From 4963e560211a23bd6cccf6952205368e2eceef8a Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 27 Apr 2025 19:06:49 -0400 Subject: [PATCH] Fixes for 6.12 Signed-off-by: Sasha Levin --- ...uce-ra_pages-in-blk_apply_bdi_limits.patch | 62 ++++++ ...dd-namespace-to-bpf-internal-symbols.patch | 87 +++++++++ ..._lockend-underflow-in-btrfs_punch_ho.patch | 95 +++++++++ ...rn-eio-on-raid1-block-group-write-po.patch | 149 ++++++++++++++ ...rrect-flush-end-position-calculation.patch | 43 +++++ ...-add-missing-support-for-cpuset_v2_m.patch | 105 ++++++++++ ...c-fix-null-ptr-deref-in-apple_soc_cp.patch | 49 +++++ ...-invalid-return-value-in-.get-callba.patch | 40 ++++ ...nable-by-default-during-compile-test.patch | 98 ++++++++++ .../cpufreq-fix-compile-test-defaults.patch | 80 ++++++++ ...-null-ptr-deref-in-scmi_cpufreq_get_.patch | 51 +++++ ...-null-ptr-deref-in-scpi_cpufreq_get_.patch | 49 +++++ ...-sun50i-prevent-out-of-bounds-access.patch | 81 ++++++++ ...void-warning-about-unused-size_bytes.patch | 42 ++++ ...races-in-mnt_tree_beneath-handling-b.patch | 181 ++++++++++++++++++ ...-an-error-if-vcpu-affinity-is-set-fo.patch | 38 ++++ ...o_xyz-exception-handlers-more-robust.patch | 140 ++++++++++++++ ...h-make-regs_irqs_disabled-more-clear.patch | 46 +++++ .../loongarch-select-arch_use_memtest.patch | 40 ++++ ...ync-driver-specific-behavior-of-mt75.patch | 57 ++++++ ..._eth_soc-net-revise-netsysv3-hardwar.patch | 97 ++++++++++ ...t-lwtunnel-disable-bhs-when-required.patch | 120 ++++++++++++ ...l-ptr-deref-in-mlx5_create_-inner_-t.patch | 55 ++++++ ...c-allocation-after-switch-case-to-pr.patch | 77 ++++++++ queue-6.12/net-phy-leds-fix-memory-leak.patch | 101 ++++++++++ ...ix-a-potential-uaf-in-hfsc_dequeue-t.patch | 51 +++++ ...ix-a-uaf-vulnerability-in-class-hand.patch | 70 +++++++ ...unsupported-pds_core_cmd_fw_control-.patch | 60 ++++++ ...ore-make-wait_context-part-of-q_info.patch | 175 +++++++++++++++++ ...-possible-adminq-overflow-stuck-cond.patch | 73 +++++++ ...unnecessary-check-in-pds_client_admi.patch | 60 ++++++ ...-sampling-counting-events-on-certain.patch | 62 ++++++ ...nction-like-macro-by-static-inline-f.patch | 64 +++++++ ...d-missing-fence.i-after-building-the.patch | 61 ++++++ ...flags-for-scsi_cmnd-that-did-not-com.patch | 50 +++++ ...d-null-check-in-ufshcd_mcq_compl_pen.patch | 42 ++++ ...q-add-null-check-in-ufshcd_mcq_abort.patch | 69 +++++++ queue-6.12/series | 42 ++++ ...plicate-noinline-from-pipe_clear_now.patch | 43 +++++ ...inter-dereference-in-tipc_mon_reinit.patch | 125 ++++++++++++ ...etter-resource-allocation-failure-ha.patch | 94 +++++++++ ...-scsi-fix-vhost_scsi_send_bad_target.patch | 115 +++++++++++ ...host-scsi-fix-vhost_scsi_send_status.patch | 76 ++++++++ 43 files changed, 3315 insertions(+) create mode 100644 queue-6.12/block-never-reduce-ra_pages-in-blk_apply_bdi_limits.patch create mode 100644 queue-6.12/bpf-add-namespace-to-bpf-internal-symbols.patch create mode 100644 queue-6.12/btrfs-avoid-page_lockend-underflow-in-btrfs_punch_ho.patch create mode 100644 queue-6.12/btrfs-zoned-return-eio-on-raid1-block-group-write-po.patch create mode 100644 queue-6.12/ceph-fix-incorrect-flush-end-position-calculation.patch create mode 100644 queue-6.12/cgroup-cpuset-v1-add-missing-support-for-cpuset_v2_m.patch create mode 100644 queue-6.12/cpufreq-apple-soc-fix-null-ptr-deref-in-apple_soc_cp.patch create mode 100644 queue-6.12/cpufreq-cppc-fix-invalid-return-value-in-.get-callba.patch create mode 100644 queue-6.12/cpufreq-do-not-enable-by-default-during-compile-test.patch create mode 100644 queue-6.12/cpufreq-fix-compile-test-defaults.patch create mode 100644 queue-6.12/cpufreq-scmi-fix-null-ptr-deref-in-scmi_cpufreq_get_.patch create mode 100644 queue-6.12/cpufreq-scpi-fix-null-ptr-deref-in-scpi_cpufreq_get_.patch create mode 100644 queue-6.12/cpufreq-sun50i-prevent-out-of-bounds-access.patch create mode 100644 queue-6.12/dma-contiguous-avoid-warning-about-unused-size_bytes.patch create mode 100644 queue-6.12/fix-a-couple-of-races-in-mnt_tree_beneath-handling-b.patch create mode 100644 queue-6.12/iommu-amd-return-an-error-if-vcpu-affinity-is-set-fo.patch create mode 100644 queue-6.12/loongarch-make-do_xyz-exception-handlers-more-robust.patch create mode 100644 queue-6.12/loongarch-make-regs_irqs_disabled-more-clear.patch create mode 100644 queue-6.12/loongarch-select-arch_use_memtest.patch create mode 100644 queue-6.12/net-dsa-mt7530-sync-driver-specific-behavior-of-mt75.patch create mode 100644 queue-6.12/net-ethernet-mtk_eth_soc-net-revise-netsysv3-hardwar.patch create mode 100644 queue-6.12/net-lwtunnel-disable-bhs-when-required.patch create mode 100644 queue-6.12/net-mlx5-fix-null-ptr-deref-in-mlx5_create_-inner_-t.patch create mode 100644 queue-6.12/net-mlx5-move-ttc-allocation-after-switch-case-to-pr.patch create mode 100644 queue-6.12/net-phy-leds-fix-memory-leak.patch create mode 100644 queue-6.12/net_sched-hfsc-fix-a-potential-uaf-in-hfsc_dequeue-t.patch create mode 100644 queue-6.12/net_sched-hfsc-fix-a-uaf-vulnerability-in-class-hand.patch create mode 100644 queue-6.12/pds_core-handle-unsupported-pds_core_cmd_fw_control-.patch create mode 100644 queue-6.12/pds_core-make-wait_context-part-of-q_info.patch create mode 100644 queue-6.12/pds_core-prevent-possible-adminq-overflow-stuck-cond.patch create mode 100644 queue-6.12/pds_core-remove-unnecessary-check-in-pds_client_admi.patch create mode 100644 queue-6.12/perf-x86-fix-non-sampling-counting-events-on-certain.patch create mode 100644 queue-6.12/riscv-replace-function-like-macro-by-static-inline-f.patch create mode 100644 queue-6.12/riscv-uprobes-add-missing-fence.i-after-building-the.patch create mode 100644 queue-6.12/scsi-core-clear-flags-for-scsi_cmnd-that-did-not-com.patch create mode 100644 queue-6.12/scsi-ufs-core-add-null-check-in-ufshcd_mcq_compl_pen.patch create mode 100644 queue-6.12/scsi-ufs-mcq-add-null-check-in-ufshcd_mcq_abort.patch create mode 100644 queue-6.12/splice-remove-duplicate-noinline-from-pipe_clear_now.patch create mode 100644 queue-6.12/tipc-fix-null-pointer-dereference-in-tipc_mon_reinit.patch create mode 100644 queue-6.12/vhost-scsi-add-better-resource-allocation-failure-ha.patch create mode 100644 queue-6.12/vhost-scsi-fix-vhost_scsi_send_bad_target.patch create mode 100644 queue-6.12/vhost-scsi-fix-vhost_scsi_send_status.patch diff --git a/queue-6.12/block-never-reduce-ra_pages-in-blk_apply_bdi_limits.patch b/queue-6.12/block-never-reduce-ra_pages-in-blk_apply_bdi_limits.patch new file mode 100644 index 0000000000..29383c2ded --- /dev/null +++ b/queue-6.12/block-never-reduce-ra_pages-in-blk_apply_bdi_limits.patch @@ -0,0 +1,62 @@ +From 67bf725c92ace4dcc438411b8b9b0a2cb71d0f6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Apr 2025 10:25:21 +0200 +Subject: block: never reduce ra_pages in blk_apply_bdi_limits +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christoph Hellwig + +[ Upstream commit 7b720c720253e2070459420b2628a7b9ee6733b3 ] + +When the user increased the read-ahead size through sysfs this value +currently get lost if the device is reprobe, including on a resume +from suspend. + +As there is no hardware limitation for the read-ahead size there is +no real need to reset it or track a separate hardware limitation +like for max_sectors. + +This restores the pre-atomic queue limit behavior in the sd driver as +sd did not use blk_queue_io_opt and thus never updated the read ahead +size to the value based of the optimal I/O, but changes behavior for +all other drivers. As the new behavior seems useful and sd is the +driver for which the readahead size tweaks are most useful that seems +like a worthwhile trade off. + +Fixes: 804e498e0496 ("sd: convert to the atomic queue limits API") +Reported-by: Holger Hoffstätte +Signed-off-by: Christoph Hellwig +Tested-by: Holger Hoffstätte +Reviewed-by: Hannes Reinecke +Link: https://lore.kernel.org/r/20250424082521.1967286-1-hch@lst.de +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-settings.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/block/blk-settings.c b/block/blk-settings.c +index 7abf034089cd9..1e63e3dd54402 100644 +--- a/block/blk-settings.c ++++ b/block/blk-settings.c +@@ -61,8 +61,14 @@ void blk_apply_bdi_limits(struct backing_dev_info *bdi, + /* + * For read-ahead of large files to be effective, we need to read ahead + * at least twice the optimal I/O size. ++ * ++ * There is no hardware limitation for the read-ahead size and the user ++ * might have increased the read-ahead size through sysfs, so don't ever ++ * decrease it. + */ +- bdi->ra_pages = max(lim->io_opt * 2 / PAGE_SIZE, VM_READAHEAD_PAGES); ++ bdi->ra_pages = max3(bdi->ra_pages, ++ lim->io_opt * 2 / PAGE_SIZE, ++ VM_READAHEAD_PAGES); + bdi->io_pages = lim->max_sectors >> PAGE_SECTORS_SHIFT; + } + +-- +2.39.5 + diff --git a/queue-6.12/bpf-add-namespace-to-bpf-internal-symbols.patch b/queue-6.12/bpf-add-namespace-to-bpf-internal-symbols.patch new file mode 100644 index 0000000000..bcd58c08f4 --- /dev/null +++ b/queue-6.12/bpf-add-namespace-to-bpf-internal-symbols.patch @@ -0,0 +1,87 @@ +From a163f5191fd7e4aa3cbd862ecbbef590a498a54e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Apr 2025 18:45:42 -0700 +Subject: bpf: Add namespace to BPF internal symbols + +From: Alexei Starovoitov + +[ Upstream commit f88886de0927a2adf4c1b4c5c1f1d31d2023ef74 ] + +Add namespace to BPF internal symbols used by light skeleton +to prevent abuse and document with the code their allowed usage. + +Fixes: b1d18a7574d0 ("bpf: Extend sys_bpf commands for bpf_syscall programs.") +Signed-off-by: Alexei Starovoitov +Signed-off-by: Andrii Nakryiko +Acked-by: Kumar Kartikeya Dwivedi +Link: https://lore.kernel.org/bpf/20250425014542.62385-1-alexei.starovoitov@gmail.com +Signed-off-by: Sasha Levin +--- + Documentation/bpf/bpf_devel_QA.rst | 8 ++++++++ + kernel/bpf/preload/bpf_preload_kern.c | 1 + + kernel/bpf/syscall.c | 6 +++--- + 3 files changed, 12 insertions(+), 3 deletions(-) + +diff --git a/Documentation/bpf/bpf_devel_QA.rst b/Documentation/bpf/bpf_devel_QA.rst +index de27e1620821c..0acb4c9b8d90f 100644 +--- a/Documentation/bpf/bpf_devel_QA.rst ++++ b/Documentation/bpf/bpf_devel_QA.rst +@@ -382,6 +382,14 @@ In case of new BPF instructions, once the changes have been accepted + into the Linux kernel, please implement support into LLVM's BPF back + end. See LLVM_ section below for further information. + ++Q: What "BPF_INTERNAL" symbol namespace is for? ++----------------------------------------------- ++A: Symbols exported as BPF_INTERNAL can only be used by BPF infrastructure ++like preload kernel modules with light skeleton. Most symbols outside ++of BPF_INTERNAL are not expected to be used by code outside of BPF either. ++Symbols may lack the designation because they predate the namespaces, ++or due to an oversight. ++ + Stable submission + ================= + +diff --git a/kernel/bpf/preload/bpf_preload_kern.c b/kernel/bpf/preload/bpf_preload_kern.c +index 0c63bc2cd895a..56a81df7a9d7c 100644 +--- a/kernel/bpf/preload/bpf_preload_kern.c ++++ b/kernel/bpf/preload/bpf_preload_kern.c +@@ -89,4 +89,5 @@ static void __exit fini(void) + } + late_initcall(load); + module_exit(fini); ++MODULE_IMPORT_NS("BPF_INTERNAL"); + MODULE_LICENSE("GPL"); +diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c +index 696e5a2cbea2e..b7e6921fb0b9c 100644 +--- a/kernel/bpf/syscall.c ++++ b/kernel/bpf/syscall.c +@@ -1457,7 +1457,7 @@ struct bpf_map *bpf_map_get(u32 ufd) + + return map; + } +-EXPORT_SYMBOL(bpf_map_get); ++EXPORT_SYMBOL_NS(bpf_map_get, "BPF_INTERNAL"); + + struct bpf_map *bpf_map_get_with_uref(u32 ufd) + { +@@ -3223,7 +3223,7 @@ struct bpf_link *bpf_link_get_from_fd(u32 ufd) + bpf_link_inc(link); + return link; + } +-EXPORT_SYMBOL(bpf_link_get_from_fd); ++EXPORT_SYMBOL_NS(bpf_link_get_from_fd, "BPF_INTERNAL"); + + static void bpf_tracing_link_release(struct bpf_link *link) + { +@@ -5853,7 +5853,7 @@ int kern_sys_bpf(int cmd, union bpf_attr *attr, unsigned int size) + return ____bpf_sys_bpf(cmd, attr, size); + } + } +-EXPORT_SYMBOL(kern_sys_bpf); ++EXPORT_SYMBOL_NS(kern_sys_bpf, "BPF_INTERNAL"); + + static const struct bpf_func_proto bpf_sys_bpf_proto = { + .func = bpf_sys_bpf, +-- +2.39.5 + diff --git a/queue-6.12/btrfs-avoid-page_lockend-underflow-in-btrfs_punch_ho.patch b/queue-6.12/btrfs-avoid-page_lockend-underflow-in-btrfs_punch_ho.patch new file mode 100644 index 0000000000..462215d68b --- /dev/null +++ b/queue-6.12/btrfs-avoid-page_lockend-underflow-in-btrfs_punch_ho.patch @@ -0,0 +1,95 @@ +From e2a8ac251fe4292d195c4ad688e978989903bd86 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 Mar 2025 17:46:35 +1030 +Subject: btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range() + +From: Qu Wenruo + +[ Upstream commit bc2dbc4983afedd198490cca043798f57c93e9bf ] + +[BUG] +When running btrfs/004 with 4K fs block size and 64K page size, +sometimes fsstress workload can take 100% CPU for a while, but not long +enough to trigger a 120s hang warning. + +[CAUSE] +When such 100% CPU usage happens, btrfs_punch_hole_lock_range() is +always in the call trace. + +One example when this problem happens, the function +btrfs_punch_hole_lock_range() got the following parameters: + + lock_start = 4096, lockend = 20469 + +Then we calculate @page_lockstart by rounding up lock_start to page +boundary, which is 64K (page size is 64K). + +For @page_lockend, we round down the value towards page boundary, which +result 0. Then since we need to pass an inclusive end to +filemap_range_has_page(), we subtract 1 from the rounded down value, +resulting in (u64)-1. + +In the above case, the range is inside the same page, and we do not even +need to call filemap_range_has_page(), not to mention to call it with +(u64)-1 at the end. + +This behavior will cause btrfs_punch_hole_lock_range() to busy loop +waiting for irrelevant range to have its pages dropped. + +[FIX] +Calculate @page_lockend by just rounding down @lockend, without +decreasing the value by one. So @page_lockend will no longer overflow. + +Then exit early if @page_lockend is no larger than @page_lockstart. +As it means either the range is inside the same page, or the two pages +are adjacent already. + +Finally only decrease @page_lockend when calling filemap_range_has_page(). + +Fixes: 0528476b6ac7 ("btrfs: fix the filemap_range_has_page() call in btrfs_punch_hole_lock_range()") +Reviewed-by: Filipe Manana +Signed-off-by: Qu Wenruo +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/file.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c +index 78c4a3765002e..eaa991e698049 100644 +--- a/fs/btrfs/file.c ++++ b/fs/btrfs/file.c +@@ -2235,15 +2235,20 @@ static void btrfs_punch_hole_lock_range(struct inode *inode, + * will always return true. + * So here we need to do extra page alignment for + * filemap_range_has_page(). ++ * ++ * And do not decrease page_lockend right now, as it can be 0. + */ + const u64 page_lockstart = round_up(lockstart, PAGE_SIZE); +- const u64 page_lockend = round_down(lockend + 1, PAGE_SIZE) - 1; ++ const u64 page_lockend = round_down(lockend + 1, PAGE_SIZE); + + while (1) { + truncate_pagecache_range(inode, lockstart, lockend); + + lock_extent(&BTRFS_I(inode)->io_tree, lockstart, lockend, + cached_state); ++ /* The same page or adjacent pages. */ ++ if (page_lockend <= page_lockstart) ++ break; + /* + * We can't have ordered extents in the range, nor dirty/writeback + * pages, because we have locked the inode's VFS lock in exclusive +@@ -2255,7 +2260,7 @@ static void btrfs_punch_hole_lock_range(struct inode *inode, + * we do, unlock the range and retry. + */ + if (!filemap_range_has_page(inode->i_mapping, page_lockstart, +- page_lockend)) ++ page_lockend - 1)) + break; + + unlock_extent(&BTRFS_I(inode)->io_tree, lockstart, lockend, +-- +2.39.5 + diff --git a/queue-6.12/btrfs-zoned-return-eio-on-raid1-block-group-write-po.patch b/queue-6.12/btrfs-zoned-return-eio-on-raid1-block-group-write-po.patch new file mode 100644 index 0000000000..ffe41611e7 --- /dev/null +++ b/queue-6.12/btrfs-zoned-return-eio-on-raid1-block-group-write-po.patch @@ -0,0 +1,149 @@ +From a48d61bb80315f2677b9bd84d48d458da5cf3048 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Mar 2025 16:04:01 +0100 +Subject: btrfs: zoned: return EIO on RAID1 block group write pointer mismatch +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Johannes Thumshirn + +[ Upstream commit b0c26f47992672661340dd6ea931240213016609 ] + +There was a bug report about a NULL pointer dereference in +__btrfs_add_free_space_zoned() that ultimately happens because a +conversion from the default metadata profile DUP to a RAID1 profile on two +disks. + +The stack trace has the following signature: + + BTRFS error (device sdc): zoned: write pointer offset mismatch of zones in raid1 profile + BUG: kernel NULL pointer dereference, address: 0000000000000058 + #PF: supervisor read access in kernel mode + #PF: error_code(0x0000) - not-present page + PGD 0 P4D 0 + Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI + RIP: 0010:__btrfs_add_free_space_zoned.isra.0+0x61/0x1a0 + RSP: 0018:ffffa236b6f3f6d0 EFLAGS: 00010246 + RAX: 0000000000000000 RBX: ffff96c8132f3400 RCX: 0000000000000001 + RDX: 0000000010000000 RSI: 0000000000000000 RDI: ffff96c8132f3410 + RBP: 0000000010000000 R08: 0000000000000003 R09: 0000000000000000 + R10: 0000000000000000 R11: 00000000ffffffff R12: 0000000000000000 + R13: ffff96c758f65a40 R14: 0000000000000001 R15: 000011aac0000000 + FS: 00007fdab1cb2900(0000) GS:ffff96e60ca00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000000000000058 CR3: 00000001a05ae000 CR4: 0000000000350ef0 + Call Trace: + + ? __die_body.cold+0x19/0x27 + ? page_fault_oops+0x15c/0x2f0 + ? exc_page_fault+0x7e/0x180 + ? asm_exc_page_fault+0x26/0x30 + ? __btrfs_add_free_space_zoned.isra.0+0x61/0x1a0 + btrfs_add_free_space_async_trimmed+0x34/0x40 + btrfs_add_new_free_space+0x107/0x120 + btrfs_make_block_group+0x104/0x2b0 + btrfs_create_chunk+0x977/0xf20 + btrfs_chunk_alloc+0x174/0x510 + ? srso_return_thunk+0x5/0x5f + btrfs_inc_block_group_ro+0x1b1/0x230 + btrfs_relocate_block_group+0x9e/0x410 + btrfs_relocate_chunk+0x3f/0x130 + btrfs_balance+0x8ac/0x12b0 + ? srso_return_thunk+0x5/0x5f + ? srso_return_thunk+0x5/0x5f + ? __kmalloc_cache_noprof+0x14c/0x3e0 + btrfs_ioctl+0x2686/0x2a80 + ? srso_return_thunk+0x5/0x5f + ? ioctl_has_perm.constprop.0.isra.0+0xd2/0x120 + __x64_sys_ioctl+0x97/0xc0 + do_syscall_64+0x82/0x160 + ? srso_return_thunk+0x5/0x5f + ? __memcg_slab_free_hook+0x11a/0x170 + ? srso_return_thunk+0x5/0x5f + ? kmem_cache_free+0x3f0/0x450 + ? srso_return_thunk+0x5/0x5f + ? srso_return_thunk+0x5/0x5f + ? syscall_exit_to_user_mode+0x10/0x210 + ? srso_return_thunk+0x5/0x5f + ? do_syscall_64+0x8e/0x160 + ? sysfs_emit+0xaf/0xc0 + ? srso_return_thunk+0x5/0x5f + ? srso_return_thunk+0x5/0x5f + ? seq_read_iter+0x207/0x460 + ? srso_return_thunk+0x5/0x5f + ? vfs_read+0x29c/0x370 + ? srso_return_thunk+0x5/0x5f + ? srso_return_thunk+0x5/0x5f + ? syscall_exit_to_user_mode+0x10/0x210 + ? srso_return_thunk+0x5/0x5f + ? do_syscall_64+0x8e/0x160 + ? srso_return_thunk+0x5/0x5f + ? exc_page_fault+0x7e/0x180 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + RIP: 0033:0x7fdab1e0ca6d + RSP: 002b:00007ffeb2b60c80 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 + RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fdab1e0ca6d + RDX: 00007ffeb2b60d80 RSI: 00000000c4009420 RDI: 0000000000000003 + RBP: 00007ffeb2b60cd0 R08: 0000000000000000 R09: 0000000000000013 + R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 + R13: 00007ffeb2b6343b R14: 00007ffeb2b60d80 R15: 0000000000000001 + + CR2: 0000000000000058 + ---[ end trace 0000000000000000 ]--- + +The 1st line is the most interesting here: + + BTRFS error (device sdc): zoned: write pointer offset mismatch of zones in raid1 profile + +When a RAID1 block-group is created and a write pointer mismatch between +the disks in the RAID set is detected, btrfs sets the alloc_offset to the +length of the block group marking it as full. Afterwards the code expects +that a balance operation will evacuate the data in this block-group and +repair the problems. + +But before this is possible, the new space of this block-group will be +accounted in the free space cache. But in __btrfs_add_free_space_zoned() +it is being checked if it is a initial creation of a block group and if +not a reclaim decision will be made. But the decision if a block-group's +free space accounting is done for an initial creation depends on if the +size of the added free space is the whole length of the block-group and +the allocation offset is 0. + +But as btrfs_load_block_group_zone_info() sets the allocation offset to +the zone capacity (i.e. marking the block-group as full) this initial +decision is not met, and the space_info pointer in the 'struct +btrfs_block_group' has not yet been assigned. + +Fail creation of the block group and rely on manual user intervention to +re-balance the filesystem. + +Afterwards the filesystem can be unmounted, mounted in degraded mode and +the missing device can be removed after a full balance of the filesystem. + +Reported-by: 西木野羰基 +Link: https://lore.kernel.org/linux-btrfs/CAB_b4sBhDe3tscz=duVyhc9hNE+gu=B8CrgLO152uMyanR8BEA@mail.gmail.com/ +Fixes: b1934cd60695 ("btrfs: zoned: handle broken write pointer on zones") +Reviewed-by: Anand Jain +Signed-off-by: Johannes Thumshirn +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/zoned.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/fs/btrfs/zoned.c b/fs/btrfs/zoned.c +index 2bb7e32ad9458..2603c9d60fd21 100644 +--- a/fs/btrfs/zoned.c ++++ b/fs/btrfs/zoned.c +@@ -1655,7 +1655,6 @@ int btrfs_load_block_group_zone_info(struct btrfs_block_group *cache, bool new) + * stripe. + */ + cache->alloc_offset = cache->zone_capacity; +- ret = 0; + } + + out: +-- +2.39.5 + diff --git a/queue-6.12/ceph-fix-incorrect-flush-end-position-calculation.patch b/queue-6.12/ceph-fix-incorrect-flush-end-position-calculation.patch new file mode 100644 index 0000000000..e50ed392f8 --- /dev/null +++ b/queue-6.12/ceph-fix-incorrect-flush-end-position-calculation.patch @@ -0,0 +1,43 @@ +From b2325601d73fc25d55cd10c6cf5642a34a9a593e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Mar 2025 10:47:11 +0000 +Subject: ceph: Fix incorrect flush end position calculation + +From: David Howells + +[ Upstream commit f452a2204614fc10e2c3b85904c4bd300c2789dc ] + +In ceph, in fill_fscrypt_truncate(), the end flush position is calculated +by: + + loff_t lend = orig_pos + CEPH_FSCRYPT_BLOCK_SHIFT - 1; + +but that's using the block shift not the block size. + +Fix this to use the block size instead. + +Fixes: 5c64737d2536 ("ceph: add truncate size handling support for fscrypt") +Signed-off-by: David Howells +Reviewed-by: Viacheslav Dubeyko +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/inode.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c +index 315ef02f9a3fa..f7875e6f30290 100644 +--- a/fs/ceph/inode.c ++++ b/fs/ceph/inode.c +@@ -2362,7 +2362,7 @@ static int fill_fscrypt_truncate(struct inode *inode, + + /* Try to writeback the dirty pagecaches */ + if (issued & (CEPH_CAP_FILE_BUFFER)) { +- loff_t lend = orig_pos + CEPH_FSCRYPT_BLOCK_SHIFT - 1; ++ loff_t lend = orig_pos + CEPH_FSCRYPT_BLOCK_SIZE - 1; + + ret = filemap_write_and_wait_range(inode->i_mapping, + orig_pos, lend); +-- +2.39.5 + diff --git a/queue-6.12/cgroup-cpuset-v1-add-missing-support-for-cpuset_v2_m.patch b/queue-6.12/cgroup-cpuset-v1-add-missing-support-for-cpuset_v2_m.patch new file mode 100644 index 0000000000..29a435e195 --- /dev/null +++ b/queue-6.12/cgroup-cpuset-v1-add-missing-support-for-cpuset_v2_m.patch @@ -0,0 +1,105 @@ +From a5f2c2c1046894f25eaee90c763ce0b9359e40d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Apr 2025 21:17:51 +0000 +Subject: cgroup/cpuset-v1: Add missing support for cpuset_v2_mode +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: T.J. Mercier + +[ Upstream commit 1bf67c8fdbda21fadd564a12dbe2b13c1ea5eda7 ] + +Android has mounted the v1 cpuset controller using filesystem type +"cpuset" (not "cgroup") since 2015 [1], and depends on the resulting +behavior where the controller name is not added as a prefix for cgroupfs +files. [2] + +Later, a problem was discovered where cpu hotplug onlining did not +affect the cpuset/cpus files, which Android carried an out-of-tree patch +to address for a while. An attempt was made to upstream this patch, but +the recommendation was to use the "cpuset_v2_mode" mount option +instead. [3] + +An effort was made to do so, but this fails with "cgroup: Unknown +parameter 'cpuset_v2_mode'" because commit e1cba4b85daa ("cgroup: Add +mount flag to enable cpuset to use v2 behavior in v1 cgroup") did not +update the special cased cpuset_mount(), and only the cgroup (v1) +filesystem type was updated. + +Add parameter parsing to the cpuset filesystem type so that +cpuset_v2_mode works like the cgroup filesystem type: + +$ mkdir /dev/cpuset +$ mount -t cpuset -ocpuset_v2_mode none /dev/cpuset +$ mount|grep cpuset +none on /dev/cpuset type cgroup (rw,relatime,cpuset,noprefix,cpuset_v2_mode,release_agent=/sbin/cpuset_release_agent) + +[1] https://cs.android.com/android/_/android/platform/system/core/+/b769c8d24fd7be96f8968aa4c80b669525b930d3 +[2] https://cs.android.com/android/platform/superproject/main/+/main:system/core/libprocessgroup/setup/cgroup_map_write.cpp;drc=2dac5d89a0f024a2d0cc46a80ba4ee13472f1681;l=192 +[3] https://lore.kernel.org/lkml/f795f8be-a184-408a-0b5a-553d26061385@redhat.com/T/ + +Fixes: e1cba4b85daa ("cgroup: Add mount flag to enable cpuset to use v2 behavior in v1 cgroup") +Signed-off-by: T.J. Mercier +Acked-by: Waiman Long +Reviewed-by: Kamalesh Babulal +Acked-by: Michal Koutný +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +--- + kernel/cgroup/cgroup.c | 29 +++++++++++++++++++++++++++++ + 1 file changed, 29 insertions(+) + +diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c +index 4378f3eff25d2..e63d6f3b00470 100644 +--- a/kernel/cgroup/cgroup.c ++++ b/kernel/cgroup/cgroup.c +@@ -2339,9 +2339,37 @@ static struct file_system_type cgroup2_fs_type = { + }; + + #ifdef CONFIG_CPUSETS_V1 ++enum cpuset_param { ++ Opt_cpuset_v2_mode, ++}; ++ ++static const struct fs_parameter_spec cpuset_fs_parameters[] = { ++ fsparam_flag ("cpuset_v2_mode", Opt_cpuset_v2_mode), ++ {} ++}; ++ ++static int cpuset_parse_param(struct fs_context *fc, struct fs_parameter *param) ++{ ++ struct cgroup_fs_context *ctx = cgroup_fc2context(fc); ++ struct fs_parse_result result; ++ int opt; ++ ++ opt = fs_parse(fc, cpuset_fs_parameters, param, &result); ++ if (opt < 0) ++ return opt; ++ ++ switch (opt) { ++ case Opt_cpuset_v2_mode: ++ ctx->flags |= CGRP_ROOT_CPUSET_V2_MODE; ++ return 0; ++ } ++ return -EINVAL; ++} ++ + static const struct fs_context_operations cpuset_fs_context_ops = { + .get_tree = cgroup1_get_tree, + .free = cgroup_fs_context_free, ++ .parse_param = cpuset_parse_param, + }; + + /* +@@ -2378,6 +2406,7 @@ static int cpuset_init_fs_context(struct fs_context *fc) + static struct file_system_type cpuset_fs_type = { + .name = "cpuset", + .init_fs_context = cpuset_init_fs_context, ++ .parameters = cpuset_fs_parameters, + .fs_flags = FS_USERNS_MOUNT, + }; + #endif +-- +2.39.5 + diff --git a/queue-6.12/cpufreq-apple-soc-fix-null-ptr-deref-in-apple_soc_cp.patch b/queue-6.12/cpufreq-apple-soc-fix-null-ptr-deref-in-apple_soc_cp.patch new file mode 100644 index 0000000000..e7efc3888b --- /dev/null +++ b/queue-6.12/cpufreq-apple-soc-fix-null-ptr-deref-in-apple_soc_cp.patch @@ -0,0 +1,49 @@ +From 848a51a3abf4766204752908fe6a5b6f163f39ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Apr 2025 20:48:13 +0800 +Subject: cpufreq: apple-soc: Fix null-ptr-deref in + apple_soc_cpufreq_get_rate() + +From: Henry Martin + +[ Upstream commit 9992649f6786921873a9b89dafa5e04d8c5fef2b ] + +cpufreq_cpu_get_raw() can return NULL when the target CPU is not present +in the policy->cpus mask. apple_soc_cpufreq_get_rate() does not check +for this case, which results in a NULL pointer dereference. + +Fixes: 6286bbb40576 ("cpufreq: apple-soc: Add new driver to control Apple SoC CPU P-states") +Signed-off-by: Henry Martin +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/apple-soc-cpufreq.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/cpufreq/apple-soc-cpufreq.c b/drivers/cpufreq/apple-soc-cpufreq.c +index 4dcacab9b4bf2..ddf7dcb3e9b0b 100644 +--- a/drivers/cpufreq/apple-soc-cpufreq.c ++++ b/drivers/cpufreq/apple-soc-cpufreq.c +@@ -103,11 +103,17 @@ static const struct of_device_id apple_soc_cpufreq_of_match[] __maybe_unused = { + + static unsigned int apple_soc_cpufreq_get_rate(unsigned int cpu) + { +- struct cpufreq_policy *policy = cpufreq_cpu_get_raw(cpu); +- struct apple_cpu_priv *priv = policy->driver_data; ++ struct cpufreq_policy *policy; ++ struct apple_cpu_priv *priv; + struct cpufreq_frequency_table *p; + unsigned int pstate; + ++ policy = cpufreq_cpu_get_raw(cpu); ++ if (unlikely(!policy)) ++ return 0; ++ ++ priv = policy->driver_data; ++ + if (priv->info->cur_pstate_mask) { + u64 reg = readq_relaxed(priv->reg_base + APPLE_DVFS_STATUS); + +-- +2.39.5 + diff --git a/queue-6.12/cpufreq-cppc-fix-invalid-return-value-in-.get-callba.patch b/queue-6.12/cpufreq-cppc-fix-invalid-return-value-in-.get-callba.patch new file mode 100644 index 0000000000..afa7209e47 --- /dev/null +++ b/queue-6.12/cpufreq-cppc-fix-invalid-return-value-in-.get-callba.patch @@ -0,0 +1,40 @@ +From 03dbd7c379b8b1cf7583d0bc74f542a260c8c158 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 13 Apr 2025 11:11:42 +0100 +Subject: cpufreq: cppc: Fix invalid return value in .get() callback + +From: Marc Zyngier + +[ Upstream commit 2b8e6b58889c672e1ae3601d9b2b070be4dc2fbc ] + +Returning a negative error code in a function with an unsigned +return type is a pretty bad idea. It is probably worse when the +justification for the change is "our static analisys tool found it". + +Fixes: cf7de25878a1 ("cppc_cpufreq: Fix possible null pointer dereference") +Signed-off-by: Marc Zyngier +Cc: "Rafael J. Wysocki" +Cc: Viresh Kumar +Reviewed-by: Lifeng Zheng +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cppc_cpufreq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/cppc_cpufreq.c b/drivers/cpufreq/cppc_cpufreq.c +index c1cdf0f4d0ddd..36ea181260c7e 100644 +--- a/drivers/cpufreq/cppc_cpufreq.c ++++ b/drivers/cpufreq/cppc_cpufreq.c +@@ -767,7 +767,7 @@ static unsigned int cppc_cpufreq_get_rate(unsigned int cpu) + int ret; + + if (!policy) +- return -ENODEV; ++ return 0; + + cpu_data = policy->driver_data; + +-- +2.39.5 + diff --git a/queue-6.12/cpufreq-do-not-enable-by-default-during-compile-test.patch b/queue-6.12/cpufreq-do-not-enable-by-default-during-compile-test.patch new file mode 100644 index 0000000000..11ea7d029d --- /dev/null +++ b/queue-6.12/cpufreq-do-not-enable-by-default-during-compile-test.patch @@ -0,0 +1,98 @@ +From 1ef2c6a4035c196824ce03e9b182234cb20dd9aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Apr 2025 14:40:06 +0200 +Subject: cpufreq: Do not enable by default during compile testing + +From: Krzysztof Kozlowski + +[ Upstream commit d4f610a9bafdec8e3210789aa19335367da696ea ] + +Enabling the compile test should not cause automatic enabling of all +drivers. + +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Viresh Kumar +Stable-dep-of: a374f28700ab ("cpufreq: fix compile-test defaults") +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/Kconfig.arm | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm +index e67b2326671c9..f6e6066e2e64b 100644 +--- a/drivers/cpufreq/Kconfig.arm ++++ b/drivers/cpufreq/Kconfig.arm +@@ -67,7 +67,7 @@ config ARM_VEXPRESS_SPC_CPUFREQ + config ARM_BRCMSTB_AVS_CPUFREQ + tristate "Broadcom STB AVS CPUfreq driver" + depends on (ARCH_BRCMSTB && !ARM_SCMI_CPUFREQ) || COMPILE_TEST +- default y ++ default ARCH_BRCMSTB + help + Some Broadcom STB SoCs use a co-processor running proprietary firmware + ("AVS") to handle voltage and frequency scaling. This driver provides +@@ -172,7 +172,7 @@ config ARM_RASPBERRYPI_CPUFREQ + config ARM_S3C64XX_CPUFREQ + bool "Samsung S3C64XX" + depends on CPU_S3C6410 || COMPILE_TEST +- default y ++ default CPU_S3C6410 + help + This adds the CPUFreq driver for Samsung S3C6410 SoC. + +@@ -181,7 +181,7 @@ config ARM_S3C64XX_CPUFREQ + config ARM_S5PV210_CPUFREQ + bool "Samsung S5PV210 and S5PC110" + depends on CPU_S5PV210 || COMPILE_TEST +- default y ++ default CPU_S5PV210 + help + This adds the CPUFreq driver for Samsung S5PV210 and + S5PC110 SoCs. +@@ -205,7 +205,7 @@ config ARM_SCMI_CPUFREQ + config ARM_SPEAR_CPUFREQ + bool "SPEAr CPUFreq support" + depends on PLAT_SPEAR || COMPILE_TEST +- default y ++ default PLAT_SPEAR + help + This adds the CPUFreq driver support for SPEAr SOCs. + +@@ -224,7 +224,7 @@ config ARM_TEGRA20_CPUFREQ + tristate "Tegra20/30 CPUFreq support" + depends on ARCH_TEGRA || COMPILE_TEST + depends on CPUFREQ_DT +- default y ++ default ARCH_TEGRA + help + This adds the CPUFreq driver support for Tegra20/30 SOCs. + +@@ -232,7 +232,7 @@ config ARM_TEGRA124_CPUFREQ + bool "Tegra124 CPUFreq support" + depends on ARCH_TEGRA || COMPILE_TEST + depends on CPUFREQ_DT +- default y ++ default ARCH_TEGRA + help + This adds the CPUFreq driver support for Tegra124 SOCs. + +@@ -247,14 +247,14 @@ config ARM_TEGRA194_CPUFREQ + tristate "Tegra194 CPUFreq support" + depends on ARCH_TEGRA_194_SOC || ARCH_TEGRA_234_SOC || (64BIT && COMPILE_TEST) + depends on TEGRA_BPMP +- default y ++ default ARCH_TEGRA + help + This adds CPU frequency driver support for Tegra194 SOCs. + + config ARM_TI_CPUFREQ + bool "Texas Instruments CPUFreq support" + depends on ARCH_OMAP2PLUS || ARCH_K3 || COMPILE_TEST +- default y ++ default ARCH_OMAP2PLUS || ARCH_K3 + help + This driver enables valid OPPs on the running platform based on + values contained within the SoC in use. Enable this in order to +-- +2.39.5 + diff --git a/queue-6.12/cpufreq-fix-compile-test-defaults.patch b/queue-6.12/cpufreq-fix-compile-test-defaults.patch new file mode 100644 index 0000000000..a9c0892f6c --- /dev/null +++ b/queue-6.12/cpufreq-fix-compile-test-defaults.patch @@ -0,0 +1,80 @@ +From 818ac2133bf20a3ba867b99ad274259461998b58 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Apr 2025 09:28:38 +0200 +Subject: cpufreq: fix compile-test defaults + +From: Johan Hovold + +[ Upstream commit a374f28700abd20e8a7d026f89aa26f759445918 ] + +Commit 3f66425a4fc8 ("cpufreq: Enable COMPILE_TEST on Arm drivers") +enabled compile testing of most Arm CPUFreq drivers but left the +existing default values unchanged so that many drivers are enabled by +default whenever COMPILE_TEST is selected. + +This specifically results in the S3C64XX CPUFreq driver being enabled +and initialised during boot of non-S3C64XX platforms with the following +error logged: + + cpufreq: Unable to obtain ARMCLK: -2 + +Commit d4f610a9bafd ("cpufreq: Do not enable by default during compile +testing") recently fixed most of the default values, but two entries +were missed and two could use a more specific default condition. + +Fix the default values for drivers that can be compile tested and that +should be enabled by default when not compile testing. + +Fixes: 3f66425a4fc8 ("cpufreq: Enable COMPILE_TEST on Arm drivers") +Cc: Rob Herring (Arm) +Signed-off-by: Johan Hovold +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/Kconfig.arm | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm +index f6e6066e2e64b..71f4b612dd971 100644 +--- a/drivers/cpufreq/Kconfig.arm ++++ b/drivers/cpufreq/Kconfig.arm +@@ -67,7 +67,7 @@ config ARM_VEXPRESS_SPC_CPUFREQ + config ARM_BRCMSTB_AVS_CPUFREQ + tristate "Broadcom STB AVS CPUfreq driver" + depends on (ARCH_BRCMSTB && !ARM_SCMI_CPUFREQ) || COMPILE_TEST +- default ARCH_BRCMSTB ++ default y if ARCH_BRCMSTB && !ARM_SCMI_CPUFREQ + help + Some Broadcom STB SoCs use a co-processor running proprietary firmware + ("AVS") to handle voltage and frequency scaling. This driver provides +@@ -79,7 +79,7 @@ config ARM_HIGHBANK_CPUFREQ + tristate "Calxeda Highbank-based" + depends on ARCH_HIGHBANK || COMPILE_TEST + depends on CPUFREQ_DT && REGULATOR && PL320_MBOX +- default m ++ default m if ARCH_HIGHBANK + help + This adds the CPUFreq driver for Calxeda Highbank SoC + based boards. +@@ -124,7 +124,7 @@ config ARM_MEDIATEK_CPUFREQ + config ARM_MEDIATEK_CPUFREQ_HW + tristate "MediaTek CPUFreq HW driver" + depends on ARCH_MEDIATEK || COMPILE_TEST +- default m ++ default m if ARCH_MEDIATEK + help + Support for the CPUFreq HW driver. + Some MediaTek chipsets have a HW engine to offload the steps +@@ -247,7 +247,7 @@ config ARM_TEGRA194_CPUFREQ + tristate "Tegra194 CPUFreq support" + depends on ARCH_TEGRA_194_SOC || ARCH_TEGRA_234_SOC || (64BIT && COMPILE_TEST) + depends on TEGRA_BPMP +- default ARCH_TEGRA ++ default ARCH_TEGRA_194_SOC || ARCH_TEGRA_234_SOC + help + This adds CPU frequency driver support for Tegra194 SOCs. + +-- +2.39.5 + diff --git a/queue-6.12/cpufreq-scmi-fix-null-ptr-deref-in-scmi_cpufreq_get_.patch b/queue-6.12/cpufreq-scmi-fix-null-ptr-deref-in-scmi_cpufreq_get_.patch new file mode 100644 index 0000000000..23c87edc24 --- /dev/null +++ b/queue-6.12/cpufreq-scmi-fix-null-ptr-deref-in-scmi_cpufreq_get_.patch @@ -0,0 +1,51 @@ +From e208bda7bec33a624b4a09d2979b6851f1142e3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Apr 2025 23:03:53 +0800 +Subject: cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() + +From: Henry Martin + +[ Upstream commit 484d3f15cc6cbaa52541d6259778e715b2c83c54 ] + +cpufreq_cpu_get_raw() can return NULL when the target CPU is not present +in the policy->cpus mask. scmi_cpufreq_get_rate() does not check for +this case, which results in a NULL pointer dereference. + +Add NULL check after cpufreq_cpu_get_raw() to prevent this issue. + +Fixes: 99d6bdf33877 ("cpufreq: add support for CPU DVFS based on SCMI message protocol") +Signed-off-by: Henry Martin +Acked-by: Sudeep Holla +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/scmi-cpufreq.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c +index 07d6f9a9b7c82..7e7c1613a67c6 100644 +--- a/drivers/cpufreq/scmi-cpufreq.c ++++ b/drivers/cpufreq/scmi-cpufreq.c +@@ -34,11 +34,17 @@ static struct cpufreq_driver scmi_cpufreq_driver; + + static unsigned int scmi_cpufreq_get_rate(unsigned int cpu) + { +- struct cpufreq_policy *policy = cpufreq_cpu_get_raw(cpu); +- struct scmi_data *priv = policy->driver_data; ++ struct cpufreq_policy *policy; ++ struct scmi_data *priv; + unsigned long rate; + int ret; + ++ policy = cpufreq_cpu_get_raw(cpu); ++ if (unlikely(!policy)) ++ return 0; ++ ++ priv = policy->driver_data; ++ + ret = perf_ops->freq_get(ph, priv->domain_id, &rate, false); + if (ret) + return 0; +-- +2.39.5 + diff --git a/queue-6.12/cpufreq-scpi-fix-null-ptr-deref-in-scpi_cpufreq_get_.patch b/queue-6.12/cpufreq-scpi-fix-null-ptr-deref-in-scpi_cpufreq_get_.patch new file mode 100644 index 0000000000..58d61c5dc9 --- /dev/null +++ b/queue-6.12/cpufreq-scpi-fix-null-ptr-deref-in-scpi_cpufreq_get_.patch @@ -0,0 +1,49 @@ +From e5a1954e96fbf9ee8d7a67b0883f4adbff4e8c39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Apr 2025 23:03:54 +0800 +Subject: cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() + +From: Henry Martin + +[ Upstream commit 73b24dc731731edf762f9454552cb3a5b7224949 ] + +cpufreq_cpu_get_raw() can return NULL when the target CPU is not present +in the policy->cpus mask. scpi_cpufreq_get_rate() does not check for +this case, which results in a NULL pointer dereference. + +Fixes: 343a8d17fa8d ("cpufreq: scpi: remove arm_big_little dependency") +Signed-off-by: Henry Martin +Acked-by: Sudeep Holla +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/scpi-cpufreq.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/cpufreq/scpi-cpufreq.c b/drivers/cpufreq/scpi-cpufreq.c +index f2d913a91be9e..a191d9bdf667a 100644 +--- a/drivers/cpufreq/scpi-cpufreq.c ++++ b/drivers/cpufreq/scpi-cpufreq.c +@@ -29,9 +29,16 @@ static struct scpi_ops *scpi_ops; + + static unsigned int scpi_cpufreq_get_rate(unsigned int cpu) + { +- struct cpufreq_policy *policy = cpufreq_cpu_get_raw(cpu); +- struct scpi_data *priv = policy->driver_data; +- unsigned long rate = clk_get_rate(priv->clk); ++ struct cpufreq_policy *policy; ++ struct scpi_data *priv; ++ unsigned long rate; ++ ++ policy = cpufreq_cpu_get_raw(cpu); ++ if (unlikely(!policy)) ++ return 0; ++ ++ priv = policy->driver_data; ++ rate = clk_get_rate(priv->clk); + + return rate / 1000; + } +-- +2.39.5 + diff --git a/queue-6.12/cpufreq-sun50i-prevent-out-of-bounds-access.patch b/queue-6.12/cpufreq-sun50i-prevent-out-of-bounds-access.patch new file mode 100644 index 0000000000..9a4519cfed --- /dev/null +++ b/queue-6.12/cpufreq-sun50i-prevent-out-of-bounds-access.patch @@ -0,0 +1,81 @@ +From ef77b97a936e798903b6fc33eedf337397147a2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Mar 2025 15:55:57 +0000 +Subject: cpufreq: sun50i: prevent out-of-bounds access +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Andre Przywara + +[ Upstream commit 14c8a418159e541d70dbf8fc71225d1623beaf0f ] + +A KASAN enabled kernel reports an out-of-bounds access when handling the +nvmem cell in the sun50i cpufreq driver: +================================================================== +BUG: KASAN: slab-out-of-bounds in sun50i_cpufreq_nvmem_probe+0x180/0x3d4 +Read of size 4 at addr ffff000006bf31e0 by task kworker/u16:1/38 + +This is because the DT specifies the nvmem cell as covering only two +bytes, but we use a u32 pointer to read the value. DTs for other SoCs +indeed specify 4 bytes, so we cannot just shorten the variable to a u16. + +Fortunately nvmem_cell_read() allows to return the length of the nvmem +cell, in bytes, so we can use that information to only access the valid +portion of the data. +To cover multiple cell sizes, use memcpy() to copy the information into a +zeroed u32 buffer, then also make sure we always read the data in little +endian fashion, as this is how the data is stored in the SID efuses. + +Fixes: 6cc4bcceff9a ("cpufreq: sun50i: Refactor speed bin decoding") +Reported-by: Jernej Skrabec +Signed-off-by: Andre Przywara +Reviewed-by: Jernej Škrabec +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/sun50i-cpufreq-nvmem.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/drivers/cpufreq/sun50i-cpufreq-nvmem.c b/drivers/cpufreq/sun50i-cpufreq-nvmem.c +index 293921acec937..0599dbf851ebe 100644 +--- a/drivers/cpufreq/sun50i-cpufreq-nvmem.c ++++ b/drivers/cpufreq/sun50i-cpufreq-nvmem.c +@@ -167,7 +167,9 @@ static int sun50i_cpufreq_get_efuse(void) + struct nvmem_cell *speedbin_nvmem; + const struct of_device_id *match; + struct device *cpu_dev; +- u32 *speedbin; ++ void *speedbin_ptr; ++ u32 speedbin = 0; ++ size_t len; + int ret; + + cpu_dev = get_cpu_device(0); +@@ -190,14 +192,18 @@ static int sun50i_cpufreq_get_efuse(void) + return dev_err_probe(cpu_dev, PTR_ERR(speedbin_nvmem), + "Could not get nvmem cell\n"); + +- speedbin = nvmem_cell_read(speedbin_nvmem, NULL); ++ speedbin_ptr = nvmem_cell_read(speedbin_nvmem, &len); + nvmem_cell_put(speedbin_nvmem); +- if (IS_ERR(speedbin)) +- return PTR_ERR(speedbin); ++ if (IS_ERR(speedbin_ptr)) ++ return PTR_ERR(speedbin_ptr); + +- ret = opp_data->efuse_xlate(*speedbin); ++ if (len <= 4) ++ memcpy(&speedbin, speedbin_ptr, len); ++ speedbin = le32_to_cpu(speedbin); + +- kfree(speedbin); ++ ret = opp_data->efuse_xlate(speedbin); ++ ++ kfree(speedbin_ptr); + + return ret; + }; +-- +2.39.5 + diff --git a/queue-6.12/dma-contiguous-avoid-warning-about-unused-size_bytes.patch b/queue-6.12/dma-contiguous-avoid-warning-about-unused-size_bytes.patch new file mode 100644 index 0000000000..cf4149266c --- /dev/null +++ b/queue-6.12/dma-contiguous-avoid-warning-about-unused-size_bytes.patch @@ -0,0 +1,42 @@ +From a5cfd4d5d412270552dd3454fdb038591006d77b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Apr 2025 17:15:42 +0200 +Subject: dma/contiguous: avoid warning about unused size_bytes + +From: Arnd Bergmann + +[ Upstream commit d7b98ae5221007d3f202746903d4c21c7caf7ea9 ] + +When building with W=1, this variable is unused for configs with +CONFIG_CMA_SIZE_SEL_PERCENTAGE=y: + +kernel/dma/contiguous.c:67:26: error: 'size_bytes' defined but not used [-Werror=unused-const-variable=] + +Change this to a macro to avoid the warning. + +Fixes: c64be2bb1c6e ("drivers: add Contiguous Memory Allocator") +Signed-off-by: Arnd Bergmann +Signed-off-by: Marek Szyprowski +Link: https://lore.kernel.org/r/20250409151557.3890443-1-arnd@kernel.org +Signed-off-by: Sasha Levin +--- + kernel/dma/contiguous.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/kernel/dma/contiguous.c b/kernel/dma/contiguous.c +index 055da410ac71d..8df0dfaaca18e 100644 +--- a/kernel/dma/contiguous.c ++++ b/kernel/dma/contiguous.c +@@ -64,8 +64,7 @@ struct cma *dma_contiguous_default_area; + * Users, who want to set the size of global CMA area for their system + * should use cma= kernel parameter. + */ +-static const phys_addr_t size_bytes __initconst = +- (phys_addr_t)CMA_SIZE_MBYTES * SZ_1M; ++#define size_bytes ((phys_addr_t)CMA_SIZE_MBYTES * SZ_1M) + static phys_addr_t size_cmdline __initdata = -1; + static phys_addr_t base_cmdline __initdata; + static phys_addr_t limit_cmdline __initdata; +-- +2.39.5 + diff --git a/queue-6.12/fix-a-couple-of-races-in-mnt_tree_beneath-handling-b.patch b/queue-6.12/fix-a-couple-of-races-in-mnt_tree_beneath-handling-b.patch new file mode 100644 index 0000000000..b51ad22e25 --- /dev/null +++ b/queue-6.12/fix-a-couple-of-races-in-mnt_tree_beneath-handling-b.patch @@ -0,0 +1,181 @@ +From d5d9161745301925bef266f51db781325cacb271 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Apr 2025 02:30:34 +0100 +Subject: fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount() + +From: Al Viro + +[ Upstream commit 0d039eac6e5950f9d1ecc9e410c2fd1feaeab3b6 ] + +Normally do_lock_mount(path, _) is locking a mountpoint pinned by +*path and at the time when matching unlock_mount() unlocks that +location it is still pinned by the same thing. + +Unfortunately, for 'beneath' case it's no longer that simple - +the object being locked is not the one *path points to. It's the +mountpoint of path->mnt. The thing is, without sufficient locking +->mnt_parent may change under us and none of the locks are held +at that point. The rules are + * mount_lock stabilizes m->mnt_parent for any mount m. + * namespace_sem stabilizes m->mnt_parent, provided that +m is mounted. + * if either of the above holds and refcount of m is positive, +we are guaranteed the same for refcount of m->mnt_parent. + +namespace_sem nests inside inode_lock(), so do_lock_mount() has +to take inode_lock() before grabbing namespace_sem. It does +recheck that path->mnt is still mounted in the same place after +getting namespace_sem, and it does take care to pin the dentry. +It is needed, since otherwise we might end up with racing mount --move +(or umount) happening while we were getting locks; in that case +dentry would no longer be a mountpoint and could've been evicted +on memory pressure along with its inode - not something you want +when grabbing lock on that inode. + +However, pinning a dentry is not enough - the matching mount is +also pinned only by the fact that path->mnt is mounted on top it +and at that point we are not holding any locks whatsoever, so +the same kind of races could end up with all references to +that mount gone just as we are about to enter inode_lock(). +If that happens, we are left with filesystem being shut down while +we are holding a dentry reference on it; results are not pretty. + +What we need to do is grab both dentry and mount at the same time; +that makes inode_lock() safe *and* avoids the problem with fs getting +shut down under us. After taking namespace_sem we verify that +path->mnt is still mounted (which stabilizes its ->mnt_parent) and +check that it's still mounted at the same place. From that point +on to the matching namespace_unlock() we are guaranteed that +mount/dentry pair we'd grabbed are also pinned by being the mountpoint +of path->mnt, so we can quietly drop both the dentry reference (as +the current code does) and mnt one - it's OK to do under namespace_sem, +since we are not dropping the final refs. + +That solves the problem on do_lock_mount() side; unlock_mount() +also has one, since dentry is guaranteed to stay pinned only until +the namespace_unlock(). That's easy to fix - just have inode_unlock() +done earlier, while it's still pinned by mp->m_dentry. + +Fixes: 6ac392815628 "fs: allow to mount beneath top mount" # v6.5+ +Signed-off-by: Al Viro +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/namespace.c | 69 ++++++++++++++++++++++++++------------------------ + 1 file changed, 36 insertions(+), 33 deletions(-) + +diff --git a/fs/namespace.c b/fs/namespace.c +index f898de3a6f705..bd601ab26e781 100644 +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -2596,56 +2596,62 @@ static struct mountpoint *do_lock_mount(struct path *path, bool beneath) + struct vfsmount *mnt = path->mnt; + struct dentry *dentry; + struct mountpoint *mp = ERR_PTR(-ENOENT); ++ struct path under = {}; + + for (;;) { +- struct mount *m; ++ struct mount *m = real_mount(mnt); + + if (beneath) { +- m = real_mount(mnt); ++ path_put(&under); + read_seqlock_excl(&mount_lock); +- dentry = dget(m->mnt_mountpoint); ++ under.mnt = mntget(&m->mnt_parent->mnt); ++ under.dentry = dget(m->mnt_mountpoint); + read_sequnlock_excl(&mount_lock); ++ dentry = under.dentry; + } else { + dentry = path->dentry; + } + + inode_lock(dentry->d_inode); +- if (unlikely(cant_mount(dentry))) { +- inode_unlock(dentry->d_inode); +- goto out; +- } +- + namespace_lock(); + +- if (beneath && (!is_mounted(mnt) || m->mnt_mountpoint != dentry)) { ++ if (unlikely(cant_mount(dentry) || !is_mounted(mnt))) ++ break; // not to be mounted on ++ ++ if (beneath && unlikely(m->mnt_mountpoint != dentry || ++ &m->mnt_parent->mnt != under.mnt)) { + namespace_unlock(); + inode_unlock(dentry->d_inode); +- goto out; ++ continue; // got moved + } + + mnt = lookup_mnt(path); +- if (likely(!mnt)) ++ if (unlikely(mnt)) { ++ namespace_unlock(); ++ inode_unlock(dentry->d_inode); ++ path_put(path); ++ path->mnt = mnt; ++ path->dentry = dget(mnt->mnt_root); ++ continue; // got overmounted ++ } ++ mp = get_mountpoint(dentry); ++ if (IS_ERR(mp)) + break; +- +- namespace_unlock(); +- inode_unlock(dentry->d_inode); +- if (beneath) +- dput(dentry); +- path_put(path); +- path->mnt = mnt; +- path->dentry = dget(mnt->mnt_root); +- } +- +- mp = get_mountpoint(dentry); +- if (IS_ERR(mp)) { +- namespace_unlock(); +- inode_unlock(dentry->d_inode); ++ if (beneath) { ++ /* ++ * @under duplicates the references that will stay ++ * at least until namespace_unlock(), so the path_put() ++ * below is safe (and OK to do under namespace_lock - ++ * we are not dropping the final references here). ++ */ ++ path_put(&under); ++ } ++ return mp; + } +- +-out: ++ namespace_unlock(); ++ inode_unlock(dentry->d_inode); + if (beneath) +- dput(dentry); +- ++ path_put(&under); + return mp; + } + +@@ -2656,14 +2662,11 @@ static inline struct mountpoint *lock_mount(struct path *path) + + static void unlock_mount(struct mountpoint *where) + { +- struct dentry *dentry = where->m_dentry; +- ++ inode_unlock(where->m_dentry->d_inode); + read_seqlock_excl(&mount_lock); + put_mountpoint(where); + read_sequnlock_excl(&mount_lock); +- + namespace_unlock(); +- inode_unlock(dentry->d_inode); + } + + static int graft_tree(struct mount *mnt, struct mount *p, struct mountpoint *mp) +-- +2.39.5 + diff --git a/queue-6.12/iommu-amd-return-an-error-if-vcpu-affinity-is-set-fo.patch b/queue-6.12/iommu-amd-return-an-error-if-vcpu-affinity-is-set-fo.patch new file mode 100644 index 0000000000..95dc82a4c2 --- /dev/null +++ b/queue-6.12/iommu-amd-return-an-error-if-vcpu-affinity-is-set-fo.patch @@ -0,0 +1,38 @@ +From 935ad5e264836ec8670a695868c970a96f78a5a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Apr 2025 12:38:20 -0700 +Subject: iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE + +From: Sean Christopherson + +[ Upstream commit 07172206a26dcf3f0bf7c3ecaadd4242b008ea54 ] + +Return -EINVAL instead of success if amd_ir_set_vcpu_affinity() is +invoked without use_vapic; lying to KVM about whether or not the IRTE was +configured to post IRQs is all kinds of bad. + +Fixes: d98de49a53e4 ("iommu/amd: Enable vAPIC interrupt remapping mode by default") +Signed-off-by: Sean Christopherson +Message-ID: <20250404193923.1413163-6-seanjc@google.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd/iommu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c +index a24a97a2c6469..f61e48f237324 100644 +--- a/drivers/iommu/amd/iommu.c ++++ b/drivers/iommu/amd/iommu.c +@@ -3660,7 +3660,7 @@ static int amd_ir_set_vcpu_affinity(struct irq_data *data, void *vcpu_info) + * we should not modify the IRTE + */ + if (!dev_data || !dev_data->use_vapic) +- return 0; ++ return -EINVAL; + + ir_data->cfg = irqd_cfg(data); + pi_data->ir_data = ir_data; +-- +2.39.5 + diff --git a/queue-6.12/loongarch-make-do_xyz-exception-handlers-more-robust.patch b/queue-6.12/loongarch-make-do_xyz-exception-handlers-more-robust.patch new file mode 100644 index 0000000000..827ea7df6e --- /dev/null +++ b/queue-6.12/loongarch-make-do_xyz-exception-handlers-more-robust.patch @@ -0,0 +1,140 @@ +From f27737dafbaae18e31f0ee4080df9df61d2886d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Apr 2025 20:15:41 +0800 +Subject: LoongArch: Make do_xyz() exception handlers more robust + +From: Tiezhu Yang + +[ Upstream commit cc73cc6bcdb5f959670e3ff9abdc62461452ddff ] + +Currently, interrupts need to be disabled before single-step mode is +set, it requires that CSR_PRMD_PIE be cleared in save_local_irqflag() +which is called by setup_singlestep(), this is reasonable. + +But in the first kprobe breakpoint exception, if the irq is enabled at +the beginning of do_bp(), it will not be disabled at the end of do_bp() +due to the CSR_PRMD_PIE has been cleared in save_local_irqflag(). So for +this case, it may corrupt exception context when restoring the exception +after do_bp() in handle_bp(), this is not reasonable. + +In order to restore exception safely in handle_bp(), it needs to ensure +the irq is disabled at the end of do_bp(), so just add a local variable +to record the original interrupt status in the parent context, then use +it as the check condition to enable and disable irq in do_bp(). + +While at it, do the similar thing for other do_xyz() exception handlers +to make them more robust. + +Fixes: 6d4cc40fb5f5 ("LoongArch: Add kprobes support") +Suggested-by: Jinyang He +Suggested-by: Huacai Chen +Co-developed-by: Tianyang Zhang +Signed-off-by: Tianyang Zhang +Signed-off-by: Tiezhu Yang +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/kernel/traps.c | 20 ++++++++++++-------- + 1 file changed, 12 insertions(+), 8 deletions(-) + +diff --git a/arch/loongarch/kernel/traps.c b/arch/loongarch/kernel/traps.c +index c57b4134f3e84..00424b7e34c15 100644 +--- a/arch/loongarch/kernel/traps.c ++++ b/arch/loongarch/kernel/traps.c +@@ -553,9 +553,10 @@ asmlinkage void noinstr do_ale(struct pt_regs *regs) + die_if_kernel("Kernel ale access", regs); + force_sig_fault(SIGBUS, BUS_ADRALN, (void __user *)regs->csr_badvaddr); + #else ++ bool pie = regs_irqs_disabled(regs); + unsigned int *pc; + +- if (regs->csr_prmd & CSR_PRMD_PIE) ++ if (!pie) + local_irq_enable(); + + perf_sw_event(PERF_COUNT_SW_ALIGNMENT_FAULTS, 1, regs, regs->csr_badvaddr); +@@ -582,7 +583,7 @@ asmlinkage void noinstr do_ale(struct pt_regs *regs) + die_if_kernel("Kernel ale access", regs); + force_sig_fault(SIGBUS, BUS_ADRALN, (void __user *)regs->csr_badvaddr); + out: +- if (regs->csr_prmd & CSR_PRMD_PIE) ++ if (!pie) + local_irq_disable(); + #endif + irqentry_exit(regs, state); +@@ -614,12 +615,13 @@ static void bug_handler(struct pt_regs *regs) + asmlinkage void noinstr do_bce(struct pt_regs *regs) + { + bool user = user_mode(regs); ++ bool pie = regs_irqs_disabled(regs); + unsigned long era = exception_era(regs); + u64 badv = 0, lower = 0, upper = ULONG_MAX; + union loongarch_instruction insn; + irqentry_state_t state = irqentry_enter(regs); + +- if (regs->csr_prmd & CSR_PRMD_PIE) ++ if (!pie) + local_irq_enable(); + + current->thread.trap_nr = read_csr_excode(); +@@ -685,7 +687,7 @@ asmlinkage void noinstr do_bce(struct pt_regs *regs) + force_sig_bnderr((void __user *)badv, (void __user *)lower, (void __user *)upper); + + out: +- if (regs->csr_prmd & CSR_PRMD_PIE) ++ if (!pie) + local_irq_disable(); + + irqentry_exit(regs, state); +@@ -703,11 +705,12 @@ asmlinkage void noinstr do_bce(struct pt_regs *regs) + asmlinkage void noinstr do_bp(struct pt_regs *regs) + { + bool user = user_mode(regs); ++ bool pie = regs_irqs_disabled(regs); + unsigned int opcode, bcode; + unsigned long era = exception_era(regs); + irqentry_state_t state = irqentry_enter(regs); + +- if (regs->csr_prmd & CSR_PRMD_PIE) ++ if (!pie) + local_irq_enable(); + + if (__get_inst(&opcode, (u32 *)era, user)) +@@ -773,7 +776,7 @@ asmlinkage void noinstr do_bp(struct pt_regs *regs) + } + + out: +- if (regs->csr_prmd & CSR_PRMD_PIE) ++ if (!pie) + local_irq_disable(); + + irqentry_exit(regs, state); +@@ -1008,6 +1011,7 @@ static void init_restore_lbt(void) + + asmlinkage void noinstr do_lbt(struct pt_regs *regs) + { ++ bool pie = regs_irqs_disabled(regs); + irqentry_state_t state = irqentry_enter(regs); + + /* +@@ -1017,7 +1021,7 @@ asmlinkage void noinstr do_lbt(struct pt_regs *regs) + * (including the user using 'MOVGR2GCSR' to turn on TM, which + * will not trigger the BTE), we need to check PRMD first. + */ +- if (regs->csr_prmd & CSR_PRMD_PIE) ++ if (!pie) + local_irq_enable(); + + if (!cpu_has_lbt) { +@@ -1031,7 +1035,7 @@ asmlinkage void noinstr do_lbt(struct pt_regs *regs) + preempt_enable(); + + out: +- if (regs->csr_prmd & CSR_PRMD_PIE) ++ if (!pie) + local_irq_disable(); + + irqentry_exit(regs, state); +-- +2.39.5 + diff --git a/queue-6.12/loongarch-make-regs_irqs_disabled-more-clear.patch b/queue-6.12/loongarch-make-regs_irqs_disabled-more-clear.patch new file mode 100644 index 0000000000..67791642c7 --- /dev/null +++ b/queue-6.12/loongarch-make-regs_irqs_disabled-more-clear.patch @@ -0,0 +1,46 @@ +From 39ae3c0bda2a9065d498ba3d661816cd644d2411 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Apr 2025 20:15:41 +0800 +Subject: LoongArch: Make regs_irqs_disabled() more clear + +From: Tiezhu Yang + +[ Upstream commit bb0511d59db9b3e40c8d51f0d151ccd0fd44071d ] + +In the current code, the definition of regs_irqs_disabled() is actually +"!(regs->csr_prmd & CSR_CRMD_IE)" because arch_irqs_disabled_flags() is +defined as "!(flags & CSR_CRMD_IE)", it looks a little strange. + +Define regs_irqs_disabled() as !(regs->csr_prmd & CSR_PRMD_PIE) directly +to make it more clear, no functional change. + +While at it, the return value of regs_irqs_disabled() is true or false, +so change its type to reflect that and also make it always inline. + +Fixes: 803b0fc5c3f2 ("LoongArch: Add process management") +Signed-off-by: Tiezhu Yang +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/include/asm/ptrace.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/loongarch/include/asm/ptrace.h b/arch/loongarch/include/asm/ptrace.h +index f3ddaed9ef7f0..a5b63c84f8541 100644 +--- a/arch/loongarch/include/asm/ptrace.h ++++ b/arch/loongarch/include/asm/ptrace.h +@@ -33,9 +33,9 @@ struct pt_regs { + unsigned long __last[]; + } __aligned(8); + +-static inline int regs_irqs_disabled(struct pt_regs *regs) ++static __always_inline bool regs_irqs_disabled(struct pt_regs *regs) + { +- return arch_irqs_disabled_flags(regs->csr_prmd); ++ return !(regs->csr_prmd & CSR_PRMD_PIE); + } + + static inline unsigned long kernel_stack_pointer(struct pt_regs *regs) +-- +2.39.5 + diff --git a/queue-6.12/loongarch-select-arch_use_memtest.patch b/queue-6.12/loongarch-select-arch_use_memtest.patch new file mode 100644 index 0000000000..6d8703bdac --- /dev/null +++ b/queue-6.12/loongarch-select-arch_use_memtest.patch @@ -0,0 +1,40 @@ +From 816672d78a1a3123a6aa6977a0f6dbd94c47b447 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Apr 2025 20:15:22 +0800 +Subject: LoongArch: Select ARCH_USE_MEMTEST + +From: Yuli Wang + +[ Upstream commit fb8e9f59d6f292c3d9fea6c155c22ea5fc3053ab ] + +As of commit dce44566192e ("mm/memtest: add ARCH_USE_MEMTEST"), +architectures must select ARCH_USE_MEMTESET to enable CONFIG_MEMTEST. + +Commit 628c3bb40e9a ("LoongArch: Add boot and setup routines") added +support for early_memtest but did not select ARCH_USE_MEMTESET. + +Fixes: 628c3bb40e9a ("LoongArch: Add boot and setup routines") +Tested-by: Erpeng Xu +Tested-by: Yuli Wang +Signed-off-by: Yuli Wang +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/loongarch/Kconfig b/arch/loongarch/Kconfig +index fe9f895138dba..a7a1f15bcc672 100644 +--- a/arch/loongarch/Kconfig ++++ b/arch/loongarch/Kconfig +@@ -68,6 +68,7 @@ config LOONGARCH + select ARCH_SUPPORTS_NUMA_BALANCING + select ARCH_USE_BUILTIN_BSWAP + select ARCH_USE_CMPXCHG_LOCKREF ++ select ARCH_USE_MEMTEST + select ARCH_USE_QUEUED_RWLOCKS + select ARCH_USE_QUEUED_SPINLOCKS + select ARCH_WANT_DEFAULT_BPF_JIT +-- +2.39.5 + diff --git a/queue-6.12/net-dsa-mt7530-sync-driver-specific-behavior-of-mt75.patch b/queue-6.12/net-dsa-mt7530-sync-driver-specific-behavior-of-mt75.patch new file mode 100644 index 0000000000..ea197e8183 --- /dev/null +++ b/queue-6.12/net-dsa-mt7530-sync-driver-specific-behavior-of-mt75.patch @@ -0,0 +1,57 @@ +From c5055c1500dfff6df87e8701ffcc36956990a0ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Apr 2025 04:10:20 +0100 +Subject: net: dsa: mt7530: sync driver-specific behavior of MT7531 variants + +From: Daniel Golle + +[ Upstream commit 497041d763016c2e8314d2f6a329a9b77c3797ca ] + +MT7531 standalone and MMIO variants found in MT7988 and EN7581 share +most basic properties. Despite that, assisted_learning_on_cpu_port and +mtu_enforcement_ingress were only applied for MT7531 but not for MT7988 +or EN7581, causing the expected issues on MMIO devices. + +Apply both settings equally also for MT7988 and EN7581 by moving both +assignments form mt7531_setup() to mt7531_setup_common(). + +This fixes unwanted flooding of packets due to unknown unicast +during DA lookup, as well as issues with heterogenous MTU settings. + +Fixes: 7f54cc9772ce ("net: dsa: mt7530: split-off common parts from mt7531_setup") +Signed-off-by: Daniel Golle +Reviewed-by: Chester A. Unal +Link: https://patch.msgid.link/89ed7ec6d4fa0395ac53ad2809742bb1ce61ed12.1745290867.git.daniel@makrotopia.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mt7530.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c +index abc979fbb45d1..93bf085a61d39 100644 +--- a/drivers/net/dsa/mt7530.c ++++ b/drivers/net/dsa/mt7530.c +@@ -2540,6 +2540,9 @@ mt7531_setup_common(struct dsa_switch *ds) + struct mt7530_priv *priv = ds->priv; + int ret, i; + ++ ds->assisted_learning_on_cpu_port = true; ++ ds->mtu_enforcement_ingress = true; ++ + mt753x_trap_frames(priv); + + /* Enable and reset MIB counters */ +@@ -2687,9 +2690,6 @@ mt7531_setup(struct dsa_switch *ds) + if (ret) + return ret; + +- ds->assisted_learning_on_cpu_port = true; +- ds->mtu_enforcement_ingress = true; +- + return 0; + } + +-- +2.39.5 + diff --git a/queue-6.12/net-ethernet-mtk_eth_soc-net-revise-netsysv3-hardwar.patch b/queue-6.12/net-ethernet-mtk_eth_soc-net-revise-netsysv3-hardwar.patch new file mode 100644 index 0000000000..569ae87188 --- /dev/null +++ b/queue-6.12/net-ethernet-mtk_eth_soc-net-revise-netsysv3-hardwar.patch @@ -0,0 +1,97 @@ +From a556ca40e090407eee0f58287122a6f57153ce3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Apr 2025 17:41:07 +0100 +Subject: net: ethernet: mtk_eth_soc: net: revise NETSYSv3 hardware + configuration + +From: Bo-Cun Chen + +[ Upstream commit 491ef1117c56476f199b481f8c68820fe4c3a7c2 ] + +Change hardware configuration for the NETSYSv3. + - Enable PSE dummy page mechanism for the GDM1/2/3 + - Enable PSE drop mechanism when the WDMA Rx ring full + - Enable PSE no-drop mechanism for packets from the WDMA Tx + - Correct PSE free drop threshold + - Correct PSE CDMA high threshold + +Fixes: 1953f134a1a8b ("net: ethernet: mtk_eth_soc: add NETSYS_V3 version support") +Signed-off-by: Bo-Cun Chen +Signed-off-by: Daniel Golle +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/b71f8fd9d4bb69c646c4d558f9331dd965068606.1744907886.git.daniel@makrotopia.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mediatek/mtk_eth_soc.c | 24 +++++++++++++++++---- + drivers/net/ethernet/mediatek/mtk_eth_soc.h | 10 ++++++++- + 2 files changed, 29 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +index d408dcda76d79..223aee1af4430 100644 +--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c ++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +@@ -3997,11 +3997,27 @@ static int mtk_hw_init(struct mtk_eth *eth, bool reset) + mtk_w32(eth, 0x21021000, MTK_FE_INT_GRP); + + if (mtk_is_netsys_v3_or_greater(eth)) { +- /* PSE should not drop port1, port8 and port9 packets */ +- mtk_w32(eth, 0x00000302, PSE_DROP_CFG); ++ /* PSE dummy page mechanism */ ++ mtk_w32(eth, PSE_DUMMY_WORK_GDM(1) | PSE_DUMMY_WORK_GDM(2) | ++ PSE_DUMMY_WORK_GDM(3) | DUMMY_PAGE_THR, PSE_DUMY_REQ); ++ ++ /* PSE free buffer drop threshold */ ++ mtk_w32(eth, 0x00600009, PSE_IQ_REV(8)); ++ ++ /* PSE should not drop port8, port9 and port13 packets from ++ * WDMA Tx ++ */ ++ mtk_w32(eth, 0x00002300, PSE_DROP_CFG); ++ ++ /* PSE should drop packets to port8, port9 and port13 on WDMA Rx ++ * ring full ++ */ ++ mtk_w32(eth, 0x00002300, PSE_PPE_DROP(0)); ++ mtk_w32(eth, 0x00002300, PSE_PPE_DROP(1)); ++ mtk_w32(eth, 0x00002300, PSE_PPE_DROP(2)); + + /* GDM and CDM Threshold */ +- mtk_w32(eth, 0x00000707, MTK_CDMW0_THRES); ++ mtk_w32(eth, 0x08000707, MTK_CDMW0_THRES); + mtk_w32(eth, 0x00000077, MTK_CDMW1_THRES); + + /* Disable GDM1 RX CRC stripping */ +@@ -4018,7 +4034,7 @@ static int mtk_hw_init(struct mtk_eth *eth, bool reset) + mtk_w32(eth, 0x00000300, PSE_DROP_CFG); + + /* PSE should drop packets to port 8/9 on WDMA Rx ring full */ +- mtk_w32(eth, 0x00000300, PSE_PPE0_DROP); ++ mtk_w32(eth, 0x00000300, PSE_PPE_DROP(0)); + + /* PSE Free Queue Flow Control */ + mtk_w32(eth, 0x01fa01f4, PSE_FQFC_CFG2); +diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.h b/drivers/net/ethernet/mediatek/mtk_eth_soc.h +index 8d7b6818d8601..0570623e569d5 100644 +--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h ++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h +@@ -151,7 +151,15 @@ + #define PSE_FQFC_CFG1 0x100 + #define PSE_FQFC_CFG2 0x104 + #define PSE_DROP_CFG 0x108 +-#define PSE_PPE0_DROP 0x110 ++#define PSE_PPE_DROP(x) (0x110 + ((x) * 0x4)) ++ ++/* PSE Last FreeQ Page Request Control */ ++#define PSE_DUMY_REQ 0x10C ++/* PSE_DUMY_REQ is not a typo but actually called like that also in ++ * MediaTek's datasheet ++ */ ++#define PSE_DUMMY_WORK_GDM(x) BIT(16 + (x)) ++#define DUMMY_PAGE_THR 0x1 + + /* PSE Input Queue Reservation Register*/ + #define PSE_IQ_REV(x) (0x140 + (((x) - 1) << 2)) +-- +2.39.5 + diff --git a/queue-6.12/net-lwtunnel-disable-bhs-when-required.patch b/queue-6.12/net-lwtunnel-disable-bhs-when-required.patch new file mode 100644 index 0000000000..db8bc1a31f --- /dev/null +++ b/queue-6.12/net-lwtunnel-disable-bhs-when-required.patch @@ -0,0 +1,120 @@ +From 5bca71eb9aa4642edc25df7f023a20eeb7670ae4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Apr 2025 18:07:16 +0200 +Subject: net: lwtunnel: disable BHs when required + +From: Justin Iurman + +[ Upstream commit c03a49f3093a4903c8a93c8b5c9a297b5343b169 ] + +In lwtunnel_{output|xmit}(), dev_xmit_recursion() may be called in +preemptible scope for PREEMPT kernels. This patch disables BHs before +calling dev_xmit_recursion(). BHs are re-enabled only at the end, since +we must ensure the same CPU is used for both dev_xmit_recursion_inc() +and dev_xmit_recursion_dec() (and any other recursion levels in some +cases) in order to maintain valid per-cpu counters. + +Reported-by: Alexei Starovoitov +Closes: https://lore.kernel.org/netdev/CAADnVQJFWn3dBFJtY+ci6oN1pDFL=TzCmNbRgey7MdYxt_AP2g@mail.gmail.com/ +Reported-by: Eduard Zingerman +Closes: https://lore.kernel.org/netdev/m2h62qwf34.fsf@gmail.com/ +Fixes: 986ffb3a57c5 ("net: lwtunnel: fix recursion loops") +Signed-off-by: Justin Iurman +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250416160716.8823-1-justin.iurman@uliege.be +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/core/lwtunnel.c | 26 ++++++++++++++++++++------ + 1 file changed, 20 insertions(+), 6 deletions(-) + +diff --git a/net/core/lwtunnel.c b/net/core/lwtunnel.c +index 4417a18b3e951..f63586c9ce021 100644 +--- a/net/core/lwtunnel.c ++++ b/net/core/lwtunnel.c +@@ -332,6 +332,8 @@ int lwtunnel_output(struct net *net, struct sock *sk, struct sk_buff *skb) + struct dst_entry *dst; + int ret; + ++ local_bh_disable(); ++ + if (dev_xmit_recursion()) { + net_crit_ratelimited("%s(): recursion limit reached on datapath\n", + __func__); +@@ -347,8 +349,10 @@ int lwtunnel_output(struct net *net, struct sock *sk, struct sk_buff *skb) + lwtstate = dst->lwtstate; + + if (lwtstate->type == LWTUNNEL_ENCAP_NONE || +- lwtstate->type > LWTUNNEL_ENCAP_MAX) +- return 0; ++ lwtstate->type > LWTUNNEL_ENCAP_MAX) { ++ ret = 0; ++ goto out; ++ } + + ret = -EOPNOTSUPP; + rcu_read_lock(); +@@ -363,11 +367,13 @@ int lwtunnel_output(struct net *net, struct sock *sk, struct sk_buff *skb) + if (ret == -EOPNOTSUPP) + goto drop; + +- return ret; ++ goto out; + + drop: + kfree_skb(skb); + ++out: ++ local_bh_enable(); + return ret; + } + EXPORT_SYMBOL_GPL(lwtunnel_output); +@@ -379,6 +385,8 @@ int lwtunnel_xmit(struct sk_buff *skb) + struct dst_entry *dst; + int ret; + ++ local_bh_disable(); ++ + if (dev_xmit_recursion()) { + net_crit_ratelimited("%s(): recursion limit reached on datapath\n", + __func__); +@@ -395,8 +403,10 @@ int lwtunnel_xmit(struct sk_buff *skb) + lwtstate = dst->lwtstate; + + if (lwtstate->type == LWTUNNEL_ENCAP_NONE || +- lwtstate->type > LWTUNNEL_ENCAP_MAX) +- return 0; ++ lwtstate->type > LWTUNNEL_ENCAP_MAX) { ++ ret = 0; ++ goto out; ++ } + + ret = -EOPNOTSUPP; + rcu_read_lock(); +@@ -411,11 +421,13 @@ int lwtunnel_xmit(struct sk_buff *skb) + if (ret == -EOPNOTSUPP) + goto drop; + +- return ret; ++ goto out; + + drop: + kfree_skb(skb); + ++out: ++ local_bh_enable(); + return ret; + } + EXPORT_SYMBOL_GPL(lwtunnel_xmit); +@@ -427,6 +439,8 @@ int lwtunnel_input(struct sk_buff *skb) + struct dst_entry *dst; + int ret; + ++ DEBUG_NET_WARN_ON_ONCE(!in_softirq()); ++ + if (dev_xmit_recursion()) { + net_crit_ratelimited("%s(): recursion limit reached on datapath\n", + __func__); +-- +2.39.5 + diff --git a/queue-6.12/net-mlx5-fix-null-ptr-deref-in-mlx5_create_-inner_-t.patch b/queue-6.12/net-mlx5-fix-null-ptr-deref-in-mlx5_create_-inner_-t.patch new file mode 100644 index 0000000000..b585351f13 --- /dev/null +++ b/queue-6.12/net-mlx5-fix-null-ptr-deref-in-mlx5_create_-inner_-t.patch @@ -0,0 +1,55 @@ +From 7727926946d02a75fbf2599f0c57c60a360d7b26 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Apr 2025 10:38:13 +0800 +Subject: net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table() + +From: Henry Martin + +[ Upstream commit 91037037ee3d611ce17f39d75f79c7de394b122a ] + +Add NULL check for mlx5_get_flow_namespace() returns in +mlx5_create_inner_ttc_table() and mlx5_create_ttc_table() to prevent +NULL pointer dereference. + +Fixes: 137f3d50ad2a ("net/mlx5: Support matching on l4_type for ttc_table") +Signed-off-by: Henry Martin +Reviewed-by: Mark Bloch +Reviewed-by: Michal Swiatkowski +Link: https://patch.msgid.link/20250418023814.71789-2-bsdhenrymartin@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c +index 9f13cea164465..510879e1ba30e 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c +@@ -636,6 +636,11 @@ struct mlx5_ttc_table *mlx5_create_inner_ttc_table(struct mlx5_core_dev *dev, + } + + ns = mlx5_get_flow_namespace(dev, params->ns_type); ++ if (!ns) { ++ kvfree(ttc); ++ return ERR_PTR(-EOPNOTSUPP); ++ } ++ + groups = use_l4_type ? &inner_ttc_groups[TTC_GROUPS_USE_L4_TYPE] : + &inner_ttc_groups[TTC_GROUPS_DEFAULT]; + +@@ -709,6 +714,11 @@ struct mlx5_ttc_table *mlx5_create_ttc_table(struct mlx5_core_dev *dev, + } + + ns = mlx5_get_flow_namespace(dev, params->ns_type); ++ if (!ns) { ++ kvfree(ttc); ++ return ERR_PTR(-EOPNOTSUPP); ++ } ++ + groups = use_l4_type ? &ttc_groups[TTC_GROUPS_USE_L4_TYPE] : + &ttc_groups[TTC_GROUPS_DEFAULT]; + +-- +2.39.5 + diff --git a/queue-6.12/net-mlx5-move-ttc-allocation-after-switch-case-to-pr.patch b/queue-6.12/net-mlx5-move-ttc-allocation-after-switch-case-to-pr.patch new file mode 100644 index 0000000000..b4012aa97e --- /dev/null +++ b/queue-6.12/net-mlx5-move-ttc-allocation-after-switch-case-to-pr.patch @@ -0,0 +1,77 @@ +From 537e7dfbcb658d6d22b9c654dd8fde6971896c8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Apr 2025 10:38:14 +0800 +Subject: net/mlx5: Move ttc allocation after switch case to prevent leaks + +From: Henry Martin + +[ Upstream commit fa8fd315127ca48c65e7e6692a84ffcf3d07168e ] + +Relocate the memory allocation for ttc table after the switch statement +that validates params->ns_type in both mlx5_create_inner_ttc_table() and +mlx5_create_ttc_table(). This ensures memory is only allocated after +confirming valid input, eliminating potential memory leaks when invalid +ns_type cases occur. + +Fixes: 137f3d50ad2a ("net/mlx5: Support matching on l4_type for ttc_table") +Signed-off-by: Henry Martin +Reviewed-by: Michal Swiatkowski +Reviewed-by: Mark Bloch +Link: https://patch.msgid.link/20250418023814.71789-3-bsdhenrymartin@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c +index 510879e1ba30e..43b2216bc0a22 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c +@@ -618,10 +618,6 @@ struct mlx5_ttc_table *mlx5_create_inner_ttc_table(struct mlx5_core_dev *dev, + bool use_l4_type; + int err; + +- ttc = kvzalloc(sizeof(*ttc), GFP_KERNEL); +- if (!ttc) +- return ERR_PTR(-ENOMEM); +- + switch (params->ns_type) { + case MLX5_FLOW_NAMESPACE_PORT_SEL: + use_l4_type = MLX5_CAP_GEN_2(dev, pcc_ifa2) && +@@ -635,6 +631,10 @@ struct mlx5_ttc_table *mlx5_create_inner_ttc_table(struct mlx5_core_dev *dev, + return ERR_PTR(-EINVAL); + } + ++ ttc = kvzalloc(sizeof(*ttc), GFP_KERNEL); ++ if (!ttc) ++ return ERR_PTR(-ENOMEM); ++ + ns = mlx5_get_flow_namespace(dev, params->ns_type); + if (!ns) { + kvfree(ttc); +@@ -696,10 +696,6 @@ struct mlx5_ttc_table *mlx5_create_ttc_table(struct mlx5_core_dev *dev, + bool use_l4_type; + int err; + +- ttc = kvzalloc(sizeof(*ttc), GFP_KERNEL); +- if (!ttc) +- return ERR_PTR(-ENOMEM); +- + switch (params->ns_type) { + case MLX5_FLOW_NAMESPACE_PORT_SEL: + use_l4_type = MLX5_CAP_GEN_2(dev, pcc_ifa2) && +@@ -713,6 +709,10 @@ struct mlx5_ttc_table *mlx5_create_ttc_table(struct mlx5_core_dev *dev, + return ERR_PTR(-EINVAL); + } + ++ ttc = kvzalloc(sizeof(*ttc), GFP_KERNEL); ++ if (!ttc) ++ return ERR_PTR(-ENOMEM); ++ + ns = mlx5_get_flow_namespace(dev, params->ns_type); + if (!ns) { + kvfree(ttc); +-- +2.39.5 + diff --git a/queue-6.12/net-phy-leds-fix-memory-leak.patch b/queue-6.12/net-phy-leds-fix-memory-leak.patch new file mode 100644 index 0000000000..4bd938c34c --- /dev/null +++ b/queue-6.12/net-phy-leds-fix-memory-leak.patch @@ -0,0 +1,101 @@ +From 2bf915d4fd3010bfef0e583cc01e058cc5e765f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Apr 2025 11:25:56 +0800 +Subject: net: phy: leds: fix memory leak + +From: Qingfang Deng + +[ Upstream commit b7f0ee992adf601aa00c252418266177eb7ac2bc ] + +A network restart test on a router led to an out-of-memory condition, +which was traced to a memory leak in the PHY LED trigger code. + +The root cause is misuse of the devm API. The registration function +(phy_led_triggers_register) is called from phy_attach_direct, not +phy_probe, and the unregister function (phy_led_triggers_unregister) +is called from phy_detach, not phy_remove. This means the register and +unregister functions can be called multiple times for the same PHY +device, but devm-allocated memory is not freed until the driver is +unbound. + +This also prevents kmemleak from detecting the leak, as the devm API +internally stores the allocated pointer. + +Fix this by replacing devm_kzalloc/devm_kcalloc with standard +kzalloc/kcalloc, and add the corresponding kfree calls in the unregister +path. + +Fixes: 3928ee6485a3 ("net: phy: leds: Add support for "link" trigger") +Fixes: 2e0bc452f472 ("net: phy: leds: add support for led triggers on phy link state change") +Signed-off-by: Hao Guan +Signed-off-by: Qingfang Deng +Reviewed-by: Andrew Lunn +Link: https://patch.msgid.link/20250417032557.2929427-1-dqfext@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/phy_led_triggers.c | 23 +++++++++++++---------- + 1 file changed, 13 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/phy/phy_led_triggers.c b/drivers/net/phy/phy_led_triggers.c +index f550576eb9dae..6f9d8da76c4df 100644 +--- a/drivers/net/phy/phy_led_triggers.c ++++ b/drivers/net/phy/phy_led_triggers.c +@@ -91,9 +91,8 @@ int phy_led_triggers_register(struct phy_device *phy) + if (!phy->phy_num_led_triggers) + return 0; + +- phy->led_link_trigger = devm_kzalloc(&phy->mdio.dev, +- sizeof(*phy->led_link_trigger), +- GFP_KERNEL); ++ phy->led_link_trigger = kzalloc(sizeof(*phy->led_link_trigger), ++ GFP_KERNEL); + if (!phy->led_link_trigger) { + err = -ENOMEM; + goto out_clear; +@@ -103,10 +102,9 @@ int phy_led_triggers_register(struct phy_device *phy) + if (err) + goto out_free_link; + +- phy->phy_led_triggers = devm_kcalloc(&phy->mdio.dev, +- phy->phy_num_led_triggers, +- sizeof(struct phy_led_trigger), +- GFP_KERNEL); ++ phy->phy_led_triggers = kcalloc(phy->phy_num_led_triggers, ++ sizeof(struct phy_led_trigger), ++ GFP_KERNEL); + if (!phy->phy_led_triggers) { + err = -ENOMEM; + goto out_unreg_link; +@@ -127,11 +125,11 @@ int phy_led_triggers_register(struct phy_device *phy) + out_unreg: + while (i--) + phy_led_trigger_unregister(&phy->phy_led_triggers[i]); +- devm_kfree(&phy->mdio.dev, phy->phy_led_triggers); ++ kfree(phy->phy_led_triggers); + out_unreg_link: + phy_led_trigger_unregister(phy->led_link_trigger); + out_free_link: +- devm_kfree(&phy->mdio.dev, phy->led_link_trigger); ++ kfree(phy->led_link_trigger); + phy->led_link_trigger = NULL; + out_clear: + phy->phy_num_led_triggers = 0; +@@ -145,8 +143,13 @@ void phy_led_triggers_unregister(struct phy_device *phy) + + for (i = 0; i < phy->phy_num_led_triggers; i++) + phy_led_trigger_unregister(&phy->phy_led_triggers[i]); ++ kfree(phy->phy_led_triggers); ++ phy->phy_led_triggers = NULL; + +- if (phy->led_link_trigger) ++ if (phy->led_link_trigger) { + phy_led_trigger_unregister(phy->led_link_trigger); ++ kfree(phy->led_link_trigger); ++ phy->led_link_trigger = NULL; ++ } + } + EXPORT_SYMBOL_GPL(phy_led_triggers_unregister); +-- +2.39.5 + diff --git a/queue-6.12/net_sched-hfsc-fix-a-potential-uaf-in-hfsc_dequeue-t.patch b/queue-6.12/net_sched-hfsc-fix-a-potential-uaf-in-hfsc_dequeue-t.patch new file mode 100644 index 0000000000..9f2f3b4e89 --- /dev/null +++ b/queue-6.12/net_sched-hfsc-fix-a-potential-uaf-in-hfsc_dequeue-t.patch @@ -0,0 +1,51 @@ +From 797b228574ec0e9cd1393dd15c7ddfb08e3bc0ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Apr 2025 11:47:31 -0700 +Subject: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too + +From: Cong Wang + +[ Upstream commit 6ccbda44e2cc3d26fd22af54c650d6d5d801addf ] + +Similarly to the previous patch, we need to safe guard hfsc_dequeue() +too. But for this one, we don't have a reliable reproducer. + +Fixes: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ("Linux-2.6.12-rc2") +Reported-by: Gerrard Tai +Signed-off-by: Cong Wang +Reviewed-by: Jamal Hadi Salim +Link: https://patch.msgid.link/20250417184732.943057-3-xiyou.wangcong@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sched/sch_hfsc.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c +index e730d3f791c24..5bb4ab9941d6e 100644 +--- a/net/sched/sch_hfsc.c ++++ b/net/sched/sch_hfsc.c +@@ -1637,10 +1637,16 @@ hfsc_dequeue(struct Qdisc *sch) + if (cl->qdisc->q.qlen != 0) { + /* update ed */ + next_len = qdisc_peek_len(cl->qdisc); +- if (realtime) +- update_ed(cl, next_len); +- else +- update_d(cl, next_len); ++ /* Check queue length again since some qdisc implementations ++ * (e.g., netem/codel) might empty the queue during the peek ++ * operation. ++ */ ++ if (cl->qdisc->q.qlen != 0) { ++ if (realtime) ++ update_ed(cl, next_len); ++ else ++ update_d(cl, next_len); ++ } + } else { + /* the class becomes passive */ + eltree_remove(cl); +-- +2.39.5 + diff --git a/queue-6.12/net_sched-hfsc-fix-a-uaf-vulnerability-in-class-hand.patch b/queue-6.12/net_sched-hfsc-fix-a-uaf-vulnerability-in-class-hand.patch new file mode 100644 index 0000000000..db5fe3d7d2 --- /dev/null +++ b/queue-6.12/net_sched-hfsc-fix-a-uaf-vulnerability-in-class-hand.patch @@ -0,0 +1,70 @@ +From d5871b466473acf86ea5906229465edaeb97f55f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Apr 2025 11:47:30 -0700 +Subject: net_sched: hfsc: Fix a UAF vulnerability in class handling + +From: Cong Wang + +[ Upstream commit 3df275ef0a6ae181e8428a6589ef5d5231e58b5c ] + +This patch fixes a Use-After-Free vulnerability in the HFSC qdisc class +handling. The issue occurs due to a time-of-check/time-of-use condition +in hfsc_change_class() when working with certain child qdiscs like netem +or codel. + +The vulnerability works as follows: +1. hfsc_change_class() checks if a class has packets (q.qlen != 0) +2. It then calls qdisc_peek_len(), which for certain qdiscs (e.g., + codel, netem) might drop packets and empty the queue +3. The code continues assuming the queue is still non-empty, adding + the class to vttree +4. This breaks HFSC scheduler assumptions that only non-empty classes + are in vttree +5. Later, when the class is destroyed, this can lead to a Use-After-Free + +The fix adds a second queue length check after qdisc_peek_len() to verify +the queue wasn't emptied. + +Fixes: 21f4d5cc25ec ("net_sched/hfsc: fix curve activation in hfsc_change_class()") +Reported-by: Gerrard Tai +Reviewed-by: Konstantin Khlebnikov +Signed-off-by: Cong Wang +Reviewed-by: Jamal Hadi Salim +Link: https://patch.msgid.link/20250417184732.943057-2-xiyou.wangcong@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sched/sch_hfsc.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c +index c287bf8423b47..e730d3f791c24 100644 +--- a/net/sched/sch_hfsc.c ++++ b/net/sched/sch_hfsc.c +@@ -958,6 +958,7 @@ hfsc_change_class(struct Qdisc *sch, u32 classid, u32 parentid, + + if (cl != NULL) { + int old_flags; ++ int len = 0; + + if (parentid) { + if (cl->cl_parent && +@@ -988,9 +989,13 @@ hfsc_change_class(struct Qdisc *sch, u32 classid, u32 parentid, + if (usc != NULL) + hfsc_change_usc(cl, usc, cur_time); + ++ if (cl->qdisc->q.qlen != 0) ++ len = qdisc_peek_len(cl->qdisc); ++ /* Check queue length again since some qdisc implementations ++ * (e.g., netem/codel) might empty the queue during the peek ++ * operation. ++ */ + if (cl->qdisc->q.qlen != 0) { +- int len = qdisc_peek_len(cl->qdisc); +- + if (cl->cl_flags & HFSC_RSC) { + if (old_flags & HFSC_RSC) + update_ed(cl, len); +-- +2.39.5 + diff --git a/queue-6.12/pds_core-handle-unsupported-pds_core_cmd_fw_control-.patch b/queue-6.12/pds_core-handle-unsupported-pds_core_cmd_fw_control-.patch new file mode 100644 index 0000000000..40415c349b --- /dev/null +++ b/queue-6.12/pds_core-handle-unsupported-pds_core_cmd_fw_control-.patch @@ -0,0 +1,60 @@ +From 9dedc33d3f82da028398c3bb5cd02d9158d49cd8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Apr 2025 10:46:04 -0700 +Subject: pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result + +From: Brett Creeley + +[ Upstream commit 2567daad69cd1107fc0ec29b1615f110d7cf7385 ] + +If the FW doesn't support the PDS_CORE_CMD_FW_CONTROL command +the driver might at the least print garbage and at the worst +crash when the user runs the "devlink dev info" devlink command. + +This happens because the stack variable fw_list is not 0 +initialized which results in fw_list.num_fw_slots being a +garbage value from the stack. Then the driver tries to access +fw_list.fw_names[i] with i >= ARRAY_SIZE and runs off the end +of the array. + +Fix this by initializing the fw_list and by not failing +completely if the devcmd fails because other useful information +is printed via devlink dev info even if the devcmd fails. + +Fixes: 45d76f492938 ("pds_core: set up device and adminq") +Signed-off-by: Brett Creeley +Reviewed-by: Simon Horman +Signed-off-by: Shannon Nelson +Reviewed-by: Jacob Keller +Link: https://patch.msgid.link/20250421174606.3892-3-shannon.nelson@amd.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/pds_core/devlink.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/amd/pds_core/devlink.c b/drivers/net/ethernet/amd/pds_core/devlink.c +index 44971e71991ff..ca23cde385e67 100644 +--- a/drivers/net/ethernet/amd/pds_core/devlink.c ++++ b/drivers/net/ethernet/amd/pds_core/devlink.c +@@ -102,7 +102,7 @@ int pdsc_dl_info_get(struct devlink *dl, struct devlink_info_req *req, + .fw_control.opcode = PDS_CORE_CMD_FW_CONTROL, + .fw_control.oper = PDS_CORE_FW_GET_LIST, + }; +- struct pds_core_fw_list_info fw_list; ++ struct pds_core_fw_list_info fw_list = {}; + struct pdsc *pdsc = devlink_priv(dl); + union pds_core_dev_comp comp; + char buf[32]; +@@ -115,8 +115,6 @@ int pdsc_dl_info_get(struct devlink *dl, struct devlink_info_req *req, + if (!err) + memcpy_fromio(&fw_list, pdsc->cmd_regs->data, sizeof(fw_list)); + mutex_unlock(&pdsc->devcmd_lock); +- if (err && err != -EIO) +- return err; + + listlen = min(fw_list.num_fw_slots, ARRAY_SIZE(fw_list.fw_names)); + for (i = 0; i < listlen; i++) { +-- +2.39.5 + diff --git a/queue-6.12/pds_core-make-wait_context-part-of-q_info.patch b/queue-6.12/pds_core-make-wait_context-part-of-q_info.patch new file mode 100644 index 0000000000..32a64a9427 --- /dev/null +++ b/queue-6.12/pds_core-make-wait_context-part-of-q_info.patch @@ -0,0 +1,175 @@ +From 7752728cf2a7b211e1e1e063287b3be09cf5e248 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Apr 2025 10:46:06 -0700 +Subject: pds_core: make wait_context part of q_info + +From: Shannon Nelson + +[ Upstream commit 3f77c3dfffc7063428b100c4945ca2a7a8680380 ] + +Make the wait_context a full part of the q_info struct rather +than a stack variable that goes away after pdsc_adminq_post() +is done so that the context is still available after the wait +loop has given up. + +There was a case where a slow development firmware caused +the adminq request to time out, but then later the FW finally +finished the request and sent the interrupt. The handler tried +to complete_all() the completion context that had been created +on the stack in pdsc_adminq_post() but no longer existed. +This caused bad pointer usage, kernel crashes, and much wailing +and gnashing of teeth. + +Fixes: 01ba61b55b20 ("pds_core: Add adminq processing and commands") +Reviewed-by: Simon Horman +Signed-off-by: Shannon Nelson +Reviewed-by: Jacob Keller +Link: https://patch.msgid.link/20250421174606.3892-5-shannon.nelson@amd.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/pds_core/adminq.c | 36 +++++++++------------- + drivers/net/ethernet/amd/pds_core/core.c | 4 ++- + drivers/net/ethernet/amd/pds_core/core.h | 2 +- + 3 files changed, 18 insertions(+), 24 deletions(-) + +diff --git a/drivers/net/ethernet/amd/pds_core/adminq.c b/drivers/net/ethernet/amd/pds_core/adminq.c +index c83a0a80d5334..506f682d15c10 100644 +--- a/drivers/net/ethernet/amd/pds_core/adminq.c ++++ b/drivers/net/ethernet/amd/pds_core/adminq.c +@@ -5,11 +5,6 @@ + + #include "core.h" + +-struct pdsc_wait_context { +- struct pdsc_qcq *qcq; +- struct completion wait_completion; +-}; +- + static int pdsc_process_notifyq(struct pdsc_qcq *qcq) + { + union pds_core_notifyq_comp *comp; +@@ -109,10 +104,10 @@ void pdsc_process_adminq(struct pdsc_qcq *qcq) + q_info = &q->info[q->tail_idx]; + q->tail_idx = (q->tail_idx + 1) & (q->num_descs - 1); + +- /* Copy out the completion data */ +- memcpy(q_info->dest, comp, sizeof(*comp)); +- +- complete_all(&q_info->wc->wait_completion); ++ if (!completion_done(&q_info->completion)) { ++ memcpy(q_info->dest, comp, sizeof(*comp)); ++ complete(&q_info->completion); ++ } + + if (cq->tail_idx == cq->num_descs - 1) + cq->done_color = !cq->done_color; +@@ -162,8 +157,7 @@ irqreturn_t pdsc_adminq_isr(int irq, void *data) + static int __pdsc_adminq_post(struct pdsc *pdsc, + struct pdsc_qcq *qcq, + union pds_core_adminq_cmd *cmd, +- union pds_core_adminq_comp *comp, +- struct pdsc_wait_context *wc) ++ union pds_core_adminq_comp *comp) + { + struct pdsc_queue *q = &qcq->q; + struct pdsc_q_info *q_info; +@@ -205,9 +199,9 @@ static int __pdsc_adminq_post(struct pdsc *pdsc, + /* Post the request */ + index = q->head_idx; + q_info = &q->info[index]; +- q_info->wc = wc; + q_info->dest = comp; + memcpy(q_info->desc, cmd, sizeof(*cmd)); ++ reinit_completion(&q_info->completion); + + dev_dbg(pdsc->dev, "head_idx %d tail_idx %d\n", + q->head_idx, q->tail_idx); +@@ -231,16 +225,13 @@ int pdsc_adminq_post(struct pdsc *pdsc, + union pds_core_adminq_comp *comp, + bool fast_poll) + { +- struct pdsc_wait_context wc = { +- .wait_completion = +- COMPLETION_INITIALIZER_ONSTACK(wc.wait_completion), +- }; + unsigned long poll_interval = 1; + unsigned long poll_jiffies; + unsigned long time_limit; + unsigned long time_start; + unsigned long time_done; + unsigned long remaining; ++ struct completion *wc; + int err = 0; + int index; + +@@ -250,20 +241,19 @@ int pdsc_adminq_post(struct pdsc *pdsc, + return -ENXIO; + } + +- wc.qcq = &pdsc->adminqcq; +- index = __pdsc_adminq_post(pdsc, &pdsc->adminqcq, cmd, comp, &wc); ++ index = __pdsc_adminq_post(pdsc, &pdsc->adminqcq, cmd, comp); + if (index < 0) { + err = index; + goto err_out; + } + ++ wc = &pdsc->adminqcq.q.info[index].completion; + time_start = jiffies; + time_limit = time_start + HZ * pdsc->devcmd_timeout; + do { + /* Timeslice the actual wait to catch IO errors etc early */ + poll_jiffies = msecs_to_jiffies(poll_interval); +- remaining = wait_for_completion_timeout(&wc.wait_completion, +- poll_jiffies); ++ remaining = wait_for_completion_timeout(wc, poll_jiffies); + if (remaining) + break; + +@@ -292,9 +282,11 @@ int pdsc_adminq_post(struct pdsc *pdsc, + dev_dbg(pdsc->dev, "%s: elapsed %d msecs\n", + __func__, jiffies_to_msecs(time_done - time_start)); + +- /* Check the results */ +- if (time_after_eq(time_done, time_limit)) ++ /* Check the results and clear an un-completed timeout */ ++ if (time_after_eq(time_done, time_limit) && !completion_done(wc)) { + err = -ETIMEDOUT; ++ complete(wc); ++ } + + dev_dbg(pdsc->dev, "read admin queue completion idx %d:\n", index); + dynamic_hex_dump("comp ", DUMP_PREFIX_OFFSET, 16, 1, +diff --git a/drivers/net/ethernet/amd/pds_core/core.c b/drivers/net/ethernet/amd/pds_core/core.c +index 4830292d5f879..3c60d4cf9d0e1 100644 +--- a/drivers/net/ethernet/amd/pds_core/core.c ++++ b/drivers/net/ethernet/amd/pds_core/core.c +@@ -167,8 +167,10 @@ static void pdsc_q_map(struct pdsc_queue *q, void *base, dma_addr_t base_pa) + q->base = base; + q->base_pa = base_pa; + +- for (i = 0, cur = q->info; i < q->num_descs; i++, cur++) ++ for (i = 0, cur = q->info; i < q->num_descs; i++, cur++) { + cur->desc = base + (i * q->desc_size); ++ init_completion(&cur->completion); ++ } + } + + static void pdsc_cq_map(struct pdsc_cq *cq, void *base, dma_addr_t base_pa) +diff --git a/drivers/net/ethernet/amd/pds_core/core.h b/drivers/net/ethernet/amd/pds_core/core.h +index 543097983bf60..ec637dc4327a5 100644 +--- a/drivers/net/ethernet/amd/pds_core/core.h ++++ b/drivers/net/ethernet/amd/pds_core/core.h +@@ -96,7 +96,7 @@ struct pdsc_q_info { + unsigned int bytes; + unsigned int nbufs; + struct pdsc_buf_info bufs[PDS_CORE_MAX_FRAGS]; +- struct pdsc_wait_context *wc; ++ struct completion completion; + void *dest; + }; + +-- +2.39.5 + diff --git a/queue-6.12/pds_core-prevent-possible-adminq-overflow-stuck-cond.patch b/queue-6.12/pds_core-prevent-possible-adminq-overflow-stuck-cond.patch new file mode 100644 index 0000000000..1b4601dc2b --- /dev/null +++ b/queue-6.12/pds_core-prevent-possible-adminq-overflow-stuck-cond.patch @@ -0,0 +1,73 @@ +From debe1b33d6e9011de401ebd1983bc86beadbcbab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Apr 2025 10:46:03 -0700 +Subject: pds_core: Prevent possible adminq overflow/stuck condition + +From: Brett Creeley + +[ Upstream commit d9e2f070d8af60f2c8c02b2ddf0a9e90b4e9220c ] + +The pds_core's adminq is protected by the adminq_lock, which prevents +more than 1 command to be posted onto it at any one time. This makes it +so the client drivers cannot simultaneously post adminq commands. +However, the completions happen in a different context, which means +multiple adminq commands can be posted sequentially and all waiting +on completion. + +On the FW side, the backing adminq request queue is only 16 entries +long and the retry mechanism and/or overflow/stuck prevention is +lacking. This can cause the adminq to get stuck, so commands are no +longer processed and completions are no longer sent by the FW. + +As an initial fix, prevent more than 16 outstanding adminq commands so +there's no way to cause the adminq from getting stuck. This works +because the backing adminq request queue will never have more than 16 +pending adminq commands, so it will never overflow. This is done by +reducing the adminq depth to 16. + +Fixes: 45d76f492938 ("pds_core: set up device and adminq") +Reviewed-by: Michal Swiatkowski +Reviewed-by: Simon Horman +Signed-off-by: Brett Creeley +Signed-off-by: Shannon Nelson +Reviewed-by: Jacob Keller +Link: https://patch.msgid.link/20250421174606.3892-2-shannon.nelson@amd.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/pds_core/core.c | 5 +---- + drivers/net/ethernet/amd/pds_core/core.h | 2 +- + 2 files changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/amd/pds_core/core.c b/drivers/net/ethernet/amd/pds_core/core.c +index 536635e577279..4830292d5f879 100644 +--- a/drivers/net/ethernet/amd/pds_core/core.c ++++ b/drivers/net/ethernet/amd/pds_core/core.c +@@ -325,10 +325,7 @@ static int pdsc_core_init(struct pdsc *pdsc) + size_t sz; + int err; + +- /* Scale the descriptor ring length based on number of CPUs and VFs */ +- numdescs = max_t(int, PDSC_ADMINQ_MIN_LENGTH, num_online_cpus()); +- numdescs += 2 * pci_sriov_get_totalvfs(pdsc->pdev); +- numdescs = roundup_pow_of_two(numdescs); ++ numdescs = PDSC_ADMINQ_MAX_LENGTH; + err = pdsc_qcq_alloc(pdsc, PDS_CORE_QTYPE_ADMINQ, 0, "adminq", + PDS_CORE_QCQ_F_CORE | PDS_CORE_QCQ_F_INTR, + numdescs, +diff --git a/drivers/net/ethernet/amd/pds_core/core.h b/drivers/net/ethernet/amd/pds_core/core.h +index 14522d6d5f86b..543097983bf60 100644 +--- a/drivers/net/ethernet/amd/pds_core/core.h ++++ b/drivers/net/ethernet/amd/pds_core/core.h +@@ -16,7 +16,7 @@ + + #define PDSC_WATCHDOG_SECS 5 + #define PDSC_QUEUE_NAME_MAX_SZ 16 +-#define PDSC_ADMINQ_MIN_LENGTH 16 /* must be a power of two */ ++#define PDSC_ADMINQ_MAX_LENGTH 16 /* must be a power of two */ + #define PDSC_NOTIFYQ_LENGTH 64 /* must be a power of two */ + #define PDSC_TEARDOWN_RECOVERY false + #define PDSC_TEARDOWN_REMOVING true +-- +2.39.5 + diff --git a/queue-6.12/pds_core-remove-unnecessary-check-in-pds_client_admi.patch b/queue-6.12/pds_core-remove-unnecessary-check-in-pds_client_admi.patch new file mode 100644 index 0000000000..723ca4c26f --- /dev/null +++ b/queue-6.12/pds_core-remove-unnecessary-check-in-pds_client_admi.patch @@ -0,0 +1,60 @@ +From a0b34106a7875e3b4551c775755074189fd2c259 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Apr 2025 10:46:05 -0700 +Subject: pds_core: Remove unnecessary check in pds_client_adminq_cmd() + +From: Brett Creeley + +[ Upstream commit f9559d818205a4a0b9cd87181ef46e101ea11157 ] + +When the pds_core driver was first created there were some race +conditions around using the adminq, especially for client drivers. +To reduce the possibility of a race condition there's a check +against pf->state in pds_client_adminq_cmd(). This is problematic +for a couple of reasons: + +1. The PDSC_S_INITING_DRIVER bit is set during probe, but not + cleared until after everything in probe is complete, which + includes creating the auxiliary devices. For pds_fwctl this + means it can't make any adminq commands until after pds_core's + probe is complete even though the adminq is fully up by the + time pds_fwctl's auxiliary device is created. + +2. The race conditions around using the adminq have been fixed + and this path is already protected against client drivers + calling pds_client_adminq_cmd() if the adminq isn't ready, + i.e. see pdsc_adminq_post() -> pdsc_adminq_inc_if_up(). + +Fix this by removing the pf->state check in pds_client_adminq_cmd() +because invalid accesses to pds_core's adminq is already handled by +pdsc_adminq_post()->pdsc_adminq_inc_if_up(). + +Fixes: 10659034c622 ("pds_core: add the aux client API") +Reviewed-by: Simon Horman +Signed-off-by: Brett Creeley +Signed-off-by: Shannon Nelson +Reviewed-by: Jacob Keller +Link: https://patch.msgid.link/20250421174606.3892-4-shannon.nelson@amd.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/pds_core/auxbus.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/net/ethernet/amd/pds_core/auxbus.c b/drivers/net/ethernet/amd/pds_core/auxbus.c +index 2babea1109917..b76a9b7e0aed6 100644 +--- a/drivers/net/ethernet/amd/pds_core/auxbus.c ++++ b/drivers/net/ethernet/amd/pds_core/auxbus.c +@@ -107,9 +107,6 @@ int pds_client_adminq_cmd(struct pds_auxiliary_dev *padev, + dev_dbg(pf->dev, "%s: %s opcode %d\n", + __func__, dev_name(&padev->aux_dev.dev), req->opcode); + +- if (pf->state) +- return -ENXIO; +- + /* Wrap the client's request */ + cmd.client_request.opcode = PDS_AQ_CMD_CLIENT_CMD; + cmd.client_request.client_id = cpu_to_le16(padev->client_id); +-- +2.39.5 + diff --git a/queue-6.12/perf-x86-fix-non-sampling-counting-events-on-certain.patch b/queue-6.12/perf-x86-fix-non-sampling-counting-events-on-certain.patch new file mode 100644 index 0000000000..e8c8dab1d8 --- /dev/null +++ b/queue-6.12/perf-x86-fix-non-sampling-counting-events-on-certain.patch @@ -0,0 +1,62 @@ +From a8de2b208be300575d4e30799ee9092a13b1d04c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Apr 2025 06:47:24 +0000 +Subject: perf/x86: Fix non-sampling (counting) events on certain x86 platforms + +From: Luo Gengkun + +[ Upstream commit 1a97fea9db9e9b9c4839d4232dde9f505ff5b4cc ] + +Perf doesn't work at perf stat for hardware events on certain x86 platforms: + + $perf stat -- sleep 1 + Performance counter stats for 'sleep 1': + 16.44 msec task-clock # 0.016 CPUs utilized + 2 context-switches # 121.691 /sec + 0 cpu-migrations # 0.000 /sec + 54 page-faults # 3.286 K/sec + cycles + instructions + branches + branch-misses + +The reason is that the check in x86_pmu_hw_config() for sampling events is +unexpectedly applied to counting events as well. + +It should only impact x86 platforms with limit_period used for non-PEBS +events. For Intel platforms, it should only impact some older platforms, +e.g., HSW, BDW and NHM. + +Fixes: 88ec7eedbbd2 ("perf/x86: Fix low freqency setting issue") +Signed-off-by: Luo Gengkun +Signed-off-by: Ingo Molnar +Reviewed-by: Kan Liang +Cc: Alexander Shishkin +Cc: Arnaldo Carvalho de Melo +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Ravi Bangoria +Link: https://lore.kernel.org/r/20250423064724.3716211-1-luogengkun@huaweicloud.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c +index 0d33c85da4535..d737d53d03aa9 100644 +--- a/arch/x86/events/core.c ++++ b/arch/x86/events/core.c +@@ -628,7 +628,7 @@ int x86_pmu_hw_config(struct perf_event *event) + if (event->attr.type == event->pmu->type) + event->hw.config |= x86_pmu_get_event_config(event); + +- if (!event->attr.freq && x86_pmu.limit_period) { ++ if (is_sampling_event(event) && !event->attr.freq && x86_pmu.limit_period) { + s64 left = event->attr.sample_period; + x86_pmu.limit_period(event, &left); + if (left > event->attr.sample_period) +-- +2.39.5 + diff --git a/queue-6.12/riscv-replace-function-like-macro-by-static-inline-f.patch b/queue-6.12/riscv-replace-function-like-macro-by-static-inline-f.patch new file mode 100644 index 0000000000..79f6e12ad8 --- /dev/null +++ b/queue-6.12/riscv-replace-function-like-macro-by-static-inline-f.patch @@ -0,0 +1,64 @@ +From c0e52706ee2008ce2d92b376f4aec3e4f07a2b5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Apr 2025 13:13:59 +0200 +Subject: riscv: Replace function-like macro by static inline function +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Björn Töpel + +[ Upstream commit 121f34341d396b666d8a90b24768b40e08ca0d61 ] + +The flush_icache_range() function is implemented as a "function-like +macro with unused parameters", which can result in "unused variables" +warnings. + +Replace the macro with a static inline function, as advised by +Documentation/process/coding-style.rst. + +Fixes: 08f051eda33b ("RISC-V: Flush I$ when making a dirty page executable") +Signed-off-by: Björn Töpel +Link: https://lore.kernel.org/r/20250419111402.1660267-1-bjorn@kernel.org +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/include/asm/cacheflush.h | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +diff --git a/arch/riscv/include/asm/cacheflush.h b/arch/riscv/include/asm/cacheflush.h +index 8de73f91bfa37..b59ffeb668d6a 100644 +--- a/arch/riscv/include/asm/cacheflush.h ++++ b/arch/riscv/include/asm/cacheflush.h +@@ -34,11 +34,6 @@ static inline void flush_dcache_page(struct page *page) + flush_dcache_folio(page_folio(page)); + } + +-/* +- * RISC-V doesn't have an instruction to flush parts of the instruction cache, +- * so instead we just flush the whole thing. +- */ +-#define flush_icache_range(start, end) flush_icache_all() + #define flush_icache_user_page(vma, pg, addr, len) \ + do { \ + if (vma->vm_flags & VM_EXEC) \ +@@ -78,6 +73,16 @@ void flush_icache_mm(struct mm_struct *mm, bool local); + + #endif /* CONFIG_SMP */ + ++/* ++ * RISC-V doesn't have an instruction to flush parts of the instruction cache, ++ * so instead we just flush the whole thing. ++ */ ++#define flush_icache_range flush_icache_range ++static inline void flush_icache_range(unsigned long start, unsigned long end) ++{ ++ flush_icache_all(); ++} ++ + extern unsigned int riscv_cbom_block_size; + extern unsigned int riscv_cboz_block_size; + void riscv_init_cbo_blocksizes(void); +-- +2.39.5 + diff --git a/queue-6.12/riscv-uprobes-add-missing-fence.i-after-building-the.patch b/queue-6.12/riscv-uprobes-add-missing-fence.i-after-building-the.patch new file mode 100644 index 0000000000..cdb6bd9ecf --- /dev/null +++ b/queue-6.12/riscv-uprobes-add-missing-fence.i-after-building-the.patch @@ -0,0 +1,61 @@ +From 239c7115c0858d8b08331e3f7b16db99dfa9a497 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Apr 2025 13:14:00 +0200 +Subject: riscv: uprobes: Add missing fence.i after building the XOL buffer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Björn Töpel + +[ Upstream commit 7d1d19a11cfbfd8bae1d89cc010b2cc397cd0c48 ] + +The XOL (execute out-of-line) buffer is used to single-step the +replaced instruction(s) for uprobes. The RISC-V port was missing a +proper fence.i (i$ flushing) after constructing the XOL buffer, which +can result in incorrect execution of stale/broken instructions. + +This was found running the BPF selftests "test_progs: +uprobe_autoattach, attach_probe" on the Spacemit K1/X60, where the +uprobes tests randomly blew up. + +Reviewed-by: Guo Ren +Fixes: 74784081aac8 ("riscv: Add uprobes supported") +Signed-off-by: Björn Töpel +Link: https://lore.kernel.org/r/20250419111402.1660267-2-bjorn@kernel.org +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/probes/uprobes.c | 10 ++-------- + 1 file changed, 2 insertions(+), 8 deletions(-) + +diff --git a/arch/riscv/kernel/probes/uprobes.c b/arch/riscv/kernel/probes/uprobes.c +index 4b3dc8beaf77d..cc15f7ca6cc17 100644 +--- a/arch/riscv/kernel/probes/uprobes.c ++++ b/arch/riscv/kernel/probes/uprobes.c +@@ -167,6 +167,7 @@ void arch_uprobe_copy_ixol(struct page *page, unsigned long vaddr, + /* Initialize the slot */ + void *kaddr = kmap_atomic(page); + void *dst = kaddr + (vaddr & ~PAGE_MASK); ++ unsigned long start = (unsigned long)dst; + + memcpy(dst, src, len); + +@@ -176,13 +177,6 @@ void arch_uprobe_copy_ixol(struct page *page, unsigned long vaddr, + *(uprobe_opcode_t *)dst = __BUG_INSN_32; + } + ++ flush_icache_range(start, start + len); + kunmap_atomic(kaddr); +- +- /* +- * We probably need flush_icache_user_page() but it needs vma. +- * This should work on most of architectures by default. If +- * architecture needs to do something different it can define +- * its own version of the function. +- */ +- flush_dcache_page(page); + } +-- +2.39.5 + diff --git a/queue-6.12/scsi-core-clear-flags-for-scsi_cmnd-that-did-not-com.patch b/queue-6.12/scsi-core-clear-flags-for-scsi_cmnd-that-did-not-com.patch new file mode 100644 index 0000000000..c197bb5853 --- /dev/null +++ b/queue-6.12/scsi-core-clear-flags-for-scsi_cmnd-that-did-not-com.patch @@ -0,0 +1,50 @@ +From add794595decba26d3448d8c28b2a9fc3cb17074 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Mar 2025 11:49:33 +0300 +Subject: scsi: core: Clear flags for scsi_cmnd that did not complete + +From: Anastasia Kovaleva + +[ Upstream commit 54bebe46871d4e56e05fcf55c1a37e7efa24e0a8 ] + +Commands that have not been completed with scsi_done() do not clear the +SCMD_INITIALIZED flag and therefore will not be properly reinitialized. +Thus, the next time the scsi_cmnd structure is used, the command may +fail in scsi_cmd_runtime_exceeded() due to the old jiffies_at_alloc +value: + + kernel: sd 16:0:1:84: [sdts] tag#405 timing out command, waited 720s + kernel: sd 16:0:1:84: [sdts] tag#405 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=66636s + +Clear flags for commands that have not been completed by SCSI. + +Fixes: 4abafdc4360d ("block: remove the initialize_rq_fn blk_mq_ops method") +Signed-off-by: Anastasia Kovaleva +Link: https://lore.kernel.org/r/20250324084933.15932-2-a.kovaleva@yadro.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_lib.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c +index 3023b07dc483b..ce4b428b63f83 100644 +--- a/drivers/scsi/scsi_lib.c ++++ b/drivers/scsi/scsi_lib.c +@@ -1237,8 +1237,12 @@ EXPORT_SYMBOL_GPL(scsi_alloc_request); + */ + static void scsi_cleanup_rq(struct request *rq) + { ++ struct scsi_cmnd *cmd = blk_mq_rq_to_pdu(rq); ++ ++ cmd->flags = 0; ++ + if (rq->rq_flags & RQF_DONTPREP) { +- scsi_mq_uninit_cmd(blk_mq_rq_to_pdu(rq)); ++ scsi_mq_uninit_cmd(cmd); + rq->rq_flags &= ~RQF_DONTPREP; + } + } +-- +2.39.5 + diff --git a/queue-6.12/scsi-ufs-core-add-null-check-in-ufshcd_mcq_compl_pen.patch b/queue-6.12/scsi-ufs-core-add-null-check-in-ufshcd_mcq_compl_pen.patch new file mode 100644 index 0000000000..8518130770 --- /dev/null +++ b/queue-6.12/scsi-ufs-core-add-null-check-in-ufshcd_mcq_compl_pen.patch @@ -0,0 +1,42 @@ +From cbb28b2d9626019530de6e7e5be1f28c038604dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Apr 2025 14:59:09 -0500 +Subject: scsi: ufs: core: Add NULL check in + ufshcd_mcq_compl_pending_transfer() + +From: Chenyuan Yang + +[ Upstream commit 08a966a917fe3d92150fa3cc15793ad5e57051eb ] + +Add a NULL check for the returned hwq pointer by ufshcd_mcq_req_to_hwq(). + +This is similar to the fix in commit 74736103fb41 ("scsi: ufs: core: Fix +ufshcd_abort_one racing issue"). + +Signed-off-by: Chenyuan Yang +Link: https://lore.kernel.org/r/20250412195909.315418-1-chenyuan0y@gmail.com +Fixes: ab248643d3d6 ("scsi: ufs: core: Add error handling for MCQ mode") +Reviewed-by: Peter Wang +Reviewed-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/core/ufshcd.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c +index 89fc0b5662919..8d4a5b8371b63 100644 +--- a/drivers/ufs/core/ufshcd.c ++++ b/drivers/ufs/core/ufshcd.c +@@ -5689,6 +5689,8 @@ static void ufshcd_mcq_compl_pending_transfer(struct ufs_hba *hba, + continue; + + hwq = ufshcd_mcq_req_to_hwq(hba, scsi_cmd_to_rq(cmd)); ++ if (!hwq) ++ continue; + + if (force_compl) { + ufshcd_mcq_compl_all_cqes_lock(hba, hwq); +-- +2.39.5 + diff --git a/queue-6.12/scsi-ufs-mcq-add-null-check-in-ufshcd_mcq_abort.patch b/queue-6.12/scsi-ufs-mcq-add-null-check-in-ufshcd_mcq_abort.patch new file mode 100644 index 0000000000..22b6344852 --- /dev/null +++ b/queue-6.12/scsi-ufs-mcq-add-null-check-in-ufshcd_mcq_abort.patch @@ -0,0 +1,69 @@ +From 635479d9566cbb9790629b1ed7ee01108cd00041 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Apr 2025 19:13:20 -0500 +Subject: scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort() + +From: Chenyuan Yang + +[ Upstream commit 4c324085062919d4e21c69e5e78456dcec0052fe ] + +A race can occur between the MCQ completion path and the abort handler: +once a request completes, __blk_mq_free_request() sets rq->mq_hctx to +NULL, meaning the subsequent ufshcd_mcq_req_to_hwq() call in +ufshcd_mcq_abort() can return a NULL pointer. If this NULL pointer is +dereferenced, the kernel will crash. + +Add a NULL check for the returned hwq pointer. If hwq is NULL, log an +error and return FAILED, preventing a potential NULL-pointer +dereference. As suggested by Bart, the ufshcd_cmd_inflight() check is +removed. + +This is similar to the fix in commit 74736103fb41 ("scsi: ufs: core: Fix +ufshcd_abort_one racing issue"). + +This is found by our static analysis tool KNighter. + +Signed-off-by: Chenyuan Yang +Link: https://lore.kernel.org/r/20250410001320.2219341-1-chenyuan0y@gmail.com +Fixes: f1304d442077 ("scsi: ufs: mcq: Added ufshcd_mcq_abort()") +Reviewed-by: Bart Van Assche +Reviewed-by: Peter Wang +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/core/ufs-mcq.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/drivers/ufs/core/ufs-mcq.c b/drivers/ufs/core/ufs-mcq.c +index dba935c712d64..45b04f3c37764 100644 +--- a/drivers/ufs/core/ufs-mcq.c ++++ b/drivers/ufs/core/ufs-mcq.c +@@ -673,13 +673,6 @@ int ufshcd_mcq_abort(struct scsi_cmnd *cmd) + unsigned long flags; + int err; + +- if (!ufshcd_cmd_inflight(lrbp->cmd)) { +- dev_err(hba->dev, +- "%s: skip abort. cmd at tag %d already completed.\n", +- __func__, tag); +- return FAILED; +- } +- + /* Skip task abort in case previous aborts failed and report failure */ + if (lrbp->req_abort_skip) { + dev_err(hba->dev, "%s: skip abort. tag %d failed earlier\n", +@@ -688,6 +681,11 @@ int ufshcd_mcq_abort(struct scsi_cmnd *cmd) + } + + hwq = ufshcd_mcq_req_to_hwq(hba, scsi_cmd_to_rq(cmd)); ++ if (!hwq) { ++ dev_err(hba->dev, "%s: skip abort. cmd at tag %d already completed.\n", ++ __func__, tag); ++ return FAILED; ++ } + + if (ufshcd_mcq_sqe_search(hba, hwq, tag)) { + /* +-- +2.39.5 + diff --git a/queue-6.12/series b/queue-6.12/series index c64c859d38..24914e3537 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -47,3 +47,45 @@ drm-xe-bmg-add-one-additional-pci-id.patch drm-amd-display-fix-unnecessary-cast-warnings-from-c.patch drm-amd-display-dml2-use-vzalloc-rather-than-kzalloc.patch lib-kconfig.ubsan-remove-default-ubsan-from-ubsan_in.patch +ceph-fix-incorrect-flush-end-position-calculation.patch +cpufreq-sun50i-prevent-out-of-bounds-access.patch +dma-contiguous-avoid-warning-about-unused-size_bytes.patch +cpufreq-apple-soc-fix-null-ptr-deref-in-apple_soc_cp.patch +cpufreq-scmi-fix-null-ptr-deref-in-scmi_cpufreq_get_.patch +cpufreq-scpi-fix-null-ptr-deref-in-scpi_cpufreq_get_.patch +scsi-ufs-mcq-add-null-check-in-ufshcd_mcq_abort.patch +cpufreq-cppc-fix-invalid-return-value-in-.get-callba.patch +cpufreq-do-not-enable-by-default-during-compile-test.patch +cpufreq-fix-compile-test-defaults.patch +btrfs-avoid-page_lockend-underflow-in-btrfs_punch_ho.patch +btrfs-zoned-return-eio-on-raid1-block-group-write-po.patch +cgroup-cpuset-v1-add-missing-support-for-cpuset_v2_m.patch +vhost-scsi-add-better-resource-allocation-failure-ha.patch +vhost-scsi-fix-vhost_scsi_send_bad_target.patch +vhost-scsi-fix-vhost_scsi_send_status.patch +net-mlx5-fix-null-ptr-deref-in-mlx5_create_-inner_-t.patch +net-mlx5-move-ttc-allocation-after-switch-case-to-pr.patch +scsi-core-clear-flags-for-scsi_cmnd-that-did-not-com.patch +scsi-ufs-core-add-null-check-in-ufshcd_mcq_compl_pen.patch +net-lwtunnel-disable-bhs-when-required.patch +net-phy-leds-fix-memory-leak.patch +tipc-fix-null-pointer-dereference-in-tipc_mon_reinit.patch +net-ethernet-mtk_eth_soc-net-revise-netsysv3-hardwar.patch +fix-a-couple-of-races-in-mnt_tree_beneath-handling-b.patch +net_sched-hfsc-fix-a-uaf-vulnerability-in-class-hand.patch +net_sched-hfsc-fix-a-potential-uaf-in-hfsc_dequeue-t.patch +net-dsa-mt7530-sync-driver-specific-behavior-of-mt75.patch +pds_core-prevent-possible-adminq-overflow-stuck-cond.patch +pds_core-handle-unsupported-pds_core_cmd_fw_control-.patch +pds_core-remove-unnecessary-check-in-pds_client_admi.patch +pds_core-make-wait_context-part-of-q_info.patch +block-never-reduce-ra_pages-in-blk_apply_bdi_limits.patch +iommu-amd-return-an-error-if-vcpu-affinity-is-set-fo.patch +riscv-replace-function-like-macro-by-static-inline-f.patch +riscv-uprobes-add-missing-fence.i-after-building-the.patch +splice-remove-duplicate-noinline-from-pipe_clear_now.patch +bpf-add-namespace-to-bpf-internal-symbols.patch +perf-x86-fix-non-sampling-counting-events-on-certain.patch +loongarch-select-arch_use_memtest.patch +loongarch-make-regs_irqs_disabled-more-clear.patch +loongarch-make-do_xyz-exception-handlers-more-robust.patch diff --git a/queue-6.12/splice-remove-duplicate-noinline-from-pipe_clear_now.patch b/queue-6.12/splice-remove-duplicate-noinline-from-pipe_clear_now.patch new file mode 100644 index 0000000000..ebcd41fb48 --- /dev/null +++ b/queue-6.12/splice-remove-duplicate-noinline-from-pipe_clear_now.patch @@ -0,0 +1,43 @@ +From c379ed662248f35c6036c4bb54c20132597f33c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Apr 2025 18:00:23 +0000 +Subject: splice: remove duplicate noinline from pipe_clear_nowait + +From: T.J. Mercier + +[ Upstream commit e6f141b332ddd9007756751b6afd24f799488fd8 ] + +pipe_clear_nowait has two noinline macros, but we only need one. + +I checked the whole tree, and this is the only occurrence: + +$ grep -r "noinline .* noinline" +fs/splice.c:static noinline void noinline pipe_clear_nowait(struct file *file) +$ + +Fixes: 0f99fc513ddd ("splice: clear FMODE_NOWAIT on file if splice/vmsplice is used") +Signed-off-by: "T.J. Mercier" +Link: https://lore.kernel.org/20250423180025.2627670-1-tjmercier@google.com +Reviewed-by: Jens Axboe +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/splice.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/splice.c b/fs/splice.c +index 06232d7e505f6..38f8c94267315 100644 +--- a/fs/splice.c ++++ b/fs/splice.c +@@ -45,7 +45,7 @@ + * here if set to avoid blocking other users of this pipe if splice is + * being done on it. + */ +-static noinline void noinline pipe_clear_nowait(struct file *file) ++static noinline void pipe_clear_nowait(struct file *file) + { + fmode_t fmode = READ_ONCE(file->f_mode); + +-- +2.39.5 + diff --git a/queue-6.12/tipc-fix-null-pointer-dereference-in-tipc_mon_reinit.patch b/queue-6.12/tipc-fix-null-pointer-dereference-in-tipc_mon_reinit.patch new file mode 100644 index 0000000000..c574e8d0a1 --- /dev/null +++ b/queue-6.12/tipc-fix-null-pointer-dereference-in-tipc_mon_reinit.patch @@ -0,0 +1,125 @@ +From 3fbe1f060f1eaa1513666b95439748d5cdec8a57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Apr 2025 14:47:15 +0700 +Subject: tipc: fix NULL pointer dereference in tipc_mon_reinit_self() + +From: Tung Nguyen + +[ Upstream commit d63527e109e811ef11abb1c2985048fdb528b4cb ] + +syzbot reported: + +tipc: Node number set to 1055423674 +Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI +KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] +CPU: 3 UID: 0 PID: 6017 Comm: kworker/3:5 Not tainted 6.15.0-rc1-syzkaller-00246-g900241a5cc15 #0 PREEMPT(full) +Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 +Workqueue: events tipc_net_finalize_work +RIP: 0010:tipc_mon_reinit_self+0x11c/0x210 net/tipc/monitor.c:719 +... +RSP: 0018:ffffc9000356fb68 EFLAGS: 00010246 +RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000003ee87cba +RDX: 0000000000000000 RSI: ffffffff8dbc56a7 RDI: ffff88804c2cc010 +RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000000 +R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000007 +R13: fffffbfff2111097 R14: ffff88804ead8000 R15: ffff88804ead9010 +FS: 0000000000000000(0000) GS:ffff888097ab9000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00000000f720eb00 CR3: 000000000e182000 CR4: 0000000000352ef0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + tipc_net_finalize+0x10b/0x180 net/tipc/net.c:140 + process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238 + process_scheduled_works kernel/workqueue.c:3319 [inline] + worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400 + kthread+0x3c2/0x780 kernel/kthread.c:464 + ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153 + ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 + +... +RIP: 0010:tipc_mon_reinit_self+0x11c/0x210 net/tipc/monitor.c:719 +... +RSP: 0018:ffffc9000356fb68 EFLAGS: 00010246 +RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000003ee87cba +RDX: 0000000000000000 RSI: ffffffff8dbc56a7 RDI: ffff88804c2cc010 +RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000000 +R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000007 +R13: fffffbfff2111097 R14: ffff88804ead8000 R15: ffff88804ead9010 +FS: 0000000000000000(0000) GS:ffff888097ab9000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00000000f720eb00 CR3: 000000000e182000 CR4: 0000000000352ef0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + +There is a racing condition between workqueue created when enabling +bearer and another thread created when disabling bearer right after +that as follow: + +enabling_bearer | disabling_bearer +--------------- | ---------------- +tipc_disc_timeout() | +{ | bearer_disable() + ... | { + schedule_work(&tn->work); | tipc_mon_delete() + ... | { +} | ... + | write_lock_bh(&mon->lock); + | mon->self = NULL; + | write_unlock_bh(&mon->lock); + | ... + | } +tipc_net_finalize_work() | } +{ | + ... | + tipc_net_finalize() | + { | + ... | + tipc_mon_reinit_self() | + { | + ... | + write_lock_bh(&mon->lock); | + mon->self->addr = tipc_own_addr(net); | + write_unlock_bh(&mon->lock); | + ... | + } | + ... | + } | + ... | +} | + +'mon->self' is set to NULL in disabling_bearer thread and dereferenced +later in enabling_bearer thread. + +This commit fixes this issue by validating 'mon->self' before assigning +node address to it. + +Reported-by: syzbot+ed60da8d686dc709164c@syzkaller.appspotmail.com +Fixes: 46cb01eeeb86 ("tipc: update mon's self addr when node addr generated") +Signed-off-by: Tung Nguyen +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250417074826.578115-1-tung.quang.nguyen@est.tech +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tipc/monitor.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/tipc/monitor.c b/net/tipc/monitor.c +index e2f19627e43d5..b45c5b91bc7af 100644 +--- a/net/tipc/monitor.c ++++ b/net/tipc/monitor.c +@@ -716,7 +716,8 @@ void tipc_mon_reinit_self(struct net *net) + if (!mon) + continue; + write_lock_bh(&mon->lock); +- mon->self->addr = tipc_own_addr(net); ++ if (mon->self) ++ mon->self->addr = tipc_own_addr(net); + write_unlock_bh(&mon->lock); + } + } +-- +2.39.5 + diff --git a/queue-6.12/vhost-scsi-add-better-resource-allocation-failure-ha.patch b/queue-6.12/vhost-scsi-add-better-resource-allocation-failure-ha.patch new file mode 100644 index 0000000000..76a85fe285 --- /dev/null +++ b/queue-6.12/vhost-scsi-add-better-resource-allocation-failure-ha.patch @@ -0,0 +1,94 @@ +From 4e25c373e419cb094a4e135625f6c2ad7d1dc4bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Dec 2024 13:15:10 -0600 +Subject: vhost-scsi: Add better resource allocation failure handling + +From: Mike Christie + +[ Upstream commit 3ca51662f8186b569b8fb282242c20ccbb3993c2 ] + +If we can't allocate mem to map in data for a request or can't find +a tag for a command, we currently drop the command. This leads to the +error handler running to clean it up. Instead of dropping the command +this has us return an error telling the initiator that it queued more +commands than we can handle. The initiator will then reduce how many +commands it will send us and retry later. + +Signed-off-by: Mike Christie +Message-Id: <20241203191705.19431-4-michael.christie@oracle.com> +Signed-off-by: Michael S. Tsirkin +Acked-by: Stefan Hajnoczi +Stable-dep-of: b18268713547 ("vhost-scsi: Fix vhost_scsi_send_bad_target()") +Signed-off-by: Sasha Levin +--- + drivers/vhost/scsi.c | 28 +++++++++++++++++++++++++--- + 1 file changed, 25 insertions(+), 3 deletions(-) + +diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c +index 7aeff435c1d87..ad7fa5bc0f5fc 100644 +--- a/drivers/vhost/scsi.c ++++ b/drivers/vhost/scsi.c +@@ -630,7 +630,7 @@ vhost_scsi_get_cmd(struct vhost_virtqueue *vq, struct vhost_scsi_tpg *tpg, + + tag = sbitmap_get(&svq->scsi_tags); + if (tag < 0) { +- pr_err("Unable to obtain tag for vhost_scsi_cmd\n"); ++ pr_warn_once("Guest sent too many cmds. Returning TASK_SET_FULL.\n"); + return ERR_PTR(-ENOMEM); + } + +@@ -929,6 +929,24 @@ static void vhost_scsi_target_queue_cmd(struct vhost_scsi_cmd *cmd) + target_submit(se_cmd); + } + ++static void ++vhost_scsi_send_status(struct vhost_scsi *vs, struct vhost_virtqueue *vq, ++ int head, unsigned int out, u8 status) ++{ ++ struct virtio_scsi_cmd_resp __user *resp; ++ struct virtio_scsi_cmd_resp rsp; ++ int ret; ++ ++ memset(&rsp, 0, sizeof(rsp)); ++ rsp.status = status; ++ resp = vq->iov[out].iov_base; ++ ret = __copy_to_user(resp, &rsp, sizeof(rsp)); ++ if (!ret) ++ vhost_add_used_and_signal(&vs->dev, vq, head, 0); ++ else ++ pr_err("Faulted on virtio_scsi_cmd_resp\n"); ++} ++ + static void + vhost_scsi_send_bad_target(struct vhost_scsi *vs, + struct vhost_virtqueue *vq, +@@ -1216,8 +1234,8 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq) + exp_data_len + prot_bytes, + data_direction); + if (IS_ERR(cmd)) { +- vq_err(vq, "vhost_scsi_get_cmd failed %ld\n", +- PTR_ERR(cmd)); ++ ret = PTR_ERR(cmd); ++ vq_err(vq, "vhost_scsi_get_tag failed %dd\n", ret); + goto err; + } + cmd->tvc_vhost = vs; +@@ -1254,11 +1272,15 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq) + * EINVAL: Invalid response buffer, drop the request + * EIO: Respond with bad target + * EAGAIN: Pending request ++ * ENOMEM: Could not allocate resources for request + */ + if (ret == -ENXIO) + break; + else if (ret == -EIO) + vhost_scsi_send_bad_target(vs, vq, vc.head, vc.out); ++ else if (ret == -ENOMEM) ++ vhost_scsi_send_status(vs, vq, vc.head, vc.out, ++ SAM_STAT_TASK_SET_FULL); + } while (likely(!vhost_exceeds_weight(vq, ++c, 0))); + out: + mutex_unlock(&vq->mutex); +-- +2.39.5 + diff --git a/queue-6.12/vhost-scsi-fix-vhost_scsi_send_bad_target.patch b/queue-6.12/vhost-scsi-fix-vhost_scsi_send_bad_target.patch new file mode 100644 index 0000000000..8454d25ffc --- /dev/null +++ b/queue-6.12/vhost-scsi-fix-vhost_scsi_send_bad_target.patch @@ -0,0 +1,115 @@ +From 26d39bd6f5e4616258f6e2e963e5853ea31f9ac5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Apr 2025 23:29:47 -0700 +Subject: vhost-scsi: Fix vhost_scsi_send_bad_target() + +From: Dongli Zhang + +[ Upstream commit b182687135474d7ed905a07cc6cb2734b359e13e ] + +Although the support of VIRTIO_F_ANY_LAYOUT + VIRTIO_F_VERSION_1 was +signaled by the commit 664ed90e621c ("vhost/scsi: Set +VIRTIO_F_ANY_LAYOUT + VIRTIO_F_VERSION_1 feature bits"), +vhost_scsi_send_bad_target() still assumes the response in a single +descriptor. + +In addition, although vhost_scsi_send_bad_target() is used by both I/O +queue and control queue, the response header is always +virtio_scsi_cmd_resp. It is required to use virtio_scsi_ctrl_tmf_resp or +virtio_scsi_ctrl_an_resp for control queue. + +Fixes: 664ed90e621c ("vhost/scsi: Set VIRTIO_F_ANY_LAYOUT + VIRTIO_F_VERSION_1 feature bits") +Signed-off-by: Dongli Zhang +Acked-by: Jason Wang +Reviewed-by: Mike Christie +Message-Id: <20250403063028.16045-3-dongli.zhang@oracle.com> +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/vhost/scsi.c | 48 ++++++++++++++++++++++++++++++++++---------- + 1 file changed, 37 insertions(+), 11 deletions(-) + +diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c +index ad7fa5bc0f5fc..7bfe5e5865fe9 100644 +--- a/drivers/vhost/scsi.c ++++ b/drivers/vhost/scsi.c +@@ -947,23 +947,46 @@ vhost_scsi_send_status(struct vhost_scsi *vs, struct vhost_virtqueue *vq, + pr_err("Faulted on virtio_scsi_cmd_resp\n"); + } + ++#define TYPE_IO_CMD 0 ++#define TYPE_CTRL_TMF 1 ++#define TYPE_CTRL_AN 2 ++ + static void + vhost_scsi_send_bad_target(struct vhost_scsi *vs, + struct vhost_virtqueue *vq, +- int head, unsigned out) ++ struct vhost_scsi_ctx *vc, int type) + { +- struct virtio_scsi_cmd_resp __user *resp; +- struct virtio_scsi_cmd_resp rsp; ++ union { ++ struct virtio_scsi_cmd_resp cmd; ++ struct virtio_scsi_ctrl_tmf_resp tmf; ++ struct virtio_scsi_ctrl_an_resp an; ++ } rsp; ++ struct iov_iter iov_iter; ++ size_t rsp_size; + int ret; + + memset(&rsp, 0, sizeof(rsp)); +- rsp.response = VIRTIO_SCSI_S_BAD_TARGET; +- resp = vq->iov[out].iov_base; +- ret = __copy_to_user(resp, &rsp, sizeof(rsp)); +- if (!ret) +- vhost_add_used_and_signal(&vs->dev, vq, head, 0); ++ ++ if (type == TYPE_IO_CMD) { ++ rsp_size = sizeof(struct virtio_scsi_cmd_resp); ++ rsp.cmd.response = VIRTIO_SCSI_S_BAD_TARGET; ++ } else if (type == TYPE_CTRL_TMF) { ++ rsp_size = sizeof(struct virtio_scsi_ctrl_tmf_resp); ++ rsp.tmf.response = VIRTIO_SCSI_S_BAD_TARGET; ++ } else { ++ rsp_size = sizeof(struct virtio_scsi_ctrl_an_resp); ++ rsp.an.response = VIRTIO_SCSI_S_BAD_TARGET; ++ } ++ ++ iov_iter_init(&iov_iter, ITER_DEST, &vq->iov[vc->out], vc->in, ++ rsp_size); ++ ++ ret = copy_to_iter(&rsp, rsp_size, &iov_iter); ++ ++ if (likely(ret == rsp_size)) ++ vhost_add_used_and_signal(&vs->dev, vq, vc->head, 0); + else +- pr_err("Faulted on virtio_scsi_cmd_resp\n"); ++ pr_err("Faulted on virtio scsi type=%d\n", type); + } + + static int +@@ -1277,7 +1300,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq) + if (ret == -ENXIO) + break; + else if (ret == -EIO) +- vhost_scsi_send_bad_target(vs, vq, vc.head, vc.out); ++ vhost_scsi_send_bad_target(vs, vq, &vc, TYPE_IO_CMD); + else if (ret == -ENOMEM) + vhost_scsi_send_status(vs, vq, vc.head, vc.out, + SAM_STAT_TASK_SET_FULL); +@@ -1510,7 +1533,10 @@ vhost_scsi_ctl_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq) + if (ret == -ENXIO) + break; + else if (ret == -EIO) +- vhost_scsi_send_bad_target(vs, vq, vc.head, vc.out); ++ vhost_scsi_send_bad_target(vs, vq, &vc, ++ v_req.type == VIRTIO_SCSI_T_TMF ? ++ TYPE_CTRL_TMF : ++ TYPE_CTRL_AN); + } while (likely(!vhost_exceeds_weight(vq, ++c, 0))); + out: + mutex_unlock(&vq->mutex); +-- +2.39.5 + diff --git a/queue-6.12/vhost-scsi-fix-vhost_scsi_send_status.patch b/queue-6.12/vhost-scsi-fix-vhost_scsi_send_status.patch new file mode 100644 index 0000000000..7016c0ea61 --- /dev/null +++ b/queue-6.12/vhost-scsi-fix-vhost_scsi_send_status.patch @@ -0,0 +1,76 @@ +From 7be9341f7b40b53d0d84d073097544ce9ab975a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Apr 2025 23:29:48 -0700 +Subject: vhost-scsi: Fix vhost_scsi_send_status() + +From: Dongli Zhang + +[ Upstream commit 58465d86071b61415e25fb054201f61e83d21465 ] + +Although the support of VIRTIO_F_ANY_LAYOUT + VIRTIO_F_VERSION_1 was +signaled by the commit 664ed90e621c ("vhost/scsi: Set +VIRTIO_F_ANY_LAYOUT + VIRTIO_F_VERSION_1 feature bits"), +vhost_scsi_send_bad_target() still assumes the response in a single +descriptor. + +Similar issue in vhost_scsi_send_bad_target() has been fixed in previous +commit. In addition, similar issue for vhost_scsi_complete_cmd_work() has +been fixed by the commit 6dd88fd59da8 ("vhost-scsi: unbreak any layout for +response"). + +Fixes: 3ca51662f818 ("vhost-scsi: Add better resource allocation failure handling") +Signed-off-by: Dongli Zhang +Acked-by: Jason Wang +Reviewed-by: Mike Christie +Message-Id: <20250403063028.16045-4-dongli.zhang@oracle.com> +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/vhost/scsi.c | 18 +++++++++++------- + 1 file changed, 11 insertions(+), 7 deletions(-) + +diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c +index 7bfe5e5865fe9..35a03306d1345 100644 +--- a/drivers/vhost/scsi.c ++++ b/drivers/vhost/scsi.c +@@ -931,18 +931,22 @@ static void vhost_scsi_target_queue_cmd(struct vhost_scsi_cmd *cmd) + + static void + vhost_scsi_send_status(struct vhost_scsi *vs, struct vhost_virtqueue *vq, +- int head, unsigned int out, u8 status) ++ struct vhost_scsi_ctx *vc, u8 status) + { +- struct virtio_scsi_cmd_resp __user *resp; + struct virtio_scsi_cmd_resp rsp; ++ struct iov_iter iov_iter; + int ret; + + memset(&rsp, 0, sizeof(rsp)); + rsp.status = status; +- resp = vq->iov[out].iov_base; +- ret = __copy_to_user(resp, &rsp, sizeof(rsp)); +- if (!ret) +- vhost_add_used_and_signal(&vs->dev, vq, head, 0); ++ ++ iov_iter_init(&iov_iter, ITER_DEST, &vq->iov[vc->out], vc->in, ++ sizeof(rsp)); ++ ++ ret = copy_to_iter(&rsp, sizeof(rsp), &iov_iter); ++ ++ if (likely(ret == sizeof(rsp))) ++ vhost_add_used_and_signal(&vs->dev, vq, vc->head, 0); + else + pr_err("Faulted on virtio_scsi_cmd_resp\n"); + } +@@ -1302,7 +1306,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq) + else if (ret == -EIO) + vhost_scsi_send_bad_target(vs, vq, &vc, TYPE_IO_CMD); + else if (ret == -ENOMEM) +- vhost_scsi_send_status(vs, vq, vc.head, vc.out, ++ vhost_scsi_send_status(vs, vq, &vc, + SAM_STAT_TASK_SET_FULL); + } while (likely(!vhost_exceeds_weight(vq, ++c, 0))); + out: +-- +2.39.5 + -- 2.47.3