| Age | Commit message (Collapse) | Author |
|---|
|
git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core
Pull more driver core fixes from Danilo Krummrich:
- Revert TAINT_FORCED_BIND, introduced to flag manual sysfs bind/unbind
operations associated with misleading fuzzing reports. It also taints
established workflows, including VFIO device passthrough; a more
targeted approach will be revisited after 7.4.
- Rate limit synthetic uevent failure messages to prevent log flooding
from repeated invalid writes to sysfs uevent files
* tag 'driver-core-7.4-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core:
Revert "driver core: add TAINT_FORCED_BIND for when userspace manually messes with devices and drivers"
driver core: Limit the messages on a refused uevent
|
|
Commit 3e14f079d7a0 ("selftests/fuse: add fuse symlink caching test")
registered fuse_symlink_cache_test in the fuse selftest Makefile and
.gitignore, but the test source was not part of the applied commit, so
building the fuse selftests fails:
make[1]: *** No rule to make target 'fuse_symlink_cache_test.c', needed by '.../fuse_symlink_cache_test'.
Add fuse_symlink_cache_test.c as posted in Luis Henriques's v5
submission. The test serves a file and a symlink to it from a libfuse
low-level filesystem, resolves the symlink 100 times, and counts the
readlink requests that reach the server: one when FUSE_CAP_CACHE_SYMLINKS
is set during FUSE_INIT, and all 100 when it is not.
Fixes: 3e14f079d7a0 ("selftests/fuse: add fuse symlink caching test")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/r/202610170822.oEJ1Autq-lkp@intel.com/
Link: https://lore.kernel.org/r/20261001164916.15311-8-luis@igalia.com
Originally-by: Luis Henriques <luis@igalia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Reviewed-by: Luis Henriques <luis@igalia.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-ktest
Pull ktest updates from Steven Rostedt:
- Sort configs before writing config file
Currently the .config file is created from the perl hash array from
reading the applied min-configs. The order is determined by how perl
hashes the values. This causes the .config file to be created in
different orders for each run, and the order may determine the final
value of the .config file after it goes through a make oldconfig.
Sort the values when creating the .config so that the result is the
same for every run.
- Add total test time to run output
Have ktest display the total test time of running all the tests. This
is useful to find issues in the build, install, boot or test run
where things are hanging for longer than expected.
- Update reading of the git output during bisect
The ktest bisect is an automated way to run git bisect. Since there
currently no easy way to know if the bisect found the bad commit (I'm
talking with the git maintainers to fix this[1]), it parses the
output for the line "is first bad commit". But a recent update to git
has the output state "is the first 'bad' commit" which breaks ktest
bisect.
Have ktest handle both output strings.
[1] https://lore.kernel.org/all/20261020141011.0015d172@gandalf.local.home/
* tag 'ktest-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-ktest:
ktest: Accept quoted bad term in git bisect output
ktest.pl: Add total test run time to output
ktest: Sort config keys before writing config files
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull thermal control fixes from Rafael Wysocki:
"These fix three issues related to thermal control:
- Fix CPU mask truncation in power limit trace event used by the
power allocator thermal governor (Hungyu Lin)
- Fix code indentation in create_s32_tzp_attr() and rearrange it to
use early return when applicable (Thorsten Blum)
- Allow cross builds of the Intel thermal tests (Sasha Levin)"
* tag 'thermal-7.4-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
thermal: sysfs: Fix indentation in create_s32_tzp_attr()
thermal: Fix CPU mask truncation in power limit trace event
selftests/thermal: allow cross builds of the Intel tests
|
|
Pull more KVM updates from Paolo Bonzini:
"ARM64:
- Fix a couple of embarrassing merge mistakes in kvmarm-7.4
- Cleanup the HCR_EL2 bit fields to exclusively use the generated
definitions, fixings a nasty regression introduced in 6.16, where
barriers were not upgraded from NSH to ISH anymore
- Fix publication of state when a vcpu is forced out of the guest
- Let vcpu pausing nest correctly
- Sanitise ID_AA64MMFR3_EL1.S1P[IO]E to follow the rules of the
architecture
- Don't warn on SMCCC filter reserved range allocation failure
- Prevent GICv5 and TLBI hypercalls to be used from the host when
pKVM is active
- Enforce that only GICv3 guests are supported for pKVM
- Don't try to access GICv5 EL2 sysregs from EL1
- Compute architectrally correct values for ID_AA64MMFR3_EL1.S1P[IO]E
by checking the feature dependencies
- Require matching VGIC and ITS model
- Cleanup TRACE_REMOTE dependencies
- Fix random comments
ARM64 selftests:
- selftests: Skip unwritable ID fields in the failed-run test
- Move pkvm_selftests() after all CPUs have initialized EL2
RISC-V:
- Allow Zicclsm, Ziccamoa, Ziccif, Za64rs for KVM guest
- Implement KVM_PRE_FAULT_MEMORY ioctl()
- Replace imsic switch-case macros with range checks
RISC-V fixes:
- Avoid redundant interrupt check for pending timers
- Reject vCPU creation after AIA initialization
- Fix build with vector support disabled
- Fix IPI delivery for out-of-order vcpu_id
- Use a raw lock for IMSIC wakeup state
- Reject vCPU creation after AIA initialization
RISC-V selftests:
- Lazy V-extension enablement for KVM selftests
- Show sepc/scause/stval CSRs in KVM selftests vcpu dump"
* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (42 commits)
KVM: selftests: Reject GICv3 ITS with a GICv5 VGIC
KVM: arm64: vgic: Require matching VGIC and ITS models
KVM: arm64: gic-v5: Drop unused addr variable
KVM: arm64: Sanitise ID_AA64MMFR3_EL1.S1P[IO]E
KVM: arm64: selftests: Skip unwritable ID fields in the failed-run test
tracing/remotes: Fix TRACE_REMOTE build when TRACING=n
KVM: arm64: Move pkvm_selftests() after all CPUs have initialized EL2
KVM: arm64: Get rid of compatibility HCR_EL2 aliases
KVM: arm64: Convert HCR_xyz to HCR_EL2_xyz
KVM: arm64: Set HCR_EL2.BSU to Inner Shareable for guests
KVM: arm64: Fix stale VGICv3 comments in the nVHE world switch
KVM: arm64: vgic: Do not access the GICv5 CPU interface from EL1
KVM: arm64: Validate the host-provided vgic model in pKVM
KVM: arm64: Reject the stage-2 flush hypercalls under pKVM
KVM: arm64: Return on kvm_gmem_get_pfn() failure in gmem_abort()
KVM: riscv: selftest: add Zicclsm, Ziccamoa, Ziccif, Za64rs
RISC-V: KVM: Allow Zicclsm, Ziccamoa, Ziccif, Za64rs in guest
MAINTAINERS: name the kvm-riscv/linux riscv_kvm_next branch
RISC-V: KVM: Don't write MMIO load result to x0
RISC-V: KVM: Use a raw lock for IMSIC wakeup state
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
Pull arm64 fixes from Catalin Marinas:
"Three fixes that turned up during the merging window: shadow stack not
freed during a failed fork or it is unmapped from parent when a worker
thread exits (same commit covers both); PTE_CONT set on PROT_NONE
entries but subsequently ignored by the unfolding code since
pte_valid() is false (pte_present() is true); an MPAM lock not
released on the error path.
Summary:
- Release the GCS on a failed fork.
copy_thread() can allocate a GCS for CLONE_VM threads but a later
copy_process() failure left the VMA in the parent's mm. Implement
exit_thread() to free it and stop kernel threads and user workers
inheriting the parent's GCS base/size. Add a kselftest for the
clone3() failure case
- Do not set PTE_CONT on invalid PTEs in contpte_set_ptes().
Batched set_ptes() of present-invalid entries (e.g. PROT_NONE)
created contpte groups that the single-PTE helpers did not unfold,
corrupting a neighbouring guard marker via
test_and_clear_young_ptes()
- Release the MPAM mon_sel lock on the mpam_save_mbwu_state() error
paths"
* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
selftests/arm64: GCS must not leak on a failed clone3
arm64/gcs: release GCS on failed fork
arm64/mm: restrict transparent contpte mappings to valid PTEs
arm_mpam: Release the mon_sel lock on mpam_save_mbwu_state() errors
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull vfs fixes from Christian Brauner:
- writeback:
- Update dirtied_when instead of dirtied_time_when when a wb switch
puts an inode at the newest end of the target b_dirty list. The
list was left out of order so move_expired_inodes() could stop
before older inodes, and the lazytime expiration timestamp was
reset
- Clear the old wb's dirty-I/O state and bandwidth contribution when
a batch of inode switches leaves its dirty lists empty. An empty
wb stayed scheduled for periodic writeback and inflated
bdi->tot_write_bandwidth
- Take wb_switch_rwsem across the inode scan of
cleanup_offline_cgwb(). The v7.3-rc5 fix that rotates scanned
inodes let a scan racing a sync()'s queue_io() move lazytime
inodes past the sync's cutoff, so sync() returned without
persisting their timestamps
- Don't kick writeback for an IOCB_DONTCACHE write on an inode that
has no wb yet. With cgroup writeback an O_DIRECT RWF_DONTCACHE
write to a block device dereferenced NULL
- statmount/listmount/listns:
- Refuse statmount() string requests with a buffer that isn't larger
than struct statmount
- Don't wrap around with a U64_MAX cursor in listmount() and
listns()
- Don't end listns() at an inactive namespace
- Only add init_ipc_ns and init_net to the namespace trees if
CONFIG_IPC_NS and CONFIG_NET_NS are enabled
- iomap:
- Only mark blocks uptodate in __iomap_write_begin() after reading
them and let __iomap_write_end() mark the zeroed blocks uptodate
once the copy from userspace succeeded
- Check a chunk against max_integrity_io_size() on its own before
the bio size check
- Only enforce block alignment for direct I/O into holes and
unwritten extents if IOMAP_DIO_FSBLOCK_ALIGNED is set
- backing-file:
- Check S_APPEND and S_IMMUTABLE on the backing inode. FUSE
passthrough opens the backing file with vfs_open() which skips
may_open(), so anyone who may open the FUSE file for writing could
overwrite an append-only backing file anywhere or write to an
immutable one. Open, mmap and writes now check the backing inode
the way may_open() and do_mmap() do
- Always call kiocb_end_write() for a queued write
- Let backing files inherit FMODE_NONOTIFY from the user file. The
event fds fanotify creates for permission events on a stacked
filesystem raised FS_OPEN_PERM on the real path from inside the
listener's read() and deadlocked listeners with marks on both
layers
- pidfs:
- Look the task up before checking for exit information in
PIDFD_GET_INFO and start over if the task no longer owns the pid
once all fields have been read. A caller racing release_task() got
neither PIDFD_INFO_PID nor PIDFD_INFO_EXIT or ESRCH although the
exit information was available, and a caller racing a sub-thread's
exec reported that thread's tid as the pid
- Clear the mask bits of fields that lie beyond the struct size the
caller passed. The uapi header promises that the mask names no
such field but a caller passing PIDFD_INFO_SIZE_VER0 got the
coredump and supported mask bits set for fields that were never
written
- aio:
- Give the aio ring a ->read_folio that fails with EIO so a fault on
a ring whose file was truncated gets SIGBUS instead of jumping to
NULL
- Check nr_events against the ring size before doubling it in
ioctx_alloc()
- splice:
- Only write back an implicit file position in do_splice() when the
splice helper succeeded. splice doesn't take f_pos_lock so a
failed splice restored a stale snapshot over a position that a
concurrent getdents() had moved. On ext2 the next readdir then
trusted an offset inside a directory entry
- Retry tee() when the input pipe was emptied or the output pipe
filled between the prep steps and link_pipe() instead of returning
0 while the input pipe still has writers, as splice_pipe_to_pipe()
does
- ucount:
- Take the reference that pins a ucounts level on the 0 -> 1
transition before checking the rlimit
- Read the parent ucounts before dropping the rlimit count in
do_dec_rlimit_put_ucounts()
- inode:
- Rotate inodes whose page cache couldn't be dropped to the tail of
the LRU
- Skip inodes that another LRU walker is isolating
- setns:
- Set nsset->flags before anything in prepare_nsset() can fail so
the error path drops the cred prepared for CLONE_NEWUSER. A
failing setns() with CLONE_NEWUSER and CLONE_NEWNS leaked it
together with its user namespace
- Refuse setns(CLONE_NEWNS) for a task that shares its fs_struct
again when more namespaces are requested
- minix:
- Restore uptodate on the pinned bitmap buffers before redirtying
them after a failed writeback instead of tripping the warning in
mark_buffer_dirty(), as ext2 and ext4 do for their superblock
buffers
- Reject rmdir() of a directory with a corrupted link count with
EFSCORRUPTED instead of hitting the drop_nlink() warning
- userns: Keep the exec securebits and their locks when creating or
joining a user namespace. set_cred_user_ns() reset all securebits to
SECUREBITS_DEFAULT so anyone who may create a user namespace could
shed SECBIT_EXEC_RESTRICT_FILE and SECBIT_EXEC_DENY_INTERACTIVE with
a single unshare(CLONE_NEWUSER)
- fs: Honor FOP_UNSIGNED_OFFSET in sys_llseek() and in the pread64(),
pwrite64(), preadv() and pwritev() wrappers
- proc/kcore: Advance the vmalloc retry in read_kcore_iter() by the
last vread_iter() copy instead of the running total
- eventpoll: Return the error when the wakeup source for EPOLLWAKEUP
can't be created in EPOLL_CTL_MOD instead of reporting success
without suspend protection
- coredump: Mark do_coredump() noinline_for_stack
- nsfs: Check the trailing bytes of a namespace file handle in bytes
instead of words
- netfs: Restore the per-level and per-point decoding of the debug mask
- exportfs: Release the directory file get_name() opened with
__fput_sync(). From nfsd's kernel threads the deferred fputs arrived
faster than delayed_fput retired them and each pinned the directory's
readdir state, growing unreclaimable slab by about 90 MB per second
under a parallel tree walk
- fs: Call ramfs_kill_sb() for a ramfs rootfs. Since rootfs can be
unmounted as of v7.0 its struct ramfs_fs_info was leaked
- signal: Check the blocked mask for every entry
dequeue_synchronous_signal() looks at. The scan could select a
blocked synchronous signal and deliver it while blocked
- super: Convert the superblock device table from an rhltable to a
plain hashtable under a spinlock. This fixes a bug from v7.3 where
fs_bdev_freeze() froze a btrfs filesystem through a stale member that
open_ctree() had already released while the freeze was waiting for
SB_BORN
- fork: Leave rcu_users at zero until copy_process() can't fail
anymore. bpf_task_acquire() handed out trusted references to the new
task from the task_alloc LSM hook and sched_ext's ops.init_task() and
a failing fork freed the task behind them
- xattr: Always run cap_convert_nscap() for a security.capability
write. A zero-length setxattr() skipped it and let an unprivileged
caller without CAP_SETFCAP or write permission on the file plant an
empty security.capability xattr that made every execve() of the
binary fail with EINVAL
- namei: Skip the S_ISDIR assertion in
- proc: Refuse to mount on entries below /proc/<pid>/net like fd/,
fdinfo/ and map_files/. proc_net_d_revalidate() always fails so the
first lookup by anyone with search permission ran d_invalidate() on
the dentry and detached every mount on it, locked mounts included
- libfs: Hold one mount reference for all pins instead of one per pin.
The pin count is what keeps the mount alive, so the per-pin reference
only cost a mntget() and a mntput() through
mntput_no_expire_slowpath() for every debugfs, tracefs, securityfs or
configfs file that comes and goes
- iov_iter: Return 0 from iov_iter_alignment() for an empty iterator of
any type
- watch_queue: Give info_id its own storage instead of overlaying it
with rcu_head
- filelock: Take an active superblock reference while waiting for a
delegation break. After a lazy umount closing the delegation holder
could shut down the superblock under the waiter whose final iput()
then ran shmem_evict_inode() on freed state
- fs: Skip the copy_file_range() write limit checks when there is no
data to copy
- bpf: Allow bpf_d_path() from fentry on filp_close_sync(). Since
close_range() became synchronous this cycle close(), close_range()
and the closes on exec and exit no longer go through filp_close().
fexit stays rejected since the file may be gone by then
- fs_pin: Dequeue the wait entry unconditionally in pin_kill(). A
spuriously woken waiter kept its on-stack entry queued, took that as
proof that the pin was alive and used the freed acct structure when
umount() of the accounting file raced acct(2)
- dcache: Don't fail __d_obtain_alias() for an inode without links and
aliases. The ESTALE check added this cycle broke open_by_handle_at()
and nfsd file handle decoding on NFS and FUSE where i_nlink is just
what the server last reported and the handle may well still be valid
- selftests/ovl: Fix the mountinfo expectations of the detached layer
test which has failed since it was added
* tag 'vfs-7.4-rc1.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (60 commits)
fs: don't fail __d_obtain_alias() for unlinked inodes
ns: don't add init_ipc_ns and init_net without namespace support
aio: avoid request count overflow in ioctx_alloc()
selftests/ovl: fix detached layer mountinfo expectations
bpf: Allow bpf_d_path() from filp_close_sync()
fs: skip copy_file_range write limits when there is no data
minix: reject rmdir of a directory with a corrupted link count
fs_pin: do not trust the pin after a spurious wakeup in pin_kill()
ucount: read the parent ucounts before dropping the rlimit count
splice: retry tee() instead of returning 0 when it races
selftests/pidfd: test that fields beyond the struct size are not reported
pidfs: do not report fields that do not fit into the caller's struct
fs: let backing files inherit FMODE_NONOTIFY from the user file
splice: avoid stale f_pos writeback on error
backing-file: always end a queued write
filelock: keep superblock active through delegation wait
watch_queue: keep info_id separate from rcu_head
iomap: only follow dio alignment requirement if specified
iov_iter: fix NULL deref in iov_iter_alignment()
backing-file: enforce append-only and immutable backing inodes
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull more block updates from Jens Axboe:
"Bigger than usual for an end-of-merge-window pull request, main reason
being that the MD side I had missed a pull on, and both NVMe and block
got a good pile of LLM driven fixes where some of them may as well
just go in now rather than wait a full cycle. This contains:
- NVMe fixes via Keith:
- nvme-tcp fallout from the parallel queue allocation: initialize
pf_cache_lock and the header digest before requests are set up,
and don't dereference a NULL queue->ctrl on reconnect
- nvme-fabrics queue mapping fixes: reset io_queues on reconnect,
limit each queue type to the online CPUs, and clear a poll map
with no poll queues
- nvme-tcp io_work priority inversion with send_mutex held
(Seiji), error recovery on read_sock failure and skipping TLS
control records while waiting for the ICResp (Martin B), TLS
handshake timeout validation, and an address attribute race
- nvme-rdma NULL metadata_sgl dereference with T10-PI
- nvme-pci early boot hang with the quirks parameter
- nvme-multipath ANA log bounds underflow, and an nvme-fc
discovery reference leak
- nvmet hardening: rdma inline SGL out-of-bounds write and short
connect requests, fc use-after-free in LS create connection and
teardown on admin queue failure, pci-epf transport error
reporting and SGL length checks, zns NUMD wrap, fc stale read
data, auth state and status fixes, ports list and qid_max
locking, rdma double puts and irq-safe locking, and a double
free on metadata SGL allocation failure
- nvmet fixes from Josef: big discard length truncation, NULL
derefs for PCI endpoint targets and debugfs host_traddr, stop
listening when a tcp port is removed, and don't BUG() in
nvme-loop when a scan runs beside a reset
- MD fixes via Yu Kuai:
- raid5 validation: reject too few disks, invalid reshape disks, a
per-device size below one chunk, and an inconsistent reshape
state from the superblock instead of BUG(), plus journal payload
size checks
- raid5 error path and lifetime fixes: extra_page leak and NULL
derefs in free_conf/setup_conf, draining released_stripes before
destroying the cache, RCU for the big_stripe_tree lookup, and
per-array io_unit slab names
- md core: reject v0.90 arrays with too many devices, validate
bblog_size, take reconfig_mutex when enabling PPL, fix the
mddev->private NULL deref when stopping an array under IO, and
don't hand out the array before mddev->kobj is added
- raid10 missing barrier wakeup, raid0 device count validation, a
bogus mddev_unlock() in lbs_store(), and shared helpers
- blk-mq fixes from Josef:
- don't trust the bio cookie in blk_mq_poll()
- keep tag sharing fair after a queue update
- don't bring back flags of a completed request from the timeout
handler
- honor a restarted timer
- initialize the dma state for P2P
- quiesce a queue joining a quiesced tag set
- set up and exit hctxs under tag_list_lock
- free the tag bitmaps in the SRCU callback
- blk-cgroup and friends from Josef:
- keep the old blkg while reassociating a bio
- free struct ioc after a grace period
- don't truncate v1 iops limits
- fix root io.stat on 32-bit
- don't free a blkg with its punt work queued
- flush iolatency enable_work after going offline
- pass dead group I/O counts on and make reset_stats reset them
- don't enter reclaim under rq_qos_mutex
- Other core fixes from Josef:
- a disk use-after-free in sync_bdevs()
- don't losing the status of a failed flush request
- 64-bit sector math for mac partitions
- apply the segment size to the integrity buffer
- blk-iocost: abort a weight transfer on invalid donation weights,
and publish hweights as one atomic value
- Fix a NULL deref and use-after-free in __blk_crypto_evict_key(),
reachable via dm-inlinecrypt
- Fix recursive i_rwsem locking in blkdev_write_iter(), from two
fixes for the same race landing in the window
- Advance the iterator after copy-in for SG_DXFER_TO_FROM_DEV, fixing
an infinite loop in blk_rq_map_user_iov()
- Check the open mode for LOOP_SET_STATUS in the compat ioctl
- rnbd-srv use-after-free and kobject fixes
- drbd timer and req_lock fixes
- zloop cleanups and error path fixes
- cdrom header and kernel-doc cleanups"
* tag 'block-7.4-20261029' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (109 commits)
blk-crypto: fix NULL deref and UAF in __blk_crypto_evict_key()
zloop: check that the zone backing file support ->{read,write}_iter
zloop: fput file after failed zone init
zloop: share more code for opening a zone backing file
zloop: remove a duplicate call to zloop_get_block_size
block: fix kernel-doc warnings in blk-map.c and blk-mq-dma.c
blk-iocost: publish hweights as one atomic value
blk-iocost: abort weight transfer on invalid donation weights
rnbd-srv: publish the sess_dev at the end of OPEN
rnbd-srv: fix use-after-free on two CLOSE messages
block/rnbd-srv: drop the sess_dev kobject unlocked
block/rnbd-srv: don't free the device on a sysfs error
drbd: take req_lock to skip the initial sync as peer
drbd: stop the start_resync timer of a dying device
block: apply the segment size to the integrity buffer
blk-mq: free the bitmaps of tags in the SRCU callback
block: partitions/mac: compute the sectors in 64 bits
blk-mq: set up a queue under tag_list_lock
blk-mq: exit the hctxs of a queue under tag_list_lock
blk-mq: quiesce a queue that joins a quiesced tag set
...
|
|
set_layers_via_detached_mount_fds was copied from the attached-fd test
and still looks for /tmp paths. Detached open_tree() layers are recorded
by d_path() as upperdir=/upper, workdir=/work, and lowerdir+=/ and
datadir+=/ for each cloned directory. The test has failed since it was
added.
Reported-by: Disha Goel <disgoel@linux.ibm.com>
Link: https://lore.kernel.org/linux-unionfs/20260924112858.51392-2-disgoel@linux.ibm.com
Fixes: ccc829b15d48a ("selftests: add tests for using detached mount with overlayfs")
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Link: https://patch.msgid.link/20261017165103.2450042-1-amir73il@gmail.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
|
|
The d_path selftest closes its descriptors with close_range() so that
its fentry program on filp_close() runs.
Commit 056069eb2b66 ("fs: make close_range() synchronous") switched
close_range() to filp_close_sync(), so the program still attaches but
is never called:
test_d_path_basic:FAIL:close trampoline for filp_close was not called
With that series, close(), close_range() and the closes on exec and
exit all go through filp_close_sync(). Few paths still reach
filp_close(), dup2() being one of them, so a program on filp_close()
no longer sees most file closes.
Allow bpf_d_path() from filp_close_sync(), but only from fentry.
filp_close_sync() drops the last file reference inline, so by the time
an fexit program runs, file->f_path may already be freed, with no RCU
delay for NORCU dentries such as pipes and sockets.
Attach the selftest program to filp_close_sync() and keep triggering
it with close_range().
Add a test rejecting bpf_d_path() from fexit/filp_close_sync.
Fixes: 056069eb2b66 ("fs: make close_range() synchronous")
Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
Link: https://patch.msgid.link/20261021201400.5409-1-ihor.solodrai@linux.dev
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
|
|
PIDFD_GET_INFO must not set the mask bit of a field that lies beyond
the struct size encoded in the ioctl command. Add a test that requests
the coredump fields and the supported mask with PIDFD_INFO_SIZE_VER0
over a full-size, poisoned struct, and checks that the mask names none
of those fields and that the poison behind the first 64 bytes is
intact.
Add fallback definitions of PIDFD_INFO_SIZE_VER0 to VER3 to pidfd.h,
like the other uapi constants there.
Signed-off-by: Nickolai Zeldovich <nickolai@csail.mit.edu>
Link: https://patch.msgid.link/20261024041334.831273-3-nickolai@csail.mit.edu
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux
Pull RISC-V updates from Paul Walmsley:
- Add support for crash hotplug
- Improve user copy performance on cores with fast misaligned accesses
- Optimize code paths involving pgtable_l{4,5}_enabled() by patching in
the return values during early boot (since these don't change during
runtime), or by specifying the return values directly in Kconfig
files (for purpose-built kernels)
- Change the PCIe bus reassignment behavior to depend on the
PCI_REASSIGN_ALL_BUS PCI flag (as ARM64 does)
- Avoid an unnecessary sstatus CSR read during context switch
- Make the sbi_ecall() macro variadic, improving code clarity
- Refactor __switch_to_vector() to prepare for upcoming vector context
switch optimizations
- Add a kselftest for vectorized user copy
- Add bounds checking on the shadow stack restore token address to
avoid it being used as an attack vector
- Fix the shadow stack and indirect branch landing pad control
functions to only update the CPU's envcfg CSR when operating on the
current task
- For MIPS RISC-V systems, add support for early boot-applied errata;
and for P8700 RISC-V systems, avoid WFI usage in the kernel (since it
is buggy)
- Add the "B" RISC-V ISA extension to hwcap and hwprobe reporting
- Add support for specifying and reporting the "Zic64b" RISC-V ISA
extension, and add it to the SpacemiT K1, K3, and Sophgo SG2044 DT
files
- Require the block size of cache management operations to be specified
in DT schema validation for the RISC-V ISA extensions Zicbom, Zicbop,
and Zicboz
- Some miscellaneous fixes: fix an incorrect bitfield width in the
RVG_SYSTEM_CSR_MASK bitmask macro; make RISCV_ALTERNATIVE mandatory,
now that XIP kernel support has been removed; and remove some
unnecessary includes in kernel/smp.c
* tag 'riscv-for-linus-7.4-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (28 commits)
riscv: mm: unexport _pgtable_l4_enabled and _pgtable_l5_enabled
riscv: introduce RISCV_ISA_SV48 and RISCV_ISA_SV57
riscv: support early isa ext and use it to optimize pgtable_l4|l5_enabled
riscv: convert pgtable_l4|l5_enabled to inline function
riscv: remove RISCV_ALTERNATIVE Kconfig option
riscv: Add a getter for user PMLEN support
riscv: dts: sophgo: sg2044: Add Zic64b ISA extension
riscv: dts: spacemit: k1: Add Zic64b ISA extension
riscv: dts: spacemit: k3: Add Zic64b ISA extension
riscv: Add Zic64b to cpufeature and hwprobe
dt-bindings: riscv: Add Zic64b extension description
dt-bindings: riscv: Require block-size for Zicbom, Zicbop, and Zicboz
riscv: Add B to hwcap and hwprobe
riscv: remove unused profile.h includes
riscv: cfi: Only write envcfg CSR when task is current
riscv: cfi: Bounds check restore token before swap
riscv: Add ERRATA_MIPS_P8700_WFI to replace WFI with mips.pause
selftest: riscv: test vectorized user copy
riscv: vector: refactor context switch for kernel-mode vector
riscv: do not read csr in vector context switch
...
|
|
KTAP coverage for clone3(CLONE_VM|CLONE_PIDFD) with a bad pidfd
pointer: sixteen failures must not grow the parent's GCS VMA count.
Assisted-by: LLM
Signed-off-by: Iván Ezequiel Rodriguez <ivanrwcm25@gmail.com>
Reviewed-by: Mark Brown <broonie@kernel.org>
Tested-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
|
|
messes with devices and drivers"
This reverts commit fcbfaffee51a452cc8efcbaa3b88ec4595678424.
Turns out that vfio is a crazy beast and people have been "relying" on
the bind/unbind debugging feature as a way to handle passing through
devices to guest instances. Because of this (https://xkcd.com/1172/),
let's revert the feature for now until we can figure out a more agreeable
way to handle this such that normal workflows do not taint the kernel.
Odds are something like what Uwe proposes at:
https://lore.kernel.org/lkml/cover.1790612298.git.u.kleine-koenig@baylibre.com/
will be the best way forward and will be revisited after for after 7.4.
The feature was originally intended to stem the flow of unnecessary
fuzzing reports of "broken" drivers where random devices were being
bound to random drivers and of course things were going wrong. The main
syzbot tool is now not doing this anymore, and hopefully no one else
starts it up again (but in this madness of LLMs these days, you can't be
sure.)
Thanks to everyone for telling me just how wrong I was to implement
this, I appreciated the feedback :)
Link: https://lore.kernel.org/all/DLIL9H50MALI.3JROXYEEUM3KU@kernel.org/
To: Jonathan Corbet <corbet@lwn.net>
To: Shuah Khan <skhan@linuxfoundation.org>
To: Randy Dunlap <rdunlap@infradead.org>
To: "Rafael J. Wysocki" <rafael@kernel.org>
To: Danilo Krummrich <dakr@kernel.org>
To: Johan Hovold <johan@kernel.org>
To: Steven Rostedt <rostedt@goodmis.org>
To: Masami Hiramatsu <mhiramat@kernel.org>
To: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Reported-by: Leon Romanovsky <leon@kernel.org>
Reported-by: Jason Gunthorpe <jgg@ziepe.ca>
Reported-by: Michal Pecio <michal.pecio@gmail.com>
Reported-by: "Uwe Kleine-König" <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/20261028-bind_taint-revert-v1-1-7c6b9cef30c9@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Revert the change in Documentation/admin-guide/tainted-kernels.rst.
- Danilo ]
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux
Pull Rust fixes from Miguel Ojeda:
"Toolchain and infrastructure:
- Fix 'objtool' warnings for the upcoming Rust 1.101.0 (expected
2026-12-24) by adding one more 'noreturn' function
'kernel' crate:
- Fix KCFI failures on every call from C to Rust IRQ handlers and
'hrtimer' callbacks by giving the C enum bindings the correct
'cfi_encoding'. Also prevent the same issue for DMA callbacks
taking 'dma_data_direction'
- 'workqueue' module: fix a runtime warning when queueing work on the
deprecated 'system_wq' by switching to 'system_{percpu,dfl}_wq'"
* tag 'rust-fixes-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:
rust: dma: declare cfi_encoding for dma_data_direction
rust: hrtimer: declare cfi_encoding for hrtimer_restart
rust: irq: declare cfi_encoding for irqreturn
objtool/rust: add one more `noreturn` Rust function for Rust 1.101.0
rust: workqueue: replace deprecated system_wq with system_{percpu,dfl}_wq
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Jakub Kicinski:
"Current release - new code bugs:
- mctp: usblib: fix assertion breaking esoteric builds
Previous releases - regressions:
- Revert advertising the TCP MSS from the configured MTU
- netlink: check sk_rcvbuf before charging the dump skb
- eth:
- ti: am65-cpts: fix support for PTP_EXTTS_REQUEST2 ioctl
- mlx4: always create the eth and ib auxiliary devices
- tg3: invert restart quirk logic to restrict SNP power-down bypass
- bnxt: recycle agg buffers when Rx head buffer allocation fails
Previous releases - always broken:
- net: fix frag_list leak in skb_segment_list() error path
- sctp: reject forged cookie peer_addr with unknown address family
- vxlan: keep reserved_bits across changelink
- net: limit priority VLAN untag depth
- inet: frags: prevent acceptance of partially authenticated reassembly
- gro: do not GRO GSO packets with inconsistent payload
- tcp: avoid double destroy in tcp_abort() of an unaccepted child"
* tag 'net-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (137 commits)
tun: drop batched packets while the device is down
selftests: net: netlink-dumps: start a dump with a notification queued
netlink: check sk_rcvbuf before charging the dump skb
net/sched: act_ife: do not consume the inner header on egress
openvswitch: use eth_type_trans_careful() in internal_dev_recv()
net: use eth_type_trans_careful() in __dev_forward_skb2()
loopback: use eth_type_trans_careful()
net: add eth_type_trans_careful()
tcp: initialize mapped children before route lookup
tcp: fix reordering addition overflow in MTU probing
tcp: avoid double destroy in tcp_abort() of an unaccepted child
net: bgmac: fix TX DMA unmapping and slot cleanup
gro: do not GRO GSO packets with inconsistent payload
net/packet: check TX_RING fragments before memory accounting
eth: bnxt: hand XDP frags over to the copybreak skb
eth: bnxt: free XDP frags when xdp_do_redirect() fails
eth: bnxt: don't leak buffers when XDP agg buffer allocation fails
eth: bnxt: resize Rx head buffers when rx-copybreak changes
eth: bnxt: recycle agg buffers when Rx head buffer allocation fails
netdev-genl: ignore NETDEV_UNREGISTER rebroadcasts
...
|
|
Pull bpf fixes from Alexei Starovoitov:
- Remove BPF_F_ARENA_SCALAR flag and .arena.data section in libbpf that
were added for rust-bpf in this merge window. We found a cleaner
approach that does it on compiler side instead of kernel/libbpf. No
released kernel has them (Alexei Starovoitov)
- Fix bpf_send_signal_task() returning -EPERM when it is called from a
kernel thread (Aditya Sharma)
- Various fixes (Alexei Starovoitov):
- Use emit_rsb_call() to call bpf_unwind_target() in x86 JIT to fix
objtool warning during the build
- Fix scalar evolution: clear delta of a widened register, don't
widen a pointer to a buffer, don't clamp a register whose type
changed in the loop, and reset the range of a clamped packet
pointer
- Finish the insn in the state that maybe_fork_scalars() splits
off, so that pruning doesn't drop it at the head of a counted
loop
- Preserve the registers that carry stack arguments across
arch_bpf_timed_may_goto() on x86-64, arm64 and riscv64
- Don't re-sort subprog_info[] for every new subprogram
- Fix flaky map_kptr and rcu_reentry selftests
- Use memmove() in bpf_skb_load_bytes(), bpf_skb_load_bytes_relative()
and bpf_xdp_load_bytes(), since the destination can be a slice of the
same packet (Ayushman Rout)
- Fixes and follow-ups for scalar evolution: reject pointer operands in
32-bit recurrences and latches, don't intersect with the current
register range on clamp to avoid a false 'verifier bug', avoid false
infinite loop reports, and recognize a 32-bit copy of the induction
variable (Eduard Zingerman)
- Fix out-of-bounds write to btf->types[] for split BTF and propagate
btf_add_type() errors in btf_check_all_metas() (Feng Yang)
- Fix use-after-free in bpf_timer callback that fires after its inner
map was freed (Mani Tofigh)
- Fix x86 JIT stopping before jumps converge: size backward jumps by
the insns they jump over (Mykyta Yatsenko)
- Fix use-after-free of struct_ops trampoline: dissociate struct_ops
progs before the grace period of the map (Qiliang Yuan)
- Validate stack argument reads against the caller state to fix
out-of-bounds read in the verifier, and reject callbacks with stack
arguments (Weiming Shi)
- Tie borrowed iterator results and pointers loaded from trusted fields
to the lifetime of their source, so that iterator next, destroy and
reference release invalidate them (Xu Yunxiang)
* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (48 commits)
bpf: Don't re-sort subprog_info[] for every new subprogram
bpf: Fix out-of-bounds btf->types write for split BTF
selftests/bpf: Test stack arguments across may_goto
bpf: Keep stack arguments in arch_bpf_timed_may_goto()
selftests/bpf: Test maybe_fork_scalars() at the head of a counted loop
bpf: Finish the insn in the state that maybe_fork_scalars() splits off
selftests/bpf: Test the clamp of pointers in scalar evolution
bpf: Reset the range of a packet pointer that scalar evolution clamps
bpf: Don't clamp a register whose type changed in the loop
selftests/bpf: Test a loop that moves a pointer to a buffer
bpf: Don't widen a pointer to a buffer in scalar evolution
selftests/bpf: Avoid a page fault in rcu_reentry while the handler is armed
selftests/bpf: Wait for the last maps of map_kptr to be freed
selftests/bpf: Test that a widened register is not linked
bpf: Clear delta of a register that scalar evolution widens
bpf, x86: Remove r0_on_stack from fetching atomics in arena
bpf: Remove BPF_F_ARENA_SCALAR
selftests/bpf: Remove tests for arena access through numbers
libbpf: Keep format strings of bpf_printk() in .rodata
libbpf: Remove .arena.data
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux
Pull more documentation updates from Jonathan Corbet:
"A handful of late-arriving changes, most of which were ready ahead of
the merge window:
- More Portuguese translation updates
- Some docs-build and self-test fixes
- Bring documentation for the user-space access primitives
in include/linux/uaccess.h into the docs build.
This revealed a number of malformed kerneldoc comments,
which are fixed in a subsequent tweak to uaccess.h"
* tag 'docs-7.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux:
uaccess: fix some erroneous kerneldoc comments
docs/translations/pt_BR: admin-guide: add efi-stub.rst
docs/translations/pt_BR: admin-guide: add kernel-parameters.rst
docs/translations/pt_BR: admin-guide: add bootconfig.rst
docs/translations/pt_BR: admin-guide: add perf-security.rst
docs/translations/pt_BR: admin-guide: add LSM/index.rst
docs/translations/pt_BR: admin-guide: add hw-vuln/index.rst
docs/translations/pt_BR: admin-guide: add cputopology.rst
docs/translations/pt_BR: admin-guide: add sysctl/index.rst
docs/translations/pt_BR: admin-guide: add sysfs-rules.rst
docs/translations/pt_BR: admin-guide: add features.rst
docs: pt_BR: process: translate userspace debugging guide
docs: kerneldoc.py: preserve headings in kernel-doc output
docs: xforms_lists: Handle DECLARE_KHOSER_PTR() struct members
docs: test_doc_build: don't select urllib3 yanked version
docs: test_doc_build: address pylint warnings
docs: test_doc_build: update it to support newer Sphinx versions
docs: test_doc_build: better handle python version
docs: admin-guide: Fix typo in kernel-parameters.txt
docs: core-api: include documentation from linux/uaccess.h
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext
Pull sched_ext fixes from Tejun Heo:
"This is a big pull for fixes, but much of it was in the works before
the merge window.
Most of these fixes are in sub-scheduler support, which nests BPF
schedulers under a parent that hands them CPUs. It was heavily
reworked over recent cycles and is now functionally complete. Porting
real schedulers on it drove the latest additions and keeps finding
corner cases.
For example, once CPUs are shared and can be taken back, the kernel
must keep every task moving when its scheduler can't run it or is
failing, and those fallbacks interact subtly with each other and with
other new core features.
- The fallback paths meant to keep a task moving when its scheduler
can't run it or is failing could themselves leave it stuck
- The stall watchdog could blame a scheduler for time it wasn't
responsible for, even taking down all of sched_ext
- Sub-schedulers were told late, or not at all, which CPUs they could
use
- Deferred callbacks could stay queued or be dropped under core
scheduling and proxy execution, with a sched/core fix to the
duplicate check
- Hardening: tracing programs can no longer call kfuncs that could
deadlock the CPU"
* tag 'sched_ext-for-7.4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: (34 commits)
sched_ext: Reject scx_bpf_sub_grant/revoke() in tracing programs
sched_ext: Fix the rescue overload pick ejecting the wrong sub under bypass
sched_ext: Fix use-after-free of a NONE rescuee leaving its sched while running
sched_ext: Fix a lone IMMED task waiting behind a kept prev
sched_ext: Fix queued bypassed tasks stalling when the host loses SCX_CAP_BASE
sched_ext: Let the bypass load balancer move tasks homed on other cpus
sched_ext: Factor out bypass_lb_move() and insert with the donor DSQ unlocked
sched_ext: Fix the bypass load balancer stranding tasks on cpus where the host lacks SCX_CAP_BASE
sched_ext: Fix bypassed tasks stalling when the host lacks SCX_CAP_BASE
sched_ext: Expire prev's slice in dispatch_one() under bypass
sched_ext: Fix a cpu idling after put_prev_task_scx() queues its task on the local DSQ
sched_ext: Refuse extending a kernel slice
sched_ext: Mark the rescue grant as a kernel slice with SCX_TASK_KERNEL_SLICE
sched_ext: Fix a cpu idling with a runnable rescuee
sched_ext: Restore a rescuee's slice after ops.stopping()
sched_ext: Fix rescue served time disagreeing with the slice under proxy execution
sched_ext: Move refill_task_slice_dfl() below apply_slice_vtime()
sched_ext: Fix bypassed tasks looping on a host without SCX_CAP_ENQ
sched_ext: Fix bypassed tasks stranded by the reenqueue limit
sched_ext: Clear holding_cpu where the claim is confirmed
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
Pull cgroup fixes from Tejun Heo:
- cgroup.kill did not kill a process whose thread group leader had
exited while other threads still ran, nor those threads once moved to
another cgroup, letting a process survive its container being killed
- A cgroup.procs write under favordynmods could migrate a newly forked
process before fork linked it to its cgroup, corrupting cgroup task
lists
- cpuset partition fixes for nested hierarchies: invalidation, revival,
shrinking and switches between root and isolated could leak isolated
CPUs, skip or miscompute the housekeeping check, or leave wrong
effective CPUs:
- A root partition can no longer be created under an isolated
parent or stay valid under one, as disabling it could leave no
housekeeping CPUs
- Enabling a partition failed when a grandchild held tasks,
although the parent had none of its own
- Separately, an allocation racing with a cpuset.mems update could
drop its mempolicy nodemask and land on the wrong node, and a
memoryless node in cpuset.mems triggered a spurious "movable
nodes only" warning
- Two no-functional-change cleanups of the effective CPU
computation
* tag 'cgroup-for-7.4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: (27 commits)
cgroup/cpuset: Integrate compute_partition_effective_cpumask() into compute_effective_cpumask()
cgroup/cpuset: Relocate compute_*effective_cpumask() and compute_effective_nodemask()
cgroup/cpuset: Release invalid isolated CPUs with a shrunk root partition parent
cgroup/cpuset: Release invalid isolated CPUs in compute_partition_effective_cpumask()
cgroup/cpuset: Make sure compute_partition_effective_cpumask() is only called for valid partition
cgroup/cpuset: Prevent recursive call of remote_cpus_update() via update_cpumasks_hier()
selftests/cgroup: Check for a single range nohz_full CPUs before running test matrix
cgroup/cpuset: Minor fixes to prstate_housekeeping_conflict()
cgroup/cpuset: Fix incorrect effective_cpus bug in update_cpumasks_hier()
cgroup/cpuset: Properly compute effective xcpus in update_parent_effective_cpumask()
cgroup/cpuset: Find furthest isolated ancestor for invalidated isolated partition
cgroup: don't kill migrated processes through their exiting threads
cgroup/cpuset: check effective mems for a movable-only configuration
cgroup/cpuset: Fix task checking when enabling a partition
cgroup: serialize migrations of newly forked processes
selftests/cgroup: test cgroup.kill with an exited thread group leader
cgroup: fix cgroup.kill for exited thread group leader
selftests/cgroup: Skip test_cpuset_prs.sh test if some required CPUs are offline
selftests/cgroup: Add tests for nohz_full housekeeping check
selftests/cgroup: Add tests for isolcpus housekeeping check
...
|
|
Add a test which starts a link dump on a socket with SO_RCVBUF 2048
while a link notification is still queued, after a large read made the
kernel attempt large dump skbs. It reads like libnl does, peeking
before each read, and expects the dump to complete with a zero status
and at least one link. The notifications come from bringing lo up and
down, so the test runs in its own netns and is skipped without the
privileges to create one.
The test fails without the previous patch.
Signed-off-by: Jhonata Poma-Hansen <jhonata.poma@gmail.com>
Link: https://patch.msgid.link/20261027-netlink-dump-livelock-v2-2-c4bb05352a33@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
A tc egress BPF program can push a tiny link-layer header with
bpf_skb_change_head() on an skb whose head is almost empty, then
redirect it to an Ethernet device ingress. __bpf_redirect_common()
only checks mac_header < network_header, and __dev_forward_skb2()
crashes in eth_type_trans():
tc filter add dev lo egress pref 1 matchall action vlan pop_eth continue
tc filter add dev lo egress pref 2 bpf da obj prog.o
# prog: bpf_skb_change_head(skb, 1, 0);
# return bpf_redirect(veth1_ifindex, BPF_F_INGRESS);
# AF_PACKET SOCK_RAW on lo: eth / eth / 8192 bytes of payload
kernel BUG at include/linux/skbuff.h:2839!
RIP: 0010:eth_type_trans (include/linux/etherdevice.h:635 net/ethernet/eth.c:163)
Call Trace:
__dev_forward_skb2 (net/core/dev.c:2507)
dev_forward_skb_nomtu (net/core/dev.c:2546)
__dev_queue_xmit (net/core/dev.c:4738 net/core/dev.c:4998)
packet_sendmsg (net/packet/af_packet.c:3157 net/packet/af_packet.c:3189)
Use eth_type_trans_careful(), and drop the packet if the Ethernet
header can not be pulled. This also covers other dev_forward_skb()
users (veth, macvlan, ipvlan, netdevsim, l2tp_eth).
Update the empty_skb BPF selftest: at lwt_xmit, BPF_PROG_TEST_RUN
strips the Ethernet header, so the "veth ETH_HLEN+1" packet is a 1-byte
skb. Redirecting it to veth ingress used to read the Ethernet header
past skb->tail and deliver a 1-byte frame; it is now dropped with
NET_RX_DROP, as veth_xmit() already does at egress.
Fixes: 3a0af8fd61f9 ("bpf: BPF for lightweight tunnel infrastructure")
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com>
Tested-by: Jamal Hadi Salim <jhs@mojatatu.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20261028122703.2093730-4-edumazet@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
With -r (SOCK_RAW, IPPROTO_UDP) the test writes only the UDP header and
payload, and the kernel adds the IP header. get_udp_csum() still expects
the IP source and destination addresses to directly precede the UDP
header, and reads 2 * alen bytes before the start of the buffer: 8 bytes
for IPv4, 32 bytes for IPv6.
ASan reports a heap-buffer-overflow for both -4 -r and -6 -r. Without
ASan the read usually goes unnoticed, but it faults when the buffer is
the first chunk in the heap. That happens on Ubuntu 26.04, where the
kselftest runner wraps the test in uutils stdbuf, and txtimestamp.sh
fails with SIGSEGV on every run.
Even without a crash, -r packets were sent with a checksum computed
over unrelated heap memory, so their UDP checksum was invalid.
Build the pseudo-header from the destination address and checksum only
the UDP header and payload. -R and -P already write daddr as both the
source and destination address, so their checksums are unchanged. With
-r the kernel selects the source address, which equals daddr for the
loopback addresses used by txtimestamp.sh.
Fixes: b52354aa068e ("selftests: expand txtimestamp with ipv6 dgram + raw and pf_packet")
Signed-off-by: Jamie Nguyen <jamien@nvidia.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>
Link: https://patch.msgid.link/20261027162945.2122306-1-jamien@nvidia.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
|
current_hweight() publishes the cache generation and both weights with
separate stores. Refreshers running on different CPUs can interleave
their stores and leave a new generation paired with weights from an older
calculation. The compiler can also reorder the generation store before
the weight stores, so a reader that sees the new generation can accept
stale weights.
A stale weight is not only a reporting artifact. It feeds the cost
calculation and the donation logic, where an inconsistent combination can
lead to a zero divisor in transfer_surpluses().
In addition, the slow path rereads iocg->hweight_active/inuse after
publishing them, so the value it returns can be the one written by another
refresher instead of the locally computed one.
Pack the generation and both weights into a single atomic64_t and publish
them with one atomic write. Readers take one atomic snapshot and return
the local values. Weights are in [1, WEIGHT_ONE]; storing each minus one
preserves the full range in 16 bits and leaves 32 bits for the generation.
The two weight fields remain as the donation workspace used under
ioc->lock. Tracepoints decode the packed cache without refreshing it and
iocost_monitor.py is updated accordingly.
Developed with assistance from Claude Code (Anthropic): the assistant
drafted the packed representation, the helpers and the tracepoint/monitor
changes, and ran the checks listed below. The author reviewed the result
and remains responsible for it.
Fixes: 7caa47151ab2 ("blkcg: implement blk-iocost")
Signed-off-by: Kunhai Dai <daikunhai@didiglobal.com>
Tested-by: Tao Cui <cuitao@kylinos.cn>
Reviewed-by: Tao Cui <cuitao@kylinos.cn>
Acked-by: Tejun Heo <tj@kernel.org>
Link: https://patch.msgid.link/20261019125412.3123895-3-daikunhai@didiglobal.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
|
|
Check that the exec securebits survive creating a user namespace with
unshare(CLONE_NEWUSER) and joining one with setns():
- both bits with their locks, which can't be changed in there
- both bits without their locks, which can still be cleared in there
- only the locks, which keep the bits from being set in there
The other securebits are reset as before.
Link: https://patch.msgid.link/20261026-work-securebits-userns-v1-2-b35473fa1a34@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
|
|
Every existing splice call in this file either passes
SPLICE_F_NONBLOCK or runs on a blocking socket, so nothing
exercises the socket's own O_NONBLOCK on the splice path. A change
that stops consulting sock->file->f_flags puts splice(2) and
sendfile(2) back to sleeping in tls_rx_rec_wait(), and the suite
still reports pass.
Splice from a nonblocking socket without SPLICE_F_NONBLOCK, first
with no record queued, which must return EAGAIN, then with a record
to deliver. A kernel that ignores the socket flag sleeps until the
harness timeout rather than returning.
Signed-off-by: Chuck Lever <cel@kernel.org>
Link: https://patch.msgid.link/20261027015215.605919-3-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
exceptions"
This reverts commit e5c8e301b497 ("selftests: net: packetdrill: add
tests for advertised MSS with PMTU exceptions").
These tests assert the behaviour introduced by commit 2640e6419594
("net: advertise TCP MSS from the configured MTU, not the learned
PMTU"), which is reverted in the next patch because it causes a
regression. Remove them first so the series stays bisectable.
Signed-off-by: Yongjian Wang <echoowall@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@kernel.org>
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Link: https://patch.msgid.link/20261026-advmss-revert-v1-1-272fa4b7ecb6@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD
KVM/arm64 fixes for 7.4, take #1
- Fix a couple of embarrassing merge mistakes in kvmarm-7.4
- Cleanup the HCR_EL2 bit fields to exclusively use the generated
definitions, fixings a nasty regression introduced in 6.16, where
barriers were not upgraded from NSH to ISH anymore
- Fix publication of state when a vcpu is forced out of the guest
- Let vcpu pausing nest correctly
- Sanitise ID_AA64MMFR3_EL1.S1P[IO]E to follow the rules of the architecture
- Don't warn on SMCCC filter reserved range allocation failure
- Prevent GICv5 and TLBI hypercalls to be used from the host when pKVM
is active
- Enforce that only GICv3 guests are supported for pKVM
- Don't try to access GICv5 EL2 sysregs from EL1
- Compute architectrally correct values for ID_AA64MMFR3_EL1.S1P[IO]E
by checking the feature dependencies
- Require matching VGIC and ITS model
- Cleanup TRACE_REMOTE dependencies
- selftests: Skip unwritable ID fields in the failed-run test
- Move pkvm_selftests() after all CPUs have initialized EL2
- Fix random comments
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86
Pull x86 platform driver updates from Ilpo Järvinen:
"The usual updates for laptop quirks from HP, ASUS, Acer, Dell etc:
- new model names and recent CPU support
- more special button / function key handling
- battery and hardware monitoring quirks
Tool updates to intel-speed-select
WMI now supports non-x86 architectures
Miscellaneous cleanups / refactoring / improvements"
* tag 'platform-drivers-x86-v7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (237 commits)
platform/x86: asus-wmi: name the TUF keyboard RGB state and speed codes
platform/x86: asus-wmi: fix TUF keyboard power state shutdown naming
platform/x86: asus-wmi: rename TUF RGB state DEVID to _CMD
platform/x86: asus-armoury: add power limits quirk for GU605CM
platform/x86: asus-armoury: add power limits quirk for G533QS
platform/x86: asus-armoury: add power limits quirk for GA402NV
platform/x86: asus-armoury: add power limits quirk for FA608UP
platform/x86: asus-armoury: add power limits quirk for FA608UH
platform/x86: asus-armoury: add power limits quirk for FA608PM
platform/x86: asus-armoury: add power limits quirk for G713QR
platform/x86: ibm_rtl: Fix potential OOB read at signature search
platform/x86: acer-wmi: Add support for Acer Nitro AN16-41
platform/x86: acer-wmi: Cycle platform profile on mode key 0x4
platform/x86: hp-wmi: Disable hwmon attributes when no fans are usable
platform/x86: gpd pocket fan: Cancel work before releasing GPIOs
platform/x86: asus-armoury: Add XBOX ROG Ally X 20 Tunables
platform/x86: msi-wmi: Ignore WMI events for keys also handled by atkbd
platform/x86: msi-wmi: Sort scancodes numerically
platform: arm64: Add a driver for the EC found on ASUS Glymur machines
MAINTAINERS: Add myself as a LENOVO drivers co-maintainer
...
|
|
Each test passes arguments 6-8 on the stack. Thus it uses all the registers
in which the JITs of x86-64, arm64 and riscv64 pass stack arguments.
may_goto then
------------------------------------------- ---------------------------
70000 iterations in the callee the callee reads the args
the time is up in the callee the callee reads the args
70000 iterations in the caller, after the the caller calls the callee
writes of the args
70000 iterations have one look at the clock. Without the fix on x86-64 the
second test fails, and the first test fails with the hpet clocksource. The
third test passes there. The result depends on the registers that the C
code uses.
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261027190314.1440199-20-alexei.starovoitov@gmail.com
|
|
The insn that forks is the head of a loop that scalar evolution counted.
The state with 0 that maybe_fork_scalars() splits off is within the state
that is kept at the head. The access is out of bounds only in the state
with 0.
Without the previous patch the verifier accepts the prog.
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261027190314.1440199-18-alexei.starovoitov@gmail.com
|
|
test the loop result
-------------------------------------- ------------------------- ------
clamp_released_pointer releases ringbuf memory reject
clamp_invalidated_pkt_pointer calls bpf_skb_pull_data() reject
clamp_pkt_pointer_keeps_no_range compares with pkt_end reject
clamp_pkt_pointer_keeps_range_of_entry has no compare loads
In the first three tests a flag in a 32-bit spill separates the first
iteration from the second one. Scalar evolution does not widen the flag.
Thus the verifier does not prune the state that returns to the head of the
loop, and it verifies the second iteration with the clamped register.
Without the fixes the three progs load.
In the last test the compare with pkt_end is in front of the loop. Its
range must stay valid in the loop.
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261027190314.1440199-16-alexei.starovoitov@gmail.com
|
|
ptr_buf moves one pointer to a buffer until it gets to a second pointer. It
never reads through the pointer. It loads only if scalar evolution widens
the pointer, and that is no longer the case.
Change it to the loop that real progs have, for example
bpf_iter_bpf_percpu_array_map.c. It counts in a register and reads through
the pointer in each iteration. Without
"bpf: Don't widen a pointer to a buffer in scalar evolution" the verifier
rejects it with "invalid variable buffer offset".
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261027190314.1440199-13-alexei.starovoitov@gmail.com
|
|
The test arms a handler at rcu_segcblist_enqueue() for its thread. Then it
deletes an element of a task storage map. The delete gets to
rcu_segcblist_enqueue(), and the handler does a nested delete there.
The handler fires at the first rcu_segcblist_enqueue() in the thread. A
page fault can be the first:
skel->bss->target_pid = tid the handler is armed
the next insn is in a page that is not in memory
asm_exc_page_fault
filemap_fault
v9fs_issue_read
p9_req_put
irq_work_run
rcu_defer_drain
rcu_segcblist_enqueue
the handler deletes the element
bpf_map_delete_elem() -ENOENT
test_rcu_reentry:FAIL:boot_delete unexpected error: -2 (errno 2)
The result depends on the layout of test_progs. In the binary that failed,
test_rcu_reentry() crosses the end of a page immediately after the store.
This binary fails each time when it is on 9p. A copy of the same file on
ext4 passes.
Move the store and the delete to a function. Call it one time without a pid
and with a bad fd. This call brings the text and .bss into memory, and it
does not arm the handler.
Fixes: 0464f587c61a ("selftests/bpf: Add a call_srcu() re-entry reproducer")
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261027190314.1440199-11-alexei.starovoitov@gmail.com
|
|
map_kptr_race/htab_leak fails occasionally in a complete run of test_progs:
test_htab_leak:FAIL:htab refcount unexpected htab refcount:
actual 6 != expected 2
This is a race between two tests. It is not a leak in the kernel.
- map_kptr runs immediately before htab_leak. The two tests examine the
refcount of the same test object.
- The kernel frees maps asynchronously. Thus the maps drop their
references some time after close().
- map_kptr waits for that after each subtest, but not after the last one.
Wait after the last subtest too.
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261027190314.1440199-10-alexei.starovoitov@gmail.com
|
|
Scalar evolution widens a register that has delta 4. Then the prog copies
the register. With the stale delta the verifier finds that a read of
uninitialized r9 is dead code, and it loads the prog. See
"bpf: Clear delta of a register that scalar evolution widens".
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261027190314.1440199-9-alexei.starovoitov@gmail.com
|
|
Rust has no address spaces. Thus a prog in Rust accesses arena through
scalars. With BPF_F_ARENA_SCALAR the verifier accepts each load and each
store through a scalar as an access to arena.
The verifier rewrites one insn at a time. Thus it must add one insn to each
access. The compiler knows the source of each pointer. It can emit one
addr_space_cast for each pointer, as it does for the __arena pointers of C.
flag: one move for each access cast: one cast for each pointer
ax = (u32)r1 r1 = addr_space_cast(r1, 0, 1)
r2 = *(u64 *)(ax + 0) r2 = *(u64 *)(r1 + 0)
ax = (u32)r1 r3 = *(u64 *)(r1 + 8)
r3 = *(u64 *)(ax + 8)
20 progs of rust-bpf, with the flag and with the casts that a prototype of
an LLVM pass emits:
flag casts
moves or casts 1568 571
insns 14864 13938
jited bytes 72351 69111
No released kernel has the flag. LLVM does not emit the casts for Rust at
this time. Until it does, Rust progs that access arena do not load.
scx_mavd and scx_nitosis set the flag too. They are experimental schedulers
in C in sched-ext/scx, and they use the flag to omit __arena. They must use
__arena again.
This reverts commit 4c651a91bdfc
("bpf: Treat load and store through a number as arena access"). One part
stays: BPF_REG_AX in reg2pt_regs[] of the x86 JIT. The fetching AND/OR/XOR
atomics in arena use it now.
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261027190314.1440199-6-alexei.starovoitov@gmail.com
|
|
With BPF_F_ARENA_SCALAR the verifier accepts a load or a store through a
scalar as an access to arena. The next patch removes the flag. Remove its
tests.
Keep one test. Without the flag the verifier must reject such a load, also
in a prog that has an arena. Move this test to verifier_arena.c.
The removed tests were the only tests of a special path in the x86 JIT for
the fetching AND/OR/XOR atomics. Only the flag used that path.
arena_atomics tests the usual path.
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261027190314.1440199-5-alexei.starovoitov@gmail.com
|
|
The format strings of bpf_printk() moved from .rodata to .rodata.str for
one reason. .arena.data moved .rodata into arena, and helpers cannot read
strings from arena.
.arena.data is removed. Move the strings back to .rodata. As a result, an
object that has its own .rodata has one map less.
This reverts commit 373e1223ff00
("libbpf: Keep format strings of bpf_printk() in .rodata.str"). libbpf
1.8.0 has the strings in .rodata.
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261027190314.1440199-4-alexei.starovoitov@gmail.com
|
|
Rust has no address spaces. Thus a global variable cannot have the __arena
attribute. The .arena.data section was a workaround. It told libbpf to do
two things:
- Move .data, .bss and .rodata into arena.
- Load the progs with BPF_F_ARENA_SCALAR.
The compiler must select the location of a variable, not libbpf. libbpf
already puts the .addr_space.1 section in arena. The __arena variables of C
are in this section, and LLVM can use it for Rust too. Until LLVM does
that, the global data of Rust progs stays in array maps.
This reverts commit 8ab58ed42b08 ("libbpf: Keep global data in arena when
the object has .arena.data"). libbpf 1.8.0 does not have the section.
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261027190314.1440199-3-alexei.starovoitov@gmail.com
|
|
The .arena.data section and the BPF_F_ARENA_SCALAR flag let a prog in Rust
keep its global data in arena. The subsequent patches remove the two,
because the compiler can do this work. First remove the tests for
.arena.data.
One of the tests is a prog in Rust. It has no replacement, because LLVM
does not put the globals of Rust in arena at this time. No other selftest
is in Rust. Thus also remove the makefile rules that build Rust.
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261027190314.1440199-2-alexei.starovoitov@gmail.com
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull tracing updates from Steven Rostedt:
- Add "within" to filter logic
Add a way to trace events by what function they fall in.
echo 'within == "vfs_read" > events/sched/sched_switch/filter
Will only trigger sched_switch events that happen within the vfs_read
function. It uses a stacktrace at the event and checks if any entry
is within the specified function and if so, it prints the event.
- Remove a duplicate definition of ftrace_set_clr_event() from the
header
- Do not have ftrace_set_clr_event() modify its input buffer
Have the buffer passed into ftrace_set_clr_event() to be const char *
and not allow modifications to it that might cause side effects.
- Add kunit tests for ftrace_parse_event_string()
- Add filter argument to __ftrace_set_clr_event()
Make it possible to set a filter on an event at the same time it is
enabled.
- Add event filtering logic to the kernel command line
To allow filtering events on boot, allow filtering to be specified on
the kernel command line when enabling events.
- Rename "ring_buffer_size()" to "ring_buffer_capacity()"
"size" refers to how much is allocated whereas the actual return
value is the amount of available data in the ring buffer minus its
meta data.
- Rename "trace_array_entries" to "trace_array_capacity"
There's several functions that use "entries" and returns the amount
of data that that is usable. "entries" should be only for the number
of events, not the amount of data.
- Print the histogram "bucket" size as unsigned.
If a bucket size is LONG_MAX, then it shows up as a negative number.
- Show bucket size in output of histograms
The output of what the histogram is shown doesn't show the size of
the buckets when buckets are used. The output should be the same as
the input and since specifying buckets without a size is an invalid
command, the output to display what was entered should also show the
size.
- Fix stacktrace modifier output
Only show the stacktrace modifier when it was specified in creation.
- Unregister filed variable histograms when the command fails
If one histogram references a variable of another histogram it
registers that other histogram. But if the first histogram fails in
setup after it registered the other histogram it doesn't unregister
it. Have the first histogram add the reference to the other histogram
so the failure clean up will unregister the second histogram too.
- Fix 64-bit signed histogram fields on 32-bit kernels
A fix to convert char * to u64 with added casting also incorrectly
added an intermediate cast to convert a long value to u64 which ended
up truncating the upper 32 bits for 32-bit kernels. Remove the
intermediate typecast.
- Print signed histogram keys as signed
Histogram keys were being printed as unsigned and with signed keys it
was giving the wrong output.
- Use copy_from_user() and not __copy_from_user() in syscall tracing
The syscall tracing incorrectly was using __copy_from_user() which
could be an issue if the system trusts perf doing the trace.
- Take trace_types_lock when recording a new module in persistent
buffer
When a new module is loaded, the persistent ring buffer saves it in
its persistent memory. All the trace_arrays are iterated looking for
any persistent buffer to add the module to. But it did not hold the
trace_types_lock meaning a trace_array could be added or removed
while iterating the list.
- Only create tracepoint guest_halt_poll_ns when it is used
The tracepoint guest_halt_poll_ns is defined in the power management
code but it is only used when CONFIG_CPU_IDLE_GOV_HALTPOLL is
enabled. This wastes memory when that config isn't enabled so wrap
the tracepoint around that as well.
- Handle empty fields for events in trace_event_get_offsets()
The user events could have empty fields and this causes
trace_event_get_offsets() to crash as it expects events to always
have fields. Make the function handle events with no fields.
- Reject incomplete event filter expressions
If a filter has an incomplete expression (common_pid == 1111 || ), it
will cause a out-of-bounds bug. Have the predicate_parse() only
process the expression if it is complete.
* tag 'trace-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (27 commits)
tracing: Reject incomplete event filter expressions
tracing: Guard trace_event_get_offsets() against an empty fields list
cpuidle: haltpoll: Only define guest_halt_poll_ns tracepoint when used
tracing/osnoise: Add __printf attribute to osnoise_print()
tracing/histograms: Verify event_call identity when updating synth_event refcount
tracing: Save the event file instead of the compatible histogram
tracing: Hold trace_types_lock when resetting last boot data from readers
tracing: Hold trace_types_lock when updating modules in persistent instances
tracing/syscalls: Use copy_from_user for the faultable syscall buffer
tracing: Print a signed histogram key as signed
tracing: Fix 64-bit and signed histogram fields on 32-bit kernels
tracing: Clamp the printed end of a histogram bucket at U64_MAX
tracing: Unregister field variable histograms when the command fails
tracing: Only report the stacktrace modifier on a real field
tracing: Add the bucket size to expr_field_str()
tracing: Print the bucket size as unsigned
tracing: Rename tracing_entries_fops to tracing_capacity_fops
tracing: Rename trace_array::entries to capacity
ring-buffer: Rename ring_buffer_size() to ring_buffer_capacity()
tracing: Parse filter from boot event string
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull more MM updates from Andrew Morton:
- "mm: make VMA flag semantics explicit, eliminate VM_SPECIAL" (Lorenzo
Stoakes):
Replace VM_SPECIAL with helpers describing mapping ownership and
behavior. Enforce the mmap flag rules and convert affected drivers,
removing ambiguous tests shared by driver mappings and ordinary
memory.
- "support kselftest on nommu platform" (Hajime Tazaki):
Add opt-in mmap and mremap tests for NOMMU systems. Teach the runner
to avoid its fork-dependent timeout command and document the build
and runtime requirements.
- "mm/collapse: separate a collapse from its callers" (Kiryl
Shutsemau):
Separate huge-page collapse from caller policy. Replace khugepaged
identity checks with explicit permissions, and separate scanning from
collapse with the mmap_lock drop in one place.
- "mm: implement and use vma_has_anon_rmap(), silence KCSAN" (Lorenzo
Stoakes):
Provide a common helper for testing whether a VMA has anonymous
reverse mappings. Document the locking rules, annotate intentional
concurrent reads for KCSAN, and convert the core MM callers.
- "mm/sparse: remove SECTION_MARKED_PRESENT and further cleanups"
(David Hildenbrand):
Remove SECTION_MARKED_PRESENT in favor of the early-section flag.
Simplify sparse memory initialization, section metadata handling and
related PFN validity checks.
- "sh: remove NUMA and SPARSEMEM support" (Mike Rapoport):
Remove SuperH NUMA and SPARSEMEM support. The extra memory banks have
been unusable since the NO_BOOTMEM conversion, leaving only the code
and data overhead.
- "mm: Unify device DAX and HugeTLB vmemmap population paths" (Muchun
Song):
Unify the generic device DAX and HugeTLB vmemmap population paths and
shared tail-page handling. Remove the duplicate DAX machinery while
retaining the powerpc radix implementation.
- "kselftest: mm: fix some failure of split_huge_page_test" (Yeoreum
Yun):
Fix huge-page split tests racing with khugepaged recollapse. Use
pagemap and page flags instead of VMA-boundary assumptions which fail
when glibc has already enabled THP.
- "memcg: move memcgid refcount to objcg to unpin dying memcgs"
(Bingfang Guo):
Let dying memcgs be freed while swapped-out shmem still holds their
IDs. Move ID references to reparentable objcgs, with the necessary
swap accounting and RCU lifetime changes.
- "mm/truncate: fix data loss when truncating straddling large folios"
(Zhang Yi):
Preserve out-of-range data when truncating straddling large folios.
Fix a lookup race and split-failure handling, and handle minimum
folio orders for the forthcoming ext4 iomap buffered I/O path.
- "mm/damon: introduce damos quota goal target metric complement flag"
(SJ Park):
Let DAMOS quota goals use a metric's complement, so utilization can
also express free-memory goals without adding separate metrics. Add
the sysfs interface, documentation and tests.
- "arm64/mm: Standardize printing for pgtable entries" (Anshuman
Khandual):
Use the generic formatter for arm64 page-table entries, ready for
future wider entries. Move the safe-PTE-update check out of the
header to avoid an include cycle.
- "mm: kmsan: fix iounmap metadata teardown" (Dima Koziuk):
Fix KMSAN metadata leaks on iounmap and failed ioremap allocations.
Free backing pages before removing their mappings, and share the
teardown with partial-allocation cleanup.
- "mm/damon/core: preserve quota state when constructing schemes" (Karl
Mehltretter):
Preserve running DAMOS quota state while validating parameter
updates. Even rejected updates could reset accounting and exceed the
quota window; add tests for both accepted and rejected updates.
- "mm/vmalloc: fix vmalloc_dump_obj VA lookup" (Ye Liu):
Fix vmalloc_dump_obj() lookups for last-page addresses and
allocations spanning vmap zones. These allocations were being missed
in diagnostic output.
- "mm: various (urgent?) fixes" (David Hildenbrand):
Fix mmap charge leaks and hugetlb use-after-free, wrong-address
unmapping, stuck locks and endless faults. Also preserve reservations
on failed mremap and handle stale userfaultfd bits.
- "maple_tree: fix maple_range_64 crashes in RCU mode" (Dimitris
Charisis):
Fix pointer and metadata confusion during RCU destruction of
maple_range_64 nodes, avoiding double frees and invalid accesses. Add
a regression test; no in-tree user currently uses this combination.
- "mm: fix hugetlb NR_HUGETLB accounting on folio migration" (Hongfu
Li):
Fix hugetlb migration and preallocation accounting so /proc/vmstat
retains the correct count and memory.numa_stat follows the folio to
its new node.
- "mm/damon: fix a minor bug, clean code, and add a test" (SJ Park):
Fix 32-bit DAMON age overflow which made old regions look young.
Share hugetlb folio acquisition code and add a regression test for
the previously fixed last-region skipping bug.
- "mm/damon/core: cleanup code, reduce stack usage, and add kunit" (SJ
Park):
Reduce kdamond stack usage and remove unused enums. Add deterministic
PSI quota-goal tests which do not depend on the machine's current
memory pressure.
- "mm/damon: fix the temporal goal tuner's size quota conversion"
(Donggeun Yoo):
Bound the temporal tuner's quota conversion to prevent overflow and
zero effective quotas, which could stop schemes making progress. Add
boundary tests.
- "Don't use GFP_DMA when calling dma_alloc_coherent" (Baoquan He):
Remove redundant GFP_DMA flags from coherent DMA allocation calls.
The DMA API already selects the zone from device limits and ignores
the caller's flag.
- "kselftest: mm: fix intermittent failure khugepaged test" (Yeoreum
Yun):
Propagate child-process failures in the khugepaged tests and prevent
background collapse from racing their checks. This removes false
passes and intermittent failures.
- "MAINTAINERS: cover all hugetlb headers under HUGETLB SUBSYSTEM"
(Enze Li):
Cover all hugetlb headers in MAINTAINERS so get_maintainer.pl finds
the right maintainers. Also label the closing hugetlb_cgroup.h
include guard.
Summary of the 65 singletons in this merge:
The singletons include a few worthwhile performance fixes. Avoiding
unnecessary reverse-map tree updates gave a reported 15.9% improvement
in UnixBench's execl test on a 192-core x86 system. A reclaim retry
fix stops defrag_mode from spinning under memory.low protection; a
reported file-creation stress test ran 5.7 times faster, with far less
memory pressure. Narrower hugetlb invalidations also spare KVM guests
needless refaults: the reported Redis-in-VM P99 QPS penalty while
punching holes fell from 7.09% to 1.45%.
Several fixes prevent lost data or corrupted memory. Lazyfree
huge-page races with mremap()/munmap() could lose data or access freed
memory, and MADV_COLD could lose a concurrent write's dirty bit.
Another fix prevents stale migration entries from outliving large
folios. On filesystems with blocks smaller than a page, extending a
file by 4 GiB or more could expose bytes written past the old EOF
through mmap instead of zeroes. That is fixed, along with
use-after-free races in PAGEMAP_SCAN during process exit and in
memory-cgroup accounting on PREEMPT_RT kernels.
Other fixes stop UFFDIO_MOVE spinning forever on pinned large folios,
which could wedge other memory operations, and stop mremap() leaking
commit charges until allocations fail under strict overcommit. A
further fix keeps userfaultfd tracking intact on neighboring mappings.
NUMA binding no longer prevents long-term pins when the chosen node
has only movable memory, fixing QEMU/VFIO startup and io_uring buffer
registration failures. MGLRU also gets a fix for early-boot crashes
with memory cgroups disabled at boot, notably in small crash kernels.
* tag 'mm-stable-2026-10-25-19-27' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (213 commits)
mm: multi-gen LRU: fix NULL lruvec->pgdat deref with memcg disabled on cmdline
mm/page_counter: use WRITE_ONCE() for emin/elow when parent is the root
mm/memcontrol: publish null pointer before dropping css reference
test_maple_tree: test maple_range_64 node in RCU mode
maple_tree: fix maple_range_64 crashes in RCU mode
mm/vma: avoid broken uffd merge on mremap
tools/testing/shared: catch a failed posix_memalign()
mm/damon/core: remove unreachable damos charge_{target,addr}_from
mm/shrinker: allocate shrinker_info_unit from a dedicated kmem_cache
riscv: mm: exclude invalid THP PMDs from page table check
mm/damon/core: filter out damos address filter-split failed region
fs/proc/task_mmu: pin mm_users in do_pagemap_scan()
mm/mempolicy: apply bind policies against the scoped allocation zone
mm/vmscan: reclaim every zone in per-node proactive reclaim
mm/mremap: correctly uncharge accountable VMAs in error path
mm/mremap: populate calculated fields in vrm state correctly
MAINTAINERS: add an entry for MEMORY MANAGEMENT - MEMORY MAP
mm: bdi: reset min_ratio after the sysfs attributes are gone
mm/page_vma_mapped: continue past nonmatching huge PMDs
selftests/mm: skip hugetlb cgroup v2 tests without the needed controllers
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull non-MM updates from Andrew Morton:
- "ocfs2: exit recovery thread on mount error path" (Joseph Qi):
Stop OCFS2 recovery before freeing failed-mount state and replay
slots, closing use-after-free and double-free races. Defer
suballocator reclaim to break a transaction-lock deadlock with
dismount.
- "ocfs2: validate suballoc slot and bit of metadata blocks" (Joseph
Qi):
Validate OCFS2 metadata suballocator slots, bits and directory index
block locations. Reject corrupt metadata with filesystem errors
instead of BUGs or out-of-bounds accesses.
- "ocfs2: deal with legacy signed name hash values" (Joseph Qi):
Restore OCFS2 lookups for non-ASCII names stored with legacy signed
hashes. Use stored xattr hashes during bucket splits to avoid
duplicate entries and spurious ENOSPC failures.
- "ocfs2: stabilize dentry names in file and setattr traces" (Cen
Zhang):
Snapshot OCFS2 names during file and setattr tracing to prevent
rename races using freed storage or mismatched names and lengths.
Preserve trace formats and the locked release open-count sample.
- "panic: fix panic_force_cpu= redirect races and NMI bypass" (Bradley
Morgan):
Fix panic_force_cpu races and NMI redirection so crash-kernel CPU
selection is honored. Preserve variable arguments on failed redirects
and use a static message buffer.
- "fat: allocate multiple clusters in fallocate" (Matheus Alves de
Almeida):
Allocate FAT clusters in batches for FALLOC_FL_KEEP_SIZE and batch
FAT updates. This removes repeated single-cluster allocation
overhead, particularly on synchronous mounts.
- "scripts/gdb: fix radix tree lookup and stack depot diagnostic"
(Ting-Han Hou):
Fix GDB radix-tree lookup and its handling of XArray sibling, retry
and zero entries. Also repair the stack-depot diagnostic for an
out-of-range pool index.
- "hung_task: Improve warning budget handling and task reporting"
(Aaron Tomlin):
Reset the hung-task warning budget after recovery so later hangs
remain visible. Keep the configured limit intact and emit one summary
per scan when detailed reports exhaust the budget.
- "bootconfig: Reject unexpected data after null character and
cleanups" (Masami Hiramatsu):
Reject bootconfig data after an embedded null while accepting
trailing padding. Validate the full input in the userspace tool, and
retain internal tree sanity checks there rather than in the kernel.
- "kbuild: GCOV cleanups following the prefer-atomic fix" (Konstantin
Khorenko):
Use the actual GCOV build flags in the prefer-atomic compiler probe.
Move flag setup into scripts/Makefile.gcov and skip the probe when
GCOV is disabled.
- "ocfs2: xattr bucket validation fixes" (Joseph Qi):
Accept valid OCFS2 xattr buckets spanning 512-byte blocks, avoiding
false read-only remounts. Reject misaligned buckets and return errors
instead of panicking on corrupt defrag metadata.
- "ocfs2: fix metadata reservation for xattr value trees" (Joseph Qi):
Reserve enough OCFS2 metadata for new and relocated xattr value
trees. Fix shortfalls which could cause ENOSPC, dropped entries and
leaked clusters on fragmented filesystems; remove duplicate
reservations.
- "Introduce arch_do_panic" (Mete Durlu):
Add arch_do_panic() and move s390 and sparc handling out of generic
panic code. The architecture-specific actions now follow the
end-of-panic marker.
- "checkpatch: userspace improvements" (Petr Vorel):
Improve checkpatch's userspace detection and suppress kernel-only
checks. Recognize standard inttypes macros and add explicit
--userspace and --no-userspace overrides.
- "ocfs2: validate dr_fs_generation of dir index root blocks" (Joseph
Qi):
Check OCFS2 directory index generations and leaf block numbers.
Reject stale or misplaced blocks instead of using metadata left by a
previously formatted filesystem.
- "selftests/membarrier: Skip an unregistered memory barrier test on
Musl" (Chris Gellermann):
Skip the unregistered membarrier test when libc has already
registered the command. Musl does this during thread creation,
causing false failures in the multithreaded test.
- "init: fix array boundary bugs in boot parameter parsing"
(Wilson Felipe Pereira):
Fix boot argument boundary cases which leave stale arguments in
init's command line or panic when replacing the final environment
variable. Clear the last slot and check duplicates before the limit.
Summary of the 87 singletons in this merge:
The OCFS2 singletons fix deadlocks between xattr updates and inline
truncation, and during inode reclaim. Corrupt quota and extent
metadata could also crash the kernel or corrupt memory; these paths
now check the layout before using it. Other fixes close use-after-free
and publication races around cluster reconfiguration, node failure,
quota remount errors and shared refcount trees. New files now retain
security labels from all stacked LSMs instead of silently dropping all
but one. Valid xattr insertions also stop tripping FORTIFY on builds
with counted arrays.
Elsewhere, a lost wakeup could leave hardware-monitoring reads stuck
in unkillable sleep and block further I2C traffic. That is fixed, as
are kernel memory leaks in POSIX message-queue notifications and tmpfs
casefold setup which could grow until memory is exhausted. A driver
removal race which could crash the kernel is fixed too. The
hibernation command through reboot() also stops taking the same mutex
twice, avoiding a deadlock before suspension.
On the boot side, bzip2 decoding now accepts valid full blocks emitted
by lbzip2, fixing failures to boot those compressed kernels. Malformed
bzip2 streams can no longer overflow the decode buffer, and LZ4
initrds are checked before the decoder can read past their end. FAT
rejects geometry which overflows the data-area calculation on 32-bit
systems, and rolls back entries when inode setup fails, preventing
failed creations from reappearing after remount. The x86 XOR and RAID6
AVX paths also avoid imposing a slowdown on subsequent SSE code.
* tag 'mm-nonmm-stable-2026-10-25-14-57' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (134 commits)
scripts/gdb: fix stack depot out-of-bounds diagnostic
scripts/gdb: fix radix tree lookup pointer handling
ocfs2/cluster: remove zero-address nodes from IP tree on teardown
ocfs2: snapshot the dentry name while tracing file release
ocfs2: snapshot dentry names in file and setattr traces
ocfs2/dlm: drain join handlers before releasing module text
MAINTAINERS: update Markus's e-mail address
mailmap: add entries for Andrew Jones
stackdepot: stop preallocating after the final pool
ocfs2: drain quorum work before removing the cluster
watchdog: force console verbose when reporting lockups
profiling: fix sampling step on 64-bit big-endian systems
kernel/reboot: avoid potential deadlocks during suspension
compat: avoid double rounding in times()
ocfs2: pin owning modules for open debugfs files
ocfs2/cluster: initialize heartbeat regions before publishing them
selftests/proc: proc-pid-vm: fix unused variable warning on non-x86
ocfs2: pin refcount trees before dropping the lookup lock
ocfs2: validate the xattr tree root of an indexed xattr block
ocfs2/dlm: hold the lookup reference across convert AST enqueue
...
|
|
In the following patches, bypassed tasks run under rescue when their host
lacks SCX_CAP_BASE on the cpu. Under bypass the kernel zeroes the running
task's slice at every tick, as it does not trust the scheduler's slices.
A rescue grant has to survive that, or it is served a tick at a time with
the rescuee sent to the tail of the local DSQ each time. The generic slice
handling can't tell a kernel grant from a scheduler's slice.
Mark the grant as a kernel slice with SCX_TASK_KERNEL_SLICE, set at rescue
admission and cleared when the slice ends. The generic slice handling leaves
it alone. The default refill does nothing for it, and the three zeroings go
through the new expire_task_slice(), which skips it:
- the bypass tick's zeroing of the running task
- the eviction of a running task that can't stay on the cpu when bypass
lifts
- the cap-revoke eviction of a running task
Schedulers keep their control. Preemption and scx_bpf_task_set_slice() still
apply, and the rescue stays bounded by served time.
The sites that recognized the rescuee by identity, the reenqueue scan and
put_prev_task_scx()'s reinsert, test the flag instead.
scx_task_has_kernel_slice() hides the test behind the scx_has_subs() static
key, as only a sub-scheduler's task can carry the flag. The flag's entries
join the enum tables in tools/sched_ext.
No kernel slice reaches a zeroing until bypassed tasks run under rescue. The
cap-revoke eviction skipped the rescuee already, and bypass entry ends an
open rescue, so the bypass tick and the eviction at bypass lift see none.
The refill is the one behavior change. The pick refills a zero slice only
for a task that can stay on the cpu, so it concerns a rescuee whose
scheduler holds BASE there. A scheduler may zero such a queued rescuee's
slice, and the next pick used to refill it to the default.
Now the rescuee runs on the zero slice until the next tick. There
put_prev_task_scx() restores the remainder when another task is runnable.
When nothing else is runnable, dispatch_one() keeps the rescuee as the last
task. The pick then ends its zero slice, which ends the rescue, and refills
the default. A scheduler with SCX_OPS_ENQ_LAST skips the keep-last test.
scx_rescue_keep() restores the remainder there instead and the rescue goes
on.
v2:
- scx_rescue_admit()'s kerneldoc no longer mentions a served-time snapshot.
- The description covers a scheduler with SCX_OPS_ENQ_LAST, whose rescuee
dispatch_one() keeps on the remainder.
Signed-off-by: Tejun Heo <tj@kernel.org>
Reviewed-by: Andrea Righi <arighi@nvidia.com>
|
|
The following patches add a flag for a kernel-owned slice to scx_ent_flags.
The two 3-bit fields, the task state at bits 8 to 10 and the reenqueue
reason at bits 12 to 14, sit right above the single-bit flags, so the new
flag would have to take bit 11 or 15, out of sequence with the rest.
Pack the fields at the top of the word, below SCX_TASK_CURSOR, the state at
bits 25 to 27 and the reason at bits 28 to 30, so that the single-bit flags
continue from bit 8.
The renumbering changes the values a BPF scheduler reads from p->scx.flags.
Nothing in the kernel or the in-tree schedulers hardcodes the numbers. The
enum ABI table in tools/sched_ext/include/scx/enums_abi.autogen.h, kept for
repairing enum values that a kernel's BTF truncates, is regenerated for the
two fields. In the scx repository, scx_eevdf tests SCX_TASK_REENQ_IMMED and
SCX_TASK_REENQ_PREEMPTED against SCX_TASK_REENQ_REASON_MASK. Those three
names belong in its load-time enum table, so that they follow the running
kernel. No behavior change.
Signed-off-by: Tejun Heo <tj@kernel.org>
Reviewed-by: Andrea Righi <arighi@nvidia.com>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse
Pull fuse updates from Miklos Szeredi:
- Add dax backing and extent map support for famfs (John Groves,
Miklos)
- Support large folios (Joanne)
- Add selftests and documentation of caching behavior (Luis Henriques)
- Add FUSE_SYNCFS request (Jimmy Zuber)
- Convert readdir cache to use folios (Tal Zussman)
- Lots of bug fixes
* tag 'fuse-update-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: (53 commits)
fuse: handle extent map files in fuse_passthrough_fadvise()
fuse: resolve extent maps in O(1) when possible
fuse: add support for striped backing
fuse: add extent map I/O support
fuse: add extent map data structure
fuse: add support for opening dax device as backing
fuse: support opening 64 bit backing ID
fuse: support 64 bit, server allocated backing ID
fuse: add helpers for EIO return value with kernel message
dax: use READ_ONCE() in dax_holder()
dax: add fsdev_dax_from_file()
fuse: fix copy_file_range reply handling race
virtiofs: validate fixed-output response length
fuse: don't d_drop() before d_splice_alias()
virtio_fs: read the vring size under virtio_fs_mutex in ->get_tree
fuse: validate folio state before pipe_buf_try_steal() in fuse_try_move_folio()
fuse: rename fuse_direct_io() to fuse_do_direct_io()
fuse: Forward vfs_fadvise to backing_file in passthrough mode
selftests/fuse: add the missing FUSE_HAS_SYNCFS privilege test
fuse: don't launder folios of a bad inode
...
|
|
After the clamping changes, r7 returns to the header with [-72, -16]
instead of the narrower [-64, -16], so the test no longer checks subrange
pruning. Assign an invariant fp-16 pointer to r7 in the loop, giving r7 an
ANY SCEV that is not clamped and restoring strict-subrange coverage.
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261026-scev-simpler-clamp-v2-11-f373aec9825f@gmail.com
|
|
When building SCEV expressions for the loop:
w7 = w1; r7 = (zext32 r1)
w1 = w7; r1 = (zext32 (zext32 r1))
w1 += 2; r1 = (zext32 (+ (zext32 (zext32 r1)) 2))
Computed SCEV expression for r1:
(zext32 (linear r1 2))
Substituting this into r7's expression at the latch:
(zext32 (zext32 (linear r1 2)))
Without (zext32 (zext32 X)) -> (zext32 X) simplification rule
the latch would not be recognized as linear and header_count
won't be computed.
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261026-scev-simpler-clamp-v2-10-f373aec9825f@gmail.com
|
|
Add three test cases exercising state pruning after loop counter
clamping. All turn a 32-bit stack spill into STACK_MISC during the
first iteration. This prevents a state match at the outer loop header
on the next iteration, while allowing states to match further inside
the loop. All are falsely reported as infinite loop w/o changes in
patch [1].
- clamp_callee_state_pruning(), a callee overwrites the upper half of
the caller's stack slot. States then match at the callee's exit,
where the current frame has no active loop.
Verify that current_loop() finds the caller's active loop.
- clamp_nested_loop_state_pruning(), the overwrite happens inside an
inner loop. Exercise matching states when the inner loop is entered
again on a subsequent outer iteration.
- clamp_nested_unrolled_loop_state_pruning(), same as above, but the
inner loop is not recognized by SCEV and is unrolled with a precise
counter, so its entries are never marked terminating.
[1] bpf: avoid false infinite loop reports after changes in SCEV clamping
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261026-scev-simpler-clamp-v2-9-f373aec9825f@gmail.com
|
