From: Greg Kroah-Hartman Date: Wed, 5 Mar 2025 14:23:47 +0000 (+0100) Subject: 6.1-stable patches X-Git-Tag: v6.6.81~14 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=980baee4a5ef3c0b82cc8a6ca50fc8022894c1a8;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: intel_idle-handle-older-cpus-which-stop-the-tsc-in-deeper-c-states-correctly.patch media-mtk-vcodec-potential-null-pointer-deference-in-scp.patch mm-memory-use-exception-ip-to-search-exception-tables.patch pfifo_tail_enqueue-drop-new-packet-when-sch-limit-0.patch ptrace-introduce-exception_ip-arch-hook.patch squashfs-check-the-inode-number-is-not-the-invalid-value-of-zero.patch --- diff --git a/queue-6.1/intel_idle-handle-older-cpus-which-stop-the-tsc-in-deeper-c-states-correctly.patch b/queue-6.1/intel_idle-handle-older-cpus-which-stop-the-tsc-in-deeper-c-states-correctly.patch new file mode 100644 index 0000000000..b90a681d20 --- /dev/null +++ b/queue-6.1/intel_idle-handle-older-cpus-which-stop-the-tsc-in-deeper-c-states-correctly.patch @@ -0,0 +1,54 @@ +From c157d351460bcf202970e97e611cb6b54a3dd4a4 Mon Sep 17 00:00:00 2001 +From: Thomas Gleixner +Date: Tue, 25 Feb 2025 23:37:08 +0100 +Subject: intel_idle: Handle older CPUs, which stop the TSC in deeper C states, correctly + +From: Thomas Gleixner + +commit c157d351460bcf202970e97e611cb6b54a3dd4a4 upstream. + +The Intel idle driver is preferred over the ACPI processor idle driver, +but fails to implement the work around for Core2 generation CPUs, where +the TSC stops in C2 and deeper C-states. This causes stalls and boot +delays, when the clocksource watchdog does not catch the unstable TSC +before the CPU goes deep idle for the first time. + +The ACPI driver marks the TSC unstable when it detects that the CPU +supports C2 or deeper and the CPU does not have a non-stop TSC. + +Add the equivivalent work around to the Intel idle driver to cure that. + +Fixes: 18734958e9bf ("intel_idle: Use ACPI _CST for processor models without C-state tables") +Reported-by: Fab Stz +Signed-off-by: Thomas Gleixner +Tested-by: Fab Stz +Cc: All applicable +Closes: https://lore.kernel.org/all/10cf96aa-1276-4bd4-8966-c890377030c3@yahoo.fr +Link: https://patch.msgid.link/87bjupfy7f.ffs@tglx +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman +--- + drivers/idle/intel_idle.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/idle/intel_idle.c ++++ b/drivers/idle/intel_idle.c +@@ -56,6 +56,7 @@ + #include + #include + #include ++#include + #include + + #define INTEL_IDLE_VERSION "0.5.1" +@@ -1583,6 +1584,9 @@ static void __init intel_idle_init_cstat + if (intel_idle_state_needs_timer_stop(state)) + state->flags |= CPUIDLE_FLAG_TIMER_STOP; + ++ if (cx->type > ACPI_STATE_C1 && !boot_cpu_has(X86_FEATURE_NONSTOP_TSC)) ++ mark_tsc_unstable("TSC halts in idle"); ++ + state->enter = intel_idle; + state->enter_s2idle = intel_idle_s2idle; + } diff --git a/queue-6.1/media-mtk-vcodec-potential-null-pointer-deference-in-scp.patch b/queue-6.1/media-mtk-vcodec-potential-null-pointer-deference-in-scp.patch new file mode 100644 index 0000000000..c5325498a8 --- /dev/null +++ b/queue-6.1/media-mtk-vcodec-potential-null-pointer-deference-in-scp.patch @@ -0,0 +1,33 @@ +From 53dbe08504442dc7ba4865c09b3bbf5fe849681b Mon Sep 17 00:00:00 2001 +From: Fullway Wang +Date: Thu, 18 Jan 2024 02:35:06 +0000 +Subject: media: mtk-vcodec: potential null pointer deference in SCP + +From: Fullway Wang + +commit 53dbe08504442dc7ba4865c09b3bbf5fe849681b upstream. + +The return value of devm_kzalloc() needs to be checked to avoid +NULL pointer deference. This is similar to CVE-2022-3113. + +Link: https://lore.kernel.org/linux-media/PH7PR20MB5925094DAE3FD750C7E39E01BF712@PH7PR20MB5925.namprd20.prod.outlook.com +Signed-off-by: Fullway Wang +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Jianqi Ren +Signed-off-by: He Zhe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/mediatek/vcodec/mtk_vcodec_fw_scp.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_fw_scp.c ++++ b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_fw_scp.c +@@ -65,6 +65,8 @@ struct mtk_vcodec_fw *mtk_vcodec_fw_scp_ + } + + fw = devm_kzalloc(&dev->plat_dev->dev, sizeof(*fw), GFP_KERNEL); ++ if (!fw) ++ return ERR_PTR(-ENOMEM); + fw->type = SCP; + fw->ops = &mtk_vcodec_rproc_msg; + fw->scp = scp; diff --git a/queue-6.1/mm-memory-use-exception-ip-to-search-exception-tables.patch b/queue-6.1/mm-memory-use-exception-ip-to-search-exception-tables.patch new file mode 100644 index 0000000000..a40ab7bb82 --- /dev/null +++ b/queue-6.1/mm-memory-use-exception-ip-to-search-exception-tables.patch @@ -0,0 +1,47 @@ +From 8fa5070833886268e4fb646daaca99f725b378e9 Mon Sep 17 00:00:00 2001 +From: Jiaxun Yang +Date: Fri, 2 Feb 2024 12:30:28 +0000 +Subject: mm/memory: Use exception ip to search exception tables + +From: Jiaxun Yang + +commit 8fa5070833886268e4fb646daaca99f725b378e9 upstream. + +On architectures with delay slot, instruction_pointer() may differ +from where exception was triggered. + +Use exception_ip we just introduced to search exception tables to +get rid of the problem. + +Fixes: 4bce37a68ff8 ("mips/mm: Convert to using lock_mm_and_find_vma()") +Reported-by: Xi Ruoyao +Link: https://lore.kernel.org/r/75e9fd7b08562ad9b456a5bdaacb7cc220311cc9.camel@xry111.site/ +Suggested-by: Linus Torvalds +Signed-off-by: Jiaxun Yang +Signed-off-by: Thomas Bogendoerfer +Cc: Salvatore Bonaccorso +Signed-off-by: Greg Kroah-Hartman +--- + mm/memory.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -5323,7 +5323,7 @@ static inline bool get_mmap_lock_careful + } + + if (regs && !user_mode(regs)) { +- unsigned long ip = instruction_pointer(regs); ++ unsigned long ip = exception_ip(regs); + if (!search_exception_tables(ip)) + return false; + } +@@ -5348,7 +5348,7 @@ static inline bool upgrade_mmap_lock_car + { + mmap_read_unlock(mm); + if (regs && !user_mode(regs)) { +- unsigned long ip = instruction_pointer(regs); ++ unsigned long ip = exception_ip(regs); + if (!search_exception_tables(ip)) + return false; + } diff --git a/queue-6.1/pfifo_tail_enqueue-drop-new-packet-when-sch-limit-0.patch b/queue-6.1/pfifo_tail_enqueue-drop-new-packet-when-sch-limit-0.patch new file mode 100644 index 0000000000..afcc4d2680 --- /dev/null +++ b/queue-6.1/pfifo_tail_enqueue-drop-new-packet-when-sch-limit-0.patch @@ -0,0 +1,68 @@ +From 647cef20e649c576dff271e018d5d15d998b629d Mon Sep 17 00:00:00 2001 +From: Quang Le +Date: Mon, 3 Feb 2025 16:58:38 -0800 +Subject: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 + +From: Quang Le + +commit 647cef20e649c576dff271e018d5d15d998b629d upstream. + +Expected behaviour: +In case we reach scheduler's limit, pfifo_tail_enqueue() will drop a +packet in scheduler's queue and decrease scheduler's qlen by one. +Then, pfifo_tail_enqueue() enqueue new packet and increase +scheduler's qlen by one. Finally, pfifo_tail_enqueue() return +`NET_XMIT_CN` status code. + +Weird behaviour: +In case we set `sch->limit == 0` and trigger pfifo_tail_enqueue() on a +scheduler that has no packet, the 'drop a packet' step will do nothing. +This means the scheduler's qlen still has value equal 0. +Then, we continue to enqueue new packet and increase scheduler's qlen by +one. In summary, we can leverage pfifo_tail_enqueue() to increase qlen by +one and return `NET_XMIT_CN` status code. + +The problem is: +Let's say we have two qdiscs: Qdisc_A and Qdisc_B. + - Qdisc_A's type must have '->graft()' function to create parent/child relationship. + Let's say Qdisc_A's type is `hfsc`. Enqueue packet to this qdisc will trigger `hfsc_enqueue`. + - Qdisc_B's type is pfifo_head_drop. Enqueue packet to this qdisc will trigger `pfifo_tail_enqueue`. + - Qdisc_B is configured to have `sch->limit == 0`. + - Qdisc_A is configured to route the enqueued's packet to Qdisc_B. + +Enqueue packet through Qdisc_A will lead to: + - hfsc_enqueue(Qdisc_A) -> pfifo_tail_enqueue(Qdisc_B) + - Qdisc_B->q.qlen += 1 + - pfifo_tail_enqueue() return `NET_XMIT_CN` + - hfsc_enqueue() check for `NET_XMIT_SUCCESS` and see `NET_XMIT_CN` => hfsc_enqueue() don't increase qlen of Qdisc_A. + +The whole process lead to a situation where Qdisc_A->q.qlen == 0 and Qdisc_B->q.qlen == 1. +Replace 'hfsc' with other type (for example: 'drr') still lead to the same problem. +This violate the design where parent's qlen should equal to the sum of its childrens'qlen. + +Bug impact: This issue can be used for user->kernel privilege escalation when it is reachable. + +Fixes: 57dbb2d83d10 ("sched: add head drop fifo queue") +Reported-by: Quang Le +Signed-off-by: Quang Le +Signed-off-by: Cong Wang +Link: https://patch.msgid.link/20250204005841.223511-2-xiyou.wangcong@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman +--- + net/sched/sch_fifo.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/sched/sch_fifo.c ++++ b/net/sched/sch_fifo.c +@@ -39,6 +39,9 @@ static int pfifo_tail_enqueue(struct sk_ + { + unsigned int prev_backlog; + ++ if (unlikely(READ_ONCE(sch->limit) == 0)) ++ return qdisc_drop(skb, sch, to_free); ++ + if (likely(sch->q.qlen < sch->limit)) + return qdisc_enqueue_tail(skb, sch); + diff --git a/queue-6.1/ptrace-introduce-exception_ip-arch-hook.patch b/queue-6.1/ptrace-introduce-exception_ip-arch-hook.patch new file mode 100644 index 0000000000..7d8d4e8b5a --- /dev/null +++ b/queue-6.1/ptrace-introduce-exception_ip-arch-hook.patch @@ -0,0 +1,74 @@ +From 11ba1728be3edb6928791f4c622f154ebe228ae6 Mon Sep 17 00:00:00 2001 +From: Jiaxun Yang +Date: Fri, 2 Feb 2024 12:30:26 +0000 +Subject: ptrace: Introduce exception_ip arch hook + +From: Jiaxun Yang + +commit 11ba1728be3edb6928791f4c622f154ebe228ae6 upstream. + +On architectures with delay slot, architecture level instruction +pointer (or program counter) in pt_regs may differ from where +exception was triggered. + +Introduce exception_ip hook to invoke architecture code and determine +actual instruction pointer to the exception. + +Link: https://lore.kernel.org/lkml/00d1b813-c55f-4365-8d81-d70258e10b16@app.fastmail.com/ +Signed-off-by: Jiaxun Yang +Signed-off-by: Thomas Bogendoerfer +Cc: Salvatore Bonaccorso +Signed-off-by: Greg Kroah-Hartman +--- + arch/mips/include/asm/ptrace.h | 2 ++ + arch/mips/kernel/ptrace.c | 7 +++++++ + include/linux/ptrace.h | 4 ++++ + 3 files changed, 13 insertions(+) + +--- a/arch/mips/include/asm/ptrace.h ++++ b/arch/mips/include/asm/ptrace.h +@@ -155,6 +155,8 @@ static inline long regs_return_value(str + } + + #define instruction_pointer(regs) ((regs)->cp0_epc) ++extern unsigned long exception_ip(struct pt_regs *regs); ++#define exception_ip(regs) exception_ip(regs) + #define profile_pc(regs) instruction_pointer(regs) + + extern asmlinkage long syscall_trace_enter(struct pt_regs *regs); +--- a/arch/mips/kernel/ptrace.c ++++ b/arch/mips/kernel/ptrace.c +@@ -31,6 +31,7 @@ + #include + #include + ++#include + #include + #include + #include +@@ -48,6 +49,12 @@ + #define CREATE_TRACE_POINTS + #include + ++unsigned long exception_ip(struct pt_regs *regs) ++{ ++ return exception_epc(regs); ++} ++EXPORT_SYMBOL(exception_ip); ++ + /* + * Called by kernel/ptrace.c when detaching.. + * +--- a/include/linux/ptrace.h ++++ b/include/linux/ptrace.h +@@ -402,6 +402,10 @@ static inline void user_single_step_repo + #define current_user_stack_pointer() user_stack_pointer(current_pt_regs()) + #endif + ++#ifndef exception_ip ++#define exception_ip(x) instruction_pointer(x) ++#endif ++ + extern int task_current_syscall(struct task_struct *target, struct syscall_info *info); + + extern void sigaction_compat_abi(struct k_sigaction *act, struct k_sigaction *oact); diff --git a/queue-6.1/series b/queue-6.1/series index 97253faf08..11d814cbe0 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -168,3 +168,9 @@ sched-core-prevent-rescheduling-when-interrupts-are-disabled.patch riscv-futex-sign-extend-compare-value-in-atomic-cmpxchg.patch drm-amd-display-fixed-integer-types-and-null-check-locations.patch amdgpu-pm-legacy-fix-suspend-resume-issues.patch +intel_idle-handle-older-cpus-which-stop-the-tsc-in-deeper-c-states-correctly.patch +ptrace-introduce-exception_ip-arch-hook.patch +mm-memory-use-exception-ip-to-search-exception-tables.patch +squashfs-check-the-inode-number-is-not-the-invalid-value-of-zero.patch +pfifo_tail_enqueue-drop-new-packet-when-sch-limit-0.patch +media-mtk-vcodec-potential-null-pointer-deference-in-scp.patch diff --git a/queue-6.1/squashfs-check-the-inode-number-is-not-the-invalid-value-of-zero.patch b/queue-6.1/squashfs-check-the-inode-number-is-not-the-invalid-value-of-zero.patch new file mode 100644 index 0000000000..c37e4b0461 --- /dev/null +++ b/queue-6.1/squashfs-check-the-inode-number-is-not-the-invalid-value-of-zero.patch @@ -0,0 +1,69 @@ +From 9253c54e01b6505d348afbc02abaa4d9f8a01395 Mon Sep 17 00:00:00 2001 +From: Phillip Lougher +Date: Mon, 8 Apr 2024 23:02:06 +0100 +Subject: Squashfs: check the inode number is not the invalid value of zero + +From: Phillip Lougher + +commit 9253c54e01b6505d348afbc02abaa4d9f8a01395 upstream. + +Syskiller has produced an out of bounds access in fill_meta_index(). + +That out of bounds access is ultimately caused because the inode +has an inode number with the invalid value of zero, which was not checked. + +The reason this causes the out of bounds access is due to following +sequence of events: + +1. Fill_meta_index() is called to allocate (via empty_meta_index()) + and fill a metadata index. It however suffers a data read error + and aborts, invalidating the newly returned empty metadata index. + It does this by setting the inode number of the index to zero, + which means unused (zero is not a valid inode number). + +2. When fill_meta_index() is subsequently called again on another + read operation, locate_meta_index() returns the previous index + because it matches the inode number of 0. Because this index + has been returned it is expected to have been filled, and because + it hasn't been, an out of bounds access is performed. + +This patch adds a sanity check which checks that the inode number +is not zero when the inode is created and returns -EINVAL if it is. + +[phillip@squashfs.org.uk: whitespace fix] + Link: https://lkml.kernel.org/r/20240409204723.446925-1-phillip@squashfs.org.uk +Link: https://lkml.kernel.org/r/20240408220206.435788-1-phillip@squashfs.org.uk +Signed-off-by: Phillip Lougher +Reported-by: "Ubisectech Sirius" +Closes: https://lore.kernel.org/lkml/87f5c007-b8a5-41ae-8b57-431e924c5915.bugreport@ubisectech.com/ +Cc: Christian Brauner +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Xiangyu Chen +Signed-off-by: He Zhe +Signed-off-by: Greg Kroah-Hartman +--- + fs/squashfs/inode.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/fs/squashfs/inode.c ++++ b/fs/squashfs/inode.c +@@ -48,6 +48,10 @@ static int squashfs_new_inode(struct sup + gid_t i_gid; + int err; + ++ inode->i_ino = le32_to_cpu(sqsh_ino->inode_number); ++ if (inode->i_ino == 0) ++ return -EINVAL; ++ + err = squashfs_get_id(sb, le16_to_cpu(sqsh_ino->uid), &i_uid); + if (err) + return err; +@@ -58,7 +62,6 @@ static int squashfs_new_inode(struct sup + + i_uid_write(inode, i_uid); + i_gid_write(inode, i_gid); +- inode->i_ino = le32_to_cpu(sqsh_ino->inode_number); + inode->i_mtime.tv_sec = le32_to_cpu(sqsh_ino->mtime); + inode->i_atime.tv_sec = inode->i_mtime.tv_sec; + inode->i_ctime.tv_sec = inode->i_mtime.tv_sec;