[PW_SID:1079116] riscv: Assorted bug fixes#1744
Conversation
The condition checking whether a specific errata needs patching uses logical AND (&&) instead of bitwise AND (&). Since logical AND only checks that both operands are non-zero, this causes all errata patches to be applied whenever any single errata is detected, rather than only applying the matching one. The SiFive errata implementation correctly uses bitwise AND for the same check. Fixes: 0b0ca95 ("riscv: errata: Fix the PAUSE Opcode for MIPS P8700") Signed-off-by: Michael Neuling <mikey@neuling.org> Assisted-by: Cursor:claude-4.6-opus-high-thinking Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
compat_riscv_gpr_set() calls cregs_to_regs() unconditionally, even when user_regset_copyin() fails. Since cregs is an uninitialized stack variable, a copyin failure causes uninitialized stack data to be written into the target task's pt_regs, corrupting its register state and potentially leaking kernel stack contents. Only call cregs_to_regs() when user_regset_copyin() succeeds. Fixes: 4608c15 ("riscv: compat: ptrace: Add compat_arch_ptrace implement") Signed-off-by: Michael Neuling <mikey@neuling.org> Assisted-by: Cursor:claude-4.6-opus-high-thinking Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
find_vm_area() can return NULL if no vm_struct covers the given address. The code immediately dereferences area->addr without a NULL check. While is_vmalloc_or_module_addr() confirms the address falls within the vmalloc/module address range, it does not guarantee the address belongs to an active allocation, so find_vm_area() may still return NULL. Add the missing NULL check. Fixes: 311cd2f ("riscv: Fix set_memory_XX() and set_direct_map_XX() by splitting huge linear mappings") Signed-off-by: Michael Neuling <mikey@neuling.org> Assisted-by: Cursor:claude-4.6-opus-high-thinking Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
huge_pte_offset() can return NULL when any level of the page table walk encounters a non-present entry. Both huge_ptep_set_access_flags() and huge_ptep_set_wrprotect() re-derive ptep via huge_pte_offset() in the napot path but use the result without a NULL check, leading to NULL pointer dereferences in get_clear_contig_flush() and set_pte_at(). Add NULL checks after huge_pte_offset() in both functions. Fixes: 82a1a1f ("riscv: mm: support Svnapot in hugetlb page") Signed-off-by: Michael Neuling <mikey@neuling.org> Assisted-by: Cursor:claude-4.6-opus-high-thinking Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
remove_pte_mapping() reads the PTE via ptep_get() (a READ_ONCE) into a local variable, but then checks pte_present(*ptep) by dereferencing the pointer directly, reading the PTE a second time. If another CPU modifies the PTE between the two reads, pte_present may check a different value than what was captured, and the subsequent pte_page() could derive the wrong page to free. Use the already-captured local pte variable for the pte_present check. Fixes: c75a74f ("riscv: mm: Add memory hotplugging support") Signed-off-by: Michael Neuling <mikey@neuling.org> Assisted-by: Cursor:claude-4.6-opus-high-thinking Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
|
Patch 1: "[1/5] riscv: errata: Fix bitwise vs logical AND in MIPS errata patching" |
|
Patch 1: "[1/5] riscv: errata: Fix bitwise vs logical AND in MIPS errata patching" |
|
Patch 1: "[1/5] riscv: errata: Fix bitwise vs logical AND in MIPS errata patching" |
|
Patch 1: "[1/5] riscv: errata: Fix bitwise vs logical AND in MIPS errata patching" |
|
Patch 1: "[1/5] riscv: errata: Fix bitwise vs logical AND in MIPS errata patching" |
|
Patch 1: "[1/5] riscv: errata: Fix bitwise vs logical AND in MIPS errata patching" |
|
Patch 1: "[1/5] riscv: errata: Fix bitwise vs logical AND in MIPS errata patching" |
|
Patch 1: "[1/5] riscv: errata: Fix bitwise vs logical AND in MIPS errata patching" |
|
Patch 1: "[1/5] riscv: errata: Fix bitwise vs logical AND in MIPS errata patching" |
|
Patch 1: "[1/5] riscv: errata: Fix bitwise vs logical AND in MIPS errata patching" |
|
Patch 1: "[1/5] riscv: errata: Fix bitwise vs logical AND in MIPS errata patching" |
|
Patch 1: "[1/5] riscv: errata: Fix bitwise vs logical AND in MIPS errata patching" |
|
Patch 2: "[2/5] riscv: ptrace: Fix register corruption in compat_riscv_gpr_set on error" |
|
Patch 2: "[2/5] riscv: ptrace: Fix register corruption in compat_riscv_gpr_set on error" |
|
Patch 2: "[2/5] riscv: ptrace: Fix register corruption in compat_riscv_gpr_set on error" |
|
Patch 2: "[2/5] riscv: ptrace: Fix register corruption in compat_riscv_gpr_set on error" |
|
Patch 2: "[2/5] riscv: ptrace: Fix register corruption in compat_riscv_gpr_set on error" |
|
Patch 2: "[2/5] riscv: ptrace: Fix register corruption in compat_riscv_gpr_set on error" |
|
Patch 2: "[2/5] riscv: ptrace: Fix register corruption in compat_riscv_gpr_set on error" |
|
Patch 2: "[2/5] riscv: ptrace: Fix register corruption in compat_riscv_gpr_set on error" |
|
Patch 2: "[2/5] riscv: ptrace: Fix register corruption in compat_riscv_gpr_set on error" |
|
Patch 2: "[2/5] riscv: ptrace: Fix register corruption in compat_riscv_gpr_set on error" |
|
Patch 2: "[2/5] riscv: ptrace: Fix register corruption in compat_riscv_gpr_set on error" |
|
Patch 2: "[2/5] riscv: ptrace: Fix register corruption in compat_riscv_gpr_set on error" |
|
Patch 3: "[3/5] riscv: mm: Fix NULL pointer dereference in __set_memory" |
|
Patch 3: "[3/5] riscv: mm: Fix NULL pointer dereference in __set_memory" |
|
Patch 3: "[3/5] riscv: mm: Fix NULL pointer dereference in __set_memory" |
|
Patch 3: "[3/5] riscv: mm: Fix NULL pointer dereference in __set_memory" |
|
Patch 3: "[3/5] riscv: mm: Fix NULL pointer dereference in __set_memory" |
|
Patch 4: "[4/5] riscv: mm: Fix NULL dereferences in napot hugetlb functions" |
|
Patch 4: "[4/5] riscv: mm: Fix NULL dereferences in napot hugetlb functions" |
|
Patch 4: "[4/5] riscv: mm: Fix NULL dereferences in napot hugetlb functions" |
|
Patch 4: "[4/5] riscv: mm: Fix NULL dereferences in napot hugetlb functions" |
|
Patch 4: "[4/5] riscv: mm: Fix NULL dereferences in napot hugetlb functions" |
|
Patch 4: "[4/5] riscv: mm: Fix NULL dereferences in napot hugetlb functions" |
|
Patch 4: "[4/5] riscv: mm: Fix NULL dereferences in napot hugetlb functions" |
|
Patch 4: "[4/5] riscv: mm: Fix NULL dereferences in napot hugetlb functions" |
|
Patch 4: "[4/5] riscv: mm: Fix NULL dereferences in napot hugetlb functions" |
|
Patch 4: "[4/5] riscv: mm: Fix NULL dereferences in napot hugetlb functions" |
|
Patch 4: "[4/5] riscv: mm: Fix NULL dereferences in napot hugetlb functions" |
|
Patch 4: "[4/5] riscv: mm: Fix NULL dereferences in napot hugetlb functions" |
|
Patch 5: "[5/5] riscv: mm: Fix TOCTOU race in remove_pte_mapping" |
|
Patch 5: "[5/5] riscv: mm: Fix TOCTOU race in remove_pte_mapping" |
|
Patch 5: "[5/5] riscv: mm: Fix TOCTOU race in remove_pte_mapping" |
|
Patch 5: "[5/5] riscv: mm: Fix TOCTOU race in remove_pte_mapping" |
|
Patch 5: "[5/5] riscv: mm: Fix TOCTOU race in remove_pte_mapping" |
|
Patch 5: "[5/5] riscv: mm: Fix TOCTOU race in remove_pte_mapping" |
|
Patch 5: "[5/5] riscv: mm: Fix TOCTOU race in remove_pte_mapping" |
|
Patch 5: "[5/5] riscv: mm: Fix TOCTOU race in remove_pte_mapping" |
|
Patch 5: "[5/5] riscv: mm: Fix TOCTOU race in remove_pte_mapping" |
|
Patch 5: "[5/5] riscv: mm: Fix TOCTOU race in remove_pte_mapping" |
|
Patch 5: "[5/5] riscv: mm: Fix TOCTOU race in remove_pte_mapping" |
|
Patch 5: "[5/5] riscv: mm: Fix TOCTOU race in remove_pte_mapping" |
PR for series 1079116 applied to workflow__riscv__fixes
Name: riscv: Assorted bug fixes
URL: https://patchwork.kernel.org/project/linux-riscv/list/?series=1079116
Version: 1