From 139e65bd7f539e9765d7914c4811646e3a084e4a Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Fri, 8 Mar 2024 12:00:17 -0500 Subject: [PATCH] Fixes for 6.1 Signed-off-by: Sasha Levin --- ...ialise-xdp_rxq_info-struct-before-ru.patch | 49 ++++ ...er-vma-alignment-for-memory-mapped-f.patch | 46 ++++ ...re-to-pull-inner-header-in-geneve_rx.patch | 139 ++++++++++ ...i-right-after-disabling-irqs-when-ha.patch | 41 +++ ...disabling-irq-and-napi-in-ice_qp_dis.patch | 74 +++++ ...p-pretending-to-support-rss-over-aq-.patch | 95 +++++++ ...eturning-frame-twice-in-xdp_redirect.patch | 169 ++++++++++++ ...e-irqs-in-ixgbe_txrx_ring_-dis-en-ab.patch | 138 ++++++++++ ...p-fix-register-write-order-in-ksz8_i.patch | 61 +++++ ...ntial-null-pointer-dereference-in-ic.patch | 40 +++ ...ossible-uaf-in-ip6_route_mpath_notif.patch | 258 ++++++++++++++++++ ...runtime-pm-count-underflow-on-link-s.patch | 45 +++ ...-warning-in-rds_conn_connect_if_down.patch | 57 ++++ ...se-after-free-inside-sparx5_del_mact.patch | 46 ++++ ...ntrack_h323-add-protection-for-bmp-l.patch | 71 +++++ ...-fix-l3num-expectations-with-inet-ps.patch | 62 +++++ ...a-race-around-sysctl_netrom_default_.patch | 36 +++ ...a-race-around-sysctl_netrom_link_fai.patch | 36 +++ ...a-race-around-sysctl_netrom_obsolesc.patch | 37 +++ ...a-race-around-sysctl_netrom_routing_.patch | 36 +++ ...a-race-around-sysctl_netrom_transpor.patch | 36 +++ ...-around-sysctl_netrom_transpor.patch-15916 | 37 +++ ...-around-sysctl_netrom_transpor.patch-20699 | 37 +++ ...-around-sysctl_netrom_transpor.patch-25363 | 36 +++ ...-around-sysctl_netrom_transpor.patch-27340 | 36 +++ ...-around-sysctl_netrom_transpor.patch-31091 | 37 +++ ...ta-races-around-sysctl_net_busy_read.patch | 68 +++++ ...races-around-sysctl_netrom_network_t.patch | 74 +++++ queue-6.1/series | 29 ++ ...d-fix-tracepoints-that-save-qdisc_de.patch | 92 +++++++ 30 files changed, 2018 insertions(+) create mode 100644 queue-6.1/cpumap-zero-initialise-xdp_rxq_info-struct-before-ru.patch create mode 100644 queue-6.1/erofs-apply-proper-vma-alignment-for-memory-mapped-f.patch create mode 100644 queue-6.1/geneve-make-sure-to-pull-inner-header-in-geneve_rx.patch create mode 100644 queue-6.1/i40e-disable-napi-right-after-disabling-irqs-when-ha.patch create mode 100644 queue-6.1/ice-reorder-disabling-irq-and-napi-in-ice_qp_dis.patch create mode 100644 queue-6.1/ice-virtchnl-stop-pretending-to-support-rss-over-aq-.patch create mode 100644 queue-6.1/igc-avoid-returning-frame-twice-in-xdp_redirect.patch create mode 100644 queue-6.1/ixgbe-dis-en-able-irqs-in-ixgbe_txrx_ring_-dis-en-ab.patch create mode 100644 queue-6.1/net-dsa-microchip-fix-register-write-order-in-ksz8_i.patch create mode 100644 queue-6.1/net-ice-fix-potential-null-pointer-dereference-in-ic.patch create mode 100644 queue-6.1/net-ipv6-avoid-possible-uaf-in-ip6_route_mpath_notif.patch create mode 100644 queue-6.1/net-lan78xx-fix-runtime-pm-count-underflow-on-link-s.patch create mode 100644 queue-6.1/net-rds-fix-warning-in-rds_conn_connect_if_down.patch create mode 100644 queue-6.1/net-sparx5-fix-use-after-free-inside-sparx5_del_mact.patch create mode 100644 queue-6.1/netfilter-nf_conntrack_h323-add-protection-for-bmp-l.patch create mode 100644 queue-6.1/netfilter-nft_ct-fix-l3num-expectations-with-inet-ps.patch create mode 100644 queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_default_.patch create mode 100644 queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_link_fai.patch create mode 100644 queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_obsolesc.patch create mode 100644 queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_routing_.patch create mode 100644 queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_transpor.patch create mode 100644 queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_transpor.patch-15916 create mode 100644 queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_transpor.patch-20699 create mode 100644 queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_transpor.patch-25363 create mode 100644 queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_transpor.patch-27340 create mode 100644 queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_transpor.patch-31091 create mode 100644 queue-6.1/netrom-fix-data-races-around-sysctl_net_busy_read.patch create mode 100644 queue-6.1/netrom-fix-data-races-around-sysctl_netrom_network_t.patch create mode 100644 queue-6.1/tracing-net_sched-fix-tracepoints-that-save-qdisc_de.patch diff --git a/queue-6.1/cpumap-zero-initialise-xdp_rxq_info-struct-before-ru.patch b/queue-6.1/cpumap-zero-initialise-xdp_rxq_info-struct-before-ru.patch new file mode 100644 index 00000000000..4d22129c32b --- /dev/null +++ b/queue-6.1/cpumap-zero-initialise-xdp_rxq_info-struct-before-ru.patch @@ -0,0 +1,49 @@ +From bd00ef5f4c01ae718ad8282f8d72c9304d0cd0d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Mar 2024 22:31:32 +0100 +Subject: cpumap: Zero-initialise xdp_rxq_info struct before running XDP + program +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Toke Høiland-Jørgensen + +[ Upstream commit 2487007aa3b9fafbd2cb14068f49791ce1d7ede5 ] + +When running an XDP program that is attached to a cpumap entry, we don't +initialise the xdp_rxq_info data structure being used in the xdp_buff +that backs the XDP program invocation. Tobias noticed that this leads to +random values being returned as the xdp_md->rx_queue_index value for XDP +programs running in a cpumap. + +This means we're basically returning the contents of the uninitialised +memory, which is bad. Fix this by zero-initialising the rxq data +structure before running the XDP program. + +Fixes: 9216477449f3 ("bpf: cpumap: Add the possibility to attach an eBPF program to cpumap") +Reported-by: Tobias Böhm +Signed-off-by: Toke Høiland-Jørgensen +Link: https://lore.kernel.org/r/20240305213132.11955-1-toke@redhat.com +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + kernel/bpf/cpumap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/bpf/cpumap.c b/kernel/bpf/cpumap.c +index 08a8e81027289..0508937048137 100644 +--- a/kernel/bpf/cpumap.c ++++ b/kernel/bpf/cpumap.c +@@ -222,7 +222,7 @@ static int cpu_map_bpf_prog_run_xdp(struct bpf_cpu_map_entry *rcpu, + void **frames, int n, + struct xdp_cpumap_stats *stats) + { +- struct xdp_rxq_info rxq; ++ struct xdp_rxq_info rxq = {}; + struct xdp_buff xdp; + int i, nframes = 0; + +-- +2.43.0 + diff --git a/queue-6.1/erofs-apply-proper-vma-alignment-for-memory-mapped-f.patch b/queue-6.1/erofs-apply-proper-vma-alignment-for-memory-mapped-f.patch new file mode 100644 index 00000000000..7e27b9dc747 --- /dev/null +++ b/queue-6.1/erofs-apply-proper-vma-alignment-for-memory-mapped-f.patch @@ -0,0 +1,46 @@ +From 22c1acc1838870eae7e7b222764fccc71a0d6cc8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Mar 2024 13:31:38 +0800 +Subject: erofs: apply proper VMA alignment for memory mapped files on THP + +From: Gao Xiang + +[ Upstream commit 4127caee89612a84adedd78c9453089138cd5afe ] + +There are mainly two reasons that thp_get_unmapped_area() should be +used for EROFS as other filesystems: + + - It's needed to enable PMD mappings as a FSDAX filesystem, see + commit 74d2fad1334d ("thp, dax: add thp_get_unmapped_area for pmd + mappings"); + + - It's useful together with large folios and + CONFIG_READ_ONLY_THP_FOR_FS which enable THPs for mmapped files + (e.g. shared libraries) even without FSDAX. See commit 1854bc6e2420 + ("mm/readahead: Align file mappings for non-DAX"). + +Fixes: 06252e9ce05b ("erofs: dax support for non-tailpacking regular file") +Fixes: ce529cc25b18 ("erofs: enable large folios for iomap mode") +Fixes: e6687b89225e ("erofs: enable large folios for fscache mode") +Reviewed-by: Jingbo Xu +Reviewed-by: Chao Yu +Signed-off-by: Gao Xiang +Link: https://lore.kernel.org/r/20240306053138.2240206-1-hsiangkao@linux.alibaba.com +Signed-off-by: Sasha Levin +--- + fs/erofs/data.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/erofs/data.c b/fs/erofs/data.c +index b32801d716f89..9d20e5d23ae0b 100644 +--- a/fs/erofs/data.c ++++ b/fs/erofs/data.c +@@ -440,4 +440,5 @@ const struct file_operations erofs_file_fops = { + .read_iter = erofs_file_read_iter, + .mmap = erofs_file_mmap, + .splice_read = generic_file_splice_read, ++ .get_unmapped_area = thp_get_unmapped_area, + }; +-- +2.43.0 + diff --git a/queue-6.1/geneve-make-sure-to-pull-inner-header-in-geneve_rx.patch b/queue-6.1/geneve-make-sure-to-pull-inner-header-in-geneve_rx.patch new file mode 100644 index 00000000000..8b728528c32 --- /dev/null +++ b/queue-6.1/geneve-make-sure-to-pull-inner-header-in-geneve_rx.patch @@ -0,0 +1,139 @@ +From 8639c377ef309571a095c21385bfba1a38956170 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Feb 2024 13:11:52 +0000 +Subject: geneve: make sure to pull inner header in geneve_rx() + +From: Eric Dumazet + +[ Upstream commit 1ca1ba465e55b9460e4e75dec9fff31e708fec74 ] + +syzbot triggered a bug in geneve_rx() [1] + +Issue is similar to the one I fixed in commit 8d975c15c0cd +("ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()") + +We have to save skb->network_header in a temporary variable +in order to be able to recompute the network_header pointer +after a pskb_inet_may_pull() call. + +pskb_inet_may_pull() makes sure the needed headers are in skb->head. + +[1] +BUG: KMSAN: uninit-value in IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline] + BUG: KMSAN: uninit-value in geneve_rx drivers/net/geneve.c:279 [inline] + BUG: KMSAN: uninit-value in geneve_udp_encap_recv+0x36f9/0x3c10 drivers/net/geneve.c:391 + IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline] + geneve_rx drivers/net/geneve.c:279 [inline] + geneve_udp_encap_recv+0x36f9/0x3c10 drivers/net/geneve.c:391 + udp_queue_rcv_one_skb+0x1d39/0x1f20 net/ipv4/udp.c:2108 + udp_queue_rcv_skb+0x6ae/0x6e0 net/ipv4/udp.c:2186 + udp_unicast_rcv_skb+0x184/0x4b0 net/ipv4/udp.c:2346 + __udp4_lib_rcv+0x1c6b/0x3010 net/ipv4/udp.c:2422 + udp_rcv+0x7d/0xa0 net/ipv4/udp.c:2604 + ip_protocol_deliver_rcu+0x264/0x1300 net/ipv4/ip_input.c:205 + ip_local_deliver_finish+0x2b8/0x440 net/ipv4/ip_input.c:233 + NF_HOOK include/linux/netfilter.h:314 [inline] + ip_local_deliver+0x21f/0x490 net/ipv4/ip_input.c:254 + dst_input include/net/dst.h:461 [inline] + ip_rcv_finish net/ipv4/ip_input.c:449 [inline] + NF_HOOK include/linux/netfilter.h:314 [inline] + ip_rcv+0x46f/0x760 net/ipv4/ip_input.c:569 + __netif_receive_skb_one_core net/core/dev.c:5534 [inline] + __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5648 + process_backlog+0x480/0x8b0 net/core/dev.c:5976 + __napi_poll+0xe3/0x980 net/core/dev.c:6576 + napi_poll net/core/dev.c:6645 [inline] + net_rx_action+0x8b8/0x1870 net/core/dev.c:6778 + __do_softirq+0x1b7/0x7c5 kernel/softirq.c:553 + do_softirq+0x9a/0xf0 kernel/softirq.c:454 + __local_bh_enable_ip+0x9b/0xa0 kernel/softirq.c:381 + local_bh_enable include/linux/bottom_half.h:33 [inline] + rcu_read_unlock_bh include/linux/rcupdate.h:820 [inline] + __dev_queue_xmit+0x2768/0x51c0 net/core/dev.c:4378 + dev_queue_xmit include/linux/netdevice.h:3171 [inline] + packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276 + packet_snd net/packet/af_packet.c:3081 [inline] + packet_sendmsg+0x8aef/0x9f10 net/packet/af_packet.c:3113 + sock_sendmsg_nosec net/socket.c:730 [inline] + __sock_sendmsg net/socket.c:745 [inline] + __sys_sendto+0x735/0xa10 net/socket.c:2191 + __do_sys_sendto net/socket.c:2203 [inline] + __se_sys_sendto net/socket.c:2199 [inline] + __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x63/0x6b + +Uninit was created at: + slab_post_alloc_hook mm/slub.c:3819 [inline] + slab_alloc_node mm/slub.c:3860 [inline] + kmem_cache_alloc_node+0x5cb/0xbc0 mm/slub.c:3903 + kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560 + __alloc_skb+0x352/0x790 net/core/skbuff.c:651 + alloc_skb include/linux/skbuff.h:1296 [inline] + alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6394 + sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2783 + packet_alloc_skb net/packet/af_packet.c:2930 [inline] + packet_snd net/packet/af_packet.c:3024 [inline] + packet_sendmsg+0x70c2/0x9f10 net/packet/af_packet.c:3113 + sock_sendmsg_nosec net/socket.c:730 [inline] + __sock_sendmsg net/socket.c:745 [inline] + __sys_sendto+0x735/0xa10 net/socket.c:2191 + __do_sys_sendto net/socket.c:2203 [inline] + __se_sys_sendto net/socket.c:2199 [inline] + __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x63/0x6b + +Fixes: 2d07dc79fe04 ("geneve: add initial netdev driver for GENEVE tunnels") +Reported-and-tested-by: syzbot+6a1423ff3f97159aae64@syzkaller.appspotmail.com +Signed-off-by: Eric Dumazet +Reviewed-by: Jiri Pirko +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/geneve.c | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c +index f393e454f45ca..3f8da6f0b25ce 100644 +--- a/drivers/net/geneve.c ++++ b/drivers/net/geneve.c +@@ -221,7 +221,7 @@ static void geneve_rx(struct geneve_dev *geneve, struct geneve_sock *gs, + struct genevehdr *gnvh = geneve_hdr(skb); + struct metadata_dst *tun_dst = NULL; + unsigned int len; +- int err = 0; ++ int nh, err = 0; + void *oiph; + + if (ip_tunnel_collect_metadata() || gs->collect_md) { +@@ -272,9 +272,23 @@ static void geneve_rx(struct geneve_dev *geneve, struct geneve_sock *gs, + skb->pkt_type = PACKET_HOST; + } + +- oiph = skb_network_header(skb); ++ /* Save offset of outer header relative to skb->head, ++ * because we are going to reset the network header to the inner header ++ * and might change skb->head. ++ */ ++ nh = skb_network_header(skb) - skb->head; ++ + skb_reset_network_header(skb); + ++ if (!pskb_inet_may_pull(skb)) { ++ DEV_STATS_INC(geneve->dev, rx_length_errors); ++ DEV_STATS_INC(geneve->dev, rx_errors); ++ goto drop; ++ } ++ ++ /* Get the outer header. */ ++ oiph = skb->head + nh; ++ + if (geneve_get_sk_family(gs) == AF_INET) + err = IP_ECN_decapsulate(oiph, skb); + #if IS_ENABLED(CONFIG_IPV6) +-- +2.43.0 + diff --git a/queue-6.1/i40e-disable-napi-right-after-disabling-irqs-when-ha.patch b/queue-6.1/i40e-disable-napi-right-after-disabling-irqs-when-ha.patch new file mode 100644 index 00000000000..102e6eadc54 --- /dev/null +++ b/queue-6.1/i40e-disable-napi-right-after-disabling-irqs-when-ha.patch @@ -0,0 +1,41 @@ +From f28a471d8e95f5876a446153c6992bf2295304ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Feb 2024 22:45:52 +0100 +Subject: i40e: disable NAPI right after disabling irqs when handling xsk_pool + +From: Maciej Fijalkowski + +[ Upstream commit d562b11c1eac7d73f4c778b4cbe5468f86b1f20d ] + +Disable NAPI before shutting down queues that this particular NAPI +contains so that the order of actions in i40e_queue_pair_disable() +mirrors what we do in i40e_queue_pair_enable(). + +Fixes: 123cecd427b6 ("i40e: added queue pair disable/enable functions") +Signed-off-by: Maciej Fijalkowski +Tested-by: Chandan Kumar Rout (A Contingent Worker at Intel) +Acked-by: Magnus Karlsson +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 76455405a6d8e..d8a7fb21b7b76 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -13569,9 +13569,9 @@ int i40e_queue_pair_disable(struct i40e_vsi *vsi, int queue_pair) + return err; + + i40e_queue_pair_disable_irq(vsi, queue_pair); ++ i40e_queue_pair_toggle_napi(vsi, queue_pair, false /* off */); + err = i40e_queue_pair_toggle_rings(vsi, queue_pair, false /* off */); + i40e_clean_rx_ring(vsi->rx_rings[queue_pair]); +- i40e_queue_pair_toggle_napi(vsi, queue_pair, false /* off */); + i40e_queue_pair_clean_rings(vsi, queue_pair); + i40e_queue_pair_reset_stats(vsi, queue_pair); + +-- +2.43.0 + diff --git a/queue-6.1/ice-reorder-disabling-irq-and-napi-in-ice_qp_dis.patch b/queue-6.1/ice-reorder-disabling-irq-and-napi-in-ice_qp_dis.patch new file mode 100644 index 00000000000..0b440bb710e --- /dev/null +++ b/queue-6.1/ice-reorder-disabling-irq-and-napi-in-ice_qp_dis.patch @@ -0,0 +1,74 @@ +From 631e0c0210711db5b3c42dee85fe4bc10f7ef4c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Feb 2024 22:45:53 +0100 +Subject: ice: reorder disabling IRQ and NAPI in ice_qp_dis + +From: Maciej Fijalkowski + +[ Upstream commit 99099c6bc75a30b76bb5d6774a0509ab6f06af05 ] + +ice_qp_dis() currently does things in very mixed way. Tx is stopped +before disabling IRQ on related queue vector, then it takes care of +disabling Rx and finally NAPI is disabled. + +Let us start with disabling IRQs in the first place followed by turning +off NAPI. Then it is safe to handle queues. + +One subtle change on top of that is that even though ice_qp_ena() looks +more sane, clear ICE_CFG_BUSY as the last thing there. + +Fixes: 2d4238f55697 ("ice: Add support for AF_XDP") +Signed-off-by: Maciej Fijalkowski +Tested-by: Chandan Kumar Rout (A Contingent Worker at Intel) +Acked-by: Magnus Karlsson +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_xsk.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_xsk.c b/drivers/net/ethernet/intel/ice/ice_xsk.c +index 41ee081eb8875..48cf24709fe32 100644 +--- a/drivers/net/ethernet/intel/ice/ice_xsk.c ++++ b/drivers/net/ethernet/intel/ice/ice_xsk.c +@@ -171,6 +171,10 @@ static int ice_qp_dis(struct ice_vsi *vsi, u16 q_idx) + return -EBUSY; + usleep_range(1000, 2000); + } ++ ++ ice_qvec_dis_irq(vsi, rx_ring, q_vector); ++ ice_qvec_toggle_napi(vsi, q_vector, false); ++ + netif_tx_stop_queue(netdev_get_tx_queue(vsi->netdev, q_idx)); + + ice_fill_txq_meta(vsi, tx_ring, &txq_meta); +@@ -187,13 +191,10 @@ static int ice_qp_dis(struct ice_vsi *vsi, u16 q_idx) + if (err) + return err; + } +- ice_qvec_dis_irq(vsi, rx_ring, q_vector); +- + err = ice_vsi_ctrl_one_rx_ring(vsi, false, q_idx, true); + if (err) + return err; + +- ice_qvec_toggle_napi(vsi, q_vector, false); + ice_qp_clean_rings(vsi, q_idx); + ice_qp_reset_stats(vsi, q_idx); + +@@ -256,11 +257,11 @@ static int ice_qp_ena(struct ice_vsi *vsi, u16 q_idx) + if (err) + goto free_buf; + +- clear_bit(ICE_CFG_BUSY, vsi->state); + ice_qvec_toggle_napi(vsi, q_vector, true); + ice_qvec_ena_irq(vsi, q_vector); + + netif_tx_start_queue(netdev_get_tx_queue(vsi->netdev, q_idx)); ++ clear_bit(ICE_CFG_BUSY, vsi->state); + free_buf: + kfree(qg_buf); + return err; +-- +2.43.0 + diff --git a/queue-6.1/ice-virtchnl-stop-pretending-to-support-rss-over-aq-.patch b/queue-6.1/ice-virtchnl-stop-pretending-to-support-rss-over-aq-.patch new file mode 100644 index 00000000000..878b8778217 --- /dev/null +++ b/queue-6.1/ice-virtchnl-stop-pretending-to-support-rss-over-aq-.patch @@ -0,0 +1,95 @@ +From ee87785f1f6ec2dd12dfef37fb443f1e8698f80d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 13:51:58 -0800 +Subject: ice: virtchnl: stop pretending to support RSS over AQ or registers + +From: Jacob Keller + +[ Upstream commit 2652b99e43403dc464f3648483ffb38e48872fe4 ] + +The E800 series hardware uses the same iAVF driver as older devices, +including the virtchnl negotiation scheme. + +This negotiation scheme includes a mechanism to determine what type of RSS +should be supported, including RSS over PF virtchnl messages, RSS over +firmware AdminQ messages, and RSS via direct register access. + +The PF driver will always prefer VIRTCHNL_VF_OFFLOAD_RSS_PF if its +supported by the VF driver. However, if an older VF driver is loaded, it +may request only VIRTCHNL_VF_OFFLOAD_RSS_REG or VIRTCHNL_VF_OFFLOAD_RSS_AQ. + +The ice driver happily agrees to support these methods. Unfortunately, the +underlying hardware does not support these mechanisms. The E800 series VFs +don't have the appropriate registers for RSS_REG. The mailbox queue used by +VFs for VF to PF communication blocks messages which do not have the +VF-to-PF opcode. + +Stop lying to the VF that it could support RSS over AdminQ or registers, as +these interfaces do not work when the hardware is operating on an E800 +series device. + +In practice this is unlikely to be hit by any normal user. The iAVF driver +has supported RSS over PF virtchnl commands since 2016, and always defaults +to using RSS_PF if possible. + +In principle, nothing actually stops the existing VF from attempting to +access the registers or send an AQ command. However a properly coded VF +will check the capability flags and will report a more useful error if it +detects a case where the driver does not support the RSS offloads that it +does. + +Fixes: 1071a8358a28 ("ice: Implement virtchnl commands for AVF support") +Signed-off-by: Jacob Keller +Reviewed-by: Alan Brady +Tested-by: Rafal Romanowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_virtchnl.c | 9 +-------- + drivers/net/ethernet/intel/ice/ice_virtchnl_allowlist.c | 2 -- + 2 files changed, 1 insertion(+), 10 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl.c b/drivers/net/ethernet/intel/ice/ice_virtchnl.c +index 6c03ebf81ffda..4b71392f60df1 100644 +--- a/drivers/net/ethernet/intel/ice/ice_virtchnl.c ++++ b/drivers/net/ethernet/intel/ice/ice_virtchnl.c +@@ -440,7 +440,6 @@ static int ice_vc_get_vf_res_msg(struct ice_vf *vf, u8 *msg) + vf->driver_caps = *(u32 *)msg; + else + vf->driver_caps = VIRTCHNL_VF_OFFLOAD_L2 | +- VIRTCHNL_VF_OFFLOAD_RSS_REG | + VIRTCHNL_VF_OFFLOAD_VLAN; + + vfres->vf_cap_flags = VIRTCHNL_VF_OFFLOAD_L2; +@@ -453,14 +452,8 @@ static int ice_vc_get_vf_res_msg(struct ice_vf *vf, u8 *msg) + vfres->vf_cap_flags |= ice_vc_get_vlan_caps(hw, vf, vsi, + vf->driver_caps); + +- if (vf->driver_caps & VIRTCHNL_VF_OFFLOAD_RSS_PF) { ++ if (vf->driver_caps & VIRTCHNL_VF_OFFLOAD_RSS_PF) + vfres->vf_cap_flags |= VIRTCHNL_VF_OFFLOAD_RSS_PF; +- } else { +- if (vf->driver_caps & VIRTCHNL_VF_OFFLOAD_RSS_AQ) +- vfres->vf_cap_flags |= VIRTCHNL_VF_OFFLOAD_RSS_AQ; +- else +- vfres->vf_cap_flags |= VIRTCHNL_VF_OFFLOAD_RSS_REG; +- } + + if (vf->driver_caps & VIRTCHNL_VF_OFFLOAD_FDIR_PF) + vfres->vf_cap_flags |= VIRTCHNL_VF_OFFLOAD_FDIR_PF; +diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl_allowlist.c b/drivers/net/ethernet/intel/ice/ice_virtchnl_allowlist.c +index 5a82216e7d034..63e83e8b97e55 100644 +--- a/drivers/net/ethernet/intel/ice/ice_virtchnl_allowlist.c ++++ b/drivers/net/ethernet/intel/ice/ice_virtchnl_allowlist.c +@@ -13,8 +13,6 @@ + * - opcodes needed by VF when caps are activated + * + * Caps that don't use new opcodes (no opcodes should be allowed): +- * - VIRTCHNL_VF_OFFLOAD_RSS_AQ +- * - VIRTCHNL_VF_OFFLOAD_RSS_REG + * - VIRTCHNL_VF_OFFLOAD_WB_ON_ITR + * - VIRTCHNL_VF_OFFLOAD_CRC + * - VIRTCHNL_VF_OFFLOAD_RX_POLLING +-- +2.43.0 + diff --git a/queue-6.1/igc-avoid-returning-frame-twice-in-xdp_redirect.patch b/queue-6.1/igc-avoid-returning-frame-twice-in-xdp_redirect.patch new file mode 100644 index 00000000000..f30fda10b3e --- /dev/null +++ b/queue-6.1/igc-avoid-returning-frame-twice-in-xdp_redirect.patch @@ -0,0 +1,169 @@ +From 835b0f0423d224192c9bcea08f9a599c75d42b87 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Feb 2024 10:08:43 +0100 +Subject: igc: avoid returning frame twice in XDP_REDIRECT + +From: Florian Kauer + +[ Upstream commit ef27f655b438bed4c83680e4f01e1cde2739854b ] + +When a frame can not be transmitted in XDP_REDIRECT +(e.g. due to a full queue), it is necessary to free +it by calling xdp_return_frame_rx_napi. + +However, this is the responsibility of the caller of +the ndo_xdp_xmit (see for example bq_xmit_all in +kernel/bpf/devmap.c) and thus calling it inside +igc_xdp_xmit (which is the ndo_xdp_xmit of the igc +driver) as well will lead to memory corruption. + +In fact, bq_xmit_all expects that it can return all +frames after the last successfully transmitted one. +Therefore, break for the first not transmitted frame, +but do not call xdp_return_frame_rx_napi in igc_xdp_xmit. +This is equally implemented in other Intel drivers +such as the igb. + +There are two alternatives to this that were rejected: +1. Return num_frames as all the frames would have been + transmitted and release them inside igc_xdp_xmit. + While it might work technically, it is not what + the return value is meant to represent (i.e. the + number of SUCCESSFULLY transmitted packets). +2. Rework kernel/bpf/devmap.c and all drivers to + support non-consecutively dropped packets. + Besides being complex, it likely has a negative + performance impact without a significant gain + since it is anyway unlikely that the next frame + can be transmitted if the previous one was dropped. + +The memory corruption can be reproduced with +the following script which leads to a kernel panic +after a few seconds. It basically generates more +traffic than a i225 NIC can transmit and pushes it +via XDP_REDIRECT from a virtual interface to the +physical interface where frames get dropped. + + #!/bin/bash + INTERFACE=enp4s0 + INTERFACE_IDX=`cat /sys/class/net/$INTERFACE/ifindex` + + sudo ip link add dev veth1 type veth peer name veth2 + sudo ip link set up $INTERFACE + sudo ip link set up veth1 + sudo ip link set up veth2 + + cat << EOF > redirect.bpf.c + + SEC("prog") + int redirect(struct xdp_md *ctx) + { + return bpf_redirect($INTERFACE_IDX, 0); + } + + char _license[] SEC("license") = "GPL"; + EOF + clang -O2 -g -Wall -target bpf -c redirect.bpf.c -o redirect.bpf.o + sudo ip link set veth2 xdp obj redirect.bpf.o + + cat << EOF > pass.bpf.c + + SEC("prog") + int pass(struct xdp_md *ctx) + { + return XDP_PASS; + } + + char _license[] SEC("license") = "GPL"; + EOF + clang -O2 -g -Wall -target bpf -c pass.bpf.c -o pass.bpf.o + sudo ip link set $INTERFACE xdp obj pass.bpf.o + + cat << EOF > trafgen.cfg + + { + /* Ethernet Header */ + 0xe8, 0x6a, 0x64, 0x41, 0xbf, 0x46, + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, + const16(ETH_P_IP), + + /* IPv4 Header */ + 0b01000101, 0, # IPv4 version, IHL, TOS + const16(1028), # IPv4 total length (UDP length + 20 bytes (IP header)) + const16(2), # IPv4 ident + 0b01000000, 0, # IPv4 flags, fragmentation off + 64, # IPv4 TTL + 17, # Protocol UDP + csumip(14, 33), # IPv4 checksum + + /* UDP Header */ + 10, 0, 1, 1, # IP Src - adapt as needed + 10, 0, 1, 2, # IP Dest - adapt as needed + const16(6666), # UDP Src Port + const16(6666), # UDP Dest Port + const16(1008), # UDP length (UDP header 8 bytes + payload length) + csumudp(14, 34), # UDP checksum + + /* Payload */ + fill('W', 1000), + } + EOF + + sudo trafgen -i trafgen.cfg -b3000MB -o veth1 --cpp + +Fixes: 4ff320361092 ("igc: Add support for XDP_REDIRECT action") +Signed-off-by: Florian Kauer +Reviewed-by: Maciej Fijalkowski +Tested-by: Naama Meir +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igc/igc_main.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c +index 4b6f882b380dc..e052f49cc08d7 100644 +--- a/drivers/net/ethernet/intel/igc/igc_main.c ++++ b/drivers/net/ethernet/intel/igc/igc_main.c +@@ -6330,7 +6330,7 @@ static int igc_xdp_xmit(struct net_device *dev, int num_frames, + int cpu = smp_processor_id(); + struct netdev_queue *nq; + struct igc_ring *ring; +- int i, drops; ++ int i, nxmit; + + if (unlikely(!netif_carrier_ok(dev))) + return -ENETDOWN; +@@ -6346,16 +6346,15 @@ static int igc_xdp_xmit(struct net_device *dev, int num_frames, + /* Avoid transmit queue timeout since we share it with the slow path */ + txq_trans_cond_update(nq); + +- drops = 0; ++ nxmit = 0; + for (i = 0; i < num_frames; i++) { + int err; + struct xdp_frame *xdpf = frames[i]; + + err = igc_xdp_init_tx_descriptor(ring, xdpf); +- if (err) { +- xdp_return_frame_rx_napi(xdpf); +- drops++; +- } ++ if (err) ++ break; ++ nxmit++; + } + + if (flags & XDP_XMIT_FLUSH) +@@ -6363,7 +6362,7 @@ static int igc_xdp_xmit(struct net_device *dev, int num_frames, + + __netif_tx_unlock(nq); + +- return num_frames - drops; ++ return nxmit; + } + + static void igc_trigger_rxtxq_interrupt(struct igc_adapter *adapter, +-- +2.43.0 + diff --git a/queue-6.1/ixgbe-dis-en-able-irqs-in-ixgbe_txrx_ring_-dis-en-ab.patch b/queue-6.1/ixgbe-dis-en-able-irqs-in-ixgbe_txrx_ring_-dis-en-ab.patch new file mode 100644 index 00000000000..231ce6d8bad --- /dev/null +++ b/queue-6.1/ixgbe-dis-en-able-irqs-in-ixgbe_txrx_ring_-dis-en-ab.patch @@ -0,0 +1,138 @@ +From ece265e6d053881f512029a68c97600a74eddfee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Feb 2024 22:45:51 +0100 +Subject: ixgbe: {dis, en}able irqs in ixgbe_txrx_ring_{dis, en}able + +From: Maciej Fijalkowski + +[ Upstream commit cbf996f52c4e658b3fb4349a869a62fd2d4c3c1c ] + +Currently routines that are supposed to toggle state of ring pair do not +take care of associated interrupt with queue vector that these rings +belong to. This causes funky issues such as dead interface due to irq +misconfiguration, as per Pavel's report from Closes: tag. + +Add a function responsible for disabling single IRQ in EIMC register and +call this as a very first thing when disabling ring pair during xsk_pool +setup. For enable let's reuse ixgbe_irq_enable_queues(). Besides this, +disable/enable NAPI as first/last thing when dealing with closing or +opening ring pair that xsk_pool is being configured on. + +Reported-by: Pavel Vazharov +Closes: https://lore.kernel.org/netdev/CAJEV1ijxNyPTwASJER1bcZzS9nMoZJqfR86nu_3jFFVXzZQ4NA@mail.gmail.com/ +Fixes: 024aa5800f32 ("ixgbe: added Rx/Tx ring disable/enable functions") +Signed-off-by: Maciej Fijalkowski +Acked-by: Magnus Karlsson +Tested-by: Chandan Kumar Rout (A Contingent Worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 56 ++++++++++++++++--- + 1 file changed, 49 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +index 6dc554e810a17..086cc25730338 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +@@ -2947,8 +2947,8 @@ static void ixgbe_check_lsc(struct ixgbe_adapter *adapter) + static inline void ixgbe_irq_enable_queues(struct ixgbe_adapter *adapter, + u64 qmask) + { +- u32 mask; + struct ixgbe_hw *hw = &adapter->hw; ++ u32 mask; + + switch (hw->mac.type) { + case ixgbe_mac_82598EB: +@@ -10543,6 +10543,44 @@ static void ixgbe_reset_rxr_stats(struct ixgbe_ring *rx_ring) + memset(&rx_ring->rx_stats, 0, sizeof(rx_ring->rx_stats)); + } + ++/** ++ * ixgbe_irq_disable_single - Disable single IRQ vector ++ * @adapter: adapter structure ++ * @ring: ring index ++ **/ ++static void ixgbe_irq_disable_single(struct ixgbe_adapter *adapter, u32 ring) ++{ ++ struct ixgbe_hw *hw = &adapter->hw; ++ u64 qmask = BIT_ULL(ring); ++ u32 mask; ++ ++ switch (adapter->hw.mac.type) { ++ case ixgbe_mac_82598EB: ++ mask = qmask & IXGBE_EIMC_RTX_QUEUE; ++ IXGBE_WRITE_REG(&adapter->hw, IXGBE_EIMC, mask); ++ break; ++ case ixgbe_mac_82599EB: ++ case ixgbe_mac_X540: ++ case ixgbe_mac_X550: ++ case ixgbe_mac_X550EM_x: ++ case ixgbe_mac_x550em_a: ++ mask = (qmask & 0xFFFFFFFF); ++ if (mask) ++ IXGBE_WRITE_REG(hw, IXGBE_EIMS_EX(0), mask); ++ mask = (qmask >> 32); ++ if (mask) ++ IXGBE_WRITE_REG(hw, IXGBE_EIMS_EX(1), mask); ++ break; ++ default: ++ break; ++ } ++ IXGBE_WRITE_FLUSH(&adapter->hw); ++ if (adapter->flags & IXGBE_FLAG_MSIX_ENABLED) ++ synchronize_irq(adapter->msix_entries[ring].vector); ++ else ++ synchronize_irq(adapter->pdev->irq); ++} ++ + /** + * ixgbe_txrx_ring_disable - Disable Rx/Tx/XDP Tx rings + * @adapter: adapter structure +@@ -10559,6 +10597,11 @@ void ixgbe_txrx_ring_disable(struct ixgbe_adapter *adapter, int ring) + tx_ring = adapter->tx_ring[ring]; + xdp_ring = adapter->xdp_ring[ring]; + ++ ixgbe_irq_disable_single(adapter, ring); ++ ++ /* Rx/Tx/XDP Tx share the same napi context. */ ++ napi_disable(&rx_ring->q_vector->napi); ++ + ixgbe_disable_txr(adapter, tx_ring); + if (xdp_ring) + ixgbe_disable_txr(adapter, xdp_ring); +@@ -10567,9 +10610,6 @@ void ixgbe_txrx_ring_disable(struct ixgbe_adapter *adapter, int ring) + if (xdp_ring) + synchronize_rcu(); + +- /* Rx/Tx/XDP Tx share the same napi context. */ +- napi_disable(&rx_ring->q_vector->napi); +- + ixgbe_clean_tx_ring(tx_ring); + if (xdp_ring) + ixgbe_clean_tx_ring(xdp_ring); +@@ -10597,9 +10637,6 @@ void ixgbe_txrx_ring_enable(struct ixgbe_adapter *adapter, int ring) + tx_ring = adapter->tx_ring[ring]; + xdp_ring = adapter->xdp_ring[ring]; + +- /* Rx/Tx/XDP Tx share the same napi context. */ +- napi_enable(&rx_ring->q_vector->napi); +- + ixgbe_configure_tx_ring(adapter, tx_ring); + if (xdp_ring) + ixgbe_configure_tx_ring(adapter, xdp_ring); +@@ -10608,6 +10645,11 @@ void ixgbe_txrx_ring_enable(struct ixgbe_adapter *adapter, int ring) + clear_bit(__IXGBE_TX_DISABLED, &tx_ring->state); + if (xdp_ring) + clear_bit(__IXGBE_TX_DISABLED, &xdp_ring->state); ++ ++ /* Rx/Tx/XDP Tx share the same napi context. */ ++ napi_enable(&rx_ring->q_vector->napi); ++ ixgbe_irq_enable_queues(adapter, BIT_ULL(ring)); ++ IXGBE_WRITE_FLUSH(&adapter->hw); + } + + /** +-- +2.43.0 + diff --git a/queue-6.1/net-dsa-microchip-fix-register-write-order-in-ksz8_i.patch b/queue-6.1/net-dsa-microchip-fix-register-write-order-in-ksz8_i.patch new file mode 100644 index 00000000000..a2a96aaf181 --- /dev/null +++ b/queue-6.1/net-dsa-microchip-fix-register-write-order-in-ksz8_i.patch @@ -0,0 +1,61 @@ +From 60fc3d88f4e1b0756dc2d295c99339f25df0e4df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Mar 2024 16:41:35 +0100 +Subject: net: dsa: microchip: fix register write order in ksz8_ind_write8() + +From: Tobias Jakobi (Compleo) + +[ Upstream commit b7fb7729c94fb2d23c79ff44f7a2da089c92d81c ] + +This bug was noticed while re-implementing parts of the kernel +driver in userspace using spidev. The goal was to enable some +of the errata workarounds that Microchip describes in their +errata sheet [1]. + +Both the errata sheet and the regular datasheet of e.g. the KSZ8795 +imply that you need to do this for indirect register accesses: +- write a 16-bit value to a control register pair (this value + consists of the indirect register table, and the offset inside + the table) +- either read or write an 8-bit value from the data storage + register (indicated by REG_IND_BYTE in the kernel) + +The current implementation has the order swapped. It can be +proven, by reading back some indirect register with known content +(the EEE register modified in ksz8_handle_global_errata() is one of +these), that this implementation does not work. + +Private discussion with Oleksij Rempel of Pengutronix has revealed +that the workaround was apparantly never tested on actual hardware. + +[1] https://ww1.microchip.com/downloads/aemDocuments/documents/OTH/ProductDocuments/Errata/KSZ87xx-Errata-DS80000687C.pdf + +Signed-off-by: Tobias Jakobi (Compleo) +Reviewed-by: Oleksij Rempel +Fixes: 7b6e6235b664 ("net: dsa: microchip: ksz8795: handle eee specif erratum") +Link: https://lore.kernel.org/r/20240304154135.161332-1-tobias.jakobi.compleo@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/microchip/ksz8795.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/dsa/microchip/ksz8795.c b/drivers/net/dsa/microchip/ksz8795.c +index c63e082dc57dc..934600eccbaf2 100644 +--- a/drivers/net/dsa/microchip/ksz8795.c ++++ b/drivers/net/dsa/microchip/ksz8795.c +@@ -49,9 +49,9 @@ static int ksz8_ind_write8(struct ksz_device *dev, u8 table, u16 addr, u8 data) + mutex_lock(&dev->alu_mutex); + + ctrl_addr = IND_ACC_TABLE(table) | addr; +- ret = ksz_write8(dev, regs[REG_IND_BYTE], data); ++ ret = ksz_write16(dev, regs[REG_IND_CTRL_0], ctrl_addr); + if (!ret) +- ret = ksz_write16(dev, regs[REG_IND_CTRL_0], ctrl_addr); ++ ret = ksz_write8(dev, regs[REG_IND_BYTE], data); + + mutex_unlock(&dev->alu_mutex); + +-- +2.43.0 + diff --git a/queue-6.1/net-ice-fix-potential-null-pointer-dereference-in-ic.patch b/queue-6.1/net-ice-fix-potential-null-pointer-dereference-in-ic.patch new file mode 100644 index 00000000000..0e11746a964 --- /dev/null +++ b/queue-6.1/net-ice-fix-potential-null-pointer-dereference-in-ic.patch @@ -0,0 +1,40 @@ +From a4c2ebd9188a8d5b17d847979370bb8f5c586149 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Feb 2024 18:54:48 +0300 +Subject: net: ice: Fix potential NULL pointer dereference in + ice_bridge_setlink() + +From: Rand Deeb + +[ Upstream commit 06e456a05d669ca30b224b8ed962421770c1496c ] + +The function ice_bridge_setlink() may encounter a NULL pointer dereference +if nlmsg_find_attr() returns NULL and br_spec is dereferenced subsequently +in nla_for_each_nested(). To address this issue, add a check to ensure that +br_spec is not NULL before proceeding with the nested attribute iteration. + +Fixes: b1edc14a3fbf ("ice: Implement ice_bridge_getlink and ice_bridge_setlink") +Signed-off-by: Rand Deeb +Reviewed-by: Simon Horman +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_main.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c +index ab46cfca4028d..3117f65253b37 100644 +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -7681,6 +7681,8 @@ ice_bridge_setlink(struct net_device *dev, struct nlmsghdr *nlh, + pf_sw = pf->first_sw; + /* find the attribute in the netlink message */ + br_spec = nlmsg_find_attr(nlh, sizeof(struct ifinfomsg), IFLA_AF_SPEC); ++ if (!br_spec) ++ return -EINVAL; + + nla_for_each_nested(attr, br_spec, rem) { + __u16 mode; +-- +2.43.0 + diff --git a/queue-6.1/net-ipv6-avoid-possible-uaf-in-ip6_route_mpath_notif.patch b/queue-6.1/net-ipv6-avoid-possible-uaf-in-ip6_route_mpath_notif.patch new file mode 100644 index 00000000000..ce07691eb13 --- /dev/null +++ b/queue-6.1/net-ipv6-avoid-possible-uaf-in-ip6_route_mpath_notif.patch @@ -0,0 +1,258 @@ +From 60ca156d5bc7eaadd7e1ad97c77f358e978c4fc8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 3 Mar 2024 14:48:00 +0000 +Subject: net/ipv6: avoid possible UAF in ip6_route_mpath_notify() + +From: Eric Dumazet + +[ Upstream commit 685f7d531264599b3f167f1e94bbd22f120e5fab ] + +syzbot found another use-after-free in ip6_route_mpath_notify() [1] + +Commit f7225172f25a ("net/ipv6: prevent use after free in +ip6_route_mpath_notify") was not able to fix the root cause. + +We need to defer the fib6_info_release() calls after +ip6_route_mpath_notify(), in the cleanup phase. + +[1] +BUG: KASAN: slab-use-after-free in rt6_fill_node+0x1460/0x1ac0 +Read of size 4 at addr ffff88809a07fc64 by task syz-executor.2/23037 + +CPU: 0 PID: 23037 Comm: syz-executor.2 Not tainted 6.8.0-rc4-syzkaller-01035-gea7f3cfaa588 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 +Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106 + print_address_description mm/kasan/report.c:377 [inline] + print_report+0x167/0x540 mm/kasan/report.c:488 + kasan_report+0x142/0x180 mm/kasan/report.c:601 + rt6_fill_node+0x1460/0x1ac0 + inet6_rt_notify+0x13b/0x290 net/ipv6/route.c:6184 + ip6_route_mpath_notify net/ipv6/route.c:5198 [inline] + ip6_route_multipath_add net/ipv6/route.c:5404 [inline] + inet6_rtm_newroute+0x1d0f/0x2300 net/ipv6/route.c:5517 + rtnetlink_rcv_msg+0x885/0x1040 net/core/rtnetlink.c:6597 + netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543 + netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] + netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367 + netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908 + sock_sendmsg_nosec net/socket.c:730 [inline] + __sock_sendmsg+0x221/0x270 net/socket.c:745 + ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584 + ___sys_sendmsg net/socket.c:2638 [inline] + __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667 + do_syscall_64+0xf9/0x240 + entry_SYSCALL_64_after_hwframe+0x6f/0x77 +RIP: 0033:0x7f73dd87dda9 +Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 +RSP: 002b:00007f73de6550c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e +RAX: ffffffffffffffda RBX: 00007f73dd9ac050 RCX: 00007f73dd87dda9 +RDX: 0000000000000000 RSI: 0000000020000140 RDI: 0000000000000005 +RBP: 00007f73dd8ca47a R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 +R13: 000000000000006e R14: 00007f73dd9ac050 R15: 00007ffdbdeb7858 + + +Allocated by task 23037: + kasan_save_stack mm/kasan/common.c:47 [inline] + kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 + poison_kmalloc_redzone mm/kasan/common.c:372 [inline] + __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:389 + kasan_kmalloc include/linux/kasan.h:211 [inline] + __do_kmalloc_node mm/slub.c:3981 [inline] + __kmalloc+0x22e/0x490 mm/slub.c:3994 + kmalloc include/linux/slab.h:594 [inline] + kzalloc include/linux/slab.h:711 [inline] + fib6_info_alloc+0x2e/0xf0 net/ipv6/ip6_fib.c:155 + ip6_route_info_create+0x445/0x12b0 net/ipv6/route.c:3758 + ip6_route_multipath_add net/ipv6/route.c:5298 [inline] + inet6_rtm_newroute+0x744/0x2300 net/ipv6/route.c:5517 + rtnetlink_rcv_msg+0x885/0x1040 net/core/rtnetlink.c:6597 + netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543 + netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] + netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367 + netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908 + sock_sendmsg_nosec net/socket.c:730 [inline] + __sock_sendmsg+0x221/0x270 net/socket.c:745 + ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584 + ___sys_sendmsg net/socket.c:2638 [inline] + __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667 + do_syscall_64+0xf9/0x240 + entry_SYSCALL_64_after_hwframe+0x6f/0x77 + +Freed by task 16: + kasan_save_stack mm/kasan/common.c:47 [inline] + kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 + kasan_save_free_info+0x4e/0x60 mm/kasan/generic.c:640 + poison_slab_object+0xa6/0xe0 mm/kasan/common.c:241 + __kasan_slab_free+0x34/0x70 mm/kasan/common.c:257 + kasan_slab_free include/linux/kasan.h:184 [inline] + slab_free_hook mm/slub.c:2121 [inline] + slab_free mm/slub.c:4299 [inline] + kfree+0x14a/0x380 mm/slub.c:4409 + rcu_do_batch kernel/rcu/tree.c:2190 [inline] + rcu_core+0xd76/0x1810 kernel/rcu/tree.c:2465 + __do_softirq+0x2bb/0x942 kernel/softirq.c:553 + +Last potentially related work creation: + kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47 + __kasan_record_aux_stack+0xae/0x100 mm/kasan/generic.c:586 + __call_rcu_common kernel/rcu/tree.c:2715 [inline] + call_rcu+0x167/0xa80 kernel/rcu/tree.c:2829 + fib6_info_release include/net/ip6_fib.h:341 [inline] + ip6_route_multipath_add net/ipv6/route.c:5344 [inline] + inet6_rtm_newroute+0x114d/0x2300 net/ipv6/route.c:5517 + rtnetlink_rcv_msg+0x885/0x1040 net/core/rtnetlink.c:6597 + netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543 + netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] + netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367 + netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908 + sock_sendmsg_nosec net/socket.c:730 [inline] + __sock_sendmsg+0x221/0x270 net/socket.c:745 + ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584 + ___sys_sendmsg net/socket.c:2638 [inline] + __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667 + do_syscall_64+0xf9/0x240 + entry_SYSCALL_64_after_hwframe+0x6f/0x77 + +The buggy address belongs to the object at ffff88809a07fc00 + which belongs to the cache kmalloc-512 of size 512 +The buggy address is located 100 bytes inside of + freed 512-byte region [ffff88809a07fc00, ffff88809a07fe00) + +The buggy address belongs to the physical page: +page:ffffea0002681f00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x9a07c +head:ffffea0002681f00 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0 +flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) +page_type: 0xffffffff() +raw: 00fff00000000840 ffff888014c41c80 dead000000000122 0000000000000000 +raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 +page dumped because: kasan: bad access detected +page_owner tracks the page as allocated +page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 23028, tgid 23027 (syz-executor.4), ts 2340253595219, free_ts 2339107097036 + set_page_owner include/linux/page_owner.h:31 [inline] + post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1533 + prep_new_page mm/page_alloc.c:1540 [inline] + get_page_from_freelist+0x33ea/0x3580 mm/page_alloc.c:3311 + __alloc_pages+0x255/0x680 mm/page_alloc.c:4567 + __alloc_pages_node include/linux/gfp.h:238 [inline] + alloc_pages_node include/linux/gfp.h:261 [inline] + alloc_slab_page+0x5f/0x160 mm/slub.c:2190 + allocate_slab mm/slub.c:2354 [inline] + new_slab+0x84/0x2f0 mm/slub.c:2407 + ___slab_alloc+0xd17/0x13e0 mm/slub.c:3540 + __slab_alloc mm/slub.c:3625 [inline] + __slab_alloc_node mm/slub.c:3678 [inline] + slab_alloc_node mm/slub.c:3850 [inline] + __do_kmalloc_node mm/slub.c:3980 [inline] + __kmalloc+0x2e0/0x490 mm/slub.c:3994 + kmalloc include/linux/slab.h:594 [inline] + kzalloc include/linux/slab.h:711 [inline] + new_dir fs/proc/proc_sysctl.c:956 [inline] + get_subdir fs/proc/proc_sysctl.c:1000 [inline] + sysctl_mkdir_p fs/proc/proc_sysctl.c:1295 [inline] + __register_sysctl_table+0xb30/0x1440 fs/proc/proc_sysctl.c:1376 + neigh_sysctl_register+0x416/0x500 net/core/neighbour.c:3859 + devinet_sysctl_register+0xaf/0x1f0 net/ipv4/devinet.c:2644 + inetdev_init+0x296/0x4d0 net/ipv4/devinet.c:286 + inetdev_event+0x338/0x15c0 net/ipv4/devinet.c:1555 + notifier_call_chain+0x18f/0x3b0 kernel/notifier.c:93 + call_netdevice_notifiers_extack net/core/dev.c:1987 [inline] + call_netdevice_notifiers net/core/dev.c:2001 [inline] + register_netdevice+0x15b2/0x1a20 net/core/dev.c:10340 + br_dev_newlink+0x27/0x100 net/bridge/br_netlink.c:1563 + rtnl_newlink_create net/core/rtnetlink.c:3497 [inline] + __rtnl_newlink net/core/rtnetlink.c:3717 [inline] + rtnl_newlink+0x158f/0x20a0 net/core/rtnetlink.c:3730 +page last free pid 11583 tgid 11583 stack trace: + reset_page_owner include/linux/page_owner.h:24 [inline] + free_pages_prepare mm/page_alloc.c:1140 [inline] + free_unref_page_prepare+0x968/0xa90 mm/page_alloc.c:2346 + free_unref_page+0x37/0x3f0 mm/page_alloc.c:2486 + kasan_depopulate_vmalloc_pte+0x74/0x90 mm/kasan/shadow.c:415 + apply_to_pte_range mm/memory.c:2619 [inline] + apply_to_pmd_range mm/memory.c:2663 [inline] + apply_to_pud_range mm/memory.c:2699 [inline] + apply_to_p4d_range mm/memory.c:2735 [inline] + __apply_to_page_range+0x8ec/0xe40 mm/memory.c:2769 + kasan_release_vmalloc+0x9a/0xb0 mm/kasan/shadow.c:532 + __purge_vmap_area_lazy+0x163f/0x1a10 mm/vmalloc.c:1770 + drain_vmap_area_work+0x40/0xd0 mm/vmalloc.c:1804 + process_one_work kernel/workqueue.c:2633 [inline] + process_scheduled_works+0x913/0x1420 kernel/workqueue.c:2706 + worker_thread+0xa5f/0x1000 kernel/workqueue.c:2787 + kthread+0x2ef/0x390 kernel/kthread.c:388 + ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 + ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242 + +Memory state around the buggy address: + ffff88809a07fb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc + ffff88809a07fb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc +>ffff88809a07fc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + ^ + ffff88809a07fc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + ffff88809a07fd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + +Fixes: 3b1137fe7482 ("net: ipv6: Change notifications for multipath add to RTA_MULTIPATH") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Reviewed-by: David Ahern +Link: https://lore.kernel.org/r/20240303144801.702646-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv6/route.c | 21 +++++++-------------- + 1 file changed, 7 insertions(+), 14 deletions(-) + +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 7f65dc750feb8..887599d351b8d 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -5335,19 +5335,7 @@ static int ip6_route_multipath_add(struct fib6_config *cfg, + err_nh = NULL; + list_for_each_entry(nh, &rt6_nh_list, next) { + err = __ip6_ins_rt(nh->fib6_info, info, extack); +- fib6_info_release(nh->fib6_info); +- +- if (!err) { +- /* save reference to last route successfully inserted */ +- rt_last = nh->fib6_info; +- +- /* save reference to first route for notification */ +- if (!rt_notif) +- rt_notif = nh->fib6_info; +- } + +- /* nh->fib6_info is used or freed at this point, reset to NULL*/ +- nh->fib6_info = NULL; + if (err) { + if (replace && nhn) + NL_SET_ERR_MSG_MOD(extack, +@@ -5355,6 +5343,12 @@ static int ip6_route_multipath_add(struct fib6_config *cfg, + err_nh = nh; + goto add_errout; + } ++ /* save reference to last route successfully inserted */ ++ rt_last = nh->fib6_info; ++ ++ /* save reference to first route for notification */ ++ if (!rt_notif) ++ rt_notif = nh->fib6_info; + + /* Because each route is added like a single route we remove + * these flags after the first nexthop: if there is a collision, +@@ -5415,8 +5409,7 @@ static int ip6_route_multipath_add(struct fib6_config *cfg, + + cleanup: + list_for_each_entry_safe(nh, nh_safe, &rt6_nh_list, next) { +- if (nh->fib6_info) +- fib6_info_release(nh->fib6_info); ++ fib6_info_release(nh->fib6_info); + list_del(&nh->next); + kfree(nh); + } +-- +2.43.0 + diff --git a/queue-6.1/net-lan78xx-fix-runtime-pm-count-underflow-on-link-s.patch b/queue-6.1/net-lan78xx-fix-runtime-pm-count-underflow-on-link-s.patch new file mode 100644 index 00000000000..2c016bd3a2a --- /dev/null +++ b/queue-6.1/net-lan78xx-fix-runtime-pm-count-underflow-on-link-s.patch @@ -0,0 +1,45 @@ +From 3ce9bec5162ce7a9cf8bbbee1d36325c297d4ccb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Feb 2024 13:45:17 +0100 +Subject: net: lan78xx: fix runtime PM count underflow on link stop + +From: Oleksij Rempel + +[ Upstream commit 1eecc7ab82c42133b748e1895275942a054a7f67 ] + +Current driver has some asymmetry in the runtime PM calls. On lan78xx_open() +it will call usb_autopm_get() and unconditionally usb_autopm_put(). And +on lan78xx_stop() it will call only usb_autopm_put(). So far, it was +working only because this driver do not activate autosuspend by default, +so it was visible only by warning "Runtime PM usage count underflow!". + +Since, with current driver, we can't use runtime PM with active link, +execute lan78xx_open()->usb_autopm_put() only in error case. Otherwise, +keep ref counting high as long as interface is open. + +Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver") +Signed-off-by: Oleksij Rempel +Reviewed-by: Jiri Pirko +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/lan78xx.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index 4fd4563811299..366e83ed0a973 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -3137,7 +3137,8 @@ static int lan78xx_open(struct net_device *net) + done: + mutex_unlock(&dev->dev_mutex); + +- usb_autopm_put_interface(dev->intf); ++ if (ret < 0) ++ usb_autopm_put_interface(dev->intf); + + return ret; + } +-- +2.43.0 + diff --git a/queue-6.1/net-rds-fix-warning-in-rds_conn_connect_if_down.patch b/queue-6.1/net-rds-fix-warning-in-rds_conn_connect_if_down.patch new file mode 100644 index 00000000000..a3355cdae09 --- /dev/null +++ b/queue-6.1/net-rds-fix-warning-in-rds_conn_connect_if_down.patch @@ -0,0 +1,57 @@ +From 5748869fcfe0ba64bb783086d8f3c91782d90504 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Mar 2024 08:13:08 +0800 +Subject: net/rds: fix WARNING in rds_conn_connect_if_down + +From: Edward Adam Davis + +[ Upstream commit c055fc00c07be1f0df7375ab0036cebd1106ed38 ] + +If connection isn't established yet, get_mr() will fail, trigger connection after +get_mr(). + +Fixes: 584a8279a44a ("RDS: RDMA: return appropriate error on rdma map failures") +Reported-and-tested-by: syzbot+d4faee732755bba9838e@syzkaller.appspotmail.com +Signed-off-by: Edward Adam Davis +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/rds/rdma.c | 3 +++ + net/rds/send.c | 6 +----- + 2 files changed, 4 insertions(+), 5 deletions(-) + +diff --git a/net/rds/rdma.c b/net/rds/rdma.c +index fba82d36593ad..a4e3c5de998be 100644 +--- a/net/rds/rdma.c ++++ b/net/rds/rdma.c +@@ -301,6 +301,9 @@ static int __rds_rdma_map(struct rds_sock *rs, struct rds_get_mr_args *args, + kfree(sg); + } + ret = PTR_ERR(trans_private); ++ /* Trigger connection so that its ready for the next retry */ ++ if (ret == -ENODEV) ++ rds_conn_connect_if_down(cp->cp_conn); + goto out; + } + +diff --git a/net/rds/send.c b/net/rds/send.c +index 0c5504068e3c2..a4ba45c430d81 100644 +--- a/net/rds/send.c ++++ b/net/rds/send.c +@@ -1314,12 +1314,8 @@ int rds_sendmsg(struct socket *sock, struct msghdr *msg, size_t payload_len) + + /* Parse any control messages the user may have included. */ + ret = rds_cmsg_send(rs, rm, msg, &allocated_mr, &vct); +- if (ret) { +- /* Trigger connection so that its ready for the next retry */ +- if (ret == -EAGAIN) +- rds_conn_connect_if_down(conn); ++ if (ret) + goto out; +- } + + if (rm->rdma.op_active && !conn->c_trans->xmit_rdma) { + printk_ratelimited(KERN_NOTICE "rdma_op %p conn xmit_rdma %p\n", +-- +2.43.0 + diff --git a/queue-6.1/net-sparx5-fix-use-after-free-inside-sparx5_del_mact.patch b/queue-6.1/net-sparx5-fix-use-after-free-inside-sparx5_del_mact.patch new file mode 100644 index 00000000000..84042afeff7 --- /dev/null +++ b/queue-6.1/net-sparx5-fix-use-after-free-inside-sparx5_del_mact.patch @@ -0,0 +1,46 @@ +From 5b8b4e87c5ddf3cfb53953be1da32c826a63fc52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Mar 2024 09:06:08 +0100 +Subject: net: sparx5: Fix use after free inside sparx5_del_mact_entry + +From: Horatiu Vultur + +[ Upstream commit 89d72d4125e94aa3c2140fedd97ce07ba9e37674 ] + +Based on the static analyzis of the code it looks like when an entry +from the MAC table was removed, the entry was still used after being +freed. More precise the vid of the mac_entry was used after calling +devm_kfree on the mac_entry. +The fix consists in first using the vid of the mac_entry to delete the +entry from the HW and after that to free it. + +Fixes: b37a1bae742f ("net: sparx5: add mactable support") +Signed-off-by: Horatiu Vultur +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20240301080608.3053468-1-horatiu.vultur@microchip.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/microchip/sparx5/sparx5_mactable.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/microchip/sparx5/sparx5_mactable.c b/drivers/net/ethernet/microchip/sparx5/sparx5_mactable.c +index 4af285918ea2a..75868b3f548ec 100644 +--- a/drivers/net/ethernet/microchip/sparx5/sparx5_mactable.c ++++ b/drivers/net/ethernet/microchip/sparx5/sparx5_mactable.c +@@ -347,10 +347,10 @@ int sparx5_del_mact_entry(struct sparx5 *sparx5, + list) { + if ((vid == 0 || mact_entry->vid == vid) && + ether_addr_equal(addr, mact_entry->mac)) { ++ sparx5_mact_forget(sparx5, addr, mact_entry->vid); ++ + list_del(&mact_entry->list); + devm_kfree(sparx5->dev, mact_entry); +- +- sparx5_mact_forget(sparx5, addr, mact_entry->vid); + } + } + mutex_unlock(&sparx5->mact_lock); +-- +2.43.0 + diff --git a/queue-6.1/netfilter-nf_conntrack_h323-add-protection-for-bmp-l.patch b/queue-6.1/netfilter-nf_conntrack_h323-add-protection-for-bmp-l.patch new file mode 100644 index 00000000000..7afd0a6332c --- /dev/null +++ b/queue-6.1/netfilter-nf_conntrack_h323-add-protection-for-bmp-l.patch @@ -0,0 +1,71 @@ +From b4621f9c439242f93679ee5ac8439baddeb46a43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Mar 2024 11:38:55 +0000 +Subject: netfilter: nf_conntrack_h323: Add protection for bmp length out of + range + +From: Lena Wang + +[ Upstream commit 767146637efc528b5e3d31297df115e85a2fd362 ] + +UBSAN load reports an exception of BRK#5515 SHIFT_ISSUE:Bitwise shifts +that are out of bounds for their data type. + +vmlinux get_bitmap(b=75) + 712 + +vmlinux decode_seq(bs=0xFFFFFFD008037000, f=0xFFFFFFD008037018, level=134443100) + 1956 + +vmlinux decode_choice(base=0xFFFFFFD0080370F0, level=23843636) + 1216 + +vmlinux decode_seq(f=0xFFFFFFD0080371A8, level=134443500) + 812 + +vmlinux decode_choice(base=0xFFFFFFD008037280, level=0) + 1216 + +vmlinux DecodeRasMessage() + 304 + +vmlinux ras_help() + 684 + +vmlinux nf_confirm() + 188 + + +Due to abnormal data in skb->data, the extension bitmap length +exceeds 32 when decoding ras message then uses the length to make +a shift operation. It will change into negative after several loop. +UBSAN load could detect a negative shift as an undefined behaviour +and reports exception. +So we add the protection to avoid the length exceeding 32. Or else +it will return out of range error and stop decoding. + +Fixes: 5e35941d9901 ("[NETFILTER]: Add H.323 conntrack/NAT helper") +Signed-off-by: Lena Wang +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_h323_asn1.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/net/netfilter/nf_conntrack_h323_asn1.c b/net/netfilter/nf_conntrack_h323_asn1.c +index e697a824b0018..540d97715bd23 100644 +--- a/net/netfilter/nf_conntrack_h323_asn1.c ++++ b/net/netfilter/nf_conntrack_h323_asn1.c +@@ -533,6 +533,8 @@ static int decode_seq(struct bitstr *bs, const struct field_t *f, + /* Get fields bitmap */ + if (nf_h323_error_boundary(bs, 0, f->sz)) + return H323_ERROR_BOUND; ++ if (f->sz > 32) ++ return H323_ERROR_RANGE; + bmp = get_bitmap(bs, f->sz); + if (base) + *(unsigned int *)base = bmp; +@@ -589,6 +591,8 @@ static int decode_seq(struct bitstr *bs, const struct field_t *f, + bmp2_len = get_bits(bs, 7) + 1; + if (nf_h323_error_boundary(bs, 0, bmp2_len)) + return H323_ERROR_BOUND; ++ if (bmp2_len > 32) ++ return H323_ERROR_RANGE; + bmp2 = get_bitmap(bs, bmp2_len); + bmp |= bmp2 >> f->sz; + if (base) +-- +2.43.0 + diff --git a/queue-6.1/netfilter-nft_ct-fix-l3num-expectations-with-inet-ps.patch b/queue-6.1/netfilter-nft_ct-fix-l3num-expectations-with-inet-ps.patch new file mode 100644 index 00000000000..805fcf3571a --- /dev/null +++ b/queue-6.1/netfilter-nft_ct-fix-l3num-expectations-with-inet-ps.patch @@ -0,0 +1,62 @@ +From b46bb9f80110bea9970ef2f897a96628d75ede60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Mar 2024 13:38:15 +0100 +Subject: netfilter: nft_ct: fix l3num expectations with inet pseudo family + +From: Florian Westphal + +[ Upstream commit 99993789966a6eb4f1295193dc543686899892d3 ] + +Following is rejected but should be allowed: + +table inet t { + ct expectation exp1 { + [..] + l3proto ip + +Valid combos are: +table ip t, l3proto ip +table ip6 t, l3proto ip6 +table inet t, l3proto ip OR l3proto ip6 + +Disallow inet pseudeo family, the l3num must be a on-wire protocol known +to conntrack. + +Retain NFPROTO_INET case to make it clear its rejected +intentionally rather as oversight. + +Fixes: 8059918a1377 ("netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_ct.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c +index 8df7564f0611e..2bfe3cdfbd581 100644 +--- a/net/netfilter/nft_ct.c ++++ b/net/netfilter/nft_ct.c +@@ -1237,14 +1237,13 @@ static int nft_ct_expect_obj_init(const struct nft_ctx *ctx, + switch (priv->l3num) { + case NFPROTO_IPV4: + case NFPROTO_IPV6: +- if (priv->l3num != ctx->family) +- return -EINVAL; ++ if (priv->l3num == ctx->family || ctx->family == NFPROTO_INET) ++ break; + +- fallthrough; +- case NFPROTO_INET: +- break; ++ return -EINVAL; ++ case NFPROTO_INET: /* tuple.src.l3num supports NFPROTO_IPV4/6 only */ + default: +- return -EOPNOTSUPP; ++ return -EAFNOSUPPORT; + } + + priv->l4proto = nla_get_u8(tb[NFTA_CT_EXPECT_L4PROTO]); +-- +2.43.0 + diff --git a/queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_default_.patch b/queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_default_.patch new file mode 100644 index 00000000000..4f71ceff7b6 --- /dev/null +++ b/queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_default_.patch @@ -0,0 +1,36 @@ +From a8c289c2c40c28d9150e343644c8b4183dbbb50a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Mar 2024 16:20:35 +0800 +Subject: netrom: Fix a data-race around sysctl_netrom_default_path_quality + +From: Jason Xing + +[ Upstream commit 958d6145a6d9ba9e075c921aead8753fb91c9101 ] + +We need to protect the reader reading sysctl_netrom_default_path_quality +because the value can be changed concurrently. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Jason Xing +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/netrom/nr_route.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c +index baea3cbd76ca5..6f709fdffc11f 100644 +--- a/net/netrom/nr_route.c ++++ b/net/netrom/nr_route.c +@@ -153,7 +153,7 @@ static int __must_check nr_add_node(ax25_address *nr, const char *mnemonic, + nr_neigh->digipeat = NULL; + nr_neigh->ax25 = NULL; + nr_neigh->dev = dev; +- nr_neigh->quality = sysctl_netrom_default_path_quality; ++ nr_neigh->quality = READ_ONCE(sysctl_netrom_default_path_quality); + nr_neigh->locked = 0; + nr_neigh->count = 0; + nr_neigh->number = nr_neigh_no++; +-- +2.43.0 + diff --git a/queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_link_fai.patch b/queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_link_fai.patch new file mode 100644 index 00000000000..fff3129ea64 --- /dev/null +++ b/queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_link_fai.patch @@ -0,0 +1,36 @@ +From cc387df586452d83bbec524e7e33b7229659e97a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Mar 2024 16:20:45 +0800 +Subject: netrom: Fix a data-race around sysctl_netrom_link_fails_count + +From: Jason Xing + +[ Upstream commit bc76645ebdd01be9b9994dac39685a3d0f6f7985 ] + +We need to protect the reader reading the sysctl value because the +value can be changed concurrently. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Jason Xing +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/netrom/nr_route.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c +index 89e12e6eea2ef..70480869ad1c5 100644 +--- a/net/netrom/nr_route.c ++++ b/net/netrom/nr_route.c +@@ -728,7 +728,7 @@ void nr_link_failed(ax25_cb *ax25, int reason) + nr_neigh->ax25 = NULL; + ax25_cb_put(ax25); + +- if (++nr_neigh->failed < sysctl_netrom_link_fails_count) { ++ if (++nr_neigh->failed < READ_ONCE(sysctl_netrom_link_fails_count)) { + nr_neigh_put(nr_neigh); + return; + } +-- +2.43.0 + diff --git a/queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_obsolesc.patch b/queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_obsolesc.patch new file mode 100644 index 00000000000..81a820fcdfd --- /dev/null +++ b/queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_obsolesc.patch @@ -0,0 +1,37 @@ +From e9fe682397a50685b12305a87de0e5f3b277e09e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Mar 2024 16:20:36 +0800 +Subject: netrom: Fix a data-race around + sysctl_netrom_obsolescence_count_initialiser + +From: Jason Xing + +[ Upstream commit cfd9f4a740f772298308b2e6070d2c744fb5cf79 ] + +We need to protect the reader reading the sysctl value +because the value can be changed concurrently. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Jason Xing +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/netrom/nr_route.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c +index 6f709fdffc11f..b8ddd8048f352 100644 +--- a/net/netrom/nr_route.c ++++ b/net/netrom/nr_route.c +@@ -766,7 +766,7 @@ int nr_route_frame(struct sk_buff *skb, ax25_cb *ax25) + if (ax25 != NULL) { + ret = nr_add_node(nr_src, "", &ax25->dest_addr, ax25->digipeat, + ax25->ax25_dev->dev, 0, +- sysctl_netrom_obsolescence_count_initialiser); ++ READ_ONCE(sysctl_netrom_obsolescence_count_initialiser)); + if (ret) + return ret; + } +-- +2.43.0 + diff --git a/queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_routing_.patch b/queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_routing_.patch new file mode 100644 index 00000000000..f20e43ab640 --- /dev/null +++ b/queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_routing_.patch @@ -0,0 +1,36 @@ +From b23060893bab46da8ee7b846026f79a09da41c60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Mar 2024 16:20:44 +0800 +Subject: netrom: Fix a data-race around sysctl_netrom_routing_control + +From: Jason Xing + +[ Upstream commit b5dffcb8f71bdd02a4e5799985b51b12f4eeaf76 ] + +We need to protect the reader reading the sysctl value because the +value can be changed concurrently. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Jason Xing +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/netrom/nr_route.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c +index b8ddd8048f352..89e12e6eea2ef 100644 +--- a/net/netrom/nr_route.c ++++ b/net/netrom/nr_route.c +@@ -780,7 +780,7 @@ int nr_route_frame(struct sk_buff *skb, ax25_cb *ax25) + return ret; + } + +- if (!sysctl_netrom_routing_control && ax25 != NULL) ++ if (!READ_ONCE(sysctl_netrom_routing_control) && ax25 != NULL) + return 0; + + /* Its Time-To-Live has expired */ +-- +2.43.0 + diff --git a/queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_transpor.patch b/queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_transpor.patch new file mode 100644 index 00000000000..e17f61b7c4f --- /dev/null +++ b/queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_transpor.patch @@ -0,0 +1,36 @@ +From 263e41de052eb763a78a6346c6c5e04b234c57b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Mar 2024 16:20:38 +0800 +Subject: netrom: Fix a data-race around sysctl_netrom_transport_timeout + +From: Jason Xing + +[ Upstream commit 60a7a152abd494ed4f69098cf0f322e6bb140612 ] + +We need to protect the reader reading the sysctl value because the +value can be changed concurrently. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Jason Xing +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/netrom/af_netrom.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c +index ec5747969f964..3c6567af2ba47 100644 +--- a/net/netrom/af_netrom.c ++++ b/net/netrom/af_netrom.c +@@ -453,7 +453,7 @@ static int nr_create(struct net *net, struct socket *sock, int protocol, + nr_init_timers(sk); + + nr->t1 = +- msecs_to_jiffies(sysctl_netrom_transport_timeout); ++ msecs_to_jiffies(READ_ONCE(sysctl_netrom_transport_timeout)); + nr->t2 = + msecs_to_jiffies(sysctl_netrom_transport_acknowledge_delay); + nr->n2 = +-- +2.43.0 + diff --git a/queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_transpor.patch-15916 b/queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_transpor.patch-15916 new file mode 100644 index 00000000000..b5d0833c650 --- /dev/null +++ b/queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_transpor.patch-15916 @@ -0,0 +1,37 @@ +From 6dcecece4def23a2611deea1d2e5fea5c059d698 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Mar 2024 16:20:43 +0800 +Subject: netrom: Fix a data-race around + sysctl_netrom_transport_no_activity_timeout + +From: Jason Xing + +[ Upstream commit f99b494b40431f0ca416859f2345746199398e2b ] + +We need to protect the reader reading the sysctl value because the +value can be changed concurrently. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Jason Xing +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/netrom/af_netrom.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c +index 88941b66631fc..5472e79cde830 100644 +--- a/net/netrom/af_netrom.c ++++ b/net/netrom/af_netrom.c +@@ -461,7 +461,7 @@ static int nr_create(struct net *net, struct socket *sock, int protocol, + nr->t4 = + msecs_to_jiffies(READ_ONCE(sysctl_netrom_transport_busy_delay)); + nr->idle = +- msecs_to_jiffies(sysctl_netrom_transport_no_activity_timeout); ++ msecs_to_jiffies(READ_ONCE(sysctl_netrom_transport_no_activity_timeout)); + nr->window = READ_ONCE(sysctl_netrom_transport_requested_window_size); + + nr->bpqext = 1; +-- +2.43.0 + diff --git a/queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_transpor.patch-20699 b/queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_transpor.patch-20699 new file mode 100644 index 00000000000..79d6e80f07b --- /dev/null +++ b/queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_transpor.patch-20699 @@ -0,0 +1,37 @@ +From 06cfb71053fafc2a75f1e36366d1330f9605aca8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Mar 2024 16:20:42 +0800 +Subject: netrom: Fix a data-race around + sysctl_netrom_transport_requested_window_size + +From: Jason Xing + +[ Upstream commit a2e706841488f474c06e9b33f71afc947fb3bf56 ] + +We need to protect the reader reading the sysctl value because the +value can be changed concurrently. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Jason Xing +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/netrom/af_netrom.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c +index ee6621c0d2e45..88941b66631fc 100644 +--- a/net/netrom/af_netrom.c ++++ b/net/netrom/af_netrom.c +@@ -462,7 +462,7 @@ static int nr_create(struct net *net, struct socket *sock, int protocol, + msecs_to_jiffies(READ_ONCE(sysctl_netrom_transport_busy_delay)); + nr->idle = + msecs_to_jiffies(sysctl_netrom_transport_no_activity_timeout); +- nr->window = sysctl_netrom_transport_requested_window_size; ++ nr->window = READ_ONCE(sysctl_netrom_transport_requested_window_size); + + nr->bpqext = 1; + nr->state = NR_STATE_0; +-- +2.43.0 + diff --git a/queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_transpor.patch-25363 b/queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_transpor.patch-25363 new file mode 100644 index 00000000000..400db7d0867 --- /dev/null +++ b/queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_transpor.patch-25363 @@ -0,0 +1,36 @@ +From cc00a2e09aa43bf3cfdc972086b4b99e484196a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Mar 2024 16:20:39 +0800 +Subject: netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries + +From: Jason Xing + +[ Upstream commit e799299aafed417cc1f32adccb2a0e5268b3f6d5 ] + +We need to protect the reader reading the sysctl value because the +value can be changed concurrently. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Jason Xing +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/netrom/af_netrom.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c +index 3c6567af2ba47..be404ace98786 100644 +--- a/net/netrom/af_netrom.c ++++ b/net/netrom/af_netrom.c +@@ -457,7 +457,7 @@ static int nr_create(struct net *net, struct socket *sock, int protocol, + nr->t2 = + msecs_to_jiffies(sysctl_netrom_transport_acknowledge_delay); + nr->n2 = +- msecs_to_jiffies(sysctl_netrom_transport_maximum_tries); ++ msecs_to_jiffies(READ_ONCE(sysctl_netrom_transport_maximum_tries)); + nr->t4 = + msecs_to_jiffies(sysctl_netrom_transport_busy_delay); + nr->idle = +-- +2.43.0 + diff --git a/queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_transpor.patch-27340 b/queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_transpor.patch-27340 new file mode 100644 index 00000000000..3dc22ea43b1 --- /dev/null +++ b/queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_transpor.patch-27340 @@ -0,0 +1,36 @@ +From 7b2595f33ad502ef5a85650b626b2b9475e689f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Mar 2024 16:20:41 +0800 +Subject: netrom: Fix a data-race around sysctl_netrom_transport_busy_delay + +From: Jason Xing + +[ Upstream commit 43547d8699439a67b78d6bb39015113f7aa360fd ] + +We need to protect the reader reading the sysctl value because the +value can be changed concurrently. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Jason Xing +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/netrom/af_netrom.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c +index 7428ea436e318..ee6621c0d2e45 100644 +--- a/net/netrom/af_netrom.c ++++ b/net/netrom/af_netrom.c +@@ -459,7 +459,7 @@ static int nr_create(struct net *net, struct socket *sock, int protocol, + nr->n2 = + msecs_to_jiffies(READ_ONCE(sysctl_netrom_transport_maximum_tries)); + nr->t4 = +- msecs_to_jiffies(sysctl_netrom_transport_busy_delay); ++ msecs_to_jiffies(READ_ONCE(sysctl_netrom_transport_busy_delay)); + nr->idle = + msecs_to_jiffies(sysctl_netrom_transport_no_activity_timeout); + nr->window = sysctl_netrom_transport_requested_window_size; +-- +2.43.0 + diff --git a/queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_transpor.patch-31091 b/queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_transpor.patch-31091 new file mode 100644 index 00000000000..09fef6ac884 --- /dev/null +++ b/queue-6.1/netrom-fix-a-data-race-around-sysctl_netrom_transpor.patch-31091 @@ -0,0 +1,37 @@ +From 33580aa566de830a046301f79c9795f6c353b376 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Mar 2024 16:20:40 +0800 +Subject: netrom: Fix a data-race around + sysctl_netrom_transport_acknowledge_delay + +From: Jason Xing + +[ Upstream commit 806f462ba9029d41aadf8ec93f2f99c5305deada ] + +We need to protect the reader reading the sysctl value because the +value can be changed concurrently. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Jason Xing +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/netrom/af_netrom.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c +index be404ace98786..7428ea436e318 100644 +--- a/net/netrom/af_netrom.c ++++ b/net/netrom/af_netrom.c +@@ -455,7 +455,7 @@ static int nr_create(struct net *net, struct socket *sock, int protocol, + nr->t1 = + msecs_to_jiffies(READ_ONCE(sysctl_netrom_transport_timeout)); + nr->t2 = +- msecs_to_jiffies(sysctl_netrom_transport_acknowledge_delay); ++ msecs_to_jiffies(READ_ONCE(sysctl_netrom_transport_acknowledge_delay)); + nr->n2 = + msecs_to_jiffies(READ_ONCE(sysctl_netrom_transport_maximum_tries)); + nr->t4 = +-- +2.43.0 + diff --git a/queue-6.1/netrom-fix-data-races-around-sysctl_net_busy_read.patch b/queue-6.1/netrom-fix-data-races-around-sysctl_net_busy_read.patch new file mode 100644 index 00000000000..5efc0a76fbe --- /dev/null +++ b/queue-6.1/netrom-fix-data-races-around-sysctl_net_busy_read.patch @@ -0,0 +1,68 @@ +From 5d08f47c6a0a390c7456114eb29c29edc2088e5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Mar 2024 16:20:46 +0800 +Subject: netrom: Fix data-races around sysctl_net_busy_read + +From: Jason Xing + +[ Upstream commit d380ce70058a4ccddc3e5f5c2063165dc07672c6 ] + +We need to protect the reader reading the sysctl value because the +value can be changed concurrently. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Jason Xing +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/netrom/af_netrom.c | 2 +- + net/netrom/nr_in.c | 6 +++--- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c +index 5472e79cde830..f0879295de110 100644 +--- a/net/netrom/af_netrom.c ++++ b/net/netrom/af_netrom.c +@@ -954,7 +954,7 @@ int nr_rx_frame(struct sk_buff *skb, struct net_device *dev) + * G8PZT's Xrouter which is sending packets with command type 7 + * as an extension of the protocol. + */ +- if (sysctl_netrom_reset_circuit && ++ if (READ_ONCE(sysctl_netrom_reset_circuit) && + (frametype != NR_RESET || flags != 0)) + nr_transmit_reset(skb, 1); + +diff --git a/net/netrom/nr_in.c b/net/netrom/nr_in.c +index 2f084b6f69d7e..97944db6b5ac6 100644 +--- a/net/netrom/nr_in.c ++++ b/net/netrom/nr_in.c +@@ -97,7 +97,7 @@ static int nr_state1_machine(struct sock *sk, struct sk_buff *skb, + break; + + case NR_RESET: +- if (sysctl_netrom_reset_circuit) ++ if (READ_ONCE(sysctl_netrom_reset_circuit)) + nr_disconnect(sk, ECONNRESET); + break; + +@@ -128,7 +128,7 @@ static int nr_state2_machine(struct sock *sk, struct sk_buff *skb, + break; + + case NR_RESET: +- if (sysctl_netrom_reset_circuit) ++ if (READ_ONCE(sysctl_netrom_reset_circuit)) + nr_disconnect(sk, ECONNRESET); + break; + +@@ -262,7 +262,7 @@ static int nr_state3_machine(struct sock *sk, struct sk_buff *skb, int frametype + break; + + case NR_RESET: +- if (sysctl_netrom_reset_circuit) ++ if (READ_ONCE(sysctl_netrom_reset_circuit)) + nr_disconnect(sk, ECONNRESET); + break; + +-- +2.43.0 + diff --git a/queue-6.1/netrom-fix-data-races-around-sysctl_netrom_network_t.patch b/queue-6.1/netrom-fix-data-races-around-sysctl_netrom_network_t.patch new file mode 100644 index 00000000000..f21edcfd8f1 --- /dev/null +++ b/queue-6.1/netrom-fix-data-races-around-sysctl_netrom_network_t.patch @@ -0,0 +1,74 @@ +From c80553216b354d6ed3cca69638af86b16d55097d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Mar 2024 16:20:37 +0800 +Subject: netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser + +From: Jason Xing + +[ Upstream commit 119cae5ea3f9e35cdada8e572cc067f072fa825a ] + +We need to protect the reader reading the sysctl value because the +value can be changed concurrently. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Jason Xing +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/netrom/nr_dev.c | 2 +- + net/netrom/nr_out.c | 2 +- + net/netrom/nr_subr.c | 5 +++-- + 3 files changed, 5 insertions(+), 4 deletions(-) + +diff --git a/net/netrom/nr_dev.c b/net/netrom/nr_dev.c +index 3aaac4a22b387..2c34389c3ce6f 100644 +--- a/net/netrom/nr_dev.c ++++ b/net/netrom/nr_dev.c +@@ -81,7 +81,7 @@ static int nr_header(struct sk_buff *skb, struct net_device *dev, + buff[6] |= AX25_SSSID_SPARE; + buff += AX25_ADDR_LEN; + +- *buff++ = sysctl_netrom_network_ttl_initialiser; ++ *buff++ = READ_ONCE(sysctl_netrom_network_ttl_initialiser); + + *buff++ = NR_PROTO_IP; + *buff++ = NR_PROTO_IP; +diff --git a/net/netrom/nr_out.c b/net/netrom/nr_out.c +index 44929657f5b71..5e531394a724b 100644 +--- a/net/netrom/nr_out.c ++++ b/net/netrom/nr_out.c +@@ -204,7 +204,7 @@ void nr_transmit_buffer(struct sock *sk, struct sk_buff *skb) + dptr[6] |= AX25_SSSID_SPARE; + dptr += AX25_ADDR_LEN; + +- *dptr++ = sysctl_netrom_network_ttl_initialiser; ++ *dptr++ = READ_ONCE(sysctl_netrom_network_ttl_initialiser); + + if (!nr_route_frame(skb, NULL)) { + kfree_skb(skb); +diff --git a/net/netrom/nr_subr.c b/net/netrom/nr_subr.c +index e2d2af924cff4..c3bbd5880850b 100644 +--- a/net/netrom/nr_subr.c ++++ b/net/netrom/nr_subr.c +@@ -182,7 +182,8 @@ void nr_write_internal(struct sock *sk, int frametype) + *dptr++ = nr->my_id; + *dptr++ = frametype; + *dptr++ = nr->window; +- if (nr->bpqext) *dptr++ = sysctl_netrom_network_ttl_initialiser; ++ if (nr->bpqext) ++ *dptr++ = READ_ONCE(sysctl_netrom_network_ttl_initialiser); + break; + + case NR_DISCREQ: +@@ -236,7 +237,7 @@ void __nr_transmit_reply(struct sk_buff *skb, int mine, unsigned char cmdflags) + dptr[6] |= AX25_SSSID_SPARE; + dptr += AX25_ADDR_LEN; + +- *dptr++ = sysctl_netrom_network_ttl_initialiser; ++ *dptr++ = READ_ONCE(sysctl_netrom_network_ttl_initialiser); + + if (mine) { + *dptr++ = 0; +-- +2.43.0 + diff --git a/queue-6.1/series b/queue-6.1/series index 0222bb0129a..ce57a431ba3 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -1 +1,30 @@ ceph-switch-to-corrected-encoding-of-max_xattr_size-.patch +net-lan78xx-fix-runtime-pm-count-underflow-on-link-s.patch +ixgbe-dis-en-able-irqs-in-ixgbe_txrx_ring_-dis-en-ab.patch +i40e-disable-napi-right-after-disabling-irqs-when-ha.patch +ice-reorder-disabling-irq-and-napi-in-ice_qp_dis.patch +tracing-net_sched-fix-tracepoints-that-save-qdisc_de.patch +geneve-make-sure-to-pull-inner-header-in-geneve_rx.patch +net-sparx5-fix-use-after-free-inside-sparx5_del_mact.patch +ice-virtchnl-stop-pretending-to-support-rss-over-aq-.patch +net-ice-fix-potential-null-pointer-dereference-in-ic.patch +igc-avoid-returning-frame-twice-in-xdp_redirect.patch +net-ipv6-avoid-possible-uaf-in-ip6_route_mpath_notif.patch +cpumap-zero-initialise-xdp_rxq_info-struct-before-ru.patch +net-dsa-microchip-fix-register-write-order-in-ksz8_i.patch +net-rds-fix-warning-in-rds_conn_connect_if_down.patch +netfilter-nft_ct-fix-l3num-expectations-with-inet-ps.patch +netfilter-nf_conntrack_h323-add-protection-for-bmp-l.patch +erofs-apply-proper-vma-alignment-for-memory-mapped-f.patch +netrom-fix-a-data-race-around-sysctl_netrom_default_.patch +netrom-fix-a-data-race-around-sysctl_netrom_obsolesc.patch +netrom-fix-data-races-around-sysctl_netrom_network_t.patch +netrom-fix-a-data-race-around-sysctl_netrom_transpor.patch +netrom-fix-a-data-race-around-sysctl_netrom_transpor.patch-25363 +netrom-fix-a-data-race-around-sysctl_netrom_transpor.patch-31091 +netrom-fix-a-data-race-around-sysctl_netrom_transpor.patch-27340 +netrom-fix-a-data-race-around-sysctl_netrom_transpor.patch-20699 +netrom-fix-a-data-race-around-sysctl_netrom_transpor.patch-15916 +netrom-fix-a-data-race-around-sysctl_netrom_routing_.patch +netrom-fix-a-data-race-around-sysctl_netrom_link_fai.patch +netrom-fix-data-races-around-sysctl_net_busy_read.patch diff --git a/queue-6.1/tracing-net_sched-fix-tracepoints-that-save-qdisc_de.patch b/queue-6.1/tracing-net_sched-fix-tracepoints-that-save-qdisc_de.patch new file mode 100644 index 00000000000..3d2c853a844 --- /dev/null +++ b/queue-6.1/tracing-net_sched-fix-tracepoints-that-save-qdisc_de.patch @@ -0,0 +1,92 @@ +From 6c7a3ce7f9de26fd0ce2e9b305fe111a53d9e5f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Feb 2024 14:34:44 -0500 +Subject: tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Steven Rostedt (Google) + +[ Upstream commit 51270d573a8d9dd5afdc7934de97d66c0e14b5fd ] + +I'm updating __assign_str() and will be removing the second parameter. To +make sure that it does not break anything, I make sure that it matches the +__string() field, as that is where the string is actually going to be +saved in. To make sure there's nothing that breaks, I added a WARN_ON() to +make sure that what was used in __string() is the same that is used in +__assign_str(). + +In doing this change, an error was triggered as __assign_str() now expects +the string passed in to be a char * value. I instead had the following +warning: + +include/trace/events/qdisc.h: In function ‘trace_event_raw_event_qdisc_reset’: +include/trace/events/qdisc.h:91:35: error: passing argument 1 of 'strcmp' from incompatible pointer type [-Werror=incompatible-pointer-types] + 91 | __assign_str(dev, qdisc_dev(q)); + +That's because the qdisc_enqueue() and qdisc_reset() pass in qdisc_dev(q) +to __assign_str() and to __string(). But that function returns a pointer +to struct net_device and not a string. + +It appears that these events are just saving the pointer as a string and +then reading it as a string as well. + +Use qdisc_dev(q)->name to save the device instead. + +Fixes: a34dac0b90552 ("net_sched: add tracepoints for qdisc_reset() and qdisc_destroy()") +Signed-off-by: Steven Rostedt (Google) +Reviewed-by: Jamal Hadi Salim +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/trace/events/qdisc.h | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/include/trace/events/qdisc.h b/include/trace/events/qdisc.h +index a3995925cb057..1f4258308b967 100644 +--- a/include/trace/events/qdisc.h ++++ b/include/trace/events/qdisc.h +@@ -81,14 +81,14 @@ TRACE_EVENT(qdisc_reset, + TP_ARGS(q), + + TP_STRUCT__entry( +- __string( dev, qdisc_dev(q) ) +- __string( kind, q->ops->id ) +- __field( u32, parent ) +- __field( u32, handle ) ++ __string( dev, qdisc_dev(q)->name ) ++ __string( kind, q->ops->id ) ++ __field( u32, parent ) ++ __field( u32, handle ) + ), + + TP_fast_assign( +- __assign_str(dev, qdisc_dev(q)); ++ __assign_str(dev, qdisc_dev(q)->name); + __assign_str(kind, q->ops->id); + __entry->parent = q->parent; + __entry->handle = q->handle; +@@ -106,14 +106,14 @@ TRACE_EVENT(qdisc_destroy, + TP_ARGS(q), + + TP_STRUCT__entry( +- __string( dev, qdisc_dev(q) ) +- __string( kind, q->ops->id ) +- __field( u32, parent ) +- __field( u32, handle ) ++ __string( dev, qdisc_dev(q)->name ) ++ __string( kind, q->ops->id ) ++ __field( u32, parent ) ++ __field( u32, handle ) + ), + + TP_fast_assign( +- __assign_str(dev, qdisc_dev(q)); ++ __assign_str(dev, qdisc_dev(q)->name); + __assign_str(kind, q->ops->id); + __entry->parent = q->parent; + __entry->handle = q->handle; +-- +2.43.0 + -- 2.47.3