mirror of
https://github.com/torvalds/linux.git
synced 2026-10-25 01:05:03 +02:00
0fa993581a
1485139 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Vincent Donnefort
|
0fa993581a |
tracing: Fix simple_ring_buffer undef check on sparc64
simple_ring_buffer relies on headers that end up including
<asm/thread_info.h>. On sparc64, this emits the undefined symbol
current_thread_info_reg. Allow this symbol.
Link: https://patch.msgid.link/20260923074213.3077182-4-vdonnefort@google.com
Fixes:
|
||
|
Vincent Donnefort
|
ba875c4483 |
tracing: Fix simple_ring_buffer undef check on parisc
simple_ring_buffer uses local_set() and cmpxchg() on unsigned long. Add
them to undefsyms_base.c to extend the allowlist for the parisc
architecture.
Link: https://patch.msgid.link/20260923074213.3077182-3-vdonnefort@google.com
Fixes:
|
||
|
Vincent Donnefort
|
c902b6d709 |
tracing: Fix empty symbol names in simple_ring_buffer undef check
Sparc64 emits empty symmbol names. Skips them when establishing the
allowlist and when extracing undefined symbols.
Link: https://patch.msgid.link/20260923074213.3077182-2-vdonnefort@google.com
Fixes:
|
||
|
Donggeun Yoo
|
25132363c7 |
ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()
On a persistent ring buffer, rb_meta_subbuf_idx() can return an index one
sub-buffer too high. rb_setup_ids_meta_page() then fills subbuf_ids[]
shifted by one and leaves subbuf_ids[0] NULL, which __rb_map_vma()
dereferences when userspace maps trace_pipe_raw. rb_update_meta_reader()
writes two such indices into meta->buffers[], which rb_cpu_meta_valid()
would reject on the next boot, discarding the previous boot's trace.
A CPU's sub-buffer array starts after its meta header and the nr_subbufs
integers that follow, aligned up to a sub-buffer. rb_meta_subbuf_idx()
inverts that calculation but skips only the integers, not the header, so
its base is one sub-buffer low whenever the omitted header size crosses
the alignment boundary.
Invert the calculation with rb_subbufs_from_meta() rather than repeating
it. rb_range_buffer() maps an index back to an address through the same
helper, so the two directions can no longer disagree.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260918071507.1019251-1-donggeunyoo.kernel@gmail.com
Fixes:
|
||
|
Donggeun Yoo
|
647c2f97fc |
tracing: Fix the shift out of bounds in the log2 histogram modifier
The .log2 key modifier files a value under its base-2 order:
# echo 'hist:keys=bytes_req.log2' > events/kmem/kmalloc/trigger
hist_field_log2() computes that as ilog2(roundup_pow_of_two(val)). The
out-of-line form of roundup_pow_of_two() is
return 1UL << fls_long(n - 1);
which shifts by 64 on a 64-bit kernel both when n is 0, where n - 1
wraps to ULONG_MAX, and when n is above 2^63. Both are ordinary keys,
because the field fetch hands every value over as a u64: a syscall
argument of 0 reaches the first, and one above 2^63 reaches the second.
Keying sys_enter_lseek on offset.log2 and passing 0, 1, 2, 3, 1000,
2^63+1 and U64_MAX gives
{ offset: ~ 2^1 } hitcount: 1
{ offset: ~ 2^10 } hitcount: 1
{ offset: ~ 2^2 } hitcount: 1
{ offset: ~ 2^0 } hitcount: 4
Keys above 2^63 land in the lowest bucket. With CONFIG_UBSAN_SHIFT=y
the shift is also reported:
UBSAN: shift-out-of-bounds in include/linux/log2.h:57:13
shift exponent 64 is too large for 64-bit type 'long unsigned int'
__ubsan_handle_shift_out_of_bounds.cold+0xdd/0x1cb
hist_fn_call.cold+0x8b/0xd9
event_hist_trigger+0x1cc/0x790
ftrace_syscall_enter+0x197/0x360
do_syscall_64+0x402/0x4b0
Use order_base_2(), which is ilog2(n - 1) + 1 for n > 1 and 0 below
that. It returns what the old expression returned on every input the
old one was defined for. Where it was not, 0 stays in bucket 0, which
is where x86_64 had been putting it, and the keys above 2^63 move into
bucket 64.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260916002735.808520-1-donggeunyoo.kernel@gmail.com
Fixes:
|
||
|
David Carlier
|
3f23cae09a |
ring-buffer: Do not show buffer_meta for CPUs without a buffer
The per_cpu/cpuN/buffer_meta files are created for every possible CPU,
but buffer->buffers[cpu] is only allocated once that CPU comes online.
Reading the file of a CPU that never came online dereferences a NULL
cpu_buffer in rbm_start().
Fail the open with -ENODEV when the CPU has no buffer, as the other
per CPU ring buffer interfaces do.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260914133506.4865-3-devnexen@gmail.com
Fixes:
|
||
|
David Carlier
|
2afe7575fb |
tracing: Take trace_types_lock when dropping the buffer_meta reference
tracing_buffer_meta_open() drops the trace_array reference with
__trace_array_put() when ring_buffer_meta_seq_init() fails, without
holding trace_types_lock. Use trace_array_put() like every other open
error path.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260914133506.4865-2-devnexen@gmail.com
Fixes:
|
||
|
Donggeun Yoo
|
a0777b9e53 |
tracing: Fix NULL dereference when copying keys for a field variable
In event_hist_trigger_parse() where it needs to create actions like
"onmatch", it calls:
event_hist_trigger_parse() {
create_actions() {
action_create() {
trace_action_create() {
trace_action_create_field_var() {
create_field_var_hist()
Where create_field_var_hist() does a loop on the hist_data
representing the keys. The issue is, if the keys uses one of the
pseudo field types (like common_cpu), the hist_data field element
will have NULL for its field member causing a NULL pointer
dereference when accessing the key_field->field->name.
# echo 'hist:keys=common_cpu:ts0=common_timestamp.usecs' > \
events/sched/sched_waking/trigger
# echo 'my_synth u64 lat; int prio' > synthetic_events
# echo 'hist:keys=common_cpu:wakeup_lat=common_timestamp.usecs-$ts0:\
onmatch(sched.sched_waking).my_synth($wakeup_lat,prio)' > \
events/sched/sched_switch/trigger
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
RIP: 0010:create_field_var_hist+0x771/0x1380
Call Trace:
trace_action_create_field_var+0x360/0x600
trace_action_create+0x393/0xe80
event_hist_trigger_parse+0x3e47/0x69e0
trigger_process_regex+0x1a6/0x250
event_trigger_write+0xce/0x160
Instead of accessing it directly, use the proper handler
expr_field_str() to get the name.
The three previous patches are prerequisites: without them a .buckets
key and a common_stacktrace key each render into a command that cannot
be parsed back.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260914053443.981201-5-donggeunyoo.kernel@gmail.com
Fixes:
|
||
|
Linus Torvalds
|
24a19b953e | Linux 7.3-rc7 | ||
|
Linus Torvalds
|
d6d3455d87 |
Landlock fix for v7.3-rc7
-----BEGIN PGP SIGNATURE----- iIYEABYKAC4WIQSVyBthFV4iTW/VU1/l49DojIL20gUCasuxWRAcbWljQGRpZ2lr b2QubmV0AAoJEOXj0OiMgvbSHaEA/2qsakLl6MYmTQ5+c4MAdtPcJXttnQJoAWJl t5OrpCQEAP9A/DSj46Ci2ocnfbfvhtfHgzX5CQMef8nxUillfVYnBw== =G4p3 -----END PGP SIGNATURE----- Merge tag 'landlock-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux Pull Landlock fix from Mickaël Salaün: "This fixes a Clang bug by removing an annotation, which was introduced mostly for documentation" * tag 'landlock-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: landlock: Drop __counted_by from landlock_domain.handled_masks |
||
|
Linus Torvalds
|
f479598167 |
spi: Fixes for v7.3
A small collection of driver specific fixes, plus a new device ID in the DesignWare device tree binding. One of the sg2044 fixes which enforces clock limits properly is more critical than average since getting them wrong might lead to data corruption. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQReagvpf3TrrA7BoYYv73Ows9A4iQUCasrOmAAKCRAv73Ows9A4 iVT3AP9OD2ppR1G68eZZH3qB1Q9jhHAWREihWUqZZ+Y3I+hiVQEA8O0uTgTFveMw usHV1vv81Ca4EPAEmAKbrhBAH3oAMgY= =ibsk -----END PGP SIGNATURE----- Merge tag 'spi-fix-v7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A small collection of driver specific fixes, plus a new device ID in the DesignWare device tree binding. One of the sg2044 fixes which enforces clock limits properly is more critical than average since getting them wrong might lead to data corruption" * tag 'spi-fix-v7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: dt-bindings: snps,dw-apb-ssi: Add Synaptics sl2610 spi spi: sg2044-nor: Honor SPI clock limits spi: sg2044-nor: Return transfer errors spi: cadence-qspi: Fix status polling with octal DTR chips spi: spi-nxp-fspi: exit stop mode before waiting for DLL lock |
||
|
Linus Torvalds
|
5906f156e8 |
regulator: Fixes for v7.3
There's a couple of core fixes here, there were a couple of issues with of_regulator_bulk_get_all() not behaving consistently with the other bulk regulator APIs which caused memory leaks and error handling issues in users. We also have a of fairly standard driver specific fixes. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQReagvpf3TrrA7BoYYv73Ows9A4iQUCasrJ0QAKCRAv73Ows9A4 iSA9AP9lETVKHzhDIU+QiXmXh5mDVXTrpA0JXC6HL7fMUAgS6QEA4REJaKEbp9pU lvMfR/lTS88EbrtKF+ZuDM+EkIa+qQc= =xELe -----END PGP SIGNATURE----- Merge tag 'regulator-fix-v7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "There's a couple of core fixes here: there were a couple of issues with of_regulator_bulk_get_all() not behaving consistently with the other bulk regulator APIs which caused memory leaks and error handling issues in users. We also have a couple of fairly standard driver specific fixes" * tag 'regulator-fix-v7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: ltc3676: don't read the write-only HRST and CLIRQ registers regulator: of: state who owns the array from of_regulator_bulk_get_all() regulator: of: fill in supply names in of_regulator_bulk_get_all() regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4 |
||
|
Linus Torvalds
|
d5b6dc381d |
SCSI fixes on 20261011
Driver (and tape media changer) only fixes. Three of the fixes are about the same size, (ch, ufs decouble CQ and ufs avoid unsafe MMIO) but the unsafe MMIO is the least obvious logic change. -----BEGIN PGP SIGNATURE----- iLgEABMIAGAWIQTnYEDbdso9F2cI+arnQslM7pishQUCasspJRsUgAAAAAAEAA5t YW51MiwyLjUrMS4xMiwyLDImHGphbWVzLmJvdHRvbWxleUBoYW5zZW5wYXJ0bmVy c2hpcC5jb20ACgkQ50LJTO6YrIUL5gD+Lwi6HVanx/zkn6Qy+9N0Kx0IZTsamTpM Aug3Rx74YWYA/ii94bbXr0xrdohBAdPO1MppOQGfmcTqdHAIP/7lxWzn =EeOd -----END PGP SIGNATURE----- Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Driver (and tape media changer) only fixes. Three of the fixes are about the same size, (ch, ufs decouble CQ and ufs avoid unsafe MMIO) but the unsafe MMIO is the least obvious logic change" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock() scsi: ch: Do not keep references to data transfer element devices scsi: ufs: mediatek: Handle mPHY power-on failures scsi: qedi: Initialize callback state before registration scsi: ufs: core: Hold a clock reference across the probe |
||
|
Linus Torvalds
|
4375b45d70 |
block-7.3-20261010
-----BEGIN PGP SIGNATURE-----
iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmrLiicQHGF4Ym9lQGtl
cm5lbC5kawAKCRD301j7KXHgpvOmD/452m7OeggU07h2q1wqdiw2lh5zIvXcjQIF
ih4nl5lezismqbenazF6IqSsz5YAq5SM0EroNEXrQnr2UzndjyXyVN3fPdQVA+7R
8Hg3rlU31XzGW+WZknGx25RfaIGovNbJUFhPMuYpY41raOSevwIhx2X3k5UZUAWd
4id28sXJTMk097XdQnfqNcaXcu3FDHx9ZcOKlSyRWaZD36vY4XPFwrFESyMzyWWJ
PhfwTBG6/MxxzOS0QdCzkSpA1L1Ipj48LO87X/RMX8NnrXw5Gar6+1NhVykfocdb
acKxUaAw5VF72Uinrrm+f7tMIAmsoFzwJR+VXJJxYNQMB2GLBL69BOsz9Qmr6qaA
71GQ52wfGh8fajeUH5C+pTDab4zZwY9X+ugGoocXaK/f43vxLARYLevC/MEionD/
HbZazH79Ock4dLolMBKgDXhrLUZbk/d0TiJpJezaaO+v09KlWDyhf+uzFOKkfdUL
YUsXGkQT+cp1ymN2M7Stiey+b2EMPhU8NjL/Sb52o3gllxeP8tUfXfGimxIWH1k3
fhzqYHpZNROCB8wzqeawqkZzJPpe7Xj5H5FRDf6fiqWZ+BelD1Je+mq1Ck53XLKr
tmDnmFwl7B+FrX519u4BqObW95PKC/0JsrmW5BeW+mHjbIHnOCTVsZiEoW+Q+Q57
3twF8ITLUA==
=jxPV
-----END PGP SIGNATURE-----
Merge tag 'block-7.3-20261010' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull block fixes from Jens Axboe:
- NVMe fixes via Keith:
- Fix swapped ZRASF zone state values for full and read only
- nvme-multipath revalidate head zones after unfreezing the head
queue
- Revert "nvme: do not reset controllers in NVME_CTRL_NEW state",
which broke things
- nvmet fixes for invalid NSIDs on feature 82h and using the local
P2P device on metadata allocation failure
- zloop: zero out only the unread tail of a short read
* tag 'block-7.3-20261010' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
Revert "nvme: do not reset controllers in NVME_CTRL_NEW state"
zloop: zero out only the unread tail of short reads
nvmet: use the local P2P device on metadata allocation failure
nvme-multipath: revalidate head zones after unfreezing the head queue
nvme: fix swapped ZRASF zone state values for full and read only
nvmet: return Invalid Field for invalid NSIDs feature 82h
|
||
|
Nguyen Ngoc Thang
|
3d8cc52db2
|
landlock: Drop __counted_by from landlock_domain.handled_masks
With clang 22 and CONFIG_FORTIFY_SOURCE, the second
landlock_restrict_self() call hits a bogus fortify report in
inherit_ruleset():
memcpy: detected buffer overflow: 4 byte write of buffer size 0
Call Trace:
__fortify_panic
landlock_merge_ruleset
__se_sys_landlock_restrict_self
handled_masks[] lives in an anonymous struct inside the anonymous union
that overlays work_free. For such a flexible array, clang computes the
address of the __counted_by counter as the start of the array instead of
&num_layers. The bound is then read from handled_masks[0], i.e. from
the first layer's access masks, which is not a count. The same layout
crashes clang itself in a standalone test.
The annotation was added as documentation, so drop it rather than
restructure the union. Keep the information in the member comment.
Reported-by: syzbot+a0eecb22de4d821a9e5d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=a0eecb22de4d821a9e5d
Fixes:
|
||
|
Linus Torvalds
|
b7c0316c1a |
io_uring-7.3-20261010
-----BEGIN PGP SIGNATURE----- iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmrLihgQHGF4Ym9lQGtl cm5lbC5kawAKCRD301j7KXHgpqHYD/0WmtUynMfrRLjrod20cJV39pzOSBLVgAgu 9q4y6/o5UP6AFlenvvejA09AzAW14TpIx1xw+wz9W7kOIEfBFdYr+8ZlLdJCVY7+ COMDryOgoSZqd77CTUZ54V7d+z4dEOEYtkfpDBxq/0bbUrZpDB3UGHcQm1GBAj7y FGPIAqmjJ6BH5ymNlCwjmBhgkSSsscKtlJXHUgpDNrwPwndmcg38on3QWmNJP97u tnOO2j8Xy5TYDoGJ8liK37y56YKtR+vYiIRd1rlCvdtvtmaMBKkj3NNFMUGMEC25 1qapshKstL+20ZUmXTITGMxOfsrsZSj3nT93BV3W8jt/POMbhzX5W7zO8fS3gDKW 9XNYQXL2zMfp6iF3zIU3nsdcggK/T1uBtDXQureM8zl8QQa7XgJOCW8b8eNJZAo2 /W7Hz5TKshnrkXGEIvKWCb/UcrijHMLbtQ+eGcj/TeteMvO69bl+fQn0tzlOud0t lqMmFsuZMa6mkYn2XV86Ie2tf0AOS5LSGKsWwvkmAg5Pkz1l5qIDTyuLFEDfWQpg N3uLC/uo4+ap1s3ccUX6Pb8feZ1GVtjS7Wsqe04DFxFCESllbYiwkUMAGPFST7l8 SFZuafe/eJbW/MFnB/AKk5jBWMcwXP+usBWq/0w1/ETA4DhWXLQQnIefI1FoZpZa OjOfFuKDYA== =GaD2 -----END PGP SIGNATURE----- Merge tag 'io_uring-7.3-20261010' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: - Don't spin on local work the exiting task can't run. For a ring still R_DISABLED when the task got its tctx node, the submitter is set later and may be another task, so DEFER_TASKRUN local work stays pending forever and the exiting task spins in do_exit(). - Don't charge the SQ/CQ rings or provided buffer rings to RLIMIT_MEMLOCK. The region API conversion started charging them, which the rings had been exempt from. - Don't exempt disabled rings from task restrictions on register - Populate the CONNECT filter fields for a 24-byte sockaddr_in6 * tag 'io_uring-7.3-20261010' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/cancel: don't spin on local work the task can't run io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6 io_uring/register: don't exempt disabled rings from task restrictions io_uring/kbuf: don't charge provided buffer rings to RLIMIT_MEMLOCK io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK |
||
|
Linus Torvalds
|
5f97a3ec36 |
xfs: fixes for 7.3-rc7
Signed-off-by: Carlos Maiolino <cem@kernel.org> -----BEGIN PGP SIGNATURE----- iJUEABMJAB0WIQSmtYVZ/MfVMGUq1GNcsMJ8RxYuYwUCassr8wAKCRBcsMJ8RxYu Y0zlAYDt4ReluNicsRWxFKTeSU9GSJ3asMlyV24nBxOxj6ggzpMkJpU76aVDFCaq NDn13vEBgMVppi1VVMez8tYOOL390yfzlWnpq38mPaMnv4cXDQGZUvETcL1n+4U+ xVf/7NasOQ== =X+Ty -----END PGP SIGNATURE----- Merge tag 'xfs-fixes-7.3-rc7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Carlos Maiolino: "This fixes a data corruption vector where a user could trick the exchange-range feature to add shared blocks beyond the file's EOF, which may then be used to modify data on another file" * tag 'xfs-fixes-7.3-rc7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: fix exchange-range-to-eof file size exchange xfs: stop exchanging reflink flags when exchanging mappings |
||
|
Linus Torvalds
|
4d61397c86 |
x86 fix:
- Work around AMD TLBI Erratum #1718 (Borislav Petkov) Signed-off-by: Ingo Molnar <mingo@kernel.org> -----BEGIN PGP SIGNATURE----- iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmrLN7QRHG1pbmdvQGtl cm5lbC5vcmcACgkQEnMQ0APhK1hFohAAqJHoyW96qIFMKak6sY63CaJ3lDfFmaB2 8aZW8oKhmjTCECHH/Ff7wDxIL733CsdaxynnJ9YxAmujpsAmaO6Tk8PxuGaVPJsJ pTW8w4ViVJdnsaNzCQpbm8iB3Q5anmiqwgSd/2C8mmEZVF04ZtzmMKyGeGG99GPH p7AzpQKkh0UAjIGCV0i1KXQzboHXld4APJGcoiQIAmNBzdHjJBVrJA+vsUzdcLOf nufTe01afNa2ehlB2cwy0eOn9/+cnZsF4jObFBvmXYjD1rucYSRvUCWOFTMNt5vP Sj57hhhU5ozSHkZVz9I2l6W+7txk9qhLXPA3cFs3FDFjhXFqUo/mmRn/oQxwGzCR fsMq5ImTWTzdTuTzlhWFbNLUJOc0OFWMidyVb2eul9kipz451KFVssuTEWwpV3Mb fEfjPZnnuEAz+0kVckuLGEsROQFst0VDv53BVUSfmunIGZFtyWH1rIpEn4AeIYUC vT66l/pPYqF1tJcX2OB2tHgY2Qw2OCfQPloYrchLTsE2us+fpwZIp8du2yqjasGK 75V0AGDFV2xNkt+x76HZ0bKaFihfg3M7e0NZbon1BF3d4w/Z0HZ/JVaUEBglKTnz QdLD6Y8nKroaTazHfwCwR8JUPesFOuxAqIlZdEXWt2/adfgs7HaTjwu14nD5rrbQ eQhaUR6PyUE= =x9f4 -----END PGP SIGNATURE----- Merge tag 'x86-urgent-2026-10-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fix from Ingo Molnar: - Work around AMD TLBI Erratum #1718 (Borislav Petkov) * tag 'x86-urgent-2026-10-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/CPU/AMD: Fix AMD TLBI Erratum #1718 |
||
|
Linus Torvalds
|
b2d929a1c2 |
RISC-V updates for v7.3-rc7
- Fix a regression in the Zbb-enabled strnlen() implementation when
huge counts are specified
- When userspace pointer masking is enabled, strip the tag from
user-specified pointers in two spots in the RISC-V futex code where
this was missing
- When CONFIG_SHADOW_CALL_STACK=y, use a supervisor mode-only CSR bit
to determine whether the trap came from userspace or not, rather
than a userspace-writable register
- Reset the HSTATUS.HU bit during CPU initialization to avoid
unexpected behavior, as the RISC-V specification does not require
this bit to be hardware-reset
- Fix the T-Head GhostWrite probing code when !CONFIG_ERRATA_THEAD_MAE
- Fix RV32 boots using 32-bit.config by constraining NR_CPUS
- Implement a workaround for SiFive MAL-9092, which requires fences
around hypervisor load/store instructions
- Fix the RISC-V patch_map() code to work properly for EXECMEM
addresses when !CONFIG_STRICT_MODULE_RWX
- Fix ptrace register set access reporting when CFI landing pad or
shadow stack support is enabled
- Avoid copying garbage into the target's vstate when PTRACE_SETREGSET
is called with a short iov_len
- Fix load_unaligned_zeropad() on RV32 kernels with
CONFIG_RISCV_EFFICIENT_UNALIGNED_ACCESS=y
- Fix build breakage for any userspace program that includes
uapi/asm/vendor/mips.h
- Fix a build warning for 32-bit allmodconfig builds related to SiFive
errata
- Fix misspecified inline assembly constraints in the vector context
save/restore code
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEElRDoIDdEz9/svf2Kx4+xDQu9KksFAmrLCxIACgkQx4+xDQu9
Kkv0uRAAmTamkNXZpPx0WF9/i48d+40TS7U45u+w0wKbNxgRR+R4jNHOGr91bNQn
82pOG7c8AQbDJv0bed9EgdYQCQR58VC+GXLcCdV9ZvINs9ffIpyoYlD0kL5YXjSv
0kEM6ZCFn3+tLLko8e3UuBGZwnwN2VeyBae1TOutJx/jjTU6R2vrZHAsNd4ol3PB
CcZX533cbNDY4NKZHzniPXdWPdzWK42I5+HwNayf3BFUEsnN/JUZwHI0sTt3wgZo
DpOTRm/C883VelF8NnpPl0cAEux/0KfTP0GPsnPFOvuvIDA/Hn/PfRhweyjCRZ1r
LYWYLpvpbkCOPvyzFL0eKzl1DOgz8KtqdqOA/qUUooxog1egJ9uBynXrh0We4IV1
EbxRjKDiJ7QJJsX8m0xpWtMFYU0hQ3MHxePAxeSVdA5mHksEhWxvudWScwm2Cpt7
9Vq01WmyV3uBMlq7Cd9KJxyNGOTikpciMnUIR4h0WaHZxuevAfgXhs2dVRS2u/Be
a2CztPGV931/1BGLP+wV6I6BXqet+4Q86VDo1Dcj7u6Zr0NyjmJYfz64cmNrSVWZ
CDm9wvxhEedD+9fNvP4fx8B+8nRNZDpWtpevkFy5iDHkd9xeauKax9njrH/gw2S4
lIZZ1+5D14c/d6s0OJIwrMe+xcYu3cZ6qVCEmQXuO3jTHiXky4I=
=ZFs2
-----END PGP SIGNATURE-----
Merge tag 'riscv-for-linus-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux
Pull RISC-V fixes from Paul Walmsley:
"Several security fixes, a significant strnlen() regression fix, and
several other miscellaneous fixes:
- Fix a regression in the Zbb-enabled strnlen() implementation when
huge counts are specified
- When userspace pointer masking is enabled, strip the tag from
user-specified pointers in two spots in the RISC-V futex code where
this was missing
- When CONFIG_SHADOW_CALL_STACK=y, use a supervisor mode-only CSR bit
to determine whether the trap came from userspace or not, rather
than a userspace-writable register
- Reset the HSTATUS.HU bit during CPU initialization to avoid
unexpected behavior, as the RISC-V specification does not require
this bit to be hardware-reset
- Fix the T-Head GhostWrite probing code when
!CONFIG_ERRATA_THEAD_MAE
- Fix RV32 boots using 32-bit.config by constraining NR_CPUS
- Implement a workaround for SiFive MAL-9092, which requires fences
around hypervisor load/store instructions
- Fix the RISC-V patch_map() code to work properly for EXECMEM
addresses when !CONFIG_STRICT_MODULE_RWX
- Fix ptrace register set access reporting when CFI landing pad or
shadow stack support is enabled
- Avoid copying garbage into the target's vstate when
PTRACE_SETREGSET is called with a short iov_len
- Fix load_unaligned_zeropad() on RV32 kernels with
CONFIG_RISCV_EFFICIENT_UNALIGNED_ACCESS=y
- Fix build breakage for any userspace program that includes
uapi/asm/vendor/mips.h
- Fix a build warning for 32-bit allmodconfig builds related to
SiFive errata
- Fix misspecified inline assembly constraints in the vector context
save/restore code"
* tag 'riscv-for-linus-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
riscv: fix load_unaligned_zeropad() fixup for RV32
riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp
riscv: ptrace: Zero-initialize regset buffers before copyin
riscv: ptrace: reject CFI regset access when extensions are absent
riscv: fix NR_CPUS range leaking 64-bit default onto 32-bit builds
riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE
riscv: futex: untag the user pointer before the atomic access
riscv: lib: Fix ZBB strnlen wrap-around regression on huge counts
riscv: patch: fix handling of bpf-jit execmem addresses
RISC-V: Clear HSTATUS.HU on CPU initialization
RISC-V: errata: Add SiFive MAL-9092 workaround
riscv: vector: Fix output operands in context save
riscv: vector: Fix data pointer constraints in context save/restore
riscv: limit sifive errata to CONFIG_64BIT
riscv: hwprobe: use _BITULL() rather than BIT() in MIPS vendor uapi header
|
||
|
Linus Torvalds
|
b88c841d11 |
Input updates for v7.3-rc6
- A fix for the ati_remote2 sysfs attributes handling, resolving type confusion after conversion to dev_groups - Updates to the xpad joystick driver adding support for the Corsair Novablade Pro controller (wired and 2.4 GHz wireless) and a newer hardware revision of the 8BitDo Pro 2 Wired Controller for Xbox. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQST2eWILY88ieB2DOtAj56VGEWXnAUCasr21QAKCRBAj56VGEWX nBWuAQCBO6dsRJKdKICBgjj55mb8P9yOmtAXUDaSWnMONbcWJAEA3l0SJ8GnL0jh 4hLh6aCf4tTjIrB/cyKx47dSvj5YxQg= =3bCc -----END PGP SIGNATURE----- Merge tag 'input-for-v7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: - A fix for the ati_remote2 sysfs attributes handling, resolving type confusion after conversion to dev_groups - Updates to the xpad joystick driver adding support for the Corsair Novablade Pro controller (wired and 2.4 GHz wireless) and a newer hardware revision of the 8BitDo Pro 2 Wired Controller for Xbox. * tag 'input-for-v7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox Input: xpad - add support for Corsair Novablade Pro Input: ati_remote2 - fix type confusion in device attribute handlers |
||
|
Darrick J. Wong
|
7dfb218c82 |
xfs: fix exchange-range-to-eof file size exchange
Norbert Szetei posted a patch containing an incomplete description of a
bug in XFS_IOC_EXCHANGE_RANGE's TO_EOF flag. The bug tricks
exchange-range into modifying a file so that it has shared blocks
starting beyond EOF, which is never allowed because files never have
written data beyond EOF, and you can only share written data blocks.
This is key to all the incorrect behavior that follows.
Eventually I got from Norbert a description of what's going wrong:
> Fair. Here it is with physical block numbers, 4k blocks. peer is the file
> that gets rewritten and file1 is the one that ends up with the flag
> cleared.
>
> Start, nothing shared:
>
> peer size 4096 -> [100]
> file1 size 12288 -> [200] [201] [202]
> donor1 size 4096 -> [300]
> donor2 size 4096 -> [400]
>
> 1. FICLONERANGE peer's block into file1's middle slot:
>
> peer size 4096 -> [100]
> file1 size 12288 -> [200] [100] [202] reflink flag set
> ^^^^^ both files own block 100
>
> 2. XFS_IOC_EXCHANGE_RANGE file1 against donor1, file1_offset 0,
> file2_offset 8192, length 0, TO_EOF. One block is exchanged, and the sizes
> are exchanged with it:
>
> file1 size 4096 -> [200] [100] [300] reflink flag set
> ^^^^^^^^^^^ still owned, now past the size
> donor1 size 12288 -> [202]
>
> file1 says it is one block long while it still owns three. Nothing was
> unmapped. file2_offset is block 2, so this exchange cannot clear a flag.
>
> 3. XFS_IOC_EXCHANGE_RANGE file1 against donor2, both offsets 0, length 4096.
> By i_disk_size this is two one-block files exchanging everything, so
> xmi_can_exchange_reflink_flags() agrees and the flag is cleared:
>
> file1 size 4096 -> [400] [100] [300] reflink flag CLEARED
> donor2 size 4096 -> [200]
>
> Block 100 is still shared with peer.
>
> 4. pwrite(file1, 4096, 4096), which is file1's second slot, block 100.
> xfs_is_cow_inode(file1) is false, so no CoW:
>
> peer size 4096 -> [100] same block, new contents
>
> Block 100 is the only one that matters here. PoC below, it reads a file
> called peer in the current directory. The filesystem needs reflink and
> exchange-range, which mkfs.xfs 7.x turns on by default.
So yes, TO_EOF is screwing up the file size even if it's actually
exchanging the data block correctly. The following is the intended
behavior of XFS_EXCHANGE_RANGE_TO_EOF, as described by its manpage:
"Ignore the length parameter. All bytes in file1_fd from file1_offset
to EOF are moved to file2_fd, and file2's size is set to
(file2_offset+(file1_length-file1_offset)). Meanwhile, all bytes in
file2 from file2_offset to EOF are moved to file1 and file1's size is
set to (file1_offset+(file2_length-file2_offset))."
In other words, if we only exchange a portion of the file data, then we
should only exchange the portion of the file size that relates to the
exchanged data. Unfortunately, the code swaps the ondisk file size and
the incore file sizes, which is incorrect if the caller passes in a
nonzero offset.
Having confused the file sizes, the PoC uses a second exchange-range
call on what looks like a non-reflinked single-block file. Because the
file size is set incorrectly, exchange-range thinks it's exchanging the
full contents of two files and clears the reflink flag on the broken
file. That enables an extending write of the broken file to rewrite the
shared block that's just past EOF. This has become known colloquially
as refluxfs.
Once the file sizes are set correctly, the second exchange-range no
longer thinks that it's doing a full-contents swap, so it won't clear
the reflink flag on either of its file arguments.
Norbert followed up to an earlier version of this patch with a second
complaint about us not handling the i_disk_size state correctly:
> The offsets are bounded against the incore i_size but subtracted from
> the ondisk i_disk_size, so a file that has not been written back gives
> xmi_isize1 = 0 + (0 - 12288).
>
> For instance, you can do:
>
> $ xfs_io -f -c "pwrite -q 0 4096" -c fsync file1
> $ xfs_io -f -c "pwrite -q 0 12288" \
> -c "exchangerange -s 0 -d 12288 file1" dirty
> $ stat -c %s file1
> 0
> $ stat -c %i file1
> 131
> $ sudo xfs_io -r -c "bulkstat_single 131" . | grep bs_size
> bs_size = 18446744073709539328
That's wrong, and the new file size update logic depends on the ondisk
i_disk_size matching the incore i_size, so flush the pagecache as needed
to push it upwards.
Link: https://lore.kernel.org/linux-xfs/1E196589-DEBE-40AC-AFEA-D420DAAB067F@doyensec.com/
Reported-by: Norbert Szetei <norbert@doyensec.com>
Cc: stable@vger.kernel.org # v6.10
Fixes:
|
||
|
Norbert Szetei
|
d84d6c1a7f |
xfs: stop exchanging reflink flags when exchanging mappings
When an exchange covers both files from offset 0 to i_disk_size, xmi_can_exchange_reflink_flags() assumes every mapping moved and hands the reflink flag over to the other file. That assumption is wrong. A file can still own shared blocks past i_disk_size, e.g. after EXCHANGE_RANGE_TO_EOF sets a smaller size without unmapping anything. The flag is cleared anyway, and the next write to such a block happens in place instead of CoW, corrupting the other file that shares it. Commit |
||
|
Linus Torvalds
|
a5ebb76233 |
- amd64_edac: Shorten the ErrorInformation field read from the MCA_SYND MSR to
only two bits. It is perfectly fine to do so because no system ever supported more than 2 bits of information (the Chip Selects used were only 4 maximum) and newer hardware will use only 2 bits anyway -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmrKvjAACgkQEsHwGGHe VUrXohAAkfpqZl6l2SOOyrDNEAX8VqhhuIlp/wV+xpWtP32AZWDb3xyjrUB+Vzxs aR68mt57xzEWDQY0ciwIDWrxPSydDIWBIG6xeHAJc6PcT9BhP406MZ19mmJGRS85 Yl5yYlqm2Ucr8UGCe2vlS+4/CU2nbnRsXC7OeOMbVEKm73E/0Auq0Za8N+45SwcN 5QoPt1ffZBL6MJMceX73uztwwvXoh68/jnVd4LjjF8w7JUoXuOa1m/tDosL3zDNR 4Oy+i5YOfXNQ96L4OS4nwLBuUdwH4psWcWOwAD3WN+10OBWtMxUIV5cJgwcB+oHm SL0J5TECPJtWRmzNBraqPnOW8hwMFLrT1KOxOaq/nO7D1T2K+2Hf8Wo1/btoQWqz jisRSfNbaGeDuiXAoZKsWf6AkVBMHb3eXPsNRCywXh13+oZ5BfMtojXBYD9BHQsy U9DGLNuecccCvVbMvqci3wj+nYNgWt5ZRkqT9HeIcnFSRc6kC7O3c40qNAtwl1Qj NbGKkfelAQRaJFaT7l1tPj4NlsanqL/J3sF+wV5HZShhiWkUmaT9Pr6NXXKzq7I+ eUO7ccDb7RaAdGTvK1V6Gl3oPaHa+o23qFvBSqKA6GGClwZpO3G8qwVSEoZHGtS1 L0wEC1bzN3I+C9Uq/SKyCuaefouvBQJGMGr0XhwZ8RRTFfISjnA= =F1H/ -----END PGP SIGNATURE----- Merge tag 'edac_urgent_for_v7.3_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC fix from Borislav Petkov: - amd64_edac: Shorten the ErrorInformation field read from the MCA_SYND MSR to only two bits. It is perfectly fine to do so because no system ever supported more than 2 bits of information (the Chip Selects used were only 4 maximum) and newer hardware will use only 2 bits anyway * tag 'edac_urgent_for_v7.3_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/amd64: Mask UMC chip select to the four implemented selects |
||
|
Linus Torvalds
|
bb934c29fd |
drm fixes for 7.3-rc7
fb: - defer setup when fbdev_probe() fails, not just on -EAGAIN bridge: - Fix unlocked list_del in drm_bridge_add() - Fix unlocked list access in drm_bridge_attach() - th1520-dw-hdmi: Fix error check on dw_hdmi_probe() return value - th1520-dw-hdmi: Fix remove() callback aspeed: - Balance the display clock enable on teardown i915: - Fix a GT park race that could trigger spurious RPM wakelock warnings - Fix execbuffer relocation cleanup to avoid out-of-bounds free xe: - i2c removal - system Controller Maibox header handling - two bo pin/unpin accounting bugs - not emitting a w/a twice - xe_mmio_wait32() to honor delay/sleep maximums amdgpu: - Fix direct scanout alpha on some DRM_FORMATs - UserQ fixes - Fix tearing flips with PSR - GPU reset vblank fix - Debugfs register interface fix - Fix display mode patching - Expand Mac reserved memory workaround amdkfd: - SDMA doorbell fix - Fix dma-buf reference leak in error path imagination: - fix reference and vm_bo handling in remap() - size page table preallocation by device address gud: - don't keep a connector without a CRTC as connector_state panthor: - validate userspace queue count against initialized firmware slot count nouveau: - fix null ptr regression - skip turing CE workaround for non-GR vmwgfx: - validate pitch value - add blend mode property vc4: - drain hangcheck timer on unbind - free BO cache on teardown - use kvmalloc_objs for bo cache size list - disable V3D interrupt across runtime suspend - fix binner slot allocation - fix fw refcount leak -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmrKj3sACgkQDHTzWXnE hr6e+A/+I1d+UvVkSnIsMv7NGLGiNvDClWvTnypF0ys2poiUGZ88UPzGuE7r8zfc BK9zZnQ/+LSYu/NLhmLnxDxYmx+Y2rKMjQEq22RsjUAzrPhn0/UsoWTt5jRMfim+ If9gW5p51rX4TBH90fgiTiwvAHxfSSzPjIlQIcjSAQKFxOIZ6mQtyKU4453H//XQ AO1fIDOvcUnZXyQCveoLtaU9ICKv5HNTwF4UBAnRfOmrJr/1ny2H51/tsFkh4Dwy h/OMyJDMNSfa/w9JZOGC/+fEipEQZ15Hk3QUy8i+UUEtD/JKFeG2nlNPuKqjjhrA slQa8E9M7anw+akPjJ0vWrOrqMXcxXE9huRWUUvv9MXkXpFjYmUeBTw1Q9Oc2No4 kdqmS9Skl6R/VJjeWeV2m/iNftL0k3CUWr2paCb9nGUOoaxdoMC72JVl7MprrSOT KG46ggDMfqhIygfkT+PBighZkMCJs/Fkw/UCM9Dldc3M3ds1VmQnH9I+1W+LUqjN OHT5FJfiabejImgnrPtPDtGJtZQub7K9ZUJc13GqxjCK3IXp1oqit8wVZS1qqmw7 3dpc+mWB0Re9CnlaOVb/WTzbip3WGlX8mdHrm+gKYHhigR5EjwiZSal7jP+fKYqK riXBBTU4CE44Y92lutvtJ4NjSqiShK/pzAkzPVVL8bCYoQAL4fk= =TKVJ -----END PGP SIGNATURE----- Merge tag 'drm-fixes-2026-10-11' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Ailie: "Live from Dublin Airport, it's Saturday Night drm fixes. This week has the missing misc fixes from last week which I tracked down and seemed to be a race/bug in my lei setup somehow, once I asked lei to ignore it's cache I got the missing email. But there are more misc fixes this week and amd and intel ones. The main ones in this are amdgpu and xe, with vc4, vmwgfx, nouveau and imagination in the middle, with a bunch of small single fixes. Bit busier than I'd like, but the missing misc might explain it, anyways time for me to fly home. fb: - defer setup when fbdev_probe() fails, not just on -EAGAIN bridge: - Fix unlocked list_del in drm_bridge_add() - Fix unlocked list access in drm_bridge_attach() - th1520-dw-hdmi: - Fix error check on dw_hdmi_probe() return value - Fix remove() callback aspeed: - Balance the display clock enable on teardown i915: - Fix a GT park race that could trigger spurious RPM wakelock warnings - Fix execbuffer relocation cleanup to avoid out-of-bounds free xe: - i2c removal - system Controller Maibox header handling - two bo pin/unpin accounting bugs - not emitting a w/a twice - xe_mmio_wait32() to honor delay/sleep maximums amdgpu: - Fix direct scanout alpha on some DRM_FORMATs - UserQ fixes - Fix tearing flips with PSR - GPU reset vblank fix - Debugfs register interface fix - Fix display mode patching - Expand Mac reserved memory workaround amdkfd: - SDMA doorbell fix - Fix dma-buf reference leak in error path imagination: - fix reference and vm_bo handling in remap() - size page table preallocation by device address gud: - don't keep a connector without a CRTC as connector_state panthor: - validate userspace queue count against initialized firmware slot count nouveau: - fix null ptr regression - skip turing CE workaround for non-GR vmwgfx: - validate pitch value - add blend mode property vc4: - drain hangcheck timer on unbind - free BO cache on teardown - use kvmalloc_objs for bo cache size list - disable V3D interrupt across runtime suspend - fix binner slot allocation - fix fw refcount leak" * tag 'drm-fixes-2026-10-11' of https://gitlab.freedesktop.org/drm/kernel: (39 commits) drm/nouveau: Skip the Turing CE workaround object for non-GR channels drm/vc4: Fix binner slot allocation failing on an idle GPU drm/vc4: Disable the V3D interrupt across runtime suspend drm/imagination: Size page table preallocation by device address drm/imagination: Fix reference and vm_bo handling in remap() drm/amdgpu: make Mac FB workaround generic drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info drm/amd/display: Don't replace a sink mode that shares the native totals drm/amdkfd: align SDMA doorbell base for shader doorbell writes drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks drm/amdgpu: serialize vblank counter reads against GPU reset drm/amd/display: disable self-refresh on tearing flips drm/amdgpu/userq: return the memdup_user() error for the user MQD drm/amdgpu/userq: only accept doorbell BOs as queue doorbell drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs drm/xe/i2c: cancel the client work on remove drm/xe/sysctrl: Fix mailbox header handling drm/i915/gt: Unmask interrupts only when ACTIVE is true drm/i915/gem: Prevent overstepping exec array boundary drm/gud: don't keep a connector without a CRTC as connector_state ... |
||
|
Linus Torvalds
|
b62f58bd71 |
i2c-fixes for v7.3-rc7
qcom-geni: fix runtime PM reference leak on xfer -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQScDfrjQa34uOld1VLaeAVmJtMtbgUCasoNSwAKCRDaeAVmJtMt bvJNAQDmm2Rj8dyCOMlm6pNRJv8Wh6CpydUbmTbko/GRMsBWiAEAsPiRtXC07Z+w GrOIQdIVrKCPiShnW0ajDufnMZjDpg4= =i2NX -----END PGP SIGNATURE----- Merge tag 'i2c-fixes-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux Pull i2c fix from Andi Shyti: "Just one qcom-geni fix for a runtime PM reference leak during transfer setup" * tag 'i2c-fixes-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux: i2c: qcom-geni: release runtime PM reference when set_rate fails |
||
|
Dave Airlie
|
c61e23ed14 |
A pointer assignment fix for gud, a reference fix and a preallocation
size fix for imagination, a suspend fix and an allocation fix when idle for vc4, and a hardware variant fix for nouveau. -----BEGIN PGP SIGNATURE----- iJUEABMJAB0WIQTkHFbLp4ejekA/qfgnX84Zoj2+dgUCasjkYwAKCRAnX84Zoj2+ dpu/AX0QwkYdn5r75S9Nsud12AGxs68MQYdf9O/JnsJYO5+Y5L078rTScygmDnvT civ/Y3ABgIhqXI1I/vXtyC7T+REXa47Gpll+ZVtw2FLj7c9czWjgr2iHIqXpn8pK 3A7y86s0kA== =YUdz -----END PGP SIGNATURE----- Merge tag 'drm-misc-fixes-2026-10-09' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes A pointer assignment fix for gud, a reference fix and a preallocation size fix for imagination, a suspend fix and an allocation fix when idle for vc4, and a hardware variant fix for nouveau. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maxime Ripard <self@mripard.dev> Link: https://patch.msgid.link/asjkbknTHg2t8JGy@houat |
||
|
Dave Airlie
|
492c4ded0f |
amd-drm-fixes-7.3-2026-10-08:
amdgpu: - Fix direct scanout alpha on some DRM_FORMATs - UserQ fixes - Fix tearing flips with PSR - GPU reset vblank fix - Debugfs register interface fix - Fix display mode patching - Expand Mac reserved memory workaround amdkfd: - SDMA doorbell fix - Fix dma-buf reference leak in error path -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQQgO5Idg2tXNTSZAr293/aFa7yZ2AUCasfVFQAKCRC93/aFa7yZ 2Nf6AP0T/qzbqO519Aih3Zr1Y8rETWjQ38fCoDbojom9/tzAoQD9HgNQkNvkO+fK R4uCeUzG91tnJK2Yuzv+WzWIbLQrdAA= =Ptpq -----END PGP SIGNATURE----- Merge tag 'amd-drm-fixes-7.3-2026-10-08' of https://gitlab.freedesktop.org/drm/amdgpu/kernel into drm-fixes amd-drm-fixes-7.3-2026-10-08: amdgpu: - Fix direct scanout alpha on some DRM_FORMATs - UserQ fixes - Fix tearing flips with PSR - GPU reset vblank fix - Debugfs register interface fix - Fix display mode patching - Expand Mac reserved memory workaround amdkfd: - SDMA doorbell fix - Fix dma-buf reference leak in error path Signed-off-by: Dave Airlie <airlied@redhat.com> From: Alex Deucher <alexander.deucher@amd.com> Link: https://patch.msgid.link/20261008174658.2506431-1-alexander.deucher@amd.com |
||
|
Dave Airlie
|
a8013cbe8d |
Fixes on:
- i2c removal (Fan) - system Controller Maibox header handling (Mallesh) - two bo pin/unpin accounting bugs (Thomas) - not emitting a w/a twice (Tvrtko) - xe_mmio_wait32() to honor delay/sleep maximums (Al\ an) -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEEbSBwaO7dZQkcLOKj+mJfZA7rE8oFAmrHxFUACgkQ+mJfZA7r E8py7Qf+ODo88JXxsL6C62wpd4nNbYxxBxLGW0TLrmtveBm/2uLvQQInOJpkE/Ni awXUrW92CbJWN1cAxvrvrGQBO1NedkypCMxHgmfsiUmSmEpT34/KXLExn8A5Kddo m+VzMxHWavk0k4ELsullJlFSZbnTC3hwOZlK7tJ0HaKatEpH8uM8EQk3qZqGEnOM OjuQDLLyEF3MwwvSv+Y81oZLfeNHaJ6esjmSX4mccd3sxjmRa0dFPAjRaRzLa+2P A+cw3ep+cRBZSutNBhElWPJZTrRzgNBKkBnB05+FeIctcRNbhvUf23IiWlf2kWvg G4DkiE/m/G/RKO+/t0DNsiDcnIloGA== =610A -----END PGP SIGNATURE----- Merge tag 'drm-xe-fixes-2026-10-08' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Fixes on: - i2c removal (Fan) - system Controller Maibox header handling (Mallesh) - two bo pin/unpin accounting bugs (Thomas) - not emitting a w/a twice (Tvrtko) - xe_mmio_wait32() to honor delay/sleep maximums (Alan) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patch.msgid.link/asfEfgbIjs0GJ-RF@intel.com |
||
|
Linus Torvalds
|
3857c2fe54 |
pci-v7.3-fixes-4
-----BEGIN PGP SIGNATURE-----
iQJIBAABCgAyFiEEgMe7l+5h9hnxdsnuWYigwDrT+vwFAmrJDcMUHGJoZWxnYWFz
QGdvb2dsZS5jb20ACgkQWYigwDrT+vy3yg/+N0HQJ+3TmmVgLHpZryZnicIvr4Rk
aak7isoP1g2fCHXmNaHptm5bOWyGOJ3sPl8t6Z2JtNNqEO/Fz4bF2KNQkTtCnvRP
dB/j9deI2omhpIWpmOAaL6Z5nN3rbKz8OFxyQGQpkG83qS7M0jF0rpSLLhi6wyp+
EBDMkw03OK6iubvwaECJdwmdk1mkhjHnv04ONLZfq8DNJm7jFQYAui2nQ2Fw8lti
BZb8yY+CGW/PUpGgSmJOa2UERxNBKH78sSK218nsQ5M7oXU4rLzgjmKnyfIz1F6X
1Xqs2R7UzO1kosHpjqR9wSBIay5331g9fdSVYSiMcVXGbroxZZ9yzvgBTQABeaT8
jLo6l6Z/j8CQ5B9oq4nk8lAeZj661IMIQKyJcssbIvwv4Nq+5JHECr1n8loo9sTG
85r4n6nSSBXxQlg4EY+SVXTO5Rpf0QYz6CI0eIYeUU2oxlAhctJ+B2khBmSTgSzY
lw1XiQDOMgD1WDH/GN0pr/alvi90RMhj1s6dnVlYEiCF9FyAXR1zb8EpFZ0SsBm5
I28N/+QmlUw1hrdeRiYn1c+5asvCCqAx2OR3xlllU55CS7rsjXdOVnPUFe6xtH93
0Yi3KmH0uVl6X+WgWjGnLCWYIBR3DAE9lF8LzNlKMVSP+V6TfPvrnfNahuZvdK7H
NbraXi5qBPycGyw=
=fagl
-----END PGP SIGNATURE-----
Merge tag 'pci-v7.3-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci
Pull PCI fix from Bjorn Helgaas:
"This fixes some GPU initialization regressions caused by
|
||
|
Linus Torvalds
|
b71ccf604f |
MMC host:
- cavium-octeon|thunderx: Destroy slot platform devices on remove
- mtk-sd: Cancel request timeout work on remove
- sdhci-sprd: Disable runtime PM on remove
MEMSTICK:
- Wait for request completion before freeing card
- rtsx_usb_ms: Complete requests after eject instead of dropping them
-----BEGIN PGP SIGNATURE-----
iQJEBAABCgAuFiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmrI78UQHHVsZmhAa2Vy
bmVsLm9yZwAKCRD+JoQlc1iMKcd6D/4sm/MrbdE0d8Q9ceIV9BAfiQfETj4mo53Q
3uH07n9PSaxVIJotLvvjni5TmAiISqXm+ZyNb0VMn8Xz4piVOhaOY4vKaiiLM71B
bMaim5lLd/oc5IopvzaYgEz7hOV6NSbqMjlC31fBQhkEtD9f182/A0324LFAuE0T
H+VtnhxbExzCXbeeSCWQhERaWTG93csh9gTSS8W9kZzcTngEVly+vpZELTeJwhZl
sVfzFTIf7Jv3omeDfMfwWUgfYRHlBVvgjI0ZtgZbZzhWyLj8SOQXvqH/PKmn+mxx
UdrmJsrTCI0MmbJRnmOkxgD5t9KGmVPD8oS36BUGZ/6qYRs+bzCRqAN3n+kXHmV4
cYF6/YOUNVBIkJ9qPZZapySYI3YBlu9GgD+dMriAAc+Jt2jBlbNBqdzQScouCSx3
kjx50GiPC7HSwtf77Up3inJuVig7Qwut2BnEznhYgtv1AatNqZAzMLzx+ZB8M/Dw
kOQDkQNGeg+Lpmd2oqjtnHezdiR5b+H2Zc5U+I8lSMRZPmHn1yhE5KKAxkLdcTaJ
SUQN1Nn2cFiyef55apb03K2JHQS+Wh7xzDvbR4/rZ4VursJgNuRE9G0YmU+jJlrg
IlsGKFXRvTuub0E+MvQ57xLxo4CjG40J9wgPgygTldLb1aU2OJKUX/JzwBTMDTD1
AcrnwZub/g==
=42Y1
-----END PGP SIGNATURE-----
Merge tag 'mmc-v7.3-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc
Pull MMC/MEMSTICK fixes from Ulf Hansson:
"MMC host:
- cavium-octeon|thunderx: Destroy slot platform devices on remove
- mtk-sd: Cancel request timeout work on remove
- sdhci-sprd: Disable runtime PM on remove
MEMSTICK:
- Wait for request completion before freeing card
- rtsx_usb_ms: Complete requests after eject instead of dropping
them"
* tag 'mmc-v7.3-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
memstick: rtsx_usb_ms: complete requests after eject instead of dropping them
memstick: core: wait for request completion before freeing card
mmc: cavium-thunderx: destroy slot platform devices on remove
mmc: cavium-octeon: destroy slot platform devices on remove
mmc: sdhci-sprd: disable runtime PM on remove
mmc: mtk-sd: Cancel request timeout work on remove
|
||
|
Linus Torvalds
|
f7bec60381 |
[GIT PULL for v7.3-rc7] media fixes
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE+QmuaPwR3wnBdVwACF8+vY7k4RUFAmrJCqQACgkQCF8+vY7k 4RWu/w/+LBwsMO9VA1C16lAKROP5HwuSdumeNnsjNinZX4Tonmz7Y5L+Ru+9Jzcz WDpbNtJTNhMa2f+i1YhCPVxNp22mwuGaqNUm8xfipt9fuvwShPaTTzoNsEh7l3iT TwMt2G5Np0G1u0fiDaBESR30sKw6YfYR8nxhM3lP4FfK4M3GhkuDnaAtwzCHa1Dm 1M1J76kS6eUGT+BOJMy6qARhAD00zQgjk9HZDV56FmCsz2XdDh1hnOC11IvbRV+K spdU3TffnoU4FMWQQnqJHxJR/Btq72O0CmiHVPopHQFM9DA6eEBd0eUcXTieIjbb aFp04/z0EWlYuwEGPKvnAdmwiJfRgoMLgGTnyViZMV0KtGbXVHmEr4KhUjRNMvVl Vjz/9ehYEweiKwQhUuV+upaQeWyQzI9VNbkAr9KSXX81piyFAkzur4dXljf8qR/x KQUIyhyshcvgQ0upoVFZ2q23hq1s7hKGOmFKT6DZhXs0OySkYRbj/iFzQ4YyhBpJ qTMmFF+Edlg0CtVhST3QxZcYv7b97RG2pue+R2jX71xB25yq2MbebMmjKB8Vp5id AhsvlRY0Dyp1sPqPtfukERSoCgJ6UHKI6D7DqpqzUcIeLgVyBEAjri4jUCZxhvXn 9fzYX56K1IuEFUl64LrPAhejo0iQTsdKx/gBprQulzwsDp4QrX8= =M/y8 -----END PGP SIGNATURE----- Merge tag 'media/v7.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fix from Mauro Carvalho Chehab: "A fix for em28xx unregister code affecting devices with FM radio support" * tag 'media/v7.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: em28xx: use video_unregister_device for radio_dev |
||
|
Linus Torvalds
|
5f6ee187fa |
sound fixes for 7.3-rc7
A dozen of small fixes. All device-specific quirks or fixes, and nothing exciting is expected. - USB-audio and HD-audio quirks - HD-audio TAS2781 codec fix - ctxfi driver memory leak fix - ASoC AMD quirks - ASoC cs35l56 and adau1372 codec fixes -----BEGIN PGP SIGNATURE----- iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmrI71gOHHRpd2FpQHN1 c2UuZGUACgkQLtJE4w1nLE/doA//VzIL0NcwVlEduCcwTcfWRwGjn7QPPA0isbjy Z+2SDryLxx+JgnCf6tI86CcBjP7o4hWHX9pHXb3smy7862aoWAUt5r5LR2MCZNa0 Q6wGiqDcL3jhNdy5gE5KUzShtD3DWAXo4Pqv/urHyOBHjcGqa6HNAurja7tmFne6 5DkozkvxyP/CIUsOHltO+YRPzmI7OIrLGjC5lbuyhNHIzCOEyUHgKaVFzyr6Fwcz ansQpgOQxc+0VN/FEVI0rXqxG483pSP+M0Ao8Y+aWpSTG534dgw2oGC10M2G59uW p4MyHkkhMcy41ARMLWWlYmzCEbsleiBBUUqIhKIwOAWJRHksRHwRtmHmTpcJbAHZ E7HkRGw6WOyxo9KKeD0fdyxBIF5VIvqrumjreWu2dX9XNJDzrfJZMtkzB+rStqmQ KR7uctZvGgfFKOJ76ENYmeEaEVNFREGK531aGRgiqCvOEJ/naY3PT/V3f6BIDjp+ OmG1YFqkI2vbC+Vw49+ydiAbvLz/ulhsFRvlNGzZl829Gpn/cwnw1sBRW+2QoCzX 4a6ICUZ76NlsneiqI3yHCm87VyDPmY8Mn3V8UAbEapt6G5xirDjDClV3qHAn928A fRZ5YB4poD/ek143mp306ljnxx14nQZiFDowLAIbi5ZCIjv6cXMMw79wOe4yzOax 0xYNFXo= =at5l -----END PGP SIGNATURE----- Merge tag 'sound-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A dozen of small fixes. All device-specific quirks or fixes, and nothing exciting is expected. - USB-audio and HD-audio quirks - HD-audio TAS2781 codec fix - ctxfi driver memory leak fix - ASoC AMD quirks - ASoC cs35l56 and adau1372 codec fixes" * tag 'sound-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ASoC: amd: acp: Add more ACP7.0 match entries for Cirrus Logic parts ASoC: amd: acp: Add DMI override for ASUS EXPERTBOOK AM7406CKA ASoC: sdw_utils: Switch CS35L56/57/62/63 to use OT25 DAI ASoC: cs35l56: Add DAI for SDCA OT25 stream ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes ASoC: adau1372: allow sleepy powerdown GPIOs ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P) ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg3xxx (103c:8bfd) ALSA: hda/tas2781: Accept V1 calibration data without CRC ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers ALSA: hda/realtek: Add quirk for ASRock NUC BOX-358H ALSA: usb-audio: Add native DSD support for Cambridge Audio streamers |
||
|
Linus Torvalds
|
9a06d4b7c5 |
pmdomain providers:
- imx: Serialize power on/off across sibling domains for imx8m-blk-ctrl - rockchip: Fix a couple of errors during probe -----BEGIN PGP SIGNATURE----- iQJEBAABCgAuFiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmrI1PoQHHVsZmhAa2Vy bmVsLm9yZwAKCRD+JoQlc1iMKU1tEACaVeu6L1ug6LeHc+MFu14aaaB3QXOxhNPA Ls3csZknwHf1cGVnhR+ZsQ3ScBT5wC5mJtSZr0eiqCMALBZXy6J8ZNzAK97qgFdE m94lc1Kkr/7miuv1pJe8hNh3kyOzLZqG/jMDLdmMjdfKSf/8oICQ2d9+ZLLhqBMT IKgSNQQGj7d5AwDYpFRocgadrByC+ampCCi7z8xEgU3H9QANQhQPjOTyPDJ1CFV+ 7QFXGjfP2OuHKoYgUy2eAWK2gloImUVcalPjBT7OxG3ApSOZdiNNPFL0jzk0xg79 XA94iQ9vgWSVdUDaezLey1xXBRvn3XSXkHmh6Fr1feUhfseFWXYsiiNiKxfUDXjb FCQzjJT3ARn1vKu8q4359Y3nX1IG0ZYfdSCKFkcxmL8I2klB+hEkZp9jTZzwzcfT 8KlDiCN0a48Ag4EwZcc+A3DLCk3/GIlnnKeFnqty+kaJsPMyuGtANowItV9Cwfgu dM/AEe1tdDNAks+K2Y5c9wfgh2pKiHnzd2v7FS2kqvV/kKfFHoU8l8NqKUVSjpx+ hiGpCUGERDfDxgsT+HINuSjSG44i/KG7D16z6UtlKtDnOcUHPtZC9Jcvz7jm5Nup fbzrkQ55ZU/E5TxLnf0fCkghh5WnjH8UmCDlGEwlH4LQo1ho8ay0HLT/ur5dtLDM UoOGg5uPNA== =Q0z1 -----END PGP SIGNATURE----- Merge tag 'pmdomain-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain provider fixes from Ulf Hansson: - imx: Serialize power on/off across sibling domains for imx8m-blk-ctrl - rockchip: Fix a couple of errors during probe * tag 'pmdomain-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: pmdomain: rockchip: don't ignore clock lookup errors on attach pmdomain: rockchip: fix clock leak on domain probe failure pmdomain: rockchip: propagate subdomain add errors pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains |
||
|
Linus Torvalds
|
c8d4256f10 |
dma-mapping fixes for Linux 7.3
Two more fixes for the corner cases in the DMA-mapping SWIOTLB code (Peng Fan and Marek Szyprowski). -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQSrngzkoBtlA8uaaJ+Jp1EFxbsSRAUCasjDHAAKCRCJp1EFxbsS RDWxAPoC3zN3Xr76mPqfCYJWLBYu5Onrf250WwuZgVd4wO8MAAEA42uamlDYtLFa iopG6/88zhUzQ2aVg2rcbmc+307UlAA= =XP5b -----END PGP SIGNATURE----- Merge tag 'dma-mapping-7.3-2026-10-09' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux Pull dma-mapping fixes from Marek Szyprowski: "Two more fixes for the corner cases in the DMA-mapping SWIOTLB code (Peng Fan and Marek Szyprowski)" * tag 'dma-mapping-7.3-2026-10-09' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: swiotlb: fix default_swiotlb_limit() for non-growable default pool iommu/dma: skip swiotlb bounce for DMA_ATTR_MMIO in iommu_dma_map_phys |
||
|
Linus Torvalds
|
fc1c25014f |
fsverity fix for v7.3-rc7
Fix a regression from commit |
||
|
Linus Torvalds
|
f99005fbed |
vfs-7.3-rc7.fixes
Please consider pulling these changes from the signed vfs-7.3-rc7.fixes tag.
Thanks!
Christian
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCasilxwAKCRCRxhvAZXjc
ooQTAQD6awSrQcUIG0ca5hbowpn7sLi8kWGnmzf2yydKSyp3bwEAnpSQEw3BXUKH
0O7JEyZFL0VcMTTceSPKkKCqGg5nugI=
=Wc48
-----END PGP SIGNATURE-----
Merge tag 'vfs-7.3-rc7.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull vfs fixes from Christian Brauner:
"This contains fixes for the current development cycle.
All of them came out of a review of the mount code that started with a
bug report. The review modeled the corner cases of mount propagation,
unmounting and mount reference counting and turned up a lot of bugs.
Most of them years old. Most fixes come with a selftest.
- Rework connected mounts.
A mount that is unmounted together with its parent can stay
attached to the parent to keep its mountpoint covered. That happens
when the mountpoint is removed with rmdir(), unlink() or rename(),
when a detached tree is dissolved, and for locked mounts in any
umount that isn't synchronous, including the teardown of their
mount namespace. The parent then owns the child and drops it on its
own final mntput(). So any reference from the child's superblock
back to one of its ancestors becomes a cycle that is never freed.
A loop device backed by an image on a tmpfs and mounted on that
same tmpfs is enough. Remove the directory the tmpfs is mounted on
from the host, let the container's mount namespace exit, and the
loop device, the tmpfs and the filesystem on the loop device are
leaked for good. The same works with autofs, zram, ecryptfs,
binfmt_misc, fuse passthrough, zloop, a mass storage gadget and md,
and the selftests have reproducers for them. This has been possible
since v4.1. It is also why "put_mnt_ns(): leave mounts connected"
was reverted in -rc5. Keeping every mount of a dying mount
namespace connected made these cycles trivial to create.
Every unmounted mount is now detached from its parent. Where the
mountpoint has to stay covered the mount leaves a cover on the
parent instead, allocated together with the mount. A lookup on the
unmounted parent that hits a cover finds an empty immutable
directory or file on the private nullfs instance. Nothing leads
from a cover to another mount, so no unmounted mount owns another
one and no cycle can form.
This is visible to userspace. A formerly connected mount can no
longer be reached through its unmounted parent and ".." inside it
leads nowhere, as for every other lazily unmounted mount.
With that the private nullfs instance becomes reachable from
userspace, so it now refuses mounts on top, is mounted read-only,
and refuses fsnotify marks and file locks. Its inodes are shared by
every holder and a watch or a lock would otherwise reach across
users. may_decode_fh() now also decides its subtree check under a
single mount_lock hold, as a racing umount could otherwise let it
decode into what a locked child covered.
- umount:
* Don't silently unmount busy mounts.
Since v4.13 propagate_umount() takes down propagated copies of
the victim with children as long as each child is an overmount or
another copy of the victim, but propagate_mount_busy() only ever
checked copies without children or with just an overmount. A
container that moved a tree beneath its copy of a host mount lost
that tree from under its open file descriptor to a plain umount()
on the host. propagate_mount_busy() now applies the same rules,
walking each chain of copies once.
* Don't let a migrating task hide its reference from umount().
mnt_get_count() sums the per-cpu counters under mount_lock but
the mntget() and mntput() fast paths don't take it. A task that
takes a reference on a cpu the sum has already passed and drops
it after migrating to one the sum hasn't reached yet hides the
reference it held to begin with, and umount() succeeds with the
file still open. Gets and puts now live in separate per-cpu
counters and all puts are summed before all gets with a full
barrier in between, the way srcu_readers_active_idx_check() does
it. mntget() is unchanged and mntput() gains an smp_wmb().
* Check each submount for references right before unmounting it.
shrink_submounts() and mark_mounts_for_expiry() checked all their
victims up front. Unmounting the first could move a busy
overmount to where the next victim's propagated copy is looked up
and it was then unmounted without a check.
* Never expire a locked mount.
A shrinkable mount moved beneath a locked mount with
MOVE_MOUNT_BENEATH takes over the lock, and umount() of an
unlocked ancestor expired it and revealed what it covered. That
umount() now fails with EBUSY as it does for any other locked
child. A lazy umount still takes the whole tree.
- Overmounts and locked mounts:
* Unhash a dentry before detaching the mounts on it.
unlink(), rmdir() and rename() detach the mounts on the victim
but only d_delete() it once its inode is unlocked, a window that
includes an expedited RCU grace period. In between, a lookup from
a mount namespace in which the dentry is a mountpoint found it
hashed, positive and uncovered. Drop the dentry first, as
d_invalidate() already does.
* Don't reveal overmounted entries in refwalk.
A refwalk that had grabbed the dentry before the unlink never
rechecked it the way rcuwalk does with d_seq and mount_lock.
Without any artificial widening three walkers read the covered
file 27 times in a minute. step_into() now fails an unhashed
dentry marked DCACHE_CANT_MOUNT with -ESTALE and the walk is
retried.
* Keep covered mounts covered in OPEN_TREE_NAMESPACE.
Creating such a mount namespace only takes a user namespace and
the copy followed bind mount rules: no children without
AT_RECURSIVE and no unbindable mounts with it. An unprivileged
user could see what mounts covered in the source, such as the
parts of /proc and /sys that container runtimes mask. If the
caller doesn't own the source mount namespace a non-recursive
copy of a mount with something mounted below the requested
directory is now refused and a recursive copy includes unbindable
mounts, the way unshare() copies.
* Keep the lock on a mount that a propagated copy is moved beneath.
MNT_LOCKED moved to any mount that ended up beneath a locked
mount, propagated copies included. A host mount and umount on a
directory covered by a locked mount in a less privileged mount
namespace left that cover unlocked for the namespace's owner to
remove. Only mounts the caller places beneath take over the lock
now.
* Handle mount locking for automounts correctly. Which copies to
lock was decided by the mount namespace of the task that
triggered the automount. A task in a user namespace that
triggered one on a host mount through a file descriptor got the
host's own automount locked while its own copy stayed unlocked
and could have nosuid, nodev and noexec cleared. Use the owner of
the mount namespace the mount lands in.
- Use-after-free and crashes:
* Refuse an automount below a mount that is in no namespace.
The private clones overlayfs uses for its layers have the
MNT_NS_INTERNAL error pointer as their namespace, which
finish_automount() let through and count_mounts() dereferenced. A
fanotify filesystem mark on an overlayfs lower layer hands out
file descriptors on such a clone. With debugfs as the lower layer
opening "tracing" oopses with namespace_sem held for writing and
every mount operation on the system blocks from then on.
* Reset the old parent's ->overmount in mnt_change_mountpoint().
When propagate_umount() moved an overmount off a mount that a
file descriptor kept alive, MOVE_MOUNT_BENEATH through that
descriptor later followed the stale pointer into the freed
overmount.
* statmount() with STATMOUNT_BY_FD and pivot_root() read the parent
of a mount that may be unmounted and only held by a file
descriptor, while the parent's final mntput() can free it.
statmount() now reads it under mount_lock and pivot_root() first
checks that both mounts are in the caller's mount namespace.
* Queue a mount only once for mount notifications. A mount
reparented by one umount_tree() and taken down by the next under
the same namespace_sem hold, as in shrink_submounts(), was queued
twice. That cut the mounts queued in between out of notify_list
while it still pointed at them, and once they were freed every
later mount operation walked freed memory.
* Don't let a pseudo dentry become the root of a mount. A bind
mount of a bpf token file did that with a DCACHE_NORCU dentry,
which is freed without an RCU grace period while lockless path
walks may still look at it. Refuse to clone such a mount.
* Don't inherit MNT_UMOUNT in clone_mnt(). A bind mount of a lazily
unmounted nsfs or pidfs mount through its file descriptor started
out flagged as unmounted. Among other things __detach_mounts()
then dropped the namespace's reference on it, the mount outlived
its namespace and mount_setattr() through the descriptor read the
freed namespace. A recursive bind mount of such a mount also
copied the unmounted stack still attached to it. That now fails
with EINVAL, copying the mount itself still works.
* Remove the fsnotify marks of a mount namespace in free_mnt_ns()
instead of the RCU callback that frees the namespace, where
taking the group mutexes meant sleeping in softirq context.
- Propagation and copies:
* Keep a copied mount unbindable. Since v6.17 clone_mnt() didn't
copy the unbindable flag, so every mount namespace created with
CLONE_NEWNS had bindable copies of all unbindable mounts. This
had been fixed once before.
* Refuse MOVE_MOUNT_SET_GROUP on an unbindable mount. It made the
mount an unbindable slave, a state nothing else can produce, or
silently dropped the unbindable flag. CRIU applies MS_UNBINDABLE
after restoring sharing and isn't affected.
* Check a recursive bind mount for mount namespace loops.
Recursively bind mounting a tree from another mount namespace
could put a mount of a namespace's file inside that same
namespace, which then pins itself and all its mounts. Repeating
it leaks without limit, the reproducer took Shmem from 380 kB to
65916 kB. The copy is now checked with check_for_nsfs_mounts()
before it is grafted, as move_mount() does.
* Look at the topmost mount for a mount namespace file.
attach_recursive_mnt() never looked at the topmost mount of the
source's chain of overmounts. If that was the chain's only mount
namespace file an existing mount at a propagated destination got
buried below the root of the nsfs file where no path walk reaches
it.
* Don't put a mountpoint on a dentry that's being removed.
attach_recursive_mnt() makes a mountpoint of the source's root
without its inode lock, so a racing rmdir() of that directory
could leave a mount on it that nothing ever detaches.
d_set_mounted() now checks cant_mount() as well.
- nullfs:
* Take no inode lock for readdir of an immutable directory.
The root of every empty mount namespace is the same nullfs
directory and iterate_dir() held its i_rwsem across
->iterate_shared(). A reader whose buffer faults on a FUSE mount
of its own holds it for as long as its server wants, and with an
exclusive locker queued behind it every lookup that misses the
dcache, every create and every mount in that directory waits. One
user of an empty mount namespace stalls all others. Directories
with the new FOP_IMMUTABLE flag skip the lock.
* Refuse to reconfigure internal superblocks through fspick(),
MS_REMOUNT or the read-only remount that a synchronous umount()
of the root does. For nullfs only root in the initial user
namespace could do it, but the superblock is shared by every
mount namespace and the flags showed up in statfs() for all of
them.
* Don't update the access time on nullfs and refuse F_SET_RW_HINT
on an immutable inode.
- unshare: Free an nsproxy that was never installed with
nsproxy_free() when set_cred_ucounts() fails. put_nsproxy() dropped
active references that were never taken, which triggered a warning
and hid the caller's own namespaces from listns().
- Smaller changes: mount_setattr() checks the target before it walks
the tree to allocate peer group ids, unshare() puts the old
fs_struct before the old namespaces, dissolve_on_fput() drops the
file's reference to the tree itself, disconnect_mount() is
simplified and the documentation of the propagated unmount rule is
brought up to date"
* tag 'vfs-7.3-rc7.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (58 commits)
namespace: simplify disconnect_mount()
selftests/filesystems: test covered mounts
namespace: rework connected mounts
nullfs: add an empty immutable regular file
selftests/filesystems: check that reading the root of an empty mount namespace stalls nobody
selftests/filesystems: add a helper that holds a readdir in a page fault
readdir: take no inode lock on an immutable directory
nullfs: refuse file locks
fsnotify: let a filesystem refuse marks on its objects
namespace: nothing is mounted on or written through knullfs
namespace: keep the private nullfs instance in knullfs
fhandle: decide the subtree check under mount_lock
selftests/filesystems: check that an automount below an overlay layer is refused
selftests/filesystems: check the atime of the empty mount namespace root
selftests/filesystems: check that a lock lands on the right mount and stays
namespace: keep the lock on a mount that a propagated copy is moved beneath
namespace: never expire a locked mount
nullfs: don't update the access time
namespace: handle mount locking for automounts correctly
namespace: refuse an automount below a mount that is in no namespace
...
|
||
|
Linus Torvalds
|
9515f634db |
arm64 fixes for -rc7
- Fix PMU EL2 trap configuration for CPUs with an IMPDEF PMU.
- Fix kcov boot selftest failure by excluding our early IRQ entry code.
-----BEGIN PGP SIGNATURE-----
iQFEBAABCgAuFiEEPxTL6PPUbjXGY88ct6xw3ITBYzQFAmrH1N8QHHdpbGxAa2Vy
bmVsLm9yZwAKCRC3rHDchMFjNHG0CACV2EKHHOdY/g1+PA6NmNeWzVlFT0nczOSh
m/iF+SHdZ+ZcFdipKFQd5cMVpDyVubOvJjuvlFQYreM1AkNrbTqavYfHwbF8mmdF
iqSZIjimjPUBmAJtxlobgP1UPUypI6Chnu0GTnLohufaznEhVqBj97aaE3xyMe3F
muX6d5yybK+wUi/iNt+gnsDNnGS9nDv0/Az7lUeqE1kSFWISz0UQa/pyEDtm4XT9
kzaWsRuRiRNb86nxalA5lvGaZd+RRXtMkUGp0OB3TCgN5WyfgFf3QiSufcYS3RlN
aozeM3nZFaSU4XMH8Ce1XbUkfr1HNA18MgwMSzorjLMBs56PAvax
=Xwu1
-----END PGP SIGNATURE-----
Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
Pull arm64 fixes from Will Deacon:
"It finally seems to have calmed down on the arm64 fixes front, so
please pull these two straightforward fixes for -rc7. One fixes the
EL2 trap configuration for implementation-defined CPU PMU hardware
during boot and the other fixes a kcov selftest failure by excluding
our softirq early entry code:
- Fix PMU EL2 trap configuration for CPUs with an IMPDEF PMU
- Fix kcov boot selftest failure by excluding our early IRQ entry
code"
* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
arm64: irq: exclude the softirq stack switch from KCOV
arm64/boot: Don't set PMUv3p9 FGT2 bits without PMUv3
|
||
|
Bihaan Sen
|
41363c27b8 |
Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox
The 8BitDo Pro 2 Wired Controller for Xbox is already matched by the vendor-wide XPAD_XBOXONE_VENDOR(0x2dc8) entry, but a later hardware revision reports product ID 0x201e, which has no entry in the xpad_device table. The device therefore binds and functions but is exposed to userspace as "Generic X-Box pad". Add the VID/PID pair so the controller is named correctly, and set MAP_SHARE_BUTTON to expose the share button as KEY_RECORD. Signed-off-by: Bihaan Sen <stevewholikesthings@gmail.com> Link: https://patch.msgid.link/20260925114459.110253-1-stevewholikesthings@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> |
||
|
Krzysztof Furman
|
f9282b8aa8 |
Input: xpad - add support for Corsair Novablade Pro
Add device IDs for the Corsair Novablade Pro leverless fight controller in both wired (0x2b1f) and 2.4 GHz receiver (0x2b2b) modes, and add Corsair's vendor ID to the Xbox 360 vendor match list. Outside of its PS4/PS5 modes the controller uses the Xbox 360 protocol (vendor-specific class, subclass 93, protocol 1) on interface 0, which xpad does not currently bind, so no gamepad device is created. The PS4/PS5 modes present a standard HID gamepad and already work with hid-generic. Tested on 7.2.5 with the 2.4 GHz receiver and wired. Assisted-by: Claude Opus 5.5 Signed-off-by: Krzysztof Furman <krisfur@proton.me> Link: https://patch.msgid.link/20261009-xpad-corsair-novablade-v1-1-e58746bef99f@proton.me Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> |
||
|
Haotian Zhang
|
f321cc430c |
Input: ati_remote2 - fix type confusion in device attribute handlers
Previously, the channel_mask and mode_mask attributes were registered on the parent usb_device via sysfs_create_group(). When commit |
||
|
Cen Zhang (Microsoft Security FORGE Labs)
|
fddcf4c532 |
io_uring/cancel: don't spin on local work the task can't run
io_uring_cancel_generic() refuses to sleep while any ring on the exiting
task's tctx has local work pending. It assumes the task is that ring's
submitter and that the next io_uring_try_cancel_requests() pass will run
the work. This does not hold for a ring that was still
IORING_SETUP_R_DISABLED when the task got its tctx node from
io_uring_create() or io_ringfd_register(). The submitter is set later by
IORING_REGISTER_ENABLE_RINGS, possibly from another task, and only the
submitter may run local work on an IORING_SETUP_DEFER_TASKRUN ring. To
the exiting task the work stays pending forever, the loop never reaches
schedule(), and the task trips the WARN_ON_ONCE() once and then spins in
do_exit().
An unprivileged user can set this up at will by creating a disabled
ring, having a child enable it and stop, posting to the ring with
IORING_OP_MSG_RING and exiting with a request in flight that only the
child can complete. The exiting thread burns a CPU until the child runs
or dies, and with panic_on_warn set the WARN panics the kernel.
Fix by skipping the sleep only when io_allowed_defer_tw_run() allows the
task to run the work. This is reasonable since work it cannot run cannot
complete any of its requests either, so nothing is lost by sleeping.
Drop the WARN_ON_ONCE() since handing a disabled ring to another thread
is a supported scenario, not a bug state.
Fixes:
|
||
|
Natasha Klaus
|
aa5d5f8e50 |
io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6
io_connect_bpf_populate() fills connect.port and connect.v6_addr for
AF_INET6 only when addr_len >= sizeof(struct sockaddr_in6), i.e. 28
bytes.
The IPv6 connect paths accept SIN6_LEN_RFC2133 (24 bytes), which
already holds sin6_port and sin6_addr. io_connect() passes addr_len to
the socket layer unchanged.
At addr_len 24 the filter sees family AF_INET6 with port and address
zero, while the kernel connects to the real destination. A filter that
denies an IPv6 port or address is bypassed. Denying connect.port == P
rejects [::1]:P with -EACCES at addr_len 28 but connects at addr_len 24.
Use SIN6_LEN_RFC2133 as the threshold. sin6_scope_id stays zero when
absent.
The threshold mismatch was found by an AI coding assistant (Claude Code)
comparing this hook against the net/ipv6 length checks on my
instructions; it also drafted the reproducer and this patch. I verified
the bypass and the fix in a VM on 7.3-rc6 and that 7.2 has the same
code.
Fixes:
|
||
|
Eugene Gvozdetsky
|
6da8f402e3 |
io_uring/register: don't exempt disabled rings from task restrictions
A ring created with IORING_SETUP_R_DISABLED is exempt from its register restrictions until it is enabled. This lets the creator register the restrictions and then enable the ring with IORING_REGISTER_ENABLE_RINGS, whether or not that opcode is in the allowed set. Since commit |
||
|
Jens Axboe
|
cde56daf4b |
io_uring/kbuf: don't charge provided buffer rings to RLIMIT_MEMLOCK
Just like with the SQ and CQ rings, the provided buffer rings were also
not charged against the memlock limit prior to the below mentioned
commit. Restore that behavior.
Fixes:
|
||
|
Linus Torvalds
|
af32da41b0 |
Including fixes from wireless, wireguard, CAN and Bluetooth.
We have one known regression to wrap up in VLAN handling.
Current release - regressions:
- Bluetooth: RFCOMM: fix deadlock on rfcomm_mutex
Previous releases - regressions:
- can: fix regression in handling RPS after migrating metadata to skb_ext
- eth: iavf: fix regressions in reconfig impacting bonding
- eth: mana: fix packet forwarding performance regression
- eth: stmmac: remove buggy VLAN acceleration support
Previous releases - always broken:
- a few high prio fixes for tun, and af_packet
- amt: fix a UaF on tunnel teardown
- eth: bnxt: fix PCIe AER recovery and FLR handling issues
- eth: macb: don't modify Tx skbs before taking ownership
- eth: axienet: don't leak Tx skbs on interface stop
- wifi: nxpwifi: number of LLM-ish fixes
- wifi: assorted mt76 fixes
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE6jPA+I1ugmIBA4hXMUZtbf5SIrsFAmrH6sMACgkQMUZtbf5S
IrtsDg//UvqATFotE+zcXa9yD3Pdg35wSH3uGZJYWIr+ZzEFW3hQdbh9rZy5ulX3
XUhFKlFSeEIarV4UstlvEbkLXSEqbaaFMfYBw03L6os3mGVQqMwi+C+7gn3aoqd4
NE1ct2NChnryr8ORCRjZW3OXjAguGuQBXZ4BFRnDWatbY0Cfuf35ap/RdNKztcEd
hct5rsd3LCNgGspjKq19LvD3npEcURebD9Do7mpwoIlw/AECLdCqUW0QkIJW/F6L
qZic95CyZXy39guuhI88cmfnSiZfz2grm8az4nlF9cDoJS1CW7peor6KzzisbT6m
Iltkwwj6v0NcVKE3f86oSSE5RS8kOJx+YcftNe0S+flZmCLpxopbF6VGfTJUmlyJ
CsQ6+n7iQd+1MoZZDGaJjgx14se5pqnnkJ38dVVi1OhomS/jpFYuw2U1dw1GzrJN
hLjPxmeF+HIFIKEbVjMyMbTCQGb8CfCQnH0qQ7XJnezImln+oA9ub66b/Zgwbubl
k8elLxkiFKgjT9bnwm4/+ZtI5VW8QRgV6sxPxpxD4tyVIaKrs2b9sqv9do3YPjPa
HGzMcRL9YMtGcv87gS8gjJRlAdkOWWzVDzw3nf3gMvAiedHIqvtUBcjB22+ueXqg
mJ0dT46BBTNbzrl8gljVTU5zm6ZYHxKm2vTTgbMdGJTzASNKfmE=
=+sxU
-----END PGP SIGNATURE-----
Merge tag 'net-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Jakub Kicinski:
"Including fixes from wireless, wireguard, CAN and Bluetooth.
We have one known regression to wrap up in VLAN handling.
Current release - regressions:
- Bluetooth: RFCOMM: fix deadlock on rfcomm_mutex
Previous releases - regressions:
- can: fix regression in handling RPS after migrating metadata to skb_ext
- eth:
- iavf: fix regressions in reconfig impacting bonding
- mana: fix packet forwarding performance regression
- stmmac: remove buggy VLAN acceleration support
Previous releases - always broken:
- a few high prio fixes for tun, and af_packet
- amt: fix a UaF on tunnel teardown
- eth:
- bnxt: fix PCIe AER recovery and FLR handling issues
- macb: don't modify Tx skbs before taking ownership
- axienet: don't leak Tx skbs on interface stop
- wifi:
- nxpwifi: number of LLM-ish fixes
- assorted mt76 fixes"
* tag 'net-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (128 commits)
net: macb: copy shared skbs before appending the FCS
net: macb: check TX ring before modifying skb
vsock: Fix memory leak in vmci_transport_recv_dgram_cb()
wireguard: noise: reject response consumption after intermediate initiation
wireguard: queueing: preserve tstamp_type when encapsulating packet
net: openvswitch: validate transport header presence in set_ipv6_addr
net/smc: protect clcsock lifetime in smc_getname
ipv6: do not warn on route notification size race
ipv4: do not warn on route notification size race
ipv4: validate checksum_start before completing checksum
ptp: ocp: fix PCIe delay estimation calculation
xen/netfront: don't leak the skb when xennet_fill_frags() fails
net/packet: call packet_parse_headers after virtio_net_hdr_to_skb
xen/netfront: drop RX packets with a short Ethernet header
net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()
net: sparx5: free the matchall entry on destroy
selftests: mlxsw: Test port range occupancy on template create
mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()
net: dsa: microchip: fix KSZ8765 fiber detection
net/mlx5e: Order ICOSQ cc update after CQ doorbell
...
|
||
|
Mary Guillemard
|
6ccf996a0d |
drm/nouveau: Skip the Turing CE workaround object for non-GR channels
This workaround is here for the old Gallium driver and predate async CE and NVDEC. Instead of only skipping it for NVDEC, let's only apply it in case of GR channels. This should make async CE work properly on Turing by stopping the assign of a GRCE. (here CE0) Signed-off-by: Mary Guillemard <mary@mary.zone> Reviewed-by: Lyude Paul <lyude@redhat.com> Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com> Signed-off-by: Lyude Paul <lyude@redhat.com> Link: https://patch.msgid.link/20261007-turing-async-ce-fix-v1-1-12ee6ccd1a3c@mary.zone |
||
|
Lukas Wunner
|
79c168e2aa |
PCI/AER: Skip error recovery on false alarms
Alex is seeing a probe failure of the amdgpu driver after the Root Port above an AMD Navi10 GPU has been reset. The reset was performed to recover from a Firmware First reported Fatal Error. However all status registers in the Root Port's AER Extended Capability are blank, so apparently the platform firmware raised a false alarm. The issue is only occurring since commit |
||
|
Maíra Canal
|
cca01232d9
|
drm/vc4: Fix binner slot allocation failing on an idle GPU
A job's binner slots are returned to bin_alloc_used by vc4_complete_exec(),
which runs from the job_done workqueue, but the seqno
vc4_v3d_get_bin_slot() waits on is incremented earlier, in the function
vc4_irq_finish_render_job(). Therefore, a waiter can wake, retry, and still
find the pool full because the worker has not run. By then, the job might
have left the render_job_list, so no seqno remains to wait on and the
allocation fails returning -ENOMEM.
This scenario can be reproduced on a Raspberry Pi 3 by using a burst of
small jobs (e.g. Piglit's `quick_gl` suite), with userspace seeing a
rejected submit for a pool about to become free.
Note that the slots are held from validation until the render completes,
so the pool can also be exhausted by jobs still queued on bin_job_list,
leaving render_job_list empty and nothing to wait on.
Release the slots from the FRDONE handler and wait on the pool instead of
on one job's seqno. This bounds the wait to the actual resource. Also, by
claiming the slot inside the wait condition, another submit is unable to
take the slot between the wakeup and the retry. vc4_complete_exec() keeps
clearing the slots for jobs that never completed, and now wakes the
waiters too.
Note that the wait takes a deadline, since the two callers need different
ones. The submit path is a user task and can be interrupted, so it waits
without one. On the other hand, vc4_overflow_mem_work() runs on a worker
and never sees a signal, so it needs a deadline. During a reset,
vc4_irq_disable() masks V3D_DRIVER_IRQS before draining the worker, and
with those masked nothing can release a slot. This deadlocks: the worker
would wait for slots that only the reset can free, while the reset waits
in cancel_work_sync() for the worker.
Fixes:
|
||
|
Maíra Canal
|
6abc8e4dcf
|
drm/vc4: Disable the V3D interrupt across runtime suspend
vc4_irq_disable() masks the V3D interrupt sources and then calls
synchronize_irq() before the V3D is powered down. However, by itself,
this is not enough to quiesce the interrupt handler.
synchronize_irq() waits for handlers that have already set
IRQD_IRQ_INPROGRESS, and for irqchips reporting IRQCHIP_STATE_ACTIVE.
A GIC interrupt chip is able to mark an interrupt active as soon as a
CPU acknowledges it, so there these checks cover the whole dispatch path.
On RPi 0-3, however, the interrupt controller is ARMCTRL, which has no
active state. A CPU that has read the hwirq out of the pending register
but has not yet reached handle_level_irq() stays invisible to
synchronize_irq().
During a power transition, vc4_irq() may therefore run after the power
domain is off, where every V3D register read will return 0xdeadbeef.
0xdeadbeef has FLDONE, FRDONE and OUTOMEM set. This problem doesn't
trigger NULL pointer dereference issues only because the functions
vc4_irq_finish_bin_job() and vc4_irq_finish_render_job() return early
when there is no job pointer, but OUTOMEM is still able to schedule
vc4_overflow_mem_work() after vc4_irq_disable() has already cancelled it.
Therefore, fix the spurious interrupts by disabling the interrupt line
across the PM transition. To preserve the enable/disable balance, move
vc4_irq_install() and request the IRQ line disabled before the first
runtime resume.
Fixes:
|
||
|
Hengyu Liang
|
b59cabf9b4 |
io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK
Commit |