mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-11-10 20:48:12 +00:00
1,463,816 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Tao Cui
|
4e050c5b92 |
block/blk-iocost: collect per-cpu latency stats over possible CPUs
ioc_lat_stat() walks ioc->pcpu_stat with for_each_online_cpu() to
compute missed-ppm and rq_wait deltas. An offlined CPU is skipped, so
its delta is dropped from the period and its last_* watermark is not
advanced; on re-online the next collection sees a delta spanning the
whole offline interval, corrupting the latency/vrate picture.
Fixes:
|
||
|
Tao Cui
|
e0698304bd |
block/blk-iolatency: account per-cpu latency stats over possible CPUs
iolatency_check_latencies() and iolatency_ssd_stat() iterate a blkg's per-cpu latency stats with for_each_online_cpu(). When a CPU that has accumulated io.latency samples goes offline, its bucket is skipped: the check loop (which also resets) neither sums nor clears it, and the show path under-reports. On re-online the stranded samples are flushed into a later check window, which can trigger a spurious throttle/scale adjustment. Fixes: |
||
|
Tao Cui
|
9d617828cf |
block/blk-stat: drain per-cpu callback stats over possible CPUs
blk_stat_timer_fn() sums and resets a callback's per-cpu buckets using
for_each_online_cpu(). A CPU that goes offline with pending samples is
skipped, so its samples are neither accumulated into the window nor
cleared; they sit in the bucket until the CPU comes back online, at
which point the stale values are flushed into whatever window is then
running.
This silently corrupts the latency picture that consumers (notably
writeback throttling via wbt, and blk-mq latency tracking) base
decisions on around CPU hotplug: under-counting while the CPU is
offline, then a burst of stale data on re-online.
Fixes:
|
||
Zheng Qixing
|
d3f775718a |
blk-cgroup: factor policy pd teardown loop into helper
Move the teardown sequence which offlines and frees per-policy blkg_policy_data (pd) into a helper for readability. No functional change intended. Signed-off-by: Zheng Qixing <zhengqixing@huawei.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Tang Yizhou <yizhou.tang@shopee.com> Signed-off-by: Yu Kuai <yukuai@fygo.io> Reviewed-by: Nilay Shroff <nilay@linux.ibm.com> Link: https://patch.msgid.link/20260802112525.3933753-5-yukuai@kernel.org Signed-off-by: Jens Axboe <axboe@kernel.dk> |
||
|
Zheng Qixing
|
5e92203899 |
blk-cgroup: skip dying blkg in blkcg_activate_policy()
When switching IO schedulers on a block device, blkcg_activate_policy()
can race with concurrent blkcg deletion, leading to a use-after-free in
rcu_accelerate_cbs.
T1: T2:
blkg_destroy
kill(&blkg->refcnt) // blkg->refcnt=1->0
blkg_release // call_rcu(__blkg_release)
...
blkg_free_workfn
->pd_free_fn(pd)
elv_iosched_store
elevator_switch
...
iterate blkg list
blkg_get(blkg) // blkg->refcnt=0->1
list_del_init(&blkg->q_node)
blkg_put(pinned_blkg) // blkg->refcnt=1->0
blkg_release // call_rcu again
rcu_accelerate_cbs // uaf
Fix this by checking hlist_unhashed(&blkg->blkcg_node) before getting
a reference to the blkg. This is the same check used in blkg_destroy()
to detect if a blkg has already been destroyed. If the blkg is already
unhashed, skip processing it since it's being destroyed.
Fixes:
|
||
|
Zheng Qixing
|
5313d4d417 |
blk-cgroup: fix race between policy activation and blkg destruction
When switching an IO scheduler on a block device, blkcg_activate_policy()
allocates blkg_policy_data (pd) for all blkgs attached to the queue.
However, blkcg_activate_policy() may race with concurrent blkcg deletion,
leading to use-after-free and memory leak issues.
The use-after-free occurs in the following race:
T1 (blkcg_activate_policy):
- Successfully allocates pd for blkg1 (loop0->queue, blkcgA)
- Fails to allocate pd for blkg2 (loop0->queue, blkcgB)
- Enters the enomem rollback path to release blkg1 resources
T2 (blkcg deletion):
- blkcgA is deleted concurrently
- blkg1 is freed via blkg_free_workfn()
- blkg1->pd is freed
T1 (continued):
- Rollback path accesses blkg1->pd->online after pd is freed
- Triggers use-after-free
In addition, blkg_free_workfn() frees pd before removing the blkg from
q->blkg_list. This allows blkcg_activate_policy() to allocate a new pd
for a blkg that is being destroyed, leaving the newly allocated pd
unreachable when the blkg is finally freed.
Fix these races by extending blkcg_mutex coverage to serialize
blkcg_activate_policy() rollback and blkg destruction, ensuring pd
lifecycle is synchronized with blkg list visibility.
Fixes:
|
||
Yu Kuai
|
9a91679894 |
blk-cgroup: protect q->blkg_list iteration in blkg_destroy_all() with blkcg_mutex
blkg_destroy_all() iterates q->blkg_list without holding blkcg_mutex, which can race with blkg_free_workfn() that removes blkgs from the list while holding blkcg_mutex. Add blkcg_mutex protection around the q->blkg_list iteration to prevent potential list corruption or use-after-free issues. Reviewed-by: Tang Yizhou <yizhou.tang@shopee.com> Signed-off-by: Yu Kuai <yukuai@fygo.io> Reviewed-by: Tao Cui <cuitao@kylinos.cn> Reviewed-by: Nilay Shroff <nilay@linux.ibm.com> Link: https://patch.msgid.link/20260802112525.3933753-2-yukuai@kernel.org Signed-off-by: Jens Axboe <axboe@kernel.dk> |
||
|
Tao Cui
|
3be7ad35f1 |
block/blk-cgroup-rwstat: use data_race() for online test
blkg_rwstat_recursive_sum() reads pos_blkg->online without the queue
lock that its doc comment requires, since blkcg_print_blkgs() stopped
holding it in
|
||
Tal Zussman
|
8b5ffb43ae |
block: enable RWF_DONTCACHE for block devices
Block device buffered reads and writes already pass through filemap_read() and iomap_file_buffered_write() respectively, both of which handle IOCB_DONTCACHE. Enable RWF_DONTCACHE for block device files by setting FOP_DONTCACHE in def_blk_fops. For CONFIG_BUFFER_HEAD=y, writeback goes through buffer_head's __bh_submit() which sets BIO_COMPLETE_IN_TASK on dropbehind folios. For CONFIG_BUFFER_HEAD=n, writeback goes through iomap which handles it via BIO_COMPLETE_IN_TASK on the ioend bio. This support is useful for databases that operate on raw block devices, among other userspace applications. Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Tal Zussman <tz2294@columbia.edu> Reviewed-by: Jan Kara <jack@suse.cz> Link: https://patch.msgid.link/20260730-blk-dontcache-v7-5-3e8e6850068d@columbia.edu Signed-off-by: Jens Axboe <axboe@kernel.dk> |
||
|
Tal Zussman
|
a2c924c240 |
buffer: set BIO_COMPLETE_IN_TASK for dropbehind writeback
Set BIO_COMPLETE_IN_TASK in __bh_submit() for write bios when the folio has dropbehind set, so that buffer_head writeback completions get deferred to task context where folio_end_dropbehind() can safely invalidate folios. Read completions are not deferred since dropbehind invalidation for reads is handled synchronously by the reader. Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Tal Zussman <tz2294@columbia.edu> Reviewed-by: Jan Kara <jack@suse.cz> Link: https://patch.msgid.link/20260730-blk-dontcache-v7-4-3e8e6850068d@columbia.edu Signed-off-by: Jens Axboe <axboe@kernel.dk> |
||
|
Tal Zussman
|
efbde6f9f4 |
iomap: use BIO_COMPLETE_IN_TASK for dropbehind writeback
Set BIO_COMPLETE_IN_TASK on iomap writeback bios when a dropbehind folio is added. This ensures that bi_end_io runs in task context, where folio_end_dropbehind() can safely invalidate folios. With the bio layer now handling task-context deferral generically, IOMAP_IOEND_DONTCACHE is no longer needed, as XFS no longer needs to route DONTCACHE ioends through its completion workqueue. Remove the flag and its NOMERGE entry. Without the NOMERGE, regular I/Os that get merged with a dropbehind folio will also have their completion deferred to task context. Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Tal Zussman <tz2294@columbia.edu> Link: https://patch.msgid.link/20260730-blk-dontcache-v7-3-3e8e6850068d@columbia.edu Signed-off-by: Jens Axboe <axboe@kernel.dk> |
||
|
Tal Zussman
|
77e73fa61b |
block: add task-context bio completion infrastructure
Some bio completion handlers need to run from preemptible task context,
but bio_endio() may be called from IRQ context (e.g., buffer_head
writeback). Callers need a way to ensure their callback eventually runs
from a sleepable context. Add infrastructure for that, in two forms:
1. BIO_COMPLETE_IN_TASK, a bio flag the submitter sets when it knows
in advance that its callback needs task context (e.g., dropbehind
writeback). bio_endio() sees the flag and offloads completion to a
worker automatically.
2. bio_complete_in_task(), a helper that completion callbacks can
invoke from within bi_end_io() when the deferral decision is
dynamic (e.g., fserror reporting).
Both share a per-CPU list drained by a work item on a WQ_PERCPU
workqueue. Producers push the bio onto the local CPU's list and schedule
the work item, which then dispatches each bio's bi_end_io() from task
context.
Both methods are gated on bio_in_atomic(), which returns true in any
context where a sleeping bi_end_io() is unsafe, including
non-preemptible task context.
Two CPU hotplug callbacks are used to drain remaining bios from the
departing CPU's batch, while maintaining the per-CPU behavior. The
CPUHP_AP_ONLINE_DYN callback disables the per-CPU work item while the
CPU is still online, preventing it from running on an unbound worker
later. CPUHP_BP_PREPARE_DYN then drains any bios added between disabling
the work item and CPU offline.
Link: https://lore.kernel.org/all/20260409160243.1008358-1-hch@lst.de/
Suggested-by: Matthew Wilcox <willy@infradead.org>
Suggested-by: Christoph Hellwig <hch@infradead.org>
Signed-off-by: Tal Zussman <tz2294@columbia.edu>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260730-blk-dontcache-v7-2-3e8e6850068d@columbia.edu
Signed-off-by: Jens Axboe <axboe@kernel.dk>
|
||
|
Tal Zussman
|
8ed0831b52 |
block: introduce bio_in_atomic()
Move the atomic context detection logic from erofs's z_erofs_in_atomic()
into the block layer as bio_in_atomic(). This helper returns true when
the current context is unsafe for sleeping bio completion handlers (e.g.,
hard/soft IRQ, preempt-disabled).
The logic was originally added to erofs in commit
|
||
Keith Busch
|
14b007e178 |
block: validate user space vectors during extraction
The bio-based drivers don't necessarily check the alignment split, and stacking block drivers don't always handle a misalignment detected after submitting the bio. Validate user vectors against the device's dma_alignment as the bio is built from the iov_iter, rejecting misaligned early with -EINVAL. Cc: stable@vger.kernel.org Fixes: |
||
|
Keith Busch
|
c5059c1af2 |
zloop: set dma_alignment from the backing files for direct I/O
Direct I/O request's use pages handed to the backing files unchanged, so the backing's DMA alignment requirement applies. Track dio_mem_align and advertise it as the device's dma_alignment so we communicate proper limits and misaligned I/O is rejected here instead of reaching the backend. Reviewed-by: Hannes Reinecke <hare@kernel.org> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Keith Busch <kbusch@kernel.org> Link: https://patch.msgid.link/20260720201057.1862857-5-kbusch@meta.com Signed-off-by: Jens Axboe <axboe@kernel.dk> |
||
|
Keith Busch
|
6c8dec275c |
loop: set dma_alignment from the backing file for direct I/O
Direct I/O user pages are forwarded to the backing file unchanged, so the backing's DMA alignment requirement applies to them. Track the backing's dio_mem_align and advertise it as the loop device's dma_alignment so we advertise proper limits and misaligned I/O is rejected here instead of being dispatched to the backend. Reviewed-by: Hannes Reinecke <hare@kernel.org> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Keith Busch <kbusch@kernel.org> Link: https://patch.msgid.link/20260720201057.1862857-4-kbusch@meta.com Signed-off-by: Jens Axboe <axboe@kernel.dk> |
||
|
Keith Busch
|
702a2a9f3d |
block: fix dio leak on metadata mapping error
A failed integrity mapping holds a dio reference, so we need to go
through the full bio ending in case there were previously submitted
bio's in the sequence.
Fixes:
|
||
|
Keith Busch
|
75ae18ca94 |
block: use blkdev_iov_iter_get_pages status for errors
blkdev_iov_iter_get_pages() can return various error values, including EIO, EFAULT, and ENOMEM. Set the actual reported status so user space can know why an operation failed. Reviewed-by: Hannes Reinecke <hare@kernel.org> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Keith Busch <kbusch@kernel.org> Link: https://patch.msgid.link/20260720201057.1862857-2-kbusch@meta.com Signed-off-by: Jens Axboe <axboe@kernel.dk> |
||
Linus Torvalds
|
f5098b6bae | Linux 7.2-rc5 v7.2-rc5 | ||
|
Linus Torvalds
|
4235cb24ec |
vfs-7.2-rc5.fixes
Please consider pulling these changes from the signed vfs-7.2-rc5.fixes tag.
Thanks!
Christian
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCamYljAAKCRCRxhvAZXjc
ogWyAPwORZDIIsRiAQbnPs+OkYszuWCY29OeUrTf+m3z+tBTLwD+NUFtpH5XIcYJ
3jHtGXPoHjEaOVsNyIdxwnOxWfo+6ws=
=VNq0
-----END PGP SIGNATURE-----
Merge tag 'vfs-7.2-rc5.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull vfs fixes from Christian Brauner:
- vfs: Preserve the ACL_DONT_CACHE state in forget_cached_acl().
ACL_DONT_CACHE is meant to be a permanent opt-out from ACL caching
which FUSE relies on for servers that don't negotiate FUSE_POSIX_ACL.
The helper replaced it with ACL_NOT_CACHED, silently re-enabling the
cache, and as fuse doesn't invalidate the cache for such servers a
properly timed get_acl() returned stale ACLs. Comes with a fuse
selftest reproducing this.
- pidfs:
- Preserve PIDFD_THREAD when a thread pidfd is reopened via
open_by_handle_at(). PIDFD_THREAD shares the O_EXCL bit which
do_dentry_open() strips after the flags have been validated, so
the reopened pidfd silently became a process pidfd. Comes with a
selftest.
- Add a pidfs_dentry_open() helper so the regular pidfd allocation
path and the file handle path share the code that forces O_RDWR
and reapplies the pidfd flags that do_dentry_open() strips.
- Handle FS_IOC32_GETVERSION in the compat ioctl path.
- Make pidfs_ino_lock static.
- iomap:
- Fix the block range calculation in ifs_clear_range_dirty() so a
partial clear doesn't drop the dirty state of blocks the range
only partially covers.
- Support invalidating partial folios so a partial truncate or hole
punch with blocksize < foliosize doesn't leave stale dirty bits
behind.
- Only set did_zero when iomap_zero_iter() actually zeroed
something.
- Guard ifs_set_range_dirty() and ifs_set_range_uptodate() against
zero-length ranges where the unsigned last-block calculation
underflows and bitmap_set() writes far beyond the ifs->state
allocation.
- Don't merge ioends with different io_private values as the merge
could leak or corrupt the private data of the individual ioends.
- exec:
- Raise bprm->have_execfd only once the binfmt_misc interpreter has
actually been opened. The flag was set as soon as a matching 'O'
or 'C' entry was found. If the interpreter open failed with
ENOEXEC the exec fell through to the next binary format with
have_execfd raised but no executable staged and begin_new_exec()
NULL derefed past the point of no return.
- Fix an unsigned loop counter wrap in transfer_args_to_stack() on
nommu. An overlong argument or environment string pushes bprm->p
below PAGE_SIZE, the stop index becomes zero, and the loop never
terminates, wrapping its counter and copying garbage from in
front of the page array into the new process stack.
- Make binfmt_elf_fdpic only honour the first PT_INTERP like
binfmt_elf does. Each additional PT_INTERP overwrote the previous
interpreter, leaking the name allocation and the interpreter file
reference together with the write denial open_exec() took,
leaving the file unwritable for as long as the system runs.
- overlayfs:
- Compare the full escaped xattr prefix including the trailing dot.
An xattr like "trusted.overlay.overlayfoo" was misclassified as
an escaped overlay xattr.
- Check read access to the copy_file_range() source with the
source's mounter credentials.
- super: Thawing a filesystem whose block device was frozen with
bdev_freeze() deadlocked. Dropping the last block layer freeze
reference from under s_umount ends up in fs_bdev_thaw() which
reacquires s_umount on the same task. Pin the superblock with an
active reference instead and call bdev_thaw() without holding
s_umount.
- procfs: Return EACCES instead of success when the ptrace access check
for namespace links fails.
- afs: Use afs_dir_get_block() rather than afs_dir_find_block() for
block 0 in afs_edit_dir_remove(), matching afs_edit_dir_add().
- Push the memcg gating of ->nr_cached_objects() down into the btrfs
and shmem callbacks instead of skipping every callback during
non-root memcg reclaim. The blanket check short-circuited XFS whose
inode reclaim hook is intentionally driven from per-memcg contexts to
free memcg-charged slab.
- eventpoll: Pin files while checking reverse paths.
Since struct file became SLAB_TYPESAFE_BY_RCU a concurrent close
could free and recycle the file under the check which then took and
dropped the f_lock of whatever live file now occupies that slot.
* tag 'vfs-7.2-rc5.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (24 commits)
super: fix emergency thaw deadlock on frozen block devices
pidfs: make pidfs_ino_lock static
eventpoll: pin files while checking reverse paths
fs: push nr_cached_objects memcg gating into individual filesystems
afs: Fix afs_edit_dir_remove() to get, not find, block 0
iomap: prevent ioend merge when io_private differs
iomap: add comments for ifs_clear/set_range_dirty()
iomap: fix out-of-bounds bitmap_set() with zero-length range
iomap: fix incorrect did_zero setting in iomap_zero_iter()
iomap: support invalidating partial folios
iomap: correct the range of a partial dirty clear
fs/super: fix emergency thaw double-unlock of s_umount
pidfs: handle FS_IOC32_GETVERSION in compat ioctl
ovl: check access to copy_file_range source with src mounter creds
proc: Fix broken error paths for namespace links
pidfs: add pidfs_dentry_open() helper
selftests/pidfd: check PIDFD_THREAD survives open_by_handle_at()
pidfs: preserve thread pidfds reopened by file handle
ovl: fix trusted xattr escape prefix matching
selftests/fuse: add ACL_DONT_CACHE regression test
...
|
||
|
Linus Torvalds
|
72841e8e83 |
spi: Fixes for v7.2
Just a couple of small bits for the SpacemiT driver - one small fix, and a new compatible in the DT binding. -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmpmL3sACgkQJNaLcl1U h9CDnwgAggPOeUHMrQWYES7f74oTVl/kt0B1TBV6g91r8a4p0yyy7Kn6C1njBQ7n N5bgSL2EkpQRjj2d5akh42Apwb5EQZMdqICo68XElWnk0AxH6Y1PdRkfcruU9PnS t7KJEeBxdsZAJhx5ZEWZrIwjY/rbEvI+rfePgdm8kVeUUVs4ur6Zg1DNk/LgolOP xr60E5DWHIczjJ3Ae+svL5mmJ8FICFOThAYjMzGyRACB4c3znMBhzKVoNrUR6sl5 7qSf1x3WBXIYwd0RRs9YhTF6vQhlnfKfu8rPfb2S6v8rE7JmmokLr3kVFzgpph1K o893VMecWe5al0ZuE2qdf44w2Ohv0Q== =2PTr -----END PGP SIGNATURE----- Merge tag 'spi-fix-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "Just a couple of small bits for the SpacemiT driver - one small fix, and a new compatible in the DT binding" * tag 'spi-fix-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: dt-bindings: spacemit: add K3 SPI compatible spi: spacemit: Correct TX FIFO slot calculation |
||
|
Linus Torvalds
|
e6bfeebfe1 |
regulator: Fixes for v7.2
One driver specific fix where one of the MediaTek drivers duplicated some core code buggily, and a core fix for an ordering issue on startup where we could end up configuring a voltage outside of constraints due to the order in which we applied constraints. -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmpmMC4ACgkQJNaLcl1U h9DoiAf/V64CUAFspev+AtzWpx1Su9zZoSzoMM5Gj0WBuMoo4G5hZj804DQ/n8al sai+f0loMEVcblfpZNOlYagSkDgvvIc/1SQrAQ1oIxMbpotE1vn4htzGsJJuwwgL lh5GC4CsrXOSRX3VG6pJeBR6RTb9VEbkAhLoxKAJyPlcynk2KdBPwR9B1ZlCgpe6 MP2WrurEVexvuDlZdE8THYth4FXCms0uH5VLo+Q3G4r1Ayt9YpvbvG91fzJSJGti NAzAWma2GFGwQkka5sgMYHyP6rwM1vJ71mz+Bq9G5fUe6DyEp85jv993D5lq2vbH 69GO6ZTZmruCqOkDEELIKA4EpKYzZA== =3XbV -----END PGP SIGNATURE----- Merge tag 'regulator-fix-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "One driver specific fix where one of the MediaTek drivers duplicated some core code buggily, and a core fix for an ordering issue on startup where we could end up configuring a voltage outside of constraints due to the order in which we applied constraints" * tag 'regulator-fix-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: core: clamp voltage constraints before applying apply_uV regulator: mt6358: use regmap helper to read fixed LDO calibration |
||
|
Linus Torvalds
|
09b2124a47 |
Char/Misc driver fixes for 7.2-rc5
Here are a number of small char/misc/etc. driver fixes for 7.2-rc5 that resolve a bunch of different reported issues. Included in here are: - rust_binder error message reporting fix - stratix10-svc firmware driver fixes - mei driver fix - intel_th hardware tracing driver fix - comedi driver fix - uio_hv_generic driver fix - ntsync selftest fix - nsm misc driver fix - some MAINTAINER file updates All of these have been in linux-next for over a week with no reported issues. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -----BEGIN PGP SIGNATURE----- iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCamYCHg8cZ3JlZ0Brcm9h aC5jb20ACgkQMUfUDdst+ymTpwCgyyS6niRHf2Y0qx/o+i8s87h+ipoAoJeaOzb7 RWX/ZYiUEoQCtfbxmXZF =cRG6 -----END PGP SIGNATURE----- Merge tag 'char-misc-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are a number of small char/misc/etc driver fixes for 7.2-rc5 that resolve a bunch of different reported issues. Included in here are: - rust_binder error message reporting fix - stratix10-svc firmware driver fixes - mei driver fix - intel_th hardware tracing driver fix - comedi driver fix - uio_hv_generic driver fix - ntsync selftest fix - nsm misc driver fix - some MAINTAINER file updates All of these have been in linux-next for over a week with no reported issues" * tag 'char-misc-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: MAINTAINERS: Update wine-devel list address rust_binder: only print failure if error has source intel_th: fix MSC output device reference leak misc: nsm: pin the module while the device is open mei: bus: access mei_device under device_lock on cleanup misc: nsm: only unlock nsm_dev on post-lock error paths selftests: ntsync: correct CONFIG_NTSYNC name comedi: comedi_parport: deal with premature interrupt uio_hv_generic: Bind to FCopy device by default MAINTAINERS: Add Greg Kroah-Hartman to GPIB firmware: stratix10-svc: fix teardown order in remove to prevent race firmware: stratix10-svc: handle NO_RESPONSE in async poll firmware: stratix10-svc: fix FCS SMC call kernel-doc firmware: stratix10-svc: fix memory leaks and list corruption bugs |
||
|
Linus Torvalds
|
516e2cb010 |
Staging driver fixes for 7.2-rc5
Here are two small staging driver fixes for 7.2-rc5. They both resolve some reported bugs in the rtl8723bs staging driver and have been in linux-next for over a week with no reported issues. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -----BEGIN PGP SIGNATURE----- iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCamYAxA8cZ3JlZ0Brcm9h aC5jb20ACgkQMUfUDdst+ylfoQCghy7Exq7vpWMlhR8LwQucWqABsxsAnjzK86WN 8VZ68CMngObWMPH31Dx7 =sWD7 -----END PGP SIGNATURE----- Merge tag 'staging-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver fixes from Greg KH: "Here are two small staging driver fixes for 7.2-rc5. They both resolve some reported bugs in the rtl8723bs staging driver and have been in linux-next for over a week with no reported issues" * tag 'staging-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() staging: rtl8723bs: fix inverted HT40 secondary channel offset |
||
|
Linus Torvalds
|
3d0a01cad2 |
Serial driver fixes for 7.2-rc5
Here are two small serial driver fixes for 7.2-rc5. They are:
- sc16is7xx get_direction() callback fix, which resolves a
user-triggerable warning in the driver
- NULL pointer dereference on some platforms using the 8250_mid serial
driver
Both have been in linux-next for over a week with no reported issues.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCamYBZA8cZ3JlZ0Brcm9h
aC5jb20ACgkQMUfUDdst+ykMjACgpSS04QGbBIWmMHnxBWHnDT+Z8qoAn210DRbo
l5E84oG0BSJg1i9c3mnj
=WB87
-----END PGP SIGNATURE-----
Merge tag 'tty-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty
Pull serial driver fixes from Greg KH:
"Here are two small serial driver fixes for 7.2-rc5. They are:
- sc16is7xx get_direction() callback fix, which resolves a
user-triggerable warning in the driver
- NULL pointer dereference on some platforms using the 8250_mid
serial driver
Both have been in linux-next for over a week with no reported issues"
* tag 'tty-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
serial: sc16is7xx: implement gpio get_direction() callback
serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms
|
||
|
Linus Torvalds
|
79ba9db003 |
USB fixes for 7.2-rc5
Here are some small USB fixes and new device quirks and ids for 7.2-rc5. Included in here are: - usb storage quirk added - new usb serial device ids added - usb-serial device name leak and other bug fixes - small xhci driver fixes - normal batch of typec driver fixes for reported issues - usb-atm much-reported-by-syzbot fix for firmware download races - sysfs BOS device removal race fix - lots of usb gadget driver fixes for reported issues - other small USB driver fixes for other reported problems. All of these have been in linux-next this past week, many of them much longer. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -----BEGIN PGP SIGNATURE----- iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCamYE0A8cZ3JlZ0Brcm9h aC5jb20ACgkQMUfUDdst+yk0twCdFi0ivPtWtEzmP7lUNRCzmyT3MvoAoI7o6lJm E5+ID/c4mWfX/DjoPFhU =uUBv -----END PGP SIGNATURE----- Merge tag 'usb-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are some small USB fixes and new device quirks and ids: - usb storage quirk added - new usb serial device ids added - usb-serial device name leak and other bug fixes - small xhci driver fixes - normal batch of typec driver fixes for reported issues - usb-atm much-reported-by-syzbot fix for firmware download races - sysfs BOS device removal race fix - lots of usb gadget driver fixes for reported issues - other small USB driver fixes for other reported problems All of these have been in linux-next this past week, many of them much longer" * tag 'usb-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (30 commits) usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path USB: serial: io_edgeport: cap received transmit credits USB: serial: option: add TDTECH MT5710-CN USB: serial: io_ti: reject oversized boot-mode firmware USB: serial: mxuport: validate firmware header size usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect usb: typec: ucsi: yoga_c630: Remove redundant duplicate altmode handling usb: typec: ucsi: Add duplicate detection to nvidia registration path usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback usb: chipidea: fix usage_count leak when autosuspend_delay is negative usb: core: sysfs: add lock to bos_descriptors_read() usb: musb: omap2430: Do not put borrowed of_node in probe usb: core: port: Deattach Type-C connector on component unbind USB: storage: add NO_ATA_1X quirk for Longmai USB Key USB: serial: ftdi_sio: add support for E+H FXA291 USB: serial: keyspan_pda: fix data loss on receive throttling usb: gadget: printer: fix infinite loop in printer_read() usb: gadget: f_midi: cancel pending IN work before freeing the midi object usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown ... |
||
|
Linus Torvalds
|
864be1277d |
tracing fix for 7.2:
- Move rb_desc->nr_page_va before updating dynamic array The rb_descr->page_va is a dynamic array counted by nr_page_va. But the updating of the page_va[] is done before the nr_page_va is incremented causing a build with CONFIG_UBSAN_BOUNDS to flag it as an overflow. Move the increment of the counted by value before the array element is updated. - Propagate errors from remote event bulk updates The return value of trace_remote_enable_event() was not being checked by remote_events_dir_enable_write() where it would silently fail. Have it check the return value and propagate that back up to user space. - Fix resource leak on mmiotrace trace_pipe close The mmiotrace tracer was created in 2008 before the trace_pipe had a close callback to allow tracers to do clean up from trace_pipe open. The trace_pipe close cleanup callback was added in 2009 but the mmiotrace tracer was not updated. It had a hack to do the cleanup in the read call, where it may leak if user space did not read the entire buffer. Add a callback to mmiotrace trace_pipe close do to the cleanup properly. - Fix a possible NULL pointer dereference in the mmiotrace tracer If the mmio_pipe_open() fails to find a PCI device, it will set the hiter->dev pointer to NULL. The read function will blindly dereference that pointer. Fix the read call to check to see if that pointer is populated before dereferencing it. - Fix union collision of module and refcnt for dynamic events In 'struct trace_event_call', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. The filter on module logic only checked if the 'module' was set to determine if the event belonged to the module. As dynamic events are always builtin, it doesn't need the 'module' field of the structure and used a refcount. But the module filtering logic would then mistaken these dynamic events as a module and call module_name(event->module) on it. Add a check to see if the event is a dynamic event and if so, do not check it for being part of the given module. - Reset the top level buffer in selftests before running instances The ftracetest selftest initializes each instance before executing the tests. But it does not reset the top level buffer. Dynamic events are only added and removed by the top level so any left over dynamic events will not be removed by the reset in the instances. Left over dynamic events can cause the tests to incorrectly fail. Reset the top level buffer before running the instances. - Make the context_switch counter 64 bit The code to read user space for a system call trace event or for a trace_marker will disable migration, enable preemption, read user space into a per CPU buffer, disable preemption and enable migration again. It checks if the per CPU context switch counter to see if it changed, and if it did not, it would know that the per CPU buffer was not touched by another task. But the save counter was 32 bit and it would compare it to the 64 bit context_switch variable. A long running system could have the context_switch variable greater that 1<<32 in which case the compare will always fail. The compare will promote the 32 bit int saved value to 64 bit and compare it to the full 64 bit counter. Since the top 32 bits of the saved value was zero, it would never match. - Fix a use-after-free of the event_enable trigger The event_enable trigger allows for enabling one event when another event is triggered. When the trigger is removed, it must go through a synchronization phase to make sure it is not triggered again. The trigger itself is delayed by the "bulk delay" logic that was recently added. But the code that frees the event_enable data used to rely on the trigger code to do the synchronization. Now that the code uses the call RCU functions (and a workqueue), that delay no longer is there. Add a callback private_data_free() function that allows triggers to clean up data after the synchronization phase has completed. - Move the module_ref counter into the delay callback Since an event of the event_enable trigger can enable an event for a module, it ups the module ref count for that event's module. This prevents the event from trying to enable an event that no longer exists and cause a use-after-free bug. The ref counter was set back down when the trigger was removed but not after thy synchronization phase. This could lead to the module data being accessed after module was unloaded. Move the module ref decrement into the private_data_free() callback of the event_enable trigger. - Add mutex to protect parser in ftrace filtering The set_ftrace_filter file uses a parsing descriptor that is allocated at open and modified by writes. If multiple threads were to write to the descriptor at the same time, it can corrupt the parser. Add a mutex around the modifications of the parser descriptor. - Fix possible corruption in perf syscall tracing The perf system call trace events can now read user space. To do so, the reads of user space enable preemption and disables it again. During this time that preemption is enabled, the task can migrate. The perf event list head is assigned via a per CPU pointer. It is done before the user space part is called. If the user space reading migrates the task to another CPU, then the head pointer is no longer valid. Re-assign the head pointer after the reading of user space to keep it using the correct data. -----BEGIN PGP SIGNATURE----- iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCamYDGhQccm9zdGVkdEBn b29kbWlzLm9yZwAKCRAp5XQQmuv6qkhYAP9G5wDTVQQzitl900iWp9rvQ2Qm5UWN JDnK2HO1elmj0AD8CRiHBI5W3O2yUmoO4bOFZ9YFXz+DqJ1jwkDs5FfqjAU= =EMD9 -----END PGP SIGNATURE----- Merge tag 'trace-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Move rb_desc->nr_page_va before updating dynamic array The rb_descr->page_va is a dynamic array counted by nr_page_va. But the updating of the page_va[] is done before the nr_page_va is incremented causing a build with CONFIG_UBSAN_BOUNDS to flag it as an overflow. Move the increment of the counted by value before the array element is updated. - Propagate errors from remote event bulk updates The return value of trace_remote_enable_event() was not being checked by remote_events_dir_enable_write() where it would silently fail. Have it check the return value and propagate that back up to user space. - Fix resource leak on mmiotrace trace_pipe close The mmiotrace tracer was created in 2008 before the trace_pipe had a close callback to allow tracers to do clean up from trace_pipe open. The trace_pipe close cleanup callback was added in 2009 but the mmiotrace tracer was not updated. It had a hack to do the cleanup in the read call, where it may leak if user space did not read the entire buffer. Add a callback to mmiotrace trace_pipe close do to the cleanup properly. - Fix a possible NULL pointer dereference in the mmiotrace tracer If the mmio_pipe_open() fails to find a PCI device, it will set the hiter->dev pointer to NULL. The read function will blindly dereference that pointer. Fix the read call to check to see if that pointer is populated before dereferencing it. - Fix union collision of module and refcnt for dynamic events In 'struct trace_event_call', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. The filter on module logic only checked if the 'module' was set to determine if the event belonged to the module. As dynamic events are always builtin, it doesn't need the 'module' field of the structure and used a refcount. But the module filtering logic would then mistaken these dynamic events as a module and call module_name(event->module) on it. Add a check to see if the event is a dynamic event and if so, do not check it for being part of the given module. - Reset the top level buffer in selftests before running instances The ftracetest selftest initializes each instance before executing the tests. But it does not reset the top level buffer. Dynamic events are only added and removed by the top level so any left over dynamic events will not be removed by the reset in the instances. Left over dynamic events can cause the tests to incorrectly fail. Reset the top level buffer before running the instances. - Make the context_switch counter 64 bit The code to read user space for a system call trace event or for a trace_marker will disable migration, enable preemption, read user space into a per CPU buffer, disable preemption and enable migration again. It checks if the per CPU context switch counter to see if it changed, and if it did not, it would know that the per CPU buffer was not touched by another task. But the save counter was 32 bit and it would compare it to the 64 bit context_switch variable. A long running system could have the context_switch variable greater that 1<<32 in which case the compare will always fail. The compare will promote the 32 bit int saved value to 64 bit and compare it to the full 64 bit counter. Since the top 32 bits of the saved value was zero, it would never match. - Fix a use-after-free of the event_enable trigger The event_enable trigger allows for enabling one event when another event is triggered. When the trigger is removed, it must go through a synchronization phase to make sure it is not triggered again. The trigger itself is delayed by the "bulk delay" logic that was recently added. But the code that frees the event_enable data used to rely on the trigger code to do the synchronization. Now that the code uses the call RCU functions (and a workqueue), that delay no longer is there. Add a callback private_data_free() function that allows triggers to clean up data after the synchronization phase has completed. - Move the module_ref counter into the delay callback Since an event of the event_enable trigger can enable an event for a module, it ups the module ref count for that event's module. This prevents the event from trying to enable an event that no longer exists and cause a use-after-free bug. The ref counter was set back down when the trigger was removed but not after thy synchronization phase. This could lead to the module data being accessed after module was unloaded. Move the module ref decrement into the private_data_free() callback of the event_enable trigger. - Add mutex to protect parser in ftrace filtering The set_ftrace_filter file uses a parsing descriptor that is allocated at open and modified by writes. If multiple threads were to write to the descriptor at the same time, it can corrupt the parser. Add a mutex around the modifications of the parser descriptor. - Fix possible corruption in perf syscall tracing The perf system call trace events can now read user space. To do so, the reads of user space enable preemption and disables it again. During this time that preemption is enabled, the task can migrate. The perf event list head is assigned via a per CPU pointer. It is done before the user space part is called. If the user space reading migrates the task to another CPU, then the head pointer is no longer valid. Re-assign the head pointer after the reading of user space to keep it using the correct data. * tag 'trace-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: perf: Fix stale head for perf syscall tracing ftrace: Add global mutex to serialize trace_parser access tracing: Delay module ref count for "enable_event" trigger tracing: Fix use-after-free freeing trigger private data tracing: Fix context switch counter truncation selftests/ftrace: Reset triggers at top level before instance loop tracing: Fix union collision of module and refcnt for dynamic events tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev tracing: Fix resource leak on mmiotrace trace_pipe close tracing: Propagate errors from remote event bulk updates tracing/remotes: Fix page_va[] access before counter update in trace_remote_alloc_buffer() |
||
|
Linus Torvalds
|
86d1022b2c |
m68knommu: fix on top off v7.2-rc4
. fix broken local SoC IO accesses for ColdFire -----BEGIN PGP SIGNATURE----- iQJEBAABCgAuFiEEmsfM6tQwfNjBOxr3TiQVqaG9L4AFAmpmCkEQHGdlcmdAa2Vy bmVsLm9yZwAKCRBOJBWpob0vgAfGEACdeDStzWowLpRvqHymL+KlOiPxkHFjaevD nlCybnL77KAu/bsY6gxKEadAplS/PCutNn4U4gtikdKPGklS8wIEMK9JttUzJhCl /Tv2sawYoTzyFj8leXi7slQowQjsj3GEhUpm0WMilRRVNENpQvpxRYos4qiScMdZ xsp9gmL8gK9UIbOYnNpPP95jOlnO9DblSllVBuPwXcsb8AX1uUj1c83720vVqfYO pH8nnhvOr1PHIbfEeDPuOGj/z0uTIgVJxa7wtvhEraLxgedTJHcKpI7HMmF3R1Yr 0yM3n3hI9XoC6FU3ySP+KQOLyrGhbd6p5uajxc8SgHoIF4QZj92IK04+z4psFfQC MNg1c3yoXY4BZX9lIsZ52JzC2dVacBIntuclYFwu0xeFHDdtp7wH38Y8pbOGwmVY ObR6fooPbv54wT53b4oiW0RvtTp1QMRbQywr1O1RRM6QUr/a9wgXcIZ+d75GBlCV NftNvvjlEvVcfHl/nuBtDj9zQpYkwL41u/L5eg9riqHllEY1JV2GPsLQWmWP3CVw OVygfxEe66dppbW+QuVK3Pl72P2yVLBqdERZFYnibMNFiy5jnGxhOZ9G0/W+ewna LsL0BbDQEBduxUrbVSkNbM34e48v5IRHVFO3PD47u3gaFvL3Z8WksacENBimT5hy btidRA+Tyg== =r9I3 -----END PGP SIGNATURE----- Merge tag 'm68knommu-fixes-on-top-off-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu Pull m68knommu fix from Greg Ungerer: - fix broken local SoC IO accesses for ColdFire * tag 'm68knommu-fixes-on-top-off-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu: m68k: coldfire: fix breakage of missed IO access update |
||
|
Linus Torvalds
|
3f97818796 |
- Disable jump/lookup tables in the x86 boot decompressor code
a bit more widely, because newer versions of LLVM started
optimizing it a bit better and introduced run-time relocations
in PIE code. (Nathan Chancellor)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmpl0uARHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1hmpxAAltRv2TwPA4MeZt10iYTG4BdwMp4OleR4
hDxqYL9T1OJev4wLujlri3/Vb1MVKG1S3YQjeG6hWAB0L+//hbx2e/nEU24uW5xb
j+0kAWSSZPUIP3KRc5Cy4mb1EXiumjk3GHnwXZpRV5XA4RRoTmpexd09J5v5KNvt
/q/c8ZzVMB8p8S1K98BdL/wMAyEHLg+iSywTdNsa8Zyw8qB8qAlRgLHTlhYjkcnO
E1+g3MY7QDEjMYDgHAMP1GHvtXTktXfp2Neo4s0WLmY/C6LEyWE/+HIDrMVuzjat
AU5IWbE0tDxGYdeyVvVoxRafFWmVg7mfnazkORp6iojbfJeVBB+IkNAVX0fbKEBT
Yx6Gcm/x0Xb2pf8zaUWE2q02Sz4WYpWrkcLZrLIVnCphyAK7K7V+I7ZkFP1reQR9
fr9RIsKC+6K5mWivFpOjkEzYp+D9Yp2OJyAgK0oE7F7Zd6u0+qpCWaM+VPHsYp41
wsVGTPgD5JP871o6ln38YskBct70E3BnzO5p10a5PbyRaaBCSBZC1XGCglIs7PS9
TmsZOI4Wc8dHzobUTXNdgOymfqXV/bQEITL8qRt9Ge2GUiUROFLp8IVzmJIADWKv
oqtoNo/vjthpFTXVZ3c4beACEaNu71bDbLjwjOdIb2W8NPY+Z+WeSkHDcg5Gt7qN
2cYWBUyhc3o=
=3e+9
-----END PGP SIGNATURE-----
Merge tag 'x86-urgent-2026-07-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fix from Ingo Molnar:
- Disable jump/lookup tables in the x86 boot decompressor code
a bit more widely, because newer versions of LLVM started
optimizing it a bit better and introduced run-time relocations
in PIE code (Nathan Chancellor)
* tag 'x86-urgent-2026-07-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/boot/compressed: Disable jump tables
|
||
|
Linus Torvalds
|
a6671109d6 |
- SMP-call fixes when CSD lock debugging is enabled (Chuyi Zhou)
Signed-off-by: Ingo Molnar <mingo@kernel.org> -----BEGIN PGP SIGNATURE----- iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmpl0OURHG1pbmdvQGtl cm5lbC5vcmcACgkQEnMQ0APhK1jnng/9HrimCemEFDFpbyfbqf5ucrV8FyrbIWIX HgxpXYKpOAobz2d0DYA0dn7y+HGVJr9rU7tLxeLpH+NSsT+nm/wva+2D0X4h8Lod VKNFXI1EeQ6GJ0bmRY/DBv2GKPrYfnb1gzn/HO6KE/GITWO79Uq48K/4GTE+mbR6 l++YilPqJfujYA6IlnxdexSJNZUkNbL8lDHsxBm0xM+TyG5JP+xpdHZLpU6Tf5fd l+DcTg6KriS1T+PqAWa+2BXhMhJg2BTEZmH3mU3uvqv8EDMyTUpP4X/f0JLVU/qi 24aFDCrd5zwDey58CXnOhybzpgH7Em8/1GMN5t+6eJBtPt4Hd48h7XVgJeGZje8t yxxtruQ/c5NiKYCoHPro0uMPYu6SWaz8k/h8U2dHqtg6nswVTv89V7jSno8UGsW0 W+vJcDpO3KlfHDRXLQg2E+/WRpQzD5bUeaV9/d0x/4BzokmSDNlafMNZ/bL0RUT+ I0ij4TI16RQNSMxUMTLRC9SP4n1YyH0VMGRn9goTEns2DBdl8Y+xHH+Cnk4RedwX 9MmTLvHyuKHh5VeytWlvNbQD7+L13neec/Hlhw7/sLH7+LMUJfeMM6y4roWQvDuG /5lIT/7P/ketFzgQSGVMtaUi3ZCgfT4ZCS6X6KyaSe3F654Jt0ZpdyUQ9t1Xc42U Z+QM5jJ/4gY= =6nVN -----END PGP SIGNATURE----- Merge tag 'smp-urgent-2026-07-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull SMP debug fixes from Ingo Molnar: - SMP-call fixes when CSD lock debugging is enabled (Chuyi Zhou) * tag 'smp-urgent-2026-07-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: smp: Make CSD lock acquisition atomic for debug mode smp: Avoid invalid per-CPU CSD lookup with CSD lock debug |
||
Christian Brauner
|
749d7aa037 |
super: fix emergency thaw deadlock on frozen block devices
do_thaw_all_callback() calls bdev_thaw() while holding sb->s_umount
exclusively. If the block device was frozen via bdev_freeze() dropping
the last block layer freeze reference calls fs_bdev_thaw() which
reacquires s_umount:
do_thaw_all_callback(sb)
super_lock_excl(sb) # holds sb->s_umount
bdev_thaw(sb->s_bdev)
mutex_lock(&bdev->bd_fsfreeze_mutex)
# bd_fsfreeze_count drops 1 -> 0
bd_holder_ops->thaw == fs_bdev_thaw
get_bdev_super(bdev)
bdev_super_lock(bdev, true)
super_lock(sb, true)
down_write(&sb->s_umount) # same task: deadlock
The emergency thaw worker deadlocks against itself holding both
s_umount and bd_fsfreeze_mutex. That fscks any subsequent unmount,
freeze, or thaw of that filesystem and block device.
[ 81.878470] sysrq: Show Blocked State
[ 81.880140] task:kworker/0:1 state:D stack:0 pid:11 tgid:11 ppid:2 task_flags:0x4208060 flags:0x00080000
[ 81.884876] Workqueue: events do_thaw_all
[ 81.886656] Call Trace:
[ 81.887759] <TASK>
[ 81.888763] __schedule+0x579/0x1420
[ 81.890372] schedule+0x3a/0x100
[ 81.891794] schedule_preempt_disabled+0x15/0x30
[ 81.893848] rwsem_down_write_slowpath+0x1ea/0x900
[ 81.895191] ? __pfx_do_thaw_all_callback+0x10/0x10
[ 81.896528] down_write+0xbd/0xc0
[ 81.897505] super_lock+0x91/0x180
[ 81.898457] ? __mutex_lock+0xa99/0x1140
[ 81.900748] ? __mutex_unlock_slowpath+0x1f/0x400
[ 81.902069] bdev_super_lock+0x5b/0x150
[ 81.903132] get_bdev_super+0x10/0x60
[ 81.904042] fs_bdev_thaw+0x23/0xf0
[ 81.904755] bdev_thaw+0x82/0x100
[ 81.905484] do_thaw_all_callback+0x2c/0x50
[ 81.906298] __iterate_supers+0x5d/0x130
[ 81.907067] do_thaw_all+0x20/0x40
[ 81.907739] process_one_work+0x206/0x5e0
[ 81.908545] worker_thread+0x1e2/0x3c0
[ 81.909339] ? __pfx_worker_thread+0x10/0x10
[ 81.910171] kthread+0xf4/0x130
[ 81.910799] ? __pfx_kthread+0x10/0x10
[ 81.911528] ret_from_fork+0x2e2/0x3b0
[ 81.912259] ? __pfx_kthread+0x10/0x10
[ 81.913010] ret_from_fork_asm+0x1a/0x30
[ 81.913806] </TASK>
bdev_super_lock() even documents the violated requirement with
lockdep_assert_not_held(&sb->s_umount).
Acquiring bd_fsfreeze_mutex under s_umount also inverts the
bd_fsfreeze_mutex vs. s_umount ordering established by
bdev_{freeze,thaw}() and can thus ABBA against a concurrent block-layer
freeze even when the recursive path isn't hit.
Fix this by not holding s_umount around the bdev_thaw() loop at all. Pin
the superblock with an active reference instead as
filesystems_freeze_callback() does. The active reference keeps the
superblock from being shut down and so ->s_bdev stays valid without
holding s_umount. The block-layer-held freeze is dropped by
fs_bdev_thaw() with FREEZE_MAY_NEST | FREEZE_HOLDER_USERSPACE exactly as
a regular unfreeze would and thaw_super_locked() handles
filesystem-level freezes as before.
The emergency thaw path has deadlocked like this in one form or
another for a long long time but the current exclusively-held
shape dates back to commit [1] where thaw_bdev() already ended in
thaw_super() with s_umount held by do_thaw_all_callback().
Fixes:
|
||
|
Linus Torvalds
|
3dab139d47 |
Rust fixes for v7.2 (2nd)
Toolchain and infrastructure:
- 'zerocopy' crates: update to v0.8.54 to fix a modpost error under
'CONFIG_CC_OPTIMIZE_FOR_SIZE=y'.
There are actually two updates in the PR: the one to v0.8.52 is
fairly large and was originally not intended for a fixes PR, but the
actual fix landed in the v0.8.54 one. Thus I included both here.
The v0.8.52 update includes two things upstream added for us:
'--cfg no_fp_fmt_parse' to avoid a local workaround, and the new
'most_traits' feature.
The good news is that, after these updates, the delta with upstream
is now trivial: only an identifier prefix change and the SPDX
parentheses.
- Fix an objtool warning by adding one more 'noreturn' function for
Rust 1.99.0 (expected 2026-10-01).
- Clean up new 'semicolon_in_expressions_from_macros' lint errors for
Rust 1.99.0 (expected 2026-10-01). The lint can be allowed, but it
will be a hard error at some point in the future anyway, so clean it
up now.
- Locally allow new 'suspicious_runtime_symbol_definitions' lint for
Rust 1.98.0 (expected 2026-08-20).
- Globally allow 'clippy::unwrap_or_default' lint since it relies on
optimizations -- under 'CONFIG_CC_OPTIMIZE_FOR_SIZE=y' it does not
work well.
'kernel' crate:
- 'time' module: fix 'Delta::as_micros_ceil()' to round negative values
correctly.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEPjU5OPd5QIZ9jqqOGXyLc2htIW0FAmpk6V4ACgkQGXyLc2ht
IW24OQ/7B2pQtg8IE/6fvkPO7I+EPGknkiutPczrh0HFJ2x0rSaC69NVjkV3d5nq
KWk1zOPPzxMoOeIEOR/e8iAMfo9B093mlohappwMKLZGju2x+K6JA+rn6HsvTLiv
fGgjM7hq3B7ExBCon7qDQLYh6cib9T90e9IJrE8rnitbJ8QkUSqXTwCqUbkN7pOt
U5GUX9yHxo9slc9XYy3AC8aifqaBNeUWzfn6a7DN7nLUNhm5AYiYyduvU6QZQ1kR
ezinZn3Jqv+VrpXcuM2x2iMMJCdFILzXdnrhPWoT8whc9GzNWVArkSIYFefvjgvK
Yb+gppVjEuKwsT81eoMwD9edD+wL/4MSU6lnW4eN0EhgECSy7HZs2Jjv1UIrPPSH
ZvVp6Bzn0nuXed4fh+mrqvwmltqnDpVK06c/q6M8u5mQ/HURwCsh43M7X7S4Sm0p
X8AutCjsWj+uP44ZnC/Y5p/r3tFl+HM55YT/favb54Xzq+SDrMtSQ7HFM7CZaDHd
g1B/SBlCTs1O1htqNDWqzew8HdoLfRueZf9tRnTCYSlvOgjSgBB9561m2wfgVE86
yrwPnaYZeipny2hVh+iCiZGDvrqKh+r4nMB8R8X61qjWC7/szjsxs3IiCUpPpMJB
3omYUm3nOxzZjYp9uK0E+YW+BITjC8VrP6XWUnzedfas1bds63k=
=4BpZ
-----END PGP SIGNATURE-----
Merge tag 'rust-fixes-7.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux
Pull rust fixes from Miguel Ojeda:
"Toolchain and infrastructure:
- 'zerocopy' crates: update to v0.8.54 to fix a modpost error under
'CONFIG_CC_OPTIMIZE_FOR_SIZE=y'.
There are actually two updates in the PR: the one to v0.8.52 is
fairly large and was originally not intended for a fixes PR, but the
actual fix landed in the v0.8.54 one. Thus I included both here.
The v0.8.52 update includes two things upstream added for us:
'--cfg no_fp_fmt_parse' to avoid a local workaround, and the new
'most_traits' feature.
The good news is that, after these updates, the delta with upstream
is now trivial: only an identifier prefix change and the SPDX
parentheses.
- Fix an objtool warning by adding one more 'noreturn' function for
Rust 1.99.0 (expected 2026-10-01).
- Clean up new 'semicolon_in_expressions_from_macros' lint errors for
Rust 1.99.0 (expected 2026-10-01). The lint can be allowed, but it
will be a hard error at some point in the future anyway, so clean it
up now.
- Locally allow new 'suspicious_runtime_symbol_definitions' lint for
Rust 1.98.0 (expected 2026-08-20).
- Globally allow 'clippy::unwrap_or_default' lint since it relies on
optimizations -- under 'CONFIG_CC_OPTIMIZE_FOR_SIZE=y' it does not
work well.
'kernel' crate:
- 'time' module: fix 'Delta::as_micros_ceil()' to round negative values
correctly"
* tag 'rust-fixes-7.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:
rust: time: fix as_micros_ceil() to round correctly for negative Delta
rust: device: avoid trailing ; in printing macros
objtool/rust: add one more `noreturn` Rust function for Rust 1.99.0
rust: zerocopy: update to v0.8.54
rust: zerocopy: update to v0.8.52
rust: allow `clippy::unwrap_or_default` globally
rust: allow `suspicious_runtime_symbol_definitions` lint for Rust >= 1.98
|
||
|
Linus Torvalds
|
ef9ce800df |
perf tools fixes for v7.2.
- Update header copies of kernel headers, including const.h, fs.h, perf_event.h, gfp_types.h, kvm.h, cpufeatures.h, rtnetlink.hp, msr-index.h, drm.h and socket.h. - Add some build files related to BPF skels to .gitignore. Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQR2GiIUctdOfX2qHhGyPKLppCJ+JwUCamSrfQAKCRCyPKLppCJ+ J41WAQCqkEX7tpYp9F1f/lhzLjeeBc1dcvddAgrlzr/79E0Y8AD8ChH8SMc95ERH rOrpIKhflMUQw5EazDW/AczabIZfcQs= =2+4S -----END PGP SIGNATURE----- Merge tag 'perf-tools-fixes-for-v7.2-1-2026-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools Pull perf tools fixes from Arnaldo Carvalho de Melo: - Update header copies of kernel headers, including const.h, fs.h, perf_event.h, gfp_types.h, kvm.h, cpufeatures.h, rtnetlink.hp, msr-index.h, drm.h and socket.h - Add some build files related to BPF skels to .gitignore * tag 'perf-tools-fixes-for-v7.2-1-2026-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: tools headers: Sync KVM headers with the kernel sources tools headers: Sync UAPI linux/fs.h with the kernel sources perf beauty: Update copy of linux/socket.h with the kernel sources tools headers: Sync UAPI drm/drm.h with kernel sources tools arch x86: Sync the msr-index.h copy with the kernel sources tools headers x86 cpufeatures: Sync with the kernel sources tools headers: Sync linux/gfp_types.h with the kernel sources tools headers UAPI: Sync linux/rtnetlink.h with the kernel sources tools headers UAPI: Sync linux/const.h with the kernel sources perf bench bpf: Add missing .gitignore file |
||
|
Linus Torvalds
|
d99d2a953a |
firewire fixes for 7.2-rc5
Fix a bug in unit driver for RFC 2734 IPv4 over IEEE 1394. The driver failed to reassemble a complete datagram when it was stored across multiple buffer ranges in the list. Ruoyu Wang reported and fixed it. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQQE66IEYNDXNBPeGKSsLtaWM8LwEwUCamSU6gAKCRCsLtaWM8Lw E/B8AQDAi36W7MJ/y+pcbYA0BQHE/hsr/BbVsx3LmuR2WrHKFwD/WXat4OwVtdVc ZkrO1gwRE263p3UGpqFEftZdS976xgw= =z/i1 -----END PGP SIGNATURE----- Merge tag 'firewire-fixes-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull firewire fix from Takashi Sakamoto: "Fix a bug in unit driver for RFC 2734 IPv4 over IEEE 1394. The driver failed to reassemble a complete datagram when it was stored across multiple buffer ranges in the list. Ruoyu Wang reported and fixed it" * tag 'firewire-fixes-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: firewire: net: Fix fragmented datagram reassembly |
||
|
Linus Torvalds
|
3fb11702e4 |
LoongArch fixes for v7.2-rc5
-----BEGIN PGP SIGNATURE----- iQJKBAABCAA0FiEEzOlt8mkP+tbeiYy5AoYrw/LiJnoFAmpjKJIWHGNoZW5odWFj YWlAa2VybmVsLm9yZwAKCRAChivD8uImeulhD/9Oe/6FLvyuK4KYi+0DyacU4FZ4 NQjgFa3g2CBY+qiS6qSjzygbClFLZjkhbXsOaQekQjiYWNCKwTCJGg0m/y+qNS+S F1UWxuZxVor1ty4y6KSldCHtdI5ROSXf2Iq3UNw2JX2W8LK0r/asLvFpkIHGcDdJ kqMnD4aktxgs+RYZVs9rQrS0cR8mQom6KVu39/4KB/6QulEMEaH857txobexlaTo 7Jo/I3fcsxbcWxo+I6yZSdSkIBRI5H6eywbHgF0ug7cOmpQL70IGIx0S42XK7RUy A/A7BrPN1JMFTloDSHTX6b05lCh4UEhLBbFgX3ztVCNXt0j5v7/y5dqISwn4qlDP LkPEx/LQ1GsHQu9pqDN3gpD/G/RK+DvpA4p6+GpDrrQ7PQFMIKuzcil7LeZZ0C7H VNbt7QP+HgPHezNroOMp16/PeEBLp2tkO1bqjCf/gRc47OPqLQtOiPJOK0B9yFzw x4J8SRwxjqrg/TYYfP5lOhqafF0cp7ZE7LSlCMwylnZ6EYHaeEJh14ii5u36XJuj ohu83vsobIRa9fJ7StQ8Hf6nJSGSoWpkn6WIAxiL/+Ksz4gzfe+5TNEoBg1cGqjX XBS/qVj0ju06QVrg4H8X9gKEt7LQN+nIXBCg/OXSD75pdM/wlO08PANygU4FXUbE /Q3RTJykzBT4P1TETg== =BlSV -----END PGP SIGNATURE----- Merge tag 'loongarch-fixes-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch fixes from Huacai Chen: - fix build warnings and errors - move jump_label_init() before parse_early_param() - retrieve CPU package ID from PPTT when available - fix some bugs kgdb, BPF JIT and laptop platform driver bugs * tag 'loongarch-fixes-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: platform/loongarch: laptop: Explicitly reset bl_powered state when suspend platform/loongarch: laptop: Stop setting acpi_device_class() LoongArch: BPF: Fix memory leak in bpf_jit_free() LoongArch: BPF: Zero-extend signed ALU32 div/mod results LoongArch: Fix oops during single-step debugging LoongArch: Fix address space mismatch in kexec command line lookup LoongArch: Retrieve CPU package ID from PPTT when available LoongArch: Move jump_label_init() before parse_early_param() LoongArch: Fix build errors due to wrong instructions for 32BIT LoongArch: Increase TASK_STRUCT_OFFSET up to 2040 for 32BIT |
||
|
Linus Torvalds
|
0ce37745d4 |
block-7.2-20260724
-----BEGIN PGP SIGNATURE----- iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmpkDdwQHGF4Ym9lQGtl cm5lbC5kawAKCRD301j7KXHgpjDzEACEBgNkSx8wWKnDR1/nqa0TWR2PkHbb2QLp 5vf2NW6K+vgA1d0jF0UI+PCxoN9zc7fIqWpfyssNJtRAZkyfyclcPsh573uoJQ5V yOSKtUF5ARedyZdMzTUgKqfi2R4PKBvbyD2TEirsDk1iirK7n8EFHy9soORdEgl3 6qmFOWtKk/XCIOauIYoHDU3mlsSbukEGtoHEoucwgQQrzT7PvE/4vM7G1n4DXULE NwSUpYjjRpyaTVc47vihhK7dpwXayJ5um8IqTWFLGmREr7LCaf1ZjT3lZtWYnoDF FOG2w1EhcGByvNDz0vKL1sywfjBVPAAjYYaFpbfjwEuwNC6GUQUQ6AEQFpqoNIQ5 Xt1ujXFiySXwjJNtdhzFI8cs5ZSDQVCx4VdJ/3r2fyPJemFyBt7pUiJz0hmmnTH2 jO4ikNjRRWom7aAYC7sSM32OoIZLgDa572KD0uMOLXEP4seouq/SS+V9eMQE7ay3 nl9Bp2kGV7SvubRxENAYyStalNl4ekSXk7YHYZNBzj8GaVPiTC98j5p1zqXrbDLn Ovts0SdbENvz0jFOisYlx3GA7Nlud5oV+iMvxgVuHD7urkljY3INHsqpSEgP8K6e 7ggwocJV+gE277aS7mmdPJ3ZYsPS0mf7vhx3vq9anNhKcuamFiKaymqTGcxerjmC oqtrmld3NA== =m0rQ -----END PGP SIGNATURE----- Merge tag 'block-7.2-20260724' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - Fix a ublk recovery hang, where END_USER_RECOVERY without a successful START_USER_RECOVERY could be satisfied by a stale completion latch - Fix a stack out-of-bounds read in the CDROMVOLCTRL ioctl - MAINTAINERS email address update for Roger Pau Monne * tag 'block-7.2-20260724' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: MAINTAINERS: update my email address cdrom: fix stack out-of-bounds read in CDROMVOLCTRL ublk: wait on ublk_dev_ready() instead of ub->completion |
||
|
Linus Torvalds
|
73387b89d9 |
io_uring-7.2-20260724
-----BEGIN PGP SIGNATURE----- iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmpkDfYQHGF4Ym9lQGtl cm5lbC5kawAKCRD301j7KXHgpgJgEACAoCs3hC/reUovTYQB8+68AyyBmF5xeJMI uxYKcVEZGjOo6gTjSm2GYEBa6P85kQtbWEKEfuxXxV2gT1S/3yulV+uy8NfI/lO7 NsKYRHszaa/AFr2RbeZeYLU9TN/qFbZinfxukpW1zWrfwg83IhGGe6QN53G1XB2v +pO0bqSZ/qKkJ4IXGubLxSxUnDWg6bav4XUeEkjSlE6mzp1+BgpesLLOsZNvvLST 5QTGt5EfWFBgo9LdYHz/ky7MnJjkioFDY+c10sLp2+6ghtyMTZcACB1W4gSSyJG+ QsLYJ6Z25f7zo7WIci42pCDDDhYWQgDFc7r9+uJ1ISFKXLGnEyONnBaxmk2LTWdX g9V03+pI17vTOQNU0XlkpajUykOmMCkhZWA8jwlOAFJXtz+pdV1vSKeSZt9tEB4j aEd6IjoBUrPLsv7WIlomf/h9quHfdjMogA6eyaXc4227XzKWo63XlGe4HxBC6yQQ 4Lq8QH8dta6BOm+5APQXNQ5g/EB0OVLDkgh8EzSTDChgoJd4hVwoHnGbGidZSAcR mgSl4SG/XdXMIwhqAH5iiI+7YZ71ALnoRkLujED90c+lGHrrY0T7H99XaHprp6xa NOUbz5CAZf+bWPfXbLpJG+QTh/evh9zxfJ30VprHByl99EJFxjK7rW3BJvOAokjs 1O635JJo7A== =pQDU -----END PGP SIGNATURE----- Merge tag 'io_uring-7.2-20260724' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: - Fix a missing ERESTARTSYS conversion in the read paths, which got messed up back when some code consolidation was done for read multishot support - zcrx UAPI rename, dropping the abbreviated "notif" naming in favor of "event" for consistency and to be less ambiguous for users. This was added for 7.2, so let's rename it while we still can. No functional or code changes, just a strict rename * tag 'io_uring-7.2-20260724' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/zcrx: rename notif to event io_uring/zcrx: rename ZCRX_NOTIF_NO_BUFFERS io_uring/zcrx: drop "notif" from stats struct names io_uring/rw: fix missing ERESTARTSYS conversion in read paths |
||
Steven Rostedt
|
2c2b322acd |
tracing: perf: Fix stale head for perf syscall tracing
The code that can read the user space parameters of a system call may
enable preemption and migrate. The head of the per CPU perf events list
may be pointing to the wrong CPU event if the code migrates the task.
Reassign the head pointer if the system call event called the code that
may have caused a migration.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260724193210.03fae1d6@gandalf.local.home
Reported-by: Sashiko <>
Link: https://sashiko.dev/#/patchset/20260717173252.3431565-1-usama.arif%40linux.dev
Fixes:
|
||
Tengda Wu
|
7720b63bce |
ftrace: Add global mutex to serialize trace_parser access
In ftrace, the trace_parser structure is allocated and initialized when a trace file is opened, and is subsequently used across write and release handlers to parse user input. The affected handler paths and their specific functions are: - Open paths: ftrace_regex_open(), ftrace_graph_open() - Write paths: ftrace_regex_write(), ftrace_graph_write() - Release paths: ftrace_regex_release(), ftrace_graph_release() If userspace opens a trace file descriptor and shares it across multiple threads, concurrent write calls will race on the parser's internal state, specifically the 'idx', 'cont', and 'buffer' fields, leading to corrupted input or undefined behavior. Fix this by adding a global mutex, parser_lock, to serialize all access to trace_parser across write and release paths, preventing concurrent corruption of parser state. Fixes: |
||
|
Linus Torvalds
|
8e371eff3f |
eight ksmbd server fixes
-----BEGIN PGP SIGNATURE-----
iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmpj6jgACgkQiiy9cAdy
T1F7Agv/Q0LNuCs18A0dR8SlNLwbo6lE6RVL3A8TfFKqiqpyigPBf0Ax2VqR/uuH
6rfuwZYLMNOp9P+jgFYPug8+fx2Ya58oLlVtCY+JooASUbwEg7PG/R3oHuZe4tOS
m6m8+DVO82JwGH88dkLXBvyrlkxCWZJtPWlS3s+os/2mGAX8M4hvIiCKGz3PAFmb
Qul3AGlxlSgi7eKuZGMU2OslgRVmMVOrNUgW4LfkDP/c8JjwgdDAuhebJOV2sAKi
qL8GlIk/ZsXbZ9qK2ogQ03dt3WxcikWcqbj4GX/d0191sPRx0XuRRXwhOetTUzR3
7PtcDSk6x94+ut4vpuheEaz4Mx8MiNV73pJzNqPQ5WLbA493PUJdEVPbQE2z+y5j
lPFRRYqNtTDAMKv5ZFCUSKs7gO52/jIgdn+RSJ29tJ2Di4IzmguTGv3Cwmq/yL7s
lhfoo2YM55AVkgeOfSsHXNGB89XQjolGb0S5j5fHCkmtvKt5zoWVTp8eoHgG7jih
l7h1AR1X
=7btg
-----END PGP SIGNATURE-----
Merge tag 'v7.2-rc4-smb3-server-fixes' of git://git.samba.org/ksmbd
Pull smb server fixes from Steve French:
"This contains eight ksmbd fixes covering POSIX ACL handling, SMB
signing enforcement, DACL parsing and construction hardening, session
lifetime handling, and validation of malformed transform and
compressed SMB2 requests:
- preserve inherited POSIX ACL mask when creating objects.
- enforce the session signing requirement for plaintext SMB requests.
- harden DACL/ACE processing against size overflows, incomplete ACE
copies, and undersized SIDs.
- defer teardown of a previous session until NTLM authentication
succeeds.
- reject undersized encryption-transform and decompressed SMB2
requests before they can reach normal SMB2 request processing"
* tag 'v7.2-rc4-smb3-server-fixes' of git://git.samba.org/ksmbd:
ksmbd: reject undersized decompressed SMB2 requests
ksmbd: validate minimum PDU size for transform requests
ksmbd: defer destroy_previous_session() until after NTLM authentication
ksmbd: validate ACE size against SID sub-authorities
ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL
ksmbd: bound DACL dedup walk to copied ACEs
ksmbd: enforce signing required by the session
ksmbd: preserve VFS inherited POSIX ACL mask
|
||
|
Linus Torvalds
|
ae453eef92 |
BPF fixes:
- Fix tcp_bpf_sendmsg() error path mistaking a concurrently-freed sk_psock->cork for the local temporary message and freeing it again. (Chengfeng Ye) - Reject passing scalar NULL to nonnull arg of a global subprog. Previously the verifier did not account for the cases directly passing scalars to a global subprog, e.g.: 'global_func(0);' would pass even if 'global_func' argument was marked nonnull. (Amery Hung) Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRINyQBqoQUC24dy5htleuBPyPTXgUCamPsBwAKCRBtleuBPyPT Xo/uAP0YR6/9em1W/sZnss6Wkwfwd9NdmmlrJqSlt7aq+A+W7AD/V5HbigM4pJ76 CZFkKvnzhhU3dSXm/dBT1/GGJbL4pwo= =uzKM -----END PGP SIGNATURE----- Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Pull bpf fixes from Eduard Zingerman: - Fix tcp_bpf_sendmsg() error path mistaking a concurrently-freed sk_psock->cork for the local temporary message and freeing it again (Chengfeng Ye) - Reject passing scalar NULL to nonnull arg of a global subprog. Previously the verifier did not account for the cases directly passing scalars to a global subprog, e.g.: 'global_func(0);' would pass even if 'global_func' argument was marked nonnull (Amery Hung) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() selftests/bpf: Test passing scalar NULL to nonnull global subprog bpf: Reject passing scalar NULL to nonnull arg of a global subprog |
||
|
Steven Rostedt
|
e091351b38 |
tracing: Delay module ref count for "enable_event" trigger
Triggers are now delayed from freeing, but can still be triggered until
after the RCU grace period has ended. The freeing of the enable_event data
is put into the private_data_free() callback, but the put of the module
refcount is done immediately.
It is possible that if a module is removed that has an event that would
enable (or disable) it is still active, it can read the data of the module
after it is removed causing a use-after-free bug.
Move the trace_event_put_ref() that releases the module into the delayed
callback so that the module can not be removed until any reference to its
events are finished.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260724132415.1b5005db@gandalf.local.home
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://sashiko.dev/#/patchset/20260724030523.19081-1-devnexen%40gmail.com
Fixes:
|
||
David Carlier
|
7909781215 |
tracing: Fix use-after-free freeing trigger private data
Commit |
||
Chengfeng Ye
|
2d66a03386 |
bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()
tcp_bpf_sendmsg() keeps msg_tx across sk_stream_wait_memory(), which
drops and reacquires the socket lock. Its error path tries to decide
whether msg_tx names the local temporary message by comparing it with
the current value of psock->cork.
This comparison is unsafe when two threads send on the same socket:
Thread A Thread B
msg_tx = psock->cork
sk_msg_alloc() fails
sk_stream_wait_memory()
releases the socket lock acquires the socket lock
completes the cork
psock->cork = NULL
frees the cork
reacquires the socket lock
msg_tx != psock->cork
sk_msg_free(msg_tx)
The stale cork is therefore mistaken for the local temporary message
and freed again. KASAN reported:
BUG: KASAN: slab-use-after-free in sk_msg_free+0x49/0x50
Read of size 4 at addr ffff88810c908800 by task poc/90
Call Trace:
sk_msg_free+0x49/0x50
tcp_bpf_sendmsg+0x14f5/0x1cc0
__sys_sendto+0x32c/0x3a0
__x64_sys_sendto+0xdb/0x1b0
Allocated by task 89:
__kasan_kmalloc+0x8f/0xa0
tcp_bpf_sendmsg+0x16b3/0x1cc0
Freed by task 91:
__kasan_slab_free+0x43/0x70
kfree+0x131/0x3c0
tcp_bpf_sendmsg+0xec3/0x1cc0
msg_tx can only name the stack-local tmp or the shared cork. Check for
tmp directly so a changed psock->cork cannot turn a shared message into
an apparent local one.
Fixes:
|
||
|
Linus Torvalds
|
e2a936998a |
drm fixes for 7.2-rc5
MAINTAINERS: - update address ttm: - backup pages using correct order gpusvm: - fix mm leak on eviction - properly zero page array in mm scanning tests: - fix dma mask errors in tests panel: - fix dependency issues - ilitek-ili9881c - fix probing i915: - Remove DP_EDP_BACKLIGHT_AUX_ENABLE_CAP check for DPCD backlight xe: - Skip invalidation for purgeable state updates - Add drm_dev guards when detaching CCS read / write buffers - Alloc per domain unique i2c id - Fix SVM leak on resv obj alloc failure in xe_vm_create amdgpu: - Fix a backport mistake for dm_gpureset_toggle_interrupts() - Fix a failure on flip-done timeouts for mode1 reset appletbdrm: - fix issue in damage handling amdxdna: - fix command timeout race imagination: - fix gpu vm locking vc4: - prevent trusted bo from being mapped again - prevent timer rearm on shutdown v3d: - fix NULL deref in unbind - idle AXI before clock disable on suspend - use proper GMP access for newer hw vmwgfx: - validate shader array size ethosu: - fix length calculations - handle internal chaining buffers gma500: - return errors from HDMI i2c reads -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmpj0ckACgkQDHTzWXnE hr7ExBAAo7QeJH9InKxqEv4Yt+JDcmGM4HhGhMoBkRp3YwgS0JDnUsTZeb2jGSbb XgbgfrYa1E8tUYSUUoMRQoHBQffuAXCovsaKxL0WOBaT5S/pIfKYsHyQLEMIFaLs /cTH0VZ49VVOrlNyiQp4tUwJTAalRhB4RS+hfDLQMsG2wHdK4jObmamdpNh71vsZ K7vPUvhRqyim2r9nVa6pv/LXpjRbtf+tq8cQF0ywW4eybB1zfdk+t8QQlAqkhoph FW6Wz8o6d/wFezOyFaItOfJyJS+RPeUIEwWnmqtUM1Qp26DpLmPlH9HPJMl7yjZm vrxuCH9B5RBE75PvJX3p9lVgh7ZENtVYboh+YhMSFjqKtirJf4Nm+XoUHwq2bycp q5Re9IRlfPacrKe33eetOREmw7nnAtg8mw4VTuZLuYM1MlwZqSRfxVvcBCy1QMOP FNcHg63uGogrRj4vdbmDyqmf0hsK1ZeBMH6OKdCe3ABjytFIZ0TxTseytvx7tug1 ymt0t8W/lFrdZipN8oF36k2VQGLs5k3qAvV90b7RaEL7zpbZHu3H7FNsACk2vOcv E5XpvsnVxlgbFUQMDrtV7YxyCrn4+ln9CrAI7St9fIAHNNS7BsmQWe06Co9Kjy+c 9/aOw4tsZ0GUaPodKQxvvQrTmExzqXMu5iYnm4JTXO2zuSAjFpk= =iIeO -----END PGP SIGNATURE----- Merge tag 'drm-fixes-2026-07-25' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Weekly drm pull request, small and scattered seems to be the new normal, the ttm change is probably the largest, with xe being the most. Alex was out this week so amdgpu is smaller and only has some urgent fixes. MAINTAINERS: - update mailmap address ttm: - backup pages using correct order gpusvm: - fix mm leak on eviction - properly zero page array in mm scanning tests: - fix dma mask errors in tests panel: - fix dependency issues - ilitek-ili9881c - fix probing i915: - Remove DP_EDP_BACKLIGHT_AUX_ENABLE_CAP check for DPCD backlight xe: - Skip invalidation for purgeable state updates - Add drm_dev guards when detaching CCS read / write buffers - Alloc per domain unique i2c id - Fix SVM leak on resv obj alloc failure in xe_vm_create amdgpu: - Fix a backport mistake for dm_gpureset_toggle_interrupts() - Fix a failure on flip-done timeouts for mode1 reset appletbdrm: - fix issue in damage handling amdxdna: - fix command timeout race imagination: - fix gpu vm locking vc4: - prevent trusted bo from being mapped again - prevent timer rearm on shutdown v3d: - fix NULL deref in unbind - idle AXI before clock disable on suspend - use proper GMP access for newer hw vmwgfx: - validate shader array size ethosu: - fix length calculations - handle internal chaining buffers gma500: - return errors from HDMI i2c reads" * tag 'drm-fixes-2026-07-25' of https://gitlab.freedesktop.org/drm/kernel: (31 commits) drm/amd/display: Fix missing DCE check in dm_gpureset_toggle_interrupts() drm/amd/display: Fix flip-done timeouts on mode1 reset Revert "drm/pagemap: Guard HPAGE_PMD_ORDER use with CONFIG_ARCH_ENABLE_THP_MIGRATION" drm/vc4: Shut down BO cache timer before teardown drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem drm/xe/vm: Fix SVM leak on resv obj alloc failure in xe_vm_create() drm/xe/i2c: Allow per domain unique id drm/gma500: return errors from Oaktrail HDMI I2C reads drm/vc4: hvs/v3d: Fix null dereference in unbind drm/panel: fix unmet dependency bug for DRM_PANEL_HIMAX_HX83121A drm/panel: s6e3ha8: fix unmet dependency on DRM_DISPLAY_HELPER drm/panel: ilitek-ili9882t: fix unmet dependency for DRM_PANEL_ILITEK_ILI9882T drm/panel: ilitek-ili9881c: do not fail probe if iovcc is absent drm/v3d: Idle AXI transactions before disabling the clock on suspend drm/v3d: Reach the GMP through the hub registers on V3D 7.x mailmap: Update Maíra Canal's email address drm/pagemap: Guard HPAGE_PMD_ORDER use with CONFIG_ARCH_ENABLE_THP_MIGRATION drm/pagemap: Clear driver-provided PFNs from migration PFN array drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers accel: ethosu: Handle U85 internal chaining buffer ... |
||
|
Linus Torvalds
|
dad0a87d79 |
A bunch of assorted fixes with the majority being hardening against
malformed input and invalid data scenarios that don't happen in real deployments but can be utilized to trigger use-after-free and similar issues, some error path leak fixups and two patches from Max to avoid a potential hang in __ceph_get_caps() and unintended nesting of current->journal_info while handling replies from the MDS. All marked for stable. -----BEGIN PGP SIGNATURE----- iQFHBAABCgAxFiEEydHwtzie9C7TfviiSn/eOAIR84sFAmpjx6wTHGlkcnlvbW92 QGdtYWlsLmNvbQAKCRBKf944AhHzixDmB/4/J+dqhhDKg69t0ADnAPLgxe3AoXwi 7GRd2Uk5/AU9o+1fexyfWt2u+3ZtAVGLVRZPF1ARFQQDGUoj99X06NlTyVAFRNMb p78Sun5iuiDJb72UOD3WzW9lmpjSeCVUbTuTadtmF4y34KIvZ7AYltjZBpycE2Yj lyiUr4CSkXMAa/wWDKg+8SAw2tBI61WdyJeyu8ESCUmm9Q2XLq1+2N/jhfifk0oC Dc7EHUZmg7YNbTr0DKyLXdAoZHE54zKC2qDrvfTPmpTsOhMI2v5LY6JtXzm8/l6c wAGgIj5hRePGDDPb1V5Mbz3rkY/VIGdKmkqEV4PZn+IHafZGp45lnS7V =q2wM -----END PGP SIGNATURE----- Merge tag 'ceph-for-7.2-rc5' of https://github.com/ceph/ceph-client Pull ceph fixes from Ilya Dryomov: "A bunch of assorted fixes with the majority being hardening against malformed input and invalid data scenarios that don't happen in real deployments but can be utilized to trigger use-after-free and similar issues, some error path leak fixups and two patches from Max to avoid a potential hang in __ceph_get_caps() and unintended nesting of current->journal_info while handling replies from the MDS. All marked for stable" * tag 'ceph-for-7.2-rc5' of https://github.com/ceph/ceph-client: ceph: avoid fs reclaim while using current->journal_info ceph: add owner/capability checks for CEPH_IOC_SET_LAYOUT* ceph: fix hanging __ceph_get_caps() with stale mds_wanted rbd: Reset positive result codes to zero in object map update path libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE libceph: refresh auth->authorizer_buf{,_len} after authorizer update ceph: fix refcount leak in ceph_readdir() libceph: guard missing CRUSH type name lookup libceph: remove debugfs files before client teardown libceph: bound get_version reply decode to front len ceph: fix writeback_count leak in write_folio_nounlock() libceph: fix two unsafe bare decodes in decode_lockers() ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() libceph: Reject monmaps advertising zero monitors libceph: reject zero bucket types in crush_decode libceph: Fix multiplication overflow in decode_new_up_state_weight() |
||
|
Linus Torvalds
|
981f4a2baa |
fscrypt fixes for v7.2-rc5
A couple fixes for AI-detected bugs. -----BEGIN PGP SIGNATURE----- iIkEABYIADIWIQSacvsUNc7UX4ntmEPzXCl4vpKOKwUCamPDWBQcZWJpZ2dlcnNA a2VybmVsLm9yZwAKCRDzXCl4vpKOK4C8APjY2sD4jMa1oX05SiLL7iUulkTXivOb n14nFabjqF25AP9MZImv0oS5eQWt/QPLHfNlB6olRd9Q0GqVOYYdKQ/6DA== =pStx -----END PGP SIGNATURE----- Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux Pull fscrypt fixes from Eric Biggers: "A couple fixes for AI-detected bugs" * tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux: fscrypt: Avoid dynamic allocation in fscrypt_get_devices() fscrypt: Add missing superblock check in find_or_insert_direct_key() |
||
Dave Airlie
|
6c33542c01 |
amd-drm-fixes-v7.2-2026-07-04:
- Fix a backport mistake for dm_gpureset_toggle_interrupts() - Fix a failure on flip-done timeouts for mode1 reset -----BEGIN PGP SIGNATURE----- iQJHBAABCgAxFiEECwtuSU6dXvs5GA2aLRkspiR3AnYFAmpjgMsTHHN1cGVybTFA a2VybmVsLm9yZwAKCRAtGSymJHcCdpwoD/wPLCIUF9TLUuzBRBJYCA9lCBUerB7u XUvjfjhWgp2Vd4aWRSHW5TD1ZLwXhLNsA4nzLAo7G7/Tqy+1Z9ZnyqUSgP3DeZLf KQHLvP/14no1PxLHOEIlqFffKWSkfqkboQar/5eWtZPkPa7F9EIRl5gXqZ75uxVg 9y7GSPHX2971J7ekTlnT6TbwK3Avl+GmPLKYAL+2hJVQZHMrYqtJNwz812+S9x7u HsXpAK3d2YxY1hg5NdMfYdEiAQyRxJCd/JXGqPHMDRoxD8J36b1Oq8KaimdbTpZa qwiQeHFAVjsHYTBu9GRghuLWJpKGlOhZlr+62XwdOYBYdveAB5nPeEkY4NKNIab+ Aqbjb6GshKMNAn8vpX2l6e5y9TAXIaZlbDYbQuJWR9zEcmrdIKElxpzMFeCZnRFm fxWtEn8ao6/WB0hKgLIR1vkrSAe8YoNjZCPdKCSKDPx9yI37I5LeloeZ2+uaJQIs cKh3vK9/0kp9w1Yhkz+MD6qZIlhV0NWuRzkEtjY96O7ND4x6pFPovxYrqfSS4GpG VjKCZjMaXNqZhh+kRrGD4p/f6T4P4XHyi5tIbflMhnkNWYYRik9foMx0Zef88yeR pLMIfcOezOI2rjeNE6JP/a8MrPMkarMezMLlpPKlgSIn9QHwCdqwqmv4E5CLJ6u0 17Z4CYGLipWIKA== =xo0b -----END PGP SIGNATURE----- Merge tag 'amd-drm-fixes-v7.2-2026-07-24' of git://git.kernel.org/pub/scm/linux/kernel/git/superm1/linux into drm-fixes amd-drm-fixes-v7.2-2026-07-04: - Fix a backport mistake for dm_gpureset_toggle_interrupts() - Fix a failure on flip-done timeouts for mode1 reset Signed-off-by: Dave Airlie <airlied@redhat.com> From: Mario Limonciello <superm1@kernel.org> Link: https://patch.msgid.link/5d5964a3-fb85-4a3c-9252-a43c93fe935d@kernel.org |
||
|
Linus Torvalds
|
0c452fbdf4 |
arm64 fixes for -rc5
- Fix early_ioremap() of unaligned ACPI tables - Remove bogus information from data abort diagnostics - Fix kprobes recursion during single-step - Fix incorrect constant in ESR address size fault macro - Fix OOB page-table walk in memory hot-unplug notifier - Fix OOB access to the linear map when retrieving an unaligned huge pte - Fix MPAM register reset values - Fix MPAM NULL dereference on teardown -----BEGIN PGP SIGNATURE----- iQFEBAABCgAuFiEEPxTL6PPUbjXGY88ct6xw3ITBYzQFAmpjYKMQHHdpbGxAa2Vy bmVsLm9yZwAKCRC3rHDchMFjNDMIB/9MTWfjEY3QYefcaP3yIRqN4IVY1CORewCi yGE/BKq4WH86mCKp7k+OojyXYV5WP7YZOVZcEYIuSCyJ5KrRmbJ6ezFgQaDP+C4y 18ZSMSks9LKVkV0gZNiAkdr2NtKPX4uI/iqFskKWUIRoRBHXjijc5J6R71BPiQYV r3Uwtw4TQPd8YV/L5j71OyK/PhgSQyfdXClo0iW3b4WK0xoZJUcrIQIVEZduKL6J IPlzarT46sZKvyb8MZkOWiURVRE8JWMDn1LY9QP02OMyJeWyO9q3TlQ4dC/FNpb9 tUMfomyteXr7TIxU3ueTRs+wng7zQJtWpiFtpwFlzFaZcXVrH0xU =M9Lk -----END PGP SIGNATURE----- Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "It's a bit all over the place, as I was hoping to fix a decade-old bug in our seccomp handling on syscall entry and ended up collecting other fixes in the meantime. You'll see the failed attempt (+revert) here but I didn't want to hold off on the others any longer. Hopefully we'll get that one squashed next week... - Fix early_ioremap() of unaligned ACPI tables - Remove bogus information from data abort diagnostics - Fix kprobes recursion during single-step - Fix incorrect constant in ESR address size fault macro - Fix OOB page-table walk in memory hot-unplug notifier - Fix OOB access to the linear map when retrieving an unaligned huge pte - Fix MPAM register reset values - Fix MPAM NULL dereference on teardown" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: make huge_ptep_get handled unaligned addresses arm64/mm: Check the requested PFN range during memory removal arm64: Correct value returned by ESR_ELx_FSC_ADDRSZ_nL() arm64: kprobes: Allow reentering kprobes while single-stepping arm64: kprobes: Only handle faults originating from XOL slot drivers/virt: pkvm: Fix end calculation in mmio_guard_ioremap_hook() Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" arm64: mm: When logging data aborts only decode Xs when ISV=1 arm64: fixmap: Allow 256K early_ioremap() at any offset arm_mpam: guard MBWU state before adding it to garbage arm_mpam: Fix MPAMCFG_MBW_PBM register setting arm_mpam: Fix software reset values of MPAMCFG_PRI arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates |
||
|
Linus Torvalds
|
a93212b3d1 |
IOMMU Fixes for Linux v7.2-rc5
- AMD: * Fix lockdep splat from nested domain allocation * Fix nested domain leak * Fix broken synchronisation of command completion * Fix OOB write in "ivrs_acpihid" command-line parsing - VT-d: * Prevent SVA for IOMMUs with non-coherent page-table walker * Fix OOB write in PMU driver. -----BEGIN PGP SIGNATURE----- iQFEBAABCgAuFiEEPxTL6PPUbjXGY88ct6xw3ITBYzQFAmpjXsoQHHdpbGxAa2Vy bmVsLm9yZwAKCRC3rHDchMFjNGzbB/9xlcRZhOY0aTlqbKglyjyOmqtnJrtNOyUp 6+gTqiUBcWp9fOXQxA/n+Ne0wYgyYJNgmI0K1Upn0u2ffbnbiT9TLNKEl6fJMW0s 3g5VNIsqP06SmPVt18eCuLspEP2+JPHvFw7kQY+IAF5odfyXZ4eZ4duk9PPLI5Ov ggk4+ePMhFn1pYdK+3MOMqZ/lqc1Q3gWWwvuLnV/FrmQ4dwmh3nE328cbn2yYSBl t5e0k+89qBq8ktCO5DbxJQStno757FMmCQ58qcYhpI5oMIbfXl4TYSEsXut88g0e jT//iXgyQywLYvbnoCZ5BF5dNI9IZwYolkgwZYaAbM+MN3sZSSwu =nAFJ -----END PGP SIGNATURE----- Merge tag 'iommu-fixes-v7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux Pull iommu fixes from Will Deacon: "Joerg's away at the moment so I've been looking after the IOMMU tree in his absence. In the process of doing that, I've hoovered up a handful of fixes for the AMD and Intel drivers which address a combination of the usual out-of-bounds/locking/leak bugs as well as some logical issues around SVA and command completion. AMD: - Fix lockdep splat from nested domain allocation - Fix nested domain leak - Fix broken synchronisation of command completion - Fix OOB write in "ivrs_acpihid" command-line parsing VT-d: - Prevent SVA for IOMMUs with non-coherent page-table walker - Fix OOB write in PMU driver" * tag 'iommu-fixes-v7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() iommu/amd: Bound the early ACPI HID map iommu/vt-d: Disallow SVA if page walk is not coherent iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() iommu/amd: Fix nested domain leak iommu/amd: Fix IRQ unsafe locking in gdom allocation |