--- /dev/null
+From 05b538c1765f8d14a71ccf5f85258dcbeaf189f7 Mon Sep 17 00:00:00 2001
+From: Pavel Begunkov <asml.silence@gmail.com>
+Date: Thu, 9 Jun 2022 08:34:35 +0100
+Subject: io_uring: fix not locked access to fixed buf table
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+commit 05b538c1765f8d14a71ccf5f85258dcbeaf189f7 upstream.
+
+We can look inside the fixed buffer table only while holding
+->uring_lock, however in some cases we don't do the right async prep for
+IORING_OP_{WRITE,READ}_FIXED ending up with NULL req->imu forcing making
+an io-wq worker to try to resolve the fixed buffer without proper
+locking.
+
+Move req->imu setup into early req init paths, i.e. io_prep_rw(), which
+is called unconditionally for rw requests and under uring_lock.
+
+Fixes: 634d00df5e1cf ("io_uring: add full-fledged dynamic buffers support")
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/io_uring.c | 28 ++++++++++++++--------------
+ 1 file changed, 14 insertions(+), 14 deletions(-)
+
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -2932,15 +2932,24 @@ static int io_prep_rw(struct io_kiocb *r
+ kiocb->ki_complete = io_complete_rw;
+ }
+
++ /* used for fixed read/write too - just read unconditionally */
++ req->buf_index = READ_ONCE(sqe->buf_index);
++ req->imu = NULL;
++
+ if (req->opcode == IORING_OP_READ_FIXED ||
+ req->opcode == IORING_OP_WRITE_FIXED) {
+- req->imu = NULL;
++ struct io_ring_ctx *ctx = req->ctx;
++ u16 index;
++
++ if (unlikely(req->buf_index >= ctx->nr_user_bufs))
++ return -EFAULT;
++ index = array_index_nospec(req->buf_index, ctx->nr_user_bufs);
++ req->imu = ctx->user_bufs[index];
+ io_req_set_rsrc_node(req);
+ }
+
+ req->rw.addr = READ_ONCE(sqe->addr);
+ req->rw.len = READ_ONCE(sqe->len);
+- req->buf_index = READ_ONCE(sqe->buf_index);
+ return 0;
+ }
+
+@@ -3066,18 +3075,9 @@ static int __io_import_fixed(struct io_k
+
+ static int io_import_fixed(struct io_kiocb *req, int rw, struct iov_iter *iter)
+ {
+- struct io_ring_ctx *ctx = req->ctx;
+- struct io_mapped_ubuf *imu = req->imu;
+- u16 index, buf_index = req->buf_index;
+-
+- if (likely(!imu)) {
+- if (unlikely(buf_index >= ctx->nr_user_bufs))
+- return -EFAULT;
+- index = array_index_nospec(buf_index, ctx->nr_user_bufs);
+- imu = READ_ONCE(ctx->user_bufs[index]);
+- req->imu = imu;
+- }
+- return __io_import_fixed(req, rw, iter, imu);
++ if (WARN_ON_ONCE(!req->imu))
++ return -EFAULT;
++ return __io_import_fixed(req, rw, iter, req->imu);
+ }
+
+ static void io_ring_submit_unlock(struct io_ring_ctx *ctx, bool needs_lock)
--- /dev/null
+From foo@baz Thu Jun 30 03:21:45 PM CEST 2022
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Tue, 28 Jun 2022 20:20:15 +0300
+Subject: net: mscc: ocelot: allow unregistered IP multicast flooding to CPU
+To: stable <stable@vger.kernel.org>, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Sasha Levin <sashal@kernel.org>
+Cc: netdev@vger.kernel.org, "David S. Miller" <davem@davemloft.net>, Eric Dumazet <edumazet@google.com>, Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>, Xiaoliang Yang <xiaoliang.yang_1@nxp.com>, Claudiu Manoil <claudiu.manoil@nxp.com>, Alexandre Belloni <alexandre.belloni@bootlin.com>, UNGLinuxDriver@microchip.com, Andrew Lunn <andrew@lunn.ch>, Vivien Didelot <vivien.didelot@gmail.com>, Florian Fainelli <f.fainelli@gmail.com>, Maxim Kochetkov <fido_max@inbox.ru>, Colin Foster <colin.foster@in-advantage.com>, stable@kernel.org
+Message-ID: <20220628172016.3373243-4-vladimir.oltean@nxp.com>
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+Since commit 4cf35a2b627a ("net: mscc: ocelot: fix broken IP multicast
+flooding") from v5.12, unregistered IP multicast flooding is
+configurable in the ocelot driver for bridged ports. However, by writing
+0 to the PGID_MCIPV4 and PGID_MCIPV6 port masks at initialization time,
+the CPU port module, for which ocelot_port_set_mcast_flood() is not
+called, will have unknown IP multicast flooding disabled.
+
+This makes it impossible for an application such as smcroute to work
+properly, since all IP multicast traffic received on a standalone port
+is treated as unregistered (and dropped).
+
+Starting with commit 7569459a52c9 ("net: dsa: manage flooding on the CPU
+ports"), the limitation above has been lifted, because when standalone
+ports become IFF_PROMISC or IFF_ALLMULTI, ocelot_port_set_mcast_flood()
+would be called on the CPU port module, so unregistered multicast is
+flooded to the CPU on an as-needed basis.
+
+But between v5.12 and v5.18, IP multicast flooding to the CPU has
+remained broken, promiscuous or not.
+
+Delete the inexplicable premature optimization of clearing PGID_MCIPV4
+and PGID_MCIPV6 as part of the init sequence, and allow unregistered IP
+multicast to be flooded freely to the CPU port module.
+
+Fixes: a556c76adc05 ("net: mscc: Add initial Ocelot switch support")
+Cc: stable@kernel.org
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mscc/ocelot.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/mscc/ocelot.c
++++ b/drivers/net/ethernet/mscc/ocelot.c
+@@ -2208,9 +2208,13 @@ int ocelot_init(struct ocelot *ocelot)
+ ANA_PGID_PGID, PGID_MC);
+ ocelot_rmw_rix(ocelot, ANA_PGID_PGID_PGID(BIT(ocelot->num_phys_ports)),
+ ANA_PGID_PGID_PGID(BIT(ocelot->num_phys_ports)),
++ ANA_PGID_PGID, PGID_MCIPV4);
++ ocelot_rmw_rix(ocelot, ANA_PGID_PGID_PGID(BIT(ocelot->num_phys_ports)),
++ ANA_PGID_PGID_PGID(BIT(ocelot->num_phys_ports)),
++ ANA_PGID_PGID, PGID_MCIPV6);
++ ocelot_rmw_rix(ocelot, ANA_PGID_PGID_PGID(BIT(ocelot->num_phys_ports)),
++ ANA_PGID_PGID_PGID(BIT(ocelot->num_phys_ports)),
+ ANA_PGID_PGID, PGID_BC);
+- ocelot_write_rix(ocelot, 0, ANA_PGID_PGID, PGID_MCIPV4);
+- ocelot_write_rix(ocelot, 0, ANA_PGID_PGID, PGID_MCIPV6);
+
+ /* Allow manual injection via DEVCPU_QS registers, and byte swap these
+ * registers endianness.
projects / thirdparty / kernel / stable-queue.git / commitdiff
