From: Greg Kroah-Hartman Date: Wed, 5 Mar 2025 14:23:29 +0000 (+0100) Subject: 5.10-stable patches X-Git-Tag: v6.6.81~16 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6228f942ba4a434655830d4757232539b879374d;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: intel_idle-handle-older-cpus-which-stop-the-tsc-in-deeper-c-states-correctly.patch pfifo_tail_enqueue-drop-new-packet-when-sch-limit-0.patch --- diff --git a/queue-5.10/intel_idle-handle-older-cpus-which-stop-the-tsc-in-deeper-c-states-correctly.patch b/queue-5.10/intel_idle-handle-older-cpus-which-stop-the-tsc-in-deeper-c-states-correctly.patch new file mode 100644 index 0000000000..4b9ef37921 --- /dev/null +++ b/queue-5.10/intel_idle-handle-older-cpus-which-stop-the-tsc-in-deeper-c-states-correctly.patch @@ -0,0 +1,54 @@ +From c157d351460bcf202970e97e611cb6b54a3dd4a4 Mon Sep 17 00:00:00 2001 +From: Thomas Gleixner +Date: Tue, 25 Feb 2025 23:37:08 +0100 +Subject: intel_idle: Handle older CPUs, which stop the TSC in deeper C states, correctly + +From: Thomas Gleixner + +commit c157d351460bcf202970e97e611cb6b54a3dd4a4 upstream. + +The Intel idle driver is preferred over the ACPI processor idle driver, +but fails to implement the work around for Core2 generation CPUs, where +the TSC stops in C2 and deeper C-states. This causes stalls and boot +delays, when the clocksource watchdog does not catch the unstable TSC +before the CPU goes deep idle for the first time. + +The ACPI driver marks the TSC unstable when it detects that the CPU +supports C2 or deeper and the CPU does not have a non-stop TSC. + +Add the equivivalent work around to the Intel idle driver to cure that. + +Fixes: 18734958e9bf ("intel_idle: Use ACPI _CST for processor models without C-state tables") +Reported-by: Fab Stz +Signed-off-by: Thomas Gleixner +Tested-by: Fab Stz +Cc: All applicable +Closes: https://lore.kernel.org/all/10cf96aa-1276-4bd4-8966-c890377030c3@yahoo.fr +Link: https://patch.msgid.link/87bjupfy7f.ffs@tglx +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman +--- + drivers/idle/intel_idle.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/idle/intel_idle.c ++++ b/drivers/idle/intel_idle.c +@@ -56,6 +56,7 @@ + #include + #include + #include ++#include + + #define INTEL_IDLE_VERSION "0.5.1" + +@@ -1295,6 +1296,9 @@ static void __init intel_idle_init_cstat + if (intel_idle_state_needs_timer_stop(state)) + state->flags |= CPUIDLE_FLAG_TIMER_STOP; + ++ if (cx->type > ACPI_STATE_C1 && !boot_cpu_has(X86_FEATURE_NONSTOP_TSC)) ++ mark_tsc_unstable("TSC halts in idle"); ++ + state->enter = intel_idle; + state->enter_s2idle = intel_idle_s2idle; + } diff --git a/queue-5.10/pfifo_tail_enqueue-drop-new-packet-when-sch-limit-0.patch b/queue-5.10/pfifo_tail_enqueue-drop-new-packet-when-sch-limit-0.patch new file mode 100644 index 0000000000..afcc4d2680 --- /dev/null +++ b/queue-5.10/pfifo_tail_enqueue-drop-new-packet-when-sch-limit-0.patch @@ -0,0 +1,68 @@ +From 647cef20e649c576dff271e018d5d15d998b629d Mon Sep 17 00:00:00 2001 +From: Quang Le +Date: Mon, 3 Feb 2025 16:58:38 -0800 +Subject: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 + +From: Quang Le + +commit 647cef20e649c576dff271e018d5d15d998b629d upstream. + +Expected behaviour: +In case we reach scheduler's limit, pfifo_tail_enqueue() will drop a +packet in scheduler's queue and decrease scheduler's qlen by one. +Then, pfifo_tail_enqueue() enqueue new packet and increase +scheduler's qlen by one. Finally, pfifo_tail_enqueue() return +`NET_XMIT_CN` status code. + +Weird behaviour: +In case we set `sch->limit == 0` and trigger pfifo_tail_enqueue() on a +scheduler that has no packet, the 'drop a packet' step will do nothing. +This means the scheduler's qlen still has value equal 0. +Then, we continue to enqueue new packet and increase scheduler's qlen by +one. In summary, we can leverage pfifo_tail_enqueue() to increase qlen by +one and return `NET_XMIT_CN` status code. + +The problem is: +Let's say we have two qdiscs: Qdisc_A and Qdisc_B. + - Qdisc_A's type must have '->graft()' function to create parent/child relationship. + Let's say Qdisc_A's type is `hfsc`. Enqueue packet to this qdisc will trigger `hfsc_enqueue`. + - Qdisc_B's type is pfifo_head_drop. Enqueue packet to this qdisc will trigger `pfifo_tail_enqueue`. + - Qdisc_B is configured to have `sch->limit == 0`. + - Qdisc_A is configured to route the enqueued's packet to Qdisc_B. + +Enqueue packet through Qdisc_A will lead to: + - hfsc_enqueue(Qdisc_A) -> pfifo_tail_enqueue(Qdisc_B) + - Qdisc_B->q.qlen += 1 + - pfifo_tail_enqueue() return `NET_XMIT_CN` + - hfsc_enqueue() check for `NET_XMIT_SUCCESS` and see `NET_XMIT_CN` => hfsc_enqueue() don't increase qlen of Qdisc_A. + +The whole process lead to a situation where Qdisc_A->q.qlen == 0 and Qdisc_B->q.qlen == 1. +Replace 'hfsc' with other type (for example: 'drr') still lead to the same problem. +This violate the design where parent's qlen should equal to the sum of its childrens'qlen. + +Bug impact: This issue can be used for user->kernel privilege escalation when it is reachable. + +Fixes: 57dbb2d83d10 ("sched: add head drop fifo queue") +Reported-by: Quang Le +Signed-off-by: Quang Le +Signed-off-by: Cong Wang +Link: https://patch.msgid.link/20250204005841.223511-2-xiyou.wangcong@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman +--- + net/sched/sch_fifo.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/sched/sch_fifo.c ++++ b/net/sched/sch_fifo.c +@@ -39,6 +39,9 @@ static int pfifo_tail_enqueue(struct sk_ + { + unsigned int prev_backlog; + ++ if (unlikely(READ_ONCE(sch->limit) == 0)) ++ return qdisc_drop(skb, sch, to_free); ++ + if (likely(sch->q.qlen < sch->limit)) + return qdisc_enqueue_tail(skb, sch); + diff --git a/queue-5.10/series b/queue-5.10/series index 3169a0ecb9..bfef66b3f5 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -389,3 +389,5 @@ phy-exynos5-usbdrd-fix-mpll_multiplier-and-ssc_refclksel-masks-in-refclk.patch mptcp-always-handle-address-removal-under-msk-socket-lock.patch vmlinux.lds-ensure-that-const-vars-with-relocations-are-mapped-r-o.patch sched-core-prevent-rescheduling-when-interrupts-are-disabled.patch +intel_idle-handle-older-cpus-which-stop-the-tsc-in-deeper-c-states-correctly.patch +pfifo_tail_enqueue-drop-new-packet-when-sch-limit-0.patch