5.10-stable patches

added patches:
	mips-mm-tlb-r4k-uniquify-tlb-entries-on-init.patch
	mm-hmm-move-pmd_to_hmm_pfn_flags-to-the-respective-ifdeffery.patch
	usb-gadget-fix-use-after-free-in-composite_dev_cleanup.patch

diff --git a/queue-5.10/mips-mm-tlb-r4k-uniquify-tlb-entries-on-init.patch b/queue-5.10/mips-mm-tlb-r4k-uniquify-tlb-entries-on-init.patch
new file mode 100644 (file)
index 0000000..b1e42e6
--- /dev/null
+++ b/queue-5.10/mips-mm-tlb-r4k-uniquify-tlb-entries-on-init.patch
@@ -0,0 +1,98 @@
+From 35ad7e181541aa5757f9f316768d3e64403ec843 Mon Sep 17 00:00:00 2001
+From: Jiaxun Yang <jiaxun.yang@flygoat.com>
+Date: Sat, 7 Jun 2025 13:43:56 +0100
+Subject: MIPS: mm: tlb-r4k: Uniquify TLB entries on init
+
+From: Jiaxun Yang <jiaxun.yang@flygoat.com>
+
+commit 35ad7e181541aa5757f9f316768d3e64403ec843 upstream.
+
+Hardware or bootloader will initialize TLB entries to any value, which
+may collide with kernel's UNIQUE_ENTRYHI value. On MIPS microAptiv/M5150
+family of cores this will trigger machine check exception and cause boot
+failure. On M5150 simulation this could happen 7 times out of 1000 boots.
+
+Replace local_flush_tlb_all() with r4k_tlb_uniquify() which probes each
+TLB ENTRIHI unique value for collisions before it's written, and in case
+of collision try a different ASID.
+
+Cc: stable@kernel.org
+Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/mips/mm/tlb-r4k.c |   56 ++++++++++++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 55 insertions(+), 1 deletion(-)
+
+--- a/arch/mips/mm/tlb-r4k.c
++++ b/arch/mips/mm/tlb-r4k.c
+@@ -498,6 +498,60 @@ static int __init set_ntlb(char *str)
+ 
+ __setup("ntlb=", set_ntlb);
+ 
++/* Initialise all TLB entries with unique values */
++static void r4k_tlb_uniquify(void)
++{
++      int entry = num_wired_entries();
++
++      htw_stop();
++      write_c0_entrylo0(0);
++      write_c0_entrylo1(0);
++
++      while (entry < current_cpu_data.tlbsize) {
++              unsigned long asid_mask = cpu_asid_mask(&current_cpu_data);
++              unsigned long asid = 0;
++              int idx;
++
++              /* Skip wired MMID to make ginvt_mmid work */
++              if (cpu_has_mmid)
++                      asid = MMID_KERNEL_WIRED + 1;
++
++              /* Check for match before using UNIQUE_ENTRYHI */
++              do {
++                      if (cpu_has_mmid) {
++                              write_c0_memorymapid(asid);
++                              write_c0_entryhi(UNIQUE_ENTRYHI(entry));
++                      } else {
++                              write_c0_entryhi(UNIQUE_ENTRYHI(entry) | asid);
++                      }
++                      mtc0_tlbw_hazard();
++                      tlb_probe();
++                      tlb_probe_hazard();
++                      idx = read_c0_index();
++                      /* No match or match is on current entry */
++                      if (idx < 0 || idx == entry)
++                              break;
++                      /*
++                       * If we hit a match, we need to try again with
++                       * a different ASID.
++                       */
++                      asid++;
++              } while (asid < asid_mask);
++
++              if (idx >= 0 && idx != entry)
++                      panic("Unable to uniquify TLB entry %d", idx);
++
++              write_c0_index(entry);
++              mtc0_tlbw_hazard();
++              tlb_write_indexed();
++              entry++;
++      }
++
++      tlbw_use_hazard();
++      htw_start();
++      flush_micro_tlb();
++}
++
+ /*
+  * Configure TLB (for init or after a CPU has been powered off).
+  */
+@@ -537,7 +591,7 @@ static void r4k_tlb_configure(void)
+       temp_tlb_entry = current_cpu_data.tlbsize - 1;
+ 
+       /* From this point on the ARC firmware is dead.  */
+-      local_flush_tlb_all();
++      r4k_tlb_uniquify();
+ 
+       /* Did I tell you that ARC SUCKS?  */
+ }

diff --git a/queue-5.10/mm-hmm-move-pmd_to_hmm_pfn_flags-to-the-respective-ifdeffery.patch b/queue-5.10/mm-hmm-move-pmd_to_hmm_pfn_flags-to-the-respective-ifdeffery.patch
new file mode 100644 (file)
index 0000000..6b23715
--- /dev/null
+++ b/queue-5.10/mm-hmm-move-pmd_to_hmm_pfn_flags-to-the-respective-ifdeffery.patch
@@ -0,0 +1,56 @@
+From 188cb385bbf04d486df3e52f28c47b3961f5f0c0 Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Thu, 10 Jul 2025 11:23:53 +0300
+Subject: mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+commit 188cb385bbf04d486df3e52f28c47b3961f5f0c0 upstream.
+
+When pmd_to_hmm_pfn_flags() is unused, it prevents kernel builds with
+clang, `make W=1` and CONFIG_TRANSPARENT_HUGEPAGE=n:
+
+  mm/hmm.c:186:29: warning: unused function 'pmd_to_hmm_pfn_flags' [-Wunused-function]
+
+Fix this by moving the function to the respective existing ifdeffery
+for its the only user.
+
+See also:
+
+  6863f5643dd7 ("kbuild: allow Clang to find unused static inline functions for W=1 build")
+
+Link: https://lkml.kernel.org/r/20250710082403.664093-1-andriy.shevchenko@linux.intel.com
+Fixes: 992de9a8b751 ("mm/hmm: allow to mirror vma of a file on a DAX backed filesystem")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Reviewed-by: Alistair Popple <apopple@nvidia.com>
+Cc: Andriy Shevchenko <andriy.shevchenko@linux.intel.com>
+Cc: Bill Wendling <morbo@google.com>
+Cc: Jerome Glisse <jglisse@redhat.com>
+Cc: Justin Stitt <justinstitt@google.com>
+Cc: Nathan Chancellor <nathan@kernel.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/hmm.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/hmm.c
++++ b/mm/hmm.c
+@@ -171,6 +171,7 @@ static inline unsigned long hmm_pfn_flag
+       return order << HMM_PFN_ORDER_SHIFT;
+ }
+ 
++#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+ static inline unsigned long pmd_to_hmm_pfn_flags(struct hmm_range *range,
+                                                pmd_t pmd)
+ {
+@@ -181,7 +182,6 @@ static inline unsigned long pmd_to_hmm_p
+              hmm_pfn_flags_order(PMD_SHIFT - PAGE_SHIFT);
+ }
+ 
+-#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+ static int hmm_vma_handle_pmd(struct mm_walk *walk, unsigned long addr,
+                             unsigned long end, unsigned long hmm_pfns[],
+                             pmd_t pmd)

diff --git a/queue-5.10/series b/queue-5.10/series
index fd608ffd2383fa698664a43d2e8abca6e1e63fce..ebec65d2de688b06fc6616fa5f65600e0f10f7dc 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -187,3 +187,6 @@ perf-core-prevent-vma-split-of-buffer-mappings.patch
 net-packet-fix-a-race-in-packet_set_ring-and-packet_notifier.patch
 vsock-do-not-allow-binding-to-vmaddr_port_any.patch
 usb-serial-option-add-foxconn-t99w709.patch
+mips-mm-tlb-r4k-uniquify-tlb-entries-on-init.patch
+mm-hmm-move-pmd_to_hmm_pfn_flags-to-the-respective-ifdeffery.patch
+usb-gadget-fix-use-after-free-in-composite_dev_cleanup.patch

diff --git a/queue-5.10/usb-gadget-fix-use-after-free-in-composite_dev_cleanup.patch b/queue-5.10/usb-gadget-fix-use-after-free-in-composite_dev_cleanup.patch
new file mode 100644 (file)
index 0000000..ccbe1d6
--- /dev/null
+++ b/queue-5.10/usb-gadget-fix-use-after-free-in-composite_dev_cleanup.patch
@@ -0,0 +1,51 @@
+From 151c0aa896c47a4459e07fee7d4843f44c1bb18e Mon Sep 17 00:00:00 2001
+From: Tao Xue <xuetao09@huawei.com>
+Date: Mon, 21 Jul 2025 17:39:08 +0800
+Subject: usb: gadget : fix use-after-free in composite_dev_cleanup()
+
+From: Tao Xue <xuetao09@huawei.com>
+
+commit 151c0aa896c47a4459e07fee7d4843f44c1bb18e upstream.
+
+1. In func configfs_composite_bind() -> composite_os_desc_req_prepare():
+if kmalloc fails, the pointer cdev->os_desc_req will be freed but not
+set to NULL. Then it will return a failure to the upper-level function.
+2. in func configfs_composite_bind() -> composite_dev_cleanup():
+it will checks whether cdev->os_desc_req is NULL. If it is not NULL, it
+will attempt to use it.This will lead to a use-after-free issue.
+
+BUG: KASAN: use-after-free in composite_dev_cleanup+0xf4/0x2c0
+Read of size 8 at addr 0000004827837a00 by task init/1
+
+CPU: 10 PID: 1 Comm: init Tainted: G           O      5.10.97-oh #1
+ kasan_report+0x188/0x1cc
+ __asan_load8+0xb4/0xbc
+ composite_dev_cleanup+0xf4/0x2c0
+ configfs_composite_bind+0x210/0x7ac
+ udc_bind_to_driver+0xb4/0x1ec
+ usb_gadget_probe_driver+0xec/0x21c
+ gadget_dev_desc_UDC_store+0x264/0x27c
+
+Fixes: 37a3a533429e ("usb: gadget: OS Feature Descriptors support")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Tao Xue <xuetao09@huawei.com>
+Link: https://lore.kernel.org/r/20250721093908.14967-1-xuetao09@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/composite.c |    5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/usb/gadget/composite.c
++++ b/drivers/usb/gadget/composite.c
+@@ -2241,6 +2241,11 @@ int composite_os_desc_req_prepare(struct
+       if (!cdev->os_desc_req->buf) {
+               ret = -ENOMEM;
+               usb_ep_free_request(ep0, cdev->os_desc_req);
++              /*
++               * Set os_desc_req to NULL so that composite_dev_cleanup()
++               * will not try to free it again.
++               */
++              cdev->os_desc_req = NULL;
+               goto end;
+       }
+       cdev->os_desc_req->context = cdev;