From: Greg Kroah-Hartman Date: Mon, 20 Jul 2026 16:33:09 +0000 (+0200) Subject: 6.18-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4fb4001e98abbc40601b7b2cec275e54cdbc4a32;p=thirdparty%2Fkernel%2Fstable-queue.git 6.18-stable patches added patches: drm-xe-userptr-stub-notifier_lock-helpers-when-drm_gpusvm-n.patch net-sched-sch_teql-move-rcu_read_lock-spin_lock-from-_bh-variants.patch platform-x86-amd-pmc-avoid-logging-null-for-dmi-values.patch --- diff --git a/queue-6.18/drm-xe-userptr-stub-notifier_lock-helpers-when-drm_gpusvm-n.patch b/queue-6.18/drm-xe-userptr-stub-notifier_lock-helpers-when-drm_gpusvm-n.patch new file mode 100644 index 0000000000..ada4f49aeb --- /dev/null +++ b/queue-6.18/drm-xe-userptr-stub-notifier_lock-helpers-when-drm_gpusvm-n.patch @@ -0,0 +1,62 @@ +From f5ef65adf81da3dbce4e692e48c1754c0bb95da0 Mon Sep 17 00:00:00 2001 +From: Shuicheng Lin +Date: Tue, 30 Jun 2026 19:22:21 +0000 +Subject: drm/xe/userptr: Stub notifier_lock helpers when DRM_GPUSVM=n +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Shuicheng Lin + +commit f5ef65adf81da3dbce4e692e48c1754c0bb95da0 upstream. + +When CONFIG_DRM_GPUSVM=n (e.g. um-allyesconfig), the only caller of +xe_pt_svm_userptr_notifier_lock() is compiled out, triggering: + + drivers/gpu/drm/xe/xe_pt.c:1418:13: warning: + 'xe_pt_svm_userptr_notifier_lock' defined but not used + [-Wunused-function] + +The helpers cannot simply be removed in this case: the matching +xe_pt_svm_userptr_notifier_unlock() is also referenced from +xe_pt_update_ops_run(), which lives outside any DRM_GPUSVM ifdef and is +gated only at runtime by pt_update_ops->needs_svm_lock. The symbol must +exist in all builds. + +Provide empty static inline stubs for !DRM_GPUSVM, matching the pattern +used by xe_svm_notifier_lock()/_unlock() in xe_svm.h. + +Fixes: dca6e08c923a ("drm/xe/userptr: Hold notifier_lock for write on inject test path") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202606302210.QqcLbOEN-lkp@intel.com/ +Reviewed-by: Matthew Brost +Link: https://patch.msgid.link/20260630192221.2998168-1-shuicheng.lin@intel.com +Signed-off-by: Shuicheng Lin +(cherry picked from commit 3359422bf0a1140e96d783a19a397686e580a3ca) +Signed-off-by: Thomas Hellström +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/xe/xe_pt.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/gpu/drm/xe/xe_pt.c ++++ b/drivers/gpu/drm/xe/xe_pt.c +@@ -1388,6 +1388,7 @@ static int xe_pt_pre_commit(struct xe_mi + pt_update_ops, rftree); + } + ++#if IS_ENABLED(CONFIG_DRM_GPUSVM) + /* + * Acquire/release the svm notifier_lock around xe_pt_svm_userptr_pre_commit() + * and the matching late release in xe_pt_update_ops_run(). Read mode by +@@ -1414,6 +1415,10 @@ static void xe_pt_svm_userptr_notifier_u + xe_svm_notifier_unlock(vm); + #endif + } ++#else ++static inline void xe_pt_svm_userptr_notifier_lock(struct xe_vm *vm) { } ++static inline void xe_pt_svm_userptr_notifier_unlock(struct xe_vm *vm) { } ++#endif + + #if IS_ENABLED(CONFIG_DRM_GPUSVM) + #ifdef CONFIG_DRM_XE_USERPTR_INVAL_INJECT diff --git a/queue-6.18/net-sched-sch_teql-move-rcu_read_lock-spin_lock-from-_bh-variants.patch b/queue-6.18/net-sched-sch_teql-move-rcu_read_lock-spin_lock-from-_bh-variants.patch new file mode 100644 index 0000000000..ab7448fe53 --- /dev/null +++ b/queue-6.18/net-sched-sch_teql-move-rcu_read_lock-spin_lock-from-_bh-variants.patch @@ -0,0 +1,118 @@ +From 6301f6a34ed86fe6f3b7b3211ea069f3677fc559 Mon Sep 17 00:00:00 2001 +From: Jamal Hadi Salim +Date: Tue, 30 Jun 2026 11:09:22 -0400 +Subject: net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants + +From: Jamal Hadi Salim + +commit 6301f6a34ed86fe6f3b7b3211ea069f3677fc559 upstream. + +This is a followup based on sashiko comments [1] on commit e5b811fe7931 +("net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF") + +Use plain rcu_read_lock()/spin_lock() in teql_master_xmit() instead of the +_bh variants, since ndo_start_xmit is already invoked with BH disabled +by the core stack and the _bh primitives can warn in_hardirq() when xmit +is reached through netpoll or a softirq xmit path with hard IRQs disabled. + +Moves rcu_read_lock() after restart: label + adds rcu_read_unlock() before +goto restart (fixes the unbounded RCU hold across retries) + +[1] https://sashiko.dev/#/patchset/20260628111229.669751-1-jhs%40mojatatu.com + +Signed-off-by: Jamal Hadi Salim +Fixes: e5b811fe7931 ("net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF") +Link: https://patch.msgid.link/20260630150922.238714-1-jhs@mojatatu.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + net/sched/sch_teql.c | 27 ++++++++++++++------------- + 1 file changed, 14 insertions(+), 13 deletions(-) + +--- a/net/sched/sch_teql.c ++++ b/net/sched/sch_teql.c +@@ -311,14 +311,14 @@ static netdev_tx_t teql_master_xmit(stru + int subq = skb_get_queue_mapping(skb); + struct sk_buff *skb_res = NULL; + +- rcu_read_lock_bh(); +- +- start = rcu_dereference_bh(master->slaves); +- + restart: + nores = 0; + busy = 0; + ++ rcu_read_lock(); ++ ++ start = rcu_dereference(master->slaves); ++ + q = start; + if (!q) + goto drop; +@@ -345,17 +345,17 @@ restart: + netdev_start_xmit(skb, slave, slave_txq, false) == + NETDEV_TX_OK) { + __netif_tx_unlock(slave_txq); +- spin_lock_bh(&master->slaves_lock); ++ spin_lock(&master->slaves_lock); + if (rcu_dereference_protected(master->slaves, + lockdep_is_held(&master->slaves_lock)) == q) + rcu_assign_pointer(master->slaves, + rcu_dereference_protected(NEXT_SLAVE(q), + lockdep_is_held(&master->slaves_lock))); +- spin_unlock_bh(&master->slaves_lock); ++ spin_unlock(&master->slaves_lock); + netif_wake_queue(dev); + master->tx_packets++; + master->tx_bytes += length; +- rcu_read_unlock_bh(); ++ rcu_read_unlock(); + return NETDEV_TX_OK; + } + __netif_tx_unlock(slave_txq); +@@ -364,37 +364,38 @@ restart: + busy = 1; + break; + case 1: +- spin_lock_bh(&master->slaves_lock); ++ spin_lock(&master->slaves_lock); + if (rcu_dereference_protected(master->slaves, + lockdep_is_held(&master->slaves_lock)) == q) + rcu_assign_pointer(master->slaves, + rcu_dereference_protected(NEXT_SLAVE(q), + lockdep_is_held(&master->slaves_lock))); +- spin_unlock_bh(&master->slaves_lock); +- rcu_read_unlock_bh(); ++ spin_unlock(&master->slaves_lock); ++ rcu_read_unlock(); + return NETDEV_TX_OK; + default: + nores = 1; + break; + } + __skb_pull(skb, skb_network_offset(skb)); +- } while ((q = rcu_dereference_bh(NEXT_SLAVE(q))) != start); ++ } while ((q = rcu_dereference(NEXT_SLAVE(q))) != start); + + if (nores && skb_res == NULL) { + skb_res = skb; ++ rcu_read_unlock(); + goto restart; + } + + if (busy) { + netif_stop_queue(dev); +- rcu_read_unlock_bh(); ++ rcu_read_unlock(); + return NETDEV_TX_BUSY; + } + master->tx_errors++; + + drop: + master->tx_dropped++; +- rcu_read_unlock_bh(); ++ rcu_read_unlock(); + dev_kfree_skb(skb); + return NETDEV_TX_OK; + } diff --git a/queue-6.18/platform-x86-amd-pmc-avoid-logging-null-for-dmi-values.patch b/queue-6.18/platform-x86-amd-pmc-avoid-logging-null-for-dmi-values.patch new file mode 100644 index 0000000000..caf3c33c48 --- /dev/null +++ b/queue-6.18/platform-x86-amd-pmc-avoid-logging-null-for-dmi-values.patch @@ -0,0 +1,51 @@ +From a0738abd042f7406edd2175a819cf2e66388ed97 Mon Sep 17 00:00:00 2001 +From: Daniel Gibson +Date: Sat, 27 Jun 2026 00:02:10 +0200 +Subject: platform/x86/amd/pmc: Avoid logging "(null)" for DMI values +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Daniel Gibson + +commit a0738abd042f7406edd2175a819cf2e66388ed97 upstream. + +dmi_get_system_info(...) can return NULL. Using that as %s arguments +of dev_info() would log "(null)" (as part of a message like +'... System Vendor: "(null)", Product Name: "(null)" ...'), which may +be confusing for users. + +Use Elvis operator to print "(Unknown)" instead. + +Fixes: 428b9fd2dce5 ("platform/x86/amd/pmc: Add delay_suspend module parameter") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202606251540.Nr2BtaNu-lkp@intel.com/ +Suggested-by: Ilpo Järvinen +Signed-off-by: Daniel Gibson +Link: https://patch.msgid.link/20260626220210.1761783-2-daniel@gibson.sh +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/x86/amd/pmc/pmc.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/platform/x86/amd/pmc/pmc.c ++++ b/drivers/platform/x86/amd/pmc/pmc.c +@@ -660,11 +660,11 @@ static bool amd_pmc_want_suspend_delay(s + } else if (delay_suspend == 1) { + if (!intermediate_wakeup) + dev_info(pdev->dev, "Delaying suspend by 2.5s because delay_suspend=1. If this solves problems on your machine, please report this whole line to: platform-driver-x86@vger.kernel.org so it can be automatically detected as affected in the future. System Vendor: \"%s\" Product Name: \"%s\" Product Family: \"%s\" Board Vendor: \"%s\" Board Name: \"%s\"\n", +- dmi_get_system_info(DMI_SYS_VENDOR), +- dmi_get_system_info(DMI_PRODUCT_NAME), +- dmi_get_system_info(DMI_PRODUCT_FAMILY), +- dmi_get_system_info(DMI_BOARD_VENDOR), +- dmi_get_system_info(DMI_BOARD_NAME)); ++ dmi_get_system_info(DMI_SYS_VENDOR) ?: "(Unknown)", ++ dmi_get_system_info(DMI_PRODUCT_NAME) ?: "(Unknown)", ++ dmi_get_system_info(DMI_PRODUCT_FAMILY) ?: "(Unknown)", ++ dmi_get_system_info(DMI_BOARD_VENDOR) ?: "(Unknown)", ++ dmi_get_system_info(DMI_BOARD_NAME) ?: "(Unknown)"); + return true; + } + return false; diff --git a/queue-6.18/series b/queue-6.18/series index f792f239ce..c0963a6854 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -1418,3 +1418,6 @@ ieee802154-allow-legacy-llsec-add-del-ops-to-pass-strict-validation.patch ieee802154-ca8210-fix-cas_ctl-leak-on-spi_async-failure.patch ieee802154-ca8210-fix-pointer-truncation-in-kfifo-on-64-bit.patch gve-fix-header-buffer-corruption-with-header-split-and-hw-gro.patch +platform-x86-amd-pmc-avoid-logging-null-for-dmi-values.patch +net-sched-sch_teql-move-rcu_read_lock-spin_lock-from-_bh-variants.patch +drm-xe-userptr-stub-notifier_lock-helpers-when-drm_gpusvm-n.patch