Sashiko AI review pointed out the following issue.
The __merge_memory_ranges() function incorrectly handles overlapping
memory ranges when merging them. Although sort_memory_ranges() sorts all
ranges by their start address in ascending order beforehand, the merge
logic remains defective in two ways:
1. It compares the current range's start against the previous element (i-1)
instead of the running target index (idx)
2. It unconditionally overwrites 'ranges[idx].end' with 'ranges[i].end'.
This logic flaw leads to critical memory truncation when a larger memory
range completely subsumes subsequent smaller ranges.
For example, consider a sorted input array with three ranges:
Range A (idx=0): [0x1000 - 0x9000]
Range B (i=1): [0x2000 - 0x5000] (completely inside Range A)
Range C (i=2): [0x6000 - 0x8000] (completely inside Range A)
1. When i=1 (Range B):
ranges[1].start (0x2000) <= ranges[0].end + 1 (0x9001) is TRUE.
The code executes: ranges[0].end = ranges[1].end, which erroneously
shrinks Range A's end from 0x9000 down to 0x5000.
2. When i=2 (Range C):
ranges[2].start (0x6000) <= ranges[1].end + 1 (0x5001) is FALSE.
The code falls into the else block, creating a broken new range.
As a result, valid memory fragments [0x5001 - 0x5fff] and [0x8001 - 0x9000]
are completely lost from the kexec exclude lists, potentially allowing
the crash kernel to overwrite active memory, causing data corruption
or crashes.
Fix this by ensuring the start of the current range is compared against the
end of the active merged range (idx), and use max() to safely prevent the
outer boundary from being truncated.
Cc: stable@vger.kernel.org
Fixes: 180adfc532 ("powerpc/kexec_file: Add helper functions for getting memory ranges")
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Reviewed-by: Sourabh Jain <sourabhjain@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260729012948.2797865-4-ruanjinjie@huawei.com
A static Sashiko AI review identified a potential NULL pointer
dereference in kexec_extra_fdt_size_ppc64().
On platforms without any reserved memory regions,
get_reserved_memory_ranges() can return 0 while leaving 'rmem'
unallocated as NULL. Passing it directly leads to a kernel panic when
evaluating 'rmem->nr_ranges'.
Add a NULL check for 'rmem' to prevent this crash.
Cc: stable@vger.kernel.org
Fixes: 0d3ff06733 ("powerpc/kexec_file: fix extra size calculation for kexec FDT")
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Reviewed-by: Sourabh Jain <sourabhjain@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260729012948.2797865-3-ruanjinjie@huawei.com
In get_crash_memory_ranges(), if crash_exclude_mem_range() failed
after realloc_mem_ranges() has successfully allocated the cmem
memory, it just returns an error but leaves cmem pointing to
the allocated memory, nor is it freed in the caller
update_crash_elfcorehdr(), which cause a memory leak, goto out
to free the cmem.
Fixes: 849599b702 ("powerpc/crash: add crash memory hotplug support")
Reviewed-by: Sourabh Jain <sourabhjain@linux.ibm.com>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260729012948.2797865-2-ruanjinjie@huawei.com
The PPC4xx GPIO driver stopped assigning an explicit parent
to the gpio_chip when it moved away from of_mm_gpiochip_add_data().
Restore that association from the platform device so OF GPIO lookup
can match phandles to the registered gpiochip.
Tested on: Cisco MX60W. No more probe deferral.
Assisted-by: Codex:GPT-5.5
Fixes: 1044dbaf2a ("powerpc/44x: Change GPIO driver to a proper platform driver")
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260517063754.21819-1-rosenp@gmail.com
The lack of get_direction() callback in this driver causes GPIOLIB to
emit a warning. Implement it.
Fixes: e623c4303e ("gpiolib: sanitize the return value of gpio_chip::get_direction()")
Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/c6eb70aa0e1ba6e15f947c827006aa79edace05c.1785318836.git.chleroy@kernel.org
Include asm-generic/serial.h and use the generic BASE_BAUD definition
instead of redefining it.
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Reviewed-by: Amit Machhiwal <amachhiw@linux.ibm.com>
Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260729223807.570178-3-thorsten.blum@linux.dev
There have been no sprintf() callers in the boot wrapper since commit
e275e023aa ("powerpc/44x: Warp patches for the new NDFC driver").
Remove the function definition and declaration.
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260724172200.208722-2-thorsten.blum@linux.dev
Check only the first byte instead of scanning the entire string with
strlen().
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260721155346.121975-4-thorsten.blum@linux.dev
Check only the first byte instead of scanning the entire string with
strlen().
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260721155346.121975-3-thorsten.blum@linux.dev
Use cpu_relax() to wait for the execution status SPE_EX_STATE_EXECUTED.
Drop the comments while at it.
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260720231153.116827-2-thorsten.blum@linux.dev
Check only the first byte instead of scanning the entire string with
strlen(). While at it, keep dt_cpu_name static, but move it into
dt_cpu_ftrs_scan_callback(), where it is assigned.
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260701114428.818748-3-thorsten.blum@linux.dev
Now that struct rtas_error_log uses a flexible array member for the
extended log buffer, use struct_size() to calculate the total RTAS error
log size and avoid using the hard-coded header size of 8 bytes.
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260627104730.276858-4-thorsten.blum@linux.dev
Now that struct rtas_error_log uses a flexible array member for the
extended log buffer, use struct_size() to calculate the total RTAS error
log size and avoid using the hard-coded header size of 8 bytes.
Use min() to replace the open-coded implementation while at it.
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260627104730.276858-3-thorsten.blum@linux.dev
Drop the local 10-byte buffer. The old code copied at most 9 bytes from
the user buffer, but only the first byte was used to select the RTAS
operation.
Use get_user() to read the command byte instead and compare it directly
with '0' and '1'. Drop the explicit user buffer check, since get_user()
will fail on a NULL pointer and correctly return -EFAULT instead of
-EINVAL. Remove the now-obsolete string constants as well as any
strncmp() and strlen() calls.
Return the original count instead of a potentially capped value, since
the full user write has been consumed once the command is accepted.
Use unsigned int op to better match the manage_flash() interface.
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260528201226.1599977-3-thorsten.blum@linux.dev
Drop the redundant buffer assignment in serial_edit_cmdline() since the
cp pointer is immediately overwritten.
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260528082357.1397611-3-thorsten.blum@linux.dev
Replace the manual string length accounting, memcpy(), and NUL
termination with a single snprintf() call to prepend the elfcorehdr=
address and to detect string truncation at the same time.
Use kmalloc() to avoid unnecessarily zeroing the memory. While at it,
also use "prepending" instead of "appending" in the error message.
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260527000105.1081651-3-thorsten.blum@linux.dev
Now that all kvm entry to guest paths handle the task work
using the generic framework, enable HAVE_POSIX_CPU_TIMERS_TASK_WORK
which allows running posix cpu timers in task context instead of running
them in hardirq. This would is a necessary step towards enabling
PREEMPT_RT on powerNV systems.
Signed-off-by: Shrikanth Hegde <sshegde@linux.ibm.com>
Signed-off-by: Vishal Chourasia <vishalc@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260709092140.1753715-5-vishalc@linux.ibm.com
Since commit 2cd571245b ("sched/fair: Add related data structure for
task based throttle") in v6.18, CFS bandwidth throttling no longer
dequeues a task directly; it queues task_work via TWA_RESUME and sets
TIF_NOTIFY_RESUME, relying on that work running before the task returns
to guest/user mode. The powerpc KVM run loops only checked for reschedule
and signals, never TIF_NOTIFY_RESUME, so the deferred throttle never ran
while a vCPU stayed in the run loop: a CPU-bound guest that rarely exits
to userspace ran far past its cpu.max quota and then appeared frozen for
minutes while the accrued throttle debt was repaid.
Use the generic infrastructure to check for and handle pending work
before transitioning into guest mode, replacing the open-coded
need_resched() and cond_resched() checks in the Book3S HV run loops and
in the common kvmppc_prepare_to_enter() used by the Book3S PR and BookE
run loops. The redundant signal_pending() recheck (and its sigpend label)
in kvmhv_run_single_vcpu() is also dropped, as
xfer_to_guest_mode_work_pending() is a superset of it.
This picks up handling for TIF_NOTIFY_RESUME, which was previously
ignored, meaning task work will now be correctly handled on every
guest re-entry.
Selecting VIRT_XFER_TO_GUEST_WORK disables RCU's last-resort self-IPI
fallback for vCPU tasks (see rcu_irq_work_resched()), which on
nohz_full CPUs was what forced a reschedule for deferred rcuog wakeups
queued right before guest entry. Take over that obligation the same way
x86 and s390 do: call xfer_to_guest_mode_prepare() with IRQs disabled
immediately before the final xfer_to_guest_mode_work_pending() check at
each guest-entry gate (kvmhv_run_single_vcpu(), kvmppc_run_core() and
kvmppc_prepare_to_enter()).
In kvmppc_prepare_to_enter(), IRQs are now disabled with
local_irq_disable() before hard_irq_disable(): on 32-bit,
hard_irq_disable() is a raw MSR[EE] clear that bypasses the
lockdep/irq-tracing state, and the strict xfer_to_guest_mode helpers
assert that IRQs are seen as disabled. This also allows upgrading the
racy __xfer_to_guest_mode_work_pending() check to the asserting
variant, as this loop is the terminal gate for the PR and BookE paths.
In kvmhv_run_single_vcpu(), the -EINTR exit and the pre-existing
kvmhv_setup_mmu() failure exit now leave via the done label instead of
returning directly, keeping the run_vcpu enter/exit tracepoints
balanced and vcpu->arch.ret consistent with the returned value.
In kvmppc_prepare_to_enter() the generic helper accounts the signal exit
(vcpu->stat.signal_exits and KVM_EXIT_INTR) but does not set the exit
type, so kvmppc_set_exit_type(SIGNAL_EXITS) is retained on the signal
path to preserve the E500 CONFIG_KVM_EXIT_TIMING histogram; it is a no-op
otherwise.
Signed-off-by: Vishal Chourasia <vishalc@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260709092140.1753715-4-vishalc@linux.ibm.com
For now only Big Endian 32-bit PowerPC is supported, as that is the only
hardware I have. This has been tested on the Nintendo Wii so far, but I
plan on also using it on the GameCube, Wii U and Apple G4.
These changes aren’t the only ones required to get the kernel to compile
and link on PowerPC, libcore will also have to be changed to not use
integer division to format u64, u128 and core::time::Duration, otherwise
__udivdi3() and __umoddi3() will have to be added. I have tested this
change by replacing the three implementations with unimplemented!() and
it linked just fine.
Signed-off-by: Link Mauve <linkmauve@linkmauve.fr>
Link: https://github.com/Rust-for-Linux/linux/issues/105
Link: https://github.com/linuxppc/issues/issues/451
Acked-by: Gary Guo <gary@garyguo.net>
Link: https://github.com/rust-lang/compiler-team/issues/986
Signed-off-by: Mukesh Kumar Chaurasiya (IBM) <mkchauras@gmail.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260708082454.1254320-7-mkchauras@gmail.com
The core crate currently depends on these two functions for i64/u64/
i128/u128/core::time::Duration formatting, but we shouldn’t use that in
the kernel so let’s panic if they are ever called.
This doesn’t yet fix drm_panic_qr.rs, which also uses __udivdi3 when
CONFIG_CC_OPTIMIZE_FOR_SIZE=y, but at least makes the rest of the kernel
build on PPC32.
Signed-off-by: Link Mauve <linkmauve@linkmauve.fr>
Signed-off-by: Mukesh Kumar Chaurasiya (IBM) <mkchauras@gmail.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260708082454.1254320-6-mkchauras@gmail.com
Added support for a new macro ARCH_STATIC_BRANCH_ASM in powerpc
to avoid duplication of inline asm between C and Rust. This is
inline with 'commit aecaf18165 ("jump_label: adjust inline asm to be consistent")'
Co-developed-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Reviewed-by: Gary Guo <gary@garyguo.net>
Link: https://github.com/Rust-for-Linux/linux/issues/105
Link: https://github.com/linuxppc/issues/issues/451
Signed-off-by: Mukesh Kumar Chaurasiya (IBM) <mkchauras@gmail.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260708082454.1254320-4-mkchauras@gmail.com
When building with LLVM=1 for architectures like powerpc where
CONFIG_DMA_SHARED_BUFFER is not enabled, the build fails with:
ld.lld: error: undefined symbol: dma_resv_reset_max_fences
>>> referenced by helpers.c
>>> rust/helpers/helpers.o:(rust_helper_dma_resv_unlock)
The issue occurs because:
1. CONFIG_DEBUG_MUTEXES=y is enabled
2. CONFIG_DMA_SHARED_BUFFER is not enabled
3. dma_resv_reset_max_fences() is declared in the header when
CONFIG_DEBUG_MUTEXES is set
4. But the function is only compiled in drivers/dma-buf/dma-resv.c,
which is only built when CONFIG_DMA_SHARED_BUFFER is enabled
5. Rust helpers call dma_resv_unlock() which calls
dma_resv_reset_max_fences(), causing an undefined symbol
Fix this by compiling `dma-resv.c` file only when CONFIG_DMA_SHARED_BUFFER
is enabled.
Fixes: 9b836641d3 ("rust: helpers: Add bindings/wrappers for dma_resv_lock")
Reviewed-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Gary Guo <gary@garyguo.net>
Signed-off-by: Mukesh Kumar Chaurasiya (IBM) <mkchauras@gmail.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260708082454.1254320-3-mkchauras@gmail.com
When building Rust code for powerpc64le with LLVM=1 and -j1, rustc
encounters an error: "multiple candidates for `rmeta` dependency `core`
found", with two candidates:
1. The host's standard library from the rustup toolchain
2. The kernel's custom libcore.rmeta in the rust/ directory
This occurs because the build system uses `-L$(objtree)/rust` for host
library builds (proc_macro2, quote, syn), which causes rustc to search
the rust/ directory. During this search, rustc finds both the kernel's
custom libcore.rmeta and gains access to the host's standard library,
creating a conflict.
The solution is to separate host libraries into a dedicated rust/host/
subdirectory and use `-L$(objtree)/rust/host` for host builds instead
of `-L$(objtree)/rust`. This ensures that:
1. Host library builds (proc_macro2, quote, syn) only search rust/host/
and never encounter the kernel's libcore.rmeta
2. Proc macro builds use `-L$(objtree)/rust/host` to find their
dependencies
Special handling is added for rustdoc-pin_init, which is a host build
(to access the alloc crate) but depends on proc macros from the main
rust/ directory. It uses explicit `--extern` paths to reference the
proc macros without adding `-L$(objtree)/rust`, which would reintroduce
the conflict.
The rust/host/ directory is added to clean-files to ensure it's removed
during `make clean`.
Link: https://github.com/Rust-for-Linux/linux/issues/105
Link: https://github.com/linuxppc/issues/issues/451
Signed-off-by: Mukesh Kumar Chaurasiya (IBM) <mkchauras@gmail.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260708082454.1254320-2-mkchauras@gmail.com
Please consider pulling these changes from the signed vfs-7.2-rc5.fixes tag.
Thanks!
Christian
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCamYljAAKCRCRxhvAZXjc
ogWyAPwORZDIIsRiAQbnPs+OkYszuWCY29OeUrTf+m3z+tBTLwD+NUFtpH5XIcYJ
3jHtGXPoHjEaOVsNyIdxwnOxWfo+6ws=
=VNq0
-----END PGP SIGNATURE-----
Merge tag 'vfs-7.2-rc5.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull vfs fixes from Christian Brauner:
- vfs: Preserve the ACL_DONT_CACHE state in forget_cached_acl().
ACL_DONT_CACHE is meant to be a permanent opt-out from ACL caching
which FUSE relies on for servers that don't negotiate FUSE_POSIX_ACL.
The helper replaced it with ACL_NOT_CACHED, silently re-enabling the
cache, and as fuse doesn't invalidate the cache for such servers a
properly timed get_acl() returned stale ACLs. Comes with a fuse
selftest reproducing this.
- pidfs:
- Preserve PIDFD_THREAD when a thread pidfd is reopened via
open_by_handle_at(). PIDFD_THREAD shares the O_EXCL bit which
do_dentry_open() strips after the flags have been validated, so
the reopened pidfd silently became a process pidfd. Comes with a
selftest.
- Add a pidfs_dentry_open() helper so the regular pidfd allocation
path and the file handle path share the code that forces O_RDWR
and reapplies the pidfd flags that do_dentry_open() strips.
- Handle FS_IOC32_GETVERSION in the compat ioctl path.
- Make pidfs_ino_lock static.
- iomap:
- Fix the block range calculation in ifs_clear_range_dirty() so a
partial clear doesn't drop the dirty state of blocks the range
only partially covers.
- Support invalidating partial folios so a partial truncate or hole
punch with blocksize < foliosize doesn't leave stale dirty bits
behind.
- Only set did_zero when iomap_zero_iter() actually zeroed
something.
- Guard ifs_set_range_dirty() and ifs_set_range_uptodate() against
zero-length ranges where the unsigned last-block calculation
underflows and bitmap_set() writes far beyond the ifs->state
allocation.
- Don't merge ioends with different io_private values as the merge
could leak or corrupt the private data of the individual ioends.
- exec:
- Raise bprm->have_execfd only once the binfmt_misc interpreter has
actually been opened. The flag was set as soon as a matching 'O'
or 'C' entry was found. If the interpreter open failed with
ENOEXEC the exec fell through to the next binary format with
have_execfd raised but no executable staged and begin_new_exec()
NULL derefed past the point of no return.
- Fix an unsigned loop counter wrap in transfer_args_to_stack() on
nommu. An overlong argument or environment string pushes bprm->p
below PAGE_SIZE, the stop index becomes zero, and the loop never
terminates, wrapping its counter and copying garbage from in
front of the page array into the new process stack.
- Make binfmt_elf_fdpic only honour the first PT_INTERP like
binfmt_elf does. Each additional PT_INTERP overwrote the previous
interpreter, leaking the name allocation and the interpreter file
reference together with the write denial open_exec() took,
leaving the file unwritable for as long as the system runs.
- overlayfs:
- Compare the full escaped xattr prefix including the trailing dot.
An xattr like "trusted.overlay.overlayfoo" was misclassified as
an escaped overlay xattr.
- Check read access to the copy_file_range() source with the
source's mounter credentials.
- super: Thawing a filesystem whose block device was frozen with
bdev_freeze() deadlocked. Dropping the last block layer freeze
reference from under s_umount ends up in fs_bdev_thaw() which
reacquires s_umount on the same task. Pin the superblock with an
active reference instead and call bdev_thaw() without holding
s_umount.
- procfs: Return EACCES instead of success when the ptrace access check
for namespace links fails.
- afs: Use afs_dir_get_block() rather than afs_dir_find_block() for
block 0 in afs_edit_dir_remove(), matching afs_edit_dir_add().
- Push the memcg gating of ->nr_cached_objects() down into the btrfs
and shmem callbacks instead of skipping every callback during
non-root memcg reclaim. The blanket check short-circuited XFS whose
inode reclaim hook is intentionally driven from per-memcg contexts to
free memcg-charged slab.
- eventpoll: Pin files while checking reverse paths.
Since struct file became SLAB_TYPESAFE_BY_RCU a concurrent close
could free and recycle the file under the check which then took and
dropped the f_lock of whatever live file now occupies that slot.
* tag 'vfs-7.2-rc5.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (24 commits)
super: fix emergency thaw deadlock on frozen block devices
pidfs: make pidfs_ino_lock static
eventpoll: pin files while checking reverse paths
fs: push nr_cached_objects memcg gating into individual filesystems
afs: Fix afs_edit_dir_remove() to get, not find, block 0
iomap: prevent ioend merge when io_private differs
iomap: add comments for ifs_clear/set_range_dirty()
iomap: fix out-of-bounds bitmap_set() with zero-length range
iomap: fix incorrect did_zero setting in iomap_zero_iter()
iomap: support invalidating partial folios
iomap: correct the range of a partial dirty clear
fs/super: fix emergency thaw double-unlock of s_umount
pidfs: handle FS_IOC32_GETVERSION in compat ioctl
ovl: check access to copy_file_range source with src mounter creds
proc: Fix broken error paths for namespace links
pidfs: add pidfs_dentry_open() helper
selftests/pidfd: check PIDFD_THREAD survives open_by_handle_at()
pidfs: preserve thread pidfds reopened by file handle
ovl: fix trusted xattr escape prefix matching
selftests/fuse: add ACL_DONT_CACHE regression test
...
Just a couple of small bits for the SpacemiT driver - one small fix, and
a new compatible in the DT binding.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmpmL3sACgkQJNaLcl1U
h9CDnwgAggPOeUHMrQWYES7f74oTVl/kt0B1TBV6g91r8a4p0yyy7Kn6C1njBQ7n
N5bgSL2EkpQRjj2d5akh42Apwb5EQZMdqICo68XElWnk0AxH6Y1PdRkfcruU9PnS
t7KJEeBxdsZAJhx5ZEWZrIwjY/rbEvI+rfePgdm8kVeUUVs4ur6Zg1DNk/LgolOP
xr60E5DWHIczjJ3Ae+svL5mmJ8FICFOThAYjMzGyRACB4c3znMBhzKVoNrUR6sl5
7qSf1x3WBXIYwd0RRs9YhTF6vQhlnfKfu8rPfb2S6v8rE7JmmokLr3kVFzgpph1K
o893VMecWe5al0ZuE2qdf44w2Ohv0Q==
=2PTr
-----END PGP SIGNATURE-----
Merge tag 'spi-fix-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
Pull spi fixes from Mark Brown:
"Just a couple of small bits for the SpacemiT driver - one small fix,
and a new compatible in the DT binding"
* tag 'spi-fix-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
spi: dt-bindings: spacemit: add K3 SPI compatible
spi: spacemit: Correct TX FIFO slot calculation
One driver specific fix where one of the MediaTek drivers duplicated
some core code buggily, and a core fix for an ordering issue on startup
where we could end up configuring a voltage outside of constraints due
to the order in which we applied constraints.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmpmMC4ACgkQJNaLcl1U
h9DoiAf/V64CUAFspev+AtzWpx1Su9zZoSzoMM5Gj0WBuMoo4G5hZj804DQ/n8al
sai+f0loMEVcblfpZNOlYagSkDgvvIc/1SQrAQ1oIxMbpotE1vn4htzGsJJuwwgL
lh5GC4CsrXOSRX3VG6pJeBR6RTb9VEbkAhLoxKAJyPlcynk2KdBPwR9B1ZlCgpe6
MP2WrurEVexvuDlZdE8THYth4FXCms0uH5VLo+Q3G4r1Ayt9YpvbvG91fzJSJGti
NAzAWma2GFGwQkka5sgMYHyP6rwM1vJ71mz+Bq9G5fUe6DyEp85jv993D5lq2vbH
69GO6ZTZmruCqOkDEELIKA4EpKYzZA==
=3XbV
-----END PGP SIGNATURE-----
Merge tag 'regulator-fix-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator
Pull regulator fixes from Mark Brown:
"One driver specific fix where one of the MediaTek drivers duplicated
some core code buggily, and a core fix for an ordering issue on
startup where we could end up configuring a voltage outside of
constraints due to the order in which we applied constraints"
* tag 'regulator-fix-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
regulator: core: clamp voltage constraints before applying apply_uV
regulator: mt6358: use regmap helper to read fixed LDO calibration
Here are a number of small char/misc/etc. driver fixes for 7.2-rc5 that
resolve a bunch of different reported issues. Included in here are:
- rust_binder error message reporting fix
- stratix10-svc firmware driver fixes
- mei driver fix
- intel_th hardware tracing driver fix
- comedi driver fix
- uio_hv_generic driver fix
- ntsync selftest fix
- nsm misc driver fix
- some MAINTAINER file updates
All of these have been in linux-next for over a week with no reported
issues.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCamYCHg8cZ3JlZ0Brcm9h
aC5jb20ACgkQMUfUDdst+ymTpwCgyyS6niRHf2Y0qx/o+i8s87h+ipoAoJeaOzb7
RWX/ZYiUEoQCtfbxmXZF
=cRG6
-----END PGP SIGNATURE-----
Merge tag 'char-misc-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
Pull char/misc driver fixes from Greg KH:
"Here are a number of small char/misc/etc driver fixes for 7.2-rc5 that
resolve a bunch of different reported issues. Included in here are:
- rust_binder error message reporting fix
- stratix10-svc firmware driver fixes
- mei driver fix
- intel_th hardware tracing driver fix
- comedi driver fix
- uio_hv_generic driver fix
- ntsync selftest fix
- nsm misc driver fix
- some MAINTAINER file updates
All of these have been in linux-next for over a week with no reported
issues"
* tag 'char-misc-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
MAINTAINERS: Update wine-devel list address
rust_binder: only print failure if error has source
intel_th: fix MSC output device reference leak
misc: nsm: pin the module while the device is open
mei: bus: access mei_device under device_lock on cleanup
misc: nsm: only unlock nsm_dev on post-lock error paths
selftests: ntsync: correct CONFIG_NTSYNC name
comedi: comedi_parport: deal with premature interrupt
uio_hv_generic: Bind to FCopy device by default
MAINTAINERS: Add Greg Kroah-Hartman to GPIB
firmware: stratix10-svc: fix teardown order in remove to prevent race
firmware: stratix10-svc: handle NO_RESPONSE in async poll
firmware: stratix10-svc: fix FCS SMC call kernel-doc
firmware: stratix10-svc: fix memory leaks and list corruption bugs
Here are two small staging driver fixes for 7.2-rc5. They both resolve
some reported bugs in the rtl8723bs staging driver and have been in
linux-next for over a week with no reported issues.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCamYAxA8cZ3JlZ0Brcm9h
aC5jb20ACgkQMUfUDdst+ylfoQCghy7Exq7vpWMlhR8LwQucWqABsxsAnjzK86WN
8VZ68CMngObWMPH31Dx7
=sWD7
-----END PGP SIGNATURE-----
Merge tag 'staging-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging
Pull staging driver fixes from Greg KH:
"Here are two small staging driver fixes for 7.2-rc5. They both resolve
some reported bugs in the rtl8723bs staging driver and have been in
linux-next for over a week with no reported issues"
* tag 'staging-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()
staging: rtl8723bs: fix inverted HT40 secondary channel offset
Here are two small serial driver fixes for 7.2-rc5. They are:
- sc16is7xx get_direction() callback fix, which resolves a
user-triggerable warning in the driver
- NULL pointer dereference on some platforms using the 8250_mid serial
driver
Both have been in linux-next for over a week with no reported issues.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCamYBZA8cZ3JlZ0Brcm9h
aC5jb20ACgkQMUfUDdst+ykMjACgpSS04QGbBIWmMHnxBWHnDT+Z8qoAn210DRbo
l5E84oG0BSJg1i9c3mnj
=WB87
-----END PGP SIGNATURE-----
Merge tag 'tty-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty
Pull serial driver fixes from Greg KH:
"Here are two small serial driver fixes for 7.2-rc5. They are:
- sc16is7xx get_direction() callback fix, which resolves a
user-triggerable warning in the driver
- NULL pointer dereference on some platforms using the 8250_mid
serial driver
Both have been in linux-next for over a week with no reported issues"
* tag 'tty-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
serial: sc16is7xx: implement gpio get_direction() callback
serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms
Here are some small USB fixes and new device quirks and ids for 7.2-rc5.
Included in here are:
- usb storage quirk added
- new usb serial device ids added
- usb-serial device name leak and other bug fixes
- small xhci driver fixes
- normal batch of typec driver fixes for reported issues
- usb-atm much-reported-by-syzbot fix for firmware download races
- sysfs BOS device removal race fix
- lots of usb gadget driver fixes for reported issues
- other small USB driver fixes for other reported problems.
All of these have been in linux-next this past week, many of them much
longer.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCamYE0A8cZ3JlZ0Brcm9h
aC5jb20ACgkQMUfUDdst+yk0twCdFi0ivPtWtEzmP7lUNRCzmyT3MvoAoI7o6lJm
E5+ID/c4mWfX/DjoPFhU
=uUBv
-----END PGP SIGNATURE-----
Merge tag 'usb-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
Pull USB fixes from Greg KH:
"Here are some small USB fixes and new device quirks and ids:
- usb storage quirk added
- new usb serial device ids added
- usb-serial device name leak and other bug fixes
- small xhci driver fixes
- normal batch of typec driver fixes for reported issues
- usb-atm much-reported-by-syzbot fix for firmware download races
- sysfs BOS device removal race fix
- lots of usb gadget driver fixes for reported issues
- other small USB driver fixes for other reported problems
All of these have been in linux-next this past week, many of them much
longer"
* tag 'usb-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (30 commits)
usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path
USB: serial: io_edgeport: cap received transmit credits
USB: serial: option: add TDTECH MT5710-CN
USB: serial: io_ti: reject oversized boot-mode firmware
USB: serial: mxuport: validate firmware header size
usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect
usb: typec: ucsi: yoga_c630: Remove redundant duplicate altmode handling
usb: typec: ucsi: Add duplicate detection to nvidia registration path
usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware
usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback
usb: chipidea: fix usage_count leak when autosuspend_delay is negative
usb: core: sysfs: add lock to bos_descriptors_read()
usb: musb: omap2430: Do not put borrowed of_node in probe
usb: core: port: Deattach Type-C connector on component unbind
USB: storage: add NO_ATA_1X quirk for Longmai USB Key
USB: serial: ftdi_sio: add support for E+H FXA291
USB: serial: keyspan_pda: fix data loss on receive throttling
usb: gadget: printer: fix infinite loop in printer_read()
usb: gadget: f_midi: cancel pending IN work before freeing the midi object
usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown
...
- Move rb_desc->nr_page_va before updating dynamic array
The rb_descr->page_va is a dynamic array counted by nr_page_va. But the
updating of the page_va[] is done before the nr_page_va is incremented
causing a build with CONFIG_UBSAN_BOUNDS to flag it as an overflow.
Move the increment of the counted by value before the array element is
updated.
- Propagate errors from remote event bulk updates
The return value of trace_remote_enable_event() was not being checked by
remote_events_dir_enable_write() where it would silently fail. Have it
check the return value and propagate that back up to user space.
- Fix resource leak on mmiotrace trace_pipe close
The mmiotrace tracer was created in 2008 before the trace_pipe had a close
callback to allow tracers to do clean up from trace_pipe open. The
trace_pipe close cleanup callback was added in 2009 but the mmiotrace
tracer was not updated. It had a hack to do the cleanup in the read call,
where it may leak if user space did not read the entire buffer.
Add a callback to mmiotrace trace_pipe close do to the cleanup properly.
- Fix a possible NULL pointer dereference in the mmiotrace tracer
If the mmio_pipe_open() fails to find a PCI device, it will set the
hiter->dev pointer to NULL. The read function will blindly dereference
that pointer. Fix the read call to check to see if that pointer is
populated before dereferencing it.
- Fix union collision of module and refcnt for dynamic events
In 'struct trace_event_call', the 'module' pointer and the 'refcnt' atomic
variable share the same memory space in a union. The filter on module
logic only checked if the 'module' was set to determine if the event
belonged to the module. As dynamic events are always builtin, it doesn't
need the 'module' field of the structure and used a refcount. But the
module filtering logic would then mistaken these dynamic events as a
module and call module_name(event->module) on it.
Add a check to see if the event is a dynamic event and if so, do not check
it for being part of the given module.
- Reset the top level buffer in selftests before running instances
The ftracetest selftest initializes each instance before executing the
tests. But it does not reset the top level buffer. Dynamic events are only
added and removed by the top level so any left over dynamic events will
not be removed by the reset in the instances.
Left over dynamic events can cause the tests to incorrectly fail. Reset
the top level buffer before running the instances.
- Make the context_switch counter 64 bit
The code to read user space for a system call trace event or for a
trace_marker will disable migration, enable preemption, read user space
into a per CPU buffer, disable preemption and enable migration again.
It checks if the per CPU context switch counter to see if it changed, and
if it did not, it would know that the per CPU buffer was not touched by
another task.
But the save counter was 32 bit and it would compare it to the 64 bit
context_switch variable. A long running system could have the
context_switch variable greater that 1<<32 in which case the compare will
always fail. The compare will promote the 32 bit int saved value to 64 bit
and compare it to the full 64 bit counter. Since the top 32 bits of the
saved value was zero, it would never match.
- Fix a use-after-free of the event_enable trigger
The event_enable trigger allows for enabling one event when another event
is triggered. When the trigger is removed, it must go through a
synchronization phase to make sure it is not triggered again. The trigger
itself is delayed by the "bulk delay" logic that was recently added.
But the code that frees the event_enable data used to rely on the trigger
code to do the synchronization. Now that the code uses the call RCU
functions (and a workqueue), that delay no longer is there.
Add a callback private_data_free() function that allows triggers to clean
up data after the synchronization phase has completed.
- Move the module_ref counter into the delay callback
Since an event of the event_enable trigger can enable an event for a
module, it ups the module ref count for that event's module. This prevents
the event from trying to enable an event that no longer exists and cause a
use-after-free bug.
The ref counter was set back down when the trigger was removed but not
after thy synchronization phase. This could lead to the module data being
accessed after module was unloaded.
Move the module ref decrement into the private_data_free() callback of the
event_enable trigger.
- Add mutex to protect parser in ftrace filtering
The set_ftrace_filter file uses a parsing descriptor that is allocated at
open and modified by writes. If multiple threads were to write to the
descriptor at the same time, it can corrupt the parser.
Add a mutex around the modifications of the parser descriptor.
- Fix possible corruption in perf syscall tracing
The perf system call trace events can now read user space. To do so, the
reads of user space enable preemption and disables it again. During this
time that preemption is enabled, the task can migrate. The perf event list
head is assigned via a per CPU pointer. It is done before the user space
part is called. If the user space reading migrates the task to another
CPU, then the head pointer is no longer valid.
Re-assign the head pointer after the reading of user space to keep it
using the correct data.
-----BEGIN PGP SIGNATURE-----
iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCamYDGhQccm9zdGVkdEBn
b29kbWlzLm9yZwAKCRAp5XQQmuv6qkhYAP9G5wDTVQQzitl900iWp9rvQ2Qm5UWN
JDnK2HO1elmj0AD8CRiHBI5W3O2yUmoO4bOFZ9YFXz+DqJ1jwkDs5FfqjAU=
=EMD9
-----END PGP SIGNATURE-----
Merge tag 'trace-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull tracing fixes from Steven Rostedt:
- Move rb_desc->nr_page_va before updating dynamic array
The rb_descr->page_va is a dynamic array counted by nr_page_va. But
the updating of the page_va[] is done before the nr_page_va is
incremented causing a build with CONFIG_UBSAN_BOUNDS to flag it as an
overflow.
Move the increment of the counted by value before the array element
is updated.
- Propagate errors from remote event bulk updates
The return value of trace_remote_enable_event() was not being checked
by remote_events_dir_enable_write() where it would silently fail.
Have it check the return value and propagate that back up to user
space.
- Fix resource leak on mmiotrace trace_pipe close
The mmiotrace tracer was created in 2008 before the trace_pipe had a
close callback to allow tracers to do clean up from trace_pipe open.
The trace_pipe close cleanup callback was added in 2009 but the
mmiotrace tracer was not updated. It had a hack to do the cleanup in
the read call, where it may leak if user space did not read the
entire buffer.
Add a callback to mmiotrace trace_pipe close do to the cleanup
properly.
- Fix a possible NULL pointer dereference in the mmiotrace tracer
If the mmio_pipe_open() fails to find a PCI device, it will set the
hiter->dev pointer to NULL. The read function will blindly
dereference that pointer. Fix the read call to check to see if that
pointer is populated before dereferencing it.
- Fix union collision of module and refcnt for dynamic events
In 'struct trace_event_call', the 'module' pointer and the 'refcnt'
atomic variable share the same memory space in a union. The filter on
module logic only checked if the 'module' was set to determine if the
event belonged to the module. As dynamic events are always builtin,
it doesn't need the 'module' field of the structure and used a
refcount. But the module filtering logic would then mistaken these
dynamic events as a module and call module_name(event->module) on it.
Add a check to see if the event is a dynamic event and if so, do not
check it for being part of the given module.
- Reset the top level buffer in selftests before running instances
The ftracetest selftest initializes each instance before executing
the tests. But it does not reset the top level buffer. Dynamic events
are only added and removed by the top level so any left over dynamic
events will not be removed by the reset in the instances.
Left over dynamic events can cause the tests to incorrectly fail.
Reset the top level buffer before running the instances.
- Make the context_switch counter 64 bit
The code to read user space for a system call trace event or for a
trace_marker will disable migration, enable preemption, read user
space into a per CPU buffer, disable preemption and enable migration
again. It checks if the per CPU context switch counter to see if it
changed, and if it did not, it would know that the per CPU buffer was
not touched by another task.
But the save counter was 32 bit and it would compare it to the 64 bit
context_switch variable. A long running system could have the
context_switch variable greater that 1<<32 in which case the compare
will always fail. The compare will promote the 32 bit int saved value
to 64 bit and compare it to the full 64 bit counter. Since the top 32
bits of the saved value was zero, it would never match.
- Fix a use-after-free of the event_enable trigger
The event_enable trigger allows for enabling one event when another
event is triggered. When the trigger is removed, it must go through a
synchronization phase to make sure it is not triggered again. The
trigger itself is delayed by the "bulk delay" logic that was recently
added. But the code that frees the event_enable data used to rely on
the trigger code to do the synchronization. Now that the code uses
the call RCU functions (and a workqueue), that delay no longer is
there.
Add a callback private_data_free() function that allows triggers to
clean up data after the synchronization phase has completed.
- Move the module_ref counter into the delay callback
Since an event of the event_enable trigger can enable an event for a
module, it ups the module ref count for that event's module. This
prevents the event from trying to enable an event that no longer
exists and cause a use-after-free bug.
The ref counter was set back down when the trigger was removed but
not after thy synchronization phase. This could lead to the module
data being accessed after module was unloaded.
Move the module ref decrement into the private_data_free() callback
of the event_enable trigger.
- Add mutex to protect parser in ftrace filtering
The set_ftrace_filter file uses a parsing descriptor that is
allocated at open and modified by writes. If multiple threads were to
write to the descriptor at the same time, it can corrupt the parser.
Add a mutex around the modifications of the parser descriptor.
- Fix possible corruption in perf syscall tracing
The perf system call trace events can now read user space. To do so,
the reads of user space enable preemption and disables it again.
During this time that preemption is enabled, the task can migrate.
The perf event list head is assigned via a per CPU pointer. It is
done before the user space part is called. If the user space reading
migrates the task to another CPU, then the head pointer is no longer
valid.
Re-assign the head pointer after the reading of user space to keep it
using the correct data.
* tag 'trace-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
tracing: perf: Fix stale head for perf syscall tracing
ftrace: Add global mutex to serialize trace_parser access
tracing: Delay module ref count for "enable_event" trigger
tracing: Fix use-after-free freeing trigger private data
tracing: Fix context switch counter truncation
selftests/ftrace: Reset triggers at top level before instance loop
tracing: Fix union collision of module and refcnt for dynamic events
tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev
tracing: Fix resource leak on mmiotrace trace_pipe close
tracing: Propagate errors from remote event bulk updates
tracing/remotes: Fix page_va[] access before counter update in trace_remote_alloc_buffer()
a bit more widely, because newer versions of LLVM started
optimizing it a bit better and introduced run-time relocations
in PIE code. (Nathan Chancellor)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmpl0uARHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1hmpxAAltRv2TwPA4MeZt10iYTG4BdwMp4OleR4
hDxqYL9T1OJev4wLujlri3/Vb1MVKG1S3YQjeG6hWAB0L+//hbx2e/nEU24uW5xb
j+0kAWSSZPUIP3KRc5Cy4mb1EXiumjk3GHnwXZpRV5XA4RRoTmpexd09J5v5KNvt
/q/c8ZzVMB8p8S1K98BdL/wMAyEHLg+iSywTdNsa8Zyw8qB8qAlRgLHTlhYjkcnO
E1+g3MY7QDEjMYDgHAMP1GHvtXTktXfp2Neo4s0WLmY/C6LEyWE/+HIDrMVuzjat
AU5IWbE0tDxGYdeyVvVoxRafFWmVg7mfnazkORp6iojbfJeVBB+IkNAVX0fbKEBT
Yx6Gcm/x0Xb2pf8zaUWE2q02Sz4WYpWrkcLZrLIVnCphyAK7K7V+I7ZkFP1reQR9
fr9RIsKC+6K5mWivFpOjkEzYp+D9Yp2OJyAgK0oE7F7Zd6u0+qpCWaM+VPHsYp41
wsVGTPgD5JP871o6ln38YskBct70E3BnzO5p10a5PbyRaaBCSBZC1XGCglIs7PS9
TmsZOI4Wc8dHzobUTXNdgOymfqXV/bQEITL8qRt9Ge2GUiUROFLp8IVzmJIADWKv
oqtoNo/vjthpFTXVZ3c4beACEaNu71bDbLjwjOdIb2W8NPY+Z+WeSkHDcg5Gt7qN
2cYWBUyhc3o=
=3e+9
-----END PGP SIGNATURE-----
Merge tag 'x86-urgent-2026-07-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fix from Ingo Molnar:
- Disable jump/lookup tables in the x86 boot decompressor code
a bit more widely, because newer versions of LLVM started
optimizing it a bit better and introduced run-time relocations
in PIE code (Nathan Chancellor)
* tag 'x86-urgent-2026-07-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/boot/compressed: Disable jump tables
do_thaw_all_callback() calls bdev_thaw() while holding sb->s_umount
exclusively. If the block device was frozen via bdev_freeze() dropping
the last block layer freeze reference calls fs_bdev_thaw() which
reacquires s_umount:
do_thaw_all_callback(sb)
super_lock_excl(sb) # holds sb->s_umount
bdev_thaw(sb->s_bdev)
mutex_lock(&bdev->bd_fsfreeze_mutex)
# bd_fsfreeze_count drops 1 -> 0
bd_holder_ops->thaw == fs_bdev_thaw
get_bdev_super(bdev)
bdev_super_lock(bdev, true)
super_lock(sb, true)
down_write(&sb->s_umount) # same task: deadlock
The emergency thaw worker deadlocks against itself holding both
s_umount and bd_fsfreeze_mutex. That fscks any subsequent unmount,
freeze, or thaw of that filesystem and block device.
[ 81.878470] sysrq: Show Blocked State
[ 81.880140] task:kworker/0:1 state:D stack:0 pid:11 tgid:11 ppid:2 task_flags:0x4208060 flags:0x00080000
[ 81.884876] Workqueue: events do_thaw_all
[ 81.886656] Call Trace:
[ 81.887759] <TASK>
[ 81.888763] __schedule+0x579/0x1420
[ 81.890372] schedule+0x3a/0x100
[ 81.891794] schedule_preempt_disabled+0x15/0x30
[ 81.893848] rwsem_down_write_slowpath+0x1ea/0x900
[ 81.895191] ? __pfx_do_thaw_all_callback+0x10/0x10
[ 81.896528] down_write+0xbd/0xc0
[ 81.897505] super_lock+0x91/0x180
[ 81.898457] ? __mutex_lock+0xa99/0x1140
[ 81.900748] ? __mutex_unlock_slowpath+0x1f/0x400
[ 81.902069] bdev_super_lock+0x5b/0x150
[ 81.903132] get_bdev_super+0x10/0x60
[ 81.904042] fs_bdev_thaw+0x23/0xf0
[ 81.904755] bdev_thaw+0x82/0x100
[ 81.905484] do_thaw_all_callback+0x2c/0x50
[ 81.906298] __iterate_supers+0x5d/0x130
[ 81.907067] do_thaw_all+0x20/0x40
[ 81.907739] process_one_work+0x206/0x5e0
[ 81.908545] worker_thread+0x1e2/0x3c0
[ 81.909339] ? __pfx_worker_thread+0x10/0x10
[ 81.910171] kthread+0xf4/0x130
[ 81.910799] ? __pfx_kthread+0x10/0x10
[ 81.911528] ret_from_fork+0x2e2/0x3b0
[ 81.912259] ? __pfx_kthread+0x10/0x10
[ 81.913010] ret_from_fork_asm+0x1a/0x30
[ 81.913806] </TASK>
bdev_super_lock() even documents the violated requirement with
lockdep_assert_not_held(&sb->s_umount).
Acquiring bd_fsfreeze_mutex under s_umount also inverts the
bd_fsfreeze_mutex vs. s_umount ordering established by
bdev_{freeze,thaw}() and can thus ABBA against a concurrent block-layer
freeze even when the recursive path isn't hit.
Fix this by not holding s_umount around the bdev_thaw() loop at all. Pin
the superblock with an active reference instead as
filesystems_freeze_callback() does. The active reference keeps the
superblock from being shut down and so ->s_bdev stays valid without
holding s_umount. The block-layer-held freeze is dropped by
fs_bdev_thaw() with FREEZE_MAY_NEST | FREEZE_HOLDER_USERSPACE exactly as
a regular unfreeze would and thaw_super_locked() handles
filesystem-level freezes as before.
The emergency thaw path has deadlocked like this in one form or
another for a long long time but the current exclusively-held
shape dates back to commit [1] where thaw_bdev() already ended in
thaw_super() with s_umount held by do_thaw_all_callback().
Fixes: 08fdc8a013 ("buffer.c: call thaw_super during emergency thaw") [1]
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260723-work-super-emergency_thaw-v1-1-7c315c600245@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Toolchain and infrastructure:
- 'zerocopy' crates: update to v0.8.54 to fix a modpost error under
'CONFIG_CC_OPTIMIZE_FOR_SIZE=y'.
There are actually two updates in the PR: the one to v0.8.52 is
fairly large and was originally not intended for a fixes PR, but the
actual fix landed in the v0.8.54 one. Thus I included both here.
The v0.8.52 update includes two things upstream added for us:
'--cfg no_fp_fmt_parse' to avoid a local workaround, and the new
'most_traits' feature.
The good news is that, after these updates, the delta with upstream
is now trivial: only an identifier prefix change and the SPDX
parentheses.
- Fix an objtool warning by adding one more 'noreturn' function for
Rust 1.99.0 (expected 2026-10-01).
- Clean up new 'semicolon_in_expressions_from_macros' lint errors for
Rust 1.99.0 (expected 2026-10-01). The lint can be allowed, but it
will be a hard error at some point in the future anyway, so clean it
up now.
- Locally allow new 'suspicious_runtime_symbol_definitions' lint for
Rust 1.98.0 (expected 2026-08-20).
- Globally allow 'clippy::unwrap_or_default' lint since it relies on
optimizations -- under 'CONFIG_CC_OPTIMIZE_FOR_SIZE=y' it does not
work well.
'kernel' crate:
- 'time' module: fix 'Delta::as_micros_ceil()' to round negative values
correctly.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEPjU5OPd5QIZ9jqqOGXyLc2htIW0FAmpk6V4ACgkQGXyLc2ht
IW24OQ/7B2pQtg8IE/6fvkPO7I+EPGknkiutPczrh0HFJ2x0rSaC69NVjkV3d5nq
KWk1zOPPzxMoOeIEOR/e8iAMfo9B093mlohappwMKLZGju2x+K6JA+rn6HsvTLiv
fGgjM7hq3B7ExBCon7qDQLYh6cib9T90e9IJrE8rnitbJ8QkUSqXTwCqUbkN7pOt
U5GUX9yHxo9slc9XYy3AC8aifqaBNeUWzfn6a7DN7nLUNhm5AYiYyduvU6QZQ1kR
ezinZn3Jqv+VrpXcuM2x2iMMJCdFILzXdnrhPWoT8whc9GzNWVArkSIYFefvjgvK
Yb+gppVjEuKwsT81eoMwD9edD+wL/4MSU6lnW4eN0EhgECSy7HZs2Jjv1UIrPPSH
ZvVp6Bzn0nuXed4fh+mrqvwmltqnDpVK06c/q6M8u5mQ/HURwCsh43M7X7S4Sm0p
X8AutCjsWj+uP44ZnC/Y5p/r3tFl+HM55YT/favb54Xzq+SDrMtSQ7HFM7CZaDHd
g1B/SBlCTs1O1htqNDWqzew8HdoLfRueZf9tRnTCYSlvOgjSgBB9561m2wfgVE86
yrwPnaYZeipny2hVh+iCiZGDvrqKh+r4nMB8R8X61qjWC7/szjsxs3IiCUpPpMJB
3omYUm3nOxzZjYp9uK0E+YW+BITjC8VrP6XWUnzedfas1bds63k=
=4BpZ
-----END PGP SIGNATURE-----
Merge tag 'rust-fixes-7.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux
Pull rust fixes from Miguel Ojeda:
"Toolchain and infrastructure:
- 'zerocopy' crates: update to v0.8.54 to fix a modpost error under
'CONFIG_CC_OPTIMIZE_FOR_SIZE=y'.
There are actually two updates in the PR: the one to v0.8.52 is
fairly large and was originally not intended for a fixes PR, but the
actual fix landed in the v0.8.54 one. Thus I included both here.
The v0.8.52 update includes two things upstream added for us:
'--cfg no_fp_fmt_parse' to avoid a local workaround, and the new
'most_traits' feature.
The good news is that, after these updates, the delta with upstream
is now trivial: only an identifier prefix change and the SPDX
parentheses.
- Fix an objtool warning by adding one more 'noreturn' function for
Rust 1.99.0 (expected 2026-10-01).
- Clean up new 'semicolon_in_expressions_from_macros' lint errors for
Rust 1.99.0 (expected 2026-10-01). The lint can be allowed, but it
will be a hard error at some point in the future anyway, so clean it
up now.
- Locally allow new 'suspicious_runtime_symbol_definitions' lint for
Rust 1.98.0 (expected 2026-08-20).
- Globally allow 'clippy::unwrap_or_default' lint since it relies on
optimizations -- under 'CONFIG_CC_OPTIMIZE_FOR_SIZE=y' it does not
work well.
'kernel' crate:
- 'time' module: fix 'Delta::as_micros_ceil()' to round negative values
correctly"
* tag 'rust-fixes-7.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:
rust: time: fix as_micros_ceil() to round correctly for negative Delta
rust: device: avoid trailing ; in printing macros
objtool/rust: add one more `noreturn` Rust function for Rust 1.99.0
rust: zerocopy: update to v0.8.54
rust: zerocopy: update to v0.8.52
rust: allow `clippy::unwrap_or_default` globally
rust: allow `suspicious_runtime_symbol_definitions` lint for Rust >= 1.98
- Update header copies of kernel headers, including const.h, fs.h,
perf_event.h, gfp_types.h, kvm.h, cpufeatures.h, rtnetlink.hp,
msr-index.h, drm.h and socket.h.
- Add some build files related to BPF skels to .gitignore.
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQR2GiIUctdOfX2qHhGyPKLppCJ+JwUCamSrfQAKCRCyPKLppCJ+
J41WAQCqkEX7tpYp9F1f/lhzLjeeBc1dcvddAgrlzr/79E0Y8AD8ChH8SMc95ERH
rOrpIKhflMUQw5EazDW/AczabIZfcQs=
=2+4S
-----END PGP SIGNATURE-----
Merge tag 'perf-tools-fixes-for-v7.2-1-2026-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools
Pull perf tools fixes from Arnaldo Carvalho de Melo:
- Update header copies of kernel headers, including const.h, fs.h,
perf_event.h, gfp_types.h, kvm.h, cpufeatures.h, rtnetlink.hp,
msr-index.h, drm.h and socket.h
- Add some build files related to BPF skels to .gitignore
* tag 'perf-tools-fixes-for-v7.2-1-2026-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools:
tools headers: Sync KVM headers with the kernel sources
tools headers: Sync UAPI linux/fs.h with the kernel sources
perf beauty: Update copy of linux/socket.h with the kernel sources
tools headers: Sync UAPI drm/drm.h with kernel sources
tools arch x86: Sync the msr-index.h copy with the kernel sources
tools headers x86 cpufeatures: Sync with the kernel sources
tools headers: Sync linux/gfp_types.h with the kernel sources
tools headers UAPI: Sync linux/rtnetlink.h with the kernel sources
tools headers UAPI: Sync linux/const.h with the kernel sources
perf bench bpf: Add missing .gitignore file
Fix a bug in unit driver for RFC 2734 IPv4 over IEEE 1394. The driver
failed to reassemble a complete datagram when it was stored across
multiple buffer ranges in the list. Ruoyu Wang reported and fixed it.
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQQE66IEYNDXNBPeGKSsLtaWM8LwEwUCamSU6gAKCRCsLtaWM8Lw
E/B8AQDAi36W7MJ/y+pcbYA0BQHE/hsr/BbVsx3LmuR2WrHKFwD/WXat4OwVtdVc
ZkrO1gwRE263p3UGpqFEftZdS976xgw=
=z/i1
-----END PGP SIGNATURE-----
Merge tag 'firewire-fixes-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394
Pull firewire fix from Takashi Sakamoto:
"Fix a bug in unit driver for RFC 2734 IPv4 over IEEE 1394.
The driver failed to reassemble a complete datagram when it was stored
across multiple buffer ranges in the list. Ruoyu Wang reported and
fixed it"
* tag 'firewire-fixes-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394:
firewire: net: Fix fragmented datagram reassembly
-----BEGIN PGP SIGNATURE-----
iQJKBAABCAA0FiEEzOlt8mkP+tbeiYy5AoYrw/LiJnoFAmpjKJIWHGNoZW5odWFj
YWlAa2VybmVsLm9yZwAKCRAChivD8uImeulhD/9Oe/6FLvyuK4KYi+0DyacU4FZ4
NQjgFa3g2CBY+qiS6qSjzygbClFLZjkhbXsOaQekQjiYWNCKwTCJGg0m/y+qNS+S
F1UWxuZxVor1ty4y6KSldCHtdI5ROSXf2Iq3UNw2JX2W8LK0r/asLvFpkIHGcDdJ
kqMnD4aktxgs+RYZVs9rQrS0cR8mQom6KVu39/4KB/6QulEMEaH857txobexlaTo
7Jo/I3fcsxbcWxo+I6yZSdSkIBRI5H6eywbHgF0ug7cOmpQL70IGIx0S42XK7RUy
A/A7BrPN1JMFTloDSHTX6b05lCh4UEhLBbFgX3ztVCNXt0j5v7/y5dqISwn4qlDP
LkPEx/LQ1GsHQu9pqDN3gpD/G/RK+DvpA4p6+GpDrrQ7PQFMIKuzcil7LeZZ0C7H
VNbt7QP+HgPHezNroOMp16/PeEBLp2tkO1bqjCf/gRc47OPqLQtOiPJOK0B9yFzw
x4J8SRwxjqrg/TYYfP5lOhqafF0cp7ZE7LSlCMwylnZ6EYHaeEJh14ii5u36XJuj
ohu83vsobIRa9fJ7StQ8Hf6nJSGSoWpkn6WIAxiL/+Ksz4gzfe+5TNEoBg1cGqjX
XBS/qVj0ju06QVrg4H8X9gKEt7LQN+nIXBCg/OXSD75pdM/wlO08PANygU4FXUbE
/Q3RTJykzBT4P1TETg==
=BlSV
-----END PGP SIGNATURE-----
Merge tag 'loongarch-fixes-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson
Pull LoongArch fixes from Huacai Chen:
- fix build warnings and errors
- move jump_label_init() before parse_early_param()
- retrieve CPU package ID from PPTT when available
- fix some bugs kgdb, BPF JIT and laptop platform driver bugs
* tag 'loongarch-fixes-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson:
platform/loongarch: laptop: Explicitly reset bl_powered state when suspend
platform/loongarch: laptop: Stop setting acpi_device_class()
LoongArch: BPF: Fix memory leak in bpf_jit_free()
LoongArch: BPF: Zero-extend signed ALU32 div/mod results
LoongArch: Fix oops during single-step debugging
LoongArch: Fix address space mismatch in kexec command line lookup
LoongArch: Retrieve CPU package ID from PPTT when available
LoongArch: Move jump_label_init() before parse_early_param()
LoongArch: Fix build errors due to wrong instructions for 32BIT
LoongArch: Increase TASK_STRUCT_OFFSET up to 2040 for 32BIT
-----BEGIN PGP SIGNATURE-----
iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmpkDdwQHGF4Ym9lQGtl
cm5lbC5kawAKCRD301j7KXHgpjDzEACEBgNkSx8wWKnDR1/nqa0TWR2PkHbb2QLp
5vf2NW6K+vgA1d0jF0UI+PCxoN9zc7fIqWpfyssNJtRAZkyfyclcPsh573uoJQ5V
yOSKtUF5ARedyZdMzTUgKqfi2R4PKBvbyD2TEirsDk1iirK7n8EFHy9soORdEgl3
6qmFOWtKk/XCIOauIYoHDU3mlsSbukEGtoHEoucwgQQrzT7PvE/4vM7G1n4DXULE
NwSUpYjjRpyaTVc47vihhK7dpwXayJ5um8IqTWFLGmREr7LCaf1ZjT3lZtWYnoDF
FOG2w1EhcGByvNDz0vKL1sywfjBVPAAjYYaFpbfjwEuwNC6GUQUQ6AEQFpqoNIQ5
Xt1ujXFiySXwjJNtdhzFI8cs5ZSDQVCx4VdJ/3r2fyPJemFyBt7pUiJz0hmmnTH2
jO4ikNjRRWom7aAYC7sSM32OoIZLgDa572KD0uMOLXEP4seouq/SS+V9eMQE7ay3
nl9Bp2kGV7SvubRxENAYyStalNl4ekSXk7YHYZNBzj8GaVPiTC98j5p1zqXrbDLn
Ovts0SdbENvz0jFOisYlx3GA7Nlud5oV+iMvxgVuHD7urkljY3INHsqpSEgP8K6e
7ggwocJV+gE277aS7mmdPJ3ZYsPS0mf7vhx3vq9anNhKcuamFiKaymqTGcxerjmC
oqtrmld3NA==
=m0rQ
-----END PGP SIGNATURE-----
Merge tag 'block-7.2-20260724' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull block fixes from Jens Axboe:
- Fix a ublk recovery hang, where END_USER_RECOVERY without a
successful START_USER_RECOVERY could be satisfied by a stale
completion latch
- Fix a stack out-of-bounds read in the CDROMVOLCTRL ioctl
- MAINTAINERS email address update for Roger Pau Monne
* tag 'block-7.2-20260724' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
MAINTAINERS: update my email address
cdrom: fix stack out-of-bounds read in CDROMVOLCTRL
ublk: wait on ublk_dev_ready() instead of ub->completion
-----BEGIN PGP SIGNATURE-----
iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmpkDfYQHGF4Ym9lQGtl
cm5lbC5kawAKCRD301j7KXHgpgJgEACAoCs3hC/reUovTYQB8+68AyyBmF5xeJMI
uxYKcVEZGjOo6gTjSm2GYEBa6P85kQtbWEKEfuxXxV2gT1S/3yulV+uy8NfI/lO7
NsKYRHszaa/AFr2RbeZeYLU9TN/qFbZinfxukpW1zWrfwg83IhGGe6QN53G1XB2v
+pO0bqSZ/qKkJ4IXGubLxSxUnDWg6bav4XUeEkjSlE6mzp1+BgpesLLOsZNvvLST
5QTGt5EfWFBgo9LdYHz/ky7MnJjkioFDY+c10sLp2+6ghtyMTZcACB1W4gSSyJG+
QsLYJ6Z25f7zo7WIci42pCDDDhYWQgDFc7r9+uJ1ISFKXLGnEyONnBaxmk2LTWdX
g9V03+pI17vTOQNU0XlkpajUykOmMCkhZWA8jwlOAFJXtz+pdV1vSKeSZt9tEB4j
aEd6IjoBUrPLsv7WIlomf/h9quHfdjMogA6eyaXc4227XzKWo63XlGe4HxBC6yQQ
4Lq8QH8dta6BOm+5APQXNQ5g/EB0OVLDkgh8EzSTDChgoJd4hVwoHnGbGidZSAcR
mgSl4SG/XdXMIwhqAH5iiI+7YZ71ALnoRkLujED90c+lGHrrY0T7H99XaHprp6xa
NOUbz5CAZf+bWPfXbLpJG+QTh/evh9zxfJ30VprHByl99EJFxjK7rW3BJvOAokjs
1O635JJo7A==
=pQDU
-----END PGP SIGNATURE-----
Merge tag 'io_uring-7.2-20260724' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull io_uring fixes from Jens Axboe:
- Fix a missing ERESTARTSYS conversion in the read paths, which got
messed up back when some code consolidation was done for read
multishot support
- zcrx UAPI rename, dropping the abbreviated "notif" naming in favor of
"event" for consistency and to be less ambiguous for users. This was
added for 7.2, so let's rename it while we still can. No functional
or code changes, just a strict rename
* tag 'io_uring-7.2-20260724' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
io_uring/zcrx: rename notif to event
io_uring/zcrx: rename ZCRX_NOTIF_NO_BUFFERS
io_uring/zcrx: drop "notif" from stats struct names
io_uring/rw: fix missing ERESTARTSYS conversion in read paths
In ftrace, the trace_parser structure is allocated and initialized when
a trace file is opened, and is subsequently used across write and release
handlers to parse user input.
The affected handler paths and their specific functions are:
- Open paths: ftrace_regex_open(), ftrace_graph_open()
- Write paths: ftrace_regex_write(), ftrace_graph_write()
- Release paths: ftrace_regex_release(), ftrace_graph_release()
If userspace opens a trace file descriptor and shares it across multiple
threads, concurrent write calls will race on the parser's internal state,
specifically the 'idx', 'cont', and 'buffer' fields, leading to corrupted
input or undefined behavior.
Fix this by adding a global mutex, parser_lock, to serialize all access
to trace_parser across write and release paths, preventing concurrent
corruption of parser state.
Fixes: e704eff3ff ("ftrace: Have set_graph_function handle multiple functions in one write")
Fixes: 689fd8b65d ("tracing: trace parser support for function and graph")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260725024721.1983675-1-wutengda@huaweicloud.com
Signed-off-by: Tengda Wu <wutengda@huaweicloud.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
- Fix tcp_bpf_sendmsg() error path mistaking a concurrently-freed
sk_psock->cork for the local temporary message and freeing it
again. (Chengfeng Ye)
- Reject passing scalar NULL to nonnull arg of a global subprog.
Previously the verifier did not account for the cases directly
passing scalars to a global subprog, e.g.: 'global_func(0);'
would pass even if 'global_func' argument was marked nonnull.
(Amery Hung)
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQRINyQBqoQUC24dy5htleuBPyPTXgUCamPsBwAKCRBtleuBPyPT
Xo/uAP0YR6/9em1W/sZnss6Wkwfwd9NdmmlrJqSlt7aq+A+W7AD/V5HbigM4pJ76
CZFkKvnzhhU3dSXm/dBT1/GGJbL4pwo=
=uzKM
-----END PGP SIGNATURE-----
Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf
Pull bpf fixes from Eduard Zingerman:
- Fix tcp_bpf_sendmsg() error path mistaking a concurrently-freed
sk_psock->cork for the local temporary message and freeing it again
(Chengfeng Ye)
- Reject passing scalar NULL to nonnull arg of a global subprog.
Previously the verifier did not account for the cases directly
passing scalars to a global subprog, e.g.: 'global_func(0);' would
pass even if 'global_func' argument was marked nonnull (Amery Hung)
* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()
selftests/bpf: Test passing scalar NULL to nonnull global subprog
bpf: Reject passing scalar NULL to nonnull arg of a global subprog
