| Age | Commit message (Collapse) | Author |
|---|
|
https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/pci/pci.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next.git
# Conflicts:
# drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux.git
|
|
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/mm/linux.git
# Conflicts:
# arch/riscv/mm/init.c
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git
# Conflicts:
# fs/nullfs.c
# tools/testing/selftests/Makefile
|
|
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/cel/linux
|
|
git://git.linux-nfs.org/projects/trondmy/nfs-2.6.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/leitao/linux.git
|
|
|
|
# Conflicts:
# fs/ceph/addr.c
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git
|
|
https://git.kernel.org/pub/scm/fs/fsverity/linux.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git
|
|
Enabling allmulticast on a down passthru macvlan, bringing it up,
then toggling allmulticast off and on can underflow the lower device's
allmulti reference count.
macvlan_change_rx_flags() only propagates IFF_ALLMULTI changes while
the macvlan is up. However, the passthru path in macvlan_open() skips
taking an allmulti reference when IFF_ALLMULTI is already set.
Clearing allmulticast after opening the device therefore decrements
a reference that was never taken. With no other allmulti users, the
unsigned counter wraps from zero to UINT_MAX. The next increment
fails with -EOVERFLOW and reports "allmulti touches roof".
The issue was observed during development testing with 5.10 and 6.12
kernels. It was reproduced on Linux 6.12.68 by enabling allmulticast
on a down passthru macvlan, bringing it up, and toggling allmulticast
off and on. This triggered the “allmulti touches roof” warning.
Signed-off-by: Prasad Koya <prasad@arista.com>
Signed-off-by: Dave Miller <davem@davem-thinkpadp1gen8.ibmlond.csb>
|
|
rawv6_send_hdrinc() caches the route before handing the skb to
l3mdev_ip6_out(). The VRF output path may replace skb->dst and release
the original route, leaving the cached pointer stale.
The function later dereferences that pointer for statistics accounting
and as the output device passed to NF_HOOK(). Its RCU read-side critical
section starts after l3mdev_ip6_out(), so it cannot prevent the old route
from being reclaimed in between.
Reload the route from the current skb destination after
l3mdev_ip6_out() returns.
KASAN reports a slab-use-after-free in rawv6_sendmsg(), with the route
allocated by ip6_dst_alloc(), freed by dst_destroy() from rcu_core(), and
the related RCU callback queued from vrf_l3_out().
Fixes: 4c1feac58e06 ("net: vrf: Flip IPv6 output path from FIB lookup hook to out hook")
Cc: stable@vger.kernel.org
Signed-off-by: Zhou Qiuyue <n0ps1edzz@gmail.com>
Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>
Signed-off-by: Dave Miller <davem@davem-thinkpadp1gen8.ibmlond.csb>
|
|
On the JMicron JMC250 revision 03, the MAC reset performed during
suspend leaves GPREG1_RXCLKOFF set. Although the driver enables Magic
Packet detection, the gated RX MAC clock prevents wake-up from ACPI S3.
Keep the RX MAC clock enabled while WoL is armed. Restore the gated
clock state immediately after disabling WoL during resume, preserving
the RX engine initialization ordering.
Prevent concurrent link-change work from gating the clock again after
WoL has been armed. Quiesce interrupt-driven link-change scheduling,
synchronize pending interrupts, and cancel outstanding link-change
work before programming WoL in suspend and shutdown paths.
Restore the deferred processing state before requesting link
reinitialization on resume.
Tested on an ASUS K42JE with JMC250 [197b:0250] rev 03 using a
Debian 6.12.111 kernel and an externally built module. ACPI S3 wake
with a Magic Packet completed in 19 seconds, while a control without
a Magic Packet resumed through the RTC alarm after 123 seconds.
Ethernet and SSH recovered after resume.
S4 and S5 wake behaviour has not been validated with this revision.
Fixes: 854a2e7c331a ("jme: Safer MAC processor reset sequence")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Franck Baur <franck.baur.67@gmail.com>
Signed-off-by: Dave Miller <davem@davem-thinkpadp1gen8.ibmlond.csb>
|
|
Sparse (W=1) builds fail because `SIZE_CHECK(struct rogue_fwif_hwrtdata,
384)` expects 384 bytes, but the compiler generates a 336-byte
structure.
This is due to an alignment conflict: the inner member `cleanup_state`
requires 64-byte alignment, but the outer struct is explicitly marked
`__aligned(8)`.
While a non-sparse build implicitly pads the size to a multiple of 64, a
sparse build strictly respects the 8-byte outer alignment, resulting in
a size mismatch.
Fix this by aligning the entire structure to 64 bytes, which resolves
the contradiction and forces the correct 384 byte size on all builds.
Fixes: a26f067feac1 ("drm/imagination: Add FWIF headers")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202512131851.1WNXk3BC-lkp@intel.com/
Reviewed-by: Matt Coster <matt.coster@imgtec.com>
Reviewed-by: Luigi Santivetti <luigi.santivetti@imgtec.com>
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>
Link: https://patch.msgid.link/20261029-fix_imagination-v4-1-689745dd52ef@samsung.com
Signed-off-by: Alessio Belle <alessio.belle@imgtec.com>
|
|
squashfs_read_fragment_index_table() checks that the table fits before the
next one with:
if (fragment_table_start + length > next_table)
return ERR_PTR(-EINVAL);
fragment_table_start comes from the superblock and is not validated before
this point. A start of 2^64 - length wraps the sum to zero, so the check
passes regardless of next_table and fails to reject the invalid table
ordering.
length then reaches kmalloc() through squashfs_read_table(). A fragment
count of 0xffffffff asks for 64MB, order 14. GFP_KERNEL does not include
__GFP_NOWARN, so the page allocator warns before the mount fails with
-ENOMEM. With panic_on_warn, the warning panics the kernel.
Compare the operands instead of adding them. id.c and export.c avoid the
same wrap with an exact-size check. Keep the inequality here because a
gap before the next table is still allowed.
Link: https://lore.kernel.org/20260822143328.68867-3-kmehltretter@gmail.com
Fixes: 1cac63cc9b2f ("Squashfs: add sanity checks to fragment reading at mount time")
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Assisted-by: Claude:claude-opus-5
Cc: Phillip Lougher <phillip@squashfs.org.uk>
Cc: <stable@vger.kernel.org>
|
|
Patch series "squashfs: harden fragment index table sizing".
Two integer overflows undermine fragment index table handling. One is in
the original fragment sizing macros. The other is in a bounds check added
by commit 1cac63cc9b2f ("Squashfs: add sanity checks to fragment reading
at mount time").
Patch 1: the fragment byte count wraps on 32-bit, so the index table is
allocated too small and squashfs_frag_lookup() reads out of bounds. A
crafted image triggers a KASAN out-of-bounds read on a 32-bit build. With
the fix the same image fails cleanly at mount.
Patch 2: the check that the table fits before the next one adds two u64
values controlled by the filesystem image and can wrap.
This patch (of 2):
SQUASHFS_FRAGMENT_BYTES() multiplies the on-disk fragment count (an
unsigned int) by sizeof(struct squashfs_fragment_entry), a size_t. On a
32-bit kernel that product is 32-bit and can wrap.
squashfs_read_fragment_index_table() sizes the fragment index table from
it, but squashfs_frag_lookup() bounds the fragment number against
msblk->fragments, the unwrapped superblock value. The two disagree: an
image declaring 0x10000001 fragments wraps the product to 16, so a single
index entry is allocated, yet the lookup still accepts fragment
0x0fffffff:
if (fragment >= msblk->fragments)
return -EIO;
block = SQUASHFS_FRAGMENT_INDEX(fragment);
...
start_block = le64_to_cpu(msblk->fragment_index[block]);
block is then 524287 and the read lands ~4MB past an 8-byte allocation.
On a 32-bit build KASAN catches it when the crafted image is mounted and
the file is stat'd.
Cast to u64 in the macro so the multiplication is 64-bit on all targets.
After conversion to index-table entries, SQUASHFS_FRAGMENT_INDEX_BYTES()
is at most 64 MiB for any u32 count, so it fits both the unsigned int
local and the int argument it feeds. 64-bit builds are unchanged.
Link: https://lore.kernel.org/20260822143328.68867-1-kmehltretter@gmail.com
Link: https://lore.kernel.org/20260822143328.68867-2-kmehltretter@gmail.com
Fixes: ffae2cd73a9e ("Squashfs: header files")
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Assisted-by: Claude:claude-opus-5
Cc: Phillip Lougher <phillip@squashfs.org.uk>
Cc: <stable@vger.kernel.org>
|
|
csky allmodconfig, gcc-15.2.0:
drivers/media/v4l2-core/v4l2-vp9.c: In function 'v4l2_vp9_adapt_noncoef_probs':
drivers/media/v4l2-core/v4l2-vp9.c:1834:1: error: the frame size of 1436 bytes is larger than 1280 bytes [-Werror=frame-larger-than=]
The amount of inlining in there is simply nuts. This patch semi-randomly
uninlines various things and fixes the above.
Ad the .text size reduction is tremendous:
ts:/usr/src/25> size drivers/media/v4l2-core/v4l2-vp9.o
text data bss dec hex filename
22450 36 0 22486 57d6 drivers/media/v4l2-core/v4l2-vp9.o-before
16144 36 0 16180 3f34 drivers/media/v4l2-core/v4l2-vp9.o-after
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com>
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
|
|
Keep variable assignments in the same order throughout the function to
make the code easier to follow.
No functional changes.
Link: https://lore.kernel.org/20260811121831.577848-3-yuntao.wang@linux.dev
Signed-off-by: Yuntao Wang <yuntao.wang@linux.dev>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Jason Baron <jbaron@akamai.com>
Cc: Jim Cromie <jim.cromie@gmail.com>
|
|
Patch series "dyndbg: fix incorrect mod_ct value in dynamic_debug_init()".
Fix and clean up dynamic_debug_init().
This patch (of 2):
Suppose all `struct _ddebug` instances belong to the same module, mod_ct
should be 1, but it is currently 0.
mod_ct is incremented only when iter->modname changes, i.e. when the loop
encounters the first _ddebug entry of a new module:
if (strcmp(modname, iter->modname)) {
mod_ct++;
...
}
If all _ddebug entries belong to the same module, strcmp() never returns
nonzero, so mod_ct remains 0.
However, the last (and in this case only) module is added after the loop:
di.num_descs = mod_sites;
di.descs = iter_mod_start;
ret = ddebug_add_module(&di, modname);
Thus, mod_ct should be incremented before adding this final module.
The bug only affects the diagnostic message printed by vpr_info():
"%d prdebugs in %d modules, ..."
It reports one fewer module than the actual number of modules. There is
no userspace-visible runtime effect; the dynamic debug tables themselves
are initialized correctly.
Fix it.
Link: https://lore.kernel.org/20260811121831.577848-1-yuntao.wang@linux.dev
Link: https://lore.kernel.org/20260811121831.577848-2-yuntao.wang@linux.dev
Signed-off-by: Yuntao Wang <yuntao.wang@linux.dev>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Jason Baron <jbaron@akamai.com>
Cc: Jim Cromie <jim.cromie@gmail.com>
|
|
The uevent_filtering test shrinks the uevent socket buffer to 4 KB
although the default socket buffer size is much higher. This leads to
this test being flaky when too many unrelated uevents are fired on the
machine. They might fill up the netlink receive buffer leading to ENOBUFS
errors when trying to receive the uevents. For example, I could trigger
test failures when running triggering a lot of udev events in the
background:
$ # run multiple of that in the background:
$ while :; do sudo udevadm trigger --action=change; done &
$ sudo ./uevent_filtering
# Starting 1 tests from 1 test cases.
# RUN global.uevent_filtering ...
add@/devices/virtual/mem/fullACTION=addDEVPATH=/devices/virtual/mem/fullSUBSYSTEM=memSYNTH_UUID=0MAJOR=1MINOR=7DEVNAME=fullDEVMODE=0666SEQNUM=304458
add@/devices/virtual/mem/fullACTION=addDEVPATH=/devices/virtual/mem/fullSUBSYSTEM=memSYNTH_UUID=0MAJOR=1MINOR=7DEVNAME=fullDEVMODE=0666SEQNUM=304471
add@/devices/virtual/mem/fullACTION=addDEVPATH=/devices/virtual/mem/fullSUBSYSTEM=memSYNTH_UUID=0MAJOR=1MINOR=7DEVNAME=fullDEVMODE=0666SEQNUM=304481
add@/devices/virtual/mem/fullACTION=addDEVPATH=/devices/virtual/mem/fullSUBSYSTEM=memSYNTH_UUID=0MAJOR=1MINOR=7DEVNAME=fullDEVMODE=0666SEQNUM=349156
No buffer space available - Failed to receive uevent
# uevent_filtering.c:463:uevent_filtering:Expected 0 (0) == ret (-1)
# uevent_filtering: Test failed
# FAIL global.uevent_filtering
not ok 1 global.uevent_filtering
The default receive buffer size (SK_RMEM_MAX) is far larger than the
requested 4 KB, so keep this to make the test less flaky.
Link: https://lore.kernel.org/20260619-get-swam-a1cd4cca@mheyne-amazon
Fixes: 9d3df886d17b ("selftests: uevent filtering")
Signed-off-by: Maximilian Heyne <mheyne@amazon.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Christian Brauner <christianvanbrauner@gmail.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Wei Yang <richard.weiyang@gmail.com>
Cc: <stable@vger.kernel.org>
|
|
to make it more readable and consistent.
Link: https://lore.kernel.org/atObuVZXbl9n-zFq@redhat.com
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Christian Brauner <brauner@kernel.org>
|
|
The ocfs2 inode flag macros are alias definitions for the generic fs
flags. Remove these redundant macros, most of which are anyway unused,
and use the generic flags directly.
Link: https://lore.kernel.org/20261022130457.69343-3-ailiop@suse.com
Signed-off-by: Anthony Iliopoulos <ailiop@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
|
