Merge tag 'linux_kselftest-fixes-7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest
Pull kselftest fixes from Shuah Khan:
"Fixes run_fat_tests hang, false bashism in kprobe_non_uniq_symbol.tc,
and ftrace invalid test skip"
* tag 'linux_kselftest-fixes-7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:
selftests/ftrace: Add missing spaces after ! in probe syntax tests
tracing/selftests: Fix false bashism in kprobe_non_uniq_symbol.tc
selftests/filesystems: Fix run_fat_tests hang
Merge tag 'keys-v7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd
Pull key fixes from Jarkko Sakkinen:
- Expand key->datalen and key->quotalen in order to avoid integer
truncation and the leak of quota.
- Enforce KEY_MAX_DESC_SIZE limits across in-kernel and
payload-generated paths.
- Verify the key identity in __key_unlink_begin() as type and
description could also refer to a more recently linked key with
matching properties as the one being unlinked.
- Fix key update race with key GC
* tag 'keys-v7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd:
KEYS: Protect the update method check against type removal
KEYS: Verify the key identity in __key_unlink_begin
[2 lines not shown]
Merge tag 'probes-fixes-v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull probe fixes from Masami Hiramatsu:
"Fix registration and unregistration error handling:
- Release the instruction slot via arch_remove_kprobe() and propagate
the error code when arm_kprobe() fails in
__register_kprobe() instead of leaking the slot and returning 0.
- Skip rethook_free() and kretprobe holder cleanup in
unregister_kretprobes() when __unregister_kprobe_top() fails, and
clear rp->rh after synchronize_rcu() to avoid double free and NULL
pointer dereferences.
- Resolve the target address up-front in register_kretprobe() and
check for re-registration before allocating resources so
symbol_name-based re-registration does not corrupt the active
kretprobe on error.
[49 lines not shown]
kprobes: Arm reused optprobe on cooling list
A new probe that reuses an unused probe still on a cooling list doesn't
fire. reuse_unused_kprobe() clears DISABLED, so register_aggr_kprobe()
doesn't arm it and the probe has no int3 until it's optimized again, or
ever if it can't be (e.g., it has a post_handler).
Keep a reused cooling probe disabled instead, so register_aggr_kprobe()
arms it if the new probe is enabled, or enable_kprobe() does it later.
The probe is then still unused when add_new_kprobe() force-unoptimizes
it for a new probe with a post_handler, which would unhash it and queue
it for freeing. Skip that since a cooling probe is already unoptimized.
With the fix, the new probe fires.
Link: https://lore.kernel.org/all/20261105-kprobes-optprobe-state-v2-3-7a2f5290baa0@columbia.edu/
Fixes: 06e0d3b89da1 ("kprobes: Make optprobe optimizer multi-generational and asynchronous")
Suggested-by: Masami Hiramatsu (Google) <mhiramat at kernel.org>
Signed-off-by: Mani Tofigh <mt4022 at columbia.edu>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat at kernel.org>
kprobes: Do not disarm unhashed optprobe on dispatch
A new probe at the address of a force-unoptimized probe can stop
firing. When unoptimize_kprobe() force-unoptimizes an unused probe it
disarms and unhashes it, but the next dispatch disarms it again. If a
new probe was registered at the same address in the meantime, the
second disarm clears the new probe's int3. For a module address the
same disarm would write to freed module text after rmmod.
Skip the disarm for unhashed probes since they're always disarmed before
they're unhashed. With the fix, the new probe fires.
Link: https://lore.kernel.org/all/20261105-kprobes-optprobe-state-v2-2-7a2f5290baa0@columbia.edu/
Fixes: 06e0d3b89da1 ("kprobes: Make optprobe optimizer multi-generational and asynchronous")
Signed-off-by: Mani Tofigh <mt4022 at columbia.edu>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat at kernel.org>
kprobes: Disarm disabled optprobe on forced unoptimization
A disabled optimized probe can be freed with its int3 still in the
text. It waits on the unoptimizing list for the optimizer to remove its
jump. If another probe is armed on one of the bytes that jump replaced,
unoptimize_kprobe() forces the unoptimization and moves the disabled
probe straight to a cooling list without removing its int3:
Task A (tracefs) Task B (optimizer)
disable k1
/* k1 queued to unoptimize */
/* still on an earlier batch */
enable k2 on a byte k1's jump replaced
unoptimize_kprobe(k1, true)
/* int3 back, k1 on a cooling list */
remove k1
/* k1 freed, int3 left in the text */
The next call into the function then oopses:
[27 lines not shown]
Merge tag 'devm_kmalloc_obj-v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
Pull devm_kmalloc_obj conversion from Kees Cook:
- treewide refresh of kmalloc_obj() conversions
- devm_kmalloc_obj conversion rules added to Coccinelle scripting
- treewide conversion of devm_kmalloc() family to devm_kmalloc_obj()
* tag 'devm_kmalloc_obj-v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
treewide: Convert devm_kmalloc() family to the devm_kmalloc_obj() family
coccinelle: kmalloc_obj: Include devm_kmalloc_obj conversion rules
treewide: refresh kmalloc_obj() conversions
Merge tag 'driver-core-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core
Pull driver core fixes from Danilo Krummrich:
- Fix an unused-function warning in the Rust I/O code that breaks
builds with CONFIG_PCI disabled and CONFIG_WERROR enabled
- Fix kernfs sparse warnings on SMP Alpha when inheriting a parent
node's group ID
- Add Johan Hovold as an auxiliary bus maintainer
* tag 'driver-core-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core:
MAINTAINERS: update auxiliary bus entry
kernfs: avoid READ_ONCE() on a kgid_t in kernfs_new_node()
rust: io: fix unused Flags::from_raw warning without CONFIG_PCI
Merge tag 'ata-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux
Pull ata fixes from Niklas Cassel:
- Allow re-enabling NCQ, after EH disabled it, by writing the current
queue depth to the queue_depth sysfs attribute (Igor)
- Retry failed non-NCQ commands when their sense data asks for a
retry, as is already done for NCQ commands. Previously, such
non-NCQ commands were never retried (me)
- Only check the power mode of ATA and ZAC devices before putting
them in standby mode (on suspend, shutdown or device removal).
libata never puts other devices, such as ATAPI devices, in standby
mode, and some ATAPI devices reject the CHECK POWER MODE command
(Giuseppe)
- Fix several bugs in the MODE SELECT translation.
[35 lines not shown]
Merge tag 'firewire-fixes-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394
Pull firewire fix from Takashi Sakamoto:
"Fix a race in the 1394 OHCI driver, introduced in v7.4-rc1
Queueing an AT local request in interrupt context can race with
dequeueing requests in a workqueue without disabling interrupts,
potentially leading to a deadlock"
* tag 'firewire-fixes-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394:
firewire: ohci: avoid potential deadlock when queueing AT local requests
Merge tag 'mips-fixes_7.4_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux
Pull MIPS fixes from Thomas Bogendoerfer:
"Alchemy:
- Fix /proc/interrups
- Preserve ethernet address from PROM
SGI:
- IP27: Fix NMI dump
- IP30: make defconfig more useful
- IP32: added workarounds for crime revision 1.1
Others:
- Fix compressed kernel linked with ld.lld
- Fix IDE ports on Cobalt devices
- Reject wrong affinity settings on SB1250 platforms"
* tag 'mips-fixes_7.4_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux:
MIPS: SB1250: Validate and update IRQ affinity
[12 lines not shown]
Merge tag 'x86-urgent-2026-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fixes from Ingo Molnar:
- Select the BHI mitigation based on the attack vector properly
(Breno Leitao)
- Fix i386-gcov build bug in csum_ipv6_magic() due to overly
strict asm constraints that cannot be met in that build mode
(Rosen Penev)
- Fix Vmware-guest i386 high-bandwidth hypercall arguments
under UNWINDER_GUESS & disabled frame-pointers (Zack Rusin)
- Fix resctrl AMD ABMC counter ID field width (Babu Moger)
- Fix restctrl pqos tool ABI breakage by reverting the
mbm_assign_mode to default mode at boot (Babu Moger)
[36 lines not shown]
Merge tag 'sched-urgent-2026-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull scheduler fixes from Ingo Molnar:
- Fix this_bw on class change of a dying SCHED_DEADLINE task
(Nickolai Zeldovich)
- Account I/O waits independently of delayed dequeue
(Christian Loehle)
- Clear throttle state when leaving the fair class (Daehyeon Ko)
- Fix u32 truncation of the PELT period count (Hui Su)
- Fix imbalanced cluster static-key updates that can mistakenly
disable cluster-aware scheduling (Hui Su)
- Fix active load balancing logic to ignore non-fair current
in alb_break_llc() (Kayra Cizmeci)
[8 lines not shown]
Merge tag 'perf-urgent-2026-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull perf events fixes from Ingo Molnar:
- Fix sideband event output when only requesting attr.defer_output
(Ian Rogers)
- Clamp deferred callchain entry count to fit u16 header.size
(Ian Rogers)
- Various AMD IBS fixes (Ravi Bangoria):
- Reset CPU0 IBS state on syscore resume
- Fix kernel address leak via REGS_USER and REGS_INTR
- Simplify/fix event state handling with IBS_CAPS_DIS
- Revert AUX page allocation order default to be continuous (Leo Yan)
- Don't send SIGTRAP after exec removed the event (Danish Khateeb)
[8 lines not shown]
Merge tag 'locking-urgent-2026-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull locking fixes from Ingo Molnar:
- Fix lockdep message output (Zhuangzhuang Wang)
- Fix OSQ memory ordering bugs, one of which can cause
unlink queue corruption (Peter Zijlstra)
* tag 'locking-urgent-2026-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
locking/osq: Fix unlink queue corruption
locking/osq: Switch osq_wait_next()/atomic_cmpxchg() ordering
locking/lockdep: Fix inverted "on"/"last" CPU label in lockdep_print_held_locks()
Merge tag 'rust-fixes-7.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux
Pull Rust fixes from Miguel Ojeda:
"Toolchain and infrastructure:
- Fix build error with bindgen 0.73 in certain configs such as
allmodconfig by deriving 'Zeroable' for opaque array wrappers.
'kernel' crate:
- 'cpufreq' module: clean 'undocumented_unsafe_blocks' Clippy warning
for Rust <= 1.86"
* tag 'rust-fixes-7.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:
rust: bindings: derive Zeroable for bindgen's opaque array wrappers
rust: cpufreq: fix `undocumented_unsafe_blocks` in `PolicyCpu::from_cpu()`
Merge tag 'for-7.4-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux
Pull btrfs fixes from David Sterba:
"A btrfs fixes. The ones that could have some user noticeable impact
are enumerated, the rest is one-liners.
- fix chattr failing on files with nodatasum and compress flags
- fix inode defrag status with concurrent truncation so it's not
skipped in defrag in the future
- fix merging compressed extent in fiemap output
- fix deleting wrong subvolume by id if it gets renamed during the
ioctl
- error handling fixes: sysfs, quotas, fs-verity, scrub, zoned mode"
* tag 'for-7.4-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
[16 lines not shown]
Merge tag 'ksmbd-for-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb
Pull smb server updates from Namjae Jeon:
- Validate EA-name NUL termination to prevent out-of-bounds reads in
debug logging. Return STATUS_EA_LIST_INCONSISTENT for malformed EA
names in CREATE and SET_INFO requests.
- Grant the owner's implicit READ_CONTROL and WRITE_DAC rights when no
ACE names it, including MAXIMUM_ALLOWED handling, while respecting
applicable OWNER RIGHTS ACEs.
- Check group membership before granting permissions from a POSIX ACL
group entry, preventing unintended access when a caller's UID matches
the group's numeric GID.
- Avoid reading past the DACL when logging an access denial by printing
the requested and allowed access masks instead.
[23 lines not shown]
Merge tag 'ntfs-for-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs
Pull ntfs fixes from Namjae Jeon:
- Don't allow compression to be enabled through system.ntfs_attrib on
volumes with clusters larger than 4 KiB, preventing out-of-bounds
accesses in the compressed read path.
- Don't allow resident attribute values to overlap the attribute
header, preventing malformed records from causing writes outside the
MFT record buffer.
- Fix recursive acquisition of the mapping invalidate lock when writing
to non-resident named streams through NTFS_IOC_STREAM_WRITE.
- Keep the file size unchanged when extending the initialized size
fails, avoiding unintended truncation and page-cache removal.
- Avoid integer overflow when limiting attribute reads to the attribute
[21 lines not shown]
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull SCSI fixes from James Bottomley:
"Mostly fixes in drivers.
The three core changes are moving the target reap into the main exit
path of pseudo device allocation to fix a leak and a couple of minor
error propagation updates in bsg.
The largest driver fix is the rethreading of Buslogic to enable
context locking that was held back from the merge window pull due to
problems spotted by the maintainer"
* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
scsi: target: tcmu: Fix divide-by-zero in data_pages_per_blk store
scsi: target: Verify the iSCSI ISID is null-terminated
scsi: bsg: Report io_uring data copyback failures
scsi: bsg: Report synchronous data copyback failures
scsi: target: Validate REGISTER AND MOVE TransportID length
[12 lines not shown]
Merge tag 'spi-fix-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
Pull spi fixes from Mark Brown:
"As well as a few driver specific fixes we have a couple of core fixes
here.
One avoids requesting interrupts until we have validated that we have
a SPI device, avoiding triggering warnings on boot.
The other avoids a request for a zero length scatterlist triggering a
BUG_ON() in swiotlb on 64k page systems, this was due to using both
DIV_ROUND_UP() and min() to compute lengths"
* tag 'spi-fix-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
spi: cadence-quadspi: Fix race between DMA completion and transfer start
spi: ljca: Don't require data in write replies
spi: acpi: only look up the IRQ of confirmed SPI devices
spi: pic32-sqi: fail transfer when the BD ring is exhausted
spi: fix zero-length scatterlist entries for vmalloc buffers
[2 lines not shown]
Merge tag 'regulator-fix-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator
Pull regulator fixes from Mark Brown:
"A small collection of mostly fairly standard driver specific fixes.
The mt6363 changes are a little large but are the result of two
independent users running into the same issues and testing each
other's changes so given that it's only -rc1 it seemed sensible to
take the changes as fixes"
* tag 'regulator-fix-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
regulator: mt6363: Fix VEMC voltage selection
regulator: mt6363: Use 8-bit register values
regulator: mt6363: Fix the registers of the VSRAM CPU and APU LDOs
regulator: qcom_spmi: don't take a sleeping lock in the SAW IPI
Merge tag 'devicetree-fixes-for-7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux
Pull devicetree fixes from Rob Herring:
"All of these are patches that didn't get picked up for the merge
window. They all fix new warnings because the corresponding .dts
changes did get applied
- Add Altera Agilex5 DWC3 controller and Raspberry Pi RP1 PWM
controller bindings
- Make "peer-hub" property optional on cypress,hx3 USB hubs"
* tag 'devicetree-fixes-for-7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux:
dt-bindings: usb: add Altera Agilex5 DWC3 controller
dt-bindings: pwm: Add Raspberry Pi RP1 PWM controller
dt-bindings: usb: cypress,hx3: make peer-hub property optional
Merge tag 'sound-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"A collection of (unsurprisingly high amount of) small fixes since the
previous PR. Majority of changes are device-specific quirks and driver
fixes, along with a few ALSA core fixes and USB-audio driver
hardening.
ALSA Core:
- Fix page leak on WC DMA buffer allocation failure
- Prevent O_APPEND on OSS streams to avoid UAF
- A PCM regression fix for PulseAudio to allow hw_refine with mmap
- Serialize DSP image loading requests in hwdep
- Clear user-provided numid before adding a control
- Fix dropped data bytes in UMP to MIDI 1.0 System message conversion
HD-audio:
- Fix double-free on stream page allocation failure in core
- Stop capability walk cleanly on empty capability header
[52 lines not shown]
x86/mm: Fix global ASID handed out to two processes
On AMD CPUs with INVLPGB, two live processes can get the same MAX_ASID_AVAILABLE
global ASID value. The two then hit each other's TLB entries, so each can read
or corrupt the other's memory.
The global ASID space is managed lazily. When a global ASID is freed, its bit is
set in the global_asid_freed bitmap. Once the free ASID search reaches the end
of the global_asid_used bitmap, a global flush is done to really reclaim the
lazily freed global ASIDs.
However, the current code can assign the same global ASID to two different
processes, if one process is assigned MAX_ASID_AVAILABLE - 1, another process
MAX_ASID_AVAILABLE, and both stick around (keeping their global ASID numbers in
use) until the search wraps around again. At that point a third process could
also get assigned MAX_ASID_AVAILABLE.
the highest ASID stays in use, so it is not handed out again
last_global_asid stays below it, so no reset
[25 lines not shown]
Merge tag 'drm-fixes-2026-11-07' of https://gitlab.freedesktop.org/drm/kernel
Pull drm fixes from Dave Airlie:
"This is the weekly drm fixes, amdgpu leading the way with some i915,
nouveau and other fixes.
There should be a bunch of xe fixes, but their tree got screwed up so
I guess I'll send those next week once they cleanup whatever happened.
atomic:
- Fix CRTC dma-fence handling
drm:
- Add parsing for additional HDMI 2.2 FRL rates
bridge:
- nwl-dsi: Fix LCDIF handling
dma-buf:
[105 lines not shown]
tracing/eprobe: Install the trigger for every instance that enables the eprobe
The eprobe trigger lives in the instance of the enabling file, but it is
only added when the eprobe is first enabled and only removed when the
last file goes away. A second instance then records nothing, and the
first instance's trigger is left behind once the eprobe is disabled
there, so the eprobe can be deleted while that trigger still uses it.
Add and remove the trigger for each file. The file is never NULL here,
so warn if it is and drop the dead perf paths.
Link: https://lore.kernel.org/all/20261107101233.151434-1-devnexen@gmail.com/
Fixes: 7491e2c44278 ("tracing: Add a probe that attaches to trace events")
Cc: stable at vger.kernel.org
Signed-off-by: David Carlier <devnexen at gmail.com>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat at kernel.org>
tracing/probes: bound symstr stores to reserved length
Traceprobe calculates dynamic string sizes before storing the values. A
probed pointer can change between those passes, so
fetch_store_symstrlen() can reserve space for a short symbol while
fetch_store_symstring() observes a longer one. The store path then
overwrites the trace record.
Format the symbol into a temporary KSYM_SYMBOL_LEN buffer and copy only
the bytes that fit in the reserved field, including a trailing NUL.
Update __data_loc with the length actually stored so consumers do not
read beyond the truncated value.
Link: https://lore.kernel.org/all/179378621331.55520.2052332247156241151@stu.pku.edu.cn/
Fixes: b26a124cbfa8 ("tracing/probes: Add symstr type for dynamic events")
Signed-off-by: Yifan Zhang <yfzhang23 at stu.pku.edu.cn>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat at kernel.org>
ata: libata-scsi: reject data-in commands with a data-out buffer
SG_IO can submit a data-in SCSI command with DMA_TO_DEVICE. The
scatterlist can then contain pages pinned without write access.
ata_scsi_rbuf_fill() writes simulated replies to that scatterlist;
in the reported case, the copy tried to write the shared zero page
and faulted in the kernel.
The same mismatch can affect SG_IO commands translated by libata.
ZBC IN and GET PHYSICAL ELEMENT STATUS completion handlers can modify
the receive buffer even if the drive aborts the command. For ATAPI,
the successful INQUIRY completion also rewrites the buffer in
atapi_fixup_inquiry().
Reject these mismatched commands before the buffer is written or the
command is issued. Report ABORTED COMMAND / DATA IN BUFFER ERROR because
the CDB itself can be valid; the supplied transfer direction is wrong.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
[8 lines not shown]
