Commit Graph

1181820 Commits

Author SHA1 Message Date
CKI KWF Bot f138c66eb1 [redhat] kernel-5.14.0-637.el9
Signed-off-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>
2025-11-12 11:21:07 +00:00
CKI KWF Bot 04e073d0fb Merge: Upgrade SMC driver
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/7579

JIRA: https://issues.redhat.com/browse/RHEL-99989
Conflicts: Conflicts due to change in line numbers between 5.14 & 6.17 kernel, no functional changes
Commitids:
```
ae2be35cbed2c8385e890147ea321a3fcc3ca5fa
2fe5273f149cc882c371f9954b5fdbd1bd8c9b5c
1018825a9539a67aa381ff033a49355eb03bd84d
5a79575711264b98b435e08107c9e5bf129df210
d37307eaac13f3c5fe912787b5f9facbc574f2cf
0908503ade5f5fecbdb16c5ce16b2b5ee6107e8d
d27a835f41d947f62e6a95e89ba523299c9e6437
0a3e6939d4b33d68bce89477b9db01d68b744749
d386d59b7c1a39112ca875327339ed519df2b96c
e0d103542b06c36240e3887edfe49578464866eb
98d4435efcbf37801a3246fb53856c4b934a2613
f8406a2fd279d05eb4a76c9b77cb740b6f350549
6fd27ea183c208e478129a85e11d880fc70040f2
cd959bf7c3bbaf64a29750c5e36776078a18a8fe
25c12b459db8365fee84b63f3dd7910f70627f29
82ac39ebd6db0c9f7a97a934bda1e3e101a9d201
d293958a8595ba566fb90b99da4d6263e14fee15
0541db8ee32c09463a72d0987382b3a3336b0043
2c7f14ed9c19ec0f149479d1c2842ec1f9bf76d7
27ef6a9981fe74191849966a6d5e0400a4008ab8
10bc9761d12e440656062ef78cd889bbfa827dcf
a4b6539038c1aa1ae871aacf6e41b566c3613993
bfc6c67ec2d64d0ca4e5cc3e1ac84298a10b8d62
752e2217d789be2c6a6ac66554b981cd71cd9f31
199561a48f026bf674424fd9019c0690a3570377
c3ee72ded0d2fc6433a009291d7825b28426e4c0
091d019adce033118776ef93b50a268f715ae8f6
ae2402bf882b40fb9cf3b6a5c9ff0e6c7a9ef842
4814f9110ec6b7b2a25ec0c397f996ce34d31115
60ada4fe644edaa6c2da97364184b0425e8aeaf5
d9cef55ed49117bd63695446fb84b4b91815c0b4
ba1e9421cf1a8369d25c3832439702a015d6b5f9
```

Omitted-fix: 60ada4fe644edaa6c2da97364184b0425e8aeaf5

Signed-off-by: Mete Durlu <mdurlu@redhat.com>

Approved-by: Steve Best <sbest@redhat.com>
Approved-by: Tony Camuso <tcamuso@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
2025-11-12 11:20:12 +00:00
CKI KWF Bot 15cc0187f9 Merge: gitlab-ci: disable automotive pipelines
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/7569

JIRA: INTERNAL
Upstream Status: RHEL only

We no longer need to run automotive pipelines in c9s but instead of
removing them we'll mark them disabled for now.

Signed-off-by: Scott Weaver <scweaver@redhat.com>

Approved-by: Tales da Aparecida <tales.aparecida@redhat.com>
Approved-by: Jarod Wilson <jarod@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
2025-11-12 11:20:11 +00:00
CKI KWF Bot 9b63010080 Merge: redhat: introduce RELEASE_LOCALVERSION variable
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/7553

JIRA: INTERNAL
Upstream Status: RHEL only

Sometimes we run into situation where people forget to set proper
localversion during official builds and end up with .test in NVR.

Introduce a new variable to Makefile.variables, which will be persisted
in source-git as well (contrast to localversion) and take priority when
used for dist-rtg targets. The scenarios where we need custom localversion
for official build should be very rare, meaning that the maintainer doesn't
need to touch this variable and default (empty localversion) will be used
instead of whatever may be left in 'localversion' (or DISTLOCALVERSION).

Signed-off-by: Jan Stancek <jstancek@redhat.com>

Approved-by: Scott Weaver <scweaver@redhat.com>
Approved-by: Patrick Talbert <ptalbert@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
2025-11-12 11:20:10 +00:00
CKI KWF Bot 0243fa2929 Merge: redhat: remove EARLY ystream bits
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/7552

JIRA: INTERNAL
Upstream Status: RHEL only (ARK commit 31028fbea1a742c36d19053ade720ea44316ccce)

commit 31028fbea1a742c36d19053ade720ea44316ccce
Author: Jan Stancek <jstancek@redhat.com>
Date:   Thu Oct 30 07:47:25 2025 +0100

    redhat: remove EARLY ystream bits

    This was used in downstream RHEL to avoid NVR collisions between stream
    that is about to GA and next one (which overlap for ~6 weeks). While
    back we started using ZSTREAM numbering early and hence this option
    is no longer used. Remove all related bits.

    Signed-off-by: Jan Stancek <jstancek@redhat.com>

Signed-off-by: Jan Stancek <jstancek@redhat.com>

Approved-by: Scott Weaver <scweaver@redhat.com>
Approved-by: Patrick Talbert <ptalbert@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
2025-11-12 11:20:08 +00:00
CKI KWF Bot 144e2bc700 Merge: [rhel-9] bpf: Do not audit capability check in do_jit()
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/7544

JIRA: https://issues.redhat.com/browse/RHEL-105376

Backport one commit that silences CAP_SYS_ADMIN denials when BPF decides whether to apply a Spectre mitigation.

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>

Approved-by: Viktor Malik <vmalik@redhat.com>
Approved-by: Gregory Bell <grbell@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
2025-11-12 11:20:07 +00:00
CKI KWF Bot 771d56c680 Merge: CVE-2025-40047: io_uring/waitid: always prune wait queue entry in io_waitid_wait()
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/7538

JIRA: https://issues.redhat.com/browse/RHEL-124973
CVE: CVE-2025-40047

```
commit 2f8229d53d984c6a05b71ac9e9583d4354e3b91f
Author: Jens Axboe <axboe@kernel.dk>
Date:   Tue Oct 7 07:46:00 2025 -0600

    io_uring/waitid: always prune wait queue entry in io_waitid_wait()

    For a successful return, always remove our entry from the wait queue
    entry list. Previously this was skipped if a cancelation was in
    progress, but this can race with another invocation of the wait queue
    entry callback.

    Cc: stable@vger.kernel.org
    Fixes: f31ecf671ddc ("io_uring: add IORING_OP_WAITID support")
    Reported-by: syzbot+b9e83021d9c642a33d8c@syzkaller.appspotmail.com
    Tested-by: syzbot+b9e83021d9c642a33d8c@syzkaller.appspotmail.com
    Link: https://lore.kernel.org/io-uring/68e5195e.050a0220.256323.001f.GAE@google.com/
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
```

Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com>

---

<small>Created 2025-10-30 01:56 UTC by backporter - [KWF FAQ](https://red.ht/kernel_workflow_doc) - [Slack #team-kernel-workflow](https://redhat-internal.slack.com/archives/C04LRUPMJQ5) - [Source](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/webhook/utils/backporter.py) - [Documentation](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/docs/README.backporter.md) - [Report an issue](https://issues.redhat.com/secure/CreateIssueDetails!init.jspa?pid=12334433&issuetype=1&priority=4&summary=backporter+webhook+issue&components=kernel-workflow+/+backporter)</small>

Approved-by: Jeff Moyer <jmoyer@redhat.com>
Approved-by: Brian Foster <bfoster@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
2025-11-12 11:20:05 +00:00
CKI KWF Bot 70cc9e2ed9 Merge: [Intel 9.8 FEAT] [WCL-U] IO: Add I2C Device ID
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/7502

JIRA: https://issues.redhat.com/browse/RHEL-95651

```
commit c91a0e4e549d0457c61f2199fcd84d699400bee1
Author: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Date:   Mon Sep 15 14:29:36 2025 +0300

    mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs

    Add Intel Wildcat Lake PCI IDs.

    Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    Link: https://lore.kernel.org/r/20250915112936.10696-1-ilpo.jarvinen@linux.intel.com
    Signed-off-by: Lee Jones <lee@kernel.org>
```

Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com>

---

<small>Created 2025-10-21 20:09 UTC by backporter - [KWF FAQ](https://red.ht/kernel_workflow_doc) - [Slack #team-kernel-workflow](https://redhat-internal.slack.com/archives/C04LRUPMJQ5) - [Source](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/webhook/utils/backporter.py) - [Documentation](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/docs/README.backporter.md) - [Report an issue](https://issues.redhat.com/secure/CreateIssueDetails!init.jspa?pid=12334433&issuetype=1&priority=4&summary=backporter+webhook+issue&components=kernel-workflow+/+backporter)</small>

Approved-by: David Arcari <darcari@redhat.com>
Approved-by: Steve Best <sbest@redhat.com>
Approved-by: Tony Camuso <tcamuso@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
2025-11-12 11:20:04 +00:00
CKI KWF Bot 6f161a04e4 Merge: x86: Reduce KASLR entropy
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/7462

JIRA: https://issues.redhat.com/browse/RHEL-117031

The following error is seen on Nvidia systems:

<4>[ 1062.336158] NVRM: VM: nv_alloc_pages:3801: 0x0000000021ac81f7, 32 page(s), count = 1, flags = 0x00000004, page_table = 0x00000000677eb7bb
<3>[ 1062.339224] nvidia-uvm: uvm_pmm_gpu.c:3480 devmem_init[pid:6006] request_free_mem_region() err -34
<3>[ 1062.339530] nvidia-uvm: uvm_gpu.c:1311 init_gpu[pid:6006] PMM initialization failed: Failure: Generic Error [NV_ERR_GENERIC], GPU ID 1: GPU-de9f6996-a0bf-2443-d0b7-eca4d994dab2 UVM-GI-de9f6996-a0bf-2443-d0b7-eca4d994dab2

Nvidia's documention [1] points out that the problem has been fixed upstream.  After discussions with Nvidia, they pointed out two commits (backported in this changeset) that will resolve the issue.

This fix has been tested by the reporter.

[1] https://docs.nvidia.com/cuda/archive/13.0.0/cuda-toolkit-release-notes/index.html#known-issues

Signed-off-by: Prarit Bhargava <prarit@redhat.com>

Approved-by: David Arcari <darcari@redhat.com>
Approved-by: Rafael Aquini <raquini@redhat.com>
Approved-by: Lucas Zampieri <lzampier@redhat.com>
Approved-by: Eder Zulian <ezulian@redhat.com>
Approved-by: John W. Linville <linville@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
2025-11-12 11:20:02 +00:00
CKI KWF Bot 277c09e2aa Merge: KVM: x86: Advertise support for AMD's PREFETCHI
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/7461

# Merge Request Required Information

## Summary of Changes

Latest AMD Platforms introduce a new instruction, PREFETCHI, that loads a cache line from a specified memory address into the indicated data or instruction cache level, based on locality reference hints.

Advertise support for the instruction to the user space

## Approved Development Ticket(s)

```
JIRA: https://issues.redhat.com/browse/RHEL-98696
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
```

<details><summary>Click for formatting instructions</summary>
Please follow the CentOS Stream [contribution documentation](https://docs.centos.org/en-US/stream-contrib/quickstart/) for how to file this ticket and have it approved.

List tickets each on their own line of this description using the format "Resolves: RHEL-76229", "Related: RHEL-76229" or "Reverts: RHEL-76229", as appropriate.
</details>

Approved-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Approved-by: Bandan Das <bsd@redhat.com>
Approved-by: Steve Best <sbest@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
2025-11-12 11:20:00 +00:00
CKI KWF Bot 2270dbc721 Merge: Refresh s390x KVM subsystem up to (mostly) kernel 6.17-rc7, fix postcopy migration problem and add CHSC Store Event Information feature
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/7388

JIRA: https://issues.redhat.com/browse/RHEL-113452

JIRA: https://issues.redhat.com/browse/RHEL-43214

JIRA: https://issues.redhat.com/browse/RHEL-72996

Refresh the zKVM subsystem to the latest upstream kernel, fix one important bug with postcopy migration and add the "Report vfio-ap configuration changes with CHSC Store Event Information" feature.

Omitted-fix: 0fc670d07d5de36a54f061f457743c9cde1d8b46

(it's a risc-v patch, not applicable to RHEL-9)

Signed-off-by: Thomas Huth <thuth@redhat.com>

Approved-by: Tony Camuso <tcamuso@redhat.com>
Approved-by: Vladis Dronov <vdronov@redhat.com>
Approved-by: Jerry Snitselaar <jsnitsel@redhat.com>
Approved-by: Rafael Aquini <raquini@redhat.com>
Approved-by: Eder Zulian <ezulian@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
2025-11-12 11:19:58 +00:00
CKI KWF Bot b9c8dae923 Merge: xfs: do not propagate ENODATA disk errors into xattr code
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/7379

JIRA: https://issues.redhat.com/browse/RHEL-71501

ENODATA (aka ENOATTR) has a very specific meaning in the xfs xattr code;
namely, that the requested attribute name could not be found.

However, a medium error from disk may also return ENODATA. At best,
this medium error may escape to userspace as "attribute not found"
when in fact it's an IO (disk) error.

At worst, we may oops in xfs_attr_leaf_get() when we do:

	error = xfs_attr_leaf_hasname(args, &bp);
	if (error == -ENOATTR)  {
		xfs_trans_brelse(args->trans, bp);
		return error;
	}

because an ENODATA/ENOATTR error from disk leaves us with a null bp,
and the xfs_trans_brelse will then null-deref it.

As discussed on the list, we really need to modify the lower level
IO functions to trap all disk errors and ensure that we don't let
unique errors like this leak up into higher xfs functions - many
like this should be remapped to EIO.

However, this patch directly addresses a reported bug in the xattr
code, and should be safe to backport to stable kernels. A larger-scope
patch to handle more unique errors at lower levels can follow later.

(Note, prior to 07120f1abd we did not oops, but we did return the
wrong error code to userspace.)

Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Fixes: 07120f1abd ("xfs: Add xfs_has_attr and subroutines")
Cc: stable@vger.kernel.org # v5.9+
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
(cherry picked from commit ae668cd567a6a7622bc813ee0bb61c42bed61ba7)
Signed-off-by: Carlos Maiolino <cmaiolino@redhat.com>

Approved-by: Brian Foster <bfoster@redhat.com>
Approved-by: Pavel Reichl <preichl@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
2025-11-12 11:19:56 +00:00
CKI KWF Bot 74a30f696a Merge: sched: Do not call __put_task_struct() on rt if pi_blocked_on is set
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/7175

JIRA: https://issues.redhat.com/browse/RHEL-40885

commit 8671bad873ebeb082afcf7b4501395c374da6023
Author: Luis Claudio R. Goncalves <lgoncalv@redhat.com>
Date:   Mon Jul 7 11:03:59 2025 -0300

    sched: Do not call __put_task_struct() on rt if pi_blocked_on is set

    With PREEMPT_RT enabled, some of the calls to put_task_struct() coming
    from rt_mutex_adjust_prio_chain() could happen in preemptible context and
    with a mutex enqueued. That could lead to this sequence:

            rt_mutex_adjust_prio_chain()
              put_task_struct()
                __put_task_struct()
                  sched_ext_free()
                    spin_lock_irqsave()
                      rtlock_lock() --->  TRIGGERS
                                          lockdep_assert(!current->pi_blocked_on);

    This is not a SCHED_EXT bug. The first cleanup function called by
    __put_task_struct() is sched_ext_free() and it happens to take a
    (RT) spin_lock, which in the scenario described above, would trigger
    the lockdep assertion of "!current->pi_blocked_on".

    Crystal Wood was able to identify the problem as __put_task_struct()
    being called during rt_mutex_adjust_prio_chain(), in the context of
    a process with a mutex enqueued.

    Instead of adding more complex conditions to decide when to directly
    call __put_task_struct() and when to defer the call, unconditionally
    resort to the deferred call on PREEMPT_RT to simplify the code.

    Fixes: 893cdaaa3977 ("sched: avoid false lockdep splat in put_task_struct()")
    Suggested-by: Crystal Wood <crwood@redhat.com>
    Signed-off-by: Luis Claudio R. Goncalves <lgoncalv@redhat.com>
    Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
    Reviewed-by: Wander Lairson Costa <wander@redhat.com>
    Reviewed-by: Valentin Schneider <vschneid@redhat.com>
    Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
    Link: https://lore.kernel.org/r/aGvTz5VaPFyj0pBV@uudg.org

Signed-off-by: Luis Claudio R. Goncalves <lgoncalv@redhat.com>

Approved-by: Oleg Nesterov <oleg@redhat.com>
Approved-by: Wander Lairson Costa <wander@redhat.com>
Approved-by: Phil Auld <pauld@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
2025-11-12 11:19:53 +00:00
CKI KWF Bot f07b929571 [redhat] kernel-5.14.0-636.el9
Signed-off-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>
2025-11-07 16:53:42 +00:00
CKI KWF Bot ff8d0046b9 Merge: Hypervisor pipe (HVPIPE) character driver to support HVPIPE RTAS calls
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/7562

Description: Hypervisor pipe (HVPIPE) character driver to support HVPIPE RTAS calls

JIRA: https://issues.redhat.com/browse/RHEL-101849

Build Info: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=69010252

Tested: Verified Brew build test kernel RPMs and confirmed issue is resovled

Signed-off-by: Mamatha Inamdar <minamdar@redhat.com>

Approved-by: Steve Best <sbest@redhat.com>
Approved-by: Tony Camuso <tcamuso@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
2025-11-07 16:52:59 +00:00
CKI KWF Bot 328bbe2bba Merge: Rebase RTLA to v6.17 [rhel-9.8]
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/7554

# Merge Request Required Information

JIRA: https://issues.redhat.com/browse/RHEL-117873

CVE: CVE-2025-38493
CVE: CVE-2025-39887
CVE: CVE-2025-39974
CVE: CVE-2025-21733

## Summary of Changes

Rebase RTLA in RHEL 9.8 to upstream 6.17, with one fix from 6.18.

## Approved Development Ticket(s)
All submissions to CentOS Stream must reference a ticket in [Red Hat Jira](https://issues.redhat.com/).

<details><summary>Click for formatting instructions</summary>
Please follow the CentOS Stream [contribution documentation](https://docs.centos.org/en-US/stream-contrib/quickstart/) for how to file this ticket and have it approved.

List tickets each on their own line of this description using the format "Resolves: RHEL-76229", "Related: RHEL-76229" or "Reverts: RHEL-76229", as appropriate.
</details>

Signed-off-by: Tomas Glozar <tglozar@redhat.com>

Approved-by: Phil Auld <pauld@redhat.com>
Approved-by: Wander Lairson Costa <wander@redhat.com>
Approved-by: Luis Claudio R. Goncalves <lgoncalv@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
2025-11-07 16:52:57 +00:00
CKI KWF Bot 5696c2dc1b Merge: net/smc: Remove validation of reserved bits in CLC Decline msg
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/7550

JIRA: https://issues.redhat.com/browse/RHEL-124197

commit cc282f73bc0cbdf3ee7af2f2d3a2ef4e6b19242d

Signed-off-by: Mete Durlu <mdurlu@redhat.com>

Approved-by: Steve Best <sbest@redhat.com>
Approved-by: Tony Camuso <tcamuso@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
2025-11-07 16:52:55 +00:00
CKI KWF Bot ccfe97bc88 Merge: i40e: input validation fixes
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/7539

JIRA: https://issues.redhat.com/browse/RHEL-123809
CVE: CVE-2025-39968
CVE: CVE-2025-39969
CVE: CVE-2025-39970
CVE: CVE-2025-39971
CVE: CVE-2025-39972
CVE: CVE-2025-39973

This fixes several missing input validation bugs in i40e.

Signed-off-by: Michal Schmidt <mschmidt@redhat.com>

Approved-by: Kamal Heib <kheib@redhat.com>
Approved-by: José Ignacio Tornos Martínez <jtornosm@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
2025-11-07 16:52:54 +00:00
CKI KWF Bot 412da9904c Merge: io_uring: enable per-io write streams
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/7523

io_uring: enable per-io write streams

JIRA: https://issues.redhat.com/browse/RHEL-122870

This is actually one bug fix for initializing kiocb.ki_write_stream,
otherwise it may fail blktests block/035.

Signed-off-by: Ming Lei <ming.lei@redhat.com>

Approved-by: Brian Foster <bfoster@redhat.com>
Approved-by: John Meneghini <jmeneghi@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
2025-11-07 16:52:52 +00:00
CKI KWF Bot 9356f29cb6 Merge: Update the nvme drivers to kernel v6.16
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/7518

# Merge Request Required Information

## Summary of Changes

JIRA: https://issues.redhat.com/browse/RHEL-114502

Update the nvme drivers and sync them with kernel version 6.16

Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>

## Approved Development Ticket(s)
All submissions to CentOS Stream must reference a ticket in [Red Hat Jira](https://issues.redhat.com/).

<details><summary>Click for formatting instructions</summary>
Please follow the CentOS Stream [contribution documentation](https://docs.centos.org/en-US/stream-contrib/quickstart/) for how to file this ticket and have it approved.

List tickets each on their own line of this description using the format "Resolves: RHEL-76229", "Related: RHEL-76229" or "Reverts: RHEL-76229", as appropriate.
</details>

Approved-by: Ewan D. Milne <emilne@redhat.com>
Approved-by: Ming Lei <ming.lei@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
2025-11-07 16:52:51 +00:00
CKI KWF Bot 039d7c32dd Merge: crypto: octeontx2: update octeontx2 crypto driver to v6.17
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/7501

```
JIRA: https://issues.redhat.com/browse/RHEL-122025
Upstream Status: 11 commits are merged into the linux.git

Bring in the latest OcteonTX2 driver bugfixes and updates.
Almost all the commits apply cleanly. One commit has a partial
scope limited to the OcteonTX2 driver only. One commit requires
a small edit due to a missing tree-wide upstream commit.

Signed-off-by: Vladis Dronov <vdronov@redhat.com>
```

Approved-by: Tony Camuso <tcamuso@redhat.com>
Approved-by: Herbert Xu <zxu@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
2025-11-07 16:52:49 +00:00
CKI KWF Bot bb3f889ac9 Merge: CNB98: RDMA: Update to v6.16
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/7480

Description:
This patch set updates the RDMA core and RDMA ULPs to upstream kernel v6.16.

Depends: !7355

Upstream:
Linus's master tree.

Issues:

JIRA: https://issues.redhat.com/browse/RHEL-110100

Brew:
https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=69108556

Omitted-fix: 0b261d7c1cd3 ("RDMA/rxe: Break endless pagefault loop for RO pages")

Signed-off-by: Kamal Heib <kheib@redhat.com>

Approved-by: Murphy Zhou <xzhou@redhat.com>
Approved-by: José Ignacio Tornos Martínez <jtornosm@redhat.com>
Approved-by: Rafael Aquini <raquini@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
2025-11-07 16:52:47 +00:00
CKI KWF Bot 3d698cc555 Merge: USB/TB code rebase of supported drivers to upstream v6.16
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/7476

JIRA: https://issues.redhat.com/browse/RHEL-116016

This MR rebases supported usb/tbt/memstick/extcon drivers to upstream kernel v6.16. By design, rebase changes are limited to supported drivers and their relevant physical infrastructure. Treewide changes which touch these drivers are partially pulled in, whenever found out to be relevant. A new pm wakeup function also had to be imported in this merge request.

1) Common Vulnerabilities and Exposures:

```
CVE: CVE-2023-53356
CVE: CVE-2023-53551
CVE: CVE-2024-56670
CVE: CVE-2025-38103
CVE: CVE-2025-38174
CVE: CVE-2025-38268
CVE: CVE-2025-38391
CVE: CVE-2025-38404
CVE: CVE-2025-38448
CVE: CVE-2025-38497
CVE: CVE-2025-38535
```

2) Omitted fixes:

```
Omitted-fix: 9fc5986fbcd7 usb: typec: tcpci: Fix wakeup source leaks on device unbind
Omitted-fix: 015c0e63eb7c usb: gadget: udc-xilinx: Remove the invalid comment
Omitted-fix: e2d8ae899760 ASoC: qdsp6: fix compile-testing without CONFIG_OF
Omitted-fix: d8163a32ca95 phy: tegra: xusb: Add Tegra234 support
Omitted-fix: 56ad91c1aa9c i2c: robotfuzz-osif: disable zero-length read messages
```

Signed-off-by: Desnes Nunes <desnesn@redhat.com>

Approved-by: David Marlin <dmarlin@redhat.com>
Approved-by: Tony Camuso <tcamuso@redhat.com>
Approved-by: Bastien Nocera <bnocera@redhat.com>
Approved-by: Eric Chanudet <echanude@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
2025-11-07 16:52:45 +00:00
CKI KWF Bot 32cc13275c Merge: ext4: fix FS_IOC_GETFSMAP handling
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/7389

JIRA: https://issues.redhat.com/browse/RHEL-109218

Fixes to allow ext4 to pass fstests generic/365.

Signed-off-by: Brian Foster <bfoster@redhat.com>

Approved-by: Pavel Reichl <preichl@redhat.com>
Approved-by: Carlos Maiolino <cmaiolino@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
2025-11-07 16:52:43 +00:00
CKI KWF Bot 59c30cfa42 Merge: SCSI updates for 9.8
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/7365

SCSI core updates for RHEL 9.8 to upstream 6.17 +/-

JIRA: https://issues.redhat.com/browse/RHEL-116075

Signed-off-by: Ewan D. Milne <emilne@redhat.com>

Approved-by: bgurney <bgurney@redhat.com>
Approved-by: Ming Lei <ming.lei@redhat.com>
Approved-by: John Meneghini <jmeneghi@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
2025-11-07 16:52:41 +00:00
CKI KWF Bot c52c19321e Merge: CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/7163

JIRA: https://issues.redhat.com/browse/RHEL-104731
CVE: CVE-2025-38351

```
Upstream: Merged

commit fa787ac07b3ceb56dd88a62d1866038498e96230
Author: Manuel Andreas <manuel.andreas@tum.de>
Date:   Wed Jun 25 15:53:19 2025 +0200

    KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush

    In KVM guests with Hyper-V hypercalls enabled, the hypercalls
    HVCALL_FLUSH_VIRTUAL_ADDRESS_LIST and HVCALL_FLUSH_VIRTUAL_ADDRESS_LIST_EX
    allow a guest to request invalidation of portions of a virtual TLB.
    For this, the hypercall parameter includes a list of GVAs that are supposed
    to be invalidated.

    However, when non-canonical GVAs are passed, there is currently no
    filtering in place and they are eventually passed to checked invocations of
    INVVPID on Intel / INVLPGA on AMD.  While AMD's INVLPGA silently ignores
    non-canonical addresses (effectively a no-op), Intel's INVVPID explicitly
    signals VM-Fail and ultimately triggers the WARN_ONCE in invvpid_error():

      invvpid failed: ext=0x0 vpid=1 gva=0xaaaaaaaaaaaaa000
      WARNING: CPU: 6 PID: 326 at arch/x86/kvm/vmx/vmx.c:482
      invvpid_error+0x91/0xa0 [kvm_intel]
      Modules linked in: kvm_intel kvm 9pnet_virtio irqbypass fuse
      CPU: 6 UID: 0 PID: 326 Comm: kvm-vm Not tainted 6.15.0 #14 PREEMPT(voluntary)
      RIP: 0010:invvpid_error+0x91/0xa0 [kvm_intel]
      Call Trace:
        vmx_flush_tlb_gva+0x320/0x490 [kvm_intel]
        kvm_hv_vcpu_flush_tlb+0x24f/0x4f0 [kvm]
        kvm_arch_vcpu_ioctl_run+0x3013/0x5810 [kvm]

    Hyper-V documents that invalid GVAs (those that are beyond a partition's
    GVA space) are to be ignored.  While not completely clear whether this
    ruling also applies to non-canonical GVAs, it is likely fine to make that
    assumption, and manual testing on Azure confirms "real" Hyper-V interprets
    the specification in the same way.

    Skip non-canonical GVAs when processing the list of address to avoid
    tripping the INVVPID failure.  Alternatively, KVM could filter out "bad"
    GVAs before inserting into the FIFO, but practically speaking the only
    downside of pushing validation to the final processing is that doing so
    is suboptimal for the guest, and no well-behaved guest will request TLB
    flushes for non-canonical addresses.

    Fixes: 260970862c88 ("KVM: x86: hyper-v: Handle HVCALL_FLUSH_VIRTUAL_ADDRESS_LIST{,EX} calls gently")
    Cc: stable@vger.kernel.org
    Signed-off-by: Manuel Andreas <manuel.andreas@tum.de>
    Suggested-by: Vitaly Kuznetsov <vkuznets@redhat.com>
    Link: https://lore.kernel.org/r/c090efb3-ef82-499f-a5e0-360fc8420fb7@tum.de
    Signed-off-by: Sean Christopherson <seanjc@google.com>
```

Signed-off-by: Jon Maloy <jmaloy@redhat.com>

---

<small>Created 2025-07-24 17:58 UTC by backporter - [KWF FAQ](https://red.ht/kernel_workflow_doc) - [Slack #team-kernel-workflow](https://redhat-internal.slack.com/archives/C04LRUPMJQ5) - [Source](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/webhook/utils/backporter.py) - [Documentation](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/docs/README.backporter.md) - [Report an issue](https://issues.redhat.com/secure/CreateIssueDetails!init.jspa?pid=12334433&issuetype=1&priority=4&summary=backporter+webhook+issue&components=kernel-workflow+/+backporter)</small>

Approved-by: Waiman Long <longman@redhat.com>
Approved-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
2025-11-07 16:52:39 +00:00
CKI KWF Bot 88c9f0ae1b Merge: cgroup/rstat: avoid disabling irqs for O(num_cpu)
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/6931

Backporting upstream patch `cgroup/rstat: avoid disabling irqs for O(num_cpu)` to help address performance degradation issues.

JIRA: https://issues.redhat.com/browse/RHEL-94298

Signed-off-by: Radostin Stoyanov <rstoyano@redhat.com>

Approved-by: Herton R. Krzesinski <herton@redhat.com>
Approved-by: Waiman Long <longman@redhat.com>
Approved-by: Phil Auld <pauld@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
2025-11-07 16:52:38 +00:00
Mete Durlu 5e3ed29740 net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync()
JIRA: https://issues.redhat.com/browse/RHEL-99989

commit ba1e9421cf1a8369d25c3832439702a015d6b5f9
Author: Liu Jian <liujian56@huawei.com>
Date:   Thu Aug 28 20:41:17 2025 +0800

    net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync()

    BUG: kernel NULL pointer dereference, address: 00000000000002ec
    PGD 0 P4D 0
    Oops: Oops: 0000 [#1] SMP PTI
    CPU: 28 UID: 0 PID: 343 Comm: kworker/28:1 Kdump: loaded Tainted: G        OE       6.17.0-rc2+ #9 NONE
    Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
    Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014
    Workqueue: smc_hs_wq smc_listen_work [smc]
    RIP: 0010:smc_ib_is_sg_need_sync+0x9e/0xd0 [smc]
    ...
    Call Trace:
     <TASK>
     smcr_buf_map_link+0x211/0x2a0 [smc]
     __smc_buf_create+0x522/0x970 [smc]
     smc_buf_create+0x3a/0x110 [smc]
     smc_find_rdma_v2_device_serv+0x18f/0x240 [smc]
     ? smc_vlan_by_tcpsk+0x7e/0xe0 [smc]
     smc_listen_find_device+0x1dd/0x2b0 [smc]
     smc_listen_work+0x30f/0x580 [smc]
     process_one_work+0x18c/0x340
     worker_thread+0x242/0x360
     kthread+0xe7/0x220
     ret_from_fork+0x13a/0x160
     ret_from_fork_asm+0x1a/0x30
     </TASK>

    If the software RoCE device is used, ibdev->dma_device is a null pointer.
    As a result, the problem occurs. Null pointer detection is added to
    prevent problems.

    Fixes: 0ef69e788411c ("net/smc: optimize for smc_sndbuf_sync_sg_for_device and smc_rmb_sync_sg_for_cpu")
    Signed-off-by: Liu Jian <liujian56@huawei.com>
    Reviewed-by: Guangguan Wang <guangguan.wang@linux.alibaba.com>
    Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
    Reviewed-by: D. Wythe <alibuda@linux.alibaba.com>
    Link: https://patch.msgid.link/20250828124117.2622624-1-liujian56@huawei.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>

Signed-off-by: Mahanta Jambigi <mjambigi@linux.ibm.com>
Signed-off-by: Mete Durlu <mdurlu@redhat.com>
2025-11-07 16:16:20 +01:00
Mete Durlu e8e40f6eb8 net/smc: fix UAF on smcsk after smc_listen_out()
JIRA: https://issues.redhat.com/browse/RHEL-99989

commit d9cef55ed49117bd63695446fb84b4b91815c0b4
Author: D. Wythe <alibuda@linux.alibaba.com>
Date:   Mon Aug 18 13:46:18 2025 +0800

    net/smc: fix UAF on smcsk after smc_listen_out()

    BPF CI testing report a UAF issue:

      [   16.446633] BUG: kernel NULL pointer dereference, address: 000000000000003  0
      [   16.447134] #PF: supervisor read access in kernel mod  e
      [   16.447516] #PF: error_code(0x0000) - not-present pag  e
      [   16.447878] PGD 0 P4D   0
      [   16.448063] Oops: Oops: 0000 [#1] PREEMPT SMP NOPT  I
      [   16.448409] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:1 Tainted: G           OE      6.13.0-rc3-g89e8a75fda73-dirty #4  2
      [   16.449124] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODUL  E
      [   16.449502] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/201  4
      [   16.450201] Workqueue: smc_hs_wq smc_listen_wor  k
      [   16.450531] RIP: 0010:smc_listen_work+0xc02/0x159  0
      [   16.452158] RSP: 0018:ffffb5ab40053d98 EFLAGS: 0001024  6
      [   16.452526] RAX: 0000000000000001 RBX: 0000000000000002 RCX: 000000000000030  0
      [   16.452994] RDX: 0000000000000280 RSI: 00003513840053f0 RDI: 000000000000000  0
      [   16.453492] RBP: ffffa097808e3800 R08: ffffa09782dba1e0 R09: 000000000000000  5
      [   16.453987] R10: 0000000000000000 R11: 0000000000000000 R12: ffffa0978274640  0
      [   16.454497] R13: 0000000000000000 R14: 0000000000000000 R15: ffffa09782d4092  0
      [   16.454996] FS:  0000000000000000(0000) GS:ffffa097bbc00000(0000) knlGS:000000000000000  0
      [   16.455557] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003  3
      [   16.455961] CR2: 0000000000000030 CR3: 0000000102788004 CR4: 0000000000770ef  0
      [   16.456459] PKRU: 5555555  4
      [   16.456654] Call Trace  :
      [   16.456832]  <TASK  >
      [   16.456989]  ? __die+0x23/0x7  0
      [   16.457215]  ? page_fault_oops+0x180/0x4c  0
      [   16.457508]  ? __lock_acquire+0x3e6/0x249  0
      [   16.457801]  ? exc_page_fault+0x68/0x20  0
      [   16.458080]  ? asm_exc_page_fault+0x26/0x3  0
      [   16.458389]  ? smc_listen_work+0xc02/0x159  0
      [   16.458689]  ? smc_listen_work+0xc02/0x159  0
      [   16.458987]  ? lock_is_held_type+0x8f/0x10  0
      [   16.459284]  process_one_work+0x1ea/0x6d  0
      [   16.459570]  worker_thread+0x1c3/0x38  0
      [   16.459839]  ? __pfx_worker_thread+0x10/0x1  0
      [   16.460144]  kthread+0xe0/0x11  0
      [   16.460372]  ? __pfx_kthread+0x10/0x1  0
      [   16.460640]  ret_from_fork+0x31/0x5  0
      [   16.460896]  ? __pfx_kthread+0x10/0x1  0
      [   16.461166]  ret_from_fork_asm+0x1a/0x3  0
      [   16.461453]  </TASK  >
      [   16.461616] Modules linked in: bpf_testmod(OE) [last unloaded: bpf_testmod(OE)  ]
      [   16.462134] CR2: 000000000000003  0
      [   16.462380] ---[ end trace 0000000000000000 ]---
      [   16.462710] RIP: 0010:smc_listen_work+0xc02/0x1590

    The direct cause of this issue is that after smc_listen_out_connected(),
    newclcsock->sk may be NULL since it will releases the smcsk. Therefore,
    if the application closes the socket immediately after accept,
    newclcsock->sk can be NULL. A possible execution order could be as
    follows:

    smc_listen_work                                 | userspace
    -----------------------------------------------------------------
    lock_sock(sk)                                   |
    smc_listen_out_connected()                      |
    | \- smc_listen_out                             |
    |    | \- release_sock                          |
         | |- sk->sk_data_ready()                   |
                                                    | fd = accept();
                                                    | close(fd);
                                                    |  \- socket->sk = NULL;
    /* newclcsock->sk is NULL now */
    SMC_STAT_SERV_SUCC_INC(sock_net(newclcsock->sk))

    Since smc_listen_out_connected() will not fail, simply swapping the order
    of the code can easily fix this issue.

    Fixes: 3b2dec2603 ("net/smc: restructure client and server code in af_smc")
    Signed-off-by: D. Wythe <alibuda@linux.alibaba.com>
    Reviewed-by: Guangguan Wang <guangguan.wang@linux.alibaba.com>
    Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
    Reviewed-by: Dust Li <dust.li@linux.alibaba.com>
    Link: https://patch.msgid.link/20250818054618.41615-1-alibuda@linux.alibaba.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Mahanta Jambigi <mjambigi@linux.ibm.com>
Signed-off-by: Mete Durlu <mdurlu@redhat.com>
2025-11-07 16:16:13 +01:00
Mete Durlu 01d76a42bf smc: Fix various oops due to inet_sock type confusion.
JIRA: https://issues.redhat.com/browse/RHEL-99989
Conflicts: Conflicts due to change in line numbers between 5.14 & 6.17
kernel, no functional changes

commit 60ada4fe644edaa6c2da97364184b0425e8aeaf5
Author: Kuniyuki Iwashima <kuniyu@google.com>
Date:   Fri Jul 11 06:07:52 2025 +0000

    smc: Fix various oops due to inet_sock type confusion.

    syzbot reported weird splats [0][1] in cipso_v4_sock_setattr() while
    freeing inet_sk(sk)->inet_opt.

    The address was freed multiple times even though it was read-only memory.

    cipso_v4_sock_setattr() did nothing wrong, and the root cause was type
    confusion.

    The cited commit made it possible to create smc_sock as an INET socket.

    The issue is that struct smc_sock does not have struct inet_sock as the
    first member but hijacks AF_INET and AF_INET6 sk_family, which confuses
    various places.

    In this case, inet_sock.inet_opt was actually smc_sock.clcsk_data_ready(),
    which is an address of a function in the text segment.

      $ pahole -C inet_sock vmlinux
      struct inet_sock {
      ...
              struct ip_options_rcu *    inet_opt;             /*   784     8 */

      $ pahole -C smc_sock vmlinux
      struct smc_sock {
      ...
              void                       (*clcsk_data_ready)(struct sock *); /*   784     8 */

    The same issue for another field was reported before. [2][3]

    At that time, an ugly hack was suggested [4], but it makes both INET
    and SMC code error-prone and hard to change.

    Also, yet another variant was fixed by a hacky commit 98d4435efcbf3
    ("net/smc: prevent NULL pointer dereference in txopt_get").

    Instead of papering over the root cause by such hacks, we should not
    allow non-INET socket to reuse the INET infra.

    Let's add inet_sock as the first member of smc_sock.

    [0]:
    kvfree_call_rcu(): Double-freed call. rcu_head 000000006921da73
    WARNING: CPU: 0 PID: 6718 at mm/slab_common.c:1956 kvfree_call_rcu+0x94/0x3f0 mm/slab_common.c:1955
    Modules linked in:
    CPU: 0 UID: 0 PID: 6718 Comm: syz.0.17 Tainted: G        W           6.16.0-rc4-syzkaller-g7482bb149b9f #0 PREEMPT
    Tainted: [W]=WARN
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
    pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
    pc : kvfree_call_rcu+0x94/0x3f0 mm/slab_common.c:1955
    lr : kvfree_call_rcu+0x94/0x3f0 mm/slab_common.c:1955
    sp : ffff8000a03a7730
    x29: ffff8000a03a7730 x28: 00000000fffffff5 x27: 1fffe000184823d3
    x26: dfff800000000000 x25: ffff0000c2411e9e x24: ffff0000dd88da00
    x23: ffff8000891ac9a0 x22: 00000000ffffffea x21: ffff8000891ac9a0
    x20: ffff8000891ac9a0 x19: ffff80008afc2480 x18: 00000000ffffffff
    x17: 0000000000000000 x16: ffff80008ae642c8 x15: ffff700011ede14c
    x14: 1ffff00011ede14c x13: 0000000000000004 x12: ffffffffffffffff
    x11: ffff700011ede14c x10: 0000000000ff0100 x9 : 5fa3c1ffaf0ff000
    x8 : 5fa3c1ffaf0ff000 x7 : 0000000000000001 x6 : 0000000000000001
    x5 : ffff8000a03a7078 x4 : ffff80008f766c20 x3 : ffff80008054d360
    x2 : 0000000000000000 x1 : 0000000000000201 x0 : 0000000000000000
    Call trace:
     kvfree_call_rcu+0x94/0x3f0 mm/slab_common.c:1955 (P)
     cipso_v4_sock_setattr+0x2f0/0x3f4 net/ipv4/cipso_ipv4.c:1914
     netlbl_sock_setattr+0x240/0x334 net/netlabel/netlabel_kapi.c:1000
     smack_netlbl_add+0xa8/0x158 security/smack/smack_lsm.c:2581
     smack_inode_setsecurity+0x378/0x430 security/smack/smack_lsm.c:2912
     security_inode_setsecurity+0x118/0x3c0 security/security.c:2706
     __vfs_setxattr_noperm+0x174/0x5c4 fs/xattr.c:251
     __vfs_setxattr_locked+0x1ec/0x218 fs/xattr.c:295
     vfs_setxattr+0x158/0x2ac fs/xattr.c:321
     do_setxattr fs/xattr.c:636 [inline]
     file_setxattr+0x1b8/0x294 fs/xattr.c:646
     path_setxattrat+0x2ac/0x320 fs/xattr.c:711
     __do_sys_fsetxattr fs/xattr.c:761 [inline]
     __se_sys_fsetxattr fs/xattr.c:758 [inline]
     __arm64_sys_fsetxattr+0xc0/0xdc fs/xattr.c:758
     __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
     invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
     el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
     do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
     el0_svc+0x58/0x180 arch/arm64/kernel/entry-common.c:879
     el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:898
     el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600

    [1]:
    Unable to handle kernel write to read-only memory at virtual address ffff8000891ac9a8
    KASAN: probably user-memory-access in range [0x0000000448d64d40-0x0000000448d64d47]
    Mem abort info:
      ESR = 0x000000009600004e
      EC = 0x25: DABT (current EL), IL = 32 bits
      SET = 0, FnV = 0
      EA = 0, S1PTW = 0
      FSC = 0x0e: level 2 permission fault
    Data abort info:
      ISV = 0, ISS = 0x0000004e, ISS2 = 0x00000000
      CM = 0, WnR = 1, TnD = 0, TagAccess = 0
      GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
    swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000207144000
    [ffff8000891ac9a8] pgd=0000000000000000, p4d=100000020f950003, pud=100000020f951003, pmd=0040000201000781
    Internal error: Oops: 000000009600004e [#1]  SMP
    Modules linked in:
    CPU: 0 UID: 0 PID: 6946 Comm: syz.0.69 Not tainted 6.16.0-rc4-syzkaller-g7482bb149b9f #0 PREEMPT
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
    pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
    pc : kvfree_call_rcu+0x31c/0x3f0 mm/slab_common.c:1971
    lr : add_ptr_to_bulk_krc_lock mm/slab_common.c:1838 [inline]
    lr : kvfree_call_rcu+0xfc/0x3f0 mm/slab_common.c:1963
    sp : ffff8000a28a7730
    x29: ffff8000a28a7730 x28: 00000000fffffff5 x27: 1fffe00018b09bb3
    x26: 0000000000000001 x25: ffff80008f66e000 x24: ffff00019beaf498
    x23: ffff00019beaf4c0 x22: 0000000000000000 x21: ffff8000891ac9a0
    x20: ffff8000891ac9a0 x19: 0000000000000000 x18: 00000000ffffffff
    x17: ffff800093363000 x16: ffff80008052c6e4 x15: ffff700014514ecc
    x14: 1ffff00014514ecc x13: 0000000000000004 x12: ffffffffffffffff
    x11: ffff700014514ecc x10: 0000000000000001 x9 : 0000000000000001
    x8 : ffff00019beaf7b4 x7 : ffff800080a94154 x6 : 0000000000000000
    x5 : ffff8000935efa60 x4 : 0000000000000008 x3 : ffff80008052c7fc
    x2 : 0000000000000001 x1 : ffff8000891ac9a0 x0 : 0000000000000001
    Call trace:
     kvfree_call_rcu+0x31c/0x3f0 mm/slab_common.c:1967 (P)
     cipso_v4_sock_setattr+0x2f0/0x3f4 net/ipv4/cipso_ipv4.c:1914
     netlbl_sock_setattr+0x240/0x334 net/netlabel/netlabel_kapi.c:1000
     smack_netlbl_add+0xa8/0x158 security/smack/smack_lsm.c:2581
     smack_inode_setsecurity+0x378/0x430 security/smack/smack_lsm.c:2912
     security_inode_setsecurity+0x118/0x3c0 security/security.c:2706
     __vfs_setxattr_noperm+0x174/0x5c4 fs/xattr.c:251
     __vfs_setxattr_locked+0x1ec/0x218 fs/xattr.c:295
     vfs_setxattr+0x158/0x2ac fs/xattr.c:321
     do_setxattr fs/xattr.c:636 [inline]
     file_setxattr+0x1b8/0x294 fs/xattr.c:646
     path_setxattrat+0x2ac/0x320 fs/xattr.c:711
     __do_sys_fsetxattr fs/xattr.c:761 [inline]
     __se_sys_fsetxattr fs/xattr.c:758 [inline]
     __arm64_sys_fsetxattr+0xc0/0xdc fs/xattr.c:758
     __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
     invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
     el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
     do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
     el0_svc+0x58/0x180 arch/arm64/kernel/entry-common.c:879
     el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:898
     el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600
    Code: aa1f03e2 52800023 97ee1e8d b4000195 (f90006b4)

    Fixes: d25a92ccae6b ("net/smc: Introduce IPPROTO_SMC")
    Reported-by: syzbot+40bf00346c3fe40f90f2@syzkaller.appspotmail.com
    Closes: https://lore.kernel.org/all/686d9b50.050a0220.1ffab7.0020.GAE@google.com/
    Tested-by: syzbot+40bf00346c3fe40f90f2@syzkaller.appspotmail.com
    Reported-by: syzbot+f22031fad6cbe52c70e7@syzkaller.appspotmail.com
    Closes: https://lore.kernel.org/all/686da0f3.050a0220.1ffab7.0022.GAE@google.com/
    Reported-by: syzbot+271fed3ed6f24600c364@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=271fed3ed6f24600c364 # [2]
    Link: https://lore.kernel.org/netdev/99f284be-bf1d-4bc4-a629-77b268522fff@huawei.com/ # [3]
    Link: https://lore.kernel.org/netdev/20250331081003.1503211-1-wangliang74@huawei.com/ # [4]
    Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
    Reviewed-by: D. Wythe <alibuda@linux.alibaba.com>
    Reviewed-by: Wang Liang <wangliang74@huawei.com>
    Link: https://patch.msgid.link/20250711060808.2977529-1-kuniyu@google.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Mahanta Jambigi <mjambigi@linux.ibm.com>
Signed-off-by: Mete Durlu <mdurlu@redhat.com>
2025-11-07 16:16:09 +01:00
Mete Durlu 7c78786d4d net/smc: convert timeouts to secs_to_jiffies()
JIRA: https://issues.redhat.com/browse/RHEL-99989

commit 4814f9110ec6b7b2a25ec0c397f996ce34d31115
Author: Easwar Hariharan <easwar.hariharan@linux.microsoft.com>
Date:   Mon Jul 7 15:03:32 2025 -0700

    net/smc: convert timeouts to secs_to_jiffies()

    Commit b35108a51cf7 ("jiffies: Define secs_to_jiffies()") introduced
    secs_to_jiffies().  As the value here is a multiple of 1000, use
    secs_to_jiffies() instead of msecs_to_jiffies to avoid the multiplication.

    This is converted using scripts/coccinelle/misc/secs_to_jiffies.cocci with
    the following Coccinelle rules:

    @depends on patch@
    expression E;
    @@

    -msecs_to_jiffies(E * 1000)
    +secs_to_jiffies(E)

    -msecs_to_jiffies(E * MSEC_PER_SEC)
    +secs_to_jiffies(E)

    Signed-off-by: Easwar Hariharan <eahariha@linux.microsoft.com>
    Reviewed-by: Dust Li <dust.li@linux.alibaba.com>
    Reviewed-by: Guangguan Wang <guangguan.wang@linux.alibaba.com>
    Link: https://patch.msgid.link/20250707-netdev-secs-to-jiffies-part-2-v2-1-b7817036342f@linux.microsoft.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Mahanta Jambigi <mjambigi@linux.ibm.com>
Signed-off-by: Mete Durlu <mdurlu@redhat.com>
2025-11-07 16:16:08 +01:00
Mete Durlu da6868d835 net/smc: replace strncpy with strscpy
JIRA: https://issues.redhat.com/browse/RHEL-99989

commit ae2402bf882b40fb9cf3b6a5c9ff0e6c7a9ef842
Author: Pranav Tyagi <pranav.tyagi03@gmail.com>
Date:   Fri Jun 20 15:55:59 2025 +0530

    net/smc: replace strncpy with strscpy

    Replace the deprecated strncpy() with two-argument version of
    strscpy() as the destination is an array
    and should be NUL-terminated.

    Signed-off-by: Pranav Tyagi <pranav.tyagi03@gmail.com>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Link: https://patch.msgid.link/20250620102559.6365-1-pranav.tyagi03@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Mahanta Jambigi <mjambigi@linux.ibm.com>
Signed-off-by: Mete Durlu <mdurlu@redhat.com>
2025-11-07 16:16:07 +01:00
Mete Durlu e827af796a net/smc: remove unused function smc_lo_supports_v2
JIRA: https://issues.redhat.com/browse/RHEL-99989

commit 091d019adce033118776ef93b50a268f715ae8f6
Author: Wang Liang <wangliang74@huawei.com>
Date:   Thu Jun 19 11:08:54 2025 +0800

    net/smc: remove unused function smc_lo_supports_v2

    The smcd_ops->supports_v2 is only called in smcd_register_dev(), which
    calls function smcd_supports_v2 for ism. For loopback-ism, function
    smc_lo_supports_v2 is unused, remove it.

    Signed-off-by: Wang Liang <wangliang74@huawei.com>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Link: https://patch.msgid.link/20250619030854.1536676-1-wangliang74@huawei.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Mahanta Jambigi <mjambigi@linux.ibm.com>
Signed-off-by: Mete Durlu <mdurlu@redhat.com>
2025-11-07 16:16:06 +01:00
Mete Durlu 9bfbd54a96 net/smc: remove unused input parameters in smc_buf_get_slot
JIRA: https://issues.redhat.com/browse/RHEL-99989
Conflicts: Conflicts due to change in line numbers between 5.14 & 6.17
kernel, no functional changes

commit c3ee72ded0d2fc6433a009291d7825b28426e4c0
Author: Wang Liang <wangliang74@huawei.com>
Date:   Wed Jun 18 18:33:42 2025 +0800

    net/smc: remove unused input parameters in smc_buf_get_slot

    The input parameter "compressed_bufsize" of smc_buf_get_slot is unused,
    remove it.

    Signed-off-by: Wang Liang <wangliang74@huawei.com>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Link: https://patch.msgid.link/20250618103342.1423913-1-wangliang74@huawei.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Mahanta Jambigi <mjambigi@linux.ibm.com>
Signed-off-by: Mete Durlu <mdurlu@redhat.com>
2025-11-07 16:16:05 +01:00
Mete Durlu e428271d08 s390: ism: Pass string literal as format argument of dev_set_name()
JIRA: https://issues.redhat.com/browse/RHEL-99989

commit 199561a48f026bf674424fd9019c0690a3570377
Author: Simon Horman <horms@kernel.org>
Date:   Thu Apr 17 11:28:23 2025 +0100

    s390: ism: Pass string literal as format argument of dev_set_name()

    GCC 14.2.0 reports that passing a non-string literal as the
    format argument of dev_set_name() is potentially insecure.

    drivers/s390/net/ism_drv.c: In function 'ism_probe':
    drivers/s390/net/ism_drv.c:615:2: warning: format not a string literal and no format arguments [-Wformat-security]
      615 |  dev_set_name(&ism->dev, dev_name(&pdev->dev));
          |  ^~~~~~~~~~~~

    It seems to me that as pdev is a PCIE device then the dev_name
    call above should always return the device's BDF, e.g. 00:12.0.
    That this should not contain format escape sequences. And thus
    the current usage is safe.

    But, it seems better to be safe than sorry. And, as a bonus, compiler
    output becomes less verbose by addressing this issue.

    Compile tested only.
    No functional change intended.

    Signed-off-by: Simon Horman <horms@kernel.org>
    Link: https://patch.msgid.link/20250417-ism-str-fmt-v1-1-9818b029874d@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Mahanta Jambigi <mjambigi@linux.ibm.com>
Signed-off-by: Mete Durlu <mdurlu@redhat.com>
2025-11-07 16:16:05 +01:00
Mete Durlu bd2c46beca smc: Fix lockdep false-positive for IPPROTO_SMC.
JIRA: https://issues.redhat.com/browse/RHEL-99989

commit 752e2217d789be2c6a6ac66554b981cd71cd9f31
Author: Kuniyuki Iwashima <kuniyu@google.com>
Date:   Mon Apr 7 10:03:17 2025 -0700

    smc: Fix lockdep false-positive for IPPROTO_SMC.

    SMC consists of two sockets: smc_sock and kernel TCP socket.

    Currently, there are two ways of creating the sockets, and syzbot reported
    a lockdep splat [0] for the newer way introduced by commit d25a92ccae6b
    ("net/smc: Introduce IPPROTO_SMC").

      socket(AF_SMC             , SOCK_STREAM, SMCPROTO_SMC or SMCPROTO_SMC6)
      socket(AF_INET or AF_INET6, SOCK_STREAM, IPPROTO_SMC)

    When a socket is allocated, sock_lock_init() sets a lockdep lock class to
    sk->sk_lock.slock based on its protocol family.  In the IPPROTO_SMC case,
    AF_INET or AF_INET6 lock class is assigned to smc_sock.

    The repro sets IPV6_JOIN_ANYCAST for IPv6 UDP and SMC socket and exercises
    smc_switch_to_fallback() for IPPROTO_SMC.

      1. smc_switch_to_fallback() is called under lock_sock() and holds
         smc->clcsock_release_lock.

          sk_lock-AF_INET6 -> &smc->clcsock_release_lock
          (sk_lock-AF_SMC)

      2. Setting IPV6_JOIN_ANYCAST to SMC holds smc->clcsock_release_lock
         and calls setsockopt() for the kernel TCP socket, which holds RTNL
         and the kernel socket's lock_sock().

          &smc->clcsock_release_lock -> rtnl_mutex (-> k-sk_lock-AF_INET6)

      3. Setting IPV6_JOIN_ANYCAST to UDP holds RTNL and lock_sock().

          rtnl_mutex -> sk_lock-AF_INET6

    Then, lockdep detects a false-positive circular locking,

      .-> sk_lock-AF_INET6 -> &smc->clcsock_release_lock -> rtnl_mutex -.
      `-----------------------------------------------------------------'

    but IPPROTO_SMC should have the same locking rule as AF_SMC.

          sk_lock-AF_SMC   -> &smc->clcsock_release_lock -> rtnl_mutex -> k-sk_lock-AF_INET6

    Let's set the same lock class for smc_sock.

    Given AF_SMC uses the same lock class for SMCPROTO_SMC and SMCPROTO_SMC6,
    we do not need to separate the class for AF_INET and AF_INET6.

    [0]:
    WARNING: possible circular locking dependency detected
    6.14.0-rc3-syzkaller-00267-gff202c5028a1 #0 Not tainted

    syz.4.1528/11571 is trying to acquire lock:
    ffffffff8fef8de8 (rtnl_mutex){+.+.}-{4:4}, at: ipv6_sock_ac_close+0xd9/0x110 net/ipv6/anycast.c:220

    but task is already holding lock:
    ffff888027f596a8 (&smc->clcsock_release_lock){+.+.}-{4:4}, at: smc_clcsock_release+0x75/0xe0 net/smc/smc_close.c:30

    which lock already depends on the new lock.

    the existing dependency chain (in reverse order) is:

     -> #2 (&smc->clcsock_release_lock){+.+.}-{4:4}:
           __mutex_lock_common kernel/locking/mutex.c:585 [inline]
           __mutex_lock+0x19b/0xb10 kernel/locking/mutex.c:730
           smc_switch_to_fallback+0x2d/0xa00 net/smc/af_smc.c:903
           smc_sendmsg+0x13d/0x520 net/smc/af_smc.c:2781
           sock_sendmsg_nosec net/socket.c:718 [inline]
           __sock_sendmsg net/socket.c:733 [inline]
           ____sys_sendmsg+0xaaf/0xc90 net/socket.c:2573
           ___sys_sendmsg+0x135/0x1e0 net/socket.c:2627
           __sys_sendmsg+0x16e/0x220 net/socket.c:2659
           do_syscall_x64 arch/x86/entry/common.c:52 [inline]
           do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
           entry_SYSCALL_64_after_hwframe+0x77/0x7f

     -> #1 (sk_lock-AF_INET6){+.+.}-{0:0}:
           lock_sock_nested+0x3a/0xf0 net/core/sock.c:3645
           lock_sock include/net/sock.h:1624 [inline]
           sockopt_lock_sock net/core/sock.c:1133 [inline]
           sockopt_lock_sock+0x54/0x70 net/core/sock.c:1124
           do_ipv6_setsockopt+0x2160/0x4520 net/ipv6/ipv6_sockglue.c:567
           ipv6_setsockopt+0xcb/0x170 net/ipv6/ipv6_sockglue.c:993
           udpv6_setsockopt+0x7d/0xd0 net/ipv6/udp.c:1850
           do_sock_setsockopt+0x222/0x480 net/socket.c:2303
           __sys_setsockopt+0x1a0/0x230 net/socket.c:2328
           __do_sys_setsockopt net/socket.c:2334 [inline]
           __se_sys_setsockopt net/socket.c:2331 [inline]
           __x64_sys_setsockopt+0xbd/0x160 net/socket.c:2331
           do_syscall_x64 arch/x86/entry/common.c:52 [inline]
           do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
           entry_SYSCALL_64_after_hwframe+0x77/0x7f

     -> #0 (rtnl_mutex){+.+.}-{4:4}:
           check_prev_add kernel/locking/lockdep.c:3163 [inline]
           check_prevs_add kernel/locking/lockdep.c:3282 [inline]
           validate_chain kernel/locking/lockdep.c:3906 [inline]
           __lock_acquire+0x249e/0x3c40 kernel/locking/lockdep.c:5228
           lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5851
           __mutex_lock_common kernel/locking/mutex.c:585 [inline]
           __mutex_lock+0x19b/0xb10 kernel/locking/mutex.c:730
           ipv6_sock_ac_close+0xd9/0x110 net/ipv6/anycast.c:220
           inet6_release+0x47/0x70 net/ipv6/af_inet6.c:485
           __sock_release net/socket.c:647 [inline]
           sock_release+0x8e/0x1d0 net/socket.c:675
           smc_clcsock_release+0xb7/0xe0 net/smc/smc_close.c:34
           __smc_release+0x5c2/0x880 net/smc/af_smc.c:301
           smc_release+0x1fc/0x5f0 net/smc/af_smc.c:344
           __sock_release+0xb0/0x270 net/socket.c:647
           sock_close+0x1c/0x30 net/socket.c:1398
           __fput+0x3ff/0xb70 fs/file_table.c:464
           task_work_run+0x14e/0x250 kernel/task_work.c:227
           resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
           exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
           exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
           __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
           syscall_exit_to_user_mode+0x27b/0x2a0 kernel/entry/common.c:218
           do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89
           entry_SYSCALL_64_after_hwframe+0x77/0x7f

    other info that might help us debug this:

    Chain exists of:
      rtnl_mutex --> sk_lock-AF_INET6 --> &smc->clcsock_release_lock

     Possible unsafe locking scenario:

           CPU0                    CPU1
           ----                    ----
      lock(&smc->clcsock_release_lock);
                                   lock(sk_lock-AF_INET6);
                                   lock(&smc->clcsock_release_lock);
      lock(rtnl_mutex);

     *** DEADLOCK ***

    2 locks held by syz.4.1528/11571:
     #0: ffff888077e88208 (&sb->s_type->i_mutex_key#10){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:877 [inline]
     #0: ffff888077e88208 (&sb->s_type->i_mutex_key#10){+.+.}-{4:4}, at: __sock_release+0x86/0x270 net/socket.c:646
     #1: ffff888027f596a8 (&smc->clcsock_release_lock){+.+.}-{4:4}, at: smc_clcsock_release+0x75/0xe0 net/smc/smc_close.c:30

    stack backtrace:
    CPU: 0 UID: 0 PID: 11571 Comm: syz.4.1528 Not tainted 6.14.0-rc3-syzkaller-00267-gff202c5028a1 #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
    Call Trace:
     <TASK>
     __dump_stack lib/dump_stack.c:94 [inline]
     dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
     print_circular_bug+0x490/0x760 kernel/locking/lockdep.c:2076
     check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2208
     check_prev_add kernel/locking/lockdep.c:3163 [inline]
     check_prevs_add kernel/locking/lockdep.c:3282 [inline]
     validate_chain kernel/locking/lockdep.c:3906 [inline]
     __lock_acquire+0x249e/0x3c40 kernel/locking/lockdep.c:5228
     lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5851
     __mutex_lock_common kernel/locking/mutex.c:585 [inline]
     __mutex_lock+0x19b/0xb10 kernel/locking/mutex.c:730
     ipv6_sock_ac_close+0xd9/0x110 net/ipv6/anycast.c:220
     inet6_release+0x47/0x70 net/ipv6/af_inet6.c:485
     __sock_release net/socket.c:647 [inline]
     sock_release+0x8e/0x1d0 net/socket.c:675
     smc_clcsock_release+0xb7/0xe0 net/smc/smc_close.c:34
     __smc_release+0x5c2/0x880 net/smc/af_smc.c:301
     smc_release+0x1fc/0x5f0 net/smc/af_smc.c:344
     __sock_release+0xb0/0x270 net/socket.c:647
     sock_close+0x1c/0x30 net/socket.c:1398
     __fput+0x3ff/0xb70 fs/file_table.c:464
     task_work_run+0x14e/0x250 kernel/task_work.c:227
     resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
     exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
     exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
     __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
     syscall_exit_to_user_mode+0x27b/0x2a0 kernel/entry/common.c:218
     do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
    RIP: 0033:0x7f8b4b38d169
    Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
    RSP: 002b:00007ffe4efd22d8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
    RAX: 0000000000000000 RBX: 00000000000b14a3 RCX: 00007f8b4b38d169
    RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
    RBP: 00007f8b4b5a7ba0 R08: 0000000000000001 R09: 000000114efd25cf
    R10: 00007f8b4b200000 R11: 0000000000000246 R12: 00007f8b4b5a5fac
    R13: 00007f8b4b5a5fa0 R14: ffffffffffffffff R15: 00007ffe4efd23f0
     </TASK>

    Fixes: d25a92ccae6b ("net/smc: Introduce IPPROTO_SMC")
    Reported-by: syzbot+be6f4b383534d88989f7@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=be6f4b383534d88989f7
    Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
    Reviewed-by: Wenjia Zhang <wenjia@linux.ibm.com>
    Link: https://patch.msgid.link/20250407170332.26959-1-kuniyu@amazon.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Mahanta Jambigi <mjambigi@linux.ibm.com>
Signed-off-by: Mete Durlu <mdurlu@redhat.com>
2025-11-07 16:16:04 +01:00
Mete Durlu b0b4e2c702 net/smc: use the correct ndev to find pnetid by pnetid table
JIRA: https://issues.redhat.com/browse/RHEL-99989

commit bfc6c67ec2d64d0ca4e5cc3e1ac84298a10b8d62
Author: Guangguan Wang <guangguan.wang@linux.alibaba.com>
Date:   Tue Mar 4 20:43:04 2025 +0800

    net/smc: use the correct ndev to find pnetid by pnetid table

    When using smc_pnet in SMC, it will only search the pnetid in the
    base_ndev of the netdev hierarchy(both HW PNETID and User-defined
    sw pnetid). This may not work for some scenarios when using SMC in
    container on cloud environment.
    In container, there have choices of different container network,
    such as directly using host network, virtual network IPVLAN, veth,
    etc. Different choices of container network have different netdev
    hierarchy. Examples of netdev hierarchy show below. (eth0 and eth1
    in host below is the netdev directly related to the physical device).
                _______________________________
               |   _________________           |
               |  |POD              |          |
               |  |                 |          |
               |  | eth0_________   |          |
               |  |____|         |__|          |
               |       |         |             |
               |       |         |             |
               |   eth1|base_ndev| eth0_______ |
               |       |         |    | RDMA  ||
               | host  |_________|    |_______||
               ---------------------------------
         netdev hierarchy if directly using host network
               ________________________________
               |   _________________           |
               |  |POD  __________  |          |
               |  |    |upper_ndev| |          |
               |  |eth0|__________| |          |
               |  |_______|_________|          |
               |          |lower netdev        |
               |        __|______              |
               |   eth1|         | eth0_______ |
               |       |base_ndev|    | RDMA  ||
               | host  |_________|    |_______||
               ---------------------------------
                netdev hierarchy if using IPVLAN
                _______________________________
               |   _____________________       |
               |  |POD        _________ |      |
               |  |          |base_ndev||      |
               |  |eth0(veth)|_________||      |
               |  |____________|________|      |
               |               |pairs          |
               |        _______|_              |
               |       |         | eth0_______ |
               |   veth|base_ndev|    | RDMA  ||
               |       |_________|    |_______||
               |        _________              |
               |   eth1|base_ndev|             |
               | host  |_________|             |
               ---------------------------------
                 netdev hierarchy if using veth
    Due to some reasons, the eth1 in host is not RDMA attached netdevice,
    pnetid is needed to map the eth1(in host) with RDMA device so that POD
    can do SMC-R. Because the eth1(in host) is managed by CNI plugin(such
    as Terway, network management plugin in container environment), and in
    cloud environment the eth(in host) can dynamically be inserted by CNI
    when POD create and dynamically be removed by CNI when POD destroy and
    no POD related to the eth(in host) anymore. It is hard to config the
    pnetid to the eth1(in host). But it is easy to config the pnetid to the
    netdevice which can be seen in POD. When do SMC-R, both the container
    directly using host network and the container using veth network can
    successfully match the RDMA device, because the configured pnetid netdev
    is a base_ndev. But the container using IPVLAN can not successfully
    match the RDMA device and 0x03030000 fallback happens, because the
    configured pnetid netdev is not a base_ndev. Additionally, if config
    pnetid to the eth1(in host) also can not work for matching RDMA device
    when using veth network and doing SMC-R in POD.

    To resolve the problems list above, this patch extends to search user
    -defined sw pnetid in the clc handshake ndev when no pnetid can be found
    in the base_ndev, and the base_ndev take precedence over ndev for backward
    compatibility. This patch also can unify the pnetid setup of different
    network choices list above in container(Config user-defined sw pnetid in
    the netdevice can be seen in POD).

    Signed-off-by: Guangguan Wang <guangguan.wang@linux.alibaba.com>
    Reviewed-by: Wenjia Zhang <wenjia@linux.ibm.com>
    Reviewed-by: Halil Pasic <pasic@linux.ibm.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Mahanta Jambigi <mjambigi@linux.ibm.com>
Signed-off-by: Mete Durlu <mdurlu@redhat.com>
2025-11-07 16:16:03 +01:00
Mete Durlu 58325d8a61 net/smc: fix data error when recvmsg with MSG_PEEK flag
JIRA: https://issues.redhat.com/browse/RHEL-99989

commit a4b6539038c1aa1ae871aacf6e41b566c3613993
Author: Guangguan Wang <guangguan.wang@linux.alibaba.com>
Date:   Sat Jan 4 22:32:01 2025 +0800

    net/smc: fix data error when recvmsg with MSG_PEEK flag

    When recvmsg with MSG_PEEK flag, the data will be copied to
    user's buffer without advancing consume cursor and without
    reducing the length of rx available data. Once the expected
    peek length is larger than the value of bytes_to_rcv, in the
    loop of do while in smc_rx_recvmsg, the first loop will copy
    bytes_to_rcv bytes of data from the position local_tx_ctrl.cons,
    the second loop will copy the min(bytes_to_rcv, read_remaining)
    bytes from the position local_tx_ctrl.cons again because of the
    lacking of process with advancing consume cursor and reducing
    the length of available data. So do the subsequent loops. The
    data copied in the second loop and the subsequent loops will
    result in data error, as it should not be copied if no more data
    arrives and it should be copied from the position advancing
    bytes_to_rcv bytes from the local_tx_ctrl.cons if more data arrives.

    This issue can be reproduce by the following python script:
    server.py:
    import socket
    import time
    server_ip = '0.0.0.0'
    server_port = 12346
    server_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    server_socket.bind((server_ip, server_port))
    server_socket.listen(1)
    print('Server is running and listening for connections...')
    conn, addr = server_socket.accept()
    print('Connected by', addr)
    while True:
        data = conn.recv(1024)
        if not data:
            break
        print('Received request:', data.decode())
        conn.sendall(b'Hello, client!\n')
        time.sleep(5)
        conn.sendall(b'Hello, again!\n')
    conn.close()

    client.py:
    import socket
    server_ip = '<server ip>'
    server_port = 12346
    resp=b'Hello, client!\nHello, again!\n'
    client_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    client_socket.connect((server_ip, server_port))
    request = 'Hello, server!'
    client_socket.sendall(request.encode())
    peek_data = client_socket.recv(len(resp),
        socket.MSG_PEEK | socket.MSG_WAITALL)
    print('Peeked data:', peek_data.decode())
    client_socket.close()

    Fixes: 952310ccf2 ("smc: receive data from RMBE")
    Reported-by: D. Wythe <alibuda@linux.alibaba.com>
    Signed-off-by: Guangguan Wang <guangguan.wang@linux.alibaba.com>
    Link: https://patch.msgid.link/20250104143201.35529-1-guangguan.wang@linux.alibaba.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Mahanta Jambigi <mjambigi@linux.ibm.com>
Signed-off-by: Mete Durlu <mdurlu@redhat.com>
2025-11-07 16:15:48 +01:00
Mete Durlu 6c1ea19863 net/smc: delete pointless divide by one
JIRA: https://issues.redhat.com/browse/RHEL-99989

commit 10bc9761d12e440656062ef78cd889bbfa827dcf
Author: Dan Carpenter <dan.carpenter@linaro.org>
Date:   Wed Jan 8 12:26:06 2025 +0300

    net/smc: delete pointless divide by one

    Here "buf" is a void pointer so sizeof(*buf) is one.  Doing a divide
    by one makes the code less readable.  Delete it.

    Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
    Link: https://patch.msgid.link/ee1a790b-f874-4512-b3ae-9c45f99dc640@stanley.mountain
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Mahanta Jambigi <mjambigi@linux.ibm.com>
Signed-off-by: Mete Durlu <mdurlu@redhat.com>
2025-11-07 16:15:45 +01:00
Mete Durlu a5ddf5a6bd net/smc: support SMC-R V2 for rdma devices with max_recv_sge equals to 1
JIRA: https://issues.redhat.com/browse/RHEL-99989

commit 27ef6a9981fe74191849966a6d5e0400a4008ab8
Author: Guangguan Wang <guangguan.wang@linux.alibaba.com>
Date:   Wed Dec 11 10:30:54 2024 +0800

    net/smc: support SMC-R V2 for rdma devices with max_recv_sge equals to 1

    For SMC-R V2, llc msg can be larger than SMC_WR_BUF_SIZE, thus every
    recv wr has 2 sges, the first sge with length SMC_WR_BUF_SIZE is for
    V1/V2 compatible llc/cdc msg, and the second sge with length
    SMC_WR_BUF_V2_SIZE-SMC_WR_TX_SIZE is for V2 specific llc msg, like
    SMC_LLC_DELETE_RKEY and SMC_LLC_ADD_LINK for SMC-R V2. The memory
    buffer in the second sge is shared by all recv wr in one link and
    all link in one lgr for saving memory usage purpose.

    But not all RDMA devices with max_recv_sge greater than 1. Thus SMC-R
    V2 can not support on such RDMA devices and SMC_CLC_DECL_INTERR fallback
    happens because of the failure of create qp.

    This patch introduce the support for SMC-R V2 on RDMA devices with
    max_recv_sge equals to 1. Every recv wr has only one sge with individual
    buffer whose size is SMC_WR_BUF_V2_SIZE once the RDMA device's max_recv_sge
    equals to 1. It may use more memory, but it is better than
    SMC_CLC_DECL_INTERR fallback.

    Co-developed-by: Wen Gu <guwen@linux.alibaba.com>
    Signed-off-by: Wen Gu <guwen@linux.alibaba.com>
    Signed-off-by: Guangguan Wang <guangguan.wang@linux.alibaba.com>
    Reviewed-by: Wenjia Zhang <wenjia@linux.ibm.com>
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>

Signed-off-by: Mahanta Jambigi <mjambigi@linux.ibm.com>
Signed-off-by: Mete Durlu <mdurlu@redhat.com>
2025-11-07 16:15:41 +01:00
Mete Durlu b3ef0f0f3e net/smc: fix LGR and link use-after-free issue
JIRA: https://issues.redhat.com/browse/RHEL-99989

commit 2c7f14ed9c19ec0f149479d1c2842ec1f9bf76d7
Author: Wen Gu <guwen@linux.alibaba.com>
Date:   Wed Nov 27 21:30:14 2024 +0800

    net/smc: fix LGR and link use-after-free issue

    We encountered a LGR/link use-after-free issue, which manifested as
    the LGR/link refcnt reaching 0 early and entering the clear process,
    making resource access unsafe.

     refcount_t: addition on 0; use-after-free.
     WARNING: CPU: 14 PID: 107447 at lib/refcount.c:25 refcount_warn_saturate+0x9c/0x140
     Workqueue: events smc_lgr_terminate_work [smc]
     Call trace:
      refcount_warn_saturate+0x9c/0x140
      __smc_lgr_terminate.part.45+0x2a8/0x370 [smc]
      smc_lgr_terminate_work+0x28/0x30 [smc]
      process_one_work+0x1b8/0x420
      worker_thread+0x158/0x510
      kthread+0x114/0x118

    or

     refcount_t: underflow; use-after-free.
     WARNING: CPU: 6 PID: 93140 at lib/refcount.c:28 refcount_warn_saturate+0xf0/0x140
     Workqueue: smc_hs_wq smc_listen_work [smc]
     Call trace:
      refcount_warn_saturate+0xf0/0x140
      smcr_link_put+0x1cc/0x1d8 [smc]
      smc_conn_free+0x110/0x1b0 [smc]
      smc_conn_abort+0x50/0x60 [smc]
      smc_listen_find_device+0x75c/0x790 [smc]
      smc_listen_work+0x368/0x8a0 [smc]
      process_one_work+0x1b8/0x420
      worker_thread+0x158/0x510
      kthread+0x114/0x118

    It is caused by repeated release of LGR/link refcnt. One suspect is that
    smc_conn_free() is called repeatedly because some smc_conn_free() from
    server listening path are not protected by sock lock.

    e.g.

    Calls under socklock        | smc_listen_work
    -------------------------------------------------------
    lock_sock(sk)               | smc_conn_abort
    smc_conn_free               | \- smc_conn_free
    \- smcr_link_put            |    \- smcr_link_put (duplicated)
    release_sock(sk)

    So here add sock lock protection in smc_listen_work() path, making it
    exclusive with other connection operations.

    Fixes: 3b2dec2603 ("net/smc: restructure client and server code in af_smc")
    Co-developed-by: Guangguan Wang <guangguan.wang@linux.alibaba.com>
    Signed-off-by: Guangguan Wang <guangguan.wang@linux.alibaba.com>
    Co-developed-by: Kai <KaiShen@linux.alibaba.com>
    Signed-off-by: Kai <KaiShen@linux.alibaba.com>
    Signed-off-by: Wen Gu <guwen@linux.alibaba.com>
    Reviewed-by: Wenjia Zhang <wenjia@linux.ibm.com>
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>

Signed-off-by: Mahanta Jambigi <mjambigi@linux.ibm.com>
Signed-off-by: Mete Durlu <mdurlu@redhat.com>
2025-11-07 16:15:35 +01:00
Mete Durlu 59306a170f net/smc: initialize close_work early to avoid warning
JIRA: https://issues.redhat.com/browse/RHEL-99989

commit 0541db8ee32c09463a72d0987382b3a3336b0043
Author: Wen Gu <guwen@linux.alibaba.com>
Date:   Wed Nov 27 21:30:13 2024 +0800

    net/smc: initialize close_work early to avoid warning

    We encountered a warning that close_work was canceled before
    initialization.

      WARNING: CPU: 7 PID: 111103 at kernel/workqueue.c:3047 __flush_work+0x19e/0x1b0
      Workqueue: events smc_lgr_terminate_work [smc]
      RIP: 0010:__flush_work+0x19e/0x1b0
      Call Trace:
       ? __wake_up_common+0x7a/0x190
       ? work_busy+0x80/0x80
       __cancel_work_timer+0xe3/0x160
       smc_close_cancel_work+0x1a/0x70 [smc]
       smc_close_active_abort+0x207/0x360 [smc]
       __smc_lgr_terminate.part.38+0xc8/0x180 [smc]
       process_one_work+0x19e/0x340
       worker_thread+0x30/0x370
       ? process_one_work+0x340/0x340
       kthread+0x117/0x130
       ? __kthread_cancel_work+0x50/0x50
       ret_from_fork+0x22/0x30

    This is because when smc_close_cancel_work is triggered, e.g. the RDMA
    driver is rmmod and the LGR is terminated, the conn->close_work is
    flushed before initialization, resulting in WARN_ON(!work->func).

    __smc_lgr_terminate             | smc_connect_{rdma|ism}
    -------------------------------------------------------------
                                    | smc_conn_create
                                    | \- smc_lgr_register_conn
    for conn in lgr->conns_all      |
    \- smc_conn_kill                |
       \- smc_close_active_abort    |
          \- smc_close_cancel_work  |
             \- cancel_work_sync    |
                \- __flush_work     |
                     (close_work)   |
                                    | smc_close_init
                                    | \- INIT_WORK(&close_work)

    So fix this by initializing close_work before establishing the
    connection.

    Fixes: 46c28dbd4c ("net/smc: no socket state changes in tasklet context")
    Fixes: 413498440e ("net/smc: add SMC-D support in af_smc")
    Signed-off-by: Wen Gu <guwen@linux.alibaba.com>
    Reviewed-by: Wenjia Zhang <wenjia@linux.ibm.com>
    Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>

Signed-off-by: Mahanta Jambigi <mjambigi@linux.ibm.com>
Signed-off-by: Mete Durlu <mdurlu@redhat.com>
2025-11-07 16:15:34 +01:00
Mete Durlu e234ef692c net/smc: do not leave a dangling sk pointer in __smc_create()
JIRA: https://issues.redhat.com/browse/RHEL-99989

commit d293958a8595ba566fb90b99da4d6263e14fee15
Author: Eric Dumazet <edumazet@google.com>
Date:   Wed Nov 6 22:19:22 2024 +0000

    net/smc: do not leave a dangling sk pointer in __smc_create()

    Thanks to commit 4bbd360a5084 ("socket: Print pf->create() when
    it does not clear sock->sk on failure."), syzbot found an issue with AF_SMC:

    smc_create must clear sock->sk on failure, family: 43, type: 1, protocol: 0
     WARNING: CPU: 0 PID: 5827 at net/socket.c:1565 __sock_create+0x96f/0xa30 net/socket.c:1563
    Modules linked in:
    CPU: 0 UID: 0 PID: 5827 Comm: syz-executor259 Not tainted 6.12.0-rc6-next-20241106-syzkaller #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
     RIP: 0010:__sock_create+0x96f/0xa30 net/socket.c:1563
    Code: 03 00 74 08 4c 89 e7 e8 4f 3b 85 f8 49 8b 34 24 48 c7 c7 40 89 0c 8d 8b 54 24 04 8b 4c 24 0c 44 8b 44 24 08 e8 32 78 db f7 90 <0f> 0b 90 90 e9 d3 fd ff ff 89 e9 80 e1 07 fe c1 38 c1 0f 8c ee f7
    RSP: 0018:ffffc90003e4fda0 EFLAGS: 00010246
    RAX: 099c6f938c7f4700 RBX: 1ffffffff1a595fd RCX: ffff888034823c00
    RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
    RBP: 00000000ffffffe9 R08: ffffffff81567052 R09: 1ffff920007c9f50
    R10: dffffc0000000000 R11: fffff520007c9f51 R12: ffffffff8d2cafe8
    R13: 1ffffffff1a595fe R14: ffffffff9a789c40 R15: ffff8880764298c0
    FS:  000055557b518380(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 00007fa62ff43225 CR3: 0000000031628000 CR4: 00000000003526f0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
    Call Trace:
     <TASK>
      sock_create net/socket.c:1616 [inline]
      __sys_socket_create net/socket.c:1653 [inline]
      __sys_socket+0x150/0x3c0 net/socket.c:1700
      __do_sys_socket net/socket.c:1714 [inline]
      __se_sys_socket net/socket.c:1712 [inline]

    For reference, see commit 2d859aff775d ("Merge branch
    'do-not-leave-dangling-sk-pointers-in-pf-create-functions'")

    Fixes: d25a92ccae6b ("net/smc: Introduce IPPROTO_SMC")
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Cc: Ignat Korchagin <ignat@cloudflare.com>
    Cc: D. Wythe <alibuda@linux.alibaba.com>
    Cc: Dust Li <dust.li@linux.alibaba.com>
    Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
    Reviewed-by: Wenjia Zhang <wenjia@linux.ibm.com>
    Link: https://patch.msgid.link/20241106221922.1544045-1-edumazet@google.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Mahanta Jambigi <mjambigi@linux.ibm.com>
Signed-off-by: Mete Durlu <mdurlu@redhat.com>
2025-11-07 16:15:32 +01:00
Mete Durlu e32d91807e net/smc: Fix searching in list of known pnetids in smc_pnet_add_pnetid
JIRA: https://issues.redhat.com/browse/RHEL-99989

commit 82ac39ebd6db0c9f7a97a934bda1e3e101a9d201
Author: Li RongQing <lirongqing@baidu.com>
Date:   Mon Oct 14 19:53:21 2024 +0800

    net/smc: Fix searching in list of known pnetids in smc_pnet_add_pnetid

    pnetid of pi (not newly allocated pe) should be compared

    Fixes: e888a2e833 ("net/smc: introduce list of pnetids for Ethernet devices")
    Reviewed-by: D. Wythe <alibuda@linux.alibaba.com>
    Reviewed-by: Wen Gu <guwen@linux.alibaba.com>
    Signed-off-by: Li RongQing <lirongqing@baidu.com>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Reviewed-by: Gerd Bayer <gbayer@linux.ibm.com>
    Link: https://patch.msgid.link/20241014115321.33234-1-lirongqing@baidu.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Mahanta Jambigi <mjambigi@linux.ibm.com>
Signed-off-by: Mete Durlu <mdurlu@redhat.com>
2025-11-07 16:15:31 +01:00
Mete Durlu 03fb0c6247 net/smc: Fix memory leak when using percpu refs
JIRA: https://issues.redhat.com/browse/RHEL-99989

commit 25c12b459db8365fee84b63f3dd7910f70627f29
Author: Kai Shen <KaiShen@linux.alibaba.com>
Date:   Thu Oct 10 11:56:24 2024 +0000

    net/smc: Fix memory leak when using percpu refs

    This patch adds missing percpu_ref_exit when releasing percpu refs.
    When releasing percpu refs, percpu_ref_exit should be called.
    Otherwise, memory leak happens.

    Fixes: 79a22238b4f2 ("net/smc: Use percpu ref for wr tx reference")
    Signed-off-by: Kai Shen <KaiShen@linux.alibaba.com>
    Reviewed-by: Dust Li <dust.li@linux.alibaba.com>
    Reviewed-by: Wenjia Zhang <wenjia@linux.ibm.com>
    Link: https://patch.msgid.link/20241010115624.7769-1-KaiShen@linux.alibaba.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Mahanta Jambigi <mjambigi@linux.ibm.com>
Signed-off-by: Mete Durlu <mdurlu@redhat.com>
2025-11-07 16:15:29 +01:00
Mete Durlu a6bd460b2a net/smc: Address spelling errors
JIRA: https://issues.redhat.com/browse/RHEL-99989

commit cd959bf7c3bbaf64a29750c5e36776078a18a8fe
Author: Simon Horman <horms@kernel.org>
Date:   Wed Oct 9 11:05:21 2024 +0100

    net/smc: Address spelling errors

    Address spelling errors flagged by codespell.

    This patch is intended to cover all files under drivers/smc

    Signed-off-by: Simon Horman <horms@kernel.org>
    Reviewed-by: D. Wythe <alibuda@linux.alibaba.com>
    Reviewed-by: Guangguan Wang <guangguan.wang@linux.alibaba.com>
    Reviewed-by: Randy Dunlap <rdunlap@infradead.org>
    Reviewed-by: Wenjia Zhang <wenjia@linux.ibm.com>
    Link: https://patch.msgid.link/20241009-smc-starspell-v1-1-b8b395bbaf82@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Mahanta Jambigi <mjambigi@linux.ibm.com>
Signed-off-by: Mete Durlu <mdurlu@redhat.com>
2025-11-07 16:15:27 +01:00
Mete Durlu e3b959b6e6 net/smc: fix lacks of icsk_syn_mss with IPPROTO_SMC
JIRA: https://issues.redhat.com/browse/RHEL-99989

commit 6fd27ea183c208e478129a85e11d880fc70040f2
Author: D. Wythe <alibuda@linux.alibaba.com>
Date:   Wed Oct 9 14:55:16 2024 +0800

    net/smc: fix lacks of icsk_syn_mss with IPPROTO_SMC

    Eric report a panic on IPPROTO_SMC, and give the facts
    that when INET_PROTOSW_ICSK was set, icsk->icsk_sync_mss must be set too.

    Bug: Unable to handle kernel NULL pointer dereference at virtual address
    0000000000000000
    Mem abort info:
    ESR = 0x0000000086000005
    EC = 0x21: IABT (current EL), IL = 32 bits
    SET = 0, FnV = 0
    EA = 0, S1PTW = 0
    FSC = 0x05: level 1 translation fault
    user pgtable: 4k pages, 48-bit VAs, pgdp=00000001195d1000
    [0000000000000000] pgd=0800000109c46003, p4d=0800000109c46003,
    pud=0000000000000000
    Internal error: Oops: 0000000086000005 [#1] PREEMPT SMP
    Modules linked in:
    CPU: 1 UID: 0 PID: 8037 Comm: syz.3.265 Not tainted
    6.11.0-rc7-syzkaller-g5f5673607153 #0
    Hardware name: Google Google Compute Engine/Google Compute Engine,
    BIOS Google 08/06/2024
    pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
    pc : 0x0
    lr : cipso_v4_sock_setattr+0x2a8/0x3c0 net/ipv4/cipso_ipv4.c:1910
    sp : ffff80009b887a90
    x29: ffff80009b887aa0 x28: ffff80008db94050 x27: 0000000000000000
    x26: 1fffe0001aa6f5b3 x25: dfff800000000000 x24: ffff0000db75da00
    x23: 0000000000000000 x22: ffff0000d8b78518 x21: 0000000000000000
    x20: ffff0000d537ad80 x19: ffff0000d8b78000 x18: 1fffe000366d79ee
    x17: ffff8000800614a8 x16: ffff800080569b84 x15: 0000000000000001
    x14: 000000008b336894 x13: 00000000cd96feaa x12: 0000000000000003
    x11: 0000000000040000 x10: 00000000000020a3 x9 : 1fffe0001b16f0f1
    x8 : 0000000000000000 x7 : 0000000000000000 x6 : 000000000000003f
    x5 : 0000000000000040 x4 : 0000000000000001 x3 : 0000000000000000
    x2 : 0000000000000002 x1 : 0000000000000000 x0 : ffff0000d8b78000
    Call trace:
    0x0
    netlbl_sock_setattr+0x2e4/0x338 net/netlabel/netlabel_kapi.c:1000
    smack_netlbl_add+0xa4/0x154 security/smack/smack_lsm.c:2593
    smack_socket_post_create+0xa8/0x14c security/smack/smack_lsm.c:2973
    security_socket_post_create+0x94/0xd4 security/security.c:4425
    __sock_create+0x4c8/0x884 net/socket.c:1587
    sock_create net/socket.c:1622 [inline]
    __sys_socket_create net/socket.c:1659 [inline]
    __sys_socket+0x134/0x340 net/socket.c:1706
    __do_sys_socket net/socket.c:1720 [inline]
    __se_sys_socket net/socket.c:1718 [inline]
    __arm64_sys_socket+0x7c/0x94 net/socket.c:1718
    __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
    invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
    el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
    do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
    el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712
    el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730
    el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598
    Code: ???????? ???????? ???????? ???????? (????????)
    ---[ end trace 0000000000000000 ]---

    This patch add a toy implementation that performs a simple return to
    prevent such panic. This is because MSS can be set in sock_create_kern
    or smc_setsockopt, similar to how it's done in AF_SMC. However, for
    AF_SMC, there is currently no way to synchronize MSS within
    __sys_connect_file. This toy implementation lays the groundwork for us
    to support such feature for IPPROTO_SMC in the future.

    Fixes: d25a92ccae6b ("net/smc: Introduce IPPROTO_SMC")
    Reported-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: D. Wythe <alibuda@linux.alibaba.com>
    Reviewed-by: Eric Dumazet <edumazet@google.com>
    Reviewed-by: Wenjia Zhang <wenjia@linux.ibm.com>
    Link: https://patch.msgid.link/1728456916-67035-1-git-send-email-alibuda@linux.alibaba.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Mahanta Jambigi <mjambigi@linux.ibm.com>
Signed-off-by: Mete Durlu <mdurlu@redhat.com>
2025-11-07 16:15:24 +01:00
Mete Durlu debd5dc1ad net/smc: add sysctl for smc_limit_hs
JIRA: https://issues.redhat.com/browse/RHEL-99989
Conflicts: Conflicts due to change in line numbers between 5.14 & 6.17
kernel, no functional changes

commit f8406a2fd279d05eb4a76c9b77cb740b6f350549
Author: D. Wythe <alibuda@linux.alibaba.com>
Date:   Fri Sep 6 10:35:35 2024 +0800

    net/smc: add sysctl for smc_limit_hs

    In commit 48b6190a0042 ("net/smc: Limit SMC visits when handshake workqueue congested"),
    we introduce a mechanism to put constraint on SMC connections visit
    according to the pressure of SMC handshake process.

    At that time, we believed that controlling the feature through netlink
    was sufficient. However, most people have realized now that netlink is
    not convenient in container scenarios, and sysctl is a more suitable
    approach.

    In addition, since commit 462791bbfa35 ("net/smc: add sysctl interface for SMC")
    had introcuded smc_sysctl_net_init(), it is reasonable for us to
    initialize limit_smc_hs in it instead of initializing it in
    smc_pnet_net_int().

    Signed-off-by: D. Wythe <alibuda@linux.alibaba.com>
    Reviewed-by: Wen Gu <guwen@linux.alibaba.com>
    Reviewed-by: Jan Karcher <jaka@linux.ibm.com>
    Link: https://patch.msgid.link/1725590135-5631-1-git-send-email-alibuda@linux.alibaba.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>

Signed-off-by: Mahanta Jambigi <mjambigi@linux.ibm.com>
Signed-off-by: Mete Durlu <mdurlu@redhat.com>
2025-11-07 16:15:22 +01:00
Mete Durlu 1d1ede1e3d net/smc: prevent NULL pointer dereference in txopt_get
JIRA: https://issues.redhat.com/browse/RHEL-99989

commit 98d4435efcbf37801a3246fb53856c4b934a2613
Author: Jeongjun Park <aha310510@gmail.com>
Date:   Thu Aug 29 12:56:48 2024 +0900

    net/smc: prevent NULL pointer dereference in txopt_get

    Since smc_inet6_prot does not initialize ipv6_pinfo_offset, inet6_create()
    copies an incorrect address value, sk + 0 (offset), to inet_sk(sk)->pinet6.

    In addition, since inet_sk(sk)->pinet6 and smc_sk(sk)->clcsock practically
    point to the same address, when smc_create_clcsk() stores the newly
    created clcsock in smc_sk(sk)->clcsock, inet_sk(sk)->pinet6 is corrupted
    into clcsock. This causes NULL pointer dereference and various other
    memory corruptions.

    To solve this problem, you need to initialize ipv6_pinfo_offset, add a
    smc6_sock structure, and then add ipv6_pinfo as the second member of
    the smc_sock structure.

    Reported-by: syzkaller <syzkaller@googlegroups.com>
    Fixes: d25a92ccae6b ("net/smc: Introduce IPPROTO_SMC")
    Signed-off-by: Jeongjun Park <aha310510@gmail.com>
    Reviewed-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Mahanta Jambigi <mjambigi@linux.ibm.com>
Signed-off-by: Mete Durlu <mdurlu@redhat.com>
2025-11-07 16:15:18 +01:00
Mete Durlu 804c18945e net/smc: introduce statistics for ringbufs usage of net namespace
JIRA: https://issues.redhat.com/browse/RHEL-99989

commit e0d103542b06c36240e3887edfe49578464866eb
Author: Wen Gu <guwen@linux.alibaba.com>
Date:   Wed Aug 14 21:08:27 2024 +0800

    net/smc: introduce statistics for ringbufs usage of net namespace

    The buffer size histograms in smc_stats, namely rx/tx_rmbsize, record
    the sizes of ringbufs for all connections that have ever appeared in
    the net namespace. They are incremental and we cannot know the actual
    ringbufs usage from these. So here introduces statistics for current
    ringbufs usage of existing smc connections in the net namespace into
    smc_stats, it will be incremented when new connection uses a ringbuf
    and decremented when the ringbuf is unused.

    Signed-off-by: Wen Gu <guwen@linux.alibaba.com>
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>

Signed-off-by: Mahanta Jambigi <mjambigi@linux.ibm.com>
Signed-off-by: Mete Durlu <mdurlu@redhat.com>
2025-11-07 16:15:16 +01:00