From: Greg Kroah-Hartman Date: Mon, 22 Sep 2025 05:50:46 +0000 (+0200) Subject: 5.10-stable patches X-Git-Tag: v6.1.154~14 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0184aafa098c08be846bd543ae23499231a23097;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: btrfs-tree-checker-fix-the-incorrect-inode-ref-size-check.patch mptcp-propagate-shutdown-to-subflows-when-possible.patch net-rfkill-gpio-add-dt-support.patch net-rfkill-gpio-fix-crash-due-to-dereferencering-uninitialized-pointer.patch --- diff --git a/queue-5.10/btrfs-tree-checker-fix-the-incorrect-inode-ref-size-check.patch b/queue-5.10/btrfs-tree-checker-fix-the-incorrect-inode-ref-size-check.patch new file mode 100644 index 0000000000..7d4b8692ef --- /dev/null +++ b/queue-5.10/btrfs-tree-checker-fix-the-incorrect-inode-ref-size-check.patch @@ -0,0 +1,57 @@ +From stable+bounces-180845-greg=kroah.com@vger.kernel.org Mon Sep 22 01:15:58 2025 +From: Sasha Levin +Date: Sun, 21 Sep 2025 19:15:50 -0400 +Subject: btrfs: tree-checker: fix the incorrect inode ref size check +To: stable@vger.kernel.org +Cc: Qu Wenruo , Johannes Thumshirn , Filipe Manana , David Sterba , Sasha Levin +Message-ID: <20250921231550.3032338-1-sashal@kernel.org> + +From: Qu Wenruo + +[ Upstream commit 96fa515e70f3e4b98685ef8cac9d737fc62f10e1 ] + +[BUG] +Inside check_inode_ref(), we need to make sure every structure, +including the btrfs_inode_extref header, is covered by the item. But +our code is incorrectly using "sizeof(iref)", where @iref is just a +pointer. + +This means "sizeof(iref)" will always be "sizeof(void *)", which is much +smaller than "sizeof(struct btrfs_inode_extref)". + +This will allow some bad inode extrefs to sneak in, defeating tree-checker. + +[FIX] +Fix the typo by calling "sizeof(*iref)", which is the same as +"sizeof(struct btrfs_inode_extref)", and will be the correct behavior we +want. + +Fixes: 71bf92a9b877 ("btrfs: tree-checker: Add check for INODE_REF") +CC: stable@vger.kernel.org # 6.1+ +Reviewed-by: Johannes Thumshirn +Reviewed-by: Filipe Manana +Signed-off-by: Qu Wenruo +Reviewed-by: David Sterba +Signed-off-by: David Sterba +[ Added unlikely() ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/tree-checker.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/fs/btrfs/tree-checker.c ++++ b/fs/btrfs/tree-checker.c +@@ -1545,10 +1545,10 @@ static int check_inode_ref(struct extent + while (ptr < end) { + u16 namelen; + +- if (ptr + sizeof(iref) > end) { ++ if (unlikely(ptr + sizeof(*iref) > end)) { + inode_ref_err(leaf, slot, + "inode ref overflow, ptr %lu end %lu inode_ref_size %zu", +- ptr, end, sizeof(iref)); ++ ptr, end, sizeof(*iref)); + return -EUCLEAN; + } + diff --git a/queue-5.10/mptcp-propagate-shutdown-to-subflows-when-possible.patch b/queue-5.10/mptcp-propagate-shutdown-to-subflows-when-possible.patch new file mode 100644 index 0000000000..7c7608020a --- /dev/null +++ b/queue-5.10/mptcp-propagate-shutdown-to-subflows-when-possible.patch @@ -0,0 +1,84 @@ +From stable+bounces-180870-greg=kroah.com@vger.kernel.org Mon Sep 22 03:46:38 2025 +From: Sasha Levin +Date: Sun, 21 Sep 2025 21:46:30 -0400 +Subject: mptcp: propagate shutdown to subflows when possible +To: stable@vger.kernel.org +Cc: "Matthieu Baerts (NGI0)" , Mat Martineau , Geliang Tang , Jakub Kicinski , Sasha Levin +Message-ID: <20250922014630.3127747-1-sashal@kernel.org> + +From: "Matthieu Baerts (NGI0)" + +[ Upstream commit f755be0b1ff429a2ecf709beeb1bcd7abc111c2b ] + +When the MPTCP DATA FIN have been ACKed, there is no more MPTCP related +metadata to exchange, and all subflows can be safely shutdown. + +Before this patch, the subflows were actually terminated at 'close()' +time. That's certainly fine most of the time, but not when the userspace +'shutdown()' a connection, without close()ing it. When doing so, the +subflows were staying in LAST_ACK state on one side -- and consequently +in FIN_WAIT2 on the other side -- until the 'close()' of the MPTCP +socket. + +Now, when the DATA FIN have been ACKed, all subflows are shutdown. A +consequence of this is that the TCP 'FIN' flag can be set earlier now, +but the end result is the same. This affects the packetdrill tests +looking at the end of the MPTCP connections, but for a good reason. + +Note that tcp_shutdown() will check the subflow state, so no need to do +that again before calling it. + +Fixes: 3721b9b64676 ("mptcp: Track received DATA_FIN sequence number and add related helpers") +Cc: stable@vger.kernel.org +Fixes: 16a9a9da1723 ("mptcp: Add helper to process acks of DATA_FIN") +Reviewed-by: Mat Martineau +Reviewed-by: Geliang Tang +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20250912-net-mptcp-fix-sft-connect-v1-1-d40e77cbbf02@kernel.org +Signed-off-by: Jakub Kicinski +[ Adjust context ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/protocol.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +--- a/net/mptcp/protocol.c ++++ b/net/mptcp/protocol.c +@@ -326,6 +326,20 @@ static void mptcp_stop_timer(struct sock + mptcp_sk(sk)->timer_ival = 0; + } + ++static void mptcp_shutdown_subflows(struct mptcp_sock *msk) ++{ ++ struct mptcp_subflow_context *subflow; ++ ++ mptcp_for_each_subflow(msk, subflow) { ++ struct sock *ssk = mptcp_subflow_tcp_sock(subflow); ++ bool slow; ++ ++ slow = lock_sock_fast(ssk); ++ tcp_shutdown(ssk, SEND_SHUTDOWN); ++ unlock_sock_fast(ssk, slow); ++ } ++} ++ + static void mptcp_check_data_fin_ack(struct sock *sk) + { + struct mptcp_sock *msk = mptcp_sk(sk); +@@ -348,6 +362,7 @@ static void mptcp_check_data_fin_ack(str + break; + case TCP_CLOSING: + case TCP_LAST_ACK: ++ mptcp_shutdown_subflows(msk); + inet_sk_state_store(sk, TCP_CLOSE); + sk->sk_state_change(sk); + break; +@@ -430,6 +445,7 @@ static void mptcp_check_data_fin(struct + inet_sk_state_store(sk, TCP_CLOSING); + break; + case TCP_FIN_WAIT2: ++ mptcp_shutdown_subflows(msk); + inet_sk_state_store(sk, TCP_CLOSE); + // @@ Close subflows now? + break; diff --git a/queue-5.10/net-rfkill-gpio-add-dt-support.patch b/queue-5.10/net-rfkill-gpio-add-dt-support.patch new file mode 100644 index 0000000000..eb14d11832 --- /dev/null +++ b/queue-5.10/net-rfkill-gpio-add-dt-support.patch @@ -0,0 +1,77 @@ +From stable+bounces-180855-greg=kroah.com@vger.kernel.org Mon Sep 22 01:46:38 2025 +From: Sasha Levin +Date: Sun, 21 Sep 2025 19:46:29 -0400 +Subject: net: rfkill: gpio: add DT support +To: stable@vger.kernel.org +Cc: Philipp Zabel , Johannes Berg , Sasha Levin +Message-ID: <20250921234630.3087563-1-sashal@kernel.org> + +From: Philipp Zabel + +[ Upstream commit d64c732dfc9edcd57feb693c23162117737e426b ] + +Allow probing rfkill-gpio via device tree. This hooks up the already +existing support that was started in commit 262c91ee5e52 ("net: +rfkill: gpio: prepare for DT and ACPI support") via the "rfkill-gpio" +compatible, with the "name" and "type" properties renamed to "label" +and "radio-type", respectively, in the device tree case. + +Signed-off-by: Philipp Zabel +Link: https://lore.kernel.org/r/20230102-rfkill-gpio-dt-v2-2-d1b83758c16d@pengutronix.de +Signed-off-by: Johannes Berg +Stable-dep-of: b6f56a44e4c1 ("net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/rfkill/rfkill-gpio.c | 20 ++++++++++++++++++-- + 1 file changed, 18 insertions(+), 2 deletions(-) + +--- a/net/rfkill/rfkill-gpio.c ++++ b/net/rfkill/rfkill-gpio.c +@@ -79,6 +79,8 @@ static int rfkill_gpio_probe(struct plat + { + struct rfkill_gpio_data *rfkill; + struct gpio_desc *gpio; ++ const char *name_property; ++ const char *type_property; + const char *type_name; + int ret; + +@@ -86,8 +88,15 @@ static int rfkill_gpio_probe(struct plat + if (!rfkill) + return -ENOMEM; + +- device_property_read_string(&pdev->dev, "name", &rfkill->name); +- device_property_read_string(&pdev->dev, "type", &type_name); ++ if (dev_of_node(&pdev->dev)) { ++ name_property = "label"; ++ type_property = "radio-type"; ++ } else { ++ name_property = "name"; ++ type_property = "type"; ++ } ++ device_property_read_string(&pdev->dev, name_property, &rfkill->name); ++ device_property_read_string(&pdev->dev, type_property, &type_name); + + if (!rfkill->name) + rfkill->name = dev_name(&pdev->dev); +@@ -169,12 +178,19 @@ static const struct acpi_device_id rfkil + MODULE_DEVICE_TABLE(acpi, rfkill_acpi_match); + #endif + ++static const struct of_device_id rfkill_of_match[] __maybe_unused = { ++ { .compatible = "rfkill-gpio", }, ++ { }, ++}; ++MODULE_DEVICE_TABLE(of, rfkill_of_match); ++ + static struct platform_driver rfkill_gpio_driver = { + .probe = rfkill_gpio_probe, + .remove = rfkill_gpio_remove, + .driver = { + .name = "rfkill_gpio", + .acpi_match_table = ACPI_PTR(rfkill_acpi_match), ++ .of_match_table = of_match_ptr(rfkill_of_match), + }, + }; + diff --git a/queue-5.10/net-rfkill-gpio-fix-crash-due-to-dereferencering-uninitialized-pointer.patch b/queue-5.10/net-rfkill-gpio-fix-crash-due-to-dereferencering-uninitialized-pointer.patch new file mode 100644 index 0000000000..31ad985d2e --- /dev/null +++ b/queue-5.10/net-rfkill-gpio-fix-crash-due-to-dereferencering-uninitialized-pointer.patch @@ -0,0 +1,60 @@ +From stable+bounces-180856-greg=kroah.com@vger.kernel.org Mon Sep 22 01:46:38 2025 +From: Sasha Levin +Date: Sun, 21 Sep 2025 19:46:30 -0400 +Subject: net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer +To: stable@vger.kernel.org +Cc: Hans de Goede , Heikki Krogerus , Johannes Berg , Sasha Levin +Message-ID: <20250921234630.3087563-2-sashal@kernel.org> + +From: Hans de Goede + +[ Upstream commit b6f56a44e4c1014b08859dcf04ed246500e310e5 ] + +Since commit 7d5e9737efda ("net: rfkill: gpio: get the name and type from +device property") rfkill_find_type() gets called with the possibly +uninitialized "const char *type_name;" local variable. + +On x86 systems when rfkill-gpio binds to a "BCM4752" or "LNV4752" +acpi_device, the rfkill->type is set based on the ACPI acpi_device_id: + + rfkill->type = (unsigned)id->driver_data; + +and there is no "type" property so device_property_read_string() will fail +and leave type_name uninitialized, leading to a potential crash. + +rfkill_find_type() does accept a NULL pointer, fix the potential crash +by initializing type_name to NULL. + +Note likely sofar this has not been caught because: + +1. Not many x86 machines actually have a "BCM4752"/"LNV4752" acpi_device +2. The stack happened to contain NULL where type_name is stored + +Fixes: 7d5e9737efda ("net: rfkill: gpio: get the name and type from device property") +Cc: stable@vger.kernel.org +Cc: Heikki Krogerus +Signed-off-by: Hans de Goede +Reviewed-by: Heikki Krogerus +Link: https://patch.msgid.link/20250913113515.21698-1-hansg@kernel.org +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/rfkill/rfkill-gpio.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/rfkill/rfkill-gpio.c ++++ b/net/rfkill/rfkill-gpio.c +@@ -78,10 +78,10 @@ static int rfkill_gpio_acpi_probe(struct + static int rfkill_gpio_probe(struct platform_device *pdev) + { + struct rfkill_gpio_data *rfkill; +- struct gpio_desc *gpio; ++ const char *type_name = NULL; + const char *name_property; + const char *type_property; +- const char *type_name; ++ struct gpio_desc *gpio; + int ret; + + rfkill = devm_kzalloc(&pdev->dev, sizeof(*rfkill), GFP_KERNEL); diff --git a/queue-5.10/series b/queue-5.10/series index 18f5614af0..e16eca41d1 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -77,3 +77,7 @@ phy-phy-bcm-ns-usb3-drop-support-for-deprecated-dt-binding.patch phy-broadcom-ns-usb3-fix-wvoid-pointer-to-enum-cast-warning.patch phy-use-device_get_match_data.patch phy-ti-omap-usb2-fix-device-leak-at-unbind.patch +net-rfkill-gpio-add-dt-support.patch +net-rfkill-gpio-fix-crash-due-to-dereferencering-uninitialized-pointer.patch +btrfs-tree-checker-fix-the-incorrect-inode-ref-size-check.patch +mptcp-propagate-shutdown-to-subflows-when-possible.patch