6.1-stable patches

added patches:
	riscv-fix-wrong-usage-of-lm_alias-when-splitting-a-huge-linear-mapping.patch

diff --git a/queue-6.1/riscv-fix-wrong-usage-of-lm_alias-when-splitting-a-huge-linear-mapping.patch b/queue-6.1/riscv-fix-wrong-usage-of-lm_alias-when-splitting-a-huge-linear-mapping.patch
new file mode 100644 (file)
index 0000000..bf057f3
--- /dev/null
+++ b/queue-6.1/riscv-fix-wrong-usage-of-lm_alias-when-splitting-a-huge-linear-mapping.patch
@@ -0,0 +1,43 @@
+From c29fc621e1a49949a14c7fa031dd4760087bfb29 Mon Sep 17 00:00:00 2001
+From: Alexandre Ghiti <alexghiti@rivosinc.com>
+Date: Tue, 12 Dec 2023 20:54:00 +0100
+Subject: riscv: Fix wrong usage of lm_alias() when splitting a huge linear mapping
+
+From: Alexandre Ghiti <alexghiti@rivosinc.com>
+
+commit c29fc621e1a49949a14c7fa031dd4760087bfb29 upstream.
+
+lm_alias() can only be used on kernel mappings since it explicitly uses
+__pa_symbol(), so simply fix this by checking where the address belongs
+to before.
+
+Fixes: 311cd2f6e253 ("riscv: Fix set_memory_XX() and set_direct_map_XX() by splitting huge linear mappings")
+Reported-by: syzbot+afb726d49f84c8d95ee1@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/linux-riscv/000000000000620dd0060c02c5e1@google.com/
+Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com>
+Reviewed-by: Charlie Jenkins <charlie@rivosinc.com>
+Link: https://lore.kernel.org/r/20231212195400.128457-1-alexghiti@rivosinc.com
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/riscv/mm/pageattr.c |    9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/arch/riscv/mm/pageattr.c
++++ b/arch/riscv/mm/pageattr.c
+@@ -304,8 +304,13 @@ static int __set_memory(unsigned long ad
+                               goto unlock;
+               }
+       } else if (is_kernel_mapping(start) || is_linear_mapping(start)) {
+-              lm_start = (unsigned long)lm_alias(start);
+-              lm_end = (unsigned long)lm_alias(end);
++              if (is_kernel_mapping(start)) {
++                      lm_start = (unsigned long)lm_alias(start);
++                      lm_end = (unsigned long)lm_alias(end);
++              } else {
++                      lm_start = start;
++                      lm_end = end;
++              }
+ 
+               ret = split_linear_mapping(lm_start, lm_end);
+               if (ret)

diff --git a/queue-6.1/series b/queue-6.1/series
index b24c9011d37fd038702a53f6fbf6defa21709cd8..a0e6d40c48aafabca3b56acec76518979e35226a 100644 (file)
--- a/queue-6.1/series
+++ b/queue-6.1/series
@@ -414,3 +414,4 @@ ipv6-mcast-fix-data-race-in-ipv6_mc_down-mld_ifc_wor.patch
 i2c-s3c24xx-fix-read-transfers-in-polling-mode.patch
 i2c-s3c24xx-fix-transferring-more-than-one-message-i.patch
 block-remove-special-casing-of-compound-pages.patch
+riscv-fix-wrong-usage-of-lm_alias-when-splitting-a-huge-linear-mapping.patch