| Age | Commit message (Collapse) | Author |
|---|
|
https://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux.git
|
|
# New commits in timers/urgent:
e7cad586d732 ("timers: Clear pending_map on CPU hotplug")
Signed-off-by: Ingo Molnar <mingo@kernel.org>
|
|
# New commits in sched/urgent:
7dbc307b6c72 ("sched/mmcid: Fix affinity-triggered switch back to per-task mode")
Signed-off-by: Ingo Molnar <mingo@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
Pull hardening updates from Kees Cook:
- Provide kmalloc_obj*-style API for devm_kmalloc()
- Improve seq_buf API for saner C String handling with several bug
fixes along the way (Kees Cook, Bill Wendling)
- Overflow helper readability improvements (Bill Wendling)
- Unexport native_write_cr4() (Dennis Chen)
- um: fix CONFIG_GCOV for built-in code (Johannes Berg)
- Improve stackinit test coverage (Justin Stitt)
- KMSAN: fix memset() when using fortify-source, again (Arnd Bergmann)
- lkdtm: use kmalloc() instead of __get_free_page (Mahad Ibrahim)
- signalfd: don't dequeue the forced fatal signals (Oleg Nesterov)
- Fix randstruct to recognize new container_of() behavior
- coccinelle: kmalloc_obj: Convert multi-byte integral allocations too
- Fix a couple remaining allocation return type mismatches
* tag 'hardening-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: (29 commits)
overflow: Match arithmetic in both parts of __builtin_choose_expr
lkdtm: Make UNSET_SMEP built-in-only and unexport native_write_cr4()
extcon: realtek: Remove const from type_c_cfg allocation type
coresight: cti: Add const to con_groups allocation type
docs: core-api: Document the seq_buf API
nvdimm: ndtest: Return the string length from flags_show()
powerpc/papr_scm: Return the string length from the sysfs show functions
seq_buf: Add seq_buf_init_append()
bpf: Remove dead newline stripping from format_disasm_line()
seq_buf: Add seq_buf_terminate()
seq_buf: Add seq_buf_strlen()
seq_buf: Clear what a writer did not claim when a seq_buf overflows
seq_buf: Copy what fits when seq_buf_puts() and seq_buf_putmem() overflow
scsi: lpfc: Print rx monitor records straight into the seq_buf
seq_buf: Do not pop from an overflowed seq_buf
seq_buf: Do not print an empty line from an overflowed seq_buf_do_printk()
.get_maintainer.ignore: Add Kees Cook
devres: Provide kmalloc_obj*-style API for devm_kmalloc
mm: Move default_gfp() into gfp_types.h
kunit/stackinit: Clean up XFAIL under instrumentation
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
Pull seccomp updates from Kees Cook:
- allow addfd to transfer O_PATH descriptors (Cong Wang)
- allow restarting interrupted unreceived notifications (Cong Wang)
- fix SECCOMP_ADDFD_FLAG_SEND when interrupted (Hui Peng)
- Various docs and test clean-ups
* tag 'seccomp-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
selftests/seccomp: Split fork_and_close into clone and close tests
seccomp: Document RESTART_BEFORE_RECV and O_PATH addfd
selftests/seccomp: test addfd with an O_PATH descriptor
seccomp: allow addfd to transfer O_PATH descriptors
docs/seccomp: describe the SECCOMP_FILTER_FLAG_RESTART_BEFORE_RECV flag
selftests/seccomp: cover restart of unreceived notifications
seccomp: allow restarting interrupted unreceived notifications
seccomp: restore knotif->state when SECCOMP_ADDFD_FLAG_SEND is interrupted
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext
Pull sched_ext updates from Tejun Heo:
- Proxy execution can now be enabled together with sched_ext. A BPF
scheduler can opt in to receive mutex-blocked tasks that donate their
scheduling context to the lock owner and place them itself.
- Lazy preemption: a BPF scheduler can preempt or kick a CPU lazily,
deferring the switch to the next return to user space or tick, as the
fair class can.
- Sub-schedulers: a parent now learns which child runs on each CPU it
delegated and when a cap change takes effect. A detaching child loses
its caps before the parent restores the CPUs.
- New kfuncs re-enqueue single tasks from a dispatch queue iteration
and report a cgroup's CPU count and a CID's NUMA node. The CID
topology now includes clusters.
- Hot path optimizations: dispatch queue and task lookups compare keys
inline, remote task moves no longer take a dispatch queue lock twice,
and sub-scheduler hooks cost nothing without sub-schedulers.
- Kfuncs callable from tracing programs are hardened against NMI and
IRQ nesting, which could hard-lock the CPU or pick a wrong idle CPU.
- Built-in dispatch queues no longer allocate per-CPU state that grew
with the square of the CPU count.
- Header syncs with the scx repo, a BTF workaround for pahole 1.32, and
selftest fixes and coverage.
* tag 'sched_ext-for-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: (69 commits)
sched_ext: Drop the locks periodically while walking a user DSQ for re-enqueue
sched_ext: scx_qmap: Also re-enqueue stranded tasks with scx_bpf_dsq_reenq_task()
sched_ext: Add scx_bpf_dsq_reenq_task() to re-enqueue single tasks from a DSQ iteration
sched_ext: Factor out the rq lock switch of scx_dsq_move()
sched_ext: Don't queue balance callbacks from a core-sched pick
sched_ext: Don't leave balance callbacks queued across a pick retry
sched_ext: Fix a bypassed task stalling on a cpu its scheduler has no caps on
sched_ext: Fix the running task keeping its protection into bypass
sched_ext: Fix use-after-free of a local reenq node left on an inactive cpu
sched_ext: Keep proxy donors with slice left on the local DSQ
selftests/sched_ext: Report reload_loop attach failures
selftests/sched_ext: Bound exit waits
selftests/sched_ext: Add SCX_ASSERT_ALIVE and adopt it
selftests/sched_ext: Fail loudly when EXIT_KIND is missing from BTF
sched_ext: Add SCX_ECODE_RSN_CGROUP_OFFLINE to user_exit_info.h
selftests/sched_ext: Fix reload_loop error-path use-after-free
selftests/sched_ext: Fix build error in dequeue_remote selftest
sched_ext: scx_qmap: Reset a child's cpuperf targets once its PERF revoke takes effect
sched_ext: Add ops.sub_child_ecaps_updated() to report a child's effective cap changes
sched_ext: scx_qmap: Show actual cid use per participant
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
Pull cgroup updates from Tejun Heo:
- A write to cgroup.subtree_control or cgroup.type could hang in D
state for as long as a task pinning a dying controller took to exit,
as syzbot reported. The wait is now interruptible.
- cpuset: the deadline bandwidth check ran on cpusets that weren't
valid partition roots, failing cpuset writes with -EBUSY while
deadline tasks existed. The CPU count the fair class takes from
cpuset assumed a shared hierarchy that cgroup1 may not have.
- Finding a cgroup's effective controller state no longer walks up the
hierarchy, for per-I/O users such as nvmet. io.stat reads of cgroups
without block devices skip the stat flush.
- cpuset v1-only code moved to the v1 file and the exclusive flag
dropped from v2, with documentation corrections for partition roots
and boot-isolated CPUs.
- Dead cgroups fail writes with -ENODEV consistently, plus small
cleanups.
- Selftest fixes, most visibly for tests that skipped on machines with
many mounts, and a new pids.events notification test.
* tag 'cgroup-for-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: (27 commits)
selftests/cgroup: test pids.events notification
selftests: cgroup: make test_memcg_sock check flushed sock stats
selftests: cgroup: skip test_memcg_sock under cgroup.memory=nosocket
selftests/cgroup: Free the paths returned by cg_control()
selftests: memcg: Don't close an uninitialized fd
cgroup: Track the effective css in each cgroup
cgroup/cpuset: Move cpuset_update_flag() to cpuset-v1.c
selftests: cgroup: Preserve command arguments in with_stress.sh
selftests: cgroup: Enable the cpu controller in test_cpu
cgroup/cpuset: Use cpuset_v2() in cpuset_num_cpus()
selftests/cgroup: add settings file with a longer timeout
cgroup/cpuset: Remove CS_CPU_EXCLUSIVE handling code from v2
cgroup/cpuset: Run SCHED_DEADLINE shrink test on valid partition root only
docs: cgroup-v2: Describe effective CPUs of partition roots
docs: cgroup-v2: Describe boot-isolated CPUs in cpuset.cpus.isolated
cgroup/cpuset: Remove redundant sched domain rebuild from update_prstate()
selftests/cgroup: don't crash on a truncated mount entry in cg_find_root()
selftests/cgroup: read the entire file in read_text()
blk-cgroup: skip rstat flush for cgroups without blkgs
cgroup: use assign_bit() where applicable
...
|
|
Pull workqueue updates from Tejun Heo:
- Flushing a workqueue now visits only the queues used since the last
flush instead of one per possible CPU. Idle flushes get 10 to 100
times faster on large machines, which XFS hits on every log force.
- Per-cpu workqueues are built through the same attribute path as
unbound ones and get a max_active of their own, continuing the work
to turn them into an affinity scope of unbound workqueues.
- New tracepoints for work items turning CPU-intensive, rescuer mayday
and rescue events, and BH workers yielding with work pending.
- A KCSAN annotation and small cleanups
* tag 'wq-for-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq:
workqueue: mark pool->nr_running as __data_racy
workqueue: BUG_ON() a pwq release before workqueue_init()
workqueue: Derive the standard attrs from the workqueue flags
workqueue: Give percpu workqueues their own max_active
workqueue: Make flush_workqueue() visit only pwqs active since the last flush
workqueue: Maintain pwq->total_in_flight
workqueue: Add for_each_node_with_fallback()
workqueue: Fix typo "upto" in comment
workqueue: Add workqueue_bh_budget_yield tracepoint
workqueue: Add workqueue_mayday and workqueue_rescued tracepoints
workqueue: Add workqueue_cpu_intensive tracepoint
workqueue: rename the pwq slot helpers shared with percpu
workqueue: build percpu pwqs through the attrs path
workqueue: make the default pwq optional
workqueue: resolve the backing pool in alloc_pwq()
workqueue: move the unbound-only attrs check to apply_workqueue_attrs()
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
Pull crypto updates from Herbert Xu:
"API:
- Fix algif_skcipher source SG overrun
- Allow hmac(sha512) for non-root users
Algorithms:
- Add wrapper for zeroing AES key context
- Avoid redundant stream initialisations in zstd
Drivers:
- Remove hisilicon/sec.
- Handle digest-only authenc requests in atmel
- Handle zero-length skcipher requests in mxs-dcp
- Lower the default priority of caam/qi2
Others:
- Optimise key comparison in rhashtable lookup that uses constant
parameters"
* tag 'v7.4-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (146 commits)
crypto: atmel-tdes - consolidate error paths in atmel_tdes_dma_init()
crypto: atmel-tdes - reuse fast in atmel_tdes_crypt_start()
crypto: atmel-tdes - use separate DMA scatterlists
MAINTAINERS: delete entry for John Allen
hwrng: amd - use PMBASE_OFFSET consistently
hwrng: cctrng - simplify cctrng_probe()
hwrng: intel - simplify intel_rng_mod_init()
crypto: qat - fix use of destroyed vf2pf_lock on VF restart
crypto: qat - initialise state_lock on every path in adf_devmgr_add_dev()
hwrng: imx-rngc - Use optional clock
crypto: talitos - init tasklets before requesting IRQs
crypto: algif_skcipher - rewind rounded output bytes
crypto: algif_hash - Allow hmac(sha512) for unpriviledged users
crypto: sa2ul - Remove unused fields
hwrng: stm32 - use devm_platform_ioremap_resource() in stm32_rng_probe()
hwrng: stm32 - drop redundant initializations
hwrng: amd - simplify control flow in amd_rng_mod_init()
hwrng: stm32 - reuse clock rate in stm32_rng_clock_freq_restrain()
hwrng: stm32 - use swap() in stm32_rng_probe()
hwrng: cctrng - drop redundant initializations
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm
Pull pmdomain updates from Ulf Hansson:
"pmdomain core:
- Add a genpd config to support unknown initial status
- Add support system wide resume latency constraints
- Enable a non-CPU device in a CPU PM domain to do power on
- Fall back to use device node name for domain idle states
pmdomain providers:
- cpuidle-psci: Initialize the PM domains in powered off state for OSI
- cpuidle-psci: Move initialization a bit earlier in the boot sequence
- qcom: Add NMXC power domain for Nord
- qcom: Add support for SM7250, Kuno and MSM8952 power domains
- renesas: Add support for r8a774a3 SYSC power domains
- renesas: Fix lockdep false positive for r8a78000
- riscv: Add RPMI device power service
- st: Add the actual power domains on U8500
- st: Convert Ux500 PM domains to schema
pm qos:
- Add a flag for system wide latency constraints
- Add lockless read for flags"
* tag 'pmdomain-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: (36 commits)
dt-bindings: arm: Add the actual power domains on U8500
dt-bindings: arm: ux500: Drop NR_DOMAINS
dt-bindings: power: Convert Ux500 PM domains to schema
dt-bindings: power: rpmpd: Add MSM8952 power domains
pmdomain: rockchip: drop duplicated errno from supply failure message
pmdomain: core: add support system-wide resume latency constraints
pmdomain: core: add genpd_for_each_child() helper
PM / QoS: add lockless read for flags
PM / QoS: add flag to indicate latency applies system-wide
pmdomain: renesas: rcar-sys: Add r8a774a3 support
dt-bindings: power: Add r8a774a3 SYSC power domain definitions
dt-bindings: power: renesas,rcar-sysc: Document vendor-prefixed header paths
pmdomain: imx93-blk-ctrl: Use pm_runtime_resume_and_get()
pmdomain: imx8m-blk-ctrl: Use pm_runtime_resume_and_get()
pmdomain: imx: gpcv2: Use pm_runtime_resume_and_get()
pmdomain: rockchip: Fix domain check in rockchip_pm_add_one_domain()
pmdomain: core: Fall back to node name for idle states
pmdomain: renesas: r8a78000: Fix lockdep false positive
pmdomain: fix typo "releated" in comment
pmdomain: imx: Propagate SCU provider registration failures
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux
Pull pwm updates from Uwe Kleine-König:
"The usual mix of fixes for older issues, devicetree changes and
cleanups.
Part of this is a shared branch that introduces device-managed
variants of atomic_notifier_chain_register() and
blocking_notifier_chain_register()"
* tag 'pwm/for-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux:
dt-bindings: pwm: Add IPQ5210 binding
pwm: tiehrpwm: Clear period on disable to allow reconfiguration
pwm: Allow 32-bit tasks to use the character device
pwm: lp3943: fix NULL pointer dereference for an unconfigured channel
pwm: mtk-disp: Fix period readback
pwm: ipq: Prevent potential 32-bit integer overflow in hi_div calculation
pwm: loongson: Reload PWM configuration through counter reset
pwm: Fix typos in comments
dt-bindings: pwm: Convert TI PWM Subsystem to DT schema
docs: pwm: Fix bracket and punctuation
pwm: iqs620a: Use devm_blocking_notifier_chain_register()
pwm: renesas-tpu: Fix runtime PM reference leak
notifier: add device-managed registration APIs
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core
Pull driver core updates from Danilo Krummrich:
"Core:
- Add TAINT_FORCED_BIND to taint the kernel and driver module before
manual sysfs bind/unbind operations; make add_taint_module()
available to driver core and update taint decoding tools and
documentation
- Constify device_show/store_*() attribute parameters and adapt x86
MCE and perf users to prepare for const dev_ext_attribute instances
- Fix UAF in NUMA access node registration failure handling by
dropping the device reference with put_device() instead of directly
freeing the node
debugfs:
- Make debugfs_create_str() read-only to eliminate double-free races
between concurrent writers; reject writable modes; convert
interconnect and SoundWire users to local file operations with
mutex-protected strings
kobject:
- Fix out-of-bounds access in kobject_action_type() when parsing
action strings containing embedded NUL bytes
- Fix the kobject_set_name() reference in kset_register() kernel-doc
Rust:
- DMA:
- Tie Coherent, CoherentBox and CoherentHandle to the device's
bound lifetime to prevent retaining DMA allocations beyond
driver unbind; propagate the lifetime through nova-core and the
DMA sample driver
- I/O:
- Require explicit base types for registers and replace relative
registers with typed subregion projections; reimplement
register!() as a proc macro, support registers using existing
types without inline bitfields, and convert nova-core, Tyr and
the PCI sample; add AsRepr/AsReprMut and transmute helpers with
deferred size checks for representation conversions
- Wrap ResourceSize in a transparent newtype with explicit
conversions, including checked conversion to usize
- PCI:
- Add typed PCIe extended capability lookup and SR-IOV accessors
for the First VF Offset and decoded VF BAR addresses and widths,
keeping raw SR-IOV registers private to preserve PCI core
ownership of their state
- scatterlist:
- Honor the device's maximum segment size as well as the DMA
mapping limit when constructing SG tables
- Return u32 from SGEntry::dma_len() to match the C segment length
type
- misc:
- Validate auxiliary DeviceId name length explicitly to improve
compile-time diagnostics for oversized device ID table entries
- Drop unnecessary 'static bounds from debugfs ScopedDir file
creation methods to support data containing non-'static
references, including DMA buffers
Misc:
- Add Johan Hovold as driver core maintainer
- Simplify platform_device_alloc() by returning early on allocation
failure
- Fix typos in driver core and kernfs comments"
* tag 'driver-core-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: (41 commits)
rust: pci: add extended capability and SR-IOV support
kobject: Fix the kobj_set_name reference in kset_register() kernel-doc
rust: io: convert ResourceSize into a transparent newtype
rust: scatterlist: return u32 from SGEntry::dma_len()
MAINTAINERS: add myself as driver core maintainer
debugfs: make debugfs_create_str() read-only
soundwire: debugfs: replace writable string helper
interconnect: debugfs: replace writable string helper
docs: admin-guide: Handle TAINT_FORCED_BIND when parsing /proc/sys/kernel/tainted
driver core: platform: Simplify platform_device_alloc()
kobject: fix out-of-bounds access in kobject_action_type()
rust: scatterlist: honor the device's maximum segment size
driver core: add TAINT_FORCED_BIND for when userspace manually messes with devices and drivers
module: fix up documentation for add_taint() and add_taint_module()
module: pull out add_taint_module() to be public
driver core: Constify the signature of device_show/store_*()
drivers: perf: Use __DEVICE_ATTR() macro to initialize dev_ext_attribute
x86/mce: Use __DEVICE_ATTR() macro to initialize dev_ext_attribute
rust: auxiliary: validate DeviceId name length
driver core: fix typos in comments
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull power management updates from Rafael Wysocki:
"This time, the most visible part are the ACPI CPPC updates from
Christian Loehle, including CPPC cpufreq driver changes, even though
updates of cpufreq drivers proper are still the largest topic group.
However, the updates of cpufreq drivers depend on the ACPI CPPC
updates, so they should really be counted together and that is well
over 1/2 of the total commit count.
Interestingly enough, almost all of the updates included here are
fixes or cleanups, with some new feature support in the amd-pstate
cpufreq driver and IPQ9650 support in the qcom-nvmem cpufreq driver.
The runtime PM documentation improvements from Brian Norris can also
be mostly regarded as fixes, but a new kunit test goes along with
them.
Specifics:
- Fix multiple issues related to input validation, synchronization,
access safety, memory layout and register field validation, and
error handling in the ACPI CPPC library (Christian Loehle and Sumit
Gupta)
- Select the frequency-invariance callback per CPU in the CPPC
cpufreq driver and create the FIE worker before enabling PCC
callbacks in it to avoid queueing work through a missing worker and
dereferencing a NULL pointer (Christian Loehle)
- Update the CPPC cpufreq driver entry in MAINTAINERS and add a new
entry for the ACPI CPPC library (Christian Loehle)
- Minor fixes in various cpufreq drivers (Alexander Koskovich, Daniel
Schwierzeck, Frank Zhang, Haotian Zhang, Kathiravan Thirumoorthy,
Sumeet Pawnikar, and Xueqin Luo)
- Fix wrong behaviors on multi-node servers in the Loongson cpufreq
driver (Huacai Chen)
- Reject NULL from cpufreq_cpu_get() in the Rust code (Mehmet
Koseoglu)
- Add suspend OPP to mediatek cpufreq driver and DT (Ryan Brue)
- Fixups for a few bugs identified by Sashiko in the amd-pstate
cpufreq driver (Mario Limoncielloi, Wentao Guan)
- Initial support for maximum frequency capacity handling on Zen6
client in amd-pstate (Mario Limonciello)
- Fix for amd-pstate-ut with 'Requested CPU Min frequency' BIOS
option (K Prateek Nayak)
- New Zen6 tuning values for EPP in amd-pstate (Mario Limonciello,
Vishal Badole)
- amd-pstate documentation fix (Karl Mehltretter)
- Restrict deferred downscaling to low load for shared policies in
the conservative cpufreq governor to avoid undesirable CPU
frequency reduction in some cases (Shengming Hu)
- Serialize sugov_start() against rate limit updates in the schedutil
cpufreq governor to avoid using a stale rate limit value (Hui Su)
- Prevent cpuidle governors menu and teo from returning idle state 0
after it has been disabled (Xueqin Luo)
- Replace min_t() with the better alternatives in the intel_idle
driver and make it use 2-argument strscpy() (Andy Shevchenko)
- Fix two repeated phrase instances in cpuidle (Hemanth Selam,
Syazwina Fazrul)
- Add rugged Panther Lake support to the intel_rapl power capping
driver and make it use %pe for printing error pointers (Srinivas
Pandruvada and Sumeet Pawnikar)
- Update and improve runtime PM documentation and add a kunit test
for supplier idle/suspend (Brian Norris)
- Add a pm_runtime_dont_use_autosuspend() call to pm_runtime_reinit()
to ensure autosuspend disabling on driver teardown (Joshua Crofts)
- Ignore page-zero RAM in E820 checksum during hibernation on x86 to
avoid rejecting images created after kexec() (Matthias Goergens)
- Add resume event mapping for PMSG_POWEROFF to the PM core to allow
it to carry out device shutdown in the future (Mario Limonciello)
- Add DPM watchdog to prepare/late/early/noirq/complete phases of
device suspend and resume (Mayank Rungta)
- Update swsusp.txt references to swsusp.rst in hibernation
documentation (Li Jun)
- Fix use-after-free of perf domain in netlink doit handlers for
energy models (Fan Wu)
- Add synchronize_rcu() back to cpu_pm_unregister_notifier() after it
was removed inadvertently in previous development cycles to avoid
use-after-free (Bradley Morgan)
- Unregister CPU PM notifier outside the timer lock in the
timer-ti-dm clocksource driver (Bradley Morgan)
- Fix typo "sucessfully" in a comment in pm_clk_add_clk() kerneldoc
comment and typo "hierachy" in a comment in pm-graph (Hemanth
Selam)
- Fix the return value in dev_pm_opp_get_of_node() kernel-doc (Karl
Mehltretter)"
* tag 'pm-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (89 commits)
cpufreq: loongson3: Replace IOCSR read/write with MMIO ones
cpufreq: loongson3: Use global physical CPU ID in get/target callbacks
cpufreq: loongson3: Replace per-package mutex with per-node
cpufreq: loongson3: Adjust the width of id and val in smc_message
cpufreq: loongson3: Make this driver depend on MACH_LOONGSON64
PM: runtime: Expand introduction with core concepts and structure
cpufreq: schedutil: Serialize sugov_start() against rate limit updates
MAINTAINERS: ACPI: Add a separate CPPC entry
MAINTAINERS: cpufreq: Replace CPPC reviewer
arm64: dts: mediatek: mt8173: Mark the lowest CPU OPPs for suspend
cpufreq: mediatek: Enter system sleep at the suspend OPP
cpufreq: qcom-cpufreq-hw: fix device node refcount leak in phandle parsing
cpufreq: qcom-nvmem: Add IPQ9650 support
cpufreq: Add Milos to cpufreq-dt-platdev blocklist
cpufreq: Use %pe to print error pointers symbolically
rust: rcpufreq_dt: add module alias
cpufreq: sti: avoid NULL dereference in dev_err()
cpufreq: tegra194: fix double-pointer error in get_cpu_ndiv
cpufreq: sparc-us2e: fix frequency table index copy-paste error
rust: cpufreq: reject NULL from cpufreq_cpu_get()
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull VDSO updates from Thomas Gleixner:
"Updates for the VDSO subsystem:
- Ensure that the CLOCK_AUX base calculations are properly scaled
against the base timekeeper. The update function failed to take the
fractional nanosecond part into account, which results in a
rounding error.
- Cleanup and consolidate the vsyscall headers to get rid of
pointless copies all over the architectures.
- Replace a runtime conditional in the time getter function for
namespaced clocks by simple pointer arithmetic which speeds up the
read function"
* tag 'timers-vdso-2026-10-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
vdso/vsyscall: Keep the CLOCK_AUX base scaled
vdso/math64: Add and use __iter_div64_u64_rem()
vdso/math64: Use OPTIMIZER_HIDE_VAR() in __iter_div_u64_rem()
vdso/gettimeofday: Avoid runtime conditional in do_hres_timens()
vdso: Remove __ASSEMBLER__ guards from vsyscall.h
vdso: Add asm-generic/vdso/vsyscall.h
vdso: Remove unnecessary vdso/vsyscall.h includes
riscv/hwprobe: Include vdso/datapage.h
arm64/vdso: Delete asm/vdso/vsyscall.h inclusions
x86/vdso: Delete asm/vdso/vsyscall.h inclusions
sparc/vdso: Delete asm/vdso/vsyscall.h inclusion
s390/vdso: Delete asm/vdso/vsyscall.h inclusions
sparc/vdso: Move __VDSO_PAGES to asm/vdso.h
x86/vdso: Move vDSO page definitions to asm/vdso.h
vdso: Delete asm-generic/vdso/vsyscall.h
vdso/vsyscall: Define fallback time synchronization functions in vsyscall.c
vdso/getrandom: Define fallback __arch_get_vdso_u_rng_data() in getrandom.c
vdso/gettimeofday: Define fallback __arch_get_vdso_u_time_data() in gettimeofday.c
vdso: Move the kernel-side time update helpers to a new header
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull NOHZ updates from Thomas Gleixner:
"Updates for the tick/NOHZ machinery:
- Add the BLOCK_SOFTIRQ to the hotplug safe local softirq pending
mask to prevent false positive error messages. A BLOCK_SOFTIRQ can
be pending when a CPU goes offline as the subsequent cleanup will
take care of the outstanding completions.
- Remove a few redundant invocations of local_irq_save/restore() and
timekeeping_max_deferment() to speed up the NOHZ idle transitions"
* tag 'timers-nohz-2026-10-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
tick/nohz: Avoid unused timekeeping_max_deferment() calls
tick/nohz: Remove redundant local_irq_save()/restore()
tick/nohz: Add BLOCK_SOFTIRQ to the hotplug safe mask
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull timer core updates from Thomas Gleixner:
"Updates for the core timekeeping and timers subsystem:
- Futher cleanups for the POSIX timer exit/exec related code to
simplify the code flow and to make it more robust against future
changes.
- Prevent tearing of timekeeper::ktime_sec which can be accessed
without the sequence count protection.
The timekeeper is updated by memcpy() with an uneven sequence count
to force readers into the retry path. On 64-bit machine the
ktime_sec member can be accessed atomically without the sequence
count protection. That is only correct when the update side
memcpy() guarantees atomicity at the 64-bit granularity. That's not
guaranteed due to debug options, compilers and instruction
availability. If the memcpy() does not provide the atomicity then
the unprotected readers can observe store tearing.
To prevent this write the ktime_sec member before the memcpy() so
that a non-atomic memcpy() will write the same data. A similar fix
has been done for the xtime_sec member, but the ktime_sec
equivalent was missed.
- Prevent time64_to_tm() day truncation on 32-bit kernels
The function receives a 64-bit seconds value but stores the
quotient of the computation in a long, which truncates the result
for large input values. Cure this by using div_s64_rem() which
stores the quotient in s64 and only leaves the seconds-within-day
reminder in a long, which is guaranteed to fit. This fix comes with
a corresponding kunit test to prevent further mishaps.
- Mark data-racy accesses to the hrtimer_sleeper::task member.
The recent updates to KCSAN flagged these benign races. Annotate
them with new helper functions, convert all existing usage sites
and mark the task member private after that so that future users
which fail to use the helpers can be detected automatically.
- Address similar benign KCSAN flagged issues in the hrtimer, timer
and timer migration code.
- Fixes for a few selftest issues"
* tag 'timers-core-2026-10-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (26 commits)
selftests/timers: clocksource-switch: Fix unchecked open()/read()
selftests: timers: Measure the CPU timers on the clock they count
selftests: timers: Count what tick is worth in the drift estimate
time/kunit: Add time64_to_tm() case beyond 32-bit day count
time: Prevent time64_to_tm() day truncation on 32-bit
timekeeping: Use READ_ONCE/WRITE_ONCE() for ktime_sec to prevent tearing
timers/migration: Mark racy updates to tmigr_event::ignore field
timers: Mark racy updates to hlist_node::pprev field
hrtimer: Apply READ_ONCE() to lockless base->running loads
hrtimer: Mark the hrtimer_sleeper structure's ->task field __private
hrtimer: Update hrtimer_resolution only if value changes
futex: Use accessor for hrtimer_sleeper ->task field in requeue
rtmutex: Use accessor for hrtimer_sleeper ->task field
net: pktgen: Use accessor for hrtimer_sleeper ->task field
timers: Use accessor for hrtimer_sleeper ->task field in sleep_timeout.c
futex: Use accessor for hrtimer_sleeper ->task field in waitwake.c
io-uring/rw: Use accessor for hrtimer_sleeper ->task field
wait: Use accessor for hrtimer_sleeper ->task field
aio: Use accessor for hrtimer_sleeper ->task field
hrtimer: Mark data-racy accesses to hrtimer_sleeper ->task field
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull irq chip driver updates from Thomas Gleixner:
"Updates for interrupt chip drivers:
- Remove the futile attempts to cleanup resources when the probing of
the main interrupt chip fails for SiFIVE/PLIC devices. If that
probe fails the system will stall immediately afterwards in the
boot process without reaching a state where the error could be
diagnosed. The lack of resource cleanup led to a frenzy of AI
detected/assisted "fixes" which just make the code pretend to be
correct for no value.
Remove the existing half baked cleanup and immediately panic the
machine when the probe fails. That's far more useful than letting
it proceed and stall out a millisecond later with no information
about the root cause.
- A series of fixes for the ARM GIC-V3 driver addressing a potential
double free, a bitmask overrun on 32-bit ARM and a OF node leak.
- Automatically set the IRQ_DOMAIN_FLAG_DESTROY_GC when a interrupt
domain is created that also allocates the generic interrupt chip
during domain creation. That removes the requirement for manually
setting the flag in the domain creation info structure when it
contains a valid entry for allocating the generic interrupt chip.
Remove the therefore redundant setters of
IRQ_DOMAIN_FLAG_DESTROY_GC in the existing drivers.
- Add support for Annapurna Labs FIC version 2 and 3 and implement
affinity control for the demultiplexed interrupts by utilizing the
recently merged interrupt redirection infrastructure.
- Convert the ACPI device ID structures to named initializers
- Consolidate the IPI related constants for RISC-V interrupt
controllers
- Add support for Qualcomm Purwa SoC interrupt chip and consolidate
the workaround for the previous version in Hamoa SoCs.
- The usual small fixes and improvements all over the place"
* tag 'irq-drivers-2026-10-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (61 commits)
irqchip/al-fic: Support per-child affinity via interrupt redirection
irqchip/al-fic: Add support for FIC v3
irqchip/al-fic: Support error and fatal outputs and FIC v2
dt-bindings: interrupt-controller: amazon,al-fic: Add mask selection
irqchip/al-fic: Switch to shared parent interrupt
irqchip/al-fic: Keep the device_node instead of a cached name string
irqchip/al-fic: Use %pOF and raise init log level
irqchip/al-fic: Use %pe to print init error
irqchip/al-fic: Fix coding style issues
irqchip: Use named initializers for acpi_device_id
irqchip/gic-v5: Fix standalone IRSes OF probe
dt-bindings: interrupt-controller: gicv5: Relax IRS properties constraints
irqchip/renesas-rzv2h: Preserve TIEN state in rzv2h_tint_set_type()
irqchip/loongson-eiointc: Use pa_to_nid() rather than hard-code
irqchip/riscv-imsic: Expose the fwnode via the global config
irqchip/meson-gpio: Allow the GPIO interrupts to wake the system
irqchip/gic-v3: Ensure change to DS is visible
irqchip/mips-gic: Transfer interrupt mask state across clusters
irqchip/mips-gic: Fix recursive acquisition of gic_lock in gic_set_affinity()
irqchip/mips-gic: Fix unbalanced cm_core_lock in for_each_online_cpu_gic()
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull irq updates from Thomas Gleixner:
"Updates for the generic interrupt subsystem:
- Skip programming of MSI/MSI-X related data while a PCI channel is
offline (Link is down) in the error recovery code path. Accessing
an offline channel results in a BUS error which affects the
underlying Root Port.
Check for pci_channel_offline() and if true avoid the writes and
just cache the modifications which are subsequently applied when
the Link has recovered.
- Prevent a stack UAF when a faulting interrupt thread exits. On X86
the crash causes the stack to be discarded, which contains the
callback head for the exit task_work to run the destructor. If the
stack is clobbered before the destructor runs, then the indirect
call of the task work function ends up in a random place. Move the
callback head into the interrupt action to prevent that.
- Prevent an UAF in the interrupt thread exit code which can happen
when a faulting interrupt thread exits and races with a concurrent
free_irq() by synchronizing free_irq() against thread exit.
- Ensure that interrupt context accounting is accurate on interrupt
return when checking for soft interrupt invocation.
The code removed the hard interrupt context prematurely so that the
subsequent code appeared to be in task context according to the
preempt counter. That confuses ftrace, perf and K*SAN which get
their recording context wrong. On Preempt-RT this can result in
misbehaviour when BPF programs are attached to the affected region.
Cure it by preserving the hard interrupt count up to the point
where soft interrupts are actually invoked and switch directly to
soft interrupt processing right there. That avoids the intermediate
"in task context" state.
- The usual small fixes and improvements"
* tag 'irq-core-2026-10-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
genirq/proc: Fix missing CPU header in /proc/interrupts
PCI/MSI: Skip MSI/MSI-X programming while the channel is offline
genirq: Fix typos in comments
genirq: Move interrupt thread exit_work object to irqaction
genirq: Defer kfree(irqaction) until irq_thread_dtor() finishes
softirq: Preserve interrupt context on return from interrupt
softirq: Remove redundant h->action from preempt_count mismatch error
genirq: Discard cpumask of irqaffinity= boot parameter if parsing fails
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu
Pull CSD lock updates from Paul McKenney:
"Report CSD-lock stall recovery time:
- Refactor to simplify csd_lock_wait_toolong() function prototype
- Report time required to recover from a CSD-lock stall
- Add a test of this reporting"
* tag 'csd-lock.2026.10.12a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu:
lib/test_csd_lock: Add a module to stall a CPU on a CSD lock
locking/csd-lock: Report how long a stuck CSD lock took to recover
locking/csd-lock: Pack csd_lock_wait_toolong() state into a struct
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux
Pull Kbuild / Kconfig updates from Nathan Chancellor:
"Kbuild:
- Suppress compiler flags in debug info for external module builds
- Use '-fmacro-prefix-map' in more places in the build
- Merge initial set of changes from Lorenzo's speed up series, along
with some fixes found through testing:
- Avoid allocating .modinfo in vmlinux
- Speed up kallsyms by indexing symbols by token and outputting
binary data to disk directly then including in assembly via
.incbin
- Don't sort $(NM) output when unnecessary
- Only emit relocations on the final vmlinx link
- Reimplement mksysmap in C
- Move many cc-option and ld-option calls into the Kconfig stage to
cache their results
- Use pigz for gzip compression when available
- Move gen_init_cpio and gen_initramfs.sh from usr/ to scripts/
- Add a TOML configuration to scripts/container and update
documentation accordingly
- Add a generic, opt-in mechanism for checking that headers can
compile standalone
- Update machine function splitting argument for LLVM 24 rename in
AutoFDO build
- Miscellaneous minor clean ups, fixes, and hardening, mostly
found/fixed via LLMs
Kconfig:
- Turn recursive ranges into an error
- Fix savedefconfig for defaults that were adjusted for being out of
range and revert a previously applied workaround
- Improvements and hardening around integer and hexadecimal values
- Emit a warning when selecting or implying a choice symbol, which
has no effect
- Emit a warning when KCONFIG_PROBABILITY is malformed
- Introduce def_string / def_int / def_hex to mirror the existing
def_bool / def_tristate to succinctly set a value and type at the
same time.
- Add cc-option-str and ld-option-str macros to act like Kbuild's
cc-option and ld-option, returning the string when the option is
supported, allowing many checks to be moved into Kconfig
- Minor usability improvements to Kconfig tests"
* tag 'kbuild-7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux: (59 commits)
kbuild: AutoFDO: Update split machine function argument for upstream rename
kbuild: Mark the initcall ordering recipe as recursive
kbuild: Mark the gzip recipes as recursive
localmodconfig: Explicitly report boolean configs during integrity check
scripts/make_fit: Ignore schema checks when decomposing DTBs
clang-tools: Import os for broken pipe handling
kconfig: use the value argument in sym_get_near_range_bound()
kconfig: fix infinite loop in conf_choice() when no choice value is visible
kconfig: cleanup stale comment about 'keys' array
kconfig: Improve ergonomics around disabling warnings with cc-option
scripts/Kconfig.toolchain: Drop compiler symbols from dependencies
checkkconfigsymbols.py: Parse Git status output line by line
gen_init_cpio: stop parsing on lines with a missing argument list
.gitignore: drop Module.markers
.gitignore: ignore pacman package signatures
kbuild: add header check facility as a manually run static analyzer
Documentation: dev-tools: refer to user ID rather than id
Documentation: dev-tools: update container.rst with config file
scripts: add TOML config to container tool
kconfig: tests: {old,save}defconfig: Forward dynamic keyword arguments
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux
Pull RCU updates from Paul McKenney:
"Execution contexts and call_rcu() and call_srcu():
- Make call_rcu() and call_srcu invocable from NMI handlers and while
holding scheduler locks (using irq-work handlers)
- Add rcutorture and BPF tests calling these functions from these
contexts
- Disable rcutorture overload testing for RCU readers that are
"fragile", that is, that do not either disable preemption or have
some form of RCU priority boosting
SRCU updates:
- Add an atomic SRCU where readers run with preemption disabled and
grace periods can be invoked from atomic contexts. David Woodhouse
has a patch series exploiting this for GPC
- Add torture and lockdep tests for atomic SRCU
- Add numerous optimizations for atomic SRCU based on the fact that
it does not have callbacks, for example, eliminating any transition
to "big" srcu_struct structures even on systems that configure
these to happen at initialization time
Additional torture-test updates:
- Fix a divide-by-zero bug in forward-progress testing
- Synchronously wait for all IRQ-queued callbacks to complete
- Allow alternative "ssh" commands to be specified for use by
kvm-remote.sh
- Fix kvm-again.sh re-run failure on PowerPC
- Add additional lockdep testing for atomic SRCU
- Fix error double-counting in srcu_lockdep.sh
- Add atomic SRCU cross-CPU IRQ context mismatch testing, with the
- trick being that the atomic SRCU readers context must be at least
as strict as that of the atomic SRCU grace-period wait. So for
example, if the readers have IRQs disabled, so must the
grace-period wait
Miscellaneous updates:
- Update stallwarn.rst documentation for the re-implementation of RCU
Tasks Trace in terms of SRCU
- Fix the lazy-callback shrink scanner budget computation so that it
honors the reclaim budget
- Avoid panicking on RCU CPU stalls that end before the warning can
be printed
- Add "running" and "boosted" indications to the RCU task stall
warning output
- People have been (incorrectly) relying on rcu_barrier() to wait for
kfree_rcu() callbacks and processing. But it turns out to be easier
to fix rcu_barrier() to meet their expectations than to fix their
code to live within the earlier rcu_barrier() specification. So
rcu_barrier() now waits on kfree_rcu() callbacks and processing
- Disable RCU Tasks console output that track when this RCU flavor
switches between per-CPU and global callback queuing. New use cases
appeared that generated enough console traffic to cause trouble,
and no one seemed to care about these messages. For those needing
those messages, there is a new rcupdate.rcu_task_collapse_debug
kernel boot parameter
- Fix __rcu pointer attribute handling to eliminate false positives
- Fix typos and drop redundant #include directives"
* tag 'rcu.2026.10.12b' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux: (46 commits)
rcutorture: Add atomic SRCU cross-CPU IRQ context mismatch test
selftests/rcutorture: Fix double nerrs count in srcu_lockdep.sh
selftests/rcutorture: Wire atomic SRCU into srcu_lockdep.sh
rcutorture: Add atomic SRCU lockdep support
rcutorture: Fix kvm-again.sh re-run failure on ppc64
torture: Allow specifying alternative ssh command to kvm-remote.sh
rcutorture: Synchronously wait for all rcu_torture_irq() callbacks to complete
rcutorture: Fix divide-by-zero with fwd_progress_div=1
srcutree: Preserve IRQ state in synchronize_srcu_atomic() callchain
srcutiny: Add lockdep and early-boot checks to synchronize_srcu_atomic()
srcutree: Add lockdep and early-boot checks to synchronize_srcu_atomic()
srcutree: Skip torture to-big transition for atomic SRCU
srcutree: Don't transition atomic SRCU to big in srcu_gp_end()
srcutree: Make init_srcu_struct_atomic() prevent transition to big
srcu: Restrict atomic-SRCU non_block annotation to task context
srcutree: Remove srcu_barrier() sleep for atomic SRCU
srcutree: Skip callback scheduling for atomic SRCU grace periods
srcutree: Add reader-free fastpath to synchronize_srcu_atomic()
rcutorture: Add atomic-SRCU support to torture.sh
srcutree: Explicitly note DEFINE_SRCU() needs for srcu_barrier()
...
|
|
This is long over-due: the __get_user() and __put_user() functions are
entirely historical, and are never the rigth thing to use any more. And
when mis-used (read: every case) they are not only slower than the right
thing, but also insecure because they don't check the user address
range.
Most of the usage sites have been converted long ago, but various
left-overs remained. So this started out as a single patch that I wrote
as a "show people how to convert __{get,put}_user() to modern code".
In particular, Thomas last year implemented the very nice new scoped
user access region helpers (see commit e497310b4ffb: "uaccess: Provide
scoped user access regions") that makes the modern interfaces
particularly easy to use and really removes any excuse for the old
horrors.
That small example patch then grew to this, partly using Claude as a
glorified coccinelle script to apply the pattern to other places.
There were a few different reasons for using __put_user() and
__get_user() rather than the alternatives, but the original historical
one was performance: when doing multiple accesses off the same base
pointer, doing a single range check followed by multiple non-checked
accesses used to create smaller and faster code.
The keyword here is "used to". It hasn't been true for years, because
the range check isn't actually the real cost these days. The real cost
of user accesses on modern hardware is turning the user accesses on and
off in the first place (on x86, using the STAC/CLAC instructions).
Those sequences get turned into 'scoped_user_read_access() { }' blocks,
see for example that first patch in the series: "signal: use scoped user
access for old-style sigaction".
Another, historical reason for using __get_user() and friends is that
you actually want to do a kernel pointer access, but the pointer might
not be entirely reliable (typically during fault handling), so you want
to have exception handling for the kernel access.
The modern way to do that kind of non-faulting kernel access is using
"get_kernel_nofault()", but some code predates that helper existing at
all, and used __get_user() as a way to just get a memory access with
exception handling. For that pattern, see for example "alpha: use
get_kernel_nofault() in dik_show_code()"
A third bad reason for using __get_user() and friends was that the
proper get_user() had a "might_fault()" in it, and code that ran in
atomic regions but hadn't disabled page faults would result in a
warning. That kind of code needs to explicitly disable page faults,
because "atomic region" is not well defined at run-time and can be
invisible (eg a preempt-off region in a non-preemptible kernel).
See "vdpa_sim: disable page faults around vringh_need_notify_iotlb()"
for an example of that pattern, where the local_bh_disable() now also
grows a pagefault_disable(), which makes the normal get_user() no longer
warn about the user access in non-process context, because it can see
that the potential page fault will not cause problems.
And finally, the really nasty reason to use __get_user() and friends:
pointers that can be either kernel pointers or user pointers. We've
gotten rid of almost all such cases, but a couple remained. See for
example "x86/sev: Use explicit user-or-kernel accessors for #VC memory
operands".
NOTE! This series removes all __get/put_user() calls from generic code
but only does the final removal of the whole interface on x86. Other
architectures have not been entirely converted, for a variety of reasons:
- arm64 makes __{get,put}_user() be exactly the same as
{get,put}_user() so it's harmless and didn't have the dangers of the
legacy use cases.
- any architecture that uses <asm-generic/uaccess.h> will still use
__{get,put}_user as the underlying helper function name
- several architectures had some legacy uses that weren't entirely
trivial and I didn't want to extend this patch series to things that
I don't know and that don't really matter.
but I did do a couple of the obvious "follows the exact same pattern"
just because it could be done mindlessly and automatically.
Let's see if I broke anything, but we should have done this years ago.
* uaccess-cleanups: (48 commits)
drm/i915/gem: ignore errors on presumed_offset write-back
powerpc/align: use get_user_instr() for a user-mode instruction
powerpc/signal64: use scoped user access in setup_trampoline()
powerpc/signal64: use get_user() for the single context reads
powerpc/signal32: use get_user() for the single context reads
KVM: PPC: Book3S HV: use get_user()/put_user() for the HPT fd
powerpc/powernv: use get_user()/put_user() in the LPC debugfs files
s390: use get_user()/put_user() instead of the unchecked variants
ARM: OABI: use scoped user access in epoll_put_uevent()
ARM: signal: stop using __put_user() for the signal frame
ARM: signal: check the FDPIC function descriptor address
alpha: split the prefetch check in do_page_fault() by mode
openrisc: use get_kernel_nofault() in show_registers()
alpha: use get_kernel_nofault() in dik_show_code()
nios2: use scoped user access for the signal frame
nios2: check the signal frame address before writing to it
hexagon: use scoped user access for the signal frame
alpha: use scoped user access when setting up signal frames
alpha: use scoped user access in the sigreturn path
alpha: use scoped user access in osf_sigaction()
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm
Pull lsm updates from Paul Moore:
- Add LSM hooks, object blobs, and audit records for namespaces
Add the necessary bits to enable LSMs to enforce access controls on
the management of various kernel namespaces. While this pull request
does not contain any in-tree users of these hooks, the Landlock pull
request for Linux v7.4 will include Landlock support and the next
merge window will likely include SELinux support as well. Considering
the development behind these hooks, I expect that BPF LSM developers
will also be making use of the namespace hooks, if they haven't
already.
- Update the inode LSM hooks to include mount idmaps
This allows LSMs to incorporate the mount ID mapping into their
access control decisions. While there are no current in-tree users of
this, it was requested by those developing BPF LSM programs and this
pull request includes a BPF LSM selftest.
- Preserve the full 32-bit ioctl command in LSM audit records
Previously only the low 16 bits were logged, ignoring the direction
and size information in the upper 16 bits. The pull request also
includes a Landlock based selftest to verify the full 32-bit ioctl
value.
- Ensure we don't call security_backing_file_free() multiple times
Thankfully we don't have a problem with the current code base, but we
want to fix this behavior now before it becomes a problem.
- Clarify that only the current task may access current->cred
The current code is a bit misleading around safely accessing the cred
field in a task struct. Through comment and code corrections, this
pull request clarifies that only the task itself may access its cred
field.
- Add SLAB_NO_MERGE to the credential object cache
Harden the credential cache by ensuring credential objects live on
dedicated slab pages.
- Make use of safe memory zero'ing in the LSM Rust bindings
- Update the docs for the current behavior of /sys/kernel/security/lsm
- Update the docs for CONFIG_LSM and the "lsm=" command line option
- Remove unnecessary code
* tag 'lsm-pr-20261016' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm:
lsm: remove redundant NULL check in security_init()
selftests/landlock: Check full ioctl commands in audit records
lsm: Preserve full ioctl commands in audit records
doc: fix LSM ordering description for /sys/kernel/security/lsm
doc: describe CONFIG_LSM and lsm= as the selection mechanism
selftests/bpf: verify mount idmaps reach inode hooks
lsm: expose mount idmaps to inode hooks
rust: lsm: replace `core::mem::zeroed` with `pin_init::zeroed`
cred: prevent slab cache merging for cred_jar
lsm: don't call security_backing_file_free() multiple times
lsm: delete duplicate assignment in lsm_prepare()
lsm: update the BUILD_BUG_ON() in audit_log_lsm_data()
lsm: add LSM_AUDIT_DATA_NS for namespace audit records
lsm: add LSM blob and hooks for namespaces
ns: Free anonymous mount namespaces via ns_common_free()
cred: clarify that task_struct::cred is only for the current task
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit
Pull audit updates from Paul Moore:
- Fix the accounting of audit filter rule additions and removals
Tracking audit filter rules is important as their presence can
trigger additional processing. Unfortunately, the existing code did
not properly track the removal of filter rules, resulting in some
cases where additional processing was done when none was required.
This not only corrects the accounting problems, but also provides a
cleaner API for tracking audit filter rule additions and removals.
- Add a FSOPEN record to log the filesystem name in the new mount API
Close a long standing audit blindspot by capturing the filesystem
name, e.g. "tmpfs", when calling fsopen().
- Split audit's storage of process and file capabilities
Instead of a single structure that stores all possible capability
information, create a dedicated audit file capabilities struct and
convert the existing audit capabilities struct into a process
capabilities struct. This saves 80 bytes from the per-task
audit_context on 64-bit systems.
- Ensure that the PROCTITLE record is reset on exec()
This fixes a problem where systemd would set a temporary PROCTITLE
string after forking a child process before calling exec(),
effectively locking the PROCTITLE string to the temporary value. This
pull request resets the PROCTITLE state on exec() so that newly
executed processes can set their PROCTITLE correctly.
- Add some missing unlikely() annotations to the audit wrapper
functions
- Clean up the audit netlink multicast skb length adjustment
* tag 'audit-pr-20261016' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
audit: add FSOPEN record to log filesystem name
audit: separate file and process capability storage
audit: Fix filter rule accounting after automatic removal
audit: use copied skb length in kauditd_send_multicast_skb()
audit: add missing unlikely hint to audit_dummy_context() wrappers
audit: free proctitle in context so it can be re-set by fork on exec_binprm
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull perf events updates from Ingo Molnar:
- Support SIMD/eGPRs/SSP register sampling in perf
(Dapeng Mi, Kan Liang)
- Turn amd_uncore_ctx events into a flexible array (Rosen Penev)
- Finish the work related to fixing the guest PEBS path to not
set unwanted PERF_GLOBAL_CTRL bits, for which urgent fixes
are upstream already (Sean Christopherson)
- Drop redundant counter slot searches in the AMD uncore
driver (Usama Arif)
- Don't WARN when the ext_regs_buf allocation fails (vineash)
- Annotate x86_pmu::hybrid_pmu with __counted_by_ptr (Thorsten Blum)
* tag 'perf-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (34 commits)
perf/x86: Don't WARN when the ext_regs_buf allocation fails
perf/x86/amd/uncore: Free counter slot by index
perf/x86/amd/uncore: Remove redundant event slot scan
perf/x86/intel: Check only PMC bits in PEBS_ENABLED when detecting host PEBS usage
KVM: VMX: Only tell perf to enable PEBS counters for fully enabled PMCs
KVM: VMX: Drop a redundant pmu->global_ctrl check when processing pebs_enable
perf/x86/intel: KVM: Handle cross-mapped PEBS PMCs entirely within KVM
perf/x86: KVM: Have perf define a dedicated struct for getting guest PEBS data
perf/x86/intel: Invert names of intel_ctrl_{guest,host}_mask
perf/x86/intel: Annotate x86_pmu::hybrid_pmu with __counted_by_ptr
perf/x86/amd/uncore: Turn amd_uncore_ctx events into a flexible array
perf/x86/intel: Add sanity check for PEBS record/fragment size
perf/x86: Activate back-to-back NMI detection for arch-PEBS induced NMIs
perf/x86/intel: Advertise PERF_PMU_CAP_SIMD_REGS capability
perf/x86/intel: Support arch-PEBS based SIMD/eGPRs sampling
perf/x86: Support SSP sampling using sample_regs_* fields
perf/x86: Support eGPRs sampling using sample_regs_* fields
perf: Enhance perf_reg_validate() with simd_enabled argument
perf/x86: Support OPMASK sampling using sample_simd_pred_reg_* fields
perf/x86: Support ZMM sampling using sample_simd_vec_reg_* fields
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull locking updates from Ingo Molnar:
- In the refcount checking code, BUG() on UAF related errors if
CONFIG_BUG_ON_DATA_CORRUPTION=y (Jann Horn)
- Add {over,under}flow detection for local_interrupt_{enable,disable}()
(Boqun Feng)
- Add kunit test case for max local_interrupt_disable() nesting level
(Boqun Feng)
- Clarify comment (Boqun Feng)
* tag 'locking-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
irq: Add max local_interrupt_disable() nesting level kunit test case
irq: Explain better on NMI_MASK overflow condition
irq: Add {over,under}flow detection for local_interrupt_{enable,disable}
refcount: Use CONFIG_BUG_ON_DATA_CORRUPTION for UAF-related errors
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull scheduler updates from Ingo Molnar:
"Kconfig updates:
- Simplify PREEMPT_DYNAMIC (Mark Rutland)
Fair scheduler updates:
- Remove redundant RUN_TO_PARITY check (Elif Topuz)
- Declare augmented callbacks per field, fix
rb_add_augmented_cached() descent (Yiwei Lin, Peter Zijlstra)
- Restart fair hrtick after same-task repicks (Shubhang Kaushik)
- Improve the scheduling latency of short slice tasks (Vincent
Guittot)
Deadline/RT scheduler updates:
- Check start_dl_timer expiry with ktime_before() (Liang Hao)
- irq_work: CPU-hotplug improvements on PREEMPT_RT (Sebastian Andrzej
Siewior)
Energy-aware scheduling updates:
- Implement the steal_governor, introduce preferred CPUs and
steal-driven vCPU backoff (Shrikanth Hegde)
Multi-processor load-balancing updates:
- Enable preferred SMT siblings on NVIDIA Olympus (Andrea Righi)
- Randomize equally shallow idle CPU picks (Christian Loehle)
- Remove redundant core_sched_seq (Hui Su)
Cache-aware scheduling updates:
- Avoid publishing partial LLC utilization (Jemmy Wong)
NUMA-balancing updates:
- Reset NUMA fault locality after scan period update (Eric Kim)
Proxy execution updates:
- Ongoing work to implement sleeping owner handling for proxy
execution (John Stultz, Vasily Gorbik)
- Preparatory steps to make sched_ext compatible with proxy execution
(Andrea Righi)
Scheduler infrastructure updates & fixes:
- Remove the RCU wait from PSI trigger destruction (Shakeel Butt)
- Avoid modifying wait-entry on failed priority registration
(Hui Su)
- Use the new static key API for sched_feat (Hongyan Xia)
- Convert paravirt_steal to new static key APIs (Hongyan Xia)
- cputime: Don't account idle time twice after dyntick-idle
(Stian Halseth)
Scheduler debugging updates:
- Set TIF_NEED_RESCHED before calling __trace_set_need_resched()
(Sechang Lim)
- Fix context analysis errors in non-preferred CPU push (Shrikanth
Hegde)
Misc cleanups and fixes by Christian Loehle, Shubhang Kaushik,
Thomas Huth and Vladimir Zapolskiy"
* tag 'sched-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (64 commits)
sched: Replace nr_iowait_cpu() with a bool accessor
Revert "sched/fair: Remove dead code on enqueue_task_fair()"
sched/cache: Avoid publishing partial LLC utilization
sched/cputime: Don't account idle time twice after dyntick-idle
sched/psi: Remove the RCU wait from trigger destruction
sched/eevdf: Remove redundant RUN_TO_PARITY check
sched/wait: Avoid modifying entry on failed priority registration
rbtree_test: Use rb_add_augmented_cached() for the cached augmented test
rbtree: Update augmented data on the way down in rb_add_augmented_cached()
rbtree: Declare augmented callbacks per field with RB_AUG()
rbtree_test: Use rb_add() and rb_add_cached() for the basic tests
smpboot: Don't park the thread if work is pending
irq_work: Flush lazy work CPU down on PREEMPT_RT
irq_work: Update a comment regarding CPU hotplug invocation
sched/topology: Add asymmetric SMT packing override
sched/fair: Honor asymmetric SMT priority in idle selection
sched: Set TIF_NEED_RESCHED before calling __trace_set_need_resched()
sched/core: Fix context analysis errors in non-preferred CPU push
virt/steal_governor: Enable the driver
virt/steal_governor: Implement steal_governor policy loop
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 kdump update from Dave Hansen:
"Some kdump code is using NR_CPUS_DEFAULT as if it were the actual,
in-use max number of CPUs. Move it over to use NR_CPUS instead.
I suspect this one being in-tree for a few years means that the vast
majority of kdump users are on distro kernels that don't drop NR_CPUS
below the defaults"
* tag 'x86_kdump_for_7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
crash: Update stale NR_CPUS_DEFAULT references in elfcorehdr sizing docs
x86/crash: Reserve elfcorehdr for CONFIG_NR_CPUS, not CONFIG_NR_CPUS_DEFAULT
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
Pull arm64 updates from Catalin Marinas:
"Here are the arm64 updates for 7.4.
The more interesting bits are the removal of big-endian kernel support
(already marked BROKEN for some time), preemptible this_cpu_*()
operations and MPAM support for the firmware-backed (Fb) interface.
CCA (Arm's confidential compute) is slowly trickling in with host RMI
(Realm Management Interface) support and some refactoring, including a
dedicated SMCCC bus to advertise firmware services. There are also the
usual PMU updates for new hardware and a few fixes/cleanups.
Core features:
- Remove big-endian kernel support: CONFIG_CPU_BIG_ENDIAN has
depended on BROKEN for a while, so drop the remaining code (BE
hypervisor object, BPF JIT, assembly/crypto/library routines,
endianness helper macros, selftests) and force a little-endian
build
- Add preemptible this_cpu_*() operations (read/write, RMW, xchg,
cmpxchg and cmpxchg128) that no longer need to disable preemption
around the per-CPU address generation and access
- Preparation patches for implementing CONFIG_HOTPLUG_PARALLEL on
arm64
Memory management:
- Treat faults taken by EFI runtime firmware as kernel faults
- Clear PTE_WRITE for EFI_MEMORY_RO mappings (with hardware dirty
state management enabled, this is not truly read-only)
- Raise the default ARCH_MMAP_RND_BITS for 48-bit and 52-bit VA
configurations (28/26/24 bits for 4K/16K/64K pages)
- Implement clear_page[s]() using memset()
- Enable BBML2 no-abort (a.k.a. BBML3) for the NVIDIA Rigel CPU
Perf and PMU:
- Support for HiSilicon's ITS PMU
- Add support for some new events: INST_SIMD_ALU_VEC for Apple PMUs
and a cycle counter for the latest version of HiSilicon's MN PMU
hardware
- A bunch of fixes to the CXL PMU driver to address pre-existing
issues from Sashiko
- Fix generation of PERF_RECORD_ITRACE_START records for SPE and ETM
drivers
- Reduce excessive stack consumption in the Marvell DDR PMU driver
- Minor driver updates and cleanups all over
Arm Confidential Compute Architecture (CCA):
- Add an Arm SMCCC bus for firmware services discovered through SMCCC
and move the TRNG and CCA guest (TSM provider) drivers onto it,
removing the dummy CCA platform device and adding a sysfs ABI for
Realm guests
- Move the Realm Service Interface (RSI) code out of arch/arm64/ into
drivers/firmware/arm_rmm/
- Add the host side of the Realm Management Interface (RMI): detect,
configure and activate the RMM, add SRO support and wrappers for
the Realm RMI commands
- Block hibernation (new arch hook in the PM core) and kexec while
the RMM is active. To be revisited in the future with proper
support for deactivation
- Handle Granule Protection Faults (GPFs) taken by the host, caused
by accesses to memory delegated to the RMM. In a future patch, the
exception table lookup will be limited to is_kdump_kernel() cases
MPAM (Memory Partitioning And Monitoring):
- Add support for the MPAM firmware-backed (Fb) interface, allowing
MSC accesses to be mediated by firmware
- Fix a list of theoretical issues with the driver (MSC access error
propagation, MBWU monitor save/restore and locking, resctrl class
handling, error interrupt restore, maximum number of PARTIDs)
- Add the mailing list and a missing file to the MAINTAINERS entry
- Document when to set arm64.nompam
Errata and CPU features:
- Add the NXP i.MX8QM/8QP workaround for the Cortex-A53 cache
coherency issue (ERR050104), using a new ARM64_CPUCAP_SOC_ERRATUM
capability type for SoC-level errata
Miscellaneous:
- Mask debug exceptions (DAIF) around the hardware breakpoint
register manipulations when called from generic kernel code
- Don't zero the SVE state buffer when the SVE state is live
- Return -EPERM instead of -EBUSY from the GCS prctl() locking
failures (matching x86), with the selftest updated. Slight ABI
change but no software deployment yet
- kselftest: fix unsound MTE fault skipping by introducing MTE-safe
memory accessors, avoid copying each signal test binary more than
once
- Update sysreg definitions (fix three enum values and two field
names, mark architecturally dropped fields as RES0) and remove the
TME transaction state check from the BRBE driver
- Fix the description of ARM64_HAS_LPA2 and remove a redundant
ID_AA64MMFR0 define"
* tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: (144 commits)
arm64: cpufeature: Enable BBML2 for NVIDIA Rigel
arm64: cputype: Add NVIDIA Rigel definitions
arm64: raise default ARCH_MMAP_RND_BITS for 48-bit and 52-bit VA
arm64/debug: mask debug exceptions when called from common code
kselftest/arm64: signal: copy each test binary only once
kselftest/arm64: Check for -EPERM not -EBUSY in the locking test
arm64: gcs: Return -EPERM not -EBUSY for prctl() locking failures
perf: arm_brbe: Remove the check for TME transaction states
arm64: sysreg: Mark fields the architecture dropped as RES0
arm64: sysreg: Fix the names of two misspelt fields
arm64: sysreg: Fix three incorrect enum values
arm64: smp: Defer RCU registration during secondary CPU bringup
arm64: smp: Don't bother printing the I-cache policy for each CPU
arm64: smp: Defer update of secondary CPU capabilities
arm64: smp: Tidy up cpuinfo init and cpufeature updates
arm64: smp: Tidy up smp_prepare_cpus()
arm64: cpufeature: Store every ID register with its overrides applied
arm64: cpufeature: Read MPAMIDR_EL1 in __cpuinfo_store_cpu()
arm64: cpufeature: Add read_cpuid_with_overrides()
arm64: cpufeature: Check arm64_ftr_regs[] before the first store
...
|
|
MM CID switches to per-CPU ownership when the number of users of an mm
exceeds the maximum number of CIDs. When the affinity union grows, the
per-CPU threshold is recalculated and the MM can switch back to per-task
ownership through deferred work.
mm_cid_calc_pcpu_thrs() incorrectly uses min(nr_cpus_allowed, users) to
calculate that switch-back threshold. This makes pcpu_thrs no larger than
users, so the users < pcpu_thrs check in mm_update_cpus_allowed() can never
succeed.
For example, with three users restricted to two CPUs, the MM enters per-CPU
mode. On an eight-CPU system, widening the affinity union to all eight CPUs
should produce a threshold of four, but the old calculation produces three
and returns early. The MM therefore remains in per-CPU mode even though the
widened CPU set makes per-task ownership preferable.
Calculate pcpu_thrs from nr_cpus_allowed directly. The users bound in
__mm_update_max_cids() still controls when per-CPU mode is entered, so this
does not change the threshold calculated when switching from per-task to
per-CPU ownership.
Tested with an x86_64 QEMU reproducer using three users, an initial two-CPU
affinity, and an eight-CPU affinity expansion. The baseline does not invoke
mm_cid_work_fn() after the affinity expansion. The fixed kernel invokes the
deferred work once and completes the switch back to per-task mode.
Fixes: fbd0e71dc370 ("sched/mmcid: Provide CID ownership mode fixup functions")
Signed-off-by: Hui Su <sh_def@163.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260915155953.2856524-1-sh_def@163.com
|
|
CPU hotplug migration leaves pending_map bits set on the outgoing CPU
while its wheel vectors are empty. After re-online, a later next_expiry
recalc can treat those empty buckets as pending and temporarily pull
next_expiry forward until collect drains the bits.
Clear pending_map under the base lock after migration in timers_dead_cpu().
Fixes: 500462a9de65 ("timers: Switch to a non-cascading wheel")
Signed-off-by: Liang Hao <haohlliang@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260930063621.37740-1-haohlliang@gmail.com
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull file closing updates from Christian Brauner:
"This makes closing files synchronous for close_range(), exec and exit.
Since fput() was switched to task work every final __fput() of an
exiting task is queued on task work and run from exit_task_work().
exec and close_range() do the same. For a task with a large descriptor
table that is a cmpxchg() and a TIF_NOTIFY_RESUME test-and-set per
file plus a list entry for any later task_work_cancel() to search
under pi_lock, and then a second pass over every struct file that
isn't cache hot anymore by then. Oleg and Neil have pointed this out
over the years.
close_files(), close_range() and close-on-exec now flush and put each
file inline the way close(2) does. Kernel threads aren't affected.
They share init_files which init_task pins forever so their
exit_files() never drops the last reference, and their fput() keeps
punting to a workqueue. The one place that could put a table from a
kthread context, a failing copy_process(), can't hold the last
reference while the source table is alive.
On a 64 vCPU KVM guest tearing down 4096, 65536 and 1M descriptors
scattered at random positions in the table:
4096 fds 65536 fds 1M fds
exit 1045 -> 895 us 18.9 -> 14.9 ms 429 -> 306 ms
execve, close-on-exec 1393 -> 1190 us 21.4 -> 16.9 ms 471 -> 325 ms
close_range() 1179 -> 988 us 21.9 -> 17.4 ms 484 -> 337 ms
So that is 16-21% or 40-150 ns per closed file, largest at 1M
descriptors. With eight processes tearing down 65536 descriptors each
at once it stays at 16-21% because the second pass over 16 MB of
struct file is what gets expensive when CPUs compete for the cache.
With 32 or 64 processes both kernels are bound by pushing millions of
files through slab and rcu and the difference shrinks to 4-8%. Files
whose own release dominates gain less, 13% for eventfds, 11% for
pipes, 6% for AF_UNIX sockets. close(2) is untouched and will-it-scale
is within 2%.
The spufs coredump support is removed. It was the only reason
do_coredump() unshared the descriptor table. gdb dropped Cell
debugging in 9.1 and binutils in 2.34, the Cell blades are gone and
nothing on the PlayStation 3 produces or reads these notes. With that
unshare_files() goes away, exec installs its private table through the
new switch_files_struct() and the coredump startup completion becomes
a plain thread count waited on with the new wait_var_event_state().
Three fixes for the synchronous close are included. A failed fork
released its files under scx_fork_rwsem and deadlocked against the bpf
link's release. A session leader's exit released its tty before
disassociate_ctty() ran and the foreground job lost its SIGHUP, so the
tty is hung up before the files are closed now. And descriptor tables
are walked from the highest descriptor down which restores the order
the deferred puts had and keeps a few long-standing release ordering
bugs from deadlocking exit"
* tag 'vfs-7.4-rc1.sync_close' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
fs: close files from the highest descriptor down
coredump: factor out coredump_wait_inactive()
exit: hang up the tty before closing the files
fork: release the files of a failed fork after sched_cancel_fork()
coredump: replace the startup completion with a thread count
sched: add wait_var_event_state()
coredump: drop core_state->dumper
fs: make close_cloexec_files() synchronous
fs: rename do_close_on_exec() to close_cloexec_files()
fs: make close_range() synchronous
fs: make close_files() synchronous
fs: add filp_close_sync()
fs: remove unshare_files()
fs: move unshare_fd() to fs/file.c
fs: add switch_files_struct()
coredump: stop unsharing the file descriptor table
fs: don't open-code file_close_fd() in close_fd()
powerpc: remove coredump support
|
|
copy_user_syms() and bpf_uprobe_multi_link_attach() check whole user
arrays with access_ok() up front, then read them one element at a time
with __get_user(), with other work in between: allocations and
strncpy_from_user() in copy_user_syms(), validation in the uprobe_multi
loop. Each of those accesses enables and disables user access on its
own, so the up-front check saves nothing. On x86, __get_user() is even
more expensive than get_user(): it does an lfence, where get_user()
checks the address with a couple of plain instructions.
Use get_user(). The access_ok() checks stay, because they also make a
bad array fail with -EFAULT before anything else is looked up or
allocated. Update the comment that said they were there for
__get_user().
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
syscall_user_dispatch() reads the selector byte with __get_user(),
relying on an access_ok() done once at prctl time when the selector
address was set. So the pointer being dereferenced was validated in a
different system call, and the separation saves nothing anyway:
__get_user() still enables and disables user access, and on x86 it does
an lfence that get_user() avoids.
Use get_user(), and drop the comment explaining why the unchecked access
was safe.
The selector may be a tagged address. The prctl-time check is done on
untagged_addr(selector), but it is the tagged pointer that gets stored,
and __get_user() never checked it. get_user() does, and on x86 with LAM
a tagged pointer fails its range check. So untag it at the point of use
as well. The prctl-time check stays, so a bad address is still reported
when it is set.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
is_trap_at_addr() reads the instruction at a user address with
__get_user(), inside pagefault_disable() since the caller holds
mmap_lock. There is no access_ok() in front of it, and nothing here
needs the unchecked version: with page faults disabled, get_user()'s
might_fault() check returns early, so that is no reason to avoid it
either.
Use get_user(), which also checks that the address is a user address,
and on x86 avoids the lfence that __get_user() does.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
PTRACE_GETREGSET and PTRACE_SETREGSET do an access_ok() on the user
iovec, read its two fields with __get_user(), and once the regset has
been transferred write the length back with __put_user(). Each of those
accesses enables and disables user access on its own, so the up-front
check saves nothing. On x86, __get_user() is even more expensive than
get_user(): it does an lfence, where get_user() checks the address with
a couple of plain instructions.
Just use get_user() and put_user(), and drop the access_ok(). Both
fields are read before anything else is done, so a bad pointer still
fails with -EFAULT up front.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
get_compat_sigevent() does one access_ok() on the user structure and
then reads four fields with __get_user(). Each of those reads enables
and disables user access on its own, so the single range check no longer
buys anything.
Read the fields inside a scoped_user_read_access() instead.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
__save_altstack() and __compat_save_altstack() write three fields with
__put_user(), relying on the caller having done access_ok() on the whole
signal frame. Each of those writes enables and disables user access on
its own, so that check saves nothing.
x86 and powerpc already avoid these functions by using
unsafe_save_altstack() inside their own user access regions. Use the
same helpers here, inside a scoped_user_write_access(), so that every
other architecture gets a single range check and a single user access
region too. None of those callers is itself inside a user access
region, so nothing nests.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
The old sigaction() system call and its compat counterpart do one
access_ok() on the user structure and then a series of __get_user() or
__put_user() calls on its fields. That was an optimization back when
each of those was a single memory access. These days each of them
enables and disables user access on its own (stac/clac on x86), so the
up-front check saves nothing.
Convert them to scoped_user_{read,write}_access() with
unsafe_{get,put}_user(), which does the range check once and puts a
single stac/clac pair around plain moves.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull vfs idmap constification from Christian Brauner:
"This makes struct mnt_idmap const throughout the tree.
A mount's idmapping is immutable. The only thing modified after
alloc_mnt_idmap() is the reference count and that is hidden behind
mnt_idmap_get() and mnt_idmap_put(). Everything else only reads from
it. That is the same model struct cred uses and the idmapping is
sensitive enough to deserve it.
The conversion goes bottom up through the vfs{g,u}id and fs{g,u}id
helpers, the privilege checks, acl, xattr and quota and then every
inode operation that takes an idmap, so ->permission(), ->getattr(),
->setattr(), ->create(), ->mkdir(), ->mknod(), ->symlink(),
->rename(), ->tmpfile(), ->get_acl(), ->set_acl() and ->fileattr_set()
with their implementations in every filesystem, plus the LSM hooks.
struct vfsmount, struct mount_kattr and struct kstatmount store a
const pointer and nop_mnt_idmap and invalid_mnt_idmap live in rodata,
so anything that tries to modify them faults instead of silently
corrupting the initial idmapping"
* tag 'vfs-7.4-rc1.idmap' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (27 commits)
fs: make nop_mnt_idmap and invalid_mnt_idmap const
fs: port mnt_idmap() and file_mnt_idmap() to const mnt_idmap
fs: port vfs_*() helpers to const mnt_idmap
fs: port ->setattr() to pass const mnt_idmap
fs: port ->getattr() to pass const mnt_idmap
fs: port ->create() to pass const mnt_idmap
fs: port ->symlink() to pass const mnt_idmap
fs: port ->mkdir() to pass const mnt_idmap
fs: port ->rename() to pass const mnt_idmap
fs: port ->mknod() to pass const mnt_idmap
fs: port ->tmpfile() to pass const mnt_idmap
fs: port ->get_acl() to pass const mnt_idmap
fs: port ->set_acl() to pass const mnt_idmap
fs: port ->fileattr_set() to pass const mnt_idmap
fs: port xattr to const mnt_idmap
fs: port ->permission() to pass const mnt_idmap
fs: port acl to const mnt_idmap
fs: port inode_init_owner() to const mnt_idmap
fs: port inode_owner_or_capable() to const mnt_idmap
fs: port privilege checking helpers to const mnt_idmap
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull file table updates from Christian Brauner:
"This annotates struct fdtable's fd array with __counted_by_ptr so
KASAN and the fortified functions can bounds check it against max_fds
and adds a KUnit suite for fdtable. A follow-up uses __struct_size()
in the test since sparse doesn't know __builtin_dynamic_object_size().
FD_PREPARE() is simplified. It was built as an ACQUIRE-style guard on
infrastructure that was never needed. The ACQUIRE machinery and
CLASS_INIT() go away, the variable is declared with __cleanup()
directly, struct fd_prepare loses its err field since the fd either
holds the descriptor or the error, and callers get a const pointer to
the guard behind a UNIQUE_ID() name so they can't shadow it. Code
generation is identical"
* tag 'vfs-7.4-rc1.file' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
file: make struct fd_prepare const and kill its err field
cleanup: remove CLASS_INIT()
file: declare the FD_PREPARE() variable with __cleanup() directly
file: simplify FD_PREPARE()
vfs: use __struct_size() in the fdtable KUnit test
vfs: Add KUnit tests for fdtable
vfs: Annotate struct fdtable's fd field with __counted_by_ptr
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull coredump updates from Christian Brauner:
"This adds sparse coredumps and per-request memory type selection to
the coredump socket protocol.
A coredump sent over the socket transfers every zero of every hole in
every mapping. For a process with 128 threads that's 1 GB of mostly
thread stacks, 8 MB reservations with a few pages touched, and the
holes sit in the middle of the dump rather than at the end. The
coredump_filter bit that was proposed for this stops each PT_LOAD at
the last populated page. But that mask says which kinds of memory to
include and propagates across fork and exec, whereas what is selected
here is an encoding. The usermodehelper isn't salvagable for this
either. The coredump socket already has a handshake for exactly this.
A server that raises COREDUMP_RECORDS in coredump_ack->mask gets the
coredump as a sequence of records, each a struct
coredump_record_header followed by what it describes. The stream ends
explicitly with an end record that reports the size, so a missing one
means truncation.
With COREDUMP_SPARSE holes cross the socket as a bare header that says
how many zero bytes were skipped. Reassembling the records gives back
the same coredump, so a debugger and everything else still see an
ordinary core file. Numbers from the selftests: the 128 thread process
sends 1424153 bytes for a coredump of 1075150848 bytes, a 256 MB
mapping with the first and the last page touched sends 188793 bytes
for 268890112 bytes, and with COREDUMP_RECORDS alone the record
overhead is under one percent.
The selftests also simulate a server uploading to a blob store that
can't seek and rewrites the program headers so the object is an
ordinary ELF core file without the holes.
COREDUMP_MEMORY_TYPES lets the server choose what memory to dump per
request instead of relying on the static /proc/<pid>/coredump_filter
of the crashing task. The request carries the default types and a mask
of every type the kernel knows about, the ack carries the selection.
Zero is valid and dumps the program headers and notes and nothing but
the mappings that are always dumped.
Preparatory cleanups refuse negative skips in dump_skip_to(), chunk
every write at a page so a pipe or a socket never takes a short write
in the middle of a record, make the dump helpers return bool and
replace the core_dumped integer with COREDUMP_STATE_STARTED and
COREDUMP_STATE_TRUNCATED flags.
Also included is a fix for coredump_parse() reading core_pattern while
it is being modified. The sysctl handler now validates a copy and
publishes it under a spinlock and the parser works on a snapshot, so a
rejected pattern is never visible and the rollback logic goes away.
And to_kthread()'s lockless flags read is annotated with READ_ONCE()"
* tag 'vfs-7.4-rc1.coredump' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (29 commits)
kthread: Annotate lockless to_kthread() flags access
coredump: parse a snapshot of core_pattern
selftests/coredump: test failed handshakes
selftests/coredump: improve coredump size negotiation tests
selftests/coredump: test COREDUMP_MEMORY_TYPES
selftests/coredump: simplify the refusal tests
tools: sync coredump.h header
coredump: select memory types to include
selftests/coredump: show how to inspect the task to decide how the coredump should be sent
selftests/coredump: simulate a blob store
selftests/coredump: put a hole in the middle of a sparse mapping
selftests/coredump: hand the record stream to a sink
selftests/coredump: test COREDUMP_RECORDS and COREDUMP_SPARSE
coredump: describe the holes when COREDUMP_SPARSE is negotiated
coredump: send the coredump in records if requested
tools: sync coredump.h header
coredump: add COREDUMP_SPARSE to the coredump socket protocol
coredump: add COREDUMP_RECORDS to the coredump socket protocol
coredump: clean up coredump state handling
coredump: always chunk writes
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull signal handling updates from Christian Brauner:
"This stops TIF_NOTIFY_SIGNAL from interrupting work that can't be
restarted and fixes a bunch of coredump and signal bugs.
TIF_NOTIFY_SIGNAL kicks a task out of an uninterruptible sleep so it
returns to userspace, runs its task work and goes back to sleep. That
breaks coredumps: dump_interrupted() only lets fatal signals interrupt
a dump and writes to a regular file ignore TIF_NOTIFY_SIGNAL. But the
pipe and the socket paths check signal_pending() Adeep down in code
that is shared with regular syscalls and bail. So a crashing process
with io_uring requests in flight loses most of its coredump.
In the selftest an unfixed kernel delivers 357324 of at least 5111808
bytes. And io_uring isn't the only source. klp_send_signals(),
bpf_task_work_schedule_signal(), landlock's tsync, kthread_stop() and
the printk kunit test raise the bit as well, some of them from irq
context against any task. So this can't be fixed per subsystem and the
state has to be per-task and ambient.
Add PF_NO_NOTIFY_SIGNAL and no_notify_signal_save()/restore() helpers
modelled on memalloc_nofs_save(). Inside such a section
signal_pending() ignores TIF_NOTIFY_SIGNAL. Coredumps, the smb send
path, which hand-rolled its own version of this, and the pid namespace
reaper, which busy-looped when the bit kept getting raised, are
converted.
The second part is a set of fixes that fell out of looking at the
coredump code with kres and modelling it in TLA+:
- coredump_finish() woke the parked threads without holding rcu. A
parked thread can exit on a spurious wakeup and be freed before
wake_up_process() takes its pi_lock.
- Only SIGKILL and the freezers interrupt a dump now and the three
freezers agree. Power management and cgroup v1 freezing aborted a
dump while a cgroup v2 freeze either waited for the dump or cut it
short depending on where the core went.
- io-wq set its exit bit without a barrier against the task work that
creates workers. On weakly ordered architectures exit could hang on
worker_done.
- retarget_shared_pending() slingshotted a shared signal to the dumper
when a zapped sibling restored its signal mask. That set
TIF_SIGPENDING on the dumper and truncated the core.
- A tracer could clear the signal mask of a user worker with
PTRACE_SETSIGMASK and inject a coredump signal. An io-wq worker of
an SQPOLL ring dumping core deadlocks the whole group.
PTRACE_SETSIGMASK is refused for user workers now and
__set_task_blocked() enforces the fork-time mask.
- exec cancels io_uring requests before de_thread() so a worker
creation queued as task work can't add a thread to a thread group
that de_thread() just took down.
- No io threads are created from a PF_SIGNALED or PF_POSTCOREDUMP
creator anymore. Such a worker was invisible to zap_process() but
still decremented threads_remaining on exit so the dumper could
leave coredump_wait_inactive() early.
Also included are a comment that do_each_pid_task() needs
tasklist_lock, a READ_ONCE() in pid_alive() and a regression test for
fork() into a pid namespace whose ancestor lost its init"
* tag 'kernel-7.4-rc1.signal' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (21 commits)
pid: use READ_ONCE() in pid_alive()
selftests: pid_namespace: test fork with dead ancestor
pid: document that do_each_pid_task() needs tasklist_lock
signal: enforce the user worker signal mask in __set_task_blocked()
fork: use SIG_KERNEL_ONLY_MASK for the user worker signal mask
fork: don't create io threads once PF_POSTCOREDUMP is set
fork: move the coredump and exec checks into create_io_thread()
exec: cancel io_uring requests before de_thread()
selftests/coredump: expect PTRACE_SETSIGMASK to be refused on a user worker
selftests/coredump: test a user worker as the coredumping thread
ptrace: refuse to change the signal mask of a user worker
selftests/coredump: test shared signal retargeting during a dump
signal: only SIGKILL and the freezers interrupt a coredumping task
signal: don't retarget shared signals in a dying thread group
io-wq: order the exit bit against worker creation task work
coredump: hold RCU while releasing parked threads
pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper
smb: prevent TIF_NOTIFY_SIGNAL from interrupting
selftests/coredump: test that TIF_NOTIFY_SIGNAL doesn't truncate a coredump
coredump: prevent TIF_NOTIFY_SIGNAL from interrupting coredumps
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull namespace updates from Christian Brauner:
- Reject uid_map, gid_map and projid_map values that don't fit in a
u32.
map_write() parsed with simple_strtoul() and truncated modulo 2^32 on
64-bit so "4294967301 1000 1" was installed as "5 1000 1" without an
error. Each field is parsed with kstrtou32() now and selftests cover
the out-of-range, negative and in-range cases. This isn't a security
fix. The truncated values were valid ids and every later check still
applied to them.
- Annotate struct uid_gid_map's forward and reverse pointers with
__counted_by_ptr and add a KUnit suite for inserting and sorting
extents.
insert_extent() wrote to forward[nr_extents] before bumping the count
which the annotation flags, so it bumps first now. Two follow-up
fixes rename the now global helpers to uid_gid_map_insert_extent()
and uid_gid_map_sort(), since the btrfs self-tests have their own
insert_extent(), and guard the declarations on CONFIG_KUNIT.
- Drop the BUG_ON() NULL checks in copy_mnt_ns() and copy_utsname().
create_new_namespaces() always passes a valid pointer and the other
copy_*_ns() helpers don't check either.
- Remove a dead key_put() on the create_user_ns() error path.
* tag 'namespace-7.4-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
selftests/namespaces: add uid_map/gid_map range tests
userns: reject uid_map/gid_map values that do not fit in u32
userns: declare the KUnit-visible helpers whenever KUnit is enabled
userns: rename insert_extent() and sort_idmaps()
userns: Add KUnit test suite for uid_gid_map
userns: Add __counted_by_ptr attribute to struct uid_gid_map
fs: namespace: drop BUG_ON() in copy_mnt_ns()
uts: drop BUG_ON() in copy_utsname()
userns: remove dead key_put() on the create_user_ns() error path
|
|
Merge updates related to system sleep, an energy model handling update,
a generic CPU PM driver update, a clock framework PM update, and a
pm-graph utility update for 7.4:
- Ignore page-zero RAM in E820 checksum during hibernation on x86 to
avoid rejecting images created after kexec() (Matthias Goergens)
- Add resume event mapping for PMSG_POWEROFF to the PM core to allow it
to carry out device shutdown in the future (Mario Limonciello)
- Add DPM watchdog to prepare/late/early/noirq/complete phases of
device suspend and resume (Mayank Rungta)
- Update swsusp.txt references to swsusp.rst in hibernation
documentation (Li Jun)
- Fix use-after-free of perf domain in netlink doit handlers for energy
models (Fan Wu)
- Add synchronize_rcu() back to cpu_pm_unregister_notifier() after it
was removed inadvertently in previous development cycles to avoid
use-after-free (Bradley Morgan)
- Unregister CPU PM notifier outside the timer lock in the timer-ti-dm
clocksource driver (Bradley Morgan)
- Fix typo "sucessfully" in a comment in pm_clk_add_clk() kerneldoc
comment and typo "hierachy" in a comment in pm-graph (Hemanth Selam)
* pm-sleep:
x86/hibernate: Ignore page-zero RAM in E820 checksum
PM: sleep: Add resume event mapping for PMSG_POWEROFF
PM: sleep: Add DPM watchdog to prepare/late/early/noirq/complete phases
PM: hibernate: docs: update swsusp.txt references to swsusp.rst
* pm-em:
PM: EM: Fix use-after-free of perf domain in netlink doit handlers
* pm-cpu:
PM: CPU: Restore synchronize_rcu() to cpu_pm_unregister_notifier()
clocksource/drivers/timer-ti-dm: Unregister CPU PM notifier outside of the timer lock
* pm-misc:
PM: clk: fix typo "sucessfully" in comment
* pm-tools:
tools: power: pm-graph: fix typo "hierachy" in comment
|
|
Merge cpufreq updates for 7.4:
- Minor fixes in various cpufreq drivers (Alexander Koskovich, Daniel
Schwierzeck, Frank Zhang, Haotian Zhang, Kathiravan Thirumoorthy,
Sumeet Pawnikar, and Xueqin Luo)
- Fix wrong behaviors on multi-node servers in the Loongson cpufreq
driver (Huacai Chen)
- Reject NULL from cpufreq_cpu_get() in the Rust code (Mehmet Koseoglu)
- Add suspend OPP to mediatek cpufreq driver and DT (Ryan Brue)
- Fixups for a few bugs identified by Sashiko in the amd-pstate cpufreq
driver (Mario Limoncielloi, Wentao Guan)
- Initial support for maximum frequency capacity handling on Zen6
client in amd-pstate (Mario Limonciello)
- Fix for amd-pstate-ut with 'Requested CPU Min frequency' BIOS option
(K Prateek Nayak)
- New Zen6 tuning values for EPP in amd-pstate (Mario Limonciello,
Vishal Badole)
- amd-pstate documentation fix (Karl Mehltretter)
- Restrict deferred downscaling to low load for shared policies in the
conservative cpufreq governor to avoid undesirable CPU frequency
reduction in some cases (Shengming Hu)
- Serialize sugov_start() against rate limit updates in the schedutil
cpufreq governor to avoid using a stale rate limit value (Hui Su)
* pm-cpufreq: (34 commits)
cpufreq: loongson3: Replace IOCSR read/write with MMIO ones
cpufreq: loongson3: Use global physical CPU ID in get/target callbacks
cpufreq: loongson3: Replace per-package mutex with per-node
cpufreq: loongson3: Adjust the width of id and val in smc_message
cpufreq: loongson3: Make this driver depend on MACH_LOONGSON64
cpufreq: schedutil: Serialize sugov_start() against rate limit updates
arm64: dts: mediatek: mt8173: Mark the lowest CPU OPPs for suspend
cpufreq: mediatek: Enter system sleep at the suspend OPP
cpufreq: qcom-cpufreq-hw: fix device node refcount leak in phandle parsing
cpufreq: qcom-nvmem: Add IPQ9650 support
cpufreq: Add Milos to cpufreq-dt-platdev blocklist
cpufreq: Use %pe to print error pointers symbolically
rust: rcpufreq_dt: add module alias
cpufreq: sti: avoid NULL dereference in dev_err()
cpufreq: tegra194: fix double-pointer error in get_cpu_ndiv
cpufreq: sparc-us2e: fix frequency table index copy-paste error
rust: cpufreq: reject NULL from cpufreq_cpu_get()
cpufreq: amd-pstate-ut: Fix max_freq and EPP test failures on Zen6
cpufreq: amd-pstate: Propagate cppc_set_auto_sel() errors on mode change
cpufreq: amd-pstate: Restore previous mode when changing driver mode fails
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull scheduler fixes from Ingo Molnar:
- Fix __sched_setscheduler() class change race causing
lost reschedules, exposed by recent RCU changes (K Prateek Nayak)
- Fix s64 multiplication overflow in place_entity()'s vlag
scaling code that can corrupt an entity's placement (Hui Su)
* tag 'sched-urgent-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
sched/fair: Avoid overflow in place_entity()
sched/core: Call wakeup_preempt() for queued tasks during class change
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull perf events fixes from Ingo Molnar:
- Fix x86 Intel uncore driver bug on Diamond Rapids CPUs
that erroneously always-cleared the invert bit (Guixiong Wei)
- Fix accounting bug in the perf mlock 'gift' code causing
unrelated RLIMIT_MEMLOCK functionality to fail (Lorenzo Stoakes)
- Fix perf_pmu_migrate_context() bug leaving events behind during
CPU hot-unplug (Haris Okanovic)
- Update cgroup time when rotating multiplexed events, to fix
time_running & scaled counts accounting bug (Antoine Huret)
* tag 'perf-urgent-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
perf: Update cgroup time when rotating multiplexed events
perf: Fix perf_pmu_migrate_context() leaving events behind
perf: Track the perf mlock gift separately
perf/x86/intel/uncore: Fix DMR CXL CM invert filter
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull locking fixes from Ingo Molnar:
- Fix FUT_OFF_MMSHARED futex hashing bug that can cause
missed wakeups or spurious wakeups on futex-waiting
tasks (Jann Horn)
- Fix lockdep context tracking bug in the deferred hrtimer
rearming entry code, which causes a lockdep chain leak
that will eventually turn lockdep off (Mikhail Gavrilov)
* tag 'locking-urgent-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
entry: Account the deferred hrtimer rearm as hardirq context for lockdep
futex: Fix mm reuse handling for FUT_OFF_MMSHARED
|
|
reenq_user() drops dsq->lock around each re-enqueue and its rq lock every
SCX_TASK_ITER_BATCH re-enqueues. A walk filtered by SCX_REENQ_MARKED skips
unmarked tasks without dropping either, so a long run of unmarked tasks is
walked in one hold of both locks.
Count the visited tasks instead of the re-enqueued ones and drop both locks
every SCX_TASK_ITER_BATCH visits. An unfiltered walk drops the locks as
often as before.
Suggested-by: Andrea Righi <arighi@nvidia.com>
Link: https://lore.kernel.org/all/atP-LIKpxPhR-Nuc@gpd4/
Signed-off-by: Tejun Heo <tj@kernel.org>
Reviewed-by: Andrea Righi <arighi@nvidia.com>
|
