From: Greg Kroah-Hartman Date: Tue, 22 Jul 2025 09:51:54 +0000 (+0200) Subject: 6.6-stable patches X-Git-Tag: v6.1.147~24 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b195849886c6211d7fe4b2ac4b95338aa98383d2;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: revert-selftests-bpf-adjust-dummy_st_ops_success-to-detect-additional-error.patch revert-selftests-bpf-dummy_st_ops-should-reject-0-for-non-nullable-params.patch --- diff --git a/queue-6.6/revert-selftests-bpf-adjust-dummy_st_ops_success-to-detect-additional-error.patch b/queue-6.6/revert-selftests-bpf-adjust-dummy_st_ops_success-to-detect-additional-error.patch new file mode 100644 index 0000000000..484751cb5d --- /dev/null +++ b/queue-6.6/revert-selftests-bpf-adjust-dummy_st_ops_success-to-detect-additional-error.patch @@ -0,0 +1,105 @@ +From shung-hsi.yu@suse.com Tue Jul 22 11:40:01 2025 +From: Shung-Hsi Yu +Date: Thu, 17 Jul 2025 16:09:24 +0800 +Subject: Revert "selftests/bpf: adjust dummy_st_ops_success to detect additional error" +To: stable@vger.kernel.org +Cc: Eduard Zingerman , Kui-Feng Lee , Shung-Hsi Yu +Message-ID: <20250717080928.221475-2-shung-hsi.yu@suse.com> + +From: Shung-Hsi Yu + +This reverts commit 264451a364dba5ca6cb2878126a9798dfc0b1a06 which is +commit 3b3b84aacb4420226576c9732e7b539ca7b79633 upstream. + +The updated dummy_st_ops test requires commit 1479eaff1f16 ("bpf: mark +bpf_dummy_struct_ops.test_1 parameter as nullable"), which in turn depends on +"Support PTR_MAYBE_NULL for struct_ops arguments" series (see link below), +neither are backported to stable 6.6. + +Without them the kernel simply panics from null pointer dereference half way +through running BPF selftests. + + #68/1 deny_namespace/unpriv_userns_create_no_bpf:OK + #68/2 deny_namespace/userns_create_bpf:OK + #68 deny_namespace:OK + [ 26.829153] BUG: kernel NULL pointer dereference, address: 0000000000000000 + [ 26.831136] #PF: supervisor read access in kernel mode + [ 26.832635] #PF: error_code(0x0000) - not-present page + [ 26.833999] PGD 0 P4D 0 + [ 26.834771] Oops: 0000 [#1] PREEMPT SMP PTI + [ 26.835997] CPU: 2 PID: 119 Comm: test_progs Tainted: G OE 6.6.66-00003-gd80551078e71 #3 + [ 26.838774] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 + [ 26.841152] RIP: 0010:bpf_prog_8ee9cbe7c9b5a50f_test_1+0x17/0x24 + [ 26.842877] Code: 00 00 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc f3 0f 1e fa 0f 1f 44 00 00 66 90 55 48 89 e5 f3 0f 1e fa 48 8b 7f 00 <8b> 47 00 be 5a 00 00 00 89 77 00 c9 c3 cc cc cc cc cc cc cc cc c0 + [ 26.847953] RSP: 0018:ffff9e6b803b7d88 EFLAGS: 00010202 + [ 26.849425] RAX: 0000000000000001 RBX: 0000000000000001 RCX: 2845e103d7dffb60 + [ 26.851483] RDX: 0000000000000000 RSI: 0000000084d09025 RDI: 0000000000000000 + [ 26.853508] RBP: ffff9e6b803b7d88 R08: 0000000000000001 R09: 0000000000000000 + [ 26.855670] R10: 0000000000000000 R11: 0000000000000000 R12: ffff9754c0b5f700 + [ 26.857824] R13: ffff9754c09cc800 R14: ffff9754c0b5f680 R15: ffff9754c0b5f760 + [ 26.859741] FS: 00007f77dee12740(0000) GS:ffff9754fbc80000(0000) knlGS:0000000000000000 + [ 26.862087] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + [ 26.863705] CR2: 0000000000000000 CR3: 00000001020e6003 CR4: 0000000000170ee0 + [ 26.865689] Call Trace: + [ 26.866407] + [ 26.866982] ? __die+0x24/0x70 + [ 26.867774] ? page_fault_oops+0x15b/0x450 + [ 26.868882] ? search_bpf_extables+0xb0/0x160 + [ 26.870076] ? fixup_exception+0x26/0x330 + [ 26.871214] ? exc_page_fault+0x64/0x190 + [ 26.872293] ? asm_exc_page_fault+0x26/0x30 + [ 26.873352] ? bpf_prog_8ee9cbe7c9b5a50f_test_1+0x17/0x24 + [ 26.874705] ? __bpf_prog_enter+0x3f/0xc0 + [ 26.875718] ? bpf_struct_ops_test_run+0x1b8/0x2c0 + [ 26.876942] ? __sys_bpf+0xc4e/0x2c30 + [ 26.877898] ? __x64_sys_bpf+0x20/0x30 + [ 26.878812] ? do_syscall_64+0x37/0x90 + [ 26.879704] ? entry_SYSCALL_64_after_hwframe+0x78/0xe2 + [ 26.880918] + [ 26.881409] Modules linked in: bpf_testmod(OE) [last unloaded: bpf_testmod(OE)] + [ 26.883095] CR2: 0000000000000000 + [ 26.883934] ---[ end trace 0000000000000000 ]--- + [ 26.885099] RIP: 0010:bpf_prog_8ee9cbe7c9b5a50f_test_1+0x17/0x24 + [ 26.886452] Code: 00 00 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc f3 0f 1e fa 0f 1f 44 00 00 66 90 55 48 89 e5 f3 0f 1e fa 48 8b 7f 00 <8b> 47 00 be 5a 00 00 00 89 77 00 c9 c3 cc cc cc cc cc cc cc cc c0 + [ 26.890379] RSP: 0018:ffff9e6b803b7d88 EFLAGS: 00010202 + [ 26.891450] RAX: 0000000000000001 RBX: 0000000000000001 RCX: 2845e103d7dffb60 + [ 26.892779] RDX: 0000000000000000 RSI: 0000000084d09025 RDI: 0000000000000000 + [ 26.894254] RBP: ffff9e6b803b7d88 R08: 0000000000000001 R09: 0000000000000000 + [ 26.895630] R10: 0000000000000000 R11: 0000000000000000 R12: ffff9754c0b5f700 + [ 26.897008] R13: ffff9754c09cc800 R14: ffff9754c0b5f680 R15: ffff9754c0b5f760 + [ 26.898337] FS: 00007f77dee12740(0000) GS:ffff9754fbc80000(0000) knlGS:0000000000000000 + [ 26.899972] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + [ 26.901076] CR2: 0000000000000000 CR3: 00000001020e6003 CR4: 0000000000170ee0 + [ 26.902336] Kernel panic - not syncing: Fatal exception + [ 26.903639] Kernel Offset: 0x36000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) + [ 26.905693] ---[ end Kernel panic - not syncing: Fatal exception ]--- + +Link: https://lore.kernel.org/all/20240209023750.1153905-1-thinker.li@gmail.com/ +Signed-off-by: Shung-Hsi Yu +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/bpf/progs/dummy_st_ops_success.c | 13 ++----------- + 1 file changed, 2 insertions(+), 11 deletions(-) + +--- a/tools/testing/selftests/bpf/progs/dummy_st_ops_success.c ++++ b/tools/testing/selftests/bpf/progs/dummy_st_ops_success.c +@@ -11,17 +11,8 @@ int BPF_PROG(test_1, struct bpf_dummy_op + { + int ret; + +- /* Check that 'state' nullable status is detected correctly. +- * If 'state' argument would be assumed non-null by verifier +- * the code below would be deleted as dead (which it shouldn't). +- * Hide it from the compiler behind 'asm' block to avoid +- * unnecessary optimizations. +- */ +- asm volatile ( +- "if %[state] != 0 goto +2;" +- "r0 = 0xf2f3f4f5;" +- "exit;" +- ::[state]"p"(state)); ++ if (!state) ++ return 0xf2f3f4f5; + + ret = state->val; + state->val = 0x5a; diff --git a/queue-6.6/revert-selftests-bpf-dummy_st_ops-should-reject-0-for-non-nullable-params.patch b/queue-6.6/revert-selftests-bpf-dummy_st_ops-should-reject-0-for-non-nullable-params.patch new file mode 100644 index 0000000000..e0baf4b560 --- /dev/null +++ b/queue-6.6/revert-selftests-bpf-dummy_st_ops-should-reject-0-for-non-nullable-params.patch @@ -0,0 +1,68 @@ +From shung-hsi.yu@suse.com Tue Jul 22 11:40:50 2025 +From: Shung-Hsi Yu +Date: Thu, 17 Jul 2025 16:09:25 +0800 +Subject: Revert "selftests/bpf: dummy_st_ops should reject 0 for non-nullable params" +To: stable@vger.kernel.org +Cc: Eduard Zingerman , Kui-Feng Lee , Shung-Hsi Yu +Message-ID: <20250717080928.221475-3-shung-hsi.yu@suse.com> + +From: Shung-Hsi Yu + +This reverts commit e7d193073a223663612301c659e53795b991ca89 which is +commit 6a2d30d3c5bf9f088dcfd5f3746b04d84f2fab83 upstream. + +The dummy_st_ops/dummy_sleepable_reject_null test requires commit 980ca8ceeae6 +("bpf: check bpf_dummy_struct_ops program params for test runs"), which in turn +depends on "Support PTR_MAYBE_NULL for struct_ops arguments" series (see link +below), neither are backported to stable 6.6. + +Link: https://lore.kernel.org/all/20240209023750.1153905-1-thinker.li@gmail.com/ +Signed-off-by: Shung-Hsi Yu +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/bpf/prog_tests/dummy_st_ops.c | 27 ------------------ + 1 file changed, 27 deletions(-) + +--- a/tools/testing/selftests/bpf/prog_tests/dummy_st_ops.c ++++ b/tools/testing/selftests/bpf/prog_tests/dummy_st_ops.c +@@ -147,31 +147,6 @@ static void test_dummy_sleepable(void) + dummy_st_ops_success__destroy(skel); + } + +-/* dummy_st_ops.test_sleepable() parameter is not marked as nullable, +- * thus bpf_prog_test_run_opts() below should be rejected as it tries +- * to pass NULL for this parameter. +- */ +-static void test_dummy_sleepable_reject_null(void) +-{ +- __u64 args[1] = {0}; +- LIBBPF_OPTS(bpf_test_run_opts, attr, +- .ctx_in = args, +- .ctx_size_in = sizeof(args), +- ); +- struct dummy_st_ops_success *skel; +- int fd, err; +- +- skel = dummy_st_ops_success__open_and_load(); +- if (!ASSERT_OK_PTR(skel, "dummy_st_ops_load")) +- return; +- +- fd = bpf_program__fd(skel->progs.test_sleepable); +- err = bpf_prog_test_run_opts(fd, &attr); +- ASSERT_EQ(err, -EINVAL, "test_run"); +- +- dummy_st_ops_success__destroy(skel); +-} +- + void test_dummy_st_ops(void) + { + if (test__start_subtest("dummy_st_ops_attach")) +@@ -184,8 +159,6 @@ void test_dummy_st_ops(void) + test_dummy_multiple_args(); + if (test__start_subtest("dummy_sleepable")) + test_dummy_sleepable(); +- if (test__start_subtest("dummy_sleepable_reject_null")) +- test_dummy_sleepable_reject_null(); + + RUN_TESTS(dummy_st_ops_fail); + } diff --git a/queue-6.6/series b/queue-6.6/series index 43aaf5ce87..24a0283f9f 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -105,3 +105,5 @@ i2c-omap-handle-omap_i2c_init-errors-in-omap_i2c_probe.patch regulator-pwm-regulator-calculate-the-output-voltage-for-disabled-pwms.patch regulator-pwm-regulator-manage-boot-on-with-disabled-pwm-channels.patch asoc-fsl_sai-force-a-software-reset-when-starting-in-consumer-mode.patch +revert-selftests-bpf-adjust-dummy_st_ops_success-to-detect-additional-error.patch +revert-selftests-bpf-dummy_st_ops-should-reject-0-for-non-nullable-params.patch