From: Sasha Levin Date: Sun, 7 Jul 2024 14:53:23 +0000 (-0400) Subject: Fixes for 5.15 X-Git-Tag: v6.6.38~52 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=e4b11947fba4bfe28a7bec4e6f48a7fd2648358c;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.15 Signed-off-by: Sasha Levin --- diff --git a/queue-5.15/bonding-fix-out-of-bounds-read-in-bond_option_arp_ip.patch b/queue-5.15/bonding-fix-out-of-bounds-read-in-bond_option_arp_ip.patch new file mode 100644 index 00000000000..51c58e3820d --- /dev/null +++ b/queue-5.15/bonding-fix-out-of-bounds-read-in-bond_option_arp_ip.patch @@ -0,0 +1,79 @@ +From 6d08f32816bd5e11e786203feb77d72524b65b94 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Jul 2024 14:55:55 +0100 +Subject: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() + +From: Sam Sun + +[ Upstream commit e271ff53807e8f2c628758290f0e499dbe51cb3d ] + +In function bond_option_arp_ip_targets_set(), if newval->string is an +empty string, newval->string+1 will point to the byte after the +string, causing an out-of-bound read. + +BUG: KASAN: slab-out-of-bounds in strlen+0x7d/0xa0 lib/string.c:418 +Read of size 1 at addr ffff8881119c4781 by task syz-executor665/8107 +CPU: 1 PID: 8107 Comm: syz-executor665 Not tainted 6.7.0-rc7 #1 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 +Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106 + print_address_description mm/kasan/report.c:364 [inline] + print_report+0xc1/0x5e0 mm/kasan/report.c:475 + kasan_report+0xbe/0xf0 mm/kasan/report.c:588 + strlen+0x7d/0xa0 lib/string.c:418 + __fortify_strlen include/linux/fortify-string.h:210 [inline] + in4_pton+0xa3/0x3f0 net/core/utils.c:130 + bond_option_arp_ip_targets_set+0xc2/0x910 +drivers/net/bonding/bond_options.c:1201 + __bond_opt_set+0x2a4/0x1030 drivers/net/bonding/bond_options.c:767 + __bond_opt_set_notify+0x48/0x150 drivers/net/bonding/bond_options.c:792 + bond_opt_tryset_rtnl+0xda/0x160 drivers/net/bonding/bond_options.c:817 + bonding_sysfs_store_option+0xa1/0x120 drivers/net/bonding/bond_sysfs.c:156 + dev_attr_store+0x54/0x80 drivers/base/core.c:2366 + sysfs_kf_write+0x114/0x170 fs/sysfs/file.c:136 + kernfs_fop_write_iter+0x337/0x500 fs/kernfs/file.c:334 + call_write_iter include/linux/fs.h:2020 [inline] + new_sync_write fs/read_write.c:491 [inline] + vfs_write+0x96a/0xd80 fs/read_write.c:584 + ksys_write+0x122/0x250 fs/read_write.c:637 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x63/0x6b +---[ end trace ]--- + +Fix it by adding a check of string length before using it. + +Fixes: f9de11a16594 ("bonding: add ip checks when store ip target") +Signed-off-by: Yue Sun +Signed-off-by: Simon Horman +Acked-by: Jay Vosburgh +Reviewed-by: Hangbin Liu +Link: https://patch.msgid.link/20240702-bond-oob-v6-1-2dfdba195c19@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/bonding/bond_options.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c +index 5f883a18bbabd..1f8f7537e8ebf 100644 +--- a/drivers/net/bonding/bond_options.c ++++ b/drivers/net/bonding/bond_options.c +@@ -1171,9 +1171,9 @@ static int bond_option_arp_ip_targets_set(struct bonding *bond, + __be32 target; + + if (newval->string) { +- if (!in4_pton(newval->string+1, -1, (u8 *)&target, -1, NULL)) { +- netdev_err(bond->dev, "invalid ARP target %pI4 specified\n", +- &target); ++ if (strlen(newval->string) < 1 || ++ !in4_pton(newval->string + 1, -1, (u8 *)&target, -1, NULL)) { ++ netdev_err(bond->dev, "invalid ARP target specified\n"); + return ret; + } + if (newval->string[0] == '+') +-- +2.43.0 + diff --git a/queue-5.15/e1000e-fix-s0ix-residency-on-corporate-systems.patch b/queue-5.15/e1000e-fix-s0ix-residency-on-corporate-systems.patch new file mode 100644 index 00000000000..4f0b1e8175e --- /dev/null +++ b/queue-5.15/e1000e-fix-s0ix-residency-on-corporate-systems.patch @@ -0,0 +1,211 @@ +From 29b5c39c216557706d6a9179032e8343e012a9a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Jun 2024 13:17:53 -0700 +Subject: e1000e: Fix S0ix residency on corporate systems + +From: Dima Ruinskiy + +[ Upstream commit c93a6f62cb1bd097aef2e4588648a420d175eee2 ] + +On vPro systems, the configuration of the I219-LM to achieve power +gating and S0ix residency is split between the driver and the CSME FW. +It was discovered that in some scenarios, where the network cable is +connected and then disconnected, S0ix residency is not always reached. +This was root-caused to a subset of I219-LM register writes that are not +performed by the CSME FW. Therefore, the driver should perform these +register writes on corporate setups, regardless of the CSME FW state. + +This was discovered on Meteor Lake systems; however it is likely to +appear on other platforms as well. + +Fixes: cc23f4f0b6b9 ("e1000e: Add support for Meteor Lake") +Link: https://bugzilla.kernel.org/show_bug.cgi?id=218589 +Signed-off-by: Dima Ruinskiy +Signed-off-by: Vitaly Lifshits +Signed-off-by: Tony Nguyen +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20240628201754.2744221-1-anthony.l.nguyen@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/e1000e/netdev.c | 132 ++++++++++----------- + 1 file changed, 66 insertions(+), 66 deletions(-) + +diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c +index 6b7d162af3e5e..c153f44a6ab85 100644 +--- a/drivers/net/ethernet/intel/e1000e/netdev.c ++++ b/drivers/net/ethernet/intel/e1000e/netdev.c +@@ -6374,49 +6374,49 @@ static void e1000e_s0ix_entry_flow(struct e1000_adapter *adapter) + mac_data |= E1000_EXTCNF_CTRL_GATE_PHY_CFG; + ew32(EXTCNF_CTRL, mac_data); + +- /* Enable the Dynamic Power Gating in the MAC */ +- mac_data = er32(FEXTNVM7); +- mac_data |= BIT(22); +- ew32(FEXTNVM7, mac_data); +- + /* Disable disconnected cable conditioning for Power Gating */ + mac_data = er32(DPGFR); + mac_data |= BIT(2); + ew32(DPGFR, mac_data); + +- /* Don't wake from dynamic Power Gating with clock request */ +- mac_data = er32(FEXTNVM12); +- mac_data |= BIT(12); +- ew32(FEXTNVM12, mac_data); +- +- /* Ungate PGCB clock */ +- mac_data = er32(FEXTNVM9); +- mac_data &= ~BIT(28); +- ew32(FEXTNVM9, mac_data); +- +- /* Enable K1 off to enable mPHY Power Gating */ +- mac_data = er32(FEXTNVM6); +- mac_data |= BIT(31); +- ew32(FEXTNVM6, mac_data); +- +- /* Enable mPHY power gating for any link and speed */ +- mac_data = er32(FEXTNVM8); +- mac_data |= BIT(9); +- ew32(FEXTNVM8, mac_data); +- + /* Enable the Dynamic Clock Gating in the DMA and MAC */ + mac_data = er32(CTRL_EXT); + mac_data |= E1000_CTRL_EXT_DMA_DYN_CLK_EN; + ew32(CTRL_EXT, mac_data); +- +- /* No MAC DPG gating SLP_S0 in modern standby +- * Switch the logic of the lanphypc to use PMC counter +- */ +- mac_data = er32(FEXTNVM5); +- mac_data |= BIT(7); +- ew32(FEXTNVM5, mac_data); + } + ++ /* Enable the Dynamic Power Gating in the MAC */ ++ mac_data = er32(FEXTNVM7); ++ mac_data |= BIT(22); ++ ew32(FEXTNVM7, mac_data); ++ ++ /* Don't wake from dynamic Power Gating with clock request */ ++ mac_data = er32(FEXTNVM12); ++ mac_data |= BIT(12); ++ ew32(FEXTNVM12, mac_data); ++ ++ /* Ungate PGCB clock */ ++ mac_data = er32(FEXTNVM9); ++ mac_data &= ~BIT(28); ++ ew32(FEXTNVM9, mac_data); ++ ++ /* Enable K1 off to enable mPHY Power Gating */ ++ mac_data = er32(FEXTNVM6); ++ mac_data |= BIT(31); ++ ew32(FEXTNVM6, mac_data); ++ ++ /* Enable mPHY power gating for any link and speed */ ++ mac_data = er32(FEXTNVM8); ++ mac_data |= BIT(9); ++ ew32(FEXTNVM8, mac_data); ++ ++ /* No MAC DPG gating SLP_S0 in modern standby ++ * Switch the logic of the lanphypc to use PMC counter ++ */ ++ mac_data = er32(FEXTNVM5); ++ mac_data |= BIT(7); ++ ew32(FEXTNVM5, mac_data); ++ + /* Disable the time synchronization clock */ + mac_data = er32(FEXTNVM7); + mac_data |= BIT(31); +@@ -6508,33 +6508,6 @@ static void e1000e_s0ix_exit_flow(struct e1000_adapter *adapter) + } else { + /* Request driver unconfigure the device from S0ix */ + +- /* Disable the Dynamic Power Gating in the MAC */ +- mac_data = er32(FEXTNVM7); +- mac_data &= 0xFFBFFFFF; +- ew32(FEXTNVM7, mac_data); +- +- /* Disable mPHY power gating for any link and speed */ +- mac_data = er32(FEXTNVM8); +- mac_data &= ~BIT(9); +- ew32(FEXTNVM8, mac_data); +- +- /* Disable K1 off */ +- mac_data = er32(FEXTNVM6); +- mac_data &= ~BIT(31); +- ew32(FEXTNVM6, mac_data); +- +- /* Disable Ungate PGCB clock */ +- mac_data = er32(FEXTNVM9); +- mac_data |= BIT(28); +- ew32(FEXTNVM9, mac_data); +- +- /* Cancel not waking from dynamic +- * Power Gating with clock request +- */ +- mac_data = er32(FEXTNVM12); +- mac_data &= ~BIT(12); +- ew32(FEXTNVM12, mac_data); +- + /* Cancel disable disconnected cable conditioning + * for Power Gating + */ +@@ -6547,13 +6520,6 @@ static void e1000e_s0ix_exit_flow(struct e1000_adapter *adapter) + mac_data &= 0xFFF7FFFF; + ew32(CTRL_EXT, mac_data); + +- /* Revert the lanphypc logic to use the internal Gbe counter +- * and not the PMC counter +- */ +- mac_data = er32(FEXTNVM5); +- mac_data &= 0xFFFFFF7F; +- ew32(FEXTNVM5, mac_data); +- + /* Enable the periodic inband message, + * Request PCIe clock in K1 page770_17[10:9] =01b + */ +@@ -6591,6 +6557,40 @@ static void e1000e_s0ix_exit_flow(struct e1000_adapter *adapter) + mac_data &= ~BIT(31); + mac_data |= BIT(0); + ew32(FEXTNVM7, mac_data); ++ ++ /* Disable the Dynamic Power Gating in the MAC */ ++ mac_data = er32(FEXTNVM7); ++ mac_data &= 0xFFBFFFFF; ++ ew32(FEXTNVM7, mac_data); ++ ++ /* Disable mPHY power gating for any link and speed */ ++ mac_data = er32(FEXTNVM8); ++ mac_data &= ~BIT(9); ++ ew32(FEXTNVM8, mac_data); ++ ++ /* Disable K1 off */ ++ mac_data = er32(FEXTNVM6); ++ mac_data &= ~BIT(31); ++ ew32(FEXTNVM6, mac_data); ++ ++ /* Disable Ungate PGCB clock */ ++ mac_data = er32(FEXTNVM9); ++ mac_data |= BIT(28); ++ ew32(FEXTNVM9, mac_data); ++ ++ /* Cancel not waking from dynamic ++ * Power Gating with clock request ++ */ ++ mac_data = er32(FEXTNVM12); ++ mac_data &= ~BIT(12); ++ ew32(FEXTNVM12, mac_data); ++ ++ /* Revert the lanphypc logic to use the internal Gbe counter ++ * and not the PMC counter ++ */ ++ mac_data = er32(FEXTNVM5); ++ mac_data &= 0xFFFFFF7F; ++ ew32(FEXTNVM5, mac_data); + } + + static int e1000e_pm_freeze(struct device *dev) +-- +2.43.0 + diff --git a/queue-5.15/gpiolib-of-add-a-quirk-for-reset-line-polarity-for-h.patch b/queue-5.15/gpiolib-of-add-a-quirk-for-reset-line-polarity-for-h.patch new file mode 100644 index 00000000000..210c0186dfe --- /dev/null +++ b/queue-5.15/gpiolib-of-add-a-quirk-for-reset-line-polarity-for-h.patch @@ -0,0 +1,79 @@ +From 50675277938ad0cc3c46f2255c85de0f1feb8be1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Oct 2022 22:41:11 -0700 +Subject: gpiolib: of: add a quirk for reset line polarity for Himax LCDs + +From: Dmitry Torokhov + +[ Upstream commit 99d18d42c942854a073191714a311dc2420ec7d3 ] + +Existing DTS that use legacy (non-standard) property name for the reset +line "gpios-reset" also specify incorrect polarity (0 which maps to +"active high"). Add a quirk to force polarity to "active low" so that +once driver is converted to gpiod API that pays attention to line +polarity it will work properly. + +Reviewed-by: Linus Walleij +Signed-off-by: Dmitry Torokhov +Signed-off-by: Bartosz Golaszewski +Stable-dep-of: f8d76c2c313c ("gpiolib: of: add polarity quirk for TSC2005") +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpiolib-of.c | 36 ++++++++++++++++++++++++++++++++++++ + 1 file changed, 36 insertions(+) + +diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c +index e9da0d5017c02..7a77d9cd9c774 100644 +--- a/drivers/gpio/gpiolib-of.c ++++ b/drivers/gpio/gpiolib-of.c +@@ -152,11 +152,47 @@ static void of_gpio_quirk_polarity(const struct device_node *np, + } + } + ++/* ++ * This quirk does static polarity overrides in cases where existing ++ * DTS specified incorrect polarity. ++ */ ++static void of_gpio_try_fixup_polarity(const struct device_node *np, ++ const char *propname, ++ enum of_gpio_flags *flags) ++{ ++ static const struct { ++ const char *compatible; ++ const char *propname; ++ bool active_high; ++ } gpios[] = { ++#if !IS_ENABLED(CONFIG_LCD_HX8357) ++ /* ++ * Himax LCD controllers used incorrectly named ++ * "gpios-reset" property and also specified wrong ++ * polarity. ++ */ ++ { "himax,hx8357", "gpios-reset", false }, ++ { "himax,hx8369", "gpios-reset", false }, ++#endif ++ }; ++ unsigned int i; ++ ++ for (i = 0; i < ARRAY_SIZE(gpios); i++) { ++ if (of_device_is_compatible(np, gpios[i].compatible) && ++ !strcmp(propname, gpios[i].propname)) { ++ of_gpio_quirk_polarity(np, gpios[i].active_high, flags); ++ break; ++ } ++ } ++} ++ + static void of_gpio_flags_quirks(const struct device_node *np, + const char *propname, + enum of_gpio_flags *flags, + int index) + { ++ of_gpio_try_fixup_polarity(np, propname, flags); ++ + /* + * Some GPIO fixed regulator quirks. + * Note that active low is the default. +-- +2.43.0 + diff --git a/queue-5.15/gpiolib-of-add-polarity-quirk-for-tsc2005.patch b/queue-5.15/gpiolib-of-add-polarity-quirk-for-tsc2005.patch new file mode 100644 index 00000000000..b949ccee99f --- /dev/null +++ b/queue-5.15/gpiolib-of-add-polarity-quirk-for-tsc2005.patch @@ -0,0 +1,46 @@ +From 892ab56aefa4db8459c4db45329731ccf892e62a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jul 2024 11:26:09 -0700 +Subject: gpiolib: of: add polarity quirk for TSC2005 + +From: Dmitry Torokhov + +[ Upstream commit f8d76c2c313c56d5cb894a243dff4550f048278d ] + +DTS for Nokia N900 incorrectly specifies "active high" polarity for +the reset line, while the chip documentation actually specifies it as +"active low". In the past the driver fudged gpiod API and inverted +the logic internally, but it was changed in d0d89493bff8. + +Fixes: d0d89493bff8 ("Input: tsc2004/5 - switch to using generic device properties") +Signed-off-by: Dmitry Torokhov +Acked-by: Linus Walleij +Link: https://lore.kernel.org/r/ZoWXwYtwgJIxi-hD@google.com +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpiolib-of.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c +index 7a77d9cd9c774..608526ce7bab0 100644 +--- a/drivers/gpio/gpiolib-of.c ++++ b/drivers/gpio/gpiolib-of.c +@@ -173,6 +173,14 @@ static void of_gpio_try_fixup_polarity(const struct device_node *np, + */ + { "himax,hx8357", "gpios-reset", false }, + { "himax,hx8369", "gpios-reset", false }, ++#endif ++#if IS_ENABLED(CONFIG_TOUCHSCREEN_TSC2005) ++ /* ++ * DTS for Nokia N900 incorrectly specified "active high" ++ * polarity for the reset line, while the chip actually ++ * treats it as "active low". ++ */ ++ { "ti,tsc2005", "reset-gpios", false }, + #endif + }; + unsigned int i; +-- +2.43.0 + diff --git a/queue-5.15/gpiolib-of-factor-out-code-overriding-gpio-line-pola.patch b/queue-5.15/gpiolib-of-factor-out-code-overriding-gpio-line-pola.patch new file mode 100644 index 00000000000..18f7b236afa --- /dev/null +++ b/queue-5.15/gpiolib-of-factor-out-code-overriding-gpio-line-pola.patch @@ -0,0 +1,105 @@ +From 82bc8e5bf79cae22f18d9eb03f8b7165aae48f5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Oct 2022 22:41:09 -0700 +Subject: gpiolib: of: factor out code overriding gpio line polarity + +From: Dmitry Torokhov + +[ Upstream commit e3186e36925fc18384492491ebcf3da749780a30 ] + +There are several instances where we use a separate property to +override polarity specified in gpio property. Factor it out into +a separate function. + +Reviewed-by: Linus Walleij +Signed-off-by: Dmitry Torokhov +Signed-off-by: Bartosz Golaszewski +Stable-dep-of: f8d76c2c313c ("gpiolib: of: add polarity quirk for TSC2005") +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpiolib-of.c | 48 +++++++++++++++++++++++---------------- + 1 file changed, 28 insertions(+), 20 deletions(-) + +diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c +index 7a96eb626a08b..e9da0d5017c02 100644 +--- a/drivers/gpio/gpiolib-of.c ++++ b/drivers/gpio/gpiolib-of.c +@@ -130,6 +130,28 @@ bool of_gpio_need_valid_mask(const struct gpio_chip *gc) + return false; + } + ++/* ++ * Overrides stated polarity of a gpio line and warns when there is a ++ * discrepancy. ++ */ ++static void of_gpio_quirk_polarity(const struct device_node *np, ++ bool active_high, ++ enum of_gpio_flags *flags) ++{ ++ if (active_high) { ++ if (*flags & OF_GPIO_ACTIVE_LOW) { ++ pr_warn("%s GPIO handle specifies active low - ignored\n", ++ of_node_full_name(np)); ++ *flags &= ~OF_GPIO_ACTIVE_LOW; ++ } ++ } else { ++ if (!(*flags & OF_GPIO_ACTIVE_LOW)) ++ pr_info("%s enforce active low on GPIO handle\n", ++ of_node_full_name(np)); ++ *flags |= OF_GPIO_ACTIVE_LOW; ++ } ++} ++ + static void of_gpio_flags_quirks(const struct device_node *np, + const char *propname, + enum of_gpio_flags *flags, +@@ -145,7 +167,7 @@ static void of_gpio_flags_quirks(const struct device_node *np, + (!(strcmp(propname, "enable-gpio") && + strcmp(propname, "enable-gpios")) && + of_device_is_compatible(np, "regulator-gpio")))) { +- bool active_low = !of_property_read_bool(np, ++ bool active_high = of_property_read_bool(np, + "enable-active-high"); + /* + * The regulator GPIO handles are specified such that the +@@ -153,13 +175,7 @@ static void of_gpio_flags_quirks(const struct device_node *np, + * the polarity of the GPIO line. Any phandle flags must + * be actively ignored. + */ +- if ((*flags & OF_GPIO_ACTIVE_LOW) && !active_low) { +- pr_warn("%s GPIO handle specifies active low - ignored\n", +- of_node_full_name(np)); +- *flags &= ~OF_GPIO_ACTIVE_LOW; +- } +- if (active_low) +- *flags |= OF_GPIO_ACTIVE_LOW; ++ of_gpio_quirk_polarity(np, active_high, flags); + } + /* + * Legacy open drain handling for fixed voltage regulators. +@@ -200,18 +216,10 @@ static void of_gpio_flags_quirks(const struct device_node *np, + * conflict and the "spi-cs-high" flag will + * take precedence. + */ +- if (of_property_read_bool(child, "spi-cs-high")) { +- if (*flags & OF_GPIO_ACTIVE_LOW) { +- pr_warn("%s GPIO handle specifies active low - ignored\n", +- of_node_full_name(child)); +- *flags &= ~OF_GPIO_ACTIVE_LOW; +- } +- } else { +- if (!(*flags & OF_GPIO_ACTIVE_LOW)) +- pr_info("%s enforce active low on chipselect handle\n", +- of_node_full_name(child)); +- *flags |= OF_GPIO_ACTIVE_LOW; +- } ++ bool active_high = of_property_read_bool(child, ++ "spi-cs-high"); ++ of_gpio_quirk_polarity(child, active_high, ++ flags); + of_node_put(child); + break; + } +-- +2.43.0 + diff --git a/queue-5.15/inet_diag-initialize-pad-field-in-struct-inet_diag_r.patch b/queue-5.15/inet_diag-initialize-pad-field-in-struct-inet_diag_r.patch new file mode 100644 index 00000000000..c1540cf1863 --- /dev/null +++ b/queue-5.15/inet_diag-initialize-pad-field-in-struct-inet_diag_r.patch @@ -0,0 +1,117 @@ +From 845f6d763857946db0add88958e5e90470971069 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jul 2024 18:16:49 +0900 +Subject: inet_diag: Initialize pad field in struct inet_diag_req_v2 + +From: Shigeru Yoshida + +[ Upstream commit 61cf1c739f08190a4cbf047b9fbb192a94d87e3f ] + +KMSAN reported uninit-value access in raw_lookup() [1]. Diag for raw +sockets uses the pad field in struct inet_diag_req_v2 for the +underlying protocol. This field corresponds to the sdiag_raw_protocol +field in struct inet_diag_req_raw. + +inet_diag_get_exact_compat() converts inet_diag_req to +inet_diag_req_v2, but leaves the pad field uninitialized. So the issue +occurs when raw_lookup() accesses the sdiag_raw_protocol field. + +Fix this by initializing the pad field in +inet_diag_get_exact_compat(). Also, do the same fix in +inet_diag_dump_compat() to avoid the similar issue in the future. + +[1] +BUG: KMSAN: uninit-value in raw_lookup net/ipv4/raw_diag.c:49 [inline] +BUG: KMSAN: uninit-value in raw_sock_get+0x657/0x800 net/ipv4/raw_diag.c:71 + raw_lookup net/ipv4/raw_diag.c:49 [inline] + raw_sock_get+0x657/0x800 net/ipv4/raw_diag.c:71 + raw_diag_dump_one+0xa1/0x660 net/ipv4/raw_diag.c:99 + inet_diag_cmd_exact+0x7d9/0x980 + inet_diag_get_exact_compat net/ipv4/inet_diag.c:1404 [inline] + inet_diag_rcv_msg_compat+0x469/0x530 net/ipv4/inet_diag.c:1426 + sock_diag_rcv_msg+0x23d/0x740 net/core/sock_diag.c:282 + netlink_rcv_skb+0x537/0x670 net/netlink/af_netlink.c:2564 + sock_diag_rcv+0x35/0x40 net/core/sock_diag.c:297 + netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline] + netlink_unicast+0xe74/0x1240 net/netlink/af_netlink.c:1361 + netlink_sendmsg+0x10c6/0x1260 net/netlink/af_netlink.c:1905 + sock_sendmsg_nosec net/socket.c:730 [inline] + __sock_sendmsg+0x332/0x3d0 net/socket.c:745 + ____sys_sendmsg+0x7f0/0xb70 net/socket.c:2585 + ___sys_sendmsg+0x271/0x3b0 net/socket.c:2639 + __sys_sendmsg net/socket.c:2668 [inline] + __do_sys_sendmsg net/socket.c:2677 [inline] + __se_sys_sendmsg net/socket.c:2675 [inline] + __x64_sys_sendmsg+0x27e/0x4a0 net/socket.c:2675 + x64_sys_call+0x135e/0x3ce0 arch/x86/include/generated/asm/syscalls_64.h:47 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xd9/0x1e0 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +Uninit was stored to memory at: + raw_sock_get+0x650/0x800 net/ipv4/raw_diag.c:71 + raw_diag_dump_one+0xa1/0x660 net/ipv4/raw_diag.c:99 + inet_diag_cmd_exact+0x7d9/0x980 + inet_diag_get_exact_compat net/ipv4/inet_diag.c:1404 [inline] + inet_diag_rcv_msg_compat+0x469/0x530 net/ipv4/inet_diag.c:1426 + sock_diag_rcv_msg+0x23d/0x740 net/core/sock_diag.c:282 + netlink_rcv_skb+0x537/0x670 net/netlink/af_netlink.c:2564 + sock_diag_rcv+0x35/0x40 net/core/sock_diag.c:297 + netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline] + netlink_unicast+0xe74/0x1240 net/netlink/af_netlink.c:1361 + netlink_sendmsg+0x10c6/0x1260 net/netlink/af_netlink.c:1905 + sock_sendmsg_nosec net/socket.c:730 [inline] + __sock_sendmsg+0x332/0x3d0 net/socket.c:745 + ____sys_sendmsg+0x7f0/0xb70 net/socket.c:2585 + ___sys_sendmsg+0x271/0x3b0 net/socket.c:2639 + __sys_sendmsg net/socket.c:2668 [inline] + __do_sys_sendmsg net/socket.c:2677 [inline] + __se_sys_sendmsg net/socket.c:2675 [inline] + __x64_sys_sendmsg+0x27e/0x4a0 net/socket.c:2675 + x64_sys_call+0x135e/0x3ce0 arch/x86/include/generated/asm/syscalls_64.h:47 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xd9/0x1e0 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +Local variable req.i created at: + inet_diag_get_exact_compat net/ipv4/inet_diag.c:1396 [inline] + inet_diag_rcv_msg_compat+0x2a6/0x530 net/ipv4/inet_diag.c:1426 + sock_diag_rcv_msg+0x23d/0x740 net/core/sock_diag.c:282 + +CPU: 1 PID: 8888 Comm: syz-executor.6 Not tainted 6.10.0-rc4-00217-g35bb670d65fc #32 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014 + +Fixes: 432490f9d455 ("net: ip, diag -- Add diag interface for raw sockets") +Reported-by: syzkaller +Signed-off-by: Shigeru Yoshida +Reviewed-by: Eric Dumazet +Link: https://patch.msgid.link/20240703091649.111773-1-syoshida@redhat.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv4/inet_diag.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c +index 3aeba9e2b22cd..bdef05b1957bd 100644 +--- a/net/ipv4/inet_diag.c ++++ b/net/ipv4/inet_diag.c +@@ -1281,6 +1281,7 @@ static int inet_diag_dump_compat(struct sk_buff *skb, + req.sdiag_family = AF_UNSPEC; /* compatibility */ + req.sdiag_protocol = inet_diag_type2proto(cb->nlh->nlmsg_type); + req.idiag_ext = rc->idiag_ext; ++ req.pad = 0; + req.idiag_states = rc->idiag_states; + req.id = rc->id; + +@@ -1296,6 +1297,7 @@ static int inet_diag_get_exact_compat(struct sk_buff *in_skb, + req.sdiag_family = rc->idiag_family; + req.sdiag_protocol = inet_diag_type2proto(nlh->nlmsg_type); + req.idiag_ext = rc->idiag_ext; ++ req.pad = 0; + req.idiag_states = rc->idiag_states; + req.id = rc->id; + +-- +2.43.0 + diff --git a/queue-5.15/kvm-s390-fix-lpswey-handling.patch b/queue-5.15/kvm-s390-fix-lpswey-handling.patch new file mode 100644 index 00000000000..b24e7b278c5 --- /dev/null +++ b/queue-5.15/kvm-s390-fix-lpswey-handling.patch @@ -0,0 +1,130 @@ +From dc74c8725c8ee93d395cb3fe7186f1fa9baca221 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Jun 2024 18:35:47 +0200 +Subject: KVM: s390: fix LPSWEY handling + +From: Christian Borntraeger + +[ Upstream commit 4c6abb7f7b349f00c0f7ed5045bf67759c012892 ] + +in rare cases, e.g. for injecting a machine check we do intercept all +load PSW instructions via ICTL_LPSW. With facility 193 a new variant +LPSWEY was added. KVM needs to handle that as well. + +Fixes: a3efa8429266 ("KVM: s390: gen_facilities: allow facilities 165, 193, 194 and 196") +Reported-by: Marc Hartmayer +Reviewed-by: Sven Schnelle +Reviewed-by: Claudio Imbrenda +Signed-off-by: Christian Borntraeger +Message-ID: <20240628163547.2314-1-borntraeger@linux.ibm.com> +Signed-off-by: Sasha Levin +--- + arch/s390/include/asm/kvm_host.h | 1 + + arch/s390/kvm/kvm-s390.c | 1 + + arch/s390/kvm/kvm-s390.h | 15 +++++++++++++++ + arch/s390/kvm/priv.c | 32 ++++++++++++++++++++++++++++++++ + 4 files changed, 49 insertions(+) + +diff --git a/arch/s390/include/asm/kvm_host.h b/arch/s390/include/asm/kvm_host.h +index a604d51acfc83..7abbc5fb9021b 100644 +--- a/arch/s390/include/asm/kvm_host.h ++++ b/arch/s390/include/asm/kvm_host.h +@@ -408,6 +408,7 @@ struct kvm_vcpu_stat { + u64 instruction_io_other; + u64 instruction_lpsw; + u64 instruction_lpswe; ++ u64 instruction_lpswey; + u64 instruction_pfmf; + u64 instruction_ptff; + u64 instruction_sck; +diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c +index 5526f782249c0..8d7f2c7da1d36 100644 +--- a/arch/s390/kvm/kvm-s390.c ++++ b/arch/s390/kvm/kvm-s390.c +@@ -123,6 +123,7 @@ const struct _kvm_stats_desc kvm_vcpu_stats_desc[] = { + STATS_DESC_COUNTER(VCPU, instruction_io_other), + STATS_DESC_COUNTER(VCPU, instruction_lpsw), + STATS_DESC_COUNTER(VCPU, instruction_lpswe), ++ STATS_DESC_COUNTER(VCPU, instruction_lpswey), + STATS_DESC_COUNTER(VCPU, instruction_pfmf), + STATS_DESC_COUNTER(VCPU, instruction_ptff), + STATS_DESC_COUNTER(VCPU, instruction_sck), +diff --git a/arch/s390/kvm/kvm-s390.h b/arch/s390/kvm/kvm-s390.h +index a2fde6d69057b..7ed3a3914139c 100644 +--- a/arch/s390/kvm/kvm-s390.h ++++ b/arch/s390/kvm/kvm-s390.h +@@ -119,6 +119,21 @@ static inline u64 kvm_s390_get_base_disp_s(struct kvm_vcpu *vcpu, u8 *ar) + return (base2 ? vcpu->run->s.regs.gprs[base2] : 0) + disp2; + } + ++static inline u64 kvm_s390_get_base_disp_siy(struct kvm_vcpu *vcpu, u8 *ar) ++{ ++ u32 base1 = vcpu->arch.sie_block->ipb >> 28; ++ s64 disp1; ++ ++ /* The displacement is a 20bit _SIGNED_ value */ ++ disp1 = sign_extend64(((vcpu->arch.sie_block->ipb & 0x0fff0000) >> 16) + ++ ((vcpu->arch.sie_block->ipb & 0xff00) << 4), 19); ++ ++ if (ar) ++ *ar = base1; ++ ++ return (base1 ? vcpu->run->s.regs.gprs[base1] : 0) + disp1; ++} ++ + static inline void kvm_s390_get_base_disp_sse(struct kvm_vcpu *vcpu, + u64 *address1, u64 *address2, + u8 *ar_b1, u8 *ar_b2) +diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c +index 6a765fe22eafc..f9d9e70e3b000 100644 +--- a/arch/s390/kvm/priv.c ++++ b/arch/s390/kvm/priv.c +@@ -795,6 +795,36 @@ static int handle_lpswe(struct kvm_vcpu *vcpu) + return 0; + } + ++static int handle_lpswey(struct kvm_vcpu *vcpu) ++{ ++ psw_t new_psw; ++ u64 addr; ++ int rc; ++ u8 ar; ++ ++ vcpu->stat.instruction_lpswey++; ++ ++ if (!test_kvm_facility(vcpu->kvm, 193)) ++ return kvm_s390_inject_program_int(vcpu, PGM_OPERATION); ++ ++ if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE) ++ return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP); ++ ++ addr = kvm_s390_get_base_disp_siy(vcpu, &ar); ++ if (addr & 7) ++ return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION); ++ ++ rc = read_guest(vcpu, addr, ar, &new_psw, sizeof(new_psw)); ++ if (rc) ++ return kvm_s390_inject_prog_cond(vcpu, rc); ++ ++ vcpu->arch.sie_block->gpsw = new_psw; ++ if (!is_valid_psw(&vcpu->arch.sie_block->gpsw)) ++ return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION); ++ ++ return 0; ++} ++ + static int handle_stidp(struct kvm_vcpu *vcpu) + { + u64 stidp_data = vcpu->kvm->arch.model.cpuid; +@@ -1449,6 +1479,8 @@ int kvm_s390_handle_eb(struct kvm_vcpu *vcpu) + case 0x61: + case 0x62: + return handle_ri(vcpu); ++ case 0x71: ++ return handle_lpswey(vcpu); + default: + return -EOPNOTSUPP; + } +-- +2.43.0 + diff --git a/queue-5.15/net-allow-skb_datagram_iter-to-be-called-from-any-co.patch b/queue-5.15/net-allow-skb_datagram_iter-to-be-called-from-any-co.patch new file mode 100644 index 00000000000..9c71713c4e2 --- /dev/null +++ b/queue-5.15/net-allow-skb_datagram_iter-to-be-called-from-any-co.patch @@ -0,0 +1,60 @@ +From bd0257f05b04b15a8cd634b509e555233e19c01e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jun 2024 13:00:08 +0300 +Subject: net: allow skb_datagram_iter to be called from any context + +From: Sagi Grimberg + +[ Upstream commit d2d30a376d9cc94c6fb730c58b3e5b7426ecb6de ] + +We only use the mapping in a single context, so kmap_local is sufficient +and cheaper. Make sure to use skb_frag_foreach_page as skb frags may +contain compound pages and we need to map page by page. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-lkp/202406161539.b5ff7b20-oliver.sang@intel.com +Fixes: 950fcaecd5cc ("datagram: consolidate datagram copy to iter helpers") +Signed-off-by: Sagi Grimberg +Link: https://patch.msgid.link/20240626100008.831849-1-sagi@grimberg.me +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/core/datagram.c | 19 +++++++++++++------ + 1 file changed, 13 insertions(+), 6 deletions(-) + +diff --git a/net/core/datagram.c b/net/core/datagram.c +index 1ff8241217a9c..6b7db06eafe68 100644 +--- a/net/core/datagram.c ++++ b/net/core/datagram.c +@@ -440,15 +440,22 @@ static int __skb_datagram_iter(const struct sk_buff *skb, int offset, + + end = start + skb_frag_size(frag); + if ((copy = end - offset) > 0) { +- struct page *page = skb_frag_page(frag); +- u8 *vaddr = kmap(page); ++ u32 p_off, p_len, copied; ++ struct page *p; ++ u8 *vaddr; + + if (copy > len) + copy = len; +- n = INDIRECT_CALL_1(cb, simple_copy_to_iter, +- vaddr + skb_frag_off(frag) + offset - start, +- copy, data, to); +- kunmap(page); ++ ++ skb_frag_foreach_page(frag, ++ skb_frag_off(frag) + offset - start, ++ copy, p, p_off, p_len, copied) { ++ vaddr = kmap_local_page(p); ++ n = INDIRECT_CALL_1(cb, simple_copy_to_iter, ++ vaddr + p_off, p_len, data, to); ++ kunmap_local(vaddr); ++ } ++ + offset += n; + if (n != copy) + goto short_copy; +-- +2.43.0 + diff --git a/queue-5.15/netfilter-nf_tables-unconditionally-flush-pending-wo.patch b/queue-5.15/netfilter-nf_tables-unconditionally-flush-pending-wo.patch new file mode 100644 index 00000000000..11065d05941 --- /dev/null +++ b/queue-5.15/netfilter-nf_tables-unconditionally-flush-pending-wo.patch @@ -0,0 +1,62 @@ +From 2e4d3b122d6867ef7e3eeb68a834368f2523cad0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Jul 2024 16:08:14 +0200 +Subject: netfilter: nf_tables: unconditionally flush pending work before + notifier + +From: Florian Westphal + +[ Upstream commit 9f6958ba2e902f9820c594869bd710ba74b7c4c0 ] + +syzbot reports: + +KASAN: slab-uaf in nft_ctx_update include/net/netfilter/nf_tables.h:1831 +KASAN: slab-uaf in nft_commit_release net/netfilter/nf_tables_api.c:9530 +KASAN: slab-uaf int nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597 +Read of size 2 at addr ffff88802b0051c4 by task kworker/1:1/45 +[..] +Workqueue: events nf_tables_trans_destroy_work +Call Trace: + nft_ctx_update include/net/netfilter/nf_tables.h:1831 [inline] + nft_commit_release net/netfilter/nf_tables_api.c:9530 [inline] + nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597 + +Problem is that the notifier does a conditional flush, but its possible +that the table-to-be-removed is still referenced by transactions being +processed by the worker, so we need to flush unconditionally. + +We could make the flush_work depend on whether we found a table to delete +in nf-next to avoid the flush for most cases. + +AFAICS this problem is only exposed in nf-next, with +commit e169285f8c56 ("netfilter: nf_tables: do not store nft_ctx in transaction objects"), +with this commit applied there is an unconditional fetch of +table->family which is whats triggering the above splat. + +Fixes: 2c9f0293280e ("netfilter: nf_tables: flush pending destroy work before netlink notifier") +Reported-and-tested-by: syzbot+4fd66a69358fc15ae2ad@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=4fd66a69358fc15ae2ad +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 506dc5c4cdccb..6e4ce511f51ba 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -10659,8 +10659,7 @@ static int nft_rcv_nl_event(struct notifier_block *this, unsigned long event, + + gc_seq = nft_gc_seq_begin(nft_net); + +- if (!list_empty(&nf_tables_destroy_list)) +- nf_tables_trans_destroy_flush_work(); ++ nf_tables_trans_destroy_flush_work(); + again: + list_for_each_entry(table, &nft_net->tables, list) { + if (nft_table_has_owner(table) && +-- +2.43.0 + diff --git a/queue-5.15/riscv-kexec-avoid-deadlock-in-kexec-crash-path.patch b/queue-5.15/riscv-kexec-avoid-deadlock-in-kexec-crash-path.patch new file mode 100644 index 00000000000..51c7c43748b --- /dev/null +++ b/queue-5.15/riscv-kexec-avoid-deadlock-in-kexec-crash-path.patch @@ -0,0 +1,58 @@ +From 16874c6f0f182b4ff9495dfbd4019039dcd44354 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jun 2024 10:33:16 +0800 +Subject: riscv: kexec: Avoid deadlock in kexec crash path + +From: Song Shuai + +[ Upstream commit c562ba719df570c986caf0941fea2449150bcbc4 ] + +If the kexec crash code is called in the interrupt context, the +machine_kexec_mask_interrupts() function will trigger a deadlock while +trying to acquire the irqdesc spinlock and then deactivate irqchip in +irq_set_irqchip_state() function. + +Unlike arm64, riscv only requires irq_eoi handler to complete EOI and +keeping irq_set_irqchip_state() will only leave this possible deadlock +without any use. So we simply remove it. + +Link: https://lore.kernel.org/linux-riscv/20231208111015.173237-1-songshuaishuai@tinylab.org/ +Fixes: b17d19a5314a ("riscv: kexec: Fixup irq controller broken in kexec crash path") +Signed-off-by: Song Shuai +Reviewed-by: Ryo Takakura +Link: https://lore.kernel.org/r/20240626023316.539971-1-songshuaishuai@tinylab.org +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/machine_kexec.c | 10 +--------- + 1 file changed, 1 insertion(+), 9 deletions(-) + +diff --git a/arch/riscv/kernel/machine_kexec.c b/arch/riscv/kernel/machine_kexec.c +index db41c676e5a26..7889dfb55cf24 100644 +--- a/arch/riscv/kernel/machine_kexec.c ++++ b/arch/riscv/kernel/machine_kexec.c +@@ -163,20 +163,12 @@ static void machine_kexec_mask_interrupts(void) + + for_each_irq_desc(i, desc) { + struct irq_chip *chip; +- int ret; + + chip = irq_desc_get_chip(desc); + if (!chip) + continue; + +- /* +- * First try to remove the active state. If this +- * fails, try to EOI the interrupt. +- */ +- ret = irq_set_irqchip_state(i, IRQCHIP_STATE_ACTIVE, false); +- +- if (ret && irqd_irq_inprogress(&desc->irq_data) && +- chip->irq_eoi) ++ if (chip->irq_eoi && irqd_irq_inprogress(&desc->irq_data)) + chip->irq_eoi(&desc->irq_data); + + if (chip->irq_mask) +-- +2.43.0 + diff --git a/queue-5.15/selftests-fix-oom-in-msg_zerocopy-selftest.patch b/queue-5.15/selftests-fix-oom-in-msg_zerocopy-selftest.patch new file mode 100644 index 00000000000..888ae385df7 --- /dev/null +++ b/queue-5.15/selftests-fix-oom-in-msg_zerocopy-selftest.patch @@ -0,0 +1,101 @@ +From 0239448c6a6294b3b064bb78bb9edd5de9845d09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Jul 2024 22:53:48 +0000 +Subject: selftests: fix OOM in msg_zerocopy selftest + +From: Zijian Zhang + +[ Upstream commit af2b7e5b741aaae9ffbba2c660def434e07aa241 ] + +In selftests/net/msg_zerocopy.c, it has a while loop keeps calling sendmsg +on a socket with MSG_ZEROCOPY flag, and it will recv the notifications +until the socket is not writable. Typically, it will start the receiving +process after around 30+ sendmsgs. However, as the introduction of commit +dfa2f0483360 ("tcp: get rid of sysctl_tcp_adv_win_scale"), the sender is +always writable and does not get any chance to run recv notifications. +The selftest always exits with OUT_OF_MEMORY because the memory used by +opt_skb exceeds the net.core.optmem_max. Meanwhile, it could be set to a +different value to trigger OOM on older kernels too. + +Thus, we introduce "cfg_notification_limit" to force sender to receive +notifications after some number of sendmsgs. + +Fixes: 07b65c5b31ce ("test: add msg_zerocopy test") +Signed-off-by: Zijian Zhang +Signed-off-by: Xiaochun Lu +Reviewed-by: Willem de Bruijn +Link: https://patch.msgid.link/20240701225349.3395580-2-zijianzhang@bytedance.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/msg_zerocopy.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/net/msg_zerocopy.c b/tools/testing/selftests/net/msg_zerocopy.c +index bdc03a2097e85..926556febc83c 100644 +--- a/tools/testing/selftests/net/msg_zerocopy.c ++++ b/tools/testing/selftests/net/msg_zerocopy.c +@@ -85,6 +85,7 @@ static bool cfg_rx; + static int cfg_runtime_ms = 4200; + static int cfg_verbose; + static int cfg_waittime_ms = 500; ++static int cfg_notification_limit = 32; + static bool cfg_zerocopy; + + static socklen_t cfg_alen; +@@ -95,6 +96,7 @@ static char payload[IP_MAXPACKET]; + static long packets, bytes, completions, expected_completions; + static int zerocopied = -1; + static uint32_t next_completion; ++static uint32_t sends_since_notify; + + static unsigned long gettimeofday_ms(void) + { +@@ -208,6 +210,7 @@ static bool do_sendmsg(int fd, struct msghdr *msg, bool do_zerocopy, int domain) + error(1, errno, "send"); + if (cfg_verbose && ret != len) + fprintf(stderr, "send: ret=%u != %u\n", ret, len); ++ sends_since_notify++; + + if (len) { + packets++; +@@ -460,6 +463,7 @@ static bool do_recv_completion(int fd, int domain) + static void do_recv_completions(int fd, int domain) + { + while (do_recv_completion(fd, domain)) {} ++ sends_since_notify = 0; + } + + /* Wait for all remaining completions on the errqueue */ +@@ -549,6 +553,9 @@ static void do_tx(int domain, int type, int protocol) + else + do_sendmsg(fd, &msg, cfg_zerocopy, domain); + ++ if (cfg_zerocopy && sends_since_notify >= cfg_notification_limit) ++ do_recv_completions(fd, domain); ++ + while (!do_poll(fd, POLLOUT)) { + if (cfg_zerocopy) + do_recv_completions(fd, domain); +@@ -708,7 +715,7 @@ static void parse_opts(int argc, char **argv) + + cfg_payload_len = max_payload_len; + +- while ((c = getopt(argc, argv, "46c:C:D:i:mp:rs:S:t:vz")) != -1) { ++ while ((c = getopt(argc, argv, "46c:C:D:i:l:mp:rs:S:t:vz")) != -1) { + switch (c) { + case '4': + if (cfg_family != PF_UNSPEC) +@@ -736,6 +743,9 @@ static void parse_opts(int argc, char **argv) + if (cfg_ifindex == 0) + error(1, errno, "invalid iface: %s", optarg); + break; ++ case 'l': ++ cfg_notification_limit = strtoul(optarg, NULL, 0); ++ break; + case 'm': + cfg_cork_mixed = true; + break; +-- +2.43.0 + diff --git a/queue-5.15/selftests-make-order-checking-verbose-in-msg_zerocop.patch b/queue-5.15/selftests-make-order-checking-verbose-in-msg_zerocop.patch new file mode 100644 index 00000000000..cef7afa33c5 --- /dev/null +++ b/queue-5.15/selftests-make-order-checking-verbose-in-msg_zerocop.patch @@ -0,0 +1,40 @@ +From f6b0bc7e36c9622c52fe6feca2cbd299d68a84e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Jul 2024 22:53:49 +0000 +Subject: selftests: make order checking verbose in msg_zerocopy selftest + +From: Zijian Zhang + +[ Upstream commit 7d6d8f0c8b700c9493f2839abccb6d29028b4219 ] + +We find that when lock debugging is on, notifications may not come in +order. Thus, we have order checking outputs managed by cfg_verbose, to +avoid too many outputs in this case. + +Fixes: 07b65c5b31ce ("test: add msg_zerocopy test") +Signed-off-by: Zijian Zhang +Signed-off-by: Xiaochun Lu +Reviewed-by: Willem de Bruijn +Link: https://patch.msgid.link/20240701225349.3395580-3-zijianzhang@bytedance.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/msg_zerocopy.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/net/msg_zerocopy.c b/tools/testing/selftests/net/msg_zerocopy.c +index 926556febc83c..7ea5fb28c93db 100644 +--- a/tools/testing/selftests/net/msg_zerocopy.c ++++ b/tools/testing/selftests/net/msg_zerocopy.c +@@ -438,7 +438,7 @@ static bool do_recv_completion(int fd, int domain) + /* Detect notification gaps. These should not happen often, if at all. + * Gaps can occur due to drops, reordering and retransmissions. + */ +- if (lo != next_completion) ++ if (cfg_verbose && lo != next_completion) + fprintf(stderr, "gap: %u..%u does not append to %u\n", + lo, hi, next_completion); + next_completion = hi + 1; +-- +2.43.0 + diff --git a/queue-5.15/series b/queue-5.15/series index 6156c7a3dfe..a8c2cff67fb 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -31,3 +31,18 @@ jffs2-fix-potential-illegal-address-access-in-jffs2_.patch s390-mark-psw-in-__load_psw_mask-as-__unitialized.patch s390-pkey-wipe-sensitive-data-on-failure.patch tools-power-turbostat-remember-global-max_die_id.patch +upstream-tcp-fix-dsack-undo-in-fast-recovery-to-call.patch +tcp_metrics-validate-source-addr-length.patch +kvm-s390-fix-lpswey-handling.patch +e1000e-fix-s0ix-residency-on-corporate-systems.patch +net-allow-skb_datagram_iter-to-be-called-from-any-co.patch +wifi-wilc1000-fix-ies_len-type-in-connect-path.patch +riscv-kexec-avoid-deadlock-in-kexec-crash-path.patch +netfilter-nf_tables-unconditionally-flush-pending-wo.patch +bonding-fix-out-of-bounds-read-in-bond_option_arp_ip.patch +selftests-fix-oom-in-msg_zerocopy-selftest.patch +selftests-make-order-checking-verbose-in-msg_zerocop.patch +inet_diag-initialize-pad-field-in-struct-inet_diag_r.patch +gpiolib-of-factor-out-code-overriding-gpio-line-pola.patch +gpiolib-of-add-a-quirk-for-reset-line-polarity-for-h.patch +gpiolib-of-add-polarity-quirk-for-tsc2005.patch diff --git a/queue-5.15/tcp_metrics-validate-source-addr-length.patch b/queue-5.15/tcp_metrics-validate-source-addr-length.patch new file mode 100644 index 00000000000..ebdb00b9388 --- /dev/null +++ b/queue-5.15/tcp_metrics-validate-source-addr-length.patch @@ -0,0 +1,38 @@ +From d2dbeac1b19022f416c2035978203dfd54252f08 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jun 2024 14:25:00 -0700 +Subject: tcp_metrics: validate source addr length + +From: Jakub Kicinski + +[ Upstream commit 66be40e622e177316ae81717aa30057ba9e61dff ] + +I don't see anything checking that TCP_METRICS_ATTR_SADDR_IPV4 +is at least 4 bytes long, and the policy doesn't have an entry +for this attribute at all (neither does it for IPv6 but v6 is +manually validated). + +Reviewed-by: Eric Dumazet +Fixes: 3e7013ddf55a ("tcp: metrics: Allow selective get/del of tcp-metrics based on src IP") +Signed-off-by: Jakub Kicinski +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_metrics.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c +index def337f72c860..f17635ac7d829 100644 +--- a/net/ipv4/tcp_metrics.c ++++ b/net/ipv4/tcp_metrics.c +@@ -619,6 +619,7 @@ static const struct nla_policy tcp_metrics_nl_policy[TCP_METRICS_ATTR_MAX + 1] = + [TCP_METRICS_ATTR_ADDR_IPV4] = { .type = NLA_U32, }, + [TCP_METRICS_ATTR_ADDR_IPV6] = { .type = NLA_BINARY, + .len = sizeof(struct in6_addr), }, ++ [TCP_METRICS_ATTR_SADDR_IPV4] = { .type = NLA_U32, }, + /* Following attributes are not received for GET/DEL, + * we keep them for reference + */ +-- +2.43.0 + diff --git a/queue-5.15/upstream-tcp-fix-dsack-undo-in-fast-recovery-to-call.patch b/queue-5.15/upstream-tcp-fix-dsack-undo-in-fast-recovery-to-call.patch new file mode 100644 index 00000000000..dda06581aea --- /dev/null +++ b/queue-5.15/upstream-tcp-fix-dsack-undo-in-fast-recovery-to-call.patch @@ -0,0 +1,70 @@ +From 0a9ae6e3abdb2e64abf1bf358fed2a98af249627 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jun 2024 22:42:27 -0400 +Subject: UPSTREAM: tcp: fix DSACK undo in fast recovery to call + tcp_try_to_open() + +From: Neal Cardwell + +[ Upstream commit a6458ab7fd4f427d4f6f54380453ad255b7fde83 ] + +In some production workloads we noticed that connections could +sometimes close extremely prematurely with ETIMEDOUT after +transmitting only 1 TLP and RTO retransmission (when we would normally +expect roughly tcp_retries2 = TCP_RETR2 = 15 RTOs before a connection +closes with ETIMEDOUT). + +From tracing we determined that these workloads can suffer from a +scenario where in fast recovery, after some retransmits, a DSACK undo +can happen at a point where the scoreboard is totally clear (we have +retrans_out == sacked_out == lost_out == 0). In such cases, calling +tcp_try_keep_open() means that we do not execute any code path that +clears tp->retrans_stamp to 0. That means that tp->retrans_stamp can +remain erroneously set to the start time of the undone fast recovery, +even after the fast recovery is undone. If minutes or hours elapse, +and then a TLP/RTO/RTO sequence occurs, then the start_ts value in +retransmits_timed_out() (which is from tp->retrans_stamp) will be +erroneously ancient (left over from the fast recovery undone via +DSACKs). Thus this ancient tp->retrans_stamp value can cause the +connection to die very prematurely with ETIMEDOUT via +tcp_write_err(). + +The fix: we change DSACK undo in fast recovery (TCP_CA_Recovery) to +call tcp_try_to_open() instead of tcp_try_keep_open(). This ensures +that if no retransmits are in flight at the time of DSACK undo in fast +recovery then we properly zero retrans_stamp. Note that calling +tcp_try_to_open() is more consistent with other loss recovery +behavior, since normal fast recovery (CA_Recovery) and RTO recovery +(CA_Loss) both normally end when tp->snd_una meets or exceeds +tp->high_seq and then in tcp_fastretrans_alert() the "default" switch +case executes tcp_try_to_open(). Also note that by inspection this +change to call tcp_try_to_open() implies at least one other nice bug +fix, where now an ECE-marked DSACK that causes an undo will properly +invoke tcp_enter_cwr() rather than ignoring the ECE mark. + +Fixes: c7d9d6a185a7 ("tcp: undo on DSACK during recovery") +Signed-off-by: Neal Cardwell +Signed-off-by: Yuchung Cheng +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_input.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index eaa66f51c6a84..f37b39350e816 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -3034,7 +3034,7 @@ static void tcp_fastretrans_alert(struct sock *sk, const u32 prior_snd_una, + return; + + if (tcp_try_undo_dsack(sk)) +- tcp_try_keep_open(sk); ++ tcp_try_to_open(sk, flag); + + tcp_identify_packet_loss(sk, ack_flag); + if (icsk->icsk_ca_state != TCP_CA_Recovery) { +-- +2.43.0 + diff --git a/queue-5.15/wifi-wilc1000-fix-ies_len-type-in-connect-path.patch b/queue-5.15/wifi-wilc1000-fix-ies_len-type-in-connect-path.patch new file mode 100644 index 00000000000..0de221e2819 --- /dev/null +++ b/queue-5.15/wifi-wilc1000-fix-ies_len-type-in-connect-path.patch @@ -0,0 +1,51 @@ +From 15c2ba27f1d35870a6ce1b6ad46df419eef890a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Jul 2024 18:23:20 +0200 +Subject: wifi: wilc1000: fix ies_len type in connect path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jozef Hopko + +[ Upstream commit 39ab8fff623053a50951b659e5f6b72343d7d78c ] + +Commit 205c50306acf ("wifi: wilc1000: fix RCU usage in connect path") +made sure that the IEs data was manipulated under the relevant RCU section. +Unfortunately, while doing so, the commit brought a faulty implicit cast +from int to u8 on the ies_len variable, making the parsing fail to be +performed correctly if the IEs block is larger than 255 bytes. This failure +can be observed with Access Points appending a lot of IEs TLVs in their +beacon frames (reproduced with a Pixel phone acting as an Access Point, +which brough 273 bytes of IE data in my testing environment). + +Fix IEs parsing by removing this undesired implicit cast. + +Fixes: 205c50306acf ("wifi: wilc1000: fix RCU usage in connect path") +Signed-off-by: Jozef Hopko +Signed-off-by: Alexis Lothoré +Acked-by: Ajay Singh +Signed-off-by: Kalle Valo +Link: https://patch.msgid.link/20240701-wilc_fix_ies_data-v1-1-7486cbacf98a@bootlin.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/microchip/wilc1000/hif.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/microchip/wilc1000/hif.c b/drivers/net/wireless/microchip/wilc1000/hif.c +index fe95a6201a679..3d6877acff3a0 100644 +--- a/drivers/net/wireless/microchip/wilc1000/hif.c ++++ b/drivers/net/wireless/microchip/wilc1000/hif.c +@@ -364,7 +364,8 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss, + struct ieee80211_p2p_noa_attr noa_attr; + const struct cfg80211_bss_ies *ies; + struct wilc_join_bss_param *param; +- u8 rates_len = 0, ies_len; ++ u8 rates_len = 0; ++ int ies_len; + int ret; + + param = kzalloc(sizeof(*param), GFP_KERNEL); +-- +2.43.0 +