From: Greg Kroah-Hartman Date: Wed, 29 Jul 2026 15:51:30 +0000 (+0200) Subject: drop already applied patch from queues X-Git-Tag: v5.10.262~21 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=97ae2386b45f04e0f1dc86b2f45a38f1cfce38c8;p=thirdparty%2Fkernel%2Fstable-queue.git drop already applied patch from queues --- diff --git a/queue-6.1/mm-refactor-mm_access-to-not-return-null.patch b/queue-6.1/mm-refactor-mm_access-to-not-return-null.patch deleted file mode 100644 index 888428c747..0000000000 --- a/queue-6.1/mm-refactor-mm_access-to-not-return-null.patch +++ /dev/null @@ -1,132 +0,0 @@ -From 5309c17af0356d024321c89ff6c1771737e0c2cf Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 24 Sep 2024 21:10:23 +0100 -Subject: mm: refactor mm_access() to not return NULL - -From: Lorenzo Stoakes - -[ Upstream commit cd3f8467afd470ccab0de2fbc7c76664af4a0bac ] - -mm_access() can return NULL if the mm is not found, but this is handled -the same as an error in all callers, with some translating this into an --ESRCH error. - -Only proc_mem_open() returns NULL if no mm is found, however in this case -it is clearer and makes more sense to explicitly handle the error. -Additionally we take the opportunity to refactor the function to eliminate -unnecessary nesting. - -Simplify things by simply returning -ESRCH if no mm is found - this both -eliminates confusing use of the IS_ERR_OR_NULL() macro, and simplifies -callers which would return -ESRCH by returning this error directly. - -[lorenzo.stoakes@oracle.com: prefer neater pointer error comparison] - Link: https://lkml.kernel.org/r/2fae1834-749a-45e1-8594-5e5979cf7103@lucifer.local -Link: https://lkml.kernel.org/r/20240924201023.193135-1-lorenzo.stoakes@oracle.com -Signed-off-by: Lorenzo Stoakes -Suggested-by: Arnd Bergmann -Cc: Al Viro -Signed-off-by: Andrew Morton -Signed-off-by: Sasha Levin ---- - fs/proc/base.c | 26 ++++++++++++++------------ - kernel/fork.c | 5 +++-- - mm/madvise.c | 4 ++-- - mm/process_vm_access.c | 4 ++-- - 4 files changed, 21 insertions(+), 18 deletions(-) - -diff --git a/fs/proc/base.c b/fs/proc/base.c -index b89e6fbf23266c..6f24023b64f31e 100644 ---- a/fs/proc/base.c -+++ b/fs/proc/base.c -@@ -811,19 +811,21 @@ static const struct file_operations proc_single_file_operations = { - struct mm_struct *proc_mem_open(struct inode *inode, unsigned int mode) - { - struct task_struct *task = get_proc_task(inode); -- struct mm_struct *mm = ERR_PTR(-ESRCH); -+ struct mm_struct *mm; - -- if (task) { -- mm = mm_access(task, mode | PTRACE_MODE_FSCREDS); -- put_task_struct(task); -+ if (!task) -+ return ERR_PTR(-ESRCH); - -- if (!IS_ERR_OR_NULL(mm)) { -- /* ensure this mm_struct can't be freed */ -- mmgrab(mm); -- /* but do not pin its memory */ -- mmput(mm); -- } -- } -+ mm = mm_access(task, mode | PTRACE_MODE_FSCREDS); -+ put_task_struct(task); -+ -+ if (IS_ERR(mm)) -+ return mm == ERR_PTR(-ESRCH) ? NULL : mm; -+ -+ /* ensure this mm_struct can't be freed */ -+ mmgrab(mm); -+ /* but do not pin its memory */ -+ mmput(mm); - - return mm; - } -@@ -2201,7 +2203,7 @@ static int map_files_d_revalidate(struct dentry *dentry, unsigned int flags) - goto out_notask; - - mm = mm_access(task, PTRACE_MODE_READ_FSCREDS); -- if (IS_ERR_OR_NULL(mm)) -+ if (IS_ERR(mm)) - goto out; - - if (!dname_to_vma_addr(dentry, &vm_start, &vm_end)) { -diff --git a/kernel/fork.c b/kernel/fork.c -index db2a9016f636f4..63f56a292f756a 100644 ---- a/kernel/fork.c -+++ b/kernel/fork.c -@@ -1418,8 +1418,9 @@ struct mm_struct *mm_access(struct task_struct *task, unsigned int mode) - return ERR_PTR(err); - - mm = get_task_mm(task); -- if (mm && mm != current->mm && -- !ptrace_may_access(task, mode)) { -+ if (!mm) { -+ mm = ERR_PTR(-ESRCH); -+ } else if (mm != current->mm && !ptrace_may_access(task, mode)) { - mmput(mm); - mm = ERR_PTR(-EACCES); - } -diff --git a/mm/madvise.c b/mm/madvise.c -index 06c5adcaec5955..a3a3a423e9510c 100644 ---- a/mm/madvise.c -+++ b/mm/madvise.c -@@ -1485,8 +1485,8 @@ SYSCALL_DEFINE5(process_madvise, int, pidfd, const struct iovec __user *, vec, - - /* Require PTRACE_MODE_READ to avoid leaking ASLR metadata. */ - mm = mm_access(task, PTRACE_MODE_READ_FSCREDS); -- if (IS_ERR_OR_NULL(mm)) { -- ret = IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH; -+ if (IS_ERR(mm)) { -+ ret = PTR_ERR(mm); - goto release_task; - } - -diff --git a/mm/process_vm_access.c b/mm/process_vm_access.c -index 78dfaf9e8990af..025cba94e63ff3 100644 ---- a/mm/process_vm_access.c -+++ b/mm/process_vm_access.c -@@ -200,8 +200,8 @@ static ssize_t process_vm_rw_core(pid_t pid, struct iov_iter *iter, - } - - mm = mm_access(task, PTRACE_MODE_ATTACH_REALCREDS); -- if (!mm || IS_ERR(mm)) { -- rc = IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH; -+ if (IS_ERR(mm)) { -+ rc = PTR_ERR(mm); - /* - * Explicitly map EACCES to EPERM as EPERM is a more - * appropriate error code for process_vw_readv/writev --- -2.53.0 - diff --git a/queue-6.1/series b/queue-6.1/series index fade0a61ae..a891659a4e 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -21,7 +21,6 @@ gpu-host1x-fix-use-after-free-in-host1x_bo_clear_cac.patch xprtrdma-clear-receive-side-ownership-pointers-on-re.patch input-ims-pcu-fix-heap-buffer-overflow-in-ims_pcu_pr.patch input-ims-pcu-fix-logic-error-in-packet-reset.patch -mm-refactor-mm_access-to-not-return-null.patch arm64-tegra-fix-cpu-compatible-string-to-cortex-a78a.patch ib-mad-drop-unmatched-rmpp-responses-before-reassemb.patch mtd-mtdswap-remove-debugfs-stats-file-on-teardown.patch diff --git a/queue-6.12/mm-refactor-mm_access-to-not-return-null.patch b/queue-6.12/mm-refactor-mm_access-to-not-return-null.patch deleted file mode 100644 index aa7bee6bbb..0000000000 --- a/queue-6.12/mm-refactor-mm_access-to-not-return-null.patch +++ /dev/null @@ -1,132 +0,0 @@ -From 7e51752907c9bd2ed0203b7bec215834b16c11ce Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 24 Sep 2024 21:10:23 +0100 -Subject: mm: refactor mm_access() to not return NULL - -From: Lorenzo Stoakes - -[ Upstream commit cd3f8467afd470ccab0de2fbc7c76664af4a0bac ] - -mm_access() can return NULL if the mm is not found, but this is handled -the same as an error in all callers, with some translating this into an --ESRCH error. - -Only proc_mem_open() returns NULL if no mm is found, however in this case -it is clearer and makes more sense to explicitly handle the error. -Additionally we take the opportunity to refactor the function to eliminate -unnecessary nesting. - -Simplify things by simply returning -ESRCH if no mm is found - this both -eliminates confusing use of the IS_ERR_OR_NULL() macro, and simplifies -callers which would return -ESRCH by returning this error directly. - -[lorenzo.stoakes@oracle.com: prefer neater pointer error comparison] - Link: https://lkml.kernel.org/r/2fae1834-749a-45e1-8594-5e5979cf7103@lucifer.local -Link: https://lkml.kernel.org/r/20240924201023.193135-1-lorenzo.stoakes@oracle.com -Signed-off-by: Lorenzo Stoakes -Suggested-by: Arnd Bergmann -Cc: Al Viro -Signed-off-by: Andrew Morton -Signed-off-by: Sasha Levin ---- - fs/proc/base.c | 26 ++++++++++++++------------ - kernel/fork.c | 5 +++-- - mm/madvise.c | 4 ++-- - mm/process_vm_access.c | 4 ++-- - 4 files changed, 21 insertions(+), 18 deletions(-) - -diff --git a/fs/proc/base.c b/fs/proc/base.c -index 9f032236849783..427fb5abb07c7c 100644 ---- a/fs/proc/base.c -+++ b/fs/proc/base.c -@@ -817,19 +817,21 @@ static const struct file_operations proc_single_file_operations = { - struct mm_struct *proc_mem_open(struct inode *inode, unsigned int mode) - { - struct task_struct *task = get_proc_task(inode); -- struct mm_struct *mm = ERR_PTR(-ESRCH); -+ struct mm_struct *mm; - -- if (task) { -- mm = mm_access(task, mode | PTRACE_MODE_FSCREDS); -- put_task_struct(task); -+ if (!task) -+ return ERR_PTR(-ESRCH); - -- if (!IS_ERR_OR_NULL(mm)) { -- /* ensure this mm_struct can't be freed */ -- mmgrab(mm); -- /* but do not pin its memory */ -- mmput(mm); -- } -- } -+ mm = mm_access(task, mode | PTRACE_MODE_FSCREDS); -+ put_task_struct(task); -+ -+ if (IS_ERR(mm)) -+ return mm == ERR_PTR(-ESRCH) ? NULL : mm; -+ -+ /* ensure this mm_struct can't be freed */ -+ mmgrab(mm); -+ /* but do not pin its memory */ -+ mmput(mm); - - return mm; - } -@@ -2199,7 +2201,7 @@ static int map_files_d_revalidate(struct dentry *dentry, unsigned int flags) - goto out_notask; - - mm = mm_access(task, PTRACE_MODE_READ_FSCREDS); -- if (IS_ERR_OR_NULL(mm)) -+ if (IS_ERR(mm)) - goto out; - - if (!dname_to_vma_addr(dentry, &vm_start, &vm_end)) { -diff --git a/kernel/fork.c b/kernel/fork.c -index 6191f1f8bde86d..2b7577edffa2da 100644 ---- a/kernel/fork.c -+++ b/kernel/fork.c -@@ -1580,8 +1580,9 @@ struct mm_struct *mm_access(struct task_struct *task, unsigned int mode) - return ERR_PTR(err); - - mm = get_task_mm(task); -- if (mm && mm != current->mm && -- !ptrace_may_access(task, mode)) { -+ if (!mm) { -+ mm = ERR_PTR(-ESRCH); -+ } else if (mm != current->mm && !ptrace_may_access(task, mode)) { - mmput(mm); - mm = ERR_PTR(-EACCES); - } -diff --git a/mm/madvise.c b/mm/madvise.c -index 4a3b609a33e60d..d2b315993a1c01 100644 ---- a/mm/madvise.c -+++ b/mm/madvise.c -@@ -1521,8 +1521,8 @@ SYSCALL_DEFINE5(process_madvise, int, pidfd, const struct iovec __user *, vec, - - /* Require PTRACE_MODE_READ to avoid leaking ASLR metadata. */ - mm = mm_access(task, PTRACE_MODE_READ_FSCREDS); -- if (IS_ERR_OR_NULL(mm)) { -- ret = IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH; -+ if (IS_ERR(mm)) { -+ ret = PTR_ERR(mm); - goto release_task; - } - -diff --git a/mm/process_vm_access.c b/mm/process_vm_access.c -index b308e96cd05a28..656d3e88755b6f 100644 ---- a/mm/process_vm_access.c -+++ b/mm/process_vm_access.c -@@ -201,8 +201,8 @@ static ssize_t process_vm_rw_core(pid_t pid, struct iov_iter *iter, - } - - mm = mm_access(task, PTRACE_MODE_ATTACH_REALCREDS); -- if (!mm || IS_ERR(mm)) { -- rc = IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH; -+ if (IS_ERR(mm)) { -+ rc = PTR_ERR(mm); - /* - * Explicitly map EACCES to EPERM as EPERM is a more - * appropriate error code for process_vw_readv/writev --- -2.53.0 - diff --git a/queue-6.12/series b/queue-6.12/series index 0effd30807..f3bc197642 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -33,7 +33,6 @@ xprtrdma-clear-receive-side-ownership-pointers-on-re.patch input-ims-pcu-fix-heap-buffer-overflow-in-ims_pcu_pr.patch input-ims-pcu-fix-logic-error-in-packet-reset.patch soc-qcom-ice-allow-explicit-votes-on-iface-clock-for.patch -mm-refactor-mm_access-to-not-return-null.patch posix-cpu-timers-prevent-uaf-caused-by-non-leader-ex.patch arm64-tegra-fix-cpu-compatible-string-to-cortex-a78a.patch firmware-arm_ffa-respect-firmware-advertised-rx-tx-b.patch diff --git a/queue-6.6/mm-refactor-mm_access-to-not-return-null.patch b/queue-6.6/mm-refactor-mm_access-to-not-return-null.patch deleted file mode 100644 index 88bdb6857a..0000000000 --- a/queue-6.6/mm-refactor-mm_access-to-not-return-null.patch +++ /dev/null @@ -1,132 +0,0 @@ -From f99ae878d27857cf473a19743d6a59f22b22506e Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 24 Sep 2024 21:10:23 +0100 -Subject: mm: refactor mm_access() to not return NULL - -From: Lorenzo Stoakes - -[ Upstream commit cd3f8467afd470ccab0de2fbc7c76664af4a0bac ] - -mm_access() can return NULL if the mm is not found, but this is handled -the same as an error in all callers, with some translating this into an --ESRCH error. - -Only proc_mem_open() returns NULL if no mm is found, however in this case -it is clearer and makes more sense to explicitly handle the error. -Additionally we take the opportunity to refactor the function to eliminate -unnecessary nesting. - -Simplify things by simply returning -ESRCH if no mm is found - this both -eliminates confusing use of the IS_ERR_OR_NULL() macro, and simplifies -callers which would return -ESRCH by returning this error directly. - -[lorenzo.stoakes@oracle.com: prefer neater pointer error comparison] - Link: https://lkml.kernel.org/r/2fae1834-749a-45e1-8594-5e5979cf7103@lucifer.local -Link: https://lkml.kernel.org/r/20240924201023.193135-1-lorenzo.stoakes@oracle.com -Signed-off-by: Lorenzo Stoakes -Suggested-by: Arnd Bergmann -Cc: Al Viro -Signed-off-by: Andrew Morton -Signed-off-by: Sasha Levin ---- - fs/proc/base.c | 26 ++++++++++++++------------ - kernel/fork.c | 5 +++-- - mm/madvise.c | 4 ++-- - mm/process_vm_access.c | 4 ++-- - 4 files changed, 21 insertions(+), 18 deletions(-) - -diff --git a/fs/proc/base.c b/fs/proc/base.c -index da5c436ea36fd6..881c2d4846d7ce 100644 ---- a/fs/proc/base.c -+++ b/fs/proc/base.c -@@ -811,19 +811,21 @@ static const struct file_operations proc_single_file_operations = { - struct mm_struct *proc_mem_open(struct inode *inode, unsigned int mode) - { - struct task_struct *task = get_proc_task(inode); -- struct mm_struct *mm = ERR_PTR(-ESRCH); -+ struct mm_struct *mm; - -- if (task) { -- mm = mm_access(task, mode | PTRACE_MODE_FSCREDS); -- put_task_struct(task); -+ if (!task) -+ return ERR_PTR(-ESRCH); - -- if (!IS_ERR_OR_NULL(mm)) { -- /* ensure this mm_struct can't be freed */ -- mmgrab(mm); -- /* but do not pin its memory */ -- mmput(mm); -- } -- } -+ mm = mm_access(task, mode | PTRACE_MODE_FSCREDS); -+ put_task_struct(task); -+ -+ if (IS_ERR(mm)) -+ return mm == ERR_PTR(-ESRCH) ? NULL : mm; -+ -+ /* ensure this mm_struct can't be freed */ -+ mmgrab(mm); -+ /* but do not pin its memory */ -+ mmput(mm); - - return mm; - } -@@ -2201,7 +2203,7 @@ static int map_files_d_revalidate(struct dentry *dentry, unsigned int flags) - goto out_notask; - - mm = mm_access(task, PTRACE_MODE_READ_FSCREDS); -- if (IS_ERR_OR_NULL(mm)) -+ if (IS_ERR(mm)) - goto out; - - if (!dname_to_vma_addr(dentry, &vm_start, &vm_end)) { -diff --git a/kernel/fork.c b/kernel/fork.c -index 724040ac589501..36854aaec482d6 100644 ---- a/kernel/fork.c -+++ b/kernel/fork.c -@@ -1570,8 +1570,9 @@ struct mm_struct *mm_access(struct task_struct *task, unsigned int mode) - return ERR_PTR(err); - - mm = get_task_mm(task); -- if (mm && mm != current->mm && -- !ptrace_may_access(task, mode)) { -+ if (!mm) { -+ mm = ERR_PTR(-ESRCH); -+ } else if (mm != current->mm && !ptrace_may_access(task, mode)) { - mmput(mm); - mm = ERR_PTR(-EACCES); - } -diff --git a/mm/madvise.c b/mm/madvise.c -index 73ea053c9003ab..0c30710bfd859f 100644 ---- a/mm/madvise.c -+++ b/mm/madvise.c -@@ -1492,8 +1492,8 @@ SYSCALL_DEFINE5(process_madvise, int, pidfd, const struct iovec __user *, vec, - - /* Require PTRACE_MODE_READ to avoid leaking ASLR metadata. */ - mm = mm_access(task, PTRACE_MODE_READ_FSCREDS); -- if (IS_ERR_OR_NULL(mm)) { -- ret = IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH; -+ if (IS_ERR(mm)) { -+ ret = PTR_ERR(mm); - goto release_task; - } - -diff --git a/mm/process_vm_access.c b/mm/process_vm_access.c -index 0523edab03a6a5..5be8e91aa87209 100644 ---- a/mm/process_vm_access.c -+++ b/mm/process_vm_access.c -@@ -200,8 +200,8 @@ static ssize_t process_vm_rw_core(pid_t pid, struct iov_iter *iter, - } - - mm = mm_access(task, PTRACE_MODE_ATTACH_REALCREDS); -- if (!mm || IS_ERR(mm)) { -- rc = IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH; -+ if (IS_ERR(mm)) { -+ rc = PTR_ERR(mm); - /* - * Explicitly map EACCES to EPERM as EPERM is a more - * appropriate error code for process_vw_readv/writev --- -2.53.0 - diff --git a/queue-6.6/series b/queue-6.6/series index 20ea501d32..43007187ee 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -26,7 +26,6 @@ gpu-host1x-fix-use-after-free-in-host1x_bo_clear_cac.patch xprtrdma-clear-receive-side-ownership-pointers-on-re.patch input-ims-pcu-fix-heap-buffer-overflow-in-ims_pcu_pr.patch input-ims-pcu-fix-logic-error-in-packet-reset.patch -mm-refactor-mm_access-to-not-return-null.patch arm64-tegra-fix-cpu-compatible-string-to-cortex-a78a.patch ib-mad-drop-unmatched-rmpp-responses-before-reassemb.patch mtd-mtdswap-remove-debugfs-stats-file-on-teardown.patch