Merge tag 'loongarch-fixes-7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson
Pull LoongArch fixes from Huacai Chen:
"Fix several bugs in ACPI IOVT, KEXEC, Hibernation, BPF JIT and KVM"
* tag 'loongarch-fixes-7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson:
LoongArch: KVM: Reject repeated PCH-PIC CTRL_INIT
LoongArch: KVM: Propagate real error code in kvm_pch_pic_create()
LoongArch: KVM: Clear device pointer in irqchip destroy callbacks
LoongArch: BPF: Make use of beqz and bnez for trampoline branches
LoongArch: BPF: Make arena support depend on 128-bit cmpxchg
LoongArch: Restore KFENCE pages through DMW on resume
LoongArch: kexec_file: Fix elf_headers memory leak in retry loop
LoongArch: kexec_file: Fix a modified cmdline leak
ACPI: LoongArch: Validate ACPI IOVT device entries
ACPI: LoongArch: Add checksum validation for ACPI IOVT table
ACPI: LoongArch: Fix incorrect pointer in acpi_iovt_init()
Merge tag 'v7.4-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
Pull crypto fixes from Herbert Xu:
- Fix potential overflow from malformed keys in caam
- Fix use-after-free in essiv
- Fix potential dead-lock in ccp when combined with KVM changes in
mainline
* tag 'v7.4-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
crypto: ccp - Make usage of sev_cmd_mutex more granular
crypto: essiv - fix use-after-free in AEAD path
crypto: caam - reject overlong RSA CRT parameters
Merge tag 'page_alloc-for-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/mm/page_alloc
Pull page allocator fixes from Vlastimil Babka:
- Stable fixes for various races of page allocator's reading of
zonelists and memory hotplug activity. These can result in BUGs,
allocation failures or allocations from wrong nodes (Gregory Price,
Josef Bacik)
- Stable fixes for bugs free_pages_nolock(), page_frag allocation, page
isolation, that can trigger WARNs, degraded operation or infinite
loop (Josef Bacik)
* tag 'page_alloc-for-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/mm/page_alloc:
mm/page_alloc: remove the zone_spans_pfn() check from get_pfnblock_bitmap_bitidx()
mm/memory_hotplug: resize zones under their seqlock
mm: page_isolation: do not take slab pages for free
mm: page_frag: refill the cache for large fragments
mm/page_alloc: clear ->private of deferred free pages
[13 lines not shown]
Merge tag 'mmc-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc
Pull MMC fixes from Ulf Hansson:
"MMC host:
- jz4740: Remove the host before resetting the controller
- meson-gx: Fix support for busy detection
- mmci: Fix DMA channel leak when mmc_add_host() fails
- omap: Synchronize clock timer before disabling fclk
- sdhci-brcmstb: Don't log an error for missing BOOT registers
- sdhci-esdhc-imx: Map unsupported driver type to Type B
- sunxi: Fix clock and runtime PM leaks on probe failure
MEMSTICK:
- Don't clear dev->driver in memstick_device_remove()"
* tag 'mmc-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
mmc: jz4740: Remove the host before resetting the controller
mmc: sunxi: fix clock and runtime PM leaks on probe failure
mmc: mmci: fix DMA channel leak when mmc_add_host() fails
[8 lines not shown]
Merge tag 'xsa531+532-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip
Pull xen fixes from Juergen Gross:
"Two fixes for the xen-netback driver.
One is a UAF (again - I failed doing a complete fix last week), and
one a possible double unmap of a guest's ring-page, resulting in DoS
of the host or another guest"
* tag 'xsa531+532-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
xen-netback: Zero out sring pointers on unmap
xen-netback: Fix XenBus connection failure cleanup
Merge branch 'amd-iommu-fix'
Merge AMD iommu fix from Jörg Rödel:
"Improper validation of device table accesses in the IOMMU may allow an
out-of-bounds read of a Device Table Entry (DTE), potentially
resulting in loss of system integrity or denial of service.
This issue does not manifest when the device table is configured to
its maximum supported size (Suravee Suthikulpanit)"
* amd-iommu-fix:
iommu/amd: Force device table to maximum size
iommu/amd: Force device table to maximum size
IOMMU can perform out-of-bounds read of the device table entry (DTE)
that is adjacent to the last DTE and falls outside the device table.
For example, if the device table can hold 0 to N-1 entries, then the
IOMMU can be made to fetch the Nth entry, which falls outside the
device table.
The device table is owned by the hypervisor (HV) and is assigned in 4KB
pages that are contiguous in system physical address (SPA). If the
out-of-bound DTE falls on a guest-owned page, then the guest can exploit
this bug to setup malicious table walks to corrupt HV pages and/or bring
down the system. Note that this bug does not manifest when the device
table size is set to its maximum size of 2MB.
Therefore, force the device table size to the maximum 2MB on affected
processors. These are CPU family 0x17 (Zen1/Zen2) through family 0x1a
(Zen5/BRH).
[14 lines not shown]
Merge tag 'vfs-7.4-rc3.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull vfs fixes from Christian Brauner:
- libfs: Make readdir on tmpfs walk the offset tree in offset order
instead of d_children to avoid skipping entries or relisting the
whole directory
It's faster too. Listing a million entries takes 114ms instead of
146ms, and 113ms instead of 470ms with four processes listing in
parallel
- iomap: Finish the ->iomap_next() conversion that started in v7.3
The nilfs2 and fuse ext_map iomap code added this merge window is
converted so now we can remove the ->iomap_begin()/->iomap_end()
fallback. We waited until the new iomap users from other trees were
in mainline otherwise this would have been very messy
[75 lines not shown]
xen-netback: Zero out sring pointers on unmap
If xenvif_map_frontend_data_rings() fails when a ring is already mapped,
it unmaps them via xenvif_unmap_frontend_data_rings() which keeps the
ring pointers unchanged. xenvif_connect_data()'s cleanup path calls
xenvif_disconnect_queue() which in turn calls
xenvif_unmap_frontend_data_rings() again, which will attempt to unmap the
pointers a second time.
Zero out the ring pointers after they are unmapped to avoid this issue.
This is XSA-532
Fixes: 2ac061ce97f4 ("xen/netback: cleanup init and deinit code")
Signed-off-by: Tu Dinh <ngoc-tu.dinh at vates.tech>
Reviewed-by: Juergen Gross <jgross at suse.com>
xen-netback: Fix XenBus connection failure cleanup
xenvif_get_stats and xenvif_get_ethtool_stats capture vif->num_queues
under rcu_read_lock. We need to unpublish vif->num_queues before
synchronize_net to ensure that readers that come afterwards will not
read a non-zero vif->num_queues and attempt to access invalid queues.
This is the same cleanup algorithm as used in backend_disconnect and
added in commit b17075d5c198 ("xen-netback: fix race condition on XenBus
disconnect").
This is XSA-531
Fixes: 5fb756f1bbec ("xen-netback: Fix UAF when reading statistics data")
Signed-off-by: Tu Dinh <ngoc-tu.dinh at vates.tech>
LoongArch: KVM: Reject repeated PCH-PIC CTRL_INIT
KVM_DEV_LOONGARCH_PCH_PIC_CTRL_INIT has no guard against repeated
invocation: every call overwrites pch_pic_base and registers the same
kvm_io_device on the MMIO bus at the new base address, while the
kvm_pch_pic_destroy() unregisters only one bus range. After a repeated
init, MMIO to the stale ranges computes its register offset against the
new base address and silently reads 0 / drops writes, and the leftover
bus entries persist until the VM is destroyed.
Reject repeated initialization with -EEXIST, using the initialized
state of the kvm_io_device as the indicator. The check, the MMIO base
update and the bus registration are serialized by slots_lock, and the
real registration error is propagated instead of being replaced with
-EFAULT. On a registration failure the base addr and the device state
are rolled back so that a retry can start over.
Cc: stable at vger.kernel.org
Fixes: d206d9514873 ("LoongArch: KVM: Add PCHPIC user mode read and write functions")
[3 lines not shown]
LoongArch: KVM: Clear device pointer in irqchip destroy callbacks
The destroy callbacks of the four irqchip devices free the device
structure without clearing kvm->arch.{ipi,eiointc,pch_pic,dmsintc},
leaving a dangling pointer. ops->destroy() is not only called at VM
teardown but also when KVM_CREATE_DEVICE succeeds and the following
anon_inode_getfd() fails (e.g. under RLIMIT_NOFILE); the VM stays
alive, kvm_arch_irqchip_in_kernel() still reports true, and interrupt
injection dereferences the freed device.
Clear the pointer when destroying.
Cc: stable at vger.kernel.org
Fixes: c532de5a67a7 ("LoongArch: KVM: Add IPI device support")
Fixes: 2e8b9df82631 ("LoongArch: KVM: Add EIOINTC device support")
Fixes: e785dfacf7e7 ("LoongArch: KVM: Add PCHPIC device support")
Fixes: 229132c309d6 ("LoongArch: KVM: Add DMSINTC device support")
Reviewed-by: Bibo Mao <maobibo at loongson.cn>
Signed-off-by: Tao Cui <cuitao at kylinos.cn>
Signed-off-by: Huacai Chen <chenhuacai at loongson.cn>
LoongArch: KVM: Propagate real error code in kvm_pch_pic_create()
The real error code of kvm_setup_default_irq_routing() is replaced by
kvm_pch_pic_create() with a fixed -ENOMEM. Return the actual error code,
as kvm_eiointc_create() already does; while the kvm_ipi_create() case is
fixed separately by "Return the actual error code in kvm_ipi_create()"
(Chaithanya Lagisetty).
Cc: stable at vger.kernel.org
Fixes: e785dfacf7e7 ("LoongArch: KVM: Add PCHPIC device support")
Reviewed-by: Bibo Mao <maobibo at loongson.cn>
Signed-off-by: Tao Cui <cuitao at kylinos.cn>
Signed-off-by: Huacai Chen <chenhuacai at loongson.cn>
LoongArch: BPF: Make use of beqz and bnez for trampoline branches
Currently, the implementation for BPF trampoline branches does not match
the existing technical comments. The code uses larch_insn_gen_beq, where
the comment indicates beqz should be used.
While the BPF trampoline size is restricted within a single memory page
(at most 64KB on LoongArch) and cannot cross the original 16-bit branch
offset limit of the reg2i16 format, switching to the beqz instruction
(which belongs to the reg1i21 format) avoids explicitly specifying the
zero register during dynamic JIT encoding, resulting in cleaner assembly
generation.
While at it, also apply the same optimization to the bne instruction by
replacing it with bnez and adding a corresponding comment.
Cc: stable at vger.kernel.org
Signed-off-by: Tiezhu Yang <yangtiezhu at loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai at loongson.cn>
LoongArch: Restore KFENCE pages through DMW on resume
With KFENCE enabled, resume from hibernation triggers KFENCE reports
while swsusp_asm_resume() copies the image pages, for example:
BUG: KFENCE: use-after-free write in swsusp_asm_resume+0x20/0x94
Use-after-free write at 0x00000000a57ee925 (in kfence-#254):
swsusp_asm_resume+0x20/0x94
hibernation_restore+0x128/0x1a0
load_image_and_restore+0x6c/0xc8
software_resume+0x240/0x260
do_one_initcall+0x68/0x200
kernel_init_freeable+0x26c/0x304
kernel_init+0x20/0x134
ret_from_kernel_thread+0x24/0x1d0
ret_from_kernel_thread_asm+0xc/0x98
During resume from hibernation, the image pages that occupy physical
[28 lines not shown]
LoongArch: BPF: Make arena support depend on 128-bit cmpxchg
When testing bpf selftest "jit_insns/cast_to_user", there are different
behaviors on different Loongson machines.
(1) Loongson-3A6000
$ sudo ./test_progs -a jit_insns/cast_to_user
...
Summary: 1/1 PASSED, 0 SKIPPED, 0/0 FAILED
(2) Loongson-3A5000
$ sudo ./test_progs -a jit_insns/cast_to_user
...
libbpf: map 'arena': failed to create: -ENOMEM
run_subtest:FAIL:unexpected_load_failure unexpected error: -12 (errno 12)
...
Summary: 0/0 PASSED, 0 SKIPPED, 1/1 FAILED
This is because the arena range tree uses kmalloc_nolock() API, which
[38 lines not shown]
LoongArch: kexec_file: Fix a modified cmdline leak
machine_kexec_prepare() copies it to KEXEC_CMDLINE_ADDR and overwrites
the pointer. Free the heap buffer after the copy here.
Cc: stable at vger.kernel.org
Fixes: d162feec6b6e ("LoongArch: Add preparatory infrastructure for kexec_file")
Signed-off-by: Jinjie Ruan <ruanjinjie at huawei.com>
Signed-off-by: Huacai Chen <chenhuacai at loongson.cn>
LoongArch: kexec_file: Fix elf_headers memory leak in retry loop
A retry allocates new elf headers and overwrites image->elf_headers,
leaking the previous buffer. Free it before assigning here.
Cc: stable at vger.kernel.org
Fixes: 55d990f0084c ("LoongArch: Add EFI binary support for kexec_file")
Link: https://sashiko.dev/#/patchset/20260729031235.2840255-1-ruanjinjie%40huawei.com
Signed-off-by: Jinjie Ruan <ruanjinjie at huawei.com>
Signed-off-by: Huacai Chen <chenhuacai at loongson.cn>
ACPI: LoongArch: Validate ACPI IOVT device entries
START and END device entries in ACPI IOVT should be paired and
adjacent, while SINGLE entries shouldn't be between START and END.
So add a iovt_validate_entries() function to validate the entries
before the real parsing.
By the way, move kzalloc_obj() from the ACPI_IOVT_DEVICE_ENTRY_END
case to the ACPI_IOVT_DEVICE_ENTRY_START case, so as to avoid NULL
pointer dereference.
Signed-off-by: Huacai Chen <chenhuacai at loongson.cn>
ACPI: LoongArch: Add checksum validation for ACPI IOVT table
Checksum information is put in acpi_table_header, here add checksum
validation support with IOVT table.
Signed-off-by: Bibo Mao <maobibo at loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai at loongson.cn>
ACPI: LoongArch: Fix incorrect pointer in acpi_iovt_init()
In acpi_iovt_init(), hdr is of type struct acpi_table_iovt *. Passing
&hdr results in a pointer to the local variable rather than a pointer
to the IOVT table. Drop the address-of operator and pass hdr directly.
Cc: stable at vger.kernel.org
Fixes: a9b0c34507eb ("ACPI: LoongArch: Add acpi_arch_[late]_init()")
Signed-off-by: Bibo Mao <maobibo at loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai at loongson.cn>
mm/memory_hotplug: resize zones under their seqlock
With CONFIG_DEBUG_VM the page allocator checks that a page which is
freed, split or allocated lies within its zone. The check reads
zone->zone_start_pfn and zone->spanned_pages under zone->span_seqlock, as
memory hotplug can change the two at any time.
Commit 27cacaad16c5 ("mm,memory_hotplug: drop unneeded locking") removed
the write side, since all resizing is serialized by the hotplug lock. That
leaves the reader without protection. When memory below the start of a
zone goes online, the start is lowered first and the size is raised
afterwards. When the lowest memory of a zone goes offline, the size is
reduced first. In between, the zone seems to end before its last pages. If
one of them goes through the allocator at that moment, it is reported as
being outside of the zone triggers VM_BUG_ON_PAGE().
Write the two fields in a write section of the seqlock. Interrupts are
disabled as pages are freed from interrupts, too, and the reader would
wait for the writer which it has interrupted.
[8 lines not shown]
mm/page_alloc: remove the zone_spans_pfn() check from get_pfnblock_bitmap_bitidx()
Whenever the flags of a pageblock are read or written, a kernel with
CONFIG_DEBUG_VM makes sure that the pfn lies within the zone of the page.
Unlike bad_range(), that check reads zone->zone_start_pfn and
zone->spanned_pages without zone->span_seqlock.
Memory hotplug changes the two fields one after the other. If the lower
end of a zone moves, the zone seems to end before its last pages in
between. A page of that part which is freed at that moment, on another
CPU, ends in
page dumped because: VM_BUG_ON_PAGE(!zone_spans_pfn(page_zone(page), pfn))
kernel BUG at mm/page_alloc.c:372!
free_unref_folios+0x55e/0xed0
folios_put_refs+0x2b5/0x530
An attempt has been made [1] to fix this with the span seqlock check.
But that can trigger all sorts of problems in restricted contexts, as
[12 lines not shown]
mm: page_isolation: do not take slab pages for free
page_is_unmovable() regards a page with a reference count of zero as free
or about to be freed. Since slab allocates frozen pages, they will
be wrongly considered to be freed if order 0 (higher-order compound
pages are caught earlier).
If such slabs are the only unmovable pages of a memory block, memory
offlining now isolates the block, this can lead to offline_pages()
looping without progress.
Thus detect the slab pages as removable to return -EBUSY, as would
happen before commit 9aec2fb0fd5e ("slab: allocate frozen pages").
Fixes: 9aec2fb0fd5e ("slab: allocate frozen pages")
Cc: stable at vger.kernel.org
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef at toxicpanda.com>
Signed-off-by: David Hildenbrand (Arm) <david at kernel.org>
[4 lines not shown]
Merge tag 'x86_bugs_tsa_zen5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 TSA fix from Borislav Petkov:
- A mitigation for AMD Zen5's version of TSA
* tag 'x86_bugs_tsa_zen5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/bugs: Mitigate TSA on AMD Zen5
Merge tag 'linux_kselftest-fixes-7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest
Pull kselftest fixes from Shuah Khan:
"Fixes run_fat_tests hang, false bashism in kprobe_non_uniq_symbol.tc,
and ftrace invalid test skip"
* tag 'linux_kselftest-fixes-7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:
selftests/ftrace: Add missing spaces after ! in probe syntax tests
tracing/selftests: Fix false bashism in kprobe_non_uniq_symbol.tc
selftests/filesystems: Fix run_fat_tests hang
Merge tag 'keys-v7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd
Pull key fixes from Jarkko Sakkinen:
- Expand key->datalen and key->quotalen in order to avoid integer
truncation and the leak of quota.
- Enforce KEY_MAX_DESC_SIZE limits across in-kernel and
payload-generated paths.
- Verify the key identity in __key_unlink_begin() as type and
description could also refer to a more recently linked key with
matching properties as the one being unlinked.
- Fix key update race with key GC
* tag 'keys-v7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd:
KEYS: Protect the update method check against type removal
KEYS: Verify the key identity in __key_unlink_begin
[2 lines not shown]
Merge tag 'probes-fixes-v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull probe fixes from Masami Hiramatsu:
"Fix registration and unregistration error handling:
- Release the instruction slot via arch_remove_kprobe() and propagate
the error code when arm_kprobe() fails in
__register_kprobe() instead of leaking the slot and returning 0.
- Skip rethook_free() and kretprobe holder cleanup in
unregister_kretprobes() when __unregister_kprobe_top() fails, and
clear rp->rh after synchronize_rcu() to avoid double free and NULL
pointer dereferences.
- Resolve the target address up-front in register_kretprobe() and
check for re-registration before allocating resources so
symbol_name-based re-registration does not corrupt the active
kretprobe on error.
[49 lines not shown]
fs: fix the SEEK_CUR f_lock condition
Commit da06e3c51794 ("fs: don't needlessly acquire f_lock") wanted to
skip f_lock for SEEK_CUR on files that already serialize f_pos through
f_pos_lock, i.e. FMODE_ATOMIC_POS files and directories, and keep it
for everything else. The condition it added does the opposite:
file_seek_cur_needs_f_lock() returns false exactly for the files that
never take f_pos_lock and true for the ones that do.
So since v6.15 a SEEK_CUR on a shared block device or on a character
device that uses fixed_size_llseek() updates f_pos without any lock and
two concurrent calls can lose an update, while regular files and
directories pay for a spinlock they don't need.
Invert the condition.
Fixes: da06e3c51794 ("fs: don't needlessly acquire f_lock")
Cc: stable at vger.kernel.org
Link: https://patch.msgid.link/20261106-work-file-seek_f_lock-v1-1-5b9a6c2928d4@kernel.org
[2 lines not shown]
kprobes: Arm reused optprobe on cooling list
A new probe that reuses an unused probe still on a cooling list doesn't
fire. reuse_unused_kprobe() clears DISABLED, so register_aggr_kprobe()
doesn't arm it and the probe has no int3 until it's optimized again, or
ever if it can't be (e.g., it has a post_handler).
Keep a reused cooling probe disabled instead, so register_aggr_kprobe()
arms it if the new probe is enabled, or enable_kprobe() does it later.
The probe is then still unused when add_new_kprobe() force-unoptimizes
it for a new probe with a post_handler, which would unhash it and queue
it for freeing. Skip that since a cooling probe is already unoptimized.
With the fix, the new probe fires.
Link: https://lore.kernel.org/all/20261105-kprobes-optprobe-state-v2-3-7a2f5290baa0@columbia.edu/
Fixes: 06e0d3b89da1 ("kprobes: Make optprobe optimizer multi-generational and asynchronous")
Suggested-by: Masami Hiramatsu (Google) <mhiramat at kernel.org>
Signed-off-by: Mani Tofigh <mt4022 at columbia.edu>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat at kernel.org>
