tianshuo han reported a remotely-triggerable crash if the client sends a
kernel RPC server a specially crafted packet. If decoding the RPC reply
fails in such a way that SVC_GARBAGE is returned without setting the
rq_accept_statp pointer, then that pointer can be dereferenced and a
value stored there.
If it's the first time the thread has processed an RPC, then that
pointer will be set to NULL and the kernel will crash. In other cases,
it could create a memory scribble.
The server sunrpc code treats a SVC_GARBAGE return from svc_authenticate
or pg_authenticate as if it should send a GARBAGE_ARGS reply. RFC 5531
says that if authentication fails that the RPC should be rejected
instead with a status of AUTH_ERR.
Handle a SVC_GARBAGE return as an AUTH_ERROR, with a reason of
AUTH_BADCRED instead of returning GARBAGE_ARGS in that case. This
sidesteps the whole problem of touching the rpc_accept_statp pointer in
this situation and avoids the crash.
Cc: stable(a)vger.kernel.org # v6.9+
Fixes: 29cd2927fb91 ("SUNRPC: Fix encoding of accepted but unsuccessful RPC replies")
Reported-by: tianshuo han <hantianshuo233(a)gmail.com>
Signed-off-by: Jeff Layton <jlayton(a)kernel.org>
---
This should be more correct. Unfortunately, I don't know of any
testcases for low-level RPC error handling. That seems like something
that would be nice to do with pynfs or similar though.
---
Changes in v2:
- Fix endianness of rq_accept_statp assignment
- Better describe the way the crash happens and how this fixes it
- point Fixes: tag at correct patch
- add Cc: stable tag
---
net/sunrpc/svc.c | 11 ++---------
1 file changed, 2 insertions(+), 9 deletions(-)
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index 939b6239df8ab6229ce34836d77d3a6b983fbbb7..99050ab1435148ac5d52b697ab1a771b9e948143 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -1375,7 +1375,8 @@ svc_process_common(struct svc_rqst *rqstp)
case SVC_OK:
break;
case SVC_GARBAGE:
- goto err_garbage_args;
+ rqstp->rq_auth_stat = rpc_autherr_badcred;
+ goto err_bad_auth;
case SVC_SYSERR:
goto err_system_err;
case SVC_DENIED:
@@ -1516,14 +1517,6 @@ svc_process_common(struct svc_rqst *rqstp)
*rqstp->rq_accept_statp = rpc_proc_unavail;
goto sendit;
-err_garbage_args:
- svc_printk(rqstp, "failed to decode RPC header\n");
-
- if (serv->sv_stats)
- serv->sv_stats->rpcbadfmt++;
- *rqstp->rq_accept_statp = rpc_garbage_args;
- goto sendit;
-
err_system_err:
if (serv->sv_stats)
serv->sv_stats->rpcbadfmt++;
---
base-commit: 9afe652958c3ee88f24df1e4a97f298afce89407
change-id: 20250617-rpc-6-16-cc7a23e9c961
Best regards,
--
Jeff Layton <jlayton(a)kernel.org>
Hello,
New build issue found on stable-rc/linux-5.4.y:
---
clang: error: assembler command failed with exit code 1 (use -v to
see invocation) in drivers/firmware/qcom_scm-32.o
(scripts/Makefile.build:262) [logspec:kbuild,kbuild.compiler.error]
---
- dashboard: https://d.kernelci.org/i/maestro:e1ce6e2cb61e68ec7bf14991570487d713f77e0a
- giturl: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
- commit HEAD: e2f5a2e75b315706dd2d1d50a4313e5785eb189d
Log excerpt:
=====================================================
CC drivers/firmware/qcom_scm-32.o
CC lib/idr.o
CC drivers/gpu/host1x/debug.o
CC drivers/clk/rockchip/clk-rk3328.o
CC drivers/clk/rockchip/clk-rk3368.o
CC lib/ioremap.o
CC drivers/gpu/drm/drm_probe_helper.o
CC drivers/clk/rockchip/clk-rk3399.o
/tmp/qcom_scm-32-2d4d72.s: Assembler messages:
/tmp/qcom_scm-32-2d4d72.s:56: Error: selected processor does not
support `smc #0' in ARM mode
/tmp/qcom_scm-32-2d4d72.s:69: Error: selected processor does not
support `smc #0' in ARM mode
/tmp/qcom_scm-32-2d4d72.s:173: Error: selected processor does not
support `smc #0' in ARM mode
/tmp/qcom_scm-32-2d4d72.s:394: Error: selected processor does not
support `smc #0' in ARM mode
/tmp/qcom_scm-32-2d4d72.s:545: Error: selected processor does not
support `smc #0' in ARM mode
/tmp/qcom_scm-32-2d4d72.s:930: Error: selected processor does not
support `smc #0' in ARM mode
/tmp/qcom_scm-32-2d4d72.s:1070: Error: selected processor does not
support `smc #0' in ARM mode
/tmp/qcom_scm-32-2d4d72.s:1117: Error: selected processor does not
support `smc #0' in ARM mode
clang: error: assembler command failed with exit code 1 (use -v to see
invocation)
=====================================================
# Builds where the incident occurred:
## defconfig+allmodconfig+CONFIG_FRAME_WARN=2048 on (arm):
- compiler: clang-17
- dashboard: https://d.kernelci.org/build/maestro:685191885c2cf25042b9bb39
## multi_v7_defconfig on (arm):
- compiler: clang-17
- dashboard: https://d.kernelci.org/build/maestro:685191845c2cf25042b9bb35
#kernelci issue maestro:e1ce6e2cb61e68ec7bf14991570487d713f77e0a
Reported-by: kernelci.org bot <bot(a)kernelci.org>
--
This is an experimental report format. Please send feedback in!
Talk to us at kernelci(a)lists.linux.dev
Made with love by the KernelCI team - https://kernelci.org
Hello,
New build issue found on stable-rc/linux-6.1.y:
---
stack frame size (2488) exceeds limit (2048) in
'dml31_ModeSupportAndSystemConfigurationFull'
[-Werror,-Wframe-larger-than] in
drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn31/display_mode_vba_31.o
(drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn31/display_mode_vba_31.c)
[logspec:kbuild,kbuild.compiler.error]
---
- dashboard: https://d.kernelci.org/i/maestro:69fb66ef80a96ff4750a9dacf73be24a7cbe888e
- giturl: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
- commit HEAD: 2c86adab41e98d103953bf8c447202c9147150ab
Log excerpt:
=====================================================
drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn31/display_mode_vba_31.c:3795:6:
error: stack frame size (2488) exceeds limit (2048) in
'dml31_ModeSupportAndSystemConfigurationFull'
[-Werror,-Wframe-larger-than]
3795 | void dml31_ModeSupportAndSystemConfigurationFull(struct
display_mode_lib *mode_lib)
| ^
CC drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn303/dcn303_fpu.o
1 error generated.
CC drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn314/dcn314_fpu.o
=====================================================
# Builds where the incident occurred:
## x86_64_defconfig+kselftest+x86-board on (x86_64):
- compiler: clang-17
- dashboard: https://d.kernelci.org/build/maestro:685193725c2cf25042b9bcc9
#kernelci issue maestro:69fb66ef80a96ff4750a9dacf73be24a7cbe888e
Reported-by: kernelci.org bot <bot(a)kernelci.org>
--
This is an experimental report format. Please send feedback in!
Talk to us at kernelci(a)lists.linux.dev
Made with love by the KernelCI team - https://kernelci.org
Hello,
New build issue found on stable-rc/linux-5.4.y:
---
in drivers/firmware/qcom_scm-32.o (scripts/Makefile.build:262)
[logspec:kbuild,kbuild.compiler]
---
- dashboard: https://d.kernelci.org/i/maestro:04c1ce2921a16b59c7329a6026c59ea7942ef691
- giturl: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
- commit HEAD: e2f5a2e75b315706dd2d1d50a4313e5785eb189d
Log excerpt:
=====================================================
CC drivers/firmware/qcom_scm-32.o
CC drivers/firmware/trusted_foundations.o
CC drivers/clk/qcom/clk-regmap.o
CC drivers/gpio/gpio-pl061.o
CC kernel/resource.o
CC kernel/sysctl.o
/tmp/ccsKkK07.s: Assembler messages:
/tmp/ccsKkK07.s:45: Error: selected processor does not support `smc
#0' in ARM mode
/tmp/ccsKkK07.s:94: Error: selected processor does not support `smc
#0' in ARM mode
/tmp/ccsKkK07.s:160: Error: selected processor does not support `smc
#0' in ARM mode
/tmp/ccsKkK07.s:296: Error: selected processor does not support `smc
#0' in ARM mode
=====================================================
# Builds where the incident occurred:
## multi_v7_defconfig on (arm):
- compiler: gcc-12
- dashboard: https://d.kernelci.org/build/maestro:685191a35c2cf25042b9bb4f
## multi_v7_defconfig+kselftest on (arm):
- compiler: gcc-12
- dashboard: https://d.kernelci.org/build/maestro:685191ab5c2cf25042b9bb56
#kernelci issue maestro:04c1ce2921a16b59c7329a6026c59ea7942ef691
Reported-by: kernelci.org bot <bot(a)kernelci.org>
--
This is an experimental report format. Please send feedback in!
Talk to us at kernelci(a)lists.linux.dev
Made with love by the KernelCI team - https://kernelci.org
Hello,
New build issue found on stable-rc/linux-5.15.y:
---
integer literal is too large to be represented in type 'long',
interpreting as 'unsigned long' per C89; this literal will have type
'long long' in C99 onwards [-Werror,-Wc99-compat] in
drivers/gpu/drm/meson/meson_vclk.o
(drivers/gpu/drm/meson/meson_vclk.c)
[logspec:kbuild,kbuild.compiler.error]
---
- dashboard: https://d.kernelci.org/i/maestro:ae3b0334acd91200d6ced325a381bafac2d46493
- giturl: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
- commit HEAD: d99cd6f3a570e2f93e8f966b8ca772ef3da54fe2
Log excerpt:
=====================================================
drivers/gpu/drm/meson/meson_vclk.c:399:15: error: integer literal is
too large to be represented in type 'long', interpreting as 'unsigned
long' per C89; this literal will have type 'long long' in C99 onwards
[-Werror,-Wc99-compat]
399 | .pll_freq = 2970000000,
| ^
drivers/gpu/drm/meson/meson_vclk.c:411:15: error: integer literal is
too large to be represented in type 'long', interpreting as 'unsigned
long' per C89; this literal will have type 'long long' in C99 onwards
[-Werror,-Wc99-compat]
411 | .pll_freq = 2970000000,
| ^
drivers/gpu/drm/meson/meson_vclk.c:423:15: error: integer literal is
too large to be represented in type 'long', interpreting as 'unsigned
long' per C89; this literal will have type 'long long' in C99 onwards
[-Werror,-Wc99-compat]
423 | .pll_freq = 2970000000,
| ^
drivers/gpu/drm/meson/meson_vclk.c:436:15: error: integer literal is
too large to be represented in type 'long', interpreting as 'unsigned
long' per C89; this literal will have type 'long long' in C99 onwards
[-Werror,-Wc99-compat]
436 | .phy_freq = 2970000000,
| ^
drivers/gpu/drm/meson/meson_vclk.c:460:15: error: integer literal is
too large to be represented in type 'long', interpreting as 'unsigned
long' per C89; this literal will have type 'long long' in C99 onwards
[-Werror,-Wc99-compat]
460 | .phy_freq = 2970000000,
| ^
CC [M] net/dccp/feat.o
drivers/gpu/drm/meson/meson_vclk.c:850:8: error: integer literal is
too large to be represented in type 'long', interpreting as 'unsigned
long' per C89; this literal will have type 'long long' in C99 onwards
[-Werror,-Wc99-compat]
850 | case 2970000000:
| ^
drivers/gpu/drm/meson/meson_vclk.c:868:8: error: integer literal is
too large to be represented in type 'long', interpreting as 'unsigned
long' per C89; this literal will have type 'long long' in C99 onwards
[-Werror,-Wc99-compat]
868 | case 2970000000:
| ^
drivers/gpu/drm/meson/meson_vclk.c:885:8: error: integer literal is
too large to be represented in type 'long', interpreting as 'unsigned
long' per C89; this literal will have type 'long long' in C99 onwards
[-Werror,-Wc99-compat]
885 | case 2970000000:
| ^
8 errors generated.
=====================================================
# Builds where the incident occurred:
## defconfig+allmodconfig+CONFIG_FRAME_WARN=2048 on (arm):
- compiler: clang-17
- dashboard: https://d.kernelci.org/build/maestro:685192b15c2cf25042b9bc2e
#kernelci issue maestro:ae3b0334acd91200d6ced325a381bafac2d46493
Reported-by: kernelci.org bot <bot(a)kernelci.org>
--
This is an experimental report format. Please send feedback in!
Talk to us at kernelci(a)lists.linux.dev
Made with love by the KernelCI team - https://kernelci.org
Since in v6.8-rc1, the of_node symlink under tty devices is
missing. This breaks any udev rules relying on this information.
Link the of_node information in the serial controller device with the
parent defined in the device tree. This will also apply to the serial
device which takes the serial controller as a parent device.
Fixes: b286f4e87e32 ("serial: core: Move tty and serdev to be children of serial core port device")
Cc: stable(a)vger.kernel.org
Signed-off-by: Aidan Stewart <astewart(a)tektelic.com>
---
v1 -> v2:
- v1: https://lore.kernel.org/linux-serial/20250616162154.9057-1-astewart@tekteli…
- Remove IS_ENABLED(CONFIG_OF) check.
---
drivers/tty/serial/serial_base_bus.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/tty/serial/serial_base_bus.c b/drivers/tty/serial/serial_base_bus.c
index 5d1677f1b651..cb3b127b06b6 100644
--- a/drivers/tty/serial/serial_base_bus.c
+++ b/drivers/tty/serial/serial_base_bus.c
@@ -72,6 +72,7 @@ static int serial_base_device_init(struct uart_port *port,
dev->parent = parent_dev;
dev->bus = &serial_base_bus_type;
dev->release = release;
+ device_set_of_node_from_dev(dev, parent_dev);
if (!serial_base_initialized) {
dev_dbg(port->dev, "uart_add_one_port() called before arch_initcall()?\n");
--
2.49.0
The longest length of a symbol (KSYM_NAME_LEN) was increased to 512 in
the reference [1]. Because in Rust symbols can become quite long due to
namespacing introduced by modules, types, traits, generics, etc.
This patch series presents two commits that implement a test to verify
that a symbol with KSYM_NAME_LEN of 512 can be read.
The first commit: To check that symbol length was valid, the commit
implements a kunit test that verifies that a symbol of 512 length can
be read.
The second commit: There was a warning when building with clang because
there was a definition of unlikely from compiler.h in tools/include/linux,
which conflicted with the one in the instruction decoder selftest.
[1] https://lore.kernel.org/lkml/20220802015052.10452-6-ojeda@kernel.org/
---
Nathan Chancellor (1):
x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c
Sergio González Collado (1):
Kunit to check the longest symbol length
arch/x86/tools/insn_decoder_test.c | 5 +-
lib/Kconfig.debug | 9 ++++
lib/Makefile | 2 +
lib/longest_symbol_kunit.c | 82 ++++++++++++++++++++++++++++++
4 files changed, 95 insertions(+), 3 deletions(-)
create mode 100644 lib/longest_symbol_kunit.c
base-commit: ba9210b8c96355a16b78e1b890dce78f284d6f31
--
2.39.2
Since in v6.8-rc1, the of_node symlink under tty devices is
missing. This breaks any udev rules relying on this information.
Link the of_node information in the serial controller device with the
parent defined in the device tree. This will also apply to the serial
device which takes the serial controller as a parent device.
Fixes: b286f4e87e32 ("serial: core: Move tty and serdev to be children of serial core port device")
Cc: stable(a)vger.kernel.org
Signed-off-by: Aidan Stewart <astewart(a)tektelic.com>
---
drivers/tty/serial/serial_base_bus.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/tty/serial/serial_base_bus.c b/drivers/tty/serial/serial_base_bus.c
index 5d1677f1b651..0e4bf7a3e775 100644
--- a/drivers/tty/serial/serial_base_bus.c
+++ b/drivers/tty/serial/serial_base_bus.c
@@ -73,6 +73,10 @@ static int serial_base_device_init(struct uart_port *port,
dev->bus = &serial_base_bus_type;
dev->release = release;
+ if (IS_ENABLED(CONFIG_OF)) {
+ device_set_of_node_from_dev(dev, parent_dev);
+ }
+
if (!serial_base_initialized) {
dev_dbg(port->dev, "uart_add_one_port() called before arch_initcall()?\n");
return -EPROBE_DEFER;
--
2.49.0
The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y
git checkout FETCH_HEAD
git cherry-pick -x f4ecdc352646f7d23f348e5c544dbe3212c94fc8
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2025061708-cameo-caring-38a0@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From f4ecdc352646f7d23f348e5c544dbe3212c94fc8 Mon Sep 17 00:00:00 2001
From: Pawel Laszczak <pawell(a)cadence.com>
Date: Tue, 13 May 2025 05:30:09 +0000
Subject: [PATCH] usb: cdnsp: Fix issue with detecting command completion event
In some cases, there is a small-time gap in which CMD_RING_BUSY can be
cleared by controller but adding command completion event to event ring
will be delayed. As the result driver will return error code.
This behavior has been detected on usbtest driver (test 9) with
configuration including ep1in/ep1out bulk and ep2in/ep2out isoc
endpoint.
Probably this gap occurred because controller was busy with adding some
other events to event ring.
The CMD_RING_BUSY is cleared to '0' when the Command Descriptor has been
executed and not when command completion event has been added to event
ring.
To fix this issue for this test the small delay is sufficient less than
10us) but to make sure the problem doesn't happen again in the future
the patch introduces 10 retries to check with delay about 20us before
returning error code.
Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver")
Cc: stable <stable(a)kernel.org>
Signed-off-by: Pawel Laszczak <pawell(a)cadence.com>
Acked-by: Peter Chen <peter.chen(a)kernel.org>
Link: https://lore.kernel.org/r/PH7PR07MB9538AA45362ACCF1B94EE9B7DD96A@PH7PR07MB9…
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
diff --git a/drivers/usb/cdns3/cdnsp-gadget.c b/drivers/usb/cdns3/cdnsp-gadget.c
index cd1e00daf43f..55f95f41b3b4 100644
--- a/drivers/usb/cdns3/cdnsp-gadget.c
+++ b/drivers/usb/cdns3/cdnsp-gadget.c
@@ -548,6 +548,7 @@ int cdnsp_wait_for_cmd_compl(struct cdnsp_device *pdev)
dma_addr_t cmd_deq_dma;
union cdnsp_trb *event;
u32 cycle_state;
+ u32 retry = 10;
int ret, val;
u64 cmd_dma;
u32 flags;
@@ -579,8 +580,23 @@ int cdnsp_wait_for_cmd_compl(struct cdnsp_device *pdev)
flags = le32_to_cpu(event->event_cmd.flags);
/* Check the owner of the TRB. */
- if ((flags & TRB_CYCLE) != cycle_state)
+ if ((flags & TRB_CYCLE) != cycle_state) {
+ /*
+ * Give some extra time to get chance controller
+ * to finish command before returning error code.
+ * Checking CMD_RING_BUSY is not sufficient because
+ * this bit is cleared to '0' when the Command
+ * Descriptor has been executed by controller
+ * and not when command completion event has
+ * be added to event ring.
+ */
+ if (retry--) {
+ udelay(20);
+ continue;
+ }
+
return -EINVAL;
+ }
cmd_dma = le64_to_cpu(event->event_cmd.cmd_trb);