From: Greg Kroah-Hartman Date: Thu, 30 Jun 2022 13:29:44 +0000 (+0200) Subject: 5.15-stable patches X-Git-Tag: v4.9.321~4 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f5531371bec2872f837381650de6770efc4f738b;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: io_uring-fix-not-locked-access-to-fixed-buf-table.patch net-mscc-ocelot-allow-unregistered-ip-multicast-flooding-to-cpu.patch --- diff --git a/queue-5.15/io_uring-fix-not-locked-access-to-fixed-buf-table.patch b/queue-5.15/io_uring-fix-not-locked-access-to-fixed-buf-table.patch new file mode 100644 index 00000000000..f572dae9371 --- /dev/null +++ b/queue-5.15/io_uring-fix-not-locked-access-to-fixed-buf-table.patch @@ -0,0 +1,76 @@ +From 05b538c1765f8d14a71ccf5f85258dcbeaf189f7 Mon Sep 17 00:00:00 2001 +From: Pavel Begunkov +Date: Thu, 9 Jun 2022 08:34:35 +0100 +Subject: io_uring: fix not locked access to fixed buf table + +From: Pavel Begunkov + +commit 05b538c1765f8d14a71ccf5f85258dcbeaf189f7 upstream. + +We can look inside the fixed buffer table only while holding +->uring_lock, however in some cases we don't do the right async prep for +IORING_OP_{WRITE,READ}_FIXED ending up with NULL req->imu forcing making +an io-wq worker to try to resolve the fixed buffer without proper +locking. + +Move req->imu setup into early req init paths, i.e. io_prep_rw(), which +is called unconditionally for rw requests and under uring_lock. + +Fixes: 634d00df5e1cf ("io_uring: add full-fledged dynamic buffers support") +Signed-off-by: Pavel Begunkov +Signed-off-by: Greg Kroah-Hartman +--- + fs/io_uring.c | 28 ++++++++++++++-------------- + 1 file changed, 14 insertions(+), 14 deletions(-) + +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -2932,15 +2932,24 @@ static int io_prep_rw(struct io_kiocb *r + kiocb->ki_complete = io_complete_rw; + } + ++ /* used for fixed read/write too - just read unconditionally */ ++ req->buf_index = READ_ONCE(sqe->buf_index); ++ req->imu = NULL; ++ + if (req->opcode == IORING_OP_READ_FIXED || + req->opcode == IORING_OP_WRITE_FIXED) { +- req->imu = NULL; ++ struct io_ring_ctx *ctx = req->ctx; ++ u16 index; ++ ++ if (unlikely(req->buf_index >= ctx->nr_user_bufs)) ++ return -EFAULT; ++ index = array_index_nospec(req->buf_index, ctx->nr_user_bufs); ++ req->imu = ctx->user_bufs[index]; + io_req_set_rsrc_node(req); + } + + req->rw.addr = READ_ONCE(sqe->addr); + req->rw.len = READ_ONCE(sqe->len); +- req->buf_index = READ_ONCE(sqe->buf_index); + return 0; + } + +@@ -3066,18 +3075,9 @@ static int __io_import_fixed(struct io_k + + static int io_import_fixed(struct io_kiocb *req, int rw, struct iov_iter *iter) + { +- struct io_ring_ctx *ctx = req->ctx; +- struct io_mapped_ubuf *imu = req->imu; +- u16 index, buf_index = req->buf_index; +- +- if (likely(!imu)) { +- if (unlikely(buf_index >= ctx->nr_user_bufs)) +- return -EFAULT; +- index = array_index_nospec(buf_index, ctx->nr_user_bufs); +- imu = READ_ONCE(ctx->user_bufs[index]); +- req->imu = imu; +- } +- return __io_import_fixed(req, rw, iter, imu); ++ if (WARN_ON_ONCE(!req->imu)) ++ return -EFAULT; ++ return __io_import_fixed(req, rw, iter, req->imu); + } + + static void io_ring_submit_unlock(struct io_ring_ctx *ctx, bool needs_lock) diff --git a/queue-5.15/net-mscc-ocelot-allow-unregistered-ip-multicast-flooding-to-cpu.patch b/queue-5.15/net-mscc-ocelot-allow-unregistered-ip-multicast-flooding-to-cpu.patch new file mode 100644 index 00000000000..1c08f11fc07 --- /dev/null +++ b/queue-5.15/net-mscc-ocelot-allow-unregistered-ip-multicast-flooding-to-cpu.patch @@ -0,0 +1,60 @@ +From foo@baz Thu Jun 30 03:21:45 PM CEST 2022 +From: Vladimir Oltean +Date: Tue, 28 Jun 2022 20:20:15 +0300 +Subject: net: mscc: ocelot: allow unregistered IP multicast flooding to CPU +To: stable , Greg Kroah-Hartman , Sasha Levin +Cc: netdev@vger.kernel.org, "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Xiaoliang Yang , Claudiu Manoil , Alexandre Belloni , UNGLinuxDriver@microchip.com, Andrew Lunn , Vivien Didelot , Florian Fainelli , Maxim Kochetkov , Colin Foster , stable@kernel.org +Message-ID: <20220628172016.3373243-4-vladimir.oltean@nxp.com> + +From: Vladimir Oltean + +Since commit 4cf35a2b627a ("net: mscc: ocelot: fix broken IP multicast +flooding") from v5.12, unregistered IP multicast flooding is +configurable in the ocelot driver for bridged ports. However, by writing +0 to the PGID_MCIPV4 and PGID_MCIPV6 port masks at initialization time, +the CPU port module, for which ocelot_port_set_mcast_flood() is not +called, will have unknown IP multicast flooding disabled. + +This makes it impossible for an application such as smcroute to work +properly, since all IP multicast traffic received on a standalone port +is treated as unregistered (and dropped). + +Starting with commit 7569459a52c9 ("net: dsa: manage flooding on the CPU +ports"), the limitation above has been lifted, because when standalone +ports become IFF_PROMISC or IFF_ALLMULTI, ocelot_port_set_mcast_flood() +would be called on the CPU port module, so unregistered multicast is +flooded to the CPU on an as-needed basis. + +But between v5.12 and v5.18, IP multicast flooding to the CPU has +remained broken, promiscuous or not. + +Delete the inexplicable premature optimization of clearing PGID_MCIPV4 +and PGID_MCIPV6 as part of the init sequence, and allow unregistered IP +multicast to be flooded freely to the CPU port module. + +Fixes: a556c76adc05 ("net: mscc: Add initial Ocelot switch support") +Cc: stable@kernel.org +Signed-off-by: Vladimir Oltean +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mscc/ocelot.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/mscc/ocelot.c ++++ b/drivers/net/ethernet/mscc/ocelot.c +@@ -2208,9 +2208,13 @@ int ocelot_init(struct ocelot *ocelot) + ANA_PGID_PGID, PGID_MC); + ocelot_rmw_rix(ocelot, ANA_PGID_PGID_PGID(BIT(ocelot->num_phys_ports)), + ANA_PGID_PGID_PGID(BIT(ocelot->num_phys_ports)), ++ ANA_PGID_PGID, PGID_MCIPV4); ++ ocelot_rmw_rix(ocelot, ANA_PGID_PGID_PGID(BIT(ocelot->num_phys_ports)), ++ ANA_PGID_PGID_PGID(BIT(ocelot->num_phys_ports)), ++ ANA_PGID_PGID, PGID_MCIPV6); ++ ocelot_rmw_rix(ocelot, ANA_PGID_PGID_PGID(BIT(ocelot->num_phys_ports)), ++ ANA_PGID_PGID_PGID(BIT(ocelot->num_phys_ports)), + ANA_PGID_PGID, PGID_BC); +- ocelot_write_rix(ocelot, 0, ANA_PGID_PGID, PGID_MCIPV4); +- ocelot_write_rix(ocelot, 0, ANA_PGID_PGID, PGID_MCIPV6); + + /* Allow manual injection via DEVCPU_QS registers, and byte swap these + * registers endianness. diff --git a/queue-5.15/series b/queue-5.15/series index ff5883ae1f5..ed72f5aaa94 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -24,3 +24,5 @@ fs-fix-acl-translation.patch fs-account-for-group-membership.patch rtw88-8821c-support-rfe-type4-wifi-nic.patch rtw88-rtw8821c-enable-rfe-6-devices.patch +net-mscc-ocelot-allow-unregistered-ip-multicast-flooding-to-cpu.patch +io_uring-fix-not-locked-access-to-fixed-buf-table.patch