| Age | Commit message (Collapse) | Author |
|---|
|
Kernel structures increasingly want to publish pointers into a BPF arena
to the BPF programs they are shared with, and some pointer members that
reach programs as trusted are legitimately NULL at times. Neither can be
expressed today: a pointer member reaches the program as an ordinary
kernel pointer, and sched_ext resorts to a plain u64 holding a
pre-translated arena address that programs cast before use.
Define __arena and __nullable as BTF type tags, the way __user, __rcu
and __percpu already are, so that tagged members survive into vmlinux
and module BTF and the verifier can act on them. To kernel code and to
sparse the qualifiers are empty: the pointers are ordinary kernel
pointers. The verifier side follows in the next patches.
The tags live in a header of their own, bpf_compiler_types.h, rather
than in compiler_types.h. They mean something to the BPF verifier only,
and only the few structures shared with BPF programs that want to
publish such a pointer carry them, so the code that declares such a
structure includes the header and the rest of the kernel never sees the
qualifiers.
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261019132203.3034698-6-memxor@gmail.com
|
|
Pass the ACF firmware filename as an argument to
aw88399_request_firmware_file() instead of hardcoding AW88399_ACF_FILE.
Both existing callers (ASoC and HDA) pass AW88399_ACF_FILE to preserve
current behavior. Also add missing newlines to the log messages of the
modified lines.
This allows the HDA side codec driver to request per-model firmware files
in the next patch.
Tested-by: Xia Yun'an <imitoy@imitoy.top>
Signed-off-by: Marco Giunta <marco_giunta@outlook.it>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/SN6PR19MB2303DB0BF41797A38EB04CBFFC992@SN6PR19MB2303.namprd19.prod.outlook.com
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus
ASoC: Updates for v7.4
There's an awful lot of cleanup work in this pull request, lots from Bui
Duc Phuc, Pengpeng Hou, HyeongJun An and Chancel Liu cleaning up detail
issues in drivers in addition to Mormoto-san's ongoing framework work.
This time Morimoto-san's work included enabling auto_selectable_formats
so there's less manual configuration required for DAI links.
There's also been a huge amount of upstreaming activity from Qualcomm,
some pain there but hopefully enough has now landed for things to be
smoother in future.
- Use auto_selectable_formats in most drivers to reduce the amount of
manual configuration required for DAI links.
- Support for compressed audio on SOF IPC4 systems.
- Support for AMD ACP 7.B and 7.F, AmLogic A9 and T7, Airoha AN7581,
ESS Technology ES9039Q2M, Intel Cherry Trail with RT5688, Nuvoton
NAU83G60, nVidia systems with WM8994, Qualcomm QAIF, Senary I2S, WCD9378
and various platforms, Realtek RT766 and RT767, Senary SN624x
I also mistakenly merged some SPI changes in here then applied more
patches on top before I noticed (it looks like this was b4's base
selection logic picking a bad base for some ASoC work), highlights there
are:
- Improvements for spidev_test to cover additional use cases, plus be a
bit easier to use.
- Push more Tegra210 QSPI handling into interrupt context for
performance improvements.
- Support for Qualcomm QPIC SNAND v2 and RealTek RTD1625 NOR.
- Documentation clarifications.
- Fixes for some runtime PM and error handling issues.
- Support for R-Car Gen5.
(this should also be going in via my SPI pull request)
|
|
nfs_localio_invalidate_clients() moves UUID nodes embedded in nfs_client
objects to a private list, then walks that list without retaining the
containing clients. Concurrent client teardown can free an entry that
the iterator has already selected, causing a use-after-free.
Take a reference to each selected UUID under the namespace list lock.
Keep this reference count in nfs_common, independently of cl_count, and
have nfs_free_client() drain temporary UUID users before freeing the
client. Releasing a UUID reference wakes waiting probes and signals
completion when the last reference is dropped. It neither calls into
nfs.ko nor performs final NFS client teardown in the NFSD invalidation
context.
Keep the UUID on the namespace list until its files have been closed.
When another thread is already disabling it, wait for that thread to
finish unlinking it instead of repeatedly selecting the same head entry.
The wait releases the UUID spinlock so file cleanup can make progress.
Append registrations in sequence order and capture the last sequence
under the namespace list lock at the start of invalidation. Stop at that
boundary so new registrations cannot indefinitely extend the sweep,
even if its original last entry is removed concurrently.
Publish the LOCALIO association under the UUID and namespace list locks
before making the entry visible to invalidation. A temporary UUID
reference allows the handshake to drop the global lookup lock before
taking the UUID lock in the documented order; recheck the lookup in case
the probe was withdrawn. A new probe waits for temporary UUID users to
drain, then rechecks the association before reusing the UUID. This keeps
a transient invalidation reference from discarding the client's LOCALIO
revalidation attempt. Withdraw pending probes before dropping the owner's
UUID reference.
A deterministic same-base KASAN reproducer triggered the reported
use-after-free on the unpatched tree. With this patch, the same controlled
invalidation and teardown race completed without the target KASAN report
or another selected kernel diagnostic. A separate all-live run recorded
disable events for all 16 unique clients.
Test-only synchronization hooks verified that a second disabler waits for
unlink after ->net is cleared and that client teardown waits for a
temporary UUID reference to drain. NFSv4.2 and NFSv3 read, write, and
unmount smoke tests, export-flush and I/O stress, NFSD restarts, network
namespace lifecycle tests, and module unloads passed with KASAN and
lockdep enabled.
A full x86_64 kernel and modules build with GCC 13.3, CONFIG_WERROR=y,
NFS_FS=m, NFSD=m, and LOCALIO enabled completed without diagnostics.
Module metadata showed that nfs_localio.ko depends only on sunrpc, while
nfs.ko depends on lockd, nfs_localio, and sunrpc.
A separate NFS_FS=m, NFSD=y build also linked vmlinux successfully.
The vulnerability research and validation were conducted by members of
the Tobabz team as part of the Best of the Best 15th program.
Fixes: 085804110aa1 ("nfs_common: track all open nfsd_files per LOCALIO nfs_client")
Assisted-by: LLM
Signed-off-by: Jinpyo Lee <bint4b13@gmail.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
|
|
Add the FUSE_BACKING_MAP_CYCLIC flag for FUSE_NOTIFY_BACKING_MAP
notifications to enable creating striped maps.
This is just a set of regular extents that repeats after the end of the
last extent using a striping pattern (i.e. on the target backings the
stripes have a contiguous footprint).
Two additional limits apply compared to non-cyclic extent map population:
- the size of the extents (chunk size) must be equal
- the extents must start from zero offset and follow each other without
gaps.
Originally-by: John Groves <john@groves.net>
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
|
|
Add support for creating and managing extent maps that map file regions to
dax device regions.
Introduce FUSE_NOTIFY_BACKING_MAP for populating extent maps from
userspace.
Extent maps are handled as a new type of backing and are assigned a 64 bit
backing ID by the server.
One extent consists of
- offset within the containing backing
- length of extent
- target backing ID
- offset into target backing
Extents must be non-overlapping, and can only refer to dax device backings
for now.
At this point only support creating and populating the extent map in one
operation, though the interface is not limited by this and later may be
changed, so that partial population of an extent map would be possible.
Originally-by: John Groves <john@groves.net>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
|
|
Add backing_id_64 field to fuse_open_out to allow opening files with
64-bit server-allocated backing IDs.
If the connection was initialized with FUSE_PASSTHROUGH_V2, the kernel
reads the backing ID from open_out.backing_id_64 instead of
open_out.backing_id.
The open reply is now variable-length for backward compatibility with
servers that don't send the new backing_id_64 field.
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
|
|
Add support for server allocated 64-bit backing IDs alongside the
existing kernel allocated 32-bit IDs.
Opened with FUSE_DEV_IOC_BACKING_CREATE, the backing ID sent via
fuse_backing_create_in.backing_id.
Closed with FUSE_NOTIFY_BACKING_REMOVE. Since close only provides the
backing ID, not the file descriptor, it doesn't have to be done with an
ioctl.
Backing ID can take any 64 bit value other than zero.
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
|
|
If the file is a fsdev_dax open, take the dax_dev from the device inode's
i_cdev. Return with a reference grabbed on the private dax inode.
Make dax_dev_get() static again (internal to super.c for alloc_dax), export
fsdev_dax_from_file() instead.
This fix is in response to a Sashiko review, and some subsequent analysis.
About the 'fixes' tag: this removes the export of dax_dev_get(), which was
flawed, and replaces it with fsdev_dax_from_file(). It feels like the fixes
tag makes sense for correcting an ABI error.
Fixes: 2ae624d5a555d ("dax: export dax_dev_get()")
Originally-by: John Groves <john@groves.net>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Gregory Price (Meta) <gourry@gourry.net>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
|
|
Merge updates related to runtime PM for 7.4:
- Update and improve runtime PM documentation and add a kunit test for
supplier idle/suspend (Brian Norris)
- Add a pm_runtime_dont_use_autosuspend() call to pm_runtime_reinit()
to ensure autosuspend disabling on driver teardown (Joshua Crofts)
* pm-runtime:
PM: runtime: Expand introduction with core concepts and structure
PM: runtime: Clarify driver callback expectations and structure Section 2
PM: runtime: Clarify ->runtime_idle() callback return value handling
PM: runtime: Add "Section" hyperlinks
PM: runtime: Misc improvements to runtime_pm.rst
PM: runtime: More kerneldoc formatting
PM: runtime: Correct pm_runtime_autosuspend_expiration() doc
PM: runtime: call pm_runtime_dont_use_autosuspend() on reinit()
PM: core: Document struct dev_pm_info with kerneldoc
PM: runtime: Pull API docs from kerneldoc
PM: runtime: kerneldoc wording improvements
PM: runtime: Improve set_{status,active,suspended} docs
PM: runtime: kerneldoc fixes
PM: runtime: Add kunit test for supplier idle/suspend
PM: runtime: Only queue an idle check for RPM-linked suppliers
|
|
Merge cpufreq updates for 7.4:
- Minor fixes in various cpufreq drivers (Alexander Koskovich, Daniel
Schwierzeck, Frank Zhang, Haotian Zhang, Kathiravan Thirumoorthy,
Sumeet Pawnikar, and Xueqin Luo)
- Fix wrong behaviors on multi-node servers in the Loongson cpufreq
driver (Huacai Chen)
- Reject NULL from cpufreq_cpu_get() in the Rust code (Mehmet Koseoglu)
- Add suspend OPP to mediatek cpufreq driver and DT (Ryan Brue)
- Fixups for a few bugs identified by Sashiko in the amd-pstate cpufreq
driver (Mario Limoncielloi, Wentao Guan)
- Initial support for maximum frequency capacity handling on Zen6
client in amd-pstate (Mario Limonciello)
- Fix for amd-pstate-ut with 'Requested CPU Min frequency' BIOS option
(K Prateek Nayak)
- New Zen6 tuning values for EPP in amd-pstate (Mario Limonciello,
Vishal Badole)
- amd-pstate documentation fix (Karl Mehltretter)
- Restrict deferred downscaling to low load for shared policies in the
conservative cpufreq governor to avoid undesirable CPU frequency
reduction in some cases (Shengming Hu)
- Serialize sugov_start() against rate limit updates in the schedutil
cpufreq governor to avoid using a stale rate limit value (Hui Su)
* pm-cpufreq: (34 commits)
cpufreq: loongson3: Replace IOCSR read/write with MMIO ones
cpufreq: loongson3: Use global physical CPU ID in get/target callbacks
cpufreq: loongson3: Replace per-package mutex with per-node
cpufreq: loongson3: Adjust the width of id and val in smc_message
cpufreq: loongson3: Make this driver depend on MACH_LOONGSON64
cpufreq: schedutil: Serialize sugov_start() against rate limit updates
arm64: dts: mediatek: mt8173: Mark the lowest CPU OPPs for suspend
cpufreq: mediatek: Enter system sleep at the suspend OPP
cpufreq: qcom-cpufreq-hw: fix device node refcount leak in phandle parsing
cpufreq: qcom-nvmem: Add IPQ9650 support
cpufreq: Add Milos to cpufreq-dt-platdev blocklist
cpufreq: Use %pe to print error pointers symbolically
rust: rcpufreq_dt: add module alias
cpufreq: sti: avoid NULL dereference in dev_err()
cpufreq: tegra194: fix double-pointer error in get_cpu_ndiv
cpufreq: sparc-us2e: fix frequency table index copy-paste error
rust: cpufreq: reject NULL from cpufreq_cpu_get()
cpufreq: amd-pstate-ut: Fix max_freq and EPP test failures on Zen6
cpufreq: amd-pstate: Propagate cppc_set_auto_sel() errors on mode change
cpufreq: amd-pstate: Restore previous mode when changing driver mode fails
...
|
|
Merge ACPI CPPC library updates the CPPC cpufreq driver updates based on
them for 7.4:
- Fix multiple issues related to input validation, synchronization,
access safety, memory layout and register field validation, and error
handling in the ACPI CPPC library (Christian Loehle and Sumit Gupta)
- Select the frequency-invariance callback per CPU in the CPPC cpufreq
driver and create the FIE worker before enabling PCC callbacks in it
to avoid queueing work through a missing worker and dereferencing a
NULL pointer (Christian Loehle)
- Update the CPPC cpufreq driver entry in MAINTAINERS and add a new
entry for the ACPI CPPC library (Christian Loehle)
* acpi-cppc: (22 commits)
MAINTAINERS: ACPI: Add a separate CPPC entry
MAINTAINERS: cpufreq: Replace CPPC reviewer
cpufreq: CPPC: Create the FIE worker before enabling PCC callbacks
cpufreq: CPPC: Select the frequency-invariance callback per CPU
ACPI: CPPC: Accept requests to retain immutable autonomous selection
ACPI: CPPC: Propagate errors from cross-CPU FFH calls
ACPI: CPPC: Validate FFH register fields before hardware access
ACPI: CPPC: Keep Performance Limited clearable on NVIDIA T41
ACPI: CPPC: Clear Performance Limited without a stale read
ACPI: CPPC: Validate SystemIO overlaps across processors
ACPI: CPPC: Validate PCC overlaps across processors
ACPI: CPPC: Validate SystemIO register layouts
ACPI: CPPC: Validate and access PCC register layouts
ACPI: CPPC: Reject direct reads of write-only controls
ACPI: CPPC: Reject unsafe cross-CPU SystemMemory RMW
ACPI: CPPC: Release PCC data after probe failures
ACPI: CPPC: Release CPC descriptors through kobject
ACPI: CPPC: Serialize PCC EPP payload updates
ACPI: CPPC: Serialize PCC single-register payload updates
ACPI: CPPC: Propagate performance-control write errors
...
|
|
The new helper font_glyph_cursor() fills a glyph with a cursor pattern.
As with the font_glyph_rotate_*() helpers, the caller has to provide the
output memory.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
|
|
Cursors in the VT subsystem are blocks within a character cell that are
filled with the foreground color. The new helpers vc_cursor_start() and
vc_cursor_end() return the scanlines in which the cursor block starts rsp.
ends. This is compatible with VGA hardware.
In terms of cursor design, the new cursor-size helpers follow established
styles in fbcon. The only exception is in underline cursors for fonts with
a size larger than 10. The underlining dash is now one pixel closer to
the font-glyph data, so that the cursor looks less detached. This follows
the style used by vgacon.
Users control the cursor size with the vt module's parameter cur_default
or with the ESC sequence \e[?Nc, where N is the cursor-size constant. In
case of an invalid setting, the new helpers fall back to cur_default and
then underline cursors; in this order.
Similar code in vgacon and fbcon ignores the cursor's default size stored
in vt.cur_default. The consoles default to full-block cursors, while vt
defaults to underline cursors. VGA BIOSes also tend to use underline by.
default. Upon initialization vt applies its default to the console, but
each console might fall back to it own default. For example, running the
ESC code from above with the invalid constant of 8 magically flips the
cursor from underline to block size on vgacon. Another call with N set
to 0 (i.e., default) magically flips it back to underlyine. Making
underline the new default everywhere harmonizes vt, fbcon and most VGA
BIOSes.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Helge Deller <deller@gmx.de>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Helge Deller <deller@gmx.de>
|
|
Sashiko warns that we still have races when the dest overload
thresholds are updated. If we narrow the range between
thresholds the lockless readers (ip_vs_bind_dest and
ip_vs_unbind_dest) may use old threshold values and
as result to skip the required flag change.
To solve the problem ip_vs_bind_dest() and ip_vs_unbind_dest()
will have the chance as before to change the overload
state not only at the exact threshold positions but
at any conn count below the lower and above the upper thresholds.
To make it work without entering the locked region for
every connection, we introduce l_threshold_val. Together with
u_threshold_val we will switch between two states:
1. not overloaded: where l_threshold_val is set to 0
to close the door for more ip_vs_unbind_dest() calls
to clear the overload state.
2. overloaded: where u_threshold_val is set to INT_MAX
to close the door for more ip_vs_bind_dest() calls
to set the overload state.
If a race occurs, multiple CPUs can repeat the state change
but this should be for short time window.
With the introduction of l_threshold_val the
IP_VS_DEST_F_OVERLOAD flag and the 'flags' field are not
needed anymore. We will use the ip_vs_dest_is_overloaded()
helper for all places that read the overload state.
Do not check IP_VS_DEST_CF_AVAILABLE in ip_vs_dh.c because
we do not hold reference to dest after it is removed and
rely on RCU to access the available dests.
To reduce the cacheline accesses while selecting destination,
keep the mostly used fields (weight and l_threshold_val)
at the first read-mostly cacheline together with the hash
nodes.
Fixes: 8f843441c4e7 ("ipvs: properly update the overload flag on dest edit")
Link: https://sashiko.dev/#/patchset/20260810190621.894119-1-pablo%40netfilter.org
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
Merge updates of the ACPI PCC (Platform Communications Channel) driver,
ACPI NUMA support code, ACPI Platform Firmware Runtime Update and
Telemetry driver, ACPI WMI support code, and a PNP update for 7.4:
- Fix the shared memory signature handling in the ACPI PCC address
space handler, free the PCC mailbox channel on operation region
deactivation, and avoid unnecessary repeated computations of the
PCC operation region command timeout (Sudeep Holla)
- Fix a log message typo in the ACPI NUMA support code (Hemanth Selam)
- Zero-initialize capability query result in the ACPI Platform Firmware
Runtime Update and Telemetry driver to avoid disclosure of kernel
stack data to user space (Karl Mehltretter)
- Replace the remaining built-in/module check for CONFIG_ACPI_WMI in a
header file with IS_ENABLED() macro (Lalit Shankar Chowdhury)
- Detach device after resource transition failure in pnp_device_probe()
to avoid blocking later manual PNP configuration attempts (Myeonghun
Pak)
* acpi-pcc:
ACPI: PCC: Cache OpRegion command timeout
ACPI: PCC: Free channel on OpRegion deactivation
ACPI: PCC: Preserve shared memory signature in OpRegion handler
* acpi-numa:
ACPI: NUMA: fix typo in log message
* acpi-pfrut:
ACPI: pfr_update: zero-initialize capability query result
* acpi-misc:
ACPI: WMI: use IS_ENABLED() to simplify built-in or module check
* pnp:
PNP: Detach device after resource transition failure
|
|
Merge changes related to ACPI support in device drivers for 7.4:
- Switch over the users of acpi_get_first_physical_node(), that
was inherently racy and therefore not really safe to use, to use
its replacement acpi_bus_get_primary_device(), and eliminate the
former (Rafael Wysocki)
- Add !CONFIG_ACPI stubs for acpi_find_child_device() and
acpi_device_uid() (Mario Limonciello and Robin Murphy)
* acpi-driver:
ACPI: bus: Drop acpi_get_first_physical_node()
efi/dev-path-parser: Switch to use acpi_bus_get_primary_device()
ALSA: hda: tas2781: Switch to use acpi_bus_get_primary_device()
ALSA: hda: cs35l41: Switch to use acpi_bus_get_primary_device()
iommu/arm-smmu-v3: Switch to use acpi_bus_get_primary_device()
ACPI: Add stub for acpi_find_child_device()
ACPI: bus: Provide !ACPI stub for acpi_device_uid()
ALSA: hda: aw88399: Switch to use acpi_bus_get_primary_device()
ASoC: loongson: Switch to use acpi_bus_get_primary_device()
ASoC: intel: boards: Switch to use acpi_bus_get_primary_device()
ASoC: amd: acp3x-es83xx: Switch to use acpi_bus_get_primary_device()
ASoC: amd: acp-es8336: Switch to use acpi_bus_get_primary_device()
thunderbolt: Switch to use acpi_bus_get_primary_device()
platform/x86: apple-gmux: Switch to use acpi_bus_get_primary_device()
platform/x86: x86-android-tablets: Use acpi_bus_get_primary_device()
platform/x86: serdev_helpers: Switch to use acpi_bus_get_primary_device()
platform/x86: yogabook: Switch to use acpi_bus_get_primary_device()
ACPI: amba: Switch to use acpi_bus_get_primary_device()
ACPI: bus: Use acpi/acpi_bus.h without CONFIG_ACPI
|
|
Merge ACPICA updates and ACPI thermal control updates for 7.4:
- Add IOVT IOMMU support to ACPICA (Bibo Mao)
- Fix PCC OperationRegion command offsets in ACPICA (Sudeep Holla)
- Fix memory leak in acpi_ds_create_field() related to the handling of
internal_pcc_buffer allocations (Breno Leitao)
- Fix memory leak due to leftover devm_kcalloc() argument in the ACPI
fan driver (Rafael Wysocki)
- Fix backlight unregistration ordering in the ACPI video bus device
driver (Rafael Wysocki)
- Update the thermal core to allow the registration of thermal class
cooling devices under specific parents and convert the ACPI fan,
ACPI processor, and ACPI video bus device drivers to do so (Rafael
Wysocki)
- Adjust the ACPI thermal zone driver to use thermal class cooling
device parent information for binding cooling devices to trip points
in thermal zones (Rafael Wysocki)
- Use cooling device data that is a better match for a given driver
instread of a struct acpi_device pointer that had to be used for
this purpose previously in the ACPI fan and processor drivers (Rafael
Wysocki)
- Fix acpi_thermal_guess_offset() in the ACPI thermal zone driver for
thermal zone devices with a 273.0°K offset (Hans de Goede)
- Define a free for ACPI objects allocated by ACPICA helpers and use
it to simplify AML error handling in the ACPI fan driver (Rafael
Wysocki)
* acpica:
ACPICA: actbl2.h: Add bit constants of the Flags field in the IOVT IOMMU structure
ACPICA: Fix PCC OperationRegion command offsets
ACPICA: Fix memory leak in acpi_ds_create_field()
* acpi-thermal:
ACPI: fan: Use __free() to simplify AML error handling
ACPI: thermal: Fix acpi_thermal_guess_offset() for device with a 273.0°K offset
ACPI: fan: Use more suitable cooling device data
ACPI: fan: Store ACPI device pointer in struct acpi_fan
ACPI: processor: thermal: Use more suitable cooling device data
ACPI: thermal: Use cooling device parent for thermal zone binding
ACPI: fan: Use thermal_cooling_device_create()
ACPI: video: Use thermal_cooling_device_create()
ACPI: processor: thermal: Use thermal_cooling_device_create()
thermal: core: Introduce thermal_cooling_device_create()
ACPI: video: Fix backlight unregistration ordering
ACPI: fan: Fix memory leak due to leftover devm_kcalloc() argument
|
|
Pull 7.4 merge-window stuff.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
|
|
OSS proc entries and notifier callbacks can remain in use without an
open OSS device file. Normal snd-pcm-oss removal can therefore delete
an existing PCM's OSS proc entry while late HDA codec binding repeats
snd_card_register() on the same live card:
OSS PCM module unload Card registration
--------------------- -----------------
snd_info_free_entry(entry)
proc_remove(entry->p)
clear entry->p
snd_info_card_register()
republish linked entry
unlink and free entry
The new proc node retains a pointer to freed storage. Mixer OSS removal
can likewise release an adapter while a card notification still uses it.
Hold a snd-pcm-oss module reference for each PCM registered with its
notifier and a snd-mixer-oss reference for each card adapter. Release
them at final unregister or FREE, after proc and adapter cleanup. Normal
module unload can no longer initiate removal while these objects exist.
Track PCM OSS registration with a separate bool registered. Unlike
oss.reg, this state also covers unmapped PCMs and remains set across
DISCONNECT until final unregister. BUILD-state and creation-error cleanup
must not drop a reference when registration never acquired one. The PCM
notifier's register_mutex serialization keeps the final put ahead of
notifier removal and module teardown until dispatch has finished.
For mixer OSS, serialize callback publication, dispatch and withdrawal
in the core so module exit waits for callbacks, including one dropping
the last reference, to return. Keep card enumeration in the OSS module,
with card references released after dispatch drops the mutex. Ignore
duplicate REGISTER notifications so a delayed registration cannot
replace an adapter retained across DISCONNECT and leak its module pin.
Partial HDA codec teardown can still remove an individual PCM while the
card remains registered; its object-lifetime handling is separate.
Fixes: 2471b6c80a70 ("ALSA: info: Register proc entries recursively, too")
Suggested-by: Takashi Iwai <tiwai@suse.de>
Assisted-by: LLM
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/pm-pmb-26d66390a25fec9fad6c-v6-5be251a3ac8832955a31-2@gmail.com
|
|
An extension that writes to the packet of a tc, lwt_xmit or sk_skb program
starts with bpf_unclone_prologue(). If the skb is cloned, that gives it
a new head.
It does not count as changing packet data. changes_pkt_data goes by the
helpers and kfuncs that a program calls, and whether it gets a prologue
is known only after it has been compared with its target. So the extension
can replace a global function that leaves the packet alone, and the callers
of that function keep their packet pointers across the call. These point
into the old head, which is left to the other clone. Once that is freed,
by the reader of a packet socket for example:
BUG: KASAN: slab-use-after-free in bpf_prog_53bc21b9810cadbc_t_read+0x2e8/0x36e
Read of size 1 at addr ffff888107bfe73c by task tt11/102
Freed by task 112:
kfree+0x161/0x500
skb_release_data+0x2dc/0x340
consume_skb+0xa6/0x1c0
packet_recvmsg+0x4b3/0xa20
Nothing is wrong if the target program writes to the packet too: its own
prologue has uncloned the skb, and that of the extension does nothing.
Nor if the callers hold no packet pointers, like a dispatcher, or if the
main function is replaced.
Note for every global function that leaves the packet alone if it is
called while packet pointers, or slices of the dynptr of a packet, are
held. What the callers of a global function hold is not known while it
is verified, so the functions that it calls are taken for such as well.
Refuse an extension with a prologue for such a function, unless the target
program has a prologue, both when the extension is loaded and when it
is attached to another target.
Functions can share a type id in func_info. The first of them is the one
that is replaced, so look it up in one place.
Fixes: 7e40781cc8b7 ("bpf: verifier: Use target program's type for access verifications")
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20261019011328.1843764-1-alexei.starovoitov@gmail.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
|
|
For BPF_MAP_TYPE_PERCPU_ARRAY map, bpf_percpu_array_update()
is not considering the possibility of a combination of
(BPF_NOEXIST, BPF_EXIST) flags with (BPF_F_CPU, BPF_F_ALL_CPUS) flags.
This causes the (BPF_NOEXIST, BPF_EXIST) flags to lose their effect
in some cases.
For example, using the (BPF_F_ALL_CPUS | BPF_EXIST) flag combination
with bpf_map_update_elem() results in an incorrect EINVAL error
response, even though the flag combination is valid.
This patch fixes the bug by adding proper flag validations and checks.
Before this patch, bpf_percpu_array_update() rejected
BPF_F_ALL_CPUS | BPF_EXIST and BPF_F_ALL_CPUS | BPF_NOEXIST with
-EINVAL. Also the BPF_F_CPU | BPF_NOEXIST were accepted.
After the patch BPF_F_ALL_CPUS | BPF_EXIST is accepted and
BPF_F_ALL_CPUS | BPF_NOEXIST and BPF_F_CPU | BPF_NOEXIST
result in -EEXIST.
This patch also starts returning -EINVAL for (BPF_EXIST | BPF_NOEXIST),
with or without BPF_F_CPU, which was previously accepted.
Fixes: 8eb76cb03f0f ("bpf: Add BPF_F_CPU and BPF_F_ALL_CPUS flags support for percpu_array maps")
Signed-off-by: Masoud Aghasi <maghasi@disroot.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Leon Hwang <leon.hwang@linux.dev>
Link: https://patch.msgid.link/20261008120734.1565972-2-maghasi@disroot.org
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull SCSI fixes from James Bottomley:
"All fixes in drivers (or the tape ULD) and one core fix to bsg (the
block ioctl equivalent of sg_io).
The biggest is the race in auth updates fix in iscsi configfs, but the
next biggest one is in bsg but the generic pieces of that are mostly
threading reply_len"
* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies
scsi: libsas: Fix SMP IO deadlock during HA resume
scsi: libiscsi: Validate the task named by a management response
scsi: libiscsi: Validate the ITT reflected in a Reject PDU
scsi: libiscsi: Reject a negative task index from parse_pdu_itt
scsi: target: iscsi: Fix race in discovery auth updates
scsi: target: Disable interrupts while holding delayed_cmd_lock
scsi: st: Fix use-after-free race between st_remove() and st_open()
scsi: st: Save the visited block for the partition the drive is in
scsi: xen/scsifront: Check for a NULL shadow entry on a backend response
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap
Pull regmap fixes from Mark Brown:
"The main thing here is a fix for lockdep warnings with MMIO regmaps
that use a raw spinlock and a cache, some other lockdep fixes we'd
done for the benefit of the maple tree on sleeping buses meant that we
were doing allocations for those MMIO regmaps under a raw spinlock.
While fixing that Michael Reeves also noticed that the debugfs files
were briefly available without the cache structures backing them.
There's also a fix for interrupt freeing on error in regmap-irq which
had been hanging around because it's not super urgent"
* tag 'regmap-fix-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
regmap: Drop map lock during cache init and exit
regmap: Remove debugfs before cache teardown
regmap: irq: Free the irqdomain we create
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull perf events fixes from Ingo Molnar:
- Fix x86 Intel uncore driver bug on Diamond Rapids CPUs
that erroneously always-cleared the invert bit (Guixiong Wei)
- Fix accounting bug in the perf mlock 'gift' code causing
unrelated RLIMIT_MEMLOCK functionality to fail (Lorenzo Stoakes)
- Fix perf_pmu_migrate_context() bug leaving events behind during
CPU hot-unplug (Haris Okanovic)
- Update cgroup time when rotating multiplexed events, to fix
time_running & scaled counts accounting bug (Antoine Huret)
* tag 'perf-urgent-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
perf: Update cgroup time when rotating multiplexed events
perf: Fix perf_pmu_migrate_context() leaving events behind
perf: Track the perf mlock gift separately
perf/x86/intel/uncore: Fix DMR CXL CM invert filter
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull locking fixes from Ingo Molnar:
- Fix FUT_OFF_MMSHARED futex hashing bug that can cause
missed wakeups or spurious wakeups on futex-waiting
tasks (Jann Horn)
- Fix lockdep context tracking bug in the deferred hrtimer
rearming entry code, which causes a lockdep chain leak
that will eventually turn lockdep off (Mikhail Gavrilov)
* tag 'locking-urgent-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
entry: Account the deferred hrtimer rearm as hardirq context for lockdep
futex: Fix mm reuse handling for FUT_OFF_MMSHARED
|
|
Some hardware monitoring chips support three alarm levels for current and
voltage high limits, and three alarm levels for voltage low limits.
Add support for currX_emergency, inX_emergency, and inX_lemergency
attributes together with the appropriate alarm attributes to support such
chips.
Cc: Manaf Meethalavalappu Pallikunhi <manaf.pallikunhi@oss.qualcomm.com>
Tested-by: Manaf Meethalavalappu Pallikunhi <manaf.pallikunhi@oss.qualcomm.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Link: https://patch.msgid.link/20260813211433.879638-1-linux@roeck-us.net
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
|
|
Two bugs were found in the arm64 EFI runtime support that weren't caught
by LKDTM. The existing EFI_RUNTIME_CRASH test instructs the firmware to
write to kernel memory that is mapped read-only, which usually fails as
expected. However, this does not exercise the runtime mapping logic in
the kernel, nor the fault recovery logic when the faulting address is
inside the EFI runtime memory regions itself.
So add two more test cases:
- a write to R/O memory test that uses the firmware's own executable
memory as an output buffer
- a branch to memory that is occupied by the firmware's runtime services
function table, which is usually mapped non-execute.
This depends on the EFI memory attributes table having been exposed by
the firmware and having been taken into account by the runtime mapping
code, so this is used as a prerequisite by the new tests, otherwise it
produces an XFAIL.
Reviewed-by: Kees Cook <kees@kernel.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
|
|
ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/sboyd/spmi into char-misc-next
Stephen writes:
More than a handful of changes for SPMI. I'm bringing on Abel
Vesa to help maintain SPMI so the tree may change in the future
but we'll probably continue to send patches when the pile is
small.
The big change here is that we gained a new function
spmi_subdevice_alloc_and_add() to support complex PMICs that have
different devices spread throughout the SPMI address. We've grown
subdevice drivers that use OF APIs directly to figure out some
base address to add to all their register read/write operations
which is tightly coupling our parent/child drivers. This change
allows us to clean all those drivers up to use standard device
APIs and their own regmap instead of relying on a parent SPMI
driver to do all the heavy lifting. The series also updated
drivers that could use the new API and I picked those all up
because they were acked by maintainers.
Beyond that we have some minor fixes to the Qualcomm and Mediatek
SPMI drivers for bugs in software and hardware and a couple
maintainer updates as stated earlier.
* tag 'spmi-for-next' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/sboyd/spmi:
MAINTAINERS: Add Abel as SPMI co-maintainer
spmi: mtk-pmif: Fix clock reference leak in mtk_spmi_bus_probe()
iio: adc: qcom-spmi-iadc: Remove regmap R/W wrapper functions
iio: adc: qcom-spmi-iadc: Migrate to devm_spmi_subdevice_alloc_and_add()
misc: qcom-coincell: Migrate to devm_spmi_subdevice_alloc_and_add()
phy: qualcomm: eusb2-repeater: Migrate to devm_spmi_subdevice_alloc_and_add()
power: reset: qcom-pon: Migrate to devm_spmi_subdevice_alloc_and_add()
nvmem: qcom-spmi-sdam: Migrate to devm_spmi_subdevice_alloc_and_add()
spmi: Add helper to get a parent SPMI device
spmi: Implement spmi_subdevice_alloc_and_add() and devm variant
spmi: Remove unneeded goto in spmi_device_add() error path
spmi: Print error status with %pe format
spmi: Remove redundant dev_name() print in spmi_device_add()
spmi: Fix potential use-after-free by grabbing of_node reference
spmi: mtk-pmif: Add workaround for FSM lockup/error in read operation
MAINTAINERS: Add Qualcomm SPMI controller entry
spmi: pmic-arb: return 0 in spmi_pmic_arb_register_buses() on success
|
|
Add encap_proto (AF_INET or AF_INET6) to struct flow_offload_tunnel
to allow its use as part of the hash table key during flowtable entry
lookup.
This is a preliminary change to support IPv4 over IPv6 tunneling via
the flowtable infrastructure for software acceleration.
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@oss.qualcomm.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
bpf_dynptr_write() to the dynptr of an skb ends in
__bpf_skb_store_bytes(), which makes the range writable first. That pulls
data into the head or unclones it, and either can reallocate the head. So
check_helper_call() invalidates all packet pointers and all slices of the
skb behind the helper.
Several kfuncs take the same road: bpf_dynptr_copy() and
bpf_dynptr_memset(), if they get no writable slice of the destination
because it is not linear, and bpf_probe_read_{user,kernel}[_str]_dynptr()
and bpf_copy_from_user[_task][_str]_dynptr() likewise. The verifier does
not know. A program can keep a packet pointer or a slice across such a
call and read and write the old head, which has been freed.
Treat a kfunc of that kind as bpf_dynptr_write() is treated, by the type
of the dynptr it writes to, which is the first argument of all of them.
Where a global function is only scanned for what it may do, the type is
not known yet. There any call of these kfuncs counts, as a tail call does.
Fixes: daec295a7094 ("bpf/helpers: Introduce bpf_dynptr_copy kfunc")
Fixes: a498ee7576de ("bpf: Implement dynptr copy kfuncs")
Fixes: 5fc5d8fded57 ("bpf: Add bpf_dynptr_memset() kfunc")
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261017230950.802052-9-alexei.starovoitov@gmail.com
|
|
When the last reference to a program goes, __bpf_prog_put_noref() takes
its symbols out of the kallsyms tree and frees its line info at once, and
waits for the grace periods only with the rest. But the program may still
be running: the link or the array it was called from is gone, the call is
not over.
search_bpf_extables() finds the exception table of a program by its
symbol. A load that faults, and that the table is there to fix up, is
fatal from then on:
Oops: general protection fault, probably for non-canonical address
0xdead0000000006f8: 0000 [#1] SMP NOPTI
RIP: 0010:0xffffffffc06008f6
It takes a program that is detached and closed on one CPU while it runs on
another. Unwinders and bpf_prog_find_from_stack() do not know the program
any more either, and the stack dump of a BPF stream reads the freed line
info.
Free the line info behind the grace periods the program needs, as it is
done with the BTF that its text comes from. Remove the symbols in
bpf_prog_free_deferred(), which runs behind them as well. The symbols are
looked up under rcu_read_lock(), so the images and the program itself are
freed one more grace period later. All that the program refers to is
released when it was before.
Fixes: 3dec541b2e63 ("bpf: Add support for BTF pointers to x86 JIT")
Fixes: d7c431cafcb4 ("bpf: Add dump_stack() analogue to print to BPF stderr")
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261017230950.802052-6-alexei.starovoitov@gmail.com
|
|
bpf_local_storage_destroy() frees the elements of an owner behind a plain
RCU grace period, on the ground that no program can refer to an owner that
goes away. But the pointer that bpf_task_storage_get() and its like
return stays valid for the verifier after the program has released the
owner, or has left the bpf_rcu_read_lock() section it had the owner from.
A sleepable program is in no RCU read side critical section, so it can
write to the value after the owner has died and the element was freed:
BUG: KASAN: slab-use-after-free in _copy_from_user+0x42/0xa0
Write of size 8 at addr ffff8880074404a8 by task lsuaf/55
Free the element behind an RCU Tasks Trace grace period if sleepable code
may use the map. A program that a map is bound to was loaded, and counted
in map->sleepable_refcnt, before it got a value from the live owner, and
stays counted until a grace period behind its last run.
A program can also get at a storage map by a lookup in an outer map. Then
only the outer map is counted, its programs can come after the inner map
was put into it, and can hold on to the inner map after it was taken out.
So note in a map that it has been an inner map, and treat it like one with
sleepable users from then on.
The same goes for what the special fields of the value hold. The page of
a uptr has to stay pinned, and a kptr which the program stores after the
owner has died has to be released. Leave the fields, and the smap that it
takes to free them, to bpf_selem_free_trace_rcu(), as bpf_selem_unlink()
does. bpf_local_storage_map_free() waits for that callback, and leaves
smap alone if it comes across such an element.
Elements of such maps now wait for sleepable programs that are running
when their owner dies. Other maps are freed as before.
Fixes: dcf456c9a095 ("bpf: Fix usage of trace RCU in local storage.")
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261017230950.802052-4-alexei.starovoitov@gmail.com
|
|
Unregistering a netfilter hook calls nf_queue_nf_hook_drop(), which makes
nfqnl_nf_hook_drop() walk every nfqueue instance of the network namespace
and flush it, reinjecting every packet that waits for a verdict with
NF_DROP. Deleting an nftables base chain of any table, family and hook
point therefore drops the packets queued by hooks of unrelated tables,
families and hook points. The verdict that userspace sends for them
afterwards fails with -ENOENT.
Before commit 039b40ee5854 ("netfilter: nf_queue: only call
synchronize_net twice if nf_queue is active") nf_queue_nf_hook_drop()
received the removed hook and nfqueue only dropped the entries queued by
that hook. The commit removed the argument and the comparison because
base chain removal while nfqueue is in use was rare at the time. With
base chains added and removed by userspace agents while another program
holds packets in a queue this is no longer the case. Commit
960632ece694 ("netfilter: convert hook list to an array") then replaced
the hook pointer in struct nf_queue_entry with an index into the hook
array of the hook point, so a comparison per hook is no longer possible.
A comparison per hook point is: the index of an entry is only stale when
the array of its own hook point changed.
Pass the nf_hook_ops being unregistered down to the queue handler and
add nf_hook_cmp() to nfnetlink_queue, a cmpfn for nfqnl_flush() that
matches the entries whose state.pf and state.hook are the hook point of
that hook. The handler takes the nf_hook_ops rather than the family of
the modified array to keep a single argument with NULL meaning "flush
everything", which nf_ct_iterate_destroy() uses on module exit and
__nft_ct_set_destroy() uses when a ct zone expression goes away and a
queued packet may still reference its conntrack template. The
cmpfn resolves the family itself. An NFPROTO_INET hook is registered in
the IPv4 and the IPv6 array, so it matches the entries of both families;
nf_unregister_net_hook() calls __nf_unregister_net_hook() for the two
arrays back to back and the second flush finds nothing left. If the
shrink of one array fails to allocate, that array keeps its dummy hook
and its entries stay valid, so the flush for the other family drops
them without need; no entry with a stale index survives. An
NFPROTO_INET hook at NF_INET_INGRESS is registered in the netdev ingress
array, the same mapping that nf_static_key_inc() applies. nfqueue does
not accept the ingress and egress hooks (nft_queue_validate()), the
mapping keeps the comparison consistent with the registration.
The entries queued from the hook point whose array changed are still
dropped, their hook_index is stale. Registering a hook in front of the
one that queued a packet still makes nf_reinject() resume at a stale
index, so the packet traverses the queueing hook a second time; this is
not changed here.
Tested with the reproducer script from the thread, unchanged: it queues
20 UDP packets from an inet output chain to a queue program that delays
every verdict by 100 ms and changes the ruleset while they wait. Before
this change deleting an unrelated ip6 base chain or an unrelated ip6
table delivers 3 of 20 packets and the queue program exits on ENOENT;
with it all 20 are delivered. Deleting a base chain at the same hook
point (inet output, another priority, in the same or another table) or
an ip table with an output base chain still drops the queued packets;
deleting an ip6 table with an output base chain or a netdev ingress
chain does not. Adding a base chain in front of the queueing one still
queues the packets twice. The nft_queue.sh selftest passes, with
CONFIG_NETFILTER_NETLINK_QUEUE=y and built as a module. The following
patch adds a test for both outcomes that holds the verdicts instead of
delaying them.
The code and this commit message were written with an LLM coding
assistant from a task description that contained the report, the
suggestion from the thread and the two commits above. The author
reviewed the result, directed the changes and validated them with the
reproducer and the selftest in virtme-ng before and after the change.
Suggested-by: Florian Westphal <fw@strlen.de>
Link: https://lore.kernel.org/netfilter-devel/CABhP=tYtCyr-qzL==98nkmDVZr6x+f8E26V1AAOpMXgZgt0vAQ@mail.gmail.com/
Assisted-by: LLM
Signed-off-by: Antonio Ojea <aojea@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
DSQ iteration
scx_bpf_dsq_reenq() re-enqueues a whole DSQ, but a scheduler that loses the
cpus serving a DSQ, such as a sub-scheduler after a cap revoke, needs only
the stranded tasks placed again.
Add scx_bpf_dsq_reenq_task(), which marks a task from a DSQ iteration. When
the iteration ends, the DSQ's deferred re-enqueue walk is scheduled once and
re-enqueues only the marked tasks. The kfunc locks the task's rq and the DSQ
like scx_bpf_dsq_move() and is callable from the same contexts. The mark is
cleared when the task leaves the DSQ, so a task consumed before the walk is
not re-enqueued.
An iteration's DSQ can be destroyed before the iteration ends, so
schedule_dsq_reenq() now skips a destroyed DSQ instead of aborting the
scheduler. scx_bpf_dsq_reenq() racing scx_bpf_destroy_dsq() takes the same
path.
Declare the kfunc for the tools and add a compat probe.
v2: Note in the kerneldoc that another iteration's re-enqueue may take a
marked task early, and that a task on another scheduler returns false
(Andrea).
Signed-off-by: Tejun Heo <tj@kernel.org>
Reviewed-by: Andrea Righi <arighi@nvidia.com>
|
|
Merge power-supply fixes branch to extend the epc_sem unregister fix
contained in it from external_power_changed to also cover get/set
property.
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
|
|
The bpf_map_elem iterator, for all but the per-cpu maps, and the
bpf_sk_storage_map iterator hand the live value of an element to the
program as a writable buffer. The verifier does not know the map when it
checks the program, so nothing keeps the program from writing over a
bpf_spin_lock, a bpf_timer, a kptr or another special field, which neither
a map update nor a pointer to a map value can touch. With CAP_BPF and
CAP_PERFMON, or a BPF token, a program can so make the kernel follow a
pointer of its choice: after a write over a bpf_timer the kernel crashes
on the written value when the element is removed.
Offsets into a buffer are constants. Let the verifier record the range of
bytes that a program may write through a read-write buffer, and refuse the
program with -EACCES, at attach and at a link update, if a special field
of the map lies in that range.
A program that only reads, or that writes beside the special fields, works
as before. One that writes on both sides of a special field is refused,
since the range covers the field.
Fixes: d6c4503cc296 ("bpf: Implement bpf iterator for hash maps")
Fixes: 5ce6e77c7edf ("bpf: Implement bpf iterator for sock local storage map")
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261017163745.3341787-30-alexei.starovoitov@gmail.com
|
|
Sleepable programs can only use the kinds of map that do without an RCU
read side critical section. check_map_prog_compatibility() sees to that
when a map is bound to the program, and asks whether the program is
sleepable. That misses the bpf_wq or bpf_task_work callback of a program
that is not, which runs sleepable all the same, and it misses an inner
map, which is not bound.
The bpf_wq callback of a tc program that looks a key up in a sockhash
gets as far as
WARNING: net/core/sock_map.c:903 at __sock_hash_lookup_elem+0x18f/0x1e0
Ask the same question for the map that is handed to a helper in sleepable
context, unless the RCU read lock is held: by bpf_rcu_read_lock(), or by
the helper that runs the callback, as bpf_for_each_map_elem() does for a
hash map. Programs that take the lock go on working. Disabled preemption
or interrupts are not enough, since the maps ask for rcu_read_lock_held().
The other parts of the program may use such a map as before.
A global function that is called with preemption or interrupts disabled is
verified for the non-sleepable context, in which nothing is known of all
that. Verify it for a context of its own: not sleepable, and without the
RCU read lock. It differs in what maps can be used, and in nothing else.
What is refused from now on runs into the warning above, or uses what the
map frees behind a plain RCU grace period: an entry of a devmap, of a perf
event array or of a cgroup array.
A bloom filter does without RCU. Add it to the list, so that callbacks
which use one go on loading. As a side effect sleepable programs can use
bloom filters as well.
A pointer to the value of a devmap which a program keeps beyond
bpf_rcu_read_unlock() is not dealt with here.
Fixes: 638e4b825d52 ("bpf: Allows per-cpu maps and map-in-map in sleepable programs")
Fixes: 8e83da9732d9 ("bpf: add bpf_wq_start")
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261017163745.3341787-25-alexei.starovoitov@gmail.com
|
|
bpf_wq_work() runs the callback under rcu_read_lock_trace() only, since
the callback may sleep. The program it belongs to need not be sleepable,
and such a program is freed behind a plain RCU grace period. The
reference that the bpf_wq holds is dropped when the map element goes, or
when another callback is set, no matter whether the work is running.
If that was the last reference the program is freed under the running
callback, and the worker goes on in the freed JIT image:
Oops: int3: 0000 [#1] SMP NOPTI
RIP: 0010:0xffffffffc0600947
All it takes is to close the map and the program while the callback runs.
Note in the program that it has a callback that runs sleepable, and wait
for an RCU Tasks Trace grace period, which implies a plain one, before
such a program is freed. Let bpf_wq_work() enter its read side critical
section before it reads callback_fn.
bpf_task_work holds a reference to the program until the callback is done.
Fixes: 8e83da9732d9 ("bpf: add bpf_wq_start")
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261017163745.3341787-23-alexei.starovoitov@gmail.com
|
|
bpf_prog_realloc() moves a program that the rewrites of the verifier make
outgrow its pages. It updates aux->prog, but not the offload->prog of a
device-bound program. When the device is unregistered,
__bpf_offload_dev_netdev_unregister() hands the stale pointer to
__bpf_prog_offload_destroy(), which faults on the freed program:
BUG: unable to handle page fault for address: ffffc90000071050
RIP: 0010:__bpf_prog_offload_destroy+0x3f/0x310
It takes the right to load a device-bound XDP program, CAP_BPF and
CAP_NET_ADMIN or a BPF token, and a device that can be removed.
Commit a1aa9ef47c29 ("bpf: Fix stale offload->prog pointer after constant
blinding") repaired the other place that replaces a program. Do the same
here.
Nothing keeps the device while a program is loaded, so it can also be
unregistered at that very moment. That frees the offload, and it may have
read offload->prog already when the old copy of the program is freed. In
both places update the pointer under bpf_devs_lock, before the old copy
goes.
Fixes: ab3f0063c48c ("bpf: offload: add infrastructure for loading programs for a specific netdev")
Fixes: 2b3486bc2d23 ("bpf: Introduce device-bound XDP programs")
Fixes: a1aa9ef47c29 ("bpf: Fix stale offload->prog pointer after constant blinding")
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261017163745.3341787-21-alexei.starovoitov@gmail.com
|
|
The bpf_map_elem, bpf_sk_storage_map and sockmap iterators hand the key
and the value of an element to the program as buffers. The verifier only
records how far a program reaches into them, and ->attach_target()
compares that with the key and value size of the map.
bpf_iter_link_replace() does not. BPF_LINK_UPDATE installs a program that
an attach refuses with -EACCES, and the program then reads, and for a
value writes, behind every element that the iterator visits. It takes
CAP_BPF and CAP_PERFMON, or a BPF token.
Split the test out of the three ->attach_target() and ask it, as
->check_prog(), for the new program of an update as well. Targets without
such a test take every program of their kind, as before.
Fixes: d6c4503cc296 ("bpf: Implement bpf iterator for hash maps")
Fixes: 5ce6e77c7edf ("bpf: Implement bpf iterator for sock local storage map")
Fixes: 0365351524d7 ("net: Allow iterating sockmap and sockhash")
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261017163745.3341787-20-alexei.starovoitov@gmail.com
|
|
bpf_local_storage_map_free() pins the owner with refcount_inc_not_zero()
while it uncharges an element. The pin counts when
bpf_local_storage_destroy() could not get local_storage->lock: destroy()
then goes on, drops the owner's reference and spins until the count is
zero. So the pin is the last reference whenever it is needed, and
refcount_dec() takes that for a bug: it warns "decrement hit 0; leaking
memory" and saturates the count. Unless destroy() happens to read the
count between the two stores it spins for ever, under rcu_read_lock().
Drop the pin with refcount_dec_and_test().
Fixes: 5d800f87d0a5 ("bpf: Support lockless unlink when freeing map or local storage")
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261017163745.3341787-11-alexei.starovoitov@gmail.com
|
|
A sleepable "iter.s/task_vma" program can be attached, but its ->show()
callback runs with the mmap_lock of the iterated mm held for read. As soon
as the program runs, bpf_iter_run_prog() calls might_fault(), and any
bpf_copy_from_user() or bpf_copy_from_user_task() it does may really fault
or take mmap_lock again. With lockdep this is reported as recursive
locking of mmap_lock. Without lockdep, a fault on the reader's own mm, or
access_process_vm() on the iterated mm, has to take mmap_lock for read
again. If a writer queued up in the meantime that blocks behind the
writer, which in turn waits for the read lock the iterator already holds,
and the read() hangs:
reader (iter.s/task_vma) other thread of the same mm
task_vma_seq_get_next()
mmap_read_lock(mm)
mmap_write_lock(mm) <- waits
bpf prog: copy_from_user()
page fault
mmap_read_lock(mm) <- queued behind the writer
The reader waits killable, so the hang lasts until it gets a fatal signal.
bpf_iter_link_attach() allows sleepable programs for the targets that set
BPF_ITER_RESCHED, and task_vma sets it because cond_resched() between VMAs
is fine with mmap_lock held. Rescheduling between objects and running a
sleepable program inside ->show() are different properties, though, and
task_vma only has the first one. The open-coded task_vma iterator does not
have this problem since it hands out a snapshot of the VMA and holds no
lock when it returns to the program.
The vma handed to the program is only stable under mmap_lock, so the lock
can't be dropped around ->show(). Add a feature flag BPF_ITER_NOSLEEP for
targets which can't run sleepable programs although they can reschedule,
and set it for task_vma.
The check at attach time is not enough. BPF_LINK_UPDATE replaces the
program of a link, and bpf_iter_link_replace() only compares the type, the
attach type and the BTF id of the two programs, which are the same for a
sleepable and a non-sleepable one. Do the check there as well. That also
closes this way around the existing rule: so far a sleepable program could
be put on a link of a target that doesn't set BPF_ITER_RESCHED, like the
hash map element iterator, which runs it under rcu_read_lock().
BPF_LINK_CREATE of a sleepable program for the task_vma target, and
BPF_LINK_UPDATE to one, now fail with -EINVAL, also for programs that
don't touch user memory and have been working since sleepable iterator
programs exist. The programs can still be loaded. They have to be
loaded as non-sleepable programs, or use the open-coded iterator.
Fixes: b77fb25dcb34 ("bpf: Add support for bpf iterator programs to use sleepable helpers")
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261017163745.3341787-6-alexei.starovoitov@gmail.com
|
|
A sleepable program (e.g. SEC("syscall"), lsm.s, fentry.s) can pass a
callback to bpf_for_each_map_elem() on a hash map and call a sleepable
helper or kfunc such as bpf_copy_from_user() from it. The verifier
accepts this, but at run time the callback is invoked from inside an RCU
read-side critical section:
bpf_for_each_hash_elem()
rcu_read_lock();
callback_fn(map, key, val, ctx, 0);
bpf_copy_from_user() <- may fault and sleep
rcu_read_unlock();
bpf_each_rhash_elem() does the same for BPF_MAP_TYPE_RHASH. Sleeping
there triggers the "Voluntary context switch within RCU read-side
critical section!" warning, delays grace periods, and with
CONFIG_PREEMPT_RCU=n silently ends the read-side critical section that
the bucket walk relies on.
Synchronous callbacks are verified with the caller's state, so
kernel/bpf/verifier.c:in_sleepable_context() only looks at the program's
sleepability and the locks the program took itself, and does not know
that the helper holds rcu_read_lock() around the callback.
With a SEC("syscall") program whose callback reads a page that has to be
read from disk first:
BUG: sleeping function called from invalid context at include/linux/uaccess.h:169
RCU nest depth: 1, expected: 0
__might_fault+0x29/0x80
_copy_from_user+0x26/0x90
bpf_copy_from_user+0x23/0x60
bpf_prog_17d44fa39eebd6cc_cb+0x35/0x46
bpf_for_each_hash_elem+0xdb/0x280
Fix by marking the callback frame of hash map iteration as running under
RCU and making in_sleepable_context() false while such a frame is on the
call stack, so sleepable helpers, kfuncs and global functions are
rejected there as inside bpf_rcu_read_lock(). The rules for trusting RCU
protected pointers are left alone, which is conservative and keeps
callbacks that verify today and do not sleep working. The flag is
compared in func_states_equal() so that pruning never mixes the two
contexts. Array map callbacks run without any lock and keep the caller's
context.
Fixes: 314ee05e2fc6 ("bpf: Add hashtab support for bpf_for_each_map_elem() helper")
Fixes: 818e00848227 ("bpf: Implement iteration ops for resizable hashtab")
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261017163745.3341787-3-alexei.starovoitov@gmail.com
|
|
KVM keeps one vgic_irq per LPI. A MAPTI of an LPI whose vgic_irq
already exists reuses it for the new ITE and leaves its target vCPU as
it was. Mapping one LPI from two events is UNPREDICTABLE (IHI 0069H.b,
5.2.10), but nothing stops a guest from doing it. If the first MAPTI
names a collection the guest never maps and the second a mapped one,
the LPI translates through the second event with a NULL target vCPU.
When the VMM routes an assigned device's MSI to that event on a host
with GICv4 enabled, kvm_vgic_v4_set_forwarding() takes the vPE from the
NULL target vCPU and the host oopses:
Unable to handle kernel paging request at virtual address 0000000000001980
[...]
Call trace:
its_build_vmapti_cmd (drivers/irqchip/irq-gic-v3-its.c:943) (P)
its_irq_set_vcpu_affinity (drivers/irqchip/irq-gic-v3-its.c:1380)
irq_set_vcpu_affinity (kernel/irq/manage.c:670)
its_map_vlpi (drivers/irqchip/irq-gic-v4.c:326)
kvm_vgic_v4_set_forwarding (arch/arm64/kvm/vgic/vgic-v4.c:485)
kvm_arch_irq_bypass_add_producer (arch/arm64/kvm/arm.c:2977)
irq_bypass_register_consumer (virt/lib/irqbypass.c:44)
kvm_irqfd (arch/arm64/kvm/../../../virt/kvm/eventfd.c:496)
kvm_vm_ioctl (arch/arm64/kvm/../../../virt/kvm/kvm_main.c:5270)
Track in each vgic_irq whether an ITE maps it. Drop a MAPTI of an LPI
that is already mapped, as a failed MAPTI already is. Restoring the ITS
tables keeps the first ITE it reads for each LPI and drops any later
one, so a guest saved with a double mapping still restores. Key the
check on the mapping, not on the vgic_irq. A vgic_irq outlives its ITE
while anything holds a reference to it, such as the vCPU it was last
queued on. A later MAPTI of such an LPI succeeds as before, and now
retargets it to its collection.
Fixes: 196b136498b35 ("KVM: arm/arm64: GICv4: Wire mapping/unmapping of VLPIs in VFIO irq bypass")
Suggested-by: Marc Zyngier <maz@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
Reviewed-by: Oliver Upton <oupton@kernel.org>
Link: https://patch.msgid.link/20261013081646.933312-2-fuad.tabba@linux.dev
Signed-off-by: Marc Zyngier <maz@kernel.org>
|
|
Commit c436a624f89e ("ipv4: Pass netns to fib_table_lookup()") added the
network namespace as an argument of fib_table_lookup() so that it could
be passed to the fib_table_lookup tracepoint. However, the function is
called in the data path and the namespace is only needed when the
tracepoint is enabled, so the additional argument is unnecessary
overhead.
Instead, pass the namespace that is now stored in the FIB table to the
tracepoint. This way, the namespace is only read when the tracepoint is
enabled. Revert the signature of fib_table_lookup() and its callers to
what they were before the above commit. The tracepoint itself is
unchanged.
No functional changes intended.
Suggested-by: Paolo Abeni <pabeni@redhat.com>
Link: https://lore.kernel.org/netdev/43857d08-c4f4-44ce-a0b3-0e7fcc56bf90@redhat.com/
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Tested-by: Björn Töpel <bjorn@kernel.org>
Reviewed-by: Björn Töpel <bjorn@kernel.org>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20261014082612.1280756-3-idosch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
The next patch will stop passing the network namespace to
fib_table_lookup() and instead pass the namespace from the FIB table to
the fib_table_lookup tracepoint. As a preparation, store the namespace
in the FIB table when the table is created.
The FIB table structure grows from 48 bytes to 56 bytes and still fits
in a single cache line.
No functional changes intended.
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Tested-by: Björn Töpel <bjorn@kernel.org>
Reviewed-by: Björn Töpel <bjorn@kernel.org>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20261014082612.1280756-2-idosch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
phy_attach_direct() pins the PHY driver module through d->driver, and
phy_detach() releases it by reading d->driver again. Unbinding the PHY
driver while the PHY is attached clears that pointer, so a detach that
runs while the driver is still unbound skips the put and the module can
no longer be unloaded; if a different driver binds in between, the put
lands on a module that was never pinned. The NULL test added by
commit c2b727df7caa ("net: phy: Avoid NPD upon phy_detach() when driver
is unbound") avoids the oops but skips the put.
Found by reading phy_detach() while chasing a PHY driver unbind race on
a Keenetic KN-1012 (MT7981, air_en8811h built as a module). The leak
itself was not observed there: unbinding air_en8811h under the attached
lan4 DSA port and then unbinding the switch faults earlier on that
board, in phy_free_interrupt() or under phy_stop(), before
phy_detach() gets to the put.
Remember which module was pinned and release that one.
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
Link: https://patch.msgid.link/20261013151200.2473464-3-f@lex.la
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
Pull drm fixes from Dave Airlie:
"Last set of fixes, mostly amdgpu, some i915 and xe.
I think the dma-buf revert is probably the most important: while it is
technically correct the fallout from it means we shouldn't enable
DMABUF_DEBUG like that yet, and fix the fallout first.
Summary:
MAINTAINERS update
dma-buf:
- revert dma-debug y on debug kernel due to msm interaction
core:
- fix drm_exec prelocked object interaction
i915:
- Fix ARL-S host bridge detection
- Add sanity checks for malformed DMC firmware
xe:
- OA uAPI fix
- shrinker fix
- fix eviction of object with no bo resource
- fix LRU for external objects
amdgpu:
- UVD fix
- TTM sched entity fixes
- SMU 14 fix
- Userptr leak fixes
- Runpm ref count fix
- CRIU fix
- UserQ fixes
- USB4 fix
- SDMA 3 fix
virtio-gpu:
- revert double setting blend property
- reset device before deleting vqs on freeze
vc4:
- fix hdmi audio runtime_pm interaction
amdxdna:
- fix Kconfig invalid configuration
rocket:
- fix error path for failed init
- fix core unbinding and scheduler lookup paths
panthor:
- fix immortalis configuration"
* tag 'drm-fixes-2026-10-17' of https://gitlab.freedesktop.org/drm/kernel: (31 commits)
drm/amdgpu/sdma3: Work around POLL_REGMEM / FENCE hang
drm/amdgpu: keep the eviction fence until the last handle is closed
drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions
drm/amdgpu/userq: actually validate userq BOs
drm/amdgpu: report the BO alignment in bytes in GEM_LIST_HANDLES
drm/amdgpu: free the userptr ranges when a CS fails after parser_bos
drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr
drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl
drm/amd/pm: add zero fan stop temperature support on smu 14.0.2
drm/amdgpu: destroy mutex when tearing down ttm buffer entity
drm/amdgpu: fix sched entity leak in ttm buffer entity init
drm/amdgpu/uvd3.1: Fix checking whether UVD firmware keyselect was already set
drm/panthor: fix immortalis condition
drm/i915/cx0_phy: Fix ARL-S host bridge detection
drm/i915/dmc: Add sanity check for DMC load address
drm/i915/dmc: Harden DMC firmware payload parsing
drm/exec: don't immediately add prelocked obj to array of locked objs
drm/virtio: Reset device before deleting virtqueues on freeze
drm/xe: Bump LRU for external objects on exec and rebind
drm/xe/oa: Zero OA buffer at allocation
...
|
|
TCP request migration clones pending request sockets with
inet_reqsk_clone(). For MPTCP MP_JOIN requests this byte-copies
subflow_req->msk, but the clone does not own a reference.
The original and cloned requests can consequently drop the same msk
reference, leaving one request with a dangling pointer. This manifests as
a KASAN slab-use-after-free in subflow_req_destructor():
BUG: KASAN: slab-use-after-free in subflow_req_destructor (net/mptcp/subflow.c:45)
Write of size 4 at addr ff1100010e008d40 by task swapper/0/0
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.2.0-rc5-00353-gc27e36054537 #10 PREEMPT(full)
Call Trace:
subflow_req_destructor (net/mptcp/subflow.c:45)
subflow_v4_req_destructor (net/mptcp/subflow.c:694)
__reqsk_free (net/ipv4/inet_connection_sock.c:906)
reqsk_timer_handler (include/net/request_sock.h:137 net/ipv4/inet_connection_sock.c:1147)
Allocated by task 10014:
sk_prot_alloc (net/core/sock.c:2246)
sk_clone (net/core/sock.c:2488)
mptcp_sk_clone_init (include/net/sock.h:1848 net/mptcp/protocol.c:3564)
subflow_syn_recv_sock (net/mptcp/subflow.c:883)
tcp_check_req (net/ipv4/tcp_minisocks.c:934)
Freed by task 0:
slab_free_after_rcu_debug (include/linux/kasan.h:235 mm/slub.c:2677 mm/slub.c:6439)
rcu_core (kernel/rcu/tree.c:2645 kernel/rcu/tree.c:2897)
Last potentially related work creation:
kmem_cache_free (mm/slub.c:2638 mm/slub.c:6377 mm/slub.c:6504)
__sk_destruct (net/core/sock.c:2289 net/core/sock.c:2391)
sk_destruct (net/core/sock.c:2419)
__sk_free (net/core/sock.c:2430)
sk_free (net/core/sock.c:2441)
mptcp_close (include/net/sock.h:2020 net/mptcp/protocol.c:3399)
inet_release (net/ipv4/af_inet.c:442)
The buggy address belongs to the cache MPTCP of size 2968
The buggy address is 128 bytes inside a freed 2968-byte region
A non-NULL subflow_req->msk means that the request owns one reference. The
third ACK can concurrently transfer the original request reference to the
child and release it, so taking an unconditional hold on the copied pointer
is unsafe.
MPTCP sockets use SLAB_TYPESAFE_BY_RCU and all current inet_reqsk_clone()
callers run in an RCU read-side critical section. Document and
lockdep-check that calling-context requirement. Read the pointer from the
original request and acquire a reference only if it is still live. Use
refcount_inc_not_zero_acquire() so the subsequent ownership validation
cannot be reordered before the try-get, then re-read the original request
to verify that it still owns the same msk. If either check fails, clear the
clone pointer; otherwise its normal destructor balances the new reference.
Mark the ownership-transfer store with WRITE_ONCE() to match the lockless
reads.
The following patch completes the clone fixup for MP_CAPABLE token
ownership. Both patches carry the same Fixes tag and are required for
stable backports.
Fixes: c905dee62232 ("tcp: Migrate TCP_NEW_SYN_RECV requests at retransmitting SYN+ACKs.")
Cc: stable@vger.kernel.org
Reported-by: Kyle Zeng <kylebot@openai.com>
Reported-by: David Lee <david.lee@trailofbits.com>
Reported-by: Vega <vega@nebusec.ai>
Closes: https://lore.kernel.org/all/20260804095051.715355-1-david.lee@trailofbits.com/
Signed-off-by: Ruide Cao <caoruide123@gmail.com>
Signed-off-by: Ren Wei <weir@nebusec.ai>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20261013-net-mptcp-misc-fixes-7-3-rc8-v1-3-932c9b182fc7@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
