]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
fuzz cleanup
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 30 May 2026 10:35:45 +0000 (12:35 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 30 May 2026 10:37:27 +0000 (12:37 +0200)
12 files changed:
queue-6.1/bpf-sockmap-fix-af_unix-iter-deadlock.patch
queue-6.1/bpf-sockmap-take-state-lock-for-af_unix-iter.patch
queue-6.12/firmware-arm_ffa-align-rxtx-buffer-size-before-mappi.patch
queue-6.12/firmware-arm_ffa-fix-sched-recv-callback-partition-l.patch
queue-6.18/net-shaper-annotate-the-data-races.patch
queue-6.18/net-shaper-enforce-singleton-netdev-scope-with-id-0.patch
queue-6.18/net-shaper-reject-queue-scope-handle-with-missing-id.patch
queue-6.18/net-shaper-rework-the-valid-marking-again.patch
queue-7.0/net-shaper-annotate-the-data-races.patch
queue-7.0/net-shaper-enforce-singleton-netdev-scope-with-id-0.patch
queue-7.0/net-shaper-reject-queue-scope-handle-with-missing-id.patch
queue-7.0/net-shaper-rework-the-valid-marking-again.patch

index 1f1578272d385149a98f1ec4305bf6193d78c5d6..12a0a1dede284a14e1c9ee2827bbfcc3ee9c4dcc 100644 (file)
@@ -62,14 +62,12 @@ Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
 Link: https://patch.msgid.link/20260414-unix-proto-update-null-ptr-deref-v4-2-2af6fe97918e@rbox.co
 Signed-off-by: Sasha Levin <sashal@kernel.org>
 ---
- net/unix/af_unix.c | 7 +++----
+ net/unix/af_unix.c |    7 +++----
  1 file changed, 3 insertions(+), 4 deletions(-)
 
-diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
-index 99d80687998bd..f810c2b90b8b1 100644
 --- a/net/unix/af_unix.c
 +++ b/net/unix/af_unix.c
-@@ -3601,15 +3601,14 @@ static int bpf_iter_unix_seq_show(struct seq_file *seq, void *v)
+@@ -3598,15 +3598,14 @@ static int bpf_iter_unix_seq_show(struct
        struct bpf_prog *prog;
        struct sock *sk = v;
        uid_t uid;
@@ -87,7 +85,7 @@ index 99d80687998bd..f810c2b90b8b1 100644
                ret = SEQ_SKIP;
                goto unlock;
        }
-@@ -3619,7 +3618,7 @@ static int bpf_iter_unix_seq_show(struct seq_file *seq, void *v)
+@@ -3616,7 +3615,7 @@ static int bpf_iter_unix_seq_show(struct
        prog = bpf_iter_get_info(&meta, false);
        ret = unix_prog_seq_show(prog, &meta, v, uid);
  unlock:
@@ -96,6 +94,3 @@ index 99d80687998bd..f810c2b90b8b1 100644
        return ret;
  }
  
--- 
-2.53.0
-
index bd7573c722b80e1065e57069c382112c13228786..f89c0c0b875753e9bc4930142788560c4a884186 100644 (file)
@@ -87,14 +87,12 @@ Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
 Link: https://patch.msgid.link/20260414-unix-proto-update-null-ptr-deref-v4-5-2af6fe97918e@rbox.co
 Signed-off-by: Sasha Levin <sashal@kernel.org>
 ---
- net/unix/af_unix.c | 2 ++
+ net/unix/af_unix.c |    2 ++
  1 file changed, 2 insertions(+)
 
-diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
-index f810c2b90b8b1..8b0dc82fcdca3 100644
 --- a/net/unix/af_unix.c
 +++ b/net/unix/af_unix.c
-@@ -3607,6 +3607,7 @@ static int bpf_iter_unix_seq_show(struct seq_file *seq, void *v)
+@@ -3604,6 +3604,7 @@ static int bpf_iter_unix_seq_show(struct
                return 0;
  
        lock_sock(sk);
@@ -102,7 +100,7 @@ index f810c2b90b8b1..8b0dc82fcdca3 100644
  
        if (unlikely(sock_flag(sk, SOCK_DEAD))) {
                ret = SEQ_SKIP;
-@@ -3618,6 +3619,7 @@ static int bpf_iter_unix_seq_show(struct seq_file *seq, void *v)
+@@ -3615,6 +3616,7 @@ static int bpf_iter_unix_seq_show(struct
        prog = bpf_iter_get_info(&meta, false);
        ret = unix_prog_seq_show(prog, &meta, v, uid);
  unlock:
@@ -110,6 +108,3 @@ index f810c2b90b8b1..8b0dc82fcdca3 100644
        release_sock(sk);
        return ret;
  }
--- 
-2.53.0
-
index 9305b76943251092c84c0d50119e171911f7cdfc..0b099fd5721d441e46680999fb801fe48a4e0ee0 100644 (file)
@@ -23,14 +23,12 @@ Link: https://patch.msgid.link/20260428-ffa_fixes-v2-9-8595ae450034@kernel.org
 Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
 Signed-off-by: Sasha Levin <sashal@kernel.org>
 ---
- drivers/firmware/arm_ffa/driver.c | 3 ++-
+ drivers/firmware/arm_ffa/driver.c |    3 ++-
  1 file changed, 2 insertions(+), 1 deletion(-)
 
-diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c
-index 521007bfa35a4..f35c3a56326c7 100644
 --- a/drivers/firmware/arm_ffa/driver.c
 +++ b/drivers/firmware/arm_ffa/driver.c
-@@ -1929,6 +1929,7 @@ static int __init ffa_init(void)
+@@ -1885,6 +1885,7 @@ static int __init ffa_init(void)
                        rxtx_bufsz = SZ_4K;
        }
  
@@ -38,7 +36,7 @@ index 521007bfa35a4..f35c3a56326c7 100644
        drv_info->rxtx_bufsz = rxtx_bufsz;
        drv_info->rx_buffer = alloc_pages_exact(rxtx_bufsz, GFP_KERNEL);
        if (!drv_info->rx_buffer) {
-@@ -1944,7 +1945,7 @@ static int __init ffa_init(void)
+@@ -1900,7 +1901,7 @@ static int __init ffa_init(void)
  
        ret = ffa_rxtx_map(virt_to_phys(drv_info->tx_buffer),
                           virt_to_phys(drv_info->rx_buffer),
@@ -47,6 +45,3 @@ index 521007bfa35a4..f35c3a56326c7 100644
        if (ret) {
                pr_err("failed to register FFA RxTx buffers\n");
                goto free_pages;
--- 
-2.53.0
-
index f13a8d6085d4b33c80e630f196ff9e88ce3cd85a..210d91e2cfae1b9f2b4107480ffba6dd7f184420 100644 (file)
@@ -18,14 +18,12 @@ Link: https://patch.msgid.link/20260428-ffa_fixes-v2-11-8595ae450034@kernel.org
 Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
 Signed-off-by: Sasha Levin <sashal@kernel.org>
 ---
- drivers/firmware/arm_ffa/driver.c | 6 +++---
+ drivers/firmware/arm_ffa/driver.c |    6 +++---
  1 file changed, 3 insertions(+), 3 deletions(-)
 
-diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c
-index f35c3a56326c7..89474fa3c80e5 100644
 --- a/drivers/firmware/arm_ffa/driver.c
 +++ b/drivers/firmware/arm_ffa/driver.c
-@@ -1155,7 +1155,7 @@ static int
+@@ -1111,7 +1111,7 @@ static int
  ffa_sched_recv_cb_update(struct ffa_device *dev, ffa_sched_recv_cb callback,
                         void *cb_data, bool is_registration)
  {
@@ -34,7 +32,7 @@ index f35c3a56326c7..89474fa3c80e5 100644
        struct list_head *phead;
        bool cb_valid;
  
-@@ -1168,11 +1168,11 @@ ffa_sched_recv_cb_update(struct ffa_device *dev, ffa_sched_recv_cb callback,
+@@ -1124,11 +1124,11 @@ ffa_sched_recv_cb_update(struct ffa_devi
                return -EINVAL;
        }
  
@@ -48,6 +46,3 @@ index f35c3a56326c7..89474fa3c80e5 100644
                pr_err("%s: No such partition ID 0x%x\n", __func__, dev->vm_id);
                return -EINVAL;
        }
--- 
-2.53.0
-
index a3f5b333e07d4bbf8f072a827195fbe730ebac7b..b23d98c0eb93d7b0c063e7e3b27698e99786978b 100644 (file)
@@ -22,14 +22,12 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 Stable-dep-of: b8d7519352ba ("net: shaper: rework the VALID marking (again)")
 Signed-off-by: Sasha Levin <sashal@kernel.org>
 ---
- net/shaper/shaper.c | 53 ++++++++++++++++++++++++++++++++-------------
+ net/shaper/shaper.c |   53 +++++++++++++++++++++++++++++++++++++---------------
  1 file changed, 38 insertions(+), 15 deletions(-)
 
-diff --git a/net/shaper/shaper.c b/net/shaper/shaper.c
-index 23d535f157294..a01de4392eb66 100644
 --- a/net/shaper/shaper.c
 +++ b/net/shaper/shaper.c
-@@ -138,35 +138,58 @@ static int net_shaper_fill_handle(struct sk_buff *msg,
+@@ -136,35 +136,58 @@ handle_nest_cancel:
        return -EMSGSIZE;
  }
  
@@ -102,7 +100,7 @@ index 23d535f157294..a01de4392eb66 100644
                goto nla_put_failure;
  
        genlmsg_end(msg, hdr);
-@@ -424,7 +447,7 @@ static void net_shaper_commit(struct net_shaper_binding *binding,
+@@ -422,7 +445,7 @@ static void net_shaper_commit(struct net
                /* Successful update: drop the tentative mark
                 * and update the hierarchy container.
                 */
@@ -111,6 +109,3 @@ index 23d535f157294..a01de4392eb66 100644
                smp_wmb();
                __xa_set_mark(&hierarchy->shapers, index, NET_SHAPER_VALID);
        }
--- 
-2.53.0
-
index d5b05185c9aee08a596fa727b9edf7aac0d7c6fe..567d6128a56bb83ddf1f1d0a4c0bb3db8b69369d 100644 (file)
@@ -21,14 +21,12 @@ Link: https://patch.msgid.link/20260510192904.3987113-10-kuba@kernel.org
 Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 Signed-off-by: Sasha Levin <sashal@kernel.org>
 ---
- net/shaper/shaper.c | 6 ++++++
+ net/shaper/shaper.c |    6 ++++++
  1 file changed, 6 insertions(+)
 
-diff --git a/net/shaper/shaper.c b/net/shaper/shaper.c
-index b2d85963243fa..d65008b819dc9 100644
 --- a/net/shaper/shaper.c
 +++ b/net/shaper/shaper.c
-@@ -482,6 +482,12 @@ static int net_shaper_parse_handle(const struct nlattr *attr,
+@@ -480,6 +480,12 @@ static int net_shaper_parse_handle(const
        else if (handle->scope == NET_SHAPER_SCOPE_NODE)
                id = NET_SHAPER_ID_UNSPEC;
  
@@ -41,6 +39,3 @@ index b2d85963243fa..d65008b819dc9 100644
        handle->id = id;
        return 0;
  }
--- 
-2.53.0
-
index da7ab108a1a5de2a1af8a5c2488786f7127997db..dc506bdb4d605556c8e2b574741871e3c4466b3e 100644 (file)
@@ -25,14 +25,12 @@ Link: https://patch.msgid.link/20260510192904.3987113-11-kuba@kernel.org
 Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 Signed-off-by: Sasha Levin <sashal@kernel.org>
 ---
- net/shaper/shaper.c | 9 +++++++--
+ net/shaper/shaper.c |    9 +++++++--
  1 file changed, 7 insertions(+), 2 deletions(-)
 
-diff --git a/net/shaper/shaper.c b/net/shaper/shaper.c
-index d65008b819dc9..23d535f157294 100644
 --- a/net/shaper/shaper.c
 +++ b/net/shaper/shaper.c
-@@ -477,10 +477,15 @@ static int net_shaper_parse_handle(const struct nlattr *attr,
+@@ -475,10 +475,15 @@ static int net_shaper_parse_handle(const
         * shaper (any other value).
         */
        id_attr = tb[NET_SHAPER_A_HANDLE_ID];
@@ -50,6 +48,3 @@ index d65008b819dc9..23d535f157294 100644
  
        if (id && handle->scope == NET_SHAPER_SCOPE_NETDEV) {
                NL_SET_ERR_MSG_ATTR(info->extack, id_attr,
--- 
-2.53.0
-
index 0cb93d399a78f7e6074a578f85d04e479a4a0ae6..cb46238c5e56b639e1db73c9dfc60e4dfe913600 100644 (file)
@@ -31,12 +31,10 @@ Link: https://patch.msgid.link/20260515221325.1685455-3-kuba@kernel.org
 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 Signed-off-by: Sasha Levin <sashal@kernel.org>
 ---
- include/net/net_shaper.h |  1 +
- net/shaper/shaper.c      | 45 ++++++++++++++++------------------------
+ include/net/net_shaper.h |    1 +
+ net/shaper/shaper.c      |   45 ++++++++++++++++++---------------------------
  2 files changed, 19 insertions(+), 27 deletions(-)
 
-diff --git a/include/net/net_shaper.h b/include/net/net_shaper.h
-index 5c3f49b52fe96..3939b816b0011 100644
 --- a/include/net/net_shaper.h
 +++ b/include/net/net_shaper.h
 @@ -53,6 +53,7 @@ struct net_shaper {
@@ -47,11 +45,9 @@ index 5c3f49b52fe96..3939b816b0011 100644
        struct rcu_head rcu;
  };
  
-diff --git a/net/shaper/shaper.c b/net/shaper/shaper.c
-index a01de4392eb66..f992b28e19fd6 100644
 --- a/net/shaper/shaper.c
 +++ b/net/shaper/shaper.c
-@@ -306,31 +306,24 @@ static void net_shaper_default_parent(const struct net_shaper_handle *handle,
+@@ -304,31 +304,24 @@ static void net_shaper_default_parent(co
        parent->id = 0;
  }
  
@@ -91,7 +87,7 @@ index a01de4392eb66..f992b28e19fd6 100644
  }
  
  /* Allocate on demand the per device shaper's hierarchy container.
-@@ -444,12 +437,10 @@ static void net_shaper_commit(struct net_shaper_binding *binding,
+@@ -442,12 +435,10 @@ static void net_shaper_commit(struct net
                if (WARN_ON_ONCE(!cur))
                        continue;
  
@@ -107,7 +103,7 @@ index a01de4392eb66..f992b28e19fd6 100644
        }
        xa_unlock(&hierarchy->shapers);
  }
-@@ -466,10 +457,10 @@ static void net_shaper_rollback(struct net_shaper_binding *binding)
+@@ -464,10 +455,10 @@ static void net_shaper_rollback(struct n
  
        xa_lock(&hierarchy->shapers);
        xa_for_each(&hierarchy->shapers, index, cur) {
@@ -120,7 +116,7 @@ index a01de4392eb66..f992b28e19fd6 100644
        }
        xa_unlock(&hierarchy->shapers);
  }
-@@ -882,12 +873,12 @@ int net_shaper_nl_get_dumpit(struct sk_buff *skb,
+@@ -880,12 +871,12 @@ int net_shaper_nl_get_dumpit(struct sk_b
                goto out_unlock;
  
        for (; (shaper = xa_find(&hierarchy->shapers, &ctx->start_index,
@@ -138,6 +134,3 @@ index a01de4392eb66..f992b28e19fd6 100644
                ret = net_shaper_fill_one(skb, binding, shaper, info);
                if (ret)
                        break;
--- 
-2.53.0
-
index 0b560fc22441123a6fa2ed31bee87e51aac1d19f..668dc6f032445872bcc5255de4cc961c857decdb 100644 (file)
@@ -22,14 +22,12 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 Stable-dep-of: b8d7519352ba ("net: shaper: rework the VALID marking (again)")
 Signed-off-by: Sasha Levin <sashal@kernel.org>
 ---
- net/shaper/shaper.c | 53 ++++++++++++++++++++++++++++++++-------------
+ net/shaper/shaper.c |   53 +++++++++++++++++++++++++++++++++++++---------------
  1 file changed, 38 insertions(+), 15 deletions(-)
 
-diff --git a/net/shaper/shaper.c b/net/shaper/shaper.c
-index b1c65110f04d3..520cefdc3d908 100644
 --- a/net/shaper/shaper.c
 +++ b/net/shaper/shaper.c
-@@ -138,35 +138,58 @@ static int net_shaper_fill_handle(struct sk_buff *msg,
+@@ -136,35 +136,58 @@ handle_nest_cancel:
        return -EMSGSIZE;
  }
  
@@ -102,7 +100,7 @@ index b1c65110f04d3..520cefdc3d908 100644
                goto nla_put_failure;
  
        genlmsg_end(msg, hdr);
-@@ -424,7 +447,7 @@ static void net_shaper_commit(struct net_shaper_binding *binding,
+@@ -422,7 +445,7 @@ static void net_shaper_commit(struct net
                /* Successful update: drop the tentative mark
                 * and update the hierarchy container.
                 */
@@ -111,6 +109,3 @@ index b1c65110f04d3..520cefdc3d908 100644
                smp_wmb();
                __xa_set_mark(&hierarchy->shapers, index, NET_SHAPER_VALID);
        }
--- 
-2.53.0
-
index c3d20670aae2cb527a38dc2c0e6aa50a78df1c40..982e58ed8d153537e4d56d95c0d785901128ccf5 100644 (file)
@@ -21,14 +21,12 @@ Link: https://patch.msgid.link/20260510192904.3987113-10-kuba@kernel.org
 Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 Signed-off-by: Sasha Levin <sashal@kernel.org>
 ---
- net/shaper/shaper.c | 6 ++++++
+ net/shaper/shaper.c |    6 ++++++
  1 file changed, 6 insertions(+)
 
-diff --git a/net/shaper/shaper.c b/net/shaper/shaper.c
-index eb049847fed65..4ae3ee6764a0a 100644
 --- a/net/shaper/shaper.c
 +++ b/net/shaper/shaper.c
-@@ -482,6 +482,12 @@ static int net_shaper_parse_handle(const struct nlattr *attr,
+@@ -480,6 +480,12 @@ static int net_shaper_parse_handle(const
        else if (handle->scope == NET_SHAPER_SCOPE_NODE)
                id = NET_SHAPER_ID_UNSPEC;
  
@@ -41,6 +39,3 @@ index eb049847fed65..4ae3ee6764a0a 100644
        handle->id = id;
        return 0;
  }
--- 
-2.53.0
-
index ea00919b2fe0f8fa09bb0fe11bfba23f074dafbf..31b6aa18d5947c75a1f1ff45b1744791a924f0d5 100644 (file)
@@ -25,14 +25,12 @@ Link: https://patch.msgid.link/20260510192904.3987113-11-kuba@kernel.org
 Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 Signed-off-by: Sasha Levin <sashal@kernel.org>
 ---
- net/shaper/shaper.c | 9 +++++++--
+ net/shaper/shaper.c |    9 +++++++--
  1 file changed, 7 insertions(+), 2 deletions(-)
 
-diff --git a/net/shaper/shaper.c b/net/shaper/shaper.c
-index 4ae3ee6764a0a..b1c65110f04d3 100644
 --- a/net/shaper/shaper.c
 +++ b/net/shaper/shaper.c
-@@ -477,10 +477,15 @@ static int net_shaper_parse_handle(const struct nlattr *attr,
+@@ -475,10 +475,15 @@ static int net_shaper_parse_handle(const
         * shaper (any other value).
         */
        id_attr = tb[NET_SHAPER_A_HANDLE_ID];
@@ -50,6 +48,3 @@ index 4ae3ee6764a0a..b1c65110f04d3 100644
  
        if (id && handle->scope == NET_SHAPER_SCOPE_NETDEV) {
                NL_SET_ERR_MSG_ATTR(info->extack, id_attr,
--- 
-2.53.0
-
index 642c33250b7f4f07a2c89b39aa550a0796e38fdf..33958bf1d85406d13ef6357478c7d5123365b7ea 100644 (file)
@@ -31,12 +31,10 @@ Link: https://patch.msgid.link/20260515221325.1685455-3-kuba@kernel.org
 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 Signed-off-by: Sasha Levin <sashal@kernel.org>
 ---
- include/net/net_shaper.h |  1 +
- net/shaper/shaper.c      | 45 ++++++++++++++++------------------------
+ include/net/net_shaper.h |    1 +
+ net/shaper/shaper.c      |   45 ++++++++++++++++++---------------------------
  2 files changed, 19 insertions(+), 27 deletions(-)
 
-diff --git a/include/net/net_shaper.h b/include/net/net_shaper.h
-index 5c3f49b52fe96..3939b816b0011 100644
 --- a/include/net/net_shaper.h
 +++ b/include/net/net_shaper.h
 @@ -53,6 +53,7 @@ struct net_shaper {
@@ -47,11 +45,9 @@ index 5c3f49b52fe96..3939b816b0011 100644
        struct rcu_head rcu;
  };
  
-diff --git a/net/shaper/shaper.c b/net/shaper/shaper.c
-index 520cefdc3d908..dea9270f3e57d 100644
 --- a/net/shaper/shaper.c
 +++ b/net/shaper/shaper.c
-@@ -306,31 +306,24 @@ static void net_shaper_default_parent(const struct net_shaper_handle *handle,
+@@ -304,31 +304,24 @@ static void net_shaper_default_parent(co
        parent->id = 0;
  }
  
@@ -91,7 +87,7 @@ index 520cefdc3d908..dea9270f3e57d 100644
  }
  
  /* Allocate on demand the per device shaper's hierarchy container.
-@@ -444,12 +437,10 @@ static void net_shaper_commit(struct net_shaper_binding *binding,
+@@ -442,12 +435,10 @@ static void net_shaper_commit(struct net
                if (WARN_ON_ONCE(!cur))
                        continue;
  
@@ -107,7 +103,7 @@ index 520cefdc3d908..dea9270f3e57d 100644
        }
        xa_unlock(&hierarchy->shapers);
  }
-@@ -466,10 +457,10 @@ static void net_shaper_rollback(struct net_shaper_binding *binding)
+@@ -464,10 +455,10 @@ static void net_shaper_rollback(struct n
  
        xa_lock(&hierarchy->shapers);
        xa_for_each(&hierarchy->shapers, index, cur) {
@@ -120,7 +116,7 @@ index 520cefdc3d908..dea9270f3e57d 100644
        }
        xa_unlock(&hierarchy->shapers);
  }
-@@ -882,12 +873,12 @@ int net_shaper_nl_get_dumpit(struct sk_buff *skb,
+@@ -880,12 +871,12 @@ int net_shaper_nl_get_dumpit(struct sk_b
                goto out_unlock;
  
        for (; (shaper = xa_find(&hierarchy->shapers, &ctx->start_index,
@@ -138,6 +134,3 @@ index 520cefdc3d908..dea9270f3e57d 100644
                ret = net_shaper_fill_one(skb, binding, shaper, info);
                if (ret)
                        break;
--- 
-2.53.0
-