Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
38 commits
Select commit Hold shift + click to select a range
cde9f49
i2c/designware: Fix an initialization issue
PlaidCat Sep 4, 2025
8ea46bb
bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()
PlaidCat Sep 4, 2025
73532d9
selftests/bpf: Adjust data size to have ETH_HLEN
PlaidCat Sep 4, 2025
b0c3370
Bluetooth: hci_core: Fix use-after-free in vhci_flush()
PlaidCat Sep 4, 2025
5d17adf
s390/topology: Improve topology detection
PlaidCat Sep 4, 2025
c86b553
s390/pci: Fix potential double remove of hotplug slot
PlaidCat Sep 4, 2025
af81c6c
s390/pci: Fix missing check for zpci_create_device() error return
PlaidCat Sep 4, 2025
bc62f74
s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has c…
PlaidCat Sep 4, 2025
0d31bca
s390/pci: Remove redundant bus removal and disable from zpci_release_…
PlaidCat Sep 4, 2025
f2c5d06
s390/pci: Prevent self deletion in disable_slot()
PlaidCat Sep 4, 2025
87454a2
s390/pci: Allow re-add of a reserved but not yet removed device
PlaidCat Sep 4, 2025
b68348e
s390/pci: Serialize device addition and removal
PlaidCat Sep 4, 2025
86020ba
powerpc/pseries/vas: Add close() callback in vas_vm_ops struct
PlaidCat Sep 4, 2025
94d913c
net: fix udp gso skb_segment after pull from frag_list
PlaidCat Sep 4, 2025
82b2c42
selftests: net: add more info to error in bpf_offload
PlaidCat Sep 4, 2025
7914f3b
selftests: net: fix error message in bpf_offload
PlaidCat Sep 4, 2025
4440a89
selftests: net: bpf_offload: add 'libbpf_global' to ignored maps
PlaidCat Sep 4, 2025
983ede4
tls: always refresh the queue when reading sock
PlaidCat Sep 4, 2025
ac75d8c
cxgb4: use port number to set mac addr
PlaidCat Sep 4, 2025
966b49e
i40e: fix MMIO write access to an invalid page in i40e_clear_hw
PlaidCat Sep 4, 2025
9230118
sch_ets: make est_qlen_notify() idempotent
PlaidCat Sep 4, 2025
d4dbaef
net_sched: ets: Fix double list add in class with netem as child qdisc
PlaidCat Sep 4, 2025
40f3009
net/sched: Abort __tc_modify_qdisc if parent class does not exist
PlaidCat Sep 4, 2025
9688169
ice: fix eswitch code memory leak in reset scenario
PlaidCat Sep 4, 2025
065ddba
Rebuild rocky10_0 with kernel-6.12.0-55.29.1.el10_0
PlaidCat Sep 4, 2025
570621d
netfilter: nf_conntrack: fix crash due to removal of uninitialised entry
PlaidCat Sep 4, 2025
35afd8a
vsock: Fix transport_* TOCTOU
PlaidCat Sep 4, 2025
7186cbe
tipc: Fix use-after-free in tipc_conn_close().
PlaidCat Sep 4, 2025
eaf2f83
ext4: only dirty folios when data journaling regular files
PlaidCat Sep 4, 2025
943d9d6
udp: Fix multiple wraparounds of sk->sk_rmem_alloc.
PlaidCat Sep 4, 2025
aee9496
udp: Fix memory accounting leak.
PlaidCat Sep 4, 2025
00158f8
RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction
PlaidCat Sep 4, 2025
45a9b0d
s390/pci: Fix SR-IOV for PFs initially in standby
PlaidCat Sep 4, 2025
032c1f1
s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn()
PlaidCat Sep 4, 2025
ae6c1fd
s390/pci: Fix handling of isolated VFs
PlaidCat Sep 4, 2025
18afa2a
s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs
PlaidCat Sep 4, 2025
110406c
net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too
PlaidCat Sep 4, 2025
0b50c95
Rebuild rocky10_0 with kernel-6.12.0-55.30.1.el10_0
PlaidCat Sep 4, 2025
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
File renamed without changes.
2 changes: 1 addition & 1 deletion Makefile.rhelver
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ RHEL_MINOR = 0
#
# Use this spot to avoid future merge conflicts.
# Do not trim this comment.
RHEL_RELEASE = 55.27.1
RHEL_RELEASE = 55.30.1

#
# RHEL_REBASE_NUM
Expand Down
36 changes: 36 additions & 0 deletions arch/powerpc/platforms/book3s/vas-api.c
Original file line number Diff line number Diff line change
Expand Up @@ -464,7 +464,43 @@ static vm_fault_t vas_mmap_fault(struct vm_fault *vmf)
return VM_FAULT_SIGBUS;
}

/*
* During mmap() paste address, mapping VMA is saved in VAS window
* struct which is used to unmap during migration if the window is
* still open. But the user space can remove this mapping with
* munmap() before closing the window and the VMA address will
* be invalid. Set VAS window VMA to NULL in this function which
* is called before VMA free.
*/
static void vas_mmap_close(struct vm_area_struct *vma)
{
struct file *fp = vma->vm_file;
struct coproc_instance *cp_inst = fp->private_data;
struct vas_window *txwin;

/* Should not happen */
if (!cp_inst || !cp_inst->txwin) {
pr_err("No attached VAS window for the paste address mmap\n");
return;
}

txwin = cp_inst->txwin;
/*
* task_ref.vma is set in coproc_mmap() during mmap paste
* address. So it has to be the same VMA that is getting freed.
*/
if (WARN_ON(txwin->task_ref.vma != vma)) {
pr_err("Invalid paste address mmaping\n");
return;
}

mutex_lock(&txwin->task_ref.mmap_mutex);
txwin->task_ref.vma = NULL;
mutex_unlock(&txwin->task_ref.mmap_mutex);
}

static const struct vm_operations_struct vas_vm_ops = {
.close = vas_mmap_close,
.fault = vas_mmap_fault,
};

Expand Down
11 changes: 11 additions & 0 deletions arch/s390/kernel/topology.c
Original file line number Diff line number Diff line change
Expand Up @@ -555,6 +555,16 @@ static void __init alloc_masks(struct sysinfo_15_1_x *info,
}
}

static int __init detect_polarization(union topology_entry *tle)
{
struct topology_core *tl_core;

while (tle->nl)
tle = next_tle(tle);
tl_core = (struct topology_core *)tle;
return tl_core->pp != POLARIZATION_HRZ;
}

void __init topology_init_early(void)
{
struct sysinfo_15_1_x *info;
Expand All @@ -574,6 +584,7 @@ void __init topology_init_early(void)
__func__, PAGE_SIZE, PAGE_SIZE);
info = tl_info;
store_topology(info);
cpu_management = detect_polarization(info->tle);
pr_info("The CPU configuration topology of the machine is: %d %d %d %d %d %d / %d\n",
info->mag[0], info->mag[1], info->mag[2], info->mag[3],
info->mag[4], info->mag[5], info->mnest);
Expand Down
73 changes: 35 additions & 38 deletions arch/s390/pci/pci.c
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,7 @@
/* list of all detected zpci devices */
static LIST_HEAD(zpci_list);
static DEFINE_SPINLOCK(zpci_list_lock);
static DEFINE_MUTEX(zpci_add_remove_lock);

static DECLARE_BITMAP(zpci_domain, ZPCI_DOMAIN_BITMAP_SIZE);
static DEFINE_SPINLOCK(zpci_domain_lock);
Expand All @@ -69,6 +70,15 @@ EXPORT_SYMBOL_GPL(zpci_aipb);
struct airq_iv *zpci_aif_sbv;
EXPORT_SYMBOL_GPL(zpci_aif_sbv);

void zpci_zdev_put(struct zpci_dev *zdev)
{
if (!zdev)
return;
mutex_lock(&zpci_add_remove_lock);
kref_put_lock(&zdev->kref, zpci_release_device, &zpci_list_lock);
mutex_unlock(&zpci_add_remove_lock);
}

struct zpci_dev *get_zdev_by_fid(u32 fid)
{
struct zpci_dev *tmp, *zdev = NULL;
Expand Down Expand Up @@ -831,6 +841,7 @@ int zpci_add_device(struct zpci_dev *zdev)
{
int rc;

mutex_lock(&zpci_add_remove_lock);
zpci_dbg(1, "add fid:%x, fh:%x, c:%d\n", zdev->fid, zdev->fh, zdev->state);
rc = zpci_init_iommu(zdev);
if (rc)
Expand All @@ -844,12 +855,14 @@ int zpci_add_device(struct zpci_dev *zdev)
spin_lock(&zpci_list_lock);
list_add_tail(&zdev->entry, &zpci_list);
spin_unlock(&zpci_list_lock);
mutex_unlock(&zpci_add_remove_lock);
return 0;

error_destroy_iommu:
zpci_destroy_iommu(zdev);
error:
zpci_dbg(0, "add fid:%x, rc:%d\n", zdev->fid, rc);
mutex_unlock(&zpci_add_remove_lock);
return rc;
}

Expand Down Expand Up @@ -919,60 +932,44 @@ int zpci_deconfigure_device(struct zpci_dev *zdev)
* @zdev: the zpci_dev that was reserved
*
* Handle the case that a given zPCI function was reserved by another system.
* After a call to this function the zpci_dev can not be found via
* get_zdev_by_fid() anymore but may still be accessible via existing
* references though it will not be functional anymore.
*/
void zpci_device_reserved(struct zpci_dev *zdev)
{
/*
* Remove device from zpci_list as it is going away. This also
* makes sure we ignore subsequent zPCI events for this device.
*/
spin_lock(&zpci_list_lock);
list_del(&zdev->entry);
spin_unlock(&zpci_list_lock);
lockdep_assert_held(&zdev->state_lock);
/* We may declare the device reserved multiple times */
if (zdev->state == ZPCI_FN_STATE_RESERVED)
return;
zdev->state = ZPCI_FN_STATE_RESERVED;
zpci_dbg(3, "rsv fid:%x\n", zdev->fid);
/*
* The underlying device is gone. Allow the zdev to be freed
* as soon as all other references are gone by accounting for
* the removal as a dropped reference.
*/
zpci_zdev_put(zdev);
}

void zpci_release_device(struct kref *kref)
{
struct zpci_dev *zdev = container_of(kref, struct zpci_dev, kref);
int ret;

lockdep_assert_held(&zpci_add_remove_lock);
WARN_ON(zdev->state != ZPCI_FN_STATE_RESERVED);
/*
* We already hold zpci_list_lock thanks to kref_put_lock().
* This makes sure no new reference can be taken from the list.
*/
list_del(&zdev->entry);
spin_unlock(&zpci_list_lock);

if (zdev->has_hp_slot)
zpci_exit_slot(zdev);

if (zdev->zbus->bus)
zpci_bus_remove_device(zdev, false);

if (zdev_enabled(zdev))
zpci_disable_device(zdev);
if (zdev->has_resources)
zpci_cleanup_bus_resources(zdev);

switch (zdev->state) {
case ZPCI_FN_STATE_CONFIGURED:
ret = sclp_pci_deconfigure(zdev->fid);
zpci_dbg(3, "deconf fid:%x, rc:%d\n", zdev->fid, ret);
fallthrough;
case ZPCI_FN_STATE_STANDBY:
if (zdev->has_hp_slot)
zpci_exit_slot(zdev);
spin_lock(&zpci_list_lock);
list_del(&zdev->entry);
spin_unlock(&zpci_list_lock);
zpci_dbg(3, "rsv fid:%x\n", zdev->fid);
fallthrough;
case ZPCI_FN_STATE_RESERVED:
if (zdev->has_resources)
zpci_cleanup_bus_resources(zdev);
zpci_bus_device_unregister(zdev);
zpci_destroy_iommu(zdev);
fallthrough;
default:
break;
}
zpci_bus_device_unregister(zdev);
zpci_destroy_iommu(zdev);
zpci_dbg(3, "rem fid:%x\n", zdev->fid);
kfree_rcu(zdev, rcu);
}
Expand Down
24 changes: 23 additions & 1 deletion arch/s390/pci/pci_bus.c
Original file line number Diff line number Diff line change
Expand Up @@ -171,7 +171,6 @@ void zpci_bus_scan_busses(void)
static bool zpci_bus_is_multifunction_root(struct zpci_dev *zdev)
{
return !s390_pci_no_rid && zdev->rid_available &&
zpci_is_device_configured(zdev) &&
!zdev->vfn;
}

Expand Down Expand Up @@ -332,6 +331,20 @@ static int zpci_bus_add_device(struct zpci_bus *zbus, struct zpci_dev *zdev)
return rc;
}

static bool zpci_bus_is_isolated_vf(struct zpci_bus *zbus, struct zpci_dev *zdev)
{
struct pci_dev *pdev;

if (!zdev->vfn)
return false;

pdev = zpci_iov_find_parent_pf(zbus, zdev);
if (!pdev)
return true;
pci_dev_put(pdev);
return false;
}

int zpci_bus_device_register(struct zpci_dev *zdev, struct pci_ops *ops)
{
bool topo_is_tid = zdev->tid_avail;
Expand All @@ -346,6 +359,15 @@ int zpci_bus_device_register(struct zpci_dev *zdev, struct pci_ops *ops)

topo = topo_is_tid ? zdev->tid : zdev->pchid;
zbus = zpci_bus_get(topo, topo_is_tid);
/*
* An isolated VF gets its own domain/bus even if there exists
* a matching domain/bus already
*/
if (zbus && zpci_bus_is_isolated_vf(zbus, zdev)) {
zpci_bus_put(zbus);
zbus = NULL;
}

if (!zbus) {
zbus = zpci_bus_alloc(topo, topo_is_tid);
if (!zbus)
Expand Down
7 changes: 2 additions & 5 deletions arch/s390/pci/pci_bus.h
Original file line number Diff line number Diff line change
Expand Up @@ -17,11 +17,8 @@ int zpci_bus_scan_device(struct zpci_dev *zdev);
void zpci_bus_remove_device(struct zpci_dev *zdev, bool set_error);

void zpci_release_device(struct kref *kref);
static inline void zpci_zdev_put(struct zpci_dev *zdev)
{
if (zdev)
kref_put(&zdev->kref, zpci_release_device);
}

void zpci_zdev_put(struct zpci_dev *zdev);

static inline void zpci_zdev_get(struct zpci_dev *zdev)
{
Expand Down
2 changes: 2 additions & 0 deletions arch/s390/pci/pci_clp.c
Original file line number Diff line number Diff line change
Expand Up @@ -423,6 +423,8 @@ static void __clp_add(struct clp_fh_list_entry *entry, void *data)
return;
}
zdev = zpci_create_device(entry->fid, entry->fh, entry->config_state);
if (IS_ERR(zdev))
return;
list_add_tail(&zdev->entry, scan_list);
}

Expand Down
22 changes: 21 additions & 1 deletion arch/s390/pci/pci_event.c
Original file line number Diff line number Diff line change
Expand Up @@ -335,6 +335,22 @@ static void zpci_event_hard_deconfigured(struct zpci_dev *zdev, u32 fh)
zdev->state = ZPCI_FN_STATE_STANDBY;
}

static void zpci_event_reappear(struct zpci_dev *zdev)
{
lockdep_assert_held(&zdev->state_lock);
/*
* The zdev is in the reserved state. This means that it was presumed to
* go away but there are still undropped references. Now, the platform
* announced its availability again. Bring back the lingering zdev
* to standby. This is safe because we hold a temporary reference
* now so that it won't go away. Account for the re-appearance of the
* underlying device by incrementing the reference count.
*/
zdev->state = ZPCI_FN_STATE_STANDBY;
zpci_zdev_get(zdev);
zpci_dbg(1, "rea fid:%x, fh:%x\n", zdev->fid, zdev->fh);
}

static void __zpci_event_availability(struct zpci_ccdf_avail *ccdf)
{
struct zpci_dev *zdev = get_zdev_by_fid(ccdf->fid);
Expand All @@ -358,8 +374,10 @@ static void __zpci_event_availability(struct zpci_ccdf_avail *ccdf)
break;
}
} else {
if (zdev->state == ZPCI_FN_STATE_RESERVED)
zpci_event_reappear(zdev);
/* the configuration request may be stale */
if (zdev->state != ZPCI_FN_STATE_STANDBY)
else if (zdev->state != ZPCI_FN_STATE_STANDBY)
break;
zdev->state = ZPCI_FN_STATE_CONFIGURED;
}
Expand All @@ -375,6 +393,8 @@ static void __zpci_event_availability(struct zpci_ccdf_avail *ccdf)
break;
}
} else {
if (zdev->state == ZPCI_FN_STATE_RESERVED)
zpci_event_reappear(zdev);
zpci_update_fh(zdev, ccdf->fh);
}
break;
Expand Down
56 changes: 42 additions & 14 deletions arch/s390/pci/pci_iov.c
Original file line number Diff line number Diff line change
Expand Up @@ -60,18 +60,35 @@ static int zpci_iov_link_virtfn(struct pci_dev *pdev, struct pci_dev *virtfn, in
return 0;
}

int zpci_iov_setup_virtfn(struct zpci_bus *zbus, struct pci_dev *virtfn, int vfn)
/**
* zpci_iov_find_parent_pf - Find the parent PF, if any, of the given function
* @zbus: The bus that the PCI function is on, or would be added on
* @zdev: The PCI function
*
* Finds the parent PF, if it exists and is configured, of the given PCI function
* and increments its refcount. Th PF is searched for on the provided bus so the
* caller has to ensure that this is the correct bus to search. This function may
* be used before adding the PCI function to a zbus.
*
* Return: Pointer to the struct pci_dev of the parent PF or NULL if it not
* found. If the function is not a VF or has no RequesterID information,
* NULL is returned as well.
*/
struct pci_dev *zpci_iov_find_parent_pf(struct zpci_bus *zbus, struct zpci_dev *zdev)
{
int i, cand_devfn;
struct zpci_dev *zdev;
int i, vfid, devfn, cand_devfn;
struct pci_dev *pdev;
int vfid = vfn - 1; /* Linux' vfid's start at 0 vfn at 1*/
int rc = 0;

if (!zbus->multifunction)
return 0;

/* If the parent PF for the given VF is also configured in the
return NULL;
/* Non-VFs and VFs without RID available don't have a parent */
if (!zdev->vfn || !zdev->rid_available)
return NULL;
/* Linux vfid starts at 0 vfn at 1 */
vfid = zdev->vfn - 1;
devfn = zdev->rid & ZPCI_RID_MASK_DEVFN;
/*
* If the parent PF for the given VF is also configured in the
* instance, it must be on the same zbus.
* We can then identify the parent PF by checking what
* devfn the VF would have if it belonged to that PF using the PF's
Expand All @@ -85,15 +102,26 @@ int zpci_iov_setup_virtfn(struct zpci_bus *zbus, struct pci_dev *virtfn, int vfn
if (!pdev)
continue;
cand_devfn = pci_iov_virtfn_devfn(pdev, vfid);
if (cand_devfn == virtfn->devfn) {
rc = zpci_iov_link_virtfn(pdev, virtfn, vfid);
/* balance pci_get_slot() */
pci_dev_put(pdev);
break;
}
if (cand_devfn == devfn)
return pdev;
/* balance pci_get_slot() */
pci_dev_put(pdev);
}
}
return NULL;
}

int zpci_iov_setup_virtfn(struct zpci_bus *zbus, struct pci_dev *virtfn, int vfn)
{
struct zpci_dev *zdev = to_zpci(virtfn);
struct pci_dev *pdev_pf;
int rc = 0;

pdev_pf = zpci_iov_find_parent_pf(zbus, zdev);
if (pdev_pf) {
/* Linux' vfids start at 0 while zdev->vfn starts at 1 */
rc = zpci_iov_link_virtfn(pdev_pf, virtfn, zdev->vfn - 1);
pci_dev_put(pdev_pf);
}
return rc;
}
Loading