| Age | Commit message (Collapse) | Author |
|---|
|
Mirroring the earlier kmalloc_obj() conversion, convert the
device-managed allocators over to the type-based API using the now
updated scripts/coccinelle/api/kmalloc_objs.cocci. The size is derived
from the type rather than written out as a sizeof(), and the result is
a pointer to that type rather than void *, so a mismatch between the
size requested and the variable assigned becomes a build error instead
of being silently accepted.
The conversions break down as:
6713 devm_kzalloc_obj()
1749 devm_kzalloc_objs()
307 devm_kzalloc_flex()
91 devm_kmalloc_objs()
82 devm_kmalloc_obj()
2 devm_kmalloc_flex()
The rules deliberately leave alone allocations sized by a string or a
byte-sized type, or assigned to a pointer to a byte-sized type, since
those are byte buffers rather than objects. Allocations sized by a
multi-byte integer type are only converted when they are assigned to a
pointer to that same type, and allocations of pointers to integers or of
void pointers are left alone too. After this change, 528 files still
call devm_kmalloc(), devm_kzalloc(), devm_kcalloc(), or
devm_kmalloc_array().
Build tested with allmodconfig on x86_64, arm64, i386, arm, riscv, s390,
m68k, mips, parisc, sparc, loongarch, arc, xtensa, and openrisc with GCC
16.2.0 with no new warnings.
Signed-off-by: Kees Cook <kees+treewide@kernel.org>
|
|
Pull vhost,virtio updates from Michael Tsirkin:
"This adds CPR support for vhost.
Plus some fixes, notably for a host of races we had when callback fire
around device reset"
* tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost:
tools/virtio: add missing device-id/virtio.h wrapper header
vhost/vsock: add VHOST_RESET_OWNER ioctl
vhost: synchronize with RCU readers when freeing workers
vhost/vsock: re-scan TX virtqueue on device start
vhost/vsock: suppress EHOSTUNREACH fast-fail during CPR pause
vhost/vsock: split out vhost_vsock_drop_backends helper
virtio_pci: drop callback sync on reset
virtio_pci_modern: move avq cleanup from reset to del_vqs
virtio: synchronize callbacks after device reset
virtio_vdpa: implement synchronize_cbs()
platform/mellanox: mlxbf-tmfifo: implement synchronize_cbs()
um: virtio_uml: implement synchronize_cbs()
remoteproc: implement synchronize_cbs() for virtio devices
virtio_ccw: always take irq_lock in the classic interrupt handler
virtio_ccw: fix synchronize_cbs() after interrupt fallback
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull MM updates from Andrew Morton:
- "selftests/mm: improve khugepaged coverage" (Kiryl Shutsemau):
Give khugepaged a proper workout. Extend the tests to all supported
mTHP orders, check exactly which windows collapsed, and make scan
completion deterministic. Race collapse against faults, pinning, fork
and remap; verify that the contents survive.
Add coverage for whole-page-table zaps and memory pressure too.
- "selftests/mm: separate GUP microbenchmarking from functional testing"
(Sarthak Sharma):
Untangle GUP benchmarking from correctness testing. Move the
benchmark into tools/mm, add a standalone harness-based GUP selftest,
and move shared helpers into tools/lib/mm. Give each tool one job
instead of mixing timing measurements with correctness checks.
Cover the mapping, pinning and batch-size combinations explicitly.
- "mm: Switch device DAX to section-based vmemmap optimization" (Muchun
Song):
Apply section-based vmemmap optimization to device DAX. Rework the
backing metadata layout to save memory while preserving the handling
of device memory hotplug and its different alignment and lifetime
requirements.
- "mm: Introduce section-based vmemmap optimization for HugeTLB"
(Muchun Song):
Cut the memory consumed by HugeTLB's struct page array with
section-based vmemmap optimization. Arrange the metadata so large
huge pages need fewer backing pages, while keeping initialization,
teardown and the various hugepage configurations straight.
- "mm/huge_memory: clean up and decouple the anon and file split
helpers" (Kairui Song):
Separate anonymous and file-backed folio splitting, which have rather
different locking and bookkeeping requirements. Move the work into
separate helpers, drop dead checks and tidy swap-cache handling. Fix
error paths, including one that could leave a folio frozen.
Keep the swap cache cases separate from file-cache splitting.
- "mm: Unconditional per-VMA locks and cleanups" (Dave Hansen):
Make per-VMA locking unconditional and clean up the old conditional
code around it. This removes configuration-dependent plumbing and
lets callers depend on one locking model rather than carrying both
cases along.
- "memcg: remove the v1 soft limit" (Shakeel Butt):
Remove the old cgroup v1 memory soft-limit machinery. This has long
since been superseded by the newer memory-control interfaces; hauling
around a separate reclaim scheme for it no longer buys us much.
- "read proc/pid/smaps_rollup under per-vma lock" (Suren Baghdasaryan):
Read /proc/PID/smaps_rollup using per-VMA locks where possible,
rather than holding mmap_lock across the entire walk. Retain the
contention fallback and add tearing tests. This considerably reduces
latency when another thread is busy changing its mappings.
- "mm/damon: introduce data access-as-a-data attribute" (SJ Park):
Teach DAMON to expose memory access observations as data attributes,
making them available to the probe and filtering machinery. Extend
the interfaces, documentation and tests so the new information can be
used rather than merely collected.
- "Remove PG_private by using page/folio->private checks instead" (Zi
Yan):
Get rid of PG_private and use the folio's private pointer to say
whether private data is attached. Convert the filesystem users,
including erofs, f2fs and md, and clean up the old accessors and
flags. There are a few special cases, notably swapcache and hugetlb,
which need explicit care.
- "mm: make userland page table freeing RCU-safe" (Lorenzo Stoakes):
Make freeing userspace page tables safe against RCU readers. Sort out
the page-table lifetime and locking rules so walkers cannot stumble
over freed tables while mappings are being torn down.
- "make unused huge shrinker memcg aware" (Qi Zheng):
Make shmem's unused-huge-folio shrinker aware of memory cgroups, so
reclaim can find those folios under the right memcg. Wire up the
per-memcg tracking and its lifetime rules, and give the shrinklist
its own lockdep class to avoid spurious dependency reports.
- "mm: Drop pxd_ERROR()" (Anshuman Khandual):
Remove the old pxd_ERROR() page-table checks and their
architecture-specific baggage. Simplify the common page-table
interfaces and callers now that these checks no longer serve a
useful purpose.
- "memcg: group struct fields by access pattern" (Shakeel Butt):
Rearrange memcg's hot and cold fields according to how they're
actually accessed. Keep frequently updated counters and their
neighboring state from fighting over cachelines and reduce needless
cacheline traffic.
- "mm/damon/core: fix the size charged for a filter-trimmed region"
(Donggeun Yoo):
Fix DAMOS quota accounting when a filter trims a monitoring region.
Charge only the part left after filtering, not the original region,
and add KUnit coverage. Previously the excluded memory could eat into
the quota and make schemes run more slowly than requested.
- "mm/damon: add kunit and selftests for probes and probe weights" (SJ
Park):
Add more tests for DAMON probes and their weights, including
validation and the results reported to userspace. This is mostly
about catching regressions in the newer probe infrastructure before
they become harder to diagnose.
- "mm: memcontrol: constify the read side of the read side of the memcg
API" (Tal Zussman):
Mark the read-only parts of the memcg interface const, from folio and
lruvec accessors to counters and swap helpers. Most of this is
mechanical, but it makes the contracts clearer and lets the compiler
catch accidental writes.
- "mm/damon/vaddr: support {prep,apply}_probes" (SJ Park):
Support the new prepare/apply probe operations in DAMON's
virtual-address backend. This brings vaddr monitoring into line with
the probe infrastructure and makes the added probe types useful there
too.
- "mm/mglru: clean up folio counters and flag usage" (Kairui Song):
Simplify MGLRU's folio counters and flag handling. Remove redundant
accounting paths and make the state transitions easier to follow
without changing the intended reclaim policy.
- "arch, mm/execmem: resolve confusion about set_direct_map_valid_noflush()"
(Mike Rapoport (Microsoft)):
Clarify and straighten out the set_direct_map_valid_noflush()
interface across architectures and execmem. Make the requested
mapping changes and the callers' expectations agree, rather than
relying on subtly different architecture behavior.
- "mm: zswap: free cold writeback folios promptly" (Alexandre Ghiti):
Free zswap writeback folios as soon as their disk write completes.
They are cold temporary buffers, so putting them on the LRU only
makes reclaim rediscover them later. Extend swap-cache dropbehind and
let zswap keep these folios off the LRU altogether.
- "mm: gup: cleanup gup_fast call chain" (Aristeu Rozanski):
Clean up the GUP-fast call chain and simplify how the fast-path
helpers pass their arguments and results around. Keep the page-pin
behavior the same while making the call sequence easier to maintain.
- "mm: optimize zone-device memmap initialization" (Li Zhe):
Speed up initialization of zone-device struct pages. Avoid redundant
work when setting up large device-memory ranges, where touching every
descriptor can get expensive.
- "mm/zswap: shrink zswap_entry via a pool id" (Jianyue Wu):
Reduce the size of zswap_entry by storing a compact pool identifier
instead of a full pointer. Keep the pool lookup and lifetime handling
correct while saving per-entry metadata.
- "mm/damon: support access monitoring of hugetlb-backed memory"
(Krishna Iyer):
Let DAMON monitor hugetlb-backed memory too. Extend the relevant
access checks and add coverage so those mappings no longer fall
through a hole in the monitoring machinery.
- "mm/execmem: fixes and cleanups for the ROX cache" (Mike Rapoport):
Tidy execmem's read-only-executable cache and fix its handling of the
awkward allocation and release cases. The aim is to make the cache's
ownership and permission transitions more predictable.
- "zsmallc: remove old object read API" (Sergey Senozhatsky):
Drop zsmalloc's old object-read API and move its remaining users to
the supported access mechanism. This removes a duplicate interface
which we no longer need.
- "mm/mempolicy: stop copying state in the interleave paths" (Gregory
Price):
Stop copying mempolicy state in the interleave paths when a reference
to the existing policy will do. This avoids extra work and makes the
ownership rules less obscure.
- "mm/mglru: speed up inc_min_seq() and fix cold/hot inversions" (Barry
Song):
Make MGLRU's generation advancement cheaper and fix cases where cold
and hot folios end up in the wrong order. Adjust the counter and list
handling so reclaim doesn't keep passing over the better eviction
candidates.
- "mm: Fix MF_DELAYED handling on memory failure" (Lisa Wang):
Treat MF_DELAYED as a partially completed memory-failure operation,
not an outright failure. Propagate that result correctly through
shmem and the generic handler, fix the extra-reference accounting,
and add tests for the resulting SIGBUS behavior.
- "tools/mm/page_owner_sort: fix --sort, add module filter, improve
usage" (Ye Liu):
Fix page_owner_sort's --sort handling, add module-based filtering and
make the usage output more helpful. This makes the tool less
frustrating when tracking down who is holding on to pages.
- "mm/damon: move damos filter range arguments validation to core" (SJ
Park):
Move DAMOS filter range validation into the core, where all callers
can share it. Also close the sysfs read-twice races which could pass
inconsistent ranges, and add tests for invalid input.
- "mm/damon: misc cleanups" (Zenghui Yu):
Clean up a collection of small DAMON rough edges in the core,
interfaces and tests. No large behavior change here, just simpler
code and fewer opportunities for confusion.
- "mm/damon: cleanup code, add test cases, and update guidances in
docs" (SJ Park):
Clean up DAMON's core and interfaces, add missing test cases and
bring the documentation into line with the code. These changes should
make the newer facilities easier to understand and maintain.
- "mm/damon: introduce hugepage_size probe filter" (SJ Park):
Add a DAMON probe filter for hugepage size. Let users select a range
of folio sizes through sysfs, validate the range and document the new
interface, so monitoring can concentrate on memory backed by the
desired hugepage sizes.
- "selftests/mm: pagemap_ioctl test fixes and cleanups" (Zenghui Yu):
Fix some pagemap ioctl test assumptions and clean up their setup and
reporting. Make failures point to the operation that went wrong
rather than to test harness bookkeeping.
- "mm: avoid large folio splits when swap is unavailable" (Johannes
Weiner):
Avoid splitting large folios merely to attempt swap when no swap
space is available. There is little point paying for an expensive
split when reclaim cannot actually swap the resulting pages out.
- "mm: workingset: fix the shadow node budget under MGLRU" (Hui Zhu):
Fix the workingset shadow-node budget with MGLRU enabled. Keep the
shadow entries within the intended limits so refault tracking does
not quietly consume more metadata than it should.
- "selftests/mm: TAP output and global-state fixes" (Song Hu):
Fix selftests which produce misleading TAP output or fail to restore
global settings after a run. A test ought to leave the system as it
found it, particularly when a whole suite follows behind.
- "mm: remove page_swap_entry()" (Tal Zussman):
Remove page_swap_entry() and convert its remaining users to the folio
and swap-entry helpers. Lose an old page-level interface and make the
swap paths a little more consistent.
- "mm: refactor zonelist constructors and iterators" (Gregory Price):
Refactor the zonelist construction and walk helpers to reduce
duplicated logic. Keep the allocation ordering rules intact while
making it clearer how zones are selected.
- "mm: kmemleak: batch the struct page scan" (Breno Leitao):
Scan adjacent struct pages in batches instead of taking kmemleak_lock
once for every single page. This preserves scan coverage and the
lock-hold bound, while cutting overhead substantially on debug
kernels.
- "mm/damon: misc improvements in tests and documents" (Zenghui Yu):
Fix some DAMON selftests which leave kdamond running or fail under
Python safe-path mode, and improve the KUnit coverage and
documentation. Nothing especially glamorous, but these are worth
doing.
- "mm/damon: introduce probe_hits_wsum DAMOS core filter" (SJ Park):
Add a DAMOS core filter using weighted probe-hit counts. This gives
schemes another way to select regions based on what the monitoring
probes observed.
- "mm/mglru: fix ineffective memory protection for non-kswapd reclaim"
(Ridong Chen):
Fix MGLRU's memory protection handling for reclaim outside kswapd.
The protection settings weren't having the intended effect in these
paths, leaving protected memory more exposed than requested.
- "mm/damon: improve readability, clarity and test coverage" (SJ Park):
Simplify a handful of DAMON core helpers, clarify their behavior and
expand test coverage. There are no intended userspace-visible changes
in this batch.
- "mm: replace PF_KCOMPACTD/PF_KSWAPD with kthread_func()" (Kefeng
Wang):
Stop identifying reclaim and compaction workers through the PF_KSWAPD
and PF_KCOMPACTD task flags. Use their kthread functions instead and
remove the redundant flag plumbing.
- "mm/hugetlb: fix surplus accounting and availability checks during
demotion" (Longlong Xia):
Fix HugeTLB surplus accounting and availability checks when demoting
huge pages. Keep the counters and reservation decisions consistent as
one huge page turns into several smaller ones.
- "mm/damon: add kunit tests for probe_hits handling and probe params
validation" (Jason Angelov):
Add KUnit tests for DAMON probe-hit handling and invalid probe
parameters. These cover edge cases that were too easy to miss in
ordinary monitoring tests.
- "mm/damon: fix misc bugs in kunit, quota goals and sysfs refresh_ms"
(SJ Park):
Fix a few DAMON bugs in KUnit tests, quota-goal handling and the
sysfs refresh interval. Small fixes, but the incorrect results and
control behavior were real.
- "mm: zswap: optimize zswap invalidate and store" (Kefeng Wang):
Simplify zswap's invalidate and store paths to avoid avoidable
lookups and work. Keep the entry lifetime rules intact while making
those frequent operations cheaper.
- "mm: replace custom ratelimiting logic" (Pedro Falcato):
Replace hand-rolled MM rate limiting with the common kernel helpers.
There is no need to maintain another local version of the same
mechanism.
- "mm/vmalloc: minor cleanups" (Ye Liu):
Tidy some vmalloc initialization and reporting code, and pull
duplicated vmap-area insertion work into a helper. No functional
changes are intended.
- "mm/mglru: clean up isolate_folios for readability and clarity"
(Ridong Chen):
Clean up MGLRU's isolate_folios() so the decisions are easier to read
and verify. Keep reclaim behavior unchanged while removing
unnecessary twists in the control flow.
- "Catch automatic storage in IDA and Maple Tree definitions" (Yury
Norov):
Catch IDA and maple-tree definitions placed in automatic storage
where the lifetime rules are wrong or easy to get wrong. Add checks
so such mistakes are harder to slip through unnoticed.
- "mm, swap: some random fixes and cleanups" (Kemeng Shi):
Fix and simplify a few unrelated swap paths, removing redundant work
and tidying up error handling. A small collection of things which
were better fixed than left lying around.
- "mm/page_io: folio conversion cleanups" (Tal Zussman):
Finish some page-to-folio conversions in swap I/O, removing obsolete
wrappers and using folio operations consistently. The I/O behavior is
intended to remain the same.
- "mm/swap: skip empty clusters in the swapoff scan" (Youngjun Park):
Skip empty swap clusters during swapoff instead of walking slots
which have nothing to release. This avoids pointless work on sparsely
used swap devices.
- "mm: trace: decode architecture-specific VMA flags" (Meijing Zhao):
Teach the VMA trace output to decode architecture-specific flags,
rather than leaving them as unexplained bits. That should make
tracing a good deal more useful when debugging unusual mappings.
- "mm, swap: don't spin on a bad swap entry" (Breno Leitao):
Stop repeatedly retrying a swap entry which is already known to be
bad. Make the error path terminate cleanly instead of wasting CPU
chasing an entry that cannot be used.
- "mm/page_isolation: fix UBSAN shift-out-of-bounds in
isolate_single_pageblock" (Qi Xi):
Fix an out-of-range shift in isolate_single_pageblock() and tighten
its associated boundary handling. UBSAN found the issue; the result
should be more robust pageblock isolation.
- "mm: khugepaged: fix tracepoint UAF" (Vernon Yang):
Fix a use-after-free in khugepaged tracepoint handling. Make sure the
information recorded by tracing stays valid for as long as the trace
event needs it.
- "mm/damon: fix DAMOS bugs in core, paddr and vaddr" (SJ Park):
Fix several DAMOS problems across the core and physical- and
virtual-address backends. The changes close error cases and bring the
implementations back into agreement.
- "mm/hugetlb_cgroup: move the per-node usage along with the folio"
(Hongfu Li):
Move HugeTLB per-node usage accounting when folios migrate between
nodes or are reparented to another cgroup. Otherwise numa_stat can
retain stale charges and even underflow when the folio is freed.
- "docs/core-api: memory-allocation: add k[mz]alloc_obj() and clarify
kmalloc" (Mike Rapoport):
Document the typed k[mz]alloc_obj() allocation helpers and clear up
some kmalloc guidance. Make it easier for callers to choose the right
interface.
- "selftests/mm: Validate selections and scope memfd_secret setup"
(Tianyi Chen):
Check selftest selections before running and confine memfd_secret
setup to the cases that actually need it. Avoid confusing failures
caused by the test harness itself.
- "mm/damon: move zero damos quota target_value handling to the core
layer" (SJ Park):
Handle a zero DAMOS quota goal target in the core rather than making
each user of the interface invent its own rule. Keep quota decisions
consistent across callers.
- "mm/damon: Introduce a huge page collapsing mechanism using auto
tuning" (Asier Gutierrez):
Add an auto-tuned DAMON mechanism for collapsing huge pages. Use
monitoring feedback to decide when collapse is worthwhile rather than
forcing one fixed policy onto every workload.
- "kmemleak: fix stale documentation and raise the verbose default"
(Breno Leitao):
Bring the kmemleak documentation up to date and require a third
confirming scan before verbose kernels print a suspected leak. The
extra scan helps suppress transient false positives in noisy debug
builds.
- "mm/memory: improve insert_pages() error handling" (Avi Weiss):
Tighten insert_pages() error handling so partial failures are
reported and cleaned up consistently. The caller should not have to
guess how far the operation got.
- "mm/damon: allow NULL or unstarted damon_ctx parameter for
damon_call()" (SJ Park):
Make damon_call() handle NULL and not-yet-started contexts safely.
Simplify the rules for callers and avoid an indefinite wait on an
invalid state.
- "mm/damon: introduce pgidle_set probe filter type" (SJ Park):
Add a pgidle_set DAMON probe filter, giving monitoring users another
way to select pages by their idle-tracking state. Wire it through the
filter interfaces and tests.
- "mm/damon/core: remove unused helper functions" (Cheng-Han Wu):
Remove DAMON core helpers which no longer have callers. Keep the API
surface smaller rather than retaining dead code just in case.
- "mm: stop calling pmd_folio() on special PMDs" (Gregory Price):
Avoid calling pmd_folio() on special PMD mappings that have no struct
page. The old assumption could fault in procfs walkers; use the
normal-folio checks and handle those mappings properly.
- "mm: remove three unused helpers from mm.h" (Tal Zussman):
Remove three unused helpers from mm.h. Fewer obsolete interfaces for
the next person to stumble over.
- "mm/damon: improvements in efficiency, error handling, documents"
(Liew Rui Yan):
Skip needless DAMOS quota work once the quota is full, propagate a
missing sysfs error and tidy a couple of comments. The ignored error
could make a monitoring-start request appear successful when it
wasn't.
- "docs/mm/damon/design: add explanation of nr_snapshots" (Liew Rui
Yan):
Explain DAMON's nr_snapshots accounting in the design documentation
and straighten out the associated terminology. Make it clearer what
users should expect from that counter.
- "selftests/cgroup: fixes for test_zswap on single core VM" (Wilson
Felipe Pereira):
Fix two test_zswap failures on single-CPU VMs. Wait for the exiting
child's cgroup to become unpopulated before reconfiguring it, and
avoid another test assumption which breaks under constrained
scheduling.
- "docs/ksm: fix advisor documentation and comment" (Jinjiang Tu):
Correct the KSM advisor documentation and a misleading code comment.
Keep the description aligned with how the advisor actually works.
- "Fix bugs in HugeTLB allocation when mem_cgroup_charge_hugetlb()
fails" (Ackerley Tng):
Fix HugeTLB allocation cleanup when the memcg charge fails. Make sure
failure exits undo what was allocated rather than leaving stale
accounting or resources behind.
- "mm, memcg: fix memory.peak reset clobbering other fds' watermark"
(Ridong Chen):
Fix memory.peak reset handling so resetting one file descriptor
doesn't overwrite the watermark kept for another. Keep those per-open
measurements independent as intended.
- "mm: reject zone device folios in more folio walkers" (Gregory
Price):
Reject zone-device folios in page walkers that cannot safely handle
them. Extend the existing checks rather than assuming every folio has
ordinary system-memory backing.
- "percpu: remove code with no effect" (Sang-Heon Jeon):
Remove a few pieces of percpu code which no longer do anything. There
is no reason to keep maintaining dead paths.
* tag 'mm-stable-2026-10-19-21-33' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (539 commits)
mm: shmem: assign a lock class to the unused huge shrinklist
mm: vmscan: put rotation-missed folios at the LRU tail
mm: kmemleak: scan the struct page array in MAX_SCAN_SIZE batches
mm: kmemleak: move the struct page scan into a helper
mm/damon: document that a zero sample_interval is accepted
mm/damon: fix typos in comments
mm/damon/sysfs: propagate damon_call() error in turn_damon_on
mm/damon/core: skip quota score setup when the quota is full
mm/damon/tests/core-kunit: test the size charged for a filter-trimmed region
mm/damon/core: charge only the part of a region the filter left
mm: disallow raw PFN mappings of huge/shared zeropage
selftests/mm: zap whole PTE tables in the khugepaged race harness
selftests/mm: add memory-pressure threads to the khugepaged race harness
selftests/mm: race the collapse of windows with holes
selftests/mm: add khugepaged race harness
selftests/mm: check that one khugepaged pass collapses one window
selftests/mm: run every supported collapse order by default
selftests/mm: cover a shared-source collapse write race
selftests/mm: parameterize the mixed-source collapse case by source order
selftests/mm: add order-parameterized khugepaged collapse cases
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
Pull hardening updates from Kees Cook:
- Provide kmalloc_obj*-style API for devm_kmalloc()
- Improve seq_buf API for saner C String handling with several bug
fixes along the way (Kees Cook, Bill Wendling)
- Overflow helper readability improvements (Bill Wendling)
- Unexport native_write_cr4() (Dennis Chen)
- um: fix CONFIG_GCOV for built-in code (Johannes Berg)
- Improve stackinit test coverage (Justin Stitt)
- KMSAN: fix memset() when using fortify-source, again (Arnd Bergmann)
- lkdtm: use kmalloc() instead of __get_free_page (Mahad Ibrahim)
- signalfd: don't dequeue the forced fatal signals (Oleg Nesterov)
- Fix randstruct to recognize new container_of() behavior
- coccinelle: kmalloc_obj: Convert multi-byte integral allocations too
- Fix a couple remaining allocation return type mismatches
* tag 'hardening-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: (29 commits)
overflow: Match arithmetic in both parts of __builtin_choose_expr
lkdtm: Make UNSET_SMEP built-in-only and unexport native_write_cr4()
extcon: realtek: Remove const from type_c_cfg allocation type
coresight: cti: Add const to con_groups allocation type
docs: core-api: Document the seq_buf API
nvdimm: ndtest: Return the string length from flags_show()
powerpc/papr_scm: Return the string length from the sysfs show functions
seq_buf: Add seq_buf_init_append()
bpf: Remove dead newline stripping from format_disasm_line()
seq_buf: Add seq_buf_terminate()
seq_buf: Add seq_buf_strlen()
seq_buf: Clear what a writer did not claim when a seq_buf overflows
seq_buf: Copy what fits when seq_buf_puts() and seq_buf_putmem() overflow
scsi: lpfc: Print rx monitor records straight into the seq_buf
seq_buf: Do not pop from an overflowed seq_buf
seq_buf: Do not print an empty line from an overflowed seq_buf_do_printk()
.get_maintainer.ignore: Add Kees Cook
devres: Provide kmalloc_obj*-style API for devm_kmalloc
mm: Move default_gfp() into gfp_types.h
kunit/stackinit: Clean up XFAIL under instrumentation
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux
Pull UML updates from Johannes Berg:
- NOMMU support, mostly for mm/ testing
The only bigger change, we added support for building with
!CONFIG_MMU, mostly for testing, e.g. via kunit. Some new
selftests targetted to NOMMU are moving elsewhere, but are
runnable on ARCH=um without MMU.
- Tighter page permissions
Tighten page permissions to catch more bugs (ARCH=um is,
after all, often used for testing), and also mark __init
memory inaccessible for the same reason.
- Various maintenance/cleanups
Fix build on really old hosts, fix leaks, make the code a
bit more robust, header cleanups, typo fixes, the usual.
* tag 'uml-for-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux: (38 commits)
um: place large BSS inputs in an output section
um: fix shutdown __inittext access
um: time-travel: fix sched_yield() behaviour
um: require MMU for UML PCI support
um: vector: avoid NULL queue dereference in legacy RX mode
um: use %pB to print functions in stack traces
um: mprotect() __init memory
um: move init text between __init_begin/end
um: improve checking for --no-warn-rwx-segments
um: make stub compilation more robust
um: link .lbss/.ldata/.lrodata correctly
um: add perf-event support
x86/um: remove unused <asm/required-features.h> header
um: fix typo "hander" in comment
um: Add definition of __NR_close_range for older host OSs
um: virtio_uml: switch to dynamic root device
um: Tighten exec permissions on page mappings
Documentation: um: document nommu UML
um: allow deselecting CONFIG_MMU
um: nommu: add userspace runner processes
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 FPU state updates from Borislav Petkov:
- Document and cleanup the signal frame handling with the goal to allow
process migration between CPUs with different FPU capabilities but
which use only a common set of FPU features, i.e., think
checkpoint/restore (Andrei Vagin)
- Consolidate how XSTATE features are checked by doing them once during
boot with the intent of removing cpu_has_xfeatures(). Latter will
happen in the next cycle (Eric Biggers)
- Other cleanups
* tag 'x86_fpu_for_v7.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/fpu: Remove additional remnants of math emulation
x86/fpu: Remove unnecessary checks for X86_FEATURE_FPU
selftests/x86: Add tests for signal frame FPU portability
x86/fpu: Pre-fault only required size of xstate buffer
x86/fpu: Fix potential underflow in xstate_calculate_size()
x86/fpu: Document reasoning of FX-only fallback
x86/fpu: Extract restore_from_ia32_fxstate() and clean up fpu__restore_sig()
x86/fpu: Clean up and rename variables in signal frame handling
x86/fpu: Document signal frame layout and portability
xor: Add AVX-512 optimized xor_gen()
xor: Remove redundant X86_FEATURE_OSXSAVE check
lib/crc: x86: Stop using cpu_has_xfeatures()
lib/crypto: x86: Stop using cpu_has_xfeatures()
crypto: x86 - Stop using cpu_has_xfeatures()
um: Check for missing AVX and AVX-512 xstate bits
x86/fpu: Check for missing AVX and AVX-512 xstate bits
|
|
GNU ld requires input sections matched by a linker script to be
assigned to an output section. Place UML's .lbss inputs in a named
output section so the linker accepts the static UML linker script.
The .ldata inputs are already collected inside the .data output
section, so they do not need the same change.
Fixes: 779c65ede680 ("um: link .lbss/.ldata/.lrodata correctly")
Signed-off-by: Hajime Tazaki <thehajime@gmail.com>
Link: https://patch.msgid.link/20261009052826.179995-1-thehajime@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
Now every architecture has been converted to support
CONFIG_MMU_GATHER_RCU_TABLE_FREE, this configuration option no longer
makes any sense to keep around.
Therefore remove it, and remove all the dead code that existed for
!CONFIG_MMU_GATHER_RCU_TABLE_FREE architectures previously.
Additionally, CONFIG_MMU_GATHER_TABLE_FREE is no longer necessary, as all
architectures instead use CONFIG_HAVE_ARCH_TLB_REMOVE_TABLE when a custom
__tlb_remove_table() is required, so remove this too.
A number of architectures only enabled CONFIG_MMU_GATHER_RCU_TABLE_FREE if
CONFIG_MMU was set, however the mmu_gather logic only actually does
something meaningful if CONFIG_MMU is set (mmu_gather.c is only compiled
in this case, for instance).
As a result, there's no need to gate any of this logic on CONFIG_MMU
explicitly.
CONFIG_PT_RECLAIM however does have a strict dependency on CONFIG_MMU, so
make this dependency explicit.
Additionally, correct comments to remove references to non-RCU page table
gathering and make it clear that this is not 'semi-RCU', nor has it been
since commit 1fb3d8c20bfa ("mm/mmu_gather: replace IPI with
synchronize_rcu() when batch allocation fails").
With this change in place the kernel policy is now that userspace page
tables are freed after an RCU grace period, and thus it is now safe to
unconditionally perform page table walks under RCU, safe in the knowledge
that page tables will not be freed underneath the walker.
This is all that is guaranteed, however, so naturally it is still
incumbent upon page table walkers to ensure that the page table entries
are as expected.
Link: https://lore.kernel.org/20260925-rcu-pagetable-freeing-v5-11-31e91065fea4@kernel.org
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Reviewed-by: Lance Yang <lance.yang@linux.dev>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Cc: Zi Yan <ziy@nvidia.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Nico Pache <nico.pache@linux.dev>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Barry Song <baohua@kernel.org>
Cc: Usama Arif <usama.arif@linux.dev>
Cc: Guo Ren <guoren@kernel.org>
Cc: Brian Cain <bcain@kernel.org>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Dinh Nguyen <dinguyen@kernel.org>
Cc: Simon Schuster <schuster.simon@siemens-energy.com>
Cc: Jonas Bonn <jonas@southpole.se>
Cc: Stefan Kristiansson <stefan.kristiansson@saunalahti.fi>
Cc: Stafford Horne <shorne@gmail.com>
Cc: Rich Felker <dalias@libc.org>
Cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Cc: Paul Walmsley <pjw@kernel.org>
Cc: Palmer Dabbelt <palmer@dabbelt.com>
Cc: Albert Ou <aou@eecs.berkeley.edu>
Cc: Alexandre Ghiti <alex@ghiti.fr>
Cc: Russell King <linux@armlinux.org.uk>
Cc: Vineet Gupta <vgupta@kernel.org>
Cc: Michal Simek <monstr@monstr.eu>
Cc: Chris Zankel <chris@zankel.net>
Cc: Max Filippov <jcmvbkbc@gmail.com>
Cc: Will Deacon <will@kernel.org>
Cc: Aneesh Kumar K.V <aneesh.kumar@kernel.org>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: David S. Miller <davem@davemloft.net>
Cc: Andreas Larsson <andreas@gaisler.com>
Cc: Richard Henderson <richard.henderson@linaro.org>
Cc: Matt Turner <mattst88@gmail.com>
Cc: Magnus Lindholm <linmag7@gmail.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Huacai Chen <chenhuacai@kernel.org>
Cc: WANG Xuerui <kernel@xen0n.name>
Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Cc: James Bottomley <james.bottomley@hansenpartnership.com>
Cc: Helge Deller <deller@gmx.de>
Cc: Madhavan Srinivasan <maddy@linux.ibm.com>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Christophe Leroy <chleroy@kernel.org>
Cc: Heiko Carstens <hca@linux.ibm.com>
Cc: Vasily Gorbik <gor@linux.ibm.com>
Cc: Alexander Gordeev <agordeev@linux.ibm.com>
Cc: Christian Borntraeger <borntraeger@linux.ibm.com>
Cc: Sven Schnelle <svens@linux.ibm.com>
Cc: Richard Weinberger <richard@nod.at>
Cc: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Cc: Johannes Berg <johannes@sipsolutions.net>
Cc: Thomas Gleixner <tglx@kernel.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: John Hubbard <jhubbard@nvidia.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Randy Dunlap <rdunlap@infradead.org>
Cc: Hugh Dickins <hughd@google.com>
Cc: Qi Zheng <qi.zheng@linux.dev>
|
|
There are no more users left for any pxd_ERROR() either in generic MM or
in the platform MM. Hence all these platform macros along with their
generic fallback could be dropped across the tree.
Link: https://lore.kernel.org/20260831054331.625505-9-anshuman.khandual@arm.com
Signed-off-by: Anshuman Khandual <anshuman.khandual@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Geert Uytterhoeven <geert@linux-m68k.org> # m68k
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Cc: Helge Deller <deller@gmx.de>
Cc: Huacai Chen <chenhuacai@kernel.org>
Cc: James Bottomley <james.bottomley@HansenPartnership.com>
Cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Rich Felker <dalias@libc.org>
Cc: Samuel Holland <samuel.holland@sifive.com>
Cc: WANG Xuerui <kernel@xen0n.name>
Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
|
|
Commit 9e8db5913264 ("net: avoid false positives in untrusted gso
validation") added a '&& skb->network_header' check before flow-dissecting
GSO packets without VIRTIO_NET_HDR_F_NEEDS_CSUM in
__virtio_net_hdr_to_skb(), because some callers (such as tun_get_user(),
tun_xdp_one(), virtnet_receive_done(), and raw_verify_header()) called
virtio_net_hdr_*_to_skb() before initializing skb->network_header and
skb->dev.
Because __alloc_skb() and __build_skb_around() zero-initialize
skb->network_header to 0 (unlike mac_header and transport_header which
are initialized to ~0U), those four callers always had
skb->network_header == 0 and bypassed flow dissection in
__virtio_net_hdr_to_skb(). More generally, skb->network_header is an
offset from skb->head (where 0 is also a valid offset whenever
skb_headroom(skb) is 0), not a boolean flag.
Whenever the 'if (gso_type && skb->network_header)' branch was skipped,
the fallback 'else if (gso_type)' only pulled nh_min_len + thlen (40 bytes
for TCPv4) without dissecting the packet, without validating ip_proto or
n_proto, and without setting skb->transport_header.
If the packet has a malformed network header, it is not rejected and a
subsequent skb_probe_transport_header() also fails, leaving
skb->transport_header at ~0U (0xffff). Similarly, if an IPv4 packet
carries IP options (ihl > 5) or an IPv6 packet carries extension headers,
pulling only nh_min_len + thlen can leave the TCP header outside
skb->head. In both cases, tcp_hdrlen(skb) in skb_gso_transport_seglen()
reads out-of-bounds:
BUG: KASAN: slab-out-of-bounds in skb_gso_transport_seglen
Read of size 2 by task poc/133
skb_gso_transport_seglen (net/core/gso.c:155)
skb_gso_validate_mac_len (net/core/gso.c:270)
tbf_enqueue (net/sched/sch_tbf.c:260)
dev_qdisc_enqueue (net/core/dev.c:4227)
__dev_queue_xmit (net/core/dev.c:4884)
In addition, checking virtio_net_hdr_match_proto() only inside
'if (!skb->protocol)' before flow dissection both skipped validation when
skb->protocol was pre-set by the caller and rejected VLAN-tagged frames
whose outer L2 protocol is ETH_P_8021Q or ETH_P_8021AD.
Fix this by:
1. Initializing skb->dev and skb->network_header (plus skb->protocol for
IFF_TUN) before virtio_net_hdr_*_to_skb() in tun_get_user(),
tun_xdp_one(), virtnet_receive_done(), and raw_verify_header(). In
tun_get_user(), drop the redundant skb_reset_mac_header(skb) in the
IFF_TUN case since __virtio_net_hdr_to_skb() unconditionally resets
mac_header.
2. Removing '&& skb->network_header' and the unvalidated
'else if (gso_type)' fallback in __virtio_net_hdr_to_skb() so all GSO
packets without VIRTIO_NET_HDR_F_NEEDS_CSUM are flow-dissected, have
their transport header pulled into linear data, and have
skb->transport_header set.
3. Moving the virtio_net_hdr_match_proto() check to after
skb_flow_dissect_flow_keys_basic(), validating keys.basic.n_proto
against hdr_gso_type.
Fixes: 9e8db5913264 ("net: avoid false positives in untrusted gso validation")
Fixes: d5be7f632bad ("net: validate untrusted gso packets without csum offload")
Fixes: 924a9bc362a5 ("net: check if protocol extracted by virtio_net_hdr_set_proto is correct")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Closes: https://lore.kernel.org/netdev/20260927163117.746432-2-bestswngs@gmail.com/
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Cc: Michael S. Tsirkin <mst@redhat.com>
Link: https://patch.msgid.link/20261001191140.2818991-3-edumazet@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
Since first moving __init text into the right place in commit
8966ed0b2d48 ("um: move init text between __init_begin/end")
and then making all init sections inaccessible, shutdown and
reboot crash instead of working correctly, for the obvious
reason that the functions are __init but run on the way out.
Removing the __init markers would work in some way, but that
would bubble through a lot of functions.
Instead, mark the relevant functions __noreturn (including
longjmp() since that's now needed so start_idle_thread() can
be __noreturn), and split out the part of main() that's done
on the way out into a new os_exit() function that's called
directly.
Reported-by: Hajime Tazaki <thehajime@gmail.com>
Closes: https://lore.kernel.org/linux-um/m24ifc4v6m.wl-thehajime@gmail.com/
Fixes: a418ab8fddea ("um: mprotect() __init memory")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Tested-by: Hajime Tazaki <thehajime@gmail.com>
Link: https://patch.msgid.link/20260928093934.ca7af44c59ca.I470ece16d176ea704aa6e5767b755055d106da35@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
Just incrementing tt_extra_sched_jiffies can make this
drift enough to hit the softlockup detector, e.g. with
ping using sched_yield() in a loop to measure short
intervals. Make the simulation actually pass time, this
requires going to the external scheduler but actually
makes this sort of thing behave much better and avoids
the soft lockup.
Fixes: 887c5c12e80c ("um: work around sched_yield not yielding in time-travel mode")
Link: https://patch.msgid.link/20260924134223.1672004-2-johannes@sipsolutions.net
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
Because UML_PCI (arch/um/drivers/Kconfig) selects FORCE_PCI, this
contradicts the current dependency of CONFIG_PCI on CONFIG_MMU. This
commit fixes this issue by adding right dependencies under !MMU
environment.
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202609271139.DpjVdepU-lkp@intel.com/
Closes: https://lore.kernel.org/oe-kbuild-all/202609271351.tw8EOsgz-lkp@intel.com/
Closes: https://lore.kernel.org/oe-kbuild-all/202609270410.Kc2FsJp1-lkp@intel.com/
Closes: https://lore.kernel.org/oe-kbuild-all/202609270228.yku16Noi-lkp@intel.com/
Closes: https://lore.kernel.org/oe-kbuild-all/202609270416.rEtAiqyF-lkp@intel.com/
Closes: https://lore.kernel.org/oe-kbuild-all/202609270538.mV3NDkLu-lkp@intel.com/
Closes: https://lore.kernel.org/oe-kbuild-all/202609271435.lANS7mTP-lkp@intel.com/
Closes: https://lore.kernel.org/oe-kbuild-all/202609271512.pg5gWbIg-lkp@intel.com/
Closes: https://lore.kernel.org/oe-kbuild-all/202609271717.pg5HjzeZ-lkp@intel.com/
Closes: https://lore.kernel.org/oe-kbuild-all/202609271810.pxMMu5ZC-lkp@intel.com/
Closes: https://lore.kernel.org/oe-kbuild-all/202609271940.FhRl0cBi-lkp@intel.com/
Closes: https://lore.kernel.org/oe-kbuild-all/202609272107.sLZJEOtt-lkp@intel.com/
Closes: https://lore.kernel.org/oe-kbuild-all/202609272234.F8tROOdL-lkp@intel.com/
Fixes: 626ff2b34dbb ("um: allow deselecting CONFIG_MMU")
Signed-off-by: Hajime Tazaki <thehajime@gmail.com>
Link: https://patch.msgid.link/20260927234537.1585880-1-thehajime@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
Bringing a UML vector netdev up can panic in vector_net_open() with a
fault in _raw_spin_lock().
vector_net_open() calls vector_reset_stats(), which takes the RX and TX
queue locks. However, queue allocation depends on runtime transport
options. With tap transport, vector RX/TX queues are not created and the
legacy header buffers are used instead. Taking a queue lock then
dereferences a NULL queue pointer.
Take the queue locks in vector_reset_stats() only when the corresponding
queue exists. Also move the RX queue lock in vector_poll() into the
VECTOR_RX path, so legacy RX does not touch rx_queue.
Signed-off-by: Henry Barreto <me@henrybarreto.dev>
Acked-By: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Link: https://patch.msgid.link/20260527213524.45903-1-contato@henrybarreto.dev
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
In a stack trace we get the return address, so if the call is at
the end of a function, it can get printed as the next function,
e.g.
vpanic+0x1d3/0x435
abort+0x0/0x4e
do_exit+0x29c/0xcb7
sys_exit_group+0x0/0x16
pid_child_should_wake+0x0/0x83
Use %pB like on x86, which resolves the name with address - 1,
in the same example I get:
vpanic+0x1d3/0x435
panic+0x55/0x55
do_exit+0x29c/0xcb7
do_group_exit+0xbe/0xbe
sys_exit_group+0x16/0x16
Link: https://patch.msgid.link/20260924085002.3ff9ca1de60a.I5ff299b6f3196ad3c51c3032a90c7158c1bbccda@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
Unlike what the comment says, we could munmap() this (but
not reuse it for guest allocations), but then stray libc
allocations could technically conflict, so mprotect() it
to catch access bugs. Align it in the linker scripts too
so that all of it can be covered, not just some.
Link: https://patch.msgid.link/20260924084946.d118ec78e604.I993b671566a4e842dcc290b78f1c0004050362ba@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
Today only the init data is there, which means any
backtrace (or other pointer printing) involving an
__init function can't print its name.
Move the initdata and include the init text between
the markers so this works.
This also enables unmapping the initdata since it's
no longer part of the overall data (which kmemleak
scans, so it would crash otherwise).
Link: https://patch.msgid.link/20260924084946.2bfe0f25e6e2.I021d3a909687794eb2c3435fdfcb7f67e3ec4ba1@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
Since LLVM=1 might end up using different linkers for
CC as linker and LD, use detect --no-warn-rwx-segments
support using CC.
Link: https://patch.msgid.link/20260923173523.15f90065ca57.I3079cffd8db3a639e93c3e2624c61bbebadc3cbd@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
With clang, stub compilation could result in getting stack
frames where none are allowed, or ways of making it be not
relocatable. Set -ftrivial-auto-var-init=uninitialized for
more code, and -fomit-frame-pointer as well to avoid these
issues.
Link: https://patch.msgid.link/20260923173523.9cb03214335b.Ie1487657bc0f464f4911e95f532ab010b32864b8@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
clang 23 for me seems to put a bunch of data into these
"large" sections, causing said data to not be considered
kernel data by the kernel, in turn causing all kinds of
strange bugs. Link the data from these sections in the
right place rather than leaving them separate.
Link: https://patch.msgid.link/20260923173523.3675aee4f2fc.Id8b553b971d1428abb1bd1222016758314af3098@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
Enable HAVE_PERF_EVENTS without any hardware events (since
there's no hardware), that just needs to select the symbol
and provide an empty asm/perf_event.h.
Link: https://patch.msgid.link/20260921230739.587996-2-johannes@sipsolutions.net
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
Correct "hander" to "handler", reported by scripts/checkpatch.pl using the
misspelling list in scripts/spelling.txt. Only touches comments, no code
changes.
Assisted-by: Cursor:claude-opus-5
Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com>
Link: https://patch.msgid.link/20260907062749.16397-1-hemanth.selam@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
__NR_close_range was introduced with
278a5fbaed89dacd04e9d052f4594ffd0e0585de ("open: add close_range()")
which is present in Linux >= 5.9. Older hosts running a kernel version
prior to that range currently fail to build due to that missing system
call number definition.
Fixes: f82a9e7b9fa9 ("um: fix execve stub execution on old host OSs")
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://patch.msgid.link/20260812173249.98435-1-florian.fainelli@broadcom.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
Driver core expects devices to be dynamically allocated and will, for
example, complain loudly when no release function has been provided.
Use __root_device_register() to allocate and register the root device
instead of open coding using a static device.
Note that root_device_register(), which also creates a link to the
module, cannot be used as the device is registered when parsing the
module parameters which happens before the module kobject has been
set up.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260812142228.55316-1-johan@kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
In UML, page mappings are backed by mmap, which allows us to
effectively manage exec permissions. Introduce a _PAGE_EXEC
bit so that pages can be mapped without granting unnecessary
exec permissions.
Signed-off-by: Tiwei Bie <tiwei.btw@antgroup.com>
Link: https://patch.msgid.link/20260517233641.127433-1-tiwei.btw@antgroup.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
Allow deselecting CONFIG_MMU to build a no-MMU
UML kernel.
Signed-off-by: Hajime Tazaki <thehajime@gmail.com>
Signed-off-by: Ricardo Koller <ricarkol@google.com>
[drop defconfig file, minor adjustments/fixes, rewrite message]
Link: https://patch.msgid.link/20260723113633.dc6b7df78016.Id9eb1e435a7d9ee75ec3e25db69ed3e8ff202a58@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
For NOMMU there are not separate address spaces for
each userspace process group, which on the one hand
means we cannot start them on demand, but on the
other means we can just have one for each (virtual)
CPU, and map all of the memory into them.
Implement such processes, and the remaining bits
needed to compile the kernel without CONFIG_MMU.
Link: https://patch.msgid.link/20260723113633.2184dce9413e.I9f810f3ed177d6dc980cad36c231f8c745dee48f@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
The asm-generic futex implementation only supports UP operations,
and the normal (MMU) implementation from uaccess.c isn't built
nor would it work.
Since NOMMU shares address space anyway, it's all trivial and we
can just make a trivial implementation.
Link: https://patch.msgid.link/20260723113633.d8373755f77c.I0a83e5ca6be6c95a81d4b2ec69677bbea5889d7d@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
Since this approach shares more code with the MMU version
in nommu, further move some code around to be able to use
it in nommu (report_enomem) or be able to replace it (this
applies to mm_id, stack, sync). Also add empty inlines for
the TLB flushing and decouple trap.c code.
Link: https://patch.msgid.link/20260723113633.163686eb0863.Ibb7f37d5645cbd566ae5b74fbb19c54c7327ba68@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
This commit adds memory operations on UML under !MMU environment.
Some part of the original UML code relying on CONFIG_MMU are excluded
from compilation when !CONFIG_MMU. Additionally, generic functions such as
uaccess, futex, memcpy/strnlen/strncpy can be used as user- and
kernel-space share the address space in !CONFIG_MMU mode.
Signed-off-by: Hajime Tazaki <thehajime@gmail.com>
Signed-off-by: Ricardo Koller <ricarkol@google.com>
[drop unnecessary bits]
Link: https://patch.msgid.link/20260723113633.1206c739d6c0.I88b7ddf5613d072b934ce5fd9ef133ea5a4aa2b6@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
This splits the memory, process related code with common and MMU
specific parts in order to avoid ifdefs in .c file and duplication
between MMU and !MMU.
Signed-off-by: Hajime Tazaki <thehajime@gmail.com>
[drop many unnecessary changes]
Link: https://patch.msgid.link/20260723113633.af7d6a109c22.Ie82119143778b91fa5585ea3493cf4014113da47@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
As UML supports CONFIG_MMU=n case, it has to use an alternate ELF
loader, FDPIC ELF loader. In this commit, we added necessary
definitions in the arch, as UML has not been used so far. It also
updates Kconfig file to use BINFMT_ELF_FDPIC under !MMU environment.
Acked-by: Kees Cook <kees@kernel.org>
Signed-off-by: Hajime Tazaki <thehajime@gmail.com>
Signed-off-by: Ricardo Koller <ricarkol@google.com>
Link: https://patch.msgid.link/20260723113633.08fe0ad5320e.I3faf90e4181f92dc74500a14090b711605573e4e@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
The futex operations are both now wrong, neither have proper
atomic semantics, which are needed for SMP. Even if we don't
have SMP across threads of a process yet, multiple processes
can use futexes to synchronize.
Also remove the documentation that's duplicated (and wrong,
as this implementation never returns -EAGAIN).
Acked-By: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Link: https://patch.msgid.link/20260723113137.9f16fc4d0c83.I76c3b1c4de6591fa277db8da39e5a24a62361694@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
read_cow_header() copies the backing-file path and computes geometry
from header fields without validating them, and the historical
"XXX Need to sanity-check the values read from the header" comment was
never addressed. Three image-controlled fields are unsafe:
- backing_file[]: not guaranteed NUL-terminated. cow_strdup() and the
later strlen()/printf() walk off the end of the header buffer when a
crafted image leaves the array unterminated (heap over-read).
- sectorsize: used as a divisor in cow_sizes()
(bitmap_len = (size + sectorsize - 1) / (8 * sectorsize)); a zero or
negative sectorsize causes a divide-by-zero / bogus geometry.
- For the V3/V3_b layouts the existing "align == 0" check printed a
warning but fell through and then computed
ROUND_UP(sizeof(header), 0), another divide-by-zero.
Reject an unterminated backing_file for each header version, turn the
align == 0 warnings into hard errors (goto out), and reject a
non-positive sectorsize before the geometry math runs.
A COW image is parsed from a file the guest opens (ubdN=cow,backing on
the command line, or a cow file an unprivileged user can point ubd at),
so a crafted header is attacker-reachable.
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Reviewed-by: Richard Weinberger <richard@nod.at>
Link: https://patch.msgid.link/20260622124823.1695944-1-michael.bommarito@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
vhost_user_get_config() sizes its reply buffer from header + payload:
size_t payload_size = sizeof(msg->payload.config) + cfg_size;
size_t msg_size = sizeof(msg->header) + payload_size;
...
msg = kzalloc(msg_size, GFP_KERNEL);
but then receives the response with msg_size as the payload cap:
rc = vhost_user_recv_resp(vu_dev, msg, msg_size);
vhost_user_recv() reads the header, then full_read()s header.size bytes
into &msg->payload after checking only "size > max_payload_size". The
payload area is msg_size - sizeof(msg->header) == payload_size bytes, so
passing msg_size as the cap lets a peer set header.size up to msg_size
and write sizeof(struct vhost_user_msg_header) (12) bytes past the end
of the kzalloc(msg_size) buffer -- a slab out-of-bounds write of
peer-controlled content.
Pass payload_size, which is the size the payload area was allocated for.
A malicious or compromised vhost-user backend triggers this during
device probe (vu_get -> vhost_user_get_config) with no guest action,
which matters in the confidential-computing model where the guest does
not trust the device backend.
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Reviewed-by: Richard Weinberger <richard@nod.at>
Link: https://patch.msgid.link/20260622124750.1694957-1-michael.bommarito@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
Convert to %pM instead of using custom code.
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20260603072958.107215-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
These buffers are allocated when initializing the virtual queues, but
were not freed again. Wrap all of the del_vqs calls to detach and free
the unused buffers before deleting the IRQ VQ.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Link: https://patch.msgid.link/20260505124317.2330700-2-benjamin@sipsolutions.net
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
Stack of task can be freed earlier than task in case of
THREAD_INFO_IN_TASK. So separate reference of stack should be there.
Help of THREAD_INFO_IN_TASK config also suggests to take this
reference before calling get_wchan.
KASAN also reports it in case of manual race reproduction:
[ 18.400000] BUG: KASAN: vmalloc-out-of-bounds in __get_wchan+0x91/0xd9
[ 18.400000] Read of size 8 at addr 00000000648bfad0 by task cat/25
..
Adding try_get_task_stack() to make sure stack's sanity.
Signed-off-by: Maninder Singh <maninder1.s@samsung.com>
Link: https://patch.msgid.link/20260429060755.1541742-1-maninder1.s@samsung.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
kconfiglint reports:
K008: config MAGIC_SYSRQ has prompts in 2 separate definitions
MAGIC_SYSRQ is defined in two places with complementary conditions:
arch/um/Kconfig:213 — depends on MCONSOLE (UML only)
lib/Kconfig.debug:665 — depends on !UML (everything except UML)
The UML definition has existed since the initial git import in
commit 1da177e4c3f4 ("Linux-2.6.12-rc2"). UML needs MAGIC_SYSRQ to work
through its mconsole interface rather than through keyboard input, so the
UML version depends on MCONSOLE while the generic version excludes UML
entirely with `depends on !UML`.
These two definitions are logically complementary: on UML, MAGIC_SYSRQ
requires MCONSOLE; on everything else, it has no special dependencies.
This can be expressed as a single definition with
`depends on !UML || MCONSOLE`, which evaluates to:
- On UML: requires MCONSOLE (same as before)
- On non-UML: always satisfiable (same as before)
Consolidate into the generic definition in lib/Kconfig.debug by changing
the dependency to `depends on !UML || MCONSOLE` and merging the UML-
specific help text that explains the mconsole-based sysrq interface.
Remove the now-redundant definition from arch/um/Kconfig.
This follows the same unification pattern used by commit 7bd291abe2da
("sched: Unify the SCHED_{SMT,CLUSTER,MC} Kconfig") and our earlier
SCHED_MC consolidation for SH.
No functional change — the resulting Kconfig behavior is identical.
Assisted-by: Claude:claude-opus-4-6 kconfiglint
Signed-off-by: Sasha Levin <sashal@kernel.org>
Link: https://patch.msgid.link/20260426000339.57049-1-sashal@kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
mconsole_parse() matches the 3-byte prefix "log", but mconsole_log()
skips strlen("log ") = 4 bytes, advancing ptr past the NUL terminator
when a client sends "log" without a trailing space.
The length then comes from req->len, the raw recvfrom() count, instead
of req->request.len, so printk() reads up to req->len - 4 bytes of
stale data from a previous request left in the static mc_request
buffer, leaking it to the kernel log.
Use req->cmd->command for the actual command length, add skip_spaces(),
use req->request.len, and guard against non-positive length.
Signed-off-by: Shengzhuo Wei <me@cherr.cc>
Link: https://patch.msgid.link/20260425-mconsole-oob-read-leak-v1-1-7d46e5892c5c@cherr.cc
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
uml_parse_vector_ifspec() stores parsed key/value pairs in the fixed
struct arglist token and value arrays, which are both sized to MAXVARGS.
The parser increments numargs as it discovers pairs, but it never checks
whether another slot is still available before writing into the arrays.
Reject interface specifications that exceed MAXVARGS instead of writing
past the end of the fixed argument arrays.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260424070106.1-uml-vector-v2-pengpeng@iscas.ac.cn
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
All callers of destroy_queue() already perform a NULL check, so
a NULL qi will never be passed in. Inside destroy_queue(), we
dereference qi immediately, and the subsequent NULL check on qi
is unnecessary and confusing. Remove it to address the smatch
warning.
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <error27@gmail.com>
Closes: https://lore.kernel.org/r/202604110937.MLUL70Lx-lkp@intel.com/
Signed-off-by: Tiwei Bie <tiwei.btw@antgroup.com>
Acked-By: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Link: https://patch.msgid.link/20260411163705.948426-1-tiwei.btw@antgroup.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
mconsole_version() formats several UTS strings into a fixed 256-byte
local buffer with sprintf() and no length bound.
Use snprintf() so the version reply stays within the local buffer.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260408160001.1-um-mconsole-v2-pengpeng@iscas.ac.cn
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
add_arg() checks whether command_line and arg fit in the fixed
COMMAND_LINE_SIZE buffer, but when command_line is non-empty it inserts
an additional space before appending arg. The current guard does not
account for that separator, so a non-empty command line can pass the
check and still overflow by one byte.
Count the separator when command_line already contains data.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260330062921.40824-1-pengpeng@iscas.ac.cn
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
With contemporary toolchains, CONFIG_GCOV doesn't work because
gcov now relies on both init and exit handlers, but those are
discarded from the binary. Fix the linker scripts to keep them
instead, so that CONFIG_GCOV can work again.
Note that this does not make it work in modules yet, since we
don't call their exit handlers.
Note: the .init_array.* wildcard and the RUNTIME_DISCARD_EXIT
define are already present in this tree; only the matching
.fini_array.* wildcard remained to be added.
Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Alex Hung <alex.hung@amd.com>
Tested-by: Mariia Nikitash <nikitash.mariiaw@gmail.com>
Link: https://patch.msgid.link/20260727195515.2306731-1-alex.hung@amd.com
Signed-off-by: Kees Cook <kees@kernel.org>
|
|
virtio_uml invokes virtqueue callbacks from vu_interrupt() and
vu_req_interrupt(), which share vu_dev->irq. The core's
synchronize_rcu() fallback already covers these IRQ handlers.
Implement synchronize_cbs() with synchronize_irq() to synchronize with
that IRQ instead of waiting for an RCU grace period.
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260908053817.26065-5-kmehltretter@gmail.com>
|
|
If the CPU declares AVX or AVX-512 support, verify that all the
corresponding bits are set in the XCR0 register. If any are missing,
warn and don't set the corresponding X86_FEATURE_* flags.
This eliminates the perceived need for UML-supporting AVX and AVX-512
optimized code in the kernel (that is, lib/raid/ currently) to start
checking the XCR0 bits in addition to X86_FEATURE_AVX*.
This aligns UML with the vast majority of userspace programs, which
check the XCR0 bits before considering AVX and AVX-512 to be supported,
as per the procedure documented in Intel's CPU manual.
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Acked-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260901145740.42337-3-ebiggers@kernel.org
|
|
The removal of the architecture-specific asm/timex.h was meant to fall back to
asm-generic/timex.h. However on UML, the host architecture headers are earlier
on the include path and therefore asm/timex.h from the host architecture is
used.
On x86 that header in turn requires the generation of cpufeaturemasks.h, which
is not set up for UML and the build fails.
In file included from ../arch/x86/include/asm/tsc.h:9,
from ../arch/x86/include/asm/timex.h:6,
from ../include/linux/timex.h:67,
from ../include/linux/time32.h:13,
from ../include/linux/time.h:60,
from ../include/linux/jiffies.h:10,
from ../include/linux/ktime.h:25,
from ../include/linux/timer.h:6,
from ../include/linux/uprobes.h:18,
from ../include/linux/mm_types.h:16,
from ../include/linux/mmzone.h:22,
from ../include/linux/gfp.h:7,
from ../include/linux/slab.h:17,
from ../include/linux/crypto.h:18,
from ../arch/um/kernel/asm-offsets.c:6:
arch/x86/include/asm/tsc.h: In function ‘get_cycles’:
arch/um/include/asm/cpufeature.h:52:39: error: implicit declaration of function ‘DISABLED_MASK_BIT_SET’ [-Wimplicit-function-declaration]
52 | (__builtin_constant_p(bit) && DISABLED_MASK_BIT_SET(bit) ? 0 : _static_cpu_has(bit))
| ^~~~~~~~~~~~~~~~~~~~~
arch/x86/include/asm/tsc.h:79:14: note: in expansion of macro ‘cpu_feature_enabled’
79 | if (!cpu_feature_enabled(X86_FEATURE_TSC))
| ^~~~~~~~~~~~~~~~~~~
arch/um/include/asm/cpufeature.h:115:17: error: implicit declaration of function ‘_static_cpu_has’ [-Wimplicit-function-declaration]
115 | _static_cpu_has(bit) \
| ^~~~~~~~~~~~~~~
...
The x86-specific timex.h also doesn't make sense on UML in general.
Reintroduce the UML-specific asm/timex.h and add a comment to document
its necessity.
[ bp: Improve that comment to actually state why stuff is there. ]
Fixes: 3ed403bbc967 ("treewide: Remove CLOCK_TICK_RATE")
Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: David Gow <david@davidgow.net>
Link: https://patch.msgid.link/20260819-uml-timex-fix-v1-1-f690b514fc9f@linutronix.de
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 cpuid updates from Borislav Petkov:
- Get rid of static_cpu_has() - one less API to care about testing CPU
features
- Unify the handling of CPU core types (performance, efficient, etc) by
mapping the vendor-specific types to Linux ones
- Continuation of the work of Ahmed Darwish to centralize CPUID leaf
representation
* tag 'x86_cpu_for_v7.3_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/CPU: Rename struct cpuid_read_output to struct cpuid_output
x86/cpu/scattered: Sort it properly
x86/cpu: Use parsed CPUID(0x1)
x86/lib: Add CPUID(0x1) family and model calculation
x86/cpu: Use parsed CPUID(0x0)
x86/cpu/transmeta: Rescan CPUID(0x1) after modifying capabilities
x86/topology: Add TOPO_CPU_TYPE_LOW_POWER
x86/topology: Name the AMD core-type values
x86/topo: Map vendor CPU types to generic Linux such types
x86/bugs: Don't use cpu-type matching in cpu_vuln_blacklist
x86/cpu: Hide and rename static_cpu_has()
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 alternatives update from Borislav Petkov:
- Remove the smp_locks alternatives machinery which was used to patch
out lock prefixes when running a SMP kernel on a uniprocessor machine
* tag 'x86_alternatives_for_v7.3_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/alternative: Drop smp_locks glue
|
