A fix to ensure that we don't overwrite the error code when cleaning up
a failed cache initialisation, helping people debug issues if they do
arise.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmo+eagACgkQJNaLcl1U
h9D09Af9GOgk/Fk+qOS8Ns4wzVmOaFEG3AhNpqhnKjX3kaI/9Sj2S+oVFzQL6jJP
za2vtYNthXWb2s/zwUCdcWO12mgrp12L+3O5FU786ihxW1WhHvNnmgEo2Cunr0Jr
mORqKimyBqW27MFtpU2lHvnt2BwF3oc2ixZHK7j0sLid/74o7gtVFrHjCfoMS5Lf
oITWMWExyRZ8DpOXNyFFl304ZvBwiHOloB0qIZPa7EV3GCL4fuUMl9dMi1mBPG1i
hISYK8kkYvNUcgCsg83zlbcmrPzShPAyc5twZwhltAUwQ9qLSygnPKDbdqkKgSUq
WT1/9gHyfR5XH/h3bATrPFQcW2RmoA==
=Ve1C
-----END PGP SIGNATURE-----
Merge tag 'regmap-fix-v7.2-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap
Pull regmap fix from Mark Brown:
"Ensure that we don't overwrite the error code when cleaning up a
failed cache initialisation, helping people debug issues if they
do arise"
* tag 'regmap-fix-v7.2-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
regcache: Do not overwrite error code when finalizing cache after error
Merge a fix eliminating a possibility of running the thermal testing
module code after that module has been removed.
* thermal-testing:
thermal: testing: zone: Flush work items during cleanup
Merge a cpuidle core fix that removes a misguided warning along with an
inaccurate comment next to it.
* pm-cpuidle:
cpuidle: Allow exit latency to exceed target residency
Merge an update of comments regarding the ACPI sysfs code, a kernel-doc
style fixup update of ACPI resource management, and ACPI IPMI driver
fix, and an ACPI processor driver fix for 7.2-rc1:
- Fix module parameter file paths in comments in the ACPI code managing
the general sysfs attributes (Zenghui Yu)
- Update kerneldoc comments in the ACPI resource management code to
follow the common style (Andy Shevchenko)
- Fix inverted interface check in ipmi_bmc_gone() which may cause ACPI
IPMI interfaces to be mishandled (Xu Rao)
- Add __cpuidle to idle state management functions related to ACPI _LPI
to avoid trace-induced RCU warnings (Li RongQing)
* acpi-sysfs:
ACPI: sysfs: Fix path of module parameters in comments
* acpi-resource:
ACPI: resource: Amend kernel-doc style
* acpi-driver:
ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone()
* acpi-processor:
ACPI: processor_idle: Mark LPI enter functions as __cpuidle
blk_hctx_poll() can busy-poll until a completion is found or
need_resched() becomes true. On preemptible kernels, the scheduler can
set TIF_NEED_RESCHED on the timer tick and preempt the task at IRQ
return before the loop condition re-evaluates it. After the context
switch, the flag is cleared, so the poller can continue spinning instead
of returning to its caller.
This can happen with io_uring IOPOLL reads inside iocb_bio_iopoll(),
which holds the rcu_read_lock() while calling bio_poll(). If another
poller on the same polled queue drains the available completions, this
poller may repeatedly find no completions and remain inside the RCU
read-side critical section long enough to trigger RCU stall reports:
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: Tasks blocked on level-1 rcu_node (CPUs 0-9): P3961
rcu: (detected by 3, t=60002 jiffies, g=18533, q=4943 ncpus=20)
task:fio state:R running task stack:0 pid:3961
Call Trace:
<TASK>
? nvme_poll+0x36/0xa0 [nvme]
? blk_hctx_poll+0x39/0x90
? blk_mq_poll+0x30/0x60
? bio_poll+0x87/0x170
? iocb_bio_iopoll+0x32/0x50
? io_uring_classic_poll+0x25/0x50
? io_do_iopoll+0x216/0x420
? __do_sys_io_uring_enter+0x2c7/0x7c0
Reproducible with:
fio -filename=/dev/nvme0n1 -direct=1 -size=4g -rw=randread \
--numjobs=32 -bs=4K -ioengine=io_uring -hipri=1 -iodepth=1 \
--registerfiles=1 --group_reporting --thread
Record the starting jiffy and exit the loop once jiffies has advanced.
This bounds each blk_hctx_poll() invocation while also covering the
case where the reschedule flag was cleared by the context switch
before the loop condition could observe it.
Fixes: f22ecf9c14 ("blk-mq: delete task running check in blk_hctx_poll()")
Reviewed-by: Fengnan Chang <changfengnan@bytedance.com>
Suggested-by: Fengnan Chang <changfengnan@bytedance.com>
Signed-off-by: Anuj Gupta <anuj20.g@samsung.com>
Signed-off-by: Alok Rathore <alok.rathore@samsung.com>
Link: https://patch.msgid.link/20260617155051.1266079-1-anuj20.g@samsung.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Add static qualifier for of_display_mode_bridge_funcs to resolve the
sparse warning:
drivers/gpu/drm/bridge/of-display-mode-bridge.c:54:25: sparse: sparse:
symbol 'of_display_mode_bridge_funcs' was not declared. Should it be
static?
Also mark the structure const as required by devm_drm_bridge_alloc()
parameter type constraints.
Fixes: ba2db93cf3 ("drm/bridge: Move legacy bridge driver out of imx directory for multi-platform use")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202606170744.FUStcWaB-lkp@intel.com/
Signed-off-by: Damon Ding <damon.ding@rock-chips.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Link: https://patch.msgid.link/20260617080755.186368-1-damon.ding@rock-chips.com
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
- Drop unnecessary type reference from khadas,mcu "fan-supply"
- Fix clocks in Renesas R-Mobile APE6 example
- Add missing Unisoc SC2730 PMIC regulators schema
- Fix Amlogic thermal example
- kernel-doc fix for of_map_id()
- Handle negative index in of_fwnode_get_reference_args()
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEktVUI4SxYhzZyEuo+vtdtY28YcMFAmo9lgUACgkQ+vtdtY28
YcMHdg//b53t64fBQF7AhVO0mp/EJLYvvCnKZ0iWw1N0Ya7WgKFMtl6UhYoxfkn5
8Q+q18rCaV6v9cP933RQ1zgdYeEavmP1ev1tpuW3MzWFRGQykJt1tgtwr1LTFEDK
NbalsaAiAbihn1Tn22gXDAddy8ghI0AyZoSDvLrUx1mlO2dZjOgg2tSt/yzmZIBf
00ZKmu6lcqmdvoitWkjN2CmFuyTATQ3+7mGJvTgPUx9FRvF/xSGHgzxkN3eHnMhC
MhYLZQMtmJ4xkRSZ1NC/OBbgSftzIbpYsZTMsG1KUJpXdGAdcz3LPUVWLWAlaqIb
sP6bu7i7x42zPF+m2BkdA9N5pdJsPNBNaR1rdcZykq9qiN+nfQkUUK16TlznQd0t
xH+wBrMZcHjoZuBpP1vzEuFc/GyGIxWOTCmjgCXXOHLxUDt17V5COHBziLa+/w1O
e++M4QYy+/1irPeTq8obr8uSSkHthbwomwWm55yfuuC+gs5tKYGoLnuyHswP4Eza
E5Usz7VlInMfF6x0yADAPlcpAymp5VdnLFnWktSv0CHo69Tac0EbgWsGMB6HV9c/
2ZawGm5yNIfoBNggA2UodgN9QDomi8I+tATCmClvZo6yR5Jaus669/s7ELMHBfgw
35RktyT0cS4z8OvkhdADWAdBIC0KGWl0PKdoqqkXITEaR/t7FjY=
=/1jq
-----END PGP SIGNATURE-----
Merge tag 'devicetree-fixes-for-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux
Pull devicetree fixes from Rob Herring:
- Drop unnecessary type reference from khadas,mcu "fan-supply"
- Fix clocks in Renesas R-Mobile APE6 example
- Add missing Unisoc SC2730 PMIC regulators schema
- Fix Amlogic thermal example
- kernel-doc fix for of_map_id()
- Handle negative index in of_fwnode_get_reference_args()
* tag 'devicetree-fixes-for-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux:
dt-bindings: mfd: khadas,mcu: Drop type reference from "fan-supply"
dt-bindings: clock: renesas: div6: Use ZT/ZTR trace clock in R-Mobile APE6 example
regulator: dt-bindings: Add Unisoc SC2730 PMIC
dt-bindings: thermal: amlogic: Correct 'reg' in the example
dt-bindings: thermal: amlogic: Fix missing header in the example
of: Fix RST inline emphasis warnings in of_map_id() kernel-doc
of: property: Fix of_fwnode_get_reference_args() with negative index
1, Add THREAD_INFO_IN_TASK implementation;
2, Add build salt to the vDSO;
3, Add some BPF JIT inline helpers;
4, Update DTS for I2C clocks and clock-frequency;
5, Some bug fixes and other small changes.
-----BEGIN PGP SIGNATURE-----
iQJKBAABCAA0FiEEzOlt8mkP+tbeiYy5AoYrw/LiJnoFAmo+MBYWHGNoZW5odWFj
YWlAa2VybmVsLm9yZwAKCRAChivD8uImesGWD/9HygPT6/JFvFR2rijLaym9TNYi
+X8m0GTUJDrBGasDQ1rXSgUAkWKIQHEvx0Q947HYWhceiIrwbiZrgMStVapk40hd
/WsiuTHFaiVzjiiXf2bdTSr9uWHIon3P1EZ6zkmdRO4l2VsvAq2elMJXazIP7NUa
fTnTGAMPXvA/TinNXZqGq/Ny9c6gp63pVUgATcBpSUmYCNYGz6xx7OwSWyGV0ncq
Kfxm87nVq6wdyCgmrzfYSGze9vM0FxfFpzvZbX9vLOfGZBGaxzDcBjH9LRU09vyp
/9fNpacKT49yNOfLO3R3MHSPFSa5DCg8ph8CDfMnqPmP01SfZpC+zmlFWv23ojx5
4v47fyaRQu6ucKL2vxkIJfKO6l8bXgcuzVgZPGVt5q5yJ5O+7yhuamncrxUKk6Ol
KGpIEJM3iKbcHKr9GF0EUcgJkbA2J/pU/094snBU3HlkoHDVcp28XxlJmNtW+jY4
49dCTbX/5v+680uf/KTUyXJ4j3m9bxMOB6feE1uVaSJF1nx6f7WYHRg7A/1pXnWy
f2chgwR4eUeqZRpFlUhcLx4R+OOD2ORvvdM0qcNv4T7E8FD31JtFVD873R2iFEG8
AlKG4Ln3DUeJdhskXXmJRIDD5nZb9XZNYlnM4ghQLBas5dtSxsSPnzkSjJHirTjR
naFFT9xxRBQOBBTrjQ==
=EvQG
-----END PGP SIGNATURE-----
Merge tag 'loongarch-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson
Pull LoongArch updates from Huacai Chen:
- Add THREAD_INFO_IN_TASK implementation
- Add build salt to the vDSO
- Add some BPF JIT inline helpers
- Update DTS for I2C clocks and clock-frequency
- Some bug fixes and other small changes
* tag 'loongarch-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson:
selftests/bpf: Test jited inline of bpf_get_smp_processor_id() for LoongArch
selftests/bpf: Test jited inline of bpf_get_current_task() for LoongArch
selftests/bpf: Add __arch_loongarch to limit test cases for LoongArch
selftests/bpf: Add get_preempt_count() support for LoongArch
LoongArch: dts: Add i2c clocks and clock-frequency properties to LS2K2000
LoongArch: dts: Add i2c clocks and clock-frequency properties to LS2K1000
LoongArch: dts: Add i2c clocks and clock-frequency properties to LS2K0500
LoongArch: BPF: Inline bpf_get_smp_processor_id() helper
LoongArch: BPF: Inline bpf_get_current_task/_btf() helpers
LoongArch: BPF: Fix off-by-one error in tail call
LoongArch: BPF: Fix outdated tail call comments
LoongArch: Add build salt to the vDSO
LoongArch: Fix nr passing in set_direct_map_valid_noflush()
LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect()
LoongArch: Move struct kimage forward declaration before use
LoongArch: Report dying CPU to RCU in stop_this_cpu()
LoongArch: Add PIO for early access before ACPI PCI root register
LoongArch: Add THREAD_INFO_IN_TASK implementation
- Fix randconfig build failure due to missing include of asm/insn.h.
- Reject unaligned hardware watchpoints which were silently being
truncated.
- Fix crash in KVM initialisation by deferring the read-only remapping
of the kernel data and bss sections.
-----BEGIN PGP SIGNATURE-----
iQFEBAABCgAuFiEEPxTL6PPUbjXGY88ct6xw3ITBYzQFAmo9LYkQHHdpbGxAa2Vy
bmVsLm9yZwAKCRC3rHDchMFjNKwJCACHfG4pnvgpqlPintNCHhFD1ITuQCJBP+zs
UXtUA3iMCA5jEpVmXx7XHrXj4fALkXVFFvia2XVDVTOcj57lbv4+xi8x8Q+DID6G
K47sXjpodBc1sNmNWiDRQn67l6EejFpxpfJzVfXEMw0wu0AWfcY+skNUuKdRdN0N
EVMn/0iCHQgs7X4orL9PySYn7lx7mv8WLXCquvRKHKRTEZkFN8l4p2bFWX1RCbzY
zEQY62uAZfZPDUEnP3aWBjvRhDsDZIdxXLQAU6OfOWXTK4XsoJOuKE84dboNHTB3
EGkeioeYlKbPpKJDzDdZPZjO/M4IUfhINAGuHGw61S6ChxZD6UEZ
=7FJU
-----END PGP SIGNATURE-----
Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
Pull arm64 fixes from Will Deacon:
"Small crop of arm64 fixes for -rc1. We've got a build fix for a new
randconfig permutation, a fix for a long-standing truncation issue
with hardware watchpoints and a KVM initialisation fix for the newly
merged remapping of the kernel data and bss sections:
- Fix randconfig build failure due to missing include of asm/insn.h
- Reject unaligned hardware watchpoints which were silently being
truncated
- Fix crash in KVM initialisation by deferring the read-only
remapping of the kernel data and bss sections"
* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
arm64: mm: Defer read-only remap of data/bss linear alias
arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS
arm64: static_call: include asm/insns.h
- Code cleanup to replace kmalloc()/snprintf() with kasprintf()
- Code cleanup to simplify code flow by removing an unnecessary variable
There should be no functional changes. The patches have all spent time
in linux-next and they pass all tests in the ecryptfs-utils tree.
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEKvuQkp28KvPJn/fVfL7QslYSS/0FAmo96M8RHGNvZGVAdHlo
aWNrcy5jb20ACgkQfL7QslYSS/0RyRAAv1eObbk5F6oyz0oii7u+AJVhoVHiGUoS
rHSo3JI5xA/0fM6jArXmiLqF6twyU0hzIiR04KIhp6IC6TvrSFuCPXrPRSzTQ1Nn
3ETW4W1nbie0T9fZqOaGLShTYK7PhhaJltS/qHmSzqZJXaLdy5QBR+vn89wBtCq7
23r9x2i097Qt4sP+SZoa5Auq3EEfj6+ZjX5Y2Ve6uOSXL5POh0vysiMAt9ROZfd9
jSNIM3EtfirKtFuZ2lcMBnBsZMSh7/6h2f0qCgptAQyVWEkINcW1i3wjv2durIe7
q5ws54BQ2eSdjA4AyL/kl/TtuV06k73XsTb3sAi+Au1T3MfVgEeXoYQA8MwYCgEp
/qbBlnVA8Zr14wNEkBUPH7nVgLmpY6pF/GyQxiL017Nroa+hjyn9thsqNnA/xMzf
CCsYhpw3Hn80pKyEvONtGxuTpMMmqjzrkoUCP5YmIo3tHibl4IlfxGhFHPtNEGtU
9/hAB4FuASnjgiYKp/UOnu6oPLww1WRMHw1hM4KYJxVYt0f/PxVp26QExCSvrMG4
xrl8kgt9CvPSRAWkhfPHecFvOi7a0UlscjdWlC4jh2eqnriMBhQzW4iCQQnMflMd
y080VNlbOZcjyK7nz2HBhaG8nTG9mVPlXw7DjjVf42AoEsWzmkqDwfCG06oX/Vps
2PPQv+hjHUw=
=TCHV
-----END PGP SIGNATURE-----
Merge tag 'ecryptfs-7.2-rc1-updates' of git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs
Pull ecryptfs updates from Tyler Hicks:
"No functional changes, just code cleanups:
- replace kmalloc()/snprintf() with kasprintf()
- simplify code flow by removing an unnecessary variable"
* tag 'ecryptfs-7.2-rc1-updates' of git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs:
ecryptfs: use kasprintf in ecryptfs_crypto_api_algify_cipher_name
ecryptfs: remove redundant variable found_auth_tok
-----BEGIN PGP SIGNATURE-----
iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmo9nx0ACgkQiiy9cAdy
T1GiNgwAuxlhhJghBrXqNqzW7FwJRsrC+ibEfCQDdI5ifREo+6Ov6I9FBEu5z/XX
OAXFJWRHYHzZEc7XqpjXOqIXRq9GN3ADA2bwQ0fsh94TazmIeYXEDcMDnutQOECM
rqm+5kO+mY+c76XPm1C1CcNi+Te3q7Ry4O6rY7JhgGn5agZPyEEVHQ2nhRbS4YCp
LQESWWd169CIeHkBJCUnPbLPPaC56pkkHaEKgoPuZk0lbSTMOeQrmWInxX2lXBNQ
udO79m7Fz2XrGy0vjBwBFfOaWdBd2Gk1b76Hc/3EwfVVm2NN8w6ge0L4m+1RglDz
3VQSBsJ3nNVNRxSLpfjRwAE+pFvIy7+XmHA4lJ0REeklpyVF+27i/QvqPuCovm/g
AfMbrExIcDt+96DEe+h5iJtbP7WiuCIsYWtvpUtnDUdz4aTrmRlJhzaDvz88vmDi
5GRmLm13oGoPN3UTF3PQDgFG4Jigs+1YlKrbeIBOXkIbcYBslIDIIxN0b82i2GRT
6osoVCRX
=/FfE
-----END PGP SIGNATURE-----
Merge tag 'v7.2-rc-part2-smb3-server-fixes' of git://git.samba.org/ksmbd
Pull smb server updates from Steve French:
"This is mostly a correctness and compatibility update for ksmbd's
SMB2/3 lease, oplock, durable handle, compound request, CREATE,
rename, stream and share-mode handling.
A large part of the series fixes cases found by smbtorture where ksmbd
diverged from the SMB2/3 protocol requirements.
The main changes are:
- Rework SMB2 lease state handling so lease state is shared per
ClientGuid/LeaseKey across opens, with better validation of lease
create contexts, ACK handling, epochs, break-in-progress reporting,
v2 lease notification routing, and chained lease breaks
- Fix several oplock break corner cases, including ACK validation,
timeout downgrade behavior, level-II break handling on unlink,
share-conflict lease breaks, and read-control/stat-open behavior
- Fix durable handle behavior around delete-on-close, stale
reconnects, reconnect context parsing, oplock/lease break
invalidation, and durable v2 AppInstanceId replacement
- Fix compound request handling so related commands propagate failed
statuses correctly, preserve response framing across chained
errors, keep compound FIDs across READ/WRITE/FLUSH, and send
interim STATUS_PENDING where clients expect cancellable compound
I/O
- Tighten CREATE and stream semantics, including create attribute
validation, allocation size reporting, explicit create security
descriptors, unnamed DATA stream handling, stream directory
validation, and stream delete sharing against the base file
- Fix rename and metadata behavior, including parent directory
sharing checks, denying directory rename with open children, and
preserving SMB ChangeTime across rename for open handles
- Fix two important safety issues: a multichannel byte-range lock
list owner race that could lead to use-after-free, and an NTLMv2
session key update before authentication proof validation
- Fix a concurrent SMB2 NEGOTIATE preauth use-after-free, a UBSAN
warning in compression capability parsing, a false hung-task
warning in the durable handle scavenger, endian debug logging,
Smatch indentation warnings, and kernel-doc warnings
- Increase the default SMB3 transaction size from 1MB to 4MB to
better match modern read/write negotiation and improve sequential
I/O behavior"
* tag 'v7.2-rc-part2-smb3-server-fixes' of git://git.samba.org/ksmbd: (50 commits)
ksmbd: fix kernel-doc warnings in smb2_lease_break_noti()
ksmbd: fix inconsistent indenting warnings
ksmbd: validate NTLMv2 response before updating session key
ksmbd: increase SMB3_DEFAULT_TRANS_SIZE from 1MB to 4MB
ksmbd: fix UBSAN array-index-out-of-bounds in decode_compress_ctxt()
ksmbd: sleep interruptibly in the durable handle scavenger
ksmbd: start file id allocation at 1
ksmbd: treat read-control opens as stat opens only for leases
ksmbd: validate :: stream type against directory create
ksmbd: break conflicting-open leases only as far as needed
ksmbd: break handle caching for share conflicts
ksmbd: normalize ungrantable lease states
ksmbd: return oplock protocol error for level II ack
ksmbd: avoid level II oplock break notification on unlink
ksmbd: downgrade oplock after break timeout
ksmbd: apply create security descriptor first
ksmbd: return requested create allocation size
ksmbd: tighten create file attribute validation
ksmbd: reject empty-attribute synchronize-only create
ksmbd: honor stream delete sharing for base file
...
info->var, a framebuffer's current mode, is expected to have a matching
entry in info->modelist. var_to_display() relies on this and treats a
failed fb_match_mode() as "This should not happen". fb_set_var() keeps it
true by adding the mode to the list on every change, and
do_register_framebuffer() does the same at registration.
store_modes() replaces the modelist from userspace. fb_new_modelist()
validates the new modes but does not check that info->var still has a
match. It relies on fbcon_new_modelist() to re-point consoles, but that
only handles consoles mapped to the framebuffer. With fbcon unbound there
are none, so info->var is left describing a mode that is no longer in the
list.
A later console takeover runs var_to_display(), where fb_match_mode()
returns NULL and leaves fb_display[i].mode NULL. fbcon_switch() passes it
to display_to_var(), and fb_videomode_to_var() dereferences the NULL mode.
Keep the current mode in the list in fb_new_modelist(), the same way
fb_set_var() does.
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Ian Bridges <icb@fastmail.org>
Signed-off-by: Helge Deller <deller@gmx.de>
fbcon_new_modelist() runs when a framebuffer's modelist changes. For each
console mapped to it with fb_display[i].mode set, it reads vc_cons[i].d and
passes the vc_num to fbcon_set_disp(). This assumes a console with a mode
set has a vc_data, but it can be NULL. fbcon_set_disp() sets
fb_display[i].mode before it checks vc_data, and fbcon_deinit() leaves the
mode set after the vc_data is freed. fbcon_new_modelist() then dereferences
the NULL vc_data.
Keep fb_display[i].mode set only while the console has a vc_data. Check
vc_data before setting the mode in fbcon_set_disp(), and clear the mode in
fbcon_deinit(). The existing mode check in fbcon_new_modelist() then skips
such consoles.
Reported-by: syzbot+42525d636f430fd5d983@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=42525d636f430fd5d983
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Ian Bridges <icb@fastmail.org>
Signed-off-by: Helge Deller <deller@gmx.de>
store_modes() replaces a framebuffer's modelist with modes from userspace.
On success it frees the old modelist with fb_destroy_modelist(). Two
fields still point into that freed list.
One pointer is fb_display[i].mode, the mode a console is using.
fbcon_new_modelist() moves these pointers to the new list. It only does so
for consoles still mapped to the framebuffer. An unmapped console is
skipped and keeps its stale pointer. Unbinding fbcon, for example, sets
con2fb_map[i] to -1 but leaves fb_display[i].mode set. An
FBIOPUT_VSCREENINFO ioctl with FB_ACTIVATE_INV_MODE later reaches
fbcon_mode_deleted(). That function reads the stale fb_display[i].mode
through fb_mode_is_equal(). The read is a use-after-free.
The other pointer is fb_info->mode, the current mode. It is set through
the mode sysfs attribute. store_modes() does not update fb_info->mode, so
it is left pointing into the freed list. show_mode(), the attribute's read
handler, dereferences the stale fb_info->mode through mode_string(). The
read is a use-after-free.
Clear both pointers before freeing the list. Commit a1f3058930 ("fbcon:
Set fb_display[i]->mode to NULL when the mode is released") added the
helper fbcon_delete_modelist(). It clears every fb_display[i].mode that
points into a given list. So far it is called only from the unregister
path. Call it from store_modes() too, and set fb_info->mode to NULL.
Reported-by: syzbot+81c7c6b52649fd07299d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=81c7c6b52649fd07299d
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/ajjoDhAi2y4ArSlz@dev/
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Ian Bridges <icb@fastmail.org>
Signed-off-by: Helge Deller <deller@gmx.de>
The intel_opregion_cleanup() call should really be in display. Move it
at the end of intel_display_driver_probe_noirq().
For xe, this is a completely non-functional change now that the
noirq/nogem cleanup calls are in the right order.
For i915, this only changes the relative order of
intel_opregion_cleanup() and i915_perf_fini(), which should be of no
consequence.
Reviewed-by: Michał Grzelak <michal.grzelak@intel.com>
Link: https://patch.msgid.link/8ccd49a5945e0560ba22079d686db1268e8e9f7f.1781549229.git.jani.nikula@intel.com
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
The display driver init and cleanup calls are slightly asymmetric. The
cleanup order should be intel_display_driver_remove_noirq() and
intel_display_driver_remove_nogem(), not the other way around. This is
also what i915 does. Follow suit in xe.
Reviewed-by: Michał Grzelak <michal.grzelak@intel.com>
Link: https://patch.msgid.link/afb11c4e11cc4d946f0360aaad1664d004a93f41.1781549229.git.jani.nikula@intel.com
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
The intel_opregion_setup(), intel_dram_detect(), and intel_bw_init_hw()
calls should really be in display. Move them at the beginning of
intel_display_driver_probe_noirq().
This is a completely non-functional change for xe.
For i915, the init order changes slightly:
- i915_pcode_init() will happen before intel_opregion_setup(). This
should be of no consequence.
- The intel_gvt_init() calls will happen before the mentioned
functions. There's a lot going on in intel_gvt_init(), but it does not
look like this should have dependencies on them either.
Reviewed-by: Michał Grzelak <michal.grzelak@intel.com>
Link: https://patch.msgid.link/aa37d6443516ae660c2de53aba8ca42e6e6d1a5c.1781549229.git.jani.nikula@intel.com
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Having display probe be called from i915_driver_create() is slightly
misleading, and an artefact from the past. Move the
intel_display_device_probe() call a level higher.
Use the shared PCI disable error path while at it.
Reviewed-by: Michał Grzelak <michal.grzelak@intel.com>
Link: https://patch.msgid.link/c97a8790a5cb1f6b10061286adad8148972c5b3b.1781549229.git.jani.nikula@intel.com
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Currently, xe_display_bo_framebuffer_init() unconditionally attempts to
apply XE_BO_FLAG_FORCE_WC to the buffer and rejects the FB creation with
-EINVAL if the BO is already VM_BINDed.
However, for imported dma-bufs (ttm_bo_type_sg), this check doesn't seem
to make much sense since CPU caching policy is entirely controlled by
the exporter. Plus there is no place to set this flag, in the first
place. Also this is not rejected if not yet vm_binded, but that seems
arbitrary since setting or not setting FORCE_WC should a noop either
way, at this stage, and whether it is currently VM_BINDed makes no
difference.
Currently if we run an app and offload rendering to an external dGPU,
like NV or another xe device, the dma-buf passed back to the compositor
(igpu) will be an actual external import from xe pov, and it will be
missing FORCE_WC, and if the compositor side did a VM_BIND before
turning into it into an fb the whole thing gets rejected.
So it looks like we either need to reject outright, no matter what, or
this usecase is valid and we need to loosen the restriction for sg
buffers. Proposing here to loosen the restriction.
Assisted-by: Gemini:gemini-3.1-pro-preview
Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/7919
Fixes: 44e694958b ("drm/xe/display: Implement display support")
Signed-off-by: Matthew Auld <matthew.auld@intel.com>
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Maarten Lankhorst <dev@lankhorst.se>
Cc: <stable@vger.kernel.org> # v6.12+
Reviewed-by: Maarten Lankhorst <dev@lankhorst.se>
Link: https://patch.msgid.link/20260612170501.550816-2-matthew.auld@intel.com
egpio_probe() registers each nested gpio_chip with gpiochip_add_data()
but ignores the return value. If one registration fails, probe still
returns success even though one of the chips was not published to
gpiolib.
Use devm_gpiochip_add_data() and fail probe if any chip registration
fails. This lets devres unwind already registered chips and prevents
the driver from publishing a partially initialized device.
Fixes: a1635b8fe5 ("[ARM] 4947/1: htc-egpio, a driver for GPIO/IRQ expanders with fixed input/output pins")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260624131828.94139-1-pengpeng@iscas.ac.cn
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
mvebu_gpio_probe() registers the GPIO chip with
devm_gpiochip_add_data() but ignores the return value. If registration
fails, probe continues and leaves later code operating on a GPIO chip
that was never published to gpiolib.
Return the registration error so the device fails probe cleanly.
Fixes: fefe7b0923 ("gpio: introduce gpio-mvebu driver for Marvell SoCs")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260624131645.86884-1-pengpeng@iscas.ac.cn
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
tlmm_test_rising_while_disabled() sets thread_op_remain to 10, but this
variable is only used by the threaded IRQ handler to control the number
of GPIO pin toggles. Since tlmm_test_rising_while_disabled() does not
register a threaded IRQ handler, the assignment is never used.
Similarly, tlmm_test_high() and tlmm_test_low() set intr_op_remain to 9,
but the variable is used to denote the IRQ handler the number of times
GPIO signal has to be toggled from the hard IRQ handler.
Since tlmm_test_high() and tlmm_test_low() themselves toggle the
signal and do not require the hard IRQ handler to do it, the assignment is
never used.
Remove the thread_op_remain assignment from
tlmm_test_rising_while_disabled() and intr_op_remain assignment from
tlmm_test_high() and tlmm_test_low() test cases.
This does not cause any change in functionality.
Signed-off-by: Sneh Mankad <sneh.mankad@oss.qualcomm.com>
Link: https://patch.msgid.link/20260610-tlmm_test_changes-v2-1-f34536da4717@oss.qualcomm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
The driver stores chip metadata in both the OF match table and the I2C
id table, but probe currently reads it with device_get_match_data().
That helper only returns firmware-node match data, so an I2C-id/modalias
match can leave chip_data NULL before the driver dereferences it to read
ngpio.
Use i2c_get_match_data() so the I2C id table driver_data is consumed
when firmware match data is not present.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260624053744.72612-1-pengpeng@iscas.ac.cn
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
88W9098 is a NXP Wi-Fi/BT combo chip with PCI device ID 0x2b43 under
Marvell Extended vendor ID. AW693 is a NXP Wi-Fi/BT combo chip with
PCI device ID 0x3003 under NXP/Philips vendor ID.
Add both chips to pwrseq_m2_pci_ids[] so that the pwrseq-pcie-m2 driver
can create the Bluetooth serdev device when these cards are inserted into
a PCIe M.2 Key E connector.
Both chips use "nxp,88w8987-bt" as the serdev compatible string, which
is the entry point for the btnxpuart driver. The driver identifies the
actual chip variant at runtime via chip ID auto-detection and loads the
appropriate firmware accordingly.
Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://patch.msgid.link/20260626023126.2189931-3-sherry.sun@oss.nxp.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Non-migratable faults that require devmem incorrectly jump to the 'out'
label, which squashes the error code intended to be returned to the
upper layers. Fix this by returning -EACCES instead.
Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: 4208fac3dc ("drm/xe: Add more SVM GT stats")
Cc: stable@vger.kernel.org
Signed-off-by: Matthew Brost <matthew.brost@intel.com>
Reviewed-by: Francois Dugast <francois.dugast@intel.com>
Link: https://patch.msgid.link/20260617135101.1245574-1-matthew.brost@intel.com
Add support for the GPIO controller found on Realtek DHC RTD1625 SoCs.
Unlike the existing Realtek GPIO driver (drivers/gpio/gpio-rtd.c),
which manages pins via shared bank registers, the RTD1625 introduces
a per-pin register architecture. Each GPIO line now has its own
dedicated 32-bit control register to manage configuration independently,
including direction, output value, input value, interrupt enable, and
debounce. Therefore, this distinct hardware design requires a separate
driver.
Additionally, the RTD1625 GPIO controller has a specific hardware quirk:
it fires both 'assert' and 'de-assert' interrupts simultaneously on any
edge toggle. To handle this, we utilize the polarity register to route
the requested edge (rising/falling) to the 'assert' IRQ line. The driver
then filters out the unwanted 'de-assert' interrupt in the IRQ handler
and pre-clears edge interrupts to prevent interrupt storms caused by
unhandled dropped interrupts.
Interrupt support is optional for this device, matching the dt-bindings.
If the interrupts property is not provided, the driver simply skips IRQ
initialization and operates purely as a basic GPIO controller.
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Tzuyi Chang <tychang@realtek.com>
Co-developed-by: Yu-Chun Lin <eleanor.lin@realtek.com>
Signed-off-by: Yu-Chun Lin <eleanor.lin@realtek.com>
Link: https://patch.msgid.link/20260622092335.1166876-4-eleanor.lin@realtek.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Replace "default y" with "default ARCH_REALTEK" to avoid bloating the build
for non-Realtek platforms when COMPILE_TEST is enabled on other platforms.
Signed-off-by: Yu-Chun Lin <eleanor.lin@realtek.com>
Link: https://patch.msgid.link/20260622092335.1166876-3-eleanor.lin@realtek.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Add the device tree bindings for the Realtek DHC (Digital Home Center)
RTD1625 GPIO controllers.
The RTD1625 GPIO controller features a per-pin register architecture
that differs significantly from previous generations. It utilizes
separate register blocks for GPIO configuration and interrupt control.
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Tzuyi Chang <tychang@realtek.com>
Signed-off-by: Yu-Chun Lin <eleanor.lin@realtek.com>
Link: https://patch.msgid.link/20260622092335.1166876-2-eleanor.lin@realtek.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Fix the checkpatch.pl warning by removing unnecessary braces from
a single-statement if-block in tb10x_gpio_probe().
Signed-off-by: Igor Putko <igorpetindev@gmail.com>
Link: https://patch.msgid.link/20260618155626.18751-4-igorpetindev@gmail.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Fix the checkpatch.pl warning by using 'unsigned int' instead of
the bare use of 'unsigned' for the offset parameter in
tb10x_gpio_to_irq().
Signed-off-by: Igor Putko <igorpetindev@gmail.com>
Link: https://patch.msgid.link/20260618155626.18751-3-igorpetindev@gmail.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
The driver currently uses irq_of_parse_and_map() to parse and map the
GPIO bank interrupt from the device tree node. Since the bank device is
represented by a platform_device, use the standard platform_get_irq()
API instead. This integrates cleanly with the platform device framework
and ensures proper error propagation (such as -EPROBE_DEFER).
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Marco Scardovi <scardracs@disroot.org>
Link: https://patch.msgid.link/20260607230504.35392-4-scardracs@disroot.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Currently, the driver retrieves the memory resource with
of_address_to_resource() and maps it with devm_ioremap_resource().
Since the bank device is a platform_device, simplify and modernize the
code by using devm_platform_ioremap_resource(). This also removes the
need for the local struct resource variable.
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Marco Scardovi <scardracs@disroot.org>
Link: https://patch.msgid.link/20260607230504.35392-3-scardracs@disroot.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
skb_gso_segment() leaves the segment list head with ->prev pointing at
the last segment, an invariant validate_xmit_skb_list() relies on when
it sets its tail pointer (tail = skb->prev).
When validate_xmit_xfrm() walks a GSO list and some segments are stolen
by async crypto (->xmit() returns -EINPROGRESS), those segments are
unlinked from the list but the head ->prev is never updated. If the
last segment is the one stolen, the returned head still has ->prev
pointing at it, even though it is now owned by the crypto engine and may
be freed. validate_xmit_skb_list() later does tail->next = skb, writing
through that stale pointer -- a use-after-free.
Repoint skb->prev at the last retained segment before returning.
Fixes: f53c723902 ("net: Add asynchronous callbacks for xfrm on layer 2.")
Signed-off-by: Petr Wozniak <petr.wozniak@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
validate_xmit_xfrm() returns NULL both when a packet is dropped and
when it is stolen by async crypto (-EINPROGRESS from ->xmit()).
Callers cannot distinguish the two cases.
f53c723902 ("net: Add asynchronous callbacks for xfrm on layer 2.")
changed the semantics of a NULL return from "dropped" to "stolen or
dropped", but __dev_queue_xmit() was not updated. On virtual/bridge
interfaces (noqueue qdisc) __dev_queue_xmit() initialises rc=-ENOMEM
and jumps to out: when skb is NULL, returning -ENOMEM to the caller
even though the packet will be delivered correctly via xfrm_dev_resume().
Return ERR_PTR(-EINPROGRESS) from validate_xmit_xfrm() for the async
case so callers can tell it apart from a real drop. Update
__dev_queue_xmit() to handle ERR_PTR(-EINPROGRESS) from
validate_xmit_skb() correctly. Update validate_xmit_skb_list() to
use IS_ERR_OR_NULL() so that ERR_PTR(-EINPROGRESS) is not mistakenly
added to the transmitted list.
Fixes: f53c723902 ("net: Add asynchronous callbacks for xfrm on layer 2.")
Suggested-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Petr Wozniak <petr.wozniak@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
A malformed USB device can provide a vendor-specific interface without
any endpoint descriptors. fcp_find_fc_interface() currently selects the
first vendor-specific interface and reads endpoint 0 from it, without
checking whether the interface actually has any endpoints.
When bNumEndpoints is zero, no endpoint array is allocated for the parsed
alternate setting, so get_endpoint(..., 0) yields an invalid endpoint
descriptor pointer. Dereferencing it through usb_endpoint_num() then
triggers a NULL pointer dereference.
Skip vendor-specific interfaces that do not have any endpoints.
Fixes: 46757a3e7d ("ALSA: FCP: Add Focusrite Control Protocol driver")
Reported-by: Jiaming Zhang <r772577952@gmail.com>
Closes: https://lore.kernel.org/lkml/CANypQFb1EHj0xX8bA1WxSOSK-5xca6ZNKzOQcp12=s=puY7VFw@mail.gmail.com/
Signed-off-by: Jiaming Zhang <r772577952@gmail.com>
Link: https://patch.msgid.link/20260625134933.425785-1-r772577952@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The laptop has a microphone mute LED on the F4 key, but it was not
taken in mind when the previous quirk was added
in commit 00e44a68ef ("ALSA:
hda/realtek: Add quirk for Acer Nitro ANV15-41").
Replace ALC2XX_FIXUP_HEADSET_MIC with ALC245_FIXUP_ACER_MICMUTE_LED,
which enables the LED and chains the previous quirk for the headset
microphone.
Fixes: 00e44a68ef ("ALSA: hda/realtek: Add quirk for Acer Nitro ANV15-41")
Signed-off-by: Oleg Kucheryavenko <oleg.kucheryavenko2018@gmail.com>
Link: https://patch.msgid.link/20260625134955.27465-1-oleg.kucheryavenko2018@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Mostly irrelevant for authentic Synaptics touchscreens, but very important
for applying workarounds to cheap TS knockoffs.
These knockoffs work well with the downstream driver, and since the user
has no way to distinguish them, later in this patch set, we introduce
workarounds to ensure they function as well as possible.
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: David Heidelberg <david@ixit.cz>
Link: https://patch.msgid.link/20260523-synaptics-rmi4-dt-v2-1-0645122babdc@ixit.cz
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
We've got a good collection of device specific fix here, plus a couple
of stand out things:
- Richard fixed some special cases with the new device_link creation
by more gracefully handling any errors during creation.
- Charles did some light refactoring of the SoundWire interfaces to
fix some persistent randconfig issues that people kept running into.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmo9XtYACgkQJNaLcl1U
h9CvHAf/asLvScBxUkGKP76NoX7+czVbpfxH+yfJ6qavcOzvi+hqHlIGh/9vpFSW
GENKI/z/g/9x1WRfwODuBdvBvfkvMGfdUKZoly1zpEICML9cDwvTHwh35TkrwVTf
/cSawS/CByv2ppdeoNe4bBTTSqf4PC0tWo3tRHR2f/LTuSAyac+eJp2PGpRoofBn
te//kJBNSOGLBxJuikOcsf6xfHzB5Rnl5QMXEk1wts5Y51NEpx0PixNbQqJ7Zvee
4jGbytul9RlS26QNM6O5qLGiQy3SpECadwvtMUiYW3jn8/YtSbl760sCeGQXjaRE
7AXiqTVbFRktJ0ffg25eeD4twOE2dQ==
=NKjz
-----END PGP SIGNATURE-----
Merge tag 'asoc-fix-v7.2-merge-window' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus
ASoC: Fixes for v7.2
We've got a good collection of device specific fix here, plus a couple
of stand out things:
- Richard fixed some special cases with the new device_link creation
by more gracefully handling any errors during creation.
- Charles did some light refactoring of the SoundWire interfaces to
fix some persistent randconfig issues that people kept running into.
When bpf_check() allocates env->insn_aux_data successfully but later
fails to allocate env->succ, it jumps directly to err_free_env.
The existing vfree(env->insn_aux_data) sits before the err_free_env
label, so that direct jump bypasses it and leaks insn_aux_data.
Move vfree(env->insn_aux_data) into err_free_env so all early and late
exit paths release it consistently.
Fixes: 2f69c56854 ("bpf: make bpf_insn_successors to return a pointer")
Signed-off-by: KaFai Wan <kafai.wan@linux.dev>
Reviewed-by: Anton Protopopov <a.s.protopopov@gmail.com>
Link: https://lore.kernel.org/r/20260624123536.114757-1-kafai.wan@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Ihor Solodrai says:
====================
Modernize resolve_btfids selftest
This series updates resolve_btfids selftests to use latest selftest
helpers API and add kfunc set testing.
This series was split from a bigger series [1]. It's general selftest
improvements that don't have to be entangled with resolve_btfids
development, and makes the main series a bit smaller.
[1] https://lore.kernel.org/bpf/20260601221805.821394-1-ihor.solodrai@linux.dev/
---
v1->v2:
* add another kfunc set in reverse order and check_kfunc_set()
helper to ensure proper testing of BTF ID sort (Eduard, patch #4)
* nit: restore a dropped break (Eduard, patch #2)
v1: https://lore.kernel.org/bpf/20260617210619.1562858-1-ihor.solodrai@linux.dev/
v0->v1:
* various nits from Jiri, Andrii and Emil
* in patch #3 (that adds gcc pragma) definitions are moved such that
.local BTF_ID_* containers are grouped together and we have a
single pragma scope
====================
Link: https://patch.msgid.link/20260624005546.1818483-1-ihor.solodrai@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Extend the resolve_btfids selftest to cover kfunc sets defined with
BTF_KFUNCS_START/BTF_KFUNCS_END.
The test verifies that resolve_btfids correctly processes BTF_ID_FLAGS,
resolves function IDs, and checks the kfunc set is sorted.
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20260624005546.1818483-5-ihor.solodrai@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
TL;DR
On aarch64 with gcc toolchain, when test_progs is linked as a PIE,
reads of BTF ID array by C name return garbage because the GNU
assembler on aarch64 unconditionally folds .local symbol references
into section+addend form, and GOT slots cannot carry an addend per the
AArch64 ELF spec.
Fix by marking the test's BTF ID objects with hidden visibility, which
makes gcc emit a direct access that bypasses the GOT entirely.
Details below.
The subsequent patches adding kfunc checks to resolve_btfids test may
cause test failures on aarch64 / gcc-15:
test_resolve_btfids:FAIL:kfunc_set_flags actual 13 != expected 1
test_resolve_btfids:FAIL:kfunc_set_cnt actual 0 != expected 4
The test defines its BTF ID sets with the same macros as the kernel
and reads them back directly by C name (in the same way as the kernel
code does).
test_kfunc_set is a .local symbol emitted into .BTF_ids by inline asm
and declared to the compiler as a plain default-visibility
extern, that is:
extern struct btf_id_set8 test_kfunc_set;
Depending on the build environment, test_progs may be linked as a
position-independent executable (for example, gcc defaults to -fpie
[1]). In a PIE, taking the address of a default-visibility extern is
routed through the GOT (Global Offset Table) [2].
The GNU assembler's adjust_reloc_syms() pass (gas/write.c [3])
replaces references to local symbols with the corresponding section
symbol, folding the symbol's offset into the relocation addend. On
aarch64 this conversion is unconditional: tc_fix_adjustable() is
defined to 1 for all fixups (gas/config/tc-aarch64.h [4]), so even
GOT-generating relocations are subject to it. The resulting object
file therefore contains:
R_AARCH64_ADR_GOT_PAGE .BTF_ids + 0x54
R_AARCH64_LD64_GOT_LO12_NC .BTF_ids + 0x54
However, the AArch64 ELF specification mandates that GOT-generating
relocations must have a zero addend [5]. The +0x54 is therefore not
honored: the linker creates a GOT slot pointing at the .BTF_ids base,
and every access through that slot reads offset 0 instead of 0x54.
This is purely a read-side problem, specific to the PIE test binary on
aarch64 with gcc toolchain. resolve_btfids patches the set header
correctly and the .BTF_ids bytes in test_progs are correct. vmlinux is
unaffected because it is built with -fno-PIE [6] and reaches .BTF_ids
with direct, addend-preserving relocations rather than the GOT. clang
is unaffected because LLVM's assembler retains the original symbol for
GOT relocations instead of converting to section+addend [7].
To mitigate this issue, mark the test's .local BTF ID objects
(test_list_local and test_set) hidden with a visibility pragma so that
gcc treats them as non-interposable and emits a direct access instead
of a GOT load. test_list_global is .globl, which the assembler does not
fold into section+addend, so it is left at default visibility. This
keeps the natural by-name access, works in both PIE and non-PIE builds,
and needs no change to the BTF_ID macros or resolve_btfids.
[1] https://gcc.gnu.org/onlinedocs/gnat_ugn/Position-Independent-Executable-PIE-Enabled-by-Default-on-Linux.html
[2] https://gcc.gnu.org/wiki/Visibility
[3] https://sourceware.org/git/?p=binutils-gdb.git;a=blob;f=gas/write.c#l922
[4] https://sourceware.org/git/?p=binutils-gdb.git;a=blob;f=gas/config/tc-aarch64.h#l279
[5] https://github.com/ARM-software/abi-aa/blob/main/aaelf64/aaelf64.rst#5733relocation-operations
[6] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Makefile?h=v7.1-rc6#n593
[7] 4b3bc46d1d/llvm/lib/MC/ELFObjectWriter.cpp (L1213-L1224)
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
Link: https://lore.kernel.org/r/20260624005546.1818483-4-ihor.solodrai@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Refactor resolve_btfids test in order to:
* use newer ASSERT_* macros instead of CHECK
* extend the lifetime of loaded BTF to enable additional checks
* cleanup unused/unnecessary code
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
Link: https://lore.kernel.org/r/20260624005546.1818483-3-ihor.solodrai@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Sync tools/include/linux/btf_ids.h with include/linux/btf_ids.h so
tools-side code can use BTF_ID_FLAGS(), BTF_SET8_START(), and
BTF_KFUNCS_START().
Keep the tools copy's existing compiler header dependency:
tools/include/linux/compiler.h already provides __maybe_unused and
tools/include/linux/compiler_attributes.h does not exist.
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
Link: https://lore.kernel.org/r/20260624005546.1818483-2-ihor.solodrai@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Nuoqi Gui says:
====================
bpf: Mask pseudo pointer values in verifier logs
Verifier log printing already hides ldimm64 immediates for map FD and
map value pseudo sources when pointer leaks are not allowed. The same
print path also sees rewritten immediates for BPF_PSEUDO_MAP_IDX,
BPF_PSEUDO_MAP_IDX_VALUE, and BPF_PSEUDO_BTF_ID, but those sources were
not included in the pointer classification.
Extend the existing masking so all pointer-producing ldimm64 pseudo
sources print as 0x0 when allow_ptr_leaks is false.
Patch 1 extends the disassembler-side masking.
Patch 2 adds verifier selftest coverage for pseudo-BTF ksym logs.
Signed-off-by: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
---
Changes in v2:
- Replace the CAP_BPF gate with verifier-log masking in print_bpf_insn().
- Also mask BPF_PSEUDO_MAP_IDX and BPF_PSEUDO_MAP_IDX_VALUE immediates.
- Update selftests to check masked pseudo-BTF ksym logs.
- Link to v1: https://patch.msgid.link/20260620-f01-13-pseudo-btf-id-cap-bpf-v1-0-f950f69fe60c@mails.tsinghua.edu.cn
====================
Link: https://patch.msgid.link/20260623-f01-13-pseudo-btf-id-cap-bpf-v2-0-a190ebb8f3e2@mails.tsinghua.edu.cn
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Add verifier_unpriv coverage for a raw socket-filter load of the
bpf_prog_active typed ksym. The test verifies that the unprivileged load
remains accepted and that the verbose verifier log prints the ldimm64
immediate as 0x0 instead of exposing a nonzero kernel address.
Signed-off-by: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
Link: https://lore.kernel.org/r/20260623-f01-13-pseudo-btf-id-cap-bpf-v2-2-a190ebb8f3e2@mails.tsinghua.edu.cn
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
print_bpf_insn() masks ldimm64 immediates for pointer-bearing pseudo
sources when pointer leaks are not allowed, but the mask only covers
BPF_PSEUDO_MAP_FD and BPF_PSEUDO_MAP_VALUE.
BPF_PSEUDO_MAP_IDX, BPF_PSEUDO_MAP_IDX_VALUE, and BPF_PSEUDO_BTF_ID can
also be resolved to kernel pointer values before the verifier log prints
the instruction. Include them in the existing pointer classification so
the log prints 0x0 instead of the rewritten address.
Fixes: 4976b718c3 ("bpf: Introduce pseudo_btf_id")
Fixes: 387544bfa2 ("bpf: Introduce fd_idx")
Signed-off-by: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
Link: https://lore.kernel.org/r/20260623-f01-13-pseudo-btf-id-cap-bpf-v2-1-a190ebb8f3e2@mails.tsinghua.edu.cn
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
