Linux kernel mainline source http://mirrors.hust.edu.cn/git/linux.git/atom?h=master 2026-09-04T13:44:43+00:00 2026-09-04T13:44:43+00:00 Jérémy Jean Jeremy.Jean@oss.cyber.gouv.fr 2026-09-04T13:44:43+00:00 urn:sha1:72ce4b24676e8b3b75376c4c559dd81c1ac52d5a LoongArch uses break 11 for the breakpoint placed after an instruction that Kprobes executes out of line. Since userspace can issue the same break instruction, do_bp() can reach kprobe_singlestep_handler() when there is no current probe. The handler actually returns false in this case, but it first calls preempt_enable_no_resched(). The corresponding preempt_disable() is done by kprobe_breakpoint_handler() on a real Kprobe hit, so it has not run here. As a result, an ordinary userspace breakpoint (code 11) underflows the current task's preempt count. This also makes in_interrupt() return true until the task schedules. One visible consequence is the socket cgroup attribution: cgroup_sk_alloc() treats the allocation as interrupt context and assigns the socket to the root cgroup. A socket opened from the SIGTRAP handler can then avoid a BPF_CGROUP_INET_SOCK_CREATE policy attached to the task's own cgroup. Return as soon as kprobe_running() reports no active probe. The same check has appeared in [PATCH v10 2/4] of the original LoongArch Kprobes series, but was dropped before the feature reached mainline. Cc: stable@vger.kernel.org Fixes: 6d4cc40fb5f5 ("LoongArch: Add kprobes support") Link: https://lore.kernel.org/loongarch/1670575981-14389-3-git-send-email-yangtiezhu@loongson.cn/ Assisted-by: Codex:gpt-5 Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn> 2026-09-04T13:44:43+00:00 Wentao Guan guanwentao@uniontech.com 2026-09-04T13:44:43+00:00 urn:sha1:c3f2feace5e4f4b01b68b9f947b19adb4155c32e The rethook trampoline saves $r21 ($u0), the percpu base, into its frame at entry and restores it at exit. Inbetween rethook_trampoline_handler() may schedule via preempt_enable_notrace(). If the task migrates to another CPU, the frame's $r21 holds the old CPU's percpu base, and restoring it poisons $r21 on the new CPU. Until the next user->kernel transition heals $r21, all this_cpu_*() accesses (runqueues, RCU per-CPU data, timer tick programming, FPU ownership) hit the wrong CPU's percpu area. Under kretprobe-heavy preemptible load this can corrupt scheduler and timer state: scheduling-while-atomic splats, wrong-CPU RCU warnings, WARN_ON_ONCE(rq != this_rq()) in nohz_balance_exit_idle(), and CPUs parking in the idle loop with the constant timer never re-armed (hard lockup). Reproduces on a Loongson-3A6000 with kretprobes on VFS paths plus heavy file churn (OS install / unsquashfs). By convention $r21 always holds the current CPU's percpu base in kernel mode: SAVE_SOME() at exception entry reloads it only when coming from user mode, and RESTORE_SOME() restores it only when returning to user mode; the context-switch path never writes it. Therefore the live $r21 at trampoline exit is already correct, and nothing inbetween can change it legitimately (kernel C code cannot write a global register variable). The same flaw existed even in the pre-rethook kretprobe trampoline since v6.3; it was carried over when rethook replaced it. Drop both the save and the restore here. Drop the restore is enough to solve the issue, and drop the save is to keep the code tidy and no need to clear it. Cc: stable@vger.kernel.org # v6.3+ Fixes: 3f5536860086d ("LoongArch: Add kretprobes support") Assisted-by: Kimi:Kimi-K3 # debug and root-cause analysis Signed-off-by: Wentao Guan <guanwentao@uniontech.com> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn> 2026-09-04T13:44:43+00:00 Anthony Iliopoulos ailiop@suse.com 2026-09-04T13:44:43+00:00 urn:sha1:3e1b64bd8cd2bc15c514d90b3dd0a55c53302f3a setup_profiling_timer() is not used by any code at this point. Since a default weak implementation exists, there is no need to still keep this arch-specific definition around. Remove it along with the now-redundant profile header includes. Signed-off-by: Anthony Iliopoulos <ailiop@suse.com> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn> 2026-09-04T13:44:24+00:00 Hemanth Selam hemanth.selam@gmail.com 2026-09-04T13:44:24+00:00 urn:sha1:20a9e97137caaa3fbb27f22f83a5ad80cbd03b01 Correct "avaliable" to "available", reported by scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. It only touches the comments, no code changes. Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn> 2026-08-20T21:46:50+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-08-20T21:46:50+00:00 urn:sha1:caf325ab81be0bc22adf75248ecd22f52f01ad21 Pull LoongArch updates from Huacai Chen: - Add DIRECT_MAP_PHYSMEM_END definition - Expand module virtual address space to 2GB - Use current_stack_pointer in current_pt_regs() - BPF JIT enhancements such as kptr_xchg and timed may_goto - Some bug fixes and other small changes * tag 'loongarch-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: selftests/bpf: Enable kptr_xchg_inline test on LoongArch LoongArch: BPF: Add arch_bpf_stack_walk() implementation LoongArch: BPF: Add timed may_goto implementation LoongArch: BPF: Resolve per-CPU addrs for internal-only MOV LoongArch: BPF: Advertise JIT support for kptr xchg inline LoongArch: BPF: Align value-returning atomics with LKMM LoongArch: BPF: Split unconditional branch JA paths statically LoongArch: BPF: Remove dead move_imm() call in BPF_NEG path LoongArch: BPF: Remove redundant zext jumping in move_imm() LoongArch: BPF: Implement branchless conditional move for TCC LoongArch: BPF: Refactor jump offset calculation in tail call LoongArch: BPF: Move arena register slot below TCC context LoongArch: BPF: Optimize redundant TCC loads in epilogue LoongArch: Use current_stack_pointer in current_pt_regs() LoongArch: Use generic cmp_int() instead of custom cmp_3way() LoongArch: Expand module virtual address space to 2GB LoongArch: Add DIRECT_MAP_PHYSMEM_END definition LoongArch: Fix acpi_package_ids[] array overflow 2026-08-18T23:56:25+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-08-18T23:56:25+00:00 urn:sha1:104a813376837da3b9651457d6fdc99596257fba Pull VDSO updates from Thomas Gleixner: - Consolidate the VDSO datastore further and provide support for mlock_all() and prefaulting. - Provide 32-bit legacy time related functionality only if CONFIG_COMPAT_32BIT_TIME is enabled. The config switch exists, but architecture code still exposes the legacy functionality even disabled. Clean this up by adding the missing guards and validating at build time that the VDSO is legacy free if disabled. - Consolidate the VDSO related config options in core and drivers, which removes some non-sensical dependencies and quite an amount of #ifdeffery. - Clean up the PAGE_SIZE definition maze * tag 'timers-vdso-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (30 commits) random: vDSO: Drop custom PAGE_SIZE definitions LoongArch: Remove CONFIG_GENERIC_GETTIMEOFDAY ifdeffery clocksource/drivers/timer-riscv: Remove CONFIG_GENERIC_GETTIMEOFDAY ifdeffery clocksource/drivers/arm_arch_timer: Remove CONFIG_GENERIC_GETTIMEOFDAY ifdeffery clocksource/drivers/mips-gic-timer: Remove CONFIG_GENERIC_GETTIMEOFDAY ifdeffery MIPS: csrc-r4k: Remove CONFIG_GENERIC_GETTIMEOFDAY ifdeffery vDSO: Make clockmode constants available without CONFIG_GENERIC_GETTIMEOFDAY kbuild: Support generated asm-headers in subdirectories vdso: Rename HAVE_GENERIC_VDSO to VDSO_DATASTORE vdso: Drop HAVE_GENERIC_VDSO from architecture kconfig files vdso: Automatically select HAVE_GENERIC_VDSO if necessary MIPS: vdso: Stop using CONFIG_HAVE_GENERIC_VDSO vdso: Remove the dependency on HAVE_GENERIC_VDSO from ARCH_HAS_VDSO_ARCH_DATA futex: Remove dependency on HAVE_GENERIC_VDSO from FUTEX_ROBUST_UNLOCK vdso/gettimeofday: Verify COMPAT_32BIT_TIME interactions sparc: vdso: Respect COMPAT_32BIT_TIME MIPS: VDSO: Respect COMPAT_32BIT_TIME powerpc/vdso: Respect COMPAT_32BIT_TIME ARM: VDSO: Respect COMPAT_32BIT_TIME arm64: vdso32: Respect COMPAT_32BIT_TIME ... 2026-08-18T22:00:56+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-08-18T22:00:56+00:00 urn:sha1:3424d8c18a7da1010d03391a22e728b857d0d5c5 Pull generic entry code updates from Thomas Gleixner: - Make syscall user dispatching configurable Not all architectures can makes use of syscall user dispatching. Allow them to disable the feature completely. - Consolidate stack randomization for the generic entry code and the architectures using it. Stack randomization on syscall entry was sprinkled throughout the architecture specific low level entry code and in some cases at the wrong points, e.g. before establishing state, which violates the non-instrumentable constraints of that code. Clean this up by integrating stack randomization into the generic entry code helpers so that it is invoked at the earliest possible point right after establishing state and converting all generic entry code using architecture over. - Clean up the syscall number handling in the generic entry code. It works correctly for architectures which have a separate return value storage in pt_regs, but fails to distinguish the case where user space handed in -1 as syscall number from the case where the entry code rejects it by returning -1 to the callers. Aside of that the return value functionality of those interfaces is not really intuitive. Fix this by separating the decision to reject a syscall (user dispatch, ptrace, seccomp ...) from the potential modification of the syscall number through these mechanisms. This solves most of the problems for architectures which do not have a separate return value storage in pt_regs except for the case where a tracepoint has a BPF script or a probe attached which overwrite both the syscall number and the return value. But that's a problem which cannot be solved in the generic code, that only can be addressed by separating the storage model in the affected architectures. * tag 'core-entry-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (23 commits) entry, treewide: Make syscall_enter_from_user_mode[_work]() indicate syscall execution entry: Make return type of syscall_trace_enter() bool entry: Rework trace_syscall_enter() entry: Rework syscall_audit_enter() syscall_user_dispatch: Introduce ARCH_SUPPORTS_SYSCALL_USER_DISPATCH entry: Fix seccomp bypass after ptrace with TSYNC x86/entry: Simplify the syscall number logic x86/entry: Get rid of the sys_ni_syscall() indirection x86/entry: Make syscall functions static ptrace, treewide: Rename ptrace_report_syscall_entry() to ptrace_report_syscall_permit_entry() seccomp, treewide: Rename and convert __secure_computing() to return boolean entry: Use syscall number instead of rereading it entry: Remove syscall_enter_from_user_mode() x86/syscall: Use [syscall_]enter_from_user_mode_randomize_stack() s390/syscall: Use enter_from_user_mode_randomize_stack() riscv/syscall: Use syscall_enter_from_user_mode_randomize_stack() powerpc/syscall: Use syscall_enter_from_user_mode_randomize_stack() loongarch/syscall: Use syscall_enter_from_user_mode_randomize_stack() entry: Provide [syscall_]enter_from_user_mode_randomize_stack() randomize_kstack: Provide add_random_kstack_offset_irqsoff() ... 2026-08-18T17:28:28+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-08-18T17:28:28+00:00 urn:sha1:ba24659b1dbee90d4ce7ffc7577e299f085533a1 Pull kexec updates from Mike Rapoport: - Deduplicate crash memory allocation and the exclusion of reserved crash kernel regions from architecture specific code into a generic crash_prepare_headers() and enable crashkernel CMA reservation on arm64 and riscv reservation on arm64 and riscv. - Skip purgatory checksum verification when the kexec segments cannot be corrupted by DMA, which saves about 250ms on kexec. - Replace __ASSEMBLY__ with the compiler provided __ASSEMBLER__ in include/linux/kexec.h. - Fix a keyring refcount imbalance in the kdump kernel's dm-crypt key restore path, which over-dropped the user keyring reference when more than one key was restored. * tag 'kexec-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux: crash_dump: release keyring reference at the correct time kexec: Replace __ASSEMBLY__ with __ASSEMBLER__ in header file kexec_file: skip checksum verification when safe riscv: kexec_file: Add support for crashkernel CMA reservation arm64: kexec_file: Add support for crashkernel CMA reservation powerpc/kexec_file: Use crash_exclude_core_ranges() helper LoongArch: kexec_file: Use crash_prepare_headers() helper to simplify code riscv: kexec_file: Use crash_prepare_headers() helper to simplify code x86/crash: Use crash_prepare_headers() helper to simplify code arm64: kexec_file: Use crash_prepare_headers() helper to simplify code crash: Add crash_prepare_headers() to exclude crash kernel memory powerpc/crash: sort crash memory ranges before preparing elfcorehdr riscv: kexec_file: Fix crashk_low_res not exclude bug 2026-08-18T17:03:54+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-08-18T17:03:54+00:00 urn:sha1:38fda1d9d2f5df55bd1c095aec07de3699091316 Pull memblock updates from Mike Rapoport: "Non-urgent fixes: - Fix calculation of node_spanned_pages when running with 'kernelcore=mirror' - Properly handle failure to allocate per_cpu_nodestats in free_area_init_core_hotplug() - Fix deferred initialization of the memory map for configurations where node's RAM end is not aligned on PAGES_PER_SECTION Cleanups: - Remove redundant pageblock_align() call in free_unused_memmap() - Remove unnecessary invalid range checks in users of memblock iterators. Some users of for_each_mem_range() and for_each_mem_pfn_range() verify that start < end for each range. This is redundant because memblock iterators guarantee to never return an invalid range - Stop overlapping zones with 'kernelcore=mirror' and align behaviour of 'kernelcore=mirror' with other variants of kernelcore and movablecore - Remove redundant updates of numa_nodes_parsed mask in the callers of numa_add_memblk(), the latter always updates the mask anyway - Remove unnecessary initialization of pgdat->per_cpu_nodestats to NULL, the variable is reset to the actual value a few lines below" * tag 'memblock-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock: (25 commits) mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn mm/mm_init: remove unnecessary initialization of pgdat->per_cpu_nodestats mm/mm_init: remove redundant memset in free_area_init() mm: numa_memblks: use numa_add_reserved_memblk() in numa_cleanup_meminfo() arch_numa: remove redundant node_possible_map assignment mm: numa_memblks: remove redundant numa_nodemask_from_meminfo() LoongArch: remove redundant numa_nodes_parsed node_set() arch_numa: remove redundant numa_nodes_parsed node_set() x86/numa: remove redundant numa_nodes_parsed node_set() of/numa: remove redundant numa_nodes_parsed node_set() ACPI: NUMA: remove redundant numa_nodes_parsed node_set() mm: numa_memblks: set numa_nodes_parsed in numa_add_memblk() mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug mm/mm_init: drop overlap_memmap_init() mm/mm_init: don't overlap NORMAL and MOVABLE zones with kernelcore=mirror mm/hugetlb: remove unnecessary empty range check in hugetlb_bootmem_set_nodes() mm: remove unnecessary empty range check in early_calculate_totalpages() powerpc64/kasan: Remove unreachable invalid range check in kasan_init_phys_region() ARM: remove unreachable invalid range check in kasan_init() riscv: remove unreachable invalid range check in kasan_init() ... 2026-08-17T14:07:14+00:00 Tiezhu Yang yangtiezhu@loongson.cn 2026-08-17T14:07:14+00:00 urn:sha1:4b5b0b79d1f8ef9a683b6572267867d5d9755338 Currently, the module-sections.c file defines a custom cmp_3way() macro to perform a three-way comparison. There is already a generic cmp_int() macro to do the same thing in linux/sort.h, thus remove the custom macro and use the generic interface. This is similar with commit 3e17a4b443bb ("riscv: module: Use generic cmp_int() instead of custom cmp_3way()"). Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>