mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-11-13 07:31:07 +00:00
1,464,481 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Linus Torvalds
|
c5096fec0c |
selinux/stable-7.2 PR 20260805
-----BEGIN PGP SIGNATURE----- iQJIBAABCgAyFiEES0KozwfymdVUl37v6iDy2pc3iXMFAmpzc6gUHHBhdWxAcGF1 bC1tb29yZS5jb20ACgkQ6iDy2pc3iXPZug//SUeo33WvIYrLhlMYwPaVh9jqaR7c TG/bdUUofqPHxCXAMdmdqBVv3p3xU+7h6ds4CHFmgiWCUJ53ApbH+tl+lPxOzxTC awIWed5tJbFBiZ9ZQNc2hwaY5ETM0wQsVoZDAqWBZeu+Yf76ynjJN5fwxXRKBtcO 7DJR/NpPj1lHdp6AR3rfB/RQUVhg/0CnlFYb04Ef5aIwZ8fdlFh99GaZsQtMZvfO do6Yud/iNyEsL42lp7Zf21Ejlq8ubToLUCKEMygT2iDhKBq69DbOgMABkH0m6Bco A98s1KYARddzxT98bzRZkhzxiun0r9QVprYWzFPGi+pMkXi5eG6qgEMq/tkST313 kD3GsQPPQxY5k/AklD57/CoeI9rU7ioeZH/ZfFxDHupl5ExogI26VJ3h2obkdq3A aMZlr/rl5PPJD9qxjw8qFQd7Wn8A7Q1p041Bbf3pi1xxeVvdvP2z/e/MU9RQ7Xpr UIQNqd2QU3/uVstY743oximLRNQnRL7Aqq8r5KrbqeP9mlX6r+eEv2q0nBuqIAcR 7FOnkIn86ptl6prbTbG1FEYeRVypxAGuJrA6dDv8h2r4c4BuRc1Za3vVqluXH2Vg OxExgrP2Dg1TMQFAse4dTQlGOltLl1FvTd9JBm1t3kxpi0pbby2mUcHg3xjC/Cbm 8Dbxe9fEmsK+/jc= =YbZ/ -----END PGP SIGNATURE----- Merge tag 'selinux-pr-20260805' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux fixes from Paul Moore: - Continue to improve the validation of SELinux policies during load - Fix a SELinux regression caused by bpffs changes in v7.2-rc1 - Fix a SELinux preformance regression caused by SELinux changes in v7.2-rc1 * tag 'selinux-pr-20260805' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: check level category sets once at load time selinux: require every boolean value to be defined selinux: reject an unclaimed class value in security_get_classes() selinux: require a class's permission values to cover its permission count selinux: do not cancel a policy conversion that never started selinux: bpf: check SBLABEL_MNT before isec init selinux: reject a class permission count below its inherited common selinux: reject a permission value exceeding the class permission count |
||
|
Linus Torvalds
|
0d83957076 |
SoC fixes for 7.2, part 2
The majority of the fixes this time is for Qualcomm devicetree files, addressing various incorrect settings in chip specific dtsi files that prevent some feature from working correctly. Another three such issues are addressed on the Broadcom bcm5301x and bcm2712 SoC platforms. Two minor issues are addressed in nuvoton and aspeed specific SoC drivers, and the MAINTAINERS file is updated to add Billy Tsai and Ryan Chen as aspeed reviewers as well as clarify the NXP/Freescale entries. -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmpyTNUACgkQmmx57+YA GNmeThAAttKVEz+dS4P5j3MUPMxISPYg1GL7bePrP2bqXYpy28i6nsyMhgcm3Bf7 SgQEsFG4QCsJa2jkk46LDRGs+sSvtk9zNJOFklQ54KRhUQp/o4txzT7m4t8tY7Sj KodLk6lSj8iw8BrLVbYGs8wSxu2IdKZhi7ILiapZSlmxVTVrRF/+gQf9JFaX5KY3 GJS+hN3rX4+N9jxyrzvlUJP8aK4H2pchZbB1ZqBAAy7SLdXfU2lNKr1NX1oIUyAn VIbonzPnu+mZeSnPjUzZBGzMJHgC+XjUi7ntk5Ab1aBLDLXDC2QPGo3qTo1cIHQi C+/9cMkVvkCdZMXwEyQY12S43FjBQeLPkcFah5HNAO6m5+q4qo2UcHyBXGlaDAoT EGYw4fibd8UjI1shWQrx9Qsq0lHYi+uLtE2iJPsCoQPFiFK7tn3d3MisCbp91r5h XDP5WdAW1MERGpTyHvVqB2pBiqyRt9wFMa98GHEEPk989jV0X1YHuHWSHYr/ZhU1 0wdr4XTDB3qrkIlGaDddwt5hTb8/D2eHHS8RNHHZkYVa+Bi4t8dZB5rSRn5au6Qq YrHPIvkNqJF7RbjzhmQq242vtZaUR3x0d6e6X/VE+WuTmLaUF33+AoHlwGn3TWN4 OUmoBsMJ0ZVskOgiqR/VhlDeLOEDXTXd31DvnXzV/tsU9LGGVaY= =1+QO -----END PGP SIGNATURE----- Merge tag 'soc-fixes-7.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC fixes from Arnd Bergmann: "The majority of the fixes this time is for Qualcomm devicetree files, addressing various incorrect settings in chip specific dtsi files that prevent some feature from working correctly. Another three such issues are addressed on the Broadcom bcm5301x and bcm2712 SoC platforms. Two minor issues are addressed in nuvoton and aspeed specific SoC drivers, and the MAINTAINERS file is updated to add Billy Tsai and Ryan Chen as aspeed reviewers as well as clarify the NXP/Freescale entries" * tag 'soc-fixes-7.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: MAINTAINERS: add Ryan Chen and Billy Tsai as reviewer for ARM/ASPEED ARM: dts: BCM5301X: EA9200: fix NVRAM size ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt arm64: dts: qcom: eliza: Fix DSI1 phy reference clock rate MAINTAINERS: ARM/FREESCALE: merge Layerscape entry into i.MX entry ARM: npcm: Fix OF node refcount leaks in SMP setup soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read arm64: dts: broadcom: bcm2712: Remove non-functional EL2 virtual timer arm64: dts: qcom: sdm850-lenovo-yoga-c630: lower PSCI cluster idle arm64: dts: qcom: sc8280xp: gaokun3: correct EC interrupt pin arm64: dts: qcom: sc8280xp: add several missing pdc map entries arm64: dts: qcom: sm8650: Fix IPA IMEM slice arm64: dts: qcom: monaco: Add default GIC address cells arm64: dts: qcom: purwa: Fix GPU IOMMU property arm64: dts: qcom: glymur: fix QUP serial engine IRQs arm64: dts: qcom: glymur: fix PCIe SMMU interrupts |
||
Andy Lutomirski
|
478a1c3abe |
mm: fix incorrect flush address in direct page table reclaim
When zap_pte_range reclaims a page table, it does:
pte_free_tlb(tlb, pmd_pgtable(pmdval), addr);
and this is unconditionally wrong: if this code executes, addr *always*
points one past the end of the range covered by the table. The addr
parameter is used to flush the TLB (really the paging-structure-cache)
to drop references to the to-be-freed table, and any architecture that
cares about the parameter will flush the wrong address. (But they'll
still free the correct page).
I think it's worth contemplating why the kernel works at all.
If we hit the offending line of code, we will first clear the PMD entry
(line 1954, zap_empty_pte_table), then we will issue pending flushes if
force_flush is set (tlb_flush_mmu_tlbonly(tlb)), then we will skip the
retry on line 1979 (phew!), and then we will do the offending
pte_free_tlb call. *Or* we will clear the PMD entry immediately before
pte_free_tlb (line 1983, zap_pte_table_if_empty).
If we have any pending flushes (i.e. we actually zapped any last-level
entries) at the time we clear the PMD entry, then the flush really ought
to flush all references to the table (Linus certainly seems to think it
will on all architectures [0]).
The condition under which we have no accumulated flushes at the time of
the clear is very complex (the whole zap_pte_range function has absurdly
complex control flow). If we do hit the bad case, then we will end up
clearing the PMD entry after the last time the range is flushed, and any
CPU is free to cache a reference to the (empty) page table. If this
happens due to an ordinary read or write, it would segfault, so it would
be rare. But the cache could be speculatively filled as well. Then
we'll flush the wrong address and then free and possibly reuse the
table.
On x86, even flushing the wrong address works on non-KPTI Intel systems
because INVLPG flushes *all* paging-structure-caches, not just the ones
for the target address. But INVPCID does not, and flush_tlb_one_user
will use INVPCID if it's available. And then we're toast. AMD systems
are more susceptible: we set the EFER.TCE bit, which makes even INVLPG
only flush the target address.
I think this might fix an issue in ripgrep reported here:
https://github.com/BurntSushi/ripgrep/issues/3494
[0] https://lore.kernel.org/all/CA+55aFzBggoXtNXQeng5d_mRoDnaMBE5Y+URs+PHR67nUpMtaw@mail.gmail.com/T/#u
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Fixes:
|
||
|
Linus Torvalds
|
c21bb41938 |
vhost,vdpa: last minute fixes
A small number of fixes that seem too important to wait until the next release. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> -----BEGIN PGP SIGNATURE----- iQFDBAABCgAtFiEEXQn9CHHI+FuUyooNKB8NuNKNVGkFAmpxXrUPHG1zdEByZWRo YXQuY29tAAoJECgfDbjSjVRpX5IIAJhVIR6djPQ/Hf24pHD+wHPAvKbV4+CCrtlv S/Frw7R8bTn0byvr3iuAHcuWLKSMXPYxfGKQRI1E7E4vbbKD81N0p+vYiO41pyV6 d7BKUxSIEOEExJ8c198ajo+S2n5OdLjayLfYagzqbClwb2Snz+mdGjBIcSLJttSb i53LebWHDXV8/uZLkyd0H8YlHXHmxroIOq16UpwwvO+lgafxZPs6ZinBS5fwEJxk fyKKf1rdoPbqQhrDU5IaHlQdqS+ZjL+3ab3rT49wCSnn+FKpzzikhxELNylZZMof StC/Y3HAbC8rY54ZMjxGcDt1KfntRchZySuOmhZ/Av+sCXaegm0= =EMjO -----END PGP SIGNATURE----- Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull vhost/vdpa fixes from Michael Tsirkin: "A small number of fixes that seem too important to wait until the next release" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: vhost-scsi: reject feature changes after endpoint vhost-scsi: flush backend after device ioctls vhost: reset the vring metadata cache on vring reconfiguration vhost-scsi: Validate T10 PI scatterlist counts vdpa/mlx5: Fix buffer length in create_direct_keys() vhost/vdpa: reject overflowing PA map page counts on 32-bit vhost_iotlb: bound map allocation in add_range |
||
Arnd Bergmann
|
c7a127371c |
aspeed: Update MAINTAINERS for 7.3
Add Ryan and Billy as reviewers for ASPEED SoC patches. I asked both to add themselves to increase ASPEED's visibility of upstream changes. -----BEGIN PGP SIGNATURE----- iJIEABYKADoWIQSoUT1x3bOSX/nAa8ajM9GZTrjhpgUCanGGJhwcYW5kcmV3QGNv ZGVjb25zdHJ1Y3QuY29tLmF1AAoJEKMz0ZlOuOGmDFoA+wVan8QYBaVyH4ESK0nz 73koP4V+NcoMRFeH7WHlKi3yAQDkXhq553bJXUlEhM8Gmy8A+29bjc1YsbwqQ1k9 DBw6DA== =IW7p -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmpyPqcACgkQmmx57+YA GNka7RAAgSHmYtLxG557sn7Esdovym8DDG53hUGimyzXbGm2DorV51kNzDyN9tUt S4Qys/V9NjqAGl7Lpk91uEFvfY5Box6hE9nq6kxzKpOmqhEvAaqhEEsFp27qv7Ce Qtiofw8705H1XbR7l7oaHvuUVjgRHdG5PYsHZU+6PADkVWGPIoeETUiToANfnjz6 b0JzNtyqPZFvjolt19p6LDENWEqwmONlR4CDqBWEHvZQxt5tizq1iq+cFb7mO+gg 4xvYVd4s0m8cL6l6ycJx3pXEk6wQL4CyZKnVS+kuVoA5wJzUtq4oPtIVdC+2LXZA j66GdUxVo2YKqcV7m6kT2xFo8NBAOQrcVTFfe7qFh2qmgcFDm415j7a5I5xN2YsX KJh3XefNQjP5y8JrA6K+o3BaoDrLRqPk4f6P9I1yLIjZV/3YjXoh/Ey6ew3DfZi0 FURUTrLEKNLI+PKaBFxFM3oLBn/K6twkBrobRKoDa5OQHkE0h4nS3Qz4esFRARK6 PyA3oqAdbx6fFVV1rdiJQk3KM+ctkvoIYAu+n6Gb4ahgTeZhxUHkrVRX7tUdKrqI wlTpd3N1km4aGkJD62HjLgdCPORUWLU9GcDicu93XvmtSQcajYERIKgM89sK1Lqr XAVA3YoRjU3xtdrSEQqF74vrXJXzykH13SPDGdf1sT8mZKDCO4Y= =qDYR -----END PGP SIGNATURE----- Merge tag 'aspeed-7.3-maintainers-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux into arm/fixes aspeed: Update MAINTAINERS for 7.3 Add Ryan and Billy as reviewers for ASPEED SoC patches. I asked both to add themselves to increase ASPEED's visibility of upstream changes. * tag 'aspeed-7.3-maintainers-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux: MAINTAINERS: add Ryan Chen and Billy Tsai as reviewer for ARM/ASPEED Signed-off-by: Arnd Bergmann <arnd@arndb.de> |
||
|
Arnd Bergmann
|
c73d40a1e7 |
nuvoton: First batch of ARM arch fixes for 7.2
Again a one-off change, fixing OF resource leaks in the SMP-bringup code for the NPCM7xx SoCs. -----BEGIN PGP SIGNATURE----- iJEEABYKADoWIQSoUT1x3bOSX/nAa8ajM9GZTrjhpgUCanGNzhwcYW5kcmV3QGNv ZGVjb25zdHJ1Y3QuY29tLmF1AAoJEKMz0ZlOuOGm7q0BALVNMCCpkq7EUdoXlLXQ kKLaa/eHSsRjlVkWysp8KMNhAPitU483DtqvcGiPeLD/ljIc4SC6CubwoE0YcNdg SCkL =jyvO -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmpyPKcACgkQmmx57+YA GNnK7Q//QYOANi8ZC4dUSgypONH8evH/heNwCKIzHM836KIdHVM3DnsFLBCaK+n/ dk0L1qs+Ko/PbcwZ0RSD0S6D8MGRpd1sV2FzHtTgnB0Z8r4aRJ0YPB2V3YbBsYf3 q5QZfbfAgvFA4hCtXTkhK0rzjiHKaJHUBHFeKtQKzISiQ5FNzw3IODV8uy8ZTxQS kpfbwVAepwpJ71/EEhRlXySrbr4q5Tk9DVat6rPXVUPzyAmb0lVCa0QQd4JaWKF8 OwYJjjNjJZvR6/8Xkr2z8+rio4/5Y7z0O5O7QzXHcB8f7098Tyq3We5s2wjKPjiW rAITG2uuesbQq3voIWQRtppRFFENZlCTmtUkkYJbuH23lERdbnGzJWeel0q/H0kR weeTUpGcVYocCh43OIhMZ+n5/vQuI8Xd7Yf7phHrXrx4y+UOVHCWA+4+N02u1qZj ufviSp4VZdepjBQxBytrd0LWYIvzsQOOzWHMCoUiWCz1uAI3b9LISupz0dXPLPtv xj5TbEm9UFCeQzFav6bvzvO/Wwy/XLKsm65V/T2ixeYsUtaKLDw8dqwgByx3TjNv 3BUeVtXAn0m7WBM1EP+1AKuKG+9FcU+TcnvBKF8LgVh7q4zZYuKBAWZAHuuEvLZv eDtMpWL04b/IDt98xMipOWrfnOEb3Vgwr40o3RWxP3ZBOEXi8+k= =g+dz -----END PGP SIGNATURE----- Merge tag 'nuvoton-7.2-arm-fixes-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux into arm/fixes nuvoton: First batch of ARM arch fixes for 7.2 Again a one-off change, fixing OF resource leaks in the SMP-bringup code for the NPCM7xx SoCs. * tag 'nuvoton-7.2-arm-fixes-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux: ARM: npcm: Fix OF node refcount leaks in SMP setup Signed-off-by: Arnd Bergmann <arnd@arndb.de> |
||
|
Linus Torvalds
|
31996e14bd |
- Fix a robust futexes exit race (Keno Fischer)
Signed-off-by: Ingo Molnar <mingo@kernel.org> -----BEGIN PGP SIGNATURE----- iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmpyKL8RHG1pbmdvQGtl cm5lbC5vcmcACgkQEnMQ0APhK1hHZA/+MuV0q1TjWfNot/8wX0o3dXMxFW041gg9 CNZK086nI1rdhiFwmu4a6QQ/CgKe8tHFa3SET+PJcwNBtxX8AoMma8hw+3E6FeLL DV/HM04S3CZahVrvbMwPl+ewPW/Nxjy0e8xO6qJzBQetUALAElzf3u9PofVbL8tI fQLzL616SzSZNk5NbUvP5EuJxM24ZfZET9fkHvF3ybq90gT2jM3EHw9hau+clXHz JqIKvhclRw3xqfEh1kbpYd2Q49v+0jvr2qYUbc9lDGarn/a/xBiOIS3rX9RbEyvA BgMmbu4NOyoFAiVZ3pRt+hJh/T55Zbyg5Yaveov7PfXXk9IwdXVtVkrcJTJNQkOW Qi5HiBx0bfLl1B5CeEUx4idpWo2uuNantlid9U+tVV1YfkUmshS8NMECvVT17kqQ Ck4ZbwMpoHhqei3e1wBIWFGOP9VgyvRTm44DykV8elbJ3w4/YOkFl9f4XF95mgm9 JaTGxQOe4r4hetKRddPouvtzbWrCbdxsQY9WLhBJq09nbJEubW8F4nhGZbaY618d OMY7RfaXXCaV0rvaESpNLSiy4WrzJ3D0shmirL8jZBrW4gckJiYnfI7QpXFZ6CyS XeJgWPCuV5L2CLTehE2t8R6zGCTNadebpKZ9M78xxGuQ+pCtaElZ+4t4Esw8Jmqb beFBOYmimjE= =IPYC -----END PGP SIGNATURE----- Merge tag 'locking-urgent-2026-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull futex fix from Ingo Molnar: - Fix a robust futexes exit race (Keno Fischer) * tag 'locking-urgent-2026-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: futex: Prevent robust futex exit race some more |
||
|
Linus Torvalds
|
562bfb501c |
integrity-v7.2-rc7
-----BEGIN PGP SIGNATURE----- iIoEABYKADIWIQQdXVVFGN5XqKr1Hj7LwZzRsCrn5QUCanIVbBQcem9oYXJAbGlu dXguaWJtLmNvbQAKCRDLwZzRsCrn5ZZJAPoCMJOvZSkj5EZVUr/fsO6MiC8rQDu6 OhNe4lripeVOowD/RapG1/PcGuYNlqtOxjFaB/Y0FYRH2hnGHpgqW/If0ws= =2zQ5 -----END PGP SIGNATURE----- Merge tag 'integrity-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity Pull integrity fixes from Mimi Zohar: "Two IMA bug fixes: one addresses a potential integer underflow, the other instantiates two LSM hooks" * tag 'integrity-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: ima: Instantiate file_truncate and path_truncate hooks ima: fix out-of-bounds read in xattr_verify() |
||
|
Linus Torvalds
|
7c350d079e |
More NFS Client Bugfixes for Linux 7.2-rc
Bugfixes: * NFS: Pin the 'struct nfs_server' during a FREE_STATEID call * NFS: Decrement refcounts if allocating nfs_free_stateid_data fails * NFSv4.2: fix nfs4_listxattr size accounting -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEnZ5MQTpR7cLU7KEp18tUv7ClQOsFAmpyFAUACgkQ18tUv7Cl QOv7BRAAkxQD75eXSHScM4KJKmpkRGG0NFhUFg8bSUxpCD+KUmeoFV5jlpqLMeUh nsE+Pzpt+eqbsxOkQh/Ds3IibEcXSKKzbgGAP8vSJhzM3FtSpFAmH4N0rw8XvkNY YNA10JPuJORrFHRFRtT9orliIb5JHofx2ia/OPmLMOS43cpEjN01n8lOAtoTexYS NuTskTce4wyyPEJFre9Pl6IgKJTaA5hNt8R2UUEnQrtCzXPtlYh9r8cF3axj/FtV pmzVKRrsEMYV7AJFz18sSbi31GM/n/Usvj9z1znmNGgZeyFYqxhYXbe3L9mEwH7I u7Ecrg8o8sLfLlP/MTm3prXHgcAwus0EavjhyuAG4teRfSQ7MOmTAHHXc3hlwGg/ iFOWdYZIOXSlcGOKIwuAuQTXwgf337lG93QhHhZWtimSVip44tebyLDLZWB3T8Uw 93D0rzXuk8YPogRPtquKtpxglpM64MGF8Z37J5U67D2PRwWJyfPetolED5nkc5Gz 831h4vt4mKxeti0paOc91ruxuU5YYB0umMox6QJ1G35G+8b23BcszHtc/Cwehbvj qFTC0E4OT8VVmScbP+yu9YkM8yLPTnHur9cjh5ocvk18MpqpDWctiQD4WsOWxLIH zplTZNhj5QH6rq8KTzv09OIgp+jtLHkymtL0grU9N4jzuIr0RQM= =ZJe2 -----END PGP SIGNATURE----- Merge tag 'nfs-for-7.2-3' of git://git.linux-nfs.org/projects/anna/linux-nfs Pull NFS client fixes from Anna Schumaker: - Pin the 'struct nfs_server' during a FREE_STATEID call - Decrement refcounts if allocating nfs_free_stateid_data fails - Fix nfs4_listxattr size accounting for * tag 'nfs-for-7.2-3' of git://git.linux-nfs.org/projects/anna/linux-nfs: NFSv4.2: fix nfs4_listxattr size accounting NFS: Decrement refcounts if allocating nfs_free_stateid_data fails NFS: Pin the 'struct nfs_server' during a FREE_STATEID call |
||
Mimi Zohar
|
b80bed5c87 |
ima: Instantiate file_truncate and path_truncate hooks
Instantiate the file_truncate and path_truncate LSM hooks to reset the action cache flags (IMA_DONE_MASK) as soon as truncation is requested, so the file, based on policy, is re-collected, re-measured, re-audited, and re-appraised on next access. Tested-by: Frederick Lawler <fred@cloudflare.com> Cc: stable@vger.kernel.org Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> |
||
Lincoln Wallace
|
5ff232d311 |
ima: fix out-of-bounds read in xattr_verify()
The digest-length check in xattr_verify() mixes int and size_t:
if (xattr_len - sizeof(xattr_value->type) - hash_start >=
iint->ima_hash->length)
sizeof() yields size_t, so the usual arithmetic conversions promote
the whole left-hand side to unsigned 64-bit before the subtraction
runs. For a truncated xattr this underflows instead of going negative:
a 1-byte IMA_XATTR_DIGEST_NG xattr (xattr_len == 1, hash_start == 1)
turns "1 - 1 - 1" into SIZE_MAX, which is trivially >= ima_hash->length.
The check then passes and the following memcmp() reads
iint->ima_hash->length bytes starting past the end of the buffer
vfs_getxattr_alloc() allocated for it.
Nothing upstream clamps xattr_len back into a safe range first:
ima_get_hash_algo() only special-cases xattr_len < 2 to pick a default
algorithm, and evm_verifyxattr() returns INTEGRITY_UNKNOWN rather than
failing when no HMAC key is loaded, so a truncated security.ima value
reaches the length check as-is.
Rewrite the comparison so every operand stays a signed int and no
implicit conversion to size_t can occur.
Fixes:
|
||
Stephen Smalley
|
9c1cc4a7f7 |
selinux: check level category sets once at load time
As reported by Jiri Vozar, commit |
||
|
Arnd Bergmann
|
7140eea247 |
aspeed: First batch of driver fixes for 7.2
This time it's a single fix for a kfifo overrun, caused by the the lpc-snoop driver implementation behaving as multiple consumers. -----BEGIN PGP SIGNATURE----- iJIEABYKADoWIQSoUT1x3bOSX/nAa8ajM9GZTrjhpgUCanGJnxwcYW5kcmV3QGNv ZGVjb25zdHJ1Y3QuY29tLmF1AAoJEKMz0ZlOuOGmFzUA/RYKJEPxwID+xqkE6wtz oJjsSkOqFzhjixC5AafLnz6OAQCe2bJyi7AWkBG2EiBKBp2GIvF1pZ1md4KXDDPw P7qICQ== =VvQf -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmpxqWYACgkQmmx57+YA GNkcjBAAgvhEalcZqXurAxTB/A6Sq9PU1/g0SOfdPyM36+edqcNwFzU2By9ntnmN m++upZpiFU7sSAu79FrHbUu0XXRrAViXX9Oay1wcpIaQtwCcZrGIQg3fEcMYmhNz kjAMGCFXeKqvNblNXK9ydtUWQU1DQGxpH2mAWU+zbSaGL6F+xHAdv0rNNt9gXmEC a3D5g1acSftvSYnw24ybtuojH8jjlYDGL7fiYeZfUX7eo3EyyMOAm1OFGWCVjNIG 9dsSZL2Lt/sodbvd0/+qOwZryYUl2BWDw9Aq0ttVVvMn2d7cnwET8TOAUV0iQBYA EbYNp+NfT+Hgc52WFMtkCrepmALZTFOJFn4hqE+KxpWjdRLWmz9jzplJKW/fZKhp WGxlrNiNc+GAFaMUXNpZA/KvtQbcpEbl7oeyVzZWZYI7dcnPAruT9lLeq3c275r6 mfIOH0c2DQPQ61YVIneCkten4ia/dAhTuQp0fv0Gz5k+hpUv0OpJFVolzV8j22Gw CG8fEvWlGLqUrzR8nEdNCxgR5KuatSWiaR5E30043+1jZFCsXG49KD1goi9TNnPZ 1Y9k4lomT8HzXwpQFL/tu+42lYZlyS1waFEaNUqrNqZPriQf2/ySqsqctJ5hXL5n XWBI+uut4LmUIkUxhpbo0cogJwJhRIZVWI9hN0D7E33iQkQckZA= =JG8D -----END PGP SIGNATURE----- Merge tag 'aspeed-7.2-driver-fixes-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux into arm/fixes aspeed: First batch of driver fixes for 7.2 This time it's a single fix for a kfifo overrun, caused by the the lpc-snoop driver implementation behaving as multiple consumers. * tag 'aspeed-7.2-driver-fixes-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux: soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read Signed-off-by: Arnd Bergmann <arnd@arndb.de> |
||
Billy Tsai
|
6cdd8cbbf8 |
MAINTAINERS: add Ryan Chen and Billy Tsai as reviewer for ARM/ASPEED
Add Ryan Chen and myself as a reviewer for the ARM/ASPEED MACHINE SUPPORT entry to reflect ongoing review and contribution work on AST2xxx/AST27xx platform support. Signed-off-by: Billy Tsai <billy_tsai@aspeedtech.com> Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au> |
||
Jia Jia
|
42bc45df59 |
vhost-scsi: reject feature changes after endpoint
vhost_scsi_setup_vq_cmds() runs from VHOST_SCSI_SET_ENDPOINT and allocates
each command's protection scatterlist array (prot_sgl) according to the
acknowledged VIRTIO_SCSI_F_T10_PI bit. The command pools are not rebuilt
when VHOST_SET_FEATURES changes that bit later.
Although virtio feature bits must not change after feature negotiation,
vhost_scsi_set_features() currently accepts such a request after the
endpoint is active and updates acked_features. Enabling T10-PI after
endpoint setup therefore leaves prot_sgl NULL while the I/O path follows
the new feature bit.
For a 129-page protection payload, vhost_scsi_mapal() passes the missing
first chunk to sg_alloc_table_chained():
sg_alloc_table_chained(table, 129, first_chunk=NULL,
nents_first_chunk=inline_sg_cnt)
sg_pool_index() then hits:
BUG_ON(nents > SG_CHUNK_SIZE); /* 129 > 128 */
The kernel reported the following call trace and register state:
Call Trace:
<TASK>
? __sg_alloc_table+0x1d8/0x250
? __pfx_vhost_run_work_list+0x10/0x10 [vhost]
sg_alloc_table_chained+0x59/0xf0
? __pfx_sg_pool_alloc+0x10/0x10
? vhost_scsi_calc_sgls.constprop.0+0x43/0x60 [vhost_scsi]
vhost_scsi_handle_vq+0xf02/0x1700 [vhost_scsi]
? __pfx_vhost_scsi_handle_vq+0x10/0x10 [vhost_scsi]
vhost_scsi_handle_kick+0x37/0x50 [vhost_scsi]
vhost_run_work_list+0x8e/0xd0 [vhost]
vhost_task_fn+0xe1/0x210
ret_from_fork+0x348/0x540
</TASK>
RIP: 0010:0x4
CR2 = 0x4
RSP: 0018:ffffc90000dbf940 EFLAGS: 00010202
RAX: ffffffff82396810 RBX: ffff88811dc28b80 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000820 RDI: 0000000000000081
VHOST_F_LOG_ALL is a vhost-specific runtime feature and remains the only
exception.
Reject changes to any feature other than VHOST_F_LOG_ALL while the
endpoint is active. This preserves the existing runtime log toggle while
preventing feature-dependent command resources and data-path state from
becoming inconsistent. Userspace must clear the endpoint before changing
any other negotiated feature and set the endpoint up again afterward.
Fixes:
|
||
|
Jia Jia
|
22598f55a4 |
vhost-scsi: flush backend after device ioctls
vhost-scsi translates guest response descriptors into userspace iovecs when commands are submitted. Target-core completes those commands asynchronously, so VHOST_SET_MEM_TABLE can replace the memory table while an in-flight command still retains response iovecs translated through the old table. If the old mapping is reused after VHOST_SET_MEM_TABLE returns, command completion can write the response to an unrelated userspace object. Flush the vhost-scsi backend after vhost_dev_ioctl() handles a device ioctl. This waits for in-flight commands that can still use the old response iovecs before the ioctl returns. Signed-off-by: Jia Jia <physicalmtea@gmail.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <20260724060919.1569170-1-physicalmtea@gmail.com> |
||
Jun Yang
|
de845981da |
vhost: reset the vring metadata cache on vring reconfiguration
vq->meta_iotlb[] caches the vhost_iotlb_map that backs each vring
metadata region, and iotlb_access_ok() returns early on a cache hit,
taking the hit as proof that the region has already been validated:
if (vhost_vq_meta_fetch(vq, addr, len, type))
return true;
The cache is reset on VHOST_IOTLB_UPDATE and VHOST_IOTLB_INVALIDATE, on
device IOTLB (re)initialisation and on vq reset, but not when
VHOST_SET_VRING_ADDR replaces vq->desc, vq->avail and vq->used, nor when
VHOST_SET_VRING_NUM changes the region sizes.
With a device IOTLB attached both ioctls are accepted while the vq is
live, and neither validates the addresses at ioctl time: vq_access_ok()
and vq_log_used_access_ok() return true early because the addresses are
GIOVAs, deferring validation to prefetch time. Once the cache has been
populated that deferred validation no longer runs -- vq_meta_prefetch()
hits the stale entry and returns true -- and vhost_vq_meta_fetch() keeps
translating through the old mapping as
map->addr + addr - map->start
for an address the mapping no longer covers. vhost_copy_to_user() and
vhost_copy_from_user() consume the result with __copy_to_user() and
__copy_from_user(), which do not check it either, so a subsequent used
ring update or descriptor fetch accesses memory outside the region the
IOTLB actually maps.
Reset the metadata cache whenever the vring is reconfigured, so the new
addresses are pushed back through iotlb_access_ok()'s slow path.
Fixes:
|
||
Linfeng Sun
|
d876c493fc |
vhost-scsi: Validate T10 PI scatterlist counts
When T10 PI is negotiated, vhost-scsi splits protection bytes from
the data iterator before mapping the request scatterlists. A malformed
request can claim protection bytes that cover or exceed the full payload
length. The former leaves no data bytes to map, while the latter
underflows exp_data_len before advancing the iterator. Both cases can let
a zero data SGL count reach sg_alloc_table_chained(), which triggers
BUG_ON(!nents).
Reject protection lengths that cover or exceed the payload before
subtracting prot_bytes and advancing the iterator. Also propagate
negative errors from the protection SGL calculation before calling the
allocator, matching the data SGL path.
Fixes:
|
||
Bryam Vargas
|
a93d37a09b |
selinux: require every boolean value to be defined
p_bools.nprim comes from the policy image independently of how many
booleans follow it, and cond_index_bool() fills bool_val_to_struct[] at
value - 1, so a count larger than the values present leaves NULL entries.
Every user of that array then walks it by index and dereferences each
entry: cond_evaluate_expr() on the access-vector path,
security_get_bools() and security_get_bool_value() behind selinuxfs, and
security_set_bools(). A sparse class value is absorbed by
policydb_class_isvalid() and its siblings; booleans have no such
predicate, and no consumer that could use one.
Reject a boolean value that no boolean defines, once, where the array is
built. Conforming policies define every boolean they declare and are
unaffected.
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Bryam Vargas
|
22b05fec62 |
selinux: reject an unclaimed class value in security_get_classes()
security_get_classes() sizes an array by p_classes.nprim and fills it at
value - 1, so a class value the policy never defines leaves a NULL.
sel_make_classes() passes every entry to sel_make_dir(), reaching the same
d_alloc_name() dereference as the permission array. The class symbol table
is allowed to be sparse (policydb_class_isvalid() exists to absorb that),
but this getter builds its own array straight from the hash table and has
no such predicate.
Fail the lookup when a value went unclaimed instead of handing out the
NULL. Conforming policies define every class they declare and are
unaffected.
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Bryam Vargas
|
b98a8ac507 |
selinux: require a class's permission values to cover its permission count
security_get_permissions() sizes an array by the class's permissions.nprim
and fills it at value - 1, from the inherited common's permission table and
then the class's own. A value no permission defines leaves a NULL that
sel_make_perm_files() passes to d_alloc_name(), an oops inside
sel_write_load() that strands selinux_state.policy_mutex and leaves every
later load in uninterruptible sleep; two permissions sharing a value
overwrite the first kstrdup(). Bounding each value by nprim catches
neither, and neither would a count: the symbol table is keyed on the
permission name, so duplicates pass.
Track the values each permission table claims and require them to cover
exactly what its count declares, rejecting a count no value can reach.
Conforming policies are unaffected.
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Bryam Vargas
|
e5c0235a3c |
selinux: do not cancel a policy conversion that never started
sel_write_load() calls selinux_policy_cancel() when sel_make_policy_nodes()
fails, and that helper dereferences the outgoing policy to cancel its
sidtab conversion. On the first policy load there is no outgoing policy:
security_load_policy() returns early for that case, before it converts
anything, and state->policy is still NULL. A first load that fails while
building the selinuxfs tree therefore takes a NULL dereference in
selinux_policy_cancel(), reached from a write(2) to /sys/fs/selinux/load.
Skip the cancel when there is no old policy, mirroring the check
security_load_policy() already makes before it converts.
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Linus Torvalds
|
848acc8ffe |
fsverity fix for v7.2-rc7
Fix a regression where truncating a file with fsverity enabled started being allowed on kernels without fsverity support. -----BEGIN PGP SIGNATURE----- iIoEABYIADIWIQSacvsUNc7UX4ntmEPzXCl4vpKOKwUCanDeAhQcZWJpZ2dlcnNA a2VybmVsLm9yZwAKCRDzXCl4vpKOKyYTAQCTfYq9OAJPt0ehUHTPpQeYESZAKRjo xxpirrJdHkhpgwEAlLXBLRHtlE43p/5wb6EzTk3ra31Kg5bKzjzDFtDz5QQ= =jMbW -----END PGP SIGNATURE----- Merge tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fsverity/linux Pull fsverity fix from Eric Biggers: "Fix a regression where truncating a file with fsverity enabled started being allowed on kernels without fsverity support" * tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fsverity/linux: fs,fsverity: remove check for fsverity being enabled in setattr_prepare() |
||
|
Linus Torvalds
|
2e718c8831 |
fscrypt fix for v7.2-rc7
Fix a bug where FS_IOC_SET_ENCRYPTION_POLICY checked the original uid rather than the idmapped one. -----BEGIN PGP SIGNATURE----- iIoEABYIADIWIQSacvsUNc7UX4ntmEPzXCl4vpKOKwUCanDcuBQcZWJpZ2dlcnNA a2VybmVsLm9yZwAKCRDzXCl4vpKOK2y8AQD8CcQNNDxRu49rzhRaY9+giG9glOgT gYTY8CF1+Umo9AD/aMpIftPqnz2WUX81+Ch5ad5EnlHsfQ+S7dIdp16Zegw= =FD4q -----END PGP SIGNATURE----- Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux Pull fscrypt fix from Eric Biggers: "Fix a bug where FS_IOC_SET_ENCRYPTION_POLICY checked the original uid rather than the idmapped one" * tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux: fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() |
||
Christian Borntraeger
|
727e1f5698 |
vdpa/mlx5: Fix buffer length in create_direct_keys()
We have seen in our CI the following KASAN message:
BUG: KASAN: slab-out-of-bounds in cmd_exec+0x550/0xca0 [mlx5_core]
Read of size 272 at addr 0000000176795020 by task qemu-system-s39/82764
[...]
[<000011388ab3a7a0>] cmd_exec+0x550/0xca0 [mlx5_core]
[<000011388ab3b61c>] mlx5_cmd_exec_cb+0x25c/0x4f0 [mlx5_core]
[<000011388b21e82e>] mlx5_vdpa_exec_async_cmds+0x22e/0x5e0 [mlx5_vdpa]
[<000011388b21fd44>] create_direct_keys+0x954/0xef0 [mlx5_vdpa]
[...]
The buggy address is located 4128 bytes inside of
allocated 4384-byte region [0000000176794000, 0000000176795120)
So in essence we read 16 bytes beyond 4384-byte allocation.
create_direct_keys calculates the pointer and length for in and out
buffers.
The size calculation for in includes the entire structure
size (out + in + mtt[]) but the pointer passed to cmd_exec points only
to the 'in' field, skipping the 'out' field.
This causes mlx5_copy_to_msg() to read beyond the allocated buffer
by sizeof(out) bytes when copying command data.
Properly calculate the input size to match the pointer and allocation size.
Fixes:
|
||
Yousef Alhouseen
|
0619aaa34c |
vhost/vdpa: reject overflowing PA map page counts on 32-bit
vhost_vdpa_pa_map() adds the IOVA page offset to the user-controlled map
size before computing the number of pages to pin. On 32-bit systems,
where unsigned long is narrower than u64, that addition can overflow and
the code can pin and map fewer pages than the requested IOTLB range.
Reject sizes that overflow the unsigned long page-count calculation.
Fixes:
|
||
Linfeng Sun
|
1ed35ac7f3 |
vhost_iotlb: bound map allocation in add_range
vhost_iotlb_add_range_ctx() only retires an old entry when the table
has a non-zero limit, has exactly reached that limit and has
VHOST_IOTLB_FLAG_RETIRE set. Non-retiring tables can keep allocating
entries after reaching their configured limit.
Existing vhost devices allocate their IOTLB with max_iotlb_entries from
vhost.c, which defaults to 2048 and is tunable by module parameter. Use
the caller-provided limit at the allocation point instead of adding a
separate default in the common IOTLB helper, and reject non-positive
values in vhost paths that can report an error.
Other vhost IOTLB users should not create zero-limit tables when entries
can be populated from userspace or guest-controlled requests. Add
caller-side max_iotlb_entries parameters for mlx5 vDPA, VDUSE and
vhost-vDPA. Reject non-positive VDUSE and vhost-vDPA values, and require
at least two entries for vdpa_sim and mlx5 vDPA paths that install
full-range mappings, since those mappings are split into two IOTLB
entries.
Handle full-range mappings in the common helper by checking that the
IOTLB can hold both split entries before inserting the first half. This
avoids returning an error after leaving a half mapping behind.
When the table is full, keep the existing retire behavior for retiring
tables and return -ENOSPC for non-retiring tables. Reuse the retired map
node instead of freeing it and allocating a replacement, so a stream of
IOTLB updates cannot keep forcing GFP_ATOMIC allocations after the table
has reached its limit. If a zero-limit IOTLB still reaches the common
helper, treat it as a configuration error and return -EINVAL.
I found this bug myself, though the patch was written with AI assistance.
Fixes:
|
||
|
Linus Torvalds
|
c8e0d43058 |
liveupdate: a fix for v7.2-rc7
* fix a regression caused by allowing coexistence of KHO with deferred initialization of the memory map. -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEEeOVYVaWZL5900a/pOQOGJssO/ZEFAmpweGsACgkQOQOGJssO /ZHe4gf/b06J+YW9GO7FGQclCf3s30DbL8nNeEkb74lpWU8CAfk2vbo9QyrlYH8+ 5wtISj9+SdBwMfY4XFdDWOur1EHD47N52xbT5zL3yp1UEPpXYbggiiKuzwCXK1MZ lVhyc3XfPmF4eRP5V0Nr7AsN1pAujH83uRrTgg//ZJziOaOtLi7ZWJZa0Oae3UY1 z+/bRIM21DzkL2wD2fitlYxYBmrooYRS6FVr+wv/khBnLxAtcWGM+nfHGI4/i4bK 5oz/9D3+nD/rQBqOT6F+Vf6Dz3zPtJPLe7+B459x24f2yPzJplIt6cDq9nxZKbY2 L7q3npvcsts7iLXVsKSeaHeEfn2l7g== =xzQP -----END PGP SIGNATURE----- Merge tag 'liveupdate-fixes-2026-08-03' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux Pull liveupdate fix from Mike Rapoport: - fix a regression caused by allowing coexistence of KHO with deferred initialization of the memory map * tag 'liveupdate-fixes-2026-08-03' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux: kho: align kho_scratch to MAX_ORDER_NR_PAGES pages |
||
|
Linus Torvalds
|
be76b516e6 |
sched_ext: Fixes for v7.2-rc6
- More lifecycle fixes for the new sub-scheduler support: a failed enable could tear down a never-linked sub-scheduler in a way that races the root scheduler's disable and leads to a use-after-free, tasks that were not on the ext class could still get the enable callback, and a policy-rejection path silently rewrote a running task's scheduling policy instead of aborting the scheduler. - Scheduler enable/disable could deadlock with cgroup removal and a concurrent cgroup weight write through kernfs. Fixed by reordering lock acquisition. - Sync wakeups could leave the waker CPU incorrectly marked idle in the built-in idle-CPU tracking. - A selftest fix for sleeping tasks whose CPU affinity changes before wakeup. -----BEGIN PGP SIGNATURE----- iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCam/mog4cdGpAa2VybmVs Lm9yZwAKCRCxYfJx3gVYGe0NAQC2UrrXeSm97RTCv+5HBfom/8sjPdB2tiAwGiUt fUUQ+AD9FP30urJaoiALUiL+EGWpLFejwUCXNXlT+0kN2TiFxQM= =EuWf -----END PGP SIGNATURE----- Merge tag 'sched_ext-for-7.2-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext fixes from Tejun Heo: - More lifecycle fixes for the new sub-scheduler support: a failed enable could tear down a never-linked sub-scheduler in a way that races the root scheduler's disable and leads to a use-after-free, tasks that were not on the ext class could still get the enable callback, and a policy-rejection path silently rewrote a running task's scheduling policy instead of aborting the scheduler. - Scheduler enable/disable could deadlock with cgroup removal and a concurrent cgroup weight write through kernfs. Fixed by reordering lock acquisition. - Sync wakeups could leave the waker CPU incorrectly marked idle in the built-in idle-CPU tracking. - A selftest fix for sleeping tasks whose CPU affinity changes before wakeup. * tag 'sched_ext-for-7.2-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: selftests/sched_ext: Handle sleeping task affinity changes in numa test sched_ext: Mark waker CPU busy when selected in WAKE_SYNC case sched_ext: Don't enable non-ext tasks in the sub-sched task loops sched_ext: Skip sub-disable teardown for never-linked sub-schedulers sched_ext: Take cgroup_lock() first in scx_cgroup_lock() sched_ext: Reject setting disallow from init_task outside the enable path |
||
|
Linus Torvalds
|
35e66f03de |
cgroup: Fixes for v7.2-rc6
- A pressure trigger's poll timer could be re-armed while the last trigger was being torn down and then fire after the cgroup was freed. Tie the timer to the cgroup's lifetime and shut it down when the cgroup is freed. - Writing to a pressure file forked a worker kthread while holding the cgroup mutex, creating lock dependencies from the mutex to the whole fork path. A pressure write racing a sched_ext scheduler enable, which blocks forks before grabbing the mutex, deadlocked. Fork the worker with the mutex dropped. - Documentation fix for io.latency behavior on non-rotational devices. -----BEGIN PGP SIGNATURE----- iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCam/mlw4cdGpAa2VybmVs Lm9yZwAKCRCxYfJx3gVYGVhRAQCyNBHCHpaY9erKTezenGDK6D+LqbfLWiWuIntB swiwLQEA6h6Rgob2GDDRHOey7+XwF6PHh6xoh4FhSYboeEZd1wc= =Re+7 -----END PGP SIGNATURE----- Merge tag 'cgroup-for-7.2-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fixes from Tejun Heo: - A pressure trigger's poll timer could be re-armed while the last trigger was being torn down and then fire after the cgroup was freed. Tie the timer to the cgroup's lifetime and shut it down when the cgroup is freed. - Writing to a pressure file forked a worker kthread while holding the cgroup mutex, creating lock dependencies from the mutex to the whole fork path. A pressure write racing a sched_ext scheduler enable, which blocks forks before grabbing the mutex, deadlocked. Fork the worker with the mutex dropped. - Documentation fix for io.latency behavior on non-rotational devices. * tag 'cgroup-for-7.2-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: Docs/admin-guide/cgroup-v2: document io.latency rotational vs non-rotational behavior sched/psi: Shut down rtpoll_timer in psi_cgroup_free() sched/psi: Create the psimon kthread outside of cgroup_mutex |
||
|
Arnd Bergmann
|
cf3eb490ff |
This pull request contains Broadcom ARM-based SoCs Device Tree fixes for
7.2, please pull the following: - Rosen fixes the Linksys EA9200 NVRAM DT size, the 2nd PCIe controller interrupt that was duplicated -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEm+Rq3+YGJdiR9yuFh9CWnEQHBwQFAmpr3TgACgkQh9CWnEQH BwRtjRAAztTIR7AHRhZvEjBtQiwrzjNkxQaPlYeWRBtGeFRRQmiT9qQR+pzqlblr 9qk0ftuNTrea8bitc9y6MVJ0Q4wainTm4skuK7Z6n0EgXwFSF61iDmlHN9w3k2px nQmhLO+9O79VClMDYUcN4Ry6iTRMvqV+0MLYlP4lK9iGOsQ2xEJhRxBJThFHsJeJ GLS/bvMRVVvvztH9RXhfGap4+zXwrLPhndiZRxSVI7wfEJhewYGiErxiAM7XXoKL KMOO7gofZYo+b+rSUumbiS7vvq4hnX7/9ThE8Semtt0+dHhRREM1STiueNvIQNm4 HAKypDQvtzvnhqTtjO/i5eTQYJq46haR6Dieh+LW+Rm/LyyUGgh+0E3YGEhbkQMg PBCHtnFivm5ImphPqHD1hu7VphDvUQfKiD0TGdV1npqgvvfSH5SEJdIm8wvkGbP+ UWg465WeZWT5+x1bgFFz8W9yFg88unWOgd+651Ogn5V7lDtLOw4Tgaugqch22pE/ tUi4zZQ/dgAMmY/C0IL9fIMCMzJ/quD4yDyNg2Q7DyOCpnmMU+PspOMyZrx2/MHu 9cIWZyo68UhHh87wmLeQxfWuqTGXpOL+1y6KCFCYV4JedS2bASnqwB+88nxltsm+ /IWCZMKKxaj1Cml0SNmwTru2pDw/yiF5pRvXuXAG6OkrRMnjfMk= =oqYh -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmpwhAYACgkQmmx57+YA GNlhag/+PrU6ZkGVjgHS7lIP4QSQE72DSEP20jBE9MuvG6V9vEij7NqhEvRM9f6t 2fxiacYQtd01G0ti8TLE1eKuEjAGiUjPuChOmS5m/RmxSN0zVfTT6OqQbYyjsXIH rpWyBFF3MzZVeDN0EG1oKjrfQAOo1aOIZLG0GlmDIex+Ufw/OEvgkKTN+boVeHcu l2SptFknjcsNkplSt54xS6gnttwE5dvMFHNdvKxXk2yX0xDeeuC11ym6WVnilBvg D8RBklrK3oyqkwTp3lWmaw/tRmcsC1YOCpuJHXqmK2KFGIH/4mggY2uqeP+Q3Ugl 2jGArDmRU4CqlDQs4XUYHn0DLJFaPBCuFRpVPMvfnz0BVaf7fDKVqiwqqmsaq2qj Im5fMUy0gjILmBupxezCWITwZMVQYhJmyvsNe96VhUp6qyeMjU/mV5hj91rZCPEP tEwXPTB8BnFLQJSNjgfiAWLEFOhy7zOBEg3CPGNMlJuzfc0xAebo2gdLZk/O4N1H oj5EvHXOu1+fcLvZK+oSTahGWCB/bqal/FcAMDj/bCBikiYxSEWFe+Nt3laDTD8B 49+gDFESSK10cu+bnu5P+VZdjWiXnKs0nqg5boBuA89uWfV9Sk29JGpaLvPyYcuP mxWXmzpOWIAWZKOBpXzamieXVb07NQfqikn0LO53J4hvNz/Vbm4= =YFCR -----END PGP SIGNATURE----- Merge tag 'arm-soc/for-7.2/devicetree-fixes-v2' of https://github.com/Broadcom/stblinux into arm/fixes This pull request contains Broadcom ARM-based SoCs Device Tree fixes for 7.2, please pull the following: - Rosen fixes the Linksys EA9200 NVRAM DT size, the 2nd PCIe controller interrupt that was duplicated * tag 'arm-soc/for-7.2/devicetree-fixes-v2' of https://github.com/Broadcom/stblinux: ARM: dts: BCM5301X: EA9200: fix NVRAM size ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt Signed-off-by: Arnd Bergmann <arnd@arndb.de> |
||
|
Linus Torvalds
|
075b74841b | Linux 7.2-rc6 v7.2-rc6 | ||
Tao Cui
|
2fd9b4cfce |
Docs/admin-guide/cgroup-v2: document io.latency rotational vs non-rotational behavior
io.latency is documented only in terms of average latency and the avg_lat stat, which matches rotational devices. On non-rotational devices a group misses its target once enough of the IOs in the window individually exceed it, and io.stat reports missed/total rather than avg_lat/win. Describe both cases: how a miss is detected, note that the avg_lat tuning guidance is rotational-only, and update the io.stat field list (mark avg_lat/win as rotational-only, document missed/total). Acked-by: Michal Koutný <mkoutny@suse.com> Signed-off-by: Tao Cui <cuitao@kylinos.cn> Signed-off-by: Tejun Heo <tj@kernel.org> |
||
|
Linus Torvalds
|
f5a7e2ae5f |
RISC-V updates for v7.2-rc6
- Fix swiotlb initialization on systems where DRAM is located above
4GiB (such as the Tenstorrent Blackhole cards)
- Fix an out-of-bounds access in the memory hot-remove code that can
occur on Sv39 and Sv48 systems
- Avoid oopsing during boot if the SBI component of the unaligned
access performance checking code loses a race against __init
function freeing
- Avoid attempting to install the debug-enabled vDSO when it shouldn't
be built due to !CONFIG_MMU
- Avoid some sparse warnings by adding missing __iomem notations
in get_cycles{,_hi}()
- Drop an unnecessary runtime warning in the SiFive errata handler
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEElRDoIDdEz9/svf2Kx4+xDQu9KksFAmpvhjgACgkQx4+xDQu9
KkvxVRAAsKDraTKUCihar+rgSSy3MZaCIo3u3Xg7FExhF7oCNvxdeHXcjgUOFVHl
P3YwbMCm43ztnNC7jXTQyd8OZ+EqneqRNRK0Hvj+dbXLmIV/P0byIbG2VAZPmbal
vYZ7L52M2a25A30ZGSGPknc2kthLyuhM2XOxOFhd8HjJcuyF+76YQbx+Lbw6255/
s4zVAwzlmztfVKV0y8Gark32CnZfJOeytYmIixOL7daDmb1iY70oJv4828wWfVaD
FP2dQkQXfH4VPnces4h5g/0vuhYf3LL76jbXIWgYE+UMEvv2dR2IcgnfBzKLSAcH
xzQpTKr0LIywd/wdVxng1vRk9MM+ltvdNRMF1nhIAS3FvBZYbogSKP6E8vSM2YDR
NL7Qoh+lDf9tAGk2rlGr34wTR3DvX3z0LH4pNcBwQveLjqk9gQ9g+BwPYHFnqjLy
j94Nch5hA2jnWypWCgmL3d7PP96joZsogPHYT8GbXdSXCTf9nTyV7EYCtERV6nJh
CtJI595pUurT5jQx+qxSXj/PyvL4o4z5hib4Vmc6qh1fucJgsyr9/5VSMPDHzeqd
FjcLlBBMRfRAZwiGey+1+Ini0pCBSaV5HNEmKEaLsTH/wua/XFm9gOkUGl5WKyTe
yUhYppZErSmPMSXhRFEC5IkeOV8TcxHBs3+KESMMYZVbq4H5BRs=
=gw8o
-----END PGP SIGNATURE-----
Merge tag 'riscv-for-linus-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux
Pull RISC-V fixes from Paul Walmsley:
- Fix swiotlb initialization on systems where DRAM is located above
4GiB (such as the Tenstorrent Blackhole cards)
- Fix an out-of-bounds access in the memory hot-remove code that can
occur on Sv39 and Sv48 systems
- Avoid oopsing during boot if the SBI component of the unaligned
access performance checking code loses a race against __init function
freeing
- Avoid attempting to install the debug-enabled vDSO when it shouldn't
be built due to !CONFIG_MMU
- Avoid some sparse warnings by adding missing __iomem notations in
get_cycles{,_hi}()
- Drop an unnecessary runtime warning in the SiFive errata handler
* tag 'riscv-for-linus-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
riscv: vdso: Only try to install vDSO when present
riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove
riscv: drop __init from vec_check_unaligned_access_speed_all_cpus
riscv: mm: fix SWIOTLB initialization for systems with DRAM above 4GB
riscv/sifive: remove warning in errata
riscv: time: Add missing __iomem in get_cycles() and get_cycles_hi()
|
||
|
Linus Torvalds
|
0e672789d4 |
s390 updates for 7.2-rc6
- Fix PCI MMIO write syscall falsely reporting success for mappings not valid for MMIO when MIO is unavailable by returning -EFAULT - Fix CPRB parameter buffer overflows in zcrypt CCA AES cipher and ECC private key conversion by rejecting oversized key tokens - Fix buffer overreads and length underflow in pkey and zcrypt CCA token validation by checking length fields against actual buffer sizes - Fix out of bounds permission bitmap access in zcrypt EP11 admin CPRB filtering on custom device nodes by using AP_DOMAINS as the limit - Fix speculative permission bitmap reads in zcrypt CCA and EP11 admin CPRB handling by sanitizing user controlled domain indexes - Fix sensitive key material left in zcrypt CCA clear key import buffers by scrubbing CPRB and temporary buffers after use -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEE3QHqV+H2a8xAv27vjYWKoQLXFBgFAmpvT7gACgkQjYWKoQLX FBg7qAf/eDHPqcayM4/Rasf3P+KVoIquyl0BjBI41Lf348em9ffLdvGI+PmSgo3s CVOPmsQY1zn4UvWrU3Wn0/Kmgo7U4xv6ODDUbvuTbjr7gUigMOYPoH3zShQJW8dY bJ5UnbtYC5ZMpnkEFQi4F1xNd3IoOFQLnbUPaFd+5S+slUJygGNh4XjEBEUfo3yS dyly7GWgml2obf2R4IfRG1ItP4hY8OWo0K9XrDJomh+s5WfkFy5QMlL6uEsuXzcR iqEPTaHblvz5FhEozZmmFppM3GVclyLouxZTHYHP32OaoLOIgF9NNW4WUmXodyF/ efMV21LmtCjMcLrM4LQ1PohTtXgG+A== =U3To -----END PGP SIGNATURE----- Merge tag 's390-7.2-6' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 updates from Vasily Gorbik: - Fix PCI MMIO write syscall falsely reporting success for mappings not valid for MMIO when MIO is unavailable by returning -EFAULT - Fix CPRB parameter buffer overflows in zcrypt CCA AES cipher and ECC private key conversion by rejecting oversized key tokens - Fix buffer overreads and length underflow in pkey and zcrypt CCA token validation by checking length fields against actual buffer sizes - Fix out of bounds permission bitmap access in zcrypt EP11 admin CPRB filtering on custom device nodes by using AP_DOMAINS as the limit - Fix speculative permission bitmap reads in zcrypt CCA and EP11 admin CPRB handling by sanitizing user controlled domain indexes - Fix sensitive key material left in zcrypt CCA clear key import buffers by scrubbing CPRB and temporary buffers after use * tag 's390-7.2-6' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() s390/zcrypt: Close speculative mem read possibility s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs s390/zcrypt: Fix buffer over-read in cca_cipher2protkey s390/zcrypt: Validate length for CCA ECC private key requests s390/zcrypt: Validate length for CCA AES cipher key requests s390/pci: Fix s390_pci_mmio_write syscall error return without MIO |
||
|
Linus Torvalds
|
8eae6c90b7 |
Misc x86 fixes:
- Fix the boot-time memcmp() asm implementation's constraints
and optimization properties (Mauricio Faria de Oliveira)
- Move the 0xd0...0xd7 AMD Zen5 model range from the Zen6
range where it mistakenly ended up (Pratik Vishwakarma)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmpu9+0RHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1j8Ig//WBoOGw9bbFkDJFUdIS59EdJS+4l7KTJh
eRxiExnwQluOpo1x4/mKAMmgqz7IoFCc0PjLXIBC3+rN+AvM5+L/qkBGtHmcaHEu
uXdU5zAYk6a7QfvK9C6k1C/v4HQKb3FLvUliJShKfLAv7ekLLvVHWxExmJYoBsrn
VxPIW3+rpnBJn4v5bLUVs/Z6h99aB4nicA4i6p7WKiy+Vr1qOSIu5T4piff27FJE
btT61yOfTKFoKgum5dI4ZYJTX29edXcJUMPidN/egJAxMQnUdI38fO/joYMreYsx
rJ3zuv3mdV+LiusPO7ZHcNVZtc09PPMM2krLrOyjSEHzhE/WGqLXNn6FKK5H+j86
xKyawqhD+2ANktj+09bFfu3cpZEz5bdifyKx6BtvgYkSEVaX055E1zzqYXZCIaVs
DqdAs3aSKNWAbJkfMONJMZ4P28ZGikppeefihG6hcAnBjAyQC9SaTOA37fHT6WQ/
bDf3NU5c+TX0TrWd696E9jy5cLjXL60jbVPL7SF7C3d8/QPPWCbOU14Dw3s4bWh+
WfptSuB9Iuk+aalRnAVWpUBI9DDUcomC3oDLLHttztXojdZPvP1zdUhDzjaJ0Im8
N8xC30PBMGIrFGJpXN4XRM3BlSxXBVGrmS/WAqE/KE51RcA5WzQBFMGBe4V3gRbO
OV3slKkCD9k=
=EHql
-----END PGP SIGNATURE-----
Merge tag 'x86-urgent-2026-08-02' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull misc x86 fixes from Ingo Molnar:
- Fix the boot-time memcmp() asm implementation's constraints
and optimization properties (Mauricio Faria de Oliveira)
- Move the 0xd0...0xd7 AMD Zen5 model range from the Zen6
range where it mistakenly ended up (Pratik Vishwakarma)
* tag 'x86-urgent-2026-08-02' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/CPU/AMD: Carve out a Zen5 models range
x86/boot: Add volatile, clobbers and zero-length test in memcmp()
|
||
|
Linus Torvalds
|
65bfd707fd |
- Fix wakeups of deferred DL servers to be actually deferred
(Gabriele Monaco) Signed-off-by: Ingo Molnar <mingo@kernel.org> -----BEGIN PGP SIGNATURE----- iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmpu9psRHG1pbmdvQGtl cm5lbC5vcmcACgkQEnMQ0APhK1iC+w/+LcPcYHltFHYkR/Bmsux4IoLuLCMhBzm6 WrZ093wE7zgv9CJmO411OVi98pAGKozYE+ITb1A5uyXSZlsyLh/KCdxkBkwl3muq 5GGh0dGGX26SGidddp2Q9GGuqpMD1ay4c/D4KuS0V7qmDmEP8b+xohpuH9YcTqfk rz6DN+JBOd/wt2NPAWxTH8CuCwTnUcLl/w+sulhZSg9ZGw50VzrMSde723Ef0OPY qzdnMTOhy6yWLwf0dpZcqecwTDISqr6k27LvseyglpwC7T6CsX8xFWbrQoHT7SW0 0A1nYRRzUTMrVb//WVxVb38Ys0X+BCRnHTXGFthyrJChiPitCemyq+QRjdGg1raY MAnIUG3KODpG1ZSkLCpl4fupI7XdFZxKA7Xx5DF4Qfy/3aTUetRcfrs0KfYaebDD /yRTaeJvI1kVRp0y1tyZ7F9YNHwPF0TAQ6IEWJKlDFSdlxIufjWRefBpOuEkH/+m lLqtzHbpQS75EYZN6EzfzBduQ76PH0aPTen2Yge29RsWET4gUTB2V1llbipFkjlp ybLMojtt5mPhLpghWZqRZ9G9VkMuV0LVlKxjSn5+om3RjfuT/z9gDlrKbWGUt1t6 4jIwqFaK89wHVVu8lHdbxzRU+WF1rWee4+u0vnWgOeays3Xe4WQ5yi7tIQijwmNM Ae8y6pslfb0= =u1Q7 -----END PGP SIGNATURE----- Merge tag 'sched-urgent-2026-08-02' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fix from Ingo Molnar: - Fix wakeups of deferred DL servers to be actually deferred (Gabriele Monaco) * tag 'sched-urgent-2026-08-02' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/deadline: Use revised wakeup rule only for running dl_server |
||
|
Linus Torvalds
|
e1f05cd3fc |
- Fix uretprobes race that can crash the kernel (Breno Leitao)
Signed-off-by: Ingo Molnar <mingo@kernel.org> -----BEGIN PGP SIGNATURE----- iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmpu9WURHG1pbmdvQGtl cm5lbC5vcmcACgkQEnMQ0APhK1hcmg//fG1ohnQxdQhs2CxWHBlY0mDY9N+FMphh sKnSMW8/1CMPWNXZ4aLT/yla/YtG3vgVv2De2YKxcgsHWTBTATF5JQNrAy1jqI/y pYHtN7zRAttJ05KjyZhwZbFg1GqDAqQs/+uYg42uNtxJ73q+VJlIK0U1ovzh2jZI WGfPrpSYa1wMiUHN5DXSuVQ3VG5ezbujEwOD1zvxax9sgOzVH2iEKqW83QRkYL0i 2Lf6fMBGlrt7zuk0pqu9ohBmFxaqAslWWJg8pwekHu2wpH89UMRCsXrLh2a9DTA2 1JdWkr2BQ7H5E/q1FKFSTa7SBLnVwFNTGyLb0MVepbcf8JOkQf2KLo24qj3BBUE4 eI69OWq+s32uwK62Tv1qBwcoAuGDZqigwDRbqnI7tUbMFRVoknP1/vzuGcMUgPWR a/QnTZptPofrlg1JExo3B8co7U4oJb7M0cIi3c+P3XXwG75jjq8eA2EkR1Iy/u22 jWoJUr5n82LuJMsDHHbJqbi4RJ2wOAsgvOoAqkEnHB/r1nEbFsmqMb35N1zT0fIV 0XwW0roQekx69DKA6PysM2XTpypHayu0JIdZ5yeRgs6AxLArqYdd6ROnbwx6r2ZN DUxWgUp/OgWRGIjihHvQkoO6bRz9zHOyI5EezkRH6uGOPKk3wXrVPCF7wAmx81XC ttpg5MkSoj8= =S4B0 -----END PGP SIGNATURE----- Merge tag 'perf-urgent-2026-08-02' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull uprobes fix from Ingo Molnar: - Fix uretprobes race that can crash the kernel (Breno Leitao) * tag 'perf-urgent-2026-08-02' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: uprobes: Fix NULL pointer dereference in hprobe_expire() |
||
|
Linus Torvalds
|
bd1dde8775 |
vfs-7.2-rc6.fixes
Please consider pulling these changes from the signed vfs-7.2-rc6.fixes tag.
Thanks!
Christian
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCam8K1wAKCRCRxhvAZXjc
oicvAP9SaD+BOfpqRkICUIrZ/Lz+x3bIn1a0/yjgDQlPE1xJmQD+JCqIVnvUDN2U
m89mFy/4Mq9FYnuHZ6LWMAeYYIx3OQM=
=+294
-----END PGP SIGNATURE-----
Merge tag 'vfs-7.2-rc6.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull vfs fixes from Christian Brauner:
"binfmt_misc:
- Don't let an 'F' entry pin its own instance.
An entry registered with 'F' opens its interpreter at registration
time and holds that file until the entry is freed, so an entry
nobody removes by hand is only closed once the binfmt_misc
superblock is shut down.
If the interpreter lives on a mount that keeps that superblock
alive the two pin each other and the file is never closed. That's
reachable by pointing the interpreter at the instance itself or by
using the instance as an overlayfs lower layer, and once the mount
namespace is gone there's nothing left to unregister through
either.
- Restore write access when removing an entry.
Registering with the MISC_FMT_OPEN_FILE flag opens the interpreter
via open_exec() which denies write access for as long as the entry
exists, but removal only did filp_close() and never restored it.
The inode's i_writecount stayed permanently negative and opening
the interpreter for writing kept failing with ETXTBSY long after
the entry was gone.
- Use exe_file_deny_write_access() for the interpreter clone so both
sides base their decision on the same mode.
- Reject a flag character as the field delimiter. create_entry() pads
the buffer with the delimiter so the field parsers terminate even
on a truncated string, but check_special_flags() consumes flag
characters instead of scanning for the delimiter.
If the delimiter is itself a flag character the padding stops
acting as a terminator and the scan keeps reading past the end of
the allocation. Such a registration was always rejected, just only
after the out of bounds read has already happened.
- Don't leak the user namespace when the mount fails.
bm_get_tree() hands its reference to get_tree_keyed() and sget_fc()
moves it into sb->s_fs_info, but generic_shutdown_super() only
calls ->put_super() from inside the if (sb->s_root) branch and
bm_fill_super() can fail before either s_root or s_op is in place.
Drop the reference in ->kill_sb() instead, which runs
unconditionally.
netfs:
- Clear PG_private_2 on a copy-to-cache append failure.
- Handle a rolling buffer allocation failure in single-object
writeback and drop the extra folio reference
netfs_write_folio_single() took before the append.
- Release the previously batched readahead folios when
rolling_buffer_load_from_ra() fails in
netfs_prepare_read_iterator()
- Fix the folio_queue ENOMEM in writeback by adding a mempool and
passing gfp flags into the rolling buffer helpers.
iomap:
- Add a separate bio_set for iomap_split_ioend(). It can split bios
that already come from iomap_ioend_bioset and deadlock once that
bioset is exhausted.
afs:
- Set call->async for an asynchronous afs_fs_fetch_data() the way
afs_fs_fetch_data64() already does.
- Subtract subreq->transferred from subreq->len in
afs_fs_fetch_data() rather than adding it.
- Fix a UAF when sending a message"
* tag 'vfs-7.2-rc6.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
iomap: add a separate bio_set for iomap_split_ioend
binfmt_misc: don't leak the user namespace when the mount fails
binfmt_misc: reject a flag character as the field delimiter
binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
binfmt_misc: restore write access when removing an entry
binfmt_misc: don't let an 'F' entry pin its own instance
netfs: Fix folio_queue ENOMEM in writeback by adding a mempool
netfs: release readahead folios on iterator preparation failure
netfs: handle single writeback rolling buffer allocation failure
netfs: clear PG_private_2 on copy-to-cache append failure
afs: Fix UAF when sending a message
afs: Fix afs_fs_fetch_data() to subtract transferred from len
afs: Fix afs_fs_fetch_data() to set call->async
|
||
|
Linus Torvalds
|
a84c804215 |
SCSI fixes on 20260802
No core changes. The largest driver fix is the reversion of threaded interrupt handlers in UFS and the next is the resume deadlock fix in hisi_sas which extends into libsas. Signed-off-by: James E.J. Bottomley <James.Bottomley@HansenPartnership.com> -----BEGIN PGP SIGNATURE----- iLgEABMIAGAWIQTnYEDbdso9F2cI+arnQslM7pishQUCam86+xsUgAAAAAAEAA5t YW51MiwyLjUrMS4xMiwyLDImHGphbWVzLmJvdHRvbWxleUBoYW5zZW5wYXJ0bmVy c2hpcC5jb20ACgkQ50LJTO6YrIVcnwD/QWD/DCvLd533SY0vE2fZYVYnUVi3uzAy OGkbmxKtCSABAO/djRxNN1CTDtVXnhUhp/VLn0niXfy4jLmCkoWpnD2N =ERuj -----END PGP SIGNATURE----- Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley" "No core changes. The largest driver fix is the reversion of threaded interrupt handlers in UFS and the next is the resume deadlock fix in hisi_sas which extends into libsas" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: core: Initialize hba->rpmbs list in ufshcd scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit scsi: target: Clear cmd_cnt when initial counter enrollment fails scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req scsi: ufs: core: Revert "Delegate the interrupt service routine to a threaded IRQ handler" scsi: ufs: core: Cancel RTC work in active-active suspend scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE scsi: ufs: dt-bindings: Add missing mcq reg for qcom,sa8255p-ufshc scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer |
||
|
Linus Torvalds
|
49c9f4657b |
dmaengine fixes for v7.2
Bunch of driver fixes for: - switchtec fix for register programming - sun6i descriptor reclaim fix - Couple of Intel idxd fixes for double free in error and setup failure - Qualcomm bam dma command element fix -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE+vs47OPLdNbVcHzyfBQHDyUjg0cFAmpuzYcACgkQfBQHDyUj g0evqg//ZOIvQV12d4eOp7JCzWgfb7uPi+fx6YpMQOxhML5OIwu1nX9tZ1eV6MZB 4G0lXPW0QhUFFzEpELp+odUJfXhgZkXaaw/yr0Km7fv1bUxKhPVvqVEHpT8EH5QT wivwL17ur8IzFEbjtCDNg2qoVCyzRufbDUcbEvZZFgpUaEnTrwFgfchLZZJm7Vkc fIaLbYN5Peq8AsRKw6TmAos0sOqEVvlfFDULtlKvkVcsheor3ZquIyLm0Czghp/+ BNFXVLxPG3sMJjeg2c/u8E/u2GTCGbuDvmIZFcWgds59YCkB/ETIwG9smfFNew38 mrTJfpGemqGkMx8T5x4e3yr7z2YX+7eBWBV5Js77rkpRw/Aq7iwW3emoTnIanr9c U3oJJCjrEpBLCKv2pNkWNo49vZbceUPCnNvsTcG9xjSFjKQEDHufLk9cQZbug125 iB1tmqJJigfKf818rh184PS5OY6puw4UaeEWfTG3APQif688xjlfxXBmXEDZPpqR TGAasuIsUOk6J+glOlkhNh9el3z+kyjFFdM+UZTr0TJQahc/+PVR+Zgk1VjluAwx 4LbEv1W+3scGELOIdZm5Kld4Mr12o2KfIEgFdlG3atlRRqyNGxnbKZ1xrSrsJ1o0 BjoqI7ZDe5IbljlJRm+tzpmtE4P/qH1LB3OHy0gFvbfSRYQ9x/4= =GT2Z -----END PGP SIGNATURE----- Merge tag 'dmaengine-fix-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine Pull dmaengine fixes from Vinod Koul: - switchtec fix for register programming - sun6i descriptor reclaim fix - Intel idxd fixes for double free in error and setup failure - Qualcomm bam dma command element fix * tag 'dmaengine-fix-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() dmaengine: idxd: fix double free of wq, engine, and group structs dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA dmaengine: switchtec-dma: fix FIELD_GET misuse when programming SE threshold |
||
|
Linus Torvalds
|
40814468ee |
phy fixes for 7.2
Couple of driver fixes
- Couple of zynqmp clock and pm error handling and SERDES scrambler
register handling
- Rockchip SSC spread fix
- Qualcomm musb return call fix
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE+vs47OPLdNbVcHzyfBQHDyUjg0cFAmpuzEsACgkQfBQHDyUj
g0dj9g/9GsRGDJotlJkhFy+7sKmMaEG6VRPJMRSdp3J1dz2SWavMHdgzf8hsHXHU
sHn6Z5ARG+PpDc5bdzt3qXJs49fgtr+E9uqeRxBDwe061E9x7XKCuggsQWcPz+SB
avGdmR8sK1z6FYXhMBy5dofffae5/00dZZUIuLdJFLPfFFqAePsIY6TetL8mdcTU
GaDm+o/TTfcvH8bxxBwtQiVLhNKX6zsIFBT3nIT6ReNJUzXvsg2ELKNxibhwkm5n
246UJSOazCPYPXDMnL/gBklVPjw/aPbU4N2bAX39o0aXyUWCoyi8T6A1LQvPxwqs
pluJjVod3LtExKXGcbMbw9ONam4OeCytMrIiTnWoLwlbwNhaL5Omss1LMkFQAEhv
9o/lae/NIdLV8OsdhfO3303xhrcZaYZX5UMtLv86CZWPcD8zeENohjuA0RcmxjHx
C5SdGPAXunZ4NUDat207bg/Un8P3X3V8tiw4GsFdFT+9Y0PMZaXIUV3fcY5EtGBY
5X1vl+g0htscmCdXLhLqRpYHwUDsMU/pujN/SlBUz6skN1A+fXq1rTF9TWbsMfQv
1TfMLMYBfiIXh5IVaOG58fuhLzVf9VmWk+An1m+wtl1I7vJctnG+/erZ55qEeVEp
AsTz5nHjJ6qynE9K8Y5c/HVRd9wckTPvGMDcXfD7CM5sarHchG4=
=CL3g
-----END PGP SIGNATURE-----
Merge tag 'phy-fixes-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy
Pull phy fixes from Vinod Koul:
- fixes for zynqmp clock and pm error handling and SERDES scrambler
register handling
- Rockchip SSC spread fix
- Qualcomm musb return call fix
* tag 'phy-fixes-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy:
phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB
phy: zynqmp: use read-modify-write for SERDES scrambler bypass
phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask
phy: zynqmp: fix runtime PM leak on probe allocation failure
phy: zynqmp: fix clock error handling in xpsgtr_phy_init()
phy: rockchip: naneng-combphy: Always configure SSC spread direction
phy: qcom: m31-eusb2: Fix return value of init call
|
||
Keno Fischer
|
6d4514ca9c |
futex: Prevent robust futex exit race some more
A robust futex unlock stores 0 over the whole futex value - wiping FUTEX_WAITERS - and wakes a single waiter. That wakeup is a one-shot notification: the protocol relies on its recipient to either acquire the futex (and eventually unlock while aware of the remaining contention) or re-arm FUTEX_WAITERS before sleeping again. If the woken waiter is killed before it can do either, the kernel must jump in and wake the next task down the line. This is a known complication of the futex protocol with a previous partial fix in commit |
||
|
Linus Torvalds
|
2d2338c93d |
i2c-fixes for v7.2-rc6
- amd-mp2: unregister callback if adapter registration fails - designware: defer probe until child GPIO controllers are bound - imx: - mark adapter suspended while hardware is powered down - fix stale slave pointer and shared IRQ registration race - stop slave timer before clearing slave pointer - iproc: reset controller if START_BUSY remains set after timeout - jz4780: cache clock rate to avoid clk_get_rate() deadlock - qcom-cci: rely on runtime PM helpers for system sleep - spacemit: request interrupt after clock initialization -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQScDfrjQa34uOld1VLaeAVmJtMtbgUCam2wKAAKCRDaeAVmJtMt bqfFAP0V1w4b6tyH2a2LUM3dpL83OjhGnMi1xsBO9fAybv0kWAD/aRICEDDENJPh SxD+DpQ7xH3inwBR+akLeqMAHfSfOgE= =M+Cd -----END PGP SIGNATURE----- Merge tag 'i2c-fixes-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux Pull i2c fixes from Andi Shyti: "A set of fixes across several host controller drivers. The largest part addresses three issues in the i.MX driver, while the remaining changes fix probe ordering, power management, timeout recovery and error handling. amd-mp2: - unregister callback if adapter registration fails designware: - defer probe until child GPIO controllers are bound imx: - mark adapter suspended while hardware is powered down - fix stale slave pointer and shared IRQ registration race - stop slave timer before clearing slave pointer iproc: - reset controller if START_BUSY remains set after timeout jz4780: - cache clock rate to avoid clk_get_rate() deadlock qcom-cci: - rely on runtime PM helpers for system sleep spacemit: - request interrupt after clock initialization" * tag 'i2c-fixes-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux: i2c: qcom-cci: drop custom suspend/resume and rely on runtime PM helpers i2c: imx: Cancel hrtimer before clearing slave pointer i2c: imx: Fix slave registration race and error handling i2c: iproc: reset bus after timeout if START_BUSY is stuck i2c: imx: mark I2C adapter when hardware is powered down i2c: designware: defer probe if child GpioInt controllers are not bound i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock i2c: amd-mp2: Unregister callback on adapter add failure i2c: spacemit: request IRQ after controller initialization |
||
|
Linus Torvalds
|
02dc699f83 |
First round of Kbuild fixes for 7.2
- Fix regression with MO= when building out of tree kernel modules due to incorrectly overwriting build tree's Makefile - Avoid stripping .BTF sections from modules when building debug .rpm packages Signed-off-by: Nathan Chancellor <nathan@kernel.org> -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQR74yXHMTGczQHYypIdayaRccAalgUCam1cngAKCRAdayaRccAa lt/FAQDqTsqzD4FKeeOUkyoIahT+l31Spa0VNUTMa+EwEv24WwEAjExf66Ch7rVe KRdLXdDUSRI8TZiDZeibf8kGx0i+PwQ= =1d+/ -----END PGP SIGNATURE----- Merge tag 'kbuild-fixes-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux Pull Kbuild fixes from Nathan Chancellor: - Fix regression with MO= when building out of tree kernel modules due to incorrectly overwriting build tree's Makefile - Avoid stripping .BTF sections from modules when building debug .rpm packages * tag 'kbuild-fixes-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux: kbuild: rpm-pkg: Preserve BTF sections in kernel modules during debuginfo stripping kbuild: Stop modifying $(objtree)/Makefile when building oot-kmods oos |
||
|
Linus Torvalds
|
2aa6a5e889 |
tracing fixes for v7.2:
- Reset dropped_count in mmio_reset_data() When mmio_reset_data() is called, it does not reset the dropped_count so that subsequent runs will have incorrect reporting. - Add NULL check for mmio_trace_array in logging functions The functions __trace_mmiotrace_rw() and __trace_mmiotrace_map() may have the 'tr' variable passed to it as NULL. But they both dereference it without checking if it is NULL first. - Check return value of __register_event() in trace_module_add_events() If __register_event() fails, the call after it (__add_event_to_tracers()) will create a file for it. If the module fails to load and its memory is freed, the file will still point to it and it will not be removed as the registering of the event did not complete. Only call __add_event_to_tracers() if the __register_event() was successful. - Fix false positive match in regex_match_full() The regex full matching uses a strncmp() to test against the match string and the value. It should not match if value is a prefix of the string to match. Check to make sure the length of the strings match before comparing. - Fix reader page read offset for remote buffers A page swapped in by __rb_get_reader_page_from_remote() retains its stale read offset, causing subsequent reads to skip events or read past valid data. - Fix memory leak of subbuf_ids in rb_allocate_cpu_buffer() Remote buffers allocate a subbuf_ids array. If the allocator function fails after it is allocated, it does not free it, resulting in a memory leak. -----BEGIN PGP SIGNATURE----- iIkEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCam1A0RQccm9zdGVkdEBn b29kbWlzLm9yZwAKCRAp5XQQmuv6qlW/AQDCpddDwAMwN80i3tn5uiqec9JLZT5I DR6G+0zEF9a5DAD2IxiD3gH/mPVZ3CdiqfElBqjc0Pq1dx414xmzXBv+CA== =GUpD -----END PGP SIGNATURE----- Merge tag 'trace-v7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Reset dropped_count in mmio_reset_data() When mmio_reset_data() is called, it does not reset the dropped_count so that subsequent runs will have incorrect reporting. - Add NULL check for mmio_trace_array in logging functions The functions __trace_mmiotrace_rw() and __trace_mmiotrace_map() may have the 'tr' variable passed to it as NULL. But they both dereference it without checking if it is NULL first. - Check return value of __register_event() in trace_module_add_events() If __register_event() fails, the __add_event_to_tracers() call after it will create a file for it. If the module fails to load and its memory is freed, the file will still point to it and it will not be removed as the registering of the event did not complete. Only call __add_event_to_tracers() if the __register_event() was successful. - Fix false positive match in regex_match_full() The regex full matching uses a strncmp() to test against the match string and the value. It should not match if value is a prefix of the string to match. Check to make sure the length of the strings match before comparing. - Fix reader page read offset for remote buffers A page swapped in by __rb_get_reader_page_from_remote() retains its stale read offset, causing subsequent reads to skip events or read past valid data. - Fix memory leak of subbuf_ids in rb_allocate_cpu_buffer() Remote buffers allocate a subbuf_ids array. If the allocator function fails after it is allocated, it does not free it, resulting in a memory leak. * tag 'trace-v7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: ring-buffer: Fix subbuf_ids memory leak in rb_allocate_cpu_buffer() error path ring-buffer: Fix reader page read offset for remote buffers tracing/filters: Fix false positive match in regex_match_full() tracing: Check return value of __register_event() in trace_module_add_events() tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions tracing/mmiotrace: Reset dropped_count in mmio_reset_data() |
||
|
Linus Torvalds
|
0131b508c0 |
Description for this pull request:
- Keep RECALL_ON_OPEN in inode flags when reloading them from $FILE_NAME.
- Check runlist reallocation sizes for negative values and overflow.
- Drop stale page cache after shrinking non-resident attributes to prevent
writeback failures and data loss.
-----BEGIN PGP SIGNATURE-----
iQJKBAABCgA0FiEE6NzKS6Uv/XAAGHgyZwv7A1FEIQgFAmptO5UWHGxpbmtpbmpl
b25Aa2VybmVsLm9yZwAKCRBnC/sDUUQhCIxWEACGOzwM7ji4uCwIDWLA0sSNH5OG
BLVG64rUb01uN47pheIKEFT3DSF7VNaDwg1B+/lM4x1DtIKiGKoIPZB2XCPtTbQH
X/4ijla6or9Ua0A5GJTIZmHgl17C1Q36qQTba0qDYKIxGvU9tbxmA7jDt+2vYQkv
ylaXpjxvGjiLivqJrQjOJ+GDPEhahrxbcYbwE2bg3jI50ycq3e21zTDHt1tN3VYb
JzC6d82bxA3e8rQXdo8F6C/aEmhykCFpieVQbooKMvqkdKiB32oQYZp/31mHFUlv
y3XM7Elac+s8EwIj0h/6RFEmMUig7wj5RIpv47q8CH+joncDXdAs1vDqeYQWaQpc
VIT79bBiz0SP8qvkvTkIVQ/zdw1iaG/iXltGWycZHSWFrQKk4jaw3+zJiP5ISjFp
iiNbLNYCa7vlyWk9V0pKBf/cqZxUHCosqp4yKFhkA/OzYz34RyyRrhfrjXz3KJaG
1Iq3ojsiVYAoQQT8noe9boETrbt4A/cw41eg06OJlVkYEeDMu6bfAbe0dk6kU88p
ri1FCqb4ceVgKTgVh8HnmTIrzS2gJoA5ZPmPxIZ5FH7yJd6EPxExDGho7VOtBKZq
yodtBTQiUwnvbUZlnZzWsangS+7yPyliAq7QwTrXPBK2iKlsfgkuTeZAF5IpK3/O
8VDbs3pPqTzNp1wAiA==
=/w7C
-----END PGP SIGNATURE-----
Merge tag 'ntfs-for-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs
Pull ntfs fixes from Namjae Jeon:
- Keep RECALL_ON_OPEN in inode flags when reloading them from
$FILE_NAME
- Check runlist reallocation sizes for negative values and overflow
- Drop stale page cache after shrinking non-resident attributes to
prevent writeback failures and data loss
* tag 'ntfs-for-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs:
ntfs: drop stale page-cache when shrinking a non-resident attr
ntfs: harden runlist realloc size calculations
ntfs: preserve RECALL_ON_OPEN on WSL special-file reparse points
|
||
|
Linus Torvalds
|
bc29fe1c61 |
three ksmbd server fixes
-----BEGIN PGP SIGNATURE----- iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmptPL4ACgkQiiy9cAdy T1EteAwAu9BZVpUNaogLwPGzwlqcOjUVRU/oxH2olpRUe7BNtteyJ7kTwQZ65i1Q pFSH6h8upKv1cmavhC8mjip040ucam2OQ1jl/+QykTs2Q6zyrcJDuUFJTwacQ3D1 9B4gH0BB3xy4vIDAle+0Z7ucShqp+SN/gSzO2FKcJ8yDUl5+WeSS2lkt9MoAciMD Q9JbhXoBzIAyxTa4TCxBRVANNlwtagy4HkNNSNgx7+APkZAxLeVZN2xxHEDv3oE/ VyvArq1IUGdsqUkZmUsJw9jt9sUC46ySpOcxcFtKLVZ4KE3gxZHGn4IYepAM+AHf fscWkRG8cb1N601NwrnqgLc30ph9yUabRf/hDnlWqs5SptiMRmkeyYwE6fnU2Da7 VwExlNO+8rwerRg2MH336thS5JInH6hy/K+HcVEgzfIoel+NI3wUC+pxgqWlIo2B EcCsurzlQikBo70D9RkOiZeOEGuj/17Y/mWmJzXHwEUmJBzPc83eleKNv/ywl6+A 1VcTrtRF =l3O8 -----END PGP SIGNATURE----- Merge tag 'v7.2-rc5-smb3-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - Use memcmp() when comparing fixed-size binary ClientGUIDs, so embedded NUL bytes are handled correctly - Reject repeated SMB2 NEGOTIATE requests after dialect selection This prevents preauth_info leaks, enforces the SMB2 protocol requirements, and serializes negotiation state updates. - Fix a use-after-free in __close_file_table_ids() by removing the volatile file ID from the owning IDR before dropping the IDR reference * tag 'v7.2-rc5-smb3-server-fixes' of git://git.samba.org/ksmbd: ksmbd: use memcmp() to compare ClientGUIDs ksmbd: reject repeated SMB2 NEGOTIATE requests ksmbd: fix use-after-free in __close_file_table_ids() |
||
|
Linus Torvalds
|
f30ca2ce7d |
ata fixes for 7.2-rc6
- Fix PCI resource initialization in the sata_mv driver to keep legacy
Marvell boards functional (Rosen).
- Fix ahci_ceva driver initialization error path (Radhey).
- Fix libata header file to remove a kernel doc compilation warning
(Randy).
- Increase the timeout for the STANDBY IMMEDIATE command to avoid
suspend failures with drives that are slow to respond to this command
(Matt).
- Fixes for the handling of timed out commands in the presence of
deferred non-NCQ commands, to avoid excessive delays in executing the
error handler (me).
- Disable link power management for a couple of WD drives that have
been identified as not functioning properly when power management is
used (Niklas).
- Fix the device iteration loop when checking for link power management
support to correctly handle port multiplier setups (Niklas).
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQSRPv8tYSvhwAzJdzjdoc3SxdoYdgUCam01HgAKCRDdoc3SxdoY
dv7zAP9Fc6HE7yW9XtTWmHHDC/pqVBuxIpaWXggcBMPCY4GzkgD+MgA97IsQf6QU
4kun74jcJuZJzBbMjBNLesIzPaYQ5Qo=
=qRqX
-----END PGP SIGNATURE-----
Merge tag 'ata-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux
Pull ata fixes from Damien Le Moal:
- Fix PCI resource initialization in the sata_mv driver to keep legacy
Marvell boards functional (Rosen)
- Fix ahci_ceva driver initialization error path (Radhey)
- Fix libata header file to remove a kernel doc compilation warning
(Randy)
- Increase the timeout for the STANDBY IMMEDIATE command to avoid
suspend failures with drives that are slow to respond to this command
(Matt)
- Fixes for the handling of timed out commands in the presence of
deferred non-NCQ commands, to avoid excessive delays in executing the
error handler (me)
- Disable link power management for a couple of WD drives that have
been identified as not functioning properly when power management is
used (Niklas)
- Fix the device iteration loop when checking for link power management
support to correctly handle port multiplier setups (Niklas)
* tag 'ata-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:
ata: libata-sata: fix ata_scsi_lpm_supported() iteration
ata: libata-core: Disable LPM on WD Green 2.5 480GB
ata: libata-core: Disable LPM on some WD drives
scsi: libsas: terminate deferred commands on time out
ata: libata-scsi: schedule deferred atapi command
ata: libata-scsi: terminate deferred commands on time out
ata: libata-eh: Increase STANDBY IMMEDIATE timeout
ata: libata: avoid kernel-doc warnings
ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources()
ata: sata_mv: accept 1 or 2 resources in platform probe
|
||
Masami Hiramatsu (Google)
|
260b20d9b7 |
ring-buffer: Fix subbuf_ids memory leak in rb_allocate_cpu_buffer() error path
In rb_allocate_cpu_buffer(), cpu_buffer->subbuf_ids is allocated using
kcalloc() when buffer->remote is non-NULL. If a subsequent page allocation
fails (e.g., ring_buffer_desc_page() returns NULL or rb_allocate_pages()
fails), execution jumps to fail_free_reader.
While __free(kfree) automatically frees the outer cpu_buffer structure
at scope exit, kfree(cpu_buffer) does not recursively free nested heap
pointers such as cpu_buffer->subbuf_ids, resulting in a memory leak.
Fix this by explicitly freeing cpu_buffer->subbuf_ids in the
fail_free_reader error unwinding path when cpu_buffer->remote is set.
Link: https://patch.msgid.link/178550740672.380917.6067449683620196150.stgit@devnote2
Fixes:
|