mirror of
https://github.com/torvalds/linux.git
synced 2026-09-14 16:10:02 +02:00
3eb40771c0
1465141 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Linus Torvalds
|
3eb40771c0 |
SoC fixes for 7.2, part 3
These are three last-minute fixes for the 7.2 release, though nothing alarming: - one error handling fix for optee firmware - incorrect i2c data for the apple M3 that was added in 7.2 - a boot time warning fix for nvidia tegra -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmp/kkEACgkQmmx57+YA GNn0sRAAnDh3M8YkrmeGdU4aLCEIFDa+SB4+5OF2ANtjunGy3kUlPj1f9y9Sk7aq CEA2foLgAOThE7anz3VrV5RC+OHBqfe3OD39kMqdlTJlqZNLpVEbqFsyoMr8owAw zpfwDl8n1u9ROjGEyQ7t6QAE512ZLbwZ3wducoQPFGXZfjTpiuF4P00lpXa729xF H+Pb0WOMz3zytIfGKvKx4RWkiH0/xatiLoy0AO+73b2lCQgkJF4bhdkM+G5XAIvG XBhzO488Pu9vuoXpNnY0lizE2xZiJdhBJkR8/Ad0KrTlaLsjwJkF237ozWQ89F8U /00wS8zE9FXsEQNw9uJj7EjW7nKItxTloq3MELjoXbGV7xW5sEsjWZM3xsvFX5rD uJo4laNmjp7LZgTvlOZ9T5HM3XIMes3MNTqa4qx0bmrpxwy8BiaTuED9ugrUAIkv xR2xejKQdFEIEfJRga9YSVbVhF1fDH0dFG+8BVchx6npFWwFRk/RI0JycFGqUul7 8CNXuweWNaVb0Q/zfwWz99pVNqdDySJpAMh4Pl4GKB++jYRvnHU4sCSqDYrkqWRo UGMpZhuXHpwzVWu3B/gPdk2YW/Mo1jfGN6dPFP3JsfdQx1BaUx/2j4ggJn20nTUw v7bBU2i0ljMvNkClCqY8sIfgWDxiI1vsFzabW5o2PRzm8R+jm94= =xgY+ -----END PGP SIGNATURE----- Merge tag 'soc-fixes-7.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC fixes from Arnd Bergmann: "These are three last-minute fixes for the 7.2 release, though nothing alarming: - one error handling fix for optee firmware - incorrect i2c data for the apple M3 that was added in 7.2 - a boot time warning fix for nvidia tegra" * tag 'soc-fixes-7.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: arm64: tegra: Add EL2 virtual timer interrupt for Tegra194 arm64: dts: apple: t8122: Fix I2C resources optee: ffa: Add NULL check in optee_ffa_lend_protmem |
||
|
Linus Torvalds
|
5e060ff9d1 |
OpenRISC fix for 7.2
A bug fix found by researchers.
* Ensure to mask all privileged bits when restoring the supervisor
register from sigreturn.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE2cRzVK74bBA6Je/xw7McLV5mJ+QFAmqABmQACgkQw7McLV5m
J+TL9A/7BmXvg+A5KT0xKxYrC//OCvD5dGwwKVhc5tEtNhpcWZU4fQo9WioRUpcz
OfbBcKN4RGrpm9Do685mqc2+nOGFcK9SId6eN47ri2G1ZJ1+wXE1IVKLIddlpBzp
rBJJyStBAKG2ICQfgoKM26JGbRttH19hJWSDITLzA2vAMp2gxpV7I1tSiLMrbOym
e/fKuclQ2tlH3DX+CJrRia/azeKRMjhlTCsSCH+FQSG+oegtCd6PP+rWi+i7cIas
pdSrDes+ES6LcGncK+uaNQfIi4D9tm37POYOK1zq4cyQknl4yl0mCWzHDegHocM3
EMAeZXgIxWR2sDn/xGl42gXsEjsIxgwUn9eufvAaNNVomFKOE8cVTsTAI7sgOCsj
9eiLLTCAQdGt8wiKYZLfnSm/tkIrtUs+Uc0v1OWslWUN9pVOuhiE5RYVwt6oOgyf
/16K0OFVggElHSyCkk9WPWryER1fg2n/eaOHflyOCO7YaQj9LL2e6TkVae7jQ+re
vZ1ZgNuSO9ZchcemvtQ0gH28sceRy+R2ICQV7ytuR+7Isxk1kQwXuKFhjNkKcy35
pTVFaFY1d/PwrtgUglk45/9ITFLJZNiz4ToE8jrP8P9+DlQhdp7tmZ2gNmtPb3Ll
H0fOU2Bh4QeAQm4T0XDGlm1U2eGA5gy3HFUUNMXomLdNfpT2vIU=
=p9Ll
-----END PGP SIGNATURE-----
Merge tag 'for-linus' of https://github.com/openrisc/linux
Pull OpenRISC fix from Stafford Horne:
"A bug fix found by researchers:
- mask all privileged bits when restoring the supervisor register
from sigreturn"
* tag 'for-linus' of https://github.com/openrisc/linux:
openrisc: signal: do not restore privileged SR bits on sigreturn
|
||
|
Ali Ahmet Memis
|
32ef1b30ad |
openrisc: signal: do not restore privileged SR bits on sigreturn
restore_sigcontext() copies the whole supervision register (SR) from the
signal frame and only clears SPR_SR_SM before the value is reloaded into
the hardware SR (through ESR and l.rfe) on the return to user space. All
other SR bits are left under user control.
An unprivileged task can thus return from a signal handler through a
crafted sigframe that clears SPR_SR_DME. With the data MMU disabled the
CPU performs no translation or protection on data accesses, so the task
gains read and write access to arbitrary physical memory, a local
privilege escalation. SPR_SR_IME, SPR_SR_SUMRA, SPR_SR_LEE, SPR_SR_EPH
and the cache-enable bits are exposed the same way. The ptrace GPR regset
already refuses any change to SR for exactly this reason.
Restore only the arithmetic flag bits (F, CY, OV) from the signal frame
and take every privileged control bit from the SR the kernel saved on
signal entry.
Verified with qemu-system-or1k -M or1k-sim: before this change an
unprivileged PoC clears SPR_SR_DME in rt_sigreturn and writes a marker to
physical address 0x03000000 (beyond the kernel's mem=32M); afterwards the
same PoC receives SIGSEGV and physical memory is unchanged.
Fixes:
|
||
|
Linus Torvalds
|
15ef2f78c4 |
Input updates for v7.2-rc7
- A couple of fixes to the sur40 touchscreen driver to correct registration and teardown ordering, and to fix error path unwinding when video device registration fails. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQST2eWILY88ieB2DOtAj56VGEWXnAUCan/qAgAKCRBAj56VGEWX nIwLAQCryq8oWRzTY1H7QurNDJ89vSwdRJ8CxiLqQgJmWCzgzQD/Vr9SJmWacfn1 TEtDiqHoRSk2wOrZaSDRgsWTH2BOYQI= =RCXW -----END PGP SIGNATURE----- Merge tag 'input-for-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: - A couple of fixes to the sur40 touchscreen driver to correct registration and teardown ordering, and to fix error path unwinding when video device registration fails. * tag 'input-for-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: sur40 - fix V4L error path cleanup Input: sur40 - fix input device registration ordering |
||
|
Linus Torvalds
|
dac3e89a2c |
drm fixes for 7.2 final:
scheduler: - revert fair scheduler patches due to regression - mark fair as experimental connector: - fix OOB read in hdmi audio infoframe log: - fix divide by 0 if module param is set to 0 - fix OOB read on empty message - fix infinite loop for too large scale xe: - Fix DPT Allocation paths - Fixes around UM queue BO - Order ring writes before ring tail updates - Add termination on resume for PXP - Document Sentinel and make CTX_TIMESTAMP read TOCTOU-safe - Fix sync entry leak on OA config emit failure - Check managed mutex initilization errors - Fix min frequency setting - Fix xe_device_probe error path amdgpu: - Bounds checking fix in CS IOCTL - Bounds checking fix in GEM IOCTL - Display fixes - GPUVM fix - ASPM fix - UVD bounds checking fixes - VCE 3 fix - BT.2020 fixes - NBIF 6.3.1 fix - IP discovery fix radeon: - Runtime pm fix amdxdna: - skip attempting to populate unmapped pages -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmp/eCcACgkQDHTzWXnE hr4BoA/7By6sGa+PelN5D3XzzJCHWd8/G/A3TFAFLrtpVK6M84qzNHenGFTNO1SF 3stK9CANA5GmXTudR3UJ4/ZagTde2ZU2hI0tHwOlldRvV91+Ed4lTcr6Kf4xzSnP R+Z3KZ/ggvGpKb628Z7hbwhNBkbkTY4TgotY0vCGK59t1M9Is0b3rMDB9ok7Z9ET B2nQr6UQ/3rb7aoOm0cYik2vTplTI7P1pchq0yKaXwZLNGlmuf556u/t3zsb2+3T E2ouifY82di75Fq+mQFhr4IP9SnFukxeXZw0mkykg2TUlPNRosHHYifdBWZztVLn ZVICunIDuzBb/bSgCeC3qM1nhNW3IBse9xTwpcNIm6zA7qantoCB83t8MPbR6d/C C1NVGcWC89AP7sKT5s15Yzpk7Ink1CJ8GReDV87g0NGFQKCihb4MnW8AkF4nRR5O CZuIwEE3M8MDncDBErL+9K1KmHO5UnIy0FEV3lEgSmoRqgG9m/6BAMwzNXbVU3W4 CwlgcKyeFS23f++GW02OMWJVAp4VV7S7b4pxllL0zoL2ZPQZ827BYwpnKBtiOrJp Sb0U0dIKxgho+nA6R2XvdCZItN0OvjyvQK6OCNYAMtC7XEGboJJ3jBf+rkvgM4jo rpumV+1lI/urWO9rhhg2Ri318N9mWIWqIbmKYPIMrGojG3MiKBw= =rauR -----END PGP SIGNATURE----- Merge tag 'drm-fixes-2026-08-15' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "While this is large for rc8 time but also AI driven fixes is a lot of it, we had a more traditional screw up, and a regression was just found in the fair scheduling patches that went in back in rc1. This reverts the fair scheduler back to an option and sets the default back to what it should have been. We might have been a bit overly zealous in switching over, but at least it feels more normal than the AI driven fixes. Apart from the scheduler, it's mostly amdgpu and xe fixes, with some misc fixes to the log code and connector code. scheduler: - revert fair scheduler patches due to regression - mark fair as experimental connector: - fix OOB read in hdmi audio infoframe log: - fix divide by 0 if module param is set to 0 - fix OOB read on empty message - fix infinite loop for too large scale xe: - Fix DPT Allocation paths - Fixes around UM queue BO - Order ring writes before ring tail updates - Add termination on resume for PXP - Document Sentinel and make CTX_TIMESTAMP read TOCTOU-safe - Fix sync entry leak on OA config emit failure - Check managed mutex initilization errors - Fix min frequency setting - Fix xe_device_probe error path amdgpu: - Bounds checking fix in CS IOCTL - Bounds checking fix in GEM IOCTL - Display fixes - GPUVM fix - ASPM fix - UVD bounds checking fixes - VCE 3 fix - BT.2020 fixes - NBIF 6.3.1 fix - IP discovery fix radeon: - Runtime pm fix amdxdna: - skip attempting to populate unmapped pages" * tag 'drm-fixes-2026-08-15' of https://gitlab.freedesktop.org/drm/kernel: (51 commits) drm/log: Fix infinite loop when scale is too large for display drm/log: Fix out-of-bounds read on empty message length drm/log: Fix division by zero when scale module parameter is 0 drm/xe: Fix xe_device_probe() failure drm/xe: Fix a bug in pc_adjust_freq_bounds() drm/xe/oa: Check managed mutex initialization errors drm/xe/oa: Fix sync entry leak on OA config emit failure drm/xe/lrc: document sentinel and make CTX_TIMESTAMP read TOCTOU-safe drm/xe/pxp: add termination on resume drm/xe: Order ring writes before ring tail updates drm/xe/guc_ads: use uncached mapping for UM queue BO drm/xe/guc_ads: allocate UM queues in VRAM on dGFX drm/xe/guc_ads: allocate UM queues in a separate BO drm/xe: Fix DPT allocation paths. accel/amdxdna: Skip unmapped range in aie2_populate_range() drm/amdgpu: Prefer default discovery offset drm/amdgpu: Reject UVD message with invalid number of h265 refs drm/amdgpu: fix nbif 6.3.1 l1 low power not functional drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix ... |
||
|
Linus Torvalds
|
b26d316aaa |
Fixes for the Qualcomm, Rockchip, and SpacemiT clk drivers
- Keep audio working on Rockchip rk3588 by skipping disabling
unused clks
- Fix SpacemiT USB2 clk data so they actually work and keep the
HDMA bus clk enabled to avoid system hangs
- Avoid clk hangs on Qualcomm Eliza display hardware and revert
a patch that breaks PCIe on some Qualcomm platforms
-----BEGIN PGP SIGNATURE-----
iQJIBAABCAAyFiEE9L57QeeUxqYDyoaDrQKIl8bklSUFAmp/RRMUHHN3Ym95ZEBj
aHJvbWl1bS5vcmcACgkQrQKIl8bklSUNJw/9H0FynE4W1JnI5G4KMWJ5g3DUI+BH
y8r/Z+RiCtuwSx7rnu7rKI8Exsg6P1pT2s6Gj4CZN+xBtjDbVIC3hXty99d2VhC6
VwEvUW2/fxTYT2B0UwUNCjvxboWtVLP10DrvVrFSYF7AhYZhRNrq1XygqfXpCF5E
/v1duwPQoYsFrjCbV9eC55IL6rka7CNk1Yqm5scmGG+musPy9x/RaP1wdQbotSI/
Q/oFkNsRcM1/jo/QDVYCP4cZDPgbc+bfydj0a0dGqknW/PIueGu7dOZUIT/q+RoA
9GIcM4jEkBUHb6IVbDKPXvJClirF3kFKmjm3sAnD38MCbiA2D/pdUK6I5GFS2ieB
I1//j6qG08chWzq94HLKJ5Xpkn/L+R6btErwNmodHPgJ/+JnKJHkWWrNVmxR+Txm
YfDK2bP9fPp3Lj8bUDFAHFpWZHSbSNoGHsDrlkHyTA4qt076KGR0XxQfNMJWiVkz
oqctmn9pUJAX5bFFSlxQVs/vQAO87wIijTrIdrRLbhyHR1gu6rDBB+TvCKFokkvR
087zTihEeumyl2P/SrQl8UCXiJm98869SrvsCbfJ4Xvf0C5wwTejhjoOLJoIAJwC
UOJ1Pdi5XsLTbGXheFofeZy09UPzBWzGRxsXkYh8KGtLxi0kov2PULAPYuTMfwga
hLo5q75jO3OWxVA=
=Vc/s
-----END PGP SIGNATURE-----
Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux
Pull clk fixes from Stephen Boyd:
"Fixes for the Qualcomm, Rockchip, and SpacemiT clk drivers:
- Keep audio working on Rockchip rk3588 by skipping disabling unused
clks
- Fix SpacemiT USB2 clk data so they actually work and keep the HDMA
bus clk enabled to avoid system hangs
- Avoid clk hangs on Qualcomm Eliza display hardware and revert a
patch that breaks PCIe on some Qualcomm platforms"
* tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:
dt-bindings: clock: Replace bouncing emails
Revert "clk: qcom: regmap-phy-mux: Rework the implementation"
clk: spacemit: k3: set hdma clock as critical
clk: spacemit: k3: fix USB2 bus clock
clk: qcom: dispcc-eliza: Fix disp_cc_mdss_mdp_clk_src RCG stall on Eliza EVK
clk: rockchip: rk3588: don't disable unused I2S MCLK output gates
|
||
|
Linus Torvalds
|
06d9a86e02 |
spi: Final fixes for v7.2
A couple of relatively minor (but as ever important if you're hitting them) and straightforward driver specific fixes, plus one new device ID documented in the DT bindings for the DesignWare controller. -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmp/Vl4ACgkQJNaLcl1U h9Af0Af+J2MqcGcVuUFYO6NG9agqkqZkylfW5rPNPeEL63GqPjo2jh1YTaIiOO1X pOvWxt6Ihf0WQF7MD6WJu7N+wWe2nkVR5AIvLe9HzD5xDBYv8xLd3JQi1O4LsrjL /8aINGhuhizY+PSVQXf5mps0POGX8sb5vE9Q12bE6FCxmUgFSRMISs/dCend8qQl p7YWIQkxkpEj5OWX95iG7wz5Yt0d8JGns+1cCdRaibdKKTG6SlfaQNX0vEV7n1Dx tN3aJyOggSNS4ADed1S/pd1cZyv3663fRvYpya5nL84ynFJFKdHZvElo8AjOuUaO up15wJ4SPnabI5wepnVlNCleLluK/Q== =mKW0 -----END PGP SIGNATURE----- Merge tag 'spi-fix-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A couple of relatively minor (but as ever important if you're hitting them) and straightforward driver specific fixes, plus one new device ID documented in the DT bindings for the DesignWare controller" * tag 'spi-fix-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: virtio: mark device ready before registering the controller spi: dw: fix wrong RX_SAMPLE_DLY setting after resume spi: dt-bindings: snps,dw-apb-ssi: Document Axiado AX3005 |
||
|
Linus Torvalds
|
53313bf327 |
regulator: Final changes for v7.2
There's one fix here for a data entry error in the voltage mapping in the fp9931 driver, and a device ID addition for a LDO in the Qualcomm PM8350b that's just a trivial quirk. -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmp/VZAACgkQJNaLcl1U h9BIiwf+OhrDj0zdVbufHV+m1+Nb8EP+UyfHfluhopSJi3dq1tY1P2Z0patUZdhU gHMizes0lq0e1xce5H4W0cqSRJGylVR9NEDYmrO+c7sePKzVWmb0lznSIrQBg6MA fMtaSfRxn1DjR78oms1h2O1qKHxFuHfIF0mKXEKYJKyKa48l3zU782xgXsXIIeXE xB+4j5DVAW4aPROT/BCsJEmfjCwLw7lwf5o1tsfgtgKO520hdJ7L6wlrHnnmSZFr g9YZDb4J9CDwHbbsBc9FCCJZw4u8rXm/fNQkVYF4DFCfodWQqPvdrB25JBYZM+Lf rOabFiJ99+29qn22bhvg80FdFQAwog== =y4W7 -----END PGP SIGNATURE----- Merge tag 'regulator-fix-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "There's one fix here for a data entry error in the voltage mapping in the fp9931 driver, and a device ID addition for a LDO in the Qualcomm PM8350b that's just a trivial quirk" * tag 'regulator-fix-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: fp9931: Fix VPOS/VNEG voltage selector table regulator: qcom-rpmh: Add support for PM8350B regulator: dt-bindings: qcom,rpmh: Add support for PM8350B |
||
|
Linus Torvalds
|
beea256806 |
regmap: Final fixes for v7.2
A couple more fixes for regmap, this time for the SoundWire MBQ support.
- Several drivers omit the readable_reg callback and it's generally
optional in regmap but the MBQ code had an assumption that one was
present added in one of the APIs, remove that.
- The timeout and retry intervals were swapped in read_poll_timeout()
for soundwire-mbq.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmp/VQkACgkQJNaLcl1U
h9B47Qf7BRh4U/G5/UZqHworvgBB+CUqdc/PdEzPlB7u8VmlEDixRID8tvJv4vX5
oG6dduuNnR/Op9SWD91lU0aicFQgeCPArMKYxsl9A4DRJBcYws70897yJgNdIly+
2sdTxpRhl80bL0FIBaUYOMI9Gg0LD/OuudVaLzEwyYde8M+xfQEBFEjRTPbe68Vr
yg/aAVVsefID3P0fGzbNhuiCLbhUT29K5sXxSM+LDtPk2Bz9Rrt8tBiYGtDmTBxj
J6CGe6wF7kLxLW/PPF4/eNMtnU8oGfq/X2L9G57b9q3QwHV8PcrHFKqH5GuXl1wJ
13QpamimMfyqKmcOUF5GqVbyFG7mww==
=jwlB
-----END PGP SIGNATURE-----
Merge tag 'regmap-fix-v7.2-rc7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap
Pull regmap fixes from Mark Brown:
"A couple more fixes for regmap, this time for the SoundWire MBQ
support:
- Several drivers omit the readable_reg callback and it's generally
optional in regmap but the MBQ code had an assumption that one was
present added in one of the APIs, remove that
- The timeout and retry intervals were swapped in read_poll_timeout()
for soundwire-mbq"
* tag 'regmap-fix-v7.2-rc7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
regmap: sdw-mbq: don't call an unset readable_reg callback
regmap: sdw-mbq: Fix swap of timeout and retry times
|
||
|
Linus Torvalds
|
d2ed9eaaf2 |
MMC host:
- atmel-mci: Fix use-after-free in atmci_remove due to race condition
- loongson2: Fix sg iteration in data reorder functions
- omap_hsmmc: Fix busy_timeout overflow in ns conversion on 32-bit
- sdhci: Make tuning_err a signed int
- sdhci: Unmap the bounce buffer before device release
-----BEGIN PGP SIGNATURE-----
iQJEBAABCgAuFiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmp/I6EQHHVsZmhAa2Vy
bmVsLm9yZwAKCRD+JoQlc1iMKfYNEAC51HDTsIkN0SWfsxC0YT1jeo/90MViAoSm
j8HIXfdueeiV6iJcb2g9oYUKvfdstxWd4Q7Nx5rM6vRwOJqc/gPY9sTbSW/wnyqR
LdJoGSxV88dwmnk3Pc2r2SlB9pbNhFGcGime+RQ/Ri2G1pNpu5FDiFLLAI1c/Rko
5s2kuGOn8LHeezZZdVr5mPDq5Ya+SYZkUmPbdqfJO2NdxZm/XGFcV7V/vAqYizCX
UlgjbFtsSJ6lxhW7cG6IcmDZro2i8hxMZhbdip6qsnY9sazgeG7EkWqDBcqGfAhF
VbgXwk2v/kXvIbN0ygpsoUxA1LTw+Xg09h4gXx6EisQkhUJWiLpipZBNMCcezbEl
HtdfYq/omUfA3ZhvxXTJPFuaT3OqSimYHJs7FF0fbAYpVqS49ep6JeVp0zYH6tjH
Y5ydsDYj31e4e+nuBCvibIfhL3vusXGk9ehXO4kboFSe8YVd6rCz6iJYcNFYKq+B
Hif9bY6FORI1//5nnhFGCSNzyysdeO6mVtDvv08/+1JfNmtGEFQQJQmsTv4W51r+
crlONm41WfNaPFgWtNh6cEyNHJk+tVd6FlotiQnKu3QSWu6FG7vuXrRyuVyOzHYb
G5YEwFyQR1iIrgRsAm9YH084tR7pZLmFwcjXSt/LxNnTw4tGq9RjtLxGBH2GsRtt
UnyQXxL3bA==
=Ihe4
-----END PGP SIGNATURE-----
Merge tag 'mmc-v7.2-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc
Pull MMC fixes from Ulf Hansson:
- atmel-mci: Fix use-after-free in atmci_remove due to race condition
- loongson2: Fix sg iteration in data reorder functions
- omap_hsmmc: Fix busy_timeout overflow in ns conversion on 32-bit
- sdhci:
- Make tuning_err a signed int
- Unmap the bounce buffer before device release
* tag 'mmc-v7.2-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
mmc: loongson2: Fix sg iteration in data reorder functions
mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit
mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition
mmc: sdhci: unmap the bounce buffer before device release
mmc: sdhci: make tuning_err a signed int
|
||
|
Linus Torvalds
|
a823c9da52 |
pmdomain providers:
- arm: Don't treat performance state 0 as an error - mediatek: Fix mt8183 hang on boot - mediatek: Fix potential null pointer dereference - mediatek: Prevent using uninitialized data - mediatek: Avoid setting RTFF's CLK_DIS before NRESTORE - qcom: Add missing MXC and MMCX power domains for Eliza -----BEGIN PGP SIGNATURE----- iQJEBAABCgAuFiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmp/IjIQHHVsZmhAa2Vy bmVsLm9yZwAKCRD+JoQlc1iMKcMiEACePh2D5q9HrQfb1R1oRjTLm5ozqmR4SHNj bSJ4doCKlqLkAWR8uxeHGqk0RICnXUmeBWg72y3kp1FhymCWu7tr97/jwTtnmgP1 ztWATvb4IxkmjZE6Z+bhGZWnGiMZa2lITvWYnCzC5++dACQkLTTXlo6nBEk824/w RXw85ph/cnXilaQOH6l3T45uZolCmLJWeq+NqDoKhA5aStUmzO8+zAg53MjRpkR0 vZyemvBtrgO0ojYyI/APA4bUQFicmuZY3sXMjUHzRZNU8BWu4lsH8H8Pe3q2qVbn hUKCZmEkukKWFLyOeOMRibm3pKnEXvNuABcNL1KmyAMM91kXN1dfNaVbXUxS/3/2 /+0T4anwQfyTw0qrUUf68HtqaPrCBo9Pj/oP2BODKMORj9MsY2J1LUBNbGQvxux9 MHeT6v71eve7OV7LcQ9sZk1aM6X03BySVQsBhr5su8XQ6XuGVQqv3tTr1tLamoqd N8e0TRjJIjnqa+hu/bDHCcEIOaFDLlvBxFd9c9uLk+NRT1URDIFCzo16W+l01AYn 2XRAKtBpHNqq+2iQVhvnQIVjaijF3pasmkyUr6IsDm6QfKuI9EyJXBeoeqI0ZyQ3 PsuXhaZumFCigvWChvELMkRyScsb8Czyw0fNP2cLlTb77bL1pdXrq8AjfDCoSjp5 S0CskFrnNg== =oG0O -----END PGP SIGNATURE----- Merge tag 'pmdomain-v7.2-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain fixes from Ulf Hansson: - arm: Don't treat performance state 0 as an error - mediatek: - Fix mt8183 hang on boot - Fix potential null pointer dereference - Prevent using uninitialized data - Avoid setting RTFF's CLK_DIS before NRESTORE - qcom: Add missing MXC and MMCX power domains for Eliza * tag 'pmdomain-v7.2-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev() pmdomain: qcom: rpmhpd: Add missing MXC and MMCX power domains for Eliza pmdomain: arm: Fix -EINVAL from scmi_pd_set_perf_state() on state 0 pmdomain: mediatek: Fix mt8183 hang on boot pmdomain: mediatek: fix remaining %pOF after of_node_put() pmdomains: mediatek: Avoid setting RTFF's CLK_DIS before NRESTORE |
||
|
Linus Torvalds
|
a5161661ae |
sound fixes for 7.2
A handful of small device-specific quirks, regression fixes, and build
fixes. Nothing really stands out.
- Fix for a potential UAF in in USB-audio MIDI2 endpoint handling
- Fix for a mixer regression on SteelSeries Arctis Nova 5 in USB-audio
- ASoC Intel HDMI-In capture, ACPI match table additions and quirks
- ASoC AMD quirk for HyperX OMEN
- Fix for ASoC Xilinx about crash in pcm formatter IRQ handlers
- Fixes for ASoC Realtek rt1320 and rt5645 codecs
- Fixes for ASoC TI tas2781 and tac5xx2-sdw build errors
-----BEGIN PGP SIGNATURE-----
iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmp+2KkOHHRpd2FpQHN1
c2UuZGUACgkQLtJE4w1nLE+2nRAAtyZCuZHuWm8ws01CDmLH5bthPVwgW0iBjnHy
mEAA0dRhwsa2lxICsAzcO8C1a+vSN3hOeQS0d+YzbCnaATj6sXMEPXDyy2NvGTWA
lRcv4HIIloDvm+cKw10jJp6p8v6n6OqP80ME34cq8c8LpLoiFDq31yGYqVekRJ+6
JyHEfyqzUCRY1wiZ9TEBnoU0I6112jWbQWhgsJxI/ZURXSBZM8r/nXfyg2cqUwIw
8P/TVhouXEvGSCdbOP7J2r3AglLBnjCcUiGx27cY9T9CJWt0hLzeYIclkZBAFIJV
l8VsiaenCNS0fHGr7fBF7gZx1WooO2724bdHxZiHmWkxNe5wOuWrqa2j66BjbiQM
EUrqpwZRO2fOg3/f2odw8VMIn+XWdszNIdDs75EoNTUZdb31sw3Ac/U1j0NBb3n2
vgXgDrZf+FSfxJ3V5+jwwrt5S2cliynj6qGMa3dObCoCP8dRKrqQoTdYMW+uMmTj
nn4bR2kjdudCJKqe6myqr9HWz8dK6XnfJbnUkYX0zBiFWrvy1yecwcyd9PEF2311
xdpdDbCXXBHvCjSo33e4wIhwd+F/tdwtonIbBpo893pC4ZTKL27Ba9quXJwu6xxB
R8MYBz7sRRlLG93a9Dixrxjp0tRrL6ZnmkW7D524rqD786D2W6sR8FpCTp4uCBwz
bkmGkgM=
=+V0F
-----END PGP SIGNATURE-----
Merge tag 'sound-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai"
"A handful of small device-specific quirks, regression fixes, and build
fixes. Nothing really stands out.
- Fix for a potential UAF in in USB-audio MIDI2 endpoint handling
- Fix for a mixer regression on SteelSeries Arctis Nova 5 in
USB-audio
- ASoC Intel HDMI-In capture, ACPI match table additions and quirks
- ASoC AMD quirk for HyperX OMEN
- Fix for ASoC Xilinx about crash in pcm formatter IRQ handlers
- Fixes for ASoC Realtek rt1320 and rt5645 codecs
- Fixes for ASoC TI tas2781 and tac5xx2-sdw build errors"
* tag 'sound-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
ASoC: Intel: NVL: Add entry for HDMI-In capture support to non-I2S codec boards.
ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers
ASoC: tac5xx2-sdw: select REGMAP_SOUNDWIRE_MBQ
ASoC: rt1320: run the initialisation preset on the first hardware init
ASoC: rt5645: Perform the initial jack detect at probe
ASoC: Intel: sof_rt5682: Add HDMI-In capture with rt5682 support for NVL.
ASoC: Intel: soc-acpi: Add entry for HDMI_In capture support in NVL match table
ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx
ASoC: tas2781: fix clang build error for goto bypassing cleanup variable
ALSA: usb-audio: Fix mixer regression on SteelSeries Arctis Nova 5
ALSA: usb: Fix UAF at delayed release of MIDI2 EPs
|
||
|
Linus Torvalds
|
c5890ac6d5 |
A handful of tiny fixes, with the main ones being a follow-up for
CEPH_IOC_SET_LAYOUT{,_POLICY} ioctl permissions check that went into
-rc5 and a userspace compatibility fixup. The rest mostly harden
against malformed network input. All marked for stable.
-----BEGIN PGP SIGNATURE-----
iQFHBAABCgAxFiEEydHwtzie9C7TfviiSn/eOAIR84sFAmp/SyQTHGlkcnlvbW92
QGdtYWlsLmNvbQAKCRBKf944AhHzi+OMB/9DOUyMrxqGptG9BhzMmHPIMNE7PI+m
jHh0zEnMsE2rKaYfkLNf/p7RrcvcK4PSMCYZKXSUx0D6n3PoEccDW/JTC/rro5B/
3fZIAaZBg8B25o6b0uGjO29e7BY+WouoNAC6fU9F/DtVTnYp4bk40DsvQS6pvFiN
K2sVLIsSBhDZ7czmVlMlpc/er64TRYnWGmaxaAPMuiW5HEhWxvFDav3/r3gsP/fk
mFJ5QU4qcq/q0QmMW7gO9Q+GXjOK2+9eaplNF3wCOSdHIF2nX5knbvgu5n7a4Qoh
GNf0ak7PfFCzUoRdC/4XkMRQAO9IYgzq45EivApJQKvKmETWrzFLQ1uP
=pOld
-----END PGP SIGNATURE-----
Merge tag 'ceph-for-7.2-rc8' of https://github.com/ceph/ceph-client
Pull ceph fixes from Ilya Dryomov:
"A handful of tiny fixes, with the main ones being a follow-up for
CEPH_IOC_SET_LAYOUT{,_POLICY} ioctl permissions check that went into
rc5 and a userspace compatibility fixup. The rest mostly harden
against malformed network input. All marked for stable"
* tag 'ceph-for-7.2-rc8' of https://github.com/ceph/ceph-client:
ceph: use the mount idmap for the owner checks in the SET_LAYOUT ioctls
ceph: fix MDS random selection readiness predicate
libceph: Avoid using invalid osd indices from primary_temp
libceph: fix OOB read in decode_watchers() via missing bounds check
libceph: fix multiple unsafe decodes in decode_locker()
libceph: tolerate addrvecs with multiple entries of the same type
|
||
|
Linus Torvalds
|
ad8d485e66 |
vfs-7.2-rc8.fixes
Please consider pulling these changes from the signed vfs-7.2-rc8.fixes tag. Thanks! Christian -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCan7RJAAKCRCRxhvAZXjc olPOAP9C1jX75LIMjyoJb9lpVAvCdlrvf0wcD88NXVBylueILAEA6GC8/lVpvUX8 nSFAZojyykVsPitfUdsbLagltXwLqgU= =/Rxi -----END PGP SIGNATURE----- Merge tag 'vfs-7.2-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: - Don't warn when a mount is completed from another user namespace. fsopen() records the caller's user namespace in fc->user_ns and hands back an ordinary file descriptor. The task that calls fsconfig(FSCONFIG_CMD_CREATE) doesn't have to be the one that created the context, and mount_capable() lets it through as long as the caller has CAP_SYS_ADMIN over fc->user_ns, which anyone in an ancestor namespace does. So fc->user_ns != current_user_ns() is something an unprivileged user can arrange. Both overlayfs and binfmt_misc WARN_ON() that. Overlayfs already has the same check as a plain error return in ovl_parse_param(). Drop the WARN_ON() and just refuse. Add selftests for both cases. - Reject pid allocations through dead ancestor pid namespaces. Require PIDNS_ADDING in every namespace that will receive the pid before publishing any of them. That preserves the invariant that free_pid() never decrements pid_allocated in a namespace whose child_reaper is no longer live. The existing ENOMEM behavior is unchanged. * tag 'vfs-7.2-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: pid: reject allocations through dead ancestor pid namespaces selftests/filesystems: test completing a context from another user namespace binfmt_misc: don't warn when the mount is completed from another user namespace ovl: don't warn when the mount is completed from another user namespace |
||
|
Linus Torvalds
|
97a91cc439 |
RISC-V updates for late v7.2-rc
- Fix a fault caused when the RISC-V Zbb-enabled strlen() is executed on a string that ends right before a page boundary, when the next page is unmapped - Fix a race with the misaligned vector performance testing code that can prevent the outcome of the test from being stored into the vDSO cache - Fix a kernel warning generated by the ftrace code when ftrace_modify_call_code() runs against a ftrace-traced function where a kprobe has already been attached. This shows up in the bpf kselftests -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEElRDoIDdEz9/svf2Kx4+xDQu9KksFAmp+hQMACgkQx4+xDQu9 KktD/hAAgVmzmzpnDwAEpENS57aWo9oNp8uihbM9Dlsi/MVzKKrT0AEsJbjifAQQ IBOIca4z+/R4TBxDif/npui/Z3JRsGzCR2iePbjmg1g78j79P3KTEihF2AN+pVnP Syx5lj6ilOMd9vvI7Akigceh+ZxNQ/OMPrfDFQtWHqyiJgy4Iskr9sM2elTsUx65 rEyYzqlHneq8L4GgeAWzzq4jbaWpEanlsGHKQ8WXC3UFdtZI70pFCrRSQ8qHx59k ZkDW280CaAUX52cqUc7W8EBgIXHG0vgfzyJ66NIumKo7eTlU0OXzLz4x41S05hep OEueIcyLMfMus7nfUZD6AeWrp4xJE0UW7aBD0COV9w1+uPJptahla8vH/NPcFLee uMuAP7S3B9Q/h3LlHUIQKIPa4jT1di2piuQZMScJokzjaEV2/xi7pt0N0kG8pHbu t1pc56KswXZzqqqHPHt9lS2NZimCnWw3ZS4mu8WJ/r/qMm7iLt2lSAySGfoCsdXi Eo3Fg2+HQr53ttm9SRUlKv6/iA3VIW60ZCz/n3eTcym7roz6HWqUqiZNmI/m6TW2 M33gGnvxm78+DxXbt5GNbHpbZQOxHM6xEZrmMwiWc4jXqh7IiD03ITMk8dq2ojNi oLm1qrv3Cv8MCXi2i/Hr+8qs+oVYm/Z6Jl7M9BsHEB1WuSPBrtw= =KAg1 -----END PGP SIGNATURE----- Merge tag 'riscv-for-linus-v7.2-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Paul Walmsley: - Fix a fault caused when the RISC-V Zbb-enabled strlen() is executed on a string that ends right before a page boundary, when the next page is unmapped - Fix a race with the misaligned vector performance testing code that can prevent the outcome of the test from being stored into the vDSO cache - Fix a kernel warning generated by the ftrace code when ftrace_modify_call_code() runs against a ftrace-traced function where a kprobe has already been attached. This shows up in the bpf kselftests * tag 'riscv-for-linus-v7.2-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: lib: Fix ZBB strnlen reading past count boundary riscv: hwprobe: Register unaligned probes before usermode riscv: ftrace: Fix ftrace_modify_call failure on kprobed functions |
||
|
Gao Xiang
|
a64d500b00 |
erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms
CONFIG_NR_CPUS doesn't define on some UP platforms (e.g. arm), so this can cause make oldconfig to loop indefinitely when CONFIG_SMP=n: $ make ARCH=arm allmodconfig $ sed -i "/CONFIG_SMP=y/d" .config $ sed -i "/CONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS.*/d" .config EROFS LZMA default maximum decompression streams (EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS) [0] (NEW) EROFS LZMA default maximum decompression streams (EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS) [0] (NEW) ... Let's guard NR_CPUS with SMP instead of using a hardcoded arbitrary CPU uplimit here, similar to commit |
||
|
Dave Airlie
|
b2601e783a |
Driver Changes:
- Fix DPT Allocation paths (Maarten) - Fixes around UM queue BO (Jia) - Order ring writes before ring tail updates (Matthew Brost) - Add termination on resume for PXP (Daniele) - Document Sentinel and make CTX_TIMESTAMP read TOCTOU-safe (Gajendra) - Fix sync entry leak on OA config emit failure (Linmao Li) - Check managed mutex initilization errors (Linmao Li) - Fix min frequency setting (Vinay) - Fix xe_device_probe error path (Raag) -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRskUM7w1oG5rx2IZO4FpNVCsYGvwUCan4Y0QAKCRC4FpNVCsYG vw4gAQD/56NgUmv0Rx3BsDCQhjCMb99DtTGbnEvhehmb6nJ0gQD/eBPPDmobVJYZ P0pGk6B014FrmH+PDjD9Vo2EbswLFQE= =ez0c -----END PGP SIGNATURE----- Merge tag 'drm-xe-fixes-2026-08-13' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Driver Changes: - Fix DPT Allocation paths (Maarten) - Fixes around UM queue BO (Jia) - Order ring writes before ring tail updates (Matthew Brost) - Add termination on resume for PXP (Daniele) - Document Sentinel and make CTX_TIMESTAMP read TOCTOU-safe (Gajendra) - Fix sync entry leak on OA config emit failure (Linmao Li) - Check managed mutex initilization errors (Linmao Li) - Fix min frequency setting (Vinay) - Fix xe_device_probe error path (Raag) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Thomas Hellstrom <thomas.hellstrom@linux.intel.com> Link: https://patch.msgid.link/an4ZogmPqP2Xtfx3@fedora |
||
|
Dave Airlie
|
7581e7c73e |
drm-misc-fixes for v7.3:
- Revert fair scheduler patches and mark fair policy as experimental due to reported regressions. - Fix OOB read in connector/hdmi infoframe. - Handle invalid scaling parameters and empty messages in log target. - Skip attempting to populate unmapped pages in amdxdna. -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEuXvWqAysSYEJGuVH/lWMcqZwE8MFAmp936wACgkQ/lWMcqZw E8MzVA//aKT/DVfDA9dUljxQS70lC17W0a9sf16rpQsftuRxCUci1x2kXJG5sIGa MaKdxmP8PaR0J+xNC/2rGuk2cyKiQxd4BaRnNYXHY4pLG8FbUmSbhWMrICgxj9XE DUBDXzwqjfq7lxXRsKsqARhkn4rHzb9TS84YeQaUZuuwgL2AbDeSEGZkXMTxKCuJ 0sDD8kklVNJKn4ofke5za3KWJ1gIWP/y+kosmi38kG8oZ5M3Uen6JXv/mp0VhMMd UAM+vRUFtWmkYVTsvxC9BXxdo6nqMUWRviXAeHnt6BijuysQ0ZAIuFvnf7/o+Knu NXDABvoZFuFm6pP4t3BSEX2M2RrwczxfvT465UvYaoLwgLutGxwP4AvmWE4vLe32 5pNQLpfllCkxZeOYuxewTEfWLhykxF8wnSeVy9l6II+/OpkPnUjDAFJkDHcaTk+V dPPmPZrOGC/LeLtD7JYbhRX6FkNQzTKNLjXSDjt3w/Sori3nhXkSAuj0zFDM7rHj KAnXh6B4j3vOAbqUEOHmabLqoRmlgpfP30NSyvLc47hMqvHJj+YV9V+5Ay1Yg3Sh otMusvCZY/vpwvVhlFS45XA8k81YdjnxmUqLrQceJS/KGYHt5Qzc1kP2JynjX+D7 /byp/TzTuBnO8cdXaDz58coAEPdoyfGSjH2qVYs4FgeT06ZPOYQ= =Stgd -----END PGP SIGNATURE----- Merge tag 'drm-misc-fixes-2026-08-13' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes drm-misc-fixes for v7.3: - Revert fair scheduler patches and mark fair policy as experimental due to reported regressions. - Fix OOB read in connector/hdmi infoframe. - Handle invalid scaling parameters and empty messages in log target. - Skip attempting to populate unmapped pages in amdxdna. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Link: https://patch.msgid.link/a9b38792-bdd0-42da-a46a-7a048c26c0c2@linux.intel.com |
||
|
Dave Airlie
|
c3da119ddf |
amd-drm-fixes-7.2-2026-08-12:
amdgpu: - Bounds checking fix in CS IOCTL - Bounds checking fix in GEM IOCTL - Display fixes - GPUVM fix - ASPM fix - UVD bounds checking fixes - VCE 3 fix - BT.2020 fixes - NBIF 6.3.1 fix - IP discovery fix radeon: - Runtime pm fix -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQQgO5Idg2tXNTSZAr293/aFa7yZ2AUCanzNKAAKCRC93/aFa7yZ 2BTKAPwO7Y4oJfUq81w8inePMePgjCn1ML/RtKMErD0VTjfwbgD+MxbL1ABHf1Ar wyHayFAnS2mMGc+3wPoOW21E9TnL4w0= =XNgL -----END PGP SIGNATURE----- Merge tag 'amd-drm-fixes-7.2-2026-08-12' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-7.2-2026-08-12: amdgpu: - Bounds checking fix in CS IOCTL - Bounds checking fix in GEM IOCTL - Display fixes - GPUVM fix - ASPM fix - UVD bounds checking fixes - VCE 3 fix - BT.2020 fixes - NBIF 6.3.1 fix - IP discovery fix radeon: - Runtime pm fix Signed-off-by: Dave Airlie <airlied@redhat.com> From: Alex Deucher <alexander.deucher@amd.com> Link: https://patch.msgid.link/20260812200720.2155401-1-alexander.deucher@amd.com |
||
|
Linus Torvalds
|
2f1baf1fc8 |
tracing fixes for v7.2:
- Fix NULL pointer dereference when matching unloaded module wildcard event
The set_event can take events for modules that have not been loaded
yet. This is done by writing '<event>:mod:<module>'.
If '<event>' is not added, then it means to add all events in <module>.
This wildcard is represented by a NULL pointer. If one were to try to
remove the same module item with a named event it would cause a NULL
pointer dereference when comparing the NULL with the name in strcmp().
echo ':mod:kvm' > /sys/kernel/tracing/set_event
echo '!kvm_ack_irq:mod:kvm' >> /sys/kernel/tracing/set_event
The above will do a strcmp("kvm_ack_irq", NULL) and crash the kernel.
Test for NULL (wildcard) before doing the strcmp().
- Fix event data field race in loading two modules at the same time
When a module loads, its trace events get registered. The fields
of the events are also dynamically created and added to the events
fields list. It also will call a function that will look at all the
events for updates that need to be done. If two modules load at the
same time, the one that scans all events and their fields may read
the one being added as the scan doesn't take the event_mutex.
This may cause a data race.
Have the scan take the event_mutex to prevent the race.
-----BEGIN PGP SIGNATURE-----
iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCan438BQccm9zdGVkdEBn
b29kbWlzLm9yZwAKCRAp5XQQmuv6qq6EAPwNoL0MQ5Yk+rRuWIwDj33FFd3Skwe6
DfqVdxVEzCDdzAEArW2usswnZRlOCZddZPUCVj0MWdNz2sVin3p/j0Qklgg=
=W3ej
-----END PGP SIGNATURE-----
Merge tag 'trace-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull tracing fixes from Steven Rostedt:
- Fix NULL pointer dereference when matching unloaded module wildcard
event
The set_event can take events for modules that have not been loaded
yet. This is done by writing '<event>:mod:<module>'.
If '<event>' is not added, then it means to add all events in
<module>. This wildcard is represented by a NULL pointer. If one were
to try to remove the same module item with a named event it would
cause a NULL pointer dereference when comparing the NULL with the
name in strcmp().
echo ':mod:kvm' > /sys/kernel/tracing/set_event
echo '!kvm_ack_irq:mod:kvm' >> /sys/kernel/tracing/set_event
The above will do a strcmp("kvm_ack_irq", NULL) and crash the kernel.
Test for NULL (wildcard) before doing the strcmp().
- Fix event data field race in loading two modules at the same time
When a module loads, its trace events get registered. The fields of
the events are also dynamically created and added to the events
fields list. It also will call a function that will look at all the
events for updates that need to be done. If two modules load at the
same time, the one that scans all events and their fields may read
the one being added as the scan doesn't take the event_mutex. This
may cause a data race.
Have the scan take the event_mutex to prevent the race.
* tag 'trace-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
tracing: Fix race between update_event_fields and, event_define_fields
tracing: Fix NULL pointer dereference in module event cache removal
|
||
|
Michael Wu
|
c3730b8373 |
tracing: Fix race between update_event_fields and, event_define_fields
The following sequence may leads race between event_define_fields()
and update_event_fields():
CPU0 (loads module A) CPU1 (loads module B)
=============================== ===============================
load_module(A) load_module(B)
notifier_call_chain notifier_call_chain
trace_module_notify trace_module_notify
mutex_lock(&event_mutex) trace_event_update_all()
trace_module_add_events(A) down_write(&trace_event_sem)
__register_event(call_A)
__add_event_to_tracers(call_A)
event_define_fields(call_A)
for each f: list_for_each_entry(field,
list_add(&f->link, &class->fields, link)
&class->fields) field = class->fields->next;
Where access to the class->fields is not protected by the event_mutex in
trace_event_update_all().
This produces the following panic:
Unable to handle kernel access ... at virtual address 0000000000000018
pc : update_event_fields+0xf8/0x368
Call trace:
update_event_fields+0xf8/0x368
trace_event_update_all+0x7c/0x2b4
trace_module_notify+0x4c/0x1dc
notifier_call_chain+0x84/0x168
blocking_notifier_call_chain_robust+0x64/0xd4
load_module+0x10c8/0x123c
__arm64_sys_finit_module+0x230/0x31c
Fix by taking event_mutex in trace_event_update_all() before
trace_event_sem.
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Hui Su
|
b69859204d |
tracing: Fix NULL pointer dereference in module event cache removal
A module-only event filter such as ":mod:foo" is cached with a NULL
event_mod->match when foo has not been loaded. If a later write tries to
remove a specific match from the same module, remove_cache_mod() passes
the NULL cached match to strcmp(), causing a NULL pointer dereference.
The issue can be reproduced from userspace:
echo ':mod:trace_events_kunit_missing' > /sys/kernel/tracing/set_event
echo '!foo_bar:mod:trace_events_kunit_missing' >> /sys/kernel/tracing/set_event
The second write must be a concatenation (">>") to not include O_TRUNC as
that would cause ftrace_clear_events() to clear the cached modules lines.
The crash was reproduced on x86_64 QEMU while KUnit workers contended on
the event tracing path:
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor read access in kernel mode
RIP: 0010:strcmp+0x10/0x30
Call Trace:
__ftrace_set_clr_event_nolock+0x373/0x4a0
ftrace_set_clr_event+0xf0/0x180
ftrace_event_write+0xdf/0x110
vfs_write+0xf6/0x440
ksys_write+0x68/0xe0
do_syscall_64+0xf9/0x540
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Check event_mod->match before comparing it, consistent with the existing
NULL checks for the cached system and event fields. The mismatched removal
continues to return -EINVAL; a broad cached module filter is removed with
"!:mod:<module>".
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260811173902.1927376-2-sh_def@163.com
Fixes:
|
||
|
Jasper Wise
|
11058bd3d4
|
spi: virtio: mark device ready before registering the controller
virtio_spi_probe() registers the SPI controller with devm_spi_register_controller(). spi_register_controller() binds a child inline unless its driver has asked for asynchronous probing, so a peripheral that performs a transfer during its own probe reaches virtio_spi_transfer_one(), which kicks the virtqueue before probe has returned. The driver never calls virtio_device_ready(), so DRIVER_OK is set on its behalf by virtio_dev_probe(), only once probe has returned. The virtio spec is explicit about that ordering in 3.1 Device Initialization: | The driver MUST NOT send any buffer available notifications to the | device before setting DRIVER_OK. A device that waits for DRIVER_OK before servicing the queue therefore leaves the transfer unanswered, and virtio_spi_transfer_one() waits for its completion with no timeout, so probe never returns. Mark the device ready before registering the controller, as done for the same reason in commit |
||
|
Mikhail Gavrilov
|
3aa1dcaa4f |
Revert "wifi: mt76: Disable napi when removing device"
This reverts commit |
||
|
Linus Torvalds
|
e14aacefb7 |
There is a known WiFi/mt76 regression, waiting for a complete fix that
should land soonish.
Including fixes from netfilter.
Previous releases - regressions:
- tcp: fix icsk_ack.ato bitfield overflow
- af_unix: Unlink scc_entry in unix_del_edge().
- ipv4: fix use-after-free in fib_nhc_update_mtu()
- netfilter:
- ipset: fix refcount race between list:set GC and swap
- nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
- sched: act_ct: fix sk_buff leak when the header checks reject a packet
- sctp: clear new_transport when removing a peer
- dibs: correct freeing of dmb_clientid_arr
- ovpn: fix NULL dereference when killing missing key
- eth: veth: fix queue index used to wake the peer txq in veth_poll
- eth: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling
- eth: gve: fix zero-length skb frag with header-split
Previous releases - always broken:
- core: fix skb length accounting after generic XDP frag adjustment
- af_packet: don't send zero-byte data in tpacket_snd().
- eth: bnxt: avoid deadlock when canceling IRQ affinity notifier
- eth: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-----BEGIN PGP SIGNATURE-----
iQJGBAABCgAwFiEEg1AjqC77wbdLX2LbKSR5jcyPE6QFAmp93xcSHHBhYmVuaUBy
ZWRoYXQuY29tAAoJECkkeY3MjxOkMMEP/AyjDJBRLMNyKkqY5lEK1ZvPqgaCTWuE
U/A8ZBxveuCmRDCWkEJhQp2bQHuwJsqW9wYmFob8eEEsAmjey7362t3z7OxKuq7x
kL8MOpkSY7MyB1kJBrzNMhBSHtSfbRQ/6vqJApoeXkMYxldi9NKvT1pndVwx1vdZ
G0dVD0dMTR/bWuALfg1aQXAHziACL7eR19eJ/IR9IF2F+Tqi8LgrZpiv0FT9ZU8G
vHeX9P1WpiorU4nnyqpBoNNpam3mTupcXg+ScqSKlkYKUCZV8ILA0rLZijZxXTrK
WbO7VxzAjwoz//GMTHAdnw4m0lsPVpCXGzWm/CIUQ/Z1OO04NXGru6LPOlsgufZ1
LNtbon7+GJ3JWl54/cvBYuDMBaYY+9CW6WdiWdlQuxlaZmixAWpbSxCZuwZMlV9Z
5HRhQfbg1N20zSTNnmKi5o6uwWOWxpQpxIwDkmPlDIpFPX2HtD+gNJ8UqHwIhgcG
j6h2oP2up6PS6NxtWm5+UFXqrwL/0AyI1R5x5hdbOO2rfyfcDDec4eo+qhrOhnkq
uKvBADD4b9zO7hllOz/XQ0uDYfylZlnp4Gx3+6JMYkqeMbk+TmSxrras+g6jnPyk
gTQ9MK2RHoFywDGMiNebDUJAX/fNWxWywzyzuY3izW4B1jho9YGMSLilaJ/xDDQ9
AL7fWaTpvCty
=asb8
-----END PGP SIGNATURE-----
Merge tag 'net-7.2-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Paolo Abeni:
"Including fixes from netfilter.
There is a known WiFi/mt76 regression, waiting for a complete fix that
should land soonish.
Previous releases - regressions:
- tcp: fix icsk_ack.ato bitfield overflow
- af_unix: Unlink scc_entry in unix_del_edge()
- ipv4: fix use-after-free in fib_nhc_update_mtu()
- netfilter:
- ipset: fix refcount race between list:set GC and swap
- nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort
path
- sched: act_ct: fix sk_buff leak when the header checks reject a
packet
- sctp: clear new_transport when removing a peer
- dibs: correct freeing of dmb_clientid_arr
- ovpn: fix NULL dereference when killing missing key
- eth:
- veth: fix queue index used to wake the peer txq in veth_poll
- ngbe: fix NULL pointer dereference in non-MSI-X interrupt
enabling
- gve: fix zero-length skb frag with header-split
Previous releases - always broken:
- core: fix skb length accounting after generic XDP frag adjustment
- af_packet: don't send zero-byte data in tpacket_snd().
- eth:
- bnxt: avoid deadlock when canceling IRQ affinity notifier
- ipvlan: inherit needed_headroom and needed_tailroom from
phy_dev"
* tag 'net-7.2-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (55 commits)
l2tp: fix tunnel and session refcount leak on seq_file release
net/sched: cls_bpf: reject dev-bound programs bound to a different device
sctp: fix use-after-free of cached ASCONF chunk
net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
sctp: clear new_transport when removing a peer
net/dibs: Correct freeing of dmb_clientid_arr
net/sched: cls_u32: skip hash tables in u32_bind_class()
gve: fix NULL dereference due to missing ptp adjfine
gve: fix zero-length skb frag with header-split
net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
af_packet: Don't send zero-byte data in tpacket_snd().
tipc: read le->link under the node lock in tipc_node_link_down()
selftests: tls: cover splice after a failed decrypt
net/tls: Fail tls_sw_splice_read() after a failed async decrypt
net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling
net: tap: fix wrong transport_header when sending VLAN-tagged frame
net: packet: fix wrong transport_header when sending VLAN-tagged frame
vxlan: do not arm the ageing timer on a device that is down
ipv4: fix use-after-free in fib_nhc_update_mtu()
NTB: ntb_netdev: Preserve RX queue depth on allocation failure
...
|
||
|
Linus Torvalds
|
83a4f90e98 |
firewire fixes for 7.2-final
Fix a NULL pointer dereference in 1394 OHCI PCI driver when probe() returns early with an error, as detected by Syzkaller. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQQE66IEYNDXNBPeGKSsLtaWM8LwEwUCan2ycwAKCRCsLtaWM8Lw ExX4APkBTU8zkvG/Gy7oSsFtLZWmy2BXkWxh88PiLkbs2GG3sgEA/x9Y43ysmoM+ OTLeNES8O/tmGjGrq8tZxfYL+AjCCg0= =l4pB -----END PGP SIGNATURE----- Merge tag 'firewire-fixes-7.2-final' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull firewire fix from Takashi Sakamoto: "Fix a NULL pointer dereference in 1394 OHCI PCI driver when probe() returns early with an error, as detected by Syzkaller" * tag 'firewire-fixes-7.2-final' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: firewire: ohci: fix NULL pointer dereference in ar_context_release |
||
|
Linus Torvalds
|
b4f5144d37 |
gpio fixes for v7.2
- use raw_spinlock_t in gpio-ml-ioh to avoid locking context issues - fix a race condition in gpio-ml-ioh by sharing the register locks across channels - fix a use-after-free bug in unbind path in gpio-sloppy-logic-analyzer -----BEGIN PGP SIGNATURE----- iQIyBAABCgAdFiEEkeUTLeW1Rh17omX8BZ0uy/82hMMFAmp9fVYACgkQBZ0uy/82 hMM2bg/4lIfsWQF7GiSs7cgOa/J0DNIo1PZuf2h9cSJYuR10gMBszCVrBrM/qFT0 05MbJGQcaPSW8Zq8QwR+BoaZ20d64iXuipWOkqg53lN5whU28Tm2z2/YFdC/UHAO niXbIstc4d26mm1hc6AwjGV4p6lgzTR2W+IcbkImUAAUQDJX+YE6iasclL2EViz5 fufRQ2VaF159AD5zeNjMxoYRwGlZGAU+qeXwbYDhkt0CBOhAZ0eUhnyQi8zYcnpN OsKmqRplq/tm6jdUjGBoHOFWoXnp4QdukvyEHP/M56WfxyYPOcc9ABCMK45MqpvX b+9eAy0LjQg+38D6geQIP53ZzVKUrbg4NnLItGV8ad6WR9e0t8+xm0c01hKQ9fdw n5R12KMr2OdYjSjq1MAuBbUSRrwBjwdgZuxcE5fo3w0aLYfaVAX9LoFkpuv8WP/U hSUuO9cMxLRnb2ckDVCoazI4lBNuBG2E7si3eodPkFfU6UoiAN8+TQFW3O1AeOnz LDFMnRb3EADMC4LFdnYSUiQRRm0mHnjhLj1BNZ4Rjgd3ZEgfsHv7ez2JNtIyJs5F r7H4XBMH1cthyaIkdXWPoKPyE2AJiEg9g0KyvNTHqp2+ORDtz7o3m11AsXDAjGZm y22YVJUPKUwqVzAabOuoJY872fPQ1N9Zkf9aLrGWNL9MvI+bAw== =Mmpx -----END PGP SIGNATURE----- Merge tag 'gpio-fixes-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - use raw_spinlock_t in gpio-ml-ioh to avoid locking context issues - fix a race condition in gpio-ml-ioh by sharing the register locks across channels - fix a use-after-free bug in unbind path in gpio-sloppy-logic-analyzer * tag 'gpio-fixes-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind gpio: ml-ioh: share the register lock across channels gpio: ml-ioh: use raw_spinlock_t for the register lock gpiolib: Check gc->get_direction() before calling gpiod_get_direction() |
||
|
Linus Torvalds
|
64dc3ba55e |
m68k fixes for v7.2
- m68k: Define NR_CPUS to 1. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQQ9qaHoIs/1I4cXmEiKwlD9ZEnxcAUCan13fAAKCRCKwlD9ZEnx cIo6AP9d3BCY2IMGKEHyeF/W+KUtQ5Abgmpe3IW+aztsxtsZgwD+MR6iM0TIaTg+ e5zlvNICBmIiKHDo3sD1vSssHB3WaQU= =VhE7 -----END PGP SIGNATURE----- Merge tag 'm68k-for-v7.2-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k Pull m68k fix from Geert Uytterhoeven: "Define NR_CPUS to 1. This fixes a long-standing but never critical before oddity on m68k, that turned into a serious configuration issue after a recent erofs change" * tag 'm68k-for-v7.2-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: m68k: Define NR_CPUS to 1 |
||
|
Shixiong Ou
|
f4f2bba28d |
drm/log: Fix infinite loop when scale is too large for display
When scale is large enough that scaled_font exceeds the display
dimensions, rows or columns become 0. A columns value of 0 causes
an infinite loop in drm_log_draw_kmsg_record() because the loop
never decrements len.
Check for zero rows/columns in drm_log_setup_modeset() and return
an error, cleaning up the already allocated buffer to avoid a leak.
Fixes:
|
||
|
Shixiong Ou
|
60baa179ed |
drm/log: Fix out-of-bounds read on empty message length
drm_log_draw_kmsg_record() accesses s[len - 1] to strip the trailing
newline, but len is unsigned int. If len is 0, the subtraction wraps
to UINT_MAX, causing an out-of-bounds read.
Add an early return when len is 0.
Fixes:
|
||
|
Shixiong Ou
|
921ac6cb06 |
drm/log: Fix division by zero when scale module parameter is 0
The scale module parameter can be set to 0 via kernel command line.
When scale is 0, scaled_font_h and scaled_font_w become 0, causing
a division by zero in the rows/columns calculation.
Since the scale module parameter is read-only (0444 permissions), it
cannot be changed at runtime via sysfs. Clamp it to 1 once in
drm_log_register().
Fixes:
|
||
|
Takashi Iwai
|
a92ee0d248 |
ASoC: Fixes for v7.2
This set of fixes is bulked out quite a bit by the inclusion of a lot of quirks for various x86 platforms, though there are a few driver specific fixes in here too. Nothing here is terribly critical, we should be fine waiting for the merge window if it's too much. -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmp9tZ0ACgkQJNaLcl1U h9DXYAf/R1QWsCP/mXjOb7M5A2KNRvOR4uIUDtbQYYRF3jibOEWgcq8eRUH40w/P wHKuCQVKGLyFv7g3yiGjfMccHn/CAcOtUBMarnjFWL9c465LLwNkydJAcEe3K7Vf XUNIMEzj7qq4rbCVouWRm3UuPOQXoPwbJxtsDIjKApPD2ml5dmmL7E5e7aC3m4hf RgVzWn4KUvWvr30EdiCUj/5LleysY+OgEDl8MkDm4ZJb1hcZ2wswkGkx1rILVkjR 2ZsqUl2/HYGhYbMerhsuIfTGN9SSMYgPJ4qAWoPhAmfhZHNCwGYGvMg/1Uo3JjB+ /Wmk4NA0yoW9msrCqmFu9ZNDfAQ54A== =3J8V -----END PGP SIGNATURE----- Merge tag 'asoc-fix-v7.2-rc7' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v7.2 This set of fixes is bulked out quite a bit by the inclusion of a lot of quirks for various x86 platforms, though there are a few driver specific fixes in here too. Nothing here is terribly critical, we should be fine waiting for the merge window if it's too much. |
||
|
Raag Jadav
|
ef526d122b |
drm/xe: Fix xe_device_probe() failure
Currently, xe_device_probe() jumps to err_unregister_display label in case
of failure except for its last call, which directly returns the error
without required cleanup handling. This results in stale drm device that
isn't cleaned up on unwind. Fix it.
[ 810.194180] sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:01.0/0000:01:00.0/0000:02:01.0/0000:03:00.0/drm/renderD128'
[ 810.194183] CPU: 9 UID: 0 PID: 5616 Comm: modprobe Kdump: loaded Tainted: G S U E 7.2.0-rc2-xe #382 PREEMPT(full)
[ 810.194185] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER, [E]=UNSIGNED_MODULE
[ 810.194186] Hardware name: ASUS System Product Name/PRIME Z790-P WIFI, BIOS 1805 10/30/2024
[ 810.194186] Call Trace:
[ 810.194187] <TASK>
[ 810.194188] dump_stack_lvl+0xe0/0x100
[ 810.194195] dump_stack+0x14/0x20
[ 810.194197] sysfs_warn_dup+0x5f/0x80
[ 810.194204] sysfs_create_dir_ns+0xbe/0xd0
[ 810.194210] kobject_add_internal+0xbc/0x2b0
[ 810.194215] kobject_add+0x7c/0xe0
[ 810.194220] ? get_device_parent+0xcf/0x1e0
[ 810.194227] device_add+0xe3/0x870
[ 810.194231] ? __pfx_drm_gem_name_info+0x10/0x10 [drm]
[ 810.194280] drm_minor_register+0x73/0x130 [drm]
[ 810.194322] drm_dev_register+0x76/0x2a0 [drm]
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Vinay Belgaumkar
|
5cf82c8cec |
drm/xe: Fix a bug in pc_adjust_freq_bounds()
In cases where min frequency was actually greater than BMG_MIN_FREQ,
we were not using the updated min frequency as there was a missing
call to pc_action_query_task_state() between the two settings of
min frequency. Since we know what min_freq was last set, use that
cached value while comparing to BMG_MIN_FREQ to fix this issue.
v2: pc->freq_ready is not set until after pc_adjust_freq_bounds(). Stay
with pc_action_query_task_state() instead.
v3: Update commit message (Stuart)
Fixes:
|
||
|
Linmao Li
|
f110dbbfa2 |
drm/xe/oa: Check managed mutex initialization errors
drmm_mutex_init() can fail while registering its managed cleanup action. On failure, the reset path destroys the mutex, so continuing OA setup leaves an unusable lock that later paths may acquire. Return the error from per-GT OA initialization and abort device-wide OA initialization if the metrics lock cannot be initialized. Fixes: |
||
|
Linmao Li
|
8d33c4987c |
drm/xe/oa: Fix sync entry leak on OA config emit failure
xe_oa_emit_oa_config() releases the sync entries and the syncs array
only on its success path. When it fails before the point of no return
(fence allocation, config buffer allocation or batch submission), it
returns without touching stream->syncs.
The stream open path handles such failures in the caller, but
xe_oa_config_locked() propagates the error without any cleanup, so the
syncs array and the fence references held by the parsed entries are
leaked. The next config ioctl overwrites stream->syncs, making the
memory unreachable for good.
Clean up the parsed syncs when xe_oa_emit_oa_config() fails, matching
the cleanup done by the stream open error path.
Fixes:
|
||
|
Gajendra Uttamchand
|
cb4afddf9e |
drm/xe/lrc: document sentinel and make CTX_TIMESTAMP read TOCTOU-safe
Problem: CTX_TIMESTAMP MMIO reads could be stale if a context
switched out between check and read; LRC stores a sentinel while
a context starts that must not be treated as a real timestamp.
Fix: Check the LRC-stored sentinel before and after the MMIO read;
return the LRC value if the context switched out to avoid TOCTOU.
Note: Keep XE_LRC_CTX_TIMESTAMP_ACTIVE in xe_lrc.h as the
canonical sentinel.
Fixes:
|
||
|
Daniele Ceraolo Spurio
|
51afaf53e0 |
drm/xe/pxp: add termination on resume
Suspend/resume causes the PXP keys to become invalid, but doesn't
actually kill the session. The driver also doesn't explicitly kill and
re-start the session until a new PXP request comes in, which means that
the "zombie" session can potentially stick around if there are no new
requests from userspace. While this is not an issue for PXP, HDCP has a
new behavior starting on PTL where a communication is sent to GSC if a
session is active at suspend time (even if it doesn't have a valid key),
which can lead to delays in the suspend flow if we suspend while the
zombie session is still active.
To avoid this, we can trigger a termination on resume and kill the
zombie session immediately, instead of delaying the termination to the
next PXP request. Due to restrictions in the rpm suspend/resume flow, we
can't call the termination flow from within the resume call itself, so
the pxp irq worker is expanded to cover this scenario.
The existing logic in the worker doesn't work as-is for the new flow,
because the pm_get_if_active will fail if the worker runs before the
pci_resume call has completed (which is possible, since we queue it
from within that call) or after we're started to suspend again.
Given that we always want to run the worker after a resume (differently
from the irq case, where we want to skip if we're suspended), we can
solve this by just taking the PM reference before queueing the worker.
As part of this rework, the pxp->events variable has been moved to atomic,
to avoid having to take xe->irq.lock from non-irq related paths.
Fixes:
|
||
|
Matthew Brost
|
9f83c94469 |
drm/xe: Order ring writes before ring tail updates
The ring buffer and the LRC context image are both mapped WC, so the ring
tail update can become visible to the device before the ring contents it
is meant to publish.
The GuC CT send does contain an xe_device_wmb(), so sending the H2G would
flush the ring contents. The problem is that it comes too late:
xe_lrc_set_ring_tail() publishes the tail before the H2G is sent, and the
device samples the tail from the context image independently of it, either
at context switch-in or while the context is already resident. A submitter
which is interrupted between updating the tail and sending its H2G
therefore leaves the device free to observe the new tail while the ring
contents behind it are not yet visible:
1. Thread A emits a job into the ring, sets the tail to T_A and sends
the H2G, which flushes A's ring contents. The GuC starts scheduling
the context in, but it is not executing yet.
2. Thread B emits a job into ring[T_A..T_B]. Those writes are not yet
visible to the device.
3. Thread B updates the ring tail to T_B. That write targets a
different page and becomes visible first.
4. Thread B is interrupted before it sends its H2G, so the flush which
would have published ring[T_A..T_B] has not happened yet.
5. The context is switched in and samples the ring tail from the
context image, picking up T_B rather than T_A.
6. The GPU executes A's job, advances HEAD to T_A, and continues on to
ring[T_A..T_B], which still holds the previous wrap's contents, so
the CS parses stale commands.
The result is command stream corruption, which typically manifests as a
hang or a spurious pagefault rather than anything that points back at the
submission path.
Kernel jobs are by far the most likely to hit this. Kernel queues such as
the migration queue are shared and can be driven by many threads
concurrently, producing back-to-back submissions on an LRC which is
already executing. User queues are typically tied to a single submitting
thread, so the same interleaving is much harder to produce.
Add an xe_device_wmb() at the end of xe_lrc_write_ring() so that it covers
every ring tail publication site, and so the invariant is local: once
xe_lrc_write_ring() returns, the ring contents are visible to the device.
Fixes:
|
||
|
Jia Yao
|
8d5134ae41 |
drm/xe/guc_ads: use uncached mapping for UM queue BO
On Pre-Xe3p platform, the GAM write the UM queue through DPA using UC.
if GuC reads the queue via GGTT (WB), stale data may be observed
when the cacheline has been polluted by another agent.
To match the GAM's UC writes, configure the GuC mapping as UC as well.
Fixes:
|
||
|
Jia Yao
|
f342810a14 |
drm/xe/guc_ads: allocate UM queues in VRAM on dGFX
On iGPU, the UM queue BO is allocated in system memory. On dGFX, the BO
was previously created in system memory and later reallocated in
xe_guc_realloc_post_hwconfig(). Allocate the UM queue BO directly in
VRAM on dGFX, where it is ultimately required.
Fixes:
|
||
|
Jia Yao
|
99b0181595 |
drm/xe/guc_ads: allocate UM queues in a separate BO
Move the UM queues into a dedicated BO (ads->um_queue_bo) and avoid
CPU memset operations on it, which eliminates the CPU as a potential
cacheline-polluting agent and helps maintain consistency between GAM
writes and GuC reads.
We also need to ensure the base_dpa for the queue is contiguous on hw
where this is used instead of a GGTT address. Another good reason to
split this out to a separate BO.
Fixes:
|
||
|
Maarten Lankhorst
|
fc64875790 |
drm/xe: Fix DPT allocation paths.
Remove the fallback for VRAM to system memory, I tested it and that doesn't work at all, only a black screen with pipe fault errors were observed. On systems with media GT, extra latency is added when accessing stolen memory when the GT is in MC6. Since we additionally aren't counting how much memory is used for stolen and we could in theory fill up the entire stolen area with DPT's, avoid using stolen and only use the default memory region. Using stolen may also result in random system hangs under load. Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/7513 Fixes: |
||
|
Aleksandr Nogikh
|
42d217add8 |
firewire: ohci: fix NULL pointer dereference in ar_context_release
During the error handling path of the driver's probe function, a NULL
pointer dereference can occur in ar_context_release().
When pci_probe() fails early (e.g., if pcim_enable_device() or MMIO mapping
fails), the devres cleanup mechanism invokes release_ohci(). This function
unconditionally calls ar_context_release() to clean up the asynchronous
receive contexts. However, if ar_context_init() was not yet called,
ctx->ohci remains NULL (as the fw_ohci structure is zero-initialized by
devres_alloc()).
ar_context_release() immediately dereferences ctx->ohci to get the dev
pointer before checking if the context was actually initialized, leading to
a crash:
Oops: general protection fault, probably for non-canonical address
0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
RIP: 0010:ar_context_release+0x3f/0x380 drivers/firewire/ohci.c:543
Call Trace:
release_ohci+0x3f/0x60 drivers/firewire/ohci.c:3567
release_nodes drivers/base/devres.c:546 [inline]
devres_release_all+0x1a8/0x260 drivers/base/devres.c:576
device_unbind_cleanup drivers/base/dd.c:597 [inline]
really_probe+0x451/0xae0 drivers/base/dd.c:772
To fix this, move the assignment of the dev pointer after the !ctx->buffer
check. If ctx->buffer is NULL, it indicates that the context was never
successfully initialized and there is nothing to release, safely avoiding
the dereference of the uninitialized ctx->ohci pointer.
Fixes:
|
||
|
Eric Dumazet
|
9006c116dd |
l2tp: fix tunnel and session refcount leak on seq_file release
In pppol2tp_proc_open() and l2tp_dfs_seq_open(), iteration state (pd->tunnel and pd->session) is kept in seq_file private data to allow iteration across multiple read() system calls. However, if userspace closes /proc/net/pppol2tp or /sys/kernel/debug/l2tp/tunnels before reading to end-of-file (EOF), any tunnel or session reference stored in pd->tunnel / pd->session is left un-dropped when seq_file private data is freed. Fix this by dropping any remaining pd->tunnel and pd->session references in pppol2tp_proc_release() and l2tp_dfs_seq_release() when closing the file. Fixes: |
||
|
Jamal Hadi Salim
|
120977e2c0 |
net/sched: cls_bpf: reject dev-bound programs bound to a different device
cls_bpf_prog_from_efd() obtained a SCHED_CLS program via
bpf_prog_get_type_dev() but never verified that a device-bound (offloaded)
program's bound netdev matches the TC netdev the classifier is being
attached to. This let a program loaded with prog_ifindex for device A be
attached via cls_bpf + skip_sw to device B; deleting device A then
destroyed the program's offload state while it was still attached to
device B, triggering a netdevsim WARN (panic with panic_on_warn=1).
Mirror the XDP attach path (net/core/dev.c) and reject the attach with
-EINVAL when a dev-bound program's bound device does not match the
target device.
Fixes:
|
||
|
Lizhi Hou
|
6c916e301f |
accel/amdxdna: Skip unmapped range in aie2_populate_range()
aie2_populate_range() incorrectly failed jobs for BOs with multiple
mmaps: if the unmapped entry appeared first in umap_list, the loop would
pick it up, call hmm_range_fault() on a gone VMA, and return -EFAULT
without ever trying the remaining valid mapps.
Fix it by skipping unmapped entries. After the loop, if the map list is
empty or all maps are valid, map_invalid can be cleared normally.
Fixes:
|
||
|
Jakub Kicinski
|
2bb155e921 |
Included fixes:
* release key slot crypto transforms from a workqueue rather than an RCU callback, because crypto_free_aead() may sleep with async or hardware implementations * run all deferred ovpn work on a module-owned workqueue and drain it on module exit, so no work item can still be executing module text after the module is unloaded * finish crypto callback cleanup (key slot release and leftover skb) before dropping the peer reference that gates netdev unregistration and module removal * avoid dereferencing a NULL key slot when userspace asks to kill a key that is not installed on the peer -----BEGIN PGP SIGNATURE----- iJEEABYIADkWIQQr0db7q+Rc7Zog28Fc8QQzwdnOtwUCanjnnRsUgAAAAAAEAA5t YW51MiwyLjUrMS4xMiwyLDIACgkQXPEEM8HZzre4UwEAqIw3zlYNPzJeNRq4GB0b is5pBp/ZWiWIpJjdNSHmtpgA/1/1oBil7ZTdM0KhUCcCR1LHIXLb2sJOFUfhzowc QO4K =qG8X -----END PGP SIGNATURE----- Merge tag 'ovpn-net-20260809' of https://github.com/OpenVPN/ovpn-net-next Antonio Quartulli says: ==================== Included fixes: * release key slot crypto transforms from a workqueue rather than an RCU callback, because crypto_free_aead() may sleep with async or hardware implementations * run all deferred ovpn work on a module-owned workqueue and drain it on module exit, so no work item can still be executing module text after the module is unloaded * finish crypto callback cleanup (key slot release and leftover skb) before dropping the peer reference that gates netdev unregistration and module removal * avoid dereferencing a NULL key slot when userspace asks to kill a key that is not installed on the peer * tag 'ovpn-net-20260809' of https://github.com/OpenVPN/ovpn-net-next: ovpn: defer key slot crypto freeing to workqueue ovpn: run deferred work on a module-owned workqueue ovpn: finish crypto callback cleanup before peer release ovpn: fix NULL dereference when killing missing key ==================== Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260809212142.2249027-1-antonio@openvpn.net Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Yuxiang Yang
|
8c283e7b56 |
sctp: fix use-after-free of cached ASCONF chunk
addip_last_asconf caches the outstanding outbound ASCONF chunk. The normal
ASCONF-ACK completion path releases the chunk and clears the pointer.
However, sctp_asconf_queue_teardown() releases the cached chunk without
clearing addip_last_asconf. During peer restart handling,
sctp_sf_do_dupcook_a() queues SCTP_CMD_PURGE_ASCONF_QUEUE, which invokes
sctp_asconf_queue_teardown() while the association remains alive and leaves
the pointer dangling.
A delayed authenticated ASCONF-ACK can then reach sctp_sf_do_asconf_ack(),
which accesses the stale chunk and passes it to sctp_process_asconf_ack(),
causing a use-after-free and a second release.
Clearing the pointer exposes a race with T4 expiry. Peer restart handling
queues the timer stop before the purge, but SCTP_CMD_TIMER_STOP uses
timer_delete(), which does not wait for a callback already running on
another CPU. Such a callback can reach sctp_sf_t4_timer_expire() after
the purge and dereference NULL.
Clear addip_last_asconf after releasing the cached chunk, and make
sctp_sf_t4_timer_expire() consume a stale T4 expiry if no outstanding
ASCONF remains.
Fixes:
|
||
|
Dmitry Torokhov
|
062dc4693e |
Input: sur40 - fix V4L error path cleanup
In sur40_probe(), if video_register_device() fails, the error path jumps to err_unreg_video. This incorrectly attempts to unregister a video device that was never successfully registered, and fails to free the V4L2 control handler (v4l2_ctrl_handler_free) that was initialized immediately prior. Fix this by introducing an err_free_ctrl label to properly free the V4L2 control handler and bypass video_unregister_device() when video device registration fails. Reported-by: sashiko-bot@kernel.org Cc: stable@vger.kernel.org Assisted-by: Antigravity:gemini-3.5-flash Link: https://patch.msgid.link/20260616051235.1549517-2-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> |