mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-11-13 07:31:07 +00:00
1,485,420 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Ze Tan
|
9437f2113b |
smb/client: preserve open info type across compound queries
contains_posix_file_info describes the metadata stored in the
fi/posix_fi union. GET_REPARSE and QUERY_WSL_EA do not update that
union, so clearing the flag while processing those responses can make
POSIX metadata look like FILE_ALL_INFORMATION.
Set the flag when CREATE or a validated query response actually
populates the union, and leave it unchanged for auxiliary compound
operations. This also avoids changing the type when a query fails
before copying any metadata.
The issue can be reproduced against a Samba server with SMB3 UNIX
extensions enabled:
mount -t cifs //<server>/<share> /mnt/cifs \
-o vers=3.1.1,posix,reparse=nfs,actimeo=0
mkfifo /mnt/cifs/test-fifo
umount /mnt/cifs
mount -t cifs //<server>/<share> /mnt/cifs \
-o vers=3.1.1,posix,reparse=nfs,actimeo=0
stat -c '%F %s' /mnt/cifs/test-fifo
Before this change, stat reports "fifo 1024" although the server-side
EOF is zero. After this change, it reports "fifo 0".
Fixes:
|
||
|
Ze Tan
|
ebdc1afb1e |
smb/client: mark missing nlink values as unknown
Several SMB1 fallback and open responses do not provide the hard link
count. The SMB2 create-only query fallback has the same limitation.
These paths currently leave a zero link count or synthesize a value of
one and then expose it as authoritative metadata.
Mark those results with unknown_nlink so existing inodes keep their
cached link count and new inodes receive the usual sane default.
This was tested against Samba with "server min protocol = NT1". Mount
the share using SMB1 with Unix extensions disabled:
mount -t cifs //<server>/<share> /mnt/cifs \
-o username=<user>,vers=1.0,nounix
Create three names for the same inode and cache its real link count:
TESTDIR=/mnt/cifs/nlink-repro-$$
mkdir "$TESTDIR"
touch "$TESTDIR/file1"
ln "$TESTDIR/file1" "$TESTDIR/file2"
ln "$TESTDIR/file1" "$TESTDIR/file3"
stat -c 'before open: %h' "$TESTDIR/file1"
Open the file and read the link count through the open descriptor:
exec 3<"$TESTDIR/file1"
stat -Lc 'after open: %h' /proc/$$/fd/3
exec 3<&-
Clean up the test files:
rm -f "$TESTDIR/file1" "$TESTDIR/file2" "$TESTDIR/file3"
rmdir "$TESTDIR"
Before this change, the two stat commands report 3 and 1 because the
SMB1 open response overwrites the known link count. With this change,
both commands report 3.
Signed-off-by: Ze Tan <tanze@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
|
||
Frank Sorenson
|
48cab1fd57 |
cifs: fix clearing stats for fastest execution of each smb2 command
The code to clear the 'fastest_cmd' statistics has a typo that
repeatedly clears the stat for cmd 0, rather than iterating
through each cmd. Fix the typo (0->i).
Fixes:
|
||
Jakub Kicinski
|
b70b7b7156 |
bluetooth pull request for net:
Core: - hci_core: use skb_get() instead of skb_clone() for req_skb - hci_conn: re-enable advertising only for peripheral role - hci_event: clear HCI_LE_ADV only on a created connection - hci_sync: Clear HCI_CMD_PENDING when dropping the last request - hci_sync: add conditional locking annotations - hci_sync: do not leak an hci_conn when a second LE connect is rejected - eir: Fix OOB read in eir_get_service_data() - mgmt: fix 'hdev->discovery.uuids' NULL dereference - L2CAP: access chan->conn safely in get/setsockopt - L2CAP: reject accept queue add unless BT_LISTEN - L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan - RFCOMM: serialize security confirmation handling - RFCOMM: serialize session teardown - RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop - ISO: fix use-after-free of listener socket in iso_conn_ready Drivers: - btnxpuart: Validate the FW dump header length - btnxpuart: Check remote M.2 connector availability before pwrseq - btmtksdio: Take exclusive ownership of the SKB before TX - btmtksdio: Fix out-of-bounds DMA read in the TX path - hci_uart: Fix false success return in hci_uart_setup() - hci_bcm: fix usage_count leak when autosuspend_delay is negative - hci_h5: fix usage_count leak when autosuspend_delay is negative - hci_intel: fix usage_count leak when autosuspend_delay is negative - btmtk: Do not report success when subsys reset fails - btmtk: Do not discard the subsystem reset timeout - btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728 - hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378 -----BEGIN PGP SIGNATURE----- iQJNBAABCgA3FiEE7E6oRXp8w05ovYr/9JCA4xAyCykFAmqMhYgZHGx1aXoudm9u LmRlbnR6QGludGVsLmNvbQAKCRD0kIDjEDILKcEvD/9aWqXXH3K6WMwGtRnYUdjd LMqf8U/qA4h/hu+zk8+YIcpWkORDG4EWx01ZTZDnOeHi0/XREtEaKNZ6AbP91CXR J9ZGUVMAuhJ4SrE3gIBaAqw/1NA1m4ygL5i57tIfIdfgkye6nHPagyVUGWJmBAMr QLF8M6WmRghHhvElX69zk640o7v21/XadmpA02/78o/I73BNHBvBdZH/Dd8rGwAI +Z4TJ/tSRVJQO15MiutWu92tGMiFt7AN7Bzj1Xv6E+0yiOqCwOfXpGXq6ALGofZy 5iZ8BHWhvRTtj/4sSU2M9p/sH/dwbBW6CA69QL8CwAMnKPbARHwlx/nI5vXEVWKK Cb3ItdG65AoMV4+/vg0VuhbUmXDTk2ZI44KW2sunXcY/aVjA1O6afnIyFcQZ/JSr Fp+F/C8ZYtBDJqenX3d6KuHRUJtierkCSjWovetI3ty2BJ07jsb0RLb3BuEeJDtx RK1YiOlLTfFVaJCDgGcJ7CcOLlAN6EYv45WtlH395uLdSwNqNbS3GdvwyX2qSTjs 2MNXLYL0EnnjSBBKuvjl0Z50H5t8OYt+UDcZRiwPO1r4rWlilUC8jS19kH4qiTcm PXjtjtfc0PZiKnE5lF7aWY0gNbaPvUHHG/PCZQCd55s3DgKE8y+nap1v7f/5gvMD wV4Wga1ecjWjJUbMzGkAoA== =q5DT -----END PGP SIGNATURE----- Merge tag 'for-net-2026-08-24' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: Core: - hci_core: use skb_get() instead of skb_clone() for req_skb - hci_conn: re-enable advertising only for peripheral role - hci_event: clear HCI_LE_ADV only on a created connection - hci_sync: Clear HCI_CMD_PENDING when dropping the last request - hci_sync: add conditional locking annotations - hci_sync: do not leak an hci_conn when a second LE connect is rejected - eir: Fix OOB read in eir_get_service_data() - mgmt: fix 'hdev->discovery.uuids' NULL dereference - L2CAP: access chan->conn safely in get/setsockopt - L2CAP: reject accept queue add unless BT_LISTEN - L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan - RFCOMM: serialize security confirmation handling - RFCOMM: serialize session teardown - RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop - ISO: fix use-after-free of listener socket in iso_conn_ready Drivers: - btnxpuart: Validate the FW dump header length - btnxpuart: Check remote M.2 connector availability before pwrseq - btmtksdio: Take exclusive ownership of the SKB before TX - btmtksdio: Fix out-of-bounds DMA read in the TX path - hci_uart: Fix false success return in hci_uart_setup() - hci_bcm: fix usage_count leak when autosuspend_delay is negative - hci_h5: fix usage_count leak when autosuspend_delay is negative - hci_intel: fix usage_count leak when autosuspend_delay is negative - btmtk: Do not report success when subsys reset fails - btmtk: Do not discard the subsystem reset timeout - btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728 - hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378 * tag 'for-net-2026-08-24' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: (27 commits) Bluetooth: RFCOMM: serialize session teardown Bluetooth: do not leak an hci_conn when a second LE connect is rejected Bluetooth: RFCOMM: serialize security confirmation handling Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728 Bluetooth: hci_uart: Fix false success return in hci_uart_setup() Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection Bluetooth: hci_conn: re-enable advertising only for peripheral role Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378 Bluetooth: eir: Fix OOB read in eir_get_service_data() Bluetooth: btnxpuart: Validate the FW dump header length Bluetooth: hci_sync: add conditional locking annotations Bluetooth: btnxpuart: Check remote M.2 connector availability before pwrseq Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX Bluetooth: btmtk: Do not discard the subsystem reset timeout Bluetooth: btmtk: Do not report success when subsys reset fails Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan ... ==================== Link: https://patch.msgid.link/20260824180639.3570348-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
Linus Torvalds
|
66498c75b4 |
dmaengine updates for v7.3
Core:
- New API to combine configuration and preparation and users
New Support:
- Mediatek MT8189 SoC uart dma support
Updates:
- Designware dma driver flatten desc structures and simplify code,
interrupt-path groundwork changes, first part of PCI EP DMA support
- Updates to zynqmp_dma with runtime PM and device removal improvments
- Xilinx dma optimizations for AXIDMA and MCDMA channel management
-----BEGIN PGP SIGNATURE-----
iQIyBAABCgAdFiEE+vs47OPLdNbVcHzyfBQHDyUjg0cFAmqMgZEACgkQfBQHDyUj
g0e82w/4oLwj2QUjUO3QEO2l4E/RVS2/7UyCYKoJDAh66aM8Z3QjQ+lUvy+4wHHE
H8AtTpRzGEPpqqU+BckHEySf8mNhlA4ULhX17aPc+NKqYNlW8p2L63kPFYggI1ja
Z6/zVFrJDLwWTI0bSxAyJ6OoaObSXY0P6qpMcXKcqoHc981+EHMGrt/iVJM4Et/c
Q6nFMxIMgxYPI1VCMSrJqOBA4ZvymyWBisJPZf6SK0iH3PnaBnGWWWilpT8eUJxm
/MbVf2aUMetdK1+QVx1nNQUdb1eyAw50zFgbeDFDTXQ85Mfbvwh8XxxuT4wXJS5b
8MFwIEUq6iRgyjZYlykmFYBXw1A3SZWuWMUuMic4l13lw7dxk92wR31j99pIRaV3
g2iykz+gzQNQ5RNPuo/9j0s26FAmMNxbFW1RPAMnoVc33vZakV4ueaYtIy7s7mMJ
eDrE6YNDW24DWfWrSxkQGCW1qFGBUY20dXZ0sBmhUxpTLB0ubPZrWLvKKZe/qTUJ
wmrGNtTBLAYJMsGBm5VMybXwrQXa2Hvqa6KKFR2TdjpdcJwyWVHzRPpR+sJ7GfxZ
Lz59ODW3x1MnukRQS/T+RXGT42Tzk+qQQ+xK/yCrXq0VkxE3010n7SglTEEygGYP
Zk2eos4fARpXOUNqAxoKTVRyvQBxrIrHuJuQjAys2RhLHARuCQ==
=lUcr
-----END PGP SIGNATURE-----
Merge tag 'dmaengine-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine
Pull dmaengine updates from Vinod Koul:
"Core:
- New API to combine configuration and preparation and users
New hardware support:
- Mediatek MT8189 SoC uart dma support
Updates:
- Designware dma driver flatten desc structures and simplify code,
interrupt-path groundwork changes, first part of PCI EP DMA support
- Updates to zynqmp_dma with runtime PM and device removal
improvments
- Xilinx dma optimizations for AXIDMA and MCDMA channel management"
* tag 'dmaengine-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: (73 commits)
dmaengine: dw-edma: Mark emulated IRQ as level-triggered
dmaengine: idxd: assign all engines to group 0 in IAA defaults
dmaengine: qcom_hidma: remove conditional return with no effect
dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal
dmaengine: fsl-edma: tracing: no ptr dereference during log output
dmaengine: dw-edma: Program endpoint function numbers
dmaengine: dw-edma-pcie: Add chip flags to match data
dmaengine: dw-edma-pcie: Handle optional data blocks
dmaengine: dw-edma-pcie: Factor out descriptor block address lookup
dmaengine: dw-edma-pcie: Add register offset match flag
dmaengine: dw-edma-pcie: Add platform ops to match data
dmaengine: dw-edma-pcie: Rename vsec_data to dma_data
dmaengine: dw-edma-pcie: Add capability match data
dmaengine: dw-edma-pcie: Track non-LL mode in DMA data
dmaengine: dw-edma: Add partial channel ownership mode
dmaengine: dw-edma: Initialize IRQ data before requesting IRQs
dmaengine: dw-edma: Add core quiesce operations
dmaengine: dw-edma: Add per-channel interrupt routing control
dmaengine: dw-edma: Factor out HDMA interrupt setup helper
dmaengine: dw-edma: Defer channel IRQ handling to workqueue
...
|
||
|
Linus Torvalds
|
16e6a1a3cb |
phy updates for 7.3
As usual bunch of new device and driver support and updates to existing
drivers and addition of Manivannan to help with reviews.
- New Support
- Mediatek MT8196 DSI PHY support
- Renesas RZ/G3L usb2 support
- Qualcomm SM8475 QMP USB PHY and PCIe phy, IPQ9650 QMP PCIe PHY, QUSB2
Phy for Shikra SoC, Hawi support for QMP PCIe phy and UFS PHY. Glymur
QMP PCIe Multi-PHY driver and multiple link-mode support, ipq5210 PCIe
phy support
- Spacemit USB3/PCIe comb PHY driver
- Updates
- Samsung hdptx driver improvements for modernizing the register
access and code cleanup
- Qualcomm drop duplicate v8 DP headers, improved runtime handling for qmp
drivers
- Rockchip clock lane phase tuning and 2500 Mbps support and TMDS rate
handling
- Freescale imx8mq improvements for runtime pm, pd handling.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE+vs47OPLdNbVcHzyfBQHDyUjg0cFAmqMf1YACgkQfBQHDyUj
g0cx8g/+M2Thg88JXJ1HIbcCD/Dh6gtsZHmnfW71EUxIE//QKV950PE1Oqu/Va7i
Z9YRonkGjzyuYFJZixW/C8OzL5lqy1vp62t/qbUa1Q4UKawhI+ALEUBrWXkozxyR
LKM9OSoNTxUa40vJrb54MkiouTrwGOhOPhf0LB6QaIDkQqae5/10uux5TsGdvU57
pVDC2SIAZaYg4a3xcv0sFVORDuMhPMSGZyjDR2CDSaAdR3H4kau5mfY7+98w8T6u
dt7wEWThUSFXTSPbHER3zj2JEHlaG/EcOzAmwy44ttqTdqP7X12O4nnJeDE08ymb
/sib42WwQvL3OwXgzBOKOIF7P6g6691I15lMLIMtGj9j2wyimDchO7YGRcNxtJTt
3x96YbWABmDbrQblWXZcKro/PG13i0tMxmm4W0HYcCtK5sCvhWpHjwV3n46y6Kuv
cxgQpsrRwYNGWgMOai9X0ft5tXn5uqFyaGiolPBo7IlOLtbsTuG6Q2H8QbxJKokf
KjiYofA0EXrp/DtBnSlA1x7S5ODTRi25soHTIvrlJlljls4vRrqV4ZU33peicDY5
XbXlIX4XOu7pxNtDSpQYoWXnIIDo9/QfpJy4YUlVdGZTtLDcLW98Aqwxre/FWWUj
c8FeNDGSj0vPaL7Pm8XF4PXmKTW6xjf2MToFcUlAcJsEFsfm1XM=
=Hg5e
-----END PGP SIGNATURE-----
Merge tag 'phy-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy
Pull phy updates from Vinod Koul:
"As usual bunch of new device and driver support and updates to
existing drivers and addition of Manivannan to help with reviews.
New Support:
- Mediatek MT8196 DSI PHY support
- Renesas RZ/G3L usb2 support
- Qualcomm SM8475 QMP USB PHY and PCIe phy, IPQ9650 QMP PCIe PHY,
QUSB2 Phy for Shikra SoC, Hawi support for QMP PCIe phy and UFS
PHY. Glymur QMP PCIe Multi-PHY driver and multiple link-mode
support, ipq5210 PCIe phy support
- Spacemit USB3/PCIe comb PHY driver
Updates:
- Samsung hdptx driver improvements for modernizing the register
access and code cleanup
- Qualcomm drop duplicate v8 DP headers, improved runtime handling
for qmp drivers
- Rockchip clock lane phase tuning and 2500 Mbps support and TMDS
rate handling
- Freescale imx8mq improvements for runtime pm, pd handling"
* tag 'phy-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: (76 commits)
MAINTAINERS: Add Manivannan Sadhasivam as the Reviewer for Generic PHY Framework
phy: rockchip-samsung-dcphy: fix out-of-range max_register
phy: qcom: qmp-pcie: Add QMP PCIe Multi-PHY driver
dt-bindings: phy: qcom: Add Glymur QMP PCIe multiple link-mode PHY
phy: rockchip: samsung-hdptx: Consistently use bitfield macros
phy: rockchip: samsung-hdptx: Simplify GRF access with FIELD_PREP_WM16()
phy: rockchip: samsung-hdptx: Drop restrict_rate_change handling
phy: rockchip: samsung-hdptx: Consolidate consumer_put on error path
phy: rockchip: samsung-hdptx: Drop TMDS rate setup workaround
phy: rockchip: samsung-hdptx: Handle uncommitted PHY config changes
phy: rockchip: samsung-hdptx: Fix rate recalculation for 3.2GHz FRL
phy: rockchip: samsung-hdptx: Guard against clk rate integer underflow
phy: rockchip: samsung-hdptx: Prevent divide-by-zero when computing clk rate
phy: rockchip: samsung-hdptx: Fix rate recalculation for high bpc
phy: qcom: qmp-combo: Drop qmp_v4_calibrate_dp_phy
phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs
phy: renesas: rcar-gen3-usb2: Ignore missing VBUS regulator
phy: qcom: qmp-pcie: Add support for SM8475 Gen3x1 PCIe0 port
phy: qcom: qmp-pcie: Add pcs_lane1 offset to V5 offsets
dt-bindings: phy: qcom,sc8280xp-qmp-pcie-phy: Add SM8475 QMP PHY
...
|
||
|
Linus Torvalds
|
ab9b9b51ba |
soundwire updates for 7.3
- Bunch of Intel dmi quirks ghost list handling for Asus Zenbook Duo, Asus
ROG Zephyrus Duo and Asus Expertbook. Intel Peripheral
bra_block_alignment handling
- Cadence library BRA_NumBytes[8] support
- Qualcomm SCP address paging, bus mclk_freq support. Increase of data
ports to 17 and driver improvements.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE+vs47OPLdNbVcHzyfBQHDyUjg0cFAmqMd8kACgkQfBQHDyUj
g0dBjg/+Po6cyEfCuBH88IMxUBrcpjODyRdKDMNdM3MxBxYTJQiJmQPO60OwLOR/
EGDPDUTqrzDt5HwmalgnyM+gEl7aLknwMAmJoK0gCw9BiO/1RfcXPEmLdoIJtrzG
r2GnDuGzQBpxP//af7/b3N89eTCI3HKBLCHpYapyqFrhbniKHO9uDYsnBTzgz4NI
GK6WJU5hqx7n92zvruQZIkHYijhYgkRru566eOBx8sDhO+w9lELHDTm7TmW8Qrwo
XV1jMlPep9edClwYT9MwfEXe8ICwh0gShM3kWrhdi/i1OeEsT0VCa1NzNh14OOuV
h4LlT0byLDGvx1zzCeDPEG5ZRqO8wdNwe7/1HeR5VD9Sn0pcEZKDWbzFVsiWTnqG
/QKGjbylbenKZHfaL5EvnyiWhEXLv2t0qiiSWGbT+qEGa2Jk+IL6vps3Kr6dhNcg
7KZHs5KAag3DTNAtF/W6n7/Ut9rfz6GI4f7acDSfsHz3gRenLqPQmZeAQLX1rtMR
/A24EMNWkan2ffxMIGgBigQ6WiAVyuUDQFLr1yefhjIGN3+WTTtE/gGaAn+8xbdd
o1CBUneoRQ3WtdRCljhBIAfM4HdS1i4GxIdvqrcDu1jmIYLsxs2HJIs24uZOC6Mk
KgnoJbHsiriJ5CvoM5s6eKBI9jsx6XdT/KsLyHwLvVvSnzczIRM=
=rjmH
-----END PGP SIGNATURE-----
Merge tag 'soundwire-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire
Pull soundwire updates from Vinod Koul:
- Intel dmi quirks ghost list handling for Asus Zenbook Duo,
Asus ROG Zephyrus Duo and Asus Expertbook. Intel Peripheral
bra_block_alignment handling
- Cadence library BRA_NumBytes[8] support
- Qualcomm SCP address paging, bus mclk_freq support. Increase of
data ports to 17 and driver improvements
* tag 'soundwire-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire:
soundwire: dmi-quirks: Disable ghost Realtek on Asus ROG Zephyrus Duo
soundwire: stream: validate slave port properties
soundwire: honor clock_reg_supported in the clock scaling check
soundwire: qcom: set the bus mclk_freq property
soundwire: dmi-quirks: Disable ghost Realtek on Asus Zenbook Duo
soundwire: intel_ace2x: handle the max_data_per_frame property
soundwire: get mipi-sdw-bra-mode-max-data-per-frame property
soundwire: intel: handle Peripheral bra_block_alignment
soundwire: Add bra_block_alignment property support
soundwire: cadence_master: add BRA_NumBytes[8] support
soundwire: bus.h: repair kernel-doc comments
soundwire: intel_auxdevice: Add cs42l44 to wake_capable_list
soundwire: qcom: add SCP address paging support
soundwire: dmi-quirks: add a global ghost list
soundwire: dmi-quirks: Disable ghost Realtek on Asus Expertbook
soundwire: qcom: Allocate sruntime array dynamically
soundwire: qcom: Fix port exhaustion check in stream_alloc_ports
dt-bindings: soundwire: qcom: Increase max data ports to 17
|
||
Sai Krishna
|
3b11a77f69 |
octeontx2-af: fix cn20k mailbox lifetime on repeated rvu_mbox_init()
rvu_mbox_init() is called separately for AF-PF mailboxes during probe
and for AF-VF mailboxes when SR-IOV is enabled. Each call used to
allocate a new ng_rvu object, leaking the first allocation when the
pointer was overwritten on the second call.
Sharing one ng_rvu across both paths exposed several teardown bugs:
the error path freed all cn20k mailbox DMA and kfree()d ng_rvu even
when only the failing init type should be unwound, leaving live AF-PF
mailbox memory in use after an AF-VF init failure. mutex_init() was
also re-run on the AF-VF path while AF-PF mailbox handlers could still
hold rvu->mbox_lock. Probe and SR-IOV failure paths did not release
cn20k mailbox DMA either, since cleanup only happened in rvu_remove().
Allocate ng_rvu once with devm_kzalloc(), initialize mbox_lock in the
same block, unwind only the mailbox memory for the failing init type,
and free cn20k mailbox DMA from the probe and pci_enable_sriov()
error paths.
Fixes:
|
||
Suman Ghosh
|
b09a0503c7 |
octeontx2-pf: fix NULL deref of af_xdp_zc_qidx on rep setup
af_xdp_zc_qidx tracks receive queues using AF_XDP zero-copy and is
allocated during PF/VF probe. Representors and other non-AF_XDP paths
leave the pointer NULL, but several call sites used test_bit() on it
unconditionally.
Switching to devlink eswitch mode creates representors and runs
otx2_init_hw_resources(), which reaches otx2_pool_aq_init() and oopses
when dereferencing the NULL bitmap. Add NULL checks before every
af_xdp_zc_qidx test_bit() use in the RSS, ethtool, XSK, and pool init
paths.
Fixes:
|
||
Alexandra Winter
|
80230a18c1 |
net/iucv: filter frames in afiucv_hs_rcv() by ingress device
afiucv_hs_rcv() selects a socket from iucv_sk_list by matching four 8-byte
name fields in the transport header alone. No check is made against the
net_device the frame arrived on.
This can cause a frame arriving on any netdev to be delivered to an AF_IUCV
socket. Three problems follow.
First, a frame arriving over HiperSockets can be delivered to a socket
bound to the classic z/VM IUCV transport, which has iucv->hs_dev == NULL.
iucv_sock_bind() takes the classic path whenever the requested userid
matches iucv_userid, even on a guest that also has a HiperSockets device
carrying the same identifier. The child socket created by
afiucv_hs_callback_syn() for such a match inherits hs_dev = NULL and
transport = AF_IUCV_TRANS_HIPER, so the first send() on it returns -ENODEV.
The socket delivered to accept() is unusable.
Second, a frame arriving on one netdev can be delivered to a socket bound
to a different IQD device. Which can lead to
- Accept-queue exhaustion (DoS)
- Attacker-controlled peer identity in the child socket
- Data injection into existing sockets
- Fabric noise on the IQD fabric, where bogus replies are sent
- killing established connections
Third, all AF_IUCV sockets live in init_net, as iucv_sock_alloc() calls
sk_alloc(&init_net, ...). But even frames arriving on netdev devices in a
namespace can be delivered to an IUCV socket. So a process in an
unprivileged user and network namespace holding only the CAP_NET_RAW
capability valid within that namespace can send a raw ETH_P_AF_IUCV frame
on its own lo device and have it matched against init_net sockets.
Fix all three by skipping any socket whose hs_dev does not match the
ingress device. A classic z/VM IUCV socket has hs_dev == NULL; the ingress
dev is never NULL, so classic sockets are skipped automatically. An unbound
HIPER socket also has hs_dev == NULL and is skipped. A bound HIPER socket
is only reachable from the exact IQD device it was bound to. Because hs_dev
is always a device in init_net (iucv_sock_bind() scans
for_each_netdev_rcu(&init_net, ...) exclusively), a frame whose ingress
device belongs to another namespace never matches any socket.
Note that AF_IUCV over HiperSockets provides no per-connection
authentication: no sequence numbers, no TLS, no nonce. The four name fields
identifying a connection are exchanged in plaintext on the shared
HiperSockets segment (VCHID). Any host on the same HiperSockets segment
could spoof any frame type against an existing connection. That is a
protocol-level property unchanged by this patch. The fix reduces the attack
surface to peers present on the same HiperSockets segment.
Fixes:
|
||
Allison Henderson
|
d4f4846619 |
net/rds: use wq_has_sleeper() in rds_cong_map_updated()
rds_cong_map_updated() runs after a peer's congestion map has been
rewritten (by rds_tcp_cong_recv() and rds_ib_cong_recv(), or the
clear-all in the loopback and IB send-completion paths). It bumps
rds_cong_generation and then checks waitqueue_active() on
map->m_waitq and on rds_poll_waitq to decide whether anyone needs
waking. atomic_inc() carries no ordering and waitqueue_active() is a
plain load, so nothing orders the map and generation stores before
the wait queue reads. The waiters do the mirror image: rds_cong_wait()
adds itself to m_waitq and then tests the port bit, and rds_poll()
registers on rds_poll_waitq and then reads the generation. That is
the store-buffering pattern described above waitqueue_active() in
include/linux/wait.h - the updater can observe an empty wait queue
while the waiter still observes the port as congested, and no wake-up
is issued.
rds_cong_wait() is an interruptible sleep with no timeout, so a
sender blocked on a congested port stays blocked until the next
congestion update from that peer arrives or a signal is delivered.
A poll() waiter misses the map-updated notification the same way.
Use wq_has_sleeper(), which is waitqueue_active() preceded by the
required full barrier, as rds_tcp_state_change() already does for
the same pattern.
Fixes:
|
||
Long Li
|
2c7493f980 |
net: mana: Cap MSI-X vectors to the device MSI-X table size
mana_gd_query_max_resources() sizes gc->num_msix_usable from resp.max_msix
and the CPU count, but never from the device MSI-X table. On a 1792 vCPU
M-series VM that yields 1793 while the table has 1024 entries, and
mana_gd_setup_remaining_irqs() then walks indices 1..1792, running off the
end of the region mapped by msix_map_region():
BUG: unable to handle page fault for address: ff8e347f8b99800c
RIP: 0010:msix_prepare_msi_desc+0x7a/0x90
RAX: 0000000000004000 RBX: ff4330cb164ea780 RCX: ff8e347f8b998000
Call Trace:
<TASK>
__msi_domain_alloc_irqs+0x13a/0x440
msi_domain_alloc_irq_at+0x149/0x1b0
mana_gd_setup+0x351/0x890
mana_gd_probe+0x274/0x390
</TASK>
RAX is index 1024 * PCI_MSIX_ENTRY_SIZE, one entry past the table.
msi_insert_desc() does range check the index, but only against the MSI
domain hwsize, which matches the table only for devices on an MSI parent
domain. With a global PCI/MSI domain hwsize is MSI_XA_DOMAIN_SIZE, so
nothing bounds the request.
Cap num_msix_usable with pci_msix_vec_count().
Fixes:
|
||
Victor Nogueira
|
5b483f7791 |
net/sched: act_ife: Only operate on Ethernet frames
act_ife encapsulates/decapsulates the original Ethernet header and uses
skb->dev->hard_header_len as the length of that header. That is only
correct for Ethernet devices: on a device where hard_header_len does not
match the L2 header that was actually pulled (PPP reports PPP_HDRLEN
while nothing is stripped on ingress), the ingress skb_push()/skb_pull()
use the wrong length and can hit skb_under_panic when headroom is tight.
IFE is Ethernet-only by design - it builds an outer ethhdr, rewrites
h_source/h_dest/h_proto, and calls eth_type_trans() on decode - so
instead of trying to make the offsets work for arbitrary link types,
simply drop packets that do not carry an Ethernet header.
Checking skb->dev->type alone is not enough. We have to cater for a
corner case where mirred can redirect an skb from a non-Ethernet device
to an Ethernet one, and skb->dev then says nothing about the framing the
skb actually has: an skb redirected from ppp0 reaches the target's ingress
hook with mac_len 0 and no Ethernet header at all. So at ingress also
require mac_len to be ETH_HLEN. On egress mac_len is not maintained, so
the device type is all we have; a bogus redirect there yields a malformed
frame rather than an out-of-bounds push, and it would be malformed with or
without IFE.
That corner case is not theoretical - redirecting from ppp0 into a veth
that has an ife encode action on its ingress hook panics without this
patch:
skbuff: skb_under_panic: len:98 put:14 head:ffff88800e410000
data:ffff88800e40fff5 tail:0x57 end:0x640 dev:veth3
kernel BUG at net/core/skbuff.c:214!
Call Trace:
skb_push (net/core/skbuff.c:224 net/core/skbuff.c:2657)
tcf_ife_act (net/sched/act_ife.c:829 net/sched/act_ife.c:874)
tc_run (net/core/dev.c:4463)
netif_receive_skb (net/core/dev.c:6463 net/core/dev.c:6522)
tcf_mirred_to_dev (net/sched/act_mirred.c:248 net/sched/act_mirred.c:328)
tcf_mirred_act (net/sched/act_mirred.c:489)
tc_run (net/core/dev.c:4463)
process_backlog (net/core/dev.c:6728)
With Ethernet framing guaranteed, use ETH_HLEN instead of
hard_header_len.
Fixes:
|
||
Manush Prajwal
|
5c07193ebe |
net: ethernet: renesas: rswitch: fix device_node refcount leak in rswitch_get_port_node()
On an of_property_read_u32() failure, rswitch_get_port_node() set port to NULL and jumped to the out label before releasing the reference the for_each_available_child_of_node() iterator was holding on it. Once port was overwritten with NULL, that reference could never be released since out: only put "ports", the parent node. Rework the function around for_each_available_child_of_node_scoped() instead of adding a manual of_node_put(), so the iterator's reference is dropped automatically on every exit path. Since port is the function's return value, take an explicit reference with of_node_get() on the match before breaking out of the loop. Signed-off-by: Manush Prajwal <manushprajwal555@gmail.com> Link: https://patch.msgid.link/6a882352.ee10049a.267d65.7a31@mx.google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Jakub Kicinski
|
01ba856c36 |
Merge branch 'net-enetc-restore-rx-ring-congestion-mode-after-ring-reconfiguration'
Wei Fang says: ==================== net: enetc: restore RX ring congestion mode after ring reconfiguration The RX BD ring congestion mode (CM) enables the ENETC MAC to generate PAUSE frames when ingress congestion occurs. It is configured only in the phylink .mac_link_up() callback, which is invoked when the link status changes. However, enetc_reconfigure() tears down and re-creates the RX BD rings at runtime without any link status change, for example when enabling or disabling PTP RX hardware timestamping. enetc_setup_rxbdr() rebuilds the RBMR register from zero, which clears the CM bit, and since the link status does not change, .mac_link_up() is not called again to restore it. As a result, flow control silently stops working after such a reconfiguration. To solve this issue, track the desired CM state in a software flag ENETC_RXBDR_CM, which is maintained by the .mac_link_up() / .mac_link_down() callbacks and consulted by enetc_setup_rxbdr() when the RX BD rings are (re)configured. Both ENETC v1 and ENETC v4 are affected and are fixed in the same way. ==================== Link: https://patch.msgid.link/20260821064140.1315611-1-wei.fang@oss.nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
Wei Fang
|
fa1a8457b8 |
net: enetc: restore RX ring congestion mode for ENETC v4
ENETC v4 has the same problem as ENETC v1: the RX BD ring congestion
mode (CM) is only configured in the phylink .mac_link_up() callback, so
it is cleared when enetc_reconfigure() rebuilds the RX BD rings at
runtime (for example when enabling or disabling PTP RX hardware
timestamping) without a link status change, and it is never restored.
As a result, the MAC can no longer generate PAUSE frames on ingress
congestion and flow control stops working.
Fix it in the same way as ENETC v1. Track the desired CM state in the
software flag ENETC_RXBDR_CM. Route enetc4_set_tx_pause() through the
shared helper enetc_set_congestion_mode(), which sets or clears the flag
according to tx_pause and updates the ENETC_RBMR_CM bit under si->gen_lock.
When the RX BD rings are (re)enabled, enetc_enable_rxbdr() consults this
flag and restores the CM bit accordingly, so flow control survives ring
reconfiguration even when the link status does not change.
Fixes:
|
||
|
Wei Fang
|
9e94d8e14a |
net: enetc: restore RX ring congestion mode after ring reconfiguration
The RX ring congestion mode (CM) is only configured in the phylink
.mac_link_up() callback enetc_pl_mac_link_up(), which sets the
ENETC_RBMR_CM bit when tx_pause is enabled. This callback runs only when
the link status changes.
However, enetc_reconfigure() tears down and re-creates the RX BD rings at
runtime without any link status change, for example when attaching or
detaching an XDP program, or when enabling/disabling PTP RX hardware
timestamping. The rings are rebuilt from a cleared RBMR, so the CM bit is
lost. Since the link status does not change, enetc_pl_mac_link_up() is
not called again and the CM bit is never restored.
As a result, the ENETC MAC can no longer generate PAUSE frames on ingress
congestion, and flow control stops working after such a reconfiguration.
Track the desired CM state in a software flag ENETC_RXBDR_CM. Set or clear
this flag in enetc_pl_mac_link_up() according to tx_pause. When the RX BD
rings are (re)enabled, enetc_enable_rxbdr() consults this flag and restores
the ENETC_RBMR_CM bit accordingly, so flow control survives ring
reconfiguration even when the link status does not change.
RBMR is now written as a whole word from enetc_enable_rxbdr() rather than
by read-modify-write from several call sites. Serialize the remaining RBMR
read-modify-write paths, the congestion mode update and the RX VLAN offload
update, with the new si->gen_lock so they cannot race each other.
Fixes:
|
||
Naveen Mamindlapalli
|
9edf8d4876 |
octeontx2-af: Fix TL3/TL2 link config ENA clearing
Clear and restore the ENA bit for each TL3/TL2 link entry during
SMQ flush instead of repeatedly using the same link index.
Fixes:
|
||
|
Jakub Kicinski
|
c745d091fc |
Merge branch 'net-smc-fix-use-after-free-in-smc_rx_pipe_buf_release'
Hidayath Khan says: ==================== net/smc: fix use-after-free in smc_rx_pipe_buf_release() smc_rx_pipe_buf_release() tests sk_state before taking the socket lock and then dereferences conn->rmb_desc and conn->lgr. A concurrent close runs smc_conn_free() in between, which releases those structures. On the is_reg_err path smcr_buf_unuse() frees the descriptor outright, so this is a use-after-free. Patch 2/2 fixes this by taking the socket lock first and testing conn->freed instead. smc_conn_free() sets that flag before releasing anything, under the same lock, so the two paths exclude each other. Patch 1/2 is a prerequisite. conn->freed shares a byte with killed and out_of_sync as single-bit bitfields. out_of_sync is written from the receive tasklet without the socket lock, so a concurrent store to freed from process context can be lost in the read-modify-write. Patch 1/2 gives each flag its own byte so stores do not interfere. ==================== Link: https://patch.msgid.link/20260820074642.966856-1-hidayath@linux.ibm.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
Hidayath Khan
|
c924884743 |
net/smc: fix use-after-free in smc_rx_pipe_buf_release()
smc_rx_splice() hands RMB pages to a pipe and takes a socket reference
per entry so the smc_sock stays alive until the reader finishes. The
connection does not: a concurrent close runs smc_conn_free(), which
releases the receive buffer back to the link group pool.
smc_rx_pipe_buf_release() tests sk_state before taking the socket lock.
The state can change between the test and the lock, and
smc_rx_update_cons() then dereferences conn->rmb_desc and walks
conn->lgr, which smc_conn_free() has already released. On the
is_reg_err path smcr_buf_unuse() frees the descriptor outright, so
this is a use-after-free.
Take the socket lock first and test conn->freed instead.
smc_conn_free() sets that flag before releasing anything, and every
caller holds the socket lock. The two paths exclude each other: either
the pipe release runs first with everything valid, or it sees the flag
and skips the update.
Fixes:
|
||
|
Hidayath Khan
|
db51a8658c |
net/smc: stop killed, freed and out_of_sync sharing a byte
The three connection state flags are single-bit bitfields, so they occupy
one byte of struct smc_connection and every store to one is a
read-modify-write of the other two:
u8 killed : 1;
u8 freed : 1;
u8 out_of_sync : 1;
They are not written under a common lock. smc_cdc_msg_validate() sets
out_of_sync from the receive tasklet, while smc_conn_kill() sets killed
from process context under lock_sock(), and the receive path does not defer
to the backlog when the socket is owned -- smc_cdc_msg_recv() takes only
bh_lock_sock().
Give each flag its own byte so a store no longer touches its neighbours.
All readers test them as booleans and are unchanged. struct smc_connection
grows by two bytes.
Fixes:
|
||
|
Hidayath Khan
|
719296c4aa |
net/smc: fix socket refcount leak in smc_switch_conns()
smc_switch_conns() takes a reference on the SMC socket before dropping
lgr->conns_lock, so the connection stays alive while the CDC slot is
fetched:
sock_hold(&smc->sk);
read_unlock_bh(&lgr->conns_lock);
/* pre-fetch buffer outside of send_lock, might sleep */
rc = smc_cdc_get_free_slot(conn, to_lnk, &wr_buf, NULL, &pend);
if (rc)
goto err_out;
The err_out label only drops the wr_tx link reference, so this early exit
returns without the matching sock_put(). The second error exit is not
affected, because sock_put() has already run by then.
A leaked sk_refcnt means the smc_sock is never destroyed. Its send and
receive buffers stay allocated, and for a user socket the reference held
on the network namespace is never released, so the netns can no longer be
torn down.
smc_cdc_get_free_slot() fails when the target link goes down or when the
connection has been killed while the switch is in progress. Both are
reachable during the link failover this function implements, so the leak
is triggered by the same hardware events that make smc_switch_conns() run
in the first place.
Restructure so there is a single sock_put() covering both outcomes,
instead of adding a second one to the error path.
Fixes:
|
||
Md Rabbani
|
317fe168f4 |
net: stmmac: fix device node reference leaks in stmmac_mtl_setup()
In stmmac_mtl_setup(), q_node is shared across the RX and TX queue parsing loops. When the RX queue loop breaks early because the number of parsed queues reaches plat->rx_queues_to_use, q_node retains an acquired reference count. If the error check passes (queue == plat->rx_queues_to_use), execution proceeds directly to the TX queue loop, where of_get_next_child() immediately overwrites q_node with the first TX child, permanently leaking the retained RX child device node reference. Switch both loops to for_each_child_of_node_scoped() so child node references are automatically dropped upon loop exit or early break, and remove the now-unnecessary function-scoped q_node variable and its manual of_node_put() at the exit label. Signed-off-by: Md Rabbani <rabbanyhmm@gmail.com> Link: https://patch.msgid.link/20260821055718.57-1-rabbanyhmm@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
Zihan Xi
|
af20e269f7 |
net: l2tp: do not propagate multicast notification errors
The tunnel create, tunnel modify, session create, and session modify
netlink handlers send multicast notifications through helpers that can fail
while allocating or encoding a message, or while multicasting it.
For tunnel and session create/modify, a notification is sent after the live
operation has completed. Returning a best-effort notification error as the
command result can therefore report failure for an operation that already
committed and can cause callers to retry and accumulate live objects.
Keep sending notifications for listener visibility, but do not propagate
their best-effort status as the command result. This also keeps the tunnel
modify command consistent with the other notification-only paths.
Fixes:
|
||
Xiang Mei
|
a66734a1c5 |
net: qualcomm: rmnet: restore skb->dev on deaggregated frames
rmnet_map_deaggregate() allocates each sub-frame with alloc_skb() and leaves skb->dev NULL. __rmnet_map_ingress_handler() assigns skb->dev = ep->egress_dev only on the data path, but a MAP command frame is dispatched to rmnet_map_command() before that, so rmnet_map_send_ack() runs netif_tx_lock(skb->dev) on a NULL device. An unprivileged user reaches this by unsharing a user+net namespace, creating an rmnet link over a tap device with INGRESS_DEAGGREGATION and INGRESS_MAP_COMMANDS, and writing an aggregated frame carrying a flow-control command to the tap fd. Restore the assignment dropped by |
||
|
Jakub Kicinski
|
0a90e8f4e2 |
Merge branch 'selftests-net-fixes-for-fin_ack_lat'
Qingshuang Fu says: ==================== selftests/net: fixes for fin_ack_lat This series fixes two bugs in the fin_ack_lat self-test. Patch 1 fixes the swapped kill() arguments in sig_handler(), so the server actually forwards SIGTERM to the client. It also makes the wrapper script's cleanup tolerant of ESRCH, since the client may now exit before the kill command reaches its PID. Patch 2 adds a missing fork() error check: on failure the code falls into server()'s infinite accept loop, producing empty output that the wrapper script treats as a passing test. ==================== Link: https://patch.msgid.link/20260821030922.1123754-1-fffsqian@163.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
Qingshuang Fu
|
11e41444a3 |
selftests/net: check fork() return value in fin_ack_lat
main() never checks fork() for failure. When fork() returns -1 (EAGAIN/ENOMEM/RLIMIT_NPROC), the !child_pid test is false and the process falls into server()'s infinite accept() loop with no client ever connecting, producing empty output. The wrapper script treats an empty log as a passing test, producing a false positive. Check fork() for failure with error(), as is done for every other syscall in this file. Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn> Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260821031442.1124777-2-fffsqian@163.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Qingshuang Fu
|
2d83aa65dc |
selftests/net: fix kill() argument order and wrapper cleanup in fin_ack_lat
sig_handler() passes its arguments to kill() in the wrong order: it sends signal number child_pid to PID SIGTERM (15) instead of sending SIGTERM to the client process. The call therefore always fails and the signal is never forwarded: when only the server process receives SIGTERM, the client keeps running its infinite connect loop as an orphan process. Swap the arguments so that the server forwards SIGTERM to the client. Guard the call with child_pid > 0: the client inherits the handler and sees child_pid == 0, and a plain argument swap would make it call kill(0, SIGTERM), signaling the whole process group instead of exiting quietly. Now that the server actually terminates the client before the wrapper script's cleanup runs, kill() may fail with ESRCH for the already-exited client. The script uses set -e, so make the kill tolerant to avoid aborting the EXIT trap and leaking temporary files. Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn> Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260821031442.1124777-1-fffsqian@163.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
Yuqi Xu
|
403f96c32c |
openvswitch: Fix CT limit teardown use-after-free
Packet processing uses CT limit state under RCU, while netns teardown
frees that state under ovs_mutex. The CT limit pointer was neither removed
from readers nor protected by a grace period, allowing packet processing to
dereference the freed state.
An unprivileged user can trigger this bug from a user and network
namespace, causing a slab-use-after-free in ovs_ct_execute() when the
netns is torn down.
Publish the CT limit pointer through RCU, remove it before teardown, and
wait for readers before freeing its contents. Keep ovs_mutex around
individual CT limit updates, and use the RCU read-side lock while GET
traverses the RCU-protected limit lists.
Netns teardown detaches the RCU-protected CT limit state in the pernet
.pre_exit callback while holding ovs_mutex. The pernet core guarantees an
RCU grace period between the .pre_exit and .exit callbacks, so the .exit
callback completes the teardown without adding any extra synchronization.
The netlink command handlers do not need NULL checks because the userspace
netlink socket holds an active reference to its network namespace while a
request is processed. The per-netns exit path therefore cannot run
concurrently with SET, DEL, or GET for that socket's namespace.
Fixes:
|
||
|
Linus Torvalds
|
2f43193b88 |
dma-mapping updates for Linux 7.3:
- swiotlb: added new configuration option for the default pool size
(Jagadeesh Pagadala) and reduced overhead for high watermark tracking
(chenhuguanshen)
- minor code cleanups and improvements (Vova Sharaienko, Honglei Huang
and Marek Szyprowski)
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQSrngzkoBtlA8uaaJ+Jp1EFxbsSRAUCaoxGQgAKCRCJp1EFxbsS
RFPEAP0eo9usjFcvh0YKTPh6/mXgqxRuTNQZ7i+2lRGEczKcJQEA7mwkgwpiOaKn
f++mMVOmsPvl2Y7r/5XqBWywwhyygA0=
=X8pY
-----END PGP SIGNATURE-----
mergetag object
|
||
Anshumali Gaur
|
3ba97ff4f8 |
octeontx2-vf: fix workqueue and netdev race in probe/remove
Initialize the VF workqueue before register_netdev() so ndo_set_rx_mode
does not queue work on a NULL workqueue. Unregister the netdev before
destroying the workqueue, and add proper probe error cleanup.
Fixes:
|
||
|
Anshumali Gaur
|
4d5df98369 |
octeontx2-af: fix out-of-bounds read setting MSI-X irq affinity
rvu_register_interrupts() walks every MSI-X vector and uses strstr()
to match "Mbox" or "FLR" in irq_name before pinning those interrupts
to CPU 0. irq_name is a per-vector NAME_SIZE buffer, but not every
slot is populated before this loop runs. strstr() keeps scanning until
it finds a NUL terminator, so an uninitialized slot can trigger a KASAN
slab-out-of-bounds read at boot when debug options are enabled.
Use strnstr() with NAME_SIZE to bound the search within each vector's
name buffer.
Fixes:
|
||
|
Anshumali Gaur
|
ec65631bd5 |
octeontx2-af: fix NULL deref in NIX TM tree debugfs read path
rvu_dbg_nix_tm_tree_display() dereferences pfvf->sq_ctx without
checking whether the SQ context has been allocated. Reading
/sys/kernel/debug/octeontx2/nix/tm_tree for a NIX LF whose transmit
queues are not set up triggers a kernel oops.
Guard the read path the same way rvu_dbg_nix_tm_tree_write() already
does and return -EINVAL with a seq_file message when sq_ctx is NULL.
Fixes:
|
||
Cen Zhang (Microsoft)
|
d989e22ae9 |
gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free
gtp_newlink()'s error path frees tid_hash and addr_hash without
waiting for an RCU grace period after clearing sk_user_data. A
concurrent gtp_encap_recv() in softirq may still hold the gtp_dev
pointer obtained via rcu_dereference_sk_user_data() and access the
freed memory.
BUG: KASAN: slab-use-after-free in gtp0_pdp_find+0x1f6/0x200 (gtp.c:152)
Call Trace:
<IRQ>
gtp0_pdp_find+0x1f6/0x200
gtp_encap_recv+0x527/0x24b0
udp_queue_rcv_one_skb+0x75f/0xc10
Add synchronize_net() before the kfree calls in out_hashtable, which
covers all error paths from both gtp_encap_enable() and
gtp_create_sockets().
Fixes:
|
||
|
Jakub Kicinski
|
3e995a30b9 |
Merge branch 'xsk-pre-existing-af_xdp-tx-metadata-fixes-from-sashiko'
Stanislav Fomichev says: ==================== xsk: pre-existing AF_XDP TX metadata fixes from Sashiko A few fixes to address pre-existing issues from Sashiko review. Notes on the feedback from net-next v1 posting [0]: - It correctly complains about ABI breakage for 32 bit systems, added an explanation why I think we unlikely to have any 32 bit users with launch time - mlx5 batching (pre existing) - I think my point in the comment still stays (that we do not make it worse) 0: from https://netdev-ai.bots.linux.dev/sashiko/#/message/20260810184753.135756-1-sdf%40fomichev.me ==================== Link: https://patch.msgid.link/20260819160535.1472459-1-sdf@fomichev.me Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
Stanislav Fomichev
|
a6e4b9a6de |
xsk: honor XDP_TX_METADATA in zero-copy path
The zero-copy path reads TX metadata whenever the UMEM has metadata space,
even if the descriptor does not set XDP_TX_METADATA. Pass descriptor
options through the metadata helpers and ignore metadata unless the option
is set.
This does not fix the existing per-WQE metadata handling for mlx5 MPWQEs.
Only the descriptor that starts a session passes through
xsk_tx_metadata_request() and configures offload state shared by the batch.
Metadata on descriptors joining an open session is therefore not validated
and does not configure its requested offloads. In addition, a non-NULL
metadata pointer from such a descriptor is treated as a timestamp
completion request even when XDP_TXMD_FLAGS_TIMESTAMP is not set, so its
metadata union can be overwritten with an unrequested timestamp. Fixing
mixed metadata states within one MPWQE requires a separate change.
Fixes:
|
||
|
Stanislav Fomichev
|
bd7d30bd1d |
xsk: align TX metadata layout across ABIs
Add explicit padding before launch_time so xsk_tx_metadata has the same
layout on 32-bit and 64-bit systems.
On several architectures (csky, i386, nios2, m65k, openrisc, sh), the old
native 32-bit layout put launch_time at offset 12 and had a natural size of
20 bytes. Using sizeof(struct xsk_tx_metadata) as tx_metadata_len was already
rejected because the length must be a multiple of eight, so the
straightforward use of the interface was broken on those ABIs. Userspace
could still register a padded length of 24 bytes, though; mixing the old and
new layouts then silently reads launch_time from the wrong offset and
misprograms packet launch times. This intentionally replaces that
incompatible layout because the affected architectures are unlikely to
have any notable users. (x86_64 and arm64 have the most users and are _not_
affected)
Fixes:
|
||
Shiji Yang
|
c0ef04232f |
net: ethernet: mtk_wed: increase WED v2 WDMA RESV_BUFF to 0x80
Change WDMA RESV_BUFF from 0x40 to 0x80 to avoid CDM TX FIFO overflow.
Without this patch mt7986 and mt7981 may have WDMA TX hang issue. This
patch was pulled from mtk-openwrt-feeds GPL open source project.
Link:
|
||
|
Linus Torvalds
|
918e25291c |
slab changes for 7.3
-----BEGIN PGP SIGNATURE----- iQFPBAABCAA5FiEEe7vIQRWZI0iWSE3xu+CwddJFiJoFAmqMSHQbFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMiwyAAoJELvgsHXSRYiaC8EH/ihctMRDnqbUxyc3cSIZ cuy3ocSSu8UnHzSNarylY8sVYIYflgY6owV7UvaUKmXGYHiHIDdI5NMDzpjola7X Ct7mpIuobFHpFhTQMqvYkeEQ3EytS7NPHKs3jd6t2HSOYJdY4lghjRZcxOlo7+GA 5EJa468TSHswWbT34e3NY7gpoHCXTucR6FBqoVtluLOliQWNMkWbeDQ9hEnMoyNy hEdooWDxt8vBuSqVRCZxrgJRK2nauf1P/CHZm4HcNttOQp0iwr8Q7GER7dBpW0jR 1b1zM9YPH4g6CSll5V6sWSMUNAaDx3Akx3ZyKhd3G2kyP3HkPXKSag/fS8xxCFLN hh0= =6lTR -----END PGP SIGNATURE----- Merge tag 'slab-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab updates from Vlastimil Babka: - Add kfree_rcu_nolock() that can be used from contexts where spinning on a lock might be unsafe, such as a BPF program attached to an arbitrary function, or in NMI context. This complements the existing kfree_nolock() support (Harry Yoo) - Runtime instead of compile-time slabobj_ext sizing. Avoid wasting memory when memory allocation profiling is compiled but not enabled, with initial partial support to also avoid wasting memory for objcg pointers when those are not needed, while profiling is enabled (Vlastimil Babka) - Various non-urgent fixes, cleanups and optimizations (Hao Li, Hongling Zeng, Li RongQing, Li Xiasong, Seongjun Hong, Shengming Hu) * tag 'slab-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: (31 commits) mm/slab, kfence, memcg: completely remove obj_ext for kfence objects mm/slab: stop allocating objcg pointers when unnecessary mm/slab: add cache_ and slab_needs_objcg() helpers mm/slab: stop exporting kvfree_rcu_barrier[_on_cache]() slub_kunit: extend the test for kfree_rcu_nolock() mm/slab: introduce kfree_rcu_nolock() mm/slab: introduce struct kvfree_rcu_head for kvfree_rcu batching mm/slab: reduce slabobj_ext memory with allocation profiling disabled mm/slab: introduce slab_obj_ext_has_codetag() mm/slab: allow kfree_rcu_sheaf() on PREEMPT_RT mm/slab: extend deferred free mechanism to handle rcu sheaves mm/slab: use call_rcu() in unknown context if irqs are enabled mm/slab: handle the !allow_spin case in kfree_rcu_sheaf() mm/slab: change struct slabobj_ext to a union mm/slab: replace slab.stride with obj_exts_in_object mm/slab: abstract slabobj_ext.ref access mm/slab: abstract slabobj_ext.objcg access mm/slab: make slab_obj_ext() determine object index mm: move struct slabobj_ext to mm/slab.h mm/slab: remove objs_per_slab() ... |
||
|
Linus Torvalds
|
a0300e8cf0 |
configfs changes for v7.3-rc1
-----BEGIN PGP SIGNATURE----- iQJKBAABCgA0FiEEV4rZyNlmdiYqwGqG+lApCKrFvdAFAmqMG1kWHGEuaGluZGJv cmdAa2VybmVsLm9yZwAKCRD6UCkIqsW90MdID/wOtlQoSX0AgF0P8caePJ460pag hny+JQsywMqR3nnFzbNW8mchGtKg643rS5ub3GexiJdj1ZS1++5haqAgVh0G3XSn kT9CZ9ndMWAzKC+QFfO7F34VLXYx5klZkjF5FJx/NGrNlxaH/gkVMYPbDsJX+FJu 4YYqu/E7HQ6wPyA4jdnErRW/fBKSHJ9DosJ7L19u/xbXrStk1oRMQC2xHY3gnEuX 3MEJOjm62mB3d2Syr42gjggL47hy0JDm38wI8akky7EvK7uOzhNE9Wk+cTpoUz7w zTTTr+N03jRPkrbFL3nHlGj38sUh3y7b1Ce650YvkRVIebo/2xKMhK+sZUnfmz/v aUEN0MrEzT05uYxZGtv96TtXm+980LVsJuARbvfrQAIeApGnkqm+x+AVSk2SaHXN kGtGUvOd+0XCPA1ZYxMkBcUOIDv5rLnlQrYAdWDq6OK4hjbL0I+qC0gbFZqtYKr8 yn/0PNjNoz52qimdtxft280tKQT3jC0no3IOUOcEhgUl4ibpHOK5R0nAKdtHUMCE mo7XK2tsR/EfZkJRLhNaYIK2kF+kVmmY5LECZgbZeBaqQk+0f14bNhwwUANTE9DJ vsxEdsYDSSW+FKPxnrqnLvprJg1WOnjYORDhjkIArNJNawaPR1uaoJpQkanwUdnW j/SHjUoloWAAr35LAg== =fzXE -----END PGP SIGNATURE----- Merge tag 'configfs-for-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/a.hindborg/linux Pull configfs update from Andreas Hindborg: "Update configfs MAINTAINERS entry. Breno Leitao will maintain configfs C code going forward. I will continue maintaining configfs Rust parts" * tag 'configfs-for-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/a.hindborg/linux: MAINTAINERS: configfs: split configfs entry in C and Rust parts |
||
Yao Kai
|
cf9c8aaea0 |
workqueue: Fix unbound pool lifetime for pending pwqs
KASAN reports a use-after-free of an unbound worker_pool in
node_activate_pending_pwq():
BUG: KASAN: slab-use-after-free in _raw_spin_trylock+0x6d/0x120
Read of size 4 at addr ffff8880089ce000 by task kworker/u22:0/318
CPU: 1 UID: 0 PID: 318 Comm: kworker/u22:0 Not tainted 7.2.0 #1 PREEMPT(lazy)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Workqueue: 0x0 (flush-8:0)
Call Trace:
<TASK>
dump_stack_lvl+0x53/0x70
print_report+0xce/0x610
kasan_report+0xce/0x100
_raw_spin_trylock+0x6d/0x120
pwq_dec_nr_in_flight+0x4b4/0xcb0
process_one_work+0x921/0x11a0
worker_thread+0x4d0/0xd20
kthread+0x2de/0x3c0
ret_from_fork+0x3aa/0x620
ret_from_fork_asm+0x1a/0x30
</TASK>
Allocated by task 311:
alloc_pwq+0x439/0xca0
apply_wqattrs_prepare+0x75e/0xd10
apply_workqueue_attrs_locked+0x44/0xa0
wq_nice_store+0x350/0x450
Freed by task 0:
kfree+0x127/0x3b0
rcu_core+0x523/0x1780
handle_softirqs+0x1b3/0x610
Last potentially related work creation:
put_unbound_pool+0x3f3/0x7d0
pwq_release_workfn+0x494/0x8e0
kthread_worker_fn+0x1ff/0x790
Canceling the last inactive work skips pwq_dec_nr_active(), so an empty
pwq can remain on pending_pwqs when its refcnt reaches zero.
pwq_release_workfn() currently puts the pool before removing that pwq.
If this drops the last pool reference, the pool can be RCU-freed while
the pwq remains reachable, and node_activate_pending_pwq() may trylock
the freed pool->lock.
Remove the pwq from pending_pwqs before putting the pool.
Fixes:
|
||
|
Linus Torvalds
|
5b05bb3f6c |
platform-drivers-x86 for v7.3-1
Highlights:
- amd/halo: Add Halo RGB LED driver
- amd/hsmp:
- Properly serialize probe, remove, and data paths
- Add support for protocol v7 used by Family 1AH Model 80H
- Fix error checking corner cases (largely from AI review)
- Reject negative power cap
- amd/pmc:
- Improve behavior on platforms that do not support STB
- Add T14 Gen2 AMD (20XL) to s2idle quirk list
- amd/pmf:
- Add ioctl interface to retrieve device metrics
- Add support for new metrics tables used by Family 1AH Model 80H
- arm64: qcom-hamoa-ec: Reject short responses
- asus-nb-wmi: Support ProArt key on ASUS ProArt PX13
- asus-armoury:
- Gate PPT writes behind active fan curve
- Add power limits for more models
- dell-wmi-base: Fix handling of ultra performance key
- dell-wmi-sysman: Don't hex dump attribute security buffer
- hp-bioscfg:
- Various fixes
- Improve reduced ACPI packages support (necessary for HP EliteBook 840 G2)
- lg-laptop:
- Fix LED resource handling
- Add support for events used in newer models
- Fix keyboard backlight support on LG Gram 16T90SP
- hp-wmi:
- Generalize thermal params to board params
- Manage CPU and GPU PWM independently
- Add GPU MUX switch support
- Add Victus 15-fb0xxx support
- Add OMEN MAX 16-ak0xxx, OMEN 16-n0xxx, OMEN 16-wd0xxx, OMEN
16-wf0xxx, and OMEN board ID 8D88 support
- Add OMEN Transcend 16-u0xxx support
- huawei: Add support for Fn-lock ACPI interface found on newer Huawei
laptops such as MateBook 14 2024
- ISST:
- Improve input validation (many fixes)
- Disallow SST-CP (core-power) feature if perf profile add fails
- lenovo/yb9-kbdock: Add driver for Yoga Book 9 14IAH10
- lenovo/ymc:
- Extend hinge switch query to support Yoga 9 2-in-1 14IPH11
- Prevent loading on Yoga Book 9 14IAH10 to avoid duplicated input
nodes
- msi-ec: Add MSI Raider A18 HX A9WJG and MSI Katana GF76 11UEK support
- msi-wmi: Add MSI Claw M-Center keys support
- oxpec: Add support for OneXPlayer X2 Mini Pro
- redmi-wmi: Report kbd backlight cycle, OEM preset power mode, and FnLock
toggle events to userspace
- samsung-galaxybook: Add Samsung Galaxy Book6 Pro support
- thinkpad_acpi: Add USB-C Security support
- uniwill-laptop:
- Add keyboard backlight, AC auto boot, and USB powershare support
- Add MACHENIKE L16 Pro, AiStone X4SP4NAL, and Avell A60 MUV support
- Make lightbar max brightness configurable and add support for
LAPQC71A/B
- Major refactoring efforts:
- Stop setting acpi_device_name/class() and pnp.device_class to
faciliate their eventual removal
- Many rollback/remove path fixes (presumably mostly found by AI)
- Miscellaneous cleanups / refactoring / improvements
The following is an automated shortlog grouped by driver:
acer-wmi:
- reject missing gaming WMI results
amd/hsmp:
- ACPI HSMP refcounted sockets and coordinated release
- Add HSMP messages for Family 1Ah, Model 50h-5Fh
- Add IOCTL_GET_TELEMETRY_DATA for metric table reads
- Clear mdev.this_device on deregister
- Enable protocol version 7 metric tables on the ACPI driver
- Gate the data plane on a fully initialized socket
- Map the metric table with ioremap() and unmap it explicitly
- Pass struct device explicitly to ACPI mailbox parsers
- Reject negative power cap writes in hwmon
- Serialize ACPI HSMP probe and remove with an rwsem
- Serialize per-socket metric table reads with a mutex
- Serialize the data plane against socket teardown
- Source metric-table size from firmware
- Unify response_sz validation to an upper-bound check
- Validate ACPI UID before parsing socket index
- Validate _DSD mailbox sub-package element count
amd:
- Introduce Halo Box RGB LED driver
amd/pmc:
- Add T14 Gen2 AMD (20XL) to s2idle quirk list
- Do not fail probe when STB init fails
- Fix LPS0 and debugfs leaks when STB init fails
- Fix msg_port restoration in amd_stb_debugfs_open_v2()
- Only expose stb_read after telemetry buffer is mapped
- Propagate SMU errors and validate S2D address
- Restore msg_port on amd_stb_s2d_init() error paths
amd/pmf:
- Add 1AH_M80H device IDs and extended SMU mailbox registers
- Add 1AH_M80H metrics table and NPU metrics support
- Add missing newline in dev_err message
- Add util layer and userspace character device interface
- Implement util layer ioctl handler
- Introduce AMD PMF testing tool for driver metrics and features
- Move debug helper functions to UAPI header
- Move metrics code to dedicated file
- Refactor NPU metrics for platform extensibility
- store BIOS output values for user-space metrics via util IOCTL
- Store commonly used enums in the header file
- Use per-SoC smu_regs struct for SMU mailbox registers
- Use upper/lower_32_bits() in amd_pmf_set_dram_addr()
arm64: qcom-hamoa-ec:
- reject incomplete responses
asus-armoury:
- Add power limits for ROG Strix SCAR 16 (G635LX)
- Add power limits quirk for FA401KM
- Add power limits quirk for FA608WV
- add support for FX517ZR
- add support for HN7306EA and HN7306EAC
- fix Use-After-Free and memory leak in driver init
- gate PPT writes behind active fan curve
- use cleanup.h to manage tunables
asus-laptop:
- Stop setting acpi_device_name/class()
asus-nb-wmi:
- map ProArt key (0x8b) to KEY_PROG3
asus-wireless:
- Fail probe when there is no ACPI match
asus-wmi:
- fix resource leaks on probe failure
dell-ddv:
- Use no_free_ptr() to simplify error handling
dell-privacy:
- Fix race condition
dell-smbios:
- Pass device to callbacks
dell-smbios-wmi:
- Fix chardev resource management
- Replace global list with single item
dell-wmi-base:
- Fix handling of ultra performance key
- Fix resource leak on module load failure
dell-wmi-sysman:
- Don't hex dump attribute security buffer
- Fix instance ID bounds
Documentation/ABI:
- add testing entry for AMD PMF character device interface
eeepc-laptop:
- Stop setting acpi_device_name/class()
fujitsu-laptop:
- Stop setting acpi_device_name/class()
fujitsu-tablet:
- Stop setting acpi_device_name/class()
hp-bioscfg:
- accept reduced ACPI packages from older HP BIOS
- advance elem past consumed array elements
- bound ordered-list parsing by the package count
- fix heap OOB read in sk_store() and kek_store()
- fix heap OOB read on empty password write
- fix new_password_store() overwriting current_password
- fix off-by-one write in hp_get_string_from_buffer()
- fix ORD_LIST_ELEMENTS never being parsed
- fix password encoding bounds check
- pass validated element count to package parsers
- warn on element type mismatch instead of failing
hp-wmi:
- Add dual-channel PWM fan control
- Add GPU MUX switch support
- Add OMEN board 8A43 thermal profile support
- Add OMEN board 8BA9 thermal profile support
- Add OMEN board 8BAA thermal profile support
- Add OMEN board 8D88 thermal profile support
- Add OMEN Transcend 16 8BB3 support
- Add support for OMEN MAX 16-ak0xxx (8DD6)
- Add Victus 15-fb0xxx support
- Drive fan control from board data
- Introduce board-specific feature data
huawei-wmi:
- add ACPI fallback for Fn-lock on newer models
ideapad-laptop:
- Fix driver unregistration order
int1092:
- Fix info leak in parse_package()
- Fix potential memory leak in sar_probe()
intel/pmc:
- initialize empty PMT read result
ishtp_eclite:
- Fix ACPI device reference leak in probe error path
ISST:
- Add a NULL check for sst_inst[]
- Just allow 2 bits for SST feature enable
- Return error during profile addition
- Use PP level enable mask
- Validate level in perf mask ioctls
- Validate logical CPU id and clos id
- Validate max level for set feature
- Validate parameter for core power state
- Validate parameter for frequency and priority
- Validate socket ID in clos_assoc ioctl
lenovo:
- Add Yoga Book 9 keyboard dock detection driver
lenovo: lenovo-ymc:
- Suppress probe on Yoga Book 9 14IAH10
lenovo/ymc:
- Only match lower byte in WMI lid switch query response
lg-laptop:
- Add support for additional events
- Add support for native ACPI events
- Fix keyboard backlight support on LG Gram 16T90SP
- Fix LED resource handling
- Improve WMAB control method support
MAINTAINERS:
- update Intel PMC Core maintainer contact
mlxbf-bootctl:
- fix the build error with FIELD_PREP()
mlxbf-pmc:
- Check ACPI_COMPANION() against NULL
msi-ec:
- Add MSI Katana GF76 11UEK EC firmware
- Add MSI Raider A18 HX A9WJG EC firmware
msi-wmi:
- Add MSI Claw M-Center keys
- Reformat msi_wmi_notify()
oxpec:
- Add support for OneXPlayer X2 Mini Pro
panasonic-laptop:
- Fix sentinel write past pcc->sinf[]
- Stop setting acpi_device_name/class()
power: supply: surface_{battery,charger}:
- Consistently define ssam_device_ids using named initializers
redmi-wmi:
- report EC state change events
samsung-galaxybook:
- Add SAMB430 device ID
sony-laptop:
- Stop setting acpi_device_class()
sonypi:
- Stop setting acpi_device_name/class()
surface: acpi-notify:
- Check ACPI companion before use
surface: aggregator:
- Consistently define ssam_device_ids using named initializers
surface: surfacepro3_button:
- Stop setting acpi_device_name()
think-lmi:
- Fix certificate thumbprint sysfs output
- Fix current password length check
- Free system certificate signatures
thinkpad_acpi:
- Add USB-C Security (USCS) support
- Fix fan speed reporting on Edge E330
- Fix USB-C Security probe failure on unsupported platforms
- Stop setting acpi_device_class()
topstar-laptop:
- Stop setting acpi_device_name/class()
toshiba_acpi:
- Do not use uninitialized device_class
toshiba_bluetooth:
- Use more common error handling code in toshiba_bt_rfkill_probe()
toshiba_haps:
- Do not use uninitialized device_class
uniwill-laptop:
- Add 2 new feature defines for TUXEDO devices
- Add AC auto boot support
- Add Avell A60 MUV support
- Add keyboard backlight support
- Add lightbar support for LAPQC71A/B
- Add support for the AiStone X4SP4NAL
- Add support for the MACHENIKE L16 Pro
- Add support for USB powershare
- Handle screen-related events
- Remove single color keyboard detection
- Split uniwill_kbd_led_init()
x86/platform/olpc: xo15:
- Stop setting acpi_device_name/class()
xo15-ebook:
- Stop setting acpi_device_name/class()
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQSCSUwRdwTNL2MhaBlZrE9hU+XOMQUCaow0EgAKCRBZrE9hU+XO
MRvYAP412gjYokIoj6ncE2OD897gX2d5BwUVKkraQHoevxLm8wEAikY+iYbdOv3a
fqhPeCDZSRBn6yEBHewY7cdotNDn2go=
=d/Uf
-----END PGP SIGNATURE-----
Merge tag 'platform-drivers-x86-v7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86
Pull x86 platform driver updates from Ilpo Järvinen
"Highlights:
Major refactoring effort: stop setting acpi_device_name/class() and
pnp.device_class to facilitate their eventual removal
Many rollback/remove path fixes (presumably mostly found by AI)
Miscellaneous cleanups / refactoring / improvements
amd/halo:
- Add Halo RGB LED driver
amd/hsmp:
- Properly serialize probe, remove, and data paths
- Add support for protocol v7 used by Family 1AH Model 80H
- Fix error checking corner cases (largely from AI review)
- Reject negative power cap
amd/pmc:
- Improve behavior on platforms that do not support STB
- Add T14 Gen2 AMD (20XL) to s2idle quirk list
amd/pmf:
- Add ioctl interface to retrieve device metrics
- Add support for new metrics tables used by Family 1AH Model 80H
qcom-hamoa-ec (arm64):
- Reject short responses
asus-nb-wmi:
- Support ProArt key on ASUS ProArt PX13
asus-armoury:
- Gate PPT writes behind active fan curve
- Add power limits for more models
dell-wmi-base:
- Fix handling of ultra performance key
dell-wmi-sysman:
- Don't hex dump attribute security buffer
hp-bioscfg:
- Various fixes
- Improve reduced ACPI packages support (necessary for HP EliteBook 840 G2)
lg-laptop:
- Fix LED resource handling
- Add support for events used in newer models
- Fix keyboard backlight support on LG Gram 16T90SP
hp-wmi:
- Generalize thermal params to board params
- Manage CPU and GPU PWM independently
- Add GPU MUX switch support
- Add Victus 15-fb0xxx support
- Add OMEN MAX 16-ak0xxx, OMEN 16-n0xxx, OMEN 16-wd0xxx, OMEN
16-wf0xxx, and OMEN board ID 8D88 support
- Add OMEN Transcend 16-u0xxx support
huawei:
- Add support for Fn-lock ACPI interface found on newer Huawei
laptops such as MateBook 14 2024
ISST:
- Improve input validation (many fixes)
- Disallow SST-CP (core-power) feature if perf profile add fails
lenovo/yb9-kbdock:
- Add driver for Yoga Book 9 14IAH10
lenovo/ymc:
- Extend hinge switch query to support Yoga 9 2-in-1 14IPH11
- Prevent loading on Yoga Book 9 14IAH10 to avoid duplicated input
nodes
msi-ec:
- Add MSI Raider A18 HX A9WJG and MSI Katana GF76 11UEK support
msi-wmi:
- Add MSI Claw M-Center keys support
oxpec:
- Add support for OneXPlayer X2 Mini Pro
redmi-wmi:
- Report kbd backlight cycle, OEM preset power mode, and FnLock
toggle events to userspace
samsung-galaxybook:
- Add Samsung Galaxy Book6 Pro support
thinkpad_acpi:
- Add USB-C Security support
uniwill-laptop:
- Add keyboard backlight, AC auto boot, and USB powershare support
- Add MACHENIKE L16 Pro, AiStone X4SP4NAL, and Avell A60 MUV support
- Make lightbar max brightness configurable and add support for
LAPQC71A/B"
* tag 'platform-drivers-x86-v7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (152 commits)
platform/x86: think-lmi: Fix current password length check
platform/x86: redmi-wmi: report EC state change events
MAINTAINERS: update Intel PMC Core maintainer contact
platform/x86: oxpec: Add support for OneXPlayer X2 Mini Pro
platform/x86: thinkpad_acpi: Fix fan speed reporting on Edge E330
platform/x86: msi-ec: Add MSI Katana GF76 11UEK EC firmware
platform/x86: think-lmi: Fix certificate thumbprint sysfs output
mlxbf-bootctl: fix the build error with FIELD_PREP()
platform/x86: think-lmi: Free system certificate signatures
platform/x86: ISST: Add a NULL check for sst_inst[]
platform/x86: ISST: Return error during profile addition
platform/x86: ISST: Just allow 2 bits for SST feature enable
platform/x86: ISST: Use PP level enable mask
platform/x86: ISST: Validate parameter for frequency and priority
platform/x86: ISST: Validate parameter for core power state
platform/x86: ISST: Validate max level for set feature
platform/x86: ISST: Validate logical CPU id and clos id
platform/x86: ISST: Validate level in perf mask ioctls
platform/x86: ISST: Validate socket ID in clos_assoc ioctl
platform/x86/amd/hsmp: Reject negative power cap writes in hwmon
...
|
||
Chengfeng Ye
|
ebe6674292 |
Bluetooth: RFCOMM: serialize session teardown
rfcomm_kill_listener() walks session_list and deletes every session
without holding rfcomm_mutex, unlike the normal session processing and
connect error paths.
Under normal operation, an open RFCOMM socket pins rfcomm.ko, so
rfcomm_kill_listener() does not run concurrently with rfcomm_dlc_open().
However, forced module unload via delete_module(O_TRUNC) can stop
krfcommd while a failed connect is still unwinding.
connect task forced unload / krfcommd
------------ ------------------------
rfcomm_lock()
rfcomm_session_add()
delete_module("rfcomm", O_TRUNC)
rfcomm_kill_listener()
fetch session from session_list
kernel_connect() fails
rfcomm_session_del()
remove and free session
rfcomm_session_del(session)
The final call then reads the freed session and may corrupt the list.
KASAN reported with mdelay() to enlarge critical window:
BUG: KASAN: slab-use-after-free in rfcomm_run+0x3802/0x3f00 [rfcomm]
Read of size 8 at addr ffff888111058d40 by task krfcommd/79
Tainted: [R]=FORCED_RMMOD
Allocated by task 86:
rfcomm_session_add+0xa1/0x300 [rfcomm]
rfcomm_dlc_open+0x8b2/0xf30 [rfcomm]
rfcomm_sock_connect+0x34c/0x530 [rfcomm]
Freed by task 86:
kfree+0x121/0x3c0
rfcomm_dlc_open+0xab7/0xf30 [rfcomm]
rfcomm_sock_connect+0x34c/0x530 [rfcomm]
Hold rfcomm_mutex across the teardown traversal so every reachable
session_list walk uses the same serialization.
Reviewed-by: Ali Ahmet Memis <ali@iusegentoo.com>
Tested-by: Ali Ahmet Memis <ali@iusegentoo.com>
Reviewed-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
|
||
Radek Podgorny
|
7e1e404720 |
Bluetooth: do not leak an hci_conn when a second LE connect is rejected
create_le_conn_complete() decides whether the failed connection is
still pending by comparing it against hci_lookup_le_connect(), which
returns the first LE connection in BT_CONNECT. That is the same
connection only while at most one is pending.
Two can be pending. Connections created on the passive scan path sit
in BT_CONNECT with HCI_CONN_SCANNING set and are invisible to
hci_lookup_le_connect() until hci_le_create_conn_sync() clears the
flag when their command is issued, so the -EBUSY guard in
hci_connect_le() does not prevent a second connection from being
queued while the first is still on the scan path. Whenever two
connections are in BT_CONNECT at once, the lookup may return one
connection while create_le_conn_complete() is reporting the failure
of the other; the early exit then drops the error and hci_conn_failed()
never runs on the connection that failed.
The controller also rejects a second HCI_OP_LE_CREATE_CONN issued
while another connection creation is still outstanding, per Core Spec
Vol 4, Part E. The spec calls for Command Disallowed there; the
bcm43438 observed here answers with an LMP/LL error code instead,
which bt_to_errno() maps to the -EPROTO (-71) in the log below.
The leaked connection stays in BT_CONNECT forever, and because
hci_connect_le() refuses to dial while hci_lookup_le_connect() finds
anything, every subsequent attempt to reach any peer fails with
-EBUSY and no command reaches the controller at all.
Seen on a bcm43438 with two BLE peers polled on the same interval
(state 5 is BT_CONNECT; both handles are UNSET ones, allocated from
the ida above HCI_CONN_HANDLE_MAX):
Bluetooth: hci1: Opcode 0x2013 failed: -71
# hcitool con
< LE 14:9C:EF:03:68:81 handle 3840 state 5 lm CENTRAL
< LE C4:D3:6A:8C:B5:38 handle 3841 state 5 lm CENTRAL
A btmon capture across the next ten minutes of connect attempts
contains no HCI_OP_LE_CREATE_CONN at all; outgoing LE connections
do not recover until the adapter is reset. With this change the same
scenario fails the rejected connection cleanly and further connects
to both peers go through.
Ask about the connection itself instead of about the device.
Fixes:
|
||
|
Chengfeng Ye
|
759c185d0b |
Bluetooth: RFCOMM: serialize security confirmation handling
rfcomm_security_cfm() looks up a session on session_list and then walks
its DLC list without holding rfcomm_mutex. Since RFCOMM session teardown
uses rfcomm_mutex, krfcommd can close and free the same session and DLCs
concurrently:
hci_rx_work krfcommd
----------- ---------
rfcomm_session_get()
rfcomm_lock()
rfcomm_session_close()
rfcomm_dlc_unlink()
rfcomm_session_del()
kfree(s)
rfcomm_unlock()
walk s->dlcs
The callback can then read a freed session list head and touch freed DLCs
while updating their flags or timers.
Serialize the session lookup and DLC traversal in rfcomm_security_cfm()
with rfcomm_mutex. This matches the existing RFCOMM session lifetime
rules and prevents concurrent rfcomm_session_del() / rfcomm_dlc_unlink()
from tearing the objects down while the callback is using them.
KASAN reported:
BUG: KASAN: slab-use-after-free in rfcomm_security_cfm+0x41c/0x440
Read of size 8 at addr ffff888111fb3960 by task kworker/u17:1/89
Workqueue: hci0 hci_rx_work
Call Trace:
rfcomm_security_cfm+0x41c/0x440
hci_encrypt_cfm+0x139/0x590
hci_encrypt_change_evt+0x37b/0xc40
hci_event_packet+0x71b/0xb20
hci_rx_work+0x293/0x730
Allocated by task 69:
rfcomm_session_add+0x9e/0x2f0
rfcomm_run+0x44b/0x41e0
Freed by task 69:
kfree+0x131/0x3c0
rfcomm_session_del+0x188/0x220
rfcomm_run+0x1985/0x41e0
Fixes:
|
||
Junjie Cao
|
ca0583c246 |
Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728
Commit |
||
Gongwei Li
|
a935579934 |
Bluetooth: hci_uart: Fix false success return in hci_uart_setup()
When reading the local version information for vendor detection fails, the error is only printed and 0 is returned, which masks the setup failure from the HCI core. Return PTR_ERR(skb) instead. Fixes: |
||
Hyunwoo Kim
|
44c98fd082 |
Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop
rfcomm_apply_pn() accepts the MTU value from a remote PN (Parameter
Negotiation) frame without checking for zero. When the remote peer
sends an MTU of zero, d->mtu is set to 0. This causes the sendmsg
path to enter an infinite loop when fragmenting data, as each fragment
has size == min_t(size_t, len, 0) == 0, so the remaining length never
decreases. The infinite allocation of zero-length skbs exhausts all
system memory.
Fix by clamping d->mtu to RFCOMM_DEFAULT_MTU when the negotiated
value is zero, consistent with the initial value assigned in
rfcomm_dlc_alloc().
Fixes:
|
||
Hang Nan
|
560bef609f |
Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready
iso_conn_ready() looks up the BIS listener socket with iso_get_sock(),
which takes a reference, and then, without re-checking its state,
creates a child socket from it:
parent = iso_get_sock(hdev, ...);
if (!parent)
return;
lock_sock(parent);
sk = iso_sock_alloc(sock_net(parent), NULL, BTPROTO_ISO, ...);
...
iso_chan_add(conn, sk, parent);
...
release_sock(parent);
sock_put(parent);
If the listener socket is closed concurrently, between iso_get_sock()
and lock_sock(), the reference taken by iso_get_sock() may be the last
one: the close path drops the link-list reference, and once
iso_conn_ready() drops its own reference at the end of the function the
socket is freed. The child socket, however, is already linked to the
freed parent, and a later disconnect of the child runs iso_chan_del()
-> bt_accept_unlink(), which dereferences the dangling parent pointer
into the freed accept queue (a use-after-free). The same dangling
pointer is also dereferenced through parent->***() in
iso_chan_del().
Fix it the same way the connected (non-BIS) path was fixed in commit
|
||
Guilherme G. Piccoli
|
94509f50d6 |
docs: panic: Disclaimer about console verbosity when using panic_print with pstore
Users of panic_print / panic_sys_info are usually aware of the potentially huge amount of information displayed with such options - their goal by using them is indeed to dump more information during panic! What might come unnoticed at first is the impact that the console_verbose() call on panic path has, specially in cases that users rely on pstore as a means to collect the panic logs. Recent experience shows that dumping all tasks in an ARM64 system (with qcom_geni tty driver) gets a 2 minute delay on panic time due to writing such information to console. But in that case, pstore was used, so there was no need for console printing, and suppressing that reduced the full time to less than 0.5 second. The option "printk.console_no_auto_verbose" aims exactly at this use case: avoid automatically increasing the loglevel during panic path. So, let's officially document this to avoid users wasting their time either on long panic printing or debugging the panic delays. While at it, improve the readability of the panic_print text, by adding some line breaks. Suggested-by: Petr Mladek <pmladek@suse.com> Reviewed-by: Bradley Morgan <include@grrlz.net> Reviewed-by: Feng Tang <feng.tang@linux.alibaba.com> Signed-off-by: Guilherme G. Piccoli <gpiccoli@igalia.com> Reviewed-by: Petr Mladek <pmladek@suse.com> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <20260819183419.2203903-1-gpiccoli@igalia.com> |