The change referenced by the Fixes tag releases the HIQ SDMA MQD trunk
buffer when device_queue_manager_init() fails after it has been
allocated.
However, the same failure path can also be reached after
init_mqd_managers() has succeeded. At that point dqm->mqd_mgrs[] contains
per-type MQD manager objects owned by the device queue manager. The
normal teardown path frees those objects from uninitialize(), but the
initialization error path only frees dqm itself.
Free the MQD managers from the initialization error path as well. This is
safe for earlier failures because dqm is zeroed when allocated and
init_mqd_managers() clears the entries it rolls back internally.
Fixes: b7cccc8286 ("drm/amdkfd: fix a memory leak in device_queue_manager_init()")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Mukul Joshi <mukul.joshi@amd.com>
Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 1fff2e07b6)
Cc: stable@vger.kernel.org
Allow using multiple SDMA schedulers only on GPUs where
we are allowed to do concurrent VM flushes.
This consideration is necessary because all GART windows
are mapped in VMID 0 (the kernel VMID) so each buffer
entity would flush VMID 0 concurrently.
Practically this means that we can't use multiple SDMA
engines for TTM on GFX6-8 and Navi 1x.
Fixes: 01c836788b ("drm/amdgpu: pass all the sdma scheds to amdgpu_mman")
Fixes: e4029f7a94 ("drm/amdgpu: only use working sdma schedulers for ttm")
Cc: Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer@amd.com>
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit a8171229bc)
There were two mistakes in the previous implementation:
The check for AutomaticDCTransition should be inverted.
We recently learned that the kernel should send
PPSMC_MSG_RunningOnAC when the flag is set, and not the
other way around.
The clocks also need to be recomputed, because the code in
the smu7_apply_state_adjust_rules() function selects
different limits on AC and DC.
Fixes: 96da0d8661 ("drm/amd/pm/smu7: Notify SMU7 of DC->AC switch")
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 516f8fc30a)
Cc: stable@vger.kernel.org
AMD Ryzen Pinnacle Ridge (Zen+, family 0x17 model 0x08) CPUs have
PCI controllers that don't support PCIe dynamic speed switching,
causing system freezes during GPU initialization when enabled.
Disable dynamic speed switching when this CPU is detected.
Assisted-by: Claude:sonnet
Fixes: 466a7d1153 ("drm/amd: Use the first non-dGPU PCI device for BW limits")
Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5436
Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
Link: https://patch.msgid.link/20260709031520.841611-1-mario.limonciello@amd.com
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 9ceb4e034a)
Cc: stable@vger.kernel.org
We need the fence to reemit the gds switch or spm update
after a queue reset.
Fixes: a17ef94121 ("drm/amdgpu: rework ring reset backup and reemit v9")
Cc: timur.kristof@gmail.com
Cc: christian.koenig@amd.com
Reviewed-by: Timur Kristóf <timur.kristof@gmail.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit bc639a9ead)
Cc: stable@vger.kernel.org
There were two mistakes in the previous implementation:
The check for ATOM_PP_PLATFORM_CAP_HARDWAREDC should be
inverted. We recently learned that the kernel should send
PPSMC_MSG_RunningOnAC when the flag is set, and not the
other way around.
The clocks also need to be recomputed, because the code in
the si_apply_state_adjust_rules() function selects different
limits on AC and DC.
Fixes: 2d071f6457 ("drm/amd/pm/si: Notify the SMC when switching to AC")
Tested-by: Jeremy Klarenbeek <jeremy.klarenbeek99@gmail.com>
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 358dd0a9ce)
Cc: stable@vger.kernel.org
When DPM is turned off with the amdgpu.dpm=0 module parameter,
the thermal work queue isn't initialized so we shouldn't
schedule any work on it.
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit bd018d3617)
On DCE8-class ASICs (e.g. Bonaire), the resource pool contains digital
DIG stream encoders plus one analog DAC encoder. When assigning a stream
encoder for a second DisplayPort MST stream, if the preferred digital
encoder is already acquired, dce100_find_first_free_match_stream_enc_for_link()
falls back to the first free pool entry. That entry may be the analog
encoder, whose funcs table lacks DP hooks such as dp_set_stream_attribute.
The subsequent atomic commit then dereferences NULL function pointers in
link_set_dpms_on() and crashes.
Skip encoders without dp_set_stream_attribute when the stream uses a DP
signal (including MST). Use dc_is_dp_signal(stream->signal) for the MST
fallback path instead of checking only the link connector signal.
Tested on:
- GPU: AMD Radeon R7 260X (Bonaire / DCE8)
- Board: Supermicro C9X299-PG300
- Setup: DP MST daisy chain, hotplug second monitor or have it connected on boot
- Kernel: 7.1.3 (issue observed since 6.19)
- Result: kernel oops without patch; dual monitors stable with patch
Signed-off-by: Andriy Korud <a.korud@gmail.com>
Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5162
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 28ec64943e)
Cc: stable@vger.kernel.org
Always set native cursor mode when the CRTC is disabled,
to make sure it doesn't cause atomic commits to fail when
they are trying to disable the CRTC.
Fixes: 41af6215cd ("drm/amd/display: Reject cursor plane on DCE when scaled differently than primary")
Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5432
Cc: Leo Li <sunpeng.li@amd.com>
Cc: Michel Dänzer <michel.daenzer@mailbox.org>
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Tested-by: Viktor Jägersküpper <viktor_jaegerskuepper@freenet.de>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 2f79f0130f)
Cc: stable@vger.kernel.org
The old radeon driver has a documented workaround in ci_dpm.c
which claims that Bonaire 0x6658 with old memory controller
firmware is unstable with MCLK DPM, so as a precaution I
disabled MCLK DPM on this ASIC in amdgpu.
Note that the old MC firmware is not actually used with
amdgpu, but in theory it's possible that the VBIOS sets
up the ASIC with an old MC firmware that is already running
when amdgpu initializes (in which case amdgpu doesn't
load its own firmware).
What I expected to happen is that the GPU would simply use
its maximum memory clock, and indeed this is what seemed
to happen according to amdgpu_pm_info which reads the
current MCLK value from the SMU.
However, some users reported a huge perf regression
and upon a closer look it seems that the GPU seems to
not actually use the highest MCLK value, despite the SMU
reporting that it does.
Let's not disable MCLK DPM on Bonaire 0x6658 (R7 260X).
Keep MCLK DPM disabled on R9 M380 in the 2015 iMac
because that still hangs if we enable it.
Fixes: 9851f29cb0 ("drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs")
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit d34acad064)
Cc: stable@vger.kernel.org
When compiling the AMDGPU display driver for 32-bit architectures,
the linker reports undefined reference to `__udivdi3` in functions
get_dp_dto_frequency_100hz() and dcn401_get_dp_dto_frequency_100hz().
This is because the code uses 64-bit division (/) on 32-bit systems,
which GCC cannot handle directly and instead tries to call the missing
__udivdi3 helper function.
Replace the raw division with div_u64(), the kernel's standard 64-bit
division helper, to avoid the link error.
Signed-off-by: Linlin Yang <yanglinlin@kylinos.cn>
Reported-by: k2ci <kernel-bot@kylinos.cn>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 0421fc6ab3)
Cc: stable@vger.kernel.org
Currently the contents of IBs are abruptly cut off and don't
show the full contents. This patch makes sure to reserve
space for those contents too so they may be printed.
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Acked-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 4e2c082150)
Cc: stable@vger.kernel.org
These are in the dmesg logs but are missing from devcoredumps.
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit fed7aa36d7)
Cc: stable@vger.kernel.org
amdgpu_acpi_vfct_bios() fetches the VFCT table with acpi_get_table()
but never releases it. acpi_get_table() takes a reference on the
table (incrementing its validation_count and mapping it on the 0->1
transition); without a paired acpi_put_table() the mapping is leaked
on every call, whether or not a matching VBIOS image is found.
Route all exit paths after the table is acquired through a common
acpi_put_table(). The VBIOS image is copied out with kmemdup() before
the table is released, so it remains valid for the caller.
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Link: https://patch.msgid.link/20260708193518.702584-3-mario.limonciello@amd.com
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit ca5988682b)
Cc: stable@vger.kernel.org
On systems where PCI bus renumbering occurs (e.g. pci=realloc,
resource conflicts), the runtime bus number may differ from the
BIOS POST bus number recorded in the VFCT table. This causes
amdgpu_acpi_vfct_bios() to fail finding the VBIOS even though
the correct device entry exists.
Introduce amdgpu_acpi_vfct_match() which treats the bus number
as a soft filter: vendor/device/function identity is the hard
requirement, while exact bus match is the preferred path. When
bus numbers disagree but device identity matches, accept the
VFCT entry and log a dev_notice for diagnostics.
Reported-by: Oz Tiram <oz@shift-computing.de>
Closes: https://lore.kernel.org/amd-gfx/20260621173211.28443-1-oz@shift-computing.de/
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Link: https://patch.msgid.link/20260708193518.702584-2-mario.limonciello@amd.com
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 11c1416720)
Cc: stable@vger.kernel.org
amdgpu_bo_create_reserved() only allocates a new BO when
*bo_ptr (struct amdgpu_bo **bo_ptr as input parameter) is
NULL, it simply skips creation when *bo_ptr is non-NULL.
But it unconditionally reserves, pins, gart allocates
and maps the BO afterwards.
When the same non-NULL BO pointer is passed in again,
for example firmware buffers that live in adev and are
re-loaded on every resume / cp_resume / start
under AMDGPU_FW_LOAD_DIRECT, amdgpu_bo_pin() just increases
pin_count unconditionally, however the matching teardown only unpins
once, so pin_count never drops to zero, so TTM is not able
to move, swap or evict a BO, causing BO leaks.
This commit fixes this issue by only pinning the bo
once at creation, and repeated calls no longer
take additional pin references.
Signed-off-by: Zhu Lingshan <lingshan.zhu@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 3ddc0ae762)
Cc: stable@vger.kernel.org
pre_reset only force-completes fences of MAPPED queues. A queue in any
other state (e.g. mid-eviction) keeps its last_fence pending; after a
GPU reset that fence never signals, so the eviction/suspend worker and
process teardown (amdgpu_evf_mgr_flush_suspend) wait on it forever and
wedge the machine:
INFO: task kworker/6:28 blocked for more than 120 seconds.
Workqueue: events amdgpu_eviction_fence_suspend_worker [amdgpu]
Call Trace:
dma_fence_wait_timeout+0x7e/0x130
amdgpu_userq_evict+0x67/0x140 [amdgpu]
amdgpu_eviction_fence_suspend_worker+0xd8/0x160 [amdgpu]
process_scheduled_works+0xa6/0x420
Force-complete every queue's fence regardless of state. The unmap and
mark-hung step stays gated on MAPPED, since unmapping a queue that is
not mapped is invalid.
Fixes: 290f46cf57 ("drm/amdgpu: Implement user queue reset functionality")
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 9102b39fa9)
Cc: stable@vger.kernel.org
set_pipe_unlock_order needs to be set to true for the pipes to be unlocked
in correct order to avoid det overallocation
Reviewed-by: Charlene Liu <charlene.liu@amd.com>
Signed-off-by: Dmytro Laktyushkin <dmytro.laktyushkin@amd.com>
Signed-off-by: George Zhang <george.zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 183bbded99)
set_pipe_unlock_order needs to be set to true for the pipes to be unlocked
in correct order to avoid det overallocation
Reviewed-by: Taimur Hassan <syed.hassan@amd.com>
Signed-off-by: Dmytro Laktyushkin <dmytro.laktyushkin@amd.com>
Signed-off-by: George Zhang <george.zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 198663d035)
[Why]
FWTS autobrightness fails on eDP panels because actual_brightness can
read higher than the advertised max_brightness (e.g. 63576 vs 62451).
The conversion helpers expose the firmware PWM range to userspace as
[0..max]. But max_brightness is advertised as (max - min), which is
smaller. So reading the level can return a value above max_brightness.
This regressed in commit 4b61b8a390 ("drm/amd/display: Add debugging
message for brightness caps"), which changed max_brightness to
(max - min) and undid commit 8dbd72cb79 ("drm/amd/display: Export full
brightness range to userspace").
[How]
Advertise max_brightness as max, and scale the initial AC/DC brightness
against max too. Update the KUnit expectations to match.
Fixes: 4b61b8a390 ("drm/amd/display: Add debugging message for brightness caps")
Reviewed-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: George Zhang <george.zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit bd9e2b5b04)
Cc: stable@vger.kernel.org
[why]
The 8K120/8K240 timings live in DisplayID extension blocks 2 and 3
of this EDID. The EDID is a 4-block (512-byte) HDMI 2.1 EDID
that uses HF-EEODB.
drm core reads and parses this correctly, but amdgpu rebuilds its own copy.
Only 2 of 4 blocks were copied into sink->dc_edid, that leads to
drm_edid_connector_add_modes() never sees blocks 2 and 3.
[how]
Directly populate edid_blob_ptr with a blob whose length is the full,
and HF-EEODB-aware size.
Reviewed-by: Sun peng (Leo) Li <sunpeng.li@amd.com>
Signed-off-by: Fangzhi Zuo <Jerry.Zuo@amd.com>
Signed-off-by: George Zhang <george.zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 11a90eaf5c)
No functional changes. Just clean up a conceptual mismatch.
Based on feedback on the NUTMEG code in DC, the
preferred_link_setting is meant to force the DP link to a
specific setting, meaning both the link rate and lane count
should be locked to an exact value. What NUTMEG needs is
a lower bound on the link rate, which is not the same concept.
Implement this as a HW workaround flag instead.
Suggested-by: Wenjing Liu <wenjing.liu@amd.com>
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 871ceb8538)
Cc: stable@vger.kernel.org
When there is a preferred link rate setting, it needs to be
applied to both the current and initial link rate.
This was regressed by a "coding style" fix, which caused
the current link rate to not respect the preferred value.
This commit restores the functionality of NUTMEG,
the DP bridge encoder found on old APUs such as Kaveri.
Fixes: a62346043a ("drm/amd/display: Fix coding style issue")
Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5465
Cc: Chuanyu Tseng <Chuanyu.Tseng@amd.com>
Reviewed-by: Fangzhi Zuo <Jerry.Zuo@amd.com>
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit e78b0a367f)
Cc: stable@vger.kernel.org
total_cwsr_size was computed in 32-bit before being used as a BO/SVM
allocation size.
With large ctx_save_restore_area_size and debug_memory_size
multiplied by the XCC count, the product can wrap,
yielding an undersized CWSR save area that firmware later overruns.
Promote total_cwsr_size to u64 and use check_add_overflow()/
check_mul_overflow() in both kfd_queue_acquire_buffers() and
kfd_queue_release_buffers().
Signed-off-by: Yongqiang Sun <Yongqiang.Sun@amd.com>
Reviewed-by: Philip Yang <philip.yang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 319f7e1342)
Cc: stable@vger.kernel.org
[why]
DCN42B is missing some register masks, which are causing errors in dmesg.
[how]
Make DCN42B reuse the DCN42 register lists, and add the missing defines manually.
Fixes: 64142f9d51 ("drm/amd/display: Fix DCN42 null registers & register masks")
Reviewed-by: Ovidiu (Ovi) Bunea <ovidiu.bunea@amd.com>
Signed-off-by: Matthew Stewart <Matthew.Stewart2@amd.com>
Signed-off-by: George Zhang <george.zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit b7d6914590)
GC 11.7.0 and 11.7.1 should map to AMDGPU_FAMILY_GC_11_5_4 for DCN42.
Fixes: cf591e67c0 ("drm/amdgpu: add support for GC IP version 11.7.0")
Fixes: a928d8d81e ("drm/amdgpu: add support for GC IP version 11.7.1")
Signed-off-by: Roman Li <Roman.Li@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit f8ee6447e7)
on plane disable) along with couple of GT selftests fixes.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEbSBwaO7dZQkcLOKj+mJfZA7rE8oFAmpadygACgkQ+mJfZA7r
E8prkQf/anrvKC+XNFx1PHSBwHiuzuCDCCGm+M4guTs1WxUi0m9yAhD7YWKXnC8r
8j2SUB3Vcm6rEYTEspd+BktN3WdGFymDQ+LTuxZNb84pm0fkpHat0VlX7RBib373
OgaiDK0odXWedPoaOglGMmTY0KS6BMuBFFZMHdFfoK06fjkeZO18aFw+eyh9NBLH
CqZkbMygXBRKUfAT81V2+IUKeiTQ5DZTjTrysx9ywA7+6l6zlH85B0c3bGGZHQE1
YzQVnRbqStMfCdkzJ1Tj9RLA6iygCcRrA7taOwIep5plDCA0x7j7ZKWSNvePcmQJ
YSaZ7wr/wUdyl5aPsSyBZQ0dGBIb6w==
=Y8Vk
-----END PGP SIGNATURE-----
Merge tag 'drm-intel-fixes-2026-07-17' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes
Couple of display fixes (NV12 for bigjoiner and Watermark clear
on plane disable) along with couple of GT selftests fixes.
Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Rodrigo Vivi <rodrigo.vivi@intel.com>
Link: https://patch.msgid.link/alp3ks0K1ZsxUC05@intel.com
- Fix a UAF in socket clone early bailout paths (Matt Bobrowski)
- Reject unhashed UDP sockets on sockmap update to prevent refcount leaks
(Michal Luczaj)
- Account for receive queue data in FIONREAD on sockmap sockets without a
verdict program (Mattia Meleleo)
- Reject negative constant offsets for verifier buffer pointers (Sun Jian)
- Fix for tracing of kfuncs with implicit arguments (Ihor Solodrai)
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQR0/74CM8h5+1E9pgtHLTd7Y1QvgwUCalp3/AAKCRBHLTd7Y1Qv
g9J/AQCJzidAmStp1i074sZC7sC1uq+aYIvwycpMTp6hVgyP+AEAw7oKcnGkPGXs
jeEDctaLtxBnPMXGAR5UaeqdNqu9ywQ=
=zQgn
-----END PGP SIGNATURE-----
Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf
Pull bpf fixes from Kumar Kartikeya Dwivedi:
- Fix a UAF in socket clone early bailout paths (Matt Bobrowski)
- Reject unhashed UDP sockets on sockmap update to prevent refcount
leaks (Michal Luczaj)
- Account for receive queue data in FIONREAD on sockmap sockets without
a verdict program (Mattia Meleleo)
- Reject negative constant offsets for verifier buffer pointers (Sun
Jian)
- Fix for tracing of kfuncs with implicit arguments (Ihor Solodrai)
* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
selftests/bpf: Cover tracing implicit kfunc args
bpf: Fix tracing of kfuncs with implicit args
selftests/bpf: Cover negative buffer pointer offsets
bpf: Reject negative const offsets for buffer pointers
selftests/bpf: Test FIONREAD on a sockmap socket without a verdict program
bpf, sockmap: Account for receive queue in FIONREAD without a verdict program
selftests/bpf: Fail unbound UDP on sockmap update
selftests/bpf: Adapt sockmap update error handling
bpf, sockmap: Reject unhashed UDP sockets on sockmap update
selftests/bpf: Ensure UDP sockets are bound
bpf: Fix UAF in sock clone early bailouts
-----BEGIN PGP SIGNATURE-----
iQJIBAABCgAyFiEES0KozwfymdVUl37v6iDy2pc3iXMFAmpaXtgUHHBhdWxAcGF1
bC1tb29yZS5jb20ACgkQ6iDy2pc3iXPAGxAAyCWrUecMqUOJTSYbTl5hjRqR6w9U
+h1hfFaiukGgEokG9qrFBR7MTgei0ybcyt2d/Mn8r2Mz1C0kK4tBjtT8ho1tqVZD
5ANfti4ffhw6H83ZHRf5h18vwNXldHjBsEwjthySRYwlK2KsV4tW/+WFCStdWzCH
TOpUShUlkIMvibNbKf6vvqk75jP/SCZLpjsRBD+gdRSkXqcFLLqXrK+FiAw4NKXE
z7nRc0KK161eT4GM+KPBYkC9hE6+PntamYL10nDgrz1r3hp/B2Wx66bO36NR7XvA
5omsa/hJW7aXoQtXTxlf2+AuhYKjig+KYdxhidU8jKVXc16fUn4UmeUZJRvoDQKW
ryjPALVnbBIrw/e+nDYV0wsJD6q8xAE3LuIQIMir661ZMtf7umdmm6G1anyhKYHe
oLgjKyOiaGaY9WeW+g+bO29pmcpnmPPyiNI2KRkLsfgeCB2JKECDLyjZboCNjWGV
ykdmt3kXndlaEwpmxvJBFCb4WlB2mKpCz6HxgNhM2jPu5X4MwS6fkrvIlBNHcdTg
o2Sz5cuQLcnpD9A91AhKmKdxNYNeT7H4KlMm8x/8vRHNQbmi72WE7kkuEj09augt
qeO8kbeq7dm13wY72MzNOQXwiNtmeCUDPwehud86Hqg0iZDDyB2RGWtn14AWQhGb
Kmpyx9QglgeUEyc=
=4P+L
-----END PGP SIGNATURE-----
Merge tag 'selinux-pr-20260717' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux
Pull selinux fix from Paul Moore:
"A single SELinux patch to correct a problem with the overlayfs mmap()
and mprotect() fixes from earlier this year where we inadvertenly
included an additional SELinux execmem permission check on some
operations"
* tag 'selinux-pr-20260717' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
selinux: fix incorrect execmem checks on overlayfs
- Fix a build error in certain configurations
- Clarify some parts of the documentation
- Remove unused code that I forgot to remove in commit cf52058dcd
-----BEGIN PGP SIGNATURE-----
iIoEABYIADIWIQSacvsUNc7UX4ntmEPzXCl4vpKOKwUCalpR7hQcZWJpZ2dlcnNA
a2VybmVsLm9yZwAKCRDzXCl4vpKOK0FsAP4g1ERoX/xslpz++c9GQPK3QhXGjug5
B1nGMnqDJPQmewD/eAloShBc5VYxnCeDDN24txP2RZeRK9XSG/mGTsdv2wk=
=Dtak
-----END PGP SIGNATURE-----
Merge tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux
Pull crypto library fixes from Eric Biggers:
- Fix a build error in certain configurations
- Clarify some parts of the documentation
- Remove unused code that I forgot to remove in commit cf52058dcd
("lib/crypto: powerpc/md5: Drop powerpc optimized MD5 code")
* tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux:
crypto: aes - Fix conditions for selecting MAC dependencies
lib/crypto: docs: Improve introduction sentence
lib/crypto: docs: Fix some sentence fragments
lib/crypto: md5: Remove support for md5_mod_init_arch()
io_install_bpf() only rejects a second registration on the ctx side
(ctx->bpf_ops) and sets the per-map back-pointer ops->priv
unconditionally. The struct_ops link path never advances a map past
BPF_STRUCT_OPS_STATE_READY, so the same io_uring_bpf_ops map can be
registered more than once, and bpf_io_reg() re-resolves the target ring
via fget(ops->ring_fd) on every call. A caller can therefore point the
same ring_fd at a different io_ring_ctx between two BPF_LINK_CREATE
calls.
The second registration passes the ctx->bpf_ops check (the new ctx has
none) and overwrites ops->priv, orphaning the first ctx. Teardown
(io_eject_bpf()/bpf_io_unreg()) only reaches a ctx through ops->priv, so
the orphaned ctx is never torn down: its ctx->loop_step keeps pointing
into the struct_ops trampoline, which is freed once the map is gone. A
later io_uring_enter() on the orphaned ring then calls the dangling
ctx->loop_step from io_run_loop() -- a use-after-free of freed
executable memory, reachable by a task with CAP_BPF + CAP_PERFMON.
Reject registration when ops->priv is already set, as hid_bpf_reg()
does for its struct_ops.
Cc: stable@vger.kernel.org
Fixes: 98f37634b1 ("io_uring/bpf-ops: implement bpf ops registration")
Signed-off-by: Woraphat Khiaodaeng <worapat.kd2@gmail.com>
Reviewed-by: Gabriel Krisman Bertazi <krisman@suse.de>
Reviewed-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://patch.msgid.link/20260717154537.129736-1-worapat.kd2@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
- the revert of the uclinux map driver which was presumably no longer
used but in fact was
- the use of SPI match data to get chip capabilities in the mchp23k256
driver
- several fixes addressing the newly introduced virt-concat support
- a missing build dependency on ndfc
There is as well the usual load (if not actually bigger than ususal) of
uninitialized variables, leaks, double free, and AI fuzzed issues being
fixed.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEE9HuaYnbmDhq/XIDIJWrqGEe9VoQFAmpaTeQACgkQJWrqGEe9
VoQ0/Af7BpZ9gxFZrgiXBdQ/XcVDfsrP7YP/3D3SLlB7ynwPHrq0YvMdBs8CCp+b
YbTDqBrt0+T1YeZ4igWu50bGSjAz0mLztE2r09/uwrG9YO+B0s98jXRFEqnaOMMf
2ghhrIKr2RB9OPJaigmtdzQij1UAjCIFpWxEz4XLytXQ5oxnzP2j50JyeVxifb1R
3KDw0KBibngn3I5MUQ4OHCg4+6Krf0rtjo8yZWB6LKgVlCcy3eEbYGZMn3YI3T6T
xsOa8KxkBLf2BeAFu2nDp0e/5vEfaVk9fCnRElBDz3kEdJ6LR6k45mLpqfB+U9HN
DhWZswONu0y54xHAmyauVWyYBK/DHg==
=SD+E
-----END PGP SIGNATURE-----
Merge tag 'mtd/fixes-for-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux
Pull mtd fixes from Miquel Raynal:
"Among the most important fixes that we have here, there are:
- the revert of the uclinux map driver which was presumed to
be no longer used but in fact was
- the use of SPI match data to get chip capabilities in the
mchp23k256 driver
- several fixes addressing the newly introduced virt-concat
support
- a missing build dependency on ndfc
as well as the usual load (if not actually bigger than usual) of
uninitialized variables, leaks, double free, and AI fuzzed issues
being fixed"
* tag 'mtd/fixes-for-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux:
Revert "mtd: maps: remove uclinux map driver"
mtd: onenand: samsung: report DMA completion timeouts
mtd: rawnand: fsl_ifc: return errors for failed page reads
mtd: mchp23k256: use SPI match data for chip caps
mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout
mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout
mtd: fix double free and WARN_ON in add_mtd_device() error paths
mtd: virt-concat: free duplicate generated name
mtd: nand: mtk-ecc: stop on ECC idle timeouts
mtd: mtdswap: remove debugfs stats file on teardown
mtd: mtdpart: validate partition bounds in mtd_add_partition()
mtd: mtdpart: fix uninitialized erasesize on MTDPART_OFS_RETAIN error path
mtd: rawnand: ndfc: add CONFIG_OF dependency
mtd: spinand: initialize ret in regular page reads
mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy()
mtd: rawnand: ingenic: handle ECC clock enable failures
mtd: nand: ecc-mtk: handle ECC clock enable failures
mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy_joins()
mtd: rawnand: ndfc: fix gcc uninitialized var
- Fix RPMB device unregister ordering
- Fix __counted_by handling in mmc_test
MMC host:
- mtk-sd: Document missing clocks for MT8189
- sdhci-esdhc-imx: Fix the support for system suspend/resume for SDIO
- sdhci-of-dwcmshc: Fix error handling for clock prepare/enable
- vub300: Fix lockdep issue for the cmd_mutex
- vub300: Fix use-after-free on probe failure
MEMSTICK:
- Reject a card that reports too many blocks
-----BEGIN PGP SIGNATURE-----
iQJEBAABCgAuFiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmpaF4YQHHVsZmhAa2Vy
bmVsLm9yZwAKCRD+JoQlc1iMKQsXEAC4Y3DuRvuYUi3MVeAI8IqXZKW1qZ2Wg7pD
tvjbS0h1ZLVBPXeWIhjL2N9Y2GWIzbq5Yb0zAyqwl4d99IsNL5j0ul6rQbVWHY6Z
48IJ8idboGeUXZ9foUif8t+gZOVUd6Mecf8GxWkJcwlJ70pt36TCGWPvp3/MkQmP
w6srlDXfIZgQyauQIz+cHYcocD0L7vp6apAcT/QQRLadY4PBpzNfjjgbqr5ogejF
ovRkTUBp2D/ufTV0p8V0ykQ9onac7aV1HrX1ubSjs/2rkxNMOBGRYTeds8YYm4Of
Jljdivx0EeLA638sJ7XO6QGbxT7pwwffRzS+q6VE+NilKghwF3/GE1LPv8NSV+mA
woeSxPCgVxfqF+THGQE9J8NQXtIV6UF7gNHVSp+Vq/aKuykSwnRslUbu7mncgDZC
nv2cwcmlVU98IKDNVFNNMCkMbaEyifWzaxR6gX2Xlo+Qo6n3A/Qz6bSjw5LTkIyg
sAx0jmSKWbgpRZl4eYO16DKDwOkGW5zDEhjxQqtRBcyxv7Yndgl+lcP/fPR0oVCT
/gyZOEsFg3ItfUCW5nMnTRWZ6u8D7tSXXVXaqs8b4HB8Nj7jX2WHfkrmT0+i8oMu
eGXITNNOWp827RZHX1uxzoBMQXfHVIZq8FVECAcrCxnzQz4E5zpP3JKTzz9ydpe6
VG49Xs+JsA==
=IHdC
-----END PGP SIGNATURE-----
Merge tag 'mmc-v7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc
Pull MMC fixes from Ulf Hansson:
"MMC core:
- Fix RPMB device unregister ordering
- Fix __counted_by handling in mmc_test
MMC host:
- mtk-sd: Document missing clocks for MT8189
- sdhci-esdhc-imx: Fix the support for system suspend/resume for SDIO
- sdhci-of-dwcmshc: Fix error handling for clock prepare/enable
- vub300:
- Fix lockdep issue for the cmd_mutex
- Fix use-after-free on probe failure
MEMSTICK:
- Reject a card that reports too many blocks"
* tag 'mmc-v7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
mmc: sdhci-esdhc-imx: fix resume error handling
mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend
mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend
mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt
mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume
mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore
mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume
mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore
mmc: block: fix RPMB device unregister ordering
memstick: ms_block: reject a card that reports too many blocks
dt-bindings: mmc: mtk-sd: Document extra clocks for MT8189
mmc: vub300: defer reset until cmd_mutex is unlocked
mmc: vub300: fix use-after-free on probe failure
mmc: mmc_test: Fix __counted_by handling after kzalloc_flex() conversion
mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method
There are only three devicetree fixes this time: one critical memory
corruption fix for Renesas and three minor corrections for Tegra.
The MAINTAINERS file is updated for a new maintainer of the CIX platform
and two address changes.
The rest is all driver fixes, mostly firmware:
- multiple runtime issues in ARM SCMI and FF-A firmware code, dealing
with error handling for corner cases in firmware.
- multiple fixes for reset drivers, dealing with individual platform
specific mistakes and more error handling
- minor build and runtime fixes for the Tegra SoC drivers
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmpaP90ACgkQmmx57+YA
GNlLkBAAiObAyuy5l4MxvbKmYz60DpPLigpJdHJxBk3xr4cB3+QO8hFxVQ9mJvJD
bfSTq3c0fjHdoBBl20/YjAwimkDvgzSkIDVNMRpOeK32ME7QbsTA5lpoGiDDiFfS
VtZ/RWTH2TyejKU0gUwBZhH7UogFBPmUleefOLc2aPGG+1tZSmbQFmK0eFXt+fvP
Wo0aPrDg0hs+KBq2UK2jN/ir9F50qIvYGDnz3m6t0aZzXfbWM0JQ8t59WlVl8cbq
FOLpqE7CjEXu+sUW0xRvJ88D25JtL7sa5oFI4cELzJKnrnb/hPHZ5TN484AeGMGO
pDb+4jT04xV6YdCowNSYf6FHYXD2yJAGU1N39DKZkPRRh9nkcjxsQKl8uGtgV8sO
YI+Wj5sGKaLDNWDQc75ew0s17S75/WsIijGfp04XsLRxDoup6NiENiOvsZL+ERc+
5BHzJ/KUF58sLK097vKYhX6DWFqKX5O44i7kB5HqZUKC8SbekQ5ZwqsEFGKneNYW
Nu73fzgDeKQRMyJ+Y6hYnDXdWjTZPLQMcMniJm3FXUvPdJNPSgJd6W3Vej+Ww4gN
vF/t7/qPJl333HIK0hmKD8xh4Vkk3JvmAPMStjfRkW3yAWY2MpTbnJkLyoIDiuoM
F0vSvAg4RLbC2SWqC+IeEY9rRMgMOVisrnuJIM09l5DwAiPof/k=
=BN00
-----END PGP SIGNATURE-----
Merge tag 'soc-fixes-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
Pull SoC fixes from Arnd Bergmann:
"There are only three devicetree fixes this time: one critical memory
corruption fix for Renesas and three minor corrections for Tegra.
The MAINTAINERS file is updated for a new maintainer of the CIX
platform and two address changes.
The rest is all driver fixes, mostly firmware:
- multiple runtime issues in ARM SCMI and FF-A firmware code, dealing
with error handling for corner cases in firmware.
- multiple fixes for reset drivers, dealing with individual platform
specific mistakes and more error handling
- minor build and runtime fixes for the Tegra SoC drivers"
* tag 'soc-fixes-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:
arm64: dts: renesas: ironhide: Describe inline ECC carveouts
MAINTAINERS: Update maintainer and git tree for CIX SoC
ARM: Don't let ARMv5 platforms select USE_OF
MAINTAINERS: Update SpacemiT SoC git tree repository
firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context
firmware: arm_scmi: Use 64-bit division for clock rate rounding
reset: imx7: Correct polarity of MIPI CSI resets on i.MX8MQ
reset: sunxi: fix memory region leak on ioremap failure
dt-bindings: reset: altr: add COMBOPHY_RESET for Agilex5
reset: spacemit: k3: fix USB2 ahb reset
firmware: arm_scmi: Grammar s/may needed/may be needed/
firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()
firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits
arm64: tegra: Fix CPU1 node unit-address on Tegra264
arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234
MAINTAINERS: .mailmap: update Jens Wiklander's email address
soc/tegra: fuse: Fix spurious straps warning on SMCCC platforms
soc/tegra: pmc: fix #ifdef block in header
drm/tegra: Fix a strange error handling path
arm64: tegra: Remove fallback compatible for GPCDMA
- Enable CONFIG_VPA_PMU to be used with KVM
- Initialize starttime at boot for native accounting
- Set CPU_FTR_P11_PVR for Power11 and later processors
- fix memory leak on krealloc failure in papr_init
- Misc fixes and cleanups
Thanks to:
Amit Machhiwal, Christophe Leroy (CS GROUP), Ethan Nelson-Moore, Gautam
Menghani, Harsh Prateek Bora, Junrui Luo, Mukesh Kumar Chaurasiya (IBM), Ritesh
Harjani (IBM), Rosen Penev, Shrikanth Hegde, Thorsten Blum, Yuhao Jiang
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEqX2DNAOgU8sBX3pRpnEsdPSHZJQFAmpZtKcACgkQpnEsdPSH
ZJSzpxAAvEWlybs7IZWdkZA74GCb1LXXElqANbhUpkl/bNuV2LDaxb5v63FIhTuu
tqFISwJ86+wodsKH6vyMk1dGGxbphXl4AOUcNQVRlA6C4EWJBiMtukhn6AFmi294
crEXLCY91w5a5ftvu2Bvvn6DaJwCmjxzDw3pZ9MWDgwe3drKtb9/HPyC3IKSFAWo
f00sw7r9WqBxnvJaHzPi+NpUdTP/DB86TzH9IKxq7jQtGainj978Ghy9KIm68Eb+
kqET9ecytynNw0wSbIn2O1WXSw9Axg038bwoIXnpUc6MSmSLrgTeFuEuugcyH1cJ
yor/FHeeImfGTaUgtjjJr1yRgRHe7TC1PiHjgKk4dko6X9PXiP+6kxyY+kQGGTqx
+e2R1lXC1YS/V1fGOd2yEep/7ThrCto6wCKqwg45B/la9tjUfwb8oGfR0SVTT2ZS
u1j3z154bz8sv3a2H3Dx5tslDeSPPCcA1sElTT9Ir+/ppZZjt2gzGAPFCb0OSOAA
WyjmK9bM0Fp//jL+PpARBSsfQmvqnllgKqBLTZ0Y/btnJPMra7ptalkhs/Dtx8W1
8IkLc56C/s5nPaU0BcF/LtJfLENETzq/EPV1YRiNDHykALp3yFOaOk0CJtEteLk4
mmWbb9P7SbsmEijXtDptt62Lv0YWSoS5OCRfOLHV/Q4VYd1JN+w=
=jI4x
-----END PGP SIGNATURE-----
Merge tag 'powerpc-7.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux
Pull powerpc fixes from Madhavan Srinivasan:
- Enable CONFIG_VPA_PMU to be used with KVM
- Initialize starttime at boot for native accounting
- Set CPU_FTR_P11_PVR for Power11 and later processors
- fix memory leak on krealloc failure in papr_init
- Misc fixes and cleanups
Thanks to Amit Machhiwal, Christophe Leroy (CS GROUP), Ethan
Nelson-Moore, Gautam Menghani, Harsh Prateek Bora, Junrui Luo, Mukesh
Kumar Chaurasiya (IBM), Ritesh Harjani (IBM), Rosen Penev, Shrikanth
Hegde, Thorsten Blum, and Yuhao Jiang
* tag 'powerpc-7.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
powerpc: Remove dead non-preemption code
powerpc/dt_cpu_ftrs: Set CPU_FTR_P11_PVR for Power11 and later processors
powerpc/pseries: fix memory leak on krealloc failure in papr_init
powerpc/uaccess: correct check for CONFIG_PPC_E500 in mask_user_address()
powerpc/vtime: Initialize starttime at boot for native accounting
powerpc/85xx: Add fsl,ifc to common device ids
powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()
powerpc/pseries/Kconfig: Enable CONFIG_VPA_PMU to be used with KVM
On CONFIG_INET=n builds, mpls_valid_fib_dump_req() walks the parsed
attribute table itself instead of calling ip_valid_fib_dump_req(). The
RTA_OIF arm passes tb[RTA_OIF] to nla_get_u32() without checking it is
present, so an RTM_GETROUTE dump for AF_MPLS with strict checking and no
RTA_OIF hits a NULL dereference.
RTM_GETROUTE is RTNL_KIND_GET, which rtnetlink_rcv_msg() permits without
CAP_NET_ADMIN, so an unprivileged user can trigger it.
Oops: general protection fault, probably for non-canonical address
0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: 0010:mpls_valid_fib_dump_req (net/mpls/af_mpls.c:2189)
Call Trace:
mpls_dump_routes (net/mpls/af_mpls.c:2236)
netlink_dump (net/netlink/af_netlink.c:2331)
__netlink_dump_start (net/netlink/af_netlink.c:2446)
rtnetlink_rcv_msg (net/core/rtnetlink.c:7033)
netlink_rcv_skb (net/netlink/af_netlink.c:2556)
netlink_unicast (net/netlink/af_netlink.c:1345)
netlink_sendmsg (net/netlink/af_netlink.c:1900)
__sock_sendmsg (net/socket.c:790)
____sys_sendmsg (net/socket.c:2684)
___sys_sendmsg (net/socket.c:2738)
__sys_sendmsg (net/socket.c:2770)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Skip unset attributes, as ip_valid_fib_dump_req() does.
Fixes: 196cfebf89 ("net/mpls: Handle kernel side filtering of route dumps")
Assisted-by: Claude:claude-opus-4-8
Reported-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20260711114958.1009619-3-bestswngs@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
llc_sap_add_socket() takes a SAP reference for each socket added to a SAP,
and llc_sap_remove_socket() releases it. llc_create_incoming_sock() takes
an additional SAP reference after adding the child socket.
This extra reference was balanced by an explicit llc_sap_put() in
llc_ui_release() until commit 3100aa9d74 ("llc: fix SAP reference
counting w.r.t. socket handling") removed that put. The corresponding hold
in the accept path was left behind.
When such a child socket is removed, only the reference taken by
llc_sap_add_socket() is released. The extra reference keeps the SAP alive
after its last socket is removed. Remove the obsolete hold.
Fixes: 3100aa9d74 ("llc: fix SAP reference counting w.r.t. socket handling")
Cc: stable@vger.kernel.org
Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
Link: https://patch.msgid.link/20260712130343.518797-1-xuanqiang.luo@linux.dev
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
The "mac" bind mode reactivation downs the interface, restores the saved
MAC and renames it to trigger a target resume. This assumes the recreated
interface comes back with a different MAC, which is true under
MACAddressPolicy=none (as on the Netdev CI) but not when MACs are
persistent. In the persistent case netconsole resumes the target on its
own, and the down/restore/rename flow instead drops it and fails the test.
Guard the block on the MAC having actually changed so the test passes
under both policies.
Fixes: 6ecc08329b ("selftests: netconsole: validate target resume")
Reported-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Closes: https://lore.kernel.org/netdev/f398373e-2cb4-4649-a491-9763df94d98b@kernel.org/
Signed-off-by: Andre Carvalho <asantostc@gmail.com>
Tested-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Reviewed-by: Breno Leitao <leitao@debian.org>
Link: https://patch.msgid.link/20260710-netcons-mac-reload-v1-1-3fb1bcc70b4a@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
bnxt_aux_devices_init() calls auxiliary_device_init() before all fields
used by bnxt_aux_dev_release() are initialized. After
auxiliary_device_init() succeeds, later errors must unwind with
auxiliary_device_uninit(), which invokes the release callback.
The release callback assumes that aux_priv->id, aux_priv->edev,
edev->net and edev->ulp_tbl are all populated. If allocation fails
after auxiliary_device_init(), the release path can otherwise dereference
or clear partially initialized state.
Allocate and attach the bnxt_en_dev and ULP table before calling
auxiliary_device_init(), so the release callback only sees a fully
initialized auxiliary private object. If auxiliary_device_init() itself
fails, free those allocations directly because device_initialize() has not
run and the release callback will not be invoked.
This issue was found by a static analysis checker and confirmed by manual
source review.
Fixes: 194fad5b27 ("bnxt_en: Refactor bnxt_rdma_aux_device_init/uninit functions")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
Link: https://patch.msgid.link/20260711163716.3996929-1-ruoyuw560@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
The auth_hmacs array in struct sctp_cookie is supposed to store a complete
SCTP_AUTH_HMAC_ALGO parameter, which consists of a struct sctp_paramhdr
followed by N HMAC identifiers.
However, the array size was calculated using an extra 2 bytes instead of
sizeof(struct sctp_paramhdr), which is 4 bytes. When four HMAC identifiers
are configured, the HMAC-ALGO parameter stored in the endpoint is larger
than the auth_hmacs buffer in the cookie.
As a result, sctp_association_init() copies beyond the end of auth_hmacs
when initializing the association, corrupting the adjacent auth_chunks
field. This can lead to an invalid HMAC identifier being accepted and later
cause an out-of-bounds read in sctp_auth_get_hmac().
Fix the array size calculation by including the full SCTP parameter header
size.
Fixes: 1f485649f5 ("[SCTP]: Implement SCTP-AUTH internals")
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Xin Liu <dstsmallbird@foxmail.com>
Reported-by: Zihan Xi <xizh2024@lzu.edu.cn>
Reported-by: Ren Wei <enjou1224z@gmail.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/634a0de0d5de29532915e6d47c92a0cbc206e03f.1783707155.git.lucien.xin@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
When a dpll_pin is shared across multiple dpll_device instances and
those devices are being unregistered (e.g. during driver module removal),
a NULL pointer dereference can occur in dpll_msg_add_pin_ref_sync().
This happens under the following conditions:
- A pin is registered with two or more dpll devices (dpll_A, dpll_B)
- The pin has ref_sync pairs with other pins
- During unregistration of dpll_A's pins, a ref_sync partner pin is
unregistered first, removing it from dpll_A->pin_refs
- But since the partner pin is still registered with dpll_B, its
dpll_refs is not empty, so dpll_pin_ref_sync_pair_del() does NOT
run and the partner stays in the pin's ref_sync_pins xarray
- When the pin itself is then unregistered from dpll_A, the delete
notification calls dpll_msg_add_pin_ref_sync() which finds the
partner in ref_sync_pins, passes dpll_pin_available() (partner is
still registered with dpll_B), but dpll_pin_on_dpll_priv(dpll_A,
partner) returns NULL because partner was already removed from
dpll_A->pin_refs
- The NULL priv pointer is passed to the driver's ref_sync_get
callback, which dereferences it
BUG: kernel NULL pointer dereference, address: 0000000000000034
Oops: Oops: 0000 [#1] SMP NOPTI
RIP: 0010:zl3073x_dpll_input_pin_ref_sync_get+0x73/0x80 [zl3073x]
Call Trace:
dpll_msg_add_pin_ref_sync+0xb8/0x200
dpll_cmd_pin_get_one+0x3b6/0x4b0
dpll_pin_event_send+0x72/0x140
__dpll_pin_unregister+0x5a/0x2b0
dpll_pin_unregister+0x49/0x70
Fix this by skipping ref_sync pins whose priv pointer cannot be resolved
for the current dpll device.
Fixes: 58256a26bf ("dpll: add reference sync get/set")
Signed-off-by: Ivan Vecera <ivecera@redhat.com>
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Link: https://patch.msgid.link/20260710193625.1378822-1-ivecera@redhat.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Release the TIME_WAIT socket reference and jump to discard_it
upon PSP policy failure in both IPv4 and IPv6 receive paths.
This prevents a memory leak of tcp_tw_bucket structures.
Fixes: 659a2899a5 ("tcp: add datapath logic for PSP with inline key exchange")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Daniel Zahka <daniel.zahka@gmail.com>
Link: https://patch.msgid.link/20260710181317.4060230-1-edumazet@google.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Workloads that repeatedly allocate and release mkeys carrying TPH
steering-tag hints (e.g. churning RDMA MRs) leak one
struct mlx5_st_idx_data per cycle; kmemleak flags it as unreferenced
and the kmalloc slab grows over time.
When the last reference to an ST table entry is dropped,
mlx5_st_dealloc_index() removed the entry from idx_xa but the backing
mlx5_st_idx_data allocation was never freed.
Free idx_data after the xa_erase() so the lifetime of the bookkeeping
struct matches the lifetime of the ST entry it tracks.
Cc: stable@vger.kernel.org
Fixes: 888a7776f4 ("net/mlx5: Add support for device steering tag")
Reviewed-by: Michael Gur <michaelgur@nvidia.com>
Signed-off-by: Zhiping Zhang <zhipingz@meta.com>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/20260702222507.1234467-1-zhipingz@meta.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-----BEGIN PGP SIGNATURE-----
iIkEABYKADEWIQSl+MghEFFAdY3pYJLMOmT6rpmt0gUCaljFDxMcbWtsQHBlbmd1
dHJvbml4LmRlAAoJEMw6ZPquma3ScvEBAMN4/7N+Es+yBfeHYu2A+6b+5qeW+4Px
WtxSffc9OxxtAP9H/UhgxnZdzgCalXipwZGjwSKgm87vPU8H1GDKlX3LBw==
=EJTl
-----END PGP SIGNATURE-----
Merge tag 'linux-can-fixes-for-7.2-20260716' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can
Marc Kleine-Budde says:
====================
pull-request: can 2026-07-16
this is a pull request of 19 patches for net/main.
The first patch is by Alexander Hölzl and fixes the Kconfig
description of the vxcan driver.
Next patch by Fan Wu fixes the tear down order in the esd_usb driver.
Followed by a patch by Oliver Hartkopp that adds missing locking for
the raw flags in the CAN_RAW protocol.
Shuhao Fu's patch for the j1939 protocol fix lockless
local-destination check.
Stéphane Grosjean updates their email address.
The next 11 patches all target the CAM Broadcast Manager protocol. One
contributed by Lee Jones the remaining ones by Oliver Hartkopp. They
fix several concurrency and locking issues found by various bots.
The last 3 patches are also by Oliver Hartkopp fixing concurrency and
locking issues found by various bots in the CAN ISO Transport
Protocol.
linux-can-fixes-for-7.2-20260716
* tag 'linux-can-fixes-for-7.2-20260716' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can:
can: isotp: serialize TX state transitions under so->rx_lock
can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER
can: isotp: use unconditional synchronize_rcu() in isotp_release()
can: bcm: track a single source interface for ANYDEV timeout/throttle ops
can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()
can: bcm: fix stale rx/tx ops after device removal
can: bcm: add missing device refcount for CAN filter removal
can: bcm: validate frame length in bcm_rx_setup() for RTR replies
can: bcm: extend bcm_tx_lock usage for data and timer updates
can: bcm: add missing rcu list annotations and operations
can: bcm: fix CAN frame rx/tx statistics
can: bcm: add locking when updating filter and timer values
can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure
can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF
can: peak: Modification of references to email accounts being deleted
can: j1939: fix lockless local-destination check
can: raw: add locking for raw flags bitfield
can: esd_usb: kill anchored URBs before freeing netdevs
can: vxcan: Kconfig: fix description stating no local echo provided
====================
Link: https://patch.msgid.link/20260716155528.809908-1-mkl@pengutronix.de
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-----BEGIN PGP SIGNATURE-----
iQJdBAABCABHFiEEgKkgxbID4Gn1hq6fcJGo2a1f9gAFAmpRAaIbFIAAAAAABAAO
bWFudTIsMi41KzEuMTIsMiwyDRxmd0BzdHJsZW4uZGUACgkQcJGo2a1f9gAQJw/+
Kj3gIsC+IWVsyF4zVvQrYlNkE6SELujsS7OkzY2voyaMS2waA2awl2Wep7G5Z6B7
o36vez8ajnMCvGzfJKOtLgo2H32qxW4XzRuJVROlHRgSpJjASVTP9WREK4pCmfJr
cU/D8YujTMxoEcdaIjDgjKyDogMtfbEyUqbiguLuym9NEX4izXXMv9tfWlFfWDtH
RhmDV25WXLTa/h1Iz7rl2m1FPZ48oB7VOaar0seIPYF+kQ+tVr0CsSnfx22uHfoj
H2g8ahfjjDhyPJTraDjQbdyenW5TzZ3ZzoBpwlpRynbKwKgLqnFdCBtG/vdm0SMM
ZOfITT0aU8/tyh/zUm3pOmhIQJpGrxQC7ox0Jya+wc6tNT9ixKAocfUm/ftSuZBD
EmH+YlfdQivEcaiP9GlPyGKFp0xRlAtDjbPiA5ZZXJtCNS17KRHNmc/GRIBnhqJu
sv8c5Qxj3xppoBbTENKy0WI81L200CEpBrm+7qUgQj+TRdXzCaLCL7KTyLlmKxQa
mor1TPDbrs5FEMWVaPJLloKSlKCm0forFnuRIxD3VYLQxqeomHY4CaV+vNjdMJDC
4oV64Z1XVDR5SjtA+/MmX07FdTBdlGDzBZQugwQyhbM+iHEHBmvxXkyMEBpVBN2x
U9XICr1PBibENZAyS/IKYW8ilfPtkUiW6Jgyk5W7bIw=
=eXsP
-----END PGP SIGNATURE-----
Merge tag 'nf-26-07-10' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf
Florian Westphal says:
====================
netfilter: updates for net
The following patchset contains Netfilter fixes for *net*.
These are fixes for bugs except patches 6 and 9 which fix issues added in
last PR and 7.1-rc1.
1) Reject unsupported target families in xt_nat_checkentry().
From Wyatt Feng.
2) Fix inverted time_after() check in ecache_work_evict_list().
Causes pointless work rescheds and thus way longer time to
clear the pending event backlog. From Yizhou Zhao.
3) Fix a use-after-free in br_ip6_fragment() caused by a dangling prevhdr
pointer. From Xiang Mei.
4) Fix incorrect conntrack zone comparison in nf_conncount tuple
deduplication. Pass IP_CT_DIR_ORIGINAL, not zone direction.
From Yizhou Zhao.
5) Add bridge tunnel flowtable regression test for a bug that
got fixed in the previous PR. From Zhengyang Chen.
6) Use the correct direction when setting up tunnel routes in the flowtable
xmit path. From Pablo Neira Ayuso. This fixes a bug added in the
previous PR.
7) Reload IP header after potential skb head reallocation in IPVS.
8) Fix incorrect IPv6 transport offsets in TCP application code. Correct the
ICMPv6 header offset to ensure proper checksumming with extension headers,
from Julian Anastasov. this is a followup to the previous PR.
9) Remove null-termination requirement for xt_physdev masks, this broke
device names with 15 characters.
netfilter pull request nf-26-07-10
* tag 'nf-26-07-10' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
netfilter: xt_physdev: masks are not c-strings
ipvs: fix more places with wrong ipv6 transport offsets
ipvs: reload ip header after head reallocation
netfilter: flowtable: use correct direction to set up tunnel route
selftests: netfilter: add bridge tunnel flowtable regression
netfilter: nf_conncount: fix zone comparison in tuple dedup
netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()
netfilter: ecache: fix inverted time_after() check
netfilter: xt_nat: reject unsupported target families
====================
Link: https://patch.msgid.link/20260710143733.29741-1-fw@strlen.de
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
