From d179ee76aba9141666b367528f81972943ab54fe Mon Sep 17 00:00:00 2001 From: Manuel Quintero Fonseca Date: Fri, 22 May 2026 17:01:31 -0700 Subject: resource: downgrade "resource sanity check" warning to debug level The "resource sanity check" warning need not mean that there is a functional issue and in the cases when there isn't one, it is just useless and confusing noise. For this reason, downgrade the log level of it from "warn" to "debug". This reduces log clutter while keeping the diagnostic information available for debugging purposes if needed. Link: https://lore.kernel.org/20260523000131.7086-1-sakunix@yahoo.com Signed-off-by: Manuel Quintero Fonseca Cc: Andriy Shevchenko Cc: Bjorn Helgaas Cc: Hans de Goede Cc: Mika Westeberg Cc: "Rafael J. Wysocki" Signed-off-by: Andrew Morton --- kernel/resource.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'kernel') diff --git a/kernel/resource.c b/kernel/resource.c index 3d17e3196a3e..e60539a55541 100644 --- a/kernel/resource.c +++ b/kernel/resource.c @@ -1859,7 +1859,7 @@ int iomem_map_sanity_check(resource_size_t addr, unsigned long size) if (p->flags & IORESOURCE_BUSY) continue; - pr_warn("resource sanity check: requesting [mem %pa-%pa], which spans more than %s %pR\n", + pr_debug("resource sanity check: requesting [mem %pa-%pa], which spans more than %s %pR\n", &addr, &end, p->name, p); err = -1; break; -- cgit v1.2.3 From b4e28b4db72c8005baf4bacfeb8fcf686b13154e Mon Sep 17 00:00:00 2001 From: Jim Cromie Date: Thu, 18 Jun 2026 13:07:15 -0600 Subject: kernel/params: fix a pr_debug(" %p ") in parse_one() Inside parse_one(), the core parameter-parsing engine prints the address of the parameter-set callback function using %p: pr_debug("handling %s with %p\n", param, params[i].ops->set); Since the string value of the parameter being parsed (val) is already available, print the parameter name and its value instead, and avoid tainting the kernel by exposing a kernel-ptr. Link: https://lore.kernel.org/20260618190715.3563047-1-jim.cromie@gmail.com Signed-off-by: Jim Cromie Cc: Greg Kroah-Hartman Signed-off-by: Andrew Morton --- kernel/params.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'kernel') diff --git a/kernel/params.c b/kernel/params.c index a668863a4bb6..5c8a05921e28 100644 --- a/kernel/params.c +++ b/kernel/params.c @@ -136,8 +136,8 @@ static int parse_one(char *param, if (!val && !(params[i].ops->flags & KERNEL_PARAM_OPS_FL_NOARG)) return -EINVAL; - pr_debug("handling %s with %p\n", param, - params[i].ops->set); + pr_debug("handling %s with value '%s'\n", param, + val ? val : "no-arg"); kernel_param_lock(params[i].mod); if (param_check_unsafe(¶ms[i])) err = params[i].ops->set(val, ¶ms[i]); -- cgit v1.2.3 From 5fc2358263e92db7c0436f6d1c3e9276a826986b Mon Sep 17 00:00:00 2001 From: Matthew Chen Date: Tue, 16 Jun 2026 01:45:57 +0800 Subject: watchdog/softlockup: fix softlockup typos Fix misspellings of "softlockup" in the watchdog enabled bit definitions and related comments. Also fix a nearby "successful" typo. No functional change. Link: https://lore.kernel.org/20260615174557.1836562-1-edcr1790@gmail.com Signed-off-by: Matthew Chen Reviewed-by: Douglas Anderson Reviewed-by: Petr Mladek Signed-off-by: Andrew Morton --- kernel/watchdog.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) (limited to 'kernel') diff --git a/kernel/watchdog.c b/kernel/watchdog.c index 87dd5e0f6968..e5134ad7b663 100644 --- a/kernel/watchdog.c +++ b/kernel/watchdog.c @@ -359,14 +359,14 @@ static void lockup_detector_update_enable(void) if (watchdog_hardlockup_available && watchdog_hardlockup_user_enabled) watchdog_enabled |= WATCHDOG_HARDLOCKUP_ENABLED; if (watchdog_softlockup_user_enabled) - watchdog_enabled |= WATCHDOG_SOFTOCKUP_ENABLED; + watchdog_enabled |= WATCHDOG_SOFTLOCKUP_ENABLED; } #ifdef CONFIG_SOFTLOCKUP_DETECTOR /* - * Delay the soflockup report when running a known slow code. - * It does _not_ affect the timestamp of the last successdul reschedule. + * Delay the softlockup report when running a known slow code. + * It does _not_ affect the timestamp of the last successful reschedule. */ #define SOFTLOCKUP_DELAY_REPORT ULONG_MAX @@ -742,7 +742,7 @@ static int is_softlockup(unsigned long touch_ts, unsigned long period_ts, unsigned long now) { - if ((watchdog_enabled & WATCHDOG_SOFTOCKUP_ENABLED) && watchdog_thresh) { + if ((watchdog_enabled & WATCHDOG_SOFTLOCKUP_ENABLED) && watchdog_thresh) { /* * If period_ts has not been updated during a sample_period, then * in the subsequent few sample_periods, period_ts might also not @@ -1098,11 +1098,11 @@ static void proc_watchdog_update(bool thresh_changed) * caller | table->data points to | 'which' * -------------------|----------------------------------|------------------------------- * proc_watchdog | watchdog_user_enabled | WATCHDOG_HARDLOCKUP_ENABLED | - * | | WATCHDOG_SOFTOCKUP_ENABLED + * | | WATCHDOG_SOFTLOCKUP_ENABLED * -------------------|----------------------------------|------------------------------- * proc_nmi_watchdog | watchdog_hardlockup_user_enabled | WATCHDOG_HARDLOCKUP_ENABLED * -------------------|----------------------------------|------------------------------- - * proc_soft_watchdog | watchdog_softlockup_user_enabled | WATCHDOG_SOFTOCKUP_ENABLED + * proc_soft_watchdog | watchdog_softlockup_user_enabled | WATCHDOG_SOFTLOCKUP_ENABLED */ static int proc_watchdog_common(int which, const struct ctl_table *table, int write, void *buffer, size_t *lenp, loff_t *ppos) @@ -1136,7 +1136,7 @@ static int proc_watchdog(const struct ctl_table *table, int write, void *buffer, size_t *lenp, loff_t *ppos) { return proc_watchdog_common(WATCHDOG_HARDLOCKUP_ENABLED | - WATCHDOG_SOFTOCKUP_ENABLED, + WATCHDOG_SOFTLOCKUP_ENABLED, table, write, buffer, lenp, ppos); } @@ -1159,7 +1159,7 @@ static int proc_nmi_watchdog(const struct ctl_table *table, int write, static int proc_soft_watchdog(const struct ctl_table *table, int write, void *buffer, size_t *lenp, loff_t *ppos) { - return proc_watchdog_common(WATCHDOG_SOFTOCKUP_ENABLED, + return proc_watchdog_common(WATCHDOG_SOFTLOCKUP_ENABLED, table, write, buffer, lenp, ppos); } #endif -- cgit v1.2.3 From d19cdc167e696714509e87d3f7ae765b6e164589 Mon Sep 17 00:00:00 2001 From: Bradley Morgan Date: Mon, 22 Jun 2026 20:25:08 +0000 Subject: signal: avoid shared siginfo namespace rewrites send_signal_locked() rewrites sender ids for the target namespace. Group sends reuse the same siginfo, so one recipient can affect the next. Copy the siginfo before changing it. Link: https://lore.kernel.org/86a8857d58d43ee26a8b365b837fd24830343494.1782159692.git.include@grrlz.net Fixes: 7a0cf094944e ("signal: Correct namespace fixups of si_pid and si_uid") Signed-off-by: Bradley Morgan Acked-by: Oleg Nesterov Cc: "Eric W. Biederman" Cc: Adrian Huang Cc: Aleksandr Nogikh Cc: Christian Brauner Cc: Marco Elver Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Peter Zijlstra Cc: Steven Rostedt Cc: Signed-off-by: Andrew Morton --- kernel/signal.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'kernel') diff --git a/kernel/signal.c b/kernel/signal.c index bbc0fd4cc4d7..c53f202da9da 100644 --- a/kernel/signal.c +++ b/kernel/signal.c @@ -1181,6 +1181,7 @@ static inline bool has_si_pid_and_uid(struct kernel_siginfo *info) int send_signal_locked(int sig, struct kernel_siginfo *info, struct task_struct *t, enum pid_type type) { + struct kernel_siginfo rewritten; /* Should SIGKILL or SIGSTOP be received by a pid namespace init? */ bool force = false; @@ -1194,6 +1195,9 @@ int send_signal_locked(int sig, struct kernel_siginfo *info, /* SIGKILL and SIGSTOP is special or has ids */ struct user_namespace *t_user_ns; + rewritten = *info; + info = &rewritten; + rcu_read_lock(); t_user_ns = task_cred_xxx(t, user_ns); if (current_user_ns() != t_user_ns) { -- cgit v1.2.3 From 306d71b091908bd898cbc0d7e98130354b62be2e Mon Sep 17 00:00:00 2001 From: Oleg Nesterov Date: Fri, 26 Jun 2026 17:33:08 +0200 Subject: signal: change sys_kill() to use SEND_SIG_NOINFO prepare_kill_siginfo(PIDTYPE_TGID) fills si_code = SI_USER and sets si_pid/si_uid in the sender's namespace. Then send_signal_locked() translates si_pid/si_uid to the target's namespace. SEND_SIG_NOINFO exists precisely for the case when si_code == SI_USER and si_pid/si_uid are the sender's ids; this is exactly what sys_kill() does via prepare_kill_siginfo(PIDTYPE_TGID). Change sys_kill() to use it directly. SEND_SIG_NOINFO produces the same result: si_code = SI_USER, and __send_signal_locked() computes si_pid/si_uid directly in the target's namespace. The force computation is also the same: both check if the sender is visible in the target's pid namespace. This is just a cleanup and microoptimization (especially with [1]), this skips the has_si_pid_and_uid() block in send_signal_locked() and offloads the namespace translation logic to __send_signal_locked(SEND_SIG_NOINFO) which uses the simpler computations. NOTE: As a "side effect" this also fixes the kill(pid < 0, sig) case where send_signal_locked() rewrites si_pid/si_uid in the shared siginfo, corrupting it for subsequent recipients. But for other group senders like __kill_pgrp_info() we still need the fix from Bradley Morgan [1] who found this problem. TODO: kill prepare_kill_siginfo() and change other users to use SEND_SIG_NOINFO too. This needs trivial changes in __send_signal_locked() and TP_STORE_SIGINFO(). Link: https://lore.kernel.org/aj6btAZqYuv59a8w@redhat.com Link: https://lore.kernel.org/all/20260622164029.11474-1-include@grrlz.net/ [1] Signed-off-by: Oleg Nesterov Reviewed-by: Bradley Morgan Cc: Eric Biederman Signed-off-by: Andrew Morton --- kernel/signal.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) (limited to 'kernel') diff --git a/kernel/signal.c b/kernel/signal.c index c53f202da9da..041498ff835e 100644 --- a/kernel/signal.c +++ b/kernel/signal.c @@ -3962,11 +3962,7 @@ static void prepare_kill_siginfo(int sig, struct kernel_siginfo *info, */ SYSCALL_DEFINE2(kill, pid_t, pid, int, sig) { - struct kernel_siginfo info; - - prepare_kill_siginfo(sig, &info, PIDTYPE_TGID); - - return kill_something_info(sig, &info, pid); + return kill_something_info(sig, SEND_SIG_NOINFO, pid); } /* -- cgit v1.2.3 From 571999ccd1224d7a629f2592887750e381c665b3 Mon Sep 17 00:00:00 2001 From: Oleg Nesterov Date: Sat, 4 Jul 2026 16:34:42 +0200 Subject: signal: avoid unconditional siginfo copy in send_signal_locked() send_signal_locked() unconditionally copies siginfo before the namespace translation to avoid corrupting a shared siginfo. Not that I think this can actually hurt performance-wise, just it doesn't look clean to me; the copy is only needed in the unlikely case when the translation will actually change something. Defer it to the two cases where si_pid/si_uid are rewritten, and while at it add #ifdef's just for completeness. Link: https://lore.kernel.org/akkaAgNfUby5_3nM@redhat.com Signed-off-by: Oleg Nesterov Reviewed-by: Bradley Morgan Cc: Christian Brauner Cc: Eric Biederman Signed-off-by: Andrew Morton --- kernel/signal.c | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-) (limited to 'kernel') diff --git a/kernel/signal.c b/kernel/signal.c index 041498ff835e..0f509ee4f42d 100644 --- a/kernel/signal.c +++ b/kernel/signal.c @@ -1181,7 +1181,7 @@ static inline bool has_si_pid_and_uid(struct kernel_siginfo *info) int send_signal_locked(int sig, struct kernel_siginfo *info, struct task_struct *t, enum pid_type type) { - struct kernel_siginfo rewritten; + struct kernel_siginfo __maybe_unused rewritten; /* Should SIGKILL or SIGSTOP be received by a pid namespace init? */ bool force = false; @@ -1193,27 +1193,34 @@ int send_signal_locked(int sig, struct kernel_siginfo *info, force = true; } else if (has_si_pid_and_uid(info)) { /* SIGKILL and SIGSTOP is special or has ids */ +#ifdef CONFIG_USER_NS struct user_namespace *t_user_ns; - - rewritten = *info; - info = &rewritten; + kuid_t uid; rcu_read_lock(); t_user_ns = task_cred_xxx(t, user_ns); if (current_user_ns() != t_user_ns) { - kuid_t uid = make_kuid(current_user_ns(), info->si_uid); - info->si_uid = from_kuid_munged(t_user_ns, uid); + rewritten = *info; + info = &rewritten; + uid = make_kuid(current_user_ns(), info->si_uid); + rewritten.si_uid = from_kuid_munged(t_user_ns, uid); } rcu_read_unlock(); - +#endif /* A kernel generated signal? */ force = (info->si_code == SI_KERNEL); +#ifdef CONFIG_PID_NS /* From an ancestor pid namespace? */ if (!task_pid_nr_ns(current, task_active_pid_ns(t))) { - info->si_pid = 0; + if (info != &rewritten) { + rewritten = *info; + info = &rewritten; + } + rewritten.si_pid = 0; force = true; } +#endif } return __send_signal_locked(sig, info, t, type, force); } -- cgit v1.2.3 From b7a8d7589a632c7de115362bbec6d88b10f685f1 Mon Sep 17 00:00:00 2001 From: Andrea Calabrese Date: Wed, 20 May 2026 08:28:50 +0200 Subject: kernel: refactor: shorten has_pending_signals In has_pending_signals there was a switch/case used for optimizations. However, today's compilers perform loop unrolling efficiently, thus it is not needed anymore. Put i inside the for declaration so we do not risk its escape from the scope. Moreover, i starts now from 0 and counts up, as it is a more usual pattern. Link: https://lore.kernel.org/20260520062849.183621-2-andrea.calabrese@amarulasolutions.com Signed-off-by: Andrea Calabrese Acked-by: Oleg Nesterov Cc: Adrian Huang Cc: Christian Brauner Cc: Marco Elver Cc: Peter Zijlstra Signed-off-by: Andrew Morton --- kernel/signal.c | 26 ++++---------------------- 1 file changed, 4 insertions(+), 22 deletions(-) (limited to 'kernel') diff --git a/kernel/signal.c b/kernel/signal.c index 0f509ee4f42d..fdee0b012a11 100644 --- a/kernel/signal.c +++ b/kernel/signal.c @@ -130,28 +130,10 @@ static bool sig_ignored(struct task_struct *t, int sig, bool force) */ static inline bool has_pending_signals(sigset_t *signal, sigset_t *blocked) { - unsigned long ready; - long i; - - switch (_NSIG_WORDS) { - default: - for (i = _NSIG_WORDS, ready = 0; --i >= 0 ;) - ready |= signal->sig[i] &~ blocked->sig[i]; - break; - - case 4: ready = signal->sig[3] &~ blocked->sig[3]; - ready |= signal->sig[2] &~ blocked->sig[2]; - ready |= signal->sig[1] &~ blocked->sig[1]; - ready |= signal->sig[0] &~ blocked->sig[0]; - break; - - case 2: ready = signal->sig[1] &~ blocked->sig[1]; - ready |= signal->sig[0] &~ blocked->sig[0]; - break; - - case 1: ready = signal->sig[0] &~ blocked->sig[0]; - } - return ready != 0; + unsigned long ready = 0; + for (long i = 0; i < _NSIG_WORDS; i++) + ready |= signal->sig[i] & ~blocked->sig[i]; + return ready != 0; } #define PENDING(p,b) has_pending_signals(&(p)->signal, (b)) -- cgit v1.2.3 From 1db1573bc59f7c91fa2867e4cbea73494d5b623e Mon Sep 17 00:00:00 2001 From: JianChunfu Date: Tue, 7 Jul 2026 17:23:54 +0800 Subject: kernel/fork: declare max_threads __read_mostly max_threads is initialized once by fork_init()->set_max_threads(), and thereafter is mostly read in hot path, such as copy_process(). The fact that it is mostly read and not written to makes it candidates for __read_mostly declarations. I have already tested on my machine(arm64,256core,kernel-7.1.3) with 'hackbench -P -l 500 -g 100/500/1000/2000' and the results show that there is an average of 13% improvement in performance. before patch: hackbench -g 100 500 1000 2000 1.094 4.651 13.305 36.322 after patch: hackbench -g 100 500 1000 2000 0.823 4.487 11.107 32.987 Above data are the average values obtained from multiple tests, and there was indeed some fluctuation in the data during the tests. Link: https://lore.kernel.org/20260707092354.465847-1-jansef.jian@hj-micro.com Signed-off-by: JianChunfu Reviewed-by: Lorenzo Stoakes Cc: Dietmar Eggemann Cc: Ingo Molnar Cc: Kees Cook Cc: Liam R. Howlett Cc: Peter Zijlstra Cc: Steven Rostedt Signed-off-by: Andrew Morton --- kernel/fork.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'kernel') diff --git a/kernel/fork.c b/kernel/fork.c index f0e2e131a9a5..516faec8efb8 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -143,7 +143,7 @@ unsigned long total_forks; /* Handle normal Linux uptimes. */ int nr_threads; /* The idle threads do not count.. */ -static int max_threads; /* tunable limit on nr_threads */ +static int max_threads __read_mostly; /* tunable limit on nr_threads */ #define NAMED_ARRAY_INDEX(x) [x] = __stringify(x) -- cgit v1.2.3 From b0860c1df2dc3123171146ac5f1e3321289835b4 Mon Sep 17 00:00:00 2001 From: Yiyang Chen Date: Sat, 11 Jul 2026 04:07:36 +0800 Subject: taskstats: return -EBADF when cgroupstats receives an invalid fd Patch series "taskstats: fix cgroupstats invalid fd handling and add selftests". This series fixes an issue where cgroupstats mishandles invalid file descriptors, and introduces a functional kselftest to prevent regressions. When an invalid file descriptor is passed via CGROUPSTATS_CMD_ATTR_FD, cgroupstats_user_cmd() returns 0 instead of an error code. This leads to two broken behaviors depending on netlink flags: - Callers without NLM_F_ACK block indefinitely on recv(). - Callers with NLM_F_ACK receive a misleading success ACK (errno == 0) but no actual statistics payload. The first patch addresses this by returning -EBADF when the fd cannot be resolved. The second patch adds a comprehensive kselftest covering both the valid cgroup v1 query and the invalid fd paths (with and without NLM_F_ACK) to ensure the fixes work as intended. This patch (of 2): cgroupstats_user_cmd() returns 0 without sending a reply or a netlink error when the fd passed via CGROUPSTATS_CMD_ATTR_FD does not resolve to an open file in the caller's table. As a result: - clients that did not set NLM_F_ACK block on recv() indefinitely waiting for a CGROUPSTATS_CMD_NEW message that is never emitted; - clients that set NLM_F_ACK receive a misleading "success" ACK (errno == 0) with no statistics payload. Return -EBADF instead so the netlink layer propagates the error to userspace as expected. Link: https://lore.kernel.org/cover.1783713230.git.cyyzero16@gmail.com Link: https://lore.kernel.org/b4fd9e288e4a48efebaf41b4ffcdb204b06675c4.1783713230.git.cyyzero16@gmail.com Signed-off-by: Yiyang Chen Acked-by: Balbir Singh Cc: Dr. Thomas Orgis Signed-off-by: Andrew Morton --- kernel/taskstats.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'kernel') diff --git a/kernel/taskstats.c b/kernel/taskstats.c index 2cd0172d0516..8d115670a3ca 100644 --- a/kernel/taskstats.c +++ b/kernel/taskstats.c @@ -423,7 +423,7 @@ static int cgroupstats_user_cmd(struct sk_buff *skb, struct genl_info *info) fd = nla_get_u32(info->attrs[CGROUPSTATS_CMD_ATTR_FD]); CLASS(fd, f)(fd); if (fd_empty(f)) - return 0; + return -EBADF; size = nla_total_size(sizeof(struct cgroupstats)); -- cgit v1.2.3 From 1f58a5335cdd14b3fb5f2a5d3763dee1f5cba1d3 Mon Sep 17 00:00:00 2001 From: Bradley Morgan Date: Thu, 23 Jul 2026 21:09:22 +0000 Subject: taskstats: fix cpumask parsing cutting off the last character parse() hands nla_strscpy() len as dstsize, and nla_strscpy() copies at most dstsize - 1 bytes. When the attr payload comes in without a trailing NUL, srclen == len >= dstsize and the last character of the cpumask string gets cut off. Register "0-15" and you are silently listening on "0-1", exit data for the rest never shows up. The bug only bites when the sender doesn't NUL terminate the payload; senders that include the NUL were always fine (srclen gets decremented for the trailing NUL, so srclen < dstsize). Thats probably why this survived 20 years. And the policy is NLA_STRING, not NLA_NUL_STRING, so a payload without the trailing NUL is legit input here. Skip the kmalloc/nla_strscpy dance entirely and use nla_strdup(), which already allocates srclen + 1 and terminates. The nla_len() bounds checks stay as they were. Link: https://lore.kernel.org/EC49FE41-7F5F-41E0-A07A-ABEB8ECA514D@grrlz.net Fixes: f9fd8914c1ac ("[PATCH] per-task delay accounting taskstats interface: control exit data through cpumasks") Signed-off-by: Bradley Morgan Reported-by: Oleg Deomi Closes: https://lore.kernel.org/CAByWkfZ6b1=3H9pwkz-dDQOs9cZaF-HYQ6b9Yb0=Hq2r1Vv_Pw@mail.gmail.com Reviewed-by: Andrew Morton Cc: Balbir Singh Cc: Signed-off-by: Andrew Morton --- kernel/taskstats.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'kernel') diff --git a/kernel/taskstats.c b/kernel/taskstats.c index 8d115670a3ca..74f89b632c0a 100644 --- a/kernel/taskstats.c +++ b/kernel/taskstats.c @@ -368,10 +368,9 @@ static int parse(struct nlattr *na, struct cpumask *mask) return -E2BIG; if (len < 1) return -EINVAL; - data = kmalloc(len, GFP_KERNEL); + data = nla_strdup(na, GFP_KERNEL); if (!data) return -ENOMEM; - nla_strscpy(data, na, len); ret = cpulist_parse(data, mask); kfree(data); return ret; -- cgit v1.2.3 From 2eed77fdcb0cc48e8eccb2bcd4b7f2c6d650e84c Mon Sep 17 00:00:00 2001 From: Tetsuo Handa Date: Thu, 16 Jul 2026 08:01:29 +0900 Subject: kcov: fix data corruption and race conditions on PREEMPT_RT syzbot is reporting KCOV state corruption on PREEMPT_RT kernels, for the temporary storage used for saving/restoring remote KCOV state is currently allocated as the per-CPU area. On PREEMPT_RT kernels, softirq handlers run as preemptible task threads (e.g., ksoftirqd). If a softirq context preempts a task running a remote KCOV session, it safely saves the task's state into the per-CPU area. However, if that softirq thread is subsequently preempted by a higher- priority softirq thread on the same CPU, the second softirq will overwrite the same per-CPU area, permanently destroying the original task's KCOV state. Fix this data corruption by moving the temporary storage from the per-CPU area to the per-thread area. Since each softirq thread now owns its own task context, nested softirq preemption no longer causes data overwrites. Note that while the temporary storage is now on a per-thread basis, the per-CPU kcov_percpu_data.lock must be retained, for we need to ensure that kcov_remote_start() and kcov_remote_stop() operate atomically without racing against asynchronous interrupts that manipulate the current task's KCOV state. It is likely that GFP_KERNEL allocation by vmalloc_node() in kcov_init() has already called panic() before returning NULL, for there will be no OOM-killable userspace processes when __init function of built-in module runs. But this patch also fixes crashing the kernel when vmalloc_node() in kcov_init() returned NULL, for kcov_init() left per-CPU irq_area == NULL but kcov_remote_start() depends on per-CPU irq_area != NULL, resulting in (1) doing vmalloc() in kcov_remote_start() despite !in_task() context (2) out-of-array-bounds access if (1) succeeded but kcov->remote_size < CONFIG_KCOV_IRQ_AREA_SIZE (3) always leak memory allocated by (1), eventually killing all OOM-killable userspace processes problems. Link: https://lore.kernel.org/43552d09-2ce2-4b19-b0d3-a2d1ab952145@I-love.SAKURA.ne.jp Reported-by: syzbot+3f51ad7ac3ae57a6fdcc@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3f51ad7ac3ae57a6fdcc Reported-by: syzbot+47cf95ca1f9dcca872c8@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=47cf95ca1f9dcca872c8 Reported-by: syzbot+8a173e13208949931dc7@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=8a173e13208949931dc7 Reported-by: syzbot+90984d3713722683112e@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=90984d3713722683112e Analyzed-by: AI Mode in Google Search (no mail address) Fixes: 5ff3b30ab57d ("kcov: collect coverage from interrupts") Signed-off-by: Tetsuo Handa Reviewed-by: Alexander Potapenko Cc: Alan Stern Cc: Andrey Konovalov Cc: Christoph Hellwig Cc: Clark Williams Cc: Dmitry Vyukov Cc: Greg Kroah-Hartman Cc: Marco Elver Cc: Mark Brown Cc: Roman Gushchin Cc: Sebastian Andrzej Siewior Cc: Signed-off-by: Andrew Morton --- kernel/kcov.c | 90 +++++++++++++++++++++++++++++++---------------------------- 1 file changed, 47 insertions(+), 43 deletions(-) (limited to 'kernel') diff --git a/kernel/kcov.c b/kernel/kcov.c index 1df373fb562b..a7514303eff3 100644 --- a/kernel/kcov.c +++ b/kernel/kcov.c @@ -86,17 +86,12 @@ struct kcov_remote { static DEFINE_SPINLOCK(kcov_remote_lock); static DEFINE_HASHTABLE(kcov_remote_map, 4); -static struct list_head kcov_remote_areas = LIST_HEAD_INIT(kcov_remote_areas); +static struct list_head kcov_remote_areas[2] = { + LIST_HEAD_INIT(kcov_remote_areas[0]), LIST_HEAD_INIT(kcov_remote_areas[1]) +}; struct kcov_percpu_data { - void *irq_area; local_lock_t lock; - - unsigned int saved_mode; - unsigned int saved_size; - void *saved_area; - struct kcov *saved_kcov; - int saved_sequence; }; static DEFINE_PER_CPU(struct kcov_percpu_data, kcov_percpu_data) = { @@ -132,12 +127,13 @@ static struct kcov_remote *kcov_remote_add(struct kcov *kcov, u64 handle) } /* Must be called with kcov_remote_lock locked. */ -static struct kcov_remote_area *kcov_remote_area_get(unsigned int size) +static struct kcov_remote_area *kcov_remote_area_get(unsigned int size, bool irq) { struct kcov_remote_area *area; struct list_head *pos; + struct list_head *list = &kcov_remote_areas[irq]; - list_for_each(pos, &kcov_remote_areas) { + list_for_each(pos, list) { area = list_entry(pos, struct kcov_remote_area, list); if (area->size == size) { list_del(&area->list); @@ -149,11 +145,11 @@ static struct kcov_remote_area *kcov_remote_area_get(unsigned int size) /* Must be called with kcov_remote_lock locked. */ static void kcov_remote_area_put(struct kcov_remote_area *area, - unsigned int size) + unsigned int size, bool irq) { INIT_LIST_HEAD(&area->list); area->size = size; - list_add(&area->list, &kcov_remote_areas); + list_add(&area->list, &kcov_remote_areas[irq]); /* * KMSAN doesn't instrument this file, so it may not know area->list * is initialized. Unpoison it explicitly to avoid reports in @@ -390,6 +386,12 @@ void kcov_task_init(struct task_struct *t) kcov_task_reset(t); t->kcov_remote = NULL; t->kcov_handle = current->kcov_handle; + t->kcov_softirq = 0; + t->kcov_saved_mode = 0; + t->kcov_saved_size = 0; + t->kcov_saved_area = NULL; + t->kcov_saved_kcov = NULL; + t->kcov_saved_sequence = 0; } static void kcov_reset(struct kcov *kcov) @@ -836,17 +838,16 @@ static inline bool kcov_mode_enabled(unsigned int mode) static void kcov_remote_softirq_start(struct task_struct *t) __must_hold(&kcov_percpu_data.lock) { - struct kcov_percpu_data *data = this_cpu_ptr(&kcov_percpu_data); unsigned int mode; mode = READ_ONCE(t->kcov_mode); barrier(); if (kcov_mode_enabled(mode)) { - data->saved_mode = mode; - data->saved_size = t->kcov_size; - data->saved_area = t->kcov_area; - data->saved_sequence = t->kcov_sequence; - data->saved_kcov = t->kcov; + t->kcov_saved_mode = mode; + t->kcov_saved_size = t->kcov_size; + t->kcov_saved_area = t->kcov_area; + t->kcov_saved_sequence = t->kcov_sequence; + t->kcov_saved_kcov = t->kcov; kcov_stop(t); } } @@ -854,17 +855,15 @@ static void kcov_remote_softirq_start(struct task_struct *t) static void kcov_remote_softirq_stop(struct task_struct *t) __must_hold(&kcov_percpu_data.lock) { - struct kcov_percpu_data *data = this_cpu_ptr(&kcov_percpu_data); - - if (data->saved_kcov) { - kcov_start(t, data->saved_kcov, data->saved_size, - data->saved_area, data->saved_mode, - data->saved_sequence); - data->saved_mode = 0; - data->saved_size = 0; - data->saved_area = NULL; - data->saved_sequence = 0; - data->saved_kcov = NULL; + if (t->kcov_saved_kcov) { + kcov_start(t, t->kcov_saved_kcov, t->kcov_saved_size, + t->kcov_saved_area, t->kcov_saved_mode, + t->kcov_saved_sequence); + t->kcov_saved_mode = 0; + t->kcov_saved_size = 0; + t->kcov_saved_area = NULL; + t->kcov_saved_sequence = 0; + t->kcov_saved_kcov = NULL; } } @@ -927,17 +926,17 @@ void kcov_remote_start(u64 handle) sequence = kcov->sequence; if (in_task()) { size = kcov->remote_size; - area = kcov_remote_area_get(size); + area = kcov_remote_area_get(size, false); } else { size = CONFIG_KCOV_IRQ_AREA_SIZE; - area = this_cpu_ptr(&kcov_percpu_data)->irq_area; + area = kcov_remote_area_get(size, true); } spin_unlock(&kcov_remote_lock); - /* Can only happen when in_task(). */ + /* Allocate new buffer if we can sleep. */ if (!area) { local_unlock_irqrestore(&kcov_percpu_data.lock, flags); - area = vmalloc(size * sizeof(unsigned long)); + area = in_task() ? vmalloc(size * sizeof(unsigned long)) : NULL; if (!area) { kcov_put(kcov); return; @@ -1079,11 +1078,9 @@ void kcov_remote_stop(void) kcov_move_area(kcov->mode, kcov->area, kcov->size, area); spin_unlock(&kcov->lock); - if (in_task()) { - spin_lock(&kcov_remote_lock); - kcov_remote_area_put(area, size); - spin_unlock(&kcov_remote_lock); - } + spin_lock(&kcov_remote_lock); + kcov_remote_area_put(area, size, !in_task()); + spin_unlock(&kcov_remote_lock); local_unlock_irqrestore(&kcov_percpu_data.lock, flags); @@ -1129,14 +1126,21 @@ static void __init selftest(void) static int __init kcov_init(void) { - int cpu; + int cpu = num_possible_cpus(); + +#ifdef CONFIG_PREEMPT_RT + /* Allocate some extra buffers in order to prepare for softirq preemption. */ + cpu = cpu >= 4 ? cpu * 2 : cpu + 4; +#endif + while (cpu--) { + void *area = vmalloc(CONFIG_KCOV_IRQ_AREA_SIZE * sizeof(unsigned long)); + unsigned long flags; - for_each_possible_cpu(cpu) { - void *area = vmalloc_node(CONFIG_KCOV_IRQ_AREA_SIZE * - sizeof(unsigned long), cpu_to_node(cpu)); if (!area) return -ENOMEM; - per_cpu_ptr(&kcov_percpu_data, cpu)->irq_area = area; + spin_lock_irqsave(&kcov_remote_lock, flags); + kcov_remote_area_put(area, CONFIG_KCOV_IRQ_AREA_SIZE, true); + spin_unlock_irqrestore(&kcov_remote_lock, flags); } /* -- cgit v1.2.3 From 36ffbe1d5e99ebe17bea60e65e053dbcd89bc04c Mon Sep 17 00:00:00 2001 From: Bradley Morgan Date: Tue, 28 Jul 2026 20:21:03 +0000 Subject: taskstats: drop the dead NULL attribute check in parse() Patch series "taskstats: tidy up the cpumask command path". Two small cleanups from reading kernel/taskstats.c. No functional change in either one. This patch (of 2): taskstats_user_cmd() only calls the cpumask handlers after checking the same info->attrs[] entry, so parse() never sees a NULL attribute. Drop the check and its odd "return 1", which no caller tested for anyway. No functional change. Link: https://lore.kernel.org/20260728202104.17839-1-include@grrlz.net Link: https://lore.kernel.org/20260728202104.17839-2-include@grrlz.net Signed-off-by: Bradley Morgan Cc: Balbir Singh Signed-off-by: Andrew Morton --- kernel/taskstats.c | 2 -- 1 file changed, 2 deletions(-) (limited to 'kernel') diff --git a/kernel/taskstats.c b/kernel/taskstats.c index 74f89b632c0a..7af47511152d 100644 --- a/kernel/taskstats.c +++ b/kernel/taskstats.c @@ -361,8 +361,6 @@ static int parse(struct nlattr *na, struct cpumask *mask) int len; int ret; - if (na == NULL) - return 1; len = nla_len(na); if (len > TASKSTATS_CPUMASK_MAXLEN) return -E2BIG; -- cgit v1.2.3 From c4904c4ae33c5f76c10b03a2283e47d8a6736941 Mon Sep 17 00:00:00 2001 From: Bradley Morgan Date: Tue, 28 Jul 2026 20:21:04 +0000 Subject: taskstats: fold the two cpumask handlers into one cmd_attr_register_cpumask() and cmd_attr_deregister_cpumask() differed only in which attribute they parsed and which action they passed on, so take both as arguments. __free(free_cpumask_var) then removes the goto. No functional change. Link: https://lore.kernel.org/20260728202104.17839-3-include@grrlz.net Signed-off-by: Bradley Morgan Cc: Balbir Singh Signed-off-by: Andrew Morton --- kernel/taskstats.c | 38 ++++++++++++-------------------------- 1 file changed, 12 insertions(+), 26 deletions(-) (limited to 'kernel') diff --git a/kernel/taskstats.c b/kernel/taskstats.c index 7af47511152d..f31df72f0e9d 100644 --- a/kernel/taskstats.c +++ b/kernel/taskstats.c @@ -448,36 +448,18 @@ static int cgroupstats_user_cmd(struct sk_buff *skb, struct genl_info *info) return send_reply(rep_skb, info); } -static int cmd_attr_register_cpumask(struct genl_info *info) +static int cmd_attr_cpumask(struct genl_info *info, int attr, + enum actions action) { - cpumask_var_t mask; + cpumask_var_t mask __free(free_cpumask_var) = CPUMASK_VAR_NULL; int rc; if (!alloc_cpumask_var(&mask, GFP_KERNEL)) return -ENOMEM; - rc = parse(info->attrs[TASKSTATS_CMD_ATTR_REGISTER_CPUMASK], mask); + rc = parse(info->attrs[attr], mask); if (rc < 0) - goto out; - rc = add_del_listener(info->snd_portid, mask, REGISTER); -out: - free_cpumask_var(mask); - return rc; -} - -static int cmd_attr_deregister_cpumask(struct genl_info *info) -{ - cpumask_var_t mask; - int rc; - - if (!alloc_cpumask_var(&mask, GFP_KERNEL)) - return -ENOMEM; - rc = parse(info->attrs[TASKSTATS_CMD_ATTR_DEREGISTER_CPUMASK], mask); - if (rc < 0) - goto out; - rc = add_del_listener(info->snd_portid, mask, DEREGISTER); -out: - free_cpumask_var(mask); - return rc; + return rc; + return add_del_listener(info->snd_portid, mask, action); } static size_t taskstats_packet_size(void) @@ -552,9 +534,13 @@ err: static int taskstats_user_cmd(struct sk_buff *skb, struct genl_info *info) { if (info->attrs[TASKSTATS_CMD_ATTR_REGISTER_CPUMASK]) - return cmd_attr_register_cpumask(info); + return cmd_attr_cpumask(info, + TASKSTATS_CMD_ATTR_REGISTER_CPUMASK, + REGISTER); else if (info->attrs[TASKSTATS_CMD_ATTR_DEREGISTER_CPUMASK]) - return cmd_attr_deregister_cpumask(info); + return cmd_attr_cpumask(info, + TASKSTATS_CMD_ATTR_DEREGISTER_CPUMASK, + DEREGISTER); else if (info->attrs[TASKSTATS_CMD_ATTR_PID]) return cmd_attr_pid(info); else if (info->attrs[TASKSTATS_CMD_ATTR_TGID]) -- cgit v1.2.3 From 9b836cd566815ab6302cfe56a7e432376e119652 Mon Sep 17 00:00:00 2001 From: Bradley Morgan Date: Thu, 6 Aug 2026 13:30:13 +0000 Subject: signal: factor out the kernel reserved si_code check The check that prevents userspace from sending siginfo with si_code values reserved to the kernel is duplicated across do_rt_sigqueueinfo(), do_rt_tgsigqueueinfo() and do_pidfd_send_signal(). Move the check into a helper so the rule lives in one place. Link: https://lore.kernel.org/20260806133013.4341-1-include@grrlz.net Signed-off-by: Bradley Morgan Reviewed-by: Andrew Morton Acked-by: Oleg Nesterov Cc: Christian Brauner Cc: Thomas Gleixner Signed-off-by: Andrew Morton --- kernel/signal.c | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-) (limited to 'kernel') diff --git a/kernel/signal.c b/kernel/signal.c index fdee0b012a11..a5e15bf09d31 100644 --- a/kernel/signal.c +++ b/kernel/signal.c @@ -3944,6 +3944,15 @@ static void prepare_kill_siginfo(int sig, struct kernel_siginfo *info, info->si_uid = from_kuid_munged(current_user_ns(), current_uid()); } +/* + * Not even root can pretend to send SI_FROMKERNEL() signals. + * Nor can they impersonate kill()/tgkill(), which have si_pid/uid + */ +static bool si_code_reserved_to_kernel(int si_code) +{ + return si_code >= 0 || si_code == SI_TKILL; +} + /** * sys_kill - send a signal to a process * @pid: the PID of the process @@ -4035,7 +4044,7 @@ static int do_pidfd_send_signal(struct pid *pid, int sig, enum pid_type type, /* Only allow sending arbitrary signals to yourself. */ if ((task_pid(current) != pid || type > PIDTYPE_TGID) && - (kinfo.si_code >= 0 || kinfo.si_code == SI_TKILL)) + si_code_reserved_to_kernel(kinfo.si_code)) return -EPERM; } else { prepare_kill_siginfo(sig, &kinfo, type); @@ -4190,11 +4199,8 @@ SYSCALL_DEFINE2(tkill, pid_t, pid, int, sig) static int do_rt_sigqueueinfo(pid_t pid, int sig, kernel_siginfo_t *info) { - /* Not even root can pretend to send signals from the kernel. - * Nor can they impersonate a kill()/tgkill(), which adds source info. - */ - if ((info->si_code >= 0 || info->si_code == SI_TKILL) && - (task_pid_vnr(current) != pid)) + if (si_code_reserved_to_kernel(info->si_code) && + task_pid_vnr(current) != pid) return -EPERM; /* POSIX.1b doesn't mention process groups. */ @@ -4237,11 +4243,8 @@ static int do_rt_tgsigqueueinfo(pid_t tgid, pid_t pid, int sig, kernel_siginfo_t if (pid <= 0 || tgid <= 0) return -EINVAL; - /* Not even root can pretend to send signals from the kernel. - * Nor can they impersonate a kill()/tgkill(), which adds source info. - */ - if ((info->si_code >= 0 || info->si_code == SI_TKILL) && - (task_pid_vnr(current) != pid)) + if (si_code_reserved_to_kernel(info->si_code) && + task_pid_vnr(current) != pid) return -EPERM; return do_send_specific(tgid, pid, sig, info); -- cgit v1.2.3 From 5146e0688d86f0654263e4b0e4ff1719b4072f16 Mon Sep 17 00:00:00 2001 From: Bradley Morgan Date: Sun, 9 Aug 2026 00:29:01 +0000 Subject: prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator prctl_set_auxv() copies the user vector into a stack buffer, forces AT_NULL on the last two entries there, and then copies only len bytes into mm->saved_auxv. Which is fine until the vector is shorter than the buffer, because then the forced terminator sits past the end of the copy and never lands in saved_auxv at all. The code even says /* Make sure the last entry is always AT_NULL */ and it does, just not in the part that gets copied. So mm->saved_auxv keeps the stale tail from exec. Reproducing it is easy: from a process with CAP_SYS_RESOURCE (just run it as root), call prctl(PR_SET_MM, PR_SET_MM_AUXV, ...) with a vector that has a couple of entries and no AT_NULL inside len (32 bytes on arm64), and then hexdump /proc/self/auxv, or gcore the process and look at the AUXV note with readelf -n. This is arm64, the new vector was just { AT_UID, 0x1111, AT_GID, 0x2222 }: idx before (from exec) after the prctl [0] AT_SYSINFO_EHDR 0x7ed1d6e000 AT_UID 0x1111 <- new [1] AT_MINSIGSTKSZ 0x1270 AT_GID 0x2222 <- new [2] AT_HWCAP 0x119fff AT_HWCAP 0x119fff <- stale [3] AT_PAGESZ 0x1000 AT_PAGESZ 0x1000 <- stale ... 16 more entries ... <- stale [20] AT_NULL 0x0 AT_NULL 0x0 21 entries before the prctl, still 21 after: the two new ones plus all 19 left over from exec. Every consumer walks the vector until AT_NULL, so what they get now is a vector that never existed at exec, the head from the prctl glued onto the tail of the old binary. gdb and crash pull the AUXV note out of coredumps to find AT_PHDR, AT_ENTRY, AT_SYSINFO_EHDR and friends, and a mixed vector points them at the wrong layout. /proc//auxv and PR_GET_AUXV hand the same mess out to live processes too. Nothing crashes, everything just quietly reads a frankenstein auxv. And callers that terminate their own vector hide the whole thing, which is likely why nobody noticed since PR_SET_MM_AUXV landed in 2012. Nothing exciting security wise either, I mean it needs CAP_SYS_RESOURCE to begin with. prctl_set_mm_map() right above already copies the whole buffer for exactly this reason, so just do the same here. user_auxv is zero initialized and only partially filled from userspace, so the rest is zeros and nothing leaks. Link: https://lore.kernel.org/20260809002901.32591-1-include@grrlz.net Fixes: fe8c7f5cbf91 ("c/r: prctl: extend PR_SET_MM to set up more mm_struct entries") Signed-off-by: Bradley Morgan Cc: Alexey Dobriyan Cc: Cyrill Gorcuno Signed-off-by: Andrew Morton --- kernel/sys.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'kernel') diff --git a/kernel/sys.c b/kernel/sys.c index df69bd71de03..35b538ba843c 100644 --- a/kernel/sys.c +++ b/kernel/sys.c @@ -2189,7 +2189,7 @@ static int prctl_set_auxv(struct mm_struct *mm, unsigned long addr, BUILD_BUG_ON(sizeof(user_auxv) != sizeof(mm->saved_auxv)); task_lock(current); - memcpy(mm->saved_auxv, user_auxv, len); + memcpy(mm->saved_auxv, user_auxv, sizeof(user_auxv)); task_unlock(current); return 0; -- cgit v1.2.3