| Age | Commit message (Collapse) | Author |
|---|
|
do_listns() and do_listns_userns() take the last namespace id the caller
saw and look up the first namespace after it by searching the rbtree for
last_ns_id + 1. With U64_MAX that wraps around to zero and the search
returns the namespace with the smallest id. So a cursor at the largest
possible id restarts the listing from the beginning instead of failing
with ENOENT like a cursor of U64_MAX - 1 does. That's the case for the
unified tree, the type-specific trees and the owner tree alike.
No namespace will ever have that id. They come from a counter and a
caller that only feeds back ids it got from us can't hit this. It's
still wrong.
Instead of adding one to the cursor and searching for the smallest id
that's greater or equal make the lookup helpers search for the smallest
id that's strictly greater than the cursor. That's what both callers
want anyway and there's nothing left to overflow.
Reproducer, unprivileged:
#define _GNU_SOURCE
#include <errno.h>
#include <stdint.h>
#include <stdio.h>
#include <sys/syscall.h>
#include <unistd.h>
#ifndef __NR_listns
#define __NR_listns 470
#endif
#define CLONE_NEWUSER 0x10000000U
#define LISTNS_CURRENT_USER 0xffffffffffffffffULL
struct ns_id_req {
uint32_t size, spare;
uint64_t ns_id;
uint32_t ns_type, spare2;
uint64_t user_ns_id;
};
static void list(const char *tree, uint32_t type, uint64_t owner,
uint64_t cursor)
{
struct ns_id_req req = {
.size = sizeof(req), .ns_id = cursor, .ns_type = type,
.user_ns_id = owner,
};
uint64_t ids[8];
long ret;
errno = 0;
ret = syscall(__NR_listns, &req, ids, 8, 0);
printf("%s cursor %llu: ret %ld errno %d", tree,
(unsigned long long)cursor, ret, errno);
for (long i = 0; i < ret && i < 3; i++)
printf("%s%llu", i ? "," : " ids ", (unsigned long long)ids[i]);
printf("%s\n", ret > 3 ? ",..." : "");
}
int main(void)
{
static const uint64_t cursors[] = { 0, UINT64_MAX - 1, UINT64_MAX };
for (int i = 0; i < 3; i++)
list("unified", 0, 0, cursors[i]);
for (int i = 0; i < 3; i++)
list("userns", CLONE_NEWUSER, 0, cursors[i]);
for (int i = 0; i < 3; i++)
list("owner", 0, LISTNS_CURRENT_USER, cursors[i]);
return 0;
}
Before, on 7.3.0-rc7-00252-g4e3259b08c54 (vfs.fixes) in a VM:
unified cursor 0: ret 8 errno 0 ids 1,2,3,...
unified cursor 18446744073709551614: ret -1 errno 2
unified cursor 18446744073709551615: ret 8 errno 0 ids 1,2,3,...
userns cursor 0: ret 1 errno 0 ids 3
userns cursor 18446744073709551614: ret -1 errno 2
userns cursor 18446744073709551615: ret 1 errno 0 ids 3
owner cursor 0: ret 8 errno 0 ids 1,2,4,...
owner cursor 18446744073709551614: ret -1 errno 2
owner cursor 18446744073709551615: ret 8 errno 0 ids 1,2,4,...
After:
unified cursor 0: ret 8 errno 0 ids 1,2,3,...
unified cursor 18446744073709551614: ret -1 errno 2
unified cursor 18446744073709551615: ret -1 errno 2
userns cursor 0: ret 1 errno 0 ids 3
userns cursor 18446744073709551614: ret -1 errno 2
userns cursor 18446744073709551615: ret -1 errno 2
owner cursor 0: ret 8 errno 0 ids 1,2,4,...
owner cursor 18446744073709551614: ret -1 errno 2
owner cursor 18446744073709551615: ret -1 errno 2
Reported-by: shaos <shawnq1@163.com>
Link: https://lore.kernel.org/r/20261020110732.959552-1-shawnq1@163.com
Fixes: 76b6f5dfb3fd ("nstree: add listns()")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261021-work-mount-statmount_listns_fixes-v1-5-8917a4c1bd14@kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux
Pull pwm updates from Uwe Kleine-König:
"The usual mix of fixes for older issues, devicetree changes and
cleanups.
Part of this is a shared branch that introduces device-managed
variants of atomic_notifier_chain_register() and
blocking_notifier_chain_register()"
* tag 'pwm/for-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux:
dt-bindings: pwm: Add IPQ5210 binding
pwm: tiehrpwm: Clear period on disable to allow reconfiguration
pwm: Allow 32-bit tasks to use the character device
pwm: lp3943: fix NULL pointer dereference for an unconfigured channel
pwm: mtk-disp: Fix period readback
pwm: ipq: Prevent potential 32-bit integer overflow in hi_div calculation
pwm: loongson: Reload PWM configuration through counter reset
pwm: Fix typos in comments
dt-bindings: pwm: Convert TI PWM Subsystem to DT schema
docs: pwm: Fix bracket and punctuation
pwm: iqs620a: Use devm_blocking_notifier_chain_register()
pwm: renesas-tpu: Fix runtime PM reference leak
notifier: add device-managed registration APIs
|
|
Creating a child partition can fail when tasks are present in its
descendants, even though the parent has no tasks of its own.
On a cgroup v2 system with CPUs 0-7 online:
cd /sys/fs/cgroup
echo +cpuset > cgroup.subtree_control
mkdir A
echo 1-2 > A/cpuset.cpus
echo root > A/cpuset.cpus.partition
echo +cpuset > A/cgroup.subtree_control
mkdir A/B
echo 1-2 > A/B/cpuset.cpus
echo +cpuset > A/B/cgroup.subtree_control
mkdir A/B/C
echo 1-2 > A/B/C/cpuset.cpus
echo $$ > A/B/C/cgroup.procs
echo root > A/B/cpuset.cpus.partition
cat A/B/cpuset.cpus.partition
root invalid (Parent unable to distribute cpu downstream)
cat A/cpuset.cpus.effective
1-2
B should be a valid root, leaving A with an empty effective CPU list.
The task in C belongs to B's partition and does not need CPUs in A.
partition_is_populated() is called with B as excluded_child, but
continue only skips B in the pre-order walk. The walk still visits C
and finds the task there, so A is considered populated.
Fix this by skipping the whole excluded subtree with
css_rightmost_descendant(), as is already done for valid child
partitions. Also add a test case to test_cpuset_prs.sh with a task in
a grandchild cpuset.
Fixes: b1bcaed1e39a ("cpuset: Treat cpusets in attaching as populated")
Cc: stable@vger.kernel.org # v6.19+
Signed-off-by: Guopeng Zhang <zhangguopeng@kylinos.cn>
Reviewed-by: Waiman Long <longman@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
|
|
|
|
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core
Pull driver core updates from Danilo Krummrich:
"Core:
- Add TAINT_FORCED_BIND to taint the kernel and driver module before
manual sysfs bind/unbind operations; make add_taint_module()
available to driver core and update taint decoding tools and
documentation
- Constify device_show/store_*() attribute parameters and adapt x86
MCE and perf users to prepare for const dev_ext_attribute instances
- Fix UAF in NUMA access node registration failure handling by
dropping the device reference with put_device() instead of directly
freeing the node
debugfs:
- Make debugfs_create_str() read-only to eliminate double-free races
between concurrent writers; reject writable modes; convert
interconnect and SoundWire users to local file operations with
mutex-protected strings
kobject:
- Fix out-of-bounds access in kobject_action_type() when parsing
action strings containing embedded NUL bytes
- Fix the kobject_set_name() reference in kset_register() kernel-doc
Rust:
- DMA:
- Tie Coherent, CoherentBox and CoherentHandle to the device's
bound lifetime to prevent retaining DMA allocations beyond
driver unbind; propagate the lifetime through nova-core and the
DMA sample driver
- I/O:
- Require explicit base types for registers and replace relative
registers with typed subregion projections; reimplement
register!() as a proc macro, support registers using existing
types without inline bitfields, and convert nova-core, Tyr and
the PCI sample; add AsRepr/AsReprMut and transmute helpers with
deferred size checks for representation conversions
- Wrap ResourceSize in a transparent newtype with explicit
conversions, including checked conversion to usize
- PCI:
- Add typed PCIe extended capability lookup and SR-IOV accessors
for the First VF Offset and decoded VF BAR addresses and widths,
keeping raw SR-IOV registers private to preserve PCI core
ownership of their state
- scatterlist:
- Honor the device's maximum segment size as well as the DMA
mapping limit when constructing SG tables
- Return u32 from SGEntry::dma_len() to match the C segment length
type
- misc:
- Validate auxiliary DeviceId name length explicitly to improve
compile-time diagnostics for oversized device ID table entries
- Drop unnecessary 'static bounds from debugfs ScopedDir file
creation methods to support data containing non-'static
references, including DMA buffers
Misc:
- Add Johan Hovold as driver core maintainer
- Simplify platform_device_alloc() by returning early on allocation
failure
- Fix typos in driver core and kernfs comments"
* tag 'driver-core-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: (41 commits)
rust: pci: add extended capability and SR-IOV support
kobject: Fix the kobj_set_name reference in kset_register() kernel-doc
rust: io: convert ResourceSize into a transparent newtype
rust: scatterlist: return u32 from SGEntry::dma_len()
MAINTAINERS: add myself as driver core maintainer
debugfs: make debugfs_create_str() read-only
soundwire: debugfs: replace writable string helper
interconnect: debugfs: replace writable string helper
docs: admin-guide: Handle TAINT_FORCED_BIND when parsing /proc/sys/kernel/tainted
driver core: platform: Simplify platform_device_alloc()
kobject: fix out-of-bounds access in kobject_action_type()
rust: scatterlist: honor the device's maximum segment size
driver core: add TAINT_FORCED_BIND for when userspace manually messes with devices and drivers
module: fix up documentation for add_taint() and add_taint_module()
module: pull out add_taint_module() to be public
driver core: Constify the signature of device_show/store_*()
drivers: perf: Use __DEVICE_ATTR() macro to initialize dev_ext_attribute
x86/mce: Use __DEVICE_ATTR() macro to initialize dev_ext_attribute
rust: auxiliary: validate DeviceId name length
driver core: fix typos in comments
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull power management updates from Rafael Wysocki:
"This time, the most visible part are the ACPI CPPC updates from
Christian Loehle, including CPPC cpufreq driver changes, even though
updates of cpufreq drivers proper are still the largest topic group.
However, the updates of cpufreq drivers depend on the ACPI CPPC
updates, so they should really be counted together and that is well
over 1/2 of the total commit count.
Interestingly enough, almost all of the updates included here are
fixes or cleanups, with some new feature support in the amd-pstate
cpufreq driver and IPQ9650 support in the qcom-nvmem cpufreq driver.
The runtime PM documentation improvements from Brian Norris can also
be mostly regarded as fixes, but a new kunit test goes along with
them.
Specifics:
- Fix multiple issues related to input validation, synchronization,
access safety, memory layout and register field validation, and
error handling in the ACPI CPPC library (Christian Loehle and Sumit
Gupta)
- Select the frequency-invariance callback per CPU in the CPPC
cpufreq driver and create the FIE worker before enabling PCC
callbacks in it to avoid queueing work through a missing worker and
dereferencing a NULL pointer (Christian Loehle)
- Update the CPPC cpufreq driver entry in MAINTAINERS and add a new
entry for the ACPI CPPC library (Christian Loehle)
- Minor fixes in various cpufreq drivers (Alexander Koskovich, Daniel
Schwierzeck, Frank Zhang, Haotian Zhang, Kathiravan Thirumoorthy,
Sumeet Pawnikar, and Xueqin Luo)
- Fix wrong behaviors on multi-node servers in the Loongson cpufreq
driver (Huacai Chen)
- Reject NULL from cpufreq_cpu_get() in the Rust code (Mehmet
Koseoglu)
- Add suspend OPP to mediatek cpufreq driver and DT (Ryan Brue)
- Fixups for a few bugs identified by Sashiko in the amd-pstate
cpufreq driver (Mario Limoncielloi, Wentao Guan)
- Initial support for maximum frequency capacity handling on Zen6
client in amd-pstate (Mario Limonciello)
- Fix for amd-pstate-ut with 'Requested CPU Min frequency' BIOS
option (K Prateek Nayak)
- New Zen6 tuning values for EPP in amd-pstate (Mario Limonciello,
Vishal Badole)
- amd-pstate documentation fix (Karl Mehltretter)
- Restrict deferred downscaling to low load for shared policies in
the conservative cpufreq governor to avoid undesirable CPU
frequency reduction in some cases (Shengming Hu)
- Serialize sugov_start() against rate limit updates in the schedutil
cpufreq governor to avoid using a stale rate limit value (Hui Su)
- Prevent cpuidle governors menu and teo from returning idle state 0
after it has been disabled (Xueqin Luo)
- Replace min_t() with the better alternatives in the intel_idle
driver and make it use 2-argument strscpy() (Andy Shevchenko)
- Fix two repeated phrase instances in cpuidle (Hemanth Selam,
Syazwina Fazrul)
- Add rugged Panther Lake support to the intel_rapl power capping
driver and make it use %pe for printing error pointers (Srinivas
Pandruvada and Sumeet Pawnikar)
- Update and improve runtime PM documentation and add a kunit test
for supplier idle/suspend (Brian Norris)
- Add a pm_runtime_dont_use_autosuspend() call to pm_runtime_reinit()
to ensure autosuspend disabling on driver teardown (Joshua Crofts)
- Ignore page-zero RAM in E820 checksum during hibernation on x86 to
avoid rejecting images created after kexec() (Matthias Goergens)
- Add resume event mapping for PMSG_POWEROFF to the PM core to allow
it to carry out device shutdown in the future (Mario Limonciello)
- Add DPM watchdog to prepare/late/early/noirq/complete phases of
device suspend and resume (Mayank Rungta)
- Update swsusp.txt references to swsusp.rst in hibernation
documentation (Li Jun)
- Fix use-after-free of perf domain in netlink doit handlers for
energy models (Fan Wu)
- Add synchronize_rcu() back to cpu_pm_unregister_notifier() after it
was removed inadvertently in previous development cycles to avoid
use-after-free (Bradley Morgan)
- Unregister CPU PM notifier outside the timer lock in the
timer-ti-dm clocksource driver (Bradley Morgan)
- Fix typo "sucessfully" in a comment in pm_clk_add_clk() kerneldoc
comment and typo "hierachy" in a comment in pm-graph (Hemanth
Selam)
- Fix the return value in dev_pm_opp_get_of_node() kernel-doc (Karl
Mehltretter)"
* tag 'pm-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (89 commits)
cpufreq: loongson3: Replace IOCSR read/write with MMIO ones
cpufreq: loongson3: Use global physical CPU ID in get/target callbacks
cpufreq: loongson3: Replace per-package mutex with per-node
cpufreq: loongson3: Adjust the width of id and val in smc_message
cpufreq: loongson3: Make this driver depend on MACH_LOONGSON64
PM: runtime: Expand introduction with core concepts and structure
cpufreq: schedutil: Serialize sugov_start() against rate limit updates
MAINTAINERS: ACPI: Add a separate CPPC entry
MAINTAINERS: cpufreq: Replace CPPC reviewer
arm64: dts: mediatek: mt8173: Mark the lowest CPU OPPs for suspend
cpufreq: mediatek: Enter system sleep at the suspend OPP
cpufreq: qcom-cpufreq-hw: fix device node refcount leak in phandle parsing
cpufreq: qcom-nvmem: Add IPQ9650 support
cpufreq: Add Milos to cpufreq-dt-platdev blocklist
cpufreq: Use %pe to print error pointers symbolically
rust: rcpufreq_dt: add module alias
cpufreq: sti: avoid NULL dereference in dev_err()
cpufreq: tegra194: fix double-pointer error in get_cpu_ndiv
cpufreq: sparc-us2e: fix frequency table index copy-paste error
rust: cpufreq: reject NULL from cpufreq_cpu_get()
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull VDSO updates from Thomas Gleixner:
"Updates for the VDSO subsystem:
- Ensure that the CLOCK_AUX base calculations are properly scaled
against the base timekeeper. The update function failed to take the
fractional nanosecond part into account, which results in a
rounding error.
- Cleanup and consolidate the vsyscall headers to get rid of
pointless copies all over the architectures.
- Replace a runtime conditional in the time getter function for
namespaced clocks by simple pointer arithmetic which speeds up the
read function"
* tag 'timers-vdso-2026-10-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
vdso/vsyscall: Keep the CLOCK_AUX base scaled
vdso/math64: Add and use __iter_div64_u64_rem()
vdso/math64: Use OPTIMIZER_HIDE_VAR() in __iter_div_u64_rem()
vdso/gettimeofday: Avoid runtime conditional in do_hres_timens()
vdso: Remove __ASSEMBLER__ guards from vsyscall.h
vdso: Add asm-generic/vdso/vsyscall.h
vdso: Remove unnecessary vdso/vsyscall.h includes
riscv/hwprobe: Include vdso/datapage.h
arm64/vdso: Delete asm/vdso/vsyscall.h inclusions
x86/vdso: Delete asm/vdso/vsyscall.h inclusions
sparc/vdso: Delete asm/vdso/vsyscall.h inclusion
s390/vdso: Delete asm/vdso/vsyscall.h inclusions
sparc/vdso: Move __VDSO_PAGES to asm/vdso.h
x86/vdso: Move vDSO page definitions to asm/vdso.h
vdso: Delete asm-generic/vdso/vsyscall.h
vdso/vsyscall: Define fallback time synchronization functions in vsyscall.c
vdso/getrandom: Define fallback __arch_get_vdso_u_rng_data() in getrandom.c
vdso/gettimeofday: Define fallback __arch_get_vdso_u_time_data() in gettimeofday.c
vdso: Move the kernel-side time update helpers to a new header
|
|
Automatic topology packing starts a new shard before adding a core when
the current shard would exceed its target size. However, a first core is
always accepted so that cores remain indivisible. An indivisible core with
more than SCX_CID_SHARD_MAX_CPUS CPUs cannot be represented without
exceeding the hard shard limit.
Per-shard state uses fixed-size inline cmask storage sized for
SCX_CID_SHARD_MAX_CPUS. Passing an oversized shard to alloc_pshard() can
therefore make cmask initialization overwrite the following fields.
Reject an indivisible core larger than SCX_CID_SHARD_MAX_CPUS before adding
it to a shard. Existing non-empty shard splitting already keeps the total
within the hard cap, while an indivisible core may still exceed
cid_shard_size when it fits within the hard limit.
Report the oversized core and the hard limit with scx_error() so that the
rejection is diagnosable.
tj: The bug is only reproducible with artificial VM topologies. It can't
happen on real hardware.
Fixes: e2c841b91bf9 ("sched_ext: Add CID sharding")
Reviewed-by: Andrea Righi <arighi@nvidia.com>
Tested-by: Andrea Righi <arighi@nvidia.com>
Signed-off-by: Hui Su <sh_def@163.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull NOHZ updates from Thomas Gleixner:
"Updates for the tick/NOHZ machinery:
- Add the BLOCK_SOFTIRQ to the hotplug safe local softirq pending
mask to prevent false positive error messages. A BLOCK_SOFTIRQ can
be pending when a CPU goes offline as the subsequent cleanup will
take care of the outstanding completions.
- Remove a few redundant invocations of local_irq_save/restore() and
timekeeping_max_deferment() to speed up the NOHZ idle transitions"
* tag 'timers-nohz-2026-10-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
tick/nohz: Avoid unused timekeeping_max_deferment() calls
tick/nohz: Remove redundant local_irq_save()/restore()
tick/nohz: Add BLOCK_SOFTIRQ to the hotplug safe mask
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull timer core updates from Thomas Gleixner:
"Updates for the core timekeeping and timers subsystem:
- Futher cleanups for the POSIX timer exit/exec related code to
simplify the code flow and to make it more robust against future
changes.
- Prevent tearing of timekeeper::ktime_sec which can be accessed
without the sequence count protection.
The timekeeper is updated by memcpy() with an uneven sequence count
to force readers into the retry path. On 64-bit machine the
ktime_sec member can be accessed atomically without the sequence
count protection. That is only correct when the update side
memcpy() guarantees atomicity at the 64-bit granularity. That's not
guaranteed due to debug options, compilers and instruction
availability. If the memcpy() does not provide the atomicity then
the unprotected readers can observe store tearing.
To prevent this write the ktime_sec member before the memcpy() so
that a non-atomic memcpy() will write the same data. A similar fix
has been done for the xtime_sec member, but the ktime_sec
equivalent was missed.
- Prevent time64_to_tm() day truncation on 32-bit kernels
The function receives a 64-bit seconds value but stores the
quotient of the computation in a long, which truncates the result
for large input values. Cure this by using div_s64_rem() which
stores the quotient in s64 and only leaves the seconds-within-day
reminder in a long, which is guaranteed to fit. This fix comes with
a corresponding kunit test to prevent further mishaps.
- Mark data-racy accesses to the hrtimer_sleeper::task member.
The recent updates to KCSAN flagged these benign races. Annotate
them with new helper functions, convert all existing usage sites
and mark the task member private after that so that future users
which fail to use the helpers can be detected automatically.
- Address similar benign KCSAN flagged issues in the hrtimer, timer
and timer migration code.
- Fixes for a few selftest issues"
* tag 'timers-core-2026-10-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (26 commits)
selftests/timers: clocksource-switch: Fix unchecked open()/read()
selftests: timers: Measure the CPU timers on the clock they count
selftests: timers: Count what tick is worth in the drift estimate
time/kunit: Add time64_to_tm() case beyond 32-bit day count
time: Prevent time64_to_tm() day truncation on 32-bit
timekeeping: Use READ_ONCE/WRITE_ONCE() for ktime_sec to prevent tearing
timers/migration: Mark racy updates to tmigr_event::ignore field
timers: Mark racy updates to hlist_node::pprev field
hrtimer: Apply READ_ONCE() to lockless base->running loads
hrtimer: Mark the hrtimer_sleeper structure's ->task field __private
hrtimer: Update hrtimer_resolution only if value changes
futex: Use accessor for hrtimer_sleeper ->task field in requeue
rtmutex: Use accessor for hrtimer_sleeper ->task field
net: pktgen: Use accessor for hrtimer_sleeper ->task field
timers: Use accessor for hrtimer_sleeper ->task field in sleep_timeout.c
futex: Use accessor for hrtimer_sleeper ->task field in waitwake.c
io-uring/rw: Use accessor for hrtimer_sleeper ->task field
wait: Use accessor for hrtimer_sleeper ->task field
aio: Use accessor for hrtimer_sleeper ->task field
hrtimer: Mark data-racy accesses to hrtimer_sleeper ->task field
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull irq chip driver updates from Thomas Gleixner:
"Updates for interrupt chip drivers:
- Remove the futile attempts to cleanup resources when the probing of
the main interrupt chip fails for SiFIVE/PLIC devices. If that
probe fails the system will stall immediately afterwards in the
boot process without reaching a state where the error could be
diagnosed. The lack of resource cleanup led to a frenzy of AI
detected/assisted "fixes" which just make the code pretend to be
correct for no value.
Remove the existing half baked cleanup and immediately panic the
machine when the probe fails. That's far more useful than letting
it proceed and stall out a millisecond later with no information
about the root cause.
- A series of fixes for the ARM GIC-V3 driver addressing a potential
double free, a bitmask overrun on 32-bit ARM and a OF node leak.
- Automatically set the IRQ_DOMAIN_FLAG_DESTROY_GC when a interrupt
domain is created that also allocates the generic interrupt chip
during domain creation. That removes the requirement for manually
setting the flag in the domain creation info structure when it
contains a valid entry for allocating the generic interrupt chip.
Remove the therefore redundant setters of
IRQ_DOMAIN_FLAG_DESTROY_GC in the existing drivers.
- Add support for Annapurna Labs FIC version 2 and 3 and implement
affinity control for the demultiplexed interrupts by utilizing the
recently merged interrupt redirection infrastructure.
- Convert the ACPI device ID structures to named initializers
- Consolidate the IPI related constants for RISC-V interrupt
controllers
- Add support for Qualcomm Purwa SoC interrupt chip and consolidate
the workaround for the previous version in Hamoa SoCs.
- The usual small fixes and improvements all over the place"
* tag 'irq-drivers-2026-10-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (61 commits)
irqchip/al-fic: Support per-child affinity via interrupt redirection
irqchip/al-fic: Add support for FIC v3
irqchip/al-fic: Support error and fatal outputs and FIC v2
dt-bindings: interrupt-controller: amazon,al-fic: Add mask selection
irqchip/al-fic: Switch to shared parent interrupt
irqchip/al-fic: Keep the device_node instead of a cached name string
irqchip/al-fic: Use %pOF and raise init log level
irqchip/al-fic: Use %pe to print init error
irqchip/al-fic: Fix coding style issues
irqchip: Use named initializers for acpi_device_id
irqchip/gic-v5: Fix standalone IRSes OF probe
dt-bindings: interrupt-controller: gicv5: Relax IRS properties constraints
irqchip/renesas-rzv2h: Preserve TIEN state in rzv2h_tint_set_type()
irqchip/loongson-eiointc: Use pa_to_nid() rather than hard-code
irqchip/riscv-imsic: Expose the fwnode via the global config
irqchip/meson-gpio: Allow the GPIO interrupts to wake the system
irqchip/gic-v3: Ensure change to DS is visible
irqchip/mips-gic: Transfer interrupt mask state across clusters
irqchip/mips-gic: Fix recursive acquisition of gic_lock in gic_set_affinity()
irqchip/mips-gic: Fix unbalanced cm_core_lock in for_each_online_cpu_gic()
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull irq updates from Thomas Gleixner:
"Updates for the generic interrupt subsystem:
- Skip programming of MSI/MSI-X related data while a PCI channel is
offline (Link is down) in the error recovery code path. Accessing
an offline channel results in a BUS error which affects the
underlying Root Port.
Check for pci_channel_offline() and if true avoid the writes and
just cache the modifications which are subsequently applied when
the Link has recovered.
- Prevent a stack UAF when a faulting interrupt thread exits. On X86
the crash causes the stack to be discarded, which contains the
callback head for the exit task_work to run the destructor. If the
stack is clobbered before the destructor runs, then the indirect
call of the task work function ends up in a random place. Move the
callback head into the interrupt action to prevent that.
- Prevent an UAF in the interrupt thread exit code which can happen
when a faulting interrupt thread exits and races with a concurrent
free_irq() by synchronizing free_irq() against thread exit.
- Ensure that interrupt context accounting is accurate on interrupt
return when checking for soft interrupt invocation.
The code removed the hard interrupt context prematurely so that the
subsequent code appeared to be in task context according to the
preempt counter. That confuses ftrace, perf and K*SAN which get
their recording context wrong. On Preempt-RT this can result in
misbehaviour when BPF programs are attached to the affected region.
Cure it by preserving the hard interrupt count up to the point
where soft interrupts are actually invoked and switch directly to
soft interrupt processing right there. That avoids the intermediate
"in task context" state.
- The usual small fixes and improvements"
* tag 'irq-core-2026-10-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
genirq/proc: Fix missing CPU header in /proc/interrupts
PCI/MSI: Skip MSI/MSI-X programming while the channel is offline
genirq: Fix typos in comments
genirq: Move interrupt thread exit_work object to irqaction
genirq: Defer kfree(irqaction) until irq_thread_dtor() finishes
softirq: Preserve interrupt context on return from interrupt
softirq: Remove redundant h->action from preempt_count mismatch error
genirq: Discard cpumask of irqaffinity= boot parameter if parsing fails
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu
Pull CSD lock updates from Paul McKenney:
"Report CSD-lock stall recovery time:
- Refactor to simplify csd_lock_wait_toolong() function prototype
- Report time required to recover from a CSD-lock stall
- Add a test of this reporting"
* tag 'csd-lock.2026.10.12a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu:
lib/test_csd_lock: Add a module to stall a CPU on a CSD lock
locking/csd-lock: Report how long a stuck CSD lock took to recover
locking/csd-lock: Pack csd_lock_wait_toolong() state into a struct
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux
Pull Kbuild / Kconfig updates from Nathan Chancellor:
"Kbuild:
- Suppress compiler flags in debug info for external module builds
- Use '-fmacro-prefix-map' in more places in the build
- Merge initial set of changes from Lorenzo's speed up series, along
with some fixes found through testing:
- Avoid allocating .modinfo in vmlinux
- Speed up kallsyms by indexing symbols by token and outputting
binary data to disk directly then including in assembly via
.incbin
- Don't sort $(NM) output when unnecessary
- Only emit relocations on the final vmlinx link
- Reimplement mksysmap in C
- Move many cc-option and ld-option calls into the Kconfig stage to
cache their results
- Use pigz for gzip compression when available
- Move gen_init_cpio and gen_initramfs.sh from usr/ to scripts/
- Add a TOML configuration to scripts/container and update
documentation accordingly
- Add a generic, opt-in mechanism for checking that headers can
compile standalone
- Update machine function splitting argument for LLVM 24 rename in
AutoFDO build
- Miscellaneous minor clean ups, fixes, and hardening, mostly
found/fixed via LLMs
Kconfig:
- Turn recursive ranges into an error
- Fix savedefconfig for defaults that were adjusted for being out of
range and revert a previously applied workaround
- Improvements and hardening around integer and hexadecimal values
- Emit a warning when selecting or implying a choice symbol, which
has no effect
- Emit a warning when KCONFIG_PROBABILITY is malformed
- Introduce def_string / def_int / def_hex to mirror the existing
def_bool / def_tristate to succinctly set a value and type at the
same time.
- Add cc-option-str and ld-option-str macros to act like Kbuild's
cc-option and ld-option, returning the string when the option is
supported, allowing many checks to be moved into Kconfig
- Minor usability improvements to Kconfig tests"
* tag 'kbuild-7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux: (59 commits)
kbuild: AutoFDO: Update split machine function argument for upstream rename
kbuild: Mark the initcall ordering recipe as recursive
kbuild: Mark the gzip recipes as recursive
localmodconfig: Explicitly report boolean configs during integrity check
scripts/make_fit: Ignore schema checks when decomposing DTBs
clang-tools: Import os for broken pipe handling
kconfig: use the value argument in sym_get_near_range_bound()
kconfig: fix infinite loop in conf_choice() when no choice value is visible
kconfig: cleanup stale comment about 'keys' array
kconfig: Improve ergonomics around disabling warnings with cc-option
scripts/Kconfig.toolchain: Drop compiler symbols from dependencies
checkkconfigsymbols.py: Parse Git status output line by line
gen_init_cpio: stop parsing on lines with a missing argument list
.gitignore: drop Module.markers
.gitignore: ignore pacman package signatures
kbuild: add header check facility as a manually run static analyzer
Documentation: dev-tools: refer to user ID rather than id
Documentation: dev-tools: update container.rst with config file
scripts: add TOML config to container tool
kconfig: tests: {old,save}defconfig: Forward dynamic keyword arguments
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux
Pull RCU updates from Paul McKenney:
"Execution contexts and call_rcu() and call_srcu():
- Make call_rcu() and call_srcu invocable from NMI handlers and while
holding scheduler locks (using irq-work handlers)
- Add rcutorture and BPF tests calling these functions from these
contexts
- Disable rcutorture overload testing for RCU readers that are
"fragile", that is, that do not either disable preemption or have
some form of RCU priority boosting
SRCU updates:
- Add an atomic SRCU where readers run with preemption disabled and
grace periods can be invoked from atomic contexts. David Woodhouse
has a patch series exploiting this for GPC
- Add torture and lockdep tests for atomic SRCU
- Add numerous optimizations for atomic SRCU based on the fact that
it does not have callbacks, for example, eliminating any transition
to "big" srcu_struct structures even on systems that configure
these to happen at initialization time
Additional torture-test updates:
- Fix a divide-by-zero bug in forward-progress testing
- Synchronously wait for all IRQ-queued callbacks to complete
- Allow alternative "ssh" commands to be specified for use by
kvm-remote.sh
- Fix kvm-again.sh re-run failure on PowerPC
- Add additional lockdep testing for atomic SRCU
- Fix error double-counting in srcu_lockdep.sh
- Add atomic SRCU cross-CPU IRQ context mismatch testing, with the
- trick being that the atomic SRCU readers context must be at least
as strict as that of the atomic SRCU grace-period wait. So for
example, if the readers have IRQs disabled, so must the
grace-period wait
Miscellaneous updates:
- Update stallwarn.rst documentation for the re-implementation of RCU
Tasks Trace in terms of SRCU
- Fix the lazy-callback shrink scanner budget computation so that it
honors the reclaim budget
- Avoid panicking on RCU CPU stalls that end before the warning can
be printed
- Add "running" and "boosted" indications to the RCU task stall
warning output
- People have been (incorrectly) relying on rcu_barrier() to wait for
kfree_rcu() callbacks and processing. But it turns out to be easier
to fix rcu_barrier() to meet their expectations than to fix their
code to live within the earlier rcu_barrier() specification. So
rcu_barrier() now waits on kfree_rcu() callbacks and processing
- Disable RCU Tasks console output that track when this RCU flavor
switches between per-CPU and global callback queuing. New use cases
appeared that generated enough console traffic to cause trouble,
and no one seemed to care about these messages. For those needing
those messages, there is a new rcupdate.rcu_task_collapse_debug
kernel boot parameter
- Fix __rcu pointer attribute handling to eliminate false positives
- Fix typos and drop redundant #include directives"
* tag 'rcu.2026.10.12b' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux: (46 commits)
rcutorture: Add atomic SRCU cross-CPU IRQ context mismatch test
selftests/rcutorture: Fix double nerrs count in srcu_lockdep.sh
selftests/rcutorture: Wire atomic SRCU into srcu_lockdep.sh
rcutorture: Add atomic SRCU lockdep support
rcutorture: Fix kvm-again.sh re-run failure on ppc64
torture: Allow specifying alternative ssh command to kvm-remote.sh
rcutorture: Synchronously wait for all rcu_torture_irq() callbacks to complete
rcutorture: Fix divide-by-zero with fwd_progress_div=1
srcutree: Preserve IRQ state in synchronize_srcu_atomic() callchain
srcutiny: Add lockdep and early-boot checks to synchronize_srcu_atomic()
srcutree: Add lockdep and early-boot checks to synchronize_srcu_atomic()
srcutree: Skip torture to-big transition for atomic SRCU
srcutree: Don't transition atomic SRCU to big in srcu_gp_end()
srcutree: Make init_srcu_struct_atomic() prevent transition to big
srcu: Restrict atomic-SRCU non_block annotation to task context
srcutree: Remove srcu_barrier() sleep for atomic SRCU
srcutree: Skip callback scheduling for atomic SRCU grace periods
srcutree: Add reader-free fastpath to synchronize_srcu_atomic()
rcutorture: Add atomic-SRCU support to torture.sh
srcutree: Explicitly note DEFINE_SRCU() needs for srcu_barrier()
...
|
|
With proxy execution, __schedule() can call set_next_task_scx() with
SNT_REPICK and then SNT_PICK for the same donor. Both calls queue the
kick_sync balance callback while kick_sync_pending remains set.
When the callback is the only list entry, its next pointer is NULL, so
the existing duplicate check misses it. Queueing it again links it to
itself and causes the wait to run twice.
Also check whether the callback is already the head of the list to
reject the second insertion.
This covers the kick_sync callback because nothing else is queued
between SNT_REPICK and SNT_PICK. Requeueing the tail of a longer list
remains possible and is outside the scope of this fix.
Fixes: e2859566ffbc ("sched_ext: Queue the kick_sync wait from set_next_task_scx()")
Reported-by: Tejun Heo <tj@kernel.org>
Link: https://lore.kernel.org/r/08cac02c604dd73ef96fc92eb29d692b@kernel.org
Signed-off-by: Andrea Righi <arighi@nvidia.com>
Acked-by: Tejun Heo <tj@kernel.org>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Tejun Heo <tj@kernel.org>
|
|
A prog with unwind_goto or unwind_exit has to be JITed by a JIT that
supports them. The driver JITs an offloaded prog, and nobody looks at
jit_required there.
nfp rejects unwind_goto in nfp_verify_insn(). netdevsim takes everything.
Nothing runs such a prog, but it's not jited for bpf_insn_prepare_dump(),
which takes unwind_goto for BPF_CALL_ARGS and shows it as a call.
Fixes: a2d274771321 ("bpf: Add unwind_goto and unwind_exit insns")
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261020231942.2568163-3-alexei.starovoitov@gmail.com
Closes: https://lore.kernel.org/bpf/sashiko-outbox-179499@kernel.org/
|
|
Representation
--------------
Represent ALU32 recurrences as:
w0 += step -> (zext32 (linear r0 step))
Extend simplify() rules to maintain the above form for latch
expressions. E.g. for a post-condition loop such as:
w0 = 0;
l: w0 += 1;
if w0 != 3 goto l;
exit;
SCEV at header: (zext32 (linear r0 1))
Initial SCEV at latch: (zext32 (+ (zext32 (linear r0 1)) 1))
Simplified SCEV at latch: (zext32 (+ (zext32 (linear r0 1)) 1))
-> (zext32 (+ (linear r0 1) 1))
-> (zext32 (linear (+ r0 1) 1))
Iterations count computation
----------------------------
- Extract the main iteration-count logic from compute_max_iters() into
compute_backedge_taken_count(). Reuse its 64-bit arithmetic after
sign/zero extending the latch operands.
- Reject the computed count if the predicted exit value falls outside
signed/unsigned 32-bit range, e.g.:
w0 = 0x7ffffffe;
l: w0 += 1;
if w0 s<= 0x7fffffff goto l;
The 64-bit computation predicts an exit at S32_MAX + 1, but the
32-bit value wraps to S32_MIN and the comparison remains true.
- Handle mixed 64-bit/32-bit comparisons/recurrences only when initial
bounds and step fit in 32-bit ranges, e.g.:
w0 = 0;
r1 = 0x100000003 ll;
l: w0 += 1;
if r0 != r1 goto l;
Truncating the bound to 32 bits would predict three header visits.
However, `w0 += 1` keeps r0 within [0, U32_MAX], so it can never
be equal to the 64-bit bound.
Widened bounds computation
--------------------------
- Update linear_bounds() to truncate the initially computed 64-bit
range to 32 bits, then zero-extend it to obtain the 64-bit range
of iteration values. Step computation needs to handle:
- unsigned 32-bit wraparound;
- entry and zero-extended iteration values disagreeing on base/step.
- Union both ranges with the corresponding register ranges at entry,
since the entry value need not be zero-extended.
- Extend `struct bounds` to keep both {32,64}-bit ranges and pass both
to bpf_set_reg_range(). A 64-bit range alone loses useful 32-bit
information, e.g.:
entry = 0, step = -1, two header visits
r64: [0, U32_MAX]
r32: [-1, 0]
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261020-scev-32bit-v1-1-838f34f9f0cd@gmail.com
|
|
This is long over-due: the __get_user() and __put_user() functions are
entirely historical, and are never the rigth thing to use any more. And
when mis-used (read: every case) they are not only slower than the right
thing, but also insecure because they don't check the user address
range.
Most of the usage sites have been converted long ago, but various
left-overs remained. So this started out as a single patch that I wrote
as a "show people how to convert __{get,put}_user() to modern code".
In particular, Thomas last year implemented the very nice new scoped
user access region helpers (see commit e497310b4ffb: "uaccess: Provide
scoped user access regions") that makes the modern interfaces
particularly easy to use and really removes any excuse for the old
horrors.
That small example patch then grew to this, partly using Claude as a
glorified coccinelle script to apply the pattern to other places.
There were a few different reasons for using __put_user() and
__get_user() rather than the alternatives, but the original historical
one was performance: when doing multiple accesses off the same base
pointer, doing a single range check followed by multiple non-checked
accesses used to create smaller and faster code.
The keyword here is "used to". It hasn't been true for years, because
the range check isn't actually the real cost these days. The real cost
of user accesses on modern hardware is turning the user accesses on and
off in the first place (on x86, using the STAC/CLAC instructions).
Those sequences get turned into 'scoped_user_read_access() { }' blocks,
see for example that first patch in the series: "signal: use scoped user
access for old-style sigaction".
Another, historical reason for using __get_user() and friends is that
you actually want to do a kernel pointer access, but the pointer might
not be entirely reliable (typically during fault handling), so you want
to have exception handling for the kernel access.
The modern way to do that kind of non-faulting kernel access is using
"get_kernel_nofault()", but some code predates that helper existing at
all, and used __get_user() as a way to just get a memory access with
exception handling. For that pattern, see for example "alpha: use
get_kernel_nofault() in dik_show_code()"
A third bad reason for using __get_user() and friends was that the
proper get_user() had a "might_fault()" in it, and code that ran in
atomic regions but hadn't disabled page faults would result in a
warning. That kind of code needs to explicitly disable page faults,
because "atomic region" is not well defined at run-time and can be
invisible (eg a preempt-off region in a non-preemptible kernel).
See "vdpa_sim: disable page faults around vringh_need_notify_iotlb()"
for an example of that pattern, where the local_bh_disable() now also
grows a pagefault_disable(), which makes the normal get_user() no longer
warn about the user access in non-process context, because it can see
that the potential page fault will not cause problems.
And finally, the really nasty reason to use __get_user() and friends:
pointers that can be either kernel pointers or user pointers. We've
gotten rid of almost all such cases, but a couple remained. See for
example "x86/sev: Use explicit user-or-kernel accessors for #VC memory
operands".
NOTE! This series removes all __get/put_user() calls from generic code
but only does the final removal of the whole interface on x86. Other
architectures have not been entirely converted, for a variety of reasons:
- arm64 makes __{get,put}_user() be exactly the same as
{get,put}_user() so it's harmless and didn't have the dangers of the
legacy use cases.
- any architecture that uses <asm-generic/uaccess.h> will still use
__{get,put}_user as the underlying helper function name
- several architectures had some legacy uses that weren't entirely
trivial and I didn't want to extend this patch series to things that
I don't know and that don't really matter.
but I did do a couple of the obvious "follows the exact same pattern"
just because it could be done mindlessly and automatically.
Let's see if I broke anything, but we should have done this years ago.
* uaccess-cleanups: (48 commits)
drm/i915/gem: ignore errors on presumed_offset write-back
powerpc/align: use get_user_instr() for a user-mode instruction
powerpc/signal64: use scoped user access in setup_trampoline()
powerpc/signal64: use get_user() for the single context reads
powerpc/signal32: use get_user() for the single context reads
KVM: PPC: Book3S HV: use get_user()/put_user() for the HPT fd
powerpc/powernv: use get_user()/put_user() in the LPC debugfs files
s390: use get_user()/put_user() instead of the unchecked variants
ARM: OABI: use scoped user access in epoll_put_uevent()
ARM: signal: stop using __put_user() for the signal frame
ARM: signal: check the FDPIC function descriptor address
alpha: split the prefetch check in do_page_fault() by mode
openrisc: use get_kernel_nofault() in show_registers()
alpha: use get_kernel_nofault() in dik_show_code()
nios2: use scoped user access for the signal frame
nios2: check the signal frame address before writing to it
hexagon: use scoped user access for the signal frame
alpha: use scoped user access when setting up signal frames
alpha: use scoped user access in the sigreturn path
alpha: use scoped user access in osf_sigaction()
...
|
|
A shutdown callback in a loadable module may need to distinguish a
kexec reboot from a normal restart, halt, or poweroff. The Hyper-V
VMBus driver needs this distinction when moving its kexec cleanup into
a common syscore shutdown callback.
Add kexec_is_in_progress() and export it to GPL modules so the callback
can remain guarded when VMBus is built as a module. Provide a false
inline implementation when CONFIG_KEXEC_CORE is disabled.
The helper reports only the normal kexec reboot path. Crash kexec and
preserve-context kexec do not set this state.
Signed-off-by: Shradha Gupta <shradhagupta@linux.microsoft.com>
Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Reviewed-by: Michael Kelley <mhklinux@outlook.com>
Reviewed-by: Bradley Morgan <brads@mainlining.org>
Reviewed-by: Naman Jain <namjain@linux.microsoft.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm
Pull lsm updates from Paul Moore:
- Add LSM hooks, object blobs, and audit records for namespaces
Add the necessary bits to enable LSMs to enforce access controls on
the management of various kernel namespaces. While this pull request
does not contain any in-tree users of these hooks, the Landlock pull
request for Linux v7.4 will include Landlock support and the next
merge window will likely include SELinux support as well. Considering
the development behind these hooks, I expect that BPF LSM developers
will also be making use of the namespace hooks, if they haven't
already.
- Update the inode LSM hooks to include mount idmaps
This allows LSMs to incorporate the mount ID mapping into their
access control decisions. While there are no current in-tree users of
this, it was requested by those developing BPF LSM programs and this
pull request includes a BPF LSM selftest.
- Preserve the full 32-bit ioctl command in LSM audit records
Previously only the low 16 bits were logged, ignoring the direction
and size information in the upper 16 bits. The pull request also
includes a Landlock based selftest to verify the full 32-bit ioctl
value.
- Ensure we don't call security_backing_file_free() multiple times
Thankfully we don't have a problem with the current code base, but we
want to fix this behavior now before it becomes a problem.
- Clarify that only the current task may access current->cred
The current code is a bit misleading around safely accessing the cred
field in a task struct. Through comment and code corrections, this
pull request clarifies that only the task itself may access its cred
field.
- Add SLAB_NO_MERGE to the credential object cache
Harden the credential cache by ensuring credential objects live on
dedicated slab pages.
- Make use of safe memory zero'ing in the LSM Rust bindings
- Update the docs for the current behavior of /sys/kernel/security/lsm
- Update the docs for CONFIG_LSM and the "lsm=" command line option
- Remove unnecessary code
* tag 'lsm-pr-20261016' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm:
lsm: remove redundant NULL check in security_init()
selftests/landlock: Check full ioctl commands in audit records
lsm: Preserve full ioctl commands in audit records
doc: fix LSM ordering description for /sys/kernel/security/lsm
doc: describe CONFIG_LSM and lsm= as the selection mechanism
selftests/bpf: verify mount idmaps reach inode hooks
lsm: expose mount idmaps to inode hooks
rust: lsm: replace `core::mem::zeroed` with `pin_init::zeroed`
cred: prevent slab cache merging for cred_jar
lsm: don't call security_backing_file_free() multiple times
lsm: delete duplicate assignment in lsm_prepare()
lsm: update the BUILD_BUG_ON() in audit_log_lsm_data()
lsm: add LSM_AUDIT_DATA_NS for namespace audit records
lsm: add LSM blob and hooks for namespaces
ns: Free anonymous mount namespaces via ns_common_free()
cred: clarify that task_struct::cred is only for the current task
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit
Pull audit updates from Paul Moore:
- Fix the accounting of audit filter rule additions and removals
Tracking audit filter rules is important as their presence can
trigger additional processing. Unfortunately, the existing code did
not properly track the removal of filter rules, resulting in some
cases where additional processing was done when none was required.
This not only corrects the accounting problems, but also provides a
cleaner API for tracking audit filter rule additions and removals.
- Add a FSOPEN record to log the filesystem name in the new mount API
Close a long standing audit blindspot by capturing the filesystem
name, e.g. "tmpfs", when calling fsopen().
- Split audit's storage of process and file capabilities
Instead of a single structure that stores all possible capability
information, create a dedicated audit file capabilities struct and
convert the existing audit capabilities struct into a process
capabilities struct. This saves 80 bytes from the per-task
audit_context on 64-bit systems.
- Ensure that the PROCTITLE record is reset on exec()
This fixes a problem where systemd would set a temporary PROCTITLE
string after forking a child process before calling exec(),
effectively locking the PROCTITLE string to the temporary value. This
pull request resets the PROCTITLE state on exec() so that newly
executed processes can set their PROCTITLE correctly.
- Add some missing unlikely() annotations to the audit wrapper
functions
- Clean up the audit netlink multicast skb length adjustment
* tag 'audit-pr-20261016' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
audit: add FSOPEN record to log filesystem name
audit: separate file and process capability storage
audit: Fix filter rule accounting after automatic removal
audit: use copied skb length in kauditd_send_multicast_skb()
audit: add missing unlikely hint to audit_dummy_context() wrappers
audit: free proctitle in context so it can be re-set by fork on exec_binprm
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull perf events updates from Ingo Molnar:
- Support SIMD/eGPRs/SSP register sampling in perf
(Dapeng Mi, Kan Liang)
- Turn amd_uncore_ctx events into a flexible array (Rosen Penev)
- Finish the work related to fixing the guest PEBS path to not
set unwanted PERF_GLOBAL_CTRL bits, for which urgent fixes
are upstream already (Sean Christopherson)
- Drop redundant counter slot searches in the AMD uncore
driver (Usama Arif)
- Don't WARN when the ext_regs_buf allocation fails (vineash)
- Annotate x86_pmu::hybrid_pmu with __counted_by_ptr (Thorsten Blum)
* tag 'perf-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (34 commits)
perf/x86: Don't WARN when the ext_regs_buf allocation fails
perf/x86/amd/uncore: Free counter slot by index
perf/x86/amd/uncore: Remove redundant event slot scan
perf/x86/intel: Check only PMC bits in PEBS_ENABLED when detecting host PEBS usage
KVM: VMX: Only tell perf to enable PEBS counters for fully enabled PMCs
KVM: VMX: Drop a redundant pmu->global_ctrl check when processing pebs_enable
perf/x86/intel: KVM: Handle cross-mapped PEBS PMCs entirely within KVM
perf/x86: KVM: Have perf define a dedicated struct for getting guest PEBS data
perf/x86/intel: Invert names of intel_ctrl_{guest,host}_mask
perf/x86/intel: Annotate x86_pmu::hybrid_pmu with __counted_by_ptr
perf/x86/amd/uncore: Turn amd_uncore_ctx events into a flexible array
perf/x86/intel: Add sanity check for PEBS record/fragment size
perf/x86: Activate back-to-back NMI detection for arch-PEBS induced NMIs
perf/x86/intel: Advertise PERF_PMU_CAP_SIMD_REGS capability
perf/x86/intel: Support arch-PEBS based SIMD/eGPRs sampling
perf/x86: Support SSP sampling using sample_regs_* fields
perf/x86: Support eGPRs sampling using sample_regs_* fields
perf: Enhance perf_reg_validate() with simd_enabled argument
perf/x86: Support OPMASK sampling using sample_simd_pred_reg_* fields
perf/x86: Support ZMM sampling using sample_simd_vec_reg_* fields
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull locking updates from Ingo Molnar:
- In the refcount checking code, BUG() on UAF related errors if
CONFIG_BUG_ON_DATA_CORRUPTION=y (Jann Horn)
- Add {over,under}flow detection for local_interrupt_{enable,disable}()
(Boqun Feng)
- Add kunit test case for max local_interrupt_disable() nesting level
(Boqun Feng)
- Clarify comment (Boqun Feng)
* tag 'locking-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
irq: Add max local_interrupt_disable() nesting level kunit test case
irq: Explain better on NMI_MASK overflow condition
irq: Add {over,under}flow detection for local_interrupt_{enable,disable}
refcount: Use CONFIG_BUG_ON_DATA_CORRUPTION for UAF-related errors
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull scheduler updates from Ingo Molnar:
"Kconfig updates:
- Simplify PREEMPT_DYNAMIC (Mark Rutland)
Fair scheduler updates:
- Remove redundant RUN_TO_PARITY check (Elif Topuz)
- Declare augmented callbacks per field, fix
rb_add_augmented_cached() descent (Yiwei Lin, Peter Zijlstra)
- Restart fair hrtick after same-task repicks (Shubhang Kaushik)
- Improve the scheduling latency of short slice tasks (Vincent
Guittot)
Deadline/RT scheduler updates:
- Check start_dl_timer expiry with ktime_before() (Liang Hao)
- irq_work: CPU-hotplug improvements on PREEMPT_RT (Sebastian Andrzej
Siewior)
Energy-aware scheduling updates:
- Implement the steal_governor, introduce preferred CPUs and
steal-driven vCPU backoff (Shrikanth Hegde)
Multi-processor load-balancing updates:
- Enable preferred SMT siblings on NVIDIA Olympus (Andrea Righi)
- Randomize equally shallow idle CPU picks (Christian Loehle)
- Remove redundant core_sched_seq (Hui Su)
Cache-aware scheduling updates:
- Avoid publishing partial LLC utilization (Jemmy Wong)
NUMA-balancing updates:
- Reset NUMA fault locality after scan period update (Eric Kim)
Proxy execution updates:
- Ongoing work to implement sleeping owner handling for proxy
execution (John Stultz, Vasily Gorbik)
- Preparatory steps to make sched_ext compatible with proxy execution
(Andrea Righi)
Scheduler infrastructure updates & fixes:
- Remove the RCU wait from PSI trigger destruction (Shakeel Butt)
- Avoid modifying wait-entry on failed priority registration
(Hui Su)
- Use the new static key API for sched_feat (Hongyan Xia)
- Convert paravirt_steal to new static key APIs (Hongyan Xia)
- cputime: Don't account idle time twice after dyntick-idle
(Stian Halseth)
Scheduler debugging updates:
- Set TIF_NEED_RESCHED before calling __trace_set_need_resched()
(Sechang Lim)
- Fix context analysis errors in non-preferred CPU push (Shrikanth
Hegde)
Misc cleanups and fixes by Christian Loehle, Shubhang Kaushik,
Thomas Huth and Vladimir Zapolskiy"
* tag 'sched-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (64 commits)
sched: Replace nr_iowait_cpu() with a bool accessor
Revert "sched/fair: Remove dead code on enqueue_task_fair()"
sched/cache: Avoid publishing partial LLC utilization
sched/cputime: Don't account idle time twice after dyntick-idle
sched/psi: Remove the RCU wait from trigger destruction
sched/eevdf: Remove redundant RUN_TO_PARITY check
sched/wait: Avoid modifying entry on failed priority registration
rbtree_test: Use rb_add_augmented_cached() for the cached augmented test
rbtree: Update augmented data on the way down in rb_add_augmented_cached()
rbtree: Declare augmented callbacks per field with RB_AUG()
rbtree_test: Use rb_add() and rb_add_cached() for the basic tests
smpboot: Don't park the thread if work is pending
irq_work: Flush lazy work CPU down on PREEMPT_RT
irq_work: Update a comment regarding CPU hotplug invocation
sched/topology: Add asymmetric SMT packing override
sched/fair: Honor asymmetric SMT priority in idle selection
sched: Set TIF_NEED_RESCHED before calling __trace_set_need_resched()
sched/core: Fix context analysis errors in non-preferred CPU push
virt/steal_governor: Enable the driver
virt/steal_governor: Implement steal_governor policy loop
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 kdump update from Dave Hansen:
"Some kdump code is using NR_CPUS_DEFAULT as if it were the actual,
in-use max number of CPUs. Move it over to use NR_CPUS instead.
I suspect this one being in-tree for a few years means that the vast
majority of kdump users are on distro kernels that don't drop NR_CPUS
below the defaults"
* tag 'x86_kdump_for_7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
crash: Update stale NR_CPUS_DEFAULT references in elfcorehdr sizing docs
x86/crash: Reserve elfcorehdr for CONFIG_NR_CPUS, not CONFIG_NR_CPUS_DEFAULT
|
|
Rust Drop, C++ destructors and __attribute__((cleanup)) in C have to run
when a panic or an exception passes through a frame.
v1 [1] did it with a flag in r3 and 'if r3 != 0 goto pad' after the call.
Three bugs that the bots found there had the same cause: r3 is an ordinary
register, and JITs guessed the meaning from the shape of the code.
Kumar suggested new insns instead [2]:
unwind_goto pad BPF_JMP | BPF_JCOND, src_reg = BPF_UNWIND_GOTO
unwind_exit BPF_JMP | BPF_EXIT, src_reg = BPF_UNWIND_EXIT
'call foo; unwind_goto pad' goes to the pad when foo left with unwind_exit
and falls through when it left with exit. No register says which one it
was. In everything else unwind_exit is exit.
llvm lowers unwinding to them [3]:
ret exit
invoke foo unwind pad call foo; unwind_goto pad
resume r0 = 0; unwind_exit
call _Unwind_RaiseException r0 = 0; unwind_exit
invoke _Unwind_RaiseException goto pad
In a function that returns 16 bytes it's 'r0 = 0; r2 = 0; unwind_exit'.
Landing pads are ordinary blocks, so the verifier checks them like any
other code. A pad that forgets to drop a lock or a reference is a leak on
that path. There are no tables, no stack walk, no kfuncs, no BTF and
nothing to do for libbpf and other loaders.
In the verifier:
- unwind_goto has to follow a call or callx of a subprog and cannot be
a jump target. For cfg, liveness and the rest it's one more conditional
jump, like may_goto.
- How the callee left is one bit of the verifier state. It lives from
the exit of the callee to the next insn. states_equal() looks at it,
since the registers can be the same either way.
- unwind_exit is rejected when unwind_goto doesn't follow the call.
- A global subprog that has unwind_exit can leave either way. Both are
explored after the call, like it's done for might_throw.
- A sync callback cannot unwind. The helper that calls it doesn't expect
that: bpf_loop() would go on.
- unwind_exit of the main prog is exit, unless it's an extension. So it is
in async and exception callbacks. The kernel calls them, and there is no
frame to unwind to.
- An extension leaves either way, like the subprog that it replaced.
freplace is a jump, so the extension returns to the caller of
the subprog. An extension that has unwind_exit can replace only a subprog
that has it too. Otherwise there is no unwind_goto after the calls.
- Of tracing progs only fentry can attach to a subprog or an extension
that has unwind_exit. It would return to the trampoline that called it.
- unwind_exit changes its return address, so the cpu mispredicts
the return and runs what follows unwind_goto speculatively. Without
CAP_PERFMON the verifier looks at that path too.
- unwind_goto goes away together with a pad that turned out to be dead
code. It stays when what follows it is dead code. The cpu predicts that
the callee returns there, so 'goto pc-1' takes the place of the dead
code. Otherwise its removal would move other code there.
JITs don't emit a branch:
unwind_goto:
extable[n++] = { ret_addr - 1 -> pad }
unwind_exit:
my_ret_addr = bpf_unwind_target(my_ret_addr)
epilogue
So exit and the normal path after the call cost nothing. Every frame fixes
only its own return address. There is no stack walk. The lookup is what
the page fault handler does for bpf progs.
The interpreter cannot do that, so the prog has to be JITed, and JITs opt
in with bpf_jit_supports_unwind(). x86-64 and arm64 are in the next
patches.
BPF_JCOND is the same opcode as BPF_CALL_ARGS of the interpreter, and
BPF_UNWIND_GOTO is the same number as BPF_PSEUDO_CALL. may_goto is gone by
the time a prog is dumped, unwind_goto is not. bpf_insn_prepare_dump()
tells them apart: a prog with unwind_goto is always JITed.
Compared to v1 there is no BTF decl_tag and no 'r3 = 0' before every exit.
Tail call and ld_abs are fine in a subprog that can unwind, since they
leave it like exit does.
unwind_exit doesn't set r0. An implicit definition of r0 would need
special cases in backtracking, in liveness and in the check of the return
value of the main prog. A plain 'r0 = 0' in front of it needs none.
Rust
rust-bpf [4] builds with that llvm as it is. The programs are built with
-C panic=unwind. The panic handler prints the message and calls
_Unwind_RaiseException().
exc_cleanup.rs panics three frames deep, with preemption disabled in one
frame and rcu_read_lock held in another. All Drop impls run and the prog
returns 0.
scx_simple.rs is 2195 insns with 48 unwind_goto, 20 of them after callx,
and 16 unwind_exit. With r3 it was 2216 insns. scx_cosmos.rs is 3694 insns
with 68 and 18. It was 3716.
C++
Exceptions work too. This compiles, loads and runs:
struct rcu_guard {
rcu_guard() { bpf_rcu_read_lock(); }
~rcu_guard() { bpf_rcu_read_unlock(); }
};
static __noinline int inner(int len)
{
rcu_guard guard;
if (len > 100)
throw 1;
return len;
}
SEC("tc") int prog(struct __sk_buff *skb)
{
try {
return inner(skb->len);
} catch (...) {
return 42;
}
}
It returns 64 for a packet of 64 bytes and 42 for a packet of 200 bytes.
The destructor runs in both cases, otherwise the verifier would reject
the prog. 'throw' is a jump to the pad with the destructor. 'catch' is
unwind_goto:
inner:
w6 = w1
call bpf_rcu_read_lock
if w6 s< 101 goto ret
r1 = exc_obj ll
*(u32 *)(r1 + 0) = 1
goto pad
ret:
call bpf_rcu_read_unlock
w0 = w6
exit
pad:
call bpf_rcu_read_unlock
r0 = 0
unwind_exit
prog:
w6 = *(u32 *)(r1 + 0)
w1 = w6
call inner
unwind_goto catch
out:
w0 = w6
exit
catch:
w6 = 42
goto out
It needs -fexceptions -funwind-tables and four one line __cxa_*()
functions, where __cxa_throw() calls _Unwind_RaiseException().
Every pad is entered whatever was thrown, so llvm takes catch (...) only.
It's a selftest in patch 5.
[1] https://lore.kernel.org/bpf/20261018010246.1643877-1-alexei.starovoitov@gmail.com/
[2] https://lore.kernel.org/bpf/DM7KR7J8VY2T.1CZIRUF6QRCWG@gmail.com/
[3] https://github.com/llvm/llvm-project/pull/233649
[4] https://github.com/4ast/rust-bpf
Suggested-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261020181320.1284798-2-alexei.starovoitov@gmail.com
|
|
maybe_queue_balance_callback() clears SCX_RQ_BAL_CB_PENDING when it
queues the deferred callback. Proxy resolution can then zap the callback
without running it, leaving the deferred actions unscheduled until a
later wakeup or deferred request.
Use the existing irq_work fallback for dispatch-time deferred requests
when proxy execution is enabled. This keeps the work scheduled even if
proxy resolution retries the pick or falls back to idle, without relying
on another SCX dispatch to restore a discarded callback.
Fixes: a8ad873113d3 ("sched_ext: defer queue_balance_callback() until after ops.dispatch")
Reported-by: Tejun Heo <tj@kernel.org>
Link: https://lore.kernel.org/r/08cac02c604dd73ef96fc92eb29d692b@kernel.org
Signed-off-by: Andrea Righi <arighi@nvidia.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
Pull arm64 updates from Catalin Marinas:
"Here are the arm64 updates for 7.4.
The more interesting bits are the removal of big-endian kernel support
(already marked BROKEN for some time), preemptible this_cpu_*()
operations and MPAM support for the firmware-backed (Fb) interface.
CCA (Arm's confidential compute) is slowly trickling in with host RMI
(Realm Management Interface) support and some refactoring, including a
dedicated SMCCC bus to advertise firmware services. There are also the
usual PMU updates for new hardware and a few fixes/cleanups.
Core features:
- Remove big-endian kernel support: CONFIG_CPU_BIG_ENDIAN has
depended on BROKEN for a while, so drop the remaining code (BE
hypervisor object, BPF JIT, assembly/crypto/library routines,
endianness helper macros, selftests) and force a little-endian
build
- Add preemptible this_cpu_*() operations (read/write, RMW, xchg,
cmpxchg and cmpxchg128) that no longer need to disable preemption
around the per-CPU address generation and access
- Preparation patches for implementing CONFIG_HOTPLUG_PARALLEL on
arm64
Memory management:
- Treat faults taken by EFI runtime firmware as kernel faults
- Clear PTE_WRITE for EFI_MEMORY_RO mappings (with hardware dirty
state management enabled, this is not truly read-only)
- Raise the default ARCH_MMAP_RND_BITS for 48-bit and 52-bit VA
configurations (28/26/24 bits for 4K/16K/64K pages)
- Implement clear_page[s]() using memset()
- Enable BBML2 no-abort (a.k.a. BBML3) for the NVIDIA Rigel CPU
Perf and PMU:
- Support for HiSilicon's ITS PMU
- Add support for some new events: INST_SIMD_ALU_VEC for Apple PMUs
and a cycle counter for the latest version of HiSilicon's MN PMU
hardware
- A bunch of fixes to the CXL PMU driver to address pre-existing
issues from Sashiko
- Fix generation of PERF_RECORD_ITRACE_START records for SPE and ETM
drivers
- Reduce excessive stack consumption in the Marvell DDR PMU driver
- Minor driver updates and cleanups all over
Arm Confidential Compute Architecture (CCA):
- Add an Arm SMCCC bus for firmware services discovered through SMCCC
and move the TRNG and CCA guest (TSM provider) drivers onto it,
removing the dummy CCA platform device and adding a sysfs ABI for
Realm guests
- Move the Realm Service Interface (RSI) code out of arch/arm64/ into
drivers/firmware/arm_rmm/
- Add the host side of the Realm Management Interface (RMI): detect,
configure and activate the RMM, add SRO support and wrappers for
the Realm RMI commands
- Block hibernation (new arch hook in the PM core) and kexec while
the RMM is active. To be revisited in the future with proper
support for deactivation
- Handle Granule Protection Faults (GPFs) taken by the host, caused
by accesses to memory delegated to the RMM. In a future patch, the
exception table lookup will be limited to is_kdump_kernel() cases
MPAM (Memory Partitioning And Monitoring):
- Add support for the MPAM firmware-backed (Fb) interface, allowing
MSC accesses to be mediated by firmware
- Fix a list of theoretical issues with the driver (MSC access error
propagation, MBWU monitor save/restore and locking, resctrl class
handling, error interrupt restore, maximum number of PARTIDs)
- Add the mailing list and a missing file to the MAINTAINERS entry
- Document when to set arm64.nompam
Errata and CPU features:
- Add the NXP i.MX8QM/8QP workaround for the Cortex-A53 cache
coherency issue (ERR050104), using a new ARM64_CPUCAP_SOC_ERRATUM
capability type for SoC-level errata
Miscellaneous:
- Mask debug exceptions (DAIF) around the hardware breakpoint
register manipulations when called from generic kernel code
- Don't zero the SVE state buffer when the SVE state is live
- Return -EPERM instead of -EBUSY from the GCS prctl() locking
failures (matching x86), with the selftest updated. Slight ABI
change but no software deployment yet
- kselftest: fix unsound MTE fault skipping by introducing MTE-safe
memory accessors, avoid copying each signal test binary more than
once
- Update sysreg definitions (fix three enum values and two field
names, mark architecturally dropped fields as RES0) and remove the
TME transaction state check from the BRBE driver
- Fix the description of ARM64_HAS_LPA2 and remove a redundant
ID_AA64MMFR0 define"
* tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: (144 commits)
arm64: cpufeature: Enable BBML2 for NVIDIA Rigel
arm64: cputype: Add NVIDIA Rigel definitions
arm64: raise default ARCH_MMAP_RND_BITS for 48-bit and 52-bit VA
arm64/debug: mask debug exceptions when called from common code
kselftest/arm64: signal: copy each test binary only once
kselftest/arm64: Check for -EPERM not -EBUSY in the locking test
arm64: gcs: Return -EPERM not -EBUSY for prctl() locking failures
perf: arm_brbe: Remove the check for TME transaction states
arm64: sysreg: Mark fields the architecture dropped as RES0
arm64: sysreg: Fix the names of two misspelt fields
arm64: sysreg: Fix three incorrect enum values
arm64: smp: Defer RCU registration during secondary CPU bringup
arm64: smp: Don't bother printing the I-cache policy for each CPU
arm64: smp: Defer update of secondary CPU capabilities
arm64: smp: Tidy up cpuinfo init and cpufeature updates
arm64: smp: Tidy up smp_prepare_cpus()
arm64: cpufeature: Store every ID register with its overrides applied
arm64: cpufeature: Read MPAMIDR_EL1 in __cpuinfo_store_cpu()
arm64: cpufeature: Add read_cpuid_with_overrides()
arm64: cpufeature: Check arm64_ftr_regs[] before the first store
...
|
|
With favordynmods enabled, a cgroup.procs migration takes the target
threadgroup's cgroup_threadgroup_rwsem for writing. A process fork holds
the forking threadgroup's semaphore for reading. These are different
semaphores when fork creates a new process.
copy_process() publishes the child's PID before cgroup_post_fork() links
the child to its css_set. A writer can find the child in that interval,
take its uncontended semaphore, and migrate it while child->cgroups still
points to init_css_set and child->cg_list is empty. Migration links the
node into init_css_set.mg_tasks. cgroup_post_fork() then adds the same
node to the intended css_set as though it were unlinked, corrupting both
task lists and their css_set ownership.
This regresses the fork/migration race fixed by commit b12b533fa523
("cgroups: add lock for child->cgroups in cgroup_post_fork()") and
restored again in 2012 after the lock had been removed. The old task_lock
protection was later superseded by global css_set and cgroup threadgroup
locking. The change identified by the Fixes tag narrowed only the migration
side back to a per-threadgroup lock, recreating the different-process
exclusion failure.
Take the new threadgroup's semaphore for reading before the child becomes
visible and hold it through cgroup_post_fork(). Use a nested lock subclass
because fork already holds the parent's semaphore. CLONE_THREAD children
share the parent's signal_struct and remain covered by the existing lock.
Migrations of unrelated, fully initialized threadgroups remain concurrent.
An AI coding assistant was used to identify and reproduce the regression
and to develop and test this fix.
Fixes: 0568f89d4fb8 ("cgroup: replace global percpu_rwsem with per threadgroup resem when writing to cgroup.procs")
Cc: stable@vger.kernel.org # 6.18+
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
|
|
MM CID switches to per-CPU ownership when the number of users of an mm
exceeds the maximum number of CIDs. When the affinity union grows, the
per-CPU threshold is recalculated and the MM can switch back to per-task
ownership through deferred work.
mm_cid_calc_pcpu_thrs() incorrectly uses min(nr_cpus_allowed, users) to
calculate that switch-back threshold. This makes pcpu_thrs no larger than
users, so the users < pcpu_thrs check in mm_update_cpus_allowed() can never
succeed.
For example, with three users restricted to two CPUs, the MM enters per-CPU
mode. On an eight-CPU system, widening the affinity union to all eight CPUs
should produce a threshold of four, but the old calculation produces three
and returns early. The MM therefore remains in per-CPU mode even though the
widened CPU set makes per-task ownership preferable.
Calculate pcpu_thrs from nr_cpus_allowed directly. The users bound in
__mm_update_max_cids() still controls when per-CPU mode is entered, so this
does not change the threshold calculated when switching from per-task to
per-CPU ownership.
Tested with an x86_64 QEMU reproducer using three users, an initial two-CPU
affinity, and an eight-CPU affinity expansion. The baseline does not invoke
mm_cid_work_fn() after the affinity expansion. The fixed kernel invokes the
deferred work once and completes the switch back to per-task mode.
Fixes: fbd0e71dc370 ("sched/mmcid: Provide CID ownership mode fixup functions")
Signed-off-by: Hui Su <sh_def@163.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260915155953.2856524-1-sh_def@163.com
|
|
CPU hotplug migration leaves pending_map bits set on the outgoing CPU
while its wheel vectors are empty. After re-online, a later next_expiry
recalc can treat those empty buckets as pending and temporarily pull
next_expiry forward until collect drains the bits.
Clear pending_map under the base lock after migration in timers_dead_cpu().
Fixes: 500462a9de65 ("timers: Switch to a non-cascading wheel")
Signed-off-by: Liang Hao <haohlliang@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260930063621.37740-1-haohlliang@gmail.com
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull file closing updates from Christian Brauner:
"This makes closing files synchronous for close_range(), exec and exit.
Since fput() was switched to task work every final __fput() of an
exiting task is queued on task work and run from exit_task_work().
exec and close_range() do the same. For a task with a large descriptor
table that is a cmpxchg() and a TIF_NOTIFY_RESUME test-and-set per
file plus a list entry for any later task_work_cancel() to search
under pi_lock, and then a second pass over every struct file that
isn't cache hot anymore by then. Oleg and Neil have pointed this out
over the years.
close_files(), close_range() and close-on-exec now flush and put each
file inline the way close(2) does. Kernel threads aren't affected.
They share init_files which init_task pins forever so their
exit_files() never drops the last reference, and their fput() keeps
punting to a workqueue. The one place that could put a table from a
kthread context, a failing copy_process(), can't hold the last
reference while the source table is alive.
On a 64 vCPU KVM guest tearing down 4096, 65536 and 1M descriptors
scattered at random positions in the table:
4096 fds 65536 fds 1M fds
exit 1045 -> 895 us 18.9 -> 14.9 ms 429 -> 306 ms
execve, close-on-exec 1393 -> 1190 us 21.4 -> 16.9 ms 471 -> 325 ms
close_range() 1179 -> 988 us 21.9 -> 17.4 ms 484 -> 337 ms
So that is 16-21% or 40-150 ns per closed file, largest at 1M
descriptors. With eight processes tearing down 65536 descriptors each
at once it stays at 16-21% because the second pass over 16 MB of
struct file is what gets expensive when CPUs compete for the cache.
With 32 or 64 processes both kernels are bound by pushing millions of
files through slab and rcu and the difference shrinks to 4-8%. Files
whose own release dominates gain less, 13% for eventfds, 11% for
pipes, 6% for AF_UNIX sockets. close(2) is untouched and will-it-scale
is within 2%.
The spufs coredump support is removed. It was the only reason
do_coredump() unshared the descriptor table. gdb dropped Cell
debugging in 9.1 and binutils in 2.34, the Cell blades are gone and
nothing on the PlayStation 3 produces or reads these notes. With that
unshare_files() goes away, exec installs its private table through the
new switch_files_struct() and the coredump startup completion becomes
a plain thread count waited on with the new wait_var_event_state().
Three fixes for the synchronous close are included. A failed fork
released its files under scx_fork_rwsem and deadlocked against the bpf
link's release. A session leader's exit released its tty before
disassociate_ctty() ran and the foreground job lost its SIGHUP, so the
tty is hung up before the files are closed now. And descriptor tables
are walked from the highest descriptor down which restores the order
the deferred puts had and keeps a few long-standing release ordering
bugs from deadlocking exit"
* tag 'vfs-7.4-rc1.sync_close' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
fs: close files from the highest descriptor down
coredump: factor out coredump_wait_inactive()
exit: hang up the tty before closing the files
fork: release the files of a failed fork after sched_cancel_fork()
coredump: replace the startup completion with a thread count
sched: add wait_var_event_state()
coredump: drop core_state->dumper
fs: make close_cloexec_files() synchronous
fs: rename do_close_on_exec() to close_cloexec_files()
fs: make close_range() synchronous
fs: make close_files() synchronous
fs: add filp_close_sync()
fs: remove unshare_files()
fs: move unshare_fd() to fs/file.c
fs: add switch_files_struct()
coredump: stop unsharing the file descriptor table
fs: don't open-code file_close_fd() in close_fd()
powerpc: remove coredump support
|
|
copy_user_syms() and bpf_uprobe_multi_link_attach() check whole user
arrays with access_ok() up front, then read them one element at a time
with __get_user(), with other work in between: allocations and
strncpy_from_user() in copy_user_syms(), validation in the uprobe_multi
loop. Each of those accesses enables and disables user access on its
own, so the up-front check saves nothing. On x86, __get_user() is even
more expensive than get_user(): it does an lfence, where get_user()
checks the address with a couple of plain instructions.
Use get_user(). The access_ok() checks stay, because they also make a
bad array fail with -EFAULT before anything else is looked up or
allocated. Update the comment that said they were there for
__get_user().
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
syscall_user_dispatch() reads the selector byte with __get_user(),
relying on an access_ok() done once at prctl time when the selector
address was set. So the pointer being dereferenced was validated in a
different system call, and the separation saves nothing anyway:
__get_user() still enables and disables user access, and on x86 it does
an lfence that get_user() avoids.
Use get_user(), and drop the comment explaining why the unchecked access
was safe.
The selector may be a tagged address. The prctl-time check is done on
untagged_addr(selector), but it is the tagged pointer that gets stored,
and __get_user() never checked it. get_user() does, and on x86 with LAM
a tagged pointer fails its range check. So untag it at the point of use
as well. The prctl-time check stays, so a bad address is still reported
when it is set.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
is_trap_at_addr() reads the instruction at a user address with
__get_user(), inside pagefault_disable() since the caller holds
mmap_lock. There is no access_ok() in front of it, and nothing here
needs the unchecked version: with page faults disabled, get_user()'s
might_fault() check returns early, so that is no reason to avoid it
either.
Use get_user(), which also checks that the address is a user address,
and on x86 avoids the lfence that __get_user() does.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
PTRACE_GETREGSET and PTRACE_SETREGSET do an access_ok() on the user
iovec, read its two fields with __get_user(), and once the regset has
been transferred write the length back with __put_user(). Each of those
accesses enables and disables user access on its own, so the up-front
check saves nothing. On x86, __get_user() is even more expensive than
get_user(): it does an lfence, where get_user() checks the address with
a couple of plain instructions.
Just use get_user() and put_user(), and drop the access_ok(). Both
fields are read before anything else is done, so a bad pointer still
fails with -EFAULT up front.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
get_compat_sigevent() does one access_ok() on the user structure and
then reads four fields with __get_user(). Each of those reads enables
and disables user access on its own, so the single range check no longer
buys anything.
Read the fields inside a scoped_user_read_access() instead.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
__save_altstack() and __compat_save_altstack() write three fields with
__put_user(), relying on the caller having done access_ok() on the whole
signal frame. Each of those writes enables and disables user access on
its own, so that check saves nothing.
x86 and powerpc already avoid these functions by using
unsafe_save_altstack() inside their own user access regions. Use the
same helpers here, inside a scoped_user_write_access(), so that every
other architecture gets a single range check and a single user access
region too. None of those callers is itself inside a user access
region, so nothing nests.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
The old sigaction() system call and its compat counterpart do one
access_ok() on the user structure and then a series of __get_user() or
__put_user() calls on its fields. That was an optimization back when
each of those was a single memory access. These days each of them
enables and disables user access on its own (stac/clac on x86), so the
up-front check saves nothing.
Convert them to scoped_user_{read,write}_access() with
unsafe_{get,put}_user(), which does the range check once and puts a
single stac/clac pair around plain moves.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull vfs idmap constification from Christian Brauner:
"This makes struct mnt_idmap const throughout the tree.
A mount's idmapping is immutable. The only thing modified after
alloc_mnt_idmap() is the reference count and that is hidden behind
mnt_idmap_get() and mnt_idmap_put(). Everything else only reads from
it. That is the same model struct cred uses and the idmapping is
sensitive enough to deserve it.
The conversion goes bottom up through the vfs{g,u}id and fs{g,u}id
helpers, the privilege checks, acl, xattr and quota and then every
inode operation that takes an idmap, so ->permission(), ->getattr(),
->setattr(), ->create(), ->mkdir(), ->mknod(), ->symlink(),
->rename(), ->tmpfile(), ->get_acl(), ->set_acl() and ->fileattr_set()
with their implementations in every filesystem, plus the LSM hooks.
struct vfsmount, struct mount_kattr and struct kstatmount store a
const pointer and nop_mnt_idmap and invalid_mnt_idmap live in rodata,
so anything that tries to modify them faults instead of silently
corrupting the initial idmapping"
* tag 'vfs-7.4-rc1.idmap' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (27 commits)
fs: make nop_mnt_idmap and invalid_mnt_idmap const
fs: port mnt_idmap() and file_mnt_idmap() to const mnt_idmap
fs: port vfs_*() helpers to const mnt_idmap
fs: port ->setattr() to pass const mnt_idmap
fs: port ->getattr() to pass const mnt_idmap
fs: port ->create() to pass const mnt_idmap
fs: port ->symlink() to pass const mnt_idmap
fs: port ->mkdir() to pass const mnt_idmap
fs: port ->rename() to pass const mnt_idmap
fs: port ->mknod() to pass const mnt_idmap
fs: port ->tmpfile() to pass const mnt_idmap
fs: port ->get_acl() to pass const mnt_idmap
fs: port ->set_acl() to pass const mnt_idmap
fs: port ->fileattr_set() to pass const mnt_idmap
fs: port xattr to const mnt_idmap
fs: port ->permission() to pass const mnt_idmap
fs: port acl to const mnt_idmap
fs: port inode_init_owner() to const mnt_idmap
fs: port inode_owner_or_capable() to const mnt_idmap
fs: port privilege checking helpers to const mnt_idmap
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull file table updates from Christian Brauner:
"This annotates struct fdtable's fd array with __counted_by_ptr so
KASAN and the fortified functions can bounds check it against max_fds
and adds a KUnit suite for fdtable. A follow-up uses __struct_size()
in the test since sparse doesn't know __builtin_dynamic_object_size().
FD_PREPARE() is simplified. It was built as an ACQUIRE-style guard on
infrastructure that was never needed. The ACQUIRE machinery and
CLASS_INIT() go away, the variable is declared with __cleanup()
directly, struct fd_prepare loses its err field since the fd either
holds the descriptor or the error, and callers get a const pointer to
the guard behind a UNIQUE_ID() name so they can't shadow it. Code
generation is identical"
* tag 'vfs-7.4-rc1.file' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
file: make struct fd_prepare const and kill its err field
cleanup: remove CLASS_INIT()
file: declare the FD_PREPARE() variable with __cleanup() directly
file: simplify FD_PREPARE()
vfs: use __struct_size() in the fdtable KUnit test
vfs: Add KUnit tests for fdtable
vfs: Annotate struct fdtable's fd field with __counted_by_ptr
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull coredump updates from Christian Brauner:
"This adds sparse coredumps and per-request memory type selection to
the coredump socket protocol.
A coredump sent over the socket transfers every zero of every hole in
every mapping. For a process with 128 threads that's 1 GB of mostly
thread stacks, 8 MB reservations with a few pages touched, and the
holes sit in the middle of the dump rather than at the end. The
coredump_filter bit that was proposed for this stops each PT_LOAD at
the last populated page. But that mask says which kinds of memory to
include and propagates across fork and exec, whereas what is selected
here is an encoding. The usermodehelper isn't salvagable for this
either. The coredump socket already has a handshake for exactly this.
A server that raises COREDUMP_RECORDS in coredump_ack->mask gets the
coredump as a sequence of records, each a struct
coredump_record_header followed by what it describes. The stream ends
explicitly with an end record that reports the size, so a missing one
means truncation.
With COREDUMP_SPARSE holes cross the socket as a bare header that says
how many zero bytes were skipped. Reassembling the records gives back
the same coredump, so a debugger and everything else still see an
ordinary core file. Numbers from the selftests: the 128 thread process
sends 1424153 bytes for a coredump of 1075150848 bytes, a 256 MB
mapping with the first and the last page touched sends 188793 bytes
for 268890112 bytes, and with COREDUMP_RECORDS alone the record
overhead is under one percent.
The selftests also simulate a server uploading to a blob store that
can't seek and rewrites the program headers so the object is an
ordinary ELF core file without the holes.
COREDUMP_MEMORY_TYPES lets the server choose what memory to dump per
request instead of relying on the static /proc/<pid>/coredump_filter
of the crashing task. The request carries the default types and a mask
of every type the kernel knows about, the ack carries the selection.
Zero is valid and dumps the program headers and notes and nothing but
the mappings that are always dumped.
Preparatory cleanups refuse negative skips in dump_skip_to(), chunk
every write at a page so a pipe or a socket never takes a short write
in the middle of a record, make the dump helpers return bool and
replace the core_dumped integer with COREDUMP_STATE_STARTED and
COREDUMP_STATE_TRUNCATED flags.
Also included is a fix for coredump_parse() reading core_pattern while
it is being modified. The sysctl handler now validates a copy and
publishes it under a spinlock and the parser works on a snapshot, so a
rejected pattern is never visible and the rollback logic goes away.
And to_kthread()'s lockless flags read is annotated with READ_ONCE()"
* tag 'vfs-7.4-rc1.coredump' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (29 commits)
kthread: Annotate lockless to_kthread() flags access
coredump: parse a snapshot of core_pattern
selftests/coredump: test failed handshakes
selftests/coredump: improve coredump size negotiation tests
selftests/coredump: test COREDUMP_MEMORY_TYPES
selftests/coredump: simplify the refusal tests
tools: sync coredump.h header
coredump: select memory types to include
selftests/coredump: show how to inspect the task to decide how the coredump should be sent
selftests/coredump: simulate a blob store
selftests/coredump: put a hole in the middle of a sparse mapping
selftests/coredump: hand the record stream to a sink
selftests/coredump: test COREDUMP_RECORDS and COREDUMP_SPARSE
coredump: describe the holes when COREDUMP_SPARSE is negotiated
coredump: send the coredump in records if requested
tools: sync coredump.h header
coredump: add COREDUMP_SPARSE to the coredump socket protocol
coredump: add COREDUMP_RECORDS to the coredump socket protocol
coredump: clean up coredump state handling
coredump: always chunk writes
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull signal handling updates from Christian Brauner:
"This stops TIF_NOTIFY_SIGNAL from interrupting work that can't be
restarted and fixes a bunch of coredump and signal bugs.
TIF_NOTIFY_SIGNAL kicks a task out of an uninterruptible sleep so it
returns to userspace, runs its task work and goes back to sleep. That
breaks coredumps: dump_interrupted() only lets fatal signals interrupt
a dump and writes to a regular file ignore TIF_NOTIFY_SIGNAL. But the
pipe and the socket paths check signal_pending() Adeep down in code
that is shared with regular syscalls and bail. So a crashing process
with io_uring requests in flight loses most of its coredump.
In the selftest an unfixed kernel delivers 357324 of at least 5111808
bytes. And io_uring isn't the only source. klp_send_signals(),
bpf_task_work_schedule_signal(), landlock's tsync, kthread_stop() and
the printk kunit test raise the bit as well, some of them from irq
context against any task. So this can't be fixed per subsystem and the
state has to be per-task and ambient.
Add PF_NO_NOTIFY_SIGNAL and no_notify_signal_save()/restore() helpers
modelled on memalloc_nofs_save(). Inside such a section
signal_pending() ignores TIF_NOTIFY_SIGNAL. Coredumps, the smb send
path, which hand-rolled its own version of this, and the pid namespace
reaper, which busy-looped when the bit kept getting raised, are
converted.
The second part is a set of fixes that fell out of looking at the
coredump code with kres and modelling it in TLA+:
- coredump_finish() woke the parked threads without holding rcu. A
parked thread can exit on a spurious wakeup and be freed before
wake_up_process() takes its pi_lock.
- Only SIGKILL and the freezers interrupt a dump now and the three
freezers agree. Power management and cgroup v1 freezing aborted a
dump while a cgroup v2 freeze either waited for the dump or cut it
short depending on where the core went.
- io-wq set its exit bit without a barrier against the task work that
creates workers. On weakly ordered architectures exit could hang on
worker_done.
- retarget_shared_pending() slingshotted a shared signal to the dumper
when a zapped sibling restored its signal mask. That set
TIF_SIGPENDING on the dumper and truncated the core.
- A tracer could clear the signal mask of a user worker with
PTRACE_SETSIGMASK and inject a coredump signal. An io-wq worker of
an SQPOLL ring dumping core deadlocks the whole group.
PTRACE_SETSIGMASK is refused for user workers now and
__set_task_blocked() enforces the fork-time mask.
- exec cancels io_uring requests before de_thread() so a worker
creation queued as task work can't add a thread to a thread group
that de_thread() just took down.
- No io threads are created from a PF_SIGNALED or PF_POSTCOREDUMP
creator anymore. Such a worker was invisible to zap_process() but
still decremented threads_remaining on exit so the dumper could
leave coredump_wait_inactive() early.
Also included are a comment that do_each_pid_task() needs
tasklist_lock, a READ_ONCE() in pid_alive() and a regression test for
fork() into a pid namespace whose ancestor lost its init"
* tag 'kernel-7.4-rc1.signal' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (21 commits)
pid: use READ_ONCE() in pid_alive()
selftests: pid_namespace: test fork with dead ancestor
pid: document that do_each_pid_task() needs tasklist_lock
signal: enforce the user worker signal mask in __set_task_blocked()
fork: use SIG_KERNEL_ONLY_MASK for the user worker signal mask
fork: don't create io threads once PF_POSTCOREDUMP is set
fork: move the coredump and exec checks into create_io_thread()
exec: cancel io_uring requests before de_thread()
selftests/coredump: expect PTRACE_SETSIGMASK to be refused on a user worker
selftests/coredump: test a user worker as the coredumping thread
ptrace: refuse to change the signal mask of a user worker
selftests/coredump: test shared signal retargeting during a dump
signal: only SIGKILL and the freezers interrupt a coredumping task
signal: don't retarget shared signals in a dying thread group
io-wq: order the exit bit against worker creation task work
coredump: hold RCU while releasing parked threads
pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper
smb: prevent TIF_NOTIFY_SIGNAL from interrupting
selftests/coredump: test that TIF_NOTIFY_SIGNAL doesn't truncate a coredump
coredump: prevent TIF_NOTIFY_SIGNAL from interrupting coredumps
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull namespace updates from Christian Brauner:
- Reject uid_map, gid_map and projid_map values that don't fit in a
u32.
map_write() parsed with simple_strtoul() and truncated modulo 2^32 on
64-bit so "4294967301 1000 1" was installed as "5 1000 1" without an
error. Each field is parsed with kstrtou32() now and selftests cover
the out-of-range, negative and in-range cases. This isn't a security
fix. The truncated values were valid ids and every later check still
applied to them.
- Annotate struct uid_gid_map's forward and reverse pointers with
__counted_by_ptr and add a KUnit suite for inserting and sorting
extents.
insert_extent() wrote to forward[nr_extents] before bumping the count
which the annotation flags, so it bumps first now. Two follow-up
fixes rename the now global helpers to uid_gid_map_insert_extent()
and uid_gid_map_sort(), since the btrfs self-tests have their own
insert_extent(), and guard the declarations on CONFIG_KUNIT.
- Drop the BUG_ON() NULL checks in copy_mnt_ns() and copy_utsname().
create_new_namespaces() always passes a valid pointer and the other
copy_*_ns() helpers don't check either.
- Remove a dead key_put() on the create_user_ns() error path.
* tag 'namespace-7.4-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
selftests/namespaces: add uid_map/gid_map range tests
userns: reject uid_map/gid_map values that do not fit in u32
userns: declare the KUnit-visible helpers whenever KUnit is enabled
userns: rename insert_extent() and sort_idmaps()
userns: Add KUnit test suite for uid_gid_map
userns: Add __counted_by_ptr attribute to struct uid_gid_map
fs: namespace: drop BUG_ON() in copy_mnt_ns()
uts: drop BUG_ON() in copy_utsname()
userns: remove dead key_put() on the create_user_ns() error path
|
|
KCSAN reports a data race on bpf_lru_node::type between the LRU list
rotation and the free path of the common LRU:
BUG: KCSAN: data-race in __bpf_lru_list_rotate / bpf_lru_push_free
write to 0xffff88811b758022 of 1 bytes by task 4756 on cpu 1:
__bpf_lru_node_move
__bpf_lru_list_rotate_active
__bpf_lru_list_rotate
bpf_lru_list_pop_free_to_local
bpf_common_lru_pop_free
bpf_lru_pop_free
htab_lru_map_update_elem
read to 0xffff88811b758022 of 1 bytes by task 4752 on cpu 0:
bpf_lru_list_push_free
bpf_common_lru_push_free
bpf_lru_push_free
htab_lru_push_free
htab_lru_map_update_elem
value changed: 0x00 -> 0x01
bpf_lru_list_push_free() reads node->type for a WARN_ON_ONCE() sanity
check before taking l->lock. __bpf_lru_node_move(), called right after
under l->lock, does the same check, so drop the unlocked one.
bpf_common_lru_push_free() re-checks node->type under loc_l->lock after
the lockless READ_ONCE() at function entry. By then the node has been
removed from the htab, so only flush and rotate can change its type,
through __bpf_lru_node_move_in() and __bpf_lru_node_move() under
l->lock. Mark that re-check with READ_ONCE() and those two writers with
WRITE_ONCE(), following commit 6df8fb83301d ("bpf_lru_list: Read
double-checked variable once without lock"). The remaining writers
operate on a node with a single owner that nobody else reads and are
left alone.
Tested on bpf-next with CONFIG_KCSAN=y in a 4-vCPU virtme-ng guest,
using a reproducer that runs 8 threads issuing BPF_MAP_UPDATE_BATCH
on a 64-entry BPF_MAP_TYPE_LRU_HASH with overlapping keys.
Reported-by: syzbot+1ea4f564bf6f1f3d1dc4@syzkaller.appspotmail.com
Signed-off-by: Nicholas Velten <nicholasfvelten@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261019-fix-lru-node-type-kcsan-v2-1-c10a410b3565@gmail.com
Closes: https://syzkaller.appspot.com/bug?extid=1ea4f564bf6f1f3d1dc4
|
|
Existing arena kfunc code has an underlying race condition
that can lead to writes being lost from the BPF program's
point of view:
a) A memory range gets freed by operation (1), and its range
is added back to the arena range tree.
b) A concurrent allocation (2) reallocates the range, and does
writes to it. Writes from that CPU may follow the stale TLB
entries into the pages that are about to be freed.
c) (1) invalidates the TLB. The old pages, and any writes done
to them, are now inaccessible. zap_pages() similarly removes the
mappings for userspace threads.
This can be triggered by particularly demanding BPF arena data
structures that constantly allocate and deallocate memory, like
hash table allocations.
Solve this ABA problem by keeping the range allocated until TLB
invalidation and unmapping are complete. Under the arena spinlock,
claim any free pages in the range and clear its kernel PTEs. Then drop
the spinlock, lock and unlock each cleared page to wait for faults that
are still installing a user PTE, flush the kernel TLB and zap the user
page tables. Finally, retake the spinlock to release the range. Frees
serialize on zap_mutex, so an overlapping free cannot release the range
early. Claiming the range only allocates a range tree node when the
whole range is free, and then there is nothing to free.
User faults on a range that is allocated without a page now raise
SIGBUS instead of populating it. That covers a range reserved with
bpf_arena_reserve_pages() and a range whose kernel PTEs a free has
already cleared. Touching a page while a BPF program frees it is a user
space bug, and in a BPF_F_SEGV_ON_FAULT arena it already raises SIGSEGV.
Sleepable frees run synchronously and are deferred only when the arena
spinlock cannot be taken. The deferred free worker retries such a free
in place instead of requeueing itself, so the flush_work() in
arena_map_free() waits for all of its work.
Fixes: b8467290edab ("bpf: arena: make arena kfuncs any context safe")
Reported-by: Mykola Lysenko <nickolay.lysenko@gmail.com>
Suggested-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261019201108.4552-3-emil@etsalapatis.com
|
|
A user fault on an arena pins the page that the kernel arena maps,
drops the arena spinlock and returns the page to the core fault code,
which then locks the folio and installs the user PTE. A concurrent
free can clear the kernel mapping in that window. The page reference
prevents a use-after-free, but the fault can still install a user PTE
for a page the arena has already released. User space and BPF programs
then see different memory at the same arena offset.
Close the window from the fault side. Lock the page, recheck that the
kernel mapping still points to it, and return it with VM_FAULT_LOCKED so
that it stays locked until the core fault code has installed the user
PTE. If a free removed the page, drop it and return VM_FAULT_NOPAGE so
that the fault starts over. Return VM_FAULT_HWPOISON for a poisoned
page.
This change alone does not close the race, because the free path does
not yet wait for the page lock. The following change makes frees wait
for in-flight faults before zapping user mappings.
Fixes: 317460317a02 ("bpf: Introduce bpf_arena.")
Suggested-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261019201108.4552-2-emil@etsalapatis.com
|
|
The signature of a program covers its insns as submitted, along with the
frozen metadata maps of a signed loader, and bpf_prog_verify_signature()
checks it before the verifier does anything else with the program. CO-RE
relocations are the one input besides the insns that changes them: the
loader hands them in with the program, and bpf_check_core_relo() applies
them after the signature check, rewriting the immediate or the offset of
every insn a record names with a value the loader chooses, a field
offset, a type size or id or an enum value of the kernel BTF, or a type
id of the BTF the loader supplies itself. Whoever holds a signed program
can so change its constants once the signature has passed, the offsets a
signed loader reads its metadata map with for instance, and run a
program the signer never saw. The exclusive metadata map of a signed
loader does not make up for it: the hash that binds the map to a program
is chosen by whoever creates the map, so it can name the relocated
program as well.
Refuse a signed load that carries relocations, before the signature is
examined, like the other checks on the shape of a signed load. A signed
loader has none to lose: the programs it embeds are relocated by the
loader itself through bpf_core_apply(), and nothing relocates the loader.
The BTF of the program itself can stay: without relocations it steers
only the verification, through func_info, line_info and the annotations
of global function arguments, and rewrites nothing.
Fixes: 349271568303 ("bpf: Implement signature verification for BPF programs")
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://patch.msgid.link/20261019144851.4052056-2-memxor@gmail.com
|
