From: Greg Kroah-Hartman Date: Thu, 30 Jul 2026 12:40:17 +0000 (+0200) Subject: 6.12-stable patches X-Git-Tag: v6.6.148~34 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=2bcded096312f00b82f8125b7ffb361142bd1fbc;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: mm-damon-core-disallow-overlapping-input-ranges-for-damon_set_regions.patch mm-damon-core-validate-ranges-in-damon_set_regions.patch rust-allow-suspicious_runtime_symbol_definitions-lint-for-rust-1.98.patch --- diff --git a/queue-6.12/mm-damon-core-disallow-overlapping-input-ranges-for-damon_set_regions.patch b/queue-6.12/mm-damon-core-disallow-overlapping-input-ranges-for-damon_set_regions.patch new file mode 100644 index 0000000000..69d232f2c2 --- /dev/null +++ b/queue-6.12/mm-damon-core-disallow-overlapping-input-ranges-for-damon_set_regions.patch @@ -0,0 +1,70 @@ +From 954157679ec34661c2e87e7eb796104a797c32db Mon Sep 17 00:00:00 2001 +From: SJ Park +Date: Fri, 3 Jul 2026 09:56:08 -0700 +Subject: mm/damon/core: disallow overlapping input ranges for damon_set_regions() + +From: SJ Park + +commit 954157679ec34661c2e87e7eb796104a797c32db upstream. + +damon_set_regions() assumes the input ranges are sorted by the address and +don't overlap each other. Hence the assumption was initially to be +explicitly validated. But commit 97d482f4592f ("mm/damon/sysfs: reuse +damon_set_regions() for regions setting") has mistakenly removed the +validation. + +This can make DAMON behave in unexpected ways. At the best, the +monitoring results snapshot will just look weird since there will be +overlapping regions. DAMOS will also work weirdly, applying the same +action multiple times for overlapping regions, and make DAMOS quota weird. +More seriously, depending on the setup and regions updates sequence, +negative size regions can be made. It will trigger WARN_ONCE() if the +kernel is built with CONFIG_DAMON_DEBUG_SANITY=y. Depending on the +monitoring results, the negative size region can further trigger division +by zero in damon_merge_two_regions(). + +Note that some of the consequences including the WARN_ONCE() and the +divide by zero depend on commits that were introduced after the root cause +commit 97d482f4592f ("mm/damon/sysfs: reuse damon_set_regions() for +regions setting"). + +Fix the problems by checking the assumption and returning an error if +the input ranges don't meet the assumption. + +The issue was discovered [1] by Sashiko. + +Link: https://lore.kernel.org/20260703165610.92894-1-sj@kernel.org +Link: https://lore.kernel.org/20260630041806.151124-1-sj@kernel.org [1] +Fixes: 97d482f4592f ("mm/damon/sysfs: reuse damon_set_regions() for regions setting") +Signed-off-by: SJ Park +Cc: # 5.19.x +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/damon/core.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/mm/damon/core.c ++++ b/mm/damon/core.c +@@ -212,12 +212,19 @@ int damon_set_regions(struct damon_targe + { + struct damon_region *r, *next; + unsigned int i; ++ unsigned long last_end; + int err; + + for (i = 0; i < nr_ranges; i++) { +- if (ALIGN_DOWN(ranges[i].start, DAMON_MIN_REGION) >= +- ALIGN(ranges[i].end, DAMON_MIN_REGION)) ++ unsigned long start, end; ++ ++ start = ALIGN_DOWN(ranges[i].start, DAMON_MIN_REGION); ++ end = ALIGN(ranges[i].end, DAMON_MIN_REGION); ++ if (start >= end) ++ return -EINVAL; ++ if (i > 0 && last_end > start) + return -EINVAL; ++ last_end = end; + } + + /* Remove regions which are not in the new ranges */ diff --git a/queue-6.12/mm-damon-core-validate-ranges-in-damon_set_regions.patch b/queue-6.12/mm-damon-core-validate-ranges-in-damon_set_regions.patch new file mode 100644 index 0000000000..5fc799eca4 --- /dev/null +++ b/queue-6.12/mm-damon-core-validate-ranges-in-damon_set_regions.patch @@ -0,0 +1,60 @@ +From 1292c0ecb1caefb8ca064a3639d5673991e8810c Mon Sep 17 00:00:00 2001 +From: SJ Park +Date: Mon, 29 Jun 2026 20:52:19 -0700 +Subject: mm/damon/core: validate ranges in damon_set_regions() + +From: SJ Park + +commit 1292c0ecb1caefb8ca064a3639d5673991e8810c upstream. + +DAMON core logic assumes zero length regions don't exist. However, a few +DAMON API callers including DAMON_SYSFS, DAMON_RECLAIM and DAMON_LRU_SORT +allow users to set empty monitoring target regions. This could result in +WARN_ONCE() on CONFIG_DAMON_DEBUG_SANITY enabled kernel, and +divide-by-zero from damon_merge_two_regions(). + +For example, the WANR_ONCE() can be triggered like below. + + # grep DAMON_DEBUG_SANITY /boot/config-$(uname -r) + # CONFIG_DAMON_DEBUG_SANITY=y + # damo start + # cd /sys/kernel/mm/damon/admin/kdamonds/0 + # echo 0 > contexts/0/targets/0/regions/0/start + # echo 0 > contexts/0/targets/0/regions/0/end + # echo commit > state + # dmesg + [....] + [ 73.705780] ------------[ cut here ]------------ + [ 73.707552] start 0 >= end 0 + [ 73.708452] WARNING: mm/damon/core.c:359 at damon_new_region+0x6e/0x80, CPU#1: kdamond.0/758 + [...] + +All DAMON API callers eventually use damon_set_regions() to setup the +regions. Add the validation logic in the function. + +Link: https://lore.kernel.org/20260630035221.146458-1-sj@kernel.org +Fixes: 43b0536cb471 ("mm/damon: introduce DAMON-based Reclamation (DAMON_RECLAIM)") +Signed-off-by: SJ Park +Cc: Yang yingliang +Cc: # 5.16.x +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/damon/core.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/mm/damon/core.c ++++ b/mm/damon/core.c +@@ -214,6 +214,12 @@ int damon_set_regions(struct damon_targe + unsigned int i; + int err; + ++ for (i = 0; i < nr_ranges; i++) { ++ if (ALIGN_DOWN(ranges[i].start, DAMON_MIN_REGION) >= ++ ALIGN(ranges[i].end, DAMON_MIN_REGION)) ++ return -EINVAL; ++ } ++ + /* Remove regions which are not in the new ranges */ + damon_for_each_region_safe(r, next, t) { + for (i = 0; i < nr_ranges; i++) { diff --git a/queue-6.12/rust-allow-suspicious_runtime_symbol_definitions-lint-for-rust-1.98.patch b/queue-6.12/rust-allow-suspicious_runtime_symbol_definitions-lint-for-rust-1.98.patch new file mode 100644 index 0000000000..faa471b46c --- /dev/null +++ b/queue-6.12/rust-allow-suspicious_runtime_symbol_definitions-lint-for-rust-1.98.patch @@ -0,0 +1,107 @@ +From 608045a91d9176d66b2114d0006bc8b57dff2ca9 Mon Sep 17 00:00:00 2001 +From: Miguel Ojeda +Date: Mon, 15 Jun 2026 16:32:25 +0200 +Subject: rust: allow `suspicious_runtime_symbol_definitions` lint for Rust >= 1.98 + +From: Miguel Ojeda + +commit 608045a91d9176d66b2114d0006bc8b57dff2ca9 upstream. + +Starting with Rust 1.98.0 (expected 2026-08-20), Rust is introducing a +couple new lints, `invalid_runtime_symbol_definitions` (deny-by-default) +and `suspicious_runtime_symbol_definitions` (warn-by-default), which check +the signature of items whose symbol name is a runtime symbol expected by +`core`. + +Our build hits the second one, i.e. the warning: + + error: suspicious definition of the runtime `strlen` symbol used by the standard library + --> rust/bindings/bindings_generated.rs:20018:5 + | + 20018 | pub fn strlen(s: *const ffi::c_char) -> usize; + | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + | + = note: expected `unsafe extern "C" fn(*const i8) -> usize` + found `unsafe extern "C" fn(*const u8) -> usize` + = help: either fix the signature or remove any attributes like `#[unsafe(no_mangle)]`, `#[unsafe(export_name = "strlen")]`, or `#[link_name = "strlen"]` + = help: allow this lint if the signature is compatible + = note: `-D suspicious-runtime-symbol-definitions` implied by `-D warnings` + = help: to override `-D warnings` add `#[allow(suspicious_runtime_symbol_definitions)]` + + error: suspicious definition of the runtime `strlen` symbol used by the standard library + --> rust/uapi/uapi_generated.rs:14236:5 + | + 14236 | pub fn strlen(s: *const ffi::c_char) -> usize; + | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + | + = note: expected `unsafe extern "C" fn(*const i8) -> usize` + found `unsafe extern "C" fn(*const u8) -> usize` + = help: either fix the signature or remove any attributes like `#[unsafe(no_mangle)]`, `#[unsafe(export_name = "strlen")]`, or `#[link_name = "strlen"]` + = help: allow this lint if the signature is compatible + = note: `-D suspicious-runtime-symbol-definitions` implied by `-D warnings` + = help: to override `-D warnings` add `#[allow(suspicious_runtime_symbol_definitions)]` + +Thus `allow` the lint in `bindings` and `uapi`. + +A more targeted alternative to avoid `allow`ing it would be to pass +`--blocklist-function strlen` to `bindgen`, but we would perhaps need +to adjust if other C headers end up adding more (or Rust checking more). +Since it is just the less critical one that we hit, and since eventually +this should be properly fixed by getting upstream Rust to provide a flag +like GCC/Clang's `-funsigned-char` [2][3], just `allow` it for now. + +Cc: Urgau +Cc: stable@vger.kernel.org # Needed in 6.12.y and later (Rust is pinned in older LTSs). +Link: https://github.com/rust-lang/rust/pull/155521 [1] +Link: https://github.com/rust-lang/rust/issues/138446 [2] +Link: https://github.com/Rust-for-Linux/linux/issues/355 [3] +Reviewed-by: Gary Guo +Reviewed-by: Alice Ryhl +Reviewed-by: Tamir Duberstein +Link: https://patch.msgid.link/20260615143225.471756-1-ojeda@kernel.org +Signed-off-by: Miguel Ojeda +Signed-off-by: Greg Kroah-Hartman +--- + init/Kconfig | 3 +++ + rust/bindings/lib.rs | 4 ++++ + rust/uapi/lib.rs | 4 ++++ + 3 files changed, 11 insertions(+) + +--- a/init/Kconfig ++++ b/init/Kconfig +@@ -140,6 +140,9 @@ config LD_CAN_USE_KEEP_IN_OVERLAY + config RUSTC_HAS_UNNECESSARY_TRANSMUTES + def_bool RUSTC_VERSION >= 108800 + ++config RUSTC_HAS_SUSPICIOUS_RUNTIME_SYMBOL_DEFINITIONS ++ def_bool RUSTC_VERSION >= 109800 ++ + config PAHOLE_VERSION + int + default $(shell,$(srctree)/scripts/pahole-version.sh $(PAHOLE)) +--- a/rust/bindings/lib.rs ++++ b/rust/bindings/lib.rs +@@ -27,6 +27,10 @@ + #[allow(dead_code)] + #[allow(clippy::undocumented_unsafe_blocks)] + #[cfg_attr(CONFIG_RUSTC_HAS_UNNECESSARY_TRANSMUTES, allow(unnecessary_transmutes))] ++#[cfg_attr( ++ CONFIG_RUSTC_HAS_SUSPICIOUS_RUNTIME_SYMBOL_DEFINITIONS, ++ allow(suspicious_runtime_symbol_definitions) ++)] + mod bindings_raw { + // Manual definition for blocklisted types. + type __kernel_size_t = usize; +--- a/rust/uapi/lib.rs ++++ b/rust/uapi/lib.rs +@@ -25,6 +25,10 @@ + unsafe_op_in_unsafe_fn + )] + #![cfg_attr(CONFIG_RUSTC_HAS_UNNECESSARY_TRANSMUTES, allow(unnecessary_transmutes))] ++#![cfg_attr( ++ CONFIG_RUSTC_HAS_SUSPICIOUS_RUNTIME_SYMBOL_DEFINITIONS, ++ allow(suspicious_runtime_symbol_definitions) ++)] + + // Manual definition of blocklisted types. + type __kernel_size_t = usize; diff --git a/queue-6.12/series b/queue-6.12/series index dabd02514d..ba8d2498fa 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -459,3 +459,6 @@ drm-amd-display-fix-dtb-dto-updates-breaking-live-pi.patch io_uring-rw-fix-missing-erestartsys-conversion-in-re.patch net-pcs-xpcs-fix-sgmii-state-reading.patch gve-fix-rx-queue-stall-on-alloc-failure.patch +rust-allow-suspicious_runtime_symbol_definitions-lint-for-rust-1.98.patch +mm-damon-core-validate-ranges-in-damon_set_regions.patch +mm-damon-core-disallow-overlapping-input-ranges-for-damon_set_regions.patch