bnxt_request_irq() has unnecessary level of indentation.
Use continue instead. No need to re-fetch NUMA node for
each IRQ, move to the function level.
No functional changes.
Reviewed-by: Breno Leitao <leitao@debian.org>
Link: https://patch.msgid.link/20260803193135.2030368-4-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
The TPH support must have broken aRFS in bnxt. IRQ can only have one
notifier, so installing the TPH notifier is overriding the one implicitly
installed by irq_cpu_rmap_add().
Make sure we call cpu_rmap_update() from the TPH notifier.
We need to be careful with the ordering and not free the rmap
until we unregistered the notifier. Note that moving the rmap
freeing after the early return in bnxt_free_irq() is fine -
there's no path that could leave rmap with irq_tbl being NULL.
Fixes: c214410c47 ("bnxt_en: Add TPH support in BNXT driver")
Reviewed-by: Michael Chan <michael.chan@broadcom.com>
Link: https://patch.msgid.link/20260803193135.2030368-3-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
bnxt_irq_affinity_notify() copies into irq->cpu_mask.
Cancel the notifier before freeing irq->cpu_mask.
Fixes: c214410c47 ("bnxt_en: Add TPH support in BNXT driver")
Reviewed-by: Michael Chan <michael.chan@broadcom.com>
Link: https://patch.msgid.link/20260803193135.2030368-2-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Fix the Eliza display clock controller to avoid RCG stall. Revert the
rework of the "PHY mux" clock, as this broke PCIe on several different
targets.
Drop (and correct one) bouncing maintainer email addresses in DeviceTree
bindings.
-----BEGIN PGP SIGNATURE-----
iQJCBAABCgAsFiEEBd4DzF816k8JZtUlCx85Pw2ZrcUFAmpnlToOHGJqb3JuQGty
eW8uc2UACgkQCx85Pw2ZrcWNXg//RN1nAKFwKalihovDtpk6wlkxdUEJl53E1dcU
t5BWTTPWqlSmlc/FWvIqe7EccWRkm/3/rzt1KKaTw6mqupm2pmvtHa/A1dIfzNuw
EMwcFZQssb4m56rS+hO8fvGTxSE8MEd+gl4UXet+neXGvmM7mLu+LotMIH0EbELT
QZetojCYtZQVezkiNy/BKiXLCER/FnuQU0S37cpOR6bEWiS0rzptPKAFX3qgoKZ/
I1ff7iCJ5DJSkIYgAZhFXvMk4V6GGP+HXBp5LnWyzxTt+J5+YER+L5Zmv0po8NFh
NzFxfC9nH+kihD9716FouII64QbwbmKdTc0qS1tLhH9u5OQmhTZEQ283kadpZIdc
nwIglsdmibgFixRDM6sI7CR3aYuFZVbaMCMKWRC9aE7Vxpf0KuRzJnmqxCOwqa1u
5E6+Ps5wb93+mDtYAdx+qRXzLh8ZGUZksoVOE2gC6aZGFkDHEAkQewww6nEQ5ikT
9dZlgnesgMux78Yn1H+PhTFtNXgJXFjWGgBm2YgVXOCvDyXaTF6LE3wlpSIeo9SV
mGAExhPm0OrBmxyN15ynQhVXrn4cKv5sY3rBRKPWtVi3pzWmp1y7KVBf/AL6UONj
c6VmCq1hFBPrV6IUPM8kHJK50Ju+yIrcqS2P6quEaEIT8RKCyunvurwHHjhUz7Ya
uUM7ZxI=
=yj29
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQJIBAABCAAyFiEE9L57QeeUxqYDyoaDrQKIl8bklSUFAmp6GioUHHN3Ym95ZEBj
aHJvbWl1bS5vcmcACgkQrQKIl8bklSW9bA//SYbI1Mj6q2gMJyFZEL0Fz8P5pfWI
LAPPAFK+xhTQDl0POkv2/zzRYmXhuQFTD/v2asRmCyu/C9b+GMKVBTuAQWnybSy3
Mp6HjYRrAVpMbZE56lLGkgZXi6a3bZOh9K5m6wdd5frMQt131slBaiiK/U3ZyFKR
TQEIpNsbNa5mx614yCqobEDlGBIO0o4r2Z4iQD05ni2MH+ZYhVUKo+8gisEJledR
GK7ter1b04MCMaxLuW6GAj46DNUhXdXTaEunmgdimjhtSTCy09AulTZO477heQQj
PGXXxjuh7bxY0z8xorbWeqgz1nhr1L/nSDXPxTOyydBJ4FESqEtx8H4SaYiqdqxI
AGNMH7KQPPJTf9nB8lJWFW8tlUi71a/LlQHH8Gu55+N28nkTceQ02dR1eUSue43I
o2g6PMDUayX5SQRyQyEmO4Geusm5yENNHSxL7myDOsw3XIJbt9fjCTdulA50azK2
3QsFkXHy+fBOHxLa2njELKpga/AkUmmmfdj8u3nSe7z60Rjo0ZqUgPd61zO6HTf+
ncDjKlWHnihb7TnEQWyYSLZr9t/BOALDQXS8UFoxaNYu1ReNrV9OqxZFKN/igX77
HzYEmYURM5XeS3I/W8ignbxAXk6VBGvd91tv3By8o7fhlPfPQNCCcOJ9VvhdBkFb
Vrf6zvBdavldz3U=
=RZDP
-----END PGP SIGNATURE-----
Merge tag 'qcom-clk-fixes-for-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into clk-fixes
Pull Qualcomm clock driver fixes from Bjorn Andersson:
- Fix the Eliza display clock controller to avoid RCG stall.
Revert the rework of the "PHY mux" clock, as this broke PCIe
on several different targets
- Drop (and correct one) bouncing maintainer email addresses in
Qualcomm clk DeviceTree bindings
* tag 'qcom-clk-fixes-for-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux:
dt-bindings: clock: Replace bouncing emails
Revert "clk: qcom: regmap-phy-mux: Rework the implementation"
clk: qcom: dispcc-eliza: Fix disp_cc_mdss_mdp_clk_src RCG stall on Eliza EVK
For bitmap this change makes no difference, because destructors are
called synchronously.
List type however calls them via call_rcu() so accounting decrement can
happen after list_set_flush() set ext_size to 0.
'set->elements = 0' can be removed for the same reason in the list type
case, it calls 'set->elements--' for each element.
Fixes: 9e41f26a50 ("netfilter: ipset: Count non-static extension memory for userspace")
Suggested-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
If list_set_uadd() calls list_set_replace() to swap an expired entry,
the element count remains the same, therefore the increment must be elided.
Fixes: 702b71e7c6 ("netfilter: ipset: Add element count to all set types header")
Link: https://sashiko.dev/#/patchset/20260806101947.2802-1-fw%40strlen.de
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
nf_flow_table_iterate() only treats original-direction tuple nodes as
owning entries. Publishing the original node first lets GC observe and
free a flow while flow_offload_add() is still inserting the reply node.
Publish the reply node first and the original node last so GC never
sees a partially installed flow.
KASAN can trigger slab-use-after-free read and write reports in the
flowtable/rhashtable path (rht_deferred_worker, jhash, flow_offload_del,
flow_offload_lookup, etc.).
Fixes: ac2a66665e ("netfilter: add generic flow table infrastructure")
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Assisted-by: Codex:gpt-5
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
In nft_flow_rule_offload_abort(), WARN_ON_ONCE(err) is triggered on every
error during rollback, including -ENOMEM. Memory allocation failures are
expected under low-memory conditions and do not indicate a kernel bug.
Trace for example:
nft_flow_offload_chain() // FLOW_BLOCK_BIND
nft_flow_block_chain()
nft_chain_offload_cmd()
nft_block_offload_cmd()
->ndo_setup_tc()
nsim_setup_tc()
flow_block_cb_setup_simple()
flow_block_cb_alloc() // fails to -ENOMEM
The warning was reproduced on the 5.10 stable kernel under memory pressure
via fault injection, but the underlying bug exists in mainline as well,
as demonstrated by the ENOMEM trace above. The following splat was
triggered during nf_tables transaction processing:
WARNING: CPU: 0 PID: 8567 at net/netfilter/nf_tables_offload.c:532 nft_flow_rule_offload_abort net/netfilter/nf_tables_offload.c:532 [inline]
WARNING: CPU: 0 PID: 8567 at net/netfilter/nf_tables_offload.c:532 nft_flow_rule_offload_commit+0x971/0xcd0 net/netfilter/nf_tables_offload.c:591
Modules linked in:
CPU: 0 PID: 8567 Comm: syz-executor.0 Not tainted 5.10.260-syzkaller #0
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:nft_flow_rule_offload_abort net/netfilter/nf_tables_offload.c:532 [inline]
RIP: 0010:nft_flow_rule_offload_commit+0x971/0xcd0 net/netfilter/nf_tables_offload.c:591
Call Trace:
nf_tables_commit+0x3bd/0x4bd0 net/netfilter/nf_tables_api.c:8604
nfnetlink_rcv_batch+0xb1e/0x1f20 net/netfilter/nfnetlink.c:509
nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:579 [inline]
nfnetlink_rcv+0x3b3/0x420 net/netfilter/nfnetlink.c:597
netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
netlink_unicast+0x6cd/0xa00 net/netfilter/af_netlink.c:1340
netlink_sendmsg+0x906/0xe10 net/netfilter/af_netlink.c:1919
sock_sendmsg_nosec net/socket.c:651 [inline]
__sock_sendmsg+0x155/0x190 net/socket.c:663
____sys_sendmsg+0x705/0x870 net/socket.c:2379
___sys_sendmsg+0x100/0x170 net/socket.c:2433
__sys_sendmsg+0xe9/0x1c0 net/socket.c:2462
do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x67/0xd1
Change the condition to WARN_ON_ONCE(err && err != -ENOMEM) so that
warnings are only emitted for unexpected errors. This aligns with the
common kernel practice of not warning on -ENOMEM.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Fixes: 63b48c73ff ("netfilter: nf_tables_offload: undo updates if transaction fails")
Signed-off-by: Alexey Velichayshiy <a.velichayshiy@ispras.ru>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
While the outer IP header is already pulled into the skb head,
we must be careful and revalidate the embedded headers after
reading them from the skb frags to prevent out-of-bounds
access.
One such place reported by Sashiko is ip_vs_nat_icmp() where
local process can change the ihl field and after
skb_ensure_writable() we can see larger value which is a
problem for the ip_send_check(cih) calls.
Add check to drop the packet if the ihl field is changed.
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Link: https://sashiko.dev/#/patchset/20260730183506.87473-1-ja%40ssi.bg
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
ip_vs_in_icmp() rebases an skb from the outer ICMP packet to the
quoted original request before passing it to icmp_send(). However,
IPCB(skb)->opt still describes the outer IPv4 header.
A timestamp option in the outer header can therefore leave an offset
that points into the quoted transport header after the rebase.
__ip_options_echo() treats a byte at that stale location as the option
length and copies it into the fixed-size option storage on the
__icmp_send() stack, causing a stack out-of-bounds write.
Clear the stale option metadata after resetting the network header.
Keep the remaining control block fields, including the ingress
interface used by the ICMP response path.
Fixes: f2edb9f770 ("ipvs: implement passive PMTUD for IPIP packets")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6-sol Codex:gpt-5.5-cyber
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Co-developed-by: David Lee <david.lee@trailofbits.com>
Signed-off-by: David Lee <david.lee@trailofbits.com>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
sashiko reports: "nfnl_log_net_exit() calls nf_log_unset(), which
clears the logger pointer without an RCU grace period. Immediately after,
ops_free_list() frees the per-net state while concurrent packets might
still be executing nf_log_packet() under rcu_read_lock()."
Clear the pointer via .pre_exit to make sure rcu readers have completed
before pernet storage is free'd. The change in nf_log_syslog.c is only
done for consistency: it doesn't use pernet data.
Link: https://sashiko.dev/#/patchset/20260731151806.849724-1-pablo%40netfilter.org
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
TCP and SCTP conntrack paths can emit invalid-packet logs while ct->lock
is still held.
When invalid logging is routed to nfnetlink_log and conntrack export is
enabled, the log path can re-enter conntrack netlink glue and dump the
same conntrack again. Protocol attribute dumping may take ct->lock, so
logging while holding that lock can deadlock.
Defer the TCP invalid logs by storing only the minimal log context while
ct->lock is held and emitting the log after unlocking. Also make the TCP
timeout-lowering invalid path return whether a log is needed, then emit
that log after unlocking.
Do the same for the SCTP invalid state-transition log that can be reached
while ct->lock is held.
Add a lockdep assertion to nf_ct_l4proto_log_invalid() so future callers
that log invalid conntracks while holding ct->lock are caught outside TCP
and SCTP as well.
Fixes: 628d694344 ("netfilter: conntrack: reduce timeout when receiving out-of-window fin or rst")
Fixes: d9a6f0d0df ("netfilter: conntrack: prepare tcp_in_window for ternary return value")
Fixes: f71cb8f45d ("netfilter: conntrack: sctp: use nf log infrastructure for invalid packets")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Assisted-by: Codex:gpt-5.4
Signed-off-by: Zihan Xi <zihanx@nebusec.ai>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
IPVS configuration paths update destination availability while connection
accounting updates destination overload state. The two independent states
share dest->flags, so their read-modify-write updates can race and lose one
another.
Keep OVERLOAD in flags, where the preceding patch serializes its updates
with dst_lock, and move AVAILABLE to cflags. This keeps configuration-
controlled availability out of the scheduler hot cacheline until a
scheduler needs to check it. It also prevents availability updates from
clobbering overload state.
The destination status bits are not exposed through the IPVS sockopt or
netlink interfaces, so keep their definitions in the internal IPVS header.
Readers can still observe stale destination state; this does not provide a
cross-field snapshot.
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
Reported-by: Ao Wang <wangao@seu.edu.cn>
Reported-by: Xuewei Feng <fengxw06@126.com>
Reported-by: Qi Li <qli01@tsinghua.edu.cn>
Reported-by: Ke Xu <xuke@tsinghua.edu.cn>
Link: https://lore.kernel.org/all/8913381c-1e02-35c7-0ec4-61de5a12fd35@ssi.bg/
Assisted-by: Claude-Code:GLM-5.2
Suggested-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
The upper/lower connection thresholds for dest can be changed,
so use ip_vs_dest_update_overload() to properly update the
dest overload flag.
The thresholds were not limited, fit them in the 0 .. INT_MAX
range as already done in ipvsadm.
As the thresholds are also read when connections are created
and expired, use WRITE_ONCE/READ_ONCE to access them.
As the lower threshold is optional, use (u - (u >> 2)) to
calculate the 75% default value based on the upper threshold
by preserving the integer rounding, as suggested by Yizhou Zhao.
Trigger flag update when totalconns reaches one of the
thresholds and use dst_lock to serialize the updating.
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Replace the inactconns dest counter with totalconns, now
inactconns can be obtained from totalconns - activeconns.
This reduces the atomic inc/dec ops for TCP/SCTP from
6 to 4 if the connection is established and then closed.
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
A bridge nftables ct zone set rule can attach a conntrack template to
an skb before nf_ct_bridge_pre() sees it. For non-IPv4 and non-IPv6
EtherTypes, nf_ct_bridge_pre() currently overwrites skb->_nfct with
IP_CT_UNTRACKED without releasing the existing template reference.
That makes the per-cpu template, and any temporary templates allocated
for concurrent use, unreachable and leaks memory until the host runs out
of slab.
Reset the skb conntrack state before marking the frame untracked so the
existing template reference is dropped on the non-IP path.
Fixes: 3c171f496e ("netfilter: bridge: add connection tracking system")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
__ip_set_put_byindex() resolved the index to a set pointer under RCU,
then took ip_set_ref_lock in __ip_set_put() to decrement set->ref.
ip_set_swap() holds that same lock while swapping both the ip_set_list
slots and the two sets' ref counters, so it can interleave between the
dereference and the lock acquisition, leaving the caller to decrement a
set whose reference already moved to the other index and hit
BUG_ON(set->ref == 0). list_set_gc() reaches this from timer softirq,
which the nfnl mutex does not serialize against swap: an expiring
list:set member calls list_set_del() -> ip_set_put_byindex() while
IPSET_CMD_SWAP runs on the referenced sets.
Resolve the index and decrement under ip_set_ref_lock, as ip_set_swap()
already does, keeping the refcount tied to the index rather than to a
stale set pointer.
kernel BUG at net/netfilter/ipset/ip_set_core.c:685!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:ip_set_put_byindex (net/netfilter/ipset/ip_set_core.c:870)
Call Trace:
<IRQ>
list_set_del (net/netfilter/ipset/ip_set_list_set.c:159)
set_cleanup_entries (net/netfilter/ipset/ip_set_list_set.c:181)
list_set_gc (net/netfilter/ipset/ip_set_list_set.c:578)
call_timer_fn (kernel/time/timer.c:1748)
__run_timers (kernel/time/timer.c:1799 kernel/time/timer.c:2374)
run_timer_softirq (kernel/time/timer.c:2405)
</IRQ>
Kernel panic - not syncing: Fatal exception in interrupt
Fixes: 9076aea765 ("netfilter: ipset: Increase the number of maximal sets automatically")
Reported-by: AutonomousCodeSecurity@microsoft.com
Signed-off-by: Xiang Mei (Microsoft) <xmei5@asu.edu>
Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
These patches fix some issues which were noticed in some drivers where
caches were not fully resynced after suspend. Drivers are supposed to
be sorting the table of register defaults they provide to the core and
the core was relying on that but it turns out there are many cases where
this does not happen, it's easy to get wrong when using named defines
for registers rather than numbers. It is more robust to remove the
requirement for sorting and instead have the core ensure everything it
needs sorting is sorted so do that.
There will be patches during the merge window sorting the tables in
drivers since it is more efficient to do that but this will just be a
minor performance win rather than a correctness fix.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmp5yXcACgkQJNaLcl1U
h9AdhQf+OuDvmAGl6VpkbUBQqK/E9YO7mXqEOKGpbhi5e4CDUN+pY1HsMIgChMC7
e2gvLNwUY1zYUlon2RzXAYJ3fV/JmIZmz/8qp65VN2qljltAS+PT47qYpZb0WKKa
RAGdUOCthmaNwGou/ofO/MpAqRbgXY89H3AlBBRfR5jGsVJTqyvMsKVCR2h/X7SN
7rlEV6/a9gubTGrZEXaNEl6SvCsI1JmTidQHO4A9ROvo38alrYU4fMCgbSJ/W7cA
U5oBbO0qIixgR/xGNkMrLMKoIRfXElJ2he9idOQDcfbAMzlUeyZkj2xHqF9gHNRs
Zx/l0QrCagcLjUNVDMhpgE85Q+dfqQ==
=7QwV
-----END PGP SIGNATURE-----
Merge tag 'regmap-fix-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap
Pull regmap fixes from Mark Brown:
"These fix some issues which were noticed in some drivers where caches
were not fully resynced after suspend. Drivers are supposed to be
sorting the table of register defaults they provide to the core and
the core was relying on that but it turns out there are many cases
where this does not happen, it's easy to get wrong when using named
defines for registers rather than numbers. It is more robust to remove
the requirement for sorting and instead have the core ensure
everything it needs sorting is sorted so do that.
There will be patches during the merge window sorting the tables in
drivers since it is more efficient to do that but this will just be a
minor performance win rather than a correctness fix"
* tag 'regmap-fix-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
regcache: Sort the local copy of an unsorted reg_defaults array
regcache: Use a consistent sort for defaults table
- Fix lockdep warning regression in rhashtable.
- Fix default authsize in rfc4309.
- Fix gcm cryptlen calculation in tegra.
- Fix qce registration error-path bug.
- Fix incorrect use of sg_dma_len before mapping in starfive.
- Allow cbc(paes) to be used with af_alg.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEn51F/lCuNhUwmDeSxycdCkmxi6cFAmpsT0oACgkQxycdCkmx
i6daNA/+J02CNtbzTpBDOJX/mwY6W3QZFqslzoaywgterDAC72o3tkg9/bEtqbih
2y1UDh5RTzGoMdoB2BV9Fw8TbwSEFgzNIY7IBzvSxLu0Fu1CWvJmiJkFpY9waVBq
mj4iCe2U1i3QFXXBd61GDoS1WGMt2exm2QWSxn9tiADwz76w13+84mEH5i+1cn5S
Ufyz4312hZaeNBYsON2bQ4xeuMbZuxcyE+eIZQ849G2CvjMVbgrE+wNN77n2a6wo
UI+XHkT/XpiTCYkbFA5ATTWKn/fyEnGQ0IofqdGdj+75Ch1wrswXwb697WzMQwf5
VrxgWIFhHgzpUjJFlZNx6yd1zs978dyjw3VonILuBKUeris3yQhoYGQ1r89dshrD
2oL8SFjHR5iSjqtowthO02kWwl9w6U4LnNGNBsXyRz5aYJJtG9ctxchqcIZe8kA5
YQ2UnQHIfGAYIlSCcpijBGUGXCPJiDXo5ovt7PcNgtkB+/tedPhCWrznRio2ECD3
Ebi8d48fp3cx9eS5t4C91YP+wG9T7mEgICec6H9xMLhu3MPh0oyP/i2A1e64QPv8
VVzPbsJMvJRU5wa0/+FkJ922WLp9OkHfcGU8FUx49/zjkskMAhjTcuIEwlqOm7TI
tsa9AlM6PrNT122WauCvnxDQ4PglsKeuYnAEhqrsbmfpJumd9kM=
=rHls
-----END PGP SIGNATURE-----
Merge tag 'v7.2-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
Pull crypto fixes from Herbert Xu:
- Fix lockdep warning regression in rhashtable
- Fix default authsize in rfc4309
- Fix gcm cryptlen calculation in tegra
- Fix qce registration error-path bug
- Fix incorrect use of sg_dma_len before mapping in starfive
- Allow cbc(paes) to be used with af_alg
* tag 'v7.2-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
crypto: af_alg - Allow cbc(paes)
crypto: starfive - use scatterlist length before DMA mapping
crypto: qce - fix error path in devm_qce_register_algs
rhashtable: fix false-positive lockdep splat on rhltable destruction
crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req()
crypto: ccm - Set rfc4309 maxauthsize from child
rt1320_io_init() applies the vendor initialisation preset only when the
amplifier's SDCA function status has FUNCTION_NEEDS_INITIALIZATION set:
if ((amp_func_status & FUNCTION_NEEDS_INITIALIZATION)) {
Its two sibling drivers guard the same write differently, also running
the preset on the first hardware init:
rt712-sdca.c: if ((amp_func_status & FUNCTION_NEEDS_INITIALIZATION) ||
(!rt712->first_hw_init)) {
rt722-sdca.c: if ((amp_func_status & FUNCTION_NEEDS_INITIALIZATION) ||
(!rt722->first_hw_init)) {
On the Microsoft Surface Pro 11 (Intel) the RT1320 never sets that bit.
Its function status reads back 0x41 on every boot, cold or warm:
rt1320-sdca sdw:0:0:025d:1320:01: rt1320_io_init amp func_status=0x41
which is NEWLY_ATTACHED | FUNCTION_HAS_BEEN_RESET: the function reports
that it has been reset and does not consider itself in need of
initialisation. Bit 5 is never set, so the preset never runs,
rt1320_vc_preset() and the MCU patch load are skipped, and the amplifier
is left unprogrammed. rt712 and rt722 would have run it via their
first_hw_init fallback.
Add the same fallback. With it rt1320_vc_preset() executes and the
amplifier reports RT1320_KR0_INT_READY=0x1f where previously it did not.
Signed-off-by: Sergey Lebedev <lsa.uz@pm.me>
Link: https://patch.msgid.link/20260804225853.31585-2-lsa.uz@pm.me
Signed-off-by: Mark Brown <broonie@kernel.org>
The !CONFIG_NO_HZ_COMMON stubs use ktime_add(), ktime_get() and TICK_NSEC,
but tick.h includes neither <linux/ktime.h> nor <linux/jiffies.h>. Most
configurations build only because those declarations arrive transitively.
Commit 6440966067 ("cpuset: Remove cpuset_cpu_is_isolated()") removed
<linux/cpuset.h> from <linux/sched/isolation.h>. The <linux/cpuset.h>
include chain had been satisfying these declarations before <linux/tick.h>
was parsed. Commit 8aa76aa415 ("ring-buffer: Use a housekeeping CPU to
wake up waiters") then added <linux/sched/isolation.h> to ring_buffer.c
ahead of any header which provides them. Neither change is wrong on its
own: the failure requires both and appeared in v7.0.
ARM rpc_defconfig + CONFIG_FUNCTION_TRACER fails to build:
$ make ARCH=arm rpc_defconfig
$ ./scripts/config -e FTRACE -e FUNCTION_TRACER
$ make ARCH=arm olddefconfig
$ make ARCH=arm kernel/trace/ring_buffer.o
In file included from include/linux/sched/isolation.h:6,
from kernel/trace/ring_buffer.c:8:
include/linux/tick.h: In function 'tick_nohz_get_next_hrtimer':
include/linux/tick.h:156:9: error: implicit declaration of function
'ktime_add'; did you mean 'size_add'?
include/linux/tick.h:156:19: error: implicit declaration of function
'ktime_get'; did you mean 'time_init'?
include/linux/tick.h:156:32: error: 'TICK_NSEC' undeclared
Include the headers the file actually uses.
Fixes: 8aa76aa415 ("ring-buffer: Use a housekeeping CPU to wake up waiters")
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Assisted-by: Codex:gpt-5.6-sol
Link: https://patch.msgid.link/20260722062141.19671-1-kmehltretter@gmail.com
With the recently found INVLPGB / TLBSYNC issue, there has been some
interest in disabling INVLPGB-based TLB flushing, in order to rule out
that CPU issue as a cause of userspace crashes.
Add a kernel command line option to control the TLB flushing behavior.
If the need arises, we will add a "tlbi=broadcast" for the case when TLB
invalidation broadcasts need to be explicitly selected, but this is not
needed now yet.
[ bp: Rewrite commit message, move to cpu/common.c, add documentation. ]
Fixes: 767ae437a3 ("x86/mm: Add INVLPGB feature and Kconfig entry")
Suggested-by: Borislav Petkov <bp@alien8.de>
Signed-off-by: Rik van Riel <riel@surriel.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Cc: <stable@kernel.org>
Link: https://patch.msgid.link/20260729204341.3eb0b5ea@fangorn
Currently, scmi_pd_set_perf_state() treats a performance state of 0 as
invalid and returns -EINVAL. As a result, devices attached to SCMI
performance domains can report failures when relinquishing their
performance vote.
The OPP framework use performance state 0 to indicate that no performance
vote is required. For example, dev_pm_opp_set_rate(dev, 0) is commonly
used (by firmware or linux) when a device is runtime suspended.
A zero performance state does not require any SCMI performance request
to be sent. Treat it as a no-op and return success instead of reporting
an error.
Signed-off-by: Praveen Talari <praveen.talari@oss.qualcomm.com>
Fixes: 2af23ceb86 ("pmdomain: arm: Add the SCMI performance domain")
Cc: stable@vger.kernel.org
Signed-off-by: Ulf Hansson <ulfh@kernel.org>
The only initial jack detect is the rt5645_irq(0, rt5645) at the end of
rt5645_set_jack_detect(). A card described with simple-audio-card has no
machine driver to call that, so jack state is only ever sampled from an
edge on hp-detect-gpios.
A headphone already in the socket at boot is therefore never noticed, and
the card is silent with every mixer control set correctly.
rt5645_jack_detect() is what force enables the "LDO2" and "Mic Det Power"
supplies that the "HP amp" widget depends on, and what programs
RT5645_CHARGE_PUMP away from its reset value, so without it "HP amp"
cannot power up. Unplugging and replugging the jack is the only way to
recover.
Do the detect at the end of the component probe when the driver owns a
hp-detect GPIO and the codec's own jack detect is unused, which is the
case that has no other trigger. A machine driver calling
rt5645_set_jack_detect() later just repeats it.
Signed-off-by: Rudi Heitbaum <rudi@heitbaum.com>
Link: https://patch.msgid.link/anNU3tOUR7rOReSB@5e001e58230e
Signed-off-by: Mark Brown <broonie@kernel.org>
Added match table entry on nvl machines to support HDMI-In capture
with rt5682 I2S audio codec. also added the respective quirk
configuration in rt5682 machine driver.
Signed-off-by: Balamurugan C <balamurugan.c@intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://patch.msgid.link/20260806105742.2676322-3-yung-chuan.liao@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Adding HDMI-In capture via I2S feature support in NVL platform.
Signed-off-by: Balamurugan C <balamurugan.c@intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://patch.msgid.link/20260806105742.2676322-2-yung-chuan.liao@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
The HyperX OMEN Gaming Laptop 16-ap1xxx (HP board 8F06) has an
internal digital microphone array attached to the AMD ACP PDM
controller, but the acp6x machine driver does not register the DMIC
sound card because this board is missing from the DMI quirk table,
leaving the internal microphone unusable.
Add a DMI quirk entry for the HP board "8F06" so the acp6x DMIC
capture card gets registered.
Signed-off-by: Lin Xianglin <1021538027@qq.com>
Link: https://patch.msgid.link/tencent_428392223C2AD3BF23E7ABAA7521FE5C0C07@qq.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Remove invalid goto exit paths that jump across guard(mutex) cleanup
variable initialization, replace them with direct kfree(src) and return,
to fix the s390 clang build error in acoustic_ctl_write().
Fixes: d75d38dc46 ("ASoC: tas2781: Add a debugfs node for acoustic tuning")
Signed-off-by: Shenghao Ding <shenghao-ding@ti.com>
Link: https://patch.msgid.link/20260807000304.826-1-shenghao-ding@ti.com
Signed-off-by: Mark Brown <broonie@kernel.org>
The "trigger" debugfs file has a hand-rolled ->write handler
(trigger_write()) that dereferences the per-device gpio_la_poll_priv. The
file is created with debugfs_create_file_unsafe(), and the handler never
takes a debugfs reference. Nothing keeps the object alive while the
handler runs.
priv is allocated with devm_kzalloc(). devres frees it when the platform
device is unbound. debugfs_create_file_unsafe() installs no full_proxy
wrapper, so debugfs_remove_recursive() in gpio_la_poll_remove() does not
wait for an in-flight trigger_write(). The blob_lock taken there does not
help, because trigger_write() never takes it. A write that races an unbind
therefore writes into freed memory:
trigger_write() gpio_la_poll_remove()
priv = m->private
buf = memdup_user() [may sleep]
mutex_lock(&priv->blob_lock)
debugfs_remove_recursive() [no wait]
mutex_unlock(&priv->blob_lock)
(remove returns; devres frees priv)
priv->trig_data = buf <-- use-after-free write
priv->trig_len = count
The race is reachable by root via
/sys/bus/platform/drivers/gpio-sloppy-logic-analyzer/unbind.
Create "trigger" with debugfs_create_file() instead. Its full_proxy
wrapper makes debugfs_remove_recursive() drain any in-flight ->write
before it returns.
The use-after-free is confirmed under KASAN with a minimal reproducer of
the same debugfs_create_file_unsafe() plus devm_kzalloc() pattern
(available on request); it produces a slab-use-after-free write in the
handler.
Fixes: 7828b7bbbf ("gpio: add sloppy logic analyzer using polling")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4.8
Signed-off-by: Cengiz Can <cengiz.can@canonical.com>
Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Link: https://patch.msgid.link/20260730220258.358169-2-cengiz.can@canonical.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Suspend and resume hold channel 0's lock while saving and restoring
registers for all eight channels. Code paths using the other seven locks
can therefore run concurrently with PM.
Use one controller-wide lock shared by all channels.
Fixes: b490fa0bf8 ("gpio-ml-ioh: Fix suspend/resume issue")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Link: https://lore.kernel.org/r/20260731033956.EE6F61F000E9@smtp.kernel.org
Signed-off-by: Junjie Cao <junjie.cao@intel.com>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260804095935.2132215-1-junjie.cao@intel.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
ioh_irq_type() is registered as the irq_chip .irq_set_type callback and
takes chip->spinlock with spin_lock_irqsave(). This callback is reached
from __setup_irq() -> __irq_set_trigger() -> chip->irq_set_type() while
the caller holds desc->lock, a raw_spinlock_t, with hardirqs disabled.
That context is not sleepable, but on PREEMPT_RT a regular spinlock_t is
an rtmutex-backed sleeping lock, so acquiring it there is invalid.
ioh_irq_enable() and ioh_irq_disable() take the same lock from the
.irq_enable/.irq_disable callbacks, which are likewise invoked with
desc->lock held.
Convert the register lock to raw_spinlock_t. The same lock also
serializes the GPIO direction/value callbacks and the suspend/resume
register save/restore, and those critical sections only perform short
sequences of MMIO register accesses (ioread32()/iowrite32()); the
.irq_set_type callback additionally emits a dev_warn() on an unsupported
type. None of these are sleepable operations, so keeping this register
lock non-sleeping is appropriate for the irqchip callbacks and does not
change the GPIO-side locking contract.
This is the same fix as commit a02b8950d6 ("gpio: pch: use
raw_spinlock_t for the register lock"); this driver shares the same
structure as gpio-pch.
Fixes: 54be566317 ("gpio-ml-ioh: Support interrupt function")
Cc: stable@vger.kernel.org
Reviewed-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260731032747.2987292-1-junjie.cao@intel.com
Signed-off-by: Junjie Cao <junjie.cao@intel.com>
A helper function was copying a given audio infoframe into the
connector's copy but using the size of the destination (a generic
target, sized to accept many different data blocks) not the source (a
very specific type of data block). Thus, it was copying 60 bytes of
data from a 28 byte allocation.
Fix that by using the source size instead, together with a build bug
on the source size actually being smaller than the destination.
I hit this running KUnit tests under KASAN (while debugging something
else entirely). In the real world, it seems unlikely to cause an
actual problem. It is a read not a write so it can't corrupt any
memory. However, it could potentially fall off the end of a page and
cause an accvio bug.
Fixes: f378b77227 ("drm/connector: hdmi: Add Infoframes generation")
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Cc: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: David Airlie <airlied@gmail.com>
Cc: Simona Vetter <simona@ffwll.ch>
Cc: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Cc: Daniel Stone <daniel@fooishbar.org>
Cc: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
Cc: Jani Nikula <jani.nikula@intel.com>
Cc: José Expósito <jose.exposito89@gmail.com>
Cc: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Cc: dri-devel@lists.freedesktop.org
Cc: stable@vger.kernel.org # v6.11+
Signed-off-by: John Harrison <John.Harrison@Igalia.com>
Link: https://patch.msgid.link/20260723220652.533345-1-John.Harrison@Igalia.com
Signed-off-by: Maxime Ripard <mripard@kernel.org>
This contains a single fix adding an interrupt to the architected
timer's device tree node for the EL2 virtual timer. This prevents
a warning from the driver at boot time.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEiOrDCAFJzPfAjcif3SOs138+s6EFAmpvcnsACgkQ3SOs138+
s6H0mA/+PLBXfv6YDjYEOvAA/YnX7AqjtdogO6Xi1ghWDWtzt40ZgTYIiFlsYTbH
W3f/Pzf1wUS7wo4x6kDebPmRgxxrcHcs33AUXQj79GXVVyLVf5NWh8irDrzWCQLb
VTAtWCnR4PlSUMEDcSDpTqrwMQTy70aQ5A0AOFQSOmPtTsCmB7JW6WvY+iqHjt/m
bBuDe3aJ5lO5bVqJ8RwXnFmjq4ESWB+DKsveoMcrMvsGhXAuLOLZfuPqsxKZvF3Y
KIZJ4+zljZdXn7yQZhvqnUbLVYTispfftKHVKnrhcuk6FQBtUidgt7cXu5OyJBKH
BuskaDbI5U7+E6sgXpWjfAGnDC+wOglK8agDHZm3E6f2nVo9s3j/4WWdzWvAUWah
2KHWyKo+LH3TuYmxeUCx+UJhh7kBSWQA+yKQIDsEqZ93T3enMaXJmphDM3Z7p8eA
AMOQCr5jo0SVPZhgGvl2klCX2u7/HsemGnxuhdj7E6e8xyQwI0kIxmlq6NVIQILK
ysaAZIeLfbiTd/FKqwNXMr6ijJ9H+u0A7jaO2OPACOCs7gVGAjNNl0L+z4CZG/xb
jkq8k56fhKNw+t2YCYuSYszjBk19cfyilpR2EBNaFcRGp8GIqCYcfMieNhRgAs++
dCCic9080g+Zz/WFD2zw+hnYu2+0HSqtsamJxj9oYqj/5WjRHn4=
=GtgQ
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmp5gAQACgkQmmx57+YA
GNkfehAAk4obG7FUjOzL/dwLr0wegQfFlGY6BJ7CgJnmhXPcYSv/VVdjC+PIl/LG
2PSLPOFJRoaGKS1X6u60unMxLxxJSZE3y1raWaBKvOj/5NMtfsLNmCU2Vnrb0dXW
KG+jgG2z8Ll/+EAHrUa676/janG3PE94djx27jnDEIFWqpx0BDOHkCE7unLZBJtm
XD3POp6tsbGaIvwQUJT1V607RxBP4jd7MuPtxdCkKY5Q8jpVVC+4nT6qObX3Y/XG
8uL4RBtWXqq92WP7CkNcNh03WPOGOxu24Vcdyg6bZdyyWp8sop6A6RbX6EUZirTq
tyERUlREshjJvP0EhXiIhrtqrolSpf8q5yTsduX766J+REST7IeVpS3puyd493cc
ojYcYU3Lqs+IVBUw8dQzK9JzFkj/jPbK7aDRKmdfYsUvHDhIA+0uCr6STosiNF5C
LOnt5toOl1hqOrg4S+sECyYO7xU7VcSOhj2yrcVIEm0LtiVfLA09ZeC7zOZqCEFh
JVtyBdF5yghenZBfOnui8cXlV6BrHVo18uWSnRxwsnu33eaOANdj9agMZxqBts0x
v4GOaA+cmUTlIpivw52ii71wiKe9b8CdV3il9eGxoRFGqSZT7qkdXUeyYmaZ5can
r6ra7OPUU0cpJ4CP/szbcofvu2g0gBY+IP3BHpNCxP9wn8uIqe0=
=R3yw
-----END PGP SIGNATURE-----
Merge tag 'tegra-for-7.2-arm64-dt-fixes-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into arm/fixes
arm64: tegra: Device tree fixes for v7.2
This contains a single fix adding an interrupt to the architected
timer's device tree node for the EL2 virtual timer. This prevents
a warning from the driver at boot time.
* tag 'tegra-for-7.2-arm64-dt-fixes-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux:
arm64: tegra: Add EL2 virtual timer interrupt for Tegra194
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
__exit_to_user_mode_loop() invokes rseq_grant_timeslice_extension() with
interrupts enabled. If the extension is granted it invokes
hrtimer_rearm_deferred_tif() to ensure that a pending deferred hrtimer
rearm is handled before exiting to user space.
Though this invokes __hrtimer_rearm_deferred() which expects to be invoked
with interrupts disabled as it takes hrtimer_cpu_base::lock with
raw_spin_lock(). That's a livelock waiting to happen and caught by lockdep:
WARNING: ./include/linux/hrtimer_rearm.h:17 at irqentry_exit, CPU#1: slice_test
WARNING: inconsistent lock state
inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage.
Prevent this by disabling interrupts around the invocation of
hrtimer_rearm_deferred_tif() in rseq_grant_timeslice_extension().
[ tglx: Massaged change log ]
Fixes: 15dd3a9488 ("hrtimer: Push reprogramming timers into the interrupt return path")
Signed-off-by: Niels Pressel <npressel@ethz.ch>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260802124423.51616-1-npressel@ethz.ch
Christian Brauner <brauner@kernel.org> says:
fsopen() records the caller's user namespace in fc->user_ns and hands back
an ordinary file descriptor. The task that calls fsconfig(CMD_CREATE)
doesn't have to be the one that created the context, and mount_capable()
lets it through as long as the caller has CAP_SYS_ADMIN over fc->user_ns,
which anyone in an ancestor namespace does. So fc->user_ns !=
current_user_ns() is something an unprivileged user can arrange.
Both overlayfs and binfmt_misc WARN_ON() that. They're plain WARN_ON()s, so
it can be done in a loop to taint the kernel and flood the log, and it
panics a machine booted with panic_on_warn. Keep refusing the mount, just
stop warning about it. Overlayfs already spells the same check as a plain
error return in ovl_parse_param() for Opt_override_creds.
And add a selftest for both cases.
* patches from https://patch.msgid.link/20260802-work-fill_super-warn-v1-0-4e987911a39a@kernel.org:
selftests/filesystems: test completing a context from another user namespace
binfmt_misc: don't warn when the mount is completed from another user namespace
ovl: don't warn when the mount is completed from another user namespace
Link: https://patch.msgid.link/20260802-work-fill_super-warn-v1-0-4e987911a39a@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
fsopen() records the caller's user namespace in fc->user_ns and hands
back an ordinary file descriptor, so the task that issues
FSCONFIG_CMD_CREATE need not be the one that created the context.
mount_capable() authorizes that for a caller holding CAP_SYS_ADMIN in an
ancestor of fc->user_ns, which any unprivileged user has over a user
namespace it just created.
binfmt_misc and overlayfs used to WARN_ON() the mismatch. Add a test for
both. Also cover the handover within one user namespace. That is a
supported thing to do and has to keep working.
Link: https://patch.msgid.link/20260802-work-fill_super-warn-v1-3-4e987911a39a@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
fsopen() records the caller's user namespace in fc->user_ns and hands
back an ordinary file descriptor. Nothing ties the task that calls
fsconfig(FSCONFIG_CMD_CREATE) to the task that created the context. The
fd is inherited across fork() and exec() and it can be passed over a
unix socket.
Completing a context from another user namespace is allowed on purpose.
vfs_cmd_create() authorizes the create with mount_capable(), which for
FS_USERNS_MOUNT checks ns_capable(fc->user_ns, CAP_SYS_ADMIN), and that
succeeds for a task holding CAP_SYS_ADMIN in an ancestor of fc->user_ns.
So an unprivileged task can reach the WARN_ON() in bm_fill_super():
create a user and a mount namespace in a child, call
fsopen("binfmt_misc") there, send the fscontext fd to the parent and let
the parent issue FSCONFIG_CMD_CREATE. Both namespaces come from a plain
unshare(1) and no capability is needed anywhere:
WARNING: fs/binfmt_misc.c:938 at bm_fill_super+0xa2/0xc0 [binfmt_misc]
CPU: 15 UID: 1000 PID: 3243382 Comm: fswarn
Call Trace:
get_tree_keyed+0x7d/0xb0
bm_get_tree+0x34/0x90 [binfmt_misc]
vfs_get_tree+0x2a/0x100
vfs_cmd_create+0x60/0xf0
__do_sys_fsconfig+0x4b2/0x500
The child needs the mount namespace because fsopen() itself gates on
may_mount(), which asks for CAP_SYS_ADMIN in the user namespace owning
the caller's mount namespace. fsconfig() doesn't repeat that check.
It is a WARN_ON() and not a WARN_ON_ONCE(), so the condition can be
raised in a loop to taint the kernel and flood the log, and it panics a
kernel booted with panic_on_warn.
Keep refusing the mount and stop warning about it. Nothing in
bm_fill_super() depends on the two namespaces matching, it derives
everything from sb->s_user_ns.
Fixes: 21ca59b365 ("binfmt_misc: enable sandboxed mounts")
Cc: stable@vger.kernel.org # v6.7+
Link: https://patch.msgid.link/20260802-work-fill_super-warn-v1-2-4e987911a39a@kernel.org
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
fsopen() records the caller's user namespace in fc->user_ns and hands
back an ordinary file descriptor. Nothing ties the task that calls
fsconfig(FSCONFIG_CMD_CREATE) to the task that created the context. The
fd is inherited across fork() and exec() and it can be passed over a
unix socket.
Completing a context from another user namespace is allowed on purpose.
vfs_cmd_create() authorizes the create with mount_capable(), which for
FS_USERNS_MOUNT checks ns_capable(fc->user_ns, CAP_SYS_ADMIN), and that
succeeds for a task holding CAP_SYS_ADMIN in an ancestor of fc->user_ns.
So an unprivileged task can reach the WARN_ON() in ovl_fill_super():
create a user and a mount namespace in a child, call fsopen("overlay")
there, send the fscontext fd to the parent and let the parent issue
FSCONFIG_CMD_CREATE. Both namespaces come from a plain unshare(1) and no
capability is needed anywhere:
WARNING: fs/overlayfs/super.c:1551 at ovl_fill_super+0x7b9/0x1e20 [overlay]
CPU: 3 UID: 1000 PID: 3243376 Comm: fswarn
Call Trace:
get_tree_nodev+0x71/0xa0
ovl_get_tree+0x15/0x20 [overlay]
vfs_get_tree+0x2a/0x100
vfs_cmd_create+0x60/0xf0
__do_sys_fsconfig+0x4b2/0x500
The child needs the mount namespace because fsopen() itself gates on
may_mount(), which asks for CAP_SYS_ADMIN in the user namespace owning
the caller's mount namespace. fsconfig() doesn't repeat that check.
It is a WARN_ON() and not a WARN_ON_ONCE(), so the condition can be
raised in a loop to taint the kernel and flood the log, and it panics a
kernel booted with panic_on_warn.
Keep refusing the mount and stop warning about it. ovl_parse_param()
already spells a user namespace check this way for Opt_override_creds.
Fixes: 1784fbc2ed ("ovl: port to new mount api")
Cc: stable@vger.kernel.org # v6.5+
Link: https://patch.msgid.link/20260802-work-fill_super-warn-v1-1-4e987911a39a@kernel.org
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Just a single commit that fixes the i2c IRQ and MMIO ranges for the M3
SoC.
Signed-off-by: Sven Peter <sven@kernel.org>
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQS3vz815OHsEaWy0u9EEX0kKnUe6QUCanYCGgAKCRBEEX0kKnUe
6XCtAQCUJFZiqsus7g3hq7PpUyAmiEWfdOWrC5qnEqbhFiWdGAD+LWxX7b5bIq0M
es49MlApDpwzaFijCsz4KnNBsqjC1gk=
=CAwK
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmp5fEoACgkQmmx57+YA
GNlk4w/9HEYyM5nLoc5bMWNAdZDzfz8gTnxkSd7ZYhd4SWAdb1p0UlPk1rAyTS00
+piMiSOSZExH+8gq0+Gbr14Yj7GuXJ32etR+Kmreg+cRYf9TC1tu2DMFxt2IsADn
rObDHpkzNI3+9eMGQ50hLSo8vGDKmIeczSRy1MhCujYyjH1PLMMqXwZ8+20vWC/q
xL42k+MHHsYIBO6TuCx79uDfBBOG7yjjq55WXOGq+qTK28PP0fHXdOfo2Ds5Tp7o
NxhM5BTuwVutjGKcDj/nfRdU+kUDJVZZAXk7BoPZ14wk+7lAnqQpqM9d86dUKvHJ
meVm+ugtdMyPPeYCvMhDrC1dkXTgyRrkM1GMtXfR/ujR5yAgYQjJmHA2YRhwoLvg
dX142P8rdSEzexBxxSlxSRI2CtIqQp3oY9ew6XWu7PluNcVJi9jQpuxjoER7hTRZ
9MjusRYVoirm8h/jub9pZ4YlgCY37PjSslU6aQ5hkZgx9G1UND1hh4bDn/rnUT8m
fh96aoE7snbN259+ecYtylgOWSRKOeVn6FoeETCu74cDKNHH9C/WyjOU4c0earQn
CoOT1srhL506u3l4a1+b3CcCWB0XXuPxfQEaRnnj9kyrowNKXWKSEC5u1tEeupgN
0LJfNHbiBiyqveV3yPAysoaDm5uqV8EDL2Ymnfp9WGC2qYMAoXU=
=qGIT
-----END PGP SIGNATURE-----
Merge tag 'apple-soc-fixes-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux into arm/fixes
Apple SoC fixes for 7.2
Just a single commit that fixes the i2c IRQ and MMIO ranges for the M3
SoC.
Signed-off-by: Sven Peter <sven@kernel.org>
* tag 'apple-soc-fixes-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux:
arm64: dts: apple: t8122: Fix I2C resources
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Key slots are released through a kref and the existing release path
frees the AEAD transforms from an RCU callback. That is not safe for all
crypto implementations: crypto_free_aead can sleep, for example when an
async or hardware implementation has teardown work to complete.
Use queue_rcu_work for key-slot release. This keeps the RCU grace period
needed by lockless key-slot readers, but runs the actual crypto teardown
from workqueue context where sleeping is allowed. Once the rcu_work
callback runs, pre-existing RCU readers are gone, and the final kref put
already proves that no transform user remains, so the worker can release
the AEAD transforms and free the slot directly.
The previous patch drains ovpn_wq during module exit, so queued key-slot
teardown work cannot outlive module text.
Fixes: 8534731dbf ("ovpn: implement packet processing")
Signed-off-by: Ralf Lici <ralf@mandelbit.com>
Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
ovpn queues several work items whose callbacks execute module text.
These works currently run on the global system workqueues, so module
exit has no driver-owned drain point that guarantees the callbacks have
fully returned before the module text can be freed.
Object references protect the objects used by the callbacks, but they do
not prove that a workqueue function has returned. In particular, a
worker can drop the final reference that unblocks device teardown while
it is still executing ovpn code.
Add a module-owned workqueue and queue all ovpn work items on it. During
module exit, unregister rtnl and netlink first, flush the workqueue so
ordinary ovpn workers finish, run the final RCU barrier, and destroy the
workqueue last. This keeps the workqueue available for cleanup work
queued from RCU callbacks, while ensuring no ovpn work item can outlive
the module text.
The per-device delayed keepalive work remains explicitly disabled during
netdev teardown (disable_delayed_work_sync in ndo_uninit), since
flush_workqueue does not flush delayed work that is still only pending
on its timer.
Fixes: 3ecfd9349f ("ovpn: implement keepalive mechanism")
Fixes: 11851cbd60 ("ovpn: implement TCP transport")
Signed-off-by: Ralf Lici <ralf@mandelbit.com>
Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
- Fix use-after-free in eventfs_remove_rec()
The freeing of the eventfs_inode children used list_for_each_entry() where
the child is freed via srcu, but there's still a chance that it gets freed.
It should be using list_for_each_entry_safe().
- Fix eventfs_inode SRCU use of list in freeing
The iterator uses an SRCU protected list walk on the eventfs inodes. The
eventfs inode uses its "list" field in a union with the RCU list head.
When the inode gets added to the SRCU list it immediately corrupts the
list pointer and can cause an issue with the iterator. Move the RCU list
head to be shared with the children list head which allows the iterator to
check the parent inode if is freed before referencing the child. Have the
iterator check the parent "is_freed" field and break out if it is set.
Also add memory barriers to make sure the ordering is correct.
- Fix various RCU synchronization issues with direct_functions
Updates to direct_functions have some missing RCU protection and
synchronization. Restructure the code a bit to make sure updates to the
direct_functions are protected.
- Remove an unneeded comma from a scope_guard()
There's a spurious comma in a scope_guard(). Remove it.
- Fix race in per CPU buffer swap in the ring buffer
When a per CPU buffer swap happens, it must make sure that it doesn't
occur while a writer is active. Instead it returns an -EBUSY. But there's
a small race window when a writer moves from one sub-buffer to the next
that it resets the "committing" counter. If a swap happens at that moment,
the buffer used for the commit of an event will not match the buffer the
event is actually on. Instead of using the "committing" counter, use the
recursive detection counter that does not get reset when the writer
crosses sub-buffers.
- Fix off-by-one in ftrace_free_mem()
The function ftrace_free_mem() gets an "end_ptr" as a parameter that is
exclusive to the rang to be freed. But its value is used to search for the
records that expects an inclusive value. Subtract one from the parameter
to convert it to an inclusive range.
- Disable resizing of the ring buffer for persistent buffers
Resizing the persistent buffer has undefined behavior. Prevent it from
being resized.
- Disable changing ring buffer subbuf order when resizing is disabled
The ring buffer subbuffer order can not be changed during resizing. Use
that instead of just checking if the buffer is mapped as mapped buffers
also have resizing disabled.
- Initialize subbuf_order of reader pages when they are created
In rb_allocate_cpu_buffer() the bpage->order is not updated to the current
subbuf_order leaving it as zero. This value is used when the page is freed.
- Fix test_ringbuffer() to test for ERR_PTR before calling kthread_stop()
The rb_threads[] array is assigned the output of kthread_run_on_cpu()
which could return an ERR_PTR. At the end of the test, all threads in the
array are cleaned up by kthread_stop() passing in the value in the array
if it isn't zero. But if the array contains an ERR_PTR, kthread_stop()
will not be able to handle it properly.
-----BEGIN PGP SIGNATURE-----
iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCanicmBQccm9zdGVkdEBn
b29kbWlzLm9yZwAKCRAp5XQQmuv6quonAP9HgM214Bt43edhuJb3oFy9fdS+sqYZ
RIJ9q90iMDUH0AEAk3650lu7u80YniD4INKNrz5QMM2EbIMaNqtqwkS8uwQ=
=tZwi
-----END PGP SIGNATURE-----
Merge tag 'trace-v7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull tracing fixes from Steven Rostedt:
- Fix use-after-free in eventfs_remove_rec()
The freeing of the eventfs_inode children used list_for_each_entry()
where the child is freed via srcu, but there's still a chance that it
gets freed. It should be using list_for_each_entry_safe().
- Fix eventfs_inode SRCU use of list in freeing
The iterator uses an SRCU protected list walk on the eventfs inodes.
The eventfs inode uses its "list" field in a union with the RCU list
head. When the inode gets added to the SRCU list it immediately
corrupts the list pointer and can cause an issue with the iterator.
Move the RCU list head to be shared with the children list head which
allows the iterator to check the parent inode if is freed before
referencing the child. Have the iterator check the parent "is_freed"
field and break out if it is set. Also add memory barriers to make
sure the ordering is correct.
- Fix various RCU synchronization issues with direct_functions
Updates to direct_functions have some missing RCU protection and
synchronization. Restructure the code a bit to make sure updates to
the direct_functions are protected.
- Remove an unneeded comma from a scope_guard()
There's a spurious comma in a scope_guard(). Remove it.
- Fix race in per CPU buffer swap in the ring buffer
When a per CPU buffer swap happens, it must make sure that it doesn't
occur while a writer is active. Instead it returns an -EBUSY. But
there's a small race window when a writer moves from one sub-buffer
to the next that it resets the "committing" counter. If a swap
happens at that moment, the buffer used for the commit of an event
will not match the buffer the event is actually on. Instead of using
the "committing" counter, use the recursive detection counter that
does not get reset when the writer crosses sub-buffers.
- Fix off-by-one in ftrace_free_mem()
The function ftrace_free_mem() gets an "end_ptr" as a parameter that
is exclusive to the rang to be freed. But its value is used to search
for the records that expects an inclusive value. Subtract one from
the parameter to convert it to an inclusive range.
- Disable resizing of the ring buffer for persistent buffers
Resizing the persistent buffer has undefined behavior. Prevent it
from being resized.
- Disable changing ring buffer subbuf order when resizing is disabled
The ring buffer subbuffer order can not be changed during resizing.
Use that instead of just checking if the buffer is mapped as mapped
buffers also have resizing disabled.
- Initialize subbuf_order of reader pages when they are created
In rb_allocate_cpu_buffer() the bpage->order is not updated to the
current subbuf_order leaving it as zero. This value is used when the
page is freed.
- Fix test_ringbuffer() to test for ERR_PTR before calling
kthread_stop()
The rb_threads[] array is assigned the output of kthread_run_on_cpu()
which could return an ERR_PTR. At the end of the test, all threads in
the array are cleaned up by kthread_stop() passing in the value in
the array if it isn't zero. But if the array contains an ERR_PTR,
kthread_stop() will not be able to handle it properly.
* tag 'trace-v7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()
ring-buffer: Prevent subbuf order change when resizing is disabled
ring-buffer: Prevent resizing of persistent ring buffer
ftrace: Fix off-by-one fentry site disable in ftrace_free_mem()
ring-buffer: Use current_context for safe per-CPU buffer swap
ftrace: Drop extra comma in trace_buffered_event_enable
ftrace: Protect direct_functions in update_ftrace_direct_mod
ftrace: Protect direct_functions in update_ftrace_direct_del
ftrace: Protect direct_functions in ftrace_find_rec_direct
eventfs: Use children field for rcu head and add memory barriers
eventfs: Fix use-after-free in eventfs_remove_rec()
- Fix potential uninitialized memory reads and buffer overflows from
malformed zcrypt CCA and EP11 requests by properly validating lengths
and payloads
- Fix possible out of bounds accesses in zcrypt EP11 domain handling by
replacing fixed payload layout assumptions with parsing ASN.1 fields
with bounds checks
- Fix zcrypt CCA and EP11 request and reply buffer allocations missing
required 4-byte padding, and scrub the full allocation on release
- Fix zcrypt CCA and EP11 messages leaking up to 3 uninitialized bytes
of memory by zeroing trailing alignment padding
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEE3QHqV+H2a8xAv27vjYWKoQLXFBgFAmp4YYUACgkQjYWKoQLX
FBh1tgf/ZZMzYxWDawMfYg2SoE16aLEG6M+I8qa1EmpxCXwu2Evl17LdMtkZFL1C
ClDux15JGBhbpYyHyXhlsnUMRSHKLatLF2LU4KR6g3q5JgFcNRUVzSH8uuE40en5
UspMeEG09NENUJGveyZ8tEbGmkbI1hxAzicD4nRMTuin8VpXWKvHaNeQYXhkuDtr
5nuCiRmJUgMrwAVgtTXkdWzMaR0QwLWwkkLXLhnQk6NWyz1EhYmXWT+YG2axu7/y
KUWU5jEs1AutO7YUxgTzrvxjS4M5IbokSXNyTUlLUqmPzdbXVWrpuF0nFEorBCA3
TzA7NCaJAChYWFfg54zQYdd4ijnf2Q==
=iulo
-----END PGP SIGNATURE-----
Merge tag 's390-7.2-7' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux
Pull s390 fixes from Vasily Gorbik:
- Fix potential uninitialized memory reads and buffer overflows from
malformed zcrypt CCA and EP11 requests by properly validating lengths
and payloads
- Fix possible out of bounds accesses in zcrypt EP11 domain handling by
replacing fixed payload layout assumptions with parsing ASN.1 fields
with bounds checks
- Fix zcrypt CCA and EP11 request and reply buffer allocations missing
required 4-byte padding, and scrub the full allocation on release
- Fix zcrypt CCA and EP11 messages leaking up to 3 uninitialized bytes
of memory by zeroing trailing alignment padding
* tag 's390-7.2-7' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
s390/zcrypt: Pad trailing CCA or EP11 message with zeros
s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing
s390/zcrypt: Improve EP11 CPRB length and overflow checks
s390/zcrypt: Improve CCA CPRB length and overflow checks
s390/zcrypt: Fix CPRB memory allocation in zcrypt misc code
