From: Greg Kroah-Hartman Date: Thu, 9 Jul 2026 17:37:25 +0000 (+0200) Subject: 6.1-stable patches X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5bf0b736fd6ec1ec7a032329f84cffc12a12b6de;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: acpi-cppc-suppress-ubsan-warning-caused-by-field-misuse.patch rust-kbuild-set-frame-pointer-llvm-module-flag-for-config_frame_pointer.patch --- diff --git a/queue-6.1/acpi-cppc-suppress-ubsan-warning-caused-by-field-misuse.patch b/queue-6.1/acpi-cppc-suppress-ubsan-warning-caused-by-field-misuse.patch new file mode 100644 index 0000000000..1b7b7f66ab --- /dev/null +++ b/queue-6.1/acpi-cppc-suppress-ubsan-warning-caused-by-field-misuse.patch @@ -0,0 +1,81 @@ +From 1b1acf2dada0cc3931bb2cb9ff8832edfbee46a1 Mon Sep 17 00:00:00 2001 +From: Jeremy Linton +Date: Mon, 1 Jun 2026 18:58:08 -0500 +Subject: ACPI: CPPC: Suppress UBSAN warning caused by field misuse + +From: Jeremy Linton + +commit 1b1acf2dada0cc3931bb2cb9ff8832edfbee46a1 upstream. + +The definition of reg->access_width changes depending on the +reg->space_id type. Type ACPI_ADR_SPACE_PLATFORM_COMM uses +access_width to indicate the PCC region, which can result in a UBSAN +if the value is greater than 4. + +For example: + + UBSAN: shift-out-of-bounds in drivers/acpi/cppc_acpi.c:1090:9 + shift exponent 32 is too large for 32-bit type 'int' + CPU: 61 UID: 0 PID: 1220 Comm: (udev-worker) Not tainted 7.0.10-201.fc44.aarch64 #1 PREEMPT(lazy) + Hardware name: To be filled by O.E.M. + Call trace: + ...(trimming) + ubsan_epilogue+0x10/0x48 + __ubsan_handle_shift_out_of_bounds+0xdc/0x1e0 + cpc_write+0x4d0/0x670 + cppc_set_perf+0x18c/0x490 + cppc_cpufreq_cpu_init+0x1c8/0x380 [cppc_cpufreq] + ... (trimming) + +Lets fix this by validating the region type, as well as whether +access_width has a value. Then since we are returning bit_width +directly for ACPI_ADR_SPACE_PLATFORM_COMM, drop the code correcting +the size. + +Fixes: 2f4a4d63a193 ("ACPI: CPPC: Use access_width over bit_width for system memory accesses") +Signed-off-by: Jeremy Linton +Tested-by: Jarred White +Reviewed-by: Jarred White +Reviewed-by: Easwar Hariharan +Cc: All applicable +Link: https://patch.msgid.link/20260601235808.1113137-1-jeremy.linton@arm.com +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/cppc_acpi.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/acpi/cppc_acpi.c ++++ b/drivers/acpi/cppc_acpi.c +@@ -166,8 +166,13 @@ show_cppc_data(cppc_get_perf_caps, cppc_ + show_cppc_data(cppc_get_perf_ctrs, cppc_perf_fb_ctrs, reference_perf); + show_cppc_data(cppc_get_perf_ctrs, cppc_perf_fb_ctrs, wraparound_time); + +-/* Check for valid access_width, otherwise, fallback to using bit_width */ +-#define GET_BIT_WIDTH(reg) ((reg)->access_width ? (8 << ((reg)->access_width - 1)) : (reg)->bit_width) ++/* ++ * PCC reuses the access_width field as the subspace id, so only decode access ++ * size for non-PCC registers. Otherwise, use the bit_width. ++ */ ++#define GET_BIT_WIDTH(reg) (((reg)->access_width && \ ++ (reg)->space_id != ACPI_ADR_SPACE_PLATFORM_COMM) ? \ ++ (8 << ((reg)->access_width - 1)) : (reg)->bit_width) + + /* Shift and apply the mask for CPC reads/writes */ + #define MASK_VAL_READ(reg, val) (((val) >> (reg)->bit_offset) & \ +@@ -1027,7 +1032,6 @@ static int cpc_read(int cpu, struct cpc_ + * by the bit width field; the access size is used to indicate + * the PCC subspace id. + */ +- size = reg->bit_width; + vaddr = GET_PCC_VADDR(reg->address, pcc_ss_id); + } + else if (reg->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY) +@@ -1099,7 +1103,6 @@ static int cpc_write(int cpu, struct cpc + * by the bit width field; the access size is used to indicate + * the PCC subspace id. + */ +- size = reg->bit_width; + vaddr = GET_PCC_VADDR(reg->address, pcc_ss_id); + } + else if (reg->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY) diff --git a/queue-6.1/rust-kbuild-set-frame-pointer-llvm-module-flag-for-config_frame_pointer.patch b/queue-6.1/rust-kbuild-set-frame-pointer-llvm-module-flag-for-config_frame_pointer.patch new file mode 100644 index 0000000000..b8e347d1a9 --- /dev/null +++ b/queue-6.1/rust-kbuild-set-frame-pointer-llvm-module-flag-for-config_frame_pointer.patch @@ -0,0 +1,54 @@ +From 191f49f1e38b1c10eb44b0f967c6175c884ef7db Mon Sep 17 00:00:00 2001 +From: Alice Ryhl +Date: Tue, 16 Jun 2026 12:30:38 +0000 +Subject: rust: Kbuild: set frame-pointer llvm module flag for CONFIG_FRAME_POINTER + +From: Alice Ryhl + +commit 191f49f1e38b1c10eb44b0f967c6175c884ef7db upstream. + +Due to a rustc bug, the -Cforce-frame-pointers=y flag only emits the +frame-pointer annotation for functions, but not for the module. This +means that functions generated by the LLVM backend such as +'asan.module_ctor' do not receive the frame-pointer annotation. + +This is likely to lead to broken backtraces and may also cause issues +with ftrace if these features are used with functions generated by the +LLVM backend. + +Thus, use -Zllvm_module_flag to work around this rustc bug if using a +rustc without the fix. + +[ The fix [1] has landed for Rust 1.98.0 (expected release on + 2026-08-20). - Miguel ] + +Cc: stable@vger.kernel.org # 6.12.y and later (flag not available in pinned Rust in older LTSs). +Fixes: 2f7ab1267dc9 ("Kbuild: add Rust support") +Link: https://github.com/rust-lang/rust/pull/156980 [1] +Signed-off-by: Alice Ryhl +Link: https://patch.msgid.link/20260616-frame-ptr-fix-v1-1-dc6b29a631d9@google.com +[ - Adjusted Cc: stable@ as discussed. +Signed-off-by: Greg Kroah-Hartman + + - Added comment with link to the PR, similar to what we did in commit + ac35b5580ace ("rust: arm64: set uwtable llvm module flag for + CONFIG_UNWIND_TABLES"). + + - Miguel ] +Signed-off-by: Miguel Ojeda +--- + Makefile | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/Makefile ++++ b/Makefile +@@ -904,6 +904,9 @@ KBUILD_CFLAGS += $(call cc-disable-warni + ifdef CONFIG_FRAME_POINTER + KBUILD_CFLAGS += -fno-omit-frame-pointer -fno-optimize-sibling-calls + KBUILD_RUSTFLAGS += -Cforce-frame-pointers=y ++# Work around rustc bug on compilers without ++# https://github.com/rust-lang/rust/pull/156980. ++KBUILD_RUSTFLAGS += $(if $(call rustc-min-version,109800),,-Zllvm_module_flag=frame-pointer:u32:2:max) + else + # Some targets (ARM with Thumb2, for example), can't be built with frame + # pointers. For those, we don't have FUNCTION_TRACER automatically diff --git a/queue-6.1/series b/queue-6.1/series index ac66580f6b..b384cc251e 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -44,3 +44,5 @@ eventpoll-drop-vestigial-__-prefix-from-ep_remove_-file-epi.patch eventpoll-rename-ep_remove_safe-back-to-ep_remove.patch eventpoll-move-epi_fget-up.patch eventpoll-fix-ep_remove-struct-eventpoll-struct-file-uaf.patch +acpi-cppc-suppress-ubsan-warning-caused-by-field-misuse.patch +rust-kbuild-set-frame-pointer-llvm-module-flag-for-config_frame_pointer.patch