Pull vfs keyring updates from Christian Brauner:
 "The kernel has two keyrings that userspace fills with X.509
  certificates at boot: .fs-verity for fs-verity built-in signatures
  and .dm-verity for dm-verity root hash signatures.

  Neither is linked into any process keyring. Hence, request_key() and
  KEYCTL_SEARCH can't find them. The only way for userspace to identify
  them is to read their serial number out of /proc/keys. That is not
  just a large file often the names can also be reused and appear
  multiple times which allows forging these keyrings.

  This adds two fixed special key ids, KEY_SPEC_DM_VERITY_KEYRING and
  KEY_SPEC_FS_VERITY_KEYRING next to KEY_SPEC_BPF_KEYRING. The latter
  went in through bpf-next this merge window.

  lookup_user_key() resolves the fixed key ids to the two keyrings. So
  userspace can add a dm-verity (fixed keyring id: -10) certificate with

	keyctl padd asymmetric "" -10 < cert.der

  and seal the keyring with

	keyctl restrict_keyring -10

  without looking anything up first"

* tag 'vfs-7.4-rc1.keyring' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  Documentation: keys: document IDs added since KEY_SPEC_REQKEY_AUTH_KEY
  keys: add KEY_SPEC_FS_VERITY_KEYRING
  keys: add KEY_SPEC_DM_VERITY_KEYRING

Pull bpf updates from Alexei Starovoitov:
 "Major changes:

   - Introduce scalar evolution (SCEV) analysis in the verifier.

     It infers how registers and stack slots change in a loop and lets
     the verifier check bounded loops with induction variables as ranges
     instead of walking every iteration. The number of processed insns
     drops ten fold in programs with loops (Eduard Zingerman)

   - Add 'callx' instruction: indirect call of a static BPF subprogram.

     The address is taken with ld_imm64 or loaded from read-only data.
     Supported by x86-64, arm64 and riscv64 JITs (Alexei Starovoitov, Pu
     Lehui)

   - Add unwind_goto and unwind_exit instructions, so that Rust panic or
     C++ exception can run destructors of every frame it passes through.
     The normal path is free of unwind code. Supported by x86-64 and
     arm64 JITs (Alexei Starovoitov)

   - Support programs compiled by rust-bpf: treat load and store through
     a number as arena access with BPF_F_ARENA_SCALAR, accept rust names
     in BTF (Alexei Starovoitov)

   - Raise BPF program stack size from 512 bytes to 2 KiB on x86-64 and
     arm64 (Kumar Kartikeya Dwivedi)

   - Support struct, union and __int128 up to 16 bytes passed and
     returned by value in BPF subprograms and kfuncs, and fix x86-64 and
     arm64 trampolines for such arguments (Yonghong Song)

   - Introduce a common way to attach struct_ops to a cgroup via
     bpf_link. bpf_tcp_ops is the first user and mirrors TCP sock_ops
     callbacks (Martin KaFai Lau, Amery Hung)

   - Describe inlined functions in BTF. New kinds tell where the inline
     sites are and how to fetch the arguments there.

     CONFIG_DEBUG_INFO_BTF_INLINE keeps it apart from the main BTF in
     .BTF.inline section or in btf_vmlinux_inline.ko (Alan Maguire)

   - Fix many memory safety, lifetime and locking bugs in BPF core,
     verifier, iterators, local storage, dynptr, devmap, cpumap and
     seg6local (Josef Bacik, Alexei Starovoitov)

   - Diff stat is dominated by selftests and by removal of
     lib/test_bpf.c. Its 16k lines of instruction tests were converted
     to BPF selftests that BPF CI runs on every architecture it covers
     (Daniel Borkmann)

  Other features and fixes:

   - Add KASAN checks to memory accesses of JITed programs on x86-64
     (Alexis Lothoré)

   - Complete unification of helper, kfunc and subprog argument checks
     in the verifier (Amery Hung)

   - Add bpf_copy_from_user_mm[_str]() kfuncs (Anastasios Papagiannis)

   - Various features and fixes (Daniel Borkmann):
       - Add .bpf keyring for program signature verification, modelled
         after dm-verity keyring, and support ML-DSA in signing tools
       - Emit shorter and faster code in x86-64 JIT for patterns that
         LLVM generates
       - Fix various issues in gotox handling

   - Let BPF LSM set xattrs at inode creation with bpf_inode_init_xattr()
     (David Windsor, Daniel Borkmann)

   - Use sleepable page allocation in sleepable arena paths. Fix races
     between arena free, allocation and user page fault (Emil Tsalapatis)

   - Switch BPF crypto from lskcipher to AES-CBC and AES-ECB libraries
     (Eric Biggers)

   - Add bpf_proactive_reclaim() kfunc (Hui Zhu)

   - Render decl_tags in libbpf btf_dump and add tests for bpftool C
     dump (Ihor Solodrai)

   - Speed up tracing_multi attach on x86 (Jiri Olsa)

   - Various features and fixes (Kumar Kartikeya Dwivedi):
       - Add BPF_PROG_STREAM_OPEN command to read BPF streams through a
         file descriptor with poll support
       - Let kernel structs publish arena pointers with __arena type tag
       - Fix __uninit kfunc output buffers and fastcall rewrite with
         indirect stack accesses
       - Refuse CO-RE relocations for signed programs

   - Add enqueue_rcvq and dequeue_rcvq hooks to bpf_tcp_ops to adjust
     sk_rcvlowat and avoid unnecessary wakeups (Kuniyuki Iwashima)

   - Add bpf_ksock_sendto() kfunc and allow ksock connect and send from
     bpf_wq (Mahe Tardy)

   - Fix racy plt target update in arm64 bpf_arch_text_poke()
     (Matthew Wood)

   - Restructure BPF selftests Makefile as a layered build
     (Mykola Lysenko)

   - Speed up hash map lookups for u32 and u64 keys (Mykyta Yatsenko)

   - Add signed div/mod, movsx, bswap and gotol to MIPS JITs, signed
     div/mod to parisc JITs (Nicholas Dudar, Johan Almbladh)

   - Fix stack overflow in build ID parser on 32-bit (Nickolai
     Zeldovich)

   - Add stack arguments, signed arena loads and gotox to riscv64 JIT.
     Pu Lehui is now co-maintainer of riscv BPF JITs (Pu Lehui, Chen
     Pei, Feng Jiang)

   - Add bpf_call_rcu() and bpf_call_rcu_tasks_trace() kfuncs. Support
     fetching and/or/xor atomics in arena on x86-64 (Puranjay Mohan)

   - Fix flaky selftests, selftests with clang 23 and bpf-gcc
     (Qiliang Yuan, KaFai Wan, Vineet Gupta)

   - Fix builds broken by fatal resolve_btfids warnings, BTF generation
     on ARC, and define arch_cmpxchg_local() on arc, hexagon and
     openrisc (Sasha Levin)

   - Reduce memory use of hash maps by up to 50% per element
     (T.J. Mercier)

   - Mark pointer fields of sched_ext ops arguments as trusted (Tejun
     Heo)

   - Remove legacy bpf_asm, bpf_dbg and bpf_jit_disasm tools (Xia Yan)

   - Fix index overflow in queue and stack maps, arena range tree after
     allocation failure, tail call loop after freplace detach, lost
     signal in bpf_send_signal() (Yuan Chen)

   - Many more fixes and cleanups"

* tag 'bpf-next-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (660 commits)
  selftests/bpf: Time tc_edt from its first packet with data
  selftests/bpf: Test unwind_exit of an exception callback
  selftests/bpf: Tests for 32-bit scalar evolution bounds computation
  bpf: Reject unwind_goto and unwind_exit in offloaded progs
  bpf: Support 32-bit linear scalar evolution
  bpf: Make unwind_exit of an exception callback exit in JITs
  selftests/bpf: Test forbidden bpf_ksock_sendto() LSM attach
  selftests/bpf: Test ksock sendto()
  bpf: Add bpf_ksock_sendto() kfunc
  selftests/bpf: Test unwinding from R0: R2 subprog
  selftests/bpf: Add a C++ prog with exceptions
  selftests/bpf: Add tests for unwind_goto and unwind_exit
  bpf, arm64: Support unwind_goto and unwind_exit
  bpf, x86: Support unwind_goto and unwind_exit
  bpf: Add unwind_goto and unwind_exit insns
  tools/bpf: Remove legacy BPF tools
  bpf: Annotate data races on bpf_lru_node type
  selftests/bpf: Add arena allocation race tests
  bpf: Fix arena race between page free and alloc leading to incoherency
  bpf: Revalidate faulted arena pages before installing user mappings
  ...

Pull module updates from Petr Pavlu:

 - Ignore local labels and mapping symbols during module load

   These symbols were already ignored during kallsyms address-to-symbol
   lookups. Filter them out earlier during module loading to reduce
   lookup overhead and prevent them from appearing in /proc/kallsyms.

 - Fix potentially incorrect access of SetOnce<T> when setting Rust
   module parameters.

 - Fix a potential read of an uninitialized count when printing taint
   information for unloaded modules.

 - Allocate the kmod argument array using kmalloc_array() in preparation
   for conversion to type-aware allocators.

 - Clean up includes in linux/kmod.h

   Add explicit includes of linux/umh.h to files that use usermode
   helpers. Then clean up the #include list in linux/kmod.h, notably
   removing the compatibility linux/umh.h include.

 - Remove the error-injection.h include from linux/module.h

   Add explicit includes of linux/error-injection.h to files that use
   the ALLOW_ERROR_INJECTION() macro and currently rely on it being
   provided indirectly via linux/module.h. Then remove the unnecessary
   linux/error-injection.h include from linux/module.h.

 - Replace __MODULE_STRING() with __stringify() in various drivers in
   preparation for removing the former macro.

* tag 'modules-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux:
  drivers: Replace __MODULE_STRING() with __stringify()
  module: Fix uninitialized count read of unloaded taint tracking record
  rust: module_param: Fix potentially incorrect access of `SetOnce<T>`
  module: Remove the error-injection.h include from linux/module.h
  drm/xe: Include error-injection.h for ALLOW_ERROR_INJECTION()
  drm/i915: Include error-injection.h for ALLOW_ERROR_INJECTION()
  syscalls: Include error-injection.h for ALLOW_ERROR_INJECTION()
  net: Include error-injection.h for ALLOW_ERROR_INJECTION()
  block: Include error-injection.h for ALLOW_ERROR_INJECTION()
  module: Bring includes in linux/kmod.h up to date
  time/jiffies: Include linux/sysctl.h for proc_int_u2k_conv_uop(), ...
  umh, treewide: Explicitly include linux/umh.h where needed
  modules/kmod: Allocate argv with kmalloc_array()
  module/kallsyms: Ignore local labels and mapping symbols during module load
  module/kallsyms: Refactor current symbol filtering into is_core_symbol()
  module/kallsyms: Rename is_mapping_symbol() to is_ignored_kernel_symbol()

Pull keys updates from Jarkko Sakkinen:
 "Highlight:

   - Don't leak local kernel addresses (and complement the ongoing
     rhashtable migration) (Kyle Zeng)

     The index value for the associative array has been calculated with
     the following formula:

	mult_64x32_and_fold(description + type address + domain address)

     By creating a sequence of dummy keys (e.g., "A", "B", "C", ...), it
     is trivial to form a group of equations with a predictable hash
     function, and ultimately break KASLR.

     Kyle's solution is based on an ephemeral SipHash key and an atomic
     64-bit counter, which is encapsulated to a key_index_id(). This
     function is then used to assign identifiers for types and domains,
     and since the IDs are unique for each power on, they are as unique
     as memory addresses are.

     With these ingredients the index value calculation can be changed
     into form, which is not leaking any kernel addresses:

	SipHash(description + type id + domain id)

  Features and improvements:

   - TPM fields were moved from trusted_key_options to the TPM backend.
     They cost memory for non-TPM backends.

   - A TPM trusted key now caches tpm_is_tpm2() at the root of each call
     chain, and passes the result as a parameter. This decreases the
     amount of I/O traffic given that tpm_is_tpm2() starts and stops the
     chip via tpm_try_get_ops() and tpm_put_ops().

  Bugfixes:

   - A TPM trusted key corrupted the return value of a failed key
     unsealing operation if the pcrlock feature was used.

   - A TPM 2 trusted key allocated an off-by-four too large buffer for
     the decoded ASN.1 blob coming from keyctl add trusted.

   - Sometimes a TPM 2 trusted key rejected created keys based on the
     TPM2_Create response size, treating them as too large. Now it
     correctly checks the extracted TPM2 key blob size.

   - The keyctl reject operation raced with keyctl restrict_keyring
     because keyring->sem was not held in key_reject_and_link() before
     accessing keyring->restrict_link.

   - keyctl_describe_key() was not holding key->sem while accessing its
     fields, which can lead to use-after-free of a retired key type.

   - find_keyring_by_name() and procfs code were reading the UID from
     key->user->uid instead of key->uid. The latter is the cached value
     and is meant to protect against a use-after-free caused by keyctl
     chown.

   - search_process_keyrings_rcu() did not properly RCU-dereference the
     authorization key payload, which could cause a null dereference if
     the payload was revoked.

   - keyctl_read_key() checked key->type->read without holding key->sem,
     which can lead to use-after-free if the type is retired. Based on
     my suggestion, this was addressed in __keyctl_read_key(), which
     already did take key->sem"

* tag 'keys-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd:
  keys/trusted_keys: reuse TPM version in option handling
  security: keys: Fix comment of search_process_keyrings_rcu()
  keys/trusted/tpm2: Validate TPM2_Create object sizes separately
  keys/trusted_keys: move TPM-specific fields into struct trusted_key_tpm
  keys: Protect the read method check against type removal
  keys: Avoid owner account dereferences in /proc/keys
  keys: make keyring indexes independent of kernel addresses
  keys: Check the authorization payload in process keyring searches
  keys: Avoid the owner account dereference in named keyring lookup
  keys: Protect the type name while describing a key
  KEYS: Fix key_reject_and_link() race with keyring restriction
  KEYS: trusted: Fix blob allocation size in tpm2_key_decode()
  keys/trusted_keys: return immediately after TPM unseal failure

Pull crypto library updates from Eric Biggers:

 - Migrate the x86 and riscv optimized implementations of various AES
   modes (ECB, CBC, CBC-CTS, CTR, XCTR, XTS) into lib/crypto/.

   This makes the library APIs be properly accelerated on these
   architectures, while still accelerating crypto_skcipher as well.

   It removes a lot of redundant glue code, since the crypto API
   boilerplate no longer needs to be duplicated for these architectures.

   It also fixes the longstanding issue where optimizations for these
   AES modes were disabled by default on these architectures.

 - Optimize AES-XTS on SPARC64 using the SPARC crypto opcodes

 - Move the SipHash code into lib/crypto/

 - Update the ChaCha and Poly1305 functions to take size_t lengths,
   resolving issues where lengths over INT_MAX were mishandled

 - Make frame pointer unwinding work properly in some of the x86
   assembly functions, by following the standard %rbp convention

 - Add helper functions for zeroizing structs

 - Make a few documentation improvements

* tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: (49 commits)
  lib/crypto: md5: remove unused header
  lib/crypto: mips/chacha: Handle lengths of 2 GiB or more
  lib/crypto: arm/chacha: Handle lengths of 2 GiB or more in scalar code
  lib/crypto: chacha: Use size_t length
  lib/crypto: poly1305: Use size_t length
  lib/crypto: x86/sha512: Follow the normal %rbp convention
  lib/crypto: x86/sha256: Follow the normal %rbp convention
  lib/crypto: x86/sha1: Follow the normal %rbp convention
  lib/crypto: chacha20poly1305: zeroize state in __chacha20poly1305_decrypt
  lib/crypto: sparc/aes-xts: Add optimization using the AES opcodes
  lib: Move SipHash into lib/crypto/
  lib/crypto: x86/aes-ctr: Remove some unreachable code
  crypto: x86/aesni-intel - Add transitional selections
  crypto: aes - Boost priority of encryption modes further
  lib/crypto: x86/aes: Set RNDKEY in aes_cbc_encrypt_aesni()
  lib/crypto: riscv/aes-xts: Migrate optimized code into library
  lib/crypto: riscv/aes-ctr: Migrate optimized code into library
  lib/crypto: riscv/aes-cbc: Migrate optimized code into library
  lib/crypto: riscv/aes-ecb: Migrate optimized code into library
  lib/crypto: riscv/aes: Pass key struct to assembly code
  ...

Determine the TPM version once in the seal and unseal paths, and reuse
it when allocating and parsing trusted key options.

This reduces the number of fallible calls to tpm_is_tpm2() and avoids
unnecessary I/O between the kernel and the TPM.

Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Link: https://lore.kernel.org/r/20261005062732.140733-1-ssrish@linux.ibm.com
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>

search_my_process_keyrings() has been renamed to search_cred_keyrings_rcu()
in commit e59428f721ee ("keys: Move the RCU locks outwards from the keyring
search functions"), but one spot has been missed in a comment.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Jinjie Ruan <ruanjinjie@huawei.com>
Link: https://lore.kernel.org/r/20260928072024.91664-1-thuth@redhat.com
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>

TPM2_Create returns outPrivate, outPublic, creationData, creationHash and
creationTicket in its response parameter area. However, only outPrivate and
outPublic are included in the trusted key blob. The size of the blob is
therefore not determined by the size of the complete response parameter
area.

tpm2_seal_trusted() currently compares the size of the complete response
parameter area against MAX_BLOB_SIZE. This can reject a valid response
when the remaining response outputs cause the entire response parameter
area to exceed MAX_BLOB_SIZE, even though the outPrivate and outPublic
TPM2B structures consumed by tpm2_key_encode() remain small enough to be
encoded in the key blob.

This is observed when creating larger trusted keys using the swtpm TPM 2.0
emulator backed by libtpms.

For example, requesting a 113-byte key succeeds, 114 fails.

~$ keyctl add trusted trusted_key1 "new 113 keyhandle=0x81000001" @u
520504613
~$ keyctl add trusted trusted_key2 "new 114 keyhandle=0x81000001" @u
add_key: Argument list too long
~$

Remove the MAX_BLOB_SIZE check on the complete response parameter area.
Instead, use the response length passed to tpm2_key_encode() to validate
that the outPrivate and outPublic TPM2B structures are fully contained
in the response before accessing them.

Previously, a response parameter area larger than MAX_BLOB_SIZE was
rejected with -E2BIG before ASN.1 encoding. With this change, if the
resulting encoded blob does not fit in payload->blob, the error returned by
asn1_encode_sequence() is propagated instead.

Also, use scope-based cleanup to simplify resource management.

Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
Link: https://lore.kernel.org/r/20260926184203.479203-1-ssrish@linux.ibm.com
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>

The trusted_key_options struct contains TPM-specific fields (keyhandle,
keyauth, blobauth_len, blobauth, pcrinfo_len, pcrinfo, pcrlock, hash,
policydigest_len, policydigest, and policyhandle). This leads to the
accumulation of backend-specific fields in the generic options structure.

Define struct trusted_key_tpm and move the TPM-specific fields there. Store
a pointer to it in the private member of struct trusted_key_options.

Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Link: https://lore.kernel.org/r/20260912062950.279104-3-ssrish@linux.ibm.com
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>

keyctl_read_key() checks key->type->read without holding key->sem.
A reference keeps the key alive, but does not pin the module containing
its type. A surviving RxRPC key can therefore be read while AF_RXRPC
is being unloaded:

  KEYCTL_READ task                    Module unload and key GC
  ----------------                   ------------------------
  lookup_user_key()
  permission / possession checks
  load key->type
                                     af_rxrpc_exit()
                                       unregister_key_type()
                                         GC: down_write(key->sem)
                                         GC: retype to key_type_dead
                                         GC: up_write(key->sem)
                                       unregister_key_type() returns
                                     free_module()
  read saved type's read member

The final access can read freed module storage. The read invocation in
__keyctl_read_key() is already protected by key->sem, but the earlier
method check is outside that critical section.

Move the method check into __keyctl_read_key(), after key_validate() and
under its existing read hold on key->sem. The check and invocation then
use the same protected type for length queries and every read retry.
The GC cannot retype the key until the semaphore is released, and type
unregistration waits for that GC pass before the module can be freed.

Return -EOPNOTSUPP when validation succeeds and the type has no read
method. A temporary buffer may now be allocated before this result;
allocation and copying to userspace remain outside the semaphore.

Assisted-by: LLM
Cc: stable@vger.kernel.org # v5.10+
Fixes: d3ec10aa9581 ("KEYS: Don't write out to userspace while holding key semaphore")
Suggested-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Reviewed-by: David Howells <dhowells@redhat.com>
Link: https://lore.kernel.org/r/pm-key-management-objects-candidate-0010-v7-fc85721ff5cfb9e33ac6@gmail.com
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>