| Age | Commit message (Collapse) | Author |
|---|
|
https://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux.git
# Conflicts:
# drivers/firmware/tegra/bpmp-tegra186.c
# drivers/firmware/tegra/bpmp-tegra210.c
# drivers/firmware/tegra/bpmp.c
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/pza/linux
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/mm/linux.git
|
|
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git
|
|
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/mm/linux.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/cel/linux
|
|
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux.git
# Conflicts:
# fs/btrfs/volumes.c
|
|
|
|
# New commits in timers/urgent:
c1b96ba87e3c ("timekeeping: Refresh auxiliary base before offset validation")
67f1969e29b6 ("timekeeping: Reject cross timestamps for invalid AUX clocks")
c49b3c20a2d0 ("tsacct: Keep task begin times stable across suspend")
385b5ec1f31d ("timekeeping: Read getboottime64() offsets under the sequence counter")
5e85b36768b7 ("tools headers: Update the vdso/unaligned.h copy with the kernel sources")
2727aca4439e ("vdso: Add VDSO_UNALIGNED_PACKED config option")
Signed-off-by: Ingo Molnar <mingo@kernel.org>
|
|
# New commits in core/urgent:
efe191f1605a ("entry: Complete syscall_enter_from_user_mode_work() to bool migration")
75b1663222d7 ("entry: Fix return type of syscall_trace_enter()")
Signed-off-by: Ingo Molnar <mingo@kernel.org>
|
|
This reverts commit e2a33a2a3258794891cdd6ca4b1318da6594d157.
With no remaining users in the kernel tree, remove sort_nonatomic() and
sort_r_nonatomic() to clean up dead code. This effectively drops the
wrapper function __sort_r() and eliminates the may_schedule branch and
cond_resched() call from the inner loop of the core sorting routine,
slightly simplifying and optimizing the code.
Link: https://lore.kernel.org/20260910165222.1186628-3-visitorckw@gmail.com
Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Song Liu <song@kernel.org>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Andrii Nakryiko <andrii@kernel.org>
Cc: Eduard Zingerman <eddyz87@gmail.com>
Cc: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Cc: KP Singh <kpsingh@kernel.org>
Cc: <matt@bobrowski.net>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Ihor Solodrai <ihor.solodrai@linux.dev>
Cc: <martin.lau@linux.dev>
Cc: Yonghong Song <yonghong.song@linux.dev>
Cc: Emil Tsalapatis <emil@etsalapatis.com>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: <hch@infradead.org>
Cc: Ching-Chun (Jim) Huang <jserv@ccns.ncku.edu.tw>
Cc: Yu-Chun Lin <eleanor.lin@realtek.com>
Cc: <marscheng@google.com>
|
|
The pages protected by KFENCE are removed from the direct map.
safe_copy_page() temporarily maps and unmaps them using set_direct_map
APIs, or, when the stars align, even using debug_pagealloc_map_pages().
Neither of these APIs cares whether it is a KFENCE page and both blindly
perform the update of the kernel page table for any non-present page.
Ability to use debug_pagealloc_map_pages() to remap KFENCE pages when both
KFENCE and debug_pagealloc are enabled is an amusing coincidence.
But with increasing appetite for using set_direct_map for hardening
purposes, it becomes too big of a hammer to enable saving any non-present
page in the hibernation image.
Another gotcha is that loongarch that does not have a direct map at all
advertises ARCH_HAS_SET_DIRECT_MAP to allow coexistence of KFENCE and
hibernation.
Extend KFENCE with a bitmap that tracks which pages are protected and
provide kfence_force_mapping() and kfence_reset_mapping() APIs that allow
forced mapping and unmapping of KFENCE pages.
Use these APIs in hibernate_{map,unmap}_pages() for KFENCE pages.
Link: https://lore.kernel.org/20260926-hibernation-v2-4-235f69f3ab2a@kernel.org
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: David Hildenbrand (Arm) <david@kernel.org>
Acked-by: Rafael J. Wysocki <rafael@kernel.org>
Cc: Alexander Potapenko <glider@google.com>
Cc: Marco Elver <elver@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Len Brown <lenb@kernel.org>
Cc: Pavel Machek <pavel@kernel.org>
|
|
Patch series "hibernation: make safe_copy_page more robust and remove
debug_pagealloc support", v2.
When hibernation creates a memory image, it uses set_direct_map() APIs to
temporarily map pages that are marked as not present in the kernel page
tables.
Initially, this was intended to support debug_pagealloc along with
hibernation on x86.
With the increasing desire to use set_direct_map APIs for hardening
features and with their inconsistent implementations across architectures,
using kernel_page_present() + set_direct_map_valid_noflush() to save
non-present pages in the hibernation image is not very safe, to say the
least.
Worse, some combinations of debug features, such as debug_pagealloc and
PAGE_POISON cause a crash during restore.
Keeping debug_pagealloc compatible with hibernation requires a complex
infrastructure for tracking free unmapped pages with a page flag/page type,
verifying that it is actually a free page that hibernate_map_page() tries
to remap and making sure there are no stale or failed page table updates.
With init_on_{alloc,free} and/or PAGE_POISON on top, this also requires the
ability to map and initialize these free pages on restore.
This complexity does not seem justified for a somewhat niche debugging
scenario.
Instead of a complex fix to support hibernation with debug_pagealloc, make
sure that copy_data_pages() and its helpers properly handle errors that may
happen during page table updates, explicitly enable saving of KFENCE pages
and disallow hibernation when debug_pagealloc is enabled.
This patch (of 5):
Since commit 31a1b9d7fe768 ("mm: page_alloc: move mark_free_page() into
snapshot.c") several helpers that set, clear and query free and forbidden
page status are only used inside kernel/power/snapshot.c
Make them static and add necessary forward declarations near the existing
declarations of similar helpers.
Link: https://lore.kernel.org/20260926-hibernation-v2-0-235f69f3ab2a@kernel.org
Link: https://lore.kernel.org/20260926-hibernation-v2-1-235f69f3ab2a@kernel.org
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: David Hildenbrand (Arm) <david@kernel.org>
Acked-by: Rafael J. Wysocki <rafael@kernel.org>
Cc: Alexander Potapenko <glider@google.com>
Cc: Marco Elver <elver@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Len Brown <lenb@kernel.org>
Cc: Pavel Machek <pavel@kernel.org>
|
|
The kernel-doc comment for jhash() documents the first parameter as @k,
but the function signature uses key.
Fix the parameter name in the comment to match the signature.
No functional changes.
Link: https://lore.kernel.org/20261030093834.13043-1-zhangcoder@yeah.net
Signed-off-by: Ziran Zhang <zhangcoder@yeah.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
|
|
Commit 22302af28d3f ("cleanup: Annotate guard constructors with
nonnull") added the macro __nonnull_args() to wrap raw compiler
attribute.
Replace __attribute__((nonnull)) with __nonnull_args() to standardize
nonnull attribute usage across the tree and keep the attribute's quirks
in one place rather than open-coded at every call site.
Link: https://lore.kernel.org/5bfdc1491d297b5e98cf42322c790f06481c28c7.1793027261.git.d@ilvokhin.com
Signed-off-by: Dmitry Ilvokhin <d@ilvokhin.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Suggested-by: Miguel Ojeda <ojeda@kernel.org>
Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: Christian König <christian.koenig@amd.com>
Cc: David Airlie <airlied@gmail.com>
Cc: Simona Vetter <simona@ffwll.ch>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Cc: Tvrtko Ursulin <tursulin@ursulin.net>
Cc: Lee Jones <lee@kernel.org>
Cc: Pavel Machek <pavel@kernel.org>
Cc: Joel Stanley <joel@jms.id.au>
Cc: Andrew Jeffery <andrew@codeconstruct.com.au>
Cc: Ryan Chen <ryan_chen@aspeedtech.com>
Cc: Billy Tsai <billy_tsai@aspeedtech.com>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: Kees Cook <kees@kernel.org>
Cc: Andy Shevchenko <andy@kernel.org>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Andy Whitcroft <apw@canonical.com>
Cc: Joe Perches <joe@perches.com>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Shuah Khan <skhan@linuxfoundation.org>
Cc: Randy Dunlap <rdunlap@infradead.org>
Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: Jani Nikula <jani.nikula@intel.com>
Cc: Andi Shyti <andi.shyti@kernel.org>
|
|
Commit 22302af28d3f ("cleanup: Annotate guard constructors with
nonnull") added the macro __nonnull_args() to wrap raw compiler
attribute.
Replace __attribute__((nonnull)) with __nonnull_args() to standardize
nonnull attribute usage across the tree and keep the attribute's quirks
in one place rather than open-coded at every call site.
tools/testing/shared/linux/xarray.h directly includes the kernel's
include/linux/xarray.h, which now uses __nonnull_args(). The macro is
not defined under tools/, breaking test builds.
Define __nonnull_args() in tools/include/linux/compiler.h.
Link: https://lore.kernel.org/e2660c4c9f5e6f97be2ef7bd3752d259bce77d81.1793027261.git.d@ilvokhin.com
Signed-off-by: Dmitry Ilvokhin <d@ilvokhin.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Suggested-by: Miguel Ojeda <ojeda@kernel.org>
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: Christian König <christian.koenig@amd.com>
Cc: David Airlie <airlied@gmail.com>
Cc: Simona Vetter <simona@ffwll.ch>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Cc: Tvrtko Ursulin <tursulin@ursulin.net>
Cc: Lee Jones <lee@kernel.org>
Cc: Pavel Machek <pavel@kernel.org>
Cc: Joel Stanley <joel@jms.id.au>
Cc: Andrew Jeffery <andrew@codeconstruct.com.au>
Cc: Ryan Chen <ryan_chen@aspeedtech.com>
Cc: Billy Tsai <billy_tsai@aspeedtech.com>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Kees Cook <kees@kernel.org>
Cc: Andy Shevchenko <andy@kernel.org>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Andy Whitcroft <apw@canonical.com>
Cc: Joe Perches <joe@perches.com>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Shuah Khan <skhan@linuxfoundation.org>
Cc: Randy Dunlap <rdunlap@infradead.org>
Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: Jani Nikula <jani.nikula@intel.com>
Cc: Andi Shyti <andi.shyti@kernel.org>
Cc: Andi Shyti <andi.shyti@linux.intel.com>
|
|
Commit 22302af28d3f ("cleanup: Annotate guard constructors with
nonnull") added the macro __nonnull_args() to wrap raw compiler
attribute.
Replace __attribute__((nonnull)) with __nonnull_args() to
standardize nonnull attribute usage across the tree and keep the
attribute's quirks in one place rather than open-coded at every call
site.
Add spaces after the commas in the __nonnull_args() argument list to
follow the usual coding style (according to checkpatch).
Link: https://lore.kernel.org/580fdfbe2eb6694438cbd8f5337bd2f1edac564b.1793027261.git.d@ilvokhin.com
Signed-off-by: Dmitry Ilvokhin <d@ilvokhin.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Suggested-by: Miguel Ojeda <ojeda@kernel.org>
Reviewed-by: Andy Shevchenko <andy@kernel.org>
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: Christian König <christian.koenig@amd.com>
Cc: David Airlie <airlied@gmail.com>
Cc: Simona Vetter <simona@ffwll.ch>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Cc: Tvrtko Ursulin <tursulin@ursulin.net>
Cc: Lee Jones <lee@kernel.org>
Cc: Pavel Machek <pavel@kernel.org>
Cc: Joel Stanley <joel@jms.id.au>
Cc: Andrew Jeffery <andrew@codeconstruct.com.au>
Cc: Ryan Chen <ryan_chen@aspeedtech.com>
Cc: Billy Tsai <billy_tsai@aspeedtech.com>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Kees Cook <kees@kernel.org>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Andy Whitcroft <apw@canonical.com>
Cc: Joe Perches <joe@perches.com>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Shuah Khan <skhan@linuxfoundation.org>
Cc: Randy Dunlap <rdunlap@infradead.org>
Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: Jani Nikula <jani.nikula@intel.com>
Cc: Andi Shyti <andi.shyti@kernel.org>
Cc: Andi Shyti <andi.shyti@linux.intel.com>
|
|
Commit 22302af28d3f ("cleanup: Annotate guard constructors with
nonnull") added the macro __nonnull_args() to wrap raw compiler
attribute.
Replace __attribute__((nonnull)) with __nonnull_args() to
standardize nonnull attribute usage across the tree and keep the
attribute's quirks in one place rather than open-coded at every call
site.
Link: https://lore.kernel.org/f0d7b2f0dce916f4cde3dd466a5b51a4b88fbdd8.1793027261.git.d@ilvokhin.com
Signed-off-by: Dmitry Ilvokhin <d@ilvokhin.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Suggested-by: Miguel Ojeda <ojeda@kernel.org>
Reviewed-by: Andy Shevchenko <andy@kernel.org>
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: Christian König <christian.koenig@amd.com>
Cc: David Airlie <airlied@gmail.com>
Cc: Simona Vetter <simona@ffwll.ch>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Cc: Tvrtko Ursulin <tursulin@ursulin.net>
Cc: Lee Jones <lee@kernel.org>
Cc: Pavel Machek <pavel@kernel.org>
Cc: Joel Stanley <joel@jms.id.au>
Cc: Andrew Jeffery <andrew@codeconstruct.com.au>
Cc: Ryan Chen <ryan_chen@aspeedtech.com>
Cc: Billy Tsai <billy_tsai@aspeedtech.com>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Kees Cook <kees@kernel.org>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Andy Whitcroft <apw@canonical.com>
Cc: Joe Perches <joe@perches.com>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Shuah Khan <skhan@linuxfoundation.org>
Cc: Randy Dunlap <rdunlap@infradead.org>
Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: Jani Nikula <jani.nikula@intel.com>
Cc: Andi Shyti <andi.shyti@kernel.org>
Cc: Andi Shyti <andi.shyti@linux.intel.com>
|
|
Cross-merge networking fixes after downstream PR (net-7.4-rc3).
Conflicts:
net/core/dev.c
fdca4b030c78f ("net: Segment CHECKSUM_UNNECESSARY GSO skbs other than fraglist")
f4564d298418c ("net: reset transport_header for ndo_features_check")
https://lore.kernel.org/avXGDHChG4mIw6Tl@sirena.org.uk
drivers/net/dsa/motorcomm/chip.c
4dd10fbbeb9c3 ("treewide: Convert devm_kmalloc() family to the devm_kmalloc_obj() family")
a9a173f81c83e ("net: dsa: motorcomm: Free the MIB block on port teardown")
https://lore.kernel.org/avXGA_FRXwZM7ExI@sirena.org.uk
Adjacent changes:
drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
8959c2030f5c ("net: stmmac: release MDIO node if bus data allocation fails")
4dd10fbbeb9c ("treewide: Convert devm_kmalloc() family to the devm_kmalloc_obj() family")
drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
edf10f5c2513 ("net: stmmac: rebuild VLAN priority steering when filters change")
4dd10fbbeb9c ("treewide: Convert devm_kmalloc() family to the devm_kmalloc_obj() family")
net/core/skbuff.c
8b67debdfbf6 ("net: skbuff: uncharge trimmed zerocopy frags on error")
ecca9bb2c855 ("net: skbuff: replace ubuf_info ops ptr with type id")
net/ipv4/ip_output.c
23fe6ac2e97a ("net: skbuff: make skb_copy_and_csum_bits() report unreadable frag
s")
0f47fce51a98 ("ipv4: keep XFRM headers out of corked skb lengths")
net/ipv6/seg6_local.c
6b290fe547c2 ("seg6: skip the route refcount in seg6local IPv4 lookups")
549484dd3e80 ("seg6: validate state in netfilter continuations")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
The GEN11_* irq register definitions aren't needed outside the
core i915 irq code anymore. Move the definitions from the global
intel_gmd_interrupt_regs.h header back into the private i915_reg.h.
Suggested-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patch.msgid.link/20261110125942.11010-1-ville.syrjala@linux.intel.com
Reviewed-by: Jani Nikula <jani.nikula@intel.com>
|
|
BPF program freeing currently runs from the system workqueue. With BPF
program pack allocations, freeing the last program in a pack can take
pack_mutex and call into execmem/vmalloc code to change page permissions.
That path may queue a vmalloc purge helper to the same CPU and wait for it
to finish.
If enough other BPF program free workers are already active on that CPU,
they can all block on pack_mutex and consume the system workqueue active
slots. The worker holding pack_mutex then waits for the vmalloc purge work,
but that purge work cannot run because the queue is full of pack_mutex
waiters:
[ 24.646667] INFO: task kworker/0:4:1291 blocked for more than 10 seconds.
[ 24.646669] Not tainted 7.3.0-00001-gdeaa120a9b25-dirty #11
[ 24.646670] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 24.646671] task:kworker/0:4 state:D stack:0 pid:1291 tgid:1291 ppid:2 task_flags:0x4208060 flags:0x00080000
[ 24.646675] Workqueue: events bpf_prog_free_deferred
[ 24.646678] Call Trace:
[ 24.646680] <TASK>
[ 24.646686] __schedule+0x5bc/0x1430
[ 24.646702] schedule+0x3f/0x100
[ 24.646706] schedule_timeout+0x106/0x110
[ 24.646711] ? srso_alias_return_thunk+0x5/0xfbef5
[ 24.646713] ? mark_held_locks+0x49/0x80
[ 24.646720] ? srso_alias_return_thunk+0x5/0xfbef5
[ 24.646723] ? lockdep_hardirqs_on_prepare+0xdc/0x190
[ 24.646726] ? srso_alias_return_thunk+0x5/0xfbef5
[ 24.646732] __wait_for_common+0xc1/0x1d0
[ 24.646735] ? __pfx_schedule_timeout+0x10/0x10
[ 24.646748] ? __flush_work+0x1f8/0x550
[ 24.646751] __flush_work+0x309/0x550
[ 24.646759] ? __pfx_wq_barrier_func+0x10/0x10
[ 24.646783] __purge_vmap_area_lazy+0x3e4/0x440
[ 24.646796] _vm_unmap_aliases+0x2d5/0x330
[ 24.646810] change_page_attr_set_clr+0xb9/0x580
[ 24.646817] ? srso_alias_return_thunk+0x5/0xfbef5
[ 24.646833] set_memory_nx+0x3b/0x50
[ 24.646838] __execmem_cache_free+0x35/0xb0
[ 24.646848] execmem_free+0x98/0x160
[ 24.646864] bpf_prog_pack_free+0x152/0x190
[ 24.646871] bpf_jit_binary_pack_free+0x17/0x90
[ 24.646876] bpf_jit_free+0x5e/0x130
[ 24.646882] process_one_work+0x289/0x790
[ 24.646886] ? srso_alias_return_thunk+0x5/0xfbef5
[ 24.646888] ? srso_alias_return_thunk+0x5/0xfbef5
[ 24.646902] worker_thread+0x1b3/0x370
[ 24.646908] ? __pfx_worker_thread+0x10/0x10
[ 24.646911] kthread+0xf7/0x130
[ 24.646914] ? __pfx_kthread+0x10/0x10
[ 24.646920] ret_from_fork+0x293/0x300
[ 24.646923] ? __pfx_kthread+0x10/0x10
[ 24.646927] ret_from_fork_asm+0x1a/0x30
[ 24.646947] </TASK>
Move deferred freeing of BPF programs, program images, and trampoline
images to a dedicated workqueue to avoid this deadlock.
Fixes: 72210662c5a2 ("mm: vmalloc: offload free_vmap_area_lock lock")
Reported-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261109181610.7027-1-emil@etsalapatis.com
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Jakub Kicinski:
"Including fixes from netfilter, wireless and bluetooth.
Previous releases - regressions:
- tcp: rate limit receive queue collapsing
- raw: fix ICMP unreachable sent when receive queue is full
- eth: bnxt_en: take RTNL before netif_close() when aborting FW reset
Previous releases - always broken:
- tcp:
- bound snd_cwnd_clamp to TCP_MAX_SND_CWND
- number of fixes for TCP Fast Open
- gro:
- invalidate frag0 after a pull
- avoid parsing headers from shared fragments
- cipso: stop modifying live ip_options_rcu
- udp: do not use a cross-family sk_rx_dst in early demux
- fou: gue: check IP version of held packets for direct IP
encapsulation
- skbuff: preserve fclone lifetime when freeing stolen heads
- eth:
- mlx5e:
- fix crashes on queue stats access to queues without stats
- SHAMPO, disable end padding when relaxed ordering is
- ena: keep the RX buffer mapped if skb allocation fails"
* tag 'net-7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (227 commits)
selftests: net: add a test for NSH GSO
nsh: limit recursion in nsh_gso_segment()
selftests: tls: Cover the cap on consecutive empty records
selftests: tls: Extend coverage for zero-length records
selftests: tls: Skip the zero_len tests when TLS is unavailable
tls: Consume empty data records in tls_sw_splice_read()
tls: Break the connection after a burst of empty data records
net: phy: c45: select BASE-T1 type for the forced speed
net/mlx5e: Fix false WARN_ON_ONCE in flow steering cleanup on RX init failure
net/mlx5e: IPsec, don't match upper proto selectors in crypto offload TX
tcp: fix request_sock use-after-free during Fast Open accept()
net: usb: cdc_ncm: don't underflow the NDP room check
net: netns: fix INT_MAX nsid cleanup
amt: use ipv6_hdr() in amt_mldv1_leave_handler()
af_unix: Inherit SO_INQ in unix_stream_connect()
tcp: Pass req->rsk_listener to inet_csk_reqsk_queue_drop() in tcp_check_req().
mailmap: add entries for Hangbin Liu
net: virtio: validate outer protocol of UDP tunnel GSO packets
tun: clear stale skb->protocol of NAPI frags skbs
net: virtio: fix UDP tunnel GSO header of VLAN tagged packets
...
|
|
The HTTP/2 parsers of the Datadog agent, as shipped from 7.51 on, are
rejected:
current_header = NULL;
if (interesting_headers < HTTP2_MAX_HEADERS_COUNT_FOR_PROCESSING)
current_header = &headers_to_process[interesting_headers];
873: r1 = *(u64 *)(r10 -352) r1 is [0, 2]
874: r1 &= 255
875: r3 = r1
876: r3 *= 20 r3 is [0, 40]
877: r4 = *(u64 *)(r10 -320) map_value, 40 bytes
878: r4 += r3
879: r3 = 2
880: if r3 > r1 goto pc+1 r1 is [0, 1] at 882
881: r4 = 0
1001: *(u32 *)(r1 +4) = r2 r1 is r4
invalid access to map value, value_size=40 off=44 size=4
A jump refines 'tested register + constant' and, by match_linked_add(),
'register + tested register + constant'. r4 is neither.
Evaluate instead of matching. A register is linked if a tested register is
among the operands of its expression (LLVM: SCEVExprContains()). After the
jump the expression is evaluated in the refined state (getRangeRef()), each
op by scev_value_alu(). An operand that no op describes is read from a live
SCEV register that holds it + a constant: its leader (GVN).
find_linked_regs() keeps the linked registers and the leaders of a jump, as
before. Expressions share operands, so a visit of the jump lists the bases
below the linked registers in post-order, each base once, with the
positions of its operands and leaders. A leader is found by base.
eval_linked_exprs() walks the list once: a value is the intersection of
what the leaders hold and what the operands give. A linked register is the
value of its base + its constant. A register that is dead after the jump is
left out.
'tested + constant' is a base whose leader is the tested register.
'x == tested (mod 2^8)' is a leader in 8 bits: scalar_intersect() has the
rule. 'p = x + i' is an add. match_linked_add() and the searches for the
other operand go, recompute_ptr() keeps its checks and loses its add,
refine_linked_regs() is called once per branch.
Not evaluated: below depth EXPR_STACK_DEPTH; an operand without a live
leader ('h += n * 20' overwrites the only register that holds h; of two
indexes that are tested after the add the first is dead at the second
jump). Beside the tested registers one leader of an operand is read, the
widest. A jump with 64K distinct subexpressions refines nothing.
The filter is cheap: an expression is constructed after its operands, so
what is older than the tested values is dropped without a look at its
operands. Kernel instructions at load: Falco and Datadog +1 %, rust-bpf and
Tetragon +2 %. A prog with 60 slots that hold 'tested + constant' and 1000
jumps loads in 3/4 of the time.
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261112155337.1040699-12-alexei.starovoitov@gmail.com
|
|
current_header = NULL;
if (interesting_headers < HTTP2_MAX_HEADERS_COUNT_FOR_PROCESSING)
current_header = &headers_to_process[interesting_headers];
clang computes the address before it tests the index (the HTTP/2 parser of
the Datadog agent). The jump bounds the index, and scalar evolution has the
expression of the pointer: (+ hdrs (* (zext8 n) 20)). What nobody computes
is the range of that expression after the jump. The next patch does.
eval_expr() is the evaluator that scev.c has. It computes the value of an
expression in a state at a loop header: the initial value, the step and the
bound of an induction variable. It knows a register, a constant, an add and
(zext32 slot) for a 32-bit spill.
Give it + - * / % & | ^ << >> s>> and the extensions. scev_value_alu()
applies an op to two values by scalar_alu(), the transfer function that the
main pass applies to the insn. scalar_ext() is new: the two casts of the
main pass under one name. No arithmetic is added. neg and the byte swaps
have no value, as before. Two things are not in struct scalar:
- The width. A 32-bit spill holds the low 32 bits of a value: struct
scev_value gets 'bits', the value is known modulo 2^bits.
+ - * & | ^ << respect that. An extension of N bits wants N bits and
makes 64. >> s>> / % want 64. (zext32 slot) is no special case any more.
- The type. Expressions have none, the state has it. A pointer can be an
operand of an add, with a scalar, as in scev_value_add(), which goes
with its level 2 message.
match_linear_latch() decides which expressions get here, and it does not
change. For these: (zext32 r) of a register or a 64-bit spill had no value
and has one. A slot with a 32-bit spill, read in 64 bits, was unknown and
has no value. A sum of scalars ends with the reduction.
struct scev_value moves to bpf_verifier.h: the main pass is going to get
one.
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261112155337.1040699-11-alexei.starovoitov@gmail.com
|
|
r1 = r6
r1 &= 255
if r1 > 29 goto out
/* r6 is used */
Scalar evolution tells refine_linked_regs() that r6 and r1 are equal in
their low 8 bits. For other registers it is 16, 32 or 64 bits. The function
intersects the two by hand: are they equal in all bits because both fit, do
the known bits overlap, the 32-bit ranges, the 64-bit ranges, the
reduction, and back to the saved register if nothing is left.
The next patches compute the value of an expression in scev.c. A value can
be known from more than one source there, what a register holds and what
the operands give, in a number of bits each. The sources are intersected by
the same rules.
Move the rules into scalar_intersect(dst, src, bits), an operation on
struct scalar like scalar_add() and scalar_alu(). No functional change.
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261112155337.1040699-10-alexei.starovoitov@gmail.com
|
|
adjust_scalar_min_max_vals() is the transfer function of an ALU insn
with two scalar operands. Two calls in it need the environment of the
verifier: sanitize_val_alu() and maybe_fork_scalars(). Scalar evolution
is going to evaluate expressions such as h + (n & 255) * 20 and needs
the transfer function without them.
Cut the function in two. scalar_alu(dst, src, insn) is
is_safe_to_compute_dst_reg_range(), the switch, the zero extension of
an ALU32 result and the reduction. adjust_scalar_min_max_vals() calls
sanitize_val_alu(), maybe_fork_scalars() and then scalar_alu(). It still
gets its source operand by value, so 'r1 += r1' does not pass one scalar
as dst and src.
The two calls used to come after is_safe_to_compute_dst_reg_range().
sanitize_val_alu() is called for ADD and SUB, maybe_fork_scalars() for
AND and OR, and the range of these four is always safe to compute.
bpf_mark_reg_unknown(dst_reg) becomes scalar_set_unknown(dst) in two
places. The rest of a SCALAR_VALUE register is 0 already.
No functional change.
Suggested-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261112155337.1040699-6-alexei.starovoitov@gmail.com
|
|
Datadog's socket__http2_headers_parser computes p = h + (n & 255) * 20
and compares n with 2 afterwards. The jump refines n. The range of p
follows from its expression: an and, a multiplication, an addition.
Scalar evolution knows the expression and is going to evaluate it with
the transfer functions of the main pass. The values in between are in no
register.
scalar_add(), scalar_union() and a few more functions take
a struct scalar. The others read and write the same five members and
take a struct bpf_reg_state. Code that has a value and no register makes
up a register of 80 bytes: BPF_NEG copies its operand to
env->fake_reg[0], adjust_scalar_min_max_vals() gets a copy of the source
register, refine_linked_regs() copies a register to add a constant.
Make 61 more functions take a struct scalar: reg_bounds_sync() with its
callees, the checks of the invariants, the casts, all ALU operations,
the widening, the refinement by a jump. In them, and in the switch of
adjust_scalar_min_max_vals(), which calls the ALU operations:
struct bpf_reg_state * struct scalar *
reg_smin(reg) cnum64_smin(s->r64)
reg_set_srange64(reg, a, b) s->r64 = cnum64_from_srange(a, b)
scalar_of(reg) s
reg, dst_reg, src_reg s, dst, src
reg1, reg2 a, b
'reg' in the function's name 'scalar'
and the same for the other 7 getters and 3 setters. The names are those
of scalar_add() and scalar_zext32(). bpf_reg_widen_range() becomes
scalar_widen(). What is only read becomes const.
A caller with a register passes scalar_of(reg). reg_bounds_sync() is
called 15 times with a register and reg_is_empty() 8 times: the two
stay, as one line each. reg_step_reset() was such a line. 3 of its 21
calls still have a register, so it goes.
What is not a substitution:
- An and, or, xor that gives a constant and BPF_NEG call
__mark_reg_known(). It clears the ids and the union and calls
scalar_set_const(). They call scalar_set_const() now: their register
is a SCALAR_VALUE, there is nothing to clear.
- regs_refine_cond_op() and BPF_UHMUL, BPF_SHMUL in the switch call
is_reg_const(), which tests the type. Both callers of the first pass
scalars only, the operands of the switch are scalars.
scalar_is_const() is the rest of is_reg_const().
- BPF_NEG keeps its operand in a struct scalar on the stack. The source
operand of adjust_scalar_min_max_vals(), still passed by value, and
of maybe_fork_scalars() is a struct scalar.
is_scalar_branch_taken() keeps its registers: it ends in
simulate_both_branches_taken(), which refines four registers of env and
not the arguments. reg_bounds_sanity_check() and range_within() are only
called with a register.
No functional change.
Suggested-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261112155337.1040699-5-alexei.starovoitov@gmail.com
|
|
auxmap__store_socktuple_param() of Falco copies from a struct on the stack:
struct sockaddr_in6 addr = {};
bpf_probe_read_user(&addr, size, usrsockaddr);
bpf_probe_read_kernel(&ipv6_remote, 16, addr.sin6_addr.in6_u.u6_addr32);
r3 = 8
r3 += r8 ; R3=fp-144 R8=fp-152
call bpf_probe_read_kernel#113 ; use: fp0-8..-2048
The liveness pass loses the offset of r3, as it does at 'c = buf[i]'. All
slots of the frame are live up to this insn. That includes the slots in
which the compiler left a pointer that no insn loads again. Two pointers
to different places have no join. A pointer and a number have no join.
States that differ in such a slot stay apart. K such slots with two values
each give 2^K states at a join point.
The read does not need the pointers. A helper, a kfunc or a global subprog
that gets a pointer to the stack reads memory. A load of 1, 2 or 4 bytes
does not give a spilled pointer back: the result is an unknown number.
Calculate a second set in the liveness pass: the slots from which a later
insn can fill a register. It has the equation of the live slots, without
the reads above. If a slot is live and is not in the second set,
bpf_clean_verifier_state() replaces a spilled pointer with STACK_MISC. The
bytes stay readable. States that differ only in such a pointer are equal.
STACK_MISC stands for any content of a slot, see stacksafe(), and the
verifier goes on with the cleaned state. Thus an error in the new set can
reject a valid prog, not accept an unsafe one. These reads count as a fill:
- A load of 8 bytes at any offset. An offset that the liveness pass lost
is frequently a constant in the main pass: a[n++] = p; p = a[--n];
- A short load at a known offset. The main pass rejects it if the slot
has a pointer: invalid size of register fill
- An atomic insn, callx, a helper that calls one of two callbacks.
A short load at an offset that only the main pass knows got this error too.
Now it reads unknown bytes if the state was cleaned between the spill and
the load. States that only such a pointer kept apart are joined now, as in
the same code without the pointer. Without CAP_PERFMON no state changes:
a helper must not read a pointer.
The insns that the verifier processes. Falco and Tracee: the code of Nov 9
with the flags of the projects, clang 17:
Falco recvmsg_x 13267 -> 1954
Falco send_x 3125 -> 1880
Tracee trace_security_file_mprotect 17872 -> 8515
8 such pointers, then 'c = buf[i]' 5000 -> 118
12 such pointers, then 'c = buf[i]' rejected -> 162
All progs pay for the second set when they are loaded: Cilium takes 1% more
instructions in the kernel and 3% more memory, Tetragon 2% and 4%.
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261112155337.1040699-2-alexei.starovoitov@gmail.com
|
|
There has never been a user in upstream kernel, and no devicetree
support was ever added, so it is clear that this is entirely
unused.
Cc: Roland Stigge <stigge@antcom.de>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Nuno Sá <nuno.sa@analog.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
|
|
This was used on the iop32x platform but has no references
left in the kernel and has no devicetree support, so there
is no longer a way to use it.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
|
|
The max197 driver requires platform data providing a convert() callback
function pointer and fails to probe without it. The last user of this
driver was the x86/elan ts5500 platform that is no longer supported.
Remove the unused driver, its platform_data header file, Kconfig/Makefile
entries, and documentation.
Cc: Nuno Sá <nuno.sa@analog.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Nuno Sá <nuno.sa@analog.com>
[groeck: Updated description with details from Arnd's patch]
Link: https://patch.msgid.link/20261110183434.181711-9-linux@roeck-us.net
|
|
There are no in-tree users for this driver, but it supports devicetree
and can be used with external dtb files. As there is no platform_data
definition otherwise, remove the legacy probe support.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
[groeck: Resolved context conflict]
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
|
|
There are no in-tree users of ltc4245_platform_data. Sampling all GPIO
pins as analog voltages is already configurable via the
"ltc4245,use-extra-gpios" devicetree property.
Drop platform data support from the driver, remove the unused
platform_data header file, and update the driver documentation.
Cc: Nuno Sá <nuno.sa@analog.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Nuno Sá <nuno.sa@analog.com>
Link: https://patch.msgid.link/20261110183434.181711-6-linux@roeck-us.net
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
|
|
There are no in-tree users providing gsc_hwmon_platform_data. Channel
descriptions and the fan controller base address are already obtained
from devicetree / fwnode properties.
Move enum gsc_hwmon_mode and struct gsc_hwmon_channel into the driver,
fold the channel array and fan_base into struct gsc_hwmon_data, drop
platform data support, and remove the unused platform_data header file.
Cc: Tim Harvey <tharvey@gateworks.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Link: https://patch.msgid.link/20261110183434.181711-5-linux@roeck-us.net
|
|
There are no in-tree users of g762_platform_data. All hardware
parameters configurable through platform data (input clock, fan gear
mode, PWM polarity, and fan startup voltage) are already configurable
via devicetree properties.
Drop platform data support and the now-unnecessary CONFIG_OF guards from
the driver, remove the unused platform_data header file, and update the
driver documentation.
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Link: https://patch.msgid.link/20261110183434.181711-4-linux@roeck-us.net
|
|
There are no in-tree users of emc2305_platform_data. Active PWM channel
count is detected from the chip product ID register, and per-channel PWM
and thermal cooling parameters are configurable via devicetree child
nodes.
Move EMC2305_PWM_MAX into the driver, drop platform data support, and
remove the unused platform_data header file.
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Link: https://patch.msgid.link/20261110183434.181711-3-linux@roeck-us.net
|
|
The asd7828 driver supports both DT and platform_data based
probing, but nothing uses the latter.
Remove the platform_data header and simplify the driver to
make it DT-only.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
[groeck: Fixed subject, dropped initialization of diff_input]
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
|
