6.6-stable patches

added patches:
	revert-selftests-bpf-adjust-dummy_st_ops_success-to-detect-additional-error.patch
	revert-selftests-bpf-dummy_st_ops-should-reject-0-for-non-nullable-params.patch

diff --git a/queue-6.6/revert-selftests-bpf-adjust-dummy_st_ops_success-to-detect-additional-error.patch b/queue-6.6/revert-selftests-bpf-adjust-dummy_st_ops_success-to-detect-additional-error.patch
new file mode 100644 (file)
index 0000000..484751c
--- /dev/null
+++ b/queue-6.6/revert-selftests-bpf-adjust-dummy_st_ops_success-to-detect-additional-error.patch
@@ -0,0 +1,105 @@
+From shung-hsi.yu@suse.com  Tue Jul 22 11:40:01 2025
+From: Shung-Hsi Yu <shung-hsi.yu@suse.com>
+Date: Thu, 17 Jul 2025 16:09:24 +0800
+Subject: Revert "selftests/bpf: adjust dummy_st_ops_success to detect additional error"
+To: stable@vger.kernel.org
+Cc: Eduard Zingerman <eddyz87@gmail.com>, Kui-Feng Lee <thinker.li@gmail.com>, Shung-Hsi Yu <shung-hsi.yu@suse.com>
+Message-ID: <20250717080928.221475-2-shung-hsi.yu@suse.com>
+
+From: Shung-Hsi Yu <shung-hsi.yu@suse.com>
+
+This reverts commit 264451a364dba5ca6cb2878126a9798dfc0b1a06 which is
+commit 3b3b84aacb4420226576c9732e7b539ca7b79633 upstream.
+
+The updated dummy_st_ops test requires commit 1479eaff1f16 ("bpf: mark
+bpf_dummy_struct_ops.test_1 parameter as nullable"), which in turn depends on
+"Support PTR_MAYBE_NULL for struct_ops arguments" series (see link below),
+neither are backported to stable 6.6.
+
+Without them the kernel simply panics from null pointer dereference half way
+through running BPF selftests.
+
+    #68/1    deny_namespace/unpriv_userns_create_no_bpf:OK
+    #68/2    deny_namespace/userns_create_bpf:OK
+    #68      deny_namespace:OK
+    [   26.829153] BUG: kernel NULL pointer dereference, address: 0000000000000000
+    [   26.831136] #PF: supervisor read access in kernel mode
+    [   26.832635] #PF: error_code(0x0000) - not-present page
+    [   26.833999] PGD 0 P4D 0
+    [   26.834771] Oops: 0000 [#1] PREEMPT SMP PTI
+    [   26.835997] CPU: 2 PID: 119 Comm: test_progs Tainted: G           OE      6.6.66-00003-gd80551078e71 #3
+    [   26.838774] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014
+    [   26.841152] RIP: 0010:bpf_prog_8ee9cbe7c9b5a50f_test_1+0x17/0x24
+    [   26.842877] Code: 00 00 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc f3 0f 1e fa 0f 1f 44 00 00 66 90 55 48 89 e5 f3 0f 1e fa 48 8b 7f 00 <8b> 47 00 be 5a 00 00 00 89 77 00 c9 c3 cc cc cc cc cc cc cc cc c0
+    [   26.847953] RSP: 0018:ffff9e6b803b7d88 EFLAGS: 00010202
+    [   26.849425] RAX: 0000000000000001 RBX: 0000000000000001 RCX: 2845e103d7dffb60
+    [   26.851483] RDX: 0000000000000000 RSI: 0000000084d09025 RDI: 0000000000000000
+    [   26.853508] RBP: ffff9e6b803b7d88 R08: 0000000000000001 R09: 0000000000000000
+    [   26.855670] R10: 0000000000000000 R11: 0000000000000000 R12: ffff9754c0b5f700
+    [   26.857824] R13: ffff9754c09cc800 R14: ffff9754c0b5f680 R15: ffff9754c0b5f760
+    [   26.859741] FS:  00007f77dee12740(0000) GS:ffff9754fbc80000(0000) knlGS:0000000000000000
+    [   26.862087] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+    [   26.863705] CR2: 0000000000000000 CR3: 00000001020e6003 CR4: 0000000000170ee0
+    [   26.865689] Call Trace:
+    [   26.866407]  <TASK>
+    [   26.866982]  ? __die+0x24/0x70
+    [   26.867774]  ? page_fault_oops+0x15b/0x450
+    [   26.868882]  ? search_bpf_extables+0xb0/0x160
+    [   26.870076]  ? fixup_exception+0x26/0x330
+    [   26.871214]  ? exc_page_fault+0x64/0x190
+    [   26.872293]  ? asm_exc_page_fault+0x26/0x30
+    [   26.873352]  ? bpf_prog_8ee9cbe7c9b5a50f_test_1+0x17/0x24
+    [   26.874705]  ? __bpf_prog_enter+0x3f/0xc0
+    [   26.875718]  ? bpf_struct_ops_test_run+0x1b8/0x2c0
+    [   26.876942]  ? __sys_bpf+0xc4e/0x2c30
+    [   26.877898]  ? __x64_sys_bpf+0x20/0x30
+    [   26.878812]  ? do_syscall_64+0x37/0x90
+    [   26.879704]  ? entry_SYSCALL_64_after_hwframe+0x78/0xe2
+    [   26.880918]  </TASK>
+    [   26.881409] Modules linked in: bpf_testmod(OE) [last unloaded: bpf_testmod(OE)]
+    [   26.883095] CR2: 0000000000000000
+    [   26.883934] ---[ end trace 0000000000000000 ]---
+    [   26.885099] RIP: 0010:bpf_prog_8ee9cbe7c9b5a50f_test_1+0x17/0x24
+    [   26.886452] Code: 00 00 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc f3 0f 1e fa 0f 1f 44 00 00 66 90 55 48 89 e5 f3 0f 1e fa 48 8b 7f 00 <8b> 47 00 be 5a 00 00 00 89 77 00 c9 c3 cc cc cc cc cc cc cc cc c0
+    [   26.890379] RSP: 0018:ffff9e6b803b7d88 EFLAGS: 00010202
+    [   26.891450] RAX: 0000000000000001 RBX: 0000000000000001 RCX: 2845e103d7dffb60
+    [   26.892779] RDX: 0000000000000000 RSI: 0000000084d09025 RDI: 0000000000000000
+    [   26.894254] RBP: ffff9e6b803b7d88 R08: 0000000000000001 R09: 0000000000000000
+    [   26.895630] R10: 0000000000000000 R11: 0000000000000000 R12: ffff9754c0b5f700
+    [   26.897008] R13: ffff9754c09cc800 R14: ffff9754c0b5f680 R15: ffff9754c0b5f760
+    [   26.898337] FS:  00007f77dee12740(0000) GS:ffff9754fbc80000(0000) knlGS:0000000000000000
+    [   26.899972] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+    [   26.901076] CR2: 0000000000000000 CR3: 00000001020e6003 CR4: 0000000000170ee0
+    [   26.902336] Kernel panic - not syncing: Fatal exception
+    [   26.903639] Kernel Offset: 0x36000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
+    [   26.905693] ---[ end Kernel panic - not syncing: Fatal exception ]---
+
+Link: https://lore.kernel.org/all/20240209023750.1153905-1-thinker.li@gmail.com/
+Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/bpf/progs/dummy_st_ops_success.c |   13 ++-----------
+ 1 file changed, 2 insertions(+), 11 deletions(-)
+
+--- a/tools/testing/selftests/bpf/progs/dummy_st_ops_success.c
++++ b/tools/testing/selftests/bpf/progs/dummy_st_ops_success.c
+@@ -11,17 +11,8 @@ int BPF_PROG(test_1, struct bpf_dummy_op
+ {
+       int ret;
+ 
+-      /* Check that 'state' nullable status is detected correctly.
+-       * If 'state' argument would be assumed non-null by verifier
+-       * the code below would be deleted as dead (which it shouldn't).
+-       * Hide it from the compiler behind 'asm' block to avoid
+-       * unnecessary optimizations.
+-       */
+-      asm volatile (
+-              "if %[state] != 0 goto +2;"
+-              "r0 = 0xf2f3f4f5;"
+-              "exit;"
+-      ::[state]"p"(state));
++      if (!state)
++              return 0xf2f3f4f5;
+ 
+       ret = state->val;
+       state->val = 0x5a;

diff --git a/queue-6.6/revert-selftests-bpf-dummy_st_ops-should-reject-0-for-non-nullable-params.patch b/queue-6.6/revert-selftests-bpf-dummy_st_ops-should-reject-0-for-non-nullable-params.patch
new file mode 100644 (file)
index 0000000..e0baf4b
--- /dev/null
+++ b/queue-6.6/revert-selftests-bpf-dummy_st_ops-should-reject-0-for-non-nullable-params.patch
@@ -0,0 +1,68 @@
+From shung-hsi.yu@suse.com  Tue Jul 22 11:40:50 2025
+From: Shung-Hsi Yu <shung-hsi.yu@suse.com>
+Date: Thu, 17 Jul 2025 16:09:25 +0800
+Subject: Revert "selftests/bpf: dummy_st_ops should reject 0 for non-nullable params"
+To: stable@vger.kernel.org
+Cc: Eduard Zingerman <eddyz87@gmail.com>, Kui-Feng Lee <thinker.li@gmail.com>, Shung-Hsi Yu <shung-hsi.yu@suse.com>
+Message-ID: <20250717080928.221475-3-shung-hsi.yu@suse.com>
+
+From: Shung-Hsi Yu <shung-hsi.yu@suse.com>
+
+This reverts commit e7d193073a223663612301c659e53795b991ca89 which is
+commit 6a2d30d3c5bf9f088dcfd5f3746b04d84f2fab83 upstream.
+
+The dummy_st_ops/dummy_sleepable_reject_null test requires commit 980ca8ceeae6
+("bpf: check bpf_dummy_struct_ops program params for test runs"), which in turn
+depends on "Support PTR_MAYBE_NULL for struct_ops arguments" series (see link
+below), neither are backported to stable 6.6.
+
+Link: https://lore.kernel.org/all/20240209023750.1153905-1-thinker.li@gmail.com/
+Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/bpf/prog_tests/dummy_st_ops.c |   27 ------------------
+ 1 file changed, 27 deletions(-)
+
+--- a/tools/testing/selftests/bpf/prog_tests/dummy_st_ops.c
++++ b/tools/testing/selftests/bpf/prog_tests/dummy_st_ops.c
+@@ -147,31 +147,6 @@ static void test_dummy_sleepable(void)
+       dummy_st_ops_success__destroy(skel);
+ }
+ 
+-/* dummy_st_ops.test_sleepable() parameter is not marked as nullable,
+- * thus bpf_prog_test_run_opts() below should be rejected as it tries
+- * to pass NULL for this parameter.
+- */
+-static void test_dummy_sleepable_reject_null(void)
+-{
+-      __u64 args[1] = {0};
+-      LIBBPF_OPTS(bpf_test_run_opts, attr,
+-              .ctx_in = args,
+-              .ctx_size_in = sizeof(args),
+-      );
+-      struct dummy_st_ops_success *skel;
+-      int fd, err;
+-
+-      skel = dummy_st_ops_success__open_and_load();
+-      if (!ASSERT_OK_PTR(skel, "dummy_st_ops_load"))
+-              return;
+-
+-      fd = bpf_program__fd(skel->progs.test_sleepable);
+-      err = bpf_prog_test_run_opts(fd, &attr);
+-      ASSERT_EQ(err, -EINVAL, "test_run");
+-
+-      dummy_st_ops_success__destroy(skel);
+-}
+-
+ void test_dummy_st_ops(void)
+ {
+       if (test__start_subtest("dummy_st_ops_attach"))
+@@ -184,8 +159,6 @@ void test_dummy_st_ops(void)
+               test_dummy_multiple_args();
+       if (test__start_subtest("dummy_sleepable"))
+               test_dummy_sleepable();
+-      if (test__start_subtest("dummy_sleepable_reject_null"))
+-              test_dummy_sleepable_reject_null();
+ 
+       RUN_TESTS(dummy_st_ops_fail);
+ }

diff --git a/queue-6.6/series b/queue-6.6/series
index 43aaf5ce87a12bd7af9bb593c5748a247e8e69d8..24a0283f9fafff2a24366378acf724fcb2cf0a13 100644 (file)
--- a/queue-6.6/series
+++ b/queue-6.6/series
@@ -105,3 +105,5 @@ i2c-omap-handle-omap_i2c_init-errors-in-omap_i2c_probe.patch
 regulator-pwm-regulator-calculate-the-output-voltage-for-disabled-pwms.patch
 regulator-pwm-regulator-manage-boot-on-with-disabled-pwm-channels.patch
 asoc-fsl_sai-force-a-software-reset-when-starting-in-consumer-mode.patch
+revert-selftests-bpf-adjust-dummy_st_ops_success-to-detect-additional-error.patch
+revert-selftests-bpf-dummy_st_ops-should-reject-0-for-non-nullable-params.patch