mirror of
https://github.com/torvalds/linux.git
synced 2026-10-23 23:51:02 +02:00
eadfe727dd
1485157 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Christian Brauner
|
eadfe727dd
|
selftests/filesystems: test that a mntns file can't take over a lock
Add a case to the locked mount test: - a bind of the mount namespace file of a grandchild moved beneath a locked cover must fail with EINVAL - a bind of an ordinary file beneath it takes the lock over, the old cover can go and the new one can't - the file is still covered after unshare(CLONE_NEWNS) Link: https://patch.msgid.link/20261014-work-namei-locked-mnt_ns_file-v1-2-24035bd5d8e9@kernel.org Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org> |
||
|
Christian Brauner
|
69fbe94f80
|
namespace: a mount that copy_tree() leaves out can't take over a lock
Since commit |
||
|
Christian Brauner
|
a7064be65f
|
Merge patch series "fs: don't let idle threads pin the initramfs"
Christian Brauner <brauner@kernel.org> says:
Since v7.0 nullfs is the real rootfs and userspace can pivot_root() away
from the initramfs and unmount it. systemd does exactly that and the
initramfs is supposed to be freed afterwards. But it isn't (cf. [1]).
The unpacked initramfs stays around forever. It shows up as Unevictable
in /proc/meminfo with ramfs and as Shmem with tmpfs. In the reports
that's between 70MB and 150MB.
Two things keep it alive and neither is visible from userspace:
(1) On v7.0 to v7.2 devtmpfsd unshares a copy of the initial mount
namespace which since nullfs contains the initramfs mount. It
doesn't show up in /proc/<pid>/mountinfo because it's below the
thread's root. That's already fixed in mainline by commit
|
||
|
Christian Brauner
|
d2bdb9b61b
|
fs: let idle threads share init_fs
With nullfs as the real rootfs userspace can pivot_root() away from the
initramfs and unmount it:
chdir(rootfs);
pivot_root(".", ".");
umount2(".", MNT_DETACH);
That's what systemd does and the initramfs is supposed to go away at
that point together with all the memory it uses. But on every machine
with more than one possible cpu the initramfs superblock stays around
forever (cf. [1]). With ramfs as rootfs the unpacked initramfs shows up
as Unevictable in /proc/meminfo, with tmpfs as Shmem, and it is never
freed. In the reports that's between 70MB and 150MB.
The idle threads of the secondary cpus are created by fork_idle() from
smp_init(). That runs in kernel_init(), i.e., in PID 1, after
init_userspace_fs() moved PID 1 from nullfs into the initramfs.
fork_idle() doesn't pass CLONE_FS so each idle thread gets a private
copy of PID 1's fs_struct and with it a reference to the initramfs as
root and as pwd.
pivot_root() relies on chroot_fs_refs() to move everyone whose root or
pwd is the old root over to the new root. Idle threads aren't on the
task list though so chroot_fs_refs() never finds them. They never exit
either. So they keep the initramfs mount and with it the superblock
alive for good. I overlooked this when I added nullfs. Before that the
rootfs could never be unmounted anyway so it didn't matter what pinned
it.
Idle threads are kernel threads and init_task, the idle thread of the
boot cpu, already uses init_fs. So let the idle threads of the other
cpus share init_fs as well instead of copying PID 1's filesystem state.
Note that kernels before 7.3 need a different backport. There PID 1
still shares init_fs with all kthreads so passing CLONE_FS in
fork_idle() is enough. They also have a second pin: devtmpfsd unshares
a copy of the initial mount namespace, initramfs mount included. That
was fixed in commit
|
||
|
Christian Brauner
|
98b6cf102b
|
namei: test for a negative dentry the way traverse_mounts() does
lookup_fast_for_open() only hands an O_CREAT open a cached dentry if
it's positive. Otherwise the open goes on to lookup_open(), which takes
the directory lock and creates the file. It tests for that with
!dentry->d_inode, but traverse_mounts() later decides with the type in
d_flags. And when a dentry is instantiated __d_set_inode_and_type()
stores ->d_inode first and only then releases the type into ->d_flags.
So a refwalk that took its reference to a negative dentry right before
another task instantiates it can find ->d_inode already set in
lookup_fast_for_open(), go on to step_into(), and still find the
negative type in traverse_mounts(). The open then fails with -ENOENT,
which an O_CREAT open must never do. rcuwalk doesn't get that far, the
d_seq check in step_into() catches the instantiation.
Use d_is_negative() so both look at the type. While the type is still
negative the open takes lookup_open() and waits for the directory lock
like any other O_CREAT open of a negative dentry.
On its own the window is a couple of instructions in the creating task,
so it takes an interrupt or a preempted vcpu in exactly the right spot.
I haven't caught it without help in about 600 million racing O_CREAT
opens.
The debug patch below stalls the creating task between the two stores
for names starting with "ocrace", the way an interrupt landing there
would. The reproducer below opens "ocrace" with O_CREAT through
symlinks on a strictatime tmpfs: following them updates their atime,
which drops the walk out of rcuwalk, so the name is always looked up in
refwalk. With
echo 20 > /proc/sys/fs/ocrace_instantiate_us
./ocreat_enoent -t 60
on a KASAN kernel open() failed with -ENOENT 43 times in 4.9 million
calls. With this patch it never failed in 4.8 million calls. Tracing
step_into_slowpath() during such a run, each of the 98 -ENOENTs it
returned came right after the same task had entered it with a dentry
that was still typed negative.
// SPDX-License-Identifier: GPL-2.0
/*
* ocreat_enoent: open(O_CREAT) racing the creation of the same name.
*
* Writers unlink "ocrace" and create it again. Readers open it with
* O_CREAT through a symlink of their own on a strictatime tmpfs.
* Following the symlink updates its atime, which drops the walk out of
* rcu mode, so the name is always looked up in refwalk. An O_CREAT open
* must never fail with ENOENT.
*
* -p arms a cpu-clock perf timer with that period in ns on every writer,
* so that interrupts land at random points in it.
*
* usage: ocreat_enoent [-t secs] [-w writers] [-r readers] [-p ns]
*/
#define _GNU_SOURCE
#include <errno.h>
#include <fcntl.h>
#include <pthread.h>
#include <stdatomic.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <unistd.h>
#include <linux/perf_event.h>
#define DIR "/tmp/oc"
static atomic_int stop;
static atomic_long opens, creates, enoent, other;
static long period;
static void die(const char *what)
{
fprintf(stderr, "FATAL %s: %s\n", what, strerror(errno));
exit(2);
}
static void *writer(void *arg)
{
(void)arg;
if (period) {
struct perf_event_attr attr = {
.type = PERF_TYPE_SOFTWARE,
.size = sizeof(attr),
.config = PERF_COUNT_SW_CPU_CLOCK,
.sample_period = period,
};
if (syscall(SYS_perf_event_open, &attr, 0, -1, -1, 0) < 0)
die("perf_event_open");
}
while (!atomic_load(&stop)) {
int fd;
unlink(DIR "/ocrace");
fd = open(DIR "/ocrace", O_CREAT | O_RDWR | O_CLOEXEC, 0644);
if (fd >= 0)
close(fd);
atomic_fetch_add(&creates, 1);
}
return NULL;
}
static void *reader(void *arg)
{
char lnk[64];
snprintf(lnk, sizeof(lnk), DIR "/lnk.%ld", (long)arg);
while (!atomic_load(&stop)) {
int fd = open(lnk, O_CREAT | O_RDWR | O_CLOEXEC, 0644);
if (fd >= 0)
close(fd);
else if (errno == ENOENT)
atomic_fetch_add(&enoent, 1);
else
atomic_fetch_add(&other, 1);
atomic_fetch_add(&opens, 1);
}
return NULL;
}
int main(int argc, char **argv)
{
int secs = 60, nw = 4, nr = 12, c, n = 0;
pthread_t t[256];
while ((c = getopt(argc, argv, "t:w:r:p:")) != -1) {
switch (c) {
case 't': secs = atoi(optarg); break;
case 'w': nw = atoi(optarg); break;
case 'r': nr = atoi(optarg); break;
case 'p': period = atol(optarg); break;
default: return 2;
}
}
if (nw + nr > 256)
return 2;
mkdir(DIR, 0755);
if (mount("oc", DIR, "tmpfs", MS_STRICTATIME, "mode=0755"))
die("tmpfs");
for (long i = 0; i < nr; i++) {
char lnk[64];
snprintf(lnk, sizeof(lnk), DIR "/lnk.%ld", i);
if (symlink("ocrace", lnk))
die("symlink");
}
for (long i = 0; i < nw; i++)
if (pthread_create(&t[n++], NULL, writer, NULL))
die("writer");
for (long i = 0; i < nr; i++)
if (pthread_create(&t[n++], NULL, reader, (void *)i))
die("reader");
sleep(secs);
atomic_store(&stop, 1);
for (int i = 0; i < n; i++)
pthread_join(t[i], NULL);
printf("%ds: %ld opens, %ld creates, ENOENT %ld, other errors %ld\n",
secs, atomic_load(&opens), atomic_load(&creates),
atomic_load(&enoent), atomic_load(&other));
umount2(DIR, MNT_DETACH);
return atomic_load(&enoent) ? 1 : 0;
}
diff --git a/fs/dcache.c b/fs/dcache.c
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -32,9 +32,13 @@
#include <linux/bit_spinlock.h>
#include <linux/rculist_bl.h>
#include <linux/list_lru.h>
+#include <linux/delay.h>
#include "internal.h"
#include "mount.h"
+/* debug: stall "ocrace*" names between ->d_inode and the type */
+static int sysctl_ocrace_instantiate_us;
+
#include <asm/runtime-const.h>
/*
@@ -200,6 +204,13 @@
}
static const struct ctl_table fs_dcache_sysctls[] = {
+ {
+ .procname = "ocrace_instantiate_us",
+ .data = &sysctl_ocrace_instantiate_us,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec,
+ },
{
.procname = "dentry-state",
.data = &dentry_stat,
@@ -405,6 +416,10 @@
unsigned flags;
dentry->d_inode = inode;
+ /* debug: an interrupt landing right here */
+ if (unlikely(READ_ONCE(sysctl_ocrace_instantiate_us)) &&
+ !strncmp(dentry->d_name.name, "ocrace", 6))
+ udelay(READ_ONCE(sysctl_ocrace_instantiate_us));
flags = READ_ONCE(dentry->d_flags);
flags &= ~DCACHE_ENTRY_TYPE;
flags |= type_flags;
Fixes:
|
||
|
Christian Brauner
|
9cd0df397a
|
fs: pass flags to copy_fs()
Turn the umh boolean into a flags argument. Idle threads need their own case in copy_fs() as well and that's nicer than a second boolean. No functional changes. Link: https://patch.msgid.link/20261013-work-fs-idle_fs-v1-1-2063d1bcb5aa@kernel.org Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org> |
||
|
Guanglei Zhu
|
99ae7dc439
|
ovl: reject lowerdir ending with unescaped backslash
In ovl_parse_param_split_lowerdirs() a backslash consumes the character that follows it. When the backslash is the last character of the lowerdir value, it consumes the NUL terminator: the loop exits normally and the backslash is kept in the output, so the lowerdir is passed downstream with a trailing backslash and the mount fails later with a confusing ENOENT from path lookup. A trailing unescaped backslash escapes nothing, so reject it with EINVAL. Signed-off-by: Guanglei Zhu <zhugl3@xiaopeng.com> Link: https://patch.msgid.link/20261012095538.938789-1-zhugl3@xiaopeng.com Reviewed-by: Amir Goldstein <amir73il@gmail.com> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org> |
||
|
Kyle Zeng
|
36ebddca56
|
fsnotify: prevent mark additions during connector teardown
fsnotify_destroy_marks() keeps a reference to its current mark while it
drops conn->lock to destroy the mark. This stabilizes the forward-walk
cursor, but does not prevent a new mark from being inserted before it.
For example, an inotify watch re-added after IN_IGNORED sorts before the
old, detached mark for the same group. The walk can miss the replacement
and then detach the entire connector from the object.
The replacement is still on its group's marks_list and, for inotify, in
the watch IDR. The group mutex no longer protects the connector's object
from disappearing. An unprivileged fdinfo read racing the final detach
can consequently call igrab(NULL):
BUG: KASAN: null-ptr-deref in igrab+0x24/0x100
Write of size 4 at addr 0000000000000148
Call Trace:
igrab+0x24/0x100
inotify_show_fdinfo+0x1dc/0x5e0
seq_show+0x397/0x690
Set a DESTROYING flag under conn->lock before starting the walk, and
reject new marks on that connector with -ENOENT. The existing add-mark
error paths undo the temporary group-list entry and the backend's watch
allocation. Do not wait for teardown while holding the group mutex,
which the destroyer needs. Once the old connector is detached, an add
can install a fresh connector as before.
This closes the insertion race for all object types using the common
connector teardown, without changing the mark reference or SRCU lifetime
rules.
Fixes:
|
||
|
Christian Brauner
|
40d38f58fc
|
Merge patch series "fs: drop the smp_mb()s that mnt_get_count() made redundant"
Christian Brauner <brauner@kernel.org> says:
mntput_no_expire_slowpath() and do_umount() both have an smp_mb()
between taking mount_lock and summing up the reference count. They pair
with the smp_mb() in __legitimize_mnt(). The walker increments the count
and then re-reads the seqcount. The unmounter writes the seqcount when
it takes mount_lock and then sums up the count. They must not both miss
each other's store. That's store buffering and it needs a full barrier
on both sides.
Since
|
||
|
Aviv Vaknin
|
81933038f5
|
pid_namespace: make zap_pid_ns_processes() freezable
When the init of a pid namespace exits, zap_pid_ns_processes() waits until all other pids in the namespace are freed. A tracer outside the namespace that does not reap its traced zombies keeps those pids allocated, so this wait has no upper bound, and while it lasts every suspend attempt fails: Freezing user space processes failed after 20.006 seconds (2 tasks refusing to freeze, wq_busy=0): Neither wait is freezable. The first loop sleeps in do_wait(), which returns -ERESTARTSYS on the freezer's fake signal; the loop then clears TIF_SIGPENDING and waits again without ever freezing. The final loop sleeps in TASK_INTERRUPTIBLE, and since nothing clears TIF_SIGPENDING there, schedule() returns immediately after the first freeze attempt and the task spins until the wait ends. Sleep in TASK_INTERRUPTIBLE | TASK_FREEZABLE in do_wait(), so that the freezer can freeze tasks waiting there directly, and in TASK_IDLE | TASK_FREEZABLE in the final loop, like coredump_task_exit() does. This was hit with Chromium-based browsers: crashpad ptrace-attaches the threads of a crashed renderer, which is a pid namespace init, and does not reap those killed during the dump. Fixes: |
||
|
Christian Brauner
|
a291a5cf00
|
fs: drop the smp_mb()s that mnt_get_count() made redundant
Both mntput_no_expire_slowpath() and do_umount() have an smp_mb() between taking mount_lock and summing up the reference count. They pair with the smp_mb() in __legitimize_mnt(). A walker in __legitimize_mnt() increments the count and then re-reads the seqcount of mount_lock. The unmounter writes the seqcount when it takes mount_lock and then sums up the count. They must not both miss each other's store. Otherwise the walker keeps a reference to a mount that the unmounter finishes off. That's the store buffering pattern and it needs a full barrier between the store and the load on both sides. In commit |
||
|
Sung Byeongchan
|
65676cd420
|
autofs: ignore notification errors from a replaced pipe
autofs_notify_daemon() takes a reference to the current notification
pipe under wq_mutex, then drops the mutex before writing the request. The
write can block while the daemon enters catatonic mode and installs a
replacement pipe.
If the old pipe's reader is then closed, the delayed write returns -EPIPE
and the generic error path enters catatonic mode again. That transition
acts on the current superblock state, closes the replacement pipe, and
releases the new daemon generation's wait queues.
Only enter catatonic mode when the pipe which failed is still the current
pipe. Factor the already-locked transition so the identity check and state
change are atomic with respect to another replacement.
This was reproduced on v7.3-rc5-337-gff47652a4b66c in a local QEMU guest.
An unprivileged UID 65534 lookup filled the old packet pipe before a
normal CATATONIC/SETPIPEFD restart. On the unmodified kernel, the new pipe
received HUP and both a pending victim lookup and a later lookup failed
with ENOENT in two out of two fresh-mount runs.
With this change, the new pipe remained active, received an intact
304-byte request, and both victim lookups completed in two out of two
runs. Normal lookup and restart-without-a-blocked-writer controls passed.
No KASAN, oops, refcount, or lock diagnostic was observed. A source
reproducer and complete local logs are available privately on request.
The demonstrated impact is limited to denial of a shared autofs service
during a legitimate daemon restart. No memory corruption, information leak,
privilege escalation, or code execution primitive was observed.
Fixes:
|
||
|
Christian Brauner
|
c68b15ae11
|
Merge patch series "fs: fix a range of UAFs during rcu pathwalk caused by non-rcu frees"
Christian Brauner <brauner@kernel.org> says: While working on eliding the grace period in namespace_unlock() I went through what filesystems free when they're shut down and what a pathwalk in rcu mode can still read at that point. Since 66a97c2ec953's rcu pathwalk fixes that's the filesystem's job. Whatever ->permission(), ->d_revalidate(), ->get_link(), ->d_hash() and ->d_compare() look at in rcu mode has to be freed after a grace period. A few filesystems don't do that. Most of it is hidden by umount(2). namespace_unlock() waits for a grace period before it drops the mounts, so a walker that was inside the filesystem is gone by the time the filesystem is shut down. But the last reference to a mount doesn't have to go away in umount(2). A chdir() out of a lazily unmounted directory or the close() of the last file on it drops it without a grace period. A walker can then still be in the filesystem while ->put_super() and ->kill_sb() free what it reads. With KASAN on vfs.fixes: - ext4_get_link() reads sb->s_fs_info and the extent status counters in rcu mode for a symlink that keeps its target in a data block. ext4_put_super() destroys the counters, clears s_fs_info and frees the sbi right away. That's a NULL dereference, a use-after-free of the sbi or a fault on a destroyed percpu counter, depending on where the walker sits. - The unicode map of casefolded ext4, f2fs and tmpfs is freed from ->put_super() while generic_ci_d_hash() and generic_ci_d_compare() use it. - ntfs3 with nocase frees its sbi and mount options under ntfs_d_hash() and ntfs_d_compare(). A remount frees the old mount options right away too, that one needs no unmount at all. - eventfs frees an eventfs_inode after an SRCU grace period only, but tracefs_d_revalidate() reads it under rcu_read_lock(). No unmount needed either. The ipc patch is a different kind of bug. create_ipc_ns() leaks the mqueue mount and its superblock when it fails after mq_init_ns(). I ran into it while looking at the kern_unmount() users. afs and 9p look just as broken but nothing can reach it today. Both have a private bdi, and generic_shutdown_super() calls bdi_unregister(), which waits for a grace period before ->kill_sb() frees their private data. That grace period is there for the rcu readers of bdi_list and covers afs and 9p by accident. I don't want them to depend on that, so they free their private data after a grace period of their own as well. I appended the reproducers. The race reproducers hold a pathwalk inside the filesystem's callback for two seconds with a kprobe while the other side frees what it reads. For the ntfs3 remount the window is a single load and its dereference, so that one needs an mdelay() in the kernel. ext4 with a journal needs a kernel without lockdep since jbd2_journal_destroy() calls lockdep_unregister_key(), which waits for a grace period too. Clean this all up. * patches from https://patch.msgid.link/20261009-work-fixes-rcu-v1-0-7446d2d335e6@kernel.org: ntfs3: free replaced mount options after a grace period ntfs3: free the sbi after a grace period unicode: free the map after a grace period ipc: drop the mqueue mount with kern_unmount() on setup failure eventfs: free the eventfs_inode after an rcu grace period too 9p: free the session after a grace period afs: free the super info after a grace period ext4: free the sbi after a grace period Link: https://patch.msgid.link/20261009-work-fixes-rcu-v1-0-7446d2d335e6@kernel.org Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org> |
||
|
Christian Brauner
|
56c3824de5
|
ntfs3: free replaced mount options after a grace period
ntfs_fs_reconfigure() replaces the old mount options with new mount
options in sbi->options. The old mount options land in fs_context and
are freed as soon as remount returns. With a pathwalk held up in
ntfs_nls_to_utf16() between loading sbi->options and dereferencing it
while a remount replaces them:
BUG: KASAN: slab-use-after-free in ntfs_nls_to_utf16+0x7ae/0x7c0
Read of size 8 at addr ff110001044fd448 by task walker/98
Call Trace:
<TASK>
ntfs_nls_to_utf16+0x7ae/0x7c0
ntfs_d_hash+0x22b/0x500
link_path_walk+0x11ad/0x1d30
path_lookupat+0x63/0xb00
filename_lookup+0x1f1/0x5b0
vfs_statx+0xd7/0x3b0
[...]
Allocated by task 95:
__kmalloc_node_track_caller_noprof+0x2a2/0x730
kmemdup_noprof+0x25/0x50
ntfs_fill_super+0x1e5/0x4550
[...]
Freed by task 97:
kfree+0x1db/0x5b0
put_fs_context+0x13c/0x7d0
path_mount+0x54a/0x2130
__x64_sys_mount+0x20c/0x270
That info is needed in rcu lookup in the dentry hash and dentry compary
methods for ntfs3 and causes a UAF today. Delay freeing with an rcu
grace period.
ntfs_nls_to_utf16() reads ->nls and ->ads once under rcu_read_lock() so
the hooks pair with the release in ntfs_fs_reconfigure(). That also
covers callers outside of rcu pathwalk such as ntfs_lookup(). They don't
hold rcu_read_lock() themselves and wouldn't be protected by the grace
period otherwise. Remount refuses to change the iocharset so ->nls stays
valid after rcu_read_unlock().
Fixes:
|
||
|
Christian Brauner
|
c01b091b06
|
ntfs3: free the sbi after a grace period
If the "nocase" mount option ntfs3 uses custom hash and dentry compare
functions. Both access ntfs3 superblock private information in rcu
pathwalk. ntfs_put_super() and ntfs3_kill_sb() drop the info without any
rcu delay. A lookup that's still inside the filesystem when the last
reference to the mount is dropped causes a UAF. With a pathwalk held up
in ntfs_d_hash() while the last reference to the mount goes away:
BUG: KASAN: slab-use-after-free in ntfs_nls_to_utf16+0x752/0x940
Read of size 8 at addr ff1100010453c850 by task walker/99
Call Trace:
<TASK>
ntfs_nls_to_utf16+0x752/0x940
ntfs_d_hash+0x22b/0x500
link_path_walk+0x11ad/0x1d30
path_lookupat+0x63/0xb00
filename_lookup+0x1f1/0x5b0
vfs_statx+0xd7/0x3b0
[...]
Allocated by task 95:
__kmalloc_cache_noprof+0x249/0x560
ntfs_init_fs_context+0x2db/0x5a0
alloc_fs_context+0x52e/0xc70
[...]
Freed by task 98:
kfree+0x1db/0x5b0
deactivate_locked_super+0x9c/0xf0
cleanup_mnt+0x9f/0x130
task_work_run+0x131/0x250
The bug is currently masked by the grace period in namespace_unlock()
for umount(2). Keep the necessary information until the filesystem
private info is freed and free it with an rcu delay.
ntfs3_free_sbi() now runs from an rcu callback and drops the upcase
table via ntfs_put_shared(). So switch s_shared_lock over to
spin_lock_bh(). Otherwise the callback can deadlock against a task
holding the lock on the same cpu.
Fixes:
|
||
|
Christian Brauner
|
a96c5299bd
|
unicode: free the map after a grace period
generic_ci_d_hash() and generic_ci_d_compare() read sb->s_encoding and
dereference the unicode map while a pathwalk in rcu mode holds nothing
but rcu_read_lock(). The filesystems that use them, ext4, f2fs and
tmpfs, drop the map with utf8_unload() from ->put_super(), which runs
when the last reference to the mount goes away. A lookup that is still
inside such a filesystem at that point reads a freed map.
With a pathwalk held up in utf8_casefold_hash() while the last reference
to a casefolded tmpfs goes away:
BUG: KASAN: slab-use-after-free in utf8nlookup+0x74c/0x950
Read of size 8 at addr ff110001030fe658 by task walker/98
Call Trace:
<TASK>
utf8nlookup+0x74c/0x950
utf8byte+0x160/0x1560
utf8_casefold_hash+0x167/0x230
generic_ci_d_hash+0xdd/0x1c0
link_path_walk+0x11ad/0x1d30
path_lookupat+0x63/0xb00
filename_lookup+0x1f1/0x5b0
vfs_statx+0xd7/0x3b0
[...]
Allocated by task 94:
__kmalloc_cache_noprof+0x249/0x560
utf8_load+0x4e/0x570
shmem_parse_opt_casefold.isra.0+0x92/0x270
[...]
Freed by task 97:
kfree+0x1db/0x5b0
shmem_put_super+0x72/0x170
generic_shutdown_super+0x14c/0x530
kill_anon_super+0x3a/0x60
deactivate_locked_super+0x9c/0xf0
cleanup_mnt+0x9f/0x130
So far that has been hard to hit. umount(2) waits for a grace period
in namespace_unlock() before it drops the mount, so only a mount whose
last reference goes away elsewhere, like the close of a file or a chdir
out of a lazily unmounted directory, can race a walker. So it is
reachable.
Delay the free until a grace period has passed. The map and the data
table it holds a reference to then outlive any pathwalk that found the
superblock before the mount went away. The reference on the data table
module is dropped from the rcu callback as well. utf8-core is built in
whenever CONFIG_UNICODE is set, so there is no module exit that would
have to wait for the callbacks.
Overlayfs points the s_encoding of an overlay at the map of its first
layer without taking a reference of its own. That stays correct. The
layer is held by the overlay, so its map is dropped only after the
overlay is gone.
Fixes:
|
||
|
Christian Brauner
|
f0e48172a5
|
ipc: drop the mqueue mount with kern_unmount() on setup failure
mq_init_ns() creates the mqueue mount with fc_mount_longterm(), so its ->mnt_ns is MNT_NS_INTERNAL. When setting up the mqueue or ipc sysctls or msg_init_ns() fails afterwards, create_ipc_ns() drops it with a plain mntput(). With ->mnt_ns set that takes the fast path of mntput_no_expire(). The count drops to zero and nothing ever kills the mount, so the mount and the mqueue superblock are leaked. Commit |
||
|
Christian Brauner
|
6e6928b396
|
eventfs: free the eventfs_inode after an rcu grace period too
tracefs_d_revalidate() reads ->is_freed of the eventfs_inode that dentry->d_fsdata points to, and ->d_revalidate() is called in rcu pathwalk mode with nothing but rcu_read_lock() held. The dentry itself stays around for such a walker, but tracefs_d_release() drops its reference to the eventfs_inode when the dentry is killed, and release_ei() then frees it after a grace period of eventfs_srcu. An SRCU grace period doesn't wait for rcu_read_lock() sections, so the walker can read an eventfs_inode that is already gone. With a pathwalk held up in tracefs_d_revalidate() while the dentry goes away: BUG: KASAN: slab-use-after-free in tracefs_d_revalidate+0x76/0x90 Read of size 1 at addr ff1100010152d8d0 by task walker/97 Call Trace: <TASK> tracefs_d_revalidate+0x76/0x90 lookup_fast+0x320/0x640 path_lookupat+0x160/0xb00 filename_lookup+0x1f1/0x5b0 vfs_statx+0xd7/0x3b0 vfs_fstatat+0x4d/0x90 __do_sys_newfstatat+0xa0/0x100 do_syscall_64+0x10e/0x5e0 entry_SYSCALL_64_after_hwframe+0x77/0x7f [...] Allocated by task 1: __kmalloc_cache_noprof+0x249/0x560 eventfs_create_dir+0x7a/0x590 event_create_dir+0x2fb/0xcf0 trace_add_event_call+0xbf/0x150 [...] Freed by task 11: kfree+0x1db/0x5b0 srcu_invoke_callbacks+0x3a3/0x620 process_one_work+0x937/0x1810 worker_thread+0x4f1/0xd60 Before commit |
||
|
Christian Brauner
|
bcec7fc2e2
|
9p: free the session after a grace period
v9fs_vfs_get_link_dotl() reads ->cache from the v9fs_session_info in
sb->s_fs_info to decide whether the symlink target sits in the page
cache. It does that before it looks at the dentry, so it also does it in
rcu pathwalk mode. Without loose or metadata caching the dentries have
no ->d_revalidate() that would make the walk leave rcu mode before it
gets there.
v9fs_kill_super() frees the session and clears sb->s_fs_info without
waiting for a grace period. Right now a pathwalk can't still be in
v9fs_vfs_get_link_dotl() at that point, but only by accident. umount(2)
waits for a grace period in namespace_unlock() before it drops the
mount. And a mount whose last reference goes away elsewhere, like the
chdir out of a lazily unmounted directory, still gets a grace period
from bdi_unregister(). v9fs_fill_super() sets up a private bdi, so
generic_shutdown_super() unregisters it from kill_anon_super() and
bdi_remove_from_list() waits in synchronize_rcu_expedited() before
v9fs_kill_super() frees the session. That grace period protects the rcu
readers of bdi_list in the writeback code. It has nothing to do with
pathwalk.
Don't rely on it. Keep sb->s_fs_info and free the session after a grace
period.
Fixes:
|
||
|
Cen Zhang (Microsoft)
|
5e531d62f1
|
watch_queue: Fix note pool publication race in watch_queue_set_size()
There is a race between watch_queue_set_size() and post_one_notification().
watch_queue_set_size() publishes wqueue->notes, notes_bitmap, nr_pages and
nr_notes with plain stores, and post_one_notification() reads them with
plain loads under a different lock, so nothing orders the four stores
against the poster's loads: depending on the build, notes can be stored
last (gcc 14 on x86-64 does this). Since keyctl_watch_key() lets a watch
attach to a queue before it is sized, post_one_notification() can already
be running on another CPU at that moment: it reads nr_notes > 0, passes
its bounds check, and then reads notes while it is still NULL,
dereferencing notes[0].
An unprivileged user triggers this reliably by watching one of its own
keys through a notification pipe and racing ioctl(IOC_WATCH_QUEUE_SET_SIZE)
on that pipe against keyctl(KEYCTL_SETPERM) on the key from another CPU,
triggering:
BUG: kernel NULL pointer dereference, address: 0000000000000000
RIP: 0010:post_one_notification.isra.0+0xa2/0x1e0
Call Trace:
__post_watch_notification+0x148/0x180
keyctl_setperm_key+0x119/0x130
do_syscall_64+0x108/0x4c0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Kernel panic - not syncing: Fatal exception in interrupt
Fix this by publishing nr_notes last with smp_store_release(), and by
reading it once with smp_load_acquire() in post_one_notification() before
the bitmap and the page array are touched. A poster that observes a
non-zero nr_notes then also observes the pool behind it; one that observes
zero drops the notification as before.
Fixes:
|
||
|
Christian Brauner
|
59e483739f
|
afs: free the super info after a grace period
afs_atcell_get_link() resolves the @cell and .@cell symlinks of a
dynamic root in rcu pathwalk mode. Before it looks at the dentry it gets
the afs_net through afs_i2net(), which reads ->net_ns from the
afs_super_info in sb->s_fs_info. The @cell dentries are kept around when
unused and the dynamic root has no ->d_revalidate(), so a lookup that
finds @cell in the dcache gets to ->get_link() in rcu mode.
afs_kill_super() frees the afs_super_info with a plain kfree() in
afs_destroy_sbi(). Right now a pathwalk can't still be in
afs_atcell_get_link() at that point, but only by accident. umount(2)
waits for a grace period in namespace_unlock() before it drops the
mount. And a mount whose last reference goes away elsewhere, like the
chdir out of a lazily unmounted directory, still gets a grace period
from bdi_unregister(). afs_fill_super() sets up a private bdi, so
generic_shutdown_super() unregisters it from kill_anon_super() and
bdi_remove_from_list() waits in synchronize_rcu_expedited() before
afs_destroy_sbi() runs. That grace period protects the rcu readers of
bdi_list in the writeback code. It has nothing to do with pathwalk.
Don't rely on it and free the afs_super_info after a grace period.
Fixes:
|
||
|
Kyle Zeng
|
40bb03d3ea
|
pipe: preserve existing fasync readers on writer setup failure
F_SETFL and FIOASYNC decide whether to invoke ->fasync() before
pipe_fasync() takes pipe->mutex. Two enables of one O_RDWR FIFO can
therefore both enter the callback.
fasync_helper() allocates before checking for an existing entry. If the
first enable installs both entries, a second enable can update the
reader entry and then fail the allocation for the writer entry. The
error path removes the pre-existing reader entry, clearing FASYNC while
the writer entry remains registered. __fput() then skips ->fasync(), so a
later pipe notification can dereference the freed file or its f_owner.
An unprivileged memory-pressure reproducer triggers a KASAN
slab-use-after-free in send_sigio() through this path.
Keep the reader helper's result and undo the registration only if this
call added it. The pipe mutex serializes changes to both lists, so a
failed new registration still removes its reader, while a failed
duplicate preserves the existing registrations and FASYNC. Successful
duplicate enables continue to update fa_fd as before.
Fixes:
|
||
|
Christian Brauner
|
c17b44266a
|
ext4: free the sbi after a grace period
ext4_get_link() follows a symlink that keeps its target in a data block
in rcu pathwalk mode with ext4_getblk(EXT4_GET_BLOCKS_CACHED_NOWAIT).
That reads s_mount_state in the ASSERT() of ext4_getblk() and again in
ext4_es_lookup_extent(), and the lookup bumps the extent status hit or
miss counter, all through sb->s_fs_info.
ext4_put_super() destroys those counters, clears sb->s_fs_info and frees
the sbi without waiting for a grace period. A pathwalk that is still in
ext4_get_link() when the last reference to the mount goes away then
dereferences a NULL s_fs_info, the freed sbi or the destroyed percpu
counters.
With a pathwalk held up in ext4_get_link() while the last reference
goes away:
KASAN: null-ptr-deref in range [0x00000000000000a8-0x00000000000000af]
RIP: 0010:ext4_getblk+0xf0/0x640
Call Trace:
<TASK>
ext4_get_link+0x26c/0x410
pick_link+0xf96/0x1780
step_into_slowpath+0x9b8/0x1250
path_lookupat+0x484/0xb00
filename_lookup+0x1f1/0x5b0
vfs_statx+0xd7/0x3b0
vfs_fstatat+0x4d/0x90
__do_sys_newfstatat+0xa0/0x100
do_syscall_64+0x10e/0x5e0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
So far that has been hard to hit. umount(2) waits for a grace period in
namespace_unlock() before it drops the mount, so only a mount whose last
reference goes away elsewhere, like the close of a file or a chdir out of
a lazily unmounted directory, can race a walker.
Keep sb->s_fs_info and free the sbi together with the extent status
counters after a grace period. Split the counters out of
ext4_es_unregister_shrinker() for that. The shrinker still gets wasted
in ext4_put_super(), the counters go with the sbi.
Fixes:
|
||
|
Nickolai Zeldovich
|
28d2905d77
|
exit: fix lost-update race on the child_subreaper bitfields
is_child_subreaper, has_child_subreaper, autoreap and, with
CONFIG_POSIX_TIMERS=y, timer_create_restore_ids are 1-bit fields that
share one memory location in struct signal_struct. A store to any of
them is a read-modify-write of the whole word, and three of the stores
run without a common lock:
- PR_SET_CHILD_SUBREAPER writes me->signal->is_child_subreaper with
no lock held.
- propagate_has_child_subreaper(), run by walk_process_tree() from
the same prctl in an ancestor, writes p->signal->has_child_subreaper
of every descendant p under read_lock(&tasklist_lock), which does
not exclude the other writers.
- PR_TIMER_CREATE_RESTORE_IDS writes
current->signal->timer_create_restore_ids with no lock held.
When a process calls prctl(PR_SET_CHILD_SUBREAPER, 1) while an
ancestor's PR_SET_CHILD_SUBREAPER walk visits it, or while another
thread of the same process calls prctl(PR_TIMER_CREATE_RESTORE_IDS),
the read-modify-write sequences interleave and one of the bits is
silently lost:
- If has_child_subreaper is lost, the process's orphaned descendants
are reparented straight to init when it exits: find_new_reaper()
tests father->signal->has_child_subreaper first and never looks for
the ancestor subreaper. The service manager that registered as the
subreaper never gets SIGCHLD for them and cannot wait() on them.
- If is_child_subreaper is lost, the prctl returned 0 but the process
is not a subreaper: orphans of its descendants skip it and are
reparented to the next subreaper up or to init.
PR_GET_CHILD_SUBREAPER reads back 0.
- If timer_create_restore_ids is lost, the prctl returned 0 but
timer_create() does not restore the requested timer ids (or keeps
restoring them after _OFF), and _GET reads back the old value.
Documentation/memory-barriers.txt requires all fields of one bitfield
to be protected by one lock for exactly this reason. No lock is taken
or documented for these flags, and the prctls need no privilege, so any
process can hit the race against its own ancestors or descendants, or
between two of its own threads.
Make is_child_subreaper and has_child_subreaper separate bool members.
Each store then has its own memory location and no read-modify-write
of a neighbour. The readers and their locking are unchanged.
autoreap stays a bit-field and so shares a memory location only with
timer_create_restore_ids. That pair is race-free: autoreap is stored
exactly once, in copy_process() before the new signal_struct is
reachable by any other task, and timer_create_restore_ids is only
stored to the signal_struct of an already running process.
Fixes:
|
||
|
Sasha Levin
|
f1365f97fb
|
samples: pidfd: fix userprogs typo
The Makefile adds pidfd-metadata to "usertprogs-always-y", which kbuild
does not know, so the sample has not been built since the conversion to
userprogs, even with CONFIG_SAMPLE_PIDFD=y.
Fix the variable name. pidfd-metadata.c builds without warnings with
gcc and clang for x86_64 and arm64.
Fixes:
|
||
|
Cen Zhang
|
4c43582893
|
ocfs2/dlm: Protect the recovery list during debugfs reads
Recovery participant records must remain alive while debug_state_print()
walks reco.node_data and formats their fields. The formatter holds
dlm->spinlock, but the recovery participant list is protected by
dlm_reco_state_lock. In particular, dlm_destroy_recovery_area() detaches
the list under dlm_reco_state_lock and frees the detached records after
releasing it. A concurrent debugfs open can therefore read freed memory.
Protect the participant traversal and field reads in debug_state_print()
with dlm_reco_state_lock, matching the existing list writers. This also
serializes the traversal against list_add_tail() during recovery-area
initialization. Make the existing lock available to the debug code
through dlmcommon.h; the lock remains internal to the OCFS2 DLM module.
Release dlm->spinlock after formatting the other domain state and before
acquiring dlm_reco_state_lock, so the debug reader does not nest the two
locks. Leave recovery list insertion, detachment and freeing unchanged.
KASAN report as below:
BUG: KASAN: slab-use-after-free in debug_state_open+0x1169/0x12d0
Read of size 4 at addr ffff88810662ef80 by task dlm-state-stres/896
CPU: 1 UID: 0 PID: 896 Comm: dlm-state-stres Not tainted 7.3.0-rc4-next-20260921-pmb-ocfs2-functional-v1+ #1 PREEMPT(lazy)
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x93/0xd0
print_report+0xce/0x630
? debug_state_open+0x1169/0x12d0
? srso_alias_return_thunk+0x5/0xfbef5
? __virt_addr_valid+0x20e/0x420
? debug_state_open+0x1169/0x12d0
kasan_report+0xe0/0x110
? debug_state_open+0x1169/0x12d0
debug_state_open+0x1169/0x12d0
? __pfx_debug_state_open+0x10/0x10
full_proxy_open_regular+0x193/0x310
do_dentry_open+0x595/0x12d0
? __pfx_full_proxy_open_regular+0x10/0x10
vfs_open_consume+0xd1/0x400
? srso_alias_return_thunk+0x5/0xfbef5
path_openat+0x18d0/0x2020
? __pfx_path_openat+0x10/0x10
do_file_open+0x21e/0x470
? __pfx_do_file_open+0x10/0x10
? _raw_spin_unlock+0x23/0x40
? srso_alias_return_thunk+0x5/0xfbef5
? alloc_fd+0x3a6/0x6b0
do_sys_openat2+0xf4/0x1b0
? __pfx_do_sys_openat2+0x10/0x10
? srso_alias_return_thunk+0x5/0xfbef5
? __fput+0x5b5/0xa60
__x64_sys_openat+0x136/0x1e0
? __pfx___x64_sys_openat+0x10/0x10
do_syscall_64+0x114/0x620
entry_SYSCALL_64_after_hwframe+0x77/0x7f
[Register dump omitted.]
</TASK>
Allocated by task 880:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
__kasan_kmalloc+0xaa/0xb0
__kmalloc_cache_noprof+0x28d/0x610
dlm_remaster_locks+0x147/0x1d90
dlm_do_recovery+0xde1/0x1580
dlm_recovery_thread+0x109/0x300
kthread+0x351/0x460
ret_from_fork+0x659/0x940
ret_from_fork_asm+0x1a/0x30
Freed by task 880:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
kasan_save_free_info+0x3b/0x60
__kasan_slab_free+0x5f/0x80
kfree+0x308/0x580
dlm_destroy_recovery_area+0x285/0x460
dlm_remaster_locks+0x17c4/0x1d90
dlm_do_recovery+0xde1/0x1580
dlm_recovery_thread+0x109/0x300
kthread+0x351/0x460
ret_from_fork+0x659/0x940
ret_from_fork_asm+0x1a/0x30
The buggy address belongs to the object at ffff88810662ef80
which belongs to the cache kmalloc-32 of size 32
The buggy address is located 0 bytes inside of
freed 32-byte region [ffff88810662ef80, ffff88810662efa0)
[Page and memory-state dumps omitted.]
Fixes:
|
||
|
Linus Torvalds
|
24a19b953e | Linux 7.3-rc7 | ||
|
Linus Torvalds
|
d6d3455d87 |
Landlock fix for v7.3-rc7
-----BEGIN PGP SIGNATURE----- iIYEABYKAC4WIQSVyBthFV4iTW/VU1/l49DojIL20gUCasuxWRAcbWljQGRpZ2lr b2QubmV0AAoJEOXj0OiMgvbSHaEA/2qsakLl6MYmTQ5+c4MAdtPcJXttnQJoAWJl t5OrpCQEAP9A/DSj46Ci2ocnfbfvhtfHgzX5CQMef8nxUillfVYnBw== =G4p3 -----END PGP SIGNATURE----- Merge tag 'landlock-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux Pull Landlock fix from Mickaël Salaün: "This fixes a Clang bug by removing an annotation, which was introduced mostly for documentation" * tag 'landlock-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: landlock: Drop __counted_by from landlock_domain.handled_masks |
||
|
Linus Torvalds
|
f479598167 |
spi: Fixes for v7.3
A small collection of driver specific fixes, plus a new device ID in the DesignWare device tree binding. One of the sg2044 fixes which enforces clock limits properly is more critical than average since getting them wrong might lead to data corruption. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQReagvpf3TrrA7BoYYv73Ows9A4iQUCasrOmAAKCRAv73Ows9A4 iVT3AP9OD2ppR1G68eZZH3qB1Q9jhHAWREihWUqZZ+Y3I+hiVQEA8O0uTgTFveMw usHV1vv81Ca4EPAEmAKbrhBAH3oAMgY= =ibsk -----END PGP SIGNATURE----- Merge tag 'spi-fix-v7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A small collection of driver specific fixes, plus a new device ID in the DesignWare device tree binding. One of the sg2044 fixes which enforces clock limits properly is more critical than average since getting them wrong might lead to data corruption" * tag 'spi-fix-v7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: dt-bindings: snps,dw-apb-ssi: Add Synaptics sl2610 spi spi: sg2044-nor: Honor SPI clock limits spi: sg2044-nor: Return transfer errors spi: cadence-qspi: Fix status polling with octal DTR chips spi: spi-nxp-fspi: exit stop mode before waiting for DLL lock |
||
|
Linus Torvalds
|
5906f156e8 |
regulator: Fixes for v7.3
There's a couple of core fixes here, there were a couple of issues with of_regulator_bulk_get_all() not behaving consistently with the other bulk regulator APIs which caused memory leaks and error handling issues in users. We also have a of fairly standard driver specific fixes. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQReagvpf3TrrA7BoYYv73Ows9A4iQUCasrJ0QAKCRAv73Ows9A4 iSA9AP9lETVKHzhDIU+QiXmXh5mDVXTrpA0JXC6HL7fMUAgS6QEA4REJaKEbp9pU lvMfR/lTS88EbrtKF+ZuDM+EkIa+qQc= =xELe -----END PGP SIGNATURE----- Merge tag 'regulator-fix-v7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "There's a couple of core fixes here: there were a couple of issues with of_regulator_bulk_get_all() not behaving consistently with the other bulk regulator APIs which caused memory leaks and error handling issues in users. We also have a couple of fairly standard driver specific fixes" * tag 'regulator-fix-v7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: ltc3676: don't read the write-only HRST and CLIRQ registers regulator: of: state who owns the array from of_regulator_bulk_get_all() regulator: of: fill in supply names in of_regulator_bulk_get_all() regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4 |
||
|
Linus Torvalds
|
d5b6dc381d |
SCSI fixes on 20261011
Driver (and tape media changer) only fixes. Three of the fixes are about the same size, (ch, ufs decouble CQ and ufs avoid unsafe MMIO) but the unsafe MMIO is the least obvious logic change. -----BEGIN PGP SIGNATURE----- iLgEABMIAGAWIQTnYEDbdso9F2cI+arnQslM7pishQUCasspJRsUgAAAAAAEAA5t YW51MiwyLjUrMS4xMiwyLDImHGphbWVzLmJvdHRvbWxleUBoYW5zZW5wYXJ0bmVy c2hpcC5jb20ACgkQ50LJTO6YrIUL5gD+Lwi6HVanx/zkn6Qy+9N0Kx0IZTsamTpM Aug3Rx74YWYA/ii94bbXr0xrdohBAdPO1MppOQGfmcTqdHAIP/7lxWzn =EeOd -----END PGP SIGNATURE----- Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Driver (and tape media changer) only fixes. Three of the fixes are about the same size, (ch, ufs decouble CQ and ufs avoid unsafe MMIO) but the unsafe MMIO is the least obvious logic change" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock() scsi: ch: Do not keep references to data transfer element devices scsi: ufs: mediatek: Handle mPHY power-on failures scsi: qedi: Initialize callback state before registration scsi: ufs: core: Hold a clock reference across the probe |
||
|
Linus Torvalds
|
4375b45d70 |
block-7.3-20261010
-----BEGIN PGP SIGNATURE-----
iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmrLiicQHGF4Ym9lQGtl
cm5lbC5kawAKCRD301j7KXHgpvOmD/452m7OeggU07h2q1wqdiw2lh5zIvXcjQIF
ih4nl5lezismqbenazF6IqSsz5YAq5SM0EroNEXrQnr2UzndjyXyVN3fPdQVA+7R
8Hg3rlU31XzGW+WZknGx25RfaIGovNbJUFhPMuYpY41raOSevwIhx2X3k5UZUAWd
4id28sXJTMk097XdQnfqNcaXcu3FDHx9ZcOKlSyRWaZD36vY4XPFwrFESyMzyWWJ
PhfwTBG6/MxxzOS0QdCzkSpA1L1Ipj48LO87X/RMX8NnrXw5Gar6+1NhVykfocdb
acKxUaAw5VF72Uinrrm+f7tMIAmsoFzwJR+VXJJxYNQMB2GLBL69BOsz9Qmr6qaA
71GQ52wfGh8fajeUH5C+pTDab4zZwY9X+ugGoocXaK/f43vxLARYLevC/MEionD/
HbZazH79Ock4dLolMBKgDXhrLUZbk/d0TiJpJezaaO+v09KlWDyhf+uzFOKkfdUL
YUsXGkQT+cp1ymN2M7Stiey+b2EMPhU8NjL/Sb52o3gllxeP8tUfXfGimxIWH1k3
fhzqYHpZNROCB8wzqeawqkZzJPpe7Xj5H5FRDf6fiqWZ+BelD1Je+mq1Ck53XLKr
tmDnmFwl7B+FrX519u4BqObW95PKC/0JsrmW5BeW+mHjbIHnOCTVsZiEoW+Q+Q57
3twF8ITLUA==
=jxPV
-----END PGP SIGNATURE-----
Merge tag 'block-7.3-20261010' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull block fixes from Jens Axboe:
- NVMe fixes via Keith:
- Fix swapped ZRASF zone state values for full and read only
- nvme-multipath revalidate head zones after unfreezing the head
queue
- Revert "nvme: do not reset controllers in NVME_CTRL_NEW state",
which broke things
- nvmet fixes for invalid NSIDs on feature 82h and using the local
P2P device on metadata allocation failure
- zloop: zero out only the unread tail of a short read
* tag 'block-7.3-20261010' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
Revert "nvme: do not reset controllers in NVME_CTRL_NEW state"
zloop: zero out only the unread tail of short reads
nvmet: use the local P2P device on metadata allocation failure
nvme-multipath: revalidate head zones after unfreezing the head queue
nvme: fix swapped ZRASF zone state values for full and read only
nvmet: return Invalid Field for invalid NSIDs feature 82h
|
||
|
Nguyen Ngoc Thang
|
3d8cc52db2
|
landlock: Drop __counted_by from landlock_domain.handled_masks
With clang 22 and CONFIG_FORTIFY_SOURCE, the second
landlock_restrict_self() call hits a bogus fortify report in
inherit_ruleset():
memcpy: detected buffer overflow: 4 byte write of buffer size 0
Call Trace:
__fortify_panic
landlock_merge_ruleset
__se_sys_landlock_restrict_self
handled_masks[] lives in an anonymous struct inside the anonymous union
that overlays work_free. For such a flexible array, clang computes the
address of the __counted_by counter as the start of the array instead of
&num_layers. The bound is then read from handled_masks[0], i.e. from
the first layer's access masks, which is not a count. The same layout
crashes clang itself in a standalone test.
The annotation was added as documentation, so drop it rather than
restructure the union. Keep the information in the member comment.
Reported-by: syzbot+a0eecb22de4d821a9e5d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=a0eecb22de4d821a9e5d
Fixes:
|
||
|
Linus Torvalds
|
b7c0316c1a |
io_uring-7.3-20261010
-----BEGIN PGP SIGNATURE----- iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmrLihgQHGF4Ym9lQGtl cm5lbC5kawAKCRD301j7KXHgpqHYD/0WmtUynMfrRLjrod20cJV39pzOSBLVgAgu 9q4y6/o5UP6AFlenvvejA09AzAW14TpIx1xw+wz9W7kOIEfBFdYr+8ZlLdJCVY7+ COMDryOgoSZqd77CTUZ54V7d+z4dEOEYtkfpDBxq/0bbUrZpDB3UGHcQm1GBAj7y FGPIAqmjJ6BH5ymNlCwjmBhgkSSsscKtlJXHUgpDNrwPwndmcg38on3QWmNJP97u tnOO2j8Xy5TYDoGJ8liK37y56YKtR+vYiIRd1rlCvdtvtmaMBKkj3NNFMUGMEC25 1qapshKstL+20ZUmXTITGMxOfsrsZSj3nT93BV3W8jt/POMbhzX5W7zO8fS3gDKW 9XNYQXL2zMfp6iF3zIU3nsdcggK/T1uBtDXQureM8zl8QQa7XgJOCW8b8eNJZAo2 /W7Hz5TKshnrkXGEIvKWCb/UcrijHMLbtQ+eGcj/TeteMvO69bl+fQn0tzlOud0t lqMmFsuZMa6mkYn2XV86Ie2tf0AOS5LSGKsWwvkmAg5Pkz1l5qIDTyuLFEDfWQpg N3uLC/uo4+ap1s3ccUX6Pb8feZ1GVtjS7Wsqe04DFxFCESllbYiwkUMAGPFST7l8 SFZuafe/eJbW/MFnB/AKk5jBWMcwXP+usBWq/0w1/ETA4DhWXLQQnIefI1FoZpZa OjOfFuKDYA== =GaD2 -----END PGP SIGNATURE----- Merge tag 'io_uring-7.3-20261010' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: - Don't spin on local work the exiting task can't run. For a ring still R_DISABLED when the task got its tctx node, the submitter is set later and may be another task, so DEFER_TASKRUN local work stays pending forever and the exiting task spins in do_exit(). - Don't charge the SQ/CQ rings or provided buffer rings to RLIMIT_MEMLOCK. The region API conversion started charging them, which the rings had been exempt from. - Don't exempt disabled rings from task restrictions on register - Populate the CONNECT filter fields for a 24-byte sockaddr_in6 * tag 'io_uring-7.3-20261010' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/cancel: don't spin on local work the task can't run io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6 io_uring/register: don't exempt disabled rings from task restrictions io_uring/kbuf: don't charge provided buffer rings to RLIMIT_MEMLOCK io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK |
||
|
Linus Torvalds
|
5f97a3ec36 |
xfs: fixes for 7.3-rc7
Signed-off-by: Carlos Maiolino <cem@kernel.org> -----BEGIN PGP SIGNATURE----- iJUEABMJAB0WIQSmtYVZ/MfVMGUq1GNcsMJ8RxYuYwUCassr8wAKCRBcsMJ8RxYu Y0zlAYDt4ReluNicsRWxFKTeSU9GSJ3asMlyV24nBxOxj6ggzpMkJpU76aVDFCaq NDn13vEBgMVppi1VVMez8tYOOL390yfzlWnpq38mPaMnv4cXDQGZUvETcL1n+4U+ xVf/7NasOQ== =X+Ty -----END PGP SIGNATURE----- Merge tag 'xfs-fixes-7.3-rc7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Carlos Maiolino: "This fixes a data corruption vector where a user could trick the exchange-range feature to add shared blocks beyond the file's EOF, which may then be used to modify data on another file" * tag 'xfs-fixes-7.3-rc7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: fix exchange-range-to-eof file size exchange xfs: stop exchanging reflink flags when exchanging mappings |
||
|
Linus Torvalds
|
4d61397c86 |
x86 fix:
- Work around AMD TLBI Erratum #1718 (Borislav Petkov) Signed-off-by: Ingo Molnar <mingo@kernel.org> -----BEGIN PGP SIGNATURE----- iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmrLN7QRHG1pbmdvQGtl cm5lbC5vcmcACgkQEnMQ0APhK1hFohAAqJHoyW96qIFMKak6sY63CaJ3lDfFmaB2 8aZW8oKhmjTCECHH/Ff7wDxIL733CsdaxynnJ9YxAmujpsAmaO6Tk8PxuGaVPJsJ pTW8w4ViVJdnsaNzCQpbm8iB3Q5anmiqwgSd/2C8mmEZVF04ZtzmMKyGeGG99GPH p7AzpQKkh0UAjIGCV0i1KXQzboHXld4APJGcoiQIAmNBzdHjJBVrJA+vsUzdcLOf nufTe01afNa2ehlB2cwy0eOn9/+cnZsF4jObFBvmXYjD1rucYSRvUCWOFTMNt5vP Sj57hhhU5ozSHkZVz9I2l6W+7txk9qhLXPA3cFs3FDFjhXFqUo/mmRn/oQxwGzCR fsMq5ImTWTzdTuTzlhWFbNLUJOc0OFWMidyVb2eul9kipz451KFVssuTEWwpV3Mb fEfjPZnnuEAz+0kVckuLGEsROQFst0VDv53BVUSfmunIGZFtyWH1rIpEn4AeIYUC vT66l/pPYqF1tJcX2OB2tHgY2Qw2OCfQPloYrchLTsE2us+fpwZIp8du2yqjasGK 75V0AGDFV2xNkt+x76HZ0bKaFihfg3M7e0NZbon1BF3d4w/Z0HZ/JVaUEBglKTnz QdLD6Y8nKroaTazHfwCwR8JUPesFOuxAqIlZdEXWt2/adfgs7HaTjwu14nD5rrbQ eQhaUR6PyUE= =x9f4 -----END PGP SIGNATURE----- Merge tag 'x86-urgent-2026-10-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fix from Ingo Molnar: - Work around AMD TLBI Erratum #1718 (Borislav Petkov) * tag 'x86-urgent-2026-10-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/CPU/AMD: Fix AMD TLBI Erratum #1718 |
||
|
Linus Torvalds
|
b2d929a1c2 |
RISC-V updates for v7.3-rc7
- Fix a regression in the Zbb-enabled strnlen() implementation when
huge counts are specified
- When userspace pointer masking is enabled, strip the tag from
user-specified pointers in two spots in the RISC-V futex code where
this was missing
- When CONFIG_SHADOW_CALL_STACK=y, use a supervisor mode-only CSR bit
to determine whether the trap came from userspace or not, rather
than a userspace-writable register
- Reset the HSTATUS.HU bit during CPU initialization to avoid
unexpected behavior, as the RISC-V specification does not require
this bit to be hardware-reset
- Fix the T-Head GhostWrite probing code when !CONFIG_ERRATA_THEAD_MAE
- Fix RV32 boots using 32-bit.config by constraining NR_CPUS
- Implement a workaround for SiFive MAL-9092, which requires fences
around hypervisor load/store instructions
- Fix the RISC-V patch_map() code to work properly for EXECMEM
addresses when !CONFIG_STRICT_MODULE_RWX
- Fix ptrace register set access reporting when CFI landing pad or
shadow stack support is enabled
- Avoid copying garbage into the target's vstate when PTRACE_SETREGSET
is called with a short iov_len
- Fix load_unaligned_zeropad() on RV32 kernels with
CONFIG_RISCV_EFFICIENT_UNALIGNED_ACCESS=y
- Fix build breakage for any userspace program that includes
uapi/asm/vendor/mips.h
- Fix a build warning for 32-bit allmodconfig builds related to SiFive
errata
- Fix misspecified inline assembly constraints in the vector context
save/restore code
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEElRDoIDdEz9/svf2Kx4+xDQu9KksFAmrLCxIACgkQx4+xDQu9
Kkv0uRAAmTamkNXZpPx0WF9/i48d+40TS7U45u+w0wKbNxgRR+R4jNHOGr91bNQn
82pOG7c8AQbDJv0bed9EgdYQCQR58VC+GXLcCdV9ZvINs9ffIpyoYlD0kL5YXjSv
0kEM6ZCFn3+tLLko8e3UuBGZwnwN2VeyBae1TOutJx/jjTU6R2vrZHAsNd4ol3PB
CcZX533cbNDY4NKZHzniPXdWPdzWK42I5+HwNayf3BFUEsnN/JUZwHI0sTt3wgZo
DpOTRm/C883VelF8NnpPl0cAEux/0KfTP0GPsnPFOvuvIDA/Hn/PfRhweyjCRZ1r
LYWYLpvpbkCOPvyzFL0eKzl1DOgz8KtqdqOA/qUUooxog1egJ9uBynXrh0We4IV1
EbxRjKDiJ7QJJsX8m0xpWtMFYU0hQ3MHxePAxeSVdA5mHksEhWxvudWScwm2Cpt7
9Vq01WmyV3uBMlq7Cd9KJxyNGOTikpciMnUIR4h0WaHZxuevAfgXhs2dVRS2u/Be
a2CztPGV931/1BGLP+wV6I6BXqet+4Q86VDo1Dcj7u6Zr0NyjmJYfz64cmNrSVWZ
CDm9wvxhEedD+9fNvP4fx8B+8nRNZDpWtpevkFy5iDHkd9xeauKax9njrH/gw2S4
lIZZ1+5D14c/d6s0OJIwrMe+xcYu3cZ6qVCEmQXuO3jTHiXky4I=
=ZFs2
-----END PGP SIGNATURE-----
Merge tag 'riscv-for-linus-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux
Pull RISC-V fixes from Paul Walmsley:
"Several security fixes, a significant strnlen() regression fix, and
several other miscellaneous fixes:
- Fix a regression in the Zbb-enabled strnlen() implementation when
huge counts are specified
- When userspace pointer masking is enabled, strip the tag from
user-specified pointers in two spots in the RISC-V futex code where
this was missing
- When CONFIG_SHADOW_CALL_STACK=y, use a supervisor mode-only CSR bit
to determine whether the trap came from userspace or not, rather
than a userspace-writable register
- Reset the HSTATUS.HU bit during CPU initialization to avoid
unexpected behavior, as the RISC-V specification does not require
this bit to be hardware-reset
- Fix the T-Head GhostWrite probing code when
!CONFIG_ERRATA_THEAD_MAE
- Fix RV32 boots using 32-bit.config by constraining NR_CPUS
- Implement a workaround for SiFive MAL-9092, which requires fences
around hypervisor load/store instructions
- Fix the RISC-V patch_map() code to work properly for EXECMEM
addresses when !CONFIG_STRICT_MODULE_RWX
- Fix ptrace register set access reporting when CFI landing pad or
shadow stack support is enabled
- Avoid copying garbage into the target's vstate when
PTRACE_SETREGSET is called with a short iov_len
- Fix load_unaligned_zeropad() on RV32 kernels with
CONFIG_RISCV_EFFICIENT_UNALIGNED_ACCESS=y
- Fix build breakage for any userspace program that includes
uapi/asm/vendor/mips.h
- Fix a build warning for 32-bit allmodconfig builds related to
SiFive errata
- Fix misspecified inline assembly constraints in the vector context
save/restore code"
* tag 'riscv-for-linus-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
riscv: fix load_unaligned_zeropad() fixup for RV32
riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp
riscv: ptrace: Zero-initialize regset buffers before copyin
riscv: ptrace: reject CFI regset access when extensions are absent
riscv: fix NR_CPUS range leaking 64-bit default onto 32-bit builds
riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE
riscv: futex: untag the user pointer before the atomic access
riscv: lib: Fix ZBB strnlen wrap-around regression on huge counts
riscv: patch: fix handling of bpf-jit execmem addresses
RISC-V: Clear HSTATUS.HU on CPU initialization
RISC-V: errata: Add SiFive MAL-9092 workaround
riscv: vector: Fix output operands in context save
riscv: vector: Fix data pointer constraints in context save/restore
riscv: limit sifive errata to CONFIG_64BIT
riscv: hwprobe: use _BITULL() rather than BIT() in MIPS vendor uapi header
|
||
|
Linus Torvalds
|
b88c841d11 |
Input updates for v7.3-rc6
- A fix for the ati_remote2 sysfs attributes handling, resolving type confusion after conversion to dev_groups - Updates to the xpad joystick driver adding support for the Corsair Novablade Pro controller (wired and 2.4 GHz wireless) and a newer hardware revision of the 8BitDo Pro 2 Wired Controller for Xbox. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQST2eWILY88ieB2DOtAj56VGEWXnAUCasr21QAKCRBAj56VGEWX nBWuAQCBO6dsRJKdKICBgjj55mb8P9yOmtAXUDaSWnMONbcWJAEA3l0SJ8GnL0jh 4hLh6aCf4tTjIrB/cyKx47dSvj5YxQg= =3bCc -----END PGP SIGNATURE----- Merge tag 'input-for-v7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: - A fix for the ati_remote2 sysfs attributes handling, resolving type confusion after conversion to dev_groups - Updates to the xpad joystick driver adding support for the Corsair Novablade Pro controller (wired and 2.4 GHz wireless) and a newer hardware revision of the 8BitDo Pro 2 Wired Controller for Xbox. * tag 'input-for-v7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox Input: xpad - add support for Corsair Novablade Pro Input: ati_remote2 - fix type confusion in device attribute handlers |
||
|
Darrick J. Wong
|
7dfb218c82 |
xfs: fix exchange-range-to-eof file size exchange
Norbert Szetei posted a patch containing an incomplete description of a
bug in XFS_IOC_EXCHANGE_RANGE's TO_EOF flag. The bug tricks
exchange-range into modifying a file so that it has shared blocks
starting beyond EOF, which is never allowed because files never have
written data beyond EOF, and you can only share written data blocks.
This is key to all the incorrect behavior that follows.
Eventually I got from Norbert a description of what's going wrong:
> Fair. Here it is with physical block numbers, 4k blocks. peer is the file
> that gets rewritten and file1 is the one that ends up with the flag
> cleared.
>
> Start, nothing shared:
>
> peer size 4096 -> [100]
> file1 size 12288 -> [200] [201] [202]
> donor1 size 4096 -> [300]
> donor2 size 4096 -> [400]
>
> 1. FICLONERANGE peer's block into file1's middle slot:
>
> peer size 4096 -> [100]
> file1 size 12288 -> [200] [100] [202] reflink flag set
> ^^^^^ both files own block 100
>
> 2. XFS_IOC_EXCHANGE_RANGE file1 against donor1, file1_offset 0,
> file2_offset 8192, length 0, TO_EOF. One block is exchanged, and the sizes
> are exchanged with it:
>
> file1 size 4096 -> [200] [100] [300] reflink flag set
> ^^^^^^^^^^^ still owned, now past the size
> donor1 size 12288 -> [202]
>
> file1 says it is one block long while it still owns three. Nothing was
> unmapped. file2_offset is block 2, so this exchange cannot clear a flag.
>
> 3. XFS_IOC_EXCHANGE_RANGE file1 against donor2, both offsets 0, length 4096.
> By i_disk_size this is two one-block files exchanging everything, so
> xmi_can_exchange_reflink_flags() agrees and the flag is cleared:
>
> file1 size 4096 -> [400] [100] [300] reflink flag CLEARED
> donor2 size 4096 -> [200]
>
> Block 100 is still shared with peer.
>
> 4. pwrite(file1, 4096, 4096), which is file1's second slot, block 100.
> xfs_is_cow_inode(file1) is false, so no CoW:
>
> peer size 4096 -> [100] same block, new contents
>
> Block 100 is the only one that matters here. PoC below, it reads a file
> called peer in the current directory. The filesystem needs reflink and
> exchange-range, which mkfs.xfs 7.x turns on by default.
So yes, TO_EOF is screwing up the file size even if it's actually
exchanging the data block correctly. The following is the intended
behavior of XFS_EXCHANGE_RANGE_TO_EOF, as described by its manpage:
"Ignore the length parameter. All bytes in file1_fd from file1_offset
to EOF are moved to file2_fd, and file2's size is set to
(file2_offset+(file1_length-file1_offset)). Meanwhile, all bytes in
file2 from file2_offset to EOF are moved to file1 and file1's size is
set to (file1_offset+(file2_length-file2_offset))."
In other words, if we only exchange a portion of the file data, then we
should only exchange the portion of the file size that relates to the
exchanged data. Unfortunately, the code swaps the ondisk file size and
the incore file sizes, which is incorrect if the caller passes in a
nonzero offset.
Having confused the file sizes, the PoC uses a second exchange-range
call on what looks like a non-reflinked single-block file. Because the
file size is set incorrectly, exchange-range thinks it's exchanging the
full contents of two files and clears the reflink flag on the broken
file. That enables an extending write of the broken file to rewrite the
shared block that's just past EOF. This has become known colloquially
as refluxfs.
Once the file sizes are set correctly, the second exchange-range no
longer thinks that it's doing a full-contents swap, so it won't clear
the reflink flag on either of its file arguments.
Norbert followed up to an earlier version of this patch with a second
complaint about us not handling the i_disk_size state correctly:
> The offsets are bounded against the incore i_size but subtracted from
> the ondisk i_disk_size, so a file that has not been written back gives
> xmi_isize1 = 0 + (0 - 12288).
>
> For instance, you can do:
>
> $ xfs_io -f -c "pwrite -q 0 4096" -c fsync file1
> $ xfs_io -f -c "pwrite -q 0 12288" \
> -c "exchangerange -s 0 -d 12288 file1" dirty
> $ stat -c %s file1
> 0
> $ stat -c %i file1
> 131
> $ sudo xfs_io -r -c "bulkstat_single 131" . | grep bs_size
> bs_size = 18446744073709539328
That's wrong, and the new file size update logic depends on the ondisk
i_disk_size matching the incore i_size, so flush the pagecache as needed
to push it upwards.
Link: https://lore.kernel.org/linux-xfs/1E196589-DEBE-40AC-AFEA-D420DAAB067F@doyensec.com/
Reported-by: Norbert Szetei <norbert@doyensec.com>
Cc: stable@vger.kernel.org # v6.10
Fixes:
|
||
|
Norbert Szetei
|
d84d6c1a7f |
xfs: stop exchanging reflink flags when exchanging mappings
When an exchange covers both files from offset 0 to i_disk_size, xmi_can_exchange_reflink_flags() assumes every mapping moved and hands the reflink flag over to the other file. That assumption is wrong. A file can still own shared blocks past i_disk_size, e.g. after EXCHANGE_RANGE_TO_EOF sets a smaller size without unmapping anything. The flag is cleared anyway, and the next write to such a block happens in place instead of CoW, corrupting the other file that shares it. Commit |
||
|
Linus Torvalds
|
a5ebb76233 |
- amd64_edac: Shorten the ErrorInformation field read from the MCA_SYND MSR to
only two bits. It is perfectly fine to do so because no system ever supported more than 2 bits of information (the Chip Selects used were only 4 maximum) and newer hardware will use only 2 bits anyway -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmrKvjAACgkQEsHwGGHe VUrXohAAkfpqZl6l2SOOyrDNEAX8VqhhuIlp/wV+xpWtP32AZWDb3xyjrUB+Vzxs aR68mt57xzEWDQY0ciwIDWrxPSydDIWBIG6xeHAJc6PcT9BhP406MZ19mmJGRS85 Yl5yYlqm2Ucr8UGCe2vlS+4/CU2nbnRsXC7OeOMbVEKm73E/0Auq0Za8N+45SwcN 5QoPt1ffZBL6MJMceX73uztwwvXoh68/jnVd4LjjF8w7JUoXuOa1m/tDosL3zDNR 4Oy+i5YOfXNQ96L4OS4nwLBuUdwH4psWcWOwAD3WN+10OBWtMxUIV5cJgwcB+oHm SL0J5TECPJtWRmzNBraqPnOW8hwMFLrT1KOxOaq/nO7D1T2K+2Hf8Wo1/btoQWqz jisRSfNbaGeDuiXAoZKsWf6AkVBMHb3eXPsNRCywXh13+oZ5BfMtojXBYD9BHQsy U9DGLNuecccCvVbMvqci3wj+nYNgWt5ZRkqT9HeIcnFSRc6kC7O3c40qNAtwl1Qj NbGKkfelAQRaJFaT7l1tPj4NlsanqL/J3sF+wV5HZShhiWkUmaT9Pr6NXXKzq7I+ eUO7ccDb7RaAdGTvK1V6Gl3oPaHa+o23qFvBSqKA6GGClwZpO3G8qwVSEoZHGtS1 L0wEC1bzN3I+C9Uq/SKyCuaefouvBQJGMGr0XhwZ8RRTFfISjnA= =F1H/ -----END PGP SIGNATURE----- Merge tag 'edac_urgent_for_v7.3_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC fix from Borislav Petkov: - amd64_edac: Shorten the ErrorInformation field read from the MCA_SYND MSR to only two bits. It is perfectly fine to do so because no system ever supported more than 2 bits of information (the Chip Selects used were only 4 maximum) and newer hardware will use only 2 bits anyway * tag 'edac_urgent_for_v7.3_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/amd64: Mask UMC chip select to the four implemented selects |
||
|
Linus Torvalds
|
bb934c29fd |
drm fixes for 7.3-rc7
fb: - defer setup when fbdev_probe() fails, not just on -EAGAIN bridge: - Fix unlocked list_del in drm_bridge_add() - Fix unlocked list access in drm_bridge_attach() - th1520-dw-hdmi: Fix error check on dw_hdmi_probe() return value - th1520-dw-hdmi: Fix remove() callback aspeed: - Balance the display clock enable on teardown i915: - Fix a GT park race that could trigger spurious RPM wakelock warnings - Fix execbuffer relocation cleanup to avoid out-of-bounds free xe: - i2c removal - system Controller Maibox header handling - two bo pin/unpin accounting bugs - not emitting a w/a twice - xe_mmio_wait32() to honor delay/sleep maximums amdgpu: - Fix direct scanout alpha on some DRM_FORMATs - UserQ fixes - Fix tearing flips with PSR - GPU reset vblank fix - Debugfs register interface fix - Fix display mode patching - Expand Mac reserved memory workaround amdkfd: - SDMA doorbell fix - Fix dma-buf reference leak in error path imagination: - fix reference and vm_bo handling in remap() - size page table preallocation by device address gud: - don't keep a connector without a CRTC as connector_state panthor: - validate userspace queue count against initialized firmware slot count nouveau: - fix null ptr regression - skip turing CE workaround for non-GR vmwgfx: - validate pitch value - add blend mode property vc4: - drain hangcheck timer on unbind - free BO cache on teardown - use kvmalloc_objs for bo cache size list - disable V3D interrupt across runtime suspend - fix binner slot allocation - fix fw refcount leak -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmrKj3sACgkQDHTzWXnE hr6e+A/+I1d+UvVkSnIsMv7NGLGiNvDClWvTnypF0ys2poiUGZ88UPzGuE7r8zfc BK9zZnQ/+LSYu/NLhmLnxDxYmx+Y2rKMjQEq22RsjUAzrPhn0/UsoWTt5jRMfim+ If9gW5p51rX4TBH90fgiTiwvAHxfSSzPjIlQIcjSAQKFxOIZ6mQtyKU4453H//XQ AO1fIDOvcUnZXyQCveoLtaU9ICKv5HNTwF4UBAnRfOmrJr/1ny2H51/tsFkh4Dwy h/OMyJDMNSfa/w9JZOGC/+fEipEQZ15Hk3QUy8i+UUEtD/JKFeG2nlNPuKqjjhrA slQa8E9M7anw+akPjJ0vWrOrqMXcxXE9huRWUUvv9MXkXpFjYmUeBTw1Q9Oc2No4 kdqmS9Skl6R/VJjeWeV2m/iNftL0k3CUWr2paCb9nGUOoaxdoMC72JVl7MprrSOT KG46ggDMfqhIygfkT+PBighZkMCJs/Fkw/UCM9Dldc3M3ds1VmQnH9I+1W+LUqjN OHT5FJfiabejImgnrPtPDtGJtZQub7K9ZUJc13GqxjCK3IXp1oqit8wVZS1qqmw7 3dpc+mWB0Re9CnlaOVb/WTzbip3WGlX8mdHrm+gKYHhigR5EjwiZSal7jP+fKYqK riXBBTU4CE44Y92lutvtJ4NjSqiShK/pzAkzPVVL8bCYoQAL4fk= =TKVJ -----END PGP SIGNATURE----- Merge tag 'drm-fixes-2026-10-11' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Ailie: "Live from Dublin Airport, it's Saturday Night drm fixes. This week has the missing misc fixes from last week which I tracked down and seemed to be a race/bug in my lei setup somehow, once I asked lei to ignore it's cache I got the missing email. But there are more misc fixes this week and amd and intel ones. The main ones in this are amdgpu and xe, with vc4, vmwgfx, nouveau and imagination in the middle, with a bunch of small single fixes. Bit busier than I'd like, but the missing misc might explain it, anyways time for me to fly home. fb: - defer setup when fbdev_probe() fails, not just on -EAGAIN bridge: - Fix unlocked list_del in drm_bridge_add() - Fix unlocked list access in drm_bridge_attach() - th1520-dw-hdmi: - Fix error check on dw_hdmi_probe() return value - Fix remove() callback aspeed: - Balance the display clock enable on teardown i915: - Fix a GT park race that could trigger spurious RPM wakelock warnings - Fix execbuffer relocation cleanup to avoid out-of-bounds free xe: - i2c removal - system Controller Maibox header handling - two bo pin/unpin accounting bugs - not emitting a w/a twice - xe_mmio_wait32() to honor delay/sleep maximums amdgpu: - Fix direct scanout alpha on some DRM_FORMATs - UserQ fixes - Fix tearing flips with PSR - GPU reset vblank fix - Debugfs register interface fix - Fix display mode patching - Expand Mac reserved memory workaround amdkfd: - SDMA doorbell fix - Fix dma-buf reference leak in error path imagination: - fix reference and vm_bo handling in remap() - size page table preallocation by device address gud: - don't keep a connector without a CRTC as connector_state panthor: - validate userspace queue count against initialized firmware slot count nouveau: - fix null ptr regression - skip turing CE workaround for non-GR vmwgfx: - validate pitch value - add blend mode property vc4: - drain hangcheck timer on unbind - free BO cache on teardown - use kvmalloc_objs for bo cache size list - disable V3D interrupt across runtime suspend - fix binner slot allocation - fix fw refcount leak" * tag 'drm-fixes-2026-10-11' of https://gitlab.freedesktop.org/drm/kernel: (39 commits) drm/nouveau: Skip the Turing CE workaround object for non-GR channels drm/vc4: Fix binner slot allocation failing on an idle GPU drm/vc4: Disable the V3D interrupt across runtime suspend drm/imagination: Size page table preallocation by device address drm/imagination: Fix reference and vm_bo handling in remap() drm/amdgpu: make Mac FB workaround generic drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info drm/amd/display: Don't replace a sink mode that shares the native totals drm/amdkfd: align SDMA doorbell base for shader doorbell writes drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks drm/amdgpu: serialize vblank counter reads against GPU reset drm/amd/display: disable self-refresh on tearing flips drm/amdgpu/userq: return the memdup_user() error for the user MQD drm/amdgpu/userq: only accept doorbell BOs as queue doorbell drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs drm/xe/i2c: cancel the client work on remove drm/xe/sysctrl: Fix mailbox header handling drm/i915/gt: Unmask interrupts only when ACTIVE is true drm/i915/gem: Prevent overstepping exec array boundary drm/gud: don't keep a connector without a CRTC as connector_state ... |
||
|
Linus Torvalds
|
b62f58bd71 |
i2c-fixes for v7.3-rc7
qcom-geni: fix runtime PM reference leak on xfer -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQScDfrjQa34uOld1VLaeAVmJtMtbgUCasoNSwAKCRDaeAVmJtMt bvJNAQDmm2Rj8dyCOMlm6pNRJv8Wh6CpydUbmTbko/GRMsBWiAEAsPiRtXC07Z+w GrOIQdIVrKCPiShnW0ajDufnMZjDpg4= =i2NX -----END PGP SIGNATURE----- Merge tag 'i2c-fixes-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux Pull i2c fix from Andi Shyti: "Just one qcom-geni fix for a runtime PM reference leak during transfer setup" * tag 'i2c-fixes-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux: i2c: qcom-geni: release runtime PM reference when set_rate fails |
||
|
Dave Airlie
|
c61e23ed14 |
A pointer assignment fix for gud, a reference fix and a preallocation
size fix for imagination, a suspend fix and an allocation fix when idle for vc4, and a hardware variant fix for nouveau. -----BEGIN PGP SIGNATURE----- iJUEABMJAB0WIQTkHFbLp4ejekA/qfgnX84Zoj2+dgUCasjkYwAKCRAnX84Zoj2+ dpu/AX0QwkYdn5r75S9Nsud12AGxs68MQYdf9O/JnsJYO5+Y5L078rTScygmDnvT civ/Y3ABgIhqXI1I/vXtyC7T+REXa47Gpll+ZVtw2FLj7c9czWjgr2iHIqXpn8pK 3A7y86s0kA== =YUdz -----END PGP SIGNATURE----- Merge tag 'drm-misc-fixes-2026-10-09' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes A pointer assignment fix for gud, a reference fix and a preallocation size fix for imagination, a suspend fix and an allocation fix when idle for vc4, and a hardware variant fix for nouveau. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maxime Ripard <self@mripard.dev> Link: https://patch.msgid.link/asjkbknTHg2t8JGy@houat |
||
|
Dave Airlie
|
492c4ded0f |
amd-drm-fixes-7.3-2026-10-08:
amdgpu: - Fix direct scanout alpha on some DRM_FORMATs - UserQ fixes - Fix tearing flips with PSR - GPU reset vblank fix - Debugfs register interface fix - Fix display mode patching - Expand Mac reserved memory workaround amdkfd: - SDMA doorbell fix - Fix dma-buf reference leak in error path -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQQgO5Idg2tXNTSZAr293/aFa7yZ2AUCasfVFQAKCRC93/aFa7yZ 2Nf6AP0T/qzbqO519Aih3Zr1Y8rETWjQ38fCoDbojom9/tzAoQD9HgNQkNvkO+fK R4uCeUzG91tnJK2Yuzv+WzWIbLQrdAA= =Ptpq -----END PGP SIGNATURE----- Merge tag 'amd-drm-fixes-7.3-2026-10-08' of https://gitlab.freedesktop.org/drm/amdgpu/kernel into drm-fixes amd-drm-fixes-7.3-2026-10-08: amdgpu: - Fix direct scanout alpha on some DRM_FORMATs - UserQ fixes - Fix tearing flips with PSR - GPU reset vblank fix - Debugfs register interface fix - Fix display mode patching - Expand Mac reserved memory workaround amdkfd: - SDMA doorbell fix - Fix dma-buf reference leak in error path Signed-off-by: Dave Airlie <airlied@redhat.com> From: Alex Deucher <alexander.deucher@amd.com> Link: https://patch.msgid.link/20261008174658.2506431-1-alexander.deucher@amd.com |
||
|
Dave Airlie
|
a8013cbe8d |
Fixes on:
- i2c removal (Fan) - system Controller Maibox header handling (Mallesh) - two bo pin/unpin accounting bugs (Thomas) - not emitting a w/a twice (Tvrtko) - xe_mmio_wait32() to honor delay/sleep maximums (Al\ an) -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEEbSBwaO7dZQkcLOKj+mJfZA7rE8oFAmrHxFUACgkQ+mJfZA7r E8py7Qf+ODo88JXxsL6C62wpd4nNbYxxBxLGW0TLrmtveBm/2uLvQQInOJpkE/Ni awXUrW92CbJWN1cAxvrvrGQBO1NedkypCMxHgmfsiUmSmEpT34/KXLExn8A5Kddo m+VzMxHWavk0k4ELsullJlFSZbnTC3hwOZlK7tJ0HaKatEpH8uM8EQk3qZqGEnOM OjuQDLLyEF3MwwvSv+Y81oZLfeNHaJ6esjmSX4mccd3sxjmRa0dFPAjRaRzLa+2P A+cw3ep+cRBZSutNBhElWPJZTrRzgNBKkBnB05+FeIctcRNbhvUf23IiWlf2kWvg G4DkiE/m/G/RKO+/t0DNsiDcnIloGA== =610A -----END PGP SIGNATURE----- Merge tag 'drm-xe-fixes-2026-10-08' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Fixes on: - i2c removal (Fan) - system Controller Maibox header handling (Mallesh) - two bo pin/unpin accounting bugs (Thomas) - not emitting a w/a twice (Tvrtko) - xe_mmio_wait32() to honor delay/sleep maximums (Alan) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patch.msgid.link/asfEfgbIjs0GJ-RF@intel.com |
||
|
Linus Torvalds
|
3857c2fe54 |
pci-v7.3-fixes-4
-----BEGIN PGP SIGNATURE-----
iQJIBAABCgAyFiEEgMe7l+5h9hnxdsnuWYigwDrT+vwFAmrJDcMUHGJoZWxnYWFz
QGdvb2dsZS5jb20ACgkQWYigwDrT+vy3yg/+N0HQJ+3TmmVgLHpZryZnicIvr4Rk
aak7isoP1g2fCHXmNaHptm5bOWyGOJ3sPl8t6Z2JtNNqEO/Fz4bF2KNQkTtCnvRP
dB/j9deI2omhpIWpmOAaL6Z5nN3rbKz8OFxyQGQpkG83qS7M0jF0rpSLLhi6wyp+
EBDMkw03OK6iubvwaECJdwmdk1mkhjHnv04ONLZfq8DNJm7jFQYAui2nQ2Fw8lti
BZb8yY+CGW/PUpGgSmJOa2UERxNBKH78sSK218nsQ5M7oXU4rLzgjmKnyfIz1F6X
1Xqs2R7UzO1kosHpjqR9wSBIay5331g9fdSVYSiMcVXGbroxZZ9yzvgBTQABeaT8
jLo6l6Z/j8CQ5B9oq4nk8lAeZj661IMIQKyJcssbIvwv4Nq+5JHECr1n8loo9sTG
85r4n6nSSBXxQlg4EY+SVXTO5Rpf0QYz6CI0eIYeUU2oxlAhctJ+B2khBmSTgSzY
lw1XiQDOMgD1WDH/GN0pr/alvi90RMhj1s6dnVlYEiCF9FyAXR1zb8EpFZ0SsBm5
I28N/+QmlUw1hrdeRiYn1c+5asvCCqAx2OR3xlllU55CS7rsjXdOVnPUFe6xtH93
0Yi3KmH0uVl6X+WgWjGnLCWYIBR3DAE9lF8LzNlKMVSP+V6TfPvrnfNahuZvdK7H
NbraXi5qBPycGyw=
=fagl
-----END PGP SIGNATURE-----
Merge tag 'pci-v7.3-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci
Pull PCI fix from Bjorn Helgaas:
"This fixes some GPU initialization regressions caused by
|
||
|
Linus Torvalds
|
b71ccf604f |
MMC host:
- cavium-octeon|thunderx: Destroy slot platform devices on remove
- mtk-sd: Cancel request timeout work on remove
- sdhci-sprd: Disable runtime PM on remove
MEMSTICK:
- Wait for request completion before freeing card
- rtsx_usb_ms: Complete requests after eject instead of dropping them
-----BEGIN PGP SIGNATURE-----
iQJEBAABCgAuFiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmrI78UQHHVsZmhAa2Vy
bmVsLm9yZwAKCRD+JoQlc1iMKcd6D/4sm/MrbdE0d8Q9ceIV9BAfiQfETj4mo53Q
3uH07n9PSaxVIJotLvvjni5TmAiISqXm+ZyNb0VMn8Xz4piVOhaOY4vKaiiLM71B
bMaim5lLd/oc5IopvzaYgEz7hOV6NSbqMjlC31fBQhkEtD9f182/A0324LFAuE0T
H+VtnhxbExzCXbeeSCWQhERaWTG93csh9gTSS8W9kZzcTngEVly+vpZELTeJwhZl
sVfzFTIf7Jv3omeDfMfwWUgfYRHlBVvgjI0ZtgZbZzhWyLj8SOQXvqH/PKmn+mxx
UdrmJsrTCI0MmbJRnmOkxgD5t9KGmVPD8oS36BUGZ/6qYRs+bzCRqAN3n+kXHmV4
cYF6/YOUNVBIkJ9qPZZapySYI3YBlu9GgD+dMriAAc+Jt2jBlbNBqdzQScouCSx3
kjx50GiPC7HSwtf77Up3inJuVig7Qwut2BnEznhYgtv1AatNqZAzMLzx+ZB8M/Dw
kOQDkQNGeg+Lpmd2oqjtnHezdiR5b+H2Zc5U+I8lSMRZPmHn1yhE5KKAxkLdcTaJ
SUQN1Nn2cFiyef55apb03K2JHQS+Wh7xzDvbR4/rZ4VursJgNuRE9G0YmU+jJlrg
IlsGKFXRvTuub0E+MvQ57xLxo4CjG40J9wgPgygTldLb1aU2OJKUX/JzwBTMDTD1
AcrnwZub/g==
=42Y1
-----END PGP SIGNATURE-----
Merge tag 'mmc-v7.3-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc
Pull MMC/MEMSTICK fixes from Ulf Hansson:
"MMC host:
- cavium-octeon|thunderx: Destroy slot platform devices on remove
- mtk-sd: Cancel request timeout work on remove
- sdhci-sprd: Disable runtime PM on remove
MEMSTICK:
- Wait for request completion before freeing card
- rtsx_usb_ms: Complete requests after eject instead of dropping
them"
* tag 'mmc-v7.3-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
memstick: rtsx_usb_ms: complete requests after eject instead of dropping them
memstick: core: wait for request completion before freeing card
mmc: cavium-thunderx: destroy slot platform devices on remove
mmc: cavium-octeon: destroy slot platform devices on remove
mmc: sdhci-sprd: disable runtime PM on remove
mmc: mtk-sd: Cancel request timeout work on remove
|
||
|
Linus Torvalds
|
f7bec60381 |
[GIT PULL for v7.3-rc7] media fixes
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE+QmuaPwR3wnBdVwACF8+vY7k4RUFAmrJCqQACgkQCF8+vY7k 4RWu/w/+LBwsMO9VA1C16lAKROP5HwuSdumeNnsjNinZX4Tonmz7Y5L+Ru+9Jzcz WDpbNtJTNhMa2f+i1YhCPVxNp22mwuGaqNUm8xfipt9fuvwShPaTTzoNsEh7l3iT TwMt2G5Np0G1u0fiDaBESR30sKw6YfYR8nxhM3lP4FfK4M3GhkuDnaAtwzCHa1Dm 1M1J76kS6eUGT+BOJMy6qARhAD00zQgjk9HZDV56FmCsz2XdDh1hnOC11IvbRV+K spdU3TffnoU4FMWQQnqJHxJR/Btq72O0CmiHVPopHQFM9DA6eEBd0eUcXTieIjbb aFp04/z0EWlYuwEGPKvnAdmwiJfRgoMLgGTnyViZMV0KtGbXVHmEr4KhUjRNMvVl Vjz/9ehYEweiKwQhUuV+upaQeWyQzI9VNbkAr9KSXX81piyFAkzur4dXljf8qR/x KQUIyhyshcvgQ0upoVFZ2q23hq1s7hKGOmFKT6DZhXs0OySkYRbj/iFzQ4YyhBpJ qTMmFF+Edlg0CtVhST3QxZcYv7b97RG2pue+R2jX71xB25yq2MbebMmjKB8Vp5id AhsvlRY0Dyp1sPqPtfukERSoCgJ6UHKI6D7DqpqzUcIeLgVyBEAjri4jUCZxhvXn 9fzYX56K1IuEFUl64LrPAhejo0iQTsdKx/gBprQulzwsDp4QrX8= =M/y8 -----END PGP SIGNATURE----- Merge tag 'media/v7.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fix from Mauro Carvalho Chehab: "A fix for em28xx unregister code affecting devices with FM radio support" * tag 'media/v7.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: em28xx: use video_unregister_device for radio_dev |
||
|
Linus Torvalds
|
5f6ee187fa |
sound fixes for 7.3-rc7
A dozen of small fixes. All device-specific quirks or fixes, and nothing exciting is expected. - USB-audio and HD-audio quirks - HD-audio TAS2781 codec fix - ctxfi driver memory leak fix - ASoC AMD quirks - ASoC cs35l56 and adau1372 codec fixes -----BEGIN PGP SIGNATURE----- iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmrI71gOHHRpd2FpQHN1 c2UuZGUACgkQLtJE4w1nLE/doA//VzIL0NcwVlEduCcwTcfWRwGjn7QPPA0isbjy Z+2SDryLxx+JgnCf6tI86CcBjP7o4hWHX9pHXb3smy7862aoWAUt5r5LR2MCZNa0 Q6wGiqDcL3jhNdy5gE5KUzShtD3DWAXo4Pqv/urHyOBHjcGqa6HNAurja7tmFne6 5DkozkvxyP/CIUsOHltO+YRPzmI7OIrLGjC5lbuyhNHIzCOEyUHgKaVFzyr6Fwcz ansQpgOQxc+0VN/FEVI0rXqxG483pSP+M0Ao8Y+aWpSTG534dgw2oGC10M2G59uW p4MyHkkhMcy41ARMLWWlYmzCEbsleiBBUUqIhKIwOAWJRHksRHwRtmHmTpcJbAHZ E7HkRGw6WOyxo9KKeD0fdyxBIF5VIvqrumjreWu2dX9XNJDzrfJZMtkzB+rStqmQ KR7uctZvGgfFKOJ76ENYmeEaEVNFREGK531aGRgiqCvOEJ/naY3PT/V3f6BIDjp+ OmG1YFqkI2vbC+Vw49+ydiAbvLz/ulhsFRvlNGzZl829Gpn/cwnw1sBRW+2QoCzX 4a6ICUZ76NlsneiqI3yHCm87VyDPmY8Mn3V8UAbEapt6G5xirDjDClV3qHAn928A fRZ5YB4poD/ek143mp306ljnxx14nQZiFDowLAIbi5ZCIjv6cXMMw79wOe4yzOax 0xYNFXo= =at5l -----END PGP SIGNATURE----- Merge tag 'sound-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A dozen of small fixes. All device-specific quirks or fixes, and nothing exciting is expected. - USB-audio and HD-audio quirks - HD-audio TAS2781 codec fix - ctxfi driver memory leak fix - ASoC AMD quirks - ASoC cs35l56 and adau1372 codec fixes" * tag 'sound-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ASoC: amd: acp: Add more ACP7.0 match entries for Cirrus Logic parts ASoC: amd: acp: Add DMI override for ASUS EXPERTBOOK AM7406CKA ASoC: sdw_utils: Switch CS35L56/57/62/63 to use OT25 DAI ASoC: cs35l56: Add DAI for SDCA OT25 stream ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes ASoC: adau1372: allow sleepy powerdown GPIOs ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P) ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg3xxx (103c:8bfd) ALSA: hda/tas2781: Accept V1 calibration data without CRC ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers ALSA: hda/realtek: Add quirk for ASRock NUC BOX-358H ALSA: usb-audio: Add native DSD support for Cambridge Audio streamers |