| Age | Commit message (Collapse) | Author |
|---|
|
git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core
Pull more driver core fixes from Danilo Krummrich:
- Revert TAINT_FORCED_BIND, introduced to flag manual sysfs bind/unbind
operations associated with misleading fuzzing reports. It also taints
established workflows, including VFIO device passthrough; a more
targeted approach will be revisited after 7.4.
- Rate limit synthetic uevent failure messages to prevent log flooding
from repeated invalid writes to sysfs uevent files
* tag 'driver-core-7.4-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core:
Revert "driver core: add TAINT_FORCED_BIND for when userspace manually messes with devices and drivers"
driver core: Limit the messages on a refused uevent
|
|
Pull fsverity fixes from Eric Biggers:
"Fixes for several bugs found by LLMs:
- Fix bypass of IPE's fsverity support, and a use-after-free in
certain cases, when FS_IOC_ENABLE_VERITY fails when almost done
- Fix FS_IOC_MEASURE_VERITY and FS_IOC_READ_VERITY_METADATA to no
longer bypass Landlock and AppArmor's read permission checks
- Be robust against the filesystem returning different values for a
file's verity descriptor length in two successive queries"
* tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fsverity/linux:
fsverity: Set S_VERITY only after rollback is no longer possible
fsverity: Tell LSMs about signature only after verity is enabled
fsverity: Be more careful with return value of ->get_verity_descriptor()
fsverity: Explicitly require FMODE_READ to retrieve hashes
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull power management fixes from Rafael Wysocki:
"These address assorted issues in the power management code and update
documentation:
- Fix potential out-of-bounds access in deferred reset in the cpufreq
statistics code (Zhongqiu Han)
- Cancel HWP notify work in the intel_pstate driver cleanup to
prevent possible use-after-free from occurring (Tristan Madani)
- Adjust state names and descriptions for ACPI _LPI idle states in
the intel_idle driver to make them follow the driver's idle state
naming convention (Rafael Wysocki)
- Document the new pm_runtime_use_autosuspend() undo mechanism that
triggers automatically on driver exit (Joshua Crofts)
- Do not call suspend_ops->begin()/end() for suspend-to-idle to avoid
driver confusion (Ovidiu Panait)
- Make the energy model management code allocate the cpumask for
non-CPU perf domains to prevent out-of-bounds reads from occurring
in the EM netlink interface (Karl Mehltretter)"
* tag 'pm-7.4-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
PM: runtime: clarify pm_runtime_use_autosuspend() undo mechanism
cpufreq: stats: Fix potential out-of-bounds access in deferred reset
PM: suspend: Do not call suspend_ops->begin()/end() for s2idle
intel_idle: Adjust state names and descriptions for _LPI states
PM: EM: allocate the cpumask for every perf domain
cpufreq: intel_pstate: cancel HWP notify work in driver cleanup
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson
Pull LoongArch updates from Huacai Chen:
- Add LoongArch-specific ACPI initialization
- Set NX compat flag in PE/COFF efi header
- Use pa_to_nid()/nid_to_addrbase() rather than hard-code
- Detect and expose LAMCAS/DIV32 feature existence
- Fix and improve perf hardware breakpoints
- Fix and improve BPF JIT (trampoline and 32-bit operations)
- Add arch_crash_save_vmcoreinfo() support
- Some bug fixes and other small changes
* tag 'loongarch-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: (24 commits)
soc: loongson: loongson2_guts: Use of_root instead of own reference
soc: loongson: loongson2_pm: Fix build warnings for 32BIT
LoongArch: dts: loongson-2k0500: Drop unsupported bus_id in DWMAC
LoongArch: BPF: Optimize 32-bit operations using native instructions
LoongArch: BPF: Clean up and decouple is32 parameter from move_imm()
LoongArch: BPF: Fix stack arguments for indirect trampolines
LoongArch: Add arch_crash_save_vmcoreinfo() support
LoongArch: Fix one-shot limitation for perf hardware breakpoints
LoongArch: Fix perf hardware breakpoint failure via installation
LoongArch: Only send SIGTRAP signal if necessary in do_watch()
LoongArch: Fix architectural naming typo for CSR_FWPS_SKIP
LoongArch: Fix bitmask corruption in update_bp_registers()
LoongArch: Remove redundant call in update_bp_registers()
LoongArch: Remove arch-specific __smp_mb__{before,after}_atomic()
LoongArch: Detect and expose DIV32 feature existence
LoongArch: Detect and expose LAMCAS feature existence
LoongArch: Use pa_to_nid()/nid_to_addrbase() rather than hard-code
LoongArch: Don't init & online empty nodes
LoongArch: Call cpu_final_simd() with pure_initcall()
LoongArch: Use assign_bit() API where applicable
...
|
|
Merge assorted power management fixes for 7.4-rc1:
- Fix potential out-of-bounds access in deferred reset in the cpufreq
statistics code (Zhongqiu Han)
- Cancel HWP notify work in the intel_pstate driver cleanup to prevent
possible use-after-free from occurring (Tristan Madani)
- Adjust state names and descriptions for ACPI _LPI idle states in the
intel_idle driver to make them follow the driver's idle state naming
convention (Rafael Wysocki)
- Document the new pm_runtime_use_autosuspend() undo mechanism that
triggers automatically on driver exit (Joshua Crofts)
- Do not call suspend_ops->begin()/end() for suspend-to-idle to avoid
driver confusion (Ovidiu Panait)
* pm-cpufreq:
cpufreq: stats: Fix potential out-of-bounds access in deferred reset
cpufreq: intel_pstate: cancel HWP notify work in driver cleanup
* pm-cpuidle:
intel_idle: Adjust state names and descriptions for _LPI states
* pm-runtime:
PM: runtime: clarify pm_runtime_use_autosuspend() undo mechanism
* pm-sleep:
PM: suspend: Do not call suspend_ops->begin()/end() for s2idle
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull vfs fixes from Christian Brauner:
- writeback:
- Update dirtied_when instead of dirtied_time_when when a wb switch
puts an inode at the newest end of the target b_dirty list. The
list was left out of order so move_expired_inodes() could stop
before older inodes, and the lazytime expiration timestamp was
reset
- Clear the old wb's dirty-I/O state and bandwidth contribution when
a batch of inode switches leaves its dirty lists empty. An empty
wb stayed scheduled for periodic writeback and inflated
bdi->tot_write_bandwidth
- Take wb_switch_rwsem across the inode scan of
cleanup_offline_cgwb(). The v7.3-rc5 fix that rotates scanned
inodes let a scan racing a sync()'s queue_io() move lazytime
inodes past the sync's cutoff, so sync() returned without
persisting their timestamps
- Don't kick writeback for an IOCB_DONTCACHE write on an inode that
has no wb yet. With cgroup writeback an O_DIRECT RWF_DONTCACHE
write to a block device dereferenced NULL
- statmount/listmount/listns:
- Refuse statmount() string requests with a buffer that isn't larger
than struct statmount
- Don't wrap around with a U64_MAX cursor in listmount() and
listns()
- Don't end listns() at an inactive namespace
- Only add init_ipc_ns and init_net to the namespace trees if
CONFIG_IPC_NS and CONFIG_NET_NS are enabled
- iomap:
- Only mark blocks uptodate in __iomap_write_begin() after reading
them and let __iomap_write_end() mark the zeroed blocks uptodate
once the copy from userspace succeeded
- Check a chunk against max_integrity_io_size() on its own before
the bio size check
- Only enforce block alignment for direct I/O into holes and
unwritten extents if IOMAP_DIO_FSBLOCK_ALIGNED is set
- backing-file:
- Check S_APPEND and S_IMMUTABLE on the backing inode. FUSE
passthrough opens the backing file with vfs_open() which skips
may_open(), so anyone who may open the FUSE file for writing could
overwrite an append-only backing file anywhere or write to an
immutable one. Open, mmap and writes now check the backing inode
the way may_open() and do_mmap() do
- Always call kiocb_end_write() for a queued write
- Let backing files inherit FMODE_NONOTIFY from the user file. The
event fds fanotify creates for permission events on a stacked
filesystem raised FS_OPEN_PERM on the real path from inside the
listener's read() and deadlocked listeners with marks on both
layers
- pidfs:
- Look the task up before checking for exit information in
PIDFD_GET_INFO and start over if the task no longer owns the pid
once all fields have been read. A caller racing release_task() got
neither PIDFD_INFO_PID nor PIDFD_INFO_EXIT or ESRCH although the
exit information was available, and a caller racing a sub-thread's
exec reported that thread's tid as the pid
- Clear the mask bits of fields that lie beyond the struct size the
caller passed. The uapi header promises that the mask names no
such field but a caller passing PIDFD_INFO_SIZE_VER0 got the
coredump and supported mask bits set for fields that were never
written
- aio:
- Give the aio ring a ->read_folio that fails with EIO so a fault on
a ring whose file was truncated gets SIGBUS instead of jumping to
NULL
- Check nr_events against the ring size before doubling it in
ioctx_alloc()
- splice:
- Only write back an implicit file position in do_splice() when the
splice helper succeeded. splice doesn't take f_pos_lock so a
failed splice restored a stale snapshot over a position that a
concurrent getdents() had moved. On ext2 the next readdir then
trusted an offset inside a directory entry
- Retry tee() when the input pipe was emptied or the output pipe
filled between the prep steps and link_pipe() instead of returning
0 while the input pipe still has writers, as splice_pipe_to_pipe()
does
- ucount:
- Take the reference that pins a ucounts level on the 0 -> 1
transition before checking the rlimit
- Read the parent ucounts before dropping the rlimit count in
do_dec_rlimit_put_ucounts()
- inode:
- Rotate inodes whose page cache couldn't be dropped to the tail of
the LRU
- Skip inodes that another LRU walker is isolating
- setns:
- Set nsset->flags before anything in prepare_nsset() can fail so
the error path drops the cred prepared for CLONE_NEWUSER. A
failing setns() with CLONE_NEWUSER and CLONE_NEWNS leaked it
together with its user namespace
- Refuse setns(CLONE_NEWNS) for a task that shares its fs_struct
again when more namespaces are requested
- minix:
- Restore uptodate on the pinned bitmap buffers before redirtying
them after a failed writeback instead of tripping the warning in
mark_buffer_dirty(), as ext2 and ext4 do for their superblock
buffers
- Reject rmdir() of a directory with a corrupted link count with
EFSCORRUPTED instead of hitting the drop_nlink() warning
- userns: Keep the exec securebits and their locks when creating or
joining a user namespace. set_cred_user_ns() reset all securebits to
SECUREBITS_DEFAULT so anyone who may create a user namespace could
shed SECBIT_EXEC_RESTRICT_FILE and SECBIT_EXEC_DENY_INTERACTIVE with
a single unshare(CLONE_NEWUSER)
- fs: Honor FOP_UNSIGNED_OFFSET in sys_llseek() and in the pread64(),
pwrite64(), preadv() and pwritev() wrappers
- proc/kcore: Advance the vmalloc retry in read_kcore_iter() by the
last vread_iter() copy instead of the running total
- eventpoll: Return the error when the wakeup source for EPOLLWAKEUP
can't be created in EPOLL_CTL_MOD instead of reporting success
without suspend protection
- coredump: Mark do_coredump() noinline_for_stack
- nsfs: Check the trailing bytes of a namespace file handle in bytes
instead of words
- netfs: Restore the per-level and per-point decoding of the debug mask
- exportfs: Release the directory file get_name() opened with
__fput_sync(). From nfsd's kernel threads the deferred fputs arrived
faster than delayed_fput retired them and each pinned the directory's
readdir state, growing unreclaimable slab by about 90 MB per second
under a parallel tree walk
- fs: Call ramfs_kill_sb() for a ramfs rootfs. Since rootfs can be
unmounted as of v7.0 its struct ramfs_fs_info was leaked
- signal: Check the blocked mask for every entry
dequeue_synchronous_signal() looks at. The scan could select a
blocked synchronous signal and deliver it while blocked
- super: Convert the superblock device table from an rhltable to a
plain hashtable under a spinlock. This fixes a bug from v7.3 where
fs_bdev_freeze() froze a btrfs filesystem through a stale member that
open_ctree() had already released while the freeze was waiting for
SB_BORN
- fork: Leave rcu_users at zero until copy_process() can't fail
anymore. bpf_task_acquire() handed out trusted references to the new
task from the task_alloc LSM hook and sched_ext's ops.init_task() and
a failing fork freed the task behind them
- xattr: Always run cap_convert_nscap() for a security.capability
write. A zero-length setxattr() skipped it and let an unprivileged
caller without CAP_SETFCAP or write permission on the file plant an
empty security.capability xattr that made every execve() of the
binary fail with EINVAL
- namei: Skip the S_ISDIR assertion in
- proc: Refuse to mount on entries below /proc/<pid>/net like fd/,
fdinfo/ and map_files/. proc_net_d_revalidate() always fails so the
first lookup by anyone with search permission ran d_invalidate() on
the dentry and detached every mount on it, locked mounts included
- libfs: Hold one mount reference for all pins instead of one per pin.
The pin count is what keeps the mount alive, so the per-pin reference
only cost a mntget() and a mntput() through
mntput_no_expire_slowpath() for every debugfs, tracefs, securityfs or
configfs file that comes and goes
- iov_iter: Return 0 from iov_iter_alignment() for an empty iterator of
any type
- watch_queue: Give info_id its own storage instead of overlaying it
with rcu_head
- filelock: Take an active superblock reference while waiting for a
delegation break. After a lazy umount closing the delegation holder
could shut down the superblock under the waiter whose final iput()
then ran shmem_evict_inode() on freed state
- fs: Skip the copy_file_range() write limit checks when there is no
data to copy
- bpf: Allow bpf_d_path() from fentry on filp_close_sync(). Since
close_range() became synchronous this cycle close(), close_range()
and the closes on exec and exit no longer go through filp_close().
fexit stays rejected since the file may be gone by then
- fs_pin: Dequeue the wait entry unconditionally in pin_kill(). A
spuriously woken waiter kept its on-stack entry queued, took that as
proof that the pin was alive and used the freed acct structure when
umount() of the accounting file raced acct(2)
- dcache: Don't fail __d_obtain_alias() for an inode without links and
aliases. The ESTALE check added this cycle broke open_by_handle_at()
and nfsd file handle decoding on NFS and FUSE where i_nlink is just
what the server last reported and the handle may well still be valid
- selftests/ovl: Fix the mountinfo expectations of the detached layer
test which has failed since it was added
* tag 'vfs-7.4-rc1.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (60 commits)
fs: don't fail __d_obtain_alias() for unlinked inodes
ns: don't add init_ipc_ns and init_net without namespace support
aio: avoid request count overflow in ioctx_alloc()
selftests/ovl: fix detached layer mountinfo expectations
bpf: Allow bpf_d_path() from filp_close_sync()
fs: skip copy_file_range write limits when there is no data
minix: reject rmdir of a directory with a corrupted link count
fs_pin: do not trust the pin after a spurious wakeup in pin_kill()
ucount: read the parent ucounts before dropping the rlimit count
splice: retry tee() instead of returning 0 when it races
selftests/pidfd: test that fields beyond the struct size are not reported
pidfs: do not report fields that do not fit into the caller's struct
fs: let backing files inherit FMODE_NONOTIFY from the user file
splice: avoid stale f_pos writeback on error
backing-file: always end a queued write
filelock: keep superblock active through delegation wait
watch_queue: keep info_id separate from rcu_head
iomap: only follow dio alignment requirement if specified
iov_iter: fix NULL deref in iov_iter_alignment()
backing-file: enforce append-only and immutable backing inodes
...
|
|
Pull more SCSI updates from James Bottomley:
"A couple of late arriving driver updates (lpfc, ufs) with the main
addition being the lock context analysis update where clang static
analysis coupled with annotations are used to verify driver guarantees
about locks and warn on compile if they're inconsistent. This is
mostly annotations with only a few code changes (except in scsi_debug
which needed a fairly big rework to validate with locking context
analysis)"
* tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (103 commits)
scsi: ufs: core: Do not release a reserved request in ufshcd_abort()
scsi: ufs: core: Remove completed-without-interrupt path in ufshcd_abort()
scsi: ufs: core: Fix double release in ufshcd_eh_timed_out()
scsi: ufs: core: Fix double completion in ufshcd_clear_lu_cmds()
scsi: ufs: core: Add a helper for clearing hba->outstanding_reqs
scsi: ufs: core: Remove an always-false WARN_ONCE()
scsi: fnic: Update module authors
scsi: ufs: qcom: Power down UFS during system suspend on Milos
scsi: MAINTAINERS: Update Marvell Ethernet storage maintainers
scsi: handle out-of-range SG_SET_TIMEOUT values
scsi: core: Update cdrom.h coments
scsi: st: MAINTAINERS: Add Laurence Oberman and John Meneghini
scsi: sd: Mark the disk dead if runtime resume fails in sd_remove()
scsi: libiscsi_tcp: Prevent R2T range check overflow
scsi: ufs: core: Fix stale comment in ufshcd_mcq_config_nr_queues()
scsi: fnic: Annotate fnic_nvme functions with __must_hold()
scsi: ufs: core: Fix a deadlock between clock scaling and device commands
scsi: ufs: core: Clear stale UIC result byte before peer DME retries
scsi: ufs: bsg: Reject UIC commands with a non-zero result byte
scsi: ufs: bsg: Validate request_len before accessing request
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull more block updates from Jens Axboe:
"Bigger than usual for an end-of-merge-window pull request, main reason
being that the MD side I had missed a pull on, and both NVMe and block
got a good pile of LLM driven fixes where some of them may as well
just go in now rather than wait a full cycle. This contains:
- NVMe fixes via Keith:
- nvme-tcp fallout from the parallel queue allocation: initialize
pf_cache_lock and the header digest before requests are set up,
and don't dereference a NULL queue->ctrl on reconnect
- nvme-fabrics queue mapping fixes: reset io_queues on reconnect,
limit each queue type to the online CPUs, and clear a poll map
with no poll queues
- nvme-tcp io_work priority inversion with send_mutex held
(Seiji), error recovery on read_sock failure and skipping TLS
control records while waiting for the ICResp (Martin B), TLS
handshake timeout validation, and an address attribute race
- nvme-rdma NULL metadata_sgl dereference with T10-PI
- nvme-pci early boot hang with the quirks parameter
- nvme-multipath ANA log bounds underflow, and an nvme-fc
discovery reference leak
- nvmet hardening: rdma inline SGL out-of-bounds write and short
connect requests, fc use-after-free in LS create connection and
teardown on admin queue failure, pci-epf transport error
reporting and SGL length checks, zns NUMD wrap, fc stale read
data, auth state and status fixes, ports list and qid_max
locking, rdma double puts and irq-safe locking, and a double
free on metadata SGL allocation failure
- nvmet fixes from Josef: big discard length truncation, NULL
derefs for PCI endpoint targets and debugfs host_traddr, stop
listening when a tcp port is removed, and don't BUG() in
nvme-loop when a scan runs beside a reset
- MD fixes via Yu Kuai:
- raid5 validation: reject too few disks, invalid reshape disks, a
per-device size below one chunk, and an inconsistent reshape
state from the superblock instead of BUG(), plus journal payload
size checks
- raid5 error path and lifetime fixes: extra_page leak and NULL
derefs in free_conf/setup_conf, draining released_stripes before
destroying the cache, RCU for the big_stripe_tree lookup, and
per-array io_unit slab names
- md core: reject v0.90 arrays with too many devices, validate
bblog_size, take reconfig_mutex when enabling PPL, fix the
mddev->private NULL deref when stopping an array under IO, and
don't hand out the array before mddev->kobj is added
- raid10 missing barrier wakeup, raid0 device count validation, a
bogus mddev_unlock() in lbs_store(), and shared helpers
- blk-mq fixes from Josef:
- don't trust the bio cookie in blk_mq_poll()
- keep tag sharing fair after a queue update
- don't bring back flags of a completed request from the timeout
handler
- honor a restarted timer
- initialize the dma state for P2P
- quiesce a queue joining a quiesced tag set
- set up and exit hctxs under tag_list_lock
- free the tag bitmaps in the SRCU callback
- blk-cgroup and friends from Josef:
- keep the old blkg while reassociating a bio
- free struct ioc after a grace period
- don't truncate v1 iops limits
- fix root io.stat on 32-bit
- don't free a blkg with its punt work queued
- flush iolatency enable_work after going offline
- pass dead group I/O counts on and make reset_stats reset them
- don't enter reclaim under rq_qos_mutex
- Other core fixes from Josef:
- a disk use-after-free in sync_bdevs()
- don't losing the status of a failed flush request
- 64-bit sector math for mac partitions
- apply the segment size to the integrity buffer
- blk-iocost: abort a weight transfer on invalid donation weights,
and publish hweights as one atomic value
- Fix a NULL deref and use-after-free in __blk_crypto_evict_key(),
reachable via dm-inlinecrypt
- Fix recursive i_rwsem locking in blkdev_write_iter(), from two
fixes for the same race landing in the window
- Advance the iterator after copy-in for SG_DXFER_TO_FROM_DEV, fixing
an infinite loop in blk_rq_map_user_iov()
- Check the open mode for LOOP_SET_STATUS in the compat ioctl
- rnbd-srv use-after-free and kobject fixes
- drbd timer and req_lock fixes
- zloop cleanups and error path fixes
- cdrom header and kernel-doc cleanups"
* tag 'block-7.4-20261029' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (109 commits)
blk-crypto: fix NULL deref and UAF in __blk_crypto_evict_key()
zloop: check that the zone backing file support ->{read,write}_iter
zloop: fput file after failed zone init
zloop: share more code for opening a zone backing file
zloop: remove a duplicate call to zloop_get_block_size
block: fix kernel-doc warnings in blk-map.c and blk-mq-dma.c
blk-iocost: publish hweights as one atomic value
blk-iocost: abort weight transfer on invalid donation weights
rnbd-srv: publish the sess_dev at the end of OPEN
rnbd-srv: fix use-after-free on two CLOSE messages
block/rnbd-srv: drop the sess_dev kobject unlocked
block/rnbd-srv: don't free the device on a sysfs error
drbd: take req_lock to skip the initial sync as peer
drbd: stop the start_resync timer of a dying device
block: apply the segment size to the integrity buffer
blk-mq: free the bitmaps of tags in the SRCU callback
block: partitions/mac: compute the sectors in 64 bits
blk-mq: set up a queue under tag_list_lock
blk-mq: exit the hctxs of a queue under tag_list_lock
blk-mq: quiesce a queue that joins a quiesced tag set
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux
Pull clk updates from Stephen Boyd:
"Here's the clk changes for the merge window which is dominated in the
diffstat by Qualcomm churning out new SoCs that need clk drivers.
Looking beyond the sheer amount of lines of mostly data there we have
a clk nexus DT binding change in the core clk framework and a driver
core patch to add a subsys driver macro.
The clock nexus support is useful for devices that map clks internally
or for connectors on a board that route clock signals to another
board. I suspect the use of this will expand in the future, so we have
unit tests to make sure it doesn't break.
The driver core change adds subsys_driver() and
subsys_platform_driver() so we can register early drivers without
open-coding that all (module_platform_driver() is at device initcall
level so it isn't be used).
Beyond the core framework bits we have lots of changes all over the
tree to initialize 'struct clk_init_data'. The potential risk here is
that someone forgets to initialize all the members of that structure
and either the clk flags cause weird behavior later on or the parents
are pointing at junk and the clk is orphaned forever. The patches just
initialize the thing with zeroes to be safe. Longer term we should
probably move this struct out of 'struct clk_hw' and pass it during
clk registration time. That's a much bigger change and would require
restructuring entire drivers that rely on the pointer being there.
Finally, we have the usual fixes like calculation updates for
dividers, handling error paths during clk registration, or fixing clk
data now that drivers are using them. Those patches are dwarfed by the
amount of new SoC support and only affect those SoCs and the consumers
of those clks. Overall I'm more concerned the clk_init_data patches
are going to expose some latent bugs that we didn't notice before
because something was relying on clks being orphaned and now they're
not.
Core:
- subsys_driver() / subsys_platform_driver() macros
- Clock nexus DT binding support (with KUnit tests)
- Spread-spectrum configuration validation
- Fully initialize struct clk_init_data across many drivers
New Drivers:
- Anlogic DR1V90 CRU
- ZTE zx297520v3 top, matrix, and LSP clocks
- Samsung Exynos5515 and ACPM driver extended to Exynos850.
- Qualcomm Eliza camera, camera-BIST, GPU, and video clks
- Qualcomm Hawi / Maili camera and GPU controllers
- Qualcomm Kuno global, RPMh
- Qualcomm MSM8952 global, RPM
- Qualcomm Nord camera/video clocks, EMAC interconnect, PHY resets
- Qualcomm IPQ5210 / IPQ9650 network clocks
- i.MX93 350 MHz fractional-N GP-PLL for display
- i.MX pll14xx spread-spectrum clock generation
- Amlogic A9 SCMI clock controller
- Allwinner single-divider "update bit" support
- EN7523 Serdes port selection"
* tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (316 commits)
clk: imx: pll14xx: support spread spectrum clock generation
clk: cdce925: Size the PLL child name buffer for any int
clk: stm32: fix clock array size for STM32MP21
dt-bindings: clock: Convert HiSilicon clocks to DT schema
clk: lmk04832: Handle reset GPIO lookup errors
dt-bindings: clock: anlogic,dr1v90-cru: make external clocks optional
clk: tegra: bpmp: remove kcalloc
clk: mmp2-audio: add missing PM_CLK dependency
clk: zte: Introduce a driver for zx297520v3 LSP clocks
clk: zte: Introduce a driver for zx297520v3 matrix clocks
clk: zte: Introduce a driver for zx297520v3 top clocks
clk: zte: Add zx PLL support infrastructure
clk: zte: Add regmap-based clocks
clk: zte: Add Clock registration infrastructure
dt-bindings: clk: zte: Add zx297520v3 LSP clock and reset controller
dt-bindings: clk: zte: Add zx297520v3 matrix clock and reset controller
dt-bindings: clk: zte: Add zx297520v3 top clock and reset controller
clk: nuvoton: ma35d1: Add missing WDT/WWDT parent clocks
dt-bindings: clock: ma35d1: Add missing WDT/WWDT parent clocks
dt-bindings: clock: ma35d1: Drop CLK_MAX_IDX define
...
|
|
https://github.com/Paragon-Software-Group/linux-ntfs3
Pull ntfs3 updates from Konstantin Komarov:
"The bulk of this cycle is hardening against corrupted or maliciously
crafted volumes. Most of these fixes come from fuzzing and KASAN
reports. The main areas are:
- $LogFile replay, where several unchecked on-disk sizes could make
mount write past the MFT record buffer
- MFT record and index parsing
- extended attributes, where a bad $EA entry could leak up to 64K of
kernel heap to userspace through getxattr()
Reading a damaged compressed file could also return uninitialized page
cache contents to userspace; that is fixed too.
A few fixes affect healthy volumes as well: a heap overflow in
fallocate(INSERT_RANGE) on small files, a use-after-free when a
WOF-compressed file is opened for writing during a concurrent read, a
lock-order deadlock in readdir, and stale disk data showing up in
newly allocated clusters of compressed files.
On the feature side there are new tracepoints covering mount, log
replay, lookup, directory index, allocation, iomap and file I/O. There
is also a new 'ugm' mount option (on by default): with ugm=0, newly
created files don't get the WSL uid/gid/mode extended attributes,
which Windows doesn't use.
The rest is smaller correctness fixes and cleanups"
* tag 'ntfs3_for_7.4' of https://github.com/Paragon-Software-Group/linux-ntfs3: (52 commits)
ntfs3: add file I/O tracepoints
ntfs3: add iomap tracepoints
ntfs3: add allocation tracepoints
ntfs3: add directory index tracepoints
ntfs3: add create inode tracepoint
ntfs3: add namei tracepoints
ntfs3: add mount and log replay tracepoints
fs/ntfs3: validate the EA value length in ntfs_read_ea()
fs/ntfs3: handle partial allocation in attr_data_get_block_locked()
ntfs3: fix mapping pairs bounds check for alignment
fs/ntfs3: bound DeleteAttribute asize against rec->used in do_action
ntfs3: release ni_lock before dir_emit in ntfs_readdir to fix deadlocks
fs/ntfs3: bound CreateAttribute asize against record_size in do_action
fs/ntfs3: do not mark frame pages uptodate on read error
fs/ntfs3: prevent positive E_NTFS_NONRESIDENT from reaching writeback error handling
fs/ntfs3: fix ntfs_fnd leak when compare function is missing
fs/ntfs3: fix stale attr_b in attr_allocate_frame()
fs/ntfs3: reject unaligned hole punching on compressed files
fs/ntfs3: take ni_lock() once in ntfs_readdir()
fs/ntfs3: reserve a compression unit in maxbytes_sparse
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux
Pull hyperv updates from Wei Liu:
- Update to documents and code comments (Michael Kelley)
- Harden Vmbus (Kameron Carr)
- Rework MSHV driver page deposit logic (Mukesh Rathor)
- Vmbus kexec bug fix (Shradha Gupta)
- Miscellaneous bug fixes (Daehyeon Ko, Jiale Yao, Sasha Levin)
* tag 'hyperv-next-signed-20261028' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux:
Drivers: hv: Remove leftover support for old Hyper-V versions
mshv: Remove unused *_old memory deposit functions
mshv: Redesign hypervisor memory deposit logic
mshv: Rename memory deposit memory functions to _old
mshv_vtl: reject poll files with multiple waitqueues
mshv_vtl: detach poll waiter on POLLFREE
mshv_vtl: initialize poll file mutex before device registration
Documentation: hyperv: Update information on guest CPU offlining
Documentation: hyperv: Remove support for guests on Hyper-V 2012/2012R2
Drivers: hv: Run VMBus kexec cleanup from syscore shutdown
kexec: Add helper to report an active kexec reboot
tools: hv: remove unused rte_smp_mb()
Documentation: hyperv: Update documentation for sending VMBus packets
Drivers: hv: vmbus: Check ACPI companion before use
Documentation: hyperv: Describe validation of the ring buffer indices
Drivers: hv: vmbus: Keep the ring byte counts sane for a bad index
Drivers: hv: vmbus: Compute ring byte counts from a caller-held snapshot
Drivers: hv: vmbus: Use *_ONCE() to access shared ring buffer indices
Drivers: hv: vmbus: Bounds check the shared ring buffer indices
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux
Pull RISC-V updates from Paul Walmsley:
- Add support for crash hotplug
- Improve user copy performance on cores with fast misaligned accesses
- Optimize code paths involving pgtable_l{4,5}_enabled() by patching in
the return values during early boot (since these don't change during
runtime), or by specifying the return values directly in Kconfig
files (for purpose-built kernels)
- Change the PCIe bus reassignment behavior to depend on the
PCI_REASSIGN_ALL_BUS PCI flag (as ARM64 does)
- Avoid an unnecessary sstatus CSR read during context switch
- Make the sbi_ecall() macro variadic, improving code clarity
- Refactor __switch_to_vector() to prepare for upcoming vector context
switch optimizations
- Add a kselftest for vectorized user copy
- Add bounds checking on the shadow stack restore token address to
avoid it being used as an attack vector
- Fix the shadow stack and indirect branch landing pad control
functions to only update the CPU's envcfg CSR when operating on the
current task
- For MIPS RISC-V systems, add support for early boot-applied errata;
and for P8700 RISC-V systems, avoid WFI usage in the kernel (since it
is buggy)
- Add the "B" RISC-V ISA extension to hwcap and hwprobe reporting
- Add support for specifying and reporting the "Zic64b" RISC-V ISA
extension, and add it to the SpacemiT K1, K3, and Sophgo SG2044 DT
files
- Require the block size of cache management operations to be specified
in DT schema validation for the RISC-V ISA extensions Zicbom, Zicbop,
and Zicboz
- Some miscellaneous fixes: fix an incorrect bitfield width in the
RVG_SYSTEM_CSR_MASK bitmask macro; make RISCV_ALTERNATIVE mandatory,
now that XIP kernel support has been removed; and remove some
unnecessary includes in kernel/smp.c
* tag 'riscv-for-linus-7.4-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (28 commits)
riscv: mm: unexport _pgtable_l4_enabled and _pgtable_l5_enabled
riscv: introduce RISCV_ISA_SV48 and RISCV_ISA_SV57
riscv: support early isa ext and use it to optimize pgtable_l4|l5_enabled
riscv: convert pgtable_l4|l5_enabled to inline function
riscv: remove RISCV_ALTERNATIVE Kconfig option
riscv: Add a getter for user PMLEN support
riscv: dts: sophgo: sg2044: Add Zic64b ISA extension
riscv: dts: spacemit: k1: Add Zic64b ISA extension
riscv: dts: spacemit: k3: Add Zic64b ISA extension
riscv: Add Zic64b to cpufeature and hwprobe
dt-bindings: riscv: Add Zic64b extension description
dt-bindings: riscv: Require block-size for Zicbom, Zicbop, and Zicboz
riscv: Add B to hwcap and hwprobe
riscv: remove unused profile.h includes
riscv: cfi: Only write envcfg CSR when task is current
riscv: cfi: Bounds check restore token before swap
riscv: Add ERRATA_MIPS_P8700_WFI to replace WFI with mips.pause
selftest: riscv: test vectorized user copy
riscv: vector: refactor context switch for kernel-mode vector
riscv: do not read csr in vector context switch
...
|
|
messes with devices and drivers"
This reverts commit fcbfaffee51a452cc8efcbaa3b88ec4595678424.
Turns out that vfio is a crazy beast and people have been "relying" on
the bind/unbind debugging feature as a way to handle passing through
devices to guest instances. Because of this (https://xkcd.com/1172/),
let's revert the feature for now until we can figure out a more agreeable
way to handle this such that normal workflows do not taint the kernel.
Odds are something like what Uwe proposes at:
https://lore.kernel.org/lkml/cover.1790612298.git.u.kleine-koenig@baylibre.com/
will be the best way forward and will be revisited after for after 7.4.
The feature was originally intended to stem the flow of unnecessary
fuzzing reports of "broken" drivers where random devices were being
bound to random drivers and of course things were going wrong. The main
syzbot tool is now not doing this anymore, and hopefully no one else
starts it up again (but in this madness of LLMs these days, you can't be
sure.)
Thanks to everyone for telling me just how wrong I was to implement
this, I appreciated the feedback :)
Link: https://lore.kernel.org/all/DLIL9H50MALI.3JROXYEEUM3KU@kernel.org/
To: Jonathan Corbet <corbet@lwn.net>
To: Shuah Khan <skhan@linuxfoundation.org>
To: Randy Dunlap <rdunlap@infradead.org>
To: "Rafael J. Wysocki" <rafael@kernel.org>
To: Danilo Krummrich <dakr@kernel.org>
To: Johan Hovold <johan@kernel.org>
To: Steven Rostedt <rostedt@goodmis.org>
To: Masami Hiramatsu <mhiramat@kernel.org>
To: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Reported-by: Leon Romanovsky <leon@kernel.org>
Reported-by: Jason Gunthorpe <jgg@ziepe.ca>
Reported-by: Michal Pecio <michal.pecio@gmail.com>
Reported-by: "Uwe Kleine-König" <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/20261028-bind_taint-revert-v1-1-7c6b9cef30c9@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Revert the change in Documentation/admin-guide/tainted-kernels.rst.
- Danilo ]
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux
Pull Rust fixes from Miguel Ojeda:
"Toolchain and infrastructure:
- Fix 'objtool' warnings for the upcoming Rust 1.101.0 (expected
2026-12-24) by adding one more 'noreturn' function
'kernel' crate:
- Fix KCFI failures on every call from C to Rust IRQ handlers and
'hrtimer' callbacks by giving the C enum bindings the correct
'cfi_encoding'. Also prevent the same issue for DMA callbacks
taking 'dma_data_direction'
- 'workqueue' module: fix a runtime warning when queueing work on the
deprecated 'system_wq' by switching to 'system_{percpu,dfl}_wq'"
* tag 'rust-fixes-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:
rust: dma: declare cfi_encoding for dma_data_direction
rust: hrtimer: declare cfi_encoding for hrtimer_restart
rust: irq: declare cfi_encoding for irqreturn
objtool/rust: add one more `noreturn` Rust function for Rust 1.101.0
rust: workqueue: replace deprecated system_wq with system_{percpu,dfl}_wq
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Jakub Kicinski:
"Current release - new code bugs:
- mctp: usblib: fix assertion breaking esoteric builds
Previous releases - regressions:
- Revert advertising the TCP MSS from the configured MTU
- netlink: check sk_rcvbuf before charging the dump skb
- eth:
- ti: am65-cpts: fix support for PTP_EXTTS_REQUEST2 ioctl
- mlx4: always create the eth and ib auxiliary devices
- tg3: invert restart quirk logic to restrict SNP power-down bypass
- bnxt: recycle agg buffers when Rx head buffer allocation fails
Previous releases - always broken:
- net: fix frag_list leak in skb_segment_list() error path
- sctp: reject forged cookie peer_addr with unknown address family
- vxlan: keep reserved_bits across changelink
- net: limit priority VLAN untag depth
- inet: frags: prevent acceptance of partially authenticated reassembly
- gro: do not GRO GSO packets with inconsistent payload
- tcp: avoid double destroy in tcp_abort() of an unaccepted child"
* tag 'net-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (137 commits)
tun: drop batched packets while the device is down
selftests: net: netlink-dumps: start a dump with a notification queued
netlink: check sk_rcvbuf before charging the dump skb
net/sched: act_ife: do not consume the inner header on egress
openvswitch: use eth_type_trans_careful() in internal_dev_recv()
net: use eth_type_trans_careful() in __dev_forward_skb2()
loopback: use eth_type_trans_careful()
net: add eth_type_trans_careful()
tcp: initialize mapped children before route lookup
tcp: fix reordering addition overflow in MTU probing
tcp: avoid double destroy in tcp_abort() of an unaccepted child
net: bgmac: fix TX DMA unmapping and slot cleanup
gro: do not GRO GSO packets with inconsistent payload
net/packet: check TX_RING fragments before memory accounting
eth: bnxt: hand XDP frags over to the copybreak skb
eth: bnxt: free XDP frags when xdp_do_redirect() fails
eth: bnxt: don't leak buffers when XDP agg buffer allocation fails
eth: bnxt: resize Rx head buffers when rx-copybreak changes
eth: bnxt: recycle agg buffers when Rx head buffer allocation fails
netdev-genl: ignore NETDEV_UNREGISTER rebroadcasts
...
|
|
Pull bpf fixes from Alexei Starovoitov:
- Remove BPF_F_ARENA_SCALAR flag and .arena.data section in libbpf that
were added for rust-bpf in this merge window. We found a cleaner
approach that does it on compiler side instead of kernel/libbpf. No
released kernel has them (Alexei Starovoitov)
- Fix bpf_send_signal_task() returning -EPERM when it is called from a
kernel thread (Aditya Sharma)
- Various fixes (Alexei Starovoitov):
- Use emit_rsb_call() to call bpf_unwind_target() in x86 JIT to fix
objtool warning during the build
- Fix scalar evolution: clear delta of a widened register, don't
widen a pointer to a buffer, don't clamp a register whose type
changed in the loop, and reset the range of a clamped packet
pointer
- Finish the insn in the state that maybe_fork_scalars() splits
off, so that pruning doesn't drop it at the head of a counted
loop
- Preserve the registers that carry stack arguments across
arch_bpf_timed_may_goto() on x86-64, arm64 and riscv64
- Don't re-sort subprog_info[] for every new subprogram
- Fix flaky map_kptr and rcu_reentry selftests
- Use memmove() in bpf_skb_load_bytes(), bpf_skb_load_bytes_relative()
and bpf_xdp_load_bytes(), since the destination can be a slice of the
same packet (Ayushman Rout)
- Fixes and follow-ups for scalar evolution: reject pointer operands in
32-bit recurrences and latches, don't intersect with the current
register range on clamp to avoid a false 'verifier bug', avoid false
infinite loop reports, and recognize a 32-bit copy of the induction
variable (Eduard Zingerman)
- Fix out-of-bounds write to btf->types[] for split BTF and propagate
btf_add_type() errors in btf_check_all_metas() (Feng Yang)
- Fix use-after-free in bpf_timer callback that fires after its inner
map was freed (Mani Tofigh)
- Fix x86 JIT stopping before jumps converge: size backward jumps by
the insns they jump over (Mykyta Yatsenko)
- Fix use-after-free of struct_ops trampoline: dissociate struct_ops
progs before the grace period of the map (Qiliang Yuan)
- Validate stack argument reads against the caller state to fix
out-of-bounds read in the verifier, and reject callbacks with stack
arguments (Weiming Shi)
- Tie borrowed iterator results and pointers loaded from trusted fields
to the lifetime of their source, so that iterator next, destroy and
reference release invalidate them (Xu Yunxiang)
* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (48 commits)
bpf: Don't re-sort subprog_info[] for every new subprogram
bpf: Fix out-of-bounds btf->types write for split BTF
selftests/bpf: Test stack arguments across may_goto
bpf: Keep stack arguments in arch_bpf_timed_may_goto()
selftests/bpf: Test maybe_fork_scalars() at the head of a counted loop
bpf: Finish the insn in the state that maybe_fork_scalars() splits off
selftests/bpf: Test the clamp of pointers in scalar evolution
bpf: Reset the range of a packet pointer that scalar evolution clamps
bpf: Don't clamp a register whose type changed in the loop
selftests/bpf: Test a loop that moves a pointer to a buffer
bpf: Don't widen a pointer to a buffer in scalar evolution
selftests/bpf: Avoid a page fault in rcu_reentry while the handler is armed
selftests/bpf: Wait for the last maps of map_kptr to be freed
selftests/bpf: Test that a widened register is not linked
bpf: Clear delta of a register that scalar evolution widens
bpf, x86: Remove r0_on_stack from fetching atomics in arena
bpf: Remove BPF_F_ARENA_SCALAR
selftests/bpf: Remove tests for arena access through numbers
libbpf: Keep format strings of bpf_printk() in .rodata
libbpf: Remove .arena.data
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux
Pull more documentation updates from Jonathan Corbet:
"A handful of late-arriving changes, most of which were ready ahead of
the merge window:
- More Portuguese translation updates
- Some docs-build and self-test fixes
- Bring documentation for the user-space access primitives
in include/linux/uaccess.h into the docs build.
This revealed a number of malformed kerneldoc comments,
which are fixed in a subsequent tweak to uaccess.h"
* tag 'docs-7.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux:
uaccess: fix some erroneous kerneldoc comments
docs/translations/pt_BR: admin-guide: add efi-stub.rst
docs/translations/pt_BR: admin-guide: add kernel-parameters.rst
docs/translations/pt_BR: admin-guide: add bootconfig.rst
docs/translations/pt_BR: admin-guide: add perf-security.rst
docs/translations/pt_BR: admin-guide: add LSM/index.rst
docs/translations/pt_BR: admin-guide: add hw-vuln/index.rst
docs/translations/pt_BR: admin-guide: add cputopology.rst
docs/translations/pt_BR: admin-guide: add sysctl/index.rst
docs/translations/pt_BR: admin-guide: add sysfs-rules.rst
docs/translations/pt_BR: admin-guide: add features.rst
docs: pt_BR: process: translate userspace debugging guide
docs: kerneldoc.py: preserve headings in kernel-doc output
docs: xforms_lists: Handle DECLARE_KHOSER_PTR() struct members
docs: test_doc_build: don't select urllib3 yanked version
docs: test_doc_build: address pylint warnings
docs: test_doc_build: update it to support newer Sphinx versions
docs: test_doc_build: better handle python version
docs: admin-guide: Fix typo in kernel-parameters.txt
docs: core-api: include documentation from linux/uaccess.h
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
Pull cgroup fixes from Tejun Heo:
- cgroup.kill did not kill a process whose thread group leader had
exited while other threads still ran, nor those threads once moved to
another cgroup, letting a process survive its container being killed
- A cgroup.procs write under favordynmods could migrate a newly forked
process before fork linked it to its cgroup, corrupting cgroup task
lists
- cpuset partition fixes for nested hierarchies: invalidation, revival,
shrinking and switches between root and isolated could leak isolated
CPUs, skip or miscompute the housekeeping check, or leave wrong
effective CPUs:
- A root partition can no longer be created under an isolated
parent or stay valid under one, as disabling it could leave no
housekeeping CPUs
- Enabling a partition failed when a grandchild held tasks,
although the parent had none of its own
- Separately, an allocation racing with a cpuset.mems update could
drop its mempolicy nodemask and land on the wrong node, and a
memoryless node in cpuset.mems triggered a spurious "movable
nodes only" warning
- Two no-functional-change cleanups of the effective CPU
computation
* tag 'cgroup-for-7.4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: (27 commits)
cgroup/cpuset: Integrate compute_partition_effective_cpumask() into compute_effective_cpumask()
cgroup/cpuset: Relocate compute_*effective_cpumask() and compute_effective_nodemask()
cgroup/cpuset: Release invalid isolated CPUs with a shrunk root partition parent
cgroup/cpuset: Release invalid isolated CPUs in compute_partition_effective_cpumask()
cgroup/cpuset: Make sure compute_partition_effective_cpumask() is only called for valid partition
cgroup/cpuset: Prevent recursive call of remote_cpus_update() via update_cpumasks_hier()
selftests/cgroup: Check for a single range nohz_full CPUs before running test matrix
cgroup/cpuset: Minor fixes to prstate_housekeeping_conflict()
cgroup/cpuset: Fix incorrect effective_cpus bug in update_cpumasks_hier()
cgroup/cpuset: Properly compute effective xcpus in update_parent_effective_cpumask()
cgroup/cpuset: Find furthest isolated ancestor for invalidated isolated partition
cgroup: don't kill migrated processes through their exiting threads
cgroup/cpuset: check effective mems for a movable-only configuration
cgroup/cpuset: Fix task checking when enabling a partition
cgroup: serialize migrations of newly forked processes
selftests/cgroup: test cgroup.kill with an exited thread group leader
cgroup: fix cgroup.kill for exited thread group leader
selftests/cgroup: Skip test_cpuset_prs.sh test if some required CPUs are offline
selftests/cgroup: Add tests for nohz_full housekeeping check
selftests/cgroup: Add tests for isolcpus housekeeping check
...
|
|
nvme updates for Linux 7.4
- Fix regressions from the parallel nvme-tcp I/O queue setup: request
PDU sizing with header digest, a NULL controller dereference when
reconnecting with more queues, and early lock initialization
- Handle TLS control records in nvme-tcp: skip records arriving ahead
of the ICResp, and start error recovery when the socket read fails
- Fix an nvme-tcp io_work priority inversion stalling I/O
- Fix nvme-tcp address attribute race with queue teardown
- Validate the TLS handshake timeout parameters for host and target
- Fix fabrics connects with isolated CPUs and queue mapping bugs
- Fix early boot hang and buffer size for the nvme.quirks parameter
- Fix nvme-rdma NULL metadata SGL dereference with T10-PI
- Fix ANA underflow check and an nvme-fc discovery reference leak
- Fix nvme-loop BUG() when a namespace scan races a reset
- Target port and configfs locking fixes, and port removal races
- Target auth fixes for CHALLENGE failure and negotiation handling
- Target fc fixes for a connection use-after-free, read data on failed
commands, and admin queue allocation failure teardown
- Target rdma fix for short connection requests
- Target rdma fix for inline SGL out-of-bounds write
- Target rdma refcount, locking, and module unload fixes
- Target pci-epf SGL length and error status fixes
- Target NULL dereference fixes for pci-epf and debugfs
- Target ZNS NUMD overflow check
- Target Connect fix for a controller leak with a zero queue size
- Target fixes for a metadata SGL double-free and a leaked blk plug
- Target fix for truncated large discards
- Misc cleanups
* tag 'nvme-7.4-2026-10-28' of git://git.infradead.org/nvme: (44 commits)
nvmet: don't clear sq->ctrl for a Connect with sqsize 0
nvmet-rdma: fix double puts after a failed RDMA WRITE
nvmet-rdma: disable interrupts under rsp_wr_wait_lock
nvmet-rdma: flush nvmet-wq on module exit
nvme-loop: don't BUG() if a scan runs beside a reset
nvmet-tcp: don't read a removed port at Connect time
nvmet: fix NULL dereference in debugfs host_traddr
nvmet-tcp: stop listening when a port is removed
nvmet: fix NULL dereference of PCI endpoint targets
nvmet-auth: take only AUTH_Negotiate for a negotiation
nvmet: don't truncate the length of big discards
nvme-tcp: validate the TLS handshake timeout
nvmet-tcp: validate the TLS handshake timeout
nvmet: Free the old negotiation state when restarting authentication
nvmet: Finish the blk plug when integrity allocation fails
nvme-tcp: fix NULL queue->ctrl dereference on reconnect
nvme-tcp: Validate the queue state under the queue lock in the address attribute
nvme-tcp: fix io_work priority inversion when send_mutex is held
nvme-tcp: fix request PDU size when header digest is enabled
nvme-tcp: skip TLS control records while waiting for the ICResp
...
|
|
The gtp generic netlink family sends notifications on its "gtp"
multicast group when a PDP context is added or deleted, and for GTP-U
echo responses. They carry the same attributes as a GETPDP reply: the
MS and peer addresses, and the TEIDs, or the TID and the flow label.
GETPDP requires CAP_NET_ADMIN, but generic netlink lets any user join a
multicast group by default, so an unprivileged user in the network
namespace of the gtp device can read all of this. Found by code
inspection.
Fix by marking the group with GENL_MCAST_CAP_NET_ADMIN, like the psample
"packets" group, and with uns-admin-perm in the gtp netlink spec. Only
users with CAP_NET_ADMIN in the user namespace owning the network
namespace can then join it.
This is still weaker than the check on GETPDP, which needs
CAP_NET_ADMIN in the initial user namespace: in a network namespace
owned by another user namespace, its root can join the group, but not
use GETPDP. Genetlink has no multicast group flag for the initial user
namespace, and ioam6 pairs its ops and its group the same way. This fix
blocks the unprivileged users.
Tested by joining the group as root, as root without CAP_NET_ADMIN, and
as an unprivileged user:
Before:
root: joined
root without CAP_NET_ADMIN: joined
nobody: joined
After:
root: joined
root without CAP_NET_ADMIN: EPERM
nobody: EPERM
Fixes: 50aba46c234e ("gtp: add notification mechanism")
Reviewed-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: Anil Kaushik <anilkaushikwireless@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20261027130623.3136658-1-anilkaushikwireless@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
|
SECBIT_EXEC_RESTRICT_FILE and SECBIT_EXEC_DENY_INTERACTIVE tell script
interpreters to only run what AT_EXECVE_CHECK allows and to refuse
interactive input. A service manager sets them together with their lock
bits so that nothing below it can turn them off again.
But set_cred_user_ns() resets all securebits to SECUREBITS_DEFAULT. So
any task that can create a user namespace sheds the locked exec bits
with a single unshare(CLONE_NEWUSER) and joining one with setns() does
the same. The lock is pointless if anyone who may create a user
namespace can drop it, and that is pretty much everyone.
Resetting the other bits is fine. They are about how capabilities are
computed and a new user namespace starts out with a full set of
capabilities anyway. The exec bits grant nothing though. They are
restrictions a task placed on itself, just like no_new_privs which a
user namespace doesn't touch either. So keep them and their locks.
Reproducer:
// SPDX-License-Identifier: GPL-2.0
/* Lock the exec securebits, then create a user namespace and look at them again. */
#define _GNU_SOURCE
#include <sched.h>
#include <stdio.h>
#include <sys/prctl.h>
#define SECBIT_EXEC_RESTRICT_FILE (1 << 8)
#define SECBIT_EXEC_RESTRICT_FILE_LOCKED (1 << 9)
#define SECBIT_EXEC_DENY_INTERACTIVE (1 << 10)
#define SECBIT_EXEC_DENY_INTERACTIVE_LOCKED (1 << 11)
int main(void)
{
int bits = SECBIT_EXEC_RESTRICT_FILE | SECBIT_EXEC_RESTRICT_FILE_LOCKED |
SECBIT_EXEC_DENY_INTERACTIVE | SECBIT_EXEC_DENY_INTERACTIVE_LOCKED;
if (prctl(PR_SET_SECUREBITS, bits, 0, 0, 0)) {
perror("PR_SET_SECUREBITS");
return 1;
}
printf("before: 0x%x\n", prctl(PR_GET_SECUREBITS, 0, 0, 0, 0));
printf("clear locked bits: %s\n", prctl(PR_SET_SECUREBITS, 0, 0, 0, 0) ? "refused" : "ALLOWED");
if (unshare(CLONE_NEWUSER)) {
perror("unshare(CLONE_NEWUSER)");
return 1;
}
printf("after unshare(CLONE_NEWUSER): 0x%x\n", prctl(PR_GET_SECUREBITS, 0, 0, 0, 0));
return 0;
}
On v7.1 this prints "before: 0xf00", "clear locked bits: refused" and
"after unshare(CLONE_NEWUSER): 0x0". With this patch the last line
reads 0xf00 as well.
Fixes: a0623b2a1d59 ("security: Add EXEC_RESTRICT_FILE and EXEC_DENY_INTERACTIVE securebits")
Cc: stable@vger.kernel.org # v6.14+
Link: https://patch.msgid.link/20261026-work-securebits-userns-v1-1-b35473fa1a34@kernel.org
Reviewed-by: Mickaël Salaün <mic@digikod.net>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
|
|
The comment in fsverity_ioctl_read_metadata(), which justifies not
checking for FMODE_READ, doesn't consider that the nonstandard access
mode 3 (ioctl-only) exists.
Opening an ioctl-only fd generally requires read (and write) permission.
However, there are gaps with certain LSMs: an ioctl-only fd requests
read (and write) permission via security_inode_permission, but not
security_file_open. With certain LSMs relying on the latter, such as
Landlock and AppArmor, an ioctl-only fd can be opened without the LSM
granting read (and write) permission.
Since FS_IOC_READ_VERITY_METADATA returns hashes of file contents
blocks, it should require read permission. This also applies to
FS_IOC_MEASURE_VERITY, which returns a hash for the whole file.
Meanwhile, ioctl-only fds are a rarely-used feature, not known to be
used with either ioctl.
Therefore, just disallow these ioctls on ioctl-only file descriptors,
similar to what was already done with FS_IOC_ENABLE_VERITY.
More specifically, explicitly check for FMODE_READ. This also covers
write-only fds to non-verity files which otherwise would have failed
with ENODATA. This change in error code for write-only fds should be
fine too, as these ioctls cannot be usefully used with write-only fds
anyway, but it's worth noting as another technicality.
Fixes: 4dd893d832cf ("fs-verity: implement FS_IOC_MEASURE_VERITY ioctl")
Fixes: e17fe6579de0 ("fs-verity: add FS_IOC_READ_VERITY_METADATA ioctl")
Cc: stable@vger.kernel.org
Reviewed-by: Andrey Albershteyn <aalbersh@kernel.org>
Link: https://patch.msgid.link/20261022211522.1489943-1-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86
Pull x86 platform driver updates from Ilpo Järvinen:
"The usual updates for laptop quirks from HP, ASUS, Acer, Dell etc:
- new model names and recent CPU support
- more special button / function key handling
- battery and hardware monitoring quirks
Tool updates to intel-speed-select
WMI now supports non-x86 architectures
Miscellaneous cleanups / refactoring / improvements"
* tag 'platform-drivers-x86-v7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (237 commits)
platform/x86: asus-wmi: name the TUF keyboard RGB state and speed codes
platform/x86: asus-wmi: fix TUF keyboard power state shutdown naming
platform/x86: asus-wmi: rename TUF RGB state DEVID to _CMD
platform/x86: asus-armoury: add power limits quirk for GU605CM
platform/x86: asus-armoury: add power limits quirk for G533QS
platform/x86: asus-armoury: add power limits quirk for GA402NV
platform/x86: asus-armoury: add power limits quirk for FA608UP
platform/x86: asus-armoury: add power limits quirk for FA608UH
platform/x86: asus-armoury: add power limits quirk for FA608PM
platform/x86: asus-armoury: add power limits quirk for G713QR
platform/x86: ibm_rtl: Fix potential OOB read at signature search
platform/x86: acer-wmi: Add support for Acer Nitro AN16-41
platform/x86: acer-wmi: Cycle platform profile on mode key 0x4
platform/x86: hp-wmi: Disable hwmon attributes when no fans are usable
platform/x86: gpd pocket fan: Cancel work before releasing GPIOs
platform/x86: asus-armoury: Add XBOX ROG Ally X 20 Tunables
platform/x86: msi-wmi: Ignore WMI events for keys also handled by atkbd
platform/x86: msi-wmi: Sort scancodes numerically
platform: arm64: Add a driver for the EC found on ASUS Glymur machines
MAINTAINERS: Add myself as a LENOVO drivers co-maintainer
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine
Pull dmaengine updates from Vinod Koul:
"This consists of start of work for hiding dmaengine internals and
adding new APIs for dmaengine calls. Also couple of drivers and device
and lot of updates esp AI-assisted improvements to drivers.
Core:
- Better document descriptor flags and clarify ordering rules around
cookie completion
- New APIs to start hiding dmaengine guts so that we can start making
them internal
New Support:
- Nord and Maili GPI DMAengine support
- DW axi dma updates and support for UltraRISC DP1000 controller
- Apple M3 generation ADMACs support
- Amlogic A9 SoC DMA controller driver
- Sun6i refactoring and support for Allwinner A733 DMA controller
Updates:
- Freescale device_prep_peripheral_dma_vec support and dynamic
scatter/gather chaining
- TI crossbar and cppi DT schema conversion
- zynqmp driver updates for error patch handling
- Link list handling improvements for DW edma driver
- ST dma40 improvements and corner case handling"
* tag 'dmaengine-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: (149 commits)
dmaengine: amlogic: Fix regmap error check issue
dmaengine: ste_dma40: Preserve the LCPA I/O address space
docs: dmaengine: clarify ordering rules around cookie completion
dmaengine: move driver-private helpers out of include/linux/dmaengine.h
dmaengine: add dmaengine_desc_set_callback() helper
dmaengine: add dmaengine_get_provider_device() API
dmaengine: add dmaengine_get_max_xor() helper
dmaengine: add dmaengine_get_cap_mask() and dmaengine_has_cap() helpers
dmaengine: add dmaengine_get_copy_align() and related alignment getter helpers
dmaengine: add dmaengine_is_*_aligned() helpers for DMA consumers
dmaengine: add dmaengine_prep_dma_(pq|pq_val|interrupt|xor)() API
dmaengine: sh: rcar-dmac: Add support for R-Car Gen5 SoCs
dt-bindings: renesas,rcar-dmac: Add support for R-Car X5H SoC
dmaengine: sh: rcar-dmac: SMMU doesn't need IPMMU workaround
dmaengine: sh: rcar-dmac: fix style in struct initialization
dmaengine: qcom: bam_dma: free interrupt before the clock in error path
dmaengine: ppc4xx: fix typo "contoller" in comment
dmaengine: ste_dma40: Search all blocks for fixed logical channels
dt-bindings: dma: dma40: Restore disabled-channels
dmaengine: ste_dma40: Validate memcpy configuration
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy
Pull phy updates from Vinod Koul:
"As usual bunch of new device and driver support and updates to
existing drivers:
New Support:
- Rockchip rk3576 csi dphy support
- Mediatek MT8195, MT8196 DisplayPort PHYs. MT8196 PCI-Express Gen4
S-PHY, MT8189 tphy support
- Qualcomm Nord eUSB2, QMP USB PHY, QMP PCIe and Gen5x16 PHY support,
M31 eUSB2 PHY, Maili QMP UFS & PCIe PHY, Shikra PCIe phy
- New driver for Qualcomm CSI2 C-PHY/DPHY support and new APIs in
core to parse phy nodes
- Nvidia Tegra238 XUSB pad controller support, Tegra264 MPHY driver,
Tegra264 xusb support
- Thunderbolt phy support in core and Qualcomm driver support for
USB4 for X1E platforms
- Google Tensor SoC USB PHY driver
- ASPEED AST2700 USB3 PHY driver
- Microchip MCP2542 can phy support
Updates:
- FRL TxFFE config support and Samsumg driver support and runtime PM
for dcphy driver
- Mediatek optional repeater support for USB2 ports
- Refactoring and improvements on rockchip usbdp driver
- Apple USB4 pipehandler state support
- Rockchip single-lane DP support"
* tag 'phy-for-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: (114 commits)
phy: tegra: Add support for Tegra238 XUSB pad controller
phy: tegra: xusb: Use dev_err_probe()
dt-bindings: phy: tegra194: Add compatible for Tegra238
MAINTAINERS: Add ASPEED USB3 PHY driver
phy: aspeed: Add AST2700 USB3.2 PHY driver
dt-bindings: phy: aspeed: Document AST2700 USB3.2 PHY
phy: rockchip: phy-rockchip-inno-csidphy: add support for rk3576 variant
dt-bindings: phy: rockchip-inno-csi-dphy: add rk3576 variant
phy: mediatek: Add support for PCI-Express Gen4 S-PHY
dt-bindings: phy: Document MT8196 MediaTek PCI-Express Gen4 S-PHY
phy: tegra: Add Tegra264 MPHY driver
dt-bindings: phy: Add nvidia,tegra264-mphy
phy: rockchip: samsung-hdptx: Add support for FRL TxFFE level control
phy: rockchip: samsung-hdptx: Handle PHY config after module reload
phy: hdmi: Add optional FRL TxFFE config options
phy: tegra: xusb: Add Tegra264 support
phy: tegra: xusb: Increase timeout for USB2_TRK_COMPLETED polling
phy: tegra: xusb: Use devm_clk_get_optional to fetch USB2 tracking clock
dt-bindings: phy: tegra-xusb: Add support for Tegra264
phy: freescale: fsl-samsung-hdmi: initialize default rate
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire
Pull soundwire updates from Vinod Koul:
- CLOCK_STOP_MODE1 support in bus and Intel driver
- DMI quirks for disabling ghost on Lenovo Yoga 7 Pro, Lenovo Yoga
Slim 7, Lenovo Pro 9, Lenovo Yoga Slim 7i 14IPH11.
- Few more codecs as wake capable, tac5xx2 family, rt718, rt766/rt767
- Qualcomm Shikra SoC support
* tag 'soundwire-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire:
soundwire: intel_auxdevice: add rt766/rt767 codec to wake_capable_list
soundwire: dmi-quirks: Disable ghost rt711 on Lenovo Yoga Slim 7
soundwire: dmi-quirks: Disable ghost Realtek on Lenovo Yoga 7 Pro
soundwire: intel_auxdevice: add rt718 codec to wake_capable_list
soundwire: dmi-quirks: drop the ghost RT1320 on the Surface Pro 11 (Intel)
soundwire: qcom: add EE-aware register layout for Shikra
dt-bindings: soundwire: qcom: add qcom,shikra-soundwire compatible
soundwire: Intel: stop sdw clock in system suspend
soundwire: Intel: add wake_enable parameter to stop_bus ops
soundwire: bus: add CLOCK_STOP_MODE1 support back
soundwire: dmi-quirks: Disable ghost Realtek on Lenovo Pro 9
soundwire: qcom: cache SCP_ADDRPAGE1/2 to preserve MBQ atomicity
soundwire: bus: iterate DT compatibles for class-ID match
soundwire: fix repeated words in log messages
soundwire: intel_auxdevice: add tac5xx2 family to wake_capable_list
soundwire: bus_type: Use devres to free slave IDA
soundwire: dmi-quirks: add Lenovo Yoga Slim 7i 14IPH11
soundwire: intel: initialise quirk_mask before reading it
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux
Pull rpmsg updates from Bjorn Andersson:
- Allow virtio rpmsg to use separate transmit and receive buffer counts
based on the vring sizes, and obtain buffer sizes from virtio config
space when the feature is negotiated. Document the configuration and
report the MTU in the sample driver.
- Fix signal interruption and timeout handling while waiting for a
virtio transmit buffer. Release the device tree node reference on
MediaTek channel teardown.
- Convert the rpmsg control ioctl comments to kernel-doc format.
* tag 'rpmsg-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux:
rpmsg: virtio: fix error handling in TX buffer wait
rpmsg: mtk: release channel OF node on device teardown
samples: rpmsg: Fix mtu printk specifiers
samples: rpmsg: Add MTU size info
docs: rpmsg: Add virtio config space details
rpmsg: virtio_rpmsg_bus: Get buffer size from config space
rpmsg: virtio_rpmsg_bus: Allow different size of tx and rx bufs
rpmsg: virtio_rpmsg_bus: Rename rbufs and sbufs
rpmsg: ctrl: use kernel-doc format for ioctl macros
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux
Pull remoteproc updates from Bjorn Andersson:
- Add Qualcomm QMI Thermal Mitigation Device support for PAS-managed
remote processors, with cooling device bindings and configurations
for Hamoa, Kodiak, Lemans, Talos, Monaco, and Shikra CDSP and modem
subsystems as applicable.
- Add per-power-domain proxy performance states for Hawi CDSP and
update Hawi, Maili, and SDX75 PAS compatible bindings and the SDX75
device tree. Correct the Qualcomm ADSP startup timeout.
- Fetch auto-boot firmware only once and synchronize boot work with
device removal. Bound ELF section header accesses, improve trace
diagnostics, and update coredump configuration documentation.
- Set 48-bit DMA masks for TI K3 DSP and R5 remote processors, correct
mailbox message types, and enable compile testing for more TI
drivers. Fix i.MX address range boundary checks and DSP runtime PM
ordering, and simplify mailbox notification handling.
- Harden Xilinx mailbox setup and teardown and avoid sending
notifications when the transmit queue is full. Propagate STM32
optional IRQ lookup errors and correct the MediaTek MT8188 SCP
register binding.
* tag 'rproc-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: (33 commits)
remoteproc: qcom_q6v5_pas: Add QMI TMD cooling support for Shikra
remoteproc: virtio: Remove stray white space
remoteproc: virtio: Replace kmemdup with kmemdup_array
remoteproc: virtio: Add vdev_to_rsc() helper
remoteproc: core: Fetch the auto-boot firmware only once
remoteproc: xlnx: fix typecast warnings
remoteproc: qcom_q6v5_pas: enable QMI TMD cooling support
remoteproc: qcom: pas: add support for TMD thermal cooling devices
soc: qcom: Add QMI TMD support for remote thermal mitigation
dt-bindings: remoteproc: qcom,pas: add #cooling-cells property
remoteproc: qcom_q6v5_pas: add per-PD proxy performance states for Hawi CDSP
dt-bindings: remoteproc: qcom,sm8550-pas: make qcom,hawi-cdsp-pas standalone
arm64: dts: qcom: sdx75: Use SM8650 MPSS as fallback compatible
dt-bindings: remoteproc: qcom,sm8550-pas: Make SDX75 MPSS fallback to SM8650
dt-bindings: remoteproc: qcom,sm8550-pas: Add Hawi and Maili MPSS as SM8650 fallback
dt-bindings: remoteproc: Fix MT8188 SCP regs
remoteproc: Use %p for pointer formatting
remoteproc: Add compile testing for additional TI drivers
remoteproc: k3-dsp: Fix usage of omap_mbox_message and mbox_msg_t
remoteproc: k3: Include what we need and only what we need
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux
Pull I3C updates from Alexandre Belloni:
"This introduces the I3C hub support in the core with drivers still
being worked on. Then we have the usual fixes and cleanups:
Subsystem:
- Add APIs for I3C hub support
- Restrict HDR modes to those supported by the bus and target
- Fix ACPI target enumeration on multi-instance controllers by
extracting the bus-controller instance number and PID from the
correct _ADR fields.
- allocate IBI workqueue with WQ_HIGHPRI
Drivers:
- dw: Synaptics sl2610 support
- mipi-i3c-hci: HDR-DDR support, cleanup and fixes"
* tag 'i3c/for-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux: (28 commits)
dt-bindings: i3c: Add Synaptics sl2610 i3c
i3c: dw: switch to array-based exclusive reset control
dt-bindings: i3c: dw: support up to two reset lines
i3c: hub: Add support for the I3C interface in the I3C hub
dt-bindings: i3c: Add NXP P3H2x4x i3c-hub support
i3c: master: Add controller-only device operation helpers
i3c: master: Add APIs for I3C hub support
i3c: master: use named initializers for acpi_device_id
i3c: master: adi: free the IRQ before unregistering the master
i3c: master: amd: Report direct CCC read length in payload.actual_len
i3c: mipi-i3c-hci: Add HDR-DDR support
i3c: Restrict HDR modes to those supported by the bus and target
i3c: mipi-i3c-hci: Support configurable device NACK retries
i3c: mipi-i3c-hci: Remove invalid HDR-BT and Fm/Fm+ definitions
i3c: mipi-i3c-hci: Remove invalid transfer size limit
i3c: mipi-i3c-hci: Correct RESP_DATA_LENGTH to bits 15:0
i3c: mipi-i3c-hci: Stop rings gracefully when suspending
i3c: mipi-i3c-hci: Move DMA suspend/resume callbacks
i3c: mipi-i3c-hci: Process multiple IBIs per interrupt
i3c: mipi-i3c-hci: Fix runtime PM violation in i3c_hci_free_ibi()
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply
Pull power supply and reset updates from Sebastian Reichel:
"Power-supply core:
- introduce LOAD_SWITCH property
- pack power_supply_desc to optimize memory
- prevent power-supply device unregistration while callback runs
- drop last CONFIG_OF build-time dependencies from the core
- documentation fixes
Power-supply drivers:
- bq27xxx: add support for bq27z746, bq28z620
- ab8500: add AB8505 support
- bq257xx: fix probe time configuration race condition
- multiple: convert drivers with custom LOAD_SWITCH properties to the
new standard one
- cros_charge-control: restore EC state on resume
- qcom_battmgr: fix USB type reporting, notify charger online state,
report full batteries and correct capacity on X1E
- gpio-charger: always report as discharging if input power is
missing
- bq24190_charger: don't reset registers across system suspend
- qcom_smbx: a lot of independent fixes
- lots of error and module removal path fixes
- misc fixes
Reset drivers
- misc fixes"
* tag 'for-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: (77 commits)
power: supply: gpio-charger: Report discharging without input power
power: supply: qcom_battmgr: report full batteries
power_supply: serialize property access with unregister
power: supply: bq257xx: Describe the dev field in the driver data structure
power: supply: qcom_battmgr: Notify charger supplies of online changes
power: supply: generic-adc-battery: fix status with no supplier
power: supply: qcom_battmgr: report the USB type from USB_ADAP_TYPE
power: supply: sysfs: Ratelimit "unavailable enum value" warning
power: supply: cros_charge-control: restore EC state on resume
power: supply: qcom_smbx: set the charge enable after software control
power: supply: generic-adc-battery: Propagate charged GPIO errors
power: supply: sbs-battery: disable polling before supply teardown
power: supply: pf1550: drain IRQ work before unregistering supplies
power: supply: bq256xx: Expose VBUS state through extcon
power: supply: ab8500_fg: Avoid reserved AB8505 CCConf bit
power: supply: ab8500_fg: Finalize current measurements
power: supply: ab8500_charger: Recover inactive AB8505 charger
power: supply: ab8500_charger: Retry AB8505 USB detection
power: supply: ab8500_charger: Skip absent AB8505 main charger
power: supply: ab8500_charger: Handle detection errors
...
|
|
tls_handshake_timeout is writable but stored as a signed int. Multiplying
the value by MSEC_PER_SEC and HZ therefore uses signed arithmetic.
With HZ=1000, setting it to 2147484 overflows both multiplications. If
the handshake request is accepted and its completion remains pending,
schedule_timeout() reports a wrong timeout value with a stack dump and
returns zero. The handshake then fails immediately with -ETIMEDOUT,
while the handshake agent was given about 24.9 days. Negative values
such as -1 have the same kernel-side effect.
Store the parameter as an unsigned int and reject values that cannot be
represented both by tls_handshake_args::ta_timeout_ms and by a safe
jiffies delay. Take one snapshot so a concurrent parameter update cannot
give the handshake agent and completion wait different timeouts.
Document the accepted range for built-in use.
wait_for_completion_interruptible_timeout() returns the remaining
jiffies as a long after a successful completion. Keep that result in a
long because an accepted timeout can exceed INT_MAX jiffies on 64-bit
systems.
Negative and oversized values now fail with -EINVAL. Keep zero valid,
preserving the existing immediate-timeout behavior.
Fixes: be8e82caa685 ("nvme-tcp: enable TLS handshake upcall")
Cc: stable@vger.kernel.org
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Yingjie Wang <1075151112@qq.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
|
|
tls_handshake_timeout is writable but stored as a signed int. Multiplying
the value by MSEC_PER_SEC and HZ therefore uses signed arithmetic.
With HZ=1000, setting it to 2147484 overflows both multiplications. If
the handshake request is accepted and remains pending, the timer wheel
treats the jiffies delay as already expired and queues the timeout work
on its next advance, while the handshake agent was given about 24.9
days. Negative values such as -1 cause the same immediate kernel-side
timeout.
Store the parameter as an unsigned int and reject values that cannot be
represented both by tls_handshake_args::ta_timeout_ms and by a safe
jiffies delay. Take one snapshot so a concurrent parameter update cannot
give the handshake agent and delayed work different timeouts. Document
the accepted range for built-in use.
Negative and oversized values now fail with -EINVAL. Keep zero valid,
preserving the existing immediate-timeout behavior.
Fixes: 675b453e0241 ("nvmet-tcp: enable TLS handshake upcall")
Cc: stable@vger.kernel.org
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Yingjie Wang <1075151112@qq.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
|
|
After TX is offloaded on device A, a route change, or a change in the
usable-slave set of an 802.3ad or balance-xor (layer3+4) bond, can make
RX setup program device B. tls_device_attach() sees the existing TLS
destructor and keeps ctx->netdev pointing at A. The RX driver state on B
is then untracked: tls_dev_resync() and tls_dev_del() are invoked on A
for a context it never created, and neither socket close nor
NETDEV_DOWN on B calls tls_dev_del() for B, so the driver context leaks.
The reverse setup order has the same problem.
Check the shared device binding under device_offload_lock before each
tls_dev_add(). Permit the first attachment and a second direction on the
same device. Reject a different device, including when the old binding
was cleared by NETDEV_DOWN: the TLS destructor remains installed and
tls_device_attach() cannot establish a new binding. Setup then falls
back to software for the requested direction.
The RX check precedes allocation and software setup. TX uses its existing
resource unwind path without calling the driver. Document the shared
binding and clarify that fallback is per direction.
This issue was discovered during code review and subsequently
reproduced on hardware using mlx5 and TLS 1.2 AES-GCM-128.
Changing the route between TX and RX setup installed the second
direction on a different device. Driver traces showed successful adds
on both devices, but both deletes at socket close targeted the first
device, leaving an orphaned context on the second. Both setup orders
reproduced the leak, even though all current core TLS context counters
returned to zero. No crash was observed.
With the fix, the same tests correctly fall back to software for the
second direction and leave no orphaned hardware context.
Fixes: 4799ac81e52a ("tls: Add rx inline crypto offload")
Signed-off-by: Rishikesh Jethwani <rjethwani@purestorage.com>
Signed-off-by: Dave Miller <davem@davem-thinkpadp1gen8.ibmlond.csb>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull tracing updates from Steven Rostedt:
- Add "within" to filter logic
Add a way to trace events by what function they fall in.
echo 'within == "vfs_read" > events/sched/sched_switch/filter
Will only trigger sched_switch events that happen within the vfs_read
function. It uses a stacktrace at the event and checks if any entry
is within the specified function and if so, it prints the event.
- Remove a duplicate definition of ftrace_set_clr_event() from the
header
- Do not have ftrace_set_clr_event() modify its input buffer
Have the buffer passed into ftrace_set_clr_event() to be const char *
and not allow modifications to it that might cause side effects.
- Add kunit tests for ftrace_parse_event_string()
- Add filter argument to __ftrace_set_clr_event()
Make it possible to set a filter on an event at the same time it is
enabled.
- Add event filtering logic to the kernel command line
To allow filtering events on boot, allow filtering to be specified on
the kernel command line when enabling events.
- Rename "ring_buffer_size()" to "ring_buffer_capacity()"
"size" refers to how much is allocated whereas the actual return
value is the amount of available data in the ring buffer minus its
meta data.
- Rename "trace_array_entries" to "trace_array_capacity"
There's several functions that use "entries" and returns the amount
of data that that is usable. "entries" should be only for the number
of events, not the amount of data.
- Print the histogram "bucket" size as unsigned.
If a bucket size is LONG_MAX, then it shows up as a negative number.
- Show bucket size in output of histograms
The output of what the histogram is shown doesn't show the size of
the buckets when buckets are used. The output should be the same as
the input and since specifying buckets without a size is an invalid
command, the output to display what was entered should also show the
size.
- Fix stacktrace modifier output
Only show the stacktrace modifier when it was specified in creation.
- Unregister filed variable histograms when the command fails
If one histogram references a variable of another histogram it
registers that other histogram. But if the first histogram fails in
setup after it registered the other histogram it doesn't unregister
it. Have the first histogram add the reference to the other histogram
so the failure clean up will unregister the second histogram too.
- Fix 64-bit signed histogram fields on 32-bit kernels
A fix to convert char * to u64 with added casting also incorrectly
added an intermediate cast to convert a long value to u64 which ended
up truncating the upper 32 bits for 32-bit kernels. Remove the
intermediate typecast.
- Print signed histogram keys as signed
Histogram keys were being printed as unsigned and with signed keys it
was giving the wrong output.
- Use copy_from_user() and not __copy_from_user() in syscall tracing
The syscall tracing incorrectly was using __copy_from_user() which
could be an issue if the system trusts perf doing the trace.
- Take trace_types_lock when recording a new module in persistent
buffer
When a new module is loaded, the persistent ring buffer saves it in
its persistent memory. All the trace_arrays are iterated looking for
any persistent buffer to add the module to. But it did not hold the
trace_types_lock meaning a trace_array could be added or removed
while iterating the list.
- Only create tracepoint guest_halt_poll_ns when it is used
The tracepoint guest_halt_poll_ns is defined in the power management
code but it is only used when CONFIG_CPU_IDLE_GOV_HALTPOLL is
enabled. This wastes memory when that config isn't enabled so wrap
the tracepoint around that as well.
- Handle empty fields for events in trace_event_get_offsets()
The user events could have empty fields and this causes
trace_event_get_offsets() to crash as it expects events to always
have fields. Make the function handle events with no fields.
- Reject incomplete event filter expressions
If a filter has an incomplete expression (common_pid == 1111 || ), it
will cause a out-of-bounds bug. Have the predicate_parse() only
process the expression if it is complete.
* tag 'trace-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (27 commits)
tracing: Reject incomplete event filter expressions
tracing: Guard trace_event_get_offsets() against an empty fields list
cpuidle: haltpoll: Only define guest_halt_poll_ns tracepoint when used
tracing/osnoise: Add __printf attribute to osnoise_print()
tracing/histograms: Verify event_call identity when updating synth_event refcount
tracing: Save the event file instead of the compatible histogram
tracing: Hold trace_types_lock when resetting last boot data from readers
tracing: Hold trace_types_lock when updating modules in persistent instances
tracing/syscalls: Use copy_from_user for the faultable syscall buffer
tracing: Print a signed histogram key as signed
tracing: Fix 64-bit and signed histogram fields on 32-bit kernels
tracing: Clamp the printed end of a histogram bucket at U64_MAX
tracing: Unregister field variable histograms when the command fails
tracing: Only report the stacktrace modifier on a real field
tracing: Add the bucket size to expr_field_str()
tracing: Print the bucket size as unsigned
tracing: Rename tracing_entries_fops to tracing_capacity_fops
tracing: Rename trace_array::entries to capacity
ring-buffer: Rename ring_buffer_size() to ring_buffer_capacity()
tracing: Parse filter from boot event string
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull more MM updates from Andrew Morton:
- "mm: make VMA flag semantics explicit, eliminate VM_SPECIAL" (Lorenzo
Stoakes):
Replace VM_SPECIAL with helpers describing mapping ownership and
behavior. Enforce the mmap flag rules and convert affected drivers,
removing ambiguous tests shared by driver mappings and ordinary
memory.
- "support kselftest on nommu platform" (Hajime Tazaki):
Add opt-in mmap and mremap tests for NOMMU systems. Teach the runner
to avoid its fork-dependent timeout command and document the build
and runtime requirements.
- "mm/collapse: separate a collapse from its callers" (Kiryl
Shutsemau):
Separate huge-page collapse from caller policy. Replace khugepaged
identity checks with explicit permissions, and separate scanning from
collapse with the mmap_lock drop in one place.
- "mm: implement and use vma_has_anon_rmap(), silence KCSAN" (Lorenzo
Stoakes):
Provide a common helper for testing whether a VMA has anonymous
reverse mappings. Document the locking rules, annotate intentional
concurrent reads for KCSAN, and convert the core MM callers.
- "mm/sparse: remove SECTION_MARKED_PRESENT and further cleanups"
(David Hildenbrand):
Remove SECTION_MARKED_PRESENT in favor of the early-section flag.
Simplify sparse memory initialization, section metadata handling and
related PFN validity checks.
- "sh: remove NUMA and SPARSEMEM support" (Mike Rapoport):
Remove SuperH NUMA and SPARSEMEM support. The extra memory banks have
been unusable since the NO_BOOTMEM conversion, leaving only the code
and data overhead.
- "mm: Unify device DAX and HugeTLB vmemmap population paths" (Muchun
Song):
Unify the generic device DAX and HugeTLB vmemmap population paths and
shared tail-page handling. Remove the duplicate DAX machinery while
retaining the powerpc radix implementation.
- "kselftest: mm: fix some failure of split_huge_page_test" (Yeoreum
Yun):
Fix huge-page split tests racing with khugepaged recollapse. Use
pagemap and page flags instead of VMA-boundary assumptions which fail
when glibc has already enabled THP.
- "memcg: move memcgid refcount to objcg to unpin dying memcgs"
(Bingfang Guo):
Let dying memcgs be freed while swapped-out shmem still holds their
IDs. Move ID references to reparentable objcgs, with the necessary
swap accounting and RCU lifetime changes.
- "mm/truncate: fix data loss when truncating straddling large folios"
(Zhang Yi):
Preserve out-of-range data when truncating straddling large folios.
Fix a lookup race and split-failure handling, and handle minimum
folio orders for the forthcoming ext4 iomap buffered I/O path.
- "mm/damon: introduce damos quota goal target metric complement flag"
(SJ Park):
Let DAMOS quota goals use a metric's complement, so utilization can
also express free-memory goals without adding separate metrics. Add
the sysfs interface, documentation and tests.
- "arm64/mm: Standardize printing for pgtable entries" (Anshuman
Khandual):
Use the generic formatter for arm64 page-table entries, ready for
future wider entries. Move the safe-PTE-update check out of the
header to avoid an include cycle.
- "mm: kmsan: fix iounmap metadata teardown" (Dima Koziuk):
Fix KMSAN metadata leaks on iounmap and failed ioremap allocations.
Free backing pages before removing their mappings, and share the
teardown with partial-allocation cleanup.
- "mm/damon/core: preserve quota state when constructing schemes" (Karl
Mehltretter):
Preserve running DAMOS quota state while validating parameter
updates. Even rejected updates could reset accounting and exceed the
quota window; add tests for both accepted and rejected updates.
- "mm/vmalloc: fix vmalloc_dump_obj VA lookup" (Ye Liu):
Fix vmalloc_dump_obj() lookups for last-page addresses and
allocations spanning vmap zones. These allocations were being missed
in diagnostic output.
- "mm: various (urgent?) fixes" (David Hildenbrand):
Fix mmap charge leaks and hugetlb use-after-free, wrong-address
unmapping, stuck locks and endless faults. Also preserve reservations
on failed mremap and handle stale userfaultfd bits.
- "maple_tree: fix maple_range_64 crashes in RCU mode" (Dimitris
Charisis):
Fix pointer and metadata confusion during RCU destruction of
maple_range_64 nodes, avoiding double frees and invalid accesses. Add
a regression test; no in-tree user currently uses this combination.
- "mm: fix hugetlb NR_HUGETLB accounting on folio migration" (Hongfu
Li):
Fix hugetlb migration and preallocation accounting so /proc/vmstat
retains the correct count and memory.numa_stat follows the folio to
its new node.
- "mm/damon: fix a minor bug, clean code, and add a test" (SJ Park):
Fix 32-bit DAMON age overflow which made old regions look young.
Share hugetlb folio acquisition code and add a regression test for
the previously fixed last-region skipping bug.
- "mm/damon/core: cleanup code, reduce stack usage, and add kunit" (SJ
Park):
Reduce kdamond stack usage and remove unused enums. Add deterministic
PSI quota-goal tests which do not depend on the machine's current
memory pressure.
- "mm/damon: fix the temporal goal tuner's size quota conversion"
(Donggeun Yoo):
Bound the temporal tuner's quota conversion to prevent overflow and
zero effective quotas, which could stop schemes making progress. Add
boundary tests.
- "Don't use GFP_DMA when calling dma_alloc_coherent" (Baoquan He):
Remove redundant GFP_DMA flags from coherent DMA allocation calls.
The DMA API already selects the zone from device limits and ignores
the caller's flag.
- "kselftest: mm: fix intermittent failure khugepaged test" (Yeoreum
Yun):
Propagate child-process failures in the khugepaged tests and prevent
background collapse from racing their checks. This removes false
passes and intermittent failures.
- "MAINTAINERS: cover all hugetlb headers under HUGETLB SUBSYSTEM"
(Enze Li):
Cover all hugetlb headers in MAINTAINERS so get_maintainer.pl finds
the right maintainers. Also label the closing hugetlb_cgroup.h
include guard.
Summary of the 65 singletons in this merge:
The singletons include a few worthwhile performance fixes. Avoiding
unnecessary reverse-map tree updates gave a reported 15.9% improvement
in UnixBench's execl test on a 192-core x86 system. A reclaim retry
fix stops defrag_mode from spinning under memory.low protection; a
reported file-creation stress test ran 5.7 times faster, with far less
memory pressure. Narrower hugetlb invalidations also spare KVM guests
needless refaults: the reported Redis-in-VM P99 QPS penalty while
punching holes fell from 7.09% to 1.45%.
Several fixes prevent lost data or corrupted memory. Lazyfree
huge-page races with mremap()/munmap() could lose data or access freed
memory, and MADV_COLD could lose a concurrent write's dirty bit.
Another fix prevents stale migration entries from outliving large
folios. On filesystems with blocks smaller than a page, extending a
file by 4 GiB or more could expose bytes written past the old EOF
through mmap instead of zeroes. That is fixed, along with
use-after-free races in PAGEMAP_SCAN during process exit and in
memory-cgroup accounting on PREEMPT_RT kernels.
Other fixes stop UFFDIO_MOVE spinning forever on pinned large folios,
which could wedge other memory operations, and stop mremap() leaking
commit charges until allocations fail under strict overcommit. A
further fix keeps userfaultfd tracking intact on neighboring mappings.
NUMA binding no longer prevents long-term pins when the chosen node
has only movable memory, fixing QEMU/VFIO startup and io_uring buffer
registration failures. MGLRU also gets a fix for early-boot crashes
with memory cgroups disabled at boot, notably in small crash kernels.
* tag 'mm-stable-2026-10-25-19-27' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (213 commits)
mm: multi-gen LRU: fix NULL lruvec->pgdat deref with memcg disabled on cmdline
mm/page_counter: use WRITE_ONCE() for emin/elow when parent is the root
mm/memcontrol: publish null pointer before dropping css reference
test_maple_tree: test maple_range_64 node in RCU mode
maple_tree: fix maple_range_64 crashes in RCU mode
mm/vma: avoid broken uffd merge on mremap
tools/testing/shared: catch a failed posix_memalign()
mm/damon/core: remove unreachable damos charge_{target,addr}_from
mm/shrinker: allocate shrinker_info_unit from a dedicated kmem_cache
riscv: mm: exclude invalid THP PMDs from page table check
mm/damon/core: filter out damos address filter-split failed region
fs/proc/task_mmu: pin mm_users in do_pagemap_scan()
mm/mempolicy: apply bind policies against the scoped allocation zone
mm/vmscan: reclaim every zone in per-node proactive reclaim
mm/mremap: correctly uncharge accountable VMAs in error path
mm/mremap: populate calculated fields in vrm state correctly
MAINTAINERS: add an entry for MEMORY MANAGEMENT - MEMORY MAP
mm: bdi: reset min_ratio after the sysfs attributes are gone
mm/page_vma_mapped: continue past nonmatching huge PMDs
selftests/mm: skip hugetlb cgroup v2 tests without the needed controllers
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull non-MM updates from Andrew Morton:
- "ocfs2: exit recovery thread on mount error path" (Joseph Qi):
Stop OCFS2 recovery before freeing failed-mount state and replay
slots, closing use-after-free and double-free races. Defer
suballocator reclaim to break a transaction-lock deadlock with
dismount.
- "ocfs2: validate suballoc slot and bit of metadata blocks" (Joseph
Qi):
Validate OCFS2 metadata suballocator slots, bits and directory index
block locations. Reject corrupt metadata with filesystem errors
instead of BUGs or out-of-bounds accesses.
- "ocfs2: deal with legacy signed name hash values" (Joseph Qi):
Restore OCFS2 lookups for non-ASCII names stored with legacy signed
hashes. Use stored xattr hashes during bucket splits to avoid
duplicate entries and spurious ENOSPC failures.
- "ocfs2: stabilize dentry names in file and setattr traces" (Cen
Zhang):
Snapshot OCFS2 names during file and setattr tracing to prevent
rename races using freed storage or mismatched names and lengths.
Preserve trace formats and the locked release open-count sample.
- "panic: fix panic_force_cpu= redirect races and NMI bypass" (Bradley
Morgan):
Fix panic_force_cpu races and NMI redirection so crash-kernel CPU
selection is honored. Preserve variable arguments on failed redirects
and use a static message buffer.
- "fat: allocate multiple clusters in fallocate" (Matheus Alves de
Almeida):
Allocate FAT clusters in batches for FALLOC_FL_KEEP_SIZE and batch
FAT updates. This removes repeated single-cluster allocation
overhead, particularly on synchronous mounts.
- "scripts/gdb: fix radix tree lookup and stack depot diagnostic"
(Ting-Han Hou):
Fix GDB radix-tree lookup and its handling of XArray sibling, retry
and zero entries. Also repair the stack-depot diagnostic for an
out-of-range pool index.
- "hung_task: Improve warning budget handling and task reporting"
(Aaron Tomlin):
Reset the hung-task warning budget after recovery so later hangs
remain visible. Keep the configured limit intact and emit one summary
per scan when detailed reports exhaust the budget.
- "bootconfig: Reject unexpected data after null character and
cleanups" (Masami Hiramatsu):
Reject bootconfig data after an embedded null while accepting
trailing padding. Validate the full input in the userspace tool, and
retain internal tree sanity checks there rather than in the kernel.
- "kbuild: GCOV cleanups following the prefer-atomic fix" (Konstantin
Khorenko):
Use the actual GCOV build flags in the prefer-atomic compiler probe.
Move flag setup into scripts/Makefile.gcov and skip the probe when
GCOV is disabled.
- "ocfs2: xattr bucket validation fixes" (Joseph Qi):
Accept valid OCFS2 xattr buckets spanning 512-byte blocks, avoiding
false read-only remounts. Reject misaligned buckets and return errors
instead of panicking on corrupt defrag metadata.
- "ocfs2: fix metadata reservation for xattr value trees" (Joseph Qi):
Reserve enough OCFS2 metadata for new and relocated xattr value
trees. Fix shortfalls which could cause ENOSPC, dropped entries and
leaked clusters on fragmented filesystems; remove duplicate
reservations.
- "Introduce arch_do_panic" (Mete Durlu):
Add arch_do_panic() and move s390 and sparc handling out of generic
panic code. The architecture-specific actions now follow the
end-of-panic marker.
- "checkpatch: userspace improvements" (Petr Vorel):
Improve checkpatch's userspace detection and suppress kernel-only
checks. Recognize standard inttypes macros and add explicit
--userspace and --no-userspace overrides.
- "ocfs2: validate dr_fs_generation of dir index root blocks" (Joseph
Qi):
Check OCFS2 directory index generations and leaf block numbers.
Reject stale or misplaced blocks instead of using metadata left by a
previously formatted filesystem.
- "selftests/membarrier: Skip an unregistered memory barrier test on
Musl" (Chris Gellermann):
Skip the unregistered membarrier test when libc has already
registered the command. Musl does this during thread creation,
causing false failures in the multithreaded test.
- "init: fix array boundary bugs in boot parameter parsing"
(Wilson Felipe Pereira):
Fix boot argument boundary cases which leave stale arguments in
init's command line or panic when replacing the final environment
variable. Clear the last slot and check duplicates before the limit.
Summary of the 87 singletons in this merge:
The OCFS2 singletons fix deadlocks between xattr updates and inline
truncation, and during inode reclaim. Corrupt quota and extent
metadata could also crash the kernel or corrupt memory; these paths
now check the layout before using it. Other fixes close use-after-free
and publication races around cluster reconfiguration, node failure,
quota remount errors and shared refcount trees. New files now retain
security labels from all stacked LSMs instead of silently dropping all
but one. Valid xattr insertions also stop tripping FORTIFY on builds
with counted arrays.
Elsewhere, a lost wakeup could leave hardware-monitoring reads stuck
in unkillable sleep and block further I2C traffic. That is fixed, as
are kernel memory leaks in POSIX message-queue notifications and tmpfs
casefold setup which could grow until memory is exhausted. A driver
removal race which could crash the kernel is fixed too. The
hibernation command through reboot() also stops taking the same mutex
twice, avoiding a deadlock before suspension.
On the boot side, bzip2 decoding now accepts valid full blocks emitted
by lbzip2, fixing failures to boot those compressed kernels. Malformed
bzip2 streams can no longer overflow the decode buffer, and LZ4
initrds are checked before the decoder can read past their end. FAT
rejects geometry which overflows the data-area calculation on 32-bit
systems, and rolls back entries when inode setup fails, preventing
failed creations from reappearing after remount. The x86 XOR and RAID6
AVX paths also avoid imposing a slowdown on subsequent SSE code.
* tag 'mm-nonmm-stable-2026-10-25-14-57' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (134 commits)
scripts/gdb: fix stack depot out-of-bounds diagnostic
scripts/gdb: fix radix tree lookup pointer handling
ocfs2/cluster: remove zero-address nodes from IP tree on teardown
ocfs2: snapshot the dentry name while tracing file release
ocfs2: snapshot dentry names in file and setattr traces
ocfs2/dlm: drain join handlers before releasing module text
MAINTAINERS: update Markus's e-mail address
mailmap: add entries for Andrew Jones
stackdepot: stop preallocating after the final pool
ocfs2: drain quorum work before removing the cluster
watchdog: force console verbose when reporting lockups
profiling: fix sampling step on 64-bit big-endian systems
kernel/reboot: avoid potential deadlocks during suspension
compat: avoid double rounding in times()
ocfs2: pin owning modules for open debugfs files
ocfs2/cluster: initialize heartbeat regions before publishing them
selftests/proc: proc-pid-vm: fix unused variable warning on non-x86
ocfs2: pin refcount trees before dropping the lookup lock
ocfs2: validate the xattr tree root of an indexed xattr block
ocfs2/dlm: hold the lookup reference across convert AST enqueue
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs
Pull f2fs updates from Jaegeuk Kim:
"In this round, key enhancements focus on introducing a dedicated
metadata cache infrastructure and dynamically parameterizing on-disk
block layouts and geometry macros.
Moving meta, node, and compress blocks out of the VFS page cache
removes the page == block size assumption for metadata, which along
with dynamic block layout descriptions paves the way for large folio
and page != block support in the future.
We also opt in to multigrain timestamps, add bio entry-count
throttling for asynchronous write_end_io completion, and expose the
resizable_tail feature via sysfs.
Alongside these features, critical bug fixes resolve race conditions
across compression, mmap write faults, checkpoint/shutdown, and
filesystem freeze, prevent write bio splitting and GC holes on
sequential zoned devices, and strengthen on-disk sanity checks for
SIT/NAT bitmaps, read-only curseg entries, and device aliasing.
Additional stability patches address online resize, roll-forward
recovery, atomic file operations, quota handling, and dirty inode
syncing livelocks.
Enhancements:
- implement dedicated metadata cache for meta, node, and compress
blocks to decouple metadata from page cache for large folio and
page != block support
- dynamically describe SIT, NAT, orphan, dentry, node, and xattr
block layouts and parameterize block/sector/node conversion macros
- opt in to multigrain timestamps
- introduce max_atc_write_bio_entry_cnt sysfs node
- expose resizable_tail feature via sysfs
- avoid unnecessary reads in f2fs_update_meta_block()
Bug fixes:
- compress: force out-place update for all writes, allow pinning
empty compressed files, and fix truncate/writeback and cache
population races
- zone: avoid bio split and GC target block grab failure on
sequential zones
- quota: convert inline quota files on quotaon, fix flush failure
during freeze, and restore empty string mount options
- atomic/mmap: disallow mmap write and data-modifying fallocate on
atomic files, avoid truncate_inode_pages_final() on live inodes,
and fix races in f2fs_vm_page_mkwrite()
- resize/alias: refresh pinned allocation boundary and flush SIT
journal during resize, and drop pending discards before reserving
device alias
- sanity check: bound SIT/NAT bitmaps by checkpoint pack, check all
cur_*_segno[] on readonly images, and validate multi-device on
device alias
- recovery/cp: release removed xattr node in roll-forward recovery,
invalidate curseg on change_curseg() failure, and return -EIO for
lost inode block after cp_error
- fix livelock in syncing dirty inodes and preserve APPEND/UPDATE ino
entries
- use bio_in_atomic() in f2fs_{read,write}_end_io()
- fix 32-bit shift truncation in mount option bitmasks and defragment
range
And a number of minor bug fixes"
* tag 'f2fs-for-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (79 commits)
f2fs: compress: don't overwrite populated compress cache entry
f2fs: fix to update superblock crc in sanity_check_area_boundary()
f2fs: fix to fetch ino via ino_of_node() under cache lock
f2fs: zone: fix to don't fail to grab GC target block on zoned device
f2fs: don't use truncate_inode_pages_final() on live inodes
f2fs: expose resizable_tail feature via sysfs
f2fs: use BIT_ULL for mount option bitmasks
f2fs: fix submit accounting for IPU writeback
f2fs: fix to avoid potential reference count leak in do_garbage_collect()
f2fs: refresh pinned allocation boundary after resize
f2fs: flush SIT journal during filesystem resize
f2fs: release a removed xattr node in roll-forward recovery
f2fs: quota: fix quota flush failure during filesystem freeze
f2fs: return -EIO for a lost inode block after cp_error
f2fs: avoid unnecessary reads in f2fs_update_meta_block()
f2fs: bound the SIT/NAT bitmaps by the checkpoint pack
f2fs: opt in to multigrain timestamps
f2fs: fix to use bio_in_atomic() in f2fs_read_end_io()
f2fs: fix to use bio_in_atomic() in f2fs_write_end_io()
f2fs: fix to invalidate curseg if change_curseg() fails
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse
Pull fuse updates from Miklos Szeredi:
- Add dax backing and extent map support for famfs (John Groves,
Miklos)
- Support large folios (Joanne)
- Add selftests and documentation of caching behavior (Luis Henriques)
- Add FUSE_SYNCFS request (Jimmy Zuber)
- Convert readdir cache to use folios (Tal Zussman)
- Lots of bug fixes
* tag 'fuse-update-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: (53 commits)
fuse: handle extent map files in fuse_passthrough_fadvise()
fuse: resolve extent maps in O(1) when possible
fuse: add support for striped backing
fuse: add extent map I/O support
fuse: add extent map data structure
fuse: add support for opening dax device as backing
fuse: support opening 64 bit backing ID
fuse: support 64 bit, server allocated backing ID
fuse: add helpers for EIO return value with kernel message
dax: use READ_ONCE() in dax_holder()
dax: add fsdev_dax_from_file()
fuse: fix copy_file_range reply handling race
virtiofs: validate fixed-output response length
fuse: don't d_drop() before d_splice_alias()
virtio_fs: read the vring size under virtio_fs_mutex in ->get_tree
fuse: validate folio state before pipe_buf_try_steal() in fuse_try_move_folio()
fuse: rename fuse_direct_io() to fuse_do_direct_io()
fuse: Forward vfs_fadvise to backing_file in passthrough mode
selftests/fuse: add the missing FUSE_HAS_SYNCFS privilege test
fuse: don't launder folios of a bad inode
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull vfs keyring updates from Christian Brauner:
"The kernel has two keyrings that userspace fills with X.509
certificates at boot: .fs-verity for fs-verity built-in signatures
and .dm-verity for dm-verity root hash signatures.
Neither is linked into any process keyring. Hence, request_key() and
KEYCTL_SEARCH can't find them. The only way for userspace to identify
them is to read their serial number out of /proc/keys. That is not
just a large file often the names can also be reused and appear
multiple times which allows forging these keyrings.
This adds two fixed special key ids, KEY_SPEC_DM_VERITY_KEYRING and
KEY_SPEC_FS_VERITY_KEYRING next to KEY_SPEC_BPF_KEYRING. The latter
went in through bpf-next this merge window.
lookup_user_key() resolves the fixed key ids to the two keyrings. So
userspace can add a dm-verity (fixed keyring id: -10) certificate with
keyctl padd asymmetric "" -10 < cert.der
and seal the keyring with
keyctl restrict_keyring -10
without looking anything up first"
* tag 'vfs-7.4-rc1.keyring' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
Documentation: keys: document IDs added since KEY_SPEC_REQKEY_AUTH_KEY
keys: add KEY_SPEC_FS_VERITY_KEYRING
keys: add KEY_SPEC_DM_VERITY_KEYRING
|
|
Commit d1706f9da9f4 ("PM: runtime: call pm_runtime_dont_use_autosuspend() on reinit()")
introduced a pm_runtime_dont_use_autosuspend() call that is executed automatically
on driver exit without making any changes to the kerneldocs.
Update the kerneldocs to clarify the current mechanism of
pm_runtime_use_autosuspend() cleanup on exit.
Fixes: d1706f9da9f4 ("PM: runtime: call pm_runtime_dont_use_autosuspend() on reinit()")
Signed-off-by: Joshua Crofts <crofts@kernel.org>
[ rjw: Added Fixes: tag ]
Link: https://patch.msgid.link/20261027122042.1444-1-crofts@kernel.org
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
|
|
Since commit 23c85094fe18 ("proc/kcore: add vmcoreinfo note to /proc/
kcore") the kernel has exported the vmcoreinfo PT_NOTE on /proc/kcore
as well as /proc/vmcore.
LoongArch does not provide arch_crash_save_vmcoreinfo(), so the arch-
specific values are missing from the vmcoreinfo PT_NOTE. The generic
exporter in kernel/vmcore_info.c already provides NUMBER(VMALLOC_START),
but tools like crash cannot derive VMALLOC_END, the module and vmemmap
ranges, VA_BITS, or the KASLR offset of a LoongArch dump.
Since commit 18210a104bb9 ("LoongArch: Expand module virtual address
space to 2GB") the vmalloc and module boundaries are no longer stable
across kernel versions either, so vmcoreinfo is the only reliable source
for them.
Provide this function in a separate file that is built at the same time
as its caller in kernel/vmcore_info.c, and add a LOONGARCH64 section to
Documentation/admin-guide/kdump/vmcoreinfo.rst.
Reported-by: Haoran Jiang <jianghaoran@kylinos.cn>
Suggested-by: Haoran Jiang <jianghaoran@kylinos.cn>
Tested-by: Tao Cui <cuitao@kylinos.cn>
Co-developed-by: George Guo <guodongtai@kylinos.cn>
Signed-off-by: George Guo <guodongtai@kylinos.cn>
Signed-off-by: Yangyang Lian <lianyangyang@kylinos.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
|
|
tcp_tso_autosize() right-shifts the u32 returned by tcp_min_rtt() by
sysctl_tcp_tso_rtt_log. The sysctl uses proc_dou8vec_minmax() without
an upper bound, so it accepts values through 255. Values above 31 make
the shift undefined.
A process with CAP_NET_ADMIN in the target network namespace can set the
per-netns sysctl. With CONFIG_UBSAN_SHIFT=y, setting it to 32 and sending
TCP data over loopback triggers:
UBSAN: shift-out-of-bounds in net/ipv4/tcp_output.c:2264:30
shift exponent 32 is too large for 32-bit type 'unsigned int'
Call Trace:
__ubsan_handle_shift_out_of_bounds
tcp_tso_segs
tcp_write_xmit
__tcp_push_pending_frames
tcp_push
tcp_sendmsg_locked
Limit the sysctl to 31, the largest valid shift count for a u32, and
document the accepted range. Writes of larger values now fail with
-EINVAL.
On a UBSAN/KASAN build of the net tree, values 0 and 31 remained
accepted, values 32 and 255 returned -EINVAL, and TCP traffic with the
valid boundary values produced no sanitizer diagnostics.
Fixes: 65466904b015 ("tcp: adjust TSO packet sizes based on min_rtt")
Cc: stable@vger.kernel.org
Signed-off-by: Yingjie Wang <1075151112@qq.com>
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Reviewed-by: Neal Cardwell <ncardwell@google.com>
Reviewed-by: Eric Dumazet <edumazet@kernel.org>
Link: https://patch.msgid.link/tencent_31D2FFCCE76C50A695A1270151F825E90906@qq.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
'clk-tenstorrent' and 'clk-pile' into clk-next
* clk-renesas: (25 commits)
clk: renesas: r8a78000: Add SGASYNCD8_PERW_BUS
clk: renesas: rzg2l: Fix internal clock names
clk: renesas: r9a08g046: Add TSU and ADC1 clocks and resets
clk: renesas: Add support for RZ/G2M v3.0
clk: renesas: r9a08g046: Add CANFD clocks and resets
clk: renesas: r9a08g046: Propagate clk rate for ETH TX mux clocks
dt-bindings: clock: Add r8a774a3 CPG Core Clock definitions
clk: renesas: r8a779g0: Add ZG clocks
clk: renesas: rcar-gen4: Tidy up DEF_GEN4_Z()
clk: renesas: r9a09g077: Register SYSC regmap
clk: renesas: rcar-gen3: Use FIELD_GET()
clk: renesas: rzv2h: Convert to clk_hw based provider API
clk: renesas: rzv2h: Drop duplicated parent lookup in fixed_mod_status_clk_register()
clk: renesas: r9a08g046: Add PCIe clocks and reset
clk: renesas: Make sure clk_init_data is fully initialized
clk: renesas: r9a08g046: Add clock and reset entries for LVDS
clk: renesas: r9a08g046: Add MIPI DSI and LCDC clock/reset entries
clk: renesas: r9a08g046: Sort macro definitions alphabetically
clk: renesas: rzg2l: Add support for RZ/G3L DSI mux
clk: renesas: rzg2l: Add support for LVDS fixed-factor divider with 4:7 duty cycle
...
* clk-samsung:
clk: samsung: acpm: add Exynos850 support
clk: samsung: acpm: introduce driver data for SoC-specific clocks
clk: samsung: Introduce Exynos5515 clock driver
clk: samsung: clk-pll: Add support for pll_309
dt-bindings: clock: Add Exynos5515 SoC
* clk-starfive:
dt-bindings: soc: starfive: Add StarFive JHB100 syscon modules
dt-bindings: clock: Add StarFive JHB100 Peripheral-3 clock and reset generator
dt-bindings: clock: Add StarFive JHB100 Peripheral-2 clock and reset generator
dt-bindings: clock: Add StarFive JHB100 Peripheral-1 clock and reset generator
dt-bindings: clock: Add StarFive JHB100 Peripheral-0 clock and reset generator
dt-bindings: clock: Add StarFive JHB100 System-2 clock and reset generator
dt-bindings: clock: Add StarFive JHB100 System-1 clock and reset generator
dt-bindings: clock: Add StarFive JHB100 System-0 clock and reset generator
* clk-tenstorrent:
MAINTAINERS: Update RISC-V Tenstorrent SoC entry
clk: tenstorrent: use regmap_assign_bits() for conditional set/clear
clk: tenstorrent: Fix refcount leak on shared gate clk enable failure
clk: tenstorrent: Assign .num before accessing .hws
* clk-pile: (126 commits)
clk: imx: pll14xx: support spread spectrum clock generation
clk: cdce925: Size the PLL child name buffer for any int
clk: stm32: fix clock array size for STM32MP21
dt-bindings: clock: Convert HiSilicon clocks to DT schema
clk: lmk04832: Handle reset GPIO lookup errors
dt-bindings: clock: anlogic,dr1v90-cru: make external clocks optional
clk: tegra: bpmp: remove kcalloc
clk: mmp2-audio: add missing PM_CLK dependency
clk: zte: Introduce a driver for zx297520v3 LSP clocks
clk: zte: Introduce a driver for zx297520v3 matrix clocks
clk: zte: Introduce a driver for zx297520v3 top clocks
clk: zte: Add zx PLL support infrastructure
clk: zte: Add regmap-based clocks
clk: zte: Add Clock registration infrastructure
dt-bindings: clk: zte: Add zx297520v3 LSP clock and reset controller
dt-bindings: clk: zte: Add zx297520v3 matrix clock and reset controller
dt-bindings: clk: zte: Add zx297520v3 top clock and reset controller
clk: nuvoton: ma35d1: Add missing WDT/WWDT parent clocks
dt-bindings: clock: ma35d1: Add missing WDT/WWDT parent clocks
dt-bindings: clock: ma35d1: Drop CLK_MAX_IDX define
...
|
|
Convert the HiSilicon Hi6220/Hi3660/Hi3670 clock bindings to DT schema
format. Rearrange the binding documents splitting out the stub clock
binding from everything else.
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Acked-by: Wei Xu <xuwei5@hisilicon.com>
Link: https://patch.msgid.link/20261001212051.2227941-1-robh@kernel.org
Signed-off-by: Brian Masney <bmasney@redhat.com>
|
|
The main oscillator is the only required input clock for the CRU, while
the external CAN and WDT clocks are optional board-level inputs. The
binding currently requires all three clocks, forcing device trees for
boards without these external inputs to add stub fixed-clock nodes for
which no meaningful clock-frequency can be specified.
Allow the clocks and clock-names properties to contain just "osc",
optionally followed by either or both of "can_ext" and "wdt_ext".
Fixes: 155d900e4c7d ("dt-bindings: clock: add Anlogic DR1V90 CRU")
Signed-off-by: Junhui Liu <junhui.liu@pigmoral.tech>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
|
|
The clock controller of the zx297520v3 Low Speed Peripherals is
relatively clean. One register per device with gates, muxes and resets
and for some devices a divider. There are even bits in the matrix
controller to control propagation of clock lines down to LSP.
The clocks are sorted by register address and I am convinced that the
device list is complete. There are, however, a few more registers that
are likely extra dividers for TDM and I2S devices.
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Stefan Dösinger <stefandoesinger@gmail.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
|
|
This controller contains clocks and resets for high speed devices on the
zx297520v3 board and hardware spinlocks that I expect will be necessary
to communicate correctly with the LTE DSP firmware blob.
I don't know much about the hwlocks yet other than that they exist, so
there is no header yet adding meaning to their indices. Presumably that
meaning doesn't exist in hardware and is de facto defined by ZTE's
firmware blobs running on the rprocs.
The zte-zx297520v3-crm driver will instantiate separate MFD children for
clocks and resets, which are handled by separate clock and reset
drivers.
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Stefan Dösinger <stefandoesinger@gmail.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
|
|
These SoCs have 3 clock and reset controllers: Top, Matrix and LSP.
Clocks go from oscillator -> top -> matrix -> LSP, with a register in
top controlling most clocks that get passed to matrix and a register in
matrix controlling all the clocks that get passed to LSP.
Generally every device has two clocks (one work clock, and one that
connects it to the bus, I call it PCLK), two reset bits (I don't know
what the difference is - sometimes asserting one is enough to reset the
device, sometimes both need to be asserted). PCLK and WCLK are
controlled by individual gates. Some devices have a mux and/or a
divider for their work clock. Some devices, like the GPIO controller,
only have reset bits and no clocks.
The top clock controller is fed by a 26 MHz external oscillator and has 4
PLLs to generate other clock rates. ZTE's kernel mostly relies on the
boot ROM to set up PLLs, but one LTE-related PLL is not configured
on some boards. Therefore my driver contains code to program PLLs. It
produces identical settings as the boot ROM for the pre-programmed
frequencies.
Not all clocks will have an explicit user in the end. I am defining a
lot of them simply to shut them off. The boot loader sets up a few of
the proprietary timers, which will send regular IRQs (although the
kernel of course doesn't need to listen to them). I don't plan to add a
driver for the proprietary timer as I see no use for them - the ARM arch
timer works just fine. I will add a driver for the very similar
proprietary watchdog though.
The clock list in this patch is pretty complete but not exhaustive.
There are other bits that are enabled, but I couldn't deduce what they
are controlling by trial and error. Some of them seem to do nothing.
Others cause an instant hang of the board when disabled. It is quite
likely that a handful more clocks will be added in the future, but not a
large number.
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Stefan Dösinger <stefandoesinger@gmail.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
|
|
The MA35D1 clock controller takes two crystal oscillator inputs from
the board:
- HXT, a high-speed 24 MHz crystal for most of the system
- LXT, a low-speed 32.768 kHz crytal for the RTC and low power modes
So far the binding was expecting a single crystal. The example named it
HXT, but no real definition for it was given. LXT was not even
described. In order to remain backward compatible, we will continue to
allow either one (HXT) or two (HXT then LXT) input clocks. I propose to
give those phandles a name to clarify what these entries expect, but I'm
not listing the clock-names property in the required block, for backward
compatibility. The rates are fixed by the TRM, so even if the second
oscillator is not described, the OS can make an educated guess.
Fixes: 2f8b5eb589cb ("dt-bindings: clock: nuvoton: add binding for ma35d1 clock controller")
Cc: stable@vger.kernel.org
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://patch.msgid.link/20260930-perso-ma35d1-upstream-clk-v6-2-48937ee6c9bb@bootlin.com
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
|
|
The value of the _LPI "State Name" field is used as the description of
the given idle state (that is, the value of its "desc" attribute in
sysfs) which is not consistent with idle state descriptions used when
the idle state information comes from an ACPI _CST object.
To rectify that, use the _LPI "State Name" field value as the value of
the "name" sysfs attribute of a given idle state and use the MWAIT hint
value from the _LPI register address value to derive the value of its
"desc" sysfs attribute in analogy with the _CST case.
Fixes: abc5c103c66d ("intel_idle: Add ACPI _LPI support")
Tested-by: Len Brown <len.brown@intel.com>
Cc: 7.3+ <stable@vger.kernel.org> # 7.3+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
[ rjw: Adjusted scnprintf() format string, tweaked changelog ]
Link: https://patch.msgid.link/6061409.DvuYhMxLoT@rafael.j.wysocki
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
|
