The execbuffer relocation fast path writes each updated presumed_offset
back to the user's relocation array with __put_user(), ignoring any
failure. It does that while holding the objects' dma_resv locks, and
with page faults enabled unless the relocation cache happens to have an
atomic mapping active. So if that write faults, for example on a
copy-on-write page after a fork(), the fault handler takes mmap_lock
under dma_resv. That is the opposite of the order the i915 fault
handler uses, which takes the object lock under mmap_lock.
The comment above it claimed this could not happen, because "we did
previously check if the relocations were writable (access_ok)".
access_ok() is purely a range check. The comment dates from when this
was access_ok(VERIFY_WRITE), and that only ever made a difference on the
original i386, whose write-protect bit did not stop supervisor writes.
So nothing has made sure the array was writable for decades.
Do the write with page faults disabled, and if it fails, fall back to
the slow path exactly as we already do when reading the relocations
fails part-way through. We cannot just ignore the failure: the object
has already been relocated, and a stale presumed_offset could later
match again and skip a relocation that is needed. The slow path
prefaults and retries. If the write still fails, it copies the
relocations and marks every presumed_offset invalid with faults allowed
and no locks held, which breaks copy-on-write as needed.
One user-visible change: a relocation array in genuinely read-only
memory used to get through the fast path, silently losing the
presumed_offset updates. It now gets -EFAULT from the slow path, as it
already did whenever anything else sent execbuffer there. The uapi has
the kernel updating presumed_offset, so the array is expected to be
writable.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
gntdev_copy() updates per-segment status words with __get_user() and
__put_user(). privcmd writes back mmap batch errors and the resource
frame count with __put_user(). The pointers were validated earlier,
away from the accesses: by a copy_from_user() of the enclosing
structure, or by an access_ok() on the whole array before a callback
walks it. Each access enables and disables user access on its own
anyway, so the separation saves nothing.
Use get_user() and put_user().
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
getu16_iotlb() and putu16_iotlb() use __get_user() and __put_user() when
the IOTLB maps to user virtual addresses. Nothing nearby checks the
translated address: that relies on the mapping having been validated
against the user's VMAs when it was set up.
Use get_user() and put_user(), which do the same single, untorn access
and also check the address. The only atomic-context use, the vdpa
simulators' notification check, now disables page faults around it, so
the might_fault() in the checked accessors stays quiet there.
This is part of getting rid of __get_user() and __put_user() entirely.
Tested-and-acked-by: Michael S. Tsirkin <mst@redhat.com>
Fixes: 42823a871f ("vringh: support VA with iotlb")
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
When vdpa_sim runs with use_va (the default), its rings live in user
memory, and vringh reads the ring's flags and event index with
__get_user() through the user address. The net and block simulators
call vringh_need_notify_iotlb() with bottom halves disabled, so those
reads happen in atomic context.
That only works today because __get_user() has no might_fault() check: a
fault is not handled in atomic context and simply comes back as -EFAULT.
Make that explicit with pagefault_disable() around the call, so vringh
can use the normal user accessors without complaint. Only the
notification check needs this: the rest of the ring processing runs in
the same kthread without bottom halves disabled, and can fault normally.
Tested-and-acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
ubi_get_ec_info() checks the user's erase_counters array with
access_ok() and then fills it one entry at a time with __put_user(),
taking the wear-leveling lock for each entry in between. Each of those
accesses enables and disables user access on its own, so the up-front
check saves nothing.
Use put_user(). The access_ok() stays, so a bad array still fails
before anything is written.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
isapnp_proc_bus_read() checks the user buffer with access_ok() and then
copies the configuration registers one byte at a time with __put_user(),
reading each register in between. Each of those accesses enables and
disables user access on its own, so the up-front check saves nothing.
Use put_user(). The ignored return value and the access_ok() stay as
they were.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
proc_bus_pci_read() and proc_bus_pci_write() check the user buffer with
access_ok() and then copy config space one byte, word or dword at a time
with __put_user() and __get_user(). Each of those accesses enables and
disables user access on its own, so the up-front check saves nothing.
Use put_user() and get_user(). This deliberately changes nothing else:
the return values were ignored before and still are, and the access_ok()
stays, since it is the only error these functions report for a bad
buffer.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
read_port() and write_port() check the whole user buffer with
access_ok() and then move it one byte at a time with __put_user() and
__get_user(), doing an inb() or outb() for each. Each of those accesses
enables and disables user access on its own, so the up-front check saves
nothing.
Use put_user() and get_user(). The access_ok() stays, because it also
makes a partly invalid buffer fail up front, rather than after some
ports have already been read or written.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
The comment in set_aliased_prot() says the target address is faulted in
with __get_user(), but the code has used copy_from_kernel_nofault() for
a long time. Make the comment say so.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
The FPU signal frame code reads and writes a handful of individual
fields (the xstate magic words, the legacy status word, the xfeatures
header and PKRU) with __get_user() and __put_user(). These rely on an
access_ok() of the whole frame done earlier by the caller. Each of
those accesses enables and disables user access on its own, so the
up-front check saves nothing. On x86, __get_user() is even more
expensive than get_user(): it does an lfence, where get_user() checks
the address with a couple of plain instructions.
Use get_user() and put_user(). The accesses that run with page faults
disabled stay that way; get_user() and put_user() are fine there.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
genregs_set() and genregs32_set() read the user buffer one word at a
time with __get_user(), calling putreg() for each. The access_ok() that
makes this safe is in the generic copy_regset_from_user(), on the other
side of an indirect call through the regset. Each of those accesses
enables and disables user access on its own, so the up-front check saves
nothing. On x86, __get_user() is even more expensive than get_user():
it does an lfence, where get_user() checks the address with a couple of
plain instructions.
Use get_user(), so each read checks its own address.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
The user callchain walkers read each two-word stack frame with
__get_user(), after checking the frame with valid_user_frame(), which is
just __access_ok(). They run with page faults disabled, since they can
be called from NMI context.
Read each frame inside a scoped_user_read_access() instead, which does
the range check itself and needs only a single stac/clac pair for both
loads. That leaves valid_user_frame() unused, so remove it.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
copy_stack_frame() reads the two words of a user stack frame with
__get_user(), after an __access_ok() on the frame and inside
pagefault_disable(), since the user stack walk can run in atomic
context.
Do the two reads in a scoped_user_read_access() instead. It nests
inside the pagefault_disable() section, does the range check itself, and
needs only a single stac/clac pair for both loads.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
All four sigreturn variants (32-bit sigreturn and rt_sigreturn, native
64-bit and x32 rt_sigreturn) do an access_ok() on the whole signal frame
only to read the signal mask with __get_user(). The 64-bit and x32
variants also read uc_flags that way. Everything else in the frame is
read by helpers that do their own checking.
Read those fields inside a scoped_user_read_access() instead, which does
the range check once and puts a single stac/clac pair around plain
loads. The scoped accessor shadows 'frame' with a checked copy only
inside its block, so the badframe path still reports the original
pointer.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
__do_fast_syscall_32() fetches the user's EBP from the stack slot the
vDSO stashed it in. On 64-bit kernels it used __get_user(), as a
micro-optimization: the address is explicitly 32 bits, so it cannot be
out of range.
That optimization has turned into a pessimization. On x86-64,
get_user() checks the address with a compare and a conditional move,
while __get_user() does an lfence instead. Use get_user() on both
32-bit and 64-bit, which also removes the IS_ENABLED(CONFIG_X86_64)
special case.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
____sys_recvmsg() writes msg_flags and msg_controllen back with
__put_user(), and the compat sendmmsg()/recvmmsg() loops write msg_len
the same way. None of these has an access_ok() of its own: they rely on
the earlier copy_from_user() of the message header having checked the
range. For the compat msg_len that is not even true, since msg_len
lives after the compat_msghdr that was copied. It is only safe because
compat pointers are 32-bit. The native mmsg paths already use
put_user().
Use put_user() everywhere. On x86 that adds a couple of instructions to
check the address, on a path that has to enable and disable user access
for each write anyway.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
copy_user_syms() and bpf_uprobe_multi_link_attach() check whole user
arrays with access_ok() up front, then read them one element at a time
with __get_user(), with other work in between: allocations and
strncpy_from_user() in copy_user_syms(), validation in the uprobe_multi
loop. Each of those accesses enables and disables user access on its
own, so the up-front check saves nothing. On x86, __get_user() is even
more expensive than get_user(): it does an lfence, where get_user()
checks the address with a couple of plain instructions.
Use get_user(). The access_ok() checks stay, because they also make a
bad array fail with -EFAULT before anything else is looked up or
allocated. Update the comment that said they were there for
__get_user().
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
syscall_user_dispatch() reads the selector byte with __get_user(),
relying on an access_ok() done once at prctl time when the selector
address was set. So the pointer being dereferenced was validated in a
different system call, and the separation saves nothing anyway:
__get_user() still enables and disables user access, and on x86 it does
an lfence that get_user() avoids.
Use get_user(), and drop the comment explaining why the unchecked access
was safe.
The selector may be a tagged address. The prctl-time check is done on
untagged_addr(selector), but it is the tagged pointer that gets stored,
and __get_user() never checked it. get_user() does, and on x86 with LAM
a tagged pointer fails its range check. So untag it at the point of use
as well. The prctl-time check stays, so a bad address is still reported
when it is set.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
is_trap_at_addr() reads the instruction at a user address with
__get_user(), inside pagefault_disable() since the caller holds
mmap_lock. There is no access_ok() in front of it, and nothing here
needs the unchecked version: with page faults disabled, get_user()'s
might_fault() check returns early, so that is no reason to avoid it
either.
Use get_user(), which also checks that the address is a user address,
and on x86 avoids the lfence that __get_user() does.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
PTRACE_GETREGSET and PTRACE_SETREGSET do an access_ok() on the user
iovec, read its two fields with __get_user(), and once the regset has
been transferred write the length back with __put_user(). Each of those
accesses enables and disables user access on its own, so the up-front
check saves nothing. On x86, __get_user() is even more expensive than
get_user(): it does an lfence, where get_user() checks the address with
a couple of plain instructions.
Just use get_user() and put_user(), and drop the access_ok(). Both
fields are read before anything else is done, so a bad pointer still
fails with -EFAULT up front.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
get_compat_sigevent() does one access_ok() on the user structure and
then reads four fields with __get_user(). Each of those reads enables
and disables user access on its own, so the single range check no longer
buys anything.
Read the fields inside a scoped_user_read_access() instead.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
__save_altstack() and __compat_save_altstack() write three fields with
__put_user(), relying on the caller having done access_ok() on the whole
signal frame. Each of those writes enables and disables user access on
its own, so that check saves nothing.
x86 and powerpc already avoid these functions by using
unsafe_save_altstack() inside their own user access regions. Use the
same helpers here, inside a scoped_user_write_access(), so that every
other architecture gets a single range check and a single user access
region too. None of those callers is itself inside a user access
region, so nothing nests.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
The old sigaction() system call and its compat counterpart do one
access_ok() on the user structure and then a series of __get_user() or
__put_user() calls on its fields. That was an optimization back when
each of those was a single memory access. These days each of them
enables and disables user access on its own (stac/clac on x86), so the
up-front check saves nothing.
Convert them to scoped_user_{read,write}_access() with
unsafe_{get,put}_user(), which does the range check once and puts a
single stac/clac pair around plain moves.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
All fixes in drivers (or the tape ULD) and one core fix to bsg (the
block ioctl equivalent of sg_io). The biggest is the race in auth
updates fix in iscsi configfs, but the next biggest one is in bsg but
the generic pieces of that are mostly threading reply_len.
Signed-off-by: James E.J. Bottomley <James.Bottomley@HansenPartnership.com>
-----BEGIN PGP SIGNATURE-----
iLgEABMIAGAWIQTnYEDbdso9F2cI+arnQslM7pishQUCatTZmRsUgAAAAAAEAA5t
YW51MiwyLjUrMS4xMiwyLDImHGphbWVzLmJvdHRvbWxleUBoYW5zZW5wYXJ0bmVy
c2hpcC5jb20ACgkQ50LJTO6YrIWZfAD/ZC6Pwo0OMS8MuYYGwb+fF2YM0Msr+zAG
4gDRU5yDWl0A/jEw1iFbmGyoNTtBTHSE9I38j/nRAaa+UT/JeS4q0g1E
=wBqG
-----END PGP SIGNATURE-----
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull SCSI fixes from James Bottomley:
"All fixes in drivers (or the tape ULD) and one core fix to bsg (the
block ioctl equivalent of sg_io).
The biggest is the race in auth updates fix in iscsi configfs, but the
next biggest one is in bsg but the generic pieces of that are mostly
threading reply_len"
* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies
scsi: libsas: Fix SMP IO deadlock during HA resume
scsi: libiscsi: Validate the task named by a management response
scsi: libiscsi: Validate the ITT reflected in a Reject PDU
scsi: libiscsi: Reject a negative task index from parse_pdu_itt
scsi: target: iscsi: Fix race in discovery auth updates
scsi: target: Disable interrupts while holding delayed_cmd_lock
scsi: st: Fix use-after-free race between st_remove() and st_open()
scsi: st: Save the visited block for the partition the drive is in
scsi: xen/scsifront: Check for a NULL shadow entry on a backend response
A small collection of driver specific fixes, all quite important if you
have the relevant hardware.
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQReagvpf3TrrA7BoYYv73Ows9A4iQUCatTACAAKCRAv73Ows9A4
if2lAQDfQLZHMIvrU2wGNFBX2CUe2repS3JyRnmRalP9nXSVkAEAgS4wY/wU8wzQ
o+7ajrnUAZjgx/IK3HKoV0fXMOvlTAw=
=1PL3
-----END PGP SIGNATURE-----
Merge tag 'spi-fix-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
Pull spi fixes from Mark Brown:
"A small collection of driver specific fixes, all quite important if
you have the relevant hardware"
* tag 'spi-fix-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
spi: spi-fsl-lpspi: directly return ret in fsl_lpspi_transfer_one()
spi: spi-fsl-lpspi: pass struct fsl_lpspi_data instead of struct spi_controller if possible
spi: imx: fix slab corruption from undersized DMA bounce buffers
spi: tegra114: assert CS GPIO for every transfer in a message
The main thing here is a fix for lockdep warnings with MMIO regmaps that
use a raw spinlock and a cache, some other lockdep fixes we'd done for
the benefit of the maple tree on sleeping buses meant that we were doing
allocations for those MMIO regmaps under a raw spinlock. While fixing
that Michael Reeves also noticed that the debugfs files were briefly
available without the cache structures backing them.
There's also a fix for interrupt freeing on error in regmap-irq which
had been hanging around because it's not super urgent.
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQReagvpf3TrrA7BoYYv73Ows9A4iQUCatS/PwAKCRAv73Ows9A4
idqeAP4y6bdFUzY0e9Ntiixana3IyzJ2dxzrjHIFHcOZl02UhwD8D2jWwFIw0CIs
izZUkBabg5UyIeM1NkzZWtmDhkZTaAk=
=AS9J
-----END PGP SIGNATURE-----
Merge tag 'regmap-fix-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap
Pull regmap fixes from Mark Brown:
"The main thing here is a fix for lockdep warnings with MMIO regmaps
that use a raw spinlock and a cache, some other lockdep fixes we'd
done for the benefit of the maple tree on sleeping buses meant that we
were doing allocations for those MMIO regmaps under a raw spinlock.
While fixing that Michael Reeves also noticed that the debugfs files
were briefly available without the cache structures backing them.
There's also a fix for interrupt freeing on error in regmap-irq which
had been hanging around because it's not super urgent"
* tag 'regmap-fix-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
regmap: Drop map lock during cache init and exit
regmap: Remove debugfs before cache teardown
regmap: irq: Free the irqdomain we create
Three independent clock management fixes, plus one for a simple
reset mask blunder in the qcom-cci interrupt handler.
- qcom-cci: prevent lost reset requests during interrupt handling
- qcom-geni: preserve the selected source clock
- viai2c-wmt: fix clock reference leak
- xiic: fix clock disable warnings during removal
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQScDfrjQa34uOld1VLaeAVmJtMtbgUCatTkqQAKCRDaeAVmJtMt
bmntAQCohnAvbkYQh6VfaPl5TzQPytHWTMg3AiqyLeDWs7MuAAD/RQS6vFQMyzvj
kD1fK/ocHIs/D59T21JiOzhhiNSSNwo=
=SdHD
-----END PGP SIGNATURE-----
Merge tag 'i2c-fixes-7.3-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux
Pull i2c fixes from Andi Shyti:
"Three independent clock management fixes, plus one for a simple
reset mask blunder in the qcom-cci interrupt handler"
* tag 'i2c-fixes-7.3-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux:
i2c: xiic: restore non-managed runtime PM to fix clk WARN flood
i2c: qcom-cci: Fix HALT_ACK reset request being dropped
i2c: qcom-geni: Restore the source-clock selection policy
i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()
Fix a regression introduced in v6.19. It affects cancellation of the
timer for split transaction timeout when handling a response. The issue
is unlikely to occur in practice.
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQQE66IEYNDXNBPeGKSsLtaWM8LwEwUCatQ4OwAKCRCsLtaWM8Lw
E2sNAP49Zw/nOmC9OaYKthJtKUup5Oi+4kxQnNjnDDNIraa/2gEAnhum0sbs/PHt
VCRl5/WMsHPQRgNMrihFO6G+2+KACgQ=
=F+OT
-----END PGP SIGNATURE-----
Merge tag 'firewire-fixes-7.3-final' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394
Pull firewire fix from Takashi Sakamoto:
"Fix a regression introduced in v6.19. It affects cancellation of the
timer for split transaction timeout when handling a response. The
issue is unlikely to occur in practice"
* tag 'firewire-fixes-7.3-final' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394:
firewire: core: fix race condition in split transaction handling
- Emit the FineIBT paranoid "cs" prefix as a byte,
to work around a GNU toolchain build warning (Kees Cook)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmrUo24RHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1i2PhAAm4V2NsF3knhwSQ2WC55RTZbXmlYLAJAq
57rUJejuVM7eHrNhsT0FJIesMLbIDHz5RzVSllN7ESBB5zEkbiyIxRonaG6WTiKk
G0y/IyPsA4BWFp9Ojq5NyDhD95do0gTc08Oxd8eEeJULBzGAaErGl8ExX15SQJkh
eMVdAN4RcathkVrgKbdTklXkECa9j4I+rfBlkX4g8bJ22mbi8h8nfYNrlkX9vncf
IxWNwUh3eKAamLHnKeqbmDUOUrP7ss/hWGWRG0La7G+8jWoX3YlWQdzJeMtWzdV6
unNeFIjjP4lvBtKDkfUBf0JZN+mKo/Zwl5dWNQ/A26vOJTJmmFx03YsuWYDXR0+Q
Vqvm09PSSPbKdGWT7MmlJNhEdBUPOLmCSOT06hfHYKsk+Qkx8XMUIz/bTbNW5gVP
eeok5YWMBn3dQ2B4+LfBqxwMeu+jripgJjN0bj1JOHwkMzYthRce3SHyWRW6hsIh
oOReFnmxaImkh22ia1RLnPscp2efkV9InL5IpNXIH3MXpvlNiUfd0OiDMSGS6ici
AnErf5LK1aXLI+agmBx+7XovUb7umnWpUyvLy3f93E6i6o3urGJ2Tg9Eq+pLJPOR
OAYkzsdJiLCVZqiFm+S+8xNCmlnOs76rKk9bOElOBXUej80q0zwQXHzJ8Pl+yBU1
zw54ecYyK8A=
=xZLR
-----END PGP SIGNATURE-----
Merge tag 'x86-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86/core update from Ingo Molnar:
- Emit the FineIBT paranoid "cs" prefix as a byte,
to work around a GNU toolchain build warning (Kees Cook)
* tag 'x86-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/kcfi: Emit the FineIBT paranoid "cs" prefix as a byte
- Fix FUT_OFF_MMSHARED futex hashing bug that can cause
missed wakeups or spurious wakeups on futex-waiting
tasks (Jann Horn)
- Fix lockdep context tracking bug in the deferred hrtimer
rearming entry code, which causes a lockdep chain leak
that will eventually turn lockdep off (Mikhail Gavrilov)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmrUjUgRHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1gmPg//W4D6TwoPAhod8ExaSApVeP9vrqUnMkEg
hf5GsvwT+0wW8cD8xaBnUVA2ylcLDurmu+eXedurOdc3VcRh/BSvJlBpPXMLA5pc
L+iiGI8sMK6koNQrDXtFcHJbcdm5CSmNVc7sv0Vodi+7Q4EjZWL1SLI34F/5EbMd
mvgJ1NDVVr/2L1gc1ojsPo6CUWnFTaq8sp48kYDrmpllo8epECQptJ248wfP2Grv
1v43UYjprCjCY/KOvWz6O5wsXL+25vGk5JX2mY9BemmWJEoq7QOlBceJGpZiFmCf
hO2b1a9aI7pKC7lBRBdeQF/GZHF5AF1E7NPmwR7nSSSGfG6z1rVeoq6e4/lewgui
irvPDY2EDz4F5eQxDxZXTXzS7oKddEha4pB2L50/q9leFXdR1JG5Xh5D5p2lK5K0
pUvo0ODt4TEVriX00sH8Q+2SBOyXhAGXfM2lwS0J5LMY9J+yexqn9MldM8ulg6Dm
BoHYw5FXMuJrcUeNA4RM410bN4YGwKRNSzV8JlngQsfMX3EH0m8aorDYJ8TlLd91
Tv3CfK0pIgNe0r2Tvx5xlNHjbypWk6a7GZBrWbQIeRvS1y60xFyus2kqd6OuF4W/
iELs6ZM732881GXtRIQFQz9GbijA5FfSSpL3iPyKO71e/OsOLZGezQi7LXqZ1ZgF
dk7g5R52Vb4=
=V72L
-----END PGP SIGNATURE-----
Merge tag 'locking-urgent-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull locking fixes from Ingo Molnar:
- Fix FUT_OFF_MMSHARED futex hashing bug that can cause
missed wakeups or spurious wakeups on futex-waiting
tasks (Jann Horn)
- Fix lockdep context tracking bug in the deferred hrtimer
rearming entry code, which causes a lockdep chain leak
that will eventually turn lockdep off (Mikhail Gavrilov)
* tag 'locking-urgent-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
entry: Account the deferred hrtimer rearm as hardirq context for lockdep
futex: Fix mm reuse handling for FUT_OFF_MMSHARED
For a split transaction, either fw_core_handle_response() or
split_transaction_timeout_callback() may manipulate the same transaction
entry in the pending transaction list. The return value of timer_delete()
is used to determine which function handles the entry. If the transaction
is a split transaction and timer_delete() returns zero, the timeout
callback may already be running. In this case, the response handler must
leave the entry in the list for the timeout callback to remove.
A previous code refactoring broke this behavior, introducing a race
condition in which both functions could process the same transaction.
This could lead to a use-after-free on the transaction initiator side.
Fix the regression by ensuring that the response handler does not process
the transaction when timer_delete() returns zero. The timeout callback is
responsible for removing the entry from the pending transaction list.
Fixes: fa2dc27100 ("firewire: core: code refactoring to find and pop transaction entry")
Link: https://lore.kernel.org/r/20261018025504.290598-1-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Commit 45e1dccc06 ("x86/insn: Simplify for_each_insn_prefix()") made
for_each_insn_prefix() declare its own loop counter named idx.
get_seg_reg_override_idx() keeps its result in a local of the same name,
so the assignments in the loop body now write the loop counter:
- the function always returns INAT_SEG_REG_DEFAULT, so FS and GS
overrides are ignored;
- a CS override sets the counter to INAT_SEG_REG_CS (2), the increment
makes it 3, and prefixes.bytes[3] holds the last prefix, 0x2e again,
so the loop never terminates.
The UMIP emulation reaches this from the #GP handler for user space: an
SGDT, SIDT or SMSW with a memory operand and a CS prefix leaves the task
spinning in the kernel, never returning to user space, with a SIGKILL
that is never delivered. Any user can thus tie up CPUs until reboot.
With an FS or GS prefix, the emulated result is written to the wrong
address.
Rename the internal macro iterator variable.
[ Lukas' original patch renamed the use site, I changed it to rename the
iterator in the macro instead, but left Lukas' commit message and
authorship - Linus ]
Fixes: 45e1dccc06 ("x86/insn: Simplify for_each_insn_prefix()")
Signed-off-by: Lukas Zobernig <lukas.zobernig@gmail.com>
Acked-by: Peter Zijlstra <peterz@infradead.org>
Acked-by: Borislav Petkov <bp@alien8.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Here are the (hopefully) last bits for 7.3.
At this time, all changes are small and device-specific ASoC fixes.
Not super-urgent, but should be fairly safe to take.
-----BEGIN PGP SIGNATURE-----
iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmrSViUOHHRpd2FpQHN1
c2UuZGUACgkQLtJE4w1nLE/VwRAAkan0lCo3yf6j+dvU3iyR2qYF+9s98dZLlaaw
wRQk8ZtPdrSh40NwQ56GTkbbYGuXaKiKU9+YeYnvqodwOE88qpOJHHxy4Li8s3Gx
CKg0TfGYSrtzKvDgEGF01EoKbHw8/r+YL6rWi6p3A+FD1bInwkl9qNYnmZWNq/gM
tKsRWNgKsSP5jeFAuEAapSNzlaxoQp86Iz+AYGtVaFKK1tImotzvTuz9SUI9dTEv
r5QbjvanR1QtPc15iQwTcyKNQIg8C9+LWqA1Lw4aI6dYVVDyIc2UsucFG2Ndnt3Y
yeuIK1LIBJPGwc0A76YimztPk/fHOMk5xZPXi2Z6xy0mofN3ACwD8VKhktVVO0kF
7SVWWaGqCIDbCPpY2jpa7Kim9uqdefc18Jg8zHusO7+TU4NvuO8Iih0D1kLQ++WO
5C0O43OIuIvvN5hAiKXdv8wKPz4/BKufn2/RwuwwaRrfTnczsXOXXiHJQhd11gJ8
iGgVQc+1XAYR/u91LC6ilNx7l6dAosgaCiU9aCeL4o1BgeLG738OtObqFuxTRgfo
5Yjr6v5X3CXZB/7gBIhHcsCIwiWcP/iiEBlqifvUdbjJ8qy3z9de9tis2yg/1KFp
1Oqp2V3UTL3sq3xv6eBVXr1w78yR7kXkF8d5LKmTZL0nyjFV7IJRNFNtOsIfPZfO
eGS4CFk=
=AOo0
-----END PGP SIGNATURE-----
Merge tag 'sound-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"Here are the (hopefully) last bits for 7.3.
At this time, all changes are small and device-specific ASoC fixes.
Not super-urgent, but should be fairly safe to take"
* tag 'sound-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
ASoC: amd: yc: disable MSI on resume
ASoC: nau8822: Fix the 128x oversampling switch bits
ASoC: wm8978: Fix the 128x oversampling switch bits
ASoC: max98371: Fix the Speaker DHT Min Volume bits
ASoC: pcm3168a: Fix the DAC zero flag polarity bit
ASoC: cs42l52: Fix the NG Type Switch bit
ASoC: cs42l56: Put the Limiter Cushion control on the limiter register
ASoC: stm32: spdifrx: fix synchronization state check
ASoC: Intel: avs: Reset the stream unless it is already prepared
ASoC: SOF: sof-client: Use event-handler mutex consistently
ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture
-----BEGIN PGP SIGNATURE-----
iQJIBAABCgAyFiEEgMe7l+5h9hnxdsnuWYigwDrT+vwFAmrSWyQUHGJoZWxnYWFz
QGdvb2dsZS5jb20ACgkQWYigwDrT+vxZfg/9G4QxTP/m2gpQW6P+lMmU2xcACa08
K/lNG3HWLg08a0sqgveAv6Kb1dHw6OeUeCprGmZjjSFhkZMALsDiTZgU2pvE3a9m
00L0qKqb6oWRS2qOqULOchlCK8f10MUKJLlc823SKIRw+UEGCzxd+Qk91U3r+jX6
3J9e760m/pRFxmEoVEoW0Hcd1DDIDNII1wHB89J5JdSKJ9qMDSJQjiUoQy7aTWJo
ig9bVyq7Rrx6pHBK7oGC/Ua7BRFw0yx8IEda4CbqIg+aj5vciTyaNIMVQkWyMpVT
v+YKEIn4jb6zqI9Ei+joswYYq7XvTBe/r8TDLz/ZMqDoNpdRWyNQxkL4Z/hViMGf
51OoLBbXDZH9wi99DWyQrav5R2aGFpNDDOQRsPcNNiEboWu77DAALkPACoIBZvoS
gc777dnY+D48vAl1e3wfCzlSReoEHMOm5ROYzBR4jQHTN7DN83nL7eyw/GilcoG4
JcCTaceKp79MngOHmiVGUUyEOfllZvdUq/dneMLRNNvZe9HvjvTnf+0TY4u/9ubb
8/O7hxbEeYqYcW/dk++0Pd02M0qTarvGL5okdajj8FtEzhnTs66Ka/lb4Ekuyxah
CEKFeqpI5qzAlsmfkbpu6RCXcg4/gd7jcCe/0LrbMWjebzorPKsy0XVVyoXct5W4
8ZqkJoa8C78lreg=
=RsGW
-----END PGP SIGNATURE-----
Merge tag 'pci-v7.3-fixes-6' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci
Pull PCI fixes from Bjorn Helgaas:
- Ignore Immediate Readiness on Samsung 990 PRO and 990 EVO Plus NVMe,
which falsely advertise it; removal of unrelated delays in v7.2
caused post-FLR state restoration to fail, resulting in a VFIO
passthrough regression (Alexander Gruhlke)
-Don't treat ~0 as 'device is ready' in pci_dev_wait(); with RRS SV, a
device may respond with RRS (resulting in data of 0x0001) or may not
respond at all (typically resulting in ~0 data). A v6.12 change
treated ~0 as 'ready', resulting in a regression with Intel and
Samsung NVMe SSDs (Alexander Gruhlke)
* tag 'pci-v7.3-fixes-6' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:
PCI: Don't treat ~0 as ready in pci_dev_wait() with RRS SV
PCI: Ignore Immediate Readiness on Samsung 990 PRO and 990 EVO Plus NVMe
-----BEGIN PGP SIGNATURE-----
iQJPBAABCAA5FiEESH4wyp42V4tXvYsjUqAMR0iAlPIFAmrSRhIbFIAAAAAABAAO
bWFudTIsMi41KzEuMTIsMiwyAAoJEFKgDEdIgJTyms0P/jeEH1xJq001K8uAfPeH
+wXdGRlKNuN+0ZRxR+RqjF0KRhgdjG0CBGUZu4ZdhKwaPlTy0ooeZSxohpOeBc/E
tEzblYRX7bueoOxHd/5Do2O22qPNxgWvAF1hGChHL/CasPpYjQYE2y5JH9yKsTum
R7MpkEbWcn4MR5Dcnd4Kc267bJ1+5xSSppXgfaBPUFhdSR0LsNJ4bB4q59KUDBRy
Kx4HS+bBVW7GP6+VwrZ0GdtPr/ztk5BRqVeZt1oETvxQKN7/BV7KWXDRIYjzjqcF
f4EeUKgUCWFxa0VG7J+EzghfUu7qJjld5qQKeSMra49xpERgN2KgA3CudZKAvyDe
+YHp76U51XD37PXRnNBCy+B0N1o4zzmw06p0sRD2Ka/XVHoWSptRDPV/YLYaihrW
lhZkPcNai7U/vJKF8pExbAsfYIY38ai3ZecLCQr9NRdtuZceOl7JpdadW5mDPI0Y
1JJSuC4lt/fUDkcCquruZANLoe8CtE9ueCMGkUQv7yxa77tySoRjZ7GgsZczyyFd
orrUhtiSPddepjRFRBf5Sz9msUiKXMFKCvj8v2gtH7ID1NooLh1auHM5bqKrgnag
Ohp0HV+oXQ+vo5Gg0rksIxla5JnTbApICp41ksDiKVWeLXchMyL8NGzeo1eZ6wyv
2hbh85lj2TkmSkJOfd6vkYxl
=nY7x
-----END PGP SIGNATURE-----
Merge tag 'printk-for-7.3-hotfix' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux
Pull printk fixes from Petr Mladek:
- Switch NBCON consoles to the emergency mode in emergency_restart() to
see messages even in this shutdown code path
- Postpone the start of printk kthreads after smp_init(). It prevents
boot stalls on some HW
- Typo fix in a previous hot-fix patch
* tag 'printk-for-7.3-hotfix' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux:
printk: Postpone kthread startup
printk: fix kernel-doc name for nbcon_write_context_is_braille
nbcon/reboot: Switch NBCON consoles into the emergency mode in emergency_restart()
- Fix NULL dereference when copying histogram field variable
If event_hist_trigger_parse() creates an action that uses one of pseudo
fields for its keys, the hist_data field element will have a NULL for its
field member. When looking to match that key, the lookup uses
key_field->field->name which will dereference a NULL pointer.
Instead use the helper function that handles such cases: expr_field_str().
- Take the trace_types_lock when dropping the buffer_meta reference
The tracing_buffer_meta_open() error return drops the trace_array
reference with __trace_array_put() instead of trace_array_put() where the
former doesn't take the lock and the latter does.
- Fix NULL pointer dereference when reading per_cpu/cpuN/buffer_meta
These files are created for every possible CPU. But it only contains data
for CPUs that have come online. If one is read for a CPU that hasn't come
online yet, it triggers a NULL pointer dereference.
Have reading of CPUs that have not come on line yet return -ENODEV.
- Fix an out-of-bounds shift in the log2 histogram modifier
Histograms can take a log2 modifier to have the buckets defined by log2
increments. If a shift is greater than ULONG_MAX or above 2^63, the key
falls into a lower order bucket.
Use order_base_2() instead of "ilog2(n - 1) + 1" to have all overflowed
keys go into the top bucket.
- Fix the persistent ring buffer rb_meta_subbuf_idx() accounting
The algorithm for finding the index of a sub-buffer in a persistent ring
buffer buffer did not take into account the meta data at the beginning of
the buffer causing the wrong index to be returned.
As rb_subbufs_from_meta() does the proper accounting to find the first
sub-buffer, use that function instead of repeating the logic (incorrectly)
and make the calculations based off of that.
- Fix the symbol name checks for the remote buffer code
The remote ring buffer has a build time check to make sure its not using
any code that will not be in the hypervisor. For various architectures,
there has been false positive reports from this checker.
Fix them.
- Fix false warning in ring_buffer_map_get_reader()
There is a WARN_ON() after rb_get_reader_page() if no reader is returned.
But there are legitimate cases where this can happen. Remove the WARN_ON()
and also a check that covers one of the legitimate cases that tries to
exit out early. There's no need for the check if it just simply allows the
return of NULL from rb_get_reader_page().
- Fix the ignored return value from resize_buffer_duplicate_size()
Some clean up of the code in tracing_snapshot_write() removed checking the
return value of resize_buffer_duplicate_size() and if that failed it would
not be detected.
- Fix the histogram timestamps for buffered events
The histogram timestamps are taken from the events that are recorded.
It currently reads ring_buffer_event_time_stamp() but if the event is
buffered it does not read it properly. Use tracing_event_time_stamp()
which handles both buffered and normal events.
- Do not initialize tracefs if tracing is disabled at boot
If tracing fails to allocate or some other error is detected,
tracing_disabled is set. Do not initialize tracefs in this case as it may
expect data to be initialized but is not.
- Free eventfs inode after an RCU grace period
Currently eventfs_inodes are freed after a SRCU grace period as the
iterations in the code use SRCU. There are locations that the inode may
still be accessed from the VFS that uses RCU which does not have the same
synchronization as SRCU. Add an RCU wait before free eventfs inodes.
- Do not fail persistent and remote buffers under memory pressure
As persistent and remote buffers have their own pre-allocated memory,
there's no reason to check how much memory is available before created
them. By checking the memory pressure, these buffers may fail to be
created even though their memory is already present.
- Account for subbuffer size when checking how much memory is available
Before allocating a ring buffer, the size is checked against the current
memory pressure of the system. But it assumes every sub-buffer is of page
size. This is no longer the case. Use the actual sub-buffer size when
calculating how much memory will be used.
- Reject non-stack fields for synthetic stacktrace fields
Stack traces are special fields and the checks currently do not do enough
to make sure that the fields being processed as stack traces are indeed
stack traces. Update the logic to properly detect what is or is not a
stack trace.
- Fix a crash in print_graph_function_event()
When a tracer does not define static or default flags the
tr->current_trace_flags is set to NULL. If the ring buffer is
not cleared when switching tracers, the previous tracers events
could be read. The function_graph entries will dereference the
tr->current_trace_flags and cause a crash.
Set the tr->current_trace_flags to a empty set of flags to prevent
it from being NULL.
- Separate tracing filter predicate count from allocation
The amount allocated for the predicate program is the number of predicates
defined plus two for adding "true" and "false" at the end. The nr_preds is
incremented by two to accommodate the booleans but is then used as the
limit check for number of predicates. This is incorrect as it is now two
higher than what is expected.
Use a separate variable for the size of the predicate array.
- Fix the filter operator stack check
The operator stack increments the pointer and then writes the content onto
the stack. The check for overflow compared the current pointer to see if
it was greater than the stack size before doing so. This is an off by 2
error as the write will be at the size - 1 and the compare is done before
the increment. Adjust the check accordingly.
-----BEGIN PGP SIGNATURE-----
iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCatItoRQccm9zdGVkdEBn
b29kbWlzLm9yZwAKCRAp5XQQmuv6qmfsAP9XviDyrl49/PBpuanB2qQzlMGqYQlb
CwISmzgWoO1jKQEArNiSpKsIdPLfSJSLfIHAGxAZfmT42SugA4M5jqhW3Qc=
=7KiP
-----END PGP SIGNATURE-----
Merge tag 'trace-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull tracing fixes from Steven Rostedt:
- Fix NULL dereference when copying histogram field variable
If event_hist_trigger_parse() creates an action that uses one of
pseudo fields for its keys, the hist_data field element will have a
NULL for its field member. When looking to match that key, the lookup
uses key_field->field->name which will dereference a NULL pointer.
Instead use the helper function that handles such cases:
expr_field_str().
- Take the trace_types_lock when dropping the buffer_meta reference
The tracing_buffer_meta_open() error return drops the trace_array
reference with __trace_array_put() instead of trace_array_put() where
the former doesn't take the lock and the latter does.
- Fix NULL pointer dereference when reading per_cpu/cpuN/buffer_meta
These files are created for every possible CPU. But it only contains
data for CPUs that have come online. If one is read for a CPU that
hasn't come online yet, it triggers a NULL pointer dereference.
Have reading of CPUs that have not come on line yet return -ENODEV.
- Fix an out-of-bounds shift in the log2 histogram modifier
Histograms can take a log2 modifier to have the buckets defined by
log2 increments. If a shift is greater than ULONG_MAX or above 2^63,
the key falls into a lower order bucket.
Use order_base_2() instead of "ilog2(n - 1) + 1" to have all
overflowed keys go into the top bucket.
- Fix the persistent ring buffer rb_meta_subbuf_idx() accounting
The algorithm for finding the index of a sub-buffer in a persistent
ring buffer buffer did not take into account the meta data at the
beginning of the buffer causing the wrong index to be returned.
As rb_subbufs_from_meta() does the proper accounting to find the
first sub-buffer, use that function instead of repeating the logic
(incorrectly) and make the calculations based off of that.
- Fix the symbol name checks for the remote buffer code
The remote ring buffer has a build time check to make sure its not
using any code that will not be in the hypervisor. For various
architectures, there has been false positive reports from this
checker.
Fix them.
- Fix false warning in ring_buffer_map_get_reader()
There is a WARN_ON() after rb_get_reader_page() if no reader is
returned. But there are legitimate cases where this can happen.
Remove the WARN_ON() and also a check that covers one of the
legitimate cases that tries to exit out early. There's no need for
the check if it just simply allows the return of NULL from
rb_get_reader_page().
- Fix the ignored return value from resize_buffer_duplicate_size()
Some clean up of the code in tracing_snapshot_write() removed
checking the return value of resize_buffer_duplicate_size() and if
that failed it would not be detected.
- Fix the histogram timestamps for buffered events
The histogram timestamps are taken from the events that are recorded.
It currently reads ring_buffer_event_time_stamp() but if the event is
buffered it does not read it properly. Use tracing_event_time_stamp()
which handles both buffered and normal events.
- Do not initialize tracefs if tracing is disabled at boot
If tracing fails to allocate or some other error is detected,
tracing_disabled is set. Do not initialize tracefs in this case as it
may expect data to be initialized but is not.
- Free eventfs inode after an RCU grace period
Currently eventfs_inodes are freed after a SRCU grace period as the
iterations in the code use SRCU. There are locations that the inode
may still be accessed from the VFS that uses RCU which does not have
the same synchronization as SRCU. Add an RCU wait before free eventfs
inodes.
- Do not fail persistent and remote buffers under memory pressure
As persistent and remote buffers have their own pre-allocated memory,
there's no reason to check how much memory is available before
created them. By checking the memory pressure, these buffers may fail
to be created even though their memory is already present.
- Account for subbuffer size when checking how much memory is available
Before allocating a ring buffer, the size is checked against the
current memory pressure of the system. But it assumes every
sub-buffer is of page size. This is no longer the case. Use the
actual sub-buffer size when calculating how much memory will be used.
- Reject non-stack fields for synthetic stacktrace fields
Stack traces are special fields and the checks currently do not do
enough to make sure that the fields being processed as stack traces
are indeed stack traces. Update the logic to properly detect what is
or is not a stack trace.
- Fix a crash in print_graph_function_event()
When a tracer does not define static or default flags the
tr->current_trace_flags is set to NULL. If the ring buffer is not
cleared when switching tracers, the previous tracers events could be
read. The function_graph entries will dereference the
tr->current_trace_flags and cause a crash.
Set the tr->current_trace_flags to a empty set of flags to prevent it
from being NULL.
- Separate tracing filter predicate count from allocation
The amount allocated for the predicate program is the number of
predicates defined plus two for adding "true" and "false" at the end.
The nr_preds is incremented by two to accommodate the booleans but is
then used as the limit check for number of predicates. This is
incorrect as it is now two higher than what is expected.
Use a separate variable for the size of the predicate array.
- Fix the filter operator stack check
The operator stack increments the pointer and then writes the content
onto the stack. The check for overflow compared the current pointer
to see if it was greater than the stack size before doing so. This is
an off by 2 error as the write will be at the size - 1 and the
compare is done before the increment. Adjust the check accordingly.
* tag 'trace-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
tracing: Check operator stack capacity before pushing
tracing: Keep the predicate limit separate from program capacity
tracing: Fix crash in print_graph_function_event()
tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields
ring-buffer: Use subbuf_order in available memory estimation
ring-buffer: Skip si_mem_available() for persistent and remote buffers
eventfs: Free the eventfs_inode after an rcu grace period too
tracing: Do not initialize tracefs work if tracing is disabled
tracing: Fix hist trigger timestamps for buffered events
tracing: Fix ignored return value of resize_buffer_duplicate_size()
ring-buffer: Fix false warning in ring_buffer_map_get_reader()
tracing: Fix simple_ring_buffer undef check on sparc64
tracing: Fix simple_ring_buffer undef check on parisc
tracing: Fix empty symbol names in simple_ring_buffer undef check
ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()
tracing: Fix the shift out of bounds in the log2 histogram modifier
ring-buffer: Do not show buffer_meta for CPUs without a buffer
tracing: Take trace_types_lock when dropping the buffer_meta reference
tracing: Fix NULL dereference when copying keys for a field variable
- tracing: probes: error if BTF is required but unavailable
Fix to return an error instead of NULL if BTF is not available when
user specify '$args*' meta fetch argument for probe events.
-----BEGIN PGP SIGNATURE-----
iQFPBAABCgA5FiEEh7BulGwFlgAOi5DV2/sHvwUrPxsFAmrSAywbHG1hc2FtaS5o
aXJhbWF0c3VAZ21haWwuY29tAAoJENv7B78FKz8bY14IAIQNGUIk12JDJMKWAhZp
Zv9jt7ER+3ei2v9qnhnykEvzbMA9PiuPu/6I8u1z+vTkJg7n7YK27DWWZ1o14E1m
CRMgo/c+s5H+vWaBwCuxxwYBEWBFNGzB2LFBrb8L6n4cMq07AqSfIRmbz83fZHNl
N8nxqK2aENVmnM3wvSM210TuZnYwihPQncRgSAsco6Y260G+LZbPdfDZXYbfWMTD
pxkSbjdVGueiowz0zszkDyFMqIR5mtLW1hRMn8qMZaEdeZAPDeruo69hXSRyd2ny
X379NoSSNjog2efWmXEzb3OYo5PuGVU1If5eGEBraDRgBiK18nB4a13HVkvfYWWW
AM8=
=vDMe
-----END PGP SIGNATURE-----
Merge tag 'probes-fixes-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull probes fix from Masami Hiramatsu:
- error out if BTF is required but unavailable
Fix to return an error instead of NULL if BTF is not available when
user specify '$args*' meta fetch argument for probe events.
* tag 'probes-fixes-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
tracing: probes: error if BTF is required but unavailable
With RRS Software Visibility, pci_dev_wait() considers a device ready as
soon as reading the Vendor ID doesn't return the RRS value. Devices aren't
required to respond with RRS while they aren't ready, so the read may
return ~0 and pci_dev_wait() stops waiting too early. This was seen with
Intel [8086:0a54] and Samsung [144d:a80c] NVMe SSDs.
Also wait while the Vendor ID reads ~0. A VF's Vendor ID always reads ~0,
so check its Command register instead, as is done without RRS SV.
Fixes: d591f6804e ("PCI: Wait for device readiness with Configuration RRS")
Link: https://lore.kernel.org/r/20250611101442.387378-1-hui.wang@canonical.com
Suggested-by: Lukas Wunner <lukas@wunner.de>
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Alexander Gruhlke <gruhlke@mailbox.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Lukas Wunner <lukas@wunner.de>
Link: https://patch.msgid.link/20261011190145.23621-3-gruhlke@mailbox.org
- AMD: Clear S4 wake bits when firmware has _AEI, this is
important for some AMD systems.
- Do not accumulate sunxi npins across probe() attempts with
deferred probe. (desc->npins just went ++ and ++...)
- Qualcomm patch galore: split QUP functions on the Nord pin
controller, fix an OF module alias on IPQ5210 so the module
modprobes, fix two groups on the IPQ5018, make direction
changes exclusive on the SPMI-GPIO, and fix the interrupt
target width on four different SoCs.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEElDRnuGcz/wPCXQWMQRCzN7AZXXMFAmrR5asACgkQQRCzN7AZ
XXNTFg//S2kHTNXB1aZgHjo1bt0F82kFT0sFVsuddhxXW05Ss4ij27/qPCIRqgaU
QY9cT8TRiLlM4eUZyehTeuBwSKT+sgjC8DlBNQj4omsWSK963h78RSbrBD3VpjEi
Zra5XBOKvYcUF9DSiP6b+koQ2DgTxy+s7haQQ9wGqV12jGIKa7qrx69I+ERa7zc3
er+zC7ze05Tm3fm5reGKrn0aL4d1OnLrOUIlvsQsKI7CfwnPLf4dh767IUOHTHbD
ewyAwZZI/X1cL7JlJ9qqPM33lBsNL1xUq61rJ+c5vhCNyO7XTAD4KuxrUCo03bQA
MiNVXJBkPF89y47TNuiSp1evJvRLTf/gWpsLqMg8UwNw8n3huXZXDHQWhmkw2fAC
6Tkk1Te63fiQsaDhSYtT16vLApd1eSld5Fg/MD/7kPgb6me46vV2F4pniF3utF48
Xy+P5AEiMkajnkip6j80e9yiHor8bRh6MfTKRO+GbJcS05Rs42uUNZTZSQrV+pbs
t6fml/k9H/pC95rABjHJmC9NMd0SOZz+xNRhC18PdnC7A17s4+e5eRyJ+VMcF9qL
jJnIER084wgVnd3yaCai4xEOXKhWXTa7ctR74FxM1iIr8sFj1a0fYp8TAHJngS18
rDDZ0FIL/dPCwU1CRfHF0bOUdYg5dAUxvraxINl0lL8obCshXIE=
=jqbg
-----END PGP SIGNATURE-----
Merge tag 'pinctrl-v7.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl
Pull pin control fixes from Linus Walleij:
- AMD: Clear S4 wake bits when firmware has _AEI, this is important for
some AMD systems.
- Do not accumulate sunxi npins across probe() attempts with deferred
probe. (desc->npins just went ++ and ++...)
- Qualcomm patch galore: split QUP functions on the Nord pin
controller, fix an OF module alias on IPQ5210 so the module
modprobes, fix two groups on the IPQ5018, make direction changes
exclusive on the SPMI-GPIO, and fix the interrupt target width on
four different SoCs.
* tag 'pinctrl-v7.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
pinctrl: sunxi: dt: do not accumulate npins across probe attempts
pinctrl: amd: Clear S4 wake bits when firmware has _AEI
pinctrl: qcom: ipq5018: replace gcc_plltest with pwm2 on gpio12
pinctrl: qcom: ipq5018: update PWM groups and corresponding pin functions
pinctrl: qcom: spmi-gpio: make direction changes exclusive
pinctrl: qcom: ipq5018: add missing pwm3 function on gpio13
pinctrl: qcom: qcs8300: Fix intr_target_width
pinctrl: qcom: maili: Fix intr_target_width
pinctrl: qcom: hawi: Fix intr_target_width
pinctrl: qcom: nord: fix GPIO interrupt target width
pinctrl: qcom: ipq5210: Publish the OF module alias
pinctrl: qcom: nord: Split QUP1 SE2/SE3 into lane-pair functions
- with the PCIe code reworked to power the endpoint via pwrctl before it
starts the link training, we can now remove the workaround for WLAN
power which instead started causing an issue with endpoint enumeration
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEkeUTLeW1Rh17omX8BZ0uy/82hMMFAmrR5D4ACgkQBZ0uy/82
hMOEaxAApBLm3IqWdD5Ll1u63o09TXi1+vhgrdu3OkDekzhuI3gGDU8zfKNNuFpf
UNZbGcf2HNIz3mWaKMZflt9BPnA4z/ruFp7coWTL2ytpz65StOZ500BtfVv2+/bX
bm07lojdDini1IT0gvKSy3QdW2ygvIXDe78AhWZWYybwnFN+HRoOIj8Dzg13lJAb
B4JAckLJZT4XEs5UvxTt97gn0KRDsr91XNlF6ADVP17VKo5MloYgeUsczlidYdeg
P3w7OWNuqdvCXD0OZBN8oggGiiFljm7OFqjvQMAOyuMQ/CYev6qWE2FWVhglTMNc
Xnvu9aLz4yKlP6oTs1k9InPvbD5mhOYXwyckyg7+FpvQyehsSBZ2qv8JraD6gNVi
gQiB0WG04khhvYhxG/OYNLY1vEWw1zcVSKSYmLzv3YV/geF/qkFZ1x+l0s4PoCez
ShiFDNnn5tkxMATJn14t8lNzZkXoWZvVXaER06hjsR2MTjf1bJc6K5rerw47KG1y
FKMvwrnc07zslnB8GksXIHMFe6GAbXzoWIUwlZzrzwZ3GXXsB6xNMaz9dnzlkPEc
vSo8wUT6LBuV17/6fXZMr4kI2M4nI6wiiF78c+fP0jyKw33HI0s9ybRyMzCKFW6L
n9BZ2EbOlHs/N66UCcZQZs2/4KiPAvG5+dBOIGxeYU4MOxkyVug=
=SaiM
-----END PGP SIGNATURE-----
Merge tag 'pwrseq-fixes-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux
Pull power sequencing fix from Bartosz Golaszewski:
- with the PCIe code reworked to power the endpoint via pwrctl before
it starts the link training, we can now remove the workaround for
WLAN power which instead started causing an issue with endpoint
enumeration
* tag 'pwrseq-fixes-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
power: sequencing: qcom-wcn: power off WLAN at probe
- gracefully handle unsupported fwnode-only, no-device GPIO lookup for
shared pins
- mark the GPIO controller as sleeping in gpio-nct6694
- fix a GPIO device reference leak in kunit tests
- fix memory leak in error path in gpiod_set_array_value_complex()
- fix races in GPIO controller and its associated irqchip setup in
gpio-mxc
- use atomic bitops where races can occur in gpio-mxc
- fix build failure in gpio tools
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEkeUTLeW1Rh17omX8BZ0uy/82hMMFAmrR4iEACgkQBZ0uy/82
hMNndxAAmWw+V/POtQI8MUVVpp9vvmxSbBA+E//owQRKE8+67RR42pxvVyL1KDj1
laLUX/ZEWSe4jfLwK11hSbqona3wcGTzgzNJIpDfix70QNwY2rKaJ9xx5xAF8+LJ
v1do7Et54FYJyhhuoeMNgLvaULpSXw4Vg9FeO6yHlLdUmkbKRSEgxlBN2UZ70Wgb
+7xeYgZpzN9OHQ/ldIsdsFwZTn8Zc7zx1a+dxlUy6OZ/ndXBBE5FOOOBCj97qCbN
AdDhNuIxH72l9dMgGJ9uvgVYU0ZVFl6RXYG4XB239dVsX80ewDP/XolOJM9wlxVT
p3i/zgv4SaTn8n/oKeUojvCNcR9dXrDouL/Fo2iRSEwwv87mVWyBMVAyWmTKAo9b
tvi3F2cZeSLYrvf0ZKGz08BbOxtxToATWxHq303PYRExFWq1h5l9n5D0XairNZrZ
cFeqP5rAOxWkB44aQRT1xU9LCZjYDO+LYYvevwfANrDseMpeJJmue/hBFPsIfWfs
I2gWNpKC9cG1R5H/pNsEn9JqO7VwQCuYx6QswTIDUlE4Wca11qZcz3APeriDIO67
PAHBOSm7jwKJ9nuXp9PfLYjqGss+uT1o6pYiJfYOA8PtvZofwqkeXvU0B8G2OIFt
KxcvHDg+soCqpaoYOBJLNAnMlvaJLg6ABHHi4SLrjUxsY1SiTAQ=
=ZNMF
-----END PGP SIGNATURE-----
Merge tag 'gpio-fixes-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux
Pull gpio fixes from Bartosz Golaszewski:
- gracefully handle unsupported fwnode-only, no-device GPIO lookup for
shared pins
- mark the GPIO controller as sleeping in gpio-nct6694
- fix a GPIO device reference leak in kunit tests
- fix memory leak in error path in gpiod_set_array_value_complex()
- fix races in GPIO controller and its associated irqchip setup in
gpio-mxc
- use atomic bitops where races can occur in gpio-mxc
- fix build failure in gpio tools
* tag 'gpio-fixes-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
gpio: mxc: fix race between gpiochip registration and IRQ domain setup
gpio: mxc: fix wakeup_pads bit operations
gpio: mxc: fix both_edges bit operations
gpio: mxc: fix race between chained IRQ handler install and probe completion
gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths
gpio: kunit: fix GPIO device reference leak with __free()
gpio: shared: gracefully handle no-device lookup of shared GPIOs
gpio: shared: fix use-after-free bug when adding shared proxies
tools: gpio: fix building from the top level with O=
gpio: nct6694: Mark the GPIO controller as sleeping
There have been various bug reports related to SMP systems hanging
on boot. The reports vary but seem to have some overlap with regard
to missed IPI's during SMP setup. The reports also show that
reverting NBCON console usage allows the bugs to disappear.
The NBCON kthreads for console printing are started very early
during boot using early_initcall(). Since these kthreads are
asynchronously enabling/disabling interrupts during early boot, they
may be interfering with early SMP setup on some hardware platforms.
Starting the console printing kthreads later has shown to avoid the
hanging on systems that could previously reproduce the issue.
Postpone kthread starting until after all arch initcalls have
completed.
Reported-by: Derek Barbosa <debarbos@redhat.com>
Closes: https://lore.kernel.org/linux-rt-users/arPmYPbFLf2EldIl@debarbos-thinkpadt14gen5.rmtusma.csb
Fixes: 76f258bf3f ("printk: nbcon: Introduce printer kthreads")
Signed-off-by: John Ogness <john.ogness@linutronix.de>
Tested-by: Derek Barbosa <debarbos@redhat.com>
Link: https://patch.msgid.link/20261016085441.857695-1-john.ogness@linutronix.de
Signed-off-by: Petr Mladek <pmladek@suse.com>
Please consider pulling these changes from the signed vfs-7.3-rc8.fixes tag.
Thanks!
Christian
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlQAKCRCRxhvAZXjc
ooBKAQCaO0P/WCAUk+nHRuqKMT5Wjpcb+RKbZEDYxMt+JobeOwEAhx4ThOT8eOwX
D2x/HjeOJ66fkbtFP1dXJzKaySf/PAs=
=g2mr
-----END PGP SIGNATURE-----
Merge tag 'vfs-7.3-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull vfs fixes from Christian Brauner:
- Fix a range of use-after-frees during rcu pathwalk caused by non-rcu
frees.
Whatever ->permission(), ->d_revalidate(), ->get_link(), ->d_hash()
and ->d_compare() read in rcu mode has to be freed after a grace
period. umount(2) hides most of it because namespace_unlock() waits
for one, but a chdir() out of a lazily unmounted directory or the
close() of the last file on it drops the last reference without.
* ext4_get_link() reads the sbi and the extent status counters for a
symlink stored in a data block. Both are freed after a grace
period now.
* The unicode map of casefolded ext4, f2fs and tmpfs was freed under
generic_ci_d_hash() and generic_ci_d_compare().
* ntfs3 with nocase freed its sbi and mount options under its dentry
hash and compare. A remount freed the old options right away too.
* eventfs freed an eventfs_inode after an SRCU grace period only
while tracefs_d_revalidate() reads it under rcu_read_lock().
* afs and 9p are only saved by the grace period their private bdi
gets in bdi_unregister(). They stop depending on it.
* create_ipc_ns() leaked the mqueue mount and its superblock on a
late failure. A long-term mount needs kern_unmount().
- Don't let idle threads pin the initramfs.
The idle threads of the secondary cpus are forked from PID 1 with a
private copy of its fs_struct, aren't on the task list so
pivot_root() never moves them and never exit. So the initramfs stayed
pinned forever on every machine with more than one cpu, 70 to 150 MB
in the reports. They share init_fs now like init_task does.
- A mount that copy_tree() leaves out can't take over a lock.
copy_tree() drops mounts of mount namespace files from the copies it
makes for unshare(CLONE_NEWNS) and propagation without looking at
MNT_LOCKED. So root in a user namespace could bind a child's
/proc/<pid>/ns/mnt beneath a locked cover, let it take the lock over,
unshare(CLONE_NEWNS) and read the file. copy_tree() refuses with
EPERM now and the move beneath a locked mount is refused up front.
- Revert "namei: don't reveal overmounted entries in refwalk" from the
rc7 fixes. The bug class is bigger than that patch.
- namei: lookup_fast_for_open() checked ->d_inode while
traverse_mounts() checks the type in d_flags, which is set second, so
a refwalk racing the instantiation could fail an O_CREAT open with
ENOENT. Use d_is_negative() in both places.
- Drop the smp_mb()s in mntput_no_expire_slowpath() and do_umount()
that mnt_get_count()'s own barrier made redundant.
- fsnotify: a mark added while fsnotify_destroy_marks() walks the
connector could be missed and the connector detached, so an fdinfo
read called igrab(NULL). New marks are refused during teardown.
- pipe: a failed second fasync enable on an O_RDWR FIFO removed the
existing reader entry and cleared FASYNC while the writer entry
stayed, a use-after-free in send_sigio() later.
- watch_queue: post_one_notification() could see nr_notes before the
note pool behind it and dereference a NULL array. An unprivileged
user can trigger that with a key watch. Publish nr_notes last.
- pid_namespace: zap_pid_ns_processes() waits without bound for a
tracer outside the namespace to reap its zombies and neither wait was
freezable, so every suspend attempt failed.
- exit: is_child_subreaper and has_child_subreaper shared a word with
other bitfields written without a common lock, so racing prctl()s
lost a bit. They are separate bools now.
- autofs: a notification write that failed on a pipe the daemon had
already replaced put the superblock into catatonic mode again and
closed the replacement. Only do that for the current pipe.
- ovl: reject a lowerdir ending with an unescaped backslash with EINVAL
instead of a confusing ENOENT later.
- ocfs2/dlm: take dlm_reco_state_lock when the debugfs state file walks
the recovery participant list.
- samples/pidfd: fix the userprogs typo that kept pidfd-metadata from
being built.
* tag 'vfs-7.3-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (24 commits)
Revert "namei: don't reveal overmounted entries in refwalk"
selftests/filesystems: test that a mntns file can't take over a lock
fs: let idle threads share init_fs
namespace: a mount that copy_tree() leaves out can't take over a lock
namei: test for a negative dentry the way traverse_mounts() does
fs: pass flags to copy_fs()
ovl: reject lowerdir ending with unescaped backslash
fsnotify: prevent mark additions during connector teardown
pid_namespace: make zap_pid_ns_processes() freezable
fs: drop the smp_mb()s that mnt_get_count() made redundant
autofs: ignore notification errors from a replaced pipe
ntfs3: free replaced mount options after a grace period
ntfs3: free the sbi after a grace period
unicode: free the map after a grace period
ipc: drop the mqueue mount with kern_unmount() on setup failure
eventfs: free the eventfs_inode after an rcu grace period too
9p: free the session after a grace period
watch_queue: Fix note pool publication race in watch_queue_set_size()
afs: free the super info after a grace period
pipe: preserve existing fasync readers on writer setup failure
...
