mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-11-10 20:48:12 +00:00
1,481,701 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Namjae Jeon
|
feca5e70fc |
ksmbd: rate limit unmapped SID errors
A client can include many structurally valid but unmapped SIDs in a DACL.
Logging every mapping failure lets one request generate hundreds of kernel
error messages.
Rate limit the message to prevent an authenticated client from flooding
the kernel log.
Fixes:
|
||
|
Namjae Jeon
|
c61dc7b1b4 |
ksmbd: propagate DACL parsing errors
parse_dacl() silently accepts truncated ACEs and allocation failures,
allowing set_info_sec() to continue with an incomplete ACL conversion.
Return parsing and allocation errors to parse_sec_desc() so malformed
security descriptors are rejected before inode attributes or ACL xattrs
are updated.
Fixes:
|
||
|
Namjae Jeon
|
73f860489e |
ksmbd: zero pipe read compound padding
Compound response handling extends the last response iov to an eight-byte
boundary.
smb2_read_pipe() allocates only the payload size, so the alignment padding
can expose up to seven bytes of uninitialized kernel heap memory.
Allocate the aligned size and clear the unused tail before pinning the
response buffer.
Fixes:
|
||
|
Namjae Jeon
|
d12168084c |
ksmbd: safely drain sessions during logoff
SMB3 multichannel allows requests for one session to run on multiple
connections. Wait for all channels bound to a session before freeing
shared session objects.
A deferred byte-range lock remains counted as a running request and only
wakes when its file closes. Wake blocked locks during the drain without
unpublishing or modifying their file objects. Synchronous CANCEL requests
must invoke their cancellation callback to wake pending operations, while
CHANGE_NOTIFY completion remains specific to the asynchronous path.
Serialize session teardown with channel registration and previous-session
cleanup, and use atomic work-state transitions so LOGOFF, CANCEL, and
connection teardown invoke cancellation callbacks only once.
Fixes:
|
||
|
Namjae Jeon
|
5c944895a9 |
MAINTAINERS: Update the KSMBD entry
Steve French passed away recently. He was a long-time maintainer of Linux's SMB support and will be greatly missed. Update the KSMBD entry to no longer list Steve French as a maintainer. Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> |
||
|
Namjae Jeon
|
edcd92df5e |
MAINTAINERS: Add Paulo Alcantara as an SMBDIRECT co-maintainer
Steve French passed away recently. He was a long-time maintainer of Linux's SMB support and will be greatly missed. Add Paulo Alcantara as a co-maintainer of SMBDIRECT. Acked-by: Paulo Alcantara <pc@manguebit.org> Signed-off-by: Paulo Alcantara <pc@manguebit.org> Acked-by: Stefan Metzmacher <metze@samba.org> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> |
||
Aleksandr Khromov
|
db2267b27c |
ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION
smb2_get_info_filesystem() reports 56 bytes for FS_POSIX_INFORMATION,
that is the whole of FILE_SYSTEM_POSIX_INFO, but never assigns
FileSysIdentifier. Those eight bytes go to the client as they are found
in the response buffer.
The buffer is zeroed on allocation, so a standalone request leaks
nothing. A compound request can leak: the offset of the next response
is advanced by the length pinned for the previous one, so a reply that
was written into the buffer and then dropped in favour of the short
error response of smb2_set_err_rsp() stays there, and the next reply is
laid over it with only the header cleared.
Report the file system id statfs() returned, which is what the field is
for. FileSysIdentifier is __le64 and f_fsid is a pair of ints, so
assemble the value first, val[0] as the low half, and convert it on the
way out.
Fixes:
|
||
|
Aleksandr Khromov
|
c0cd3fc682 |
ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION
smb2_get_info_filesystem() reports 48 bytes for FS_CONTROL_INFORMATION,
that is the whole of struct smb2_fs_control_info, but never assigns
FileSystemControlFlags. Those four bytes go to the client as they are
found in the response buffer.
The buffer is zeroed on allocation, so a standalone request leaks
nothing. A compound request can leak: the offset of the next response
is advanced by the length pinned for the previous one, so a reply that
was written into the buffer and then dropped in favour of the short
error response of smb2_set_err_rsp() stays there, and the next reply is
laid over it with only the header cleared.
ksmbd does not implement quota tracking, so report no control flags.
Fixes:
|
||
|
Aleksandr Khromov
|
399aa12450 |
ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in
smb2_get_info_filesystem() reports 64 bytes for FS_OBJECT_ID_INFORMATION,
that is the whole of struct object_id_info, but writes only 46 of them:
- objid[] is 16 bytes, and when the volume UUID is not available only
sizeof(stfs.f_fsid) (8) bytes are copied into it;
- extended_info.version_string[] is STRING_LENGTH (28) bytes, and only
strlen("1.1.0") (5) bytes are copied into it.
The response buffer is zeroed on allocation (kvzalloc() in
smb2_allocate_rsp_buf()), so for a standalone request the remaining 31
bytes are zero. In a compound request they need not be. The offset of
the next response is advanced by the length pinned for the previous one,
so if a preceding command wrote its reply into the buffer and then
failed, smb2_set_err_rsp() pins only the short error response and the
next reply lands inside the area that has already been written. Only
the header is cleared there:
memset((char *)rsp_hdr, 0, sizeof(struct smb2_hdr) + 2);
The client then receives up to 31 bytes of a response it was not meant
to see, including one that failed with an access denied error.
Clear the structure before filling it in. As a side effect
version_string is now NUL terminated.
Fixes:
|
||
Kiran Kumar K
|
1376afc766 |
octeontx2-af: fix CN20K default MCAM rule removal on port cleanup
npc_mcam_free_all_entries() disables every MCAM entry mapped to a
port before freeing it. On CN20K, that also disables the default
broadcast, multicast, promiscuous, and unicast rules, which causes
packet drops when all rules are removed per port.
Only disable and free non-default entries. Leave CN20K default rules
enabled when freeing the remaining port entries.
Fixes:
|
||
Maciej Fijalkowski
|
a8455260b2 |
ipvlan: unregister upper devices outside pnodes_lock
syzbot reported the following circular locking dependency:
xs->mutex -> netdev lock -> pnodes_lock -> net->xdp.lock -> xs->mutex
The pnodes_lock -> net->xdp.lock edge is recorded when
ipvlan_device_event(NETDEV_UNREGISTER) calls unregister_netdevice_many()
while holding pnodes_lock. A nested NETDEV_UNREGISTER notification for
an IPvlan device enters xsk_notifier(), which acquires net->xdp.lock.
Keep pnodes_lock only while marking the upper devices as dying, removing
them from port->ipvlans, and queueing them for unregistration. Once the
devices have been detached from the protected list, release pnodes_lock
before unregister_netdevice_many() invokes notifier callbacks.
The port remains alive across unregistration because
ipvlan_device_event() holds the reference acquired by ipvlan_port_get().
The dying flag prevents a concurrent ->dellink() callback from deleting a
queued device again.
Fixes:
|
||
Baul Lee
|
4aa61c88b4 |
vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del()
vxlan_mdb_is_valid_source(), which validates MDBE_ATTR_SOURCE and every
MDBE_ATTR_SRC_LIST member, accepts the all-zeros address.
A source list is only accepted on a (*, G) entry, whose source is the
all-zeros address, and for each member of the list an (S, G) entry is
derived from it by substituting the source. Entries are keyed by a plain
memcmp() of struct vxlan_mdb_entry_key, so if MDBE_ATTR_SOURCE is present
and holds the all-zeros address and the source list holds it as well, the
derived (S, G) key is byte-identical to the (*, G) key and resolves to the
same entry. Omitting MDBE_ATTR_SOURCE is not equivalent, as the key is
then left with a zero address family.
vxlan_mdb_remote_src_del() removes the forwarding entry of a source before
freeing the source entry:
vxlan_mdb_remote_src_fwd_del(vxlan, group, remote, &ent->addr);
vxlan_mdb_remote_src_entry_del(ent);
With the keys aliased, the first call deletes the remote of the entry that
owns 'ent' instead of a separate (S, G) entry, and frees 'ent'. The second
call then runs on the freed entry, and its hlist_del() reads ->pprev and
->next out of it and writes through them.
Adding the (*, G) entry with NLM_F_REPLACE and no source list marks the
all-zeros source for deletion and reaches this from the sweep at the end
of vxlan_mdb_remote_srcs_replace().
BUG: KASAN: slab-use-after-free in __vxlan_mdb_add+0x1cd/0xd70
Read of size 8 at addr ffff888102852500 by task poc/84
__vxlan_mdb_add+0x1cd/0xd70
vxlan_mdb_add+0xc0/0x140
rtnl_mdb_add+0x157/0x2a0
rtnetlink_rcv_msg+0x207/0x5a0
Allocated by task 84:
__kmalloc_cache_noprof+0x153/0x360
vxlan_mdb_remote_srcs_add+0x2eb/0x440
__vxlan_mdb_add+0x803/0xd70
Freed by task 84:
kfree+0x14c/0x3b0
vxlan_mdb_remote_del+0x129/0x1a0
__vxlan_mdb_del+0x4f/0xe0
vxlan_mdb_remote_src_fwd_del.isra.0+0x162/0x1b0
__vxlan_mdb_add+0x1c5/0xd70
The MDB operations are netns-scoped, so an unprivileged user can perform
them in a new user and network namespace.
Reject the all-zeros address in vxlan_mdb_is_valid_source(), which covers
both call sites. A (*, G) entry is expressed by omitting the source, so
nothing legitimate is refused.
Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
Fixes:
|
||
Charles Vosburgh
|
6cfc1b90cb |
sctp: validate chunk length in the inqueue parser
SCTP chunks always include a four-byte generic header, but sctp_inq_pop() currently accepts shorter declared lengths. A zero-length chunk leaves chunk_end at the current header. When ASCONF is covered by the association's SCTP-AUTH policy, sctp_assoc_bh_rcv() can continue before the state machine performs its normal chunk-length check. sctp_inq_pop() then returns the same malformed chunk repeatedly and the receive softirq can lock up. A remote SCTP peer can trigger this after establishing an association on a kernel built with CONFIG_IP_SCTP and configured with net.sctp.addip_enable=1 and net.sctp.auth_enable=1. The reproducer did not require application credentials, a shared SCTP AUTH key, or net.sctp.addip_noauth_enable=1. On commit |
||
James Nugraha
|
ac8d6b28d4 |
net: amd-xgbe: discard rx packets with bad FCS
amd-xgbe driver currently sets the MAC_RCR.DCRCC bit whenever
RX is enabled. This disables hardware FCS validation, causing packets
with bad FCS to be accepted unconditionally.
This change unsets DCRCC so that packets with bad FCS will be dropped,
in-line with typical behaviours of many other network controllers.
Tests:
- Verified that packets with bad FCS are now dropped.
- Verified that receiving packets with bad FCS will increment the
`rx_crc_errors` counter.
Fixes:
|
||
Xuanqiang Luo
|
ac08d183da |
raw: annotate disconnect-side IPv4 match writers
raw_v4_match() reads inet_daddr, inet_rcv_saddr and sk_bound_dev_if locklessly under RCU. Bind and connect writers are annotated, but __udp_disconnect() still clears the same fields using plain stores. Commit |
||
Henry Martin
|
2cb0b0b1ed |
sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration
sctp_verify_asconf() walks ASCONF-ACK parameters with
sctp_walk_params(), which advances by SCTP_PAD4(length), while the
consumer sctp_get_asconf_response() iterates the same parameters
advancing by the raw length, without padding. A single odd-length
parameter desynchronises the two walks and makes the consumer
interpret attacker-controlled bytes at a misaligned offset.
When those bytes yield a length of zero, the while loop over
asconf_ack_len makes no progress, spinning forever in softirq
context, and the watchdog reports a soft lockup. All reads stay
within the received skb, so the lockup is a pure remote denial of
service. A remote peer can trigger it with a crafted ASCONF-ACK on
an ADD-IP enabled association with an outstanding ASCONF (RFC 5061
section 4.1.2 requires the chunk to be authenticated, but the
predefined empty key id 0 allows the peer to compute the same
association HMAC from publicly exchanged parameters, so the gate
does not help).
The SCTP_PARAM_ERR_CAUSE case of sctp_verify_asconf() also performs
no length check, letting a parameter without a complete error
header reach the consumer, which reads errhdr.cause past the end of
the parameter, an out-of-bounds read.
Reject SCTP_PARAM_ERR_CAUSE parameters shorter than
sizeof(struct sctp_addip_param) + sizeof(struct sctp_errhdr) at the
verifier, and advance the consumer iterator with the same padding
rule as the verifier to keep the two walks in lockstep. The verifier
change guarantees a complete error header in every ERR_CAUSE
parameter the consumer can see, so the consumer's asconf_ack_len
check is dropped and it returns err_param->cause directly. The
consumer padding fix is still required because odd lengths remain
valid for SCTP_PARAM_ERR_CAUSE per RFC 5061.
The issue was found by ZeroHive, a vulnerability hunting agent at
Tencent Yunding Lab.
Fixes:
|
||
Linus Torvalds
|
cee9395acd | Linux 7.3-rc1 v7.3-rc1 | ||
|
Linus Torvalds
|
78bb208b99 |
i2c-fixes for v7.3-rc1
Fixes mainly for teardown and resource handling, runtime PM and hardware-specific controller issues. - core: fix debugfs use-after-free when removing the adapter - designware: apply interrupt mask quirk for HJMC3001 - imx-lpi2c: avoid target accesses on master-only controllers - mux: release channel node when adapter registration fails - qcom-cci: fix autosuspend and runtime PM cleanup on removal - qcom-geni: fix timing parameters for 32 MHz clock -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQScDfrjQa34uOld1VLaeAVmJtMtbgUCapRFYgAKCRDaeAVmJtMt bpVsAQDz0v5x5AdiZQS224oErSA6vfd7ztavFkh8gg3tR+PgogEAhhV+xChRle4U DTwvfC2DYuzxJxYpuQbMGdvu39cuTgA= =t/+3 -----END PGP SIGNATURE----- Merge tag 'i2c-fixes-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux Pull i2c fixes from Andi Shyti: "Fixes mainly for teardown and resource handling, runtime PM and hardware-specific controller issues: - fix debugfs use-after-free when removing the adapter - designware: apply interrupt mask quirk for HJMC3001 - imx-lpi2c: avoid target accesses on master-only controllers - mux: release channel node when adapter registration fails - qcom-cci: fix autosuspend and runtime PM cleanup on removal - qcom-geni: fix timing parameters for 32 MHz clock" * tag 'i2c-fixes-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux: i2c: core: fix debugfs UAF on adapter removal i2c: imx-lpi2c: avoid accessing target registers on master-only controllers i2c: qcom-cci: fix autosuspend cleanup i2c: designware: Enable interrupt mask workaround for HJMC3001 i2c: qcom-geni: update frequency table to fix timing parameters i2c: mux: Fix channel node leak on adapter add failure |
||
|
Linus Torvalds
|
eea8bdcb59 |
Coccinelle patches for Linux v7.3
Sang-Heon Jeon <ekffu200098@gmail.com> has cleaned up a number of the semantic patches in the scripts/coccinelle directory, particularly with respect to functions that no longer exist in the kernel. He and I have also done some reorganizations that improve performance. I eliminatd some false positives. 相浦彰 / AIURA，AKIRA <akira.aiura.bj@hitachi.com> fixed an out of date URL. -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEnGZC8gbRfLXdcpA0F+92B3f5RZ0FAmqUJzoACgkQF+92B3f5 RZ1ZKA//XmJPmm4VapiaWb3Kd9R11JXEqUrkDMkexkwpa+844xC6XfUKsAJTsxff 18UksaPH+GQyLInWtu271uPDL+3X/yXbSU0iQA675XVQsG9Bz9MJ3R7tDcmFiJR9 Oflm7VwlG0QFVk1HVJRtY5+kfZ5ob54CZ82QltHCRIrPKQJ9JWqS8ffnNggLQu91 D079YK9gL/SqTXsWSUg+oU/TN5zILAZ0XDAdqN5THuMtq3ADurlKoPFeGHTiXdDs rFlmbu3XX40aL06qun6B4WLD/86fpvaVQ9NwqJnTEoTA4GNwENY/wYY9GJdsWa7h N7bTB7R8g441orRx0CeGyFBJkNocg4V5ImT42aGtsxfgIxDvFPxcfVg3TnCSbO8/ SYvvnzaIzdYkx41IIIHPLZHNbW96kbT8rI5s3DrkUoKvMePnCtrV/6bR1QFBHdiw I5/q4yhFjwvRh5ffiU5McqlYcM4NK1s3lHD+fk6oKf8XOgPzo6b1nBFky+P4Whw+ Sy/uBM2TrafRlvRrctz0EdhKSQede/Q7OVFcJKOvUUwnYKRqmrM5qPIQvDg6s4zZ 7NQWK7SsfWFKFUd1mljqN9Pe//fLIxfHKqyQwWtoPJwPmVaKSUTF/UDHu5HR4VVn wd4MxZj1ck3Dv/mtvAcJNxKw3+imD+284wPkpsrityMDpdYRHoc= =AgiL -----END PGP SIGNATURE----- Merge tag 'cocci-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux Pull Coccinelle updates from Julia Lawall: - Clean up a number of the semantic patches in the scripts/coccinelle directory, particularly with respect to functions that no longer exist in the kernel (Sang-Heon Jeon) He and I have also done some reorganizations that improve performance. - Eliminate some false positives (me) - Fix an out of date URL (相浦彰) * tag 'cocci-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux: coccinelle: ifnulldev_put: update error message coccinelle: ifnulldev_put: update outdated helper names coccinelle: atomic_as_refcounter: drop atomic_long_dec_and_lock coccinelle: kfree_mismatch: drop vmalloc_exec coccinelle: pool_zalloc-simple: drop the pci_pool_alloc rules coccinelle: zalloc-simple: drop the kmem_alloc rules coccinelle: alloc_cast: drop removed allocators coccinelle: remove obsolete pci_free_consistent.cocci scripts: coccinelle: devm_free: reduce false positives coccinelle: misc: struct_size: drop unneeded parentheses coccinelle: mini_lock: improve performance when searching loops coccinelle: api: check for macro context coccinelle: update Coccinelle website URL coccinelle: misc: minmax: avoid unhelpful isomorphisms coccinelle: misc: minmax: check for the presence of if cases coccinelle: misc: minmax: drop unneeded parentheses coccinelle: misc: minmax: improve performance when no candidate exists coccinelle: double_lock: improve performance when no double lock exists |
||
Darrick J. Wong
|
cbb4c6d9af |
CREDITS/mailmap: add some info about Darrick J. Wong
Add myself to CREDITS because apparently I've never done that; and update mailmap so that all my old email addresses get remapped to the kernel.org redirector. Signed-off-by: "Darrick J. Wong" <djwong@kernel.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> |
||
|
Linus Torvalds
|
a23cbb0574 |
- Fix UM build regression caused by the removal of the UM
specific timex.h header. (Thomas Weißschuh) Signed-off-by: Ingo Molnar <mingo@kernel.org> -----BEGIN PGP SIGNATURE----- iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmqTmUsRHG1pbmdvQGtl cm5lbC5vcmcACgkQEnMQ0APhK1iFihAAtSFpL6WKwu+eTTdTn/J41OCx6SWMw79O GRXfHX7HKVS52IhEnh3OWDVcMAqhNXe8oP/JwzBn4EuCv2LrsuBxpiTp6Bq4Y0Da Ws16Nb0CRH966L9E6z0kMZQBMsKrLGXGOE+/t9gzHpkTBzJ4a7Dzh1TZX2YudhRO lrnS+7azTb5XyshyMDo0C43AH6rUpt1ffYUz0MyACkbWPzQge42O3neN/2gKMDjq TM128Man3V4AX6K/9hC4vnvDNYdHsUqxHhc81826wVX7brF74uoYSiogn/AZK7RY CK9GQmAv7xo7AJTqe9AKt5dCy/cvVLp4vLqVYMQMGaFB05PF+1EMY69xrAkWnS4k 1cYnU0hCHN/86XOShe1s0101UPD6ZxYo/WlU53VGRJMNi7Dm5OMFFOGzAK9WfTIB 4UyOwuzq/505aA8dr5+Hk5PYikDvDXOA/zmqewAMonDrlTWhPBxWV6k+Dhks8WOt MIgjoX8wFlA7h0SUQH12XN/pxEBTgNl4P4k8YyHqVwOKN/XPZJ6XPGt2nIc8hnVc m3wHxP27x/68Ugpz1a8oADkC6lhDFgTE5XO6mmpfHKaVp/Fwdjrg8atwltHbixiV 4mo5ZlcI759lN40EBJM4QbGRP8k5TjRGgkUnv7B2qpBBgAvPnCnlMZo0871J6VVz 0CeKb6kxT+k= =eGi8 -----END PGP SIGNATURE----- Merge tag 'timers-urgent-2026-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fix from Ingo Molnar: - Fix UM build regression caused by the removal of the UM specific timex.h header (Thomas Weißschuh) * tag 'timers-urgent-2026-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: um: Use asm-generic/timex.h over the host architecture one |
||
Frank Sorenson
|
fe39cd9d48 |
cifs: don't update i_size in cifs_do_truncate without a cached handle
If find_writable_file() returns null, cifs_file_flush will return
0 without issuing set_file_size, and the outer 'if (!rc)' block
will set i_size to 0 before telling the server to truncate. If
the cifs_open() then fails, the inode will have size 0, while
the server file is unchanged.
Move the netfs_resize_file() and cifs_setsize() into the 'if
(cfile)', so they only run after a successful set_file_size.
In the no-handle else branch, evict stale pages with
truncate_inode_pages before the O_TRUNC open to dispose of old
cache pages, and let the open response set the i_size.
Fixes:
|
||
|
Frank Sorenson
|
1dac61e2c2 |
smb: client: fix heap overflow in cifs_do_set_acl()
cifs_set_acl() validates ACL size using posix_acl_xattr_size():
4 + (count * 8) // 4-byte header + 8 bytes per ACE
cifs_do_set_acl() then calls posix_acl_to_cifs() to write the CIFS
wire format into the same buffer:
6 + (count * 10) // 6-byte header + 10 bytes per ACE
An ACL that passes the xattr-based check in cifs_set_acl() can
overflow the heap when posix_acl_to_cifs() writes the larger CIFS
format.
Validate the CIFS format size against the remaining buffer space and
USHRT_MAX before converting--data_count is __u16, so sizes above
USHRT_MAX truncate the on-wire packet length, causing the server to
apply a partial ACL. Replace MaxDataCount = 1000 with
min(CIFSMaxBufSize, USHRT_MAX).
Fixes:
|
||
Paulo Alcantara
|
6949939586 |
smb: client: fix multiuser mount with krb5
Customer reported that they could no longer mount their SMB shares
with multiuser mount option and krb5. Turned out that the client
wasn't duplicating username option when creating multiuser
connections, therefore failing to retrieve credentials as
cifs.upcall(8) couldn't find them in keytab.
Fix this by duplicating username option (if set) from original fs
context before creating multiuser connections with krb5.
Reproducer:
```
$ ktutil
ktutil: add_entry -password -p testuser -k 1 -e aes256-cts
Password for testuser@ZELDA.TEST:
ktutil: write_kt /etc/krb5.keytab
ktutil: quit
$ klist -ke
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- ----------------------------------------------------------------
1 testuser@ZELDA.TEST (aes256-cts-hmac-sha1-96)
$ mount.cifs //w22-root2/scratch /mnt/1 -o \
uid=1000,sec=krb5,username=testuser@ZELDA.TEST,multiuser
mount error(13): Permission denied
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs) and
kernel log messages (dmesg)
```
Reported-by: Jacob Shivers <jshivers@redhat.com>
Fixes:
|
||
Andy Shevchenko
|
d83a21bb26 |
smb: client: transport: Fix debug printing in __release_mid()
Long time ago during upgrading printk():s to the respective pr_<level>()
calls one misconversion happened and nobody has noticed that. So,
previously printk(KERN_DEBUG) + printk() worked as one long debug print
since the trailing '\n' is only present in the followup printk() format
string. The culprit change missed that and split the message to two on
the different levels. Restore the original behaviour to make users be
less confused in the most likely never happen cases of partially getting
that message.
Fixes:
|
||
Huiwen He
|
448ba0ae65 |
smb/client: invalidate fscache for fallocate range operations
smb3_zero_range(), smb3_punch_hole(), smb3_insert_range(), and
smb3_collapse_range() modify file contents through server-side range
operations. These operations discard the affected page cache, but leave
the FS-Cache cookie valid, so a later read may return data cached before
the range operation.
Fix this by invalidating FS-Cache after outstanding I/O has completed
and before modifying the file on the server.
Run the following as root on a CIFS mount with fsc enabled and an active
CacheFiles backend:
bash -c '
MNT=/mnt/cifs
FILE="$MNT/repro"
# Generate four 1 MiB random blocks: [A][B][C][D].
dd if=/dev/urandom of=/tmp/src bs=1M count=4 status=none
# Expected contents after zeroing B: [A][zero][C][D].
cp /tmp/src /tmp/expected
dd if=/dev/zero of=/tmp/expected bs=1M seek=1 count=1 \
conv=notrunc status=none
cp /tmp/src "$FILE"
# Populate FS-Cache, then discard the page cache.
sync
echo 1 > /proc/sys/vm/drop_caches
cat "$FILE" > /dev/null
sync
echo 1 > /proc/sys/vm/drop_caches
fallocate --zero-range -o 1M -l 1M "$FILE"
if cmp -s /tmp/expected "$FILE"; then
echo "readback: OK"
else
echo "readback: STALE DATA"
fi
'
Before this change, the readback differs from /tmp/expected:
readback: STALE DATA
After this change, it matches:
readback: OK
Fixes:
|
||
|
Huiwen He
|
01261a6fa4 |
smb/client: fix stale page cache in insert/collapse range
smb3_insert_range() and smb3_collapse_range() use
truncate_pagecache_range() to invalidate the affected page cache.
However, if off or old_eof is not page-aligned, the boundary pages are
only partially zeroed and remain uptodate. As a result, the client may
return stale data after a successful insert/collapse range operation.
For example, with 4K pages:
page 0 page 1 page 2
0------4K 4K------8K 8K------12K
^ ^
off=2K old_eof=10K
Page 1 is removed from the page cache, while the boundary pages are
only partially zeroed. After COPYCHUNK moves the data on the server,
these cached pages may still return stale data.
This can be reproduced on a CIFS mount:
bash -c '
FILE=/mnt/scratch/repro
# Use a 6 KiB file so EOF is not page-aligned.
dd if=/dev/urandom of=/tmp/src bs=1K count=6 status=none
# Expected: a 4 KiB hole followed by the original data.
rm -f /tmp/expected
truncate -s 4K /tmp/expected
cat /tmp/src >> /tmp/expected
cp /tmp/src "$FILE"
# Prime the page cache before moving data on the server.
cat "$FILE" > /dev/null
fallocate --insert-range -o 0 -l 4K "$FILE"
if cmp -s /tmp/expected "$FILE"; then
echo "readback: OK"
else
echo "readback: STALE DATA"
fi
'
Fix this by writing back dirty data and discarding the page cache from
the start of the page containing off to EOF before moving data on the
server.
Fixes:
|
||
|
Huiwen He
|
7811701d6a |
smb/client: fix integer truncation in collapse range
smb3_collapse_range() stores the ssize_t return value of
smb2_copychunk_range() in an int. A successful copy larger than
INT_MAX is truncated to a negative value and treated as an error.
Reproducer:
MNT=/mnt/scratch
truncate -s 2056M "$MNT/file"
fallocate --collapse-range -o 1M -l 1M "$MNT/file"
Fix this by using __smb2_copychunk_range(), which reports success as
zero instead of returning the copied byte count.
Before this change, the reproducer fails with:
fallocate: fallocate failed: Success
and the file size remains unchanged at 2056 MiB. After this change, the
reproducer succeeds and the file size becomes the expected 2055 MiB.
Fixes:
|
||
|
Huiwen He
|
0923ae9f23 |
smb/client: fix data corruption in emulated insert range
smb3_insert_range() shifts [off, EOF) right with COPYCHUNK, copying from
low to high offsets. When the ranges overlap, the copy can overwrite
source data that has not yet been copied. For a 1 MiB insert at offset 0:
offset: 0 1M 2M 3M 4M 5M
before: | A | B | C | D |
expected: | hole | A | B | C | D |
current: | hole | A | A | A | A | (corrupted)
Let x be the insertion offset, L the total length to move, delta the
insert length, and C the normal chunk size allowed by the server.
Insert range maps
[x, x + L) -> [x + delta, x + delta + L).
When delta >= L, the complete source and target ranges are disjoint, so
the normal copy order and chunk size are safe:
offset: 0 4 8 12 16 20 24 28 32
source: [--S0--][--S1--][--S2--][--S3--]
target: [--T0--][--T1--][--T2--][--T3--]
When delta < L, the complete source and target ranges overlap, so the
copy must proceed from EOF backwards. There are two subcases.
If delta >= C, each corresponding source and target chunk is disjoint.
The 1 MiB example has L = 4 MiB and delta = C = 1 MiB:
offset: 0 1M 2M 3M 4M 5M
source: [--S0--][--S1--][--S2--][--S3--]
target: [--T0--][--T1--][--T2--][--T3--]
Copying S0 from [0, 1M) to [1M, 2M) overwrites S1 before it is copied.
Processing chunks from EOF backwards prevents this inter-chunk
overwrite.
If delta < C, the source and target ranges of a normal chunk also
overlap. For example, with L = 16, delta = 2 and C = 4:
offset: 0 2 4 6 8 10 12 14 16 18
source: [--S0--][--S1--][--S2--][--S3--]
target: [--T0--][--T1--][--T2--][--T3--]
Here S0 and T0 overlap over [2,4), S1 and T1 over [6,8), and so on.
Backward ordering cannot control how the server copies bytes inside one
descriptor, so the chunk size must be limited to delta.
Fix this by copying overlapping right shifts from EOF backwards. Limit
the chunk size to delta when delta < C so that each chunk's source and
target ranges do not overlap. Using larger chunks would require a way to
identify servers that safely handle overlapping COPYCHUNK descriptors.
Therefore:
delta >= L:
keep the normal copy order and chunk size
delta < L:
delta >= C: copy backwards and keep the normal chunk size
delta < C: copy backwards and limit the chunk size to delta
Only the delta < C subcase requires reducing the chunk size for data
integrity.
Reproducer:
bash -c '
MNT=/mnt/scratch
# Generate four 1 MiB random blocks: [A][B][C][D].
dd if=/dev/urandom of=/tmp/src bs=1M count=4 status=none
# With C = 1 MiB, test delta = C and delta < C.
for delta in 1M 1K; do
truncate -s 0 /tmp/expected
truncate -s "$delta" /tmp/expected
cat /tmp/src >> /tmp/expected
cp /tmp/src "$MNT/file"
fallocate --insert-range -o 0 -l "$delta" "$MNT/file"
if cmp -s /tmp/expected "$MNT/file"; then
echo "delta=$delta: OK"
else
echo "delta=$delta: CORRUPTED"
fi
done
'
The corruption reproduces with Samba and ksmbd, while Windows handles
the overlapping COPYCHUNK ranges safely.
The 1 MiB case tests delta >= C, while the 1 KiB case tests delta < C.
Before this change, the reproducer reports:
delta=1M: CORRUPTED
delta=1K: CORRUPTED
After this change, it passes against both ksmbd and Samba:
delta=1M: OK
delta=1K: OK
Fixes:
|
||
|
Huiwen He
|
cd03ce4950 |
smb/client: mark file sparse before emulating insert range
The SMB client emulates FALLOC_FL_INSERT_RANGE with SET_EOF, COPYCHUNK
and SET_ZERO_DATA.
SET_ZERO_DATA creates a hole only when the file is sparse. On a
non-sparse file, it clears the inserted range but leaves its blocks
allocated, causing the extent count check in xfstests generic/064 to
fail.
Fix this by marking the file sparse before modifying it.
This patch produces the expected sparse extents in xfstests generic/064
only when the server-reported block size is compatible with the server's
deallocation granularity.
For ksmbd, the reported block size follows the backing filesystem,
and the test passes. For Samba, the test passes with a block size
matching the backend granularity, for example, 4 KiB on Btrfs, but not
with the default 1 KiB value. For Windows Server 2022, 4 KiB inserts do
not generate holes, while aligned inserts of 64 KiB or larger do.
Fixes:
|
||
|
Huiwen He
|
88972e3575 |
smb/client: validate new EOF for zero range
When FALLOC_FL_ZERO_RANGE is used without FALLOC_FL_KEEP_SIZE,
smb3_zero_range() may extend EOF without checking RLIMIT_FSIZE, allowing
the file to grow beyond the caller's file-size limit.
Fix this by calling inode_newsize_ok() before sending the zero-range
request when the operation would extend EOF.
Reproducer, using a file on a CIFS mount:
bash -c '
FILE=/mnt/cifs/repro
trap "" SIGXFSZ
ulimit -f 3072
truncate -s 2M "$FILE"
fallocate --zero-range -o 0 -l 4M "$FILE"
echo "fallocate rc=$?"
stat -c "file size=%s" "$FILE"
'
Before this change, the operation succeeds despite the 3 MiB limit:
fallocate rc=0
file size=4194304
After this change, fallocate fails and leaves the file at 2 MiB.
Fixes:
|
||
|
Huiwen He
|
1519dc88c8 |
smb/client: validate new EOF for insert range
smb3_insert_range() does not check if the new file size
(i_size + len) is valid. This allows FALLOC_FL_INSERT_RANGE to bypass
RLIMIT_FSIZE, exceed s_maxbytes, or produce a size outside the loff_t
range.
Use check_add_overflow() to calculate the new EOF. Validate it with
inode_newsize_ok() before modifying the file.
Reproducer, using a file on a CIFS mount:
bash -c '
FILE=/mnt/cifs/repro
trap "" SIGXFSZ
ulimit -f 3072 # RLIMIT_FSIZE = 3 MiB
# A regular write is stopped at 3 MiB.
dd if=/dev/zero of="$FILE" bs=1M count=4 status=none
stat -c "size after write: %s" "$FILE"
# Insert 2 MiB into a 2 MiB file.
truncate -s 2M "$FILE"
fallocate -i -o 0 -l 2M "$FILE"
stat -c "size after insert: %s" "$FILE"
'
Before this change, the regular write stops at the 3 MiB limit, but
insert range grows the file to 4 MiB:
dd: error writing '/mnt/cifs/repro': File too large
size after write: 3145728
size after insert: 4194304
After this change, insert range also fails at the limit and leaves the
2 MiB file unchanged:
dd: error writing '/mnt/cifs/repro': File too large
size after write: 3145728
fallocate: fallocate failed: File too large
size after insert: 2097152
Fixes:
|
||
|
Linus Torvalds
|
637836563d |
- Revert a commit to spinlock cleanup guards that got caught up
in the subtle limitations & fragility of guards (again...) and
caused a regression (Peter Zijlstra)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmqTmG0RHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1iV+A/+J2IN9xHNPv0O9rLKaJvLsNnlMPQ4QJJB
kTbEOLDrAE7ozTmP2sLfUu75w1FQz0Hp00/tf1V7VFYaSeMBdMoqJs3itCtuqBrU
qkVFrx7splaNauvFgxdaHd5dYGszwFOjixMwhezQC1wn46ckW29bEHbIrmY5j1xC
zF7iSTaVp2zHBbkh0n6ozN28zSbHZcLEAD8mvGoscv3Bnb+9HRMAr4weTHC94kq5
4hDaRS48CgofxEfXT0erp6Rc7lS1YTUltSvkICORTv0tYtDqDf1GCiZKIjaW8FqW
N7Nre77fSlH6HfzzujNgNOhGAGoVO+Ki9vfqgnYhnFRc864g9OTREmdNLlJ2V5XB
yC0SCbAeAjOvbtTLQlRmDlKWJPlwKgXkatGupczkCna3EeL9eXx33fOO6kOGxNNs
RpQXv+wPv0S9EDdIkkuMwhx0dq6yUCfrA22+wlXUzFhXvHTbhqZlDneI9OtzubZm
kU+Vf8dgVU0z59C+2ZOwlp5YHVXquRfNXOz8lrRIeb0y0Iyvlo7pDuQ/t8w3Bh3c
KVlAEEQsK8maBHgHHKMv8ml4W6XJHC9KG6x0TtKDv+ntmrNBDhvq2sxWrhBA7JT4
kXdab1QG/hP2FEY3M6bChEadT64U1BeGlcI9xMkhX886PwrnOMzTd9xiAN7UtdCR
dITQG+bHeQo=
=EtPf
-----END PGP SIGNATURE-----
Merge tag 'locking-urgent-2026-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull locking fix from Ingo Molnar:
- Revert a commit to spinlock cleanup guards that got caught up
in the subtle limitations & fragility of guards (again...) and
caused a regression (Peter Zijlstra)
* tag 'locking-urgent-2026-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
locking: Revert switching guards to _irq_{disable,enable}()
|
||
|
Linus Torvalds
|
f59c074e76 |
Rust fixes for v7.3
Toolchain and infrastructure:
- Fix KCFI failures, such as in Rust doctests, by disabling function
merging when CFI is enabled. Gary reported the LLVM bug to upstream
and it is now fixed in their mainline.
- Fix 'objtool' fallthrough warnings under the experimental
'CONFIG_RUST_INLINE_HELPERS' by passing (for the combined Rust and
helpers code) the LLVM options needed to preserve the unreachable
traps that 'rustc' normally emits.
In addition, fix 'objtool' errors when LTO is enabled on top, by
also filtering out the LTO flags (for the combined Rust and helpers
code) so that the traps are kept in place.
- Fix 'objtool' warnings by adding one more 'noreturn' function.
- Fix 'make rusttest' target when the 'rustc-dev' component is
installed and Rust >= 1.82.0, <= 1.87.0 is used.
'kernel' crate:
- 'num' module: fix soundness issue in the 'Bounded' conversion from
'bool' by restricting the conversions to unsigned 'Bounded'.
- 'jump_label' module: fix future 'make rusttest' target failures when
'ARCH=' is set to an arch different than the host's.
- 'list' module: fix incorrect 'pop_back()' comment.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEPjU5OPd5QIZ9jqqOGXyLc2htIW0FAmqT+BIACgkQGXyLc2ht
IW0vRRAAmR1E04gT5HFDH+iNJgLlyticVsHs0rH46ICYgQWs+gpGGiJsPpnNBJxM
M5+VGauMPch5kIBKYwD/XrUe6cDDNqIfY8Eq+BnJiTxDe6U68K4cSnmPe478wZIn
15AIteCHN2x9vf49KpfI3fH/xoriS5XVEC915bQ9APXOYJv7iXZCFDzxw9dXnYu/
TE3YleA32oJ9COBT3s8ovtzNpEOtZPKhWFd2lOCaGbxBLWygu5X/PSEZs6ikmqgR
BqHrbhzSco8aYKCrbFbQrdgtwFPr3PQ8pRn44TPU6/siZNVBk83IpcxdtXrQ2gRi
wOwZfMsH2K/cEZWMXPz16hp+4onWUr1bgkfLUAzPtyqUX6rOEaBrliSXGs+yCl40
KNx5BefrhzH6UL+/pbLGVXzC5q1VLTsgS6u66piUyvhf52Wmvzc7AExGml/BWA/q
jomwnxpgLiBjO61cH4dnfrm3AtXHAWGzG/dd0BnVcpT+8HEr2W4WWRSydmPtkB+f
hXXmwAOF3sgVueJ2nxlPVcqt3LdsinCwBrQQmO8J+TtPyNW9sh72OfFSOkF/wybw
o5tcqFG7ZSNGR7pli5pYsnG4Gfv3vIraLwhiVciGXZ+es+FkKtOpaOMunUcQwKP6
+uFpdMqXVQmH4l3Adc0rG1lq6zRHnGvZ96R5PlmPhl6RVDZuv0E=
=EBLX
-----END PGP SIGNATURE-----
Merge tag 'rust-fixes-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux
Pull Rust fixes from Miguel Ojeda:
"Toolchain and infrastructure:
- Fix KCFI failures, such as in Rust doctests, by disabling function
merging when CFI is enabled. Gary reported the LLVM bug to upstream
and it is now fixed in their mainline.
- Fix 'objtool' fallthrough warnings under the experimental
'CONFIG_RUST_INLINE_HELPERS' by passing (for the combined Rust and
helpers code) the LLVM options needed to preserve the unreachable
traps that 'rustc' normally emits.
In addition, fix 'objtool' errors when LTO is enabled on top, by
also filtering out the LTO flags (for the combined Rust and helpers
code) so that the traps are kept in place.
- Fix 'objtool' warnings by adding one more 'noreturn' function.
- Fix 'make rusttest' target when the 'rustc-dev' component is
installed and Rust >= 1.82.0, <= 1.87.0 is used.
'kernel' crate:
- 'num' module: fix soundness issue in the 'Bounded' conversion from
'bool' by restricting the conversions to unsigned 'Bounded'.
- 'jump_label' module: fix future 'make rusttest' target failures
when 'ARCH=' is set to an arch different than the host's.
- 'list' module: fix incorrect 'pop_back()' comment"
* tag 'rust-fixes-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:
rust: kbuild: disambiguate `zerocopy_derive` for `rusttest`
rust: num: restrict bool conversion to unsigned Bounded
kbuild: rust: keep Rust objects out of Clang LTO with inline helpers
kbuild: rust: preserve unreachable traps with inline helpers
rust: cfi: disable function merging if CFI is enabled
rust: jump_label: skip arch-specific asm in `testlib` builds
objtool/rust: add one more `noreturn` Rust function
rust: kernel: list: fix incorrect pop_back example comment
|
||
|
Linus Torvalds
|
0fe792fa9b |
ARM updates for 7.3-rc1
- add module description for kprobes testing module
- remove references to CONFIG_CPU_ARM92x_CPU_IDLE options
- expand comment in ARM's __switch_to()
Also a number of fixes that missed 7.2:
- disable broken eBPF on RiscPC
- more BKPT fixes (guys, it's a *very* bad idea when everyone uses
the BKPT instruction for their own differing purposes.)
- another preempt-rt fix, this time for siglock / CPU timers
- fix another path where we try to send signals to processes
with interrupts disabled
- acquire mmap write lock for show_pte() with user faults
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEuNNh8scc2k/wOAE+9OeQG+StrGQFAmqUOjQACgkQ9OeQG+St
rGR5DBAAki6o4y1sATQh+ZIHIspR0t8lcQZn31lWoGup1T1KoI7f2S48vJwvd17p
CryOuHmc8H0W5Z7MoiJ9Vkg4BsQzagr28xjvYO2uLYyrOqLgyJvUyNQm2POVa9nB
296/hCQjBR8VrEszJr6mvpac2pmYo9tlK3FcHKa1jO+iJbkQW1/4i5njhWqK7g0v
cG1ezSsaa1zZsOvFtJhBb8FQca7fpF1tRKd4F7s/w1mV4v7hETMaaXuYGMzHYVw2
zrln7CvGs5vlskrnbAxwMHyJdvdZI80Sm/QvIqxdTbYgZmfHYS43MKJp8E0HRz90
1oLUfWRxLMI1hql/hxraZEnMICa4uLKbhifqDN3H59WLb+S12gRrqb1WFIdr6SUv
P+xIkSaJu24Nb6LCvaVYLV24enMx2oGG76h2itXXKyDCiYTWVz2fMmAQiajbkxnh
iCoHBqvfTGu8Qio0Ndrp9XMn1pFCtPkb2eaBGfIfTKB08FxdwqR7rcWePygS83j5
BwXgeGCNh4oV5J5isZ3bRcwa7QkqbdsTrYhXcoDUcRzZgo/GAuEjP1AzsxOdV8hh
NKpBXrzNYfy78PkYc+vBe0piiuJUykKaRNfMX2WRK8u/fj4yCtkKuMZY02WA4X2M
I5N0bcdXmeE/d4KqJcx9WXtdji16w7G15xhfKKZRdlnvs0Oy2Uw=
=KcxS
-----END PGP SIGNATURE-----
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux
Pull arm updates from Russell King:
"Updates for 7.3:
- add module description for kprobes testing module
- remove references to CONFIG_CPU_ARM92x_CPU_IDLE options
- expand comment in ARM's __switch_to()
Also a number of fixes that missed 7.2:
- disable broken eBPF on RiscPC
- more BKPT fixes (guys, it's a *very* bad idea when everyone uses
the BKPT instruction for their own differing purposes)
- another preempt-rt fix, this time for siglock / CPU timers
- fix another path where we try to send signals to processes with
interrupts disabled
- acquire mmap write lock for show_pte() with user faults"
* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux:
ARM: 9480/1: entry: expand comment in __switch_to
ARM: 9478/1: Remove references to removed CONFIG_CPU_ARM92x_CPU_IDLE options
ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults
ARM: 9484/1: enable interrupts when unhandled user faults are triggered
ARM: 9483/1: select HAVE_POSIX_CPU_TIMERS_TASK_WORK
ARM: 9481/2: breakpoint: CFI breakpoints only on demand
ARM: 9477/1: Disable broken eBPF JIT on the Risc PC
ARM: 9473/1: kprobes: test: add MODULE_DESCRIPTION
|
||
|
Linus Torvalds
|
fb5b59a6a6 |
OpenRISC 7.3 updates
One small item and one bug fix.
* The bug fix is to fix an unchecked access in our or1k_atomic syscall,
I am debating if we should just deprecate this as there is minimal
need for it.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE2cRzVK74bBA6Je/xw7McLV5mJ+QFAmqSfncACgkQw7McLV5m
J+TprRAAuyxaYmmnTQqJacQt8OEaVJ5DPsZfCtENwEg9BkXpvzo1F/uK4Enp+YEf
VABscIWCAEKY2BCbn6TYdq6uDAHg9GY0fRUcJ7ERUH9pZt7RD24R6uP0oTIffYL4
wzD5E7DOkVdKHrw5KHB75K4BTPgHPLK2aJxhnS9eX/tYS2yDLQNyFvH5OxZ/uezp
6wJlZhdSdcTTNNBu/ZLj0YHa/22RixqxWHB0Wax061LU4QFjbYo8qufSA1sdP5Do
qz/zjW6fr6ieJOwNKsM6n9BLcCS1OqTNKRrWUbxUYqeni8jX2qXWxnwjOK0RrXH2
nmraEviXMrYGg29BIi914nG1uePp0MeX8LE2+GrBQ8iEMmnJeVk+TDNqGiXT4Zg1
1NTeQaGDJu2aggPlNC2DnnJyKb7KkTceBcpBC1amUco6co7m+TbFzcnqpUcTsVSu
HhH72NGnKmY7aFuMaw6Apl6pqw8C38moXhDo45XkucQzRQJADlIkm4amm8gV+MFk
ivP6OMuW4I08DxUlZw/thUdG6qMXVUKCrVqlohjQFXNKuFeHJM+rfJFXGnEmoSCW
AkFtgCH2wMDcW5BsM1d3YV3Bj4OFYR/YaElx0T83fcTUvGNbwdFQOlmGy06Jo2Hj
Vr/5pvoYbTUdL0uJMLPEG6mZuB5LmW5K4ktGTMTPosunXRQipIk=
=DkYR
-----END PGP SIGNATURE-----
Merge tag 'for-linus' of https://github.com/openrisc/linux
Pull OpenRISC updates from Stafford Horne:
"One small trivial macro cleanup and one bug fix.
The bug fix is to fix an unchecked access in our or1k_atomic syscall,
I am debating if we should just deprecate this as there is minimal
need for it"
* tag 'for-linus' of https://github.com/openrisc/linux:
openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
openrisc: drop unneeded semicolon
|
||
|
Linus Torvalds
|
034dd340b0 |
tracing fixes for v7.3:
- Fix error output of boot instance creation failure Currently if a boot instance creation fails, instead of printing out the name of the instance that failed, it prints "(null)". That is because it prints "cur_str" that had already been processed by strsep(). Print the saved name instead. While at it, print the error code of the failure. - Fix use-after-free for same named historgrams Histograms can be named so that they can be used in multiple events. But if the named histogram has a variable attached, the second event that uses the named histogram which duplicates it and needs to free the original after duplication leaves the old variable in place and still visible. If another histogram uses than variable, it will use the stale one which will try to reference the freed duplicate histogram and crash the kernel. Free the duplicate variables along with the duplicated histogram data. - Check return value of kthread_run() in event self test The events self tests uses a kthread for testing but does not check if it succeeded in creating a kthread. If the kthread creation were to fail, the code will still try to call kthread_stop() on the error returned. - Fix race between reading trace_pipe and updating subbuffer size If a user is reading the trace_pipe file at the same time they update the ring buffer sub-buffer size, can cause the trace_pipe read to read stale data. Add trace_access_lock() around updating the ring buffer sub-buffer size. - Fix eventfs_inode on failure path in creation of the events directory In the creation of the "events" directory, if after allocating the eventfs_inode a failure is detected, it calls cleanup_ei() which calls free_ei(). The free_ei() will test if eventfs_inode being freed has no children. It is a bug if it does. But on the failure case of the creation of the "events" directory, the children lists have not yet been initialized and the free will trigger a warning because list_empty() on an uninitialized list returns false. Move the initialization into init_ei() where it makes more sense and makes sure that a created eventfs_inode has its lists initialized upon creation. - Check return value of kthread_run() in ftrace direct sample code The sample code that shows how to use the ftrace direct calls does not test the return of kthread_run() to see if it succeeds. Return a failure if the kthread_run() doesn't succeed. - Clear user events state on fork in case of alloc failure On fork, the child gets a pointer to the parent's user events state. It makes a copy of it then updates the child's pointer to it. But if the allocation fails, the duplication function leaves the child with a pointer to its parent's descriptor. When the child cleans up its data, it will free the parent's descriptor while the parent is still using it. In the duplication function, set the child's user_event_mm to NULL before testing if the allocation succeeded, and when it exits it will not free the parent's descriptor. - Fix retry exhaustion in simple ring buffer reader swap simple_ring_buffer_swap_reader_page() starts with retry set to 8 and post-decrements it only after a failed link replacement. On the final attempt, a successful replacement leaves retry at zero, while a failed replacement leaves it at -1. But the check for success expects the retry value to be non-zero and exits with an error on zero. This is the opposite result. Fix it. - Fail nicely when the remote swap_reader_page() returns an error Currently, if the swap_reader_page() of a remote buffer fails, it triggers a WARN_ON_ONCE() and continues normally. Instead, have it exit with an error and a pr_warn() print instead of a full WARNING. -----BEGIN PGP SIGNATURE----- iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCapOC3hQccm9zdGVkdEBn b29kbWlzLm9yZwAKCRAp5XQQmuv6qvjkAQCGVuyK980rwiBnfenWLpeB3QjfHA8B mV0mJSlGWm1t1gEA9WWzMGbp+OHeRV2xyA+xW7OS1S58VO9OIGrzXCGqbAM= =TrF5 -----END PGP SIGNATURE----- Merge tag 'trace-v7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Fix error output of boot instance creation failure Currently if a boot instance creation fails, instead of printing out the name of the instance that failed, it prints "(null)". That is because it prints "cur_str" that had already been processed by strsep(). Print the saved name instead. While at it, print the error code of the failure. - Fix use-after-free for same named historgrams Histograms can be named so that they can be used in multiple events. But if the named histogram has a variable attached, the second event that uses the named histogram which duplicates it and needs to free the original after duplication leaves the old variable in place and still visible. If another histogram uses than variable, it will use the stale one which will try to reference the freed duplicate histogram and crash the kernel. Free the duplicate variables along with the duplicated histogram data. - Check return value of kthread_run() in event self test The events self tests uses a kthread for testing but does not check if it succeeded in creating a kthread. If the kthread creation were to fail, the code will still try to call kthread_stop() on the error returned. - Fix race between reading trace_pipe and updating subbuffer size If a user is reading the trace_pipe file at the same time they update the ring buffer sub-buffer size, can cause the trace_pipe read to read stale data. Add trace_access_lock() around updating the ring buffer sub-buffer size. - Fix eventfs_inode on failure path in creation of the events directory In the creation of the "events" directory, if after allocating the eventfs_inode a failure is detected, it calls cleanup_ei() which calls free_ei(). The free_ei() will test if eventfs_inode being freed has no children. It is a bug if it does. But on the failure case of the creation of the "events" directory, the children lists have not yet been initialized and the free will trigger a warning because list_empty() on an uninitialized list returns false. Move the initialization into init_ei() where it makes more sense and makes sure that a created eventfs_inode has its lists initialized upon creation. - Check return value of kthread_run() in ftrace direct sample code The sample code that shows how to use the ftrace direct calls does not test the return of kthread_run() to see if it succeeds. Return a failure if the kthread_run() doesn't succeed. - Clear user events state on fork in case of alloc failure On fork, the child gets a pointer to the parent's user events state. It makes a copy of it then updates the child's pointer to it. But if the allocation fails, the duplication function leaves the child with a pointer to its parent's descriptor. When the child cleans up its data, it will free the parent's descriptor while the parent is still using it. In the duplication function, set the child's user_event_mm to NULL before testing if the allocation succeeded, and when it exits it will not free the parent's descriptor. - Fix retry exhaustion in simple ring buffer reader swap simple_ring_buffer_swap_reader_page() starts with retry set to 8 and post-decrements it only after a failed link replacement. On the final attempt, a successful replacement leaves retry at zero, while a failed replacement leaves it at -1. But the check for success expects the retry value to be non-zero and exits with an error on zero. This is the opposite result. Fix it. - Fail nicely when the remote swap_reader_page() returns an error Currently, if the swap_reader_page() of a remote buffer fails, it triggers a WARN_ON_ONCE() and continues normally. Instead, have it exit with an error and a pr_warn() print instead of a full WARNING. * tag 'trace-v7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: ring-buffer: Stop remote reader update when page swap fails tracing: Fix retry exhaustion in simple ring buffer reader swap tracing/user_events: Clear copied tracing state before fork duplication samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-modify eventfs: Initialize ei->children and ei->list in init_ei() tracing: Fix use-after-free in trace_pipe read on sub-buffer order change tracing: Fix crash passing ERR_PTR to kthread_stop() tracing: Fix use-after-free with same-name named triggers tracing: Fix logged instance name on creation failure |
||
Russell King (Oracle)
|
1a89abc009 | Merge branches 'fixes' and 'misc' into for-linus | ||
Julia Lawall
|
ef6a1dca8d |
coccinelle: ifnulldev_put: update error message
Update the report and org mode messages to reflect the new function names. Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr> |
||
Sang-Heon Jeon
|
f83b8a5869 |
coccinelle: ifnulldev_put: update outdated helper names
dev_put_track() and dev_hold_track() were renamed to netdev_put() and
netdev_hold() by commit
|
||
|
Sang-Heon Jeon
|
5264281879 |
coccinelle: atomic_as_refcounter: drop atomic_long_dec_and_lock
atomic_long_dec_and_lock() has never existed. So drop it from the rules. No functional change. Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com> Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr> |
||
|
Sang-Heon Jeon
|
3beb6e620f |
coccinelle: kfree_mismatch: drop vmalloc_exec
vmalloc_exec() was removed by commit
|
||
|
Sang-Heon Jeon
|
729eb52aa1 |
coccinelle: pool_zalloc-simple: drop the pci_pool_alloc rules
pci_pool_alloc() and pci_pool_zalloc() were removed by commit
|
||
Jacopo Labardi
|
03c6ecc4b4 |
ntfs: fix FITRIM range alignment
ntfs_trim_fs() aligns the start of a free extent up to the device discard
granularity, but derives the discard length by aligning the original extent
length down. When the free extent start is not discard-aligned, adding that
length to the aligned start can extend the discard past the free extent and
into allocated clusters.
For example, with 4 KiB clusters and 32 KiB discard granularity, the free
extent [4 KiB, 36 KiB) becomes the discard range [32 KiB, 64 KiB), so
28 KiB beyond the free extent may be discarded.
Align the absolute end of the free extent down and derive the length from
the two aligned endpoints. Skip extents that contain no full discard unit.
Reproduced with a 4 KiB-cluster NTFS filesystem on scsi_debug configured
for 32 KiB discard granularity and read-zero-after-trim. Before this
change, FITRIM zeroed seven allocated 4 KiB clusters following an unaligned
32 KiB hole. With this change, the same data remains intact across FITRIM
and remount.
Fixes:
|
||
Zhan Xusheng
|
41a52ba4a5 |
ntfs: read WOF chunks outside the decompression lock
WOF decompression uses four module-global workspaces, one per compression
format, each with a static mutex. ntfs_read_wof_compressed_block() takes
that mutex once and holds it across the whole chunk loop, so both block
reads run inside it:
mutex_lock(ws->lock);
for each chunk {
parse_wof_chunk_table(..., ws->input, ...); /* reads disk */
ntfs_read_wof_chunk(..., ws->input, ...); /* reads disk */
decompress into ws->output;
}
mutex_unlock(ws->lock);
Readers of system-compressed files then serialise system-wide on the disk
waits, not just on the decompressor scratch the lock exists for. One
reader sleeping in submit_bio_wait() blocks all the rest.
The waits dominate. Reading an 8 MiB xpress4k file (2048 chunks at a 48%
compressed ratio, so 2048 acquisitions and 4096 block reads) and timing
ws->lock against the part of it spent in ntfs_bdev_read():
backing store held of that in I/O held after
virtio, host page cache 348 ms 321 ms (92%) 24.6 ms
virtio, throttled 100 MB/s 978 ms 948 ms (96%) 36.6 ms
The page-cache row is a lower bound, having no seek cost at all, and the
share still grows with slower storage because only the wait scales while
decompression stays near 26 ms.
The reads are inside the lock only because they land in ws->input, a
buffer shared through the workspace. Nothing else requires it:
parse_wof_chunk_table() and ntfs_read_wof_chunk() already take the buffer
as a parameter and both set *chunk_mem to a pointer inside it, so a
caller-owned buffer works unchanged.
Allocate that buffer per call, do both reads without the lock, and take
the lock only around decompression, which is the step needing ws->output
and ws->scratch. squashfs is arranged this way already: its
squashfs_decompress() is handed a bio that has been read, and locks only
for the CPU work.
Block reads are unchanged in number, they just no longer run under the
lock, and hold time stops tracking device speed.
This also unnests two per-inode locks from the global one, runlist->lock
taken by both reads and base_ni->mrec_lock taken for a resident stream.
A resident chunk needs no I/O at all, yet used to queue behind a reader
blocked in submit_bio_wait() and then take mrec_lock inside the global
mutex.
The buffer is 4608 bytes for xpress4k and at most 33280 for lzx32k. This
path already does GFP_NOFS allocations per call in ntfs_attr_iget(), and
in ntfs_attr_get_search_ctx() for a resident stream, so one more does not
change how it behaves under memory pressure. The workspace keeps output
and scratch, 4 KiB to 32 KiB and 6224 bytes (xpress) or 10240 (lzx), and
its "already allocated" test moves from ws->input to ws->output.
The lock is now taken per chunk rather than per call, which differs only
for a folio spanning several chunks: a few more uncontended mutex
operations in exchange for not holding it across the reads between them.
Verified under QEMU against an uncompressed copy of the same data, on an
8 MiB file and a 100000 byte one, the latter covering the tail chunk that
is not a full comp_unit.
Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
|
||
|
Linus Torvalds
|
08dbfad3f5 |
SCSI updates for 7.3
Remaining updates for the 7.3 merge window. The only core change is enabling context analysis for the SCSI layer and UFS. The remaining changes are either bug fixes or hardening. Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZOpW2gUwxXeCmhkh7ulgGnXF3j0FAmqTH1UACgkQ7ulgGnXF 3j2EhA//VAZ4F5A4McmtwYMnCdUCjaPihX9JC7i0GHnBqloX/Scc97xs7/Gzzf7u 5HcQjoYArPYpHkGMT+KuqEpfzRiiYe41XpiPMQf7EkW4VAwYbuwLqPn4z2ma9HIS LAmxSdi1RDU3KBo9hYm4GTsvY+FYDpmrjNcYNvR5Ajf1H3O1+2EBlA54FJ92Ct1v NuxgR8F9cY2JM9cB84qhjCd1/49NEOfAQjBA32OFGbLC/9TbF83g1pgyClmOyglD WTzmzQkIq7kmq0BKWleRUKwgj9EQmOHpe4VGdvHC4n2G8vTBscsXRMqt4l1pM/UY B7c7MfCT8Ar3EnUBO1m9QAADMj9DMqIWZ7SJRDyJL0BLabhxaxDx+yrdkN0dM4SZ n/GW5f8uNO/jxLumk0OfrUChGhKnsNTjQKDnbQZ8jLPjgaj2bx8UZg/8JglOxfaZ +vV3GGsClxjIANqY6pNwvCuXFxatG1o7HUk+JwX08DQT+k7iKkHRLM/4tpiIIwWm xLvAhrX7SJRYjISZm54bPumMscjkzSaUt6CoHqSIJ9iO5AJWBUqFQqaki+lBqF43 DgIUzdEn/OYk9PGKcpjKoeXbEkBPkogHF2YI848z0bdlgb1ae+FHzkDoYH58mDKZ wVt+kQQ3iQgwgB2x9NN+wtxlGFMh6nyPS5GpWopUJXEEvm2WygY= =tfy0 -----END PGP SIGNATURE----- Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi Pull more SCSI updates from Martin Petersen: "Remaining updates for the 7.3 merge window. The only core change is enabling context analysis for the SCSI layer and UFS. The remaining changes are either bug fixes or hardening" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi: (26 commits) scsi: snic: Fix SCSI host leak on workqueue allocation failure scsi: MAINTAINERS: Update my email address scsi: MAINTAINERS: Leave the cumana_1 and oak drivers to the RISCPC maintainers scsi: leapraid: Standardize NCQ priority sysfs attributes scsi: leapraid: Serialize firmware log mmap with teardown scsi: leapraid: Balance host references for firmware log VMAs scsi: lpfc: Remove unnnecessary NULL check scsi: qla2xxx: Fix an loop timeout test scsi: qla2xxx: Fix an error code in qla_get_tmf() scsi: ibmvfc: Fix use of uninitialized rport in ibmvfc_do_work() scsi: core: Enable context analysis for hosts.o scsi: lpfc: Replace strlcat() with sysfs_emit_at() in the sysfs show functions scsi: lpfc: Replace strlcat() with seq_buf in the debugfs dump helpers scsi: lpfc: Replace strlcat() with seq_buf in lpfc_rx_monitor_report() scsi: lpfc: Replace strlcat() with scnprintf() in lpfc_vport_symbolic_node_name() scsi: lpfc: Replace strlcat() with seq_buf in lpfc_info() scsi: core: Enable context analysis scsi: core: Protect host state changes with the host lock scsi: core: Add lock context annotations scsi: core: Pass the SCSI host pointer directly to scanning functions ... |
||
Ali Ahmet Memis
|
78004e9a87 |
openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
sys_or1k_atomic() (syscall 244 in the "or1k" ABI) takes two user
pointers, v1 and v2, and swaps the words they point to in hand-written
assembly.
l.lwz r29,0(r4)
l.lwz r27,0(r5)
l.sw 0(r4),r27
l.sw 0(r5),r29
The pointers are not checked with access_ok(). The four memory
accesses also have no exception table entries.
A caller passes a kernel address as either pointer, and the syscall
reads from and writes to it directly.
This gives an unprivileged process a kernel read/write primitive. It
overwrites kernel data such as the sys_call_table, gaining code
execution in kernel context.
Check both pointers before entering the critical section. Add fixups
for the four memory accesses so faults on valid but unmapped user
addresses return -EFAULT.
[shorne@gmail.com: fix comment style]
Fixes:
|
||
|
Linus Torvalds
|
cf72cbb39d |
io_uring-7.3-20260828
-----BEGIN PGP SIGNATURE----- iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmqR/ZwQHGF4Ym9lQGtl cm5lbC5kawAKCRD301j7KXHgpr6GD/9uEDS/3lBXkP5r6qO4E5v/6eN7Sz1F/gZ4 vkH4reHh3U3VSjwOaWJHLXCkJV06JmlJAggCn0dq+P8cXWKH9VpwppzpedY/Ua05 oiDXgyoaAzhgYzE/seCALdFR0zOyvhSlluDiucrwWCcx0h4HOEnysZ3Q4RQ8gXXx 2mQ+M/n2WdXPPUHPEGezPL9PvtitFjUFr8WBeWksCtFQ+Ycyk6+NDPSanxeOjJCI FhgQDxiUIWSEItEniuwq4lUQFtImkRyUvBPPbPb51ahzkCc1QSjr8WVtfO0RJtON uiUU9hkTcKis/ufR+esikrjV2nwxo3fv2WkknrBfJ5jNFiLp/CR+FPZRwH3A/AoH Onoi3qcpcHrXzQD4j/UhyUcaIM7sntwour4PBg8cKUh/lwZkt94+orp6lniiV/Dd aS3IKmCymQjpf5N3b0QnQSi2lOGk6bUKyQD8YUnA/N3rw3olfkzSGBDz6Y4gQxAY XpvmuPDXndhfn17JSGpsCjohWkWEUuSQh1fx5JLsV9XkaPaeA89/epUzu2+b1Kxw c+/uaCkQsGGLpHa6xWhJLGocyYZViDUYeIPz8C7gqTDXTMU70mtZvILl+aZjVrjF iU2aSWDuS9oD0g16yT7FY8pBQvB8RnuNCUmS92QIr+VMqnp7793DPD5gwN88k+8L 4x4gInB+ag== =I3ma -----END PGP SIGNATURE----- Merge tag 'io_uring-7.3-20260828' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: "A few smaller fixes for io_uring that should go into the 7.3-rc1 kernel, all three headed to stable as well. This contains: - A few fixes around cancellation and teardown for waitid - Cap the user size for the query interface copy-out" * tag 'io_uring-7.3-20260828' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/waitid: avoid siginfo copy during ring teardown io_uring/waitid: honor task_work cancellation io_uring/query: cap user size passed to copy_struct_to_user |
||
|
Linus Torvalds
|
a99d741df7 |
drm next/fixes for 7.3-rc1
core: - use drm_warn instead of warn msm: - Bindings: - Added Shikra support - Document a840, a704, a722 - Core: - Use drm_client buffers for fbdev emulation - teardown fixes - ARM32 DMA fixup - Remove objects from evict list when re-validated - Bunch of corner case and error path fixes - DPU: - Dropped dev_pm_opp_set_rate(0) preventing burnout - Fixed SSPP offsets of Kaanapali - DP: - Dropped dev_pm_opp_set_rate(0) preventing burnout - Cleaned up core code in preparation for MST support - Fixed prepare() to let Pipewire continue in case of the unplugged cable - GPU: - Add support for a704 - Add support for a722 - HDMI: - Simplifed register access amdgpu: - eGPU fixes - Runtime PM fix - UserQ fixes - Backlight fix - Discovery sysfs fix - Reset handling fixes - Buffer func handling fix for xgmi - VCN boundary check fix - DC lut handling fixes - MES fixes - UVD fix - VCE 3 fix - Enforce isolation fix - HPD fix for VGA/LVDS - DML fix - DCN 6 fixes - DC gpu reset fix amdkfd: - Fix return value - CU occupancy for GFX 11 - CU occupancy for GFX 12/12.1 - Queue bounds checking fix - SVM fixes - CRIU bounds checking fix radeon: - iMac display fix xe: - error message cleanups - i2c global register definitions as dependency for xe/i2c fixes - Media workardound - Add CCS to gt_idle debugfs print - Page fault related fix - i2c related fixes - System Controller mailbox bit fix -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmqR+2wACgkQDHTzWXnE hr5VPRAAhJpCnUEOUnhiBRfQB3lqHuKV4N9XQGVoaAZHYLxNkZD6I99ScpIznEr9 sHG0ViBqz2PHyM2XoJzPZDzm8Us0moVUMMdV56IH7h11l8E7Az2Sd/Ji+AQvZEBT /qh9Py0/fjibfDm0ueMROFRhuD8RA2sJqzkGMZUBvErh+zmEQvkIDkIT6A5RpHD8 B3XEGN+UCxPBzCnKNixyNDgY2i4ipFAe0MDj9+Mh0b9BM9BoV8+Eb7sjkBz+ROMH tl57Mjjd37FaYM9MgtEt9m7eOBf266V9Xb9tbIfqShwO1aZa0Vfzuih/3Ck53Nwc VkwepP7NHZZKFHIxFgcRCVjzyA3HpZJmLot8YYOyZDJOG6KKp2X0ZUFBog5Uiv8o 7exd95FLUtIsnUtmLxlermOYJwrokgcVoigcalhLCB2+KZ5/BznutzcCSvrd8vI2 LzEGnLMgzuEKeOmiWZjagID51TYwHfPogULUlwWT4XB62dKih7/uselCObj4m/Lc kRSbiXWz1pxisfiFRsK2GECwsbEb/8qOYgSOQBgppuPbSWpX+2P4IApomRBesQ8E Db+i6hptauOwT0/1ZBo8gkOfb0XIWsjg9iV6pVuUIS80hOlr7Zj1MR7mMrWgL0nM Chs4/Nq8jWU1ESbmKPBINIXCGOGuev4lJO/pBjfySLpTUhWOQcw= =wbEZ -----END PGP SIGNATURE----- Merge tag 'drm-next-2026-08-29' of https://gitlab.freedesktop.org/drm/kernel Pull more drm updates from Dave Airlie: "As mentioned last week, an msm pull request fell down the side of the couch or whatever the email equivalent of that is. This has the msm next stuff + the usual fixes for amd/intel. core: - use drm_warn instead of warn msm: - Bindings: - Added Shikra support - Document a840, a704, a722 - Core: - Use drm_client buffers for fbdev emulation - teardown fixes - ARM32 DMA fixup - Remove objects from evict list when re-validated - Bunch of corner case and error path fixes - DPU: - Dropped dev_pm_opp_set_rate(0) preventing burnout - Fixed SSPP offsets of Kaanapali - DP: - Dropped dev_pm_opp_set_rate(0) preventing burnout - Cleaned up core code in preparation for MST support - Fixed prepare() to let Pipewire continue in case of the unplugged cable - GPU: - Add support for a704 - Add support for a722 - HDMI: - Simplifed register access amdgpu: - eGPU fixes - Runtime PM fix - UserQ fixes - Backlight fix - Discovery sysfs fix - Reset handling fixes - Buffer func handling fix for xgmi - VCN boundary check fix - DC lut handling fixes - MES fixes - UVD fix - VCE 3 fix - Enforce isolation fix - HPD fix for VGA/LVDS - DML fix - DCN 6 fixes - DC gpu reset fix amdkfd: - Fix return value - CU occupancy for GFX 11 - CU occupancy for GFX 12/12.1 - Queue bounds checking fix - SVM fixes - CRIU bounds checking fix radeon: - iMac display fix xe: - error message cleanups - i2c global register definitions as dependency for xe/i2c fixes - Media workardound - Add CCS to gt_idle debugfs print - Page fault related fix - i2c related fixes - System Controller mailbox bit fix" * tag 'drm-next-2026-08-29' of https://gitlab.freedesktop.org/drm/kernel: (121 commits) drm/xe/sysctrl: Read mailbox phase bit from hardware drm/xe/i2c: Keep the i2c controller always enabled drm/xe/i2c: Fix the interrupt handling i2c: designware: Global register definitions drm/xe: Reject page faults from non-fault-mode scratch VMs drm/xe/xe_gt_idle: Add CCS to the powergating info print drm/xe: Do not apply WA 14025883347 to media 3503 drm/amd/display: fix dc_lock leak on GPU reset error paths drm/amd/display: Fix redundant GPUVMEnable checks in dcn6 flip schedule drm/amd/display: Fix wrong bytes-per-pixel value for dml2_422_packed_10 drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore drm/amdgpu/userq: fix lock missing for userq fence error set drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram drm/amdkfd: Fix error path at svm_migrate_copy_to_ram drm/amd/display: Log details when failing to register HPD IRQ drm/amd/display: Fix HPD consideration for VGA/LVDS connectors on DCE drm/amdgpu: clamp the isolation index for rings outside a partition drm/amdkfd: Reject zero-sized AQL queue allocations after size halving drm/amdgpu: Fix VCE 3 ring align_mask drm/kfd: Add CU occupancy support to GFX12.1 ... |
||
|
Linus Torvalds
|
4cc4cc367f |
ipmi: Fix some minor issues, add async init
Several cleanup on error fixes and a missing RCU wait and proper validation on a received message in one place. The biggest change is the initialization of the driver can be done asynchronously on a work queue. That saves significant boot time. -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE/Q1c5nzg9ZpmiCaGYfOMkJGb/4EFAmqR5uMACgkQYfOMkJGb /4HmSw//behOuqAjgDZ8kwxs/WCfdXz4Tz+hr/tFUkHgCMpq5XFKZVBonY5s6eEB y4Wei0JXURTt+Yex7aH7y22g5lIwaOYA8KGklnPGsHerPR9Xpr9PucNq7YjL8EN2 hfND4jHjWtIl/8Z61/D24Dq7zbzY2oNcBt2rnAboKpEQuGOrCR4imuRkVZ182XzL wtsoMwcWYhUIpCvQ87vhUJy9IyJrwHBPRe8ziUoDfxAjQdgKBCcJ2g9hDOQY910A UphBIyAaXfap5QEBhiV4bYJd3+HM0FC/G7zH5MX6+AP19253ODuN8jlq1zCKYiwx h3uEweshhTrEQJPUh5YClRPKs4h3dkRfUPEzzW5UXtoCS75Slcdtoc/A/mf7YTTB dRKaeqyJq6WboVOcLllO6EyJtk8Wrp4YwtMHXwDpi86sHtqcPPuAQMwt5uPomJDU kTvsxfGGaLV+G+pKvjfKH6iLEAPI3gNGcjMJXdH9WPqP+w7lsGDwJR3BCIOZsFoV 8oB4rzjtlkNOTo/WD8Ijo1VU5QT4yhzDC2SYhaoJCL95fMxaay5AIlbN8k3gDalE eIlTgbcyi2qyyTV4+JjjqXdCQwI9AGSoW7B0Y8mJgt5CzY0vl3A1kKa884d5tEOm auJAUgt4oXE2E5qLL5gMgqkiay8ofNNIEMhRpjY0g/yGSUnPPa0= =Nbl3 -----END PGP SIGNATURE----- Merge tag 'for-linus-7.3-1' of https://github.com/cminyard/linux-ipmi Pull ipmi updates from Corey Minyard: "Several cleanup on error fixes and a missing RCU wait and proper validation on a received message in one place. The biggest change is the initialization of the driver can be done asynchronously on a work queue. That saves significant boot time" * tag 'for-linus-7.3-1' of https://github.com/cminyard/linux-ipmi: ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user() ipmi:msghandler: Cancel work cleanly on an error ipmi:si: Add async init to ipmi_si char: ipmi: use named initializers for acpi_device_id ipmi: Fix leak in __ipmi_bmc_register ipmi: Remove all sysfs files on registration failure ipmi: si: Fix NULL pointer dereference after failed registration ipmi: ipmb: validate write message length |