6.6-stable patches

added patches:
	netlink-return-unsigned-value-for-nla_len.patch
	nfsd-drop-the-nfsd_put-helper.patch
	series

diff --git a/queue-6.6/netlink-return-unsigned-value-for-nla_len.patch b/queue-6.6/netlink-return-unsigned-value-for-nla_len.patch
new file mode 100644 (file)
index 0000000..fbb7eda
--- /dev/null
+++ b/queue-6.6/netlink-return-unsigned-value-for-nla_len.patch
@@ -0,0 +1,56 @@
+From 172db56d90d29e47e7d0d64885d5dbd92c87ec42 Mon Sep 17 00:00:00 2001
+From: Kees Cook <keescook@chromium.org>
+Date: Wed, 6 Dec 2023 12:59:07 -0800
+Subject: netlink: Return unsigned value for nla_len()
+
+From: Kees Cook <keescook@chromium.org>
+
+commit 172db56d90d29e47e7d0d64885d5dbd92c87ec42 upstream.
+
+The return value from nla_len() is never expected to be negative, and can
+never be more than struct nlattr::nla_len (a u16). Adjust the prototype
+on the function. This will let GCC's value range optimization passes
+know that the return can never be negative, and can never be larger than
+u16. As recently discussed[1], this silences the following warning in
+GCC 12+:
+
+net/wireless/nl80211.c: In function 'nl80211_set_cqm_rssi.isra':
+net/wireless/nl80211.c:12892:17: warning: 'memcpy' specified bound 18446744073709551615 exceeds maximum object size 9223372036854775807 [-Wstringop-overflow=]
+12892 |                 memcpy(cqm_config->rssi_thresholds, thresholds,
+      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+12893 |                        flex_array_size(cqm_config, rssi_thresholds,
+      |                        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+12894 |                                        n_thresholds));
+      |                                        ~~~~~~~~~~~~~~
+
+A future change would be to clamp the subtraction to make sure it never
+wraps around if nla_len is somehow less than NLA_HDRLEN, which would
+have the additional benefit of being defensive in the face of nlattr
+corruption or logic errors.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202311090752.hWcJWAHL-lkp@intel.com/ [1]
+Cc: Johannes Berg <johannes@sipsolutions.net>
+Cc: Jeff Johnson <quic_jjohnson@quicinc.com>
+Cc: Michael Walle <mwalle@kernel.org>
+Cc: Max Schulze <max.schulze@online.de>
+Link: https://lore.kernel.org/r/20231202202539.it.704-kees@kernel.org
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/r/20231206205904.make.018-kees@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/netlink.h |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/net/netlink.h
++++ b/include/net/netlink.h
+@@ -1189,7 +1189,7 @@ static inline void *nla_data(const struc
+  * nla_len - length of payload
+  * @nla: netlink attribute
+  */
+-static inline int nla_len(const struct nlattr *nla)
++static inline u16 nla_len(const struct nlattr *nla)
+ {
+       return nla->nla_len - NLA_HDRLEN;
+ }

diff --git a/queue-6.6/nfsd-drop-the-nfsd_put-helper.patch b/queue-6.6/nfsd-drop-the-nfsd_put-helper.patch
new file mode 100644 (file)
index 0000000..9830d72
--- /dev/null
+++ b/queue-6.6/nfsd-drop-the-nfsd_put-helper.patch
@@ -0,0 +1,125 @@
+From 64e6304169f1e1f078e7f0798033f80a7fb0ea46 Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@kernel.org>
+Date: Wed, 3 Jan 2024 08:36:52 -0500
+Subject: nfsd: drop the nfsd_put helper
+
+From: Jeff Layton <jlayton@kernel.org>
+
+commit 64e6304169f1e1f078e7f0798033f80a7fb0ea46 upstream.
+
+It's not safe to call nfsd_put once nfsd_last_thread has been called, as
+that function will zero out the nn->nfsd_serv pointer.
+
+Drop the nfsd_put helper altogether and open-code the svc_put in its
+callers instead. That allows us to not be reliant on the value of that
+pointer when handling an error.
+
+Fixes: 2a501f55cd64 ("nfsd: call nfsd_last_thread() before final nfsd_put()")
+Reported-by: Zhi Li <yieli@redhat.com>
+Cc: NeilBrown <neilb@suse.de>
+Signed-off-by: Jeffrey Layton <jlayton@redhat.com>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nfsd/nfsctl.c |   31 +++++++++++++++++--------------
+ fs/nfsd/nfsd.h   |    7 -------
+ 2 files changed, 17 insertions(+), 21 deletions(-)
+
+--- a/fs/nfsd/nfsctl.c
++++ b/fs/nfsd/nfsctl.c
+@@ -692,6 +692,7 @@ static ssize_t __write_ports_addfd(char
+       char *mesg = buf;
+       int fd, err;
+       struct nfsd_net *nn = net_generic(net, nfsd_net_id);
++      struct svc_serv *serv;
+ 
+       err = get_int(&mesg, &fd);
+       if (err != 0 || fd < 0)
+@@ -702,15 +703,15 @@ static ssize_t __write_ports_addfd(char
+       if (err != 0)
+               return err;
+ 
+-      err = svc_addsock(nn->nfsd_serv, net, fd, buf, SIMPLE_TRANSACTION_LIMIT, cred);
++      serv = nn->nfsd_serv;
++      err = svc_addsock(serv, net, fd, buf, SIMPLE_TRANSACTION_LIMIT, cred);
+ 
+-      if (err < 0 && !nn->nfsd_serv->sv_nrthreads && !nn->keep_active)
++      if (err < 0 && !serv->sv_nrthreads && !nn->keep_active)
+               nfsd_last_thread(net);
+-      else if (err >= 0 &&
+-               !nn->nfsd_serv->sv_nrthreads && !xchg(&nn->keep_active, 1))
+-              svc_get(nn->nfsd_serv);
++      else if (err >= 0 && !serv->sv_nrthreads && !xchg(&nn->keep_active, 1))
++              svc_get(serv);
+ 
+-      nfsd_put(net);
++      svc_put(serv);
+       return err;
+ }
+ 
+@@ -724,6 +725,7 @@ static ssize_t __write_ports_addxprt(cha
+       struct svc_xprt *xprt;
+       int port, err;
+       struct nfsd_net *nn = net_generic(net, nfsd_net_id);
++      struct svc_serv *serv;
+ 
+       if (sscanf(buf, "%15s %5u", transport, &port) != 2)
+               return -EINVAL;
+@@ -736,32 +738,33 @@ static ssize_t __write_ports_addxprt(cha
+       if (err != 0)
+               return err;
+ 
+-      err = svc_xprt_create(nn->nfsd_serv, transport, net,
++      serv = nn->nfsd_serv;
++      err = svc_xprt_create(serv, transport, net,
+                             PF_INET, port, SVC_SOCK_ANONYMOUS, cred);
+       if (err < 0)
+               goto out_err;
+ 
+-      err = svc_xprt_create(nn->nfsd_serv, transport, net,
++      err = svc_xprt_create(serv, transport, net,
+                             PF_INET6, port, SVC_SOCK_ANONYMOUS, cred);
+       if (err < 0 && err != -EAFNOSUPPORT)
+               goto out_close;
+ 
+-      if (!nn->nfsd_serv->sv_nrthreads && !xchg(&nn->keep_active, 1))
+-              svc_get(nn->nfsd_serv);
++      if (!serv->sv_nrthreads && !xchg(&nn->keep_active, 1))
++              svc_get(serv);
+ 
+-      nfsd_put(net);
++      svc_put(serv);
+       return 0;
+ out_close:
+-      xprt = svc_find_xprt(nn->nfsd_serv, transport, net, PF_INET, port);
++      xprt = svc_find_xprt(serv, transport, net, PF_INET, port);
+       if (xprt != NULL) {
+               svc_xprt_close(xprt);
+               svc_xprt_put(xprt);
+       }
+ out_err:
+-      if (!nn->nfsd_serv->sv_nrthreads && !nn->keep_active)
++      if (!serv->sv_nrthreads && !nn->keep_active)
+               nfsd_last_thread(net);
+ 
+-      nfsd_put(net);
++      svc_put(serv);
+       return err;
+ }
+ 
+--- a/fs/nfsd/nfsd.h
++++ b/fs/nfsd/nfsd.h
+@@ -96,13 +96,6 @@ int         nfsd_pool_stats_open(struct inode *
+ int           nfsd_pool_stats_release(struct inode *, struct file *);
+ void          nfsd_shutdown_threads(struct net *net);
+ 
+-static inline void nfsd_put(struct net *net)
+-{
+-      struct nfsd_net *nn = net_generic(net, nfsd_net_id);
+-
+-      svc_put(nn->nfsd_serv);
+-}
+-
+ bool          i_am_nfsd(void);
+ 
+ struct nfsdfs_client {

diff --git a/queue-6.6/series b/queue-6.6/series
new file mode 100644 (file)
index 0000000..2e19a8a
--- /dev/null
+++ b/queue-6.6/series
@@ -0,0 +1,2 @@
+nfsd-drop-the-nfsd_put-helper.patch
+netlink-return-unsigned-value-for-nla_len.patch