mirror of
https://github.com/torvalds/linux.git
synced 2026-10-08 11:36:02 +02:00
30d0aff2c6
1464949 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Linus Torvalds
|
5668ba2304 |
Char / Misc and documentation fixes for 7.2-rc7
Here are some small char/misc and nvmem and documentation fixes for
7.2-rc7 to resolve some reported issues. Included in here are:
- updates to the documentation for the kernel threat model and
security bugs to get the LLMs to actually follow what we have been
asking them to do (i.e. not claim security issues for things we do
not consider security issues.)
- nvmem driver fixes which required a tiny "layout" driver to be
added.
- fastrpc driver fixes
- mei driver fix
- counter driver fix
- binder driver fix
All of these have been in linux-next this week with no reported
problems.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCandLdw8cZ3JlZ0Brcm9h
aC5jb20ACgkQMUfUDdst+yldzACZAVaM2/I0hIeTnoBqRFIZBcroUQYAoNk5zQSW
qYG0DWUf4LJwj9WPQWIS
=e+LJ
-----END PGP SIGNATURE-----
Merge tag 'char-misc-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
Pull char / misc and documentation fixes from Greg KH:
"Here are some small char/misc and nvmem and documentation fixes for
7.2-rc7 to resolve some reported issues. Included in here are:
- updates to the documentation for the kernel threat model and
security bugs to get the LLMs to actually follow what we have been
asking them to do (i.e. not claim security issues for things we do
not consider security issues.)
- nvmem driver fixes which required a tiny "layout" driver to be
added.
- fastrpc driver fixes
- mei driver fix
- counter driver fix
- binder driver fix
All of these have been in linux-next this week with no reported
problems"
* tag 'char-misc-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
docs: security-bugs: clarify some mandatory steps for AI reports
docs: coding-assistant: explain important steps when looking for bugs
docs: security-bugs: clarify what counts as a valid version
docs: threat-model: move fake devices out of "non production use"
docs: threat-model: clarify "security bug" vs "vulnerability"
counter: microchip-tcb-capture: Fix DT channel validation
mei: pull kvfree out of spinlock
rust_binder: do not query current thread for all ioctls
nvmem: layouts: Add fixed-layout driver
nvmem: apple-spmi-nvmem: wrap regmap calls to satisfy CFI
misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
misc: fastrpc: fix channel ctx ref leak when session alloc fails
misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
misc: fastrpc: Remove buffer from list prior to unmap operation
misc: fastrpc: Fix initial memory allocation for Audio PD memory pool
|
||
|
Leon Hwang
|
48f2fd0d93 |
ftrace: Drop extra comma in trace_buffered_event_enable
Drop the extra comma in "scoped_guard()" to cleanup the code. Link: https://patch.msgid.link/20260730150411.88667-5-leon.hwang@linux.dev Acked-by: Jiri Olsa <jolsa@kernel.org> Signed-off-by: Leon Hwang <leon.hwang@linux.dev> Signed-off-by: Steven Rostedt <rostedt@goodmis.org> |
||
|
Leon Hwang
|
092f8ec7db |
ftrace: Protect direct_functions in update_ftrace_direct_mod
Fix accessing the __rcu pointer direct_functions with RCU protection.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260730150411.88667-4-leon.hwang@linux.dev
Fixes:
|
||
|
Leon Hwang
|
f26e5fa75f |
ftrace: Protect direct_functions in update_ftrace_direct_del
Fix accessing the __rcu pointer direct_functions with RCU protection.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260730150411.88667-3-leon.hwang@linux.dev
Fixes:
|
||
|
Leon Hwang
|
63444b7617 |
ftrace: Protect direct_functions in ftrace_find_rec_direct
Fix accessing the __rcu pointer direct_functions with RCU protection.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260730150411.88667-2-leon.hwang@linux.dev
Fixes:
|
||
|
Linus Torvalds
|
a7c7074b58 |
fbdev core fixes for 7.2-rc7:
A few patches for the core fbdev layer which stabilize or fix potential issues with text font rendering after screen rotation or after user initiated font changes and locking fixes for sysfb during modifications of the graphics mode database. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQS86RI+GtKfB8BJu973ErUQojoPXwUCanbPzgAKCRD3ErUQojoP XyrEAPwJgK7J9UvN1Ii0V9p175Z/3Mzwo6DF1Z4KW5ctYVTAsQD/TC91d1vqKtJ7 SHgY6jCLegC/DpLk4dqshBPrdO2pAgM= =Y1ZB -----END PGP SIGNATURE----- Merge tag 'fbdev-for-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull fbdev fixes from Helge Deller: "A few patches for the core fbdev layer which stabilize or fix potential issues with text font rendering after screen rotation or after user initiated font changes and locking fixes for sysfb during modifications of the graphics mode database" * tag 'fbdev-for-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: fbdev: bitblit: bound-check glyph index in bit_cursor() fbdev: Fix out-of-bounds access when rotating console after font resize fbdev: core: Fix pointer desynchronization in fb_io_read() fbdev: serialize mode sysfs access with lock_fb_info() fbdev: clear fb_info->mode before deleting a videomode fbdev: bound mode sysfs output to the sysfs buffer |
||
|
Steven Rostedt
|
f0ece16ffc |
eventfs: Use children field for rcu head and add memory barriers
When an eventfs inode is freed, it sets ei->is_freed and then uses its
ei->list to add it to the srcu link list as the list field is a union with
the rcu list head. As the ei->list is used to iterate over an SRCU
protected list without taking the eventfs_mutex, there's nothing stopping
the iteration over that list to see the ei->rcu instead of the ei->list
and it will read a corrupt target.
To fix this, change the union of the rcu list head with the children list.
On freeing the eventfs inode, set the is_free and execute a smp_wmb()
before adding the eventfs inode to the SRCU list.
On iteration of the ei->children list, at the start, execute a smp_rmb()
and then read the is_freed of the ei to see if the children list is still
valid. If is_freed is set, then the ei_child read is not valid and the
loop should exit immediately.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260808094215.4252430d@robin
Fixes:
|
||
|
Shuangpeng Bai
|
fd73b69170 |
eventfs: Fix use-after-free in eventfs_remove_rec()
eventfs_remove_rec() recursively removes the child at the current loop
position. After the recursive call returns, list_for_each_entry() advances
by reading list.next from the removed child.
If free_ei() drops the final reference, release_ei() reuses the list/rcu
union to queue an SRCU callback. The child may be freed before that read.
The eventfs_mutex serializes list updates, but it does not keep the removed
child alive or prevent the SRCU callback from running.
Use list_for_each_entry_safe() to save the next sibling before recursively
removing the current child.
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Linus Torvalds
|
361efac9e9 |
Driver core fixes for 7.2-rc7
- Fix Rust build failure on s390 by gating ioremap() / iounmap() helpers and the io::mem module on CONFIG_HAS_IOMEM; gate affected doctests as well. - Add missing kernel-doc for show_const / store_const union members in struct device_attribute. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQS2q/xV6QjXAdC7k+1FlHeO1qrKLgUCancYdAAKCRBFlHeO1qrK LneZAQD9bhMwOb9C8t+fLXEYd6WR+1n932bmKTBSscZ1evnojwD+M4MqTWDBDgal Mc8wasHQsQc7pqVFFHtFEUIAZjRlpAc= =KHk2 -----END PGP SIGNATURE----- Merge tag 'driver-core-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core Pull driver core fixes from Danilo Krummrich: - Fix Rust build failure on s390 by gating ioremap() / iounmap() helpers and the io::mem module on CONFIG_HAS_IOMEM; gate affected doctests as well. - Add missing kernel-doc for show_const / store_const union members in struct device_attribute. * tag 'driver-core-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: rust: io: gate ioremap doctests on CONFIG_HAS_IOMEM rust: io: gate ioremap/iounmap on CONFIG_HAS_IOMEM driver core: add missing kernel-doc for union members |
||
|
Linus Torvalds
|
7d8c681eef |
Input updates for v7.2-rc6
- Fixes for information leaks and OOB accesses across several drivers, including evdev, focaltech, edt-ft5x06, iforce, and cs40l50-vibra - Improvements to the synaptics-rmi4 driver to properly handle F54 worker errors and prevent buffer overflows - Input validation fixes in the hynitron_cstxxx touchscreen driver to prevent issues with invalid finger IDs and touch counts - Fixes for use-after-free and initialization bugs in the byd mouse and psxpad-spi drivers - New quirks for the atkbd driver to make keyboard work on HONOR and Xiaomi laptops - Support for the ZENAIM LEVERLESS controller in the xpad driver. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQST2eWILY88ieB2DOtAj56VGEWXnAUCana8zQAKCRBAj56VGEWX nAIMAQCFKhBk3M4Q+625XmMMcb9AV+Bl0TTCxXBbdrA8bYJ+IQEA0C9AQXCmIGzC lwr7jlgTET8vN/NrEVD+WN9jNzFmZgA= =jcbm -----END PGP SIGNATURE----- Merge tag 'input-for-v7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: - Fixes for information leaks and OOB accesses across several drivers, including evdev, focaltech, edt-ft5x06, iforce, and cs40l50-vibra - Improvements to the synaptics-rmi4 driver to properly handle F54 worker errors and prevent buffer overflows - Input validation fixes in the hynitron_cstxxx touchscreen driver to prevent issues with invalid finger IDs and touch counts - Fixes for use-after-free and initialization bugs in the byd mouse and psxpad-spi drivers - New quirks for the atkbd driver to make keyboard work on HONOR and Xiaomi laptops - Support for the ZENAIM LEVERLESS controller in the xpad driver. * tag 'input-for-v7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: evdev - sanitize event type index when fetching event masks Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue Input: synaptics-rmi4 - block s_input when F54 queue is busy Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer Input: synaptics-rmi4 - zero report size on F54 work error Input: synaptics-rmi4 - fix F55 transmitter electrode count typo Input: hynitron_cstxxx - validate touch count and finger IDs Input: evdev - fix information leak in evdev_pass_values() fixp-arith: convert comments to kernel-doc format Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet Input: atkbd - skip deactivate for HONOR ZQC-P Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard Input: iforce - validate input packet lengths Input: psxpad-spi - set driver data before use Input: cs40l50-vibra - validate custom data from user space Input: xpad - add support for ZENAIM LEVERLESS Input: edt-ft5x06 - ignore contacts with an out-of-range slot id Input: byd - synchronize timer deletion before freeing private data |
||
|
Linus Torvalds
|
afe80aebd3 |
powerpc fixes for 7.2 #4
- Couple of fixes for mem leak and underflow case Thanks to: George Wilson, R Nageswara Sastry -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEqX2DNAOgU8sBX3pRpnEsdPSHZJQFAmp2vToACgkQpnEsdPSH ZJTdSRAAyU2MKr444tK8kb/wFlZJ2kT2nHmLvotr7OrTPfb3A48cTcUYqzi3aJ5r hbethTk1diJa5fM+hbN5AJLA3DBNSknAEDJiyQKeE1knOr0Q1qn3NIQL6ROJaIe0 vTeOkJHzDzpU9dWnYbhoAxuNC+rQCicuNjB5WPd93LayI2kP1BN94uEb6GU5AMOz HLqH3j/9kWtFTt+x6pbIzSiOQy6+p3lbtjJS/FMsn2wqeqRyY2IehFBP27+dpjJX z2S20qnrS+8CuZ6tut/vSJIdIozRROwGXLTx1jRHXAGsfdWCp3W+drcY3lmwFRtK xq1x6z0c6+JJvaBPGtLDQCi7wURZ3DAlBHEA8PbfLYLogt4AuVBA0WFSI1Vlr4LX rTsuG/eV4GgjSEFEHRCa68+PuQ4imjNauyX2Ty+74rqzQwIgG4O0btnJFiCHZymt hZXBDbdCr17U1+2mQI5T//n67i+sKSpgM492ti+vpaYK8Ou0Ki1oOKnPiH6KyTXz QkvwfOTKrdrMVVUgI1jtM/19ewa/z/0OoBQBT8vmRY6qkbR0k6SCV6Na9tQVAxpw l6JNcFpYidvLuXJq5NhtxdyGFqh1a/WvNR7Q/LkVmpNXVauqiYTRe4HA7RtCmOv2 JGTpk1fzn2aq+pojDZnUV7EoVg+keO1EGhPAWEJ/KDEoMEcI/5o= =HV3X -----END PGP SIGNATURE----- Merge tag 'powerpc-7.2-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Madhavan Srinivasan: - A couple of fixes for a memory leak and a underflow case Thanks to George Wilson and R Nageswara Sastry * tag 'powerpc-7.2-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/pseries: lparcfg - fix kbuf[] underflow powerpc/pseries: pci - logic bug powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak |
||
|
Rik van Riel
|
e033cbf397 |
fbdev: bitblit: bound-check glyph index in bit_cursor()
bit_cursor() fetches the glyph under the cursor with c = scr_readw(vc_pos); src = vc_font.data + ((c & charmask) * w * height); where charmask is 0x1ff when vc_hi_font_mask is set. The screen buffer value comes directly from scr_readw() and may be larger than the current font's glyph count. Syzkaller triggers this via vcs_write(). The Call Trace shows vcs_write() in vc_screen.c writing an arbitrary 16-bit value with writev() to /dev/vcsa, which vcs_write_buf() in vc_screen.c stores via vcs_scr_writew() without checking charcount. The stored value is later read in bit_cursor() in bitblit.c. When the font is changed from a font with 512 glyphs to a font with 256 glyphs, the screen buffer can retain characters with the high bit set from the previous mode, which could also produce the same out-of-bounds access. BUG: KASAN: global-out-of-bounds in soft_cursor+0x378/0x6bc drivers/video/fbdev/core/softcursor.c:70 Read of size 16 at addr ffff800086c57970 Call Trace: soft_cursor+0x378/0x6bc drivers/video/fbdev/core/softcursor.c:70 bit_cursor+0xa90/0x1108 drivers/video/fbdev/core/bitblit.c:365 fbcon_cursor+0x344/0x498 drivers/video/fbdev/core/fbcon.c:1427 hide_cursor+0xdc/0x2d0 drivers/tty/vt/vt.c:883 update_region+0x100/0x18c drivers/tty/vt/vt.c:669 vcs_write+0x8ec/0xaf0 drivers/tty/vt/vc_screen.c:685 bit_putcs_aligned() and bit_putcs_unaligned() already clamp the glyph index to vc_font.charcount. Apply the same clamp in bit_cursor() after extracting the attribute and masking, before indexing fontdata. The fix completes the bounds checking started in commit |
||
|
Zizhi Wo
|
ef7656e85f |
fbdev: Fix out-of-bounds access when rotating console after font resize
[BUG] Recently, we encountered a KASAN warning as follows: BUG: KASAN: slab-out-of-bounds in ccw_putcs+0x8bd/0xa80 Read of size 1 at addr ff11000110067100 by task bash/1209 CPU: 10 UID: 0 PID: 1209 Comm: bash Not tainted 7.2.0-rc3 #69 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014 Call Trace: <TASK> ... kasan_report+0xf0/0x120 ? ccw_putcs+0x8bd/0xa80 ccw_putcs+0x8bd/0xa80 ? __pfx_ccw_putcs+0x10/0x10 fbcon_putcs+0x338/0x410 ? __pfx_ccw_putcs+0x10/0x10 do_update_region+0x21d/0x450 invert_screen+0x29d/0x5e0 ? __kmalloc_noprof+0x493/0x640 ? vc_do_resize+0x17c/0xe50 clear_selection+0x4c/0x60 vc_do_resize+0xaee/0xe50 fbcon_modechanged+0x2bd/0x640 rotate_all_store+0x298/0x380 ... reproduce: 1) issue two ioctls: first a KDFONTOP ioctl with op.op = KD_FONT_OP_SET, op.width = 1 and op.height = 1, then a TIOCL_SETSEL ioctl 2) echo 2 > /sys/devices/virtual/graphics/fbcon/rotate_all 3) issue two ioctls: first a KDFONTOP ioctl with op.op = KD_FONT_OP_SET, op.width = 8 and op.height = 1, then a TIOCL_SETSEL ioctl 4) echo 3 > /sys/devices/virtual/graphics/fbcon/rotate_all [CAUSE] The root cause is that fbcon_modechanged() first sets the current rotate's corresponding ops. Subsequently, during vc_resize(), it may trigger clear_selection(), and in fbcon_putcs->ccw_putcs[rotate=3], this can result in an out-of-bounds access to "src". This happens because par->rotated.buf is reallocated in fbcon_rotate_font(): 1) When rotate=2, its size is (width + 7) / 8 * height 2) When rotate=3, its size is (height + 7) / 8 * width And the call to fbcon_rotate_font() occurs after clear_selection(). In other words, the fontbuffer is allocated using the size calculated from the previous rotation 2, but before reallocating it with the new size, con_putcs is already using the new rotation 3: rotate_all_store fbcon_rotate_all fbcon_set_all_vcs fbcon_modechanged set_blitting_type ... par->bitops = &ccw_fbcon_bitops vc_resize ... clear_selection highlight ... do_update_region fbcon_putcs ... image.dy = vyres - ((xx + count) * vc->vc_font.width) [1] // overflow! ccw_putcs_aligned // old buf size is still being used during the read! src = par->rotated.buf + (scr_readw(s--) & charmask) * cellsize fb_pad_aligned_buffer----[src KASAN!!!] [2] info->fbops->fb_imageblit(info, image) sys_imageblit fb_imageblit fb_address_forward // offset: image->dy * bits_per_line + image->dx * bpp unsigned int bits = (unsigned int)adr->bits + offset adr->address += (bits & ~(BITS_PER_LONG - 1u)) / BITS_PER_BYTE [3] fb_bitmap_imageblit ... fb_read_offset // page fault! [4] update_screen redraw_screen ... ccw_cursor soft_cursor memcpy(src, image->data, dsize)----[src KASAN again!!!] [5] fbcon_switch fbcon_rotate_font font_data_rotate dst = kmalloc_array(charcount, d_cellsize, GFP_KERNEL) // the new size is allocated only here! par->rotated.buf = buf [6] [FIX] A fairly obvious approach is to follow fbcon_switch(): in fbcon_modechanged(), call rotate_font() before vc_resize() so that a correctly sized buffer is allocated in time, as done in [6]. This fix is necessary, but it is not sufficient on its own. In [1] it causes an image.dy overflow (ccw_putcs: vyres = 768, image.dy = 4294967040), because vc_cols has not been updated in time at this point (it is likewise only updated after clear_selection()). This allows (xx + count) * width to exceed vyres, causing image.dy to overflow. Subsequently, address in [3] is incremented by an even larger amount, which triggers a page fault at [4]. Therefore, a second fix is required in combination with the first: move clear_selection() earlier, before set_blitting_type() in fbcon_set_all_vcs(), to prevent the out-of-bounds access. fbcon_rotate() has a similar problem, so add the same clear there. Since vc_is_sel() is not exported, the fbdev side is currently forced to call clear_selection() unconditionally, causing the global selection to be cleared prematurely. And this will not cause any other significant impact. Signed-off-by: Zizhi Wo <wozizhi@huawei.com> Signed-off-by: Helge Deller <deller@gmx.de> |
||
|
Mingyu Wang
|
81cc73be40 |
fbdev: core: Fix pointer desynchronization in fb_io_read()
In fb_io_read(), if copy_to_user() performs a partial copy (e.g., due to
a faulty user buffer), the loop adjusts the chunk size 'c' and updates
the remaining 'count'. However, the hardware 'src' pointer has already
been eagerly advanced by the original chunk size.
If the loop is allowed to continue, the read will resume from an
incorrect, over-advanced offset. Since the remaining 'count' was only
decremented by the successful bytes, this desynchronization causes the
next iterations to execute more hardware reads than originally bounded,
eventually leading to out-of-bounds I/O reads.
Fix this by breaking out of the loop immediately upon a partial
copy_to_user(). A partial copy indicates a faulty user buffer, making
subsequent read attempts futile. Breaking out ensures we return the
number of successfully read bytes without risking out-of-bounds hardware
accesses in subsequent mismatched iterations.
Fixes:
|
||
|
Melbin K Mathew
|
061db6b7a9 |
fbdev: serialize mode sysfs access with lock_fb_info()
show_mode(), show_modes(), and store_mode() access fb_info->modelist and fb_info->mode without holding lock_fb_info(). store_modes() takes lock_fb_info() while replacing the modelist and freeing the old one. A concurrent reader or writer can load a pointer to an old modelist entry before store_modes() frees it, then dereference freed memory or store a stale freed pointer in fb_info->mode. Take lock_fb_info() in show_mode(), show_modes(), and store_mode() to serialize with store_modes(). In show_mode(), copy the mode to the stack and format after dropping the lock. In store_mode(), split activate() into a _locked variant to avoid double-locking, and hold the locks for the modelist walk, mode conversion, activation, and fb_info->mode assignment together. Cc: stable@vger.kernel.org # v7.1+ Signed-off-by: Melbin K Mathew <mlbnkm1@gmail.com> Signed-off-by: Helge Deller <deller@gmx.de> |
||
|
Melbin K Mathew
|
95e647d2a5 |
fbdev: clear fb_info->mode before deleting a videomode
fb_set_var() can delete a mode from info->modelist when userspace passes FB_ACTIVATE_INV_MODE through FBIOPUT_VSCREENINFO. The code checks that the mode being deleted is not the current info->var and that fbcon is not using it, but it does not check fb_info->mode. fb_info->mode may still point into the modelist entry being deleted. If the entry is freed, later mode sysfs reads through show_mode() can dereference a stale pointer. Clear fb_info->mode before calling fb_delete_videomode() when it matches the mode being removed. Cc: stable@vger.kernel.org # v7.1+ Signed-off-by: Melbin K Mathew <mlbnkm1@gmail.com> Signed-off-by: Helge Deller <deller@gmx.de> |
||
|
Melbin K Mathew
|
d15d51fb26 |
fbdev: bound mode sysfs output to the sysfs buffer
mode_string() uses snprintf() which can return a value larger than the remaining buffer space. show_modes() accumulates the return value into i without checking whether i has reached PAGE_SIZE, causing the offset to advance past the sysfs buffer if the modelist is long enough. Add a size parameter to mode_string() and use scnprintf() to return only the bytes actually written. Add an early return when offset already exceeds the buffer. In show_modes(), stop accumulating once the buffer is full. Cc: stable@vger.kernel.org # v7.1+ Signed-off-by: Melbin K Mathew <mlbnkm1@gmail.com> Signed-off-by: Helge Deller <deller@gmx.de> |
||
|
George Wilson
|
fb442a6673 |
powerpc/pseries: lparcfg - fix kbuf[] underflow
In lparcfg_write(), a count of 0 results in kbuf[] being indexed at -1.
Check for count == 0 in the existing check for count > sizeof(kbuf) and
return -EINVAL if true.
Fixes:
|
||
|
George Wilson
|
649c10bff5 |
powerpc/pseries: pci - logic bug
The checks on num_vfs in pseries_pci_sriov_enable() are ANDed where OR
was apparently intended. Change it to OR.
Fixes:
|
||
|
George Wilson
|
5b17f3f343 |
powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak
In papr_phy_attest_create_handle(), the params->cmd.length is not
validated before use, which can result in a buffer overlow. Check it and
return -EINVAL if it is either 0 or exceeds sizeof(params->cmd).
Also, params is freed on the success path but not error. Free it on
errors after memory allocation. And free it on negative fd.
Fixes:
|
||
|
Linus Torvalds
|
a59f57e2aa |
watchdog fixes for v7.2-rc7
* at91sam9_wdt: prevent timer rearm during teardown * bd96801_wdt: Fix timeout for enabled WDG * atcwdt200: Fix return value when watchdog is enabled -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEiHPvMQj9QTOCiqgVyx8mb86fmYEFAmp2dMQACgkQyx8mb86f mYGaYw/+NLMhySF0tbh+WHyf5AZRxb87MaGjnBSGN0FO2aaY1FVSlEgH9ilZmKjG k4s6SblSK9cOS/EbHFFn9Jwg4WTUZmEI2udzPnRQqo27RpGXVmq9TtVinadS2y7+ OrzegwUVJ2g6Wk4mnk1VbDeR31GHZM5pHvPzTPnQ0EuITH4BJY2vzBHcZeHyoNEo BFS9Nt8uaWpVtzq0YpChb45Gjh26zA2pB8IUndLX7fRbZmI4YD937OdzItTIrHH+ idDy/pYu7s/s6s8dJ8NIj2vqxeOP7aQvuWTAiBYoCO2s4mgaF9kEo29IUSfFjEhh 0ljfiyodRuu/hDzBAVPHejqCahv4k/aWVaP+LZgxVkQ3mJq0MuC39DB61O3aUrLD 4giRWZPTYpz0P010aaL9cwv78upu64LQ0te1X31UsNcj1Hl//bnY9mQohwYajbbq qxcQp4I4k0/u9DxpX09yl0WNngNGWaxviETO1XOjIDOopHTxwNjfmT1B1pdGTLEk +YMPn5k/ZySYxzrzViBe7pHg/0cxRJ2gzSNhrpTDlIXPPk/JgmcI6zNC71vqADXQ O3Ge8si4F610QfDvqtGTE3Quzm0UMGWtKOUHhz/WtLXDLxaowaa5TQuF/W3E4Xlv cpv3jlIw5GkPcY6srMJ93iCuLLlPgD4Ic0LrF7VajsAtqadGPjU= =2zg4 -----END PGP SIGNATURE----- Merge tag 'watchdog-for-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull watchdog fixes from Guenter Roeck: - at91sam9_wdt: prevent timer rearm during teardown - bd96801_wdt: Fix timeout for enabled WDG - atcwdt200: Fix return value when watchdog is enabled * tag 'watchdog-for-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: watchdog: at91sam9_wdt: prevent timer rearm during teardown watchdog: bd96801_wdt: Fix timeout for enabled WDG watchdog: atcwdt200: fix return value when watchdog is enabled |
||
|
Linus Torvalds
|
5d78d199be |
hwmon fixes for v7.2-rc7
Various fixes, most of them fixing critical or high severity bugs reported by Sashiko. * ads7828 - Fix external VREF regulator handling * corsair-psu - Fix linear11 calculation - Serialize debugfs access against hwmon - Fix possible out-of-bounds access on missing string termination * ltc4282 - Fix parsing adi,current-limit-sense-microvolt - Clamp negative current limits - Avoid overflow in maximum power calculation * nzxt-smart2 - Check return value of init_device() in probe * PMBus core - Fix type confusion in notification logic - Avoid race condition during probe * PMBus/lm25066 - Fix PMBus coefficient calculations -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEiHPvMQj9QTOCiqgVyx8mb86fmYEFAmp2c8wACgkQyx8mb86f mYEBzQ/8C6RlGpqieOaNrppHgD4kyjZTxsa1Zdg4HyVm0wG4NukwOzgXwwdukXCW vXsO7aDztPE0e6HHuBeeMtN838tKvGuNpeA4xXbel1VkKvho2whaMRT43kUGs9OF l9Mquauv1ts9VCKEdmtfrTBsH1EtYSG2avFd2BiIihnvzBViET2yEI/VmE/kF5YC q3osU7GxvElh9F+MeWhVrElWmwEBEaHJHmDOJr1ZBPGvqqG6tHtWf+8ZAAvZVwtW YWwiZwk1cgMKG+b35JGe1c2o+C+Eu26BC88zuu0dT6sZRFrJbWk2YFLNQFbyE1MJ C8ifRN5KgQSGLWyNfZTWeyPPy9K4Tp6Y8h6b0xqV0F3yvLp49cv06UyabhTOIsKS rWwu9Pz1YS7OED2ljfKkULbSNCX4PqoENK3KSPN9vMP0N55syVln3W+p+q7JmLxq ag8O95d8uAJD8WE8NtqbVyTY+rm7lJ+L0CxI1JRgNsA6ARD04+yX4yF4Fobdl0y7 IDdfQKlHOKvXuNjoDaqbDUuDFJV+izWAK/+XxXIYMOvuDrTDjB7zYoDcaPAyTCKa SQGDLYExzhXI3A17CkjXSQlKakuq9nww6ShFgsFZxXAgrAnAZ8GUE3r4HySZlSY+ wedjpB+OJVU7NzokFESxuFVmSuogavqmmBwq0Yo9n8I/hn0nwVc= =sLkT -----END PGP SIGNATURE----- Merge tag 'hwmon-for-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: "Various fixes, most of them fixing critical or high severity bugs reported by Sashiko. ads7828: - Fix external VREF regulator handling corsair-psu: - Fix linear11 calculation - Serialize debugfs access against hwmon - Fix possible out-of-bounds access on missing string termination ltc4282: - Fix parsing adi,current-limit-sense-microvolt - Clamp negative current limits - Avoid overflow in maximum power calculation nzxt-smart2: - Check return value of init_device() in probe PMBus core: - Fix type confusion in notification logic - Avoid race condition during probe PMBus/lm25066: - Fix PMBus coefficient calculations" * tag 'hwmon-for-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (corsair-psu) Fix linear11 calculation hwmon: (corsair-psu) serialize debugfs access against hwmon hwmon: (ltc4282) Fix parsing adi,current-limit-sense-microvolt hwmon: (ltc4282) Clamp negative current limits hwmon: (ltc4282) Avoid overflow in maximum power calculation hwmon: (ads7828) Fix external VREF regulator handling hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations hwmon: (nzxt-smart2) Check return value of init_device() in probe hwmon: (pmbus) Fix type confusion in notification logic hwmon: (pmbus/core) Avoid race condition during probe |
||
|
Linus Torvalds
|
9a143525f6 |
ata fixes for 7.2-rc7
- Disable liknk power management on yet another misbehaving WD drive
(Niklas).
- Fix a use after free issue in the pata_sl82c105 driver (Hongyan).
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQSRPv8tYSvhwAzJdzjdoc3SxdoYdgUCanZp5gAKCRDdoc3SxdoY
dtQwAP0Yq6NUePN6QaCMJL214S3VVASmM5HaDuj3pECJbXBUxgD+L+i3CkytaJKi
pII90cCwLvXXuRT35HO5XXQGxt3Z5AY=
=CUb4
-----END PGP SIGNATURE-----
Merge tag 'ata-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux
Pull ata fixes from Damien Le Moal:
- Disable link power management on yet another misbehaving WD drive
(Niklas)
- Fix a use after free issue in the pata_sl82c105 driver (Hongyan)
* tag 'ata-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:
ata: pata_sl82c105: fix bridge revision use-after-free
ata: libata-core: Disable LPM on WDC WD141KFGX-68FH9N0
|
||
|
Linus Torvalds
|
bcc44b6785 |
drm fixes for 7.2-rc7
shmem: - check VMA boundaries for PMD mappings xe: - Fix memory leak in exec_queue_set_hang_replay_state - Apply RCS/CCS yield policy to SR-IOV VFs amdgpu: - JPEG queue reset fixes - GC 12 fix - GMC 12.1 fixes - Lockdep false positive fix - Userq fix - Bounds checking fixes - Devcoredump fixes - DCN 2.0.1 fix - Aperture mapping fix - DC avmute fix - DC self refresh fix radeon: - Performance regression fix panthor: - skip zero sized firmware segments - check VMA boundaries for PMD mappings bridge: - ps8640: propagate AUX transfer register errors amdxdna: - Improve error handling in amdxdna_insert_pages. v3d: - serialise scheduler timeouts -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmp2SKIACgkQDHTzWXnE hr7tMg/8Cr2JwdX1gtShUvxjcuil3Vb4pQbcKVCbAuDBvlXLLThAXqgb13y4CBsJ Isk6t4g4660HTDAmUBEfas0iP01rrp6f0qDVx7qFz6BkZJH9y0I4h4cuybUtKkX4 WXfYxV51+inWRI84++jPEdj6l9+acYVlbU1+/7LlGn2I2ggdxdDT9+Mo2v/92sUV P5tqOP9R7WxOHvDeGpRQqzhBSQYQVxVmjzXuRpQPEjxckYLIfCKZyDUeP4mPkFSE NcYksbB2bl186Vq4+KYd4P0uEAyYl27td0kQsJEpKvIRYrKVkEhq7gru70TBnPlE ZD1mnAhvDuHYoGlYcU5W5N5Pj2FKvpRqxfmwoT/HNP007rvVUOMVK7mDe7xyAj3j feAxFY7tAJduqx+DAOpU1IAtdPikrO/xjhxoGjUMtTeUOOebJNdNKK6O8dCMqcsX rl05bjWecGZwEmt+juEjVGeVjqIzQ+qAydPw/0OmxaQ/oQ307/ijTT61LG3yD81G fHdOdGdbV5JVn/D8TqPk6fPb5Vk+sRE/qznLVQhtI3u7/SstggiHpX6lTgRrOiO0 GI7pZuxl1zxQfV3/tj4jDBYi+ODA1Bs2enJwtq16FMkpqlEp/GpAb3S7qNNP1KI2 jm9NrVCYP0f3x2lT8CIy+mp2t+tg+RMyYK6kAbevRyrC65mQH3U= =6In+ -----END PGP SIGNATURE----- Merge tag 'drm-fixes-2026-08-08' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Weekly fixes for drm, feels relatively quiet for the post-AI world, mostly amdgpu and xe with a few fixes across the board: shmem: - check VMA boundaries for PMD mappings xe: - Fix memory leak in exec_queue_set_hang_replay_state - Apply RCS/CCS yield policy to SR-IOV VFs amdgpu: - JPEG queue reset fixes - GC 12 fix - GMC 12.1 fixes - Lockdep false positive fix - Userq fix - Bounds checking fixes - Devcoredump fixes - DCN 2.0.1 fix - Aperture mapping fix - DC avmute fix - DC self refresh fix radeon: - Performance regression fix panthor: - skip zero sized firmware segments - check VMA boundaries for PMD mappings bridge: - ps8640: propagate AUX transfer register errors amdxdna: - Improve error handling in amdxdna_insert_pages. v3d: - serialise scheduler timeouts" * tag 'drm-fixes-2026-08-08' of https://gitlab.freedesktop.org/drm/kernel: (26 commits) drm/amd/display: allow self-refresh exit while entry is blocked drm/amdgpu: fix aperture iounmap skipped on device removal drm/amd/display: Check for tg ops in dce110_set_avmute Revert "drm/amdgpu: fix aperture mapping leak" drm/radeon: restore hardware polling in fence_is_signaled to fix performance regression drm/amd: Disable DP audio spread spectrum for Cyan Skillfish drm/amdgpu/gmc12.1: fix MMHUB0 check in pasid tlb flush drm/amdgpu: Allocate coredump ring buffers per ring drm/amdgpu: Use virtual alloc during coredump drm/amdgpu: reject oversized IBs with per-ring packet limits drm/amdgpu/userq: serialize queue map against GPU reset drm/amdgpu: Fix lockdep false positive in amdgpu_lockdep_init drm/amdgpu/gmc12.1: implement tlb inv semaphore drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12 drm/amdgpu: fix JPEG v5.3.0 queue reset failure in DPG mode drm/amdgpu: fix JPEG v4.0.5 queue reset failure in DPG mode drm/amdgpu: fix JPEG v5.0.0 queue reset failure in DPG mode drm/panthor: Check VMA boundaries for PMD mappings drm/xe/uc: Apply RCS/CCS yield policy to SR-IOV VFs drm/xe: Fix memory leak in exec_queue_set_hang_replay_state() ... |
||
|
Linus Torvalds
|
3f00828032 |
Pin control fixes for v7.2:
Qualcomm fixes: some incorrectly defined groups in IPQ9650, two pins needing to be marked as GPIO in IPQ806X. -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEElDRnuGcz/wPCXQWMQRCzN7AZXXMFAmp2K4kACgkQQRCzN7AZ XXNfeRAAtZL/qwyt03wCaPCnpUVmtkcAdoKSKteUbGOf73w9VlEal8gZTY6K/EiE gCiLGJqBoB7cZqDUlt7wnv2SeW08P7NCwZz7QGWG728cx2c8gUrWtxUHbNcDrhps UpWIDF1E3khGDGki726nq2Qo1bYAG57tEVZtRsUjMTb+XQQI9JQKpvS3QECxTXwD f/QLUbkT5rRuOqXq+PQzCoD3zSkZTCWgJIL+B2uC+/CuHK682FPC+qa19i4Xdeju RZBbj6oEvt5jL52qq/jtFlRViUrdxPBb6ju1+2H3g2AUVLZe9kbSvbzO0XzO9Qvq dfLHRLBm9CcSBIcYJJwC1dVhh2Ekn5o87cxEQzBajpEaErTAac/xmblkKRKkpX/u VQTxH3IWs7ypoEB9u8c/nt6VixnvALJY/1ldznSANUstnSYrIO+mGQVDPqbfL41o K/JxaNvIKYQHfOpGcWG69hVf0ZP+NSsftfKubapiK0NO4cYnqzFpazfAvqL06Jeg jRiE0K4QWe/vraYXW/iXOw8Zb+IQAN3Z3w5KKeJg7qtPiYEdoyYp94mI3HQF5hdm hh42y0CIK3J9uXdE+s+5iNq65HGNZDzKceQ45j+Aof6w1ZhokwB3iJ4z7iQzNNgs 7VtSnTDWaqF2PS34gwLv36dAoeQ8qT33bmzVPA4xOwnIOJl2wfo= =8MB1 -----END PGP SIGNATURE----- Merge tag 'pinctrl-v7.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: "Qualcomm fixes: some incorrectly defined groups in IPQ9650, two pins needing to be marked as GPIO in IPQ806X" * tag 'pinctrl-v7.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: qcom: ipq806x: mark pci reset as a GPIO pin function pinctrl: qcom: ipq806x: mark gpio as a GPIO pin function pinctrl: qcom: ipq9650: fix audio_sec_mclk_in1/out1 group pins |
||
|
Yao Kai
|
8e7ff730dd |
futex: Fix race in futex_pivot_pending() during private hash resize
A task performing a custom private hash resize can remain blocked in
uninterruptible sleep indefinitely. The hung-task detector reports:
INFO: task futex-resizer:314 blocked for more than 10 seconds.
task:futex-resizer state:D stack:14824 pid:314 tgid:312 ppid:311
Call Trace:
__schedule+0x521/0xf30
schedule+0x22/0xa0
futex_hash_allocate+0x3db/0x490
__do_sys_prctl+0x6f5/0xbd0
do_syscall_64+0xf9/0x530
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Kernel panic - not syncing: hung_task: blocked tasks
futex_pivot_pending() allows the resize request to continue when
either no replacement hash is pending (hash_new == NULL) or the current
hash reference count has reached zero.
After the final-reference wake, another futex task can complete the
pivot between the two observations:
T1 T2
futex_hash_allocate()
wait_var_event(mm, ...)
futex_pivot_pending(mm)
hash_new != NULL
futex_hash()
futex_ref_get(old) -> false
futex_pivot_hash(mm)
hash_new = NULL
__futex_pivot_hash(mm, new)
rcu_assign_pointer(hash, new)
fph = rcu_dereference(hash) /* new */
futex_ref_is_dead(fph) -> false
schedule()
The pivot changes the state from hash_new != NULL with a dead current
hash to hash_new == NULL with a live current hash. Because
futex_pivot_pending() reads hash_new and hash without serialization,
the resize task can observe hash_new in the pre-pivot state and hash in
the post-pivot state, causing futex_pivot_pending() to return false even
though the pivot has completed. The task then goes to sleep after the
wakeup has already been consumed.
Serialize state reads in futex_pivot_pending() using futex_mm_phash::lock.
This guarantees that futex_pivot_pending() observes hash_new and hash
atomically, eliminating the race condition.
Fixes:
|
||
|
Linus Torvalds
|
a13307e97d |
BPF fixes:
- Fix BPF verifier to preserve full pointer state for commuted
scalar += pointer arithmetic (Yiyang Chen, Eduard Zingerman)
- Fix a use-after-free of request sockets in the BPF TCP
iterator batching (Jose Fernandez)
- Fix a use-after-free of sk_redir in the BPF sockmap send
verdict path (Chengfeng Ye)
- Fix a netns reference imbalance in the BPF conntrack kfuncs
(Chengfeng Ye)
- Fix bpf_get_fsverity_digest() dynptr assumptions and silent
digest truncation (Eric Biggers)
- Fix bpf_tcp_{gen,check}_syncookie to check sk_state before
sk_protocol to make sure it is a full socket (Luxiao Xu)
- Fix rqspinlock to reset the tail when preserving the queue
on deadlock (Kumar Kartikeya Dwivedi)
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
-----BEGIN PGP SIGNATURE-----
iIsEABYKADMWIQTFp0I1jqZrAX+hPRXbK58LschIgwUCanXeCRUcZGFuaWVsQGlv
Z2VhcmJveC5uZXQACgkQ2yufC7HISIMfLQD9EWzi5MVBTcvg0XsHY1GZZBZUpfwo
VCrfPm9vHAVuqQ0A/0D9vWVRf1UEk9ccn+ebVKPuTuydGnDRR0Qovuca4gQF
=jZY8
-----END PGP SIGNATURE-----
Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf
Pull BPF fixes from Daniel Borkmann:
- Fix BPF verifier to preserve full pointer state for commuted
scalar += pointer arithmetic (Yiyang Chen, Eduard Zingerman)
- Fix a use-after-free of request sockets in the BPF TCP iterator
batching (Jose Fernandez)
- Fix a use-after-free of sk_redir in the BPF sockmap send verdict
path (Chengfeng Ye)
- Fix a netns reference imbalance in the BPF conntrack kfuncs
(Chengfeng Ye)
- Fix bpf_get_fsverity_digest() dynptr assumptions and silent
digest truncation (Eric Biggers)
- Fix bpf_tcp_{gen,check}_syncookie to check sk_state before
sk_protocol to make sure it is a full socket (Luxiao Xu)
- Fix rqspinlock to reset the tail when preserving the queue
on deadlock (Kumar Kartikeya Dwivedi)
* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
rqspinlock: Reset tail when preserving queue on deadlock
bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie
fsverity: Fix silent truncation in bpf_get_fsverity_digest()
fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
bpf: Fix netns reference imbalance in conntrack kfuncs
bpf, sockmap: Fix sk_redir use-after-free in send verdict
selftests/bpf: Cover commuted pointer state propagation
bpf: Propagate untrusted pointer state in commuted arithmetic
bpf: Preserve pointer state for commuted arithmetic
bpf: Simplify sanitize_err() signature
|
||
|
Linus Torvalds
|
0150da6be1 |
s390:
- fix a lot of small bugs and races
x86:
- fix missing locking related to KVM_CAP_MOVE_ENC_CONTEXT_FROM
- warn on creating a new page table that is the child of an invalid one,
and limit damage before it's too late
- disable use of INVLPGA when NPT is enabled, because it doesn't seem
to flush TLBs correctly
-----BEGIN PGP SIGNATURE-----
iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmp14g0UHHBib256aW5p
QHJlZGhhdC5jb20ACgkQv/vSX3jHroPzrAf+KGSkR+qBbqgsSy0I86kw6VvX6h8i
TySes/l0JaNbVQDDt3vYzw/ZXhrm6dRA58i1mwjIVLIY3pflXzUrwqqXjLwvcGNf
1eX0jOZOg68fXPW22okR+7mNJdHSiRiX3Ozw20TrS5+33xN3dKa1xsTtNFRN99f6
h8mtQIP5L9dYn6y9lI27y51lkx3Ojd8SWAUJyXn8d3OA28mBcIShpq6BJsroHT34
HzibCnNAodFMGDsUJr93mpJisUV4EsWPKO2hzMm5FUUkV/JBD3GnqwF550Kwpc8a
ojuaHCEAnZXLoDuOTBiT8iQBa1fDUHizERlTkHD91s0ktwqf+e3p0azjMw==
=734T
-----END PGP SIGNATURE-----
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
Pull vkm fixes from Paolo Bonzini:
"s390:
- fix a lot of small bugs and races
x86:
- fix missing locking related to KVM_CAP_MOVE_ENC_CONTEXT_FROM
- warn on creating a new page table that is the child of an invalid
one, and limit damage before it's too late
- disable use of INVLPGA when NPT is enabled, because it doesn't seem
to flush TLBs correctly"
* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (26 commits)
KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page
KVM: SVM: Serialize accesses to the owner and mirror list with separate lock
KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled
KVM: s390: Fix cleanup in kvm_s390_pv_create_cpu()
KVM: s390: Fix ordering when adding to SCA
KVM: s390: Return -EINTR if a signal is pending while faulting-in
KVM: s390: Free the mmu cache when kvm_arch_vcpu_create() fails
KVM: s390: ucontrol: Add missing locking around gmap_remove_child()
KVM: s390: cmma: Fix dirty tracking when removing memslot
KVM: s390: Fix race in __do_essa()
KVM: s390: Fix leaking of PGM_ADDRESSING to userspace
KVM: s390: ucontrol: Fix sca_clear_ext_call()
KVM: s390: Fix overclearing ESCA in case of error
KVM: s390: Fix kvm_s390_vcpu_unsetup_cmma()
KVM: s390: Do not free SCA if it was not allocated
KVM: s390: Fix unlikely NULL gmap dereference
s390/vfio_ccw: Implement a crw lock
s390/vfio_ccw: Selectively expand io_mutex
s390/vfio_ccw: Move cp cleanup out of not operational
s390/vfio_ccw: Cancel existing workqueues
...
|
||
|
Linus Torvalds
|
7cbe91a4be |
Thermal control fixes for 7.2-rc7
Revert three thermal core updates, two recent ones and one older. The recent ones attempted to fix a design issue in the thermal core and simplify code on top of that, but they made changes visible to user space and made it unhappy. The older one is a misguided code cleanup that introduced a (potentially nasty) bug. -----BEGIN PGP SIGNATURE----- iQFGBAABCAAwFiEEcM8Aw/RY0dgsiRUR7l+9nS/U47UFAmp1yVQSHHJqd0Byand5 c29ja2kubmV0AAoJEO5fvZ0v1OO1gm8H/j6zXC1hbZbmLjQd9HSiNUgpuDOPMz9p 5oeacpOiu60PUA8a0IEEdQGHlihg4eStP8h9cSoYccKCl9MtIFHZQluPKF1Dh6NM 18749AZ0Ed2ZRZbar6ud+b88suUh9bTTWazjcwYoqr7vLtPO/1jFGDx4gED2LlEg c8CNeYzqO4KoG86qSe6gRtus6IigH0I95eFY/hlfzJrhU3v7GlGrWGuHKaNOZ85e Sv34E2UApV3s0VpU/zHpiFXJIP9eVYER8cHtUayZYOXc6wDf2jFfwYJixxn/T15F gUKpPUy0cOirobx1ZlQn5l5lVgtBuUj201XENcR1dfMINhdvuL6S1ik= =/1Jt -----END PGP SIGNATURE----- Merge tag 'thermal-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control fixes from Rafael Wysocki: "Revert three thermal core updates, two recent ones and one older. The recent ones attempted to fix a design issue in the thermal core and simplify code on top of that, but they made changes visible to user space and made it unhappy. The older one is a misguided code cleanup that introduced a (potentially nasty) bug" * tag 'thermal-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: Revert "thermal/drivers/hwmon: Cleanup coding style a bit" Revert "thermal: hwmon: Register a hwmon device for each thermal zone" Revert "thermal: hwmon: Use extra_groups for adding temperature attributes" |
||
|
Linus Torvalds
|
7e73882ecf |
sound fixes for 7.2-rc7
A collection of small fixes since the last pull request.
More than few, but an enough-manageable amount at this time.
USB-audio:
- UAF, OOB and such hardening fixes for USB-audio, usx2y and us144mkii
- Mixer regression fixes for Logitech PRO X 2 LIGHTSPEED headset and
M-Audio Fast Track Ultra
HD-audio:
- Fix for an ACPI reference leak in TAS2781 HDA side-codec
ASoC:
- Fixes the default tables for Cirrus Logic codecs
- Fixes for invalid enum accesses for Qualcomm LPASS
- Error handling and robustness fixes for Intel SOF & Soundwire
- DMI quirks for a few AMD devices
-----BEGIN PGP SIGNATURE-----
iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmp1mRAOHHRpd2FpQHN1
c2UuZGUACgkQLtJE4w1nLE+8iw/8DBwUZT7mnytHB+QHF/STnt/kIZN1Y8LSRXMy
JegVVYVksW1b9nF/JAD02vl0CMJ/ZE3qQs1deMbbbF982tfATu1B0XzLO2AYXE5F
50KLlmkyHfybHVKlYvwGRrKEUbYsBOcoeCaFPFS3gDQfkXepBMK4yE9db+qpZvcS
ZLyv9Ff3rcsCfSTNyxCJdrfiespDC6H1Trj0CeGoyiHyNr5tKhQ6JByLjTLNjweF
Mi2UNa+cy5zQV4kWiv+RvQ6CWAJyETF7oZQvHKYfybkqr4GiyDjSVl5usEGOUNdh
vKuEIbzAprEmzQ/pjX27+ig53uiwDAMDGrRDwW3khqrm7XIDXEbL5iQNbBz5HRU5
GjWCbbJGoqDCdDg9dN3nEACH2sX6kDYt8I5RKQo4l/+3tMISNrFujdCXrYQbx6We
MLouuzjLbr+gyr2EVsKaNuZqVS6Li9OEwRloP7TJjI81UAaxfosMv+tmmB8d7P2v
xjuBDObs2JgROPWy0lVI62/1cL/KLLMHM8z/+VlYxMtYJ13ipySeXCRtaHSMX46c
76Vtgx42O3YOHTkNBg5zpRFTX7NnK0B7u8JWsYqb5HlLnvr1TeUWevq3UKAc/5mX
suj747xYrYcI6nXFN9CTnfz/V3RjQqWKooBgjbKdTe2QHkynQd2GI6Kb6dYIJ/R8
MFzD4EM=
=r8TD
-----END PGP SIGNATURE-----
Merge tag 'sound-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"A collection of small fixes since the last pull request. More than
few, but an enough-manageable amount at this time.
USB-audio:
- UAF, OOB and such hardening fixes for USB-audio, usx2y and
us144mkii
- Mixer regression fixes for Logitech PRO X 2 LIGHTSPEED headset and
M-Audio Fast Track Ultra
HD-audio:
- Fix for an ACPI reference leak in TAS2781 HDA side-codec
ASoC:
- Fixes the default tables for Cirrus Logic codecs
- Fixes for invalid enum accesses for Qualcomm LPASS
- Error handling and robustness fixes for Intel SOF & Soundwire
- DMI quirks for a few AMD devices"
* tag 'sound-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (22 commits)
ALSA: usb-audio: Fix sticky mixer regressions on M-Audio Fast Track Ultra
ASoC: cs4265: sort the register default table
ASoC: cs35l45: sort the register default table
ASoC: cs35l41: sort the register default table
ASoC: amd: yc: Add DMI quirk for MSI Raider A18 HX A7VHG
ASoC: amd: yc: Add DMI quirk for Xiaomi RedmiBook 16 2025
ALSA: usx2y: bound the hwdep mmap fault offset
ALSA: usb-audio: fix OOB write on Type II inbound URBs
ALSA: us144mkii: re-anchor capture URBs on resubmission
ALSA: FCP: fix OOB write in fcp_meter_ctl_get()
MAINTAINERS: add SpacemiT K1/K3 I2S entry
ASoC: rt5645: Make the Kconfig symbol user selectable
ALSA: usb-audio: Add QUIRK_FLAG_MIXER_GET_CUR_BROKEN for Logitech PRO X 2 LIGHTSPEED
ALSA: hda/tas2781: fix ACPI reference handling
ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses
ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses
ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout
ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx
ASoC/soundwire: Intel: reset the PCMSyCM registers in hda_sdw_bpt_close
ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()
...
|
||
|
Dave Airlie
|
5fb210754e |
amd-drm-fixes-7.2-2026-08-06:
amdgpu: - JPEG queue reset fixes - GC 12 fix - GMC 12.1 fixes - Lockdep false positive fix - Userq fix - Bounds checking fixes - Devcoredump fixes - DCN 2.0.1 fix - Aperture mapping fix - DC avmute fix - DC self refresh fix radeon: - Performance regression fix -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQQgO5Idg2tXNTSZAr293/aFa7yZ2AUCanT4qwAKCRC93/aFa7yZ 2MZ3AP44wgJjZEzph2TU9kggsQbh8voajhVEI4p29zGHfCorvwEAo2l3CmnnnZ6t tr8RD0YnJ9HyVk19RsEp+rr8JIx3Qwo= =mXZL -----END PGP SIGNATURE----- Merge tag 'amd-drm-fixes-7.2-2026-08-06' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-7.2-2026-08-06: amdgpu: - JPEG queue reset fixes - GC 12 fix - GMC 12.1 fixes - Lockdep false positive fix - Userq fix - Bounds checking fixes - Devcoredump fixes - DCN 2.0.1 fix - Aperture mapping fix - DC avmute fix - DC self refresh fix radeon: - Performance regression fix Signed-off-by: Dave Airlie <airlied@redhat.com> From: Alex Deucher <alexander.deucher@amd.com> Link: https://patch.msgid.link/20260806211538.994087-1-alexander.deucher@amd.com |
||
|
Dave Airlie
|
0f7f5029eb |
drm-misc-fixes for v7.2-rc6:
- panthor & shmem helpers: Check vma range inside pmd fault handler. - panthor: handle empty firmware sections correctly. - bridge/ps8640: Forward aux transfer errors. - amdxdna: Improve error handling in amdxdna_insert_pages. -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEuXvWqAysSYEJGuVH/lWMcqZwE8MFAmp030AACgkQ/lWMcqZw E8PCIA/+MSlxJ9hi2tPLylYzUooCJmsZ2JdDdLy2mwbgcVnXOZ3qAGEKOYYhAjKh L6KmYxSslO9TzqE7dkKcqVuYgJzmWwxYLoQYvRJODnAxjFZpAhhU7JCXJjmDMV4K cd9BA8IYtFrgOw+8dM+khZHVvf+f45ChRNkPhVzbsXMLPdW0CnWJQK9cqNozWane BwEeGcw1tH2Y3+X2MBFEIEj/gdBpn2nDXCTP9VPqF1k7wRaSIdSrJ9qOOYzGm34F WSuOtZ/BhAmPprDamZMSFshKpP83be+2Crrtd0OD6ayCY5h7ULl91KAV7DlTOn5m IpPdU4Oc2ku7XfB6SOyghADI7QFjt1+VGnFQGXXZhdTdiM1sbFnLtCYnCwL8iof1 z/Fzy7l4kOvl2WzoV77BwQHD4+o5aACExDXxkzyBm0R5dL2BQTRf1n74hPWmIiJ4 ZHmauyLaXMuZPdSLTTWFMWFE5q9S3wnBHP+EYPnPud3cIr281zNFX+iuuZaGHSgS 6xCOs5I2HVZve1sW1AH9Ftzie+egpRYHy9ds8ZuU9yE5GbUbYplHm6BYZ1rHzGtx kNjOrEtvmxR8UWpIKbT03U5Tnc3z+2+Trr5rN4doOQzUE8NeVWUyio5WPqbqhLF7 D3QhX3Wo6zIjgtvRDQHVt6zBNX4GBSPbqWM77D4+UhJqUgwy+L0= =ORsJ -----END PGP SIGNATURE----- Merge tag 'drm-misc-fixes-2026-08-06' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes drm-misc-fixes for v7.2-rc6: - panthor & shmem helpers: Check vma range inside pmd fault handler. - panthor: handle empty firmware sections correctly. - bridge/ps8640: Forward aux transfer errors. - amdxdna: Improve error handling in amdxdna_insert_pages. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Link: https://patch.msgid.link/415659f6-5199-4078-8319-22d7529e777d@linux.intel.com |
||
|
Takashi Iwai
|
a8934c2c6d |
ALSA: usb-audio: Fix sticky mixer regressions on M-Audio Fast Track Ultra
The recent fix for sticky mixer volumes caused regressions of M-audio
Fast Track Ultra device, where the mixer state is kept to the default
value.
Add the quirk entries to tolerate the broken mixer behavior. As the
device is known to work in the implicit feedback mode, explicitly
enable the implicit feedback mode, too.
Since there are two FTU models that are almost identical, both entries
are added in this patch (0763:2080 and 0763:2081).
Fixes:
|
||
|
Sean Christopherson
|
5ec42d5765 |
KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page
Explicitly clear role.invalid when deriving a child shadow page's role from
its parent to harden against bugs elsewhere in KVM, as violating KVM's
invariant that invalid pages are NOT on the list of active MMU pages leads
to use-after-free due to __kvm_mmu_prepare_zap_page() using list_add()
instead of list_move() when processing an invalid shadow page, i.e. makes a
bad situation far worse.
Yell loudly if the parent is invalid, as it means KVM has missed a validity
check, i.e. KVM is attempting to map memory using an invalid/obsolete root,
but continue on as the child is otherwise still a valid shadow page.
==================================================================
BUG: KASAN: slab-use-after-free in __kvm_mmu_get_shadow_page+0x1817/0x1860 [kvm]
Write of size 8 at addr ff11000153dd1368 by task repro/853
CPU: 1 UID: 1000 PID: 853 Comm: repro Not tainted 7.2.0-rc2-3aec122bdcaf-next-vm #5 PREEMPT
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
Call Trace:
<TASK>
dump_stack_lvl+0x4b/0x70
print_report+0x153/0x49c
kasan_report+0xbc/0xf0
__kvm_mmu_get_shadow_page+0x1817/0x1860 [kvm]
mmu_alloc_root+0x141/0x320 [kvm]
kvm_mmu_load+0x612/0x20f0 [kvm]
kvm_arch_vcpu_ioctl_run+0x3dd5/0x6150 [kvm]
kvm_vcpu_ioctl+0x5e4/0x10d0 [kvm]
__x64_sys_ioctl+0x131/0x1b0
do_syscall_64+0x67/0x5f0
entry_SYSCALL_64_after_hwframe+0x4b/0x53
</TASK>
Allocated by task 853:
kasan_save_stack+0x20/0x40
kasan_save_track+0x14/0x30
__kasan_slab_alloc+0x5f/0x70
kmem_cache_alloc_noprof+0xfe/0x2e0
__kvm_mmu_topup_memory_cache+0x135/0x530 [kvm]
paging64_page_fault+0x318/0x1e30 [kvm]
kvm_mmu_do_page_fault+0x21d/0x630 [kvm]
kvm_mmu_page_fault+0x18c/0x17b0 [kvm]
kvm_arch_vcpu_ioctl_run+0x1f35/0x6150 [kvm]
kvm_vcpu_ioctl+0x5e4/0x10d0 [kvm]
__x64_sys_ioctl+0x131/0x1b0
do_syscall_64+0x67/0x5f0
entry_SYSCALL_64_after_hwframe+0x4b/0x53
Freed by task 853:
kasan_save_stack+0x20/0x40
kasan_save_track+0x14/0x30
kasan_save_free_info+0x3b/0x60
__kasan_slab_free+0x43/0x70
kmem_cache_free+0xe2/0x400
kvm_mmu_commit_zap_page.part.0+0x1e2/0x310 [kvm]
kvm_mmu_free_roots+0x283/0x560 [kvm]
kvm_arch_vcpu_ioctl_run+0x33c8/0x6150 [kvm]
kvm_vcpu_ioctl+0x5e4/0x10d0 [kvm]
__x64_sys_ioctl+0x131/0x1b0
do_syscall_64+0x67/0x5f0
entry_SYSCALL_64_after_hwframe+0x4b/0x53
Reported-by: Hyunwoo Kim <imv4bel@gmail.com>
Fixes:
|
||
|
Guenter Roeck
|
c6c4234928 |
hwmon: (corsair-psu) Fix linear11 calculation
In corsairpsu_linear11_to_int(), the mantissa is extracted using bitwise
operations and cast to s16 before being shifted left:
static int corsairpsu_linear11_to_int(const u16 val, const int scale)
{
...
const int mant = (((s16)(val & 0x7ff)) << 5) >> 5;
...
}
Due to C integer promotion rules, the masked value (which is always
positive) is promoted to a 32-bit integer before the left shift. As a
result, the sign bit is never extended to bit 31 of the promoted integer.
When the device hardware reports a negative temperature in Linear11 format
(such as an ambient temperature probe reporting sub-zero), the negative
mantissa is parsed incorrectly as a massive positive value. For example,
-1 becomes 2047, which scales to 2047 degrees Celsius.
Fix the problem by type casting the result of the left shift operation
to s16.
Another problem is left-shifting of negative values. In C, the result of
left-shifting negative values is undefined. Use a multiplication instead
to avoid the problem.
Also use a local s64 variable to store temporary results, change
the return value type from int to long, and clamp the final value
to LONG_MIN and LONG_MAX to avoid under- and overflow issues while
retaining as much information as possible.
Reported-by: Sashiko <sashiko-bot@kernel.org>
Cc: Wilken Gottwalt <wilken.gottwalt@posteo.net>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Wilken Gottwalt <wilken.gottwalt@posteo.net>
Link: https://lore.kernel.org/r/20260804034811.2385506-1-linux@roeck-us.net
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
|
||
|
Ali Ahmet Memis
|
2da6050809 |
hwmon: (corsair-psu) serialize debugfs access against hwmon
corsairpsu_request() sends a rail select command and then the actual read as two separate transfers, both going through the single shared cmd_buffer and wait_completion in corsairpsu_usb_cmd(). The hwmon core serializes its own callers, but the debugfs files call corsairpsu_get_value() directly and never take that lock, so a debugfs read can land between another reader's rail select and its value read. The result is a value from the wrong rail reported as the right one, because corsairpsu_usb_cmd() only checks the command echo and both transfers echo the command it expects. It can also make a caller consume the reply meant for the other one, since raw_event() writes into the shared buffer and completes whoever happens to be waiting. Locking was dropped in commit |
||
|
Guenter Roeck
|
335698fd7f |
hwmon: (ltc4282) Fix parsing adi,current-limit-sense-microvolt
ltc4282_parse_dt() evaluates the wrong variable when parsing the current
limit.
When the adi,current-limit-sense-microvolt property is parsed into
st->vsense_max, the subsequent switch statement evaluates the unrelated
val variable instead of st->vsense_max:
drivers/hwmon/ltc4282.c:ltc4282_parse_dt() {
...
ret = device_property_read_u32(dev, "adi,current-limit-sense-microvolt",
&st->vsense_max);
if (!ret) {
int reg_val;
switch (val) {
case 12500:
reg_val = 0;
break;
...
}
Because val holds a small integer representing vin_mode (from 0 to 3), it
never matches any of the valid current limit cases.
This causes it to always fall through to the default error case, return
-EINVAL, and aborts probe initialization for any device tree using this
property.
Validate st->vsense_max instead to fix the problem.
Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes:
|
||
|
Guenter Roeck
|
e253dd5f9f |
hwmon: (ltc4282) Clamp negative current limits
When a negative value is passed to ltc4282_write_curr(), the signed long
val is cast directly to u64:
drivers/hwmon/ltc4282.c:ltc4282_write_curr() {
/* need to pass it in millivolt */
u32 in = DIV_ROUND_CLOSEST_ULL((u64)val * st->rsense, DECA * MICRO);
...
}
This cast converts negative inputs into large positive values. The
subsequent division result overflows the u32 in variable, truncating
to a pseudo-random positive value. When this is passed to
ltc4282_write_voltage_byte(), it is clamped to the maximum limit instead
of zero.
Clamp val to 0 and to the maximum supported upper limit before the cast
and assign the result to a 64-bit temporary variable before the division
to avoid the underflow and an also possible overflow.
Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes:
|
||
|
Guenter Roeck
|
edd11a9433 |
hwmon: (ltc4282) Avoid overflow in maximum power calculation
During device initialization in ltc4282_set_max_limits(), the calculation
of the maximum power limit can suffer from a 32-bit integer overflow.
static int ltc4282_set_max_limits(struct ltc4282_state *st)
{
...
st->power_max = DIV_ROUND_CLOSEST(st->vsense_max * DECA * MILLI,
st->rsense) * st->vfs_out;
...
}
The result of DIV_ROUND_CLOSEST() evaluates to a 32-bit unsigned integer
on 32-bit architectures. This result is then multiplied by st->vfs_out,
which is a 16-bit unsigned integer. According to C promotion rules, since
both operands are 32-bit or smaller, the multiplication is performed in
32-bit precision.
If the device is configured with a low sense resistor value via the device
tree (for example, 100 nano-ohms, resulting in st->rsense = 1) and the
voltage is high, the division result can reach 343,750,000 and st->vfs_out
can be 33,280. The product of these values is approximately 11.44 trillion,
which exceeds the maximum capacity of a 32-bit integer and overflows
before being stored in st->power_max.
This overflow causes a truncated value to be assigned to st->power_max and
written to the hardware limit register. An incorrect maximum power limit
can trigger spurious power-bad faults or alarms, which may lead to the
shutdown of the monitored power rail.
Avoid the problem by calculating and storing the maximum power using 64-bit
variables.
Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes:
|
||
|
Qingshuang Fu
|
fddb5ceaf9 |
hwmon: (ads7828) Fix external VREF regulator handling
The driver currently has two issues with the external VREF regulator
handling in ads7828_probe():
1. All errors from devm_regulator_get_optional() are ignored, causing the
driver to incorrectly fall back to internal VREF even for transient
errors like -EPROBE_DEFER or genuine failures like -ENOMEM.
2. The external regulator is never enabled. The driver calls
regulator_get_voltage() without first calling regulator_enable(),
so the VREF pin may remain unpowered if the regulator is not
configured as always-on.
Fix both issues by switching to devm_regulator_get_enable_read_voltage(),
which handles regulator get, enable, and voltage read in one call.
Only -ENODEV (no regulator specified in device tree) should trigger the
fallback to internal VREF. All other errors are propagated to the caller.
Fixes:
|
||
|
Wilken Gottwalt
|
36c4d73ce0 |
hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination
In theory it could be possible that the REPLY_SIZE sized buffers for
holding the vendor and product strings could be end up missing the null
termination (for example by malicious hardware built on purpose)
required by the seq_printf() call. That limits the debugfs printf calls
to a maximum string length of REPLY_SIZE.
Fixes:
|
||
|
Linus Torvalds
|
f9a2394a23 |
17 hotfixes. 15 are cc:stable. 16 are for MM.
There's a 3 patch series from Lorenzo "mm: fix UAF caused by race between
ptdump and vmap pgtable freeing" which addresses a quite old bug in the
ptdump code.
And a 2 patch series also from Lorenzo which fixes a four year old bug in
the huge_zero_folio handling.
A 3 patch series from SJ fixes a few possible divide-by-zero issues which
Sashiko sniffed out. And a 2 patch series which fixes handling of the
commit_inputs parameters.
The remainder are singletons, please see their changelogs for details.
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCanU4oAAKCRDdBJ7gKXxA
jjNlAQC8cHxL4VjKRgSs90n6XQoYdLeIHxxRPVqfbfpRuQT/MQEAlg6+pCzlwMHW
OZojHm4c7ttzU8X/VRkq6u8a95qSyAg=
=P6ey
-----END PGP SIGNATURE-----
Merge tag 'mm-hotfixes-stable-2026-08-06-18-44' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull MM fixes from Andrew Morton:
"17 hotfixes. 15 are cc:stable. 16 are for MM.
There's a patch series from Lorenzo "mm: fix UAF caused by race
between ptdump and vmap pgtable freeing" which addresses a quite old
bug in the ptdump code.
And another series also from Lorenzo which fixes a four year old bug
in the huge_zero_folio handling.
A series from SJ fixes a few possible divide-by-zero issues which
Sashiko sniffed out. And a series which fixes handling of the
commit_inputs parameters.
The remainder are singletons, please see their changelogs for details"
* tag 'mm-hotfixes-stable-2026-08-06-18-44' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
mm/damon: adjust isolated pages stat for DAMOS_MIGRATE_{HOT,COLD}
mm/damon/ops-common: putback folios on invalid migrate nid
mm/huge_memory: initialise workingset state before folio split
mm/page_table_check: skip special zero mappings
mm/damon/lru_sort: skip damon_call() if ctx has not started
mm/damon/reclaim: skip damon_call() if ctx has not started
mm/damon/lru_sort: error out for >10000 active_mem_bp
samples/damon/mtier: error out for zero quota goal target values
mailmap: map old addresses to Danila Tikhonov
mm/huge_memory: separate out CONFIG_PERSISTENT_HUGE_ZERO_FOLIO logic
mm/huge_memory: fix huge_zero_pfn race
MAINTAINERS: update address for Brendan Jackman
mm/filemap: __filemap_add_folio() restore index before retrying
microblaze: restore the page alignment of swapper_pg_dir
arm64: remove redundant concurrent ptdump UAF mitigation
mm/ptdump: always stabilise against page table freeing using init_mm
mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF
|
||
|
Linus Torvalds
|
364465ab19 |
three ksmbd server fixes
-----BEGIN PGP SIGNATURE----- iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmp1LGcACgkQiiy9cAdy T1FDlQv9GlIzgib/35NXV/L50xHR5UeloUvH+U6xbWk+OOdYh58VpZory6MxcaP1 uF87qqvs4JKFaBmOmYCodhChjF4lomn1ZcWSIrhx8k6nV+miIJrfofpTT3rI3DV8 BYwfRPlxcUd7s79W6uCCEun70OQOrrZT8J3FSKa3Pr+ySDBVd4Q9TZLh6eW25EOf i4CUZv2LB2HGxtKXSS+B+vaP1k475b1W1InRW0Ir3Oj2amwnMst+g2wZx9rOVhMI gFfcgj3HDVlVO6QEYGEyrzPM1fMKBlpnUOVbKkLGRYJodCUTYSKFsZXd2ByJXZFx V9O5ZcyRgIfq4bOA7vBqrLi9eWJFOLavb7GUwDl9u7o51FHZT8Setk1kVkPypKJ2 dQBQ4EVX3bMqjv+BRNv8GV1Q3qwPdbBbgRtanTg33POGmIDpRKcEPdcj3C3CIaBa QVfjDpmOJk/fvsQDEJfVF1rEE/qaqQ7/1+nai9Ze29nkAzNtNPUsgriv1x11Ax9m xHfq88yg =cLad -----END PGP SIGNATURE----- Merge tag 'v7.2-rc6-smb3-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - Reject Pattern_V1 payloads when Pattern_V1 support was not negotiated - Validate compression transform flags and chained mode before allocating the decompression buffer - Enforce the pre-authentication PDU size limit before allocating the decompression buffer, preventing compressed requests from bypassing the limit * tag 'v7.2-rc6-smb3-server-fixes' of git://git.samba.org/ksmbd: ksmbd: apply the pre-authentication PDU limit when decompressing ksmbd: validate compression Flags before kvmalloc smb: compress: reject Pattern_V1 when not negotiated |
||
|
Dave Airlie
|
e9923a69ad |
- Fix memory leak in exec_queue_set_hang_replay_state (Michal)
- Apply RCS/CCS yield policy to SR-IOV VFs (Marcin) -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEEbSBwaO7dZQkcLOKj+mJfZA7rE8oFAmp0hB4ACgkQ+mJfZA7r E8oGSQgAkJx+oyBrGuUwiRiufDgVsefM4QUeAcjJkZGj24Ze9hNP1i1hxCWllZCk z34sa3pjp86VTnqYh5m1HCfB1qLlRxfSdTl/XnoVDPMurS4pDs4Mi2cwUCtiuImN n1xBdISkjpd7Q5ELbiUy86G9qaKF5QdDeQheUX0jHkuN1bakqjuRYtBPbV4C3mwz ddqVELQd60UeuOwpIb3GwbdsmzJotr+FQDMS5tdUeie3+qr9IGhT0EpE4B6Db9Gd bBnfKhGwFn30l/+VqOVvQw1sDWm3tqqN8QmACYTpYi/gmmFJd0Fwzs0QXb0lYHfB uPVfsk6ZsnNB4nu51+CHSOyQrAANzA== =WZI/ -----END PGP SIGNATURE----- Merge tag 'drm-xe-fixes-2026-08-06' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes - Fix memory leak in exec_queue_set_hang_replay_state (Michal) - Apply RCS/CCS yield policy to SR-IOV VFs (Marcin) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patch.msgid.link/anSESyrwICYHvZ59@intel.com |
||
|
Kumar Kartikeya Dwivedi
|
7a3c0289c3 |
rqspinlock: Reset tail when preserving queue on deadlock
Currently, the destruction of the waiter queue is suppressed for
rqspinlock in cases where a deadlock is detected. Deadlock checks happen
relatively frequently (on entry for AA, within 1ms for ABBA), and waiter
threads may not be involved in locking scenarios involving deadlocks.
Thus, it is useful to not flush the queue and let other waiters take a
stab at acquiring the lock after we detect a deadlock and exit.
However, we need to follow the same logic as what we did previously for
the waitq_timeout label: reset the tail, and if we cannot, signal the
next waiter appropriately. In case of deadlocks, this signal would just
mark the MCS node as unlocked, and in case of timeouts, it would signal
RES_TIMEOUT_VAL. The difference thus is in the value propagated, which
decides whether the queue remains active or gets flushed.
Not doing the tail reset, and waiting for the next waiter can lead to
cases where we are the final waiter, and thus no next waiter arrives,
leading to intermittent stalls in this path. Once the next waiter does
join, we will be unblocked. In the theoretical case when the next waiter
never joins, we risk stalling indefinitely.
This can only happen for ABBA deadlocks, since entry into the wait queue
is guarded with AA checks. A precise sequence of executions leading up
to this scenario can be:
CPU 0 holds lock A.
CPU 1 holds lock B.
CPU 2 attempts lock B, becomes the pending waiter for B.
CPU 0 attempts lock B. B has locked+pending bits set, thus CPU 0 queues.
CPU 1 attempts lock A.
CPU 0 detects an ABBA deadlock.
Once deadlock detection happens for CPU 0, it will sit waiting for the
next waiter in the queue to populate node->next, which will experience
delays until such a waiter arrives.
Fix this by adjusting the logic for the check for deadlocks preceding
the waitq_timeout label. It would make sense to consolidate code for
both cases and use 'ret' to distinguish the value being propagated, but
that is left as an exercise for a future refactoring task to avoid diff
noise in this patch.
Fixes:
|
||
|
Linus Torvalds
|
c0a27675ea |
three client fixes
-----BEGIN PGP SIGNATURE----- iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmp1B8QACgkQiiy9cAdy T1Hxxgv/VvHfzlg/s711WorN6MskMtOLx/hK8OS0bPZLqz+qyCIAJbCIWS9CrUCs BETMwoElVOoN1MAA9ACEQMrs3PF/+rQVN7OuA5Axh6pBxYqkJLoou521S6HVPKbv cUmn2cwvEMiApSJgBKPGyPaQtQcuLSxEZ8tJQtu6mat+tda63UwI/KhqS7GsZDdq SSP4aGl58HGtpK/+mHa9yUC8PogiFptmAvQhYDGhs4QFjx1c/eMAwe2x9bHYvzjq 2zyPd+C3g1anL91YOKcjmgBlorMhG+7wwEC1THoSw7uxqNQUa4ZevpwxfHYFEYNx xPVZPfgsrelR14eS2hvhB2d0uu4mIKIx9y2QSanK3KSoGg2TLSAC9UI3fLTl4EqK MlQoU6OqA6QiV7UZQfAuRfz3eXVThvvHOXl8r/elLkp/LccBi6xP378+RqsQXtIm x98242gMXTlmQ21JqR7ktWahAS0X78wqDz78Fk6Mk3xnGhAsHvpQGUYKnxw6uhZj HzayQgz4 =MCxD -----END PGP SIGNATURE----- Merge tag 'v7.2-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - Fix potential use after free in cifs_try_adding_channels - Fix SMB1 large directory enumeration - Minor debug improvement (show compress mount option) * tag 'v7.2-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() smb: client: Fix use-after-free in cifs_try_adding_channels() smb/client: show compress mount option |
||
|
Hongyan Xu
|
8444d66aa6 |
watchdog: at91sam9_wdt: prevent timer rearm during teardown
at91_ping() rearms the watchdog timer from its callback. timer_delete()
neither waits for a running callback nor prevents it from rearming the
timer, so probe failure or driver removal can leave the timer accessing the
devm-allocated at91wdt after it has been freed.
Use timer_shutdown_sync() on both teardown paths. It waits for a running
callback and rejects any attempt by the callback to rearm the timer.
Fixes:
|
||
|
Linus Torvalds
|
6c68fa601b |
for-7.2-rc6-fixup-worker-tag
-----BEGIN PGP SIGNATURE----- iQJPBAABCgA5FiEE8rQSAMVO+zA4DBdWxWXV+ddtWDsFAmp03m0bFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMiwyAAoJEMVl1fnXbVg7fJgP/1IK0RIWKQ0aa7Y8iDis xsJ+Z6qu1vlY/61WGm5s4+Q2orkNBsNl2pNI0EWOt1uKMKmvrfY5V2/fPGolaxFK Kj2Okw77uRCesWDhB+lCp4ldgazvge6OzqoueF5oPYmP22Upf1D3rOlxBPEpuemD k+nFxFQaHP82T5GC55pZ5xS6mE15tIBNv7DjTmQcTmFzGAYjocx+NaoNKcu8v3EX QzfqJa+AWaK2a84sodXwAtCzInD13q0BnofFYwwZ9gGJwJ1m8dC/NqBexA2fa/zF 4Oa5S5BxwTYpghE8iFqM0LMXsaMU9g1z7jXeNT+IQDTNPk9Vom+R4+BeXfANc6rO W2g0zmduzisI14I9XoxPgMTJemCvxa2SLELpWc1wyvG1lHuLEgCHgqMlR/S/Y7TY b+yCdDiDer7NtDV4nuxtsI9ZbF+xSxXI9MOaPMnU9IRk/2eMh0mKorxd1PtTc6rY y2y/pxm3R2w4TZ2L5sB9qIvgWngH+fNJVsprkQF1ZRrlKOHIphXQ9a/hIM3AqRlF b7aWhs/2MJGmZTzVKFSPzKOnxcVuioG08R2SWwXtJrUbQiSQQp2IOriMockJFEtV pyHOcga7+D73eop/oc6GMTGRaeG2A/zBWdzBj7DFqti36lGcaVHewU0ho+P74du9 dnmWDKC+acbp+vdqWPITcCqZ =Ier0 -----END PGP SIGNATURE----- Merge tag 'for-7.2-rc6-fixup-worker-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull Btrfs Fixes 2: Electric Boogaloo from David Sterba: "This brings back the fixup worker infrastructure. It's a mechanism to detect pages/folios that are marked dirty without filesystem knowledge and require COW fixup. The consequence of not doing so is silent data loss. The first patch covers the scenarios in detail, also reflecting folio API port and subpage block size support added in recent years. The original fixup worker was only for pages. The patch is relatively big, half of the code is debugging and support code, the rest is the core design around the detection and fix. The second patch handles an unlikely case when there's work left during unmount" * tag 'for-7.2-rc6-fixup-worker-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: flush the fixup workers during close_ctree btrfs: trigger cow fixup via dirty_folio() |
||
|
Linus Torvalds
|
6335463488 |
for-7.2-rc6-tag
-----BEGIN PGP SIGNATURE----- iQJPBAABCgA5FiEE8rQSAMVO+zA4DBdWxWXV+ddtWDsFAmp01+cbFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMiwyAAoJEMVl1fnXbVg7/cwQAJeUoeAH/B/0vc8sviP/ 0r0LLrGtULDfnmaxtrZf+63DcGOWzhOjddQ60pJwqBO3fWJbGc9+CokI/Kwd8Sj2 rtsYZshH0qOXYSL4hFOGR3ajtrcYUGfM36ZLYyhs1FUN6txv4qOpuxBTKCkG2Q9F acztMvAw2OkPFjQhnNZdP7Z87/kSF0vu4nh3OEJKr4Ih0TzoI92d8JWxB3NWtYbL yvLuF67La+89USQHrO7NgIIVOQew9CvSgty/OWsxgdBHV1yqOleMM+Tpbo4eZa+I PRrEosXfN/dVuOGbCz+vaPuzGLbl3qEMn60CHAxQ3lXRK5KkI7rW9DYkonjd1QCY 0kw6OGH5Dn4GE3/oJQvb/mJDaBC0mYntoZqtMdZ7F3Dm44RzAUy58FV8wRjCFduv MrDsCOEkwsKp0qbVJxwEnEU6WTVbD0W7tTXnt3rOnGFuFSgcvpZUrL5aZQaI4Zj+ iu1WaxAvkGvMLFIxa/8jlSq8u11PSybmzbSSs6rvtVp2Pf2R1E8vIn63tWsPia36 8cnQazI1D1RvUP/U1Gr2dYMRG29xvVc8qy8mhPXUPEAAdB/OTT1MU+VccLQm6Be+ v3PmUIljjBBKG2YYKrNnu9YJ198miN4LpPxjynnBQ+7O53cd/rFwH4QFL9BdyY+i Bn2/Lm/b3gZMZ7NI243akS4b =Nzlf -----END PGP SIGNATURE----- Merge tag 'for-7.2-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - fix leak in encoded ioctl write - disable large folios on systems with highmem - disable block size > page size when there's no transparent hugepage support (under experimental config) - reject compressed inline extents without valid LZO headers - properly initialize cached inode mapping (if block size > page size) * tag 'for-7.2-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: initialize inode mapping flags for cached inodes btrfs: disable bs > ps support if no transparent hugepage support btrfs: fix memory leak in btrfs_do_encoded_write() btrfs: lzo: reject inline extents without valid headers btrfs: disable large folios for systems with highmem |
||
|
Linus Torvalds
|
315f4bd234 |
Including fixes from netfilter.
Looks like our attempt to keep the PRs smaller have only prevented
this one from getting even bigger. In the last 9 days there were
405 postings explicitly tagged with [PATCH net], vs 687
with [PATCH net-next]. 37% of posted patches being fixes is pretty
crazy, and that's likely undercounting because LLM "researchers"
more often post fixes without knowing to tag the patches for specific
trees. I don't have historic data.
In any case, we keep adjusting the criteria. The next PR will be smaller.
Current release - regressions:
- net: defer netdev KOBJ_ADD uevent until the device is published,
previously rtnl_lock would serialize the accesses vs publishing
- net: explicitly cancel work to avoid races with ref tracker exit
- qrtr: ns: raise lookup limit to 128
- eth: hns3: fix speed configuration residue after driver reload
Previous releases - regressions:
- tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss(),
regressed flows with MSS and scaling_ratio variability
- Revert "net: thunderbolt: Enable end-to-end flow control also
in transmit", broke some platforms (no packets coming thru)
- eth: stmmac: resume PHY before hardware setup when opening
the interface
Previous releases - always broken:
- another pile of fixes for less common protocols (SCTP, TLS, SMC etc.)
- close a couple of AF_PACKET bugs and ways it can build skbs
problematic for the rest of the stack
- bridge: mrp: fix uninitialised bytes on the wire
- net: devmem: prevent net-iov / page mixing, avoid crashes
- eth: atlantic: free RX pages of consumed but not refilled buffers
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE6jPA+I1ugmIBA4hXMUZtbf5SIrsFAmp0z8gACgkQMUZtbf5S
Irs6QQ//cpHnTe8YpK7XTLak9zsKXep0ObNybwFeGVtO9ZwpIvUJnW0+DQQOto/f
iaWJd+6kqXo4nOBvJMdMm+xT/xLVVFPscAfnOhi7P4FsHPFecGxP4lsN+Gtn1afL
bgJ92IUTPfM0LZ5vvOxCIFPsUpNvtm0MNk/AacRKedUJf5JrelkHYKBIz8qNCEOR
jwdrlrhUMhAozWX1SmPXO9Hx1cKhx5g5CuZ2vDWkca5ofWkOsUb7sXdC/jdMYsFx
j0JchO8D54Ej5SrO/0z8tojRfPWgmfTlCr3kARu0b70KCV1p2Ep8HnGVGEmMLZGQ
dvTBB4MzLfCZuakC9yNwSLh4nA1ShOvMj02vxgN61vlFiKKhIFWkeW/EtfGx2E9s
XStCg+X1FY0r49oKPu7oF7oUQFRP4QGWNpWP1opVEeOsWNRYgu2ZXmvaHD4862K/
ZylNHnHOu+3Ig+xc+BWFS0T2yi20tGa3LHJgDO3uGwMVlGKKh7tcF0RoyQlalzZg
RNI8T7u6EJFCaJHTToBK/O1ImroiaBBgTCrxHqEWbP6S7Gkx51UHP7sp2Ggp3n0+
pYIQGxWogAtkkNHtap4p6WuCmlMacH/CX32Nwl0v0tjEePxoyRSSc8HlbqSX1Ylv
tJJJJ7t58PS2G4KGhw5H1WGggDuVCcFrwW1bSzHHO+qcz5MoDug=
=wJxf
-----END PGP SIGNATURE-----
Merge tag 'net-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Jakub Kicinski:
"Including fixes from netfilter.
Looks like our attempt to keep the PRs smaller have only prevented
this one from getting even bigger. In the last 9 days there were
405 postings explicitly tagged with [PATCH net], vs 687 with [PATCH
net-next]. 37% of posted patches being fixes is pretty crazy, and
that's likely undercounting because LLM "researchers" more often post
fixes without knowing to tag the patches for specific trees. I don't
have historic data.
In any case, we keep adjusting the criteria. The next PR will be
smaller.
Current release - regressions:
- net: defer netdev KOBJ_ADD uevent until the device is published,
previously rtnl_lock would serialize the accesses vs publishing
- net: explicitly cancel work to avoid races with ref tracker exit
- qrtr: ns: raise lookup limit to 128
- eth: hns3: fix speed configuration residue after driver reload
Previous releases - regressions:
- tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss(), regressed
flows with MSS and scaling_ratio variability
- Revert "net: thunderbolt: Enable end-to-end flow control also in
transmit", broke some platforms (no packets coming thru)
- eth: stmmac: resume PHY before hardware setup when opening the
interface
Previous releases - always broken:
- another pile of fixes for less common protocols (SCTP, TLS, SMC
etc.)
- close a couple of AF_PACKET bugs and ways it can build skbs
problematic for the rest of the stack
- bridge: mrp: fix uninitialised bytes on the wire
- net: devmem: prevent net-iov / page mixing, avoid crashes
- eth: atlantic: free RX pages of consumed but not refilled buffers"
* tag 'net-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (116 commits)
igc: fix netdev not re-attached after resume if interface is down
tls: don't abort the connection on signal-interrupted sends
net: avoid theoretical races with ref drain
net: Defer netdev KOBJ_ADD uevent until the device is published
MAINTAINERS: dpll: zl3073x: replace Prathosh Satish with Min Li
sctp: clear control chunk transport if it is being removed
net/atm: fix slab-out-of-bounds read in vcc_setsockopt()
s390/ism: Fix UAF of sba and ieq during ism_dev_exit()
packet: use consistent hard_header_len in TX_RING send path
packet: use consistent hard_header_len in non-ring send paths
net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
bnge: Fix resource leak in bnge_init_nic() error path
ptp: ocp: Fix board ID over-read
tls: rx: restore msg_iter before TLS 1.3 optimistic retry
selftests: tls: add a test for splicing onto a full plaintext record
tls: don't leave a full plaintext sk_msg ring unpushed
xdp: reject clones that overrun skb_shared_info tailroom
mptcp: reclaim forward-allocated memory on RX path errors
mptcp: fastopen: only mark MPTFO subflows with SYN data
mptcp: pm: fix memory leak from alloc-during-teardown race
...
|