mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-11-10 20:48:12 +00:00
1,484,755 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Linus Torvalds
|
b732c98215 |
7 hotfixes. 4 are cc:stable.
- Update .mailmap entries for Andy Yan and John Garry. - Fix read-only MAP_SHARED /dev/zero mappings so they retain shared-file semantics instead of being treated as anonymous memory, also avoiding a CONFIG_DEBUG_VM assertion. - Fix 32-bit build warnings in the hugetlb-mmap selftest caused by using the wrong printf format for size_t values. - Fix a boot-time crash when early function tracing causes CPA to free kernel page tables before the workqueues used for deferred freeing are available. - Fix two MREMAP_DONTUNMAP locked_vm accounting leaks: one caused by an mlock-on-fault VMA self-merging, and one caused by partially remapping a locked VMA. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCascg4wAKCRDdBJ7gKXxA jjLCAP4ygLUaOZmgJVAmD8loFAa/AB0CE1V+LZwBUyzqCogY6wD/Sp+JbhE+mZDS vjp7soYnDoqv7Gi872WTUx2rnjaLxAg= =qjI7 -----END PGP SIGNATURE----- Merge tag 'mm-hotfixes-stable-2026-10-07-21-48' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull MM fixes from Andrew Morton: - Update .mailmap entries for Andy Yan and John Garry - Fix read-only MAP_SHARED /dev/zero mappings so they retain shared-file semantics instead of being treated as anonymous memory, also avoiding a CONFIG_DEBUG_VM assertion - Fix 32-bit build warnings in the hugetlb-mmap selftest caused by using the wrong printf format for size_t values - Fix a boot-time crash when early function tracing causes CPA to free kernel page tables before the workqueues used for deferred freeing are available - Fix two MREMAP_DONTUNMAP locked_vm accounting leaks: one caused by an mlock-on-fault VMA self-merging, and one caused by partially remapping a locked VMA * tag 'mm-hotfixes-stable-2026-10-07-21-48' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mailmap: update entry for Andy Yan drivers/char/mem: mmap readonly MAP_SHARED-/dev/zero correctly selftests/mm: cleanup -Wformat issues in hugetlb-mmap mm: don't schedule deferred kernel page table freeing while booting mailmap: update addresses for John Garry mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge |
||
|
Linus Torvalds
|
0c2669a9f4 |
soc: fixes for 7.3, part 2
There are fixes in three ares this time:
- Four distinct issues in TEE firmware, all fairly minor
- Five devicetree mistakes on NXP i.MX8, lx2160a and Qualcomm
based machines, one of these may cause file system corruption
from an incorrect SD card supply voltage
- Five fixes for clk drivers on new Qualcomm platforms,
addressing issues with incorrect enable states
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmrBd1cACgkQmmx57+YA
GNlYxBAAhJs6mulHyhGSKOHYbvPHHHsCPFcWT6gLZRRy4lA50GwzptT8SAk6TmlS
C6wm81nVG27hdju5TMiExDUfjiTFd3sxpT8xDP1DVNAgZD6+s2LyFrFbAqRs0zxS
SoaZgzsu7q2pD4wBQpQgOM38YODl05CdzwY4YZqiFoomYHSQzI4xlTVGY6/fcJcm
79fRV63LUznRVtsy+ETMg9TdBcJjPY6huuH/C8JifXvl4Q6P99FGXvZp2rpiFqU0
Y3GXA58XtDqUyrwjbUXFrosmqAqsEU5x+iCA1EV2Y1P460rG4jyhXFAYHimJl9UH
Pnfq5Sb2r+JeK1li4HgHX8g3wDr6KUO/biuInNCUAUEFxQ6W7l+NRZTgjisB9m2W
O6Ju0WMXLMvDsm4OMxYyepxcV3fmxzYMvzs36EmJo67OAhETrTCRmU1M8l5N2s50
84wlGoGdLXYoYCKOzLKZBj77Y1zjoYcxBEDx5PLZR2kMWjxtW+zLkKK1NME39691
nDU+NfMAxbMl+28NCtP91ceaVvb+8Zf9vGDcf7RBz6fTZpwUtW9Z9L7x8MVl873a
88oZNHQrGXO+J6VcwskOIhlR5bDCPfpRQm2y2Y+wY6iz/Ie4Jh5n7J8prpzabs43
AuoGpNqHAVrkfklsr66cDzT43XX1KK59+QQwJiOXe5sDetk5m64=
=Mq24
-----END PGP SIGNATURE-----
Merge tag 'soc-fixes-7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
Pull SoC fixes from Arnd Bergmann:
- Four distinct issues in TEE firmware, all fairly minor
- Five devicetree mistakes on NXP i.MX8, lx2160a and Qualcomm
based machines, one of these may cause file system corruption
from an incorrect SD card supply voltage
- Five fixes for clk drivers on new Qualcomm platforms,
addressing issues with incorrect enable states
* tag 'soc-fixes-7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:
MAINTAINERS: update my email address
tee: optee: ffa: support shared memory offsets on large-page kernels
optee: register TEE devices only once fully initialized
tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()
arm64: dts: imx8mp-var-dart-sonata: Fix Sonata SD I/O supply
arm64: dts: lx2160a: fix the iic5 spi3 pinmux offset and value
arm64: dts: lx2160a: fix IIC1 pinmux submask rejected by pinctrl-single
arm64: dts: lx2160a: fix incorrect pinmux
clk: qcom: gpucc-kaanapali: Mark the GPU CX GDSC as votable
clk: qcom: gpucc-glymur: Mark the GPU CX GDSC as votable
clk: qcom: gcc-kaanapali: Fix always-enabling PCIE_RSCC clocks
clk: qcom: gcc-hawi: Fix always-enabling PCIE_RSCC clocks
clk: qcom: gcc-eliza: Fix always-enabling PCIE_RSCC clocks
arm64: dts: qcom: x1-denali: Fix microphone distortion
tee: qcomtee: fix kernel-doc warnings
|
||
|
Linus Torvalds
|
8fc6e59488 |
usb: mtu3: Fix a double-dereference splat in TP_printk
This splat is reporting a double-dereference that can result in garbage traces being dumped due to the possibility of the TP_printk() being executed without the benefit of main memory being present. The fix is to move the extra dereference from TP_printk() time to TP_fast_assign() time. -----BEGIN PGP SIGNATURE----- iQJHBAABCgAxFiEEbK7UrM+RBIrCoViJnr8S83LZ+4wFAmrFPjETHHBhdWxtY2tA a2VybmVsLm9yZwAKCRCevxLzctn7jFa3D/4yDuCA4eVlyw8Ldqh0bCjbZCPAz421 TUXA+KU7jQaUy3mVWNyLDpFdOe6cChXskdxnEpzwXeze+05bK1nbu0jEXACU2edO xhbbS20KirhgZcZvS4XdgF2d7RFiHG79ajbsLwy2e1JlO3EtCklVfISLcjB4Xi9S wASHI6loJ4ev6YD6InFsPQVgN19m9SuuVGQRPgtHnzuPrlWxv6KuQg2DMwiJyLI1 13/bOSiLNwVlHynMvtmv/o7Qi1XszhIjG7qotdc8TJPjcjL0grP6qSOr7/QrZxfQ nUsdyVJ+WDarAArQ/Femk4IDRiqYMnLFxN65Ol1CGUlpTkQluU8deqgj5qvEQFVX SopYFDqj4fL7prdfhtOML3DCXtJZ6BAWAA24HUCL7zJ2+pYT57USk6OiSNsIUS8Y khCsW+1pzEInb8PRI7h9dvUu6jRn407PTytKZ4GNt6PnLzDWb8wvRpy+Jjzsr6LS NLyjkNlAVYMBItsfg+Y/9Lt6uqhpioz42+/3J5bsxTqksM4BNSRSZ+paJs/fNgFk drMxMuo5gsI8zQsKaVL6QlIKEChJPKzRzEIOJYKUDx3uhpwbtHO2551KGlQZIRNL ZbXZEDfgAHfGJ3ho3QZ/AyLzFiB+WUbT5+gw6mYNzjiUFObMlgU6p6Z/rS/eMNPi 1qR4UHl0fRvu1Q== =MAuw -----END PGP SIGNATURE----- Merge tag 'usb-mtu3.2026.10.06a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull tracing fix from Paul McKenney: "Fix a double-dereference splat in TP_printk in usb mtu3. This was a pre-existing bug that can corrupt tracing output, but which was exposed this cycle by additional checking that was added to the tracing subsystem. This splat is reporting a double-dereference that can result in garbage traces being dumped due to the possibility of the TP_printk() being executed without the benefit of main memory being present. The fix is to move the extra dereference from TP_printk() time to TP_fast_assign() time" * tag 'usb-mtu3.2026.10.06a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: usb: mtu3: Fix double dereference in TP_printk |
||
|
Linus Torvalds
|
4cc6bbaeb3 |
srcu: Fix spurious WARN_ON() for rcu_segcblist_n_cbs() in cleanup_srcu_struct()
This issue was introduced during the recent merge window: |
||
|
Linus Torvalds
|
7b63ef2d55 |
for-7.3-rc6-tag
-----BEGIN PGP SIGNATURE----- iQJPBAABCgA5FiEE8rQSAMVO+zA4DBdWxWXV+ddtWDsFAmrGSIUbFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMiwyAAoJEMVl1fnXbVg7eQEP/0T5xO7uJw7S42kKi4w+ J/XP482GUb5xv0BmwOlITl5dGQHAHWKtq7zXflA+pNSoPPWUq+eTfKw1r/yYHGtu S1kHei3K3l9qWpeIOJYTdpcVayFRdn+ZZuMwvb5uojT7VbtV2UB01LQfMWM8mcaY PukCIMX+PiM8ue9l2iQZ5EXzFoaJzKpvyZP0T7ar+IIRsfE3n0qMmZeGiYKuCJOF A9N2IWNU/UIUtHpZGHZYwVzGuFdDH3Dc5b0ZzQUlL/dUvZ6345bX6NCXLceU+II1 SjlQwEKLpfY0IxfwnR3cLkAu+YE5ER6VfHCzcvVV1mZFVOQwF6+UuMTrZ3AdO6tX RFHnhVUVZSvULCRJlpsV5LIALDow/vSAif7n02oh3j2pou50UQVLI1q5olZhPOLS rpYSF7HIpj2R/1MStDko9FTp78atG+0g6DlZDsz1Dys3l0gaKx+WJ/tzh60cvPj8 aM2zck1Dw/9wsg8KMXLqlllFQRoCavmngmttONxqXYlRwz8h9CSf4uLPZzgSzORm /MR0Cb+o5W3c1LJgjRsdXa/j0NTdKGmGqbWRN+Hnwi3ZbR3GC5+HL7mGpH28TqHU /X93+/pDoGR11E8VMMgRkTDJwfuDPheKno98lwkhpC9x6znXwuhh43/6iT/gYA9k cbklJF1ok+18QTQLPTTSyIYf =Mk4y -----END PGP SIGNATURE----- Merge tag 'for-7.3-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - fix command queuing and cleanup in encoded read/write ioctls - fix root and transaction association to avoid unnecessary lock contention and transaction start - properly handle replacing multiple xattrs in the same item - in scrub, fix root reference leak after reporting an unresolved file path * tag 'for-7.3-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: fix lost error return value in btrfs_listxattr() btrfs: fix xattr replace when multiple xattrs are packed in the same item btrfs: don't stash io_uring encoded data across -EAGAIN btrfs: unlock inode and extent in caller when io_uring read extent fails btrfs: free iov when btrfs_uring_read_extent() fails btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode() btrfs: clear BTRFS_ROOT_IN_TRANS_SETUP on early exit from record_root_in_trans() |
||
|
Linus Torvalds
|
0f2732620d |
- dm-integrity:
- validate the superblock after re-reading it
- fix buffer overflow if tag size > 64
- dm:
- fix reading up to 7 bytes beyond the end of block in dm-ioctl
- fix reading free memory if the ioctls are called concurrently
- dm-crypt:
- fix a crash on invalid table line
- dm-snap:
- fix a crash on invalid table line
-----BEGIN PGP SIGNATURE-----
iIoEABYKADIWIQRnH8MwLyZDhyYfesYTAyx9YGnhbQUCasYIiRQcbXBhdG9ja2FA
cmVkaGF0LmNvbQAKCRATAyx9YGnhbZsMAQCkQZOhRxNpWdCK1+vOK8TLA8Xvv0Ay
vTsPiZ0BtZbS9gEA4Pv3pKaMxYH061Uw2YPhxw/5LOT+GBUYoHwMA5xeGAQ=
=1Uzr
-----END PGP SIGNATURE-----
Merge tag 'for-7.3/dm-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm
Pull device mapper fixes from Mikulas Patocka:
"dm-integrity:
- validate the superblock after re-reading it
- fix buffer overflow if tag size > 64
dm:
- fix reading up to 7 bytes beyond the end of block in dm-ioctl
- fix reading free memory if the ioctls are called concurrently
dm-crypt:
- fix a crash on invalid table line
dm-snap:
- fix a crash on invalid table line"
* tag 'for-7.3/dm-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
dm-integrity: validate the superblock on resume
dm-snap: reject the transient exception store for snapshot-merge
dm: fix reading free memory in do_resume
dm ioctl: don't let data_start run past the buffer
dm-crypt: reject the lmk IV mode with AEAD ciphers
dm-integrity: fix buffer overflow in inline mode with large tag size
|
||
|
Linus Torvalds
|
602042bf29 |
workqueue: Fixes for v7.3-rc6
- Fix a NULL dereference in the chained work check when a kworker queues work on a draining or destroying workqueue outside work item execution. -----BEGIN PGP SIGNATURE----- iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCasUtqA4cdGpAa2VybmVs Lm9yZwAKCRCxYfJx3gVYGWk6AP4ih99Tbz+JiBcsIMAB2l6CVmuIzkZ6J1o2V0nh vR5JoQD/UKxcEb/Zu7e+RmdoCa9+nb4E+O+Qt60OncIG5npwxgQ= =TTbp -----END PGP SIGNATURE----- Merge tag 'wq-for-7.3-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue fixes from Tejun Heo: - Fix a NULL dereference in the chained work check when a kworker queues work on a draining or destroying workqueue outside work item execution. * tag 'wq-for-7.3-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: Fix NULL current_pwq deref in chained work check |
||
|
Linus Torvalds
|
0d32b3ec5f |
cgroup: Fixes for v7.3-rc6
- During CPU offline, the active mask drops the CPU before cpuset updates the effective CPUs, so a task placement in that window could find no active CPU in the top cpuset and dereference NULL. Restore the NULL check. - The cpuset v2-mode test read the subsystem's root pointer, which is stale during a cgroup filesystem rebind, and the hotplug handler evaluated it before taking the cpuset mutex. Record the mode in a flag and test it under the mutex. -----BEGIN PGP SIGNATURE----- iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCasUtqA4cdGpAa2VybmVs Lm9yZwAKCRCxYfJx3gVYGf+HAP9wEWWAp5XQUuDFaWg6Ft8iPw4Tm+b1d2w4c5il j+EGQgD/ce2FLEIu2642xuvQB4XaScJMT7G+3XZplgBsT4/jrA4= =Qa2B -----END PGP SIGNATURE----- Merge tag 'cgroup-for-7.3-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fixes from Tejun Heo: - During CPU offline, the active mask drops the CPU before cpuset updates the effective CPUs, so a task placement in that window could find no active CPU in the top cpuset and dereference NULL. Restore the NULL check. - The cpuset v2-mode test read the subsystem's root pointer, which is stale during a cgroup filesystem rebind, and the hotplug handler evaluated it before taking the cpuset mutex. Record the mode in a flag and test it under the mutex. * tag 'cgroup-for-7.3-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup/cpuset: Call is_in_v2_mode() after acquiring cpuset_mutex in cpuset_handle_hotplug() cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus() cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode() |
||
|
Linus Torvalds
|
762122d75e |
sched_ext: Fixes for v7.3-rc6
- Taking a CPU offline could hang, or stall until the watchdog ejected the BPF scheduler, when tasks on the dying CPU were still held by the scheduler or sitting on a user dispatch queue. Re-enqueue them onto the local queue when the runqueue goes offline so that the CPU pushes them off like the other sched classes. - The sequence number guarding against stale dispatches was per runqueue, so a task re-enqueued on another CPU could get the same number and a dispatch meant for its earlier instance was applied to the new one. Use a per-task counter. - A task dispatched to another CPU's local queue got its ops.dequeue() only when picked to run and flagged as a core-sched pick. Call it at insertion like for same-CPU dispatches. -----BEGIN PGP SIGNATURE----- iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCasUtpQ4cdGpAa2VybmVs Lm9yZwAKCRCxYfJx3gVYGSu5AQDwrICXDyQlGjzAXzFq+bEKVhtMkHxuk8hm5tAy za4AwwD9FjhJHRy5x89TAmea5Cj++AToL6npdEHv7KDcgqNxsAU= =/aDw -----END PGP SIGNATURE----- Merge tag 'sched_ext-for-7.3-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext fixes from Tejun Heo: - Taking a CPU offline could hang, or stall until the watchdog ejected the BPF scheduler, when tasks on the dying CPU were still held by the scheduler or sitting on a user dispatch queue. Re-enqueue them onto the local queue when the runqueue goes offline so that the CPU pushes them off like the other sched classes. - The sequence number guarding against stale dispatches was per runqueue, so a task re-enqueued on another CPU could get the same number and a dispatch meant for its earlier instance was applied to the new one. Use a per-task counter. - A task dispatched to another CPU's local queue got its ops.dequeue() only when picked to run and flagged as a core-sched pick. Call it at insertion like for same-CPU dispatches. * tag 'sched_ext-for-7.3-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: sched_ext: Generate qseq from a per-task counter selftests/sched_ext: Add a test for ops.dequeue() on remote local DSQ moves sched_ext: Call ops.dequeue() when a task arrives on a remote local DSQ sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler |
||
Andy Yan
|
80ce291041 |
mailmap: update entry for Andy Yan
I will use andyshrk@163.com for future review and discussion. Link: https://lore.kernel.org/20260924105052.768760-1-andyshrk@163.com Signed-off-by: Andy Yan <andyshrk@163.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com> Cc: Alexander Sverdlin <alex@sverdlin.org> Cc: Chuck Lever <cel@kernel.org> Cc: Jakub Kicinski <kuba@kernel.org> Cc: Martin Kepplinger <martink@posteo.de> |
||
Lorenzo Stoakes (ARM)
|
d3ed3a4095 |
drivers/char/mem: mmap readonly MAP_SHARED-/dev/zero correctly
Rather surprisingly, opening /dev/zero read-only then mmap()'ing it MAP_SHARED gets you true anonymous memory (albeit in a VMA with non-NULL vma->vm_file). This is a by-product of MAP_PRIVATE-/dev/zero being how anonymous memory was mapped in Linux's distant past. It happens because mmap_zero_prepare() gates on VMA_SHARED_BIT and when mapping a read-only file MAP_SHARED, do_mmap() clears VMA_SHARED_BIT and VMA_MAYWRITE_BIT. The gating is incorrect - the (poorly named) VMA_MAYSHARE_BIT flag exists explicitly to tell you if something was originally mapped MAP_SHARED. So the fix is simple - gate on this instead. This isn't exactly a common use case, but it's unexpected behaviour which now causes an assert if CONFIG_DEBUG_VM is set. While this bug has existed since the dawn of time for linux (or at least since 2.6.12), it hasn't caused issues in the past, so while it's incorrect behaviour, it doesn't seem necessary to backport that far. The mapping is now accounted at mmap time and can fail with -ENOMEM under strict overcommit, and read faults allocate folios. However this is normal behaviour for a read-only shmem mapping. Commit |
||
Carlos Llamas
|
28eed9906e |
selftests/mm: cleanup -Wformat issues in hugetlb-mmap
Commit |
||
Mikhail Gavrilov
|
2fb552b0be |
mm: don't schedule deferred kernel page table freeing while booting
Booting with a boot-time function tracer and a filter, for example ftrace=function ftrace_filter=pud_free_pmd_page panics on 7.3-rc4 as soon as the tracer starts: [ 23.531178] Starting tracer 'function' [ 23.675800] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000038: 0000 [#1] SMP KASAN NOPTI [ 23.819917] KASAN: null-ptr-deref in range [0x00000000000001c0-0x00000000000001c7] [ 23.964025] CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 7.3.0-rc4-fe2ec83746e5-with-fixes-v2+ #195 PREEMPT(undef) [ 24.252248] RIP: 0010:__queue_work+0xab/0xf00 [ 25.981629] Call Trace: [ 26.125727] <TASK> [ 26.413912] ? pagetable_free_kernel+0x20/0x120 [ 26.990283] queue_work_on+0x97/0xf0 [ 27.134382] __cpa_collapse_large_pages+0x501/0x6f0 [ 27.566662] cpa_flush+0x394/0x620 [ 27.998953] change_page_attr_set_clr+0x321/0x4a0 [ 29.151729] set_memory_rox+0xa2/0xf0 [ 29.584018] create_trampoline+0x431/0x6f0 ... [ 44.343347] Kernel panic - not syncing: Attempted to kill the idle task! The boot-time tracer is started from early_trace_init(), which runs before workqueue_init_early(). Making its trampoline read-only splits a large page, and CPA collapses it again right away. The split table has been a kernel page table since commit |
||
John Garry
|
29e0dd1f2e |
mailmap: update addresses for John Garry
Point any employment addresses at my personal dev address. Link: https://lore.kernel.org/20260923075324.1382927-1-john.garry@linux.dev Signed-off-by: John Garry <john.garry@linux.dev> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
Lorenzo Stoakes (ARM)
|
597e4b9ab4 |
mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP
The MREMAP_DONTUNMAP feature is highly unusual in that it permits mremap()
operations that keep the original VMA in place.
Historically this has led to a lot of bugs where non-obvious interactions
occur between existing mremap() operations and the original VMA.
Fix another of these - partial copies.
The long-standing mremap() partial VMA logic has the baked-in assumption
that the originating VMA is unmapped and thus moved.
However MREMAP_DONTUNMAP defeats this by performing a partial copy
instead since it keeps the source VMA around.
An mremap(..., MREMAP_DONTUNMAP) operation disallows resizing of the VMA,
but the operation can be performed partially:
|-----------------|
| |
| v
<------> <------>
.new_sz. new_sz
|--.------.--| |------|
| .source. | | dest |
|--.------.--| |------|
<------------>
old_sz
The page tables in the specified range are moved, but the original VMA is
kept intact.
This interacts poorly with mlock()'d VMAs, as the VMA_LOCKED_BIT flag is
cleared for the entire source VMA and set for the entire destination VMA.
This results in an mm->locked_vm leak as the change is therefore not
accounted correctly.
The clear solution here is to make the portion of the source VMA which is
mremap()'d distinct from the rest of it, a.k.a. split it.
Therefore resolve this issue by splitting it ahead of the rest of the
mremap() operation if the VMA is mlock()'d.
This is valid, as the source VMA will lose its VMA_LOCKED_BIT flag, so if a
partial remap it will become distinct from the rest of the VMA.
In order to make this change re-expose split_vma() in vma.h for
CONFIG_MMU (nommu doesn't compile mremap.c and uses a static helper
instead).
Finally, update the sys_map_count check to account for this case.
Note that the early check does not use needs_pre_split() - this is because
the VMA has not been looked up by this point, so be conservative and assume
that the VMA is mlock()'d in this case for the purposes of the
sys_map_count check.
Link: https://lore.kernel.org/20260930-fix-dontunmap-partial-self-merge-v2-2-f388985a0f0a@kernel.org
Fixes:
|
||
|
Lorenzo Stoakes (ARM)
|
838bb60dc2 |
mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge
Patch series "mm/mremap: fix two issues with MREMAP_DONTUNMAP", v2. The MREMAP_DONTUNMAP feature is highly unusual in that it permits mremap() operations that keep the original VMA in place. Historically this has led to a lot of bugs where non-obvious interactions occur between existing mremap() operations and the original VMA. Commit |
||
Waiman Long
|
b8eb5fd5bd |
cgroup/cpuset: Call is_in_v2_mode() after acquiring cpuset_mutex in cpuset_handle_hotplug()
It is reported by sashiko that calling is_in_v2_mode() outside of
cpuset_mutex critical section in cpuset_handle_hotplug() can introduce
a TOCTOU race where cgroup hierarchy may have changed from v1 to v2 or
vice versa after is_in_v2_mode() is called leading to erroneously skip
the allocation of tmpmasks or incorrectly modify cpus_allowed masks,
resulting in cpuset state corruption. Fix that by calling is_in_v2_mode()
after acquiring the cpuset_mutex.
Fixes:
|
||
|
Linus Torvalds
|
69f80fef31 |
ata fix for 7.3-rc7
- Set CHECK CONDITION for failed ATAPI commands.
Since commit
|
||
|
Linus Torvalds
|
22430ae5d9 |
printk fixes for 7.3-rc7
-----BEGIN PGP SIGNATURE----- iQJPBAABCAA5FiEESH4wyp42V4tXvYsjUqAMR0iAlPIFAmrElacbFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMiwyAAoJEFKgDEdIgJTyEgwP/3SNJc5pKblEeXNjwHJK ezaA9s8cGua0hHYWlrveqeWqiJ40pqhEzIxNDqrfq7eqK9sNSPB5sfFamcN6Kahx KLd8sRpTe56z76mwg7Bj6zOjYl91EpcPAD5cKbMAaRyPziJ5CbYfNPMMD9UO37sS KvYD3KnmZ8CvZDadHJkb051SVnvpNN+uX6JmQxBovZQtW/o7dl3BKFF1TZZsZ/E5 ekYVR/kGiZk5mCL8B192r0bssqrlbMvalVeO2dIZiEMdcJDWDPc1Qpw0Ry4nViCh VF18bNmhIVCYWEZbc8YNqjk6U/MXxYWQUyCZkEGfwvMfOYb2nkfzCDGT6Qzl0WLc jpEKaXBAJF3py2as+QGyDWH0oiYkDtyZLavjIHvAXJ9SwGYCyM7Nh3iU2bBRwysu I/pqpahDaSZ6t5gh/Qp3VKl6WXEwng313Alyxxn/Fg3cYhPXyKt3wfzVThRouyfk X3PJr2Qmksp8iDNIm/Nktgt/rppmPQcW70fQiy13WOha/7/klrJAy6i2UVtcGrqI gmC3YkLcMmD0Ux2Siyi1y676oNx5Gp3ZOLVBDdmgDVQVNj28sCxeyydbPIz7421H jG6eUldW1tHq0YMb/p5MJ6Evjofak8yPXOouHGyaZVI5REPcwdrMSXd2Qwk66FVJ P5EPL9nIWEBYRrNuWNkYBUk0 =qEv0 -----END PGP SIGNATURE----- Merge tag 'printk-for-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux Pull printk fix from Petr Mladek: - Allow using Braille console with a serial console driver converted to NBCON API * tag 'printk-for-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux: braille: nbcon: Allow to use a serial console with NBCON API as Braille console |
||
|
Linus Torvalds
|
2c3418fffa |
KEYS changes for v7.3-rc7
This pull request contains two critical bug fixes, which can be briefly
descibed as follows:
1. key_get_persistent() creates a new persisten keyring for UID if it does
not exist yet, and creates a link from it to the nominated keyring.
Function did not set timeout when linking failed, therefore preventing
GC. The bug was addressed by calling key_set_timeout() regardless of
key_link() result when the persistent keyring gets created by
key_get_persistent().
2. __key_create_or_update() made a copy of keyring->restrict_link before
holding keyring->sem, which can cause add_key() to be executed against
stale keyring restrictions. The bug was fixed by copying the value only
after keyring->sem was taken.
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQRE6pSOnaBC00OEHEIaerohdGur0gUCasQmRQAKCRAaerohdGur
0pa7APwKavlgnkGcbJNLA7kUz+2zt+tI9K/eT/5kgOaelesvmgEA5Xe6gvaXOtjr
YaxQ2ySKAo4JvTtsPMWgaCn8p2hqVwc=
=+UWf
-----END PGP SIGNATURE-----
Merge tag 'keys-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd
Pull keys fixes from Jarkko Sakkinen:
- key_get_persistent() created a new persistent keyring if one did not
exist, but failed to set a timeout on it in an error path, preventing
GC.
Call key_set_timeout() regardless of key_link() result if a
persistent keyring was created.
- __key_create_or_update() made a copy of keyring->restrict_link before
holding keyring->sem, which could cause add_key() to be executed
against stale keyring restrictions. Fix it by copying the value only
after taking keyring->sem
* tag 'keys-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd:
KEYS: Fix add_key() race with keyring restriction
keys: finalize persistent keyring timeout after link attempt
|
||
|
Linus Torvalds
|
67f0943b39 |
selinux/stable-7.3 PR 20261005
-----BEGIN PGP SIGNATURE----- iQJIBAABCgAyFiEES0KozwfymdVUl37v6iDy2pc3iXMFAmrDdwgUHHBhdWxAcGF1 bC1tb29yZS5jb20ACgkQ6iDy2pc3iXMjnQ/+IQAKTWXjZgvhukbgb+c0Cjo7VhhC u0L9lpK2Z1A9OBufD69SoGq6CaeevGRLas5R/jX1t61mWoRO+ZHRNdMqUlyukUBU TYUesE7mcqsYVxCIjKx7f+ArwMtjQCVersBtPuY3bNHAox6OLWXKaDv9Mb9zfvqS WqVfp3QJez6TmA8Bs7RoQcKlHi4UXeioSbTa5qbmHB7GTal/0nyjS1Y6u5/gylWc fqFrh02h3i1Su7OErHMgaZsT20KyWuq4EFk3pF097FtTRPRinizU6rfvNXmSALbr Bc4TJbzwiLYH83e/Hn9kB+Pe3JhsbKBrJnL/4JYYS5oZGi5AQe7JzU1K2mco49f7 wHo31jlCpoQhyyt9w8m7uByQ+0Nud/6ZZ+rRa7y6mmpMJHQhAKwF31MCEXivJviF SKyW0SCh1VZOhvigd4/kyxpEZDhzfD84cEZD4OFGfx1qIUHTJNxM9vhPwCEYTpMm F/cz3fo3b3hMcKoBbNfICkuNoz/rQAv6XuF+SXigmbwgsLK3NeULGpPVFIPMJg7s rJHP78yzMKwi7000nSLVY6rymGUB0Bf7FFVEduGTxdd8dcai7eUQ53ztMBeA6N+q j33XOIMrsAskF21S9yULz7Eujo3BRC/vN1+h8fqKH6tmCbdCjIH+/CUUHEm6rZMv lFHoP43IOjyPxuY= =NFH9 -----END PGP SIGNATURE----- Merge tag 'selinux-pr-20261005' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux fixes from Paul Moore: - Preserve SECURITY_LSM_NATIVE_LABELS when reusing superblocks Similar to a previous fix (see the commit description of Stephen's fix) we need to check to see if we have already mounted/setup the superblock passed into the security_sb_set_mnt_opts() LSM hook so we don't mistakenly unset SECURITY_LSM_NATIVE_LABELS. - Fix a potential AVC sequence number data race * tag 'selinux-pr-20261005' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts selinux: fix data race on AVC latest_notif |
||
Filipe Manana
|
41c8899d59 |
btrfs: fix lost error return value in btrfs_listxattr()
If the input buffer does not have enough space to store the current xattr,
we set 'iter_ret' to -ERANGE and then do "break", but that only exits the
while loop over the xattrs in the current btrfs_dir_item, and then we
continue the btrfs_for_each_slot() iteration, which overwrites the value
of 'iter_ret' causing us to lose the error return value and proceed as if
the buffer has enough space.
Fix this by returning -ERANGE directly (the path is automatically freed)
instead of breaking from the while loop.
Fixes:
|
||
|
Filipe Manana
|
858bee1c77 |
btrfs: fix xattr replace when multiple xattrs are packed in the same item
If we have a btrfs_dir_item item that packs multiple xattrs and then we
replace the value of one of them (with the setxattr(2) family of syscalls)
with another value of a different size, we end up not having a fully
initialized btrfs_dir_item, resulting in a corruption that the tree
checker will detect at extent buffer writeback time.
This is because in btrfs_setxattr() when we find a btrfs_dir_item with
multiple xattrs (due to the crc32c hash of their name being the same)
we delete one of the xattr items (btrfs_dir_item) and then insert a new
one, but the deletion and insertion results in shifting existing data in
the leaf and therefore when the new value of a xattr has a different size,
the new btrfs_dir_item is placed in a leaf section that was not
initialized and we only copy the value's data and set the value's length
in the new btrfs_dir_item, without setting the name, the name's length,
the key (which must be all zeroes for xattrs), flags (BTRFS_FT_XATTR) and
transaction ID.
The following script reproduces the issue:
$ cat test.sh
#!/bin/bash
DEV=/dev/sdi
MNT=/mnt/sdi
mkfs.btrfs -f $DEV
mount $DEV $MNT
touch $MNT/testfile
# Add two xattrs that, on btrfs, have the same hash (crc32c) for their
# name and therefore are packed into the same btrfs_dir_item.
setfattr -n user.foobar -v 123 $MNT/testfile
setfattr -n user.WvG1c1Td -v qwerty $MNT/testfile
# Verify the xattrs are present.
echo "xattrs before:"
getfattr --absolute-names --dump $MNT/testfile
# Now replace the value of the foobar xattr with a significantly larger
# value.
setfattr -n user.foobar -v abcdefghijklmnopqrstuvwxyz $MNT/testfile
# Check the xattrs have the expected values.
echo "xattrs after:"
getfattr --absolute-names --dump $MNT/testfile
umount $MNT
Running it:
$ ./test.sh
(...)
xattrs before:
# file: /mnt/sdi/testfile
user.WvG1c1Td="qwerty"
user.foobar="123"
xattrs after:
# file: /mnt/sdi/testfile
user.WvG1c1Td="qwerty"
So the "user.foobar" xattr is missing and there was a transaction abort
when unmounting the fs with the following traces in dmesg:
$ dmesg
[869800.159271] BTRFS warning (device sdi): access to eb bytenr 30474240 len 16384 out of range start 16015 len 25964
[869800.159293] ------------[ cut here ]------------
[869800.159296] WARNING: fs/btrfs/extent_io.c:4408 at report_eb_range+0x44/0x60 [btrfs], CPU#8: getfattr/2605179
[869800.168961] Modules linked in: btrfs dm_thin_pool (...)
[869800.190527] CPU: 8 UID: 0 PID: 2605179 Comm: getfattr Tainted: G W 7.3.0-rc3-btrfs-next-244+ #1 PREEMPT(full)
[869800.193726] Tainted: [W]=WARN
[869800.194502] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014
[869800.197576] RIP: 0010:report_eb_range+0x44/0x60 [btrfs]
[869800.198985] Code: 48 8b 7b 18 (...)
[869800.203531] RSP: 0018:ffffce4541937d58 EFLAGS: 00010246
[869800.204609] RAX: 0000000000000000 RBX: ffff8dde054b8738 RCX: 0000000000000000
[869800.206137] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffffc04c92a0
[869800.207645] RBP: 0000000000003e8f R08: 0000000000000000 R09: 3fffffffffefffff
[869800.226175] R10: ffffce4541937a88 R11: 0000000000000003 R12: 000000000000656c
[869800.227594] R13: ffff8dde14be800f R14: 000000000000656c R15: 0000000000000069
[869800.229097] FS: 00007f59023bb780(0000) GS:ffff8de5788ed000(0000) knlGS:0000000000000000
[869800.231137] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[869800.232321] CR2: 0000558dc45e6a78 CR3: 0000000765b16004 CR4: 0000000000370ef0
[869800.233783] Call Trace:
[869800.234330] <TASK>
[869800.234791] read_extent_buffer+0x4d/0x100 [btrfs]
[869800.235898] btrfs_listxattr+0x199/0x240 [btrfs]
[869800.236912] vfs_listxattr+0x51/0xa0
[869800.237683] listxattr+0x7e/0x100
[869800.238398] path_listxattrat+0x9e/0x190
[869800.239117] do_syscall_64+0x89/0x470
[869800.239877] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[869800.240914] RIP: 0033:0x7f59024cdcb7
[869800.241686] Code: f0 ff ff 73 (...)
[869800.245353] RSP: 002b:00007ffd056dcdb8 EFLAGS: 00000246 ORIG_RAX: 00000000000000c2
[869800.246892] RAX: ffffffffffffffda RBX: 00007ffd056df2e2 RCX: 00007f59024cdcb7
[869800.248853] RDX: 0000000000006600 RSI: 0000558dc45e0470 RDI: 00007ffd056df2e2
[869800.250514] RBP: 00007ffd056df2e2 R08: 0000000000006600 R09: 0000000000006600
[869800.252295] R10: 0000000000000004 R11: 0000000000000246 R12: 00000000ffffff9c
[869800.254105] R13: 0000558dc45e0470 R14: 0000000000006600 R15: 0000000000000000
[869800.255931] </TASK>
[869800.256529] ---[ end trace 0000000000000000 ]---
[869800.260071] page: refcount:2 mapcount:0 mapping:000000007ccfc77f index:0x1d10 pfn:0x608c69
[869800.260075] memcg:ffff8dde00344d40
[869800.260076] aops:btree_aops [btrfs] ino:1
[869800.260151] flags: 0x17fffc00000402a(uptodate|lru|private|writeback|node=0|zone=2|lastcpupid=0x1ffff)
[869800.260154] raw: 017fffc00000402a fffff4adc773d4c8 fffff4adc48f3d88 ffff8de36504ba30
[869800.260155] raw: 0000000000001d10 ffff8dde054b8738 00000002ffffffff ffff8dde00344d40
[869800.260156] page dumped because: eb page dump
[869800.260157] BTRFS critical (device sdi): corrupt leaf: root=5 block=30474240 slot=5 ino=257, invalid location key type, have 46, expect 132 or 1
[869800.260161] BTRFS info (device sdi): leaf 30474240 gen 9 total ptrs 6 free space 15629 owner 5
[869800.260163] BTRFS info (device sdi): refs 3 lock_owner 0 current 2550294
[869800.260164] item 0 key (256 INODE_ITEM 0) itemoff 16123 itemsize 160
[869800.260165] inode generation 3 transid 0 size 0 nbytes 16384
[869800.260166] block group 0 mode 40755 links 1 uid 0 gid 0
[869800.260167] rdev 0 sequence 0 flags 0x0
[869800.260168] atime 1790340637.0
[869800.260169] ctime 1790340637.0
[869800.260169] mtime 1790340637.0
[869800.260170] otime 1790340637.0
[869800.260170] item 1 key (256 INODE_REF 256) itemoff 16111 itemsize 12
[869800.260172] index 0 name_len 2
[869800.260172] item 2 key (256 DIR_ITEM 982728850) itemoff 16073 itemsize 38
[869800.260173] location key (257 1 0) type 1
[869800.260174] transid 9 data_len 0 name_len 8
[869800.260175] item 3 key (257 INODE_ITEM 0) itemoff 15913 itemsize 160
[869800.260176] inode generation 9 transid 9 size 0 nbytes 0
[869800.260177] block group 0 mode 100664 links 1 uid 0 gid 0
[869800.260177] rdev 0 sequence 0 flags 0x0
[869800.260178] atime 1790340638.38778502
[869800.260179] ctime 1790340638.38778502
[869800.260179] mtime 1790340638.38778502
[869800.260180] otime 1790340638.38778502
[869800.260180] item 4 key (257 INODE_REF 256) itemoff 15895 itemsize 18
[869800.260181] index 2 name_len 8
[869800.260182] item 5 key (257 XATTR_ITEM 751495445) itemoff 15779 itemsize 116
[869800.260183] location key (0 0 0) type 8
[869800.266052] transid 9 data_len 6 name_len 13
[869800.266053] location key (8243121639454149888 46 7229457603934778967) type 0
[869800.266055] transid 113 data_len 26 name_len 0
[869800.266056] location key (8608196880778817904 120 162425) type 9
[869800.266057] transid 8391162079612502016 data_len 26982 name_len 25964
[869800.266058] BTRFS error (device sdi): block=30474240 write time tree block corruption detected
[869800.266091] ------------[ cut here ]------------
[869800.266092] WARNING: fs/btrfs/disk-io.c:336 at btree_csum_one_bio+0x20b/0x220 [btrfs], CPU#7: kworker/u50:7/2550294
[869800.268392] Modules linked in: btrfs dm_thin_pool (...)
[869800.365851] CPU: 7 UID: 0 PID: 2550294 Comm: kworker/u50:7 Tainted: G W 7.3.0-rc3-btrfs-next-244+ #1 PREEMPT(full)
[869800.368937] Tainted: [W]=WARN
[869800.369834] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014
[869800.372778] Workqueue: writeback wb_workfn (flush-btrfs-3821)
[869800.374314] RIP: 0010:btree_csum_one_bio+0x20b/0x220 [btrfs]
[869800.375915] Code: 89 44 24 04 (...)
[869800.380639] RSP: 0018:ffffce4548e3f7d0 EFLAGS: 00010246
[869800.382008] RAX: 0000000000000000 RBX: ffff8dde054b8738 RCX: 0000000000000000
[869800.383850] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8de091c2ddc0
[869800.385710] RBP: ffff8dde196a2000 R08: 0000000000000000 R09: 3fffffffffefffff
[869800.387388] R10: ffffce4548e3f500 R11: 0000000000000003 R12: ffffce4548e3f7d8
[869800.388973] R13: ffff8dde196a2000 R14: ffff8de36504b750 R15: ffff8dde4c497b00
[869800.390414] FS: 0000000000000000(0000) GS:ffff8de5788ad000(0000) knlGS:0000000000000000
[869800.392002] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[869800.393160] CR2: 000055cd6e92ad5c CR3: 00000007cb264001 CR4: 0000000000370ef0
[869800.394595] Call Trace:
[869800.395113] <TASK>
[869800.395570] btrfs_submit_bbio+0x872/0x890 [btrfs]
[869800.397284] write_meta_extent_buffer+0x70/0x80 [btrfs]
[869800.398940] btree_writepages+0x141/0x4f0 [btrfs]
[869800.400426] ? get_random_u32+0x8a/0xf0
[869800.401417] ? build_slab_freelist+0x47/0x130
[869800.402574] ? preempt_count_add+0x6b/0xa0
[869800.403633] ? _raw_spin_lock_irqsave+0x23/0x50
[869800.404807] ? _raw_spin_unlock_irqrestore+0x22/0x40
[869800.406085] ? alloc_from_new_slab+0x18f/0x330
[869800.407223] do_writepages+0xc6/0x160
[869800.408191] ? refill_objects+0xd8/0x300
[869800.409211] __writeback_single_inode+0x42/0x350
[869800.410408] writeback_sb_inodes+0x231/0x560
[869800.411511] wb_writeback+0x8a/0x300
[869800.412440] wb_workfn+0xbf/0x460
[869800.413291] ? _raw_spin_unlock+0x14/0x30
[869800.414328] ? finish_task_switch.isra.0+0xb9/0x380
[869800.415105] process_one_work+0x1d1/0x3d0
[869800.416633] worker_thread+0x1c4/0x330
[869800.417467] ? __pfx_worker_thread+0x10/0x10
[869800.418452] kthread+0xfc/0x130
[869800.419257] ? __pfx_kthread+0x10/0x10
[869800.420089] ret_from_fork+0x1f7/0x2c0
[869800.420863] ? __pfx_kthread+0x10/0x10
[869800.421654] ret_from_fork_asm+0x1a/0x30
[869800.422484] </TASK>
[869800.422953] ---[ end trace 0000000000000000 ]---
[869800.424005] BTRFS error (device sdi state A): Transaction 9 aborted (-EIO)
[869800.424010] BTRFS: error (device sdi state A) in __btrfs_run_delayed_items:1162: errno=-5 IO failure
[869800.424011] BTRFS info (device sdi state EA): forced readonly
[869800.424013] BTRFS warning (device sdi state EA): Skipping commit of aborted transaction.
[869800.424014] BTRFS: error (device sdi state EA) in cleanup_transaction:2076: errno=-5 IO failure
Fix this by always setting all fields in the new btrfs_dir_item when we
replace an existing xattr.
Fixes:
|
||
Yang Xiuwei
|
51562a8cb1 |
btrfs: don't stash io_uring encoded data across -EAGAIN
Returning -EAGAIN while leaving btrfs_uring_encoded_data in the cmd PDU leaks if the request is cancelled or the ring exits before reissue. io_uring does not free driver PDU allocations on cleanup. Write: io_queue_sqe() always issues with IO_URING_F_NONBLOCK first, so return -EAGAIN before allocating and free data on every exit. Read: free on nowait -EAGAIN too; only -EIOCBQUEUED keeps the allocation for btrfs_uring_read_finished(). Fixes: |
||
|
Yang Xiuwei
|
b6e8add5d7 |
btrfs: unlock inode and extent in caller when io_uring read extent fails
btrfs_uring_read_extent() runs only after btrfs_encoded_read() has taken
the inode shared lock and the extent lock. On failure it used to unlock
in out_fail, and a pages-array allocation failure returned -ENOMEM
without unlocking at all.
Unlock in the caller instead on all failure returns, matching the
copy_to_user() error path. The deferred -EIOCBQUEUED path still unlocks
in btrfs_uring_read_finished().
Fixes:
|
||
|
Yang Xiuwei
|
a8ea92830b |
btrfs: free iov when btrfs_uring_read_extent() fails
After btrfs_uring_read_extent(), the caller always jumped to out_acct.
That skips kfree(data->iov), which is only correct for -EIOCBQUEUED
where the deferred path owns the iov. On failure, fall through to
out_free instead.
Fixes:
|
||
|
Yang Xiuwei
|
80a8dbb30d |
btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio
If all bios finish before btrfs_encoded_read_regular_fill_pages()
returns, it calls btrfs_uring_read_extent_endio() and previously
returned the I/O status. A negative errno then made
btrfs_uring_read_extent() unlock and free while
btrfs_uring_read_finished() did the same again.
Return -EIOCBQUEUED so only the deferred path cleans up.
Reported-by: Yue Sun <samsun1006219@gmail.com>
Closes: https://lore.kernel.org/linux-btrfs/20260630091609.3414-1-samsun1006219@gmail.com/
Suggested-by: Jens Axboe <axboe@kernel.dk>
Fixes:
|
||
Wentao Liang
|
1fd742c747 |
btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()
When paths_from_inode() fails, scrub_print_warning_inode() jumps to err
without dropping the reference taken by btrfs_get_fs_root(), leaking a
reference to the root every time path resolution fails while printing
scrub warnings. Every other error and success path of the function
drops the reference.
Drop the reference on the paths_from_inode() failure path too.
Fixes:
|
||
|
Filipe Manana
|
3e6ff34afc |
btrfs: clear BTRFS_ROOT_IN_TRANS_SETUP on early exit from record_root_in_trans()
If we exit early because the transaction that last used the root already matches the current transaction, we leave the BTRFS_ROOT_IN_TRANS_SETUP bit set in the root (which we just set right before the exit). While this does not cause any functional issue, it makes callers of btrfs_record_root_in_trans() lock fs_info->reloc_mutex and call record_root_in_trans() for nothing, causing unnecessary lock contention, until one of them clears the bit in record_root_in_trans(). One caller of btrfs_record_root_in_trans() is start_transaction(), used to start new transaction or joining an existing one, which is a hot path. So clear BTRFS_ROOT_IN_TRANS_SETUP on early exit. Assisted-by: LLM Reviewed-by: Boris Burkov <boris@bur.io> Reviewed-by: Qu Wenruo <wqu@suse.com> Signed-off-by: Filipe Manana <fdmanana@suse.com> Signed-off-by: David Sterba <dsterba@suse.com> |
||
|
Linus Torvalds
|
a90ee4305c | Linux 7.3-rc6 v7.3-rc6 | ||
성병찬
|
dd3ea3fcba |
KEYS: Fix add_key() race with keyring restriction
__key_create_or_update() snapshots keyring->restrict_link before taking
the destination keyring's semaphore. keyring_restrict() installs a
restriction while holding that semaphore.
This allows a writer to observe no restriction, wait for the keyring
owner to install a reject-all restriction and return successfully, and
then link a key using the stale NULL snapshot. The writer only needs
write permission on the destination keyring.
Move the restrict_link read after __key_link_lock() and
__key_link_begin(). The read and the subsequent restriction check are
then serialized with restriction installation by keyring->sem.
The race was reproduced on v7.2.8 in 19 executions where restriction
installation returned before the link completed. All 19 linked the key
despite the reject-all restriction. With this change, 312 executions
reached the same ordering and every add_key() call failed with -EPERM.
The issue was found by manual concurrency analysis assisted by AI-based
analysis and independently verified with a QEMU reproducer and kernel
instrumentation.
Fixes:
|
||
Karl Mehltretter
|
25bf14f817 |
keys: finalize persistent keyring timeout after link attempt
When no keyring exists for the requested UID, KEYCTL_GET_PERSISTENT
creates and registers one before linking it to the requested destination.
The configured timeout is set only after the destination link succeeds.
A destination restricted with KEYCTL_RESTRICT_KEYRING makes that link fail
with -EPERM. With persistent_keyring_expiry set to 60 seconds, /proc/keys
still reports the registered keyring's expiry as "perm".
The failed call therefore leaves a quota-exempt keyring in the namespace's
hidden register, where it may remain until namespace teardown.
Rename the write-locked helper to key_get_or_create_persistent() and return
the key reference through a result parameter. Return 0 when it creates a
keyring and 1 when the retry finds an existing one. Return a negative error
on failure. Another caller may create the keyring between the initial
read-locked lookup and the retry under the write lock.
Set the timeout after permission checking and linking. Do this on success,
or on failure if the call allocated the keyring. This leaves a new keyring
collectible after failure without starting its timeout while linking is
still in progress.
Cc: stable@vger.kernel.org # v5.10+
Fixes:
|
||
|
Linus Torvalds
|
7704c4c5bb |
i2c-fixes for v7.3-rc6
Three patches in xiic for fixing the block reads and a single cleanup in the error path. - at91: also release DMA channels when deferring probe - xiic: fix SMBus block reads with PEC -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQScDfrjQa34uOld1VLaeAVmJtMtbgUCasIP0gAKCRDaeAVmJtMt bplRAP94u1e4hKXK0XeiC2WtZ7vfBYtwjeHgalyruKgnL3sK3wEAutT0bEOxpk1p cx+8y8eF0L7wOKSRU4+cHrW65YWxIQU= =x4Aw -----END PGP SIGNATURE----- Merge tag 'i2c-fixes-7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux Pull i2c fixes from Andi Shyti: "Three patches in xiic for fixing the block reads and a single cleanup in the at91 error path: - at91: also release DMA channels when deferring probe - xiic: fix SMBus block reads with PEC" * tag 'i2c-fixes-7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux: i2c: at91: release DMA channels when probe defers i2c: xiic: don't clobber msg->len to signal block-read completion i2c: xiic: defer RX_FULL until all trailing bytes are in FIFO i2c: xiic: preserve PEC byte length in SMBus block read setup |
||
|
Linus Torvalds
|
06ac073129 |
x86 architecture fixes [with an UM fix included]:
- Don't apply va_align to hugetlb mappings on AMD F15h systems
that have custom va_align.bits values (Laurent Wandrebeck)
- Fix PMD teardown handling regression flagged by lockdep
(Mikhail Gavrilov)
- Hide ptrace header register offset macros behind __ASSEMBLER__ or
__FRAME_OFFSETS, to fix user-space build errors that may trigger
if they happen to shadow these short and generic macro names
(Nick Desaulniers)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmrCBfsRHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1hhvxAAiRvv7gz6K9VIJ7S24PdQOf8VuiuLT4De
JUxTb6tUJ3VQ9+qk0xKSAg10z603PKn2Ow01znUNV5wTrRcumpkKTk39ut+x9Yl5
qLDeLVTI/NFAkrYajtjPq3OrwZKnLcAYoZaM9cWtZIoIVCBVIDAsJgS7lIJbUjQ8
FVvI4UUFaToM79jBMvAA89QOK5FrwO26/ENZLbRyceHzHnPrw/pYObaWpUhUs3S6
r0OS2NRUacDid3s3SrVJqkJ9siZvS1OdVQZZwSSKz7oNPsk3yH5aqkFrLrCZJNsa
VG3gCtb7ZLe3omFDmW9RzCYo5afbaUNbdHDOtameVoAT4h71cPoBr3mzAWDJiNEq
NFu7ICAt7XP9Kvfoa4k0n4HhbYNxH1VAyoXOAiquqpPtsU+ZtG2HhqwZknrqGxM4
9S127eCrAyGN9CLrYgcnZlALd1HUJ/nGHqdaSVxyxhaJxgxu9e717YmgsxXVl79p
uCASyox64F4JrKr1n7Yp08UwfPvsquc8ViTyxsfHCuHj59hLnLfxPefr6N86Ztdc
97yQhb7tDq7z8S8IUQTJuOtcDuqIUdm/VRg6+8SP+hVZquCW2zo0lla24Yi/cS1+
om89Mfy4l9v+VzkBy2TvNU0cLy0ClK1BQTquHALWFuCDDEmJ4vftc7eWV4VQ+Idh
lQDDgs0Q66g=
=j39M
-----END PGP SIGNATURE-----
Merge tag 'x86-urgent-2026-10-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fixes from Ingo Molnar:
- Don't apply va_align to hugetlb mappings on AMD F15h systems
that have custom va_align.bits values (Laurent Wandrebeck)
- Fix PMD teardown handling regression flagged by lockdep
(Mikhail Gavrilov)
- Hide ptrace header register offset macros behind __ASSEMBLER__ or
__FRAME_OFFSETS, to fix user-space build errors that may trigger
if they happen to shadow these short and generic macro names
(Nick Desaulniers)
* tag 'x86-urgent-2026-10-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
{x86,um}/uapi/ptrace: Guard register offset macros with __ASSEMBLER__ or __FRAME_OFFSETS
x86/mm: Drop unnecessary PMD page copy when freeing
x86/mm: Don't apply va_align to hugetlb mappings on AMD F15h
|
||
|
Linus Torvalds
|
942e4a0e46 |
Timer fix:
- Fix task work flags management regression in the hrtimer
rearming code that can leave task work items unprocessed
(Karl Mehltretter)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmrCA2cRHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1i79Q/9FjK0/gpSQMMiMYMqId0884UXMtLexmlT
bMWqLE8OOIx484g0Shelgqjvy335ur9l8FqlV1GXmfUNmA+tTUV7wfonGTCbsZ9z
7WHtBHkRySItwu9Pg/KBOUuit6+ohX73K8WmPpVazvp3vQR2fIOJ4SsflSsjAFRU
/kg1996BwfBnvQs9WoULJi28/rTzmNcnCmZjV2kh780LNwlbzFYEAZPihTQl9HYL
Eg2qoTeRw3b8qb3oAFJtjHk/jT5Um0Fu58Z9WB6/ElRPvZ2Y4Fynvu0FBv++1OwB
IILT5M0ogKdj4BfhJZf3MWdRGeMqzBvfXydPETS2ctck3DMjN1F2e7ldk3Z/wkqF
QXesbDn3FubsA7jaIKaxVdg4hSNAhhM7OcNwRTn1u9UW1zc1rolL69Y01pYeZ8iw
kBJ0AN/Bou/GHKTlCwmhyLHSLgqAPQ0NTVo0d8cEfkmu61hxTp64ECxI7no/Eb4U
U+i2UHVmnG6FzPSFXAy0QU87mtNWABF5RpS8GQtIxfvt3UjiiziMzb8hjOjMkDwD
CcACRw7UtoXQ2kILFuqu3X0uYgIGD61T290v+RKY+5Ox1scX/7u7D+HnLp9pk5id
Kimw8UAEZWEaytLh2f6ONMNL6voY5+e22jmfh2PH0cLPRGxj6uu9f8dogy4O+/GL
0vir6C41CGQ=
=IUqa
-----END PGP SIGNATURE-----
Merge tag 'timers-urgent-2026-10-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull timer fix from Ingo Molnar:
- Fix task work flags management regression in the hrtimer
rearming code that can leave task work items unprocessed
(Karl Mehltretter)
* tag 'timers-urgent-2026-10-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
hrtimer: Use the mask to clear TIF_HRTIMER_REARM from the exit work
|
||
|
Linus Torvalds
|
a27611f899 |
Perf events fixes:
- Fix race between perf_event_exit_task() and perf_pending_task()
(Luo Gengkun)
- Fix perf header output management regressions (Ian Rogers)
- Require kernel access for text poke events (Zhengchuan Liang)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmrCAjwRHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1hTzw/+IJzVOLjNe2TaHJF20uYtuFVp80FGckH3
qGMQcSSxEsdH2zWgA196UWYCuxcNtq9gRVkBw90u30Tka8F/C57r9fWf2Mx6iUBy
zRrf70Lp4RsACAnM7kscX5ieJvesflYK5Vdr1je7DtQGE9P40Hq/45zquZt1B0uJ
IqMVeDnqR46QIdAc/xNkn6G6FmI4CTJ1znwE1ZUm2HoDJ7Ya3zy0Gm9HNvdTaUN5
IU5HWgNSEyL1id+2hwrv4/f+TPgmFSkJUf/t2hn/Rvzf1eOmRHuB/d8ZEBOEBDxk
H5qeq/CGStzGMZsJprfQ65BGj/8QlXWNI8a6bzTnpAL2Ss9VKFvLvwmWDXmGo+B6
n4+MOevA9LWDuZoSxRWzM00nBFp3h8YxyjSLYScZpoA3t0n45ckA+saK/ZDFBjYZ
meWQX5mVVbktUX39hA/BeR2ps1KuHO8l2hq7BTlyK5nJfC69ptpM3OT2q0Jx/jD2
kWKlhBLBhSObe3PX2uZiHDwXdEzuiMK0VKSYfz7gr0UDFoBbwe0AETOFIN9qhEXC
4Lwln4vBpZTPGcGZYmBiWLS0uesy0mUa+FKzD8pZn7DKh8QY210Z9mr3+Tja3gsV
pVjTs+7cpT9dsfX9z4PuSSnw8VGPfoM6iwGON5byva6Ylss+uL5iCCSQ3+heQFOz
9aDZYLimUj4=
=58mT
-----END PGP SIGNATURE-----
Merge tag 'perf-urgent-2026-10-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull perf events fixes from Ingo Molnar:
- Fix race between perf_event_exit_task() and perf_pending_task()
(Luo Gengkun)
- Fix perf header output management regressions (Ian Rogers)
- Require kernel access for text poke events (Zhengchuan Liang)
* tag 'perf-urgent-2026-10-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
perf: Require kernel access for text poke events
perf: Replace perf_event_header__init_id with full header init
perf: Fix race between perf_event_exit_task() and perf_pending_task()
|
||
|
Linus Torvalds
|
1c915d6007 |
Locking fixes:
- Don't run refcount kunit self-test when !CONFIG_KUNIT_ALL_TESTS
(Kuan-Wei Chiu)
- Fix futex private hash use-after-free on resize (Chris Mason)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmrCASARHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1g8/hAAsD+KLKE+WBSVX1CTqwKyflGbV5R8fMH+
NabxcUzawNKwI3YTNSE+02cDKqDMMgmRMKPu9+hwxouVeXfWh/IU+vOWsUmGzIvd
+pXYbKt6UInGA+4BVlSc++vAskPh/s/5MySOKIH++mMINbNYsXrvfvJL+KcYUkFr
2vijeqCfdE7BTYzujYwoOlT0Dy2cTIr3ExjGe7/DE6YUT9ajahwoS4r7AaAto9YD
NzPrYBMUB/4wkx6rznZn7Pn6Di7zj9/jAUXJXsLlgM7I1+PoARP7vg12tLMUnlRp
WEk8D6ipOfSbNgEMCa41jcT9OjcIu9uny7W/lNVI9IJ9X4Irg55pMlgMUXRrsVn9
8PlYrnVxtWerxsKMhbm7g37SvD7r/7wo3FXw97N85ZPNpJrKcZS3EY6bcDCJq9ME
DWsGAFGgUpXTivjcq/pmWOCxVgLsuwyJWtzNMU3CwQ+cOADs8jMBb97qT9U1mwMi
4gB299hViUAunGTf8lIWP1NFoBmh50xQtyJ3V9jAJxVHHQvUYpuANgaLguvEWWND
aFwyoIYwUyRmRp24Gpmwb4aDhr6JK21mA97o8IJ4w5He/zuoz5DtNPacnFqObq6Y
T+I+oIFNtrZ6iVy7/yRTFqe5irmEQoA//714/VWrvaR0qorX0Elhq7JZJa95dnvC
JZ/J+oYi9jw=
=M+J3
-----END PGP SIGNATURE-----
Merge tag 'locking-urgent-2026-10-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull locking fixes from Ingo Molnar:
- Don't run refcount kunit self-test when !CONFIG_KUNIT_ALL_TESTS
(Kuan-Wei Chiu)
- Fix futex private hash use-after-free on resize (Chris Mason)
* tag 'locking-urgent-2026-10-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
futex: Fix private hash use-after-free on resize
irq: Make refcount_interrupt kunit test selectable
|
||
|
Linus Torvalds
|
6addb4f385 |
- In versalnet_edac, properly release a remote processor reference which was
acquired at probe time, on memory controller instance remove
- A handful of Altera EDAC driver fixes:
- Fix device node reference leaks covering both the success path and the
various error paths, and route the single-bit setup function through the
common exit label
- Fix a use-after-free by releasing the devres group before freeing the
control info structure in the error paths, since managed IRQ handlers
could reference the freed dci struct if they fire at just the right time
- Fix a memory leak by freeing the allocated control info structure when the
devres group open fails in the Altera SDMMC setup path
- Remove the __init marking from the Altera Arria10 setup paths and their
helpers so they remain safely callable at runtime, including after
deferred or re-triggered probing
- Prevent the Altera driver from being unbound by removing their ->remove
callbacks and marking them to suppress bind/unbind sysfs attributes, since
unbinding could erase active system memory
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmrBzj0ACgkQEsHwGGHe
VUpYCw/+PunHfO7n2E+jDTzJZh74NA6gcjVl9izDghf2MF2RBOMmS1o9swH1FAsJ
IwOxBkT79xmKBoaSeJ3Ompjm+/aIDZO4INHP1QiSq0f6p/7ilT+QLJwgIGvW9C6l
ipdYqjPJI1MoOGRQokGPGDkGsANTrO1IlSbI4KI8NQZf67QkKn7SPsf6RlF0DP4O
XvJL2xLtIVvcRIMcwWUwmkvxrTgyVc9uxKUWdhLhRR6u7ZYMNLHH3BEaVKxr2mo5
my+eW12hUJIrcSLKR0NOCQYgfiC0gS3hPZRMB3hWMD3YVVxLOzvx3UIF2PIj0PKZ
xRoGnQXjRd7yHtY1t8Un7OGCnmCcEFuQbP4jDw6HrsrwJlZ8N3R+jciSuhk88FFr
GKdrvUSAaBoJXpgDVxba7KBkxO/5pi3iSf5yAjbWob/+U6Lm02/7V9GQzk7b802R
sK7lJo1gqKXA6Yyh7DjT7yWDjAQNDH/Y5gp0EpN67meR9MScTV/3Pe0ZCRYJ81F2
hrSKS+WuJdBQBxR++QZBEan3PbTKwfdWntQxGwEsf2swyiG4WUn0AwH+P85NUGtx
EM9HNCHR2PR3jaNP539TDx4YEw186yIKLn1DyCQ6JaUvtRE/eZ/uuSfr5/4aGBVQ
3gGF+i+xXxGr0UJ6OIZe3vocEt0tU/ecRuA5hNy+7LiFOgaQ0Wg=
=2r1p
-----END PGP SIGNATURE-----
Merge tag 'edac_urgent_for_v7.3_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras
Pull EDAC fixes from Borislav Petkov:
"This is more of the new normal of LLM-induced fixes of error paths. Oh
well, they should be done eventually and hopefully we'll be back to
normal soon-ish... one would hope... :-P
AMD Versal NET:
- Properly release a remote processor reference which was acquired at
probe time, on memory controller instance remove
A handful of Altera EDAC driver fixes:
- Fix device node reference leaks covering both the success path and
the various error paths, and route the single-bit setup function
through the common exit label
- Fix a use-after-free by releasing the devres group before freeing
the control info structure in the error paths, since managed IRQ
handlers could reference the freed dci struct if they fire at just
the right time
- Fix a memory leak by freeing the allocated control info structure
when the devres group open fails in the Altera SDMMC setup path
- Remove the __init marking from the Altera Arria10 setup paths and
their helpers so they remain safely callable at runtime, including
after deferred or re-triggered probing
- Prevent the Altera driver from being unbound by removing their
->remove callbacks and marking them to suppress bind/unbind sysfs
attributes, since unbinding could erase active system memory"
* tag 'edac_urgent_for_v7.3_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras:
EDAC/versalnet: Drop remote processor handle refcount on driver removal
EDAC/altera: Fix device node reference leaks in the SDMMC ECC setup
EDAC/altera: Fix use-after-free in error paths
EDAC/altera: Fix memory leak on dci allocation failure
EDAC/altera: Drop __init from ECC setup paths for re-probe safety
EDAC/altera: Do not allow driver unbinding
|
||
Kuba Piecuch
|
e6ac89b8b1 |
sched_ext: Generate qseq from a per-task counter
finish_dispatch() uses the qseq embedded in p->scx.ops_state to tell
whether the QUEUED instance of a task it's about to claim is the one
scx_bpf_dsq_insert() saw. qseq is generated from rq->scx.ops_qseq, but
the counters of different rqs are independent, so if a task is dequeued
and re-enqueued on a different rq between scx_bpf_dsq_insert() and
finish_dispatch(), the new QUEUED instance can end up with the same
qseq as the old one:
CPU X CPU Z
----- -----
enqueue p on rq A, qseq = N
ops.dispatch()
scx_bpf_dsq_insert(p)
records qseq N
sched_setaffinity(p)
dequeue p from rq A
enqueue p on rq B, qseq = N
finish_dispatch(p, N)
qseq matches, p is claimed
The claim itself is still atomic so the core stays consistent, but an
insert issued for a previous QUEUED instance gets applied to a new one
which the BPF scheduler has just received through ops.enqueue(). This
breaks the guarantee that dispatches targeting a stale instance are
ignored.
Generate qseq from a per-task counter, p->scx.ops_qseq, instead so that
consecutive QUEUED instances of a task never share a qseq regardless of
which rq they're on. The counter is only updated in
scx_do_enqueue_task() with the task's rq locked, so no additional
synchronization is needed, and it fits in an existing hole in struct
sched_ext_entity on 64bit. Remove the now unused rq->scx.ops_qseq.
Never generate qseq 0. NONE and DISPATCHING don't carry a qseq, so
scx_bpf_dsq_insert() on a task in either state records 0. With a
per-task counter, every task's first QUEUED instance would otherwise get
qseq 0 and could be claimed by such an insert. Wrap the counter where
the QSEQ field wraps so that it can't reach a value that shifts to 0 on
32bit either.
Fixes:
|
||
Arnd Bergmann
|
1fc2d80928 |
Reject zero-sized allocations in tee_dyn_shm_alloc_helper()
-----BEGIN PGP SIGNATURE----- iQJUBAABCgA+FiEE0qerISgy2SKkqO79Wr/6JGat8H4FAmrBEqsgHGplbnMud2lr bGFuZGVyQG9zcy5xdWFsY29tbS5jb20ACgkQWr/6JGat8H5j+w/9EOjO/CnsBN1W 8NCjEdmKOQzJ/T92pqmGJnyX70b1ZyMOpdc1tvBNfU69ELAWxDGQLTw5gw+PHaww pSwRRyZeWHMZUx37Po8wZeBKvp6CE42kT4H4KpAagr2aLPGEqR7bKlKo3W+fXrmj U+W9J6TuaAjWeUaA5n0AFxoa0U7OQ9lJ4LA98vk5xUCmcTg4zeGhkXU/GSAs1tZT H34+LJuiRzoO6LnDaR2BJ8Y/qxZ0Bqgror1u1pCZKWB8eOBPiFniUf5InNRzwJmf 3iwNrnHFMh8YG4cdsEiOkE2w1EH7wQY/FzQJ1QjDok+tZ4OhE3U1D4XmIgvN+P3a xGH8n2V0qjy/8GOKRiwCA2wrCHK2XR/HTePXLPHIcwhRqgCSl3l+f1mQIHan5w2d WZg2ocfARe+ezuSVjkqRF2flLSn1uLSmqvZ/9X2Z31/CrFhlCa277KwkOmEZfniB 2sXVb+GglwZxeAvlt81dfyTrtofqxJJXhvB02gWKsvqpXKIK15dDp2KiGb4Rd0YC S7kFx6F8zu+WtXML6uKSPvqv7zcHzEpoNatxhPXrmotAEUlhZexY9UQiSrZBI6ei LM4nebnQvd0UU3aiXl2Cwa9xhcq1q5/QIKMsyeI7I7TEEkI3mVN9vHAOvr9g1hyF EyCgFacUa+9063NFdWkZ1UJga59Ko0A= =/w8l -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmrBdJgACgkQmmx57+YA GNlLnA/+P6zcvRua5h+dtOwu7yciltcGe6dH1OJHs8erfQGuG6Y3vdebbeCgIpmY sDSFUDDawbR2bAi2wwNT55ggHHknXr7b5Mna/6/IqM/gfb8WwRsOCPCmqBaJl46B QSJdd3TGtCizI0h8jAw8kUwEKk8PUqh5IHqsUJpJyGp/J0Ux3lrVfdNhMaI/FeuB n8x66UD6do7MCI/N+3W02mj0GqVma5jHKnpAwYAbVVMo6KVXRE5JcdZ9w4OfpEGO VrFqurGEe3GHhlp5LEbziqzUXq/1/TUZhBj5PNUdPZ/Vp43/TE7Zj6YkuDA/UgXO vgHV/oDIkgF3SRamLCC+muA1vIiQsLbaMl/ue3X0z/ua+x8gntnz0D+CAXtPOPTM Lvyd4TS2sexo+394ior5uQNDwTILuBnigSxhoSGtrocOYGihMRpVLUw5/QqKl75S 0yMkRA9CsSTqDb27oVnWTVGaWe9dBGre1GRxe1xFCkTPBNTfoDINkiHnazKBZF2p IZRu5VJu9ysfmEE/CGRW03/NtC2pz0H+KI/xUVq1mZtw/Y0OS9n0hFbBYFDCvY9F j1+a69paLw2qixLrs0OupUlej3qKmOy5QCUV/xO9e2+JUuahOMuBFdy+DNzE4it+ HeYV0CTEeaG99UOU4ItCuCRTgXausEVWNezxfZrhTI2t4bvyMGs= =/Oc5 -----END PGP SIGNATURE----- Merge tag 'tee-fix-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into arm/fixes Reject zero-sized allocations in tee_dyn_shm_alloc_helper() * tag 'tee-fix-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee: tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper() Signed-off-by: Arnd Bergmann <arnd@arndb.de> |
||
|
Arnd Bergmann
|
67c050583f |
Fix kernel-doc warnings
-----BEGIN PGP SIGNATURE----- iQJUBAABCgA+FiEE0qerISgy2SKkqO79Wr/6JGat8H4FAmrBEIAgHGplbnMud2lr bGFuZGVyQG9zcy5xdWFsY29tbS5jb20ACgkQWr/6JGat8H42UBAAzlnYCD3zohQp 5H5MVA/3TCey4q7ww2GahM7e5lAueN1B/73pWIdjsB7ySNrbB8FPnN8+95d+hTev q4i7xabadOVPkE4h5BYMGFkYBYmdkzSb0nDCAW3GkypBdGehwYneK1fbMqMOATDz 6YHO4TLSgWcRQt0y1SHwP9w5ald+MYePVNbW3fIeZWnixMG7XSNYWQJbi7JTdOdr zkK30YyvwIGuzogug3vYCaSoryyto7rZWWVPz2y0GT6L3KReCTQXFG/ZA7D0a1PG 1/+bRTlvuEdz3cGesgW8f3hrwuCTm8m1+4P7yc0aDH8I2ghnL+ks/q80hG5W4Dq5 qgX0XYQe2Xek5mgq1KpkCP3QkJ+5ofctcLYBsOl3OBYi7Ap97F6f9hLbE157Oe4i 1lv+N/HpgfzicSbo75ORgIapBFdS0MjjaOPjO6uBX6qGC1YFnTeG2p8FWlr95sny mhovfL9Y3QYQ96kJXKwpPQBqP1QAP3MP8IqkHZhpzIUo32+nNqjDwUIIp66s0J5e n0xlhiuUJ6wJy8kY9Uryi+puN1JGF9UFiSJmS0bu8VRqsemDOpdQUEtv2CrZTnbk VdD9WDVLZcKjRRS3wHUJFIef72kDE0EDyDaLz4D/kX5wjhuZ2uVmQGIyr2JbMavj Qxd0ftaTFmwQAllqwwShETMS0dPkWqw= =PBha -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmrBa9AACgkQmmx57+YA GNmtYhAAhmL/k87jNgEiZdGkkXabyXzI2vYa6MYY3bQTzg2IME3gBOSluEiPK7Ge T8xwkiBoZdeoH4vN7lpXH3FktepcJ+UpuR/SeP0CF02QepYNevcB2hqSQcCKzakr pVERb+NvEkvLSxfEFe/VvZvG56o753C6Yv7E0WJEWttEnnAAUeRZlj/PbNhUasRq 8b8MF4p7RFAMbEccEz0+PGuCHRtMUPQ2kBB23dcB09Ljh8UunOOjCDjDVa2ckYuH qM1qbCQ+EFcP82fUbRsgZwloc57Gp7vtmx/uF6lG8XgqNphPf+B/0zYEyV/QcQZt AbKSj5RLHRm/mcR5qWJG1z98DpdPKdBXv7WTYPGlWXmICiiMqWixiOQyVSSnFKgk 43/oG3w5fqZJYLLdMJ+HRgEK/KD+TC3/gEOKXMkgx9Zoa4OuDkryOwPsotih1Fil fi5yGWZLW4VzbxLXn84NRtMZizyc7FL5/joA8DFQenfwtCAGYHUhMddVdCmW9W+c O7o4HErRS/M5EKo1CVI/NUvlGthNoeobZxYOyVsSurr9pEmDl7M1gapgKIJY8Dbc RK3eLdDckRuNo2cvYZilIUA+iJha2cQmJB7S2wKSk2E3Bb4uLoMipObcmQs5oCJG OxxzKvZHt5koFM2mE1kvK0zMgP4MOA0X5mK5HYeNYWvc2gqHMHY= =E1wW -----END PGP SIGNATURE----- Merge tag 'qcomtee-fix-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into arm/fixes Fix kernel-doc warnings * tag 'qcomtee-fix-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee: tee: qcomtee: fix kernel-doc warnings Signed-off-by: Arnd Bergmann <arnd@arndb.de> |
||
|
Linus Torvalds
|
a74306e2e6 |
Two small clk driver fixes:
- spacemit: k3: Fix an issue that will trigger a system hang due to
unavailable frequency.
- ti: composite: Reverts a commit that breaks OMAP3.
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQSkbTJwWGWqPd7cKQS30t0nXX7AhwUCasE5PAAKCRC30t0nXX7A
h53bAQDDZT2927gpHwGA2v7Die+Zim3kTz/V51BE1ilzSXc8cwD/WTndQx2y6V7x
31zCbTEkPX/nRl3Gt1qw+uscGwO7/AA=
=5SHU
-----END PGP SIGNATURE-----
Merge tag 'clk-fixes-for-linus-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux
Pull clk fixes from Brian Masney:
"Two small clk driver fixes:
- spacemit: k3: Fix an issue that will trigger a system hang due to
unavailable frequency
- ti: composite: Reverts a commit that breaks OMAP3"
* tag 'clk-fixes-for-linus-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:
clk: spacemit: k3: add CPU PLL rate tables
clk: ti: composite: resolve parent clocks by name again
|
||
|
Linus Torvalds
|
25d576ed11 |
Char/Misc/IIO fixes for 7.3-rc6
Here is a set of char/misc/iio and other small driver subsystem fixes
for 7.3-rc6 that resolve a number of reported issues. Included in here
are:
- lots of small iio driver fixes for reported problems.
- interconnect driver revert to resolve a regression
- nitro_enclaves driver fix for a use-after-free
- binder driver fixes for reported problems (in both the rust and C
versions)
All of these have been in linux-next with no reported issues
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCasDiSA8cZ3JlZ0Brcm9h
aC5jb20ACgkQMUfUDdst+yl3dQCdH7FcKA2Tw8/IlsWz6uprAdiwFVsAoLHwDHjt
ryfPUaZkAvaZL4oPR4Dq
=KRVz
-----END PGP SIGNATURE-----
Merge tag 'char-misc-7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
Pull char/misc/IIO fixes from Greg KH:
"Here is a set of char/misc/iio and other small driver subsystem fixes
for 7.3-rc6 that resolve a number of reported issues. Included in here
are:
- lots of small iio driver fixes for reported problems
- interconnect driver revert to resolve a regression
- nitro_enclaves driver fix for a use-after-free
- binder driver fixes for reported problems (in both the rust and C
versions)
All of these have been in linux-next with no reported issues"
* tag 'char-misc-7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (63 commits)
iio: adc: ad_sigma_delta: fix use-after-free on unbind
iio: accel: kxcjk-1013: reject duplicate event disable
iio: buffer: serialize buffer teardown with mode claims
iio: cdc: ad7150: fix OF matching and publish module aliases
iio: adc: ade9000: fix NULL pointer dereference in clkout registration
iio: adc: ad4030: fix invalid oversampling_ratio validation
iio: adc: ad7173: Fix digital filter configuration
iio: adc: stm32-adc: fix possible division by zero in processed channel
iio: adc: stm32-adc: fix check on internal channel availability
iio: proximity: isl29501: Fix return type of isl29501_register_write
iio: imu: inv_icm42607: restore runtime PM on system resume errors
iio: imu: inv_icm42607: propagate runtime suspend errors
iio: adc: pac1934: check ACPI label duplication
rust_binderfs: add transaction_report feature entry
rust_binder: reschedule node refcount update on thread exit
rust_binder: cancel deferred work items in thread exit
binderfs: fix UAF write in binder_add_device
binder: fix is_failure flag for superseded transaction cleanup
binder: fix leaked fd fixups on TF_UPDATE_TXN supersede
Revert "interconnect: qcom: x1e80100: enable QoS configuration"
...
|
||
|
Linus Torvalds
|
9a32e0754d |
TTY/Serial fixes for 7.3-rc6
Here are some small tty/serial driver fixes for 7.3-rc6. Nothing major
here, just lots of small fixes for reported issues, some of them very
long-standing:
- tty hangup fixes that have been there since the BKL days and kept
tripping people up over time.
- vt selection bugfix
- other vt bugfixes (memory leaks and screen update fixes)
- n_gsm bugfix
- qcom-geni serial driver bugfix
- 8250 serial driver bugfixes
- other tiny serial driver fixes
All of these have been in linux-next, the last few only a few days but
testing here seems solid (this pull request was generated on that tree)
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCasDolg8cZ3JlZ0Brcm9h
aC5jb20ACgkQMUfUDdst+ylcoACgyhWqs4wSTyeaaIX6JyVd0NUw4zQAnRtswXUh
ysy21VUW+OGNAJuqRUAd
=slH2
-----END PGP SIGNATURE-----
Merge tag 'tty-7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty
Pull tty/serial fixes from Greg KH:
"Here are some small tty/serial driver fixes for 7.3-rc6. Nothing major
here, just lots of small fixes for reported issues, some of them very
long-standing:
- tty hangup fixes that have been there since the BKL days and kept
tripping people up over time.
- vt selection bugfix
- other vt bugfixes (memory leaks and screen update fixes)
- n_gsm bugfix
- qcom-geni serial driver bugfix
- 8250 serial driver bugfixes
- other tiny serial driver fixes
All of these have been in linux-next, the last few only a few days but
testing here seems solid (this pull request was generated on that
tree)"
* tag 'tty-7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (37 commits)
tty: add missing driver flag kernel-doc colon
vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()
vt: skip screen update for DEC alignment test on backgroup consoles
vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF
serial: sc16is7xx: reduce TX refill rate with half-FIFO trigger
serial: sc16is7xx: refill TX FIFO below trigger using fresh TXLVL
serial: tegra: don't clear the Tx FIFO on an Rx-only reset
serial: sc16is7xx: fix TX gap caused by kfifo circular buffer wrap-around
tty: fix saved termios reset race
tty: serial: mpc52xx_uart: move static declarations up.
tty: serial: max3100: shut down timer before freeing port
tty: add break_wait kernel-doc
serial: qcom-geni: keep registered console runtime active
serial: qcom-geni: Fix unbalanced runtime PM resume for no_console_suspend
serial: qcom-geni: avoid unused-function warning
tty: serial: qcom_geni_serial: Keep console RX functional after deep idle
soc: qcom: geni-se: Correct QUP Core ICC vote constants
serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()
serial: vt8500: Fix clock reference leak in vt8500_serial_probe()
kgdboc: Fix tty driver reference leak in configure_kgdboc()
...
|
||
|
Linus Torvalds
|
903e23eda5 |
USB/Thunderbolt fixes for 7.3-rc6
Here is a big set of USB and Thunderbolt driver fixes for 7.3-rc6.
They were delayed on my side due to conference travel, not the fault of
the submitters at all. Included in here are:
- lots of small thunderbolt fixes for reported issues due to more
testing and devices and a few reverts as well based on that work
- more usb-serial device ids added
- usb-serial and cdc-acm driver hangup and other fixes
- dwc3 driver fixes for reported problems
- lots of usb gadget driver fixes as people again fuzz these drivers
and send in fixes, which is nice to finally see
- typec driver fixes for reported problems
- octeon-hcd driver fixes for reported problems
- more usb-storage quirks added
- other small USB driver bugs resolved for reported problems
All of these have been in linux-next without any reported issues
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCasDlTQ8cZ3JlZ0Brcm9h
aC5jb20ACgkQMUfUDdst+ylOTQCdEBigGDRRb0smeyW4VTv5cwCTXyMAoMvaredS
oOoIRhrQdBX3jlOUhm1N
=XZLj
-----END PGP SIGNATURE-----
Merge tag 'usb-7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
Pull USB/Thunderbolt fixes from Greg KH:
"Here is a big set of USB and Thunderbolt driver fixes for 7.3-rc6.
They were delayed on my side due to conference travel, not the fault
of the submitters at all. Included in here are:
- lots of small thunderbolt fixes for reported issues due to more
testing and devices and a few reverts as well based on that work
- more usb-serial device ids added
- usb-serial and cdc-acm driver hangup and other fixes
- dwc3 driver fixes for reported problems
- lots of usb gadget driver fixes as people again fuzz these drivers
and send in fixes, which is nice to finally see
- typec driver fixes for reported problems
- octeon-hcd driver fixes for reported problems
- more usb-storage quirks added
- other small USB driver bugs resolved for reported problems
All of these have been in linux-next without any reported issues"
* tag 'usb-7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (63 commits)
usb: dwc3: gadget: fix IRQ storm on invalid event buffer count
Revert "usb: dwc3: gadget: fix IRQ storm on invalid event buffer count"
USB: gadget: dummy-hcd: Fix wait for outstanding request completions
usb: typec: port-mapper: Only match USB4 port if host interface is available
usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe
usb: dwc3: gadget: fix IRQ storm on invalid event buffer count
usb: typec: ucsi: Get the connector fwnode based on reg value
usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd
usb: core: clear both ep_in and ep_out for non-ep0 control endpoints
USB: cdc-acm: skip URB restart in port_shutdown if disconnected
usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC
usb: gadget: aspeed-vhub: cancel wake work on device removal
thunderbolt: Disable CL states for the Anker Prime TB5 dock
thunderbolt: stream: Announce support for FMODE_NOWAIT
usb: typec: ucsi: displayport: Current CAM OOB index fixup
usb: ohci-st: disable controller wakeup on removal
usb: ohci-spear: disable controller wakeup on removal
usb: ohci-s3c2410: disable controller wakeup on removal
usb: ohci-da8xx: disable controller wakeup on cleanup
usb: cdns3: fix use-after-free in cdns3_gadget_exit()
...
|
||
|
Linus Torvalds
|
8623551a42 |
Input updates for v7.3-rc5
- A fix for the Samsung S6SY761 touchscreen driver to power on the controller before unmasking interrupts during resume and to re-enable touch sensing when the device is open - Updates to the Synaptics touchpad driver to enable SMBus/RMI4 mode on Lenovo ThinkPad T490 and restrict the ThinkPad T440p InterTouch disable quirk to LEN0036 so that ThinkPad L440 retains SMBus support - A quirk for the AT keyboard driver (atkbd) to skip keyboard deactivation on Lenovo IdeaPad Slim 3 15IWC11 so the internal keyboard functions properly - A DMI quirk for the i8042 controller to disable active multiplexing on Fujitsu LIFEBOOK U7410, preventing the internal keyboard and touchpad from dying shortly after boot. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQST2eWILY88ieB2DOtAj56VGEWXnAUCasCSQgAKCRBAj56VGEWX nF+JAQC4Hu4Xd9I1hIhUnJuLuMG3EzPWajzCQxYe50Nst7MAcgEAiW/+eAIJruut i3QCkvUoF8gPpOSjOn2Z2csKQeWBWgo= =BneD -----END PGP SIGNATURE----- Merge tag 'input-for-v7.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: - A fix for the Samsung S6SY761 touchscreen driver to power on the controller before unmasking interrupts during resume and to re-enable touch sensing when the device is open - Updates to the Synaptics touchpad driver to enable SMBus/RMI4 mode on Lenovo ThinkPad T490 and restrict the ThinkPad T440p InterTouch disable quirk to LEN0036 so that ThinkPad L440 retains SMBus support - A quirk for the AT keyboard driver (atkbd) to skip keyboard deactivation on Lenovo IdeaPad Slim 3 15IWC11 so the internal keyboard functions properly - A DMI quirk for the i8042 controller to disable active multiplexing on Fujitsu LIFEBOOK U7410, preventing the internal keyboard and touchpad from dying shortly after boot. * tag 'input-for-v7.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11 Input: s6sy761 - fix resume ordering and restore sensing Input: synaptics - limit T440p InterTouch quirk to LEN0036 Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410 Input: synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490 |
||
|
Linus Torvalds
|
f7c918b8d9 |
drm fixes for 7.3-rc6
xe: - keep VF LMEM bar size low if no VFs enabled i915: - Disable VRR DC balance by default to fix timing issues mediatek: - Add missing IS_ERR check for ovl_adaptor platform device - Fix VID_DOWNSAMPLE_CONFIG register offset - Fix pdev reference leak in mtk_drm_bind() - Fix runtime PM leak in mtk_hdmi_ddc_v2_probe() - Fix ovl adaptor platform device leak amdgpu: - dc_state_create_copy() fix - HDMI RGB limited range fix - eDP ASSR fix - DCE 6 fixes - DCE 8.1 fix - SI DPM fixes - Reset fixes - Workaround for multiple SDMA entities with DCC - PWM backlight fix - GPUVM fixes - Switcheroo fix - Error handling leak fixes - GC 6 unload FW leak fix - SDMA 7.1 fix - DML frame size limit fix - RGB vs YCbCr 4:4:4 fix - DP MST fix - DC Power module fixes - MacBookPro14,3 fix amdkfd: - SVM fix radeon: - sparc64 fix -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmrAxhoACgkQDHTzWXnE hr5QeQ/6A1vgxSH7c2FlI1u8WatzEM9CGwPI/NBMsAtrloVtBwvn02vyT9cCMKJZ L/Bb9DAzpPc4P4xW44KMF4T1DAb06FQzlHD/apK8CM4YcYS+OLGqq7fMeyMnQL9m iojDE4IyRWp/ihrZQAx2iQXRr3o6hZks7AAYugs0rRPaG/aI3KRhZTTGMTPcHEBM gPMBTqDZA55J9U7s3ZHuOVky/BJeSBhLiEb1sNZAIuxXsg4zSmp8jzyJXkIMQGoF t0b+e/VYVkktN/EFDUZ/LTjSoFsSLeJGvc7Rh6DR0dI/ZEPHeJ9MQD3M5D2dawOo arw6qWNBbN5/4uDImTK9WVZm0W+qVqidxFpjPbab05rrZeCaXUCzs8jVn3k6/h9L 3uGd6BDrANvAfxyucmY7JxhoqZV/BZJHhULunFLdkUtw3MpjfPdrVq3FCbaVAhb/ ocNRrOTyx+knMlGWZ+M5NY25/1VuDDa7b3IckdNEsTWQNTbDNU1tWi5jYIVQIBIB u7PMl5UFDOPVc6IPAcPXgXZlaJDwaG7RbLPozrZPqtKsAm1etcv0Tlc985aa9D1N Q8Iav5vUyX9jGJBTd8/yIzks1YkNjB4vG6uEpBBv/6ZfDAfDk0TzX1V5f7hfRWwB GKNwwQfeXwA6UiHS1BkunCOO2CifSWbYKER90nXQpC3nhVfOVVc= =lRm1 -----END PGP SIGNATURE----- Merge tag 'drm-fixes-2026-10-03' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Live from Brisbane airport, it's Saturday Night drm fixes. The misc fixes tree didn't get a PR this week, so I'll probably have that to you when I see it, there were a few patches in there. Otherwise amdgpu is the main act, mediatek has a guest spot, and xe/i915 bring in a fix each. xe: - keep VF LMEM bar size low if no VFs enabled i915: - Disable VRR DC balance by default to fix timing issues mediatek: - Add missing IS_ERR check for ovl_adaptor platform device - Fix VID_DOWNSAMPLE_CONFIG register offset - Fix pdev reference leak in mtk_drm_bind() - Fix runtime PM leak in mtk_hdmi_ddc_v2_probe() - Fix ovl adaptor platform device leak amdgpu: - dc_state_create_copy() fix - HDMI RGB limited range fix - eDP ASSR fix - DCE 6 fixes - DCE 8.1 fix - SI DPM fixes - Reset fixes - Workaround for multiple SDMA entities with DCC - PWM backlight fix - GPUVM fixes - Switcheroo fix - Error handling leak fixes - GC 6 unload FW leak fix - SDMA 7.1 fix - DML frame size limit fix - RGB vs YCbCr 4:4:4 fix - DP MST fix - DC Power module fixes - MacBookPro14,3 fix amdkfd: - SVM fix radeon: - sparc64 fix" * tag 'drm-fixes-2026-10-03' of https://gitlab.freedesktop.org/drm/kernel: (36 commits) drm/mediatek: Fix ovl adaptor platform device leak drm/mediatek: Fix runtime PM leak in mtk_hdmi_ddc_v2_probe() drm/mediatek: Fix pdev reference leak in mtk_drm_bind() drm/amdgpu: reset VI ASIC on MacBookPro14,3 drm/amd/pm/si: Fix updating clock limits on AC/DC drm/amd/display: Fix stale replay_events after mod_power stream removal drm/radeon: Read the VRAM VBIOS signature with readb() drm/amd/display: guard dc_sink dereferences in MST mode validation drm/amd/display: Try RGB before YCbCr 4:4:4 in stream validation drm/amd/display: Fix sanitizer check for the DML frame size limit drm/amdgpu/gmc12.1: properly pass flush_type to gmc_v12_1_flush_vm_hub() drm/amdgpu: drop userq callback assignment for sdma 7.1 drm/amdgpu/gfx6: fix firmware leak on teardown drm/amdgpu: fix ACP MFD device leak on init failure drm/amdgpu: fix IP instance memory leak on kobject add failure drm/amdgpu: skip the noirq suspend reset for a switcheroo-parked GPU drm/amdgpu/gmc12: properly pass flush_type to gmc_v12_0_flush_vm_hub() drm/amd/display: map PWM brightness through custom backlight curve drm/amdgpu: implement workaround for sdma dcc corruption drm/amdkfd: Fix always mapped range mapping to all ACCESS GPUs ... |
||
|
Linus Torvalds
|
c5adb6c8a2 |
arm64 fixes for -rc6
- Fix handling of CPU erratum #2645198 when batching pte updates - Fix truncation of CPU frequency calculation by using 64-bit arithmetic in arch_freq_get_on_cpu() - Work around AMU erratum #3821522 on Cortex-A725 - Fix panic when trying to restore an SVE sigframe on a CPU that only supports SME -----BEGIN PGP SIGNATURE----- iQFEBAABCgAuFiEEPxTL6PPUbjXGY88ct6xw3ITBYzQFAmq/tpYQHHdpbGxAa2Vy bmVsLm9yZwAKCRC3rHDchMFjNJ6gB/9ZmDMU4ED2AbyP7T8Q6FttzvH01X85F2yz hlaaXv/2MDzjGSiz0spxDAZOuteJF+WSLj1WjZhlyr95xnQWfumc6D89D+kHeNre +twed6hbOQTWJzLB+u8Ef+4nKGcztIZ/FafFvPD6PKjFuhG048al8X/6oNXetBPy Ka13ywRYhnccflsWaXyWlvSwfKn2xJHOnpu4Mfbsb9DfaULDLLahz2ug+6apwX23 tc/dy40Fi0G6wFzUQGF83R3nsyZgLiOv7LFBjjqDmoiu7W86KXn83UXEwHXrp8de Zbynk7F4Bxf0lsp6y+bxTmwzm8CwI355/NFU2ccxxu17e7Qv6PnJ =TRoC -----END PGP SIGNATURE----- Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "Half of this is broken hardware (AMU counters and TLB invalidation) and the other half is broken software (frequency scaling and signals). So it seems as though we're all as bad as each other. The AMU workaround is a little noisy, as it refactors an existing workaround so that it can more easily be applied to additional CPUs. Summary: - Fix handling of CPU erratum #2645198 when batching pte updates - Fix truncation of CPU frequency calculation by using 64-bit arithmetic in arch_freq_get_on_cpu() - Work around AMU erratum #3821522 on Cortex-A725 - Fix panic when trying to restore an SVE sigframe on a CPU that only supports SME" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems arm64: errata: Add Cortex-A725 erratum 3821522 workaround arm64: errata: Factor out broken AMU const counter cap arm64: topology: fix arch_freq_get_on_cpu() overflow above 4.19 GHz arm64: mm: Fix the break-before-make flush range for erratum 2645198 |
||
Martino Papero
|
3bf8d603fd |
Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11
The internal keyboard on the Lenovo IdeaPad Slim 3 15IWC11 (83RR) does not work correctly with the default i8042 settings. Using i8042.nopnp=1 and i8042.dumbkbd=1 restores keyboard input, but prevents the Caps Lock LED from working. Using i8042.nopnp=1 alone does not fix the keyboard. The laptop works correctly when atkbd_deactivate_fixup is used instead. Add a DMI quirk for the 83RR to enable it. This was tested without any i8042 command-line parameters. Keyboard input and the Caps Lock LED work correctly, including after suspend and resume and after a cold boot. Link: https://lore.kernel.org/all/4f43465f-98ba-4722-8e29-03df20315369@kernel.org/ Signed-off-by: Martino Papero <martino.papero@lcb.to.it> Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Link: https://patch.msgid.link/c0b597b8-e7ad-4fba-a2bb-5d252e3dfbd3@lcb.to.it Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> |
||
|
Linus Torvalds
|
e767a4ea70 |
Probes fixes for v7.3-rc5:
- fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching():
Exit handlers early if !rcu_is_watching() to prevent potential
use-after-free during unregistration in idle/quiescent states. Switch
to guard(rcu_sched_notrace) to avoid fast-path lockdep overhead and
recursion while ensuring safe grace period synchronization.
- kprobes: Skip disarmed probes when checking optkprobe overlap:
Continue past disarmed or unprepared probes in get_optimized_kprobe()
to find active optimized probes. This avoids overwriting active jump
displacements which can lead to panic.
-----BEGIN PGP SIGNATURE-----
iQFPBAABCgA5FiEEh7BulGwFlgAOi5DV2/sHvwUrPxsFAmq/XSIbHG1hc2FtaS5o
aXJhbWF0c3VAZ21haWwuY29tAAoJENv7B78FKz8bi4AH/3FQZSTq4yeJTbsl0otB
gsi2Wkys+DzHrbyfxTn9lKtj6CbfUNSVyzbNQjQI62MHBl8gQ0m2Tom+UDLgjvbQ
tEBsrOTSYuVVTXfP+Fb1E4uds8u9TbozS8185W+8xDWQxty/kFo5gjFe48Of7/s0
ujp9/4b8EuAgIm8/gkbwQKt5UOg1Qmhayh2KTA6JOI4ELmxIDyIFBn96k9QvJJTz
5AKDOzx+p5tfaKOl7njamFEoXgpFftF1y0xytNnS+W7vGFuGGhvf9zAekrRHN3g9
x97HdACt8mXDmL1XeYZwLpB2qTW97Ryv40RzqbyycEtOJV7t/910ZY5iFcyn/+6c
TyY=
=Huo4
-----END PGP SIGNATURE-----
Merge tag 'probes-fixes-v7.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull probes fixes from Masami Hiramatsu:
- fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()
Exit handlers early if !rcu_is_watching() to prevent potential
use-after-free during unregistration in idle/quiescent states. Switch
to guard(rcu_sched_notrace) to avoid fast-path lockdep overhead and
recursion while ensuring safe grace period synchronization.
- kprobes: Skip disarmed probes when checking optkprobe overlap
Continue past disarmed or unprepared probes in get_optimized_kprobe()
to find active optimized probes. This avoids overwriting active jump
displacements which can lead to panic.
* tag 'probes-fixes-v7.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
kprobes: Skip disarmed probes when checking optkprobe overlap
fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()
|