| Age | Commit message (Collapse) | Author |
|---|
|
git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux
Pull iommu fixes from Joerg Roedel:
"AMD IOMMU:
- Move PerfOpt management into the IOMMU domain attachment paths,
enabling it automatically for supported integrated GPUs in identity
mode and clearing it before switching to translated or blocked
domains
- Fix a boot panic in the GPU identity-mapping quirk when a GPU has
no upstream PCI bridge
- Clear the IOMMU SNP enable flag when RMP table initialization
fails, preventing subsequent initialization from assuming SNP setup
succeeded
- Check IVRS subtable types before parsing memory definitions,
avoiding bogus PCI segments caused by misinterpreting IVHD entries
under QEMU
- Remove an obsolete warning on device release that incorrectly fires
for devices required to remain attached to an identity domain"
* tag 'iommu-fixes-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux:
iommu/amd: Fix NULL pointer dereference for GPUs without upstream bridge
iommu/amd: remove obsolete domain pointer warning on release
iommu/amd: Skip non-IVMD entries when parsing IVRS memory definitions
iommu/amd: Clear amd_iommu_snp_en if snp_rmptable_init() fails
iommu/amd: Enable PerfOpt automatically for integrated GPUs
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull block fixes from Jens Axboe:
- NVMe fixes via Keith:
- nvme-tcp use-after-free in nvme_tcp_free_ctrl() on a failed
connect, and the nvme-rdma counterpart of the NULL queue->ctrl on
reconnect
- nvmet-rdma iWARP disconnect and device removal fixes
- nvmet-tcp: ask for the TLS record type on every receive, and bound
the connections accepted per work run so a connect flood can't
hold up port removal; nvmet-auth keep the old keys if the new ones
fail to decode; nvme-loop delete the controller if a reset fails
- nvmet-auth reject incomplete DHCHAP messages, and a keep-alive
timeout overflow
- nvmet locking and bounds fixes for tbkas reconnects and the
traddr/trsvcid configfs writes, don't leak stale memory in the ANA
log page, and cache the passthru reference across queue_response
- Wait for SRCU readers before splicing the namespace list, with a
new list_splice_init_srcu() helper, and drop an extra grace period
in nvmet_ns_disable()
- Unregister when pr_register() is given a zero new key, and don't
drop the cdev reference twice on cdev_device_add() failure
- Quirks for the ADATA XPG GAMMIX S70 BLADE and KIOXIA XG10d
- Various smaller fixes and cleanups
- blk-mq: end the request if getting a keyslot fails, which left the
in-flight count and zone write plug stuck, reset the queue state on
scheduler teardown so requests don't stall in software queues, and
fix an out-of-bounds read in blk_mq_free_rqs() after a failed
nr_hw_queues update
- Only serialize elevator switches of the same queue
- dma-buf bio fixes: don't use the bvec fast path for them, and only
fail the ones that need block layer PI
- Reject GPT entries with starting_lba > ending_lba
- Return the soft block size for compat BLKBSZGET, report the correct
discard alignment in sysfs, and account the flush sequence latency
only once in iocost
- virtio_blk fixes: synchronous quiesce in freeze, freeze the virtqueue
layout at probe time, clamp max_segments to the ring size, and fix
zone append sector reporting in batched completion
- null_blk zone fixes and a cache state reset
- zloop fixes
- ublk DEL_DEV_ASYNC permission check, and 32-bit selftest build
* tag 'block-7.4-20261106' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (52 commits)
nvmet: cache passthru reference in __nvmet_req_complete()
nvmet: drop the redundant auth check in nvmet_parse_io_cmd()
nvmet: bound the traddr and trsvcid configfs writes
nvmet: take subsys->lock when forcing reconnects for tbkas
nvme: wait for SRCU readers before splicing the namespace list
srcu: Add list_splice_init_srcu()
nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for KIOXIA XG10d
nvmet: don't return memory contents beyond valid data when reading ANA log page
nvme-pci: add NO_FUA quirk for ADATA XPG GAMMIX S70 BLADE
nvmet: drop the extra RCU grace period in nvmet_ns_disable()
nvme-keyring: Add a missing key_put() call to nvme_tls_key_lookup()
ublk: add missing DEL_DEV_ASYNC to unprivileged permission check
selftests: ublk: fix the build and file offsets on 32-bit
nvmet-rdma: disconnect a queue on device removal
nvmet-rdma: queue the release work under the mutex
nvmet-rdma: take a device off the list last
nvmet-tcp: limit the connections accepted per work run
nvmet-rdma: disconnect only established queues
nvmet-auth: keep the old keys if the new ones fail
nvmet-tcp: ask for the TLS record type on every receive
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull io_uring fixes from Jens Axboe:
- Only wait for in-flight requests on ring release if the closing task
actually uses the ring.
- SQPOLL fixes: do the return-to-userspace work in the SQPOLL thread,
as memory.high reclaim and blkcg throttling otherwise only ran at
thread exit, and don't set the stop bit on thread exit, which tripped
a WARN_ON_ONCE() in the ring teardown.
- Don't poll a writer for a read side hangup or for urgent data, as a
half-closed peer or unread OOB data kept the async poll of a send
ready on every re-arm.
- Cancel all matching poll requests in one pass for CANCEL_ALL rather
than restarting the hash walk per request.
- Hold uring_lock across the put_user() for the index-alloc file
install.
- Don't arm an hrtimer and schedule for a wait whose timeout has
already expired.
- Add a feature flag for the dma-buf registered buffer support.
- selftests 32-bit cast fix
* tag 'io_uring-7.4-20261106' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
io_uring: only wait for in-flight requests if the closing task uses the ring
io_uring: add feature flag for dma-buf support
io_uring/wait: don't sleep on an already expired timeout
io_uring/rsrc: hold uring_lock across index-alloc put_user
selftests/io_uring: cast optval through uintptr_t in mini_liburing.h
io_uring/poll: don't poll a writer for urgent data
io_uring/poll: don't poll a writer for a read side hangup
io_uring/poll: cancel all matching requests in one pass
io_uring/cancel: count all requests that a CANCEL_ALL cancels
io_uring/sqpoll: do the return-to-userspace work in the SQPOLL thread
io_uring/sqpoll: don't set IO_SQ_THREAD_SHOULD_STOP on thread exit
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
Pull udf, ext2, isofs and quota fixes from Jan Kara:
- Some disk format validation improvements for udf
- Fix isofs handling of dates before 1900
- Fix ext2 inadvertedly syncing buffer on every directory modification
- Fix ext2 O_DSYNC handling for direct IO
- A couple of smaller ext2 fixes
- Fix tmpfs quotas for root filesystem
- Unify my email addresses in MAINTAINERS file
* tag 'fs_for_v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
udf: Fix incorrect error code in udf_current_aext()
udf: Simplify udf_table_prealloc_blocks()
udf: don't use eloc after the end of the unallocated space table
udf: fix preallocation discarding before an empty allocation extent
udf: check the unallocated space table when it is loaded
udf: don't let the extent type hide an exhausted free-space table extent
ext2: preserve IOMAP_F_DIRTY for extending direct writes
udf, ext2, quota, jbd2: Unify email addresses in MAINTAINERS
isofs: handle Rock Ridge long-form dates before 1900
ext2: only flush DIRSYNC directories on every change
ext2: preserve completed DIO bytes when buffered fallback fails
ext2: take invalidate_lock in ext2_write_failed()
ext2: Make sbi an proper alias for EXT2_SB(sb) in ext2_fill_super()
udf: Validate extended attribute space is large enough
quota: initialize dquot cache before mounting rootfs
udf: validate vat20->lengthHeader and VAT inode size in udf_load_vat()
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
Pull fsnotify fixes from Jan Kara:
"Two small fixes for fsnotify"
* tag 'fsnotify_for_v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
inotify: do not coalesce rename events
fsnotify: preserve 64-bit pre-content ranges
|
|
PerfOpt is usable by integrated GPUs in identity mode. Enable it from
the IOMMU driver's domain attachment paths instead of requiring an
amdgpu policy knob and exported enable/disable interfaces.
Mark supported integrated GPUs as PerfOpt-eligible when selecting their
default identity domain. Skip GCR3 setup and ATS/PRI/PASID enablement for
these identity attachments, then enable PerfOpt after installing the DTE.
Clear PerfOpt before attaching an eligible GPU to a translated or blocked
domain, including unmanaged domains used by VFIO. Propagate failures to
clear bypass, but keep a completed identity attachment successful if the
optional PerfOpt enable fails.
Clear inherited PerfOpt state during initialization, including when a crash
kernel reuses device tables. Read feature support directly from hardware
because cached features may not be available yet, and stop initialization
if the initial clear fails.
Each IOMMU has at most one PerfOpt-eligible GPU, so track activation with a
boolean under the IOMMU lock. Preserve this state while clearing hardware
at suspend and shutdown, and restore the bit on resume only where it was
active. Do not enable PerfOpt unconditionally during early IOMMU
initialization.
Remove the amdgpu parameter, driver callbacks, and exported interfaces.
Translated attachments retain their normal device capability setup.
Suggested-by: Jason Gunthorpe <jgg@ziepe.ca>
Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Vasant Hegde <vasant.hegde@amd.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Paolo Abeni:
"Including fixes from Bluetooth, IPsec, WiFi and CAN.
Current release - regressions:
- eth: wwan: mhi_wwan_ctrl: send a DTR drop before it can be coalesced
Previous releases - regressions:
- core:
- use a dedicated flag to track disabled napi instances
- frags: limit the truesize of a reassembly queue
- reject a negative TCP header offset in qdisc_pkt_len_segs_init()y
- tcp:
- reject unhashed sockets during established lookups
- free ireq->ipv6_opt after an RCU grace period
- ipv6:
- fix fib6 walker UAF on NLM_F_REPLACE
- raw: fix use-after-free in rawv6_send_hdrinc()
- wifi:
- mac80211: reinstate IEEE80211_TX_CTL_AMPDU, fix ath9k stall
- brcmfmac: map msgbuf RX packet IDs bidirectional, fix firmware
crash loop
- vsock: size receive SKBs from declared payload
- xfrm: fix use-after-free of migrated state in xfrm_do_migrate_state()
- bluetooth: hci_sync: copy the LE accept list under hdev->lock
- ptp: fix use-after-free in extts_fifo_show() reading tsevqs unlocked
- can: protect the receive lists with a per-device lock
- eth:
- bnxt: don't keep MSI-X vectors added before FW reserves them
- vxlan: stop rejecting dynamic FDB entries with a nexthop ID
Previous releases - always broken:
- sched: sch_qfq: prevent aggregate self-replacement
- bridge: disable MRP ports before the FDB flush in del_nbp()
- mptcp: do not use fast open on MP_JOIN subflows
- ipv6: serialize multicast router socket ownership
- bluetooth: hci_core: keep link-key filtering inside RCU
- eth:
- atl1c: drop oversized RX frames instead of panicking
- stmmac: a bunch of XDP path fixes
- b53: enable IGMP and MLD control packet CPU copies"
* tag 'net-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (170 commits)
tcp: ipv6: free ireq->ipv6_opt after an RCU grace period
mptcp: pm: kernel: use RCU to free endpoint listeners
tcp: initialize send sequence numbers before deferring TFO
net: bridge: disable MRP ports before the FDB flush in del_nbp()
net: stmmac: set XDP metadata length on the page_pool RX path
bonding: fix missing down path on speed/duplex failure after FAIL->UP
ip6mr: Serialize multicast router socket ownership
bonding: 3ad: don't set BOND_LINK_FAIL on a slave that is not up
net: ethernet: ti: am65-cpsw-nuss: Enable timestamping of unicast PTP packets
net: count last skb of each sk_backlog pass in __release_sock()
net: 8139cp: keep Rx masked while NAPI is scheduled
net/smc: don't spin in smc_rx_recvmsg() while a pipe holds spliced data
net: dsa: b53: restore the NSP IMP port 2 Gbps mode
net: ethernet: bgmac: preserve forced 2.5 Gbps link speed
l2tp: only return sessions of the given tunnel in l2tp_session_get()
tipc: raise the minimum bearer MTU to fit tunnel and crypto overhead
mptcp: do not use Fast Open on MP_JOIN subflows
tcp: ipv6: do not read ireq->pktopts from tcp_v6_send_synack()
ipv4: Call rt_add_uncached_list() if !do_cache in ip_route_input_slow().
ipv6: Flush rt->from in rt6_uncached_list_flush_dev().
...
|
|
Pull virtio fixes from Michael Tsirkin:
"vhost, virtio, and vdpa bugfixes.
Just a bunch of fixes all over the place"
* tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: (38 commits)
virtio_pci: don't take the MSI mutex under cpu_hotplug_lock
virtio_ring: Initialize id field in packed indirect descriptors
vhost-scsi: fix page reference leak in misaligned I/O fallback
vduse: fix VA/PA confusion in the coherent page fault path
hwrng: virtio - prevent use-after-free after a failed restore
virtio: use consistent virtqueue terminology
virtio_balloon: initialize wakeup_lock before virtqueues are set up
MAINTAINERS: add missing virtio/vdpa/vduse/vhost headers
vhost-vdpa: initialize state before publishing cdev
vhost: reject backend enable without a kick file
vhost-scsi: reject delayed virtqueue setup
virtio_ring: use shadow flags when detaching split descriptors
vhost-scsi: validate event queue descriptor direction
vhost-scsi: do not count PI bytes in the data length
vdpa/snet: Don't discard the DPU error in snet_send_ctrl_msg()
iommu/virtio: Reset device before deleting virtqueues on probe failure
vhost: fix used ring index wrap in vhost_add_used_n_in_order
vhost-scsi: zero misaligned I/O bounce pages
vringh: reject empty / undersized indirect descriptor tables
virtio_blk: Reset device on probe error paths after DRIVER_OK
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/mm/core
Pull core memory management fixes from David Hildenbrand:
"Here's a bigger set of MM fixes that we didn't manage to have ready
for -rc1. All fixes are stable-worthy; the majority fixes nasty
long-standing bugs instead of being purely hotfixes.
We have some more of these kinds of stable-worthy fixes in the
pipeline, but we'll focus on the really urgent fixes as we get closer
to the release.
(Leaving urgent MM fixes lurking for various weeks is not good, but
having too many changes close to the release is also not good, it's
tricky ...)
Most issues were reported by Anthropic. Others were found while
reworking proposed fixes, and of course some of the fixes were just
reported and fixed on the mailing list.
All fixes were in linux-next for several days without changes. Some
commit IDs changed recently when I had to drop some non-stable fixes,
rebased to -rc1 and picked up more trailers.
This includes fixes to:
- THP (Transparent Huge Pages)
- GUP (Get User Pages)
- KSM (Kernel Samepage Merging)
- USERFAULTFD
- SHARED MEMORY (shmem/tmpfs/memfd)
- HUGETLB
- Core MM, PAGE CACHE and MEMORY RECLAIM
The main changes are:
- Prevent information leaks through memfd pinning, and out-of bounds
writes in GUP.
- Fix data loss in shmem, THP collapse, KSM and memfd pinning.
- Fix corruption and reference-counting errors with huge PMD/PUD
mappings, and incorrect TLB flushing and unmapping.
- Fix various use-after-free bugs, deadlocks and unkillable loops,
witha a focus on shmem swap handling.
- Fix execution-seal enforcement for memfd (incl. hugetlb).
Other changes fix accounting, quota and userfaultfd (un)registration
handling"
* tag 'mm-core-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/mm/core: (61 commits)
mm/gup: check folio->mapping under folio lock in memfd_pin_folios()
khugepaged: fix readahead lock inversion in collapse_file()
mm/huge_memory: set the mmu_gather page size in zap_huge_pud()
mm/memory-tiers: unregister empty tiers outside memory_tier_lock
mm/cma: don't release CMA pages still in use
mm/vma: don't leak the charge for stack growth
mm/huge_memory: split huge PUDs when adjusting VMA boundaries
mm/vma: call ->may_split() before a partial merge
mm/ksm: check large swap-cache folios before mapping them
mm/ksm: fix use of a freed anon_vma at swap-in
mm/ksm: reset the unstable trees of all nodes
mm: fix deadlock of mremap() against UFFDIO_MOVE
mm: fix unkillable fault loop on MAP_DROPPABLE memory
mm: fix unmap_mapping_range() beyond 4 GiB on 32-bit
mm/memory: reject remote COW faults on PFN mappings
mm/madvise: fix data loss from MADV_FREE on a KSM page
mm/mremap: fix moving PUD leaves
mm/mremap: recheck PUDs under the page table lock
mm/mremap: use pudp_huge_get_and_clear() when moving huge PUDs
mm/mmu_notifier: set ->mm only after mmgrab()
...
|
|
Pull NVMe fixes from Keith:
"- Fix a passthru reference leak that hangs disabling a target passthru
controller (7.4-rc1 regression)
- Fix namespace removal race with SRCU readers of the namespace list
- Fix use-after-free in nvme-tcp controller teardown after a failed
connect
- Fix NULL dereference in nvme-rdma when a reconnect adds queues
- nvmet-rdma device removal and disconnect fixes
- nvmet-tcp TLS record type handling and bounded connection accept work
- Don't leak stale memory in the nvmet ANA log page
- Harden nvmet against invalid input: keep-alive timeout overflow,
incomplete DHCHAP messages, configfs address bounds, arbitration
burst mask, and locking for traffic based keep alive updates
- Keep the old nvmet auth keys if setting new ones fails
- Delete nvme-loop controller on failed reset
- Fix extra cdev reference put and unregister on a zero pr_register key
- Fix a TLS key reference leak in the nvme keyring
- Quirks for ADATA XPG GAMMIX S70 BLADE and KIOXIA XG10d
- Speed up nvmet namespace disable
- Misc cleanups"
* tag 'nvme-7.4-2026-11-05' of git://git.infradead.org/nvme: (29 commits)
nvmet: cache passthru reference in __nvmet_req_complete()
nvmet: drop the redundant auth check in nvmet_parse_io_cmd()
nvmet: bound the traddr and trsvcid configfs writes
nvmet: take subsys->lock when forcing reconnects for tbkas
nvme: wait for SRCU readers before splicing the namespace list
srcu: Add list_splice_init_srcu()
nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for KIOXIA XG10d
nvmet: don't return memory contents beyond valid data when reading ANA log page
nvme-pci: add NO_FUA quirk for ADATA XPG GAMMIX S70 BLADE
nvmet: drop the extra RCU grace period in nvmet_ns_disable()
nvme-keyring: Add a missing key_put() call to nvme_tls_key_lookup()
nvmet-rdma: disconnect a queue on device removal
nvmet-rdma: queue the release work under the mutex
nvmet-rdma: take a device off the list last
nvmet-tcp: limit the connections accepted per work run
nvmet-rdma: disconnect only established queues
nvmet-auth: keep the old keys if the new ones fail
nvmet-tcp: ask for the TLS record type on every receive
nvme-loop: delete the controller if a reset fails
nvmet-rdma: remove dead allocated field in nvmet_rdma_rsp
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull MM fixes from Andrew Morton:
- "mm: avoid losing atomic VMA flags" (Lorenzo Stoakes):
Preserve guard-page and soft-dirty state across VMA changes. Prevent
fork and THP collapse from losing guard markers, and keep changes
visible to applications which track modified memory.
- "MAINTAINERS: MM updates" (David Hildenbrand):
Start routing more MM components through mm/core.git and add Zi Yan
as a THP co-maintainer. Update component coverage and integration
branches as part of the transition to separate MM component trees.
- "mm/hugetlb: fix mremap bugs" (Li Zhe):
Fix hugetlb mremap deadlocks and truncated move lengths. Prevent
userfaultfd poison markers from affecting other processes through
shared hugetlb page tables.
- "MAINTAINERS updates for page and slab allocators" (Vlastimil Babka):
Add Johannes Weiner as a page allocator co-maintainer and update page
and slab allocator entries for their component trees and integration
through mm/linux.
- "mm/damon: fix three race bugs in sysfs and core" (SJ Park):
Serialize DAMOS tuning updates and stop monitoring contexts from
sharing mutable state. Avoid interference between concurrent DAMON
instances and incorrect auto-tuning.
- "mm: page_alloc: fix reserve access for non-blocking requests"
(Johannes Weiner):
Stop ordinary non-blocking allocations from consuming reserves or
bypassing watermarks. Avoid severe allocation stalls under memory
pressure and preserve reserves for requests entitled to use them.
- "mm/cma: accept memory of CMA areas reserved with memblock_reserve()"
(Mike Rapoport):
Accept memory in fixed-address and multi-range CMA reservations.
Prevent fatal accesses to these pages in TDX and SEV-SNP guests.
- Summary of singletons in this merge:
Several fixes address crashes and unsafe memory access. Failed THP
collapse now flushes stale translations before releasing pages which
another collapse can free. A truncation race with MADV_DONTNEED could
remove still-mapped shmem pages and hit a kernel BUG. Large-folio
page-table scans no longer wrap addresses and crash near
address-space boundaries. Hugetlb vmemmap optimization no longer
causes write faults from racing reference-count operations.
Memory-cgroup teardown is also protected against reclaim work
accessing released state.
KSM now preserves userfaultfd protection during merging and
unmerging, and retains soft-dirty information needed by incremental
memory dumpers. Reads of /proc/PID/maps and related files no longer
omit continuously mapped ranges during concurrent VMA changes. There
are also fixes for expanding mixed mappings with mremap() and
querying NUMA placement with tagged addresses. Swapoff checks for
signals while processing large address spaces and shmem files, so it
can be interrupted without holding up suspend until the whole object
is read.
Costly allocations with cheap smaller-order fallbacks avoid direct
reclaim and compaction. Reported arm64 PostgreSQL tests improved from
58,602 to 157,246 transactions per second with defrag_mode disabled;
this addresses a buffered-write regression under fragmentation.
Background reclaim can recover on the highest-numbered memory node
after it has given up, and 32-bit writeback threshold calculations no
longer overflow and assign incorrect dirty-memory limits.
* tag 'mm-hotfixes-stable-2026-11-04-20-02' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (43 commits)
MAINTAINERS: move SLAB ALLOCATOR under MEMORY MANAGEMENT
MAINTAINERS: add Johannes as the page allocator co-maintainer
MAINTAINERS: route more MM changes through mm/core.git
MAINTAINERS: rename and move MEMORY HOT(UN)PLUG
MAINTAINERS: add missing files to MM component sections
MAINTAINERS: sort entries in MM sections
MAINTAINERS: add Zi Yan as co-maintainer for MEMORY MANAGEMENT - THP
MAINTAINERS: TMPFS (SHMEM FILESYSTEM) updates
MAINTAINERS: mention for-next branch in MEMORY MANAGEMENT - MEMORY MAP
mm: memcontrol: fix NULL pointer deref and UAF from high_work_func() on dying memcg
mm/cma: accept memory of CMA areas reserved at a fixed address
mm/cma: accept memory of multi-range CMA areas
mm/page_alloc: avoid direct reclaim and compaction for costly __GFP_NORETRY allocations
mm: page_alloc: remove ALLOC_NON_BLOCK from ALLOC_RESERVES
mm: page_alloc: do not give all non-blocking requests reserve access
mm/hugetlb_vmemmap: map the shared tail page writable
fs/proc/task_mmu: fix missed VMAs when reading /proc/PID/maps and friends
selftests/mm: fix khugepaged_race build with older glibc
mm/vma: update VMA iterator state on error in new VMA merge
mm/migrate: snapshot the source nid before the misplaced migration
...
|
|
list_splice_init_rcu() makes a list look empty to new readers, waits for
the current ones with the given sync function, and only then links the
entries into the new list. The sync function takes no argument, so it
can wait for RCU readers but not for the readers of an srcu_struct.
Passing synchronize_rcu() for a list read under SRCU still builds, but
leaves SRCU readers on the entries while the last one's next pointer is
moved onto the new list head. nvme_remove_namespaces() does this today.
Add list_splice_init_srcu(), which waits for the readers of the given
srcu_struct instead.
Cc: stable@vger.kernel.org
Suggested-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Qiliang Yuan <odys.yuan@gmail.com>
Reviewed-by: Paul E. McKenney <paulmck@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can
Marc Kleine-Budde says:
====================
pull-request: can 2026-11-03
this is a pull request of 15 patches for net/main.
The first patch is by Vincent Mailhol and drops CAN-XL frames on non
CAN-XL devices.
A patch by Kaixuan Li for the CAN ISOTP protocol improves the check
for the correct CAN CC/FD frames.
The next 3 patches are by Cunhao Lu and make CAN skb freeing safe in
any context in several CAN helper functions.
A series by Oliver Hartkopp et al fixes several problems in the CAN
net-layer:
Oliver Hartkopp contributes a patch to convert the unreliable
ARPHRD_CAN type check to the robust can_get_ml_priv(). Further a patch
that adds missing error checking to the bind callback of the CAN
ISO-TP protocol. Followed by converting the CAN RAW, BCM and ISO-TP
protocol to protect the receive lists with a per-device lock. Then the
RAW and ISO-TP protocols are converted to copy the socket options
outside of lock_sock().
3 patches target the CAN procfs: A patch by Runyu Xiao resets the CAN
pkg_stats using atomics, a patch by Oliver Hartkopp fixes the stats
calculation after a statistics reset. Followed by a patch to remove
kernel pointers from the output.
ChunYuZhiQiang contributes 2 patches for the CAN netlink interfaces,
to prevent waking up the CAN device, if the interface is down.
The last patch is by Liu Changjie and fixes the decoding of bulk USB
URBs in the Peak USB CAN driver.
linux-can-fixes-for-7.4-20261103
* tag 'linux-can-fixes-for-7.4-20261103' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can:
can: peak_usb: pcan_usb_fd_decode_buf(): accept short uCAN end-of-list records
can: dev: can_tdc_fill_info(): don't read automatic TDCV if interface is down
can: dev: can_fill_info(): don't wake up controller if interface is down
can: proc: remove pointers from CAN specific proc output
can: proc: skip stats calculation after reset in can_stat_update()
can: proc: reset pkg_stats atomics individually
can: raw, isotp: copy socket options outside of lock_sock()
can: protect the receive lists with a per-device lock
can: isotp: check the return values of can_rx_register() in isotp_bind()
can: replace ARPHRD_CAN type checks with can_get_ml_priv()
can: dev: can_put_echo_skb(): free skb on invalid echo index
can: skb: make CAN skb allocation failure paths IRQ-safe
can: skb: make echo skb freeing safe in any IRQ context
can: isotp: check the frame type, not just the length
can: dev: can_dropped_invalid_skb: drop CAN XL frames on non-CAN XL devices
====================
Link: https://patch.msgid.link/20261103204305.3211144-1-mkl@pengutronix.de
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
|
Add IORING_FEAT_REGBUF_TYPES, a feature flag that tells whether extended
buffer registration and dma-buf buffers are available (see
IO_REGBUF_TYPE_* and struct io_uring_regbuf_desc).
Fixes: 62e4bf5b25d44 ("io_uring/rsrc: add dmabuf backed registered buffers")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://patch.msgid.link/1b3ca4acc350aa5a397325d066533c4e5743a0f7.1793623347.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
|
|
When IPV6_FL_F_REFLECT is set on a listener, or the
net.ipv6.flowlabel_reflect sysctl has FLOWLABEL_REFLECT_ESTABLISHED,
tcp_v6_send_synack() reflects the flowlabel of the SYN packet,
reading it from the skb stored in ireq->pktopts.
Since commit 079096f103fa ("tcp/dccp: install syn_recv requests
into ehash table"), request sockets are processed without holding
the listener lock. A cpu can then process a retransmitted SYN for a
request socket, and send a SYNACK from tcp_check_req(), while another
cpu receives the ACK completing the 3WHS. tcp_v6_syn_recv_sock()
consumes ireq->pktopts when it wins the hashdance, and the first cpu
reads a freed skb:
BUG: KASAN: slab-use-after-free in tcp_v6_send_synack (include/linux/skbuff.h:3152 include/linux/ipv6.h:110 net/ipv6/tcp_ipv6.c:582)
Read of size 8 at addr ffff88802b08b608 by task poc-ipv6-pktopt/5076
Call Trace:
<IRQ>
tcp_v6_send_synack (include/linux/skbuff.h:3152 include/linux/ipv6.h:110 net/ipv6/tcp_ipv6.c:582)
tcp_rtx_synack (net/ipv4/tcp_output.c:4719)
tcp_check_req (net/ipv4/tcp_minisocks.c:762)
tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1826)
ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:479)
ip6_input_finish (net/ipv6/ip6_input.c:534)
ip6_input (include/linux/netfilter.h:325 include/linux/netfilter.h:319 net/ipv6/ip6_input.c:545)
ipv6_rcv (include/net/dst.h:481 net/ipv6/ip6_input.c:119 include/linux/netfilter.h:325 include/linux/netfilter.h:319 net/ipv6/ip6_input.c:351)
Freed by task 5074 on cpu 0 at 15.412249s:
kmem_cache_free (include/linux/kasan.h:235 mm/slub.c:2780 mm/slub.c:6630 mm/slub.c:6757)
tcp_v6_syn_recv_sock (net/ipv6/tcp_ipv6.c:1528)
tcp_check_req (net/ipv4/tcp_minisocks.c:934)
tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1826)
ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:479)
ip6_input_finish (net/ipv6/ip6_input.c:534)
Request socket migration has the same issue: reqsk_migrate_reset()
transfers ireq->pktopts to the clone, which can be freed while
another cpu holding a reference on the old request socket is still
sending a SYNACK.
The SYNACK timer itself is not an issue, because
inet_csk_reqsk_queue_drop() calls timer_delete_sync().
Save the flowlabel of the SYN in the request socket instead, so that
tcp_v6_send_synack() no longer needs ireq->pktopts.
As a side effect, the flowlabel is also reflected for SYN packets
reusing a TIME_WAIT socket, as ireq->pktopts is not set in this case.
Fixes: e994b2f0fb92 ("tcp: do not lock listener to process SYN packets")
Fixes: 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table")
Fixes: c905dee62232 ("tcp: Migrate TCP_NEW_SYN_RECV requests at retransmitting SYN+ACKs.")
Reported-by: Anvik Loitongbam <permissiontogallop@gmail.com>
Reported-by: Yingjie Wang <x-professor@outlook.com>
Closes: https://lore.kernel.org/netdev/82c31e4d5043f3dbd11b44177cfba779d335aae3.1793599929.git.x-professor@outlook.com/
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Reviewed-by: Neal Cardwell <ncardwell@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20261102075441.3771550-1-edumazet@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless
Johannes Berg says:
====================
A few fixes to start with:
- wext: fix notifier netns interaction
- rsi: avoid TID OOB access
- mac80211: reload pointer, fix A-MPDU flags
- brcmfmac: fix DMA regression
- cfg80211: fix regdb validation
* tag 'wireless-2026-11-02' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless:
wifi: mac80211: reinstate IEEE80211_TX_CTL_AMPDU flag in ieee80211_tx_prep_agg()
wifi: cfg80211: fix out-of-bounds read in valid_rule()
wifi: rsi: Skip TX aggregation setup for non-QoS frames
wifi: wext: Limit notifier event flushes to the device's netns
wifi: brcmfmac: map msgbuf RX packet IDs bidirectional
wifi: mac80211: reload TDLS header pointer after skb_linearize()
====================
Link: https://patch.msgid.link/20261102104649.727621-3-johannes@sipsolutions.net
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
|
ipmr_get_route() and ip6mr_get_route() queue synthetic skbs on the
unresolved MFC entry to answer RTM_GETROUTE requests once the route
is resolved. These skbs carry a fake IP header with version 0, and
ipmr_cache_resolve(), ipmr_destroy_unres(), ip6mr_cache_resolve()
and ip6mr_destroy_unres() rely on this in-band tag to tell them
apart from regular packets queued by the input and output paths.
The IP version is only validated once, in ip_rcv_core() and
ip6_rcv_core(). A netfilter hook running later, for instance an
nftables payload statement in a PREROUTING chain owned by an
unprivileged user namespace, can rewrite the first header byte to
zero. The SRv6 End.DX6 action also passes the decapsulated packet
to ip6_mr_input() without checking that the inner header version
is 6. If no MFC entry exists, the packet is queued and later handled
as a netlink request: its payload is treated as an nlmsghdr and
written to, mr_fill_mroute() may call skb_put() on a nonlinear skb
(hitting SKB_LINEAR_ASSERT()), and the skb is unicast to a netlink
portid taken from stale IPCB/IP6CB bytes in skb->cb[].
ipmr_cache_report() also relies on the same tag since
commit 94a6736bb5ab ("ipmr: only copy pktinfo to cache reports").
Stop trusting packet contents: queue route queries on a dedicated
nl_queries list in the unresolved MFC entry, and pass an explicit
nl_query flag from the callers.
The per-entry limit of four queued skbs now applies to both lists
combined, as before. The synthetic header keeps version 0, since it
is copied into the NOCACHE report delivered to the mroute socket.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Fixes: 7bc570c8b4f7 ("[IPV6] MROUTE: Support multicast forwarding.")
Reported-by: Katherine Leaver <kleaver@janestreet.com>
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20261030092303.2749386-1-edumazet@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
|
KSM folios are always small, but their shared swap slots can be read
back as part of a large folio in the swap cache. ksm_might_need_to_copy()
skips large folios, so another process can map a page with an incompatible
anon_vma or page index. Reverse mapping then cannot find the new
mapping, preventing migration or reclaim.
Apply the same compatibility checks to large folios as to small ones.
Pass the page corresponding to the swap entry and copy only that page
when necessary. In do_swap_page()'s copy path, decrement only that slot's
swap count, because the source swap-cache folio can now be large.
Fix generated by an LLM and sent by Chris Mason in private.
Fixes: f1879e8a0c60 ("mm, swap: never bypass the swap cache even for SWP_SYNCHRONOUS_IO")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <mason@kernel.org>
Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Tested-by: Muhammad Usama Anjum <usama.anjum@arm.com>
Link: https://patch.msgid.link/20261031-fixes_core-v3-41-d6437171ecc3@kernel.org
Reviewed-by: Lance Yang <lance.yang@linux.dev>
Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
|
|
With per-VMA locks, UFFDIO_MOVE can run concurrently with mremap()
on different VMAs in the same mm. Those VMAs can share page tables, so
both operations can acquire the same pair of page-table locks.
UFFDIO_MOVE orders the locks by address, while mremap() takes the source
lock first. These conflicting orders can deadlock; mremap() holding
mmap_lock for writing no longer helps.
Move double_pt_lock() and double_pt_unlock() to mm/internal.h and use
them for all page-table moves in mremap(). Preserve the source entry
checks after acquiring both locks. Remove the comments claiming that
exclusive mmap_lock makes lock ordering irrelevant.
In move_ptes(), make sure to just recheck source and destination PMD
after taking the locks and drop the overly-long comment.
Fix generated by an LLM and sent by Chris Mason in private.
[ david: use new helpers consistently; simplify description and comments;
move_ptes() fixup ]
Fixes: 867a43a34ff8 ("userfaultfd: use per-vma locks in userfaultfd operations")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <mason@kernel.org>
Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Acked-by: Muchun Song <muchun.song@linux.dev>
Tested-by: Muhammad Usama Anjum <usama.anjum@arm.com>
Link: https://patch.msgid.link/20261031-fixes_core-v3-38-d6437171ecc3@kernel.org
Reviewed-by: Lance Yang <lance.yang@linux.dev>
Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
|
|
When an ordinary MMU notifier rejects a non-blocking invalidation, the
interval invalidation started beforehand is left unfinished: the caller
skips mmu_notifier_invalidate_range_end(). Subsequent interval notifier
operations can then wait forever.
The only in-tree trigger is nouveau SVM, which uses both notifier types
and rejects non-blocking invalidations. Reaping via the OOM reaper or
process_mrelease() can therefore leave the GPU fault worker stuck,
holding a reference that prevents the dying process's address space
and memory from being freed.
End the interval invalidation when an ordinary notifier fails a
non-blocking invalidation, like mn_itree_invalidate() already does when
an interval notifier fails. Make that handling clearer in the
documentation of mmu_notifier_invalidate_range_start_nonblock().
Fix generated by an LLM and sent by Josef Bacik in private.
Fixes: 99cb252f5e68 ("mm/mmu_notifier: add an interval tree notifier")
Cc: stable@vger.kernel.org
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
[ david: simplify description, update function doc ]
Acked-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Tested-by: Muhammad Usama Anjum <usama.anjum@arm.com>
Link: https://patch.msgid.link/20261031-fixes_core-v3-28-d6437171ecc3@kernel.org
Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
|
|
__tlb_adjust_range() takes the size of the range which has to be flushed
as an unsigned int. Its callers, tlb_flush_{pte,pmd,pud,p4d}_range(), get
and pass an unsigned long. Consequently, a range that is 4 GiB or larger
gets truncated, possibly to 0.
On arm64 with hugetlb, a 64k kernel can have 16 GiB hugetlb folios
mapped contiguously at the PMD level and flush them when unmapping, and a
16k kernel can flush 64 GiB PUDs through tlb_unshare_pmd_ptdesc(). So
at least these two scenarios are affected.
Fix it by flushing the proper range instead of the truncated one by
properly using "unsigned long" for range_size.
Fix generated by an LLM and sent by Josef Bacik in private.
Fixes: b528e4b6405b ("mm/hugetlb: add tlb_remove_hugetlb_entry for handling hugetlb pages")
Fixes: 8ce720d5bd91 ("mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather")
Cc: stable@vger.kernel.org
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Acked-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
[ david: use two-tab indent, simplify description ]
Reviewed-by: Qi Zheng <qi.zheng@linux.dev>
Reviewed-by: Gregory Price (Meta) <gourry@gourry.net>
Tested-by: Gregory Price (Meta) <gourry@gourry.net>
Reviewed-by: Dev Jain <dev.jain@arm.com>
Reviewed-by: Muchun Song <muchun.song@linux.dev>
Reviewed-by: Pedro Falcato <pfalcato@suse.de>
Reviewed-by: SJ Park <sj@kernel.org>
Tested-by: Muhammad Usama Anjum <usama.anjum@arm.com>
Link: https://patch.msgid.link/20261031-fixes_core-v3-27-d6437171ecc3@kernel.org
Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
|
|
The proc content in /proc/net/can/ and /proc/net/can-bcm/ is intended to
check the internal filter lists (af_can, can_raw) and the efficiency and
functionality of can_bcm jobs. While exposing kernel addresses was
acceptable when this code was written the times have changed and multiple
attempts have been made to hash or remove such now sensitive data.
This patch removes the disclosure of pointers and instead provides the
function names and sock inode numbers when available. When the function
name can not be resolved (e.g. KALLSYMS=n or stripped module symbols)
%ps would fall back to the raw text address. Therefore (unknown) is
printed instead in this case. As there's no known tooling around the CAN
specific proc output breaking the ABI with this rework creates no issue.
Suggested-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Link: https://patch.msgid.link/20261027-can-rx-lock-v12-7-eb5afc2d8b9b@hartkopp.net
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
|
|
The receive lists of a CAN device are located in the device's
can_ml_priv and travel with the device when it is moved to another
network namespace. But they are protected by the per-netns
rcvlists_lock. So can_rx_unregister() needs dev_net(dev) to pick the
right lock and silently returns when the passed namespace does not
match dev_net(dev) anymore.
isotp_release() and bcm_release() leave their notifier list before they
take any lock that serializes against the netdev notifier, which runs
under RTNL. When the bound device is moved to another namespace in this
window, the notifier skips the socket and the release path has to remove
the filters itself. isotp_release() passes the socket's namespace, which
does not match dev_net(dev) anymore. bcm_rx_unreg() passes dev_net(dev),
which can_rx_unregister() reads again for its check, so a namespace
change between both reads makes the check fail as well. In both cases
can_rx_unregister() silently returns. As can_rx_register() stores
rcv->sk without a reference, the remaining receivers point to the freed
socket (isotp) or the freed op (bcm):
BUG: KASAN: use-after-free in isotp_rcv+0x1570/0x24d0
Read of size 1 at addr ffff888118130552 by task isotp_ns_uaf/578
can_rcv_filter+0x4af/0x8c0
can_receive+0x28d/0x3c0
can_rcv+0x2a9/0x310
__netif_receive_skb_one_core+0x21a/0x260
process_backlog+0x210/0x760
Besides this, the lists of a device are protected by the rcvlists_lock
of the namespace that is passed in. Callers which pass dev_net(dev) read
it at different times, so the same lists may be modified under the locks
of different namespaces while the device is moved.
Taking RTNL in these release paths is no option: raw_bind(),
raw_setsockopt() and raw_release() already hold RTNL while adding and
removing up to CAN_RAW_FILTER_MAX filters per socket, which unprivileged
users can trigger repeatedly and which makes RTNL a global bottleneck.
Instead fix the root cause and add a spinlock to struct
can_dev_rcv_lists, which protects the receive lists of a CAN device or
the 'any' CAN device lists of a namespace. It is initialized in
can_set_ml_priv(), which is used by all CAN network devices. With this,
can_rx_unregister() finds the subscription independently of the
current namespace of the device. The protocols keep the device valid
with their tracked references. The per-netns rcvlists_lock only protects
the receive list statistics anymore, and CAN_RAW, CAN_BCM and CAN_ISOTP
pass the namespace that has been used for can_rx_register().
So isotp_release() and bcm_release() now remove their filters correctly
without RTNL, and raw_release(), raw_setsockopt(), raw_bind() and
isotp_bind() do not need RTNL anymore and add and remove their filters
under lock_sock(). To serialize bind() with NETDEV_UNREGISTER, bind()
publishes the device inside the RCU section of its lookup, and
raw_notify() and isotp_notify() recheck the bound device under lock_sock().
As RTNL does not keep NETDEV_DOWN out of bind() anymore, bind() checks
IFF_UP after publishing the bound device, with a barrier pair against
raw_notify() and isotp_notify(), so a down transition during bind() is
still reported with ENETDOWN.
Fixes: 20bab8b88baa ("can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER")
Fixes: 8e8cda6d737d ("can: initial support for network namespaces")
Reported-by: Norbert Szetei <norbert@doyensec.com>
Link: https://lore.kernel.org/linux-can/CEA6A38A-2646-4ADA-95B4-CBAE2F301A8E@doyensec.com/
Cc: stable@vger.kernel.org
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Link: https://patch.msgid.link/20261027-can-rx-lock-v12-3-eb5afc2d8b9b@hartkopp.net
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
|
|
can_put_echo_skb() can be called with hardware interrupts disabled. Its
direct drop paths use kfree_skb(), while can_create_echo_skb() uses
kfree_skb() when cloning fails and consume_skb() after a successful clone.
None of these helpers is safe in every IRQ context.
Use dev_kfree_skb_any() for all drop paths and dev_consume_skb_any() when
consuming a successfully cloned skb. This preserves the respective skb drop
and consumed semantics regardless of the caller IRQ context.
Signed-off-by: Cunhao Lu <1579567540@qq.com>
Link: https://patch.msgid.link/tencent_E84809CF236D0137885E7E4E4D58340B3208@qq.com
Cc: stable@kernel.org
Fixes: ae64438be192 ("can: dev: fix skb drop check")
Fixes: 0ae89beb283a ("can: add destructor for self generated skbs")
Fixes: 3ccd4c6167d3 ("can: Unify droping of invalid tx skbs and netdev stats")
Fixes: 39549eef3587 ("can: CAN Network device driver and Netlink interface")
[mkl: also convert can_dropped_invalid_skb(), can_dev_dropped_skb()]
[mkl: add stable on Cc + add Fixes tags]
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
FAQ:
Q: What about the comment in drivers/net/can/virtio_can.c
virtio_can_start_xmit()? The error handling for virtqueue_add_sgs()
mentions that can_put_echo_skb() consumes the skb via consume_skb().
A: The comment in virtio_can.c will be updated in a separate series, to
ease backporting of this patch.
[mkl: add FAQ section]
|
|
Pull late 9p updates from Dominique Martinet:
"This is mostly a huge wave of LLM-driven fixes. At least the LLM fixes
sort of slowed down recently? Or maybe it's just the time of the cycle
and/or I got used to it, time will tell...
A few exceptions:
- a new vsock transport was added, since it's a variant of the
existing fd/tcp transport there is little harm in taking it in
- there's an incomplete fix for when file actual size doesn't match
the size attribute (e.g. exports of sysfs).
The fix addresses when st_size > actual size with cache=none but
just about everything else is still broken (st_size=0 with actual
data regardless of cache, or with data cache st_size > actual is
still wrong and so are symlinks with 0 size)...
Maybe at some point I'll find time to understand how netfs works
and address these :|
- some fixes for the usbg transport by its author, thank you!"
* tag '9p-for-7.4-rc2' of https://github.com/martinetd/linux: (39 commits)
9p: optimize p9_fcall struct
9p: reject RERROR/RLERROR with zero errcode
9p: do not store the create fid on special files
9p: fall back to the normal open path for non-regular files
9p: don't decrement a server-owned zero nlink
9p: fix kernel-doc warning for enum p9_session_flags
9p: treat read return values of 0 as EOF
9p/xen: validate the response size from the backend
9p: fix typo in file header comments
9p: remove duplicated assignment in v9fs_fill_super()
9p: fix typos and wrong parameter docs in vfs_inode.c
9p: fix header guard comment in acl.h
net/9p/usbg: clear stale client pointer on close
net/9p/usbg: remove bogus context initialization in alloc_requests
net/9p/usbg: fix out_req buffer leak in disable_usb9pfs
net/9p/usbg: call disable_usb9pfs() from usb9pfs_disable()
net/9p/usbg: always reset completion when disconnecting
net/9p/usbg: set client to Disconnected on usb9pfs_disable
net/9p/usbg: also disable endpoints on p9_usbg_close
net/9p/usbg: Fix use-after-free in disable_usb9pfs()
...
|
|
The take_dentry_name_snapshot() function would keep trying to take a
reference on a dentry name forever, even if that dentry had been
released and the dentry name would never become valid.
All normal users held a reference to the dentry, but this "dentry name
is dead" could hit the overlayfs RCU walk case, and Amir fixed it by
adding a new try_take_dentry_name_snapshot() that returns on failure.
See commit 15c6bd5cf109 ("vfs: add try_take_dentry_name_snapshot()").
However, that fix was uncomfortably ugly, and the new "try" version was
subtly buggy in that it would also fail spuriously during a rename. The
only current user of that doesn't really care: a spurious failure would
result in the lookup just exiting RCU mode and being retried with the
dentry ref held (using the non-try version), but this all just rubbed me
the wrong way.
Instead of introducing a new and differently buggy helper, this just
makes take_dentry_name_snapshot() deal with all these situations
correctly.
It does that by instead of retrying when the external name reference
cannot be taken, it now retries purely based on the dentry sequence
counter. That means that if the external name reference failed due to a
rename, we will correctly retry it, but if it fails because the dentry
is dead and the name really is gone, it will now return that failure
rather than looping forever.
In this model, take_dentry_name_snapshot() will never return a failure
when a dentry ref is held, so the existing non-overlayfs users don't
need to care and they can safely ignore the return value.
And users that don't hold a reference (ie currently only that overlayfs
case) can use the improved take_dentry_name_snapshot() function safely
and it won't loop forever when racing with the dentry being free'd.
To make this all really robust and easy to use for any possible new use
cases, the failure case will not just return false, but also make sure
that the returned name will be empty, and that you can still call
release_dentry_name_snapshot() on the name.
But since there won't actually be anything to release on failure, you
can also do what overlayfs does: return an error and *not* call the
release function.
IOW, instead of two different functions that each had their own problem
cases, we're now back to just one single function that is robust and
easy to use in all situations. Knock wood.
Link: https://lore.kernel.org/all/CAHk-=wiPhTLn1p0ZHx-7SMdk4_zazqDK1k7MMEn9scRfqeDgtw@mail.gmail.com/
Fixes: 15c6bd5cf109 ("vfs: add try_take_dentry_name_snapshot()")
Cc: Amir Goldstein <amir73il@gmail.com>
Cc: Miklos Szeredi <miklos@szeredi.hu>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
Since commit 4ff58d6bc9dd ("block: serialize elevator changes for the
same queue using a writer lock"), a write to queue/scheduler fails with
-EBUSY whenever something else holds set->update_nr_hwq_lock. That
commit takes the lock for write, and it has to be a trylock because of
commit ce8ee8583ed8 ("block: use trylock to avoid lockdep circular
dependency in sysfs").
The lock covers the whole tag set, so it is easy to hit. A scheduler
write fails while another queue of the set is switching, or while a
sibling disk of the same SCSI host or NVMe controller is added or
removed. This matches the udev failures reported on 7.2.
Go back to taking the lock for read. The write lock was there to keep
two switches of one queue from overlapping in elevator_change_done(),
which touches the elevator sysfs and debugfs entries outside of
q->elevator_lock. Use QUEUE_FLAG_NO_ELV_SWITCH for that instead: a
write sets it before elevator_change() and clears it afterwards, and a
write that finds it set returns -EBUSY. Disk removal already sets the
flag under the write lock, so no switch can start once it has run.
Writes to the same queue, and writes that race with an nr_hw_queues
update, an nr_requests write or disk removal, can still get -EBUSY, as
with 4ff58d6bc9dd. A write to a disk that is being removed now gets
-EBUSY instead of -ENOENT.
Fixes: 4ff58d6bc9dd ("block: serialize elevator changes for the same queue using a writer lock")
Cc: stable@vger.kernel.org # v7.2+
Reported-by: Reindl Harald <h.reindl@thelounge.net>
Closes: https://lore.kernel.org/r/077dd42e-cbc9-4c23-a5ef-3d20e4fc7757@thelounge.net
Suggested-by: Nilay Shroff <nilay@linux.ibm.com>
Assisted-by: LLM
Signed-off-by: Laveesh Bansal <laveeshb@laveeshbansal.com>
Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
Link: https://patch.msgid.link/20261031044141.5569-1-laveeshb@laveeshbansal.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec
Steffen Klassert says:
====================
pull request (net): ipsec 2026-11-02
1) xfrm: retry inexact policy lookup after node reinsertion
Detect a concurrent change of the inexact policy tree while it is
searched and retry the lookup, so an insertion can't make it return
the wrong policy.
2) xfrm: interface: validate the IP header on xmit
Validate the IP header in xfrmi_xmit() like the IP receive path
does, so packets injected into an xfrm interface can't reach the
output path with a malformed header.
3) xfrm: zero-initialise km_event in the replay-notify path
Zero-initialise the replay event so the netlink header of a
kernel-originated replay notification no longer carries
uninitialised stack values.
4) xfrm: espintcp: reorder operations within espintcp_init_sk
Publish the ESP-in-TCP context before installing the socket
callbacks, so an early callback can't dereference a context that
isn't set up yet.
5) xfrm: state: reject mark with bits outside its mask on add
Reject a mark with bits outside its mask on state insert instead
of silently truncating it, so a lookup can't be given a mark that
never matches.
6) xfrm: state: reject mark with bits outside its mask on ALLOCSPI
Apply the same mark validation to ALLOCSPI, keeping the state and
policy insert paths consistent.
7) xfrm: policy: reject mark with bits outside its mask on add
Apply the same mark validation to policy insert, so a policy can't
be stored with a mark that never matches.
8) xfrm: state: exact mark/mask match for SPI-keyed control-plane SA lookups
Match mark and mask exactly in the SPI-keyed netlink SA lookups, so
a catch-all SA can no longer shadow a more specific one.
9) xfrm: fix use-after-free of migrated state in xfrm_do_migrate_state()
Hold the cloned state for the whole migration, so a concurrent
delete can't free it while it is still in use.
10) xfrm: fix hw offload state leak on xfrm_do_migrate_state() error path
Remove the hardware offload of the cloned state on the migration
error path, so the offloaded SA entry isn't leaked.
11) xfrm: include mark in MIGRATE_STATE SA collision check
Include the mark in the SA collision check, so a migration that
only changes the mark can't install a duplicate SA tuple.
12) xfrm: pass extack through to xfrm_init_replay() from xfrm_init_state()
Pass the extack to xfrm_init_replay(), so replay window errors can
be reported to userspace.
13) docs: xfrm: include mark in XFRM_MSG_MIGRATE_STATE EEXIST tuple
Document the mark as part of the EEXIST tuple of the SA migration
request.
14) xfrm4: use a full socket for local errors
Resolve the socket owner with skb_to_full_sk() in the IPv4 local
error path, so a TCP request socket isn't used as a full socket.
Please pull or let me know if there are problems.
ipsec-2026-11-02
* tag 'ipsec-2026-11-02' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec:
xfrm4: use a full socket for local errors
docs: xfrm: include mark in XFRM_MSG_MIGRATE_STATE EEXIST tuple
xfrm: pass extack through to xfrm_init_replay() from xfrm_init_state()
xfrm: include mark in MIGRATE_STATE SA collision check
xfrm: fix hw offload state leak on xfrm_do_migrate_state() error path
xfrm: fix use-after-free of migrated state in xfrm_do_migrate_state()
xfrm: state: exact mark/mask match for SPI-keyed control-plane SA lookups
xfrm: policy: reject mark with bits outside its mask on add
xfrm: state: reject mark with bits outside its mask on ALLOCSPI
xfrm: state: reject mark with bits outside its mask on add
xfrm: espintcp: reorder operations within espintcp_init_sk
xfrm: zero-initialise km_event in the replay-notify path
xfrm: interface: validate the IP header on xmit
xfrm: retry inexact policy lookup after node reinsertion
====================
Link: https://patch.msgid.link/20261102100451.2505200-1-steffen.klassert@secunet.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth
Luiz Augusto von Dentz says:
====================
bluetooth pull request for net:
Core:
- hci_core: Initialize IRK before publication
- hci_core: Initialize link key before publication
- hci_core: Initialize LTK before publication
- hci_core: Fix queuing rx_work while workqueue is drained
- hci_core: Keep link-key filtering inside RCU
- hci_core: Initialize advertising RPA work only once
- hci_sync: Fix invalid Supervision_Timeout in LE Set Default Rate
- hci_sync: re-enable legacy advertising on resume
- hci_sync: pause advertising for the scan address update
- hci_sync: Update the CIS host feature when enabling LE
- hci_sync: Copy the LE accept list under hdev->lock
- hci_sync: Protect resolving-list lookups
- hci_sync: Copy the resolving-list IRK under RCU
- hci_event: Clear explicit connect state on LE connection
- L2CAP: Hold incoming data until encryption key size is known
- L2CAP: Ignore connection responses with wrong ident
- SMP: Protect link keys during LTK derivation
- SMP: Protect LTK encryption with RCU
- MGMT: Return RFKILLED for Set Powered on a blocked controller
- MGMT: Clear disabled connection parameters when loading none
- MGMT: Fix discovery stuck after a failed Stop Discovery
- validate retained LE Create CIS command length
- validate retained LE Set CIG Parameters command length
Drivers:
- btintel: fix buffer over-read in fw payload
- btmtk: drop zero-length ISO packets from endpoint padding
- btmtk: bound the ISO payload length by the controller's MTU
- btmtk: derive the firmware ISO setting from MTK_ISO_THRESHOLD
- btmtk: fix error handling in btmtk_usb_isointf_init()
- qca: Fix the WCN3950 NVM baud rate offset
* tag 'for-net-2026-11-02' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: (30 commits)
Bluetooth: MGMT: Fix discovery stuck after a failed Stop Discovery
Bluetooth: validate retained LE Set CIG Parameters command length
Bluetooth: validate retained LE Create CIS command length
Bluetooth: hci_core: Initialize advertising RPA work only once
Bluetooth: L2CAP: Ignore connection responses with wrong ident
Bluetooth: MGMT: Clear disabled connection parameters when loading none
Bluetooth: hci_sync: Copy the resolving-list IRK under RCU
Bluetooth: SMP: Protect LTK encryption with RCU
Bluetooth: SMP: Protect link keys during LTK derivation
Bluetooth: hci_core: Keep link-key filtering inside RCU
Bluetooth: btmtk: fix error handling in btmtk_usb_isointf_init()
Bluetooth: qca: Fix the WCN3950 NVM baud rate offset
Bluetooth: MGMT: Return RFKILLED for Set Powered on a blocked controller
Bluetooth: hci_sync: Protect resolving-list lookups
Bluetooth: hci_sync: Copy the LE accept list under hdev->lock
Bluetooth: btmtk: derive the firmware ISO setting from MTK_ISO_THRESHOLD
Bluetooth: btmtk: bound the ISO payload length by the controller's MTU
Bluetooth: btmtk: drop zero-length ISO packets from endpoint padding
Bluetooth: hci_sync: Update the CIS host feature when enabling LE
Bluetooth: L2CAP: Hold incoming data until encryption key size is known
...
====================
Link: https://patch.msgid.link/20261102222018.2610820-1-luiz.dentz@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
|
When an event queue nears full, the hardware coalesces the per-CQ
GDMA_EQE_COMPLETION notifications into a single throttle EQE (type 4)
that carries no cq_id. The driver does not handle this event type, so
it falls through to the default case and is dropped. Any CQ whose
completion notification was replaced by the throttle EQE can remain
unserviced, causing its queue to stall.
This was observed internally as a TX stall:
ens1: NETDEV WATCHDOG: CPU: 45: transmit queue 1 timed out 15133 ms
mana 7870:00:00.0: HWC: Request timed out: 60000 ms
mana 7870:00:00.0: Gf stats wk handler: gf stats query timed out.
ens1: NETDEV WATCHDOG: CPU: 20: transmit queue 0 timed out 15859 ms
ens1: NETDEV WATCHDOG: CPU: 15: transmit queue 0 timed out 31731 ms
ens1: NETDEV WATCHDOG: CPU: 21: transmit queue 0 timed out 47603 ms
ens1: NETDEV WATCHDOG: CPU: 42: transmit queue 0 timed out 62451 ms
Handle the throttle EQE:
- Record up to two child CQs per EQ when a CQ is created with a parent
EQ. A mana_en EQ serves one TX CQ and one RX CQ, and the HWC EQ
serves the HWC CQ.
- On a throttle EQE, call the callback of each child CQ that is still
in cq_table[].
- Before a child CQ is freed, unlink it from its parent EQ and from
cq_table[] in mana_gd_detach_cq(), then wait for an RCU
grace period, because mana_gd_intr() reads both under
rcu_read_lock(). mana_destroy_txq() and mana_destroy_rxq() detach
the CQ before deleting its NAPI, so the synchronize_net() that NAPI
deletion already needs also covers the CQ. mana_hwc_destroy_channel()
detaches the HWC CQ and waits for a grace period before freeing the
HWC queues.
- Advertise the capability bit for throttled EQE.
- Add a throttle eqe counter per queue.
Fixes: ca9c54d2d6a5 ("net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)")
Cc: stable@vger.kernel.org
Signed-off-by: Sahil Chandna <sahilchandna@linux.microsoft.com>
Link: https://patch.msgid.link/20261028084020.2051254-1-sahilchandna@linux.microsoft.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
|
Reading /proc/PID/maps under per-VMA locks can skip continuously mapped
address ranges during concurrent VMA splits or merges. This violates the
guarantee in Documentation/filesystems/proc.rst:
"If there is something at a given vaddr during the entirety of the
life of the smaps/maps walk, there will be some output for it."
lock_next_vma() reuses a tree iterator across calls under RCU. The iterator
remembers the range of its last entry. When its node is replaced,
mas_next_slot() walks the tree again at the last index of that range, then
advances past the entry containing that index. If VMA boundaries changed,
this can skip a range that has not been reported:
- A lookup finds [A, C), then mprotect() splits it into [A, B) and [B, C)
before vma_start_read() locks the first VMA. The reader reports [A, B),
but the iterator still covers [A, C). The next call starts from B yet
advances past C, omitting [B, C).
- The reader reports [A, B) and unlocks it. A concurrent mprotect() then
merges it with [B, C). On the next call, the iterator resumes at B - 1,
which now belongs to [A, C), and advances past C. Again, [B, C) is lost.
Checking the mmap_lock sequence only within the next call misses writers
that completed before that call began. Also, a NULL result is currently
accepted without validation, so a race can terminate the walk early.
Even a fresh lookup can skip a mapping. Suppose it finds a gap before
[B, C). A writer inserts an adjacent VMA at the end of that gap, then
merges it into [B, C), replacing the node. The lookup resumes at the old
gap's last index, now inside the merged VMA, and steps past it. The
original [B, C) remains mapped throughout. Repeating the forward lookup
is insufficient: another merge can make it skip the same mapping again,
returning the same later VMA or NULL.
The fresh-lookup race also affects /proc/PID/smaps, numa_maps and
smaps_rollup. Resetting the iterator after gathering each VMA's statistics
does not prevent a merge during the next lookup. Fixing lock_next_vma()
also prevents omitted entries and incomplete rollup statistics.
Tie VMA iterator state with the current mm and the write generation at the
point of last mm speculation in vma_rcu_iter, whose values we call 'rvmi'.
This allows us to neatly abstract the existing priv->iter logic alongside
query_vma_find_by_addr() which uses its own VMA iterator.
Then, provide helpers that act on the rvmi - vma_rcu_iter_[maybe_changed,
may_have_skipped]() to determine whether any VMAs may have
been altered since last mm speculation.
Additionally introduce vma_range_is_empty(), used by
vma_rcu_iter_may_have_skipped(), to determine conclusively whether VMAs
exist in a set range, needing to be traversed.
Original fix generated by an LLM and sent by Josef Bacik in private, then
amended by David Hildenbrand, and Lorenzo Stoakes added additional
abstraction.
Link: https://lore.kernel.org/20261027-fix-proc-pid-maps-missing-vmas-v2-1-2791cc9fc95f@kernel.org
Fixes: 5631da56c9a8 ("fs/proc/task_mmu: read proc/pid/maps under per-vma lock")
Fixes: ea3085dd7a4e ("fs/proc/task_mmu: read proc/pid/{smaps|numa_maps} under per-vma lock")
Fixes: 0e985559d72a ("proc/task_mmu: read proc/pid/smaps_rollup under per-vma lock")
Fixes: d9d1c2d81797 ("fs/proc/task_mmu: execute PROCMAP_QUERY ioctl under per-vma locks")
Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Co-developed-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Suren Baghdasaryan <surenb@google.com>
Reviewed-by: Jose A. Perez de Azpillaga <azpijr@gmail.com>
Tested-by: Jose A. Perez de Azpillaga <azpijr@gmail.com>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: SJ Park <sj@kernel.org>
Cc: <stable@vger.kernel.org>
|
|
damon_split_some_reigons() uses a static variable, rotation, to remember
how many times it was called. It is again used to determine fair
selection of regions to split. Since it is a static variable, it can be
indeterministic and therefore less fair.
The user impact is not critical. No crash, no leak. DAMON's
best-effort and indeterministic monitoring accuracy could be slightly
more indeterministic when multiple kdamonds are used in parallel.
Fix the problem by moving the static variable into the damon_ctx struct.
Link: https://lore.kernel.org/20261025164808.152048-4-sj@kernel.org
Fixes: 1a582e6e0174 ("mm/damon/core: split a fraction of regions when nr_regions exceeds max/2")
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Closes: https://sashiko.dev/#/bug/linux-eebfcdde-2881-48ef-8df1-e2019d2a47f2
Cc: Jiayuan Chen <jiayuan.chen@shopee.com>
Cc: <stable@vger.kernel.org> # 7.3.x
|
|
kdamond_split_regions() uses a static variable last_nr_regions, to infer
if the region boundaries are too stable. If it looks too stable, it
does a more aggressive region split because it might be a fake stability
coming from non-aggressive split. Because the variable is static, the
inference can be racy and wrong when multiple kdamonds are running in
parallel.
The user impact is not critical. No crash, no leak. DAMON's
best-effort monitoring accuracy can be degraded when multiple kdamonds
are used in parallel and the workload has certain access patterns. Still
it is a bug that is better to fix.
Move the variable into the damon_ctx struct to fix the problem.
Link: https://lore.kernel.org/20261025164808.152048-3-sj@kernel.org
Fixes: 75c1c2b53c78 ("mm/damon/dbgfs: support multiple contexts")
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Closes: https://sashiko.dev/#/bug/linux-eebfcdde-2881-48ef-8df1-e2019d2a47f2
Cc: Fernand Sieber <sieberf@amazon.com>
Cc: SeongJae Park <sjpark@amazon.de>
Cc: <stable@vger.kernel.org> # 5.15.x
|
|
Patch series "mm: avoid losing atomic VMA flags", v1.
Since commit 2ab7f1bbafc9 ("mm/madvise: allow guard page install/remove
under VMA lock"), VMA_MAYBE_GUARD_BIT can be set atomically under the VMA
read lock.
However, a number of places wrongly assume the flags are stable under the
read lock, which can cause stale atomic VMA flags to overwrite existing
valid ones.
Additionally, one case in which VMA_SOFTDIRTY_BIT was overwritten is also
addressed.
This series addresses each of these, while keeping the logic inline with
existing conventions.
Each patch in this series is a hotfix.
This patch (of 4):
madvise, mlock and mprotect take a copy of a VMA's flags holding only the
VMA read lock, later writing it back under the write lock (in
madvise_update_vma(), mlock_fixup(), mlock_vma_pages_range() and
mprotect_fixup()).
This was done on the assumption that VMA flags cannot change with a read
lock held.
However this changed in commit 2ab7f1bbafc9 ("mm/madvise: allow guard page
install/remove under VMA lock"), which allowed VM_ATOMIC_SET_ALLOWED
flags (currently only VMA_MAYBE_GUARD_BIT) to be written concurrently under
a VMA read lock.
The actual write itself is safe as this is done under the VMA write lock
at which point no further concurrent writes can occur, however at this
point the stale flags mean that these callers can unintentionally overwrite
atomic flags incorrectly.
The consequences of this are significant - a missing VMA_MAYBE_GUARD_BIT
could result in page tables not being copied on fork (the vma_needs_copy()
check can return false) or being overwritten on file-backed THP
collapse (the file_backed_vma_is_retractable() can return true).
Resolve the issue by always taking care to retain existing atomic flags
when overwriting VMA flags, replacing the inconsistently named
vma_flags_reset_once() with vma_overwrite_flags() to do so, and always
invoking it when flags are overwritten like this.
Reads are a problem too - madvise, mlock and mprotect all compare VMA flags
without a VMA write lock held via vma_flags_same_pair().
This has more serious impact, as concurrent changes to atomic VMA flags can
cause two sets of VMA flags to be wrongly considered different.
For mprotect and madvise this causes a useless split, but mlock is impacted
more seriously as it can result in mm->locked_vm underflow.
Fix this by updating vma_flags_same_pair() to disregard
VM_ATOMIC_SET_ALLOWED VMAs - VMA equality is the same as VMA mergeability,
and atomic VMA flags are disregarded when comparing VMA flags for merge -
so this is justified semantically.
Additionally, remove the redundant vma_flags_same_mask() and the unused
vma_flags_same() as part of the change, and replace VM_ATOMIC_SET_ALLOWED
with VMA_ATOMIC_SET_ALLOWED, using the new VMA flag API.
Finally, update userland VMA tests to reflect the changes.
Link: https://lore.kernel.org/20261023-fix-vma-atomic-v1-0-8ff4fae1fc85@kernel.org
Link: https://lore.kernel.org/20261023-fix-vma-atomic-v1-1-8ff4fae1fc85@kernel.org
Fixes: 2ab7f1bbafc9 ("mm/madvise: allow guard page install/remove under VMA lock")
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Suggested-by: David Hildenbrand (Arm) <david@kernel.org>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Pedro Falcato <pfalcato@suse.de>
Tested-by: Gregory Price (Meta) <gourry@gourry.net>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Jann Horn <jannh@google.com>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: SJ Park <sj@kernel.org>
Cc: Kees Cook <kees@kernel.org>
Cc: Colin Cross <ccross@google.com>
Cc: <stable@vger.kernel.org>
|
|
For UFFDIO_POISON to install a poison marker in a hugetlb mapping, it is
sufficient to have the VMA registered for missing mode.
However, UFFD missing mode does currently not block PMD table sharing, so
installing the marker will be visible to everyone using the shared PMD
table, which is wrong as UFFDIO_POISON must stay local to the process.
To fix it, make uffd_disable_huge_pmd_share() cover VM_UFFD_MISSING as
well. With missing mode covered, hugetlb PMD sharing is disabled for all
userfaultfd registered VMAs, so the helper can simply return whether the
VMA has a userfaultfd context instead of testing individual UFFD mode
flags. Add a debug check on the marker installation path.
The existing registration path will then unshare PMD tables, and
subsequent faults will not share them while the mapping remains
registered.
The alternative would be to unshare PMD tables selectively when
installing poison markers, which results in way more complexity. Or
alternatively, simply failing the marker installation, which might break
some use cases.
This also disables PMD sharing for userfaultfd registrations that never
use UFFDIO_POISON.
Link: https://lore.kernel.org/20261022034543.51226-3-lizhe.67@bytedance.com
Fixes: 8a13897fb0da ("mm: userfaultfd: support UFFDIO_POISON for hugetlbfs")
Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
Signed-off-by: Li Zhe <lizhe.67@bytedance.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Suggested-by: Li Zhe <lizhe.67@bytedance.com>
Suggested-by: Mike Rapoport <rppt@kernel.org>
Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Peter Xu <peterx@redhat.com>
Cc: Jose A. Perez de Azpillaga <azpijr@gmail.com>
|
|
Patch series "mm/hugetlb: fix mremap bugs", v3.
This series fixes a few hugetlb mremap bugs.
Patch 1 fixes the return type of move_hugetlb_page_tables(), so large
hugetlb moves cannot be truncated when reported back to the generic
mremap code.
Patch 2 disables hugetlb PMD sharing for UFFD missing mode, so
UFFDIO_POISON markers cannot become visible through shared PMD page
tables.
Patch 3 fixes the recursive i_mmap_rwsem deadlock in the hugetlb mremap
path by avoiding the destination PMD sharing allocation path while the
mapping lock is already held for write.
This patch (of 3):
move_hugetlb_page_tables() returns the number of bytes moved, but
its return type is int while the generic move_page_tables() path uses
unsigned long lengths.
A hugetlb mremap() move length above INT_MAX can therefore be
misreported to copy_vma_and_data(). The out-of-range conversion to int
is implementation-defined; on common 64-bit builds, for example, a
4 GiB move can be reported as zero, making the caller treat the move as
a failure and use the wrong length for rollback.
Return unsigned long from move_hugetlb_page_tables(), matching
move_page_tables() and preserving the full byte count.
Link: https://lore.kernel.org/20261022034543.51226-1-lizhe.67@bytedance.com
Link: https://lore.kernel.org/20261022034543.51226-2-lizhe.67@bytedance.com
Fixes: 550a7d60bd5e ("mm, hugepages: add mremap() support for hugepage backed vma")
Signed-off-by: Li Zhe <lizhe.67@bytedance.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Peter Xu <peterx@redhat.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Jose A. Perez de Azpillaga <azpijr@gmail.com>
Cc: <stable@vger.kernel.org>
|
|
Pull bpf fixes from Alexei Starovoitov:
"Fix various bugs in bpf core and bpf-lwt. Looks like the speed of us
fixing bugs is higher than the number of new bugs found. Not out of
the woods yet. sockmap fixes will come later.
- Various fixes (Alexei Starovoitov):
- Use one may_goto time slice per prog invocation instead of one
per stack frame to fix a soft lockup in loops that nest across
calls
- Fix use-after-free in btf__add_type() in libbpf
- Invalidate a dynptr slice when its stack buffer is written or
when the frame of the buffer returns
- Fix the tracking of pointers to the stack in SCEV
- Keep the valid bytes of a packet pointer in SCEV
- Fix bpf_throw() in a prog with a private stack in x86 JIT
- Compare the arguments of an extension prog with those of its
target
- Don't accept memory of the prog for struct arguments of
KF_ACQUIRE kfuncs and for arguments of an empty struct type
- Fix mmap() of an arena: refuse address 0 and a length above
max_entries pages, etc.
- Don't let bpf_skb_adjust_room() raise gso_size to GSO_BY_FRAGS
- Fix lwt progs: reset skb->cb and don't leave a stale MAC header
after a prog pushes an IP header, require BPF_LWT_REROUTE when
an lwt_in prog changes the protocol, don't call into IPv6 when
it is disabled, don't look for the SRH again in the End.BPF
helpers, and set a dst for test runs of lwt_in progs
- Fix bpf_dynptr_copy() for overlapping ranges in one packet
(Ayushman Rout)
- Various fixes (Chris Mason):
- Reject memory of the prog for kfunc projection type arguments
- Require prog fd or capability for cgroup prog detach
- Keep the skb network offset signed in cgroup skb progs
- Reject non-IPv6 packets in BPF_LWT_ENCAP_SEG6
- Limit the SRH length and move the MAC header in
bpf_lwt_seg6_adjust_srh()
- Move the transport header together with the headers that
bpf_skb_adjust_room() and bpf_lwt_seg6_adjust_srh() move, and
use the inner transport header after a decap
- Check the offset in bpf_skb_generic_{push,pop}()
- Mark jmp mode of ftrace direct trampolines on x86 by clearing bit
63 of the address instead of setting bit 0, since an ftrace
callback can start at an odd address (Daniel Borkmann)
- Fix psock update-side data races on sk->sk_prot and progs in
sockmap (Jakub Sitnicki)
- Fix skb_pull() BUG in __bpf_redirect_neigh(): make sure that the
MAC and IP headers are there and are linear (Jamal Hadi Salim)
- Fix jited line info that is off by the CFI preamble on x86-64,
arm64 and riscv64 (Jose Fernandez)
- Clamp the trace length in __bpf_get_stack() to fix a write after
the end of the buffer (Josef Bacik)
- Drop percpu_counter from the htab element count, since its lock can
deadlock with NMI and tracing progs that update the same map
(Puranjay Mohan)
- Propagate scalar precision through stack arguments (Xu Yunxiang)
- Fix callback recursion selftest with llvm24 (Yonghong Song)
- Free the skb when bpf_xmit() fails to expand the headroom (Yuqiang
Sun)"
* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (61 commits)
libbpf: Fix use-after-free in btf__add_type
selftests/bpf: Exercise stack argument precision on state reuse
bpf: Propagate scalar precision through stack arguments
selftests/bpf: Fix callback recursion test with noipa global func
selftests/bpf: Test one may_goto time slice per prog invocation
bpf: End bpf_loop() when the time of may_goto is up
bpf: One may_goto time slice per prog invocation
bpf: Pass a pointer to arch_bpf_timed_may_goto()
s390/bpf: Support internal-only MOV instruction to resolve per-CPU addrs
selftests/bpf: End the loop of parallel_test_bitmap after 50 ms
selftests/bpf: Give the first loop of cond_break5 an end
selftests/bpf: Don't cast a pointer to .bss in arena_htab_asm
bpf: Emit timed may_goto for JITed progs only
selftests/bpf: Test writes to the buffer of bpf_dynptr_slice_rdwr()
bpf: Invalidate a dynptr slice when its stack buffer is written
selftests/bpf: Test a callee that overwrites a spilled pointer of its caller
bpf: Don't trust pointers spilled in slots that a callee can write
selftests/bpf: Test the join of fp+0 with a value that is not a pointer to stack
bpf: Fix the join of fp+0 with a value that is not a pointer to stack
selftests/bpf: Run arena_mmap serially and test MAP_FIXED addresses
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux
Pull crypto library fixes from Eric Biggers:
- Disable the MIPS64 Octeon optimized SHA-1, SHA-256, and SHA-512 code
on little-endian kernels, since it doesn't work correctly on them
- Remove the PowerPC optimized Poly1305 code. It's already been marked
as BROKEN for over a year due to not working in softirq context, but
it turns out some of the Poly1305 math is incorrect too
- A few robustness improvements for the ML-DSA code
* tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux:
lib/crypto: mldsa: Add __must_check to mldsa_verify()
lib/crypto: mldsa: Explicitly check that 'alg' is a valid value
lib/crypto: mldsa: Check pk_len before doing pointer arithmetic
lib/crypto: powerpc/poly1305: Remove BROKEN implementation
lib/crypto: mips: Disable Octeon SHA code on little-endian kernels
|
|
When the time of a prog is up all loops with may_goto end, but bpf_loop()
goes on. It calls its callback up to 1 << 23 times. The loops in the
callback make no iteration, but the rest of the callback runs, and that can
be another bpf_loop(). Two test progs with bpf_loop(1 << 23, cb) and some
work in cb return after 4 sec and 10 sec. With this patch they return after
250 ms.
bpf_loop() and bpf_for_each_map_elem() end their loop when the callback
returns 1. So return 1 in the first insns of the callback when the time is
up:
r0 = address of the count
r0 = &(void __percpu *)(r0)
r0 = *(u64 *)(r0 +0)
if r0 != 0x0 goto pc+2
r0 = 1
exit
The verifier has seen what follows: the loop of the helper can end after
each call of the callback.
A function that BPF code calls too, or that is the callback of another
helper or kfunc, stays as it is: there the return value has another
meaning. The callback of bpf_user_ringbuf_drain() stays as it is too. The
helper takes a sample out of the buffer for each call, so a call that
does nothing loses the sample. Its loop ends after 128K samples.
This patch does not limit bpf_loop() itself. Only may_goto counts and reads
the clock. So nested bpf_loop() are not stopped when the prog has no
may_goto, or has none in the callbacks: bpf_loop(1 << 20, cb) with
bpf_loop(4096, cb2) in cb takes 5 sec. Nested open coded iterators have the
same problem. A follow up will fix these holes.
A call of such a callback executes 4 more insns. The cost on x86-64 (Zen 5)
in nsec:
before after
callback makes 1 iteration, inlined bpf_loop() 1.16 1.54
callback makes 1 iteration, bpf_loop() 6.52 6.74
callback without may_goto, inlined bpf_loop() 1.16 1.16
callback without may_goto, bpf_loop() 4.95 4.95
callback without may_goto, nested bpf_loop() 1.13 1.38
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261031215543.682284-9-alexei.starovoitov@gmail.com
|
|
The count and the timestamp of may_goto are in the stack frame. So the
limit of 250 ms is for one call of a subprog, not for one invocation of the
prog, and loops that nest across calls multiply it. These 9 insns cause a
soft lockup:
main: sub:
1: call sub 1: may_goto 2f
may_goto 2f goto 1b
goto 1b 2: r0 = 0
2: r0 = 1 exit
exit
Use one count and one timestamp for all may_goto of a prog, in per-cpu
memory of the prog. The main prog sets them in its first insns. When the
time is up each loop ends at its next may_goto, in any function.
rX = address of the count
rX = &(void __percpu *)(rX)
r12 = *(u64 *)(rX +0)
if r12 == 0x0 goto target
r12 -= 1
if r12 != 0x0 goto pc+2
r12 = rX
call arch_bpf_timed_may_goto
*(u64 *)(rX +0) = r12
rX is a register that is dead at the may_goto. When all ten are live R0 is
saved in the stack.
An async callback can interrupt the prog on the same cpu. So its caller
sets count and timestamp, and puts the old values back at the end. A second
invocation of the prog on the same cpu gives more time to the first one.
x86-64 (Zen 5), nsec before after
iteration, empty loop 0.36 0.44
iteration, the body takes 4 cycles 0.89 0.89
call of a subprog and 1 iteration 1.21 1.16
The 56 progs of scx with may_goto get 1.7% more JITed code and use 25% less
stack.
Fixes: e723608bf428 ("bpf: Add verifier support for timed may_goto")
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261031215543.682284-8-alexei.starovoitov@gmail.com
|
|
hci_cs_le_create_cis() retrieves the parameters of the previously sent
command without their length. It then trusts num_cis and walks the
flexible cis[] array when a controller reports a failed command.
A five-byte HCI command containing only num_cis can therefore make the
handler read beyond the command skb. KASAN reports:
BUG: KASAN: slab-out-of-bounds in hci_cs_le_create_cis
Read of size 2
hci_cs_le_create_cis
hci_cmd_status_evt
hci_event_packet
Add a length-returning saved-command helper and require the fixed header
and complete CIS array before walking it.
The reproducer no longer triggers a KASAN report with this change.
Fixes: 26afbd826ee3 ("Bluetooth: Add initial implementation of CIS connections")
Closes: https://lore.kernel.org/linux-bluetooth/179317462624.87574.6271582002629080499@stu.pku.edu.cn/
Signed-off-by: Yifan Zhang <yfzhang23@stu.pku.edu.cn>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
|
|
Once encryption is enabled on an ACL link, the encryption key size is
read from the controller, using hdev->min_enc_key_size in the meantime.
Data received before the reply is processed with that key size, so a
peer starting SMP over BR/EDR right after encryption, which it may do,
gets its Pairing Request rejected with "Encryption Key Size" whenever
the pending security level is FIPS, as that requires a 16 octet key:
> HCI Event: Encryption Change (0x08) plen 4
> ACL Data RX: Handle 1 flags 0x02 dlen 11
BR/EDR SMP: Pairing Request (0x01) len 6
@ MGMT Event: Authentication Failed (0x0011) plen 8
Status: Authentication Failed (0x05)
< HCI Command: Read Encryption Key Size (0x05|0x0008) plen 2
> HCI Event: Command Complete (0x0e) plen 7
Key size: 16
< ACL Data TX: Handle 1 flags 0x00 dlen 6
BR/EDR SMP: Pairing Failed (0x05) len 1
Reason: Encryption key size (0x06)
Mark the connection with HCI_CONN_ENC_KEY_SIZE_PEND while the key size
is read and hold incoming L2CAP data back in pending_rx meanwhile,
processing it once the reply is handled.
Found with mgmt-tester "Pairing Acceptor - SMP over BR/EDR 2" under User
Mode Linux time travel, where the emulated peer always replies before
the key size is read.
Fixes: e3f6a257a73d ("Bluetooth: Use actual encryption key size for SMP over BR/EDR")
Assisted-by: OpenCode:claude-opus-5.5
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
|
|
struct hci_conn stores its flags in a single unsigned long, but the
HCI_CONN_* enum already has 33 entries (up to HCI_CONN_PA_SYNC_FAILED
= 32), so on 32-bit architectures set_bit()/test_bit() on the highest
flags access memory past the flags field, aliasing the adjacent
conn_reason field.
Fix this by declaring flags with DECLARE_BITMAP() sized by a new
__HCI_CONN_NUM_FLAGS terminator so it can accommodate any number of
flags.
Assisted-by: OpenCode:claude-opus-5.5
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
|
|
The truesize of fragments in a reassembly queue is only bounded by
the per netns ipfrag_high_thresh sysctl, which has no upper limit.
inet_frag_reasm_finish() sums the truesize of all fragments in an int.
If this sum reaches 2^32, it wraps, and the final sk_wmem_alloc
adjustment of the socket owning the reassembled skb can cancel its own
reference, leading to a use-after-free of this socket.
This can be triggered from an unprivileged user/network namespace,
raising ipfrag_high_thresh and using padded TUN packets, which keep
a large truesize after being trimmed by ip_rcv_core().
Track the sum of the truesize of fragments in each queue, and refuse
a fragment that would make it bigger than INT_MAX / 2. Callers kill
the queue on this error. This bound is far above the needs of
legitimate traffic.
Fixes: 18685451fc4e ("inet: inet_defrag: prevent sk release while still in use")
Cc: stable@vger.kernel.org
Reported-by: Kyle Zeng <kylebot@openai.com>
Cc: Florian Westphal <fw@strlen.de>
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Tested-by: Wang Zhan <wang.zhan@smartx.com>
Link: https://patch.msgid.link/20261030081225.2575462-1-edumazet@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
|
bpf_dynptr_slice(&ptr, off, buffer, size) and bpf_dynptr_slice_rdwr()
return a pointer to the data of a dynptr. When the data is not contiguous,
for example in a non-linear skb, they copy it to 'buffer' and return
'buffer'. Usually the buffer is on the stack. For the verifier the result
is plain memory (PTR_TO_MEM), and an access through it is not an access to
the stack:
- A store makes wrong what the verifier tracks in the buffer: a known
scalar, a spilled pointer, a dynptr, an iterator, irq flags.
- A load gives the bytes of a spilled pointer or of a dynptr as a scalar.
- Both are possible after the frame of the buffer returned.
The accesses are safe while the buffer contains only unknown bytes, as it
does after the call. Thus keep this rule: the buffer contains no tracked
data while a slice that can be the buffer exists. The slice remembers the
frame, the offset and the size of its buffer. The verifier invalidates the
slice, read-only or not, at each event that breaks the rule:
event slices of the buffer
------------------------------------------------- --------------------
the prog stores to bytes of the buffer invalid
a dynptr, an iterator or irq flags are made there invalid
the frame of the buffer returns invalid
a helper or a kfunc fills the buffer no change
a store next to the buffer, a read of the buffer no change
Tracked data gets into a stack slot in check_stack_write(), also the bytes
of a new dynptr, iterator or irq flags. Thus one call there, and one call
in prepare_func_exit(), are sufficient. Each is one walk over the
registers, only in progs that have such a slice. Helpers and kfuncs leave
only unknown bytes: mark_raw_stack() goes around check_stack_write().
The range of the buffer is in the part of bpf_reg_state that the verifier
copies with the register and compares for pruning. A slice that is the
buffer of a second call passes its range on. Local, ringbuf and skb
metadata dynptrs never return the buffer: no range. A dynptr argument of a
global function counts as an skb dynptr.
The usual pattern only reads the buffer, and it continues to load:
if (p == buffer)
bpf_dynptr_write(&ptr, 0, buffer, sizeof(buffer), 0);
A prog that stores to the buffer and then uses the old slice is rejected:
"R7 invalid mem access 'scalar'". The diagnostics name the reason, and the
log shows the buffer of a slice: R7=mem(sz=8,buf=fp[0]-8+8).
Fixes: 66e3a13e7c2c ("bpf: Add bpf_dynptr_slice and bpf_dynptr_slice_rdwr")
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261102170958.3586893-2-alexei.starovoitov@gmail.com
|
|
struct virtio_spi_config contains max_cs_inactive_ns, but its
kernel-doc describes max_cs_incative_ns. This leaves the real member
undescribed and adds a nonexistent member to the generated
documentation.
Correct the spelling.
Fixes: 6a1f3390fafe ("virtio-spi: Add virtio-spi.h")
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260909064938.90995-1-kmehltretter@gmail.com>
|
|
copy_huge_pud() copies device-DAX entries without taking a folio reference
or updating mapcounts and the child's RSS.
For example, MADV_GUARD_INSTALL sets VM_MAYBE_GUARD on a device-DAX VMA,
forcing copy_page_range() to traverse the whole VMA on fork. Any remaining
huge PUDs are then copied without accounting for the new mappings.
Unmapping them in the child decrements accounting that was never added.
Use vm_normal_page_pud() to identify refcounted mappings. Take a folio
reference and add the child's PUD rmap and RSS accounting before installing
the copied entry. Pass src and dst VMAs consistently instead of src and
dst MM. Move the TODO.
Fixes: aed877c2b4257 ("device/dax: properly refcount device dax pages when mapping")
Cc: stable@vger.kernel.org
Reviewed-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: Pedro Falcato <pfalcato@suse.de>
Reviewed-by: Lance Yang <lance.yang@linux.dev>
Tested-by: Muhammad Usama Anjum <usama.anjum@arm.com>
Link: https://patch.msgid.link/20261031-fixes_core-v3-11-d6437171ecc3@kernel.org
Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
|
|
shmem_file() only checks if file->f_mapping is a shmem mapping. This
mapping can belong to another file, however, as with a Coda file backed
by a tmpfs container after mmap().
So it does not guarantee that the file inode is an actual shmem inode.
Seal handling and memfd preservation use this check before accessing
shmem inode state, so they can access an inode of the wrong type.
Let's make shmem_file() check the inode's file operations instead, to
identify shmem inodes reliably. This will identify regular shmem inodes,
including memfds and ordinary tmpfs files, independently of wrapper file
operations.
Use shmem_mapping() in collapse_file() instead to not change the behavior
of collapse_file(): it operates on the page cache and uses mapping->host
for shmem inode operations. Focusing on the file does not seem relevant.
Fixes: c49fcfcda8b5 ("mm/shmem: update file sealing comments and file checking")
Fixes: b3749f174d68 ("mm: memfd_luo: allow preserving memfd")
Cc: stable@vger.kernel.org
Reported-by: Chris Mason <mason@kernel.org>
Suggested-by: Pratyush Yadav <pratyush@kernel.org>
Reviewed-by: Pratyush Yadav (Google) <pratyush@kernel.org>
Link: https://patch.msgid.link/20261031-fixes_core-v3-3-d6437171ecc3@kernel.org
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
|
|
The owner of a memfd sealed with F_SEAL_EXEC can still change its
execute bits by setting a POSIX access ACL. With CONFIG_TMPFS_POSIX_ACL,
this lets an unprivileged owner make a non-executable memfd executable,
bypassing vm.memfd_noexec=2.
simple_set_acl() updates i_mode directly, bypassing the seal check in
shmem_setattr(). Add shmem_set_acl() to check the resulting mode. Share
the F_SEAL_EXEC check with shmem_setattr() using memfd_check_seals_mode()
in include/linux/memfd.h.
Fix generated by an LLM and sent by Chris Mason in private.
Fixes: 6fd7353829ca ("mm/memfd: add F_SEAL_EXEC")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <mason@kernel.org>
Acked-by: Pedro Falcato <pfalcato@suse.de>
Acked-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Acked-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Reviewed-by: Pratyush Yadav (Google) <pratyush@kernel.org>
Tested-by: Gregory Price (Meta) <gourry@gourry.net>
[ david: use common helper; simplify description ]
Link: https://patch.msgid.link/20261029-fixes_shmem-v4-4-392fc715d8f6@kernel.org
Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
|
|
An extension replaces its target, a global function of another prog. From
BTF, btf_prepare_func_args() derives the kind of each argument, such as the
context, memory of a given size or a kernel object. The verifier checks the
callers with the BTF of the target and the extension with its own BTF.
Only btf_check_func_type_match() compares the two prototypes. For a pointer
to a struct, it compares only the struct names and assumes that the pointer
is the context. That was true until the commit below added pointers to
memory. Later the __arg_* tags added more kinds. Thus an extension can rely
on more than the callers guarantee (size, not NULL, kind). Then what the
verifier proved for it is false at run time.
Keep the result of btf_prepare_func_args() in bpf_func_info_aux and compare
the two results at load and on attach to another target. Return -EINVAL
unless the kind and the BTF id are the same and the memory is not larger.
The extension can also accept NULL where the callers never pass it. An
extension with the prototype and the tags of its target loads as before. An
argument that is the context only because of __arg_ctx needs the tag in the
extension too. The tag __arg_untrusted or __arg_arena on the extension only
is safe, but it is rejected because the kind differs.
Fixes: e5069b9c23b3 ("bpf: Support pointers in global func args")
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261101190535.1454146-12-alexei.starovoitov@gmail.com
|
