kernel: bump 6.12 to 6.12.47

All other patches automatically rebased.

Signed-off-by: John Audia <therealgraysky@proton.me>
This commit is contained in:
John Audia 2025-09-10 03:53:23 -04:00
parent ef9c10391d
commit 289f49d119
15 changed files with 38 additions and 159 deletions

View File

@ -1,2 +1,2 @@
LINUX_VERSION-6.12 = .45
LINUX_KERNEL_HASH-6.12.45 = 8f95a8549cfbdfb89c1181a1f55a971f04dfcd629508a2ed70b777ab92f9db3e
LINUX_VERSION-6.12 = .47
LINUX_KERNEL_HASH-6.12.47 = e82fe40871743048226987bd349ef107168b15aab90140e872ca4ed470922e25

View File

@ -32,7 +32,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
#define USB_VENDOR_ID_BELKIN 0x050d
#define USB_DEVICE_ID_FLIP_KVM 0x3201
@@ -1463,6 +1466,9 @@
@@ -1466,6 +1469,9 @@
#define USB_VENDOR_ID_XIAOMI 0x2717
#define USB_DEVICE_ID_MI_SILENT_MOUSE 0x5014
@ -52,7 +52,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
{ HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_MULTI_TOUCH), HID_QUIRK_MULTI_INPUT },
{ HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_PIXART_USB_OPTICAL_MOUSE), HID_QUIRK_ALWAYS_POLL },
{ HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_PIXART_USB_OPTICAL_MOUSE2), HID_QUIRK_ALWAYS_POLL },
@@ -211,6 +212,7 @@ static const struct hid_device_id hid_qu
@@ -213,6 +214,7 @@ static const struct hid_device_id hid_qu
{ HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_QUAD_USB_JOYPAD), HID_QUIRK_NOGET | HID_QUIRK_MULTI_INPUT },
{ HID_USB_DEVICE(USB_VENDOR_ID_XIN_MO, USB_DEVICE_ID_XIN_MO_DUAL_ARCADE), HID_QUIRK_MULTI_INPUT },
{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_GROUP_AUDIO), HID_QUIRK_NOGET },

View File

@ -199,7 +199,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
snprintf(bp->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x",
bp->pdev->name, bp->pdev->id);
bp->mii_bus->priv = bp;
@@ -1641,6 +1658,11 @@ static int macb_rx(struct macb_queue *qu
@@ -1642,6 +1659,11 @@ static int macb_rx(struct macb_queue *qu
macb_init_rx_ring(queue);
queue_writel(queue, RBQP, queue->rx_ring_dma);
@ -211,7 +211,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
macb_writel(bp, NCR, ctrl | MACB_BIT(RE));
@@ -1941,8 +1963,9 @@ static irqreturn_t macb_interrupt(int ir
@@ -1944,8 +1966,9 @@ static irqreturn_t macb_interrupt(int ir
queue_writel(queue, ISR, MACB_BIT(TCOMP) |
MACB_BIT(TXUBR));
@ -222,19 +222,19 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
wmb(); // ensure softirq can see update
}
@@ -2397,6 +2420,11 @@ static netdev_tx_t macb_start_xmit(struc
@@ -2401,6 +2424,11 @@ static netdev_tx_t macb_start_xmit(struc
skb_tx_timestamp(skb);
spin_lock_irq(&bp->lock);
spin_lock(&bp->lock);
+
+ /* TSTART write might get dropped, so make the IRQ retrigger a buffer read */
+ if (macb_readl(bp, TSR) & MACB_BIT(TGO))
+ queue->tx_pending = 1;
+
macb_writel(bp, NCR, macb_readl(bp, NCR) | MACB_BIT(TSTART));
spin_unlock_irq(&bp->lock);
spin_unlock(&bp->lock);
@@ -2803,6 +2831,37 @@ static void macb_configure_dma(struct ma
@@ -2807,6 +2835,37 @@ static void macb_configure_dma(struct ma
}
}
@ -272,7 +272,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
static void macb_init_hw(struct macb *bp)
{
u32 config;
@@ -2831,6 +2890,11 @@ static void macb_init_hw(struct macb *bp
@@ -2835,6 +2894,11 @@ static void macb_init_hw(struct macb *bp
if (bp->caps & MACB_CAPS_JUMBO)
bp->rx_frm_len_mask = MACB_RX_JFRMLEN_MASK;
@ -284,7 +284,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
macb_configure_dma(bp);
/* Enable RX partial store and forward and set watermark */
@@ -3195,6 +3259,52 @@ static void gem_get_ethtool_strings(stru
@@ -3199,6 +3263,52 @@ static void gem_get_ethtool_strings(stru
}
}
@ -337,7 +337,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
static struct net_device_stats *macb_get_stats(struct net_device *dev)
{
struct macb *bp = netdev_priv(dev);
@@ -3779,6 +3889,8 @@ static const struct ethtool_ops macb_eth
@@ -3783,6 +3893,8 @@ static const struct ethtool_ops macb_eth
};
static const struct ethtool_ops gem_ethtool_ops = {
@ -346,7 +346,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
.get_regs_len = macb_get_regs_len,
.get_regs = macb_get_regs,
.get_wol = macb_get_wol,
@@ -3788,6 +3900,8 @@ static const struct ethtool_ops gem_etht
@@ -3792,6 +3904,8 @@ static const struct ethtool_ops gem_etht
.get_ethtool_stats = gem_get_ethtool_stats,
.get_strings = gem_get_ethtool_strings,
.get_sset_count = gem_get_sset_count,
@ -355,7 +355,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
.get_link_ksettings = macb_get_link_ksettings,
.set_link_ksettings = macb_set_link_ksettings,
.get_ringparam = macb_get_ringparam,
@@ -5109,6 +5223,11 @@ static int macb_probe(struct platform_de
@@ -5113,6 +5227,11 @@ static int macb_probe(struct platform_de
}
}
}
@ -367,7 +367,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
spin_lock_init(&bp->lock);
spin_lock_init(&bp->stats_lock);
@@ -5169,6 +5288,21 @@ static int macb_probe(struct platform_de
@@ -5173,6 +5292,21 @@ static int macb_probe(struct platform_de
else
bp->phy_interface = interface;
@ -389,7 +389,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
/* IP specific init */
err = init(pdev);
if (err)
@@ -5243,6 +5377,19 @@ static void macb_remove(struct platform_
@@ -5244,6 +5378,19 @@ static void macb_remove(struct platform_
}
}
@ -409,7 +409,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
static int __maybe_unused macb_suspend(struct device *dev)
{
struct net_device *netdev = dev_get_drvdata(dev);
@@ -5496,6 +5643,7 @@ static const struct dev_pm_ops macb_pm_o
@@ -5497,6 +5644,7 @@ static const struct dev_pm_ops macb_pm_o
static struct platform_driver macb_driver = {
.probe = macb_probe,
.remove_new = macb_remove,

View File

@ -59,7 +59,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
--- a/drivers/pinctrl/Kconfig
+++ b/drivers/pinctrl/Kconfig
@@ -587,6 +587,13 @@ config PINCTRL_MLXBF3
@@ -588,6 +588,13 @@ config PINCTRL_MLXBF3
each pin. This driver can also be built as a module called
pinctrl-mlxbf3.

View File

@ -15,7 +15,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -5072,6 +5072,17 @@ static const struct macb_config versal_c
@@ -5076,6 +5076,17 @@ static const struct macb_config versal_c
.usrio = &macb_default_usrio,
};
@ -33,7 +33,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
static const struct of_device_id macb_dt_ids[] = {
{ .compatible = "cdns,at91sam9260-macb", .data = &at91sam9260_config },
{ .compatible = "cdns,macb" },
@@ -5092,6 +5103,7 @@ static const struct of_device_id macb_dt
@@ -5096,6 +5107,7 @@ static const struct of_device_id macb_dt
{ .compatible = "microchip,mpfs-macb", .data = &mpfs_config },
{ .compatible = "microchip,sama7g5-gem", .data = &sama7g5_gem_config },
{ .compatible = "microchip,sama7g5-emac", .data = &sama7g5_emac_config },

View File

@ -69,7 +69,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
#ifdef __KERNEL__
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -806,6 +806,7 @@ static int pppol2tp_connect(struct socke
@@ -796,6 +796,7 @@ static int pppol2tp_connect(struct socke
po->chan.private = sk;
po->chan.ops = &pppol2tp_chan_ops;
po->chan.mtu = pppol2tp_tunnel_mtu(tunnel);

View File

@ -1,121 +0,0 @@
From: wangzijie <wangzijie1@honor.com>
To: <akpm@linux-foundation.org>, <brauner@kernel.org>,
<viro@zeniv.linux.org.uk>, <adobriyan@gmail.com>,
<rick.p.edgecombe@intel.com>, <ast@kernel.org>,
<k.shutemov@gmail.com>, <jirislaby@kernel.org>,
<linux-fsdevel@vger.kernel.org>
Cc: <polynomial-c@gmx.de>, <gregkh@linuxfoundation.org>,
<stable@vger.kernel.org>, <regressions@lists.linux.dev>,
wangzijie <wangzijie1@honor.com>
Subject: [PATCH v3] proc: fix missing pde_set_flags() for net proc files
Date: Thu, 21 Aug 2025 18:58:06 +0800 [thread overview]
Message-ID: <20250821105806.1453833-1-wangzijie1@honor.com> (raw)
To avoid potential UAF issues during module removal races, we use pde_set_flags()
to save proc_ops flags in PDE itself before proc_register(), and then use
pde_has_proc_*() helpers instead of directly dereferencing pde->proc_ops->*.
However, the pde_set_flags() call was missing when creating net related proc files.
This omission caused incorrect behavior which FMODE_LSEEK was being cleared
inappropriately in proc_reg_open() for net proc files. Lars reported it in this link[1].
Fix this by ensuring pde_set_flags() is called when register proc entry, and add
NULL check for proc_ops in pde_set_flags().
[1]: https://lore.kernel.org/all/20250815195616.64497967@chagall.paradoxon.rec/
Fixes: ff7ec8dc1b64 ("proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al")
Cc: stable@vger.kernel.org
Reported-by: Lars Wendler <polynomial-c@gmx.de>
Signed-off-by: wangzijie <wangzijie1@honor.com>
---
v3:
- followed by Christian's suggestion to stash pde->proc_ops in a local const variable
v2:
- followed by Jiri's suggestion to refractor code and reformat commit message
---
fs/proc/generic.c | 38 +++++++++++++++++++++-----------------
1 file changed, 21 insertions(+), 17 deletions(-)
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -362,6 +362,25 @@ static const struct inode_operations pro
.setattr = proc_notify_change,
};
+static void pde_set_flags(struct proc_dir_entry *pde)
+{
+ const struct proc_ops *proc_ops = pde->proc_ops;
+
+ if (!proc_ops)
+ return;
+
+ if (proc_ops->proc_flags & PROC_ENTRY_PERMANENT)
+ pde->flags |= PROC_ENTRY_PERMANENT;
+ if (proc_ops->proc_read_iter)
+ pde->flags |= PROC_ENTRY_proc_read_iter;
+#ifdef CONFIG_COMPAT
+ if (proc_ops->proc_compat_ioctl)
+ pde->flags |= PROC_ENTRY_proc_compat_ioctl;
+#endif
+ if (proc_ops->proc_lseek)
+ pde->flags |= PROC_ENTRY_proc_lseek;
+}
+
/* returns the registered entry, or frees dp and returns NULL on failure */
struct proc_dir_entry *proc_register(struct proc_dir_entry *dir,
struct proc_dir_entry *dp)
@@ -369,6 +388,8 @@ struct proc_dir_entry *proc_register(str
if (proc_alloc_inum(&dp->low_ino))
goto out_free_entry;
+ pde_set_flags(dp);
+
write_lock(&proc_subdir_lock);
dp->parent = dir;
if (pde_subdir_insert(dir, dp) == false) {
@@ -557,20 +578,6 @@ struct proc_dir_entry *proc_create_reg(c
return p;
}
-static void pde_set_flags(struct proc_dir_entry *pde)
-{
- if (pde->proc_ops->proc_flags & PROC_ENTRY_PERMANENT)
- pde->flags |= PROC_ENTRY_PERMANENT;
- if (pde->proc_ops->proc_read_iter)
- pde->flags |= PROC_ENTRY_proc_read_iter;
-#ifdef CONFIG_COMPAT
- if (pde->proc_ops->proc_compat_ioctl)
- pde->flags |= PROC_ENTRY_proc_compat_ioctl;
-#endif
- if (pde->proc_ops->proc_lseek)
- pde->flags |= PROC_ENTRY_proc_lseek;
-}
-
struct proc_dir_entry *proc_create_data(const char *name, umode_t mode,
struct proc_dir_entry *parent,
const struct proc_ops *proc_ops, void *data)
@@ -581,7 +588,6 @@ struct proc_dir_entry *proc_create_data(
if (!p)
return NULL;
p->proc_ops = proc_ops;
- pde_set_flags(p);
return proc_register(parent, p);
}
EXPORT_SYMBOL(proc_create_data);
@@ -632,7 +638,6 @@ struct proc_dir_entry *proc_create_seq_p
p->proc_ops = &proc_seq_ops;
p->seq_ops = ops;
p->state_size = state_size;
- pde_set_flags(p);
return proc_register(parent, p);
}
EXPORT_SYMBOL(proc_create_seq_private);
@@ -663,7 +668,6 @@ struct proc_dir_entry *proc_create_singl
return NULL;
p->proc_ops = &proc_single_ops;
p->single_show = show;
- pde_set_flags(p);
return proc_register(parent, p);
}
EXPORT_SYMBOL(proc_create_single_data);

View File

@ -502,7 +502,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
{ }
--- a/drivers/net/phy/mscc/mscc_main.c
+++ b/drivers/net/phy/mscc/mscc_main.c
@@ -2712,7 +2712,7 @@ static struct phy_driver vsc85xx_driver[
@@ -2710,7 +2710,7 @@ static struct phy_driver vsc85xx_driver[
module_phy_driver(vsc85xx_driver);

View File

@ -52,7 +52,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
*/
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -3236,6 +3236,10 @@ static inline int pskb_trim(struct sk_bu
@@ -3242,6 +3242,10 @@ static inline int pskb_trim(struct sk_bu
return (len < skb->len) ? __pskb_trim(skb, len) : 0;
}
@ -63,7 +63,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
/**
* pskb_trim_unique - remove end from a paged unique (not cloned) buffer
* @skb: buffer to alter
@@ -3401,16 +3405,6 @@ static inline struct sk_buff *dev_alloc_
@@ -3407,16 +3411,6 @@ static inline struct sk_buff *dev_alloc_
}

View File

@ -149,7 +149,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+device_initcall(blk_notifications_init);
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -1751,4 +1751,12 @@ static inline bool bdev_can_atomic_write
@@ -1753,4 +1753,12 @@ static inline bool bdev_can_atomic_write
#define DEFINE_IO_COMP_BATCH(name) struct io_comp_batch name = { }

View File

@ -9,7 +9,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -3203,7 +3203,7 @@ static inline int pskb_network_may_pull(
@@ -3209,7 +3209,7 @@ static inline int pskb_network_may_pull(
* NET_IP_ALIGN(2) + ethernet_header(14) + IP_header(20/40) + ports(8)
*/
#ifndef NET_SKB_PAD

View File

@ -10,7 +10,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
@@ -5140,6 +5140,8 @@ static int mtk_probe(struct platform_dev
@@ -5148,6 +5148,8 @@ static int mtk_probe(struct platform_dev
dev_err(eth->dev, "failed to allocated dummy device\n");
goto err_unreg_netdev;
}

View File

@ -53,7 +53,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
bool gso = false;
int tx_num;
@@ -1634,6 +1651,18 @@ static netdev_tx_t mtk_start_xmit(struct
@@ -1641,6 +1658,18 @@ static netdev_tx_t mtk_start_xmit(struct
return NETDEV_TX_BUSY;
}
@ -72,7 +72,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
/* TSO: fill MSS info in tcp checksum field */
if (skb_is_gso(skb)) {
if (skb_cow_head(skb, 0)) {
@@ -1649,8 +1678,14 @@ static netdev_tx_t mtk_start_xmit(struct
@@ -1656,8 +1685,14 @@ static netdev_tx_t mtk_start_xmit(struct
}
}

View File

@ -32,7 +32,7 @@ Signed-off-by: George Moussalem <george.moussalem@outlook.com>
static bool mdt_header_valid(const struct firmware *fw)
{
@@ -98,6 +108,56 @@ static ssize_t mdt_load_split_segment(vo
@@ -100,6 +110,56 @@ static ssize_t mdt_load_split_segment(vo
return ret;
}
@ -89,7 +89,7 @@ Signed-off-by: George Moussalem <george.moussalem@outlook.com>
/**
* qcom_mdt_get_size() - acquire size of the memory region needed to load mdt
* @fw: firmware object for the mdt file
@@ -333,7 +393,8 @@ static bool qcom_mdt_bins_are_split(cons
@@ -335,7 +395,8 @@ static bool qcom_mdt_bins_are_split(cons
static int __qcom_mdt_load(struct device *dev, const struct firmware *fw,
const char *fw_name, int pas_id, void *mem_region,
phys_addr_t mem_phys, size_t mem_size,
@ -99,7 +99,7 @@ Signed-off-by: George Moussalem <george.moussalem@outlook.com>
{
const struct elf32_phdr *phdrs;
const struct elf32_phdr *phdr;
@@ -390,6 +451,14 @@ static int __qcom_mdt_load(struct device
@@ -392,6 +453,14 @@ static int __qcom_mdt_load(struct device
if (!mdt_phdr_valid(phdr))
continue;
@ -114,7 +114,7 @@ Signed-off-by: George Moussalem <george.moussalem@outlook.com>
offset = phdr->p_paddr - mem_reloc;
if (offset < 0 || offset + phdr->p_memsz > mem_size) {
dev_err(dev, "segment outside memory range\n");
@@ -407,7 +476,11 @@ static int __qcom_mdt_load(struct device
@@ -409,7 +478,11 @@ static int __qcom_mdt_load(struct device
ptr = mem_region + offset;
@ -127,7 +127,7 @@ Signed-off-by: George Moussalem <george.moussalem@outlook.com>
/* Firmware is large enough to be non-split */
if (phdr->p_offset + phdr->p_filesz > fw->size) {
dev_err(dev, "file %s segment %d would be truncated\n",
@@ -424,7 +497,7 @@ static int __qcom_mdt_load(struct device
@@ -426,7 +499,7 @@ static int __qcom_mdt_load(struct device
break;
}
@ -136,7 +136,7 @@ Signed-off-by: George Moussalem <george.moussalem@outlook.com>
memset(ptr + phdr->p_filesz, 0, phdr->p_memsz - phdr->p_filesz);
}
@@ -459,7 +532,7 @@ int qcom_mdt_load(struct device *dev, co
@@ -461,7 +534,7 @@ int qcom_mdt_load(struct device *dev, co
return ret;
return __qcom_mdt_load(dev, fw, firmware, pas_id, mem_region, mem_phys,
@ -145,7 +145,7 @@ Signed-off-by: George Moussalem <george.moussalem@outlook.com>
}
EXPORT_SYMBOL_GPL(qcom_mdt_load);
@@ -482,9 +555,36 @@ int qcom_mdt_load_no_init(struct device
@@ -484,9 +557,36 @@ int qcom_mdt_load_no_init(struct device
size_t mem_size, phys_addr_t *reloc_base)
{
return __qcom_mdt_load(dev, fw, firmware, pas_id, mem_region, mem_phys,

View File

@ -107,7 +107,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
* @get_rate_matching: Get the supported type of rate matching for a
* particular phy interface. This is used by phy consumers to determine
* whether to advertise lower-speed modes for that interface. It is
@@ -1839,6 +1865,8 @@ int phy_config_aneg(struct phy_device *p
@@ -1840,6 +1866,8 @@ int phy_config_aneg(struct phy_device *p
int _phy_start_aneg(struct phy_device *phydev);
int phy_start_aneg(struct phy_device *phydev);
int phy_aneg_done(struct phy_device *phydev);