From: Sasha Levin Date: Sat, 30 May 2026 15:01:34 +0000 (-0400) Subject: drop 2 patches based on RC review feedback X-Git-Tag: v5.10.258~5 X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=d859edcbdb5df4b876ab1182a0de01b3eae797d3;p=thirdparty%2Fkernel%2Fstable-queue.git drop 2 patches based on RC review feedback Dropped patches: - "drm/sun4i: backend: Fix error pointer dereference" Queues: 5.15, 5.10 Reason: KernelCI clang-21 build break -- the backport inserts the IS_ERR() check between two declarations in sun4i_backend_atomic_check(), triggering -Werror,-Wdeclaration-after-statement on trees built with -std=gnu89. 6.1 (gnu11, no such flag) is unaffected and retained. Report: https://lore.kernel.org/stable/178014594367.7862.7999857847041901052@330cfa3079ca/ - "bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT" Queues: 5.10 Reason: KernelCI build break -- references BPF_PSEUDO_FUNC at arch/arm/net/bpf_jit_32.c:1612, but that symbol does not exist before v5.13 (introduced by 69c087ba6225). 6.1 defines the symbol and is retained. Report: https://lore.kernel.org/stable/178014234420.7843.1328062815700584977@330cfa3079ca/ Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/bpf-arm32-reject-bpf-to-bpf-calls-and-callbacks-in-t.patch b/queue-5.10/bpf-arm32-reject-bpf-to-bpf-calls-and-callbacks-in-t.patch deleted file mode 100644 index 8044cda5b1..0000000000 --- a/queue-5.10/bpf-arm32-reject-bpf-to-bpf-calls-and-callbacks-in-t.patch +++ /dev/null @@ -1,96 +0,0 @@ -From 07c3527b8992a1420bece74d82ab34287bb31bfb Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 17 Apr 2026 07:33:52 -0700 -Subject: bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT - -From: Puranjay Mohan - -[ Upstream commit e1d486445af3c392628532229f7ce5f5cf7891b6 ] - -The ARM32 BPF JIT does not support BPF-to-BPF function calls -(BPF_PSEUDO_CALL) or callbacks (BPF_PSEUDO_FUNC), but it does -not reject them either. - -When a program with subprograms is loaded (e.g. libxdp's XDP -dispatcher uses __noinline__ subprograms, or any program using -callbacks like bpf_loop or bpf_for_each_map_elem), the verifier -invokes bpf_jit_subprogs() which calls bpf_int_jit_compile() -for each subprogram. - -For BPF_PSEUDO_CALL, since ARM32 does not reject it, the JIT -silently emits code using the wrong address computation: - - func = __bpf_call_base + imm - -where imm is a pc-relative subprogram offset, producing a bogus -function pointer. - -For BPF_PSEUDO_FUNC, the ldimm64 handler ignores src_reg and -loads the immediate as a normal 64-bit value without error. - -In both cases, build_body() reports success and a JIT image is -allocated. ARM32 lacks the jit_data/extra_pass mechanism needed -for the second JIT pass in bpf_jit_subprogs(). On the second -pass, bpf_int_jit_compile() performs a full fresh compilation, -allocating a new JIT binary and overwriting prog->bpf_func. The -first allocation is never freed. bpf_jit_subprogs() then detects -the function pointer changed and aborts with -ENOTSUPP, but the -original JIT binary has already been leaked. Each program -load/unload cycle leaks one JIT binary allocation, as reported -by kmemleak: - - unreferenced object 0xbf0a1000 (size 4096): - backtrace: - bpf_jit_binary_alloc+0x64/0xfc - bpf_int_jit_compile+0x14c/0x348 - bpf_jit_subprogs+0x4fc/0xa60 - -Fix this by rejecting both BPF_PSEUDO_CALL in the BPF_CALL -handler and BPF_PSEUDO_FUNC in the BPF_LD_IMM64 handler, falling -through to the existing 'notyet' path. This causes build_body() -to fail before any JIT binary is allocated, so -bpf_int_jit_compile() returns the original program unjitted. -bpf_jit_subprogs() then sees !prog->jited and cleanly falls -back to the interpreter with no leak. - -Acked-by: Daniel Borkmann -Fixes: 1c2a088a6626 ("bpf: x64: add JIT support for multi-function programs") -Reported-by: Jonas Rebmann -Closes: https://lore.kernel.org/bpf/b63e9174-7a3d-4e22-8294-16df07a4af89@pengutronix.de -Tested-by: Jonas Rebmann -Signed-off-by: Puranjay Mohan -Reviewed-by: Emil Tsalapatis -Link: https://lore.kernel.org/r/20260417143353.838911-1-puranjay@kernel.org -Signed-off-by: Alexei Starovoitov -Signed-off-by: Sasha Levin ---- - arch/arm/net/bpf_jit_32.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c -index 1214e39aad5ec..1b3cccd1060bb 100644 ---- a/arch/arm/net/bpf_jit_32.c -+++ b/arch/arm/net/bpf_jit_32.c -@@ -1609,6 +1609,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx) - { - u64 val = (u32)imm | (u64)insn[1].imm << 32; - -+ if (insn->src_reg == BPF_PSEUDO_FUNC) -+ goto notyet; -+ - emit_a32_mov_i64(dst, val, ctx); - - return 1; -@@ -1801,6 +1804,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx) - const s8 *r5 = bpf2a32[BPF_REG_5]; - const u32 func = (u32)__bpf_call_base + (u32)imm; - -+ if (insn->src_reg == BPF_PSEUDO_CALL) -+ goto notyet; -+ - emit_a32_mov_r64(true, r0, r1, ctx); - emit_a32_mov_r64(true, r1, r2, ctx); - emit_push_r64(r5, ctx); --- -2.53.0 - diff --git a/queue-5.10/drm-sun4i-backend-fix-error-pointer-dereference.patch b/queue-5.10/drm-sun4i-backend-fix-error-pointer-dereference.patch deleted file mode 100644 index d7be81c5ce..0000000000 --- a/queue-5.10/drm-sun4i-backend-fix-error-pointer-dereference.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 9535774e6286d4a9510ed9dcd42bde4fb5709275 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 16 Feb 2026 19:48:01 -0600 -Subject: drm/sun4i: backend: fix error pointer dereference - -From: Ethan Tidmore - -[ Upstream commit 06277983eca4a31d3c2114fa33d99a6e82484b11 ] - -The function drm_atomic_get_plane_state() can return an error pointer -and is not checked for it. Add error pointer check. - -Detected by Smatch: -drivers/gpu/drm/sun4i/sun4i_backend.c:496 sun4i_backend_atomic_check() error: -'plane_state' dereferencing possible ERR_PTR() - -Fixes: 96180dde23b79 ("drm/sun4i: backend: Add a custom atomic_check for the frontend") -Signed-off-by: Ethan Tidmore -Reviewed-by: Chen-Yu Tsai -Link: https://patch.msgid.link/20260217014801.60760-1-ethantidmore06@gmail.com -Signed-off-by: Chen-Yu Tsai -Signed-off-by: Sasha Levin ---- - drivers/gpu/drm/sun4i/sun4i_backend.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/drivers/gpu/drm/sun4i/sun4i_backend.c b/drivers/gpu/drm/sun4i/sun4i_backend.c -index 55960cbb10190..c65b10d413879 100644 ---- a/drivers/gpu/drm/sun4i/sun4i_backend.c -+++ b/drivers/gpu/drm/sun4i/sun4i_backend.c -@@ -507,6 +507,9 @@ static int sun4i_backend_atomic_check(struct sunxi_engine *engine, - drm_for_each_plane_mask(plane, drm, crtc_state->plane_mask) { - struct drm_plane_state *plane_state = - drm_atomic_get_plane_state(state, plane); -+ if (IS_ERR(plane_state)) -+ return PTR_ERR(plane_state); -+ - struct sun4i_layer_state *layer_state = - state_to_sun4i_layer_state(plane_state); - struct drm_framebuffer *fb = plane_state->fb; --- -2.53.0 - diff --git a/queue-5.10/series b/queue-5.10/series index 545f221c56..5dbef39b12 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -317,7 +317,6 @@ bluetooth-hci_ldisc-clear-hci_uart_proto_init-on-err.patch bluetooth-fix-locking-in-hci_conn_request_evt-with-h.patch bluetooth-l2cap-add-missing-chan-lock-in-l2cap_ecred.patch drm-komeda-fix-integer-overflow-in-afbc-framebuffer-.patch -drm-sun4i-backend-fix-error-pointer-dereference.patch asoc-sti-return-errors-from-regmap_field_alloc.patch asoc-sti-use-managed-regmap_field-allocations.patch dm-cache-fix-null-deref-with-concurrent-writes-in-pa.patch @@ -379,7 +378,6 @@ mtd-physmap_of_gemini-fix-disabled-pinctrl-state-che.patch mtd-rawnand-sunxi-fix-sunxi_nfc_hw_ecc_read_extra_oo.patch hid-usbhid-fix-deadlock-in-hid_post_reset.patch bpf-fix-precedence-bug-in-convert_bpf_ld_abs-alignme.patch -bpf-arm32-reject-bpf-to-bpf-calls-and-callbacks-in-t.patch pinctrl-pinctrl-pic32-fix-resource-leak.patch perf-branch-avoid-incrementing-null.patch pinctrl-abx500-fix-type-of-argument-variable.patch diff --git a/queue-5.15/drm-sun4i-backend-fix-error-pointer-dereference.patch b/queue-5.15/drm-sun4i-backend-fix-error-pointer-dereference.patch deleted file mode 100644 index c382b88166..0000000000 --- a/queue-5.15/drm-sun4i-backend-fix-error-pointer-dereference.patch +++ /dev/null @@ -1,43 +0,0 @@ -From a8491e16159dce18953983ea2bdac642afb1849d Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 16 Feb 2026 19:48:01 -0600 -Subject: drm/sun4i: backend: fix error pointer dereference - -From: Ethan Tidmore - -[ Upstream commit 06277983eca4a31d3c2114fa33d99a6e82484b11 ] - -The function drm_atomic_get_plane_state() can return an error pointer -and is not checked for it. Add error pointer check. - -Detected by Smatch: -drivers/gpu/drm/sun4i/sun4i_backend.c:496 sun4i_backend_atomic_check() error: -'plane_state' dereferencing possible ERR_PTR() - -Fixes: 96180dde23b79 ("drm/sun4i: backend: Add a custom atomic_check for the frontend") -Signed-off-by: Ethan Tidmore -Reviewed-by: Chen-Yu Tsai -Link: https://patch.msgid.link/20260217014801.60760-1-ethantidmore06@gmail.com -Signed-off-by: Chen-Yu Tsai -Signed-off-by: Sasha Levin ---- - drivers/gpu/drm/sun4i/sun4i_backend.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/drivers/gpu/drm/sun4i/sun4i_backend.c b/drivers/gpu/drm/sun4i/sun4i_backend.c -index bf8cfefa03652..a812de372437b 100644 ---- a/drivers/gpu/drm/sun4i/sun4i_backend.c -+++ b/drivers/gpu/drm/sun4i/sun4i_backend.c -@@ -507,6 +507,9 @@ static int sun4i_backend_atomic_check(struct sunxi_engine *engine, - drm_for_each_plane_mask(plane, drm, crtc_state->plane_mask) { - struct drm_plane_state *plane_state = - drm_atomic_get_plane_state(state, plane); -+ if (IS_ERR(plane_state)) -+ return PTR_ERR(plane_state); -+ - struct sun4i_layer_state *layer_state = - state_to_sun4i_layer_state(plane_state); - struct drm_framebuffer *fb = plane_state->fb; --- -2.53.0 - diff --git a/queue-5.15/series b/queue-5.15/series index 74375062a0..a55063c87b 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -428,7 +428,6 @@ net-phy-qcom-at803x-use-the-correct-bit-to-disable-e.patch sctp-fix-missing-encap_port-propagation-for-gso-frag.patch net-bpf-fix-null-ptr-deref-in-xdp_master_redirect-fo.patch drm-komeda-fix-integer-overflow-in-afbc-framebuffer-.patch -drm-sun4i-backend-fix-error-pointer-dereference.patch asoc-sti-return-errors-from-regmap_field_alloc.patch asoc-sti-use-managed-regmap_field-allocations.patch dm-cache-fix-null-deref-with-concurrent-writes-in-pa.patch