From: Greg Kroah-Hartman Date: Fri, 3 Jul 2026 07:24:28 +0000 (+0200) Subject: drop some stable patches on request X-Git-Tag: v5.10.260~9 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=13fceefa93168b908c567b8bf4daa4017107fbcf;p=thirdparty%2Fkernel%2Fstable-queue.git drop some stable patches on request --- diff --git a/queue-6.1/futex-requeue-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch b/queue-6.1/futex-requeue-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch deleted file mode 100644 index 9a18eecd25..0000000000 --- a/queue-6.1/futex-requeue-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch +++ /dev/null @@ -1,48 +0,0 @@ -From stable+bounces-266564-greg=kroah.com@vger.kernel.org Tue Jun 16 21:53:00 2026 -From: Sasha Levin -Date: Tue, 16 Jun 2026 15:52:54 -0400 -Subject: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock -To: stable@vger.kernel.org -Cc: Ji'an Zhou , Thomas Gleixner , Sasha Levin -Message-ID: <20260616195254.3526787-1-sashal@kernel.org> - -From: Ji'an Zhou - -[ Upstream commit 74e144274af39935b0f410c0ee4d2b91c3730414 ] - -When FUTEX_CMP_REQUEUE_PI requeues a non-top waiter that already owns the -target PI futex, task_blocks_on_rt_mutex() returns -EDEADLK before setting -waiter->task. - -The subsequent remove_waiter() in rt_mutex_start_proxy_lock() dereferences -the NULL waiter->task, causing a kernel crash. - -Add a self-deadlock check for non-top waiters before calling -rt_mutex_start_proxy_lock(), analogous to the top-waiter check in -futex_lock_pi_atomic(). - -Fixes: 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349 ("rtmutex: Use waiter::task instead of current in remove_waiter()") -Signed-off-by: Ji'an Zhou -Signed-off-by: Thomas Gleixner -Cc: stable@vger.kernel.org -Signed-off-by: Sasha Levin -Signed-off-by: Greg Kroah-Hartman ---- - kernel/futex/requeue.c | 6 ++++++ - 1 file changed, 6 insertions(+) - ---- a/kernel/futex/requeue.c -+++ b/kernel/futex/requeue.c -@@ -629,6 +629,12 @@ retry_private: - continue; - } - -+ /* Self-deadlock: non-top waiter already owns the PI futex. */ -+ if (rt_mutex_owner(&pi_state->pi_mutex) == this->task) { -+ ret = -EDEADLK; -+ break; -+ } -+ - ret = rt_mutex_start_proxy_lock(&pi_state->pi_mutex, - this->rt_waiter, - this->task); diff --git a/queue-6.1/loongarch-report-dying-cpu-to-rcu-in-stop_this_cpu.patch b/queue-6.1/loongarch-report-dying-cpu-to-rcu-in-stop_this_cpu.patch deleted file mode 100644 index f0adb1f86b..0000000000 --- a/queue-6.1/loongarch-report-dying-cpu-to-rcu-in-stop_this_cpu.patch +++ /dev/null @@ -1,60 +0,0 @@ -From f2539c56c74691e7a88af6372ba2b48c06ed2fe4 Mon Sep 17 00:00:00 2001 -From: Huacai Chen -Date: Thu, 25 Jun 2026 13:03:49 +0800 -Subject: LoongArch: Report dying CPU to RCU in stop_this_cpu() - -From: Huacai Chen - -commit f2539c56c74691e7a88af6372ba2b48c06ed2fe4 upstream. - -This is a port of MIPS commit 9f3f3bdc6d9dac1 ("MIPS: smp: report dying -CPU to RCU in stop_this_cpu()"). smp_send_stop() parks all secondary -CPUs in stop_this_cpu(). And the function marks the CPU offline for the -scheduler via set_cpu_online(false) but never informs RCU, so RCU keeps -expecting a quiescent state from CPUs that are now spinning forever with -interrupts disabled. - -As long as nothing waits for an RCU grace period after smp_send_stop() -this is harmless, which is why it went unnoticed. However, since commit -91840be8f710370 ("irq_work: Fix use-after-free in irq_work_single() on -PREEMPT_RT"), irq_work_sync() calls synchronize_rcu() on architectures -without an irq_work self-IPI, i.e. where arch_irq_work_has_interrupt() -returns false. Any irq_work_sync() issued in the reboot/shutdown/halt -path after smp_send_stop() then blocks on a grace period that can never -complete, hanging the reboot: - - WARNING: CPU: 0 PID: 15 at kernel/irq_work.c:144 irq_work_queue_on - ... - rcu: INFO: rcu_sched detected stalls on CPUs/tasks: - rcu: Offline CPU 1 blocking current GP. - rcu: Offline CPU 2 blocking current GP. - rcu: Offline CPU 3 blocking current GP. - -This issue needs some hacks to reproduce, and it was not noticed on -LoongArch because arch_irq_work_has_interrupt() usually returns true. - -Call rcutree_report_cpu_dead() once interrupts are disabled, mirroring -the generic CPU-hotplug offline path, so RCU stops waiting on the parked -CPUs and grace periods can still complete. LoongArch shuts down all CPUs -here without going through the CPU-hotplug mechanism, so this report is -not otherwise issued. - -Cc: -Fixes: 91840be8f710 ("irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT") -Reviewed-by: Guo Ren -Signed-off-by: Huacai Chen -Signed-off-by: Greg Kroah-Hartman ---- - arch/loongarch/kernel/smp.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/arch/loongarch/kernel/smp.c -+++ b/arch/loongarch/kernel/smp.c -@@ -517,6 +517,7 @@ static void stop_this_cpu(void *dummy) - set_cpu_online(smp_processor_id(), false); - calculate_cpu_foreign_map(); - local_irq_disable(); -+ rcutree_report_cpu_dead(); - while (true); - } - diff --git a/queue-6.1/series b/queue-6.1/series index cf84113b60..38d545c20a 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -92,7 +92,6 @@ mips-dec-prevent-initial-console-buffer-from-landing-in-xkphys.patch exfat-fix-potential-use-after-free-in-exfat_find_dir_entry.patch hdlc_ppp-sync-per-proto-timers-before-freeing-hdlc-state.patch tipc-fix-slab-use-after-free-read-in-tipc_aead_decrypt_done.patch -loongarch-report-dying-cpu-to-rcu-in-stop_this_cpu.patch pnfs-fix-use-after-free-in-pnfs_update_layout.patch irqchip-imgpdc-fix-resource-leak-add-missing-chained-handler-cleanup-on-remove.patch fpga-region-fix-use-after-free-in-child_regions_with_firmware.patch @@ -114,7 +113,6 @@ mptcp-fix-missing-wakeups-in-edge-scenarios.patch hv-utils-handle-and-propagate-errors-in-kvp_register.patch misc-fastrpc-add-dma_mask-to-fastrpc_channel_ctx.patch misc-fastrpc-fix-null-pointer-dereference-in-rpmsg-callback.patch -futex-requeue-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch drivers-hv-vmbus-improve-the-logic-of-reserving-fb_mmio-on-gen2-vms.patch locking-rtmutex-skip-remove_waiter-when-waiter-is-not-enqueued.patch phonet-pass-ifindex-to-fill_addr.patch diff --git a/queue-6.12/futex-requeue-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch b/queue-6.12/futex-requeue-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch deleted file mode 100644 index 2ca1ebb5db..0000000000 --- a/queue-6.12/futex-requeue-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch +++ /dev/null @@ -1,48 +0,0 @@ -From stable+bounces-266506-greg=kroah.com@vger.kernel.org Tue Jun 16 20:06:16 2026 -From: Sasha Levin -Date: Tue, 16 Jun 2026 15:05:55 -0400 -Subject: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock -To: stable@vger.kernel.org -Cc: Ji'an Zhou , Thomas Gleixner , Sasha Levin -Message-ID: <20260616190556.3487341-1-sashal@kernel.org> - -From: Ji'an Zhou - -[ Upstream commit 74e144274af39935b0f410c0ee4d2b91c3730414 ] - -When FUTEX_CMP_REQUEUE_PI requeues a non-top waiter that already owns the -target PI futex, task_blocks_on_rt_mutex() returns -EDEADLK before setting -waiter->task. - -The subsequent remove_waiter() in rt_mutex_start_proxy_lock() dereferences -the NULL waiter->task, causing a kernel crash. - -Add a self-deadlock check for non-top waiters before calling -rt_mutex_start_proxy_lock(), analogous to the top-waiter check in -futex_lock_pi_atomic(). - -Fixes: 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349 ("rtmutex: Use waiter::task instead of current in remove_waiter()") -Signed-off-by: Ji'an Zhou -Signed-off-by: Thomas Gleixner -Cc: stable@vger.kernel.org -Signed-off-by: Sasha Levin -Signed-off-by: Greg Kroah-Hartman ---- - kernel/futex/requeue.c | 6 ++++++ - 1 file changed, 6 insertions(+) - ---- a/kernel/futex/requeue.c -+++ b/kernel/futex/requeue.c -@@ -633,6 +633,12 @@ retry_private: - continue; - } - -+ /* Self-deadlock: non-top waiter already owns the PI futex. */ -+ if (rt_mutex_owner(&pi_state->pi_mutex) == this->task) { -+ ret = -EDEADLK; -+ break; -+ } -+ - ret = rt_mutex_start_proxy_lock(&pi_state->pi_mutex, - this->rt_waiter, - this->task); diff --git a/queue-6.12/series b/queue-6.12/series index f66ae5ddb3..3f1b986de2 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -46,7 +46,6 @@ staging-rtl8723bs-fix-buffer-over-read-in-rtw_update_protection.patch fhandle-fix-uaf-due-to-unlocked-mnt_ns-read-in-may_decode_fh.patch drivers-hv-vmbus-improve-the-logic-of-reserving-fb_mmio-on-gen2-vms.patch hv-utils-handle-and-propagate-errors-in-kvp_register.patch -futex-requeue-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch locking-mutex-remove-wakeups-from-under-mutex-wait_lock.patch locking-rtmutex-skip-remove_waiter-when-waiter-is-not-enqueued.patch phonet-pass-ifindex-to-fill_addr.patch diff --git a/queue-6.6/futex-requeue-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch b/queue-6.6/futex-requeue-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch deleted file mode 100644 index c9de29e4e0..0000000000 --- a/queue-6.6/futex-requeue-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch +++ /dev/null @@ -1,48 +0,0 @@ -From stable+bounces-266562-greg=kroah.com@vger.kernel.org Tue Jun 16 20:21:34 2026 -From: Sasha Levin -Date: Tue, 16 Jun 2026 15:21:28 -0400 -Subject: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock -To: stable@vger.kernel.org -Cc: Ji'an Zhou , Thomas Gleixner , Sasha Levin -Message-ID: <20260616192128.3499944-1-sashal@kernel.org> - -From: Ji'an Zhou - -[ Upstream commit 74e144274af39935b0f410c0ee4d2b91c3730414 ] - -When FUTEX_CMP_REQUEUE_PI requeues a non-top waiter that already owns the -target PI futex, task_blocks_on_rt_mutex() returns -EDEADLK before setting -waiter->task. - -The subsequent remove_waiter() in rt_mutex_start_proxy_lock() dereferences -the NULL waiter->task, causing a kernel crash. - -Add a self-deadlock check for non-top waiters before calling -rt_mutex_start_proxy_lock(), analogous to the top-waiter check in -futex_lock_pi_atomic(). - -Fixes: 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349 ("rtmutex: Use waiter::task instead of current in remove_waiter()") -Signed-off-by: Ji'an Zhou -Signed-off-by: Thomas Gleixner -Cc: stable@vger.kernel.org -Signed-off-by: Sasha Levin -Signed-off-by: Greg Kroah-Hartman ---- - kernel/futex/requeue.c | 6 ++++++ - 1 file changed, 6 insertions(+) - ---- a/kernel/futex/requeue.c -+++ b/kernel/futex/requeue.c -@@ -629,6 +629,12 @@ retry_private: - continue; - } - -+ /* Self-deadlock: non-top waiter already owns the PI futex. */ -+ if (rt_mutex_owner(&pi_state->pi_mutex) == this->task) { -+ ret = -EDEADLK; -+ break; -+ } -+ - ret = rt_mutex_start_proxy_lock(&pi_state->pi_mutex, - this->rt_waiter, - this->task); diff --git a/queue-6.6/loongarch-report-dying-cpu-to-rcu-in-stop_this_cpu.patch b/queue-6.6/loongarch-report-dying-cpu-to-rcu-in-stop_this_cpu.patch deleted file mode 100644 index 4d6a70bb18..0000000000 --- a/queue-6.6/loongarch-report-dying-cpu-to-rcu-in-stop_this_cpu.patch +++ /dev/null @@ -1,60 +0,0 @@ -From f2539c56c74691e7a88af6372ba2b48c06ed2fe4 Mon Sep 17 00:00:00 2001 -From: Huacai Chen -Date: Thu, 25 Jun 2026 13:03:49 +0800 -Subject: LoongArch: Report dying CPU to RCU in stop_this_cpu() - -From: Huacai Chen - -commit f2539c56c74691e7a88af6372ba2b48c06ed2fe4 upstream. - -This is a port of MIPS commit 9f3f3bdc6d9dac1 ("MIPS: smp: report dying -CPU to RCU in stop_this_cpu()"). smp_send_stop() parks all secondary -CPUs in stop_this_cpu(). And the function marks the CPU offline for the -scheduler via set_cpu_online(false) but never informs RCU, so RCU keeps -expecting a quiescent state from CPUs that are now spinning forever with -interrupts disabled. - -As long as nothing waits for an RCU grace period after smp_send_stop() -this is harmless, which is why it went unnoticed. However, since commit -91840be8f710370 ("irq_work: Fix use-after-free in irq_work_single() on -PREEMPT_RT"), irq_work_sync() calls synchronize_rcu() on architectures -without an irq_work self-IPI, i.e. where arch_irq_work_has_interrupt() -returns false. Any irq_work_sync() issued in the reboot/shutdown/halt -path after smp_send_stop() then blocks on a grace period that can never -complete, hanging the reboot: - - WARNING: CPU: 0 PID: 15 at kernel/irq_work.c:144 irq_work_queue_on - ... - rcu: INFO: rcu_sched detected stalls on CPUs/tasks: - rcu: Offline CPU 1 blocking current GP. - rcu: Offline CPU 2 blocking current GP. - rcu: Offline CPU 3 blocking current GP. - -This issue needs some hacks to reproduce, and it was not noticed on -LoongArch because arch_irq_work_has_interrupt() usually returns true. - -Call rcutree_report_cpu_dead() once interrupts are disabled, mirroring -the generic CPU-hotplug offline path, so RCU stops waiting on the parked -CPUs and grace periods can still complete. LoongArch shuts down all CPUs -here without going through the CPU-hotplug mechanism, so this report is -not otherwise issued. - -Cc: -Fixes: 91840be8f710 ("irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT") -Reviewed-by: Guo Ren -Signed-off-by: Huacai Chen -Signed-off-by: Greg Kroah-Hartman ---- - arch/loongarch/kernel/smp.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/arch/loongarch/kernel/smp.c -+++ b/arch/loongarch/kernel/smp.c -@@ -613,6 +613,7 @@ static void stop_this_cpu(void *dummy) - set_cpu_online(smp_processor_id(), false); - calculate_cpu_foreign_map(); - local_irq_disable(); -+ rcutree_report_cpu_dead(); - while (true); - } - diff --git a/queue-6.6/series b/queue-6.6/series index 0c3cb0ccac..65942742a8 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -31,7 +31,6 @@ dlm-prevent-npd-when-writing-a-positive-value-to-event_done.patch netfilter-nf_tables-always-walk-all-pending-catchall-elements.patch mptcp-pm-fix-extra_subflows-underflow-on-userspace-pm-subflow-creation.patch hv-utils-handle-and-propagate-errors-in-kvp_register.patch -futex-requeue-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch drivers-hv-vmbus-improve-the-logic-of-reserving-fb_mmio-on-gen2-vms.patch locking-rtmutex-skip-remove_waiter-when-waiter-is-not-enqueued.patch phonet-pass-ifindex-to-fill_addr.patch @@ -146,7 +145,6 @@ gfs2-fix-use-after-free-in-gfs2_qd_dealloc.patch hdlc_ppp-sync-per-proto-timers-before-freeing-hdlc-state.patch blk-cgroup-fix-uaf-in-__blkcg_rstat_flush.patch tipc-fix-slab-use-after-free-read-in-tipc_aead_decrypt_done.patch -loongarch-report-dying-cpu-to-rcu-in-stop_this_cpu.patch pnfs-fix-use-after-free-in-pnfs_update_layout.patch irqchip-imgpdc-fix-resource-leak-add-missing-chained-handler-cleanup-on-remove.patch fpga-region-fix-use-after-free-in-child_regions_with_firmware.patch