From: Greg Kroah-Hartman Date: Mon, 20 Jul 2026 16:33:00 +0000 (+0200) Subject: 6.12-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=59e7f63b8a9a47ea7d28e5f45d56302598d174bd;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: net-sched-sch_teql-move-rcu_read_lock-spin_lock-from-_bh-variants.patch platform-x86-amd-pmc-avoid-logging-null-for-dmi-values.patch --- diff --git a/queue-6.12/net-sched-sch_teql-move-rcu_read_lock-spin_lock-from-_bh-variants.patch b/queue-6.12/net-sched-sch_teql-move-rcu_read_lock-spin_lock-from-_bh-variants.patch new file mode 100644 index 0000000000..ab7448fe53 --- /dev/null +++ b/queue-6.12/net-sched-sch_teql-move-rcu_read_lock-spin_lock-from-_bh-variants.patch @@ -0,0 +1,118 @@ +From 6301f6a34ed86fe6f3b7b3211ea069f3677fc559 Mon Sep 17 00:00:00 2001 +From: Jamal Hadi Salim +Date: Tue, 30 Jun 2026 11:09:22 -0400 +Subject: net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants + +From: Jamal Hadi Salim + +commit 6301f6a34ed86fe6f3b7b3211ea069f3677fc559 upstream. + +This is a followup based on sashiko comments [1] on commit e5b811fe7931 +("net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF") + +Use plain rcu_read_lock()/spin_lock() in teql_master_xmit() instead of the +_bh variants, since ndo_start_xmit is already invoked with BH disabled +by the core stack and the _bh primitives can warn in_hardirq() when xmit +is reached through netpoll or a softirq xmit path with hard IRQs disabled. + +Moves rcu_read_lock() after restart: label + adds rcu_read_unlock() before +goto restart (fixes the unbounded RCU hold across retries) + +[1] https://sashiko.dev/#/patchset/20260628111229.669751-1-jhs%40mojatatu.com + +Signed-off-by: Jamal Hadi Salim +Fixes: e5b811fe7931 ("net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF") +Link: https://patch.msgid.link/20260630150922.238714-1-jhs@mojatatu.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + net/sched/sch_teql.c | 27 ++++++++++++++------------- + 1 file changed, 14 insertions(+), 13 deletions(-) + +--- a/net/sched/sch_teql.c ++++ b/net/sched/sch_teql.c +@@ -311,14 +311,14 @@ static netdev_tx_t teql_master_xmit(stru + int subq = skb_get_queue_mapping(skb); + struct sk_buff *skb_res = NULL; + +- rcu_read_lock_bh(); +- +- start = rcu_dereference_bh(master->slaves); +- + restart: + nores = 0; + busy = 0; + ++ rcu_read_lock(); ++ ++ start = rcu_dereference(master->slaves); ++ + q = start; + if (!q) + goto drop; +@@ -345,17 +345,17 @@ restart: + netdev_start_xmit(skb, slave, slave_txq, false) == + NETDEV_TX_OK) { + __netif_tx_unlock(slave_txq); +- spin_lock_bh(&master->slaves_lock); ++ spin_lock(&master->slaves_lock); + if (rcu_dereference_protected(master->slaves, + lockdep_is_held(&master->slaves_lock)) == q) + rcu_assign_pointer(master->slaves, + rcu_dereference_protected(NEXT_SLAVE(q), + lockdep_is_held(&master->slaves_lock))); +- spin_unlock_bh(&master->slaves_lock); ++ spin_unlock(&master->slaves_lock); + netif_wake_queue(dev); + master->tx_packets++; + master->tx_bytes += length; +- rcu_read_unlock_bh(); ++ rcu_read_unlock(); + return NETDEV_TX_OK; + } + __netif_tx_unlock(slave_txq); +@@ -364,37 +364,38 @@ restart: + busy = 1; + break; + case 1: +- spin_lock_bh(&master->slaves_lock); ++ spin_lock(&master->slaves_lock); + if (rcu_dereference_protected(master->slaves, + lockdep_is_held(&master->slaves_lock)) == q) + rcu_assign_pointer(master->slaves, + rcu_dereference_protected(NEXT_SLAVE(q), + lockdep_is_held(&master->slaves_lock))); +- spin_unlock_bh(&master->slaves_lock); +- rcu_read_unlock_bh(); ++ spin_unlock(&master->slaves_lock); ++ rcu_read_unlock(); + return NETDEV_TX_OK; + default: + nores = 1; + break; + } + __skb_pull(skb, skb_network_offset(skb)); +- } while ((q = rcu_dereference_bh(NEXT_SLAVE(q))) != start); ++ } while ((q = rcu_dereference(NEXT_SLAVE(q))) != start); + + if (nores && skb_res == NULL) { + skb_res = skb; ++ rcu_read_unlock(); + goto restart; + } + + if (busy) { + netif_stop_queue(dev); +- rcu_read_unlock_bh(); ++ rcu_read_unlock(); + return NETDEV_TX_BUSY; + } + master->tx_errors++; + + drop: + master->tx_dropped++; +- rcu_read_unlock_bh(); ++ rcu_read_unlock(); + dev_kfree_skb(skb); + return NETDEV_TX_OK; + } diff --git a/queue-6.12/platform-x86-amd-pmc-avoid-logging-null-for-dmi-values.patch b/queue-6.12/platform-x86-amd-pmc-avoid-logging-null-for-dmi-values.patch new file mode 100644 index 0000000000..3cf59d3541 --- /dev/null +++ b/queue-6.12/platform-x86-amd-pmc-avoid-logging-null-for-dmi-values.patch @@ -0,0 +1,51 @@ +From a0738abd042f7406edd2175a819cf2e66388ed97 Mon Sep 17 00:00:00 2001 +From: Daniel Gibson +Date: Sat, 27 Jun 2026 00:02:10 +0200 +Subject: platform/x86/amd/pmc: Avoid logging "(null)" for DMI values +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Daniel Gibson + +commit a0738abd042f7406edd2175a819cf2e66388ed97 upstream. + +dmi_get_system_info(...) can return NULL. Using that as %s arguments +of dev_info() would log "(null)" (as part of a message like +'... System Vendor: "(null)", Product Name: "(null)" ...'), which may +be confusing for users. + +Use Elvis operator to print "(Unknown)" instead. + +Fixes: 428b9fd2dce5 ("platform/x86/amd/pmc: Add delay_suspend module parameter") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202606251540.Nr2BtaNu-lkp@intel.com/ +Suggested-by: Ilpo Järvinen +Signed-off-by: Daniel Gibson +Link: https://patch.msgid.link/20260626220210.1761783-2-daniel@gibson.sh +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/x86/amd/pmc/pmc.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/platform/x86/amd/pmc/pmc.c ++++ b/drivers/platform/x86/amd/pmc/pmc.c +@@ -921,11 +921,11 @@ static bool amd_pmc_want_suspend_delay(s + } else if (delay_suspend == 1) { + if (!intermediate_wakeup) + dev_info(pdev->dev, "Delaying suspend by 2.5s because delay_suspend=1. If this solves problems on your machine, please report this whole line to: platform-driver-x86@vger.kernel.org so it can be automatically detected as affected in the future. System Vendor: \"%s\" Product Name: \"%s\" Product Family: \"%s\" Board Vendor: \"%s\" Board Name: \"%s\"\n", +- dmi_get_system_info(DMI_SYS_VENDOR), +- dmi_get_system_info(DMI_PRODUCT_NAME), +- dmi_get_system_info(DMI_PRODUCT_FAMILY), +- dmi_get_system_info(DMI_BOARD_VENDOR), +- dmi_get_system_info(DMI_BOARD_NAME)); ++ dmi_get_system_info(DMI_SYS_VENDOR) ?: "(Unknown)", ++ dmi_get_system_info(DMI_PRODUCT_NAME) ?: "(Unknown)", ++ dmi_get_system_info(DMI_PRODUCT_FAMILY) ?: "(Unknown)", ++ dmi_get_system_info(DMI_BOARD_VENDOR) ?: "(Unknown)", ++ dmi_get_system_info(DMI_BOARD_NAME) ?: "(Unknown)"); + return true; + } + return false; diff --git a/queue-6.12/series b/queue-6.12/series index a96620569d..0f55f9e406 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -1060,3 +1060,5 @@ ieee802154-admin-gate-legacy-llsec-dump-operations.patch ieee802154-allow-legacy-llsec-add-del-ops-to-pass-strict-validation.patch ieee802154-ca8210-fix-cas_ctl-leak-on-spi_async-failure.patch ieee802154-ca8210-fix-pointer-truncation-in-kfifo-on-64-bit.patch +platform-x86-amd-pmc-avoid-logging-null-for-dmi-values.patch +net-sched-sch_teql-move-rcu_read_lock-spin_lock-from-_bh-variants.patch