From: Sasha Levin Date: Sun, 13 Oct 2024 20:03:31 +0000 (-0400) Subject: Fixes for 5.15 X-Git-Tag: v5.10.227~58 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=8a6fb9d5f975351530377c0fbe4e2d323fd7efbf;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.15 Signed-off-by: Sasha Levin --- diff --git a/queue-5.15/hwmon-adm9240-add-missing-dependency-on-regmap_i2c.patch b/queue-5.15/hwmon-adm9240-add-missing-dependency-on-regmap_i2c.patch new file mode 100644 index 00000000000..0ff8acd8aed --- /dev/null +++ b/queue-5.15/hwmon-adm9240-add-missing-dependency-on-regmap_i2c.patch @@ -0,0 +1,36 @@ +From 9b709072c6d5c3acaffa2dd4fa3edb2df76d6168 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Oct 2024 03:08:08 +0200 +Subject: hwmon: (adm9240) Add missing dependency on REGMAP_I2C + +From: Javier Carrasco + +[ Upstream commit 14849a2ec175bb8a2280ce20efe002bb19f1e274 ] + +This driver requires REGMAP_I2C to be selected in order to get access to +regmap_config and devm_regmap_init_i2c. Add the missing dependency. + +Fixes: df885d912f67 ("hwmon: (adm9240) Convert to regmap") +Signed-off-by: Javier Carrasco +Message-ID: <20241002-hwmon-select-regmap-v1-1-548d03268934@gmail.com> +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig +index 7bc81da4ee2ef..f73a4ae2022e9 100644 +--- a/drivers/hwmon/Kconfig ++++ b/drivers/hwmon/Kconfig +@@ -165,6 +165,7 @@ config SENSORS_ADM9240 + tristate "Analog Devices ADM9240 and compatibles" + depends on I2C + select HWMON_VID ++ select REGMAP_I2C + help + If you say yes here you get support for Analog Devices ADM9240, + Dallas DS1780, National Semiconductor LM81 sensor chips. +-- +2.43.0 + diff --git a/queue-5.15/hwmon-adt7470-add-missing-dependency-on-regmap_i2c.patch b/queue-5.15/hwmon-adt7470-add-missing-dependency-on-regmap_i2c.patch new file mode 100644 index 00000000000..5d9ad742b69 --- /dev/null +++ b/queue-5.15/hwmon-adt7470-add-missing-dependency-on-regmap_i2c.patch @@ -0,0 +1,36 @@ +From b33f377893da7abc28f9326e3b288db5d2b878d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Oct 2024 03:08:09 +0200 +Subject: hwmon: (adt7470) Add missing dependency on REGMAP_I2C + +From: Javier Carrasco + +[ Upstream commit b6abcc19566509ab4812bd5ae5df46515d0c1d70 ] + +This driver requires REGMAP_I2C to be selected in order to get access to +regmap_config and devm_regmap_init_i2c. Add the missing dependency. + +Fixes: ef67959c4253 ("hwmon: (adt7470) Convert to use regmap") +Signed-off-by: Javier Carrasco +Message-ID: <20241002-hwmon-select-regmap-v1-2-548d03268934@gmail.com> +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig +index f73a4ae2022e9..d651564b10447 100644 +--- a/drivers/hwmon/Kconfig ++++ b/drivers/hwmon/Kconfig +@@ -226,6 +226,7 @@ config SENSORS_ADT7462 + config SENSORS_ADT7470 + tristate "Analog Devices ADT7470" + depends on I2C ++ select REGMAP_I2C + help + If you say yes here you get support for the Analog Devices + ADT7470 temperature monitoring chips. +-- +2.43.0 + diff --git a/queue-5.15/hwmon-tmp513-add-missing-dependency-on-regmap_i2c.patch b/queue-5.15/hwmon-tmp513-add-missing-dependency-on-regmap_i2c.patch new file mode 100644 index 00000000000..e3716365d6f --- /dev/null +++ b/queue-5.15/hwmon-tmp513-add-missing-dependency-on-regmap_i2c.patch @@ -0,0 +1,45 @@ +From bb0b95a084016307c82f5b55586d9254fd935bc4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Oct 2024 11:37:15 -0700 +Subject: hwmon: (tmp513) Add missing dependency on REGMAP_I2C + +From: Guenter Roeck + +[ Upstream commit 193bc02c664999581a1f38c152f379fce91afc0c ] + +0-day reports: + +drivers/hwmon/tmp513.c:162:21: error: + variable 'tmp51x_regmap_config' has initializer but incomplete type +162 | static const struct regmap_config tmp51x_regmap_config = { + | ^ + +struct regmap_config is only available if REGMAP is enabled. +Add the missing Kconfig dependency to fix the problem. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202410020246.2cTDDx0X-lkp@intel.com/ +Fixes: 59dfa75e5d82 ("hwmon: Add driver for Texas Instruments TMP512/513 sensor chips.") +Cc: Eric Tremblay +Reviewed-by: Javier Carrasco +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig +index 17ba1d9ff0751..7bc81da4ee2ef 100644 +--- a/drivers/hwmon/Kconfig ++++ b/drivers/hwmon/Kconfig +@@ -1949,6 +1949,7 @@ config SENSORS_TMP421 + config SENSORS_TMP513 + tristate "Texas Instruments TMP513 and compatibles" + depends on I2C ++ select REGMAP_I2C + help + If you say yes here you get support for Texas Instruments TMP512, + and TMP513 temperature and power supply sensor chips. +-- +2.43.0 + diff --git a/queue-5.15/rdma-hns-fix-uaf-for-cq-async-event.patch b/queue-5.15/rdma-hns-fix-uaf-for-cq-async-event.patch new file mode 100644 index 00000000000..796e15bc8c2 --- /dev/null +++ b/queue-5.15/rdma-hns-fix-uaf-for-cq-async-event.patch @@ -0,0 +1,93 @@ +From 2bf333414f62be0f577ab1b0ed708332c6a1500c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Oct 2024 18:22:15 +0800 +Subject: RDMA/hns: Fix UAF for cq async event + +From: Chengchang Tang + +[ Upstream commit a942ec2745ca864cd8512142100e4027dc306a42 ] + +The refcount of CQ is not protected by locks. When CQ asynchronous +events and CQ destruction are concurrent, CQ may have been released, +which will cause UAF. + +Use the xa_lock() to protect the CQ refcount. + +Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver") +Signed-off-by: Chengchang Tang +Signed-off-by: Junxian Huang +Link: https://lore.kernel.org/r/20240412091616.370789-6-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Haixiao Yan +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_cq.c | 25 +++++++++++++------------ + 1 file changed, 13 insertions(+), 12 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_cq.c b/drivers/infiniband/hw/hns/hns_roce_cq.c +index d763f097599ff..5ecd4075de937 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_cq.c ++++ b/drivers/infiniband/hw/hns/hns_roce_cq.c +@@ -125,7 +125,7 @@ static int alloc_cqc(struct hns_roce_dev *hr_dev, struct hns_roce_cq *hr_cq) + goto err_out; + } + +- ret = xa_err(xa_store(&cq_table->array, hr_cq->cqn, hr_cq, GFP_KERNEL)); ++ ret = xa_err(xa_store_irq(&cq_table->array, hr_cq->cqn, hr_cq, GFP_KERNEL)); + if (ret) { + ibdev_err(ibdev, "failed to xa_store CQ, ret = %d.\n", ret); + goto err_put; +@@ -160,8 +160,7 @@ static int alloc_cqc(struct hns_roce_dev *hr_dev, struct hns_roce_cq *hr_cq) + return 0; + + err_xa: +- xa_erase(&cq_table->array, hr_cq->cqn); +- ++ xa_erase_irq(&cq_table->array, hr_cq->cqn); + err_put: + hns_roce_table_put(hr_dev, &cq_table->table, hr_cq->cqn); + +@@ -182,7 +181,7 @@ static void free_cqc(struct hns_roce_dev *hr_dev, struct hns_roce_cq *hr_cq) + dev_err(dev, "DESTROY_CQ failed (%d) for CQN %06lx\n", ret, + hr_cq->cqn); + +- xa_erase(&cq_table->array, hr_cq->cqn); ++ xa_erase_irq(&cq_table->array, hr_cq->cqn); + + /* Waiting interrupt process procedure carried out */ + synchronize_irq(hr_dev->eq_table.eq[hr_cq->vector].irq); +@@ -478,13 +477,6 @@ void hns_roce_cq_event(struct hns_roce_dev *hr_dev, u32 cqn, int event_type) + struct ib_event event; + struct ib_cq *ibcq; + +- hr_cq = xa_load(&hr_dev->cq_table.array, +- cqn & (hr_dev->caps.num_cqs - 1)); +- if (!hr_cq) { +- dev_warn(dev, "Async event for bogus CQ 0x%06x\n", cqn); +- return; +- } +- + if (event_type != HNS_ROCE_EVENT_TYPE_CQ_ID_INVALID && + event_type != HNS_ROCE_EVENT_TYPE_CQ_ACCESS_ERROR && + event_type != HNS_ROCE_EVENT_TYPE_CQ_OVERFLOW) { +@@ -493,7 +485,16 @@ void hns_roce_cq_event(struct hns_roce_dev *hr_dev, u32 cqn, int event_type) + return; + } + +- refcount_inc(&hr_cq->refcount); ++ xa_lock(&hr_dev->cq_table.array); ++ hr_cq = xa_load(&hr_dev->cq_table.array, ++ cqn & (hr_dev->caps.num_cqs - 1)); ++ if (hr_cq) ++ refcount_inc(&hr_cq->refcount); ++ xa_unlock(&hr_dev->cq_table.array); ++ if (!hr_cq) { ++ dev_warn(dev, "async event for bogus CQ 0x%06x\n", cqn); ++ return; ++ } + + ibcq = &hr_cq->ib_cq; + if (ibcq->event_handler) { +-- +2.43.0 + diff --git a/queue-5.15/series b/queue-5.15/series index 966fc343ed2..f70b8d19238 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -663,3 +663,8 @@ rtnetlink-add-bulk-registration-helpers-for-rtnetlin.patch mctp-handle-error-of-rtnl_register_module.patch ppp-fix-ppp_async_encode-illegal-access.patch slip-make-slhc_remember-more-robust-against-maliciou.patch +rdma-hns-fix-uaf-for-cq-async-event.patch +x86-fpu-avoid-writing-lbr-bit-to-ia32_xss-unless-sup.patch +hwmon-tmp513-add-missing-dependency-on-regmap_i2c.patch +hwmon-adm9240-add-missing-dependency-on-regmap_i2c.patch +hwmon-adt7470-add-missing-dependency-on-regmap_i2c.patch diff --git a/queue-5.15/x86-fpu-avoid-writing-lbr-bit-to-ia32_xss-unless-sup.patch b/queue-5.15/x86-fpu-avoid-writing-lbr-bit-to-ia32_xss-unless-sup.patch new file mode 100644 index 00000000000..0e629a3e5b9 --- /dev/null +++ b/queue-5.15/x86-fpu-avoid-writing-lbr-bit-to-ia32_xss-unless-sup.patch @@ -0,0 +1,100 @@ +From c700d1d873fafc82a055f7adc213bc43b48fca40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Oct 2024 16:57:31 -0700 +Subject: x86/fpu: Avoid writing LBR bit to IA32_XSS unless supported + +From: Mitchell Levy + +There are two distinct CPU features related to the use of XSAVES and LBR: +whether LBR is itself supported and whether XSAVES supports LBR. The LBR +subsystem correctly checks both in intel_pmu_arch_lbr_init(), but the +XSTATE subsystem does not. + +The LBR bit is only removed from xfeatures_mask_independent when LBR is not +supported by the CPU, but there is no validation of XSTATE support. +If XSAVES does not support LBR the write to IA32_XSS causes a #GP fault, +leaving the state of IA32_XSS unchanged, i.e. zero. The fault is handled +with a warning and the boot continues. + +Consequently the next XRSTORS which tries to restore supervisor state fails +with #GP because the RFBM has zero for all supervisor features, which does +not match the XCOMP_BV field. + +As XFEATURE_MASK_FPSTATE includes supervisor features setting up the FPU +causes a #GP, which ends up in fpu_reset_from_exception_fixup(). That fails +due to the same problem resulting in recursive #GPs until the kernel runs +out of stack space and double faults. + +Prevent this by storing the supported independent features in +fpu_kernel_cfg during XSTATE initialization and use that cached value for +retrieving the independent feature bits to be written into IA32_XSS. + +[ tglx: Massaged change log ] + +Fixes: f0dccc9da4c0 ("x86/fpu/xstate: Support dynamic supervisor feature for LBR") +Suggested-by: Thomas Gleixner +[ Mitchell Levy: Backport to 5.15, since struct fpu_config is not + introduced until 578971f4e228 and feature masks are not included in + said struct until 1c253ff2287f ] +Signed-off-by: Mitchell Levy +Signed-off-by: Thomas Gleixner +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/all/20240812-xsave-lbr-fix-v3-1-95bac1bf62f4@gmail.com +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/fpu/xstate.h | 5 +++-- + arch/x86/kernel/fpu/xstate.c | 7 +++++++ + 2 files changed, 10 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/include/asm/fpu/xstate.h b/arch/x86/include/asm/fpu/xstate.h +index d91df71f60fb1..3bc08b5313b0b 100644 +--- a/arch/x86/include/asm/fpu/xstate.h ++++ b/arch/x86/include/asm/fpu/xstate.h +@@ -85,6 +85,7 @@ + #endif + + extern u64 xfeatures_mask_all; ++extern u64 xfeatures_mask_indep; + + static inline u64 xfeatures_mask_supervisor(void) + { +@@ -124,9 +125,9 @@ static inline u64 xfeatures_mask_fpstate(void) + static inline u64 xfeatures_mask_independent(void) + { + if (!boot_cpu_has(X86_FEATURE_ARCH_LBR)) +- return XFEATURE_MASK_INDEPENDENT & ~XFEATURE_MASK_LBR; ++ return xfeatures_mask_indep & ~XFEATURE_MASK_LBR; + +- return XFEATURE_MASK_INDEPENDENT; ++ return xfeatures_mask_indep; + } + + extern u64 xstate_fx_sw_bytes[USER_XSTATE_FX_SW_WORDS]; +diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c +index 81891f0fff6f6..3772577462a07 100644 +--- a/arch/x86/kernel/fpu/xstate.c ++++ b/arch/x86/kernel/fpu/xstate.c +@@ -60,6 +60,11 @@ static short xsave_cpuid_features[] __initdata = { + * XSAVE buffer, both supervisor and user xstates. + */ + u64 xfeatures_mask_all __ro_after_init; ++/* ++ * This represents the "independent" xfeatures that are supported by XSAVES, but not managed as part ++ * of the FPU core, such as LBR. ++ */ ++u64 xfeatures_mask_indep __ro_after_init; + EXPORT_SYMBOL_GPL(xfeatures_mask_all); + + static unsigned int xstate_offsets[XFEATURE_MAX] __ro_after_init = +@@ -768,6 +773,8 @@ void __init fpu__init_system_xstate(void) + goto out_disable; + } + ++ xfeatures_mask_indep = xfeatures_mask_all & XFEATURE_MASK_INDEPENDENT; ++ + /* + * Clear XSAVE features that are disabled in the normal CPUID. + */ +-- +2.43.0 +