mirror of
https://github.com/torvalds/linux.git
synced 2026-10-06 18:46:02 +02:00
4aa2c106ae
1480001 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Yunpeng Tian
|
4aa2c106ae |
smb: client: reject SetEA requests that do not fit the request buffer
CIFSSMBSetEA() copies the caller's extended attribute value into the
SMB request buffer without checking that it fits. The requirement is
stated in the source but was never implemented:
/*BB add length check to see if it would fit in
negotiated SMB buffer size BB */
/* if (ea_value_len > buffer_size - 512 (enough for header)) */
if (ea_value_len)
memcpy(parm_data->list.name + name_len + 1,
ea_value, ea_value_len);
The only bound applied on the way in is in cifs_xattr_set():
#define MAX_EA_VALUE_SIZE CIFSMaxBufSize
...
if (size > MAX_EA_VALUE_SIZE)
CIFSMaxBufSize is the full payload capacity of the buffer, so a value
of exactly that size leaves no room for the SMB header, the TRANS2
parameter block, the fealist header and the EA name that are written
ahead of it in the same object.
SendReceive() already enforces the correct limit on this very length:
if (in_len > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE)
but it is called after the copy has taken place. An unprivileged
setxattr(2) on an SMB1 mount with a 250-byte name and a 16384-byte
value writes 16384 bytes starting 345 bytes into a 16588-byte
cifs_request object, ending 141 bytes past it:
BUG: KASAN: slab-out-of-bounds in CIFSSMBSetEA+0xabc/0xde0
Write of size 16384 at addr ffff888003aa0159 by task init/68
__asan_memcpy+0x3c/0x60
CIFSSMBSetEA+0xabc/0xde0
cifs_xattr_set+0xd3a/0xff0
__vfs_setxattr+0x13e/0x1a0
The buggy address is located 345 bytes inside of
allocated 16588-byte region
Apply SendReceive()'s limit to the assembled request before the copy
rather than after it, and widen the byte counters so the sum cannot
wrap before it is tested.
byte_count is also tested against U16_MAX, because it is stored in the
16-bit pSMB->ByteCount. That becomes reachable when CIFSMaxBufSize is
raised at module load, where it may be set as high as 1024*127: with a
5-byte EA name and a 65521-byte value, count is exactly U16_MAX while
byte_count is 65556, and cpu_to_le16() would truncate it to 20 and
transmit a frame whose ByteCount does not match its length. Testing
byte_count covers count as well, since byte_count is the larger of the
two and count's only 16-bit consumer is written after this point.
check_add_overflow() is evaluated first so that total_len is assigned
before it is reported.
Fixes:
|
||
|
Paulo Alcantara
|
a8603b52b3 |
smb: client: fix data corruption with concurrent writes and O_TRUNC
cifs_do_truncate() flushes dirty pages with filemap_write_and_wait()
and truncates the file on the server, but in the old code both
operations ran without holding i_rwsem or invalidate_lock. A
concurrent buffered write via netfs_perform_write() -- which only
needs i_rwsem shared -- could dirty new pages after the flush but
before the local truncation, and those pages would be silently
discarded by cifs_setsize() -> truncate_pagecache().
Fix by acquiring inode_lock (exclusive i_rwsem) and
filemap_invalidate_lock at the top of cifs_do_truncate(), so the
entire flush-truncate-resize sequence is atomic with respect to:
- buffered writes (blocked by exclusive i_rwsem, since
netfs_start_io_write takes i_rwsem shared),
- read page faults (blocked by exclusive invalidate_lock, since
filemap_fault takes it shared),
- writeback collection (blocked by netfs_wb_begin/netfs_wb_end
around the server truncate and local resize, since
netfs_writepages also acquires the wb lock).
Fixes:
|
||
|
Frank Sorenson
|
fe39cd9d48 |
cifs: don't update i_size in cifs_do_truncate without a cached handle
If find_writable_file() returns null, cifs_file_flush will return
0 without issuing set_file_size, and the outer 'if (!rc)' block
will set i_size to 0 before telling the server to truncate. If
the cifs_open() then fails, the inode will have size 0, while
the server file is unchanged.
Move the netfs_resize_file() and cifs_setsize() into the 'if
(cfile)', so they only run after a successful set_file_size.
In the no-handle else branch, evict stale pages with
truncate_inode_pages before the O_TRUNC open to dispose of old
cache pages, and let the open response set the i_size.
Fixes:
|
||
|
Frank Sorenson
|
1dac61e2c2 |
smb: client: fix heap overflow in cifs_do_set_acl()
cifs_set_acl() validates ACL size using posix_acl_xattr_size():
4 + (count * 8) // 4-byte header + 8 bytes per ACE
cifs_do_set_acl() then calls posix_acl_to_cifs() to write the CIFS
wire format into the same buffer:
6 + (count * 10) // 6-byte header + 10 bytes per ACE
An ACL that passes the xattr-based check in cifs_set_acl() can
overflow the heap when posix_acl_to_cifs() writes the larger CIFS
format.
Validate the CIFS format size against the remaining buffer space and
USHRT_MAX before converting--data_count is __u16, so sizes above
USHRT_MAX truncate the on-wire packet length, causing the server to
apply a partial ACL. Replace MaxDataCount = 1000 with
min(CIFSMaxBufSize, USHRT_MAX).
Fixes:
|
||
|
Paulo Alcantara
|
6949939586 |
smb: client: fix multiuser mount with krb5
Customer reported that they could no longer mount their SMB shares
with multiuser mount option and krb5. Turned out that the client
wasn't duplicating username option when creating multiuser
connections, therefore failing to retrieve credentials as
cifs.upcall(8) couldn't find them in keytab.
Fix this by duplicating username option (if set) from original fs
context before creating multiuser connections with krb5.
Reproducer:
```
$ ktutil
ktutil: add_entry -password -p testuser -k 1 -e aes256-cts
Password for testuser@ZELDA.TEST:
ktutil: write_kt /etc/krb5.keytab
ktutil: quit
$ klist -ke
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- ----------------------------------------------------------------
1 testuser@ZELDA.TEST (aes256-cts-hmac-sha1-96)
$ mount.cifs //w22-root2/scratch /mnt/1 -o \
uid=1000,sec=krb5,username=testuser@ZELDA.TEST,multiuser
mount error(13): Permission denied
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs) and
kernel log messages (dmesg)
```
Reported-by: Jacob Shivers <jshivers@redhat.com>
Fixes:
|
||
|
Andy Shevchenko
|
d83a21bb26 |
smb: client: transport: Fix debug printing in __release_mid()
Long time ago during upgrading printk():s to the respective pr_<level>()
calls one misconversion happened and nobody has noticed that. So,
previously printk(KERN_DEBUG) + printk() worked as one long debug print
since the trailing '\n' is only present in the followup printk() format
string. The culprit change missed that and split the message to two on
the different levels. Restore the original behaviour to make users be
less confused in the most likely never happen cases of partially getting
that message.
Fixes:
|
||
|
Huiwen He
|
448ba0ae65 |
smb/client: invalidate fscache for fallocate range operations
smb3_zero_range(), smb3_punch_hole(), smb3_insert_range(), and
smb3_collapse_range() modify file contents through server-side range
operations. These operations discard the affected page cache, but leave
the FS-Cache cookie valid, so a later read may return data cached before
the range operation.
Fix this by invalidating FS-Cache after outstanding I/O has completed
and before modifying the file on the server.
Run the following as root on a CIFS mount with fsc enabled and an active
CacheFiles backend:
bash -c '
MNT=/mnt/cifs
FILE="$MNT/repro"
# Generate four 1 MiB random blocks: [A][B][C][D].
dd if=/dev/urandom of=/tmp/src bs=1M count=4 status=none
# Expected contents after zeroing B: [A][zero][C][D].
cp /tmp/src /tmp/expected
dd if=/dev/zero of=/tmp/expected bs=1M seek=1 count=1 \
conv=notrunc status=none
cp /tmp/src "$FILE"
# Populate FS-Cache, then discard the page cache.
sync
echo 1 > /proc/sys/vm/drop_caches
cat "$FILE" > /dev/null
sync
echo 1 > /proc/sys/vm/drop_caches
fallocate --zero-range -o 1M -l 1M "$FILE"
if cmp -s /tmp/expected "$FILE"; then
echo "readback: OK"
else
echo "readback: STALE DATA"
fi
'
Before this change, the readback differs from /tmp/expected:
readback: STALE DATA
After this change, it matches:
readback: OK
Fixes:
|
||
|
Huiwen He
|
01261a6fa4 |
smb/client: fix stale page cache in insert/collapse range
smb3_insert_range() and smb3_collapse_range() use
truncate_pagecache_range() to invalidate the affected page cache.
However, if off or old_eof is not page-aligned, the boundary pages are
only partially zeroed and remain uptodate. As a result, the client may
return stale data after a successful insert/collapse range operation.
For example, with 4K pages:
page 0 page 1 page 2
0------4K 4K------8K 8K------12K
^ ^
off=2K old_eof=10K
Page 1 is removed from the page cache, while the boundary pages are
only partially zeroed. After COPYCHUNK moves the data on the server,
these cached pages may still return stale data.
This can be reproduced on a CIFS mount:
bash -c '
FILE=/mnt/scratch/repro
# Use a 6 KiB file so EOF is not page-aligned.
dd if=/dev/urandom of=/tmp/src bs=1K count=6 status=none
# Expected: a 4 KiB hole followed by the original data.
rm -f /tmp/expected
truncate -s 4K /tmp/expected
cat /tmp/src >> /tmp/expected
cp /tmp/src "$FILE"
# Prime the page cache before moving data on the server.
cat "$FILE" > /dev/null
fallocate --insert-range -o 0 -l 4K "$FILE"
if cmp -s /tmp/expected "$FILE"; then
echo "readback: OK"
else
echo "readback: STALE DATA"
fi
'
Fix this by writing back dirty data and discarding the page cache from
the start of the page containing off to EOF before moving data on the
server.
Fixes:
|
||
|
Huiwen He
|
7811701d6a |
smb/client: fix integer truncation in collapse range
smb3_collapse_range() stores the ssize_t return value of
smb2_copychunk_range() in an int. A successful copy larger than
INT_MAX is truncated to a negative value and treated as an error.
Reproducer:
MNT=/mnt/scratch
truncate -s 2056M "$MNT/file"
fallocate --collapse-range -o 1M -l 1M "$MNT/file"
Fix this by using __smb2_copychunk_range(), which reports success as
zero instead of returning the copied byte count.
Before this change, the reproducer fails with:
fallocate: fallocate failed: Success
and the file size remains unchanged at 2056 MiB. After this change, the
reproducer succeeds and the file size becomes the expected 2055 MiB.
Fixes:
|
||
|
Huiwen He
|
0923ae9f23 |
smb/client: fix data corruption in emulated insert range
smb3_insert_range() shifts [off, EOF) right with COPYCHUNK, copying from
low to high offsets. When the ranges overlap, the copy can overwrite
source data that has not yet been copied. For a 1 MiB insert at offset 0:
offset: 0 1M 2M 3M 4M 5M
before: | A | B | C | D |
expected: | hole | A | B | C | D |
current: | hole | A | A | A | A | (corrupted)
Let x be the insertion offset, L the total length to move, delta the
insert length, and C the normal chunk size allowed by the server.
Insert range maps
[x, x + L) -> [x + delta, x + delta + L).
When delta >= L, the complete source and target ranges are disjoint, so
the normal copy order and chunk size are safe:
offset: 0 4 8 12 16 20 24 28 32
source: [--S0--][--S1--][--S2--][--S3--]
target: [--T0--][--T1--][--T2--][--T3--]
When delta < L, the complete source and target ranges overlap, so the
copy must proceed from EOF backwards. There are two subcases.
If delta >= C, each corresponding source and target chunk is disjoint.
The 1 MiB example has L = 4 MiB and delta = C = 1 MiB:
offset: 0 1M 2M 3M 4M 5M
source: [--S0--][--S1--][--S2--][--S3--]
target: [--T0--][--T1--][--T2--][--T3--]
Copying S0 from [0, 1M) to [1M, 2M) overwrites S1 before it is copied.
Processing chunks from EOF backwards prevents this inter-chunk
overwrite.
If delta < C, the source and target ranges of a normal chunk also
overlap. For example, with L = 16, delta = 2 and C = 4:
offset: 0 2 4 6 8 10 12 14 16 18
source: [--S0--][--S1--][--S2--][--S3--]
target: [--T0--][--T1--][--T2--][--T3--]
Here S0 and T0 overlap over [2,4), S1 and T1 over [6,8), and so on.
Backward ordering cannot control how the server copies bytes inside one
descriptor, so the chunk size must be limited to delta.
Fix this by copying overlapping right shifts from EOF backwards. Limit
the chunk size to delta when delta < C so that each chunk's source and
target ranges do not overlap. Using larger chunks would require a way to
identify servers that safely handle overlapping COPYCHUNK descriptors.
Therefore:
delta >= L:
keep the normal copy order and chunk size
delta < L:
delta >= C: copy backwards and keep the normal chunk size
delta < C: copy backwards and limit the chunk size to delta
Only the delta < C subcase requires reducing the chunk size for data
integrity.
Reproducer:
bash -c '
MNT=/mnt/scratch
# Generate four 1 MiB random blocks: [A][B][C][D].
dd if=/dev/urandom of=/tmp/src bs=1M count=4 status=none
# With C = 1 MiB, test delta = C and delta < C.
for delta in 1M 1K; do
truncate -s 0 /tmp/expected
truncate -s "$delta" /tmp/expected
cat /tmp/src >> /tmp/expected
cp /tmp/src "$MNT/file"
fallocate --insert-range -o 0 -l "$delta" "$MNT/file"
if cmp -s /tmp/expected "$MNT/file"; then
echo "delta=$delta: OK"
else
echo "delta=$delta: CORRUPTED"
fi
done
'
The corruption reproduces with Samba and ksmbd, while Windows handles
the overlapping COPYCHUNK ranges safely.
The 1 MiB case tests delta >= C, while the 1 KiB case tests delta < C.
Before this change, the reproducer reports:
delta=1M: CORRUPTED
delta=1K: CORRUPTED
After this change, it passes against both ksmbd and Samba:
delta=1M: OK
delta=1K: OK
Fixes:
|
||
|
Huiwen He
|
cd03ce4950 |
smb/client: mark file sparse before emulating insert range
The SMB client emulates FALLOC_FL_INSERT_RANGE with SET_EOF, COPYCHUNK
and SET_ZERO_DATA.
SET_ZERO_DATA creates a hole only when the file is sparse. On a
non-sparse file, it clears the inserted range but leaves its blocks
allocated, causing the extent count check in xfstests generic/064 to
fail.
Fix this by marking the file sparse before modifying it.
This patch produces the expected sparse extents in xfstests generic/064
only when the server-reported block size is compatible with the server's
deallocation granularity.
For ksmbd, the reported block size follows the backing filesystem,
and the test passes. For Samba, the test passes with a block size
matching the backend granularity, for example, 4 KiB on Btrfs, but not
with the default 1 KiB value. For Windows Server 2022, 4 KiB inserts do
not generate holes, while aligned inserts of 64 KiB or larger do.
Fixes:
|
||
|
Huiwen He
|
88972e3575 |
smb/client: validate new EOF for zero range
When FALLOC_FL_ZERO_RANGE is used without FALLOC_FL_KEEP_SIZE,
smb3_zero_range() may extend EOF without checking RLIMIT_FSIZE, allowing
the file to grow beyond the caller's file-size limit.
Fix this by calling inode_newsize_ok() before sending the zero-range
request when the operation would extend EOF.
Reproducer, using a file on a CIFS mount:
bash -c '
FILE=/mnt/cifs/repro
trap "" SIGXFSZ
ulimit -f 3072
truncate -s 2M "$FILE"
fallocate --zero-range -o 0 -l 4M "$FILE"
echo "fallocate rc=$?"
stat -c "file size=%s" "$FILE"
'
Before this change, the operation succeeds despite the 3 MiB limit:
fallocate rc=0
file size=4194304
After this change, fallocate fails and leaves the file at 2 MiB.
Fixes:
|
||
|
Huiwen He
|
1519dc88c8 |
smb/client: validate new EOF for insert range
smb3_insert_range() does not check if the new file size
(i_size + len) is valid. This allows FALLOC_FL_INSERT_RANGE to bypass
RLIMIT_FSIZE, exceed s_maxbytes, or produce a size outside the loff_t
range.
Use check_add_overflow() to calculate the new EOF. Validate it with
inode_newsize_ok() before modifying the file.
Reproducer, using a file on a CIFS mount:
bash -c '
FILE=/mnt/cifs/repro
trap "" SIGXFSZ
ulimit -f 3072 # RLIMIT_FSIZE = 3 MiB
# A regular write is stopped at 3 MiB.
dd if=/dev/zero of="$FILE" bs=1M count=4 status=none
stat -c "size after write: %s" "$FILE"
# Insert 2 MiB into a 2 MiB file.
truncate -s 2M "$FILE"
fallocate -i -o 0 -l 2M "$FILE"
stat -c "size after insert: %s" "$FILE"
'
Before this change, the regular write stops at the 3 MiB limit, but
insert range grows the file to 4 MiB:
dd: error writing '/mnt/cifs/repro': File too large
size after write: 3145728
size after insert: 4194304
After this change, insert range also fails at the limit and leaves the
2 MiB file unchanged:
dd: error writing '/mnt/cifs/repro': File too large
size after write: 3145728
fallocate: fallocate failed: File too large
size after insert: 2097152
Fixes:
|
||
|
Frank Sorenson
|
53676a5e28 |
cifs: add revalidation on FSCTL failure in smb2_duplicate_extents()
smb2_duplicate_extents() has no handling for
FSCTL_DUPLICATE_EXTENTS_TO_FILE failure: when the FSCTL fails, local
inode metadata may be stale from the pre-extension or from concurrent
remote writes, but is never refreshed.
Force revalidation on FSCTL failure and use i_size_read() for the
pre-extension check.
Fixes:
|
||
|
Linus Torvalds
|
45c13f3f9e |
hwspinlock updates for v7.3
Propagate single-lock registration failures from radix_tree_insert(), making caller sanity checks effective. Update the hwspinlock MAINTAINERS repository URL to the current remoteproc tree. -----BEGIN PGP SIGNATURE----- iQJCBAABCgAsFiEEBd4DzF816k8JZtUlCx85Pw2ZrcUFAmqN+8MOHGJqb3JuQGty eW8uc2UACgkQCx85Pw2ZrcUN+xAAv/yAIAOhanNNvoA0nDZptfX2b561APc3gSRg zx6KLsY+a0y9s6z6VKhv4BuKxSYSR/A0gTjHcKog7ZebrlTxUhT3UV+f7M3lI6AK Z7wkiyCc2Z7m/plPtvVm6juwYWaaCyc2qxOXca79ExG5hfiq5W/MXbHpajkLdlcY rWvNBgjxEzcUhR13qr4WIkSq6pybGbdoRlnH8rK+7evYJlgSKep7apQKDpkwKMG1 RRJQn2XBn12Yr5AfENfb3WdkcuUsGgyYAmv21yOWem4h/awZuAhsOS5j1X89Mzyo L3e6fdtVjcYwQlD8rolJYhhoW9OadkoDxHGXLrIiGZMgPRaR0k93WJOKSSwocEMG Ud6b8QTSuRYTa3Ygi0d+fODuhxB7cNl5iVcViAH/O3iyhkzIqeLidfmIwiU4LNKM Wn6xAp+oRGPYJuNO8X2qFYZS3ZhIkK1NpQekR9WMiiu8sgFrDM5LogL0XU8Ck+yk ysm9wn2h97yOV6vowpF/UHU/hu+VbC2Iu+qyNCtkdU+JQHo4X7tEhadd8FV5DbFe FugWcla5RwDa3Lef8qLZLo1xx/tmIWAx7HZLN5D/cffuG1j6ioeJHnIu/LFBEZeO Wyo5TOFrYQoIDUR+8rW7aGykYAhfevaaVuVSdl/EXMaGjADoNDunyFaG7cFnKUP/ fEG0HUw= =Z/YJ -----END PGP SIGNATURE----- Merge tag 'hwlock-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull hwspinlock updates from Bjorn Andersson: "Propagate single-lock registration failures from radix_tree_insert(), making caller sanity checks effective. Update the hwspinlock MAINTAINERS repository URL to the current remoteproc tree" * tag 'hwlock-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: hwspinlock: propagate errno when registering single lock MAINTAINERS: Update remoteproc repo url for hwspinlock |
||
|
Linus Torvalds
|
f2ed28dce9 |
rpmsg updates for v7.3
Fix a GLINK endpoint teardown deadlock during driver detach and order SMEM FIFO reads after the remote-updated availability check. Prevent duplicate rpmsg character endpoint teardown when remoteproc shutdown races with RPMSG_DESTROY_EPT_IOCTL. Replace unsafe string and sysfs formatting helpers, and correct the unregister_rpmsg_driver() return value documentation. -----BEGIN PGP SIGNATURE----- iQJCBAABCgAsFiEEBd4DzF816k8JZtUlCx85Pw2ZrcUFAmqN/A8OHGJqb3JuQGty eW8uc2UACgkQCx85Pw2ZrcVtjQ/+Ohv/oawAyLpPs73206Mjg/vCwpwfw8blHjf+ fsJ6jQQ32GUY7ySz4azNOGUvipVZ59Gf79fGXxOD1Gy49EO4h9VxYrxdgxz4WrPu RC74zDCsp6kjqCYWsRIsaCWDycubW+fMW4f9cqJ/+wEbAj4pb2kvij/Irbs+i4cW bUha/eEIpNGxikW7Un7Ikvqgxg3L77HRlWonrwt1aPnMd1SM6w5pT/0gz6zF4R9I QB4EYK5MJvcVcdciECkQf5txVNsHRPUg6d/eLZsPsxLGMNoXHBoKFHJVx6TLcy4r pJFJ/h8sNTRSSx/eHoF2i0mf4gz5aKg1V4XR9NQQ8hsLv5IIMUg5Qm4Jez5wUDJE jHiSxQzrts/HUxT8W60TGAREG0oiet0dRgZXtMZ0Muw+iLXLlSSdcS6MOvvCSIVU MHxC5wpcYRf2sMsqG3PGAs4erHsI/H1QLVV75f6UMpKcpgwYpeYzaMKx3otod95Y bvmQuEo56yqh4Pzllw7nG/avjp+zHpy0aY8YGUducQOopYv4T1WmbolYw5kYBUE8 zLKY69c3tiIwK/qgnmROfVzMAz0VjGTKeIWFUxy7rdUk9l8cRSguz0bKWN73GPx4 UwCgSFsFJHFl63idgs6KfysbVPW308ISDYLUybENEc93uM2gdV0LsOkKAraqd9lR LTZwDys= =bTs/ -----END PGP SIGNATURE----- Merge tag 'rpmsg-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull rpmsg updates from Bjorn Andersson: "Fix a GLINK endpoint teardown deadlock during driver detach and order SMEM FIFO reads after the remote-updated availability check. Prevent duplicate rpmsg character endpoint teardown when remoteproc shutdown races with RPMSG_DESTROY_EPT_IOCTL. Replace unsafe string and sysfs formatting helpers, and correct the unregister_rpmsg_driver() return value documentation" * tag 'rpmsg-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: rpmsg: glink: smem: order FIFO read after availability check rpmsg: glink: fix deadlock in endpoint destroy during driver detach rpmsg: char: Check for ongoing chrdev destroy rpmsg: glink: Replace strcpy() with strscpy() rpmsg: core: Fix incorrect return value documentation rpmsg: Replace sprintf() with sysfs_emit() in sysfs show |
||
|
Linus Torvalds
|
fc710de0dd |
remoteproc updates for v7.3
Add a remoteproc driver and binding for AMD MicroBlaze/V soft cores executing from dual-port BRAM, with clock and reset control and support for firmware without a resource table. Introduce a generic Qualcomm PAS service with SCM and OP-TEE backends, and migrate the PAS, MSS, and WCNSS remoteproc drivers to it. Add Nord ADSP and CDSP support, Eliza CDSP support, Maili ADSP/CDSP bindings, and late-attach SoCCP support for Kaanapali, Hawi, Maili, and Glymur. Enable BAM-DMUX child devices for PAS modems and fix PAS memory protection, handover, shutdown, and resource lifetime handling. Harden remoteproc lifecycle handling by attaching asynchronously, stopping crashed processors, synchronizing crash work with removal, and forcing shutdown before device resources are released. Reallocate resources during attach recovery and fix several reference and error-path leaks. Add Xilinx R5 crash detection and move RPU start and stop sequencing into the platform firmware driver. Consolidate write-combining carveout mapping callbacks, use correct I/O-memory accessors, and share optional ELF resource-table handling across drivers. Convert the TI Wakeup M3 binding to DT schema, correct Qualcomm and generic remoteproc bindings, and harden resource-table iteration against signed-offset out-of-bounds accesses. -----BEGIN PGP SIGNATURE----- iQJCBAABCgAsFiEEBd4DzF816k8JZtUlCx85Pw2ZrcUFAmqN/FgOHGJqb3JuQGty eW8uc2UACgkQCx85Pw2ZrcUvXRAAkCk6ogZOdjGY9WBugieN3WEfkAzrWAS9ntWK CGR+VcL633ymLtS/6E2fdv4d7Uh1An/ipcCJUSXU4CzumB7O1FJi1CfQok2j+4xz dIBc9m6SAMYBFVLAXD2NujdOf+nwEDLbJQib7lVBTBCNjQamvjFhUu9g/bnJt4gT F1ieAgNP15OFfHnoSWhoFHXI8ao4Vs0PwfoBLEwIP5VuFXy3DzVGaqEZgEgD7+G5 Qy0ii/TO+EFC8GdK8xxlCtKYT6J3qG/pQBaCtS9QwSXNPTbI31MlDimInUl7lxHS yWeDOJPVgNL279W7DnHiELQT6uGFac+1ILNBIGl9lI1+4Hcwgg6eTwwP6wcIOhYL YFXNfCeb5XW6moOKxhkcbOwZ46/FUS4sywoUyaAevFOc8kisDwMy81C1d2cYVg12 gq69ah4sWkSPSkAgOeUf8Aa8v3eXj9IaxcIAW9+fQdNaduuG7oRvVzowKbli9SiD qAAaIV2wyt+Il7VJl5Nw1R0nJONMTK44Xft+3k/TFzmr5N1ivfSBvGxIg0zdB9xZ 7akukQjCJgWOcyICa3ShyA6foClsJF26xVhQrfY7UPKI7DQHY5GQAKgpA2zWrqH5 cKt5xRcImKn+788pfkNdVj8IxROjGEI5JXf6etIvpPnUzkFG3nZfY6kLryOxvv0H zyxm4OM= =wi8c -----END PGP SIGNATURE----- Merge tag 'rproc-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull remoteproc updates from Bjorn Andersson: "Add a remoteproc driver and binding for AMD MicroBlaze/V soft cores executing from dual-port BRAM, with clock and reset control and support for firmware without a resource table. Introduce a generic Qualcomm PAS service with SCM and OP-TEE backends, and migrate the PAS, MSS, and WCNSS remoteproc drivers to it. Add Nord ADSP and CDSP support, Eliza CDSP support, Maili ADSP/CDSP bindings, and late-attach SoCCP support for Kaanapali, Hawi, Maili, and Glymur. Enable BAM-DMUX child devices for PAS modems and fix PAS memory protection, handover, shutdown, and resource lifetime handling. Harden remoteproc lifecycle handling by attaching asynchronously, stopping crashed processors, synchronizing crash work with removal, and forcing shutdown before device resources are released. Reallocate resources during attach recovery and fix several reference and error-path leaks. Add Xilinx R5 crash detection and move RPU start and stop sequencing into the platform firmware driver. Consolidate write-combining carveout mapping callbacks, use correct I/O-memory accessors, and share optional ELF resource-table handling across drivers. Convert the TI Wakeup M3 binding to DT schema, correct Qualcomm and generic remoteproc bindings, and harden resource-table iteration against signed-offset out-of-bounds accesses" * tag 'rproc-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: (60 commits) remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry() remoteproc: replace BSD blurb with SPDX identifier in rsc_table.h remoteproc: replace BSD blurb with SPDX identifier in remoteproc.h remoteproc: fix coding style issues in remoteproc.h MAINTAINERS: add rsc_table.h to remoteproc entry remoteproc: qcom: pas: Add Nord ADSP and CDSP support dt-bindings: remoteproc: qcom,nord-pas: Document Nord PAS remoteproc: qcom: pas: Drop unused dtb_mem_region field remoteproc: qcom: pas: Map/unmap subsystem region before auth_and_reset remoteproc: qcom: pas: Fix the PAS context creation placement remoteproc: qcom: pas: Guard dtb metadata release with dtb_pas_id check remoteproc: qcom: annotate mem_region fields with __iomem arm64: dts: qcom: eliza: Add fallback compatible for ADSP remoteproc dt-bindings: remoteproc: qcom,milos-pas: Move Eliza ADSP to SM8550 schema remoteproc: qcom: pas: Add Eliza CDSP support dt-bindings: remoteproc: qcom,sm8550-pas: Add Eliza CDSP compatible remoteproc: qcom: q6v5: Request shutdown if crash is triggered host-side remoteproc: Force shutdown during device removal remoteproc: Prevent crash handling to race with rproc_del() remoteproc: Allow shutdown of crashed processors ... |
||
|
Linus Torvalds
|
73ae59e975 |
Changes since last update:
- Fix up the EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS default logic so that
"make savedefconfig" won't write the needless default value to the
defconfig file
- Add support for SEEK_{HOLE,DATA}, splice() as well as enable large
folios in inode_share mode
- Fix z_erofs_gbuf_growsize() after the previous buffer resizing fails
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEQ0A6bDUS9Y+83NPFUXZn5Zlu5qoFAmqNu/kRHHhpYW5nQGtl
cm5lbC5vcmcACgkQUXZn5Zlu5qoMTA/8Cb7MRcm7eyCvTT1wyfgx6DSiOuYdITDW
6iQ/qRTnYDEO8FNVwqZJflLPO5pjIs/sucg69XvZg9cIP0gW4o3R5INJx+ZNZx0j
hnbPY8RNtIP0Z0rbt8Qes2cXORosZlqcdZvQFQgbmKx6jo72MLWMof7qM9jC8rOy
jMm9wipn7RjM5jN6sLGWMDleV+xfHOWT7cJzWL4qyJLgWWMp8vBMhuGfK46Cz/R4
wns+5gFanQAPmaWRJ8Wl0MIFBNhF49IGKRSxku8LYCmcnZMlnsL5TfQK/HP+d+o9
OLTK3M9zDm5VFbp18YAHNgZVUhZKZpaYC3PwmpY2t2/w2zjXVgQ1+dkXn5Iuho+y
IY7fc+D27E/QKUq7xz+H3i+0z7SW+nC4ErLxE6GQfpRLEV6GoYibkDuzrUH6+6sI
abJrLGwnE++ZXKBd3s2nspsn1Pq/ItyRdE4nsm5QZQbVbFDctZpG25gN0PM49DDV
jh6ByRMPkR5ZHVzdFhGsbT6KQyadEU/zr1AFy3UCOZ+JNv+Gs7HHI028vucbN3/x
SyX8wrt/D503+AZHLZdHp4y5BsdAXFp/qurHFY5JNMR0w7B8WmeV0q07XlBUle6v
vxQzQm920x5ZX9aGm+iYtMCWZyvdnTqp+eKHYwnyjifu6RbShFsMmpZsQ0+Du+NE
V/JvRUFV+ss=
=cqYR
-----END PGP SIGNATURE-----
Merge tag 'erofs-for-7.3-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs
Pull more erofs updates from Gao Xiang:
- Fix up the EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS default logic so
that "make savedefconfig" won't write the needless default value to
the defconfig file
- Add support for SEEK_{HOLE,DATA}, splice() as well as enable large
folios in inode_share mode
- Fix z_erofs_gbuf_growsize() after the previous buffer resizing fails
* tag 'erofs-for-7.3-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs:
erofs: simplify z_erofs_gbuf_growsize()
erofs: skip sufficiently large global buffers when resizing
erofs: support large folios in inode_share mode
erofs: support splice() in inode_share mode
erofs: support SEEK_HOLE/SEEK_DATA in inode_share mode
erofs: Fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS default logic
|
||
|
Linus Torvalds
|
7bb6284aa7 |
Arm:
* Add support for 'slot' based PMU events, paired with new UAPI that
compels the user to select a specific PMU implementation
* Lazy save/restore of vCPU state for pKVM, along with various fixes
and cleanups to the management of vCPU state between the untrusted
host and pKVM hypervisor
* Disable traps of EL1 registers for nested hypervisors when FEAT_NV2p1
is present, guaranteeing that EL2-specific register bits are stateful
in the EL1 counterpart
* Leverage FEAT_NV3 to avoid unnecessary ERET/TLBI traps when the scope
of those instructions remains 'in host' (i.e. L1 kernel/userspace)
* Pile of fixes for the management of the VNCR pseudo-TLB, such as
under-invalidations and races with concurrent TLBIs on other vCPUs
* Consolidate the non-protected and pKVM view of ICH_VTR_EL2 to a
runtime-patched constant, allowing the same data to be shared with
pKVM prior to dropping host privileges
* Considerable pile of LLM-assisted fixes around the shop but mostly in
the VGIC, our in-kernel generator of bugs (and sometimes interrupts)
LoongArch:
* Advertise already-supported capabilities.
* Some bug fixes about timer and MMIO.
* Some hardening about interrupt injection.
* Replace kvm_err() with kvm_pr_unimpl().
* Add FPU/LSX/LASX test cases for selftests.
RISC-V:
* Svadu/Zicfiss/Zicfilp FWFT support for Guest
* Use try_cmpxchg for IMSIC MRIF RMW
* More arch-specific tracepoints in KVM RISC-V
* Eager page splitting when enabling dirty logging
* Optimize hfence request handling for SMP Guests
* Improve dirty log clearing by skipping zero bits in mask
* Guard HFENCE range loops against overflow
* CPU PM notifiers in KVM RISC-V for non-retentive idle states
* Fix kernel-mode vector context save/restore for Guest
s390:
* Fixes for vfio-ap
* Fixes for the gmap rework
* Fixes for vsie
* AI triggered fixes all over
* diag9c tracing
* code move preparation for the additional arm64 support
* enable CONTEXT_ANALYSIS
x86:
* Perform spring cleaning on x86.{c,h} and asm/kvm_host.h, by adding regs.c
(the kvm_cache_regs.h => regs.h is already applied) and msrs.{c,h}, and moving
relevant code out of x86.c.
* Split kvm_mmu in three parts, respectively to describe the format of page
tables, walking the guest page tables and building the page tables. Always
use the same page table walker kvm->arch.gva_walk as the entry point to
convert a guest's virtual address, where the previous code used two
different kvm_mmu structs depending on whether the walk included nested
EPT/NPT or not. Make page fault vmexits reuse the permission checking
machinery that is used for guest page faults. This is both a cleanup
and a baby step towards supporting XS/XU memory permissions.
* Document some of the "fun" gotchas with the APIC base when creating IRQCHIPs
on x86.
* Remove a defunct masterclock update from kvm_xen_shared_info_init(). It
could result in incorrect kvmclock due to triggering an unnecessary
switch to/from masterclock mode.
* Skip Xen runstate time updates if time has effectively gone backwards, so
that the guest doesn't report 100% steal time for a very, very long time.
* Drop KVM's runtime updates of the Xen PV timing CPUID leaf, as KVM was
updating the wrong sub-leaf, and upstream KVM will soon provide all the
information needed by userspace to populate the CPUID field itself.
* Fix a bug where KVM would walk a newly created rmap without holding the rmap
lock (or mmu_lock) during aging.
* Fix a bug where aging TDP MMU SPTEs could clobber FROZEN SPTEs.
* Fix a variety of #DB priority bugs.
* Fix a class of races related to enabling Hyper-V emulation on a vCPU after
the vCPU is visible to the rest of KVM.
* Use static calls for nested virtualization ops.
* Move more KVM-internal code out of x86's kvm_host.h.
* Enumerate support for a variety of Zhaoxin instructions that don't require
explicit virtualization.
* Fix missing EFER validation bugs, including in the KVM_SET_SREGS* path.
* Harden kvm_vcpu_map() against double-mapping and thus leaking references.
* Misc fixes and cleanups, e.g. for largely benign syzkaller splats.
x86 (Intel):
* Zero a vCPU's entry in VMX's Posted Interrupt Descriptor table used for IPI
virtualization when the vCPU is freed, to fix a use-after-free where hardware
will write to a freed vCPU's PID.
* Service local TLB flushes on a failed nested VM-Enter to fix a bug where KVM
could miss a TLB on a future, successful VM-Enter with the same L2 VPID.
* Cap the maximum value shoved into the VMX Preemption Timer to workaround an
erratum that affects all existing Intel CPUs that support CPUID 0x15.
* Fix VPID virtualization bugs where KVM would fail to flush hardware TLBs.
* Harden the TDX "populate" ioctls against bad input, and to prepare
for supporting in-place private<=>shared conversion.
x86 (AMD):
* Forcefully invalidate SNP VMSA pages if their backing guest_memfd page is
zapped/invalidated, e.g. due to a PUNCH_HOLE in response to a Page-State
Change request.
* Remove a dying VM from the GA Log notifier list before the VM is actually
destroyed, to fix a potential use-after-free.
* While FOLL_WRITE was needed in the past to trigger CoW unsharing, nowadays
FOLL_LONGTERM does that already even without FOLL_WRITE, and in fact,
get_user_pages() actually disallows FOLL_WRITE together with FOLL_LONGTERM.
So don't pass FOLL_WRITE when registering encrypted memory regions, i.e. when
pinning SEV/SEV-ES guest memory, to fix a regression with file-backed memory
introduced by KVM's (correct) usage of long-term pins.
(This was reviewed by mm maintainers; for more information, see commit
|
||
|
Linus Torvalds
|
70f5376dbd |
TTY / Serial driver updates for 7.3-rc1
Here is the "big" set of tty and serial driver updates for 7.3-rc1. Not really all that much happened this development cycle for this subsystem, changes in here are: - removal of the ipwireless driver as it's no longer used or needed - new 8250_mxpcie driver added - qcom serial driver updates and additions - vt mode validation addition - lots of other small serial driver updates and additions All of these have been in linux-next for weeks with no reported issues. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -----BEGIN PGP SIGNATURE----- iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCao2mTw8cZ3JlZ0Brcm9h aC5jb20ACgkQMUfUDdst+yk34ACdFfyDYJ0n1JcdskTxdNMBSPRkj7UAoJtMC/2y jxCfyfkM18YIuwZD6CvO =MlfE -----END PGP SIGNATURE----- Merge tag 'tty-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull TTY / serial driver updates from Greg KH: "Here is the "big" set of tty and serial driver updates for 7.3-rc1. Not really all that much happened this development cycle for this subsystem, changes in here are: - removal of the ipwireless driver as it's no longer used or needed - new 8250_mxpcie driver added - qcom serial driver updates and additions - vt mode validation addition - lots of other small serial driver updates and additions All of these have been in linux-next for weeks with no reported issues" * tag 'tty-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (97 commits) serial: imx: serialize imx_uart_ports[] lifetime tty: clear cdev pointer after cdev_add() failure tty: skip cdev_del() when no cdev is registered serial: core: clear freed pointers on uart_register_driver() failure serial: core: do fallible allocations before the console can be registered serial: 8250_mxpcie: implement rx_trig_bytes callbacks via MUEx50 RTL serial: 8250_mxpcie: introduce per-port private data structure serial: 8250: allow UART drivers to override rx_trig_bytes handling serial: 8250_mxpcie: add break support for RS485 using MUEx50 features serial: 8250: allow low-level drivers to override break control serial: 8250_mxpcie: support serial interface mode switching serial: 8250_mxpcie: speed up TX using memory-mapped FIFO window serial: 8250_mxpcie: speed up RX using memory-mapped FIFO window serial: 8250_mxpcie: add custom handle_irq callback serial: 8250_mxpcie: offload XON/XOFF flow control to MUEx50 hardware serial: 8250_mxpcie: enable automatic RTS/CTS flow control serial: 8250_mxpcie: enable enhanced mode and program FIFO trigger levels serial: 8250: add Moxa MUEx50 UART port type serial: 8250: split Moxa PCIe serial board support out of 8250_pci serial: qcom-geni: Use geni_se_set_perf_level() for baud rate perf level ... |
||
|
Linus Torvalds
|
f4d50813c0 |
USB / Thunderbolt changes for 7.3-rc1
Here is the big set of USB and Thunderbolt driver updates for 7.3-rc1.
Lots of driver work for new devices and systems, and many other minor
fixes and updates. Included in here are:
- Thunderbolt subsystem driver updates and additions
- typec driver updates and additions
- usb gadget fixes all over the place, seems like people are finally
paying attention to these drivers for some reason
- xhci driver updates and fixes based on lots of reports
- usb-serial driver updates and additions
- new device ids
- other minor USB driver updates and fixes
All of these have been in linux-next for a while with no reported issues
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCao2lJA8cZ3JlZ0Brcm9h
aC5jb20ACgkQMUfUDdst+ynK3QCeLQdHatZ2d5sJdvssiLKREZeND4EAnj+V1K1O
PcVJzKAiC4dgSZ5SOwn1
=OJea
-----END PGP SIGNATURE-----
Merge tag 'usb-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
Pull USB / Thunderbolt updates from Greg KH:
"Here is the big set of USB and Thunderbolt driver updates for 7.3-rc1.
Lots of driver work for new devices and systems, and many other minor
fixes and updates. Included in here are:
- Thunderbolt subsystem driver updates and additions
- typec driver updates and additions
- usb gadget fixes all over the place, seems like people are finally
paying attention to these drivers for some reason
- xhci driver updates and fixes based on lots of reports
- usb-serial driver updates and additions
- new device ids
- other minor USB driver updates and fixes
All of these have been in linux-next for a while with no reported issues"
* tag 'usb-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (163 commits)
usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()
usb: typec: hd3ss3220: fix VBUS regulator error message
usb: usbfs: fix use-after-free of usb_device in usbdev_release()
usb: gadget: u_audio: Fix use-after-free on sound card disconnect
usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition
usb: gadget: f_tcm: keep port count until LUN teardown completes
usb: usbtest: disable dynamic ID support
usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive()
USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion
usb: gadget: snps_udc_plat: clean up PHY on probe deferral
usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()
usb: dwc2: gadget: Exit partial power down state when changing USB pull-up
usb: gadget: f_fs: Fix Use-After-Free in AIO error path
usb: gadget: f_fs: Prevent deadlock during ep0 read loop
usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed
usb: gadget: midi2: remove default configfs groups on teardown
usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init()
usb: typec: thunderbolt: Disable work before freeing tbt on remove
usb: xhci: Handle bogus TRB pointers in Missed Service Error events
...
|
||
|
Linus Torvalds
|
29b0977977 |
Staging driver updates for 7.3-rc1
Here is the big set of drivers/staging/ updates for 7.3-rc1.
Nothing major in here at all, just lots of tiny coding style cleanups,
refactoring, and minor "fixes" as found by some tools. Included in here
- loads of coding style and refactoring in the rtl8723bs wireless
driver
- minor greybus driver cleanups
- minor sm750fb driver cleanups
- other even smaller driver cleanups
All of these have been in linux-next for a weeks with no reported
issues.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCao2kLQ8cZ3JlZ0Brcm9h
aC5jb20ACgkQMUfUDdst+ym5DgCfcNXDT1NW9BrzpktehBbt+2xhtdsAoL/oRN9n
6npdA+zvLcvV6hE3kdta
=3AGF
-----END PGP SIGNATURE-----
Merge tag 'staging-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging
Pull staging driver updates from Greg KH:
"Here is the big set of drivers/staging/ updates for 7.3-rc1.
Nothing major in here at all, just lots of tiny coding style cleanups,
refactoring, and minor "fixes" as found by some tools. Included in
here
- loads of coding style and refactoring in the rtl8723bs wireless
driver
- minor greybus driver cleanups
- minor sm750fb driver cleanups
- other even smaller driver cleanups
All of these have been in linux-next for a weeks with no reported
issues"
* tag 'staging-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (186 commits)
staging: rtl8723bs: add blank line after declaration
staging: rtl8723bs: remove unused enumerations
staging: rtl8723bs: use !psta instead of comparison to NULL
staging: rtl8723bs: Replace custom RotR1 macro with ror16
staging: rtl8723bs: Remove multiple assignments
staging: rtl8723bs: fix several line spaces in wifi.h
staging: rtl8723bs: remove redundant goto in rtw_free_xmitframe()
staging: rtl8723bs: rename Restore_DM_Func_Flag functions to avoid CamelCase
staging: rtl8723bs: rename Save_DM_Func_Flag functions to avoid CamelCase
staging: rtl8723bs: wrap line over 100 characters
staging: rtl8723bs: remove unnecessary whitespace
staging: rtl8723bs: remove extra blank lines in rtw_qos.h
staging: rtl8723bs: remove redundant ReadChipVersion8723B wrapper
staging: rtl8723bs: remove debug fields from hal_com_data
staging: rtl8723bs: remove 'rf_chip' from struct hal_com_data
staging: rtl8723bs: remove unused spinlock 'SdioTxFIFOFreePageLock'
staging: rtl8723bs: remove unused 'UsbRxHighSpeedMode' from hal_com_data
staging: rtl8723bs: hal: remove unused readings from the chip
staging: rtl8723bs: remove unused 'bNeedIQK' from struct hal_com_data
staging: rtl8723bs: remove unused 'bIQKInitialized ' from hal_com_data
...
|
||
|
Linus Torvalds
|
93e4b3076b |
Char/Misc/IIO/etc driver update for 7.3-rc1
Here is the big set of char, misc, iio, counter, fpga, and other small
driver subsystems for 7.3-rc1.
Overall, due to some driver removals we only added a bit more code than
removed, which was a nice change. Highlights in this merge request are:
- Loads of IIO driver updates and additions
- binder driver updates (more on that below...)
- Removal of the SGI XP and GRU drivers as they are not used anymore
and turn out to be pretty insecure overall
- Removal of the obsolete ibmasm driver as it's not being used anymore
- Coresight driver updates and additions
- Mei driver udpates
- Counter driver updates
- FPGA driver updates
- ICC driver updates
- lots and lots of other tiny driver updates to resolve reported
issues
All of these have been in linux-next for a while, with the only reported
issues being some major merge conflicts. Miguel pointed out some of
these with the Rust tree merge, which is the majority of them. I'll
follow up with a diffstat of the merge resolution I made against your
most recent tree, which works for me.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCao143A8cZ3JlZ0Brcm9h
aC5jb20ACgkQMUfUDdst+ymtUgCeKB62gT1JfA86cg3NDB1opp+10N0An3oBBegQ
IJLqJgK45dTNtMGBwGFV
=68af
-----END PGP SIGNATURE-----
Merge tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
Pull char/misc/IIO/etc driver updates from Greg KH:
"Here is the big set of char, misc, iio, counter, fpga, and other small
driver subsystems for 7.3-rc1.
Overall, due to some driver removals we only added a bit more code
than removed, which was a nice change. Highlights in this merge
request are:
- Loads of IIO driver updates and additions
- binder driver updates (more on that below...)
- Removal of the SGI XP and GRU drivers as they are not used anymore
and turn out to be pretty insecure overall
- Removal of the obsolete ibmasm driver as it's not being used
anymore
- Coresight driver updates and additions
- Mei driver udpates
- Counter driver updates
- FPGA driver updates
- ICC driver updates
- lots and lots of other tiny driver updates to resolve reported
issues
All of these have been in linux-next for a while"
* tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (513 commits)
iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF
iio: adc: pac1921: fix wrong channel used in trigger handler read
iio: light: gp2ap002: re-enable irq if runtime suspend fails
iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
iio: light: apds9306: fix PM reference leak in apds9306_read_data()
iio: gyro: mpu3050: fix sign of raw angular velocity readings
iio: srf04: fix pm_runtime handling on probe error path
iio: adc: ad4080: configure backend data size
iio: adc: adi-axi-adc: add data size support for AD408X backend
iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable
iio: dac: ad5446: fix OF module device table
iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask
iio: light: opt4001: Reject integration times with a non-zero seconds part
iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem()
iio: light: opt4001: Fix power down clearing bits of the wrong register
iio: light: opt4060: Fix incorrect register name in threshold read error message
iio: light: opt4060: Fix pointer type passed to div_u64_rem()
iio: light: opt4060: Reject integration times with a non-zero seconds part
iio: light: ltrf216a: fix runtime PM reference leak in error path
iio: pressure: dps310: fix NULL pointer dereference on ACPI probe
...
|
||
|
Linus Torvalds
|
5f5ef9c407 |
Bootconfig updates for v7.3:
- bootconfig: Support build-time command line rendering for embedded bootconfig
. bootconfig: render descendant keys when xbc_snprint_cmdline() root has a
value. Fix xbc_snprint_cmdline() to render descendant keys when the root
has both a value and subkeys, and treats empty subtrees correctly.
. bootconfig: render embedded bootconfig as a kernel cmdline at build time.
Add build-time pipeline using tools/bootconfig -C to render the embedded
bootconfig "kernel" subtree into .init.rodata as a cmdline string.
. bootconfig: clean build-time tools/bootconfig from make clean.
. bootconfig: add xbc_prepend_embedded_cmdline() helper.
Add helper to prepend embedded bootconfig cmdline into boot_command_line
early before parse_early_param().
. x86/setup: prepend embedded bootconfig cmdline before parse_early_param.
Wire early prepend helper in x86 setup_arch() so early_param handlers see
values from the embedded bootconfig. (So this feature is currently x86 only)
. bootconfig: skip runtime kernel.* render once prepended early.
Avoid duplicating "kernel" keys in setup_boot_config().
. init/main.c: use bootconfig_cmdline_requested() for the runtime opt-in.
Refactor setup_boot_config() to share bootconfig_cmdline_requested().
. Documentation: bootconfig: document build-time cmdline rendering.
Document CONFIG_CMDLINE_FROM_BOOTCONFIG usage, requirements, and precedence.
-----BEGIN PGP SIGNATURE-----
iQFPBAABCgA5FiEEh7BulGwFlgAOi5DV2/sHvwUrPxsFAmqNQwAbHG1hc2FtaS5o
aXJhbWF0c3VAZ21haWwuY29tAAoJENv7B78FKz8bcLcH/1GHYfxZHrl1aA112j60
YqBgn98hnCiH+Q1wMhqgDIF7ks1qePT9pq0zC2vJawVa1BM6OM5RpnC4BW+YSpCa
7tRf209Hrr5sd2i0vmsnYpmd9SV9JWKsuyz6VJjFjPsfEFtI9Nj7d3jm7WfGypUc
aNEAjf3sntEaFB44MoKekHlLzTXDFrgBaUaAcdw3aGjUU1CE9ltdT+QooQGv6CHe
7Z+UlmGhg+jkQa1tNNpRnKZErD5OBLnTkoMU5ca3M7PQLlPjIcOTf62SInm47Ma/
viOyzkSYIXC/yq2U4Je4qKcZaKhNIL61jtQGFI8EbbZ0x1BzVbPjbr0DB3iq2YW4
4Xk=
=8++3
-----END PGP SIGNATURE-----
Merge tag 'bootconfig-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull bootconfig updates from Masami Hiramatsu:
- Support build-time command line building for embedded bootconfig
- Fix xbc_snprint_cmdline() to render descendant keys when the root has
both a value and subkeys, and treats empty subtrees correctly.
- Add build-time pipeline using tools/bootconfig -C to render the
embedded bootconfig "kernel" subtree into .init.rodata as a cmdline
string.
- Clean build-time tools/bootconfig from make clean
- Add helper to prepend embedded bootconfig cmdline into
boot_command_line early before parse_early_param()
- Wire early prepend helper in x86 setup_arch() so early_param handlers
see values from the embedded bootconfig (currently x86 only)
- Avoid duplicating "kernel" keys in setup_boot_config()
- Refactor setup_boot_config() to share bootconfig_cmdline_requested()
- Document CONFIG_CMDLINE_FROM_BOOTCONFIG usage, requirements, and
precedence
* tag 'bootconfig-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
init/main.c: use bootconfig_cmdline_requested() for the runtime opt-in
bootconfig: skip runtime kernel.* render once prepended early
x86/setup: prepend embedded bootconfig cmdline before parse_early_param
Documentation: bootconfig: document build-time cmdline rendering
bootconfig: add xbc_prepend_embedded_cmdline() helper
bootconfig: clean build-time tools/bootconfig from make clean
bootconfig: render embedded bootconfig as a kernel cmdline at build time
bootconfig: render descendant keys when xbc_snprint_cmdline() root has a value
|
||
|
Linus Torvalds
|
7f22f3a193 |
This contains 52 commits with improvements to compression support,
metadata handling, error propagation, and filesystem robustness.
New feature:
- Add optional read support for Windows System Compression (WOF).
Add CONFIG_NTFS_FS_WOF_COMPRESSION and support reading WOF-compressed
files through the NTFS page-read path. This includes parsing
REPARSE_TAG_WOF, handling resident and non-resident WOF metadata and
compressed chunks, and adding kernel-side XPRESS 4K/8K/16K and LZX 32K
decompressors. The codecs use a common transparent compression interface
shared with LZNT1. WOF support is read-only and disabled unless
explicitly enabled.
Other changes:
- Harden malformed filesystem handling and error paths.
Add bounds and consistency checks for mapping pairs, run lengths, MFT
locations, update-sequence offsets, non-resident attributes, compressed
attributes, index roots, and bitmap scans. Prevent out-of-bounds accesses
in decompression, MFT allocation, and index conversion paths, clean up MFT
mappings and attribute search contexts on failure, and propagate attribute
and inode initialization errors correctly.
- Improve compressed-file I/O path.
Fix compressed writes on large-page and highmem systems, reuse compression
contexts and output workspaces, avoid unnecessary reads for full-unit
overwrites, and submit one bio per compressed write unit. Write replacement
data before publishing the new mapping, correctly handle zero-filled
compressed blocks, and fix initialized-size and folio state updates after
compressed writes.
- Synchronize resident reads with MFT record updates.
- Validate the final EA stream size before modifying existing data, rewrite
the stream safely when replacing entries, restore the previous state when
metadata updates fail, and remove the EA attribute pair when the last
entry is deleted.
- Apply Windows filename restrictions only when windows_names is enabled.
- Allow index roots to relocate to extent MFT records when the base record
lacks sufficient space.
- Move non-resident attribute payload data before shrinking its record.
- Correct resident-to-non-resident conversion when compression or sparse
flags are enabled.
- Prepare file allocation and initialized-size updates before buffered or
direct I/O submission, and use pagecache_isize_extended() when extending
the file size.
- Fix highmem and page/folio access in compressed I/O paths by using the
correct local mappings and page helpers.
- Apply per-file $LXMOD permissions instead of mount masks when available,
and prevent unprivileged writes to reserved $LX* attributes.
- Update the NTFS maintainer mailing list.
- Four small cleanups.
-----BEGIN PGP SIGNATURE-----
iQJKBAABCgA0FiEE6NzKS6Uv/XAAGHgyZwv7A1FEIQgFAmqNZO8WHGxpbmtpbmpl
b25Aa2VybmVsLm9yZwAKCRBnC/sDUUQhCOOoD/9wqck6nOvUaCTRvcKbTEw2yVrR
C+S15hC/OuwqlxFHQQucav2NvCqwzuL/T/OBHycWi0NOycq+xYQQExs5wTms77R8
0a+lS5QS+evc8XM1IFOywiaetJQCpn6ivDimRKzZiuMJGPwdAVYY6dRX90WW1afl
fk9uxQHcy1Tvv7L1zvNbkr8vaycOH7LEWDukEe2XAXeZbQpumF8N0TETjH3oiNUK
NinDliRDisn0Z00qkV+DcGLQCYdVYgyJc9jW0lWT2Q2dd/o/NxfwZCrGXOSkzn1Y
6OXtMB36cQAxrW/lINwX0hSPj+YcMYQIi32nH3qyVC6+CcJ01OD5VU1aPtSsOqIX
viehEDBca7WJJq2AUBBUeAhK+Mq/exqNmm0UbMZKYikckkDrGDoYrnGMK4QAtkP5
EEduZRVy57VsRDV9gO/oNCMO3+VoAJ+iU27XFcHBxzpbsR0vmJWAjivSoRJducg0
nwZwUXfDxe6g4qFMVdd255y133uAsZ5G/lqPVFXEDiYfK/uCnKMH8O20HkzhYA75
b7sDbboRYhiXJhMKz08fKMgov4LvewgnC2wk0Farrvb719H6ELdcHooaIfBF4pkc
o1UStWnh/a6Sd4L5FCnVn4IBfiVkz9eDQzL0DKfhLfzVKcxyNmGStxrGSyUCZd6K
k1pRdpLI9Z2h6ALfhQ==
=pHcD
-----END PGP SIGNATURE-----
Merge tag 'ntfs-for-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs
Pull ntfs updates from Namjae Jeon:
"This contains improvements to compression support, metadata handling,
error propagation, and filesystem robustness.
New feature:
- Add optional read support for Windows System Compression (WOF)
Add CONFIG_NTFS_FS_WOF_COMPRESSION and support reading
WOF-compressed files through the NTFS page-read path. This includes
parsing REPARSE_TAG_WOF, handling resident and non-resident WOF
metadata and compressed chunks, and adding kernel-side XPRESS
4K/8K/16K and LZX 32K decompressors. The codecs use a common
transparent compression interface shared with LZNT1.
WOF support is read-only and disabled unless explicitly enabled.
Other changes:
- Harden malformed filesystem handling and error paths.
Add bounds and consistency checks for mapping pairs, run lengths,
MFT locations, update-sequence offsets, non-resident attributes,
compressed attributes, index roots, and bitmap scans. Prevent
out-of-bounds accesses in decompression, MFT allocation, and index
conversion paths, clean up MFT mappings and attribute search
contexts on failure, and propagate attribute and inode
initialization errors correctly.
- Improve compressed-file I/O path.
Fix compressed writes on large-page and highmem systems, reuse
compression contexts and output workspaces, avoid unnecessary reads
for full-unit overwrites, and submit one bio per compressed write
unit. Write replacement data before publishing the new mapping,
correctly handle zero-filled compressed blocks, and fix
initialized-size and folio state updates after compressed writes.
- Synchronize resident reads with MFT record updates.
- Validate the final EA stream size before modifying existing data,
rewrite the stream safely when replacing entries, restore the
previous state when metadata updates fail, and remove the EA
attribute pair when the last entry is deleted.
- Apply Windows filename restrictions only when windows_names is
enabled.
- Allow index roots to relocate to extent MFT records when the base
record lacks sufficient space.
- Move non-resident attribute payload data before shrinking its
record.
- Correct resident-to-non-resident conversion when compression or
sparse flags are enabled.
- Prepare file allocation and initialized-size updates before
buffered or direct I/O submission, and use
pagecache_isize_extended() when extending the file size.
- Fix highmem and page/folio access in compressed I/O paths by using
the correct local mappings and page helpers.
- Apply per-file $LXMOD permissions instead of mount masks when
available, and prevent unprivileged writes to reserved $LX*
attributes
- Update the NTFS maintainer mailing list
- Small cleanups"
* tag 'ntfs-for-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs: (52 commits)
ntfs: support resident WOF decompression
ntfs: add non-resident WOF decompression
ntfs: implement codec ops for LZX and XPRESS
ntfs: port lzx/xpress decompressors from ntfs-3g-system-compression
ntfs: return errors from inode initialization
ntfs: parse REPARSE_TAG_WOF
ntfs: return errors from ntfs_attr_readall
ntfs: add WOF compression config option
ntfs: define LZNT1 codec ops under transparent codec interface
ntfs: introduce transparent compression codec interface
ntfs: reject invalid empty mapping pairs
ntfs: fix resource leak in ntfs_new_attr_flags
ntfs: validate usa_ofs before preserving the update sequence number
ntfs: fix off-by-one page overflow in ntfs_decompress()
ntfs: do not update ctime when setxattr fails
ntfs: reject invalid MFT LCNs from boot sector
ntfs: serialize resident iomap reads with mrec_lock
ntfs: verify run length exceeding volume boundary
ntfs: allow index root relocation
ntfs: validate non-resident attribute offsets
...
|
||
|
Linus Torvalds
|
9cebfe6504 |
fuse update for 7.3
-----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQSQHSd0lITzzeNWNm3h3BK/laaZPAUCao1RzQAKCRDh3BK/laaZ PJ2EAP9dfslni4sFYqtXv/43Wk2iVwwdGRRSy5Tfoq8nCeNXpQEAygIv9BuJYpl6 DL861AOn/NfDBXpeU0vX4WQpTgtFIgc= =Av0t -----END PGP SIGNATURE----- Merge tag 'fuse-update-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse Pull fuse updates from Miklos Szeredi: - Improve performance of the io-uring transport by introducing buffer pools and zero-copy (Joanne) - Fix lots of bugs (Baokun Li) - Fix io-uring initialization issues (Joanne, Bernd) - More prep work for large folios (Joanne) - Don't limit buffered read to 128k (Jim Harris) - Fix zeroing of page end (dirtied with mmap) on file size extension (Jimmy Zuber) - Improve performance in certain cases with wake_up_sync() when queuing request (Xuewen Yan) - Misc fixes and cleanups (Xuewen Yan) * tag 'fuse-update-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: (35 commits) fuse: zero the partial EOF page when extending a file io_uring: Add missing include for ITER_SOURCE and ITER_DEST fuse: Fix the condition to enable over-io-uring fuse: invalidate the correct range after O_APPEND direct write selftests/fuse: test post-EOF page zeroing when a file is extended fuse: wake one waiter per freed slot when raising max_background fuse: use min_not_zero() in fuse_init_server_timeout() fuse: copy request headers via a stack buffer for io-uring fuse: give wakeup hints to the scheduler for synchronous requests fuse: check for NULL root inode in fuse_fill_super_submount fuse: reject a duplicate fd= mount option cuse: wait for pending RCU callbacks on module exit fuse: fix invalidate lock leak on open O_TRUNC DAX failure fuse: fix invalidate lock leak on setattr writeback failure fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free fuse: make dentry_tree_work static docs: fuse: document io-uring buffer pool and zero-copy uapi fuse: add zero-copy over io-uring fuse: support registered buffer pools in io-uring fuse: add io-uring buffer pools ... |
||
|
Linus Torvalds
|
ce14fe4cd7 |
There are thirty-three client fixes:
- five sensitive data leak fixes (clear stack and heap cryptographic keys/hashes) - six file size and cache synchronization fixes (fscache cookie serialization and truncation handling) - seven protocol validation and buffer safety fixes (prevent OOB access and loff_t underflow) - six metadata and POSIX attribute fixes (proper hard-link counts and setuid/setgid stripping) - three DFS cache and unmount fixes (prevent target-hint UAF and unmount hangs) - six general client improvements (fix read request leaks, stats loops, handle servers that don't support O_TMPFILE) -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQTcqRusfSdYROJQwGkpVtNKoQNdYwUCaoy9dgAKCRApVtNKoQNd Y5zrAP9HRp0z9rLmezHzGoTnF+0WYnkE9xK9pqRDoIjflXPyDAD+IDYzBXTWJpoq O1+3OiuNGvoF+X46i8xE9voAbnCTDgM= =ETzr -----END PGP SIGNATURE----- Merge tag 'cifs-fixes-7.3-rc1' of https://git.manguebit.org/linux Pull smb client updates from Paulo Alcantara: - clear sensitive data after use (stack and heap cryptographic keys/hashes) - file size and cache synchronization fixes (fscache cookie serialization and truncation handling) - protocol validation and buffer safety fixes (prevent OOB access and loff_t underflow) - metadata and POSIX attribute fixes (proper hard-link counts and setuid/setgid stripping) - DFS cache and unmount fixes (prevent target-hint UAF and unmount hangs) - general client improvements (fix read request leaks, stats loops, handle servers that don't support O_TMPFILE) * tag 'cifs-fixes-7.3-rc1' of https://git.manguebit.org/linux: (33 commits) cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 smb: client: reject a tree connect response whose byte count is too small cifs: call pagecache_isize_extended() in cifs_setsize() when extending smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV smb: client: remove redundant NULL check before kfree() smb: client: restore the data_offset bound in is_valid_oplock_break() cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() smb: client: Avoid leaking sensitive data to the heap in connect.c smb: client: Clear sensitive stack data in smb1encrypt.c smb: client: Clear sensitive stack data in cifsencrypt.c smb: client: Clear sensitive stack and heap data in smb2ops.c smb: client: Clear sensitive stack data in smb2transport.c Revert "cifs: remove all cifs files before kill super" smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() smb: client: fix ALIGN() overflow in symlink_data() error context loop smb: client: simplify __build_path_from_dentry_optional_prefix() smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() smb/client: decode reparse metadata using its payload type smb/client: preserve open info type across compound queries ... |
||
|
Frank Sorenson
|
6c322f5cf7 |
cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0
With len == 0 (clone to EOF), the effective length is computed as:
len = src_inode->i_size - off;
If off > i_size, this is a negative loff_t, corrupting the ByteCount
in the FSCTL_DUPLICATE_EXTENTS_TO_FILE request and inverting the range
in filemap_write_and_wait_range(). The existing off >= i_size check
fires only after the ioctl has already been sent.
Snapshot i_size_read() once for both the bounds check and the length
calculation, eliminating the TOCTOU and 32-bit torn-read risk. Reject
off > src_size with -EINVAL. Treat off == src_size as a no-op,
consistent with __generic_remap_file_range_prep().
Fixes:
|
||
|
Bryam Vargas
|
65deb18359 |
smb: client: reject a tree connect response whose byte count is too small
CIFSTCon() bounds its strnlen() over the byte area with the server's
ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int
and converts to a huge size_t. The later subtraction wraps the __u16
bytes_left, and that is what bounds cifs_strndup_from_utf16(): a bound of
up to 65535 against a ~16 KB cifs_req_poolp object runs off the end of the
slab object, and the bytes reach userspace through tcon->nativeFileSystem
in /proc/fs/cifs/DebugData.
Reject a byte area too small for what the parser consumes. Two bytes is
the least it can consume, and no conformant response carries fewer. The
new trace point is the 129th smb_eio_trace entry, which __mode(byte)
cannot represent, so the attribute goes with it.
Fixes:
|
||
|
Frank Sorenson
|
c510edb973 |
cifs: call pagecache_isize_extended() in cifs_setsize() when extending
cifs_setsize() calls truncate_pagecache() but skips
pagecache_isize_extended() on extension. truncate_setsize() shows
the correct pattern:
i_size_write(inode, newsize);
if (newsize > oldsize)
pagecache_isize_extended(inode, oldsize, newsize);
truncate_pagecache(inode, newsize);
pagecache_isize_extended() zeroes the tail of the page straddling old
EOF. Without it, dirty bytes in that region can be written back to
the server, exposing stale data in the newly extended range.
Cc: stable@vger.kernel.org
Cc: David Howells <dhowells@redhat.com>
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
|
||
|
Frank Sorenson
|
5d14030b46 |
smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV
The LXDEV block in cifs_query_path_info() uses SMB2_WSL_XATTR_MODE_SIZE
(4) instead of SMB2_WSL_XATTR_DEV_SIZE (8), undercounting eas_len by 4
bytes per $LXDEV EA.
eas_len is used only as a zero/non-zero presence flag so there is no
current functional impact, but the value is incorrect and misleading.
Fixes: 97db41604555 ("smb: client: parse uid, gid, mode and dev from WSL reparse points")
Cc: stable@vger.kernel.org
Cc: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
|
||
|
Mohammad Shahid
|
019716ca26 |
smb: client: remove redundant NULL check before kfree()
kfree() safely handles NULL pointers, so the explicit NULL check before calling kfree() is unnecessary. This issue was reported by ifnullfree.cocci. Signed-off-by: Mohammad Shahid <mdshahid03@gmail.com> Signed-off-by: Paulo Alcantara <pc@manguebit.org> |
||
|
Bryam Vargas
|
ba22f575de |
smb: client: restore the data_offset bound in is_valid_oplock_break()
Commit |
||
|
Frank Sorenson
|
b96db32fed |
cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size()
When the else branch of cifs_file_set_size() finds a writable file handle
via find_writable_file(), it borrows tcon and server from the handle's
tlink, attempts the handle-based set_file_size() RPC, and then releases
the handle with cifsFileInfo_put().
If set_file_size() fails, execution falls through to the path-based
fallback, which reuses the borrowed tcon and server under the
"if (tcon == NULL)" guard. Since tcon is not NULL at that point, the
guard is skipped. If cifsFileInfo_put() dropped the last reference on a
tlink that was already removed from the tlink tree (TCON_LINK_IN_TREE
cleared, as happens during reconnection or session teardown),
cifs_put_tlink() will have freed tcon; the subsequent set_path_size()
call is then a use-after-free.
Setting tcon = NULL after cifsFileInfo_put() causes the existing guard
to take the cifs_sb_tlink() path, which acquires a fresh reference for
the path-based operation or fails cleanly if the session is gone.
Fixes:
|
||
|
Thomas Huth
|
111a2b8717 |
smb: client: Avoid leaking sensitive data to the heap in connect.c
TCP_Server_Info contains a preauth_sha_hash[] and a cryptkey[] array that might contain sensitive data. Thus free its memory with kfree_sensitive() to avoid that we are leaking this information to the heap. Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Paulo Alcantara <pc@manguebit.org> |
||
|
Thomas Huth
|
2f9af06e30 |
smb: client: Clear sensitive stack data in smb1encrypt.c
Make sure to not leak signature data via the stack, clear it with memzero_explicit() before leaving the function. To avoid that we have to introduce "goto"-cleanup here, we re-arrange the code a little bit (and drop the commented cifs_dump_mem debug code that looks like a leftover from very early days). Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Paulo Alcantara <pc@manguebit.org> |
||
|
Thomas Huth
|
1a6bd74a27 |
smb: client: Clear sensitive stack data in cifsencrypt.c
Make sure to not leak hash data via the stack, clear it with memzero_explicit() before leaving the function. Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Paulo Alcantara <pc@manguebit.org> |
||
|
Thomas Huth
|
55a1ad8413 |
smb: client: Clear sensitive stack and heap data in smb2ops.c
Make sure to not leak key-related data via the heap or the stack by using kfree_sensitive() or memzero_explicit() here. Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Paulo Alcantara <pc@manguebit.org> |
||
|
Thomas Huth
|
3d93986f68 |
smb: client: Clear sensitive stack data in smb2transport.c
Sensitive data like keys that are stored in stack-local arrays could be leaked via the stack to the calling functions. There is no known vulnerability for this right now, but it's good security style to explicitly zeroize this sensitive material as soon as possible to avoid that it could be exploited together with other bugs later. Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Paulo Alcantara <pc@manguebit.org> |
||
|
Zizhi Wo
|
ce31ec06d3 |
Revert "cifs: remove all cifs files before kill super"
This reverts commit |
||
|
Frank Sorenson
|
05f78e6cf3 |
smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()
reparse_buf_ptr() reads buf->ReparseDataLength before checking that
count covers the full fixed header:
buf = (struct reparse_data_buffer *)((u8 *)io + off);
len = sizeof(*buf); /* 8 bytes */
rdlen = le16_to_cpu(buf->ReparseDataLength); /* offset 4, 2 bytes */
if (count < len || count < rdlen + len) /* check comes after */
struct reparse_data_buffer has ReparseDataLength at offset 4. If a
server returns OutputCount < 6, the read at offset 4-5 reaches past
the end of the received data. The off+count bounds against iov_len
were already validated, but that does not protect against count being
smaller than sizeof(*buf).
Split the check: verify count >= sizeof(*buf) before reading
ReparseDataLength, then verify count covers the data region.
Fixes: a158bb66b137 ("smb: client: optimise reparse point querying")
Cc: stable@vger.kernel.org
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
|
||
|
Frank Sorenson
|
62656b024e |
smb: client: fix ALIGN() overflow in symlink_data() error context loop
The check added by commit |
||
|
Dmitry Antipov
|
3fffaa8a64 |
smb: client: simplify __build_path_from_dentry_optional_prefix()
Use the convenient 'strreplace()' to simplify '__build_path_from_dentry_optional_prefix()'. Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Paulo Alcantara <pc@manguebit.org> |
||
|
Frank Sorenson
|
730d0bb195 |
smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2
When a valid primary TRANSACT2 response has been received (mid->resp_buf
set, mid->multiRsp true) and a subsequent secondary response causes
cifs_check_trans2() to return false -- either because the SMB header is
invalid (malformed != 0) or because check2ndT2() rejects the PDU --
handle_mid() overwrites mid->resp_buf with the new buffer (leaking the
primary buffer) and, because mid->multiRsp is set, skips the
server->smallbuf/bigbuf NULL-out. When the user thread frees
mid->resp_buf, server->smallbuf or server->bigbuf is left dangling; the
demux thread reuses it for the next packet, resulting in a use-after-free.
Combine both early-exit conditions and, when mid->multiRsp is already
set, abort the pending transaction inline: set multiEnd, call
dequeue_mid() with malformed=true, and return true so handle_mid() exits
without touching mid->resp_buf or the server buffer pointers.
Fixes:
|
||
|
Frank Sorenson
|
6343c1da56 |
smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()
coalesce_t2() computes data pointers directly from server-supplied
DataOffset fields with no validation against buffer bounds:
data_area_of_tgt = (char *)&pSMBt->hdr.Protocol +
get_unaligned_le16(&pSMBt->t2_rsp.DataOffset);
data_area_of_src = (char *)&pSMBs->hdr.Protocol +
get_unaligned_le16(&pSMBs->t2_rsp.DataOffset);
data_area_of_tgt += total_in_tgt;
...
memcpy(data_area_of_tgt, data_area_of_src, total_in_src);
A small DataOffset can push a pointer below the actual byte area,
overwriting header fields; a large one can push it past the buffer
end, causing out-of-bounds heap reads (source) or writes (target).
The BCC overflow guard does not prevent this: BCC reflects how much
data is present, while DataOffset controls where in the buffer it
starts.
The "validate target area" comment present since the function was
first written in 2005 was a placeholder that was never implemented.
Add lower- and upper-bound checks for both data pointers before the
memcpy, and before any target header fields are modified.
Fixes:
|
||
|
Ze Tan
|
43549eb842 |
smb/client: decode reparse metadata using its payload type
cifs_open_info_data stores FILE_ALL_INFORMATION and SMB3 POSIX query
information in a union. reparse_info_to_fattr() selects a union member
from the mount mode, while several directory checks always read
fi.Attributes.
The metadata can instead come from an SMB2 CREATE response on a POSIX
mount, or from a POSIX query while processing a reparse point. In those
cases the mount mode and hard-coded fi accesses select the wrong union
member.
See the procedures below:
cifs_nt_open
smb2_open_file
SMB2_open
data->fi = SMB2 CREATE response
data->contains_posix_file_info = false
cifs_get_inode_info
reparse_info_to_fattr
if (tcon->posix_extensions) // true
smb311_posix_info_to_fattr
data->posix_fi // wrong union member
smb311_posix_get_fattr
smb2_query_path_info
smb2_compound_op
data->posix_fi = SMB3 POSIX query response
data->contains_posix_file_info = true
reparse_info_to_fattr
data->fi.Attributes // wrong union member
Add a common DOS attribute accessor and use contains_posix_file_info
both for attribute reads and for the final fattr conversion.
Signed-off-by: Ze Tan <tanze@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
|
||
|
Ze Tan
|
9437f2113b |
smb/client: preserve open info type across compound queries
contains_posix_file_info describes the metadata stored in the
fi/posix_fi union. GET_REPARSE and QUERY_WSL_EA do not update that
union, so clearing the flag while processing those responses can make
POSIX metadata look like FILE_ALL_INFORMATION.
Set the flag when CREATE or a validated query response actually
populates the union, and leave it unchanged for auxiliary compound
operations. This also avoids changing the type when a query fails
before copying any metadata.
The issue can be reproduced against a Samba server with SMB3 UNIX
extensions enabled:
mount -t cifs //<server>/<share> /mnt/cifs \
-o vers=3.1.1,posix,reparse=nfs,actimeo=0
mkfifo /mnt/cifs/test-fifo
umount /mnt/cifs
mount -t cifs //<server>/<share> /mnt/cifs \
-o vers=3.1.1,posix,reparse=nfs,actimeo=0
stat -c '%F %s' /mnt/cifs/test-fifo
Before this change, stat reports "fifo 1024" although the server-side
EOF is zero. After this change, it reports "fifo 0".
Fixes:
|
||
|
Ze Tan
|
ebdc1afb1e |
smb/client: mark missing nlink values as unknown
Several SMB1 fallback and open responses do not provide the hard link
count. The SMB2 create-only query fallback has the same limitation.
These paths currently leave a zero link count or synthesize a value of
one and then expose it as authoritative metadata.
Mark those results with unknown_nlink so existing inodes keep their
cached link count and new inodes receive the usual sane default.
This was tested against Samba with "server min protocol = NT1". Mount
the share using SMB1 with Unix extensions disabled:
mount -t cifs //<server>/<share> /mnt/cifs \
-o username=<user>,vers=1.0,nounix
Create three names for the same inode and cache its real link count:
TESTDIR=/mnt/cifs/nlink-repro-$$
mkdir "$TESTDIR"
touch "$TESTDIR/file1"
ln "$TESTDIR/file1" "$TESTDIR/file2"
ln "$TESTDIR/file1" "$TESTDIR/file3"
stat -c 'before open: %h' "$TESTDIR/file1"
Open the file and read the link count through the open descriptor:
exec 3<"$TESTDIR/file1"
stat -Lc 'after open: %h' /proc/$$/fd/3
exec 3<&-
Clean up the test files:
rm -f "$TESTDIR/file1" "$TESTDIR/file2" "$TESTDIR/file3"
rmdir "$TESTDIR"
Before this change, the two stat commands report 3 and 1 because the
SMB1 open response overwrites the known link count. With this change,
both commands report 3.
Signed-off-by: Ze Tan <tanze@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
|
||
|
Frank Sorenson
|
48cab1fd57 |
cifs: fix clearing stats for fastest execution of each smb2 command
The code to clear the 'fastest_cmd' statistics has a typo that
repeatedly clears the stat for cmd 0, rather than iterating
through each cmd. Fix the typo (0->i).
Fixes:
|
||
|
Linus Torvalds
|
66498c75b4 |
dmaengine updates for v7.3
Core:
- New API to combine configuration and preparation and users
New Support:
- Mediatek MT8189 SoC uart dma support
Updates:
- Designware dma driver flatten desc structures and simplify code,
interrupt-path groundwork changes, first part of PCI EP DMA support
- Updates to zynqmp_dma with runtime PM and device removal improvments
- Xilinx dma optimizations for AXIDMA and MCDMA channel management
-----BEGIN PGP SIGNATURE-----
iQIyBAABCgAdFiEE+vs47OPLdNbVcHzyfBQHDyUjg0cFAmqMgZEACgkQfBQHDyUj
g0e82w/4oLwj2QUjUO3QEO2l4E/RVS2/7UyCYKoJDAh66aM8Z3QjQ+lUvy+4wHHE
H8AtTpRzGEPpqqU+BckHEySf8mNhlA4ULhX17aPc+NKqYNlW8p2L63kPFYggI1ja
Z6/zVFrJDLwWTI0bSxAyJ6OoaObSXY0P6qpMcXKcqoHc981+EHMGrt/iVJM4Et/c
Q6nFMxIMgxYPI1VCMSrJqOBA4ZvymyWBisJPZf6SK0iH3PnaBnGWWWilpT8eUJxm
/MbVf2aUMetdK1+QVx1nNQUdb1eyAw50zFgbeDFDTXQ85Mfbvwh8XxxuT4wXJS5b
8MFwIEUq6iRgyjZYlykmFYBXw1A3SZWuWMUuMic4l13lw7dxk92wR31j99pIRaV3
g2iykz+gzQNQ5RNPuo/9j0s26FAmMNxbFW1RPAMnoVc33vZakV4ueaYtIy7s7mMJ
eDrE6YNDW24DWfWrSxkQGCW1qFGBUY20dXZ0sBmhUxpTLB0ubPZrWLvKKZe/qTUJ
wmrGNtTBLAYJMsGBm5VMybXwrQXa2Hvqa6KKFR2TdjpdcJwyWVHzRPpR+sJ7GfxZ
Lz59ODW3x1MnukRQS/T+RXGT42Tzk+qQQ+xK/yCrXq0VkxE3010n7SglTEEygGYP
Zk2eos4fARpXOUNqAxoKTVRyvQBxrIrHuJuQjAys2RhLHARuCQ==
=lUcr
-----END PGP SIGNATURE-----
Merge tag 'dmaengine-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine
Pull dmaengine updates from Vinod Koul:
"Core:
- New API to combine configuration and preparation and users
New hardware support:
- Mediatek MT8189 SoC uart dma support
Updates:
- Designware dma driver flatten desc structures and simplify code,
interrupt-path groundwork changes, first part of PCI EP DMA support
- Updates to zynqmp_dma with runtime PM and device removal
improvments
- Xilinx dma optimizations for AXIDMA and MCDMA channel management"
* tag 'dmaengine-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: (73 commits)
dmaengine: dw-edma: Mark emulated IRQ as level-triggered
dmaengine: idxd: assign all engines to group 0 in IAA defaults
dmaengine: qcom_hidma: remove conditional return with no effect
dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal
dmaengine: fsl-edma: tracing: no ptr dereference during log output
dmaengine: dw-edma: Program endpoint function numbers
dmaengine: dw-edma-pcie: Add chip flags to match data
dmaengine: dw-edma-pcie: Handle optional data blocks
dmaengine: dw-edma-pcie: Factor out descriptor block address lookup
dmaengine: dw-edma-pcie: Add register offset match flag
dmaengine: dw-edma-pcie: Add platform ops to match data
dmaengine: dw-edma-pcie: Rename vsec_data to dma_data
dmaengine: dw-edma-pcie: Add capability match data
dmaengine: dw-edma-pcie: Track non-LL mode in DMA data
dmaengine: dw-edma: Add partial channel ownership mode
dmaengine: dw-edma: Initialize IRQ data before requesting IRQs
dmaengine: dw-edma: Add core quiesce operations
dmaengine: dw-edma: Add per-channel interrupt routing control
dmaengine: dw-edma: Factor out HDMA interrupt setup helper
dmaengine: dw-edma: Defer channel IRQ handling to workqueue
...
|