From: Greg Kroah-Hartman Date: Tue, 21 Jul 2026 09:09:55 +0000 (+0200) Subject: 6.18-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=00af4d31159cb90e90b7f80a283fae1a1b9ca2a5;p=thirdparty%2Fkernel%2Fstable-queue.git 6.18-stable patches added patches: ata-pata_pxa-fix-dma-channel-leak-on-probe-error.patch fhandle-reject-detached-mounts-in-capable_wrt_mount.patch fsl-fman-free-init-resources-on-keygen-failure-in-fman_init.patch hwmon-asus_atk0110-check-package-count-before-accessing-element.patch hwmon-max1619-add-missing-select-regmap-to-kconfig.patch hwmon-occ-unregister-sysfs-devices-outside-occ-lock.patch hwmon-w83627hf-remove-vid-sysfs-files-on-error-and-remove.patch hwmon-w83793-remove-vrm-sysfs-file-on-probe-failure.patch net-lan743x-initialize-eth_syslock-spinlock-before-use.patch net-liquidio-fix-bar-resource-leak-on-pf-number-failure.patch net-mlx5-hws-fix-matcher-leak-on-resize-target-setup-failure.patch net-sched-sch_multiq-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch net-sched-sch_taprio-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch net-wwan-iosm-bound-device-offsets-in-the-mux-downlink-decoder.patch orangefs-keep-the-readdir-entry-size-64-bit-in-fill_from_part.patch riscv-probes-save-original-sp-in-rethook-trampoline.patch tracing-probes-fix-double-addition-of-offset-for-foffset.patch --- diff --git a/queue-6.18/ata-pata_pxa-fix-dma-channel-leak-on-probe-error.patch b/queue-6.18/ata-pata_pxa-fix-dma-channel-leak-on-probe-error.patch new file mode 100644 index 0000000000..dee8ce4bb6 --- /dev/null +++ b/queue-6.18/ata-pata_pxa-fix-dma-channel-leak-on-probe-error.patch @@ -0,0 +1,38 @@ +From fcaf242e7fc406e78f444a35441e3b58f5e28781 Mon Sep 17 00:00:00 2001 +From: Wentao Liang +Date: Thu, 25 Jun 2026 22:18:37 +0800 +Subject: ata: pata_pxa: Fix DMA channel leak on probe error + +From: Wentao Liang + +commit fcaf242e7fc406e78f444a35441e3b58f5e28781 upstream. + +When dmaengine_slave_config() fails, the DMA channel acquired by +dma_request_chan() is not released before returning the error, +leaking the channel reference. + +Fix by adding dma_release_channel() in the error path. + +The ata_host_activate() error path already correctly releases the +DMA channel. + +Cc: stable@vger.kernel.org +Fixes: 88622d80af82 ("ata: pata_pxa: dmaengine conversion") +Signed-off-by: Wentao Liang +Reviewed-by: Niklas Cassel +Signed-off-by: Damien Le Moal +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ata/pata_pxa.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/ata/pata_pxa.c ++++ b/drivers/ata/pata_pxa.c +@@ -286,6 +286,7 @@ static int pxa_ata_probe(struct platform + ret = dmaengine_slave_config(data->dma_chan, &config); + if (ret < 0) { + dev_err(&pdev->dev, "dma configuration failed: %d\n", ret); ++ dma_release_channel(data->dma_chan); + return ret; + } + diff --git a/queue-6.18/fhandle-reject-detached-mounts-in-capable_wrt_mount.patch b/queue-6.18/fhandle-reject-detached-mounts-in-capable_wrt_mount.patch new file mode 100644 index 0000000000..ff192db69a --- /dev/null +++ b/queue-6.18/fhandle-reject-detached-mounts-in-capable_wrt_mount.patch @@ -0,0 +1,48 @@ +From 6c732471740bc2ac9b0946134f9f551dc75f4369 Mon Sep 17 00:00:00 2001 +From: David Lee +Date: Wed, 1 Jul 2026 11:44:28 +0000 +Subject: fhandle: reject detached mounts in capable_wrt_mount() + +From: David Lee + +commit 6c732471740bc2ac9b0946134f9f551dc75f4369 upstream. + +The recent fhandle RCU fix moved the mount namespace capability check +into capable_wrt_mount(), so a non-NULL mnt_namespace survives the +ns_capable() dereference. The helper still assumes the later +READ_ONCE(mount->mnt_ns) must be non-NULL because may_decode_fh() +checked is_mounted() first. + +That assumption is not stable. A detached mount from +open_tree(..., OPEN_TREE_CLONE) can be dissolved on fput while +open_by_handle_at() is between those checks, and umount_tree() can +clear mount->mnt_ns. If the helper observes NULL, it dereferences +mnt_ns->user_ns and panics. + +Return false when the RCU read observes a detached mount. This keeps +the relaxed permission path conservative: a mount no longer attached +to a namespace cannot authorize open_by_handle_at() access. + +Fixes: 620c266f3949 ("fhandle: relax open_by_handle_at() permission checks") +Cc: stable@vger.kernel.org +Signed-off-by: David Lee +Assisted-by: LLM +Link: https://patch.msgid.link/20260701114438.24431-1-david.lee@trailofbits.com +Reviewed-by: Jeff Layton +Signed-off-by: Christian Brauner (Amutable) +Signed-off-by: Greg Kroah-Hartman +--- + fs/fhandle.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/fhandle.c ++++ b/fs/fhandle.c +@@ -297,7 +297,7 @@ static bool capable_wrt_mount(struct mou + */ + guard(rcu)(); + mnt_ns = READ_ONCE(mount->mnt_ns); +- return ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN); ++ return mnt_ns && ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN); + } + + static inline int may_decode_fh(struct handle_to_path_ctx *ctx, diff --git a/queue-6.18/fsl-fman-free-init-resources-on-keygen-failure-in-fman_init.patch b/queue-6.18/fsl-fman-free-init-resources-on-keygen-failure-in-fman_init.patch new file mode 100644 index 0000000000..351a74b6f6 --- /dev/null +++ b/queue-6.18/fsl-fman-free-init-resources-on-keygen-failure-in-fman_init.patch @@ -0,0 +1,41 @@ +From d288efa2b94abc2e45a061fceb156b4f4e5b37be Mon Sep 17 00:00:00 2001 +From: Haoxiang Li +Date: Thu, 25 Jun 2026 08:48:34 +0800 +Subject: fsl/fman: Free init resources on KeyGen failure in fman_init() + +From: Haoxiang Li + +commit d288efa2b94abc2e45a061fceb156b4f4e5b37be upstream. + +fman_muram_alloc() allocates initialization resources before +initializing the KeyGen block. If keygen_init() fails, the +function returns -EINVAL directly and leaves those resources +allocated. Free the initialization resources before returning +from the KeyGen failure path. + +Fixes: 7472f4f281d0 ("fsl/fman: enable FMan Keygen") +Cc: stable@kernel.org +Signed-off-by: Haoxiang Li +Reviewed-by: Pavan Chebbi +Reviewed-by: Breno Leitao +Link: https://patch.msgid.link/20260625004834.3394389-1-haoxiang_li2024@163.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/freescale/fman/fman.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/freescale/fman/fman.c ++++ b/drivers/net/ethernet/freescale/fman/fman.c +@@ -1995,8 +1995,10 @@ static int fman_init(struct fman *fman) + + /* Init KeyGen */ + fman->keygen = keygen_init(fman->kg_regs); +- if (!fman->keygen) ++ if (!fman->keygen) { ++ free_init_resources(fman); + return -EINVAL; ++ } + + err = enable(fman, cfg); + if (err != 0) diff --git a/queue-6.18/hwmon-asus_atk0110-check-package-count-before-accessing-element.patch b/queue-6.18/hwmon-asus_atk0110-check-package-count-before-accessing-element.patch new file mode 100644 index 0000000000..a3f94f9ccb --- /dev/null +++ b/queue-6.18/hwmon-asus_atk0110-check-package-count-before-accessing-element.patch @@ -0,0 +1,47 @@ +From e2735b39f044bad7bf2017aef248935525bc0b97 Mon Sep 17 00:00:00 2001 +From: HyeongJun An +Date: Fri, 19 Jun 2026 21:27:46 +0900 +Subject: hwmon: (asus_atk0110) Check package count before accessing element + +From: HyeongJun An + +commit e2735b39f044bad7bf2017aef248935525bc0b97 upstream. + +atk_ec_present() walks the management group package returned by the GGRP +ACPI method and, for each sub-package, reads its first element: + + id = &obj->package.elements[0]; + if (id->type != ACPI_TYPE_INTEGER) + +without checking that the sub-package is non-empty. ACPICA allocates the +element array with exactly package.count entries, so for a sub-package +with a zero count this reads past the allocation. + +The sibling function atk_debugfs_ggrp_open() performs the same access but +skips empty packages with a package.count check first. Add the same +check to atk_ec_present() so a malformed firmware package cannot trigger +an out-of-bounds read. + +Fixes: 9e6eba610c2e ("hwmon: (asus_atk0110) Enable the EC") +Cc: stable@vger.kernel.org +Assisted-by: Claude:claude-opus-4-8 +Signed-off-by: HyeongJun An +Link: https://lore.kernel.org/r/20260619122746.721981-1-sammiee5311@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/asus_atk0110.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/hwmon/asus_atk0110.c ++++ b/drivers/hwmon/asus_atk0110.c +@@ -1037,6 +1037,9 @@ static int atk_ec_present(struct atk_dat + if (obj->type != ACPI_TYPE_PACKAGE) + continue; + ++ if (!obj->package.count) ++ continue; ++ + id = &obj->package.elements[0]; + if (id->type != ACPI_TYPE_INTEGER) + continue; diff --git a/queue-6.18/hwmon-max1619-add-missing-select-regmap-to-kconfig.patch b/queue-6.18/hwmon-max1619-add-missing-select-regmap-to-kconfig.patch new file mode 100644 index 0000000000..84ba2d75d5 --- /dev/null +++ b/queue-6.18/hwmon-max1619-add-missing-select-regmap-to-kconfig.patch @@ -0,0 +1,33 @@ +From 943a749bdffdd2132fab9240db890e07d93e1fcf Mon Sep 17 00:00:00 2001 +From: Joshua Crofts +Date: Mon, 29 Jun 2026 21:17:39 +0200 +Subject: hwmon: (max1619) add missing 'select REGMAP' to Kconfig + +From: Joshua Crofts + +commit 943a749bdffdd2132fab9240db890e07d93e1fcf upstream. + +The Kconfig entry for the MAX1619 sensor doesn't contain a +`select REGMAP` parameter, causing build failures if regmap +isn't selected previously during the build process. + +Fixes: f8016132ce49 ("hwmon: (max1619) Convert to use regmap") +Cc: stable@vger.kernel.org +Signed-off-by: Joshua Crofts +Link: https://lore.kernel.org/r/20260629-add-kconfig-deps-v1-1-8104df929b1a@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/hwmon/Kconfig ++++ b/drivers/hwmon/Kconfig +@@ -1213,6 +1213,7 @@ config SENSORS_MAX16065 + config SENSORS_MAX1619 + tristate "Maxim MAX1619 sensor chip" + depends on I2C ++ select REGMAP + help + If you say yes here you get support for MAX1619 sensor chip. + diff --git a/queue-6.18/hwmon-occ-unregister-sysfs-devices-outside-occ-lock.patch b/queue-6.18/hwmon-occ-unregister-sysfs-devices-outside-occ-lock.patch new file mode 100644 index 0000000000..c47f64fe53 --- /dev/null +++ b/queue-6.18/hwmon-occ-unregister-sysfs-devices-outside-occ-lock.patch @@ -0,0 +1,163 @@ +From e31408734332b8cc611342cdaaab6ba492180156 Mon Sep 17 00:00:00 2001 +From: Runyu Xiao +Date: Fri, 19 Jun 2026 09:59:38 +0800 +Subject: hwmon: (occ) unregister sysfs devices outside occ lock + +From: Runyu Xiao + +commit e31408734332b8cc611342cdaaab6ba492180156 upstream. + +occ_active(false) and occ_shutdown() unregister sysfs-backed devices while +occ->lock is held. hwmon_device_unregister() and sysfs_remove_group() can +wait for active sysfs callbacks to drain, and those callbacks can enter the +OCC update path and try to take occ->lock again. That gives the unregister +paths the lock ordering occ->lock -> sysfs callback drain, while a callback +has the opposite edge sysfs callback -> occ->lock. + +This issue was found by our static analysis tool and then manually +reviewed against the current tree. + +The grounded PoC kept the real unregister and callback carrier: + + occ_shutdown() + hwmon_device_unregister() + occ_show_temp_1() + occ_update_response() + +Lockdep reported the circular dependency with occ_shutdown() already +holding the OCC mutex and hwmon_device_unregister() waiting on the sysfs +side: + + WARNING: possible circular locking dependency detected + ... (sysfs_lock) ... at: hwmon_device_unregister+0x12/0x30 [vuln_msv] + ... (&test_occ.lock) ... at: occ_shutdown.constprop.0+0xe/0x40 [vuln_msv] + occ_update_response.isra.0+0xb/0x20 [vuln_msv] + occ_show_temp_1.constprop.0.isra.0+0x23/0x40 [vuln_msv] + *** DEADLOCK *** + +Serialize hwmon registration and removal with a separate hwmon_lock. +Under that lock, detach occ->hwmon and update occ->active while occ->lock +is held so concurrent OCC state changes still see a stable state, then +drop occ->lock before calling hwmon_device_unregister(). Remove the +driver sysfs group before taking occ->lock in occ_shutdown(), so draining +the driver attributes cannot wait while the OCC mutex is held. Also make +OCC update callbacks return -ENODEV after deactivation, so callbacks that +already passed sysfs active protection do not poll the hardware after +teardown has detached the hwmon device. + +Fixes: 849b0156d996 ("hwmon: (occ) Delay hwmon registration until user request") +Fixes: ac6888ac5a11 ("hwmon: (occ) Lock mutex in shutdown to prevent race with occ_active") +Cc: stable@vger.kernel.org +Signed-off-by: Runyu Xiao +Link: https://lore.kernel.org/r/20260619015938.494464-1-runyu.xiao@seu.edu.cn +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/occ/common.c | 34 ++++++++++++++++++++++++++++------ + drivers/hwmon/occ/common.h | 1 + + 2 files changed, 29 insertions(+), 6 deletions(-) + +--- a/drivers/hwmon/occ/common.c ++++ b/drivers/hwmon/occ/common.c +@@ -214,6 +214,11 @@ int occ_update_response(struct occ *occ) + if (rc) + return rc; + ++ if (!occ->active) { ++ rc = -ENODEV; ++ goto unlock; ++ } ++ + /* limit the maximum rate of polling the OCC */ + if (time_after(jiffies, occ->next_update)) { + rc = occ_poll(occ); +@@ -222,6 +227,7 @@ int occ_update_response(struct occ *occ) + rc = occ->last_error; + } + ++unlock: + mutex_unlock(&occ->lock); + return rc; + } +@@ -1105,11 +1111,16 @@ static void occ_parse_poll_response(stru + + int occ_active(struct occ *occ, bool active) + { +- int rc = mutex_lock_interruptible(&occ->lock); ++ struct device *hwmon = NULL; ++ int rc = mutex_lock_interruptible(&occ->hwmon_lock); + + if (rc) + return rc; + ++ rc = mutex_lock_interruptible(&occ->lock); ++ if (rc) ++ goto unlock_hwmon; ++ + if (active) { + if (occ->active) { + rc = -EALREADY; +@@ -1154,14 +1165,17 @@ int occ_active(struct occ *occ, bool act + goto unlock; + } + +- if (occ->hwmon) +- hwmon_device_unregister(occ->hwmon); ++ hwmon = occ->hwmon; + occ->active = false; + occ->hwmon = NULL; + } + + unlock: + mutex_unlock(&occ->lock); ++ if (hwmon) ++ hwmon_device_unregister(hwmon); ++unlock_hwmon: ++ mutex_unlock(&occ->hwmon_lock); + return rc; + } + +@@ -1170,6 +1184,7 @@ int occ_setup(struct occ *occ) + int rc; + + mutex_init(&occ->lock); ++ mutex_init(&occ->hwmon_lock); + occ->groups[0] = &occ->group; + + rc = occ_setup_sysfs(occ); +@@ -1190,15 +1205,22 @@ EXPORT_SYMBOL_GPL(occ_setup); + + void occ_shutdown(struct occ *occ) + { +- mutex_lock(&occ->lock); ++ struct device *hwmon; + + occ_shutdown_sysfs(occ); + +- if (occ->hwmon) +- hwmon_device_unregister(occ->hwmon); ++ mutex_lock(&occ->hwmon_lock); ++ mutex_lock(&occ->lock); ++ ++ hwmon = occ->hwmon; ++ occ->active = false; + occ->hwmon = NULL; + + mutex_unlock(&occ->lock); ++ ++ if (hwmon) ++ hwmon_device_unregister(hwmon); ++ mutex_unlock(&occ->hwmon_lock); + } + EXPORT_SYMBOL_GPL(occ_shutdown); + +--- a/drivers/hwmon/occ/common.h ++++ b/drivers/hwmon/occ/common.h +@@ -101,6 +101,7 @@ struct occ { + + unsigned long next_update; + struct mutex lock; /* lock OCC access */ ++ struct mutex hwmon_lock; /* serialize hwmon registration/removal */ + + struct device *hwmon; + struct occ_attribute *attrs; diff --git a/queue-6.18/hwmon-w83627hf-remove-vid-sysfs-files-on-error-and-remove.patch b/queue-6.18/hwmon-w83627hf-remove-vid-sysfs-files-on-error-and-remove.patch new file mode 100644 index 0000000000..c62bc70775 --- /dev/null +++ b/queue-6.18/hwmon-w83627hf-remove-vid-sysfs-files-on-error-and-remove.patch @@ -0,0 +1,49 @@ +From 5264b389c4e02dec214a46c400eb3ab867a7749a Mon Sep 17 00:00:00 2001 +From: Pengpeng Hou +Date: Mon, 15 Jun 2026 14:47:31 +0800 +Subject: hwmon: (w83627hf) remove VID sysfs files on error and remove + +From: Pengpeng Hou + +commit 5264b389c4e02dec214a46c400eb3ab867a7749a upstream. + +w83627hf_probe() creates cpu0_vid and vrm with device_create_file() when +VID information is available. + +The error path and remove callback only remove the common and optional +attribute groups. Those groups do not contain cpu0_vid or vrm, so the +files can remain after a later probe failure or after device removal +while their callbacks still expect live driver data. + +Remove the standalone VID sysfs files from both the probe error path and +the remove callback. + +Signed-off-by: Pengpeng Hou +Link: https://lore.kernel.org/r/20260615064732.48113-1-pengpeng@iscas.ac.cn +Cc: stable@vger.kernel.org +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/w83627hf.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/hwmon/w83627hf.c ++++ b/drivers/hwmon/w83627hf.c +@@ -1823,6 +1823,8 @@ static int w83627hf_probe(struct platfor + return 0; + + error: ++ device_remove_file(dev, &dev_attr_vrm); ++ device_remove_file(dev, &dev_attr_cpu0_vid); + sysfs_remove_group(&dev->kobj, &w83627hf_group); + sysfs_remove_group(&dev->kobj, &w83627hf_group_opt); + return err; +@@ -1834,6 +1836,8 @@ static void w83627hf_remove(struct platf + + hwmon_device_unregister(data->hwmon_dev); + ++ device_remove_file(&pdev->dev, &dev_attr_vrm); ++ device_remove_file(&pdev->dev, &dev_attr_cpu0_vid); + sysfs_remove_group(&pdev->dev.kobj, &w83627hf_group); + sysfs_remove_group(&pdev->dev.kobj, &w83627hf_group_opt); + } diff --git a/queue-6.18/hwmon-w83793-remove-vrm-sysfs-file-on-probe-failure.patch b/queue-6.18/hwmon-w83793-remove-vrm-sysfs-file-on-probe-failure.patch new file mode 100644 index 0000000000..c52ff3122c --- /dev/null +++ b/queue-6.18/hwmon-w83793-remove-vrm-sysfs-file-on-probe-failure.patch @@ -0,0 +1,39 @@ +From 77b983757280c69b0290811669ff1d31022e5f1d Mon Sep 17 00:00:00 2001 +From: Pengpeng Hou +Date: Mon, 15 Jun 2026 14:48:06 +0800 +Subject: hwmon: (w83793) remove vrm sysfs file on probe failure + +From: Pengpeng Hou + +commit 77b983757280c69b0290811669ff1d31022e5f1d upstream. + +w83793_probe() creates the vrm sysfs file after creating the VID files +when VID support is present. + +The normal remove path deletes vrm, but the probe error path only +removes the sensor, SDA, VID, fan, PWM and temperature files. A later +probe failure can therefore leave vrm behind after the driver data has +been freed. + +Remove vrm in the probe error path next to the VID files, matching the +normal remove path. + +Signed-off-by: Pengpeng Hou +Link: https://lore.kernel.org/r/20260615064806.51139-1-pengpeng@iscas.ac.cn +Cc: stable@vger.kernel.org +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/w83793.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/hwmon/w83793.c ++++ b/drivers/hwmon/w83793.c +@@ -1917,6 +1917,7 @@ exit_remove: + + for (i = 0; i < ARRAY_SIZE(w83793_vid); i++) + device_remove_file(dev, &w83793_vid[i].dev_attr); ++ device_remove_file(dev, &dev_attr_vrm); + + for (i = 0; i < ARRAY_SIZE(w83793_left_fan); i++) + device_remove_file(dev, &w83793_left_fan[i].dev_attr); diff --git a/queue-6.18/net-lan743x-initialize-eth_syslock-spinlock-before-use.patch b/queue-6.18/net-lan743x-initialize-eth_syslock-spinlock-before-use.patch new file mode 100644 index 0000000000..ebbd31122c --- /dev/null +++ b/queue-6.18/net-lan743x-initialize-eth_syslock-spinlock-before-use.patch @@ -0,0 +1,46 @@ +From 39139b1c1c2b614096519b526112c726adb12ff0 Mon Sep 17 00:00:00 2001 +From: Andrea Righi +Date: Fri, 26 Jun 2026 18:32:18 +0200 +Subject: net: lan743x: Initialize eth_syslock spinlock before use + +From: Andrea Righi + +commit 39139b1c1c2b614096519b526112c726adb12ff0 upstream. + +lan743x_hardware_init() calls pci11x1x_strap_get_status() during the +PCI11x1x probe sequence. That helper acquires the Ethernet subsystem +hardware lock via lan743x_hs_syslock_acquire(), which relies on +adapter->eth_syslock_spinlock to serialize access. + +The spinlock is currently initialized only after the strap status is +read. With CONFIG_DEBUG_SPINLOCK enabled, taking the zeroed initialized +spinlock can trip the spinlock debug check. + +Fix by initializing adapter->eth_syslock_spinlock before reading the +strap status so the probe path never attempts to lock an uninitialized +spinlock. + +Fixes: 46b777ad9a8c ("net: lan743x: Add support to SGMII 1G and 2.5G") +Cc: stable@vger.kernel.org # v6.0+ +Signed-off-by: Andrea Righi +Reviewed-by: David Thompson +Reviewed-by: Thangaraj Samynathan +Link: https://patch.msgid.link/20260626163218.3591486-1-arighi@nvidia.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/microchip/lan743x_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/microchip/lan743x_main.c ++++ b/drivers/net/ethernet/microchip/lan743x_main.c +@@ -3536,8 +3536,8 @@ static int lan743x_hardware_init(struct + adapter->max_tx_channels = PCI11X1X_MAX_TX_CHANNELS; + adapter->used_tx_channels = PCI11X1X_USED_TX_CHANNELS; + adapter->max_vector_count = PCI11X1X_MAX_VECTOR_COUNT; +- pci11x1x_strap_get_status(adapter); + spin_lock_init(&adapter->eth_syslock_spinlock); ++ pci11x1x_strap_get_status(adapter); + mutex_init(&adapter->sgmii_rw_lock); + pci11x1x_set_rfe_rd_fifo_threshold(adapter); + sgmii_ctl = lan743x_csr_read(adapter, SGMII_CTL); diff --git a/queue-6.18/net-liquidio-fix-bar-resource-leak-on-pf-number-failure.patch b/queue-6.18/net-liquidio-fix-bar-resource-leak-on-pf-number-failure.patch new file mode 100644 index 0000000000..f31b077645 --- /dev/null +++ b/queue-6.18/net-liquidio-fix-bar-resource-leak-on-pf-number-failure.patch @@ -0,0 +1,64 @@ +From c63ee62a3c4ac1a1542f4c1a4b87e2f41df5a496 Mon Sep 17 00:00:00 2001 +From: Haoxiang Li +Date: Wed, 24 Jun 2026 14:40:13 +0800 +Subject: net: liquidio: fix BAR resource leak on PF number failure + +From: Haoxiang Li + +commit c63ee62a3c4ac1a1542f4c1a4b87e2f41df5a496 upstream. + +If cn23xx_get_pf_num() fails, the function returns without +unmapping either BAR. Unmap both BARs before returning from +the error path. + +Found by manual code review. + +Fixes: 0c45d7fe12c7 ("liquidio: fix use of pf in pass-through mode in a virtual machine") +Cc: stable@vger.kernel.org +Signed-off-by: Haoxiang Li +Reviewed-by: Larysa Zaremba +Link: https://patch.msgid.link/20260624064013.2809570-1-haoxiang_li2024@163.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c | 18 ++++++++-------- + 1 file changed, 10 insertions(+), 8 deletions(-) + +--- a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c ++++ b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c +@@ -1163,18 +1163,14 @@ int setup_cn23xx_octeon_pf_device(struct + if (octeon_map_pci_barx(oct, 1, MAX_BAR1_IOREMAP_SIZE)) { + dev_err(&oct->pci_dev->dev, "%s CN23XX BAR1 map failed\n", + __func__); +- octeon_unmap_pci_barx(oct, 0); +- return 1; ++ goto err_unmap_bar0; + } + + if (cn23xx_get_pf_num(oct) != 0) +- return 1; ++ goto err_unmap_bar1; + +- if (cn23xx_sriov_config(oct)) { +- octeon_unmap_pci_barx(oct, 0); +- octeon_unmap_pci_barx(oct, 1); +- return 1; +- } ++ if (cn23xx_sriov_config(oct)) ++ goto err_unmap_bar1; + + octeon_write_csr64(oct, CN23XX_SLI_MAC_CREDIT_CNT, 0x3F802080802080ULL); + +@@ -1205,6 +1201,12 @@ int setup_cn23xx_octeon_pf_device(struct + oct->coproc_clock_rate = 1000000ULL * cn23xx_coprocessor_clock(oct); + + return 0; ++ ++err_unmap_bar1: ++ octeon_unmap_pci_barx(oct, 1); ++err_unmap_bar0: ++ octeon_unmap_pci_barx(oct, 0); ++ return 1; + } + EXPORT_SYMBOL_GPL(setup_cn23xx_octeon_pf_device); + diff --git a/queue-6.18/net-mlx5-hws-fix-matcher-leak-on-resize-target-setup-failure.patch b/queue-6.18/net-mlx5-hws-fix-matcher-leak-on-resize-target-setup-failure.patch new file mode 100644 index 0000000000..f9cc03140b --- /dev/null +++ b/queue-6.18/net-mlx5-hws-fix-matcher-leak-on-resize-target-setup-failure.patch @@ -0,0 +1,48 @@ +From bb09d0e64ecaa0aa0f7d1133a1696ed74dead295 Mon Sep 17 00:00:00 2001 +From: Dawei Feng +Date: Mon, 29 Jun 2026 14:40:49 +0800 +Subject: net/mlx5: HWS, fix matcher leak on resize target setup failure + +From: Dawei Feng + +commit bb09d0e64ecaa0aa0f7d1133a1696ed74dead295 upstream. + +hws_bwc_matcher_move() allocates a replacement matcher before setting it +as the resize target. If mlx5hws_matcher_resize_set_target() fails, the +replacement matcher is not attached anywhere and is leaked. + +Fix the leak by destroying the replacement matcher before returning from +the resize-target failure path. + +The bug was first flagged by an experimental analysis tool we are +developing for kernel memory-management bugs while analyzing +v6.13-rc1. The tool is still under development and is not yet publicly +available. Manual inspection confirms that the bug is still +present in v7.1.1. + +An x86_64 allyesconfig build showed no new warnings. As we do not have a +mlx5 HWS-capable device to test with, no runtime testing was able to be +performed. + +Fixes: 2111bb970c78 ("net/mlx5: HWS, added backward-compatible API handling") +Cc: stable@vger.kernel.org +Signed-off-by: Dawei Feng +Reviewed-by: Yevgeny Kliteynik +Acked-by: Tariq Toukan +Link: https://patch.msgid.link/20260629064049.3852759-1-dawei.feng@seu.edu.cn +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c +@@ -205,6 +205,7 @@ static int hws_bwc_matcher_move(struct m + ret = mlx5hws_matcher_resize_set_target(old_matcher, new_matcher); + if (ret) { + mlx5hws_err(ctx, "Rehash error: failed setting resize target\n"); ++ mlx5hws_matcher_destroy(new_matcher); + return ret; + } + diff --git a/queue-6.18/net-sched-sch_multiq-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch b/queue-6.18/net-sched-sch_multiq-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch new file mode 100644 index 0000000000..e9d73d114b --- /dev/null +++ b/queue-6.18/net-sched-sch_multiq-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch @@ -0,0 +1,44 @@ +From 54f6b0c843e228d499eb4b6bbb89df68cad9ad5d Mon Sep 17 00:00:00 2001 +From: Bryam Vargas +Date: Thu, 25 Jun 2026 04:51:20 -0500 +Subject: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked + +From: Bryam Vargas + +commit 54f6b0c843e228d499eb4b6bbb89df68cad9ad5d upstream. + +multiq_dequeue() takes a packet from a band's child with a direct +->dequeue() call after multiq_peek() peeked it. When the child is +non-work-conserving the peek stashes the skb in the child's gso_skb, so +the direct dequeue returns a different skb and orphans the stash, +desyncing the child's qlen/backlog. With a qfq child reached through a +peeking parent (e.g. tbf) this re-enters the child on an emptied list and +dereferences NULL, panicking the kernel from softirq on ordinary egress. + +Take the packet through qdisc_dequeue_peeked(), as sch_prio already does +and as sch_red and sch_sfb were just fixed to do. The helper is a no-op +when the child has no stash, so a work-conserving child is unaffected. + +Fixes: 77be155cba4e ("pkt_sched: Add peek emulation for non-work-conserving qdiscs.") +Cc: stable@vger.kernel.org +Signed-off-by: Bryam Vargas +Reviewed-by: Victor Nogueira +Acked-by: Jamal Hadi Salim +Link: https://patch.msgid.link/20260625-b4-disp-31bcb279-v1-2-85c40b83c529@proton.me +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/sched/sch_multiq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/sched/sch_multiq.c ++++ b/net/sched/sch_multiq.c +@@ -103,7 +103,7 @@ static struct sk_buff *multiq_dequeue(st + if (!netif_xmit_stopped( + netdev_get_tx_queue(qdisc_dev(sch), q->curband))) { + qdisc = q->queues[q->curband]; +- skb = qdisc->dequeue(qdisc); ++ skb = qdisc_dequeue_peeked(qdisc); + if (skb) { + qdisc_bstats_update(sch, skb); + sch->q.qlen--; diff --git a/queue-6.18/net-sched-sch_taprio-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch b/queue-6.18/net-sched-sch_taprio-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch new file mode 100644 index 0000000000..74c0c891f2 --- /dev/null +++ b/queue-6.18/net-sched-sch_taprio-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch @@ -0,0 +1,45 @@ +From e056e1dfcddca877dd46d704e8ec9860cfc9ec44 Mon Sep 17 00:00:00 2001 +From: Bryam Vargas +Date: Thu, 25 Jun 2026 04:51:19 -0500 +Subject: net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked + +From: Bryam Vargas + +commit e056e1dfcddca877dd46d704e8ec9860cfc9ec44 upstream. + +When taprio's software path peeks a non-work-conserving child qdisc, the +child stashes the peeked skb in its gso_skb; taprio_dequeue_from_txq() +then takes the packet with a direct child ->dequeue() call, which ignores +that stash, orphans the peeked skb and desyncs the child's qlen/backlog. +With a qfq child this re-enters the child on an emptied list and +dereferences NULL, panicking the kernel from softirq on ordinary egress. + +Take the packet through qdisc_dequeue_peeked(), as sch_red and sch_sfb +now do. The helper returns the child's stashed skb first and is a no-op +when there is none, so a work-conserving child is unaffected and the +gated path now consumes the skb whose length was charged to the budget. + +Fixes: 5a781ccbd19e ("tc: Add support for configuring the taprio scheduler") +Cc: stable@vger.kernel.org +Cc: Vladimir Oltean +Signed-off-by: Bryam Vargas +Reviewed-by: Victor Nogueira +Acked-by: Jamal Hadi Salim +Link: https://patch.msgid.link/20260625-b4-disp-31bcb279-v1-1-85c40b83c529@proton.me +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/sched/sch_taprio.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/sched/sch_taprio.c ++++ b/net/sched/sch_taprio.c +@@ -748,7 +748,7 @@ static struct sk_buff *taprio_dequeue_fr + return NULL; + + skip_peek_checks: +- skb = child->ops->dequeue(child); ++ skb = qdisc_dequeue_peeked(child); + if (unlikely(!skb)) + return NULL; + diff --git a/queue-6.18/net-wwan-iosm-bound-device-offsets-in-the-mux-downlink-decoder.patch b/queue-6.18/net-wwan-iosm-bound-device-offsets-in-the-mux-downlink-decoder.patch new file mode 100644 index 0000000000..5d62765e44 --- /dev/null +++ b/queue-6.18/net-wwan-iosm-bound-device-offsets-in-the-mux-downlink-decoder.patch @@ -0,0 +1,130 @@ +From 526b8ef54668780c8f69e0211c342763d5dcbad1 Mon Sep 17 00:00:00 2001 +From: Maoyi Xie +Date: Thu, 25 Jun 2026 14:17:28 +0800 +Subject: net: wwan: iosm: bound device offsets in the MUX downlink decoder + +From: Maoyi Xie + +commit 526b8ef54668780c8f69e0211c342763d5dcbad1 upstream. + +mux_dl_adb_decode() walks a chain of aggregated datagram tables using +offsets and lengths taken from the modem. first_table_index, +next_table_index, table_length, datagram_index and datagram_length are +all device supplied le values. Only first_table_index was checked, and +only for being non zero. The decoder then formed adth = block + +adth_index and read the table header and the datagram entries with no +bound against the received skb. A modem that reports an index or a +length past the downlink buffer makes the decoder read out of bounds. + +The buffer is IPC_MEM_MAX_DL_MUX_LITE_BUF_SIZE and skb->len is at most +that, so skb->len is the real limit, but none of these in band offsets +were checked against it. + +The table chain is also followed with no forward progress check. The loop +takes the next table from adth->next_table_index and stops only when that +reaches zero. A modem can stage two tables that point at each other, so +the loop never ends. It runs in softirq and clones the skb on every pass. + +Validate every device offset and length against skb->len before use. +The block header must fit. Each table header, on entry and after every +next_table_index, must lie inside the skb. The datagram table must fit. +Each datagram index and length must stay inside the skb. The header +padding must not exceed the datagram length so the receive length does +not wrap. Require each next_table_index to move forward so the chain +cannot cycle. + +This was reproduced under KASAN as a slab out of bounds read on a normal +downlink receive once the iosm net device is up. + +Fixes: 1f52d7b62285 ("net: wwan: iosm: Enable M.2 7360 WWAN card support") +Suggested-by: Loic Poulain +Cc: stable@vger.kernel.org +Signed-off-by: Maoyi Xie +Reviewed-by: Simon Horman +Reviewed-by: Loic Poulain +Link: https://patch.msgid.link/178236824878.3259367.5389624724479864947@maoyixie.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | 40 +++++++++++++++++++++-------- + 1 file changed, 30 insertions(+), 10 deletions(-) + +--- a/drivers/net/wwan/iosm/iosm_ipc_mux_codec.c ++++ b/drivers/net/wwan/iosm/iosm_ipc_mux_codec.c +@@ -553,19 +553,21 @@ static int mux_dl_process_dg(struct iosm + u32 packet_offset, i, rc, dg_len; + + for (i = 0; i < nr_of_dg; i++, dg++) { +- if (le32_to_cpu(dg->datagram_index) +- < sizeof(struct mux_adbh)) ++ u32 dg_index = le32_to_cpu(dg->datagram_index); ++ ++ dg_len = le16_to_cpu(dg->datagram_length); ++ ++ if (dg_index < sizeof(struct mux_adbh)) + goto dg_error; + +- /* Is the packet inside of the ADB */ +- if (le32_to_cpu(dg->datagram_index) >= +- le32_to_cpu(adbh->block_length)) { ++ /* Is the packet inside of the ADB and the received skb ? */ ++ if (dg_index >= le32_to_cpu(adbh->block_length) || ++ dg_index >= skb->len || ++ dg_len > skb->len - dg_index || ++ dl_head_pad_len >= dg_len) { + goto dg_error; + } else { +- packet_offset = +- le32_to_cpu(dg->datagram_index) + +- dl_head_pad_len; +- dg_len = le16_to_cpu(dg->datagram_length); ++ packet_offset = dg_index + dl_head_pad_len; + /* Pass the packet to the netif layer. */ + rc = ipc_mux_net_receive(ipc_mux, if_id, ipc_mux->wwan, + packet_offset, +@@ -589,12 +591,16 @@ static void mux_dl_adb_decode(struct ios + struct mux_adbh *adbh; + struct mux_adth *adth; + int nr_of_dg, if_id; +- u32 adth_index; ++ u32 adth_index, prev_index = 0; + u8 *block; + + block = skb->data; + adbh = (struct mux_adbh *)block; + ++ /* The block header itself must fit in the received skb. */ ++ if (skb->len < sizeof(struct mux_adbh)) ++ goto adb_decode_err; ++ + /* Process the aggregated datagram tables. */ + adth_index = le32_to_cpu(adbh->first_table_index); + +@@ -606,6 +612,16 @@ static void mux_dl_adb_decode(struct ios + + /* Loop through mixed session tables. */ + while (adth_index) { ++ /* The table header must lie within the received skb, and the ++ * chain must move forward so a modem cannot make the loop ++ * cycle between two tables. ++ */ ++ if (adth_index <= prev_index || ++ adth_index < sizeof(struct mux_adbh) || ++ adth_index > skb->len - sizeof(struct mux_adth)) ++ goto adb_decode_err; ++ prev_index = adth_index; ++ + /* Get the reference to the table header. */ + adth = (struct mux_adth *)(block + adth_index); + +@@ -629,6 +645,10 @@ static void mux_dl_adb_decode(struct ios + if (le16_to_cpu(adth->table_length) < sizeof(struct mux_adth)) + goto adb_decode_err; + ++ /* The whole datagram table must fit in the received skb. */ ++ if (le16_to_cpu(adth->table_length) > skb->len - adth_index) ++ goto adb_decode_err; ++ + /* Calculate the number of datagrams. */ + nr_of_dg = (le16_to_cpu(adth->table_length) - + sizeof(struct mux_adth)) / diff --git a/queue-6.18/orangefs-keep-the-readdir-entry-size-64-bit-in-fill_from_part.patch b/queue-6.18/orangefs-keep-the-readdir-entry-size-64-bit-in-fill_from_part.patch new file mode 100644 index 0000000000..8f4f74d025 --- /dev/null +++ b/queue-6.18/orangefs-keep-the-readdir-entry-size-64-bit-in-fill_from_part.patch @@ -0,0 +1,51 @@ +From 18227a6bc98bd0ba96ed3ce9d5b28776a5a28dfc Mon Sep 17 00:00:00 2001 +From: Bryam Vargas +Date: Fri, 19 Jun 2026 04:38:20 -0500 +Subject: orangefs: keep the readdir entry size 64-bit in fill_from_part() + +From: Bryam Vargas + +commit 18227a6bc98bd0ba96ed3ce9d5b28776a5a28dfc upstream. + +fill_from_part() computes the size of a directory entry in size_t but +stores it in a __u32. An entry length near U32_MAX wraps it to a small +value, bypasses the bounds check, and is then used to index the entry, +reading far past the directory part -- an out-of-bounds read that oopses +the kernel. + +Compute the size as a u64 so it cannot truncate; the bounds check then +rejects the entry. The trailer is supplied by the userspace client. + +Fixes: 480e3e532e31 ("orangefs: support very large directories") +Cc: stable@vger.kernel.org +Signed-off-by: Bryam Vargas +Link: https://patch.msgid.link/20260619-b4-disp-50d2bd59-v1-1-ce332969b4a2@proton.me +Signed-off-by: Christian Brauner (Amutable) +Signed-off-by: Greg Kroah-Hartman +--- + fs/orangefs/dir.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/fs/orangefs/dir.c ++++ b/fs/orangefs/dir.c +@@ -190,7 +190,8 @@ static int fill_from_part(struct orangef + { + const int offset = sizeof(struct orangefs_readdir_response_s); + struct orangefs_khandle *khandle; +- __u32 *len, padlen; ++ __u32 *len; ++ u64 padlen; + loff_t i; + char *s; + i = ctx->pos & ~PART_MASK; +@@ -214,8 +215,8 @@ static int fill_from_part(struct orangef + * len is the size of the string itself. padlen is the + * total size of the encoded string. + */ +- padlen = (sizeof *len + *len + 1) + +- (8 - (sizeof *len + *len + 1)%8)%8; ++ padlen = (u64)sizeof *len + *len + 1; ++ padlen += (8 - padlen % 8) % 8; + if (part->len < i + padlen + sizeof *khandle) + goto next; + s = (void *)part + offset + i + sizeof *len; diff --git a/queue-6.18/riscv-probes-save-original-sp-in-rethook-trampoline.patch b/queue-6.18/riscv-probes-save-original-sp-in-rethook-trampoline.patch new file mode 100644 index 0000000000..fdb91c6c4b --- /dev/null +++ b/queue-6.18/riscv-probes-save-original-sp-in-rethook-trampoline.patch @@ -0,0 +1,59 @@ +From bc7b086a45521a986a49045907f017e3e46c763e Mon Sep 17 00:00:00 2001 +From: Martin Kaiser +Date: Tue, 30 Jun 2026 21:40:03 +0200 +Subject: riscv: probes: save original sp in rethook trampoline + +From: Martin Kaiser + +commit bc7b086a45521a986a49045907f017e3e46c763e upstream. + +Reading a word from the stack in a kretprobe crashes a risc-v kernel. + +$ cd /sys/kernel/tracing/ +$ echo 'r n_tty_write $stack0' > dynamic_events +$ echo 1 > events/kprobes/enable +Unable to handle kernel paging request at virtual address 0000000200000128 +... +[] regs_get_kernel_stack_nth+0x26/0x38 +[] process_fetch_insn+0x3ee/0x760 +[] kretprobe_trace_func+0x116/0x1f0 +[] kretprobe_dispatcher+0x4a/0x58 +[] kretprobe_rethook_handler+0x5e/0x90 +[] rethook_trampoline_handler+0x70/0x108 +[] arch_rethook_trampoline_callback+0x12/0x1c +[] arch_rethook_trampoline+0x48/0x94 +[] tty_write+0x1a/0x30 + +In regs_get_kernel_stack_nth, regs->sp contains an arbitrary value. + +arch_rethook_trampoline saves the registers from the probed function in a +struct pt_regs. sp is not saved. Instead, sp is decremented for +arch_rethook_trampoline's local stack. + +Fix this crash and save the original sp along with the other registers. +Use a0 as a temporary register, it is overwritten anyway. + +Cc: stable@vger.kernel.org +Fixes: c22b0bcb1dd02 ("riscv: Add kprobes supported") +Signed-off-by: Martin Kaiser +Acked-by: Masami Hiramatsu (Google) +Link: https://patch.msgid.link/20260630194010.1824039-1-martin@kaiser.cx +[pjw@kernel.org: added Fixes tag; cc'ed stable] +Signed-off-by: Paul Walmsley +Signed-off-by: Greg Kroah-Hartman +--- + arch/riscv/kernel/probes/rethook_trampoline.S | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/riscv/kernel/probes/rethook_trampoline.S ++++ b/arch/riscv/kernel/probes/rethook_trampoline.S +@@ -41,6 +41,9 @@ + REG_S x29, PT_T4(sp) + REG_S x30, PT_T5(sp) + REG_S x31, PT_T6(sp) ++ /* save original sp */ ++ addi a0, sp, PT_SIZE_ON_STACK ++ REG_S a0, PT_SP(sp) + .endm + + .macro restore_all_base_regs diff --git a/queue-6.18/selftests-bpf-cover-negative-buffer-pointer-offsets.patch b/queue-6.18/selftests-bpf-cover-negative-buffer-pointer-offsets.patch deleted file mode 100644 index c7318c8bb7..0000000000 --- a/queue-6.18/selftests-bpf-cover-negative-buffer-pointer-offsets.patch +++ /dev/null @@ -1,216 +0,0 @@ -From 6f59deb32efa4673fc3b1fef9f3a0da48e9d8494 Mon Sep 17 00:00:00 2001 -From: Sun Jian -Date: Tue, 14 Jul 2026 02:38:46 -0700 -Subject: selftests/bpf: Cover negative buffer pointer offsets - -From: Sun Jian - -commit 6f59deb32efa4673fc3b1fef9f3a0da48e9d8494 upstream. - -Add verifier coverage for constant negative offsets on PTR_TO_TP_BUFFER -and PTR_TO_BUF pointers. Both programs adjust the buffer pointer by -8 -and access it at offset zero, so the negative effective start must be -rejected at load time. - -Switch the raw tracepoint writable attach checks from nbd_send_request -to bpf_testmod_test_writable_bare_tp, avoiding a dependency on the NBD -tracepoint. Keep the existing past-end case and add a case with a -negative var_off compensated by a positive instruction offset. The -effective start remains non-negative, so the program loads, but its -access end exceeds the writable context size and -bpf_raw_tracepoint_open() must return -EINVAL. - -Cc: stable@vger.kernel.org # 5.2.0 -Signed-off-by: Sun Jian -Acked-by: Shung-Hsi Yu -Link: https://patch.msgid.link/20260714093846.18159-3-sun.jian.kdev@gmail.com -Signed-off-by: Eduard Zingerman -Signed-off-by: Greg Kroah-Hartman ---- - tools/testing/selftests/bpf/prog_tests/raw_tp_writable_reject_bad_access.c | 57 ++++++++++ - tools/testing/selftests/bpf/prog_tests/raw_tp_writable_reject_nbd_invalid.c | 43 ------- - tools/testing/selftests/bpf/prog_tests/verifier.c | 2 - tools/testing/selftests/bpf/progs/verifier_ptr_to_buf.c | 27 ++++ - tools/testing/selftests/bpf/progs/verifier_raw_tp_writable.c | 16 ++ - 5 files changed, 102 insertions(+), 43 deletions(-) - create mode 100644 tools/testing/selftests/bpf/prog_tests/raw_tp_writable_reject_bad_access.c - delete mode 100644 tools/testing/selftests/bpf/prog_tests/raw_tp_writable_reject_nbd_invalid.c - create mode 100644 tools/testing/selftests/bpf/progs/verifier_ptr_to_buf.c - ---- /dev/null -+++ b/tools/testing/selftests/bpf/prog_tests/raw_tp_writable_reject_bad_access.c -@@ -0,0 +1,57 @@ -+// SPDX-License-Identifier: GPL-2.0 -+ -+#include -+#include "test_kmods/bpf_testmod.h" -+#include "bpf_util.h" -+ -+static void check_attach_reject(const struct bpf_insn *program, size_t prog_len) -+{ -+ LIBBPF_OPTS(bpf_prog_load_opts, opts); -+ char error[4096]; -+ int bpf_fd, tp_fd; -+ -+ opts.log_level = 2; -+ opts.log_buf = error; -+ opts.log_size = sizeof(error); -+ -+ bpf_fd = bpf_prog_load(BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE, NULL, "GPL v2", -+ program, prog_len, &opts); -+ if (!ASSERT_GE(bpf_fd, 0, "prog_load")) -+ return; -+ -+ tp_fd = bpf_raw_tracepoint_open("bpf_testmod_test_writable_bare_tp", bpf_fd); -+ ASSERT_EQ(tp_fd, -EINVAL, "bpf_raw_tracepoint_open"); -+ if (tp_fd >= 0) -+ close(tp_fd); -+ -+ close(bpf_fd); -+} -+ -+void test_raw_tp_writable_reject_bad_access(void) -+{ -+ const struct bpf_insn program[] = { -+ /* r6 is our tp buffer */ -+ BPF_LDX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0), -+ /* one byte beyond the end of the writable context */ -+ BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_6, -+ sizeof(struct bpf_testmod_test_writable_ctx)), -+ BPF_EXIT_INSN(), -+ }; -+ -+ const struct bpf_insn negative_var_off_program[] = { -+ BPF_LDX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0), -+ /* make var_off negative, but keep the effective access offset non-negative */ -+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8), -+ /* one byte beyond the end of the writable context */ -+ BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_6, -+ sizeof(struct bpf_testmod_test_writable_ctx) + 8), -+ BPF_EXIT_INSN(), -+ }; -+ -+ if (test__start_subtest("past_end")) -+ check_attach_reject(program, ARRAY_SIZE(program)); -+ -+ if (test__start_subtest("negative_var_off_past_end")) -+ check_attach_reject(negative_var_off_program, -+ ARRAY_SIZE(negative_var_off_program)); -+} ---- a/tools/testing/selftests/bpf/prog_tests/raw_tp_writable_reject_nbd_invalid.c -+++ /dev/null -@@ -1,43 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0 -- --#include --#include --#include "bpf_util.h" -- --void test_raw_tp_writable_reject_nbd_invalid(void) --{ -- __u32 duration = 0; -- char error[4096]; -- int bpf_fd = -1, tp_fd = -1; -- -- const struct bpf_insn program[] = { -- /* r6 is our tp buffer */ -- BPF_LDX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0), -- /* one byte beyond the end of the nbd_request struct */ -- BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_6, -- sizeof(struct nbd_request)), -- BPF_EXIT_INSN(), -- }; -- -- LIBBPF_OPTS(bpf_prog_load_opts, opts, -- .log_level = 2, -- .log_buf = error, -- .log_size = sizeof(error), -- ); -- -- bpf_fd = bpf_prog_load(BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE, NULL, "GPL v2", -- program, ARRAY_SIZE(program), -- &opts); -- if (CHECK(bpf_fd < 0, "bpf_raw_tracepoint_writable load", -- "failed: %d errno %d\n", bpf_fd, errno)) -- return; -- -- tp_fd = bpf_raw_tracepoint_open("nbd_send_request", bpf_fd); -- if (CHECK(tp_fd >= 0, "bpf_raw_tracepoint_writable open", -- "erroneously succeeded\n")) -- goto out_bpffd; -- -- close(tp_fd); --out_bpffd: -- close(bpf_fd); --} ---- a/tools/testing/selftests/bpf/prog_tests/verifier.c -+++ b/tools/testing/selftests/bpf/prog_tests/verifier.c -@@ -68,6 +68,7 @@ - #include "verifier_precision.skel.h" - #include "verifier_prevent_map_lookup.skel.h" - #include "verifier_private_stack.skel.h" -+#include "verifier_ptr_to_buf.skel.h" - #include "verifier_raw_stack.skel.h" - #include "verifier_raw_tp_writable.skel.h" - #include "verifier_reg_equal.skel.h" -@@ -205,6 +206,7 @@ void test_verifier_or_jmp32_k(void) - void test_verifier_precision(void) { RUN(verifier_precision); } - void test_verifier_prevent_map_lookup(void) { RUN(verifier_prevent_map_lookup); } - void test_verifier_private_stack(void) { RUN(verifier_private_stack); } -+void test_verifier_ptr_to_buf(void) { RUN(verifier_ptr_to_buf); } - void test_verifier_raw_stack(void) { RUN(verifier_raw_stack); } - void test_verifier_raw_tp_writable(void) { RUN(verifier_raw_tp_writable); } - void test_verifier_reg_equal(void) { RUN(verifier_reg_equal); } ---- /dev/null -+++ b/tools/testing/selftests/bpf/progs/verifier_ptr_to_buf.c -@@ -0,0 +1,27 @@ -+// SPDX-License-Identifier: GPL-2.0 -+ -+#include -+#include -+#include "bpf_misc.h" -+ -+SEC("iter/bpf_map_elem") -+__description("PTR_TO_BUF: reject negative const offset") -+__failure -+__msg("invalid negative rdwr buffer offset") -+__naked void ptr_to_buf_reject_negative_const_offset(void) -+{ -+ asm volatile ("r0 = 0; \ -+ r2 = *(u64 *)(r1 + %[value_off]); \ -+ if r2 == 0 goto l0_%=; \ -+ r2 += -8; \ -+ r0 = *(u64 *)(r2 + 0); \ -+l0_%=: \ -+ exit; \ -+ " -+ : -+ : __imm_const(value_off, -+ offsetof(struct bpf_iter__bpf_map_elem, value)) -+ : __clobber_all); -+} -+ -+char _license[] SEC("license") = "GPL"; ---- a/tools/testing/selftests/bpf/progs/verifier_raw_tp_writable.c -+++ b/tools/testing/selftests/bpf/progs/verifier_raw_tp_writable.c -@@ -47,4 +47,20 @@ l0_%=: /* shift the buffer pointer to a - : __clobber_all); - } - -+SEC("raw_tracepoint.w") -+__description("raw_tracepoint_writable: reject negative const offset") -+__failure -+__msg("invalid negative tracepoint buffer offset") -+__naked void tracepoint_writable_reject_negative_const_offset(void) -+{ -+ asm volatile (" \ -+ r6 = *(u64 *)(r1 + 0); \ -+ r6 += -8; \ -+ r0 = *(u64 *)(r6 + 0); \ -+ exit; \ -+" : -+ : -+ : __clobber_all); -+} -+ - char _license[] SEC("license") = "GPL"; diff --git a/queue-6.18/series b/queue-6.18/series index 34b76263e8..412ec4cca3 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -1341,7 +1341,6 @@ can-bcm-add-missing-rcu-list-annotations-and-operations.patch bpf-reset-register-bounds-before-narrowing-retval-range-in-check_mem_access.patch bpf-fork-wipe-bpf_storage-before-bailouts-that-access-it.patch bpf-add-missing-access_ok-call-to-copy_user_syms.patch -selftests-bpf-cover-negative-buffer-pointer-offsets.patch block-remove-redundant-gd_need_part_scan-in-add_disk_final.patch block-fix-race-in-blk_time_get_ns-returning-0.patch block-fix-ioring_uring_cmd_reissue-flags-check-in-blkdev_uring_cmd.patch @@ -1432,3 +1431,20 @@ ipmi-fix-refcount-leak-in-i_ipmi_request.patch bnx2x-fix-potential-memory-leak-in-bnx2x_alloc_mem_bp.patch rtc-renesas-rtca3-fix-pie-clear-polling-condition-in-alarm-setup-error-path.patch rtc-mpfs-fix-counter-upload-completion-condition.patch +hwmon-w83627hf-remove-vid-sysfs-files-on-error-and-remove.patch +hwmon-w83793-remove-vrm-sysfs-file-on-probe-failure.patch +net-liquidio-fix-bar-resource-leak-on-pf-number-failure.patch +hwmon-occ-unregister-sysfs-devices-outside-occ-lock.patch +fsl-fman-free-init-resources-on-keygen-failure-in-fman_init.patch +net-lan743x-initialize-eth_syslock-spinlock-before-use.patch +net-sched-sch_multiq-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch +net-sched-sch_taprio-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch +fhandle-reject-detached-mounts-in-capable_wrt_mount.patch +hwmon-max1619-add-missing-select-regmap-to-kconfig.patch +tracing-probes-fix-double-addition-of-offset-for-foffset.patch +orangefs-keep-the-readdir-entry-size-64-bit-in-fill_from_part.patch +net-mlx5-hws-fix-matcher-leak-on-resize-target-setup-failure.patch +ata-pata_pxa-fix-dma-channel-leak-on-probe-error.patch +net-wwan-iosm-bound-device-offsets-in-the-mux-downlink-decoder.patch +hwmon-asus_atk0110-check-package-count-before-accessing-element.patch +riscv-probes-save-original-sp-in-rethook-trampoline.patch diff --git a/queue-6.18/tracing-probes-fix-double-addition-of-offset-for-foffset.patch b/queue-6.18/tracing-probes-fix-double-addition-of-offset-for-foffset.patch new file mode 100644 index 0000000000..bf218993a2 --- /dev/null +++ b/queue-6.18/tracing-probes-fix-double-addition-of-offset-for-foffset.patch @@ -0,0 +1,34 @@ +From 9a667b7750dda88cbf1cca96a53a2163b2ee71f7 Mon Sep 17 00:00:00 2001 +From: "Masami Hiramatsu (Google)" +Date: Thu, 25 Jun 2026 08:34:47 +0900 +Subject: tracing/probes: Fix double addition of offset for @+FOFFSET + +From: Masami Hiramatsu (Google) + +commit 9a667b7750dda88cbf1cca96a53a2163b2ee71f7 upstream. + +Since commit 533059281ee5 ("tracing: probeevent: Introduce new argument + fetching code") wrongly use @offset local variable during the parsing, +the offset value is added twice when dereferencing. +Reset the @offset after setting it in FETCH_OP_FOFFS. + +Link: https://lore.kernel.org/all/178217905962.643090.1978577464942171332.stgit@devnote2/ + +Fixes: 533059281ee5 ("tracing: probeevent: Introduce new argument fetching code") +Signed-off-by: Masami Hiramatsu (Google) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + kernel/trace/trace_probe.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/kernel/trace/trace_probe.c ++++ b/kernel/trace/trace_probe.c +@@ -1248,6 +1248,7 @@ parse_probe_arg(char *arg, const struct + + code->op = FETCH_OP_FOFFS; + code->immediate = (unsigned long)offset; // imm64? ++ offset = 0; + } else { + /* uprobes don't support symbols */ + if (!(ctx->flags & TPARG_FL_KERNEL)) {