mirror of
https://github.com/torvalds/linux.git
synced 2026-10-08 19:46:02 +02:00
e7d3e2f46d
1481439 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Chang S. Bae
|
e7d3e2f46d |
x86/microcode/intel: Reject problematic loading on Granite Rapids systems
Microcode updates can usually jump revisions. However, there is an erratum on Granite Rapids systems. If they "jump over" revision 0x1000405, they result in an #MC. Avoid it. Signed-off-by: Chang S. Bae <chang.seok.bae@intel.com> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260916225939.1144524-1-chang.seok.bae@intel.com |
||
|
Yazen Ghannam
|
27600805e6 |
x86/amd_node: Fix PCI device reference counting in amd_smn_init()
The local "root" pointer is a temporary variable used during the device
search. Therefore, refcount related to the search iterators should be cleaned
up after the search is complete.
Use the __free() cleanup macro to ensure the refcount is decremented when the
temporary pointer goes out of scope.
Additionally, increment the refcount when caching a root pointer. This ensures
the in-use refcount is separate from the temporary search refcounting.
Finally, drop the redundant "root = NULL" before the second search loop. The
pci_get_class() iterator always decrements the refcount of its "from"
argument, so the first loop can only fall through with "root" already NULL.
Fixes:
|
||
|
David Laight
|
f65d38155a |
x86/div64: Fix addition of large constants in mul_u64_add_u64_div_u64()
Adding constants over 2^31 fails to compile because the ADD instruction only
supports 32bit signed immediates.
Replace the "irm" constraint with "erm" so that the compiler loads large
constants into a register.
Found by a patch to drivers/iio/frequency/ad9910.c
[ bp: Massage commit message. ]
Fixes:
|
||
|
Soheil Hassas Yeganeh
|
5a5d26f2cf |
x86/cfi: Fix FineIBT hash offset in cfi_get_func_hash()
The switch of the FineIBT preamble from "subl $hash, %r10d" to the
shorter "subl $hash, %eax" moved the hash immediate from offset 7 to
offset 5 of the preamble. fineibt_preamble_hash was updated to match,
but the open-coded offset in cfi_get_func_hash() was missed and it
still reads the hash at offset 7.
cfi_get_func_hash() is used by the BPF JIT to give a struct_ops
trampoline the CFI hash of the stub function it stands in for. With
FineIBT the trampoline now gets the upper half of the real hash
followed by the first two bytes of the next instruction, so the first
indirect call from the kernel into a struct_ops program,
tcp_init_congestion_control() calling ->init() of a BPF congestion
control for example, fails the FineIBT check and the kernel dies with
a CFI failure.
Move the FineIBT preamble template and its offset defines above
cfi_get_func_hash() and use fineibt_preamble_hash there, so every
reader of the preamble shares one definition of its layout. The
CFI_FINEIBT arm is only built with CONFIG_FINEIBT, the only
configuration in which cfi_mode can take that value.
cfi_get_func_arity() does not need the same treatment: the __bhi_args
call whose displacement it reads still ends at the function address.
Fixes:
|
||
|
Vernon Yang
|
f7491d7c81 |
x86/mm: Fix user-space data loss with MADV_FREE and THP
Some of users of Polars (a data analytics library) have lost production
data from this bug. They seem to have just the right combination of
huge pages, MADV_FREE and heavy reclaim pressure.
pmd_modify() masks the old value with (_HPAGE_CHG_MASK & ~_PAGE_DIRTY),
silently discarding the hardware dirty bit. The subsequent
pmd_mksaveddirty() call is supposed to transfer _PAGE_DIRTY into
_PAGE_SAVED_DIRTY when write-protecting, but the dirty bit was already
stripped from the value, so there is nothing left to transfer.
Contrast with pte_modify(), which keeps _PAGE_DIRTY_BITS in its mask,
and pud_modify(), which keeps _HPAGE_CHG_MASK untouched: pmd_modify()
is the odd one out. Any pmd_modify() on a writable, dirty PMD loses
the dirty state.
One visible consequence is data loss with MADV_FREE on PMD-mapped THP:
memset(buf, 0x5A, size); // PMD-mapped THP, PMD dirty
madvise(buf, size, MADV_FREE); // PMD cleaned but left writable,
// folio marked lazyfree
memset(buf, 0x5A, size); // hardware sets _PAGE_DIRTY again
mprotect(buf, size, PROT_READ); // pmd_modify() drops the dirty bit
mprotect(buf, size, PROT_READ|PROT_WRITE);
// ... memory pressure ...
Reclaim (e.g. under memcg pressure) then finds the lazyfree folio with
no dirty bit set anywhere and frees it in
__discard_anon_folio_pmd_locked(), even though the data was rewritten
after MADV_FREE; subsequent reads fault in fresh zero pages. NUMA
hinting alone can trigger the same loss, as do_huge_pmd_numa_page()
restores the PMD through pmd_modify() as well.
PMD-mapped file THPs are affected too: mprotect()/NUMA hinting dropping
the dirty bit means rewritten data is never written back.
Fix it by keeping _PAGE_DIRTY in the preserved mask, exactly like
pte_modify() and pud_modify() do. The existing
pmd_mksaveddirty()/pmd_clear_saveddirty() pair then performs the
hardware-dirty <-> saved-dirty transition based on the write bit,
preserving the shadow-stack encoding rules.
Fixes:
|
||
|
Lorenzo Stoakes (ARM)
|
9e4a3ec341 |
x86/mm/pat: Allocate split page tables as kernel page tables
A PTE is allocated directly without going through the standard page table allocation routines (such as pte_alloc_one_kernel()) when the CPA code splits a large page (__split_large_page()). This means the page table constructor is never called nor is the page table marked as a kernel page table. The former results in the folio associated with the page table not being marked as a page table (__pagetable_ctor() is never called thus neither is __folio_set_pgtable()) nor are statistics updated to reflect it (lruvec_stat_add_folio() is never called). The latter issue of failing to mark the page table as a kernel page table (ptdesc_set_kernel() is never called) is far more problematic. Since commit: |
||
|
Pedro Falcato
|
1587d3394e |
x86/alternatives: Exclude text poking against change_page_attr()
From time to time, the following BUG can be observed
in the x86 alternatives patching code [0]:
> kernel BUG at arch/x86/kernel/alternative.c:2576!
> Oops: invalid opcode: 0000 [#1] SMP NOPTI
> CPU: 0 UID: 0 PID: 355 Comm: (udev-worker) Not tainted 7.1.3-1-default #1 PREEMPT(full) openSUSE Tumbleweed 8c1795b03ec64f997e57a8ad38b1161e3b98da64
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS unknown 02/02/2022
> RIP: 0010:__text_poke+0x2aa/0x450
> Call Trace:
> <TASK>
> smp_text_poke_batch_finish+0x2a7/0x320
> __static_call_transform+0xb7/0x220
> arch_static_call_transform+0x5b/0xb0
> __static_call_init+0xe9/0x270
> static_call_module_notify+0x11f/0x150
> notifier_call_chain+0x61/0xe0
> blocking_notifier_call_chain_robust+0x63/0xc0
> load_module+0x1c92/0x20c0
> init_module_from_file+0xd8/0x140
> idempotent_init_module+0x100/0x2f0
> __x64_sys_finit_module+0x71/0xe0
> do_syscall_64+0xe1/0x610
> entry_SYSCALL_64_after_hwframe+0x76/0x7e
which matches the following BUG_ON() in alternative.c:
/*
* If something went wrong, crash and burn since recovery paths are not
* implemented.
*/
BUG_ON(!pages[0] || (cross_page_boundary && !pages[1]));
This can happen if vmalloc_to_page() fails, for any reason. Such can happen
if text poking races with CPA, which can possibly result in the collapsing
of page tables (or breaking of PMD hugepages). It is not a problem for most
users of vmalloc_to_page() (they solely own the vmalloc'd range) but, when
CONFIG_ARCH_HAS_EXECMEM_ROX=y, various modules own a single execmem vmalloc
range, and can call set_memory_*() in parallel on it. This can happen to
race against __text_poke and cause havoc in vmalloc_to_page().
Fix it by excluding against CPA using the init_mm mmap read lock.
[ dhansen: Fix up SoB ordering. The actual code flow here was:
Pedro=>Lorenzo=>Mike=>Me which is reflected in the SoB chain
now. I *believe* Mike simply picked up Lorenzo's update to
Pedro's post from the Link ]
Fixes:
|
||
|
Lorenzo Stoakes (ARM)
|
d5d8b8662e |
x86/mm/pat: Acquire init_mm read lock on attribute changes to avoid UAF
A previous commit protected against races between ptdump and CPA collapse,
however one still exists between attribute changes and collapse as reported
by Denis V. Lunev (linked).
When an attribute change arises, a lockless page table walker obtains a PTE
entry, which is later written to via set_pte_atomic():
...
-> change_page_attr_set_clr()
-> __change_page_attr_set_clr()
-> __change_page_attr()
-> _lookup_address_cpa()
-> lookup_address_in_pgd_attr()
-> [ lockless page table walker ]
-> set_pte_atomic()
There is nothing preventing a concurrent CPA collapse which can free the
PTE that was retrieved here, resulting in a use-after-free.
With the mmap write lock taken on init_mm over CPA collapse, resolve this
race by acquiring an mmap read lock on init_mm over
__change_page_attr_set_clr().
This locks across the whole operation over which the walk and the PTE
entry write occurs, solving the race.
It is safe to do this here, as no spinlocks are held upon entry to
__change_page_attr_set_clr().
However, the lock must not be held over an allocation, as allocation can
trigger reclaim and shrinkers may call into CPA recursively, making
deadlocks possible (init_mm -> ... -> fs_reclaim -> init_mm).
A page table is allocated when a huge page needs to be split:
-> change_page_attr_set_clr()
-> __change_page_attr_set_clr()
-> __change_page_attr()
-> split_large_page()
[ pagetable_alloc() ]
-> __split_large_page()
Avoid deadlocks by dropping the mmap lock across pagetable_alloc() in
split_large_page() and track whether this is needed by adding a new
'init_mm_read_locked' flag to struct cpa_data.
This is safe as __split_large_page() (called with locks re-established)
revalidates that the page table entry is the same as it was prior to the
locks being dropped and __change_page_attr() repeats the entire page table
walk whenever a split occurs, so concurrent split and collapse are
accounted for.
Concurrent ptdump is also safe as the lock is only dropped over page table
allocation during which time the page table has not yet been modified.
The CPA_COLLAPSE flag is only set by set_memory_rox(), which exclusively
operates upon vmalloc ranges, and on x86 only within the module mapping
space.
This is important, because some callers directly invoke
__change_page_attr_set_clr(), bypassing this lock. However, none of these
operate within the module mapping space.
* cpa_process_alias() - a recursive helper called by
__change_page_attr_set_clr().
* __set_memory_enc_pgtable() - operates on the direct mapping and (via
__vmbus_establish_gpadl()) the vmalloc mapping space.
* __set_pages_[n]p() - called by set_direct_map_[invalid, default,
valid]_noflush(), __kernel_map_pages() - operates on the direct map.
* kernel_[un]map_pages_in_pgd() - operates on EFI ranges.
This work is based upon Denis V. Lunev's excellent analysis of the bug
with gratitude.
[ dhansen: move to imperative voice in changelog ]
Fixes:
|
||
|
Lorenzo Stoakes (ARM)
|
a1c7570ced |
x86/mm/pat: Acquire init_mm write lock on collapse to avoid UAF
x86 implements page attribute modification using its Change Page Attributes (CPA) mechanism. This tracks properties of ranges such as cache mode through x86 page attributes, and as part of that logic manipulates kernel page tables. Since commit: |
||
|
Jasjeet Rangi
|
d2929113b1 |
x86/MCE/AMD: Fix inverted interrupt enablement during storm handling
mce_amd_handle_storm() currently does the opposite of what storm
handling needs: it enables thresholding interrupts when a storm is
detected and disables them when the storm subsides.
Flip the "on" function argument before passing it to threshold_restart_bank()
as it should have been done.
To clarify: "on" to mce_handle_storm() means, the storm is on now when
"on" is true, and off when "on" is false.
[ bp: Simplify. ]
Fixes:
|
||
|
Jason Andryuk
|
aefdbd574a |
x86/amd_node: Fix potential NULL pointer dereference
amd_smn_read/write() are exported functions around __amd_smn_rw(), so they are always available even if amd_smn_init() fails. In that case, 'amd_roots' is NULL and __amd_smn_rw() will access uninitialized memory. Then, commit: |
||
|
Jason Andryuk
|
72bd92bd81 |
x86/amd_node: Avoid divide by zero on virtualized systems
On a virtualized system, the number of nodes does not have a relationship to
the number of roots. A Xen PVH dom0 can calculate roots_per_node as 0, which
crashes with a divide by zero in:
if (count++ % roots_per_node)
because the underlying topology code on Xen ends up making num_nodes
2 and num_roots 1 and the integer division result is 0.
The issue is seen with Xen, but it could affect other systems.
Set roots_per_node to 1 in this case. Print a firmware bug when this is
performed for non-virtualized systems.
[ bp: Massage commit message. ]
Fixes:
|
||
|
Linus Torvalds
|
cee9395acd | Linux 7.3-rc1 | ||
|
Linus Torvalds
|
78bb208b99 |
i2c-fixes for v7.3-rc1
Fixes mainly for teardown and resource handling, runtime PM and hardware-specific controller issues. - core: fix debugfs use-after-free when removing the adapter - designware: apply interrupt mask quirk for HJMC3001 - imx-lpi2c: avoid target accesses on master-only controllers - mux: release channel node when adapter registration fails - qcom-cci: fix autosuspend and runtime PM cleanup on removal - qcom-geni: fix timing parameters for 32 MHz clock -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQScDfrjQa34uOld1VLaeAVmJtMtbgUCapRFYgAKCRDaeAVmJtMt bpVsAQDz0v5x5AdiZQS224oErSA6vfd7ztavFkh8gg3tR+PgogEAhhV+xChRle4U DTwvfC2DYuzxJxYpuQbMGdvu39cuTgA= =t/+3 -----END PGP SIGNATURE----- Merge tag 'i2c-fixes-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux Pull i2c fixes from Andi Shyti: "Fixes mainly for teardown and resource handling, runtime PM and hardware-specific controller issues: - fix debugfs use-after-free when removing the adapter - designware: apply interrupt mask quirk for HJMC3001 - imx-lpi2c: avoid target accesses on master-only controllers - mux: release channel node when adapter registration fails - qcom-cci: fix autosuspend and runtime PM cleanup on removal - qcom-geni: fix timing parameters for 32 MHz clock" * tag 'i2c-fixes-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux: i2c: core: fix debugfs UAF on adapter removal i2c: imx-lpi2c: avoid accessing target registers on master-only controllers i2c: qcom-cci: fix autosuspend cleanup i2c: designware: Enable interrupt mask workaround for HJMC3001 i2c: qcom-geni: update frequency table to fix timing parameters i2c: mux: Fix channel node leak on adapter add failure |
||
|
Linus Torvalds
|
eea8bdcb59 |
Coccinelle patches for Linux v7.3
Sang-Heon Jeon <ekffu200098@gmail.com> has cleaned up a number of the semantic patches in the scripts/coccinelle directory, particularly with respect to functions that no longer exist in the kernel. He and I have also done some reorganizations that improve performance. I eliminatd some false positives. 相浦彰 / AIURA，AKIRA <akira.aiura.bj@hitachi.com> fixed an out of date URL. -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEnGZC8gbRfLXdcpA0F+92B3f5RZ0FAmqUJzoACgkQF+92B3f5 RZ1ZKA//XmJPmm4VapiaWb3Kd9R11JXEqUrkDMkexkwpa+844xC6XfUKsAJTsxff 18UksaPH+GQyLInWtu271uPDL+3X/yXbSU0iQA675XVQsG9Bz9MJ3R7tDcmFiJR9 Oflm7VwlG0QFVk1HVJRtY5+kfZ5ob54CZ82QltHCRIrPKQJ9JWqS8ffnNggLQu91 D079YK9gL/SqTXsWSUg+oU/TN5zILAZ0XDAdqN5THuMtq3ADurlKoPFeGHTiXdDs rFlmbu3XX40aL06qun6B4WLD/86fpvaVQ9NwqJnTEoTA4GNwENY/wYY9GJdsWa7h N7bTB7R8g441orRx0CeGyFBJkNocg4V5ImT42aGtsxfgIxDvFPxcfVg3TnCSbO8/ SYvvnzaIzdYkx41IIIHPLZHNbW96kbT8rI5s3DrkUoKvMePnCtrV/6bR1QFBHdiw I5/q4yhFjwvRh5ffiU5McqlYcM4NK1s3lHD+fk6oKf8XOgPzo6b1nBFky+P4Whw+ Sy/uBM2TrafRlvRrctz0EdhKSQede/Q7OVFcJKOvUUwnYKRqmrM5qPIQvDg6s4zZ 7NQWK7SsfWFKFUd1mljqN9Pe//fLIxfHKqyQwWtoPJwPmVaKSUTF/UDHu5HR4VVn wd4MxZj1ck3Dv/mtvAcJNxKw3+imD+284wPkpsrityMDpdYRHoc= =AgiL -----END PGP SIGNATURE----- Merge tag 'cocci-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux Pull Coccinelle updates from Julia Lawall: - Clean up a number of the semantic patches in the scripts/coccinelle directory, particularly with respect to functions that no longer exist in the kernel (Sang-Heon Jeon) He and I have also done some reorganizations that improve performance. - Eliminate some false positives (me) - Fix an out of date URL (相浦彰) * tag 'cocci-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux: coccinelle: ifnulldev_put: update error message coccinelle: ifnulldev_put: update outdated helper names coccinelle: atomic_as_refcounter: drop atomic_long_dec_and_lock coccinelle: kfree_mismatch: drop vmalloc_exec coccinelle: pool_zalloc-simple: drop the pci_pool_alloc rules coccinelle: zalloc-simple: drop the kmem_alloc rules coccinelle: alloc_cast: drop removed allocators coccinelle: remove obsolete pci_free_consistent.cocci scripts: coccinelle: devm_free: reduce false positives coccinelle: misc: struct_size: drop unneeded parentheses coccinelle: mini_lock: improve performance when searching loops coccinelle: api: check for macro context coccinelle: update Coccinelle website URL coccinelle: misc: minmax: avoid unhelpful isomorphisms coccinelle: misc: minmax: check for the presence of if cases coccinelle: misc: minmax: drop unneeded parentheses coccinelle: misc: minmax: improve performance when no candidate exists coccinelle: double_lock: improve performance when no double lock exists |
||
|
Darrick J. Wong
|
cbb4c6d9af |
CREDITS/mailmap: add some info about Darrick J. Wong
Add myself to CREDITS because apparently I've never done that; and update mailmap so that all my old email addresses get remapped to the kernel.org redirector. Signed-off-by: "Darrick J. Wong" <djwong@kernel.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> |
||
|
Linus Torvalds
|
a23cbb0574 |
- Fix UM build regression caused by the removal of the UM
specific timex.h header. (Thomas Weißschuh) Signed-off-by: Ingo Molnar <mingo@kernel.org> -----BEGIN PGP SIGNATURE----- iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmqTmUsRHG1pbmdvQGtl cm5lbC5vcmcACgkQEnMQ0APhK1iFihAAtSFpL6WKwu+eTTdTn/J41OCx6SWMw79O GRXfHX7HKVS52IhEnh3OWDVcMAqhNXe8oP/JwzBn4EuCv2LrsuBxpiTp6Bq4Y0Da Ws16Nb0CRH966L9E6z0kMZQBMsKrLGXGOE+/t9gzHpkTBzJ4a7Dzh1TZX2YudhRO lrnS+7azTb5XyshyMDo0C43AH6rUpt1ffYUz0MyACkbWPzQge42O3neN/2gKMDjq TM128Man3V4AX6K/9hC4vnvDNYdHsUqxHhc81826wVX7brF74uoYSiogn/AZK7RY CK9GQmAv7xo7AJTqe9AKt5dCy/cvVLp4vLqVYMQMGaFB05PF+1EMY69xrAkWnS4k 1cYnU0hCHN/86XOShe1s0101UPD6ZxYo/WlU53VGRJMNi7Dm5OMFFOGzAK9WfTIB 4UyOwuzq/505aA8dr5+Hk5PYikDvDXOA/zmqewAMonDrlTWhPBxWV6k+Dhks8WOt MIgjoX8wFlA7h0SUQH12XN/pxEBTgNl4P4k8YyHqVwOKN/XPZJ6XPGt2nIc8hnVc m3wHxP27x/68Ugpz1a8oADkC6lhDFgTE5XO6mmpfHKaVp/Fwdjrg8atwltHbixiV 4mo5ZlcI759lN40EBJM4QbGRP8k5TjRGgkUnv7B2qpBBgAvPnCnlMZo0871J6VVz 0CeKb6kxT+k= =eGi8 -----END PGP SIGNATURE----- Merge tag 'timers-urgent-2026-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fix from Ingo Molnar: - Fix UM build regression caused by the removal of the UM specific timex.h header (Thomas Weißschuh) * tag 'timers-urgent-2026-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: um: Use asm-generic/timex.h over the host architecture one |
||
|
Linus Torvalds
|
637836563d |
- Revert a commit to spinlock cleanup guards that got caught up
in the subtle limitations & fragility of guards (again...) and
caused a regression (Peter Zijlstra)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmqTmG0RHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1iV+A/+J2IN9xHNPv0O9rLKaJvLsNnlMPQ4QJJB
kTbEOLDrAE7ozTmP2sLfUu75w1FQz0Hp00/tf1V7VFYaSeMBdMoqJs3itCtuqBrU
qkVFrx7splaNauvFgxdaHd5dYGszwFOjixMwhezQC1wn46ckW29bEHbIrmY5j1xC
zF7iSTaVp2zHBbkh0n6ozN28zSbHZcLEAD8mvGoscv3Bnb+9HRMAr4weTHC94kq5
4hDaRS48CgofxEfXT0erp6Rc7lS1YTUltSvkICORTv0tYtDqDf1GCiZKIjaW8FqW
N7Nre77fSlH6HfzzujNgNOhGAGoVO+Ki9vfqgnYhnFRc864g9OTREmdNLlJ2V5XB
yC0SCbAeAjOvbtTLQlRmDlKWJPlwKgXkatGupczkCna3EeL9eXx33fOO6kOGxNNs
RpQXv+wPv0S9EDdIkkuMwhx0dq6yUCfrA22+wlXUzFhXvHTbhqZlDneI9OtzubZm
kU+Vf8dgVU0z59C+2ZOwlp5YHVXquRfNXOz8lrRIeb0y0Iyvlo7pDuQ/t8w3Bh3c
KVlAEEQsK8maBHgHHKMv8ml4W6XJHC9KG6x0TtKDv+ntmrNBDhvq2sxWrhBA7JT4
kXdab1QG/hP2FEY3M6bChEadT64U1BeGlcI9xMkhX886PwrnOMzTd9xiAN7UtdCR
dITQG+bHeQo=
=EtPf
-----END PGP SIGNATURE-----
Merge tag 'locking-urgent-2026-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull locking fix from Ingo Molnar:
- Revert a commit to spinlock cleanup guards that got caught up
in the subtle limitations & fragility of guards (again...) and
caused a regression (Peter Zijlstra)
* tag 'locking-urgent-2026-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
locking: Revert switching guards to _irq_{disable,enable}()
|
||
|
Linus Torvalds
|
f59c074e76 |
Rust fixes for v7.3
Toolchain and infrastructure:
- Fix KCFI failures, such as in Rust doctests, by disabling function
merging when CFI is enabled. Gary reported the LLVM bug to upstream
and it is now fixed in their mainline.
- Fix 'objtool' fallthrough warnings under the experimental
'CONFIG_RUST_INLINE_HELPERS' by passing (for the combined Rust and
helpers code) the LLVM options needed to preserve the unreachable
traps that 'rustc' normally emits.
In addition, fix 'objtool' errors when LTO is enabled on top, by
also filtering out the LTO flags (for the combined Rust and helpers
code) so that the traps are kept in place.
- Fix 'objtool' warnings by adding one more 'noreturn' function.
- Fix 'make rusttest' target when the 'rustc-dev' component is
installed and Rust >= 1.82.0, <= 1.87.0 is used.
'kernel' crate:
- 'num' module: fix soundness issue in the 'Bounded' conversion from
'bool' by restricting the conversions to unsigned 'Bounded'.
- 'jump_label' module: fix future 'make rusttest' target failures when
'ARCH=' is set to an arch different than the host's.
- 'list' module: fix incorrect 'pop_back()' comment.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEPjU5OPd5QIZ9jqqOGXyLc2htIW0FAmqT+BIACgkQGXyLc2ht
IW0vRRAAmR1E04gT5HFDH+iNJgLlyticVsHs0rH46ICYgQWs+gpGGiJsPpnNBJxM
M5+VGauMPch5kIBKYwD/XrUe6cDDNqIfY8Eq+BnJiTxDe6U68K4cSnmPe478wZIn
15AIteCHN2x9vf49KpfI3fH/xoriS5XVEC915bQ9APXOYJv7iXZCFDzxw9dXnYu/
TE3YleA32oJ9COBT3s8ovtzNpEOtZPKhWFd2lOCaGbxBLWygu5X/PSEZs6ikmqgR
BqHrbhzSco8aYKCrbFbQrdgtwFPr3PQ8pRn44TPU6/siZNVBk83IpcxdtXrQ2gRi
wOwZfMsH2K/cEZWMXPz16hp+4onWUr1bgkfLUAzPtyqUX6rOEaBrliSXGs+yCl40
KNx5BefrhzH6UL+/pbLGVXzC5q1VLTsgS6u66piUyvhf52Wmvzc7AExGml/BWA/q
jomwnxpgLiBjO61cH4dnfrm3AtXHAWGzG/dd0BnVcpT+8HEr2W4WWRSydmPtkB+f
hXXmwAOF3sgVueJ2nxlPVcqt3LdsinCwBrQQmO8J+TtPyNW9sh72OfFSOkF/wybw
o5tcqFG7ZSNGR7pli5pYsnG4Gfv3vIraLwhiVciGXZ+es+FkKtOpaOMunUcQwKP6
+uFpdMqXVQmH4l3Adc0rG1lq6zRHnGvZ96R5PlmPhl6RVDZuv0E=
=EBLX
-----END PGP SIGNATURE-----
Merge tag 'rust-fixes-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux
Pull Rust fixes from Miguel Ojeda:
"Toolchain and infrastructure:
- Fix KCFI failures, such as in Rust doctests, by disabling function
merging when CFI is enabled. Gary reported the LLVM bug to upstream
and it is now fixed in their mainline.
- Fix 'objtool' fallthrough warnings under the experimental
'CONFIG_RUST_INLINE_HELPERS' by passing (for the combined Rust and
helpers code) the LLVM options needed to preserve the unreachable
traps that 'rustc' normally emits.
In addition, fix 'objtool' errors when LTO is enabled on top, by
also filtering out the LTO flags (for the combined Rust and helpers
code) so that the traps are kept in place.
- Fix 'objtool' warnings by adding one more 'noreturn' function.
- Fix 'make rusttest' target when the 'rustc-dev' component is
installed and Rust >= 1.82.0, <= 1.87.0 is used.
'kernel' crate:
- 'num' module: fix soundness issue in the 'Bounded' conversion from
'bool' by restricting the conversions to unsigned 'Bounded'.
- 'jump_label' module: fix future 'make rusttest' target failures
when 'ARCH=' is set to an arch different than the host's.
- 'list' module: fix incorrect 'pop_back()' comment"
* tag 'rust-fixes-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:
rust: kbuild: disambiguate `zerocopy_derive` for `rusttest`
rust: num: restrict bool conversion to unsigned Bounded
kbuild: rust: keep Rust objects out of Clang LTO with inline helpers
kbuild: rust: preserve unreachable traps with inline helpers
rust: cfi: disable function merging if CFI is enabled
rust: jump_label: skip arch-specific asm in `testlib` builds
objtool/rust: add one more `noreturn` Rust function
rust: kernel: list: fix incorrect pop_back example comment
|
||
|
Linus Torvalds
|
0fe792fa9b |
ARM updates for 7.3-rc1
- add module description for kprobes testing module
- remove references to CONFIG_CPU_ARM92x_CPU_IDLE options
- expand comment in ARM's __switch_to()
Also a number of fixes that missed 7.2:
- disable broken eBPF on RiscPC
- more BKPT fixes (guys, it's a *very* bad idea when everyone uses
the BKPT instruction for their own differing purposes.)
- another preempt-rt fix, this time for siglock / CPU timers
- fix another path where we try to send signals to processes
with interrupts disabled
- acquire mmap write lock for show_pte() with user faults
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEuNNh8scc2k/wOAE+9OeQG+StrGQFAmqUOjQACgkQ9OeQG+St
rGR5DBAAki6o4y1sATQh+ZIHIspR0t8lcQZn31lWoGup1T1KoI7f2S48vJwvd17p
CryOuHmc8H0W5Z7MoiJ9Vkg4BsQzagr28xjvYO2uLYyrOqLgyJvUyNQm2POVa9nB
296/hCQjBR8VrEszJr6mvpac2pmYo9tlK3FcHKa1jO+iJbkQW1/4i5njhWqK7g0v
cG1ezSsaa1zZsOvFtJhBb8FQca7fpF1tRKd4F7s/w1mV4v7hETMaaXuYGMzHYVw2
zrln7CvGs5vlskrnbAxwMHyJdvdZI80Sm/QvIqxdTbYgZmfHYS43MKJp8E0HRz90
1oLUfWRxLMI1hql/hxraZEnMICa4uLKbhifqDN3H59WLb+S12gRrqb1WFIdr6SUv
P+xIkSaJu24Nb6LCvaVYLV24enMx2oGG76h2itXXKyDCiYTWVz2fMmAQiajbkxnh
iCoHBqvfTGu8Qio0Ndrp9XMn1pFCtPkb2eaBGfIfTKB08FxdwqR7rcWePygS83j5
BwXgeGCNh4oV5J5isZ3bRcwa7QkqbdsTrYhXcoDUcRzZgo/GAuEjP1AzsxOdV8hh
NKpBXrzNYfy78PkYc+vBe0piiuJUykKaRNfMX2WRK8u/fj4yCtkKuMZY02WA4X2M
I5N0bcdXmeE/d4KqJcx9WXtdji16w7G15xhfKKZRdlnvs0Oy2Uw=
=KcxS
-----END PGP SIGNATURE-----
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux
Pull arm updates from Russell King:
"Updates for 7.3:
- add module description for kprobes testing module
- remove references to CONFIG_CPU_ARM92x_CPU_IDLE options
- expand comment in ARM's __switch_to()
Also a number of fixes that missed 7.2:
- disable broken eBPF on RiscPC
- more BKPT fixes (guys, it's a *very* bad idea when everyone uses
the BKPT instruction for their own differing purposes)
- another preempt-rt fix, this time for siglock / CPU timers
- fix another path where we try to send signals to processes with
interrupts disabled
- acquire mmap write lock for show_pte() with user faults"
* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux:
ARM: 9480/1: entry: expand comment in __switch_to
ARM: 9478/1: Remove references to removed CONFIG_CPU_ARM92x_CPU_IDLE options
ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults
ARM: 9484/1: enable interrupts when unhandled user faults are triggered
ARM: 9483/1: select HAVE_POSIX_CPU_TIMERS_TASK_WORK
ARM: 9481/2: breakpoint: CFI breakpoints only on demand
ARM: 9477/1: Disable broken eBPF JIT on the Risc PC
ARM: 9473/1: kprobes: test: add MODULE_DESCRIPTION
|
||
|
Linus Torvalds
|
fb5b59a6a6 |
OpenRISC 7.3 updates
One small item and one bug fix.
* The bug fix is to fix an unchecked access in our or1k_atomic syscall,
I am debating if we should just deprecate this as there is minimal
need for it.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE2cRzVK74bBA6Je/xw7McLV5mJ+QFAmqSfncACgkQw7McLV5m
J+TprRAAuyxaYmmnTQqJacQt8OEaVJ5DPsZfCtENwEg9BkXpvzo1F/uK4Enp+YEf
VABscIWCAEKY2BCbn6TYdq6uDAHg9GY0fRUcJ7ERUH9pZt7RD24R6uP0oTIffYL4
wzD5E7DOkVdKHrw5KHB75K4BTPgHPLK2aJxhnS9eX/tYS2yDLQNyFvH5OxZ/uezp
6wJlZhdSdcTTNNBu/ZLj0YHa/22RixqxWHB0Wax061LU4QFjbYo8qufSA1sdP5Do
qz/zjW6fr6ieJOwNKsM6n9BLcCS1OqTNKRrWUbxUYqeni8jX2qXWxnwjOK0RrXH2
nmraEviXMrYGg29BIi914nG1uePp0MeX8LE2+GrBQ8iEMmnJeVk+TDNqGiXT4Zg1
1NTeQaGDJu2aggPlNC2DnnJyKb7KkTceBcpBC1amUco6co7m+TbFzcnqpUcTsVSu
HhH72NGnKmY7aFuMaw6Apl6pqw8C38moXhDo45XkucQzRQJADlIkm4amm8gV+MFk
ivP6OMuW4I08DxUlZw/thUdG6qMXVUKCrVqlohjQFXNKuFeHJM+rfJFXGnEmoSCW
AkFtgCH2wMDcW5BsM1d3YV3Bj4OFYR/YaElx0T83fcTUvGNbwdFQOlmGy06Jo2Hj
Vr/5pvoYbTUdL0uJMLPEG6mZuB5LmW5K4ktGTMTPosunXRQipIk=
=DkYR
-----END PGP SIGNATURE-----
Merge tag 'for-linus' of https://github.com/openrisc/linux
Pull OpenRISC updates from Stafford Horne:
"One small trivial macro cleanup and one bug fix.
The bug fix is to fix an unchecked access in our or1k_atomic syscall,
I am debating if we should just deprecate this as there is minimal
need for it"
* tag 'for-linus' of https://github.com/openrisc/linux:
openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
openrisc: drop unneeded semicolon
|
||
|
Linus Torvalds
|
034dd340b0 |
tracing fixes for v7.3:
- Fix error output of boot instance creation failure Currently if a boot instance creation fails, instead of printing out the name of the instance that failed, it prints "(null)". That is because it prints "cur_str" that had already been processed by strsep(). Print the saved name instead. While at it, print the error code of the failure. - Fix use-after-free for same named historgrams Histograms can be named so that they can be used in multiple events. But if the named histogram has a variable attached, the second event that uses the named histogram which duplicates it and needs to free the original after duplication leaves the old variable in place and still visible. If another histogram uses than variable, it will use the stale one which will try to reference the freed duplicate histogram and crash the kernel. Free the duplicate variables along with the duplicated histogram data. - Check return value of kthread_run() in event self test The events self tests uses a kthread for testing but does not check if it succeeded in creating a kthread. If the kthread creation were to fail, the code will still try to call kthread_stop() on the error returned. - Fix race between reading trace_pipe and updating subbuffer size If a user is reading the trace_pipe file at the same time they update the ring buffer sub-buffer size, can cause the trace_pipe read to read stale data. Add trace_access_lock() around updating the ring buffer sub-buffer size. - Fix eventfs_inode on failure path in creation of the events directory In the creation of the "events" directory, if after allocating the eventfs_inode a failure is detected, it calls cleanup_ei() which calls free_ei(). The free_ei() will test if eventfs_inode being freed has no children. It is a bug if it does. But on the failure case of the creation of the "events" directory, the children lists have not yet been initialized and the free will trigger a warning because list_empty() on an uninitialized list returns false. Move the initialization into init_ei() where it makes more sense and makes sure that a created eventfs_inode has its lists initialized upon creation. - Check return value of kthread_run() in ftrace direct sample code The sample code that shows how to use the ftrace direct calls does not test the return of kthread_run() to see if it succeeds. Return a failure if the kthread_run() doesn't succeed. - Clear user events state on fork in case of alloc failure On fork, the child gets a pointer to the parent's user events state. It makes a copy of it then updates the child's pointer to it. But if the allocation fails, the duplication function leaves the child with a pointer to its parent's descriptor. When the child cleans up its data, it will free the parent's descriptor while the parent is still using it. In the duplication function, set the child's user_event_mm to NULL before testing if the allocation succeeded, and when it exits it will not free the parent's descriptor. - Fix retry exhaustion in simple ring buffer reader swap simple_ring_buffer_swap_reader_page() starts with retry set to 8 and post-decrements it only after a failed link replacement. On the final attempt, a successful replacement leaves retry at zero, while a failed replacement leaves it at -1. But the check for success expects the retry value to be non-zero and exits with an error on zero. This is the opposite result. Fix it. - Fail nicely when the remote swap_reader_page() returns an error Currently, if the swap_reader_page() of a remote buffer fails, it triggers a WARN_ON_ONCE() and continues normally. Instead, have it exit with an error and a pr_warn() print instead of a full WARNING. -----BEGIN PGP SIGNATURE----- iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCapOC3hQccm9zdGVkdEBn b29kbWlzLm9yZwAKCRAp5XQQmuv6qvjkAQCGVuyK980rwiBnfenWLpeB3QjfHA8B mV0mJSlGWm1t1gEA9WWzMGbp+OHeRV2xyA+xW7OS1S58VO9OIGrzXCGqbAM= =TrF5 -----END PGP SIGNATURE----- Merge tag 'trace-v7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Fix error output of boot instance creation failure Currently if a boot instance creation fails, instead of printing out the name of the instance that failed, it prints "(null)". That is because it prints "cur_str" that had already been processed by strsep(). Print the saved name instead. While at it, print the error code of the failure. - Fix use-after-free for same named historgrams Histograms can be named so that they can be used in multiple events. But if the named histogram has a variable attached, the second event that uses the named histogram which duplicates it and needs to free the original after duplication leaves the old variable in place and still visible. If another histogram uses than variable, it will use the stale one which will try to reference the freed duplicate histogram and crash the kernel. Free the duplicate variables along with the duplicated histogram data. - Check return value of kthread_run() in event self test The events self tests uses a kthread for testing but does not check if it succeeded in creating a kthread. If the kthread creation were to fail, the code will still try to call kthread_stop() on the error returned. - Fix race between reading trace_pipe and updating subbuffer size If a user is reading the trace_pipe file at the same time they update the ring buffer sub-buffer size, can cause the trace_pipe read to read stale data. Add trace_access_lock() around updating the ring buffer sub-buffer size. - Fix eventfs_inode on failure path in creation of the events directory In the creation of the "events" directory, if after allocating the eventfs_inode a failure is detected, it calls cleanup_ei() which calls free_ei(). The free_ei() will test if eventfs_inode being freed has no children. It is a bug if it does. But on the failure case of the creation of the "events" directory, the children lists have not yet been initialized and the free will trigger a warning because list_empty() on an uninitialized list returns false. Move the initialization into init_ei() where it makes more sense and makes sure that a created eventfs_inode has its lists initialized upon creation. - Check return value of kthread_run() in ftrace direct sample code The sample code that shows how to use the ftrace direct calls does not test the return of kthread_run() to see if it succeeds. Return a failure if the kthread_run() doesn't succeed. - Clear user events state on fork in case of alloc failure On fork, the child gets a pointer to the parent's user events state. It makes a copy of it then updates the child's pointer to it. But if the allocation fails, the duplication function leaves the child with a pointer to its parent's descriptor. When the child cleans up its data, it will free the parent's descriptor while the parent is still using it. In the duplication function, set the child's user_event_mm to NULL before testing if the allocation succeeded, and when it exits it will not free the parent's descriptor. - Fix retry exhaustion in simple ring buffer reader swap simple_ring_buffer_swap_reader_page() starts with retry set to 8 and post-decrements it only after a failed link replacement. On the final attempt, a successful replacement leaves retry at zero, while a failed replacement leaves it at -1. But the check for success expects the retry value to be non-zero and exits with an error on zero. This is the opposite result. Fix it. - Fail nicely when the remote swap_reader_page() returns an error Currently, if the swap_reader_page() of a remote buffer fails, it triggers a WARN_ON_ONCE() and continues normally. Instead, have it exit with an error and a pr_warn() print instead of a full WARNING. * tag 'trace-v7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: ring-buffer: Stop remote reader update when page swap fails tracing: Fix retry exhaustion in simple ring buffer reader swap tracing/user_events: Clear copied tracing state before fork duplication samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-modify eventfs: Initialize ei->children and ei->list in init_ei() tracing: Fix use-after-free in trace_pipe read on sub-buffer order change tracing: Fix crash passing ERR_PTR to kthread_stop() tracing: Fix use-after-free with same-name named triggers tracing: Fix logged instance name on creation failure |
||
|
Russell King (Oracle)
|
1a89abc009 | Merge branches 'fixes' and 'misc' into for-linus | ||
|
Julia Lawall
|
ef6a1dca8d |
coccinelle: ifnulldev_put: update error message
Update the report and org mode messages to reflect the new function names. Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr> |
||
|
Sang-Heon Jeon
|
f83b8a5869 |
coccinelle: ifnulldev_put: update outdated helper names
dev_put_track() and dev_hold_track() were renamed to netdev_put() and
netdev_hold() by commit
|
||
|
Sang-Heon Jeon
|
5264281879 |
coccinelle: atomic_as_refcounter: drop atomic_long_dec_and_lock
atomic_long_dec_and_lock() has never existed. So drop it from the rules. No functional change. Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com> Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr> |
||
|
Sang-Heon Jeon
|
3beb6e620f |
coccinelle: kfree_mismatch: drop vmalloc_exec
vmalloc_exec() was removed by commit
|
||
|
Sang-Heon Jeon
|
729eb52aa1 |
coccinelle: pool_zalloc-simple: drop the pci_pool_alloc rules
pci_pool_alloc() and pci_pool_zalloc() were removed by commit
|
||
|
Linus Torvalds
|
08dbfad3f5 |
SCSI updates for 7.3
Remaining updates for the 7.3 merge window. The only core change is enabling context analysis for the SCSI layer and UFS. The remaining changes are either bug fixes or hardening. Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZOpW2gUwxXeCmhkh7ulgGnXF3j0FAmqTH1UACgkQ7ulgGnXF 3j2EhA//VAZ4F5A4McmtwYMnCdUCjaPihX9JC7i0GHnBqloX/Scc97xs7/Gzzf7u 5HcQjoYArPYpHkGMT+KuqEpfzRiiYe41XpiPMQf7EkW4VAwYbuwLqPn4z2ma9HIS LAmxSdi1RDU3KBo9hYm4GTsvY+FYDpmrjNcYNvR5Ajf1H3O1+2EBlA54FJ92Ct1v NuxgR8F9cY2JM9cB84qhjCd1/49NEOfAQjBA32OFGbLC/9TbF83g1pgyClmOyglD WTzmzQkIq7kmq0BKWleRUKwgj9EQmOHpe4VGdvHC4n2G8vTBscsXRMqt4l1pM/UY B7c7MfCT8Ar3EnUBO1m9QAADMj9DMqIWZ7SJRDyJL0BLabhxaxDx+yrdkN0dM4SZ n/GW5f8uNO/jxLumk0OfrUChGhKnsNTjQKDnbQZ8jLPjgaj2bx8UZg/8JglOxfaZ +vV3GGsClxjIANqY6pNwvCuXFxatG1o7HUk+JwX08DQT+k7iKkHRLM/4tpiIIwWm xLvAhrX7SJRYjISZm54bPumMscjkzSaUt6CoHqSIJ9iO5AJWBUqFQqaki+lBqF43 DgIUzdEn/OYk9PGKcpjKoeXbEkBPkogHF2YI848z0bdlgb1ae+FHzkDoYH58mDKZ wVt+kQQ3iQgwgB2x9NN+wtxlGFMh6nyPS5GpWopUJXEEvm2WygY= =tfy0 -----END PGP SIGNATURE----- Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi Pull more SCSI updates from Martin Petersen: "Remaining updates for the 7.3 merge window. The only core change is enabling context analysis for the SCSI layer and UFS. The remaining changes are either bug fixes or hardening" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi: (26 commits) scsi: snic: Fix SCSI host leak on workqueue allocation failure scsi: MAINTAINERS: Update my email address scsi: MAINTAINERS: Leave the cumana_1 and oak drivers to the RISCPC maintainers scsi: leapraid: Standardize NCQ priority sysfs attributes scsi: leapraid: Serialize firmware log mmap with teardown scsi: leapraid: Balance host references for firmware log VMAs scsi: lpfc: Remove unnnecessary NULL check scsi: qla2xxx: Fix an loop timeout test scsi: qla2xxx: Fix an error code in qla_get_tmf() scsi: ibmvfc: Fix use of uninitialized rport in ibmvfc_do_work() scsi: core: Enable context analysis for hosts.o scsi: lpfc: Replace strlcat() with sysfs_emit_at() in the sysfs show functions scsi: lpfc: Replace strlcat() with seq_buf in the debugfs dump helpers scsi: lpfc: Replace strlcat() with seq_buf in lpfc_rx_monitor_report() scsi: lpfc: Replace strlcat() with scnprintf() in lpfc_vport_symbolic_node_name() scsi: lpfc: Replace strlcat() with seq_buf in lpfc_info() scsi: core: Enable context analysis scsi: core: Protect host state changes with the host lock scsi: core: Add lock context annotations scsi: core: Pass the SCSI host pointer directly to scanning functions ... |
||
|
Ali Ahmet Memis
|
78004e9a87 |
openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
sys_or1k_atomic() (syscall 244 in the "or1k" ABI) takes two user
pointers, v1 and v2, and swaps the words they point to in hand-written
assembly.
l.lwz r29,0(r4)
l.lwz r27,0(r5)
l.sw 0(r4),r27
l.sw 0(r5),r29
The pointers are not checked with access_ok(). The four memory
accesses also have no exception table entries.
A caller passes a kernel address as either pointer, and the syscall
reads from and writes to it directly.
This gives an unprivileged process a kernel read/write primitive. It
overwrites kernel data such as the sys_call_table, gaining code
execution in kernel context.
Check both pointers before entering the critical section. Add fixups
for the four memory accesses so faults on valid but unmapped user
addresses return -EFAULT.
[shorne@gmail.com: fix comment style]
Fixes:
|
||
|
Linus Torvalds
|
cf72cbb39d |
io_uring-7.3-20260828
-----BEGIN PGP SIGNATURE----- iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmqR/ZwQHGF4Ym9lQGtl cm5lbC5kawAKCRD301j7KXHgpr6GD/9uEDS/3lBXkP5r6qO4E5v/6eN7Sz1F/gZ4 vkH4reHh3U3VSjwOaWJHLXCkJV06JmlJAggCn0dq+P8cXWKH9VpwppzpedY/Ua05 oiDXgyoaAzhgYzE/seCALdFR0zOyvhSlluDiucrwWCcx0h4HOEnysZ3Q4RQ8gXXx 2mQ+M/n2WdXPPUHPEGezPL9PvtitFjUFr8WBeWksCtFQ+Ycyk6+NDPSanxeOjJCI FhgQDxiUIWSEItEniuwq4lUQFtImkRyUvBPPbPb51ahzkCc1QSjr8WVtfO0RJtON uiUU9hkTcKis/ufR+esikrjV2nwxo3fv2WkknrBfJ5jNFiLp/CR+FPZRwH3A/AoH Onoi3qcpcHrXzQD4j/UhyUcaIM7sntwour4PBg8cKUh/lwZkt94+orp6lniiV/Dd aS3IKmCymQjpf5N3b0QnQSi2lOGk6bUKyQD8YUnA/N3rw3olfkzSGBDz6Y4gQxAY XpvmuPDXndhfn17JSGpsCjohWkWEUuSQh1fx5JLsV9XkaPaeA89/epUzu2+b1Kxw c+/uaCkQsGGLpHa6xWhJLGocyYZViDUYeIPz8C7gqTDXTMU70mtZvILl+aZjVrjF iU2aSWDuS9oD0g16yT7FY8pBQvB8RnuNCUmS92QIr+VMqnp7793DPD5gwN88k+8L 4x4gInB+ag== =I3ma -----END PGP SIGNATURE----- Merge tag 'io_uring-7.3-20260828' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: "A few smaller fixes for io_uring that should go into the 7.3-rc1 kernel, all three headed to stable as well. This contains: - A few fixes around cancellation and teardown for waitid - Cap the user size for the query interface copy-out" * tag 'io_uring-7.3-20260828' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/waitid: avoid siginfo copy during ring teardown io_uring/waitid: honor task_work cancellation io_uring/query: cap user size passed to copy_struct_to_user |
||
|
Linus Torvalds
|
a99d741df7 |
drm next/fixes for 7.3-rc1
core: - use drm_warn instead of warn msm: - Bindings: - Added Shikra support - Document a840, a704, a722 - Core: - Use drm_client buffers for fbdev emulation - teardown fixes - ARM32 DMA fixup - Remove objects from evict list when re-validated - Bunch of corner case and error path fixes - DPU: - Dropped dev_pm_opp_set_rate(0) preventing burnout - Fixed SSPP offsets of Kaanapali - DP: - Dropped dev_pm_opp_set_rate(0) preventing burnout - Cleaned up core code in preparation for MST support - Fixed prepare() to let Pipewire continue in case of the unplugged cable - GPU: - Add support for a704 - Add support for a722 - HDMI: - Simplifed register access amdgpu: - eGPU fixes - Runtime PM fix - UserQ fixes - Backlight fix - Discovery sysfs fix - Reset handling fixes - Buffer func handling fix for xgmi - VCN boundary check fix - DC lut handling fixes - MES fixes - UVD fix - VCE 3 fix - Enforce isolation fix - HPD fix for VGA/LVDS - DML fix - DCN 6 fixes - DC gpu reset fix amdkfd: - Fix return value - CU occupancy for GFX 11 - CU occupancy for GFX 12/12.1 - Queue bounds checking fix - SVM fixes - CRIU bounds checking fix radeon: - iMac display fix xe: - error message cleanups - i2c global register definitions as dependency for xe/i2c fixes - Media workardound - Add CCS to gt_idle debugfs print - Page fault related fix - i2c related fixes - System Controller mailbox bit fix -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmqR+2wACgkQDHTzWXnE hr5VPRAAhJpCnUEOUnhiBRfQB3lqHuKV4N9XQGVoaAZHYLxNkZD6I99ScpIznEr9 sHG0ViBqz2PHyM2XoJzPZDzm8Us0moVUMMdV56IH7h11l8E7Az2Sd/Ji+AQvZEBT /qh9Py0/fjibfDm0ueMROFRhuD8RA2sJqzkGMZUBvErh+zmEQvkIDkIT6A5RpHD8 B3XEGN+UCxPBzCnKNixyNDgY2i4ipFAe0MDj9+Mh0b9BM9BoV8+Eb7sjkBz+ROMH tl57Mjjd37FaYM9MgtEt9m7eOBf266V9Xb9tbIfqShwO1aZa0Vfzuih/3Ck53Nwc VkwepP7NHZZKFHIxFgcRCVjzyA3HpZJmLot8YYOyZDJOG6KKp2X0ZUFBog5Uiv8o 7exd95FLUtIsnUtmLxlermOYJwrokgcVoigcalhLCB2+KZ5/BznutzcCSvrd8vI2 LzEGnLMgzuEKeOmiWZjagID51TYwHfPogULUlwWT4XB62dKih7/uselCObj4m/Lc kRSbiXWz1pxisfiFRsK2GECwsbEb/8qOYgSOQBgppuPbSWpX+2P4IApomRBesQ8E Db+i6hptauOwT0/1ZBo8gkOfb0XIWsjg9iV6pVuUIS80hOlr7Zj1MR7mMrWgL0nM Chs4/Nq8jWU1ESbmKPBINIXCGOGuev4lJO/pBjfySLpTUhWOQcw= =wbEZ -----END PGP SIGNATURE----- Merge tag 'drm-next-2026-08-29' of https://gitlab.freedesktop.org/drm/kernel Pull more drm updates from Dave Airlie: "As mentioned last week, an msm pull request fell down the side of the couch or whatever the email equivalent of that is. This has the msm next stuff + the usual fixes for amd/intel. core: - use drm_warn instead of warn msm: - Bindings: - Added Shikra support - Document a840, a704, a722 - Core: - Use drm_client buffers for fbdev emulation - teardown fixes - ARM32 DMA fixup - Remove objects from evict list when re-validated - Bunch of corner case and error path fixes - DPU: - Dropped dev_pm_opp_set_rate(0) preventing burnout - Fixed SSPP offsets of Kaanapali - DP: - Dropped dev_pm_opp_set_rate(0) preventing burnout - Cleaned up core code in preparation for MST support - Fixed prepare() to let Pipewire continue in case of the unplugged cable - GPU: - Add support for a704 - Add support for a722 - HDMI: - Simplifed register access amdgpu: - eGPU fixes - Runtime PM fix - UserQ fixes - Backlight fix - Discovery sysfs fix - Reset handling fixes - Buffer func handling fix for xgmi - VCN boundary check fix - DC lut handling fixes - MES fixes - UVD fix - VCE 3 fix - Enforce isolation fix - HPD fix for VGA/LVDS - DML fix - DCN 6 fixes - DC gpu reset fix amdkfd: - Fix return value - CU occupancy for GFX 11 - CU occupancy for GFX 12/12.1 - Queue bounds checking fix - SVM fixes - CRIU bounds checking fix radeon: - iMac display fix xe: - error message cleanups - i2c global register definitions as dependency for xe/i2c fixes - Media workardound - Add CCS to gt_idle debugfs print - Page fault related fix - i2c related fixes - System Controller mailbox bit fix" * tag 'drm-next-2026-08-29' of https://gitlab.freedesktop.org/drm/kernel: (121 commits) drm/xe/sysctrl: Read mailbox phase bit from hardware drm/xe/i2c: Keep the i2c controller always enabled drm/xe/i2c: Fix the interrupt handling i2c: designware: Global register definitions drm/xe: Reject page faults from non-fault-mode scratch VMs drm/xe/xe_gt_idle: Add CCS to the powergating info print drm/xe: Do not apply WA 14025883347 to media 3503 drm/amd/display: fix dc_lock leak on GPU reset error paths drm/amd/display: Fix redundant GPUVMEnable checks in dcn6 flip schedule drm/amd/display: Fix wrong bytes-per-pixel value for dml2_422_packed_10 drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore drm/amdgpu/userq: fix lock missing for userq fence error set drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram drm/amdkfd: Fix error path at svm_migrate_copy_to_ram drm/amd/display: Log details when failing to register HPD IRQ drm/amd/display: Fix HPD consideration for VGA/LVDS connectors on DCE drm/amdgpu: clamp the isolation index for rings outside a partition drm/amdkfd: Reject zero-sized AQL queue allocations after size halving drm/amdgpu: Fix VCE 3 ring align_mask drm/kfd: Add CU occupancy support to GFX12.1 ... |
||
|
Linus Torvalds
|
4cc4cc367f |
ipmi: Fix some minor issues, add async init
Several cleanup on error fixes and a missing RCU wait and proper validation on a received message in one place. The biggest change is the initialization of the driver can be done asynchronously on a work queue. That saves significant boot time. -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE/Q1c5nzg9ZpmiCaGYfOMkJGb/4EFAmqR5uMACgkQYfOMkJGb /4HmSw//behOuqAjgDZ8kwxs/WCfdXz4Tz+hr/tFUkHgCMpq5XFKZVBonY5s6eEB y4Wei0JXURTt+Yex7aH7y22g5lIwaOYA8KGklnPGsHerPR9Xpr9PucNq7YjL8EN2 hfND4jHjWtIl/8Z61/D24Dq7zbzY2oNcBt2rnAboKpEQuGOrCR4imuRkVZ182XzL wtsoMwcWYhUIpCvQ87vhUJy9IyJrwHBPRe8ziUoDfxAjQdgKBCcJ2g9hDOQY910A UphBIyAaXfap5QEBhiV4bYJd3+HM0FC/G7zH5MX6+AP19253ODuN8jlq1zCKYiwx h3uEweshhTrEQJPUh5YClRPKs4h3dkRfUPEzzW5UXtoCS75Slcdtoc/A/mf7YTTB dRKaeqyJq6WboVOcLllO6EyJtk8Wrp4YwtMHXwDpi86sHtqcPPuAQMwt5uPomJDU kTvsxfGGaLV+G+pKvjfKH6iLEAPI3gNGcjMJXdH9WPqP+w7lsGDwJR3BCIOZsFoV 8oB4rzjtlkNOTo/WD8Ijo1VU5QT4yhzDC2SYhaoJCL95fMxaay5AIlbN8k3gDalE eIlTgbcyi2qyyTV4+JjjqXdCQwI9AGSoW7B0Y8mJgt5CzY0vl3A1kKa884d5tEOm auJAUgt4oXE2E5qLL5gMgqkiay8ofNNIEMhRpjY0g/yGSUnPPa0= =Nbl3 -----END PGP SIGNATURE----- Merge tag 'for-linus-7.3-1' of https://github.com/cminyard/linux-ipmi Pull ipmi updates from Corey Minyard: "Several cleanup on error fixes and a missing RCU wait and proper validation on a received message in one place. The biggest change is the initialization of the driver can be done asynchronously on a work queue. That saves significant boot time" * tag 'for-linus-7.3-1' of https://github.com/cminyard/linux-ipmi: ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user() ipmi:msghandler: Cancel work cleanly on an error ipmi:si: Add async init to ipmi_si char: ipmi: use named initializers for acpi_device_id ipmi: Fix leak in __ipmi_bmc_register ipmi: Remove all sysfs files on registration failure ipmi: si: Fix NULL pointer dereference after failed registration ipmi: ipmb: validate write message length |
||
|
Linus Torvalds
|
548e7bcd0c |
A wide variety of mostly CephFS fixes and cleanups, split between
changes that address edge cases (Sam, Xiubo, Matthew), efficiency improvements (Max) and AI-assisted hardening (Michael, Jeremy). One thing that stands out is Alex's change to how CephFS behaves in NEARFULL scenarios: the long-standing "make all writes synchronous" behavior has become opt-in. It was always somewhat controversial and doesn't make much sense for modern deployments; the new default is to continue normal operation (i.e. buffer writes as MDS allows, etc). The behavior in case the cluster reaches any FULL state remains the same as before. -----BEGIN PGP SIGNATURE----- iQFHBAABCgAxFiEEydHwtzie9C7TfviiSn/eOAIR84sFAmqRz9QTHGlkcnlvbW92 QGdtYWlsLmNvbQAKCRBKf944AhHzi/63CACpEmwY/3lOZ4M0IQV2UJqSWzNNtUDI Hdq7hosk5gRXP/gG1bV63i935Ibe/Sp6Cb/XkTRcrPIxy/1eky8PDZN3knPlPocM TMAdLKUOzzpmehqORWdVsEGSYIXuIfVhrey30pfHVLQc86orTj7worDZydYl8r3L K6nAM8gfcT9l9Sd4jtquaT61kqCcjXKPANlvUtt8oqniMRdpL63GnFHaU33n3XTE 5Dalh4YHtIL4gTA6xZLbZqOq+99QbmmqlqlMiwFNtrfpVtPO7HWHrEy61mYrKW7U Nr7HRF6X+MeUngZVI5AgrH5K6HtlE0SeHZt2XSKuMKGMG+I4dcygUcSr =F8+z -----END PGP SIGNATURE----- Merge tag 'ceph-for-7.3-rc1' of https://github.com/ceph/ceph-client Pull ceph updates from Ilya Dryomov: "A wide variety of mostly CephFS fixes and cleanups, split between changes that address edge cases (Sam, Xiubo, Matthew), efficiency improvements (Max) and AI-assisted hardening (Michael, Jeremy). One thing that stands out is Alex's change to how CephFS behaves in NEARFULL scenarios: the long-standing "make all writes synchronous" behavior has become opt-in. It was always somewhat controversial and doesn't make much sense for modern deployments; the new default is to continue normal operation (i.e. buffer writes as MDS allows, etc). The behavior in case the cluster reaches any FULL state remains the same as before" * tag 'ceph-for-7.3-rc1' of https://github.com/ceph/ceph-client: (32 commits) ceph: force a cap message when a deferred revoke can't be acked immediately libceph: reject buckets with mismatched CRUSH ids ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode ceph: fix leaked inode reference on writeback abort at umount libceph: remove ceph_put_page_vector() libceph: validate banner payload length ceph: make nearfull sync writes opt-in ceph: do not repeat ceph_trim_dentries() if no progress possible ceph: drop mdsc->mutex before decoding the MDS reply ceph: fix UAF in check_new_map() on session freed during unlock ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock ceph: pass inode pointer around instead of reloading it ceph: mark cap remove with RB_CLEAR_NODE() instead of setting ci=NULL ceph: add helper function ceph_cap_is_removed() ceph: make __ceph_remove_cap() static ceph: cap delegated inode count in ceph_parse_deleg_inos() ceph: bound num_export_targets array for mds info v2/v3 ceph: bound MDSCapAuth path and fs_name decode in handle_session() ceph: bound xattr value length in __build_xattrs() ceph: bound copied dentry name length in NFS export get_name ... |
||
|
Linus Torvalds
|
ce727a090b |
This pull request contains updates for UBI and UBIFS:
UBI: - Support for a per-device wear-leveling threshold - Various fixes and cleanups of error paths - Correctly preserve torture flag up wear-leveling UBIFS: - Various fixes and cleanups of error paths and kernel-doc -----BEGIN PGP SIGNATURE----- iQJmBAABCABQFiEEdgfidid8lnn52cLTZvlZhesYu8EFAmqRnEsbFIAAAAAABAAO bWFudTIsMi41KzEuMTEsMiwyFhxyaWNoYXJkQHNpZ21hLXN0YXIuYXQACgkQZvlZ hesYu8HaKhAAuU11eCVhmQk9jpIdaOnFKwokE/PIj23SRz13jc7PWmFbAIHiaVt4 0p1Xd59kPfdFqsfBo6ZgSr+f0cQu2N1MjzZYSmaklG5iJk2+IuMOIvNdve/GFzNg X86J7yxLtrCq+ULNNgGv0m89G/uYoFP27Su0rAid4D2T5gYEOisXpPw5AhAL6+bS FLRMlt0QWCAtb66FmSeDgTW042NPoSCZNOsxF35X9hQ6RxvftB8mbggmTummmlgb K9Nsuwkarterq7JhS4X+RL6aZG7yDPfHVpdCDD6Ui4W0SP59W0oSokikm1myw6Yg 9NH67jUD03s0y/z3QaNiTVPuQXz5dpUyxGzK/FCT8y2aiycCDmwWF0VG8MVMhC0j TmNiuSWAljweaPSsgF176ISRG63++zwMGtz/JclVlkUwkVKYFbpEv5lcT0EzfCqh ahBlpM2aCLgJaYExd6LSVKEu0tT3+x+2MJDnRWcZM2OPMuL65IQw5V2lbdJN78Gb XFX6bfolhneptc2JwQKJx8E72iW7zuFovprTyS/J+TNcceFbfQTTcFt9EFZaXWnh +wiWm7rL7Xp9t8MA4Sc979oKFJMkAMl3Z6WTUHJWUZicX2hK+3OQaCVNO8LO/izu nPanrTeBnRiBKuAc5skQN5ywaAD3GgG/5ERWP/tdHkdsx34pcvuPnHQ= =+fCs -----END PGP SIGNATURE----- Merge tag 'ubifs-for-linus-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs Pull UBI and UBIFS updates from Richard Weinberger: "UBI: - Support for a per-device wear-leveling threshold - Various fixes and cleanups of error paths - Correctly preserve torture flag up wear-leveling UBIFS: - Various fixes and cleanups of error paths and kernel-doc" * tag 'ubifs-for-linus-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs: UBI: support per-device wear-leveling threshold UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC mtd: ubi: Release device reference on busy detach ubi: Fix rollback for explicit UBI device numbers ubifs: fix out-of-bounds read in signature length check UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs UBI: Preserve torture flag when rescheduling failed erasures ubifs: ubifs.h: clean up kernel-doc comments ubifs: key.h: use correct function parameter name ubifs: debug.h: fix kernel-doc struct prototypes |
||
|
Linus Torvalds
|
115bd364ab |
f2fs-for-7.3-rc1
In this round, key enhancements focus on reducing inode management memory
overhead, introducing resizable tail sections with unified pinned allocation,
and boosting I/O throughput via parallel multi-device flushes and asynchronous
f2fs_write_end_io() execution. We also add dynamic device alias reservations to
allow on-the-fly space donation from user partitions.
Alongside these features, critical bug fixes resolve folio race conditions,
lingering dirty flags, dentry and block counter leaks, and potential deadloops
in f2fs_fsync_node_pages(). Additional stability patches address error-path
handling across symlink, sync, and rename/unlink operations, prevent pinned file
fragmentation, and correct segment migration and free section accounting in
free_segment_range.
Enhancement:
- reduce memory footprint of ino management
- support dynamic reserve/release for device aliasing
- issue multi-device flushes in parallel
- add a way to run f2fs_write_end_io() asynchronously
- support resizable tail section and unify pinned allocation
Bug fix:
- fix to pass folio->index to f2fs_sanity_check_node_footer()
- fix folio_nr_pages() race after put in large folio invalidate
- fix to clear dirty flag on folio in error path
- accurately adjust free_sections during free_segment_range
- fix to avoid potential deadloop in f2fs_fsync_node_pages()
- fix the error path in symlink, device alias in rename/unlink,
f2fs_sync_fs,
- fix to migrate all curseg types during free_segment_range
- fix to avoid pinfile fragment on fragment:{block, segment} mode
- fix valid block count leak on data block allocation failure
- fix dentry folio leak in find_in_level
- reject overlapping move range after len expansion
- fix some bugs related to file pinning, GC functions, i_size.
And, the series includes a number of minor bug fixes.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE00UqedjCtOrGVvQiQBSofoJIUNIFAmqPybMACgkQQBSofoJI
UNKp2g/+OP6XZi56hNTqscnKyKrDdVJnOcS/YOe7d1BR+070qmPTpyFjLgjng05K
exu55rz9vJ3DlpFLsjMEo60DRlDEc5rR4AqymMjqFJH9424ZlxPpdDn6ofCVT0Ck
D6RTf3y1HFSi4x7//gPQofR9y4MlDrH2Q7NPDriipqbymuNXEjrx/vdr2nq/kHUu
2lbf7QQs08qYiyDxQcxOFdCdxUTrsEW/tkYZiwgbU2nCJ/eG2R59amgtYJg3SlVt
xdrf+IaSS7kE5+mGCoBm0WooPpB507kHaoQpZYDj2uueFvEw7nFcSfOCXapOvg8U
wFkRR0F/rZ4+AW/u4n8Ye7N4a7WjWMTBwfR3WJ2j+arhfn87vJZK6LQQlYwq16l4
tRcQFcCrKsXHh5HY2OGj8DzTd40zryXujH566YioBCAXU312My1yFjeTJzjobbUW
TclkfMl689iTr9pqBhIjKT2tTvZFLROYSLk5UBNFNSfA4PtsAAhqlUrE1ck3AuTA
8kIjLmppfZEBqVuZCF0T1z9TXk0Bg0eM8qHbl/8SdDavmf1pF1BupLqchfdZp6Jr
4iV1weK4dzmCF6++YDsNlvnBGyTbhiFdN7C5cMlv89PTSTUQZ45Me6JmNwrRDqyU
MSTyiSSpI+3rAMO0h58PHi+QAOtM0f+S7C24ySkBBerBCbMTK6A=
=xQ77
-----END PGP SIGNATURE-----
Merge tag 'f2fs-for-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs
Pull f2fs updates from Jaegeuk Kim:
"In this round, key enhancements focus on reducing inode management
memory overhead, introducing resizable tail sections with unified
pinned allocation, and boosting I/O throughput via parallel
multi-device flushes and asynchronous f2fs_write_end_io() execution.
We also add dynamic device alias reservations to allow on-the-fly
space donation from user partitions.
Alongside these features, critical bug fixes resolve folio race
conditions, lingering dirty flags, dentry and block counter leaks, and
potential deadloops in f2fs_fsync_node_pages(). Additional stability
patches address error-path handling across symlink, sync, and
rename/unlink operations, prevent pinned file fragmentation, and
correct segment migration and free section accounting in
free_segment_range.
Enhancements:
- reduce memory footprint of ino management
- support dynamic reserve/release for device aliasing
- issue multi-device flushes in parallel
- add a way to run f2fs_write_end_io() asynchronously
- support resizable tail section and unify pinned allocation
Bug fixes:
- fix to pass folio->index to f2fs_sanity_check_node_footer()
- fix folio_nr_pages() race after put in large folio invalidate
- fix to clear dirty flag on folio in error path
- accurately adjust free_sections during free_segment_range
- fix to avoid potential deadloop in f2fs_fsync_node_pages()
- fix the error path in symlink, device alias in rename/unlink,
f2fs_sync_fs
- fix to migrate all curseg types during free_segment_range
- fix to avoid pinfile fragment on fragment:{block, segment} mode
- fix valid block count leak on data block allocation failure
- fix dentry folio leak in find_in_level
- reject overlapping move range after len expansion
- fix some bugs related to file pinning, GC functions, i_size
And, the series includes a number of minor bug fixes"
* tag 'f2fs-for-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (51 commits)
f2fs: support resizable tail section and unify pinned allocation
f2fs: don't leave the hashed inode while it's unlinked
f2fs: accurately adjust free_sections during free_segment_range
f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages()
f2fs: use adjusted write range after f2fs_write_checks()
f2fs: fix to propagate error from f2fs_sync_fs()
f2fs: return symlink writeback errors
f2fs: fix error handling on device alias check in rename and unlink
f2fs: fix to reset all pinned status during fggc
f2fs: use f2fs_{down, up}_(read, write}_trace() for nat_tree_lock
f2fs: reduce memory footprint of ino management
f2fs: fix i_size when pinned fallocate partially fails
f2fs: fix to migrate all curseg types during free_segment_range
f2fs: avoid setting SBI_NEED_FSCK on transient resize failure
f2fs: fix to avoid pinfile fragment on fragment:{block, segment} mode
f2fs: cleanup w/ f2fs_need_rand_{blk, seg, seg_blk}
f2fs: fix to shrink gc_lock coverage in f2fs_gc_range()
f2fs: fix to reclaim space in f2fs_allocate_pinning_section()
f2fs: unify add/remove ino entry API for all ino types
f2fs: fix to zero post-EOF data when extending file size
...
|
||
|
Linus Torvalds
|
c20313e98b |
sound fixes for 7.3-rc1
A collection of various small fixes since the last PR.
Most changes are device-specific fixes, while there are a few fixes
addressing the issues reported recently by fuzzers.
Here are highlights:
* ALSA Core:
- Prevent adding invalid kcontrols to the LED layer
- Workaround for a false-positive mutex lockdep warning in rawmidi
* USB-audio:
- Relaxed the sticky mixer behavior check that caused regressions
- Fix an OOB write in Novation MIDI output
- Proper cleanup after system-resume errors
- Quirk updates for M-Audio Venom, Audient iD14 MkI, Logitech PRO X
Wireless, SMSL USB DAC, and Creative Sound Blaster Play! 3
HD-audio:
- Conexant headset plugin fixes
- Quirk additions and fixes for HP Laptop 15, Lenovo IdeaPad Slim 3,
TongFang XxAF5xxx, Lenovo Legion Pro 7, and Lenovo Yoga Pro 9
ASoC:
- DAPM: Fix off-by-one check on the second enum channel
- Tegra: Fix and sort register defaults
- AMD quirk updates for ASUS FA401EA, HP OmniBook X Flip 16,
HVY-WXX9/M1060, Alienware m18 R1, and MSI Thin A15 B7UC
- Fixes Qualcomm TDM handling
- Fix double put_device() on SoundWire
- Codec fixes for rt766, tac5xx2, rt712, tas2783, and max98926
Misc:
- Fix card leak on probe error on ice1712 driver
- Hardening for legacy aoa, mtpav and pcxhr drivers
-----BEGIN PGP SIGNATURE-----
iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmqROH8OHHRpd2FpQHN1
c2UuZGUACgkQLtJE4w1nLE/7Xg/9Ec3MYiAC8f60hMck0YwCxeOEABtSwRI5omKy
tYpRiKtLgjDRQ2i7Cbtaq9c3P0QOMLhr3ht01oQli+Bo8B/ojsG0oF1H+AjoN7c3
oyLMKWB18CTUCKWomyOEXjpYniKEjoTZNF/KjAuGPHo+fOPT9jOLJvwEmULS5OQq
+kYUen745xwu096TI9qK18I6W/uuasEDzgN7lv/RFOMH0IpT7Rm4BY9W37kFoGgz
IWGFz/+rsTl8D9LBf66SRp/Bes1nqNqXNkFISVkYDkAA+7Uii0H4nwFOrPa/pqqT
PucRknZT/oALkdtsTk2pR0gksu4Z6uVz1NjafeuLJSgdX9D9xKa3CYmLFVJQaLS2
acOXZaQDMPTNe3M7J+Ut+yD+7S+vMXf/HiQqjyDLasAr26DBqSb0SeBMOgQk0YJd
+467H+gH6AWl/TDc0bSuqoX0MMYQ2CSb1Wz0iyxCCQEY1brlsO/kSRTGpVnoSqvY
6sD21QQjaiIe1CkMXOELoD5g4c2WnZ2X0jEJq12wHMXW9ZkKaXX6Yu9HyfrI4KAX
/hISULNVeyxcrZcAUI7rbEuSTJ3fC7O5smfPASaCoytvA01flTxXx6NYJJKPbcNA
4bqWeymN0xtE7CHAkvFG/gCK9xC4oMCZEMgEK2/kVCqaUUsCR4GhJotupo2IKZ3k
HstnykY=
=odYe
-----END PGP SIGNATURE-----
Merge tag 'sound-fix-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"A collection of various small fixes since the last PR. Most changes
are device-specific fixes, while there are a few fixes addressing the
issues reported recently by fuzzers.
Here are highlights:
ALSA Core:
- Prevent adding invalid kcontrols to the LED layer
- Workaround for a false-positive mutex lockdep warning in rawmidi
USB-audio:
- Relaxed the sticky mixer behavior check that caused regressions
- Fix an OOB write in Novation MIDI output
- Proper cleanup after system-resume errors
- Quirk updates for M-Audio Venom, Audient iD14 MkI, Logitech PRO X
Wireless, SMSL USB DAC, and Creative Sound Blaster Play! 3
HD-audio:
- Conexant headset plugin fixes
- Quirk additions and fixes for HP Laptop 15, Lenovo IdeaPad Slim 3,
TongFang XxAF5xxx, Lenovo Legion Pro 7, and Lenovo Yoga Pro 9
ASoC:
- DAPM: Fix off-by-one check on the second enum channel
- Tegra: Fix and sort register defaults
- AMD quirk updates for ASUS FA401EA, HP OmniBook X Flip 16,
HVY-WXX9/M1060, Alienware m18 R1, and MSI Thin A15 B7UC
- Fixes Qualcomm TDM handling
- Fix double put_device() on SoundWire
- Codec fixes for rt766, tac5xx2, rt712, tas2783, and max98926
Misc:
- Fix card leak on probe error on ice1712 driver
- Hardening for legacy aoa, mtpav and pcxhr drivers"
* tag 'sound-fix-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (53 commits)
ALSA: control: Don't add invalid kcontrols to LED layer
ASoC: amd: acp-config: change quirks to cover all ASUS FA401EA variants
ALSA: hda/conexant: Always enable the headset-mic pin on plugin
ASoC: dapm: Fix off-by-one check on the second enum channel
ASoC: amd: acp-config: force SoundWire probe on HP OmniBook X Flip 16
ASoC: amd: acp3x-es83xx: Add HVY-WXX9/M1060 DMI quirk
ASoC: amd: acp-config: Add HVY-WXX9/M1060 DMI quirk
ASoC: soc-generic-dmaengine: Fix DMA channel request warning
ALSA: rawmidi: Another workaround for false-positive mutex lockdep warning
ASoC: amd: yc: Add DMI entry for Alienware m18 R1 AMD
ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC
ALSA: hda/realtek: Fix speaker mute LED for HP Laptop 15-fd0039nt
ALSA: usb-audio: Complete cleanup after system-resume errors
ALSA: hda/realtek: Add quirk for Lenovo IdeaPad Slim 3 15ABR8
ALSA: aoa: i2sbus: Check IRQ before requesting it
ALSA: usb-audio: Skip mixer creation on M-Audio Venom
ALSA: usb-audio: Skip reading sample rate on M-Audio Venom
ASoC: rt766: add RT766/RT767 VA1 device IDs
ALSA: hda/realtek: Add quirk for TongFang XxAF5xxx
ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
...
|
||
|
Linus Torvalds
|
275bc4eedf |
RTC for 7.3
Subsystem: - patchwork project is moving to kernel.org - fully initialize clk_init_data - add missing MODULE_DEVICE_TABLE() - DT bindings conversions to DT schema Drivers: - ds1307: fix WADA bit for alarms on RX8130 - rzn1: add support for RZ/T2H and RZ/N2H, many fixes -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEBqsFVZXh8s/0O5JiY6TcMGxwOjIFAmqQtsEACgkQY6TcMGxw OjJlIhAAoIwDLpLYkKfiZ+WIEcYOQkEnU7TYGD9R01oNSlGFEUkKEd5oATm4Dmz7 DfNYEFi6oPF+GJVQyVFQVxOroaKdfG80KW1ydXQVk7oMUuqW6L/juivjncGm17r+ rzMOUaSFYOCGJkvsEqTNZBz6aBHV89pTIeuwDqeTrZvkJOUHDwcKvHh401AKnIif cylLWGu72ai8+qz/9+wBY7lVDEEnW4DsYc4JjLhpc5p7B/rtHgaiyuI57KvAOZLr QP3nO+Ffoj5D+WSuT/eebVujEj7FM8cGbQwDUqgGKfAvZg4HDqcnMwUp6j3/Z1nQ Zt3DRq760oZoW9lXZEKZEOcvGh7AY/xNwNjF5kG/vAYLuHzlsne4T50BvtijUHUP KvDN6yt3acWOnr/VTikuf84lpZEgm6lxBj2ek7uxMBkSm+L22LPXl0zIhrymiHLQ dyq/DLADmpKuJPhogRhqEcQ0xEh30R46oxR4+84rjMLW7kTjNoX52oZ+n7vDctmJ Z5Tgup65WfR3T4AKgB/DHAQYomisaAEXn+mw+QuwsIV3xrBoMaxuMVwqdN/nM6yY cu20yTZK5Ap/o0oFPDoYT9jQqmyipTvHVba0Q3XCD63qg5zGW3DU77KpbEDyIgSa g5uvWQHQMafJrhnCsTKJw8plMKxec63KWyIrDOXHFAppypZYBPA= =Br8X -----END PGP SIGNATURE----- Merge tag 'rtc-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux Pull RTC updates from Alexandre Belloni: "The RZN1 driver got a fairly comprehensive cleanup. More DT binding are converted to DT schema, leaving only 5 remaining files to convert. Subsystem: - patchwork project is moving to kernel.org - fully initialize clk_init_data - add missing MODULE_DEVICE_TABLE() - DT bindings conversions to DT schema Drivers: - ds1307: fix WADA bit for alarms on RX8130 - rzn1: add support for RZ/T2H and RZ/N2H, many fixes" * tag 'rtc-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: (42 commits) MAINTAINERS: update rtc subsystem patchwork location rtc: msc313: Select by default on MSTARV7 rtc: microcrystal: Make sure clk_init_data is fully initialized rtc: philips: Make sure clk_init_data is fully initialized rtc: nct3018y: Make sure clk_init_data is fully initialized rtc: m41t80: Make sure clk_init_data is fully initialized rtc: hym8563: Make sure clk_init_data is fully initialized rtc: rzn1: Add support for Renesas RZ/T2H and RZ/N2H SoCs rtc: rzn1: Drop trailing comma from OF match table sentinel rtc: rzn1: Add OF match data to gate SUBU register access rtc: rzn1: use FIELD_PREP/FIELD_GET and GENMASK for register access rtc: rzn1: Consistently use dev_err_probe() rtc: rzn1: Use temporary variable for struct device rtc: rzn1: Dynamically calculate synchronization delay based on clock rate rtc: rzn1: Replace remove callback with devm_add_action_or_reset() rtc: rzn1: Use pm_runtime_put_sync() rtc: Kconfig: Broaden RTC_DRV_RZN1 dependency to ARCH_RENESAS rtc: rzn1: Fix malformed MODULE_AUTHOR string rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers rtc: rzn1: Fix alarm range check truncation on 32-bit systems ... |
||
|
Linus Torvalds
|
afe0579334 |
Hi,
I had to think a lot how to put this into few paragraphs. I hope this will makes sense to you and I'm not too confusing. The bulk of this pull request are Ross Philipson's TPM enablers for the Trenchboot patch series. The commits expose TPM constants, and decouple and improve robustness of tpm_buf a bit in order to implement a minimal early TPM driver. Early boot code will call either SKINIT on AMD or GETSEC[SENTER] on Intel before jumping into kernel's entry point. They re-initalize TPM PCRs but leave up to the early boot code measure initrd, boot_params and Trenchboot associated metadata. The motivation here is just that we would want in future iterations of the series put our full focus to the x86 part of the review, and call it a day as per TPM changes. Further, even if Trenchboot turned out to be empty lottery the worst possible outcome for TPM driver is that things get cleaned up a bit. BR, Jarkko -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRE6pSOnaBC00OEHEIaerohdGur0gUCapClFwAKCRAaerohdGur 0vM5AQDnmMUmfGD4aNBKx/b2gxPIgBy8KTGLDUp5sUSHGVGjuAEAzMLSz3BtTXSV 7GaPKWp81egVjgp5/zxTbA83mEwfAwk= =Pq4i -----END PGP SIGNATURE----- Merge tag 'for-next-tpm-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull TPM updates from Jarkko Sakkinen: "The bulk of this is Ross Philipson's TPM enablement for Trenchboot. That exposes TPM constants, and decouple and improve robustness of tpm_buf a bit in order to implement a minimal early TPM driver. Early boot code will call either SKINIT on AMD or GETSEC[SENTER] on Intel before jumping into kernel's entry point. They re-initalize TPM PCRs but leave up to the early boot code measure initrd, boot_params and Trenchboot associated metadata. The motivation here is just that we would want in future iterations of the series put our full focus to the x86 part of the review, and call it a day as per TPM changes. Further, even if Trenchboot turned out to be empty lottery the worst possible outcome for TPM driver is that things get cleaned up a bit" * tag 'for-next-tpm-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: tpm-buf: Add TPM buffer support header for standalone reuse tpm-buf: Memory-safe allocations tpm-buf: Remove chip parameter from tpm_buf_append_handle() tpm-buf: Merge TPM_BUF_BOUNDARY_ERROR and TPM_BUF_OVERFLOW tpm: Remove main TPM header from TPM event log header tpm: Move platform specific definitions to the new PTP header tpm: Move TPM common base definitions to the command header tpm: Move TPM2 specific definitions to the command header tpm: Move TPM1 specific definitions to the command header tpm: Initial step to reorganize TPM public headers tpm: st33zp24: Validate locality read result tpm: st33zp24: Return zero on status read failure tpm: tpm_tis_spi: fix nodef CR50 tpm_tis_spi_resume is null tpm: atmel: depend on X86 tpm: Remove redundant dev_err() tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout |
||
|
Linus Torvalds
|
9df08cdd33 |
This push fixes a memory allocation overrun in crypto acomp.
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEn51F/lCuNhUwmDeSxycdCkmxi6cFAmqRLjEACgkQxycdCkmx i6dErxAApAYijF83H3Lg+dxKoLispqaTjT5yZKXZES19WBViPhuigDoxOA9Ca5EB L5UkSdC3hTKKd5f6DfyHpv44rnUSc178h+DpIaprHFHG3XJcl7pgPi87dNc7RkgD e9rBUi95VcJdT8OfTuGNd5xw/xL4IJA9uOJ93vLZduh8YzN0UzjYioMzIFFhbKNu gl6mGKfqh17DWRc44/WJYtH0Yu9wEQ06d1mXcLNILwshcLnv++5P0aRRMqTgtVib S6npHnci9LJW8f4zxJhfJzPKhA6Ln/GUOpCloSLhamqOVyrbaR9EVnD2TizRhQDy 0VL6eardJBjJbclLTSt686+JMx6KVVqIWo81KgXlrXuEBPH1plrS5MRgv/yr595C 1dVjqrJCivh6L4qWJLIxcb2NF1fWj6n7WV16Bxw69xW7I8FAJXZjSPN3UzB7PaQz Ei9+IL/Cz3n7oj52hatR1T3LO2yrhgzUaVfkvWqumlNH8wILPWHAbZz4/07uwEo7 v8XqDXuChgn8JJH0fZ31tYEx8K1KfU09FdBqaTcZlMVOBDfKbfXovw0uONs1P+8h YJii2CdHrvOZxdLrta5NO7z2ZpNISpjmjvqendkExGV+7v/dxhesYKY98Js8WCBB z7ax+7sGzkEDMtzdxiXmCBl+PQoYazH9uiC8k9MXaFR/xo93Jgs= =fR1o -----END PGP SIGNATURE----- Merge tag 'v7.3-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fix from Herbert Xu: "Fix a memory allocation overrun in crypto acomp" * tag 'v7.3-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: acomp - allocate async request context when cloning |
||
|
Linus Torvalds
|
344be13211 |
ACPI support fix for 7.3-rc1
Revert an incomplete recent commit that may cause ACPI device power management to stop working. -----BEGIN PGP SIGNATURE----- iQFGBAABCAAwFiEEcM8Aw/RY0dgsiRUR7l+9nS/U47UFAmqRrBQSHHJqd0Byand5 c29ja2kubmV0AAoJEO5fvZ0v1OO1msIIAKj2Xn9VA93zUk/XANzhM/k0yrapAuPx qrimF5LyaCLcNEQwfdlHQMK9gOwLIjWon89JQ/7qK1ynG1Bqc+1X60n+lD066cMh s2h24QXvMfO2Ax9TqexXxQuD4TW8v23mUZBXKE6CSjH5rtUuhqL5AspsibSTQiPK p1YN9e1SZjLlvx1L1e7ctvQmp3wOiTlhAfYzPzjp18P6LHI4taae+l97MXPIVWQU 7vL6AbLZRt8UdGFiADkTtRpu+jA7ppTiCzA0r3i1WKkShLVuHioPXYG7eytSC2Tk pS026hi9qin7zMtAJxh2wwz1ZS/TzVtLhL5e7ZMUd425zRLy+RSR+Sc= =Q3HL -----END PGP SIGNATURE----- Merge tag 'acpi-7.3-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI support fix from Rafael Wysocki: "Revert an incomplete recent commit that may cause ACPI device power management to stop working" * tag 'acpi-7.3-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: Revert "ACPI: scan: Defer device power initialization" |
||
|
Linus Torvalds
|
9d607ae0f7 |
arm64 fixes for -rc1
- Fix address handling of final memory region in ptdump - Fix emulation of decrementing load/store multiple from 32-bit task - Fix SCTLR context-switching for store-only MTE mode - Fix numerous issues in MTE selftests -----BEGIN PGP SIGNATURE----- iQFEBAABCgAuFiEEPxTL6PPUbjXGY88ct6xw3ITBYzQFAmqRTQQQHHdpbGxAa2Vy bmVsLm9yZwAKCRC3rHDchMFjNAXpCADI7oz3aSuRJ3aRmMz5Vv4EvPjTrNcc5gi0 H91Qkl+UMN0DJGqt+1ZZBhm6Kv3rvrtj6UaEk1SycEV+jg2IWbhd1C1UTZCd5Lf9 0jiJdsoOgeTKahhFX9pU+QJCNpFqI+DORc+TYWB2uwN39OWPrHOXgJtdePNNYb1h UyCIRK+PEbXnA6LDxWokuzO70EddRIcpW2eT7WOWpgA2FNwN5DzsXdviosylZAtp xhjvpTJv/LNbMeBXalH91IKDbRCAWEvEY8j2BSOkcFxGFOA3aXrVh5sWKdFeqKis VoWZQTDtpHj1Mw0eCMn77H0r6uxXn/skCcd8pwfIFA7EnGguAcBB =/QWC -----END PGP SIGNATURE----- Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "A mixture of ptdump, compat and MTE fixes that came in during the merge window: - Fix address handling of final memory region in ptdump - Fix emulation of decrementing load/store multiple from 32-bit task - Fix SCTLR context-switching for store-only MTE mode - Fix numerous issues in MTE selftests" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: selftests/arm64: Add MTE test config fragment selftests/arm64: Fix MTE prctl TAP plan selftests/arm64: Treat KSM merge_across_nodes as optional selftests/arm64: Print missing MTE TAP headers arm64: compat: Fix decrementing LDM/STM alignment emulation arm64: process: Fix context switching MTE store-only tag check KVM: arm64: ptdump: Flush the last region arm64: ptdump: Make note_page_flush() range aware |
||
|
Linus Torvalds
|
72ecc30d60 |
Xtensa updates for v7.3
- use strnlen() to improve iss_console_write() - remove unused function setup_profiling_timer() - fix CONFIG_XTENSA_CALIBRATE_CCOUNT macro name in comment -----BEGIN PGP SIGNATURE----- iQJHBAABCgAxFiEEK2eFS5jlMn3N6xfYUfnMkfg/oEQFAmqRXFYTHGpjbXZia2Jj QGdtYWlsLmNvbQAKCRBR+cyR+D+gRJ0MD/4tuDraKBOimGv/U23u8Aphgc7z8TSH fyy6kHKLMfAX4rJ1ks/91urzOCZ9xX81DNNGF4KxGeB+YAEhUn7Su+dA5v2Aay8O o9oZaT9IZybxu+OF54N4HBYmbVKA6qh283daW7ZBDtKNPQUmmmxKnCjoZv1bJF4D Qa8cmmRsgK/t9S5MUmgqpij3d4EnD8zK6uRRNy5r1NPPRi+TPWugDt9h/ZaSQ9+/ nReqRu8q3xn9Xuy3zus27kd5KdnUDKM51boBEvh74OpPbL58HINlyPf3VdyHTOfH ZM2RQS8UZWmlHpbVNlrH+zRMShQKSIPWDEidP5P4oGs+jiEnuYUKDuRQlUQwdIbL BSxuRXe18AWN1kDbZkdCuLtKPL9ayxBD0/tgFIdUpropET77jGl7VnVDxCtOvJxk cfAM+qG9kER6+HsAzGo0T0o4n7oTNQ++TIaDRI+E1Yvd+E5FKfQhbG+kWaM9SB+y T/Ht4OTgF2QSflCg5T+4PBJmrTC9AUHDpZFp/SIF5agTsNCEU6x4jcYYiaREAIDK E5S2xBONUBdakNWevzT/c0M3NxbcTf0Zkmxx2y/A9HtrmPMjdIRPRaMBc2csO5he M70l70SLoOtmQFLIAOP3FuCc5CuiWaxMFj8nCvVu7UUiBHOr6Q939n5+j8h1EsXJ qsDBz6otDoR6Cg== =Lvt4 -----END PGP SIGNATURE----- Merge tag 'xtensa-20260828' of https://github.com/jcmvbkbc/linux-xtensa Pull Xtensa updates from Max Filippov: - use strnlen() to improve iss_console_write() - remove unused function setup_profiling_timer() - fix CONFIG_XTENSA_CALIBRATE_CCOUNT macro name in comment * tag 'xtensa-20260828' of https://github.com/jcmvbkbc/linux-xtensa: xtensa: remove unused setup_profiling_timer function xtensa: correct CONFIG_XTENSA_CALIBRATE_CCOUNT macro name in comment tty: xtensa/iss: use strnlen to improve iss_console_write |
||
|
Linus Torvalds
|
874b43b9f3 |
m68knommu: updates and fixes for v7.3
, new defconfigs for 2 more ColdFire boards . change to use linux/gpio/legacy.h . add platform setup for reset device of the 5441x SoC boards -----BEGIN PGP SIGNATURE----- iQJEBAABCgAuFiEEmsfM6tQwfNjBOxr3TiQVqaG9L4AFAmqQ02gQHGdlcmdAa2Vy bmVsLm9yZwAKCRBOJBWpob0vgLezD/9e8dYKwAtkclfd6wkSBVoBIG2f3yFWKDaf 0lAV/oZJjvo4lEAbS4ADzQUnFjn+MIQBRi9QL4TaekDJx612BNK3OF71etOT/7o6 h0EylRBoZ6SDSjFlm9jEtf+nu1XzlfAwRkE229pKAmPK0OBI9+z0/XQTjCh8Ag8h 1afRS3DoPDpku8vIU24LlbUtD89m1YjesRayL2KI7mBS4TTatGo+IeGPNlmJGIcz 03SytqwhxK3r1QNecOOVDOpxx9efPHWNkgo5fDi+N3XkPRm2X3ruAlsGbfvbNeZG pi30nugw57oAzBrUGSKYetdd9v/452Q336+CiDG1rVTQiJomgcW6Gu+Ps5jS9JpD b8aujjCnGVmfD7r3VQG4o96dgQFvB2hM4zQtslTagbTAWUYOBcDNSgtClGkfS2OB gxBTPGS0Ulos2CzQWoPW4LqP3k+8EcEsLUb5CNZGX3XlAWeoFOunS4lmtdxqJ7hD ndtINEBUE74C6+ns3RvIKhUKKZOIqwkqxYdw2ScsPxJlupDZssFdBEVEh4AQkFz8 UywfPwG6pWXD2Qj/FPpX3miU79jl9gawfnZv+KT9VZy+KjoZrS05WfrFFu9AB4rI BR8kXnynUCpn4RWqWVF+z+sJSPwWqJbQmZU5uyithMUb0OFyWzKFvggVja4B0Qit nbb09BEuWA== =JjnP -----END PGP SIGNATURE----- Merge tag 'm68knommu-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu Pull m68knommu updates from Greg Ungerer: "This includes a couple more new defconfigs to improve test build coverage, changes to use the more correct linux/gpio/legacy.h and platform setup for the reset device of the ColdFire 5441x SoC hardware. - new defconfigs for 2 more ColdFire boards - change to use linux/gpio/legacy.h - add platform setup for reset device of the 5441x SoC boards" * tag 'm68knommu-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu: m68k: coldfire/5441x: register mcf-rcm-reset platform device m68k/coldfire: replace linux/gpio.h inclusions m68k: defconfig: add config for M5282EVB board m68k: defconfig: add config for M52358EVB board |
||
|
Dave Airlie
|
a8b02aa825 |
amd-drm-next-7.3-2026-08-27:
amdgpu: - MES fixes - Userq fixes - UVD fix - VCE 3 fix - Enforce isolation fix - HPD fix for VGA/LVDS - DML fix - DCN 6 fixes - DC gpu reset fix amdkfd: - CU occupancy for GFX 11 - CU occupancy for GFX 12/12.1 - Queue bounds checking fix - SVM fixes - CRIU bounds checking fix -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQQgO5Idg2tXNTSZAr293/aFa7yZ2AUCapCelwAKCRC93/aFa7yZ 2FOmAP9u55LTGI137PLTeFN9INERvW8NcYsyhW2BHRR60cA9mQEAmvepnMcTMrtC yYey6hwuRp/8KYCbxk2bd7TK+ZUbGQE= =rLPa -----END PGP SIGNATURE----- Merge tag 'amd-drm-next-7.3-2026-08-27' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-7.3-2026-08-27: amdgpu: - MES fixes - Userq fixes - UVD fix - VCE 3 fix - Enforce isolation fix - HPD fix for VGA/LVDS - DML fix - DCN 6 fixes - DC gpu reset fix amdkfd: - CU occupancy for GFX 11 - CU occupancy for GFX 12/12.1 - Queue bounds checking fix - SVM fixes - CRIU bounds checking fix Signed-off-by: Dave Airlie <airlied@redhat.com> From: Alex Deucher <alexander.deucher@amd.com> Link: https://patch.msgid.link/20260827203610.3249084-1-alexander.deucher@amd.com |
||
|
Dave Airlie
|
1dd31281a6 |
Cross-subsystem Changes:
- i2c global register definitions as dependency for xe/i2c fixes. (Heikki) Driver Changes: - Media workardound (Daniele) - Add CCS to gt_idle debugfs print (Bala) - Page fault related fix (Arvind) - i2c related fixes (Heikki) - System Controller mailbox bit fix (Anoop) -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEEbSBwaO7dZQkcLOKj+mJfZA7rE8oFAmqQaxYACgkQ+mJfZA7r E8qk4Af/bhSe/FRSilbfWyH++BqBM2141oAtR2TXyZCEdRPSEr4sBLAJ0UlZyrKE 50gVsvnmwpBMnb/h4AQWRnAEjs8FahgkDeRECwj8HXfBvAM5i/jA3v7r3DnP8WOL cNmdv8l+Bs6JO60bjsfjiDo6HFQfvfvk52Tbn1xw/zX9jlugm18Vl4tg5U7H0jaK 60QCgRNN3CJtFFW7Xb9qwJuVkchOxijnx5o9N57ms/6riXLSquwFvCxTqvRMO5mJ RVJpMgaU3qRz0XWi8eA+jF5a8bBUksrf3xiDhOpO3jSdzgIoXXkHPer+nDJFld15 H4K0WtUwGuULXjL6euh7AC/e9GOrSw== =3/XE -----END PGP SIGNATURE----- Merge tag 'drm-xe-next-fixes-2026-08-27' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next Cross-subsystem Changes: - i2c global register definitions as dependency for xe/i2c fixes. (Heikki) Driver Changes: - Media workardound (Daniele) - Add CCS to gt_idle debugfs print (Bala) - Page fault related fix (Arvind) - i2c related fixes (Heikki) - System Controller mailbox bit fix (Anoop) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patch.msgid.link/apBrVgvZwIRIfuhR@intel.com |
||
|
Ivan Immanuel Shaji
|
5eab74874d |
ring-buffer: Stop remote reader update when page swap fails
The remote swap_reader_page callback can return -EBUSY when the writer
moves the head before the remote catches it, particularly during an event
storm on a small buffer. __rb_get_reader_page_from_remote() currently
warns about that failure but continues with the unchanged reader ID and
rearranges the local page list as though the swap succeeded.
Handle the callback failure as a recoverable error. Report it with
pr_warn_ratelimited() and return NULL. Callers already handle a NULL reader
page as a failed attempt. This avoids splicing the same page as both the
previous and new reader without flooding the log under contention.
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Ivan Immanuel Shaji
|
e0d3aed7b1 |
tracing: Fix retry exhaustion in simple ring buffer reader swap
simple_ring_buffer_swap_reader_page() starts with retry set to 8 and
post-decrements it only after a failed link replacement. On the final
attempt, a successful replacement leaves retry at zero, while a failed
replacement leaves it at -1.
The current !retry test reverses both outcomes. It returns an error after
a successful final replacement, leaving the link update complete but the
reader bookkeeping unfinished. After a failed final replacement, it
falls through and updates the head and reader pointers as though the
replacement succeeded, which can corrupt the ring.
Treat only a negative counter as exhaustion and return the documented
-EBUSY error.
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Jérémy Jean
|
390f6bd858 |
tracing/user_events: Clear copied tracing state before fork duplication
dup_task_struct() copies user_event_mm from the parent into the child,
without grabbing a reference to it. user_event_mm_dup() should
replace it, but it leaves that copied pointer unmodified if
user_event_mm_alloc() fails.
When the child exits, user_event_mm_remove() decrements a reference
the child never owned, which ultimately frees user_event_mm, while
the parent still as a stale pointer to it. This creates a UAF, which
KASAN reports as:
BUG: KASAN: slab-use-after-free in
current_user_event_mm+0x51/0x1d0 Write of size 4 at addr
ffff888005010d30 by task init/44
Call Trace:
<TASK>
kasan_report+0xce/0x100
kasan_check_range+0x10f/0x1e0
current_user_event_mm+0x51/0x1d0
user_events_ioctl+0x82e/0x15c0
__x64_sys_ioctl+0x139/0x1c0
do_syscall_64+0xce/0x450
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Allocated by task 44:
__kasan_kmalloc+0x8f/0xa0
__kmalloc_cache_noprof+0x180/0x3a0
user_event_mm_alloc+0x3c/0x1f0
current_user_event_mm+0x88/0x1d0
Freed by task 42:
__kasan_slab_free+0x43/0x70
kfree+0x13a/0x390
process_one_work+0x696/0xf90
worker_thread+0x420/0xba0
The fix simply clears the copied pointer before any possible failure.
In case of failure, the child then has nothing to free.
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Vasileios Almpanis
|
b15b548d52
|
i2c: core: fix debugfs UAF on adapter removal
i2c_del_adapter() frees the adapter's debugfs directory before it
unregisters the adapter device, but the new_device sysfs attribute
stays writable until device_del(). A write racing with removal still
reaches i2c_device_probe(), which passes the freed adap->debugfs to
debugfs_create_dir() as the new client's parent:
BUG: KASAN: slab-use-after-free in lookup_noperm_common+0x407/0x430
Read of size 4 at addr ffff88803ef87810 by task syz.0.61/6090
lookup_noperm_common+0x407/0x430
simple_start_creating+0x9c/0x110
debugfs_start_creating+0xdb/0x1a0
debugfs_create_dir+0x24/0x350
i2c_device_probe+0x814/0xbf0
It's technically possible to create a client after i2c_deregister_clients
has run. That client will never be unregistered and make
wait_for_completion hang.
Close the window by removing the new_device attribute at the start of
i2c_del_adapter(). device_remove_file() will drain any clients left.
Fixes:
|