From: Greg Kroah-Hartman Date: Sat, 9 Nov 2024 15:40:55 +0000 (+0100) Subject: 6.6-stable patches X-Git-Tag: v5.15.172~48 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f44a8d84498deabb1b41287b7d59fc6353633b9f;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: arm64-kconfig-make-sme-depend-on-broken-for-now.patch arm64-smccc-remove-broken-support-for-smcccv1.3-sve-discard-hint.patch arm64-sve-discard-stale-cpu-state-when-handling-sve-traps.patch btrfs-reinitialize-delayed-ref-list-after-deleting-it-from-the-list.patch mptcp-use-sock_kfree_s-instead-of-kfree.patch net-vertexcom-mse102x-fix-possible-double-free-of-tx-skb.patch net-wwan-t7xx-fix-off-by-one-error-in-t7xx_dpmaif_rx_buf_alloc.patch nfs-fix-kmsan-warning-in-decode_getfattr_attrs.patch --- diff --git a/queue-6.6/arm64-kconfig-make-sme-depend-on-broken-for-now.patch b/queue-6.6/arm64-kconfig-make-sme-depend-on-broken-for-now.patch new file mode 100644 index 00000000000..419445a5992 --- /dev/null +++ b/queue-6.6/arm64-kconfig-make-sme-depend-on-broken-for-now.patch @@ -0,0 +1,46 @@ +From 81235ae0c846e1fb46a2c6fe9283fe2b2b24f7dc Mon Sep 17 00:00:00 2001 +From: Mark Rutland +Date: Wed, 6 Nov 2024 16:42:20 +0000 +Subject: arm64: Kconfig: Make SME depend on BROKEN for now + +From: Mark Rutland + +commit 81235ae0c846e1fb46a2c6fe9283fe2b2b24f7dc upstream. + +Although support for SME was merged in v5.19, we've since uncovered a +number of issues with the implementation, including issues which might +corrupt the FPSIMD/SVE/SME state of arbitrary tasks. While there are +patches to address some of these issues, ongoing review has highlighted +additional functional problems, and more time is necessary to analyse +and fix these. + +For now, mark SME as BROKEN in the hope that we can fix things properly +in the near future. As SME is an OPTIONAL part of ARMv9.2+, and there is +very little extant hardware, this should not adversely affect the vast +majority of users. + +Signed-off-by: Mark Rutland +Cc: Ard Biesheuvel +Cc: Catalin Marinas +Cc: Marc Zyngier +Cc: Mark Brown +Cc: Will Deacon +Cc: stable@vger.kernel.org # 5.19 +Acked-by: Catalin Marinas +Link: https://lore.kernel.org/r/20241106164220.2789279-1-mark.rutland@arm.com +Signed-off-by: Will Deacon +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/arm64/Kconfig ++++ b/arch/arm64/Kconfig +@@ -2167,6 +2167,7 @@ config ARM64_SME + bool "ARM Scalable Matrix Extension support" + default y + depends on ARM64_SVE ++ depends on BROKEN + help + The Scalable Matrix Extension (SME) is an extension to the AArch64 + execution state which utilises a substantial subset of the SVE diff --git a/queue-6.6/arm64-smccc-remove-broken-support-for-smcccv1.3-sve-discard-hint.patch b/queue-6.6/arm64-smccc-remove-broken-support-for-smcccv1.3-sve-discard-hint.patch new file mode 100644 index 00000000000..d5f939ba3bd --- /dev/null +++ b/queue-6.6/arm64-smccc-remove-broken-support-for-smcccv1.3-sve-discard-hint.patch @@ -0,0 +1,227 @@ +From 8c462d56487e3abdbf8a61cedfe7c795a54f4a78 Mon Sep 17 00:00:00 2001 +From: Mark Rutland +Date: Wed, 6 Nov 2024 16:04:48 +0000 +Subject: arm64: smccc: Remove broken support for SMCCCv1.3 SVE discard hint + +From: Mark Rutland + +commit 8c462d56487e3abdbf8a61cedfe7c795a54f4a78 upstream. + +SMCCCv1.3 added a hint bit which callers can set in an SMCCC function ID +(AKA "FID") to indicate that it is acceptable for the SMCCC +implementation to discard SVE and/or SME state over a specific SMCCC +call. The kernel support for using this hint is broken and SMCCC calls +may clobber the SVE and/or SME state of arbitrary tasks, though FPSIMD +state is unaffected. + +The kernel support is intended to use the hint when there is no SVE or +SME state to save, and to do this it checks whether TIF_FOREIGN_FPSTATE +is set or TIF_SVE is clear in assembly code: + +| ldr , [, #TSK_TI_FLAGS] +| tbnz , #TIF_FOREIGN_FPSTATE, 1f // Any live FP state? +| tbnz , #TIF_SVE, 2f // Does that state include SVE? +| +| 1: orr , , ARM_SMCCC_1_3_SVE_HINT +| 2: +| << SMCCC call using FID >> + +This is not safe as-is: + +(1) SMCCC calls can be made in a preemptible context and preemption can + result in TIF_FOREIGN_FPSTATE being set or cleared at arbitrary + points in time. Thus checking for TIF_FOREIGN_FPSTATE provides no + guarantee. + +(2) TIF_FOREIGN_FPSTATE only indicates that the live FP/SVE/SME state in + the CPU does not belong to the current task, and does not indicate + that clobbering this state is acceptable. + + When the live CPU state is clobbered it is necessary to update + fpsimd_last_state.st to ensure that a subsequent context switch will + reload FP/SVE/SME state from memory rather than consuming the + clobbered state. This and the SMCCC call itself must happen in a + critical section with preemption disabled to avoid races. + +(3) Live SVE/SME state can exist with TIF_SVE clear (e.g. with only + TIF_SME set), and checking TIF_SVE alone is insufficient. + +Remove the broken support for the SMCCCv1.3 SVE saving hint. This is +effectively a revert of commits: + +* cfa7ff959a78 ("arm64: smccc: Support SMCCC v1.3 SVE register saving hint") +* a7c3acca5380 ("arm64: smccc: Save lr before calling __arm_smccc_sve_check()") + +... leaving behind the ARM_SMCCC_VERSION_1_3 and ARM_SMCCC_1_3_SVE_HINT +definitions, since these are simply definitions from the SMCCC +specification, and the latter is used in KVM via ARM_SMCCC_CALL_HINTS. + +If we want to bring this back in future, we'll probably want to handle +this logic in C where we can use all the usual FPSIMD/SVE/SME helper +functions, and that'll likely require some rework of the SMCCC code +and/or its callers. + +Fixes: cfa7ff959a78 ("arm64: smccc: Support SMCCC v1.3 SVE register saving hint") +Signed-off-by: Mark Rutland +Cc: Ard Biesheuvel +Cc: Catalin Marinas +Cc: Marc Zyngier +Cc: Mark Brown +Cc: Will Deacon +Cc: stable@vger.kernel.org +Reviewed-by: Mark Brown +Link: https://lore.kernel.org/r/20241106160448.2712997-1-mark.rutland@arm.com +Signed-off-by: Will Deacon +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/kernel/smccc-call.S | 35 +++-------------------------------- + drivers/firmware/smccc/smccc.c | 4 ---- + include/linux/arm-smccc.h | 32 +++----------------------------- + 3 files changed, 6 insertions(+), 65 deletions(-) + +--- a/arch/arm64/kernel/smccc-call.S ++++ b/arch/arm64/kernel/smccc-call.S +@@ -7,48 +7,19 @@ + + #include + #include +-#include +- +-/* +- * If we have SMCCC v1.3 and (as is likely) no SVE state in +- * the registers then set the SMCCC hint bit to say there's no +- * need to preserve it. Do this by directly adjusting the SMCCC +- * function value which is already stored in x0 ready to be called. +- */ +-SYM_FUNC_START(__arm_smccc_sve_check) +- +- ldr_l x16, smccc_has_sve_hint +- cbz x16, 2f +- +- get_current_task x16 +- ldr x16, [x16, #TSK_TI_FLAGS] +- tbnz x16, #TIF_FOREIGN_FPSTATE, 1f // Any live FP state? +- tbnz x16, #TIF_SVE, 2f // Does that state include SVE? +- +-1: orr x0, x0, ARM_SMCCC_1_3_SVE_HINT +- +-2: ret +-SYM_FUNC_END(__arm_smccc_sve_check) +-EXPORT_SYMBOL(__arm_smccc_sve_check) + + .macro SMCCC instr +- stp x29, x30, [sp, #-16]! +- mov x29, sp +-alternative_if ARM64_SVE +- bl __arm_smccc_sve_check +-alternative_else_nop_endif + \instr #0 +- ldr x4, [sp, #16] ++ ldr x4, [sp] + stp x0, x1, [x4, #ARM_SMCCC_RES_X0_OFFS] + stp x2, x3, [x4, #ARM_SMCCC_RES_X2_OFFS] +- ldr x4, [sp, #24] ++ ldr x4, [sp, #8] + cbz x4, 1f /* no quirk structure */ + ldr x9, [x4, #ARM_SMCCC_QUIRK_ID_OFFS] + cmp x9, #ARM_SMCCC_QUIRK_QCOM_A6 + b.ne 1f + str x6, [x4, ARM_SMCCC_QUIRK_STATE_OFFS] +-1: ldp x29, x30, [sp], #16 +- ret ++1: ret + .endm + + /* +--- a/drivers/firmware/smccc/smccc.c ++++ b/drivers/firmware/smccc/smccc.c +@@ -16,7 +16,6 @@ static u32 smccc_version = ARM_SMCCC_VER + static enum arm_smccc_conduit smccc_conduit = SMCCC_CONDUIT_NONE; + + bool __ro_after_init smccc_trng_available = false; +-u64 __ro_after_init smccc_has_sve_hint = false; + s32 __ro_after_init smccc_soc_id_version = SMCCC_RET_NOT_SUPPORTED; + s32 __ro_after_init smccc_soc_id_revision = SMCCC_RET_NOT_SUPPORTED; + +@@ -28,9 +27,6 @@ void __init arm_smccc_version_init(u32 v + smccc_conduit = conduit; + + smccc_trng_available = smccc_probe_trng(); +- if (IS_ENABLED(CONFIG_ARM64_SVE) && +- smccc_version >= ARM_SMCCC_VERSION_1_3) +- smccc_has_sve_hint = true; + + if ((smccc_version >= ARM_SMCCC_VERSION_1_2) && + (smccc_conduit != SMCCC_CONDUIT_NONE)) { +--- a/include/linux/arm-smccc.h ++++ b/include/linux/arm-smccc.h +@@ -227,8 +227,6 @@ u32 arm_smccc_get_version(void); + + void __init arm_smccc_version_init(u32 version, enum arm_smccc_conduit conduit); + +-extern u64 smccc_has_sve_hint; +- + /** + * arm_smccc_get_soc_id_version() + * +@@ -327,15 +325,6 @@ struct arm_smccc_quirk { + }; + + /** +- * __arm_smccc_sve_check() - Set the SVE hint bit when doing SMC calls +- * +- * Sets the SMCCC hint bit to indicate if there is live state in the SVE +- * registers, this modifies x0 in place and should never be called from C +- * code. +- */ +-asmlinkage unsigned long __arm_smccc_sve_check(unsigned long x0); +- +-/** + * __arm_smccc_smc() - make SMC calls + * @a0-a7: arguments passed in registers 0 to 7 + * @res: result values from registers 0 to 3 +@@ -402,20 +391,6 @@ asmlinkage void __arm_smccc_hvc(unsigned + + #endif + +-/* nVHE hypervisor doesn't have a current thread so needs separate checks */ +-#if defined(CONFIG_ARM64_SVE) && !defined(__KVM_NVHE_HYPERVISOR__) +- +-#define SMCCC_SVE_CHECK ALTERNATIVE("nop \n", "bl __arm_smccc_sve_check \n", \ +- ARM64_SVE) +-#define smccc_sve_clobbers "x16", "x30", "cc", +- +-#else +- +-#define SMCCC_SVE_CHECK +-#define smccc_sve_clobbers +- +-#endif +- + #define __constraint_read_2 "r" (arg0) + #define __constraint_read_3 __constraint_read_2, "r" (arg1) + #define __constraint_read_4 __constraint_read_3, "r" (arg2) +@@ -486,12 +461,11 @@ asmlinkage void __arm_smccc_hvc(unsigned + register unsigned long r3 asm("r3"); \ + CONCATENATE(__declare_arg_, \ + COUNT_ARGS(__VA_ARGS__))(__VA_ARGS__); \ +- asm volatile(SMCCC_SVE_CHECK \ +- inst "\n" : \ ++ asm volatile(inst "\n" : \ + "=r" (r0), "=r" (r1), "=r" (r2), "=r" (r3) \ + : CONCATENATE(__constraint_read_, \ + COUNT_ARGS(__VA_ARGS__)) \ +- : smccc_sve_clobbers "memory"); \ ++ : "memory"); \ + if (___res) \ + *___res = (typeof(*___res)){r0, r1, r2, r3}; \ + } while (0) +@@ -540,7 +514,7 @@ asmlinkage void __arm_smccc_hvc(unsigned + asm ("" : \ + : CONCATENATE(__constraint_read_, \ + COUNT_ARGS(__VA_ARGS__)) \ +- : smccc_sve_clobbers "memory"); \ ++ : "memory"); \ + if (___res) \ + ___res->a0 = SMCCC_RET_NOT_SUPPORTED; \ + } while (0) diff --git a/queue-6.6/arm64-sve-discard-stale-cpu-state-when-handling-sve-traps.patch b/queue-6.6/arm64-sve-discard-stale-cpu-state-when-handling-sve-traps.patch new file mode 100644 index 00000000000..fd05c872a8b --- /dev/null +++ b/queue-6.6/arm64-sve-discard-stale-cpu-state-when-handling-sve-traps.patch @@ -0,0 +1,91 @@ +From 751ecf6afd6568adc98f2a6052315552c0483d18 Mon Sep 17 00:00:00 2001 +From: Mark Brown +Date: Wed, 30 Oct 2024 20:23:50 +0000 +Subject: arm64/sve: Discard stale CPU state when handling SVE traps + +From: Mark Brown + +commit 751ecf6afd6568adc98f2a6052315552c0483d18 upstream. + +The logic for handling SVE traps manipulates saved FPSIMD/SVE state +incorrectly, and a race with preemption can result in a task having +TIF_SVE set and TIF_FOREIGN_FPSTATE clear even though the live CPU state +is stale (e.g. with SVE traps enabled). This has been observed to result +in warnings from do_sve_acc() where SVE traps are not expected while +TIF_SVE is set: + +| if (test_and_set_thread_flag(TIF_SVE)) +| WARN_ON(1); /* SVE access shouldn't have trapped */ + +Warnings of this form have been reported intermittently, e.g. + + https://lore.kernel.org/linux-arm-kernel/CA+G9fYtEGe_DhY2Ms7+L7NKsLYUomGsgqpdBj+QwDLeSg=JhGg@mail.gmail.com/ + https://lore.kernel.org/linux-arm-kernel/000000000000511e9a060ce5a45c@google.com/ + +The race can occur when the SVE trap handler is preempted before and +after manipulating the saved FPSIMD/SVE state, starting and ending on +the same CPU, e.g. + +| void do_sve_acc(unsigned long esr, struct pt_regs *regs) +| { +| // Trap on CPU 0 with TIF_SVE clear, SVE traps enabled +| // task->fpsimd_cpu is 0. +| // per_cpu_ptr(&fpsimd_last_state, 0) is task. +| +| ... +| +| // Preempted; migrated from CPU 0 to CPU 1. +| // TIF_FOREIGN_FPSTATE is set. +| +| get_cpu_fpsimd_context(); +| +| if (test_and_set_thread_flag(TIF_SVE)) +| WARN_ON(1); /* SVE access shouldn't have trapped */ +| +| sve_init_regs() { +| if (!test_thread_flag(TIF_FOREIGN_FPSTATE)) { +| ... +| } else { +| fpsimd_to_sve(current); +| current->thread.fp_type = FP_STATE_SVE; +| } +| } +| +| put_cpu_fpsimd_context(); +| +| // Preempted; migrated from CPU 1 to CPU 0. +| // task->fpsimd_cpu is still 0 +| // If per_cpu_ptr(&fpsimd_last_state, 0) is still task then: +| // - Stale HW state is reused (with SVE traps enabled) +| // - TIF_FOREIGN_FPSTATE is cleared +| // - A return to userspace skips HW state restore +| } + +Fix the case where the state is not live and TIF_FOREIGN_FPSTATE is set +by calling fpsimd_flush_task_state() to detach from the saved CPU +state. This ensures that a subsequent context switch will not reuse the +stale CPU state, and will instead set TIF_FOREIGN_FPSTATE, forcing the +new state to be reloaded from memory prior to a return to userspace. + +Fixes: cccb78ce89c4 ("arm64/sve: Rework SVE access trap to convert state in registers") +Reported-by: Mark Rutland +Signed-off-by: Mark Brown +Cc: stable@vger.kernel.org +Reviewed-by: Mark Rutland +Link: https://lore.kernel.org/r/20241030-arm64-fpsimd-foreign-flush-v1-1-bd7bd66905a2@kernel.org +Signed-off-by: Will Deacon +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/kernel/fpsimd.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/arm64/kernel/fpsimd.c ++++ b/arch/arm64/kernel/fpsimd.c +@@ -1445,6 +1445,7 @@ static void sve_init_regs(void) + } else { + fpsimd_to_sve(current); + current->thread.fp_type = FP_STATE_SVE; ++ fpsimd_flush_task_state(current); + } + } + diff --git a/queue-6.6/btrfs-reinitialize-delayed-ref-list-after-deleting-it-from-the-list.patch b/queue-6.6/btrfs-reinitialize-delayed-ref-list-after-deleting-it-from-the-list.patch new file mode 100644 index 00000000000..7fb7e5ff864 --- /dev/null +++ b/queue-6.6/btrfs-reinitialize-delayed-ref-list-after-deleting-it-from-the-list.patch @@ -0,0 +1,50 @@ +From c9a75ec45f1111ef530ab186c2a7684d0a0c9245 Mon Sep 17 00:00:00 2001 +From: Filipe Manana +Date: Mon, 4 Nov 2024 12:11:15 +0000 +Subject: btrfs: reinitialize delayed ref list after deleting it from the list + +From: Filipe Manana + +commit c9a75ec45f1111ef530ab186c2a7684d0a0c9245 upstream. + +At insert_delayed_ref() if we need to update the action of an existing +ref to BTRFS_DROP_DELAYED_REF, we delete the ref from its ref head's +ref_add_list using list_del(), which leaves the ref's add_list member +not reinitialized, as list_del() sets the next and prev members of the +list to LIST_POISON1 and LIST_POISON2, respectively. + +If later we end up calling drop_delayed_ref() against the ref, which can +happen during merging or when destroying delayed refs due to a transaction +abort, we can trigger a crash since at drop_delayed_ref() we call +list_empty() against the ref's add_list, which returns false since +the list was not reinitialized after the list_del() and as a consequence +we call list_del() again at drop_delayed_ref(). This results in an +invalid list access since the next and prev members are set to poison +pointers, resulting in a splat if CONFIG_LIST_HARDENED and +CONFIG_DEBUG_LIST are set or invalid poison pointer dereferences +otherwise. + +So fix this by deleting from the list with list_del_init() instead. + +Fixes: 1d57ee941692 ("btrfs: improve delayed refs iterations") +CC: stable@vger.kernel.org # 4.19+ +Reviewed-by: Johannes Thumshirn +Signed-off-by: Filipe Manana +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/delayed-ref.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/btrfs/delayed-ref.c ++++ b/fs/btrfs/delayed-ref.c +@@ -615,7 +615,7 @@ static bool insert_delayed_ref(struct bt + &href->ref_add_list); + else if (ref->action == BTRFS_DROP_DELAYED_REF) { + ASSERT(!list_empty(&exist->add_list)); +- list_del(&exist->add_list); ++ list_del_init(&exist->add_list); + } else { + ASSERT(0); + } diff --git a/queue-6.6/mptcp-use-sock_kfree_s-instead-of-kfree.patch b/queue-6.6/mptcp-use-sock_kfree_s-instead-of-kfree.patch new file mode 100644 index 00000000000..e67556d9615 --- /dev/null +++ b/queue-6.6/mptcp-use-sock_kfree_s-instead-of-kfree.patch @@ -0,0 +1,46 @@ +From 99635c91fb8b860a6404b9bc8b769df7bdaa2ae3 Mon Sep 17 00:00:00 2001 +From: Geliang Tang +Date: Mon, 4 Nov 2024 13:31:42 +0100 +Subject: mptcp: use sock_kfree_s instead of kfree + +From: Geliang Tang + +commit 99635c91fb8b860a6404b9bc8b769df7bdaa2ae3 upstream. + +The local address entries on userspace_pm_local_addr_list are allocated +by sock_kmalloc(). + +It's then required to use sock_kfree_s() instead of kfree() to free +these entries in order to adjust the allocated size on the sk side. + +Fixes: 24430f8bf516 ("mptcp: add address into userspace pm list") +Cc: stable@vger.kernel.org +Signed-off-by: Geliang Tang +Reviewed-by: Matthieu Baerts (NGI0) +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20241104-net-mptcp-misc-6-12-v1-2-c13f2ff1656f@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/pm_userspace.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/mptcp/pm_userspace.c ++++ b/net/mptcp/pm_userspace.c +@@ -90,6 +90,7 @@ static int mptcp_userspace_pm_delete_loc + struct mptcp_pm_addr_entry *addr) + { + struct mptcp_pm_addr_entry *entry, *tmp; ++ struct sock *sk = (struct sock *)msk; + + list_for_each_entry_safe(entry, tmp, &msk->pm.userspace_pm_local_addr_list, list) { + if (mptcp_addresses_equal(&entry->addr, &addr->addr, false)) { +@@ -97,7 +98,7 @@ static int mptcp_userspace_pm_delete_loc + * be used multiple times (e.g. fullmesh mode). + */ + list_del_rcu(&entry->list); +- kfree(entry); ++ sock_kfree_s(sk, entry, sizeof(*entry)); + msk->pm.local_addr_used--; + return 0; + } diff --git a/queue-6.6/net-vertexcom-mse102x-fix-possible-double-free-of-tx-skb.patch b/queue-6.6/net-vertexcom-mse102x-fix-possible-double-free-of-tx-skb.patch new file mode 100644 index 00000000000..18bb0002234 --- /dev/null +++ b/queue-6.6/net-vertexcom-mse102x-fix-possible-double-free-of-tx-skb.patch @@ -0,0 +1,82 @@ +From 1f26339b2ed63d1e8e18a18674fb73a392f3660e Mon Sep 17 00:00:00 2001 +From: Stefan Wahren +Date: Tue, 5 Nov 2024 17:31:01 +0100 +Subject: net: vertexcom: mse102x: Fix possible double free of TX skb + +From: Stefan Wahren + +commit 1f26339b2ed63d1e8e18a18674fb73a392f3660e upstream. + +The scope of the TX skb is wider than just mse102x_tx_frame_spi(), +so in case the TX skb room needs to be expanded, we should free the +the temporary skb instead of the original skb. Otherwise the original +TX skb pointer would be freed again in mse102x_tx_work(), which leads +to crashes: + + Internal error: Oops: 0000000096000004 [#2] PREEMPT SMP + CPU: 0 PID: 712 Comm: kworker/0:1 Tainted: G D 6.6.23 + Hardware name: chargebyte Charge SOM DC-ONE (DT) + Workqueue: events mse102x_tx_work [mse102x] + pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) + pc : skb_release_data+0xb8/0x1d8 + lr : skb_release_data+0x1ac/0x1d8 + sp : ffff8000819a3cc0 + x29: ffff8000819a3cc0 x28: ffff0000046daa60 x27: ffff0000057f2dc0 + x26: ffff000005386c00 x25: 0000000000000002 x24: 00000000ffffffff + x23: 0000000000000000 x22: 0000000000000001 x21: ffff0000057f2e50 + x20: 0000000000000006 x19: 0000000000000000 x18: ffff00003fdacfcc + x17: e69ad452d0c49def x16: 84a005feff870102 x15: 0000000000000000 + x14: 000000000000024a x13: 0000000000000002 x12: 0000000000000000 + x11: 0000000000000400 x10: 0000000000000930 x9 : ffff00003fd913e8 + x8 : fffffc00001bc008 + x7 : 0000000000000000 x6 : 0000000000000008 + x5 : ffff00003fd91340 x4 : 0000000000000000 x3 : 0000000000000009 + x2 : 00000000fffffffe x1 : 0000000000000000 x0 : 0000000000000000 + Call trace: + skb_release_data+0xb8/0x1d8 + kfree_skb_reason+0x48/0xb0 + mse102x_tx_work+0x164/0x35c [mse102x] + process_one_work+0x138/0x260 + worker_thread+0x32c/0x438 + kthread+0x118/0x11c + ret_from_fork+0x10/0x20 + Code: aa1303e0 97fffab6 72001c1f 54000141 (f9400660) + +Cc: stable@vger.kernel.org +Fixes: 2f207cbf0dd4 ("net: vertexcom: Add MSE102x SPI support") +Signed-off-by: Stefan Wahren +Link: https://patch.msgid.link/20241105163101.33216-1-wahrenst@gmx.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/vertexcom/mse102x.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/vertexcom/mse102x.c ++++ b/drivers/net/ethernet/vertexcom/mse102x.c +@@ -222,7 +222,7 @@ static int mse102x_tx_frame_spi(struct m + struct mse102x_net_spi *mses = to_mse102x_spi(mse); + struct spi_transfer *xfer = &mses->spi_xfer; + struct spi_message *msg = &mses->spi_msg; +- struct sk_buff *tskb; ++ struct sk_buff *tskb = NULL; + int ret; + + netif_dbg(mse, tx_queued, mse->ndev, "%s: skb %p, %d@%p\n", +@@ -235,7 +235,6 @@ static int mse102x_tx_frame_spi(struct m + if (!tskb) + return -ENOMEM; + +- dev_kfree_skb(txp); + txp = tskb; + } + +@@ -257,6 +256,8 @@ static int mse102x_tx_frame_spi(struct m + mse->stats.xfer_err++; + } + ++ dev_kfree_skb(tskb); ++ + return ret; + } + diff --git a/queue-6.6/net-wwan-t7xx-fix-off-by-one-error-in-t7xx_dpmaif_rx_buf_alloc.patch b/queue-6.6/net-wwan-t7xx-fix-off-by-one-error-in-t7xx_dpmaif_rx_buf_alloc.patch new file mode 100644 index 00000000000..f91e5cbecb9 --- /dev/null +++ b/queue-6.6/net-wwan-t7xx-fix-off-by-one-error-in-t7xx_dpmaif_rx_buf_alloc.patch @@ -0,0 +1,42 @@ +From 3b557be89fc688dbd9ccf704a70f7600a094f13a Mon Sep 17 00:00:00 2001 +From: Jinjie Ruan +Date: Fri, 1 Nov 2024 10:53:16 +0800 +Subject: net: wwan: t7xx: Fix off-by-one error in t7xx_dpmaif_rx_buf_alloc() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jinjie Ruan + +commit 3b557be89fc688dbd9ccf704a70f7600a094f13a upstream. + +The error path in t7xx_dpmaif_rx_buf_alloc(), free and unmap the already +allocated and mapped skb in a loop, but the loop condition terminates when +the index reaches zero, which fails to free the first allocated skb at +index zero. + +Check with i-- so that skb at index 0 is freed as well. + +Cc: stable@vger.kernel.org +Fixes: d642b012df70 ("net: wwan: t7xx: Add data path interface") +Acked-by: Sergey Ryazanov +Signed-off-by: Jinjie Ruan +Reviewed-by: Ilpo Järvinen +Link: https://patch.msgid.link/20241101025316.3234023-1-ruanjinjie@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c ++++ b/drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c +@@ -226,7 +226,7 @@ int t7xx_dpmaif_rx_buf_alloc(struct dpma + return 0; + + err_unmap_skbs: +- while (--i > 0) ++ while (i--) + t7xx_unmap_bat_skb(dpmaif_ctrl->dev, bat_req->bat_skb, i); + + return ret; diff --git a/queue-6.6/nfs-fix-kmsan-warning-in-decode_getfattr_attrs.patch b/queue-6.6/nfs-fix-kmsan-warning-in-decode_getfattr_attrs.patch new file mode 100644 index 00000000000..6988f5d8643 --- /dev/null +++ b/queue-6.6/nfs-fix-kmsan-warning-in-decode_getfattr_attrs.patch @@ -0,0 +1,69 @@ +From dc270d7159699ad6d11decadfce9633f0f71c1db Mon Sep 17 00:00:00 2001 +From: Roberto Sassu +Date: Fri, 25 Oct 2024 16:03:27 +0200 +Subject: nfs: Fix KMSAN warning in decode_getfattr_attrs() + +From: Roberto Sassu + +commit dc270d7159699ad6d11decadfce9633f0f71c1db upstream. + +Fix the following KMSAN warning: + +CPU: 1 UID: 0 PID: 7651 Comm: cp Tainted: G B +Tainted: [B]=BAD_PAGE +Hardware name: QEMU Standard PC (Q35 + ICH9, 2009) +===================================================== +===================================================== +BUG: KMSAN: uninit-value in decode_getfattr_attrs+0x2d6d/0x2f90 + decode_getfattr_attrs+0x2d6d/0x2f90 + decode_getfattr_generic+0x806/0xb00 + nfs4_xdr_dec_getattr+0x1de/0x240 + rpcauth_unwrap_resp_decode+0xab/0x100 + rpcauth_unwrap_resp+0x95/0xc0 + call_decode+0x4ff/0xb50 + __rpc_execute+0x57b/0x19d0 + rpc_execute+0x368/0x5e0 + rpc_run_task+0xcfe/0xee0 + nfs4_proc_getattr+0x5b5/0x990 + __nfs_revalidate_inode+0x477/0xd00 + nfs_access_get_cached+0x1021/0x1cc0 + nfs_do_access+0x9f/0xae0 + nfs_permission+0x1e4/0x8c0 + inode_permission+0x356/0x6c0 + link_path_walk+0x958/0x1330 + path_lookupat+0xce/0x6b0 + filename_lookup+0x23e/0x770 + vfs_statx+0xe7/0x970 + vfs_fstatat+0x1f2/0x2c0 + __se_sys_newfstatat+0x67/0x880 + __x64_sys_newfstatat+0xbd/0x120 + x64_sys_call+0x1826/0x3cf0 + do_syscall_64+0xd0/0x1b0 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +The KMSAN warning is triggered in decode_getfattr_attrs(), when calling +decode_attr_mdsthreshold(). It appears that fattr->mdsthreshold is not +initialized. + +Fix the issue by initializing fattr->mdsthreshold to NULL in +nfs_fattr_init(). + +Cc: stable@vger.kernel.org # v3.5.x +Fixes: 88034c3d88c2 ("NFSv4.1 mdsthreshold attribute xdr") +Signed-off-by: Roberto Sassu +Signed-off-by: Anna Schumaker +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfs/inode.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/nfs/inode.c ++++ b/fs/nfs/inode.c +@@ -1575,6 +1575,7 @@ void nfs_fattr_init(struct nfs_fattr *fa + fattr->gencount = nfs_inc_attr_generation_counter(); + fattr->owner_name = NULL; + fattr->group_name = NULL; ++ fattr->mdsthreshold = NULL; + } + EXPORT_SYMBOL_GPL(nfs_fattr_init); + diff --git a/queue-6.6/series b/queue-6.6/series index 11de21defa5..f9e007ac799 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -87,3 +87,11 @@ dm-cache-fix-potential-out-of-bounds-access-on-the-first-resume.patch dm-unstriped-cast-an-operand-to-sector_t-to-prevent-potential-uint32_t-overflow.patch alsa-usb-audio-add-quirk-for-hp-320-fhd-webcam.patch posix-cpu-timers-clear-tick_dep_bit_posix_timer-on-c.patch +nfs-fix-kmsan-warning-in-decode_getfattr_attrs.patch +net-wwan-t7xx-fix-off-by-one-error-in-t7xx_dpmaif_rx_buf_alloc.patch +net-vertexcom-mse102x-fix-possible-double-free-of-tx-skb.patch +mptcp-use-sock_kfree_s-instead-of-kfree.patch +arm64-sve-discard-stale-cpu-state-when-handling-sve-traps.patch +arm64-kconfig-make-sme-depend-on-broken-for-now.patch +arm64-smccc-remove-broken-support-for-smcccv1.3-sve-discard-hint.patch +btrfs-reinitialize-delayed-ref-list-after-deleting-it-from-the-list.patch