From: Greg Kroah-Hartman Date: Tue, 19 Nov 2024 12:11:10 +0000 (+0100) Subject: 6.11-stable patches X-Git-Tag: v6.12.1~31 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f5124425c895cf23d50b1f606f17d51f646b37c1;p=thirdparty%2Fkernel%2Fstable-queue.git 6.11-stable patches added patches: lib-buildid-fix-build-id-parsing-logic.patch media-dvbdev-fix-the-logic-when-dvb_dynamic_minors-is-not-set.patch net-sched-u32-add-test-case-for-systematic-hnode-idr-leaks.patch --- diff --git a/queue-6.11/lib-buildid-fix-build-id-parsing-logic.patch b/queue-6.11/lib-buildid-fix-build-id-parsing-logic.patch new file mode 100644 index 00000000000..9be81dacd14 --- /dev/null +++ b/queue-6.11/lib-buildid-fix-build-id-parsing-logic.patch @@ -0,0 +1,37 @@ +From jolsa@kernel.org Tue Nov 19 12:58:34 2024 +From: Jiri Olsa +Date: Mon, 4 Nov 2024 18:52:56 +0100 +Subject: lib/buildid: Fix build ID parsing logic +To: stable@vger.kernel.org +Cc: Andrii Nakryiko , bpf@vger.kernel.org, Daniel Borkmann +Message-ID: <20241104175256.2327164-5-jolsa@kernel.org> + +From: Jiri Olsa + +The parse_build_id_buf does not account Elf32_Nhdr header size +when getting the build id data pointer and returns wrong build +id data as result. + +This is problem only for stable trees that merged 768d731b8a0d +fix, the upstream build id code was refactored and returns proper +build id. + +Acked-by: Andrii Nakryiko +Fixes: 768d731b8a0d ("lib/buildid: harden build ID parsing logic") +Signed-off-by: Jiri Olsa +Signed-off-by: Greg Kroah-Hartman +--- + lib/buildid.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/lib/buildid.c ++++ b/lib/buildid.c +@@ -40,7 +40,7 @@ static int parse_build_id_buf(unsigned c + name_sz == note_name_sz && + memcmp(nhdr + 1, note_name, note_name_sz) == 0 && + desc_sz > 0 && desc_sz <= BUILD_ID_SIZE_MAX) { +- data = note_start + note_off + ALIGN(note_name_sz, 4); ++ data = note_start + note_off + sizeof(Elf32_Nhdr) + ALIGN(note_name_sz, 4); + memcpy(build_id, data, desc_sz); + memset(build_id + desc_sz, 0, BUILD_ID_SIZE_MAX - desc_sz); + if (size) diff --git a/queue-6.11/media-dvbdev-fix-the-logic-when-dvb_dynamic_minors-is-not-set.patch b/queue-6.11/media-dvbdev-fix-the-logic-when-dvb_dynamic_minors-is-not-set.patch new file mode 100644 index 00000000000..bb813603872 --- /dev/null +++ b/queue-6.11/media-dvbdev-fix-the-logic-when-dvb_dynamic_minors-is-not-set.patch @@ -0,0 +1,57 @@ +From a4aebaf6e6efff548b01a3dc49b4b9074751c15b Mon Sep 17 00:00:00 2001 +From: Mauro Carvalho Chehab +Date: Wed, 6 Nov 2024 21:50:55 +0100 +Subject: media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set + +From: Mauro Carvalho Chehab + +commit a4aebaf6e6efff548b01a3dc49b4b9074751c15b upstream. + +When CONFIG_DVB_DYNAMIC_MINORS, ret is not initialized, and a +semaphore is left at the wrong state, in case of errors. + +Make the code simpler and avoid mistakes by having just one error +check logic used weather DVB_DYNAMIC_MINORS is used or not. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/r/202410201717.ULWWdJv8-lkp@intel.com/ +Signed-off-by: Mauro Carvalho Chehab +Link: https://lore.kernel.org/r/9e067488d8935b8cf00959764a1fa5de85d65725.1730926254.git.mchehab+huawei@kernel.org +Cc: Nathan Chancellor +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/dvb-core/dvbdev.c | 15 ++++----------- + 1 file changed, 4 insertions(+), 11 deletions(-) + +--- a/drivers/media/dvb-core/dvbdev.c ++++ b/drivers/media/dvb-core/dvbdev.c +@@ -530,6 +530,9 @@ int dvb_register_device(struct dvb_adapt + for (minor = 0; minor < MAX_DVB_MINORS; minor++) + if (!dvb_minors[minor]) + break; ++#else ++ minor = nums2minor(adap->num, type, id); ++#endif + if (minor >= MAX_DVB_MINORS) { + if (new_node) { + list_del(&new_node->list_head); +@@ -543,17 +546,7 @@ int dvb_register_device(struct dvb_adapt + mutex_unlock(&dvbdev_register_lock); + return -EINVAL; + } +-#else +- minor = nums2minor(adap->num, type, id); +- if (minor >= MAX_DVB_MINORS) { +- dvb_media_device_free(dvbdev); +- list_del(&dvbdev->list_head); +- kfree(dvbdev); +- *pdvbdev = NULL; +- mutex_unlock(&dvbdev_register_lock); +- return ret; +- } +-#endif ++ + dvbdev->minor = minor; + dvb_minors[minor] = dvb_device_get(dvbdev); + up_write(&minor_rwsem); diff --git a/queue-6.11/net-sched-u32-add-test-case-for-systematic-hnode-idr-leaks.patch b/queue-6.11/net-sched-u32-add-test-case-for-systematic-hnode-idr-leaks.patch new file mode 100644 index 00000000000..c82f315474d --- /dev/null +++ b/queue-6.11/net-sched-u32-add-test-case-for-systematic-hnode-idr-leaks.patch @@ -0,0 +1,57 @@ +From ca34aceb322bfcd6ab498884f1805ee12f983259 Mon Sep 17 00:00:00 2001 +From: Alexandre Ferrieux +Date: Wed, 13 Nov 2024 11:04:28 +0100 +Subject: net: sched: u32: Add test case for systematic hnode IDR leaks + +From: Alexandre Ferrieux + +commit ca34aceb322bfcd6ab498884f1805ee12f983259 upstream. + +Add a tdc test case to exercise the just-fixed systematic leak of +IDR entries in u32 hnode disposal. Given the IDR in question is +confined to the range [1..0x7FF], it is sufficient to create/delete +the same filter 2048 times to fill it up and get a nonzero exit +status from "tc filter add". + +Signed-off-by: Alexandre Ferrieux +Acked-by: Jamal Hadi Salim +Reviewed-by: Victor Nogueira +Link: https://patch.msgid.link/20241113100428.360460-1-alexandre.ferrieux@orange.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/tc-testing/tc-tests/filters/u32.json | 24 +++++++++++ + 1 file changed, 24 insertions(+) + +--- a/tools/testing/selftests/tc-testing/tc-tests/filters/u32.json ++++ b/tools/testing/selftests/tc-testing/tc-tests/filters/u32.json +@@ -329,5 +329,29 @@ + "teardown": [ + "$TC qdisc del dev $DEV1 parent root drr" + ] ++ }, ++ { ++ "id": "1234", ++ "name": "Exercise IDR leaks by creating/deleting a filter many (2048) times", ++ "category": [ ++ "filter", ++ "u32" ++ ], ++ "plugins": { ++ "requires": "nsPlugin" ++ }, ++ "setup": [ ++ "$TC qdisc add dev $DEV1 parent root handle 10: drr", ++ "$TC filter add dev $DEV1 parent 10:0 protocol ip prio 2 u32 match ip src 0.0.0.2/32 action drop", ++ "$TC filter add dev $DEV1 parent 10:0 protocol ip prio 3 u32 match ip src 0.0.0.3/32 action drop" ++ ], ++ "cmdUnderTest": "bash -c 'for i in {1..2048} ;do echo filter delete dev $DEV1 pref 3;echo filter add dev $DEV1 parent 10:0 protocol ip prio 3 u32 match ip src 0.0.0.3/32 action drop;done | $TC -b -'", ++ "expExitCode": "0", ++ "verifyCmd": "$TC filter show dev $DEV1", ++ "matchPattern": "protocol ip pref 3 u32", ++ "matchCount": "3", ++ "teardown": [ ++ "$TC qdisc del dev $DEV1 parent root drr" ++ ] + } + ] diff --git a/queue-6.11/series b/queue-6.11/series index e885edeec42..5aa9700f6cf 100644 --- a/queue-6.11/series +++ b/queue-6.11/series @@ -102,3 +102,6 @@ drm-amd-display-fix-failure-to-read-vram-info-due-to-static-bp_result.patch mm-refactor-arch_calc_vm_flag_bits-and-arm64-mte-han.patch drm-xe-restore-system-memory-ggtt-mappings.patch drm-xe-improve-hibernation-on-igpu.patch +lib-buildid-fix-build-id-parsing-logic.patch +net-sched-u32-add-test-case-for-systematic-hnode-idr-leaks.patch +media-dvbdev-fix-the-logic-when-dvb_dynamic_minors-is-not-set.patch