linux/fs
Linus Torvalds a13307e97d BPF fixes:
- Fix BPF verifier to preserve full pointer state for commuted
   scalar += pointer arithmetic (Yiyang Chen, Eduard Zingerman)
 
 - Fix a use-after-free of request sockets in the BPF TCP
   iterator batching (Jose Fernandez)
 
 - Fix a use-after-free of sk_redir in the BPF sockmap send
   verdict path (Chengfeng Ye)
 
 - Fix a netns reference imbalance in the BPF conntrack kfuncs
   (Chengfeng Ye)
 
 - Fix bpf_get_fsverity_digest() dynptr assumptions and silent
   digest truncation (Eric Biggers)
 
 - Fix bpf_tcp_{gen,check}_syncookie to check sk_state before
   sk_protocol to make sure it is a full socket (Luxiao Xu)
 
 - Fix rqspinlock to reset the tail when preserving the queue
   on deadlock (Kumar Kartikeya Dwivedi)
 
 Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
 -----BEGIN PGP SIGNATURE-----
 
 iIsEABYKADMWIQTFp0I1jqZrAX+hPRXbK58LschIgwUCanXeCRUcZGFuaWVsQGlv
 Z2VhcmJveC5uZXQACgkQ2yufC7HISIMfLQD9EWzi5MVBTcvg0XsHY1GZZBZUpfwo
 VCrfPm9vHAVuqQ0A/0D9vWVRf1UEk9ccn+ebVKPuTuydGnDRR0Qovuca4gQF
 =jZY8
 -----END PGP SIGNATURE-----

Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Pull BPF fixes from Daniel Borkmann:

 - Fix BPF verifier to preserve full pointer state for commuted
   scalar += pointer arithmetic (Yiyang Chen, Eduard Zingerman)

 - Fix a use-after-free of request sockets in the BPF TCP iterator
   batching (Jose Fernandez)

 - Fix a use-after-free of sk_redir in the BPF sockmap send verdict
   path (Chengfeng Ye)

 - Fix a netns reference imbalance in the BPF conntrack kfuncs
   (Chengfeng Ye)

 - Fix bpf_get_fsverity_digest() dynptr assumptions and silent
   digest truncation (Eric Biggers)

 - Fix bpf_tcp_{gen,check}_syncookie to check sk_state before
   sk_protocol to make sure it is a full socket (Luxiao Xu)

 - Fix rqspinlock to reset the tail when preserving the queue
   on deadlock (Kumar Kartikeya Dwivedi)

* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
  rqspinlock: Reset tail when preserving queue on deadlock
  bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie
  fsverity: Fix silent truncation in bpf_get_fsverity_digest()
  fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
  bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
  bpf: Fix netns reference imbalance in conntrack kfuncs
  bpf, sockmap: Fix sk_redir use-after-free in send verdict
  selftests/bpf: Cover commuted pointer state propagation
  bpf: Propagate untrusted pointer state in commuted arithmetic
  bpf: Preserve pointer state for commuted arithmetic
  bpf: Simplify sanitize_err() signature
2026-08-07 08:08:57 -07:00
..
9p Asides of the avalanche of LLM-driven fixes, there are a couple of 2026-06-21 10:26:31 -07:00
adfs ARM development for 7.1-rc1 2026-04-25 07:44:26 -07:00
affs affs: handle set_blocksize failures 2026-05-21 13:39:35 +02:00
afs afs: Fix UAF when sending a message 2026-07-28 09:20:44 +02:00
autofs vfs-7.1-rc1.misc 2026-04-13 14:20:11 -07:00
befs befs: handle set_blocksize failures 2026-05-21 13:39:35 +02:00
bfs bfs: replace get_zeroed_page() with kzalloc() 2026-05-28 13:58:14 +02:00
btrfs for-7.2-rc6-fixup-worker-tag 2026-08-06 13:29:15 -07:00
cachefiles cachefiles: Fix file burial to take lock when unsetting S_KERNEL_FILE 2026-07-01 15:26:28 +02:00
ceph ceph: avoid fs reclaim while using current->journal_info 2026-07-23 20:29:42 +02:00
coda coda cleanups and fixes 2026-04-21 14:03:10 -07:00
configfs configfs work 2026-06-15 04:28:20 +05:30
cramfs cramfs: drop obsolete Future Development notes and update tools URL 2026-05-03 09:12:23 -06:00
crypto fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() 2026-07-28 21:19:44 -07:00
debugfs debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str() 2026-04-02 16:15:23 +02:00
devpts Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dlm dlm: init per node debugfs before add to node hash 2026-05-08 08:38:03 -05:00
ecryptfs The set of eCryptfs changes for the 7.2-rc1 merge window consists of: 2026-06-26 08:24:06 -07:00
efivarfs efivarfs: use QSTR() in efivarfs_alloc_dentry 2026-04-28 12:30:59 +02:00
efs fs: efs: remove unneeded debug prints 2026-06-11 11:42:21 -07:00
erofs erofs: cap LZMA stream pool size 2026-07-27 12:31:11 +08:00
exfat iomap: consolidate bio submission 2026-07-01 15:26:47 +02:00
exportfs find_acceptable_alias(): skip NORCU aliases with zero refcount 2026-06-05 00:34:55 -04:00
ext2 ext2: fix ignored return value of generic_write_sync() 2026-06-02 10:56:16 +02:00
ext4 Various ext4 updates for 7.2-rc1: 2026-06-18 09:42:02 -07:00
f2fs fscrypt: Avoid dynamic allocation in fscrypt_get_devices() 2026-07-20 10:39:24 -07:00
fat fat: avoid stack overflow warning 2026-07-09 15:48:55 -07:00
freevxfs freevxfs: don't BUG() on unknown typed-extent type 2026-07-01 15:26:26 +02:00
fuse fuse: call fuse_send_readpages explicitly from fuse_readahead 2026-07-01 15:26:47 +02:00
gfs2 gfs2 fixes 2026-06-26 15:13:06 -07:00
hfs hfs/hfsplus updates for v7.2 2026-06-16 12:27:23 +05:30
hfsplus hfs/hfsplus updates for v7.2 2026-06-16 12:27:23 +05:30
hostfs Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
hpfs vfs-7.2-rc1.misc 2026-06-15 03:59:45 +05:30
hugetlbfs mm: use mapping_mapped to simplify the code 2026-06-21 11:37:38 -07:00
iomap iomap: add a separate bio_set for iomap_split_ioend 2026-07-31 11:49:09 +02:00
isofs \n 2026-06-16 11:58:52 +05:30
jbd2 Various ext4 updates for 7.2-rc1: 2026-06-18 09:42:02 -07:00
jffs2 treewide: change inode->i_ino from unsigned long to u64 2026-03-06 14:31:28 +01:00
jfs vfs-7.2-rc1.misc 2026-06-15 03:59:45 +05:30
kernfs Driver core changes for 7.2-rc1 2026-06-15 12:41:17 +05:30
lockd lockd: fix NLMv3 GRANTED_MSG handling 2026-07-17 09:31:50 -04:00
minix minix: avoid overflow in bitmap block count calculation 2026-07-01 15:26:24 +02:00
netfs netfs: Fix folio_queue ENOMEM in writeback by adding a mempool 2026-07-28 15:42:31 +02:00
nfs NFSv4.2: fix nfs4_listxattr size accounting 2026-07-31 13:27:25 -04:00
nfs_common NFSD: Remove NFSERR_EAGAIN 2026-01-02 13:43:41 -05:00
nfsd nfsd-7.2 fixes: 2026-07-13 08:38:01 -07:00
nilfs2 nilfs2 updates for v7.2 2026-06-16 12:14:20 +05:30
nls fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8() 2025-12-01 11:58:06 +02:00
notify \n 2026-06-16 11:56:43 +05:30
ntfs ntfs: drop stale page-cache when shrinking a non-resident attr 2026-07-21 18:48:24 +09:00
ntfs3 iomap: consolidate bio submission 2026-07-01 15:26:47 +02:00
ocfs2 ocfs2: fix boundary check in ocfs2_check_dir_entry() to use buffer offset 2026-07-20 17:41:28 -07:00
omfs omfs: handle set_blocksize failures 2026-05-21 13:39:36 +02:00
openpromfs
orangefs orangefs: keep the readdir entry size 64-bit in fill_from_part() 2026-07-01 15:26:27 +02:00
overlayfs ovl: check access to copy_file_range source with src mounter creds 2026-07-22 16:42:28 +02:00
proc 13 hotfixes. All are cc:stable. 11 are for MM. All are singletons - 2026-07-27 14:36:26 -07:00
pstore mm.git review status for linus..mm-stable 2026-04-15 12:59:16 -07:00
qnx4 qnx4: handle set_blocksize failures 2026-05-21 13:39:35 +02:00
qnx6 fs/qnx6: fix pointer arithmetic in directory iteration 2026-05-28 14:16:33 +02:00
quota quota: allocate dquot_hash with kmalloc() 2026-05-27 15:12:22 +02:00
ramfs folio_batch: rename pagevec.h to folio_batch.h 2026-04-05 13:53:07 -07:00
resctrl fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list 2026-07-06 19:05:49 -07:00
romfs mm.git review status for linus..mm-stable 2026-02-18 20:50:32 -08:00
smb three ksmbd server fixes 2026-08-06 20:25:46 -07:00
squashfs Squashfs: check metadata block offset is within range 2026-02-24 11:13:27 -08:00
sysfs Driver core changes for 7.2-rc1 2026-06-15 12:41:17 +05:30
tests fs/tests: exec: Remove bad test vector 2026-03-18 11:41:53 -07:00
tracefs tracefs: use d_splice_alias() in ->lookup() instances 2026-06-05 01:12:15 -04:00
ubifs fs: add icount_read_once() and stop open-coding ->i_count loads 2026-05-11 23:12:28 +02:00
udf \n 2026-06-16 11:58:52 +05:30
ufs vfs-7.1-rc1.bh.metadata 2026-04-13 12:46:42 -07:00
unicode Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
vboxsf vboxsf: Implement fileattr_get for case sensitivity 2026-05-11 16:50:29 +02:00
verity fsverity: Fix silent truncation in bpf_get_fsverity_digest() 2026-08-04 09:24:23 +02:00
xfs xfs: fixes for 7.2-rc7 2026-08-06 08:16:40 -07:00
zonefs zonefs: handle integer overflow in zonefs_fname_to_fno 2026-05-12 07:53:20 +09:00
aio.c libfs: drop redundant SB_I_NOEXEC/SB_I_NODEV in init_pseudo() callers 2026-06-04 10:10:49 +02:00
anon_inodes.c libfs: drop redundant SB_I_NOEXEC/SB_I_NODEV in init_pseudo() callers 2026-06-04 10:10:49 +02:00
attr.c fs,fsverity: remove check for fsverity being enabled in setattr_prepare() 2026-07-28 21:25:03 -07:00
backing-file.c backing-file: fix backing_file_open() kerneldoc parameter 2026-06-10 09:49:25 +02:00
bad_inode.c fs: refactor ->update_time handling 2026-01-12 14:01:32 +01:00
binfmt_elf_fdpic.c binfmt_elf_fdpic: only honour the first PT_INTERP 2026-07-21 13:22:34 +02:00
binfmt_elf.c mm: unexport vm_brk_flags() and eliminate vm_flags parameter 2026-04-05 13:53:39 -07:00
binfmt_flat.c
binfmt_misc.c binfmt_misc: don't leak the user namespace when the mount fails 2026-07-28 15:51:25 +02:00
binfmt_script.c
bpf_fs_kfuncs.c bpf: have bpf_real_data_inode() take a struct file 2026-07-01 15:26:27 +02:00
buffer.c vfs-7.2-rc1.misc 2026-06-15 03:59:45 +05:30
char_dev.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
compat_binfmt_elf.c
coredump.c vfs-7.2-rc1.misc 2026-06-15 03:59:45 +05:30
d_path.c dcache: permit dynamic_dname()s up to NAME_MAX 2026-04-07 12:32:22 +02:00
dax.c dax changes for 7.1 2026-04-21 14:12:01 -07:00
dcache.c dentry memory safety stuff 2026-06-15 04:15:31 +05:30
direct-io.c direct-io: remove IOCB_NOWAIT support 2026-05-26 11:01:55 -06:00
drop_caches.c
eventfd.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
eventpoll.c eventpoll: pin files while checking reverse paths 2026-07-23 12:48:22 +02:00
exec.c exec: fix unsigned loop counter wrap in transfer_args_to_stack() 2026-07-21 13:00:49 +02:00
fcntl.c vfs-7.2-rc1.misc 2026-06-15 03:59:45 +05:30
fhandle.c fhandle: reject detached mounts in capable_wrt_mount() 2026-07-01 15:26:32 +02:00
file_attr.c fs: Add case sensitivity flags to file_kattr 2026-05-11 16:50:27 +02:00
file_table.c dentry memory safety stuff 2026-06-15 04:15:31 +05:30
file.c fs: retire stale comment in fget_task_next() 2026-05-28 14:27:00 +02:00
filesystems.c fs: fix ups and tidy ups to /proc/filesystems caching 2026-06-12 14:26:27 +02:00
fs_context.c vfs-7.1-rc1.misc 2026-04-13 14:20:11 -07:00
fs_dirent.c
fs_parser.c fs: remove fsparam_path / fs_param_is_path 2026-02-19 14:34:26 +01:00
fs_pin.c
fs_struct.c fs: add <linux/init_task.h> for 'init_fs' 2026-01-14 16:50:37 +01:00
fs-writeback.c mm: kick writeback flusher for IOCB_DONTCACHE with targeted dirty tracking 2026-06-04 10:16:51 +02:00
fserror.c treewide: change inode->i_ino from unsigned long to u64 2026-03-06 14:31:28 +01:00
fsopen.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
init.c struct filename series 2026-02-09 16:58:28 -08:00
inode.c mm.git review status for linus..mm-stable 2026-06-23 12:03:44 -07:00
internal.h fuse: invalidate page cache after DIO and async DIO writes 2026-06-15 14:06:20 +02:00
ioctl.c
Kconfig treewide: fix indentation and whitespace in Kconfig files 2026-05-28 21:24:42 -07:00
Kconfig.binfmt
kernel_read_file.c
libfs.c This series converts a bunch of unidiomatic uses of d_add() 2026-06-15 04:21:00 +05:30
locks.c filelock: add an inode_lease_ignore_mask helper 2026-05-15 19:24:32 +02:00
Makefile userfaultfd: merge fs/userfaultfd.c into mm/userfaultfd.c 2026-06-04 14:45:03 -07:00
mbcache.c vfs-7.1-rc1.misc 2026-04-13 14:20:11 -07:00
mnt_idmapping.c fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap 2026-05-11 14:19:01 +02:00
mount.h vfs-7.2-rc1.procfs 2026-06-15 04:07:58 +05:30
mpage.c mm.git review status for linus..mm-stable 2026-04-15 12:59:16 -07:00
namei.c fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid 2026-07-01 15:26:18 +02:00
namespace.c vfs-7.2-rc1.procfs 2026-06-15 04:07:58 +05:30
nsfs.c vfs-7.2-rc1.misc 2026-06-15 03:59:45 +05:30
nullfs.c fs: add immutable rootfs 2026-01-12 16:52:09 +01:00
open.c mm.git review status for linus..mm-stable 2026-06-23 12:03:44 -07:00
pidfs.c pidfs: make pidfs_ino_lock static 2026-07-24 10:30:58 +02:00
pipe.c fs/pipe: pre-allocate pages outside pipe->mutex in anon_pipe_write 2026-05-28 14:33:24 +02:00
pnode.c
pnode.h
posix_acl.c fs: preserve ACL_DONT_CACHE state in forget_cached_acl() 2026-07-21 21:52:51 +02:00
proc_namespace.c
read_write.c fs/read_write: Do not export __kernel_write() to the entire world 2026-06-05 14:46:20 +02:00
readdir.c fs: Replace user_access_{begin/end} by scoped user access 2026-03-24 14:44:02 +01:00
remap_range.c
select.c vfs-7.2-rc1.misc 2026-06-15 03:59:45 +05:30
seq_file.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
signalfd.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
splice.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
stack.c
stat.c statx: switch to CLASS(filename_maybe_null) 2026-01-16 12:52:04 -05:00
statfs.c user_statfs(): switch to CLASS(filename) 2026-01-16 12:52:04 -05:00
super.c super: fix emergency thaw deadlock on frozen block devices 2026-07-26 17:08:52 +02:00
sync.c sync_file_range: delete dead S_ISLNK code 2026-05-21 13:39:36 +02:00
sysctls.c
timerfd.c fs/timerfd: Use the new alarm/hrtimer functions 2026-05-01 21:36:13 +02:00
utimes.c do_utimes_path(): switch to CLASS(filename_uflags) 2026-01-16 12:52:03 -05:00
xattr.c lsm/stable-7.2 PR 20260615 2026-06-17 12:34:16 +01:00