+++ /dev/null
-From 07c3527b8992a1420bece74d82ab34287bb31bfb Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 17 Apr 2026 07:33:52 -0700
-Subject: bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT
-
-From: Puranjay Mohan <puranjay@kernel.org>
-
-[ Upstream commit e1d486445af3c392628532229f7ce5f5cf7891b6 ]
-
-The ARM32 BPF JIT does not support BPF-to-BPF function calls
-(BPF_PSEUDO_CALL) or callbacks (BPF_PSEUDO_FUNC), but it does
-not reject them either.
-
-When a program with subprograms is loaded (e.g. libxdp's XDP
-dispatcher uses __noinline__ subprograms, or any program using
-callbacks like bpf_loop or bpf_for_each_map_elem), the verifier
-invokes bpf_jit_subprogs() which calls bpf_int_jit_compile()
-for each subprogram.
-
-For BPF_PSEUDO_CALL, since ARM32 does not reject it, the JIT
-silently emits code using the wrong address computation:
-
- func = __bpf_call_base + imm
-
-where imm is a pc-relative subprogram offset, producing a bogus
-function pointer.
-
-For BPF_PSEUDO_FUNC, the ldimm64 handler ignores src_reg and
-loads the immediate as a normal 64-bit value without error.
-
-In both cases, build_body() reports success and a JIT image is
-allocated. ARM32 lacks the jit_data/extra_pass mechanism needed
-for the second JIT pass in bpf_jit_subprogs(). On the second
-pass, bpf_int_jit_compile() performs a full fresh compilation,
-allocating a new JIT binary and overwriting prog->bpf_func. The
-first allocation is never freed. bpf_jit_subprogs() then detects
-the function pointer changed and aborts with -ENOTSUPP, but the
-original JIT binary has already been leaked. Each program
-load/unload cycle leaks one JIT binary allocation, as reported
-by kmemleak:
-
- unreferenced object 0xbf0a1000 (size 4096):
- backtrace:
- bpf_jit_binary_alloc+0x64/0xfc
- bpf_int_jit_compile+0x14c/0x348
- bpf_jit_subprogs+0x4fc/0xa60
-
-Fix this by rejecting both BPF_PSEUDO_CALL in the BPF_CALL
-handler and BPF_PSEUDO_FUNC in the BPF_LD_IMM64 handler, falling
-through to the existing 'notyet' path. This causes build_body()
-to fail before any JIT binary is allocated, so
-bpf_int_jit_compile() returns the original program unjitted.
-bpf_jit_subprogs() then sees !prog->jited and cleanly falls
-back to the interpreter with no leak.
-
-Acked-by: Daniel Borkmann <daniel@iogearbox.net>
-Fixes: 1c2a088a6626 ("bpf: x64: add JIT support for multi-function programs")
-Reported-by: Jonas Rebmann <jre@pengutronix.de>
-Closes: https://lore.kernel.org/bpf/b63e9174-7a3d-4e22-8294-16df07a4af89@pengutronix.de
-Tested-by: Jonas Rebmann <jre@pengutronix.de>
-Signed-off-by: Puranjay Mohan <puranjay@kernel.org>
-Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
-Link: https://lore.kernel.org/r/20260417143353.838911-1-puranjay@kernel.org
-Signed-off-by: Alexei Starovoitov <ast@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/arm/net/bpf_jit_32.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c
-index 1214e39aad5ec..1b3cccd1060bb 100644
---- a/arch/arm/net/bpf_jit_32.c
-+++ b/arch/arm/net/bpf_jit_32.c
-@@ -1609,6 +1609,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
- {
- u64 val = (u32)imm | (u64)insn[1].imm << 32;
-
-+ if (insn->src_reg == BPF_PSEUDO_FUNC)
-+ goto notyet;
-+
- emit_a32_mov_i64(dst, val, ctx);
-
- return 1;
-@@ -1801,6 +1804,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
- const s8 *r5 = bpf2a32[BPF_REG_5];
- const u32 func = (u32)__bpf_call_base + (u32)imm;
-
-+ if (insn->src_reg == BPF_PSEUDO_CALL)
-+ goto notyet;
-+
- emit_a32_mov_r64(true, r0, r1, ctx);
- emit_a32_mov_r64(true, r1, r2, ctx);
- emit_push_r64(r5, ctx);
---
-2.53.0
-
+++ /dev/null
-From 9535774e6286d4a9510ed9dcd42bde4fb5709275 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 16 Feb 2026 19:48:01 -0600
-Subject: drm/sun4i: backend: fix error pointer dereference
-
-From: Ethan Tidmore <ethantidmore06@gmail.com>
-
-[ Upstream commit 06277983eca4a31d3c2114fa33d99a6e82484b11 ]
-
-The function drm_atomic_get_plane_state() can return an error pointer
-and is not checked for it. Add error pointer check.
-
-Detected by Smatch:
-drivers/gpu/drm/sun4i/sun4i_backend.c:496 sun4i_backend_atomic_check() error:
-'plane_state' dereferencing possible ERR_PTR()
-
-Fixes: 96180dde23b79 ("drm/sun4i: backend: Add a custom atomic_check for the frontend")
-Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
-Reviewed-by: Chen-Yu Tsai <wens@kernel.org>
-Link: https://patch.msgid.link/20260217014801.60760-1-ethantidmore06@gmail.com
-Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/sun4i/sun4i_backend.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/drivers/gpu/drm/sun4i/sun4i_backend.c b/drivers/gpu/drm/sun4i/sun4i_backend.c
-index 55960cbb10190..c65b10d413879 100644
---- a/drivers/gpu/drm/sun4i/sun4i_backend.c
-+++ b/drivers/gpu/drm/sun4i/sun4i_backend.c
-@@ -507,6 +507,9 @@ static int sun4i_backend_atomic_check(struct sunxi_engine *engine,
- drm_for_each_plane_mask(plane, drm, crtc_state->plane_mask) {
- struct drm_plane_state *plane_state =
- drm_atomic_get_plane_state(state, plane);
-+ if (IS_ERR(plane_state))
-+ return PTR_ERR(plane_state);
-+
- struct sun4i_layer_state *layer_state =
- state_to_sun4i_layer_state(plane_state);
- struct drm_framebuffer *fb = plane_state->fb;
---
-2.53.0
-
bluetooth-fix-locking-in-hci_conn_request_evt-with-h.patch
bluetooth-l2cap-add-missing-chan-lock-in-l2cap_ecred.patch
drm-komeda-fix-integer-overflow-in-afbc-framebuffer-.patch
-drm-sun4i-backend-fix-error-pointer-dereference.patch
asoc-sti-return-errors-from-regmap_field_alloc.patch
asoc-sti-use-managed-regmap_field-allocations.patch
dm-cache-fix-null-deref-with-concurrent-writes-in-pa.patch
mtd-rawnand-sunxi-fix-sunxi_nfc_hw_ecc_read_extra_oo.patch
hid-usbhid-fix-deadlock-in-hid_post_reset.patch
bpf-fix-precedence-bug-in-convert_bpf_ld_abs-alignme.patch
-bpf-arm32-reject-bpf-to-bpf-calls-and-callbacks-in-t.patch
pinctrl-pinctrl-pic32-fix-resource-leak.patch
perf-branch-avoid-incrementing-null.patch
pinctrl-abx500-fix-type-of-argument-variable.patch
+++ /dev/null
-From a8491e16159dce18953983ea2bdac642afb1849d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 16 Feb 2026 19:48:01 -0600
-Subject: drm/sun4i: backend: fix error pointer dereference
-
-From: Ethan Tidmore <ethantidmore06@gmail.com>
-
-[ Upstream commit 06277983eca4a31d3c2114fa33d99a6e82484b11 ]
-
-The function drm_atomic_get_plane_state() can return an error pointer
-and is not checked for it. Add error pointer check.
-
-Detected by Smatch:
-drivers/gpu/drm/sun4i/sun4i_backend.c:496 sun4i_backend_atomic_check() error:
-'plane_state' dereferencing possible ERR_PTR()
-
-Fixes: 96180dde23b79 ("drm/sun4i: backend: Add a custom atomic_check for the frontend")
-Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
-Reviewed-by: Chen-Yu Tsai <wens@kernel.org>
-Link: https://patch.msgid.link/20260217014801.60760-1-ethantidmore06@gmail.com
-Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/sun4i/sun4i_backend.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/drivers/gpu/drm/sun4i/sun4i_backend.c b/drivers/gpu/drm/sun4i/sun4i_backend.c
-index bf8cfefa03652..a812de372437b 100644
---- a/drivers/gpu/drm/sun4i/sun4i_backend.c
-+++ b/drivers/gpu/drm/sun4i/sun4i_backend.c
-@@ -507,6 +507,9 @@ static int sun4i_backend_atomic_check(struct sunxi_engine *engine,
- drm_for_each_plane_mask(plane, drm, crtc_state->plane_mask) {
- struct drm_plane_state *plane_state =
- drm_atomic_get_plane_state(state, plane);
-+ if (IS_ERR(plane_state))
-+ return PTR_ERR(plane_state);
-+
- struct sun4i_layer_state *layer_state =
- state_to_sun4i_layer_state(plane_state);
- struct drm_framebuffer *fb = plane_state->fb;
---
-2.53.0
-
sctp-fix-missing-encap_port-propagation-for-gso-frag.patch
net-bpf-fix-null-ptr-deref-in-xdp_master_redirect-fo.patch
drm-komeda-fix-integer-overflow-in-afbc-framebuffer-.patch
-drm-sun4i-backend-fix-error-pointer-dereference.patch
asoc-sti-return-errors-from-regmap_field_alloc.patch
asoc-sti-use-managed-regmap_field-allocations.patch
dm-cache-fix-null-deref-with-concurrent-writes-in-pa.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
