Link: https://patch.msgid.link/20260414-unix-proto-update-null-ptr-deref-v4-2-2af6fe97918e@rbox.co
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
- net/unix/af_unix.c | 7 +++----
+ net/unix/af_unix.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
-diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
-index 99d80687998bd..f810c2b90b8b1 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
-@@ -3601,15 +3601,14 @@ static int bpf_iter_unix_seq_show(struct seq_file *seq, void *v)
+@@ -3598,15 +3598,14 @@ static int bpf_iter_unix_seq_show(struct
struct bpf_prog *prog;
struct sock *sk = v;
uid_t uid;
ret = SEQ_SKIP;
goto unlock;
}
-@@ -3619,7 +3618,7 @@ static int bpf_iter_unix_seq_show(struct seq_file *seq, void *v)
+@@ -3616,7 +3615,7 @@ static int bpf_iter_unix_seq_show(struct
prog = bpf_iter_get_info(&meta, false);
ret = unix_prog_seq_show(prog, &meta, v, uid);
unlock:
return ret;
}
---
-2.53.0
-
Link: https://patch.msgid.link/20260414-unix-proto-update-null-ptr-deref-v4-5-2af6fe97918e@rbox.co
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
- net/unix/af_unix.c | 2 ++
+ net/unix/af_unix.c | 2 ++
1 file changed, 2 insertions(+)
-diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
-index f810c2b90b8b1..8b0dc82fcdca3 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
-@@ -3607,6 +3607,7 @@ static int bpf_iter_unix_seq_show(struct seq_file *seq, void *v)
+@@ -3604,6 +3604,7 @@ static int bpf_iter_unix_seq_show(struct
return 0;
lock_sock(sk);
if (unlikely(sock_flag(sk, SOCK_DEAD))) {
ret = SEQ_SKIP;
-@@ -3618,6 +3619,7 @@ static int bpf_iter_unix_seq_show(struct seq_file *seq, void *v)
+@@ -3615,6 +3616,7 @@ static int bpf_iter_unix_seq_show(struct
prog = bpf_iter_get_info(&meta, false);
ret = unix_prog_seq_show(prog, &meta, v, uid);
unlock:
release_sock(sk);
return ret;
}
---
-2.53.0
-
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
- drivers/firmware/arm_ffa/driver.c | 3 ++-
+ drivers/firmware/arm_ffa/driver.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c
-index 521007bfa35a4..f35c3a56326c7 100644
--- a/drivers/firmware/arm_ffa/driver.c
+++ b/drivers/firmware/arm_ffa/driver.c
-@@ -1929,6 +1929,7 @@ static int __init ffa_init(void)
+@@ -1885,6 +1885,7 @@ static int __init ffa_init(void)
rxtx_bufsz = SZ_4K;
}
drv_info->rxtx_bufsz = rxtx_bufsz;
drv_info->rx_buffer = alloc_pages_exact(rxtx_bufsz, GFP_KERNEL);
if (!drv_info->rx_buffer) {
-@@ -1944,7 +1945,7 @@ static int __init ffa_init(void)
+@@ -1900,7 +1901,7 @@ static int __init ffa_init(void)
ret = ffa_rxtx_map(virt_to_phys(drv_info->tx_buffer),
virt_to_phys(drv_info->rx_buffer),
if (ret) {
pr_err("failed to register FFA RxTx buffers\n");
goto free_pages;
---
-2.53.0
-
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
- drivers/firmware/arm_ffa/driver.c | 6 +++---
+ drivers/firmware/arm_ffa/driver.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
-diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c
-index f35c3a56326c7..89474fa3c80e5 100644
--- a/drivers/firmware/arm_ffa/driver.c
+++ b/drivers/firmware/arm_ffa/driver.c
-@@ -1155,7 +1155,7 @@ static int
+@@ -1111,7 +1111,7 @@ static int
ffa_sched_recv_cb_update(struct ffa_device *dev, ffa_sched_recv_cb callback,
void *cb_data, bool is_registration)
{
struct list_head *phead;
bool cb_valid;
-@@ -1168,11 +1168,11 @@ ffa_sched_recv_cb_update(struct ffa_device *dev, ffa_sched_recv_cb callback,
+@@ -1124,11 +1124,11 @@ ffa_sched_recv_cb_update(struct ffa_devi
return -EINVAL;
}
pr_err("%s: No such partition ID 0x%x\n", __func__, dev->vm_id);
return -EINVAL;
}
---
-2.53.0
-
Stable-dep-of: b8d7519352ba ("net: shaper: rework the VALID marking (again)")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
- net/shaper/shaper.c | 53 ++++++++++++++++++++++++++++++++-------------
+ net/shaper/shaper.c | 53 +++++++++++++++++++++++++++++++++++++---------------
1 file changed, 38 insertions(+), 15 deletions(-)
-diff --git a/net/shaper/shaper.c b/net/shaper/shaper.c
-index 23d535f157294..a01de4392eb66 100644
--- a/net/shaper/shaper.c
+++ b/net/shaper/shaper.c
-@@ -138,35 +138,58 @@ static int net_shaper_fill_handle(struct sk_buff *msg,
+@@ -136,35 +136,58 @@ handle_nest_cancel:
return -EMSGSIZE;
}
goto nla_put_failure;
genlmsg_end(msg, hdr);
-@@ -424,7 +447,7 @@ static void net_shaper_commit(struct net_shaper_binding *binding,
+@@ -422,7 +445,7 @@ static void net_shaper_commit(struct net
/* Successful update: drop the tentative mark
* and update the hierarchy container.
*/
smp_wmb();
__xa_set_mark(&hierarchy->shapers, index, NET_SHAPER_VALID);
}
---
-2.53.0
-
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
- net/shaper/shaper.c | 6 ++++++
+ net/shaper/shaper.c | 6 ++++++
1 file changed, 6 insertions(+)
-diff --git a/net/shaper/shaper.c b/net/shaper/shaper.c
-index b2d85963243fa..d65008b819dc9 100644
--- a/net/shaper/shaper.c
+++ b/net/shaper/shaper.c
-@@ -482,6 +482,12 @@ static int net_shaper_parse_handle(const struct nlattr *attr,
+@@ -480,6 +480,12 @@ static int net_shaper_parse_handle(const
else if (handle->scope == NET_SHAPER_SCOPE_NODE)
id = NET_SHAPER_ID_UNSPEC;
handle->id = id;
return 0;
}
---
-2.53.0
-
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
- net/shaper/shaper.c | 9 +++++++--
+ net/shaper/shaper.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
-diff --git a/net/shaper/shaper.c b/net/shaper/shaper.c
-index d65008b819dc9..23d535f157294 100644
--- a/net/shaper/shaper.c
+++ b/net/shaper/shaper.c
-@@ -477,10 +477,15 @@ static int net_shaper_parse_handle(const struct nlattr *attr,
+@@ -475,10 +475,15 @@ static int net_shaper_parse_handle(const
* shaper (any other value).
*/
id_attr = tb[NET_SHAPER_A_HANDLE_ID];
if (id && handle->scope == NET_SHAPER_SCOPE_NETDEV) {
NL_SET_ERR_MSG_ATTR(info->extack, id_attr,
---
-2.53.0
-
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
- include/net/net_shaper.h | 1 +
- net/shaper/shaper.c | 45 ++++++++++++++++------------------------
+ include/net/net_shaper.h | 1 +
+ net/shaper/shaper.c | 45 ++++++++++++++++++---------------------------
2 files changed, 19 insertions(+), 27 deletions(-)
-diff --git a/include/net/net_shaper.h b/include/net/net_shaper.h
-index 5c3f49b52fe96..3939b816b0011 100644
--- a/include/net/net_shaper.h
+++ b/include/net/net_shaper.h
@@ -53,6 +53,7 @@ struct net_shaper {
struct rcu_head rcu;
};
-diff --git a/net/shaper/shaper.c b/net/shaper/shaper.c
-index a01de4392eb66..f992b28e19fd6 100644
--- a/net/shaper/shaper.c
+++ b/net/shaper/shaper.c
-@@ -306,31 +306,24 @@ static void net_shaper_default_parent(const struct net_shaper_handle *handle,
+@@ -304,31 +304,24 @@ static void net_shaper_default_parent(co
parent->id = 0;
}
}
/* Allocate on demand the per device shaper's hierarchy container.
-@@ -444,12 +437,10 @@ static void net_shaper_commit(struct net_shaper_binding *binding,
+@@ -442,12 +435,10 @@ static void net_shaper_commit(struct net
if (WARN_ON_ONCE(!cur))
continue;
}
xa_unlock(&hierarchy->shapers);
}
-@@ -466,10 +457,10 @@ static void net_shaper_rollback(struct net_shaper_binding *binding)
+@@ -464,10 +455,10 @@ static void net_shaper_rollback(struct n
xa_lock(&hierarchy->shapers);
xa_for_each(&hierarchy->shapers, index, cur) {
}
xa_unlock(&hierarchy->shapers);
}
-@@ -882,12 +873,12 @@ int net_shaper_nl_get_dumpit(struct sk_buff *skb,
+@@ -880,12 +871,12 @@ int net_shaper_nl_get_dumpit(struct sk_b
goto out_unlock;
for (; (shaper = xa_find(&hierarchy->shapers, &ctx->start_index,
ret = net_shaper_fill_one(skb, binding, shaper, info);
if (ret)
break;
---
-2.53.0
-
Stable-dep-of: b8d7519352ba ("net: shaper: rework the VALID marking (again)")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
- net/shaper/shaper.c | 53 ++++++++++++++++++++++++++++++++-------------
+ net/shaper/shaper.c | 53 +++++++++++++++++++++++++++++++++++++---------------
1 file changed, 38 insertions(+), 15 deletions(-)
-diff --git a/net/shaper/shaper.c b/net/shaper/shaper.c
-index b1c65110f04d3..520cefdc3d908 100644
--- a/net/shaper/shaper.c
+++ b/net/shaper/shaper.c
-@@ -138,35 +138,58 @@ static int net_shaper_fill_handle(struct sk_buff *msg,
+@@ -136,35 +136,58 @@ handle_nest_cancel:
return -EMSGSIZE;
}
goto nla_put_failure;
genlmsg_end(msg, hdr);
-@@ -424,7 +447,7 @@ static void net_shaper_commit(struct net_shaper_binding *binding,
+@@ -422,7 +445,7 @@ static void net_shaper_commit(struct net
/* Successful update: drop the tentative mark
* and update the hierarchy container.
*/
smp_wmb();
__xa_set_mark(&hierarchy->shapers, index, NET_SHAPER_VALID);
}
---
-2.53.0
-
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
- net/shaper/shaper.c | 6 ++++++
+ net/shaper/shaper.c | 6 ++++++
1 file changed, 6 insertions(+)
-diff --git a/net/shaper/shaper.c b/net/shaper/shaper.c
-index eb049847fed65..4ae3ee6764a0a 100644
--- a/net/shaper/shaper.c
+++ b/net/shaper/shaper.c
-@@ -482,6 +482,12 @@ static int net_shaper_parse_handle(const struct nlattr *attr,
+@@ -480,6 +480,12 @@ static int net_shaper_parse_handle(const
else if (handle->scope == NET_SHAPER_SCOPE_NODE)
id = NET_SHAPER_ID_UNSPEC;
handle->id = id;
return 0;
}
---
-2.53.0
-
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
- net/shaper/shaper.c | 9 +++++++--
+ net/shaper/shaper.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
-diff --git a/net/shaper/shaper.c b/net/shaper/shaper.c
-index 4ae3ee6764a0a..b1c65110f04d3 100644
--- a/net/shaper/shaper.c
+++ b/net/shaper/shaper.c
-@@ -477,10 +477,15 @@ static int net_shaper_parse_handle(const struct nlattr *attr,
+@@ -475,10 +475,15 @@ static int net_shaper_parse_handle(const
* shaper (any other value).
*/
id_attr = tb[NET_SHAPER_A_HANDLE_ID];
if (id && handle->scope == NET_SHAPER_SCOPE_NETDEV) {
NL_SET_ERR_MSG_ATTR(info->extack, id_attr,
---
-2.53.0
-
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
- include/net/net_shaper.h | 1 +
- net/shaper/shaper.c | 45 ++++++++++++++++------------------------
+ include/net/net_shaper.h | 1 +
+ net/shaper/shaper.c | 45 ++++++++++++++++++---------------------------
2 files changed, 19 insertions(+), 27 deletions(-)
-diff --git a/include/net/net_shaper.h b/include/net/net_shaper.h
-index 5c3f49b52fe96..3939b816b0011 100644
--- a/include/net/net_shaper.h
+++ b/include/net/net_shaper.h
@@ -53,6 +53,7 @@ struct net_shaper {
struct rcu_head rcu;
};
-diff --git a/net/shaper/shaper.c b/net/shaper/shaper.c
-index 520cefdc3d908..dea9270f3e57d 100644
--- a/net/shaper/shaper.c
+++ b/net/shaper/shaper.c
-@@ -306,31 +306,24 @@ static void net_shaper_default_parent(const struct net_shaper_handle *handle,
+@@ -304,31 +304,24 @@ static void net_shaper_default_parent(co
parent->id = 0;
}
}
/* Allocate on demand the per device shaper's hierarchy container.
-@@ -444,12 +437,10 @@ static void net_shaper_commit(struct net_shaper_binding *binding,
+@@ -442,12 +435,10 @@ static void net_shaper_commit(struct net
if (WARN_ON_ONCE(!cur))
continue;
}
xa_unlock(&hierarchy->shapers);
}
-@@ -466,10 +457,10 @@ static void net_shaper_rollback(struct net_shaper_binding *binding)
+@@ -464,10 +455,10 @@ static void net_shaper_rollback(struct n
xa_lock(&hierarchy->shapers);
xa_for_each(&hierarchy->shapers, index, cur) {
}
xa_unlock(&hierarchy->shapers);
}
-@@ -882,12 +873,12 @@ int net_shaper_nl_get_dumpit(struct sk_buff *skb,
+@@ -880,12 +871,12 @@ int net_shaper_nl_get_dumpit(struct sk_b
goto out_unlock;
for (; (shaper = xa_find(&hierarchy->shapers, &ctx->start_index,
ret = net_shaper_fill_one(skb, binding, shaper, info);
if (ret)
break;
---
-2.53.0
-