From: Greg Kroah-Hartman Date: Thu, 11 Apr 2024 09:23:24 +0000 (+0200) Subject: 6.8-stable patches X-Git-Tag: v4.19.312~23 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b52b1dffc49964b70fb4439a225db252457e430d;p=thirdparty%2Fkernel%2Fstable-queue.git 6.8-stable patches added patches: bluetooth-btintel-fixe-build-regression.patch net-mpls-error-out-if-inner-headers-are-not-set.patch revert-drm-amd-amdgpu-fix-potential-ioremap-memory-leaks-in-amdgpu_device_init.patch vmci-fix-possible-memcpy-run-time-warning-in-vmci_datagram_invoke_guest_handler.patch x86-vdso-fix-rethunk-patching-for-vdso-image-x32.o-too.patch --- diff --git a/queue-6.8/bluetooth-btintel-fixe-build-regression.patch b/queue-6.8/bluetooth-btintel-fixe-build-regression.patch new file mode 100644 index 00000000000..07ade29d2be --- /dev/null +++ b/queue-6.8/bluetooth-btintel-fixe-build-regression.patch @@ -0,0 +1,39 @@ +From 6e62ebfb49eb65bdcbfc5797db55e0ce7f79c3dd Mon Sep 17 00:00:00 2001 +From: Luiz Augusto von Dentz +Date: Fri, 23 Feb 2024 12:36:23 -0500 +Subject: Bluetooth: btintel: Fixe build regression + +From: Luiz Augusto von Dentz + +commit 6e62ebfb49eb65bdcbfc5797db55e0ce7f79c3dd upstream. + +This fixes the following build regression: + +drivers-bluetooth-btintel.c-btintel_read_version()-warn: +passing-zero-to-PTR_ERR + +Fixes: b79e04091010 ("Bluetooth: btintel: Fix null ptr deref in btintel_read_version") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bluetooth/btintel.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/bluetooth/btintel.c ++++ b/drivers/bluetooth/btintel.c +@@ -435,13 +435,13 @@ int btintel_read_version(struct hci_dev + struct sk_buff *skb; + + skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_CMD_TIMEOUT); +- if (IS_ERR_OR_NULL(skb)) { ++ if (IS_ERR(skb)) { + bt_dev_err(hdev, "Reading Intel version information failed (%ld)", + PTR_ERR(skb)); + return PTR_ERR(skb); + } + +- if (skb->len != sizeof(*ver)) { ++ if (!skb || skb->len != sizeof(*ver)) { + bt_dev_err(hdev, "Intel version event size mismatch"); + kfree_skb(skb); + return -EILSEQ; diff --git a/queue-6.8/net-mpls-error-out-if-inner-headers-are-not-set.patch b/queue-6.8/net-mpls-error-out-if-inner-headers-are-not-set.patch new file mode 100644 index 00000000000..ed06eb02f4d --- /dev/null +++ b/queue-6.8/net-mpls-error-out-if-inner-headers-are-not-set.patch @@ -0,0 +1,111 @@ +From 025f8ad20f2e3264d11683aa9cbbf0083eefbdcd Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Thu, 22 Feb 2024 15:03:10 +0100 +Subject: net: mpls: error out if inner headers are not set + +From: Florian Westphal + +commit 025f8ad20f2e3264d11683aa9cbbf0083eefbdcd upstream. + +mpls_gso_segment() assumes skb_inner_network_header() returns +a valid result: + + mpls_hlen = skb_inner_network_header(skb) - skb_network_header(skb); + if (unlikely(!mpls_hlen || mpls_hlen % MPLS_HLEN)) + goto out; + if (unlikely(!pskb_may_pull(skb, mpls_hlen))) + +With syzbot reproducer, skb_inner_network_header() yields 0, +skb_network_header() returns 108, so this will +"pskb_may_pull(skb, -108)))" which triggers a newly added +DEBUG_NET_WARN_ON_ONCE() check: + +------------[ cut here ]------------ +WARNING: CPU: 0 PID: 5068 at include/linux/skbuff.h:2723 pskb_may_pull_reason include/linux/skbuff.h:2723 [inline] +WARNING: CPU: 0 PID: 5068 at include/linux/skbuff.h:2723 pskb_may_pull include/linux/skbuff.h:2739 [inline] +WARNING: CPU: 0 PID: 5068 at include/linux/skbuff.h:2723 mpls_gso_segment+0x773/0xaa0 net/mpls/mpls_gso.c:34 +[..] + skb_mac_gso_segment+0x383/0x740 net/core/gso.c:53 + nsh_gso_segment+0x40a/0xad0 net/nsh/nsh.c:108 + skb_mac_gso_segment+0x383/0x740 net/core/gso.c:53 + __skb_gso_segment+0x324/0x4c0 net/core/gso.c:124 + skb_gso_segment include/net/gso.h:83 [inline] + [..] + sch_direct_xmit+0x11a/0x5f0 net/sched/sch_generic.c:327 + [..] + packet_sendmsg+0x46a9/0x6130 net/packet/af_packet.c:3113 + [..] + +First iteration of this patch made mpls_hlen signed and changed +test to error out to "mpls_hlen <= 0 || ..". + +Eric Dumazet said: + > I was thinking about adding a debug check in skb_inner_network_header() + > if inner_network_header is zero (that would mean it is not 'set' yet), + > but this would trigger even after your patch. + +So add new skb_inner_network_header_was_set() helper and use that. + +The syzbot reproducer injects data via packet socket. The skb that gets +allocated and passed down the stack has ->protocol set to NSH (0x894f) +and gso_type set to SKB_GSO_UDP | SKB_GSO_DODGY. + +This gets passed to skb_mac_gso_segment(), which sees NSH as ptype to +find a callback for. nsh_gso_segment() retrieves next type: + + proto = tun_p_to_eth_p(nsh_hdr(skb)->np); + +... which is MPLS (TUN_P_MPLS_UC). It updates skb->protocol and then +calls mpls_gso_segment(). Inner offsets are all 0, so mpls_gso_segment() +ends up with a negative header size. + +In case more callers rely on silent handling of such large may_pull values +we could also 'legalize' this behaviour, either replacing the debug check +with (len > INT_MAX) test or removing it and instead adding a comment +before existing + + if (unlikely(len > skb->len)) + return SKB_DROP_REASON_PKT_TOO_SMALL; + +test in pskb_may_pull_reason(), saying that this check also implicitly +takes care of callers that miscompute header sizes. + +Cc: Simon Horman +Fixes: 219eee9c0d16 ("net: skbuff: add overflow debug check to pull/push helpers") +Reported-by: syzbot+99d15fcdb0132a1e1a82@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/netdev/00000000000043b1310611e388aa@google.com/raw +Signed-off-by: Florian Westphal +Link: https://lore.kernel.org/r/20240222140321.14080-1-fw@strlen.de +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/skbuff.h | 5 +++++ + net/mpls/mpls_gso.c | 3 +++ + 2 files changed, 8 insertions(+) + +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -2847,6 +2847,11 @@ static inline void skb_set_inner_network + skb->inner_network_header += offset; + } + ++static inline bool skb_inner_network_header_was_set(const struct sk_buff *skb) ++{ ++ return skb->inner_network_header > 0; ++} ++ + static inline unsigned char *skb_inner_mac_header(const struct sk_buff *skb) + { + return skb->head + skb->inner_mac_header; +--- a/net/mpls/mpls_gso.c ++++ b/net/mpls/mpls_gso.c +@@ -27,6 +27,9 @@ static struct sk_buff *mpls_gso_segment( + __be16 mpls_protocol; + unsigned int mpls_hlen; + ++ if (!skb_inner_network_header_was_set(skb)) ++ goto out; ++ + skb_reset_network_header(skb); + mpls_hlen = skb_inner_network_header(skb) - skb_network_header(skb); + if (unlikely(!mpls_hlen || mpls_hlen % MPLS_HLEN)) diff --git a/queue-6.8/revert-drm-amd-amdgpu-fix-potential-ioremap-memory-leaks-in-amdgpu_device_init.patch b/queue-6.8/revert-drm-amd-amdgpu-fix-potential-ioremap-memory-leaks-in-amdgpu_device_init.patch new file mode 100644 index 00000000000..6bd98ce57ae --- /dev/null +++ b/queue-6.8/revert-drm-amd-amdgpu-fix-potential-ioremap-memory-leaks-in-amdgpu_device_init.patch @@ -0,0 +1,91 @@ +From 03c6284df179de3a4a6e0684764b1c71d2a405e2 Mon Sep 17 00:00:00 2001 +From: Ma Jun +Date: Tue, 19 Mar 2024 15:24:03 +0800 +Subject: Revert "drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init()" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ma Jun + +commit 03c6284df179de3a4a6e0684764b1c71d2a405e2 upstream. + +This patch causes the following iounmap erorr and calltrace +iounmap: bad address 00000000d0b3631f + +The original patch was unjustified because amdgpu_device_fini_sw() will +always cleanup the rmmio mapping. + +This reverts commit eb4f139888f636614dab3bcce97ff61cefc4b3a7. + +Signed-off-by: Ma Jun +Suggested-by: Christian König +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 16 ++++++---------- + 1 file changed, 6 insertions(+), 10 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index 1e9454e6e4cb..5dc24c971b41 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -4040,10 +4040,8 @@ int amdgpu_device_init(struct amdgpu_device *adev, + * early on during init and before calling to RREG32. + */ + adev->reset_domain = amdgpu_reset_create_reset_domain(SINGLE_DEVICE, "amdgpu-reset-dev"); +- if (!adev->reset_domain) { +- r = -ENOMEM; +- goto unmap_memory; +- } ++ if (!adev->reset_domain) ++ return -ENOMEM; + + /* detect hw virtualization here */ + amdgpu_detect_virtualization(adev); +@@ -4053,7 +4051,7 @@ int amdgpu_device_init(struct amdgpu_device *adev, + r = amdgpu_device_get_job_timeout_settings(adev); + if (r) { + dev_err(adev->dev, "invalid lockup_timeout parameter syntax\n"); +- goto unmap_memory; ++ return r; + } + + amdgpu_device_set_mcbp(adev); +@@ -4061,12 +4059,12 @@ int amdgpu_device_init(struct amdgpu_device *adev, + /* early init functions */ + r = amdgpu_device_ip_early_init(adev); + if (r) +- goto unmap_memory; ++ return r; + + /* Get rid of things like offb */ + r = drm_aperture_remove_conflicting_pci_framebuffers(adev->pdev, &amdgpu_kms_driver); + if (r) +- goto unmap_memory; ++ return r; + + /* Enable TMZ based on IP_VERSION */ + amdgpu_gmc_tmz_set(adev); +@@ -4076,7 +4074,7 @@ int amdgpu_device_init(struct amdgpu_device *adev, + if (adev->gmc.xgmi.supported) { + r = adev->gfxhub.funcs->get_xgmi_info(adev); + if (r) +- goto unmap_memory; ++ return r; + } + + /* enable PCIE atomic ops */ +@@ -4345,8 +4343,6 @@ int amdgpu_device_init(struct amdgpu_device *adev, + failed: + amdgpu_vf_error_trans_all(adev); + +-unmap_memory: +- iounmap(adev->rmmio); + return r; + } + +-- +2.44.0 + diff --git a/queue-6.8/series b/queue-6.8/series index e8ac3928299..385a58533be 100644 --- a/queue-6.8/series +++ b/queue-6.8/series @@ -136,3 +136,8 @@ randomize_kstack-improve-entropy-diffusion.patch platform-x86-intel-hid-don-t-wake-on-5-button-releas.patch platform-x86-intel-vbtn-update-tablet-mode-switch-at.patch nouveau-fix-devinit-paths-to-only-handle-display-on-.patch +bluetooth-btintel-fixe-build-regression.patch +net-mpls-error-out-if-inner-headers-are-not-set.patch +vmci-fix-possible-memcpy-run-time-warning-in-vmci_datagram_invoke_guest_handler.patch +x86-vdso-fix-rethunk-patching-for-vdso-image-x32.o-too.patch +revert-drm-amd-amdgpu-fix-potential-ioremap-memory-leaks-in-amdgpu_device_init.patch diff --git a/queue-6.8/vmci-fix-possible-memcpy-run-time-warning-in-vmci_datagram_invoke_guest_handler.patch b/queue-6.8/vmci-fix-possible-memcpy-run-time-warning-in-vmci_datagram_invoke_guest_handler.patch new file mode 100644 index 00000000000..a48f3d9e301 --- /dev/null +++ b/queue-6.8/vmci-fix-possible-memcpy-run-time-warning-in-vmci_datagram_invoke_guest_handler.patch @@ -0,0 +1,36 @@ +From e606e4b71798cc1df20e987dde2468e9527bd376 Mon Sep 17 00:00:00 2001 +From: Vasiliy Kovalev +Date: Mon, 19 Feb 2024 13:53:15 +0300 +Subject: VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() + +From: Vasiliy Kovalev + +commit e606e4b71798cc1df20e987dde2468e9527bd376 upstream. + +The changes are similar to those given in the commit 19b070fefd0d +("VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()"). + +Fix filling of the msg and msg_payload in dg_info struct, which prevents a +possible "detected field-spanning write" of memcpy warning that is issued +by the tracking mechanism __fortify_memcpy_chk. + +Signed-off-by: Vasiliy Kovalev +Link: https://lore.kernel.org/r/20240219105315.76955-1-kovalev@altlinux.org +Signed-off-by: Kees Cook +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/vmw_vmci/vmci_datagram.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/misc/vmw_vmci/vmci_datagram.c ++++ b/drivers/misc/vmw_vmci/vmci_datagram.c +@@ -378,7 +378,8 @@ int vmci_datagram_invoke_guest_handler(s + + dg_info->in_dg_host_queue = false; + dg_info->entry = dst_entry; +- memcpy(&dg_info->msg, dg, VMCI_DG_SIZE(dg)); ++ dg_info->msg = *dg; ++ memcpy(&dg_info->msg_payload, dg + 1, dg->payload_size); + + INIT_WORK(&dg_info->work, dg_delayed_dispatch); + schedule_work(&dg_info->work); diff --git a/queue-6.8/x86-vdso-fix-rethunk-patching-for-vdso-image-x32.o-too.patch b/queue-6.8/x86-vdso-fix-rethunk-patching-for-vdso-image-x32.o-too.patch new file mode 100644 index 00000000000..ec1165c3962 --- /dev/null +++ b/queue-6.8/x86-vdso-fix-rethunk-patching-for-vdso-image-x32.o-too.patch @@ -0,0 +1,35 @@ +From 4969d75dd9077e19e175e60f3c5a6c7653252e63 Mon Sep 17 00:00:00 2001 +From: "Borislav Petkov (AMD)" +Date: Tue, 26 Mar 2024 10:47:14 +0100 +Subject: x86/vdso: Fix rethunk patching for vdso-image-x32.o too + +From: Borislav Petkov (AMD) + +commit 4969d75dd9077e19e175e60f3c5a6c7653252e63 upstream. + +In a similar fashion to + + b388e57d4628 ("x86/vdso: Fix rethunk patching for vdso-image-{32,64}.o") + +annotate vdso-image-x32.o too for objtool so that it gets annotated +properly and the unused return thunk warning doesn't fire. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-lkp/202403251454.23df6278-lkp@intel.com +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/r/202403251454.23df6278-lkp@intel.com +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/entry/vdso/Makefile | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/x86/entry/vdso/Makefile ++++ b/arch/x86/entry/vdso/Makefile +@@ -37,6 +37,7 @@ KCSAN_SANITIZE_vma.o := y + + OBJECT_FILES_NON_STANDARD_extable.o := n + OBJECT_FILES_NON_STANDARD_vdso-image-32.o := n ++OBJECT_FILES_NON_STANDARD_vdso-image-x32.o := n + OBJECT_FILES_NON_STANDARD_vdso-image-64.o := n + OBJECT_FILES_NON_STANDARD_vdso32-setup.o := n + OBJECT_FILES_NON_STANDARD_vma.o := n