Merge tag 'cocci-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux
Pull Coccinelle updates from Julia Lawall:
"This contains three new semantic patches
- use the typed devm_kmalloc_obj-family of allocations (Joe Perches)
- detect invalid use of __cleanup (Ella Ma)
- add uses of ARRAY_END (Alejandro Colomar)"
* tag 'cocci-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux:
coccinelle: free: add a checker for `__cleanup(kfree)` usage
coccinelle: Add devm_kmalloc_objs conversion script
scripts/coccinelle: improve efficiency of array_end.cocci
scripts/coccinelle: Add script for using ARRAY_END()
Merge tag '9p-for-7.4-rc2' of https://github.com/martinetd/linux
Pull late 9p updates from Dominique Martinet:
"This is mostly a huge wave of LLM-driven fixes. At least the LLM fixes
sort of slowed down recently? Or maybe it's just the time of the cycle
and/or I got used to it, time will tell...
A few exceptions:
- a new vsock transport was added, since it's a variant of the
existing fd/tcp transport there is little harm in taking it in
- there's an incomplete fix for when file actual size doesn't match
the size attribute (e.g. exports of sysfs).
The fix addresses when st_size > actual size with cache=none but
just about everything else is still broken (st_size=0 with actual
data regardless of cache, or with data cache st_size > actual is
still wrong and so are symlinks with 0 size)...
[28 lines not shown]
vfs: fix take_dentry_name_snapshot() semantics
The take_dentry_name_snapshot() function would keep trying to take a
reference on a dentry name forever, even if that dentry had been
released and the dentry name would never become valid.
All normal users held a reference to the dentry, but this "dentry name
is dead" could hit the overlayfs RCU walk case, and Amir fixed it by
adding a new try_take_dentry_name_snapshot() that returns on failure.
See commit 15c6bd5cf109 ("vfs: add try_take_dentry_name_snapshot()").
However, that fix was uncomfortably ugly, and the new "try" version was
subtly buggy in that it would also fail spuriously during a rename. The
only current user of that doesn't really care: a spurious failure would
result in the lookup just exiting RCU mode and being retried with the
dentry ref held (using the non-try version), but this all just rubbed me
the wrong way.
Instead of introducing a new and differently buggy helper, this just
[38 lines not shown]
Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf
Pull bpf fixes from Alexei Starovoitov:
"Fix various bugs in bpf core and bpf-lwt. Looks like the speed of us
fixing bugs is higher than the number of new bugs found. Not out of
the woods yet. sockmap fixes will come later.
- Various fixes (Alexei Starovoitov):
- Use one may_goto time slice per prog invocation instead of one
per stack frame to fix a soft lockup in loops that nest across
calls
- Fix use-after-free in btf__add_type() in libbpf
- Invalidate a dynptr slice when its stack buffer is written or
when the frame of the buffer returns
- Fix the tracking of pointers to the stack in SCEV
- Keep the valid bytes of a packet pointer in SCEV
- Fix bpf_throw() in a prog with a private stack in x86 JIT
- Compare the arguments of an extension prog with those of its
target
[75 lines not shown]
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
Pull KVM fixes from Paolo Bonzini:
"x86:
- Check validity of vmcb01 save area copied from SMRAM on RSM
- Conditionally resched when retrying gPTE walk on A/D update failure
- Conditionally resched when restarting REP string emulation
- Process each host MSR entry at most once when unwinding failed VM-Entry
- Cap number of parents of page table pages, to avoid quadratic teardown
- Unconditionally reset MMU context when emulating INIT
- Flush guest TLB when emulating a RESET to strictly honor the spec
- Add array_index_nospec() to evmcs_field_offset()"
* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
KVM: VMX: Add array_index_nospec() to evmcs_field_offset()
KVM: x86: Flush guest TLB when emulating a RESET to strictly honor the spec
KVM: x86: Unconditionally reset MMU context when emulating INIT
KVM: x86/mmu: Cap number of parent PTEs per SP at 1000 (the arbitrary rmap limit)
KVM: nVMX: Process each host MSR entry at most once when unwinding failed VM-Entry
[3 lines not shown]
Merge tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux
Pull crypto library fixes from Eric Biggers:
- Disable the MIPS64 Octeon optimized SHA-1, SHA-256, and SHA-512 code
on little-endian kernels, since it doesn't work correctly on them
- Remove the PowerPC optimized Poly1305 code. It's already been marked
as BROKEN for over a year due to not working in softirq context, but
it turns out some of the Poly1305 math is incorrect too
- A few robustness improvements for the ML-DSA code
* tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux:
lib/crypto: mldsa: Add __must_check to mldsa_verify()
lib/crypto: mldsa: Explicitly check that 'alg' is a valid value
lib/crypto: mldsa: Check pk_len before doing pointer arithmetic
lib/crypto: powerpc/poly1305: Remove BROKEN implementation
lib/crypto: mips: Disable Octeon SHA code on little-endian kernels
libbpf: Fix use-after-free in btf__add_type
For every string btf_rewrite_str() does:
off = btf__add_str(p->dst, btf__str_by_offset(p->src, *str_off));
When the string belongs to the base, the pointer goes into the raw data
of the base. btf__add_str() looks the string up in the base first,
btf__find_str() calls btf_ensure_modifiable() on the base, and that
frees the raw data. Then strset__find_str() reads the freed string.
Make all the bases of dst modifiable before the pointer is taken.
This bug is triggered by the sharing of BTF bases between src
and dst, as introduced by the resolve_btfids changes to build
inline BTF.
Fixes: cf91a7db92c6 ("resolve_btfids: Build separate main and inline BTF objects")
Reported-by: Nathan Chancellor <nathan at kernel.org>
[5 lines not shown]
selftests/bpf: Exercise stack argument precision on state reuse
Add two asm regressions for the precision of the sixth argument, which
is passed in a stack argument slot and used as a map value offset.
The first test reuses a safe state after storing arg6 from a register.
Precision must propagate from that slot to the register at an earlier
checkpoint, so a later out-of-bounds path cannot reuse that checkpoint.
The second test triggers conservative precision fallback by backtracking
across a store through a register that later becomes a scalar through
pointer subtraction. The caller's argument slot must become precise so
an out-of-bounds argument cannot reuse the safe state.
Both programs are load-only rejection tests and use the existing stack
argument compiler and architecture guards.
The two test programs were supplied by Alexei Starovoitov during review
and are included unchanged.
[8 lines not shown]
Merge branch 'bpf-fix-stack-argument-precision-propagation'
Xu Yunxiang says:
====================
bpf: Fix stack argument precision propagation
Outgoing stack arguments retain scalar state separately from registers
and ordinary spills. Their precision dependencies must reach ancestor
states when verification reuses a state or falls back to marking all
scalars precise. Otherwise, an out-of-bounds map access can reuse a state
validated for an in-bounds argument.
Patch 1 covers outgoing scalar argument slots in both precision paths.
Patch 2 adds two load-only asm regressions in verifier_stack_arg.c, based
on Alexei's examples.
Changes in v2:
- Keep the patch 1 fix and explanation unchanged; rebase onto bpf/master
[41 lines not shown]
bpf: Propagate scalar precision through stack arguments
Outgoing stack arguments retain scalar verifier state separately from
registers and ordinary spills. State comparison uses their precision
marks, but propagate_precision() does not carry those dependencies from
a reused state to the current path's ancestors. A path can consequently
reuse a state without making earlier checkpoints distinguish scalar
values that will later be used as memory offsets.
Seed the existing backtracking batch with precise scalar argument slots
from every frame. Incoming arguments live in the caller's outgoing
slots, so include caller frames as well as the current frame.
Also cover scalar argument slots in bpf_mark_all_scalars_precise(), so
conservative fallback preserves the same invariant. Keep its existing
ancestor-only traversal and leave pointer and uninitialized slots alone.
AI assistance was used in preparing this patch.
[4 lines not shown]
selftests/bpf: Fix callback recursion test with noipa global func
With llvm24 after commit 28b4a2032f97 ("[BPF] Mark global functions
noipa"), the test recursion_via_global_func_and_callback fails:
13: (85) call bpf_loop#181 4: frame1: R1=scalar() R10=fp0 cb
; return static_calls_global(i); @ verifier_global_subprogs.c:548
4: (85) call pc+1
...
; return global_calls_loop(x); @ verifier_global_subprogs.c:543
6: (85) call pc+1
Func#3 ('global_calls_loop') is global and assumed valid.
7: frame2: R0=scalar()
7: (95) exit
...
; return static_calls_global(i); @ verifier_global_subprogs.c:548
5: (95) exit
At callback return the register R0 has unknown scalar value should have been in [0, 1]
=============
[36 lines not shown]
Merge branch 'bpf-one-may_goto-time-slice-per-prog-invocation'
Alexei Starovoitov says:
====================
bpf: One may_goto time slice per prog invocation
From: Alexei Starovoitov <ast at kernel.org>
may_goto stops a loop that the verifier cannot bound: after 250 ms the loop
must exit. The count and the timestamp are in the stack frame of the
function that contains the loop. So the limit is for one call of a subprog,
not for one invocation of a prog. Loops that nest across calls multiply it,
and 9 insns lock up a cpu:
main: sub:
1: call sub 1: may_goto 2f
may_goto 2f goto 1b
goto 1b 2: r0 = 0
[63 lines not shown]
bpf: One may_goto time slice per prog invocation
The count and the timestamp of may_goto are in the stack frame. So the
limit of 250 ms is for one call of a subprog, not for one invocation of the
prog, and loops that nest across calls multiply it. These 9 insns cause a
soft lockup:
main: sub:
1: call sub 1: may_goto 2f
may_goto 2f goto 1b
goto 1b 2: r0 = 0
2: r0 = 1 exit
exit
Use one count and one timestamp for all may_goto of a prog, in per-cpu
memory of the prog. The main prog sets them in its first insns. When the
time is up each loop ends at its next may_goto, in any function.
rX = address of the count
[27 lines not shown]
selftests/bpf: End the loop of parallel_test_bitmap after 50 ms
The two progs of parallel_test_bitmap change bits of the same words in a
loop of 10000000 iterations with can_loop. The loop goes on until may_goto
stops it. The functions that it calls retry a cmpxchg that fails:
do {
...
actual = cmpxchg(&bmp->bits[idx], old, new);
if (actual == old)
return true;
} while (can_loop);
return false;
The retry is always possible only while each stack frame has a time slice
of its own. With one time slice for all may_goto of a prog, a function that
is called after the time is up makes no iteration. The bit does not change,
and the test fails with -EINVAL, in 53 of 900 runs.
[4 lines not shown]
bpf: End bpf_loop() when the time of may_goto is up
When the time of a prog is up all loops with may_goto end, but bpf_loop()
goes on. It calls its callback up to 1 << 23 times. The loops in the
callback make no iteration, but the rest of the callback runs, and that can
be another bpf_loop(). Two test progs with bpf_loop(1 << 23, cb) and some
work in cb return after 4 sec and 10 sec. With this patch they return after
250 ms.
bpf_loop() and bpf_for_each_map_elem() end their loop when the callback
returns 1. So return 1 in the first insns of the callback when the time is
up:
r0 = address of the count
r0 = &(void __percpu *)(r0)
r0 = *(u64 *)(r0 +0)
if r0 != 0x0 goto pc+2
r0 = 1
exit
[28 lines not shown]
selftests/bpf: Give the first loop of cond_break5 an end
The main prog of cond_break5 spins until may_goto stops the loop. Then it
calls a subprog and expects that the loop of the subprog makes iterations.
This is true only while each stack frame has a time slice of its own.
Stop the first loop after 100 iterations. The test still makes sure that
may_goto works in the main prog and in a subprog of one prog.
Signed-off-by: Alexei Starovoitov <ast at kernel.org>
Link: https://patch.msgid.link/20261031215543.682284-4-alexei.starovoitov@gmail.com
selftests/bpf: Test one may_goto time slice per prog invocation
Most tests call a function that spins until may_goto stops it, four times.
With one time slice for an invocation of the prog only the first call
spins. With a time slice for each frame all four calls spin, and the test
fails after 1 sec.
group tests
-------------- ------------------------------------------------------
the problem 9 insns, three levels of short loops, a subprog with
65534 iterations, bpf_loop() with a callback that spins
or makes 60000 iterations
ways to a loop call, call through a function without a loop, global
function, callx, bpf_loop() inlined and not,
bpf_for_each_map_elem(), bpf_user_ringbuf_drain(),
bpf_find_vma(), bpf_rbtree_add()
bpf_loop() ends when the time is up: inlined and not, in a callback
of bpf_loop(). Goes on when BPF code calls the callback
too
[27 lines not shown]
bpf: Pass a pointer to arch_bpf_timed_may_goto()
arch_bpf_timed_may_goto() gets the offset of count and timestamp in the
stack frame in BPF_REG_AX. Arch code adds the frame pointer to it, and
calls bpf_check_timed_may_goto() with the result. On arm64, riscv,
loongarch, powerpc and s390 the asm function does it. On x86-64 the JIT
does it, because the frame pointer is in another register when the prog has
a private stack.
The next patch moves count and timestamp out of the stack frame. So pass
the pointer in BPF_REG_AX, and let the verifier emit the addition:
before after
r12 = -16 r12 = r10
call arch_bpf_timed_may_goto r12 += -16
call arch_bpf_timed_may_goto
The JITs know which register r10 is. The asm functions have a move in place
[12 lines not shown]
s390/bpf: Support internal-only MOV instruction to resolve per-CPU addrs
The verifier emits BPF_MOV64_PERCPU_REG to turn the address of a per-cpu
variable into the address of the copy of this cpu. s390 keeps the per-cpu
offset of the cpu in the lowcore. Add it to the register with one insn, the
way the JIT reads cpu_nr and current_task for the helpers that it inlines.
With bpf_jit_supports_percpu_insn() the verifier inlines the lookup in
per-cpu array and per-cpu hash maps, and resolves the address of a value in
a per-cpu array. Patch 7 needs the insn for may_goto.
Signed-off-by: Alexei Starovoitov <ast at kernel.org>
Link: https://patch.msgid.link/20261031215543.682284-6-alexei.starovoitov@gmail.com
selftests/bpf: Don't cast a pointer to .bss in arena_htab_asm
arena_htab_asm is arena_htab.c with BPF_ARENA_FORCE_ASM. In this variant
__arena has no address space, so arr1 is in .bss, and cast_kern() is a real
insn. cast_kern(arr) turns the pointer to .bss into an offset in the arena.
Each of the 100000 stores to arr[i] faults, and the fault handler of the
arena skips it.
Remove the cast. In the other variant it is a nop. The prog takes 67 ms in
place of 950 ms on a kernel with lockdep.
With one time slice for all may_goto of a prog, may_goto stops the loops of
the old prog after 250 ms. The test does not see that, because it looks at
the first keys only.
Signed-off-by: Alexei Starovoitov <ast at kernel.org>
Link: https://patch.msgid.link/20261031215543.682284-3-alexei.starovoitov@gmail.com
bpf: Emit timed may_goto for JITed progs only
The timed form of may_goto calls arch_bpf_timed_may_goto(). This function
takes its argument and returns its result in BPF_REG_AX, in a register of
the cpu. Only JITed code can call it.
The verifier emits the timed form when the arch has a JIT that supports it.
It does not look at the prog. With CONFIG_BPF_JIT_ALWAYS_ON=n the
interpreter can run such a prog: the JIT is off, or it fails. The
interpreter calls the function like a helper. The function takes what the C
code left in that register for a pointer, and bpf_check_timed_may_goto()
reads and writes through it.
Emit the timed form only when the prog asks for a JIT, and make the JIT
mandatory for such a prog. All other progs get the form that counts down
from BPF_MAX_LOOPS.
One test of verifier_may_goto_1 shows the insns of the timed form. Load it
only when progs are JITed.
[4 lines not shown]
Merge branch 'bpf-fix-the-stack-buffer-that-bpf_dynptr_slice_rdwr-returns'
Alexei Starovoitov says:
====================
bpf: Fix the stack buffer that bpf_dynptr_slice_rdwr() returns
From: Alexei Starovoitov <ast at kernel.org>
bpf_dynptr_slice_rdwr() and bpf_dynptr_slice() can return the buffer. When
the buffer is on the stack, the prog has two pointers to the same stack
slot, and the verifier knows only one of them. A store through the slice
changes data that the verifier tracks in the slot: a known scalar, a
spilled pointer, a dynptr, an iterator. Such a prog loads today and can
crash the kernel. A load through the slice reads such data as a scalar.
Patch 1 invalidates the slice when the prog stores to the buffer, or when
the frame of the buffer returns. Patch 2 has the tests.
[18 lines not shown]
bpf: Invalidate a dynptr slice when its stack buffer is written
bpf_dynptr_slice(&ptr, off, buffer, size) and bpf_dynptr_slice_rdwr()
return a pointer to the data of a dynptr. When the data is not contiguous,
for example in a non-linear skb, they copy it to 'buffer' and return
'buffer'. Usually the buffer is on the stack. For the verifier the result
is plain memory (PTR_TO_MEM), and an access through it is not an access to
the stack:
- A store makes wrong what the verifier tracks in the buffer: a known
scalar, a spilled pointer, a dynptr, an iterator, irq flags.
- A load gives the bytes of a spilled pointer or of a dynptr as a scalar.
- Both are possible after the frame of the buffer returned.
The accesses are safe while the buffer contains only unknown bytes, as it
does after the call. Thus keep this rule: the buffer contains no tracked
data while a slice that can be the buffer exists. The slice remembers the
frame, the offset and the size of its buffer. The verifier invalidates the
slice, read-only or not, at each event that breaks the rule:
[32 lines not shown]
selftests/bpf: Test writes to the buffer of bpf_dynptr_slice_rdwr()
bpf_dynptr_slice_rdwr() and bpf_dynptr_slice() can return the buffer. When
the buffer is on the stack, a store to the buffer invalidates the slice.
See "bpf: Invalidate a dynptr slice when its stack buffer is written".
dynptr_fail.c gets short progs with skb, xdp and file dynptrs. They cover
the events that invalidate a slice, the borders of the buffer, a copy of
the slice on the stack and in a caller, pruning, read-only slices, and
events that leave the slice valid. They end with a load through the slice
and are only loaded.
test_dynptr_skb_slice_rdwr_buffer in dynptr_success.c runs on a non-linear
skb. It shows that the slice is the buffer, and that the pattern of the
documentation continues to work. It passes without the fix too.
Signed-off-by: Alexei Starovoitov <ast at kernel.org>
Link: https://patch.msgid.link/20261102170958.3586893-3-alexei.starovoitov@gmail.com
KVM: VMX: Add array_index_nospec() to evmcs_field_offset()
evmcs_field_offset() bounds-checks the guest-supplied field index against
nr_evmcs_1_fields and then indexes vmcs_field_to_evmcs_1[] without an
array_index_nospec() clamp, unlike its vmcs12 counterpart
get_vmcs12_field_offset().
A regular VMREAD instruction is allowed while an enlightened VMCS is active
since 6cbbaab60ff3 ("KVM: nVMX: Allow VMREAD when Enlightened VMCS is in
use"), and it reaches evmcs_field_offset() with a guest-supplied field
encoding. But because the index is not clamped, the guest may be able to
speculatively access past the bound check and read out of bounds of
vmcs_field_to_evmcs_1[] (Spectre v1). The leaked value is only the u16
'offset', so the exposure is limited.
The other callers of evmcs_field_offset() are not under direct guest
control, but the array_index_nospec() clamp does not hurt them.
Clamp the index with array_index_nospec(), mirroring
[6 lines not shown]
Merge branch 'bpf-fix-two-holes-in-the-analysis-of-stack-arguments'
Alexei Starovoitov says:
====================
bpf: Fix two holes in the analysis of stack arguments
From: Alexei Starovoitov <ast at kernel.org>
Before the main pass, arg_track follows pointers to the stack through
registers and spills. For each insn it tells which slots the insn can read,
which slots it can write, and which slot it writes for certain. Scalar
evolution and the removal of dead slots rely on the answer.
In two cases a store to other memory counts as a certain write to a stack
slot. Then scalar evolution misses a real write to the counter of a loop,
and a prog that accesses a map value out of bounds loads.
patch 1 "r10, or not a pointer to the stack" counts as "exactly r10".
[28 lines not shown]
bpf: Don't trust pointers spilled in slots that a callee can write
arg_track follows pointers to the stack through registers and spills.
Scalar evolution and the removal of dead slots rely on it to know which
slots an insn reads and writes.
arg_track assumes that a call does not change the pointers that are spilled
in the frame of the caller. But a static subprog or a callback can store
a pointer to other memory there, and the caller can use it:
*(u64 *)(r10 - 16) = fp-8
r1 = fp-16, r2 = map_value
call sub ; *(u64 *)(r1 + 0) = r2
r7 = *(u64 *)(r10 - 16) ; verifier: map_value. arg_track: fp-8
*(u64 *)(r10 - 8) = fp-24
*(u64 *)(r7 + 0) = 0 ; arg_track: fp-8 is overwritten
r8 = *(u64 *)(r10 - 8) ; verifier: fp-24. arg_track: none
loop:
r1 = *(u64 *)(r10 - 24) ; the counter of the loop
[30 lines not shown]
selftests/bpf: Test the join of fp+0 with a value that is not a pointer to stack
A register is r10 on one path and a pointer to a map value on the other
path. A store through it is not a certain write to the stack.
join_of_r10_and_map_value is a valid prog. It reads the slots after the
stores. The join has one branch for "pointer to stack joins other value"
and one branch for the reverse order. The prog has one register for each
order, and it checks in the log that it takes both branches. Without the
fix the slots are dead in front of the stores, and the verifier rejects
the read:
reading from stack off -8+0 size 8, slot poisoned by dead code elimination
In join_of_r10_and_map_value_hidden_store the slot holds a pointer to the
counter of a loop. Without the fix the pointer is lost, and scalar
evolution does not see the store through it. The prog loads, and it
accesses a map value out of bounds.
[2 lines not shown]
bpf: Fix the join of fp+0 with a value that is not a pointer to stack
arg_track follows pointers to the stack through registers and spills.
Scalar evolution and the removal of dead slots rely on it to know which
slots an insn reads and writes.
Where two paths meet, a register can be fp-N on one path and not a pointer
to the stack on the other path. There is no value for that. The join adds
a fake second offset, fp+0: with two offsets no store through the register
is a certain write. But for fp+0 the fake offset is the offset itself:
join(fp-8, none) = {fp-8, fp+0} two offsets
join(fp+0, none) = {fp+0} one offset: "exactly fp+0"
Then a store counts as a certain write to the stack, but at run time it can
go to other memory:
r7 = r10, or r7 = map_value + 8 ; arg_track: exactly fp+0
*(u64 *)(r10 - 8) = fp-24
[22 lines not shown]
selftests/bpf: Test a callee that overwrites a spilled pointer of its caller
The caller spills &fp[-8] to fp-16 and passes a pointer to another slot of
its frame to a callee, which stores a pointer to a map value to fp-16. The
caller fills fp-16 and stores through it. That store is not a certain write
to fp-8.
Three valid progs read fp-8 after the store. The callee is a static subprog
or a callback of bpf_loop(). In callee_overwrites_spilled_r10 the slot
holds a copy of r10. That prog also needs "bpf: Fix the join of fp+0 with
a value that is not a pointer to stack". Without the fix they fail with:
reading from stack off -8+0 size 8, slot poisoned by dead code elimination
In callee_overwrites_spilled_fp_hidden_store the store hides a write to the
counter of a loop. Without the fix the prog loads, and it accesses a map
value out of bounds.
The test for callx checks the spilled pointer in the log.
[3 lines not shown]
