From: Sasha Levin Date: Fri, 10 Jul 2026 19:46:52 +0000 (-0400) Subject: drop mm-fix-copy_from_user_nofault.patch from 5.15 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=34d034eaea320646522f59862cddae4a7586582f;p=thirdparty%2Fkernel%2Fstable-queue.git drop mm-fix-copy_from_user_nofault.patch from 5.15 Signed-off-by: Sasha Levin --- diff --git a/queue-5.15/mm-fix-copy_from_user_nofault.patch b/queue-5.15/mm-fix-copy_from_user_nofault.patch deleted file mode 100644 index 1881c4df45..0000000000 --- a/queue-5.15/mm-fix-copy_from_user_nofault.patch +++ /dev/null @@ -1,84 +0,0 @@ -From d319f344561de23e810515d109c7278919bff7b0 Mon Sep 17 00:00:00 2001 -From: Alexei Starovoitov -Date: Mon, 10 Apr 2023 19:43:44 +0200 -Subject: mm: Fix copy_from_user_nofault(). - -From: Alexei Starovoitov - -commit d319f344561de23e810515d109c7278919bff7b0 upstream. - -There are several issues with copy_from_user_nofault(): - -- access_ok() is designed for user context only and for that reason -it has WARN_ON_IN_IRQ() which triggers when bpf, kprobe, eprobe -and perf on ppc are calling it from irq. - -- it's missing nmi_uaccess_okay() which is a nop on all architectures -except x86 where it's required. -The comment in arch/x86/mm/tlb.c explains the details why it's necessary. -Calling copy_from_user_nofault() from bpf, [ke]probe without this check is not safe. - -- __copy_from_user_inatomic() under CONFIG_HARDENED_USERCOPY is calling -check_object_size()->__check_object_size()->check_heap_object()->find_vmap_area()->spin_lock() -which is not safe to do from bpf, [ke]probe and perf due to potential deadlock. - -Fix all three issues. At the end the copy_from_user_nofault() becomes -equivalent to copy_from_user_nmi() from safety point of view with -a difference in the return value. - -Reported-by: Hsin-Wei Hung -Signed-off-by: Alexei Starovoitov -Signed-off-by: Florian Lehner -Tested-by: Hsin-Wei Hung -Tested-by: Florian Lehner -Link: https://lore.kernel.org/r/20230410174345.4376-2-dev@der-flo.net -Signed-off-by: Alexei Starovoitov -[ merge conflict fixes: - copy_from_user_nofault: caused by force_uaccess_begin and - force_uaccess_end functions. moved the code around to call those - functions in the same way after the additional checks. - - check_heap_object: completely different implementation in 5.15.y. - removed any changes from this commit as the current implementation - doesn't call the same lock which caused problems. ] -Signed-off-by: Jakov Novak -Signed-off-by: Greg Kroah-Hartman ---- - mm/maccess.c | 18 ++++++++++++------ - 1 file changed, 12 insertions(+), 6 deletions(-) - ---- a/mm/maccess.c -+++ b/mm/maccess.c -@@ -5,6 +5,7 @@ - #include - #include - #include -+#include - - bool __weak copy_from_kernel_nofault_allowed(const void *unsafe_src, - size_t size) -@@ -221,13 +222,18 @@ long strncpy_from_kernel_nofault(char *d - long copy_from_user_nofault(void *dst, const void __user *src, size_t size) - { - long ret = -EFAULT; -- mm_segment_t old_fs = force_uaccess_begin(); -+ mm_segment_t old_fs; - -- if (access_ok(src, size)) { -- pagefault_disable(); -- ret = __copy_from_user_inatomic(dst, src, size); -- pagefault_enable(); -- } -+ if (!__access_ok(src, size)) -+ return ret; -+ -+ if (!nmi_uaccess_okay()) -+ return ret; -+ -+ old_fs = force_uaccess_begin(); -+ pagefault_disable(); -+ ret = __copy_from_user_inatomic(dst, src, size); -+ pagefault_enable(); - force_uaccess_end(old_fs); - - if (ret) diff --git a/queue-5.15/series b/queue-5.15/series index 8cc82c6a30..13e281e022 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -15,7 +15,6 @@ nfsd-move-name-lookup-out-of-nfsd4_list_rec_dir.patch nfsd-change-nfs4_client_to_reclaim-to-allocate-data.patch kvm-replace-guest-triggerable-bug_on-in-ioeventfd-da.patch perf-trace-beauty-fcntl-fix-build-with-older-kernel-headers.patch -mm-fix-copy_from_user_nofault.patch netfilter-nf_tables-restore-set-elements-when-delete-set-fails.patch skmsg-convert-struct-sk_msg_sg-copy-to-a-bitmap.patch net-skmsg-preserve-sg.copy-across-sg-transforms.patch