| Age | Commit message (Collapse) | Author |
|---|
|
https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/cel/linux
|
|
|
|
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Jakub Kicinski:
"Including fixes from netfilter, wireless and bluetooth.
Previous releases - regressions:
- tcp: rate limit receive queue collapsing
- raw: fix ICMP unreachable sent when receive queue is full
- eth: bnxt_en: take RTNL before netif_close() when aborting FW reset
Previous releases - always broken:
- tcp:
- bound snd_cwnd_clamp to TCP_MAX_SND_CWND
- number of fixes for TCP Fast Open
- gro:
- invalidate frag0 after a pull
- avoid parsing headers from shared fragments
- cipso: stop modifying live ip_options_rcu
- udp: do not use a cross-family sk_rx_dst in early demux
- fou: gue: check IP version of held packets for direct IP
encapsulation
- skbuff: preserve fclone lifetime when freeing stolen heads
- eth:
- mlx5e:
- fix crashes on queue stats access to queues without stats
- SHAMPO, disable end padding when relaxed ordering is
- ena: keep the RX buffer mapped if skb allocation fails"
* tag 'net-7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (227 commits)
selftests: net: add a test for NSH GSO
nsh: limit recursion in nsh_gso_segment()
selftests: tls: Cover the cap on consecutive empty records
selftests: tls: Extend coverage for zero-length records
selftests: tls: Skip the zero_len tests when TLS is unavailable
tls: Consume empty data records in tls_sw_splice_read()
tls: Break the connection after a burst of empty data records
net: phy: c45: select BASE-T1 type for the forced speed
net/mlx5e: Fix false WARN_ON_ONCE in flow steering cleanup on RX init failure
net/mlx5e: IPsec, don't match upper proto selectors in crypto offload TX
tcp: fix request_sock use-after-free during Fast Open accept()
net: usb: cdc_ncm: don't underflow the NDP room check
net: netns: fix INT_MAX nsid cleanup
amt: use ipv6_hdr() in amt_mldv1_leave_handler()
af_unix: Inherit SO_INQ in unix_stream_connect()
tcp: Pass req->rsk_listener to inet_csk_reqsk_queue_drop() in tcp_check_req().
mailmap: add entries for Hangbin Liu
net: virtio: validate outer protocol of UDP tunnel GSO packets
tun: clear stale skb->protocol of NAPI frags skbs
net: virtio: fix UDP tunnel GSO header of VLAN tagged packets
...
|
|
virtio_net_hdr_tnl_to_skb() trusts the virtio header to describe a
UDP tunnel over IPv4 or IPv6, but never checks that the frame actually
carries such outer headers. Because VIRTIO_NET_HDR_F_NEEDS_CSUM is
mandatory for tunnel GSO, __virtio_net_hdr_to_skb() skips the flow
dissector, so virtio_net_hdr_match_proto() is never applied either.
A guest (or a tap writer) can then inject a frame with an arbitrary
outer ethertype, for example ETH_P_NSH, with SKB_GSO_UDP_TUNNEL set.
The GSO stack then runs nsh_gso_segment() on top of the UDP tunnel
segmentation, which assumes a different header layout. The result is
segments with skb->data before skb->head, and a host crash in
skb_under_panic() as soon as a later layer pushes a header:
skbuff: skb_under_panic: ... put:4 ... dev:gretap1
kernel BUG at net/core/skbuff.c:215!
skb_push
__gre_xmit
gre_tap_xmit
...
tun_get_user
Validate the outer headers with the parsing helpers from Michael's
series "net: resolve uncommon partial checksums at ingress":
- locate the L3 header: Ethernet with optional VLAN tags, or the
network header set by the caller. skb->protocol is not trusted when
it disagrees with the frame.
- require the outer L3 protocol to match the declared tunnel type.
- require the outer UDP header exactly at outer_th_offset, after IPv4
options or IPv6 extension headers, and reject fragments.
Unlike the original helpers:
- the callers tell whether the frame starts with an Ethernet header,
with a new has_eth argument of virtio_net_hdr_tnl_to_skb(), instead
of using the device type. tun frames packets from its IFF_TAP and
IFF_TUN flags, and TUNSETLINK can set the device type to any value.
virtio_net and tun_xdp_one() always pass true, tun_get_user() passes
whether the device is IFF_TAP.
- ipv6_find_hdr() stops at an AH header, as Willem suggested in the
review of that series.
Fixes: a2fb4bc4e2a6 ("net: implement virtio helpers to handle UDP GSO tunneling.")
Reported-by: Hassan Sultan <hassansultan@google.com>
Suggested-by: Willem de Bruijn <willemb@google.com>
Link: https://lore.kernel.org/netdev/93d0e37c99711bebdf60c120af03010455c2f2e2.1793276116.git.mst@redhat.com/
Co-developed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Link: https://patch.msgid.link/20261110213628.3476051-4-edumazet@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
virtio_net_hdr_tnl_from_skb() builds a wrong header for VLAN tagged UDP
tunnel GSO packets.
1) When the skb carries a hwaccel VLAN tag, tun_put_user() inserts the
802.1Q header in the frame it copies to user space or vhost-net, and
passes vlan_hlen = VLAN_HLEN. virtio_net_hdr_from_skb() adds
vlan_hlen to csum_start, but inner_nh_offset and outer_th_offset do
not account for it, and are 4 bytes short of the real inner L3 and
outer UDP headers in the emitted frame.
tun advertises NETIF_F_HW_VLAN_CTAG_TX and NETIF_F_HW_VLAN_STAG_TX
in hw_enc_features, and its vlan_features keep the UDP tunnel GSO
features, so this happens for example with a VLAN filtering bridge
with a tagged port, or with a vlan device on top of a tap.
2) The outer family comes from skb->protocol, which is ETH_P_8021Q or
ETH_P_8021AD when the VLAN tag is in the packet data, so a packet
with an outer IPv6 header is reported as
VIRTIO_NET_HDR_GSO_UDP_TUNNEL_IPV4. This happens when
__vlan_hwaccel_push_inside() inserted the tag because the device does
not offload it: virtio_net never offloads VLAN insertion but keeps
UDP tunnel GSO in its vlan_features, and tun does the same with VLAN
TX offload disabled, or with QinQ (outer tag offloaded, inner tag in
the data).
The receiver sets inner_network_header and transport_header from these
offsets, and checks them with the wrong outer family. A forwarded
packet that gets segmented again uses the wrong inner headers, and a
receiver checking the outer headers against the virtio header drops
the packet.
Add vlan_hlen to both offsets like csum_start, and take the outer
family from vlan_get_protocol(), which skips VLAN tags in the data.
Fixes: a2fb4bc4e2a6 ("net: implement virtio helpers to handle UDP GSO tunneling.")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/netdev/179421814766.994134.3669228181251158303@kernel.org/
Closes: https://lore.kernel.org/netdev/179433950084.994134.15100186606737698605@kernel.org/
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Link: https://patch.msgid.link/20261110213628.3476051-2-edumazet@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull power management fixes from Rafael Wysocki:
"These address a few issues in the cpufreq core and drivers, including
issues actually seen in the field, a few issues related to runtime PM,
including a false-positive warning introduced relatively recently and
a long-standing defect in the runtime PM core code related to
autosuspend, and revert a problematic recent update of the intel_rapl
power capping driver.
Specifics:
- Revert a recent update of the intel_rapl power capping driver that
caused perf to return bogus values (Dennis Chen)
- Fix the synchronization of boost state updates in cpufreq
(Christian Loehle)
- Fix issues related to system suspend-resume synchronization in the
cpufreq core and intel_pstate driver (Rafael Wysocki)
- Fix P-state index mismatch in extract_io() in the ACPI cpufreq
driver on systems with defective _PSS (Li RongQing)
- Fix issues related to target frequency caching in cpufreq (Rafael
Wysocki)
- Prevent a false-positive warning in pm_runtime_remove() introduced
by a previous fix during the 7.0 development cycle (Zhou Minqiang)
- Extend a recent improvement related to the handling of suppliers
during device runtime-suspend to some previously missed cases in
which it is relevant for consistency (Brian Norris)
- Update runtime PM documentation to reflect new behavior after
recent changes (Stanley Jhu)
- Add last_busy timestamp updates for devices requested to resume
from runtime suspend that are missing if those devices are not
actually suspended (Rafael Wysocki)"
* tag 'pm-7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
Revert "powercap: intel_rapl: Expose all package CPUs in PMU cpumask"
PM: runtime: Update last_busy in rpm_resume() for active devices
cpufreq: Fix updates of cached resolved frequency and index
cpufreq: Cache post-resolution target frequency in __resolve_freq()
cpufreq: acpi-cpufreq: fix P-state index mismatch in extract_io()
cpufreq: Serialize global boost updates
cpufreq: Preserve global boost state on failed updates
PM: runtime: Update runtime_pm.rst for non-fatal resume errors
PM: runtime: Only queue an idle check for RPM-linked suppliers (part 2)
PM: runtime: Fix check_flush_dependency warning from pm_runtime_remove
cpufreq: intel_pstate: Use rdmsrq_safe() to read MSR_MISC_PWR_MGMT
cpufreq: intel_pstate: Clear last written P-state value on suspend
cpufreq: Force passing target frequency to driver during resume
cpufreq: Improve suspend-resume synchronization
cpufreq: Hold the policy write lock when changing boost state
|
|
Merge cpufreq fixes and fixes related to runtime PM for 7.4-rc3:
- Fix the synchronization of boost state updates in cpufreq (Christian
Loehle)
- Fix issues related to system suspend-resume synchronization in the
cpufreq core and intel_pstate driver (Rafael Wysocki)
- Fix P-state index mismatch in extract_io() in the ACPI cpufreq driver
on systems with defective _PSS (Li RongQing)
- Fix issues related to target frequency caching in cpufreq (Rafael
Wysocki)
- Prevent a false-positive warning in pm_runtime_remove() introduced
by a previous fix during the 7.0 development cycle (Zhou Minqiang)
- Extend a recent improvement related to the handling of suppliers
during device runtime-suspend to some previously missed cases in
which it is relevant for consistency (Brian Norris)
- Update runtime PM documentation to reflect new behavior after recent
changes (Stanley Jhu)
- Add last_busy timestamp updates for devices requested to resume from
runtime suspend that are missing if those devices are not actually
suspended (Rafael Wysocki)
* pm-cpufreq:
cpufreq: Fix updates of cached resolved frequency and index
cpufreq: Cache post-resolution target frequency in __resolve_freq()
cpufreq: acpi-cpufreq: fix P-state index mismatch in extract_io()
cpufreq: Serialize global boost updates
cpufreq: Preserve global boost state on failed updates
cpufreq: intel_pstate: Use rdmsrq_safe() to read MSR_MISC_PWR_MGMT
cpufreq: intel_pstate: Clear last written P-state value on suspend
cpufreq: Force passing target frequency to driver during resume
cpufreq: Improve suspend-resume synchronization
cpufreq: Hold the policy write lock when changing boost state
* pm-runtime:
PM: runtime: Update last_busy in rpm_resume() for active devices
PM: runtime: Update runtime_pm.rst for non-fatal resume errors
PM: runtime: Only queue an idle check for RPM-linked suppliers (part 2)
PM: runtime: Fix check_flush_dependency warning from pm_runtime_remove
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull more vfs fixes from Christian Brauner:
- inode: Let the shrinker reclaim inodes with I_METADATA_WRITEBACK like
any other clean inode and have evict() write out what the bit tracks
unless the inode is being deleted.
Since v7.3 ext2, ext4 without a journal, fat, udf and minix set
I_METADATA_WRITEBACK when they copy an inode into its buffer and only
fsync() and friends clear it again. inode_lru_isolate() took such
inodes off the LRU expecting something to put them back once the bit
was gone but nothing ever did. So they couldn't be reclaimed until
something fsynced them or the filesystem was unmounted.
On ext4 without a journal an atime update was enough to pin an inode,
and creating 60000 small files in a memory cgroup limited to 96M got
the task OOM killed after about 43000 of them. Now all 60000 get
created.
- dcache:
- Give d_set_mounted() a seqlock of its own that d_invalidate()
waits on after unhashing the dentry.
Since v6.17 d_set_mounted() doesn't bump the seqcount of
rename_lock anymore, so a mount racing d_invalidate() could end
up below the unhashed directory. Nobody can reach it there and it
pins the subtree until the mount namespace goes away. With a FUSE
directory 3000 levels deep 151 of 200 bind mounts racing
FUSE_NOTIFY_INVAL_ENTRY ended up there.
- Only take busy secondary roots off ->s_roots in do_one_tree() so
that umount waits for a racing eviction of an idle one. Since
v7.3 it didn't, which ended in busy inodes after unmount and an
iput() on a dead superblock.
- Make a disconnected dentry a secondary root when the mount on it
goes away so that umount finds it and waits for its eviction.
With CAP_DAC_READ_SEARCH such a dentry can be mounted on via
open_by_handle_at() and move_mount() and umount racing its
eviction ended the same way.
- splice:
- Remove pipe buffer stealing as you and David suggested.
fuse and virtio_console were the only users of ->try_steal() and
now always copy, as they already did when a steal failed.
Stealing took page cache folios out of their files and turned
pages into page cache folios and back. SPLICE_F_GIFT and
SPLICE_F_MOVE are still accepted and fuse still advertises
FUSE_SPLICE_MOVE so servers that ask for it mount as before.
- Clamp a ->write_iter() result that is larger than the iterator in
iter_file_splice_write() instead of only warning about it.
Otherwise the pipe releases buffers past its head.
- ns:
-Allocate the namespace id before calling the namespace_init LSM
hook that was added this merge window. Landlock now logs the
allocated id instead of zero when it denies the creation of a
namespace.
-Don't mark the arguments of the namespace_init and namespace_free
hooks as trusted for bpf LSM programs. Both see namespaces that
are only partially set up or on their way out.
- proc: Don't let proc_sys_call_handler() report more bytes written
than it was passed when a cgroup/sysctl bpf program replaced the
value with a longer one. A splice() into the sysctl file then walked
past the pipe head.
- coda: Pass the append state of each write on to the container file
with RWF_APPEND or RWF_NOAPPEND. coda_open() sets O_APPEND on the
container file after its iocb flags were cached, so an O_APPEND write
overwrote existing data instead of appending.
- adfs: Reject big directory entries in adfs_fplus_getnext() whose name
doesn't fit into the name buffer. A crafted image overflowed it on
the stack.
* tag 'vfs-7.4-rc3.fixes.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (28 commits)
nstree: drop ns_tree_add_raw()
ns: allocate the namespace id before the namespace_init hook
bpf: don't mark namespace_init and namespace_free arguments as trusted
splice: replace nosteal_pipe_buf_ops with default_pipe_buf_ops
splice: remove pipe buffer stealing
fuse: don't move pipe buffers into the page cache
virtio_console: copy pipe buffers in splice_write()
fs/adfs: bound directory entry name length in adfs_fplus_getnext()
dcache: let umount find a disconnected ex-mountpoint
dcache: wait for a racing eviction of a secondary root
dcache: let d_invalidate() wait for a d_set_mounted() in flight
fat: drop mmb_sync() from fat_evict_inode()
udf: drop mmb_sync() from udf_evict_inode()
minix: drop mmb_sync() from minix_evict_inode()
ext4: drop mmb_sync() from ext4_evict_inode()
ext2: drop mmb_sync() from ext2_evict_inode()
fs: don't strand I_METADATA_WRITEBACK inodes outside the LRU
fs: set I_METADATA_WRITEBACK in mmb_mark_buffer_dirty()
udf: don't allocate the inode block in udf_sync_inode_metadata()
minix: don't read the inode block in minix_sync_inode_metadata()
...
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless
Johannes Berg says:
====================
Various fixes all over, notably:
- mm81x: fix frequency reporting of 2 MHz or wider channels
- rtw88: fix stuck queue for AP on SDIO
- ath12k:
- fix split MSDU decap
- fix reconnect of MLO stations
- fix stuck TX due to lack of MCS 15 support
- mac80211: use-after-free on certain TTLM/update combinations
- nxpwifi: FW response/notification validation
- (and a subset of usual "LLM saw a bug" things)
* tag 'wireless-2026-11-11' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: (40 commits)
wifi: mac80211: fix unlocked STA statistics fallback
wifi: cfg80211: don't truncate the merged MBSSID profile length
wifi: nl80211: fix ERR_PTR use on wdev disappearance
wifi: mac80211: fix use-after-free on TTLM disconnect
wireless: Remove me as ssb maintainer
wifi: mac80211: bound pending OCB station allocations
wifi: mac80211: recheck the OCB station limit before insertion
wifi: mac80211: bound pending IBSS station allocations
wifi: mac80211: recheck the IBSS station limit before insertion
wifi: mac80211: reject invalid EHT guard intervals in airtime estimates
wifi: cfg80211: preserve mesh A-MSDU lengths when adding mesh headers
wifi: mac80211: restore dormant links when link updates fail
wifi: mac80211: recheck injected headers after removing FCS
wifi: mac80211_hwsim: ignore non-generic netlink releases
wifi: cfg80211: release rejected nontransmitted BSS reference
wifi: mac80211: drain link readers before stopping removed links
wifi: mac80211: find STA for beacons belonging to non-TX BSS
wifi: mac80211: do not switch to invalid link
wifi: mac80211: fix use-after-free when MLO link setup is rolled back
wifi: mac80211: abort chanswitch when leaving an IBSS
...
====================
Link: https://patch.msgid.link/20261111133442.225455-8-johannes@sipsolutions.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
Now that ns_tree_add() doesn't allocate an id anymore it does the same
thing as ns_tree_add_raw(). Switch the remaining ns_tree_add_raw() users
over to ns_tree_add() and drop it. Rename __ns_tree_add_raw() to
__ns_tree_add() while at it.
No functional changes.
Fixes: f675d2e95569 ("lsm: add LSM blob and hooks for namespaces")
Cc: stable@kernel.org # mainline only
Link: https://patch.msgid.link/20261029-work-security-namespace_free-v2-5-65591dbba7b3@kernel.org
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
|
|
Currently the namespace id is allocated only after __ns_common_init()
has called the namespace_init LSM hook. Most namespace types allocate it
in ns_tree_add() right before the namespace is added to the namespace
trees. So the namespace_init hook always sees an id of zero.
The namespace id is the only identifier of a namespace that is never
recycled. A bpf LSM wants to use it to track a namespace from
namespace_init until namespace_free, e.g., by using it as the key into a
map that associates data with the namespace. The inode number doesn't
work for that as it is quickly recycled.
So allocate the id in __ns_common_init() before calling the
namespace_init hook. Every namespace then has its id by the time it is
added to the namespace trees. The initial namespaces still get their
fixed ids, either statically from NS_COMMON_INIT() or for init_net from
ns_common_init(). So ns_tree_add() doesn't need to allocate an id
anymore. Ids are still handed out in creation order so mnt_ns_loop()
keeps working. Mount and ipc namespaces already allocated their id right
after ns_common_init() anyway.
If creating the namespace fails after the id has been allocated the id
is simply never used.
Landlock logs the namespace id when it denies the use of a namespace.
For a denied namespace creation that used to be zero. Now it's the id
that was allocated for the new namespace. That namespace never becomes
visible to userspace but it's the same id that other LSMs see in
namespace_init. Update the Landlock documentation and selftests
accordingly. The selftests can't know the id of a namespace whose
creation was denied so they only check that it isn't zero.
While at it, drop ns_tree_gen_id() as it has no users left.
Reproducer, 100 user and uts namespaces:
bpftrace -e 'fentry:bpf_lsm_namespace_init {
@[args.ns->ns_id ? "set" : "zero"] = count(); }' &
for i in $(seq 100); do unshare -Uu true; done
before: @[zero]: 200
after: @[set]: 200
Fixes: f675d2e95569 ("lsm: add LSM blob and hooks for namespaces")
Cc: stable@kernel.org # mainline only
Link: https://patch.msgid.link/20261029-work-security-namespace_free-v2-4-65591dbba7b3@kernel.org
Reviewed-by: Mickaël Salaün <mic@digikod.net> # Landlock changes
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
|
|
Without ->try_steal(), nosteal_pipe_buf_ops and default_pipe_buf_ops are
the same: generic_pipe_buf_release() and generic_pipe_buf_get().
Keep default_pipe_buf_ops, and use it in skb_splice_bits() and
fuse_dev_splice_read(). Export it in place of nosteal_pipe_buf_ops,
since fuse can be built as a module.
Signed-off-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Link: https://patch.msgid.link/20261110145241.536019-5-kas@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
|
|
Nothing calls pipe_buf_try_steal() any more. Remove ->try_steal() from
struct pipe_buf_operations, its implementations and the exported
generic_pipe_buf_try_steal().
PIPE_BUF_FLAG_LRU and PIPE_BUF_FLAG_GIFT were set only for stealing, and
go too. page_cache_pipe_buf_release() did nothing but drop the page and
the LRU flag, so page cache and user page buffers use
generic_pipe_buf_release().
vmsplice() still accepts SPLICE_F_GIFT, and splice() SPLICE_F_MOVE.
Both were hints, and nothing acts on them now.
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Link: https://patch.msgid.link/20261110145241.536019-4-kas@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
|
|
When a mount goes away the reference to its mountpoint is dropped with
dput_to_list() and namespace_unlock() evicts the dentry after dropping
namespace_sem. Nothing pins the filesystem at that point so it can be
unmounted at the same time. That's fine as long as
shrink_dcache_for_umount() finds the dentry. It then either evicts it
itself or waits for the eviction to finish.
But it can't find a disconnected root as those are neither in the tree
nor on ->s_roots. And they can be mounted on:
fd = open_by_handle_at(mnt_fd, handle of a file with no dentry, O_PATH);
tree = open_tree(AT_FDCWD, "/tmp/x", OPEN_TREE_CLONE);
move_mount(tree, "", fd, "", MOVE_MOUNT_F_EMPTY_PATH |
MOVE_MOUNT_T_EMPTY_PATH);
close(fd);
thread A thread B
umount2("/proc/self/fd/<tree>", MNT_DETACH)
namespace_unlock()
up_write(&namespace_sem)
umount of the filesystem
shrink_dcache_for_umount()
evict_inodes()
"Busy inodes after unmount"
shrink_dentry_list()
dentry_kill()
iput() of an inode of a superblock that is gone
So put such a dentry on ->s_roots when it's put on the shrink list. From
then on it's a secondary root like any other.
This needs the previous patch. Otherwise do_one_tree() takes the dentry
off ->s_roots and umount doesn't wait for an eviction in progress.
The stable tag is narrower than the Fixes tag on purpose. Before commit
e9895609cb7f ("wind ->s_roots via ->d_sib instead of ->d_hash") umount
doesn't wait for a secondary root that is being evicted either.
Fixes: 4edbe133f851 ("make struct mountpoint bear the dentry reference to mountpoint, not struct mount")
Cc: stable@vger.kernel.org # v7.2+
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261030-work-dcache-ai-v1-3-cd6b86e0ccc7@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
|
|
The counters enforcing TC and IPsec packet offload mutual exclusion are
not consistently serialized. IPsec admission conditionally takes
mode_lock for writing, while TC admission holds it only for read.
Neither release path takes the lock, and devices without an eswitch
cannot rely on it at all.
These are per-core-device counters, separate from the eswitch mode and
encapsulation reservations protected by mode_lock. Move them into
mdev->offload_block and protect their checks, increments and decrements
with a dedicated spinlock that is available even without an eswitch.
A spinlock is used because some of these functions are called from
atomic context and is a good fit because the critical sections are and
will stay really short.
IPsec admission then no longer needs mode_lock to update these counters.
Add warnings for unbalanced releases. Keep mlx5_esw_lock() for eswitch
operation admission and temporary mode/encapsulation reservations.
This was found by upstream Sashiko during review of [1], and spun-off
into a fix from the larger patch.
[1]
https://lore.kernel.org/netdev/178907726586.219967.4695695146458742597@kernel.org/
Fixes: c8e350e62fc5 ("net/mlx5e: Make TC and IPsec offloads mutually exclusive on a netdev")
Signed-off-by: Cosmin Ratiu <cratiu@nvidia.com>
Reviewed-by: Jianbo Liu <jianbol@nvidia.com>
Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/20261105211637.1083978-9-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
Signed-off-by: Christian Brauner <brauner@kernel.org>
|
|
|
|
Signed-off-by: Christian Brauner <brauner@kernel.org>
|
|
|
|
Signed-off-by: Christian Brauner <brauner@kernel.org>
|
|
Signed-off-by: Christian Brauner <brauner@kernel.org>
|
|
Signed-off-by: Christian Brauner <brauner@kernel.org>
|
|
Introduce helpers that acquire a referenced struct path for a task's
executable, root, and working directory. Reuse them for procfs task
links and AppArmor executable-path handling instead of duplicating file
and path reference handling at each call site.
Signed-off-by: Chen Linxuan <me@black-desk.cn>
Link: https://patch.msgid.link/20261106-pidfd-get-paths-v5-1-3147ce6571cb@black-desk.cn
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
|
|
When a mount goes away the reference to its mountpoint is dropped with
dput_to_list() and namespace_unlock() evicts the dentry after dropping
namespace_sem. Nothing pins the filesystem at that point so it can be
unmounted at the same time. That's fine as long as
shrink_dcache_for_umount() finds the dentry. It then either evicts it
itself or waits for the eviction to finish.
But it can't find a disconnected root as those are neither in the tree
nor on ->s_roots. And they can be mounted on:
fd = open_by_handle_at(mnt_fd, handle of a file with no dentry, O_PATH);
tree = open_tree(AT_FDCWD, "/tmp/x", OPEN_TREE_CLONE);
move_mount(tree, "", fd, "", MOVE_MOUNT_F_EMPTY_PATH |
MOVE_MOUNT_T_EMPTY_PATH);
close(fd);
thread A thread B
umount2("/proc/self/fd/<tree>", MNT_DETACH)
namespace_unlock()
up_write(&namespace_sem)
umount of the filesystem
shrink_dcache_for_umount()
evict_inodes()
"Busy inodes after unmount"
shrink_dentry_list()
dentry_kill()
iput() of an inode of a superblock that is gone
So put such a dentry on ->s_roots when it's put on the shrink list. From
then on it's a secondary root like any other.
This needs the previous patch. Otherwise do_one_tree() takes the dentry
off ->s_roots and umount doesn't wait for an eviction in progress.
The stable tag is narrower than the Fixes tag on purpose. Before commit
e9895609cb7f ("wind ->s_roots via ->d_sib instead of ->d_hash") umount
doesn't wait for a secondary root that is being evicted either.
Fixes: 4edbe133f851 ("make struct mountpoint bear the dentry reference to mountpoint, not struct mount")
Cc: stable@vger.kernel.org # v7.2+
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261030-work-dcache-ai-v1-3-cd6b86e0ccc7@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
|
|
Linger pings are emitted every 5 seconds (by default) but currently
there can only ever be one linger ping in flight: send_linger_ping()
always tries to revoke and free the OSD request that corresponds to the
previous ping before allocating a fresh instance for the next ping.
Because these linger ping requests go through the same per-OSD queue as
regular OSD requests, this can cause some pings to not be delivered to
the OSD on time or be lost entirely in environments with high latency
or where low/moderate latency is coupled with huge spikes. That in
turn can cause the watch to time out on the OSD, exposing this client
instance to the risk of erroneous blocklisting in case another client
manages to proceed with breaking exclusive lock before the watch gets
reestablished.
Rework send_linger_ping() and related logic to allow for multiple
in-flight linger pings. In hindsight, this should have been done in
commit 75dbb685f4e8 ("libceph: fix potential use-after-free on linger
ping and resends").
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
|
|
Eliminate lreq->ping_sent by making more use of req->r_start_stamp.
This requires setting req->r_start_stamp outside of account_request()
but it only has one other caller apart from send_linger_ping().
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/mm/page_alloc
Pull page allocator fixes from Vlastimil Babka:
- Stable fixes for various races of page allocator's reading of
zonelists and memory hotplug activity. These can result in BUGs,
allocation failures or allocations from wrong nodes (Gregory Price,
Josef Bacik)
- Stable fixes for bugs free_pages_nolock(), page_frag allocation, page
isolation, that can trigger WARNs, degraded operation or infinite
loop (Josef Bacik)
* tag 'page_alloc-for-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/mm/page_alloc:
mm/page_alloc: remove the zone_spans_pfn() check from get_pfnblock_bitmap_bitidx()
mm/memory_hotplug: resize zones under their seqlock
mm: page_isolation: do not take slab pages for free
mm: page_frag: refill the cache for large fragments
mm/page_alloc: clear ->private of deferred free pages
mm/page_alloc: don't undo another isolation in alloc_contig_range
mm/mmzone: remove zonelist_node_idx()
mm/mempolicy: read the zoneref slot once in mempolicy_slab_node()
mm/page_alloc: retry alloc_contig_pages() when the zonelist is rebuilt
mm/hugetlb: retry the pool walk when the zonelist is rebuilt
mm/page_alloc: retry allocations that raced with a zonelist rebuild
mm/mmzone: read each zoneref slot once when filtering by nodemask
mm/page_alloc: snapshot the preferred zone against shrink rebuilds
mm/mmzone: read the zoneref slot once in zonelist_zone()
mm/page_alloc: detect zonelist rebuilds from memory hot-add
mm, page_alloc: pass zone pointer to trace_reclaim_retry_zone
mm/page_alloc: keep the pagesets of an empty zone
mm/page_alloc: reset can_retry_reserves when the slowpath restarts
|
|
Filesystems such as ext4 use buffer heads to cache shared metadata in
the bdev mapping. Charging these pages to individual memcgs can trigger
foreign writeback of the bdev inode's entire owner wb, including
unrelated file data.
Following the proposal in the linked discussion, set AS_KERNEL_FILE on
the bdev mapping while it is used by a filesystem, so newly allocated
cache pages are accounted to the root memcg. Empty the mapping before
changing the flag to keep folio insertion and removal accounting
consistent.
Multiple EROFS superblocks can share an extra data device. For example,
two metadata images on /dev/loop0 and /dev/loop1 can reference the same
data blob on /dev/loop2:
mount -t erofs -o ro,device=/dev/loop2 /dev/loop0 /mnt/a
mount -t erofs -o ro,device=/dev/loop2 /dev/loop1 /mnt/b
Unmounting /mnt/a must not clear AS_KERNEL_FILE on /dev/loop2 while
/mnt/b still uses it. Keep the flag set until the last filesystem user
releases the device.
bd_openers includes raw-device opens that may outlive filesystem
users, while bd_holders also counts partition claims on the whole
device. Neither counts filesystem users of this mapping, so add
bd_fs_users, protected by the bdev inode's i_rwsem.
Update this count in fs_bdev_register() and fs_bdev_unregister().
These hooks cover both device-open helpers and callers such as btrfs
that unregister a device and close it separately, without calling
fs_bdev_file_release().
Buffered access to the mounted raw device also charges new cache
pages to the root memcg. Such access is normally restricted to
privileged users. Pages cached in ordinary file mappings retain their
existing memcg accounting.
For filesystems that cache metadata in the bdev mapping, the benefit
is expected to be most pronounced when multiple cgroups perform
buffered overwrites alongside direct I/O on the same bandwidth-limited
device, such as an HDD. Frequent foreign writeback
reduces write coalescing, producing additional I/O that can saturate
the device. Direct I/O bypasses the page cache and competes with this
writeback traffic for device bandwidth.
An ext4 test combined repeated buffered overwrites of a 256 MiB file
with foreground direct writes, while four source memcgs generated
metadata and buffered writes. Device write bandwidth was capped at
200 MiB/s. In one baseline/patched pair, background file write I/O,
including final sync, fell from 6.178 GiB to 1.652 GiB (-73.3%).
Foreground bandwidth rose from 149.70 MiB/s to 184.19 MiB/s (+23.0%),
and completion time fell from 109.444 s to 88.951 s (-18.7%).
Christian Brauner <brauner@kernel.org> says:
On top of the conversion to a plain hashtable fs_bdev_register() holds
super_dev_lock until it returns. So move the claim into
__fs_bdev_register() and switch the accounting after it as
fs_bdev_set_kernel_file() sleeps.
Link: https://lore.kernel.org/cgroups/20260925064444.3944820-1-sunjunchao@bytedance.com/T/#m55ee048deb0aad4d1f2293978f25ee6904a5725a
Suggested-by: Christoph Hellwig <hch@lst.de>
Suggested-by: Jan Kara <jack@suse.cz>
Signed-off-by: Julian Sun <sunjunchao@bytedance.com>
Link: https://patch.msgid.link/20261008130747.2868338-1-sunjunchao@bytedance.com
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull vfs fixes from Christian Brauner:
- libfs: Make readdir on tmpfs walk the offset tree in offset order
instead of d_children to avoid skipping entries or relisting the
whole directory
It's faster too. Listing a million entries takes 114ms instead of
146ms, and 113ms instead of 470ms with four processes listing in
parallel
- iomap: Finish the ->iomap_next() conversion that started in v7.3
The nilfs2 and fuse ext_map iomap code added this merge window is
converted so now we can remove the ->iomap_begin()/->iomap_end()
fallback. We waited until the new iomap users from other trees were
in mainline otherwise this would have been very messy
- errseq: Retry with the current value when the cmpxchg() in
errseq_check_and_advance() fails to avoid an old value coming back
later hiding the errors
- aio: Hold an extra count for exit_aio() itself so it can't return
before the last free_ioctx_reqs() callback has called complete()
- pidfd: Fail the namespace ioctls with EREMOTE unless the target is
visible in the caller's pid namespace like PIDFD_GET_INFO does
- eventpoll: Wake the next waiter when a woken waiter returns early
because of a fatal signal to avoid sleeping forever
- backing-file: Pass RWF_NOAPPEND on to synchronous writes to the
backing file
- initrd: Flush the deferred fput() of the ramdisk file before mounting
root
- iov_iter: Take an unsigned long segment count in import_iovec()
The upper 32 bits of the count passed to readv(), writev() and
friends were dropped before the UIO_MAXIOV check
- splice: Advance the pipe tail before checking for a full bvec array
in splice_to_socket(). The last buffer was counted again, so MSG_MORE
was set although the pipe was empty and small TCP transfers waited
for the cork timeout
- vfs:
- Reject negative offsets for SEEK_DATA and SEEK_HOLE in
default_llseek() and use must_set_pos() for its whence handling
- Only clear tv_nsec in timestamp_truncate() when clamping changed
the seconds. Timestamps whose seconds were exactly at a
filesystem time limit lost their subsecond part
- Don't leak the kernel-internal STATX_ATTR_CHANGE_MONOTONIC in
stx_attributes_mask
- Clamp the FIONREAD result to the int range so a file with 4 GiB
left isn't reported as empty
- Fix the SEEK_CUR f_lock check
- selftests: Fix the statmount and mount_setattr tests on 32-bit and
s390, build the fchmodat2 and openat2 tests without sanitizers when
the toolchain lacks the runtimes and fix a clang warning in the
mount-notify test
- docs: Fix a docutils warning in porting.rst
* tag 'vfs-7.4-rc3.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (28 commits)
fs: fix the SEEK_CUR f_lock condition
splice, net: avoid MSG_MORE when the bvec array fills
aio: don't let exit_aio() return before complete() is done
fs: porting.rst: use literal string to avoid warning
selftests/fs/mount-notify: fix the indentation in the fsmount test
selftests: probe for sanitizer support in fchmodat2 and openat2
selftests/mount_setattr: build with a 64-bit off_t
selftests/statmount: fix format warnings on 32-bit and s390
fs: use must_set_pos() in default_llseek()
fs: reject negative offsets for SEEK_DATA and SEEK_HOLE in default_llseek()
pidfd: restrict task access ioctls to the caller's pid namespace
fs: clamp FIONREAD result to int range
eventpoll: wake the next waiter when a woken waiter is killed
statx: don't leak STATX_ATTR_CHANGE_MONOTONIC in stx_attributes_mask
vfs: preserve subsecond timestamps at filesystem time limits
iov_iter: take an unsigned long segment count in import_iovec()
lib/tests: errseq: add a concurrent check_and_advance test
errseq: don't let errseq_check_and_advance() hide later errors
backing-file: pass RWF_NOAPPEND to synchronous writes
initrd: flush deferred fput() before mounting root
...
|
|
kernfs doesn't need the kernfs_syscall_ops change. The parent's i_rwsem
is held across ->mkdir(), so once scops->mkdir() has returned the new
node can be looked up by name under kernfs_rwsem, which is what the
next ->lookup() would have done anyway. This leaves cgroup, resctrl and
the kernfs_syscall_ops API untouched.
While at it, drop the unused @lookup argument and the ->set() callback
from kernfs_get_inode_locked(). Setting i_ino before inode_insert5() is
enough.
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
|
|
and remove all my E-Mail address references from the wireless sources.
Signed-off-by: Michael Büsch <m@bues.ch>
Link: https://patch.msgid.link/20261101121325.7c334d78@barney
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
tcp_reqsk_record_syn() allocates saved_syn separately from its request
socket. bpf_sock_ops_get_syn() can load that pointer while processing a
retransmitted SYN under RCU.
There are two ownership transfers which can let another CPU reclaim the
allocation while such a reader is still using it.
First, tcp_move_syn() transfers req->saved_syn to a newly created child
socket. The child can be closed and tcp_saved_syn_free() can reclaim the
allocation before a reader of the old request finishes.
Second, inet_reqsk_clone() shallow-copies request_sock during request
migration. After reqsk_migrate_reset() clears the old request pointer, the
migrated clone owns it. However, a reader which already loaded the pointer
from the old request can still be using it when the clone is released.
I found this through LLM-assisted concurrency fuzzing.
Mark the request-socket saved_syn pointer as RCU protected and use RCU
accessors for its reads and updates. Keep the full-socket pointer plain
because all of its accesses hold the socket lock. Embed an rcu_head in
struct saved_syn and use kfree_rcu() in both teardown paths. This lets a
request-side reader which loaded the object before an ownership transfer
finish.
This follows commit e3f33b0a1d89 ("ipv4: free inet_opt and ireq_opt
after an RCU grace period"), which fixed the same ownership-transfer
pattern for IPv4 options.
The issue was confirmed with KASAN on v7.3-16007-g36aad21d50d1 using
temporary kernel instrumentation to widen the reader and request-migration
window. KASAN reported a slab-use-after-free read in
bpf_sock_ops_get_syn(), with the allocation freed by __reqsk_free() from
reqsk_timer_handler(). The same explicit migration test completed without
a report with deferred reclamation. A patched kernel without the delay
instrumentation also completed a successful migration and seven saved-SYN
reads without a KASAN report.
Fixes: 0813a841566f ("bpf: tcp: Allow bpf prog to write and parse TCP header option")
Fixes: c905dee62232 ("tcp: Migrate TCP_NEW_SYN_RECV requests at retransmitting SYN+ACKs.")
Cc: stable@vger.kernel.org
Signed-off-by: Yingjie Wang <x-professor@outlook.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Eric Dumazet <edumazet@kernel.org>
Link: https://patch.msgid.link/38fa9f2cc476502e9b1c1fef09ebba1df5dd5901.1793795528.git.x-professor@outlook.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd
Pull key fixes from Jarkko Sakkinen:
- Expand key->datalen and key->quotalen in order to avoid integer
truncation and the leak of quota.
- Enforce KEY_MAX_DESC_SIZE limits across in-kernel and
payload-generated paths.
- Verify the key identity in __key_unlink_begin() as type and
description could also refer to a more recently linked key with
matching properties as the one being unlinked.
- Fix key update race with key GC
* tag 'keys-v7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd:
KEYS: Protect the update method check against type removal
KEYS: Verify the key identity in __key_unlink_begin
KEYS: Reject descriptions larger than KEY_MAX_DESC_SIZE
KEYS: Expand key->{datalen,quotalen} to unsigned int
|
|
fscrypt_is_bounce_page() no longer has any callers, so remove it. This
removes a use of page->mapping.
Signed-off-by: Tal Zussman <tz2294@columbia.edu>
Link: https://patch.msgid.link/20261101-fscrypt-page-helpers-v1-2-bcfbfaf6a237@columbia.edu
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
|
|
fscrypt_pagecache_page() no longer has any callers, so remove it. This
removes a use of page_private().
Signed-off-by: Tal Zussman <tz2294@columbia.edu>
Link: https://patch.msgid.link/20261101-fscrypt-page-helpers-v1-1-bcfbfaf6a237@columbia.edu
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
|
|
When a socket is over its receive buffer limit and its sk_rcvbuf can
not grow, every incoming segment that needs memory goes through
tcp_prune_queue(), which runs tcp_collapse_ofo_queue() and tcp_collapse()
on the receive queue. Both walk their whole queue, even when there is
nothing left to collapse.
A peer can trigger this walk per packet, without refilling memory:
1) The segment lands last in the out-of-order queue. Since commit
b0e01253a764 ("tcp: refine tcp_prune_ofo_queue() logic"),
tcp_prune_ofo_queue() drops nothing, the segment is dropped and
the queues are unchanged. The peer can send it again forever.
2) The segment lands second to last: one skb is pruned, and one small
segment fills that space again.
3) The out-of-order queue is empty and the receive queue alone is over
the limit (application not reading). Collapsing frees nothing,
the out-of-order segment is dropped, and the window is not closed.
4) Collapsing frees just one skb, enough to queue the segment. The next
segment is over the limit again.
Only allow a collapse if at least 1/8 of sk_rcvbuf of new memory was
queued in the receive queues since the previous collapse. This restores
the "12.5 % of the queue capacity" amortization of the 2018 SegmentSmack
fixes (CVE-2018-5390), using the same unit as the sk_rcvbuf limit, so
that peers sending small (bloated) segments are not penalized.
The credit is the net growth of sk_rmem_alloc in tcp_queue_rcv() and
tcp_data_queue_ofo(), so that:
- Coalescing a segment into the tailroom of the previous skb charges no
memory, and earns no credit.
- An out-of-order segment replacing or covering queued skbs only earns
the memory it adds.
- Duplicates earn nothing.
- Data moved from the out-of-order queue to the receive queue
(tcp_ofo_queue()) is not credited twice.
In-order data is credited too, so that a receive queue filled by
bloated in-order segments can still be collapsed when a hole appears.
In-order segments are rate limited as well: a peer could otherwise send
small in-order segments that each trigger a collapse freeing a single
skb, enough to queue the segment, while the out-of-order queue holds
many skbs that can not be collapsed.
The credit is tracked in a new u32 tp->rcv_collapse_credit, placed in a
hole of the tcp_sock_write_rx group: no other field moves, and tcp_sock
size is unchanged. tcp_queue_rcv() now samples sk_rmem_alloc, and
writes the credit until it saturates at sk_rcvbuf, so that the fast path
stops writing it after a full buffer of new memory. Saturating at the
goal would not work: sk_rcvbuf, and the goal with it, can grow later
(for instance in tcp_clamp_window(), just before the goal is checked),
and a socket over its limit can not earn more credit until the
application reads.
When collapsing is not allowed, tcp_prune_queue() goes directly to
tcp_prune_ofo_queue(), which is cheap in the cases above.
A regular flow can see a difference when it goes over its limit before
1/8 of sk_rcvbuf of new memory was queued since the previous collapse:
out-of-order skbs can be pruned (even for an in-order segment filling a
hole), and an in-order segment that still does not fit is dropped,
with a zero window advertised, where a collapse might have made room.
Fixes: b0e01253a764 ("tcp: refine tcp_prune_ofo_queue() logic")
Reported-by: Chris Mason <mason@kernel.org>
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Neal Cardwell <ncardwell@google.com>
Link: https://patch.msgid.link/20261105124043.1543405-1-edumazet@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
Since commit cc6c40e09d7b ("NFSD/blocklayout: Support multiple extents
per LAYOUTGET"), nfsd4_block_proc_layoutget() calls ->map_blocks once
per extent of a LAYOUTGET, each time for the range left after the
previous extent. nfsd4_block_map_extent() takes a mapping that starts at
the offset asked for or below it, but only the first extent may start
below it. A later extent that starts below its offset overlaps the
extents before it, which RFC 5663 section 2.3.1 does not allow. The
Linux client rejects such a layout (verify_extent() returns -EIO), and
the I/O that needed it fails. The block and SCSI layouts share this
code.
XFS, the only ->map_blocks implementation, used to map the whole extent
that contains the offset. Together with one call per extent, that gave
overlapping layouts in v6.19 and v7.0: allocating the blocks for one
extent of a write layout could merge the extent that the next call
starts in with the unwritten extents before it. Since commit
36ca6f11424a ("xfs: fix overlapping extents returned for pNFS
LAYOUTGET"), XFS does not map below the offset, so this patch changes
nothing with current XFS. It only stops nfsd from relying on that: trim
each extent after the first so that it starts at the offset asked for,
and move its volume offset by the same amount unless it is a NONE_DATA
extent, which has none.
nfsd leaves the end of a mapping alone, as only the filesystem knows
where it should end. It does need a mapping that contains the offset
asked for, which RFC 5663 section 2.3.1 also requires of the first
extent. A mapping that does not would leave a gap in the layout or make
the length computed from it wrap around, so warn and return
NFS4ERR_LAYOUTUNAVAILABLE; the client then does the I/O through the
metadata server. iomap_iter_done() has the same check, as a
WARN_ON_ONCE(), for ->iomap_begin(), and nfsd4_block_map_extent()
already warns and fails this way for a mapping of an unexpected type.
Document in exportfs_block.h that the mapping must contain the offset.
On a test kernel whose xfs_fs_map_blocks() maps with XFS_BMAPI_ENTIRE
and does not trim, as XFS did before that commit, a write layout over a
hole between two unwritten blocks comes back as 0+4096, 4096+4096 and
0+12288, and the pynfs test BLOCK5 fails in five runs out of five.
fstests generic/075, 091 and 263 over the block layout fail with an EIO
or a zero-length O_DIRECT write, and bl_alloc_lseg() on the client
returns -EIO three times. With this patch on top, the third extent is
8192+4096, BLOCK5 passes in five runs out of five, generic/091 and 263
pass, generic/075 fails with the fsx "Size error" that it also fails
with on nfsd-testing, and bl_alloc_lseg() returns no error.
Fixes: cc6c40e09d7b ("NFSD/blocklayout: Support multiple extents per LAYOUTGET")
Cc: stable@vger.kernel.org
Suggested-by: Darrick J. Wong <djwong@kernel.org>
Link: https://lore.kernel.org/r/20261006051324.GV2705364@frogsfrogsfrogs
Link: https://lore.kernel.org/r/20261006152333.GO1615495@frogsfrogsfrogs
Signed-off-by: Daejun Park <daejun7.park@samsung.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
Link: https://patch.msgid.link/20261007-nfsd-block-trim-v1-1-53370f97047a@samsung.com
Signed-off-by: Chuck Lever <cel@kernel.org>
|
|
Commit 319951eba0fc ("SUNRPC: Remove ->xpo_secure_port()") moved the
setting of RQ_SECURE from svc_recv() into each transport's
->xpo_recvfrom(). But a deferred request is replayed through
svc_deferred_recv(), which bypasses ->xpo_recvfrom(), so RQ_SECURE is
no longer recomputed for it. The replaying thread instead carries
whatever RQ_SECURE value was left behind by the last request it
processed, and svc_defer() does not save the original value.
An AUTH_SYS request from a privileged port can therefore be deferred
on an ip_map or export cache upcall and then replayed by a thread
whose RQ_SECURE is clear (e.g. a newly created nfsd thread, whose
svc_rqst is zero-allocated). nfsd_setuser_and_check_port() then
rejects it with nfserr_perm on an export that lacks "insecure".
Conversely, a request from an unprivileged port can be replayed with
a stale RQ_SECURE set and pass that check.
Deferral is most likely right after an NFS server restart, when the
auth caches are empty and every client reconnects at once: if a pool
has no idle threads, cache_wait_req() waits only one second for the
upcall before deferring. This was observed as NFSv3 clients getting
EPERM shortly after a server reboot.
Save RQ_SECURE in struct svc_deferred_req when the request is first
deferred and restore it in svc_deferred_recv(). Restoring the saved
bit, rather than recomputing it from the peer address, keeps it
correct for transports such as RDMA that set RQ_SECURE
unconditionally.
Fixes: 319951eba0fc ("SUNRPC: Remove ->xpo_secure_port()")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Link: https://patch.msgid.link/20261002135027.72494-1-snitzer@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
|
|
svcauth_tls_accept() offers STARTTLS on every service whose
transport class has a handshake method. The NFSv4.0 callback
service listens on TCP, so an NFS server that sends CB_NULL with
AUTH_TLS gets a STARTTLS reply. The callback thread then blocks in
svc_tcp_handshake() for up to SVC_HANDSHAKE_TO, waiting for a
handshake the NFS client is not configured to complete. The
callback service runs a small thread pool shared by every NFSv4.0
server in the network namespace, so a malicious server can stall
callbacks from other servers by repeating the probe on each
reconnect. lockd has the same exposure. It runs a single thread on
every NFS client host to receive NLM_GRANTED callbacks and does not
support RPC-with-TLS.
Add a per-service flag that a service sets when it implements
RPC-with-TLS, and have svcauth_tls_accept() answer an AUTH_TLS
probe on any other service with a plain AUTH_NULL verifier, as
RFC 9289 Section 4.1 prescribes for a server that does not support
TLS. NFSD is the only service that sets the flag.
Fixes: 74aaf96feaca ("SUNRPC: Teach server to recognize RPC_AUTH_TLS")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260925151343.529200-1-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
|
|
nfsacl_encode() reports at least four wire entries for any ACL
that has entries, because a three-entry ACL is sent as four with a
synthesized ACL_MASK. The entry encoder then walks a_entries[] up
to that count.
A one- or two-entry ACL cannot arrive from setfacl, because
set_posix_acl() validates it first. It can arrive from an NFS
server. The NFS client caches a GETACL result without validating
it, and posix_acl_create() hands the cached default ACL to
nfs3_proc_setacls() when the client creates a directory. The walk
then reads past the end of the posix_acl allocation and copies the
bytes into the SETACL arguments.
Report zero wire entries for an ACL with fewer than three, the
same as for an ACL with none. Count them the same way in
nfsacl_size(), which otherwise sizes such an ACL at four entries
and leaves the reserved bytes unwritten in the SETACL arguments.
Fixes: a257cdd0e217 ("[PATCH] NFSD: Add server support for NFSv3 ACLs.")
Cc: stable@vger.kernel.org
Acked-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Link: https://patch.msgid.link/20260924212246.114355-2-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
|
|
When ib_post_send() rejects a WR mid-chain, svc_rdma_post_send_err()
returns zero and svc_rdma_post_chunk_ctxt() reports the Read chain
as posted. The only signaled WR in the chain is its tail, so a chain
cut before the tail posts nothing that completes.
svc_rdma_process_read_list() then reports the Read in progress, and
the receive context waits for svc_rdma_wc_read_done(), which never
runs. No list the transport destructor walks holds the context, so
it leaks past teardown along with its rw contexts and their DMA
mappings.
The caller cannot release the context on the error, because the
posted Read WRs still write into pages it owns. Nor can the error
path drain the Send Queue. The drain's marker WR needs an SQ slot,
and a provider that has just rejected a WR cannot be trusted to
have one.
Park the receive context on a per-transport list, as the Send path
does, and release it from svc_rdma_free() after the drain and before
the rw contexts are destroyed. svc_rdma_post_chunk_ctxt() posts only
Read chains, so pass it the receive context itself rather than the
embedded chunk context.
Reaching this path needs a provider to reject a WR after accepting
earlier ones in the same chain. That has not been observed.
Fixes: f13193f50b64 ("svcrdma: Introduce local rdma_rw API helpers")
Link: https://patch.msgid.link/20260922015128.240977-5-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
|
|
When ib_post_send() rejects a WR mid-chain, svc_rdma_post_send_err()
returns zero to say that a completion will clean up. The Write and
Reply chunk WRs in a reply's chain do carry completions, but those
only trace or close the transport. The Send at the chain's tail is
the one whose completion puts the send context, so a chain cut
before the Send leaves the context unreleased. svc_rdma_sendto()
reports success and never puts it either. No list the transport
destructor walks holds the context, so it leaks past teardown along
with the DMA mappings, page references, and rw contexts it owns.
The error path cannot release the context itself. The posted WRs
still reference its rw contexts and pages, and the HCA may still be
reading them. Nor can it drain the Send Queue to wait for them. A
drain needs a free SQ slot for its marker WR. A provider that
rejects a WR after accepting earlier ones has most likely diverged
from svcrdma's SQ accounting, so no slot svcrdma believes it holds
can be trusted.
Transfer the context to the transport instead. On a partial post,
svc_rdma_post_send() parks the context on a per-transport list and
reports success, the same ownership a fully posted chain has.
svc_rdma_free() releases the list after its own drain and before the
rw contexts are destroyed. The SQ reservation stays debited, since
the Send that refunds it never completes and the transport is
closing.
Reaching this path requires a provider to reject a WR after
accepting earlier ones in the same chain. That has not been
observed. The Fixes: tag names the commit that wrote the mistaken
contract. The chain became long enough to cut only with commit
10e6fc1054d9 ("svcrdma: Post the Reply chunk and Send WR together").
Fixes: 71b43531ee0b ("svcrdma: Post Send WR chain")
Link: https://patch.msgid.link/20260922015128.240977-4-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fixes from Ingo Molnar:
- Select the BHI mitigation based on the attack vector properly
(Breno Leitao)
- Fix i386-gcov build bug in csum_ipv6_magic() due to overly
strict asm constraints that cannot be met in that build mode
(Rosen Penev)
- Fix Vmware-guest i386 high-bandwidth hypercall arguments
under UNWINDER_GUESS & disabled frame-pointers (Zack Rusin)
- Fix resctrl AMD ABMC counter ID field width (Babu Moger)
- Fix restctrl pqos tool ABI breakage by reverting the
mbm_assign_mode to default mode at boot (Babu Moger)
- Initialize wall clock in get_rtc_noop() (Naman Jain)
- Fix ptrace historic ABI quirk regression (Thomas Gleixner)
- Add Drew Fustini as resctrl reviewer and Ben Horgan
as fs/resctrl reviewer
- Clear SEV RMPOPT when segmented RMP is disabled by firmware but
is advertised as available (Ashish Kalra)
- Set up SEV RMPOPT only on an active SNP host (Ashish Kalra)
- Don't emit KCFI_REFERENCE() in modules (Ridge Lomont)
- Ignore negative NMI handler durations (Breno Leitao)
- Fix off-by-one error in boot-time sme_clear_pgd() (Thorsten Blum)
- Fix ASID allocation bug (Chris Mason)
* tag 'x86-urgent-2026-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/mm: Fix global ASID handed out to two processes
x86/boot: Fix off-by-one error in sme_clear_pgd()
MAINTAINERS: Add Ben Horgan as fs/resctrl reviewer
x86/nmi: Ignore negative NMI handler durations
x86/kcfi: Don't emit KCFI_REFERENCE() in modules
x86/sev: Set up RMPOPT only on an active SNP host
x86/sev: Clear RMPOPT when segmented RMP is disabled by firmware
MAINTAINERS: resctrl: Add myself as reviewer
x86/entry: Fix ptrace regression
x86/init: Initialize wall clock in get_rtc_noop()
x86,fs/resctrl: Keep mbm_assign_mode in default mode at boot
x86/resctrl: Correct ABMC counter ID field width
x86/vmware: Fix i386 high-bandwidth hypercall arguments
x86/csum: Relax the len and proto constraints in 32-bit csum_ipv6_magic()
x86/bugs: Select the BHI mitigation based on the attack vector properly
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull scheduler fixes from Ingo Molnar:
- Fix this_bw on class change of a dying SCHED_DEADLINE task
(Nickolai Zeldovich)
- Account I/O waits independently of delayed dequeue
(Christian Loehle)
- Clear throttle state when leaving the fair class (Daehyeon Ko)
- Fix u32 truncation of the PELT period count (Hui Su)
- Fix imbalanced cluster static-key updates that can mistakenly
disable cluster-aware scheduling (Hui Su)
- Fix active load balancing logic to ignore non-fair current
in alb_break_llc() (Kayra Cizmeci)
* tag 'sched-urgent-2026-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
sched/cache: Ignore non-fair current in alb_break_llc()
sched/topology: Balance cluster static-key updates
sched/pelt: Fix u32 truncation of the PELT period count
sched/fair: Clear throttle state when leaving the fair class
sched/core: Account I/O waits independently of delayed dequeue
sched/deadline: Fix this_bw on class change of a dying task
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull perf events fixes from Ingo Molnar:
- Fix sideband event output when only requesting attr.defer_output
(Ian Rogers)
- Clamp deferred callchain entry count to fit u16 header.size
(Ian Rogers)
- Various AMD IBS fixes (Ravi Bangoria):
- Reset CPU0 IBS state on syscore resume
- Fix kernel address leak via REGS_USER and REGS_INTR
- Simplify/fix event state handling with IBS_CAPS_DIS
- Revert AUX page allocation order default to be continuous (Leo Yan)
- Don't send SIGTRAP after exec removed the event (Danish Khateeb)
* tag 'perf-urgent-2026-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
perf/core: Don't send SIGTRAP after exec removed the event
Revert "perf/aux: Allocate non-contiguous AUX pages by default"
perf/amd/ibs: Simplify event state handling with IBS_CAPS_DIS
perf/amd/ibs: Fix kernel address leak via REGS_USER and REGS_INTR
perf/amd/ibs: Reset CPU0 IBS state on syscore resume
perf/core: Clamp deferred callchain entry count to fit u16 header.size
perf/core: Include perf_event_attr::defer_output in is_sb_event() check
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator
Pull regulator fixes from Mark Brown:
"A small collection of mostly fairly standard driver specific fixes.
The mt6363 changes are a little large but are the result of two
independent users running into the same issues and testing each
other's changes so given that it's only -rc1 it seemed sensible to
take the changes as fixes"
* tag 'regulator-fix-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
regulator: mt6363: Fix VEMC voltage selection
regulator: mt6363: Use 8-bit register values
regulator: mt6363: Fix the registers of the VSRAM CPU and APU LDOs
regulator: qcom_spmi: don't take a sleeping lock in the SAW IPI
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux
Pull iommu fixes from Joerg Roedel:
"AMD IOMMU:
- Move PerfOpt management into the IOMMU domain attachment paths,
enabling it automatically for supported integrated GPUs in identity
mode and clearing it before switching to translated or blocked
domains
- Fix a boot panic in the GPU identity-mapping quirk when a GPU has
no upstream PCI bridge
- Clear the IOMMU SNP enable flag when RMP table initialization
fails, preventing subsequent initialization from assuming SNP setup
succeeded
- Check IVRS subtable types before parsing memory definitions,
avoiding bogus PCI segments caused by misinterpreting IVHD entries
under QEMU
- Remove an obsolete warning on device release that incorrectly fires
for devices required to remain attached to an identity domain"
* tag 'iommu-fixes-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux:
iommu/amd: Fix NULL pointer dereference for GPUs without upstream bridge
iommu/amd: remove obsolete domain pointer warning on release
iommu/amd: Skip non-IVMD entries when parsing IVRS memory definitions
iommu/amd: Clear amd_iommu_snp_en if snp_rmptable_init() fails
iommu/amd: Enable PerfOpt automatically for integrated GPUs
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull block fixes from Jens Axboe:
- NVMe fixes via Keith:
- nvme-tcp use-after-free in nvme_tcp_free_ctrl() on a failed
connect, and the nvme-rdma counterpart of the NULL queue->ctrl on
reconnect
- nvmet-rdma iWARP disconnect and device removal fixes
- nvmet-tcp: ask for the TLS record type on every receive, and bound
the connections accepted per work run so a connect flood can't
hold up port removal; nvmet-auth keep the old keys if the new ones
fail to decode; nvme-loop delete the controller if a reset fails
- nvmet-auth reject incomplete DHCHAP messages, and a keep-alive
timeout overflow
- nvmet locking and bounds fixes for tbkas reconnects and the
traddr/trsvcid configfs writes, don't leak stale memory in the ANA
log page, and cache the passthru reference across queue_response
- Wait for SRCU readers before splicing the namespace list, with a
new list_splice_init_srcu() helper, and drop an extra grace period
in nvmet_ns_disable()
- Unregister when pr_register() is given a zero new key, and don't
drop the cdev reference twice on cdev_device_add() failure
- Quirks for the ADATA XPG GAMMIX S70 BLADE and KIOXIA XG10d
- Various smaller fixes and cleanups
- blk-mq: end the request if getting a keyslot fails, which left the
in-flight count and zone write plug stuck, reset the queue state on
scheduler teardown so requests don't stall in software queues, and
fix an out-of-bounds read in blk_mq_free_rqs() after a failed
nr_hw_queues update
- Only serialize elevator switches of the same queue
- dma-buf bio fixes: don't use the bvec fast path for them, and only
fail the ones that need block layer PI
- Reject GPT entries with starting_lba > ending_lba
- Return the soft block size for compat BLKBSZGET, report the correct
discard alignment in sysfs, and account the flush sequence latency
only once in iocost
- virtio_blk fixes: synchronous quiesce in freeze, freeze the virtqueue
layout at probe time, clamp max_segments to the ring size, and fix
zone append sector reporting in batched completion
- null_blk zone fixes and a cache state reset
- zloop fixes
- ublk DEL_DEV_ASYNC permission check, and 32-bit selftest build
* tag 'block-7.4-20261106' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (52 commits)
nvmet: cache passthru reference in __nvmet_req_complete()
nvmet: drop the redundant auth check in nvmet_parse_io_cmd()
nvmet: bound the traddr and trsvcid configfs writes
nvmet: take subsys->lock when forcing reconnects for tbkas
nvme: wait for SRCU readers before splicing the namespace list
srcu: Add list_splice_init_srcu()
nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for KIOXIA XG10d
nvmet: don't return memory contents beyond valid data when reading ANA log page
nvme-pci: add NO_FUA quirk for ADATA XPG GAMMIX S70 BLADE
nvmet: drop the extra RCU grace period in nvmet_ns_disable()
nvme-keyring: Add a missing key_put() call to nvme_tls_key_lookup()
ublk: add missing DEL_DEV_ASYNC to unprivileged permission check
selftests: ublk: fix the build and file offsets on 32-bit
nvmet-rdma: disconnect a queue on device removal
nvmet-rdma: queue the release work under the mutex
nvmet-rdma: take a device off the list last
nvmet-tcp: limit the connections accepted per work run
nvmet-rdma: disconnect only established queues
nvmet-auth: keep the old keys if the new ones fail
nvmet-tcp: ask for the TLS record type on every receive
...
|
