This reverts commit 343a77562c which is
commit 8d2da07c813ad333c20eb803e15f8c4541f25350 upstream.
It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.
Bug: 161946584
Change-Id: If7c1dad1218664f0cd6763004b01890f9258d461
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
GKI (arm64) relevant 18 out of 143 changes, affecting 32 files +213/-83
10d1496f85 fs/xattr.c: fix simple_xattr_list to always include security.* xattrs [1 file, +24/-0]
bc4c54cbb4 binfmt_elf: Move brk for static PIE even if ASLR disabled [1 file, +47/-24]
f0d70d8dca cgroup/cpuset: Extend kthread_is_per_cpu() check to all PF_NO_SETAFFINITY tasks [1 file, +4/-2]
517c11fe4f tracing: probes: Fix a possible race in trace_probe_log APIs [5 files, +27/-3]
94e7272b63 HID: uclogic: Add NULL check in uclogic_input_configured() [1 file, +4/-3]
28826a89fd Bluetooth: MGMT: Fix MGMT_OP_ADD_DEVICE invalid device flags [1 file, +6/-3]
d1365ca80b net_sched: Flush gso_skb list too during ->change() [7 files, +21/-6]
ddfa034da3 nvme-pci: make nvme_pci_npages_prp() __always_inline [1 file, +1/-1]
a3c147040b nvme-pci: acquire cq_poll_lock in nvme_poll_irqdisable [1 file, +2/-0]
c88f4ff535 ALSA: usb-audio: Add sample rate quirk for Audioengine D1 [1 file, +2/-0]
93152dac0b ALSA: usb-audio: Add sample rate quirk for Microdia JP001 USB Camera [1 file, +2/-0]
fe1bebd0ed dma-buf: insert memory barrier before updating num_fences [1 file, +3/-2]
7d353da580 ftrace: Fix preemption accounting for stacktrace trigger command [1 file, +1/-1]
bffc3038a2 scsi: sd_zbc: block: Respect bio vector limits for REPORT ZONES buffer [3 files, +7/-2]
20d6e621be ring-buffer: Fix persistent buffer when commit page is the reader page [1 file, +5/-3]
fe0756daad mm: userfaultfd: correct dirty flags set for both present and swap pte [1 file, +10/-2]
74953f93f4 mm/page_alloc: fix race condition in unaccepted memory handling [1 file, +0/-23]
5924b32446 usb: typec: ucsi: displayport: Fix deadlock [3 files, +47/-8]
Changes in 6.12.30
arm64: dts: rockchip: Assign RT5616 MCLK rate on rk3588-friendlyelec-cm3588
fs/xattr.c: fix simple_xattr_list to always include security.* xattrs
drivers/platform/x86/amd: pmf: Check for invalid sideloaded Smart PC Policies
drivers/platform/x86/amd: pmf: Check for invalid Smart PC Policies
riscv: dts: sophgo: fix DMA data-width configuration for CV18xx
binfmt_elf: Move brk for static PIE even if ASLR disabled
platform/x86/amd/pmc: Declare quirk_spurious_8042 for MECHREVO Wujie 14XA (GX4HRXL)
platform/x86: asus-wmi: Fix wlan_ctrl_by_user detection
arm64: dts: imx8mp-var-som: Fix LDO5 shutdown causing SD card timeout
cgroup/cpuset: Extend kthread_is_per_cpu() check to all PF_NO_SETAFFINITY tasks
tracing: probes: Fix a possible race in trace_probe_log APIs
tpm: tis: Double the timeout B to 4s
uio_hv_generic: Fix sysfs creation path for ring buffer
KVM: Add member to struct kvm_gfn_range to indicate private/shared
KVM: x86/mmu: Prevent installing hugepages when mem attributes are changing
iio: adc: ad7266: Fix potential timestamp alignment issue.
iio: chemical: pms7003: use aligned_s64 for timestamp
iio: pressure: mprls0025pa: use aligned_s64 for timestamp
drm/amd: Add Suspend/Hibernate notification callback support
Revert "drm/amd: Stop evicting resources on APUs in suspend"
xhci: dbc: Improve performance by removing delay in transfer event polling.
xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive.
iio: adc: ad7768-1: Fix insufficient alignment of timestamp.
iio: chemical: sps30: use aligned_s64 for timestamp
virtio_ring: add a func argument 'recycle_done' to virtqueue_reset()
virtio_net: ensure netdev_tx_reset_queue is called on bind xsk for tx
RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug
HID: thrustmaster: fix memory leak in thrustmaster_interrupts()
HID: uclogic: Add NULL check in uclogic_input_configured()
nfs: handle failure of nfs_get_lock_context in unlock path
spi: loopback-test: Do not split 1024-byte hexdumps
RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem
Bluetooth: MGMT: Fix MGMT_OP_ADD_DEVICE invalid device flags
net_sched: Flush gso_skb list too during ->change()
tools/net/ynl: ethtool: fix crash when Hardware Clock info is missing
mctp: no longer rely on net->dev_index_head[]
net: mctp: Don't access ifa_index when missing
selftests: ncdevmem: Redirect all non-payload output to stderr
selftests: ncdevmem: Separate out dmabuf provider
selftests: ncdevmem: Unify error handling
selftests: ncdevmem: Make client_ip optional
selftests: ncdevmem: Switch to AF_INET6
tests/ncdevmem: Fix double-free of queue array
net: mctp: Ensure keys maintain only one ref to corresponding dev
ALSA: seq: Fix delivery of UMP events to group ports
ALSA: ump: Fix a typo of snd_ump_stream_msg_device_info
net: cadence: macb: Fix a possible deadlock in macb_halt_tx.
net: dsa: sja1105: discard incoming frames in BR_STATE_LISTENING
nvme-pci: make nvme_pci_npages_prp() __always_inline
nvme-pci: acquire cq_poll_lock in nvme_poll_irqdisable
ALSA: sh: SND_AICA should depend on SH_DMA_API
net: dsa: b53: prevent standalone from trying to forward to other ports
vsock/test: Fix occasional failure in SIOCOUTQ tests
net/mlx5e: Disable MACsec offload for uplink representor profile
qlcnic: fix memory leak in qlcnic_sriov_channel_cfg_cmd()
regulator: max20086: fix invalid memory access
drm/xe: Save CTX_TIMESTAMP mmio value instead of LRC value
netlink: specs: tc: fix a couple of attribute names
netlink: specs: tc: all actions are indexed arrays
octeontx2-pf: macsec: Fix incorrect max transmit size in TX secy
net: ethernet: mtk_eth_soc: fix typo for declaration MT7988 ESW capability
octeontx2-af: Fix CGX Receive counters
octeontx2-pf: Do not reallocate all ntuple filters
wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request
mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices
net/tls: fix kernel panic when alloc_page failed
tsnep: fix timestamping with a stacked DSA driver
NFSv4/pnfs: Reset the layout state after a layoutreturn
dmaengine: Revert "dmaengine: dmatest: Fix dmatest waiting less when interrupted"
sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator
udf: Make sure i_lenExtents is uptodate on inode eviction
HID: bpf: abort dispatch if device destroyed
LoongArch: Prevent cond_resched() occurring within kernel-fpu
LoongArch: Move __arch_cpu_idle() to .cpuidle.text section
LoongArch: Save and restore CSR.CNTC for hibernation
LoongArch: Fix MAX_REG_OFFSET calculation
LoongArch: uprobes: Remove user_{en,dis}able_single_step()
LoongArch: uprobes: Remove redundant code about resume_era
btrfs: fix discard worker infinite loop after disabling discard
btrfs: fix folio leak in submit_one_async_extent()
btrfs: add back warning for mount option commit values exceeding 300
Revert "drm/amd/display: Hardware cursor changes color when switched to software cursor"
drm/amdgpu: fix incorrect MALL size for GFX1151
drm/amdgpu: csa unmap use uninterruptible lock
drm/amd/display: Correct the reply value when AUX write incomplete
drm/amd/display: Avoid flooding unnecessary info messages
MAINTAINERS: Update Alexey Makhalov's email address
gpio: pca953x: fix IRQ storm on system wake up
ACPI: PPTT: Fix processor subtable walk
ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2()
ALSA: usb-audio: Add sample rate quirk for Audioengine D1
ALSA: usb-audio: Add sample rate quirk for Microdia JP001 USB Camera
dma-buf: insert memory barrier before updating num_fences
hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages
hv_netvsc: Preserve contiguous PFN grouping in the page buffer array
hv_netvsc: Remove rmsg_pgcnt
arm64: dts: amlogic: dreambox: fix missing clkc_audio node
arm64: dts: rockchip: Remove overdrive-mode OPPs from RK3588J SoC dtsi
Drivers: hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges
Drivers: hv: vmbus: Remove vmbus_sendpacket_pagebuffer()
kbuild: Disable -Wdefault-const-init-unsafe
ftrace: Fix preemption accounting for stacktrace trigger command
ftrace: Fix preemption accounting for stacktrace filter command
tracing: samples: Initialize trace_array_printk() with the correct function
phy: tegra: xusb: Use a bitmask for UTMI pad power state tracking
phy: Fix error handling in tegra_xusb_port_init
phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bind
phy: renesas: rcar-gen3-usb2: Set timing registers only once
scsi: sd_zbc: block: Respect bio vector limits for REPORT ZONES buffer
smb: client: fix memory leak during error handling for POSIX mkdir
spi: tegra114: Use value to check for invalid delays
tpm: Mask TPM RC in tpm2_start_auth_session()
wifi: mt76: disable napi on driver removal
ring-buffer: Fix persistent buffer when commit page is the reader page
net: qede: Initialize qede_ll_ops with designated initializer
mm: userfaultfd: correct dirty flags set for both present and swap pte
dmaengine: ti: k3-udma: Add missing locking
dmaengine: ti: k3-udma: Use cap_mask directly from dma_device structure instead of a local copy
dmaengine: idxd: fix memory leak in error handling path of idxd_setup_wqs
dmaengine: idxd: fix memory leak in error handling path of idxd_setup_engines
dmaengine: idxd: fix memory leak in error handling path of idxd_setup_groups
dmaengine: idxd: Add missing cleanup for early error out in idxd_setup_internals
dmaengine: idxd: Add missing cleanups in cleanup internals
dmaengine: idxd: Add missing idxd cleanup to fix memory leak in remove call
dmaengine: idxd: fix memory leak in error handling path of idxd_alloc
dmaengine: idxd: fix memory leak in error handling path of idxd_pci_probe
dmaengine: idxd: Refactor remove call with idxd_cleanup() helper
CIFS: New mount option for cifs.upcall namespace resolution
drm/xe/gsc: do not flush the GSC worker from the reset path
mm/page_alloc: fix race condition in unaccepted memory handling
accel/ivpu: Rename ivpu_log_level to fw_log_level
accel/ivpu: Reset fw log on cold boot
accel/ivpu: Refactor functions in ivpu_fw_log.c
accel/ivpu: Fix fw log printing
iio: light: opt3001: fix deadlock due to concurrent flag access
Bluetooth: btnxpuart: Fix kernel panic during FW release
drm/fbdev-dma: Support struct drm_driver.fbdev_probe
drm/panel-mipi-dbi: Run DRM default client setup
drm/tiny: panel-mipi-dbi: Use drm_client_setup_with_fourcc()
usb: typec: ucsi: displayport: Fix deadlock
phy: tegra: xusb: remove a stray unlock
drm/amdgpu: fix pm notifier handling
Linux 6.12.30
Change-Id: I4fefed85c02f1ed826b7ee014700b80c10300bb5
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit 2e2f925fe737576df2373931c95e1a2b66efdfef ]
syzbot reports a data-race when accessing the event_triggered, here is the
simplified stack when the issue occurred:
==================================================================
BUG: KCSAN: data-race in virtqueue_disable_cb / virtqueue_enable_cb_delayed
write to 0xffff8881025bc452 of 1 bytes by task 3288 on cpu 0:
virtqueue_enable_cb_delayed+0x42/0x3c0 drivers/virtio/virtio_ring.c:2653
start_xmit+0x230/0x1310 drivers/net/virtio_net.c:3264
__netdev_start_xmit include/linux/netdevice.h:5151 [inline]
netdev_start_xmit include/linux/netdevice.h:5160 [inline]
xmit_one net/core/dev.c:3800 [inline]
read to 0xffff8881025bc452 of 1 bytes by interrupt on cpu 1:
virtqueue_disable_cb_split drivers/virtio/virtio_ring.c:880 [inline]
virtqueue_disable_cb+0x92/0x180 drivers/virtio/virtio_ring.c:2566
skb_xmit_done+0x5f/0x140 drivers/net/virtio_net.c:777
vring_interrupt+0x161/0x190 drivers/virtio/virtio_ring.c:2715
__handle_irq_event_percpu+0x95/0x490 kernel/irq/handle.c:158
handle_irq_event_percpu kernel/irq/handle.c:193 [inline]
value changed: 0x01 -> 0x00
==================================================================
When the data race occurs, the function virtqueue_enable_cb_delayed() sets
event_triggered to false, and virtqueue_disable_cb_split/packed() reads it
as false due to the race condition. Since event_triggered is an unreliable
hint used for optimization, this should only cause the driver temporarily
suggest that the device not send an interrupt notification when the event
index is used.
Fix this KCSAN reported data-race issue by explicitly tagging the access as
data_racy.
Reported-by: syzbot+efe683d57990864b8c8e@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/67c7761a.050a0220.15b4b9.0018.GAE@google.com/
Signed-off-by: Zhongqiu Han <quic_zhonhan@quicinc.com>
Message-Id: <20250312130412.3516307-1-quic_zhonhan@quicinc.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 8d2da07c813ad333c20eb803e15f8c4541f25350 ]
When virtqueue_reset() has actually recycled all unused buffers,
additional work may be required in some cases. Relying solely on its
return status is fragile, so introduce a new function argument
'recycle_done', which is invoked when it really occurs.
Signed-off-by: Koichiro Den <koichiro.den@canonical.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Stable-dep-of: 76a771ec4c9a ("virtio_net: ensure netdev_tx_reset_queue is called on bind xsk for tx")
Signed-off-by: Sasha Levin <sashal@kernel.org>
New option available under (for some integer N):
/sys/bus/virtio/drivers/virtio_balloon/virtioN/bail_on_out_of_puff
Default value is 0 (disabled). When enabled, the balloon will stop
inflating on first allocation failure ("out of puff") until the next
virtio configuration change.
Bug: 357781595
Bug: 407629285
Change-Id: Ic40b8edb651f396d1ecc7f391a92114209a67a31
Signed-off-by: Keir Fraser <keirf@google.com>
Instead of invalidating the tlb of the guest every page it relinquishes,
invalidate once before the host is informed about the free pages.
Bug: 315173520
Change-Id: I8450fd552a27dfc791efa15e884982aeedaa3234
Signed-off-by: Prakruthi Deepak Heragu <quic_pheragu@quicinc.com>
Signed-off-by: Elliot Berman <elliot.berman@oss.qualcomm.com>
The old API was used only by virtio_balloon, and this way we end up
less scattered around the kernel tree.
Bug: 381400679
Bug: 357781595
Change-Id: Ic896d1da83565cc260567b5a1183e94a4d13daab
Signed-off-by: Keir Fraser <keirf@google.com>
If the reporting granule is larger than guest page size, we cannot
safely relinquish memory to the hypervisor.
Bug: 381400679
Bug: 357781595
Change-Id: I84461c21e44209021afe617ed2796108c5c43718
Signed-off-by: Keir Fraser <keirf@google.com>
GKI (arm64) relevant 39 out of 174 changes, affecting 58 files +843/-596
9b53d2c2a3 bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors [1 file, +7/-0]
26702b3439 splice: do not checksum AF_UNIX sockets [1 file, +1/-0]
8aa9d1ff5b tcp: check space before adding MPTCP SYN options [1 file, +4/-2]
29d1e06560 blk-cgroup: Fix UAF in blkcg_unpin_online() [1 file, +5/-1]
cbd06d9808 block: Switch to using refcount_t for zone write plugs [1 file, +10/-10]
eea49fcea5 block: Use a zone write plug BIO work for REQ_NOWAIT BIOs [1 file, +42/-20]
a4b656ea1b dm: Fix dm-zoned-reclaim zone write pointer alignment [3 files, +124/-26]
7fa80134cf block: Prevent potential deadlocks in zone write plug error recovery [2 files, +61/-249]
825bccd943 memcg: slub: fix SUnreclaim for post charged objects [1 file, +18/-3]
3be6628c47 ALSA: usb-audio: Add implicit feedback quirk for Yamaha THR5 [1 file, +2/-0]
0eae680d03 block: Ignore REQ_NOWAIT for zone reset and zone finish operations [1 file, +9/-0]
2588c29afd usb: core: hcd: only check primary hcd skip_phy_initialization [1 file, +7/-1]
5de70cdf42 bpf: Revert "bpf: Mark raw_tp arguments with PTR_MAYBE_NULL" [4 files, +9/-87]
cab34b0c9d scsi: ufs: core: Update compl_time_stamp_local_clock after completing a cqe [1 file, +1/-0]
dd6b0ca602 usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer [1 file, +6/-3]
d32babf3fe usb: typec: ucsi: Fix completion notifications [1 file, +4/-2]
2c3ca17a07 bpf: Check size for BTF-based ctx access of pointer members [3 files, +10/-4]
e6d1dec142 bpf: Fix theoretical prog_array UAF in __uprobe_perf_func() [2 files, +10/-9]
dfb15ddf3b bpf,perf: Fix invalid prog_array access in perf_event_detach_bpf_prog [1 file, +4/-0]
bf2318e288 bpf, sockmap: Fix race between element replace and close() [1 file, +2/-3]
2bd517bafc bpf, sockmap: Fix update element with same [1 file, +1/-0]
b2fc4b17fc bpf: Augment raw_tp arguments with PTR_MAYBE_NULL [1 file, +138/-0]
a852c82eda tipc: fix NULL deref in cleanup_bearer() [1 file, +6/-1]
6610c7f8a8 net: defer final 'struct net' free in netns dismantle [2 files, +20/-1]
e7b02a0feb block: get wp_offset by bdev_offset_from_zone_start [1 file, +1/-1]
13ba06e260 Bluetooth: Improve setsockopt() handling of malformed user input [6 files, +33/-40]
45fe76573a netfilter: IDLETIMER: Fix for possible ABBA deadlock [1 file, +28/-24]
7cf0bd232b netfilter: nf_tables: do not defer rule destruction via call_rcu [2 files, +15/-21]
356078a5c5 net/sched: netem: account for backlog updates from child qdisc [1 file, +16/-6]
f9ecc90b5d Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating [1 file, +11/-22]
4ca50db1c5 Bluetooth: iso: Always release hdev at the end of iso_listen_bis [1 file, +1/-2]
827f30b1df Bluetooth: iso: Fix recursive locking warning [1 file, +6/-2]
d0f4a51246 Bluetooth: SCO: Add support for 16 bits transparent voice setting [2 files, +16/-14]
c541d7b5e1 Bluetooth: iso: Fix circular lock in iso_listen_bis [1 file, +12/-2]
cbe640d6ca Bluetooth: iso: Fix circular lock in iso_conn_big_sync [1 file, +27/-7]
c1291ea131 blk-mq: move cpuhp callback registering out of q->sysfs_lock [1 file, +92/-6]
f1a494df83 block: Fix potential deadlock while freezing queue and acquiring sysfs_lock [3 files, +26/-23]
1e04ca11a4 KVM: arm64: Disable MPAM visibility by default and ignore VMM writes [1 file, +52/-3]
5013bd1e23 x86/static-call: fix 32-bit build [1 file, +6/-1]
Changes in 6.12.6
usb: misc: onboard_usb_dev: skip suspend/resume sequence for USB5744 SMBus support
serial: sh-sci: Check if TX data was written to device in .tx_empty()
bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors
sched/deadline: Fix replenish_dl_new_period dl_server condition
perf/x86/intel/ds: Unconditionally drain PEBS DS when changing PEBS_DATA_CFG
clk: en7523: Fix wrong BUS clock for EN7581
ksmbd: fix racy issue from session lookup and expire
splice: do not checksum AF_UNIX sockets
tcp: check space before adding MPTCP SYN options
perf ftrace: Fix undefined behavior in cmp_profile_data()
virtio_net: correct netdev_tx_reset_queue() invocation point
virtio_ring: add a func argument 'recycle_done' to virtqueue_resize()
virtio_net: ensure netdev_tx_reset_queue is called on tx ring resize
riscv: mm: Do not call pmd dtor on vmemmap page table teardown
riscv: Fix wrong usage of __pa() on a fixmap address
blk-cgroup: Fix UAF in blkcg_unpin_online()
block: Switch to using refcount_t for zone write plugs
block: Use a zone write plug BIO work for REQ_NOWAIT BIOs
dm: Fix dm-zoned-reclaim zone write pointer alignment
block: Prevent potential deadlocks in zone write plug error recovery
gpio: graniterapids: Fix GPIO Ack functionality
memcg: slub: fix SUnreclaim for post charged objects
spi: rockchip: Fix PM runtime count on no-op cs
gpio: ljca: Initialize num before accessing item in ljca_gpio_config
ALSA: usb-audio: Add implicit feedback quirk for Yamaha THR5
ALSA: hda/realtek: Fix headset mic on Acer Nitro 5
riscv: Fix IPIs usage in kfence_protect_page()
crypto: hisilicon/debugfs - fix the struct pointer incorrectly offset problem
drm/panic: remove spurious empty line to clean warning
usb: host: max3421-hcd: Correctly abort a USB request.
block: Ignore REQ_NOWAIT for zone reset and zone finish operations
gpio: graniterapids: Fix vGPIO driver crash
gpio: graniterapids: Fix incorrect BAR assignment
gpio: graniterapids: Fix invalid GPI_IS register offset
gpio: graniterapids: Fix invalid RXEVCFG register bitmask
gpio: graniterapids: Determine if GPIO pad can be used by driver
gpio: graniterapids: Check if GPIO line can be used for IRQs
usb: core: hcd: only check primary hcd skip_phy_initialization
bpf: Revert "bpf: Mark raw_tp arguments with PTR_MAYBE_NULL"
ata: sata_highbank: fix OF node reference leak in highbank_initialize_phys()
usb: dwc2: Fix HCD resume
usb: dwc2: hcd: Fix GetPortStatus & SetPortFeature
usb: dwc2: Fix HCD port connection race
scsi: ufs: core: Update compl_time_stamp_local_clock after completing a cqe
usb: gadget: midi2: Fix interpretation of is_midi1 bits
usb: ehci-hcd: fix call balance of clocks handling routines
usb: typec: anx7411: fix fwnode_handle reference leak
usb: dwc3: imx8mp: fix software node kernel dump
usb: typec: anx7411: fix OF node reference leaks in anx7411_typec_switch_probe()
usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer
usb: typec: ucsi: Fix completion notifications
usb: dwc3: xilinx: make sure pipe clock is deselected in usb2 only mode
iommu/tegra241-cmdqv: do not use smp_processor_id in preemptible context
iommu/vt-d: Remove cache tags before disabling ATS
iommu/vt-d: Fix qi_batch NULL pointer with nested parent domain
drm/xe: Call invalidation_fence_fini for PT inval fences in error state
drm/amdkfd: pause autosuspend when creating pdd
drm/i915: Fix memory leak by correcting cache object name in error handler
drm/i915/color: Stop using non-posted DSB writes for legacy LUT
drm/i915: Fix NULL pointer dereference in capture_engine
drm/amdgpu: fix UVD contiguous CS mapping problem
drm/amd/pm: Set SMU v13.0.7 default workload type
drm/amdgpu: fix when the cleaner shader is emitted
drm/amdkfd: Dereference null return value
drm/amdkfd: hard-code cacheline size for gfx11
drm/amdkfd: hard-code MALL cacheline size for gfx11, gfx12
xfs: set XFS_SICK_INO_SYMLINK_ZAPPED explicitly when zapping a symlink
xfs: update btree keys correctly when _insrec splits an inode root block
xfs: don't drop errno values when we fail to ficlone the entire range
xfs: return a 64-bit block count from xfs_btree_count_blocks
xfs: fix null bno_hint handling in xfs_rtallocate_rtg
xfs: return from xfs_symlink_verify early on V4 filesystems
xfs: fix scrub tracepoints when inode-rooted btrees are involved
xfs: only run precommits once per transaction object
xfs: unlock inodes when erroring out of xfs_trans_alloc_dir
bpf: Check size for BTF-based ctx access of pointer members
bpf: Fix theoretical prog_array UAF in __uprobe_perf_func()
bpf,perf: Fix invalid prog_array access in perf_event_detach_bpf_prog
bpf, sockmap: Fix race between element replace and close()
bpf, sockmap: Fix update element with same
bpf: Augment raw_tp arguments with PTR_MAYBE_NULL
perf tools: Fix build-id event recording
wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one
wifi: mac80211: init cnt before accessing elem in ieee80211_copy_mbssid_beacon
wifi: mac80211: fix a queue stall in certain cases of CSA
wifi: mac80211: fix station NSS capability initialization order
perf machine: Initialize machine->env to address a segfault
acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl
amdgpu/uvd: get ring reference from rq scheduler
batman-adv: Do not send uninitialized TT changes
batman-adv: Remove uninitialized data in full table TT response
batman-adv: Do not let TT changes list grows indefinitely
tipc: fix NULL deref in cleanup_bearer()
net/mlx5: DR, prevent potential error pointer dereference
wifi: cfg80211: sme: init n_channels before channels[] access
selftests: mlxsw: sharedbuffer: Remove h1 ingress test case
selftests: mlxsw: sharedbuffer: Remove duplicate test cases
selftests: mlxsw: sharedbuffer: Ensure no extra packets are counted
ptp: kvm: x86: Return EOPNOTSUPP instead of ENODEV from kvm_arch_ptp_init()
bnxt_en: Fix GSO type for HW GRO packets on 5750X chips
net: lapb: increase LAPB_HEADER_LEN
net: defer final 'struct net' free in netns dismantle
net: mscc: ocelot: fix memory leak on ocelot_port_add_txtstamp_skb()
net: mscc: ocelot: improve handling of TX timestamp for unknown skb
net: mscc: ocelot: ocelot->ts_id_lock and ocelot_port->tx_skbs.lock are IRQ-safe
net: mscc: ocelot: be resilient to loss of PTP packets during transmission
net: mscc: ocelot: perform error cleanup in ocelot_hwstamp_set()
regulator: axp20x: AXP717: set ramp_delay
spi: aspeed: Fix an error handling path in aspeed_spi_[read|write]_user()
net: sparx5: fix FDMA performance issue
net: sparx5: fix the maximum frame length register
ACPI: resource: Fix memory resource type union access
cxgb4: use port number to set mac addr
qca_spi: Fix clock speed for multiple QCA7000
qca_spi: Make driver probing reliable
ALSA: control: Avoid WARN() for symlink errors
ASoC: amd: yc: Fix the wrong return value
Documentation: PM: Clarify pm_runtime_resume_and_get() return value
block: get wp_offset by bdev_offset_from_zone_start
bnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips
Documentation: networking: Add a caveat to nexthop_compat_mode sysctl
cifs: Fix rmdir failure due to ongoing I/O on deleted file
net: renesas: rswitch: fix possible early skb release
net: renesas: rswitch: fix race window between tx start and complete
net: renesas: rswitch: fix leaked pointer on error path
net: renesas: rswitch: avoid use-after-put for a device tree node
net: renesas: rswitch: handle stop vs interrupt race
ASoC: tas2781: Fix calibration issue in stress test
Bluetooth: Improve setsockopt() handling of malformed user input
libperf: evlist: Fix --cpu argument on hybrid platform
ASoC: fsl_xcvr: change IFACE_PCM to IFACE_MIXER
ASoC: fsl_spdif: change IFACE_PCM to IFACE_MIXER
selftests: netfilter: Stabilize rpath.sh
netfilter: IDLETIMER: Fix for possible ABBA deadlock
netfilter: nf_tables: do not defer rule destruction via call_rcu
net: mana: Fix memory leak in mana_gd_setup_irqs
net: mana: Fix irq_contexts memory leak in mana_gd_setup_irqs
net: dsa: felix: fix stuck CPU-injected packets with short taprio windows
net/sched: netem: account for backlog updates from child qdisc
net, team, bonding: Add netdev_base_features helper
bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features
bonding: Fix feature propagation of NETIF_F_GSO_ENCAP_ALL
team: Fix initial vlan_feature set in __team_compute_features
team: Fix feature propagation of NETIF_F_GSO_ENCAP_ALL
ASoC: Intel: sof_sdw: Add space for a terminator into DAIs array
ACPICA: events/evxfregn: don't release the ContextMutex that was never acquired
Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating
Bluetooth: iso: Always release hdev at the end of iso_listen_bis
Bluetooth: iso: Fix recursive locking warning
Bluetooth: SCO: Add support for 16 bits transparent voice setting
Bluetooth: iso: Fix circular lock in iso_listen_bis
Bluetooth: iso: Fix circular lock in iso_conn_big_sync
Bluetooth: btmtk: avoid UAF in btmtk_process_coredump
net: renesas: rswitch: fix initial MPIC register setting
net: dsa: microchip: KSZ9896 register regmap alignment to 32 bit boundaries
net: dsa: tag_ocelot_8021q: fix broken reception
drm/xe: fix the ERR_PTR() returned on failure to allocate tiny pt
drm/xe/reg_sr: Remove register pool
blk-iocost: Avoid using clamp() on inuse in __propagate_weights()
kselftest/arm64: abi: fix SVCR detection
blk-mq: move cpuhp callback registering out of q->sysfs_lock
block: Fix potential deadlock while freezing queue and acquiring sysfs_lock
rust: kbuild: set `bindgen`'s Rust target version
KVM: arm64: Disable MPAM visibility by default and ignore VMM writes
xen/netfront: fix crash when removing device
x86: make get_cpu_vendor() accessible from Xen code
objtool/x86: allow syscall instruction
x86/static-call: provide a way to do very early static-call updates
x86/xen: don't do PV iret hypercall through hypercall page
x86/xen: add central hypercall functions
x86/xen: use new hypercall functions instead of hypercall page
x86/xen: remove hypercall page
x86/static-call: fix 32-bit build
Linux 6.12.6
Change-Id: I656537654d0b73440e5b76deee63abd58ea68b56
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
commit 8d6712c892019b9b9dc5c7039edd3c9d770b510b upstream.
When virtqueue_resize() has actually recycled all unused buffers,
additional work may be required in some cases. Relying solely on its
return status is fragile, so introduce a new function argument
'recycle_done', which is invoked when the recycle really occurs.
Cc: <stable@vger.kernel.org> # v6.11+
Signed-off-by: Koichiro Den <koichiro.den@canonical.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This catches up android16-6.12 with android-mainline to 6.12-rc7.
Bug: 367265496
Change-Id: I072760fe7a0f14fcfb67d4e4992939db4b810b63
Signed-off-by: Matthias Maennich <maennich@google.com>
Signed-off-by: Aleksei Vetrov <vvvvvv@google.com>
This essentially reverts commit e41b135550
"virtio_balloon: disable VIOMMU support".
Although the virtio_balloon driver does not translate through a
VIOMMU (or bounce buffer) the pages that it sends to the device,
it *does* need to perform these translations on the virtio rings
themselves.
This fixes virtio_balloon initialisation inside a PKVM/ARM64
protected virtual machine.
Bug: 357781595
Change-Id: I2a84eec870fd638223b231e5c4d1c27216dc40a2
Signed-off-by: Keir Fraser <keirf@google.com>
The free-page reporting and hinting queues do not pass arrays of page
addresses (like the basic inflate queue) but instead pass the free page
ranges as buffers. This does not work well with DMA API: The host wants
to know the GPA, not an IOVA.
For these two virtqueues, disable DMA API and pass through buffers untranslated.
Change-Id: Ic08cf0e2aa092944bac0a6dfc8004c766a7eb3af
Bug: 357781595
Signed-off-by: Keir Fraser <keirf@google.com>
vp_modern_avq_cleanup() and vp_del_vqs() clean up admin vq
resources by virtio_pci_vq_info pointer. The info pointer of admin
vq is stored in vp_dev->admin_vq.info instead of vp_dev->vqs[].
Using the info pointer from vp_dev->vqs[] for admin vq causes a
kernel NULL pointer dereference bug.
In vp_modern_avq_cleanup() and vp_del_vqs(), get the info pointer
from vp_dev->admin_vq.info for admin vq to clean up the resources.
Also make info ptr as argument of vp_del_vq() to be symmetric with
vp_setup_vq().
vp_reset calls vp_modern_avq_cleanup, and causes the Call Trace:
==================================================================
BUG: kernel NULL pointer dereference, address:0000000000000000
...
CPU: 49 UID: 0 PID: 4439 Comm: modprobe Not tainted 6.11.0-rc5 #1
RIP: 0010:vp_reset+0x57/0x90 [virtio_pci]
Call Trace:
<TASK>
...
? vp_reset+0x57/0x90 [virtio_pci]
? vp_reset+0x38/0x90 [virtio_pci]
virtio_reset_device+0x1d/0x30
remove_vq_common+0x1c/0x1a0 [virtio_net]
virtnet_remove+0xa1/0xc0 [virtio_net]
virtio_dev_remove+0x46/0xa0
...
virtio_pci_driver_exit+0x14/0x810 [virtio_pci]
==================================================================
Fixes: 4c3b54af90 ("virtio_pci_modern: use completion instead of busy loop to wait on admin cmd result")
Signed-off-by: Feng Liu <feliu@nvidia.com>
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Reviewed-by: Parav Pandit <parav@nvidia.com>
Message-Id: <20241024135406.81388-1-feliu@nvidia.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Steps on the way to 6.12-rc2
Resolves merge conflicts in:
kernel/sched/core.c
Change-Id: Iba05a3f0bf149fd3f020ab8c90d6de92c20601cb
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Pull virtio fixes from Michael Tsirkin:
"Several small bugfixes all over the place.
Most notably, fixes the vsock allocation with GFP_KERNEL in atomic
context, which has been triggering warnings for lots of testers"
* tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost:
vhost/scsi: null-ptr-dereference in vhost_scsi_get_req()
vsock/virtio: use GFP_ATOMIC under RCU read lock
virtio_console: fix misc probe bugs
virtio_ring: tag event_triggered as racy for KCSAN
vdpa/octeon_ep: Fix format specifier for pointers in debug messages
Steps on the way to 6.12-rc1
Bug: 367265496
Change-Id: I0558de38f29cc97e194b80b6c6a79f67e9c0ebaa
Signed-off-by: Matthias Maennich <maennich@google.com>
Pull virtio updates from Michael Tsirkin:
"Several new features here:
- virtio-balloon supports new stats
- vdpa supports setting mac address
- vdpa/mlx5 suspend/resume as well as MKEY ops are now faster
- virtio_fs supports new sysfs entries for queue info
- virtio/vsock performance has been improved
And fixes, cleanups all over the place"
* tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: (34 commits)
vsock/virtio: avoid queuing packets when intermediate queue is empty
vsock/virtio: refactor virtio_transport_send_pkt_work
fw_cfg: Constify struct kobj_type
vdpa/mlx5: Postpone MR deletion
vdpa/mlx5: Introduce init/destroy for MR resources
vdpa/mlx5: Rename mr_mtx -> lock
vdpa/mlx5: Extract mr members in own resource struct
vdpa/mlx5: Rename function
vdpa/mlx5: Delete direct MKEYs in parallel
vdpa/mlx5: Create direct MKEYs in parallel
MAINTAINERS: add virtio-vsock driver in the VIRTIO CORE section
virtio_fs: add sysfs entries for queue information
virtio_fs: introduce virtio_fs_put_locked helper
vdpa: Remove unused declarations
vdpa/mlx5: Parallelize VQ suspend/resume for CVQ MQ command
vdpa/mlx5: Small improvement for change_num_qps()
vdpa/mlx5: Keep notifiers during suspend but ignore
vdpa/mlx5: Parallelize device resume
vdpa/mlx5: Parallelize device suspend
vdpa/mlx5: Use async API for vq modify commands
...
Setting event_triggered from the interrupt handler
is fundamentally racy. There are races of 2 types:
1. vq processing can read false value while interrupt
triggered and set it to true.
result will be a bit of extra work when disabling cbs, no big deal.
1. vq processing can set false value then interrupt
immediately sets true value
since interrupt then triggers a callback which will
process buffers, this is also not an issue.
However, looks like KCSAN can not figure all this out, and warns about
the race between the write and the read. Tag the access data_racy for
now. We should probably look at ways to make this more
straight-forwardly correct.
Message-ID: <6bdd771a4fb7625a9227971b3cf4745c34c31a32.1726153334.git.mst@redhat.com>
Reported-by: syzbot+8a02104389c2e0ef5049@syzkaller.appspotmail.com
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Acked-by: Marco Elver <elver@google.com>
Steps on the way to 6.12-rc1
Bug: 367265496
Change-Id: If192456da13095c7f71df3910d688439184e51cd
Signed-off-by: Matthias Maennich <maennich@google.com>
Expose memory scan/reclaim information to the host side via virtio
balloon device.
Now we have a metric to analyze the memory performance:
y: counter increases
n: counter does not changes
h: the rate of counter change is high
l: the rate of counter change is low
OOM: VIRTIO_BALLOON_S_OOM_KILL
STALL: VIRTIO_BALLOON_S_ALLOC_STALL
ASCAN: VIRTIO_BALLOON_S_SCAN_ASYNC
DSCAN: VIRTIO_BALLOON_S_SCAN_DIRECT
ARCLM: VIRTIO_BALLOON_S_RECLAIM_ASYNC
DRCLM: VIRTIO_BALLOON_S_RECLAIM_DIRECT
- OOM[y], STALL[*], ASCAN[*], DSCAN[*], ARCLM[*], DRCLM[*]:
the guest runs under really critial memory pressure
- OOM[n], STALL[h], ASCAN[*], DSCAN[l], ARCLM[*], DRCLM[l]:
the memory allocation stalls due to cgroup, not the global memory
pressure.
- OOM[n], STALL[h], ASCAN[*], DSCAN[h], ARCLM[*], DRCLM[h]:
the memory allocation stalls due to global memory pressure. The
performance gets hurt a lot. A high ratio between DRCLM/DSCAN shows
quite effective memory reclaiming.
- OOM[n], STALL[h], ASCAN[*], DSCAN[h], ARCLM[*], DRCLM[l]:
the memory allocation stalls due to global memory pressure.
the ratio between DRCLM/DSCAN gets low, the guest OS is thrashing
heavily, the serious case leads poor performance and difficult
trouble shooting. Ex, sshd may block on memory allocation when
accepting new connections, a user can't login a VM by ssh command.
- OOM[n], STALL[n], ASCAN[h], DSCAN[n], ARCLM[l], DRCLM[n]:
the low ratio between ARCLM/ASCAN shows that the guest tries to
reclaim more memory, but it can't. Once more memory is required in
future, it will struggle to reclaim memory.
Acked-by: David Hildenbrand <david@redhat.com>
Signed-off-by: zhenwei pi <pizhenwei@bytedance.com>
Message-Id: <20240423034109.1552866-5-pizhenwei@bytedance.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
When the guest OS runs under critical memory pressure, the guest
starts to kill processes. A guest monitor agent may scan 'oom_kill'
from /proc/vmstat, and reports the OOM KILL event. However, the agent
may be killed and we will loss this critical event(and the later
events).
For now we can also grep for magic words in guest kernel log from host
side. Rather than this unstable way, virtio balloon reports OOM-KILL
invocations instead.
Acked-by: David Hildenbrand <david@redhat.com>
Signed-off-by: zhenwei pi <pizhenwei@bytedance.com>
Message-Id: <20240423034109.1552866-3-pizhenwei@bytedance.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Sometime, it would be useful to disable the configure change
notification from the driver. So this patch allows this by introducing
a variable config_change_driver_disabled and only allow the configure
change notification callback to be triggered when it is allowed by
both the virtio core and the driver. It is set to false by default to
hold the current semantic so we don't need to change any drivers.
The first user for this would be virtio-net.
Cc: Venkat Venkatsubra <venkat.x.venkatsubra@oracle.com>
Cc: Gia-Khanh Nguyen <gia-khanh.nguyen@oracle.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Link: https://patch.msgid.link/20240814052228.4654-3-jasowang@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Greg Kroah-Hartman
Zhongqiu Han
Koichiro Den
Keir Fraser
Prakruthi Deepak Heragu
Darren Chang
Aleksei Vetrov
Feng Liu
Linus Torvalds
Matthias Maennich
Michael S. Tsirkin
zhenwei pi
Lee Jones
Jason Wang