mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-11-10 20:48:12 +00:00
1,463,462 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Holger Dengler
|
b3d4ab2d7d |
s390/pkey: Check length in PKEY_VERIFYPROTK ioctl
Explicitly check the buffer length request structure provided by
user-space and fail, if it exceeds the buffer size.
Cc: stable@vger.kernel.org
Fixes:
|
||
Lorenzo Bianconi
|
f4c2d8668d |
netfilter: flowtable: fix and simplify IP6IP6 tunnel handling
Fix nf_flow_ip6_tunnel_proto() to use pskb_may_pull() instead of
skb_header_pointer() to ensure the outer IPv6 header is in the skb
headroom, which is required for subsequent packet processing. Move
ctx->offset update inside the IPPROTO_IPV6 conditional block since it
should only be adjusted when an IP6IP6 tunnel is actually detected.
Simplify the rx path by removing ipv6_skip_exthdr() and checking
ip6h->nexthdr directly, as the flowtable fast path only handles simple
IP6IP6 encapsulation without extension headers.
Drop the tunnel encapsulation limit destination option support from the
tx path to match, since the rx path no longer handles extension headers.
Remove the encap_limit parameter from nf_flow_offload_ipv6_forward(),
nf_flow_tunnel_ip6ip6_push() and nf_flow_tunnel_v6_push(), along with
the ipv6_tel_txoption struct and related headroom/MTU adjustments.
Fixes:
|
||
Wyatt Feng
|
5feba91006 |
netfilter: xt_cluster: reject template conntracks in hash match
xt_cluster_mt() treats any non-NULL nf_ct_get() result as a fully
initialized conntrack and passes it to xt_cluster_hash().
This causes a state confusion bug when the raw table CT target attaches
a template conntrack to skb->_nfct before normal conntrack processing.
Templates carry IPS_TEMPLATE status but do not have a valid tuple for
hashing yet, so xt_cluster_hash() can hit its WARN_ON() path on the
zeroed l3num field.
Reject template conntracks before hashing them. This matches existing
netfilter handling for template objects and avoids hashing incomplete
conntrack state.
Fixes:
|
||
Haoze Xie
|
c9c9b37f8c |
netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst
The br_netfilter fake rtable is embedded in struct net_bridge and is
attached to bridged packets with skb_dst_set_noref(). If such a packet is
queued to NFQUEUE, __nf_queue() upgrades that fake dst with
skb_dst_force().
At that point the queued skb can hold a real dst reference after bridge
teardown has started. The problem is not that every bridged packet needs
its own dst reference. The problem is that NFQUEUE can keep the bridge
private fake dst alive after unregister begins.
Fix this by keeping the bridge fake dst model unchanged and pinning the
bridge master device only while the packet sits in NFQUEUE. Record the
bridge device in nf_queue_entry when the queued skb carries a bridge fake
dst, take a device reference for the queue lifetime, and drop it when the
queue entry is freed.
Also make sure queued entries are reaped when that bridge device goes
down, and drop the redundant nf_bridge_info_exists() test from the fake
dst detection.
This keeps netdev_priv(br->dev) alive until verdict completion, so the
embedded fake rtable and its metrics backing storage cannot be freed out
from under dst_release(). It also avoids the constant refcount bump and
avoids using ipv4-specific dst helpers for IPv6 bridge traffic.
Fixes:
|
||
Peter Zijlstra
|
e62d4192e5 |
perf: Fix addr_filter_ranges lifetime
Lee Jia Jie reported that since event::addr_filter_ranges is used under RCU, it should be RCU freed. Reported-by: Lee Jia Jie <jiajie.lee@starlabs.sg> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> |
||
Adrian Bente
|
53b3e60edb |
netfilter: flowtable: fix offloaded ct timeout never being extended
OpenWrt has recently migrated many platforms to kernel 6.18. On the
MediaTek platform, which supports hardware network offloading, WiFi
connections accelerated via the WED path were observed to drop after
roughly 300 seconds.
After several debugging sessions, assisted by the Claude LLM, the
problem was narrowed down as follows:
nf_flow_table_extend_ct_timeout() extends ct->timeout for offloaded
flows using:
cmpxchg(&ct->timeout, expires, new_timeout);
'expires' comes from nf_ct_expires(ct) and is a relative value, while
ct->timeout holds an absolute timestamp. The two are never equal, so
the cmpxchg always fails and the timeout is never extended.
This goes unnoticed for most flows, but a long-lived hardware (WED)
offloaded flow on MediaTek MT7986 eventually has ct->timeout decay to
zero, the conntrack entry is reaped and the connection breaks.
Open-code the relative value from a single READ_ONCE(ct->timeout)
snapshot and compare against that same absolute snapshot in the
cmpxchg, so the timeout extension actually takes effect while the
datapath remains authoritative if it updates ct->timeout concurrently.
Fixes:
|
||
Bartosz Golaszewski
|
442d60df74 |
x86/platform/geode: reference the real node of the cs5535 GPIO controller
GPIO software node lookup should rely exclusively on matching the addresses of the referenced firmware nodes. Commit |
||
|
Bartosz Golaszewski
|
9611c0ce21 |
Merge commit '6beaec3aee' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux into gpio/for-current
This pulls in the merge commit for MFD updates for v7.2. The PR contains a build-time dependency of one of the GPIO commits that will follow. |
||
Ramcharan Rajpurohit
|
f56521ab6f |
ALSA: hda/realtek: Enable mute LED on HP EliteBook 840 G6
The HP EliteBook 840 G6 (PCI SSID 103c:854d) has an ALC215 codec whose mic-mute and audio-mute LEDs are wired to the same GPIOs as the already supported EliteBook 830 G6 and 840 G7. Without a matching quirk the LEDs are never registered, so the front-panel mic-mute LED stays permanently lit and does not track the mute state. Apply ALC285_FIXUP_HP_GPIO_LED, mirroring the sibling EliteBook entries. With this fixup the codec registers an "hda::micmute" LED class device and the LED correctly follows the capture-mute state. This was verified on the affected machine by forcing the same fixup at runtime via snd_sof_intel_hda_generic.hda_model=103c:8548, which made the LED work as expected. Signed-off-by: Ramcharan Rajpurohit <b23ci1032@iitj.ac.in> Link: https://patch.msgid.link/20260619062435.26256-1-b23ci1032@iitj.ac.in Signed-off-by: Takashi Iwai <tiwai@suse.de> |
||
Cen Zhang
|
f199c8a8bd |
ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints
MIDI 2.0 input URBs are started during snd_usb_midi_v2_create(). A
later setup failure can still jump to snd_usb_midi_v2_free(), which
currently frees each endpoint and its coherent URB buffers without first
stopping the submitted URBs. A completion can then dereference the
embedded URB context and endpoint state after they have been freed, or
try to resubmit from the stale endpoint.
This was observed as a KASAN slab-use-after-free in
input_urb_complete().
The buggy scenario involves two paths, with each column showing the order
within that path:
probe error path: USB completion path:
1. start_input_streams() submits 1. The HCD still owns a
input URBs. submitted input URB.
2. A later setup helper returns 2. input_urb_complete() runs
an error. with urb->context in ep.
3. snd_usb_midi_v2_free() frees 3. The completion reads ep
endpoint storage and URB buffers. state and can requeue URBs.
Make the endpoint destructor follow the same teardown ordering used for
disconnect when the endpoint has not already been disconnected: publish
ep->disconnected, kill the URBs synchronously, and drain the endpoint
before freeing URB buffers and endpoint storage. The guard avoids
repeating the stop sequence after the normal
snd_usb_midi_v2_disconnect_all() path, while still synchronizing the
direct MIDI 2.0 create-error free path.
Validation reproduced this kernel report:
BUG: KASAN: slab-use-after-free in input_urb_complete+0x37/0x1b0
Workqueue: usb_hub_wq hub_event
RIP: 0010:_raw_spin_unlock_irq+0x2e/0x50
Read of size 8
Call trace:
dump_stack_lvl+0x77/0xb0
print_report+0xce/0x5f0
input_urb_complete+0x37/0x1b0 (sound/usb/midi2.c:186)
srso_alias_return_thunk+0x5/0xfbef5
__virt_addr_valid+0x19f/0x330
kasan_report+0xe0/0x110
__usb_hcd_giveback_urb+0x112/0x1d0
dummy_timer+0xaaa/0x19a0
lock_is_held_type+0x9a/0x110
__lock_acquire+0x467/0x28b0
mark_held_locks+0x40/0x70
_raw_spin_unlock_irqrestore+0x44/0x60
lockdep_hardirqs_on_prepare+0xbb/0x1a0
__hrtimer_run_queues+0x101/0x520
hrtimer_run_softirq+0xd0/0x130
handle_softirqs+0x15b/0x670
__irq_exit_rcu+0xd0/0x170
irq_exit_rcu+0xe/0x20
sysvec_apic_timer_interrupt+0x6c/0x80
asm_sysvec_apic_timer_interrupt+0x1a/0x20
Fixes:
|
||
Alice Ryhl
|
191f49f1e3 |
rust: Kbuild: set frame-pointer llvm module flag for CONFIG_FRAME_POINTER
Due to a rustc bug, the -Cforce-frame-pointers=y flag only emits the frame-pointer annotation for functions, but not for the module. This means that functions generated by the LLVM backend such as 'asan.module_ctor' do not receive the frame-pointer annotation. This is likely to lead to broken backtraces and may also cause issues with ftrace if these features are used with functions generated by the LLVM backend. Thus, use -Zllvm_module_flag to work around this rustc bug if using a rustc without the fix. [ The fix [1] has landed for Rust 1.98.0 (expected release on 2026-08-20). - Miguel ] Cc: stable@vger.kernel.org # 6.12.y and later (flag not available in pinned Rust in older LTSs). Fixes: |
||
Gary Guo
|
ac4d1caa82 |
rust: doctest: fix incorrect pattern in replacement
The `-> Result<(), impl core::fmt::Debug>` string is generated by rustdoc
and by adding "::" into the string it no longer finds anything, making
the line useless.
Remove the "::" in the pattern. Omit it in the replacement too, for
consistency with upstream rustdoc.
Fixes:
|
||
Linus Torvalds
|
f32a375ecc |
RISC-V updates for v7.2
- Prevent get_free_mem_region() from returning regions that are
unmappable in certain circumstances by defining
DIRECT_MAP_PHYSMEM_END for RISC-V
- Fix an early boot problem with kexec_file when the amount of
installed physical memory installed on the system exceeds the direct
map size, which is possible in certain RISC-V virtual memory modes
- Unconditionally sfence.vma in the new vmalloc area handling code in
the page fault handler, since even the presence of Svvptc doesn't
guarantee that the CPU won't immediately fault again after the
exception handler completes and subsequently crash
- Fix ftrace_graph_ret_addr() to use the correct task pointer
(aligning with what other architectures do)
- Fix the misaligned access performance checking code in cases when
performance is specified on the kernel command line and when CPUs
have been brought offline and back online
- Get rid of a bogus address offset in the non-frame-pointer version
of walk_stackframe(), aligning it with the frame pointer-based code
- Fix a RISC-V kfence issue causing bogus use-after-free warnings
- Add ARCH_HAS_CC_CAN_LINK for RISC-V, which needs different compiler
command line flags than other architectures
- Implement _THIS_IP_ using RISC-V-specific assembly, which seems to
be less brittle (from a compiler point of view) than taking the
address of a label
- Reduce kernel startup overhead by defining
HAVE_BUILDTIME_MCOUNT_SORT, since arch/riscv meets all the
requirements
- Patch the CFI vDSO during alternatives processing, not only the
standard vDSO
- Fix a potential memory leak in the cacheinfo code
- Clean up kernel/setup.c:add_resource() to pass along the return
value from insert_resource() and to improve the display of
resource ranges
- Clean up our purgatory.[ch] by aligning our purgatory() prototype
to what's in arch/x86, and by cleaning up verify_sha256_digest()
- Clean up cpu_is_stopped() to align its function a little more
closely to its name
- Replace some unbounded string function usage in get_early_cmdline()
and the ptdump code with strscpy()
- Replace sprintf() with sysfs_emit() in cpu_show_ghostwrite() for
safer bounds checking
- Standardize how compiler output flags are specified in the RISC-V
kselftests, aligning them with what other architectures do
- Use the Linux-generic cmp_int() macro in place of an open-coded
"cmp_3way()" macro in kernel/module-sections.c
- Panic early in boot if IRQ handler stacks can't be allocated rather
than pretending to continue normally
- Add support for Eswin SoCs in the RISC-V defconfig
- Remove some unnecessary conditionals in sbi_hsm_hart_{start,stop}()
- Clean up some Kconfig infelicities found by Kconfirm
- Replace an open-coded version of min() in the kexec_elf code with
the standard min() function
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEElRDoIDdEz9/svf2Kx4+xDQu9KksFAmoys0cACgkQx4+xDQu9
KktrOhAAn3B7WDwnF7CB3q68L8uf3F0PMTkEekkXb4PrEe6W8tkUFgNODxEejIk6
PpnyryXX4+0qlXliK/pNfBhNBXStXAfBAMm8KLEqjr+RozHMPDiEnCp0DNGjb1iW
TtVmxnpDn1BvLdvcc5bP6a1QaizuhcpVob2zyMzbTJJvNXdT4SVtFX5qRMbkzh8o
rSB7+b349fAhm+xOdpP+odK2dtUxUcD3vWX2bwrQloHAMSGIGe5rTtDLqzdip0rp
OFlEocP4hbtusiujRYHEOD7ZfeBuxfuLacAk0cT1XXkBmwI/42934359UeacGlcq
OM1vAtt3F1Xr2T4NjaRLxC3RleeKqM4w/1+f3tGrPPMcnOM+dKFQ75huls02Sj5u
1/PpuVW/FRA8pbMoMR8fQj8ed1MVumYXDMYKc8Et37m1hQfdbqE2zsRAUkX0724s
fASeMfrTKv3gIEtvzXob2ypgX+nfBJEPjiYixlGAPTV1EJRlgk0FsveZR/eoC/6n
00B9d1LYa0invctNVq/1adbBevv7sCqUMYZZipev8eOibCrWP/2TLZ3JbJi09VgB
M/YN8BTeyXNrJgdQNGWOtZ2klqy8nO7ZKekidOInv1XfSveodO/5Tz2BugrCof5b
+3ixRlLYObhbIEOIC7FJhVkBvH43rBEORql2Us93BauEdDK0haI=
=30S7
-----END PGP SIGNATURE-----
Merge tag 'riscv-for-linus-7.2-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux
Pull RISC-V updates from Paul Walmsley:
- Prevent get_free_mem_region() from returning regions that are
unmappable in certain circumstances by defining
DIRECT_MAP_PHYSMEM_END for RISC-V
- Fix an early boot problem with kexec_file when the amount of
installed physical memory installed on the system exceeds the direct
map size, which is possible in certain RISC-V virtual memory modes
- Unconditionally sfence.vma in the new vmalloc area handling code in
the page fault handler, since even the presence of Svvptc doesn't
guarantee that the CPU won't immediately fault again after the
exception handler completes and subsequently crash
- Fix ftrace_graph_ret_addr() to use the correct task pointer (aligning
with what other architectures do)
- Fix the misaligned access performance checking code in cases when
performance is specified on the kernel command line and when CPUs
have been brought offline and back online
- Get rid of a bogus address offset in the non-frame-pointer version of
walk_stackframe(), aligning it with the frame pointer-based code
- Fix a RISC-V kfence issue causing bogus use-after-free warnings
- Add ARCH_HAS_CC_CAN_LINK for RISC-V, which needs different compiler
command line flags than other architectures
- Implement _THIS_IP_ using RISC-V-specific assembly, which seems to be
less brittle (from a compiler point of view) than taking the address
of a label
- Reduce kernel startup overhead by defining
HAVE_BUILDTIME_MCOUNT_SORT, since arch/riscv meets all the
requirements
- Patch the CFI vDSO during alternatives processing, not only the
standard vDSO
- Fix a potential memory leak in the cacheinfo code
- Clean up kernel/setup.c:add_resource() to pass along the return value
from insert_resource() and to improve the display of resource ranges
- Clean up our purgatory.[ch] by aligning our purgatory() prototype to
what's in arch/x86, and by cleaning up verify_sha256_digest()
- Clean up cpu_is_stopped() to align its function a little more closely
to its name
- Replace some unbounded string function usage in get_early_cmdline()
and the ptdump code with strscpy()
- Replace sprintf() with sysfs_emit() in cpu_show_ghostwrite() for
safer bounds checking
- Standardize how compiler output flags are specified in the RISC-V
kselftests, aligning them with what other architectures do
- Use the Linux-generic cmp_int() macro in place of an open-coded
"cmp_3way()" macro in kernel/module-sections.c
- Panic early in boot if IRQ handler stacks can't be allocated rather
than pretending to continue normally
- Add support for Eswin SoCs in the RISC-V defconfig
- Remove some unnecessary conditionals in sbi_hsm_hart_{start,stop}()
- Clean up some Kconfig infelicities found by Kconfirm
- Replace an open-coded version of min() in the kexec_elf code with
the standard min() function
* tag 'riscv-for-linus-7.2-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (36 commits)
riscv: traps_misaligned: Avoid redundant unaligned access speed probe
riscv: misaligned: Fix fast_unaligned_access_speed_key init
riscv: also select ARCH_KEEP_MEMBLOCK if kexec is selected
riscv: alternative: Also patch the CFI vDSO
riscv: alternative: Pass vDSO start as parameter to apply_vdso_alternatives()
riscv: alternative: Use IS_ENABLED() over ifdeffery for apply_vdso_alternatives()
riscv: vdso: Always declare vdso_start symbols
riscv: kexec: use min to simplify riscv_kexec_elf_load
riscv: panic if IRQ handler stacks cannot be allocated
riscv: mm: Unconditionally sfence.vma for spurious fault
riscv: mm: Use the bitmap API for new_valid_map_cpus
riscv: mm: Rename new_vmalloc into new_valid_map_cpus
riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()
riscv: mm: Extract helper mark_new_valid_map()
riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe
riscv: cacheinfo: Fix node reference leak in populate_cache_leaves
riscv: kexec_file: Constrain segment placement to direct map
riscv: mm: Define DIRECT_MAP_PHYSMEM_END
riscv: defconfig: Enable Eswin SoCs
riscv: cpu_ops_sbi: No need to be bothered to check ret.error
...
|
||
|
Linus Torvalds
|
9ecfb2f728 |
ring-buffer: Updates for v7.2:
- Do not invalidate entire buffer for invalid sub-buffers For the persistent ring buffer, if one sub-buffer is found to be invalid, it invalidates the entire per CPU ring buffer. This can lose a lot of valuable data if there's some corruption with the writes to the buffer not syncing properly on a hard crash. Instead, if a sub-buffer is found to be invalid, simply zero it out and mark it for "missed events". When the persistent ring buffer is read and a sub-buffer that was cleared due to being invalid on boot up is discovered, the output will show "[LOST EVENTS]" to let the user know that events were missing at that location. Displaying the events from valid buffers can still be useful. - Add a test to be able to test corrupted sub-buffers If a persistent ring buffer is created as "ptraingtest" and the new config that adds the test is enabled, when a panic happens, the kernel will randomly corrupt one of the per CPU ring buffers. On boot up, the sub-buffers with the corruption should be cleared and flagged. When reading this buffer, the missed events should should [LOST EVENTS]. - Add commit number in the sub-buffer meta debug info The commit is used to know the content of a meta page. Add it to the buffer_meta file that is shown for each per CPU buffer. - Clean up the persistent ring buffer validation code Add some helper functions and make variable names more consistent. -----BEGIN PGP SIGNATURE----- iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCajMDZBQccm9zdGVkdEBn b29kbWlzLm9yZwAKCRAp5XQQmuv6qhDLAP4i0b8HP159LOEy/IiQKZ7hfAaUhTK8 imMVS6V1bVKTjgD8Dy/f9m8259ZIcgN9mjSKXlT30qAeGmhjjDCdc0TnagM= =mokF -----END PGP SIGNATURE----- Merge tag 'trace-ring-buffer-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull ring-buffer updates from Steven Rostedt - Do not invalidate entire buffer for invalid sub-buffers For the persistent ring buffer, if one sub-buffer is found to be invalid, it invalidates the entire per CPU ring buffer. This can lose a lot of valuable data if there's some corruption with the writes to the buffer not syncing properly on a hard crash. Instead, if a sub-buffer is found to be invalid, simply zero it out and mark it for "missed events". When the persistent ring buffer is read and a sub-buffer that was cleared due to being invalid on boot up is discovered, the output will show "[LOST EVENTS]" to let the user know that events were missing at that location. Displaying the events from valid buffers can still be useful. - Add a test to be able to test corrupted sub-buffers If a persistent ring buffer is created as "ptraingtest" and the new config that adds the test is enabled, when a panic happens, the kernel will randomly corrupt one of the per CPU ring buffers. On boot up, the sub-buffers with the corruption should be cleared and flagged. When reading this buffer, the missed events should should [LOST EVENTS]. - Add commit number in the sub-buffer meta debug info The commit is used to know the content of a meta page. Add it to the buffer_meta file that is shown for each per CPU buffer. - Clean up the persistent ring buffer validation code Add some helper functions and make variable names more consistent. * tag 'trace-ring-buffer-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: ring-buffer: Better comment the use of RB_MISSED_EVENTS ring-buffer: Show persistent buffer dropped events in trace_pipe file ring-buffer: Show persistent buffer dropped events in trace file ring-buffer: Have dropped subbuffers be persistent across reboots ring-buffer: Cleanup buffer_data_page related code ring-buffer: Cleanup persistent ring buffer validation ring-buffer: Show commit numbers in buffer_meta file ring-buffer: Add persistent ring buffer invalid-page inject test ring-buffer: Skip invalid sub-buffers when rewinding persistent ring buffer ring-buffer: Skip invalid sub-buffers when validating persistent ring buffer |
||
|
Linus Torvalds
|
23b5d045ae |
tracing: Updates for v7.2:
- Remove a redundant IS_ERR() check trace_pipe_open() already checks for IS_ERR() and does it again in the return path. Remove the return check. - Export seq_buf_putmem_hex() to allow kunit tests against them To add Kunit tests on seq_buf_putmem_hex(), it needs to be exported. - Replace strcat() and strcpy() with seq_buf() logic The code for synthetic events uses a series of strcat() and strcpy() which can be error prone. Replace them with seq_buf() logic that does all the necessary bound checking. - Add a lockdep rcu_is_watching() to trace_##event##_enabled() call The trace_##event##_enabled() is a static branch that is true if the "event" is enabled. But this can hide bugs if this logic is in a location where RCU is disabled and not "watching". It would only trigger if lockdep is enabled and the event is enabled. Add a "rcu_is_watching()" warning if lockdep is enabled in that helper function to trigger regardless if the event is enabled or not. - Remove the local variable in the trace_printk() macro For name space integrity, remove the _______STR variable in the trace_printk() macro for using the sizeof() macro directly. - Use guard()s for the trace_recursion_record.c file - Fix typo in a comment of eventfs_callback() kerneldoc - Use trace_call__##event() in events called within trace_##event##_enabled() A couple of events are called within an if block guarded by trace_##event##_enabled(). That is a static key that is only enabled when the event is enabled. The trace_call_##event() calls the tracepoint code directly without adding a redundant static key for that check. - Allow perf to read synthetic events Currently, perf does not have the ability to enable a synthetic event. If it does, it will either cause a kernel warning or error with "No such device". Synthetic events are not much different than kprobes and perf can handle fine with a few modifications. - Replace printk(KERN_WARNING ...) with pr_warn() - Replace krealloc() on an array with krealloc_array() - Fix README file path name for synthetic events - Change tracing_map tracing_map_array to use a flexible array Instead of allocating a separate pointer to hold the pages field of tracing_map_array, allocate the pages field as a flexible array when allocating the structure. - Fold trace_iterator_increment() into trace_find_next_entry_inc() The function trace_iterator_increment() was only used by trace_find_next_entry_inc(). It's not big enough to be a helper function for one user. Fold it into its caller. - Make field_var_str field a flexible array of hist_elt_data Instead of allocating a separate pointer for the field_var_str array of the hist_elt_data structure, allocate it as a flexible array when allocating the structure. - Disable KCOV for trace_irqsoff.c Like trace_preemptirq.c, trace_irqsoff.c has code that will crash when KCOV is enabled on ARM. The irqsoff tracing can be called on ARM because the irqsoff tracing code can be run from early interrupt code and produce coverage unrelated to syscall inputs. - Fix warning in __unregister_ftrace_function() called by perf Perf calls unregister_ftrace_function() without checking if its ftrace_ops has already been unregistered. There's an error path where on clean up it will unregister the ftrace_ops even if it wasn't registered and causes a warning. -----BEGIN PGP SIGNATURE----- iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCajHGbRQccm9zdGVkdEBn b29kbWlzLm9yZwAKCRAp5XQQmuv6qqP/AP4nv/Tmv6T7vxMzL7dY/WJ0xT2xkW7Z tlejy1AM/RBaTAEAkkgdDNhIAJwxCxsmY6/Zr1mRWzaF7O4kX94KYFcBHww= =7nyZ -----END PGP SIGNATURE----- Merge tag 'trace-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing updates from Steven Rostedt: - Remove a redundant IS_ERR() check trace_pipe_open() already checks for IS_ERR() and does it again in the return path. Remove the return check. - Export seq_buf_putmem_hex() to allow kunit tests against them To add Kunit tests on seq_buf_putmem_hex(), it needs to be exported. - Replace strcat() and strcpy() with seq_buf() logic The code for synthetic events uses a series of strcat() and strcpy() which can be error prone. Replace them with seq_buf() logic that does all the necessary bound checking. - Add a lockdep rcu_is_watching() to trace_##event##_enabled() call The trace_##event##_enabled() is a static branch that is true if the "event" is enabled. But this can hide bugs if this logic is in a location where RCU is disabled and not "watching". It would only trigger if lockdep is enabled and the event is enabled. Add a "rcu_is_watching()" warning if lockdep is enabled in that helper function to trigger regardless if the event is enabled or not. - Remove the local variable in the trace_printk() macro For name space integrity, remove the _______STR variable in the trace_printk() macro for using the sizeof() macro directly. - Use guard()s for the trace_recursion_record.c file - Fix typo in a comment of eventfs_callback() kerneldoc - Use trace_call__##event() in events within trace_##event##_enabled() A couple of events are called within an if block guarded by trace_##event##_enabled(). That is a static key that is only enabled when the event is enabled. The trace_call_##event() calls the tracepoint code directly without adding a redundant static key for that check. - Allow perf to read synthetic events Currently, perf does not have the ability to enable a synthetic event. If it does, it will either cause a kernel warning or error with "No such device". Synthetic events are not much different than kprobes and perf can handle fine with a few modifications. - Replace printk(KERN_WARNING ...) with pr_warn() - Replace krealloc() on an array with krealloc_array() - Fix README file path name for synthetic events - Change tracing_map tracing_map_array to use a flexible array Instead of allocating a separate pointer to hold the pages field of tracing_map_array, allocate the pages field as a flexible array when allocating the structure. - Fold trace_iterator_increment() into trace_find_next_entry_inc() The function trace_iterator_increment() was only used by trace_find_next_entry_inc(). It's not big enough to be a helper function for one user. Fold it into its caller. - Make field_var_str field a flexible array of hist_elt_data Instead of allocating a separate pointer for the field_var_str array of the hist_elt_data structure, allocate it as a flexible array when allocating the structure. - Disable KCOV for trace_irqsoff.c Like trace_preemptirq.c, trace_irqsoff.c has code that will crash when KCOV is enabled on ARM. The irqsoff tracing can be called on ARM because the irqsoff tracing code can be run from early interrupt code and produce coverage unrelated to syscall inputs. - Fix warning in __unregister_ftrace_function() called by perf Perf calls unregister_ftrace_function() without checking if its ftrace_ops has already been unregistered. There's an error path where on clean up it will unregister the ftrace_ops even if it wasn't registered and causes a warning. * tag 'trace-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: perf/ftrace: Fix WARNING in __unregister_ftrace_function tracing: Disable KCOV instrumentation for trace_irqsoff.o tracing: Turn hist_elt_data field_var_str into a flexible array tracing: Move trace_iterator_increment() into trace_find_next_entry_inc() tracing: Simplify pages allocation for tracing_map logic tracing: Fix README path for synthetic_events tracing: Use krealloc_array() for trace option array growth tracing/branch: Use pr_warn() instead of printk(KERN_WARNING) tracing: Allow perf to read synthetic events HID: Use trace_call__##name() at guarded tracepoint call sites cpufreq: amd-pstate: Use trace_call__##name() at guarded tracepoint call site tracefs: Fix typo in a comment of eventfs_callback() kerneldoc tracing: Switch trace_recursion_record.c code over to use guard() tracing: Remove local variable for argument detection from trace_printk() tracepoint: Add lockdep rcu_is_watching() check to trace_##name##_enabled() tracing: Bound synthetic-field strings with seq_buf seq_buf: Export seq_buf_putmem_hex() and add KUnit tests tracing: Remove redundant IS_ERR() check in trace_pipe_open() |
||
Daniel Zahka
|
96e7f9122a |
eth: fbnic: take netif_addr_lock_bh() around rx mode address programming
When __fbnic_set_rx_mode() is called from contexts other than
.ndo_set_rx_mode_async(), the uc and mc addr lists are accessed
without the addr lock that __hw_addr_sync_dev() and
__hw_addr_unsync_dev() require. Wrap these unprotected accesses with
netif_addr_lock_bh(). fbnic_clear_rx_mode() has similar issues.
Fixes:
|
||
Doruk Tan Ozturk
|
bda3348872 |
tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
tipc_aead_decrypt() goes straight from tipc_bearer_hold(b) to crypto_aead_decrypt(req) without taking a reference on the netns, unlike the encrypt path. When crypto_aead_decrypt() is offloaded asynchronously (e.g. the SIMD aead wrapper queuing to cryptd), the cryptd worker runs tipc_aead_decrypt_done() later. If the bearer's netns is torn down in the meantime, cleanup_net() -> tipc_exit_net() -> tipc_crypto_stop() frees the per-netns tipc_crypto, and the completion then reads it: tipc_aead_decrypt_done() dereferences aead->crypto->stats and aead->crypto->net, and tipc_crypto_rcv_complete() dereferences aead->crypto->aead[] and the node table -- reading freed memory. Decoded KASAN splat (v7.1-rc7, CONFIG_KASAN_INLINE + TIPC + TIPC_CRYPTO): BUG: KASAN: slab-use-after-free in tipc_aead_decrypt_done (net/tipc/crypto.c:999) Read of size 8 at addr ffff8881056258a8 by task kworker/u16:2/51 Workqueue: events_unbound Call Trace: tipc_aead_decrypt_done (net/tipc/crypto.c:999) process_one_work (kernel/workqueue.c:3314) worker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) Allocated by task 169: __kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415) tipc_crypto_start (net/tipc/crypto.c:1502) tipc_init_net (net/tipc/core.c:72) ops_init (net/core/net_namespace.c:137) setup_net (net/core/net_namespace.c:446) copy_net_ns (net/core/net_namespace.c:579) create_new_namespaces (kernel/nsproxy.c:132) __x64_sys_unshare (kernel/fork.c:3316) do_syscall_64 (arch/x86/entry/syscall_64.c:63) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Freed by task 8: kfree (mm/slub.c:6566) tipc_exit_net (net/tipc/core.c:119) cleanup_net (net/core/net_namespace.c:704) process_one_work (kernel/workqueue.c:3314) kthread (kernel/kthread.c:436) This is the same class of bug that commit |
||
Michael Bommarito
|
e5c0002327 |
net: rds: check cmsg_len before reading rds_rdma_args in size pass
rds_rm_size() handles RDS_CMSG_RDMA_ARGS after only CMSG_OK() and then calls rds_rdma_extra_size(), which reads args->local_vec_addr and args->nr_local without first checking that cmsg_len covers struct rds_rdma_args. The other two RDS_CMSG_RDMA_ARGS consumers already guard this: rds_rdma_bytes() in rds_sendmsg() and rds_cmsg_rdma_args() in rds_cmsg_send() both reject cmsg_len < CMSG_LEN(sizeof(struct rds_rdma_args)). Add the same check to rds_rm_size() so all three RDMA args passes are consistent. This is a consistency and hardening change with no behavioral effect for well-formed senders and no reachable bug today: rds_rdma_bytes() runs before rds_rm_size() in rds_sendmsg() and already rejects a short RDS_CMSG_RDMA_ARGS, so the size pass is not reached with an undersized cmsg. But rds_rm_size() reads the args independently of that earlier pass, and nothing in rds_rm_size() itself records or enforces the precondition, so a reader or a future refactor of the size pass cannot tell the cmsg has already been length-checked. Applying the same cmsg_len guard in all three RDS_CMSG_RDMA_ARGS consumers keeps that invariant local to each and robust to reordering. Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Reviewed-by: Allison Henderson <achender@kernel.org> Link: https://patch.msgid.link/20260617023146.2780077-1-michael.bommarito@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
Ross Porter
|
b8613e9792 |
selftests: net: fix file owner for broadcast_ether_dst test
Ensure the output file is always owned by root (even if tcpdump was
compiled with `--with-user`), by passing the `-Z root` argument when
invoking it.
Cc: stable@vger.kernel.org
Reported-by: Edoardo Canepa <edoardo.canepa@canonical.com>
Closes: https://bugs.launchpad.net/ubuntu-kernel-tests/+bug/2129815
Fixes:
|
||
Rongguang Wei
|
0ec4b78598 |
net: wangxun: don't advertise IFF_SUPP_NOFCS
Like commit a24162f18825("i40e: don't advertise IFF_SUPP_NOFCS"),
ngbe and txgbe also advertises IFF_SUPP_NOFCS and allowing users
to use the SO_NOFCS socket option. But the driver does not check
skb->no_fcs, so this option is silently ignored.
With this change, send() fails with -EPROTONOSUPPORT when AF_PACKET
socket is set SO_NOFCS option.
Signed-off-by: Rongguang Wei <weirongguang@kylinos.cn>
Link: https://patch.msgid.link/20260617092854.133992-1-clementwei90@163.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
||
Ido Schimmel
|
4045f1c3d6 |
selftests: vlan_bridge_binding: Fix flaky operational state check
check_operstate() busy waits for up to one second for the operational
state to change to the expected state. This is not enough since carrier
loss events can be delayed by the kernel for up to one second (see
__linkwatch_run_queue()), leading to sporadic failures.
Fix by increasing the busy wait period to two seconds.
Fixes:
|
||
Dawei Feng
|
1bd6676254 |
net: ena: clean up XDP TX queues when regular TX setup fails
create_queues_with_size_backoff() creates XDP TX queues before setting
up the regular TX path. If the subsequent allocation or creation of
regular TX queues fails, the error handling paths omit the teardown of the
XDP TX queues, leading to a resource leak.
Fix this by explicitly destroying the XDP TX queue subset at the two
missing failure points.
The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing
v6.13-rc1. The tool is still under development and is not yet publicly
available. Manual inspection confirms that the bug is still
present in v7.1-rc7.
An x86_64 allyesconfig build showed no new warnings. As we do not have
an ENA device to test with, no runtime testing was able to be performed.
Fixes:
|
||
Ankit Garg
|
d676c9a73b |
gve: fix header buffer corruption with header-split and HW-GRO
The DQO RX datapath programs a per-buffer-queue-descriptor
header_buf_addr at post time and reads the split header back at
completion time. Both the post and the read currently index the
header buffer by queue position rather than by the buffer's identity:
- post (gve_rx_post_buffers_dqo): header_buf_addr is computed from
bufq->tail
- read (gve_rx_dqo): the header is read from desc_idx (the completion
queue head index)
This relies on the buffer-queue index and the completion-queue index
being equal for the start of every packet, i.e. on the device consuming
posted buffers and returning completions in the exact same order. That
assumption does not hold once HW-GRO is enabled with multiple
flows: coalesced segments are accepted and completed in an order that
may differ from the order buffers were posted, and segments from
different flows may interleave.
That results in two problems:
1. Wrong header slot on read. Because the read offset is derived from
the completion index (desc_idx) while the device wrote the header to
the address programmed for the buffer's buf_id, the driver can copy
a header belonging to a different packet. This shows up as
throughput drop (about 30% drop and large numbers of TCP
retransmissions) with header-split and HW-GRO both enabled and many
streams.
2. Header buffer reused while still owned by the device. The driver
advances bufq->head by one per completion and re-posts buffers based
on that. Arrival of N RX completions only guarantees that at least N
RX buffer descriptors have been read by the device. It does not
guarantee that the device has relinquished the ownership of all the
buffers corresponding to those N descriptors. With out-of-order
completions (e.g. the completion for a packet copied into buffer N
arrives before the completion for a packet copied into buffer N-1),
the driver can re-post and overwrite a header buffer that the device
is still going to write into, corrupting the header of a packet
whose completion has not yet been processed.
Fix both issues by indexing the header buffer by buf_id on both the post
and read paths. Reading from buf_id's slot is therefore always correct
regardless of completion ordering (fixes problem 1).
Indexing by buf_id also ties each header slot to the lifetime of its
buffer state. A buffer state is only returned to the free/recycle lists
when its own completion (buf_id) is processed, so its header slot can
only be re-posted after the device is done with it. This makes header
slot reuse safe under out-of-order completions (fixes problem 2).
Allocate (gve_rx_alloc_hdr_bufs) and free (gve_rx_free_hdr_bufs) the
header buffers based on num_buf_states to match the buf_id indexing.
Cc: stable@vger.kernel.org
Fixes:
|
||
Maoyi Xie
|
55d9895f89 |
net: thunderbolt: Fix frags[] overflow by bounding frame_count
tbnet_poll() assembles a multi-frame ThunderboltIP packet into one skb. The first frame goes into the skb linear area and every further frame is added as a page fragment. skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page, hdr_size, frame_size, TBNET_RX_PAGE_SIZE - hdr_size); A packet of frame_count frames therefore ends up with frame_count - 1 fragments. tbnet_check_frame() only bounds the peer supplied frame_count to TBNET_RING_SIZE / 4 (64), which is far above MAX_SKB_FRAGS (17 by default). A peer that sends a packet of 19 or more small frames pushes nr_frags past MAX_SKB_FRAGS, so skb_add_rx_frag() writes past skb_shinfo()->frags[] and corrupts memory after the shared info. Tighten the start of packet bound to MAX_SKB_FRAGS + 1 so a packet can never produce more fragments than frags[] can hold. This matches the recent skb frags overflow fixes in other receive paths, for example |
||
Breno Leitao
|
c0ebe49232 |
netconsole: don't drop the last byte of a full-sized message
nt->buf is exactly MAX_PRINT_CHUNK bytes, but scnprintf() reserves one
byte for its NUL terminator, so a non-fragmented payload of exactly
MAX_PRINT_CHUNK loses its last byte (emitted as a stray NUL in the
release path). Grow nt->buf to MAX_PRINT_CHUNK + 1 and bound the
scnprintf() calls with sizeof(nt->buf); the transmitted length stays
capped at MAX_PRINT_CHUNK.
Alternatively, nt->buf could be left at MAX_PRINT_CHUNK and the NUL byte
reserved by routing exactly-MAX_PRINT_CHUNK payloads to fragmentation
('len < MAX_PRINT_CHUNK'), at the cost of fragmenting those messages.
But it would look less sane, thus the current approach.
Fixes:
|
||
Yun Zhou
|
bf6e8af2c8 |
flow_dissector: check device type before reading ETH_ADDRS
__skb_flow_dissect() unconditionally reads 12 bytes from eth_hdr(skb)
when FLOW_DISSECTOR_KEY_ETH_ADDRS is requested. This assumes the skb
has a valid Ethernet header at mac_header, which is not always the case.
The problem can be triggered by:
1. Creating a TUN device in L3 mode (IFF_TUN, hard_header_len=0)
2. Attaching a multiq qdisc with a flower filter matching on eth_src
3. Sending a packet through AF_PACKET
Since TUN in L3 mode has no link-layer header, mac_header points to
the L3 data area. The flow dissector reads 12 bytes of uninitialized
skb memory, which then propagates through fl_set_masked_key() and is
used as a rhashtable lookup key in __fl_lookup(), as reported by KMSAN.
Rejecting the filter in the control path (at tc filter add time) is
not feasible because TC filter blocks can be shared between arbitrary
devices -- a filter installed on an Ethernet device may later classify
packets on a headerless device through a shared block. The device
association is not fixed at filter creation time.
Fix this by gating the memcpy on dev->type == ARPHRD_ETHER, which
ensures only true Ethernet-framed packets have their addresses read.
This is more precise than the previous hard_header_len >= 12 check,
which would incorrectly pass for non-Ethernet link types like IPoIB
(ARPHRD_INFINIBAND, hard_header_len=24) and FDDI (hard_header_len=21)
whose L2 headers are not in Ethernet format. Additionally check
skb_mac_header_was_set() to guard against the pathological case where
mac_header is the unset sentinel (~0U), which would cause eth_hdr() to
return a wild pointer.
For the act_mirred redirect case (Ethernet packet redirected to a
non-Ethernet device sharing a TC block), zeroing the key is the correct
behavior: the packet is now being classified on the target device, where
Ethernet address matching is not semantically meaningful.
Note: on non-Ethernet devices, the zeroed key will match a filter
configured with all-zero MAC addresses. This is an improvement over the
previous behavior where uninitialized memory could randomly match any
filter.
Reported-by: syzbot+fa2f5b1fb06147be5e16@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=fa2f5b1fb06147be5e16
Fixes:
|
||
Lukasz Raczylo
|
e438ec3e9e |
net: macb: add TX stall timeout callback to recover from lost TSTART write
The MACB found in the Raspberry Pi RP1 suffers from sporadic stalls on
the TX queue.
While the exact root cause is not yet fully understood, it is likely
related to a hardware issue where a TSTART write to the NCR register
is missed, preventing the transmission from being kicked off.
Implement a timeout callback to handle TX queue stalls, triggering the
existing restart mechanism to recover.
Link: https://lore.kernel.org/all/20260514215459.36109-1-lukasz@raczylo.com/
Fixes:
|
||
Wayen Yan
|
5c121ee635 |
net: airoha: fix foe_check_time allocation size
foe_check_time is declared as u16 pointer but was allocated with
only ppe_num_entries bytes instead of ppe_num_entries * sizeof(u16).
When airoha_ppe_foe_verify_entry() is called with hash >= ppe_num_entries/2,
it writes beyond the allocated buffer, causing heap buffer overflow and
potential kernel crash.
Fixes:
|
||
Jakub Kicinski
|
440a974492 |
Merge branch 'devlink-fix-a-couple-parent-ref-leaks'
Cosmin Ratiu says: ==================== devlink: Fix a couple parent ref leaks These two patches fix parent ref leaks on errors. ==================== Link: https://patch.msgid.link/20260616110633.1449432-1-cratiu@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
Cosmin Ratiu
|
ba81a8b80f |
devlink: Fix parent ref leak on tc-bw failure
When a node is created via rate-new with tc-bw and a parent node,
devlink_nl_rate_set() executes the sequence of ops. It bails out on the
first failure and doesn't rollback anything. For most things that is
fine (setting some numbers), but the parent set can leak if there's
another failure after that.
That is precisely what happens when parent setting isn't the last block
in the function. After the referenced "Fixes" commit, when tc-bw fails
to be set the function bails out after having set the parent and
incremented its refcount.
There are two callers:
- devlink_nl_rate_set_doit() is fine, it just reports the error.
- but devlink_nl_rate_new_doit() frees the newly created node and leaks
the parent refcnt.
Fix that by reordering the blocks so parent setting is last and adding a
comment explaining this so future modification preserve the ordering
(hopefully).
Fixes:
|
||
|
Cosmin Ratiu
|
ba45106342 |
devlink: Fix parent ref leak in devl_rate_node_create()
In the original commit the function bails out on kstrdup failure,
forgetting to decrement the refcnt of the parent.
Fix that by moving the parent refcnt setting after kstrdup.
Fixes:
|
||
Junrui Luo
|
8cdcf3d2ca |
octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF
rvu_mbox_handler_lmtst_tbl_setup() uses req->base_pcifunc as a direct
index into the LMT map table to read another function's LMTLINE
physical base address and copy it into the caller's own LMT map table
entry. The mailbox dispatcher authenticates req->hdr.pcifunc from the
IRQ source, but req->base_pcifunc is a separate payload field and is
not sanitized.
Reject the request with -EPERM when a VF caller's base_pcifunc is not a
valid function under its own PF. is_pf_func_valid() bounds the FUNC field
to the PF's configured VF count, keeping the computed index inside the
caller's own slot block.
Fixes:
|
||
Ruoyu Wang
|
a0aa6bf985 |
net: pch_gbe: handle TX skb allocation failure
pch_gbe_alloc_tx_buffers() allocates an skb for each TX descriptor and
then passes the returned pointer to skb_reserve(). If netdev_alloc_skb()
fails, skb_reserve() dereferences NULL.
Make pch_gbe_alloc_tx_buffers() return an error when an skb allocation
fails. On failure, let pch_gbe_alloc_tx_buffers() clean the partially
allocated TX ring before returning the error. While bringing the device
up, release the RX buffer pool through a shared cleanup helper before
unwinding the IRQ setup.
Cc: stable+noautosel@kernel.org # untested fix to unlikely error path
Fixes:
|
||
Wentao Guan
|
d31deeab70 |
net: llc: make empty have static storage duration
Make @empty have static storage duration (like net/sysctl_net.c does) to avoid storing a bad pointer, and keep consistent with __register_sysctl_table @table 'should not be free'd after registration'. Note that this is _not_ a bug, since size is 0 the pointer will never get deferenced. Signed-off-by: Wentao Guan <guanwentao@uniontech.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260616064053.690154-1-guanwentao@uniontech.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
Ioana Ciornei
|
ed2294f94e |
dpaa2-switch: fix VLAN upper check not rejecting bridge join
The blamed commit refactored the prechangeupper event handling but
failed to actually return an error in case
dpaa2_switch_prevent_bridging_with_8021q_upper() detected a 802.1q upper
on a port which tries to join a bridge. Fix this by returning err
instead of 0.
Fixes:
|
||
Xiang Mei
|
9e5ad06ea8 |
virtio-net: fix len check in receive_big()
receive_big() bounds the device-announced length by
(big_packets_num_skbfrags + 1) * PAGE_SIZE. That is still too loose:
add_recvbuf_big() sets sg[1] to start at offset
sizeof(struct padded_vnet_hdr) into the first page, so the chain
actually carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) +
big_packets_num_skbfrags * PAGE_SIZE bytes -- 20 bytes less than the
check allows for the common hdr_len == 12 case.
A malicious virtio backend can announce a len in that gap. page_to_skb()
then walks one frag past the page chain, storing a NULL page->private
into skb_shinfo()->frags[MAX_SKB_FRAGS], which is both an out-of-bounds
write past the static frag array and a NULL frag handed up the rx path.
Bound len by the size add_recvbuf_big() actually advertised.
Fixes:
|
||
|
Jakub Kicinski
|
86590e2a22 |
Merge branch 'net-sched-act_ct-preserve-tc_skb_cb-across-defragmentation'
Zihan Xi says: ==================== net/sched: act_ct: preserve tc_skb_cb across defragmentation ==================== Link: https://patch.msgid.link/cover.1781358691.git.xizh2024@lzu.edu.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
Zihan Xi
|
1fd8f80a19 |
selftests/tc-testing: act_ct: add TDC test for skb cb preservation across defrag
Add a tc-testing case that sends IPv4 fragments through act_ct on clsact egress while a root prio qdisc is present on the transmit path. The test verifies that packet processing and qdisc accounting continue to work after conntrack defragmentation, covering tc_skb_cb preservation across defragmentation. Signed-off-by: Zihan Xi <xizh2024@lzu.edu.cn> Signed-off-by: Ren Wei <n05ec@lzu.edu.cn> Link: https://patch.msgid.link/53493549fdbcb2de25788b7894c56baadbc5fede.1781358692.git.xizh2024@lzu.edu.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Zihan Xi
|
9092e15def |
net/sched: act_ct: preserve tc_skb_cb across defragmentation
tcf_ct_handle_fragments() calls nf_ct_handle_fragments() without saving
and restoring skb->cb. The defrag helper clears IPCB/IP6CB, which aliases
the tc_skb_cb/qdisc_skb_cb control buffer. Fragmented traffic through
act_ct therefore loses qdisc metadata such as pkt_segs and can trigger
WARN_ON_ONCE() in qdisc_pkt_segs() when panic_on_warn is enabled.
Save and restore the full tc_skb_cb around nf_ct_handle_fragments(),
matching the pattern used by ovs_ct_handle_fragments().
Fixes:
|
||
|
Linus Torvalds
|
8c13415c8a |
[GIT PULL for v7.2] media updates
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE+QmuaPwR3wnBdVwACF8+vY7k4RUFAmo0VwMACgkQCF8+vY7k
4RXLxxAAhXl0y+3e9g4gx/FQAGGV6d3zohNomiw7u8DEPtgo3oE0n4FA2Xrd2bsK
0cWskUMqz06fMYjwi0kloLi0MNW1ufERBL2Ehr73hS+8Iza/NCPcr34B6V6wiAOV
i1vnB0qw7Juh1vr0lcplPKvcFzLBj0XWIphGkB0kRdhypfhEl36lRCf5OdmWPe63
h7Co05/zceDaBPBzATEh9pKqH8jPJvmvEDkDLCLBIiQgBAClqCcX7xZuV/MiAJWE
B8yuRoyakH/dpKfvUVaMCwtFLag3fmvkQwfSOVaF4NHmr7tW+nTRI4D7QLVDI6if
cTIEEWdQsckVh2PKVuhaRod6o02pZdk+PWoSejdq8iTqPukR9vAp4iCjVW2Hc5dG
fCirdVXla1zqbn/IZTo4T7oLHcYiFaqbrU8Xom4qZFqgeJp64H7AdifVWyqB92ru
7DMgeVAhFQJIIvLrmqhpC1wvJ6nVhnkYHeHeL8UX0NRi7korb1jY5Shj5IfekuCW
2xOtSEG+p7ni6BMFKc5qso/ZObnToymriWrjXykcowZrMjKoxYzXfsngMmsRZBN3
QPRAM23FZvaNfF/poxnHNlRazi86+HgsrU2Q2koYR4FqUJ1iLYD6OvXX2WiirI3K
j09P1BybvX7/NxyOldL60a7pICGJr7j9J6jx2DQZmVaqPMsTxew=
=Br7k
-----END PGP SIGNATURE-----
Merge tag 'media/v7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media
Pull media updates from Mauro Carvalho Chehab:
- v4l2:
- core: fix subdev sensor ownership
- subdev: Allow accessing routes with STREAMS client capability
- ctrls: Add validation for HEVC active reference counts and
background detection control
- common: Add YUV24 format info and has_alpha helper
- vb2: Change vb2_read() and vb2_write() return types to ssize_t
- i2c: cvs: Add driver of Intel Computer Vision Sensing Controller(CVS)
- atmel-isc: remove deprecated driver
- cec: Add CEC Latency Indication Protocol (LIP) support
- imon: Add iMON VFD HID OEM v1.2 key mappings
- AVMatrix: new HWS capture driver
- isp4: new AMD capture driver
- qcom:
- iris: Add hierarchical coding, B-frame, and Long-Term Reference
support for encoder
- camss: Add SM6350 platform support
- venus: Add SM6115 platform support
- chips-media: wave5: Add support for Packed YUV422, CBP profile, and
background detection
- csi2rx: Add multistream support and 32 dma chans
- Several cleanups and fixes
* tag 'media/v7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (394 commits)
media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor()
media: qcom: iris: vdec: allow GEN2 decoding into 10bit format
media: qcom: iris: vdec: update find_format to handle 8bit and 10bit formats
media: qcom: iris: vdec: update size and stride calculations for 10bit formats
media: qcom: iris: gen2: add support for 10bit decoding
media: qcom: iris: add QC10C & P010 buffer size calculations
media: qcom: iris: add helpers for 8bit and 10bit formats
media: qcom: iris: Fix FPS calculation and VPP FW overhead
media: qcom: camss: vfe-340: Support for PIX client
media: qcom: camss: vfe-340: Proper client handling
media: qcom: camss: csid-340: Enable PIX interface routing
media: qcom: camss: csid-340: Add port-to-interface mapping
media: qcom: camss: csid-340: Switch to generic CSID_CFG/CTRL registers
media: iris: Initialize HFI ops after firmware load in core init
media: iris: drop struct iris_fmt
media: iris: Add platform data for X1P42100
media: iris: Add hardware power on/off ops for X1P42100
media: iris: optimize COMV buffer allocation for VPU3x and VPU4x
media: iris: add FPS calculation and VPP FW overhead in frequency formula
media: qcom: iris: Simplify COMV size calculation
...
|
||
Kees Cook
|
079a028d63 |
string: Remove strncpy() from the kernel
strncpy() has been a persistent source of bugs due to its ambiguous intended usage and frequently counter-intuitive semantics: it may not NUL-terminate the destination, and it unconditionally zero-pads to the full length, which isn't always needed. All former callers have been migrated[1] to: - strscpy() for NUL-terminated destinations - strscpy_pad() for NUL-terminated destinations needing zero-padding - strtomem_pad() for non-NUL-terminated fixed-width fields - memcpy_and_pad() for bounded copies with explicit padding - memcpy() for known-length copies Remove the generic implementation, its declaration, the FORTIFY_SOURCE wrapper, and associated tests. Link: https://github.com/KSPP/linux/issues/90 [1] Signed-off-by: Kees Cook <kees@kernel.org> |
||
|
Linus Torvalds
|
5cd1731cc8 |
CXL changes for v7.2
Introduce devm_cxl_probe_mem(), in prep for type2 basic enabling: cxl: Add dummy function for cxl_memdev_attach_region for !CONFIG_CXL_REGION cxl/region: Introduce devm_cxl_probe_mem() cxl/memdev: Introduce cxl_class_memdev_type cxl/memdev: Pin parents for entire memdev lifetime cxl/region: Resolve region deletion races cxl/region: Block region delete during region creation CXL Misc: cxl/region: Fill first free targets[] slot during auto-discovery cxl/region: Fix out-of-bounds access in cxl_cancel_auto_attach() tools/testing/cxl: Resolve auto-region decoder targets like real HW cxl: Align interleave decode/encode helpers with their callers cxl/test: Add check after kzalloc() memory in alloc_mock_res() cxl/test: Unregister cxl_acpi in cxl_test_init() error path cxl/test: Zero out LSA backing memory to avoid leaking to user cxl/test: Fix integer overflow in mock LSA bounds checks cxl/test: Verify cmd->size_in before accessing payload cxl/port: update reference to removed CONFIG_PROVE_CXL_LOCKING cxl/region: Avoid variable shadowing in region attach paths cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size cxl/test: Fix __fortify_panic cxl/fwctl: Fix __fortify_panic MAINTAINERS: Add CXL reviewer cxl/test: Enforce PMD alignment for volatile mock regions cxl/region: Validate partition index before array access cxl/memdev: Hold memdev lock during memdev poison injection/clear CXL PCI fixes: cxl/pci: Convert PCIBIOS errors to errno on DVSEC config accesses cxl/pci: Fix the incorrect check of pci_read_config_word() return -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE5DAy15EJMCV1R6v9YGjFFmlTOEoFAmo0MqsACgkQYGjFFmlT OEp5qQ/+N//u4DqTq54P7ZV1jpVzMEchV411frsWF5wl/pvEz9cr/ruPNxpg6Gdz AtryU1hcXRrDu9hvmO3odDM7jdZsIcF8GbpAWy5blAZaRt37aU6A4+fsFb8apFst SoFQ9BV23clPAEM7TYKXgya+G4kFu+btf3uxIutc8R78e88aEHGDz/Si//cocLmo sZY5Qky5eGca7wtX5rEImJtwsKDcTrtTQKQYGcuV6swLtLuJsHgL86TEfrWAH36M Vugb83a9AhQnGaTtKhvViHZkbMTOjCfOZom9BS++YDl/hVSPU1kF184ZPAI9oi4y 0kKDyoKbTN+oEIhrmhC4SGi0UgIW2O4Y6zR7lgr2iYm08Ki9ehbOI5EX6+PTVMSH lzLVunyLY/AAU9wrQ4YENYuZgfdUXpOgUzseCVIhN4kVo0oWhnUPHVRj2m2fZ7oH JzQV1MP2YJEbfqtAFVndBBZhBjrMZMcJCHhdISvz0Axv9ezj02LYJPVgmnGDthX7 kKvPgK7u/3sShAk2qmh1csFlT3H+UH1lpPcGM6btOjpI9TNIsYnyH/VaoHt4CIVL LZpMwQEMbz7S+An1+Ckwehe7LZAXO4IMUVFSdx6pAIRILNBv+68QkFtg2Ok5v/4s 7p5WPOvS97tTf6z5G/dQkDkGQVg1rdCfrQNN/MrZK4bEvMoQ5DM= =CimP -----END PGP SIGNATURE----- Merge tag 'cxl-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull CXL updates from Dave Jiang: "A collection of CXL fixes and changes, including an update to MAINTAINERS to add Ming Li as a CXL subsystem reviewer. There's also a series to introduce devm_cxl_probe_mem() core API in order to pave the way for CXL type2 device drivers to setup and retrieve CXL region resource during probe" * tag 'cxl-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: (26 commits) cxl: Add dummy function for cxl_memdev_attach_region for !CONFIG_CXL_REGION cxl/region: Introduce devm_cxl_probe_mem() cxl/memdev: Introduce cxl_class_memdev_type cxl/memdev: Pin parents for entire memdev lifetime cxl/region: Resolve region deletion races cxl/region: Block region delete during region creation cxl/region: Fill first free targets[] slot during auto-discovery cxl/region: Fix out-of-bounds access in cxl_cancel_auto_attach() tools/testing/cxl: Resolve auto-region decoder targets like real HW cxl: Align interleave decode/encode helpers with their callers cxl/test: Add check after kzalloc() memory in alloc_mock_res() cxl/test: Unregister cxl_acpi in cxl_test_init() error path cxl/test: Zero out LSA backing memory to avoid leaking to user cxl/test: Fix integer overflow in mock LSA bounds checks cxl/test: Verify cmd->size_in before accessing payload cxl/port: update reference to removed CONFIG_PROVE_CXL_LOCKING cxl/region: Avoid variable shadowing in region attach paths cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size cxl/pci: Convert PCIBIOS errors to errno on DVSEC config accesses cxl/pci: Fix the incorrect check of pci_read_config_word() return ... |
||
|
Kees Cook
|
58c4ce8cd6 |
xtensa: Remove arch-specific strncpy() implementation
strncpy() has no remaining callers in the kernel[1]. Remove the xtensa-specific inline assembly implementation and __HAVE_ARCH_STRNCPY define, falling back to the generic version in lib/string.c. Link: https://github.com/KSPP/linux/issues/90 [1] Signed-off-by: Kees Cook <kees@kernel.org> |
||
|
Kees Cook
|
dfe05fcca8 |
x86: Remove arch-specific strncpy() implementation
strncpy() has no remaining callers in the kernel[1]. Remove the x86-32-specific inline assembly implementation and __HAVE_ARCH_STRNCPY define, falling back to the generic version in lib/string.c. Link: https://github.com/KSPP/linux/issues/90 [1] Signed-off-by: Kees Cook <kees@kernel.org> |
||
|
Kees Cook
|
7eda356658 |
powerpc: Remove arch-specific strncpy() implementation
strncpy() has no remaining callers in the kernel[1]. Remove the powerpc-specific assembly implementation from both the kernel (arch/powerpc/lib/string.S) and the boot wrapper (arch/powerpc/boot/string.S), along with the __HAVE_ARCH_STRNCPY define and declaration, falling back to the generic version in lib/string.c. The boot wrapper's strncpy had no callers in arch/powerpc/boot/. Link: https://github.com/KSPP/linux/issues/90 [1] Signed-off-by: Kees Cook <kees@kernel.org> |
||
|
Kees Cook
|
ad3242a9ac |
m68k: Remove arch-specific strncpy() implementation
strncpy() has no remaining callers in the kernel[1]. Remove the m68k-specific inline assembly implementation and __HAVE_ARCH_STRNCPY define, falling back to the generic version in lib/string.c. Link: https://github.com/KSPP/linux/issues/90 [1] Signed-off-by: Kees Cook <kees@kernel.org> |
||
|
Kees Cook
|
4cb5e246e6 |
alpha: Remove arch-specific strncpy() implementation
strncpy() has no remaining callers in the kernel[1]. Remove the alpha-specific assembly implementation and __HAVE_ARCH_STRNCPY define, falling back to the generic version in lib/string.c. The __stxncpy helper (stxncpy.S/ev6-stxncpy.S) is retained as it is still used by strncat. Link: https://github.com/KSPP/linux/issues/90 [1] Signed-off-by: Kees Cook <kees@kernel.org> |
||
|
Linus Torvalds
|
cfd96ad138 |
Updates for the 7.2 release
A race condition and a couple of static analysis issues are fixed in BTT Use sysfs_emit() in preparation for removal of cpumap_print_to_pagebuf() Escalate a dev_dbg to dev_err in a resource conflict message MAINTAINER file updates -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQR/ATNjDEocsE1wudD5tRoRP7nxxwUCajQaOQAKCRD5tRoRP7nx x3F9AP4iY4Z0ZJRbQuOtAjAd5t0tiwTubUT6IKHtAHxoWBOcXQD/TJV8HxIlnGTw K0mH1WSPgDpJFNT17+pNoRU1x/Gr4wg= =Bahm -----END PGP SIGNATURE----- Merge tag 'libnvdimm-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull nvdimm/dax updates from Alison Schofield: - Fix a race condition and a couple of static analysis issues in BTT - Use sysfs_emit() in preparation for removal of cpumap_print_to_pagebuf() - Escalate a dev_dbg to dev_err in a resource conflict message - MAINTAINER file updates * tag 'libnvdimm-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: MAINTAINERS: nvdimm: Include maintainer profile MAINTAINERS: Update address for Ira Weiny MAINTAINERS: Add maintainer info for libnvdimm and DAX nvdimm: Use sysfs_emit() for cpumask show callback dax/bus: Upgrade resource conflict message to dev_err() in alloc_dax_region() nvdimm/btt: Free arenas on btt_init() error paths nvdimm/btt: Free arena sub-allocations on discover_arenas() error path nvdimm/btt: Handle preemption in BTT lane acquisition |
||
|
Linus Torvalds
|
7849ce3871 |
pmdomain core:
- Add OF helpers for parsing the power-domains-child-ids property - Extend the power domain DT binding with power-domains-child-ids - Switch to use the dynamic root device pmdomain providers: - arm: Add support for domain hierarchies to SCMI power domains - qcom: Add power domains for the Shikra and Nord SoCs - sunxi: Fix GPU support on Radxa Cubie A7Z by keeping power domain on -----BEGIN PGP SIGNATURE----- iQJEBAABCgAuFiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmoyYiQQHHVsZmhAa2Vy bmVsLm9yZwAKCRD+JoQlc1iMKXSFEACMGPergitZamXsgMoIQGrT+jG/sZnLIaWV GBrCRhe837amMKQyq1oVu4cTjieQNLx67bJIsuMXZVuAdihyRnLLe/sKwsyOPaXu bSa8BR0GhvEXiD784EXFwEK56Zc7b8+qnw6vs67q2IGI/95rylI4gbWBgfa1JTmU /H9ayoeIoS/bgis6JPsEYXARWwZIJRJof8dxdEk/anTP6FJZIc9jYv2TPrelsyZk lu92ikdu2V4zsOu7pXd64SPSoNaFNg5T0qduOMm4vHB3ePaBr9z2wBF9moN154zB NgiIJGJiKZ+BnJnPnH0fX7YIBdr93I3pgaJebJVj9s8202oLd9gHDZ5qVjZED/uP OyhNXca5DjA1sCAL4CmxN6aVBQpT0ksnJ76BVqe+nIwNSbWvd/vlJxAswgZ1IhxR Hw9wrkYo8Ylq2UxUQ8Zs0EcDA7ANWL97DZJWIdi7ouWvlKH1OyKn75ntcTBYL1ns hCzApNg8nYgQliO2kp2siVxK0Ljunr4RRo6wdWwvRyIsRW1iZfHeqv5hzq/g7DaK QklZGZ3LT7/GVUKUWDE4XihIu+PF1+5JJk6hKYUp0T3/rjWeVuf8q1QZnVv6qnSS jDSmXzlNEcrKgYgWtgv5Je6NL3m2gQlVTgv6Lbw35/ag2L9NjhsCgocj5J5E4K0+ EYTpY3GfxA== =2hQV -----END PGP SIGNATURE----- Merge tag 'pmdomain-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain updates from Ulf Hansson: "pmdomain core: - Add OF helpers for parsing the power-domains-child-ids property - Extend the power domain DT binding with power-domains-child-ids - Switch to use the dynamic root device pmdomain providers: - arm: Add support for domain hierarchies to SCMI power domains - qcom: Add power domains for the Shikra and Nord SoCs - sunxi: Fix GPU support on Radxa Cubie A7Z by keeping power domain on" * tag 'pmdomain-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: pmdomain: core: fix unused variable warning with !PM_GENERIC_DOMAINS_OF pmdomain: core: fix early domain registration pmdomain: mediatek: mfg: move __packed after struct name to fix kernel-doc pmdomain: qcom: rpmpd: Add Shikra RPM Power Domains pmdomain: qcom: rpmhpd: Add power domains for Nord SoC dt-bindings: power: qcom,rpmpd: document the Shikra RPM Power Domains pmdomain: sunxi: support power domain flags for pck600 pmdomain: core: switch to dynamic root device pmdomain: qcom: Unify user-visible "Qualcomm" name dt-bindings: power: qcom,rpmhpd: Add RPMh power domain for Nord SoC dt-bindings: power: qcom,rpmhpd: Fix whitespace in RPMHPD defines pmdomain: arm_scmi: add support for domain hierarchies pmdomain: core: add support for power-domains-child-ids dt-bindings: power: Add power-domains-child-ids property |
||
Henrique Carvalho
|
9647492b5e |
smb: client: fix query directory replay double-free
A response-bearing attempt can return a replayable error and free its
response buffer. If SMB2_query_directory_init() fails before the next send,
cleanup retains the previous buffer type and frees that response again.
Reset response bookkeeping before each attempt to prevent the stale free.
Fixes:
|