| Age | Commit message (Collapse) | Author |
|---|
|
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Jakub Kicinski:
"Including fixes from netfilter, wireless and bluetooth.
Previous releases - regressions:
- tcp: rate limit receive queue collapsing
- raw: fix ICMP unreachable sent when receive queue is full
- eth: bnxt_en: take RTNL before netif_close() when aborting FW reset
Previous releases - always broken:
- tcp:
- bound snd_cwnd_clamp to TCP_MAX_SND_CWND
- number of fixes for TCP Fast Open
- gro:
- invalidate frag0 after a pull
- avoid parsing headers from shared fragments
- cipso: stop modifying live ip_options_rcu
- udp: do not use a cross-family sk_rx_dst in early demux
- fou: gue: check IP version of held packets for direct IP
encapsulation
- skbuff: preserve fclone lifetime when freeing stolen heads
- eth:
- mlx5e:
- fix crashes on queue stats access to queues without stats
- SHAMPO, disable end padding when relaxed ordering is
- ena: keep the RX buffer mapped if skb allocation fails"
* tag 'net-7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (227 commits)
selftests: net: add a test for NSH GSO
nsh: limit recursion in nsh_gso_segment()
selftests: tls: Cover the cap on consecutive empty records
selftests: tls: Extend coverage for zero-length records
selftests: tls: Skip the zero_len tests when TLS is unavailable
tls: Consume empty data records in tls_sw_splice_read()
tls: Break the connection after a burst of empty data records
net: phy: c45: select BASE-T1 type for the forced speed
net/mlx5e: Fix false WARN_ON_ONCE in flow steering cleanup on RX init failure
net/mlx5e: IPsec, don't match upper proto selectors in crypto offload TX
tcp: fix request_sock use-after-free during Fast Open accept()
net: usb: cdc_ncm: don't underflow the NDP room check
net: netns: fix INT_MAX nsid cleanup
amt: use ipv6_hdr() in amt_mldv1_leave_handler()
af_unix: Inherit SO_INQ in unix_stream_connect()
tcp: Pass req->rsk_listener to inet_csk_reqsk_queue_drop() in tcp_check_req().
mailmap: add entries for Hangbin Liu
net: virtio: validate outer protocol of UDP tunnel GSO packets
tun: clear stale skb->protocol of NAPI frags skbs
net: virtio: fix UDP tunnel GSO header of VLAN tagged packets
...
|
|
nsh_gso_segment() calls skb_mac_gso_segment() for the inner packet,
which calls nsh_gso_segment() again when the next protocol is NSH,
either directly or behind an inner Ethernet header (ETH_P_TEB).
Nothing limits the depth: a GSO packet made of stacked 8-byte NSH
headers recurses once per header, and a 64KB packet can hold about
8000 of them, overflowing the kernel stack.
Such a packet can be injected with a packet socket using
PACKET_VNET_HDR, or with tun/tap or virtio_net, as nothing checks
that a GSO packet with VIRTIO_NET_HDR_F_NEEDS_CSUM carries the
protocol it claims. It is then segmented in software if the output
device does not support the GSO type:
BUG: TASK stack guard page was hit at ffffcad5c0ab3ff8 (stack is ffffcad5c0ab4000..ffffcad5c0ab8000)
Oops: stack guard page: 0000 [#1] SMP NOPTI
CPU: 3 UID: 0 PID: 337 Comm: nsh_gso Tainted: G E 7.4.0-rc1+ #118 PREEMPT(lazy)
RIP: 0010:lock_acquire (kernel/locking/lockdep.c:5902)
Call Trace:
<TASK>
skb_mac_gso_segment (include/linux/rcupdate.h:309 include/linux/rcupdate.h:849 net/core/gso.c:50)
nsh_gso_segment (net/nsh/nsh.c:110) nsh
skb_mac_gso_segment (net/core/gso.c:53)
nsh_gso_segment (net/nsh/nsh.c:110) nsh
[...]
skb_mac_gso_segment (net/core/gso.c:53)
__skb_gso_segment (net/core/gso.c:129)
validate_xmit_skb (net/core/dev.c:4238)
__dev_queue_xmit (net/core/dev.c:5087)
packet_sendmsg (net/packet/af_packet.c:3157 net/packet/af_packet.c:3189)
__sys_sendto (net/socket.c:800 net/socket.c:818 net/socket.c:2283)
__x64_sys_sendto (net/socket.c:2290 net/socket.c:2286 net/socket.c:2286)
do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Use gso_recursion_inc_test(), added in commit 006c8b834aed ("net: gso:
limit recursive IP-in-IP segmentation"), with the same limit as IPv4
and IPv6. The counter is shared with them: a packet with four NSH
headers in front of an IPv4 header is still segmented, one more NSH
header and it is dropped.
The NSH -> ETH_P_TEB -> NSH route is covered as well, as each round
goes through nsh_gso_segment().
Fixes: c411ed854584 ("nsh: add GSO support")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/netdev/179443691180.2199510.148246238688217560@kernel.org/
Cc: Jiri Benc <jbenc@redhat.com>
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Reviewed-by: Jiri Benc <jbenc@redhat.com>
Link: https://patch.msgid.link/20261112102001.3744643-2-edumazet@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
TLS permits zero-length application_data records, and RFC 8446
suggests them for generating cover traffic. Nothing bounds how many of
them a reader processes back to back, though. They advance neither
loop bound in tls_sw_recvmsg() and tls_sw_read_sock(), so a peer
streaming them faster than the reader decrypts them keeps it in the
kernel for as long as they arrive. recvmsg() does not check for signals
while records are ready, and its peek and async paths queue every empty
record on rx_list. read_sock consumers like nvme-tcp hold the socket
lock throughout and never get control back.
Break the connection once a reader decrypts more than 128 consecutive
empty data records without sleeping or returning to its caller in
between, treating the burst as a protocol violation like a malformed
record header. A stream of empty records which the reader keeps up with
costs no more than any other traffic, so the count starts over on every
read and whenever the reader waits for the next record. The strparser
is stopped before it parses the next record, so the reader gets the
error from tls_rx_rec_wait() and no later record is delivered.
Returning to the caller and keeping the connection alive would need a
way to wake read_sock consumers which installed their own sk_data_ready
after the handshake, a lot of code for a peer that is either broken or
malicious.
Consume empty records in recvmsg() rather than queuing them on rx_list,
so that repeated MSG_PEEK cannot pile them up past the per-read count.
Decrypt them synchronously, too. Once a recvmsg() call has decrypted a
record asynchronously, recv_end replaces the error with the result of
process_rx_list(), so a call that saw only empty records returns 0, a
false EOF, instead of the error or -EAGAIN.
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260720-tcp-read-sock-v2-0-29545d034f3c@kernel.org?part=1
Closes: https://sashiko.dev/#/patchset/20260630191551.875664-1-cel@kernel.org?part=1
Link: https://lore.kernel.org/all/20261019-tls-follow-on-v6-0-ab01c4ecca0c@kernel.org/
Fixes: c46234ebb4d1 ("tls: RX path for ktls")
Fixes: 3be28e2c9cd0 ("net/tls: Consume empty data records in tls_sw_read_sock()")
Reviewed-by: Chuck Lever <cel@kernel.org>
Link: https://patch.msgid.link/20261111185522.2859004-2-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
Commit 25108a834e14 ("net: phy: c45: add support for 1000BASE-T1 forced
setup") made genphy_c45_pma_setup_forced() write the type selection
field (bits 3:0) of the BASE-T1 PMA/PMD control register (1.2100) on
every forced setup: 1000BASE-T1 for SPEED_1000, and 0 for everything
else. 0 selects 100BASE-T1, so forcing a 10BASE-T1L PHY to 10 Mbit/s
now also switches its PMA to 100BASE-T1, a mode it does not implement.
Seen on an ADIN1110 (internal ADIN1100 PHY): after
ethtool -s ethX autoneg off speed 10 master-slave forced-master
1.2100 reads 0xc000 instead of the 0xc002. Since the field is not
restored by re-enabling autoneg, the PHY keeps the wrong type until
the next forced setup or reset.
Add a helper that returns the type selection value for the forced speed
and the supported link modes: 100BASE-T1, 1000BASE-T1, and 10BASE-T1L or
10BASE-T1S for SPEED_10 depending on the supported 10 Mbit/s modes. Fail
with -EINVAL when no type matches instead of writing 100BASE-T1. This
also applies to forced 2.5G, 5G and 10G on BASE-T1 capable PHYs, for
which there are no link modes yet.
The field is called "type selection" in IEEE 802.3-2022 (45.2.1.214,
Table 45-178). Keep the old STRAP names as aliases.
Tested on EVAL-ADIN1110EBZ: with this change, forcing 10 Mbit/s writes
1.2100 = 0xc002 (10BASE-T1L) instead of the invalid 0xc000.
Fixes: 25108a834e14 ("net: phy: c45: add support for 1000BASE-T1 forced setup")
Signed-off-by: Iustin Stolniceanu <iustin.stolniceanu@analog.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/20261111100053.345196-1-iustin.stolniceanu@analog.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
virtio_net_hdr_tnl_to_skb() trusts the virtio header to describe a
UDP tunnel over IPv4 or IPv6, but never checks that the frame actually
carries such outer headers. Because VIRTIO_NET_HDR_F_NEEDS_CSUM is
mandatory for tunnel GSO, __virtio_net_hdr_to_skb() skips the flow
dissector, so virtio_net_hdr_match_proto() is never applied either.
A guest (or a tap writer) can then inject a frame with an arbitrary
outer ethertype, for example ETH_P_NSH, with SKB_GSO_UDP_TUNNEL set.
The GSO stack then runs nsh_gso_segment() on top of the UDP tunnel
segmentation, which assumes a different header layout. The result is
segments with skb->data before skb->head, and a host crash in
skb_under_panic() as soon as a later layer pushes a header:
skbuff: skb_under_panic: ... put:4 ... dev:gretap1
kernel BUG at net/core/skbuff.c:215!
skb_push
__gre_xmit
gre_tap_xmit
...
tun_get_user
Validate the outer headers with the parsing helpers from Michael's
series "net: resolve uncommon partial checksums at ingress":
- locate the L3 header: Ethernet with optional VLAN tags, or the
network header set by the caller. skb->protocol is not trusted when
it disagrees with the frame.
- require the outer L3 protocol to match the declared tunnel type.
- require the outer UDP header exactly at outer_th_offset, after IPv4
options or IPv6 extension headers, and reject fragments.
Unlike the original helpers:
- the callers tell whether the frame starts with an Ethernet header,
with a new has_eth argument of virtio_net_hdr_tnl_to_skb(), instead
of using the device type. tun frames packets from its IFF_TAP and
IFF_TUN flags, and TUNSETLINK can set the device type to any value.
virtio_net and tun_xdp_one() always pass true, tun_get_user() passes
whether the device is IFF_TAP.
- ipv6_find_hdr() stops at an AH header, as Willem suggested in the
review of that series.
Fixes: a2fb4bc4e2a6 ("net: implement virtio helpers to handle UDP GSO tunneling.")
Reported-by: Hassan Sultan <hassansultan@google.com>
Suggested-by: Willem de Bruijn <willemb@google.com>
Link: https://lore.kernel.org/netdev/93d0e37c99711bebdf60c120af03010455c2f2e2.1793276116.git.mst@redhat.com/
Co-developed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Link: https://patch.msgid.link/20261110213628.3476051-4-edumazet@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
virtio_net_hdr_tnl_from_skb() builds a wrong header for VLAN tagged UDP
tunnel GSO packets.
1) When the skb carries a hwaccel VLAN tag, tun_put_user() inserts the
802.1Q header in the frame it copies to user space or vhost-net, and
passes vlan_hlen = VLAN_HLEN. virtio_net_hdr_from_skb() adds
vlan_hlen to csum_start, but inner_nh_offset and outer_th_offset do
not account for it, and are 4 bytes short of the real inner L3 and
outer UDP headers in the emitted frame.
tun advertises NETIF_F_HW_VLAN_CTAG_TX and NETIF_F_HW_VLAN_STAG_TX
in hw_enc_features, and its vlan_features keep the UDP tunnel GSO
features, so this happens for example with a VLAN filtering bridge
with a tagged port, or with a vlan device on top of a tap.
2) The outer family comes from skb->protocol, which is ETH_P_8021Q or
ETH_P_8021AD when the VLAN tag is in the packet data, so a packet
with an outer IPv6 header is reported as
VIRTIO_NET_HDR_GSO_UDP_TUNNEL_IPV4. This happens when
__vlan_hwaccel_push_inside() inserted the tag because the device does
not offload it: virtio_net never offloads VLAN insertion but keeps
UDP tunnel GSO in its vlan_features, and tun does the same with VLAN
TX offload disabled, or with QinQ (outer tag offloaded, inner tag in
the data).
The receiver sets inner_network_header and transport_header from these
offsets, and checks them with the wrong outer family. A forwarded
packet that gets segmented again uses the wrong inner headers, and a
receiver checking the outer headers against the virtio header drops
the packet.
Add vlan_hlen to both offsets like csum_start, and take the outer
family from vlan_get_protocol(), which skips VLAN tags in the data.
Fixes: a2fb4bc4e2a6 ("net: implement virtio helpers to handle UDP GSO tunneling.")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/netdev/179421814766.994134.3669228181251158303@kernel.org/
Closes: https://lore.kernel.org/netdev/179433950084.994134.15100186606737698605@kernel.org/
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Link: https://patch.msgid.link/20261110213628.3476051-2-edumazet@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull ACPI fixes from Rafael Wysocki:
"These fix a mistake in the ACPI APEI GHES code causing recoverable
CPU, memory, CXL and vendor-specific errors reported through GHES to
never show up in a vmcore, address a potential deadlock related to
ACPI device hotplug that causes lockdep to complain and give up, and
fix up the recently added support for _Ixx GPEs:
- Make recoverable CPU, memory, CXL and vendor-specific errors
reported through GHES show up in vmcores by fixing a broken error
severity check in ghes_log_hwerr() (Breno Leitao)
- Avoid printing diagnostic messages for ACPI device objects after
dropping reference to them (Sasha Levin)
- Avoid holding the physical_node_lock for ACPI device objects across
device_offline() and device_online() due to a potential deadlock
that causes lockdep to complain and turn itself off (Sasha Levin)
- Avoid spurious system wakeups from suspend-to-idle on platforms
where an _Ixx GPE is shared by user-wakeup and background events
(Saranya Gopal)"
* tag 'acpi-7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
ACPI: s2idle: Handle shared _Ixx GPEs without an EC
ACPI: APEI: GHES: Fix severity check in ghes_log_hwerr()
ACPI: scan: Do not hold physical_node_lock across device_offline() and device_online()
ACPI: scan: Print the offline failure message in acpi_bus_offline()
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull power management fixes from Rafael Wysocki:
"These address a few issues in the cpufreq core and drivers, including
issues actually seen in the field, a few issues related to runtime PM,
including a false-positive warning introduced relatively recently and
a long-standing defect in the runtime PM core code related to
autosuspend, and revert a problematic recent update of the intel_rapl
power capping driver.
Specifics:
- Revert a recent update of the intel_rapl power capping driver that
caused perf to return bogus values (Dennis Chen)
- Fix the synchronization of boost state updates in cpufreq
(Christian Loehle)
- Fix issues related to system suspend-resume synchronization in the
cpufreq core and intel_pstate driver (Rafael Wysocki)
- Fix P-state index mismatch in extract_io() in the ACPI cpufreq
driver on systems with defective _PSS (Li RongQing)
- Fix issues related to target frequency caching in cpufreq (Rafael
Wysocki)
- Prevent a false-positive warning in pm_runtime_remove() introduced
by a previous fix during the 7.0 development cycle (Zhou Minqiang)
- Extend a recent improvement related to the handling of suppliers
during device runtime-suspend to some previously missed cases in
which it is relevant for consistency (Brian Norris)
- Update runtime PM documentation to reflect new behavior after
recent changes (Stanley Jhu)
- Add last_busy timestamp updates for devices requested to resume
from runtime suspend that are missing if those devices are not
actually suspended (Rafael Wysocki)"
* tag 'pm-7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
Revert "powercap: intel_rapl: Expose all package CPUs in PMU cpumask"
PM: runtime: Update last_busy in rpm_resume() for active devices
cpufreq: Fix updates of cached resolved frequency and index
cpufreq: Cache post-resolution target frequency in __resolve_freq()
cpufreq: acpi-cpufreq: fix P-state index mismatch in extract_io()
cpufreq: Serialize global boost updates
cpufreq: Preserve global boost state on failed updates
PM: runtime: Update runtime_pm.rst for non-fatal resume errors
PM: runtime: Only queue an idle check for RPM-linked suppliers (part 2)
PM: runtime: Fix check_flush_dependency warning from pm_runtime_remove
cpufreq: intel_pstate: Use rdmsrq_safe() to read MSR_MISC_PWR_MGMT
cpufreq: intel_pstate: Clear last written P-state value on suspend
cpufreq: Force passing target frequency to driver during resume
cpufreq: Improve suspend-resume synchronization
cpufreq: Hold the policy write lock when changing boost state
|
|
Merge core ACPI support code fixes and an ACPI APEI fix for 7.4-rc3:
- Avoid printing diagnostic messages for ACPI device objects after
dropping reference to them (Sasha Levin)
- Avoid holding the physical_node_lock for ACPI device objects across
device_offline() and device_online() due to a potential deadlock that
causes lockdep to complain and turn itself off (Sasha Levin)
- Make recoverable CPU, memory, CXL and vendor-specific errors reported
through GHES show up in vmcores by fixing a broken error severity
check in ghes_log_hwerr() (Breno Leitao)
* acpi-scan:
ACPI: scan: Do not hold physical_node_lock across device_offline() and device_online()
ACPI: scan: Print the offline failure message in acpi_bus_offline()
* acpi-apei:
ACPI: APEI: GHES: Fix severity check in ghes_log_hwerr()
|
|
Commit 3fcece12bc1b6 ("net: store port/representator id in
metadata_dst") dropped the options_len equality check when converting
skb_metadata_dst_cmp() to a type switch, so the memcmp length is taken
from skb a alone. When skb b carries fewer options than a, the
comparison reads past b's allocation.
Hit in practice with Cilium geneve GRO aggregation, comparing an skb
carrying 12 bytes of tunnel options against one carrying none:
memcmp: detected buffer overflow: 108 byte read of buffer size 96
WARNING: CPU: 0 PID: 15 at lib/string_helpers.c:1036 __fortify_report
__fortify_panic+0x9/0x10
skb_metadata_dst_cmp+0x11b/0x120
dev_gro_receive+0x303/0x620
gro_cell_poll+0x67/0xa0
Restore the check: unequal options_len means different metadata and no
aggregation; the memcmp only runs when both sides carry the same
options length.
Fixes: 3fcece12bc1b6 ("net: store port/representator id in metadata_dst")
Cc: stable@vger.kernel.org
Cc: Ilya Maximets <i.maximets@ovn.org>
Cc: Sasha Levin <sashal@kernel.org>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Simon Horman <horms@kernel.org>
Cc: Sridhar Samudrala <sridhar.samudrala@intel.com>
Cc: Kees Cook <kees@kernel.org>
Signed-off-by: Jean-Paul Sergent <jpsergent@gmail.com>
Link: https://patch.msgid.link/20261109082410.206140-1-jpsergent@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
|
Merge cpufreq fixes and fixes related to runtime PM for 7.4-rc3:
- Fix the synchronization of boost state updates in cpufreq (Christian
Loehle)
- Fix issues related to system suspend-resume synchronization in the
cpufreq core and intel_pstate driver (Rafael Wysocki)
- Fix P-state index mismatch in extract_io() in the ACPI cpufreq driver
on systems with defective _PSS (Li RongQing)
- Fix issues related to target frequency caching in cpufreq (Rafael
Wysocki)
- Prevent a false-positive warning in pm_runtime_remove() introduced
by a previous fix during the 7.0 development cycle (Zhou Minqiang)
- Extend a recent improvement related to the handling of suppliers
during device runtime-suspend to some previously missed cases in
which it is relevant for consistency (Brian Norris)
- Update runtime PM documentation to reflect new behavior after recent
changes (Stanley Jhu)
- Add last_busy timestamp updates for devices requested to resume from
runtime suspend that are missing if those devices are not actually
suspended (Rafael Wysocki)
* pm-cpufreq:
cpufreq: Fix updates of cached resolved frequency and index
cpufreq: Cache post-resolution target frequency in __resolve_freq()
cpufreq: acpi-cpufreq: fix P-state index mismatch in extract_io()
cpufreq: Serialize global boost updates
cpufreq: Preserve global boost state on failed updates
cpufreq: intel_pstate: Use rdmsrq_safe() to read MSR_MISC_PWR_MGMT
cpufreq: intel_pstate: Clear last written P-state value on suspend
cpufreq: Force passing target frequency to driver during resume
cpufreq: Improve suspend-resume synchronization
cpufreq: Hold the policy write lock when changing boost state
* pm-runtime:
PM: runtime: Update last_busy in rpm_resume() for active devices
PM: runtime: Update runtime_pm.rst for non-fatal resume errors
PM: runtime: Only queue an idle check for RPM-linked suppliers (part 2)
PM: runtime: Fix check_flush_dependency warning from pm_runtime_remove
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull more vfs fixes from Christian Brauner:
- inode: Let the shrinker reclaim inodes with I_METADATA_WRITEBACK like
any other clean inode and have evict() write out what the bit tracks
unless the inode is being deleted.
Since v7.3 ext2, ext4 without a journal, fat, udf and minix set
I_METADATA_WRITEBACK when they copy an inode into its buffer and only
fsync() and friends clear it again. inode_lru_isolate() took such
inodes off the LRU expecting something to put them back once the bit
was gone but nothing ever did. So they couldn't be reclaimed until
something fsynced them or the filesystem was unmounted.
On ext4 without a journal an atime update was enough to pin an inode,
and creating 60000 small files in a memory cgroup limited to 96M got
the task OOM killed after about 43000 of them. Now all 60000 get
created.
- dcache:
- Give d_set_mounted() a seqlock of its own that d_invalidate()
waits on after unhashing the dentry.
Since v6.17 d_set_mounted() doesn't bump the seqcount of
rename_lock anymore, so a mount racing d_invalidate() could end
up below the unhashed directory. Nobody can reach it there and it
pins the subtree until the mount namespace goes away. With a FUSE
directory 3000 levels deep 151 of 200 bind mounts racing
FUSE_NOTIFY_INVAL_ENTRY ended up there.
- Only take busy secondary roots off ->s_roots in do_one_tree() so
that umount waits for a racing eviction of an idle one. Since
v7.3 it didn't, which ended in busy inodes after unmount and an
iput() on a dead superblock.
- Make a disconnected dentry a secondary root when the mount on it
goes away so that umount finds it and waits for its eviction.
With CAP_DAC_READ_SEARCH such a dentry can be mounted on via
open_by_handle_at() and move_mount() and umount racing its
eviction ended the same way.
- splice:
- Remove pipe buffer stealing as you and David suggested.
fuse and virtio_console were the only users of ->try_steal() and
now always copy, as they already did when a steal failed.
Stealing took page cache folios out of their files and turned
pages into page cache folios and back. SPLICE_F_GIFT and
SPLICE_F_MOVE are still accepted and fuse still advertises
FUSE_SPLICE_MOVE so servers that ask for it mount as before.
- Clamp a ->write_iter() result that is larger than the iterator in
iter_file_splice_write() instead of only warning about it.
Otherwise the pipe releases buffers past its head.
- ns:
-Allocate the namespace id before calling the namespace_init LSM
hook that was added this merge window. Landlock now logs the
allocated id instead of zero when it denies the creation of a
namespace.
-Don't mark the arguments of the namespace_init and namespace_free
hooks as trusted for bpf LSM programs. Both see namespaces that
are only partially set up or on their way out.
- proc: Don't let proc_sys_call_handler() report more bytes written
than it was passed when a cgroup/sysctl bpf program replaced the
value with a longer one. A splice() into the sysctl file then walked
past the pipe head.
- coda: Pass the append state of each write on to the container file
with RWF_APPEND or RWF_NOAPPEND. coda_open() sets O_APPEND on the
container file after its iocb flags were cached, so an O_APPEND write
overwrote existing data instead of appending.
- adfs: Reject big directory entries in adfs_fplus_getnext() whose name
doesn't fit into the name buffer. A crafted image overflowed it on
the stack.
* tag 'vfs-7.4-rc3.fixes.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (28 commits)
nstree: drop ns_tree_add_raw()
ns: allocate the namespace id before the namespace_init hook
bpf: don't mark namespace_init and namespace_free arguments as trusted
splice: replace nosteal_pipe_buf_ops with default_pipe_buf_ops
splice: remove pipe buffer stealing
fuse: don't move pipe buffers into the page cache
virtio_console: copy pipe buffers in splice_write()
fs/adfs: bound directory entry name length in adfs_fplus_getnext()
dcache: let umount find a disconnected ex-mountpoint
dcache: wait for a racing eviction of a secondary root
dcache: let d_invalidate() wait for a d_set_mounted() in flight
fat: drop mmb_sync() from fat_evict_inode()
udf: drop mmb_sync() from udf_evict_inode()
minix: drop mmb_sync() from minix_evict_inode()
ext4: drop mmb_sync() from ext4_evict_inode()
ext2: drop mmb_sync() from ext2_evict_inode()
fs: don't strand I_METADATA_WRITEBACK inodes outside the LRU
fs: set I_METADATA_WRITEBACK in mmb_mark_buffer_dirty()
udf: don't allocate the inode block in udf_sync_inode_metadata()
minix: don't read the inode block in minix_sync_inode_metadata()
...
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless
Johannes Berg says:
====================
Various fixes all over, notably:
- mm81x: fix frequency reporting of 2 MHz or wider channels
- rtw88: fix stuck queue for AP on SDIO
- ath12k:
- fix split MSDU decap
- fix reconnect of MLO stations
- fix stuck TX due to lack of MCS 15 support
- mac80211: use-after-free on certain TTLM/update combinations
- nxpwifi: FW response/notification validation
- (and a subset of usual "LLM saw a bug" things)
* tag 'wireless-2026-11-11' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: (40 commits)
wifi: mac80211: fix unlocked STA statistics fallback
wifi: cfg80211: don't truncate the merged MBSSID profile length
wifi: nl80211: fix ERR_PTR use on wdev disappearance
wifi: mac80211: fix use-after-free on TTLM disconnect
wireless: Remove me as ssb maintainer
wifi: mac80211: bound pending OCB station allocations
wifi: mac80211: recheck the OCB station limit before insertion
wifi: mac80211: bound pending IBSS station allocations
wifi: mac80211: recheck the IBSS station limit before insertion
wifi: mac80211: reject invalid EHT guard intervals in airtime estimates
wifi: cfg80211: preserve mesh A-MSDU lengths when adding mesh headers
wifi: mac80211: restore dormant links when link updates fail
wifi: mac80211: recheck injected headers after removing FCS
wifi: mac80211_hwsim: ignore non-generic netlink releases
wifi: cfg80211: release rejected nontransmitted BSS reference
wifi: mac80211: drain link readers before stopping removed links
wifi: mac80211: find STA for beacons belonging to non-TX BSS
wifi: mac80211: do not switch to invalid link
wifi: mac80211: fix use-after-free when MLO link setup is rolled back
wifi: mac80211: abort chanswitch when leaving an IBSS
...
====================
Link: https://patch.msgid.link/20261111133442.225455-8-johannes@sipsolutions.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
When TFO is enabled, tcp_v[46]_connect() sets sk->sk_state to
TCP_SYN_SENT and puts the socket into ehash without calling
tcp_connect().
Then, tcp_fastopen_defer_connect() sets DEFER_CONNECT, and
the first write()/sendmsg() will call tcp_connect() and send
SYN with data if possible.
If tcp_abort() kills a socket before the first write()/sendmsg(),
the unhashed socket can still call it and send SYN in TCP_CLOSE.
Also, DEFER_CONNECT is cleared after __inet_stream_connect().
So, blocking write()/sendmsg() can release lock_sock() in
inet_wait_for_connect() while DEFER_CONNECT is set, and
tcp_poll() could set EPOLLOUT even after SYN is sent.
Let's clear DEFER_CONNECT in tcp_abort() and right before
tcp_connect() in tcp_sendmsg_fastopen().
Note that the last argument of __inet_stream_connect() is
changed from is_sendmsg to defer_connect as DEFER_CONNECT
is already cleared when __inet_stream_connect() is called.
This change is also needed for the next patch.
Fixes: 19f6d3f3c842 ("net/tcp-fastopen: Add new API support")
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Acked-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20261107235720.3129212-2-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
Now that ns_tree_add() doesn't allocate an id anymore it does the same
thing as ns_tree_add_raw(). Switch the remaining ns_tree_add_raw() users
over to ns_tree_add() and drop it. Rename __ns_tree_add_raw() to
__ns_tree_add() while at it.
No functional changes.
Fixes: f675d2e95569 ("lsm: add LSM blob and hooks for namespaces")
Cc: stable@kernel.org # mainline only
Link: https://patch.msgid.link/20261029-work-security-namespace_free-v2-5-65591dbba7b3@kernel.org
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
|
|
Currently the namespace id is allocated only after __ns_common_init()
has called the namespace_init LSM hook. Most namespace types allocate it
in ns_tree_add() right before the namespace is added to the namespace
trees. So the namespace_init hook always sees an id of zero.
The namespace id is the only identifier of a namespace that is never
recycled. A bpf LSM wants to use it to track a namespace from
namespace_init until namespace_free, e.g., by using it as the key into a
map that associates data with the namespace. The inode number doesn't
work for that as it is quickly recycled.
So allocate the id in __ns_common_init() before calling the
namespace_init hook. Every namespace then has its id by the time it is
added to the namespace trees. The initial namespaces still get their
fixed ids, either statically from NS_COMMON_INIT() or for init_net from
ns_common_init(). So ns_tree_add() doesn't need to allocate an id
anymore. Ids are still handed out in creation order so mnt_ns_loop()
keeps working. Mount and ipc namespaces already allocated their id right
after ns_common_init() anyway.
If creating the namespace fails after the id has been allocated the id
is simply never used.
Landlock logs the namespace id when it denies the use of a namespace.
For a denied namespace creation that used to be zero. Now it's the id
that was allocated for the new namespace. That namespace never becomes
visible to userspace but it's the same id that other LSMs see in
namespace_init. Update the Landlock documentation and selftests
accordingly. The selftests can't know the id of a namespace whose
creation was denied so they only check that it isn't zero.
While at it, drop ns_tree_gen_id() as it has no users left.
Reproducer, 100 user and uts namespaces:
bpftrace -e 'fentry:bpf_lsm_namespace_init {
@[args.ns->ns_id ? "set" : "zero"] = count(); }' &
for i in $(seq 100); do unshare -Uu true; done
before: @[zero]: 200
after: @[set]: 200
Fixes: f675d2e95569 ("lsm: add LSM blob and hooks for namespaces")
Cc: stable@kernel.org # mainline only
Link: https://patch.msgid.link/20261029-work-security-namespace_free-v2-4-65591dbba7b3@kernel.org
Reviewed-by: Mickaël Salaün <mic@digikod.net> # Landlock changes
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
|
|
Without ->try_steal(), nosteal_pipe_buf_ops and default_pipe_buf_ops are
the same: generic_pipe_buf_release() and generic_pipe_buf_get().
Keep default_pipe_buf_ops, and use it in skb_splice_bits() and
fuse_dev_splice_read(). Export it in place of nosteal_pipe_buf_ops,
since fuse can be built as a module.
Signed-off-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Link: https://patch.msgid.link/20261110145241.536019-5-kas@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
|
|
Nothing calls pipe_buf_try_steal() any more. Remove ->try_steal() from
struct pipe_buf_operations, its implementations and the exported
generic_pipe_buf_try_steal().
PIPE_BUF_FLAG_LRU and PIPE_BUF_FLAG_GIFT were set only for stealing, and
go too. page_cache_pipe_buf_release() did nothing but drop the page and
the LRU flag, so page cache and user page buffers use
generic_pipe_buf_release().
vmsplice() still accepts SPLICE_F_GIFT, and splice() SPLICE_F_MOVE.
Both were hints, and nothing acts on them now.
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Link: https://patch.msgid.link/20261110145241.536019-4-kas@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
|
|
When a mount goes away the reference to its mountpoint is dropped with
dput_to_list() and namespace_unlock() evicts the dentry after dropping
namespace_sem. Nothing pins the filesystem at that point so it can be
unmounted at the same time. That's fine as long as
shrink_dcache_for_umount() finds the dentry. It then either evicts it
itself or waits for the eviction to finish.
But it can't find a disconnected root as those are neither in the tree
nor on ->s_roots. And they can be mounted on:
fd = open_by_handle_at(mnt_fd, handle of a file with no dentry, O_PATH);
tree = open_tree(AT_FDCWD, "/tmp/x", OPEN_TREE_CLONE);
move_mount(tree, "", fd, "", MOVE_MOUNT_F_EMPTY_PATH |
MOVE_MOUNT_T_EMPTY_PATH);
close(fd);
thread A thread B
umount2("/proc/self/fd/<tree>", MNT_DETACH)
namespace_unlock()
up_write(&namespace_sem)
umount of the filesystem
shrink_dcache_for_umount()
evict_inodes()
"Busy inodes after unmount"
shrink_dentry_list()
dentry_kill()
iput() of an inode of a superblock that is gone
So put such a dentry on ->s_roots when it's put on the shrink list. From
then on it's a secondary root like any other.
This needs the previous patch. Otherwise do_one_tree() takes the dentry
off ->s_roots and umount doesn't wait for an eviction in progress.
The stable tag is narrower than the Fixes tag on purpose. Before commit
e9895609cb7f ("wind ->s_roots via ->d_sib instead of ->d_hash") umount
doesn't wait for a secondary root that is being evicted either.
Fixes: 4edbe133f851 ("make struct mountpoint bear the dentry reference to mountpoint, not struct mount")
Cc: stable@vger.kernel.org # v7.2+
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261030-work-dcache-ai-v1-3-cd6b86e0ccc7@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth
Luiz Augusto von Dentz says:
====================
bluetooth pull request for net:
Core:
- hci_conn: Fix SCO/eSCO Transport_Unit_Size for HCI data path
- L2CAP: Only accept LE responses to outstanding requests
- L2CAP: Clear request identifiers on incoming LE connections
- L2CAP: Keep recvmsg from resuming a closed channel
- Fix not updating of hdev->commands[] after reset
- reject invalid LE supervision timeout relationships
Drivers:
- btusb: fix use-after-free in force_poll_sync
- hci_qca: fix use-after-free in ibs debugfs files
- qca: Disable SoC debug logging for WCN3950
* tag 'for-net-2026-11-09' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:
Bluetooth: L2CAP: Keep recvmsg from resuming a closed channel
Bluetooth: reject invalid LE supervision timeout relationships
Bluetooth: btusb: fix use-after-free in force_poll_sync
Bluetooth: hci_qca: fix use-after-free in ibs debugfs files
Bluetooth: Fix not updating of hdev->commands[] after reset
Bluetooth: qca: Disable SoC debug logging for WCN3950
Bluetooth: L2CAP: Clear request identifiers on incoming LE connections
Bluetooth: L2CAP: Only accept LE responses to outstanding requests
Bluetooth: hci_conn: Fix SCO/eSCO Transport_Unit_Size for HCI data path
====================
Link: https://patch.msgid.link/20261110024313.2023223-1-luiz.dentz@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
cipso_v4_delopt() operates on the ip_options_rcu of a socket or a request
socket, and tries to remove CIPSO options from the middle by moving all
subsequent options.
That's not allowed - ip_options_rcu can be read locklessly and must always
be consistent. For example, ip_options_undo() reads trusted offsets and
length values from the options buffer.
Fix it by doing the modification in a copy.
The core change is in cipso_v4_delopt(), the rest is ugly plumbing to
propagate memory allocation failures.
Triggering this bug requires that the system is configured to use CIPSO.
(Setting up CIPSO requires privileges in init_user_ns.)
Fixes: f6d8bd051c39 ("inet: add RCU protection to inet->opt")
Cc: stable@vger.kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
Reviewed-by: Eric Dumazet <edumazet@kernel.org>
Acked-by: Paul Moore <paul@paul-moore.com>
Link: https://patch.msgid.link/20261106-cipso-rcuopts-v1-1-31ae931d7a0f@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
tcp_inbound_hash() parses both TCP-MD5 and TCP-AO options when at
least one of the two features is enabled. With TCP_MD5SIG=y and
TCP_AO=n, a packet carrying an AO option reaches the disabled
tcp_inbound_ao_hash() stub. That stub returns success, so sockets
configured to require MD5 authentication end up accepting
unauthenticated data. A forged AO option skips the unsigned fast
path, which is the only place where tcp_inbound_hash() can return
SKB_DROP_REASON_TCP_MD5NOTFOUND.
The inverse configuration with TCP_MD5SIG=n and TCP_AO=y has the same
problem for an MD5 option on AO sockets.
Note that TCP-AO depends on 64BIT: therefore, every 32-bit kernel with
TCP_MD5SIG=y is in the vulnerable configuration.
Make the disabled stubs reject options for the unsupported
authentication scheme. This matches the real helpers' behavior for
sockets without keys. It also means that kernels with TCP_MD5SIG=n and
TCP_AO=y now drop segments carrying an MD5 option on unkeyed sockets,
as kernels configured with TCP_MD5SIG=y already do.
Fixes: 0a3a809089eb ("net/tcp: Verify inbound TCP-AO signed segments")
Cc: stable@vger.kernel.org
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Acked-by: Dmitry Safonov <dima@arista.com>
Link: https://patch.msgid.link/20261107224733.1104094-2-Jeremy.Jean@oss.cyber.gouv.fr
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
The counters enforcing TC and IPsec packet offload mutual exclusion are
not consistently serialized. IPsec admission conditionally takes
mode_lock for writing, while TC admission holds it only for read.
Neither release path takes the lock, and devices without an eswitch
cannot rely on it at all.
These are per-core-device counters, separate from the eswitch mode and
encapsulation reservations protected by mode_lock. Move them into
mdev->offload_block and protect their checks, increments and decrements
with a dedicated spinlock that is available even without an eswitch.
A spinlock is used because some of these functions are called from
atomic context and is a good fit because the critical sections are and
will stay really short.
IPsec admission then no longer needs mode_lock to update these counters.
Add warnings for unbalanced releases. Keep mlx5_esw_lock() for eswitch
operation admission and temporary mode/encapsulation reservations.
This was found by upstream Sashiko during review of [1], and spun-off
into a fix from the larger patch.
[1]
https://lore.kernel.org/netdev/178907726586.219967.4695695146458742597@kernel.org/
Fixes: c8e350e62fc5 ("net/mlx5e: Make TC and IPsec offloads mutually exclusive on a netdev")
Signed-off-by: Cosmin Ratiu <cratiu@nvidia.com>
Reviewed-by: Jianbo Liu <jianbol@nvidia.com>
Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/20261105211637.1083978-9-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
mana_pre_alloc_rxbufs() fills the RX rings with plain pages from
dev_alloc_pages() (from_pool == false), but the rxq is registered with
MEM_TYPE_PAGE_POOL and mana_run_xdp() builds every xdp_buff with that
rxq info. mana_rx_skb() frees a !from_pool buffer correctly on
XDP_PASS, XDP_TX and XDP_DROP, but a redirected buffer is freed through
its memory model: __xdp_return() hands the plain page to
page_pool_put_full_netmem(). This triggers the WARN in
include/net/page_pool/helpers.h, breaks the page refcount, RX refills
fail and the queue stops receiving.
The pre-allocated buffers fill the whole ring of every rxq created by
an MTU change, by ethtool -L / -G and, since
commit 730ff06d3f5c ("net: mana: Use page pool fragments for RX buffers
instead of full pages to improve memory efficiency."), by every XDP
attach and detach. So on current kernels the first ring of redirected
packets after attaching an XDP program always hits this.
Reproduced on 7.2.11, and on 6.12.113 after ethtool -L, on an Azure
MANA VF: an XDP program that redirects UDP to an XSKMAP with an AF_XDP
socket in copy mode gives WARNINGs at __xdp_return+0x249 (stack
__xsk_map_redirect, xdp_do_redirect, mana_run_xdp, mana_poll), then
the queue stops.
Give each rxq a second xdp_rxq_info registered with
MEM_TYPE_PAGE_SHARED, the model these buffers had before the page pool
was added, and use it for buffers that are not from the pool. Those
buffers are already DMA-unmapped by mana_refill_rx_oob() before XDP
runs, and page_frag_free() frees them whatever their order. Allocating
the pre-allocated buffers from the page pool instead would need the
pools to exist before the rxqs and to outlive them, a much larger
change.
Found, fixed and tested with an AI coding assistant (Claude Code).
Fixes: b1d13f7a3b53 ("net: mana: Add page pool for RX buffers")
Signed-off-by: Orgad Shaneh <orgads@gmail.com>
Link: https://patch.msgid.link/20261102064324.806414-1-orgads@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/mm/page_alloc
Pull page allocator fixes from Vlastimil Babka:
- Stable fixes for various races of page allocator's reading of
zonelists and memory hotplug activity. These can result in BUGs,
allocation failures or allocations from wrong nodes (Gregory Price,
Josef Bacik)
- Stable fixes for bugs free_pages_nolock(), page_frag allocation, page
isolation, that can trigger WARNs, degraded operation or infinite
loop (Josef Bacik)
* tag 'page_alloc-for-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/mm/page_alloc:
mm/page_alloc: remove the zone_spans_pfn() check from get_pfnblock_bitmap_bitidx()
mm/memory_hotplug: resize zones under their seqlock
mm: page_isolation: do not take slab pages for free
mm: page_frag: refill the cache for large fragments
mm/page_alloc: clear ->private of deferred free pages
mm/page_alloc: don't undo another isolation in alloc_contig_range
mm/mmzone: remove zonelist_node_idx()
mm/mempolicy: read the zoneref slot once in mempolicy_slab_node()
mm/page_alloc: retry alloc_contig_pages() when the zonelist is rebuilt
mm/hugetlb: retry the pool walk when the zonelist is rebuilt
mm/page_alloc: retry allocations that raced with a zonelist rebuild
mm/mmzone: read each zoneref slot once when filtering by nodemask
mm/page_alloc: snapshot the preferred zone against shrink rebuilds
mm/mmzone: read the zoneref slot once in zonelist_zone()
mm/page_alloc: detect zonelist rebuilds from memory hot-add
mm, page_alloc: pass zone pointer to trace_reclaim_retry_zone
mm/page_alloc: keep the pagesets of an empty zone
mm/page_alloc: reset can_retry_reserves when the slowpath restarts
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull vfs fixes from Christian Brauner:
- libfs: Make readdir on tmpfs walk the offset tree in offset order
instead of d_children to avoid skipping entries or relisting the
whole directory
It's faster too. Listing a million entries takes 114ms instead of
146ms, and 113ms instead of 470ms with four processes listing in
parallel
- iomap: Finish the ->iomap_next() conversion that started in v7.3
The nilfs2 and fuse ext_map iomap code added this merge window is
converted so now we can remove the ->iomap_begin()/->iomap_end()
fallback. We waited until the new iomap users from other trees were
in mainline otherwise this would have been very messy
- errseq: Retry with the current value when the cmpxchg() in
errseq_check_and_advance() fails to avoid an old value coming back
later hiding the errors
- aio: Hold an extra count for exit_aio() itself so it can't return
before the last free_ioctx_reqs() callback has called complete()
- pidfd: Fail the namespace ioctls with EREMOTE unless the target is
visible in the caller's pid namespace like PIDFD_GET_INFO does
- eventpoll: Wake the next waiter when a woken waiter returns early
because of a fatal signal to avoid sleeping forever
- backing-file: Pass RWF_NOAPPEND on to synchronous writes to the
backing file
- initrd: Flush the deferred fput() of the ramdisk file before mounting
root
- iov_iter: Take an unsigned long segment count in import_iovec()
The upper 32 bits of the count passed to readv(), writev() and
friends were dropped before the UIO_MAXIOV check
- splice: Advance the pipe tail before checking for a full bvec array
in splice_to_socket(). The last buffer was counted again, so MSG_MORE
was set although the pipe was empty and small TCP transfers waited
for the cork timeout
- vfs:
- Reject negative offsets for SEEK_DATA and SEEK_HOLE in
default_llseek() and use must_set_pos() for its whence handling
- Only clear tv_nsec in timestamp_truncate() when clamping changed
the seconds. Timestamps whose seconds were exactly at a
filesystem time limit lost their subsecond part
- Don't leak the kernel-internal STATX_ATTR_CHANGE_MONOTONIC in
stx_attributes_mask
- Clamp the FIONREAD result to the int range so a file with 4 GiB
left isn't reported as empty
- Fix the SEEK_CUR f_lock check
- selftests: Fix the statmount and mount_setattr tests on 32-bit and
s390, build the fchmodat2 and openat2 tests without sanitizers when
the toolchain lacks the runtimes and fix a clang warning in the
mount-notify test
- docs: Fix a docutils warning in porting.rst
* tag 'vfs-7.4-rc3.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (28 commits)
fs: fix the SEEK_CUR f_lock condition
splice, net: avoid MSG_MORE when the bvec array fills
aio: don't let exit_aio() return before complete() is done
fs: porting.rst: use literal string to avoid warning
selftests/fs/mount-notify: fix the indentation in the fsmount test
selftests: probe for sanitizer support in fchmodat2 and openat2
selftests/mount_setattr: build with a 64-bit off_t
selftests/statmount: fix format warnings on 32-bit and s390
fs: use must_set_pos() in default_llseek()
fs: reject negative offsets for SEEK_DATA and SEEK_HOLE in default_llseek()
pidfd: restrict task access ioctls to the caller's pid namespace
fs: clamp FIONREAD result to int range
eventpoll: wake the next waiter when a woken waiter is killed
statx: don't leak STATX_ATTR_CHANGE_MONOTONIC in stx_attributes_mask
vfs: preserve subsecond timestamps at filesystem time limits
iov_iter: take an unsigned long segment count in import_iovec()
lib/tests: errseq: add a concurrent check_and_advance test
errseq: don't let errseq_check_and_advance() hide later errors
backing-file: pass RWF_NOAPPEND to synchronous writes
initrd: flush deferred fput() before mounting root
...
|
|
and remove all my E-Mail address references from the wireless sources.
Signed-off-by: Michael Büsch <m@bues.ch>
Link: https://patch.msgid.link/20261101121325.7c334d78@barney
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
Set the link_id in the SKB status to the invalid value of 0xf when the
link ID is not valid. Also update the test in ieee80211_rx_handlers to
correctly check this case. This avoids switching to an invalid link
during RX of a single frame (when updating the link is not needed).
It also means that the SKB link_id now has a more reasonable value as it
is possible to differentiate the non-valid case from the case where the
value is set to 0.
Add back the appropriate checks before trying to use the link_id for
access to arrays. These were removed in commit 4db13371e217 ("wifi:
mac80211: refactor RX link_id and station handling").
Finally, this also fixes the link_sta lookup to use the correct link ID,
rather than an old value from rx->link_id.
Fixes: 2d03b83ef762 ("wifi: mac80211: fix non-MLD link ID handling")
Fixes: 4db13371e217 ("wifi: mac80211: refactor RX link_id and station handling")
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Link: https://patch.msgid.link/20261027144558.7d7ed492e70a.Iaa63d80b6f13f871d1ee3cf1ce27118f72850ac0@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
An skb can retain dst_pending_confirm after its original output and
socket owner have changed. For example, a raw MSG_CONFIRM packet can
cross veth, have a TCP request socket assigned by TPROXY, and be bridged
into gretap. Neighbor output for the outer packet then calls
sock_confirm_neigh() with the request socket in skb->sk.
The helper unconditionally treats a non-NULL skb->sk as a full socket
when accessing sk_dst_pending_confirm. TCP request and TIME_WAIT sockets
do not contain that field. This produces an out-of-bounds four-byte read
and, if the word is nonzero, an out-of-bounds four-byte zero write. A
KASAN-enabled kernel reports:
BUG: KASAN: slab-out-of-bounds in ip_finish_output2+0xc9f/0xd60
Read of size 4 at addr ffff8880bdc3d880 by task tproxy_dst_conf/1771
Require sk_fullsock() before accessing the socket field, moving the
existing helper earlier in the header to make it available here. Keep
neigh_confirm() independent of the socket type so the skb's neighbor
confirmation still works, including for socketless packets. This also
covers the IPv6, VRF, and BPF neighbor-output callers.
Fixes: 4ff0620354f2 ("net: add dst_pending_confirm flag to skbuff")
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20261104132900.1071940-1-edumazet@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
SO_CNX_ADVICE calls __dst_negative_advice() while holding the socket
lock. Connected UDP sends can still invalidate or replace sk_dst_cache
without that lock. A concurrent sk_dst_check() can drop the final
destination reference and allow an RCU callback to destroy it while
__dst_negative_advice() retains only a borrowed pointer. This can cause
a use-after-free while accessing dst->ops or running the negative_advice
callback.
The writer-side ordering fixed by commit 92f1655aa2b2 ("net: fix
__dst_negative_advice() race") does not protect this reader from an
independent cache replacement.
Hold an RCU read-side critical section across the lookup and callback.
This follows the datagram release callbacks and covers IPv4, IPv6, and
XFRM advice without changing cache-reset or reference-ownership rules.
Fixes: a87cb3e48ee8 ("net: Facility to report route quality of connected sockets")
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20261104131744.1056562-1-edumazet@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
A device can be unregistered by a context other than the cleanup_net()
of its own netns, for instance a veth whose peer in another netns is
deleted. If references on it are still held, it stays in
netdev_wait_allrefs_any(), which rebroadcasts NETDEV_UNREGISTER every
second.
Meanwhile its netns can be dismantled: default_device_exit_batch()
only takes care of devices still listed in the netns, then pernet exit
handlers free their state, and finally struct net is freed while the
device still points to it.
The rebroadcasts then run notifiers against torn down pernet state, or
freed memory. Three instances were reported so far:
- netdev_genl_netdevice_event(): net->genl_sock is NULL [1]
- nh_netdev_event(): net->nexthop.devhash is NULL [2]
- nf_tables netdevice notifiers: use-after-free of the nftables
pernet storage [3]
but any notifier using dev_net(dev) is affected, as is
netdev_wait_allrefs_any() itself (__rtnl_net_lock(dev_net(dev)) with
CONFIG_DEBUG_NET_SMALL_RTNL=y).
This was prevented by rtnl_lock_unregistering() until I removed it
in commit 8a4fc54b07d7 ("net: get rid of rtnl_lock_unregistering()"),
considering only the loopback dependency, and missing the notifiers one.
Restore a per-netns counter of devices sitting in netdev_run_todo(),
and make default_device_exit_batch() wait for it to reach zero, after
it has unregistered all devices of the dying netns(es). At this point
no new unregistration can be started for these netns.
Unlike the old barrier, this only waits for devices of the netns being
dismantled and runs after their own devices are gone.
Tested on a KASAN kernel with a debug-only hack holding a reference
on a veth device for 5 seconds after its unregistration: a nexthop
on the veth in netns X, delete its peer from init_net, then delete X.
Without this patch, the nexthop_flush_dev() null-ptr-deref from [2]
triggers. With it, no splat; netns churn and dismantle of a netns
whose own device is held still work.
[1] https://lore.kernel.org/netdev/6adf9f64.6200f071.51519.0ed1.GAE@google.com/
[2] https://lore.kernel.org/netdev/20261105114707.3030737-1-bsdhenrymartin@gmail.com/
[3] https://lore.kernel.org/netdev/20261105114817.3033625-1-bsdhenrymartin@gmail.com/
Fixes: 8a4fc54b07d7 ("net: get rid of rtnl_lock_unregistering()")
Cc: stable@vger.kernel.org
Reported-by: syzbot+1269fe6cc2016008124e@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6adf9f64.6200f071.51519.0ed1.GAE@google.com/
Reported-by: Henry Martin <bsdhenrymartin@gmail.com>
Closes: https://lore.kernel.org/netdev/20261105114707.3030737-1-bsdhenrymartin@gmail.com/
Closes: https://lore.kernel.org/netdev/20261105114817.3033625-1-bsdhenrymartin@gmail.com/
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Reviewed-by: Naman Gulati <namangulati@google.com>
Link: https://patch.msgid.link/20261105144543.1624238-1-edumazet@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
tcp_reqsk_record_syn() allocates saved_syn separately from its request
socket. bpf_sock_ops_get_syn() can load that pointer while processing a
retransmitted SYN under RCU.
There are two ownership transfers which can let another CPU reclaim the
allocation while such a reader is still using it.
First, tcp_move_syn() transfers req->saved_syn to a newly created child
socket. The child can be closed and tcp_saved_syn_free() can reclaim the
allocation before a reader of the old request finishes.
Second, inet_reqsk_clone() shallow-copies request_sock during request
migration. After reqsk_migrate_reset() clears the old request pointer, the
migrated clone owns it. However, a reader which already loaded the pointer
from the old request can still be using it when the clone is released.
I found this through LLM-assisted concurrency fuzzing.
Mark the request-socket saved_syn pointer as RCU protected and use RCU
accessors for its reads and updates. Keep the full-socket pointer plain
because all of its accesses hold the socket lock. Embed an rcu_head in
struct saved_syn and use kfree_rcu() in both teardown paths. This lets a
request-side reader which loaded the object before an ownership transfer
finish.
This follows commit e3f33b0a1d89 ("ipv4: free inet_opt and ireq_opt
after an RCU grace period"), which fixed the same ownership-transfer
pattern for IPv4 options.
The issue was confirmed with KASAN on v7.3-16007-g36aad21d50d1 using
temporary kernel instrumentation to widen the reader and request-migration
window. KASAN reported a slab-use-after-free read in
bpf_sock_ops_get_syn(), with the allocation freed by __reqsk_free() from
reqsk_timer_handler(). The same explicit migration test completed without
a report with deferred reclamation. A patched kernel without the delay
instrumentation also completed a successful migration and seven saved-SYN
reads without a KASAN report.
Fixes: 0813a841566f ("bpf: tcp: Allow bpf prog to write and parse TCP header option")
Fixes: c905dee62232 ("tcp: Migrate TCP_NEW_SYN_RECV requests at retransmitting SYN+ACKs.")
Cc: stable@vger.kernel.org
Signed-off-by: Yingjie Wang <x-professor@outlook.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Eric Dumazet <edumazet@kernel.org>
Link: https://patch.msgid.link/38fa9f2cc476502e9b1c1fef09ebba1df5dd5901.1793795528.git.x-professor@outlook.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
Since commit bd56a29c7a4e ("net: gro: change skb_gro_network_header()"),
skb_gro_header_slow() no longer invalidates NAPI_GRO_CB(skb)->frag0
after pskb_may_pull(). skb_gro_may_pull() keeps comparing against the
frag0_len value set in skb_gro_reset_offset(), assuming that after a
slow pull, all later accesses are beyond frag0_len.
This is not true:
- udp4_gro_receive() and udp6_gro_receive() read the network header
with skb_gro_network_header() after udp_gro_udphdr() pulled the
UDP header.
- vxlan_gro_receive() calls skb_gro_remcsum_cleanup() at a lower
offset after the inner handlers pulled their headers.
- skb_gro_remcsum_process() can pull beyond the inner Ethernet header
before eth_gro_receive() reads it.
- napi_frags_skb() calls __skb_pull(skb, ETH_HLEN) after a slow pull,
so frag0 still points to the Ethernet header.
If the pull consumed the first page fragment, __skb_pull_tail() released
it. If the head had to grow, pskb_expand_head() freed the old one.
These reads, and the 2-byte write in skb_gro_remcsum_cleanup(), then
access memory the skb no longer holds a reference on.
esp4_gro_receive(), esp6_gro_receive(), skb_gro_receive_list() and
udp_gro_receive_segment() also pull directly and never invalidated
frag0.
Add skb_gro_frag0_invalidate(), which only clears frag0_len, and call
it before each of these pulls. This is a single store in the slow path,
and frag0 stays non NULL, so skb_gro_network_header() does not need
a NULL test.
frag0 must be invalidated even if the pull fails: __pskb_pull_tail()
can return NULL after pskb_expand_head() freed the old head, for
instance if a frag_list member has to be cloned or pulled.
As frag0 is now invalidated before a pull that can fail,
gro_try_pull_from_frag0() can see an skb whose linear part does not
cover skb_gro_offset() while frag0 still points to the start of the
packet, for instance after skb_gro_remcsum_cleanup() pulled a shorter
length. Copying from frag0 would then corrupt the headers: only use
frag0 while frag0_len is not zero, and use pskb_may_pull() otherwise.
If this pull fails, for instance after a failed pskb_pull() in
esp4_gro_receive(), do not hold the packet: later GRO lookups and
gro_complete() handlers expect its headers in the linear part.
This was found by Taesoo Kim and Cen Zhang, using LLM assisted code
analysis, and confirmed with reproducers.
Fixes: bd56a29c7a4e ("net: gro: change skb_gro_network_header()")
Fixes: 9fd1ff5d2ac7 ("udp: Support UDP fraglist GRO/GSO.")
Cc: stable@vger.kernel.org
Reported-by: Taesoo Kim <tsgatesv@gmail.com>
Reported-by: Cen Zhang <cenzhang@linux.microsoft.com>
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Link: https://patch.msgid.link/20261104151042.1157782-3-edumazet@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
skb_gro_flush_final_remcsum() calls skb_gro_remcsum_cleanup() to undo
the checksum adjustment done by skb_gro_remcsum_process() when the
packet was not consumed by GRO.
When the inner handler merged the packet (NAPI_GRO_CB(skb)->same_flow
is set), grc->offset can no longer be trusted:
- skb_gro_receive() either gives the frags or the head of the skb
to the held packet, or uses __skb_pull(skb, offset) before adding
the skb to the frag_list of the held packet.
- skb_gro_receive_list() uses skb_pull(skb, skb_gro_offset(skb)).
grc->offset is relative to the original skb->data, so the 2-byte
read-modify-write done by skb_gro_remcsum_cleanup() can land in
the payload of a packet which now belongs to the GRO packet.
pskb_may_pull() can also be called on this frag_list member.
With fraglist GRO, this can also be a use-after-free:
pskb_may_pull(skb, skb_gro_offset(skb)) in skb_gro_receive_list()
or udp_gro_receive_segment() releases the first page fragment if it
only contains headers. NAPI_GRO_CB(skb)->frag0 and frag0_len are not
updated, so skb_gro_remcsum_cleanup() takes the fast path and writes
through frag0 into a page the skb no longer holds a reference on.
The non merged case, where frag0 is used after this pull, is handled
in the following patch.
For skbs merged by skb_gro_receive(), the cleanup can be skipped:
the skb is freed, or its headers are rebuilt from the head skb in
skb_segment().
Fraglist members keep their own inner headers, as skb_segment_list()
only copies the link-layer and tunnel headers from the head skb.
Their checksum can not be right in all cases: a packet forwarded with
its tunnel header needs the original value, while a VXLAN packet
decapsulated locally needs the adjusted one, as vxlan_remcsum() only
adjusts the head skb. Make skb_gro_receive_list() refuse packets with
skb->remcsum_offload set, so that fraglist members never carry an
adjusted checksum.
This affects VXLAN (VXLAN_F_REMCSUM_NOPARTIAL) and GUE
(FOU_F_REMCSUM_NOPARTIAL).
This was found while fixing a report from Taesoo Kim and Cen Zhang,
who used LLM assisted code analysis and provided reproducers.
Fixes: 26c4f7da3e41 ("net: Fix remcsum in GRO path to not change packet")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Link: https://patch.msgid.link/20261104151042.1157782-2-edumazet@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd
Pull key fixes from Jarkko Sakkinen:
- Expand key->datalen and key->quotalen in order to avoid integer
truncation and the leak of quota.
- Enforce KEY_MAX_DESC_SIZE limits across in-kernel and
payload-generated paths.
- Verify the key identity in __key_unlink_begin() as type and
description could also refer to a more recently linked key with
matching properties as the one being unlinked.
- Fix key update race with key GC
* tag 'keys-v7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd:
KEYS: Protect the update method check against type removal
KEYS: Verify the key identity in __key_unlink_begin
KEYS: Reject descriptions larger than KEY_MAX_DESC_SIZE
KEYS: Expand key->{datalen,quotalen} to unsigned int
|
|
xp_alloc() and xsk_buff_set_size() reset xdp_buff::flags of every
buffer they hand out. In aligned mode, duplicate fill ring addresses
map to the same xskb, so the head of a frame still being gathered can
be handed out again and lose XDP_FLAGS_HAS_FRAGS. xsk_buff_add_frag()
rejects the duplicate and the frame is dropped, but xsk_buff_free()
leaves its frags on pool->xskb_list, where they are taken as frags of
the next frame.
Keep XDP_FLAGS_HAS_FRAGS on hand-out and clear it when the frags are
released, in xsk_buff_free() and xsk_rcv_zc(). The driver XDP_TX paths,
bpf_xdp_adjust_tail() and bpf_xdp_pull_data() already clear it, and
pool->heads starts zeroed. Other flags are still reset on hand-out, as
nothing clears them on release.
Since xsk_rcv_zc() now clears the flag, i40e must count Rx bytes before
running the XDP program, like ice and libeth.
Fixes: f7f6aa8e2438 ("xsk: make xsk_buff_pool responsible for clearing xdp_buff::flags")
Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Reviewed-by: Björn Töpel <bjorn@kernel.org>
Link: https://patch.msgid.link/20261102124950.958345-7-maciej.fijalkowski@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
libeth_xsk_tx_queue_bulk() takes the frags of a multi-buffer frame off
pool->xskb_list but leaves XDP_FLAGS_HAS_FRAGS set on the head. When
the head completes, libeth_xsk_buff_free_slow() frees whatever is on
the list at that point.
The XDPSQ can be completed by a bulk flush while the frags of a frame
are being queued, or by its cleanup timer while a partial Rx frame is
stashed. Those frags are then freed while in use, and the frame being
queued is sent truncated.
Clear the flag on the head once all of its frags are queued.
Fixes: b3ad8450b4dc ("libeth: xsk: add XSk XDP_TX sending helpers")
Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Reviewed-by: Björn Töpel <bjorn@kernel.org>
Link: https://patch.msgid.link/20261102124950.958345-6-maciej.fijalkowski@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
In aligned mode, a fill ring address maps straight to its pool->heads[]
entry. If user space posts the same address twice, a driver can pass
xsk_buff_add_frag() a buffer that is the head of the frame or is
already on pool->xskb_list or pool->free_list.
Re-adding a linked node corrupts the list. With buffers A, B, C, B,
xsk_rcv_zc() emits two descriptors instead of four and leaves the list
head pointing at a self-linked B. When the Rx ring later has no room
for a frame, the xsk_buff_free() cleanup follows B into pool->free_list
and passes the list head to xp_free():
BUG: kernel NULL pointer dereference, address: 00000000000000c0
RIP: 0010:xp_free+0x1a/0x50
Call Trace:
xsk_rcv_zc+0xca/0x200
The head is not on any list and needs a separate check. Adding it as
its own frag lets bpf_xdp_adjust_tail() free the in-use head and wrap
sinfo->nr_frags to 255.
Reject such buffers before adding them to the frags array, as commit
e37b2abca804 ("xsk: fix NULL pointer dereference in __xsk_rcv()") does
in the copy path. Callers already drop the frame on failure.
Unaligned mode is not affected, as each fill ring entry gets its own
xskb from pool->free_heads[].
Reproduced with a KUnit test feeding synthetic buffers to xsk_rcv_zc(),
by Nagato Shiratana.
Fixes: 24ea50127ecf ("xsk: support mbuf on ZC RX")
Reported-by: Nagato Shiratana <zuomao338@gmail.com>
Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Reviewed-by: Björn Töpel <bjorn@kernel.org>
Link: https://patch.msgid.link/20261102124950.958345-2-maciej.fijalkowski@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
When a socket is over its receive buffer limit and its sk_rcvbuf can
not grow, every incoming segment that needs memory goes through
tcp_prune_queue(), which runs tcp_collapse_ofo_queue() and tcp_collapse()
on the receive queue. Both walk their whole queue, even when there is
nothing left to collapse.
A peer can trigger this walk per packet, without refilling memory:
1) The segment lands last in the out-of-order queue. Since commit
b0e01253a764 ("tcp: refine tcp_prune_ofo_queue() logic"),
tcp_prune_ofo_queue() drops nothing, the segment is dropped and
the queues are unchanged. The peer can send it again forever.
2) The segment lands second to last: one skb is pruned, and one small
segment fills that space again.
3) The out-of-order queue is empty and the receive queue alone is over
the limit (application not reading). Collapsing frees nothing,
the out-of-order segment is dropped, and the window is not closed.
4) Collapsing frees just one skb, enough to queue the segment. The next
segment is over the limit again.
Only allow a collapse if at least 1/8 of sk_rcvbuf of new memory was
queued in the receive queues since the previous collapse. This restores
the "12.5 % of the queue capacity" amortization of the 2018 SegmentSmack
fixes (CVE-2018-5390), using the same unit as the sk_rcvbuf limit, so
that peers sending small (bloated) segments are not penalized.
The credit is the net growth of sk_rmem_alloc in tcp_queue_rcv() and
tcp_data_queue_ofo(), so that:
- Coalescing a segment into the tailroom of the previous skb charges no
memory, and earns no credit.
- An out-of-order segment replacing or covering queued skbs only earns
the memory it adds.
- Duplicates earn nothing.
- Data moved from the out-of-order queue to the receive queue
(tcp_ofo_queue()) is not credited twice.
In-order data is credited too, so that a receive queue filled by
bloated in-order segments can still be collapsed when a hole appears.
In-order segments are rate limited as well: a peer could otherwise send
small in-order segments that each trigger a collapse freeing a single
skb, enough to queue the segment, while the out-of-order queue holds
many skbs that can not be collapsed.
The credit is tracked in a new u32 tp->rcv_collapse_credit, placed in a
hole of the tcp_sock_write_rx group: no other field moves, and tcp_sock
size is unchanged. tcp_queue_rcv() now samples sk_rmem_alloc, and
writes the credit until it saturates at sk_rcvbuf, so that the fast path
stops writing it after a full buffer of new memory. Saturating at the
goal would not work: sk_rcvbuf, and the goal with it, can grow later
(for instance in tcp_clamp_window(), just before the goal is checked),
and a socket over its limit can not earn more credit until the
application reads.
When collapsing is not allowed, tcp_prune_queue() goes directly to
tcp_prune_ofo_queue(), which is cheap in the cases above.
A regular flow can see a difference when it goes over its limit before
1/8 of sk_rcvbuf of new memory was queued since the previous collapse:
out-of-order skbs can be pruned (even for an in-order segment filling a
hole), and an in-order segment that still does not fit is dropped,
with a zero window advertised, where a collapse might have made room.
Fixes: b0e01253a764 ("tcp: refine tcp_prune_ofo_queue() logic")
Reported-by: Chris Mason <mason@kernel.org>
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Neal Cardwell <ncardwell@google.com>
Link: https://patch.msgid.link/20261105124043.1543405-1-edumazet@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
Pull devm_kmalloc_obj conversion from Kees Cook:
- treewide refresh of kmalloc_obj() conversions
- devm_kmalloc_obj conversion rules added to Coccinelle scripting
- treewide conversion of devm_kmalloc() family to devm_kmalloc_obj()
* tag 'devm_kmalloc_obj-v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
treewide: Convert devm_kmalloc() family to the devm_kmalloc_obj() family
coccinelle: kmalloc_obj: Include devm_kmalloc_obj conversion rules
treewide: refresh kmalloc_obj() conversions
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fixes from Ingo Molnar:
- Select the BHI mitigation based on the attack vector properly
(Breno Leitao)
- Fix i386-gcov build bug in csum_ipv6_magic() due to overly
strict asm constraints that cannot be met in that build mode
(Rosen Penev)
- Fix Vmware-guest i386 high-bandwidth hypercall arguments
under UNWINDER_GUESS & disabled frame-pointers (Zack Rusin)
- Fix resctrl AMD ABMC counter ID field width (Babu Moger)
- Fix restctrl pqos tool ABI breakage by reverting the
mbm_assign_mode to default mode at boot (Babu Moger)
- Initialize wall clock in get_rtc_noop() (Naman Jain)
- Fix ptrace historic ABI quirk regression (Thomas Gleixner)
- Add Drew Fustini as resctrl reviewer and Ben Horgan
as fs/resctrl reviewer
- Clear SEV RMPOPT when segmented RMP is disabled by firmware but
is advertised as available (Ashish Kalra)
- Set up SEV RMPOPT only on an active SNP host (Ashish Kalra)
- Don't emit KCFI_REFERENCE() in modules (Ridge Lomont)
- Ignore negative NMI handler durations (Breno Leitao)
- Fix off-by-one error in boot-time sme_clear_pgd() (Thorsten Blum)
- Fix ASID allocation bug (Chris Mason)
* tag 'x86-urgent-2026-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/mm: Fix global ASID handed out to two processes
x86/boot: Fix off-by-one error in sme_clear_pgd()
MAINTAINERS: Add Ben Horgan as fs/resctrl reviewer
x86/nmi: Ignore negative NMI handler durations
x86/kcfi: Don't emit KCFI_REFERENCE() in modules
x86/sev: Set up RMPOPT only on an active SNP host
x86/sev: Clear RMPOPT when segmented RMP is disabled by firmware
MAINTAINERS: resctrl: Add myself as reviewer
x86/entry: Fix ptrace regression
x86/init: Initialize wall clock in get_rtc_noop()
x86,fs/resctrl: Keep mbm_assign_mode in default mode at boot
x86/resctrl: Correct ABMC counter ID field width
x86/vmware: Fix i386 high-bandwidth hypercall arguments
x86/csum: Relax the len and proto constraints in 32-bit csum_ipv6_magic()
x86/bugs: Select the BHI mitigation based on the attack vector properly
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull scheduler fixes from Ingo Molnar:
- Fix this_bw on class change of a dying SCHED_DEADLINE task
(Nickolai Zeldovich)
- Account I/O waits independently of delayed dequeue
(Christian Loehle)
- Clear throttle state when leaving the fair class (Daehyeon Ko)
- Fix u32 truncation of the PELT period count (Hui Su)
- Fix imbalanced cluster static-key updates that can mistakenly
disable cluster-aware scheduling (Hui Su)
- Fix active load balancing logic to ignore non-fair current
in alb_break_llc() (Kayra Cizmeci)
* tag 'sched-urgent-2026-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
sched/cache: Ignore non-fair current in alb_break_llc()
sched/topology: Balance cluster static-key updates
sched/pelt: Fix u32 truncation of the PELT period count
sched/fair: Clear throttle state when leaving the fair class
sched/core: Account I/O waits independently of delayed dequeue
sched/deadline: Fix this_bw on class change of a dying task
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull perf events fixes from Ingo Molnar:
- Fix sideband event output when only requesting attr.defer_output
(Ian Rogers)
- Clamp deferred callchain entry count to fit u16 header.size
(Ian Rogers)
- Various AMD IBS fixes (Ravi Bangoria):
- Reset CPU0 IBS state on syscore resume
- Fix kernel address leak via REGS_USER and REGS_INTR
- Simplify/fix event state handling with IBS_CAPS_DIS
- Revert AUX page allocation order default to be continuous (Leo Yan)
- Don't send SIGTRAP after exec removed the event (Danish Khateeb)
* tag 'perf-urgent-2026-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
perf/core: Don't send SIGTRAP after exec removed the event
Revert "perf/aux: Allocate non-contiguous AUX pages by default"
perf/amd/ibs: Simplify event state handling with IBS_CAPS_DIS
perf/amd/ibs: Fix kernel address leak via REGS_USER and REGS_INTR
perf/amd/ibs: Reset CPU0 IBS state on syscore resume
perf/core: Clamp deferred callchain entry count to fit u16 header.size
perf/core: Include perf_event_attr::defer_output in is_sb_event() check
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator
Pull regulator fixes from Mark Brown:
"A small collection of mostly fairly standard driver specific fixes.
The mt6363 changes are a little large but are the result of two
independent users running into the same issues and testing each
other's changes so given that it's only -rc1 it seemed sensible to
take the changes as fixes"
* tag 'regulator-fix-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
regulator: mt6363: Fix VEMC voltage selection
regulator: mt6363: Use 8-bit register values
regulator: mt6363: Fix the registers of the VSRAM CPU and APU LDOs
regulator: qcom_spmi: don't take a sleeping lock in the SAW IPI
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"A collection of (unsurprisingly high amount of) small fixes since the
previous PR. Majority of changes are device-specific quirks and driver
fixes, along with a few ALSA core fixes and USB-audio driver
hardening.
ALSA Core:
- Fix page leak on WC DMA buffer allocation failure
- Prevent O_APPEND on OSS streams to avoid UAF
- A PCM regression fix for PulseAudio to allow hw_refine with mmap
- Serialize DSP image loading requests in hwdep
- Clear user-provided numid before adding a control
- Fix dropped data bytes in UMP to MIDI 1.0 System message conversion
HD-audio:
- Fix double-free on stream page allocation failure in core
- Stop capability walk cleanly on empty capability header
- Fix silent output on Nvidia codecs due to shared converters
- Restore audio registers after AE-5 LED strip transmission
- Calibration data validation and custom address fixes for TAS2781
- Shared boot wait and reset helpers for CS35L41
- Cleanups and fixes for CS35L56 and AW88399
- Add Tegra268 HDMI/DP codec ID
- Device quirks for Acer, Alienware, ASUS, HP, Huawei, Lenovo, MSI
USB-audio:
- Hardening and bug fixes for usx2y and us122l drivers
- Delay MIDI URB retry on -EPIPE to allow disconnect handling
- Fix use-after-free of MIDI URBs on close in bcd2000
- Reject undersized capture buffers in line6 driver
- Fix URB leak on input setup failure in caiaq driver
- Check return value of qmi_handle_init() in Qualcomm offload driver
- Quirks for Yamaha ZG02, HIK camera, and CVT Touch Device
ASoC:
- AMD: Support more ACP7.0 projects, quirks for HP and Lenovo models
- Intel: Dummy topology for SN624x codec, SOF BPT DMA stream fix
- Qualcomm: Guard q6apm callbacks, fix runtime PM refcount leak
- Rockchip: Add missing REGMAP_MMIO Kconfig dependencies
- Meson: Request IRQ with clock enabled in axg-fifo
- Codec fixes for cs35l41, cs_dsp, wm_adsp, wm8904, ES8389, tas2770,
sn624x, and aw88399
Misc:
- FireWire: Fix inverted streaming speed in firewire-tascam
- PCI: Check SCB creation failures in legacy cs46xx driver"
* tag 'sound-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (72 commits)
ALSA: hda/realtek: Add quirk for Acer Predator PHN16-71
ALSA: hda/realtek: Use inverted mute LED quirk for HP ZBook 8 G2a
ALSA: hda: cs35l41: Add support for HP OmniBook 7 Laptop 16-ay0xxx
ALSA: usx2y: Guard the playback copy
ALSA: usx2y: Require a buffer of two URBs
ALSA: hda: cs35l56: Stop cs_dsp before calling cs_dsp_power_down()
ALSA: doc: cs35l56: Update calibration write failure message info
ALSA: hda: cs35l56: Fix mixed cleanup and goto in cs35l56_hda_fw_load()
ALSA: hda/tegra: Add Tegra268 HDMI/DP codec ID
ALSA: hda/realtek: Fix pop noise on ASUS PRIME B650M-K
ALSA: hda/realtek: Fix DAC binding for Legion Pro 7 16ARX8H variant
ALSA: hda/realtek: Fix DAC binding for Lenovo Legion Pro 7 16ARX8H
ALSA: caiaq: free the EP4 URB when input setup fails
ALSA: line6: Reject capture buffers smaller than two packets
ALSA: pcm: Allow HW_REFINE queries with mapped buffers
ALSA: hda/ca0132: Restore AE-5 audio registers after LED strip send
ALSA: hda/tas2781: Only accept CRC-less V1 data if all entries are valid
ALSA: hda/realtek: Enable mute and mic-mute LEDs on HP ENVY 17-cr0xxx
ALSA: usb-audio: Add quirk for Yamaha ZG02
ALSA: pcm: Prevent O_APPEND open on OSS streams
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux
Pull iommu fixes from Joerg Roedel:
"AMD IOMMU:
- Move PerfOpt management into the IOMMU domain attachment paths,
enabling it automatically for supported integrated GPUs in identity
mode and clearing it before switching to translated or blocked
domains
- Fix a boot panic in the GPU identity-mapping quirk when a GPU has
no upstream PCI bridge
- Clear the IOMMU SNP enable flag when RMP table initialization
fails, preventing subsequent initialization from assuming SNP setup
succeeded
- Check IVRS subtable types before parsing memory definitions,
avoiding bogus PCI segments caused by misinterpreting IVHD entries
under QEMU
- Remove an obsolete warning on device release that incorrectly fires
for devices required to remain attached to an identity domain"
* tag 'iommu-fixes-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux:
iommu/amd: Fix NULL pointer dereference for GPUs without upstream bridge
iommu/amd: remove obsolete domain pointer warning on release
iommu/amd: Skip non-IVMD entries when parsing IVRS memory definitions
iommu/amd: Clear amd_iommu_snp_en if snp_rmptable_init() fails
iommu/amd: Enable PerfOpt automatically for integrated GPUs
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull block fixes from Jens Axboe:
- NVMe fixes via Keith:
- nvme-tcp use-after-free in nvme_tcp_free_ctrl() on a failed
connect, and the nvme-rdma counterpart of the NULL queue->ctrl on
reconnect
- nvmet-rdma iWARP disconnect and device removal fixes
- nvmet-tcp: ask for the TLS record type on every receive, and bound
the connections accepted per work run so a connect flood can't
hold up port removal; nvmet-auth keep the old keys if the new ones
fail to decode; nvme-loop delete the controller if a reset fails
- nvmet-auth reject incomplete DHCHAP messages, and a keep-alive
timeout overflow
- nvmet locking and bounds fixes for tbkas reconnects and the
traddr/trsvcid configfs writes, don't leak stale memory in the ANA
log page, and cache the passthru reference across queue_response
- Wait for SRCU readers before splicing the namespace list, with a
new list_splice_init_srcu() helper, and drop an extra grace period
in nvmet_ns_disable()
- Unregister when pr_register() is given a zero new key, and don't
drop the cdev reference twice on cdev_device_add() failure
- Quirks for the ADATA XPG GAMMIX S70 BLADE and KIOXIA XG10d
- Various smaller fixes and cleanups
- blk-mq: end the request if getting a keyslot fails, which left the
in-flight count and zone write plug stuck, reset the queue state on
scheduler teardown so requests don't stall in software queues, and
fix an out-of-bounds read in blk_mq_free_rqs() after a failed
nr_hw_queues update
- Only serialize elevator switches of the same queue
- dma-buf bio fixes: don't use the bvec fast path for them, and only
fail the ones that need block layer PI
- Reject GPT entries with starting_lba > ending_lba
- Return the soft block size for compat BLKBSZGET, report the correct
discard alignment in sysfs, and account the flush sequence latency
only once in iocost
- virtio_blk fixes: synchronous quiesce in freeze, freeze the virtqueue
layout at probe time, clamp max_segments to the ring size, and fix
zone append sector reporting in batched completion
- null_blk zone fixes and a cache state reset
- zloop fixes
- ublk DEL_DEV_ASYNC permission check, and 32-bit selftest build
* tag 'block-7.4-20261106' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (52 commits)
nvmet: cache passthru reference in __nvmet_req_complete()
nvmet: drop the redundant auth check in nvmet_parse_io_cmd()
nvmet: bound the traddr and trsvcid configfs writes
nvmet: take subsys->lock when forcing reconnects for tbkas
nvme: wait for SRCU readers before splicing the namespace list
srcu: Add list_splice_init_srcu()
nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for KIOXIA XG10d
nvmet: don't return memory contents beyond valid data when reading ANA log page
nvme-pci: add NO_FUA quirk for ADATA XPG GAMMIX S70 BLADE
nvmet: drop the extra RCU grace period in nvmet_ns_disable()
nvme-keyring: Add a missing key_put() call to nvme_tls_key_lookup()
ublk: add missing DEL_DEV_ASYNC to unprivileged permission check
selftests: ublk: fix the build and file offsets on 32-bit
nvmet-rdma: disconnect a queue on device removal
nvmet-rdma: queue the release work under the mutex
nvmet-rdma: take a device off the list last
nvmet-tcp: limit the connections accepted per work run
nvmet-rdma: disconnect only established queues
nvmet-auth: keep the old keys if the new ones fail
nvmet-tcp: ask for the TLS record type on every receive
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull io_uring fixes from Jens Axboe:
- Only wait for in-flight requests on ring release if the closing task
actually uses the ring.
- SQPOLL fixes: do the return-to-userspace work in the SQPOLL thread,
as memory.high reclaim and blkcg throttling otherwise only ran at
thread exit, and don't set the stop bit on thread exit, which tripped
a WARN_ON_ONCE() in the ring teardown.
- Don't poll a writer for a read side hangup or for urgent data, as a
half-closed peer or unread OOB data kept the async poll of a send
ready on every re-arm.
- Cancel all matching poll requests in one pass for CANCEL_ALL rather
than restarting the hash walk per request.
- Hold uring_lock across the put_user() for the index-alloc file
install.
- Don't arm an hrtimer and schedule for a wait whose timeout has
already expired.
- Add a feature flag for the dma-buf registered buffer support.
- selftests 32-bit cast fix
* tag 'io_uring-7.4-20261106' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
io_uring: only wait for in-flight requests if the closing task uses the ring
io_uring: add feature flag for dma-buf support
io_uring/wait: don't sleep on an already expired timeout
io_uring/rsrc: hold uring_lock across index-alloc put_user
selftests/io_uring: cast optval through uintptr_t in mini_liburing.h
io_uring/poll: don't poll a writer for urgent data
io_uring/poll: don't poll a writer for a read side hangup
io_uring/poll: cancel all matching requests in one pass
io_uring/cancel: count all requests that a CANCEL_ALL cancels
io_uring/sqpoll: do the return-to-userspace work in the SQPOLL thread
io_uring/sqpoll: don't set IO_SQ_THREAD_SHOULD_STOP on thread exit
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf
Pablo Neira Ayuso says:
====================
Netfilter/IPVS fixes
The following batch contains Netfilter/IPVS fixes for net, this batch
addresses LLM findings, several of these fixes has been reproduced by
syzbot:
1) Add recursion count to nf_reject infrastructure to prevent stack
overflow, from Fernando F. Mancera.
2) Use kfree_rcu() to release IPVS parent application to fix UaF,
from Chengfeng Ye.
3) Fix UaF in IPVS netns removal path due to releasing per-net protocol
data too early, from Chengfeng Ye.
4) Preserve recursion count on nfqueue reinjection, from Zihan Xi.
5) Restore GRE timeout in the flowtable, otherwise, WARN_ON_ONCE()
is reachable, from Michail Andreas Michalopoulos.
6) Check non-null gc transaction in nft_rbtree before queuing it for
processing, from Xingyuan Mo.
7) Replace WARN_ON_ONCE() by DEBUG_NET_WARN_ON_ONCE() in
nf_conntrack_bridge which is reachable if the protocol of the tag
of a frame differs from the vlan_protocol of the bridge.
From Laveesh Bansal.
8) Check x_tables target name is non-null before accessing it when
building a new table, from Fernando F. Mancera.
9) Fix out-of-bound memory read in nf_conntrack_sip, from
Joas Antonio Dos Santos.
10) Fix a memleak in nf_tables hardware offload when double deleting
the same rule, in the same batch.
11) Use a mutex in xt_recent netns exit path instead of spinlock,
since proc unregistration might sleep. From Cen Zhang.
12) Zero the nf_nat_range2 struct before filling it up, to avoid
using stale uninitialized stack data to configure NAT with
an esoteric NAT flags combination. From Florian Westphal.
* tag 'nf-26-11-05' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
netfilter: nat: zero newrange before filling it in
netfilter: xt_recent: do not call remove_proc_entry() under recent_lock
netfilter: nf_tables: fix memleak when rule deletion fails with hardware offload
netfilter: nf_conntrack_sip: fix OOB read in ct_sip_parse_transport()
netfilter: x_tables: check target name before accessing verdict
netfilter: bridge: use DEBUG_NET_WARN_ON_ONCE in nf_ct_bridge_refrag()
netfilter: nft_set_rbtree: check catchall_sync return before queue_done
netfilter: flowtable: extend ct timeout of offloaded GRE flows
netfilter: nf_dup: preserve guard across NFQUEUE reinjection
ipvs: fix protocol data lifetime during namespace teardown
ipvs: Defer application parent freeing until after RCU readers
netfilter: nft_reject: prevent unbounded recursion in output hooks
====================
Link: https://patch.msgid.link/20261105124536.1009301-1-pablo@netfilter.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
The LE parameter validator calculates an unsigned maximum latency by
subtracting one from a truncated quotient. If the quotient is zero,
this wraps and accepts invalid parameters. Exact quotient boundaries
also accept equality where the supervision timeout must be greater.
Compare the products directly after checking the field bounds. The
validated interval and latency limits keep the products within int.
This enforces the strict timeout relationship without division or
unsigned subtraction.
Sashiko identified the underflow while reviewing the soft interval
preference RFC. The bug is already present in its unpatched base; keep
this common-validator fix independent of that preference policy.
Fixes: 8757825b128e ("Bluetooth: hci_check_conn_params() check proper range")
Assisted-by: LLM
Signed-off-by: Kyle Pepper <cochcoder@proton.me>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
|
