mirror of
https://github.com/torvalds/linux.git
synced 2026-10-07 19:16:02 +02:00
f2c55c76bd
1464427 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Justin Suess
|
f2c55c76bd
|
landlock: Document LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS
Document setting no_new_privs with ruleset enforcement, following the same compatibility section style as previous ABI additions. Include a section explaining the tradeoffs of setting no_new_privs through any means for privileged users of Landlock. Signed-off-by: Justin Suess <utilityemal77@gmail.com> Link: https://patch.msgid.link/20260809154544.1253100-5-utilityemal77@gmail.com Signed-off-by: Mickaël Salaün <mic@digikod.net> |
||
|
Justin Suess
|
71f98bc6e5
|
selftests/landlock: Test LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS
Check that a successful landlock_restrict_self(2) call with LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS sets no_new_privs without a prior prctl(2) call nor CAP_SYS_ADMIN, that a failed call from both an invalid ruleset and hitting the layer maximum leaves the attribute unchanged, and that LANDLOCK_RESTRICT_SELF_TSYNC extends it to sibling threads. Also check that this flag requires a ruleset. Turn the multi_threaded_success test into a multi_threaded fixture with success, no_new_privs, and no_new_privs_max_layers variants to factor out the threading code. Finally, rename restrict_self_fd_logging_flags to restrict_self_fd_flags, and restrict_self_logging_flags to restrict_self_flags to indicate that non-logging flags are now tested. Test coverage for security/landlock is 91.8% of 2373 lines according to LLVM 22. Signed-off-by: Justin Suess <utilityemal77@gmail.com> Link: https://patch.msgid.link/20260809154544.1253100-4-utilityemal77@gmail.com Signed-off-by: Mickaël Salaün <mic@digikod.net> |
||
|
Justin Suess
|
6887c03bf2
|
landlock: Add LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS
Add a landlock_restrict_self(2) flag to set the no_new_privs attribute of the calling thread only after enforcement of the ruleset: no_new_privs is set if and only if the call succeeds. This removes the need for a prior prctl(2) PR_SET_NO_NEW_PRIVS call and guarantees that a failed enforcement leaves the attribute unchanged. Because no_new_privs is set by the call itself, the no_new_privs / CAP_SYS_ADMIN requirement of landlock_restrict_self(2) is fulfilled by construction, and the related EPERM check is skipped. Unlike LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF, this flag always requires a valid ruleset: with a ruleset_fd of -1, such a call would be nothing more than a Landlock-flavored prctl(2) PR_SET_NO_NEW_PRIVS, and there is no valid use case for setting no_new_privs (possibly with LANDLOCK_RESTRICT_SELF_TSYNC) without also enforcing Landlock restrictions. Rejecting these calls also keeps the option of giving them a meaning later. The attribute is only set past the last point of failure, just before committing the new credentials. When combined with LANDLOCK_RESTRICT_SELF_TSYNC, no_new_privs is set on the sibling threads as well, in their commit phase, with the same ordering. Bump the Landlock ABI version to 11, and include the minimal related test changes to keep the tests bisectable. Cc: Mickaël Salaün <mic@digikod.net> Signed-off-by: Justin Suess <utilityemal77@gmail.com> Link: https://patch.msgid.link/20260809212459.2427878-1-utilityemal77@gmail.com Signed-off-by: Mickaël Salaün <mic@digikod.net> |
||
|
Justin Suess
|
c2fe8b60b8
|
landlock: Check landlock_restrict_self(2)'s flags before privileges
landlock_restrict_self(2) currently checks the no_new_privs / CAP_SYS_ADMIN requirement before validating the flags argument. An unprivileged caller without no_new_privs thus gets EPERM even when the passed flags are invalid, hiding the EINVAL error. Move the no_new_privs / CAP_SYS_ADMIN check just after the flags check so that malformed calls consistently error out with EINVAL whatever the caller's privileges, the same way seccomp(2) validates its flags before checking no_new_privs. Update the restrict_self_checks_ordering test accordingly. Cc: Mickaël Salaün <mic@digikod.net> Signed-off-by: Justin Suess <utilityemal77@gmail.com> Link: https://patch.msgid.link/20260809154544.1253100-2-utilityemal77@gmail.com Signed-off-by: Mickaël Salaün <mic@digikod.net> |
||
|
Günther Noack
|
bfff8bec73
|
landlock: Link the erratum documentation for whiteout objects
The documentation embeds the canonical erratum documentation from the header file, which is already a self-contained description of the issue. Signed-off-by: Günther Noack <gnoack@google.com> Link: https://patch.msgid.link/20260813093157.1436894-7-gnoack@google.com [mic: Update the documentation date] Signed-off-by: Mickaël Salaün <mic@digikod.net> |
||
|
Günther Noack
|
17522b96dc
|
selftests/landlock: Test whiteout object behaviour in OverlayFS renames
Even though OverlayFS uses vfs_rename() with RENAME_WHITEOUT on its backing directories, and even though RENAME_WHITEOUT requires LANDLOCK_ACCESS_FS_MAKE_REG, a process that renames non-regular files in an OverlayFS can do so without having the LANDLOCK_ACCESS_FS_MAKE_REG right in that location. This works, and is supposed to work, because the changes to the backing directories are done by OverlayFS, not by the originator task that did the original rename() on the OverlayFS mount. Therefore, the changes done to backing directories are not subject to the originator task's credentials. Test coverage for security/landlock is 91.8% of 2368 lines according to LLVM 22. Signed-off-by: Günther Noack <gnoack@google.com> Link: https://patch.msgid.link/20260813093157.1436894-6-gnoack@google.com [mic: Add test coverage, reflow commit message] Signed-off-by: Mickaël Salaün <mic@digikod.net> |
||
|
Günther Noack
|
8c46c6acbe
|
selftests/landlock: Add audit test for whiteout object creation
Add audit_layout1.make_whiteout: This test looks similar to audit_layout1.make_char, but creates a whiteout object through mknod(). Since whiteout object creation is now guarded with LANDLOCK_ACCESS_FS_MAKE_REG rather than LANDLOCK_ACCESS_FS_MAKE_CHAR, it also needs to log the matching denial to audit. Signed-off-by: Günther Noack <gnoack@google.com> Link: https://patch.msgid.link/20260813093157.1436894-5-gnoack@google.com Signed-off-by: Mickaël Salaün <mic@digikod.net> |
||
|
Günther Noack
|
ee890889b3
|
selftests/landlock: Add tests for whiteout object creation
Add tests to check that whiteout object creation is guarded by LANDLOCK_ACCESS_FS_MAKE_REG, in the cases where these are created from userspace: * Conventional creation with mknod() * Linking or renaming an existing whiteout object * renameat2() with RENAME_WHITEOUT, which creates a new whiteout object in the source location * renameat2() with RENAME_EXCHANGE, with one of the renamed objects being a whiteout object Signed-off-by: Günther Noack <gnoack@google.com> Link: https://patch.msgid.link/20260813093157.1436894-4-gnoack@google.com [mic: Update commit message as requested] Signed-off-by: Mickaël Salaün <mic@digikod.net> |
||
|
Günther Noack
|
672fa082d4
|
landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation
Whiteout objects are used in the upper layer of an OverlayFS to indicate that the file with this name does not exist in the unified view, even if it is present in one of the lower layer file systems. For the userspace implementations of OverlayFS (fuse-overlayfs), whiteout objects can be created from userspace as well: * mknod(2) with S_IFCHR and makedev(0, 0) * renameat2(2) with RENAME_WHITEOUT, creating the whiteout in the old place of the moved file. This commit guards whiteout creation in both of these cases with LANDLOCK_ACCESS_FS_MAKE_REG. Whiteout objects are *not* considered character devices and are not bound to a driver. LANDLOCK_ACCESS_FS_MAKE_REG describes the same permission class as a whiteout object: creating one is the only S_IFCHR creation that the VFS exempts from CAP_MKNOD, so it is as unprivileged as creating a regular file, while LANDLOCK_ACCESS_FS_MAKE_CHAR and LANDLOCK_ACCESS_FS_MAKE_BLOCK keep meaning the creation of devices that expose a kernel interface [1]. For the mknod(2) case, introduce a Landlock erratum. The creation of whiteout objects through mknod(2) was previously guarded using LANDLOCK_ACCESS_FS_MAKE_CHAR, and it is now guarded using LANDLOCK_ACCESS_FS_MAKE_REG. For the renameat2(2) case, fix a bug: Before this commit, renameat2(2) with RENAME_WHITEOUT would create a directory entry even when all LANDLOCK_ACCESS_FS_MAKE_* rights were denied. This does not affect normal renames within layered OverlayFS mounts: When doing a regular rename() on a mounted fuse-overlayfs, it is the fuse-overlayfs daemon that exercises renameat2() with RENAME_WHITEOUT, and only the Landlock domain of that daemon is checked there. Suggested-by: Christian Brauner <brauner@kernel.org> Suggested-by: Mickaël Salaün <mic@digikod.net> Cc: stable@vger.kernel.org Fixes: |
||
|
Günther Noack
|
173b1bd873
|
selftests/landlock: Use an actual chardev for MAKE_CHAR audit test
By passing a (0, 0) device number, the audit test for LANDLOCK_ACCESS_FS_MAKE_CHAR was accidentally creating a whiteout object rather than a char device. In preparation to treating whiteout objects differently, use an actual character device instead. Signed-off-by: Günther Noack <gnoack@google.com> Link: https://patch.msgid.link/20260813093157.1436894-2-gnoack@google.com Signed-off-by: Mickaël Salaün <mic@digikod.net> |
||
|
Wang Yan
|
525acde34d
|
selftests/landlock: Fix spelling error in fs_test comment
Fix typo "allowes" -> "allows" in Landlock filesystem test comment. Signed-off-by: Wang Yan <wangyan01@kylinos.cn> Reviewed-by: Günther Noack <gnoack@google.com> Link: https://patch.msgid.link/20260702015823.368529-1-wangyan01@kylinos.cn Signed-off-by: Mickaël Salaün <mic@digikod.net> |
||
|
Günther Noack
|
6b88ff2b9a
|
landlock: Documentation wording cleanups
Documentation cleanups suggested by Alejandro Colomar, which we have also applied in the man pages. Link: https://lore.kernel.org/all/agW4yMK6CinJGqXt@devuan/ Suggested-by: Alejandro Colomar <alx@kernel.org> Signed-off-by: Günther Noack <gnoack3000@gmail.com> Link: https://patch.msgid.link/20260516190112.4924-1-gnoack3000@gmail.com Signed-off-by: Mickaël Salaün <mic@digikod.net> |
||
|
Doehyun Baek
|
198c43590a
|
landlock: Document fs.resolve_unix audit blocker
The Landlock audit code can emit fs.resolve_unix as a filesystem blocker
for pathname UNIX socket resolution denials, but the admin guide's
blockers list did not mention it.
Add the missing blocker name and ABI version to keep the audit
documentation in sync with the emitted records.
Fixes:
|
||
|
Mickaël Salaün
|
07dca8ef89
|
landlock: Harden sock_is_scoped() against file-less sockets
sock_is_scoped() dereferences other->sk_socket->file->f_cred to read the peer's Landlock domain when evaluating LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET, without first checking that the peer has a backing socket and file. hook_unix_find() performs the same dereference for LANDLOCK_ACCESS_FS_RESOLVE_UNIX and does guard it. Guard it here too and treat a peer with no backing file, such as a kernel socket created by sock_create_kern(), as unscoped. This is defensive hardening, not a fix for a reachable bug. The unix_stream_connect() and unix_may_send() hooks run with the peer held under unix_state_lock() and only after the AF_UNIX core has excluded SOCK_DEAD, and no in-tree code binds a file-less AF_UNIX socket to an abstract address, so other->sk_socket->file is always valid at these call sites today. Cc: Günther Noack <gnoack@google.com> Link: https://patch.msgid.link/20260703152750.2022878-1-mic@digikod.net Signed-off-by: Mickaël Salaün <mic@digikod.net> |
||
|
Linus Torvalds
|
075b74841b | Linux 7.2-rc6 | ||
|
Linus Torvalds
|
f5a7e2ae5f |
RISC-V updates for v7.2-rc6
- Fix swiotlb initialization on systems where DRAM is located above
4GiB (such as the Tenstorrent Blackhole cards)
- Fix an out-of-bounds access in the memory hot-remove code that can
occur on Sv39 and Sv48 systems
- Avoid oopsing during boot if the SBI component of the unaligned
access performance checking code loses a race against __init
function freeing
- Avoid attempting to install the debug-enabled vDSO when it shouldn't
be built due to !CONFIG_MMU
- Avoid some sparse warnings by adding missing __iomem notations
in get_cycles{,_hi}()
- Drop an unnecessary runtime warning in the SiFive errata handler
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEElRDoIDdEz9/svf2Kx4+xDQu9KksFAmpvhjgACgkQx4+xDQu9
KkvxVRAAsKDraTKUCihar+rgSSy3MZaCIo3u3Xg7FExhF7oCNvxdeHXcjgUOFVHl
P3YwbMCm43ztnNC7jXTQyd8OZ+EqneqRNRK0Hvj+dbXLmIV/P0byIbG2VAZPmbal
vYZ7L52M2a25A30ZGSGPknc2kthLyuhM2XOxOFhd8HjJcuyF+76YQbx+Lbw6255/
s4zVAwzlmztfVKV0y8Gark32CnZfJOeytYmIixOL7daDmb1iY70oJv4828wWfVaD
FP2dQkQXfH4VPnces4h5g/0vuhYf3LL76jbXIWgYE+UMEvv2dR2IcgnfBzKLSAcH
xzQpTKr0LIywd/wdVxng1vRk9MM+ltvdNRMF1nhIAS3FvBZYbogSKP6E8vSM2YDR
NL7Qoh+lDf9tAGk2rlGr34wTR3DvX3z0LH4pNcBwQveLjqk9gQ9g+BwPYHFnqjLy
j94Nch5hA2jnWypWCgmL3d7PP96joZsogPHYT8GbXdSXCTf9nTyV7EYCtERV6nJh
CtJI595pUurT5jQx+qxSXj/PyvL4o4z5hib4Vmc6qh1fucJgsyr9/5VSMPDHzeqd
FjcLlBBMRfRAZwiGey+1+Ini0pCBSaV5HNEmKEaLsTH/wua/XFm9gOkUGl5WKyTe
yUhYppZErSmPMSXhRFEC5IkeOV8TcxHBs3+KESMMYZVbq4H5BRs=
=gw8o
-----END PGP SIGNATURE-----
Merge tag 'riscv-for-linus-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux
Pull RISC-V fixes from Paul Walmsley:
- Fix swiotlb initialization on systems where DRAM is located above
4GiB (such as the Tenstorrent Blackhole cards)
- Fix an out-of-bounds access in the memory hot-remove code that can
occur on Sv39 and Sv48 systems
- Avoid oopsing during boot if the SBI component of the unaligned
access performance checking code loses a race against __init function
freeing
- Avoid attempting to install the debug-enabled vDSO when it shouldn't
be built due to !CONFIG_MMU
- Avoid some sparse warnings by adding missing __iomem notations in
get_cycles{,_hi}()
- Drop an unnecessary runtime warning in the SiFive errata handler
* tag 'riscv-for-linus-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
riscv: vdso: Only try to install vDSO when present
riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove
riscv: drop __init from vec_check_unaligned_access_speed_all_cpus
riscv: mm: fix SWIOTLB initialization for systems with DRAM above 4GB
riscv/sifive: remove warning in errata
riscv: time: Add missing __iomem in get_cycles() and get_cycles_hi()
|
||
|
Linus Torvalds
|
0e672789d4 |
s390 updates for 7.2-rc6
- Fix PCI MMIO write syscall falsely reporting success for mappings not valid for MMIO when MIO is unavailable by returning -EFAULT - Fix CPRB parameter buffer overflows in zcrypt CCA AES cipher and ECC private key conversion by rejecting oversized key tokens - Fix buffer overreads and length underflow in pkey and zcrypt CCA token validation by checking length fields against actual buffer sizes - Fix out of bounds permission bitmap access in zcrypt EP11 admin CPRB filtering on custom device nodes by using AP_DOMAINS as the limit - Fix speculative permission bitmap reads in zcrypt CCA and EP11 admin CPRB handling by sanitizing user controlled domain indexes - Fix sensitive key material left in zcrypt CCA clear key import buffers by scrubbing CPRB and temporary buffers after use -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEE3QHqV+H2a8xAv27vjYWKoQLXFBgFAmpvT7gACgkQjYWKoQLX FBg7qAf/eDHPqcayM4/Rasf3P+KVoIquyl0BjBI41Lf348em9ffLdvGI+PmSgo3s CVOPmsQY1zn4UvWrU3Wn0/Kmgo7U4xv6ODDUbvuTbjr7gUigMOYPoH3zShQJW8dY bJ5UnbtYC5ZMpnkEFQi4F1xNd3IoOFQLnbUPaFd+5S+slUJygGNh4XjEBEUfo3yS dyly7GWgml2obf2R4IfRG1ItP4hY8OWo0K9XrDJomh+s5WfkFy5QMlL6uEsuXzcR iqEPTaHblvz5FhEozZmmFppM3GVclyLouxZTHYHP32OaoLOIgF9NNW4WUmXodyF/ efMV21LmtCjMcLrM4LQ1PohTtXgG+A== =U3To -----END PGP SIGNATURE----- Merge tag 's390-7.2-6' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 updates from Vasily Gorbik: - Fix PCI MMIO write syscall falsely reporting success for mappings not valid for MMIO when MIO is unavailable by returning -EFAULT - Fix CPRB parameter buffer overflows in zcrypt CCA AES cipher and ECC private key conversion by rejecting oversized key tokens - Fix buffer overreads and length underflow in pkey and zcrypt CCA token validation by checking length fields against actual buffer sizes - Fix out of bounds permission bitmap access in zcrypt EP11 admin CPRB filtering on custom device nodes by using AP_DOMAINS as the limit - Fix speculative permission bitmap reads in zcrypt CCA and EP11 admin CPRB handling by sanitizing user controlled domain indexes - Fix sensitive key material left in zcrypt CCA clear key import buffers by scrubbing CPRB and temporary buffers after use * tag 's390-7.2-6' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() s390/zcrypt: Close speculative mem read possibility s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs s390/zcrypt: Fix buffer over-read in cca_cipher2protkey s390/zcrypt: Validate length for CCA ECC private key requests s390/zcrypt: Validate length for CCA AES cipher key requests s390/pci: Fix s390_pci_mmio_write syscall error return without MIO |
||
|
Linus Torvalds
|
8eae6c90b7 |
Misc x86 fixes:
- Fix the boot-time memcmp() asm implementation's constraints
and optimization properties (Mauricio Faria de Oliveira)
- Move the 0xd0...0xd7 AMD Zen5 model range from the Zen6
range where it mistakenly ended up (Pratik Vishwakarma)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmpu9+0RHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1j8Ig//WBoOGw9bbFkDJFUdIS59EdJS+4l7KTJh
eRxiExnwQluOpo1x4/mKAMmgqz7IoFCc0PjLXIBC3+rN+AvM5+L/qkBGtHmcaHEu
uXdU5zAYk6a7QfvK9C6k1C/v4HQKb3FLvUliJShKfLAv7ekLLvVHWxExmJYoBsrn
VxPIW3+rpnBJn4v5bLUVs/Z6h99aB4nicA4i6p7WKiy+Vr1qOSIu5T4piff27FJE
btT61yOfTKFoKgum5dI4ZYJTX29edXcJUMPidN/egJAxMQnUdI38fO/joYMreYsx
rJ3zuv3mdV+LiusPO7ZHcNVZtc09PPMM2krLrOyjSEHzhE/WGqLXNn6FKK5H+j86
xKyawqhD+2ANktj+09bFfu3cpZEz5bdifyKx6BtvgYkSEVaX055E1zzqYXZCIaVs
DqdAs3aSKNWAbJkfMONJMZ4P28ZGikppeefihG6hcAnBjAyQC9SaTOA37fHT6WQ/
bDf3NU5c+TX0TrWd696E9jy5cLjXL60jbVPL7SF7C3d8/QPPWCbOU14Dw3s4bWh+
WfptSuB9Iuk+aalRnAVWpUBI9DDUcomC3oDLLHttztXojdZPvP1zdUhDzjaJ0Im8
N8xC30PBMGIrFGJpXN4XRM3BlSxXBVGrmS/WAqE/KE51RcA5WzQBFMGBe4V3gRbO
OV3slKkCD9k=
=EHql
-----END PGP SIGNATURE-----
Merge tag 'x86-urgent-2026-08-02' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull misc x86 fixes from Ingo Molnar:
- Fix the boot-time memcmp() asm implementation's constraints
and optimization properties (Mauricio Faria de Oliveira)
- Move the 0xd0...0xd7 AMD Zen5 model range from the Zen6
range where it mistakenly ended up (Pratik Vishwakarma)
* tag 'x86-urgent-2026-08-02' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/CPU/AMD: Carve out a Zen5 models range
x86/boot: Add volatile, clobbers and zero-length test in memcmp()
|
||
|
Linus Torvalds
|
65bfd707fd |
- Fix wakeups of deferred DL servers to be actually deferred
(Gabriele Monaco) Signed-off-by: Ingo Molnar <mingo@kernel.org> -----BEGIN PGP SIGNATURE----- iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmpu9psRHG1pbmdvQGtl cm5lbC5vcmcACgkQEnMQ0APhK1iC+w/+LcPcYHltFHYkR/Bmsux4IoLuLCMhBzm6 WrZ093wE7zgv9CJmO411OVi98pAGKozYE+ITb1A5uyXSZlsyLh/KCdxkBkwl3muq 5GGh0dGGX26SGidddp2Q9GGuqpMD1ay4c/D4KuS0V7qmDmEP8b+xohpuH9YcTqfk rz6DN+JBOd/wt2NPAWxTH8CuCwTnUcLl/w+sulhZSg9ZGw50VzrMSde723Ef0OPY qzdnMTOhy6yWLwf0dpZcqecwTDISqr6k27LvseyglpwC7T6CsX8xFWbrQoHT7SW0 0A1nYRRzUTMrVb//WVxVb38Ys0X+BCRnHTXGFthyrJChiPitCemyq+QRjdGg1raY MAnIUG3KODpG1ZSkLCpl4fupI7XdFZxKA7Xx5DF4Qfy/3aTUetRcfrs0KfYaebDD /yRTaeJvI1kVRp0y1tyZ7F9YNHwPF0TAQ6IEWJKlDFSdlxIufjWRefBpOuEkH/+m lLqtzHbpQS75EYZN6EzfzBduQ76PH0aPTen2Yge29RsWET4gUTB2V1llbipFkjlp ybLMojtt5mPhLpghWZqRZ9G9VkMuV0LVlKxjSn5+om3RjfuT/z9gDlrKbWGUt1t6 4jIwqFaK89wHVVu8lHdbxzRU+WF1rWee4+u0vnWgOeays3Xe4WQ5yi7tIQijwmNM Ae8y6pslfb0= =u1Q7 -----END PGP SIGNATURE----- Merge tag 'sched-urgent-2026-08-02' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fix from Ingo Molnar: - Fix wakeups of deferred DL servers to be actually deferred (Gabriele Monaco) * tag 'sched-urgent-2026-08-02' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/deadline: Use revised wakeup rule only for running dl_server |
||
|
Linus Torvalds
|
e1f05cd3fc |
- Fix uretprobes race that can crash the kernel (Breno Leitao)
Signed-off-by: Ingo Molnar <mingo@kernel.org> -----BEGIN PGP SIGNATURE----- iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmpu9WURHG1pbmdvQGtl cm5lbC5vcmcACgkQEnMQ0APhK1hcmg//fG1ohnQxdQhs2CxWHBlY0mDY9N+FMphh sKnSMW8/1CMPWNXZ4aLT/yla/YtG3vgVv2De2YKxcgsHWTBTATF5JQNrAy1jqI/y pYHtN7zRAttJ05KjyZhwZbFg1GqDAqQs/+uYg42uNtxJ73q+VJlIK0U1ovzh2jZI WGfPrpSYa1wMiUHN5DXSuVQ3VG5ezbujEwOD1zvxax9sgOzVH2iEKqW83QRkYL0i 2Lf6fMBGlrt7zuk0pqu9ohBmFxaqAslWWJg8pwekHu2wpH89UMRCsXrLh2a9DTA2 1JdWkr2BQ7H5E/q1FKFSTa7SBLnVwFNTGyLb0MVepbcf8JOkQf2KLo24qj3BBUE4 eI69OWq+s32uwK62Tv1qBwcoAuGDZqigwDRbqnI7tUbMFRVoknP1/vzuGcMUgPWR a/QnTZptPofrlg1JExo3B8co7U4oJb7M0cIi3c+P3XXwG75jjq8eA2EkR1Iy/u22 jWoJUr5n82LuJMsDHHbJqbi4RJ2wOAsgvOoAqkEnHB/r1nEbFsmqMb35N1zT0fIV 0XwW0roQekx69DKA6PysM2XTpypHayu0JIdZ5yeRgs6AxLArqYdd6ROnbwx6r2ZN DUxWgUp/OgWRGIjihHvQkoO6bRz9zHOyI5EezkRH6uGOPKk3wXrVPCF7wAmx81XC ttpg5MkSoj8= =S4B0 -----END PGP SIGNATURE----- Merge tag 'perf-urgent-2026-08-02' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull uprobes fix from Ingo Molnar: - Fix uretprobes race that can crash the kernel (Breno Leitao) * tag 'perf-urgent-2026-08-02' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: uprobes: Fix NULL pointer dereference in hprobe_expire() |
||
|
Linus Torvalds
|
bd1dde8775 |
vfs-7.2-rc6.fixes
Please consider pulling these changes from the signed vfs-7.2-rc6.fixes tag.
Thanks!
Christian
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCam8K1wAKCRCRxhvAZXjc
oicvAP9SaD+BOfpqRkICUIrZ/Lz+x3bIn1a0/yjgDQlPE1xJmQD+JCqIVnvUDN2U
m89mFy/4Mq9FYnuHZ6LWMAeYYIx3OQM=
=+294
-----END PGP SIGNATURE-----
Merge tag 'vfs-7.2-rc6.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull vfs fixes from Christian Brauner:
"binfmt_misc:
- Don't let an 'F' entry pin its own instance.
An entry registered with 'F' opens its interpreter at registration
time and holds that file until the entry is freed, so an entry
nobody removes by hand is only closed once the binfmt_misc
superblock is shut down.
If the interpreter lives on a mount that keeps that superblock
alive the two pin each other and the file is never closed. That's
reachable by pointing the interpreter at the instance itself or by
using the instance as an overlayfs lower layer, and once the mount
namespace is gone there's nothing left to unregister through
either.
- Restore write access when removing an entry.
Registering with the MISC_FMT_OPEN_FILE flag opens the interpreter
via open_exec() which denies write access for as long as the entry
exists, but removal only did filp_close() and never restored it.
The inode's i_writecount stayed permanently negative and opening
the interpreter for writing kept failing with ETXTBSY long after
the entry was gone.
- Use exe_file_deny_write_access() for the interpreter clone so both
sides base their decision on the same mode.
- Reject a flag character as the field delimiter. create_entry() pads
the buffer with the delimiter so the field parsers terminate even
on a truncated string, but check_special_flags() consumes flag
characters instead of scanning for the delimiter.
If the delimiter is itself a flag character the padding stops
acting as a terminator and the scan keeps reading past the end of
the allocation. Such a registration was always rejected, just only
after the out of bounds read has already happened.
- Don't leak the user namespace when the mount fails.
bm_get_tree() hands its reference to get_tree_keyed() and sget_fc()
moves it into sb->s_fs_info, but generic_shutdown_super() only
calls ->put_super() from inside the if (sb->s_root) branch and
bm_fill_super() can fail before either s_root or s_op is in place.
Drop the reference in ->kill_sb() instead, which runs
unconditionally.
netfs:
- Clear PG_private_2 on a copy-to-cache append failure.
- Handle a rolling buffer allocation failure in single-object
writeback and drop the extra folio reference
netfs_write_folio_single() took before the append.
- Release the previously batched readahead folios when
rolling_buffer_load_from_ra() fails in
netfs_prepare_read_iterator()
- Fix the folio_queue ENOMEM in writeback by adding a mempool and
passing gfp flags into the rolling buffer helpers.
iomap:
- Add a separate bio_set for iomap_split_ioend(). It can split bios
that already come from iomap_ioend_bioset and deadlock once that
bioset is exhausted.
afs:
- Set call->async for an asynchronous afs_fs_fetch_data() the way
afs_fs_fetch_data64() already does.
- Subtract subreq->transferred from subreq->len in
afs_fs_fetch_data() rather than adding it.
- Fix a UAF when sending a message"
* tag 'vfs-7.2-rc6.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
iomap: add a separate bio_set for iomap_split_ioend
binfmt_misc: don't leak the user namespace when the mount fails
binfmt_misc: reject a flag character as the field delimiter
binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
binfmt_misc: restore write access when removing an entry
binfmt_misc: don't let an 'F' entry pin its own instance
netfs: Fix folio_queue ENOMEM in writeback by adding a mempool
netfs: release readahead folios on iterator preparation failure
netfs: handle single writeback rolling buffer allocation failure
netfs: clear PG_private_2 on copy-to-cache append failure
afs: Fix UAF when sending a message
afs: Fix afs_fs_fetch_data() to subtract transferred from len
afs: Fix afs_fs_fetch_data() to set call->async
|
||
|
Linus Torvalds
|
a84c804215 |
SCSI fixes on 20260802
No core changes. The largest driver fix is the reversion of threaded interrupt handlers in UFS and the next is the resume deadlock fix in hisi_sas which extends into libsas. Signed-off-by: James E.J. Bottomley <James.Bottomley@HansenPartnership.com> -----BEGIN PGP SIGNATURE----- iLgEABMIAGAWIQTnYEDbdso9F2cI+arnQslM7pishQUCam86+xsUgAAAAAAEAA5t YW51MiwyLjUrMS4xMiwyLDImHGphbWVzLmJvdHRvbWxleUBoYW5zZW5wYXJ0bmVy c2hpcC5jb20ACgkQ50LJTO6YrIVcnwD/QWD/DCvLd533SY0vE2fZYVYnUVi3uzAy OGkbmxKtCSABAO/djRxNN1CTDtVXnhUhp/VLn0niXfy4jLmCkoWpnD2N =ERuj -----END PGP SIGNATURE----- Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley" "No core changes. The largest driver fix is the reversion of threaded interrupt handlers in UFS and the next is the resume deadlock fix in hisi_sas which extends into libsas" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: core: Initialize hba->rpmbs list in ufshcd scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit scsi: target: Clear cmd_cnt when initial counter enrollment fails scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req scsi: ufs: core: Revert "Delegate the interrupt service routine to a threaded IRQ handler" scsi: ufs: core: Cancel RTC work in active-active suspend scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE scsi: ufs: dt-bindings: Add missing mcq reg for qcom,sa8255p-ufshc scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer |
||
|
Linus Torvalds
|
49c9f4657b |
dmaengine fixes for v7.2
Bunch of driver fixes for: - switchtec fix for register programming - sun6i descriptor reclaim fix - Couple of Intel idxd fixes for double free in error and setup failure - Qualcomm bam dma command element fix -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE+vs47OPLdNbVcHzyfBQHDyUjg0cFAmpuzYcACgkQfBQHDyUj g0evqg//ZOIvQV12d4eOp7JCzWgfb7uPi+fx6YpMQOxhML5OIwu1nX9tZ1eV6MZB 4G0lXPW0QhUFFzEpELp+odUJfXhgZkXaaw/yr0Km7fv1bUxKhPVvqVEHpT8EH5QT wivwL17ur8IzFEbjtCDNg2qoVCyzRufbDUcbEvZZFgpUaEnTrwFgfchLZZJm7Vkc fIaLbYN5Peq8AsRKw6TmAos0sOqEVvlfFDULtlKvkVcsheor3ZquIyLm0Czghp/+ BNFXVLxPG3sMJjeg2c/u8E/u2GTCGbuDvmIZFcWgds59YCkB/ETIwG9smfFNew38 mrTJfpGemqGkMx8T5x4e3yr7z2YX+7eBWBV5Js77rkpRw/Aq7iwW3emoTnIanr9c U3oJJCjrEpBLCKv2pNkWNo49vZbceUPCnNvsTcG9xjSFjKQEDHufLk9cQZbug125 iB1tmqJJigfKf818rh184PS5OY6puw4UaeEWfTG3APQif688xjlfxXBmXEDZPpqR TGAasuIsUOk6J+glOlkhNh9el3z+kyjFFdM+UZTr0TJQahc/+PVR+Zgk1VjluAwx 4LbEv1W+3scGELOIdZm5Kld4Mr12o2KfIEgFdlG3atlRRqyNGxnbKZ1xrSrsJ1o0 BjoqI7ZDe5IbljlJRm+tzpmtE4P/qH1LB3OHy0gFvbfSRYQ9x/4= =GT2Z -----END PGP SIGNATURE----- Merge tag 'dmaengine-fix-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine Pull dmaengine fixes from Vinod Koul: - switchtec fix for register programming - sun6i descriptor reclaim fix - Intel idxd fixes for double free in error and setup failure - Qualcomm bam dma command element fix * tag 'dmaengine-fix-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() dmaengine: idxd: fix double free of wq, engine, and group structs dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA dmaengine: switchtec-dma: fix FIELD_GET misuse when programming SE threshold |
||
|
Linus Torvalds
|
40814468ee |
phy fixes for 7.2
Couple of driver fixes
- Couple of zynqmp clock and pm error handling and SERDES scrambler
register handling
- Rockchip SSC spread fix
- Qualcomm musb return call fix
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE+vs47OPLdNbVcHzyfBQHDyUjg0cFAmpuzEsACgkQfBQHDyUj
g0dj9g/9GsRGDJotlJkhFy+7sKmMaEG6VRPJMRSdp3J1dz2SWavMHdgzf8hsHXHU
sHn6Z5ARG+PpDc5bdzt3qXJs49fgtr+E9uqeRxBDwe061E9x7XKCuggsQWcPz+SB
avGdmR8sK1z6FYXhMBy5dofffae5/00dZZUIuLdJFLPfFFqAePsIY6TetL8mdcTU
GaDm+o/TTfcvH8bxxBwtQiVLhNKX6zsIFBT3nIT6ReNJUzXvsg2ELKNxibhwkm5n
246UJSOazCPYPXDMnL/gBklVPjw/aPbU4N2bAX39o0aXyUWCoyi8T6A1LQvPxwqs
pluJjVod3LtExKXGcbMbw9ONam4OeCytMrIiTnWoLwlbwNhaL5Omss1LMkFQAEhv
9o/lae/NIdLV8OsdhfO3303xhrcZaYZX5UMtLv86CZWPcD8zeENohjuA0RcmxjHx
C5SdGPAXunZ4NUDat207bg/Un8P3X3V8tiw4GsFdFT+9Y0PMZaXIUV3fcY5EtGBY
5X1vl+g0htscmCdXLhLqRpYHwUDsMU/pujN/SlBUz6skN1A+fXq1rTF9TWbsMfQv
1TfMLMYBfiIXh5IVaOG58fuhLzVf9VmWk+An1m+wtl1I7vJctnG+/erZ55qEeVEp
AsTz5nHjJ6qynE9K8Y5c/HVRd9wckTPvGMDcXfD7CM5sarHchG4=
=CL3g
-----END PGP SIGNATURE-----
Merge tag 'phy-fixes-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy
Pull phy fixes from Vinod Koul:
- fixes for zynqmp clock and pm error handling and SERDES scrambler
register handling
- Rockchip SSC spread fix
- Qualcomm musb return call fix
* tag 'phy-fixes-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy:
phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB
phy: zynqmp: use read-modify-write for SERDES scrambler bypass
phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask
phy: zynqmp: fix runtime PM leak on probe allocation failure
phy: zynqmp: fix clock error handling in xpsgtr_phy_init()
phy: rockchip: naneng-combphy: Always configure SSC spread direction
phy: qcom: m31-eusb2: Fix return value of init call
|
||
|
Linus Torvalds
|
2d2338c93d |
i2c-fixes for v7.2-rc6
- amd-mp2: unregister callback if adapter registration fails - designware: defer probe until child GPIO controllers are bound - imx: - mark adapter suspended while hardware is powered down - fix stale slave pointer and shared IRQ registration race - stop slave timer before clearing slave pointer - iproc: reset controller if START_BUSY remains set after timeout - jz4780: cache clock rate to avoid clk_get_rate() deadlock - qcom-cci: rely on runtime PM helpers for system sleep - spacemit: request interrupt after clock initialization -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQScDfrjQa34uOld1VLaeAVmJtMtbgUCam2wKAAKCRDaeAVmJtMt bqfFAP0V1w4b6tyH2a2LUM3dpL83OjhGnMi1xsBO9fAybv0kWAD/aRICEDDENJPh SxD+DpQ7xH3inwBR+akLeqMAHfSfOgE= =M+Cd -----END PGP SIGNATURE----- Merge tag 'i2c-fixes-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux Pull i2c fixes from Andi Shyti: "A set of fixes across several host controller drivers. The largest part addresses three issues in the i.MX driver, while the remaining changes fix probe ordering, power management, timeout recovery and error handling. amd-mp2: - unregister callback if adapter registration fails designware: - defer probe until child GPIO controllers are bound imx: - mark adapter suspended while hardware is powered down - fix stale slave pointer and shared IRQ registration race - stop slave timer before clearing slave pointer iproc: - reset controller if START_BUSY remains set after timeout jz4780: - cache clock rate to avoid clk_get_rate() deadlock qcom-cci: - rely on runtime PM helpers for system sleep spacemit: - request interrupt after clock initialization" * tag 'i2c-fixes-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux: i2c: qcom-cci: drop custom suspend/resume and rely on runtime PM helpers i2c: imx: Cancel hrtimer before clearing slave pointer i2c: imx: Fix slave registration race and error handling i2c: iproc: reset bus after timeout if START_BUSY is stuck i2c: imx: mark I2C adapter when hardware is powered down i2c: designware: defer probe if child GpioInt controllers are not bound i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock i2c: amd-mp2: Unregister callback on adapter add failure i2c: spacemit: request IRQ after controller initialization |
||
|
Linus Torvalds
|
02dc699f83 |
First round of Kbuild fixes for 7.2
- Fix regression with MO= when building out of tree kernel modules due to incorrectly overwriting build tree's Makefile - Avoid stripping .BTF sections from modules when building debug .rpm packages Signed-off-by: Nathan Chancellor <nathan@kernel.org> -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQR74yXHMTGczQHYypIdayaRccAalgUCam1cngAKCRAdayaRccAa lt/FAQDqTsqzD4FKeeOUkyoIahT+l31Spa0VNUTMa+EwEv24WwEAjExf66Ch7rVe KRdLXdDUSRI8TZiDZeibf8kGx0i+PwQ= =1d+/ -----END PGP SIGNATURE----- Merge tag 'kbuild-fixes-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux Pull Kbuild fixes from Nathan Chancellor: - Fix regression with MO= when building out of tree kernel modules due to incorrectly overwriting build tree's Makefile - Avoid stripping .BTF sections from modules when building debug .rpm packages * tag 'kbuild-fixes-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux: kbuild: rpm-pkg: Preserve BTF sections in kernel modules during debuginfo stripping kbuild: Stop modifying $(objtree)/Makefile when building oot-kmods oos |
||
|
Linus Torvalds
|
2aa6a5e889 |
tracing fixes for v7.2:
- Reset dropped_count in mmio_reset_data() When mmio_reset_data() is called, it does not reset the dropped_count so that subsequent runs will have incorrect reporting. - Add NULL check for mmio_trace_array in logging functions The functions __trace_mmiotrace_rw() and __trace_mmiotrace_map() may have the 'tr' variable passed to it as NULL. But they both dereference it without checking if it is NULL first. - Check return value of __register_event() in trace_module_add_events() If __register_event() fails, the call after it (__add_event_to_tracers()) will create a file for it. If the module fails to load and its memory is freed, the file will still point to it and it will not be removed as the registering of the event did not complete. Only call __add_event_to_tracers() if the __register_event() was successful. - Fix false positive match in regex_match_full() The regex full matching uses a strncmp() to test against the match string and the value. It should not match if value is a prefix of the string to match. Check to make sure the length of the strings match before comparing. - Fix reader page read offset for remote buffers A page swapped in by __rb_get_reader_page_from_remote() retains its stale read offset, causing subsequent reads to skip events or read past valid data. - Fix memory leak of subbuf_ids in rb_allocate_cpu_buffer() Remote buffers allocate a subbuf_ids array. If the allocator function fails after it is allocated, it does not free it, resulting in a memory leak. -----BEGIN PGP SIGNATURE----- iIkEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCam1A0RQccm9zdGVkdEBn b29kbWlzLm9yZwAKCRAp5XQQmuv6qlW/AQDCpddDwAMwN80i3tn5uiqec9JLZT5I DR6G+0zEF9a5DAD2IxiD3gH/mPVZ3CdiqfElBqjc0Pq1dx414xmzXBv+CA== =GUpD -----END PGP SIGNATURE----- Merge tag 'trace-v7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Reset dropped_count in mmio_reset_data() When mmio_reset_data() is called, it does not reset the dropped_count so that subsequent runs will have incorrect reporting. - Add NULL check for mmio_trace_array in logging functions The functions __trace_mmiotrace_rw() and __trace_mmiotrace_map() may have the 'tr' variable passed to it as NULL. But they both dereference it without checking if it is NULL first. - Check return value of __register_event() in trace_module_add_events() If __register_event() fails, the __add_event_to_tracers() call after it will create a file for it. If the module fails to load and its memory is freed, the file will still point to it and it will not be removed as the registering of the event did not complete. Only call __add_event_to_tracers() if the __register_event() was successful. - Fix false positive match in regex_match_full() The regex full matching uses a strncmp() to test against the match string and the value. It should not match if value is a prefix of the string to match. Check to make sure the length of the strings match before comparing. - Fix reader page read offset for remote buffers A page swapped in by __rb_get_reader_page_from_remote() retains its stale read offset, causing subsequent reads to skip events or read past valid data. - Fix memory leak of subbuf_ids in rb_allocate_cpu_buffer() Remote buffers allocate a subbuf_ids array. If the allocator function fails after it is allocated, it does not free it, resulting in a memory leak. * tag 'trace-v7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: ring-buffer: Fix subbuf_ids memory leak in rb_allocate_cpu_buffer() error path ring-buffer: Fix reader page read offset for remote buffers tracing/filters: Fix false positive match in regex_match_full() tracing: Check return value of __register_event() in trace_module_add_events() tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions tracing/mmiotrace: Reset dropped_count in mmio_reset_data() |
||
|
Linus Torvalds
|
0131b508c0 |
Description for this pull request:
- Keep RECALL_ON_OPEN in inode flags when reloading them from $FILE_NAME.
- Check runlist reallocation sizes for negative values and overflow.
- Drop stale page cache after shrinking non-resident attributes to prevent
writeback failures and data loss.
-----BEGIN PGP SIGNATURE-----
iQJKBAABCgA0FiEE6NzKS6Uv/XAAGHgyZwv7A1FEIQgFAmptO5UWHGxpbmtpbmpl
b25Aa2VybmVsLm9yZwAKCRBnC/sDUUQhCIxWEACGOzwM7ji4uCwIDWLA0sSNH5OG
BLVG64rUb01uN47pheIKEFT3DSF7VNaDwg1B+/lM4x1DtIKiGKoIPZB2XCPtTbQH
X/4ijla6or9Ua0A5GJTIZmHgl17C1Q36qQTba0qDYKIxGvU9tbxmA7jDt+2vYQkv
ylaXpjxvGjiLivqJrQjOJ+GDPEhahrxbcYbwE2bg3jI50ycq3e21zTDHt1tN3VYb
JzC6d82bxA3e8rQXdo8F6C/aEmhykCFpieVQbooKMvqkdKiB32oQYZp/31mHFUlv
y3XM7Elac+s8EwIj0h/6RFEmMUig7wj5RIpv47q8CH+joncDXdAs1vDqeYQWaQpc
VIT79bBiz0SP8qvkvTkIVQ/zdw1iaG/iXltGWycZHSWFrQKk4jaw3+zJiP5ISjFp
iiNbLNYCa7vlyWk9V0pKBf/cqZxUHCosqp4yKFhkA/OzYz34RyyRrhfrjXz3KJaG
1Iq3ojsiVYAoQQT8noe9boETrbt4A/cw41eg06OJlVkYEeDMu6bfAbe0dk6kU88p
ri1FCqb4ceVgKTgVh8HnmTIrzS2gJoA5ZPmPxIZ5FH7yJd6EPxExDGho7VOtBKZq
yodtBTQiUwnvbUZlnZzWsangS+7yPyliAq7QwTrXPBK2iKlsfgkuTeZAF5IpK3/O
8VDbs3pPqTzNp1wAiA==
=/w7C
-----END PGP SIGNATURE-----
Merge tag 'ntfs-for-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs
Pull ntfs fixes from Namjae Jeon:
- Keep RECALL_ON_OPEN in inode flags when reloading them from
$FILE_NAME
- Check runlist reallocation sizes for negative values and overflow
- Drop stale page cache after shrinking non-resident attributes to
prevent writeback failures and data loss
* tag 'ntfs-for-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs:
ntfs: drop stale page-cache when shrinking a non-resident attr
ntfs: harden runlist realloc size calculations
ntfs: preserve RECALL_ON_OPEN on WSL special-file reparse points
|
||
|
Linus Torvalds
|
bc29fe1c61 |
three ksmbd server fixes
-----BEGIN PGP SIGNATURE----- iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmptPL4ACgkQiiy9cAdy T1EteAwAu9BZVpUNaogLwPGzwlqcOjUVRU/oxH2olpRUe7BNtteyJ7kTwQZ65i1Q pFSH6h8upKv1cmavhC8mjip040ucam2OQ1jl/+QykTs2Q6zyrcJDuUFJTwacQ3D1 9B4gH0BB3xy4vIDAle+0Z7ucShqp+SN/gSzO2FKcJ8yDUl5+WeSS2lkt9MoAciMD Q9JbhXoBzIAyxTa4TCxBRVANNlwtagy4HkNNSNgx7+APkZAxLeVZN2xxHEDv3oE/ VyvArq1IUGdsqUkZmUsJw9jt9sUC46ySpOcxcFtKLVZ4KE3gxZHGn4IYepAM+AHf fscWkRG8cb1N601NwrnqgLc30ph9yUabRf/hDnlWqs5SptiMRmkeyYwE6fnU2Da7 VwExlNO+8rwerRg2MH336thS5JInH6hy/K+HcVEgzfIoel+NI3wUC+pxgqWlIo2B EcCsurzlQikBo70D9RkOiZeOEGuj/17Y/mWmJzXHwEUmJBzPc83eleKNv/ywl6+A 1VcTrtRF =l3O8 -----END PGP SIGNATURE----- Merge tag 'v7.2-rc5-smb3-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - Use memcmp() when comparing fixed-size binary ClientGUIDs, so embedded NUL bytes are handled correctly - Reject repeated SMB2 NEGOTIATE requests after dialect selection This prevents preauth_info leaks, enforces the SMB2 protocol requirements, and serializes negotiation state updates. - Fix a use-after-free in __close_file_table_ids() by removing the volatile file ID from the owning IDR before dropping the IDR reference * tag 'v7.2-rc5-smb3-server-fixes' of git://git.samba.org/ksmbd: ksmbd: use memcmp() to compare ClientGUIDs ksmbd: reject repeated SMB2 NEGOTIATE requests ksmbd: fix use-after-free in __close_file_table_ids() |
||
|
Linus Torvalds
|
f30ca2ce7d |
ata fixes for 7.2-rc6
- Fix PCI resource initialization in the sata_mv driver to keep legacy
Marvell boards functional (Rosen).
- Fix ahci_ceva driver initialization error path (Radhey).
- Fix libata header file to remove a kernel doc compilation warning
(Randy).
- Increase the timeout for the STANDBY IMMEDIATE command to avoid
suspend failures with drives that are slow to respond to this command
(Matt).
- Fixes for the handling of timed out commands in the presence of
deferred non-NCQ commands, to avoid excessive delays in executing the
error handler (me).
- Disable link power management for a couple of WD drives that have
been identified as not functioning properly when power management is
used (Niklas).
- Fix the device iteration loop when checking for link power management
support to correctly handle port multiplier setups (Niklas).
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQSRPv8tYSvhwAzJdzjdoc3SxdoYdgUCam01HgAKCRDdoc3SxdoY
dv7zAP9Fc6HE7yW9XtTWmHHDC/pqVBuxIpaWXggcBMPCY4GzkgD+MgA97IsQf6QU
4kun74jcJuZJzBbMjBNLesIzPaYQ5Qo=
=qRqX
-----END PGP SIGNATURE-----
Merge tag 'ata-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux
Pull ata fixes from Damien Le Moal:
- Fix PCI resource initialization in the sata_mv driver to keep legacy
Marvell boards functional (Rosen)
- Fix ahci_ceva driver initialization error path (Radhey)
- Fix libata header file to remove a kernel doc compilation warning
(Randy)
- Increase the timeout for the STANDBY IMMEDIATE command to avoid
suspend failures with drives that are slow to respond to this command
(Matt)
- Fixes for the handling of timed out commands in the presence of
deferred non-NCQ commands, to avoid excessive delays in executing the
error handler (me)
- Disable link power management for a couple of WD drives that have
been identified as not functioning properly when power management is
used (Niklas)
- Fix the device iteration loop when checking for link power management
support to correctly handle port multiplier setups (Niklas)
* tag 'ata-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:
ata: libata-sata: fix ata_scsi_lpm_supported() iteration
ata: libata-core: Disable LPM on WD Green 2.5 480GB
ata: libata-core: Disable LPM on some WD drives
scsi: libsas: terminate deferred commands on time out
ata: libata-scsi: schedule deferred atapi command
ata: libata-scsi: terminate deferred commands on time out
ata: libata-eh: Increase STANDBY IMMEDIATE timeout
ata: libata: avoid kernel-doc warnings
ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources()
ata: sata_mv: accept 1 or 2 resources in platform probe
|
||
|
Masami Hiramatsu (Google)
|
260b20d9b7 |
ring-buffer: Fix subbuf_ids memory leak in rb_allocate_cpu_buffer() error path
In rb_allocate_cpu_buffer(), cpu_buffer->subbuf_ids is allocated using
kcalloc() when buffer->remote is non-NULL. If a subsequent page allocation
fails (e.g., ring_buffer_desc_page() returns NULL or rb_allocate_pages()
fails), execution jumps to fail_free_reader.
While __free(kfree) automatically frees the outer cpu_buffer structure
at scope exit, kfree(cpu_buffer) does not recursively free nested heap
pointers such as cpu_buffer->subbuf_ids, resulting in a memory leak.
Fix this by explicitly freeing cpu_buffer->subbuf_ids in the
fail_free_reader error unwinding path when cpu_buffer->remote is set.
Link: https://patch.msgid.link/178550740672.380917.6067449683620196150.stgit@devnote2
Fixes:
|
||
|
Linus Torvalds
|
f01618fd79 |
block-7.2-20260731
-----BEGIN PGP SIGNATURE----- iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmpssRoQHGF4Ym9lQGtl cm5lbC5kawAKCRD301j7KXHgpgaQD/93lwvildH/lSnYFFvWxSSPO2xHy4234tmj wBY4sMIKb4OFb0iRaZ94mLBrfb+penGPWkkhwuxw4XpKtRAfgceCGhlPhEePqH1e T0hN6yaTTAJBLMNEKJe6eXaCG1SV1pFX4z44GM966idj/pi0YG+3XlXxP0BqLBV3 n1rhgYO6gg+KHnj3Z/opWQeeegcH9VbBFatWvw9eZgGPkRVIvxjykUmW8lRsr5gd 3aOqonxd+twCZZ9vsKNwM8vTd1/D+cC5JSJuA9ToYiALUEiPhnCNg56hBf85XwNs jxD8TkAgdHQoNIj1sOuPY9Z9Rp2V0MX14z1tBi0kIP+mttIp7IulTLNyawJ/HJFH jByzVPt3gmlmErGQ4nGxxY+fgeFy49QBdFRFfN9AbwswzymN/CtrsgfuxkEpdHM/ a5uMjcARWL9bhChDzUPKGabT0/EISsWjHw+GrgLBYrqmwAlWAsiMar/yCEeoH3n+ B/JHN5E0kdJKRdL9hcZnVBQY0OFOsRiPv0WNU5+VX/ew9nKe6xF4UVEtfRm8g/y+ 0dxivu6LDeE/iQavInzM1SPwFjlbicmyfLF/NRmLeT9lJlot9EZ1MuksqxNeA8de 6yOZ981yZiSXTBbR8MKnzWA/k4KEaY2PJLmblk0KmENsDsN1rfGXNwDNKFLb9ciQ dGqbGJPO+A== =kkrB -----END PGP SIGNATURE----- Merge tag 'block-7.2-20260731' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - A set of fixes for s390/dasd, via Stefan - Fix for a missing stop of the timeout timer, if a disk has never been added - Clear kernel owned fields on ublk setup by default * tag 'block-7.2-20260731' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: s390/dasd: Fix undersized format-check buffer s390/dasd: Fix potential NULL pointer dereference s390/dasd: Fix path verification interrupted by concurrent dasd_sleep_on_immediatly block: stop the timeout timer when releasing a never added disk ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() |
||
|
Linus Torvalds
|
5d0c32d6ec |
io_uring-7.2-20260731
-----BEGIN PGP SIGNATURE----- iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmpsr6kQHGF4Ym9lQGtl cm5lbC5kawAKCRD301j7KXHgpqS9D/9pDdC3GR86wPrkkujlr7NZ3HZ58mAS2JAF 3QYTgKWbZPcAFVwFk4Hknd5ukVLAz6Pb2nQRDl2FGaI4wx9K9AMCYruIelI3TZUq 3GX65ndPvtfIN+DOqGjLZRHISa1iwBvN0K5Mon6GvQuxuazTnj1v2GpiYufNAjW2 n+X2L9m6Y+ltDakks/YPYto5FnOhs6fOjx+gP+yZ5einCMDrGBhrkt5G0PoUKQ7F MDBa+wkUmJF6NbewKwsLd5YSEnaQ+rfNL8eBamlSptIo4GKVwcyknKM7ubXQ1YKj 5Z2/cpn7WhaucCZrsYqaSko3MH2A20CQCBx/+MNjlU+86AryQXLgxAU0XS1ML9Q2 yR74WTfvkTWgdMPsBUiY11hvPd4G2jiBKOCQ6AuSAW2fErAt4KHt3MgFjfoRLcu0 FKnFll1FQsP8dkBQ9UmA0KvTmwsF/R+VPdvvCVzzu3Nw9MGvx8nUetbt3E9t4eLw uh7Lf+kNiggP4Q053uBjEfJUivJf+Uqq7AkTurkQqNjYw0aoo7x66bKtWr6FOkI8 sUpAlX9hzPBclpol/aSsU9LSRuc2MBv8ys3geoorQsXnxalPaZTvN41OcqARssin +Iy1pCw6JpjR/5P75IV4RfCl39qxjyQ2RyM8Dwl/2Qe2fecZLkndAsQeRkKH/lHk lgpIuNBVOA== =dZCX -----END PGP SIGNATURE----- Merge tag 'io_uring-7.2-20260731' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: - Fix for a bug in how length caps are handled in multishot, and along with it, a generic fix for avoiding these kinds of conversion issues in the future. - Ensure that task restrictions are always preserved across exec. - Revert of the io_uring controlled epoll restriction, which disallowed nested contexts. Turns out that libuv is already using it like that, so we cannot simply remove it, sadly. - Fix for a reference leak in the zcrx code. * tag 'io_uring-7.2-20260731' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring: preserve task restrictions across exec io_uring/zcrx: don't clear master_ctx from the import path Revert "io_uring/epoll: disallow adding an epoll file to an epoll context" io_uring/kbuf: cap buffer selection length at MAX_RW_COUNT io_uring/net: initialize mshot_len for send |
||
|
Linus Torvalds
|
680d49d84c |
drm fixes for 7.2-rc6
dp: - Restrict some DP bandwidth calculations to HDMI DFP. bridge: - Fix small leak in bridge/display-connector mediatek: - Check CRTC state before freeing - mtk_hdmi: Fix DDC adapter double put in v2 - mtk_hdmi_common: take i2c adapter module reference - mtk_dsi: Enable HS clock only at pre-enable - ovl_adaptor: balance component registrations amdgpu: - VCN 5.3 fix - UserQ fixes - GEM close optimization - HDMI AV mute fix - UML build fixes - GFXOFF residency metrics fixes - SMU 15 fixes - debug_vm fix - PSP 15 fixes - NBIO 7.11.5 fix - pptable use after free fix - gpu metrics fetch fix - DC viewport fix - DML2.1 fix - i2c retimer spam fix - UMD profile pstate fix - Power metrics format cleanup - GTT size fix on APUs - DC context logging fix - PM sysfs fix for APUs - Follow on pageflip timeout fix amdkfd: - Various bounds checking fixes - Mutex locking fix i915/xe: - Check no-DMA huge-pte cases before DMA segment test - sink FRL rate fix - 200ms fix for TMDS scrambler status vmwgfx: - Improve various size checks and limit checks. - Fix oops when submitting invalid execbuf ioctl. - Correctly lock in vmfwgx fence signaling path. - More validation of execbuf ioctl. - Fix oops in vmwgfx vkms init failure path. - Overflow handling in shader path. panthor: - Improve firmware validation imagination: - Improve imagination trace points. qaic: - Fix QAIC transaction length check. -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmptE3kACgkQDHTzWXnE hr6EDw/8C5sATWrFBST0pLzrmbn19pCtb9rU2T3TeSGNTMbELwBaH8HH9yyolglY Z2ukKpSsKxiqddedXAb6k2cLBBIfb9Du2Jw8WvqjI071Gz+VZA3UL/lyjPOaZuw6 xIj6QBYr5zyJYSupUwIamN49Q1C712UpTf1jIkX+Gzbumv8vvnezoT6MXXpYyDL3 vyPrPeTHOoa5giLuh6NL0pUAYuwZY1SDCVWOv7KtUTYdUZUhiKtE0TLN5YmSDPVS u6CS3l3fp2hRk0JWygOlNfTjTrNy3p0Y5A+wv45Rj7HNsRwkpaDhn6w8o9EEYkGk M9ZxTkjVHLCdeF7azMt2tZFWqU879xjz96YEX3oO+kbJyd2mCUZsDhmMfBeMIPkt Hur1qe+8r1/I0Q0NNjWkCvRL3ATcP9X8PVTk7tCbmZTsB286QXdYDMuHBMCAV3H7 8NjYirnvt2AVMajceKpy9rDwfvZEBmMZOsd5G8+/rHALrt+tnfYDVFCoMU9jY2rV +DNgFtQ/BVKBHj7GZKufpyZIfpdt+nMe2WpTCn6HnmFk72dl12muC6XjyFUMVWJR jrO4JZW3n11rmqTykPH6I9jJ2ts7596+BKopZBAuG26zi77jPDFrlT5jKj358Miu 6Z7sekYAeomRpdjtVh3HjDqLVxYpiDkxqm6xLvpXfDp3UbufWHU= =L5HJ -----END PGP SIGNATURE----- Merge tag 'drm-fixes-2026-08-01' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Weekly pulls request. As expected there is more AMD this week since Alex was off last week, vmwgfx looks to have been hit with the AI stick a bit and mediatek as well. Otherwise some minor fixes across the board, the new normal definitely seems to be a thing. dp: - Restrict some DP bandwidth calculations to HDMI DFP bridge: - Fix small leak in bridge/display-connector mediatek: - Check CRTC state before freeing - mtk_hdmi: Fix DDC adapter double put in v2 - mtk_hdmi_common: take i2c adapter module reference - mtk_dsi: Enable HS clock only at pre-enable - ovl_adaptor: balance component registrations amdgpu: - VCN 5.3 fix - UserQ fixes - GEM close optimization - HDMI AV mute fix - UML build fixes - GFXOFF residency metrics fixes - SMU 15 fixes - debug_vm fix - PSP 15 fixes - NBIO 7.11.5 fix - pptable use after free fix - gpu metrics fetch fix - DC viewport fix - DML2.1 fix - i2c retimer spam fix - UMD profile pstate fix - Power metrics format cleanup - GTT size fix on APUs - DC context logging fix - PM sysfs fix for APUs - Follow on pageflip timeout fix amdkfd: - Various bounds checking fixes - Mutex locking fix i915/xe: - Check no-DMA huge-pte cases before DMA segment test - sink FRL rate fix - 200ms fix for TMDS scrambler status vmwgfx: - Improve various size checks and limit checks - Fix oops when submitting invalid execbuf ioctl - Correctly lock in vmfwgx fence signaling path - More validation of execbuf ioctl - Fix oops in vmwgfx vkms init failure path - Overflow handling in shader path panthor: - Improve firmware validation imagination: - Improve imagination trace points. qaic: - Fix QAIC transaction length check" * tag 'drm-fixes-2026-08-01' of https://gitlab.freedesktop.org/drm/kernel: (59 commits) drm/i915/hdmi: Poll for 200 msec for TMDS_Scrambler_Status drm/amd/display: Exit idle optimizations before programming drm/amd/pm: hide pp_table sysfs on APUs accel/qaic: use sizeof(*trans_hdr) for transaction length check drm/panthor: validate firmware interface structure sizes drm/xe/pt: check no-DMA huge-pte cases before DMA segment test drm/imagination: Update the trace point pvr_job_submit_fw() drm/i915/dp: Ignore the sink's DSC max FRL rate without a PCON DSC encoder drm/mediatek: ovl_adaptor: balance component registrations drm/mediatek: mtk_dsi: Enable HS clock only at pre-enable drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs drm/amd/display: use proper context for logging drm/amdgpu: cap GTT size to physical RAM on APUs drm/amd/pm: use milliwatts for GPU power sensors drm/amdgpu: restore UMD profile pstate after runtime resume drm/amd/display: Silence link_dpms I2C retimer failures drm/amdkfd: hold event_mutex while checkpointing CRIU events drm/amd/display: check if dml21_add_phantom_plane() is successful drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport drm/amd/display: Add AV mute wait frames to dce110_set_avmute ... |
||
|
Linus Torvalds
|
a2cf4ef331 |
Devicetree fixes for v7.2, part 1:
- Fix NULL bus dereference in of_pci_range_parser_one() - Prevent OOB access when too many dynamic reserved memory regions are defined -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEktVUI4SxYhzZyEuo+vtdtY28YcMFAmptCRcACgkQ+vtdtY28 YcN4oQ/9GJYlymn6frwBmPiG7iVK8OQgvFClUn61/nTuyvaOv5mXDQzbRsP1TqMG xn+XqAww6XCT4k08bxVe1nORJAIkittVjXLcWLU4EnO7+rHFZnXpEeijWDqMuYT8 rbEArsFyC1u4Uk+TXMwd0lqTZNogrJWR1hXd+T4Kecv+ORVbBeKMdWPZkMdK/KTP h88iio1V489hdufVMLjcORoySh23i1qJ1qBgjHZIS0lpdBbg2JiXfLvUJHCWHRiU W2Ucrpz/Wq//86pBie+TWn0IisYOvTB8g/ZLnrG33iN7+HaQMxlP+Cs90V6T9cGi DQ64LPfvRQrr0KlZ1TxoEy9N2N3SQXJ3l/Hq+nK08B6xlHl+d67cSRzxra/6qs3Z 7scbD5K+K6A9MnSlLn4+wxOyocF/rMHBu+RUUdiO/PqHoFe0TpMR3GHpRysGcebG OPNbZ1dP8TGaG38wOKj+ZJldoNABO0Sox0/OMv1WNHFbbhoyoDDlajDxJua3lO3U X4NN/C0bS5EiGSqSZ5SpiAF85Qj13s0RPBB223bEG7PxBA7kfk0UnU/OQwkJLb2y 8GIuG4qWeCXQhcWqxBf++DhmS61LzY3D49qHD4c6oD7ji/3ZGeWR9yyI3o/PQcG+ Gvj4CrQTCicLYgiJxL4VvKuXhXy6JhuJQi/kddO6GfwEyC5IWek= =9x2Y -----END PGP SIGNATURE----- Merge tag 'devicetree-fixes-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree fixes from Rob Herring: - Fix NULL bus dereference in of_pci_range_parser_one() - Prevent out-of-bounds access when too many dynamic reserved memory regions are defined * tag 'devicetree-fixes-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: of/address: Fix NULL bus dereference in of_pci_range_parser_one() of: reserved_mem: prevent OOB when too many dynamic regions are defined |
||
|
Linus Torvalds
|
de8c3b8e05 |
Hyper-V fixes for v7.2
-----BEGIN PGP SIGNATURE----- iQFHBAABCgAxFiEEIbPD0id6easf0xsudhRwX5BBoF4FAmps/3ITHHdlaS5saXVA a2VybmVsLm9yZwAKCRB2FHBfkEGgXoWQB/40sKuM2KWl3Ek6CnKgGLzaUrVTxW8x MTRyusPZ+AOJTtasC7LBTajCa/gXSHEebPdWFeA7jyPPrv3ZhRywBDHSZoSdzd7r sYfBGkXovfcgAV0jKrk65wupS6ymiZkO3xAngsIzxExHIa8JiuJXyQsHIYI/oH4K xs+/q9OlYVYP2f7UgC1XusuXlIx2Fixxr70//kyiuBOhPq32iu77CBbFm47Ac5JC kKq71AXnUlDrswIo8wOJCWmfRrq0s9837zDYnwrIGTw8GvOE9Z+xmvGx+StWy2jE bBTCzhliXUIxxByC5msothkFSVuPIKJkepwhKYaOEUsgeV1RdhQrDgJC =84+i -----END PGP SIGNATURE----- Merge tag 'hyperv-fixes-signed-20260731' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull hyper-v fixes from Wei Liu: - Multiple fixes for the MSHV driver (Stanislav Kinsburskii, Wei Liu, Yi Xie, Yousef Alhouseen) - Multiple fixes for the VMBus driver (Hardik Garg, Michael Kelley, Sebastian Andrzej Siewior) * tag 'hyperv-fixes-signed-20260731' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: mshv_vtl: bounds-check cpu index in vtl mmap fault handler mshv: Publish VP to pt_vp_array before installing the file descriptor Drivers: hv: vmbus: add VTL2 redirect connection ID mshv: Order pt_vp_array publish against irqfd assertion path mshv: Fix missing error code on VP allocation failure mshv: Fix level-triggered check on uninitialized data mshv: Fix race in mshv_irqfd_deassign mshv: Use kfree_rcu in mshv_portid_free mshv: Fix sleeping under spinlock in mshv_portid_alloc mshv: Fix duplicate GSI detection for GSI 0 Drivers: hv: vmbus: Remove vmbus_irq_initialized Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotation mshv_vtl: fix fd leak in mshv_ioctl_create_vtl() mshv_vtl: clear hypercall output before copyout Drivers: hv: vmbus: Set DMA coherent mask for VMBus devices mshv: fix hv_input_get_system_property struct |
||
|
Linus Torvalds
|
ce6ce829c8 |
RTLA fixes for v7.2
- Fix timerlat top actions triggering on signal Fix a bug in RTLA's timerlat top actions feature where on-threshold actions are triggered on any signal, regardless of whether a latency spike had actually occurred during the measurement. The return retval was checked for non-zero to do actions. But if a signal came in, it returns a negative and actions were being incorrectly triggered when they should not have been. -----BEGIN PGP SIGNATURE----- iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCamzXpBQccm9zdGVkdEBn b29kbWlzLm9yZwAKCRAp5XQQmuv6qnQHAQDso34IvlbyNqDUroLLfV7f+Qsikyvz OVxp9Q+b2F+57QD9H7k0OxDFfkycTFUpBaCKv1jmOXIqaGE9M1QbwE+eZgA= =3ND6 -----END PGP SIGNATURE----- Merge tag 'trace-tools-v7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull RTLA fix from Steven Rostedt: - Fix timerlat top actions triggering on signal Fix a bug in RTLA's timerlat top actions feature where on-threshold actions are triggered on any signal, regardless of whether a latency spike had actually occurred during the measurement. The return retval was checked for non-zero to do actions. But if a signal came in, it returns a negative and actions were being incorrectly triggered when they should not have been. * tag 'trace-tools-v7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: rtla/timerlat_top: Fix on-threshold actions firing on signal |
||
|
Yi Xie
|
22dfdc17ce |
mshv_vtl: bounds-check cpu index in vtl mmap fault handler
cpu is taken from pgoff & 0xffff. cpu_online() does not reject cpu >= nr_cpu_ids, and per_cpu_ptr() can then walk off __per_cpu_offset. Signed-off-by: Yi Xie <xieyi@kylinos.cn> Reviewed-by: Naman Jain <namjain@linux.microsoft.com> Signed-off-by: Wei Liu <wei.liu@kernel.org> |
||
|
Stanislav Kinsburskii
|
72e3b0311a |
mshv: Publish VP to pt_vp_array before installing the file descriptor
mshv_partition_ioctl_create_vp() called anon_inode_getfd() before
publishing the new VP into partition->pt_vp_array. anon_inode_getfd()
includes fd_install(), so the fd was live in current->files before the
publish ran.
A concurrent MSHV_RUN_VP ioctl on that fd does not serialise against the
in-progress MSHV_CREATE_VP — it takes vp->vp_mutex, not the partition
mutex. Once the VP starts running and traps, mshv_intercept_isr() can look
up partition->pt_vp_array[vp_index] and observe NULL, silently dropping the
intercept message.
Split the fd creation: reserve an fd with get_unused_fd_flags(), create the
file with anon_inode_getfile(), publish the VP via smp_store_release(), and
finally call fd_install() as the userspace-visibility commit point.
Fixes:
|
||
|
Hardik Garg
|
92d0593128 |
Drivers: hv: vmbus: add VTL2 redirect connection ID
VMBus sends CHANNELMSG_INITIATE_CONTACT through a Hyper-V message connection ID. Older protocol versions use VMBUS_MESSAGE_CONNECTION_ID, while protocol version 5.0 and newer normally use VMBUS_MESSAGE_CONNECTION_ID_4. For a VTL2 kernel using VMBus protocol 5.0 or newer, the host may expect INITIATE_CONTACT on either the redirect connection ID or VMBUS_MESSAGE_CONNECTION_ID_4. There is no capability indication that identifies which ID is active, so the driver must determine it at runtime. During VMBus negotiation, the redirect ID is tried first because it is used by VTL2 configurations with VMBus redirection enabled. If the redirect ID is unavailable, the host rejects it synchronously with HV_STATUS_INVALID_CONNECTION_ID, allowing fallback to the standard ID. Return a distinct error for an invalid Initiate Contact connection ID so this fallback does not mask other post-message failures or protocol-version rejections. Preserve the existing connection ID selection for older protocol versions or when running below VTL2. Signed-off-by: Hardik Garg <hargar@linux.microsoft.com> Reviewed-by: Tianyu Lan <Tianyu.Lan@microsoft.com> Reviewed-by: Saurabh Sengar <ssengar@linux.microsoft.com> Reviewed-by: Naman Jain <namjain@linux.microsoft.com> Reviewed-by: Michael Kelley <mhklinux@outlook.com> Signed-off-by: Wei Liu <wei.liu@kernel.org> |
||
|
Stanislav Kinsburskii
|
b098dc8692 |
mshv: Order pt_vp_array publish against irqfd assertion path
mshv_partition_ioctl_create_vp() initialises a VP struct (allocations,
mutex_init, init_waitqueue_head, page mappings) and then publishes the
pointer into partition->pt_vp_array. Several ISR paths read this array
locklessly: the intercept ISR, the two scheduler ISRs, and
mshv_try_assert_irq_fast() on the irqfd fast path.
Of these, only mshv_try_assert_irq_fast() can structurally race the
publish. It runs from an eventfd waker without holding pt_mutex, and
MSHV_IRQFD does not require the target lapic_apic_id (== vp_index) to
refer to an existing VP at registration time. A user can therefore
register an irqfd targeting a yet-to-be-created VP, then trigger
mshv_try_assert_irq_fast() concurrently with MSHV_CREATE_VP for the
same index. On weakly-ordered architectures the reader can observe a
non-NULL pointer in pt_vp_array before the initialising stores to the
VP struct become visible, leading to use of partially-initialised
fields (e.g. vp_register_page).
The other ISR readers cannot reach this race: the hypervisor will not
generate intercept or scheduler messages for a VP that has never been
told to run, and the user can only call MSHV_RUN_VP on the VP fd
returned by MSHV_CREATE_VP, which by construction is returned after
the publish. Leave those readers as plain loads.
Use smp_store_release() in mshv_partition_ioctl_create_vp() to publish
the pointer, and pair it with smp_load_acquire() in
mshv_try_assert_irq_fast(). On x86 these compile to plain accesses
under TSO; on ARM64 they emit one-instruction acquire/release barriers,
acceptable on this fast path.
The destroy-side path (destroy_partition() clearing pt_vp_array[i] to
NULL after kfree(vp)) has a separate ordering and lifetime concern
that is out of scope here.
Fixes:
|
||
|
Stanislav Kinsburskii
|
f546be6a19 |
mshv: Fix missing error code on VP allocation failure
In mshv_partition_ioctl_create_vp(), when kzalloc for the VP struct
fails, the code jumps to the cleanup path without setting ret. At that
point ret is 0 from the preceding successful mshv_vp_stats_map() call,
so the function returns success to userspace despite having failed to
create the VP. No fd is installed and no VP is registered in pt_vp_array,
but userspace has no way to know the operation failed.
Set ret to -ENOMEM before jumping to the cleanup path.
Fixes:
|
||
|
Stanislav Kinsburskii
|
0289a67cd7 |
mshv: Fix level-triggered check on uninitialized data
In mshv_irqfd_assign(), the level-triggered validation for resample
irqfds checks irqfd_lapic_irq.lapic_control.level_triggered before
mshv_irqfd_update() has populated the field. Since the irqfd struct is
zero-allocated, level_triggered is always 0 at that point, causing the
check to always reject resample irqfds with -EINVAL. This makes
level-triggered interrupt resampling — used to avoid interrupt storms
with assigned devices — completely non-functional.
Move the check after the mshv_irqfd_update() call, which resolves the
IRQ routing entry and populates irqfd_lapic_irq with the actual trigger
mode.
Fixes:
|
||
|
Stanislav Kinsburskii
|
0762262ac3 |
mshv: Fix race in mshv_irqfd_deassign
mshv_irqfd_deactivate() and the hlist traversal of pt_irqfds_list
require pt->pt_irqfds_lock to be held, but mshv_irqfd_deassign()
omits it. This races with the EPOLLHUP path in mshv_irqfd_wakeup(),
which does take the lock before calling mshv_irqfd_deactivate().
Additionally, mshv_irqfd_deactivate() uses hlist_del() which poisons
the node pointers rather than resetting them. Since
mshv_irqfd_is_active() relies on hlist_unhashed() (checks pprev ==
NULL), a poisoned node still appears active. If a concurrent path calls
mshv_irqfd_deactivate() again on the same irqfd, the guard fails to
prevent a double hlist_del() on poisoned pointers.
Fix both issues:
- Add the missing spin_lock_irq/spin_unlock_irq around the list
traversal in mshv_irqfd_deassign(), matching mshv_irqfd_release().
- Use hlist_del_init() instead of hlist_del() so the node is properly
marked as unhashed after removal, making the is_active guard reliable.
Fixes:
|
||
|
Stanislav Kinsburskii
|
5cb5c2f4a8 |
mshv: Use kfree_rcu in mshv_portid_free
mshv_portid_free() uses synchronize_rcu() followed by kfree() to reclaim port table entries. This blocks the caller until a full RCU grace period elapses, which is unnecessary since the same module already uses the non-blocking kfree_rcu() pattern in mshv_port_table_fini(). Replace with kfree_rcu() to avoid the blocking wait and keep the reclamation strategy consistent across the file. Signed-off-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com> Reviewed-by: Anirudh Rayabharam (Microsoft) <anirudh@anirudhrb.com> Signed-off-by: Wei Liu <wei.liu@kernel.org> |
||
|
Linus Torvalds
|
6269cc6f52 |
spi: Fixes for v7.2
The drip of driver specific fixes, mostly from the device vendors themselves, keeps on coming in. There's more than I'd like right now but equally nothing hugely alarming. -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmps47sACgkQJNaLcl1U h9DonAf/S1AkgEGMws3rJCTH+Bcb7ON9Xvsbjv2rU/CI7lINpSJzbUUJ1Z0qk8KX NaK8ByXBDvn06qS/6hirwuNl/lfJ69XNWSlV8MJGWXHfui2sN6ngFJy9jnTIQY72 bq0rTEPapAFg86Loare1i1nHSomLnICoq/KveE08muiPoBtjFKzP7AF7gDmfN0ot g3x39WL6bLY/qrqVw1aT/tqdVl97os/e2EJIx8lxh1M5waN/kpfFoRD/dVbdO6ZU 8iOKPzIeMco0r1JOtGq2q7JCiHN9DP8+Enyf6hkkgBS/HPEHJkO10t9PAY/ArR12 /KNB7i/i/O35ChESDgk70mcuToLbgg== =g0xm -----END PGP SIGNATURE----- Merge tag 'spi-fix-v7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "The drip of driver specific fixes, mostly from the device vendors themselves, keeps on coming in. There's more than I'd like right now but equally nothing hugely alarming" * tag 'spi-fix-v7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: spi-nxp-fspi: propagate clock reconfig failures in nxp_fspi_select_mem() spi: spi-nxp-fspi: enter stop mode before reconfiguring MCR0 and DLL spi: spi-nxp-fspi: add per-SoC SDR/DTR clock rate limits for all supported SoCs spi: spi-qpic-snand: write the feature value before executing SET_FEATURE spi: spi-cadence: Move TX FIFO full busy-wait into FIFO spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure spi: spacemit: prepare both DMA descriptors before submitting |
||
|
Linus Torvalds
|
596254ecc5 |
pci-v7.2-fixes-1
-----BEGIN PGP SIGNATURE----- iQJIBAABCgAyFiEEgMe7l+5h9hnxdsnuWYigwDrT+vwFAmpsv30UHGJoZWxnYWFz QGdvb2dsZS5jb20ACgkQWYigwDrT+vx05BAAlX0ggF2vDuKKQK1Q67oBANG+ANZq wAyMibleGWHvUfknsxcioGoXr+oZrI2fbuvaz1id2Tlx3vByfYiSihrNz4BrDbny H+YD2Mqhz0aaanb+G1WEqRndCyRLtYmsr0cUAp7giBh22t43tgdIBvKr2PsCsKCo WiEUP/QvxYuiJ73g6s7RqbwIYSzk/9MMSDhoO83c/gRZcY/r47KY19ysLevQ/176 h0xC73EV6UF0dqe485jt24/zzYkN70zV3FscPMLkU7s0Fd2jzRm/zktS7tbLTUg2 PZwqCnHc4dytoqEmcycrQHGNiPRQCCOnqcsSlWcMzPPBdYCR1EUictiYXgq0Bd4T EvvjHHl3/9IVCWgkz7rKmLz8V7GWoJSH11Ykh3AWWc7roFsTn1UH2YY+85/Asfv+ /vuo2G7zskKE5WOSaEOLBvYi84FRge3FxA3XPgMYTOePTqIpjjJ6eglZRmxEhid5 IrJhaB0O9kNuRR3Nu85lgHqL35Pp5AUVOLqyXELvcbBBJHtm1PTgjAZjyRIm0Rn7 YINhuQr3gw+3vKaXGB8qHqXMG1/hdMkHH9t6LEqAqFtRrTZjzquGg5oFnJOYINCL VinNH6/G1qIYBThTVDMeVSTUqCbkz97eedzyGo92oqpUdhseWyaaV4vwW1ss4DWv QSN25brLKheYiKk= =YyK4 -----END PGP SIGNATURE----- Merge tag 'pci-v7.2-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci fixes from Bjorn Helgaas: - Remove Karthikeyan Mitran from Mobiveil MAINTAINERS PCIe entry since email bounces (Manivannan Sadhasivam) - Preserve i.MX6Q, i.MX6QP, and i.MX6SX Root Port MSI/MSI-X Capabilities when using iMSI-RX to work around hardware defect (Soeren Moch) - Reorder i.MX6Q/DL PHY power up to fix boot hang regression (Richard Zhu) * tag 'pci-v7.2-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI: imx6: Fix i.MX6Q/DL boot hang caused by improper PHY power sequencing PCI: imx6: Keep i.MX6 Root Port MSI/MSI-X Capabilities with iMSI-RX to work around hardware bug MAINTAINERS: Drop Karthikeyan Mitran from Mobiveil PCIe entry |
||
|
Linus Torvalds
|
5f5d80d3b7 |
hwmon fixes for v7.2-rc6
- adt7470:
* Fix PWM auto temp state array and bounds check
* Fix divide-by-zero TOCTOU crash in fan speed read
* Use cached PWM frequency value
* Fix swapped PWM3 and PWM4 auto mode masks
* Fix temperature alarm logic in hwmon_temp_read()
* Fix busy-loop and I2C flooding in update thread
* Fix cache updated before hardware write on I2C error
* Fix fans stuck in manual mode on I2C errors
- ina2xx: Fix various overflow issues
- ltc4282: Fix reading the minimum alarm voltage
- lm63: Mask PWM frequency multiplier to supported bits
- lm90: Only report alarms if driver is ready
- nct6775-core:
* Prevent access to unsupported weight registers
* Fix number of temperature registers for NCT6116
- npcm750-pwm-fan: stop fan timer on device detach
- nzxt-smart2: DMA-align output buffer
- pmbus:
* Fix return value from pmbus_update_byte_data()
* Notify on the hwmon device, not the i2c client
- sht3x: Fix unaligned accesses
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEiHPvMQj9QTOCiqgVyx8mb86fmYEFAmpstKMACgkQyx8mb86f
mYEaJhAAiSUjVllgPxCrdaACCodYm7KrW1zhVN1z1eDDSsx2CLJbOSilewV/Hdn8
B0N+HzS3kNkv6JGs9dl7+KSVpYqnISIF9XnNSSHSGezeHTuAmua0JB+G4SNsBsJ0
dQF9h+XtWsF3vE/enyvW/lYXT3QHNsZzssODfbNshTUKMs9az7fDojhbcCQXb7XA
ZWCoJDPiB5PnfXS8uJuzriW3MqhqKqTzCQld6VvRNxpU4JdC5FVluinK9ZLaZDCX
quflzWt7wiMVLWOhqFkYvN+J9yAkKIeu13t1FsbwsL5wm84yDTrG/VEiDBOz76CZ
dOQPZFwQpWtcXI5WEPofso61LWzejtqOFt+VjGYGF2d3kMaD0bJHt7lhfhGEoAUy
/FFx/YKEgnzg/utJzHISUFfuA+lO3uS3/MKXyCgxVYLjedu0sNxuxtQ97fd/76ha
up+Jomg/ENwzpo1p50WVa2ME/ZydQy5xdv+TMEqj8OWw/tnFGq6jzHUx6gQ6l4RB
R4X47y2hswW3rFvGC8SE3daklwo7qr7Wx1G6uUC6BPW/7NXdMmLYT6RBMiV+ylb8
kj+5/OZMqLm/O3yO3Ze9haSRU/efhs+tns0QQYBQKBXJ/Odn90KOguADBNM0YB1X
Ra8/Xk1TZpMTQM/T8n31NvDmhO80YDIQ1nVlLmy7WWPzzDAWSWw=
=2AWw
-----END PGP SIGNATURE-----
Merge tag 'hwmon-for-v7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
Pull hwmon fixes from Guenter Roeck:
"Most of the patches are fixes for pre-existing issues reported by
Sashiko. I suspect we'll see a lot of those for a while.
- adt7470:
- Fix PWM auto temp state array and bounds check
- Fix divide-by-zero TOCTOU crash in fan speed read
- Use cached PWM frequency value
- Fix swapped PWM3 and PWM4 auto mode masks
- Fix temperature alarm logic in hwmon_temp_read()
- Fix busy-loop and I2C flooding in update thread
- Fix cache updated before hardware write on I2C error
- Fix fans stuck in manual mode on I2C errors
- ina2xx: Fix various overflow issues
- ltc4282: Fix reading the minimum alarm voltage
- lm63: Mask PWM frequency multiplier to supported bits
- lm90: Only report alarms if driver is ready
- nct6775-core:
- Prevent access to unsupported weight registers
- Fix number of temperature registers for NCT6116
- npcm750-pwm-fan: stop fan timer on device detach
- nzxt-smart2: DMA-align output buffer
- pmbus:
- Fix return value from pmbus_update_byte_data()
- Notify on the hwmon device, not the i2c client
- sht3x: Fix unaligned accesses"
* tag 'hwmon-for-v7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
hwmon: (npcm750-pwm-fan): stop fan timer on device detach
hwmon: (pmbus) Fix return value from pmbus_update_byte_data()
hwmon: (adt7470) Fix PWM auto temp state array and bounds check
hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read
hwmon: (adt7470) Use cached PWM frequency value
hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks
hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read()
hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread
hwmon: (adt7470) Fix cache updated before hardware write on I2C error
hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors
hwmon: (nct6775-core) Prevent access to unsupported weight registers
hwmon: (lm63) Mask PWM frequency multiplier to supported bits
hwmon: (nzxt-smart2) DMA-align output buffer
hwmon: (lm90) Only report alarms if driver is ready
hwmon: (sht3x) Fix unaligned accesses
hwmon: (ltc4282) Fix reading the minimum alarm voltage
hwmon: (ina2xx) Fix various overflow issues
hwmon: (pmbus/core) notify on the hwmon device, not the i2c client
hwmon: (nct6775-core) Fix number of temperature registers for NCT6116
|
||
|
Linus Torvalds
|
c5d3fe9d25 |
sound fixes for 7.2-rc6
A collection of sound fixes for the 7.2-rc6 cycle. Again, it became
far larger than wished; I'll throttle from now on.
There are no major changes, just a normal flow of small fixes.
The majority of them are device-specific quirks and ASoC SDCA/codec
updates, but it includes a few ALSA core fixes as well.
ALSA Core:
- Fix for ALSA sequencer timer division-by-zero
- Fix potential race in ALSA timer core
- Wake up linked drain waiters on PCM stream unlink
- Fix double-free of converter objects on UMP rawmidi error path
USB-audio:
- Fix a few potential out-of-bounds access bugs
- Prevent stack info leak in RME Digiface status
- Fix UAF during UMP endpoint destruction
- Fix UAF at error handling during probe in Line6 6fire driver
- Quirks for C-Media CM6206, Corsair Virtuoso, Razer Barracuda X 2.4,
JKY Technology, and generic USB headphones
HD-audio:
- Quirks for HP Victus 16, HP Dragonfly Folio G3, Lenovo Legion 7, HP
Laptop 14s, Acer Nitro 5, TongFang X6SP45xU, Infinix INBOOK X3, and
HP Pavilion All-in-One
ASoC:
- Comprehensive cleanups and bug fixes for SoundWire/SDCA drivers
- DMI quirks for AMD ACP/YC on Lenovo Legion 7, Acer Aspire, MSI
Crosshair A16, and ASUS ExpertBook
- ACPI match table entry for SOF RT5682 on Intel Nova Lake
- Device-specific mixer / clock, irq fixes for TI TAS2562, TI TAS2781,
Sophgo cv1800b ADC, Maxim MAX98090/98095, FSL ASRC/EASRC and Realtek
RT5640
-----BEGIN PGP SIGNATURE-----
iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmprXj0OHHRpd2FpQHN1
c2UuZGUACgkQLtJE4w1nLE/G4hAApuJ3FolNsTbzn3POYf/gFFngvfCNLnZPQumi
XTMDq/G1tgRBHHFpKvkadWmqB/8MnxhfofKycIfQIAwzs6zIAz8ED/p1MXL/pPj7
A7Mrn6pb583TXMeo9tt+8UTOGGECDNswUoaYfpObFBeqdGKWZdx51bpZz9KzBNee
KAfbbijvleRJpHHumP0rPL/qMGazhlA8rBCIqWYcp+YBNLXPnEYbF4wq2hjP06Fo
X9vNaBAuwuPAxjFVg+2LtaEQt4fAD+xOPSRlhlnPUPrmUKIe4kVTY5JYU9CW8Ywo
8M+U3Z/gqw37Lkko/ctu6CZrgzvmsNQWjGzFmen2I0viCGklZtJrOPTGMdu3L13o
tVoQ+nK5Pofjgk3ik5qxXu+kdZVDbSbvhQiRW50JAmhD/pLNRQxy1M6WZcS5RvDa
6AnK0sTB6nlNVd+rfXRf6lbnOyk4JI10WEXb6eWyh1PvaGcOQm3D1Sq9sq7e+1se
YWZJQsutOYv5wk+bnpfZMm+uhm3t61ibZYubz4nYqPDuC+yt3ZVSdDU3iIFTZwQ1
oHAdWYbgSNd2OAVghjzomsPL+099HDgAk1uYUrIPtb2Q+pHQ8wIYSXKpGarPA5Kp
pDnKcjfV80CT8hMGD00zOhgYXMnWNZmOPXQMq7jNaiDQPH+07Yo8tVhgg7HUxlXe
i4oMZEk=
=nkW9
-----END PGP SIGNATURE-----
Merge tag 'sound-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"A collection of sound fixes for the 7.2-rc6 cycle. Again, it became
far larger than wished; I'll throttle from now on.
There are no major changes, just a normal flow of small fixes. The
majority of them are device-specific quirks and ASoC SDCA/codec
updates, but it includes a few ALSA core fixes as well.
ALSA Core:
- Fix for ALSA sequencer timer division-by-zero
- Fix potential race in ALSA timer core
- Wake up linked drain waiters on PCM stream unlink
- Fix double-free of converter objects on UMP rawmidi error path
USB-audio:
- Fix a few potential out-of-bounds access bugs
- Prevent stack info leak in RME Digiface status
- Fix UAF during UMP endpoint destruction
- Fix UAF at error handling during probe in Line6 6fire driver
- Quirks for C-Media CM6206, Corsair Virtuoso, Razer Barracuda X 2.4,
JKY Technology, and generic USB headphones
HD-audio:
- Quirks for HP Victus 16, HP Dragonfly Folio G3, Lenovo Legion 7, HP
Laptop 14s, Acer Nitro 5, TongFang X6SP45xU, Infinix INBOOK X3, and
HP Pavilion All-in-One
ASoC:
- Comprehensive cleanups and bug fixes for SoundWire/SDCA drivers
- DMI quirks for AMD ACP/YC on Lenovo Legion 7, Acer Aspire, MSI
Crosshair A16, and ASUS ExpertBook
- ACPI match table entry for SOF RT5682 on Intel Nova Lake
- Device-specific mixer / clock, irq fixes for TI TAS2562, TI
TAS2781, Sophgo cv1800b ADC, Maxim MAX98090/98095, FSL ASRC/EASRC
and Realtek RT5640"
* tag 'sound-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (53 commits)
ASoC: rt722: reset codec to fix abnormal sound
ASoC: dt-bindings: realtek,rt5640: Make interrupts optional
ALSA: hda/realtek: Add mute LED quirk for HP Victus 16-e0xxx (MB 88ED)
ALSA: usb-audio: Add GET_SAMPLE_RATE quirk for C-Media CM6206
ALSA: usb-audio: Clamp frame size in implicit-feedback mode
ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set
ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision)
ALSA: pcm: wake linked drain waiters on unlink
ASoC: amd: acp: Add DMI quirk for Lenovo Legion 7 15ASH11
ASoC: sophgo: return 1 on volume change in cv1800b_adc_volume_set()
ASoC: tas2781: Use correct calibration data for SINEGAIN2 register
ASoC: SDCA: Move kcontrol search out of IRQ
ASoC: SDCA: Switch to fixup_controls callback for IRQ registration
ASoC: Add a component fixup_controls callback
ASoC: SDCA: Populate IRQ data earlier
ASoC: SDCA: Remove devm from primary IRQ cleanup
ASoC: SDCA: Add sdca_irq_cleanup_late()
ASoC: SDCA: Rename sdca_irq_allocate() to include devm
ALSA: hda/realtek: Add quirk for HP Dragonfly Folio G3 2-in-1 (103c:8a05)
ALSA:hda/realtek:ALC269 fixup for Legion 7 15ASH11 Mic Mute LED
...
|
||
|
Linus Torvalds
|
05b165b6c8 |
This pull request contains the following bug fixes for UML:
- UAF in UML's vector networking driver -----BEGIN PGP SIGNATURE----- iQJmBAABCABQFiEEdgfidid8lnn52cLTZvlZhesYu8EFAmpstNAbFIAAAAAABAAO bWFudTIsMi41KzEuMTEsMiwyFhxyaWNoYXJkQHNpZ21hLXN0YXIuYXQACgkQZvlZ hesYu8HLZBAA1/nFbLrAkqHF6TX1r210RrWxHQfzfmE+ER48lYh+fy2Nvq/gcV6G vEGdcAFfhstIvH8uJFoPnEClE7s0DzV/vHEBNsqmqF76HgRR88EFSbkvNGFtR9w6 DwTn3R2grN4cGaEy9phaeMLik3tj2gTfQd9wgTr+hphr6//fBtxhfe6AgIZyHVJu JmJq+JyiAbA3Pr6CKT+pojcRgx8clavputOxT/4ZaVIj2S64Cn/+BtYd4p7jYZjS IWfnYMKDvnjaDt1eAl758Cc3J+fZdHLc6Ai7rTGwSxqWCubQDz/XQ/WyI3CUuAbL cB9BKRJ5GMP13PDsj0qsg2JSDYiRpGtBvOl6WNy4D4G7wipc9GXySw4yUzBM2utL wSaISSlcA0GHHbk3GnIsoJDEd8tgo/2f8uUgx6xFtI5nYIpwwEZ6+f4JoZpNu5C0 dRA9tN6znmpnmGcRaj7Cir81xyqbxER0llyok4e4KgypC1ymWYJwC/+wIrxo+DIC GaBlY/nKjzGPzLeHnmlUvWIwmyNqOy1/HajTSRiWZ+ZTu1zb74CRvUEH3fvKMmOU kZM/KUSHRR9ufqkaiPLxoP08oEDjfg8DqbhjP7HP/KD6YO3mjod6YRgyKtUeBMhj xoBsCVl3earpv/IvWU6yRxIoIGEhl/j15zIHmm6Yjn4e3pvmQnNzVtI= =zErw -----END PGP SIGNATURE----- Merge tag 'uml-for-linus-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux Pull UML fix from Richard Weinberger: - Fix use-after-free in UML's vector networking driver * tag 'uml-for-linus-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux: um: vector: fix use-after-free in vector_mmsg_rx() |