mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-11-10 20:48:12 +00:00
248,318 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Linus Torvalds
|
156fa7417f |
x86 fixes:
- Reject the loading of a potentially problematic microcode version
on Intel Granite Rapids systems (Chang S. Bae)
- On FRED, reconstruct the proper #GP context for rejected INT
instructions, to fix a signal ABI regression (Matthew Schwartz)
- Add a test for this signal ABI regression the x86
self-test suite (Matthew Schwartz)
- Don't emit the new and not yet properly supported EGPR instructions
(%r16-%r31) on CONFIG_X86_NATIVE_CPU=y builds (Chang S. Bae)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmqvrhgRHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1inbQ/9G4Q0h9esQ945n0uYRYvVLuj2P8DvE3XN
9d5IJ5pIYdhJCvlv8yXyv1u3sq59QYNmUgpBMghHJonhqobtnchvBSiznoAMgi8L
yjRlcaFBPX9qjFQV1W9WJQuUHhW/12QFy9Bo9n1uXEv6pYspYVDwodCaS+rEvkTF
0wK3TjETv90TravGjFscYTt2VLAiy+cd/FxkUA0sBaMLjhFpUyAPHGJe/vcf8vT3
rEXkY8EeSjv5F6eKMTDVacrSZu2c9wco1bJIsSFEcxZGFzhDbuCOGiDCkwmB3uuD
ReKbEUC0KmF8qd4Ubf0dMGpbHT9LDu9Ggex619cHFOHMupPubP+yym7aCpm3v7Sb
gZe6eV6VrSREJ+oBVKsqMrWXsg1YDj6uJhC/5K3S78xBeRq64kKsmBbC93Zp20TC
QpSAxKIFqp8C+tfKzpBmcSbcipRUfATJxLjp94QaQDp467jjJCvpDJdc12mV7WR9
0gMtFjxUaIe8BGX7s2PuWPgZ8+CIH0hZQuttxUU4QWvM2RGU+QrDaMwTeAY7wme4
xomc0wpXQb5enrjmFu8betlD0xfjgt7k6eW0njezRpWSk3wyHDd5w/6Vfn8pA6Fx
AQV4UuszXzQmG+W2pdIjLhnjmsjEeWMpmwgzn0rkcqujWHeh8XOSvQIjULFrFtFv
srSbum6vEfk=
=MP1H
-----END PGP SIGNATURE-----
Merge tag 'x86-urgent-2026-09-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fixes from Ingo Molnar:
- Reject the loading of a potentially problematic microcode version
on Intel Granite Rapids systems (Chang S. Bae)
- On FRED, reconstruct the proper #GP context for rejected INT
instructions, to fix a signal ABI regression (Matthew Schwartz)
- Add a test for this signal ABI regression the x86
self-test suite (Matthew Schwartz)
- Don't emit the new and not yet properly supported EGPR instructions
(%r16-%r31) on CONFIG_X86_NATIVE_CPU=y builds (Chang S. Bae)
* tag 'x86-urgent-2026-09-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/build/64: Prevent native builds from generating EGPR use
selftests/x86: Check signal state for rejected software interrupts
x86/fred: Reconstruct the #GP context for rejected INT instructions
x86/microcode/intel: Reject problematic loading on Granite Rapids systems
|
||
|
Linus Torvalds
|
abb91eed94 |
Perf events fixes:
- Fix crash when probing CS CALL instructions (Jinke Han) - Fix NULL pointer crash during module unload (Vinay Belgaumkar) Signed-off-by: Ingo Molnar <mingo@kernel.org> -----BEGIN PGP SIGNATURE----- iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmqvqiURHG1pbmdvQGtl cm5lbC5vcmcACgkQEnMQ0APhK1hiohAAjcvOY7M998pX1tmo1Egw9kAuI0odtNOX weQ4Wq7K3X+tg+q1wVUmE/N/y/WLYWNatjwvjc8TClYdQEiaqBMH4TSLAuY3TOxa TxwdTC20uSN4EPZ0iRhKzm3biPzzzRq4M9hhV+WfGcK7ieXRn4Q7d9S3DDe5oEfG lI4l/RefIBiINVPC7dNM7xpS/7XBEPnzNeshOMwp6ZsPziZJizgC8C7RhQFAPszo Ho36KKFQqMNouCSybQl1GxLyPw+oGtneWESHXrF6Mhp+bcx40fMtJxKNyVLsVWuM wo0Ry843pCbDofOIqg7m0AufWUhz7B4MttTXXrU2/BYMHEbxlgms1AO7lnSGzPmn vP0JHZnT3y34P5uvGaVho7t9QKKbuY47cKNmsiiLuXiBQQuKnvDmDln1Mu1KS3fg a1LI8kv043iLqAjsIWMVtKlRGUX36f4NXUWrxvO/tmup3ocJhG1oYmEe/RaFddVX 5qRbHn7Z1w8jAWldODYSrXkpMRgMtClQuqHdjxZQt5DPZSORzoFxTvSfJLdUUtVx CUiT34zcLPHfvGD+ctHe5kVesgDHCxp/z1tKrJBunB+XZVl6rKHycfiGjaUXQRcR NUp6iFlfay8b79EkMsLC8p6uAmzX2q+gEwNVy8eevBSXdsYqcY5islj3ob7sBHsH vk4gDJikpE0= =onkS -----END PGP SIGNATURE----- Merge tag 'perf-urgent-2026-09-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf events fixes from Ingo Molnar: - Fix crash when probing CS CALL instructions (Jinke Han) - Fix NULL pointer crash during module unload (Vinay Belgaumkar) * tag 'perf-urgent-2026-09-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf: Fix null pointer access in is_include_guest_event() x86/kprobes: Fix crash when probing CS CALL instructions |
||
Chang S. Bae
|
63edf5a009 |
x86/build/64: Prevent native builds from generating EGPR use
Omar reports that CONFIG_X86_NATIVE_CPU=y allows builds to opportunistically emit instructions using %r16-%r31 (EGPRs) when the build host supports APX since the commit: |
||
|
Linus Torvalds
|
f259f446f5 |
soc: fixes for 7.3
The driver fixes are all for simple mistakes: a use-after-free bug on Samsung Exynos, error handling and reference counting on Arm SCMI firmware and a problem dealing with inconsistent firmware information. The rest are devicetree fixes for arm64 platforms from Altera, Renesas and Amlogic. On the Renesas platform, one patch addresses a boot time regression, the rest address minor performance and correctness issues. -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmqtProACgkQmmx57+YA GNku+BAAsyHGF7f7tniVyH1lDfZ+BY8G0i8856Pgi6xJfwTPcrtxJe15ALFJz5sa DRvCmt3fx2e4LmED2wEfTVYr+RIEmlgD27pT8lUvMo4avIcXlIxtAlqCOyKTOALS LzOJPD5VaEs/ZKXqqGDPnHzYJNO9DJ18uAuk8yGY7cK4z4IV+aANCJzCN83vhYu2 OAl37i/0PmaMhHTgLgIugd2uc28GJsyZQiFu9k9hlRWGjn9WpYivSohbF8p8Cqcw Eg/TzWVNcTrm95uuHbhaQ3tsYDtBHoy5V7e5w1a4NnJ7ufouW/I1Z9s2OrulWadY 3Hw/pEtrkWAgK1NMfAaXtErkWUjuKeMRzWwOZ0NR4Zi0Zsdt+VTyDajSLbUEuePI AfknmGcrgSIgK/HlSkLw5R0VnYI8duUjnBSDVTKBLMxFnAdBs/vDhr/ZDy8HgLjN i+Poe36q6JLTw88/d/uF+2T2HdZXwPiL9tDl16WmAUQOvZOcr6dfQdLZGIb8zwuV rghM9rnh7v2Lb5nFsC++MebH2xNw33faWplpnc0WxcUdzov20Wcr7IbdNVzKaVTn IcnjnTtCCaxXM9NxyjMrxJ8+tkkFAPyDczSPxcxL3xcOjoQ2nr4XlfPMaYwoV2N7 siwksezj55bWANuZwxObou3ZJgHHFqO0RYUdtJxDn/mBnWNOq3A= =Z5GP -----END PGP SIGNATURE----- Merge tag 'soc-fixes-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC fixes from Arnd Bergmann: "The driver fixes are all for simple mistakes: a use-after-free bug on Samsung Exynos, error handling and reference counting on Arm SCMI firmware and a problem dealing with inconsistent firmware information. The rest are devicetree fixes for arm64 platforms from Altera, Renesas and Amlogic. On the Renesas platform, one patch addresses a boot time regression, the rest address minor performance and correctness issues" * tag 'soc-fixes-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (21 commits) soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node arm64: dts: renesas: r8a779f0: Set UFS lane count firmware: arm_scmi: Fix typo "upto" in comment arm64: dts: renesas: r9a09g087: Switch GBETH TX queue scheduling to WRR arm64: dts: renesas: r9a09g077: Switch GBETH TX queue scheduling to WRR arm64: dts: renesas: r9a09g047: Switch GBETH TX queue scheduling to WRR arm64: dts: renesas: r9a09g056: Switch GBETH TX queue scheduling to WRR arm64: dts: renesas: r9a09g057: Switch GBETH TX queue scheduling to WRR firmware: arm_ffa: Tear down driver during shutdown clk: scpi: use PLATFORM_DEVID_NONE for scpi-cpufreq clk: scpi: register scpi-cpufreq once and clear on failure clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS firmware: arm_scpi: fix device_node leak in scpi_dev_domain_id arm64: dts: socfpga: change access permission from 755 to 644 ARM: socfpga: select the PL310 erratum 753970 workaround arm64: dts: amlogic: t7: fix the pin groups of the vsync PWM arm64: dts: amlogic: t7: khadas-vim4: add the PWM-driven supplies arm64: dts: amlogic: t7: fix the pin groups of two PWM outputs arm64: dts: amlogic: t7: khadas-vim4: allow the SD card to be power cycled ... |
||
|
Linus Torvalds
|
a077be4fde |
arm64 fixes for -rc4
- Fix hypercall arguments when resetting EL2 vectors during hibernation
- Fix hibernation with 52-bit capable kernels on machines without
52-bit addressing, similarly to the recent kexec fix
- Fix a bunch of clumsy codegen issues with our per-cpu accessors
- Fix MTE ptrace documentation to reflect the de-facto ABI behaviour
- Fix pthread_join() usage in MTE selftest
- Fix port selection in the Arm CMN PMU driver
-----BEGIN PGP SIGNATURE-----
iQFEBAABCgAuFiEEPxTL6PPUbjXGY88ct6xw3ITBYzQFAmqtMZ4QHHdpbGxAa2Vy
bmVsLm9yZwAKCRC3rHDchMFjNNujB/4pa4pdivXRMOH39HSDu+8i3KlREGpTA9dq
LJvwUjlgoIw0d8/b5sMSAxJi8RA29IENJPqrU97eBBLKgC2gq1oMwjOaHNTV8XUj
gal9hwuZcfO5NIJi61TkyLxn++ysVYXD3J0tbhSXbqz2oeg/jxwj9SsFfQux34GY
GeGb2cWvEXznLgN0h+vZiNh6+FsQRN+dizpiHKLh+wpbZ/vIzuVTQEo6w/+BEUWg
R4YQlvpj/2yAC0BBdPb9gALUWFbjea6zpX5gM5/PgLoqW0CIJvGXahZ7T5kDoXBT
Xp5zsKvcC8dxM5nCJIJ7xRPg75v97toYrrl2AoNQN9bgOynQAI5k
=j0NQ
-----END PGP SIGNATURE-----
Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
Pull arm64 fixes from Will Deacon:
"In this batch we've got a couple of hibernation fixes, a couple of
minor MTE fixes, some per-cpu codegen fixes (which were found as part
of Mark's series adding preemptible this_cpu_*() operations) and a fix
for the Arm CMN PMU driver.
Summary:
- Fix hypercall arguments when resetting EL2 vectors during
hibernation
- Fix hibernation with 52-bit capable kernels on machines without
52-bit addressing, similarly to the recent kexec fix
- Fix a bunch of clumsy codegen issues with our per-cpu accessors
- Fix MTE ptrace documentation to reflect the de-facto ABI behaviour
- Fix pthread_join() usage in MTE selftest
- Fix port selection in the Arm CMN PMU driver"
* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation
kselftest/arm64: Fix size of thread_data values for pthread_join()
arm64: percpu: Fix LSE operations on {8,16}-bit types
arm64: percpu: Fix this_cpu_and() mask generation
arm64: percpu: Fix this_cpu_write() casting
arm64: hibernate: clone only the linear map that exists at runtime
perf/arm-cmn: Fix wp_dev_sel2 setting for multi-DTM configurations
arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc
|
||
|
Linus Torvalds
|
5023f5b861 |
- Fix kconfig dependencies for ECONET
- Enable weak reordering for EYEQ - Include USB FDT fixup for Octeon even when USB is modular -----BEGIN PGP SIGNATURE----- iQJOBAABCAA4FiEEbt46xwy6kEcDOXoUeZbBVTGwZHAFAmqs5dUaHHRzYm9nZW5k QGFscGhhLmZyYW5rZW4uZGUACgkQeZbBVTGwZHBYbg//QPIXQOga1IcvP7OJlLxu UocYmNpgVJtPCksDtnBUx82o/D+CZdqeGtHNP6ak5YpyXOcQpUdMuYSwHwIXsHLB HhVOBmyVgyNlP0zo8zXE3iW1JMz1wfSSigDZdPFX8Jq3O5RsMq3udHJYZtAEXnIM eV8m465I9DnJWX9mlETqTli5cwL5VpDYRSy1fmGF4CYgRvbErrUZ0iZSvqdwRe7v J/p+sLBsSmEoxXL5etpvHLet+Jr9Eb8v+1k8262YcoPfvENeu3cYJpvZnIgXmeol T912xD+JmLapcICNot0QvrMZJ3RVSu/Z6ddxCGqHmiEiQGMYB9xrWYbgfQ/9hGKp aup5G1X3n3YPKd60DKRnSFgZ4+xPzEoUTh5nKlMz0XqZmtoa9m00BRTXhi8XoqFK kvBRJREb4Za3Ig40dhIJTcluLoLjgPqUs+1MfwnFnXZTbuctSZ4BtEauQL1x/A6E EbQ7gvesMQHUwW6fb70U9UbhlKuI/8t1Ao7OuI5+qs6+qnvgiScavW8CDu+W16s1 tbFQFUN1ZkP0a0SXkl5JGu6WOkl9fc3TkBDrmfuK68Fu2hUMAiE/ffCoBq+6iZBj pkagkDr5CjFxogpKveE02l9WJAVAujzMmyCusTv2NQ53mu2ZloCT3BA3cKsM6vFP dPtQD7d5qIEK3WPMENxCrcA= =PNfi -----END PGP SIGNATURE----- Merge tag 'mips-fixes_7.3_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS fixes from Thomas Bogendoerfer: - Fix kconfig dependencies for ECONET - Enable weak reordering for EYEQ - Include USB FDT fixup for Octeon even when USB is modular * tag 'mips-fixes_7.3_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: MIPS: Octeon: apply USB FDT fixups also when USB is modular mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ MIPS: config: Add EcoNet EN751221 defconfig mips: econet: fix unmet dependencies for ECONET |
||
Arnd Bergmann
|
2d5061ff37 |
Renesas fixes for v7.3 (take two)
- Fix UFS regression on R-Car S4. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQQ9qaHoIs/1I4cXmEiKwlD9ZEnxcAUCaqztfAAKCRCKwlD9ZEnx cLmlAP4hG63oxIP1QUeZpEMjRkTBGhFXnlSkvluVyrd8otWniQEAvCCC31KtKqqK B9W1mWzwBX9UITXB4cL69Zw/26W9+QI= =5xv9 -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmqtL8EACgkQmmx57+YA GNkQ9A/9FuSvFGANim6ksz5JN4ObTC4hjJu8rxrxF3uGekQNJZPO06EDU9DkM/bJ XOLDFkt3k+M3e60wdH9NKzEl54xQxyLre2XyRN2diit3ihDF9Jrv3YPFzuZcA+gR vmRh9LLIStdDNxGbRrEubfx1+WqbiNpkXqE8syXVsn93hYduMsWnrSReXA5jGENt Wjq9ghujL9Othgh8B1FOi6W4oupsBN1mCLAL0DJ0k8z0whBfb2Qkq5tnrDCPcjXc CVKzVWqe5nIMw5akMu14MToId3JpTxTrws5FOP4OUoxEVL/sCBUbS4PNujgHEMVh Ovd5DmpfNjWOB+rr4/B/u2H97e6AmNvCp5Sbd8gADBCO7RHD9zxYbGYPy9Pemhqd YBNAufAR3Bkkq0IheXVS5Dtzg2TSUchomaIz7o/hhMBu4lLdaVJyyalAy5bVOR1W l7DtetG1DqABWAsF5pm0Q8iy7lFEJlzWdhzONJn4TBCXOLi6k3lO07gmd+eIYhyM EvssZFTciDoyhurdDgqeLfjKQvvgiOi0l4SpdT606+YMipz5C5zo0oPOk4j26qvp 22Mw3JupFQCDCwsN37locBhQccdKfHuzfsy52vDMxHRuOcpnfIIcCsPkaMq5VMQu Bm8c3No5AJQGcODe4Rg7nmZrxzSNnilWGxKSkWH7C0J5vbzuXRY= =9HfJ -----END PGP SIGNATURE----- Merge tag 'renesas-fixes-for-v7.3-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into arm/fixes Renesas fixes for v7.3 (take two) - Fix UFS regression on R-Car S4. * tag 'renesas-fixes-for-v7.3-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: arm64: dts: renesas: r8a779f0: Set UFS lane count Signed-off-by: Arnd Bergmann <arnd@arndb.de> |
||
Matthew Schwartz
|
93f53499d0 |
x86/fred: Reconstruct the #GP context for rejected INT instructions
FRED event delivery does not use the IDT, so the gate DPL check that
rejects a user INT n falls to software (Intel FRED specification [1],
section 8.3). fred_intx() rejects the same vectors as IDT delivery, but
reports a zero error code and the IP after the INT. This breaks the
signal ABI. Wine uses the error code to recognize INT 0x2d, so the
changed context turns a handled breakpoint into an access violation in
Elden Ring.
Rewind IP using the instruction length in the augmented SS and
synthesize the IDT selector error code, (vector << 3) | 2. Set RF in the
saved flags, as the CPU does for a #GP fault. Section 5.2.1 defines the
saved vector, instruction length and RF state. The supplied length
handles prefixes without reading user memory. Limit the changes to
already-rejected software interrupts, preserving the accepted INT3, INT4
and enabled INT80 paths and hardware exceptions. With IA32 emulation
disabled, INT 0x80 now reports the same #GP as the DPL 0 gate IDT
installs there. The rewound IP also stops fixup_iopl_exception() from
inspecting the byte after the INT.
Also clear the software event flag. Section 6.2.3 specifies that ERETU
with this flag and TF set traps before executing any user instruction. A
tracer that suppresses SIGSEGV and resumes with TF set expects the next
instruction to run first, as after IRET. The sigreturn path clears the
same flag for this reason in prevent_single_step_upon_eretu().
[1] Intel Flexible Return and Event Delivery (FRED) Specification,
revision 9.0 (346446-009US), sections 5.2.1, 6.2.3 and 8.3.
Fixes:
|
||
|
Chang S. Bae
|
e7d3e2f46d |
x86/microcode/intel: Reject problematic loading on Granite Rapids systems
Microcode updates can usually jump revisions. However, there is an erratum on Granite Rapids systems. If they "jump over" revision 0x1000405, they result in an #MC. Avoid it. Signed-off-by: Chang S. Bae <chang.seok.bae@intel.com> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260916225939.1144524-1-chang.seok.bae@intel.com |
||
|
Linus Torvalds
|
4aec9ad1c6 |
dma-mapping fixes for Linux 7.3
A few fixes for the DMA-mapping code:
- resolved regression in accessing encrypted memory by IOMMU-backed
devices (Aneesh Kumar K.V),
- improved failure handling and removed rare bug in swiotlb/highmem
(Donggeun Yoo).
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQSrngzkoBtlA8uaaJ+Jp1EFxbsSRAUCaquwMwAKCRCJp1EFxbsS
RMT6AP0elpdaZXNY0KwUBTwU95H604J+donqriepHABIBhIDEQD9GWZqNf/m1gEI
tR5lHQ3+NGs0Q7Vd2ed1vSe82HQSsgU=
=QxUC
-----END PGP SIGNATURE-----
Merge tag 'dma-mapping-7.3-2026-09-17' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux
Pull dma-mapping fixes from Marek Szyprowski:
"A few fixes for the DMA-mapping code:
- resolved regression in accessing encrypted memory by IOMMU-backed
devices (Aneesh Kumar K.V)
- improved failure handling and removed rare bug in swiotlb/highmem
(Donggeun Yoo)"
* tag 'dma-mapping-7.3-2026-09-17' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux:
x86/mm: Don't force unencrypted DMA for IOMMU-backed devices
dma-mapping: don't trace the DMA address when the allocation fails
swiotlb: use the adjusted address for the highmem page lookup
dma-coherent: report a failed reserved memory assignment
|
||
Jinke Han
|
a5f7a5bb3b |
x86/kprobes: Fix crash when probing CS CALL instructions
When using eBPF to probe CS CALL instructions within a function,
a crash can be triggered.
The eBPF tool probes offset 257 of the __hrtimer_run_queues()
function:
<__hrtimer_run_queues+249>: nopl 0x0(%rax,%rax,1)
<__hrtimer_run_queues+254>: mov %r14,%rdi
<__hrtimer_run_queues+257>: cs call <__x86_indirect_thunk_r12>
<__hrtimer_run_queues+263>: mov %eax,%r12d
<__hrtimer_run_queues+266>: xchg %ax,%ax
<__hrtimer_run_queues+268>: mov %r13,%rdi
Which triggers this crash:
BUG: unable to handle page fault for address: 00000000000f41c9
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 0 P4D 0
Oops: 0002 [#1] SMP NOPTI
CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: P
RIP: 0010:__hrtimer_run_queues+0x106/0x230
Note that __hrtimer_run_queues+0x106 is __hrtimer_run_queues+262, which is
at the 6th byte of the above CS CALL instruction. Since the CS CALL
instruction occupies 6 bytes, the exception occurred in the middle of that
call instruction.
The root cause is that when using eBPF tools to probe in the middle of a
function, a kprobe with INT3 is used as the underlying implementation.
During single-step emulation of the original CALL instruction,
int3_emulate_call() assumes that the probed CALL instruction is 5 bytes
long. However, the actual CS-prefixed CALL instruction occupies 6 bytes,
so it constructs an incorrect exception return address. When the CPU
returns from the kprobe handler, the next instruction to be executed is at
the address of the last byte of that CS CALL instruction. Coincidentally,
starting from that address, the CPU fetches and decodes a completely
different instruction, which ultimately triggers a kernel crash.
Fix the issue by using the actual instruction length obtained from
the instruction decoder when constructing the exception return
address, rather than relying on the hardcoded CALL_INSN_SIZE macro.
[ mingo: Refined the changelog ]
Fixes:
|
||
|
Linus Torvalds
|
238650ef6c |
powerpc fixes for 7.3 #4
- PPC/KVM - fix use-after-free in kvmhv_emulate_tlbie_all_lpid()
- PPC/KVM - fix secure device page leak on uv_page_in() failure
- powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba
Thanks to: Amit Machhiwal, Gautam Menghani, Ritesh Harjani (IBM), R Nageswara
Sastry, Shivaprasad G Bhat
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEqX2DNAOgU8sBX3pRpnEsdPSHZJQFAmqqUzQACgkQpnEsdPSH
ZJQMwQ//fJnux3DlGo3zXbwGpckd3LGj/WfA7RLtk9jQTk7DUzzjArGHpk5o/CGl
99e8udaGxCuQNHEqGJg6bSTNPBlkMoaxYpMkf2mL73l1XXJiKz3aZs1iRlTdQGfK
v6TysjjB2lYstvPskoT+imODAg6ebDMHQV8Kh67DIRCY2tJrZgxBYbESBiS1q9Qq
KDL3DXpDxdczTDltpypvoqdZTBNpM63wgUMVcaquYckPwM6gRy3VWJchx8FPuZCR
JcIfowPTYKDSKI0+IyFENfeXAgZOMLih0QVWY1yN+JFs3gXhQ5aFeWwLdNinW4Sw
tPCB6Nc9R/XZlgzHgIvBuLZONbmG7uhSe4907rOucfXQIU5klMRzasfRDsBwDWqy
P3EdMd053JmRs+upQLI1UoVuorYRE1ry2vCQr3xpP32tjTAX/qTsSPhQ0LxXWkUI
B6Yr2bXjxngWCJVpM9XN45L8oAHELeigQ14cIS1o8hp+8NHctlWVvE+Shd/L2ELE
Q5Lx/svwuwGcB6BI9xSwQUCcib+NH2soiScb2qv9PuZguP0W1nRIUJj37UqA379/
wlc/5GtCHcK8PxFwaf4YYUulg/1gjUXYAmEN8lguiiqT0n1qgrDws1WDjnd6F+xj
O3rAxH+hfxwOu4u/P7QXYgqlULUZHbdU7PqFnrpmzHlllaEIHpw=
=YcTl
-----END PGP SIGNATURE-----
Merge tag 'powerpc-7.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux
Pull powerpc fixes from Madhavan Srinivasan:
"KVM:
- fix use-after-free in kvmhv_emulate_tlbie_all_lpid()
- fix secure device page leak on uv_page_in() failure
iommu:
- Fix the overflow validation in iommu_tce_check_ioba
Thanks to Amit Machhiwal, Gautam Menghani, Ritesh Harjani (IBM), R
Nageswara Sastry, and Shivaprasad G Bhat"
* tag 'powerpc-7.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba
KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure
KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()
|
||
|
Arnd Bergmann
|
ce55a6545a |
Amlogic DT Fixes for v7.3:
- Set of fixes for Amlogic T7: - use the real UART pclk - allow the SD card to be power cycled by dropping regulator-always-on - fix the pin groups of two PWM outputs - add the CPU cores PWM-driven supplies to fix runtime crashes - fix the pin groups of the vsync PWM using non-existing pin group -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEPVPGJshWBf4d9CyLd9zb2sjISdEFAmqqangACgkQd9zb2sjI SdH/SRAAhEKoBMpJG8Ps7SKIx/l2tJQcCMhbyNXl6aCUrDFx+m7lQiM7obNNFMf8 nFerqNRlXlWrsyQE4HVBudv7umt5tl3xazo1jkma6jxjyWSaStba0R3/dNkEIynb ZsiQWtbbbFiGcKdKOnEqfdVbKtrTa+KfrmmSJ/L5jofhMdw19J0R0/nALfS6rDpl Rpdm2IuEH2gotD4TBEtg06gwXDX8JmlrVW+0RPc9rDKROFAMfrdnX3NHwXlRW2UG vmXaAPu0HHcjmUtxdPS9ULadUeEYmCMnnmLEXaA5P/O4Y4gCY7xsQjnrq74k3R42 woAZVmYUTxsm2hZ/b5Oh073MpisQfM257+FTOIWK74EBYKJz8xfpjxra84KmtvH7 Ya+Glr2PePa+rLlIjF1pDuxRVMaSyJVXXMnfuY3lQGRymqSZn+LU1d8QkvzF8gEf DMqy2ypdDt5rY4//iO2vCjD8qUAPT2DaHwprIZSspHijVcZh3nOZb/K2iOXq4dVP B0oq7uPqQKqlY27yBr4mvcbiCjSqHPugJoGnl1jrJkeOqprpqHZsdz+nFZEGpMfb gNc3BNGcOS7KtePXe2NRnGXxLT0I2mjd55X4zIpCWHnkEWdq/7A91d5NeebKJfjs 6Ekjyk7DhKM79Xb8CKpzxZjQFx100MSpuqGp2oMK9VFFZP60woM= =7sol -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmqqeAcACgkQmmx57+YA GNk9Lg//TiOyBr9jmffWvzW6HxWMnLrO8K1VfEFJw3meLneV6sxR4ltDiSTEA21u L5E9HTX4L2rEMPL9c7o7mxIJvCch06BjPUIzH8aNl8tFTa7pxp+TQxZP6Ly4mmtC fTWVZwcdbGo2OhExix/mnPKKV+RDz/ymUXqjKWqvup/DC26QRTZ3qI94dtKC/eQ0 zbEt+2wrNZY2ol3OJ6l1O6Y3B/3EJ0VcCVwwFsy+6L8DCQf8BcJLM8HKBPKmUciI VdEV9/EvqD5AovspiAgIQYuomqZRqQVIS/dRQ2Uq6JTPteQQ28yUKAoysr5WjnYq /5VpvrM2zrsXjnXQBYbiLpO7Bc4we8HrakMNo2FVKr8Ptp+bg8EnHcEJRjg0Ced9 cfwJPc4AXF3UF/LiwtugbJpm4FvuGoZaF2oNRqfilwPAhXHld3GZssopAflxYB2M C1WCDynmjiJHQ07DaIg5kVxhAeyIWbS9gJrJ3j/eiFWjxWxYhkQPMumnUrk3zaaa 0gFYcu2SP5Qr0SDFE3EqyK8tvcB21Mnah7nrIQarCCBlw5HCMN3v8kUCmGvjmh5E A6YSPfXJHAjyba0nsuoFToGpREUG5iGE12aBE5YfcRl/FpHEBbYma0Kn3JFojTU0 7J5W4+zsQrKHUWzbvViHU73TWQIQcrUK9963Hs591l57umViEVU= =p+Zk -----END PGP SIGNATURE----- Merge tag 'amlogic-fixes-v7.3-rc' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux into arm/fixes Amlogic DT Fixes for v7.3: - Set of fixes for Amlogic T7: - use the real UART pclk - allow the SD card to be power cycled by dropping regulator-always-on - fix the pin groups of two PWM outputs - add the CPU cores PWM-driven supplies to fix runtime crashes - fix the pin groups of the vsync PWM using non-existing pin group * tag 'amlogic-fixes-v7.3-rc' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux: arm64: dts: amlogic: t7: fix the pin groups of the vsync PWM arm64: dts: amlogic: t7: khadas-vim4: add the PWM-driven supplies arm64: dts: amlogic: t7: fix the pin groups of two PWM outputs arm64: dts: amlogic: t7: khadas-vim4: allow the SD card to be power cycled arm64: dts: amlogic: t7: use the real UART pclk Signed-off-by: Arnd Bergmann <arnd@arndb.de> |
||
Shivaprasad G Bhat
|
0b271f7d7f |
powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba
The commit |
||
Amit Machhiwal
|
0a416ee20b |
KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure
In kvmppc_svm_page_in(), if uv_page_in() fails after
kvmppc_uvmem_get_page() has succeeded, the secure device page is never
released. kvmppc_uvmem_get_page() sets a bit in kvmppc_uvmem_bitmap,
allocates a kvmppc_uvmem_page_pvt struct, marks the GFN as
KVMPPC_GFN_UVMEM_PFN, and calls zone_device_page_init() which sets
refcount=1 and locks the page. The subsequent goto out_finalize skips
the *mig.dst assignment, so migrate_vma_finalize() is a no-op for the
page, and none of those resources are ever reclaimed.
Each occurrence permanently consumes one entry from the firmware-bounded
secure memory pool (kvmppc_uvmem_bitmap), leaks pvt, and leaves the GFN
marked as secure — making it unusable for the lifetime of the VM.
The twin __kvmppc_svm_page_out() already handles the analogous uv_page_out()
failure correctly with unlock_page(dpage); __free_page(dpage). Apply
the same pattern here: unlock_page() followed by put_page(), which
chains through free_zone_device_folio() into kvmppc_uvmem_folio_free()
to clear the bitmap bit, free pvt, and reset the GFN state.
Reachable whenever uv_page_in() returns an error (e.g. UV pool
exhaustion) on any POWER9/10 + Ultravisor/PEF system.
Fixes:
|
||
|
Amit Machhiwal
|
51938dfa8a |
KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()
kvmhv_emulate_tlbie_all_lpid() iterates the nested-guest IDR and drops
mmu_lock before calling kvmhv_emulate_tlbie_lpid(), but does not hold a
reference on the kvm_nested_guest pointer obtained from the IDR. A
concurrent vCPU issuing a single-LPID tlbie (is=2, ric=2) can race
through kvmhv_flush_nested() -> kvmhv_remove_nested() -> idr_remove /
--refcnt -> kvmhv_release_nested() -> kfree(gp) in that window, leaving
the iterating vCPU with a dangling pointer. The subsequent
mutex_lock(&gp->tlb_lock) and accesses to gp->shadow_pgtable,
gp->shadow_lpid and gp->l1_host all touch freed memory. The free path
is fully L1-controlled.
Fix this by incrementing gp->refcnt inside the loop before dropping
mmu_lock, mirroring what kvmhv_get_nested() does, and releasing the
reference with kvmhv_put_nested() after the per-guest work completes.
This is the same get/put discipline already used at every other
call site that drops mmu_lock while holding a nested-guest pointer.
Fixes:
|
||
|
Arnd Bergmann
|
2d5adffc11 |
Renesas fixes for v7.3
- Fix Ethernet stalls on RZ/V2H, RZ/V2N, RZ/G3E, RZ/T2H, and RZ/N2H. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQQ9qaHoIs/1I4cXmEiKwlD9ZEnxcAUCaprEkQAKCRCKwlD9ZEnx cMpLAP9H6eVF6pfnOLjgqE41gQUaMdn5SDmlIteD8Xyx8PQRngEA+CAMdw1oJeIy mtENt2HlmGqIYnNZhZ4Ip/VPQ5BIBwY= =usMX -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmqoDGkACgkQmmx57+YA GNmJqg//Vh6VARqCnKv9ZY0jvalvXg7ff3PLJ26bNbZEYY1u/u6II5XgJoeUP0im 3kPZihu1ZxT0vCDPOFsH1l4XUyVDhD7G36kQl9uq2stD1/N7t8uXMlObymL4jUCE LNUBaHxyOZSzdGHtPmDAZpyUrz+VZTOJmz5HFDQVHvV+JSLcy4qsQsxTOjJCTe0h TDEko4XmOBPfbjIfo9y+gAR1caD5F1EsOtS3OjjZWTLHPmHGpqQ3fBoWch0kyW7H 8RSEpxnVwxJCiBoazYdPpWuHiYk95lNlwdyhAPZAPLJmQm9CrpZsOFFEvIkuafVf K+zGvXEkrvJBDTCA3i3GbX+tuIdNjrTKneL1QqmK1bHlyrAUP1Kd5d1zmZh3AY0X mwiHSaNId0NZDkGgEWxdOHDZL8Ln+aaYMFqz+ebc7kuaL+IN18goKSxLwwgcSELN S6i1nr07r0HyLoFyz/KHoA4ormWJgLe/3Z7trxZ/Ic4An/5HAOFH/N3WyWOhpSYb jno71gz/XRjVCHBFLruc9bR3VrKhSDEL+WixIQsUNajOAkgQia8NwpwJGC4Nji1z GPmCaa8Rs3CL4FdjEvcY8zAnMdZlrXe7QCA+fWmjGT51jfdJLh+nES98wGs2HmWw uuIjvBPwv+BtT7k09j3H3rnEJ8i9IxBCHWlLih0KVGpUpGYtfno= =2JAV -----END PGP SIGNATURE----- Merge tag 'renesas-fixes-for-v7.3-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into arm/fixes Renesas fixes for v7.3 - Fix Ethernet stalls on RZ/V2H, RZ/V2N, RZ/G3E, RZ/T2H, and RZ/N2H. * tag 'renesas-fixes-for-v7.3-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: arm64: dts: renesas: r9a09g087: Switch GBETH TX queue scheduling to WRR arm64: dts: renesas: r9a09g077: Switch GBETH TX queue scheduling to WRR arm64: dts: renesas: r9a09g047: Switch GBETH TX queue scheduling to WRR arm64: dts: renesas: r9a09g056: Switch GBETH TX queue scheduling to WRR arm64: dts: renesas: r9a09g057: Switch GBETH TX queue scheduling to WRR Signed-off-by: Arnd Bergmann <arnd@arndb.de> |
||
|
Arnd Bergmann
|
ebdad7d867 |
SoCFPGA DTS fix for v7.3
- Fix DTS file access permissions -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEoHhMeiyk5VmwVMwNGZQEC4GjKPQFAmqe40AACgkQGZQEC4Gj KPR2yBAAlKHiNj+Jm4+cKypqiaE0RNd1YEsaLVfzLUFxnjUiFLwsZ+hdgH8y1H+Z 2oVaXykvNdWMCURmDnc+md5Dve1rWV2hA2w29ESUg/IW6J5rfjbBawl1L/nEXwwa OcsQFWCZg5FnQd8OW+ZT/BtNSV5MFIyYB/S0TKkCd1y3WsUSb2ZZxbN2IDeUvqjb FDv85FXhPS5uO11SkIvgAik0nTHW86FdCwmaICggYNeMorlYHOCi/ZT4WP+AkW4D z6tCFyYCypLB5vwRcy6pVJMycPg/7chO//PKiMA34Hn4cYRz5P7+qt63rOmKhhny D2n7QKB61n0uOnTFVaTUDXuVCDEX8/uGIYSkGPd2vq2a7IRI2xIVsIlEcxYm4tJW VvpKFmP/5rq3dBdIdjyxVJ4q5tNAz+uOAaWKnbQs5HylgOYECYr8Qc3hO3fO0Gza vOQe+/TKnUuMbVM8dTWYymzof5nIN6coxQJh8VcWihlmKB1M2p6kwx+VaTvYzluL Embxge1w4P0J5JTa4rAhRjMY77YjgxxLA1wiEU/1CU0HwSCPOXjEu2kgB26gAOaA X2x9iyGqY2xmdXzkFOtQTbQyvGOpKo1F7zTmKujJAPWcDl5f+I+jBqD2/QgZa0Po UGyGBR9kkt4/uAk4jCOTgAd9q6YW8tHJK4PrvN6tx3JURTbzQ3I= =oz9W -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmqoDEIACgkQmmx57+YA GNn3pw//YlboS3mV4S+uizgUVZF1/kUdrRuen19LgDXi/0CrnsWEkEKh/tKNztz7 Z4LldyNQVjmnd7poN+PB2uS1Su4U4mAkaGqTp3gCQhNmNqWDGyFIda1d1I4yGvxY awrJBHp4bKtD9KEwUcp70ey5PQ8ngIIVjWqKxWfMzgl6HzgYs9kDD/26CA534hDK MZ6vU4I/S+7vYhi1Uw4R6lT/9dU2wu4wLSP+wy9XOYVtF97ZGLQzkMY8+H13b0Tv bShneO/fgchoirmDJ1RCZ2aT5cgazX+KbBb2XGbDFHDGPXMlq9BC4N0sQb3Y3HI3 67qkBSmiS2TT5/Ia0SnWfUApROZ6Jn+/LubsU70YwRKqpo5VR64XC4SzVIkqSJVK nCa5izvfhJvEh7aeRiyVqaOYUwz5cr4DeZEirv4IC53/ZwEY0edlCtZ4yr18D+6h EarJNigEl5V3pz9ii7YHcNo6z6YhaE+raoZVTZWr92DeLYvm+H2aVBJL2zKgfr8Z AXHGATzC5Nsr28H4IGvPE1XhJ6QkSTRJdMcBAVmeP1Hcf5Zh3fxxCaToD8l2ZgbK Og9A9RapNfZ2eGK72u5waGT5VrLrLEF+UIL/ZxIxbDKT8v4CCZxt5M8z1gm0c3k4 BtvvbW17bH4YE1O2XWrQsvnJDsQ4FiijlcfK81QCKxo9kVjwxQA= =kOVb -----END PGP SIGNATURE----- Merge tag 'socfpga_dts_fix_for_v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into arm/fixes SoCFPGA DTS fix for v7.3 - Fix DTS file access permissions * tag 'socfpga_dts_fix_for_v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: arm64: dts: socfpga: change access permission from 755 to 644 Signed-off-by: Arnd Bergmann <arnd@arndb.de> |
||
|
Arnd Bergmann
|
8c8a0cac6f |
SoCFPGA fix for v7.3
- Fix PL310_ERRATA_753970 Kconfig option -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEoHhMeiyk5VmwVMwNGZQEC4GjKPQFAmqe4XYACgkQGZQEC4Gj KPTAQg//U7gbQs//XbjkgGZwN2RB42Sz8AqH1DeAH9LE/N4Mc1eLnQY+t3qv2S2W 6hR4kRvRqRXI3Kk/vZA7t3dx8l2BM8lFJr6kgnWbGHdFqsO07I8rYBk1O7IyMj4+ zxJJYp644x8eAXRowqATR//1CpGGEzFKbgNCiL0aHu18aHX2xaGbuNcxLZJO8wou BZeLzwlzpMr6rNdKeLPqlELfU7HwL3wgmSDXhlahLiNg9gIGtxGk4JOOlgGmJpN4 0DQ3UMLYAXHuBZ9YKkSMliDK2HOmL1B6D2+zgkhBN4YzCjM+HW3t9xwErNoE8wPU 3lx5Pjtm4DrDmkWh3FsIsKVoQ6SnQX1kL72PzU5gfG2IIqi3pleaGJGOqZQxmmUi 5WMwVhmU1dxvs5ahy0whjQd7ExMmh0oK29jOLOMDV257KWQ0jSq49S7fkXPcbns7 tLf1f/gLTrgMn+fGKhx5aJHxbOLj4fK8H+yIkh2donr4tYHl1lKmc8WHkWKJy660 01bFh2zhu7Ngy0YUPuA2bEZ5fMVb3Yr6GoETm8ZdHcrNCGss3cYBcIItGWYdNniE YRdkO2uGe+k4UH5SdiuwFp/CUXKrwIO/aUVVY7W++WEshkVem21fQ2XFeq6ol9FX BQKxB6GAFEJi5P0w8paJytiMDuFP7MgHwJZVaGMsQDf1ToXc6AI= =SIMB -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmqoDC4ACgkQmmx57+YA GNnndg//SpH4rVpU1I67e0Z31qMgxkvUGV4EjMjsRiExo3cMIHtw189USGQgpIDh ThkSdh7ewq+IZkQlD775++5NN8tUQiEwLYr/cwWgk7BIdjRk99oVYtFTM9KSZT3o wWXbt7NPoe5tFMeGtqkEmzJtS37f5QLDO9jCTKyHtD0OzG5OnBCIWchrJYi+DbGE 9/KwneKPUwR7ViFrkOnTXUipC28EMyg3ROFKVWzbiYD88mFAxQMypEliCKIYos1a JvvVHqsPacT7hVM4cbCGC+65qlpe1gVexOfcHqpQ4yTHi46wEXyb6uZCJx+Pg8Ny lI4fNxEi3OcmqsJf7VEmarm3MOViTzae+HdVD3A31pL1JibgkwlokFwv+xuXHWn6 m8S5EIv82VK+sFR5NjA94LMGzl13FoZR523MtawLx9uFi+0FTUKIcNpx7ov/Dt2Q G0FtvY9APyIchGJyPZhz8nLWiCdEjWffR9xma8u89osLs91Po0HSJDG5Hrjj3RBD GRDZ7r72UJ87WEGNxCzo3LInSL9+IeUc8xcIVKM8oNWFyJJkKwXVNhXx2nJJ8F0n KcST4dlmheZFN1jDijgO2Ip+aarfZ98gZxzYkQKtLeo3euro4frxUhRhOt2uHHwp 7ZFQUFy/VWyljYhhB49b3Z8jPowzil/bieuoFzTDOhsXEOpzToo= =ocHH -----END PGP SIGNATURE----- Merge tag 'socfpga_fix_for_v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into arm/fixes SoCFPGA fix for v7.3 - Fix PL310_ERRATA_753970 Kconfig option * tag 'socfpga_fix_for_v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: ARM: socfpga: select the PL310 erratum 753970 workaround Signed-off-by: Arnd Bergmann <arnd@arndb.de> |
||
Koichiro Den
|
8dc2615d57 |
arm64: dts: renesas: r8a779f0: Set UFS lane count
Since commit |
||
|
Linus Torvalds
|
704340f1cd |
* Fix user-space data loss with MADV_FREE and THP
* Fix set_memory oopses * Fix addition of large constants in mul_u64_add_u64_div_u64() * Fix FineIBT hash offset in cfi_get_func_hash() * Fix PCI device reference counting in amd_smn_init() -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEV76QKkVc4xCGURexaDWVMHDJkrAFAmqnKVYACgkQaDWVMHDJ krD8aQ/+N/I3Rwg4i54HAMtClEZQl8xZKGkuihie48vPTO5wbuJJUMWRRi5IlSMT oBRv2whRzXq9qwL0E0ZIt5S80f1K0ghnY8yLfmnhGDC+OdJrBa6do8g38WjGJueI lG6CUm+rnXq7aOCnvFpjEFULS5YClZK8P8kEGe1AplKa1dnlGRGOqq85YUzTWQ1Z Umg/HzAi0Bmj9zeoYxP6AMRTBhay5D3IgLow5htodbGb4QGZ+kNlCVMAljm97EkJ HdLKbuRe5Kf9mY4rPfHeW55WlwzWdJzVs6k3opsfvb14JpUv73OrlcPEW0mK+sxr PGbVylkmhKke2K3SQLo3Yu22SUzBT0Nzimcxn8BzCjq8PE1XTLe+11ZpnMH29RNR RCUujHYwIs++6R0812T2yqaK9JfgJl0RZYeABSv6WgZfloknBhUgb4GB8+UVWv5L HX5bnqF86uBk58v/x1lqxNzx0UEuny1MXKS/wVvnVo9RU8JeuAa7TvNAKd67i6Pp esrB97Y6+XgwquBVvlQW7v3mmU2zauHO4NGfZr8JQPYOXoUbIDwNGZBk2I/HQdb1 6NZjzYMqbwA0aqvNASRWIG5QlMeR1d7aOgGlXtDw/78yo+f+U5vBD0RMEk7YYPYz MbLtwltlVJ+ZZND1BsvT5rnyTcHs3aKdSnCya9jigAAHQcsRh8E= =0n23 -----END PGP SIGNATURE----- Merge tag 'x86_urgent_for_7.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Dave Hansen: "The most notable fix is THP not silently losing user data and having been around for a couple of years. The main explanation I'd have for its longevity is that it requires a few different things to align at the same time: MADV_FREE, THP and heavy reclaim. - Fix user-space data loss with THP - Fix set_memory oopses - Fix addition of large constants in mul_u64_add_u64_div_u64() - Fix FineIBT hash offset in cfi_get_func_hash() - Fix PCI device reference counting in amd_smn_init()" * tag 'x86_urgent_for_7.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/amd_node: Fix PCI device reference counting in amd_smn_init() x86/div64: Fix addition of large constants in mul_u64_add_u64_div_u64() x86/cfi: Fix FineIBT hash offset in cfi_get_func_hash() x86/mm: Fix user-space data loss with MADV_FREE and THP x86/mm/pat: Allocate split page tables as kernel page tables x86/alternatives: Exclude text poking against change_page_attr() x86/mm/pat: Acquire init_mm read lock on attribute changes to avoid UAF x86/mm/pat: Acquire init_mm write lock on collapse to avoid UAF |
||
|
Linus Torvalds
|
85855f85de |
Miscellaneous perf events fixes:
- Fix sched_cb_list corruption on PMU callbacks that
invoke list_del() during perf_event_overflow()
calls (Thomas Richter)
- Fix PEBS pt_regs->flags snapshot data that was
regressed with the introduction of adaptive
PEBS v4 support (Dapeng Mi)
- Fix possible drain_pebs() re-entry bug
when intel_pmu_drain_pebs_buffer() is called from
process context (Dapeng Mi)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmqmWoURHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1hzhA//TBu2jx/c2r5tafuW5mpPJH+3eGcMWUh9
KfVLt/FMzgt+sOtzM/eIQ2Sk4VAachTkSLjh6MQR1m9g4jXTVr5rH8lJlFXqW/74
v5XhaEryXTSOn6zpxXpKrVGYFq6RfdTijtmrAK+7ac6HChgRrMa0Eb5yVvPauLXE
+Y0RugHjF75c4iXapb68osWF+7EoVKGqLPZjdQ12D6wga7+1DRTZWV37hOXHtu1M
GbajBMTKF5Q4QCffsyY9PDks86dKLDrv8z7XxGNYz4pdcnwD4bMdYfu8FxohowaO
EXx9b0dxK1RobcsMo+wHZojTD0i4ySSIbN7lJU6dHopMFJ3nKgCDYuPvzov9T/Dm
8eFrzlQbr0m9+NqndFomjv4so1WGF1Q2DHqEOJQgSeHNECpUAx7mzIzv/AJiJm1P
AC3S8PJT5+AFQZtySqV6nI8UyzyMgoDo3EYdp3oKHq/B6SGDlAUHr3k8e5bpI8ss
JbIvyo1RH6DrB+FstHHve7zn5ueYmjxPQRS8NdIRrBKAeMryC7DYEDU7ZUwkAJS9
jJZE7wM0zhLbF5EPVEA3+rhrh1wZ0mUFsWJwWbn7QwIpSm331J8AEKdpKFa3k5op
FH9PusGL/SKeVwo1nReExLJWghdlxhbHAC8QhLMHTKOrhoqoUzpp5hRQ9rgx5z7N
hksCg2xZC+U=
=mKBo
-----END PGP SIGNATURE-----
Merge tag 'perf-urgent-2026-09-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull perf events fixes from Ingo Molnar
- Fix sched_cb_list corruption on PMU callbacks that
invoke list_del() during perf_event_overflow()
calls (Thomas Richter)
- Fix PEBS pt_regs->flags snapshot data that
regressed with the introduction of adaptive
PEBS v4 support (Dapeng Mi)
- Fix possible drain_pebs() re-entry bug when
intel_pmu_drain_pebs_buffer() is called from
process context (Dapeng Mi)
* tag 'perf-urgent-2026-09-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
perf/x86/intel: Prevent drain_pebs() reentry
perf/x86/intel: Correct pt_regs->flags update for PEBS path
perf/core: Allow list_del during perf_event_overflow()
|
||
|
Linus Torvalds
|
f10ae89f3d |
- Fix ARM gic-v5 irqchip driver regression, where its
enable/disable functions may corrupt unrelated
ICC_CR0_EL1 hardware state (Sascha Bischoff)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmqmVqMRHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1iHxA/+JPy8xMVQzoWDkMIAkm8GyuC8xWRoF+OC
thsCWv/KZAiysjuttpG6nyJrATt+2qP5AnmmNDKZaX5qofwU4bKjw0tt6MqIvtVo
l1quxcNafpLBlw27EqaePp56McMMext609E9PUkU/fVlwewvfT34ABnIYOJnRSei
0ZyovAmGU3jGdExXGSvDyUkoK6FuyL5R8/ugKTXs+6nRypj9eJuX8ZO0G8/FsZF+
OCbM21959/wI9imSjbbVeUINILjMv6+KMbNCh2x+8rSoOMOa0uuL7jvfmK2y8a0m
/N9mTDSZiaFCddzubx5r1lHsFs4DUtrT8ScKl0M7p/HQVYEWXtlA9rkE89BcJPk/
ibHbY6sIjyGnLfKlBiKjLzxkoYvMN7qJ76PI6bDU8ic/3i2FMnULR5URzKYsYaof
I8m3BHUTFvcjkkr+tAM6/OEsVZqVXtenJe8PduPVrxJ6OUOorvlEORV2Wuzf1qHA
DpJb49+PbElBeCBsDo7GNGKUOrp83sYaJJwUcJOeHZSGi6LyVHgklEK+2uxGHTpF
jtkAoCrjJPO6HKZloUQCrVAAXWTwImb/j/WD1pt3tz0ymHtTKJgkj5FtklXL2oID
wkydja+7UbSU+4R2/NQo8RG7m2IXERqcMEaFZoFvASeAe2UGNfxfQJ2jHE1Ugif1
JFsJv/KTLS4=
=sj7n
-----END PGP SIGNATURE-----
Merge tag 'irq-urgent-2026-09-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull irq fix from Ingo Molnar:
- Fix ARM gic-v5 irqchip driver regression, where its
enable/disable functions may corrupt unrelated
ICC_CR0_EL1 hardware state (Sascha Bischoff)
* tag 'irq-urgent-2026-09-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
irqchip/gic-v5: Preserve ICC_CR0_EL1 state
|
||
|
Linus Torvalds
|
2f0c1cf72f |
s390 updates for 7.3-rc3
- Fix NULL pointer dereferences in s390dbf when setting debug levels or resizing debug areas while logging events. Remove duplicate messages about kernel parameter overrides - Fix PAI perf crashes when per task events move to newly onlined CPUs. Add CPU hotplug callbacks to allocate and free the per-CPU data - Fix mutex use in atomic context in AES and PAES CTR code by using semaphore trylocks instead. Remove conditional locking and enable Clang CONTEXT_ANALYSIS for the crypto code - Fix scatterlist walk error handling in AES and PAES and avoid freeing PAES walk resources twice - Fix missing scrubbing of temporary AES and PAES buffers, including AES GCM error paths - Set missing CRYPTO_ALG_ASYNC and CRYPTO_ALG_NO_FALLBACK flags for PAES - Fix -EBUSY handling in PAES and PHMAC to avoid cleaning up requests already queued to the crypto engine - Fix PAES and PHMAC requests being completed twice on errors - Fix PAES and PHMAC hangs when key conversion keeps returning -EBUSY by returning -EIO after the last retry -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEE3QHqV+H2a8xAv27vjYWKoQLXFBgFAmqlzRcACgkQjYWKoQLX FBg65gf9H1AoBZnwcgcjhGzJL93sqj8nm9BRquCIdHi85FxypAYFX4nM8o7ESUWj HaIuleZA6OncKWBdHSEkBOj8fak+6RixjK7j1chUXzg0+J/bmTSWWE3j9zw8ZWUj TGY7yuvDtZ/XRefO3yxirh9Nr7OyS98FH7rxcwnlmKYz6AKQmLayLrMfw+E6BP+a Juw1aWPHRMvd+9JqakqzTOIfJNmNz34HT3yL0phqiHojU5mNsgGPUPjlD6jNkFCf 6TdRVcnkHMuhTEx/HD+/8nHTlYDVFJkLbpe9WYk94ubVY6kLaLxuBWE1ycCk7bv8 GOQygNWL5mZpL5c0MTtlm49ybIELuw== =cYX9 -----END PGP SIGNATURE----- Merge tag 's390-7.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Vasily Gorbik: - Fix NULL pointer dereferences in s390dbf when setting debug levels or resizing debug areas while logging events. Remove duplicate messages about kernel parameter overrides - Fix PAI perf crashes when per task events move to newly onlined CPUs. Add CPU hotplug callbacks to allocate and free the per-CPU data - Fix mutex use in atomic context in AES and PAES CTR code by using semaphore trylocks instead. Remove conditional locking and enable Clang CONTEXT_ANALYSIS for the crypto code - Fix scatterlist walk error handling in AES and PAES and avoid freeing PAES walk resources twice - Fix missing scrubbing of temporary AES and PAES buffers, including AES GCM error paths - Set missing CRYPTO_ALG_ASYNC and CRYPTO_ALG_NO_FALLBACK flags for PAES - Fix -EBUSY handling in PAES and PHMAC to avoid cleaning up requests already queued to the crypto engine - Fix PAES and PHMAC requests being completed twice on errors - Fix PAES and PHMAC hangs when key conversion keeps returning -EBUSY by returning -EIO after the last retry * tag 's390-7.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/crypto: Enable CONTEXT_ANALYSIS s390/crypto: Map EBUSY to EIO when key conversion fails repeatedly s390/crypto: Fix wrong return code to engine in asynch callbacks s390/crypto: Fix handling of EBUSY in PHMAC when req is pushed to crypto engine s390/crypto: Fix handling of EBUSY in PAES when req is pushed to crypto engine s390/crypto: Fix missing cra_flags in paes_s390 s390/crypto: Fix use of mutex in atomic context in PAES s390/crypto: Fix missing scrub of temp buffers with PAES algorithm s390/crypto: Fix return code handling at skcipher_walk_done in PAES algorithms s390/crypto: Fix use of mutex in atomic context s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm s390/crypto: Fix skcipher_walk return code handling in aes_s390 s390/debug: Fix race between debug area resize and event logging s390/debug: Do not repeat parameter override notice on debug_set_level() s390/debug: Fix NULL pointer dereference in debug_set_level() s390/pai: Support CPU hotplug for PMU PAI s390/pai: Move locking to event init and delete s390/pai: Use PAI PMU index as parameter replacing event |
||
|
Linus Torvalds
|
52311be52f |
powerpc fixes for 7.3 #3
- powerpc/entry: Fix double accounting of user time on interrupt entry - Fix leak in htmdump_init_debugfs - KVM: PPC: Book3S HV: Set irqfd->producer only on success - powerpc/kexec_file: print configured kernel command line - Remove redundant early_init_dt_scan_root() call - misc fixes and cleanup Thanks to: Aboorva Devarajan, Amit Machhiwal, Athira Rajeev, Christophe Leroy, Christophe Leroy (CS GROUP), Kunwu Chan, leixiang, longlong yan, Michail Tatas, Mukesh Kumar Chaurasiya (IBM), Ritesh Harjani (IBM), Shivang Upadhyay, Sourabh Jain, Thibault Ferrante, Vaibhav Jain, Venkat Rao Bagalkote -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEqX2DNAOgU8sBX3pRpnEsdPSHZJQFAmqk60sACgkQpnEsdPSH ZJQsGRAArQi4cAIMzc0w44DA4othVOjUauS81/z0TfgxCT3pUPdG0C71x5uJrDpF Cdtc03xsxLURAGy1afQX9WsWQwpimWbGLhI/KQpSgGoKEq5RNVVMvOMKVzlB8Wmo XW/bfugU0jov8Iz6vH8iQAn2hazE52G98NHU6y8ZDcOrpFBA4RRY2CaqJIt40Xzm kxgkH773ErKPbyKycW3NBYxm9Bf2Cm3HUB1RO0OnAcLE2dHr3AqUGvt0ruLx+Cew YEJEenbKaxM8YWtji6cjkGKOCjgmKdUe+t+fh4G4KZVhG8whb4Ci/NhZxlkup9AC 64B3gkqIK3Hh+ufsvbSlN6/ignFtdZsioneLoMteCx7C0cs+HTnLBoghI3FlDNXc f0ywaNlZgzDt73zAejLMp4PPiqjMyELAq9V4sKatSTugexELM1t9b3f/pIa2kFNR s/VVXJ5YL2ni6gS26vg2GVOCZeBoJ5ucrxDiZVEyaWHpnuq1cu35a+Sbf4O0yVBK h70SVyi2OLUc+DNSMJMoIDfFg+6gfzo4cbbW/s2MV2hYrDRCu0Rx3xNzq1qNAiN0 RNSC4cOQ4hCrmORzEOJzuCAahRKGrFR3vaW73KhmhCNJ7DnDqJR2luSa7f4aKg8T d/z1FY7eTqNPbt4EH4+GB/MajF59xM8OihcnjbmoSDnSGUp2DTI= =zcTl -----END PGP SIGNATURE----- Merge tag 'powerpc-7.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Madhavan Srinivasan: - powerpc/entry: Fix double accounting of user time on interrupt entry - Fix leak in htmdump_init_debugfs - KVM: PPC: Book3S HV: Set irqfd->producer only on success - powerpc/kexec_file: print configured kernel command line - Remove redundant early_init_dt_scan_root() call - misc fixes and cleanup Thanks to Aboorva Devarajan, Amit Machhiwal, Athira Rajeev, Christophe Leroy, Christophe Leroy (CS GROUP), Kunwu Chan, leixiang, longlong yan, Michail Tatas, Mukesh Kumar Chaurasiya (IBM), Ritesh Harjani (IBM), Shivang Upadhyay, Sourabh Jain, Thibault Ferrante, Vaibhav Jain, and Venkat Rao Bagalkote * tag 'powerpc-7.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/pasemi: Add a null pointer check to the pas_setup_mce_regs powerpc/prom: Remove redundant early_init_dt_scan_root() call selftests/powerpc: use MAP_FAILED instead of (void *)-1 in tm-signal-context-force-tm powerpc/kexec_file: print configured kernel command line KVM: PPC: Book3S HV: Set irqfd->producer only on success powerpc/pseries/htmdump: Fix leak in htmdump_init_debugfs selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value selftests/powerpc/pmu/ebb: fix lost_exception_test hang with sched yield change powerpc/entry: Fix double accounting of user time on interrupt entry |
||
|
Linus Torvalds
|
827751b699 |
RISC-V updates for v7.3-rc3
- Revert a bad fix, likely LLM-generated, in the pointer masking code
that confused the RISC-V hardware pointer masking implementation
with the Linux kernel tagged address feature
- Fix unexpected faults caused by kprobe instruction slot writes when
!CONFIG_STRICT_MODULE_RWX
- Fix unexpected faults on minimal configurations during runtime code
patching on !CONFIG_STRICT_MODULE_RWX systems
- Fix a misplaced variable clear causing incorrect reuse of previous
values in the RISC-V hardware feature probing code
- Fix two bugs in the PMU SBI perf code on rv32: use BIT_ULL rather
than BIT on 64-bit masks; and use a bitmap rather than an unsigned
long on a quantity that can exceed 32 bits
And a few miscellaneous cleanups:
- Avoid a potential dereference-before-NULL-pointer-check bug in the
PMU SBI perf driver
- Simplify the rv32 bug table code by using
CONFIG_GENERIC_BUG_RELATIVE_POINTERS (following x86 and PPC)
- Report the RISC-V standard ISA extensions Z[v]fhmin when support is
claimed for the superset RISC-V standard ISA extensions Z[v]fh; and
simplify our FPU test code to only check for the presence of the D
extension
- Use an existing kernel string helper in place of some open-coded
code in kernel/usercfi.c
- Fix some yamllint issues in the RISC-V DT bindings for CPUs
- Convert one use of __ASSEMBLY__ to __ASSEMBLER__ that snuck into the
RISC-V CFI selftest code
- Update the translation for the simplified Chinese translation of the
RISC-V kernel patch acceptance policy
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEElRDoIDdEz9/svf2Kx4+xDQu9KksFAmqghcoACgkQx4+xDQu9
KkvmEQ/7BVmPFuoR6OLNk2Eu8Exqen6a41KxdM/B91NJBEbBM60GAyejjWDXWmm0
K21yhRu58RGbfg2kKUJMvawzwIfuDswxCS31VtpDKnTrmP4HQz1Yvnh2M7jH9D2d
/wJCIYcJ0hJx0yDIZOUhU24aoy63ZXRygp8nTOgjkAxhkF31w+MJxTPDD0Ir7Eai
y4sRMTCabMonmyA0qozfnMoXaO3FkPv9l7pw/LHfqUYjaLNQyMHiiDPrRj1oNZPD
GQFUWykRgMccMW6kIgTJrjmzn7+vEJ7UZ/fvOD97+rGeaoyE19vcW8owUQWp6Hgb
Jq3WyS9HImrpCBTr079ht5lhu3ZucpAEP6sK5v/m4GOlBv1HdYHUS6JH0qo4DnXZ
aFrxg7WXxaFZ8dD3P8ErZkXy5Vid3+ZlpK//AOfWAqxX7q6c4K1w3lJm4bPKyNBX
vh3ASQr5oEj3KpGbihsrX2lVB/5LVP3pWTcH5f6rBBYiVFMMhWKLJXA3pjiRFN7v
ZXClKh5MznvS6ycMp5pXVYpVn2Kk+Y/mywsDqNRUigHwppkxI9MTJBq8+qcOiM9I
a7mHna4XHVVu0+B4/JMhkWgnGYRjFD6bsGzxPZODLFcmBUxmsoa5+HOENLAGdQ1w
s/Z2HmDO8yL37DxLq5O2aF3KNPSkXNBl+upQwj5lTTzR/bmghjc=
=oMU+
-----END PGP SIGNATURE-----
Merge tag 'riscv-for-linus-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux
Pull RISC-V fixes from Paul Walmsley:
"From a RISC-V point of view, there's one notable fix here, reverting
an earlier bogus fix to the pointer masking code. Fortunately the
practical impact appears to be small.
- Revert a bad fix, likely LLM-generated, in the pointer masking code
that confused the RISC-V hardware pointer masking implementation
with the Linux kernel tagged address feature
- Fix unexpected faults caused by kprobe instruction slot writes when
!CONFIG_STRICT_MODULE_RWX
- Fix unexpected faults on minimal configurations during runtime code
patching on !CONFIG_STRICT_MODULE_RWX systems
- Fix a misplaced variable clear causing incorrect reuse of previous
values in the RISC-V hardware feature probing code
- Fix two bugs in the PMU SBI perf code on rv32: use BIT_ULL rather
than BIT on 64-bit masks; and use a bitmap rather than an unsigned
long on a quantity that can exceed 32 bits
And a few miscellaneous cleanups:
- Avoid a potential dereference-before-NULL-pointer-check bug in the
PMU SBI perf driver
- Use CONFIG_GENERIC_BUG_RELATIVE_POINTERS to simplify the rv32 bug
table code (like x86 and PPC)
- Report the RISC-V standard ISA extensions Z[v]fhmin when support is
claimed for the superset RISC-V standard ISA extensions Z[v]fh; and
simplify our FPU test code to only check for the presence of the D
extension
- Use an existing kernel string helper in place of some open-coded
code in kernel/usercfi.c
- Fix some yamllint issues in the RISC-V DT bindings for CPUs
- Convert one use of __ASSEMBLY__ to __ASSEMBLER__ that snuck into
the RISC-V CFI selftest code
- Update the translation for the simplified Chinese translation of
the RISC-V kernel patch acceptance policy"
* tag 'riscv-for-linus-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
riscv: skip software algning code for HAVE_EFFICIENT_UNALIGNED_ACCESS
kselftest/riscv: Replace __ASSEMBLY__ with __ASSEMBLER__
docs/zh_CN: Update arch/riscv/patch-acceptance.rst translation
dt-bindings: riscv: cpus: Fix yamllint style issues
riscv: hwprobe: simplify has_fpu() to check D extension only
perf: RISC-V: check cpu_hw_evt before dereference in overflow IRQ
riscv: report Zfhmin/Zvfhmin when Zfh/Zvfh are present
perf: RISC-V: store available counter mask as bitmap
perf: RISC-V: use BIT_ULL for u64 overflow masks
riscv: bug: Make RV32 use GENERIC_BUG_RELATIVE_POINTERS
riscv: hwprobe: initialize pair->value in hwprobe_one_pair()
riscv: use string helper in setup_global_riscv_enable()
Revert "riscv: Reset pmm when PR_TAGGED_ADDR_ENABLE is not set"
riscv: patch: skip fixmap mapping when kernel text is already writable
riscv: mm: make EXECMEM_KPROBES writable without CONFIG_STRICT_MODULE_RWX
|
||
Catalin Marinas
|
fdb9ebc7fb |
arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation
PTRACE_{PEEK,POKE}MTETAGS return -EIO rather than -EOPNOTSUPP (as
documented) when no tags are copied from/to a mapping without PROT_MTE.
This has been the behaviour since the interface was introduced, though
the original intent was to distinguish between address not being
accessible and mapped as untagged.
Update the documentation to match the implementation (de-facto ABI).
Since -EOPNOTSUPP was never returned, change the error assignment to
-EIO as well to avoid confusion.
Fixes:
|
||
Mark Rutland
|
8cf2093f53 |
arm64: percpu: Fix LSE operations on {8,16}-bit types
The assembly for __percpu_##name##_case_##sz() and
__percpu_##name##_return_case_##sz() doesn't use the 'sfx' macro
argument to form the LSE instruction. Without 'sfx', a W register
argument will imply a 32-bit memory location, and consequently
{8,16}-bit ops will erroneously read and write 32 bits of memory when
the LSE instruction is used.
Fix this by appending 'sfx' to 'op_lse' to LSE instruction. It is not
necessary (and not valid) to append 'sfx' to 'op_llsc', as 'op_llsc' is
a register-register operation which does not access memory (and does not
take a size suffix).
Fixes:
|
||
|
Mark Rutland
|
44274c6572 |
arm64: percpu: Fix this_cpu_and() mask generation
The arm64 implementation of this_cpu_and(pcp, val) is built in terms of
ANDNOT operations, which requires the 'val' argument to be bitwise
negated. The bitwise negation is not implemented correctly, with two
bugs described below.
(1) The bitwise negation is performed as '~val' rather than '~(val)'.
This won't always generate the expected value when 'val' is an
expression.
For example, for this_cpu_and(pcp, 1 - 1):
* 'val' is '1 - 1' ===> (int) 0x00000000
* '~val' is '~1 - 1' ===> (int) 0xfffffffd
* '~(val)' is '~(1 - 1)' ===> (int) 0xffffffff
... and thus bit[1] of 'pcp' would be preserved unexpectedly by the
ANDNOT operation.
(2) The bitwise negation is performed on 'val' before it has been cast
to (at least) the width of 'pcp'. This won't always generate the
expected value for the upper bits.
For example, for this_cpu_and(pcp, zero), where 'pcp' is a u64 and
'zero' is a u32:
* 'zero' ===> (u32) 0x00000000
* '~(zero)' ===> (u32) 0xffffffff
* '(u64)~(zero)' ===> (u64) 0x00000000ffffffff
* '~((u64)(zero))' ===> (u64) 0xffffffffffffffff
... and thus bits[63:32] of 'pcp' would be preserved unexpectedly by
the ANDNOT operation.
Fix these issues by adding brackets around 'val', and by casting 'val'
to an appropriately-sized type before bitwise negation.
Fixes:
|
||
|
Mark Rutland
|
885bff055a |
arm64: percpu: Fix this_cpu_write() casting
The arm64 implementation of this_cpu_write() casts 'val' to unsigned
long. This is necessary to handle cases where 'val' is a pointer type,
and to avoid spurious compiler warnings for the (unreachable!) cases
where the pointer type would be cast to a smaller integer type.
Unfortunately, the cast is applied to 'val' rather than '(val)', which
won't always generate the expected value when 'val' is an expression.
For example, for this_cpu_write(pcp, zero - 1), where 'pcp' is a u64 and
'zero' is a u32:
* 'zero' ===> (u32) 0x00000000
* 'zero - 1' ===> (u32) 0xffffffff
* '(unsigned long)zero - 1' ===> (u64) 0xffffffffffffffff
* '(unsigned long)(zero - 1)' ===> (u64) 0x00000000ffffffff
Fix this by adding brackets around 'val'.
Fixes:
|
||
Breno Leitao
|
e4a6f57d22 |
arm64: hibernate: clone only the linear map that exists at runtime
This is similar to commit |
||
Aneesh Kumar K.V (Arm)
|
55a8e14518 |
x86/mm: Don't force unencrypted DMA for IOMMU-backed devices
Commit |
||
Yazen Ghannam
|
27600805e6 |
x86/amd_node: Fix PCI device reference counting in amd_smn_init()
The local "root" pointer is a temporary variable used during the device
search. Therefore, refcount related to the search iterators should be cleaned
up after the search is complete.
Use the __free() cleanup macro to ensure the refcount is decremented when the
temporary pointer goes out of scope.
Additionally, increment the refcount when caching a root pointer. This ensures
the in-use refcount is separate from the temporary search refcounting.
Finally, drop the redundant "root = NULL" before the second search loop. The
pci_get_class() iterator always decrements the refcount of its "from"
argument, so the first loop can only fall through with "root" already NULL.
Fixes:
|
||
David Laight
|
f65d38155a |
x86/div64: Fix addition of large constants in mul_u64_add_u64_div_u64()
Adding constants over 2^31 fails to compile because the ADD instruction only
supports 32bit signed immediates.
Replace the "irm" constraint with "erm" so that the compiler loads large
constants into a register.
Found by a patch to drivers/iio/frequency/ad9910.c
[ bp: Massage commit message. ]
Fixes:
|
||
Soheil Hassas Yeganeh
|
5a5d26f2cf |
x86/cfi: Fix FineIBT hash offset in cfi_get_func_hash()
The switch of the FineIBT preamble from "subl $hash, %r10d" to the
shorter "subl $hash, %eax" moved the hash immediate from offset 7 to
offset 5 of the preamble. fineibt_preamble_hash was updated to match,
but the open-coded offset in cfi_get_func_hash() was missed and it
still reads the hash at offset 7.
cfi_get_func_hash() is used by the BPF JIT to give a struct_ops
trampoline the CFI hash of the stub function it stands in for. With
FineIBT the trampoline now gets the upper half of the real hash
followed by the first two bytes of the next instruction, so the first
indirect call from the kernel into a struct_ops program,
tcp_init_congestion_control() calling ->init() of a BPF congestion
control for example, fails the FineIBT check and the kernel dies with
a CFI failure.
Move the FineIBT preamble template and its offset defines above
cfi_get_func_hash() and use fineibt_preamble_hash there, so every
reader of the preamble shares one definition of its layout. The
CFI_FINEIBT arm is only built with CONFIG_FINEIBT, the only
configuration in which cfi_mode can take that value.
cfi_get_func_arity() does not need the same treatment: the __bhi_args
call whose displacement it reads still ends at the function address.
Fixes:
|
||
Dapeng Mi
|
a56c03a397 |
perf/x86/intel: Prevent drain_pebs() reentry
The PEBS buffer is shared by all events on a CPU, so drain_pebs() must
not be reentered. If so, one instance may observe stale buffer state and
potentially access out-of-bound memory.
Most invocations happen in NMI context, which naturally prevents reentry.
However, drain_pebs() is also reachable from process context via
intel_pmu_drain_pebs_buffer().
In those paths, the PMU is often already disabled, but not guaranteed.
For example, __intel_pmu_pebs_disable() only disables the target counter,
so other active counters can still raise a PMI and interrupt an in-flight
drain_pebs(). Here is an example,
__perf_addr_filters_adjust()
perf_event_stop()
__perf_event_stop()
x86_pmu_stop() (event->pmu->stop)
intel_pmu_disable_event()
intel_pmu_pebs_disable()
__intel_pmu_pebs_disable()
intel_pmu_drain_large_pebs()
intel_pmu_drain_pebs_buffer()
Introduce __intel_pmu_quiesce() and __intel_pmu_resume() helpers and
use them in intel_pmu_drain_large_pebs() to disable the full PMU
around the intel_pmu_drain_pebs_buffer() call, preventing reentry.
Also add a warning in intel_pmu_drain_pebs_buffer() when the full PMU is
not disabled.
Fixes:
|
||
|
Dapeng Mi
|
88aa1223bf |
perf/x86/intel: Correct pt_regs->flags update for PEBS path
pt_regs->flags holds the saved CPU FLAGS register. In the PEBS path,
it was incorrectly set to PERF_EFLAGS_EXACT instead of being populated
from the PEBS flags snapshot.
Update pt_regs->flags from PEBS GPR flags if GPRs group is present.
Fixes:
|
||
Kunwu Chan
|
9e5c53d75c |
powerpc/pasemi: Add a null pointer check to the pas_setup_mce_regs
kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Ensure the allocation was successful by checking the pointer validity. Signed-off-by: Kunwu Chan <chentao@kylinos.cn> Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20240117091706.153431-1-chentao@kylinos.cn |
||
Sourabh Jain
|
15f3ce3aa2 |
powerpc/prom: Remove redundant early_init_dt_scan_root() call
Commit
|
||
|
Sourabh Jain
|
e58b9d9097 |
powerpc/kexec_file: print configured kernel command line
Kexec with the -d option prints extra logs about the kexec/kdump kernel that help debug kexec and kdump. For example, it shows what kexec segments are loaded, their locations, and sizes. One key piece of information still missing is the kernel command line configured for the kexec/kdump kernel. With this patch included, the kernel will print the kernel command line configured for the kexec/kdump kernel as shown below: kexec --initrd=./initrd ./kernel -lspd --command-line="test1 test2" Loaded elf core header at 0x22e30000, bufsz=0x2000 memsz=0x80000 kexec_elf: Command line: elfcorehdr=0x22e30000 test1 test2 <--- New kexec_elf: Loaded initrd at 0x22eb0000 Signed-off-by: Sourabh Jain <sourabhjain@linux.ibm.com> Tested-by: Mukesh Kumar Chaurasiya (IBM) <mkchauras@gmail.com> Reviewed-by: Mukesh Kumar Chaurasiya (IBM) <mkchauras@gmail.com> Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20250725124438.327593-1-sourabhjain@linux.ibm.com |
||
leixiang
|
1144454ea2 |
KVM: PPC: Book3S HV: Set irqfd->producer only on success
Set irqfd->producer only after kvmppc_set_passthru_irq() succeeds to
avoid leaving a dangling pointer on failure. The bypass manager does
not register a failed producer, so the pointer is never cleared.
Fixes:
|
||
Michail Tatas
|
10557fe7fc |
powerpc/pseries/htmdump: Fix leak in htmdump_init_debugfs
If any allocation fails during init all previous allocations are leaked and the debugfs directory is left. Fix by freeing the allocations that have already happened and also remove the directory that has been created. Signed-off-by: Michail Tatas <michail.tatas@gmail.com> Reviewed-by: Athira Rajeev <atrajeev@linux.ibm.com> Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/anJDq-JckR6j-6EJ@michalis-linux |
||
Aboorva Devarajan
|
11ae2e1dc5 |
powerpc/entry: Fix double accounting of user time on interrupt entry
Since the switch to generic entry, an interrupt from user mode accounts user time twice: once in arch_interrupt_enter_prepare() and again in arch_enter_from_user_mode(), which irqentry_enter() invokes for the same interrupt: arch_interrupt_enter_prepare() account_cpu_user_entry() /* first */ irqentry_enter() arch_enter_from_user_mode() account_cpu_user_entry() /* second */ The second call charges the same interval again, because account_cpu_user_entry() accumulates the time spent in user mode since the last return to user space. The two calls come from the GENERIC_ENTRY preparation series, where each step was a no-op on its own. Commit |
||
Bradley Morgan
|
955d86e5f3 |
arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc
swsusp_arch_suspend_exit() reinstalls the restored kernel's hyp stub
vectors with an hvc, but never passes the arguments. x0 is not set to
HVC_SET_VECTORS and x1 is not set to the vector address, so the stub
dispatch falls through and returns without writing vbar_el2. EL2 is
left pointing at the trans_pgd copy of the vectors, a page that
swsusp_free() releases right after resume.
Set the arguments up the same way __hyp_set_vectors() does.
Without this fix, Vladimir was able to trigger a hang when resuming from
hibernation with CONFIG_PAGE_POISONING=y and page_poison=on.
Fixes:
|
||
Vernon Yang
|
f7491d7c81 |
x86/mm: Fix user-space data loss with MADV_FREE and THP
Some of users of Polars (a data analytics library) have lost production
data from this bug. They seem to have just the right combination of
huge pages, MADV_FREE and heavy reclaim pressure.
pmd_modify() masks the old value with (_HPAGE_CHG_MASK & ~_PAGE_DIRTY),
silently discarding the hardware dirty bit. The subsequent
pmd_mksaveddirty() call is supposed to transfer _PAGE_DIRTY into
_PAGE_SAVED_DIRTY when write-protecting, but the dirty bit was already
stripped from the value, so there is nothing left to transfer.
Contrast with pte_modify(), which keeps _PAGE_DIRTY_BITS in its mask,
and pud_modify(), which keeps _HPAGE_CHG_MASK untouched: pmd_modify()
is the odd one out. Any pmd_modify() on a writable, dirty PMD loses
the dirty state.
One visible consequence is data loss with MADV_FREE on PMD-mapped THP:
memset(buf, 0x5A, size); // PMD-mapped THP, PMD dirty
madvise(buf, size, MADV_FREE); // PMD cleaned but left writable,
// folio marked lazyfree
memset(buf, 0x5A, size); // hardware sets _PAGE_DIRTY again
mprotect(buf, size, PROT_READ); // pmd_modify() drops the dirty bit
mprotect(buf, size, PROT_READ|PROT_WRITE);
// ... memory pressure ...
Reclaim (e.g. under memcg pressure) then finds the lazyfree folio with
no dirty bit set anywhere and frees it in
__discard_anon_folio_pmd_locked(), even though the data was rewritten
after MADV_FREE; subsequent reads fault in fresh zero pages. NUMA
hinting alone can trigger the same loss, as do_huge_pmd_numa_page()
restores the PMD through pmd_modify() as well.
PMD-mapped file THPs are affected too: mprotect()/NUMA hinting dropping
the dirty bit means rewritten data is never written back.
Fix it by keeping _PAGE_DIRTY in the preserved mask, exactly like
pte_modify() and pud_modify() do. The existing
pmd_mksaveddirty()/pmd_clear_saveddirty() pair then performs the
hardware-dirty <-> saved-dirty transition based on the write bit,
preserving the shadow-stack encoding rules.
Fixes:
|
||
Lorenzo Stoakes (ARM)
|
9e4a3ec341 |
x86/mm/pat: Allocate split page tables as kernel page tables
A PTE is allocated directly without going through the standard page table allocation routines (such as pte_alloc_one_kernel()) when the CPA code splits a large page (__split_large_page()). This means the page table constructor is never called nor is the page table marked as a kernel page table. The former results in the folio associated with the page table not being marked as a page table (__pagetable_ctor() is never called thus neither is __folio_set_pgtable()) nor are statistics updated to reflect it (lruvec_stat_add_folio() is never called). The latter issue of failing to mark the page table as a kernel page table (ptdesc_set_kernel() is never called) is far more problematic. Since commit: |
||
Pedro Falcato
|
1587d3394e |
x86/alternatives: Exclude text poking against change_page_attr()
From time to time, the following BUG can be observed
in the x86 alternatives patching code [0]:
> kernel BUG at arch/x86/kernel/alternative.c:2576!
> Oops: invalid opcode: 0000 [#1] SMP NOPTI
> CPU: 0 UID: 0 PID: 355 Comm: (udev-worker) Not tainted 7.1.3-1-default #1 PREEMPT(full) openSUSE Tumbleweed 8c1795b03ec64f997e57a8ad38b1161e3b98da64
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS unknown 02/02/2022
> RIP: 0010:__text_poke+0x2aa/0x450
> Call Trace:
> <TASK>
> smp_text_poke_batch_finish+0x2a7/0x320
> __static_call_transform+0xb7/0x220
> arch_static_call_transform+0x5b/0xb0
> __static_call_init+0xe9/0x270
> static_call_module_notify+0x11f/0x150
> notifier_call_chain+0x61/0xe0
> blocking_notifier_call_chain_robust+0x63/0xc0
> load_module+0x1c92/0x20c0
> init_module_from_file+0xd8/0x140
> idempotent_init_module+0x100/0x2f0
> __x64_sys_finit_module+0x71/0xe0
> do_syscall_64+0xe1/0x610
> entry_SYSCALL_64_after_hwframe+0x76/0x7e
which matches the following BUG_ON() in alternative.c:
/*
* If something went wrong, crash and burn since recovery paths are not
* implemented.
*/
BUG_ON(!pages[0] || (cross_page_boundary && !pages[1]));
This can happen if vmalloc_to_page() fails, for any reason. Such can happen
if text poking races with CPA, which can possibly result in the collapsing
of page tables (or breaking of PMD hugepages). It is not a problem for most
users of vmalloc_to_page() (they solely own the vmalloc'd range) but, when
CONFIG_ARCH_HAS_EXECMEM_ROX=y, various modules own a single execmem vmalloc
range, and can call set_memory_*() in parallel on it. This can happen to
race against __text_poke and cause havoc in vmalloc_to_page().
Fix it by excluding against CPA using the init_mm mmap read lock.
[ dhansen: Fix up SoB ordering. The actual code flow here was:
Pedro=>Lorenzo=>Mike=>Me which is reflected in the SoB chain
now. I *believe* Mike simply picked up Lorenzo's update to
Pedro's post from the Link ]
Fixes:
|
||
|
Lorenzo Stoakes (ARM)
|
d5d8b8662e |
x86/mm/pat: Acquire init_mm read lock on attribute changes to avoid UAF
A previous commit protected against races between ptdump and CPA collapse,
however one still exists between attribute changes and collapse as reported
by Denis V. Lunev (linked).
When an attribute change arises, a lockless page table walker obtains a PTE
entry, which is later written to via set_pte_atomic():
...
-> change_page_attr_set_clr()
-> __change_page_attr_set_clr()
-> __change_page_attr()
-> _lookup_address_cpa()
-> lookup_address_in_pgd_attr()
-> [ lockless page table walker ]
-> set_pte_atomic()
There is nothing preventing a concurrent CPA collapse which can free the
PTE that was retrieved here, resulting in a use-after-free.
With the mmap write lock taken on init_mm over CPA collapse, resolve this
race by acquiring an mmap read lock on init_mm over
__change_page_attr_set_clr().
This locks across the whole operation over which the walk and the PTE
entry write occurs, solving the race.
It is safe to do this here, as no spinlocks are held upon entry to
__change_page_attr_set_clr().
However, the lock must not be held over an allocation, as allocation can
trigger reclaim and shrinkers may call into CPA recursively, making
deadlocks possible (init_mm -> ... -> fs_reclaim -> init_mm).
A page table is allocated when a huge page needs to be split:
-> change_page_attr_set_clr()
-> __change_page_attr_set_clr()
-> __change_page_attr()
-> split_large_page()
[ pagetable_alloc() ]
-> __split_large_page()
Avoid deadlocks by dropping the mmap lock across pagetable_alloc() in
split_large_page() and track whether this is needed by adding a new
'init_mm_read_locked' flag to struct cpa_data.
This is safe as __split_large_page() (called with locks re-established)
revalidates that the page table entry is the same as it was prior to the
locks being dropped and __change_page_attr() repeats the entire page table
walk whenever a split occurs, so concurrent split and collapse are
accounted for.
Concurrent ptdump is also safe as the lock is only dropped over page table
allocation during which time the page table has not yet been modified.
The CPA_COLLAPSE flag is only set by set_memory_rox(), which exclusively
operates upon vmalloc ranges, and on x86 only within the module mapping
space.
This is important, because some callers directly invoke
__change_page_attr_set_clr(), bypassing this lock. However, none of these
operate within the module mapping space.
* cpa_process_alias() - a recursive helper called by
__change_page_attr_set_clr().
* __set_memory_enc_pgtable() - operates on the direct mapping and (via
__vmbus_establish_gpadl()) the vmalloc mapping space.
* __set_pages_[n]p() - called by set_direct_map_[invalid, default,
valid]_noflush(), __kernel_map_pages() - operates on the direct map.
* kernel_[un]map_pages_in_pgd() - operates on EFI ranges.
This work is based upon Denis V. Lunev's excellent analysis of the bug
with gratitude.
[ dhansen: move to imperative voice in changelog ]
Fixes:
|
||
|
Lorenzo Stoakes (ARM)
|
a1c7570ced |
x86/mm/pat: Acquire init_mm write lock on collapse to avoid UAF
x86 implements page attribute modification using its Change Page Attributes (CPA) mechanism. This tracks properties of ranges such as cache mode through x86 page attributes, and as part of that logic manipulates kernel page tables. Since commit: |
||
|
Linus Torvalds
|
893e11787f |
* AMD device topology and machine check fixes
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEV76QKkVc4xCGURexaDWVMHDJkrAFAmqgZ18ACgkQaDWVMHDJ krBVhw//cq1xgLpL9e3Y/U21cM0WVN/X02R8Q3TV7sN+x28SJTnN+ZMclwvhTtqZ F3wdprRbe/KKUZpA1PbxRdlApvHXGJw7QmveiBeO4P+solXVMxsLoEQsdDTRK6i0 dbkUxlEqi+0K4SpzrUa1HKE3fdTFEFDF+bVbm12dw1uOS7Le4qVmPx8xa2tvrWXb sELQzg5Qzt4VIm9ltx935rXUUVp7fFZDTdnOTqQqj7lPjxp8QdtfNR1kAyy2d1hF 1SdqeYJLLexZqYHSkr49xF4o3pdHoPz55O/isP+3drOReN3a2w9Pj3uADx/WdAH3 +vx1+qSejiSPwneoIdFxDnpayG/TOwpuEjwcnAlp5TVHQNIMzoqJKRsKd1PTaE2e P62VT3/BNEohlMGPjDZn6d9udUSzckJ9GwFOKOw0M4pqgRbU6Fs5mpJBbjvpyUzA pI9CRnDSQ2tUWXAr6vypvus5GFCxw7phalqeU0vv0D+u4VedjLpGa6M57QPOOOX1 BpHBb+0mBeFIVdr8NEKvRYPM8wR7dhUGv5AV2m7CsUP8M0uGHU3qNjst6bOzcitB m7vdKE9mJoxkQ/W1EEYI8xFGDsnKtlhAcA7eyFYbBqCpc83uXwDrV6mDgc+v7dTF vYzEctEkArJtfQ8zv40uSCivjamCK60SA3At1LyfKIuuQS1lNK4= =DVVF -----END PGP SIGNATURE----- Merge tag 'x86_urgent_for_7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Dave Hansen: "These are fixes for some older AMD device topology and machine check issues. But, they are issues that are affecting real users and aren't just cleaning up AI drive-by reports. These is coming a wee bit later than the usual Sundays because of a late breaking issue with one of the patches which is now temporarily kicked out" * tag 'x86_urgent_for_7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/MCE/AMD: Fix inverted interrupt enablement during storm handling x86/amd_node: Fix potential NULL pointer dereference x86/amd_node: Avoid divide by zero on virtualized systems |