| Age | Commit message (Collapse) | Author |
|---|
|
Lorenzo Bianconi says:
====================
stmmac: some XDP fixes in XDP_TX path
- Fix page address lookup for compound pages in XDP_TX path.
- Disable TX checksum offload for jumbo frames in XDP_TX path.
====================
Link: https://patch.msgid.link/20261012-stmmac-xdp-tx-pre-fixes-v1-0-05fd0c90f7e1@oss.qualcomm.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
|
stmmac_xdp_xmit_xdpf() decides TX checksum insertion from the queue COE
capability only:
csum = !priv->plat->tx_queues_cfg[queue].coe_unsupported;
and lets the enhanced descriptor set TX_CIC_FULL accordingly. On the
bugged_jumbo cores (snps,dwmac-3.40a, snps,dwmac-3.610 and
snps,dwmac-3.710) hardware checksum insertion is broken for jumbo
frames; the skb path works around it by clearing NETIF_F_CSUM_MASK in
stmmac_fix_features() when the MTU exceeds ETH_DATA_LEN, so skbs are
never marked CHECKSUM_PARTIAL and no checksum is inserted. The XDP TX
path bypasses that workaround, so once XDP is allowed at MTU >
ETH_DATA_LEN, jumbo frames sent via XDP_TX or redirected into the
device would leave the interface with a full checksum insertion enabled
on those cores - exactly what the workaround is meant to avoid.
Disable checksum insertion for oversized frames on bugged_jumbo cores in
the XDP TX path too.
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@oss.qualcomm.com>
Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Link: https://patch.msgid.link/20261012-stmmac-xdp-tx-pre-fixes-v1-2-05fd0c90f7e1@oss.qualcomm.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
|
When RX buffers are compound pages (order > 0), only the head page
carries the DMA address programmed by the page pool
(page_pool_get_dma_addr()). stmmac_xdp_xmit_xdpf() computed the head
buffer's bus address from the page that happens to contain the data:
page = frag ? skb_frag_page(frag)
: virt_to_page(xdpf->data);
dma_addr = page_pool_get_dma_addr(page);
...
RX pages become compound as soon as dma_buf_sz needs more than one page
(pp_params.order = order_base_2(num_pages) > 0), which happens from an
MTU around 3000 bytes once dma_buf_sz reaches 4096. If an XDP program
moves the data forward with bpf_xdp_adjust_head() by more than about a
page, xdpf->data points into a tail page whose struct page has no DMA
address: page_pool_get_dma_addr() then returns a bogus bus address, and
dma_sync_single_for_device() together with the TX descriptor transmit
from the wrong location.
Use virt_to_head_page() to read the DMA base of the buffer and keep the
offset relative to the head page (sizeof(*xdpf) + xdpf->headroom), which
is correct no matter which page the data ends up in.
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@oss.qualcomm.com>
Reviewed-by: Daniel Machon <daniel.machon@microchip.com>
Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Link: https://patch.msgid.link/20261012-stmmac-xdp-tx-pre-fixes-v1-1-05fd0c90f7e1@oss.qualcomm.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
|
Merge updates of assorted thermal control drivers for 7.4:
- Add the Exynos ACPM thermal driver for Google GS101, along with
DT bindings and a MAINTAINERS entry (Tudor Ambarus)
- Add Renesas RZ/G3L thermal sensor support and DT bindings, and move
default calibration values to per-SoC match data (Biju Das)
- Add Qualcomm MSM8952 TSENS support and the corresponding DT binding
compatible (Muzaffer Kadir)
- Document the Qualcomm PMAU0102 Master BandGap temperature monitor
compatible in the DT bindings (Dhruvin Rajpura)
- Extend the QCom TSENS v2 trip temperature limits to the hardware
range of -204°C to +204°C to prevent interrupt storms when operating
beyond the previous software limits (Priyansh Jain)
- Fix temperature threshold map indexing in the QCom SPMI temperature
alarm driver to prevent out-of-bounds reads (Georgi Djakov)
- Describe the additional bus clock required by the Amlogic T7 thermal
sensor and switch the driver to the clk_bulk API to manage multiple
clocks (Ronald Claveau)
- Request the Airoha EN7581 IRQ after thermal zone registration to
prevent the interrupt handler from accessing an unregistered or
already freed thermal zone (Vitaliy Sochnev)
- Fix the Airoha AN7583 ADC mux field mapping, serialize access to the
shared ADC, and verify mux selection to avoid invalid temperature
readings and spurious critical shutdowns (Vitaliy Sochnev)
- Register separate thermal zones for the AN7583 bandgap, GbE and CPU
sensors, and update the DT bindings to use one thermal sensor cell
to select the sensor (Vitaliy Sochnev)
- Fix signed integer overflow in the Renesas RZ/G3E temperature-to-code
conversion, preserve compare interrupt state across runtime PM,
and prevent overlapping temperature conversions (Ovidiu Panait)
- Remove redundant trip window validation and runtime PM
pm_runtime_mark_last_busy() calls from the Renesas RZ/G3E driver
(Ovidiu Panait)
- Propagate reset assertion failures from Renesas RZ/G3E suspend and
attempt to restore power if the sensor was active (Pengpeng Hou)
- Stop the TI bandgap alert IRQ before removing sensor interfaces and
cancel pending alert work to prevent use-after-free on driver removal
(Weigang He)
- Validate Spreadtrum sensor IDs read from the device tree before using
them for register offsets and array indexing (Weigang He)
- Convert the TI OMAP bandgap DT bindings to schema and document the
DRA752 compatible and thermal sensor cells (Bhargav Joshi)
- Use DT property helpers matching the signed temperature and unsigned
hysteresis types defined by the thermal zone bindings (Rob Herring)
- Reuse common error handling code in the power allocator governor
bind callback (Markus Elfring)
- Constify the thermal zone device operations in the i.MX9 driver
(Christophe JAILLET)
- Fix kernel-doc parameter names and firmware node references in the
cooling device registration helpers (Aryan Sinha)
- Correct the documented return value of ti_bandgap_get_sensor_data()
to describe validation errors and potentially NULL stored data
(Karl Mehltretter)
- Ensure NUL-termination when copying the cooling device command-line
argument in tmon and fix the associated string truncation warning
(Florian Fainelli)
- Fix undefined behavior caused by a signed shift in the tmon thermal
zone binding display (Liu Jing)
- Fix wording in tmon comments (Hemanth Selam)
- Simplify cpufreq_set_cur_state() in the cpufreq_cooling thermal
control driver (Thorsten Blum)
* thermal-drivers: (36 commits)
thermal/drivers/rzg3e: Propagate reset assertion failure from suspend
thermal: ti-soc-thermal: Fix the return value in ti_bandgap_get_sensor_data() kernel-doc
thermal/fw: Fix kernel-doc parameter names
thermal/qcom/tsens: Add support for MSM8952 tsens
dt-bindings: thermal: tsens: Add MSM8952
thermal/drivers/amlogic: Switch to clk_bulk API to support multiple clocks
dt-bindings: thermal: amlogic: describe bus clock for t7-thermal
tools/thermal/tmon: Fix string truncation warning in optarg copy
thermal/drivers/airoha: Register a thermal zone per AN7583 sensor
dt-bindings: arm: airoha: Use one thermal sensor cell for AN7583
thermal/drivers/airoha: Serialise access to the shared ADC
thermal/drivers/airoha: Fix AN7583 ADC mux field mapping
thermal/drivers/sprd: validate the sensor id from the device tree
thermal/drivers/ti-soc-thermal: Cancel pending alert work on remove
thermal/drivers/qcom-spmi-temp-alarm: Fix temp_map indexing
thermal: gov_power_allocator: Use common error handling code in power_allocator_bind()
tools/thermal/tmon: Fix signed shift UB in binding display
MAINTAINERS: Add entry for Samsung Exynos ACPM thermal driver
thermal/drivers/samsung: Add Exynos ACPM TMU driver GS101
dt-bindings: thermal: Add Google GS101 TMU
...
|
|
tpm2_key_decode() allocates 4 bytes more than needed. The ASN.1
callbacks tpm2_key_priv() and tpm2_key_pub() provide the lengths
of TPM2B_PRIVATE and TPM2B_PUBLIC, so ctx.priv_len and ctx.pub_len
already account for the 2-byte `size` field each of those structures
starts with.
I noticed this while reviewing commit 114f00d738f1 ("KEYS: trusted:
Fix tpm2_load_cmd() boundary check"), which correctly reports
ctx.priv_len + ctx.pub_len as the decoded blob size [1].
Let's allocate exactly that amount, matching the data copied into
the blob.
[1] https://lore.kernel.org/linux-integrity/apfoKo-BdwaLXtkT@sgarzare-redhat/
Cc: stable@vger.kernel.org # v5.13+
Fixes: f2219745250f ("security: keys: trusted: use ASN.1 TPM2 key format for the blobs")
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Link: https://lore.kernel.org/r/20260923173506.41519-1-sgarzare@redhat.com
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
|
|
trusted_tpm_unseal() proceeds to pcrlock() when the TPM unseal operation
fails. If pcrlock() succeeds, its return value overwrites the unseal error,
causing key instantiation to succeed.
Return immediately when unseal fails to preserve the original error.
Cc: stable@vger.kernel.org # v5.15+
Fixes: 5d0682be3189 ("KEYS: trusted: Add generic trusted keys framework")
Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Link: https://lore.kernel.org/r/20260912062950.279104-2-ssrish@linux.ibm.com
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
|
|
The safety IRQ is requested after the MAC and optional WoL IRQs. If its
request fails, stmmac_free_irq() frees the unregistered safety IRQ and
leaks the WoL handler. This can warn about an already-free IRQ and make
the next open fail.
Move the safety and WoL cleanup labels into reverse acquisition order.
This was found by code inspection while working on the stmmac MTU/resume
recovery series. Injecting a safety IRQ request failure in QEMU with
mocked MAC/DMA hardware reproduced the "Trying to free already-free IRQ"
warning and leaked WoL handler. The failure has not been observed without
fault injection.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de>
Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Link: https://patch.msgid.link/20261013-stmmac-irq-unwind-v3-1-fff4e2db805a@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
|
Merge updates of thermal control drivers for Intel platforms, a thermal
control documentation update and two miscellaneous thermal control
updates for 7.4:
- Make the Intel powerclamp thermal driver reject invalid window_size
values, drop redundant clamp() from duration_set() in it, and
simplify 4 functions in it (Thorsten Blum)
- Add rugged Panther Lake support to the intel_tcc_cooling thermal
driver (Srinivas Pandruvada)
- Fix temperature selection around 0 C in the int340x thermal driver,
drop redundant else from proc_thermal_add() in it, and simplify
slider_def_*_set() in it (Thorsten Blum)
- Drop unbalanced paren from cpu-idle-cooling.rst (Manuel Ebner)
- Use %pe to print error pointers symbolically in the thermal control
code and fix assorted typos in comments in it (Sumeet Pawnikar and
Hemanth Selam)
* thermal-intel:
thermal: intel: int340x: soc_slider: Simplify slider_def_*_set()
thermal: intel: powerclamp: Simplify max_idle_set()
thermal: intel: powerclamp: Simplify duration_get()
thermal: intel: powerclamp: Simplify idle_inject_update()
thermal: intel: int340x: Fix temperature selection around 0 C
thermal: intel: powerclamp: Simplify check_invalid()
thermal: intel: intel_tcc_cooling: Add rugged Panther Lake support
thermal: intel: powerclamp: Drop redundant clamp() in duration_set()
thermal: intel: int340x: Drop redundant else in proc_thermal_add()
thermal: intel: powerclamp: Reject invalid window_size values
* thermal-docs:
thermal: docs: cpu-idle-cooling.rst: Drop unbalanced paren
* thermal-misc:
thermal: Use %pe to print error pointers symbolically
thermal: fix assorted typos in comments
|
|
bnxt_xdp_set() stores the new program and drops the reference on the old
one before reopening the NIC. If bnxt_open_nic() then fails, ndo_bpf()
returns an error with the new program still in bp->xdp_prog. The caller
treats the error as "nothing was installed" and drops its own reference,
so bp->xdp_prog is left pointing at a freed program and the next XDP
update dereferences it:
BUG: unable to handle page fault for address: ff78ecc80ddd1038
RIP: 0010:__bpf_prog_put+0x5/0x80
Call Trace:
bnxt_xdp_set+0xad/0x1b0 [bnxt_en]
dev_xdp_propagate+0x36/0xa0
bond_xdp_set+0xeb/0x2d0 [bonding]
dev_xdp_install+0x1b1/0x350
bpf_xdp_link_update+0xc5/0x1b0
link_update+0x104/0x1e0
__sys_bpf+0x662/0xcf0
Seen on a 6.12 based kernel after bnxt_alloc_mem() failed an order-4
allocation on a fragmented host:
bnxt_en 0000:a0:00.1 ens4f1np1: nic open fail (rc: fffffff4)
bond1: (slave ens4f1np1): Error -12 calling ndo_bpf
Bonding is not required to hit this; a plain XDP attach on a bnxt
interface takes the same path.
Restore the previous program when an attach or a replace fails, and
recompute the page-mode and XDP TX ring configuration from it. The
configuration matters because bnxt_init_one_rx_ring() only assigns
rxr->xdp_prog in page mode, and __bnxt_set_rx_skb_mode() derives
dev->max_mtu from the installed program. Release the old program only
once the change has been committed.
A detach is not undone. dev_xdp_detach_link() clears the core's record
of the program even when the driver returns an error, so putting the
program back would leave the driver running a program the core has
already dropped. If the reopen fails during a detach, bnxt_xdp_set()
therefore returns 0 with the device closed; bnxt_open_nic() has already
logged the failure.
Found in a crash dump; the change was not tested on hardware.
Fixes: c6d30e8391b8 ("bnxt_en: Add basic XDP support.")
Cc: stable@vger.kernel.org
Signed-off-by: Vaibhav Nagare <vnagare@redhat.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20261012072802.2153706-1-vnagare@redhat.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD
KVM: s390: Changes for 7.4
- rework page allocation for secure guest variable storage
- selftests
- documentation
- replace get_zeroed_page with kzalloc
- fix floating interrupt inject for corner cases
- initial arm64 on s390 support
This also contains the patch
"arm64: Use proper include variant"
as a build fix. It is also part of the arm tree.
|
|
Merge updates related to system sleep, an energy model handling update,
a generic CPU PM driver update, a clock framework PM update, and a
pm-graph utility update for 7.4:
- Ignore page-zero RAM in E820 checksum during hibernation on x86 to
avoid rejecting images created after kexec() (Matthias Goergens)
- Add resume event mapping for PMSG_POWEROFF to the PM core to allow it
to carry out device shutdown in the future (Mario Limonciello)
- Add DPM watchdog to prepare/late/early/noirq/complete phases of
device suspend and resume (Mayank Rungta)
- Update swsusp.txt references to swsusp.rst in hibernation
documentation (Li Jun)
- Fix use-after-free of perf domain in netlink doit handlers for energy
models (Fan Wu)
- Add synchronize_rcu() back to cpu_pm_unregister_notifier() after it
was removed inadvertently in previous development cycles to avoid
use-after-free (Bradley Morgan)
- Unregister CPU PM notifier outside the timer lock in the timer-ti-dm
clocksource driver (Bradley Morgan)
- Fix typo "sucessfully" in a comment in pm_clk_add_clk() kerneldoc
comment and typo "hierachy" in a comment in pm-graph (Hemanth Selam)
* pm-sleep:
x86/hibernate: Ignore page-zero RAM in E820 checksum
PM: sleep: Add resume event mapping for PMSG_POWEROFF
PM: sleep: Add DPM watchdog to prepare/late/early/noirq/complete phases
PM: hibernate: docs: update swsusp.txt references to swsusp.rst
* pm-em:
PM: EM: Fix use-after-free of perf domain in netlink doit handlers
* pm-cpu:
PM: CPU: Restore synchronize_rcu() to cpu_pm_unregister_notifier()
clocksource/drivers/timer-ti-dm: Unregister CPU PM notifier outside of the timer lock
* pm-misc:
PM: clk: fix typo "sucessfully" in comment
* pm-tools:
tools: power: pm-graph: fix typo "hierachy" in comment
|
|
Add the FUSE_BACKING_MAP_CYCLIC flag for FUSE_NOTIFY_BACKING_MAP
notifications to enable creating striped maps.
This is just a set of regular extents that repeats after the end of the
last extent using a striping pattern (i.e. on the target backings the
stripes have a contiguous footprint).
Two additional limits apply compared to non-cyclic extent map population:
- the size of the extents (chunk size) must be equal
- the extents must start from zero offset and follow each other without
gaps.
Originally-by: John Groves <john@groves.net>
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
|
|
Wire up read, write, splice and mmap operations for extent-mapped
files through the iomap/DAX infrastructure.
When a passthrough file is opened with an EXTMAP backing, I/O is
dispatched to the dax devices referenced by the extent map.
If an address is not mapped, EIO is returned on the I/O operation.
Originally-by: John Groves <john@groves.net>
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
|
|
Add support for creating and managing extent maps that map file regions to
dax device regions.
Introduce FUSE_NOTIFY_BACKING_MAP for populating extent maps from
userspace.
Extent maps are handled as a new type of backing and are assigned a 64 bit
backing ID by the server.
One extent consists of
- offset within the containing backing
- length of extent
- target backing ID
- offset into target backing
Extents must be non-overlapping, and can only refer to dax device backings
for now.
At this point only support creating and populating the extent map in one
operation, though the interface is not limited by this and later may be
changed, so that partial population of an extent map would be possible.
Originally-by: John Groves <john@groves.net>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
|
|
This is only possible with FUSE_PASSTHROUGH_V2 enabled.
Mark the inode with S_DAX if FUSE_LOOKUP returns with FUSE_ATTR_DAX set.
This patch does not yet provide a way actually use the dax dev backing:
when such a backing ID is provided in reply to FUSE_OPEN with
FOPEN_PASSTHROUGH flag set, an error will be returned.
Truncate and hole punch is not currently allowed on inodes marked with
S_DAX.
Move fuse_backing_put() from fuse_free_inode() to fuse_evict_inode() to
avoid sleeping in atomic context.
Originally-by: John Groves <john@groves.net>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
|
|
Add backing_id_64 field to fuse_open_out to allow opening files with
64-bit server-allocated backing IDs.
If the connection was initialized with FUSE_PASSTHROUGH_V2, the kernel
reads the backing ID from open_out.backing_id_64 instead of
open_out.backing_id.
The open reply is now variable-length for backward compatibility with
servers that don't send the new backing_id_64 field.
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
|
|
Add support for server allocated 64-bit backing IDs alongside the
existing kernel allocated 32-bit IDs.
Opened with FUSE_DEV_IOC_BACKING_CREATE, the backing ID sent via
fuse_backing_create_in.backing_id.
Closed with FUSE_NOTIFY_BACKING_REMOVE. Since close only provides the
backing ID, not the file descriptor, it doesn't have to be done with an
ioctl.
Backing ID can take any 64 bit value other than zero.
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
|
|
Conditions are triggered by a buggy fuse server will result in -EIO which
is hard to interpret without any context.
Add helpers that print a short message to the kernel log as well as
returning the error value. This serves a dual purpose:
- documents the error condition inside the code
- allows the implementor of the fuse server to get the context for the
error
Some debug messages are removed in favor of this.
This also changes the mmap return value from -ETXTBSY to -ENODEV if a
passthrough open raced with the prior check. This makes both cases return
-ENODEV if the file is in passthrough mode.
Additionally change the return value of fuse_file_cached_io_open() from an
error value to a bool (true on success) as the error value is translated
anyway.
Currently these use the pr_notice_once() variant. Possibly should be
changed to a ratelimit of e.g. once per minute.
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
|
|
A future fuse patch will utilize dax_holder() in RCU context to make sure
that the holder can't be freed by a racing fs_put_dax.
This patch just makes sure that dax_holder() works properly in such a
context by adding READ_ONCE() (equivalent to rcu_dereference minus sanity
checks).
Fixing XFS is out of scope for this patchset.
Reviewed-by: Gregory Price (Meta) <gourry@gourry.net>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
|
|
If the file is a fsdev_dax open, take the dax_dev from the device inode's
i_cdev. Return with a reference grabbed on the private dax inode.
Make dax_dev_get() static again (internal to super.c for alloc_dax), export
fsdev_dax_from_file() instead.
This fix is in response to a Sashiko review, and some subsequent analysis.
About the 'fixes' tag: this removes the export of dax_dev_get(), which was
flawed, and replaces it with fsdev_dax_from_file(). It feels like the fixes
tag makes sense for correcting an ABI error.
Fixes: 2ae624d5a555d ("dax: export dax_dev_get()")
Originally-by: John Groves <john@groves.net>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Gregory Price (Meta) <gourry@gourry.net>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
|
|
Merge updates related to runtime PM for 7.4:
- Update and improve runtime PM documentation and add a kunit test for
supplier idle/suspend (Brian Norris)
- Add a pm_runtime_dont_use_autosuspend() call to pm_runtime_reinit()
to ensure autosuspend disabling on driver teardown (Joshua Crofts)
* pm-runtime:
PM: runtime: Expand introduction with core concepts and structure
PM: runtime: Clarify driver callback expectations and structure Section 2
PM: runtime: Clarify ->runtime_idle() callback return value handling
PM: runtime: Add "Section" hyperlinks
PM: runtime: Misc improvements to runtime_pm.rst
PM: runtime: More kerneldoc formatting
PM: runtime: Correct pm_runtime_autosuspend_expiration() doc
PM: runtime: call pm_runtime_dont_use_autosuspend() on reinit()
PM: core: Document struct dev_pm_info with kerneldoc
PM: runtime: Pull API docs from kerneldoc
PM: runtime: kerneldoc wording improvements
PM: runtime: Improve set_{status,active,suspended} docs
PM: runtime: kerneldoc fixes
PM: runtime: Add kunit test for supplier idle/suspend
PM: runtime: Only queue an idle check for RPM-linked suppliers
|
|
John is author of the huge rework of the printk subsystem. He has a deep
understanding of the code and great awareness of the various user
expectations. He is willing to step into the maintainer role which
will be a great help.
Reviewed-by: John Ogness <john.ogness@linutronix.de>
Reviewed-by: Steven Rostedt <rostedt@goodmis.org>
Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Link: https://patch.msgid.link/20261014115029.203908-1-pmladek@suse.com
Signed-off-by: Petr Mladek <pmladek@suse.com>
|
|
The HID raw_event callback runs before HID core validates the received
report length. waterforce_raw_event() reads command bytes and then accesses
fixed offsets for firmware or status data without any length checks. A
truncated report can therefore cause out-of-bounds reads and update hwmon
state with unrelated data.
Require every report to contain the firmware response fields, which also
covers both command bytes. After identifying a status response, require
the byte at the highest status offset before accessing its payload.
Fixes: 42ac68e3d4ba ("hwmon: Add driver for Gigabyte AORUS Waterforce AIO coolers")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Link: https://patch.msgid.link/20260927084959.893708-1-yaojiale02@163.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
|
|
Commit 0f8b916bc5b5 ("hwmon: (coretemp) avoid RDMSR interrupts to
isolated CPUs") prevents create_core_data() from creating temperature
data for an isolated CPU. coretemp_cpu_online(), however, still adds
that CPU to pdata->cpumask.
When an isolated SMT thread is processed before a housekeeping sibling,
the mask makes coretemp_cpu_online() believe that the core is already
represented. The housekeeping sibling then gets no temperature
attributes. Package attributes are similarly not retried when the first
CPU processed in a die is isolated.
The mask is also used to select a replacement CPU when a sensor target
goes offline. Including isolated CPUs permits the driver to retarget a
sensor to one, causing subsequent sysfs reads to send an RDMSR IPI to an
isolated CPU.
Keep isolated CPUs out of pdata->cpumask by moving the housekeeping check
to coretemp_cpu_online(). Sensor creation is then deferred to an eligible
CPU, and hotplug replacement targets remain on housekeeping CPUs.
Tested on an Intel Core i7-10510U running 6.18.50-3-cachyos-lts, with
nohz_full=1 on CPU 1 and its housekeeping SMT sibling on CPU 5. The stock
driver omitted Core 1 after module load and retained its readable sensor
after CPU 5 was offlined. The patched driver exposed Core 1, removed it
when CPU 5 went offline, and restored it when CPU 5 returned.
Fixes: 0f8b916bc5b5 ("hwmon: (coretemp) avoid RDMSR interrupts to isolated CPUs")
Cc: stable@vger.kernel.org
Cc: Marcelo Tosatti <mtosatti@redhat.com>
Signed-off-by: Ximing Zhang <xzhangjr@gmail.com>
Tested-by: Asaf Nuri Bertizlioğlu <ycistak@gmail.com>
Link: https://patch.msgid.link/20261016-codex-coretemp-housekeeping-v1-1-96618c5676b2@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
|
|
The documentation says that all sysfs entries are named with their
core_id, and that the "Core X" label contains the processor number.
Neither is accurate. create_core_attrs() numbers the per-core
attributes core_id + 2 and always uses temp1 for the package sensor,
and show_label() prints topology_core_id(), not the logical CPU
number.
The difference is easy to see on hybrid CPUs. On an i7-14700F, the
"Core 4" label is on temp6 and belongs to CPUs 2 and 3, and the
E-cores report core IDs 32 to 43.
Describe the actual numbering.
The mismatch was found by an LLM comparing the documentation with the
code, and verified on the i7-14700F above.
Assisted-by: LLM
Signed-off-by: Asaf Nuri Bertizlioğlu <ycistak@gmail.com>
Tested-by: Ximing Zhang <xzhangjr@gmail.com>
Reviewed-by: Ximing Zhang <xzhangjr@gmail.com>
Link: https://patch.msgid.link/20261015171759.704526-1-ycistak@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
|
|
Merge cpuidle and power capping updates for 7.4:
- Prevent cpuidle governors menu and teo from returning idle state 0
after it has been disabled (Xueqin Luo)
- Replace min_t() with the better alternatives in the intel_idle driver
and make it use 2-argument strscpy() (Andy Shevchenko)
- Fix two repeated phrase instances in cpuidle (Hemanth Selam, Syazwina
Fazrul)
- Add rugged Panther Lake support to the intel_rapl power capping
driver and make it use %pe for printing error pointers (Srinivas
Pandruvada and Sumeet Pawnikar)
* pm-cpuidle:
Documentation: power/cpuidle: Fix repeating phrase
cpuidle: tegra: fix repeated word 'that' in comment
cpuidle: teo: Do not return a disabled idle state
cpuidle: menu: Do not return a disabled idle state
intel_idle: Use 2-argument strscpy()
intel_idle: Replace min_t() with the better alternatives
* pm-powercap:
powercap: intel_rapl: Use %pe to print error pointers symbolically
powercap: intel_rapl: Add rugged Panther Lake support
|
|
drain_workqueue() allows only chained work to be queued while draining.
This is inconvenient because work can be queued from contexts other than
work items already executing on the workqueue.
Use flush_workqueue() instead to allow work to be queued from any
context.
Link: https://lore.kernel.org/r/20261019122555.328060-3-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
|
|
schedule_error_callback() requires a lock to be held by the caller.
However, __fw_send_request() calls the function without holding any lock
when retrieving the transaction label fails, as no lock is needed in
this case. context_safe() is used to suppress the precondition check in
compiler-based context analysis, but it does not affect lockdep checks.
As a result, lockdep reports a violation of the precondition.
Acquire the lock before calling the function instead of using
context_unsafe().
Link: https://lore.kernel.org/r/20261019122555.328060-2-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
|
|
drain_workqueue() allows only chained work to be queued while draining.
This is inconvenient because work can be queued from contexts other than
work items already executing on the workqueue.
Use flush_workqueue() instead to allow work to be queued from any
context.
Link: https://lore.kernel.org/r/20261019122555.328060-3-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
|
|
schedule_error_callback() requires a lock to be held by the caller.
However, __fw_send_request() calls the function without holding any lock
when retrieving the transaction label fails, as no lock is needed in
this case. context_safe() is used to suppress the precondition check in
compiler-based context analysis, but it does not affect lockdep checks.
As a result, lockdep reports a violation of the precondition.
Acquire the lock before calling the function instead of using
context_unsafe().
Link: https://lore.kernel.org/r/20261019122555.328060-2-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
|
|
When a test fails with a signal or times out, child_test_sig_handler()
appends '---- unexpected signal (<sig>) ----' followed by a multi-line
stack trace (' #0 ...' through '_start').
In verbose=1 mode, print_test_failure_snippet() selects up to
failure_snippet_lines (10) lines:
- Pass 1 selects lines matching failure keywords plus their immediate
next line (' #0 ... in child_test_sig_handler').
- Pass 2 fills the remaining quota by scanning backwards from the end
of the output buffer, which consumes the remaining lines on outermost
stack frames ('handle_internal_command', 'run_argv', 'main',
'__libc_start_main', '_start') and hides the trailing test output
showing where the test had run to.
Improve print_test_failure_snippet() by:
- Skipping blank lines and stack trace lines (' #<digit>...') when
selecting context in Pass 1 and when scanning backwards from the end
in Pass 2, with a Pass 3 fallback from the top of the buffer if quota
still remains.
- Prioritizing the non-blank line immediately preceding
'---- unexpected signal' so there is no '...' gap before the signal
message.
- Only printing '...' between selected lines when at least one non-blank
line was omitted between them.
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Ian Rogers <irogers@google.com>
Acked-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
|
|
Mypy does not retain the narrowing of an optional local variable inside
the nested progress callback, causing the perf build to fail with:
python/treport.py:649: error: Item "None" of "ProfileBuilder | None" has no attribute "cancelled" [union-attr]
Check the loading builder before assigning it to profile so the captured
variable is inferred as ProfileBuilder rather than
Optional[ProfileBuilder]. Keep the existing assertion and background
loading behavior.
Fixes: b379b70b7b7b ("perf treport: Show the profile while it loads")
Assisted-by: Codex:GPT-6.1-Sol
Signed-off-by: James Clark <james.clark@linaro.org>
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
|
|
Mypy cannot narrow Row to TaskRow or IoRow when the class passed to
isinstance() comes from a loop variable, causing the perf build to fail
with:
python/ttimechart.py:1686: error: "Row" has no attribute "task" [attr-defined]
Check against TaskRow and IoRow explicitly so mypy can verify access to
the task attribute. The tasks and I/O views contain TaskRow and IoRow
instances respectively, so task navigation behaves as before.
Fixes: e7a72d6919804e5e ("perf timechart: Add an interactive --tui mode")
Reviewed-by: Ian Rogers <irogers@google.com>
Assisted-by: Codex:GPT-6.1-Sol
Signed-off-by: James Clark <james.clark@linaro.org>
Cc: Alice Rogers <alice.mei.rogers@gmail.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
|
|
Merge cpufreq updates for 7.4:
- Minor fixes in various cpufreq drivers (Alexander Koskovich, Daniel
Schwierzeck, Frank Zhang, Haotian Zhang, Kathiravan Thirumoorthy,
Sumeet Pawnikar, and Xueqin Luo)
- Fix wrong behaviors on multi-node servers in the Loongson cpufreq
driver (Huacai Chen)
- Reject NULL from cpufreq_cpu_get() in the Rust code (Mehmet Koseoglu)
- Add suspend OPP to mediatek cpufreq driver and DT (Ryan Brue)
- Fixups for a few bugs identified by Sashiko in the amd-pstate cpufreq
driver (Mario Limoncielloi, Wentao Guan)
- Initial support for maximum frequency capacity handling on Zen6
client in amd-pstate (Mario Limonciello)
- Fix for amd-pstate-ut with 'Requested CPU Min frequency' BIOS option
(K Prateek Nayak)
- New Zen6 tuning values for EPP in amd-pstate (Mario Limonciello,
Vishal Badole)
- amd-pstate documentation fix (Karl Mehltretter)
- Restrict deferred downscaling to low load for shared policies in the
conservative cpufreq governor to avoid undesirable CPU frequency
reduction in some cases (Shengming Hu)
- Serialize sugov_start() against rate limit updates in the schedutil
cpufreq governor to avoid using a stale rate limit value (Hui Su)
* pm-cpufreq: (34 commits)
cpufreq: loongson3: Replace IOCSR read/write with MMIO ones
cpufreq: loongson3: Use global physical CPU ID in get/target callbacks
cpufreq: loongson3: Replace per-package mutex with per-node
cpufreq: loongson3: Adjust the width of id and val in smc_message
cpufreq: loongson3: Make this driver depend on MACH_LOONGSON64
cpufreq: schedutil: Serialize sugov_start() against rate limit updates
arm64: dts: mediatek: mt8173: Mark the lowest CPU OPPs for suspend
cpufreq: mediatek: Enter system sleep at the suspend OPP
cpufreq: qcom-cpufreq-hw: fix device node refcount leak in phandle parsing
cpufreq: qcom-nvmem: Add IPQ9650 support
cpufreq: Add Milos to cpufreq-dt-platdev blocklist
cpufreq: Use %pe to print error pointers symbolically
rust: rcpufreq_dt: add module alias
cpufreq: sti: avoid NULL dereference in dev_err()
cpufreq: tegra194: fix double-pointer error in get_cpu_ndiv
cpufreq: sparc-us2e: fix frequency table index copy-paste error
rust: cpufreq: reject NULL from cpufreq_cpu_get()
cpufreq: amd-pstate-ut: Fix max_freq and EPP test failures on Zen6
cpufreq: amd-pstate: Propagate cppc_set_auto_sel() errors on mode change
cpufreq: amd-pstate: Restore previous mode when changing driver mode fails
...
|
|
ctnetlink_filter_match_tuple() returns 0 (no match) when the IPv6
source or destination address differs from the filter, because the
!ipv6_addr_cmp() test is inverted. ipv6_addr_cmp() returns 0 when
the addresses are equal, so the negation makes the branch trigger on
a match instead of a mismatch, which is the opposite of the IPv4
path above.
Drop the '!' so the IPv6 branch returns 0 only when the addresses
differ, matching the IPv4 semantics and the caller's expectation.
Fixes: cb8aa9a3affb ("netfilter: ctnetlink: add kernel side filtering for dump")
Cc: stable@vger.kernel.org
Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
Reviewed-by: Weibin Liu <liuwb@xiaopeng.com>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
nf_flow_encap_pop() pulls vlan/pppoe or ip tunnel headers and resets the
network header, but leaves the transport header pointing into the removed
outer header. Reset the transport header to the inner L4 header, otherwise
later consumers (e.g. GSO segmentation) parse a bogus header.
Fixes: 4cd91f7c290f ("netfilter: flowtable: add vlan support")
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@oss.qualcomm.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
The DCCP UAPI defines option numbers 3 through 31 as reserved. Like
Padding and Mandatory, these options occupy one byte. dccp_find_option()
only treats values below 2 as single-byte and interprets the byte after a
reserved option as a TLV length.
This can skip a later option and invert an XT_DCCP_OPTION rule result. A
local production-hook fixture installed the same DROP rule for IPv4 and
IPv6. In three fresh boots per kernel, a target-only packet was dropped
20/20 times, while adding reserved option 3 before the same target let
20/20 packets reach the protected receiver. The fixed kernel dropped all
trigger packets in three fresh boots and preserved the normal controls.
Treat every option up to DCCPO_MAX_RESERVED as single-byte, matching the
protocol definition. Triggering requires
CONFIG_NETFILTER_XTABLES_LEGACY, CONFIG_NETFILTER_XT_MATCH_DCCP, an
option-based rule, and remote protocol-33 reachability. The touched source
is unchanged at 0c2669a9f4a1d607e7591ae50ccf3c432a0aff08, where the patch
applies and builds cleanly.
Fixes: 1d3de414eb20 ("[NETFILTER]: New iptables DCCP protocol header match")
Assisted-by: LLM
Signed-off-by: Sung Byeongchan <tjdqudcks0424@naver.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
For anonymous sets, when adjacent ranges are found, the end element is
not added to the set to pack the set representation. Use next start
element to complete this interval.
Jérémy Jean says:
Consider two ranges in a netfilter verdict map:
* keys 10-19 accept packets, and
* keys 30-39 jump to chain 'victim'.
Now, delete the end marker at 20. The lookup array now uses element 30
as the first range's end, so an INTERVAL_END query for key 15 returns
element 30, including its jump verdict and chain pointer. This can make
KASAN reports a UAF after the GC releases reference chain for 30 that
has expired:
BUG: KASAN: slab-use-after-free in nft_verdict_dump+0xdd/0x110
Read of size 8 at addr ff110000009dfb58 by task repro/50
...
Call Trace:
...
nft_verdict_dump+0xdd/0x110
nft_data_dump+0x4d/0x80
nf_tables_fill_setelem+0x30b/0x8a0
? __asan_memcpy+0x3c/0x60
nf_tables_fill_setelem_info+0x1b0/0x200
nft_get_set_elem+0x3fd/0x4b0
...
Freed by task 24:
...
kfree+0x1a5/0x280
nf_tables_trans_destroy_work+0x2cb/0x520
Fixes: 2aa34191f06f ("netfilter: nft_set_rbtree: use binary search array in get command")
Reported-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Link: https://patch.msgid.link/netfilter-devel/20261005200404.3544062-2-Jeremy.Jean@oss.cyber.gouv.fr/
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
The inet ingress hook runs before ip_rcv_core() and ip6_rcv_core(), so
neither IPCB nor IP6CB has been initialized when nft_reject_inet passes
a packet to nf_send_unreach() or nf_send_unreach6(). skb->cb can
therefore retain metadata from an earlier protocol layer.
For IPv4, icmp_send() treats IPCB(skb)->opt as parsed IPv4 options.
Stale option offsets can make __ip_options_echo() copy an
attacker-controlled length into its 40-byte reply option buffer and
overflow the stack. On an unpatched v7.2-rc5 kernel, the IPv4
reproducer produced:
BUG: KASAN: stack-out-of-bounds in __ip_options_echo()
Write of size 255
For IPv6, icmpv6_send() consumes IP6CB(skb) as parsed IPv6 metadata. It
always uses iif for source selection and, when MIP6 is enabled, uses
dsthao as an extension-header offset. These fields must not be stale.
For NF_INET_INGRESS, clear the address-family-specific control block and
restore its input interface before constructing the ICMP error. This
matches similar initialization normally performed by ip_rcv_core() and
ip6_rcv_core().
Fixes: 117ca1f8920c ("netfilter: nft_reject_inet: allow to use reject from inet ingress")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6-sol Codex:gpt-5.5-cyber
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Co-developed-by: David Lee <david.lee@trailofbits.com>
Signed-off-by: David Lee <david.lee@trailofbits.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
nf_flow_tuple_encap() stores the skb vlan tag in the encap tuple id
using skb_vlan_tag_get(), which returns the unmasked TCI including
the 3 PCP priority bits. The flowtable entry, however, is programmed
by nf_dev_path_info() with vlan_dev_vlan_id(), a plain 12-bit VID.
When a NIC delivers RX vlan offload skbs with a non-zero priority
(an RTL9617C EPON ONU was observed handing over vid 818 skbs with
tci 0x6332, PCP 3), the runtime lookup key never matches the
programmed entry, so every packet misses the flow table and
software flow offload is silently defeated.
Mask both parse sites to the 12-bit VID so the lookup key matches
for any priority. The in-header variant has the same problem for
frames received with PCP != 0 on a non-offload path.
The egress side is unaffected: nf_flow_encap_push() restores tags
from the programmed tuple id, which never carried priority bits.
Measured on an RTL9617C ONU (PPPoE over VLAN 818 WAN, NATed 6-flow
download over a 1G EPON line), before -> after:
download throughput 377 Mbps -> 936 Mbps
CPU0 %soft at that rate 91.5% -> 70.9%
Fixes: 4cd91f7c290f ("netfilter: flowtable: add vlan support")
Signed-off-by: Shuangfeng He <huangya90@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
Forward rc value and skip updating sysctl_sync_threshold when
proc_dointvec fails. This targets a write such as "5 x" which would fail
with -EINVAL but would store the first element anyway.
Signed-off-by: Joel Granados <joel.granados@kernel.org>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
Drop the redundant __description macros from arena_zero_off and
cast_to_user inside jit_insns_arena. This allows the test_loader
framework to automatically fallback to the snake_case C function
names rather than the description string for test display.
Before:
$ sudo ./test_progs -t jit_insns/arena_zero_off | tail -3
#191/1 jit_insns/arena access with zero offset:FAIL
#191 jit_insns:FAIL
Summary: 1/0 PASSED, 0 SKIPPED, 1/1 FAILED
$ sudo ./test_progs -t jit_insns/cast_to_user
#191/2 jit_insns/cast to a user address:OK
#191 jit_insns:OK
#192 jit_insns_blinded:OK
Summary: 2/1 PASSED, 0 SKIPPED, 0/0 FAILED
After:
$ sudo ./test_progs -t jit_insns/arena_zero_off | tail -3
#191/1 jit_insns/arena_zero_off:FAIL
#191 jit_insns:FAIL
Summary: 1/0 PASSED, 0 SKIPPED, 1/1 FAILED
$ sudo ./test_progs -t jit_insns/cast_to_user
#191/2 jit_insns/cast_to_user:OK
#191 jit_insns:OK
#192 jit_insns_blinded:OK
Summary: 2/1 PASSED, 0 SKIPPED, 0/0 FAILED
The main goal is that if a test fails, developers can immediately
recognize the exact, actionable test name from the standard output
and rerun it without any confusion.
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20261019083005.12236-1-yangtiezhu@loongson.cn
|
|
Merge ACPI CPPC library updates the CPPC cpufreq driver updates based on
them for 7.4:
- Fix multiple issues related to input validation, synchronization,
access safety, memory layout and register field validation, and error
handling in the ACPI CPPC library (Christian Loehle and Sumit Gupta)
- Select the frequency-invariance callback per CPU in the CPPC cpufreq
driver and create the FIE worker before enabling PCC callbacks in it
to avoid queueing work through a missing worker and dereferencing a
NULL pointer (Christian Loehle)
- Update the CPPC cpufreq driver entry in MAINTAINERS and add a new
entry for the ACPI CPPC library (Christian Loehle)
* acpi-cppc: (22 commits)
MAINTAINERS: ACPI: Add a separate CPPC entry
MAINTAINERS: cpufreq: Replace CPPC reviewer
cpufreq: CPPC: Create the FIE worker before enabling PCC callbacks
cpufreq: CPPC: Select the frequency-invariance callback per CPU
ACPI: CPPC: Accept requests to retain immutable autonomous selection
ACPI: CPPC: Propagate errors from cross-CPU FFH calls
ACPI: CPPC: Validate FFH register fields before hardware access
ACPI: CPPC: Keep Performance Limited clearable on NVIDIA T41
ACPI: CPPC: Clear Performance Limited without a stale read
ACPI: CPPC: Validate SystemIO overlaps across processors
ACPI: CPPC: Validate PCC overlaps across processors
ACPI: CPPC: Validate SystemIO register layouts
ACPI: CPPC: Validate and access PCC register layouts
ACPI: CPPC: Reject direct reads of write-only controls
ACPI: CPPC: Reject unsafe cross-CPU SystemMemory RMW
ACPI: CPPC: Release PCC data after probe failures
ACPI: CPPC: Release CPC descriptors through kobject
ACPI: CPPC: Serialize PCC EPP payload updates
ACPI: CPPC: Serialize PCC single-register payload updates
ACPI: CPPC: Propagate performance-control write errors
...
|
|
The kernel's font library provides font_glyph_cursor() to create cursor
glyphs. Replace fbcon's fbcon_fill_cursor_mask() with a new helper that
uses font_glyph_cursor().
The cursor shapes remain mostly unchanged. The only exception is in
underline cursors for fonts with a size larger than 10. The underlining
dash is now one pixel closer to the font-glyph data, so that the cursor
looks less detached. This follows the style used by vgacon.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
|
|
The new helper font_glyph_cursor() fills a glyph with a cursor pattern.
As with the font_glyph_rotate_*() helpers, the caller has to provide the
output memory.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
|
|
Replace vgacon's custom cursor metrics with the shared helpers
vc_cursor_start() and vc_font_cursor_end(). Note that the _end()
function returns the index of the scanline below the cursor, while
VGA hardware expects the cursor's final scanline. Hence vgacon
subtracts 1 from the end value.
The cursor shapes remain mostly unchanged, except that non-underline
cursors now also use the glyph's top-most and bottom-most scanline.
This follows the style used by fbcon.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
|
|
Fix coding style.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
|
|
Cursors in the VT subsystem are blocks within a character cell that are
filled with the foreground color. The new helpers vc_cursor_start() and
vc_cursor_end() return the scanlines in which the cursor block starts rsp.
ends. This is compatible with VGA hardware.
In terms of cursor design, the new cursor-size helpers follow established
styles in fbcon. The only exception is in underline cursors for fonts with
a size larger than 10. The underlining dash is now one pixel closer to
the font-glyph data, so that the cursor looks less detached. This follows
the style used by vgacon.
Users control the cursor size with the vt module's parameter cur_default
or with the ESC sequence \e[?Nc, where N is the cursor-size constant. In
case of an invalid setting, the new helpers fall back to cur_default and
then underline cursors; in this order.
Similar code in vgacon and fbcon ignores the cursor's default size stored
in vt.cur_default. The consoles default to full-block cursors, while vt
defaults to underline cursors. VGA BIOSes also tend to use underline by.
default. Upon initialization vt applies its default to the console, but
each console might fall back to it own default. For example, running the
ESC code from above with the invalid constant of 8 magically flips the
cursor from underline to block size on vgacon. Another call with N set
to 0 (i.e., default) magically flips it back to underlyine. Making
underline the new default everywhere harmonizes vt, fbcon and most VGA
BIOSes.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Helge Deller <deller@gmx.de>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Helge Deller <deller@gmx.de>
|
|
Sashiko warns that we still have races when the dest overload
thresholds are updated. If we narrow the range between
thresholds the lockless readers (ip_vs_bind_dest and
ip_vs_unbind_dest) may use old threshold values and
as result to skip the required flag change.
To solve the problem ip_vs_bind_dest() and ip_vs_unbind_dest()
will have the chance as before to change the overload
state not only at the exact threshold positions but
at any conn count below the lower and above the upper thresholds.
To make it work without entering the locked region for
every connection, we introduce l_threshold_val. Together with
u_threshold_val we will switch between two states:
1. not overloaded: where l_threshold_val is set to 0
to close the door for more ip_vs_unbind_dest() calls
to clear the overload state.
2. overloaded: where u_threshold_val is set to INT_MAX
to close the door for more ip_vs_bind_dest() calls
to set the overload state.
If a race occurs, multiple CPUs can repeat the state change
but this should be for short time window.
With the introduction of l_threshold_val the
IP_VS_DEST_F_OVERLOAD flag and the 'flags' field are not
needed anymore. We will use the ip_vs_dest_is_overloaded()
helper for all places that read the overload state.
Do not check IP_VS_DEST_CF_AVAILABLE in ip_vs_dh.c because
we do not hold reference to dest after it is removed and
rely on RCU to access the available dests.
To reduce the cacheline accesses while selecting destination,
keep the mostly used fields (weight and l_threshold_val)
at the first read-mostly cacheline together with the hash
nodes.
Fixes: 8f843441c4e7 ("ipvs: properly update the overload flag on dest edit")
Link: https://sashiko.dev/#/patchset/20260810190621.894119-1-pablo%40netfilter.org
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
We need to prevent userspace from corrupting e.g. tcp->doff, because
many locations in conntrack and conntrack helpers rely on
nf_conntrack_in() having validated the packet headers.
nft_payload allows to alter headers later which invalidates this
assumption.
The 'Fixes' commit restricts writes to safe fields, but there is
another side channel: the checksum location.
Restrict this too. Reported via sashiko/gemini.
Fixes: 112e447d17f7 ("netfilter: validate L4 headers after userspace packet writes")
Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
