--- /dev/null
+From e8e4626ccbecb917354e044da44b599c61d9ec88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Jun 2024 02:41:11 +0200
+Subject: netfilter: nf_tables: validate family when identifying table via
+ handle
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit f6e1532a2697b81da00bfb184e99d15e01e9d98c ]
+
+Validate table family when looking up for it via NFTA_TABLE_HANDLE.
+
+Fixes: 3ecbfd65f50e ("netfilter: nf_tables: allocate handle and delete objects via handle")
+Reported-by: Xingyuan Mo <hdthky0@gmail.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 198e4a89df481..2c31470dd61f5 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -536,7 +536,7 @@ static struct nft_table *nft_table_lookup(const struct net *net,
+
+ static struct nft_table *nft_table_lookup_byhandle(const struct net *net,
+ const struct nlattr *nla,
+- u8 genmask)
++ int family, u8 genmask)
+ {
+ struct nftables_pernet *nft_net;
+ struct nft_table *table;
+@@ -544,6 +544,7 @@ static struct nft_table *nft_table_lookup_byhandle(const struct net *net,
+ nft_net = net_generic(net, nf_tables_net_id);
+ list_for_each_entry(table, &nft_net->tables, list) {
+ if (be64_to_cpu(nla_get_be64(nla)) == table->handle &&
++ table->family == family &&
+ nft_active_genmask(table, genmask))
+ return table;
+ }
+@@ -1189,7 +1190,7 @@ static int nf_tables_deltable(struct net *net, struct sock *nlsk,
+
+ if (nla[NFTA_TABLE_HANDLE]) {
+ attr = nla[NFTA_TABLE_HANDLE];
+- table = nft_table_lookup_byhandle(net, attr, genmask);
++ table = nft_table_lookup_byhandle(net, attr, family, genmask);
+ } else {
+ attr = nla[NFTA_TABLE_NAME];
+ table = nft_table_lookup(net, attr, family, genmask);
+--
+2.43.0
+
--- /dev/null
+From 207c9a4023b4a7ea9fbf779e16d0bb9a74144828 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Jun 2024 15:54:39 -0400
+Subject: Revert "mm: memblock: replace dereferences of memblock_region.nid
+ with API calls"
+
+This reverts commit e39b20462e8d11dd9c71da53e6d00884c60ab56d.
+
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/mm/numa.c | 9 +++------
+ arch/x86/mm/numa.c | 6 ++----
+ mm/memblock.c | 8 +++-----
+ mm/page_alloc.c | 4 ++--
+ 4 files changed, 10 insertions(+), 17 deletions(-)
+
+diff --git a/arch/arm64/mm/numa.c b/arch/arm64/mm/numa.c
+index f2f4c056822a7..15eaf1e09d0ca 100644
+--- a/arch/arm64/mm/numa.c
++++ b/arch/arm64/mm/numa.c
+@@ -365,16 +365,13 @@ static int __init numa_register_nodes(void)
+ struct memblock_region *mblk;
+
+ /* Check that valid nid is set to memblks */
+- for_each_memblock(memory, mblk) {
+- int mblk_nid = memblock_get_region_node(mblk);
+-
+- if (mblk_nid == NUMA_NO_NODE || mblk_nid >= MAX_NUMNODES) {
++ for_each_memblock(memory, mblk)
++ if (mblk->nid == NUMA_NO_NODE || mblk->nid >= MAX_NUMNODES) {
+ pr_warn("Warning: invalid memblk node %d [mem %#010Lx-%#010Lx]\n",
+- mblk_nid, mblk->base,
++ mblk->nid, mblk->base,
+ mblk->base + mblk->size - 1);
+ return -EINVAL;
+ }
+- }
+
+ /* Finally register nodes. */
+ for_each_node_mask(nid, numa_nodes_parsed) {
+diff --git a/arch/x86/mm/numa.c b/arch/x86/mm/numa.c
+index 411ded8664a9e..a830d49341ecc 100644
+--- a/arch/x86/mm/numa.c
++++ b/arch/x86/mm/numa.c
+@@ -506,10 +506,8 @@ static void __init numa_clear_kernel_node_hotplug(void)
+ * reserve specific pages for Sandy Bridge graphics. ]
+ */
+ for_each_memblock(reserved, mb_region) {
+- int nid = memblock_get_region_node(mb_region);
+-
+- if (nid != MAX_NUMNODES)
+- node_set(nid, reserved_nodemask);
++ if (mb_region->nid != MAX_NUMNODES)
++ node_set(mb_region->nid, reserved_nodemask);
+ }
+
+ /*
+diff --git a/mm/memblock.c b/mm/memblock.c
+index 0510d6c7ad14c..4d471da3cc479 100644
+--- a/mm/memblock.c
++++ b/mm/memblock.c
+@@ -1147,15 +1147,13 @@ void __init_memblock __next_mem_pfn_range(int *idx, int nid,
+ {
+ struct memblock_type *type = &memblock.memory;
+ struct memblock_region *r;
+- int r_nid;
+
+ while (++*idx < type->cnt) {
+ r = &type->regions[*idx];
+- r_nid = memblock_get_region_node(r);
+
+ if (PFN_UP(r->base) >= PFN_DOWN(r->base + r->size))
+ continue;
+- if (nid == MAX_NUMNODES || nid == r_nid)
++ if (nid == MAX_NUMNODES || nid == r->nid)
+ break;
+ }
+ if (*idx >= type->cnt) {
+@@ -1168,7 +1166,7 @@ void __init_memblock __next_mem_pfn_range(int *idx, int nid,
+ if (out_end_pfn)
+ *out_end_pfn = PFN_DOWN(r->base + r->size);
+ if (out_nid)
+- *out_nid = r_nid;
++ *out_nid = r->nid;
+ }
+
+ /**
+@@ -1716,7 +1714,7 @@ int __init_memblock memblock_search_pfn_nid(unsigned long pfn,
+ *start_pfn = PFN_DOWN(type->regions[mid].base);
+ *end_pfn = PFN_DOWN(type->regions[mid].base + type->regions[mid].size);
+
+- return memblock_get_region_node(&type->regions[mid]);
++ return type->regions[mid].nid;
+ }
+ #endif
+
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index b8cccd1a9965e..147b67d31431d 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -6743,7 +6743,7 @@ static void __init find_zone_movable_pfns_for_nodes(void)
+ if (!memblock_is_hotpluggable(r))
+ continue;
+
+- nid = memblock_get_region_node(r);
++ nid = r->nid;
+
+ usable_startpfn = PFN_DOWN(r->base);
+ zone_movable_pfn[nid] = zone_movable_pfn[nid] ?
+@@ -6764,7 +6764,7 @@ static void __init find_zone_movable_pfns_for_nodes(void)
+ if (memblock_is_mirror(r))
+ continue;
+
+- nid = memblock_get_region_node(r);
++ nid = r->nid;
+
+ usable_startpfn = memblock_region_memory_base_pfn(r);
+
+--
+2.43.0
+
--- /dev/null
+From a178bdeaec1c5fefe6d836c4703af4f6f65d3c5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Jun 2024 15:54:36 -0400
+Subject: Revert "x86/mm/numa: Use NUMA_NO_NODE when calling
+ memblock_set_node()"
+
+This reverts commit 90de177533ee25451297ad406478114588a6079b.
+
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/mm/numa.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/mm/numa.c b/arch/x86/mm/numa.c
+index b018eac5e4191..411ded8664a9e 100644
+--- a/arch/x86/mm/numa.c
++++ b/arch/x86/mm/numa.c
+@@ -508,7 +508,7 @@ static void __init numa_clear_kernel_node_hotplug(void)
+ for_each_memblock(reserved, mb_region) {
+ int nid = memblock_get_region_node(mb_region);
+
+- if (nid != NUMA_NO_NODE)
++ if (nid != MAX_NUMNODES)
+ node_set(nid, reserved_nodemask);
+ }
+
+@@ -628,9 +628,9 @@ static int __init numa_init(int (*init_func)(void))
+ nodes_clear(node_online_map);
+ memset(&numa_meminfo, 0, sizeof(numa_meminfo));
+ WARN_ON(memblock_set_node(0, ULLONG_MAX, &memblock.memory,
+- NUMA_NO_NODE));
++ MAX_NUMNODES));
+ WARN_ON(memblock_set_node(0, ULLONG_MAX, &memblock.reserved,
+- NUMA_NO_NODE));
++ MAX_NUMNODES));
+ /* In case that parsing SRAT failed. */
+ WARN_ON(memblock_clear_hotplug(0, ULLONG_MAX));
+ numa_reset_distance();
+--
+2.43.0
+
pinctrl-rockchip-fix-pinmux-bits-for-rk3328-gpio3-b-.patch
pinctrl-rockchip-fix-pinmux-reset-in-rockchip_pmx_se.patch
drm-amdgpu-fix-ubsan-warning-in-kv_dpm.c.patch
+revert-x86-mm-numa-use-numa_no_node-when-calling-mem.patch
+revert-mm-memblock-replace-dereferences-of-memblock_.patch
+netfilter-nf_tables-validate-family-when-identifying.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
