+++ /dev/null
-From 8d3107f103d3a4742e730c313539e21cb6370af4 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 6 Jun 2024 12:23:31 +0200
-Subject: netfilter: Use flowlabel flow key when re-routing mangled packets
-
-From: Florian Westphal <fw@strlen.de>
-
-[ Upstream commit 6f8f132cc7bac2ac76911e47d5baa378aafda4cb ]
-
-'ip6 dscp set $v' in an nftables outpute route chain has no effect.
-While nftables does detect the dscp change and calls the reroute hook.
-But ip6_route_me_harder never sets the dscp/flowlabel:
-flowlabel/dsfield routing rules are ignored and no reroute takes place.
-
-Thanks to Yi Chen for an excellent reproducer script that I used
-to validate this change.
-
-Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
-Reported-by: Yi Chen <yiche@redhat.com>
-Signed-off-by: Florian Westphal <fw@strlen.de>
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/ipv6/netfilter.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
-index 5679fa3f696ad..abdb020dd338e 100644
---- a/net/ipv6/netfilter.c
-+++ b/net/ipv6/netfilter.c
-@@ -32,6 +32,7 @@ int ip6_route_me_harder(struct net *net, struct sock *sk_partial, struct sk_buff
- .flowi6_uid = sock_net_uid(net, sk),
- .daddr = iph->daddr,
- .saddr = iph->saddr,
-+ .flowlabel = ip6_flowinfo(iph),
- };
- int err;
-
---
-2.43.0
-
drm-bridge-panel-fix-runtime-warning-on-panel-bridge.patch
tcp-fix-race-in-tcp_v6_syn_recv_sock.patch
bluetooth-l2cap-fix-rejecting-l2cap_conn_param_updat.patch
-netfilter-use-flowlabel-flow-key-when-re-routing-man.patch
ipv6-route-add-a-missing-check-on-proc_dointvec.patch
net-ipv6-fix-the-rt-cache-flush-via-sysctl-using-a-p.patch
drivers-core-synchronize-really_probe-and-dev_uevent.patch
+++ /dev/null
-From 162dce55343613c51ed97a047df9c5b0f61b138c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 6 Jun 2024 12:23:31 +0200
-Subject: netfilter: Use flowlabel flow key when re-routing mangled packets
-
-From: Florian Westphal <fw@strlen.de>
-
-[ Upstream commit 6f8f132cc7bac2ac76911e47d5baa378aafda4cb ]
-
-'ip6 dscp set $v' in an nftables outpute route chain has no effect.
-While nftables does detect the dscp change and calls the reroute hook.
-But ip6_route_me_harder never sets the dscp/flowlabel:
-flowlabel/dsfield routing rules are ignored and no reroute takes place.
-
-Thanks to Yi Chen for an excellent reproducer script that I used
-to validate this change.
-
-Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
-Reported-by: Yi Chen <yiche@redhat.com>
-Signed-off-by: Florian Westphal <fw@strlen.de>
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/ipv6/netfilter.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
-index ab9a279dd6d47..ef06d248c3c3d 100644
---- a/net/ipv6/netfilter.c
-+++ b/net/ipv6/netfilter.c
-@@ -35,6 +35,7 @@ int ip6_route_me_harder(struct net *net, struct sock *sk_partial, struct sk_buff
- .flowi6_uid = sock_net_uid(net, sk),
- .daddr = iph->daddr,
- .saddr = iph->saddr,
-+ .flowlabel = ip6_flowinfo(iph),
- };
- int err;
-
---
-2.43.0
-
net-mlx5e-fix-features-validation-check-for-tunneled.patch
bluetooth-l2cap-fix-rejecting-l2cap_conn_param_updat.patch
netfilter-ipset-fix-race-between-namespace-cleanup-a.patch
-netfilter-use-flowlabel-flow-key-when-re-routing-man.patch
net-stmmac-replace-priv-speed-with-the-porttransmitr.patch
net-ipv6-fix-the-rt-cache-flush-via-sysctl-using-a-p.patch
ionic-fix-use-after-netif_napi_del.patch
iio-dac-ad5592r-fix-temperature-channel-scaling-value.patch
iio-imu-inv_icm42600-delete-unneeded-update-watermark-call.patch
drivers-core-synchronize-really_probe-and-dev_uevent.patch
-x86-mm-numa-use-numa_no_node-when-calling-memblock_set_node.patch
drm-exynos-vidi-fix-memory-leak-in-.get_modes.patch
drm-exynos-hdmi-report-safe-640x480-mode-as-a-fallback-when-no-edid-found.patch
vmci-prevent-speculation-leaks-by-sanitizing-event-in-event_deliver.patch
+++ /dev/null
-From 3ac36aa7307363b7247ccb6f6a804e11496b2b36 Mon Sep 17 00:00:00 2001
-From: Jan Beulich <jbeulich@suse.com>
-Date: Wed, 29 May 2024 09:42:05 +0200
-Subject: x86/mm/numa: Use NUMA_NO_NODE when calling memblock_set_node()
-
-From: Jan Beulich <jbeulich@suse.com>
-
-commit 3ac36aa7307363b7247ccb6f6a804e11496b2b36 upstream.
-
-memblock_set_node() warns about using MAX_NUMNODES, see
-
- e0eec24e2e19 ("memblock: make memblock_set_node() also warn about use of MAX_NUMNODES")
-
-for details.
-
-Reported-by: Narasimhan V <Narasimhan.V@amd.com>
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-Cc: stable@vger.kernel.org
-[bp: commit message]
-Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
-Reviewed-by: Mike Rapoport (IBM) <rppt@kernel.org>
-Tested-by: Paul E. McKenney <paulmck@kernel.org>
-Link: https://lore.kernel.org/r/20240603141005.23261-1-bp@kernel.org
-Link: https://lore.kernel.org/r/abadb736-a239-49e4-ab42-ace7acdd4278@suse.com
-Signed-off-by: Mike Rapoport (IBM) <rppt@kernel.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- arch/x86/mm/numa.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
---- a/arch/x86/mm/numa.c
-+++ b/arch/x86/mm/numa.c
-@@ -523,7 +523,7 @@ static void __init numa_clear_kernel_nod
- for_each_reserved_mem_region(mb_region) {
- int nid = memblock_get_region_node(mb_region);
-
-- if (nid != MAX_NUMNODES)
-+ if (nid != NUMA_NO_NODE)
- node_set(nid, reserved_nodemask);
- }
-
-@@ -643,9 +643,9 @@ static int __init numa_init(int (*init_f
- nodes_clear(node_online_map);
- memset(&numa_meminfo, 0, sizeof(numa_meminfo));
- WARN_ON(memblock_set_node(0, ULLONG_MAX, &memblock.memory,
-- MAX_NUMNODES));
-+ NUMA_NO_NODE));
- WARN_ON(memblock_set_node(0, ULLONG_MAX, &memblock.reserved,
-- MAX_NUMNODES));
-+ NUMA_NO_NODE));
- /* In case that parsing SRAT failed. */
- WARN_ON(memblock_clear_hotplug(0, ULLONG_MAX));
- numa_reset_distance();
+++ /dev/null
-From 0259c5da8317eb01ce43b537caf0b764ff1c674b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 6 Jun 2024 12:23:31 +0200
-Subject: netfilter: Use flowlabel flow key when re-routing mangled packets
-
-From: Florian Westphal <fw@strlen.de>
-
-[ Upstream commit 6f8f132cc7bac2ac76911e47d5baa378aafda4cb ]
-
-'ip6 dscp set $v' in an nftables outpute route chain has no effect.
-While nftables does detect the dscp change and calls the reroute hook.
-But ip6_route_me_harder never sets the dscp/flowlabel:
-flowlabel/dsfield routing rules are ignored and no reroute takes place.
-
-Thanks to Yi Chen for an excellent reproducer script that I used
-to validate this change.
-
-Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
-Reported-by: Yi Chen <yiche@redhat.com>
-Signed-off-by: Florian Westphal <fw@strlen.de>
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/ipv6/netfilter.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
-index 118e834e91902..cd158e8fb738d 100644
---- a/net/ipv6/netfilter.c
-+++ b/net/ipv6/netfilter.c
-@@ -35,6 +35,7 @@ int ip6_route_me_harder(struct net *net, struct sock *sk_partial, struct sk_buff
- .flowi6_uid = sock_net_uid(net, sk),
- .daddr = iph->daddr,
- .saddr = iph->saddr,
-+ .flowlabel = ip6_flowinfo(iph),
- };
- int err;
-
---
-2.43.0
-
net-mlx5e-fix-features-validation-check-for-tunneled.patch
bluetooth-l2cap-fix-rejecting-l2cap_conn_param_updat.patch
netfilter-ipset-fix-race-between-namespace-cleanup-a.patch
-netfilter-use-flowlabel-flow-key-when-re-routing-man.patch
net-stmmac-replace-priv-speed-with-the-porttransmitr.patch
net-ipv6-fix-the-rt-cache-flush-via-sysctl-using-a-p.patch
ionic-fix-use-after-netif_napi_del.patch
iio-dac-ad5592r-fix-temperature-channel-scaling-value.patch
iio-imu-inv_icm42600-delete-unneeded-update-watermark-call.patch
drivers-core-synchronize-really_probe-and-dev_uevent.patch
-x86-mm-numa-use-numa_no_node-when-calling-memblock_set_node.patch
drm-exynos-vidi-fix-memory-leak-in-.get_modes.patch
drm-exynos-hdmi-report-safe-640x480-mode-as-a-fallback-when-no-edid-found.patch
mptcp-ensure-snd_una-is-properly-initialized-on-connect.patch
+++ /dev/null
-From 3ac36aa7307363b7247ccb6f6a804e11496b2b36 Mon Sep 17 00:00:00 2001
-From: Jan Beulich <jbeulich@suse.com>
-Date: Wed, 29 May 2024 09:42:05 +0200
-Subject: x86/mm/numa: Use NUMA_NO_NODE when calling memblock_set_node()
-
-From: Jan Beulich <jbeulich@suse.com>
-
-commit 3ac36aa7307363b7247ccb6f6a804e11496b2b36 upstream.
-
-memblock_set_node() warns about using MAX_NUMNODES, see
-
- e0eec24e2e19 ("memblock: make memblock_set_node() also warn about use of MAX_NUMNODES")
-
-for details.
-
-Reported-by: Narasimhan V <Narasimhan.V@amd.com>
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-Cc: stable@vger.kernel.org
-[bp: commit message]
-Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
-Reviewed-by: Mike Rapoport (IBM) <rppt@kernel.org>
-Tested-by: Paul E. McKenney <paulmck@kernel.org>
-Link: https://lore.kernel.org/r/20240603141005.23261-1-bp@kernel.org
-Link: https://lore.kernel.org/r/abadb736-a239-49e4-ab42-ace7acdd4278@suse.com
-Signed-off-by: Mike Rapoport (IBM) <rppt@kernel.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- arch/x86/mm/numa.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
---- a/arch/x86/mm/numa.c
-+++ b/arch/x86/mm/numa.c
-@@ -522,7 +522,7 @@ static void __init numa_clear_kernel_nod
- for_each_reserved_mem_region(mb_region) {
- int nid = memblock_get_region_node(mb_region);
-
-- if (nid != MAX_NUMNODES)
-+ if (nid != NUMA_NO_NODE)
- node_set(nid, reserved_nodemask);
- }
-
-@@ -642,9 +642,9 @@ static int __init numa_init(int (*init_f
- nodes_clear(node_online_map);
- memset(&numa_meminfo, 0, sizeof(numa_meminfo));
- WARN_ON(memblock_set_node(0, ULLONG_MAX, &memblock.memory,
-- MAX_NUMNODES));
-+ NUMA_NO_NODE));
- WARN_ON(memblock_set_node(0, ULLONG_MAX, &memblock.reserved,
-- MAX_NUMNODES));
-+ NUMA_NO_NODE));
- /* In case that parsing SRAT failed. */
- WARN_ON(memblock_clear_hotplug(0, ULLONG_MAX));
- numa_reset_distance();
+++ /dev/null
-From 5f1d40bcae0284f18f12ef76a33ef216281bb3a0 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 6 Jun 2024 12:23:31 +0200
-Subject: netfilter: Use flowlabel flow key when re-routing mangled packets
-
-From: Florian Westphal <fw@strlen.de>
-
-[ Upstream commit 6f8f132cc7bac2ac76911e47d5baa378aafda4cb ]
-
-'ip6 dscp set $v' in an nftables outpute route chain has no effect.
-While nftables does detect the dscp change and calls the reroute hook.
-But ip6_route_me_harder never sets the dscp/flowlabel:
-flowlabel/dsfield routing rules are ignored and no reroute takes place.
-
-Thanks to Yi Chen for an excellent reproducer script that I used
-to validate this change.
-
-Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
-Reported-by: Yi Chen <yiche@redhat.com>
-Signed-off-by: Florian Westphal <fw@strlen.de>
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/ipv6/netfilter.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
-index ab9a279dd6d47..ef06d248c3c3d 100644
---- a/net/ipv6/netfilter.c
-+++ b/net/ipv6/netfilter.c
-@@ -35,6 +35,7 @@ int ip6_route_me_harder(struct net *net, struct sock *sk_partial, struct sk_buff
- .flowi6_uid = sock_net_uid(net, sk),
- .daddr = iph->daddr,
- .saddr = iph->saddr,
-+ .flowlabel = ip6_flowinfo(iph),
- };
- int err;
-
---
-2.43.0
-
net-mlx5e-fix-features-validation-check-for-tunneled.patch
bluetooth-l2cap-fix-rejecting-l2cap_conn_param_updat.patch
netfilter-ipset-fix-race-between-namespace-cleanup-a.patch
-netfilter-use-flowlabel-flow-key-when-re-routing-man.patch
net-ipv6-fix-the-rt-cache-flush-via-sysctl-using-a-p.patch
ionic-fix-use-after-netif_napi_del.patch
drivers-core-synchronize-really_probe-and-dev_uevent.patch
+++ /dev/null
-From cb22155fdf04820451fcb5386eefe655f9f39941 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 22 Apr 2024 11:06:44 +0200
-Subject: kbuild: rust: force `alloc` extern to allow "empty" Rust files
-
-From: Miguel Ojeda <ojeda@kernel.org>
-
-[ Upstream commit ded103c7eb23753f22597afa500a7c1ad34116ba ]
-
-If one attempts to build an essentially empty file somewhere in the
-kernel tree, it leads to a build error because the compiler does not
-recognize the `new_uninit` unstable feature:
-
- error[E0635]: unknown feature `new_uninit`
- --> <crate attribute>:1:9
- |
- 1 | feature(new_uninit)
- | ^^^^^^^^^^
-
-The reason is that we pass `-Zcrate-attr='feature(new_uninit)'` (together
-with `-Zallow-features=new_uninit`) to let non-`rust/` code use that
-unstable feature.
-
-However, the compiler only recognizes the feature if the `alloc` crate
-is resolved (the feature is an `alloc` one). `--extern alloc`, which we
-pass, is not enough to resolve the crate.
-
-Introducing a reference like `use alloc;` or `extern crate alloc;`
-solves the issue, thus this is not seen in normal files. For instance,
-`use`ing the `kernel` prelude introduces such a reference, since `alloc`
-is used inside.
-
-While normal use of the build system is not impacted by this, it can still
-be fairly confusing for kernel developers [1], thus use the unstable
-`force` option of `--extern` [2] (added in Rust 1.71 [3]) to force the
-compiler to resolve `alloc`.
-
-This new unstable feature is only needed meanwhile we use the other
-unstable feature, since then we will not need `-Zcrate-attr`.
-
-Cc: stable@vger.kernel.org # v6.6+
-Reported-by: Daniel Almeida <daniel.almeida@collabora.com>
-Reported-by: Julian Stecklina <julian.stecklina@cyberus-technology.de>
-Closes: https://rust-for-linux.zulipchat.com/#narrow/stream/288089-General/topic/x/near/424096982 [1]
-Fixes: 2f7ab1267dc9 ("Kbuild: add Rust support")
-Link: https://github.com/rust-lang/rust/issues/111302 [2]
-Link: https://github.com/rust-lang/rust/pull/109421 [3]
-Reviewed-by: Alice Ryhl <aliceryhl@google.com>
-Reviewed-by: Gary Guo <gary@garyguo.net>
-Link: https://lore.kernel.org/r/20240422090644.525520-1-ojeda@kernel.org
-Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- scripts/Makefile.build | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/scripts/Makefile.build b/scripts/Makefile.build
-index 1827bc1db1e98..78f9cf73d96b2 100644
---- a/scripts/Makefile.build
-+++ b/scripts/Makefile.build
-@@ -285,7 +285,7 @@ rust_common_cmd = \
- -Zallow-features=$(rust_allowed_features) \
- -Zcrate-attr=no_std \
- -Zcrate-attr='feature($(rust_allowed_features))' \
-- --extern alloc --extern kernel \
-+ -Zunstable-options --extern force:alloc --extern kernel \
- --crate-type rlib -L $(objtree)/rust/ \
- --crate-name $(basename $(notdir $@)) \
- --out-dir $(dir $@) --emit=dep-info=$(depfile)
---
-2.43.0
-
af_unix-use-skb_queue_len_lockless-in-sk_diag_show_r.patch
af_unix-annotate-data-race-of-sk-sk_shutdown-in-sk_d.patch
ipv6-fix-possible-race-in-__fib6_drop_pcpu_from.patch
-kbuild-rust-force-alloc-extern-to-allow-empty-rust-f.patch
bluetooth-qca-fix-invalid-device-address-check.patch
btrfs-fix-wrong-block_start-calculation-for-btrfs_dr.patch
usb-gadget-f_fs-use-io_data-status-consistently.patch
iio-dac-ad5592r-fix-temperature-channel-scaling-value.patch
iio-imu-inv_icm42600-delete-unneeded-update-watermark-call.patch
drivers-core-synchronize-really_probe-and-dev_uevent.patch
-x86-mm-numa-use-numa_no_node-when-calling-memblock_set_node.patch
drm-exynos-vidi-fix-memory-leak-in-.get_modes.patch
drm-exynos-hdmi-report-safe-640x480-mode-as-a-fallback-when-no-edid-found.patch
mptcp-ensure-snd_una-is-properly-initialized-on-connect.patch
+++ /dev/null
-From 3ac36aa7307363b7247ccb6f6a804e11496b2b36 Mon Sep 17 00:00:00 2001
-From: Jan Beulich <jbeulich@suse.com>
-Date: Wed, 29 May 2024 09:42:05 +0200
-Subject: x86/mm/numa: Use NUMA_NO_NODE when calling memblock_set_node()
-
-From: Jan Beulich <jbeulich@suse.com>
-
-commit 3ac36aa7307363b7247ccb6f6a804e11496b2b36 upstream.
-
-memblock_set_node() warns about using MAX_NUMNODES, see
-
- e0eec24e2e19 ("memblock: make memblock_set_node() also warn about use of MAX_NUMNODES")
-
-for details.
-
-Reported-by: Narasimhan V <Narasimhan.V@amd.com>
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-Cc: stable@vger.kernel.org
-[bp: commit message]
-Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
-Reviewed-by: Mike Rapoport (IBM) <rppt@kernel.org>
-Tested-by: Paul E. McKenney <paulmck@kernel.org>
-Link: https://lore.kernel.org/r/20240603141005.23261-1-bp@kernel.org
-Link: https://lore.kernel.org/r/abadb736-a239-49e4-ab42-ace7acdd4278@suse.com
-Signed-off-by: Mike Rapoport (IBM) <rppt@kernel.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- arch/x86/mm/numa.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
---- a/arch/x86/mm/numa.c
-+++ b/arch/x86/mm/numa.c
-@@ -523,7 +523,7 @@ static void __init numa_clear_kernel_nod
- for_each_reserved_mem_region(mb_region) {
- int nid = memblock_get_region_node(mb_region);
-
-- if (nid != MAX_NUMNODES)
-+ if (nid != NUMA_NO_NODE)
- node_set(nid, reserved_nodemask);
- }
-
-@@ -643,9 +643,9 @@ static int __init numa_init(int (*init_f
- nodes_clear(node_online_map);
- memset(&numa_meminfo, 0, sizeof(numa_meminfo));
- WARN_ON(memblock_set_node(0, ULLONG_MAX, &memblock.memory,
-- MAX_NUMNODES));
-+ NUMA_NO_NODE));
- WARN_ON(memblock_set_node(0, ULLONG_MAX, &memblock.reserved,
-- MAX_NUMNODES));
-+ NUMA_NO_NODE));
- /* In case that parsing SRAT failed. */
- WARN_ON(memblock_clear_hotplug(0, ULLONG_MAX));
- numa_reset_distance();
+++ /dev/null
-From 5b3aec93e827c7c6217daec225d3881015346967 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 19 Mar 2024 19:33:20 +0800
-Subject: ext4: fix slab-out-of-bounds in
- ext4_mb_find_good_group_avg_frag_lists()
-
-From: Baokun Li <libaokun1@huawei.com>
-
-[ Upstream commit 13df4d44a3aaabe61cd01d277b6ee23ead2a5206 ]
-
-We can trigger a slab-out-of-bounds with the following commands:
-
- mkfs.ext4 -F /dev/$disk 10G
- mount /dev/$disk /tmp/test
- echo 2147483647 > /sys/fs/ext4/$disk/mb_group_prealloc
- echo test > /tmp/test/file && sync
-
-==================================================================
-BUG: KASAN: slab-out-of-bounds in ext4_mb_find_good_group_avg_frag_lists+0x8a/0x200 [ext4]
-Read of size 8 at addr ffff888121b9d0f0 by task kworker/u2:0/11
-CPU: 0 PID: 11 Comm: kworker/u2:0 Tainted: GL 6.7.0-next-20240118 #521
-Call Trace:
- dump_stack_lvl+0x2c/0x50
- kasan_report+0xb6/0xf0
- ext4_mb_find_good_group_avg_frag_lists+0x8a/0x200 [ext4]
- ext4_mb_regular_allocator+0x19e9/0x2370 [ext4]
- ext4_mb_new_blocks+0x88a/0x1370 [ext4]
- ext4_ext_map_blocks+0x14f7/0x2390 [ext4]
- ext4_map_blocks+0x569/0xea0 [ext4]
- ext4_do_writepages+0x10f6/0x1bc0 [ext4]
-[...]
-==================================================================
-
-The flow of issue triggering is as follows:
-
-// Set s_mb_group_prealloc to 2147483647 via sysfs
-ext4_mb_new_blocks
- ext4_mb_normalize_request
- ext4_mb_normalize_group_request
- ac->ac_g_ex.fe_len = EXT4_SB(sb)->s_mb_group_prealloc
- ext4_mb_regular_allocator
- ext4_mb_choose_next_group
- ext4_mb_choose_next_group_best_avail
- mb_avg_fragment_size_order
- order = fls(len) - 2 = 29
- ext4_mb_find_good_group_avg_frag_lists
- frag_list = &sbi->s_mb_avg_fragment_size[order]
- if (list_empty(frag_list)) // Trigger SOOB!
-
-At 4k block size, the length of the s_mb_avg_fragment_size list is 14,
-but an oversized s_mb_group_prealloc is set, causing slab-out-of-bounds
-to be triggered by an attempt to access an element at index 29.
-
-Add a new attr_id attr_clusters_in_group with values in the range
-[0, sbi->s_clusters_per_group] and declare mb_group_prealloc as
-that type to fix the issue. In addition avoid returning an order
-from mb_avg_fragment_size_order() greater than MB_NUM_ORDERS(sb)
-and reduce some useless loops.
-
-Fixes: 7e170922f06b ("ext4: Add allocation criteria 1.5 (CR1_5)")
-CC: stable@vger.kernel.org
-Signed-off-by: Baokun Li <libaokun1@huawei.com>
-Reviewed-by: Jan Kara <jack@suse.cz>
-Reviewed-by: Ojaswin Mujoo <ojaswin@linux.ibm.com>
-Link: https://lore.kernel.org/r/20240319113325.3110393-5-libaokun1@huawei.com
-Signed-off-by: Theodore Ts'o <tytso@mit.edu>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/ext4/mballoc.c | 4 ++++
- fs/ext4/sysfs.c | 13 ++++++++++++-
- 2 files changed, 16 insertions(+), 1 deletion(-)
-
-diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
-index aadfeb0f5b7f3..f55ab800a7539 100644
---- a/fs/ext4/mballoc.c
-+++ b/fs/ext4/mballoc.c
-@@ -831,6 +831,8 @@ static int mb_avg_fragment_size_order(struct super_block *sb, ext4_grpblk_t len)
- return 0;
- if (order == MB_NUM_ORDERS(sb))
- order--;
-+ if (WARN_ON_ONCE(order > MB_NUM_ORDERS(sb)))
-+ order = MB_NUM_ORDERS(sb) - 1;
- return order;
- }
-
-@@ -1008,6 +1010,8 @@ static void ext4_mb_choose_next_group_best_avail(struct ext4_allocation_context
- * goal length.
- */
- order = fls(ac->ac_g_ex.fe_len) - 1;
-+ if (WARN_ON_ONCE(order - 1 > MB_NUM_ORDERS(ac->ac_sb)))
-+ order = MB_NUM_ORDERS(ac->ac_sb);
- min_order = order - sbi->s_mb_best_avail_max_trim_order;
- if (min_order < 0)
- min_order = 0;
-diff --git a/fs/ext4/sysfs.c b/fs/ext4/sysfs.c
-index 295ea9a32de91..ca66e33f61815 100644
---- a/fs/ext4/sysfs.c
-+++ b/fs/ext4/sysfs.c
-@@ -29,6 +29,7 @@ typedef enum {
- attr_trigger_test_error,
- attr_first_error_time,
- attr_last_error_time,
-+ attr_clusters_in_group,
- attr_feature,
- attr_pointer_ui,
- attr_pointer_ul,
-@@ -207,13 +208,14 @@ EXT4_ATTR_FUNC(sra_exceeded_retry_limit, 0444);
-
- EXT4_ATTR_OFFSET(inode_readahead_blks, 0644, inode_readahead,
- ext4_sb_info, s_inode_readahead_blks);
-+EXT4_ATTR_OFFSET(mb_group_prealloc, 0644, clusters_in_group,
-+ ext4_sb_info, s_mb_group_prealloc);
- EXT4_RW_ATTR_SBI_UI(inode_goal, s_inode_goal);
- EXT4_RW_ATTR_SBI_UI(mb_stats, s_mb_stats);
- EXT4_RW_ATTR_SBI_UI(mb_max_to_scan, s_mb_max_to_scan);
- EXT4_RW_ATTR_SBI_UI(mb_min_to_scan, s_mb_min_to_scan);
- EXT4_RW_ATTR_SBI_UI(mb_order2_req, s_mb_order2_reqs);
- EXT4_RW_ATTR_SBI_UI(mb_stream_req, s_mb_stream_request);
--EXT4_RW_ATTR_SBI_UI(mb_group_prealloc, s_mb_group_prealloc);
- EXT4_RW_ATTR_SBI_UI(mb_max_linear_groups, s_mb_max_linear_groups);
- EXT4_RW_ATTR_SBI_UI(extent_max_zeroout_kb, s_extent_max_zeroout_kb);
- EXT4_ATTR(trigger_fs_error, 0200, trigger_test_error);
-@@ -376,6 +378,7 @@ static ssize_t ext4_generic_attr_show(struct ext4_attr *a,
-
- switch (a->attr_id) {
- case attr_inode_readahead:
-+ case attr_clusters_in_group:
- case attr_pointer_ui:
- if (a->attr_ptr == ptr_ext4_super_block_offset)
- return sysfs_emit(buf, "%u\n", le32_to_cpup(ptr));
-@@ -459,6 +462,14 @@ static ssize_t ext4_attr_store(struct kobject *kobj,
- else
- *((unsigned int *) ptr) = t;
- return len;
-+ case attr_clusters_in_group:
-+ ret = kstrtouint(skip_spaces(buf), 0, &t);
-+ if (ret)
-+ return ret;
-+ if (t > sbi->s_clusters_per_group)
-+ return -EINVAL;
-+ *((unsigned int *) ptr) = t;
-+ return len;
- case attr_pointer_ul:
- if (!ptr)
- return 0;
---
-2.43.0
-
irqchip-riscv-intc-prevent-memory-leak-when-riscv_in.patch
ext4-avoid-overflow-when-setting-values-via-sysfs.patch
ext4-refactor-out-ext4_generic_attr_show.patch
-ext4-fix-slab-out-of-bounds-in-ext4_mb_find_good_gro.patch
eventfs-update-all-the-eventfs_inodes-from-the-event.patch
bpf-fix-multi-uprobe-pid-filtering-logic.patch
nilfs2-return-the-mapped-address-from-nilfs_get_page.patch
drivers-core-synchronize-really_probe-and-dev_uevent.patch
parisc-try-to-fix-random-segmentation-faults-in-package-builds.patch
acpi-x86-force-storaged3enable-on-more-products.patch
-x86-mm-numa-use-numa_no_node-when-calling-memblock_set_node.patch
drm-exynos-vidi-fix-memory-leak-in-.get_modes.patch
drm-exynos-hdmi-report-safe-640x480-mode-as-a-fallback-when-no-edid-found.patch
mptcp-ensure-snd_una-is-properly-initialized-on-connect.patch
+++ /dev/null
-From 3ac36aa7307363b7247ccb6f6a804e11496b2b36 Mon Sep 17 00:00:00 2001
-From: Jan Beulich <jbeulich@suse.com>
-Date: Wed, 29 May 2024 09:42:05 +0200
-Subject: x86/mm/numa: Use NUMA_NO_NODE when calling memblock_set_node()
-
-From: Jan Beulich <jbeulich@suse.com>
-
-commit 3ac36aa7307363b7247ccb6f6a804e11496b2b36 upstream.
-
-memblock_set_node() warns about using MAX_NUMNODES, see
-
- e0eec24e2e19 ("memblock: make memblock_set_node() also warn about use of MAX_NUMNODES")
-
-for details.
-
-Reported-by: Narasimhan V <Narasimhan.V@amd.com>
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-Cc: stable@vger.kernel.org
-[bp: commit message]
-Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
-Reviewed-by: Mike Rapoport (IBM) <rppt@kernel.org>
-Tested-by: Paul E. McKenney <paulmck@kernel.org>
-Link: https://lore.kernel.org/r/20240603141005.23261-1-bp@kernel.org
-Link: https://lore.kernel.org/r/abadb736-a239-49e4-ab42-ace7acdd4278@suse.com
-Signed-off-by: Mike Rapoport (IBM) <rppt@kernel.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- arch/x86/mm/numa.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
---- a/arch/x86/mm/numa.c
-+++ b/arch/x86/mm/numa.c
-@@ -523,7 +523,7 @@ static void __init numa_clear_kernel_nod
- for_each_reserved_mem_region(mb_region) {
- int nid = memblock_get_region_node(mb_region);
-
-- if (nid != MAX_NUMNODES)
-+ if (nid != NUMA_NO_NODE)
- node_set(nid, reserved_nodemask);
- }
-
-@@ -643,9 +643,9 @@ static int __init numa_init(int (*init_f
- nodes_clear(node_online_map);
- memset(&numa_meminfo, 0, sizeof(numa_meminfo));
- WARN_ON(memblock_set_node(0, ULLONG_MAX, &memblock.memory,
-- MAX_NUMNODES));
-+ NUMA_NO_NODE));
- WARN_ON(memblock_set_node(0, ULLONG_MAX, &memblock.reserved,
-- MAX_NUMNODES));
-+ NUMA_NO_NODE));
- /* In case that parsing SRAT failed. */
- WARN_ON(memblock_clear_hotplug(0, ULLONG_MAX));
- numa_reset_distance();
+++ /dev/null
-From 84cee2d2394a43766dd2990edac8a4a05817ef7b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 19 Mar 2024 19:33:20 +0800
-Subject: ext4: fix slab-out-of-bounds in
- ext4_mb_find_good_group_avg_frag_lists()
-
-From: Baokun Li <libaokun1@huawei.com>
-
-[ Upstream commit 13df4d44a3aaabe61cd01d277b6ee23ead2a5206 ]
-
-We can trigger a slab-out-of-bounds with the following commands:
-
- mkfs.ext4 -F /dev/$disk 10G
- mount /dev/$disk /tmp/test
- echo 2147483647 > /sys/fs/ext4/$disk/mb_group_prealloc
- echo test > /tmp/test/file && sync
-
-==================================================================
-BUG: KASAN: slab-out-of-bounds in ext4_mb_find_good_group_avg_frag_lists+0x8a/0x200 [ext4]
-Read of size 8 at addr ffff888121b9d0f0 by task kworker/u2:0/11
-CPU: 0 PID: 11 Comm: kworker/u2:0 Tainted: GL 6.7.0-next-20240118 #521
-Call Trace:
- dump_stack_lvl+0x2c/0x50
- kasan_report+0xb6/0xf0
- ext4_mb_find_good_group_avg_frag_lists+0x8a/0x200 [ext4]
- ext4_mb_regular_allocator+0x19e9/0x2370 [ext4]
- ext4_mb_new_blocks+0x88a/0x1370 [ext4]
- ext4_ext_map_blocks+0x14f7/0x2390 [ext4]
- ext4_map_blocks+0x569/0xea0 [ext4]
- ext4_do_writepages+0x10f6/0x1bc0 [ext4]
-[...]
-==================================================================
-
-The flow of issue triggering is as follows:
-
-// Set s_mb_group_prealloc to 2147483647 via sysfs
-ext4_mb_new_blocks
- ext4_mb_normalize_request
- ext4_mb_normalize_group_request
- ac->ac_g_ex.fe_len = EXT4_SB(sb)->s_mb_group_prealloc
- ext4_mb_regular_allocator
- ext4_mb_choose_next_group
- ext4_mb_choose_next_group_best_avail
- mb_avg_fragment_size_order
- order = fls(len) - 2 = 29
- ext4_mb_find_good_group_avg_frag_lists
- frag_list = &sbi->s_mb_avg_fragment_size[order]
- if (list_empty(frag_list)) // Trigger SOOB!
-
-At 4k block size, the length of the s_mb_avg_fragment_size list is 14,
-but an oversized s_mb_group_prealloc is set, causing slab-out-of-bounds
-to be triggered by an attempt to access an element at index 29.
-
-Add a new attr_id attr_clusters_in_group with values in the range
-[0, sbi->s_clusters_per_group] and declare mb_group_prealloc as
-that type to fix the issue. In addition avoid returning an order
-from mb_avg_fragment_size_order() greater than MB_NUM_ORDERS(sb)
-and reduce some useless loops.
-
-Fixes: 7e170922f06b ("ext4: Add allocation criteria 1.5 (CR1_5)")
-CC: stable@vger.kernel.org
-Signed-off-by: Baokun Li <libaokun1@huawei.com>
-Reviewed-by: Jan Kara <jack@suse.cz>
-Reviewed-by: Ojaswin Mujoo <ojaswin@linux.ibm.com>
-Link: https://lore.kernel.org/r/20240319113325.3110393-5-libaokun1@huawei.com
-Signed-off-by: Theodore Ts'o <tytso@mit.edu>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/ext4/mballoc.c | 4 ++++
- fs/ext4/sysfs.c | 13 ++++++++++++-
- 2 files changed, 16 insertions(+), 1 deletion(-)
-
-diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
-index 714f83632e3f9..66b5a68b0254e 100644
---- a/fs/ext4/mballoc.c
-+++ b/fs/ext4/mballoc.c
-@@ -831,6 +831,8 @@ static int mb_avg_fragment_size_order(struct super_block *sb, ext4_grpblk_t len)
- return 0;
- if (order == MB_NUM_ORDERS(sb))
- order--;
-+ if (WARN_ON_ONCE(order > MB_NUM_ORDERS(sb)))
-+ order = MB_NUM_ORDERS(sb) - 1;
- return order;
- }
-
-@@ -1008,6 +1010,8 @@ static void ext4_mb_choose_next_group_best_avail(struct ext4_allocation_context
- * goal length.
- */
- order = fls(ac->ac_g_ex.fe_len) - 1;
-+ if (WARN_ON_ONCE(order - 1 > MB_NUM_ORDERS(ac->ac_sb)))
-+ order = MB_NUM_ORDERS(ac->ac_sb);
- min_order = order - sbi->s_mb_best_avail_max_trim_order;
- if (min_order < 0)
- min_order = 0;
-diff --git a/fs/ext4/sysfs.c b/fs/ext4/sysfs.c
-index 295ea9a32de91..ca66e33f61815 100644
---- a/fs/ext4/sysfs.c
-+++ b/fs/ext4/sysfs.c
-@@ -29,6 +29,7 @@ typedef enum {
- attr_trigger_test_error,
- attr_first_error_time,
- attr_last_error_time,
-+ attr_clusters_in_group,
- attr_feature,
- attr_pointer_ui,
- attr_pointer_ul,
-@@ -207,13 +208,14 @@ EXT4_ATTR_FUNC(sra_exceeded_retry_limit, 0444);
-
- EXT4_ATTR_OFFSET(inode_readahead_blks, 0644, inode_readahead,
- ext4_sb_info, s_inode_readahead_blks);
-+EXT4_ATTR_OFFSET(mb_group_prealloc, 0644, clusters_in_group,
-+ ext4_sb_info, s_mb_group_prealloc);
- EXT4_RW_ATTR_SBI_UI(inode_goal, s_inode_goal);
- EXT4_RW_ATTR_SBI_UI(mb_stats, s_mb_stats);
- EXT4_RW_ATTR_SBI_UI(mb_max_to_scan, s_mb_max_to_scan);
- EXT4_RW_ATTR_SBI_UI(mb_min_to_scan, s_mb_min_to_scan);
- EXT4_RW_ATTR_SBI_UI(mb_order2_req, s_mb_order2_reqs);
- EXT4_RW_ATTR_SBI_UI(mb_stream_req, s_mb_stream_request);
--EXT4_RW_ATTR_SBI_UI(mb_group_prealloc, s_mb_group_prealloc);
- EXT4_RW_ATTR_SBI_UI(mb_max_linear_groups, s_mb_max_linear_groups);
- EXT4_RW_ATTR_SBI_UI(extent_max_zeroout_kb, s_extent_max_zeroout_kb);
- EXT4_ATTR(trigger_fs_error, 0200, trigger_test_error);
-@@ -376,6 +378,7 @@ static ssize_t ext4_generic_attr_show(struct ext4_attr *a,
-
- switch (a->attr_id) {
- case attr_inode_readahead:
-+ case attr_clusters_in_group:
- case attr_pointer_ui:
- if (a->attr_ptr == ptr_ext4_super_block_offset)
- return sysfs_emit(buf, "%u\n", le32_to_cpup(ptr));
-@@ -459,6 +462,14 @@ static ssize_t ext4_attr_store(struct kobject *kobj,
- else
- *((unsigned int *) ptr) = t;
- return len;
-+ case attr_clusters_in_group:
-+ ret = kstrtouint(skip_spaces(buf), 0, &t);
-+ if (ret)
-+ return ret;
-+ if (t > sbi->s_clusters_per_group)
-+ return -EINVAL;
-+ *((unsigned int *) ptr) = t;
-+ return len;
- case attr_pointer_ul:
- if (!ptr)
- return 0;
---
-2.43.0
-
+++ /dev/null
-From 323ac0f0571f76d91b481ff8a0194b7149387786 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 6 Jun 2024 12:23:31 +0200
-Subject: netfilter: Use flowlabel flow key when re-routing mangled packets
-
-From: Florian Westphal <fw@strlen.de>
-
-[ Upstream commit 6f8f132cc7bac2ac76911e47d5baa378aafda4cb ]
-
-'ip6 dscp set $v' in an nftables outpute route chain has no effect.
-While nftables does detect the dscp change and calls the reroute hook.
-But ip6_route_me_harder never sets the dscp/flowlabel:
-flowlabel/dsfield routing rules are ignored and no reroute takes place.
-
-Thanks to Yi Chen for an excellent reproducer script that I used
-to validate this change.
-
-Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
-Reported-by: Yi Chen <yiche@redhat.com>
-Signed-off-by: Florian Westphal <fw@strlen.de>
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/ipv6/netfilter.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
-index 53d255838e6ab..5d989d803009f 100644
---- a/net/ipv6/netfilter.c
-+++ b/net/ipv6/netfilter.c
-@@ -36,6 +36,7 @@ int ip6_route_me_harder(struct net *net, struct sock *sk_partial, struct sk_buff
- .flowi6_uid = sock_net_uid(net, sk),
- .daddr = iph->daddr,
- .saddr = iph->saddr,
-+ .flowlabel = ip6_flowinfo(iph),
- };
- int err;
-
---
-2.43.0
-
selftests-mm-compaction_test-fix-bogus-test-success-.patch
ext4-avoid-overflow-when-setting-values-via-sysfs.patch
ext4-refactor-out-ext4_generic_attr_show.patch
-ext4-fix-slab-out-of-bounds-in-ext4_mb_find_good_gro.patch
eventfs-update-all-the-eventfs_inodes-from-the-event.patch
.editorconfig-remove-trim_trailing_whitespace-option.patch
io_uring-rsrc-don-t-lock-while-task_running.patch
drm-nouveau-don-t-attempt-to-schedule-hpd_work-on-he.patch
netfilter-nft_inner-validate-mandatory-meta-and-payl.patch
netfilter-ipset-fix-race-between-namespace-cleanup-a.patch
-netfilter-use-flowlabel-flow-key-when-re-routing-man.patch
x86-asm-use-c-n-instead-of-p-operand-modifier-in-asm.patch
x86-uaccess-fix-missed-zeroing-of-ia32-u64-get_user-.patch
scsi-ufs-core-quiesce-request-queues-before-checking.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
