hurricos/openwrt-mirror
1
0
Fork 0
mirror of git://git.openwrt.org/openwrt/openwrt.git synced 2025-12-07 05:04:00 -05:00
Code Issues Projects Releases Wiki Activity

kernel: bump 6.12 to 6.12.42

Browse Source 
Changelog: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.42

Added backport to fix ipv6 breakage with the 6.12.42 release:
generic/backport-6.12/621-proc-fix-missing-pde_set_flags.patch[1]

All other patches automatically rebased.

1. https://lore.kernel.org/all/20250821105806.1453833-1-wangzijie1@honor.com

Build system: x86/64
Build-tested: flogic/xiaomi_redmi-router-ax6000-ubootmod, ramips/tplink_archer-a6-v3, x86/64-glibc
Run-tested: flogic/xiaomi_redmi-router-ax6000-ubootmod, ramips/tplink_archer-a6-v3, x86/64-glibc (Intel N150)

Signed-off-by: John Audia <therealgraysky@proton.me>
Link: https://github.com/openwrt/openwrt/pull/19618
Signed-off-by: Robert Marko <robimarko@gmail.com>
This commit is contained in:
John Audia 2025-08-15 15:04:26 -04:00 committed by Robert Marko
parent 23b8205fe2
commit ae49895cd2
13 changed files with 147 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
target/linux/ath79/patches-6.12/900-unaligned_access_hacks.patch
View File

@ -578,7 +578,7 @@ SVN-Revision: 35130
goto next_ht;
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -269,7 +269,7 @@ INDIRECT_CALLABLE_SCOPE struct sk_buff *
@@ -271,7 +271,7 @@ INDIRECT_CALLABLE_SCOPE struct sk_buff *
continue;
iph2 = (struct ipv6hdr *)(p->data + off);

6
target/linux/bcm27xx/patches-6.12/950-0196-staging-fbtft-Add-support-for-display-variants.patch
View File

@ -95,7 +95,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
#include <video/mipi_display.h>
@@ -1131,6 +1133,7 @@ static struct fbtft_platform_data *fbtft
@@ -1132,6 +1134,7 @@ static struct fbtft_platform_data *fbtft
* @display: Display properties
* @sdev: SPI device
* @pdev: Platform device
@ -103,7 +103,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
*
* Allocates, initializes and registers a framebuffer
*
@@ -1140,12 +1143,15 @@ static struct fbtft_platform_data *fbtft
@@ -1141,12 +1144,15 @@ static struct fbtft_platform_data *fbtft
*/
int fbtft_probe_common(struct fbtft_display *display,
struct spi_device *sdev,
@ -120,7 +120,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
int ret;
if (sdev)
@@ -1158,6 +1164,14 @@ int fbtft_probe_common(struct fbtft_disp
@@ -1159,6 +1165,14 @@ int fbtft_probe_common(struct fbtft_disp
pdata = fbtft_properties_read(dev);
if (IS_ERR(pdata))
return PTR_ERR(pdata);

4
target/linux/bcm27xx/patches-6.12/950-0330-pps-Compatibility-hack-should-be-X86-specific.patch
View File

@ -22,7 +22,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
--- a/drivers/pps/pps.c
+++ b/drivers/pps/pps.c
@@ -249,12 +249,13 @@ static long pps_cdev_ioctl(struct file *
@@ -254,12 +254,13 @@ static long pps_cdev_ioctl(struct file *
static long pps_cdev_compat_ioctl(struct file *file,
unsigned int cmd, unsigned long arg)
{
@ -38,7 +38,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
struct pps_fdata_compat compat;
struct pps_fdata fdata;
int err;
@@ -289,6 +290,7 @@ static long pps_cdev_compat_ioctl(struct
@@ -296,6 +297,7 @@ static long pps_cdev_compat_ioctl(struct
return copy_to_user(uarg, &compat,
sizeof(struct pps_fdata_compat)) ? -EFAULT : 0;
}

6
target/linux/generic/backport-6.12/612-12-v6.17-net-dsa-b53-fix-unicast-multicast-flooding-on-BCM5325.patch
View File

@ -21,7 +21,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -560,12 +560,24 @@ static void b53_port_set_ucast_flood(str
@@ -564,12 +564,24 @@ static void b53_port_set_ucast_flood(str
{
u16 uc;
@ -52,7 +52,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
}
static void b53_port_set_mcast_flood(struct b53_device *dev, int port,
@@ -573,19 +585,31 @@ static void b53_port_set_mcast_flood(str
@@ -577,19 +589,31 @@ static void b53_port_set_mcast_flood(str
{
u16 mc;
@ -107,7 +107,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
/* PHY Registers */
#define B53_PORT_MII_PAGE(i) (0x10 + (i)) /* Port i MII Registers */
@@ -369,6 +370,18 @@
@@ -372,6 +373,18 @@
#define B53_ARL_SRCH_RSTL(x) (B53_ARL_SRCH_RSTL_0 + ((x) * 0x10))
/*************************************************************************

2
target/linux/generic/backport-6.12/620-v6.15-ppp-use-IFF_NO_QUEUE-in-virtual-interfaces.patch
View File

@ -47,7 +47,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
if (error) {
--- a/drivers/net/ppp/pptp.c
+++ b/drivers/net/ppp/pptp.c
@@ -465,6 +465,7 @@ static int pptp_connect(struct socket *s
@@ -469,6 +469,7 @@ static int pptp_connect(struct socket *s
po->chan.mtu -= PPTP_HEADER_OVERHEAD;
po->chan.hdrlen = 2 + sizeof(struct pptp_gre_header);

121
target/linux/generic/backport-6.12/621-proc-fix-missing-pde_set_flags.patch Normal file
View File

@ -0,0 +1,121 @@
From: wangzijie <wangzijie1@honor.com>
To: <akpm@linux-foundation.org>, <brauner@kernel.org>,
<viro@zeniv.linux.org.uk>, <adobriyan@gmail.com>,
<rick.p.edgecombe@intel.com>, <ast@kernel.org>,
<k.shutemov@gmail.com>, <jirislaby@kernel.org>,
<linux-fsdevel@vger.kernel.org>
Cc: <polynomial-c@gmx.de>, <gregkh@linuxfoundation.org>,
<stable@vger.kernel.org>, <regressions@lists.linux.dev>,
wangzijie <wangzijie1@honor.com>
Subject: [PATCH v3] proc: fix missing pde_set_flags() for net proc files
Date: Thu, 21 Aug 2025 18:58:06 +0800 [thread overview]
Message-ID: <20250821105806.1453833-1-wangzijie1@honor.com> (raw)
To avoid potential UAF issues during module removal races, we use pde_set_flags()
to save proc_ops flags in PDE itself before proc_register(), and then use
pde_has_proc_*() helpers instead of directly dereferencing pde->proc_ops->*.
However, the pde_set_flags() call was missing when creating net related proc files.
This omission caused incorrect behavior which FMODE_LSEEK was being cleared
inappropriately in proc_reg_open() for net proc files. Lars reported it in this link[1].
Fix this by ensuring pde_set_flags() is called when register proc entry, and add
NULL check for proc_ops in pde_set_flags().
[1]: https://lore.kernel.org/all/20250815195616.64497967@chagall.paradoxon.rec/
Fixes: ff7ec8dc1b64 ("proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al")
Cc: stable@vger.kernel.org
Reported-by: Lars Wendler <polynomial-c@gmx.de>
Signed-off-by: wangzijie <wangzijie1@honor.com>
---
v3:
- followed by Christian's suggestion to stash pde->proc_ops in a local const variable
v2:
- followed by Jiri's suggestion to refractor code and reformat commit message
---
fs/proc/generic.c | 38 +++++++++++++++++++++-----------------
1 file changed, 21 insertions(+), 17 deletions(-)
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -362,6 +362,25 @@ static const struct inode_operations pro
.setattr = proc_notify_change,
};
+static void pde_set_flags(struct proc_dir_entry *pde)
+{
+ const struct proc_ops *proc_ops = pde->proc_ops;
+
+ if (!proc_ops)
+ return;
+
+ if (proc_ops->proc_flags & PROC_ENTRY_PERMANENT)
+ pde->flags |= PROC_ENTRY_PERMANENT;
+ if (proc_ops->proc_read_iter)
+ pde->flags |= PROC_ENTRY_proc_read_iter;
+#ifdef CONFIG_COMPAT
+ if (proc_ops->proc_compat_ioctl)
+ pde->flags |= PROC_ENTRY_proc_compat_ioctl;
+#endif
+ if (proc_ops->proc_lseek)
+ pde->flags |= PROC_ENTRY_proc_lseek;
+}
+
/* returns the registered entry, or frees dp and returns NULL on failure */
struct proc_dir_entry *proc_register(struct proc_dir_entry *dir,
struct proc_dir_entry *dp)
@@ -369,6 +388,8 @@ struct proc_dir_entry *proc_register(str
if (proc_alloc_inum(&dp->low_ino))
goto out_free_entry;
+ pde_set_flags(dp);
+
write_lock(&proc_subdir_lock);
dp->parent = dir;
if (pde_subdir_insert(dir, dp) == false) {
@@ -557,20 +578,6 @@ struct proc_dir_entry *proc_create_reg(c
return p;
}
-static void pde_set_flags(struct proc_dir_entry *pde)
-{
- if (pde->proc_ops->proc_flags & PROC_ENTRY_PERMANENT)
- pde->flags |= PROC_ENTRY_PERMANENT;
- if (pde->proc_ops->proc_read_iter)
- pde->flags |= PROC_ENTRY_proc_read_iter;
-#ifdef CONFIG_COMPAT
- if (pde->proc_ops->proc_compat_ioctl)
- pde->flags |= PROC_ENTRY_proc_compat_ioctl;
-#endif
- if (pde->proc_ops->proc_lseek)
- pde->flags |= PROC_ENTRY_proc_lseek;
-}
-
struct proc_dir_entry *proc_create_data(const char *name, umode_t mode,
struct proc_dir_entry *parent,
const struct proc_ops *proc_ops, void *data)
@@ -581,7 +588,6 @@ struct proc_dir_entry *proc_create_data(
if (!p)
return NULL;
p->proc_ops = proc_ops;
- pde_set_flags(p);
return proc_register(parent, p);
}
EXPORT_SYMBOL(proc_create_data);
@@ -632,7 +638,6 @@ struct proc_dir_entry *proc_create_seq_p
p->proc_ops = &proc_seq_ops;
p->seq_ops = ops;
p->state_size = state_size;
- pde_set_flags(p);
return proc_register(parent, p);
}
EXPORT_SYMBOL(proc_create_seq_private);
@@ -663,7 +668,6 @@ struct proc_dir_entry *proc_create_singl
return NULL;
p->proc_ops = &proc_single_ops;
p->single_show = show;
- pde_set_flags(p);
return proc_register(parent, p);
}
EXPORT_SYMBOL(proc_create_single_data);

4
target/linux/generic/hack-6.12/721-net-add-packet-mangeling.patch
View File

@ -52,7 +52,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
*/
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -3213,6 +3213,10 @@ static inline int pskb_trim(struct sk_bu
@@ -3236,6 +3236,10 @@ static inline int pskb_trim(struct sk_bu
return (len < skb->len) ? __pskb_trim(skb, len) : 0;
}
@ -63,7 +63,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
/**
* pskb_trim_unique - remove end from a paged unique (not cloned) buffer
* @skb: buffer to alter
@@ -3378,16 +3382,6 @@ static inline struct sk_buff *dev_alloc_
@@ -3401,16 +3405,6 @@ static inline struct sk_buff *dev_alloc_
}

4
target/linux/generic/kernel-6.12
View File

@ -1,2 +1,2 @@
LINUX_VERSION-6.12 = .41
LINUX_KERNEL_HASH-6.12.41 = 6b19a3ae99423de2416964d67251d745910277af258b4c4c63e88fd87dbf0e27
LINUX_VERSION-6.12 = .42
LINUX_KERNEL_HASH-6.12.42 = 4804528a29cd20309a0b41c30e5aeffc35fa21ee3358f4a706d4586d003bc1fb

4
target/linux/generic/pending-6.12/650-net-pppoe-implement-GRO-support.patch
View File

@ -230,7 +230,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
{
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -304,6 +304,7 @@ out:
@@ -306,6 +306,7 @@ out:
return pp;
}
@ -238,7 +238,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
static struct sk_buff *sit_ip6ip6_gro_receive(struct list_head *head,
struct sk_buff *skb)
@@ -386,6 +387,7 @@ INDIRECT_CALLABLE_SCOPE int ipv6_gro_com
@@ -388,6 +389,7 @@ INDIRECT_CALLABLE_SCOPE int ipv6_gro_com
out:
return err;
}

2
target/linux/generic/pending-6.12/655-increase_skb_pad.patch
View File

@ -9,7 +9,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -3180,7 +3180,7 @@ static inline int pskb_network_may_pull(
@@ -3203,7 +3203,7 @@ static inline int pskb_network_may_pull(
* NET_IP_ALIGN(2) + ethernet_header(14) + IP_header(20/40) + ports(8)
*/
#ifndef NET_SKB_PAD

14
target/linux/generic/pending-6.12/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch
View File

@ -185,7 +185,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
cfg->fc_flags |= RTF_REJECT;
if (rtm->rtm_type == RTN_LOCAL)
@@ -6349,6 +6380,8 @@ static int ip6_route_dev_notify(struct n
@@ -6357,6 +6388,8 @@ static int ip6_route_dev_notify(struct n
#ifdef CONFIG_IPV6_MULTIPLE_TABLES
net->ipv6.ip6_prohibit_entry->dst.dev = dev;
net->ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(dev);
@ -194,7 +194,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
net->ipv6.ip6_blk_hole_entry->dst.dev = dev;
net->ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(dev);
#endif
@@ -6360,6 +6393,7 @@ static int ip6_route_dev_notify(struct n
@@ -6368,6 +6401,7 @@ static int ip6_route_dev_notify(struct n
in6_dev_put_clear(&net->ipv6.ip6_null_entry->rt6i_idev);
#ifdef CONFIG_IPV6_MULTIPLE_TABLES
in6_dev_put_clear(&net->ipv6.ip6_prohibit_entry->rt6i_idev);
@ -202,7 +202,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
in6_dev_put_clear(&net->ipv6.ip6_blk_hole_entry->rt6i_idev);
#endif
}
@@ -6555,6 +6589,8 @@ static int __net_init ip6_route_net_init
@@ -6563,6 +6597,8 @@ static int __net_init ip6_route_net_init
#ifdef CONFIG_IPV6_MULTIPLE_TABLES
net->ipv6.fib6_has_custom_rules = false;
@ -211,7 +211,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
net->ipv6.ip6_prohibit_entry = kmemdup(&ip6_prohibit_entry_template,
sizeof(*net->ipv6.ip6_prohibit_entry),
GFP_KERNEL);
@@ -6565,11 +6601,21 @@ static int __net_init ip6_route_net_init
@@ -6573,11 +6609,21 @@ static int __net_init ip6_route_net_init
ip6_template_metrics, true);
INIT_LIST_HEAD(&net->ipv6.ip6_prohibit_entry->dst.rt_uncached);
@ -234,7 +234,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
net->ipv6.ip6_blk_hole_entry->dst.ops = &net->ipv6.ip6_dst_ops;
dst_init_metrics(&net->ipv6.ip6_blk_hole_entry->dst,
ip6_template_metrics, true);
@@ -6596,6 +6642,8 @@ out:
@@ -6604,6 +6650,8 @@ out:
return ret;
#ifdef CONFIG_IPV6_MULTIPLE_TABLES
@ -243,7 +243,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
out_ip6_prohibit_entry:
kfree(net->ipv6.ip6_prohibit_entry);
out_ip6_null_entry:
@@ -6615,6 +6663,7 @@ static void __net_exit ip6_route_net_exi
@@ -6623,6 +6671,7 @@ static void __net_exit ip6_route_net_exi
kfree(net->ipv6.ip6_null_entry);
#ifdef CONFIG_IPV6_MULTIPLE_TABLES
kfree(net->ipv6.ip6_prohibit_entry);
@ -251,7 +251,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
kfree(net->ipv6.ip6_blk_hole_entry);
#endif
dst_entries_destroy(&net->ipv6.ip6_dst_ops);
@@ -6698,6 +6747,9 @@ void __init ip6_route_init_special_entri
@@ -6706,6 +6755,9 @@ void __init ip6_route_init_special_entri
init_net.ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
init_net.ipv6.ip6_blk_hole_entry->dst.dev = init_net.loopback_dev;
init_net.ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);

2
target/linux/generic/pending-6.12/701-netfilter-nf_tables-ignore-EOPNOTSUPP-on-flowtable-d.patch
View File

@ -18,7 +18,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -8658,7 +8658,7 @@ static int nft_register_flowtable_net_ho
@@ -8638,7 +8638,7 @@ static int nft_register_flowtable_net_ho
err = flowtable->data.type->setup(&flowtable->data,
hook->ops.dev,
FLOW_BLOCK_BIND);

2
target/linux/ipq40xx/patches-6.12/701-net-dsa-add-out-of-band-tagging-protocol.patch
View File

@ -93,7 +93,7 @@ Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
+#endif
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -4769,6 +4769,9 @@ enum skb_ext_id {
@@ -4792,6 +4792,9 @@ enum skb_ext_id {
#if IS_ENABLED(CONFIG_MCTP_FLOWS)
SKB_EXT_MCTP,
#endif