mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-11-10 20:48:12 +00:00
1,482,976 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Linus Torvalds
|
9328b3b03b |
\n
-----BEGIN PGP SIGNATURE----- iQEzBAABCAAdFiEEq1nRK9aeMoq1VSgcnJ2qBz9kQNkFAmqFw00ACgkQnJ2qBz9k QNlJlgf/SylCykcdsaqBVJd9hTrg0L6AdMKyc/PpdvyjK7qWOrXLzQFV9p7BHrER pGixy+k/5QTlWRAQ7X7okHI9uo6cMzxP/OeLqiXszBPlinRxsELb1GH89+5jOrQh oAcDci0LxX9dyBXcnl+MFgS6FPURQRnGqCeyMc+EnqHF8LYTjy05jWw/sn8Ok6WF vTBV1gl1YLN6bA+cRDVH3BBWf9irzDvnbBTUo6CRF0H5wPxiuy/ddgaYxgd8GDD/ jKsZ/hmL90695CGmvoGC3WtMpAUJm/rLX6aqoYltwQYbKhVJpfAh58IhJGpgsRG4 l4kVxtZvjvP5jMskXm5SbCMAzB8Fzg== =vznt -----END PGP SIGNATURE----- Merge tag 'fs_for_v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull ext2, udf, isofs, and quota updates from Jan Kara: - Remove deprecated quota code printing warnings about exceeded quota directly to console - Various udf & isofs hardening for handling of corrupted filesystems - Fix a possible data loss in udf when converting files from inline to out-of-line format - Simplify EIO error handling in ext2 xattr code * tag 'fs_for_v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: udf: Fix data loss when converting inline inodes to out of line udf: Move udf_map_block() up ext2: Simplify error handling of IO error when adding xattr isofs: Drop support of directory entries straddling blocks isofs: validate directory records consistently quota: remove CONFIG_PRINT_QUOTA_WARNING code udf: Fix i_lenExtents truncation on 32-bit kernels isofs: release zisofs block pointer buffer head udf: Fix bh leak for unallocated space entries udf: bound lengthAllocDescs from unallocated space entry UDF symlink pathComponent header OOB read isofs: fix out-of-bounds page array access on empty zisofs block udf: reject VAT indexes equal to the entry count udf: Mark LVID buffer as uptodate before marking it dirty udf: avoid recursive s_alloc_mutex deadlock when freeing AED blocks udf: validate extent partition references in udf_current_aext() |
||
Pengpeng Hou
|
5e8076e4e4 |
net: qlcnic: validate unified ROM sections before loading
The unified ROM parser reads directory, product, and data-descriptor fields
from the firmware file. Existing validation forms table and data ends with
unchecked additions and multiplications. Malformed values can wrap before
they are compared with the firmware size. The parser also dereferences
typed pointers at firmware-controlled offsets.
Valid descriptor extents alone are insufficient for the consumers. The
loader reads a fixed-size bootloader regardless of its declared size, the
version parser assumes a 17-byte tail, and a partial final firmware word is
read as a full u64. A truncated image can therefore make the driver read
beyond the firmware allocation during validation or loading.
Replace the pointer-returning parser with bounded range helpers. Validate
table entry sizes, descriptor indices, section ranges, the fixed
bootloader load length, and the version tail before exposing any section.
Read all file fields with unaligned little-endian accessors and assemble a
partial final word from only the bytes that remain. Apply the same range
checks to the legacy image before reading its fixed fields.
Fixes:
|
||
|
Linus Torvalds
|
81e51378b7 |
\n
-----BEGIN PGP SIGNATURE----- iQEzBAABCAAdFiEEq1nRK9aeMoq1VSgcnJ2qBz9kQNkFAmqFwEgACgkQnJ2qBz9k QNnNvAgAxVRKKfkAkxzx1iRCFtRRXSeWMfUeT7hF5hHyGUN+ZrVomAFYBNXXqFPA fdpG9OLadQXmReqv6gtOOrV2cls92BU3KO01U7yXHEZmE/zDlEGSXNpK1elsponY nx8Ukiz911R5Be0JB/x/tUWW1bDi4HEO2eLfwY9MUuzNDuIvKAkhSO8ZP2teKChR ZFl/ctiiblLOsmL3rhQeJWzjG06fjEdD0b1ZbpQtjjc2bmIWRV0MQxXs/wvkt1Mz 0an1PAp3L478tGJAGQKD5TArTitpmxmGPmj6jw8WQXMvYOfkoyyeeboybx24JG0i QIMMVEcPzZwtLVTX4UbOnnUU5JpUqQ== =PDAd -----END PGP SIGNATURE----- Merge tag 'fsnotify_for_v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull fsnotify updates from Jan Kara: "A couple of assorted fixes (mostly stuff spotted by Sashiko) for fsnotify subsystem. I'm also removing Matt as a reviewer because he was not active in fsnotify in last years and after he stopped working for Google I don't have a working contact to him" * tag 'fsnotify_for_v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: fsnotify: Fix stale object mask after concurrent mark updates fanotify: report full event length for FIONREAD fanotify: fix use-after-free of file range info fanotify: stop permission watchdog when timeout is zero fsnotify: Remove Matt Bobrowski as a reviewer fanotify: initialize permission event watchdog state |
||
Tetsuo Handa
|
f85dc137aa |
net: add missing ref_tracker_dir_exit() to net_passive_dec()
I found that trying to read /sys/kernel/debug/ref_tracker/* causes NULL pointer dereference crash when alloc_netdev_mqs() via unshare() returned NULL, for commit |
||
Rafael J. Wysocki
|
a6fa4d6e38 |
ACPI: Update upstream ACPICA repository URL in documentation
Update the URL of the upstream ACPICA repository after recent changes in the upstream ACPICA project. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Armin Wolf <W_Armin@gmx.de> Link: https://patch.msgid.link/1867400.VLH7GnMWUR@rafael.j.wysocki |
||
|
Rafael J. Wysocki
|
500919d75d |
ACPI: Update MAINTAINERS entry for ACPICA
Update the MAINTAINERS entry for ACPICA after recent changes in the upstream ACPICA project. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Armin Wolf <W_Armin@gmx.de> Link: https://patch.msgid.link/3356863.5fSG56mABF@rafael.j.wysocki |
||
|
Rafael J. Wysocki
|
45ccfec7ca |
ACPI: Add Bob Moore to CREDITS
To me, Bob is a silent hero. He had been driving the development and maintenance of the ACPI Component Architecture (ACPICA) project for over 2 decades and while he was not vocal or otherwise visible too much, he was focused on improving the code delivered by him to a community reaching far beyond the Linux kernel. Bob retired from Intel earlier this year after over 40 years of continuous service and departed from software development as far as I know, and he is missed already. The kernel depends on Bob's contributions quite a bit, so he deserves a CREDITS entry. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Armin Wolf <W_Armin@gmx.de> Link: https://patch.msgid.link/3711645.iIbC2pHGDl@rafael.j.wysocki |
||
|
Linus Torvalds
|
d141ec2825 |
NFSD 7.3 Release Notes
Jeff Layton contributed CB_NOTIFY support to NFSD's NFSv4.1
directory delegations. The server used to recall a delegation as
soon as the directory changed. NFSD now watches delegated
directories through fsnotify and reports adds, removes, renames,
and directory attribute changes, carrying the filehandle and
attributes of the affected entry, so clients can keep their
caches. Some of the NOTIFY4 flags come from RFC 8881bis.
Jeff Layton also continued the netlink work that started in v7.2.
A new server-stats-get operation reports what /proc/net/rpc/nfsd
publishes, plus NFSv4 callback counts, and SUNRPC now keeps its
per-procedure call counts per network namespace, so a container
sees its own numbers. nfsstat reads all of this over netlink, with
a procfs fallback for older kernels.
SUNRPC's service thread pool mode selection is gone. Pernode is
the right choice on any host we run today, so the auto, global,
and percpu modes have been removed. A single-node host still gets
one pool. A multi-NUMA host now gets a pool per node.
sunrpc.pool_mode accepts the old names but no longer selects
anything.
The rest is bug fixes, clean-ups, and small optimizations: an
async COPY offload rework from Jeff Layton, more use-after-free
fixes in the NFSv4 state revocation paths, percpu counter
contention removed from the reply cache and IO accounting, and a
long list of hardening fixes from Chris Mason. Sincere thanks to
all contributors, reviewers, testers, and bug reporters who
participated in the v7.3 NFSD development cycle.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEKLLlsBKG3yQ88j7+M2qzM29mf5cFAmqDDs4ACgkQM2qzM29m
f5eUTQ/+NgtZZ93ssYPbu5vW1lnxI0zVMPwBw+jvdF4YShaLUTVD3AYN/wOn2n2v
Y0ULB2QOyz5zXq+9e9sL/zWJNPsGucx4G4pfcXzn96e3zPkZPChaJUKRQd347kPc
gkaExMxQBwqU7xDIaBF+g1vh4pogORfhc4xi0zE0j4kqiYJOQCJIUg33SNLrqeSa
DG7IbTuS+nvFBalbUQiWaL7DMxO2N2JlYbpU15kzBuJ8GLK7I3kPPTDGKEbEaUuF
m8krI6Drdrwb1puiZnjUO+OHvalC5JzKcLkHG9Ps1KlUgfYDZ546waPIcpCT0KjM
JFG3Avg2Zu9o+cz1AZB9Kq7epPQgHzNea3h48DOLvJP9r97cvObkg2ZocMzlHe0/
yy2qRCBpX41MWDgckB6hCVP1l/l0u7EatpXxMtdBm4Jnv6a6Em39RLX4MzFVcJ5t
cYROdLEAfwblIeJyOJm197LjjhKb7minPWRWaYwnGMe05VXUXSh7MZI/Rw7NkJev
P8p+bt1CEv1pEM0ArrDmcjPvsX2JJXMsspHovf/ymbTYLdDf9I/7NFLE/Jc6c9BT
h9/oMBcw7lumlB5aq3L/NOlXQmjtoGTQVjyMrKDwtRQXjQgFo8gaB5nXSIlB4ik+
DFz2ajp+F07VATS89Dc2m7ALO08pdNwzn4p8jq/IKnqlGWlxNIE=
=g1IS
-----END PGP SIGNATURE-----
Merge tag 'nfsd-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux
Pull nfsd updates from Chuck Lever:
- CB_NOTIFY support for NFSD's NFSv4.1 directory delegations
The server used to recall a delegation as soon as the directory
changed. NFSD now watches delegated directories through fsnotify and
reports adds, removes, renames, and directory attribute changes,
carrying the filehandle and attributes of the affected entry, so
clients can keep their caches. Some of the NOTIFY4 flags come from
RFC 8881bis (Jeff Layton)
- Continued netlink work
A new server-stats-get operation reports what /proc/net/rpc/nfsd
publishes, plus NFSv4 callback counts, and SUNRPC now keeps its
per-procedure call counts per network namespace, so a container sees
its own numbers. nfsstat reads all of this over netlink, with a
procfs fallback for older kernels (Jeff Layton)
- Remove SUNRPC service thread pool mode selection
Per node is the right choice on any host we run today, so the auto,
global, and percpu modes have been removed. A single-node host still
gets one pool. A multi-NUMA host now gets a pool per node.
sunrpc.pool_mode accepts the old names but no longer selects
anything.
- Bug fixes, clean-ups, and small optimizations:
- async COPY offload rework (Jeff Layton)
- more use-after-free fixes in the NFSv4 state revocation paths
- percpu counter contention removed from the reply cache and IO
accounting
- a long list of hardening fixes (Chris Mason)
Sincere thanks to all contributors, reviewers, testers, and bug
reporters who participated in the v7.3 NFSD development cycle.
* tag 'nfsd-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: (182 commits)
nfsd: export NFSv4 callback op stats via netlink
nfsd: count NFSv4 callback operations per netns
sunrpc: remove unused svc_version vs_count field
nfsd: implement server-stats-get netlink handler
sunrpc: use per-net counts in svc_seq_show()
sunrpc: add per-netns per-procedure call counts to svc_stat
NFSD: Document reply_cache_stats ABI
NFSD: Eliminate percpu counter contention in IO byte accounting
NFSD: Eliminate percpu counter contention in reply cache statistics
NFSD: Eliminate percpu counter contention in DRC memory accounting
NFSD: Fix off-by-one in DRC bucket pruning limit
NFSD: Relocate NFSv4 "supported attributes" to new header
NFSD: Relocate nfsd4_set_netaddr()
NFSD: Relocate nfsd_user_namespace()
NFSD: Move struct readdir_cd
NFSD: Move the export.h include from nfsd.h to auth.c
NFSD: Remove '#include "nfsd.h"' from fs/nfsd/cache.h
NFSD: include "netns.h"
NFSD: Explicitly include "stats.h"
NFSD: Make "stats.h" self-contained
...
|
||
Jiangshan Yi
|
d2796ffe38 |
bnx2x: fix double free in bnx2x_init_firmware() error path
bnx2x_init_firmware() frees bp->init_ops, bp->init_data and
bp->init_ops_offsets in its error path without setting them to NULL.
The cleanup function bnx2x_release_firmware() frees the same three
pointers unconditionally, so if init_firmware fails and
release_firmware is later called (e.g. from __bnx2x_remove or through
the function state machine), all three are freed a second time.
Set each pointer to NULL after kfree() in the error path so that the
subsequent kfree(NULL) in bnx2x_release_firmware() is a safe no-op.
Fixes:
|
||
Cen Zhang (Microsoft)
|
d2c26c2911 |
ipv6: avoid divide by zero in rt6_multipath_rebalance
rt6_multipath_rebalance() calculates the total eligible nexthop weight
in one pass and programs upper bounds in a second pass. Since
RTM_NEWROUTE is RTNL-free, a concurrent
ignore_routes_with_linkdown update can make the first pass return zero
while the second sees an eligible nexthop, causing
rt6_upper_bound_set() to divide by zero.
UBSAN: division-overflow in net/ipv6/route.c:4845:17
Oops: divide error: 0000 [#1] SMP KASAN NOPTI
rt6_upper_bound_set() net/ipv6/route.c:4845
rt6_multipath_rebalance()
fib6_add_rt2node()
ip6_route_multipath_add()
inet6_rtm_newroute()
Skip upper-bound calculation when the first pass reports a zero total.
This respects the lock-free performance considerations here and solves
insecure scenarios.
Fixes:
|
||
|
Linus Torvalds
|
ada9ccfb81 |
Fixes:
orangefs: fix double-free of trailer_buf orangefs: skip leading spaces before parsing client debug masks Cleanup: orangefs: Remove commented out code New: orangefs: use folio_pos() and folio_size() in orangefs_page_mkwrite() -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEWLOQAZkv9m2xtUCf/Vh1C1u0YnAFAmqEfo8ACgkQ/Vh1C1u0 YnCw7g/6A8tslelLuzkjMtF91rNpSQZtluVqT84CclmxFCChFlUI/M7fLgvnntph 8EQ70clSfiKsTgqnB0P0PQrIyxgY/fVgOFFGT6SBrl2iHr9rqF7nkv1GH5Ymn/W6 WhMmYKPiES0yZyNOchOBr35v7BG5m26FJfGzBCTxmTwo5SeqBziaGcR5lBT9pIoB z89Aa+x6BI3GOG3d8bOCnmiDJqypyaVzUqBIccJaWVUkxT9svZo51hHweaM/GF9w XC8DYrkR7bOb4IV+GU2vLKFn1r4PAMq720aVRtvWWm+LOpszhVCxafu4w/kqbaWl 1T8UHoAEGVSN8I3EJSc2gbZ7ZjoY6WCSOBSlN9I7xWy4HRt1zZ+FBPp5UGvhlcyU jznhhufik6dvBdHLd78yJBcrQRYfD35aWRIlPnJs4Z72AYX3+oLL2wvyM0SNd0aF IQ35GheSdlpUsYHZHZyFaK3Iw68VcOoYtCl+7DQhrhFwHz9NvDXgSW3wJI064yBU wf/Y4xAxy13A6o8FLzOk6jBZJ3OpaqcKO9liIXiq0yZ/uLikhXv096Ags4XArJh+ oS21vd1gUqN2xCaFJcrSktjmVkCdXLHo94HKZ6A+jx82xyByeprJMmPJPP9EBt3Y cUgFSfraAh2dZ+zxVZ/my5qrPo/7hP4IXo35fyMiR41m14wsgkI= =n1xT -----END PGP SIGNATURE----- Merge tag 'for-linus-7.3-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux Pull orangefs updates from Mike Marshall: "Fixes: - fix double-free of trailer_buf - skip leading spaces before parsing client debug masks Cleanup: - Remove commented out code New: - use folio_pos() and folio_size() in orangefs_page_mkwrite()" * tag 'for-linus-7.3-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux: orangefs: skip leading spaces before parsing client debug masks orangefs: Remove commented out code in find_cached_xattr orangefs: use folio_pos() and folio_size() in orangefs_page_mkwrite() orangefs: fix double-free of trailer_buf on readdir copy failure |
||
Eric Dumazet
|
07e98a4d5e |
netdevsim: update queue NAPI association on queue reset
In netdevsim, receive queues (struct nsim_rq) embed their own struct
napi_struct. When queue reset is performed (e.g. via queue_reset
debugfs), nsim_queue_start() swaps in a newly allocated struct nsim_rq,
and nsim_queue_mem_free() later deletes and frees the old one.
However, nsim_queue_start() failed to update the queue-to-NAPI mapping
via netif_queue_set_napi(). As a result, dev->_rx[idx].napi continued to
point to the old NAPI struct. After the old queue was freed, a subsequent
queue dump via Netlink (NETDEV_CMD_QUEUE_GET) triggered a KASAN
slab-use-after-free read in nla_put_napi_id() when accessing
rxq->napi->napi_id.
Fix this by calling netif_queue_set_napi() in nsim_queue_start() to
associate the new NAPI with the RX queue, and clear the association
with netif_queue_set_napi(..., NULL) in nsim_del_napi() during teardown.
Fixes:
|
||
Anirudh Prasad
|
ced45be007 |
ACPI: pfr_update: fix stack buffer overflow in query_capability()
query_capability() copies four ACPI buffer objects returned by the
firmware _DSM into fixed-size u8[16] fields in struct
pfru_update_cap_info using memcpy with the firmware-supplied length:
memcpy(&cap_hdr->code_type,
elements[CAP_CODE_TYPE_IDX].buffer.pointer,
elements[CAP_CODE_TYPE_IDX].buffer.length);
The same pattern repeats for drv_type, platform_id, and oem_id.
If the firmware returns buffer.length > 16 for any of these fields,
memcpy writes past the destination array.
struct pfru_update_cap_info is stack-allocated in pfru_ioctl().
Confirmed with KASAN on 7.2-rc6: three stack-out-of-bounds reports
are generated when a DSM returns 64-byte buffers, with writes reaching
44 bytes past the end of cap_hdr's [64, 156) frame window into
adjacent stack redzones.
Introduce a helper pointer to out_obj->package.elements and use it
to validate each buffer length against its destination field size
before copying, returning -EINVAL if the firmware supplies an
oversized buffer.
Fixes:
|
||
Aldo Ariel Panzardo
|
408da1df18 |
net: mctp: hold a reference to the route device in mctp_route_lookup()
mctp_route_lookup() uses rt->dev without holding a reference on it.
mctp_route_lookup_single() returns the route under RCU only, so the
route's device can be torn down concurrently: mctp_dev_put() drops the
last reference and synchronously kfree()s mdev->addrs. mctp_dev_saddr()
then reads rt->dev->addrs[0], giving a use-after-free reachable by an
unprivileged local AF_MCTP user on the receive/forwarding path (no
CAP_NET_RAW required):
BUG: KASAN: slab-use-after-free in mctp_route_lookup
Read of size 1 at addr ... by task mctp_uaf/...
mctp_route_lookup
mctp_pkttype_receive
Freed by task ...:
kfree
mctp_dev_put
mctp_dev_notify
In the same window mctp_dst_from_route() -> mctp_dev_hold() also
increments a refcount that has already reached zero
("refcount_t: addition on 0 ... mctp_dev_hold").
This reintroduces the use-after-free class of CVE-2023-3439: the source
address lookup was moved ahead of the point where the destination takes
its device reference.
Take a reference with refcount_inc_not_zero() before touching rt->dev,
skip a device that is already dead, and drop the reference once the
destination has taken its own.
Fixes:
|
||
|
Linus Torvalds
|
dc83d18cdd |
Changes for 7.3-rc1
Added:
load ATTR_BITMAP run extents from $MFT extension records
initialize err in attr_wof_frame_info
reserve NUL byte when converting UTF-16 names
reject restart table growth beyond U16_MAX entries
validate dirty page table on log replay
basic support for alternative data streams
validate ef->size covers the record's name and value
Fixed:
slab-out-of-bounds write in ni_create_attr_list()
out-of-bounds read of INDEX_ROOT in reparse/objid init
boundary check in ntfs_dir_count()
info-leak in ntfs_rename()
lseek EINVAL on sparse/compressed files with 64-bit clusters
info-leak on partial LZNT decompress in ni_read_frame()
bound page_lcns[] index by the log record
memory leak in indx_find_sort()
integer overflow in MFT cluster validation
reject out-of-range evcn in mi_enum_attr()
out-of-bounds read in read_log_rec_buf()
Changed:
widen inode/record number storage to u64
cosmetic fixes and improvements
rename 'err' to 'ret' in read paths
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEh0DEKNP0I9IjwfWEqbAzH4MkB7YFAmqES2UACgkQqbAzH4Mk
B7Y4QhAAjojTH+HLSlwam+kWHgABEGLn4Ka0/1zMM/3pcct8L/fdVRg3NbnU5VmA
j7Ru76kQxWVAxkGm4Vxbsed62w0/7n5Y25pwCez0x0xKYCP6fEmT8r+R7dwCe9zb
o66g4ZSrMOb0YYaQKiEa24SwU+3vHO1K/WIYt7ay678BN/6Xj6DpY4L1mLpD8gEP
vEWW7vaMiwr27u4MY0r7OW3sj5S3SBxAOhCfhFSeV63egS4Ropenohdj5Lpmrp8N
GZd7NtVD7R1sZiswAGrbqXYWeohUxAMrttLo8sqOBP9wNUu2Cyhde3DlHz1pmU3L
zsairS9LmZNS5ZjdKFt3l/zcLOszBdfiEJKauFbU1g47pB8XHcLHWcZiNLcBhwlR
P4DJHdKXYnK1yixoONKiwnyXr4ApQhnevrfysrICYv6NNCo9KtvLBAUscaweYDmn
SaGvAO57IZrwy54N37IOS9aEjXdANcYvvcJo6HKAsdPENT4sfTfBPvWxTuIqy4i6
lvGJgzH/3LGrf1M9jjqw1zT7LYyKBNhp+2AX1TNUs4wxkO3mDSAFxqTPSjZNK1A9
sgT0+QmCYNpssJr1QUPlfDPE76DwAOYGMAfudGoG1bVauNBPvXMx3Mnqnynmw53t
yS90PGzuoRq5M2/tEwrF/uELsHWHF9zgMqSNdnlq2JmRXsnwTEE=
=foIo
-----END PGP SIGNATURE-----
Merge tag 'ntfs3_for_7.3' of https://github.com/Paragon-Software-Group/linux-ntfs3
Pull ntfs3 updates from Konstantin Komarov:
"Added:
load ATTR_BITMAP run extents from $MFT extension records
initialize err in attr_wof_frame_info
reserve NUL byte when converting UTF-16 names
reject restart table growth beyond U16_MAX entries
validate dirty page table on log replay
basic support for alternative data streams
validate ef->size covers the record's name and value
Fixed:
slab-out-of-bounds write in ni_create_attr_list()
out-of-bounds read of INDEX_ROOT in reparse/objid init
boundary check in ntfs_dir_count()
info-leak in ntfs_rename()
lseek EINVAL on sparse/compressed files with 64-bit clusters
info-leak on partial LZNT decompress in ni_read_frame()
bound page_lcns[] index by the log record
memory leak in indx_find_sort()
integer overflow in MFT cluster validation
reject out-of-range evcn in mi_enum_attr()
out-of-bounds read in read_log_rec_buf()
Changed;
widen inode/record number storage to u64
cosmetic fixes and improvements
rename 'err' to 'ret' in read paths"
* tag 'ntfs3_for_7.3' of https://github.com/Paragon-Software-Group/linux-ntfs3: (21 commits)
fs/ntfs3: validate ef->size covers the record's name and value
fs/ntfs3: fix out-of-bounds read in read_log_rec_buf()
fs/ntfs3: reject out-of-range evcn in mi_enum_attr()
fs/ntfs3: fix integer overflow in MFT cluster validation
fs/ntfs3: Add basic support for alternative data streams
fs/ntfs3: Rename 'err' to 'ret' in read paths
fs/ntfs3: Fix memory leak in indx_find_sort()
fs/ntfs3: bound page_lcns[] index by the log record
fs/ntfs3: validate dirty page table on log replay
fs/ntfs3: reject restart table growth beyond U16_MAX entries
fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()
fs/ntfs3: reserve NUL byte when converting UTF-16 names
ntfs3: initialize err in attr_wof_frame_info
fs/ntfs3: fix lseek EINVAL on sparse/compressed files with 64-bit clusters
fs/ntfs3: load ATTR_BITMAP run extents from $MFT extension records
ntfs3: fix info-leak in ntfs_rename()
ntfs3: fix boundary check in ntfs_dir_count()
fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init
fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
fs/ntfs3: cosmetic fixes and improvements
...
|
||
Ruoyu Wang
|
6b9eaa61ff |
net: ipa: balance runtime PM reference on remove error
ipa_remove() takes a runtime PM reference before accessing IPA hardware
during teardown. If a concurrent modem start or stop keeps
ipa_modem_stop() busy across both attempts, the callback intentionally
returns without releasing the remaining resources because proceeding
with teardown could crash. That return also skips the matching
pm_runtime_put_noidle(), leaving the callback's usage-count reference
held.
Drop only this runtime PM reference before returning.
pm_runtime_put_noidle() does not request an idle transition, so the
hardware and resources retained on this exceptional path remain
untouched while the usage count stays balanced.
This issue was found by a static analysis checker and confirmed by
manual source review.
Fixes:
|
||
Jakub Kicinski
|
a4d7fc3255 |
Merge branch 'forcedeth-two-register-window-bounds-fixes'
Marek Czernohous says:
====================
forcedeth: two register-window bounds fixes
Two bounds fixes in forcedeth, both in the same shape: a loop that walks
the register window one step too far. They are independent of each other
and touch different functions.
1/2 nv_suspend() and nv_resume() save and restore the non-PCI config
space with i <= register_size/sizeof(u32). On a VER3 device that is
exactly the length of saved_config_space[], so the last iteration
reads and writes one element past the array, and on resume it
writel()s that element one dword past the length the driver mapped.
UBSAN catches it.
2/2 nv_tx_timeout() dumps the window in rows of eight dwords but only
bounds the row's starting offset, so the final row reads between 12
and 28 bytes past register_size, on every one of the three supported
window sizes.
Neither is a regression. Both are long standing, and 1/2 in particular
is not new to the list:
- The identical off-by-one in nv_get_regs() was fixed by commit
|
||
|
Linus Torvalds
|
8f421dfec2 |
Changes since last update:
- Allow source fds via fsconfig(), in addition to source paths - Use dedicated metadata inodes for file-backed mounts - Disallow invalid interlaced ztailpacking pclusters - Validate on-disk compression algorithm IDs against supported ones - Fix unused pcluster pools on higher page-size platforms -----BEGIN PGP SIGNATURE----- iQJFBAABCgAvFiEEQ0A6bDUS9Y+83NPFUXZn5Zlu5qoFAmqD0icRHHhpYW5nQGtl cm5lbC5vcmcACgkQUXZn5Zlu5qryQA/+L588+cfcFeLOEdugWWAwxIMcC6UZQza3 /XQD+jzlBbK/d1TQs3H9rdIibo9+5WVOG9cME4oS195Q+Di29/BmEfqYCvjwXZDr mUrl68TdsPw7fI2vCpLRduCJPXpURqJYBX77G2NfWcfFNNjZykNBOe9OAHgbBqwI 7+UmhxvRB2TvZidZ2OhCXC02dcSBcHifscniLbC9XFdhKKRgEC5Zk8jrJ+YoSIfF R7aa8zrAe1I7AI09aRPKTwjiDCueBvqE72tKodXtYr+Ay0TPWEzVZpFMPW3fjGzb TDAWPfA5oK7U7L+euGaILFXOrBnfyfc+iH1P4t6jsbFVZTemvVKv/mO/Rk3vUj+l riwDH/ZPrQguPjpMuQrXCEtFd+zEfhSpXVMYNU1MBgiPnB/Puts6C89UYtyueYf8 9nNSrKsdeZnxiimx/VnYvBNz+8l7tonvcykDLZkM7tJ6PhjyO64GzivRwN0QqctU JygsXTEBbVPHf6degKpxbx2J2FyH+Nr3tBcq/eIQqI2wENwr+qUyfQ4zmlPpQCoS fAIHqdmo2TMZYNcLT5sG1+xScETiTPvSWXsBr4iPpqWCA/QiY7rhbkTN+A0DNMcw utw9LydnlV6ERt0s56e+jmyNdgf5idkxDN/7uzvregIVCxlVCZpluNny3MBgpTPN RqhyM+v00Jk= =jqEn -----END PGP SIGNATURE----- Merge tag 'erofs-for-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs updates from Gao Xiang: "The most notable enhancement is to allow passing source fds via fsconfig() for composefs. The others are all various fixes: - Allow source fds via fsconfig(), in addition to source paths - Use dedicated metadata inodes for file-backed mounts - Disallow invalid interlaced ztailpacking pclusters - Validate on-disk compression algorithm IDs against supported ones - Fix unused pcluster pools on higher page-size platforms" * tag 'erofs-for-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: fix unused pcluster_pools for higher page sizes erofs: guard on-disk algorithm IDs against Z_EROFS_COMPRESSION_MAX erofs: fix interlaced ztailpacking pclusters erofs: use dedicated meta inodes for file-backed mounts erofs: accept source file descriptor via fsconfig erofs: fix typo in error messages |
||
Marek Czernohous
|
cfa9178ce2 |
forcedeth: stop the tx_timeout register dump past the requested window
nv_tx_timeout() dumps the register window in rows of eight dwords:
for (i = 0; i <= np->register_size; i += 32) {
netdev_info(dev, "%3x: %08x ... %08x\n", i,
readl(base + i + 0), ..., readl(base + i + 28));
The loop bound only checks the row's starting offset, so the final row
reads a full 32 bytes from a position that is below the end of the window
but too close to it. base is mapped with exactly that length:
np->base = ioremap(addr, np->register_size);
so the tail of that row is read from beyond the length the driver asked
for. Per variant, the last iteration reads past register_size by:
NV_PCI_REGSZ_VER1 (0x270): row 0x260 reads to 0x27f, 16 bytes over
NV_PCI_REGSZ_VER2 (0x2d4): row 0x2c0 reads to 0x2df, 12 bytes over
NV_PCI_REGSZ_VER3 (0x604): row 0x600 reads to 0x61f, 28 bytes over
This happens on every supported device, not just one of them. Note that
it is not a consequence of the sizes being odd: with i <= register_size
the offending row is reached whatever the size, and a size that were a
multiple of 32 would overrun by a full row rather than by a remainder.
To be precise about the severity: the reads stay inside the BAR. Memory
BAR sizes are powers of two, the driver only accepts a region with
pci_resource_len() >= register_size (forcedeth.c:5757-5762), and the
next power of two at or above each register_size already covers the
offending row: 0x400 for 0x270 and 0x2d4, 0x800 for 0x604. ioremap()
also rounds the mapped length up to page granularity, so the reads land
inside the mapping the CPU has as well. What they leave is the window
the driver asked for, not the BAR and not the mapping. That is still a
driver reading registers it did not ask for, and it is trivial to
avoid, but nobody should expect a fault from it.
Changing <= to < is not enough: register_size is a length and every size
above is larger than its last row start, so i still reaches the offending
row. Check that the whole row fits instead.
The trade-off is that a partial trailing row is no longer dumped: 16 bytes
for VER1, 20 for VER2, 4 for VER3. That seemed preferable to reading
outside the requested window, and to open-coding a second, narrower dump
for the remainder in what is a debug-only path. Extending the dump to
cover the tail can be done on top if anyone misses those registers.
Only reachable with the debug_tx_timeout module parameter, which defaults
to false. It has not been observed at runtime: forcing a genuine TX
timeout on the reference machine is not something I can do safely, so this
rests on the arithmetic above and on a build test, not on a reproduction.
UBSAN does not catch it either, since these are MMIO reads rather than an
array access. It was found by reading the function while fixing the
saved_config_space off-by-one in nv_suspend() and nv_resume().
The dump was introduced with a fixed 0x400 bound while ioremap() mapped
only NV_PCI_REGSZ (0x270), so it read about 0x190 bytes too far from the
start. Commit
|
||
|
Marek Czernohous
|
9393f1d656 |
forcedeth: fix off-by-one when saving/restoring non-PCI config space
nv_suspend() and nv_resume() walk the non-PCI configuration space with for (i = 0; i <= np->register_size/sizeof(u32); i++) which runs one iteration too many. saved_config_space is declared as u32 saved_config_space[NV_PCI_REGSZ_MAX/4]; and NV_PCI_REGSZ_VER3 is equal to NV_PCI_REGSZ_MAX (0x604), so on a VER3 device register_size/sizeof(u32) is exactly the array length and the last iteration addresses one element past the end. The element it lands on is np->name_rx[0..3]: saved_config_space[] is followed immediately by char name_rx[IFNAMSIZ + 3], and char needs no padding. Nothing observable is corrupted by that, because nv_request_irq() rewrites name_rx with sprintf() before it is ever passed to request_irq(). The bug is the out-of-bounds access itself, which UBSAN reports and which CONFIG_UBSAN_TRAP=y turns into a trap that aborts the running kernel code, plus an MMIO read and, on resume, an MMIO writel() to base + 0x604, one dword past the range the driver mapped: np->base = ioremap(addr, np->register_size); VER1 and VER2 devices stay inside the array, but they too get the stray read and the stray write one dword past their own window. Caught by UBSAN on an Apple Macmini3,1 (MCP79) during a deep S3 cycle. The splat below is trimmed: the build path in the file name, the CPU and taint lines, the Workqueue line, the "?" hint frames, and the frames below device_suspend are all cut. The kernel was tainted, with an out-of-tree nouveau and CPU_OUT_OF_SPEC; forcedeth itself was the stock module. UBSAN: array-index-out-of-bounds in drivers/net/ethernet/nvidia/forcedeth.c:6225:25 index 385 is out of range for type 'u32 [385]' Call Trace: dump_stack_lvl+0x5d/0x80 ubsan_epilogue+0x5/0x2b __ubsan_handle_out_of_bounds.cold+0x54/0x59 __this_module+0xe398c/0xe9010 [forcedeth] pci_pm_suspend+0x80/0x170 dpm_run_callback+0x51/0x160 device_suspend+0x1a2/0x4a0 ... Both loops are hit. UBSAN reports each source location only once per module load (__ubsan_handle_out_of_bounds() calls suppress_report(), which does test_and_set_bit(REPORTED_BIT, ...) on the struct source_location), so the two splats land in the first S3 cycle after the module is loaded and later cycles are silent even though the access still runs off the end every time. In that first cycle line 6225 is reported from pci_pm_suspend and line 6240 from pci_pm_resume. The same off-by-one was fixed in nv_get_regs() by commit |
||
|
Jakub Kicinski
|
ac9d95c71a |
Merge branch 'net-mlx5-preserve-speed-and-state-across-vport-modify-commands'
Tariq Toukan says: ==================== net/mlx5: Preserve speed and state across vport modify commands The firmware vport modify command bundles both admin state and max tx speed in a single operation, which requires each side to preserve the other field when it only intends to change one. When modifying max tx speed, the driver already queries the current admin state and passes it back to avoid overwriting it. However, this query and the subsequent modify were not atomic, a state change between the two could cause the modify to overwrite the new state with a stale value. The fix holds esw->state_lock across the query-modify sequence. When support for setting max tx speed via the vport modify command was introduced, the existing admin state modify path was not updated to preserve the current speed. As a result, the firmware interprets the zero speed field as an intentional reset. The fix adds a speed query before the state modify and passes the result back in the command. To support that, mlx5_query_vport_max_tx_speed() had to be fixed first: it was returning zero whenever the vport was DOWN, which was correct for the query_port_speed verb but would defeat the purpose of querying before a state modify. The DOWN-to-zero logic is moved to the verb-layer caller so the function returns the raw firmware value. Patch #1 holds esw->state_lock across the state query and modify in the speed modify path Patch #2 moves the vport DOWN zero mapping to the verb-layer caller so the query returns the raw firmware value Patch #3 queries current max tx speed before modifying vport state to preserve it ==================== Link: https://patch.msgid.link/20260816065015.3280733-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
Or Har-Toov
|
ad0ae7aefa |
net/mlx5: E-Switch, preserve max tx speed on vport state modification
When modifying vport state, the firmware interprets a zero in the max tx
speed field as an intentional reset, which can overwrite previously set
values. This patch attempts to fix this by querying the current max tx
speed from firmware before modifying the vport state and passing it back
in the modification command. If the query fails, fall back to the cached
agg_max_tx_speed value to avoid inadvertently resetting the speed.
Fixes:
|
||
|
Or Har-Toov
|
20f11b5cfa |
net/mlx5: Move vport DOWN state check out of mlx5_query_vport_max_tx_speed()
mlx5_query_vport_max_tx_speed() was introduced to serve the
query_port_speed path, which uses max_tx_speed == 0 when port is down.
This is incorrect for callers that need the actual configured speed
regardless of vport state, such as modify-vport-state helpers
that must preserve the speed across state transitions.
Move this logic to the caller function in the verb flow and let
mlx5_query_vport_max_tx_speed() return the raw firmware value
unconditionally.
Fixes:
|
||
Mark Bloch
|
ff0f9b7aa1 |
net/mlx5: E-Switch, use state lock for vport state changes
Protect vport admin state modifications and vport iteration with the
eswitch state_lock mutex to ensure proper serialization of concurrent
vport state changes.
Currently, calls to mlx5_modify_vport_admin_state() and loops iterating
over eswitch vports can race with each other, potentially leading to
inconsistent vport state. Fix this by acquiring esw->state_lock
Fixes:
|
||
Fan Ye
|
c5ae83ee02 |
net: thunderbolt: Count delivered packets in rx_packets and rx_bytes
tbnet_poll() increments rx_packets once per received frame because that is
the NAPI work unit, and then adds the same number to stats.rx_packets. An
skb is handed to the stack only when the last frame of a packet arrives,
so once the MTU exceeds TBNET_MAX_PAYLOAD_SIZE the statistic reports
frames. tx_packets is bumped once per skb, so the two ends of a link
disagree: at MTU 65330 the receiver reports 16 times the packets its
sender sent.
rx_bytes has the matching problem: frames of a packet that is later
dropped mid-assembly are already accounted, so it does not correspond to
rx_packets as documented. Account for both where the packet is completed,
and leave the NAPI work counter alone.
Fixes:
|
||
Andrea Mayer
|
f826df9533 |
ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()
ipv6_rpl_srh_rcv() dereferences idev from __in6_dev_get() without a NULL
check when reading idev->cnf.rpl_seg_enabled.
When the device's MTU drops below IPV6_MIN_MTU, addrconf_ifdown() clears
dev->ip6_ptr through RCU_INIT_POINTER(). A packet that passed the idev
check in ip6_rcv_core() can then reach ipv6_rpl_srh_rcv() with
dev->ip6_ptr already NULL.
Reproduced by flooding the receiving interface with ping6 traffic while
flapping its MTU between 1500 and 1200:
BUG: KASAN: null-ptr-deref in ipv6_rpl_srh_rcv+0xb3/0x1070
Read of size 4 at addr 00000000000006b4 by task ping6/394
CPU: 2 UID: 0 PID: 394 Comm: ping6 Not tainted 7.2.0-rc7-micro-vm-dev-00095-g24ef02f934ee #240 PREEMPT(full)
Call Trace:
<IRQ>
kasan_report+0xc6/0x100
ipv6_rpl_srh_rcv+0xb3/0x1070
ip6_protocol_deliver_rcu+0x759/0x9a0
ip6_input_finish+0xa8/0x1b0
ip6_input+0xe1/0x490
ipv6_rcv+0x33d/0x460
__netif_receive_skb_one_core+0xd6/0x130
process_backlog+0x2cc/0xa00
__napi_poll.constprop.0+0x56/0x270
net_rx_action+0x327/0x730
handle_softirqs+0x11e/0x630
do_softirq+0xb3/0xf0
</IRQ>
Both ipv6_rpl_srh_rcv() and ipv6_srh_rcv() are called only from
ipv6_rthdr_rcv(), which already has an idev lookup.
Fix the NULL dereference on the RPL path by checking idev in
ipv6_rthdr_rcv(), before it calls either function. The callees take idev as
an argument and no longer call __in6_dev_get(), so the packet is now
dropped in one place, with SKB_DROP_REASON_IPV6DISABLED on both paths.
Fixes:
|
||
Hyunwoo Kim
|
da4471557f |
net/tcp-ao: fix use-after-free of current_key on reconnect to another peer
tcp_inbound_ao_hash() is called before bh_lock_sock_nested() is taken,
with only rcu_read_lock() held. On the fast path for established
sockets, if the rnext_keyid sent by the peer differs from
current_key->sndid, the key the peer asked for is looked up and stored
in current_key. The lookup is inside the RCU read side, but current_key
outlives it.
When the socket is disconnected and connect() is called again for
another peer, tcp_ao_connect_init() unlinks every key that does not
match the new peer and frees it with call_rcu(). If current_key points
at such a key, it is cleared to NULL.
The fast path reads sk_state only once on entry, so a softirq that got
into it while the socket was still established can update current_key
after that loop has already run. The update is inside the RCU read side,
so it comes before the call_rcu() callback, and once the callback frees
the key, current_key is left pointing at freed memory.
The next transmission picks that pointer up in tcp_get_current_key().
tcp_ao_transmit_skb() then reads the traffic key from the freed object,
which is the use-after-free.
Wait for one grace period before unlinking, and only if a key is going
to be removed. By the time tcp_connect() runs the socket is already in
TCP_SYN_SENT, and TCP_AO_ESTABLISHED does not contain TCPF_SYN_SENT, so
a softirq entering after the wait cannot reach the fast path, and the
ones already in it have finished. The existing NULL handling in the loop
is then enough.
Fixes:
|
||
|
Linus Torvalds
|
62abb6cffd |
NVDIMM and DAX for v7.3
Documentation cleanup: nvdimm-btt: clean up kernel-doc warnings libnvdimm: nd.h: clean up kernel-doc warnings DAX prepare for FAMFS: dax: fsdev.c minor formatting cleanup dax: fix holder_ops race in fs_put_dax() dax: read holder_ops once in dax_holder_notify_failure() dax/fsdev: fail probe on invalid pgmap offset dax/fsdev: use __va(phys) for kaddr in direct_access dax/fsdev: clear pgmap ops and owner on unbind dax/fsdev: don't leave a dangling dev_dax->pgmap on probe failure dax/fsdev: clear vmemmap_shift when binding static pgmap dax/fsdev: fix multi-range offset in memory_failure handler dax: fix misleading comment about share/index union in dax_folio_reset_order() NVDIMM misc fixups: nvdimm/btt: reject an arena whose nfree is below the lane count libnvdimm/labels: Bound the on-media label size before the shift libnvdimm/labels: Prevent integer overflow in __nd_label_validate() Coccinelle reported cleanups: nvdimm: ndtest: remove redundant NULL check before vfree() nvdimm: nfit: remove redundant NULL check before vfree() -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQR/ATNjDEocsE1wudD5tRoRP7nxxwUCaoOJMQAKCRD5tRoRP7nx x6FQAQCmAfXFZK5eE+nujrFanI5d2iiKcTefwR/LYu0HOVG82AEA/c39OZz4jhSj bx49jE45o7qTaZHzY8ADSBVl8GHSOQA= =0lJA -----END PGP SIGNATURE----- Merge tag 'libnvdimm-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull NVDIMM and DAX updates from Alison Schofield: "Most are DAX preparatory patches for FAMFS support, along with a few NVDIMM fixes and documentation cleanups. - Documentation cleanup, removing kernel-doc warnings - preparing DAX for FAMFS - misc NVDIMM fixups with cleanups for issues reported by Coccinelle" * tag 'libnvdimm-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: nvdimm-btt: clean up kernel-doc warnings libnvdimm: nd.h: clean up kernel-doc warnings dax: fsdev.c minor formatting cleanup dax: fix holder_ops race in fs_put_dax() dax: read holder_ops once in dax_holder_notify_failure() dax/fsdev: fail probe on invalid pgmap offset dax/fsdev: use __va(phys) for kaddr in direct_access dax/fsdev: clear pgmap ops and owner on unbind dax/fsdev: don't leave a dangling dev_dax->pgmap on probe failure dax/fsdev: clear vmemmap_shift when binding static pgmap dax/fsdev: fix multi-range offset in memory_failure handler dax: fix misleading comment about share/index union in dax_folio_reset_order() nvdimm/btt: reject an arena whose nfree is below the lane count libnvdimm/labels: Bound the on-media label size before the shift libnvdimm/labels: Prevent integer overflow in __nd_label_validate() nvdimm: ndtest: remove redundant NULL check before vfree() nvdimm: nfit: remove redundant NULL check before vfree() |
||
Victor Nogueira
|
8e2efb3f45 |
net/sched: add get_fill_size callbacks for actions missing them
Several tc actions - act_police, act_bpf, act_pedit, act_ife, act_sample,
act_ct, act_ctinfo and act_tunnel_key among them - provide no
get_fill_size() callback, so tcf_action_fill_size() falls back to
tcf_action_shared_attrs_size() which does not account for the
action-specific netlink attributes emitted inside TCA_ACT_OPTIONS by
their dump functions.
When an RTM_NEWACTION request with NLM_F_ECHO (or an RTNLGRP_TC
listener) creates several actions, tcf_add_notify_msg() allocates the
echo skb from this underestimated size. When this happens, the act_api
code fails to add all of the fields to the netlink message and, thus,
fails to send it. Issue is that, when that happens, this failure doesn't
stop the action instances from being added. So any user watching these
events will be under the false impression that no actions were created at
all.
For example, act_pedit overruns with 32 actions of four munge keys each,
act_police with 32 policers once the optional rate/peakrate/result/avrate
attributes are present.
To fix this, add the missing get_fill_size callbacks returning the
worst-case size of each action's dump attributes, following the pattern
used by act_gact/act_skbedit/act_vlan. Also widen the TCA_GACT_TM
accounting in tcf_action_shared_attrs_size() to nla_total_size_64bit(),
since actions dump their tcf_t with nla_put_64bit(), which may be
preceded by an NLA_PAD attribute.
Note: We only provided fixes for the actions we reproduced this bug with
as of today. We can send a separate hardening patch for the remaining
actions to net-next later. The other pre-existing issues, pointed out by
Clashiko [1], will be fixed in upcoming patches.
[1] https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260810164357.1653956-1-victor%40mojatatu.com
Fixes:
|
||
|
Eric Dumazet
|
e5c8e301b4 |
selftests: net: packetdrill: add tests for advertised MSS with PMTU exceptions
Add packetdrill tests for IPv4 and IPv6 to verify that the advertised MSS in SYN-ACK is derived from the configured interface/route MTU, and is not shrunk by learned Path MTU exceptions from previous outbound connections. Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev> Link: https://patch.msgid.link/20260815071532.301908-1-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
Jiayuan Chen
|
2640e64195 |
net: advertise TCP MSS from the configured MTU, not the learned PMTU
The MSS a host puts in its SYN tells the peer how big a segment it may send us. Right now we can shrink it with a PMTU we learned on our own send path, which is the wrong direction entirely. On asymmetric paths this bites - think DSR load balancers, where the request side goes through a smaller-MTU overlay. We learn a small PMTU going out, then advertise a small MSS, and the peer stays capped for the whole connection even though its path back to us is wide. MSS only shows up in the SYN and never grows back. On symmetric paths we lose nothing by dropping it either: the peer runs its own PMTU discovery and usually already knows the real path MTU. So work out the advertised MSS from the configured route or device MTU and ignore the learned PMTU. Our send side is unchanged, still clamped by tcp_current_mss(). Add ip_dst_mtu_configured()/ip6_dst_mtu_configured() and use them from the two default_advmss() paths. Fixes: |
||
Théo Lebrun
|
ec518a7c4b |
net: macb: drop CONFIG_OF #if block
Fix -Wimplicit-function-declaration error on CONFIG_OF=n builds:
drivers/net/ethernet/cadence/macb_main.c: In function ‘macb_probe’:
drivers/net/ethernet/cadence/macb_main.c:5951:15: error: implicit
declaration of function ‘macb_alloc_tieoff’ [...]
5951 | err = macb_alloc_tieoff(bp);
| ^~~~~~~~~~~~~~~~~
drivers/net/ethernet/cadence/macb_main.c:5973:9: error: implicit
declaration of function ‘macb_free_tieoff’ [...]
5973 | macb_free_tieoff(bp);
| ^~~~~~~~~~~~~~~~
Error got introduced because functions are mistakenly declared in a
`#if defined(CONFIG_OF)` block. Instead of moving functions around,
avoid any future mistake and drop the block entirely.
Change the module content slightly on CONFIG_OF=n. Previously match
tables were ignored. Now they appear in the resulting build. This is
considered trivial in size by most and is the common case:
⟩ 18 out of 254 OF net drivers reference CONFIG_OF
⟩ rg -lF 'MODULE_DEVICE_TABLE(of,' drivers/net/ | tee /tmp/a | wc -l
254
⟩ xargs -a /tmp/a rg -l CONFIG_OF | wc -l
18
Tangent: no, of_match_ptr() does not imply that the compiler can
optimize out match tables, because MODULE_DEVICE_TABLE(of, ...)
unconditionally puts the match tables in the binary. It is only meant
to avoid undefined declaration issues when match tables are hidden
behind a #ifdef, as was done before. We therefore drop the macro call.
Fixes:
|
||
|
Linus Torvalds
|
cf62c7084a |
execve update for v7.3-rc1
- x86/elf: Correct comment for STACK_RND_MASK() (Lorenzo Stoakes) -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRSPkdeREjth1dHnSE2KwveOeQkuwUCaoO91gAKCRA2KwveOeQk u/OkAQDes/wLtw008oU58/Tty17XXmurNLQME4vp1u/UEVzc8gEAy70C+9xCYUSs JLGY89Dr2O+GSGABd2MsLwS9xxO87AQ= =rp7J -----END PGP SIGNATURE----- Merge tag 'execve-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull execve update from Kees Cook: - x86/elf: Correct comment for STACK_RND_MASK() (Lorenzo Stoakes) * tag 'execve-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: x86/elf: Correct comment for STACK_RND_MASK() |
||
Hui Su
|
efebf64966 |
bpf: Fix infinite loop in pcpu_freelist push with one possible CPU
__pcpu_freelist_push() can loop forever when only one CPU is possible
and an NMI re-enters pcpu_freelist_push() while the interrupted context
holds that CPU's freelist lock.
After the current-CPU fast path fails, the fallback loop walks
cpu_possible_mask while skipping the current CPU. With CONFIG_SMP=n, or
when an SMP kernel is limited to one possible CPU with nr_cpus=1 or
possible_cpus=1, there are no other possible CPUs to examine. The loop
therefore makes no lock acquisition attempt and can never make progress.
The following stack was observed on a UP system:
NMI context:
pcpu_freelist_push
free_htab_elem
htab_map_delete_elem
[perf-event BPF program]
__perf_event_overflow
perf_event_nmi_handler
exc_nmi
Interrupted context:
__pcpu_freelist_push
pcpu_freelist_push
free_htab_elem
htab_map_delete_elem
[raw_tp/sys_enter BPF program]
__bpf_trace_sys_enter
do_syscall_64
raw_res_spin_lock() detects the same-CPU recursive acquisition and
returns -EDEADLK, but the subsequent fallback loop has no candidate head
on a system with one possible CPU.
Restore the extra fallback head that existed before the rqspinlock
conversion. Keep the current-CPU fast path, then try the other possible
CPUs and finally the extra head. The additional head lets a push, which
cannot fail without losing a preallocated element, make progress when the
only per-CPU head is held by the interrupted context.
Also check the extra head from the pop path so that nodes placed there
can be reused.
Fixes:
|
||
|
Jiayuan Chen
|
7ee2f20bf2 |
selftests/bpf: Add reg-invariants test for speculative pointer arithmetic
An unprivileged socket filter does variable pointer arithmetic on a PTR_TO_MAP_VALUE whose offset collapses to a constant. The Spectre-v1 speculative path used to snapshot the pointer with a const offset and an unbounded r32, which tripped reg_bounds_sanity_check() on the following register move. Mark the test __success_unpriv (the speculative path only runs unprivileged) and flag it BPF_F_TEST_REG_INVARIANTS so the invariant violation becomes a hard load failure. The unprivileged run fails without the verifier fix and passes with it: verifier_bounds/spec_ptr_alu_const_offset @unpriv:FAIL # without fix verifier_bounds/spec_ptr_alu_const_offset @unpriv:OK # with fix Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev> Tested-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/bpf/20260819125840.286434-2-jiayuan.chen@linux.dev Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> |
||
|
Jiayuan Chen
|
150aeba624 |
bpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic
Take the following unprivileged program as an example:
r0 = bpf_map_lookup_elem(...) /* PTR_TO_MAP_VALUE, offset 0 */
...
14: r0 += r1 /* r1 is a bounded scalar */
15: r9 = r0
Loading it triggers a verifier warning from reg_bounds_sanity_check():
verifier bug: REG INVARIANTS VIOLATION (alu): const subreg tnum out
of sync with range bounds r64={.base=0x0, .size=0x0}
r32={.base=0x0, .size=0xffffffff} var_off=(0x0, 0x0)
What happens:
1. Processing insn 14 (r0 += r1) in adjust_ptr_min_max_vals(), the new
offset is computed into dst_reg's var_off and 32/64-bit ranges.
2. Because pointer registers do not track 32-bit subregister bounds,
__mark_reg32_unbounded() first sets r32 to the full range; r32 is
re-derived from the offset at the end of the function by
reg_bounds_sync().
3. On the unprivileged path, sanitize_ptr_alu() is called and, via
sanitize_speculative_path() -> push_stack(), snapshots the current
register state and schedules the next instruction (insn 15) to be
verified directly as a speculative path.
4. That snapshot is taken between step 2 and the final reg_bounds_sync():
at this point dst_reg's var_off still holds the (const) original
offset while r32 has just been blanked to the full range, i.e. the two
are out of sync. When the speculative path later verifies insn 15
(r9 = r0), the inconsistent state reaches reg_bounds_sanity_check() and
trips the warning.
var_off and the 32-bit range must always be consistent. There are two
ways to keep the snapshot consistent:
1. sync var_off and r32 before the snapshot so they match, or
2. leave r32 at its original (already consistent) value and blank it
only after the snapshot.
The whole point of sanitize_ptr_alu() is to insert a harmless masking
sequence that keeps the access in bounds under speculation, so the state
it snapshots should faithfully represent that. Take approach 2: move
__mark_reg32_unbounded() to after sanitize_ptr_alu(), so the speculative
snapshot keeps the pointer's original, consistent r32. The non-speculative
path is unchanged: r32 is still blanked before the offset is applied and
re-derived by reg_bounds_sync().
Fixes:
|
||
Peixin Xie
|
dc948f8b38 |
ACPI: scan: Defer device power initialization
acpi_bus_get_power_flags() initializes the device power state while the ACPI device object is being created, before checking whether the device is ready for enumeration. If enumeration is deferred, acpi_bus_attach() clears the initialized and power_manageable flags. When the dependency is later satisfied, acpi_bus_init_power() is called again and takes additional references to the power resources used by the device. These references prevent the resources from being turned off when the device enters D3. This issue was reproduced on a SpacemiT K3 RISC-V Pico-ITX. The affected device uses a power resource through _PR0 and has an automatically derived dependency on its interrupt controller. The initial power initialization acquires a power resource reference. The device is then deferred, but that reference is not dropped. When the dependency becomes available, power initialization acquires another reference. Consequently, entering D3 only drops the reference count from 2 to 1 and _OFF is not evaluated: [ 0.314611] ACPI Debug: "I2P2 _STA" [ 0.318260] ACPI: \_SB_.I2P2: ACPI: PM: Power resource is on [ 0.323998] ACPI: \_SB_.I2P2: New power resource [ 0.382108] ACPI Debug: "I2P2 _STA" [ 0.478964] ACPI Debug: "I2P2 _ON" [ 0.482498] ACPI: \_SB_.I2P2: ACPI: PM: Power resource turned on [ 0.488597] ACPI Debug: "I2C2, PS0" [ 0.863170] ACPI: \_SB_.I2P2: ACPI: PM: Power resource already on [ 0.873686] ACPI Debug: "I2C2, PS0" [ 2.416055] ACPI Debug: "I2C2, PS3" [ 2.423397] ACPI: \_SB_.I2P2: ACPI: PM: Power resource still in use To address this, remove the early acpi_bus_init_power() call and leave regular ACPI device objects uninitialized until acpi_bus_attach() runs after the device is ready for enumeration. Power resource objects are initialized through acpi_add_power_resource() and do not require the generic initialization in acpi_bus_attach(), so mark them as initialized there. After the change, device power state initialization is deferred until its dependency is met. Since no reference is acquired before then, the power resource left on by firmware is turned off as unused after the namespace scan. Once the dependency is met, the resource is turned on once for the device and is turned off normally when the device later enters D3: [ 0.314628] ACPI Debug: "I2P2 _STA" [ 0.318277] ACPI: \_SB_.I2P2: ACPI: PM: Power resource is on [ 0.324016] ACPI: \_SB_.I2P2: New power resource [ 0.382118] ACPI Debug: "I2P2 _STA" [ 0.496116] ACPI: \_SB_.I2P2: ACPI: PM: Turning OFF [ 0.501081] ACPI Debug: "I2P2 _OFF" [ 0.504705] ACPI: \_SB_.I2P2: ACPI: PM: Power resource turned off [ 1.415899] ACPI Debug: "I2P2 _ON" [ 1.418866] ACPI: \_SB_.I2P2: ACPI: PM: Power resource turned on [ 1.424947] ACPI Debug: "I2C2, PS0" [ 2.647655] ACPI Debug: "I2C2, PS3" [ 2.654856] ACPI Debug: "I2P2 _OFF" [ 2.654866] ACPI: \_SB_.I2P2: ACPI: PM: Power resource turned off This also avoids powering up devices before their dependencies are available. Signed-off-by: Peixin Xie <peixin.xie@linux.spacemit.com> [ rjw: Changelog edits ] Link: https://patch.msgid.link/20260820-acpi-power-resource-ref-fix-v2-1-29818173ea13@linux.spacemit.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> |
||
|
Linus Torvalds
|
ae814200e8 |
bitmap updates for v7.3
- bitmap_find_next_zero_area_off() optimization (Sunyi);
- bitmap_find_next_zero_area_off(): return size when no zero area is
found (Yury);
- bitmap vs IDA vs Maple Tree performance test (Yury);
- get rid of cpumap_print_to_pagebuf() (Yury);
- use nr_node_ids in __nodemask_pr_numnodes() (Li RongQing);
- bitops: make the *_bit_le functions use unsigned long (Benjamin);
- bitmap scatter & gather test fix (Christophe);
- use __ASSEMBLER__ in bitmap header files (Thomas);
-----BEGIN PGP SIGNATURE-----
iQGzBAABCgAdFiEEi8GdvG6xMhdgpu/4sUSA/TofvsgFAmqDX1YACgkQsUSA/Tof
vsjcpwwAw7130xQPNFREr+ttdoUn3gN/aVUOl7K2Mi3kUOdlg8i9FEaQ/a07nE5L
ozXRAWgSM7VxW1I7nkj5McsGRiRX0SRoXmTbjDfPugMiXbD1UBPqCz2n0rYHYR4P
GfQ0RJK8LUN3Sq1eIu27HNirLG1HU1jCm3fsaTft2naaY6TnSPjklZdVE6Phz87E
eblgm+AO8//EoKsggoMCnGVCVWKE3N1RrWzsaT4ltErGyHvIzvWEbCCk2cI764Qj
orLLeefPf2xVDlbzywU7uUklNWYRe4miPxrbnT5TH2KmTipb3M62MkGjPa5dzYIq
ssOvSnKoQEV9od9cNv1hPFGs5b+RO+kOolcrWKTqWeHFgVTv7dZZL0QvuGHeOfOa
Fc5GPxE2SiXLPVuUEgMhlrg9DsXGf0d9u7JHTnJF+ZL/QhIE+4wOVnIYWUyBZiqx
zF7Ic62xmeJOKz9kfYg9JQYPwUblhhyYtiWOmzLIisf8FXi5M3L9eH6rO6CEWcrk
viEkTMbW
=q8Lf
-----END PGP SIGNATURE-----
Merge tag 'bitmap-for-7.3' of https://github.com/norov/linux
Pull bitmap updates from Yury Norov:
"The usual set of fixes, cleanups and performance improvements together
with a couple of new tests:
- bitmap_find_next_zero_area_off() optimization (Sunyi)
- bitmap_find_next_zero_area_off(): return size when no zero area is
found (Yury)
- bitmap vs IDA vs Maple Tree performance test (Yury)
- get rid of cpumap_print_to_pagebuf() (Yury)
- use nr_node_ids in __nodemask_pr_numnodes() (Li RongQing)
- bitops: make the *_bit_le functions use unsigned long (Benjamin)
- bitmap scatter & gather test fix (Christophe)
- use __ASSEMBLER__ in bitmap header files (Thomas)"
* tag 'bitmap-for-7.3' of https://github.com/norov/linux: (25 commits)
lib: test bitmap vs IDA vs Maple Tree performance for region allocations
bitmap: Return size when no zero area is found
media: s5p-mfc: Treat bitmap size as allocation failure
crypto: ccp: Treat bitmap size as allocation failure
powerpc/msi: Treat bitmap size as allocation failure
ARM: dma-mapping: Treat bitmap size as allocation failure
bitmap: drop bitmap_next_set_region()
nodemask: reduce bitmap width to nr_node_ids in __nodemask_pr_numnodes()
bitmap: Properly initialise destination bitmap for scatter & gather test
lib/bitmap-str: get rid of cpumap_print_to_pagebuf()
perf: Use sysfs_emit() for cpumask show callbacks
PCI/sysfs: Use sysfs_emit() for cpumask show callbacks
RDMA/hfi1: Use sysfs_emit() for cpumask show helper
hwtracing: hisi_ptt: Use sysfs_emit() for cpumask show
fpga: dfl-fme-perf: Use sysfs_emit() for cpumask show
devfreq: Use sysfs_emit() for cpumask show callbacks
cpu: Use sysfs_emit() for cpumask show callback
x86/events: Use sysfs_emit() for cpumask show callbacks
powerpc: Use sysfs_emit() for cpumask show callbacks
arm: Use sysfs_emit() for cpumask show callbacks
...
|
||
|
Jakub Kicinski
|
50720728b1 |
ipsec-2026-08-18
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEH7ZpcWbFyOOp6OJbrB3Eaf9PW7cFAmqEJIUACgkQrB3Eaf9P W7eUHRAAhUaCftYnbSKKcvB8DgDysrRRFOieJ5ucqyYWCc51/O8bQWspzvFd2fiP cq7KLubREyGD8FqMNwl94J2zTW7awrGWyNkiA0TwNouOWIM5yu4eg7aZ1+edOMrx FF15HM8Q4DNgfHGdNYZKzRzP+72qLNEY92o6nbDYQUZmB33tFjic44+7Vphhjwb3 t/GulrwfA8M/98oDgmzqwxSIz+/5E+kXSqLouD/vCMXPbdDv0m1xW2iNPHkU+Bom Kk6WNlcPwJWmpM5mfaWP4C2T1reJnyi99MorBco69PrGFhCVxBftQO08qGaE5EeR YbNNrvPKs7mcCqnwfhDObKz8GdkPIvt79p/UKQjardN1ts/aU5N8CD4bwSzMHWep dmz3j9sydtQom+YXYxAgr50DKpyZKOS7abQou4jTmwTz5/fAHVSPzfzE7aSJpE6o Df9gW7cGmAs4KSeQaHotEBOR790AedwG1bHdn7C/KqOdd4e8IwzC+6ZLNjzlrC/f ZtwN64Ct8uChIs6A+SAnzD+C7SEP8k0A/MFOwbf+Ov5kYLkzFYL/JudB4eK437kQ K+VcZj/jrs3aBqZm5Y/O5PlK4/Bpa04XJamK2cG9la5RGked4VWSffSd9NQIg07t 2Lct15Qe7K9aJrLkXA92Qbjkmhq92RKqVCJ7ylgkwW1cRm5FxDc= =wXnr -----END PGP SIGNATURE----- Merge tag 'ipsec-2026-08-18' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec Steffen Klassert says: ==================== pull request (net): ipsec 2026-08-18 1) xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full Tighten the secpath-depth check so a full chain can't write past xvec[]. 2) Add and revert "esp: do not unref managed frag pages in esp_ssg_unref()" The patch does not fully fully resolve the issue, a corrected version will follow. 3) xfrm: espintcp: fix UAF during close Synchronize espintcp close with the xfrm_trans_reinject work queue so the freed socket message isn't dereferenced again. 4) xfrm: drop ESP-in-TCP packets with no ingress device Drop queued ESP-in-TCP records whose saved ingress device has gone away, avoiding a NULL device deref in the XFRM input path. 5) xfrm: avoid lock inversion in nat keepalive work Split the NAT keepalive walk into a reference-collection phase and a per-state lock phase to break the AB-BA with state removal. This patch has some issues that are fixed with a followup patch. 6) xfrm: Fix skb double-free in xfrm_dev_direct_output() Stop freeing the skb unconditionally in xfrm_dev_direct_output(), letting local_out()'s result indicate when ownership has moved on. 7) xfrm: ah6: validate routing header segments_left Validate the segments_left/hdrlen invariant before rearranging the routing-header addresses, avoiding an OOB memmove on malformed HDRINCL packets. 8) xfrm: fix xfrm_state_construct() auth-trunc leak Detect an already-attached auth-trunc allocation by the pointer rather than inferring it from the algorithm id, so a prior attach isn't overwritten and lost. 9) xfrm: bound nat keepalive state collection Replace the per-state allocation in the NAT keepalive walk with a fixed-size batch that drains under BH-disabled locking and resumes from the cursor, bounding the worker's memory. * tag 'ipsec-2026-08-18' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec: xfrm: bound nat keepalive state collection Revert "esp: do not unref managed frag pages in esp_ssg_unref()" xfrm: fix xfrm_state_construct() auth-trunc leak xfrm: ah6: validate routing header segments_left xfrm: Fix skb double-free in xfrm_dev_direct_output() xfrm: avoid lock inversion in nat keepalive work xfrm: drop ESP-in-TCP packets with no ingress device xfrm: espintcp: fix UAF during close esp: do not unref managed frag pages in esp_ssg_unref() xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full ==================== Link: https://patch.msgid.link/20260818092920.653034-1-steffen.klassert@secunet.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Jakub Kicinski
|
066ae87fe9 |
netfilter pull request 26-08-18
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEjF9xRqF1emXiQiqU1w0aZmrPKyEFAmqDlHcACgkQ1w0aZmrP KyES3w/8C0DTvpbwLOr/QDgbgbo39u78Ih/OxXBqxtXth8bc84DFGXgFxJdHlujI g18zRn9/r4Jo2K56nkJDlUiVVJKOsxuhW5WFCG49qgc3cq4DDwhh85DNg3XFgQLs q+UPf6UHADChfDbBzLezuHKY/Cot8BvpfirQhcQT2kfgv8XmHp3UNidyu2GM3Zqp E31MhRm/ei+IR2R3hhNOs14/cEP3tAY4jTgN4Z3hs63SKw6nZpGDpVtdEHLHWAn0 1b4EawsPlhGp8fjGGNq2hYCeyVKTQrfe3jS/roJ3IfU3Wq/k5XKufSUcG2WNQgRX KifhAXlabcW+tNabay6IWoClIzQPuV+SxcNtswvx+XAnrQ0h9qZb2YDYQlpAE2KP uZ4CWMyzhognmUtpfB957RV3/Q8qG3pleqwz+LpVeGGm6VX/cT20g460X7eyq9+e Ux27fCfSNkC4UHhR+iqM8BAqpsI47OS/X+PC2enCzmSh+JIfEsBeOcUylHVT+p14 mF4USETDzWaXN9yHK1bnbANzG/sRo8KT/pS7taN7+vk5Czje50tckqjgZ0bX5ZAK tOxZGKBajDEjntOWLEEpMvFknkxsI7H55YGU9Glhsbfrf/gfxv61+XSCe8kQ2+a8 QbRuMepR45Vfz04ZiHJoalTi7B9FTsGC3dXCGuL9Es8xf8xObPw= =qmiO -----END PGP SIGNATURE----- Merge tag 'nf-next-26-08-18' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next Pablo Neira Ayuso says: ==================== Netfilter/IPVS fixes for net-next This contains fixes for nf_tables, revisit issues with expectation infra updates reported by sashiko, an ipset fix for deletions in the hash:net type and tne fix for the IPVS FTP helper. 1) Validate layer 4 header mangling done via nfnetlink_queue and nft_payload, this is a follow up to recent similar validation at layer 3. From Zhiling Zou. 2) Do not allocate memory on delete operations in ipset hash:net type, delete operation must always succeed. From Florian Westphal. 3) Deliver nft_obj overquota packet path notification directly via nfnetlink, do not use the control plane batch logic. From Fourie Zhang. 4) Follow up to controlidate check for reinserted dead expectations, to cover the nf_conntrack_expect_related_pair() function too. 5) Do not expose expectation dead flag to userspace via ctnetlink. 6) Make commit set_update_list per-netns to prepare to publish set clone earlier. 7) Publish the set clone earlier from commit path to address set lookup failures during table re-creation, this is targetting the rbtree and pipapo set backends. 8) Fix an integer overflow in the IPVS FTP helper. A similar fix was already proposed for the conntrack FTP helper months ago. From Joas Antonio dos Santos. * tag 'nf-next-26-08-18' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next: ipvs: fix integer overflow in ftp helper port/address parsing netfilter: nf_tables: call set ops .commit when building new ruleset blob netfilter: nf_tables: move set_update_list to nftables per-netns netfilter: ctnetlink: do not expose expectation DEAD flag netfilter: nf_conntrack_expect: consolidate check for insertion of dead expectation netfilter: nf_tables: don't queue packet path object notifications netfilter: ipset: remove need to allocate memory on delete operations netfilter: validate L4 headers after userspace packet writes ==================== Link: https://patch.msgid.link/20260817232957.1281637-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
Yuyang Huang
|
47cdab0d51 |
ipv6: use RCU iterator to dump route exceptions
rt6_nh_dump_exceptions() uses hlist_for_each_entry() to iterate over
RCU-protected exception lists. The caller holds rcu_read_lock(), but does
not hold rt6_exception_lock, so rt6_insert_exception() can concurrently
add an entry with hlist_add_head_rcu().
KCSAN reports this race (irrelevant details omitted):
==================================================================
BUG: KCSAN: data-race in rt6_insert_exception / rt6_nh_dump_exceptions
write (marked) to 0xffff8a7c44c59620 of 8 bytes by interrupt on cpu 5:
rt6_insert_exception+0x3bb/0x760
__ip6_rt_update_pmtu+0x4fe/0x750
ip6_sk_update_pmtu+0x19a/0x3b0
udpv6_err+0x3ff/0x800
icmpv6_notify+0x1e1/0x440
icmpv6_rcv+0x8c0/0xab0
ip6_protocol_deliver_rcu+0x616/0x840
ip6_input_finish+0xb9/0x160
...
entry_SYSCALL_64_after_hwframe+0x77/0x7f
read to 0xffff8a7c44c59620 of 8 bytes by task 549 on cpu 14:
rt6_nh_dump_exceptions+0xb3/0x260
rt6_dump_route+0x53e/0x5f0
fib6_dump_node+0x6d/0xf0
fib6_walk_continue+0x290/0x2d0
fib6_dump_table+0x28d/0x360
inet6_dump_fib+0x37d/0x620
rtnl_dumpit+0x7b/0xd0
netlink_dump+0x3ae/0x7e0
...
entry_SYSCALL_64_after_hwframe+0x77/0x7f
4 locks held by dumper/549:
...
#1: (rcu_read_lock){....}-{1:3}, at: inet6_dump_fib+0x88/0x620
#2: (&tb->tb6_lock){+.-.}-{3:3}, at: fib6_dump_table+0x1e9/0x360
#3: (rcu_read_lock){....}-{1:3}, at: rt6_dump_route+0x483/0x5f0
value changed: 0xffff8a7c44e05700 -> 0xffff8a7c45d60100
Reported by Kernel Concurrency Sanitizer on:
CPU: 14 UID: 0 PID: 549 Comm: dumper Not tainted
7.2.0-rc7-virtme #38 PREEMPT(lazy)
...
Use hlist_for_each_entry_rcu() to safely iterate over the exception list.
Fixes:
|
||
Jorijn van der Graaf
|
3cbfd627ee |
net: ipa: fix stalled modem TX queue after runtime resume
ipa_start_xmit() unconditionally stops the TX queue before calling
pm_runtime_get(), relying on the wake scheduled by runtime resume
(ipa_modem_wake_queue_work()) to restart it once power is ACTIVE.
But that work is queued from within the runtime resume callback,
before the device's power state reaches RPM_ACTIVE, so it can run
while the device is still RPM_RESUMING. The wake is then consumed
too early: the transmit it restarts stops the queue again,
pm_runtime_get() returns -EINPROGRESS without arranging any future
wake (deferred_resume exists only for RPM_SUSPENDING), and after the
resume completes nothing is left to wake the queue. Transmit stalls
permanently: packets pile up in the qdisc behind the stopped queue,
the device runtime-suspends, and since the netdev registers no
ndo_tx_timeout the watchdog never fires. Observed on SM7635
(Fairphone 6) as the cellular data path going permanently deaf
within hours, RX included, since nothing resumes the suspended
endpoints.
Close the window by making the wake work wait for the resume to
complete (pm_runtime_get_sync()) before waking the queue. Every
queue stop is then guaranteed a later wake that happens while power
is ACTIVE; a transmit racing a new suspend/resume cycle re-schedules
the work. If the device could not be resumed, wake the queue anyway
so pending packets are dropped by the transmit path rather than
stranded.
The STARTED power flag used to narrow this window: a wake running
before the transmit path's stop suppressed that stop, but only once,
as the flag was cleared by the first stop it absorbed. Removing the
flag made a single transmit during an in-flight resume sufficient to
strand the queue, which is the form observed.
With an accelerated reproducer (autosuspend delay shortened to 5 ms,
~20 packets/s of TX), an unpatched kernel stalled three times in
230 s / 4380 packets; with this patch the same test ran 3601 s /
70298 packets without a stall.
Fixes:
|
||
|
Ruoyu Wang
|
b74a072d8f |
net: bridge: Reject descending VLAN tunnel ranges
A pair of descending VLAN and tunnel IDs can pass the tunnel range span
check. The VLAN subtraction produces a negative int, which is converted
to unsigned when compared with the u32 tunnel ID subtraction. It can
therefore equal the wrapped tunnel ID delta.
The range loop then performs no iterations. Since the batched
notification handling added a post-loop error check, this leaves err
uninitialized and makes the request's return value unpredictable.
Reject descending VLAN ranges before comparing the spans. Valid
ascending and single-entry ranges remain unchanged, while malformed
descending ranges consistently return -EINVAL.
This issue was found by a static analysis checker and confirmed by
manual source review.
Fixes:
|
||
|
Linus Torvalds
|
216b3f432a |
Kernel Concurrency Sanitizer (KCSAN) updates for v7.3
- Avoid unintended access checking in NMIs This change has had 3 weeks of linux-next exposure. -----BEGIN PGP SIGNATURE----- iIcEABYKAC8WIQR7t4b/75lzOR3l5rcxsLN3bbyLnwUCaoME4REcZWx2ZXJAZ29v Z2xlLmNvbQAKCRAxsLN3bbyLn2JYAQCHcMcgr9iqJGoqom0CdsnobYB5sa1l4mqm Tlok6vVVuQD6Aq8Vl7eOLrbq4XJkwSUMy4suyzv4ueNsOmcL7Qo2zAw= =nXoE -----END PGP SIGNATURE----- Merge tag 'kcsan-20260817-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/melver/linux Pull Kernel Concurrency Sanitizer (KCSAN) update from Marco Elver: - Avoid unintended access checking in NMIs * tag 'kcsan-20260817-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/melver/linux: kcsan: avoid unintended access checking in NMIs |
||
|
Cen Zhang (Microsoft)
|
e37b2abca8 |
xsk: fix NULL pointer dereference in __xsk_rcv()
In the __xsk_rcv() multi-buffer path, xsk_buff_alloc() is called in a
loop without checking its return value. xsk_buff_can_alloc() only
counts fill queue entries without validating their addresses, so it
can succeed while xsk_buff_alloc() rejects all remaining entries and
returns NULL.
Oops: general protection fault, probably for non-canonical address
0xdffffc0000000000
KASAN: null-ptr-deref in range
[0x0000000000000000-0x0000000000000007]
RIP: 0010:__xsk_rcv+0x426/0xc20 (net/xdp/xsk.c:350)
Call Trace:
xsk_generic_rcv+0x26d/0x5f0
xdp_do_generic_redirect+0x3c5/0xcf0
do_xdp_generic+0x92f/0xe70
__netif_receive_skb_core.constprop.0+0xf7e/0x2b30
Fix this with a two-stage transaction. First allocate and stage all
buffers required for the packet, recycling all staged buffers with
xsk_buff_free() if any allocation fails. Only after this stage
succeeds, copy the data, reserve the RX descriptors, and release the
buffers in an error-free loop.
Fixes:
|
||
|
Linus Torvalds
|
11260c335e |
sched_ext: Changes for v7.3
This depends on the arena argument support in the BPF tree and should be
pulled after the scheduler core and BPF pulls. The patches based on bpf-next
were kept on a separate branch which was merged into for-7.3 just now. The
same merged result was in linux-next for several days.
Most of this cycle completes the enqueue-path support for hierarchical
sub-scheduling, which makes sub-scheduler support feature complete: a root
BPF scheduler can now hand a cgroup subtree over to a nested sub-scheduler
together with revocable CPU grants, and the sub-scheduler owns all
scheduling decisions for its tasks on those CPUs.
Development volume was high and a number of changes plugging holes in the
new support landed late in the cycle. Also included are core scheduling
fixes that were completed too late for the v7.2 release and are routed
through this pull request.
- Sub-scheduler CPU delegation:
- Parent schedulers now grant and revoke per-CPU capabilities (enqueueing,
preemption, CPU frequency control) on their children, enforced on every
path a scheduler can reach a CPU through. Previously only dispatching
could be delegated; this lets sub-schedulers fully schedule their CPUs.
- Rescue execution: a task whose scheduler doesn't have access to the CPUs
the task needs to run on starved until the watchdog ejected the whole
scheduler. The kernel now runs such tasks directly on a small bandwidth
budget, turning a scheduler-killing failure into bounded degradation.
- Cgroup integration: tasks migrating across a sub-scheduler boundary
weren't re-homed to the new owner, causing wrong-scheduler scheduling
and a use-after-free. Sub-schedulers now take over their cgroup subtree
and receive its cgroup callbacks.
- Arena objects now cross the kernel/BPF boundary as typed pointer
arguments, translated transparently by the BPF tree's new arena argument
support, replacing untyped arguments with manual translation.
- scx_qmap now demonstrates full hierarchical sub-scheduling.
- Robustness improvements: the abort path is now NMI-safe, fixing deadlocks
when errors are raised from NMI context and making hardlockup recovery
direct. Reenqueue loops that could monopolize a CPU ahead of the watchdog
now eject the offending scheduler, and stalls are blamed on the scheduler
actually responsible.
- Hardening: BPF-writable arena memory is validated before kernel use, and
task slice and vtime writes got explicit synchronization rules, closing
corruption vectors open to buggy or malicious schedulers.
- Core scheduling: sched_ext dispatching can drop the rq lock inside the
core-wide pick, which let interleaving selections corrupt each other's
state and hard-hang the machine. The selection now restarts when the lock
was released. The task ordering callback was also invoked with its
arguments swapped, and the default ordering is updated to work across
sub-scheduler boundaries. The fixes are marked for stable.
- Other fixes headed for stable: a task init leak on fork failure during
enable, tooling compat macros that silently failed to detect newer
kernels, and a crash on reenqueueing against a destroyed dispatch queue.
- Tooling: scx_pair moves off deprecated callbacks, and the deprecated
scx_bpf_cpu_rq() kfunc is removed.
-----BEGIN PGP SIGNATURE-----
iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCaoOA7w4cdGpAa2VybmVs
Lm9yZwAKCRCxYfJx3gVYGQWqAP9Sy8GwS7dRdGze/eHwYlDBt5U9ayd2ntR0Z+H1
1Hd23AEA5kYPaEN68OgCXh/XqmFljkvEgEisXtMtw8XsZA+pHQA=
=OwIm
-----END PGP SIGNATURE-----
Merge tag 'sched_ext-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext
Pull sched_ext updates from Tejun Heo:
"Most of this cycle completes the enqueue-path support for hierarchical
sub-scheduling, which makes sub-scheduler support feature complete: a
root BPF scheduler can now hand a cgroup subtree over to a nested
sub-scheduler together with revocable CPU grants, and the
sub-scheduler owns all scheduling decisions for its tasks on those
CPUs.
Development volume was high and a number of changes plugging holes in
the new support landed late in the cycle. Also included are core
scheduling fixes that were completed too late for the v7.2 release and
are routed through this pull request.
Sub-scheduler CPU delegation:
- Parent schedulers now grant and revoke per-CPU capabilities
(enqueueing, preemption, CPU frequency control) on their children,
enforced on every path a scheduler can reach a CPU through.
Previously only dispatching could be delegated; this lets
sub-schedulers fully schedule their CPUs.
- Rescue execution: a task whose scheduler doesn't have access to the
CPUs the task needs to run on starved until the watchdog ejected
the whole scheduler. The kernel now runs such tasks directly on a
small bandwidth budget, turning a scheduler-killing failure into
bounded degradation.
- Cgroup integration: tasks migrating across a sub-scheduler boundary
weren't re-homed to the new owner, causing wrong-scheduler
scheduling and a use-after-free. Sub-schedulers now take over their
cgroup subtree and receive its cgroup callbacks.
- Arena objects now cross the kernel/BPF boundary as typed pointer
arguments, translated transparently by the BPF tree's new arena
argument support, replacing untyped arguments with manual
translation.
- scx_qmap now demonstrates full hierarchical sub-scheduling.
Other fixes and updates:
- Robustness improvements: the abort path is now NMI-safe, fixing
deadlocks when errors are raised from NMI context and making
hardlockup recovery direct. Reenqueue loops that could monopolize a
CPU ahead of the watchdog now eject the offending scheduler, and
stalls are blamed on the scheduler actually responsible.
- Hardening: BPF-writable arena memory is validated before kernel
use, and task slice and vtime writes got explicit synchronization
rules, closing corruption vectors open to buggy or malicious
schedulers.
- Core scheduling: sched_ext dispatching can drop the rq lock inside
the core-wide pick, which let interleaving selections corrupt each
other's state and hard-hang the machine. The selection now restarts
when the lock was released. The task ordering callback was also
invoked with its arguments swapped, and the default ordering is
updated to work across sub-scheduler boundaries. The fixes are
marked for stable.
- Other fixes headed for stable: a task init leak on fork failure
during enable, tooling compat macros that silently failed to detect
newer kernels, and a crash on reenqueueing against a destroyed
dispatch queue.
- Tooling: scx_pair moves off deprecated callbacks, and the
deprecated scx_bpf_cpu_rq() kfunc is removed"
* tag 'sched_ext-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: (144 commits)
sched_ext: Drop the dead SCX_DEQ_CORE_SCHED_EXEC test in dequeue_task_scx()
sched_ext: Make core-sched task ordering hierarchy-aware
sched_ext: Use runnable_at for the default core-sched task ordering
sched_ext: Fix inverted ops.core_sched_before() invocation
sched_ext: Move the config-off sub-cap kfunc stubs into sub.c
sched_ext: Rename balance-era identifiers to dispatch terms
sched_ext: Drop the stale keep_prev fixup in dispatch_pick()
sched_ext: Keep kick_sync waiting on the rq's own CPU
sched_ext: Make SCHED_CLASS_EXT select GENERIC_ALLOCATOR
sched_ext/scx_flatcg: Fix cvtime true-up on slice expiry
sched_ext: Don't BUG_ON a destroyed DSQ in process_deferred_reenq_users
sched_ext: Fix scx_bpf_dsq_move_to_local___v2 compat detection
sched_ext: Make scx_bpf_events() read the calling scheduler's counters
sched_ext: Drop unlocked scx_rq_clock_invalidate() from scx_root_disable()
selftests/sched_ext: Fix flaky ddsp failure tests on busy systems
selftests/sched_ext: Make numa idle validation race-free
sched_ext: Fix scx_bpf_dsq_reenq___compat kfunc extern prototype
sched_ext/scx_flatcg: expire cached hweights on weight changes
sched_ext: Fix exit_task leak on fork failure during enable
sched_ext: fix stale references in doc comments
...
|
||
Hongfu Li
|
a8c6daab4b |
selftests/cgroup: Fix cg_run_in_subcgroups ignoring arg parameter
cg_run_in_subcgroups() discards its arg and always passes NULL to cg_run(),
turning the (void *)100 from test_kmem_dead_cgroups() into NULL so no
allocation occurs.
This makes test_kmem_dead_cgroups() falsely pass without exercising the
"dying cgroup with charged slab" scenario it intends to test.
Pass the arg through to cg_run() to fix this.
Fixes:
|
||
Liang Luo
|
72c5ae18eb |
Docs/admin-guide/cgroup-v2: document BPF scheduler callbacks for cpu.max and cpu.idle
The cpu.weight and cpu.weight.nice entries already state that the files also affect a BPF scheduler through the cgroup_set_weight callback. However, cpu.max, cpu.max.burst and cpu.idle only mention the fair-class scheduler, even though sched_ext implements the cgroup_set_bandwidth (notified with the period/quota from cpu.max and the burst from cpu.max.burst) and cgroup_set_idle callbacks from these interfaces. Mirror the cpu.weight wording for the three entries and generalize the category preamble to refer to the corresponding cgroup_set_* callback so it keeps covering the entries below. Suggested-by: Tejun Heo <tj@kernel.org> Signed-off-by: Liang Luo <luoliang@kylinos.cn> Signed-off-by: Tejun Heo <tj@kernel.org> |
||
|
Linus Torvalds
|
40d8c81577 |
cgroup: Changes for v7.3
- cpuset:
- Attach path bug fixes: migrations spanning multiple source or
destination cpusets were mishandled, most visibly leaving thread
affinities stale when the controller is disabled in a threaded subtree.
Configuration writes could also race an in-flight attach and apply stale
state, and the deadline task count could get corrupted by concurrent
updates, skewing SCHED_DEADLINE admission decisions.
- Memory binding bug fixes: which node masks get applied differed between
the binding update paths, and tasks cloned with CLONE_INTO_CGROUP
skipped rebinding entirely. Rebinding also now runs once per process
instead of repeating for every thread sharing the mm.
- Overhead removals with no behavior change: CPU hotplug iterated tasks of
cpusets that just inherit the parent's effective masks, and the
slab-spreading task flag was still being maintained although the SLAB
allocator that consumed it is long gone.
- Data-race annotations for benign races so that KCSAN reports stay
meaningful, selftest coverage for the fixes above along with flakiness and
portability fixes, and documentation corrections.
-----BEGIN PGP SIGNATURE-----
iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCaoNzqw4cdGpAa2VybmVs
Lm9yZwAKCRCxYfJx3gVYGRxVAQDK5MAK0wUhxkG2bO7eSp0F74J/uAMXTSQdcXR+
LR3wnQD/aYTHVPXecNc2XqU10uaVqPctHTuCt2qb4J7w8brHPQ8=
=9TyI
-----END PGP SIGNATURE-----
Merge tag 'cgroup-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
Pull cgroup updates from Tejun Heo:
- Attach path bug fixes: migrations spanning multiple source or
destination cpusets were mishandled, most visibly leaving thread
affinities stale when the controller is disabled in a threaded
subtree. Configuration writes could also race an in-flight attach and
apply stale state, and the deadline task count could get corrupted by
concurrent updates, skewing SCHED_DEADLINE admission decisions.
- Memory binding bug fixes: which node masks get applied differed
between the binding update paths, and tasks cloned with
CLONE_INTO_CGROUP skipped rebinding entirely. Rebinding also now runs
once per process instead of repeating for every thread sharing the
mm.
- Overhead removals with no behavior change: CPU hotplug iterated tasks
of cpusets that just inherit the parent's effective masks, and the
slab-spreading task flag was still being maintained although the SLAB
allocator that consumed it is long gone.
- Data-race annotations for benign races so that KCSAN reports stay
meaningful, selftest coverage for the fixes above along with
flakiness and portability fixes, and documentation corrections.
* tag 'cgroup-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: (34 commits)
selftests/cgroup: Remove redundant chown in test_cgcore_lesser_ns_open
selftests/cgroup: Preserve CPU hotplug write errors
cgroup/cpuset: Add test for partition root invalidation returning wrong CPUs
cgroup/cpuset: Remove obsolete PFA_SPREAD_SLAB task flag
docs: cgroup-v2: fix stale "io" controller introduction
selftests/cgroup: Avoid awk -e in cpuset tests
cgroup/cpuset: Use WRITE_ONCE() for shared prs_err updates
selftests/cgroup: add user_usec sanity check in test_cpucg_nice
cgroup: drop unneeded semicolon
docs: cgroup-v2: mark memory.pressure and io.pressure as read-write
selftests/cgroup: Fix minor defects in test_cpuset
Docs/admin-guide/cgroup-v2: fix delay_nsec unit in io.latency doc
selftests/cgroup: Remove redundant cg_enter_current() call in test_core
selftests/cgroup: Add test for cpuset affinity on controller disable
cgroup/cpuset: Handle the special case of non-moving tasks in cpuset_can_attach()
cgroup/cpuset: Support multiple destination cpusets for cpuset_*attach()
selftests/cgroup: fix missing TAP output in test_hugetlb_memcg
cgroup/cpuset: Support multiple source cpusets for cpuset_*attach()
cgroup/cpuset: Move mpol_rebind_mm/cpuset_migrate_mm() calls inside cpuset_attach_task()
cgroup/cpuset: Make attach_ctx.old_cs track task group leader
...
|
||
|
Linus Torvalds
|
39e34e88ec |
workqueue: Changes for v7.3
- Worker wakeups moved out of pool->lock on the hot paths, shortening lock hold times. The wakeup can be expensive on arm64 due to the idle wakeup IPI, and the change improves the workqueue microbenchmark there by up to 10%. - Stall diagnostics now report pools stuck with no running worker, with a backtrace of what the CPU is executing and the likely culprit worker, instead of dumping every in-flight worker. - Preparation for turning per-cpu workqueues into an affinity scope of unbound workqueues instead of a separate backend. - Race annotations for KCSAN and sparse warnings, and doc and monitoring script fixes. -----BEGIN PGP SIGNATURE----- iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCaoNxSg4cdGpAa2VybmVs Lm9yZwAKCRCxYfJx3gVYGWDfAP4tp2XFrNOOai4aCcWivKV99Arb0YFdjozM4vjX rx3HCwEAiwfLTduv+ZeLHYTIm3V3Nxrf246fitSEYUknb+Cx8QE= =XrZO -----END PGP SIGNATURE----- Merge tag 'wq-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue updates from Tejun Heo: - Worker wakeups moved out of pool->lock on the hot paths, shortening lock hold times. The wakeup can be expensive on arm64 due to the idle wakeup IPI, and the change improves the workqueue microbenchmark there by up to 10% - Stall diagnostics now report pools stuck with no running worker, with a backtrace of what the CPU is executing and the likely culprit worker, instead of dumping every in-flight worker - Preparation for turning per-cpu workqueues into an affinity scope of unbound workqueues instead of a separate backend - Race annotations for KCSAN and sparse warnings, and doc and monitoring script fixes * tag 'wq-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: (23 commits) workqueue: annotate racy p->wake_cpu accesses in kick_pool_pick() workqueue: BUG_ON() instead of returning NULL in wq_node_nr_active() workqueue: use RCU accessors when populating wq->cpu_pwq workqueue: use rcu_dereference_sched() in workqueue_congested() workqueue: skip the node_nr_active update for non-unbound workqueues workqueue: rename alloc_unbound_pwq() to alloc_pwq() workqueue: allocate attrs for all workqueues workqueue: rename wq->unbound_attrs to wq->attrs workqueue: test WQ_UNBOUND explicitly in the hotplug loops workqueue: account nr_active by the backing pool workqueue: release pwq pools by pool type workqueue: factor out alloc_and_link_percpu_pwqs() workqueue: factor out get_percpu_pool() docs: workqueue: Fix bracket workqueue: annotate racy sum_exec_runtime reads for CPU-intensive detection workqueue: annotate racy PWQ_STAT_CPU_TIME update in wq_worker_tick() workqueue: dump the last woken worker for stalled pools workqueue: trigger a single-CPU backtrace for stalled pools workqueue: only show running workers in stall diagnostics workqueue: defer the worker wakeup outside pool->lock in process_one_work() ... |