Merge tag 'kbuild-fixes-7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux
Pull Kbuild fixes from Nathan Chancellor:
- Move probing of '-mfentry' back into Makefile instead of Kconfig
because it does not interact well with toolchains that support
multiple bit widths
- Add a big comment in scripts/Kconfig.toolchain of two pitfalls when
moving cc-option checks from Kbuild to Kconfig
* tag 'kbuild-fixes-7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux:
scripts/Kconfig.toolchain: Highlight cc-option differences between Kconfig and Kbuild
kbuild: Move testing of '-mfentry' back to Makefile from Kconfig
Merge tag 'ktest-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-ktest
Pull ktest updates from Steven Rostedt:
- Sort configs before writing config file
Currently the .config file is created from the perl hash array from
reading the applied min-configs. The order is determined by how perl
hashes the values. This causes the .config file to be created in
different orders for each run, and the order may determine the final
value of the .config file after it goes through a make oldconfig.
Sort the values when creating the .config so that the result is the
same for every run.
- Add total test time to run output
Have ktest display the total test time of running all the tests. This
is useful to find issues in the build, install, boot or test run
[19 lines not shown]
Merge tag 'cifs-fixes-7.4-rc1' of https://git.manguebit.org/linux
Pull smb client fixes from Paulo Alcantara:
- Validate the offsets and lengths a server puts in its responses
before using them, so that a malicious or broken server can no longer
make the client read past the received data:
- POSIX lock data (which leaked kernel bytes through F_GETLK)
- NT transaction responses and SMB1 EA lists (both wrapping their
pointer checks on 32-bit)
- short SESSION_SETUP responses (which sent stale buffer content
back to the server in the NTLMv2 AUTHENTICATE message)
- SMB2 READ data areas
- empty truncated fiemap responses
- Fix a heap overflow in SMB2_tcon() with UNC paths longer than
MAX_SHARENAME_LENGTH
- Fix a slab-out-of-bounds write when chmod() rewrites a security
[27 lines not shown]
Merge tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fsverity/linux
Pull fsverity fixes from Eric Biggers:
"Fixes for several bugs found by LLMs:
- Fix bypass of IPE's fsverity support, and a use-after-free in
certain cases, when FS_IOC_ENABLE_VERITY fails when almost done
- Fix FS_IOC_MEASURE_VERITY and FS_IOC_READ_VERITY_METADATA to no
longer bypass Landlock and AppArmor's read permission checks
- Be robust against the filesystem returning different values for a
file's verity descriptor length in two successive queries"
* tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fsverity/linux:
fsverity: Set S_VERITY only after rollback is no longer possible
fsverity: Tell LSMs about signature only after verity is enabled
fsverity: Be more careful with return value of ->get_verity_descriptor()
fsverity: Explicitly require FMODE_READ to retrieve hashes
Merge tag 'thermal-7.4-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull thermal control fixes from Rafael Wysocki:
"These fix three issues related to thermal control:
- Fix CPU mask truncation in power limit trace event used by the
power allocator thermal governor (Hungyu Lin)
- Fix code indentation in create_s32_tzp_attr() and rearrange it to
use early return when applicable (Thorsten Blum)
- Allow cross builds of the Intel thermal tests (Sasha Levin)"
* tag 'thermal-7.4-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
thermal: sysfs: Fix indentation in create_s32_tzp_attr()
thermal: Fix CPU mask truncation in power limit trace event
selftests/thermal: allow cross builds of the Intel tests
Merge tag 'pm-7.4-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull power management fixes from Rafael Wysocki:
"These address assorted issues in the power management code and update
documentation:
- Fix potential out-of-bounds access in deferred reset in the cpufreq
statistics code (Zhongqiu Han)
- Cancel HWP notify work in the intel_pstate driver cleanup to
prevent possible use-after-free from occurring (Tristan Madani)
- Adjust state names and descriptions for ACPI _LPI idle states in
the intel_idle driver to make them follow the driver's idle state
naming convention (Rafael Wysocki)
- Document the new pm_runtime_use_autosuspend() undo mechanism that
triggers automatically on driver exit (Joshua Crofts)
[14 lines not shown]
Merge tag 'acpi-7.4-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull ACPI support fixes from Rafael Wysocki:
"These address assorted issues in ACPI support code and work around
concurrency-related issues in AML on some platforms:
- Separate handler locking from sysfs lifetime in the ACPI platform
profile driver to avoid possible deadlocks due to sysfs accesses
during driver removal (Daniel Lezcano)
- Introduce additional locking around the evaluation of selected ACPI
control methods in a few places to work around issues related to
concurrency in AML on some platforms (Ali Ahmet Memiş)
- Address two issues reported by Sashiko in the ACPI table data sysfs
interface (Jamie Nguyen)
- Initialize parser_state.aml_end in acpi_install_method() properly
to avoid out-of-bounds accesses during control method installation
[11 lines not shown]
Merge branch 'thermal-intel'
Merge a fix for Intel thermal tests for 7.4-rc1:
- Allow cross builds of the Intel thermal tests (Sasha Levin)
* thermal-intel:
selftests/thermal: allow cross builds of the Intel tests
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
Pull more KVM updates from Paolo Bonzini:
"ARM64:
- Fix a couple of embarrassing merge mistakes in kvmarm-7.4
- Cleanup the HCR_EL2 bit fields to exclusively use the generated
definitions, fixings a nasty regression introduced in 6.16, where
barriers were not upgraded from NSH to ISH anymore
- Fix publication of state when a vcpu is forced out of the guest
- Let vcpu pausing nest correctly
- Sanitise ID_AA64MMFR3_EL1.S1P[IO]E to follow the rules of the
architecture
- Don't warn on SMCCC filter reserved range allocation failure
[73 lines not shown]
Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
Pull arm64 fixes from Catalin Marinas:
"Three fixes that turned up during the merging window: shadow stack not
freed during a failed fork or it is unmapped from parent when a worker
thread exits (same commit covers both); PTE_CONT set on PROT_NONE
entries but subsequently ignored by the unfolding code since
pte_valid() is false (pte_present() is true); an MPAM lock not
released on the error path.
Summary:
- Release the GCS on a failed fork.
copy_thread() can allocate a GCS for CLONE_VM threads but a later
copy_process() failure left the VMA in the parent's mm. Implement
exit_thread() to free it and stop kernel threads and user workers
inheriting the parent's GCS base/size. Add a kselftest for the
clone3() failure case
[16 lines not shown]
Merge tag 'loongarch-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson
Pull LoongArch updates from Huacai Chen:
- Add LoongArch-specific ACPI initialization
- Set NX compat flag in PE/COFF efi header
- Use pa_to_nid()/nid_to_addrbase() rather than hard-code
- Detect and expose LAMCAS/DIV32 feature existence
- Fix and improve perf hardware breakpoints
- Fix and improve BPF JIT (trampoline and 32-bit operations)
- Add arch_crash_save_vmcoreinfo() support
- Some bug fixes and other small changes
[23 lines not shown]
Merge branches 'pm-cpufreq', 'pm-cpuidle', 'pm-runtime' and 'pm-sleep'
Merge assorted power management fixes for 7.4-rc1:
- Fix potential out-of-bounds access in deferred reset in the cpufreq
statistics code (Zhongqiu Han)
- Cancel HWP notify work in the intel_pstate driver cleanup to prevent
possible use-after-free from occurring (Tristan Madani)
- Adjust state names and descriptions for ACPI _LPI idle states in the
intel_idle driver to make them follow the driver's idle state naming
convention (Rafael Wysocki)
- Document the new pm_runtime_use_autosuspend() undo mechanism that
triggers automatically on driver exit (Joshua Crofts)
- Do not call suspend_ops->begin()/end() for suspend-to-idle to avoid
driver confusion (Ovidiu Panait)
[13 lines not shown]
Merge tag 'ceph-for-7.4-rc1' of https://github.com/ceph/ceph-client
Pull ceph updates from Ilya Dryomov:
"The two things of note here are the disablement of inline data support
and a new lazyio mount option to enable LAZYIO behavior globally
(instead of via an ioctl on a per-file basis), both from Xiubo.
Despite being over a decade old, the inline data feature never lost
its experimental status -- it has always been off by default and
required passing --yes-i-really-mean-it flag to be turned on. It was
officially deprecated in 2020 and is now in the process of being
removed on the MDS side. For now it's still possible to re-enable it
in Kconfig, but the code will eventually be dropped from the kernel
client entirely.
Outside of that we have a number of bug fixes, a series from Tal to
help phase out older page APIs, some cleanups from Max and a large
pile of LLM-based hardening patches.
[24 lines not shown]
Merge branches 'acpi-driver' and 'acpi-sysfs'
Merge additional updates related to ACPI support in device drivers and
ACPI sysfs interface fixes for 7.4-rc1:
- Separate handler locking from sysfs lifetime in the ACPI platform
profile driver (Daniel Lezcano)
- Introduce additional locking around the evaluation of selected ACPI
control methods in a few places to work around issues related to
concurrency in AML on some platforms (Ali Ahmet Memiş)
- Address two issues reported by Sashiko in the ACPI table data sysfs
interface (Jamie Nguyen)
* acpi-driver:
ACPI: platform_profile: Separate handler locking from sysfs lifetime
platform/x86: ideapad-laptop: Evaluate ACPI methods exclusively
thermal: intel: int340x: Evaluate _TMP exclusively
[6 lines not shown]
Merge tag 'vfs-7.4-rc1.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull vfs fixes from Christian Brauner:
- writeback:
- Update dirtied_when instead of dirtied_time_when when a wb switch
puts an inode at the newest end of the target b_dirty list. The
list was left out of order so move_expired_inodes() could stop
before older inodes, and the lazytime expiration timestamp was
reset
- Clear the old wb's dirty-I/O state and bandwidth contribution when
a batch of inode switches leaves its dirty lists empty. An empty
wb stayed scheduled for periodic writeback and inflated
bdi->tot_write_bandwidth
- Take wb_switch_rwsem across the inode scan of
cleanup_offline_cgwb(). The v7.3-rc5 fix that rotates scanned
[242 lines not shown]
Merge tag 'spi-fix-v7.4-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
Pull spi fixes from Mark Brown:
"Two patches here, one a straightforward device quirk and the other a
fix for a potentially nasty data corruption bug in the zynq-qspi
driver"
* tag 'spi-fix-v7.4-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
spi: cs42l43: Add speaker ID quirk for Dell XPS 13 DX13260 SKU 0E54
spi: zynq-qspi: fix address buffer corruption and support 4-byte address
Merge tag 'regulator-fix-v7.4-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator
Pull regulator fix from Mark Brown:
"One fix here, we had an issue with deferred hardware disables where
if we were deferring while suspend was happening we would let the
workqueue run which could result in us trying to access hardware after
it or the buses used to access it were suspended.
We fix this by completing any work as we suspend the individual
regulators"
* tag 'regulator-fix-v7.4-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
regulator: irq: freeze deferred hardware access during suspend
Merge tag 'regmap-fix-v7.4-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap
Pull regmap fix from Mark Brown:
"One fix for a real issue that fortunately doesn't affect any in tree
configurations"
* tag 'regmap-fix-v7.4-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
regmap: irq: fix incorrect index calculation for read_sub_irq_data()
Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull more SCSI updates from James Bottomley:
"A couple of late arriving driver updates (lpfc, ufs) with the main
addition being the lock context analysis update where clang static
analysis coupled with annotations are used to verify driver guarantees
about locks and warn on compile if they're inconsistent. This is
mostly annotations with only a few code changes (except in scsi_debug
which needed a fairly big rework to validate with locking context
analysis)"
* tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (103 commits)
scsi: ufs: core: Do not release a reserved request in ufshcd_abort()
scsi: ufs: core: Remove completed-without-interrupt path in ufshcd_abort()
scsi: ufs: core: Fix double release in ufshcd_eh_timed_out()
scsi: ufs: core: Fix double completion in ufshcd_clear_lu_cmds()
scsi: ufs: core: Add a helper for clearing hba->outstanding_reqs
scsi: ufs: core: Remove an always-false WARN_ONCE()
scsi: fnic: Update module authors
[14 lines not shown]
Merge tag 'block-7.4-20261029' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull more block updates from Jens Axboe:
"Bigger than usual for an end-of-merge-window pull request, main reason
being that the MD side I had missed a pull on, and both NVMe and block
got a good pile of LLM driven fixes where some of them may as well
just go in now rather than wait a full cycle. This contains:
- NVMe fixes via Keith:
- nvme-tcp fallout from the parallel queue allocation: initialize
pf_cache_lock and the header digest before requests are set up,
and don't dereference a NULL queue->ctrl on reconnect
- nvme-fabrics queue mapping fixes: reset io_queues on reconnect,
limit each queue type to the online CPUs, and clear a poll map
with no poll queues
- nvme-tcp io_work priority inversion with send_mutex held
(Seiji), error recovery on read_sock failure and skipping TLS
control records while waiting for the ICResp (Martin B), TLS
handshake timeout validation, and an address attribute race
[103 lines not shown]
Merge tag 'io_uring-7.4-20261029' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull io_uring fixes from Jens Axboe:
- A batch of fixes from Chris:
- Charge registered buffer arrays, rsrc nodes, tctx nodes and
personalities to memcg, and free the XArray nodes a failed store
leaves behind.
- Clear bpf_ctx while submitting SQEs from a bpf-ops program, as the
socket code otherwise skips both the capability check and
lock_sock() for a setsockopt from the SQ.
- Free the task context after an RCU grace period, closing a UAF
when a foreign task frees the last request.
- Stop io_ring_exit_work() from waiting on an SQPOLL thread held in
get_signal(), and drop sqd->lock while the thread waits for
in-flight requests, as either one could pin every iou_exit slot
- io-wq fixes:
- Don't create new workers once the exit has begun, which could
[46 lines not shown]
Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux
Pull clk updates from Stephen Boyd:
"Here's the clk changes for the merge window which is dominated in the
diffstat by Qualcomm churning out new SoCs that need clk drivers.
Looking beyond the sheer amount of lines of mostly data there we have
a clk nexus DT binding change in the core clk framework and a driver
core patch to add a subsys driver macro.
The clock nexus support is useful for devices that map clks internally
or for connectors on a board that route clock signals to another
board. I suspect the use of this will expand in the future, so we have
unit tests to make sure it doesn't break.
The driver core change adds subsys_driver() and
subsys_platform_driver() so we can register early drivers without
open-coding that all (module_platform_driver() is at device initcall
level so it isn't be used).
[64 lines not shown]
fs: don't fail __d_obtain_alias() for unlinked inodes
Commit 669bb5af15d4 ("fs: make sure to call fsnotify_inoderemove() only
once when inode is dead") did two things. It made dentry_unlink_inode()
call fsnotify_inoderemove() only once the inode has neither links nor
aliases left. And it made __d_obtain_alias() fail with -ESTALE for an
inode in that state so that open_by_handle_at() can't create a new alias
after FS_DELETE_SELF has been reported and the inode marks are gone.
The second part is wrong for network filesystems. __d_obtain_alias()
backs d_obtain_alias() and d_obtain_root(). Those are what the
->fh_to_dentry() and ->get_parent() methods use to turn the inode they
looked up into a dentry for exportfs_decode_fh_raw(), i.e., for
open_by_handle_at() and for nfsd file handle decoding.
For a local filesystem an in-core inode without links and aliases is an
orphan that goes away on the final iput(). For a network filesystem
that's not true. i_nlink is just the link count the server last
reported and whether the object is still reachable through its file
[50 lines not shown]
ns: don't add init_ipc_ns and init_net without namespace support
When CONFIG_IPC_NS or CONFIG_NET_NS are turned off we still add the
initial ipc and network namespace to the namespace trees. ipc_ns_init()
calls ns_tree_add(&init_ipc_ns) whenever CONFIG_SYSVIPC is set and
setup_net() calls ns_tree_add_raw() on init_net whenever CONFIG_NET is
set.
But without CONFIG_IPC_NS and CONFIG_NET_NS these aren't namespaces
userspace can do anything with. They don't have proc_ns_operations so
there's no /proc/<pid>/ns/{ipc,net} for them, nsfs_fh_to_dentry()
refuses them with -EOPNOTSUPP, and since ns->ops is NULL
__ns_tree_add_raw() doesn't add them to the owner list of init_user_ns
either. So they end up half registered. That's also not how we treat
any of the other namespace types. Without CONFIG_UTS_NS, CONFIG_PID_NS,
CONFIG_TIME_NS or CONFIG_USER_NS the initial namespace is never added
to the tree.
listns() walks the unified tree and calls is_current_namespace() for
[29 lines not shown]
aio: avoid request count overflow in ioctx_alloc()
ioctx_alloc() saves the 32-bit nr_events in max_reqs, then doubles
nr_events before checking the ring-size bound. For
nr_events=0x80000001, the doubled value wraps to 2, so the ring check
passes and aio_setup_ring() builds a one-page/127-slot ring. The
original 0x80000001 is still stored in ctx->max_reqs and charged to the
global aio_nr quota.
If an administrator has raised fs.aio-max-nr to at least 0x80000001,
an unprivileged process can create that context and make later normal
io_setup() calls fail with -EAGAIN until the wrapped context is
destroyed.
Check for too large number of requests before multiplying.
Link: https://lore.kernel.org/all/20261022091748.3653127-1-teel4res@gmail.com
Reported-by: Cheng Yongkang <teel4res at gmail.com>
Signed-off-by: Jan Kara <jack at suse.cz>
[2 lines not shown]
selftests/ovl: fix detached layer mountinfo expectations
set_layers_via_detached_mount_fds was copied from the attached-fd test
and still looks for /tmp paths. Detached open_tree() layers are recorded
by d_path() as upperdir=/upper, workdir=/work, and lowerdir+=/ and
datadir+=/ for each cloned directory. The test has failed since it was
added.
Reported-by: Disha Goel <disgoel at linux.ibm.com>
Link: https://lore.kernel.org/linux-unionfs/20260924112858.51392-2-disgoel@linux.ibm.com
Fixes: ccc829b15d48a ("selftests: add tests for using detached mount with overlayfs")
Signed-off-by: Amir Goldstein <amir73il at gmail.com>
Link: https://patch.msgid.link/20261017165103.2450042-1-amir73il@gmail.com
Signed-off-by: Christian Brauner (Amutable) <brauner at kernel.org>
bpf: Allow bpf_d_path() from filp_close_sync()
The d_path selftest closes its descriptors with close_range() so that
its fentry program on filp_close() runs.
Commit 056069eb2b66 ("fs: make close_range() synchronous") switched
close_range() to filp_close_sync(), so the program still attaches but
is never called:
test_d_path_basic:FAIL:close trampoline for filp_close was not called
With that series, close(), close_range() and the closes on exec and
exit all go through filp_close_sync(). Few paths still reach
filp_close(), dup2() being one of them, so a program on filp_close()
no longer sees most file closes.
Allow bpf_d_path() from filp_close_sync(), but only from fentry.
filp_close_sync() drops the last file reference inline, so by the time
an fexit program runs, file->f_path may already be freed, with no RCU
[11 lines not shown]
fs: skip copy_file_range write limits when there is no data
generic_copy_file_checks() reduces count to zero for a source offset at
or beyond EOF, but still checks the destination write limits. If pos_out
is at RLIMIT_FSIZE, this sends SIGXFSZ and returns -EFBIG even though
there is no data to write.
For example, GNU cat copying a 1024-byte regular file to another regular
file with RLIMIT_FSIZE=1024 copies all bytes and is then killed by its
next copy_file_range() call at EOF. A zero-length request can fail in
the same way.
Check write limits only when count is nonzero, as the ordinary write
checks already do. Keep the other copy validation in place.
Fixes: 96e6e8f4a68d ("vfs: add missing checks to copy_file_range")
Cc: stable at vger.kernel.org
Signed-off-by: Hungyu Lin <dennylin0707 at gmail.com>
Link: https://patch.msgid.link/20261026015738.46230-1-dennylin0707@gmail.com
[2 lines not shown]
