mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-10-20 19:23:40 +00:00
172,931 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Linus Torvalds
|
a55f7f5f29 |
Including fixes from netfilter, IPsec and wireless. This is again
considerably bigger than the old average. No known outstanding
regressions.
Current release - regressions:
- net: increase IP_TUNNEL_RECURSION_LIMIT to 5
- eth: ice: fix PTP timestamping broken by SyncE code on E825C
Current release - new code bugs:
- eth: stmmac: dwmac-motorcomm: fix eFUSE MAC address read failure
Previous releases - regressions:
- core: fix cross-cache free of KFENCE-allocated skb head
- sched: act_csum: validate nested VLAN headers
- rxrpc: fix call removal to use RCU safe deletion
- xfrm:
- wait for RCU readers during policy netns exit
- fix refcount leak in xfrm_migrate_policy_find
- wifi: rt2x00usb: fix devres lifetime
- mptcp: fix slab-use-after-free in __inet_lookup_established
- ipvs: fix NULL deref in ip_vs_add_service error path
- eth: airoha: fix memory leak in airoha_qdma_rx_process()
- eth: lan966x: fix use-after-free and leak in lan966x_fdma_reload()
Previous releases - always broken:
- ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()
- ipv4: nexthop: avoid duplicate NHA_HW_STATS_ENABLE on nexthop group dump
- bridge: guard local VLAN-0 FDB helpers against NULL vlan group
- xsk: tailroom reservation and MTU validation
- rxrpc:
- fix to request an ack if window is limited
- fix RESPONSE authenticator parser OOB read
- netfilter: nft_ct: fix use-after-free in timeout object destroy
- batman-adv: hold claim backbone gateways by reference
- eth: stmmac: fix PTP ref clock for Tegra234
- eth: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling
- eth: ipa: fix GENERIC_CMD register field masks for IPA v5.0+
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-----BEGIN PGP SIGNATURE-----
iQJGBAABCgAwFiEEg1AjqC77wbdLX2LbKSR5jcyPE6QFAmnXtnsSHHBhYmVuaUBy
ZWRoYXQuY29tAAoJECkkeY3MjxOkZeYQAKfZCL4rCkeO7VuoZn8lMN4YrBqVphuU
MFpLKnvU8muDamBSmXGwpsdryrzQdUtEl0C7E/YyKO8TKpmFkjQRKe/Ay5XSsmJi
fqjQiZIC9TKgVbJJbQZ4yZqOO2EZXHMRx8awnDjIwIrSLTyJtD29XaJqvmm+rojw
uAVECbXpVOWdRVyIgHf0N3y99ItvwQycv6npjXWGHDryGVH1uXz4CiWFgltFd827
MgNx5gZ7wn6ls1B4E1EsIXZeCnVOoNMUBX+CtkSl7ctZD/nvqLZ0PqGEViqGZ+w7
kEK9jWWvsmST3j0wG4IldbnQJORZrDXR5lAmvOJILxUDD4jG4zaqHPYs4ELS5sHK
E1QOs6uNBNvu40neGe7zcH4DpQzv5/W5yj0ELPBZJhV/5madjEpETOh6yO7EJRBl
sdd32LD0z8wFt8yJGEbXM7YC4A8tzNagWF0wKpRqbiKFlWHdJffwqcmEe6+2CiXx
rg0q2DAfvTesmzdMgGuk4ZOeczfZ9JbxPYA0IYrUegYmbI6tAuCK5slaKGOwoyml
hX2lXNBxaVmTk7F9Qq6I9Ona78XqO0Tg0UBzC2dIsQITvkue7ItJBpkurOwYSOGt
a8SAVV0JwXSfPquKlOfLhagPZcuQuTQfIqRKVqM47KPPO/i99okRXQbfJGrpHJKM
8bzRl6654nAs
=uzl/
-----END PGP SIGNATURE-----
Merge tag 'net-7.0-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Paolo Abeni:
"Including fixes from netfilter, IPsec and wireless. This is again
considerably bigger than the old average. No known outstanding
regressions.
Current release - regressions:
- net: increase IP_TUNNEL_RECURSION_LIMIT to 5
- eth: ice: fix PTP timestamping broken by SyncE code on E825C
Current release - new code bugs:
- eth: stmmac: dwmac-motorcomm: fix eFUSE MAC address read failure
Previous releases - regressions:
- core: fix cross-cache free of KFENCE-allocated skb head
- sched: act_csum: validate nested VLAN headers
- rxrpc: fix call removal to use RCU safe deletion
- xfrm:
- wait for RCU readers during policy netns exit
- fix refcount leak in xfrm_migrate_policy_find
- wifi: rt2x00usb: fix devres lifetime
- mptcp: fix slab-use-after-free in __inet_lookup_established
- ipvs: fix NULL deref in ip_vs_add_service error path
- eth:
- airoha: fix memory leak in airoha_qdma_rx_process()
- lan966x: fix use-after-free and leak in lan966x_fdma_reload()
Previous releases - always broken:
- ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()
- ipv4: nexthop: avoid duplicate NHA_HW_STATS_ENABLE on nexthop group
dump
- bridge: guard local VLAN-0 FDB helpers against NULL vlan group
- xsk: tailroom reservation and MTU validation
- rxrpc:
- fix to request an ack if window is limited
- fix RESPONSE authenticator parser OOB read
- netfilter: nft_ct: fix use-after-free in timeout object destroy
- batman-adv: hold claim backbone gateways by reference
- eth:
- stmmac: fix PTP ref clock for Tegra234
- idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling
- ipa: fix GENERIC_CMD register field masks for IPA v5.0+"
* tag 'net-7.0-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (104 commits)
net: lan966x: fix use-after-free and leak in lan966x_fdma_reload()
net: lan966x: fix page pool leak in error paths
net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool()
nfc: pn533: allocate rx skb before consuming bytes
l2tp: Drop large packets with UDP encap
net: ipa: fix event ring index not programmed for IPA v5.0+
net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+
MAINTAINERS: Add Prashanth as additional maintainer for amd-xgbe driver
devlink: Fix incorrect skb socket family dumping
af_unix: read UNIX_DIAG_VFS data under unix_state_lock
Revert "mptcp: add needs_id for netlink appending addr"
mptcp: fix slab-use-after-free in __inet_lookup_established
net: txgbe: leave space for null terminators on property_entry
net: ioam6: fix OOB and missing lock
rxrpc: proc: size address buffers for %pISpc output
rxrpc: only handle RESPONSE during service challenge
rxrpc: Fix buffer overread in rxgk_do_verify_authenticator()
rxrpc: Fix leak of rxgk context in rxgk_verify_response()
rxrpc: Fix integer overflow in rxgk_verify_response()
rxrpc: Fix missing error checks for rxkad encryption/decryption failure
...
|
||
Jakub Kicinski
|
1ee3b19a26 |
netfilter pull request nf-26-04-08
-----BEGIN PGP SIGNATURE----- iQJdBAABCABHFiEEgKkgxbID4Gn1hq6fcJGo2a1f9gAFAmnWgxgbFIAAAAAABAAO bWFudTIsMi41KzEuMTEsMiwyDRxmd0BzdHJsZW4uZGUACgkQcJGo2a1f9gCNGhAA pX/Vn2Z6pfoNfL2Zq2pC8ZfcO+FrJUZEhPjzVTaGcsLefaOgOjQosDW3fAGSrLUj D7BbtEj4CN5aoietbuS73HCaRfxgP7Q9M0ZVHV9n4LdEjVP93XOiddXEpRazqrvq CmrdQxgtp1w43JcLuEzB20dYt6CEFiFbmqc7QWF8LPW3np1sfiw6dRaGeMTg9K9z avcDQwYmKzQfPvKezdJD8qvXDHvIv0RLcoxzwzDwyk5Z1Glqh6s0jyZO6p6Rxm1M q6dcEzOwqp+u4wrKCHqoxru94rfICZYi2eFxvaJNddiSDQuGBx0iDmwsS1QsEzU2 PC1wv9TDD2J5r4ZsLOSUZWuWEe2SzSu665sxQE+HKmMcn9KPz16Cnm7gaelg0y7c TroeJiW65kYBcmI5iozAxTNwSLBd3VnQ90rIxJxY+BEz3Q34xtild8U+HfAiVAal I/EURRTN4tEy6zgN10ciqtexx5z6hIbSAOjcIUrvq4J1Lupf3802mMPgiunMSCYm hK5ejbTgR0iCLdHUbz5Vu6O3II5D3l9UlWn21wx3mfzDD4lTFRWhXAQkpwN6qZgP bqcNfwLYifnqVaQB/od4UE5tRugo2zs1uTfJNtyiMFUUOgietDcSVDJnOTScUinH yHZjf+7mxc/7Nfk9VhqbzcrbGgibsIssy4TaSSqqxX4= =ybYL -----END PGP SIGNATURE----- Merge tag 'nf-26-04-08' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Florian Westphal says: ==================== netfilter updates for net I only included crash fixes, as we're closer to a release, rest will be handled via -next. 1) Fix a NULL pointer dereference in ip_vs_add_service error path, from Weiming Shi, bug added in 6.2 development cycle. 2) Don't leak kernel data bytes from allocator to userspace: nfnetlink_log needs to init the trailing NLMSG_DONE terminator. From Xiang Mei. 3) xt_multiport match lacks range validation, bogus userspace request will cause out-of-bounds read. From Ren Wei. 4) ip6t_eui64 match must reject packets with invalid mac header before calling eth_hdr. Make existing check unconditional. From Zhengchuan Liang. 5) nft_ct timeout policies are free'd via kfree() while they may still be reachable by other cpus that process a conntrack object that uses such a timeout policy. Existing reaping of entries is not sufficient because it doesn't wait for a grace period. Use kfree_rcu(). From Tuan Do. 6/7) Make nfnetlink_queue hash table per queue. As-is we can hit a page fault in case underlying page of removed element was free'd. Per-queue hash prevents parallel lookups. This comes with a test case that demonstrates the bug, from Fernando Fernandez Mancera. * tag 'nf-26-04-08' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: selftests: nft_queue.sh: add a parallel stress test netfilter: nfnetlink_queue: make hash table per queue netfilter: nft_ct: fix use-after-free in timeout object destroy netfilter: ip6t_eui64: reject invalid MAC header for all packets netfilter: xt_multiport: validate range encoding in checkentry netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator ipvs: fix NULL deref in ip_vs_add_service error path ==================== Link: https://patch.msgid.link/20260408163512.30537-1-fw@strlen.de Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
Marc Dionne
|
0cd3e3f3f2 |
rxrpc: Fix to request an ack if window is limited
Peers may only send immediate acks for every 2 UDP packets received.
When sending a jumbogram, it is important to check that there is
sufficient window space to send another same sized jumbogram following
the current one, and request an ack if there isn't. Failure to do so may
cause the call to stall waiting for an ack until the resend timer fires.
Where jumbograms are in use this causes a very significant drop in
performance.
Fixes:
|
||
Alok Tiwari
|
b33f5741bb |
rxrpc: Fix use of wrong skb when comparing queued RESP challenge serial
In rxrpc_post_response(), the code should be comparing the challenge serial
number from the cached response before deciding to switch to a newer
response, but looks at the newer packet private data instead, rendering the
comparison always false.
Fix this by switching to look at the older packet.
Fix further[1] to substitute the new packet in place of the old one if
newer and also to release whichever we don't use.
Fixes:
|
||
David Howells
|
146d4ab94c |
rxrpc: Fix call removal to use RCU safe deletion
Fix rxrpc call removal from the rxnet->calls list to use list_del_rcu()
rather than list_del_init() to prevent stuffing up reading
/proc/net/rxrpc/calls from potentially getting into an infinite loop.
This, however, means that list_empty() no longer works on an entry that's
been deleted from the list, making it harder to detect prior deletion. Fix
this by:
Firstly, make rxrpc_destroy_all_calls() only dump the first ten calls that
are unexpectedly still on the list. Limiting the number of steps means
there's no need to call cond_resched() or to remove calls from the list
here, thereby eliminating the need for rxrpc_put_call() to check for that.
rxrpc_put_call() can then be fixed to unconditionally delete the call from
the list as it is the only place that the deletion occurs.
Fixes:
|
||
|
Linus Torvalds
|
7f87a5ea75 |
hid-for-linus-2026040801
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEL65usyKPHcrRDEicpmLzj2vtYEkFAmnWuXcACgkQpmLzj2vt YEnxBA/+IUv7shC+2A9VOmVpPKvF7aP82hyUAaALF0JaUtGuwmKNuMy4g13S+go/ 5b6MWDlZ2pjN5lY6jFBVLcxfCysKKS3BKgfPza3y0PK1CoVeXzWniTuVjaHY9Mi+ +I64gAa/Ss1C872meBKvzNvgRnHzDFy6v7bp2Ly57Elack9ZZal6KfXBB3sMkVVB VCcFAODhiPbr4lgRlMdn6WIEnbNM3TAkmPUKTb4iyOV5qyB5/JQPWT7oqTv0FV6A z8AYAMVmpVFZyQT4NMKFdNPumziPTp4sQZuo9Wt8ybQuIlzaw1E1npkooNU9mfZd suKwQAEFnGDWA0T/5rySQ9c2P732PyBgGXpTzPAUUVmsK+LYD/CK7gkCkfursDoI RJQ8KE/RurQ7OKg8ABFpMw3OnmOfpwH7R4/EJ02PbXFEHWXGt37DrRiqJ5ud1UOj khm6b+nF1NbLzg+B5fZP7DtlPC76wOXHlAbiFloqEkG6gJl0fLfhmgFi5Pg/GZ92 eWJdUJ5ECnJL9UL2FTDxmFEcIyNBrZh+TS0MHdfvhSUHoyGWO5WNzzTqB/RCrgBF UVthzr/kSuvIkXbdjG1jDD/y+GHMVjv7HSSeh1p/l/1QfWljk6cglpl6LecaHC2Z ee2Ra2Jnw7l8PvQq6VH9WkRU94CtQtCHEyztjPW9IaR8CQk+2Oo= =KzYV -----END PGP SIGNATURE----- Merge tag 'hid-for-linus-2026040801' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - handling of new keycodes for contextual AI usages (Akshai Murari) - fix for UAF in hid-roccat (Benoît Sevens) - deduplication of error logging in amd_sfh (Maximilian Pezzullo) - various device-specific quirks and device ID additions (Even Xu, Lode Willems, Leo Vriska) * tag 'hid-for-linus-2026040801' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: Input: add keycodes for contextual AI usages (HUTRR119) HID: Kysona: Add support for VXE Dragonfly R1 Pro HID: amd_sfh: don't log error when device discovery fails with -EOPNOTSUPP HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 HID: roccat: fix use-after-free in roccat_report_event HID: Intel-thc-hid: Intel-quickspi: Add NVL Device IDs HID: Intel-thc-hid: Intel-quicki2c: Add NVL Device IDs |
||
|
Linus Torvalds
|
52f657e34d |
x86: shadow stacks: proper error handling for mmap lock
김영민 reports that shstk_pop_sigframe() doesn't check for errors from mmap_read_lock_killable(), which is a silly oversight, and also shows that we haven't marked those functions with "__must_check", which would have immediately caught it. So let's fix both issues. Reported-by: 김영민 <osori@hspace.io> Acked-by: Oleg Nesterov <oleg@redhat.com> Acked-by: Dave Hansen <dave.hansen@intel.com> Acked-by: Rick Edgecombe <rick.p.edgecombe@intel.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> |
||
Florian Westphal
|
936206e3f6 |
netfilter: nfnetlink_queue: make hash table per queue
Sharing a global hash table among all queues is tempting, but
it can cause crash:
BUG: KASAN: slab-use-after-free in nfqnl_recv_verdict+0x11ac/0x15e0 [nfnetlink_queue]
[..]
nfqnl_recv_verdict+0x11ac/0x15e0 [nfnetlink_queue]
nfnetlink_rcv_msg+0x46a/0x930
kmem_cache_alloc_node_noprof+0x11e/0x450
struct nf_queue_entry is freed via kfree, but parallel cpu can still
encounter such an nf_queue_entry when walking the list.
Alternative fix is to free the nf_queue_entry via kfree_rcu() instead,
but as we have to alloc/free for each skb this will cause more mem
pressure.
Cc: Scott Mitchell <scott.k.mitch1@gmail.com>
Fixes:
|
||
Tuan Do
|
f8dca15a1b |
netfilter: nft_ct: fix use-after-free in timeout object destroy
nft_ct_timeout_obj_destroy() frees the timeout object with kfree()
immediately after nf_ct_untimeout(), without waiting for an RCU grace
period. Concurrent packet processing on other CPUs may still hold
RCU-protected references to the timeout object obtained via
rcu_dereference() in nf_ct_timeout_data().
Add an rcu_head to struct nf_ct_timeout and use kfree_rcu() to defer
freeing until after an RCU grace period, matching the approach already
used in nfnetlink_cttimeout.c.
KASAN report:
BUG: KASAN: slab-use-after-free in nf_conntrack_tcp_packet+0x1381/0x29d0
Read of size 4 at addr ffff8881035fe19c by task exploit/80
Call Trace:
nf_conntrack_tcp_packet+0x1381/0x29d0
nf_conntrack_in+0x612/0x8b0
nf_hook_slow+0x70/0x100
__ip_local_out+0x1b2/0x210
tcp_sendmsg_locked+0x722/0x1580
__sys_sendto+0x2d8/0x320
Allocated by task 75:
nft_ct_timeout_obj_init+0xf6/0x290
nft_obj_init+0x107/0x1b0
nf_tables_newobj+0x680/0x9c0
nfnetlink_rcv_batch+0xc29/0xe00
Freed by task 26:
nft_obj_destroy+0x3f/0xa0
nf_tables_trans_destroy_work+0x51c/0x5c0
process_one_work+0x2c4/0x5a0
Fixes:
|
||
|
Linus Torvalds
|
86782c16a8 |
hyperv-fixes for v7.0-rc8
-----BEGIN PGP SIGNATURE----- iQFHBAABCgAxFiEEIbPD0id6easf0xsudhRwX5BBoF4FAmnUhoYTHHdlaS5saXVA a2VybmVsLm9yZwAKCRB2FHBfkEGgXtIDCACrMU/FIxC/S3IcN5Nm60X194C2HpsW qKZdpuFb9fxbJhHiZjwNbBsvaS8+kBQTRUiJalNgv3bYZ8y7Umt8tLNiDfgCGxRM oAiab6AwQhskchO1mXX2L6FACY9uS2NsTgEfIHU3+EKW9blX4yJodDRpTecOdI0o Ejxh2/xOC5hGHqYjol3EoDRMvn727audRKQeKDP8dh9Rn6RCbt08QinidSqpzGjI Ts2i4kgaL7WQEfXyK6qrOoP4oJ6mHCu6bM/wwMkmCMLoDwwvZ32YZ3b+LMoTmSeH FIr7mTd7loIpdVcmuSKXpjbRQgfiVLz0rEnYxy6o1XDjSpsMLdORvY44 =XSUS -----END PGP SIGNATURE----- Merge tag 'hyperv-fixes-signed-20260406' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull Hyper-V fixes from Wei Liu: - Two fixes for Hyper-V PCI driver (Long Li, Sahil Chandna) - Fix an infinite loop issue in MSHV driver (Stanislav Kinsburskii) * tag 'hyperv-fixes-signed-20260406' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: mshv: Fix infinite fault loop on permission-denied GPA intercepts PCI: hv: Fix double ida_free in hv_pci_probe error path PCI: hv: Set default NUMA node to 0 for devices without affinity info |
||
Maciej Fijalkowski
|
93e84fe45b |
xsk: fix XDP_UMEM_SG_FLAG issues
Currently xp_assign_dev_shared() is missing XDP_USE_SG being propagated
to flags so set it in order to preserve mtu check that is supposed to be
done only when no multi-buffer setup is in picture.
Also, this flag has the same value as XDP_UMEM_TX_SW_CSUM so we could
get unexpected SG setups for software Tx checksums. Since csum flag is
UAPI, modify value of XDP_UMEM_SG_FLAG.
Fixes:
|
||
|
Maciej Fijalkowski
|
1ee1605138 |
xsk: respect tailroom for ZC setups
Multi-buffer XDP stores information about frags in skb_shared_info that
sits at the tailroom of a packet. The storage space is reserved via
xdp_data_hard_end():
((xdp)->data_hard_start + (xdp)->frame_sz - \
SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
and then we refer to it via macro below:
static inline struct skb_shared_info *
xdp_get_shared_info_from_buff(const struct xdp_buff *xdp)
{
return (struct skb_shared_info *)xdp_data_hard_end(xdp);
}
Currently we do not respect this tailroom space in multi-buffer AF_XDP
ZC scenario. To address this, introduce xsk_pool_get_tailroom() and use
it within xsk_pool_get_rx_frame_size() which is used in ZC drivers to
configure length of HW Rx buffer.
Typically drivers on Rx Hw buffers side work on 128 byte alignment so
let us align the value returned by xsk_pool_get_rx_frame_size() in order
to avoid addressing this on driver's side. This addresses the fact that
idpf uses mentioned function *before* pool->dev being set so we were at
risk that after subtracting tailroom we would not provide 128-byte
aligned value to HW.
Since xsk_pool_get_rx_frame_size() is actively used in xsk_rcv_check()
and __xsk_rcv(), add a variant of this routine that will not include 128
byte alignment and therefore old behavior is preserved.
Reviewed-by: Björn Töpel <bjorn@kernel.org>
Acked-by: Stanislav Fomichev <sdf@fomichev.me>
Fixes:
|
||
|
Linus Torvalds
|
bfe62a4545 |
soc fixes for 7.0, part 2
The largest part here are devicetree fixes for Qualcomm, and NXP i.MX, addressing a few regressions and incorrect settings in board and SoC pecific dts files. The largest single commits are a revert of a cleanup patch for i.MX that caused regressions for the NAND flash controller and a fixup for an incomplete cleanup of the PCIe controller on Qualcomm platforms that broke because the state was left incompatible with both the old and new behavior. On the Rockchips, Hisilicon, Renesas, Allwinner and AT91 platforms, only a single simple dts bugfix each was added since the last round of fixes. On the SoC specific device drivers, everything is relatively harmless: three reset controller driver fixes, a compatibility for fix ASpeed soc ID, and error handling fixes for Qualcomm and Microchip. One regression fix on Qualcomm addresses a problem with a previous fix for DisplayPort alt mode. -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnSzf4ACgkQmmx57+YA GNlTFRAAqDfGNCVTJKBFdKHxCDHtJUb5CkanKEXys+OJk1OVdtO86OFTgpXcEESt HYGeJxyTcmj3zxqYVctA6E+syFatpP+mq9eNzX+YokOSaTSjF9OFhNluUMXHk7ug elM9owYReDi/l+nbwfKgtknrSZfq2xsOLiGNo78zDQKAwDGpTPGqX2Naeiyguqod V/niNDAA3MrIoZmzrbJtkmId0A//FjTOTmJGSE+OFvQ6ZnvijO3JQ7jpCPmCdIcH B+DLa8Ig+wdqQICq0Dx77bqiVWBtWlSS4QU5mHY5TmAtB82Dzse/Yi8wTZXj/rM8 i8OG2mjjynvF/g+P8Ed+XZ+qXX8HbXhAgrm4pR9WR9ZZhXM01br+LNQYAp7RjiY3 UOI/NE+poReL1s0Qr7irAMbI/TykKcCmrsgE8wt4hVPajtoJKsiIfdYGAQdb79f+ 2ZlUffQ3HxEWlMoD/glEOMesZ8HdYxRhwpavN8wvLpqXkuZJBTa8w0EDm+VyYE9W CmwP/u1CG15t33tm0TQKZ69QsENoNU/eJF8Yj4t1MfsAC9t+c5aGk0kryryxhH/w QazSFHnNMek2KOyE50MxDLWwAG4/ulTgELFlJqSjm3T7QmaT2ApTx3a1rQ28BMHL bS9Qg2bvhD+f5BY5FaZWpkBex9oZi5vGp3aIN4ERUbgMKUmVhgc= =WQXe -----END PGP SIGNATURE----- Merge tag 'soc-fixes-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC fixes from Arnd Bergmann: "The largest part here are devicetree fixes for Qualcomm, and NXP i.MX, addressing a few regressions and incorrect settings in board and SoC pecific dts files. The largest single commits are a revert of a cleanup patch for i.MX that caused regressions for the NAND flash controller and a fixup for an incomplete cleanup of the PCIe controller on Qualcomm platforms that broke because the state was left incompatible with both the old and new behavior. On the Rockchips, Hisilicon, Renesas, Allwinner and AT91 platforms, only a single simple dts bugfix each was added since the last round of fixes. On the SoC specific device drivers, everything is relatively harmless: three reset controller driver fixes, a compatibility for fix ASpeed soc ID, and error handling fixes for Qualcomm and Microchip. One regression fix on Qualcomm addresses a problem with a previous fix for DisplayPort alt mode" * tag 'soc-fixes-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (32 commits) arm64: dts: qcom: hamoa: Fix incomplete Root Port property migration dt-bindings: display/msm: qcm2290-mdss: Fix missing ranges in example firmware: microchip: fail auto-update probe if no flash found arm64: dts: renesas: sparrow-hawk: Reserve first 128 MiB of DRAM arm64: dts: qcom: agatti: Fix IOMMU DT properties dt-bindings: media: venus: Fix iommus property dt-bindings: display: msm: qcm2290-mdss: Fix iommus property arm64: dts: allwinner: sun55i: Fix r-spi DMA reset: spacemit: k3: Decouple composite reset lines reset: gpio: fix double free in reset_add_gpio_aux_device() error path ARM: dts: microchip: sam9x7: fix gpio-lines count for pioB arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity reset: rzg2l-usbphy-ctrl: Fix malformed MODULE_AUTHOR string soc: microchip: mpfs-mss-top-sysreg: Fix resource leak on driver unbind soc: microchip: mpfs-control-scb: Fix resource leak on driver unbind soc: qcom: pmic_glink_altmode: Fix TBT->SAFE->!TBT transition arm64: dts: qcom: monaco: Reserve full Gunyah metadata region arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" ... |
||
|
Linus Torvalds
|
1791c39014 |
Char/misc/iio driver fixes for 7.0-rc7
Here are a relativly large number of small char/misc/iio and other driver fixes for 7.0-rc7. There's a bunch, but overall they are all small fixes for issues that people have been having that I finally caught up with getting merged due to delays on my end. The "largest" change overall is just some documentation updates to the security-bugs.rst file to hopefully tell the AI tools (and any users that actually read the documentation), how to send us better security bug reports as the quantity of reports these past few weeks has increased dramatically due to tools getting better at "finding" things. Included in here are: - lots of small IIO driver fixes for issues reported in 7.0-rc - gpib driver fixes - comedi driver fixes - interconnect driver fix - nvmem driver fixes - mei driver fix - counter driver fix - binder rust driver fixes - some other small misc driver fixes All of these have been in linux-next this week with no reported issues. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -----BEGIN PGP SIGNATURE----- iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCadIaEg8cZ3JlZ0Brcm9h aC5jb20ACgkQMUfUDdst+ym34ACfTtx3DzFMxNmE2eQrvptvqmSeVEoAoIt9h9kF pVDpO6Njqetq0zzWfBL3 =uv/h -----END PGP SIGNATURE----- Merge tag 'char-misc-7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc/iio driver fixes from Greg KH: "Here are a relativly large number of small char/misc/iio and other driver fixes for 7.0-rc7. There's a bunch, but overall they are all small fixes for issues that people have been having that I finally caught up with getting merged due to delays on my end. The "largest" change overall is just some documentation updates to the security-bugs.rst file to hopefully tell the AI tools (and any users that actually read the documentation), how to send us better security bug reports as the quantity of reports these past few weeks has increased dramatically due to tools getting better at "finding" things. Included in here are: - lots of small IIO driver fixes for issues reported in 7.0-rc - gpib driver fixes - comedi driver fixes - interconnect driver fix - nvmem driver fixes - mei driver fix - counter driver fix - binder rust driver fixes - some other small misc driver fixes All of these have been in linux-next this week with no reported issues" * tag 'char-misc-7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (63 commits) Documentation: fix two typos in latest update to the security report howto Documentation: clarify the mandatory and desirable info for security reports Documentation: explain how to find maintainers addresses for security reports Documentation: minor updates to the security contacts .get_maintainer.ignore: add myself nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy nvmem: imx: assign nvmem_cell_info::raw_len misc: fastrpc: check qcom_scm_assign_mem() return in rpmsg_probe misc: fastrpc: possible double-free of cctx->remote_heap comedi: dt2815: add hardware detection to prevent crash comedi: runflags cannot determine whether to reclaim chanlist comedi: Reinit dev->spinlock between attachments to low-level drivers comedi: me_daq: Fix potential overrun of firmware buffer comedi: me4000: Fix potential overrun of firmware buffer comedi: ni_atmio16d: Fix invalid clean-up after failed attach gpib: fix use-after-free in IO ioctl handlers gpib: lpvo_usb: fix memory leak on disconnect gpib: Fix fluke driver s390 compile issue lis3lv02d: Omit IRQF_ONESHOT if no threaded handler is provided lis3lv02d: fix kernel-doc warnings ... |
||
|
Linus Torvalds
|
aea7c84f28 |
USB/Thunderbolt fixes for 7.0-rc7
Here are a bunch of USB and Thunderbolt fixes (most all are USB) for
7.0-rc7. More than I normally like this late in the release cycle,
partly due to my recent travels, and partly due to people banging away
on the USB gadget interfaces and apis more than normal (big shoutout to
Android for getting the vendors to actually work upstream on this,
that's a huge win overall for everyone here.)
Included in here are:
- Small thunderbolt fix
- new USB serial driver ids added
- typec driver fixes
- gadget driver fixes for some disconnect issues
- other usb gadget driver fixes for reported problems with binding and
unbinding devices as happens when a gadget device connects /
disconnects from a system it is plugged into (or it switches device
mode at a user's request, these things are complex little beasts...)
- usb offload fixes (where USB audio tunnels through the controller
while the main CPU is asleep) for when EMP spikes hit the system
causing disconnects to happen (as often happens with static
electricity in the winter months). This has been much reported by
at least one vendor, and resolves the issues they have been seeing
with this codepath. Can't wait for the "formal methods are the
answer!" people to try to model that one properly...
- Other small usb driver fixes for issues reported.
All of these have been in linux-next this week, and before, with no
reported issues, and I've personally been stressing these harder than
normal on my systems here with no problems.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCadIdow8cZ3JlZ0Brcm9h
aC5jb20ACgkQMUfUDdst+ylTVQCfYg21ERvg753HnW1zbnzjMFlJZTQAoL+/0zeH
VcNijzt/8uiEKvQWAhcB
=BcZf
-----END PGP SIGNATURE-----
Merge tag 'usb-7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
Pull USB/Thunderbolt fixes from Greg KH:
"Here are a bunch of USB and Thunderbolt fixes (most all are USB) for
7.0-rc7. More than I normally like this late in the release cycle,
partly due to my recent travels, and partly due to people banging away
on the USB gadget interfaces and apis more than normal (big shoutout
to Android for getting the vendors to actually work upstream on this,
that's a huge win overall for everyone here)
Included in here are:
- Small thunderbolt fix
- new USB serial driver ids added
- typec driver fixes
- gadget driver fixes for some disconnect issues
- other usb gadget driver fixes for reported problems with binding
and unbinding devices as happens when a gadget device connects /
disconnects from a system it is plugged into (or it switches device
mode at a user's request, these things are complex little
beasts...)
- usb offload fixes (where USB audio tunnels through the controller
while the main CPU is asleep) for when EMP spikes hit the system
causing disconnects to happen (as often happens with static
electricity in the winter months). This has been much reported by
at least one vendor, and resolves the issues they have been seeing
with this codepath. Can't wait for the "formal methods are the
answer!" people to try to model that one properly...
- Other small usb driver fixes for issues reported.
All of these have been in linux-next this week, and before, with no
reported issues, and I've personally been stressing these harder than
normal on my systems here with no problems"
* tag 'usb-7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (39 commits)
usb: gadget: f_hid: move list and spinlock inits from bind to alloc
usb: host: xhci-sideband: delegate offload_usage tracking to class drivers
usb: core: use dedicated spinlock for offload state
usb: cdns3: gadget: fix state inconsistency on gadget init failure
usb: dwc3: imx8mp: fix memory leak on probe failure path
usb: gadget: f_uac1_legacy: validate control request size
usb: ulpi: fix double free in ulpi_register_interface() error path
usb: misc: usbio: Fix URB memory leak on submit failure
USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam
usb: cdns3: gadget: fix NULL pointer dereference in ep_queue
usb: core: phy: avoid double use of 'usb3-phy'
USB: serial: option: add MeiG Smart SRM825WN
usb: gadget: f_rndis: Fix net_device lifecycle with device_move
usb: gadget: f_subset: Fix net_device lifecycle with device_move
usb: gadget: f_eem: Fix net_device lifecycle with device_move
usb: gadget: f_ecm: Fix net_device lifecycle with device_move
usb: gadget: u_ncm: Add kernel-doc comments for struct f_ncm_opts
usb: gadget: f_rndis: Protect RNDIS options with mutex
usb: gadget: f_subset: Fix unbalanced refcnt in geth_free
dt-bindings: connector: add pd-disable dependency
...
|
||
Stanislav Kinsburskii
|
16cbec2489 |
mshv: Fix infinite fault loop on permission-denied GPA intercepts
Prevent infinite fault loops when guests access memory regions without
proper permissions. Currently, mshv_handle_gpa_intercept() attempts to
remap pages for all faults on movable memory regions, regardless of
whether the access type is permitted. When a guest writes to a read-only
region, the remap succeeds but the region remains read-only, causing
immediate re-fault and spinning the vCPU indefinitely.
Validate intercept access type against region permissions before
attempting remaps. Reject writes to non-writable regions and executes to
non-executable regions early, returning false to let the VMM handle the
intercept appropriately.
This also closes a potential DoS vector where malicious guests could
intentionally trigger these fault loops to consume host resources.
Fixes:
|
||
Chris J Arges
|
77facb3522 |
net: increase IP_TUNNEL_RECURSION_LIMIT to 5
In configurations with multiple tunnel layers and MPLS lwtunnel routing, a
single tunnel hop can increment the counter beyond this limit. This causes
packets to be dropped with the "Dead loop on virtual device" message even
when a routing loop doesn't exist.
Increase IP_TUNNEL_RECURSION_LIMIT from 4 to 5 to handle this use-case.
Fixes:
|
||
|
Linus Torvalds
|
116a3308e1 |
gpio fixes for v7.0-rc7
- fix kerneldocs for gpio-timberdale and gpio-nomadik - clear the "requested" flag in error path in gpiod_request_commit() - call of_xlate() if provided when setting up shared GPIOs - handle pins shared by child firmware nodes of consumer devices - fix return value check in gpio-qixis-fpga - fix suspend on gpio-mxc - fix gpio-microchip DT bindings -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEkeUTLeW1Rh17omX8BZ0uy/82hMMFAmnPrRAACgkQBZ0uy/82 hMMuug//dHmJlcs/5gHbFgno6CzB8v3Ngkd5UF1cmdI8ebiiRwqx4NqwlnQwBP3o Dr+iTG1z5M7o47rSOeYn50a79Xns3ROQkJoeeY8Uf0ZCpaSUs7htvFXCqLyCie5o o9or5nu87V6TcV/Ue7nnRvXCRk7GTZ5z3UjpMvafuRwCz53KTLXQXae/a9KqiRHi XbCmByrw9XpdGrr5kbrdkc3SwXILREKvvN8YxGIh37XeeQYcXIKb6FjlPN86Y/xC v+krLnFjZ+duguikvGi7HlP11/JpB2RtPDPs5QOkY/GTtkZXE6zyxDWagbYIKwrr 3+QlGs+kbxzlrbVu95kw381PNcNCVZIuDLUm2aguPGRuazPhaeI+hG+XbYCeCmQI DVIzDwhcGzsj7wrrICQTkT2kWQg6FsMgzwLOc/8BeJnrohnNFQlcrI1T6EX7EIuM JLw6CkDUKN4v4ULg0B0+59D/yPSx8HgUrI4KbNgQyALDUiKW1K+bxGsS9PpWCCFT PFfHamkXO6zT+NRZV6n6GQNdpOi9EewNFXbFBlcTtBCJyZttJI7IMi0M0JndCshO V3yeOMU/LElucEMGuRMZJUJwrKPnkWe+afq0bekKrzag67cYpy0qxie4UDqVo9qB hREwBJXwtdZan4gZk4eerg+6qzVgFTF1el1fZaU8JsdByb0zkoQ= =pQpQ -----END PGP SIGNATURE----- Merge tag 'gpio-fixes-for-v7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - fix kerneldocs for gpio-timberdale and gpio-nomadik - clear the "requested" flag in error path in gpiod_request_commit() - call of_xlate() if provided when setting up shared GPIOs - handle pins shared by child firmware nodes of consumer devices - fix return value check in gpio-qixis-fpga - fix suspend on gpio-mxc - fix gpio-microchip DT bindings * tag 'gpio-fixes-for-v7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: dt-bindings: gpio: fix microchip #interrupt-cells gpio: shared: shorten the critical section in gpiochip_setup_shared() gpio: mxc: map Both Edge pad wakeup to Rising Edge gpio: qixis-fpga: Fix error handling for devm_regmap_init_mmio() gpio: shared: handle pins shared by child nodes of devices gpio: shared: call gpio_chip::of_xlate() if set gpiolib: clear requested flag if line is invalid gpio: nomadik: repair some kernel-doc comments gpio: timberdale: repair kernel-doc comments gpio: Fix resource leaks on errors in gpiochip_add_data_with_key() |
||
|
Linus Torvalds
|
7b9e74c5a4 |
bpf-fixes
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEE+soXsSLHKoYyzcli6rmadz2vbToFAmnPGdMACgkQ6rmadz2v bTrNxw/9Hcn2V/Jqp/cEagmKIKqSAUFgEE+AwRbQU5YL2Yem/6Q15rnOk8pOSDT5 jqk7VbuchVmWa+a9DVy7d3XVWohk332QbvQRHfqV8P0ZpnfJa0YqdZlKg2/4/8P/ yVhLzVrGIGcvvz9CfhIynRhq/fvr7iYbSSv9JT3nig4qCYpUf7kPbXSLtxyElNWN xX36KfTxQO4xI2+iezsNwklXF25Tv59V1fNuKF2lshxS+DwaroAzAJLd3MGvTHRj 8y5kU1UDb+HeJh9DpEFjppQp4qUQjIKAiNVvXGUOe7TI/i9VTIiMfesniWKNwzYv Alo2G8fLb4nJhzNL2ol4R0I5BCYmMT55tBFvSNJQ+9Esy6azkbExmKuE1hXsUXo1 jY0TbNt58zSZEmyz9SYoFKlg4lOW4ZIMl0RtnSBRoDwtK3ThGV7QFlnKq3uPZ6ce RcpMk7cOnERLzwPnpSiACrQmzhMk+j5HG1u+Eb3rXKxYCQO6bAhpQyPDKsiXNgkL uezq2zqAnNho0/CInHGlRj7E1JnvRoHCcLBT4zzyIY/jruI8fzK0aMqGMvk/qOby BWDnJ9GG3VmGSUc/FOp3IchKCnxXhkYqsjBCP03cbIZgr1MuixZeom81OsPNmSX8 Ke+FeGNsU5zOUJ1iG2BZjdya/DAgP8hd85WVtaXyX60KKhuu45c= =w0RY -----END PGP SIGNATURE----- Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Pull bpf fixes from Alexei Starovoitov: - Fix register equivalence for pointers to packet (Alexei Starovoitov) - Fix incorrect pruning due to atomic fetch precision tracking (Daniel Borkmann) - Fix grace period wait for bpf_link-ed tracepoints (Kumar Kartikeya Dwivedi) - Fix use-after-free of sockmap's sk->sk_socket (Kuniyuki Iwashima) - Reject direct access to nullable PTR_TO_BUF pointers (Qi Tang) - Reject sleepable kprobe_multi programs at attach time (Varun R Mallya) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: selftests/bpf: Add more precision tracking tests for atomics bpf: Fix incorrect pruning due to atomic fetch precision tracking bpf: Reject sleepable kprobe_multi programs at attach time bpf: reject direct access to nullable PTR_TO_BUF pointers bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). bpf: Fix grace period wait for tracepoint bpf_link bpf: Fix regsafe() for pointers to packet |
||
|
Linus Torvalds
|
5a9617dde7 |
This push contains the following changes:
- Add missing async markers to tegra. - Fix long hmac key DMA handling in caam. - Fix spurious ENOSPC errors in deflate. - Fix SG chaining in af_alg. - Do not use in-place process in algif_aead. - Fix out-of-place destination overflow in authencesn. -----BEGIN PGP SIGNATURE----- iQIyBAABCgAdFiEEn51F/lCuNhUwmDeSxycdCkmxi6cFAmnPB8sACgkQxycdCkmx i6eSVg/3fDIS9Sjf7yiFrjefCbBc9uCbey+BGVEY3cdKNHDAysbhDdAGqT4tVsJb w7Vn9AJ+DPGQGyadgsDuF5KmsewivKFl0gJzuKG2DNUIjTYctGJubfyiriUt1P+2 rQ7R9BBQMrbUbV0KQi/q4WlnYDJanNxcCz+cVrhDYFIjTGnu4BOun6LIhcAFlrpB 0jeVPtUZJNLPCrFNjvIdS73uE6/Y7M+u+QQ4/WQo/bhCqn6brrallB030UFUQiji SqLKL4/2fIMUzbZ5GifKz8WSNAKpGStUYyzN6MpSsprJd6opyvjeTfyup6bwJe/8 +nLUJ8PYAQ9p3XNe2YwTc0bAfbN2QgjhPJ3Gu9alLBKzj3O6JTwEwddqx4LMYgue RbOEZOBHLj/VJzxGWL84gq5HGCOaOG39xAOKny458EaUjUUrepXpp7WV3Ql6lfD7 eGZ+pHVOXUkmwcXBxE2EcD7Gb1t9F7bmhq8Y+yfi0ImzTeadFJzzCMn1K/e1zhHM RjTWmVF4eNTjLhPc27FOCcervEYmxwdhuQHRTbuyLyhNdkiVsMWaj5rCgggA6Uug bNzBYYvK0ColVCLJAy6hDU/AvYyyz22L1QodPjOGe6DJaAblrZaGETepLF0lGnpf 9//i1EaZmNPrLYifNNgkjT2xCuQZbbO3kWuTpwWtgddId0zoyA== =CJbs -----END PGP SIGNATURE----- Merge tag 'v7.0-p4' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: - Add missing async markers to tegra - Fix long hmac key DMA handling in caam - Fix spurious ENOSPC errors in deflate - Fix SG chaining in af_alg - Do not use in-place process in algif_aead - Fix out-of-place destination overflow in authencesn * tag 'v7.0-p4' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption crypto: algif_aead - Revert to operating out-of-place crypto: af-alg - fix NULL pointer dereference in scatterwalk crypto: deflate - fix spurious -ENOSPC crypto: caam - fix overflow on long hmac keys crypto: caam - fix DMA corruption on long hmac keys crypto: tegra - Add missing CRYPTO_ALG_ASYNC |
||
|
Linus Torvalds
|
f8f5627a8a |
With fixes from wireless, bluetooth and Netfilter included we're back
to each PR carrying 30%+ more fixes than in previous era. The good
news is that so far none of the "extra" fixes are themselves
causing real regressions. Not sure how much comfort that is.
Current release - fix to a fix:
- netdevsim: fix build if SKB_EXTENSIONS=n
- eth: stmmac: skip VLAN restore when VLAN hash ops are missing
Previous releases - regressions:
- wifi: iwlwifi: mvm: don't send a 6E related command when
not supported
Previous releases - always broken:
- some info leak fixes
- add missing clearing of skb->cb[] on ICMP paths from tunnels
- ipv6: flowlabel: defer exclusive option free until RCU teardown
- ipv6: avoid overflows in ip6_datagram_send_ctl()
- mpls: add seqcount to protect platform_labels from OOB access
- bridge: improve safety of parsing ND options
- Bluetooth: fix leaks, overflows and races in hci_sync
- netfilter: add more input validation, some to address bugs directly
some to prevent exploits from cooking up broken configurations
- wifi: ath: avoid poor performance due to stopping the wrong
aggregation session
- wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free
- eth: fec: fix the PTP periodic output sysfs interface
- eth: enetc: safely reinitialize TX BD ring when it has unsent frames
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE6jPA+I1ugmIBA4hXMUZtbf5SIrsFAmnOldMACgkQMUZtbf5S
IrvaPQ/9EdZIY8AnvdgZmzVrMkTbbshpOy/lLxkpFE4yX1Hgw9BLSZqoC3rq2b41
78Q6Zk7tbOHQb8rBLawi3+YuY+Eq5R4ajt4MNWWd1sYaaHnOXwp91jO4rvocSCjz
8o8/Z3VU4znG+cK85mcuYqNZcar/0dI8m01136Dtoi0dtZ4KKdUBBDT/Zq7Ov3gJ
pKrSMZBFT5UwnhlLi+xZ65KjdUMlbTujlQf0vH815p+iM+5E8fJNK5h+a6ZefXB4
Un+jXxhD/Vj5TBwq8ZouDSAWVCAG26Yy9RGcn5O7w0mlzv48mWB1bIoXFEyc2F8s
EbsiEqCNygHLoVTsBU1+0psYqey7aZDfceokzYMONHpJgpWbFmmHjfcFxfgeq9Of
iI3DU7IQMBKdN7uC4dCKc94Ty9Jye+DvCnkeMUEwxV4Dkhnr+2wP0pGqo6r2K0sT
9mFBh8YP2KyRd5+Ei8D4zmQrGpqpsXwSIwrhnGHEkWGjMAW+TltyOPzPzUgvMBHX
XllZIAFpTFaZiR9ZZU8PRyUNRfh93AmV0tY4xYCqVArf85A/LjqmJCw6K6Pthcmw
RzezpyQUCJ044EyDfDhjVgK/YEEkdT+wUcKKLw31pdOvQVAPJ4pI95pWbeVz4kLk
30DE7PR+2hExm44GHUfG/v8MJTE2OkSRu26Ci4dQsm3sT2zvv2g=
=3Pjk
-----END PGP SIGNATURE-----
Merge tag 'net-7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Jakub Kicinski:
"With fixes from wireless, bluetooth and netfilter included we're back
to each PR carrying 30%+ more fixes than in previous era.
The good news is that so far none of the "extra" fixes are themselves
causing real regressions. Not sure how much comfort that is.
Current release - fix to a fix:
- netdevsim: fix build if SKB_EXTENSIONS=n
- eth: stmmac: skip VLAN restore when VLAN hash ops are missing
Previous releases - regressions:
- wifi: iwlwifi: mvm: don't send a 6E related command when
not supported
Previous releases - always broken:
- some info leak fixes
- add missing clearing of skb->cb[] on ICMP paths from tunnels
- ipv6:
- flowlabel: defer exclusive option free until RCU teardown
- avoid overflows in ip6_datagram_send_ctl()
- mpls: add seqcount to protect platform_labels from OOB access
- bridge: improve safety of parsing ND options
- bluetooth: fix leaks, overflows and races in hci_sync
- netfilter: add more input validation, some to address bugs directly
some to prevent exploits from cooking up broken configurations
- wifi:
- ath: avoid poor performance due to stopping the wrong
aggregation session
- virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free
- eth:
- fec: fix the PTP periodic output sysfs interface
- enetc: safely reinitialize TX BD ring when it has unsent frames"
* tag 'net-7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (95 commits)
eth: fbnic: Increase FBNIC_QUEUE_SIZE_MIN to 64
ipv6: avoid overflows in ip6_datagram_send_ctl()
net: hsr: fix VLAN add unwind on slave errors
net: hsr: serialize seq_blocks merge across nodes
vsock: initialize child_ns_mode_locked in vsock_net_init()
selftests/tc-testing: add tests for cls_fw and cls_flow on shared blocks
net/sched: cls_flow: fix NULL pointer dereference on shared blocks
net/sched: cls_fw: fix NULL pointer dereference on shared blocks
net/x25: Fix overflow when accumulating packets
net/x25: Fix potential double free of skb
bnxt_en: Restore default stat ctxs for ULP when resource is available
bnxt_en: Don't assume XDP is never enabled in bnxt_init_dflt_ring_mode()
bnxt_en: Refactor some basic ring setup and adjustment logic
net/mlx5: Fix switchdev mode rollback in case of failure
net/mlx5: Avoid "No data available" when FW version queries fail
net/mlx5: lag: Check for LAG device before creating debugfs
net: macb: properly unregister fixed rate clocks
net: macb: fix clk handling on PCI glue driver removal
virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN
net/sched: sch_netem: fix out-of-bounds access in packet corruption
...
|
||
|
Linus Torvalds
|
4c2c526b5a |
IOMMU Fixes for Linux v7.0-rc6
Including: - IOMMU-PT related compile breakage in for AMD driver. - IOTLB flushing behavior when unmapped region is larger than requested due to page-sizes. - Fix IOTLB flush behavior with empty gathers. -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEr9jSbILcajRFYWYyK/BELZcBGuMFAmnOI/gACgkQK/BELZcB GuOt/g/+NVakCOh25ZW43l4GzOpoHUMhNMQnafzNA5Vh7ZrNXMESBPB1mw6kMgta ebaLxbHg6CIWoTZqqN22to01o1enKyEKMtF9/69Sp/178QidMOq21aRssbNtr0VF tpIzzoNspiKQ6io70EoYKBGLIBSIE/yrmnFDAHWo7EO/el/u+CD7RCssFBpT4ZjR d60kLZxj1mUBPVj3xhuFamT2i9IiQaPn00z3igmTocHIH8308KZY6HbRc4JtDfkE QHCrPr8SrZgpPdQwHf4/p6TFF7u5qcWYNyhtoUDp1TGUo7uYdbT2MRIvwmxhcyY1 xzYUdDNz8wufdyuGWjjsFhjcUV2KxLOk1NrneQB9Z9vrgR+N4LqW0cZX0RqcoiSH jufx4J2otd555wQOTYreeSp8zYQ5Ipx+ttaTX7yF0kfEOOhD8qNwKuWJ1nf57eQp g+YvFLDuklNSTS+mASgp0cRx1rTXy2e8RsFfi7vZHt6Chcybi6g72l0G1ALN0Krt zUVjsyp09Up2NSgIp53A6rZhoZyck7UlXUAg5yL1w9//QzIXley2TVtPW29n3zKN NHnZCAxg3qIT3VCrHk7q/Q+CzVewPcClw/4ZgZyTCEcewgAtsIdtaVQRtHKOLGzX MV5NACkK4x3MsdEXneixCy3jcraUvnxrSju67VeoIP/D2SEP/Zs= =miSc -----END PGP SIGNATURE----- Merge tag 'iommu-fixes-v7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux Pull iommu fixes from Joerg Roedel: - IOMMU-PT related compile breakage in for AMD driver - IOTLB flushing behavior when unmapped region is larger than requested due to page-sizes - Fix IOTLB flush behavior with empty gathers * tag 'iommu-fixes-v7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: iommupt/amdv1: mark amdv1pt_install_leaf_entry as __always_inline iommupt: Fix short gather if the unmap goes into a large mapping iommu: Do not call drivers for empty gathers |
||
Guan-Yu Lin
|
bd3d245b0f |
usb: core: use dedicated spinlock for offload state
Replace the coarse USB device lock with a dedicated offload_lock
spinlock to reduce contention during offload operations. Use
offload_pm_locked to synchronize with PM transitions and replace
the legacy offload_at_suspend flag.
Optimize usb_offload_get/put by switching from auto-resume/suspend
to pm_runtime_get_if_active(). This ensures offload state is only
modified when the device is already active, avoiding unnecessary
power transitions.
Cc: stable <stable@kernel.org>
Fixes:
|
||
Krzysztof Kozlowski
|
36b35ad879 |
Qualcomm driver fixes for v7.0
Fix the length of the PD restart reason string in pd-mapper to avoid QMI decoding errors, resulting in the notification being dropped. Fix the newly introduce handling of TBT/USB4 notifications in pmic_glink altmode driver, as it broke the handling of non-TBT/USB4 DisplayPort unplug events. -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEBd4DzF816k8JZtUlCx85Pw2ZrcUFAmnFNO0ACgkQCx85Pw2Z rcVjaRAAnwcE0zwUftiWG8errqAP7ZiPk4UXXgHDM9ia+KyWus7hiZUcQJ/23/YU Y0vQvWdF9RjE6M9SVacg08NEpCrHX4oypjryPFT6m31cZE4OW9SSw+Lxfjhp+2I9 l6odufal0cN79OEV2s0MToAnrLHMEJ4Z5vT9qGb26s4orPlGOvg2glpImYC42N/R RGc0veqcODr99FiMvv/wqWygptEJ28LZ5TYKPWnDiQARc3bDfl7o3bcLb/+2VE+z 90sRhGpFMHW4xWT9zpwnphb7wxERoWq8TA8PsnmCGuHVe9MhNuWYLTvv0d6Utnhc /FOY2JhCvHOxkV12KW/XBH/p3wzR7szg46yp6mmxsvF7cThEe0RCFol6ql2yZVNa u/Yxr4d7LnEIIBwQtyQ3mu07yg4fd1Ynrfem69B08skBJ6edp6tNIh3dYFDaZ0wa JJSp791fgUrOoLB1gqkHSwgC5l9c9rPgw/9awGE26Zn55QenloHql5Kdi0MDQxhZ 15UcdaKTJQtW1tTgLFoK/hGaBl+36Nm8TIIVAxnaQMYsElWBqN8armKyHnGrofKt 6n1+DUrxvI9gydaaRaCqt65IVwIUDHlTX0FXmP3A2aoWfKonZHauAsq/p1xi4eF4 LvHRXL53gr3J0ByI0hied9ZBn43a1hcOs3b1oSFNwuv0D8W3sE4= =iggu -----END PGP SIGNATURE----- Merge tag 'qcom-drivers-fixes-for-7.0' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/fixes Qualcomm driver fixes for v7.0 Fix the length of the PD restart reason string in pd-mapper to avoid QMI decoding errors, resulting in the notification being dropped. Fix the newly introduce handling of TBT/USB4 notifications in pmic_glink altmode driver, as it broke the handling of non-TBT/USB4 DisplayPort unplug events. * tag 'qcom-drivers-fixes-for-7.0' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/qcom/linux: soc: qcom: pmic_glink_altmode: Fix TBT->SAFE->!TBT transition soc: qcom: pmic_glink_altmode: Fix SVID=DP && unconnected edge case soc: qcom: pd-mapper: Fix element length in servreg_loc_pfr_req_ei Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org> |
||
|
Krzysztof Kozlowski
|
14a891256d |
Reset controller fixes for v7.0, part 2
* Decouple spacemit K3 reset lines that were incorrectly coupled together as one, but are in fact separate resets in hardware. * Fix a double free in the reset_add_gpio_aux_device() error path. This has already been fixed on reset/next by commit |
||
|
Florian Westphal
|
b7e8590987 |
netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr
IPSET_ATTR_NAME and IPSET_ATTR_NAMEREF are of NLA_STRING type, they
cannot be treated like a c-string.
They either have to be switched to NLA_NUL_STRING, or the compare
operations need to use the nla functions.
Fixes:
|
||
Randy Dunlap
|
8c0ef7b56d |
lis3lv02d: fix kernel-doc warnings
Use the correct kernel-doc format to avoid kernel-doc warnings: Warning: include/linux/lis3lv02d.h:125 struct member 'st_min_limits' not described in 'lis3lv02d_platform_data' Warning: include/linux/lis3lv02d.h:125 struct member 'st_max_limits' not described in 'lis3lv02d_platform_data' Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Link: https://patch.msgid.link/20260312051400.682991-1-rdunlap@infradead.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
Kumar Kartikeya Dwivedi
|
c76fef7dcd |
bpf: Fix grace period wait for tracepoint bpf_link
Recently, tracepoints were switched from using disabled preemption
(which acts as RCU read section) to SRCU-fast when they are not
faultable. This means that to do a proper grace period wait for programs
running in such tracepoints, we must use SRCU's grace period wait.
This is only for non-faultable tracepoints, faultable ones continue
using RCU Tasks Trace.
However, bpf_link_free() currently does call_rcu() for all cases when
the link is non-sleepable (hence, for tracepoints, non-faultable). Fix
this by doing a call_srcu() grace period wait.
As far RCU Tasks Trace gp -> RCU gp chaining is concerned, it is deemed
unnecessary for tracepoint programs. The link and program are either
accessed under RCU Tasks Trace protection, or SRCU-fast protection now.
The earlier logic of chaining both RCU Tasks Trace and RCU gp waits was
to generalize the logic, even if it conceded an extra RCU gp wait,
however that is unnecessary for tracepoints even before this change.
In practice no cost was paid since rcu_trace_implies_rcu_gp() was always
true. Hence we need not chaining any RCU gp after the SRCU gp.
For instance, in the non-faultable raw tracepoint, the RCU read section
of the program in __bpf_trace_run() is enclosed in the SRCU gp, likewise
for faultable raw tracepoint, the program is under the RCU Tasks Trace
protection. Hence, the outermost scope can be waited upon to ensure
correctness.
Also, sleepable programs cannot be attached to non-faultable
tracepoints, so whenever program or link is sleepable, only RCU Tasks
Trace protection is being used for the link and prog.
Fixes:
|
||
|
Linus Torvalds
|
53d85a2056 |
cgroup: Fixes for v7.0-rc6
- Fix cgroup rmdir racing with dying tasks. Deferred task cgroup unlink introduced a window where cgroup.procs is empty but the cgroup is still populated, causing rmdir to fail with -EBUSY and selftest failures. Make rmdir wait for dying tasks to fully leave and fix selftests to not depend on synchronous populated updates. - Fix cpuset v1 task migration failure from empty cpusets under strict security policies. When CPU hotplug removes the last CPU from a v1 cpuset, tasks must be migrated to an ancestor without a security_task_setscheduler() check that would block the migration. -----BEGIN PGP SIGNATURE----- iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCacwibg4cdGpAa2VybmVs Lm9yZwAKCRCxYfJx3gVYGXHEAP98nVEKyl7c7+sXYtwOPn8KEhdHkdpHyPZwhpS2 1wLhaQEAm8yO49s7IgvGPWSz0s/gQdmF5/x8RAee0sJsZALvGQg= =bUUt -----END PGP SIGNATURE----- Merge tag 'cgroup-for-7.0-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fixes from Tejun Heo: - Fix cgroup rmdir racing with dying tasks. Deferred task cgroup unlink introduced a window where cgroup.procs is empty but the cgroup is still populated, causing rmdir to fail with -EBUSY and selftest failures. Make rmdir wait for dying tasks to fully leave and fix selftests to not depend on synchronous populated updates. - Fix cpuset v1 task migration failure from empty cpusets under strict security policies. When CPU hotplug removes the last CPU from a v1 cpuset, tasks must be migrated to an ancestor without a security_task_setscheduler() check that would block the migration. * tag 'cgroup-for-7.0-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup/cpuset: Skip security check for hotplug induced v1 task migration cgroup/cpuset: Simplify setsched decision check in task iteration loop of cpuset_can_attach() cgroup: Fix cgroup_drain_dying() testing the wrong condition selftests/cgroup: Don't require synchronous populated update on task exit cgroup: Wait for dying tasks to leave on rmdir |
||
|
Linus Torvalds
|
dbf00d8d23 |
\n
-----BEGIN PGP SIGNATURE----- iQEzBAABCAAdFiEEq1nRK9aeMoq1VSgcnJ2qBz9kQNkFAmnLsoQACgkQnJ2qBz9k QNmnIAgAmJtXFZu/uJiRR6RrxmYzIdznkaZ8aTGeApQfG432goHqPhh1j+TKpe7Q YwrB90YP6umL16HOyKvci/jNpv7+vFb8sr93FPu8+01AnMJqfvA3IJ+hrzPy6IcX dqpO4oKr9gqbmf2/9Eny5mv50xcNI3+M7y+xh0MFsKoZxnEb2j4pCKQsPO0qMOZw Aui1fFb4nXpcWUlIJtNFRuXXR3pQf4n8ZpfywhUCe4FV5RRrwiq6Y8If0Tj8lqgx 2fEwbkkjZkFVlOijNhZSSWKnobwg3oUbpXStZE6Kyw60vZBcQgEKWOAke175v+qf XMuhiSrSawJDC45SZmb8QtGe8GEV6g== =gYPI -----END PGP SIGNATURE----- Merge tag 'fs_for_v7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull udf fix from Jan Kara: "Fix for a race in UDF that can lead to memory corruption" * tag 'fs_for_v7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: udf: Fix race between file type conversion and writeback mpage: Provide variant of mpage_writepages() with own optional folio handler |
||
Herbert Xu
|
a664bf3d60 |
crypto: algif_aead - Revert to operating out-of-place
This mostly reverts commit |
||
|
Linus Torvalds
|
d1384f70b2 |
vfs-7.0-rc6.fixes
Please consider pulling these changes from the signed vfs-7.0-rc6.fixes tag. Thanks! Christian -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCacmRjQAKCRCRxhvAZXjc olJnAQD2iiLqih8Y8nX3ESMkkIQWUoSikrfSVw/GqmuKTmlrDgEA/z+LRgDGnI/+ 6xzkEw4UNmJ9JoJsiPSlHq18yyga/ww= =DxTb -----END PGP SIGNATURE----- Merge tag 'vfs-7.0-rc6.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: - Fix netfs_limit_iter() hitting BUG() when an ITER_KVEC iterator reaches it via core dump writes to 9P filesystems. Add ITER_KVEC handling following the same pattern as the existing ITER_BVEC code. - Fix a NULL pointer dereference in the netfs unbuffered write retry path when the filesystem (e.g., 9P) doesn't set the prepare_write operation. - Clear I_DIRTY_TIME in sync_lazytime for filesystems implementing ->sync_lazytime. Without this the flag stays set and may cause additional unnecessary calls during inode deactivation. - Increase tmpfs size in mount_setattr selftests. A recent commit bumped the ext4 image size to 2 GB but didn't adjust the tmpfs backing store, so mkfs.ext4 fails with ENOSPC writing metadata. - Fix an invalid folio access in iomap when i_blkbits matches the folio size but differs from the I/O granularity. The cur_folio pointer would not get invalidated and iomap_read_end() would still be called on it despite the IO helper owning it. - Fix hash_name() docstring. - Fix read abandonment during netfs retry where the subreq variable used for abandonment could be uninitialized on the first pass or point to a deleted subrequest on later passes. - Don't block sync for filesystems with no data integrity guarantees. Add a SB_I_NO_DATA_INTEGRITY superblock flag replacing the per-inode AS_NO_DATA_INTEGRITY mapping flag so sync kicks off writeback but doesn't wait for flusher threads. This fixes a suspend-to-RAM hang on fuse-overlayfs where the flusher thread blocks when the fuse daemon is frozen. - Fix a lockdep splat in iomap when reads fail. iomap_read_end_io() invokes fserror_report() which calls igrab() taking i_lock in hardirq context while i_lock is normally held with interrupts enabled. Kick failed read handling to a workqueue. - Remove the redundant netfs_io_stream::front member and use stream->subrequests.next instead, fixing a potential issue in the direct write code path. * tag 'vfs-7.0-rc6.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: netfs: Fix the handling of stream->front by removing it iomap: fix lockdep complaint when reads fail writeback: don't block sync for filesystems with no data integrity guarantees netfs: Fix read abandonment during retry vfs: fix docstring of hash_name() iomap: fix invalid folio access when i_blkbits differs from I/O granularity selftests/mount_setattr: increase tmpfs size for idmapped mount tests fs: clear I_DIRTY_TIME in sync_lazytime netfs: Fix NULL pointer dereference in netfs_unbuffered_write() on retry netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators |
||
Akshai Murari
|
45065a5095 |
Input: add keycodes for contextual AI usages (HUTRR119)
HUTRR119 introduces new usages for keys intended to invoke AI agents based on the current context. These are useful with the increasing number of operating systems with integrated Large Language Models Add new key definitions for KEY_ACTION_ON_SELECTION, KEY_CONTEXTUAL_INSERT and KEY_CONTEXTUAL_QUERY Signed-off-by: Akshai Murari <akshaim@google.com> Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com> |
||
|
Linus Torvalds
|
f087b0bad4 |
Miscellaneous futex fixes:
- Tighten up the sys_futex_requeue() ABI a bit, to disallow
dissimilar futex flags and potential UaF access. (Peter Zijlstra)
- Fix UaF between futex_key_to_node_opt() and vma_replace_policy()
(Hao-Yu Yang)
- Clear stale exiting pointer in futex_lock_pi() retry path,
which bug triggered a warning (and potential misbehavior)
in stress-testing. (Davidlohr Bueso)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmnItYsRHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1h0Ow/+O4JG+XMdmTn2OLZQBFVqlt40RG+UAudW
tLyop+xovbLXk0FbZZen233yrYLnD8Qea9+LSIi1KPOKdklT4fimgDrVhSdZVMcY
mPJxkZ1NTRDpl3qpjgaT3yXslgpQQlzDLjAkyyC6SWQh7RHlZ9JB4UICei9sOeE8
WgwBrCfDMJXgjG5sAvkIhQFJaNEb/5HBHJu2Nxldlkl0of+le1e0mGUdY7H0ntxx
kJ4jCsrpCw+tzhZw7RmGe8ouEDkbt2f7EBT10pjZ1cEP22Rogn1AzgdD7pkbhcU3
WxbBGjSfm3ziPADELf0IhVYE/s+UXKTK9LfKDt4Q5W7paTV+o4Fllr+sraBmOoxp
Ova5RZzSdq5NCGAcmFJWg/rxEyZf+uC7GjwPx/80huzgJvBthdjOagdVKm/3BNv8
4d4H9KX67zWXE/XQHMt3g/7KYlVD9tzcp+v+h/rs8fiwkCkElwbljLISEr1StyOv
CDaCouu6FQE8MoVTNPPbH1DfEyIgNKHdXfkQbt/OkGVB9/dX71zFmxEXRCYAGMb1
wZXJ0j/oZZYcapmcb/xk5YjcZEfEU9QnMHHtCdR+dDL56xbsT5cDIzrb09LF6H/9
WiMxhx2V3RNBNUwbOKGX6vdqa2kXG+Pjp6sq9Af7VB9oy+nbWpfcVFqWbWwKAP1N
7e/EmnoxPTs=
=85AU
-----END PGP SIGNATURE-----
Merge tag 'locking-urgent-2026-03-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull futex fixes from Ingo Molnar:
- Tighten up the sys_futex_requeue() ABI a bit, to disallow dissimilar
futex flags and potential UaF access (Peter Zijlstra)
- Fix UaF between futex_key_to_node_opt() and vma_replace_policy()
(Hao-Yu Yang)
- Clear stale exiting pointer in futex_lock_pi() retry path, which
triggered a warning (and potential misbehavior) in stress-testing
(Davidlohr Bueso)
* tag 'locking-urgent-2026-03-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
futex: Clear stale exiting pointer in futex_lock_pi() retry path
futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()
futex: Require sys_futex_requeue() to have identical flags
|
||
Greg Kroah-Hartman
|
37276dd6b6 |
IIO: 2nd set of fixes for the 7.0 cycle
Usual mixed bag of fixes for recent code and much older issues that have surfaced. Biggest group are continued resolution of IRQF_ONE_SHOT being used incorrectly (which now triggers a warning) adi,ad4062 - Replace IRQF_ONESHOT (as no threaded handler) with IRQF_NO_THREAD as the caller makes use of iio_trigger_poll() which cannot run from a thread. adi,ade9000 - Move mutex_init() earlier to ensure it is available if spurious IRQ occurs. adi,adis16550 - Fix swapped gyro and accel filter functions. adi,adxl3380 - Fix some bit manipulation that was always resulting in 0. - Fix incorrect register map for calibbias on the active power channel. - Fix returning IRQF_HANDLED from a function that should return 0 or -ERRNO. aspeed,adc - Clear a reference voltage bit that might be set prior to driver load. bosch,bno055 - Off by one channel buffer sizing. Benine due to padding prior to the subsequent timestamp. hid-sensors - A more complex fix to IRQF_ONESHOT warning as this driver had a trigger that was never actually used but the ABI that exposed had to be maintained to avoid regressions. hid-sensors-rotation - An obscure buffer alignment case that applies to quaternions only was recently broken resulting in writes beyond the end of the channel buffer. Add a new core macro and apply it in this driver to make it very clear what was going on. honeywell,abp2030pa - Remove meaningless IRQF_ONESHOT from a non threaded IRQ handler. Warning fix only. invense,mpu3050 - Fix token passed to free_irq() to match the one used at setup. - Fix an irq resource leak in error path. - Reorder probe so that userspace interfaces are exposed only after everything else has finished. - Reorder remove slightly to cleanup the buffer only after irq removed ensuring reverse of probe sequence. microchip,mcp47feb02 - Fix use of mutex before it was initialized by not performing unnecessary lock that was early enough in probe that all code was serial. st,lsm6dsx - Ensure that FIFO ODR is only controllable for accel and gyro channels avoiding incorrect register accesses. - Restrict separation of buffer sampling from main sampling rate to accelerometer. It is only useful for running event detection faster than the fifo and the only events are on the accelerometer. ti,ads1018 - Fix overflow of u8 which wasn't big enough to store max data rate value. ti,ads1119: - Fix unbalanced pm in an error path. - IRQF_ONESHOT (as no threaded handler) replaced with IRQF_NO_THREAD (needed for iio_trigger_poll()). - Ensure complete reinitialized before reuse. Previously it would have completed immediate after the first time. ti,ads7950 - Fix return value of gpio_get() to be 0 or 1. - Avoid accidental overwrite of state resulting in gpio_get() only returning 0 or -ERRNO but never 1. -----BEGIN PGP SIGNATURE----- iQJFBAABCgAvFiEEbilms4eEBlKRJoGxVIU0mcT0FogFAmm1PpURHGppYzIzQGtl cm5lbC5vcmcACgkQVIU0mcT0FojACQ/8CkIpTOWqybGXUSiuv/MWkyaTrlh7wfAg esL4Wf1kfbtfnZ30uh8k8oLF3b40k1AjjjqtKVkc0Bu3SuOG9+KsSlgztbBxkBs4 WWhBBW1ZFEOn6Yldu0zjF99CrnsK03uYbFruMUTh2H/dV47UX4e48ZoVmP5BZsjt zdwIvSf+GYZCP0LcYMeLJECknVEBMK7tpa1OMffVsyWcmt7b3FpTk25q4jrhvM6Z PaZLVkBBFxKdYDBBr2eIboS8+Lo55I1s6/FghY9MnlDFM41lPKlBT+GH0bUT2ion LIOjIyUVlN6+mZHCTB2TPUR0ywibG/IsjoSR8zYkJMQ1FBW6zUAItMyCofbQHL2e NrmviAUcSReEhvGjnOK4+OZlSGQbLMu8eoYFU857x0QVg7hcNzrVviIVZie1WlQS 8Hd3Lm3sXaDC6oN1ULxDmXriOvaPDFxUqzn8AhlvAiOXNqnbBWFmdGosQ3q5rklW vjpZh/1YRJ1wActcGJoMCTfbfOuyCc7Xt4E8fqk3tNfJlXHEY0DYc5agjjdrGhzA mVtfm3Ab8glz/vcq72SUVcxL/qVqvZHjEVho701bySIMj+aZwQGwM8KnG/5QaazQ euBr5hcfc12JtbrjN3Jpn6Wog7pF+Xzqza7mUnkUYrNQ3s0mGewRgBr2EzeXvnot KWiLytre94M= =JTTZ -----END PGP SIGNATURE----- Merge tag 'iio-fixes-for-7.0b' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-linux Jonathan writes: IIO: 2nd set of fixes for the 7.0 cycle Usual mixed bag of fixes for recent code and much older issues that have surfaced. Biggest group are continued resolution of IRQF_ONE_SHOT being used incorrectly (which now triggers a warning) adi,ad4062 - Replace IRQF_ONESHOT (as no threaded handler) with IRQF_NO_THREAD as the caller makes use of iio_trigger_poll() which cannot run from a thread. adi,ade9000 - Move mutex_init() earlier to ensure it is available if spurious IRQ occurs. adi,adis16550 - Fix swapped gyro and accel filter functions. adi,adxl3380 - Fix some bit manipulation that was always resulting in 0. - Fix incorrect register map for calibbias on the active power channel. - Fix returning IRQF_HANDLED from a function that should return 0 or -ERRNO. aspeed,adc - Clear a reference voltage bit that might be set prior to driver load. bosch,bno055 - Off by one channel buffer sizing. Benine due to padding prior to the subsequent timestamp. hid-sensors - A more complex fix to IRQF_ONESHOT warning as this driver had a trigger that was never actually used but the ABI that exposed had to be maintained to avoid regressions. hid-sensors-rotation - An obscure buffer alignment case that applies to quaternions only was recently broken resulting in writes beyond the end of the channel buffer. Add a new core macro and apply it in this driver to make it very clear what was going on. honeywell,abp2030pa - Remove meaningless IRQF_ONESHOT from a non threaded IRQ handler. Warning fix only. invense,mpu3050 - Fix token passed to free_irq() to match the one used at setup. - Fix an irq resource leak in error path. - Reorder probe so that userspace interfaces are exposed only after everything else has finished. - Reorder remove slightly to cleanup the buffer only after irq removed ensuring reverse of probe sequence. microchip,mcp47feb02 - Fix use of mutex before it was initialized by not performing unnecessary lock that was early enough in probe that all code was serial. st,lsm6dsx - Ensure that FIFO ODR is only controllable for accel and gyro channels avoiding incorrect register accesses. - Restrict separation of buffer sampling from main sampling rate to accelerometer. It is only useful for running event detection faster than the fifo and the only events are on the accelerometer. ti,ads1018 - Fix overflow of u8 which wasn't big enough to store max data rate value. ti,ads1119: - Fix unbalanced pm in an error path. - IRQF_ONESHOT (as no threaded handler) replaced with IRQF_NO_THREAD (needed for iio_trigger_poll()). - Ensure complete reinitialized before reuse. Previously it would have completed immediate after the first time. ti,ads7950 - Fix return value of gpio_get() to be 0 or 1. - Avoid accidental overwrite of state resulting in gpio_get() only returning 0 or -ERRNO but never 1. * tag 'iio-fixes-for-7.0b' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (25 commits) iio: imu: adis16550: fix swapped gyro/accel filter functions iio: adc: aspeed: clear reference voltage bits before configuring vref iio: adc: ti-ads1119: Reinit completion before wait_for_completion_timeout() iio: adc: ti-ads1018: fix type overflow for data rate iio: adc: ti-ads7950: do not clobber gpio state in ti_ads7950_get() iio: adc: ti-ads7950: normalize return value of gpio_get iio: orientation: hid-sensor-rotation: fix quaternion alignment iio: add IIO_DECLARE_QUATERNION() macro iio: adc: ti-ads1119: Replace IRQF_ONESHOT with IRQF_NO_THREAD iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one iio: hid-sensors: Use software trigger iio: adc: ad4062: Replace IRQF_ONESHOT with IRQF_NO_THREAD iio: gyro: mpu3050: Fix out-of-sequence free_irq() iio: gyro: mpu3050: Move iio_device_register() to correct location iio: gyro: mpu3050: Fix irq resource leak iio: gyro: mpu3050: Fix incorrect free_irq() variable iio: imu: st_lsm6dsx: Set buffer sampling frequency for accelerometer only iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only iio: dac: mcp47feb02: Fix mutex used before initialization iio: adc: ade9000: fix wrong return type in streaming push ... |
||
|
Linus Torvalds
|
b51ad67773 |
for-7.0-rc5-tag
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE8rQSAMVO+zA4DBdWxWXV+ddtWDsFAmnIO1oACgkQxWXV+ddt
WDuLDQ//eWEAvqyA7ch+aLNm0QVHqsdH3NdVFjqw/3NsZfC9A3txTpQmmWpfqIUl
Yqb3AVIdRqwdytinn3xX17SxkJxzCWExcQ8LckoiJ2ODhLoi/vWGnaK8sUBzUDsm
2etvLGbDmhEEpkTMtIFkbY8fhprqthGCQgRHNrn/cZ+AzwohaboinvACysQJSLlH
Nqv0YxnAxsaGIaGD7wigjZ7a2BDoSZ/Q82+RvacrOkyqEThSOqzLmfl++fmHfxQo
UDzVOt9RSUnZ5LU4MYjF3H5otLczqKqRuoQC66ulIkvCml07jaKxfUVJyjkQ3dzZ
//UiylTXnC6XK/x1ayRrM73dKkXoN9mBmvH4b2FnOQJ3D3oyiCuytEF8s4nCrE+P
Zml+OTvIvWMj7Xy2U7cTMWuQGeggZ1m4nxCRScZBEnububUzt13izODwE7C8Cx1y
5FvfFIkiyeBrI03bWUO48H38lwWsfIKj6KnEk1SUeZIARClnZfM4NGZ7MbxjcntG
SunXzuQAywOZCkpskUDWMASLSH6CEGG4zgHPmbzw1NSCE5ZCHFZYXG7znv4w3CTW
TTeowG9r9cgdVBnMUTIToNWuD0jSMLmUfEPWvcwZF9ptfXdoABsPEQZTrKTLeiq7
TVdunKWzU12ZLr2sl4iku8U4H4aNQFoAwV3XqKnG8VXmzN41+Zw=
=I6JH
-----END PGP SIGNATURE-----
Merge tag 'for-7.0-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux
Pull btrfs fixes from David Sterba:
"A few more fixes. There's one that stands out in size as it fixes an
edge case in fsync.
- fix issue on fsync where file with zero size appears as a non-zero
after log replay
- in zlib compression, handle a crash when data alignment causes
folio reference issues
- fix possible crash with enabled tracepoints on a overlayfs mount
- handle device stats update error
- on zoned filesystems, fix kobject leak on sub-block groups
- fix super block offset in an error message in validation"
* tag 'for-7.0-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
btrfs: fix lost error when running device stats on multiple devices fs
btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file()
btrfs: zlib: handle page aligned compressed size correctly
btrfs: fix leak of kobject name for sub-group space_info
btrfs: fix zero size inode with non-zero size after log replay
btrfs: fix super block offset in error message in btrfs_validate_super()
|
||
|
Linus Torvalds
|
0bcb517f0a |
10 hotfixes. 8 are cc:stable. 9 are for MM.
There's a 3-patch series of DAMON fixes from Josh Law and SeongJae Park. The rest are singletons - please see the changelogs for details. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCacgT5AAKCRDdBJ7gKXxA jgYVAQDLam92lD7fD0IwdOFE36zlOcJNK4WjHSEf2y9fFFnUWQD/QPnVX+q7fR5t ZE8ZKhVkMa2w6A2VISdt9Msqm++5RQg= =oCV1 -----END PGP SIGNATURE----- Merge tag 'mm-hotfixes-stable-2026-03-28-10-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "10 hotfixes. 8 are cc:stable. 9 are for MM. There's a 3-patch series of DAMON fixes from Josh Law and SeongJae Park. The rest are singletons - please see the changelogs for details" * tag 'mm-hotfixes-stable-2026-03-28-10-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm/mseal: update VMA end correctly on merge bug: avoid format attribute warning for clang as well mm/pagewalk: fix race between concurrent split and refault mm/memory: fix PMD/PUD checks in follow_pfnmap_start() mm/damon/sysfs: check contexts->nr in repeat_call_fn mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] mm/damon/sysfs: fix param_ctx leak on damon_sysfs_new_test_ctx() failure mm/swap: fix swap cache memcg accounting MAINTAINERS, mailmap: update email address for Harry Yoo mm/huge_memory: fix folio isn't locked in softleaf_to_folio() |
||
Jinjiang Tu
|
4c5e7f0fcd |
mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
On arm64 server, we found folio that get from migration entry isn't locked
in softleaf_to_folio(). This issue triggers when mTHP splitting and
zap_nonpresent_ptes() races, and the root cause is lack of memory barrier
in softleaf_to_folio(). The race is as follows:
CPU0 CPU1
deferred_split_scan() zap_nonpresent_ptes()
lock folio
split_folio()
unmap_folio()
change ptes to migration entries
__split_folio_to_order() softleaf_to_folio()
set flags(including PG_locked) for tail pages folio = pfn_folio(softleaf_to_pfn(entry))
smp_wmb() VM_WARN_ON_ONCE(!folio_test_locked(folio))
prep_compound_page() for tail pages
In __split_folio_to_order(), smp_wmb() guarantees page flags of tail pages
are visible before the tail page becomes non-compound. smp_wmb() should
be paired with smp_rmb() in softleaf_to_folio(), which is missed. As a
result, if zap_nonpresent_ptes() accesses migration entry that stores tail
pfn, softleaf_to_folio() may see the updated compound_head of tail page
before page->flags.
This issue will trigger VM_WARN_ON_ONCE() in pfn_swap_entry_folio()
because of the race between folio split and zap_nonpresent_ptes()
leading to a folio incorrectly undergoing modification without a folio
lock being held.
This is a BUG_ON() before commit
|
||
|
Linus Torvalds
|
335c9017e3 |
spi: Fixes for v7.0
There are two core fixes here. One is from Johan dealing with an issue introduced by a devm_ API usage update causing things to be freed earlier than they had earlier when we fail to register a device, another from Danilo avoids unlocked acccess to data by converting to use a driver core API. We also have a few relatively minor driver specific fixes. -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmnG0MUACgkQJNaLcl1U h9BsrAf9H6Wj8EU/xkrHXl+trqY46+Fniloxp9Ar2aezYZXotnFL25JmAxyk5oYK HMHV677Xo+rcp9z77yr3vGyYFhiccioGm4t5kblIZxfwvxcuWj2r2d2KGF0jCBna qr3IfEowlgFW6BDfL72tZbuLrjkfmIAA2IMXOlZdHGz/QswNnOjPbbDRsyKn19xF a/CgVRyyAdAJxlv+p8/o7GbAMqJGStZ/w6Thk0GbLHASQE8Po1pTARGh7UbrJLVS hGEOM828PG8dctDbtE5Cg1mUm4rKIvtDlcZNLArSwPGfLcWei9AK++wfDck/ANho eRu8Zyr7yew00w+HLEssvyiSgS0HrA== =/ogD -----END PGP SIGNATURE----- Merge tag 'spi-fix-v7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "There are two core fixes here. One is from Johan dealing with an issue introduced by a devm_ API usage update causing things to be freed earlier than they had earlier when we fail to register a device, another from Danilo avoids unlocked acccess to data by converting to use a driver core API. We also have a few relatively minor driver specific fixes" * tag 'spi-fix-v7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: spi-fsl-lpspi: fix teardown order issue (UAF) spi: fix use-after-free on managed registration failure spi: use generic driver_override infrastructure spi: meson-spicc: Fix double-put in remove path spi: sn-f-ospi: Use devm_mutex_init() to simplify code spi: sn-f-ospi: Fix resource leak in f_ospi_probe() |
||
|
Linus Torvalds
|
83ce1c753f |
sound fixes for 7.0-rc6
This became a slightly big PR partly due to my time off in the last
week. But all changes are about device-specific fixes, so it should
be safely applicable.
* ASoC:
- Fix double free in sma1307
- Fix uninitialized variables in simple-card-utils/imx-card
- Address clock leaks and error propagation in ADAU1372
- Add DMI quirks and ACP/SDW support for ASUS
- Fix Intel CATPT DMA mask
- Fix SOF topology parsing
- Fix DT bindings for RK3576 SPDIF, STM32 SAI and WCD934x
* HD-audio:
- Quirks for Lenovo, ASUS, and various HP models, as well as speaker
pop fix on Star Labs StarFighter.
- Revert MSI X870E Tomahawk denylist again.
* USB-Audio:
- Fix distorted audio on Focusrite Scarlett 2i2/2i4 1st Gen
- Add iface reset quirk for AB17X
- Update Qualcomm USB audio Kconfig dependencies and license
* Misc:
- Fix minor compile warnings for firewire and asihpi drivers
-----BEGIN PGP SIGNATURE-----
iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmnGWu8OHHRpd2FpQHN1
c2UuZGUACgkQLtJE4w1nLE8Ngw//bx14FvGyRaEaUAmN0Q5KrJXx6qQNukzwgz8P
+ShG9fDFDXThybOxVcaO0US2mEadMXrcI1A7gfqAIuTTP/WAs5gj4WqzerlMA/Ea
PRLgF22cevb7AaEbECtho23QP1+Zn4Z6p77qAc7/4gPr/B4WZDrTXYVva+Uhiovv
QO6vAzqeTgaOJOlGHTSVKbYxWfbG8xQHrBARcHj0TbBhHNkw4jYAy7ZBGBcB/SG7
QgdmOTkRHNdP6XMKv0gL+XuN1dmZtKBCgzGULaJR28LylgB5dRSaTE3xQ+kuIsLm
tBoaL1hYtYzSHy0jubJ3OhW7CdCXcm+m9i52a7mlpZScQJpj70eCX9wbTcZdePS1
LiKnMSGfNPkpYOR1kGC78ab+W1nO21K0HAH8KGrzB8Ok1nvM3gw2MziQAQFOz0d1
hNtSIeAehnjVoRFpTAN5n5pJExoV/ok5OiwrEnlvK7JJvA/d0tTZAllB7y8gYdCX
PEMjatbFCi6fOxGAmQI7k/0Sogj+iRcKqWjk5J/x712e6jT9Wl+eLWmZNsob4i5F
zhCO0P4PSUAqjMg0p2iSzF5fKB9m9LPG2P3mvM+Vpgokb8txwnerW9amaBfrWIzy
TqsYjMrN0xHlMJb50pjCIV9DyFHqFqyE8c8XknsIinzlfzB0n7voZgEp0Kkekxhc
32SflSY=
=Yks2
-----END PGP SIGNATURE-----
Merge tag 'sound-7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"This became slightly big partly due to my time off in the last week.
But all changes are about device-specific fixes, so it should be
safely applicable.
ASoC:
- Fix double free in sma1307
- Fix uninitialized variables in simple-card-utils/imx-card
- Address clock leaks and error propagation in ADAU1372
- Add DMI quirks and ACP/SDW support for ASUS
- Fix Intel CATPT DMA mask
- Fix SOF topology parsing
- Fix DT bindings for RK3576 SPDIF, STM32 SAI and WCD934x
HD-audio:
- Quirks for Lenovo, ASUS, and various HP models, as well as
a speaker pop fix on Star Labs StarFighter
- Revert MSI X870E Tomahawk denylist again
USB-Audio:
- Fix distorted audio on Focusrite Scarlett 2i2/2i4 1st Gen
- Add iface reset quirk for AB17X
- Update Qualcomm USB audio Kconfig dependencies and license
Misc:
- Fix minor compile warnings for firewire and asihpi drivers"
* tag 'sound-7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (35 commits)
Revert "ALSA: hda/intel: Add MSI X870E Tomahawk to denylist"
ALSA: usb-audio: Add iface reset and delay quirk for AB17X USB Audio
ALSA: hda/realtek: add HP Laptop 15-fd0xxx mute LED quirk
ALSA: usb-audio: Exclude Scarlett 2i4 1st Gen from SKIP_IFACE_SETUP
ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx
ALSA: hda/realtek - Fixed Speaker Mute LED for HP EliteBoard G1a platform
ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload
ASoC: adau1372: Fix clock leak on PLL lock failure
ASoC: adau1372: Fix unchecked clk_prepare_enable() return value
ASoC: SDCA: fix finding wrong entity
ASoC: SDCA: remove the max count of initialization table
ASoC: codecs: wcd934x: fix typo in dt parsing
ASoC: dt-bindings: stm32: Fix incorrect compatible string in stm32h7-sai match
ASoC: Intel: catpt: Fix the device initialization
ASoC: amd: acp: add ASUS HN7306EA quirk for legacy SDW machine
ASoC: SOF: topology: reject invalid vendor array size in token parser
ASoC: tas2781: Add null check for calibration data
ALSA: asihpi: avoid write overflow check warning
ASoC: fsl: imx-card: initialize playback_only and capture_only
ASoC: simple-card-utils: Check value of is_playback_only and is_capture_only
...
|
||
Jan Kara
|
fffca572f9 |
mpage: Provide variant of mpage_writepages() with own optional folio handler
Some filesystems need to treat some folios specially (for example for inodes with inline data). Doing the handling in their .writepages method in a race-free manner results in duplicating some of the writeback internals. So provide generalized version of mpage_writepages() that allows filesystem to provide a handler called for each folio which can handle the folio in a special way. Reviewed-by: Christoph Hellwig <hch@lst.de> Link: https://patch.msgid.link/20260326140635.15895-3-jack@suse.cz Signed-off-by: Jan Kara <jack@suse.cz> |
||
Jason Gunthorpe
|
90c5def10b |
iommu: Do not call drivers for empty gathers
An empty gather is coded with start=U64_MAX, end=0 and several drivers go on to convert that to a size with: end - start + 1 Which gives 2 for an empty gather. This then causes Weird Stuff to happen (for example an UBSAN splat in VT-d) that is hopefully harmless, but maybe not. Prevent drivers from being called right in iommu_iotlb_sync(). Auditing shows that AMD, Intel, Mediatek and RSIC-V drivers all do things on these empty gathers. Further, there are several callers that can trigger empty gathers, especially in unusual conditions. For example iommu_map_nosync() will call a 0 size unmap on some error paths. Also in VFIO, iommupt and other places. Cc: stable@vger.kernel.org Reported-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com> Closes: https://lore.kernel.org/r/11145826.aFP6jjVeTY@jkrzyszt-mobl2.ger.corp.intel.com Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com> Reviewed-by: Samiullah Khawaja <skhawaja@google.com> Reviewed-by: Robin Murphy <robin.murphy@arm.com> Reviewed-by: Vasant Hegde <vasant.hegde@amd.com> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> |
||
Qingfang Deng
|
57a04a13aa |
netdevsim: fix build if SKB_EXTENSIONS=n
__skb_ext_put() is not declared if SKB_EXTENSIONS is not enabled, which
causes a build error:
drivers/net/netdevsim/netdev.c: In function 'nsim_forward_skb':
drivers/net/netdevsim/netdev.c:114:25: error: implicit declaration of function '__skb_ext_put'; did you mean 'skb_ext_put'? [-Werror=implicit-function-declaration]
114 | __skb_ext_put(psp_ext);
| ^~~~~~~~~~~~~
| skb_ext_put
cc1: some warnings being treated as errors
Add a stub to fix the build.
Fixes:
|
||
Sabrina Dubroca
|
629ec78ef8 |
mpls: add seqcount to protect the platform_label{,s} pair
The RCU-protected codepaths (mpls_forward, mpls_dump_routes) can have an inconsistent view of platform_labels vs platform_label in case of a concurrent resize (resize_platform_label_table, under platform_mutex). This can lead to OOB accesses. This patch adds a seqcount, so that we get a consistent snapshot. Note that mpls_label_ok is also susceptible to this, so the check against RTA_DST in rtm_to_route_config, done outside platform_mutex, is not sufficient. This value gets passed to mpls_label_ok once more in both mpls_route_add and mpls_route_del, so there is no issue, but that additional check must not be removed. Reported-by: Yuan Tan <tanyuan98@outlook.com> Reported-by: Yifan Wu <yifanwucs@gmail.com> Reported-by: Juefei Pu <tomapufckgml@gmail.com> Reported-by: Xin Liu <bird@lzu.edu.cn> Fixes: |
||
|
Linus Torvalds
|
453a4a5f97 |
Including fixes from Bluetooth, CAN, IPsec and Netfilter.
Notably, this includes the fix for the Bluetooth regression that you
were notified about. I'm not aware of any other pending regressions.
Current release - regressions:
- bluetooth:
- fix stack-out-of-bounds read in l2cap_ecred_conn_req
- fix regressions caused by reusing ident
- netfilter: revisit array resize logic
- eth: ice: set max queues in alloc_etherdev_mqs()
Previous releases - regressions:
- core: correctly handle tunneled traffic on IPV6_CSUM GSO fallback
- bluetooth:
- fix dangling pointer on mgmt_add_adv_patterns_monitor_complete
- fix deadlock in l2cap_conn_del()
- sched: codel: fix stale state for empty flows in fq_codel
- ipv6: remove permanent routes from tb6_gc_hlist when all exceptions expire.
- xfrm: fix skb_put() panic on non-linear skb during reassembly
- openvswitch:
- avoid releasing netdev before teardown completes
- validate MPLS set/set_masked payload length
- eth: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()
Previous releases - always broken:
- bluetooth: fix null-ptr-deref on l2cap_sock_ready_cb
- udp: fix wildcard bind conflict check when using hash2
- netfilter: fix use of uninitialized rtp_addr in process_sdp
- tls: Purge async_hold in tls_decrypt_async_wait()
- xfrm:
- prevent policy_hthresh.work from racing with netns teardown
- fix skb leak with espintcp and async crypto
- smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer
- can:
- add missing error handling to call can_ctrlmode_changelink()
- fix OOB heap access in cgw_csum_crc8_rel()
- eth: mana: fix use-after-free in add_adev() error path
- eth: virtio-net: fix for VIRTIO_NET_F_GUEST_HDRLEN
- eth: bcmasp: fix double free of WoL irq
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-----BEGIN PGP SIGNATURE-----
iQJGBAABCgAwFiEEg1AjqC77wbdLX2LbKSR5jcyPE6QFAmnFXoESHHBhYmVuaUBy
ZWRoYXQuY29tAAoJECkkeY3MjxOkHIsP+QGWo2TdNS6FENMC4TL0HYR/pTf6Kwil
rxxvt3CSpqfEkdwtRlgXqJycaLydl6YiNlIgnd1QtNYUTa6SHziuhUevSmK3nJTa
QkuqXnIbWFDD6nWID/P0CrBTQsZB+Vv4OhVFTbMkkvjX4X73PIbtvoNcWaZd+6rz
1BANq4dS5AjBieY824ovGlgqCxRyTr1g71RjSQy89RVgxabCwrKokLFFeqo8VObm
gemyra4wmAt43mxcTWbq/ZgTPfKpHoUSFBF8/c93zad7UKNTP9UqzydrRDSvoqZL
ZLIYxZ2jGwXCKQjs2pOEmBk2KWfrfnVxFPXizjqpPEagUQEV0NK2hSQswj1sOQnB
Ee4eL1MgXD6oUQI3qXK6XNAC4rOyDCYjVK3AeRs4hgwEkJCQp4iR+OcGO9lhU+/3
kNAUG3x0ySW0l2UNmpqnfAAu0+LR2FIdvfpoa9lTKjm6A+kKPMIrlQM4Wq1vwWoN
f6NV0Br0fQ4FclDh+KyvpZFHrEWCWlfB8sIV5JhQNHnVviP2Rarbw9VBiWvjDxky
Xn9Mac6mCswHx9GxrC3nPfNBtoNTQ9JvY0Cms/FtrERHaEvIhYxsUpXJs0fxK5mg
LACTkRzfQkXun9i1B+DYM26M6Yq4lm5TN9a1Mj2G3Df2EECriIgwdl6RI+J2bPJU
D8RbdAX5qiWu
=kySL
-----END PGP SIGNATURE-----
Merge tag 'net-7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Paolo Abeni:
"Including fixes from Bluetooth, CAN, IPsec and Netfilter.
Notably, this includes the fix for the Bluetooth regression that you
were notified about. I'm not aware of any other pending regressions.
Current release - regressions:
- bluetooth:
- fix stack-out-of-bounds read in l2cap_ecred_conn_req
- fix regressions caused by reusing ident
- netfilter: revisit array resize logic
- eth: ice: set max queues in alloc_etherdev_mqs()
Previous releases - regressions:
- core: correctly handle tunneled traffic on IPV6_CSUM GSO fallback
- bluetooth:
- fix dangling pointer on mgmt_add_adv_patterns_monitor_complete
- fix deadlock in l2cap_conn_del()
- sched: codel: fix stale state for empty flows in fq_codel
- ipv6: remove permanent routes from tb6_gc_hlist when all exceptions expire.
- xfrm: fix skb_put() panic on non-linear skb during reassembly
- openvswitch:
- avoid releasing netdev before teardown completes
- validate MPLS set/set_masked payload length
- eth: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()
Previous releases - always broken:
- bluetooth: fix null-ptr-deref on l2cap_sock_ready_cb
- udp: fix wildcard bind conflict check when using hash2
- netfilter: fix use of uninitialized rtp_addr in process_sdp
- tls: Purge async_hold in tls_decrypt_async_wait()
- xfrm:
- prevent policy_hthresh.work from racing with netns teardown
- fix skb leak with espintcp and async crypto
- smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer
- can:
- add missing error handling to call can_ctrlmode_changelink()
- fix OOB heap access in cgw_csum_crc8_rel()
- eth:
- mana: fix use-after-free in add_adev() error path
- virtio-net: fix for VIRTIO_NET_F_GUEST_HDRLEN
- bcmasp: fix double free of WoL irq"
* tag 'net-7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (90 commits)
net: macb: use the current queue number for stats
netfilter: ctnetlink: use netlink policy range checks
netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp
netfilter: nf_conntrack_expect: skip expectations in other netns via proc
netfilter: nf_conntrack_expect: store netns and zone in expectation
netfilter: ctnetlink: ensure safe access to master conntrack
netfilter: nf_conntrack_expect: use expect->helper
netfilter: nf_conntrack_expect: honor expectation helper field
netfilter: nft_set_rbtree: revisit array resize logic
netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD
tls: Purge async_hold in tls_decrypt_async_wait()
selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug
netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry
Bluetooth: btusb: clamp SCO altsetting table indices
Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop
Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()
Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock
Bluetooth: L2CAP: Fix send LE flow credits in ACL link
net: mana: fix use-after-free in add_adev() error path
...
|
||
|
Linus Torvalds
|
dabb83ecf4 |
dma-mapping fixes for Linux 7.0
A set of fixes for DMA-mapping subsystem, which resolve false-positive warnings from KMSAN and DMA-API debug (Shigeru Yoshida and Leon Romanovsky) as well as a simple build fix (Miguel Ojeda). -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQSrngzkoBtlA8uaaJ+Jp1EFxbsSRAUCacP+awAKCRCJp1EFxbsS RB0IAP94SD5YWfKauuYfXw0uxuy0POZR7rNX93y1LMxuorU+9QEAucOy9wIfjxKC Sc6U+fR4cmmIUKKnj7DCiR/EW8cOuQU= =b7th -----END PGP SIGNATURE----- Merge tag 'dma-mapping-7.0-2026-03-25' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux Pull dma-mapping fixes from Marek Szyprowski: "A set of fixes for DMA-mapping subsystem, which resolve false- positive warnings from KMSAN and DMA-API debug (Shigeru Yoshida and Leon Romanovsky) as well as a simple build fix (Miguel Ojeda)" * tag 'dma-mapping-7.0-2026-03-25' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: dma-mapping: add missing `inline` for `dma_free_attrs` mm/hmm: Indicate that HMM requires DMA coherency RDMA/umem: Tell DMA mapping that UMEM requires coherency iommu/dma: add support for DMA_ATTR_REQUIRE_COHERENT attribute dma-direct: prevent SWIOTLB path when DMA_ATTR_REQUIRE_COHERENT is set dma-mapping: Introduce DMA require coherency attribute dma-mapping: Clarify valid conditions for CPU cache line overlap dma-mapping: handle DMA_ATTR_CPU_CACHE_CLEAN in trace output dma-debug: Allow multiple invocations of overlapping entries dma: swiotlb: add KMSAN annotations to swiotlb_bounce() |
||
Hao-Yu Yang
|
190a8c48ff |
futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()
During futex_key_to_node_opt() execution, vma->vm_policy is read under
speculative mmap lock and RCU. Concurrently, mbind() may call
vma_replace_policy() which frees the old mempolicy immediately via
kmem_cache_free().
This creates a race where __futex_key_to_node() dereferences a freed
mempolicy pointer, causing a use-after-free read of mpol->mode.
[ 151.412631] BUG: KASAN: slab-use-after-free in __futex_key_to_node (kernel/futex/core.c:349)
[ 151.414046] Read of size 2 at addr ffff888001c49634 by task e/87
[ 151.415969] Call Trace:
[ 151.416732] __asan_load2 (mm/kasan/generic.c:271)
[ 151.416777] __futex_key_to_node (kernel/futex/core.c:349)
[ 151.416822] get_futex_key (kernel/futex/core.c:374 kernel/futex/core.c:386 kernel/futex/core.c:593)
Fix by adding rcu to __mpol_put().
Fixes:
|
||
|
David Howells
|
0e764b9d46 |
netfs: Fix the handling of stream->front by removing it
The netfs_io_stream::front member is meant to point to the subrequest
currently being collected on a stream, but it isn't actually used this way
by direct write (which mostly ignores it). However, there's a tracepoint
which looks at it. Further, stream->front is actually redundant with
stream->subrequests.next.
Fix the potential problem in the direct code by just removing the member
and using stream->subrequests.next instead, thereby also simplifying the
code.
Fixes:
|
||
David Carlier
|
8f15b5071b |
netfilter: ctnetlink: use netlink policy range checks
Replace manual range and mask validations with netlink policy
annotations in ctnetlink code paths, so that the netlink core rejects
invalid values early and can generate extack errors.
- CTA_PROTOINFO_TCP_STATE: reject values > TCP_CONNTRACK_SYN_SENT2 at
policy level, removing the manual >= TCP_CONNTRACK_MAX check.
- CTA_PROTOINFO_TCP_WSCALE_ORIGINAL/REPLY: reject values > TCP_MAX_WSCALE
(14). The normal TCP option parsing path already clamps to this value,
but the ctnetlink path accepted 0-255, causing undefined behavior when
used as a u32 shift count.
- CTA_FILTER_ORIG_FLAGS/REPLY_FLAGS: use NLA_POLICY_MASK with
CTA_FILTER_F_ALL, removing the manual mask checks.
- CTA_EXPECT_FLAGS: use NLA_POLICY_MASK with NF_CT_EXPECT_MASK, adding
a new mask define grouping all valid expect flags.
Extracted from a broader nf-next patch by Florian Westphal, scoped to
ctnetlink for the fixes tree.
Fixes:
|
||
Pablo Neira Ayuso
|
02a3231b6d |
netfilter: nf_conntrack_expect: store netns and zone in expectation
__nf_ct_expect_find() and nf_ct_expect_find_get() are called under rcu_read_lock() but they dereference the master conntrack via exp->master. Since the expectation does not hold a reference on the master conntrack, this could be dying conntrack or different recycled conntrack than the real master due to SLAB_TYPESAFE_RCU. Store the netns, the master_tuple and the zone in struct nf_conntrack_expect as a safety measure. This patch is required by the follow up fix not to dump expectations that do not belong to this netns. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> |