--- /dev/null
+From bc84a949b055184cb9c2ec3cac122964a9b39c07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Jun 2024 02:41:12 +0200
+Subject: netfilter: nf_tables: validate family when identifying table via
+ handle
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit f6e1532a2697b81da00bfb184e99d15e01e9d98c ]
+
+Validate table family when looking up for it via NFTA_TABLE_HANDLE.
+
+Fixes: 3ecbfd65f50e ("netfilter: nf_tables: allocate handle and delete objects via handle")
+Reported-by: Xingyuan Mo <hdthky0@gmail.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 8131d858f38d9..44d4d97b45d13 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -553,7 +553,7 @@ static struct nft_table *nft_table_lookup(const struct net *net,
+
+ static struct nft_table *nft_table_lookup_byhandle(const struct net *net,
+ const struct nlattr *nla,
+- u8 genmask)
++ int family, u8 genmask)
+ {
+ struct nftables_pernet *nft_net;
+ struct nft_table *table;
+@@ -561,6 +561,7 @@ static struct nft_table *nft_table_lookup_byhandle(const struct net *net,
+ nft_net = net_generic(net, nf_tables_net_id);
+ list_for_each_entry(table, &nft_net->tables, list) {
+ if (be64_to_cpu(nla_get_be64(nla)) == table->handle &&
++ table->family == family &&
+ nft_active_genmask(table, genmask))
+ return table;
+ }
+@@ -1243,7 +1244,7 @@ static int nf_tables_deltable(struct net *net, struct sock *nlsk,
+
+ if (nla[NFTA_TABLE_HANDLE]) {
+ attr = nla[NFTA_TABLE_HANDLE];
+- table = nft_table_lookup_byhandle(net, attr, genmask);
++ table = nft_table_lookup_byhandle(net, attr, family, genmask);
+ } else {
+ attr = nla[NFTA_TABLE_NAME];
+ table = nft_table_lookup(net, attr, family, genmask);
+--
+2.43.0
+
--- /dev/null
+From 9bfbdc69a529208b28202eb9eb05a85653bd0522 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Jun 2024 15:55:18 -0400
+Subject: Revert "mm: memblock: replace dereferences of memblock_region.nid
+ with API calls"
+
+This reverts commit 43996cf3480ac3c7d16d48003c2ae5a6e7704029.
+
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/mm/numa.c | 9 +++------
+ arch/x86/mm/numa.c | 6 ++----
+ mm/memblock.c | 8 +++-----
+ mm/page_alloc.c | 4 ++--
+ 4 files changed, 10 insertions(+), 17 deletions(-)
+
+diff --git a/arch/arm64/mm/numa.c b/arch/arm64/mm/numa.c
+index 58c83c2b8748f..53ebb4babf3a7 100644
+--- a/arch/arm64/mm/numa.c
++++ b/arch/arm64/mm/numa.c
+@@ -354,16 +354,13 @@ static int __init numa_register_nodes(void)
+ struct memblock_region *mblk;
+
+ /* Check that valid nid is set to memblks */
+- for_each_memblock(memory, mblk) {
+- int mblk_nid = memblock_get_region_node(mblk);
+-
+- if (mblk_nid == NUMA_NO_NODE || mblk_nid >= MAX_NUMNODES) {
++ for_each_memblock(memory, mblk)
++ if (mblk->nid == NUMA_NO_NODE || mblk->nid >= MAX_NUMNODES) {
+ pr_warn("Warning: invalid memblk node %d [mem %#010Lx-%#010Lx]\n",
+- mblk_nid, mblk->base,
++ mblk->nid, mblk->base,
+ mblk->base + mblk->size - 1);
+ return -EINVAL;
+ }
+- }
+
+ /* Finally register nodes. */
+ for_each_node_mask(nid, numa_nodes_parsed) {
+diff --git a/arch/x86/mm/numa.c b/arch/x86/mm/numa.c
+index bd52ce954d59a..7316dca7e846a 100644
+--- a/arch/x86/mm/numa.c
++++ b/arch/x86/mm/numa.c
+@@ -502,10 +502,8 @@ static void __init numa_clear_kernel_node_hotplug(void)
+ * reserve specific pages for Sandy Bridge graphics. ]
+ */
+ for_each_memblock(reserved, mb_region) {
+- int nid = memblock_get_region_node(mb_region);
+-
+- if (nid != MAX_NUMNODES)
+- node_set(nid, reserved_nodemask);
++ if (mb_region->nid != MAX_NUMNODES)
++ node_set(mb_region->nid, reserved_nodemask);
+ }
+
+ /*
+diff --git a/mm/memblock.c b/mm/memblock.c
+index d2d85d4d16b74..a75cc65f03307 100644
+--- a/mm/memblock.c
++++ b/mm/memblock.c
+@@ -1170,15 +1170,13 @@ void __init_memblock __next_mem_pfn_range(int *idx, int nid,
+ {
+ struct memblock_type *type = &memblock.memory;
+ struct memblock_region *r;
+- int r_nid;
+
+ while (++*idx < type->cnt) {
+ r = &type->regions[*idx];
+- r_nid = memblock_get_region_node(r);
+
+ if (PFN_UP(r->base) >= PFN_DOWN(r->base + r->size))
+ continue;
+- if (nid == MAX_NUMNODES || nid == r_nid)
++ if (nid == MAX_NUMNODES || nid == r->nid)
+ break;
+ }
+ if (*idx >= type->cnt) {
+@@ -1191,7 +1189,7 @@ void __init_memblock __next_mem_pfn_range(int *idx, int nid,
+ if (out_end_pfn)
+ *out_end_pfn = PFN_DOWN(r->base + r->size);
+ if (out_nid)
+- *out_nid = r_nid;
++ *out_nid = r->nid;
+ }
+
+ /**
+@@ -1732,7 +1730,7 @@ int __init_memblock memblock_search_pfn_nid(unsigned long pfn,
+ *start_pfn = PFN_DOWN(type->regions[mid].base);
+ *end_pfn = PFN_DOWN(type->regions[mid].base + type->regions[mid].size);
+
+- return memblock_get_region_node(&type->regions[mid]);
++ return type->regions[mid].nid;
+ }
+ #endif
+
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 4a649111178cc..0ad582945f54d 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -7214,7 +7214,7 @@ static void __init find_zone_movable_pfns_for_nodes(void)
+ if (!memblock_is_hotpluggable(r))
+ continue;
+
+- nid = memblock_get_region_node(r);
++ nid = r->nid;
+
+ usable_startpfn = PFN_DOWN(r->base);
+ zone_movable_pfn[nid] = zone_movable_pfn[nid] ?
+@@ -7235,7 +7235,7 @@ static void __init find_zone_movable_pfns_for_nodes(void)
+ if (memblock_is_mirror(r))
+ continue;
+
+- nid = memblock_get_region_node(r);
++ nid = r->nid;
+
+ usable_startpfn = memblock_region_memory_base_pfn(r);
+
+--
+2.43.0
+
--- /dev/null
+From fb5131b274d7ec27c7a43f07352b26e4b65d499c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Jun 2024 15:55:17 -0400
+Subject: Revert "x86/mm/numa: Use NUMA_NO_NODE when calling
+ memblock_set_node()"
+
+This reverts commit 7dc2965c852527327d2384b612909df7b7616dfa.
+
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/mm/numa.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/mm/numa.c b/arch/x86/mm/numa.c
+index badfa96aac320..bd52ce954d59a 100644
+--- a/arch/x86/mm/numa.c
++++ b/arch/x86/mm/numa.c
+@@ -504,7 +504,7 @@ static void __init numa_clear_kernel_node_hotplug(void)
+ for_each_memblock(reserved, mb_region) {
+ int nid = memblock_get_region_node(mb_region);
+
+- if (nid != NUMA_NO_NODE)
++ if (nid != MAX_NUMNODES)
+ node_set(nid, reserved_nodemask);
+ }
+
+@@ -624,9 +624,9 @@ static int __init numa_init(int (*init_func)(void))
+ nodes_clear(node_online_map);
+ memset(&numa_meminfo, 0, sizeof(numa_meminfo));
+ WARN_ON(memblock_set_node(0, ULLONG_MAX, &memblock.memory,
+- NUMA_NO_NODE));
++ MAX_NUMNODES));
+ WARN_ON(memblock_set_node(0, ULLONG_MAX, &memblock.reserved,
+- NUMA_NO_NODE));
++ MAX_NUMNODES));
+ /* In case that parsing SRAT failed. */
+ WARN_ON(memblock_clear_hotplug(0, ULLONG_MAX));
+ numa_reset_distance();
+--
+2.43.0
+
pinctrl-rockchip-fix-pinmux-bits-for-rk3328-gpio3-b-.patch
pinctrl-rockchip-fix-pinmux-reset-in-rockchip_pmx_se.patch
drm-amdgpu-fix-ubsan-warning-in-kv_dpm.c.patch
+revert-x86-mm-numa-use-numa_no_node-when-calling-mem.patch
+revert-mm-memblock-replace-dereferences-of-memblock_.patch
+netfilter-nf_tables-validate-family-when-identifying.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
