDi/uWkS69boHxkEGqGpfeeXLBH/nR3/6r41DJ44PIwqE FW5foMmwZbGHzyo9jqmoyXU+TfF4yJX09YOvGWsZAnhuE7li3UndWzm07B/tfzMP xKh8+dOz/5BsoORw9hPym3/4QtpKEnpkUpvFBoJ0dcG3YSk7+1lotIfPrc0X9zSm GbP46P/X4Cz5cgnNADajuPr3O856yZadqAAfi1+gUF85G9y92TwjcloWif5LtQtu 1JdonjW51x6RlS+uBr4VW0Il6X1US1Rs058TmoiIDf+lRPpYVuGmBX4Ekxp3D92j 09hnZEoSs1cxwDdMM0fttJpmS7IZEA28tJiO+20CRk3EuvBKGPNdXsQ+169OHDD9 /jnGA8ksukCN6e1UBsjA0VzxNUTT5u0cw9sXMVaQcfCWzIa2J8PtRMLoJEtDeJ7/ gXSrPtk6a9AK6QcgX5MGAlMtR+HJnZTCSJBv/i7T0E743BdWClwBq5RgTfklFHTw FXEFUX1RbgIdi4CyqZ+ilwbpIah8+7BdIK5NMNALojsLEWM5y6v88PPOIz9hsdqp PgxQKGxZh00p04WWJun3DmIO4KNvn+AYM/uMpd4TCa9Rtqi+hrm2pBDS+9K4hHDi mT+7ZweDnRX8YPt44Q== =aJ23 -----END PGP SIGNATURE----- Merge tag 'loongarch-fixes-6.17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch fixes from Huacai Chen: "Fix some build warnings for RUST-enabled objtool check, align ACPI structures for ARCH_STRICT_ALIGN, fix an unreliable stack for live patching, add some NULL pointer checkings, and fix some bugs around KVM" * tag 'loongarch-fixes-6.17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: LoongArch: KVM: Avoid copy_*_user() with lock hold in kvm_pch_pic_regs_access() LoongArch: KVM: Avoid copy_*_user() with lock hold in kvm_eiointc_sw_status_access() LoongArch: KVM: Avoid copy_*_user() with lock hold in kvm_eiointc_regs_access() LoongArch: KVM: Avoid copy_*_user() with lock hold in kvm_eiointc_ctrl_access() LoongArch: KVM: Fix VM migration failure with PTW enabled LoongArch: KVM: Remove unused returns and semicolons LoongArch: vDSO: Check kcalloc() result in init_vdso() LoongArch: Fix unreliable stack for live patching LoongArch: Replace sprintf() with sysfs_emit() LoongArch: Check the return value when creating kobj LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled LoongArch: Update help info of ARCH_STRICT_ALIGN LoongArch: Handle jump tables options for RUST LoongArch: Make LTO case independent in Makefile objtool/LoongArch: Mark special atomic instruction as INSN_BUG type objtool/LoongArch: Mark types based on break immediate code |
||
Marc Kleine-Budde
|
a3ed215cb2 |
Merge patch series "can: populate ndo_change_mtu() to prevent buffer overflow"
Vincent Mailhol <mailhol@kernel.org> says: Four drivers, namely etas_es58x, hi311x, sun4i_can and mcba_usb forgot to populate their net_device_ops->ndo_change_mtu(). Because of that, the user is free to configure any MTU on these interfaces. This can be abused by an attacker who could craft some skbs and send them through PF_PACKET to perform a buffer overflow of up to 247 bytes in each of these drivers. This series contains four patches, one for each of the drivers, to add the missing ndo_change_mtu() callback. The descriptions contain detailed explanations of how the buffer overflow could be triggered. Link: https://patch.msgid.link/20250918-can-fix-mtu-v1-0-0d1cada9393b@kernel.org Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> |
||
Vincent Mailhol
|
17c8d79452 |
can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
Sending an PF_PACKET allows to bypass the CAN framework logic and to
directly reach the xmit() function of a CAN driver. The only check
which is performed by the PF_PACKET framework is to make sure that
skb->len fits the interface's MTU.
Unfortunately, because the mcba_usb driver does not populate its
net_device_ops->ndo_change_mtu(), it is possible for an attacker to
configure an invalid MTU by doing, for example:
$ ip link set can0 mtu 9999
After doing so, the attacker could open a PF_PACKET socket using the
ETH_P_CANXL protocol:
socket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL))
to inject a malicious CAN XL frames. For example:
struct canxl_frame frame = {
.flags = 0xff,
.len = 2048,
};
The CAN drivers' xmit() function are calling can_dev_dropped_skb() to
check that the skb is valid, unfortunately under above conditions, the
malicious packet is able to go through can_dev_dropped_skb() checks:
1. the skb->protocol is set to ETH_P_CANXL which is valid (the
function does not check the actual device capabilities).
2. the length is a valid CAN XL length.
And so, mcba_usb_start_xmit() receives a CAN XL frame which it is not
able to correctly handle and will thus misinterpret it as a CAN frame.
This can result in a buffer overflow. The driver will consume cf->len
as-is with no further checks on these lines:
usb_msg.dlc = cf->len;
memcpy(usb_msg.data, cf->data, usb_msg.dlc);
Here, cf->len corresponds to the flags field of the CAN XL frame. In
our previous example, we set canxl_frame->flags to 0xff. Because the
maximum expected length is 8, a buffer overflow of 247 bytes occurs!
Populate net_device_ops->ndo_change_mtu() to ensure that the
interface's MTU can not be set to anything bigger than CAN_MTU. By
fixing the root cause, this prevents the buffer overflow.
Fixes:
|
||
|
Vincent Mailhol
|
61da0bd410 |
can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow
Sending an PF_PACKET allows to bypass the CAN framework logic and to
directly reach the xmit() function of a CAN driver. The only check
which is performed by the PF_PACKET framework is to make sure that
skb->len fits the interface's MTU.
Unfortunately, because the sun4i_can driver does not populate its
net_device_ops->ndo_change_mtu(), it is possible for an attacker to
configure an invalid MTU by doing, for example:
$ ip link set can0 mtu 9999
After doing so, the attacker could open a PF_PACKET socket using the
ETH_P_CANXL protocol:
socket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL))
to inject a malicious CAN XL frames. For example:
struct canxl_frame frame = {
.flags = 0xff,
.len = 2048,
};
The CAN drivers' xmit() function are calling can_dev_dropped_skb() to
check that the skb is valid, unfortunately under above conditions, the
malicious packet is able to go through can_dev_dropped_skb() checks:
1. the skb->protocol is set to ETH_P_CANXL which is valid (the
function does not check the actual device capabilities).
2. the length is a valid CAN XL length.
And so, sun4ican_start_xmit() receives a CAN XL frame which it is not
able to correctly handle and will thus misinterpret it as a CAN frame.
This can result in a buffer overflow. The driver will consume cf->len
as-is with no further checks on this line:
dlc = cf->len;
Here, cf->len corresponds to the flags field of the CAN XL frame. In
our previous example, we set canxl_frame->flags to 0xff. Because the
maximum expected length is 8, a buffer overflow of 247 bytes occurs a
couple line below when doing:
for (i = 0; i < dlc; i++)
writel(cf->data[i], priv->base + (dreg + i * 4));
Populate net_device_ops->ndo_change_mtu() to ensure that the
interface's MTU can not be set to anything bigger than CAN_MTU. By
fixing the root cause, this prevents the buffer overflow.
Fixes:
|
||
|
Vincent Mailhol
|
ac1c7656fa |
can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
Sending an PF_PACKET allows to bypass the CAN framework logic and to
directly reach the xmit() function of a CAN driver. The only check
which is performed by the PF_PACKET framework is to make sure that
skb->len fits the interface's MTU.
Unfortunately, because the sun4i_can driver does not populate its
net_device_ops->ndo_change_mtu(), it is possible for an attacker to
configure an invalid MTU by doing, for example:
$ ip link set can0 mtu 9999
After doing so, the attacker could open a PF_PACKET socket using the
ETH_P_CANXL protocol:
socket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL))
to inject a malicious CAN XL frames. For example:
struct canxl_frame frame = {
.flags = 0xff,
.len = 2048,
};
The CAN drivers' xmit() function are calling can_dev_dropped_skb() to
check that the skb is valid, unfortunately under above conditions, the
malicious packet is able to go through can_dev_dropped_skb() checks:
1. the skb->protocol is set to ETH_P_CANXL which is valid (the
function does not check the actual device capabilities).
2. the length is a valid CAN XL length.
And so, hi3110_hard_start_xmit() receives a CAN XL frame which it is
not able to correctly handle and will thus misinterpret it as a CAN
frame. The driver will consume frame->len as-is with no further
checks.
This can result in a buffer overflow later on in hi3110_hw_tx() on
this line:
memcpy(buf + HI3110_FIFO_EXT_DATA_OFF,
frame->data, frame->len);
Here, frame->len corresponds to the flags field of the CAN XL frame.
In our previous example, we set canxl_frame->flags to 0xff. Because
the maximum expected length is 8, a buffer overflow of 247 bytes
occurs!
Populate net_device_ops->ndo_change_mtu() to ensure that the
interface's MTU can not be set to anything bigger than CAN_MTU. By
fixing the root cause, this prevents the buffer overflow.
Fixes:
|
||
|
Vincent Mailhol
|
38c0abad45 |
can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow
Sending an PF_PACKET allows to bypass the CAN framework logic and to
directly reach the xmit() function of a CAN driver. The only check
which is performed by the PF_PACKET framework is to make sure that
skb->len fits the interface's MTU.
Unfortunately, because the etas_es58x driver does not populate its
net_device_ops->ndo_change_mtu(), it is possible for an attacker to
configure an invalid MTU by doing, for example:
$ ip link set can0 mtu 9999
After doing so, the attacker could open a PF_PACKET socket using the
ETH_P_CANXL protocol:
socket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL));
to inject a malicious CAN XL frames. For example:
struct canxl_frame frame = {
.flags = 0xff,
.len = 2048,
};
The CAN drivers' xmit() function are calling can_dev_dropped_skb() to
check that the skb is valid, unfortunately under above conditions, the
malicious packet is able to go through can_dev_dropped_skb() checks:
1. the skb->protocol is set to ETH_P_CANXL which is valid (the
function does not check the actual device capabilities).
2. the length is a valid CAN XL length.
And so, es58x_start_xmit() receives a CAN XL frame which it is not
able to correctly handle and will thus misinterpret it as a CAN(FD)
frame.
This can result in a buffer overflow. For example, using the es581.4
variant, the frame will be dispatched to es581_4_tx_can_msg(), go
through the last check at the beginning of this function:
if (can_is_canfd_skb(skb))
return -EMSGSIZE;
and reach this line:
memcpy(tx_can_msg->data, cf->data, cf->len);
Here, cf->len corresponds to the flags field of the CAN XL frame. In
our previous example, we set canxl_frame->flags to 0xff. Because the
maximum expected length is 8, a buffer overflow of 247 bytes occurs!
Populate net_device_ops->ndo_change_mtu() to ensure that the
interface's MTU can not be set to anything bigger than CAN_MTU or
CANFD_MTU (depending on the device capabilities). By fixing the root
cause, this prevents the buffer overflow.
Fixes:
|
||
Duy Nguyen
|
5cff263606 |
can: rcar_canfd: Fix controller mode setting
Driver configures register to choose controller mode before setting all channels to reset mode leading to failure. The patch corrects operation of mode setting. Signed-off-by: Duy Nguyen <duy.nguyen.rh@renesas.com> Signed-off-by: Tranh Ha <tranh.ha.xb@renesas.com> Link: https://patch.msgid.link/TYWPR01MB87434739F83E27EDCD23DF44B416A@TYWPR01MB8743.jpnprd01.prod.outlook.com Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> |
||
Chen Yufeng
|
6b69680847 |
can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled
This issue is similar to the vulnerability in the `mcp251x` driver,
which was fixed in commit
|
||
|
Linus Torvalds
|
dcf7d9e0ae |
This push fixes a NULL pointer dereference in ccp and a couple of
bugs in the af_alg interface. -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEn51F/lCuNhUwmDeSxycdCkmxi6cFAmjL0EIACgkQxycdCkmx i6ddxQ/+MaVwfK6Bkr0j4irBbTYXmV7jJCFxB13QaQhqW3QHMU/F670+epT7jI47 97sz53E967ORuvAK1K6mcHKhuk3cJ+D/8VRKc/S/vwLy51sB+6qWg0QTKdam7aYD KrtQKwSM8KHEFmCXl3qdAcbZ80PeqMo1y2vfO4bXr7ng9FETguxQgK2HAdkrnkc+ ksT4r+r2DTIJK8Yvs9MjklMG+vpkvxCVnYZcRu2Q6+GBqsXiLPb0LH4dlv9EO7iR JdwfxBOggauYE4WGv1XC8GYCp75el5w/VogVLl9NaXB5JVS9sOysvaV0CKtrVGW7 mb0Vb1f8DXXSXIHY0BDC8PImTWX/t87ArsZfCjgUXmPIaWW86nQQSdT7Z4Mabb9E DK6X/BVvvEOeJYlPDAx8lUOjKN/4DLHbjkf4NHF9eu7PwvVXWj2N8Rq5j32UVU8g rCt0uB2FvSPH3NpvCAwnHEsnQQFzWdixYUpD/VUYl3mHSrHptQ7wgSpX97XG6/r0 1jzBae7XF0sO9NrIKy9z8ZGyO1qU+WzAZvHHBvSu52S98mHu6K/SkWOxCE77kOqs QaoWBobW7Bbk1Fg/e6OZscvCdtS4LuDMdvCV1pqXW041hKb8rmPHI5wxRlT6jr7m Vhf9AAnwBtG2D1etwzvZg6Uu/VQBrbgK18J1qM/j+yBetPe3VM4= =47U8 -----END PGP SIGNATURE----- Merge tag 'v6.17-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: "This fixes a NULL pointer dereference in ccp and a couple of bugs in the af_alg interface" * tag 'v6.17-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg crypto: af_alg - Set merge to zero early in af_alg_sendmsg crypto: ccp - Always pass in an error pointer to __sev_platform_shutdown_locked() |
||
Basavaraj Natikar
|
bba920e6f8 |
HID: amd_sfh: Add sync across amd sfh work functions
The process of the report is delegated across different work functions.
Hence, add a sync mechanism to protect SFH work data across functions.
Fixes:
|
||
|
Linus Torvalds
|
e8442d5b7b |
sound fixes for 6.17-rc7
A collection of small fixes. The volume became higher than wished,
but nothing really stands out -- all small, nice and smooth.
A slightly large change is found in qcom USB-audio offload stuff, but
this is a regression fix specific to this device, hence it should be
safe to apply at this late stage.
- Various small fixes for ASoC Cirrus, Realtek, lpass, Intel and
Qualcomm drivers
- ASoC SoundWire fixes
- A few TAS2781 HD-audio side-codec driver fixes
- A fix for Qualcomm USB-audio offload breakage
- Usual a few HD-audio quirks
-----BEGIN PGP SIGNATURE-----
iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmjNFBMOHHRpd2FpQHN1
c2UuZGUACgkQLtJE4w1nLE9ngw/+P0wvO9UkWQwf1K1w1NfikJhrBP6+90adiK3x
UN3o/GZRWFFgLlSST9Uq2XyZZd0PZoiYxWrNNCNo9IUqaOTYvj5Cpznon/ZEQqnS
dyx8FnPymnx2OK7kN0RCXQ2ALwP8lpZJFtUTJ+sSF2f9JaRaTAFP2RQHG6VXYutz
9+y/cQBa1/nt8f6DQWmrS2kIdh8tu6lB4+bzMfUl4OrQ/7ySOIPgMXdvizCCLjLA
uxUpHwYIzYbk4+UZKh9jdvGyMfyzScA9YhX537c3VCQBo6Z8Wg4s2BbkUuFZsnU6
6c9piUbPzI2JOV9Hs9rBhWo+OOm7x6R0Cy6f5ulaoT4XuBFU7WMRhTi4t6czJGSC
w1JhHjbG0Tqk/ti1TCuhhDk2yiNcUjizotQEO4EPe1LYnPRIt1UaStw9KnRc+3G8
iQm3sqYCPMrUK6EWMeHFrImrodllzKbHdOq77SrPdNV8AX5i0OqkJTUmxEhqexbj
6tU/hIHJ8bT2c04yopne1e9ii9g9KBQGiVkAVY5xl0F1VXh1omrWCVT6zdskTKys
goFhU/3Qj/9fY1I86A/Pg3D03VIdXNHNDVgBMQxDQ/yUXIFrjYjHfQBs+uPFMRKy
nQpbXaF3kXwPxa7H4WrMisqsIiEtbBsN3ZLQwIz+7xsM5U3KXypo1OthWZV3q6ej
VX4liSY=
=amzV
-----END PGP SIGNATURE-----
Merge tag 'sound-6.17-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"A collection of small fixes. The volume became higher than wished, but
nothing really stands out -- all small, nice and smooth.
A slightly large change is found in qcom USB-audio offload stuff, but
this is a regression fix specific to this device, hence it should be
safe to apply at this late stage.
- Various small fixes for ASoC Cirrus, Realtek, lpass, Intel and
Qualcomm drivers
- ASoC SoundWire fixes
- A few TAS2781 HD-audio side-codec driver fixes
- A fix for Qualcomm USB-audio offload breakage
- Usual a few HD-audio quirks"
* tag 'sound-6.17-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (35 commits)
ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx
ALSA: hda: intel-dsp-config: Prevent SEGFAULT if ACPI_HANDLE() is NULL
ALSA: usb: qcom: Fix false-positive address space check
ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue
ASoC: Intel: PTL: Add entry for HDMI-In capture support to non-I2S codec boards.
ASoC: amd: acp: Fix incorrect retrival of acp_chip_info
ASoC: Intel: sof_sdw: use PRODUCT_FAMILY for Fatcat series
ASoC: qcom: sc8280xp: Fix sound card driver name match data for QCS8275
ALSA: hda/realtek: Fix volume control on Lenovo Thinkbook 13x Gen 4
ALSA: hda/realtek: Support Lenovo Thinkbook 13x Gen 5
ALSA: hda: cs35l41: Support Lenovo Thinkbook 13x Gen 5
ALSA: hda/realtek: Add ALC295 Dell TAS2781 I2C fixup
ALSA: hda/tas2781: Fix a potential race condition that causes a NULL pointer in case no efi.get_variable exsits
ASoC: qcom: sc8280xp: Enable DAI format configuration for MI2S interfaces
ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S
ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface
ASoC: Intel: catpt: Expose correct bit depth to userspace
ALSA: hda/tas2781: Fix the order of TAS2781 calibrated-data
ASoC: codecs: lpass-wsa-macro: Fix speaker quality distortion
ASoC: codecs: lpass-rx-macro: Fix playback quality distortion
...
|
||
|
Linus Torvalds
|
f2738f5660 |
drm fixes for 6.17-rc7
docs: - fix docs build regression i915: - Honor VESA eDP backlight luminance control capability bridge: - anx7625: Fix NULL pointer dereference with early IRQ - cdns-mhdp8546: Fix missing mutex unlock on error path xe: - Release kobject for the failure path - SRIOV PF: Drop rounddown_pow_of_two fair - Remove type casting on hwmon - Defer free of NVM auxiliary container to device release - Fix a NULL vs IS_ERR - Add cleanup action in xe_device_sysfs_init - Fix error handling if PXP fails to start - Set GuC RCS/CCS yield policy amdgpu: - GC 11.0.1/4 cleaner shader support - DC irq fix - OD fix amdkfd: - S0ix fix -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmjMy+oACgkQDHTzWXnE hr4Y7A//T+t/Q1bguspWP8bdTf5j2l48T5qK7GYBHomv5j9bGqY3+qURsBLewBqj upQsvYIGPFpsVC22G5vP0azHRMpIPIl3k1aIdbjdubbzQdM2WYSEO6/XB2Z6XxAJ SCQaeFbfSJUIZsXAOw2DnkRH8Ua0VaBbZBcBbKulPC5J60c2+iyPkaDUvPHIMBlo z6BIEyP88k7b7A3og0OAIsBD+DEd3BLTgh9b//F4T5ielC50jL38mGMEO00lMc8K aSZv3WGvP+dw5hrAkGtDju4PFPLPyRo5ixN+QzNuN/Rd838QzmsAafcIGquLmmx1 NO+pXOBI7mtxOc66OB5CM8rVYXb5qEbANKIYKrE+hIGpEXIYnBAr0LNJUfCXz79V S5+Wsi37Diw65V+eLSEJAU1ssl5q7x9HBmHwZsHVYinU/Icqw61rRplEyiRSru1b I0z5oFrfogxYPyHhZF9sBeI/OK2CODwJ5h7mvVNv73qZ9LauPuoletopauSU+l9c dEuREmTJJn51Uda6pi84ynCAiTELgCVa/3/yU5WYi26Rq+8UYKv11E7b8MC5QTTr zWXeaMfZFszC7DJ5I/WdptsgicLFSQRL9cc8yOJoKIUErqUnN7Ux32bOnh2Sp7UK khovrffWMulG8mqVSh6QocSt6Bn5Yi+Q5Tso6L/eObPFhhPzQuE= =tBQ6 -----END PGP SIGNATURE----- Merge tag 'drm-fixes-2025-09-19' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Weekly fixes for drm, it's a bit busier than I'd like on the xe side this week, but otherwise amdgpu and some smaller fixes for i915/bridge and a revert on docs. docs: - fix docs build regression i915: - Honor VESA eDP backlight luminance control capability bridge: - anx7625: Fix NULL pointer dereference with early IRQ - cdns-mhdp8546: Fix missing mutex unlock on error path xe: - Release kobject for the failure path - SRIOV PF: Drop rounddown_pow_of_two fair - Remove type casting on hwmon - Defer free of NVM auxiliary container to device release - Fix a NULL vs IS_ERR - Add cleanup action in xe_device_sysfs_init - Fix error handling if PXP fails to start - Set GuC RCS/CCS yield policy amdgpu: - GC 11.0.1/4 cleaner shader support - DC irq fix - OD fix amdkfd: - S0ix fix" * tag 'drm-fixes-2025-09-19' of https://gitlab.freedesktop.org/drm/kernel: drm/amdgpu: suspend KFD and KGD user queues for S0ix drm/amdkfd: add proper handling for S0ix drm/xe/guc: Set RCS/CCS yield policy drm/xe: Fix error handling if PXP fails to start drm/xe/sysfs: Add cleanup action in xe_device_sysfs_init drm/amd: Only restore cached manual clock settings in restore if OD enabled drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path drm/i915/backlight: Honor VESA eDP backlight luminance control capability drm/amd/display: Allow RX6xxx & RX7700 to invoke amdgpu_irq_get/put drm/amdgpu/gfx11: Add Cleaner Shader Support for GFX11.0.1/11.0.4 GPUs drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ drm/xe: defer free of NVM auxiliary container to device release callback drm/xe/hwmon: Remove type casting drm/xe/pf: Drop rounddown_pow_of_two fair LMEM limitation drm/xe/tile: Release kobject for the failure path Revert "drm: Add directive to format code in comment" |
||
Jason Gunthorpe
|
43f6bee021 |
iommufd/selftest: Update the fail_nth limit
There are more failure conditions now so 400 iterations is not enough pass them all, up it to 1000. The limit exists so it doesn't infinite loop. Link: https://patch.msgid.link/r/3-v1-02cd136829df+31-iommufd_syz_fput_jgg@nvidia.com Reviewed-by: Nicolin Chen <nicolinc@nvidia.com> Reviewed-by: Kevin Tian <kevin.tian@intel.com> Tested-by: Nicolin Chen <nicolinc@nvidia.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> |
||
|
Jason Gunthorpe
|
53d0584eeb |
iommufd: WARN if an object is aborted with an elevated refcount
If something holds a refcount then it is at risk of UAFing. For abort paths we expect the caller to never share the object with a parallel thread and to clean up any refcounts it obtained on its own. Add the missing dec inside iommufd_hwpt_paging_alloc() during error unwind by making iommufd_hw_pagetable_attach/detach() proper pairs. Link: https://patch.msgid.link/r/2-v1-02cd136829df+31-iommufd_syz_fput_jgg@nvidia.com Reviewed-by: Kevin Tian <kevin.tian@intel.com> Reviewed-by: Nicolin Chen <nicolinc@nvidia.com> Tested-by: Nicolin Chen <nicolinc@nvidia.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> |
||
|
Jason Gunthorpe
|
4e034bf045 |
iommufd: Fix race during abort for file descriptors
fput() doesn't actually call file_operations release() synchronously, it
puts the file on a work queue and it will be released eventually.
This is normally fine, except for iommufd the file and the iommufd_object
are tied to gether. The file has the object as it's private_data and holds
a users refcount, while the object is expected to remain alive as long as
the file is.
When the allocation of a new object aborts before installing the file it
will fput() the file and then go on to immediately kfree() the obj. This
causes a UAF once the workqueue completes the fput() and tries to
decrement the users refcount.
Fix this by putting the core code in charge of the file lifetime, and call
__fput_sync() during abort to ensure that release() is called before
kfree. __fput_sync() is a bit too tricky to open code in all the object
implementations. Instead the objects tell the core code where the file
pointer is and the core will take care of the life cycle.
If the object is successfully allocated then the file will hold a users
refcount and the iommufd_object cannot be destroyed.
It is worth noting that close(); ioctl(IOMMU_DESTROY); doesn't have an
issue because close() is already using a synchronous version of fput().
The UAF looks like this:
BUG: KASAN: slab-use-after-free in iommufd_eventq_fops_release+0x45/0xc0 drivers/iommu/iommufd/eventq.c:376
Write of size 4 at addr ffff888059c97804 by task syz.0.46/6164
CPU: 0 UID: 0 PID: 6164 Comm: syz.0.46 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xcd/0x630 mm/kasan/report.c:482
kasan_report+0xe0/0x110 mm/kasan/report.c:595
check_region_inline mm/kasan/generic.c:183 [inline]
kasan_check_range+0x100/0x1b0 mm/kasan/generic.c:189
instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:400 [inline]
__refcount_dec include/linux/refcount.h:455 [inline]
refcount_dec include/linux/refcount.h:476 [inline]
iommufd_eventq_fops_release+0x45/0xc0 drivers/iommu/iommufd/eventq.c:376
__fput+0x402/0xb70 fs/file_table.c:468
task_work_run+0x14d/0x240 kernel/task_work.c:227
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:43
exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
do_syscall_64+0x41c/0x4c0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Link: https://patch.msgid.link/r/1-v1-02cd136829df+31-iommufd_syz_fput_jgg@nvidia.com
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Jason Gunthorpe
|
7a425ec75d |
iommufd: Fix refcounting race during mmap
The owner object of the imap can be destroyed while the imap remains in
the mtree. So access to the imap pointer without holding locks is racy
with destruction.
The imap is safe to access outside the lock once a users refcount is
obtained, the owner object cannot start destruction until users is 0.
Thus the users refcount should not be obtained at the end of
iommufd_fops_mmap() but instead inside the mtree lock held around the
mtree_load(). Move the refcount there and use refcount_inc_not_zero() as
we can have a 0 refcount inside the mtree during destruction races.
Link: https://patch.msgid.link/r/0-v1-e6faace50971+3cc-iommufd_mmap_fix_jgg@nvidia.com
Cc: stable@vger.kernel.org
Fixes:
|
||
Yang Xiuwei
|
2c139a47ef |
io_uring: fix incorrect io_kiocb reference in io_link_skb
In io_link_skb function, there is a bug where prev_notif is incorrectly
assigned using 'nd' instead of 'prev_nd'. This causes the context
validation check to compare the current notification with itself instead
of comparing it with the previous notification.
Fix by using the correct prev_nd parameter when obtaining prev_notif.
Signed-off-by: Yang Xiuwei <yangxiuwei@kylinos.cn>
Reviewed-by: Pavel Begunkov <asml.silence@gmail.com>
Fixes:
|