| Age | Commit message (Collapse) | Author |
|---|
|
Like commit bdc5071d7f7b ("coccinelle: Add kmalloc_objs conversion script")
with commit 1c7bbaeed110 ("coccinelle: kmalloc_obj: Remove default GFP_KERNEL arg")
Finds and converts sized devm_kmalloc-family of allocations into the typed
devm_kmalloc_obj-family of allocations.
Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: Julia Lawall <julia.lawall@inria.fr>
|
|
* Add disable zero_multiple_format to each rule to avoid considering
the possibility that an array index is expressed using '\0'
* Omit outer parentheses on context and org/report rules that
only match ubt don't transform, since matching a subterm gives
the same result whether or not the parentheses are present.
Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>
|
|
Recently, we added an ARRAY_END() macro to simplify finding a pointer
one past the last element in an array. Such a pointer is often called
the 'end', and thus the macro name.
Make it easy to find more places where that macro should be used.
See also:
436debc9cad8 ("array_size.h: add ARRAY_END()")
8118f197b7b7 ("mm: fix benign off-by-one bugs")
a9e5620c9a9e ("kernel: fix off-by-one benign bugs")
61e9210e2392 ("mm: use ARRAY_END() instead of open-coding it")
Cc: Kees Cook <kees@kernel.org>
Cc: Markus Elfring <Markus.Elfring@web.de>
Cc: Julia Lawall <Julia.Lawall@inria.fr>
Cc: Nicolas Palix <nicolas.palix@imag.fr>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>
|
|
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull scheduler fix from Ingo Molnar:
- Fix a false positive cputime related warning in kcpustat_dyntick_stop()
that can trigger sporadically after a clocksource switch (Stian Halseth)
* tag 'sched-urgent-2026-11-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
sched/cputime: Don't warn when the tick period starts after idle exit
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull timer fixes from Ingo Molnar:
- Fix on-stack hrtimer cleanup in play_idle_precise(), and
add the hrtimer_on_stack cleanup class to facilitate the fix
(Hui Su)
- Fix clock_getres() system call's handling of NULL output
pointer in the !CONFIG_POSIX_TIMERS case (Hungyu Lin)
- Fix get_cpu_itimer() to return TICK_NSEC when the sampled CPU time
is exactly equal to the nonzero expiry (Hungyu Lin)
- Fix do_timens_ktime_to_host() time offset subtraction underflow
check (Hungyu Lin)
- Report zero remaining time for disarmed SIGEV_NONE posix timers,
and add a self-test to detect this bug in the future (Hung-Jui Lin)
- Fix NOHZ 'full kick' handling bug that can cause missed
tick updates (Peng Wang)
- Fix field access bug in the vdso/gettimeofday code that works
only by accident (Thomas Weißschuh)
- Fix & prevent immediate clocksource watchdog rerun after a delay
(Karl Mehltretter)
* tag 'timers-urgent-2026-11-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
clocksource: Prevent immediate watchdog rerun after a delay
vdso/gettimeofday: Correct the read of tz_minuteswest and tz_dsttime
tick/nohz: Reevaluate the tick for kicks flushed outside hardirq
selftests: timers: Add a test for disarmed SIGEV_NONE timers
posix-timers: Report zero remaining time for disarmed SIGEV_NONE timers
time/namespace: Fix overflow when converting absolute deadlines
timers/itimer: Keep a nonzero value at CPU timer expiry
posix-timers: Accept NULL clock_getres() output in stubs
sched/idle: Use hrtimer cleanup class in play_idle_precise()
hrtimer: Add cleanup class for on-stack timers
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull misc irqchip fixes from Ingo Molnar:
- Fix the hardware IRQ-retrigger logic on the riscv-imsic
irqchip driver (Avi Weiss)
- Fix MSI descriptor leak in the irq-msi-lib irqchip driver
(Avi Weiss)
* tag 'irq-urgent-2026-11-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
irqchip/irq-msi-lib: Free wired MSI descriptors
irqchip/riscv-imsic: Report successful hardware retrigger
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull bootconfig fix from Masami Hiramatsu:
- init/bootconfig: Pass init arguments in documented order
Parse extra_init_args before command-line init arguments in
start_kernel(). This ensures command-line options take precedence
over bootconfig, matching the documented order and saved command
line.
* tag 'bootconfig-fixes-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
init/bootconfig: pass init arguments in documented order
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux
Pull RTC updates from Alexandre Belloni:
"This introduces a way to lift the hctosys limit for 32-bit systems to
ensure systems relying on it can pass Y2038. Add a driver for the
Raspberry Pi 5 RTC and add support for the Abracon abx81x, Ricoh
R2223x, Renesas R-Car X5H and Allwinner B288 RTCs to existing drivers:
Subsystem:
- the hctosys limit for 32bit platforms is now configurable
- introduce lock guard for for rtc_device.ops_lock
- use sysfs_emit() instead of sprintf() were possible
- selftest fixes
New driver:
- Raspberry Pi 5 RTC
Drivers:
- abx80x: add support for ABX81X
- bd70528: properly enable wakeup
- cmos: Fix ACPI RTC alarm handling
- ds1685: power-off fixes
- mt6397: add nvmem support
- pcf85063: add HW UIE support
- rs5c372: Ricoh R2223x support
- rzn1: add R-Car X5H support
- s35390a: allow use of output pin for interrupt signal 1 for wakealarm to
support synology devices
- sun6i: add Allwinner B288 support"
* tag 'rtc-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: (89 commits)
rtc: rs5c372: use sysfs_emit() instead of sprintf()
rtc: ds1307: use sysfs_emit() instead of sprintf()
rtc: isl1208: use sysfs_emit() instead of sprintf()
rtc: ds1685: use sysfs_emit() instead of sprintf()
rtc: ds1343: use sysfs_emit() instead of sprintf()
rtc: rx8025: use sysfs_emit() instead of sprintf()
rtc: x1205: use sysfs_emit() instead of sprintf()
rtc: bq32k: use sysfs_emit() instead of sprintf()
rtc: ep93xx: use sysfs_emit() instead of sprintf()
rtc: pcf2127: use sysfs_emit() instead of sprintf()
rtc: rv3029: use sysfs_emit() instead of sprintf()
rtc: ds1685: keep setting PAB until power is removed
rtc: ds1685: do not sleep in the power-off handler
rtc: ds1685: arm the wake-up alarm at power-off only if an alarm is set
rtc: rv3028: use sysfs_emit() instead of sprintf()
rtc: pcf85063: add 1 Hz update interrupt (UIE) support
rtc: pcf85063: preserve the alarm flag in clkout register updates
rtc: pcf85063: do not clear AIE in the interrupt handler
rtc: pcf85063: use devm_of_clk_add_hw_provider() for clkout
rtc: s35390a: Add synology quirk
...
|
|
kcpustat_dyntick_stop() warns if idle ends before the tick period
that the next tick will account has started. That happens on x86 in
a CPU's first idle period with the tick stopped, right after the
switch from the jiffies clocksource to tsc-early.
On the jiffies clocksource ktime only moves at the tick. When the
clocksource switches some time d after a tick, that d is lost: ktime
continues from the value of the last tick. The next tick comes
TICK_NSEC after the last one, but ktime has only moved TICK_NSEC - d,
while tick_periodic() still adds a full TICK_NSEC to tick_next_period,
which is now d ahead of ktime. When NOHZ starts,
tick_init_jiffy_update() rounds it up to a multiple of TICK_NSEC and
the sched timer is armed there, up to nearly two ticks after now. A
tick stop saves that as ts->last_tick, and an idle exit before now
reaches ts->last_tick - TICK_NSEC sees the tick period in the future.
Nothing is accounted twice then. The first tick covers a period that
starts after the idle exit, and the code already handles it. Drop the
warning.
Fixes: 96a494c9cfd8 ("sched/cputime: Don't account idle time twice after dyntick-idle")
Reported-by: Paul Menzel <pmenzel@molgen.mpg.de>
Reported-by: Breno Leitao <leitao@debian.org>
Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Reviewed-by: Kayra Cizmeci <kayracizmeci@gmail.com>
Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
Signed-off-by: Stian Halseth <stian@itx.no>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Link: https://lore.kernel.org/all/auTCQauaU733PY5z@gmail.com/
Link: https://lore.kernel.org/all/CAHk-=winC2u2D1FAX5grfq9F=bxmARxhuiQ4MvHAiJFu3iF6gw@mail.gmail.com/
Link: https://patch.msgid.link/20261031081408.3378884-1-stian@itx.no
Closes: https://lore.kernel.org/all/bfe9b14a-6e65-41c5-b638-26f6e033788b@molgen.mpg.de/
--
kernel/sched/cputime.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
|
|
Ayushman Rout says:
====================
bpf: Fix overlapping copies in bpf_dynptr_copy()
bpf_dynptr_copy() can corrupt data when both ranges are in the same xdp
packet and overlap: a slice of one range is used as the buffer for
__bpf_dynptr_read() or __bpf_dynptr_write(), and the chunk loop always
copies forward.
Patch 1 does not use a slice as the buffer for a copy within one packet
and copies from the end when the destination is above the source.
Patch 2 adds selftests. They pass with the fix.
Changes in v2:
- Dropped the bpf_xdp_copy_buf() change and fixed everything in
bpf_dynptr_copy(), as suggested by Alexei
- Reworked the tests into bpf_dynptr_copy() tests where only one of the
ranges crosses into frag0
v1: https://lore.kernel.org/bpf/20261024092659.76422-1-ayushmanrout27@gmail.com/
====================
Link: https://patch.msgid.link/20261026162810.12862-1-ayushmanrout27@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
|
|
Add dynptr tests for copies within one xdp packet with frags, where the
source and the destination overlap and the destination is above the
source:
- test_dynptr_copy_xdp_overlap: both ranges cross from the linear part
into frag0. bpf_dynptr_copy() of 1200 bytes with the destination 100
bytes above the source.
- test_dynptr_copy_xdp_overlap_src_linear: the source is in the linear
part and the destination crosses into frag0.
- test_dynptr_copy_xdp_overlap_dst_frag: the source crosses into frag0
and the destination is in frag0.
The new tests set err when the data is wrong. The existing
test_dynptr_copy_xdp does not, so it can pass on corrupted data.
Without the fix to bpf_dynptr_copy(), test_dynptr_copy_xdp_overlap
fails. With it, all the new tests pass.
Signed-off-by: Ayushman Rout <ayushmanrout27@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261026162810.12862-3-ayushmanrout27@gmail.com
|
|
When both dynptrs point into the same packet and the ranges overlap,
bpf_dynptr_copy() can copy wrong data in two ways.
If one range fits into a segment and the other one does not, the slice
of the first range is used as the buffer for __bpf_dynptr_read() or
__bpf_dynptr_write(). The range that crosses into a frag is copied piece
by piece, and an earlier piece can overwrite bytes that a later piece
has yet to read.
If neither range fits into a segment, the chunks are copied from the
start to the end through a 256 byte stack buffer. When the destination
is above the source, a chunk written to the destination overwrites
source bytes that later chunks have yet to read. For a copy of 1200
bytes with the destination 100 bytes above the source, the first chunk
writes source bytes 100..355 and the second chunk then reads bytes
256..355 after they were overwritten.
Do not use a slice as the buffer when both dynptrs share the same data,
and copy the chunks from the end to the start when the destination is
above the source, like memmove() does.
The selftests added later in this series pass with this change.
Fixes: daec295a7094 ("bpf/helpers: Introduce bpf_dynptr_copy kfunc")
Suggested-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Ayushman Rout <ayushmanrout27@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261026162810.12862-2-ayushmanrout27@gmail.com
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux
Pull x86 power utilities updates from Len Brown:
"Turbostat:
- Fix --cpu option to work more than once
- Fix --Joules option to work with --show power
- Remove hard-coded 8192-CPU limit
- Decode Uncore Frequency Agent Types
- Dump RDT (Resource Director Technology) config
- Dump RP (Resource Priority) config
- Recognize Rugged Panther Lake
- Fix PMT mmap size, bounds check, and mask computation
- Misc cleanups and minor fixes
x86_energy_perf_policy:
- Harden input parsing and bounds checks
- Fix optarg keyword matching
- Rewrite MSR device path discovery
- Misc cleanups and minor fixes"
* tag 'power-utilities-2026.10.31' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux: (42 commits)
tools/power x86_energy_perf_policy: Version 2026.10.31
tools/power turbostat: Version 2026.10.31
tools/power turbostat: Fix PMT mmap size and bounds check
tools/power turbostat: Fix undefined behavior in pmt_gen_value_mask()
tools/power turbostat: Fix --Joules when used with --show power
MAINTAINERS: Add x86_energy_perf_policy
x86_energy_perf_policy: Simplify write_sysfs() return type
x86_energy_perf_policy: Use calloc to initialize string buffer
x86_energy_perf_policy: Cleanup: Constify read only parameters
x86_energy_perf_policy: Cleanup: Drop unused signal.h
x86_energy_perf_policy: Document MSRHEADER
x86_energy_perf_policy: Cleanup: Check fseek() in VM path
x86_energy_perf_policy: Cleanup: Define BCLK_MHZ
x86_energy_perf_policy: Cleanup: Define HWP_WINDOW_MAX_USEC
x86_energy_perf_policy: Bound package iteration
x86_energy_perf_policy: Harden against potential ratio overflow
x86_energy_perf_policy: Fix optarg keyword matching
x86_energy_perf_policy: Cleanup: Use snprintf() for platform-profile
x86_energy_perf_policy: Harden with strtol()
x86_energy_perf_policy: Harden update_cpufreq_scaling_freq()
...
|
|
The update side of the sockmap psock lifecycle has several unsynchronized
accesses to sk->sk_prot and psock prog state that KCSAN flags when the
new update-vs-delete race selftest runs. The fix comes from Alexei [1]:
* sock_map_link() installed psock programs and called sock_map_init_proto()
before taking sk->sk_callback_lock, racing a concurrent teardown's
tcp_bpf_update_proto() write of sk->sk_prot. Take the write_lock early,
before psock_set_prog() and sock_map_init_proto(), and drop the
psock->saved_data_ready gating from prog detection (it is re-checked
under the lock before stopping progs).
* sock_map_del_link() read psock->saved_data_ready outside the lock. Move
the saved_data_ready check under write_lock_bh(&sk->sk_callback_lock)
so prog teardown is serialized against the proto restore.
* sock_map_psock_get_checked() and sock_map_sk_is_suitable() did plain
sk->sk_prot reads. Convert to READ_ONCE() to mark the intentional racy
read against the WRITE_ONCE() swap in sock_replace_proto().
With these changes the sock_map_link/psock_set_prog side of the reported
KCSAN splats is silenced; the remaining teardown-vs-core-TCP pairings
are the separate read-side annotation problem.
[1] https://lore.kernel.org/bpf/DMBHB0TQOV1L.38MECMYFGUS5B@gmail.com
Suggested-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261030-bpf-next-v1-2-035eabf8eae7@cloudflare.com
|
|
The issue:
This is a follow-up to the short link-layer header fixes from Eric.
After vlan pop_eth, a privileged SCHED_ACT BPF program can call
bpf_skb_change_head(skb, 1, 0) and then bpf_redirect_neigh().
__bpf_redirect_neigh() calls skb_pull(skb, sizeof(*ethh)) after checking
only that mac_header < network_header. Nothing verifies that the MAC
header is long enough, that it is linear, or that the IP header the
redirect goes on to read is linear either.
A SCHED_ACT BPF program can do:
bpf_skb_change_head(skb, 1, 0);
bpf_redirect_neigh(lo, NULL, 0, 0);
after vlan pop_eth. The skb then has mac_len == 1 and only one byte of
linear data; skb_pull(ETH_HLEN) trips the skb->len < skb->data_len BUG in
__skb_pull():
kernel BUG at ./include/linux/skbuff.h:2839!
RIP: skb_pull+0x40/0x50
Call Trace: skb_do_redirect -> packet_xmit -> packet_sendmsg
Kernel panic - not syncing: Fatal exception in interrupt
The v4 and v6 paths read ip_hdr() and ipv6_hdr() as soon as the MAC
header is gone. On the AF_PACKET frame below that leaves headlen == 0
after the pull, so the network header sits at skb->tail and the route
lookup reads ip4h->protocol, ip4h->saddr and ip4h->daddr past the linear
area.
The Fix:
Use skb_network_offset(), which is the MAC header span, instead of
skb->mac_len. mac_len is zero for locally generated tc egress and netkit
packets, while the span still rejects the one-byte header produced by
pop_eth + bpf_skb_change_head(skb, 1, 0). The single check also covers
the mac_header >= network_header test it replaces.
Use pskb_may_pull() to make the Ethernet header linear before it is read
or pulled, and to make the IP header linear in both the v4 and the v6
path before ip_hdr()/ipv6_hdr() is read. The header pointers are taken
after the pull, since pskb_may_pull() may reallocate skb->head.
Conditions to recreate the bug:
On x86-64 with 4 KiB pages, enable CONFIG_PACKET, CONFIG_BPF_SYSCALL,
CONFIG_NET_SCH_INGRESS, CONFIG_NET_CLS_MATCHALL, CONFIG_NET_ACT_VLAN and
CONFIG_NET_ACT_BPF. Run as root with BPF loading, network administration
and raw-packet privileges. Bring lo up and attach a SCHED_ACT program
that calls bpf_skb_change_head(skb, 1, 0), then returns
bpf_redirect_neigh(skb->ifindex, NULL, 0, 0):
ip link set lo up
tc qdisc add dev lo clsact
tc filter add dev lo egress matchall action vlan pop_eth pipe \
action bpf object-file neigh_chghead.o section action
Send an untagged ETH_P_IP frame of ETH_HLEN + 8192 bytes through an
AF_PACKET/SOCK_RAW socket bound to lo, without PACKET_VNET_HDR or
PACKET_QDISC_BYPASS. Use a unicast destination MAC. The sender's skb
has a 14-byte linear Ethernet prefix and a fragmented payload; pop_eth
removes that prefix and change_head restores only one linear byte.
The unfixed neighbor redirect then tries to pull 14 bytes and BUGs.
Sending the same frame without pop_eth and change_head leaves the IP
header in the frags, which is the route lookup reading past skb->tail.
Fixes: b4ab31414970 ("bpf: Add redirect_neigh helper as redirect drop-in")
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Reviewed-by: Victor Nogueira <victor@mojatatu.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/netdev/20261027082604.1485903-1-edumazet@kernel.org/
Link: https://lore.kernel.org/all/2a0f5ff1d8db81b07fc4b344b8e68e3505fcbf36f72a471d1678b2f1cecd881b@mail.kernel.org/
Link: https://lore.kernel.org/netdev/DMII4JGTEUEG.2WRJPT6ODT6J0@gmail.com/
Link: https://patch.msgid.link/bpf_redirect_neigh_short_linear.v3.r0.20261031153053-1@mojatatu.com
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"A collection of fixes across the sound subsystem. Nothing particularly
stands out, mostly driver- and device-specific fixes along with a few
race / UAF fixes and cleanups. Here are some highlights:
ALSA core:
- Fix potential race in PCM proc handling at disconnection
- Fix potential race in UMP sequencer callback at releasing
HD-audio:
- Reject codec reset/reconfig on ASoC buses to prevent deadlock
- Force MSI for Hygon H34M51A board
- Usual Realtek quirks for ASUS and HP laptops/AiO
USB-audio:
- Bound packet copies by PCM buffer size in generic and ua101 drivers
- Rate-limit URB submission errors at stream start
- Skip redundant probe-time interface setup on MSI ALC4080
- Device quirks for Novation UltraNova, MOTU MicroBook II, and RYDZ
Headphone
ASoC:
- Fixes for runtime PM and IRQ handling in hdac_hda and SDCA
- SOF: Fix potential UAF at release, fix for Kconfig dependency
- Qualcomm: Fixes for sm8250 and q6apm/q6afe
- NXP / i.MX: Fix for pending work in hw_free
- Xilinx: Fix read-modify-write of AUD_CTRL in formatter_pcm
- Intel: Arrow Lake SoundWire match table additions (RT712, RT713 +
dual RT1320)
- AMD: DMI quirk for HP Laptop 14-em0xxx and memory leak fix in Raven
DMA close
- Various codec fixes for midas_wm1811, wm8994, cs35l56, cs42l56,
WSA881x/883x/884x, es8326/es8375/es9356, rt721/rt722, and
tlv320aic32x4
Misc:
- OPL3: Fix races in timer initialization, shutdown, and voice
cleanup
- Bounds checks and string helpers for AC97 and emu10k1
- Fix spu_memset() stride in legacy SH AICA driver
- Parameter handling fixes in pcmtest virtual driver"
* tag 'sound-fix-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (71 commits)
ASoC: SOF: Intel: hda: Stop the controller before freeing its DMA buffers
ASoC: imx-pcm-rpmsg: Flush pending work in hw_free
ASoC: xilinx: formatter_pcm: Fix read-modify-write of AUD_CTRL in hw_params
ASoC: hdac_hda: Keep runtime PM state in sync across codec remove/probe
ASoC: rt721: Remove invalid register defaults
ASoC: hdac_hda: Balance the runtime PM disable in codec remove
ASoC: hdac_hda: Restore the codec device type on unbind
ASoC: hdac_hda: Allocate the private data at codec driver bind
ASoC: qcom: sm8250: Limit RX digital gain to 0 dB
ALSA: hda: Reject codec reset on ASoC (ext_ops) buses
ALSA: usb-audio: add quirk for Novation UltraNova (1235:0011)
ALSA: usb-audio: Add correct datainterval in the quirks-table for Microbook II
ALSA: usb-audio: Skip probe-time interface setup for MSI MAG X570S ALC4080
ALSA: hda/realtek: Extend quirk for HP Pavilion All-in-One 27-ca1xxx
ALSA: pcmtest: Honor the enable parameter
ALSA: ua101: Bound packet copies by the PCM buffer size
ALSA: usb-audio: Bound packet copies by the PCM buffer size
ASoC: SDCA: re-enable IRQ on pm_runtime_force_suspend failure
ASoC: SDCA: drop pm_runtime reference on probe failure path
ASoC: SDCA: propagate sdw_slave_read_prop() failure in class_read_prop
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs
Pull overlayfs fixes from Amir Goldstein:
- Fixes for bugs found by Chris Mason's AI review, several of them
reachable by unprivileged users: an info leak, use-after-free and
NULL deref bugs, an RCU walk stall with remote layers and data loss
with nfs_export
- Fix copy up of files with an empty security.capability xattr, which
any user could set to block copy up
- Fix a regression from v6.16 with the override_creds mount option
- Two casefold fixes
* tag 'ovl-fixes-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs:
ovl: check the casefold flag of directories only
ovl: reserve space for the casefolded name terminator
ovl: fix mount setup failing when override_creds drops CAP_SYS_ADMIN
selftests/ovl: fix detached layer mountinfo expectations
ovl: set the revalidate flags after d_instantiate()
ovl: always encode the origin fh when index is enabled
ovl: read the nlink xattr of every indexed non-dir
ovl: skip copy up of empty security.capability
ovl: fix a torn path in ovl_get_redirect()
ovl: do not copy up a dentry that was removed
ovl: hold a reference on the parent in readdir
ovl: use the pinned upper dir in ovl_fix_origin()
ovl: do not take a name snapshot in RCU walk
vfs: add try_take_dentry_name_snapshot()
ovl: take a snapshot of the name for copy up
ovl: check that the parents of volatile/dirty are dirs
ovl: add assertions in dir cache code
ovl: set OVL_WHITEOUTS before publishing the upper dir
ovl: fortify ovl_copy_xattr() against underlying layer modifications
ovl: do not copy up an xattr value that was never read
|
|
|
|
Since 2026.04.25:
Harden input parsing and bounds checks.
Fix optarg keyword matching.
Rewrite MSR device path discovery.
Misc cleanups and minor fixes.
Signed-off-by: Len Brown <len.brown@intel.com>
|
|
Since version 2026.09.28:
Fix --cpu option to work more than once.
Fix --Joules option to work with --show power.
Remove hard-coded 8192-CPU limit.
Decode Uncore Frequency Agent Types.
Dump RDT (Resource Director Technology) config.
Dump RP (Resource Priority) config.
Recognize Rugged Panther Lake.
Fix PMT mmap size, bounds check, and mask computation.
Misc cleanups and minor fixes.
Signed-off-by: Len Brown <len.brown@intel.com>
|
|
Remove assert(offset == 0), to allow non-zero PMT offsets.
Fix the pmt_mmio_open() mapping to round-up (offset + size).
Fix the offset bounds check to disallow running past the end of the region.
[lenb: commit message re-write]
Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>
|
|
The function uses plain int literal '1' for bit shifting, which causes
undefined behavior when msb >= 31. This is because shifting a 32-bit int
by 32 or more bits is undefined behavior in C. Fix by using 1ULL
(unsigned long long) instead of 1 to ensure 64-bit arithmetic on all
platforms.
Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>
|
|
The "--Joules" option displays energy in Joules,
replacing the same metrics displayed as power in Watts.
But when used with --show power, it deletes the power
metrics without replacing them with their energy counterparts:
$ sudo ./turbostat -q --list --show power --Joules
CoreTmp,PkgTmp,RAM_J,PKG_%,RAM_%
Fix it thus:
$ sudo ./turbostat -q --list --show power --Joules
CoreTmp,PkgTmp,Pkg_J,Cor_J,GFX_J,RAM_J,PKG_%,RAM_%,Sys_J
Signed-off-by: Len Brown <len.brown@intel.com>
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus
ASoC: Fixes for v7.4
A moderately large collection of fixes and quirks that have come in
during the merge window, everything here is driver specific and none of
it unusually severe.
|
|
start_kernel() appends command-line init arguments before
bootconfig init arguments, while setup_command_line()
places them in the opposite order. As a result, the
arguments passed to init do not match the saved command
line, reversing the intended precedence of options.
Parse extra_init_args before after_dashes so command-line
init arguments are passed last.
Link: https://lore.kernel.org/all/20261027073719.4010659-2-thnkslprpt@gmail.com/
Fixes: b66fbbe8d482 ("init/bootconfig: Reorder init parameter from bootconfig and cmdline")
Signed-off-by: Avi Weiss <thnkslprpt@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb
Pull smb server fixes from Namjae Jeon:
- Fix compound CREATE response buffer sizing and reserve space for
final response padding to prevent buffer overflows and out-of-bounds
reads
- Allocate sufficient space for UTF-16 directory-name conversion,
including the terminating NUL
- Fix an RDMA transfer length underflow that can cause out-of-bounds
reads or writes when processing multiple remote buffer descriptors
- Fix use-after-free bugs during failed durable reconnect cleanup and
AppInstanceId supersede racing with session teardown
- Keep retry timeout clamp bounds constant to fix a MIPS build failure
with CONFIG_HZ=1024
- Fix a session reference leak in compounded SESSION_SETUP and reject
compounded session binding to avoid mixing session and tree state
after a failed binding
- Serialize operations on each named pipe and preserve unread RPC reply
data for subsequent READ requests when the client's output buffer is
too small
- Return complete, eight-byte-aligned stream information entries and
report insufficient output space correctly
- Use the resolved share root path so shares rooted at mount points
list their contents correctly with crossmnt disabled
- Ignore network-device events outside the initial network namespace,
preventing container interfaces from affecting ksmbd listeners
* tag 'ksmbd-for-7.4-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb:
ksmbd: return complete and aligned stream information
ksmbd: fix session reference leak on compounded SESSION_SETUP
ksmbd: fix named-pipe reply loss with small output buffers
ksmbd: avoid races between named-pipe operations
ksmbd: fix use-after-free after a failed durable reconnect
ksmbd: fix out-of-bounds read when padding the final compound response
ksmbd: fix SMB2 CREATE response buffer overflow in compound requests
ksmbd: use the resolved share path for the share root
ksmbd: keep retry timeout clamp bounds constant
smb: server: size directory name conversion buffer correctly
ksmbd: prevent session binding in compound requests
ksmbd: ignore network devices of other namespaces
ksmbd: fix app-instance non-durable supersede session UAF
smb: smbdirect: fix buffer length underflow in RDMA transfers
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools-next
Pull perf tool updates from Arnaldo Carvalho de Melo:
- Support instruction tracking on arm64 for data type profiling,
resolving stack, global, per-CPU and 'current' variable accesses, so
that 'perf annotate --data-type' resolves types on arm64 the way it
does on x86.
- Port the Python scripts to the perf module and standalone execution,
and improve the module: lazy sample callchains and event copies, GIL
handling, better session/thread lookup, new treport, flamegraph and
sqlite/postgres exporters.
- Reenable and fix the attribute expectation test suite: per-PMU bit
masks, other core PMUs' events, dummy tracking events, group checks
and spelled out skip reasons.
- perf trace: filter the target's tasks in BPF, open the BPF output
event on every CPU, add an option to disable syscall augmentation and
raise TRACE_AUG_MAX_BUF.
- perf jitdump: harden record parsing, validating unwinding sizes and
symbol names, byte-swapping debug entries via safe accessors and
fixing frees on error paths.
- perf annotate-data fixes: bound the member nesting recursion, resolve
type DIEs in the debug file they came from, adjust the offset for
flex-arrays and show the sample count in the data-type browser.
- perf symbol and debug info: try linked debug files for DSOs, avoid
repeated failing searches, set binary/symtab types for split
kallsyms, JIT maps and the build-id cache, fix libbfd symbol loading.
- perf config: serialize config file access with a mutex, add the
DEFINE_MUTEX() and DO_ONCE() primitives and a robust process shared
mutex, add the core.hybrid-merge option.
- perf report: add --progress and --no-progress options.
- perf mem: add a false sharing workload to 'perf test', request
PERF_SAMPLE_CPU by default, use the IBS swfilt filter when available
and decode L0 in the memory level.
- perf test: take turns using the perf mlock budget in the mmaping
tests, add the 'needs_mlock' suite flag, scope the probe based tests
to their PID and make more tests non-exclusive.
- perf vendor events intel: update events and metrics to TMA 5.2,
refresh the event tables and fix umask encodings.
- perf build: run shellcheck, mypy and pylint in parallel, make pylint
opt-out with NO_PYLINT=1, fix clean and install dependencies.
- Add a script and a 'make sync-headers' target to sync the tools/
copies of kernel headers with the kernel sources, plus the resulting
syncs of the cpufeatures, KVM, fs, mount, fcntl, socket, rtnetlink,
if_addr and sound headers.
- Fix cs-etm HW_ID mapping synthesis for raw trace, queue teardown
leaks and duplicate v0 global mappings.
- Add a 'perf bench atomic' benchmark for atomic operations.
- Filter events before creating lock_stat in 'perf lock contention'.
- Add a 'perf test' case for events re-armed with
PERF_EVENT_IOC_REFRESH.
- Fix memory leaks on 'perf c2c' output fields and add function view
stdio coverage to its test.
- Fix a NULL dereference resolving callchains in 'perf machine'.
- Optimize the libdw fallback when DWARF is missing and try the symbol
file first when checking for debuginfo.
- Don't call eprintf() in pr_debugN() when not verbose.
- Don't delete cumulative caller entries before the stat_acc decays in
'perf report'.
- Fix ring buffer cursor handling: keep the consumed cursor in forward
mode and use the head selected by read_init.
- Fix 'perf test mmap-basic' user rdpmc detection and only test
userspace reading on supported platforms.
- Build fixes: include sys/types.h for ssize_t, errno.h before kernel
headers and fix jevents.py type annotations for mypy 2.x.
* tag 'perf-tools-for-v7.4-1-2026-10-30' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools-next: (425 commits)
perf machine: Fix NULL deref in thread__resolve_callchain_sample()
perf pmu-events: Fix jevents.py type annotations for mypy 2.x
perf parse-events: Include errno.h before kernel headers
perf print_insn: Include sys/types.h for ssize_t
perf tests mmap-basic: Fix user rdpmc detection logic
perf tests mmap-basic: Only test userspace reading on supported platforms
perf mmap: Preserve the consumed cursor in forward mode
perf mmap: Use the head selected by read_init
perf hist: Do not delete cumulative caller entries before stat_acc decays
perf debug: Avoid calling eprintf() in pr_debugN() when verbose < n
perf libdw: Optimize fallback logic for missing DWARF
tools headers: Sync KVM headers with the kernel sources
tools headers: Sync UAPI sound/asound.h with the kernel sources
tools headers: Sync UAPI linux/mount.h with the kernel sources
tools headers: Sync UAPI linux/fs.h with the kernel sources
tools headers: Sync UAPI linux/fcntl.h with the kernel sources
tools headers: Sync linux/socket.h with the kernel sources
tools arch x86: Sync the cpufeatures.h copy with the kernel sources
tools headers UAPI: Sync linux/rtnetlink.h with the kernel sources
tools headers UAPI: Sync linux/if_addr.h with the kernel sources
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor
Pull AppArmor fixes from John Johansen:
"Leaks:
- fix a leak on a rejected string table entry
- fix refcount leak in aa_get_newest_profile()
- fix profile leak when a policy load fails
- remove fs entries created by a failed policy load
- on failed load ensure profile files are removed before parent
- Fix namespace reference leak in __aa_find_or_create_ns()
Use after free/double free:
- fix a use-after-free in aa_lookupn_ns()
- avoid potential double free when remapping DFA tables
Bounds checking by-passes:
- fix table_size() integer overflow on 32 bit
- check accept index + 1 is in bounds
Mediation fixes:
- Fix AF_UNSPEC mediation
- check address length before reading AF_UNSPEC bind address
- mediate AF_UNSPEC socket disconnects
- Fix sctp connect/bind by-passess
- advertise that sctp is being mediated
- fix check SCTP bind, and connect permission checks
- check connect permission for SCTP
- incorrect state machine traversal
- convert duplicated dfa transitions to match_char()
- locking issues
- don't revalidate inherited files under files->file_lock
- fix uninitialized variable warning in aa_inherit_files
- Bad dereferences
- fix NULL ctx->peer derefs in unix socket ctx updates
Unnecessary warnings:
- remove unconfined_profile() check in inet socket mediation
Kernel Doc:
- Fix the return value in split_token_from_name() kernel-doc
Misc:
- fix query_data() output overlapping the lookup key
- report a label allocation failure as -ENOMEM"
* tag 'apparmor-pr-2026-10-29' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor: (23 commits)
apparmor: fix uninitialized variable warning in aa_inherit_files
apparmor: fix profile leak when a policy load fails
apparmor: on failed load ensure profile files are removed before parent
apparmor: remove fs entries created by a failed policy load
apparmor: fix query_data() output overlapping the lookup key
apparmor: advertise that sctp is being mediated
apparmor: fix check SCTP bind, and connect permission checks
apparmor: check connect permission for SCTP
apparmor: fix a use-after-free in aa_lookupn_ns()
apparmor: Fix namespace reference leak in __aa_find_or_create_ns()
apparmor: check accept index + 1 is in bounds
apparmor: Fix the return value in split_token_from_name() kernel-doc
apparmor: convert duplicated dfa transitions to match_char()
apparmor: fix table_size() integer overflow on 32 bit
apparmor: avoid potential double free when remapping DFA tables
apparmor: report a label allocation failure as -ENOMEM
apparmor: fix a leak on a rejected string table entry
apparmor: remove unconfined_profile() check in inet socket mediation
apparmor: fix refcount leak in aa_get_newest_profile()
apparmor: check address length before reading AF_UNSPEC bind address
...
|
|
Since ipa_interrupt_init() allocates struct ipa_interrupt in ipa_probe(),
the structure is owned by ipa_probe() and released with
ipa_interrupt_exit() on its error paths and in ipa_remove(). The error
path of ipa_interrupt_config() still frees it with kfree(). If
ipa_interrupt_config() fails (called from ipa_config() via ipa_setup()),
ipa_probe() unwinds through err_interrupt_exit, which frees the same
structure again.
Drop the kfree() from ipa_interrupt_config(); it should only undo what it
set up itself. Drop the leftover initialization and cleanup of
ipa->interrupt now managed in ipa_proble() and ipa_remove() of ipa_main.c.
Fixes: ad1be80d7582 ("net: ipa: introduce ipa_interrupt_init()")
Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
Reviewed-by: Alex Elder <elder@riscstar.com>
Link: https://patch.msgid.link/20261029082100.17722-2-fourier.thomas@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
Currently, two bearers of different media types can be added to the
same device (e.g., "eth:eth0" and "ib:eth0") via tipc command:
tipc bearer enable media eth dev eth0
tipc bearer enable media ib dev eth0
For each command execution, tipc_enable_l2_media() is called:
tipc_enable_l2_media()
dev_get_by_name()
dev_hold()
As a result, device->dev_refcnt is incremented twice, but the second
bearer replaces the first one. This causes a leak in device->dev_refcnt.
Fix this by rejecting a bearer with a different media type when the
device is already occupied.
Fixes: cb30a63384bc ("tipc: refactor function tipc_enable_bearer()")
Reported-by: Jiakai Xu <xujiakai24@mails.ucas.ac.cn>
Closes: http://lore.kernel.org/netdev/20260918013509.1853952-1-xujiakai24@mails.ucas.ac.cn/
Signed-off-by: Tung Nguyen <tung.quang.nguyen@est.tech>
Link: https://patch.msgid.link/20261029030522.8306-1-tung.quang.nguyen@est.tech
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core
Pull more driver core fixes from Danilo Krummrich:
- Revert TAINT_FORCED_BIND, introduced to flag manual sysfs bind/unbind
operations associated with misleading fuzzing reports. It also taints
established workflows, including VFIO device passthrough; a more
targeted approach will be revisited after 7.4.
- Rate limit synthetic uevent failure messages to prevent log flooding
from repeated invalid writes to sysfs uevent files
* tag 'driver-core-7.4-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core:
Revert "driver core: add TAINT_FORCED_BIND for when userspace manually messes with devices and drivers"
driver core: Limit the messages on a refused uevent
|
|
Misc fixes for this merge window from Sasha Levin that were posted for
issues found in linux-next but not picked up by maintainers.
In an almost certainly futile attempt to clean up the disaster area that
is my inbox, I'm merging them directly rather than leaving them pending
and wait for them to come in through the proper channels.
* fixes-from-sasha:
selftests/fuse: add the missing symlink caching test
fuse: fix link error with CONFIG_FUSE_PASSTHROUGH=n
xprtrdma: fix up the nfs/nfs-anna merge of the Write chunk head trim
|
|
Commit 3e14f079d7a0 ("selftests/fuse: add fuse symlink caching test")
registered fuse_symlink_cache_test in the fuse selftest Makefile and
.gitignore, but the test source was not part of the applied commit, so
building the fuse selftests fails:
make[1]: *** No rule to make target 'fuse_symlink_cache_test.c', needed by '.../fuse_symlink_cache_test'.
Add fuse_symlink_cache_test.c as posted in Luis Henriques's v5
submission. The test serves a file and a symlink to it from a libfuse
low-level filesystem, resolves the symlink 100 times, and counts the
readlink requests that reach the server: one when FUSE_CAP_CACHE_SYMLINKS
is set during FUSE_INIT, and all 100 when it is not.
Fixes: 3e14f079d7a0 ("selftests/fuse: add fuse symlink caching test")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/r/202610170822.oEJ1Autq-lkp@intel.com/
Link: https://lore.kernel.org/r/20261001164916.15311-8-luis@igalia.com
Originally-by: Luis Henriques <luis@igalia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Reviewed-by: Luis Henriques <luis@igalia.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
Commit 2f19d54c055d ("fuse: support 64 bit, server allocated backing ID")
moved the CONFIG_FUSE_PASSTHROUGH check out of the backing ioctl handlers
and into fuse_get_conn_for_passthrough(). The calls from the handlers
into backing.c, which is only built with CONFIG_FUSE_PASSTHROUGH, are now
only removed if the compiler inlines that helper. It does not have to,
and with gcc 11 and CONFIG_CC_OPTIMIZE_FOR_SIZE it doesn't:
dev.c:(.text+0x355c): undefined reference to `fuse_backing_open'
nios2-linux-ld: dev.c:(.text+0x3594): undefined reference to `fuse_backing_open_64'
nios2-linux-ld: dev.c:(.text+0x35d0): undefined reference to `fuse_backing_close'
Check CONFIG_FUSE_PASSTHROUGH in each handler again, as
fuse_notify_backing_remove() does. The check still comes after the
fuse_get_dev() and -ENOTCONN checks, so the errors userspace sees do not
change.
Fixes: 2f19d54c055d ("fuse: support 64 bit, server allocated backing ID")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202610171310.uqRzJkIx-lkp@intel.com/
Closes: https://lore.kernel.org/oe-kbuild-all/202610260719.sj08mXBr-lkp@intel.com/
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
Two fixes for the same Write chunk payload corruption meet in
linux-next. In the nfs tree, commit a0db57fee35e ("xprtrdma: Fix Write
chunk payload corruption on a short reply header") trims
head[0].iov_len in rpcrdma_decode_msg(). In the nfs-anna tree,
commit 9ee534a75912 ("xprtrdma: trim head iovec when the payload
arrives via a Write chunk") trims it in rpcrdma_inline_fixup() and
reduces buflen by the same amount.
The merge resolution keeps the caller-side trim. By the time
rpcrdma_inline_fixup() runs, head[0].iov_len already equals copy_len,
so the block added by the nfs-anna commit never runs and its buflen
reduction in rq_rcv_buf and rq_private_buf is lost. The helper is also
still passed xdr_pad_size(writelist), while its kernel-doc now
describes @writelist as the number of bytes conveyed by the Write
chunk.
Drop the caller-side trim and pass the full Write chunk length, so
that rpcrdma_inline_fixup() is the only place that trims head[0] and
reduces buflen. Compute the pad with xdr_pad_size() in the helper, so
the padding from the nfs commit stays correct for lengths that are not
a multiple of four. Its rpclen calculation and empty reply check stay
in rpcrdma_decode_msg().
Fixes: 53ab189bdc14 ("Merge branch 'linux-next' of git://git.linux-nfs.org/projects/anna/linux-nfs.git")
Link: https://lore.kernel.org/all/as4aacUf2Q78FMvY@sirena.org.uk/
Signed-off-by: Sasha Levin <sashal@kernel.org>
Tested-by: Tim Menninger <tmenninger@everpuredata.com>
Reviewed-by: Tim Menninger <tmenninger@everpuredata.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux
Pull Kbuild fixes from Nathan Chancellor:
- Move probing of '-mfentry' back into Makefile instead of Kconfig
because it does not interact well with toolchains that support
multiple bit widths
- Add a big comment in scripts/Kconfig.toolchain of two pitfalls when
moving cc-option checks from Kbuild to Kconfig
* tag 'kbuild-fixes-7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux:
scripts/Kconfig.toolchain: Highlight cc-option differences between Kconfig and Kbuild
kbuild: Move testing of '-mfentry' back to Makefile from Kconfig
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-ktest
Pull ktest updates from Steven Rostedt:
- Sort configs before writing config file
Currently the .config file is created from the perl hash array from
reading the applied min-configs. The order is determined by how perl
hashes the values. This causes the .config file to be created in
different orders for each run, and the order may determine the final
value of the .config file after it goes through a make oldconfig.
Sort the values when creating the .config so that the result is the
same for every run.
- Add total test time to run output
Have ktest display the total test time of running all the tests. This
is useful to find issues in the build, install, boot or test run
where things are hanging for longer than expected.
- Update reading of the git output during bisect
The ktest bisect is an automated way to run git bisect. Since there
currently no easy way to know if the bisect found the bad commit (I'm
talking with the git maintainers to fix this[1]), it parses the
output for the line "is first bad commit". But a recent update to git
has the output state "is the first 'bad' commit" which breaks ktest
bisect.
Have ktest handle both output strings.
[1] https://lore.kernel.org/all/20261020141011.0015d172@gandalf.local.home/
* tag 'ktest-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-ktest:
ktest: Accept quoted bad term in git bisect output
ktest.pl: Add total test run time to output
ktest: Sort config keys before writing config files
|
|
Pull drm fixes from Dave Airlie:
"The final set of merge window fixes, from AMD mostly. with one set of
panthor mmu fixes.
amdgpu:
- UALink fixes
- Runtime PM fixes
- GPUVM fixes
- Mac fixes
- HDMI fixes
- DP MST fix
- Userptr fix
- SMU fixes
- DSC fix
- VCE/UVD sched teardown fix
- Display runpm reference fix
- Display TD-LUT fix
- SMU 13.x fixes
- SMU 14.x fixes
- Gang submit fix
- Passive DVI sink fix
- USB4 tunnel fix
- Freesync fix
amdkfd:
- SVM fixes
- Fix doorbell allocation race
- GC 12.1 fix
- GPU reset fix
- Buffer accounting fixes
- Bounds checking fixes
- Hotplug fixes
- SVM fixes
- CRIU fixes
- GFX12 fix
panthor:
- Fix bugs in MMU handling"
* tag 'drm-next-2026-10-31' of https://gitlab.freedesktop.org/drm/kernel: (52 commits)
drm/amd/display: refresh cached HDMI FreeSync state
drm/amd/display: Cap DSC bpp for USB4 DP tunnels
drm/amd/display: Poll passive DVI sinks for EDID readiness
drm/amdgpu: re-enable GFXOFF for compute on GFX12
drm/amdkfd: evict the queues only once for CRIU PROCESS_INFO
drm/amdgpu: drop the gang leader reference when freeing gang jobs
drm/amdkfd: send SMI process and VM fault events only to allowed clients
drm/amdkfd: validate SRAT subtables before parsing
drm/amd/pm: preserve committed OD features for SMU 14.0.2
drm/amd/pm: add zero fan stop temperature support on smu 14.0.2
drm/amd/pm: preserve committed OD features for SMU 13.0.0/13.0.7
drm/amd/display: Initialize missing TD-LUT programming inputs
drm/amdkfd: split vram_pages of SVM ranges prefetched without a GPU mapping
drm/amdgpu: reject CS chunks too large for kvmalloc()
drm/amd/display: take a runtime PM reference only when a CRTC turns on
drm/amdgpu: guard VCE/UVD sched entity teardown on failed probe
drm/amdkfd: stop restore retries on device unplug
drm/amdkfd: tear down KFD processes before early fini_sw on disconnect
drm/amdkfd: Validate the control stack of a restored queue
drm/amdkfd: correct vram_available calculation
...
|
|
Pull smb client fixes from Paulo Alcantara:
- Validate the offsets and lengths a server puts in its responses
before using them, so that a malicious or broken server can no longer
make the client read past the received data:
- POSIX lock data (which leaked kernel bytes through F_GETLK)
- NT transaction responses and SMB1 EA lists (both wrapping their
pointer checks on 32-bit)
- short SESSION_SETUP responses (which sent stale buffer content
back to the server in the NTLMv2 AUTHENTICATE message)
- SMB2 READ data areas
- empty truncated fiemap responses
- Fix a heap overflow in SMB2_tcon() with UNC paths longer than
MAX_SHARENAME_LENGTH
- Fix a slab-out-of-bounds write when chmod() rewrites a security
descriptor that needs more room than was reserved
- Fix a use-after-free of the server info between the cifsd thread and
the release of the last session reference (reported by syzbot)
- Fix a use-after-free in the demultiplex thread when a receive error
reconnects and frees the read request still being processed
- Fix a double teardown of a tcon that the cached directory laundromat
took a reference on while it was being freed
- Fix a NULL pointer dereference when /proc/fs/cifs/DebugData is read
while the module is still initializing
* tag 'cifs-fixes-7.4-rc1' of https://git.manguebit.org/linux:
smb: client: validate SMB1 EA list bounds before parsing
smb: client: stop processing a read response after a receive error
smb: client: don't resurrect an exiting tcon from cached dir workers
smb: client: fix early procfs exposure race
smb: client: fix slab-out-of-bounds write in id_mode_to_cifs_acl()
smb: client: hold server info until cifsd exits
smb: client: fix fiemap wild read on empty truncated response
smb: client: validate the data area in SMB2_read()
smb: client: reject short SESSION_SETUP responses
smb: client: fix buffer overflow in SMB2_tcon()
smb: client: validate NT transaction response layout and offsets
smb: client: bound POSIX lock data area by response length
|
|
Pull fsverity fixes from Eric Biggers:
"Fixes for several bugs found by LLMs:
- Fix bypass of IPE's fsverity support, and a use-after-free in
certain cases, when FS_IOC_ENABLE_VERITY fails when almost done
- Fix FS_IOC_MEASURE_VERITY and FS_IOC_READ_VERITY_METADATA to no
longer bypass Landlock and AppArmor's read permission checks
- Be robust against the filesystem returning different values for a
file's verity descriptor length in two successive queries"
* tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fsverity/linux:
fsverity: Set S_VERITY only after rollback is no longer possible
fsverity: Tell LSMs about signature only after verity is enabled
fsverity: Be more careful with return value of ->get_verity_descriptor()
fsverity: Explicitly require FMODE_READ to retrieve hashes
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull thermal control fixes from Rafael Wysocki:
"These fix three issues related to thermal control:
- Fix CPU mask truncation in power limit trace event used by the
power allocator thermal governor (Hungyu Lin)
- Fix code indentation in create_s32_tzp_attr() and rearrange it to
use early return when applicable (Thorsten Blum)
- Allow cross builds of the Intel thermal tests (Sasha Levin)"
* tag 'thermal-7.4-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
thermal: sysfs: Fix indentation in create_s32_tzp_attr()
thermal: Fix CPU mask truncation in power limit trace event
selftests/thermal: allow cross builds of the Intel tests
|
|
net->smc.limit_smc_hs is a bool, but its sysctl entry uses
proc_dointvec_minmax() with .maxlen = sizeof(int), so the handler
accesses four bytes at the address of a one-byte field.
On little-endian this works with the extra bytes being written in struct
padding. On big-endian (tested on s390x) the bool sits at the most
significant byte of the int therefore the bool stays false and the "1"
goes into padding. The sysctl reads back 1 but SMC sockets created
afterwards see limit_smc_hs as disabled.
Fix this by using proc_dobool() handler and adjust the maxlen to the
right value.
Fixes: f8406a2fd279 ("net/smc: add sysctl for smc_limit_hs")
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Link: https://patch.msgid.link/20261028225350.3753-1-fmancera@suse.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull power management fixes from Rafael Wysocki:
"These address assorted issues in the power management code and update
documentation:
- Fix potential out-of-bounds access in deferred reset in the cpufreq
statistics code (Zhongqiu Han)
- Cancel HWP notify work in the intel_pstate driver cleanup to
prevent possible use-after-free from occurring (Tristan Madani)
- Adjust state names and descriptions for ACPI _LPI idle states in
the intel_idle driver to make them follow the driver's idle state
naming convention (Rafael Wysocki)
- Document the new pm_runtime_use_autosuspend() undo mechanism that
triggers automatically on driver exit (Joshua Crofts)
- Do not call suspend_ops->begin()/end() for suspend-to-idle to avoid
driver confusion (Ovidiu Panait)
- Make the energy model management code allocate the cpumask for
non-CPU perf domains to prevent out-of-bounds reads from occurring
in the EM netlink interface (Karl Mehltretter)"
* tag 'pm-7.4-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
PM: runtime: clarify pm_runtime_use_autosuspend() undo mechanism
cpufreq: stats: Fix potential out-of-bounds access in deferred reset
PM: suspend: Do not call suspend_ops->begin()/end() for s2idle
intel_idle: Adjust state names and descriptions for _LPI states
PM: EM: allocate the cpumask for every perf domain
cpufreq: intel_pstate: cancel HWP notify work in driver cleanup
|
|
James Hilliard says:
====================
ptp: make virtual clock sampling and teardown failure-safe
Fix virtual-clock sampling errors, registration rollback and parent
teardown in separate patches. Keep failed PHC reads out of the timecounter
and serialize extended samples with virtual-clock adjustments. Also
preserve the zero sentinel for packets without hardware timestamps.
Retain the existing cyclecounter mask, scaling and conversion windows.
Retry the first failed refresh promptly, then back off consecutive failures
while preserving regular two-second refresh attempts. Queue the first
refresh immediately after registration. Prolonged sampling gaps remain
subject to the existing half-wrap conversion window and full-wrap sampling
limit.
====================
Link: https://patch.msgid.link/20261026-ptp-vclock-sampling-v6-0-e705612541f1@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
Socket timestamp delivery converts hardware timestamps to a bound
virtual clock before checking whether a hardware timestamp is present.
A zero timestamp means that the packet has no hardware timestamp, but
timecounter_cyc2time() can turn that zero into a nonzero virtual time.
The socket then reports a hardware timestamp which was never supplied.
Return zero without conversion when the input timestamp is absent.
This also covers skb_get_tx_timestamp(), which checks for an absent
timestamp after the same conversion.
This was identified during review of virtual clock sampling changes.
Fixes: d7c088265588 ("net: socket: support hardware timestamp conversion to PHC bound")
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Link: https://patch.msgid.link/20261026-ptp-vclock-sampling-v6-5-e705612541f1@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
The extended and cross-timestamp callbacks sample the physical clock
before taking the virtual clock mutex. A concurrent frequency adjustment
can advance the timecounter and change its multiplier in between, so the
older sample is converted using a different frequency than the one in
effect when it was taken.
Take the mutex before sampling and keep it held through the conversion.
Retain timecounter_cyc2time() and its existing conversion window. A PHC
sample need not advance the counter: for example, e1000e explicitly
allows non-monotonic SYSTIM readings. Treating a slightly older sample
as a forward delta would instead advance virtual time by nearly a full
counter wrap.
This race was found by code inspection of the virtual clock sampling
paths.
Fixes: f0067ebfc42b ("ptp: add gettimex64() to virtual clocks.")
Fixes: 21fad63084c2 ("ptp: add getcrosststamp() to virtual clocks.")
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Link: https://patch.msgid.link/20261026-ptp-vclock-sampling-v6-4-e705612541f1@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
The cyclecounter read callback cannot report errors. ptp_vclock_read()
ignores the return from the physical clock and consumes its output even
if the read failed. A zero sample followed by the real counter can add
an extra 32-bit wrap to virtual time. This was found by code inspection
of reset-time PHC access and the virtual clock callers.
Sample the parent before calling timecounter_read() or timecounter_init()
and have the cyclecounter callback return the cached successful sample.
On failure, leave the counter and frequency adjustment unchanged and
return the PHC error to the caller.
Retry the first failed refresh after 10 ms instead of waiting another two
seconds. With the existing 32-bit nanosecond mask, timecounter_cyc2time()
can interpret a fresh timestamp as being in the past once the last
successful refresh is about 2.147 seconds old. An isolated read failure
should not deliberately defer the next attempt until that sample is four
seconds old.
Double the retry delay after consecutive failures, up to the normal
two-second refresh interval, and reset it after a successful refresh.
Each virtual clock has its own worker, and a failed parent read can involve
bus traffic and error logging. Backoff limits that repeated work during a
persistent failure while retaining a prompt first retry.
Limit each retry delay to the next regular refresh deadline. Otherwise,
backoff can skip the next two-second refresh opportunity and lose a full
counter wrap even when the parent has recovered before that refresh was
due. Advance the deadline when an attempt reaches it without resetting the
backoff, so sustained failures still settle at the normal refresh interval.
Keep the retry state private to each clock's auxiliary worker.
Take the initial sample and initialize the counter before publishing the
clock. Return an error pointer from registration and propagate its errno
through n_vclocks, including when the initial sample fails. Queue the first
refresh immediately after registration so registration latency is not
followed by another full refresh interval.
Keep the existing cyclecounter mask and scaling. These scheduling changes
do not guarantee timely samples: prolonged read failures or worker delays
can still exceed the half-wrap conversion window, and a gap of about
4.295 seconds between successful samples can lose a full counter wrap.
Do not assume that getcycles64() exposes a full-width nanosecond counter.
Fixes: 5d43f951b1ac ("ptp: add ptp virtual clock driver framework")
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Link: https://patch.msgid.link/20261026-ptp-vclock-sampling-v6-3-e705612541f1@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
n_vclocks_store() publishes the new clock count only after every child
has been registered. If a later registration fails, it returns without
unregistering the children already created by that request. Those clocks
are left out of n_vclocks, and a subsequent request can overwrite their
index entries without removing them.
Unregister the newly created children in reverse order and clear their
index entries on failure. Leave the previously installed clocks and
their count unchanged. The n_vclocks mutex serializes this rollback with
other sysfs changes, and parent removal drains the store before walking
the children.
This was found by code inspection while adding initial PHC sample error
handling to virtual clock registration.
Fixes: 73f37068d540 ("ptp: support ptp physical/virtual clocks conversion")
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Link: https://patch.msgid.link/20261026-ptp-vclock-sampling-v6-2-e705612541f1@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
Parent clock removal walks its virtual clocks before removing the
n_vclocks sysfs attribute. The mutex taken by ptp_vclock_in_use() is
released before that walk, so a concurrent sysfs deletion can pick the
same child and unregister and free its ptp_vclock a second time. A
reference held by the device iterator does not protect that separately
allocated virtual clock.
Remove n_vclocks before walking the children. Removing the attribute
prevents new stores and drains stores already running, without holding
n_vclocks_mux across a callback that needs that mutex. Skip virtual
clocks, which do not have this attribute.
This race was found by code inspection of virtual-clock registration
failure cleanup and parent removal.
Fixes: bfcbb76b0f59 ("ptp: unregister virtual clocks when unregistering physical clock.")
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Link: https://patch.msgid.link/20261026-ptp-vclock-sampling-v6-1-e705612541f1@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
