mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-11-10 20:48:12 +00:00
1,485,174 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Linus Torvalds
|
db7afcbf9e |
sched_ext: Fixes for v7.3-rc7
- A task that skipped the BPF scheduler on its way back to its CPU's local queue could stall there until the watchdog fired, as the CPU had already decided to go idle. - Use-after-free of a destroyed user dispatch queue by a deferred re-enqueue request. - A task could be moved off a dispatch queue while the dispatching CPU was still running ops.dequeue() on it. - Bypass mode mishandled a sub-scheduler bypass overlapping an ancestor's, as across a system suspend. Descendants could leave bypass mid-teardown and tasks could be stranded on bypass queues. - The idle CPU selection helper could return a CPU outside the allowed CPUs of a pinned or migration-disabled task. -----BEGIN PGP SIGNATURE----- iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCatACow4cdGpAa2VybmVs Lm9yZwAKCRCxYfJx3gVYGdEvAP4tfwuDqRpiVDU/69SdALuWdObKorErLg/6uTxE 53qODgEA4Vvao1ZtcxzF3Fd+umA13UgiJ8WBxX66XJDMaxXtiAo= =LtsB -----END PGP SIGNATURE----- Merge tag 'sched_ext-for-7.3-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext fixes from Tejun Heo: - A task that skipped the BPF scheduler on its way back to its CPU's local queue could stall there until the watchdog fired, as the CPU had already decided to go idle. - Use-after-free of a destroyed user dispatch queue by a deferred re-enqueue request. - A task could be moved off a dispatch queue while the dispatching CPU was still running ops.dequeue() on it. - Bypass mode mishandled a sub-scheduler bypass overlapping an ancestor's, as across a system suspend. Descendants could leave bypass mid-teardown and tasks could be stranded on bypass queues. - The idle CPU selection helper could return a CPU outside the allowed CPUs of a pinned or migration-disabled task. * tag 'sched_ext-for-7.3-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs sched_ext: Rename scx_reenq_wait_dispatching() to scx_wait_dispatching() sched_ext: idle: Respect task affinity in restricted CPU selection sched_ext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor sched_ext: Propagate every bypass depth change to the descendants sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQ |
||
|
Linus Torvalds
|
e177c722b3 |
pci-v7.3-fixes-5
-----BEGIN PGP SIGNATURE----- iQJIBAABCgAyFiEEgMe7l+5h9hnxdsnuWYigwDrT+vwFAmrP3kgUHGJoZWxnYWFz QGdvb2dsZS5jb20ACgkQWYigwDrT+vzsGxAAsN2M6i1gbFHDljDAOEYJHtKevofh QFEiOUvlqhF/W5n5OFFIcvbnh4zeFYfZsnhkvEGl9/okCyRttUOVnzoddcL+Lep1 ijNA1oE/G0kyZh9uh/QMgMZc2q/+sqeK/hHT11yjIjRIgI6FZ9MiiNM+0q0Z19Yu 2E4dFS4vJxs/sIRz2xnuC3RrOgP1SpTW02GGNbPHw46rZ5XIQtUsolXSeCGF572w 7RByICd86WPtC18IygNWnDLhCgOEX2G2whx+U1XQLKabsntG64qhTOvToJh4cxQI WDYPGEM/6k9ZH9CmkUBga+AqKLIyJDTMM1e/0xDTqn4ZUN5xg1jTc6Wa3iZRK0ql GhT5rgsOg2q32OwABNlgO0DFK13nDaHCrnkwlqVMT1aGSNqVs+hJLKOaoXuttVTb FsE9vWdlFa78rf02h3mX4gQOn5sbadbCZDdg8WEnv5FDV6ihjqgG/c4ZRW+0Ld0v hevnSsZfGzNQndBeaCMj+nHF7j5EONTmMKS5M40WtF8B+//EbTcJC5II4DpugwrC oAiIBNiNC6huqsFxi9YxeRKCH2geNTVdZbRMK75mpQoHS8t4+AmYed5HxBvxG4Le AV7y+1Xsaq1P3LJEZpJkOEs5A0za2l358Ujn9qWDJmWUDxs6irqb6eKjocD8niUO 1iVQVjG/e9REYBA= =VrQ6 -----END PGP SIGNATURE----- Merge tag 'pci-v7.3-fixes-5' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull PCI fixes from Bjorn Helgaas: - Leave ANFE masked on Apple T2 Secure Enclave, which fixes spontaneous poweroff regressions on MacBookPro16,1 and likely other models with the T2 caused by new Advisory Non-Fatal Error support (Jason Perlow) - Move dw-rockchip INTx IRQ setup from rockchip_pcie_host_init(), where it runs after every reset, to the rockchip_pcie_probe() path to avoid installing new IRQ handler (which causes INTx IRQs to be lost) and leaking an IRQ domain on every reset; fixes a regression added this cycle (Shawn Lin) * tag 'pci-v7.3-fixes-5' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI: dw-rockchip: Move INTx IRQ setup to probe PCI/AER: Keep ANFE masked on Apple T2 Secure Enclave |
||
|
Linus Torvalds
|
0fcb05b723 |
Crypto library fixes for 7.3-final
Fix two Poly1305 bugs including a lost carry bit, and add a regression test. -----BEGIN PGP SIGNATURE----- iIoEABYIADIWIQSacvsUNc7UX4ntmEPzXCl4vpKOKwUCas92XxQcZWJpZ2dlcnNA a2VybmVsLm9yZwAKCRDzXCl4vpKOKzlqAP9wGX5K4F95NgzPhJ/AG0Ze5aEiRzbR Bay8csFZoftMoQEA2LipJ8lmHFrvOHwIiiUP/d3LWWXiEYaq4+y0R7CYXwo= =CmWW -----END PGP SIGNATURE----- Merge tag 'libcrypto-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull crypto library fixes from Eric Biggers: "Fix two Poly1305 bugs including a lost carry bit, and add a regression test" * tag 'libcrypto-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: lib/crypto: tests: Add Poly1305 split-update carry regression test lib/crypto: arm64: Fix lost Poly1305 carry when resuming NEON state lib/crypto: poly1305: Use memzero_explicit() in poly1305_final() |
||
|
Linus Torvalds
|
4056b3c9d3 |
NIOS2: update for v7.4
- Fix __wsum type degradation in csum_fold() -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEoHhMeiyk5VmwVMwNGZQEC4GjKPQFAmrOwjwACgkQGZQEC4Gj KPQ4eA//T6JMiR10m9y1bdOZToEfPzJS8st30iwGBTdj0hRWPyxZC8ggOLBpNgFV yJ3/ItNLb97X4tDH2FQSfwNgwK3zexP2Qpj42UbhlIt5O8B2TNN2w4ZCYj4m10z8 d0xbQUQiqJtpeLJwl3wAyGUJVFyTrvYLNHcuqFNTRamQau5Ssf5SzXSyLa78K/qR rfHrYVD2+uI41j2JcZ0HhK2kaI/+oqLNOfWjwdnhPonlnWmGhpLq0J2A5uKQCl3T InF4Vl9Zipq3UZahA79RhVTkidlOsvz36D8PKhREsxxWOP5DTQIWMrhHyMITShMC xnDXUzvPs2zqoeS6m4VxgEJ4JYWtflC92eiDMZ9KdA6CNFjRc1jfzxHty8QrjA6D 8s4fUL43ytUrgJGGr15E8bygK3DPzsiDhAziuilIarh90OuTPdaAinafHjWpz2aL HUGkCavJb9PV24xrvs5JgS+FGGE73GIl903YFSkXt6t69HYk9Y8tasIh8I2DxFhJ evzEIc+/g+E87zjjqHQmPI7zJNui7q11XpHZvbmrgOLD8h6QEbuhrmZk7dClFDgv Ho4VuFDImpzpCtuM44+3BxTLUXLCHCSnkYmcQKJj5Zsc8EoB8lN3woq5fnd96Ph9 +kqviVJ9yhISq4rrmOLG9TAscv31dGfOqlUX7NIyN0G++O7P6co= =Fhwg -----END PGP SIGNATURE----- Merge tag 'nios2_update_for_v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux Pull NIOS2 fix from Dinh Nguyen: - Fix __wsum type degradation in csum_fold() * tag 'nios2_update_for_v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: nios2: fix __wsum type degradation in csum_fold() |
||
|
Linus Torvalds
|
d77bd0d469 |
Power Supply Fixes for 7.3 cycle
* power-supply core - prevent unregistering a power supply while a callback runs * power-supply drivers - generic-adc-battery: Fix temperature IIO channel conversion - ds2780: Fix ds2780_get_capacity() returning raw value - max17042_battery: Fix vmin assigned instead of vmax in DT parsing - Fix maintenance charge table kernel-doc -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE72YNB0Y/i3JqeVQT2O7X88g7+poFAmrOwSkACgkQ2O7X88g7 +prAqw//d/NwWB6j/ZgAmi7Ww7BDnZrpHIaPrwc6t2qLG6Mu+WgWeGuKjIEd3dye +j+nSQBwEnE2yI1bJK/R2suV3c3MeMBga24W3QQ9smYvRsH+btR59TVb5Aak/l0B eo3UM8DC36k9+pzOpPFFqqf7tJNcatkC3jUdqp9nL1FA/dITc7OrVhsFkSAijjO+ U2BhXFvw9Oy1vkXPbEew9kmfi0DyYVsJJc0G7PNsJmlmS1q+VOZMTtGhXKy5/BG0 XR4BDOv7Sas7gETkTz3CKD+5IYRx7j2nah4slVYXmFImnpWfhsVCBPGdPR4jhGW6 5L5+TlK21DRvIEoaQZWdkvxvAqXIqHINUZzGNHiqdhBEYRT2Qr+KtyTVfYOeUmh7 IHLUJl+HpuZn5V/jfCkxfrSrNqmyK0/8O6hVVyvn7I6eEmTWvd6b8AcWr++TQTZa xgZl2js9F7DZ176cJaf/3rn9twShuQ2xhAtbVTr1V+HbD5IBGheQ/TfELLVUr/m1 JKBUjDRY060EROXhTkcXs3Lwt7hSFqj/fKggiWJZKqsMnSgJjyaTwpLx9k88Qqqn 5eyyjFZDEqcT8fzb5MwRvCLYVJbcJ0Up72e5xi4nXBfLcuC1jVeOG4hiwF55obrb XvFx8TQvOLVdy7H15ZX0fwOiNj68lUZi+1jebQWhoTb5z9GdkBg= =QLJn -----END PGP SIGNATURE----- Merge tag 'for-v7.3-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply Pull power supply fixes from Sebastian Reichel: "power-supply core: - prevent unregistering a power supply while a callback runs power-supply drivers: - generic-adc-battery: Fix temperature IIO channel conversion - ds2780: Fix ds2780_get_capacity() returning raw value - max17042_battery: Fix vmin assigned instead of vmax in DT parsing - Fix maintenance charge table kernel-doc" * tag 'for-v7.3-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: power: supply: core: prevent unregistering a power supply while a callback runs power: supply: generic-adc-battery: Fix temperature IIO channel conversion power: supply: ds2780: Fix ds2780_get_capacity() returning raw value power: supply: Fix maintenance charge table kernel-doc power: supply: max17042_battery: Fix vmin assigned instead of vmax in DT parsing |
||
|
Linus Torvalds
|
ca3e345926 |
Bootconfig fixes for v7.3-rc7:
- bootconfig: give the footer size static_assert a message
Add a message to static_assert() macro because it is required for
the compiler before C23. This fixes a warning.
-----BEGIN PGP SIGNATURE-----
iQFPBAABCgA5FiEEh7BulGwFlgAOi5DV2/sHvwUrPxsFAmrOu6YbHG1hc2FtaS5o
aXJhbWF0c3VAZ21haWwuY29tAAoJENv7B78FKz8b35gH/RzXQDziJaIHlRzShWV0
sHmbcfpI9exgNWn49g5CrmGTaCwTp9Ejmg9VoOxCTMSeZsd5/WDNSJj4vU0lwkYY
1UgKUhCbvNjuoXT2hrlMcYPldHYbQHpcD70cnnQKVqS3YlEMMXGxzhdyRYwwY16+
OaS8IQKvlUOgRAPIvMjbYXJCcwJHwceErkkXcEaIzchemu77Oo/Av5QcaB6/8mLu
FLN9VcK8ddDQvSaM/zMfpQ/Hg/DJf35/rYp4pXpkoSeA0EkXPuuQP/20/sL6+XzP
dVymgUr4aomEk+jHv41tf4u/tRAssKNLyido36Zb5jGD2FDJascmvECZCfu+umRq
kJk=
=jayF
-----END PGP SIGNATURE-----
Merge tag 'bootconfig-fixes-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull bootconfig fix from Masami Hiramatsu:
- bootconfig: give the footer size static_assert a message
Add a message to static_assert() macro because it is required for
the compiler before C23. This fixes a warning.
* tag 'bootconfig-fixes-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
bootconfig: give the footer size static_assert a message
|
||
|
Linus Torvalds
|
cbc08c2047 |
turbostat-2026.09.28
Since turbostat-2026.04.21: bug fixes -----BEGIN PGP SIGNATURE----- iQJIBAABCgAyFiEE67dNfPFP+XUaA73mB9BFOha3NhcFAmrBOeQUHGxlbi5icm93 bkBpbnRlbC5jb20ACgkQB9BFOha3Nhd3HBAAswLnK3kpYJ9hv/DzeH1vBpZBxXM4 fS3hydlvPHjnJ0XCxnCfpITzzJm9VRVdBm4cVKYbzZe/KPC8IqhaPN1/mxa226JB wGNg5GaWqmHyCnd0oTEnqnsp1xSIubAOCsAbJiqxvJaNvLfJ2x329WAD87MSjkSD OWiJJyOWno57ZnriC8S6HjqVbc15luDh0Iu/OsuVbGo85cbLh/jgfok4MmGEEQma ms/csuE4Fz7xnM3bgezs5xyr+Mk6AYlGKFJQsjNnmplWKS31UIw//DW4c0ESmpan 0xYwkJL8S/+/fZxZVHDsIHqUTolaTEH6P99fpvaVhUo/ewrUX8uUpJJM017+kvCD 2ZmLqwwqsZ8cDU27eoyv0lCKEkO5kyesXmmx5pfxLEYZNPS2NpASlAmgC7iONQdR MRVTrgbaUs1L1u8jlpPG6mWJwrAE9LXNVkoDeVCtEmSHJk+GbRFN/NoBeUck9iwT 5YHUWjU1Ccs4Ac04eoa2YB8yM51nDyeb8CAgUTHSZ/hRjy+fzFt2rblf3IIjRti7 1PFsG+vTGK82PqwGwq3mHew5K8302x1rvwIt9VJk89DLYHHjR7pGkyuYVLNUe75a XTTDTxCv8pBC8wJNW5HTOUhdl4gcM+2P1pouNkoCFU79/V9m5u/HJkv7mrZYybIW 9VmBSMFKV0y87FE= =5B9V -----END PGP SIGNATURE----- Merge tag 'turbostat-2026.09.28' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux Pull turbostat fixes from Len Brown. * tag 'turbostat-2026.09.28' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux: turbostat 2026.09.28 tools/power turbostat: Fix add_counter issue if > 24 counters. tools/power turbostat: Fix PMT error path fd handling tools/power turbostat: Fix CWF PMT off-by-one tools/power turbostat: Fix fd_perf leak on reset tools/power turbostat: Sanity check GFX%rc6 and SAM%mc6 percentages tools/power turbostat: add NULL check after calloc() tools/power turbostat: Warn, but don't Err on out-dated perf systems tools/power turbostat: Read complete CPU lists |
||
|
Linus Torvalds
|
03741bcea0 |
More x86 fixes:
- Fix a WARN if the SS bit is set in #NPF exit codes; the AMD manual is unclear about whether it can be set when the guest uses CET but the SupervisorShadowStackEn feature (which KVM does not use) is disabled. However, Hyper-V has started using CET now that KVM supports GMET (it wants the two feature in pairs), and that dissolves all the doubts: the SS bit *is* reported and not clearing it causes a WARN and/or a UBSAN splat. - If creating a vCPU ultimately fails, clear its entry in the AVIC Physical ID table used by hardware to perform IPI Virtualization and delivered posted IRQs. I.e. plug the same use-after-free hole related to IPI virtualization and posted IRQs that was fixed for APICv by commit |
||
Keith Busch
|
b963f2345f |
nios2: fix __wsum type degradation in csum_fold()
csum_fold() shifts a bitwise __wsum type, which sparse reports as
"restricted __wsum degrades to integer". Sparse only checks the body of
a static inline once something instantiates it, so this went unnoticed
until a recent block layer change added the first csum_fold() caller to
a file built on this architecture.
Force cast to a __u32 for the shift, as the other architectures do.
Fixes:
|
||
Kuba Piecuch
|
2935062be7 |
sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs
A task can be found on a non-local DSQ while the CPU which dispatched it is still running ops.dequeue() and hasn't cleared SCX_OPSS_DISPATCHING. The DSQ consume and move paths don't wait for the dispatch to finish and can operate on the task concurrently with the dispatcher. Call scx_wait_dispatching() in scx_move_local_task_to_local_dsq(), unlink_dsq_and_switch_rq_lock() and move_task_between_dsqs() before they operate on the task. In scx_move_local_task_to_local_dsq(), wait before scx_resolve_local_dsq() as it may update p->scx.flags. Fixes: |
||
|
Kuba Piecuch
|
18f5c699d1 |
sched_ext: Rename scx_reenq_wait_dispatching() to scx_wait_dispatching()
Waiting for SCX_OPSS_DISPATCHING to clear isn't specific to the reenqueue paths. Any path which takes a task off a DSQ can find it while the dispatch is still in flight, and the next patch calls the helper from the DSQ consume and move paths. Rename it to scx_wait_dispatching() and update its comment accordingly. No functional change. Reviewed-by: Andrea Righi <arighi@nvidia.com> Assisted-by: Claude:claude-opus-5.5 Signed-off-by: Kuba Piecuch <jpiecuch@google.com> Signed-off-by: Tejun Heo <tj@kernel.org> |
||
Shawn Lin
|
4e9f69d082 |
PCI: dw-rockchip: Move INTx IRQ setup to probe
Since commit |
||
Jason Perlow
|
7209846a16 |
PCI/AER: Keep ANFE masked on Apple T2 Secure Enclave
Commit |
||
Hui Su
|
6ac4544eff |
sched_ext: idle: Respect task affinity in restricted CPU selection
The restricted select_cpu kfunc path handles single-CPU and
migration-disabled tasks without going through scx_select_cpu_dfl().
It currently uses prev_cpu as the candidate, even though prev_cpu is only a
hint and may no longer be usable after an affinity change. With a
caller-provided @allowed mask, this can also return an idle CPU outside
p->cpus_ptr.
Derive the candidate from task state instead: use the sole CPU in
p->cpus_ptr for single-CPU tasks and task_cpu(p) for migration-disabled
tasks. Validate it against p->cpus_ptr and @allowed before claiming its
idle state.
Since the derived candidate may be on a different NUMA node from
prev_cpu, also preserve SCX_PICK_IDLE_IN_NODE by rejecting cross-node
candidates.
Perform all checks before scx_idle_test_and_clear_cpu(), as a successful
call consumes the CPU's idle bit.
Fixes:
|
||
Tejun Heo
|
5bdeca322a |
sched_ext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor
scx_bypass() claims bypass dispatch when the scheduler's depth goes from
zero to one and releases it when the depth returns to zero, but propagates
only the depth to the descendants, not the claim. A descendant that starts
bypassing with its ancestor never claims, and one whose own bypass ends
under the ancestor's keeps its claim, as its depth does not return to zero.
A sub-scheduler enable whose bypass ends under a PM suspend thus leaks its
claim: the parent keeps hosting bypass dispatch and the sub-scheduler's next
bypass trips the WARN_ON_ONCE() on the claim. A sub-scheduler disable that
starts under a PM suspend has no claim, so once the resume lifts the root's
bypass its tasks sit on the parent's bypass DSQs with nobody consuming them.
Claim for every descendant whose depth goes from zero to one in the
propagation and release every scheduler in the subtree whose depth returned
to zero once the tasks have moved out of the bypass DSQs. A parent that is
bypassing itself when a descendant claims consumes only its own bypass DSQs,
empty until it leaves bypass and becomes the host.
Fixes:
|
||
|
Tejun Heo
|
dcf7f650a2 |
sched_ext: Propagate every bypass depth change to the descendants
scx_bypass() propagates a depth change to the descendants only when the
scheduler's own depth crosses zero, so an own bypass that starts under an
ancestor's never reaches them. When the ancestor's bypass ends first, the
descendants leave bypass while the scheduler is still bypassing: a
sub-scheduler disabled under a PM suspend has its children re-queue their
tasks through their own BPF schedulers at resume, mid-teardown. If the own
bypass then ends, every descendant is decremented once more than incremented
and dec_bypass_depth() warns, though no current caller gets there.
Propagate on every call so that a descendant's depth is the sum of its own
bypasses and its ancestors'. The early return follows the walk, as a
descendant's depth is at least the scheduler's and nothing changes bypass
state unless the scheduler's own does.
Fixes:
|
||
Paolo Bonzini
|
e90ab36691 |
KVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes
When running Hyper-V from Windows 11, KVM is seeing the SS bit set in nested page fault error codes produced for shadowed NPT. The AMD manual is unclear about when SS is set, including whether it can be set when SupervisorShadowStackEn (bit 6) is not set in the MISC_CTL field of the VMCB. Nevertheless, the unexpected SS bit causes out of bounds accesses in permission_fault(), seen as either WARNs or UBSAN reports: kernel: UBSAN: array-index-out-of-bounds in arch/x86/kvm/mmu.h:225:27 kernel: index 34 is out of range for type 'u16 [16]' (in this case, the page fault error code is 34*2=0x44, i.e. SS|U; the report shows SS|U|W happening as well). Fix the handling of unknown error codes by dropping SS and (with a WARN) any bits not among those that permission_fault() expects to receive. At the same time, given the uncertainty about when hardware sets SS, follow the processor's behavior when constructing the fault's error code, and preserve the SS bit as passed to FNAME(walk_addr_generic). While the behavior is surprising, there's a possibility that Hyper-V expects it (Hyper-V does not even enable CET unless it finds MBEC/GMET!), so retain the information when reflecting the fault to L1 instead of unconditionally discarding it. Bisection shows that this started happening with commit |
||
Sasha Levin
|
a1ddc27214 |
bootconfig: give the footer size static_assert a message
static_assert() without a message is a C23 feature, so clang warns:
main.c:498:56: warning: '_Static_assert' with no message is a C23 extension [-Wc23-extensions]
Add a message.
Link: http://lkml.kernel.org/r/20261011223358.2327625-13-sashal@kernel.org
Fixes:
|
||
|
Linus Torvalds
|
24a19b953e | Linux 7.3-rc7 v7.3-rc7 | ||
|
Linus Torvalds
|
d6d3455d87 |
Landlock fix for v7.3-rc7
-----BEGIN PGP SIGNATURE----- iIYEABYKAC4WIQSVyBthFV4iTW/VU1/l49DojIL20gUCasuxWRAcbWljQGRpZ2lr b2QubmV0AAoJEOXj0OiMgvbSHaEA/2qsakLl6MYmTQ5+c4MAdtPcJXttnQJoAWJl t5OrpCQEAP9A/DSj46Ci2ocnfbfvhtfHgzX5CQMef8nxUillfVYnBw== =G4p3 -----END PGP SIGNATURE----- Merge tag 'landlock-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux Pull Landlock fix from Mickaël Salaün: "This fixes a Clang bug by removing an annotation, which was introduced mostly for documentation" * tag 'landlock-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: landlock: Drop __counted_by from landlock_domain.handled_masks |
||
|
Linus Torvalds
|
f479598167 |
spi: Fixes for v7.3
A small collection of driver specific fixes, plus a new device ID in the DesignWare device tree binding. One of the sg2044 fixes which enforces clock limits properly is more critical than average since getting them wrong might lead to data corruption. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQReagvpf3TrrA7BoYYv73Ows9A4iQUCasrOmAAKCRAv73Ows9A4 iVT3AP9OD2ppR1G68eZZH3qB1Q9jhHAWREihWUqZZ+Y3I+hiVQEA8O0uTgTFveMw usHV1vv81Ca4EPAEmAKbrhBAH3oAMgY= =ibsk -----END PGP SIGNATURE----- Merge tag 'spi-fix-v7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A small collection of driver specific fixes, plus a new device ID in the DesignWare device tree binding. One of the sg2044 fixes which enforces clock limits properly is more critical than average since getting them wrong might lead to data corruption" * tag 'spi-fix-v7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: dt-bindings: snps,dw-apb-ssi: Add Synaptics sl2610 spi spi: sg2044-nor: Honor SPI clock limits spi: sg2044-nor: Return transfer errors spi: cadence-qspi: Fix status polling with octal DTR chips spi: spi-nxp-fspi: exit stop mode before waiting for DLL lock |
||
|
Linus Torvalds
|
5906f156e8 |
regulator: Fixes for v7.3
There's a couple of core fixes here, there were a couple of issues with of_regulator_bulk_get_all() not behaving consistently with the other bulk regulator APIs which caused memory leaks and error handling issues in users. We also have a of fairly standard driver specific fixes. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQReagvpf3TrrA7BoYYv73Ows9A4iQUCasrJ0QAKCRAv73Ows9A4 iSA9AP9lETVKHzhDIU+QiXmXh5mDVXTrpA0JXC6HL7fMUAgS6QEA4REJaKEbp9pU lvMfR/lTS88EbrtKF+ZuDM+EkIa+qQc= =xELe -----END PGP SIGNATURE----- Merge tag 'regulator-fix-v7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "There's a couple of core fixes here: there were a couple of issues with of_regulator_bulk_get_all() not behaving consistently with the other bulk regulator APIs which caused memory leaks and error handling issues in users. We also have a couple of fairly standard driver specific fixes" * tag 'regulator-fix-v7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: ltc3676: don't read the write-only HRST and CLIRQ registers regulator: of: state who owns the array from of_regulator_bulk_get_all() regulator: of: fill in supply names in of_regulator_bulk_get_all() regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4 |
||
|
Linus Torvalds
|
d5b6dc381d |
SCSI fixes on 20261011
Driver (and tape media changer) only fixes. Three of the fixes are about the same size, (ch, ufs decouble CQ and ufs avoid unsafe MMIO) but the unsafe MMIO is the least obvious logic change. -----BEGIN PGP SIGNATURE----- iLgEABMIAGAWIQTnYEDbdso9F2cI+arnQslM7pishQUCasspJRsUgAAAAAAEAA5t YW51MiwyLjUrMS4xMiwyLDImHGphbWVzLmJvdHRvbWxleUBoYW5zZW5wYXJ0bmVy c2hpcC5jb20ACgkQ50LJTO6YrIUL5gD+Lwi6HVanx/zkn6Qy+9N0Kx0IZTsamTpM Aug3Rx74YWYA/ii94bbXr0xrdohBAdPO1MppOQGfmcTqdHAIP/7lxWzn =EeOd -----END PGP SIGNATURE----- Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Driver (and tape media changer) only fixes. Three of the fixes are about the same size, (ch, ufs decouble CQ and ufs avoid unsafe MMIO) but the unsafe MMIO is the least obvious logic change" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock() scsi: ch: Do not keep references to data transfer element devices scsi: ufs: mediatek: Handle mPHY power-on failures scsi: qedi: Initialize callback state before registration scsi: ufs: core: Hold a clock reference across the probe |
||
|
Linus Torvalds
|
4375b45d70 |
block-7.3-20261010
-----BEGIN PGP SIGNATURE-----
iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmrLiicQHGF4Ym9lQGtl
cm5lbC5kawAKCRD301j7KXHgpvOmD/452m7OeggU07h2q1wqdiw2lh5zIvXcjQIF
ih4nl5lezismqbenazF6IqSsz5YAq5SM0EroNEXrQnr2UzndjyXyVN3fPdQVA+7R
8Hg3rlU31XzGW+WZknGx25RfaIGovNbJUFhPMuYpY41raOSevwIhx2X3k5UZUAWd
4id28sXJTMk097XdQnfqNcaXcu3FDHx9ZcOKlSyRWaZD36vY4XPFwrFESyMzyWWJ
PhfwTBG6/MxxzOS0QdCzkSpA1L1Ipj48LO87X/RMX8NnrXw5Gar6+1NhVykfocdb
acKxUaAw5VF72Uinrrm+f7tMIAmsoFzwJR+VXJJxYNQMB2GLBL69BOsz9Qmr6qaA
71GQ52wfGh8fajeUH5C+pTDab4zZwY9X+ugGoocXaK/f43vxLARYLevC/MEionD/
HbZazH79Ock4dLolMBKgDXhrLUZbk/d0TiJpJezaaO+v09KlWDyhf+uzFOKkfdUL
YUsXGkQT+cp1ymN2M7Stiey+b2EMPhU8NjL/Sb52o3gllxeP8tUfXfGimxIWH1k3
fhzqYHpZNROCB8wzqeawqkZzJPpe7Xj5H5FRDf6fiqWZ+BelD1Je+mq1Ck53XLKr
tmDnmFwl7B+FrX519u4BqObW95PKC/0JsrmW5BeW+mHjbIHnOCTVsZiEoW+Q+Q57
3twF8ITLUA==
=jxPV
-----END PGP SIGNATURE-----
Merge tag 'block-7.3-20261010' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull block fixes from Jens Axboe:
- NVMe fixes via Keith:
- Fix swapped ZRASF zone state values for full and read only
- nvme-multipath revalidate head zones after unfreezing the head
queue
- Revert "nvme: do not reset controllers in NVME_CTRL_NEW state",
which broke things
- nvmet fixes for invalid NSIDs on feature 82h and using the local
P2P device on metadata allocation failure
- zloop: zero out only the unread tail of a short read
* tag 'block-7.3-20261010' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
Revert "nvme: do not reset controllers in NVME_CTRL_NEW state"
zloop: zero out only the unread tail of short reads
nvmet: use the local P2P device on metadata allocation failure
nvme-multipath: revalidate head zones after unfreezing the head queue
nvme: fix swapped ZRASF zone state values for full and read only
nvmet: return Invalid Field for invalid NSIDs feature 82h
|
||
Nguyen Ngoc Thang
|
3d8cc52db2 |
landlock: Drop __counted_by from landlock_domain.handled_masks
With clang 22 and CONFIG_FORTIFY_SOURCE, the second
landlock_restrict_self() call hits a bogus fortify report in
inherit_ruleset():
memcpy: detected buffer overflow: 4 byte write of buffer size 0
Call Trace:
__fortify_panic
landlock_merge_ruleset
__se_sys_landlock_restrict_self
handled_masks[] lives in an anonymous struct inside the anonymous union
that overlays work_free. For such a flexible array, clang computes the
address of the __counted_by counter as the start of the array instead of
&num_layers. The bound is then read from handled_masks[0], i.e. from
the first layer's access masks, which is not a count. The same layout
crashes clang itself in a standalone test.
The annotation was added as documentation, so drop it rather than
restructure the union. Keep the information in the member comment.
Reported-by: syzbot+a0eecb22de4d821a9e5d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=a0eecb22de4d821a9e5d
Fixes:
|
||
|
Linus Torvalds
|
b7c0316c1a |
io_uring-7.3-20261010
-----BEGIN PGP SIGNATURE----- iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmrLihgQHGF4Ym9lQGtl cm5lbC5kawAKCRD301j7KXHgpqHYD/0WmtUynMfrRLjrod20cJV39pzOSBLVgAgu 9q4y6/o5UP6AFlenvvejA09AzAW14TpIx1xw+wz9W7kOIEfBFdYr+8ZlLdJCVY7+ COMDryOgoSZqd77CTUZ54V7d+z4dEOEYtkfpDBxq/0bbUrZpDB3UGHcQm1GBAj7y FGPIAqmjJ6BH5ymNlCwjmBhgkSSsscKtlJXHUgpDNrwPwndmcg38on3QWmNJP97u tnOO2j8Xy5TYDoGJ8liK37y56YKtR+vYiIRd1rlCvdtvtmaMBKkj3NNFMUGMEC25 1qapshKstL+20ZUmXTITGMxOfsrsZSj3nT93BV3W8jt/POMbhzX5W7zO8fS3gDKW 9XNYQXL2zMfp6iF3zIU3nsdcggK/T1uBtDXQureM8zl8QQa7XgJOCW8b8eNJZAo2 /W7Hz5TKshnrkXGEIvKWCb/UcrijHMLbtQ+eGcj/TeteMvO69bl+fQn0tzlOud0t lqMmFsuZMa6mkYn2XV86Ie2tf0AOS5LSGKsWwvkmAg5Pkz1l5qIDTyuLFEDfWQpg N3uLC/uo4+ap1s3ccUX6Pb8feZ1GVtjS7Wsqe04DFxFCESllbYiwkUMAGPFST7l8 SFZuafe/eJbW/MFnB/AKk5jBWMcwXP+usBWq/0w1/ETA4DhWXLQQnIefI1FoZpZa OjOfFuKDYA== =GaD2 -----END PGP SIGNATURE----- Merge tag 'io_uring-7.3-20261010' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: - Don't spin on local work the exiting task can't run. For a ring still R_DISABLED when the task got its tctx node, the submitter is set later and may be another task, so DEFER_TASKRUN local work stays pending forever and the exiting task spins in do_exit(). - Don't charge the SQ/CQ rings or provided buffer rings to RLIMIT_MEMLOCK. The region API conversion started charging them, which the rings had been exempt from. - Don't exempt disabled rings from task restrictions on register - Populate the CONNECT filter fields for a 24-byte sockaddr_in6 * tag 'io_uring-7.3-20261010' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/cancel: don't spin on local work the task can't run io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6 io_uring/register: don't exempt disabled rings from task restrictions io_uring/kbuf: don't charge provided buffer rings to RLIMIT_MEMLOCK io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK |
||
|
Linus Torvalds
|
5f97a3ec36 |
xfs: fixes for 7.3-rc7
Signed-off-by: Carlos Maiolino <cem@kernel.org> -----BEGIN PGP SIGNATURE----- iJUEABMJAB0WIQSmtYVZ/MfVMGUq1GNcsMJ8RxYuYwUCassr8wAKCRBcsMJ8RxYu Y0zlAYDt4ReluNicsRWxFKTeSU9GSJ3asMlyV24nBxOxj6ggzpMkJpU76aVDFCaq NDn13vEBgMVppi1VVMez8tYOOL390yfzlWnpq38mPaMnv4cXDQGZUvETcL1n+4U+ xVf/7NasOQ== =X+Ty -----END PGP SIGNATURE----- Merge tag 'xfs-fixes-7.3-rc7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Carlos Maiolino: "This fixes a data corruption vector where a user could trick the exchange-range feature to add shared blocks beyond the file's EOF, which may then be used to modify data on another file" * tag 'xfs-fixes-7.3-rc7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: fix exchange-range-to-eof file size exchange xfs: stop exchanging reflink flags when exchanging mappings |
||
|
Linus Torvalds
|
4d61397c86 |
x86 fix:
- Work around AMD TLBI Erratum #1718 (Borislav Petkov) Signed-off-by: Ingo Molnar <mingo@kernel.org> -----BEGIN PGP SIGNATURE----- iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmrLN7QRHG1pbmdvQGtl cm5lbC5vcmcACgkQEnMQ0APhK1hFohAAqJHoyW96qIFMKak6sY63CaJ3lDfFmaB2 8aZW8oKhmjTCECHH/Ff7wDxIL733CsdaxynnJ9YxAmujpsAmaO6Tk8PxuGaVPJsJ pTW8w4ViVJdnsaNzCQpbm8iB3Q5anmiqwgSd/2C8mmEZVF04ZtzmMKyGeGG99GPH p7AzpQKkh0UAjIGCV0i1KXQzboHXld4APJGcoiQIAmNBzdHjJBVrJA+vsUzdcLOf nufTe01afNa2ehlB2cwy0eOn9/+cnZsF4jObFBvmXYjD1rucYSRvUCWOFTMNt5vP Sj57hhhU5ozSHkZVz9I2l6W+7txk9qhLXPA3cFs3FDFjhXFqUo/mmRn/oQxwGzCR fsMq5ImTWTzdTuTzlhWFbNLUJOc0OFWMidyVb2eul9kipz451KFVssuTEWwpV3Mb fEfjPZnnuEAz+0kVckuLGEsROQFst0VDv53BVUSfmunIGZFtyWH1rIpEn4AeIYUC vT66l/pPYqF1tJcX2OB2tHgY2Qw2OCfQPloYrchLTsE2us+fpwZIp8du2yqjasGK 75V0AGDFV2xNkt+x76HZ0bKaFihfg3M7e0NZbon1BF3d4w/Z0HZ/JVaUEBglKTnz QdLD6Y8nKroaTazHfwCwR8JUPesFOuxAqIlZdEXWt2/adfgs7HaTjwu14nD5rrbQ eQhaUR6PyUE= =x9f4 -----END PGP SIGNATURE----- Merge tag 'x86-urgent-2026-10-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fix from Ingo Molnar: - Work around AMD TLBI Erratum #1718 (Borislav Petkov) * tag 'x86-urgent-2026-10-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/CPU/AMD: Fix AMD TLBI Erratum #1718 |
||
|
Linus Torvalds
|
b2d929a1c2 |
RISC-V updates for v7.3-rc7
- Fix a regression in the Zbb-enabled strnlen() implementation when
huge counts are specified
- When userspace pointer masking is enabled, strip the tag from
user-specified pointers in two spots in the RISC-V futex code where
this was missing
- When CONFIG_SHADOW_CALL_STACK=y, use a supervisor mode-only CSR bit
to determine whether the trap came from userspace or not, rather
than a userspace-writable register
- Reset the HSTATUS.HU bit during CPU initialization to avoid
unexpected behavior, as the RISC-V specification does not require
this bit to be hardware-reset
- Fix the T-Head GhostWrite probing code when !CONFIG_ERRATA_THEAD_MAE
- Fix RV32 boots using 32-bit.config by constraining NR_CPUS
- Implement a workaround for SiFive MAL-9092, which requires fences
around hypervisor load/store instructions
- Fix the RISC-V patch_map() code to work properly for EXECMEM
addresses when !CONFIG_STRICT_MODULE_RWX
- Fix ptrace register set access reporting when CFI landing pad or
shadow stack support is enabled
- Avoid copying garbage into the target's vstate when PTRACE_SETREGSET
is called with a short iov_len
- Fix load_unaligned_zeropad() on RV32 kernels with
CONFIG_RISCV_EFFICIENT_UNALIGNED_ACCESS=y
- Fix build breakage for any userspace program that includes
uapi/asm/vendor/mips.h
- Fix a build warning for 32-bit allmodconfig builds related to SiFive
errata
- Fix misspecified inline assembly constraints in the vector context
save/restore code
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEElRDoIDdEz9/svf2Kx4+xDQu9KksFAmrLCxIACgkQx4+xDQu9
Kkv0uRAAmTamkNXZpPx0WF9/i48d+40TS7U45u+w0wKbNxgRR+R4jNHOGr91bNQn
82pOG7c8AQbDJv0bed9EgdYQCQR58VC+GXLcCdV9ZvINs9ffIpyoYlD0kL5YXjSv
0kEM6ZCFn3+tLLko8e3UuBGZwnwN2VeyBae1TOutJx/jjTU6R2vrZHAsNd4ol3PB
CcZX533cbNDY4NKZHzniPXdWPdzWK42I5+HwNayf3BFUEsnN/JUZwHI0sTt3wgZo
DpOTRm/C883VelF8NnpPl0cAEux/0KfTP0GPsnPFOvuvIDA/Hn/PfRhweyjCRZ1r
LYWYLpvpbkCOPvyzFL0eKzl1DOgz8KtqdqOA/qUUooxog1egJ9uBynXrh0We4IV1
EbxRjKDiJ7QJJsX8m0xpWtMFYU0hQ3MHxePAxeSVdA5mHksEhWxvudWScwm2Cpt7
9Vq01WmyV3uBMlq7Cd9KJxyNGOTikpciMnUIR4h0WaHZxuevAfgXhs2dVRS2u/Be
a2CztPGV931/1BGLP+wV6I6BXqet+4Q86VDo1Dcj7u6Zr0NyjmJYfz64cmNrSVWZ
CDm9wvxhEedD+9fNvP4fx8B+8nRNZDpWtpevkFy5iDHkd9xeauKax9njrH/gw2S4
lIZZ1+5D14c/d6s0OJIwrMe+xcYu3cZ6qVCEmQXuO3jTHiXky4I=
=ZFs2
-----END PGP SIGNATURE-----
Merge tag 'riscv-for-linus-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux
Pull RISC-V fixes from Paul Walmsley:
"Several security fixes, a significant strnlen() regression fix, and
several other miscellaneous fixes:
- Fix a regression in the Zbb-enabled strnlen() implementation when
huge counts are specified
- When userspace pointer masking is enabled, strip the tag from
user-specified pointers in two spots in the RISC-V futex code where
this was missing
- When CONFIG_SHADOW_CALL_STACK=y, use a supervisor mode-only CSR bit
to determine whether the trap came from userspace or not, rather
than a userspace-writable register
- Reset the HSTATUS.HU bit during CPU initialization to avoid
unexpected behavior, as the RISC-V specification does not require
this bit to be hardware-reset
- Fix the T-Head GhostWrite probing code when
!CONFIG_ERRATA_THEAD_MAE
- Fix RV32 boots using 32-bit.config by constraining NR_CPUS
- Implement a workaround for SiFive MAL-9092, which requires fences
around hypervisor load/store instructions
- Fix the RISC-V patch_map() code to work properly for EXECMEM
addresses when !CONFIG_STRICT_MODULE_RWX
- Fix ptrace register set access reporting when CFI landing pad or
shadow stack support is enabled
- Avoid copying garbage into the target's vstate when
PTRACE_SETREGSET is called with a short iov_len
- Fix load_unaligned_zeropad() on RV32 kernels with
CONFIG_RISCV_EFFICIENT_UNALIGNED_ACCESS=y
- Fix build breakage for any userspace program that includes
uapi/asm/vendor/mips.h
- Fix a build warning for 32-bit allmodconfig builds related to
SiFive errata
- Fix misspecified inline assembly constraints in the vector context
save/restore code"
* tag 'riscv-for-linus-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
riscv: fix load_unaligned_zeropad() fixup for RV32
riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp
riscv: ptrace: Zero-initialize regset buffers before copyin
riscv: ptrace: reject CFI regset access when extensions are absent
riscv: fix NR_CPUS range leaking 64-bit default onto 32-bit builds
riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE
riscv: futex: untag the user pointer before the atomic access
riscv: lib: Fix ZBB strnlen wrap-around regression on huge counts
riscv: patch: fix handling of bpf-jit execmem addresses
RISC-V: Clear HSTATUS.HU on CPU initialization
RISC-V: errata: Add SiFive MAL-9092 workaround
riscv: vector: Fix output operands in context save
riscv: vector: Fix data pointer constraints in context save/restore
riscv: limit sifive errata to CONFIG_64BIT
riscv: hwprobe: use _BITULL() rather than BIT() in MIPS vendor uapi header
|
||
|
Linus Torvalds
|
b88c841d11 |
Input updates for v7.3-rc6
- A fix for the ati_remote2 sysfs attributes handling, resolving type confusion after conversion to dev_groups - Updates to the xpad joystick driver adding support for the Corsair Novablade Pro controller (wired and 2.4 GHz wireless) and a newer hardware revision of the 8BitDo Pro 2 Wired Controller for Xbox. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQST2eWILY88ieB2DOtAj56VGEWXnAUCasr21QAKCRBAj56VGEWX nBWuAQCBO6dsRJKdKICBgjj55mb8P9yOmtAXUDaSWnMONbcWJAEA3l0SJ8GnL0jh 4hLh6aCf4tTjIrB/cyKx47dSvj5YxQg= =3bCc -----END PGP SIGNATURE----- Merge tag 'input-for-v7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: - A fix for the ati_remote2 sysfs attributes handling, resolving type confusion after conversion to dev_groups - Updates to the xpad joystick driver adding support for the Corsair Novablade Pro controller (wired and 2.4 GHz wireless) and a newer hardware revision of the 8BitDo Pro 2 Wired Controller for Xbox. * tag 'input-for-v7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox Input: xpad - add support for Corsair Novablade Pro Input: ati_remote2 - fix type confusion in device attribute handlers |
||
Darrick J. Wong
|
7dfb218c82 |
xfs: fix exchange-range-to-eof file size exchange
Norbert Szetei posted a patch containing an incomplete description of a
bug in XFS_IOC_EXCHANGE_RANGE's TO_EOF flag. The bug tricks
exchange-range into modifying a file so that it has shared blocks
starting beyond EOF, which is never allowed because files never have
written data beyond EOF, and you can only share written data blocks.
This is key to all the incorrect behavior that follows.
Eventually I got from Norbert a description of what's going wrong:
> Fair. Here it is with physical block numbers, 4k blocks. peer is the file
> that gets rewritten and file1 is the one that ends up with the flag
> cleared.
>
> Start, nothing shared:
>
> peer size 4096 -> [100]
> file1 size 12288 -> [200] [201] [202]
> donor1 size 4096 -> [300]
> donor2 size 4096 -> [400]
>
> 1. FICLONERANGE peer's block into file1's middle slot:
>
> peer size 4096 -> [100]
> file1 size 12288 -> [200] [100] [202] reflink flag set
> ^^^^^ both files own block 100
>
> 2. XFS_IOC_EXCHANGE_RANGE file1 against donor1, file1_offset 0,
> file2_offset 8192, length 0, TO_EOF. One block is exchanged, and the sizes
> are exchanged with it:
>
> file1 size 4096 -> [200] [100] [300] reflink flag set
> ^^^^^^^^^^^ still owned, now past the size
> donor1 size 12288 -> [202]
>
> file1 says it is one block long while it still owns three. Nothing was
> unmapped. file2_offset is block 2, so this exchange cannot clear a flag.
>
> 3. XFS_IOC_EXCHANGE_RANGE file1 against donor2, both offsets 0, length 4096.
> By i_disk_size this is two one-block files exchanging everything, so
> xmi_can_exchange_reflink_flags() agrees and the flag is cleared:
>
> file1 size 4096 -> [400] [100] [300] reflink flag CLEARED
> donor2 size 4096 -> [200]
>
> Block 100 is still shared with peer.
>
> 4. pwrite(file1, 4096, 4096), which is file1's second slot, block 100.
> xfs_is_cow_inode(file1) is false, so no CoW:
>
> peer size 4096 -> [100] same block, new contents
>
> Block 100 is the only one that matters here. PoC below, it reads a file
> called peer in the current directory. The filesystem needs reflink and
> exchange-range, which mkfs.xfs 7.x turns on by default.
So yes, TO_EOF is screwing up the file size even if it's actually
exchanging the data block correctly. The following is the intended
behavior of XFS_EXCHANGE_RANGE_TO_EOF, as described by its manpage:
"Ignore the length parameter. All bytes in file1_fd from file1_offset
to EOF are moved to file2_fd, and file2's size is set to
(file2_offset+(file1_length-file1_offset)). Meanwhile, all bytes in
file2 from file2_offset to EOF are moved to file1 and file1's size is
set to (file1_offset+(file2_length-file2_offset))."
In other words, if we only exchange a portion of the file data, then we
should only exchange the portion of the file size that relates to the
exchanged data. Unfortunately, the code swaps the ondisk file size and
the incore file sizes, which is incorrect if the caller passes in a
nonzero offset.
Having confused the file sizes, the PoC uses a second exchange-range
call on what looks like a non-reflinked single-block file. Because the
file size is set incorrectly, exchange-range thinks it's exchanging the
full contents of two files and clears the reflink flag on the broken
file. That enables an extending write of the broken file to rewrite the
shared block that's just past EOF. This has become known colloquially
as refluxfs.
Once the file sizes are set correctly, the second exchange-range no
longer thinks that it's doing a full-contents swap, so it won't clear
the reflink flag on either of its file arguments.
Norbert followed up to an earlier version of this patch with a second
complaint about us not handling the i_disk_size state correctly:
> The offsets are bounded against the incore i_size but subtracted from
> the ondisk i_disk_size, so a file that has not been written back gives
> xmi_isize1 = 0 + (0 - 12288).
>
> For instance, you can do:
>
> $ xfs_io -f -c "pwrite -q 0 4096" -c fsync file1
> $ xfs_io -f -c "pwrite -q 0 12288" \
> -c "exchangerange -s 0 -d 12288 file1" dirty
> $ stat -c %s file1
> 0
> $ stat -c %i file1
> 131
> $ sudo xfs_io -r -c "bulkstat_single 131" . | grep bs_size
> bs_size = 18446744073709539328
That's wrong, and the new file size update logic depends on the ondisk
i_disk_size matching the incore i_size, so flush the pagecache as needed
to push it upwards.
Link: https://lore.kernel.org/linux-xfs/1E196589-DEBE-40AC-AFEA-D420DAAB067F@doyensec.com/
Reported-by: Norbert Szetei <norbert@doyensec.com>
Cc: stable@vger.kernel.org # v6.10
Fixes:
|
||
Norbert Szetei
|
d84d6c1a7f |
xfs: stop exchanging reflink flags when exchanging mappings
When an exchange covers both files from offset 0 to i_disk_size, xmi_can_exchange_reflink_flags() assumes every mapping moved and hands the reflink flag over to the other file. That assumption is wrong. A file can still own shared blocks past i_disk_size, e.g. after EXCHANGE_RANGE_TO_EOF sets a smaller size without unmapping anything. The flag is cleared anyway, and the next write to such a block happens in place instead of CoW, corrupting the other file that shares it. Commit |
||
|
Linus Torvalds
|
a5ebb76233 |
- amd64_edac: Shorten the ErrorInformation field read from the MCA_SYND MSR to
only two bits. It is perfectly fine to do so because no system ever supported more than 2 bits of information (the Chip Selects used were only 4 maximum) and newer hardware will use only 2 bits anyway -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmrKvjAACgkQEsHwGGHe VUrXohAAkfpqZl6l2SOOyrDNEAX8VqhhuIlp/wV+xpWtP32AZWDb3xyjrUB+Vzxs aR68mt57xzEWDQY0ciwIDWrxPSydDIWBIG6xeHAJc6PcT9BhP406MZ19mmJGRS85 Yl5yYlqm2Ucr8UGCe2vlS+4/CU2nbnRsXC7OeOMbVEKm73E/0Auq0Za8N+45SwcN 5QoPt1ffZBL6MJMceX73uztwwvXoh68/jnVd4LjjF8w7JUoXuOa1m/tDosL3zDNR 4Oy+i5YOfXNQ96L4OS4nwLBuUdwH4psWcWOwAD3WN+10OBWtMxUIV5cJgwcB+oHm SL0J5TECPJtWRmzNBraqPnOW8hwMFLrT1KOxOaq/nO7D1T2K+2Hf8Wo1/btoQWqz jisRSfNbaGeDuiXAoZKsWf6AkVBMHb3eXPsNRCywXh13+oZ5BfMtojXBYD9BHQsy U9DGLNuecccCvVbMvqci3wj+nYNgWt5ZRkqT9HeIcnFSRc6kC7O3c40qNAtwl1Qj NbGKkfelAQRaJFaT7l1tPj4NlsanqL/J3sF+wV5HZShhiWkUmaT9Pr6NXXKzq7I+ eUO7ccDb7RaAdGTvK1V6Gl3oPaHa+o23qFvBSqKA6GGClwZpO3G8qwVSEoZHGtS1 L0wEC1bzN3I+C9Uq/SKyCuaefouvBQJGMGr0XhwZ8RRTFfISjnA= =F1H/ -----END PGP SIGNATURE----- Merge tag 'edac_urgent_for_v7.3_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC fix from Borislav Petkov: - amd64_edac: Shorten the ErrorInformation field read from the MCA_SYND MSR to only two bits. It is perfectly fine to do so because no system ever supported more than 2 bits of information (the Chip Selects used were only 4 maximum) and newer hardware will use only 2 bits anyway * tag 'edac_urgent_for_v7.3_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/amd64: Mask UMC chip select to the four implemented selects |
||
|
Linus Torvalds
|
bb934c29fd |
drm fixes for 7.3-rc7
fb: - defer setup when fbdev_probe() fails, not just on -EAGAIN bridge: - Fix unlocked list_del in drm_bridge_add() - Fix unlocked list access in drm_bridge_attach() - th1520-dw-hdmi: Fix error check on dw_hdmi_probe() return value - th1520-dw-hdmi: Fix remove() callback aspeed: - Balance the display clock enable on teardown i915: - Fix a GT park race that could trigger spurious RPM wakelock warnings - Fix execbuffer relocation cleanup to avoid out-of-bounds free xe: - i2c removal - system Controller Maibox header handling - two bo pin/unpin accounting bugs - not emitting a w/a twice - xe_mmio_wait32() to honor delay/sleep maximums amdgpu: - Fix direct scanout alpha on some DRM_FORMATs - UserQ fixes - Fix tearing flips with PSR - GPU reset vblank fix - Debugfs register interface fix - Fix display mode patching - Expand Mac reserved memory workaround amdkfd: - SDMA doorbell fix - Fix dma-buf reference leak in error path imagination: - fix reference and vm_bo handling in remap() - size page table preallocation by device address gud: - don't keep a connector without a CRTC as connector_state panthor: - validate userspace queue count against initialized firmware slot count nouveau: - fix null ptr regression - skip turing CE workaround for non-GR vmwgfx: - validate pitch value - add blend mode property vc4: - drain hangcheck timer on unbind - free BO cache on teardown - use kvmalloc_objs for bo cache size list - disable V3D interrupt across runtime suspend - fix binner slot allocation - fix fw refcount leak -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmrKj3sACgkQDHTzWXnE hr6e+A/+I1d+UvVkSnIsMv7NGLGiNvDClWvTnypF0ys2poiUGZ88UPzGuE7r8zfc BK9zZnQ/+LSYu/NLhmLnxDxYmx+Y2rKMjQEq22RsjUAzrPhn0/UsoWTt5jRMfim+ If9gW5p51rX4TBH90fgiTiwvAHxfSSzPjIlQIcjSAQKFxOIZ6mQtyKU4453H//XQ AO1fIDOvcUnZXyQCveoLtaU9ICKv5HNTwF4UBAnRfOmrJr/1ny2H51/tsFkh4Dwy h/OMyJDMNSfa/w9JZOGC/+fEipEQZ15Hk3QUy8i+UUEtD/JKFeG2nlNPuKqjjhrA slQa8E9M7anw+akPjJ0vWrOrqMXcxXE9huRWUUvv9MXkXpFjYmUeBTw1Q9Oc2No4 kdqmS9Skl6R/VJjeWeV2m/iNftL0k3CUWr2paCb9nGUOoaxdoMC72JVl7MprrSOT KG46ggDMfqhIygfkT+PBighZkMCJs/Fkw/UCM9Dldc3M3ds1VmQnH9I+1W+LUqjN OHT5FJfiabejImgnrPtPDtGJtZQub7K9ZUJc13GqxjCK3IXp1oqit8wVZS1qqmw7 3dpc+mWB0Re9CnlaOVb/WTzbip3WGlX8mdHrm+gKYHhigR5EjwiZSal7jP+fKYqK riXBBTU4CE44Y92lutvtJ4NjSqiShK/pzAkzPVVL8bCYoQAL4fk= =TKVJ -----END PGP SIGNATURE----- Merge tag 'drm-fixes-2026-10-11' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Ailie: "Live from Dublin Airport, it's Saturday Night drm fixes. This week has the missing misc fixes from last week which I tracked down and seemed to be a race/bug in my lei setup somehow, once I asked lei to ignore it's cache I got the missing email. But there are more misc fixes this week and amd and intel ones. The main ones in this are amdgpu and xe, with vc4, vmwgfx, nouveau and imagination in the middle, with a bunch of small single fixes. Bit busier than I'd like, but the missing misc might explain it, anyways time for me to fly home. fb: - defer setup when fbdev_probe() fails, not just on -EAGAIN bridge: - Fix unlocked list_del in drm_bridge_add() - Fix unlocked list access in drm_bridge_attach() - th1520-dw-hdmi: - Fix error check on dw_hdmi_probe() return value - Fix remove() callback aspeed: - Balance the display clock enable on teardown i915: - Fix a GT park race that could trigger spurious RPM wakelock warnings - Fix execbuffer relocation cleanup to avoid out-of-bounds free xe: - i2c removal - system Controller Maibox header handling - two bo pin/unpin accounting bugs - not emitting a w/a twice - xe_mmio_wait32() to honor delay/sleep maximums amdgpu: - Fix direct scanout alpha on some DRM_FORMATs - UserQ fixes - Fix tearing flips with PSR - GPU reset vblank fix - Debugfs register interface fix - Fix display mode patching - Expand Mac reserved memory workaround amdkfd: - SDMA doorbell fix - Fix dma-buf reference leak in error path imagination: - fix reference and vm_bo handling in remap() - size page table preallocation by device address gud: - don't keep a connector without a CRTC as connector_state panthor: - validate userspace queue count against initialized firmware slot count nouveau: - fix null ptr regression - skip turing CE workaround for non-GR vmwgfx: - validate pitch value - add blend mode property vc4: - drain hangcheck timer on unbind - free BO cache on teardown - use kvmalloc_objs for bo cache size list - disable V3D interrupt across runtime suspend - fix binner slot allocation - fix fw refcount leak" * tag 'drm-fixes-2026-10-11' of https://gitlab.freedesktop.org/drm/kernel: (39 commits) drm/nouveau: Skip the Turing CE workaround object for non-GR channels drm/vc4: Fix binner slot allocation failing on an idle GPU drm/vc4: Disable the V3D interrupt across runtime suspend drm/imagination: Size page table preallocation by device address drm/imagination: Fix reference and vm_bo handling in remap() drm/amdgpu: make Mac FB workaround generic drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info drm/amd/display: Don't replace a sink mode that shares the native totals drm/amdkfd: align SDMA doorbell base for shader doorbell writes drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks drm/amdgpu: serialize vblank counter reads against GPU reset drm/amd/display: disable self-refresh on tearing flips drm/amdgpu/userq: return the memdup_user() error for the user MQD drm/amdgpu/userq: only accept doorbell BOs as queue doorbell drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs drm/xe/i2c: cancel the client work on remove drm/xe/sysctrl: Fix mailbox header handling drm/i915/gt: Unmask interrupts only when ACTIVE is true drm/i915/gem: Prevent overstepping exec array boundary drm/gud: don't keep a connector without a CRTC as connector_state ... |
||
|
Linus Torvalds
|
b62f58bd71 |
i2c-fixes for v7.3-rc7
qcom-geni: fix runtime PM reference leak on xfer -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQScDfrjQa34uOld1VLaeAVmJtMtbgUCasoNSwAKCRDaeAVmJtMt bvJNAQDmm2Rj8dyCOMlm6pNRJv8Wh6CpydUbmTbko/GRMsBWiAEAsPiRtXC07Z+w GrOIQdIVrKCPiShnW0ajDufnMZjDpg4= =i2NX -----END PGP SIGNATURE----- Merge tag 'i2c-fixes-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux Pull i2c fix from Andi Shyti: "Just one qcom-geni fix for a runtime PM reference leak during transfer setup" * tag 'i2c-fixes-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux: i2c: qcom-geni: release runtime PM reference when set_rate fails |
||
Dave Airlie
|
c61e23ed14 |
A pointer assignment fix for gud, a reference fix and a preallocation
size fix for imagination, a suspend fix and an allocation fix when idle for vc4, and a hardware variant fix for nouveau. -----BEGIN PGP SIGNATURE----- iJUEABMJAB0WIQTkHFbLp4ejekA/qfgnX84Zoj2+dgUCasjkYwAKCRAnX84Zoj2+ dpu/AX0QwkYdn5r75S9Nsud12AGxs68MQYdf9O/JnsJYO5+Y5L078rTScygmDnvT civ/Y3ABgIhqXI1I/vXtyC7T+REXa47Gpll+ZVtw2FLj7c9czWjgr2iHIqXpn8pK 3A7y86s0kA== =YUdz -----END PGP SIGNATURE----- Merge tag 'drm-misc-fixes-2026-10-09' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes A pointer assignment fix for gud, a reference fix and a preallocation size fix for imagination, a suspend fix and an allocation fix when idle for vc4, and a hardware variant fix for nouveau. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maxime Ripard <self@mripard.dev> Link: https://patch.msgid.link/asjkbknTHg2t8JGy@houat |
||
|
Dave Airlie
|
492c4ded0f |
amd-drm-fixes-7.3-2026-10-08:
amdgpu: - Fix direct scanout alpha on some DRM_FORMATs - UserQ fixes - Fix tearing flips with PSR - GPU reset vblank fix - Debugfs register interface fix - Fix display mode patching - Expand Mac reserved memory workaround amdkfd: - SDMA doorbell fix - Fix dma-buf reference leak in error path -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQQgO5Idg2tXNTSZAr293/aFa7yZ2AUCasfVFQAKCRC93/aFa7yZ 2Nf6AP0T/qzbqO519Aih3Zr1Y8rETWjQ38fCoDbojom9/tzAoQD9HgNQkNvkO+fK R4uCeUzG91tnJK2Yuzv+WzWIbLQrdAA= =Ptpq -----END PGP SIGNATURE----- Merge tag 'amd-drm-fixes-7.3-2026-10-08' of https://gitlab.freedesktop.org/drm/amdgpu/kernel into drm-fixes amd-drm-fixes-7.3-2026-10-08: amdgpu: - Fix direct scanout alpha on some DRM_FORMATs - UserQ fixes - Fix tearing flips with PSR - GPU reset vblank fix - Debugfs register interface fix - Fix display mode patching - Expand Mac reserved memory workaround amdkfd: - SDMA doorbell fix - Fix dma-buf reference leak in error path Signed-off-by: Dave Airlie <airlied@redhat.com> From: Alex Deucher <alexander.deucher@amd.com> Link: https://patch.msgid.link/20261008174658.2506431-1-alexander.deucher@amd.com |
||
|
Dave Airlie
|
a8013cbe8d |
Fixes on:
- i2c removal (Fan) - system Controller Maibox header handling (Mallesh) - two bo pin/unpin accounting bugs (Thomas) - not emitting a w/a twice (Tvrtko) - xe_mmio_wait32() to honor delay/sleep maximums (Al\ an) -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEEbSBwaO7dZQkcLOKj+mJfZA7rE8oFAmrHxFUACgkQ+mJfZA7r E8py7Qf+ODo88JXxsL6C62wpd4nNbYxxBxLGW0TLrmtveBm/2uLvQQInOJpkE/Ni awXUrW92CbJWN1cAxvrvrGQBO1NedkypCMxHgmfsiUmSmEpT34/KXLExn8A5Kddo m+VzMxHWavk0k4ELsullJlFSZbnTC3hwOZlK7tJ0HaKatEpH8uM8EQk3qZqGEnOM OjuQDLLyEF3MwwvSv+Y81oZLfeNHaJ6esjmSX4mccd3sxjmRa0dFPAjRaRzLa+2P A+cw3ep+cRBZSutNBhElWPJZTrRzgNBKkBnB05+FeIctcRNbhvUf23IiWlf2kWvg G4DkiE/m/G/RKO+/t0DNsiDcnIloGA== =610A -----END PGP SIGNATURE----- Merge tag 'drm-xe-fixes-2026-10-08' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Fixes on: - i2c removal (Fan) - system Controller Maibox header handling (Mallesh) - two bo pin/unpin accounting bugs (Thomas) - not emitting a w/a twice (Tvrtko) - xe_mmio_wait32() to honor delay/sleep maximums (Alan) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patch.msgid.link/asfEfgbIjs0GJ-RF@intel.com |
||
|
Tejun Heo
|
069403dff3 |
sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue
A deferred reenqueue can read a freed user DSQ. The request stays on its
CPU's deferred list until run_deferred() takes it, and the RCU callback that
frees the DSQ assumes that the grace period has flushed it, so exit_dsq()
checks the per-CPU node without the deferred list lock. A grace period waits
for readers in flight, not for a pending run_deferred(). A run_deferred()
which starts after the grace period began can detach the request right
before the callback looks and then read the freed DSQ's id.
Cancel the pending requests before the grace period instead. The irq work
that frees the DSQ unlinks every CPU's request under the per-CPU deferred
list lock, and schedule_dsq_reenq() ignores a new request under the same
lock once the id is invalid. Only a run_deferred() that started before the
grace period can hold a request, and it runs with IRQs disabled, so the
grace period waits for it and nothing touches the DSQ after the callback.
Fixes:
|
||
|
Tejun Heo
|
7a9df76679 |
sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQ
With SCX_OPS_ENQ_LAST, the last runnable task on a CPU is passed to
ops.enqueue() instead of being kept running. Exiting tasks without
SCX_OPS_ENQ_EXITING, migration disabled tasks without
SCX_OPS_ENQ_MIGRATION_DISABLED and tasks on an offline rq skip ops.enqueue()
and go straight to the local DSQ. This happens in put_prev_task_scx() after
the pick has settled on idle, so nothing reschedules the CPU, which idles
with the task queued until an unrelated wakeup lands on it or the watchdog
fires.
scx_mitosis, which sets SCX_OPS_ENQ_LAST without SCX_OPS_ENQ_EXITING, hit
this during mass cgroup teardown: exiting tasks stuck in exit_mmap() for
over 40 seconds.
A task put on the local DSQ runs, as anywhere else. If the SCX_ENQ_LAST
enqueue left the task on this CPU's local DSQ, set need_resched on the task
being switched in, as proxy_resched_idle() does. resched_curr() would flag
the task being put instead, and __schedule() clears that right after the
pick.
Fixes:
|
||
|
Linus Torvalds
|
3857c2fe54 |
pci-v7.3-fixes-4
-----BEGIN PGP SIGNATURE-----
iQJIBAABCgAyFiEEgMe7l+5h9hnxdsnuWYigwDrT+vwFAmrJDcMUHGJoZWxnYWFz
QGdvb2dsZS5jb20ACgkQWYigwDrT+vy3yg/+N0HQJ+3TmmVgLHpZryZnicIvr4Rk
aak7isoP1g2fCHXmNaHptm5bOWyGOJ3sPl8t6Z2JtNNqEO/Fz4bF2KNQkTtCnvRP
dB/j9deI2omhpIWpmOAaL6Z5nN3rbKz8OFxyQGQpkG83qS7M0jF0rpSLLhi6wyp+
EBDMkw03OK6iubvwaECJdwmdk1mkhjHnv04ONLZfq8DNJm7jFQYAui2nQ2Fw8lti
BZb8yY+CGW/PUpGgSmJOa2UERxNBKH78sSK218nsQ5M7oXU4rLzgjmKnyfIz1F6X
1Xqs2R7UzO1kosHpjqR9wSBIay5331g9fdSVYSiMcVXGbroxZZ9yzvgBTQABeaT8
jLo6l6Z/j8CQ5B9oq4nk8lAeZj661IMIQKyJcssbIvwv4Nq+5JHECr1n8loo9sTG
85r4n6nSSBXxQlg4EY+SVXTO5Rpf0QYz6CI0eIYeUU2oxlAhctJ+B2khBmSTgSzY
lw1XiQDOMgD1WDH/GN0pr/alvi90RMhj1s6dnVlYEiCF9FyAXR1zb8EpFZ0SsBm5
I28N/+QmlUw1hrdeRiYn1c+5asvCCqAx2OR3xlllU55CS7rsjXdOVnPUFe6xtH93
0Yi3KmH0uVl6X+WgWjGnLCWYIBR3DAE9lF8LzNlKMVSP+V6TfPvrnfNahuZvdK7H
NbraXi5qBPycGyw=
=fagl
-----END PGP SIGNATURE-----
Merge tag 'pci-v7.3-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci
Pull PCI fix from Bjorn Helgaas:
"This fixes some GPU initialization regressions caused by
|
||
|
Linus Torvalds
|
b71ccf604f |
MMC host:
- cavium-octeon|thunderx: Destroy slot platform devices on remove
- mtk-sd: Cancel request timeout work on remove
- sdhci-sprd: Disable runtime PM on remove
MEMSTICK:
- Wait for request completion before freeing card
- rtsx_usb_ms: Complete requests after eject instead of dropping them
-----BEGIN PGP SIGNATURE-----
iQJEBAABCgAuFiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmrI78UQHHVsZmhAa2Vy
bmVsLm9yZwAKCRD+JoQlc1iMKcd6D/4sm/MrbdE0d8Q9ceIV9BAfiQfETj4mo53Q
3uH07n9PSaxVIJotLvvjni5TmAiISqXm+ZyNb0VMn8Xz4piVOhaOY4vKaiiLM71B
bMaim5lLd/oc5IopvzaYgEz7hOV6NSbqMjlC31fBQhkEtD9f182/A0324LFAuE0T
H+VtnhxbExzCXbeeSCWQhERaWTG93csh9gTSS8W9kZzcTngEVly+vpZELTeJwhZl
sVfzFTIf7Jv3omeDfMfwWUgfYRHlBVvgjI0ZtgZbZzhWyLj8SOQXvqH/PKmn+mxx
UdrmJsrTCI0MmbJRnmOkxgD5t9KGmVPD8oS36BUGZ/6qYRs+bzCRqAN3n+kXHmV4
cYF6/YOUNVBIkJ9qPZZapySYI3YBlu9GgD+dMriAAc+Jt2jBlbNBqdzQScouCSx3
kjx50GiPC7HSwtf77Up3inJuVig7Qwut2BnEznhYgtv1AatNqZAzMLzx+ZB8M/Dw
kOQDkQNGeg+Lpmd2oqjtnHezdiR5b+H2Zc5U+I8lSMRZPmHn1yhE5KKAxkLdcTaJ
SUQN1Nn2cFiyef55apb03K2JHQS+Wh7xzDvbR4/rZ4VursJgNuRE9G0YmU+jJlrg
IlsGKFXRvTuub0E+MvQ57xLxo4CjG40J9wgPgygTldLb1aU2OJKUX/JzwBTMDTD1
AcrnwZub/g==
=42Y1
-----END PGP SIGNATURE-----
Merge tag 'mmc-v7.3-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc
Pull MMC/MEMSTICK fixes from Ulf Hansson:
"MMC host:
- cavium-octeon|thunderx: Destroy slot platform devices on remove
- mtk-sd: Cancel request timeout work on remove
- sdhci-sprd: Disable runtime PM on remove
MEMSTICK:
- Wait for request completion before freeing card
- rtsx_usb_ms: Complete requests after eject instead of dropping
them"
* tag 'mmc-v7.3-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
memstick: rtsx_usb_ms: complete requests after eject instead of dropping them
memstick: core: wait for request completion before freeing card
mmc: cavium-thunderx: destroy slot platform devices on remove
mmc: cavium-octeon: destroy slot platform devices on remove
mmc: sdhci-sprd: disable runtime PM on remove
mmc: mtk-sd: Cancel request timeout work on remove
|
||
|
Linus Torvalds
|
f7bec60381 |
[GIT PULL for v7.3-rc7] media fixes
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE+QmuaPwR3wnBdVwACF8+vY7k4RUFAmrJCqQACgkQCF8+vY7k 4RWu/w/+LBwsMO9VA1C16lAKROP5HwuSdumeNnsjNinZX4Tonmz7Y5L+Ru+9Jzcz WDpbNtJTNhMa2f+i1YhCPVxNp22mwuGaqNUm8xfipt9fuvwShPaTTzoNsEh7l3iT TwMt2G5Np0G1u0fiDaBESR30sKw6YfYR8nxhM3lP4FfK4M3GhkuDnaAtwzCHa1Dm 1M1J76kS6eUGT+BOJMy6qARhAD00zQgjk9HZDV56FmCsz2XdDh1hnOC11IvbRV+K spdU3TffnoU4FMWQQnqJHxJR/Btq72O0CmiHVPopHQFM9DA6eEBd0eUcXTieIjbb aFp04/z0EWlYuwEGPKvnAdmwiJfRgoMLgGTnyViZMV0KtGbXVHmEr4KhUjRNMvVl Vjz/9ehYEweiKwQhUuV+upaQeWyQzI9VNbkAr9KSXX81piyFAkzur4dXljf8qR/x KQUIyhyshcvgQ0upoVFZ2q23hq1s7hKGOmFKT6DZhXs0OySkYRbj/iFzQ4YyhBpJ qTMmFF+Edlg0CtVhST3QxZcYv7b97RG2pue+R2jX71xB25yq2MbebMmjKB8Vp5id AhsvlRY0Dyp1sPqPtfukERSoCgJ6UHKI6D7DqpqzUcIeLgVyBEAjri4jUCZxhvXn 9fzYX56K1IuEFUl64LrPAhejo0iQTsdKx/gBprQulzwsDp4QrX8= =M/y8 -----END PGP SIGNATURE----- Merge tag 'media/v7.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fix from Mauro Carvalho Chehab: "A fix for em28xx unregister code affecting devices with FM radio support" * tag 'media/v7.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: em28xx: use video_unregister_device for radio_dev |
||
|
Linus Torvalds
|
5f6ee187fa |
sound fixes for 7.3-rc7
A dozen of small fixes. All device-specific quirks or fixes, and nothing exciting is expected. - USB-audio and HD-audio quirks - HD-audio TAS2781 codec fix - ctxfi driver memory leak fix - ASoC AMD quirks - ASoC cs35l56 and adau1372 codec fixes -----BEGIN PGP SIGNATURE----- iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmrI71gOHHRpd2FpQHN1 c2UuZGUACgkQLtJE4w1nLE/doA//VzIL0NcwVlEduCcwTcfWRwGjn7QPPA0isbjy Z+2SDryLxx+JgnCf6tI86CcBjP7o4hWHX9pHXb3smy7862aoWAUt5r5LR2MCZNa0 Q6wGiqDcL3jhNdy5gE5KUzShtD3DWAXo4Pqv/urHyOBHjcGqa6HNAurja7tmFne6 5DkozkvxyP/CIUsOHltO+YRPzmI7OIrLGjC5lbuyhNHIzCOEyUHgKaVFzyr6Fwcz ansQpgOQxc+0VN/FEVI0rXqxG483pSP+M0Ao8Y+aWpSTG534dgw2oGC10M2G59uW p4MyHkkhMcy41ARMLWWlYmzCEbsleiBBUUqIhKIwOAWJRHksRHwRtmHmTpcJbAHZ E7HkRGw6WOyxo9KKeD0fdyxBIF5VIvqrumjreWu2dX9XNJDzrfJZMtkzB+rStqmQ KR7uctZvGgfFKOJ76ENYmeEaEVNFREGK531aGRgiqCvOEJ/naY3PT/V3f6BIDjp+ OmG1YFqkI2vbC+Vw49+ydiAbvLz/ulhsFRvlNGzZl829Gpn/cwnw1sBRW+2QoCzX 4a6ICUZ76NlsneiqI3yHCm87VyDPmY8Mn3V8UAbEapt6G5xirDjDClV3qHAn928A fRZ5YB4poD/ek143mp306ljnxx14nQZiFDowLAIbi5ZCIjv6cXMMw79wOe4yzOax 0xYNFXo= =at5l -----END PGP SIGNATURE----- Merge tag 'sound-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A dozen of small fixes. All device-specific quirks or fixes, and nothing exciting is expected. - USB-audio and HD-audio quirks - HD-audio TAS2781 codec fix - ctxfi driver memory leak fix - ASoC AMD quirks - ASoC cs35l56 and adau1372 codec fixes" * tag 'sound-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ASoC: amd: acp: Add more ACP7.0 match entries for Cirrus Logic parts ASoC: amd: acp: Add DMI override for ASUS EXPERTBOOK AM7406CKA ASoC: sdw_utils: Switch CS35L56/57/62/63 to use OT25 DAI ASoC: cs35l56: Add DAI for SDCA OT25 stream ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes ASoC: adau1372: allow sleepy powerdown GPIOs ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P) ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg3xxx (103c:8bfd) ALSA: hda/tas2781: Accept V1 calibration data without CRC ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers ALSA: hda/realtek: Add quirk for ASRock NUC BOX-358H ALSA: usb-audio: Add native DSD support for Cambridge Audio streamers |
||
|
Linus Torvalds
|
9a06d4b7c5 |
pmdomain providers:
- imx: Serialize power on/off across sibling domains for imx8m-blk-ctrl - rockchip: Fix a couple of errors during probe -----BEGIN PGP SIGNATURE----- iQJEBAABCgAuFiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmrI1PoQHHVsZmhAa2Vy bmVsLm9yZwAKCRD+JoQlc1iMKU1tEACaVeu6L1ug6LeHc+MFu14aaaB3QXOxhNPA Ls3csZknwHf1cGVnhR+ZsQ3ScBT5wC5mJtSZr0eiqCMALBZXy6J8ZNzAK97qgFdE m94lc1Kkr/7miuv1pJe8hNh3kyOzLZqG/jMDLdmMjdfKSf/8oICQ2d9+ZLLhqBMT IKgSNQQGj7d5AwDYpFRocgadrByC+ampCCi7z8xEgU3H9QANQhQPjOTyPDJ1CFV+ 7QFXGjfP2OuHKoYgUy2eAWK2gloImUVcalPjBT7OxG3ApSOZdiNNPFL0jzk0xg79 XA94iQ9vgWSVdUDaezLey1xXBRvn3XSXkHmh6Fr1feUhfseFWXYsiiNiKxfUDXjb FCQzjJT3ARn1vKu8q4359Y3nX1IG0ZYfdSCKFkcxmL8I2klB+hEkZp9jTZzwzcfT 8KlDiCN0a48Ag4EwZcc+A3DLCk3/GIlnnKeFnqty+kaJsPMyuGtANowItV9Cwfgu dM/AEe1tdDNAks+K2Y5c9wfgh2pKiHnzd2v7FS2kqvV/kKfFHoU8l8NqKUVSjpx+ hiGpCUGERDfDxgsT+HINuSjSG44i/KG7D16z6UtlKtDnOcUHPtZC9Jcvz7jm5Nup fbzrkQ55ZU/E5TxLnf0fCkghh5WnjH8UmCDlGEwlH4LQo1ho8ay0HLT/ur5dtLDM UoOGg5uPNA== =Q0z1 -----END PGP SIGNATURE----- Merge tag 'pmdomain-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain provider fixes from Ulf Hansson: - imx: Serialize power on/off across sibling domains for imx8m-blk-ctrl - rockchip: Fix a couple of errors during probe * tag 'pmdomain-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: pmdomain: rockchip: don't ignore clock lookup errors on attach pmdomain: rockchip: fix clock leak on domain probe failure pmdomain: rockchip: propagate subdomain add errors pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains |
||
|
Linus Torvalds
|
c8d4256f10 |
dma-mapping fixes for Linux 7.3
Two more fixes for the corner cases in the DMA-mapping SWIOTLB code (Peng Fan and Marek Szyprowski). -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQSrngzkoBtlA8uaaJ+Jp1EFxbsSRAUCasjDHAAKCRCJp1EFxbsS RDWxAPoC3zN3Xr76mPqfCYJWLBYu5Onrf250WwuZgVd4wO8MAAEA42uamlDYtLFa iopG6/88zhUzQ2aVg2rcbmc+307UlAA= =XP5b -----END PGP SIGNATURE----- Merge tag 'dma-mapping-7.3-2026-10-09' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux Pull dma-mapping fixes from Marek Szyprowski: "Two more fixes for the corner cases in the DMA-mapping SWIOTLB code (Peng Fan and Marek Szyprowski)" * tag 'dma-mapping-7.3-2026-10-09' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: swiotlb: fix default_swiotlb_limit() for non-growable default pool iommu/dma: skip swiotlb bounce for DMA_ATTR_MMIO in iommu_dma_map_phys |
||
|
Linus Torvalds
|
fc1c25014f |
fsverity fix for v7.3-rc7
Fix a regression from commit |
||
|
Linus Torvalds
|
f99005fbed |
vfs-7.3-rc7.fixes
Please consider pulling these changes from the signed vfs-7.3-rc7.fixes tag.
Thanks!
Christian
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCasilxwAKCRCRxhvAZXjc
ooQTAQD6awSrQcUIG0ca5hbowpn7sLi8kWGnmzf2yydKSyp3bwEAnpSQEw3BXUKH
0O7JEyZFL0VcMTTceSPKkKCqGg5nugI=
=Wc48
-----END PGP SIGNATURE-----
Merge tag 'vfs-7.3-rc7.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull vfs fixes from Christian Brauner:
"This contains fixes for the current development cycle.
All of them came out of a review of the mount code that started with a
bug report. The review modeled the corner cases of mount propagation,
unmounting and mount reference counting and turned up a lot of bugs.
Most of them years old. Most fixes come with a selftest.
- Rework connected mounts.
A mount that is unmounted together with its parent can stay
attached to the parent to keep its mountpoint covered. That happens
when the mountpoint is removed with rmdir(), unlink() or rename(),
when a detached tree is dissolved, and for locked mounts in any
umount that isn't synchronous, including the teardown of their
mount namespace. The parent then owns the child and drops it on its
own final mntput(). So any reference from the child's superblock
back to one of its ancestors becomes a cycle that is never freed.
A loop device backed by an image on a tmpfs and mounted on that
same tmpfs is enough. Remove the directory the tmpfs is mounted on
from the host, let the container's mount namespace exit, and the
loop device, the tmpfs and the filesystem on the loop device are
leaked for good. The same works with autofs, zram, ecryptfs,
binfmt_misc, fuse passthrough, zloop, a mass storage gadget and md,
and the selftests have reproducers for them. This has been possible
since v4.1. It is also why "put_mnt_ns(): leave mounts connected"
was reverted in -rc5. Keeping every mount of a dying mount
namespace connected made these cycles trivial to create.
Every unmounted mount is now detached from its parent. Where the
mountpoint has to stay covered the mount leaves a cover on the
parent instead, allocated together with the mount. A lookup on the
unmounted parent that hits a cover finds an empty immutable
directory or file on the private nullfs instance. Nothing leads
from a cover to another mount, so no unmounted mount owns another
one and no cycle can form.
This is visible to userspace. A formerly connected mount can no
longer be reached through its unmounted parent and ".." inside it
leads nowhere, as for every other lazily unmounted mount.
With that the private nullfs instance becomes reachable from
userspace, so it now refuses mounts on top, is mounted read-only,
and refuses fsnotify marks and file locks. Its inodes are shared by
every holder and a watch or a lock would otherwise reach across
users. may_decode_fh() now also decides its subtree check under a
single mount_lock hold, as a racing umount could otherwise let it
decode into what a locked child covered.
- umount:
* Don't silently unmount busy mounts.
Since v4.13 propagate_umount() takes down propagated copies of
the victim with children as long as each child is an overmount or
another copy of the victim, but propagate_mount_busy() only ever
checked copies without children or with just an overmount. A
container that moved a tree beneath its copy of a host mount lost
that tree from under its open file descriptor to a plain umount()
on the host. propagate_mount_busy() now applies the same rules,
walking each chain of copies once.
* Don't let a migrating task hide its reference from umount().
mnt_get_count() sums the per-cpu counters under mount_lock but
the mntget() and mntput() fast paths don't take it. A task that
takes a reference on a cpu the sum has already passed and drops
it after migrating to one the sum hasn't reached yet hides the
reference it held to begin with, and umount() succeeds with the
file still open. Gets and puts now live in separate per-cpu
counters and all puts are summed before all gets with a full
barrier in between, the way srcu_readers_active_idx_check() does
it. mntget() is unchanged and mntput() gains an smp_wmb().
* Check each submount for references right before unmounting it.
shrink_submounts() and mark_mounts_for_expiry() checked all their
victims up front. Unmounting the first could move a busy
overmount to where the next victim's propagated copy is looked up
and it was then unmounted without a check.
* Never expire a locked mount.
A shrinkable mount moved beneath a locked mount with
MOVE_MOUNT_BENEATH takes over the lock, and umount() of an
unlocked ancestor expired it and revealed what it covered. That
umount() now fails with EBUSY as it does for any other locked
child. A lazy umount still takes the whole tree.
- Overmounts and locked mounts:
* Unhash a dentry before detaching the mounts on it.
unlink(), rmdir() and rename() detach the mounts on the victim
but only d_delete() it once its inode is unlocked, a window that
includes an expedited RCU grace period. In between, a lookup from
a mount namespace in which the dentry is a mountpoint found it
hashed, positive and uncovered. Drop the dentry first, as
d_invalidate() already does.
* Don't reveal overmounted entries in refwalk.
A refwalk that had grabbed the dentry before the unlink never
rechecked it the way rcuwalk does with d_seq and mount_lock.
Without any artificial widening three walkers read the covered
file 27 times in a minute. step_into() now fails an unhashed
dentry marked DCACHE_CANT_MOUNT with -ESTALE and the walk is
retried.
* Keep covered mounts covered in OPEN_TREE_NAMESPACE.
Creating such a mount namespace only takes a user namespace and
the copy followed bind mount rules: no children without
AT_RECURSIVE and no unbindable mounts with it. An unprivileged
user could see what mounts covered in the source, such as the
parts of /proc and /sys that container runtimes mask. If the
caller doesn't own the source mount namespace a non-recursive
copy of a mount with something mounted below the requested
directory is now refused and a recursive copy includes unbindable
mounts, the way unshare() copies.
* Keep the lock on a mount that a propagated copy is moved beneath.
MNT_LOCKED moved to any mount that ended up beneath a locked
mount, propagated copies included. A host mount and umount on a
directory covered by a locked mount in a less privileged mount
namespace left that cover unlocked for the namespace's owner to
remove. Only mounts the caller places beneath take over the lock
now.
* Handle mount locking for automounts correctly. Which copies to
lock was decided by the mount namespace of the task that
triggered the automount. A task in a user namespace that
triggered one on a host mount through a file descriptor got the
host's own automount locked while its own copy stayed unlocked
and could have nosuid, nodev and noexec cleared. Use the owner of
the mount namespace the mount lands in.
- Use-after-free and crashes:
* Refuse an automount below a mount that is in no namespace.
The private clones overlayfs uses for its layers have the
MNT_NS_INTERNAL error pointer as their namespace, which
finish_automount() let through and count_mounts() dereferenced. A
fanotify filesystem mark on an overlayfs lower layer hands out
file descriptors on such a clone. With debugfs as the lower layer
opening "tracing" oopses with namespace_sem held for writing and
every mount operation on the system blocks from then on.
* Reset the old parent's ->overmount in mnt_change_mountpoint().
When propagate_umount() moved an overmount off a mount that a
file descriptor kept alive, MOVE_MOUNT_BENEATH through that
descriptor later followed the stale pointer into the freed
overmount.
* statmount() with STATMOUNT_BY_FD and pivot_root() read the parent
of a mount that may be unmounted and only held by a file
descriptor, while the parent's final mntput() can free it.
statmount() now reads it under mount_lock and pivot_root() first
checks that both mounts are in the caller's mount namespace.
* Queue a mount only once for mount notifications. A mount
reparented by one umount_tree() and taken down by the next under
the same namespace_sem hold, as in shrink_submounts(), was queued
twice. That cut the mounts queued in between out of notify_list
while it still pointed at them, and once they were freed every
later mount operation walked freed memory.
* Don't let a pseudo dentry become the root of a mount. A bind
mount of a bpf token file did that with a DCACHE_NORCU dentry,
which is freed without an RCU grace period while lockless path
walks may still look at it. Refuse to clone such a mount.
* Don't inherit MNT_UMOUNT in clone_mnt(). A bind mount of a lazily
unmounted nsfs or pidfs mount through its file descriptor started
out flagged as unmounted. Among other things __detach_mounts()
then dropped the namespace's reference on it, the mount outlived
its namespace and mount_setattr() through the descriptor read the
freed namespace. A recursive bind mount of such a mount also
copied the unmounted stack still attached to it. That now fails
with EINVAL, copying the mount itself still works.
* Remove the fsnotify marks of a mount namespace in free_mnt_ns()
instead of the RCU callback that frees the namespace, where
taking the group mutexes meant sleeping in softirq context.
- Propagation and copies:
* Keep a copied mount unbindable. Since v6.17 clone_mnt() didn't
copy the unbindable flag, so every mount namespace created with
CLONE_NEWNS had bindable copies of all unbindable mounts. This
had been fixed once before.
* Refuse MOVE_MOUNT_SET_GROUP on an unbindable mount. It made the
mount an unbindable slave, a state nothing else can produce, or
silently dropped the unbindable flag. CRIU applies MS_UNBINDABLE
after restoring sharing and isn't affected.
* Check a recursive bind mount for mount namespace loops.
Recursively bind mounting a tree from another mount namespace
could put a mount of a namespace's file inside that same
namespace, which then pins itself and all its mounts. Repeating
it leaks without limit, the reproducer took Shmem from 380 kB to
65916 kB. The copy is now checked with check_for_nsfs_mounts()
before it is grafted, as move_mount() does.
* Look at the topmost mount for a mount namespace file.
attach_recursive_mnt() never looked at the topmost mount of the
source's chain of overmounts. If that was the chain's only mount
namespace file an existing mount at a propagated destination got
buried below the root of the nsfs file where no path walk reaches
it.
* Don't put a mountpoint on a dentry that's being removed.
attach_recursive_mnt() makes a mountpoint of the source's root
without its inode lock, so a racing rmdir() of that directory
could leave a mount on it that nothing ever detaches.
d_set_mounted() now checks cant_mount() as well.
- nullfs:
* Take no inode lock for readdir of an immutable directory.
The root of every empty mount namespace is the same nullfs
directory and iterate_dir() held its i_rwsem across
->iterate_shared(). A reader whose buffer faults on a FUSE mount
of its own holds it for as long as its server wants, and with an
exclusive locker queued behind it every lookup that misses the
dcache, every create and every mount in that directory waits. One
user of an empty mount namespace stalls all others. Directories
with the new FOP_IMMUTABLE flag skip the lock.
* Refuse to reconfigure internal superblocks through fspick(),
MS_REMOUNT or the read-only remount that a synchronous umount()
of the root does. For nullfs only root in the initial user
namespace could do it, but the superblock is shared by every
mount namespace and the flags showed up in statfs() for all of
them.
* Don't update the access time on nullfs and refuse F_SET_RW_HINT
on an immutable inode.
- unshare: Free an nsproxy that was never installed with
nsproxy_free() when set_cred_ucounts() fails. put_nsproxy() dropped
active references that were never taken, which triggered a warning
and hid the caller's own namespaces from listns().
- Smaller changes: mount_setattr() checks the target before it walks
the tree to allocate peer group ids, unshare() puts the old
fs_struct before the old namespaces, dissolve_on_fput() drops the
file's reference to the tree itself, disconnect_mount() is
simplified and the documentation of the propagated unmount rule is
brought up to date"
* tag 'vfs-7.3-rc7.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (58 commits)
namespace: simplify disconnect_mount()
selftests/filesystems: test covered mounts
namespace: rework connected mounts
nullfs: add an empty immutable regular file
selftests/filesystems: check that reading the root of an empty mount namespace stalls nobody
selftests/filesystems: add a helper that holds a readdir in a page fault
readdir: take no inode lock on an immutable directory
nullfs: refuse file locks
fsnotify: let a filesystem refuse marks on its objects
namespace: nothing is mounted on or written through knullfs
namespace: keep the private nullfs instance in knullfs
fhandle: decide the subtree check under mount_lock
selftests/filesystems: check that an automount below an overlay layer is refused
selftests/filesystems: check the atime of the empty mount namespace root
selftests/filesystems: check that a lock lands on the right mount and stays
namespace: keep the lock on a mount that a propagated copy is moved beneath
namespace: never expire a locked mount
nullfs: don't update the access time
namespace: handle mount locking for automounts correctly
namespace: refuse an automount below a mount that is in no namespace
...
|
||
|
Linus Torvalds
|
9515f634db |
arm64 fixes for -rc7
- Fix PMU EL2 trap configuration for CPUs with an IMPDEF PMU.
- Fix kcov boot selftest failure by excluding our early IRQ entry code.
-----BEGIN PGP SIGNATURE-----
iQFEBAABCgAuFiEEPxTL6PPUbjXGY88ct6xw3ITBYzQFAmrH1N8QHHdpbGxAa2Vy
bmVsLm9yZwAKCRC3rHDchMFjNHG0CACV2EKHHOdY/g1+PA6NmNeWzVlFT0nczOSh
m/iF+SHdZ+ZcFdipKFQd5cMVpDyVubOvJjuvlFQYreM1AkNrbTqavYfHwbF8mmdF
iqSZIjimjPUBmAJtxlobgP1UPUypI6Chnu0GTnLohufaznEhVqBj97aaE3xyMe3F
muX6d5yybK+wUi/iNt+gnsDNnGS9nDv0/Az7lUeqE1kSFWISz0UQa/pyEDtm4XT9
kzaWsRuRiRNb86nxalA5lvGaZd+RRXtMkUGp0OB3TCgN5WyfgFf3QiSufcYS3RlN
aozeM3nZFaSU4XMH8Ce1XbUkfr1HNA18MgwMSzorjLMBs56PAvax
=Xwu1
-----END PGP SIGNATURE-----
Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
Pull arm64 fixes from Will Deacon:
"It finally seems to have calmed down on the arm64 fixes front, so
please pull these two straightforward fixes for -rc7. One fixes the
EL2 trap configuration for implementation-defined CPU PMU hardware
during boot and the other fixes a kcov selftest failure by excluding
our softirq early entry code:
- Fix PMU EL2 trap configuration for CPUs with an IMPDEF PMU
- Fix kcov boot selftest failure by excluding our early IRQ entry
code"
* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
arm64: irq: exclude the softirq stack switch from KCOV
arm64/boot: Don't set PMUv3p9 FGT2 bits without PMUv3
|
||
Bihaan Sen
|
41363c27b8 |
Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox
The 8BitDo Pro 2 Wired Controller for Xbox is already matched by the vendor-wide XPAD_XBOXONE_VENDOR(0x2dc8) entry, but a later hardware revision reports product ID 0x201e, which has no entry in the xpad_device table. The device therefore binds and functions but is exposed to userspace as "Generic X-Box pad". Add the VID/PID pair so the controller is named correctly, and set MAP_SHARE_BUTTON to expose the share button as KEY_RECORD. Signed-off-by: Bihaan Sen <stevewholikesthings@gmail.com> Link: https://patch.msgid.link/20260925114459.110253-1-stevewholikesthings@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> |