From 3a341cb3a2c2879732bc9cf006caa6a087b82241 Mon Sep 17 00:00:00 2001 From: Kaitao Cheng Date: Thu, 18 Jun 2026 19:06:40 +0800 Subject: [PATCH 1/4] lib/vsprintf: Make no_hash_pointers take effect early The no_hash_pointers boot parameter is now handled as an alias for hash_pointers=never. However, hash_pointers=never only records the selected mode during early parameter parsing, and no_hash_pointers is not updated until hash_pointers_finalize() runs later from SLUB init. This leaves a window during very early boot where %p output is still hashed even though the user explicitly requested unhashed pointers with no_hash_pointers or hash_pointers=never. Set no_hash_pointers as soon as the "never" mode is parsed. The later hash_pointers_finalize() call still keeps the final policy decision in one place, but explicit requests to disable pointer hashing now take effect for early boot users too. Signed-off-by: Kaitao Cheng Reviewed-by: Petr Mladek Link: https://patch.msgid.link/20260618110640.82749-1-kaitao.cheng@linux.dev Signed-off-by: Petr Mladek --- lib/vsprintf.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/lib/vsprintf.c b/lib/vsprintf.c index 2bc6ef483576..e285e8bc4712 100644 --- a/lib/vsprintf.c +++ b/lib/vsprintf.c @@ -2360,6 +2360,9 @@ void __init hash_pointers_finalize(bool slub_debug) static int __init hash_pointers_mode_parse(char *str) { + /* Avoid stale no_hash_pointers state when hash_pointers overrides it */ + no_hash_pointers = false; + if (!str) { pr_warn("Hash pointers mode empty; falling back to auto.\n"); hash_pointers_mode = HASH_PTR_AUTO; @@ -2369,6 +2372,7 @@ static int __init hash_pointers_mode_parse(char *str) } else if (strcmp(str, "never") == 0) { pr_info("Hash pointers mode set to never.\n"); hash_pointers_mode = HASH_PTR_NEVER; + no_hash_pointers = true; } else if (strcmp(str, "always") == 0) { pr_info("Hash pointers mode set to always.\n"); hash_pointers_mode = HASH_PTR_ALWAYS; From d6430968d8f323f4f97b6b7d07cca6454db793bd Mon Sep 17 00:00:00 2001 From: Jia He Date: Fri, 29 May 2026 08:58:55 +0000 Subject: [PATCH 2/4] lib/tests: test_ratelimit: fix stress test thread lifecycle and leak The stress test's WARN_ON_ONCE(!sktp->tp) check in the child thread is racy and unnecessary: since kthread_run() wakes the thread before returning, the child can run before sktp[i].tp has been assigned. Moreover, sktp->tp is never actually used in the child function, so the check serves no purpose. Remove it and keep the original kthread_run() Also add a common cleanup path for thread creation failures. If creating one of the later threads fails, stop all threads that were already started and free the allocated array instead of leaving orphan kthreads and leaked memory behind. Finally, replace the module-static doneflag with kthread_should_stop(). With the doneflag, child threads may exit before the parent calls kthread_stop(), so the task lifetime is no longer guaranteed when the parent later tries to stop them. Using kthread_should_stop() keeps each child alive until kthread_stop() synchronously terminates it. Suggested-by: Petr Mladek Signed-off-by: Jia He Reviewed-by: Petr Mladek Tested-by: Petr Mladek Acked-by: Paul E. McKenney Link: https://patch.msgid.link/20260529085855.1810870-1-justin.he@arm.com Signed-off-by: Petr Mladek --- lib/tests/test_ratelimit.c | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-) diff --git a/lib/tests/test_ratelimit.c b/lib/tests/test_ratelimit.c index 33cea5f3d28b..e244f8cd47d7 100644 --- a/lib/tests/test_ratelimit.c +++ b/lib/tests/test_ratelimit.c @@ -68,7 +68,6 @@ static void test_ratelimit_smoke(struct kunit *test) static struct ratelimit_state stressrl = RATELIMIT_STATE_INIT_FLAGS("stressrl", HZ / 10, 3, RATELIMIT_MSG_ON_RELEASE); -static int doneflag; static const int stress_duration = 2 * HZ; struct stress_kthread { @@ -84,9 +83,8 @@ static int test_ratelimit_stress_child(void *arg) struct stress_kthread *sktp = arg; set_user_nice(current, MAX_NICE); - WARN_ON_ONCE(!sktp->tp); - while (!READ_ONCE(doneflag)) { + while (!kthread_should_stop()) { sktp->nattempts++; if (___ratelimit(&stressrl, __func__)) sktp->nunlimited++; @@ -105,26 +103,37 @@ static void test_ratelimit_stress(struct kunit *test) const int n_stress_kthread = cpumask_weight(cpu_online_mask); struct stress_kthread skt = { 0 }; struct stress_kthread *sktp = kzalloc_objs(*sktp, n_stress_kthread); + int n_started = 0; - KUNIT_EXPECT_NOT_NULL_MSG(test, sktp, "Memory allocation failure"); + KUNIT_ASSERT_NOT_NULL_MSG(test, sktp, "Memory allocation failure"); for (i = 0; i < n_stress_kthread; i++) { sktp[i].tp = kthread_run(test_ratelimit_stress_child, &sktp[i], "%s/%i", "test_ratelimit_stress_child", i); - KUNIT_EXPECT_NOT_NULL_MSG(test, sktp, "kthread creation failure"); + if (IS_ERR(sktp[i].tp)) { + KUNIT_FAIL(test, "kthread_run failed: %ld", PTR_ERR(sktp[i].tp)); + goto out_stop; + } + n_started++; pr_alert("Spawned test_ratelimit_stress_child %d\n", i); } schedule_timeout_idle(stress_duration); - WRITE_ONCE(doneflag, 1); - for (i = 0; i < n_stress_kthread; i++) { + +out_stop: + for (i = 0; i < n_started; i++) { kthread_stop(sktp[i].tp); skt.nattempts += sktp[i].nattempts; skt.nunlimited += sktp[i].nunlimited; skt.nlimited += sktp[i].nlimited; skt.nmissed += sktp[i].nmissed; } - KUNIT_ASSERT_EQ_MSG(test, skt.nunlimited + skt.nlimited, skt.nattempts, - "Outcomes not equal to attempts"); - KUNIT_ASSERT_EQ_MSG(test, skt.nlimited, skt.nmissed, "Misses not equal to limits"); + if (n_started == n_stress_kthread) { + KUNIT_ASSERT_EQ_MSG(test, skt.nunlimited + skt.nlimited, skt.nattempts, + "Outcomes not equal to attempts"); + KUNIT_ASSERT_EQ_MSG(test, skt.nlimited, skt.nmissed, + "Misses not equal to limits"); + } + + kfree(sktp); } static struct kunit_case ratelimit_test_cases[] = { From 36630cafbeede0b64c370edb2f7b4094327ee1e0 Mon Sep 17 00:00:00 2001 From: John Ogness Date: Fri, 3 Jul 2026 16:20:31 +0206 Subject: [PATCH 3/4] printk: Fix possible console use-after-free When emitting a record via legacy printing, it is possible that a handover to another legacy printing context occurs. When a context has performed a handover, the console SRCU read lock is released and the pointer to the console struct might now be invalid. Therefore, after calling nbcon_legacy_emit_next_record() or console_emit_next_record(), it is necessary to check if a handover occurred _before_ further @con usage. Sashiko pointed out that console_flush_one_record() was not doing this. In console_flush_one_record(), after emitting a record, move the further usage of @con after the handover check. Fixes: c158834b223f ("printk: nbcon: Use nbcon consoles in console_flush_all()") Reported-by: Sashiko Closes: https://lore.kernel.org/lkml/20260630170903.099D61F000E9@smtp.kernel.org Signed-off-by: John Ogness Reviewed-by: Petr Mladek Link: https://patch.msgid.link/20260703141521.202813-1-john.ogness@linutronix.de Signed-off-by: Petr Mladek --- kernel/printk/printk.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c index 2fe9a963c823..6d363e42e2a0 100644 --- a/kernel/printk/printk.c +++ b/kernel/printk/printk.c @@ -3264,10 +3264,8 @@ static bool console_flush_one_record(bool do_cond_resched, u64 *next_seq, bool * if (flags & CON_NBCON) { progress = nbcon_legacy_emit_next_record(con, handover, cookie, !do_cond_resched); - printk_seq = nbcon_seq_read(con); } else { progress = console_emit_next_record(con, handover, cookie); - printk_seq = con->seq; } /* @@ -3277,6 +3275,15 @@ static bool console_flush_one_record(bool do_cond_resched, u64 *next_seq, bool * if (*handover) goto fail; + /* + * @con can be used here now that it is certain that this + * context is still holding the SRCU read lock. + */ + if (flags & CON_NBCON) + printk_seq = nbcon_seq_read(con); + else + printk_seq = con->seq; + /* Track the next of the highest seq flushed. */ if (printk_seq > *next_seq) *next_seq = printk_seq; From 3219f9b61d45129d24fe4b5a070fc1e3d8fae5c5 Mon Sep 17 00:00:00 2001 From: Petr Mladek Date: Thu, 4 Jun 2026 12:14:48 +0200 Subject: [PATCH 4/4] printk: Handle pre-enabled consoles in the top-level register_console() The function try_enable_preferred_console() currently has the non-obvious side effect of returning success for consoles that are already pre-enabled. This obscures the logic flow during console registration. Move the check for pre-enabled consoles directly into the top-level register_console(). This change makes the handling of pre-enabled consoles explicit and easier to follow. Furthermore, this separation lays the groundwork for future cleanups where try_enable_preferred_console() can be restricted to cases where an entry actually exists in the console_cmdline[] array. Also it fixes a possible out-of-bound access when the console_cmdline[] array is full and no console matched. In fact, the check of c->user_specified did not make much sense. The new console either matched and was handled in the for-cycle. Or it did not match and then *c pointed to an unused entry. Possible behavior change: try_enable_preferred_console() will newly be called also with @user_specified parameter set to "false" when it failed with the "true" variant. But it looks like the right way to do. It will allow to call newcon->setup() when the console was preferred by some platform specific code. Reported-by: Naveen Kumar Chaudhary # out-of-bound access Closes: https://lore.kernel.org/r/7sq4tr2nmlz32tvkf6vpsghv6exvqfghsrlvywjcqihzsqqbf7@bspclmti5xg4 Reviewed-by: John Ogness Link: https://patch.msgid.link/20260604101459.393162-2-pmladek@suse.com Signed-off-by: Petr Mladek --- kernel/printk/printk.c | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c index 2fe9a963c823..204e877c9b04 100644 --- a/kernel/printk/printk.c +++ b/kernel/printk/printk.c @@ -3890,9 +3890,6 @@ static int console_call_setup(struct console *newcon, char *options) * the newly registered console with any of the ones selected * by either the command line or add_preferred_console() and * setup/enable it. - * - * Care need to be taken with consoles that are statically - * enabled such as netconsole */ static int try_enable_preferred_console(struct console *newcon, bool user_specified) @@ -3933,14 +3930,6 @@ static int try_enable_preferred_console(struct console *newcon, return 0; } - /* - * Some consoles, such as pstore and netconsole, can be enabled even - * without matching. Accept the pre-enabled consoles only when match() - * and setup() had a chance to be called. - */ - if (newcon->flags & CON_ENABLED && c->user_specified == user_specified) - return 0; - return -ENOENT; } @@ -4123,6 +4112,14 @@ void register_console(struct console *newcon) if (err == -ENOENT) err = try_enable_preferred_console(newcon, false); + /* + * Some consoles, such as pstore and netconsole, can be enabled even + * without matching. Accept them at this stage when they had a chance + * to match() and call setup(). + */ + if (err == -ENOENT && (newcon->flags & CON_ENABLED)) + err = 0; + /* printk() messages are not printed to the Braille console. */ if (err || newcon->flags & CON_BRL) { if (newcon->flags & CON_NBCON)