From: Sasha Levin Date: Sat, 28 Dec 2024 23:39:30 +0000 (-0500) Subject: Fixes for 5.15 X-Git-Tag: v6.1.123~33 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b68a6c54594e57ee36924e0662c0eff114107b7d;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.15 Signed-off-by: Sasha Levin --- diff --git a/queue-5.15/bpf-check-validity-of-link-type-in-bpf_link_show_fdi.patch b/queue-5.15/bpf-check-validity-of-link-type-in-bpf_link_show_fdi.patch new file mode 100644 index 00000000000..ca7a8e2c3d2 --- /dev/null +++ b/queue-5.15/bpf-check-validity-of-link-type-in-bpf_link_show_fdi.patch @@ -0,0 +1,60 @@ +From ee9f0443b129c3f50d6b792e5160fe4e2647da2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Dec 2024 14:04:35 +0800 +Subject: bpf: Check validity of link->type in bpf_link_show_fdinfo() + +From: Hou Tao + +commit 8421d4c8762bd022cb491f2f0f7019ef51b4f0a7 upstream. + +If a newly-added link type doesn't invoke BPF_LINK_TYPE(), accessing +bpf_link_type_strs[link->type] may result in an out-of-bounds access. + +To spot such missed invocations early in the future, checking the +validity of link->type in bpf_link_show_fdinfo() and emitting a warning +when such invocations are missed. + +Signed-off-by: Hou Tao +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20241024013558.1135167-3-houtao@huaweicloud.com +[ shung-hsi.yu: break up existing seq_printf() call since commit 68b04864ca42 + ("bpf: Create links for BPF struct_ops maps.") is not present ] +Signed-off-by: Shung-Hsi Yu +Signed-off-by: Sasha Levin +--- + kernel/bpf/syscall.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c +index d4b4a47081b5..37aa1e319165 100644 +--- a/kernel/bpf/syscall.c ++++ b/kernel/bpf/syscall.c +@@ -2522,16 +2522,21 @@ static void bpf_link_show_fdinfo(struct seq_file *m, struct file *filp) + { + const struct bpf_link *link = filp->private_data; + const struct bpf_prog *prog = link->prog; ++ enum bpf_link_type type = link->type; + char prog_tag[sizeof(prog->tag) * 2 + 1] = { }; + ++ if (type < ARRAY_SIZE(bpf_link_type_strs) && bpf_link_type_strs[type]) { ++ seq_printf(m, "link_type:\t%s\n", bpf_link_type_strs[type]); ++ } else { ++ WARN_ONCE(1, "missing BPF_LINK_TYPE(...) for link type %u\n", type); ++ seq_printf(m, "link_type:\t<%u>\n", type); ++ } ++ seq_printf(m, "link_id:\t%u\n", link->id); ++ + bin2hex(prog_tag, prog->tag, sizeof(prog->tag)); + seq_printf(m, +- "link_type:\t%s\n" +- "link_id:\t%u\n" + "prog_tag:\t%s\n" + "prog_id:\t%u\n", +- bpf_link_type_strs[link->type], +- link->id, + prog_tag, + prog->aux->id); + if (link->ops->show_fdinfo) +-- +2.39.5 + diff --git a/queue-5.15/mips-probe-toolchain-support-of-msym32.patch b/queue-5.15/mips-probe-toolchain-support-of-msym32.patch new file mode 100644 index 00000000000..24fe2d16b6b --- /dev/null +++ b/queue-5.15/mips-probe-toolchain-support-of-msym32.patch @@ -0,0 +1,38 @@ +From a365084cae349e6fc93d48bb697673b54ddca665 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 14:09:18 +0800 +Subject: MIPS: Probe toolchain support of -msym32 + +From: Jiaxun Yang + +[ Upstream commit 18ca63a2e23c5e170d2d7552b64b1f5ad019cd9b ] + +msym32 is not supported by LLVM toolchain. +Workaround by probe toolchain support of msym32 for KBUILD_SYM32 +feature. + +Link: https://github.com/ClangBuiltLinux/linux/issues/1544 +Signed-off-by: Jiaxun Yang +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: WangYuli +Signed-off-by: Sasha Levin +--- + arch/mips/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/mips/Makefile b/arch/mips/Makefile +index 3830217fab41..37048fbffdb7 100644 +--- a/arch/mips/Makefile ++++ b/arch/mips/Makefile +@@ -275,7 +275,7 @@ drivers-$(CONFIG_PCI) += arch/mips/pci/ + ifdef CONFIG_64BIT + ifndef KBUILD_SYM32 + ifeq ($(shell expr $(load-y) \< 0xffffffff80000000), 0) +- KBUILD_SYM32 = y ++ KBUILD_SYM32 = $(call cc-option-yn, -msym32) + endif + endif + +-- +2.39.5 + diff --git a/queue-5.15/series b/queue-5.15/series index ea560749d8d..5138ce8cf41 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -82,3 +82,6 @@ platform-x86-asus-nb-wmi-ignore-unknown-event-0xcf.patch scsi-mpt3sas-diag-reset-when-doorbell-in-use-bit-is-.patch scsi-storvsc-do-not-flag-maintenance_in-return-of-sr.patch virtio-blk-don-t-keep-queue-frozen-during-system-sus.patch +vmalloc-fix-accounting-with-i915.patch +mips-probe-toolchain-support-of-msym32.patch +bpf-check-validity-of-link-type-in-bpf_link_show_fdi.patch diff --git a/queue-5.15/vmalloc-fix-accounting-with-i915.patch b/queue-5.15/vmalloc-fix-accounting-with-i915.patch new file mode 100644 index 00000000000..95b96049e94 --- /dev/null +++ b/queue-5.15/vmalloc-fix-accounting-with-i915.patch @@ -0,0 +1,51 @@ +From 5409233e1990be3d57f8faeb0fa5570cad12c2d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Dec 2024 20:18:00 +0000 +Subject: vmalloc: fix accounting with i915 + +From: Matthew Wilcox (Oracle) + +[ Upstream commit a2e740e216f5bf49ccb83b6d490c72a340558a43 ] + +If the caller of vmap() specifies VM_MAP_PUT_PAGES (currently only the +i915 driver), we will decrement nr_vmalloc_pages and MEMCG_VMALLOC in +vfree(). These counters are incremented by vmalloc() but not by vmap() so +this will cause an underflow. Check the VM_MAP_PUT_PAGES flag before +decrementing either counter. + +Link: https://lkml.kernel.org/r/20241211202538.168311-1-willy@infradead.org +Fixes: b944afc9d64d ("mm: add a VM_MAP_PUT_PAGES flag for vmap") +Signed-off-by: Matthew Wilcox (Oracle) +Acked-by: Johannes Weiner +Reviewed-by: Shakeel Butt +Reviewed-by: Balbir Singh +Acked-by: Michal Hocko +Cc: Christoph Hellwig +Cc: Muchun Song +Cc: Roman Gushchin +Cc: "Uladzislau Rezki (Sony)" +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Matthew Wilcox (Oracle) +Signed-off-by: Sasha Levin +--- + mm/vmalloc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/mm/vmalloc.c b/mm/vmalloc.c +index cd434f0ec47f..3cb1f59d1b53 100644 +--- a/mm/vmalloc.c ++++ b/mm/vmalloc.c +@@ -2621,7 +2621,8 @@ static void __vunmap(const void *addr, int deallocate_pages) + __free_pages(page, page_order); + cond_resched(); + } +- atomic_long_sub(area->nr_pages, &nr_vmalloc_pages); ++ if (!(area->flags & VM_MAP_PUT_PAGES)) ++ atomic_long_sub(area->nr_pages, &nr_vmalloc_pages); + + kvfree(area->pages); + } +-- +2.39.5 +