| Age | Commit message (Collapse) | Author |
|---|
|
git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm
Pull lsm updates from Paul Moore:
- Add LSM hooks, object blobs, and audit records for namespaces
Add the necessary bits to enable LSMs to enforce access controls on
the management of various kernel namespaces. While this pull request
does not contain any in-tree users of these hooks, the Landlock pull
request for Linux v7.4 will include Landlock support and the next
merge window will likely include SELinux support as well. Considering
the development behind these hooks, I expect that BPF LSM developers
will also be making use of the namespace hooks, if they haven't
already.
- Update the inode LSM hooks to include mount idmaps
This allows LSMs to incorporate the mount ID mapping into their
access control decisions. While there are no current in-tree users of
this, it was requested by those developing BPF LSM programs and this
pull request includes a BPF LSM selftest.
- Preserve the full 32-bit ioctl command in LSM audit records
Previously only the low 16 bits were logged, ignoring the direction
and size information in the upper 16 bits. The pull request also
includes a Landlock based selftest to verify the full 32-bit ioctl
value.
- Ensure we don't call security_backing_file_free() multiple times
Thankfully we don't have a problem with the current code base, but we
want to fix this behavior now before it becomes a problem.
- Clarify that only the current task may access current->cred
The current code is a bit misleading around safely accessing the cred
field in a task struct. Through comment and code corrections, this
pull request clarifies that only the task itself may access its cred
field.
- Add SLAB_NO_MERGE to the credential object cache
Harden the credential cache by ensuring credential objects live on
dedicated slab pages.
- Make use of safe memory zero'ing in the LSM Rust bindings
- Update the docs for the current behavior of /sys/kernel/security/lsm
- Update the docs for CONFIG_LSM and the "lsm=" command line option
- Remove unnecessary code
* tag 'lsm-pr-20261016' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm:
lsm: remove redundant NULL check in security_init()
selftests/landlock: Check full ioctl commands in audit records
lsm: Preserve full ioctl commands in audit records
doc: fix LSM ordering description for /sys/kernel/security/lsm
doc: describe CONFIG_LSM and lsm= as the selection mechanism
selftests/bpf: verify mount idmaps reach inode hooks
lsm: expose mount idmaps to inode hooks
rust: lsm: replace `core::mem::zeroed` with `pin_init::zeroed`
cred: prevent slab cache merging for cred_jar
lsm: don't call security_backing_file_free() multiple times
lsm: delete duplicate assignment in lsm_prepare()
lsm: update the BUILD_BUG_ON() in audit_log_lsm_data()
lsm: add LSM_AUDIT_DATA_NS for namespace audit records
lsm: add LSM blob and hooks for namespaces
ns: Free anonymous mount namespaces via ns_common_free()
cred: clarify that task_struct::cred is only for the current task
|
|
g_vsyscall is only used by the x86_64 test, so clang builds for other
architectures get:
proc-pid-vm.c:224:21: warning: unused variable 'g_vsyscall' [-Wunused-variable]
The vsyscall strings next to it had the same problem and were marked
__maybe_unused for it. Move all of the vsyscall variables into the
__x86_64__ block that uses them instead, and drop those annotations
along with the local __maybe_unused fallback that was added for them.
Link: https://lore.kernel.org/20261012115330.3777115-1-sashal@kernel.org
Fixes: 17415606f9d8 ("tools/testing/selftests/proc/proc-pid-vm.c: test with vsyscall in mind")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Suggested-by: Andrew Morton <akpm@linux-foundation.org>
Assisted-by: LLM
Cc: Shuah Khan <shuah@kernel.org>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
|
|
Pause autonegotiation happens with the link partner using the same words
as the link negotiation, used for speed and duplex exchanges. However,
pause and link autonegotiation can be separately toggled :
ethtool -s eth0 autoneg on # Enable link negotiation
ethtool -A eth0 autoneg on # Enable Pause negotiation
Pause can't be negotiated if the link autoneg isn't enabled.
Pause autoneg and link autoneg settings must not interfere with one
another when user is configuring them :
- If Pause autoneg is on, it must stay on when link autoneg is disabled
(even though Pause won't actually be negotiated)
- If Pause autoneg is off, it must stay off when link autoneg is
enabled
Introduce a set of tests to verify that pause and link autoneg are
behaving correctly, in particular that the user intent is correctly
cached when toggling link autoneg.
Signed-off-by: Maxime Chevallier (Netdev Foundation) <maxime.chevallier@bootlin.com>
Link: https://patch.msgid.link/20261015134350.629593-4-maxime.chevallier@bootlin.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
Pause autonegotiation behaves differently than the regular link params
autonegotiation, in that the user intention may differ from the
negotiated pause parameters.
Introduce a test that validates we're correctly resolving pause
parameters according to 802.3.
The validation is done based on what the local interface reports in
terms of advertised and lp_advertised linkmodes.
If the remote can express what it sees in terms of its own advertised
and lp_advertised modes, validate the autoneg results on the peer as
well.
Signed-off-by: Maxime Chevallier (Netdev Foundation) <maxime.chevallier@bootlin.com>
Link: https://patch.msgid.link/20261015134350.629593-3-maxime.chevallier@bootlin.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
Ethernet flow control is a tricky thing to get right, especially when it
comes to correctly handling the negotiation of the parameters with a
link partner.
On one hand, the userspace API talks in terms of the device's ability to
send Pause frames when the device is overwhelmed by ingress traffic (TX
pause) and the ability to stop sending traffic upon receiving Pause
frames (RX pause).
On the other hand, 802.3 explains that devices can exchange their
abilities over link negotiation, but instead of echanging TX and RX
abilities, they exchange Pause and Asymmetric Pause capabilities :
RX unable TX unable => None
RX able TX unable => Pause + Asymmetric
RX unable TX able => Asymmetric
RX able TX able => Pause
The reported Pause and Asym abilities depend both on the MAC, that
eventually sends and processes these frames, and the PHY, that
advertises these to the partner.
Both MAC and PHYs can have their own limitations, and getting the
correct set of supported Pause/Asym parameters is non-trivial, unless
the MAC uses phylink, which deals with the complexity.
Introduce a set of Pause selftests that verify that the local
interface's supported pause parameters reported from ethtool (in terms
of Pause + Asym ) match the accepted parameters from "ethtool -A",
corresponding to ethtool's .set_pauseparams() ops, expressed in TX and
RX abilities.
Signed-off-by: Maxime Chevallier (Netdev Foundation) <maxime.chevallier@bootlin.com>
Link: https://patch.msgid.link/20261015134350.629593-2-maxime.chevallier@bootlin.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
Add a YNL spec for nexthop objects and nexthop buckets in rtnetlink.
./tools/net/ynl/pyynl/cli.py \
--spec Documentation/netlink/specs/rt-nexthop.yaml \
--dump getnexthop
Exclude newnexthopbucket-ntf from the C code generation. ynl_gen_c.py
looks up a classic notification by the request of the same message
type, and no request uses RTM_NEWNEXTHOPBUCKET. The spec keeps the
notification, so the Python tools can still subscribe to it.
Signed-off-by: Demos Ra <demosthenes.ra@gmail.com>
Link: https://patch.msgid.link/20261019-rt-nexthop-spec-v1-1-9c586edf86ab@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/leitao/linux
Pull configfs updates from Breno Leitao:
- Attribute structures can now be const (Thomas Weißschuh)
- The first selftests for the configfs userspace interface, plus a
sample subsystem that accepts symlinks to test against. They include
a race of symlink(2) against rmdir of the target, which exercises the
use-after-free fixed in v7.3-rc3.
- Rust bindings, merged from Andreas Hindborg's signed tag: fix the
data offset calculation in subsystem callbacks (marked for stable),
add the missing Send and Sync bounds, and correct a safety comment.
* tag 'configfs-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/leitao/linux:
samples: configfs: constify the configfs_attribute structures
configfs: Allow the registration of const struct configfs_attribute
configfs: Constify configfs_bin_attribute
configfs: Treat attribute structures as const internally
configfs: Constify is_visible/is_visible_bin in configfs_group_operations
rust: configfs: remove mutability from some field initializers
selftests/configfs: race symlink against rmdir of the target
selftests/configfs: cover symlink and unlink
samples/configfs: add a subsystem that accepts symlinks
selftests/configfs: add tests for the userspace interface
rust: configfs: fix data offset calculation for subsystem callbacks
rust: configfs: require thread-safe callback data
rust: configfs: fix release safety documentation
|
|
Several tc-testing cases assert an exact bytes/packets value from a single
injected frame, but count every frame that traverses an egress qdisc (or
match with "protocol all"). Every case creates a fresh veth pair (and, for
the gso_skb cases, a netdevsim device) and brings it up with IPv6 enabled;
a device whose link-local autoconfiguration runs then emits neighbour
solicitations, MLD reports and router solicitations for a few seconds.
Those are ordinary Ethernet frames (0x86DD) and are counted too, so the
exact assertions race with the autoconf burst and fail intermittently. The
$DEV0 peer of the veth pair lives in the init netns, so its frames follow
the init-netns IPv6 sysctls.
Conditions to recreate the bug:
Run the affected cases with IPv6 enabled (the tdc default) on net-next
(7.3.0-rc6+). 4e6b fails intermittently (4/6 here); the four netdevsim
"gso_skb" cases fail intermittently too (fb6c 1/25, 0235 4/15, 476f 4/8).
1922 did not trip in the sampled runs but shares the same setup and is
fixed for uniformity. Each failure carries a stray autoconf frame, e.g.
"bytes: 98 != 188".
The Fix:
Fix the affected cases:
- actions/ife.json 4e6b injects only an 0xED3E frame but matches with
"protocol all"; scope the filter to that ethertype.
- The four netdevsim "gso_skb" cases (fb6c, 1922, 476f, 0235) create $ETH
from within the case and bring it up immediately before installing the
qdiscs, so the autoconf burst overlaps the measurement. Set
"addrgenmode none" before the link is brought up, so the device
generates no link-local address and the counter holds only the injected
packet. IPv6 stays usable (a manually added address still works), so
cases that exercise IPv6 are unaffected. On a kernel without IPv6
(CONFIG_IPV6=n, or booted with ipv6.disable=1) the attribute is not
available, so the line is made non-fatal like every neighbouring setup
line.
With this change the affected cases pass 20/20, and the whole ife.json
(51/51) and infra/qdiscs.json (48/48) suites pass, as do the protocol-ipv6
matchall cases (filters/matchall.json 0596, 41df, 8bd2, 2a4a).
Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Victor Nogueira <victor@mojatatu.com>
Link: https://patch.msgid.link/QDISC-L9J8.v1.r0.20261014162217-1@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux
Pull crypto library updates from Eric Biggers:
- Migrate the x86 and riscv optimized implementations of various AES
modes (ECB, CBC, CBC-CTS, CTR, XCTR, XTS) into lib/crypto/.
This makes the library APIs be properly accelerated on these
architectures, while still accelerating crypto_skcipher as well.
It removes a lot of redundant glue code, since the crypto API
boilerplate no longer needs to be duplicated for these architectures.
It also fixes the longstanding issue where optimizations for these
AES modes were disabled by default on these architectures.
- Optimize AES-XTS on SPARC64 using the SPARC crypto opcodes
- Move the SipHash code into lib/crypto/
- Update the ChaCha and Poly1305 functions to take size_t lengths,
resolving issues where lengths over INT_MAX were mishandled
- Make frame pointer unwinding work properly in some of the x86
assembly functions, by following the standard %rbp convention
- Add helper functions for zeroizing structs
- Make a few documentation improvements
* tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: (49 commits)
lib/crypto: md5: remove unused header
lib/crypto: mips/chacha: Handle lengths of 2 GiB or more
lib/crypto: arm/chacha: Handle lengths of 2 GiB or more in scalar code
lib/crypto: chacha: Use size_t length
lib/crypto: poly1305: Use size_t length
lib/crypto: x86/sha512: Follow the normal %rbp convention
lib/crypto: x86/sha256: Follow the normal %rbp convention
lib/crypto: x86/sha1: Follow the normal %rbp convention
lib/crypto: chacha20poly1305: zeroize state in __chacha20poly1305_decrypt
lib/crypto: sparc/aes-xts: Add optimization using the AES opcodes
lib: Move SipHash into lib/crypto/
lib/crypto: x86/aes-ctr: Remove some unreachable code
crypto: x86/aesni-intel - Add transitional selections
crypto: aes - Boost priority of encryption modes further
lib/crypto: x86/aes: Set RNDKEY in aes_cbc_encrypt_aesni()
lib/crypto: riscv/aes-xts: Migrate optimized code into library
lib/crypto: riscv/aes-ctr: Migrate optimized code into library
lib/crypto: riscv/aes-cbc: Migrate optimized code into library
lib/crypto: riscv/aes-ecb: Migrate optimized code into library
lib/crypto: riscv/aes: Pass key struct to assembly code
...
|
|
Pull documentation updates from Jonathan Corbet:
"It was a reasonably busy cycle for docs; changes include:
- Add the AGENTS.md symbolic link into the top-level directory in the
hopes that LLMs will read it and produce better work
- The removal of the Assisted-by requirement, as concluded at the
Maintainer Summit
- A new "testdocs" make target to run the documentation unit tests
- Lots of work on the Portuguese, and Chinese translations; there is
now maintenance for the traditional Chinese translations as well
...and the usual pile of minor fixes, documentation updates, etc"
* tag 'docs-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux: (125 commits)
docs: add AGENTS.md as a symlink to README
docs: kernel-parameters: adjust reserve_mem build option
docs: kernel-parameters: don't mix cmdline options & build options
docs/ja_JP: translate submitting-patches.rst (review and report tags)
docs: remove Assisted-by references
Revert "docs: landlock: fix ENOMSG condition in create_ruleset kernel-doc"
docs: kdoc: parse context_lock_struct() as struct declaration
docs: timers: hpet: Document userspace API and ioctl commands
docs: timers: hpet: Modernize file references
Documentation: sched-preemption: Add a SPDX license identifier
docs: ABI: sysfs-driver-xdata: use literal blocks for console commands
docs: ABI: sysfs-class-firmware-attributes: use literal blocks for console commands
ABI: sysfs-bus-usb: use literal block for console commands
docs/ABI: testing: aspeed-uart-routing: use literal block for console commands
docs: kernel-parameters: fix a truncated sentence for preempt=lazy
sched/doc: add a preemption model overview
docs: ABI: TMR manager: use literal blocks for console I/O
Documentation/ABI: IFS: use literal blocks for commands
ABI: sysfs-bus-pci: use literal blocks for commands
docs: translations: pt_BR: add debugging index
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/nolibc/linux-nolibc
Pull nolibc updates from Thomas Weißschuh:
- New architectures: Hexagon, 64-bit parisc
- New library functionality: sendfile(), pread(), pwrite()
- Various bugfixes and cleanups
* tag 'nolibc-20261018-for-7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/nolibc/linux-nolibc: (28 commits)
selftests/nolibc: explicitly disable position independent executables
selftests/nolibc: use the configured kernel header directory
tools/nolibc: fix the function argument order of calloc()
tools/nolibc: check for overflow in malloc()
tools/nolibc: stop rounding malloc() sizes up to 4096 bytes
tools/nolibc: add support for pread() and pwrite()
tools/nolibc: introduce __NOLIBC_BITS_PER_SYSCALL_ARG
tools/nolibc: move __NOLIBC_LLARGPART() to compiler.h
tools/nolibc: make 64-bit systemcall argument padding generic
selftests/nolibc: make the broken MIPS N32 argument detection reusable
tools/nolibc: add 64-bit parisc support
selftests/nolibc: test the FD_* macros
tools/nolibc: fix FD_SET(), FD_CLR() and FD_ISSET() on 64-bit
tools/nolibc: fix readdir_r() with 64-bit directory offsets
tools/nolibc: fix verrx() and errx() message formatting
selftests/nolibc: add tests for the wait status macros
tools/nolibc: fix WIFSIGNALED() for status 0
tools/nolibc/parisc: consistently use %dp to refer to register %r27
selftests/nolibc: validate ENOTDIR return values from opendir()/fdopendir()
tools/nolibc: verify that a directory is opened
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/lindholm/alpha
Pull alpha updates from Magnus Lindholm:
"This completes Alpha's conversion to GENERIC_ENTRY and enables a range
of kernel features through Kconfig updates, including UBSAN, gcov,
kmemleak, page-table checking, fast GUP and sparse IRQs.
It includes TLB and MMU context fixes prompted by glibc test-suite
failures, HugeTLB support for 64KB, 512KB and 4MB pages, and fixes for
poisoned-page faults and page-table checking.
Machine-check handling is improved on Tsunami platforms, with bounded
EV6 logout decoding, Clipper environmental event reporting and safer
firmware console-log scanning.
Other changes add self-extracting compressed kernels with support for
all kernel compression formats, Alpha-specific XZ tuning, perf
register and user-stack sampling, and Alpha support in the seccomp
selftests. The series also fixes user stack-pointer reporting and IRQ
entry ordering, adds 128-bit shift helpers, cleans up linker sections,
and updates Kconfig help"
* tag 'alpha-for-v7.4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/lindholm/alpha: (57 commits)
alpha: add bounded Clipper console-log scanning
alpha: decode Clipper environmental events
alpha: decode and acknowledge Tsunami system machine checks
alpha: bound EV6 logout decoding by the processor area
alpha: describe the Tsunami system machine check frame
alpha: move Tsunami machine check handling to err_tsunami.c
alpha: fill in pc for software event samples
alpha: add HAVE_PERF_REGS and HAVE_PERF_USER_STACK_DUMP support
alpha: use user_stack_pointer() in KSTK_ESP() and dump_elf_thread()
alpha: stop storing the user stack pointer in pt_regs
alpha: fix stale user_stack_pointer()
selftests/seccomp: add Alpha support to seccomp_bpf
alpha: do not skip TLB shootdown IPIs for kthread-borrowed mms
alpha: do not clear remote MMU contexts in migrate_flush_tlb_page()
alpha: invalidate the local context in flush_icache_user_page()
alpha: invalidate the local context in flush_tlb_mm()
alpha: fix the local TLB invalidate in the UP flush_tlb_page()
alpha: fix the local TLB invalidate in flush_tlb_page()
alpha: invalidate the local context in flush_tlb_page()
alpha: only use a targeted tbi() when the target mm is really current
...
|
|
Starting with Rust 1.101.0 (expected 2026-12-24), `objtool` may report:
rust/kernel.o: warning: objtool: _R..._4core6result13unwrap_failed...()
falls through to next function _R..._4core6result13unwrap_failed...()
(and others) due to calls to the `noreturn` symbol:
core::result::unwrap_failed::unwrap_failed_inner
Rust introduced this helper when making `unwrap_failed` generic [1]. The
existing entry for `unwrap_failed` does not match the new helper.
Thus add the mangled one to the list so that `objtool` knows it is
actually `noreturn`.
See commit 56d680dd23c3 ("objtool/rust: list `noreturn` Rust functions")
for more details.
Cc: stable@vger.kernel.org # Needed in 6.12.y and later (Rust is pinned in older LTSs).
Cc: Josh Poimboeuf <jpoimboe@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://github.com/rust-lang/rust/pull/164059 [1]
Assisted-by: LLM
Link: https://patch.msgid.link/20261018131313.59391-1-ojeda@kernel.org
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull objtool updates from Ingo Molnar:
- Add unit test suite for objtool klp functionality and
known failure modes (by Song Liu and Puranjay Mohan,
with fixes by Joe Lawrence)
* tag 'objtool-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (58 commits)
objtool/klp: Add test for ThinLTO symbols sharing a demangled name
objtool/klp: Add test for Clang switch jump tables
objtool/klp: Add test for UBSAN metadata in an unchanged function
objtool/klp: Add test for absolute and __ADDRESSABLE symbols
objtool/klp: Add test for a patch which strips a data annotation
objtool/klp: Add test for the alignment of cloned data sections
objtool/klp: Add test for alternative replacement code in checksums
objtool/klp: Add test for instruction operand checksums
objtool/klp: Add test for a static call introduced by the patch
objtool/klp: Add test for tracepoint and pr_debug static branch keys
objtool/klp: Add test for a static branch introduced by the patch
objtool/klp: Add test for symbols with no checksum entry of their own
objtool/klp: Add test for data object checksums
objtool/klp: Test text annotations on alternative replacements
objtool/klp: Test a hand-built livepatch module's static call keys
objtool/klp: Test rejection of a file-local static branch key
objtool/klp: Add test for symbols whose linkage the patch changes
objtool/klp: Add test for kCFI prefix symbols and traps
objtool/klp: Add test for __bug_table, __ex_table and __mcount_loc extraction
objtool/klp: Add test for static locals which must not be correlated
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull scheduler updates from Ingo Molnar:
"Kconfig updates:
- Simplify PREEMPT_DYNAMIC (Mark Rutland)
Fair scheduler updates:
- Remove redundant RUN_TO_PARITY check (Elif Topuz)
- Declare augmented callbacks per field, fix
rb_add_augmented_cached() descent (Yiwei Lin, Peter Zijlstra)
- Restart fair hrtick after same-task repicks (Shubhang Kaushik)
- Improve the scheduling latency of short slice tasks (Vincent
Guittot)
Deadline/RT scheduler updates:
- Check start_dl_timer expiry with ktime_before() (Liang Hao)
- irq_work: CPU-hotplug improvements on PREEMPT_RT (Sebastian Andrzej
Siewior)
Energy-aware scheduling updates:
- Implement the steal_governor, introduce preferred CPUs and
steal-driven vCPU backoff (Shrikanth Hegde)
Multi-processor load-balancing updates:
- Enable preferred SMT siblings on NVIDIA Olympus (Andrea Righi)
- Randomize equally shallow idle CPU picks (Christian Loehle)
- Remove redundant core_sched_seq (Hui Su)
Cache-aware scheduling updates:
- Avoid publishing partial LLC utilization (Jemmy Wong)
NUMA-balancing updates:
- Reset NUMA fault locality after scan period update (Eric Kim)
Proxy execution updates:
- Ongoing work to implement sleeping owner handling for proxy
execution (John Stultz, Vasily Gorbik)
- Preparatory steps to make sched_ext compatible with proxy execution
(Andrea Righi)
Scheduler infrastructure updates & fixes:
- Remove the RCU wait from PSI trigger destruction (Shakeel Butt)
- Avoid modifying wait-entry on failed priority registration
(Hui Su)
- Use the new static key API for sched_feat (Hongyan Xia)
- Convert paravirt_steal to new static key APIs (Hongyan Xia)
- cputime: Don't account idle time twice after dyntick-idle
(Stian Halseth)
Scheduler debugging updates:
- Set TIF_NEED_RESCHED before calling __trace_set_need_resched()
(Sechang Lim)
- Fix context analysis errors in non-preferred CPU push (Shrikanth
Hegde)
Misc cleanups and fixes by Christian Loehle, Shubhang Kaushik,
Thomas Huth and Vladimir Zapolskiy"
* tag 'sched-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (64 commits)
sched: Replace nr_iowait_cpu() with a bool accessor
Revert "sched/fair: Remove dead code on enqueue_task_fair()"
sched/cache: Avoid publishing partial LLC utilization
sched/cputime: Don't account idle time twice after dyntick-idle
sched/psi: Remove the RCU wait from trigger destruction
sched/eevdf: Remove redundant RUN_TO_PARITY check
sched/wait: Avoid modifying entry on failed priority registration
rbtree_test: Use rb_add_augmented_cached() for the cached augmented test
rbtree: Update augmented data on the way down in rb_add_augmented_cached()
rbtree: Declare augmented callbacks per field with RB_AUG()
rbtree_test: Use rb_add() and rb_add_cached() for the basic tests
smpboot: Don't park the thread if work is pending
irq_work: Flush lazy work CPU down on PREEMPT_RT
irq_work: Update a comment regarding CPU hotplug invocation
sched/topology: Add asymmetric SMT packing override
sched/fair: Honor asymmetric SMT priority in idle selection
sched: Set TIF_NEED_RESCHED before calling __trace_set_need_resched()
sched/core: Fix context analysis errors in non-preferred CPU push
virt/steal_governor: Enable the driver
virt/steal_governor: Implement steal_governor policy loop
...
|
|
Add IPv4 and IPv6 test cases that program a route that uses a nexthop
object and check that two notifications are emitted for it, with the
second one carrying the RTM_F_TRAP flag.
The new route_nexthop_check() helper follows the same pattern as the
existing route_{addition,deletion,replacement}_check() helpers.
Without "ipv6: Hold RCU when emitting route hardware flags
notification", the IPv6 test case passes, but triggers suspicious RCU
usage splats. The IPv4 test case is added for completeness.
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Eric Dumazet <edumazet@kernel.org>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20261019140337.2886875-3-idosch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 FPU state updates from Borislav Petkov:
- Document and cleanup the signal frame handling with the goal to allow
process migration between CPUs with different FPU capabilities but
which use only a common set of FPU features, i.e., think
checkpoint/restore (Andrei Vagin)
- Consolidate how XSTATE features are checked by doing them once during
boot with the intent of removing cpu_has_xfeatures(). Latter will
happen in the next cycle (Eric Biggers)
- Other cleanups
* tag 'x86_fpu_for_v7.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/fpu: Remove additional remnants of math emulation
x86/fpu: Remove unnecessary checks for X86_FEATURE_FPU
selftests/x86: Add tests for signal frame FPU portability
x86/fpu: Pre-fault only required size of xstate buffer
x86/fpu: Fix potential underflow in xstate_calculate_size()
x86/fpu: Document reasoning of FX-only fallback
x86/fpu: Extract restore_from_ia32_fxstate() and clean up fpu__restore_sig()
x86/fpu: Clean up and rename variables in signal frame handling
x86/fpu: Document signal frame layout and portability
xor: Add AVX-512 optimized xor_gen()
xor: Remove redundant X86_FEATURE_OSXSAVE check
lib/crc: x86: Stop using cpu_has_xfeatures()
lib/crypto: x86: Stop using cpu_has_xfeatures()
crypto: x86 - Stop using cpu_has_xfeatures()
um: Check for missing AVX and AVX-512 xstate bits
x86/fpu: Check for missing AVX and AVX-512 xstate bits
|
|
The changed four tests can print [FAIL] subtests while still exiting with
status 0. Their log_test(), aka log_test_expected() in lib.sh, helpers
record a failure in ret, but the scripts never propagate ret to the exit
code, so a kselftest runner treats the run as a pass.
Initialize ret and exit with it at the end of each script so failed
subtests are reflected in the exit status.
Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
Similarly to '7b0dfbf5776b ("selftests/bpf: Test forbidden
bpf_ksock_send() LSM attach")', tests that the verifier filter prevents
bpf_ksock_sendto() to be called in a LSM program attached to
security_socket_sendmsg() as it would create a direct recursion.
Signed-off-by: Mahe Tardy <mahe.tardy@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261020155848.75711-4-mahe.tardy@gmail.com
|
|
These tests are covering that:
1. sendto() on a unconnected UDP socket works (and that the socket stays
unconnected, i.e. send() on it fails with -EDESTADDRREQ).
2. sendto() on a connected UDP socket with a NULL address is equivalent
to send().
3. sendto() on a connected socket with an explicit address doesn't
change the peer of the socket (send() after sendto() still sends to
the original connected address).
Signed-off-by: Mahe Tardy <mahe.tardy@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261020155848.75711-3-mahe.tardy@gmail.com
|
|
Global subprograms returning a 16-byte scalar use R0:R2. The
verifier therefore checks both registers at every ordinary and unwind
exit.
LLVM lowers a resume to "r0 = 0; unwind_exit". If cleanup code does not
happen to initialize R2, the verifier rejects the unwind path with:
R2 !read_ok
Extend unwind_cxx with a global unsigned __int128-returning subprogram
whose cleanup only releases its RCU read lock. Load it separately so
the existing cases continue to run and the failure is attributed to
this case. Check both the normal aggregate return and caught exception.
The test passes once LLVM defines R2 before emitting unwind_exit.
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261020181320.1284798-7-alexei.starovoitov@gmail.com
|
|
static __noinline int inner(int len)
{
rcu_guard guard;
if (len > 100)
throw 1;
return len;
}
static __noinline int middle(int len)
{
preempt_guard guard;
return inner(len) + 1;
}
SEC("tc") int catches(struct __sk_buff *skb)
{
try {
return middle(skb->len);
} catch (...) {
return 42;
}
}
The exception passes through two frames. The destructors call
bpf_rcu_read_unlock() and bpf_preempt_enable(). The verifier insists on
both, and the test checks that they ran in that order.
In the second prog nobody catches. The destructors run and the prog
returns 0.
All that is left of the C++ runtime is four one line functions.
__cxa_throw() calls _Unwind_RaiseException(), which llvm lowers.
progs/*.cpp are built like progs/*.rs: by clang only and without skeletons.
vmlinux.h and bpf_helpers.h are not C++, so the prog declares what it
needs.
clang that lowers unwinding [1] defines __BPF_FEATURE_UNWIND. Without it
the object has no progs and the test is skipped.
[1] https://github.com/llvm/llvm-project/pull/233649
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261020181320.1284798-6-alexei.starovoitov@gmail.com
|
|
The tests spell the two insns out as raw insns, so they don't depend on
llvm version.
verifier_unwind:
- A static subprog, a global one and a callee of callx leave either way at
run time, through one and two frames. The verifier follows a static
subprog, so the tests derive the argument from skb->len or read it from
a map.
- r0 of unwind_exit, r6-r9 and the stack are there in the pad. r1-r5
are not readable.
- A pad is checked like any other code: it has to drop rcu_read_lock.
- How the callee left is a part of the verifier state: two states that
differ only in that are not pruned.
- The pad of a call of a global subprog is always checked.
- A callee that never returns, where unwind_goto stays and 'goto pc-1'
follows it, and one that never unwinds, where it goes away with the pad.
- What follows unwind_goto runs speculatively: with CAP_BPF only there is
nospec in front of an insn that isn't safe with r0 of unwind_exit.
- unwind_exit without unwind_goto after the call.
- unwind_goto that doesn't follow a call of a subprog or is a jump target.
- Reserved fields.
- A sync callback cannot unwind. What it calls can.
- unwind_exit of an async and of an exception callback is exit.
- Tail call and ld_abs in a subprog that can unwind.
- unwind_exit of the main prog is exit.
- What x86-64 and arm64 JITs emit. With KASAN x86-64 JIT wraps a load in
pushes, a call and pops, so the patterns start after the loads.
- Private stack. On x86-64 r9 has to be restored on the way to the pad.
The last one has to look at the return value of a prog that uses private
stack. raw_tp is such a prog. Its test_run doesn't take a packet, so let
test_loader run it like it runs syscall progs.
unwind_attach, with the caller run after every attach:
- fentry on a subprog that unwinds. fexit is refused.
- freplace of a subprog that unwinds by an extension that returns and by
one that unwinds. The caller goes on after the call or in the pad.
- An extension that unwinds cannot replace a subprog that doesn't.
Every check that the series adds was removed in turn to see that a test
fails.
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261020181320.1284798-5-alexei.starovoitov@gmail.com
|
|
Rust Drop, C++ destructors and __attribute__((cleanup)) in C have to run
when a panic or an exception passes through a frame.
v1 [1] did it with a flag in r3 and 'if r3 != 0 goto pad' after the call.
Three bugs that the bots found there had the same cause: r3 is an ordinary
register, and JITs guessed the meaning from the shape of the code.
Kumar suggested new insns instead [2]:
unwind_goto pad BPF_JMP | BPF_JCOND, src_reg = BPF_UNWIND_GOTO
unwind_exit BPF_JMP | BPF_EXIT, src_reg = BPF_UNWIND_EXIT
'call foo; unwind_goto pad' goes to the pad when foo left with unwind_exit
and falls through when it left with exit. No register says which one it
was. In everything else unwind_exit is exit.
llvm lowers unwinding to them [3]:
ret exit
invoke foo unwind pad call foo; unwind_goto pad
resume r0 = 0; unwind_exit
call _Unwind_RaiseException r0 = 0; unwind_exit
invoke _Unwind_RaiseException goto pad
In a function that returns 16 bytes it's 'r0 = 0; r2 = 0; unwind_exit'.
Landing pads are ordinary blocks, so the verifier checks them like any
other code. A pad that forgets to drop a lock or a reference is a leak on
that path. There are no tables, no stack walk, no kfuncs, no BTF and
nothing to do for libbpf and other loaders.
In the verifier:
- unwind_goto has to follow a call or callx of a subprog and cannot be
a jump target. For cfg, liveness and the rest it's one more conditional
jump, like may_goto.
- How the callee left is one bit of the verifier state. It lives from
the exit of the callee to the next insn. states_equal() looks at it,
since the registers can be the same either way.
- unwind_exit is rejected when unwind_goto doesn't follow the call.
- A global subprog that has unwind_exit can leave either way. Both are
explored after the call, like it's done for might_throw.
- A sync callback cannot unwind. The helper that calls it doesn't expect
that: bpf_loop() would go on.
- unwind_exit of the main prog is exit, unless it's an extension. So it is
in async and exception callbacks. The kernel calls them, and there is no
frame to unwind to.
- An extension leaves either way, like the subprog that it replaced.
freplace is a jump, so the extension returns to the caller of
the subprog. An extension that has unwind_exit can replace only a subprog
that has it too. Otherwise there is no unwind_goto after the calls.
- Of tracing progs only fentry can attach to a subprog or an extension
that has unwind_exit. It would return to the trampoline that called it.
- unwind_exit changes its return address, so the cpu mispredicts
the return and runs what follows unwind_goto speculatively. Without
CAP_PERFMON the verifier looks at that path too.
- unwind_goto goes away together with a pad that turned out to be dead
code. It stays when what follows it is dead code. The cpu predicts that
the callee returns there, so 'goto pc-1' takes the place of the dead
code. Otherwise its removal would move other code there.
JITs don't emit a branch:
unwind_goto:
extable[n++] = { ret_addr - 1 -> pad }
unwind_exit:
my_ret_addr = bpf_unwind_target(my_ret_addr)
epilogue
So exit and the normal path after the call cost nothing. Every frame fixes
only its own return address. There is no stack walk. The lookup is what
the page fault handler does for bpf progs.
The interpreter cannot do that, so the prog has to be JITed, and JITs opt
in with bpf_jit_supports_unwind(). x86-64 and arm64 are in the next
patches.
BPF_JCOND is the same opcode as BPF_CALL_ARGS of the interpreter, and
BPF_UNWIND_GOTO is the same number as BPF_PSEUDO_CALL. may_goto is gone by
the time a prog is dumped, unwind_goto is not. bpf_insn_prepare_dump()
tells them apart: a prog with unwind_goto is always JITed.
Compared to v1 there is no BTF decl_tag and no 'r3 = 0' before every exit.
Tail call and ld_abs are fine in a subprog that can unwind, since they
leave it like exit does.
unwind_exit doesn't set r0. An implicit definition of r0 would need
special cases in backtracking, in liveness and in the check of the return
value of the main prog. A plain 'r0 = 0' in front of it needs none.
Rust
rust-bpf [4] builds with that llvm as it is. The programs are built with
-C panic=unwind. The panic handler prints the message and calls
_Unwind_RaiseException().
exc_cleanup.rs panics three frames deep, with preemption disabled in one
frame and rcu_read_lock held in another. All Drop impls run and the prog
returns 0.
scx_simple.rs is 2195 insns with 48 unwind_goto, 20 of them after callx,
and 16 unwind_exit. With r3 it was 2216 insns. scx_cosmos.rs is 3694 insns
with 68 and 18. It was 3716.
C++
Exceptions work too. This compiles, loads and runs:
struct rcu_guard {
rcu_guard() { bpf_rcu_read_lock(); }
~rcu_guard() { bpf_rcu_read_unlock(); }
};
static __noinline int inner(int len)
{
rcu_guard guard;
if (len > 100)
throw 1;
return len;
}
SEC("tc") int prog(struct __sk_buff *skb)
{
try {
return inner(skb->len);
} catch (...) {
return 42;
}
}
It returns 64 for a packet of 64 bytes and 42 for a packet of 200 bytes.
The destructor runs in both cases, otherwise the verifier would reject
the prog. 'throw' is a jump to the pad with the destructor. 'catch' is
unwind_goto:
inner:
w6 = w1
call bpf_rcu_read_lock
if w6 s< 101 goto ret
r1 = exc_obj ll
*(u32 *)(r1 + 0) = 1
goto pad
ret:
call bpf_rcu_read_unlock
w0 = w6
exit
pad:
call bpf_rcu_read_unlock
r0 = 0
unwind_exit
prog:
w6 = *(u32 *)(r1 + 0)
w1 = w6
call inner
unwind_goto catch
out:
w0 = w6
exit
catch:
w6 = 42
goto out
It needs -fexceptions -funwind-tables and four one line __cxa_*()
functions, where __cxa_throw() calls _Unwind_RaiseException().
Every pad is entered whatever was thrown, so llvm takes catch (...) only.
It's a selftest in patch 5.
[1] https://lore.kernel.org/bpf/20261018010246.1643877-1-alexei.starovoitov@gmail.com/
[2] https://lore.kernel.org/bpf/DM7KR7J8VY2T.1CZIRUF6QRCWG@gmail.com/
[3] https://github.com/llvm/llvm-project/pull/233649
[4] https://github.com/4ast/rust-bpf
Suggested-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261020181320.1284798-2-alexei.starovoitov@gmail.com
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next
Pablo Neira Ayuso says:
====================
Netfilter updates for net-next
The following patchset contains Netfilter/IPVS updates for net-next:
1) Disable br_netfilter in userns and schedule it for removal in 2027,
from Florian Westphal.
2) Update selftest nft_queue.sh to make it more stable on debug
kernels, from Jakub Kicinski.
3) Fix a overflow in IPVS sync messages which can only happen in very
old 2.6 kernels, from Julian Anastasov.
4) Finer grain packet drop in nfnetlink_queue when dependency objects
are going away, from Antonio Ojea.
5) Add a selftest for the nfnetlink_queue packet drop case, also
from Antonio Ojea.
6) Flush conntrack gc worker when existing netns to address a unlikely
UaF, from Florian Westphal.
7) Switch nf_tables chain types to use rcu, otherwise module removal
can trigger UaF, also from Florian.
8) Remove redundant parsing in nft_exthdr for the tcp options case,
from Fernando F. Mancera.
9) Remove redundant skb_header_pointer() calls in nft_exthdr for tcp
options, from Fernando F. Mancera.
10) Fix conntrack_vrf.sh selftest return value in zone subtest,
from Florian Westphal.
11) Restrict raw table in nft_compat to specific family, hook and
priority, from Florian Westphal.
Prepare the flowtable to support for IPv4 over IPv6 tunneling and
vice-versa, this includes 4 patches from Lorenzo Bianconi.
12) Explicitly set inner protocol when popping header, this is not
needed for the existing IPIP and IP6IP6 case because skb->protocol
remains the same.
13) Simplify tuple tunnel information fill up when parsing outer
tunnel IP headers.
14) Add a new encap_proto which determines the outer tunnel protocol
family.
15) Prepare flowtable forwarding path to deal with mixed IPv4-IPv6
tunnels.
* tag 'nf-next-26-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next:
netfilter: flowtable: unify tunnel push for IPv4 and IPv6
netfilter: flowtable: add encap_proto to flow_offload_tunnel
netfilter: flowtable: populate tunnel tuple regardless of inner protocol
netfilter: flowtable: set inner protocol when popping tunnel header
netfilter: nft_compat: restrict raw table targets/matches
selftests: netfilter: fix return value in zone subtest
netfilter: nft_exthdr: avoid 60 bytes stack buffer in TCP option mangling
netfilter: nft_exthdr: remove redundant op parsing in tcp_set_init
netfilter: nf_tables: switch chain_types array to rcu
netfilter: conntrack: fix unlikely UaF in gc worker
selftests: netfilter: nft_queue: check the scope of the hook drop flush
netfilter: nf_queue: limit the hook drop flush to the unregistered hook point
ipvs: fix buffer overflow when sending sync messages
selftests: netfilter: nft_queue.sh: only queue icmp echo request/reply
netfilter: disable br_netfilter in user namespaces
====================
Link: https://patch.msgid.link/20261018005638.1776148-1-pablo@netfilter.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
Add a test that checks that MDB entries that are rejected because the
port reached its maximum number of MDB entries (mcast_max_groups) do not
count towards the maximum number of MDB entries in the bridge
(mcast_hash_max).
The test lowers mcast_hash_max so that only three more entries can be
added. It then configures the port's maximum so that new (*, G) entries
are rejected and tries to add four of them. Next, it raises the maximum
by one so that a new (*, G) entry is accepted, but its (S, G) entry is
rejected, and tries this with four groups. Finally, it checks that
multicast snooping was not disabled because the bridge ran out of MDB
entries.
Like the other tests, the test is run for entries added both by the
control path (IGMP / MLD reports) and by the configuration path
(RTM_NEWMDB), and for both the port and port-VLAN maximums.
Without "bridge: mcast: Delete empty MDB entry when port group creation
fails", the new tests fail (other tests omitted):
# ./bridge_mdb_max.sh
INFO: 802.1d tests
TEST: cfg4: port maxgroups: rejected entries do not exhaust MDB [FAIL]
Multicast snooping disabled by rejected MDB entries
TEST: ctl4: port maxgroups: rejected entries do not exhaust MDB [FAIL]
Multicast snooping disabled by rejected MDB entries
TEST: cfg6: port maxgroups: rejected entries do not exhaust MDB [FAIL]
Multicast snooping disabled by rejected MDB entries
TEST: ctl6: port maxgroups: rejected entries do not exhaust MDB [FAIL]
Multicast snooping disabled by rejected MDB entries
INFO: 802.1q tests
TEST: cfg4: port maxgroups: rejected entries do not exhaust MDB [FAIL]
Multicast snooping disabled by rejected MDB entries
TEST: ctl4: port maxgroups: rejected entries do not exhaust MDB [FAIL]
Multicast snooping disabled by rejected MDB entries
TEST: cfg6: port maxgroups: rejected entries do not exhaust MDB [FAIL]
Multicast snooping disabled by rejected MDB entries
TEST: ctl6: port maxgroups: rejected entries do not exhaust MDB [FAIL]
Multicast snooping disabled by rejected MDB entries
INFO: 802.1q mcast_vlan_snooping 1 tests
TEST: cfg4: port_vlan maxgroups: rejected entries do not exhaust MDB [FAIL]
Multicast snooping disabled by rejected MDB entries
TEST: ctl4: port_vlan maxgroups: rejected entries do not exhaust MDB [FAIL]
Multicast snooping disabled by rejected MDB entries
TEST: cfg6: port_vlan maxgroups: rejected entries do not exhaust MDB [FAIL]
Multicast snooping disabled by rejected MDB entries
TEST: ctl6: port_vlan maxgroups: rejected entries do not exhaust MDB [FAIL]
Multicast snooping disabled by rejected MDB entries
Acked-by: Nikolay Aleksandrov <nikolay@nvidia.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Tested-by: Gabriel Goller <g.goller@proxmox.com>
Reviewed-by: Gabriel Goller <g.goller@proxmox.com>
Link: https://patch.msgid.link/20261016101407.2030133-3-idosch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
Since commit cda2962b6e2b ("neighbour: Namespacify neigh_tables."),
net.ipv[46].neigh.default.gc_thresh[123] are per-netns attributes.
Let's update nft_nat_zones.sh.
Note that the number of neighbour entries does not even reach the
default gc_thresh1 (128) with the default maxclients=100, and the
raised thresholds are only needed for gw netns when maxclients is
manually increased (e.g., 2000 as mentioned in the comment).
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20261013205816.1642597-3-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
Pull arm64 updates from Catalin Marinas:
"Here are the arm64 updates for 7.4.
The more interesting bits are the removal of big-endian kernel support
(already marked BROKEN for some time), preemptible this_cpu_*()
operations and MPAM support for the firmware-backed (Fb) interface.
CCA (Arm's confidential compute) is slowly trickling in with host RMI
(Realm Management Interface) support and some refactoring, including a
dedicated SMCCC bus to advertise firmware services. There are also the
usual PMU updates for new hardware and a few fixes/cleanups.
Core features:
- Remove big-endian kernel support: CONFIG_CPU_BIG_ENDIAN has
depended on BROKEN for a while, so drop the remaining code (BE
hypervisor object, BPF JIT, assembly/crypto/library routines,
endianness helper macros, selftests) and force a little-endian
build
- Add preemptible this_cpu_*() operations (read/write, RMW, xchg,
cmpxchg and cmpxchg128) that no longer need to disable preemption
around the per-CPU address generation and access
- Preparation patches for implementing CONFIG_HOTPLUG_PARALLEL on
arm64
Memory management:
- Treat faults taken by EFI runtime firmware as kernel faults
- Clear PTE_WRITE for EFI_MEMORY_RO mappings (with hardware dirty
state management enabled, this is not truly read-only)
- Raise the default ARCH_MMAP_RND_BITS for 48-bit and 52-bit VA
configurations (28/26/24 bits for 4K/16K/64K pages)
- Implement clear_page[s]() using memset()
- Enable BBML2 no-abort (a.k.a. BBML3) for the NVIDIA Rigel CPU
Perf and PMU:
- Support for HiSilicon's ITS PMU
- Add support for some new events: INST_SIMD_ALU_VEC for Apple PMUs
and a cycle counter for the latest version of HiSilicon's MN PMU
hardware
- A bunch of fixes to the CXL PMU driver to address pre-existing
issues from Sashiko
- Fix generation of PERF_RECORD_ITRACE_START records for SPE and ETM
drivers
- Reduce excessive stack consumption in the Marvell DDR PMU driver
- Minor driver updates and cleanups all over
Arm Confidential Compute Architecture (CCA):
- Add an Arm SMCCC bus for firmware services discovered through SMCCC
and move the TRNG and CCA guest (TSM provider) drivers onto it,
removing the dummy CCA platform device and adding a sysfs ABI for
Realm guests
- Move the Realm Service Interface (RSI) code out of arch/arm64/ into
drivers/firmware/arm_rmm/
- Add the host side of the Realm Management Interface (RMI): detect,
configure and activate the RMM, add SRO support and wrappers for
the Realm RMI commands
- Block hibernation (new arch hook in the PM core) and kexec while
the RMM is active. To be revisited in the future with proper
support for deactivation
- Handle Granule Protection Faults (GPFs) taken by the host, caused
by accesses to memory delegated to the RMM. In a future patch, the
exception table lookup will be limited to is_kdump_kernel() cases
MPAM (Memory Partitioning And Monitoring):
- Add support for the MPAM firmware-backed (Fb) interface, allowing
MSC accesses to be mediated by firmware
- Fix a list of theoretical issues with the driver (MSC access error
propagation, MBWU monitor save/restore and locking, resctrl class
handling, error interrupt restore, maximum number of PARTIDs)
- Add the mailing list and a missing file to the MAINTAINERS entry
- Document when to set arm64.nompam
Errata and CPU features:
- Add the NXP i.MX8QM/8QP workaround for the Cortex-A53 cache
coherency issue (ERR050104), using a new ARM64_CPUCAP_SOC_ERRATUM
capability type for SoC-level errata
Miscellaneous:
- Mask debug exceptions (DAIF) around the hardware breakpoint
register manipulations when called from generic kernel code
- Don't zero the SVE state buffer when the SVE state is live
- Return -EPERM instead of -EBUSY from the GCS prctl() locking
failures (matching x86), with the selftest updated. Slight ABI
change but no software deployment yet
- kselftest: fix unsound MTE fault skipping by introducing MTE-safe
memory accessors, avoid copying each signal test binary more than
once
- Update sysreg definitions (fix three enum values and two field
names, mark architecturally dropped fields as RES0) and remove the
TME transaction state check from the BRBE driver
- Fix the description of ARM64_HAS_LPA2 and remove a redundant
ID_AA64MMFR0 define"
* tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: (144 commits)
arm64: cpufeature: Enable BBML2 for NVIDIA Rigel
arm64: cputype: Add NVIDIA Rigel definitions
arm64: raise default ARCH_MMAP_RND_BITS for 48-bit and 52-bit VA
arm64/debug: mask debug exceptions when called from common code
kselftest/arm64: signal: copy each test binary only once
kselftest/arm64: Check for -EPERM not -EBUSY in the locking test
arm64: gcs: Return -EPERM not -EBUSY for prctl() locking failures
perf: arm_brbe: Remove the check for TME transaction states
arm64: sysreg: Mark fields the architecture dropped as RES0
arm64: sysreg: Fix the names of two misspelt fields
arm64: sysreg: Fix three incorrect enum values
arm64: smp: Defer RCU registration during secondary CPU bringup
arm64: smp: Don't bother printing the I-cache policy for each CPU
arm64: smp: Defer update of secondary CPU capabilities
arm64: smp: Tidy up cpuinfo init and cpufeature updates
arm64: smp: Tidy up smp_prepare_cpus()
arm64: cpufeature: Store every ID register with its overrides applied
arm64: cpufeature: Read MPAMIDR_EL1 in __cpuinfo_store_cpu()
arm64: cpufeature: Add read_cpuid_with_overrides()
arm64: cpufeature: Check arm64_ftr_regs[] before the first store
...
|
|
Pull arch/microblaze updates from Michal Simek:
"Some issues were found by AI but nothing dramatic.
The signal changes are related to upgrading the toolchains supported
by AMD. Hardened MicroBlaze cores are used in AMD/Xilinx chips, and
they will be supported for another 10+ years. New tests were run as
part of this effort, and that's how the signal stack issues were
found.
The KUnit patches have been reviewed by David, and he agreed that they
can go through my tree.
Summary:
- Add Kunit support
- Update signal handling
Small changes:
- coding style, typos
- don't use "new" ASM pseudocode
- fix refcount leak in cpuinfo code
- prevent ptrace writes to MSR and pt_mode
- enable Xilinx DMA driver by default
- build userprogs for the correct endianness"
* tag 'microblaze-v7.4' of git://git.monstr.eu/linux-2.6-microblaze:
microblaze: Build userprogs for the correct endianness
microblaze: Enable xilinx dmas and axi emac drivers
kunit: qemu_configs: Add microblaze configurations
microblaze: reset: Provide a power off handler through an unaligned PC
microblaze: reset: Call POWER_OFF handlers
microblaze: Pass -m{big,little}-endian through KBUILD_CPPFLAGS
microblaze: uaccess: Zero out destination on failed get_user()
microblaze: fix typo "multipler" in comment
microblaze: prevent ptrace writes to MSR and pt_mode
microblaze: CCF: fix refcount leak
microblaze: preserve the MSR carry flags across signals
microblaze: restore the ABI argument home area below pt_regs (PTO)
microblaze: don't clobber r3/r4 restored by rt_sigreturn
microblaze: reserve the ABI argument-home area in the signal frame
microblaze: wire up sigaltstack
microblaze: drop unneeded semicolon
microblaze: Fix MB_MANAGER build with older binutils
|
|
Commit b566f7a4f0e4 ("selftests/landlock: Fix snprintf truncation checks
in audit helpers") fixed the truncation detection in audit.h by changing
the comparison from ">" to ">=" to correctly handle the edge case where
snprintf returns a value equal to the buffer size.
However, the same pattern exists in ptrace_test.c, audit_test.c, and
net_test.c and was not fixed. snprintf() returns the number of
characters that would have been written, excluding the terminating NUL
byte. When the output is truncated, this return value equals or exceeds
the buffer size. The existing ">" check therefore fails to detect
truncation when the return value equals the buffer size.
Fix these remaining instances to use ">=" for truncation detection,
matching the fix in audit.h.
Fixes: 6a500b22971c ("selftests/landlock: Add tests for audit flags and domain IDs")
Signed-off-by: Haofeng Li <lihaofeng@kylinos.cn>
Signed-off-by: Wang Yan <wangyan01@kylinos.cn>
Reviewed-by: Günther Noack <gnoack@google.com>
Link: https://patch.msgid.link/20260626070016.61049-1-wangyan01@kylinos.cn
Cc: stable@vger.kernel.org
Signed-off-by: Mickaël Salaün <mic@digikod.net>
|
|
Add tests to exercise LANDLOCK_PERMISSION_CAPABILITY_USE enforcement. A
sandboxed process is denied a handled capability when no rule grants it,
and an explicit rule restores it. Unknown capability values above
CAP_LAST_CAP are accepted at rule-add time yet have no runtime effect,
because deny-by-default still applies once the domain is enforced.
Stacking tests cover the per-layer allow/deny combinations, including a
layer that does not handle the permission, and invalid rule attributes
return the expected errors.
Three tests exercise non-standard capability contexts: enforcing a
domain via CAP_SYS_ADMIN authorization without no_new_privs, restricting
capabilities gained through the kernel's user namespace ownership bypass
(cap_capable_helper), and checking CAP_SYS_ADMIN against a descendant
user namespace, with an unsandboxed positive control, to confirm the
decision is independent of the target.
Audit tests verify denied and allowed capabilities, per-member quiet
interactions, and CAP_OPT_NOAUDIT suppression. Trace tests cover
accepted, rejected, and no-op rule adds, and normal, quiet, and
CAP_OPT_NOAUDIT denials.
Test coverage for security/landlock is 91.8% of 2864 lines according to
LLVM 22.
Cc: Christian Brauner <brauner@kernel.org>
Cc: Günther Noack <gnoack@google.com>
Cc: Paul Moore <paul@paul-moore.com>
Cc: Serge E. Hallyn <serge@hallyn.com>
Link: https://patch.msgid.link/20261014082718.1435842-7-mic@digikod.net
Signed-off-by: Mickaël Salaün <mic@digikod.net>
|
|
Add tests covering LANDLOCK_PERMISSION_NAMESPACE_USE (namespace creation
via unshare/clone and namespace entry via setns) and its interaction
with LANDLOCK_PERMISSION_CAPABILITY_USE.
Rule validation covers the forward-compatibility contract: unknown
CLONE_NEW* bits, including holes, upper-range bits and bit 63, are
accepted at rule-add time yet have no runtime effect, because
deny-by-default still applies once the domain is enforced. Empty masks,
invalid permission selectors and non-zero flags are rejected.
Creation tests use FIXTURE_VARIANT to exercise all eight namespace types
across allowed/denied and privileged/unprivileged combinations, so every
type is shown to reach security_namespace_init(). Stacking tests cover
the three per-layer allow/deny combinations that exercise distinct
walker paths, and one domain handles both permissions at once.
Entry tests subject setns to the same type-based check through
security_namespace_install(), across processes, and require both
permissions to allow a non-user namespace.
The four open_tree(2) and fsmount(2) variants, anonymous and not, all
create a mount namespace: they converge in security_namespace_init()
with CLONE_NEWNS through different alloc_mnt_ns() paths. A
CLONE_NEWUSER | CLONE_NEWUTS unshare under partial-allow rules shows
that creation is sequential, so a denial on either type rolls the whole
syscall back with EPERM.
Audit tests cover allowed and denied creation and entry, per-member
quiet masks and the youngest-denying-layer rule. Trace tests cover
handled permissions, successful and rejected rules, version history,
namespace IDs, and quiet denials, including repeated and unknown-only
effective no-ops.
Cc: Christian Brauner <brauner@kernel.org>
Cc: Günther Noack <gnoack@google.com>
Cc: Paul Moore <paul@paul-moore.com>
Cc: Serge E. Hallyn <serge@hallyn.com>
Link: https://patch.msgid.link/20261014082718.1435842-6-mic@digikod.net
Signed-off-by: Mickaël Salaün <mic@digikod.net>
|
|
Add Landlock enforcement for namespace use through the LSM
namespace_init and namespace_install hooks. This lets a sandboxed
process restrict which namespace types it can create, join, or acquire a
file descriptor for, using LANDLOCK_PERMISSION_NAMESPACE_USE and
per-type rules.
Introduce the handled_permissions field in struct landlock_ruleset_attr:
each permission gates every use of a kernel-defined category (CLONE_NEW*
namespace types, CAP_* capabilities) with complete deny-by-default
coverage, so unknown member values need no validation, being denied
until a rule allows them. This UAPI extension advances the Landlock ABI
from 11 to 12.
There is no domain-ancestry bypass and no namespace-creator tracking,
only a flat per-layer allowed-types bitmask: hook_namespace_init()
covers creation through clone(2), unshare(2), open_tree(2) and
fsmount(2), and hook_namespace_install() covers setns(2). Each
permission hook maps its member mask explicitly in the shared permission
walker, which warns and denies if a future caller omits that mapping.
These categorical denials return -EPERM, matching Landlock's scope and
mount-topology denials rather than its object-access -EACCES convention.
struct permission_masks is forced to eight bytes with __packed and
__aligned because it must eventually hold both the eight namespace types
and all capabilities, and because m68k GCC otherwise packs its u64
bitfields at byte granularity, making the structure smaller than
sizeof(u64). Carrying it grows struct layer_config from 4 to 16 bytes,
so the largest 16-entry domain FAM grows from 64 to 256 bytes.
The permissions selector keeps the rule attribute self-describing:
- User space can mask it against handled_permissions, as it masks
allowed_access against handled_access_fs, so a program built against
newer headers still adds the rules an older kernel supports.
- It tells apart two attributes that share the same three-u64 layout.
Unknown member bits are ignored, so without it a mismatched rule type
would apply a capability mask as namespace types.
- It leaves room for a rule to carry several permissions, or for another
rule type to key the same permission differently.
The rule also carries a quiet_namespace_types bitmask that suppresses
audit submission for denied members without granting them. A sandbox
knowingly running a caller that probes a type it will never be granted
would otherwise flood the audit log and drown the surprising denials
that matter. Quiet is per-member rather than a coarse per-category
ruleset bit, so a sandbox can silence CLONE_NEWNET while still auditing
CLONE_NEWUTS; making it the complement of the allowed set would be
broad, could not audit a member that is neither allowed nor explicitly
quieted, and would auto-hide members added by future kernels. It is a
per-rule bitmask rather than the LANDLOCK_ADD_RULE_QUIET flag and the
ruleset quiet_access_* masks, which suit the unbounded rb-tree objects
of filesystem and network rules, so that flag is rejected here. Only
the youngest denying layer's quiet mask decides, so a parent cannot
silence a denial made by a deeper layer.
Trace the handled permission mask, every successful namespace rule, and
namespace denials. Successful effective no-ops advance the version, and
quiet denials remain trace-visible with logged=0. The denial event
takes the blockers argument of the filesystem and network events and
records the same blockers_type and blockers_access fields, so one filter
expression spans the mask-bearing denial events. Handled and rule
permission masks may contain permissions from multiple domains in one
field, so their names are domain-qualified, such as namespace.use. A
blocker is already interpreted in the domain supplied by the audit
prefix or denial event, so it retains the bare action name use, matching
existing access blockers such as read_file.
User namespace creation does not require capabilities, so Landlock can
restrict it directly. Non-user namespace types require CAP_SYS_ADMIN
before the Landlock check is reached; when the capability permission
added by the next commit is also handled, both must allow the operation.
Cc: Christian Brauner <brauner@kernel.org>
Cc: Günther Noack <gnoack@google.com>
Cc: Paul Moore <paul@paul-moore.com>
Cc: Serge E. Hallyn <serge@hallyn.com>
Link: https://patch.msgid.link/20261014082718.1435842-4-mic@digikod.net
Signed-off-by: Mickaël Salaün <mic@digikod.net>
|
|
This is the result of an incorrect conflict resolution in merge
commit 994489f04ebb ("Merge tag 'kvm-x86-selftests-7.4' of
https://github.com/kvm-x86/linux into HEAD", 2026-10-16).
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
Remove bpf_asm, bpf_dbg and bpf_jit_disasm, along with the assembler's
lexer and parser, as suggested by Daniel. These tools are old classic BPF
and these days there is no need to keep them in kernel anymore.
Drop their build and install rules, feature checks and ignore entries.
Remove the tool-specific documentation and update the PTP classifier and
packet socket test comments. Keep the classic BPF instruction descriptions
and assembly examples.
Keep the bpftool and resolve_btfids build and clean targets, and the
bpftool install target.
Suggested-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Xia Yan <yanxia@cmss.chinamobile.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/61f7315e-c835-425e-a99b-d2470ba9a875@iogearbox.net
Link: https://lore.kernel.org/bpf/20261020095124.928021-1-yanxia@cmss.chinamobile.com
|
|
tdc.sh preloads only some of the qdisc modules that the tc-testing
config enables. Add the missing ones: ingress, mqprio, multiq, netem,
pie, plug, prio, qfq, red, sfb, sfq, skbprio, taprio and tbf.
Signed-off-by: Ivan Vecera <ivecera@redhat.com>
Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>
Link: https://patch.msgid.link/20261014122045.2375722-1-ivecera@redhat.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
|
Test 8c39 brings up lo with a bare "ip" command. nsPlugin runs it as
"$IP netns exec <ns> ip ...", and as tdc runs commands with an empty
environment, "ip netns exec" searches only the default execvp() path
(/bin:/usr/bin). On systems that install ip only in /sbin, like Fedora,
the setup fails:
# ./tdc.py -e 8c39
Test 8c39: HFSC classify walk still reaches leaf after lateral drift
-----> prepare stage *** Could not execute: "ip link set lo up"
-----> prepare stage *** Error message: "exec of "ip" failed: No such file or directory
Use $IP like all other tdc tests do.
Fixes: 1e24c4f2ee44 ("selftests: tc-testing: add a lateral-drift hfsc classify-walk test")
Signed-off-by: Ivan Vecera <ivecera@redhat.com>
Reviewed-by: Victor Nogueira <victor@mojatatu.com>
Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>
Link: https://patch.msgid.link/20261014121414.2373985-1-ivecera@redhat.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
|
During conversion, we retain the same table and chain names used by the
original iptables/ip6tables setup, so rule output is identical to the
former iptables/ip6tables output. Add new function init_nftables so we
only do nft table setup when test need set nft rules.
Unlike iptables, nftables cannot match rules based on their full
specification. Since endpoint_tests is the only test that delete rules,
which inserts and deletes rules one by one. Flushing the table
directly is safe and easier than using nft_handle.
The cBPF bytecode matching MPTCP add‑addr is replaced with native nft
matching using "tcp option mptcp subtype add-addr". But the RM_ADDR
suboption is added after the MPTCP DSS option, and nft is unable to
handle this because it stops parsing further TCP options once it matches
the first one. We therefore use hard-coded offsets to match the RM_ADDR
suboption.
The config file adds CONFIG_NFT_NUMGEN (replaces iptables statistic nth),
CONFIG_NFT_REJECT and CONFIG_NFT_REJECT_INET for reject‑related rules.
Remove other unneeded configs.
Remove the iptables/ip6tables check in mptcp_lib.sh since no script use
it now.
Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20261013-net-next-mptcp-misc-feat-7-4-part2-v1-4-1181e5d2fda4@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
|
During the conversion, we retain the same filter and chain names previously
used by iptables/ip6tables. Counters are not added to accept rules because
the test does not inspect them. The syn mark rule is removed as it is
only for debugging, which could be added easily when needed.
After conversion, the generated output matches the original
iptables/ip6tables behavior.
Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20261013-net-next-mptcp-misc-feat-7-4-part2-v1-3-1181e5d2fda4@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull pidfd updates from Christian Brauner:
"This adds thread specific pidfds to af_unix sockets.
SO_PASSPIDFD and SO_PEERPIDFD hand out a pidfd for the thread-group
leader. A coredump server on the coredump socket can't get a handle on
the thread that took the signal and is writing the dump, and anything
doing per-thread authentication has the same problem. The sending and
the connecting thread are recorded in addition to the thread-group
leader and sk_peer_pid becomes an array indexed by pid type.
SO_PASSPIDFD_THREAD works like SO_PASSPIDFD but delivers an
SCM_PIDFD_THREAD cmsg for the sending thread. Both options are
independent so a receiver can ask for both. On SOCK_STREAM sockets
recvmsg() only stops merging data at a thread boundary when the
receiver asked for a thread pidfd. SO_PEERPIDFD_THREAD returns a pidfd
for the thread that called connect(), listen() or socketpair(). pidfs
records the coredump on the dumping thread's struct pid too so its
pidfd reports it like the leader's does. Selftests for af_unix and the
coredump socket are included"
* tag 'vfs-7.4-rc1.shared.net-next.pidfd' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
selftests/coredump: check the dumping thread's pidfd
pidfs: record the coredump on the dumping thread's pid too
selftests/net: SO_PEERPIDFD_THREAD
net: add SO_PEERPIDFD_THREAD to get a thread-specific pidfd
af_unix: record the pid of the connecting thread
net: turn sk_peer_pid into an array indexed by pid type
selftests/net: SO_PASSPIDFD_THREAD
net: add SO_PASSPIDFD_THREAD to get a thread-specific SCM_PIDFD
af_unix: record the pid of the sending thread
pid: add helpers to operate on a struct pid array
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull mount updates from Christian Brauner:
"This adds OPEN_TREE_DROP_MNTNS_MOUNTS.
crun started using OPEN_TREE_NAMESPACE to set up the container's mount
namespace and open_tree(OPEN_TREE_CLONE) for the sources of its bind
mounts. That fails on any host with a mount namespace pinned below
such a source. The recursive clone picks the pinned namespace up and
move_mount() refuses to attach the tree with ELOOP. Only a younger
mount namespace may ever be bound into an older one or mount namespace
references could form a loop. A namespace created with
OPEN_TREE_NAMESPACE is younger than everything else on the system so
from inside it every pinned namespace is older. By the time this fails
setns() has run and the host tree is out of reach, so the runtime has
to predict the situation beforehand and lose the optimization. snapd
pins mount namespaces under /run/snapd/ns so on Ubuntu that is any
container bind mounting the host root.
Every other path crossing a mount namespace boundary already leaves
these mounts behind, copy_mnt_ns() and create_new_namespace() both do.
Only get_detached_copy() asks for them.
The new flag lets a caller get a clone without them. It stays opt-in
because open_tree(OPEN_TREE_CLONE) plus move_mount() is mount --rbind
through a file descriptor and dropping them by default would silently
lose /run/snapd/ns/*.mnt on a live system. It requires AT_RECURSIVE,
is a no-op with OPEN_TREE_NAMESPACE and skips locked nsfs mounts the
way copy_mnt_ns() does, so nothing new is exposed. Selftests are
included"
* tag 'vfs-7.4-rc1.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
selftests/filesystems: test OPEN_TREE_DROP_MNTNS_MOUNTS
mount: add OPEN_TREE_DROP_MNTNS_MOUNTS
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull misc vfs updates from Christian Brauner:
"Fixes:
- aio: a keyed poll completion on an epoll instance could recurse
into the same epoll waitqueue lock when the result eventfd is
watched by that very instance. An unprivileged process could make a
CPU spin on the recursive lock. eventfd-backed poll completions are
always deferred now.
- fsnotify_inoderemove() is only called once the inode is really
dead, no nlink and no aliases, and open_by_handle_at() can't add an
alias to a dead inode anymore. The race could crash fsnotify or
lose inode mark notifications.
- devtmpfs: the conversion of the public instance to ->get_tree()
broke reconfiguring the shared superblock's options on later mounts
which made the boot time defaults permanent. A reconfigure context
is kept in fc->fs_private so the parse ops can forward options to
the underlying filesystem.
- ufs truncated the 64-bit directory size to an unsigned int in
ufs_last_byte(). A crafted image with a 4 GiB directory produced an
out-of-folio read in ufs_find_entry() and, with
CONFIG_UFS_FS_WRITE, a write into an adjacent page.
- devpts rejects max=0 instead of silently lifting the per-instance
pty limit. The value wrapped into ida_alloc_max() and became
unlimited.
- fs_pin publishes pins with the rcu list helpers so the kill paths
reading the lists under rcu see the initialization.
- dentry_kill() reports a Tasks-RCU quiescent state. Its
cond_resched() is the only reschedule point on the dentry teardown
path and cond_resched() isn't a quiescent state for Tasks-RCU, so
Meta kept seeing rcu_tasks stalls in btrfs subvolume deletion.
- writeback sizes foreign flushes by the target wb's dirty pages
instead of the memcg-wide count which over or undersized a single
bdi flush.
- nfsd READ emitted two fsnotify access events on the iterator path
since vfs_iocb_iter_read() already sends one. A READ on a krb5i or
krb5p mount showed up twice in inotify.
- pipe and splice pass a poll key when waking readers and writers so
epoll, poll() and select() waiters only wake for the event they
asked for.
- the iso8859-14 Unicode to charset tables had page01 duplicated as
page1e so 29 code points mapped to the wrong bytes and 22 that
aren't in the charset were accepted.
- orangefs doesn't wait for an unmount service operation that never
returns on system shutdown and uses ssize_t for strscpy() errors.
- __register_chrdev() checks the kobject_set_name() return value.
- selftest fixes: the openat2 tests hardcoded O_LARGEFILE to 0x8000
which is O_NOFOLLOW on powerpc, resolve_test makes /tmp a
mountpoint so RESOLVE_NO_XDEV has a boundary to trip over,
file_stressor moves into its own directory with a 30 minute
timeout, the kernfs listxattr test skips when SELinux exposes
security.selinux, the namespaces active reference tests wait for
the thread via a PIDFD_THREAD pidfd since pthread_join() returns
before exit_nsproxy_namespaces(), the idmapped_tmpfile test chowns
its directory into the mapped range, the clone3 CLONE_CLEAR_SIGHAND
test adds CLONE_VM so it fails for the intended reason, the pidfd
PPID error message prints the values it compares and fscontext_ns
gets a .gitignore.
Cleanups:
- vmcore prints the release of the crashed kernel from the VMCOREINFO
note so a kdump that dies before the dump lands still says which
kernel it was for.
- initramfs allocates hardlink hash entries with the validated cpio
name length instead of PATH_MAX, which put every entry in
kmalloc-8k.
- the unused dax_layout_busy_page() is removed,
dax_layout_busy_page_range() becomes static and dax_folio_init()
drops a redundant list initialization.
- vfs_empty_path() is removed, it has had no callers since
getname_maybe_null().
- comment and documentation fixes in aio, bpf_fs_kfuncs,
fs-writeback, inode, read_write, squashfs and the vfs.rst copy of
struct file_system_type"
* tag 'vfs-7.4-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (38 commits)
selftests/filesystems: Fix idmapped_tmpfile layer dir ownership
selftests/namespaces: Wait for thread exit via pidfd in active-ref tests
writeback: size foreign flushes by target wb dirty pages
initramfs: Reduce hardlink hash allocation sizes
fs: remove unused vfs_empty_path()
dcache: report a Tasks-RCU quiescent state in dentry_kill()
vmcore: report the release of the crashed kernel
splice: pass a poll key when waking pipe readers and writers
pipe: pass a poll key when waking writers after a resize
orangefs: use ssize_t instead of size_t for error codes...
orangefs_super: don't wait on service operation on system shutdown.
docs/vfs: Fix the struct file_system_type copy
nls: fix the Unicode to charset tables of iso8859-14
selftests/filesystems/openat2: make /tmp a mountpoint inside private namespace
selftests/filesystems/openat2: fix O_LARGEFILE definitions for non-arm64 architectures
fs: fix misleading comments in read_write.c
squashfs: fix inode number description in documentation
fs: fix typos in comments
fs/dax: Make dax_layout_busy_page_range() static
fs/dax: Remove unused dax_layout_busy_page()
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull kernfs updates from Christian Brauner:
"This contains kernfs scalability work from Shakeel driven by what Meta
sees in their fleet. kernfs_rwsem is per kernfs root, so sysfs and
cgroupfs each have one for the whole machine, and every create, remove
and rename takes it for writing. rwsems don't let readers steal the
lock once a writer is queued, so one cgroup being created or a device
being renamed parks the entire incoming reader stream in
uninterruptible sleep. Daemons that poll cgroup files in a loop turn
that into a convoy and the two that hurt most, oomd and below, are the
ones that are supposed to relieve memory pressure and record what
happened.
kernfs_dop_revalidate() took kernfs_rwsem for read once per path
component of every walk into a kernfs mount. Nothing it reads needs
the semaphore. kn->active is an atomic_t, kn->__parent and kn->name
are rcu pointers, kn->ns can be compared instead of dereferenced and
the directory revision is a plain counter. The callback runs under rcu
now. Readers walking cgroupfs and sysfs while another thread churns
cgroups, renames netdevs and plugs devices went from 48,593,360 read
acquisitions and 1,744,517 contentions to 1,280,280 and 429,846 on an
8-CPU VM and path walk throughput improved 35-53%. LOOKUP_RCU still
returns ECHILD because kernfs_iop_permission() forces every walk out
of rcu-walk anyway. That is left for later.
kernfs_fop_readdir() held the semaphore across dir_emit(). dir_emit()
copies to userspace and under memory pressure that fault goes to
reclaim with the lock every create, remove and rename needs held for
reading. Meta sees 120 second allocation stalls in filldir64() from
below and systemd-oomd stuck behind it. The lock is dropped around
dir_emit() now. Since the entry the listing stopped on can disappear
in that window and two entries can share a hash, readdir resumes on
the full (hash, ns, name) key and the fallback search lands after the
missing entry instead of repeating or skipping one. The repeat was a
pre-existing bug between two getdents(2) calls.
Three more lock holds are shortened. kernfs_notify_workfn() no longer
holds kernfs_rwsem across fsnotify() which allocates against the memcg
of the watching cgroup that is already under pressure. The open node
is allocated outside the hashed open file mutex, the most contended
lock in kernfs on their fleet with 2.19M waiters over 29 days and a
77ms median hold. A new node is activated without dropping and
retaking the write lock, lock_stat says 1200 -> 830 write acquisitions
for five dummy netdevs, and kernfs_rename_ns() allocates the new name
before and frees the old one after the lock so a rename can't enter
reclaim or wait out a grace period with it held.
Three standalone fixes come with selftests. Same-parent renames take
kernfs_rename_lock too so kernfs_path_from_node() can't build a path
that never existed. Decoding a file handle takes the semaphore so a
decode racing rmdir() can't hash an inode after the removal's
ilookup() pass and lose IN_DELETE_SELF. And kernfs_create_link() reads
the target's uid and gid under kernfs_iattr_rwsem so a chown in
between can't give the link an owner the target never had. The kernfs
selftests grew from two xattr checks to coverage of dentry
revalidation, rename, namespace tagging, file handles and readdir
under churn"
* tag 'vfs-7.4-rc1.kernfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
kernfs: free the old name outside kernfs_rwsem
kernfs: allocate the new name outside kernfs_rwsem
kernfs: activate a new node without dropping kernfs_rwsem
selftests: cover readdir resuming at a removed entry
kernfs: don't hold kernfs_rwsem across dir_emit()
kernfs: resume readdir on the full entry key
kernfs: don't repeat or skip an entry when readdir resumes
kernfs: don't hold kernfs_rwsem across notification delivery
kernfs: allocate the open node outside the open file mutex
kernfs: fix up the unlocked attribute reads on the creation paths
kernfs: don't lose IN_DELETE_SELF when decoding a file handle
kernfs: take kernfs_rename_lock for same-parent renames too
selftests: cover kernfs file handles and same-parent rename
selftests: cover kernfs dentry revalidation
kernfs: Remove kernfs_rwsem from dentry revalidation
kernfs: Avoid namespace dereference in d_revalidate()
kernfs: Prepare directory revisions for lockless reads
kernfs: Use VFS lookup context in d_revalidate()
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull coredump updates from Christian Brauner:
"This adds sparse coredumps and per-request memory type selection to
the coredump socket protocol.
A coredump sent over the socket transfers every zero of every hole in
every mapping. For a process with 128 threads that's 1 GB of mostly
thread stacks, 8 MB reservations with a few pages touched, and the
holes sit in the middle of the dump rather than at the end. The
coredump_filter bit that was proposed for this stops each PT_LOAD at
the last populated page. But that mask says which kinds of memory to
include and propagates across fork and exec, whereas what is selected
here is an encoding. The usermodehelper isn't salvagable for this
either. The coredump socket already has a handshake for exactly this.
A server that raises COREDUMP_RECORDS in coredump_ack->mask gets the
coredump as a sequence of records, each a struct
coredump_record_header followed by what it describes. The stream ends
explicitly with an end record that reports the size, so a missing one
means truncation.
With COREDUMP_SPARSE holes cross the socket as a bare header that says
how many zero bytes were skipped. Reassembling the records gives back
the same coredump, so a debugger and everything else still see an
ordinary core file. Numbers from the selftests: the 128 thread process
sends 1424153 bytes for a coredump of 1075150848 bytes, a 256 MB
mapping with the first and the last page touched sends 188793 bytes
for 268890112 bytes, and with COREDUMP_RECORDS alone the record
overhead is under one percent.
The selftests also simulate a server uploading to a blob store that
can't seek and rewrites the program headers so the object is an
ordinary ELF core file without the holes.
COREDUMP_MEMORY_TYPES lets the server choose what memory to dump per
request instead of relying on the static /proc/<pid>/coredump_filter
of the crashing task. The request carries the default types and a mask
of every type the kernel knows about, the ack carries the selection.
Zero is valid and dumps the program headers and notes and nothing but
the mappings that are always dumped.
Preparatory cleanups refuse negative skips in dump_skip_to(), chunk
every write at a page so a pipe or a socket never takes a short write
in the middle of a record, make the dump helpers return bool and
replace the core_dumped integer with COREDUMP_STATE_STARTED and
COREDUMP_STATE_TRUNCATED flags.
Also included is a fix for coredump_parse() reading core_pattern while
it is being modified. The sysctl handler now validates a copy and
publishes it under a spinlock and the parser works on a snapshot, so a
rejected pattern is never visible and the rollback logic goes away.
And to_kthread()'s lockless flags read is annotated with READ_ONCE()"
* tag 'vfs-7.4-rc1.coredump' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (29 commits)
kthread: Annotate lockless to_kthread() flags access
coredump: parse a snapshot of core_pattern
selftests/coredump: test failed handshakes
selftests/coredump: improve coredump size negotiation tests
selftests/coredump: test COREDUMP_MEMORY_TYPES
selftests/coredump: simplify the refusal tests
tools: sync coredump.h header
coredump: select memory types to include
selftests/coredump: show how to inspect the task to decide how the coredump should be sent
selftests/coredump: simulate a blob store
selftests/coredump: put a hole in the middle of a sparse mapping
selftests/coredump: hand the record stream to a sink
selftests/coredump: test COREDUMP_RECORDS and COREDUMP_SPARSE
coredump: describe the holes when COREDUMP_SPARSE is negotiated
coredump: send the coredump in records if requested
tools: sync coredump.h header
coredump: add COREDUMP_SPARSE to the coredump socket protocol
coredump: add COREDUMP_RECORDS to the coredump socket protocol
coredump: clean up coredump state handling
coredump: always chunk writes
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull close_range updates from Christian Brauner:
"This adds two new close_range() flags.
CLOSE_RANGE_EXCEPT makes close_range() operate on all file descriptors
outside of [fd, max_fd] instead of the ones inside. Alone it closes
everything but the range. With CLOSE_RANGE_CLOEXEC it marks everything
but the range close-on-exec. With CLOSE_RANGE_UNSHARE dup_fd() never
takes a reference on what is dropped. So a task between
clone(CLONE_FILES | CLONE_VM | CLONE_VFORK) and execve() that has the
descriptors for the child in one window can shed the rest of the
shared table in one call and nothing outside of the window is
referenced by the child at any point.
CLOSE_RANGE_CLOEXEC_ONLY closes the close-on-exec descriptors in the
range and leaves everything else alone. Whatever the caller
deliberately passes down, stdio, LISTEN_FDS, an inherited pipe, stays
where it is. Combined with CLOSE_RANGE_EXCEPT it names the handful of
close-on-exec descriptors that have to survive, the executable or an
error pipe, and closes every other close-on-exec descriptor.
Along the way dup_fd() stops copying a range in the middle of the
table only to close it again. close_range(CLOSE_RANGE_UNSHARE) only
avoided the copy when the range sat at the end of the table.
Descriptors in a skipped range are never copied and no reference is
taken on them, so ->flush() isn't called anymore for files from a
table they were never part of. The flags are turned into an enum and
selftests cover the window positions, the shared and the private table
and the unshare form"
* tag 'vfs-7.4-rc1.close_range' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
selftests/core: test CLOSE_RANGE_CLOEXEC_ONLY
file: add CLOSE_RANGE_CLOEXEC_ONLY
file: let dup_fd() drop only close-on-exec descriptors
selftests/core: test CLOSE_RANGE_EXCEPT
file: add CLOSE_RANGE_EXCEPT
close_range: turn the flags into an enum
file: let dup_fd() drop everything outside of the range
file: rename dup_fd()'s punch_hole to range
selftests/core: test the hole CLOSE_RANGE_UNSHARE leaves behind
file: let dup_fd() leave the punched hole behind
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull binfmt updates from Christian Brauner:
"This only lets punctuation delimit a binfmt_misc register string.
Arbitrary delimiters never made sense and nothing uses them. Every new
flag shrank the set of possible delimiters and made extensions more
hazardous than they need to be. Letters, digits, whitespace, control
characters, bytes above 0x7f and the backslash now get EINVAL.
Everything deployed uses ':' anyway. This extends the fix that
rejected a flag character as the delimiter.
Selftests and documentation are included"
* tag 'vfs-7.4-rc1.binfmt' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
binfmt_misc: document the field delimiter
selftests/exec: test delimiter restrictions
binfmt_misc: only let punctuation delimit a register string
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull bfs removal from Christian Brauner:
"This removes bfs, the filesystem UnixWare uses for its boot partition.
It only supports contiguous files and has no subdirectories. The only
data on such a partition are kernels and bootloader settings so there
is no reason to access it from Linux anymore. The uapi header stays"
* tag 'vfs-7.4-rc1.bfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
bfs: remove the filesystem
|
|
tca_action_gd() takes one reference per nested TCA_ACT_TAB entry while
tcf_action_delete() consumes two per slot, so three duplicate
TCA_ACT_INDEX entries in one RTM_DELACTION free the action mid-walk and
the next slot dereferences it. Assert a duplicate batch is rejected and
the action survives.
Conditions to recreate the bug:
tc actions add action pass index 1
tc actions delete action gact index 1 action gact index 1 \
action gact index 1
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/QDISC-K1TH.v1.r3.20261012134653-2@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull signal handling updates from Christian Brauner:
"This stops TIF_NOTIFY_SIGNAL from interrupting work that can't be
restarted and fixes a bunch of coredump and signal bugs.
TIF_NOTIFY_SIGNAL kicks a task out of an uninterruptible sleep so it
returns to userspace, runs its task work and goes back to sleep. That
breaks coredumps: dump_interrupted() only lets fatal signals interrupt
a dump and writes to a regular file ignore TIF_NOTIFY_SIGNAL. But the
pipe and the socket paths check signal_pending() Adeep down in code
that is shared with regular syscalls and bail. So a crashing process
with io_uring requests in flight loses most of its coredump.
In the selftest an unfixed kernel delivers 357324 of at least 5111808
bytes. And io_uring isn't the only source. klp_send_signals(),
bpf_task_work_schedule_signal(), landlock's tsync, kthread_stop() and
the printk kunit test raise the bit as well, some of them from irq
context against any task. So this can't be fixed per subsystem and the
state has to be per-task and ambient.
Add PF_NO_NOTIFY_SIGNAL and no_notify_signal_save()/restore() helpers
modelled on memalloc_nofs_save(). Inside such a section
signal_pending() ignores TIF_NOTIFY_SIGNAL. Coredumps, the smb send
path, which hand-rolled its own version of this, and the pid namespace
reaper, which busy-looped when the bit kept getting raised, are
converted.
The second part is a set of fixes that fell out of looking at the
coredump code with kres and modelling it in TLA+:
- coredump_finish() woke the parked threads without holding rcu. A
parked thread can exit on a spurious wakeup and be freed before
wake_up_process() takes its pi_lock.
- Only SIGKILL and the freezers interrupt a dump now and the three
freezers agree. Power management and cgroup v1 freezing aborted a
dump while a cgroup v2 freeze either waited for the dump or cut it
short depending on where the core went.
- io-wq set its exit bit without a barrier against the task work that
creates workers. On weakly ordered architectures exit could hang on
worker_done.
- retarget_shared_pending() slingshotted a shared signal to the dumper
when a zapped sibling restored its signal mask. That set
TIF_SIGPENDING on the dumper and truncated the core.
- A tracer could clear the signal mask of a user worker with
PTRACE_SETSIGMASK and inject a coredump signal. An io-wq worker of
an SQPOLL ring dumping core deadlocks the whole group.
PTRACE_SETSIGMASK is refused for user workers now and
__set_task_blocked() enforces the fork-time mask.
- exec cancels io_uring requests before de_thread() so a worker
creation queued as task work can't add a thread to a thread group
that de_thread() just took down.
- No io threads are created from a PF_SIGNALED or PF_POSTCOREDUMP
creator anymore. Such a worker was invisible to zap_process() but
still decremented threads_remaining on exit so the dumper could
leave coredump_wait_inactive() early.
Also included are a comment that do_each_pid_task() needs
tasklist_lock, a READ_ONCE() in pid_alive() and a regression test for
fork() into a pid namespace whose ancestor lost its init"
* tag 'kernel-7.4-rc1.signal' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (21 commits)
pid: use READ_ONCE() in pid_alive()
selftests: pid_namespace: test fork with dead ancestor
pid: document that do_each_pid_task() needs tasklist_lock
signal: enforce the user worker signal mask in __set_task_blocked()
fork: use SIG_KERNEL_ONLY_MASK for the user worker signal mask
fork: don't create io threads once PF_POSTCOREDUMP is set
fork: move the coredump and exec checks into create_io_thread()
exec: cancel io_uring requests before de_thread()
selftests/coredump: expect PTRACE_SETSIGMASK to be refused on a user worker
selftests/coredump: test a user worker as the coredumping thread
ptrace: refuse to change the signal mask of a user worker
selftests/coredump: test shared signal retargeting during a dump
signal: only SIGKILL and the freezers interrupt a coredumping task
signal: don't retarget shared signals in a dying thread group
io-wq: order the exit bit against worker creation task work
coredump: hold RCU while releasing parked threads
pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper
smb: prevent TIF_NOTIFY_SIGNAL from interrupting
selftests/coredump: test that TIF_NOTIFY_SIGNAL doesn't truncate a coredump
coredump: prevent TIF_NOTIFY_SIGNAL from interrupting coredumps
...
|
|
Antonio Quartulli says:
====================
Included changes:
* add Ralf Lici as ovpn reviewer
* wait for the server-side key setup before generating TCP traffic in
selftests
* enable TCP_NODELAY on TCP sockets in selftests
* drop redundant peer NULL checks in the crypto post functions
* remove the unused work field from struct ovpn_socket
* fix the documented return value of ovpn_bind_from_sockaddr()
* tag 'ovpn-net-next-20261012' of https://github.com/OpenVPN/ovpn-net-next:
MAINTAINERS: ovpn: add Ralf Lici as reviewer
selftests: ovpn: wait for the TCP server key setup before traffic
selftests: ovpn: enable TCP_NODELAY on TCP sockets
ovpn: remove redundant peer NULL checks in crypto post functions
ovpn: remove unused work field from struct ovpn_socket
ovpn: Fix the return value in ovpn_bind_from_sockaddr() kernel-doc
====================
Link: https://patch.msgid.link/
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
