Merge tag 'landlock-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux
Pull Landlock fixes from Mickaël Salaün:
"This fixes a use-after-free and a lockdep assert NULL dereferencing,
and properly truncates too-long strings printed by a Landlock
tracepoint. Most of the changes are brought by new tests"
* tag 'landlock-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux:
landlock: Test trace path output boundaries
landlock: Bound escaped trace path output
landlock: Clean up ruleset validation checks
selftests/landlock: Test abstract socket trace name limits
landlock: Fix use-after-free of the source's parent directory
Merge tag 'vfs-7.3-rc3.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull vfs fixes from Christian Brauner:
- netfs:
- Fix an uninitialized return value in netfs_unbuffered_write()
when preparing the first subrequest fails
- For partial unbuffered/DIO writes return the amount transferred
rather than an error
- Update i_size with the amount actually written when a partial
transfer ends in an error
- Fix a subrequest reference leak when the io_iter ends up empty
- Handle netfs_alloc_subrequest() failure during unbuffered writes
[86 lines not shown]
Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost
Pull virtio fixes from Michael Tsirkin:
"Just a ton of small fixes all over the place.
Also includes virtio and virtio-rng MAINTAINERS updates"
* tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: (27 commits)
vduse: return compat ioctl results directly
virtio_input: stop callbacks before unregistering input device
virtio_input: reset device if input_register_device() fails
vhost: invalidate vring access on IOTLB transitions
vduse: validate virtqueue alignment
vduse: do not take dev->rwsem in the virtqueue kick path
vhost-scsi: clamp max_io_vqs module parameter
vhost-scsi: use kvzalloc for vq array allocation
virtio-pci: return IRQ_HANDLED after non-zero ISR
virtio: add Eugenio Pérez as Maintainer
vhost: limit outstanding IOTLB misses per virtqueue
[10 lines not shown]
Merge tag 'printk-for-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux
Pull printk fixes from Petr Mladek:
- Use lazy irq_work for waking printk kthreads
- Flush pending irq_work before destroying printk kthreads
- Remove redundant WARN() when a printk kthread can't be created
- Typo fix
* tag 'printk-for-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux:
printk/nbcon: Change nbcon_irq_work to IRQ_WORK_LAZY
printk/nbcon: Flush nbcon_irq_work in nbcon_free()
console: fix /dev/kmsg reference in flags kernel doc
printk: Don't WARN on kthread_run failure.
nstree: check listing permission before taking a namespace reference
legitimize_ns() takes a reference on the candidate namespace before
may_list_ns() has decided whether the caller may see it. The
__free(ns_put) cleanup on the denied path can drop the last reference to a
mount namespace while we still hold the rcu read lock, and put_mnt_ns()
may sleep there. This is the same problem commit 2ec2aff3c8e2 ("ns: make
sure reference are dropped outside of rcu lock") fixed for the put_user()
path. Neither ns_requested() nor may_list_ns() needs a reference, both
only look at the namespace type and at the caller's own namespaces, so do
the checks first and take the reference last.
Splat:
Voluntary context switch within RCU read-side critical section!
WARNING: kernel/rcu/tree_plugin.h:332 at rcu_note_context_switch+0x238/0x2a0, CPU#5: a/3442
CPU: 5 UID: 1000 PID: 3442 Comm: a Not tainted 7.0.0-30-generic #30-Ubuntu PREEMPT(lazy)
RIP: 0010:rcu_note_context_switch+0x238/0x2a0
Call Trace:
[25 lines not shown]
exec: do_close_on_exec() before taking exec_update_lock
do_close_on_exec() currently happens while holding the exec_update_lock,
which is used in a lot of places that access process state to
synchronize access checks.
I recently added another such use of exec_update_lock, causing a
regression.
do_close_on_exec() can block waiting for a reply from a filesystem.
That means a hung filesystem can block codepaths that use
exec_update_lock; and it also means that a FUSE filesystem which
attempts to inspect the calling process can deadlock.
To avoid such problems, move do_close_on_exec() before the
exec_update_lock is taken, but after the FD table has been copied if
necessary.
I have looked through all the calls between the old and new position of
the do_close_on_exec() call; there seems to be no file descriptor table
[11 lines not shown]
Merge tag 'x86_urgent_for_7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fixes from Dave Hansen:
"These are fixes for some older AMD device topology and machine check
issues. But, they are issues that are affecting real users and aren't
just cleaning up AI drive-by reports.
These is coming a wee bit later than the usual Sundays because of a
late breaking issue with one of the patches which is now temporarily
kicked out"
* tag 'x86_urgent_for_7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/MCE/AMD: Fix inverted interrupt enablement during storm handling
x86/amd_node: Fix potential NULL pointer dereference
x86/amd_node: Avoid divide by zero on virtualized systems
Merge tag 'powerpc-7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux
Pull powerpc fixes from Madhavan Srinivasan:
- Clear TIF_SYSCALL_RET before syscall error return
- Don't drop _TIF_RESTOREALL on syscall restart
- Do not restore KUAP in arch_exit_to_user_mode_prepare()
- pci-ioda: Fix the stale irq chip reference
- Use inclusive range checks in add_usable_mem() and excluded memory
- Fix irq_soft_mask corruption on replayed interrupt exit
- MAINTAINERS: powerpc: Add Ritesh and Shrikanth
- Misc fixes and cleanups
[20 lines not shown]
Merge tag 'v7.3-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
Pull crypto fixes from Herbert Xu:
"This adds missing vzeroupper instructions to x86/aria"
* tag 'v7.3-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
crypto: x86/aria - add missing vzeroupper in AVX-512 code
crypto: x86/aria - add missing vzeroupper in AVX2 code
landlock: Test trace path output boundaries
Use focused KUnit tests to exercise the renderer's internal boundary and
composition contracts with synthetic scratch states, including both
sibling-helper evaluation orders. Check the exact output and
reservation boundaries, including a four-byte octal escape accepted at
exact capacity and rejected one byte short. Also verify an unchanged
cursor on failure, that bracketed process names and embedded NUL bytes
remain data, and that input ellipsis bytes are escaped rather than
mistaken for the raw truncation marker.
The composition test requires generic trace output helpers. Enable
CONFIG_FTRACE and CONFIG_SCHED_TRACER because the latter selects the
otherwise-hidden CONFIG_TRACING support required by
trace_print_flags_seq().
Use kselftests to exercise the complete tracefs path for both affected
filesystem events. A valid path containing 2640 spaces exceeds the
scratch output budget. Require its escaped prefix to end in the raw
[11 lines not shown]
landlock: Bound escaped trace path output
Filesystem paths may expand fourfold when trace text escapes spaces and
other untrusted bytes. A sufficiently long representation can exhaust
the shared scratch sequence. A sibling __print_flags() helper may then
return an unterminated one-past pointer because TP_printk() argument
ordering is unspecified.
Use a fixed budget rather than the scratch space available at call time,
so output does not vary with sibling evaluation order. Limit an
untrusted string to three quarters of the trace sequence, leaving the
rest for sibling helpers and final event metadata. Compute and commit
complete escaped output transactionally so an exact fill cannot consume
the terminating NUL or poison the scratch sequence.
For strings that exceed the limit, retain the largest prefix ending at a
complete escape unit, then append a raw UTF-8 ellipsis. Keep the
helper's existing octal fallback so complete values remain unchanged.
Hex fallback would consume the same four bytes per escaped byte without
[7 lines not shown]
landlock: Clean up ruleset validation checks
landlock_merge_ruleset() checks for a NULL ruleset after dereferencing
it in lockdep_assert_held(). Move the assertion after the check so the
defensive path remains effective.
The mask-validation comment originated in landlock_add_fs_access_mask()
to explain that its WARN_ON_ONCE() checked a caller invariant. It
became self-referential when this helper and its network and scope
counterparts were inlined into landlock_create_ruleset(). Restate the
invariant without naming the caller.
Keep both as defensive callee checks. Moving the assertion preserves
the NULL check's ability to warn and return -EINVAL, while invalid masks
remain warned about and masked.
Reported-by: Günther Noack <gnoack at google.com>
Closes: https://patch.msgid.link/aobYhIt3vcs2xN0b@google.com
Closes: https://patch.msgid.link/aobasxUDQ8b7GYXl@google.com
[3 lines not shown]
vduse: return compat ioctl results directly
The compat handler handles VDUSE_IOTLB_GET_FD and VDUSE_VQ_GET_INFO, but
then calls the native handler. Their different command sizes make native
dispatch return -ENOIOCTLCMD.
For GET_FD, this overwrites receive_fd()'s return value after the
descriptor is installed, leaking one fd per call. Return handled compat
results directly and use native dispatch only for other commands.
Fixes: 455a2a1af926 ("vduse: fix compat handling for VDUSE_IOTLB_GET_FD/VDUSE_VQ_GET_INFO")
Signed-off-by: Linfeng Sun <linfeng.sun.dev at gmail.com>
Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
Message-ID: <20260908-fix-vduse_dev_compat_ioctl-v1-1-62264d9bfb8d at gmail.com>
x86/MCE/AMD: Fix inverted interrupt enablement during storm handling
mce_amd_handle_storm() currently does the opposite of what storm
handling needs: it enables thresholding interrupts when a storm is
detected and disables them when the storm subsides.
Flip the "on" function argument before passing it to threshold_restart_bank()
as it should have been done.
To clarify: "on" to mce_handle_storm() means, the storm is on now when
"on" is true, and off when "on" is false.
[ bp: Simplify. ]
Fixes: 5c4663ed1eac ("x86/mce: Handle AMD threshold interrupt storms")
Signed-off-by: Jasjeet Rangi <jrangi at purestorage.com>
Signed-off-by: Borislav Petkov (AMD) <bp at alien8.de>
Signed-off-by: Ingo Molnar <mingo at kernel.org>
Cc: stable at vger.kernel.org
Link: https://patch.msgid.link/20260812221514.598842-2-jrangi@purestorage.com
x86/amd_node: Fix potential NULL pointer dereference
amd_smn_read/write() are exported functions around __amd_smn_rw(), so
they are always available even if amd_smn_init() fails. In that case,
'amd_roots' is NULL and __amd_smn_rw() will access uninitialized memory.
Then, commit:
83518453074d ("x86/amd_node: Add SMN offsets to exclusive region access")
added the 'smn_exclusive' flag, which indicated the calls to
pci_request_config_region_exclusive() succeeded, to prevent
concurrent userspace access.
Commit:
0a4b61d9c2e4 ("x86/amd_node: Fix AMD root device caching")
re-ordered initialization so pci_request_config_region_exclusive() is
[19 lines not shown]
vhost-scsi: clamp max_io_vqs module parameter
max_io_vqs is currently validated only when a vhost-scsi device is opened.
This allows sysfs to show values larger than the driver will actually use,
e.g. writing 2048 succeeds even though vhost_scsi_open() later clamps it to
VHOST_SCSI_MAX_IO_VQ. This makes the sysfs value differ from the value that
will actually be used.
hv# echo 2048 > /sys/module/vhost_scsi/parameters/max_io_vqs
hv# cat /sys/module/vhost_scsi/parameters/max_io_vqs
2048
[ 315.630495] Invalid max_io_vqs of 2048. Using 1024.
Keep accepting out-of-range values for compatibility, but clamp them in the
module parameter setter and store the effective value. This preserves the
existing behavior that invalid values do not make module loading or sysfs
writes fail. It also makes reads report the value that will actually be
[10 lines not shown]
vduse: do not take dev->rwsem in the virtqueue kick path
vduse_vq_kick() runs in the context of the vdpa .kick_vq callback. With
the virtio_vdpa bus driver that callback is invoked by virtqueue_notify()
from the virtio device driver, which may be an atomic context: virtio-blk
kicks from ->queue_rq(), which blk-mq dispatches under rcu_read_lock()
(the tag set does not use BLK_MQ_F_BLOCKING), and virtio-net kicks from
its xmit path with the tx queue lock held.
Commit b282418bc366 ("vduse: Add suspend") made vduse_vq_kick() take
dev->rwsem for reading in order to check dev->suspended. down_read() may
sleep, so with CONFIG_DEBUG_ATOMIC_SLEEP the first I/O on a VDUSE-backed
virtio-blk device bound to virtio_vdpa now triggers:
BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1573
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 27, name: kworker/1:0H
preempt_count: 0, expected: 0
RCU nest depth: 1, expected: 0
3 locks held by kworker/1:0H/27:
[40 lines not shown]
virtio_input: stop callbacks before unregistering input device
virtinput_remove() unregisters the input device before resetting the
virtio device. virtinput_recv_events() drops vi->lock around input_event(),
so clearing vi->ready does not stop a callback that passed the entry check.
It can still use vi->idev, requeue buffers and kick the queue.
Reset first, as virtinput_freeze() already does. With the preceding core
change, reset waits for callbacks before input_unregister_device() can
free vi->idev. Recheck vi->ready after taking the lock again: keep draining
completed events so an input packet is not truncated, but stop requeueing
buffers and kicking the queue.
With evdev attached, input_unregister_handle() currently waits for an RCU
grace period, which also waits out IRQ callbacks. This masks the lifetime
bug on PCI and MMIO, but does not protect sleepable callbacks on other
transports.
Fixes: 271c865161c5 ("Add virtio-input driver.")
[4 lines not shown]
virtio_input: reset device if input_register_device() fails
Probe marks the device DRIVER_OK with virtio_device_ready() before
calling input_register_device(). If registration fails, the error path
cleared vi->ready and called del_vqs() while the device was still live,
so the device could keep DMA to queues that were already torn down.
Match remove/freeze: call virtio_reset_device() on that path before
tearing down the virtqueues.
Fixes: 271c865161c5 ("Add virtio-input driver.")
Signed-off-by: Xiong Weimin <xiongweimin at kylinos.cn>
Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
Message-ID: <20260805032931.1606652-1-xiongweimin at kylinos.cn>
vduse: validate virtqueue alignment
vduse_validate_config() only checks the upper bound of vq_align. Invalid
values can therefore reach vring_create_virtqueue_map(). The split-ring
helpers use align - 1 as a bit mask, so the alignment must be a non-zero
power of two. A zero value makes vring_size() drop the descriptor and
available-ring part and vring_init() leave the used ring pointer NULL.
The VIRTIO spec requires the used ring to start at an address
aligned to at least 4 bytes. Reject values below VRING_USED_ALIGN_SIZE as
well as non-power-of-two values before they reach the virtio ring helpers.
Opening a virtio-net device created with vq_align=0 triggered:
BUG: KASAN: null-ptr-deref in virtqueue_kick_prepare_split+0xe3/0x100
Read of size 2 at addr 0000000000000000 by task systemd-network/1062
Call Trace (relevant frames):
dump_stack_lvl
[18 lines not shown]
vhost: invalidate vring access on IOTLB transitions
When VIRTIO_F_ACCESS_PLATFORM changes, cached vring pointers and IOTLB
metadata are interpreted in a different address space. Keeping them
across the transition can leave stale ring mappings in use.
Clearing d->iotlb before taking the VQ locks also lets a worker observe
a transient NULL d->iotlb and fall back to d->umem while translating a
descriptor.
Add a common vhost_clear_device_iotlb() helper for vhost-net and
vhost-vsock. Take all VQ mutexes in index order before dropping the
device-wide IOTLB, invalidate each VQ's cached ring access and metadata,
clear pending IOTLB messages, and free the old table after the handoff.
This serializes the transition with workers and prevents mixed address
space mappings.
On the first direct-to-IOTLB transition, invalidate the cached vring
addresses. When an existing device IOTLB is replaced, preserve the
[14 lines not shown]
vdpa_sim_net: check TX pull result before RX copy
vringh_iov_pull_iotlb() returns a signed byte count. A failed TX pull is
currently added to the unsigned byte counter and then passed as a size_t
length to receive_filter() and vringh_iov_push_iotlb(). A negative error
can therefore become a large length in the RX path.
Handle non-positive pull results before every length use. Count the TX
error and complete the consumed TX descriptor with zero bytes.
I found this bug myself, though the patch was written with AI assistance.
Fixes: cfe226892913 ("vdpa_sim: filter destination mac address")
Assisted-by: OpenAI-Codex:GPT-5
Signed-off-by: Linfeng Sun <linfeng.sun.dev at gmail.com>
Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
Message-ID: <20260901094842.25875-1-linfeng.sun.dev at gmail.com>
vdpa_sim_blk: reject out-of-range sector starts
vdpasim_blk_check_range() logs an invalid start sector but continues
validating the request. The subsequent unsigned capacity subtraction can
underflow and let an out-of-range buffer offset reach the data path.
The invalid offset is used by three request paths. VIRTIO_BLK_T_OUT
copies guest data to blk->buffer + offset through
vringh_iov_pull_iotlb(), causing an out-of-bounds write in
_copy_from_iter() or memcpy(). VIRTIO_BLK_T_IN copies from
blk->buffer + offset to the guest through vringh_iov_push_iotlb(),
causing an out-of-bounds read in _copy_to_iter().
VIRTIO_BLK_T_WRITE_ZEROES passes blk->buffer + offset to memset(),
causing an out-of-bounds write.
Reject starts at or beyond the capacity before the subtraction. Treat the
capacity boundary as invalid because the IN and OUT paths round byte counts
down to sectors for validation but later copy the original byte counts. A
sub-sector request at the capacity boundary would otherwise still access
[9 lines not shown]
virtio-vdpa: Use queue id when setting vq affinity
When optional queues are skipped, pass the compressed vDPA queue id to
set_vq_affinity() so affinity is applied to the queue that was actually
created.
Signed-off-by: Xiong Weimin <xiongweimin at kylinos.cn>
Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
Message-ID: <20260804092649.1344478-1-xiongweimin at kylinos.cn>
virtio: add Eugenio Pérez as Maintainer
Signed-off-by: Eugenio Pérez <eperezma at redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare at redhat.com>
Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
Message-ID: <20260903081831.2129729-1-eperezma at redhat.com>
vhost: limit outstanding IOTLB misses per virtqueue
vhost allocates a message node whenever address translation misses. If
userspace reads these messages without resolving them, repeated virtqueue
kicks can grow the pending message list until the host runs out of memory.
Virtqueue processing stops at the first translation miss and cannot make
progress until userspace installs a mapping. Keep a pointer to that
outstanding message in the virtqueue and suppress additional misses until
the node is resolved or discarded.
The pointer remains set while the message is queued for reading, copied to
userspace, or waiting on the pending list. Clear it under the IOTLB lock
when the owning node is freed. This bounds outstanding miss messages by the
fixed number of virtqueues without introducing an arbitrary queue limit.
Signed-off-by: Linfeng Sun <linfeng.sun.dev at gmail.com>
Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
Message-ID: <20260903-fix-kernel-panic-in-vhost_iotlb_miss_pending_list-v1-1-39b8cd427978 at gmail.com>
MAINTAINERS: Add a section for virtio-rng
At Michael's request, add a MAINTAINERS entry for the virtio-rng driver
and list myself as its maintainer.
I already maintain the corresponding QEMU implementation.
Cc: Michael S. Tsirkin <mst at redhat.com>
Signed-off-by: Laurent Vivier <lvivier at redhat.com>
Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
Message-ID: <20260818133913.162471-1-lvivier at redhat.com>
vdpa: octeon_ep: Check dev_set_name() in dev add
Handle dev_set_name() failures before registering the vDPA device so
allocation is unwound through the existing put_device() path.
Signed-off-by: Xiong Weimin <xiongweimin at kylinos.cn>
Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
Message-ID: <20260804092636.1344431-1-xiongweimin at kylinos.cn>
