Merge tag 'hwlock-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux
Pull hwspinlock updates from Bjorn Andersson:
"Propagate single-lock registration failures from radix_tree_insert(),
making caller sanity checks effective.
Update the hwspinlock MAINTAINERS repository URL to the current
remoteproc tree"
* tag 'hwlock-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux:
hwspinlock: propagate errno when registering single lock
MAINTAINERS: Update remoteproc repo url for hwspinlock
Merge tag 'rpmsg-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux
Pull rpmsg updates from Bjorn Andersson:
"Fix a GLINK endpoint teardown deadlock during driver detach and order
SMEM FIFO reads after the remote-updated availability check.
Prevent duplicate rpmsg character endpoint teardown when remoteproc
shutdown races with RPMSG_DESTROY_EPT_IOCTL.
Replace unsafe string and sysfs formatting helpers, and correct the
unregister_rpmsg_driver() return value documentation"
* tag 'rpmsg-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux:
rpmsg: glink: smem: order FIFO read after availability check
rpmsg: glink: fix deadlock in endpoint destroy during driver detach
rpmsg: char: Check for ongoing chrdev destroy
rpmsg: glink: Replace strcpy() with strscpy()
rpmsg: core: Fix incorrect return value documentation
rpmsg: Replace sprintf() with sysfs_emit() in sysfs show
Merge tag 'rproc-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux
Pull remoteproc updates from Bjorn Andersson:
"Add a remoteproc driver and binding for AMD MicroBlaze/V soft cores
executing from dual-port BRAM, with clock and reset control and
support for firmware without a resource table.
Introduce a generic Qualcomm PAS service with SCM and OP-TEE backends,
and migrate the PAS, MSS, and WCNSS remoteproc drivers to it. Add Nord
ADSP and CDSP support, Eliza CDSP support, Maili ADSP/CDSP bindings,
and late-attach SoCCP support for Kaanapali, Hawi, Maili, and Glymur.
Enable BAM-DMUX child devices for PAS modems and fix PAS memory
protection, handover, shutdown, and resource lifetime handling.
Harden remoteproc lifecycle handling by attaching asynchronously,
stopping crashed processors, synchronizing crash work with removal,
and forcing shutdown before device resources are released. Reallocate
resources during attach recovery and fix several reference and
error-path leaks.
[32 lines not shown]
Merge tag 'erofs-for-7.3-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs
Pull more erofs updates from Gao Xiang:
- Fix up the EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS default logic so
that "make savedefconfig" won't write the needless default value to
the defconfig file
- Add support for SEEK_{HOLE,DATA}, splice() as well as enable large
folios in inode_share mode
- Fix z_erofs_gbuf_growsize() after the previous buffer resizing fails
* tag 'erofs-for-7.3-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs:
erofs: simplify z_erofs_gbuf_growsize()
erofs: skip sufficiently large global buffers when resizing
erofs: support large folios in inode_share mode
erofs: support splice() in inode_share mode
erofs: support SEEK_HOLE/SEEK_DATA in inode_share mode
erofs: Fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS default logic
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
Pull kvm updates from Paolo Bonzini:
"ARM64:
- Add support for 'slot' based PMU events, paired with new UAPI that
compels the user to select a specific PMU implementation
- Lazy save/restore of vCPU state for pKVM, along with various fixes
and cleanups to the management of vCPU state between the untrusted
host and pKVM hypervisor
- Disable traps of EL1 registers for nested hypervisors when
FEAT_NV2p1 is present, guaranteeing that EL2-specific register bits
are stateful in the EL1 counterpart
- Leverage FEAT_NV3 to avoid unnecessary ERET/TLBI traps when the
scope of those instructions remains 'in host' (i.e. L1
kernel/userspace)
[253 lines not shown]
Merge tag 'tty-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty
Pull TTY / serial driver updates from Greg KH:
"Here is the "big" set of tty and serial driver updates for 7.3-rc1.
Not really all that much happened this development cycle for this
subsystem, changes in here are:
- removal of the ipwireless driver as it's no longer used or needed
- new 8250_mxpcie driver added
- qcom serial driver updates and additions
- vt mode validation addition
- lots of other small serial driver updates and additions
All of these have been in linux-next for weeks with no reported issues"
[23 lines not shown]
Merge tag 'usb-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
Pull USB / Thunderbolt updates from Greg KH:
"Here is the big set of USB and Thunderbolt driver updates for 7.3-rc1.
Lots of driver work for new devices and systems, and many other minor
fixes and updates. Included in here are:
- Thunderbolt subsystem driver updates and additions
- typec driver updates and additions
- usb gadget fixes all over the place, seems like people are finally
paying attention to these drivers for some reason
- xhci driver updates and fixes based on lots of reports
- usb-serial driver updates and additions
[28 lines not shown]
Merge tag 'staging-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging
Pull staging driver updates from Greg KH:
"Here is the big set of drivers/staging/ updates for 7.3-rc1.
Nothing major in here at all, just lots of tiny coding style cleanups,
refactoring, and minor "fixes" as found by some tools. Included in
here
- loads of coding style and refactoring in the rtl8723bs wireless
driver
- minor greybus driver cleanups
- minor sm750fb driver cleanups
- other even smaller driver cleanups
All of these have been in linux-next for a weeks with no reported
[24 lines not shown]
Merge tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
Pull char/misc/IIO/etc driver updates from Greg KH:
"Here is the big set of char, misc, iio, counter, fpga, and other small
driver subsystems for 7.3-rc1.
Overall, due to some driver removals we only added a bit more code
than removed, which was a nice change. Highlights in this merge
request are:
- Loads of IIO driver updates and additions
- binder driver updates (more on that below...)
- Removal of the SGI XP and GRU drivers as they are not used anymore
and turn out to be pretty insecure overall
- Removal of the obsolete ibmasm driver as it's not being used
anymore
[38 lines not shown]
Merge tag 'bootconfig-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull bootconfig updates from Masami Hiramatsu:
- Support build-time command line building for embedded bootconfig
- Fix xbc_snprint_cmdline() to render descendant keys when the root has
both a value and subkeys, and treats empty subtrees correctly.
- Add build-time pipeline using tools/bootconfig -C to render the
embedded bootconfig "kernel" subtree into .init.rodata as a cmdline
string.
- Clean build-time tools/bootconfig from make clean
- Add helper to prepend embedded bootconfig cmdline into
boot_command_line early before parse_early_param()
- Wire early prepend helper in x86 setup_arch() so early_param handlers
[18 lines not shown]
Merge tag 'ntfs-for-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs
Pull ntfs updates from Namjae Jeon:
"This contains improvements to compression support, metadata handling,
error propagation, and filesystem robustness.
New feature:
- Add optional read support for Windows System Compression (WOF)
Add CONFIG_NTFS_FS_WOF_COMPRESSION and support reading
WOF-compressed files through the NTFS page-read path. This includes
parsing REPARSE_TAG_WOF, handling resident and non-resident WOF
metadata and compressed chunks, and adding kernel-side XPRESS
4K/8K/16K and LZX 32K decompressors. The codecs use a common
transparent compression interface shared with LZNT1.
WOF support is read-only and disabled unless explicitly enabled.
[77 lines not shown]
Merge tag 'fuse-update-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse
Pull fuse updates from Miklos Szeredi:
- Improve performance of the io-uring transport by introducing buffer
pools and zero-copy (Joanne)
- Fix lots of bugs (Baokun Li)
- Fix io-uring initialization issues (Joanne, Bernd)
- More prep work for large folios (Joanne)
- Don't limit buffered read to 128k (Jim Harris)
- Fix zeroing of page end (dirtied with mmap) on file size extension
(Jimmy Zuber)
- Improve performance in certain cases with wake_up_sync() when queuing
[26 lines not shown]
Merge tag 'cifs-fixes-7.3-rc1' of https://git.manguebit.org/linux
Pull smb client updates from Paulo Alcantara:
- clear sensitive data after use (stack and heap cryptographic
keys/hashes)
- file size and cache synchronization fixes (fscache cookie
serialization and truncation handling)
- protocol validation and buffer safety fixes (prevent OOB access and
loff_t underflow)
- metadata and POSIX attribute fixes (proper hard-link counts and
setuid/setgid stripping)
- DFS cache and unmount fixes (prevent target-hint UAF and unmount
hangs)
[25 lines not shown]
smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV
The LXDEV block in cifs_query_path_info() uses SMB2_WSL_XATTR_MODE_SIZE
(4) instead of SMB2_WSL_XATTR_DEV_SIZE (8), undercounting eas_len by 4
bytes per $LXDEV EA.
eas_len is used only as a zero/non-zero presence flag so there is no
current functional impact, but the value is incorrect and misleading.
Fixes: 97db41604555 ("smb: client: parse uid, gid, mode and dev from WSL reparse points")
Cc: stable at vger.kernel.org
Cc: Paulo Alcantara <pc at manguebit.org>
Signed-off-by: Frank Sorenson <sorenson at redhat.com>
Acked-by: Namjae Jeon <linkinjeon at kernel.org>
Signed-off-by: Paulo Alcantara <pc at manguebit.org>
smb: client: Avoid leaking sensitive data to the heap in connect.c
TCP_Server_Info contains a preauth_sha_hash[] and a cryptkey[] array
that might contain sensitive data. Thus free its memory with
kfree_sensitive() to avoid that we are leaking this information to
the heap.
Signed-off-by: Thomas Huth <thuth at redhat.com>
Signed-off-by: Namjae Jeon <linkinjeon at kernel.org>
Signed-off-by: Paulo Alcantara <pc at manguebit.org>
smb: client: restore the data_offset bound in is_valid_oplock_break()
Commit 83bfbd0bb902 ("cifs: Remove the RFC1002 header from smb_hdr")
changed the quantity this bound is measured against. It used to be
srv->total_read minus the 4-byte RFC1002 preamble that total_read then
included, so it was the SMB message length. The same commit stopped
counting the preamble, and the mechanical substitution to
srv->total_read - srv->pdu_size left an expression that is identically
zero: standard_receive3() reads MID_HEADER_SIZE() bytes and then exactly
pdu_length - MID_HEADER_SIZE() more, adding both to total_read.
len is therefore 0, the subtraction below it wraps, and no __u32
DataOffset can exceed the result, so the check from commit 097f5863b1a0
("cifs: read overflow in is_valid_oplock_break()") no longer rejects
anything. Use total_read, which is now the message length on its own.
Fixes: 83bfbd0bb902 ("cifs: Remove the RFC1002 header from smb_hdr")
Cc: stable at kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity at proton.me>
Signed-off-by: Paulo Alcantara <pc at manguebit.org>
smb: client: remove redundant NULL check before kfree()
kfree() safely handles NULL pointers, so the explicit NULL check
before calling kfree() is unnecessary.
This issue was reported by ifnullfree.cocci.
Signed-off-by: Mohammad Shahid <mdshahid03 at gmail.com>
Signed-off-by: Paulo Alcantara <pc at manguebit.org>
smb: client: simplify __build_path_from_dentry_optional_prefix()
Use the convenient 'strreplace()' to simplify
'__build_path_from_dentry_optional_prefix()'.
Signed-off-by: Dmitry Antipov <dmantipov at yandex.ru>
Signed-off-by: Namjae Jeon <linkinjeon at kernel.org>
Signed-off-by: Paulo Alcantara <pc at manguebit.org>
smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()
coalesce_t2() computes data pointers directly from server-supplied
DataOffset fields with no validation against buffer bounds:
data_area_of_tgt = (char *)&pSMBt->hdr.Protocol +
get_unaligned_le16(&pSMBt->t2_rsp.DataOffset);
data_area_of_src = (char *)&pSMBs->hdr.Protocol +
get_unaligned_le16(&pSMBs->t2_rsp.DataOffset);
data_area_of_tgt += total_in_tgt;
...
memcpy(data_area_of_tgt, data_area_of_src, total_in_src);
A small DataOffset can push a pointer below the actual byte area,
overwriting header fields; a large one can push it past the buffer
end, causing out-of-bounds heap reads (source) or writes (target).
The BCC overflow guard does not prevent this: BCC reflects how much
data is present, while DataOffset controls where in the buffer it
starts.
[13 lines not shown]
smb: client: Clear sensitive stack data in smb2transport.c
Sensitive data like keys that are stored in stack-local arrays could
be leaked via the stack to the calling functions. There is no known
vulnerability for this right now, but it's good security style to
explicitly zeroize this sensitive material as soon as possible to
avoid that it could be exploited together with other bugs later.
Signed-off-by: Thomas Huth <thuth at redhat.com>
Signed-off-by: Namjae Jeon <linkinjeon at kernel.org>
Signed-off-by: Paulo Alcantara <pc at manguebit.org>
smb: client: Clear sensitive stack and heap data in smb2ops.c
Make sure to not leak key-related data via the heap or the stack
by using kfree_sensitive() or memzero_explicit() here.
Signed-off-by: Thomas Huth <thuth at redhat.com>
Signed-off-by: Namjae Jeon <linkinjeon at kernel.org>
Signed-off-by: Paulo Alcantara <pc at manguebit.org>
cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size()
When the else branch of cifs_file_set_size() finds a writable file handle
via find_writable_file(), it borrows tcon and server from the handle's
tlink, attempts the handle-based set_file_size() RPC, and then releases
the handle with cifsFileInfo_put().
If set_file_size() fails, execution falls through to the path-based
fallback, which reuses the borrowed tcon and server under the
"if (tcon == NULL)" guard. Since tcon is not NULL at that point, the
guard is skipped. If cifsFileInfo_put() dropped the last reference on a
tlink that was already removed from the tlink tree (TCON_LINK_IN_TREE
cleared, as happens during reconnection or session teardown),
cifs_put_tlink() will have freed tcon; the subsequent set_path_size()
call is then a use-after-free.
Setting tcon = NULL after cifsFileInfo_put() causes the existing guard
to take the cifs_sb_tlink() path, which acquires a fresh reference for
the path-based operation or fails cleanly if the session is gone.
[6 lines not shown]
smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2
When a valid primary TRANSACT2 response has been received (mid->resp_buf
set, mid->multiRsp true) and a subsequent secondary response causes
cifs_check_trans2() to return false -- either because the SMB header is
invalid (malformed != 0) or because check2ndT2() rejects the PDU --
handle_mid() overwrites mid->resp_buf with the new buffer (leaking the
primary buffer) and, because mid->multiRsp is set, skips the
server->smallbuf/bigbuf NULL-out. When the user thread frees
mid->resp_buf, server->smallbuf or server->bigbuf is left dangling; the
demux thread reuses it for the next packet, resulting in a use-after-free.
Combine both early-exit conditions and, when mid->multiRsp is already
set, abort the pending transaction inline: set multiEnd, call
dequeue_mid() with malformed=true, and return true so handle_mid() exits
without touching mid->resp_buf or the server buffer pointers.
Fixes: 316cf94a910f ("CIFS: Move trans2 processing to ops struct")
Cc: stable at vger.kernel.org # cifs_check_trans2() is in smb1ops.c on kernels < 7.0
[3 lines not shown]
smb/client: decode reparse metadata using its payload type
cifs_open_info_data stores FILE_ALL_INFORMATION and SMB3 POSIX query
information in a union. reparse_info_to_fattr() selects a union member
from the mount mode, while several directory checks always read
fi.Attributes.
The metadata can instead come from an SMB2 CREATE response on a POSIX
mount, or from a POSIX query while processing a reparse point. In those
cases the mount mode and hard-coded fi accesses select the wrong union
member.
See the procedures below:
cifs_nt_open
smb2_open_file
SMB2_open
data->fi = SMB2 CREATE response
data->contains_posix_file_info = false
[20 lines not shown]
smb: client: fix ALIGN() overflow in symlink_data() error context loop
The check added by commit 7d9a7f1f96cd ("smb/client: fix possible
infinite loop and oob read in symlink_data()") compared the post-ALIGN
length against the remaining buffer, but ALIGN() itself can overflow:
for ErrorDataLength near UINT32_MAX (e.g. 0xFFFFFFF9), ALIGN(x, 8)
wraps to 0, so the subsequent bounds check passes, and the loop
advances by zero bytes leaving 'p' pointing into stale data.
Fix by checking the raw ErrorDataLength against the remaining space
before applying ALIGN(), then checking again after. Since raw_len is
bounded by the buffer, raw_len + 7 cannot overflow, so the second check
is an exact post-alignment bounds guard.
Fixes: 76894f3e2f71 ("cifs: improve symlink handling for smb2+")
Cc: stable at vger.kernel.org
Signed-off-by: Frank Sorenson <sorenson at redhat.com>
Signed-off-by: Namjae Jeon <linkinjeon at kernel.org>
Signed-off-by: Paulo Alcantara <pc at manguebit.org>
smb: client: reject a tree connect response whose byte count is too small
CIFSTCon() bounds its strnlen() over the byte area with the server's
ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int
and converts to a huge size_t. The later subtraction wraps the __u16
bytes_left, and that is what bounds cifs_strndup_from_utf16(): a bound of
up to 65535 against a ~16 KB cifs_req_poolp object runs off the end of the
slab object, and the bytes reach userspace through tcon->nativeFileSystem
in /proc/fs/cifs/DebugData.
Reject a byte area too small for what the parser consumes. Two bytes is
the least it can consume, and no conformant response carries fewer. The
new trace point is the 129th smb_eio_trace entry, which __mode(byte)
cannot represent, so the attribute goes with it.
Fixes: cc20c031bb06 ("cifs: convert CIFSTCon to use new unicode helper functions")
Cc: stable at vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity at proton.me>
Reviewed-by: Namjae Jeon <linkinjeon at kernel.org>
Signed-off-by: Paulo Alcantara <pc at manguebit.org>
cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0
With len == 0 (clone to EOF), the effective length is computed as:
len = src_inode->i_size - off;
If off > i_size, this is a negative loff_t, corrupting the ByteCount
in the FSCTL_DUPLICATE_EXTENTS_TO_FILE request and inverting the range
in filemap_write_and_wait_range(). The existing off >= i_size check
fires only after the ioctl has already been sent.
Snapshot i_size_read() once for both the bounds check and the length
calculation, eliminating the TOCTOU and 32-bit torn-read risk. Reject
off > src_size with -EINVAL. Treat off == src_size as a no-op,
consistent with __generic_remap_file_range_prep().
Fixes: 04b38d601239 ("vfs: pull btrfs clone API to vfs layer")
Cc: stable at vger.kernel.org
Signed-off-by: Frank Sorenson <sorenson at redhat.com>
[2 lines not shown]
smb: client: Clear sensitive stack data in smb1encrypt.c
Make sure to not leak signature data via the stack, clear it
with memzero_explicit() before leaving the function.
To avoid that we have to introduce "goto"-cleanup here, we re-arrange
the code a little bit (and drop the commented cifs_dump_mem debug
code that looks like a leftover from very early days).
Signed-off-by: Thomas Huth <thuth at redhat.com>
Signed-off-by: Namjae Jeon <linkinjeon at kernel.org>
Signed-off-by: Paulo Alcantara <pc at manguebit.org>
cifs: call pagecache_isize_extended() in cifs_setsize() when extending
cifs_setsize() calls truncate_pagecache() but skips
pagecache_isize_extended() on extension. truncate_setsize() shows
the correct pattern:
i_size_write(inode, newsize);
if (newsize > oldsize)
pagecache_isize_extended(inode, oldsize, newsize);
truncate_pagecache(inode, newsize);
pagecache_isize_extended() zeroes the tail of the page straddling old
EOF. Without it, dirty bytes in that region can be written back to
the server, exposing stale data in the newly extended range.
Cc: stable at vger.kernel.org
Cc: David Howells <dhowells at redhat.com>
Signed-off-by: Frank Sorenson <sorenson at redhat.com>
Acked-by: Namjae Jeon <linkinjeon at kernel.org>
Signed-off-by: Paulo Alcantara <pc at manguebit.org>
Revert "cifs: remove all cifs files before kill super"
This reverts commit 6d9a4aaaa8b2612b5ef9d581e2f286a458b71ee1.
First, directly flushing fileinfo_put_wq in that commit cannot guarantee
that all in-flight I/O has run its cleanup_work on system_dfl_wq and
subsequently called queue_work(fileinfo_put_wq, ...). Flushing only the
latter workqueue may therefore miss puts that have not yet been queued, so
the fix is not reliable in the first place. Moreover, this fix flushes
inside cifs_umount(), which means the busy-dentry warning can still be
triggered when umount_check() is called inside kill_anon_super(), because
kill_anon_super() is executed before cifs_umount().
Second, commit 75f5c412fa86 ("smb: client: fix busy dentry warning on
unmount after DIO") already drains both serverclose_wq and fileinfo_put_wq
in cifs_kill_sb(), before kill_anon_super(). By adding a per-superblock
outstanding-rreq counter, it guarantees that all cleanup_work for this sb
have run, and thus all relevant cfile puts are queued on fileinfo_put_wq
or serverclose_wq.
[12 lines not shown]
