From: Greg Kroah-Hartman Date: Sat, 13 Jan 2024 09:13:11 +0000 (+0100) Subject: 5.10-stable patches X-Git-Tag: v4.19.305~15 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=fb7041be84ba69310693944e1ba58ef317906e18;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: netfilter-nf_tables-reject-tables-of-unsupported-family.patch pci-disable-ats-for-specific-intel-ipu-e2000-devices.patch pci-extract-ats-disabling-to-a-helper-function.patch --- diff --git a/queue-5.10/netfilter-nf_tables-reject-tables-of-unsupported-family.patch b/queue-5.10/netfilter-nf_tables-reject-tables-of-unsupported-family.patch new file mode 100644 index 00000000000..cebb780cdd6 --- /dev/null +++ b/queue-5.10/netfilter-nf_tables-reject-tables-of-unsupported-family.patch @@ -0,0 +1,65 @@ +From f1082dd31fe461d482d69da2a8eccfeb7bf07ac2 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 16 Feb 2022 15:55:38 +0100 +Subject: netfilter: nf_tables: Reject tables of unsupported family + +From: Phil Sutter + +commit f1082dd31fe461d482d69da2a8eccfeb7bf07ac2 upstream. + +An nftables family is merely a hollow container, its family just a +number and such not reliant on compile-time options other than nftables +support itself. Add an artificial check so attempts at using a family +the kernel can't support fail as early as possible. This helps user +space detect kernels which lack e.g. NFPROTO_INET. + +Signed-off-by: Phil Sutter +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_tables_api.c | 27 +++++++++++++++++++++++++++ + 1 file changed, 27 insertions(+) + +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -1186,6 +1186,30 @@ static int nft_objname_hash_cmp(struct r + return strcmp(obj->key.name, k->name); + } + ++static bool nft_supported_family(u8 family) ++{ ++ return false ++#ifdef CONFIG_NF_TABLES_INET ++ || family == NFPROTO_INET ++#endif ++#ifdef CONFIG_NF_TABLES_IPV4 ++ || family == NFPROTO_IPV4 ++#endif ++#ifdef CONFIG_NF_TABLES_ARP ++ || family == NFPROTO_ARP ++#endif ++#ifdef CONFIG_NF_TABLES_NETDEV ++ || family == NFPROTO_NETDEV ++#endif ++#if IS_ENABLED(CONFIG_NF_TABLES_BRIDGE) ++ || family == NFPROTO_BRIDGE ++#endif ++#ifdef CONFIG_NF_TABLES_IPV6 ++ || family == NFPROTO_IPV6 ++#endif ++ ; ++} ++ + static int nf_tables_newtable(struct net *net, struct sock *nlsk, + struct sk_buff *skb, const struct nlmsghdr *nlh, + const struct nlattr * const nla[], +@@ -1201,6 +1225,9 @@ static int nf_tables_newtable(struct net + u32 flags = 0; + int err; + ++ if (!nft_supported_family(family)) ++ return -EOPNOTSUPP; ++ + lockdep_assert_held(&nft_net->commit_mutex); + attr = nla[NFTA_TABLE_NAME]; + table = nft_table_lookup(net, attr, family, genmask); diff --git a/queue-5.10/pci-disable-ats-for-specific-intel-ipu-e2000-devices.patch b/queue-5.10/pci-disable-ats-for-specific-intel-ipu-e2000-devices.patch new file mode 100644 index 00000000000..5667a18dd95 --- /dev/null +++ b/queue-5.10/pci-disable-ats-for-specific-intel-ipu-e2000-devices.patch @@ -0,0 +1,55 @@ +From a18615b1cfc04f00548c60eb9a77e0ce56e848fd Mon Sep 17 00:00:00 2001 +From: Bartosz Pawlowski +Date: Fri, 8 Sep 2023 14:36:06 +0000 +Subject: PCI: Disable ATS for specific Intel IPU E2000 devices + +From: Bartosz Pawlowski + +commit a18615b1cfc04f00548c60eb9a77e0ce56e848fd upstream. + +Due to a hardware issue in A and B steppings of Intel IPU E2000, it expects +wrong endianness in ATS invalidation message body. This problem can lead to +outdated translations being returned as valid and finally cause system +instability. + +To prevent such issues, add quirk_intel_e2000_no_ats() to disable ATS for +vulnerable IPU E2000 devices. + +Link: https://lore.kernel.org/r/20230908143606.685930-3-bartosz.pawlowski@intel.com +Signed-off-by: Bartosz Pawlowski +Signed-off-by: Bjorn Helgaas +Reviewed-by: Andy Shevchenko +Reviewed-by: Alexander Lobakin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/quirks.c | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -5383,6 +5383,25 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AT + /* AMD Navi14 dGPU */ + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x7340, quirk_amd_harvest_no_ats); + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x7341, quirk_amd_harvest_no_ats); ++ ++/* ++ * Intel IPU E2000 revisions before C0 implement incorrect endianness ++ * in ATS Invalidate Request message body. Disable ATS for those devices. ++ */ ++static void quirk_intel_e2000_no_ats(struct pci_dev *pdev) ++{ ++ if (pdev->revision < 0x20) ++ quirk_no_ats(pdev); ++} ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1451, quirk_intel_e2000_no_ats); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1452, quirk_intel_e2000_no_ats); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1453, quirk_intel_e2000_no_ats); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1454, quirk_intel_e2000_no_ats); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1455, quirk_intel_e2000_no_ats); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1457, quirk_intel_e2000_no_ats); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1459, quirk_intel_e2000_no_ats); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x145a, quirk_intel_e2000_no_ats); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x145c, quirk_intel_e2000_no_ats); + #endif /* CONFIG_PCI_ATS */ + + /* Freescale PCIe doesn't support MSI in RC mode */ diff --git a/queue-5.10/pci-extract-ats-disabling-to-a-helper-function.patch b/queue-5.10/pci-extract-ats-disabling-to-a-helper-function.patch new file mode 100644 index 00000000000..3f2fb01f711 --- /dev/null +++ b/queue-5.10/pci-extract-ats-disabling-to-a-helper-function.patch @@ -0,0 +1,47 @@ +From f18b1137d38c091cc8c16365219f0a1d4a30b3d1 Mon Sep 17 00:00:00 2001 +From: Bartosz Pawlowski +Date: Fri, 8 Sep 2023 14:36:05 +0000 +Subject: PCI: Extract ATS disabling to a helper function + +From: Bartosz Pawlowski + +commit f18b1137d38c091cc8c16365219f0a1d4a30b3d1 upstream. + +Introduce quirk_no_ats() helper function to provide a standard way to +disable ATS capability in PCI quirks. + +Suggested-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20230908143606.685930-2-bartosz.pawlowski@intel.com +Signed-off-by: Bartosz Pawlowski +Signed-off-by: Bjorn Helgaas +Reviewed-by: Andy Shevchenko +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/quirks.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -5353,6 +5353,12 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SE + DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SERVERWORKS, 0x0422, quirk_no_ext_tags); + + #ifdef CONFIG_PCI_ATS ++static void quirk_no_ats(struct pci_dev *pdev) ++{ ++ pci_info(pdev, "disabling ATS\n"); ++ pdev->ats_cap = 0; ++} ++ + /* + * Some devices require additional driver setup to enable ATS. Don't use + * ATS for those devices as ATS will be enabled before the driver has had a +@@ -5365,8 +5371,7 @@ static void quirk_amd_harvest_no_ats(str + (pdev->device == 0x7341 && pdev->revision != 0x00)) + return; + +- pci_info(pdev, "disabling ATS\n"); +- pdev->ats_cap = 0; ++ quirk_no_ats(pdev); + } + + /* AMD Stoney platform GPU */ diff --git a/queue-5.10/series b/queue-5.10/series index 2358d6f32f0..85123fa4b62 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -37,3 +37,6 @@ powerpc-update-ppc_save_regs-to-save-current-r1-in-pt_regs.patch net-tls-update-curr-on-splice-as-well.patch ipv6-remove-max_size-check-inline-with-ipv4.patch drm-qxl-fix-uaf-on-handle-creation.patch +netfilter-nf_tables-reject-tables-of-unsupported-family.patch +pci-extract-ats-disabling-to-a-helper-function.patch +pci-disable-ats-for-specific-intel-ipu-e2000-devices.patch