Merge tag 'page_alloc-for-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/mm/page_alloc
Pull page allocator fixes from Vlastimil Babka:
- Stable fixes for various races of page allocator's reading of
zonelists and memory hotplug activity. These can result in BUGs,
allocation failures or allocations from wrong nodes (Gregory Price,
Josef Bacik)
- Stable fixes for bugs free_pages_nolock(), page_frag allocation, page
isolation, that can trigger WARNs, degraded operation or infinite
loop (Josef Bacik)
* tag 'page_alloc-for-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/mm/page_alloc:
mm/page_alloc: remove the zone_spans_pfn() check from get_pfnblock_bitmap_bitidx()
mm/memory_hotplug: resize zones under their seqlock
mm: page_isolation: do not take slab pages for free
mm: page_frag: refill the cache for large fragments
mm/page_alloc: clear ->private of deferred free pages
[13 lines not shown]
Merge tag 'mmc-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc
Pull MMC fixes from Ulf Hansson:
"MMC host:
- jz4740: Remove the host before resetting the controller
- meson-gx: Fix support for busy detection
- mmci: Fix DMA channel leak when mmc_add_host() fails
- omap: Synchronize clock timer before disabling fclk
- sdhci-brcmstb: Don't log an error for missing BOOT registers
- sdhci-esdhc-imx: Map unsupported driver type to Type B
- sunxi: Fix clock and runtime PM leaks on probe failure
MEMSTICK:
- Don't clear dev->driver in memstick_device_remove()"
* tag 'mmc-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
mmc: jz4740: Remove the host before resetting the controller
mmc: sunxi: fix clock and runtime PM leaks on probe failure
mmc: mmci: fix DMA channel leak when mmc_add_host() fails
[8 lines not shown]
Merge tag 'xsa531+532-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip
Pull xen fixes from Juergen Gross:
"Two fixes for the xen-netback driver.
One is a UAF (again - I failed doing a complete fix last week), and
one a possible double unmap of a guest's ring-page, resulting in DoS
of the host or another guest"
* tag 'xsa531+532-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
xen-netback: Zero out sring pointers on unmap
xen-netback: Fix XenBus connection failure cleanup
Merge branch 'amd-iommu-fix'
Merge AMD iommu fix from Jörg Rödel:
"Improper validation of device table accesses in the IOMMU may allow an
out-of-bounds read of a Device Table Entry (DTE), potentially
resulting in loss of system integrity or denial of service.
This issue does not manifest when the device table is configured to
its maximum supported size (Suravee Suthikulpanit)"
* amd-iommu-fix:
iommu/amd: Force device table to maximum size
iommu/amd: Force device table to maximum size
IOMMU can perform out-of-bounds read of the device table entry (DTE)
that is adjacent to the last DTE and falls outside the device table.
For example, if the device table can hold 0 to N-1 entries, then the
IOMMU can be made to fetch the Nth entry, which falls outside the
device table.
The device table is owned by the hypervisor (HV) and is assigned in 4KB
pages that are contiguous in system physical address (SPA). If the
out-of-bound DTE falls on a guest-owned page, then the guest can exploit
this bug to setup malicious table walks to corrupt HV pages and/or bring
down the system. Note that this bug does not manifest when the device
table size is set to its maximum size of 2MB.
Therefore, force the device table size to the maximum 2MB on affected
processors. These are CPU family 0x17 (Zen1/Zen2) through family 0x1a
(Zen5/BRH).
[14 lines not shown]
Merge tag 'vfs-7.4-rc3.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull vfs fixes from Christian Brauner:
- libfs: Make readdir on tmpfs walk the offset tree in offset order
instead of d_children to avoid skipping entries or relisting the
whole directory
It's faster too. Listing a million entries takes 114ms instead of
146ms, and 113ms instead of 470ms with four processes listing in
parallel
- iomap: Finish the ->iomap_next() conversion that started in v7.3
The nilfs2 and fuse ext_map iomap code added this merge window is
converted so now we can remove the ->iomap_begin()/->iomap_end()
fallback. We waited until the new iomap users from other trees were
in mainline otherwise this would have been very messy
[75 lines not shown]
xen-netback: Zero out sring pointers on unmap
If xenvif_map_frontend_data_rings() fails when a ring is already mapped,
it unmaps them via xenvif_unmap_frontend_data_rings() which keeps the
ring pointers unchanged. xenvif_connect_data()'s cleanup path calls
xenvif_disconnect_queue() which in turn calls
xenvif_unmap_frontend_data_rings() again, which will attempt to unmap the
pointers a second time.
Zero out the ring pointers after they are unmapped to avoid this issue.
This is XSA-532
Fixes: 2ac061ce97f4 ("xen/netback: cleanup init and deinit code")
Signed-off-by: Tu Dinh <ngoc-tu.dinh at vates.tech>
Reviewed-by: Juergen Gross <jgross at suse.com>
xen-netback: Fix XenBus connection failure cleanup
xenvif_get_stats and xenvif_get_ethtool_stats capture vif->num_queues
under rcu_read_lock. We need to unpublish vif->num_queues before
synchronize_net to ensure that readers that come afterwards will not
read a non-zero vif->num_queues and attempt to access invalid queues.
This is the same cleanup algorithm as used in backend_disconnect and
added in commit b17075d5c198 ("xen-netback: fix race condition on XenBus
disconnect").
This is XSA-531
Fixes: 5fb756f1bbec ("xen-netback: Fix UAF when reading statistics data")
Signed-off-by: Tu Dinh <ngoc-tu.dinh at vates.tech>
mm/memory_hotplug: resize zones under their seqlock
With CONFIG_DEBUG_VM the page allocator checks that a page which is
freed, split or allocated lies within its zone. The check reads
zone->zone_start_pfn and zone->spanned_pages under zone->span_seqlock, as
memory hotplug can change the two at any time.
Commit 27cacaad16c5 ("mm,memory_hotplug: drop unneeded locking") removed
the write side, since all resizing is serialized by the hotplug lock. That
leaves the reader without protection. When memory below the start of a
zone goes online, the start is lowered first and the size is raised
afterwards. When the lowest memory of a zone goes offline, the size is
reduced first. In between, the zone seems to end before its last pages. If
one of them goes through the allocator at that moment, it is reported as
being outside of the zone triggers VM_BUG_ON_PAGE().
Write the two fields in a write section of the seqlock. Interrupts are
disabled as pages are freed from interrupts, too, and the reader would
wait for the writer which it has interrupted.
[8 lines not shown]
mm/page_alloc: remove the zone_spans_pfn() check from get_pfnblock_bitmap_bitidx()
Whenever the flags of a pageblock are read or written, a kernel with
CONFIG_DEBUG_VM makes sure that the pfn lies within the zone of the page.
Unlike bad_range(), that check reads zone->zone_start_pfn and
zone->spanned_pages without zone->span_seqlock.
Memory hotplug changes the two fields one after the other. If the lower
end of a zone moves, the zone seems to end before its last pages in
between. A page of that part which is freed at that moment, on another
CPU, ends in
page dumped because: VM_BUG_ON_PAGE(!zone_spans_pfn(page_zone(page), pfn))
kernel BUG at mm/page_alloc.c:372!
free_unref_folios+0x55e/0xed0
folios_put_refs+0x2b5/0x530
An attempt has been made [1] to fix this with the span seqlock check.
But that can trigger all sorts of problems in restricted contexts, as
[12 lines not shown]
mm: page_isolation: do not take slab pages for free
page_is_unmovable() regards a page with a reference count of zero as free
or about to be freed. Since slab allocates frozen pages, they will
be wrongly considered to be freed if order 0 (higher-order compound
pages are caught earlier).
If such slabs are the only unmovable pages of a memory block, memory
offlining now isolates the block, this can lead to offline_pages()
looping without progress.
Thus detect the slab pages as removable to return -EBUSY, as would
happen before commit 9aec2fb0fd5e ("slab: allocate frozen pages").
Fixes: 9aec2fb0fd5e ("slab: allocate frozen pages")
Cc: stable at vger.kernel.org
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef at toxicpanda.com>
Signed-off-by: David Hildenbrand (Arm) <david at kernel.org>
[4 lines not shown]
Merge tag 'x86_bugs_tsa_zen5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 TSA fix from Borislav Petkov:
- A mitigation for AMD Zen5's version of TSA
* tag 'x86_bugs_tsa_zen5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/bugs: Mitigate TSA on AMD Zen5
Merge tag 'linux_kselftest-fixes-7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest
Pull kselftest fixes from Shuah Khan:
"Fixes run_fat_tests hang, false bashism in kprobe_non_uniq_symbol.tc,
and ftrace invalid test skip"
* tag 'linux_kselftest-fixes-7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:
selftests/ftrace: Add missing spaces after ! in probe syntax tests
tracing/selftests: Fix false bashism in kprobe_non_uniq_symbol.tc
selftests/filesystems: Fix run_fat_tests hang
Merge tag 'keys-v7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd
Pull key fixes from Jarkko Sakkinen:
- Expand key->datalen and key->quotalen in order to avoid integer
truncation and the leak of quota.
- Enforce KEY_MAX_DESC_SIZE limits across in-kernel and
payload-generated paths.
- Verify the key identity in __key_unlink_begin() as type and
description could also refer to a more recently linked key with
matching properties as the one being unlinked.
- Fix key update race with key GC
* tag 'keys-v7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd:
KEYS: Protect the update method check against type removal
KEYS: Verify the key identity in __key_unlink_begin
[2 lines not shown]
Merge tag 'probes-fixes-v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull probe fixes from Masami Hiramatsu:
"Fix registration and unregistration error handling:
- Release the instruction slot via arch_remove_kprobe() and propagate
the error code when arm_kprobe() fails in
__register_kprobe() instead of leaking the slot and returning 0.
- Skip rethook_free() and kretprobe holder cleanup in
unregister_kretprobes() when __unregister_kprobe_top() fails, and
clear rp->rh after synchronize_rcu() to avoid double free and NULL
pointer dereferences.
- Resolve the target address up-front in register_kretprobe() and
check for re-registration before allocating resources so
symbol_name-based re-registration does not corrupt the active
kretprobe on error.
[49 lines not shown]
fs: fix the SEEK_CUR f_lock condition
Commit da06e3c51794 ("fs: don't needlessly acquire f_lock") wanted to
skip f_lock for SEEK_CUR on files that already serialize f_pos through
f_pos_lock, i.e. FMODE_ATOMIC_POS files and directories, and keep it
for everything else. The condition it added does the opposite:
file_seek_cur_needs_f_lock() returns false exactly for the files that
never take f_pos_lock and true for the ones that do.
So since v6.15 a SEEK_CUR on a shared block device or on a character
device that uses fixed_size_llseek() updates f_pos without any lock and
two concurrent calls can lose an update, while regular files and
directories pay for a spinlock they don't need.
Invert the condition.
Fixes: da06e3c51794 ("fs: don't needlessly acquire f_lock")
Cc: stable at vger.kernel.org
Link: https://patch.msgid.link/20261106-work-file-seek_f_lock-v1-1-5b9a6c2928d4@kernel.org
[2 lines not shown]
kprobes: Arm reused optprobe on cooling list
A new probe that reuses an unused probe still on a cooling list doesn't
fire. reuse_unused_kprobe() clears DISABLED, so register_aggr_kprobe()
doesn't arm it and the probe has no int3 until it's optimized again, or
ever if it can't be (e.g., it has a post_handler).
Keep a reused cooling probe disabled instead, so register_aggr_kprobe()
arms it if the new probe is enabled, or enable_kprobe() does it later.
The probe is then still unused when add_new_kprobe() force-unoptimizes
it for a new probe with a post_handler, which would unhash it and queue
it for freeing. Skip that since a cooling probe is already unoptimized.
With the fix, the new probe fires.
Link: https://lore.kernel.org/all/20261105-kprobes-optprobe-state-v2-3-7a2f5290baa0@columbia.edu/
Fixes: 06e0d3b89da1 ("kprobes: Make optprobe optimizer multi-generational and asynchronous")
Suggested-by: Masami Hiramatsu (Google) <mhiramat at kernel.org>
Signed-off-by: Mani Tofigh <mt4022 at columbia.edu>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat at kernel.org>
kprobes: Do not disarm unhashed optprobe on dispatch
A new probe at the address of a force-unoptimized probe can stop
firing. When unoptimize_kprobe() force-unoptimizes an unused probe it
disarms and unhashes it, but the next dispatch disarms it again. If a
new probe was registered at the same address in the meantime, the
second disarm clears the new probe's int3. For a module address the
same disarm would write to freed module text after rmmod.
Skip the disarm for unhashed probes since they're always disarmed before
they're unhashed. With the fix, the new probe fires.
Link: https://lore.kernel.org/all/20261105-kprobes-optprobe-state-v2-2-7a2f5290baa0@columbia.edu/
Fixes: 06e0d3b89da1 ("kprobes: Make optprobe optimizer multi-generational and asynchronous")
Signed-off-by: Mani Tofigh <mt4022 at columbia.edu>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat at kernel.org>
kprobes: Disarm disabled optprobe on forced unoptimization
A disabled optimized probe can be freed with its int3 still in the
text. It waits on the unoptimizing list for the optimizer to remove its
jump. If another probe is armed on one of the bytes that jump replaced,
unoptimize_kprobe() forces the unoptimization and moves the disabled
probe straight to a cooling list without removing its int3:
Task A (tracefs) Task B (optimizer)
disable k1
/* k1 queued to unoptimize */
/* still on an earlier batch */
enable k2 on a byte k1's jump replaced
unoptimize_kprobe(k1, true)
/* int3 back, k1 on a cooling list */
remove k1
/* k1 freed, int3 left in the text */
The next call into the function then oopses:
[27 lines not shown]
Merge tag 'devm_kmalloc_obj-v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
Pull devm_kmalloc_obj conversion from Kees Cook:
- treewide refresh of kmalloc_obj() conversions
- devm_kmalloc_obj conversion rules added to Coccinelle scripting
- treewide conversion of devm_kmalloc() family to devm_kmalloc_obj()
* tag 'devm_kmalloc_obj-v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
treewide: Convert devm_kmalloc() family to the devm_kmalloc_obj() family
coccinelle: kmalloc_obj: Include devm_kmalloc_obj conversion rules
treewide: refresh kmalloc_obj() conversions
Merge tag 'driver-core-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core
Pull driver core fixes from Danilo Krummrich:
- Fix an unused-function warning in the Rust I/O code that breaks
builds with CONFIG_PCI disabled and CONFIG_WERROR enabled
- Fix kernfs sparse warnings on SMP Alpha when inheriting a parent
node's group ID
- Add Johan Hovold as an auxiliary bus maintainer
* tag 'driver-core-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core:
MAINTAINERS: update auxiliary bus entry
kernfs: avoid READ_ONCE() on a kgid_t in kernfs_new_node()
rust: io: fix unused Flags::from_raw warning without CONFIG_PCI
Merge tag 'ata-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux
Pull ata fixes from Niklas Cassel:
- Allow re-enabling NCQ, after EH disabled it, by writing the current
queue depth to the queue_depth sysfs attribute (Igor)
- Retry failed non-NCQ commands when their sense data asks for a
retry, as is already done for NCQ commands. Previously, such
non-NCQ commands were never retried (me)
- Only check the power mode of ATA and ZAC devices before putting
them in standby mode (on suspend, shutdown or device removal).
libata never puts other devices, such as ATAPI devices, in standby
mode, and some ATAPI devices reject the CHECK POWER MODE command
(Giuseppe)
- Fix several bugs in the MODE SELECT translation.
[35 lines not shown]
Merge tag 'firewire-fixes-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394
Pull firewire fix from Takashi Sakamoto:
"Fix a race in the 1394 OHCI driver, introduced in v7.4-rc1
Queueing an AT local request in interrupt context can race with
dequeueing requests in a workqueue without disabling interrupts,
potentially leading to a deadlock"
* tag 'firewire-fixes-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394:
firewire: ohci: avoid potential deadlock when queueing AT local requests
Merge tag 'mips-fixes_7.4_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux
Pull MIPS fixes from Thomas Bogendoerfer:
"Alchemy:
- Fix /proc/interrups
- Preserve ethernet address from PROM
SGI:
- IP27: Fix NMI dump
- IP30: make defconfig more useful
- IP32: added workarounds for crime revision 1.1
Others:
- Fix compressed kernel linked with ld.lld
- Fix IDE ports on Cobalt devices
- Reject wrong affinity settings on SB1250 platforms"
* tag 'mips-fixes_7.4_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux:
MIPS: SB1250: Validate and update IRQ affinity
[12 lines not shown]
Merge tag 'x86-urgent-2026-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fixes from Ingo Molnar:
- Select the BHI mitigation based on the attack vector properly
(Breno Leitao)
- Fix i386-gcov build bug in csum_ipv6_magic() due to overly
strict asm constraints that cannot be met in that build mode
(Rosen Penev)
- Fix Vmware-guest i386 high-bandwidth hypercall arguments
under UNWINDER_GUESS & disabled frame-pointers (Zack Rusin)
- Fix resctrl AMD ABMC counter ID field width (Babu Moger)
- Fix restctrl pqos tool ABI breakage by reverting the
mbm_assign_mode to default mode at boot (Babu Moger)
[36 lines not shown]
Merge tag 'sched-urgent-2026-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull scheduler fixes from Ingo Molnar:
- Fix this_bw on class change of a dying SCHED_DEADLINE task
(Nickolai Zeldovich)
- Account I/O waits independently of delayed dequeue
(Christian Loehle)
- Clear throttle state when leaving the fair class (Daehyeon Ko)
- Fix u32 truncation of the PELT period count (Hui Su)
- Fix imbalanced cluster static-key updates that can mistakenly
disable cluster-aware scheduling (Hui Su)
- Fix active load balancing logic to ignore non-fair current
in alb_break_llc() (Kayra Cizmeci)
[8 lines not shown]
Merge tag 'perf-urgent-2026-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull perf events fixes from Ingo Molnar:
- Fix sideband event output when only requesting attr.defer_output
(Ian Rogers)
- Clamp deferred callchain entry count to fit u16 header.size
(Ian Rogers)
- Various AMD IBS fixes (Ravi Bangoria):
- Reset CPU0 IBS state on syscore resume
- Fix kernel address leak via REGS_USER and REGS_INTR
- Simplify/fix event state handling with IBS_CAPS_DIS
- Revert AUX page allocation order default to be continuous (Leo Yan)
- Don't send SIGTRAP after exec removed the event (Danish Khateeb)
[8 lines not shown]
Merge tag 'locking-urgent-2026-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull locking fixes from Ingo Molnar:
- Fix lockdep message output (Zhuangzhuang Wang)
- Fix OSQ memory ordering bugs, one of which can cause
unlink queue corruption (Peter Zijlstra)
* tag 'locking-urgent-2026-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
locking/osq: Fix unlink queue corruption
locking/osq: Switch osq_wait_next()/atomic_cmpxchg() ordering
locking/lockdep: Fix inverted "on"/"last" CPU label in lockdep_print_held_locks()
Merge tag 'rust-fixes-7.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux
Pull Rust fixes from Miguel Ojeda:
"Toolchain and infrastructure:
- Fix build error with bindgen 0.73 in certain configs such as
allmodconfig by deriving 'Zeroable' for opaque array wrappers.
'kernel' crate:
- 'cpufreq' module: clean 'undocumented_unsafe_blocks' Clippy warning
for Rust <= 1.86"
* tag 'rust-fixes-7.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:
rust: bindings: derive Zeroable for bindgen's opaque array wrappers
rust: cpufreq: fix `undocumented_unsafe_blocks` in `PolicyCpu::from_cpu()`
