--- /dev/null
+From jolsa@kernel.org Tue Nov 19 12:58:34 2024
+From: Jiri Olsa <jolsa@kernel.org>
+Date: Mon, 4 Nov 2024 18:52:56 +0100
+Subject: lib/buildid: Fix build ID parsing logic
+To: stable@vger.kernel.org
+Cc: Andrii Nakryiko <andrii@kernel.org>, bpf@vger.kernel.org, Daniel Borkmann <daniel@iogearbox.net>
+Message-ID: <20241104175256.2327164-5-jolsa@kernel.org>
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+The parse_build_id_buf does not account Elf32_Nhdr header size
+when getting the build id data pointer and returns wrong build
+id data as result.
+
+This is problem only for stable trees that merged 768d731b8a0d
+fix, the upstream build id code was refactored and returns proper
+build id.
+
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Fixes: 768d731b8a0d ("lib/buildid: harden build ID parsing logic")
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ lib/buildid.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/lib/buildid.c
++++ b/lib/buildid.c
+@@ -40,7 +40,7 @@ static int parse_build_id_buf(unsigned c
+ name_sz == note_name_sz &&
+ memcmp(nhdr + 1, note_name, note_name_sz) == 0 &&
+ desc_sz > 0 && desc_sz <= BUILD_ID_SIZE_MAX) {
+- data = note_start + note_off + ALIGN(note_name_sz, 4);
++ data = note_start + note_off + sizeof(Elf32_Nhdr) + ALIGN(note_name_sz, 4);
+ memcpy(build_id, data, desc_sz);
+ memset(build_id + desc_sz, 0, BUILD_ID_SIZE_MAX - desc_sz);
+ if (size)
--- /dev/null
+From a4aebaf6e6efff548b01a3dc49b4b9074751c15b Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Date: Wed, 6 Nov 2024 21:50:55 +0100
+Subject: media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set
+
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+commit a4aebaf6e6efff548b01a3dc49b4b9074751c15b upstream.
+
+When CONFIG_DVB_DYNAMIC_MINORS, ret is not initialized, and a
+semaphore is left at the wrong state, in case of errors.
+
+Make the code simpler and avoid mistakes by having just one error
+check logic used weather DVB_DYNAMIC_MINORS is used or not.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/r/202410201717.ULWWdJv8-lkp@intel.com/
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Link: https://lore.kernel.org/r/9e067488d8935b8cf00959764a1fa5de85d65725.1730926254.git.mchehab+huawei@kernel.org
+Cc: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/dvb-core/dvbdev.c | 15 ++++-----------
+ 1 file changed, 4 insertions(+), 11 deletions(-)
+
+--- a/drivers/media/dvb-core/dvbdev.c
++++ b/drivers/media/dvb-core/dvbdev.c
+@@ -530,6 +530,9 @@ int dvb_register_device(struct dvb_adapt
+ for (minor = 0; minor < MAX_DVB_MINORS; minor++)
+ if (!dvb_minors[minor])
+ break;
++#else
++ minor = nums2minor(adap->num, type, id);
++#endif
+ if (minor >= MAX_DVB_MINORS) {
+ if (new_node) {
+ list_del(&new_node->list_head);
+@@ -543,17 +546,7 @@ int dvb_register_device(struct dvb_adapt
+ mutex_unlock(&dvbdev_register_lock);
+ return -EINVAL;
+ }
+-#else
+- minor = nums2minor(adap->num, type, id);
+- if (minor >= MAX_DVB_MINORS) {
+- dvb_media_device_free(dvbdev);
+- list_del(&dvbdev->list_head);
+- kfree(dvbdev);
+- *pdvbdev = NULL;
+- mutex_unlock(&dvbdev_register_lock);
+- return ret;
+- }
+-#endif
++
+ dvbdev->minor = minor;
+ dvb_minors[minor] = dvb_device_get(dvbdev);
+ up_write(&minor_rwsem);
--- /dev/null
+From ca34aceb322bfcd6ab498884f1805ee12f983259 Mon Sep 17 00:00:00 2001
+From: Alexandre Ferrieux <alexandre.ferrieux@gmail.com>
+Date: Wed, 13 Nov 2024 11:04:28 +0100
+Subject: net: sched: u32: Add test case for systematic hnode IDR leaks
+
+From: Alexandre Ferrieux <alexandre.ferrieux@gmail.com>
+
+commit ca34aceb322bfcd6ab498884f1805ee12f983259 upstream.
+
+Add a tdc test case to exercise the just-fixed systematic leak of
+IDR entries in u32 hnode disposal. Given the IDR in question is
+confined to the range [1..0x7FF], it is sufficient to create/delete
+the same filter 2048 times to fill it up and get a nonzero exit
+status from "tc filter add".
+
+Signed-off-by: Alexandre Ferrieux <alexandre.ferrieux@orange.com>
+Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
+Reviewed-by: Victor Nogueira <victor@mojatatu.com>
+Link: https://patch.msgid.link/20241113100428.360460-1-alexandre.ferrieux@orange.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/tc-testing/tc-tests/filters/u32.json | 24 +++++++++++
+ 1 file changed, 24 insertions(+)
+
+--- a/tools/testing/selftests/tc-testing/tc-tests/filters/u32.json
++++ b/tools/testing/selftests/tc-testing/tc-tests/filters/u32.json
+@@ -329,5 +329,29 @@
+ "teardown": [
+ "$TC qdisc del dev $DEV1 parent root drr"
+ ]
++ },
++ {
++ "id": "1234",
++ "name": "Exercise IDR leaks by creating/deleting a filter many (2048) times",
++ "category": [
++ "filter",
++ "u32"
++ ],
++ "plugins": {
++ "requires": "nsPlugin"
++ },
++ "setup": [
++ "$TC qdisc add dev $DEV1 parent root handle 10: drr",
++ "$TC filter add dev $DEV1 parent 10:0 protocol ip prio 2 u32 match ip src 0.0.0.2/32 action drop",
++ "$TC filter add dev $DEV1 parent 10:0 protocol ip prio 3 u32 match ip src 0.0.0.3/32 action drop"
++ ],
++ "cmdUnderTest": "bash -c 'for i in {1..2048} ;do echo filter delete dev $DEV1 pref 3;echo filter add dev $DEV1 parent 10:0 protocol ip prio 3 u32 match ip src 0.0.0.3/32 action drop;done | $TC -b -'",
++ "expExitCode": "0",
++ "verifyCmd": "$TC filter show dev $DEV1",
++ "matchPattern": "protocol ip pref 3 u32",
++ "matchCount": "3",
++ "teardown": [
++ "$TC qdisc del dev $DEV1 parent root drr"
++ ]
+ }
+ ]
mm-refactor-arch_calc_vm_flag_bits-and-arm64-mte-han.patch
drm-xe-restore-system-memory-ggtt-mappings.patch
drm-xe-improve-hibernation-on-igpu.patch
+lib-buildid-fix-build-id-parsing-logic.patch
+net-sched-u32-add-test-case-for-systematic-hnode-idr-leaks.patch
+media-dvbdev-fix-the-logic-when-dvb_dynamic_minors-is-not-set.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
