| Age | Commit message (Collapse) | Author |
|---|
|
https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git
# Conflicts:
# .get_maintainer.ignore
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git
# Conflicts:
# Documentation/scheduler/index.rst
# arch/arm64/configs/defconfig
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/uml/linux.git
# Conflicts:
# arch/um/Kconfig
|
|
# New commits in perf/merge:
7606d01b963f ("x86/fpu: Remove additional remnants of math emulation")
67639ee98521 ("x86/fpu: Remove unnecessary checks for X86_FEATURE_FPU")
391cac638edd ("selftests/x86: Add tests for signal frame FPU portability")
fd14edd82077 ("x86/fpu: Pre-fault only required size of xstate buffer")
f1751b220bc8 ("x86/fpu: Fix potential underflow in xstate_calculate_size()")
731300df4f7d ("x86/fpu: Document reasoning of FX-only fallback")
6916dec7a02f ("x86/fpu: Extract restore_from_ia32_fxstate() and clean up fpu__restore_sig()")
344907fab5fd ("x86/fpu: Clean up and rename variables in signal frame handling")
3d69596c684b ("x86/fpu: Document signal frame layout and portability")
6350de8671b9 ("perf/x86/amd/uncore: Free counter slot by index")
4a8557a4e5d2 ("perf/x86/amd/uncore: Remove redundant event slot scan")
ba29babd881e ("perf/x86/intel: Check only PMC bits in PEBS_ENABLED when detecting host PEBS usage")
193ef44e3261 ("KVM: VMX: Only tell perf to enable PEBS counters for fully enabled PMCs")
57c764783330 ("KVM: VMX: Drop a redundant pmu->global_ctrl check when processing pebs_enable")
31f7cf337ce7 ("perf/x86/intel: KVM: Handle cross-mapped PEBS PMCs entirely within KVM")
a634e4536ec2 ("perf/x86: KVM: Have perf define a dedicated struct for getting guest PEBS data")
b7b84fff2bd6 ("perf/x86/intel: Invert names of intel_ctrl_{guest,host}_mask")
52a6457f59ad ("perf/x86/intel: Annotate x86_pmu::hybrid_pmu with __counted_by_ptr")
df935e26ca9a ("perf/x86/amd/uncore: Turn amd_uncore_ctx events into a flexible array")
c0a44d1745d3 ("xor: Add AVX-512 optimized xor_gen()")
2405d15e5ae4 ("xor: Remove redundant X86_FEATURE_OSXSAVE check")
b93f05df9c66 ("lib/crc: x86: Stop using cpu_has_xfeatures()")
ffe52429f870 ("lib/crypto: x86: Stop using cpu_has_xfeatures()")
9256e0496c14 ("crypto: x86 - Stop using cpu_has_xfeatures()")
19c5d90800a2 ("um: Check for missing AVX and AVX-512 xstate bits")
518aa9948e4f ("x86/fpu: Check for missing AVX and AVX-512 xstate bits")
68aca309e49c ("perf/x86/intel: Add sanity check for PEBS record/fragment size")
c34db2f95094 ("perf/x86: Activate back-to-back NMI detection for arch-PEBS induced NMIs")
00cf8daabe2b ("perf/x86/intel: Advertise PERF_PMU_CAP_SIMD_REGS capability")
c4fabb67a47f ("perf/x86/intel: Support arch-PEBS based SIMD/eGPRs sampling")
098cdd582a9b ("perf/x86: Support SSP sampling using sample_regs_* fields")
578460d9af8d ("perf/x86: Support eGPRs sampling using sample_regs_* fields")
a2c64c74c029 ("perf: Enhance perf_reg_validate() with simd_enabled argument")
74d55a827e31 ("perf/x86: Support OPMASK sampling using sample_simd_pred_reg_* fields")
3807f6996a0b ("perf/x86: Support ZMM sampling using sample_simd_vec_reg_* fields")
b76210d32147 ("perf/x86: Support YMM sampling using sample_simd_vec_reg_* fields")
e9d76ada769c ("perf/x86: Support XMM sampling using sample_simd_vec_reg_* fields")
918b7d6d1729 ("perf: Add sampling support for SIMD registers")
edd9aec51213 ("perf/x86: Enable XMM register sampling for REGS_USER case")
b84c96283684 ("perf/x86: Enable XMM register sampling for non-PEBS events")
c09466807467 ("perf/x86/intel: Centralize PERF_PMU_CAP_EXTENDED_REGS updates")
05fe8825796e ("perf: Move and enhance has_extended_regs() for arch-specific use")
450d73dc5f91 ("x86/fpu: Add update_fpu_state_and_flag() helper")
03b89c9f202e ("x86/fpu/xstate: Add xsaves_nmi() helper")
9c05620b4971 ("perf/x86: Use x86_perf_regs in NMI handlers")
cb388bd530cc ("perf: Eliminate duplicate arch-specific function definitions")
bbdf84fcedfa ("perf/x86/intel: Convert x86_perf_regs to per-cpu variables")
62e074f55f41 ("perf/x86/intel: Enable large PEBS sampling for XMMs")
9106892e27ca ("perf/x86: Move hybrid PMU initialization before x86_pmu_starting_cpu()")
Signed-off-by: Ingo Molnar <mingo@kernel.org>
|
|
mm-unstable into for-next
Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
# Conflicts:
# mm/sparse-vmemmap.c
# Conflict resolution:
#
# diff --git a/mm/sparse-vmemmap.c b/mm/sparse-vmemmap.c
# index 11543f4b6304..5d7e982f94d0 100644
# --- a/mm/sparse-vmemmap.c
# +++ b/mm/sparse-vmemmap.c
# @@ -36,11 +36,7 @@
# #include "mm_init.h"
# #include "sparse.h"
#
# -<<<<<<< HEAD
# -void * __meminit vmemmap_alloc_block(unsigned long size, int node)
# -=======
# void __ref *vmemmap_alloc_block(unsigned long size, int node)
# ->>>>>>> akpm/mm-unstable
# {
# /* If the main allocator is up use that, fallback to bootmem. */
# if (slab_is_available()) {
# @@ -60,11 +56,7 @@ void __ref *vmemmap_alloc_block(unsigned long size, int node)
# }
# return NULL;
# } else
# -<<<<<<< HEAD
# return memmap_alloc(size, size, __pa(MAX_DMA_ADDRESS), node);
# -=======
# - return memmap_alloc(size, size, __pa(MAX_DMA_ADDRESS), node, false);
# ->>>>>>> akpm/mm-unstable
# }
#
# static void * __meminit altmap_alloc_block_buf(unsigned long size,
|
|
GNU ld requires input sections matched by a linker script to be
assigned to an output section. Place UML's .lbss inputs in a named
output section so the linker accepts the static UML linker script.
The .ldata inputs are already collected inside the .data output
section, so they do not need the same change.
Fixes: 779c65ede680 ("um: link .lbss/.ldata/.lrodata correctly")
Signed-off-by: Hajime Tazaki <thehajime@gmail.com>
Link: https://patch.msgid.link/20261009052826.179995-1-thehajime@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
Now every architecture has been converted to support
CONFIG_MMU_GATHER_RCU_TABLE_FREE, this configuration option no longer
makes any sense to keep around.
Therefore remove it, and remove all the dead code that existed for
!CONFIG_MMU_GATHER_RCU_TABLE_FREE architectures previously.
Additionally, CONFIG_MMU_GATHER_TABLE_FREE is no longer necessary, as all
architectures instead use CONFIG_HAVE_ARCH_TLB_REMOVE_TABLE when a custom
__tlb_remove_table() is required, so remove this too.
A number of architectures only enabled CONFIG_MMU_GATHER_RCU_TABLE_FREE if
CONFIG_MMU was set, however the mmu_gather logic only actually does
something meaningful if CONFIG_MMU is set (mmu_gather.c is only compiled
in this case, for instance).
As a result, there's no need to gate any of this logic on CONFIG_MMU
explicitly.
CONFIG_PT_RECLAIM however does have a strict dependency on CONFIG_MMU, so
make this dependency explicit.
Additionally, correct comments to remove references to non-RCU page table
gathering and make it clear that this is not 'semi-RCU', nor has it been
since commit 1fb3d8c20bfa ("mm/mmu_gather: replace IPI with
synchronize_rcu() when batch allocation fails").
With this change in place the kernel policy is now that userspace page
tables are freed after an RCU grace period, and thus it is now safe to
unconditionally perform page table walks under RCU, safe in the knowledge
that page tables will not be freed underneath the walker.
This is all that is guaranteed, however, so naturally it is still
incumbent upon page table walkers to ensure that the page table entries
are as expected.
Link: https://lore.kernel.org/20260925-rcu-pagetable-freeing-v5-11-31e91065fea4@kernel.org
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Reviewed-by: Lance Yang <lance.yang@linux.dev>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Cc: Zi Yan <ziy@nvidia.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Nico Pache <nico.pache@linux.dev>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Barry Song <baohua@kernel.org>
Cc: Usama Arif <usama.arif@linux.dev>
Cc: Guo Ren <guoren@kernel.org>
Cc: Brian Cain <bcain@kernel.org>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Dinh Nguyen <dinguyen@kernel.org>
Cc: Simon Schuster <schuster.simon@siemens-energy.com>
Cc: Jonas Bonn <jonas@southpole.se>
Cc: Stefan Kristiansson <stefan.kristiansson@saunalahti.fi>
Cc: Stafford Horne <shorne@gmail.com>
Cc: Rich Felker <dalias@libc.org>
Cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Cc: Paul Walmsley <pjw@kernel.org>
Cc: Palmer Dabbelt <palmer@dabbelt.com>
Cc: Albert Ou <aou@eecs.berkeley.edu>
Cc: Alexandre Ghiti <alex@ghiti.fr>
Cc: Russell King <linux@armlinux.org.uk>
Cc: Vineet Gupta <vgupta@kernel.org>
Cc: Michal Simek <monstr@monstr.eu>
Cc: Chris Zankel <chris@zankel.net>
Cc: Max Filippov <jcmvbkbc@gmail.com>
Cc: Will Deacon <will@kernel.org>
Cc: Aneesh Kumar K.V <aneesh.kumar@kernel.org>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: David S. Miller <davem@davemloft.net>
Cc: Andreas Larsson <andreas@gaisler.com>
Cc: Richard Henderson <richard.henderson@linaro.org>
Cc: Matt Turner <mattst88@gmail.com>
Cc: Magnus Lindholm <linmag7@gmail.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Huacai Chen <chenhuacai@kernel.org>
Cc: WANG Xuerui <kernel@xen0n.name>
Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Cc: James Bottomley <james.bottomley@hansenpartnership.com>
Cc: Helge Deller <deller@gmx.de>
Cc: Madhavan Srinivasan <maddy@linux.ibm.com>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Christophe Leroy <chleroy@kernel.org>
Cc: Heiko Carstens <hca@linux.ibm.com>
Cc: Vasily Gorbik <gor@linux.ibm.com>
Cc: Alexander Gordeev <agordeev@linux.ibm.com>
Cc: Christian Borntraeger <borntraeger@linux.ibm.com>
Cc: Sven Schnelle <svens@linux.ibm.com>
Cc: Richard Weinberger <richard@nod.at>
Cc: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Cc: Johannes Berg <johannes@sipsolutions.net>
Cc: Thomas Gleixner <tglx@kernel.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: John Hubbard <jhubbard@nvidia.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Randy Dunlap <rdunlap@infradead.org>
Cc: Hugh Dickins <hughd@google.com>
Cc: Qi Zheng <qi.zheng@linux.dev>
|
|
There are no more users left for any pxd_ERROR() either in generic MM or
in the platform MM. Hence all these platform macros along with their
generic fallback could be dropped across the tree.
Link: https://lore.kernel.org/20260831054331.625505-9-anshuman.khandual@arm.com
Signed-off-by: Anshuman Khandual <anshuman.khandual@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Geert Uytterhoeven <geert@linux-m68k.org> # m68k
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Cc: Helge Deller <deller@gmx.de>
Cc: Huacai Chen <chenhuacai@kernel.org>
Cc: James Bottomley <james.bottomley@HansenPartnership.com>
Cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Rich Felker <dalias@libc.org>
Cc: Samuel Holland <samuel.holland@sifive.com>
Cc: WANG Xuerui <kernel@xen0n.name>
Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
|
|
Commit 9e8db5913264 ("net: avoid false positives in untrusted gso
validation") added a '&& skb->network_header' check before flow-dissecting
GSO packets without VIRTIO_NET_HDR_F_NEEDS_CSUM in
__virtio_net_hdr_to_skb(), because some callers (such as tun_get_user(),
tun_xdp_one(), virtnet_receive_done(), and raw_verify_header()) called
virtio_net_hdr_*_to_skb() before initializing skb->network_header and
skb->dev.
Because __alloc_skb() and __build_skb_around() zero-initialize
skb->network_header to 0 (unlike mac_header and transport_header which
are initialized to ~0U), those four callers always had
skb->network_header == 0 and bypassed flow dissection in
__virtio_net_hdr_to_skb(). More generally, skb->network_header is an
offset from skb->head (where 0 is also a valid offset whenever
skb_headroom(skb) is 0), not a boolean flag.
Whenever the 'if (gso_type && skb->network_header)' branch was skipped,
the fallback 'else if (gso_type)' only pulled nh_min_len + thlen (40 bytes
for TCPv4) without dissecting the packet, without validating ip_proto or
n_proto, and without setting skb->transport_header.
If the packet has a malformed network header, it is not rejected and a
subsequent skb_probe_transport_header() also fails, leaving
skb->transport_header at ~0U (0xffff). Similarly, if an IPv4 packet
carries IP options (ihl > 5) or an IPv6 packet carries extension headers,
pulling only nh_min_len + thlen can leave the TCP header outside
skb->head. In both cases, tcp_hdrlen(skb) in skb_gso_transport_seglen()
reads out-of-bounds:
BUG: KASAN: slab-out-of-bounds in skb_gso_transport_seglen
Read of size 2 by task poc/133
skb_gso_transport_seglen (net/core/gso.c:155)
skb_gso_validate_mac_len (net/core/gso.c:270)
tbf_enqueue (net/sched/sch_tbf.c:260)
dev_qdisc_enqueue (net/core/dev.c:4227)
__dev_queue_xmit (net/core/dev.c:4884)
In addition, checking virtio_net_hdr_match_proto() only inside
'if (!skb->protocol)' before flow dissection both skipped validation when
skb->protocol was pre-set by the caller and rejected VLAN-tagged frames
whose outer L2 protocol is ETH_P_8021Q or ETH_P_8021AD.
Fix this by:
1. Initializing skb->dev and skb->network_header (plus skb->protocol for
IFF_TUN) before virtio_net_hdr_*_to_skb() in tun_get_user(),
tun_xdp_one(), virtnet_receive_done(), and raw_verify_header(). In
tun_get_user(), drop the redundant skb_reset_mac_header(skb) in the
IFF_TUN case since __virtio_net_hdr_to_skb() unconditionally resets
mac_header.
2. Removing '&& skb->network_header' and the unvalidated
'else if (gso_type)' fallback in __virtio_net_hdr_to_skb() so all GSO
packets without VIRTIO_NET_HDR_F_NEEDS_CSUM are flow-dissected, have
their transport header pulled into linear data, and have
skb->transport_header set.
3. Moving the virtio_net_hdr_match_proto() check to after
skb_flow_dissect_flow_keys_basic(), validating keys.basic.n_proto
against hdr_gso_type.
Fixes: 9e8db5913264 ("net: avoid false positives in untrusted gso validation")
Fixes: d5be7f632bad ("net: validate untrusted gso packets without csum offload")
Fixes: 924a9bc362a5 ("net: check if protocol extracted by virtio_net_hdr_set_proto is correct")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Closes: https://lore.kernel.org/netdev/20260927163117.746432-2-bestswngs@gmail.com/
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Cc: Michael S. Tsirkin <mst@redhat.com>
Link: https://patch.msgid.link/20261001191140.2818991-3-edumazet@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
Since first moving __init text into the right place in commit
8966ed0b2d48 ("um: move init text between __init_begin/end")
and then making all init sections inaccessible, shutdown and
reboot crash instead of working correctly, for the obvious
reason that the functions are __init but run on the way out.
Removing the __init markers would work in some way, but that
would bubble through a lot of functions.
Instead, mark the relevant functions __noreturn (including
longjmp() since that's now needed so start_idle_thread() can
be __noreturn), and split out the part of main() that's done
on the way out into a new os_exit() function that's called
directly.
Reported-by: Hajime Tazaki <thehajime@gmail.com>
Closes: https://lore.kernel.org/linux-um/m24ifc4v6m.wl-thehajime@gmail.com/
Fixes: a418ab8fddea ("um: mprotect() __init memory")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Tested-by: Hajime Tazaki <thehajime@gmail.com>
Link: https://patch.msgid.link/20260928093934.ca7af44c59ca.I470ece16d176ea704aa6e5767b755055d106da35@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
Just incrementing tt_extra_sched_jiffies can make this
drift enough to hit the softlockup detector, e.g. with
ping using sched_yield() in a loop to measure short
intervals. Make the simulation actually pass time, this
requires going to the external scheduler but actually
makes this sort of thing behave much better and avoids
the soft lockup.
Fixes: 887c5c12e80c ("um: work around sched_yield not yielding in time-travel mode")
Link: https://patch.msgid.link/20260924134223.1672004-2-johannes@sipsolutions.net
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
Because UML_PCI (arch/um/drivers/Kconfig) selects FORCE_PCI, this
contradicts the current dependency of CONFIG_PCI on CONFIG_MMU. This
commit fixes this issue by adding right dependencies under !MMU
environment.
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202609271139.DpjVdepU-lkp@intel.com/
Closes: https://lore.kernel.org/oe-kbuild-all/202609271351.tw8EOsgz-lkp@intel.com/
Closes: https://lore.kernel.org/oe-kbuild-all/202609270410.Kc2FsJp1-lkp@intel.com/
Closes: https://lore.kernel.org/oe-kbuild-all/202609270228.yku16Noi-lkp@intel.com/
Closes: https://lore.kernel.org/oe-kbuild-all/202609270416.rEtAiqyF-lkp@intel.com/
Closes: https://lore.kernel.org/oe-kbuild-all/202609270538.mV3NDkLu-lkp@intel.com/
Closes: https://lore.kernel.org/oe-kbuild-all/202609271435.lANS7mTP-lkp@intel.com/
Closes: https://lore.kernel.org/oe-kbuild-all/202609271512.pg5gWbIg-lkp@intel.com/
Closes: https://lore.kernel.org/oe-kbuild-all/202609271717.pg5HjzeZ-lkp@intel.com/
Closes: https://lore.kernel.org/oe-kbuild-all/202609271810.pxMMu5ZC-lkp@intel.com/
Closes: https://lore.kernel.org/oe-kbuild-all/202609271940.FhRl0cBi-lkp@intel.com/
Closes: https://lore.kernel.org/oe-kbuild-all/202609272107.sLZJEOtt-lkp@intel.com/
Closes: https://lore.kernel.org/oe-kbuild-all/202609272234.F8tROOdL-lkp@intel.com/
Fixes: 626ff2b34dbb ("um: allow deselecting CONFIG_MMU")
Signed-off-by: Hajime Tazaki <thehajime@gmail.com>
Link: https://patch.msgid.link/20260927234537.1585880-1-thehajime@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
Bringing a UML vector netdev up can panic in vector_net_open() with a
fault in _raw_spin_lock().
vector_net_open() calls vector_reset_stats(), which takes the RX and TX
queue locks. However, queue allocation depends on runtime transport
options. With tap transport, vector RX/TX queues are not created and the
legacy header buffers are used instead. Taking a queue lock then
dereferences a NULL queue pointer.
Take the queue locks in vector_reset_stats() only when the corresponding
queue exists. Also move the RX queue lock in vector_poll() into the
VECTOR_RX path, so legacy RX does not touch rx_queue.
Signed-off-by: Henry Barreto <me@henrybarreto.dev>
Acked-By: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Link: https://patch.msgid.link/20260527213524.45903-1-contato@henrybarreto.dev
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
In a stack trace we get the return address, so if the call is at
the end of a function, it can get printed as the next function,
e.g.
vpanic+0x1d3/0x435
abort+0x0/0x4e
do_exit+0x29c/0xcb7
sys_exit_group+0x0/0x16
pid_child_should_wake+0x0/0x83
Use %pB like on x86, which resolves the name with address - 1,
in the same example I get:
vpanic+0x1d3/0x435
panic+0x55/0x55
do_exit+0x29c/0xcb7
do_group_exit+0xbe/0xbe
sys_exit_group+0x16/0x16
Link: https://patch.msgid.link/20260924085002.3ff9ca1de60a.I5ff299b6f3196ad3c51c3032a90c7158c1bbccda@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
Unlike what the comment says, we could munmap() this (but
not reuse it for guest allocations), but then stray libc
allocations could technically conflict, so mprotect() it
to catch access bugs. Align it in the linker scripts too
so that all of it can be covered, not just some.
Link: https://patch.msgid.link/20260924084946.d118ec78e604.I993b671566a4e842dcc290b78f1c0004050362ba@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
Today only the init data is there, which means any
backtrace (or other pointer printing) involving an
__init function can't print its name.
Move the initdata and include the init text between
the markers so this works.
This also enables unmapping the initdata since it's
no longer part of the overall data (which kmemleak
scans, so it would crash otherwise).
Link: https://patch.msgid.link/20260924084946.2bfe0f25e6e2.I021d3a909687794eb2c3435fdfcb7f67e3ec4ba1@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
Since LLVM=1 might end up using different linkers for
CC as linker and LD, use detect --no-warn-rwx-segments
support using CC.
Link: https://patch.msgid.link/20260923173523.15f90065ca57.I3079cffd8db3a639e93c3e2624c61bbebadc3cbd@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
With clang, stub compilation could result in getting stack
frames where none are allowed, or ways of making it be not
relocatable. Set -ftrivial-auto-var-init=uninitialized for
more code, and -fomit-frame-pointer as well to avoid these
issues.
Link: https://patch.msgid.link/20260923173523.9cb03214335b.Ie1487657bc0f464f4911e95f532ab010b32864b8@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
clang 23 for me seems to put a bunch of data into these
"large" sections, causing said data to not be considered
kernel data by the kernel, in turn causing all kinds of
strange bugs. Link the data from these sections in the
right place rather than leaving them separate.
Link: https://patch.msgid.link/20260923173523.3675aee4f2fc.Id8b553b971d1428abb1bd1222016758314af3098@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
Enable HAVE_PERF_EVENTS without any hardware events (since
there's no hardware), that just needs to select the symbol
and provide an empty asm/perf_event.h.
Link: https://patch.msgid.link/20260921230739.587996-2-johannes@sipsolutions.net
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
Correct "hander" to "handler", reported by scripts/checkpatch.pl using the
misspelling list in scripts/spelling.txt. Only touches comments, no code
changes.
Assisted-by: Cursor:claude-opus-5
Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com>
Link: https://patch.msgid.link/20260907062749.16397-1-hemanth.selam@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
__NR_close_range was introduced with
278a5fbaed89dacd04e9d052f4594ffd0e0585de ("open: add close_range()")
which is present in Linux >= 5.9. Older hosts running a kernel version
prior to that range currently fail to build due to that missing system
call number definition.
Fixes: f82a9e7b9fa9 ("um: fix execve stub execution on old host OSs")
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://patch.msgid.link/20260812173249.98435-1-florian.fainelli@broadcom.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
Driver core expects devices to be dynamically allocated and will, for
example, complain loudly when no release function has been provided.
Use __root_device_register() to allocate and register the root device
instead of open coding using a static device.
Note that root_device_register(), which also creates a link to the
module, cannot be used as the device is registered when parsing the
module parameters which happens before the module kobject has been
set up.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260812142228.55316-1-johan@kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
In UML, page mappings are backed by mmap, which allows us to
effectively manage exec permissions. Introduce a _PAGE_EXEC
bit so that pages can be mapped without granting unnecessary
exec permissions.
Signed-off-by: Tiwei Bie <tiwei.btw@antgroup.com>
Link: https://patch.msgid.link/20260517233641.127433-1-tiwei.btw@antgroup.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
Allow deselecting CONFIG_MMU to build a no-MMU
UML kernel.
Signed-off-by: Hajime Tazaki <thehajime@gmail.com>
Signed-off-by: Ricardo Koller <ricarkol@google.com>
[drop defconfig file, minor adjustments/fixes, rewrite message]
Link: https://patch.msgid.link/20260723113633.dc6b7df78016.Id9eb1e435a7d9ee75ec3e25db69ed3e8ff202a58@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
For NOMMU there are not separate address spaces for
each userspace process group, which on the one hand
means we cannot start them on demand, but on the
other means we can just have one for each (virtual)
CPU, and map all of the memory into them.
Implement such processes, and the remaining bits
needed to compile the kernel without CONFIG_MMU.
Link: https://patch.msgid.link/20260723113633.2184dce9413e.I9f810f3ed177d6dc980cad36c231f8c745dee48f@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
The asm-generic futex implementation only supports UP operations,
and the normal (MMU) implementation from uaccess.c isn't built
nor would it work.
Since NOMMU shares address space anyway, it's all trivial and we
can just make a trivial implementation.
Link: https://patch.msgid.link/20260723113633.d8373755f77c.I0a83e5ca6be6c95a81d4b2ec69677bbea5889d7d@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
Since this approach shares more code with the MMU version
in nommu, further move some code around to be able to use
it in nommu (report_enomem) or be able to replace it (this
applies to mm_id, stack, sync). Also add empty inlines for
the TLB flushing and decouple trap.c code.
Link: https://patch.msgid.link/20260723113633.163686eb0863.Ibb7f37d5645cbd566ae5b74fbb19c54c7327ba68@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
This commit adds memory operations on UML under !MMU environment.
Some part of the original UML code relying on CONFIG_MMU are excluded
from compilation when !CONFIG_MMU. Additionally, generic functions such as
uaccess, futex, memcpy/strnlen/strncpy can be used as user- and
kernel-space share the address space in !CONFIG_MMU mode.
Signed-off-by: Hajime Tazaki <thehajime@gmail.com>
Signed-off-by: Ricardo Koller <ricarkol@google.com>
[drop unnecessary bits]
Link: https://patch.msgid.link/20260723113633.1206c739d6c0.I88b7ddf5613d072b934ce5fd9ef133ea5a4aa2b6@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
This splits the memory, process related code with common and MMU
specific parts in order to avoid ifdefs in .c file and duplication
between MMU and !MMU.
Signed-off-by: Hajime Tazaki <thehajime@gmail.com>
[drop many unnecessary changes]
Link: https://patch.msgid.link/20260723113633.af7d6a109c22.Ie82119143778b91fa5585ea3493cf4014113da47@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
As UML supports CONFIG_MMU=n case, it has to use an alternate ELF
loader, FDPIC ELF loader. In this commit, we added necessary
definitions in the arch, as UML has not been used so far. It also
updates Kconfig file to use BINFMT_ELF_FDPIC under !MMU environment.
Acked-by: Kees Cook <kees@kernel.org>
Signed-off-by: Hajime Tazaki <thehajime@gmail.com>
Signed-off-by: Ricardo Koller <ricarkol@google.com>
Link: https://patch.msgid.link/20260723113633.08fe0ad5320e.I3faf90e4181f92dc74500a14090b711605573e4e@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
The futex operations are both now wrong, neither have proper
atomic semantics, which are needed for SMP. Even if we don't
have SMP across threads of a process yet, multiple processes
can use futexes to synchronize.
Also remove the documentation that's duplicated (and wrong,
as this implementation never returns -EAGAIN).
Acked-By: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Link: https://patch.msgid.link/20260723113137.9f16fc4d0c83.I76c3b1c4de6591fa277db8da39e5a24a62361694@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
read_cow_header() copies the backing-file path and computes geometry
from header fields without validating them, and the historical
"XXX Need to sanity-check the values read from the header" comment was
never addressed. Three image-controlled fields are unsafe:
- backing_file[]: not guaranteed NUL-terminated. cow_strdup() and the
later strlen()/printf() walk off the end of the header buffer when a
crafted image leaves the array unterminated (heap over-read).
- sectorsize: used as a divisor in cow_sizes()
(bitmap_len = (size + sectorsize - 1) / (8 * sectorsize)); a zero or
negative sectorsize causes a divide-by-zero / bogus geometry.
- For the V3/V3_b layouts the existing "align == 0" check printed a
warning but fell through and then computed
ROUND_UP(sizeof(header), 0), another divide-by-zero.
Reject an unterminated backing_file for each header version, turn the
align == 0 warnings into hard errors (goto out), and reject a
non-positive sectorsize before the geometry math runs.
A COW image is parsed from a file the guest opens (ubdN=cow,backing on
the command line, or a cow file an unprivileged user can point ubd at),
so a crafted header is attacker-reachable.
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Reviewed-by: Richard Weinberger <richard@nod.at>
Link: https://patch.msgid.link/20260622124823.1695944-1-michael.bommarito@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
vhost_user_get_config() sizes its reply buffer from header + payload:
size_t payload_size = sizeof(msg->payload.config) + cfg_size;
size_t msg_size = sizeof(msg->header) + payload_size;
...
msg = kzalloc(msg_size, GFP_KERNEL);
but then receives the response with msg_size as the payload cap:
rc = vhost_user_recv_resp(vu_dev, msg, msg_size);
vhost_user_recv() reads the header, then full_read()s header.size bytes
into &msg->payload after checking only "size > max_payload_size". The
payload area is msg_size - sizeof(msg->header) == payload_size bytes, so
passing msg_size as the cap lets a peer set header.size up to msg_size
and write sizeof(struct vhost_user_msg_header) (12) bytes past the end
of the kzalloc(msg_size) buffer -- a slab out-of-bounds write of
peer-controlled content.
Pass payload_size, which is the size the payload area was allocated for.
A malicious or compromised vhost-user backend triggers this during
device probe (vu_get -> vhost_user_get_config) with no guest action,
which matters in the confidential-computing model where the guest does
not trust the device backend.
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Reviewed-by: Richard Weinberger <richard@nod.at>
Link: https://patch.msgid.link/20260622124750.1694957-1-michael.bommarito@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
Convert to %pM instead of using custom code.
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20260603072958.107215-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
These buffers are allocated when initializing the virtual queues, but
were not freed again. Wrap all of the del_vqs calls to detach and free
the unused buffers before deleting the IRQ VQ.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Link: https://patch.msgid.link/20260505124317.2330700-2-benjamin@sipsolutions.net
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
Stack of task can be freed earlier than task in case of
THREAD_INFO_IN_TASK. So separate reference of stack should be there.
Help of THREAD_INFO_IN_TASK config also suggests to take this
reference before calling get_wchan.
KASAN also reports it in case of manual race reproduction:
[ 18.400000] BUG: KASAN: vmalloc-out-of-bounds in __get_wchan+0x91/0xd9
[ 18.400000] Read of size 8 at addr 00000000648bfad0 by task cat/25
..
Adding try_get_task_stack() to make sure stack's sanity.
Signed-off-by: Maninder Singh <maninder1.s@samsung.com>
Link: https://patch.msgid.link/20260429060755.1541742-1-maninder1.s@samsung.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
kconfiglint reports:
K008: config MAGIC_SYSRQ has prompts in 2 separate definitions
MAGIC_SYSRQ is defined in two places with complementary conditions:
arch/um/Kconfig:213 — depends on MCONSOLE (UML only)
lib/Kconfig.debug:665 — depends on !UML (everything except UML)
The UML definition has existed since the initial git import in
commit 1da177e4c3f4 ("Linux-2.6.12-rc2"). UML needs MAGIC_SYSRQ to work
through its mconsole interface rather than through keyboard input, so the
UML version depends on MCONSOLE while the generic version excludes UML
entirely with `depends on !UML`.
These two definitions are logically complementary: on UML, MAGIC_SYSRQ
requires MCONSOLE; on everything else, it has no special dependencies.
This can be expressed as a single definition with
`depends on !UML || MCONSOLE`, which evaluates to:
- On UML: requires MCONSOLE (same as before)
- On non-UML: always satisfiable (same as before)
Consolidate into the generic definition in lib/Kconfig.debug by changing
the dependency to `depends on !UML || MCONSOLE` and merging the UML-
specific help text that explains the mconsole-based sysrq interface.
Remove the now-redundant definition from arch/um/Kconfig.
This follows the same unification pattern used by commit 7bd291abe2da
("sched: Unify the SCHED_{SMT,CLUSTER,MC} Kconfig") and our earlier
SCHED_MC consolidation for SH.
No functional change — the resulting Kconfig behavior is identical.
Assisted-by: Claude:claude-opus-4-6 kconfiglint
Signed-off-by: Sasha Levin <sashal@kernel.org>
Link: https://patch.msgid.link/20260426000339.57049-1-sashal@kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
mconsole_parse() matches the 3-byte prefix "log", but mconsole_log()
skips strlen("log ") = 4 bytes, advancing ptr past the NUL terminator
when a client sends "log" without a trailing space.
The length then comes from req->len, the raw recvfrom() count, instead
of req->request.len, so printk() reads up to req->len - 4 bytes of
stale data from a previous request left in the static mc_request
buffer, leaking it to the kernel log.
Use req->cmd->command for the actual command length, add skip_spaces(),
use req->request.len, and guard against non-positive length.
Signed-off-by: Shengzhuo Wei <me@cherr.cc>
Link: https://patch.msgid.link/20260425-mconsole-oob-read-leak-v1-1-7d46e5892c5c@cherr.cc
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
uml_parse_vector_ifspec() stores parsed key/value pairs in the fixed
struct arglist token and value arrays, which are both sized to MAXVARGS.
The parser increments numargs as it discovers pairs, but it never checks
whether another slot is still available before writing into the arrays.
Reject interface specifications that exceed MAXVARGS instead of writing
past the end of the fixed argument arrays.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260424070106.1-uml-vector-v2-pengpeng@iscas.ac.cn
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
All callers of destroy_queue() already perform a NULL check, so
a NULL qi will never be passed in. Inside destroy_queue(), we
dereference qi immediately, and the subsequent NULL check on qi
is unnecessary and confusing. Remove it to address the smatch
warning.
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <error27@gmail.com>
Closes: https://lore.kernel.org/r/202604110937.MLUL70Lx-lkp@intel.com/
Signed-off-by: Tiwei Bie <tiwei.btw@antgroup.com>
Acked-By: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Link: https://patch.msgid.link/20260411163705.948426-1-tiwei.btw@antgroup.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
mconsole_version() formats several UTS strings into a fixed 256-byte
local buffer with sprintf() and no length bound.
Use snprintf() so the version reply stays within the local buffer.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260408160001.1-um-mconsole-v2-pengpeng@iscas.ac.cn
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
add_arg() checks whether command_line and arg fit in the fixed
COMMAND_LINE_SIZE buffer, but when command_line is non-empty it inserts
an additional space before appending arg. The current guard does not
account for that separator, so a non-empty command line can pass the
check and still overflow by one byte.
Count the separator when command_line already contains data.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260330062921.40824-1-pengpeng@iscas.ac.cn
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
With contemporary toolchains, CONFIG_GCOV doesn't work because
gcov now relies on both init and exit handlers, but those are
discarded from the binary. Fix the linker scripts to keep them
instead, so that CONFIG_GCOV can work again.
Note that this does not make it work in modules yet, since we
don't call their exit handlers.
Note: the .init_array.* wildcard and the RUNTIME_DISCARD_EXIT
define are already present in this tree; only the matching
.fini_array.* wildcard remained to be added.
Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Alex Hung <alex.hung@amd.com>
Tested-by: Mariia Nikitash <nikitash.mariiaw@gmail.com>
Link: https://patch.msgid.link/20260727195515.2306731-1-alex.hung@amd.com
Signed-off-by: Kees Cook <kees@kernel.org>
|
|
virtio_uml invokes virtqueue callbacks from vu_interrupt() and
vu_req_interrupt(), which share vu_dev->irq. The core's
synchronize_rcu() fallback already covers these IRQ handlers.
Implement synchronize_cbs() with synchronize_irq() to synchronize with
that IRQ instead of waiting for an RCU grace period.
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260908053817.26065-5-kmehltretter@gmail.com>
|
|
If the CPU declares AVX or AVX-512 support, verify that all the
corresponding bits are set in the XCR0 register. If any are missing,
warn and don't set the corresponding X86_FEATURE_* flags.
This eliminates the perceived need for UML-supporting AVX and AVX-512
optimized code in the kernel (that is, lib/raid/ currently) to start
checking the XCR0 bits in addition to X86_FEATURE_AVX*.
This aligns UML with the vast majority of userspace programs, which
check the XCR0 bits before considering AVX and AVX-512 to be supported,
as per the procedure documented in Intel's CPU manual.
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Acked-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260901145740.42337-3-ebiggers@kernel.org
|
|
The removal of the architecture-specific asm/timex.h was meant to fall back to
asm-generic/timex.h. However on UML, the host architecture headers are earlier
on the include path and therefore asm/timex.h from the host architecture is
used.
On x86 that header in turn requires the generation of cpufeaturemasks.h, which
is not set up for UML and the build fails.
In file included from ../arch/x86/include/asm/tsc.h:9,
from ../arch/x86/include/asm/timex.h:6,
from ../include/linux/timex.h:67,
from ../include/linux/time32.h:13,
from ../include/linux/time.h:60,
from ../include/linux/jiffies.h:10,
from ../include/linux/ktime.h:25,
from ../include/linux/timer.h:6,
from ../include/linux/uprobes.h:18,
from ../include/linux/mm_types.h:16,
from ../include/linux/mmzone.h:22,
from ../include/linux/gfp.h:7,
from ../include/linux/slab.h:17,
from ../include/linux/crypto.h:18,
from ../arch/um/kernel/asm-offsets.c:6:
arch/x86/include/asm/tsc.h: In function ‘get_cycles’:
arch/um/include/asm/cpufeature.h:52:39: error: implicit declaration of function ‘DISABLED_MASK_BIT_SET’ [-Wimplicit-function-declaration]
52 | (__builtin_constant_p(bit) && DISABLED_MASK_BIT_SET(bit) ? 0 : _static_cpu_has(bit))
| ^~~~~~~~~~~~~~~~~~~~~
arch/x86/include/asm/tsc.h:79:14: note: in expansion of macro ‘cpu_feature_enabled’
79 | if (!cpu_feature_enabled(X86_FEATURE_TSC))
| ^~~~~~~~~~~~~~~~~~~
arch/um/include/asm/cpufeature.h:115:17: error: implicit declaration of function ‘_static_cpu_has’ [-Wimplicit-function-declaration]
115 | _static_cpu_has(bit) \
| ^~~~~~~~~~~~~~~
...
The x86-specific timex.h also doesn't make sense on UML in general.
Reintroduce the UML-specific asm/timex.h and add a comment to document
its necessity.
[ bp: Improve that comment to actually state why stuff is there. ]
Fixes: 3ed403bbc967 ("treewide: Remove CLOCK_TICK_RATE")
Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: David Gow <david@davidgow.net>
Link: https://patch.msgid.link/20260819-uml-timex-fix-v1-1-f690b514fc9f@linutronix.de
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 cpuid updates from Borislav Petkov:
- Get rid of static_cpu_has() - one less API to care about testing CPU
features
- Unify the handling of CPU core types (performance, efficient, etc) by
mapping the vendor-specific types to Linux ones
- Continuation of the work of Ahmed Darwish to centralize CPUID leaf
representation
* tag 'x86_cpu_for_v7.3_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/CPU: Rename struct cpuid_read_output to struct cpuid_output
x86/cpu/scattered: Sort it properly
x86/cpu: Use parsed CPUID(0x1)
x86/lib: Add CPUID(0x1) family and model calculation
x86/cpu: Use parsed CPUID(0x0)
x86/cpu/transmeta: Rescan CPUID(0x1) after modifying capabilities
x86/topology: Add TOPO_CPU_TYPE_LOW_POWER
x86/topology: Name the AMD core-type values
x86/topo: Map vendor CPU types to generic Linux such types
x86/bugs: Don't use cpu-type matching in cpu_vuln_blacklist
x86/cpu: Hide and rename static_cpu_has()
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 alternatives update from Borislav Petkov:
- Remove the smp_locks alternatives machinery which was used to patch
out lock prefixes when running a SMP kernel on a uniprocessor machine
* tag 'x86_alternatives_for_v7.3_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/alternative: Drop smp_locks glue
|
