This reverts commit c5474a7b04 which is
commit 96a30e469ca1d2b8cc7811b40911f8614b558241 upstream.
It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.
Bug: 161946584
Change-Id: I78f61af9b03cf393e287972cf3c2e092614e8014
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This reverts commit 4265682c29 which is
commit e2d2115e56c4a02377189bfc3a9a7933552a7b0f upstream.
It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.
Bug: 161946584
Change-Id: I1a833012ae4ccf639e468eedc82f6c1b93db87bc
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
GKI (arm64) relevant 35 out of 230 changes, affecting 67 files +612/-427
ec9be081c5 Revert "mmc: sdhci: Disable SD card clock before changing parameters" [1 file, +2/-7]
0698a2eb7d Bluetooth: HCI: Set extended advertising data synchronously [2 files, +130/-113]
3672fe9d1e Bluetooth: hci_sync: revert some mesh modifications [1 file, +4/-12]
44bb1e13b4 Bluetooth: MGMT: set_mesh: update LE scan interval and window [1 file, +22/-0]
a99f80c88a Bluetooth: MGMT: mesh_send: check instances prior disabling advertising [1 file, +2/-1]
5581e694d3 usb: typec: altmodes/displayport: do not index invalid pin_assignments [2 files, +2/-1]
b1abc5ab47 scsi: sd: Fix VPD page 0xb7 length check [1 file, +1/-1]
381c1c1219 Bluetooth: Prevent unintended pause by checking if advertising is active [1 file, +4/-0]
f0fee863a7 nvme: Fix incorrect cdw15 value in passthru error logging [1 file, +1/-1]
50c86c0945 netfs: Fix i_size updating [2 files, +8/-2]
a553afd91f net/sched: Always pass notifications when child class becomes empty [1 file, +5/-14]
d78f79a2c1 spinlock: extend guard with spinlock_bh variants [1 file, +13/-0]
0cc4721a71 sched/fair: Rename h_nr_running into h_nr_queued [5 files, +53/-53]
a2562bdd35 sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE [1 file, +11/-2]
5833026221 f2fs: decrease spare area for pinned files for zoned devices [3 files, +5/-2]
8912b139a8 f2fs: zone: fix to calculate first_zoned_segno correctly [4 files, +69/-20]
c5474a7b04 bpf: use common instruction history across all states [2 files, +63/-63]
4265682c29 bpf: Do not include stack ptr register in precision backtracking bookkeeping [2 files, +24/-6]
e0fefe9bc0 netfs: Fix oops in write-retry from mis-resetting the subreq iterator [1 file, +3/-2]
acf9ab15ec selinux: change security_compute_sid to return the ssid or tsid on match [1 file, +11/-5]
42c5a4b47d rcu: Return early if callback is not specified [1 file, +4/-0]
e036efbe58 add a string-to-qstr constructor [10 files, +13/-23]
f94c422157 fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass [3 files, +21/-13]
8caccd2eac usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed [1 file, +4/-1]
9f75893189 Revert "usb: xhci: Implement xhci_handshake_check_state() helper" [3 files, +3/-30]
fbebc2254a usb: xhci: quirk for data loss in ISOC transfers [3 files, +30/-0]
195597e0be xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS [1 file, +2/-1]
dbdd2a2320 Input: xpad - support Acer NGR 200 Controller [1 file, +2/-0]
3b1407caac usb: dwc3: Abort suspend on soft disconnect failure [2 files, +16/-15]
7cb8750160 usb: acpi: fix device link removal [3 files, +8/-1]
c745744a82 dma-buf: fix timeout handling in dma_resv_wait_timeout v2 [1 file, +7/-5]
ccdc472b4d Logitech C-270 even more broken [1 file, +2/-1]
c782f98eef usb: typec: displayport: Fix potential deadlock [1 file, +1/-2]
ead91de35d mm/vmalloc: fix data race in show_numa_info() [1 file, +35/-28]
4c443046d8 mm: userfaultfd: fix race of userfaultfd_move and swap cache [1 file, +31/-2]
Changes in 6.12.37
rtc: pcf2127: add missing semicolon after statement
rtc: pcf2127: fix SPI command byte for PCF2131
rtc: cmos: use spin_lock_irqsave in cmos_interrupt
virtio-net: xsk: rx: fix the frame's length check
virtio-net: ensure the received length does not exceed allocated size
s390/pci: Fix stale function handles in error handling
s390/pci: Do not try re-enabling load/store if device is disabled
net: txgbe: request MISC IRQ in ndo_open
vsock/vmci: Clear the vmci transport packet properly when initializing it
net: libwx: fix the incorrect display of the queue number
mmc: sdhci: Add a helper function for dump register in dynamic debug mode
Revert "mmc: sdhci: Disable SD card clock before changing parameters"
mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier
Bluetooth: HCI: Set extended advertising data synchronously
Bluetooth: hci_sync: revert some mesh modifications
Bluetooth: MGMT: set_mesh: update LE scan interval and window
Bluetooth: MGMT: mesh_send: check instances prior disabling advertising
iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes
regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods
Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt()
usb: typec: altmodes/displayport: do not index invalid pin_assignments
mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data
mtk-sd: Prevent memory corruption from DMA map failure
mtk-sd: reset host->mrq on prepare_data() error
drm/v3d: Disable interrupts before resetting the GPU
firmware: arm_ffa: Fix memory leak by freeing notifier callback node
firmware: arm_ffa: Move memory allocation outside the mutex locking
firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context
arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename
platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment
RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling
RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert
nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.
NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN
scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database()
scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu()
scsi: sd: Fix VPD page 0xb7 length check
scsi: ufs: core: Fix spelling of a sysfs attribute name
RDMA/mlx5: Fix HW counters query for non-representor devices
RDMA/mlx5: Fix CC counters query for MPV
RDMA/mlx5: Fix vport loopback for MPV device
platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1
platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message
Bluetooth: Prevent unintended pause by checking if advertising is active
btrfs: fix missing error handling when searching for inode refs during log replay
btrfs: fix iteration of extrefs during log replay
btrfs: return a btrfs_inode from btrfs_iget_logging()
btrfs: return a btrfs_inode from read_one_inode()
btrfs: fix invalid inode pointer dereferences during log replay
btrfs: fix inode lookup error handling during log replay
btrfs: record new subvolume in parent dir earlier to avoid dir logging races
btrfs: propagate last_unlink_trans earlier when doing a rmdir
btrfs: use btrfs_record_snapshot_destroy() during rmdir
ethernet: atl1: Add missing DMA mapping error checks and count errors
dpaa2-eth: fix xdp_rxq_info leak
drm/exynos: fimd: Guard display clock control with runtime PM calls
spi: spi-fsl-dspi: Clear completion counter before initiating transfer
drm/i915/selftests: Change mock_request() to return error pointers
nvme: Fix incorrect cdw15 value in passthru error logging
nvmet: fix memory leak of bio integrity
platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks
platform/x86: hp-bioscfg: Directly use firmware_attributes_class
platform/x86: hp-bioscfg: Fix class device unregistration
platform/x86: firmware_attributes_class: Move include linux/device/class.h
platform/x86: firmware_attributes_class: Simplify API
platform/x86: think-lmi: Directly use firmware_attributes_class
platform/x86: think-lmi: Fix class device unregistration
platform/x86: dell-sysman: Directly use firmware_attributes_class
platform/x86: dell-wmi-sysman: Fix class device unregistration
platform/mellanox: mlxreg-lc: Fix logic error in power state check
drm/bridge: aux-hpd-bridge: fix assignment of the of_node
smb: client: fix warning when reconnecting channel
net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect
drm/i915/gt: Fix timeline left held on VMA alloc error
drm/i915/gsc: mei interrupt top half should be in irq disabled context
idpf: return 0 size for RSS key if not supported
idpf: convert control queue mutex to a spinlock
igc: disable L1.2 PCI-E link substate to avoid performance issue
smb: client: set missing retry flag in smb2_writev_callback()
smb: client: set missing retry flag in cifs_readv_callback()
smb: client: set missing retry flag in cifs_writev_callback()
netfs: Fix i_size updating
lib: test_objagg: Set error message in check_expect_hints_stats()
amd-xgbe: align CL37 AN sequence as per databook
enic: fix incorrect MTU comparison in enic_change_mtu()
rose: fix dangling neighbour pointers in rose_rt_device_down()
nui: Fix dma_mapping_error() check
net/sched: Always pass notifications when child class becomes empty
amd-xgbe: do not double read link status
smb: client: fix race condition in negotiate timeout by using more precise timing
arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma
crypto: iaa - Remove dst_null support
crypto: iaa - Do not clobber req->base.data
spinlock: extend guard with spinlock_bh variants
crypto: zynqmp-sha - Add locking
kunit: qemu_configs: sparc: use Zilog console
kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y
kunit: qemu_configs: Disable faulting tests on 32-bit SPARC
gfs2: Initialize gl_no_formal_ino earlier
gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE
gfs2: Rename dinode_demise to evict_behavior
gfs2: Prevent inode creation race
gfs2: Decode missing glock flags in tracepoints
gfs2: Add GLF_PENDING_REPLY flag
gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE
gfs2: Move gfs2_dinode_dealloc
gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc
gfs2: deallocate inodes in gfs2_create_inode
btrfs: prepare btrfs_page_mkwrite() for large folios
btrfs: fix wrong start offset for delalloc space release during mmap write
sched/fair: Rename h_nr_running into h_nr_queued
sched/fair: Add new cfs_rq.h_nr_runnable
sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE
gfs2: Move gfs2_trans_add_databufs
gfs2: Don't start unnecessary transactions during log flush
ASoC: tas2764: Extend driver to SN012776
ASoC: tas2764: Reinit cache on part reset
ACPI: thermal: Fix stale comment regarding trip points
ACPI: thermal: Execute _SCP before reading trip points
bonding: Mark active offloaded xfrm_states
wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path
wifi: ath12k: Handle error cases during extended skb allocation
wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers
RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug
iommu: ipmmu-vmsa: avoid Wformat-security warning
f2fs: decrease spare area for pinned files for zoned devices
f2fs: zone: introduce first_zoned_segno in f2fs_sb_info
f2fs: zone: fix to calculate first_zoned_segno correctly
scsi: lpfc: Remove NLP_RELEASE_RPI flag from nodelist structure
scsi: lpfc: Change lpfc_nodelist nlp_flag member into a bitmask
scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk
hisi_acc_vfio_pci: bugfix cache write-back issue
hisi_acc_vfio_pci: bugfix the problem of uninstalling driver
bpf: use common instruction history across all states
bpf: Do not include stack ptr register in precision backtracking bookkeeping
arm64: dts: qcom: sm8650: change labels to lower-case
arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2
arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs
arm64: dts: renesas: Factor out White Hawk Single board support
arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description
arm64: dts: qcom: sm8650: add the missing l2 cache node
ubsan: integer-overflow: depend on BROKEN to keep this out of CI
remoteproc: k3: Call of_node_put(rmem_np) only once in three functions
remoteproc: k3-r5: Add devm action to release reserved memory
remoteproc: k3-r5: Use devm_kcalloc() helper
remoteproc: k3-r5: Use devm_ioremap_wc() helper
remoteproc: k3-r5: Use devm_rproc_add() helper
remoteproc: k3-r5: Refactor sequential core power up/down operations
netfs: Fix oops in write-retry from mis-resetting the subreq iterator
mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe()
drm/xe: Fix DSB buffer coherency
drm/xe: Move DSB l2 flush to a more sensible place
drm/xe: add interface to request physical alignment for buffer objects
drm/xe: Allow bo mapping on multiple ggtts
drm/xe: move DPT l2 flush to a more sensible place
drm/xe: Replace double space with single space after comma
drm/xe/guc: Dead CT helper
drm/xe/guc: Explicitly exit CT safe mode on unwind
selinux: change security_compute_sid to return the ssid or tsid on match
drm/simpledrm: Do not upcast in release helpers
drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause
drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read
drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13
drm/amd/display: Add more checks for DSC / HUBP ONO guarantees
arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on
drm/amdgpu/mes: add missing locking in helper functions
sched_ext: Make scx_group_set_weight() always update tg->scx.weight
scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp->nlp_flag
drm/msm: Fix a fence leak in submit error path
drm/msm: Fix another leak in the submit error path
ALSA: sb: Don't allow changing the DMA mode during operations
ALSA: sb: Force to disable DMAs once when DMA mode is changed
ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled
ata: pata_cs5536: fix build on 32-bit UML
ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic
platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list
genirq/irq_sim: Initialize work context pointers properly
powerpc: Fix struct termio related ioctl macros
ASoC: amd: yc: update quirk data for HP Victus
regulator: fan53555: add enable_time support and soft-start times
scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()
aoe: defer rexmit timer downdev work to workqueue
wifi: mac80211: drop invalid source address OCB frames
wifi: ath6kl: remove WARN on bad firmware input
ACPICA: Refuse to evaluate a method if arguments are missing
mtd: spinand: fix memory leak of ECC engine conf
rcu: Return early if callback is not specified
add a string-to-qstr constructor
module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper
fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass
RDMA/mlx5: Fix cache entry update on dereg error
IB/mlx5: Fix potential deadlock in MR deregistration
drm/xe/bmg: Update Wa_22019338487
drm/xe: Allow dropping kunit dependency as built-in
NFSv4/flexfiles: Fix handling of NFS level errors in I/O
usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed
Revert "usb: xhci: Implement xhci_handshake_check_state() helper"
usb: xhci: quirk for data loss in ISOC transfers
xhci: dbctty: disable ECHO flag by default
xhci: dbc: Flush queued requests before stopping dbc
xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS
Input: xpad - support Acer NGR 200 Controller
Input: iqs7222 - explicitly define number of external channels
usb: cdnsp: do not disable slot for disabled slot
usb: cdnsp: Fix issue with CV Bad Descriptor test
usb: dwc3: Abort suspend on soft disconnect failure
usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume
usb: acpi: fix device link removal
smb: client: fix readdir returning wrong type with POSIX extensions
cifs: all initializations for tcon should happen in tcon_info_alloc
dma-buf: fix timeout handling in dma_resv_wait_timeout v2
i2c/designware: Fix an initialization issue
Logitech C-270 even more broken
optee: ffa: fix sleep in atomic context
iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU
powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed
riscv: cpu_ops_sbi: Use static array for boot_data
platform/x86: think-lmi: Create ksets consecutively
platform/x86: think-lmi: Fix kobject cleanup
platform/x86: think-lmi: Fix sysfs group cleanup
usb: typec: displayport: Fix potential deadlock
powerpc/kernel: Fix ppc_save_regs inclusion in build
mm/vmalloc: fix data race in show_numa_info()
mm: userfaultfd: fix race of userfaultfd_move and swap cache
x86/bugs: Rename MDS machinery to something more generic
x86/bugs: Add a Transient Scheduler Attacks mitigation
KVM: SVM: Advertise TSA CPUID bits to guests
x86/microcode/AMD: Add TSA microcode SHAs
x86/process: Move the buffer clearing before MONITOR
Linux 6.12.37
Change-Id: If1d8d0f83e11df1540bebaf0fb136fe340f25dcb
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
GKI (arm64) relevant 87 out of 414 changes, affecting 112 files +738/-352
bdb71ee651 configfs: Do not override creating attribute file failure in populate_attrs() [1 file, +1/-1]
ba789be63d io_uring: account drain memory to cgroup [1 file, +1/-1]
c58b577cf7 io_uring/kbuf: account ring io_buffer_list memory [1 file, +1/-1]
f78b38af35 jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() [1 file, +3/-2]
2429bb9fad media: v4l2-dev: fix error handling in __video_register_device() [1 file, +7/-7]
5d8b057ed7 media: videobuf2: use sgtable-based scatterlist wrappers [1 file, +2/-2]
b52dc88361 media: uvcvideo: Return the number of processed controls [1 file, +10/-1]
6d2b12e7c5 media: uvcvideo: Send control events for partial succeeds [1 file, +9/-3]
aac91ae06c media: uvcvideo: Fix deferred probing error [1 file, +19/-8]
86d9837e46 arm64/mm: Close theoretical race where stale TLB entry remains valid [1 file, +5/-4]
5538af3843 block: use plug request list tail for one-shot backmerge attempt [1 file, +13/-13]
943801c380 block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion [1 file, +1/-0]
1c71f3cf5f cgroup,freezer: fix incomplete freezing when attaching tasks [1 file, +1/-2]
a0890b7805 bus: firewall: Fix missing static inline annotations for stubs [1 file, +9/-6]
5766da2237 ext4: inline: fix len overflow in ext4_prepare_inline_data [1 file, +1/-1]
796632e6f8 ext4: fix calculation of credits for extent tree modification [1 file, +6/-5]
4b36399711 ext4: ensure i_size is smaller than maxbytes [1 file, +2/-1]
be5f3061a6 ext4: only dirty folios when data journaling regular files [1 file, +6/-1]
a0b1c91ada Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer() [1 file, +2/-0]
fed611bd8c f2fs: fix to do sanity check on ino and xnid [1 file, +6/-0]
aaa644e7ff f2fs: prevent kernel warning due to negative i_nlink from corrupted image [1 file, +9/-0]
ee1b421c46 f2fs: fix to do sanity check on sit_bitmap_size [1 file, +8/-0]
f16a797dce watchdog: fix watchdog may detect false positive of softlockup [1 file, +27/-14]
02137179ff mm: fix ratelimit_pages update error in dirty_ratio_handler() [1 file, +1/-1]
462eee6d42 firmware: arm_scmi: Ensure that the message-id supports fastchannel [2 files, +45/-33]
e3cf1ef571 dm-verity: fix a memory leak if some arguments are specified multiple times [3 files, +24/-5]
f2986bccf2 dm: lock limits when reading them [1 file, +7/-1]
ec5f0b4412 ovl: Fix nested backing file paths [1 file, +2/-2]
92776ca0cc remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() [1 file, +2/-3]
f4ef928ca5 remoteproc: core: Release rproc->clean_table after rproc_attach() fails [1 file, +1/-0]
68e58f5791 PCI: dwc: ep: Correct PBA offset in .set_msix() callback [1 file, +3/-2]
b20701d594 PCI: Add ACS quirk for Loongson PCIe [1 file, +23/-0]
be0cf75cbd PCI: Fix lock symmetry in pci_slot_unlock() [1 file, +2/-1]
7b45d2401d clocksource: Fix the CPUs' choice in the watchdog per CPU verification [1 file, +1/-1]
c05aba32a9 ACPICA: Avoid sequence overread in call to strncmp() [1 file, +1/-1]
66613b13cd ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case [1 file, +8/-1]
33cd650d38 pmdomain: core: Reset genpd->states to avoid freeing invalid data [1 file, +3/-1]
f34e0c1556 platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all() [1 file, +1/-0]
c519f81e9c gpiolib: of: Add polarity quirk for s5m8767 [1 file, +9/-0]
1f152ae557 PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() [1 file, +1/-1]
6c1151d53c tipc: use kfree_sensitive() for aead cleanup [1 file, +1/-1]
b0e647442c f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx [2 files, +15/-13]
2d834477bb bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() [1 file, +2/-1]
77ff6aec7c cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs [1 file, +35/-1]
0a8446058c tcp: always seek for minimal rtt in tcp_rcv_rtt_update() [1 file, +8/-14]
f97085d365 tcp: remove zero TCP TS samples for autotuning [1 file, +5/-5]
89b20c406e tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows [1 file, +3/-3]
84c156a351 tcp: add receive queue awareness in tcp_rcv_space_adjust() [2 files, +5/-3]
3a9e74d158 ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT [1 file, +4/-0]
5eb9c50e0c net: page_pool: Don't recycle into cache on PREEMPT_RT [1 file, +4/-0]
8b0741b167 xfrm: validate assignment of maximal possible SEQ number [1 file, +42/-10]
8fdf2f79eb bpf: Pass the same orig_call value to trampoline functions [1 file, +1/-1]
f0023d7a2a f2fs: fix to bail out in get_new_segment() [2 files, +6/-1]
448dc45eea bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index [1 file, +2/-2]
78f768e36c net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions [1 file, +69/-8]
4b3383110b software node: Correct a OOB check in software_node_get_reference_args() [1 file, +1/-1]
b7129ef57d sock: Correct error checking condition for (assign|release)_proto_idx() [1 file, +2/-2]
a58f0a0e99 f2fs: fix to set atomic write status more clear [3 files, +12/-2]
b8b4b8bb34 bpf, sockmap: Fix data lost during EAGAIN retries [1 file, +2/-1]
7c41f73b64 fs/xattr.c: fix simple_xattr_list() [1 file, +1/-0]
2e10dc9c2a io_uring/kbuf: don't truncate end buffer for multiple buffer peeks [1 file, +4/-1]
1a4254ab06 io_uring: fix task leak issue in io_wq_create() [1 file, +3/-1]
4220cc0b98 nvme: always punt polled uring_cmd end_io work to task_work [1 file, +7/-14]
f9b97d466e net_sched: sch_sfq: reject invalid perturb period [1 file, +8/-2]
2a3ad42a57 net: clear the dst when changing skb protocol [1 file, +13/-6]
510a29d776 mm: close theoretical race where stale TLB entries could linger [1 file, +2/-0]
57ec081869 sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() [3 files, +9/-2]
3d828519bd atm: Revert atm_account_tx() if copy_from_iter_full() fails. [3 files, +8/-1]
47f34289d1 arm64: Restrict pagetable teardown to avoid false warning [1 file, +2/-1]
9cf5b2a3b7 mm/hugetlb: unshare page tables during VMA split, not before [5 files, +57/-16]
dc5f0aef9e net: Fix checksum update for ILA adj-transport [4 files, +7/-7]
2516299184 bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE [3 files, +7/-2]
50189d9c5e erofs: remove unused trace event erofs_destroy_inode [1 file, +0/-18]
348e541fef ipv6: remove leftover ip6 cookie initializer [1 file, +0/-2]
3c44ebad5a ipv6: replace ipcm6_init calls with ipcm6_init_sk [4 files, +3/-29]
6b358b3adf io_uring/sqpoll: don't put task_struct on tctx setup failure [1 file, +1/-4]
8873080b88 workqueue: Initialize wq_isolated_cpumask in workqueue_init_early() [1 file, +2/-1]
ac462a75fd net: netmem: fix skb_ensure_writable with unreadable skbs [1 file, +0/-3]
61b39e189d ptp: allow reading of currently dialed frequency to succeed on free-running clocks [1 file, +2/-1]
397c1faf8f tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior [1 file, +25/-12]
0d3d91c350 tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer [1 file, +2/-2]
31d50dfe9c tcp: fix passive TFO socket having invalid NAPI ID [1 file, +3/-0]
0f8df5d6f2 ublk: santizize the arguments from userspace when adding a device [1 file, +3/-0]
456019adaa perf: Fix sample vs do_exit() [2 files, +16/-8]
7335c33d62 perf: Fix cgroup state vs ERROR [1 file, +30/-21]
fd199366bf perf/core: Fix WARN in perf_cgroup_switch() [1 file, +20/-2]
22f935bc86 arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() [1 file, +1/-1]
Changes in 6.12.35
configfs: Do not override creating attribute file failure in populate_attrs()
crypto: marvell/cesa - Do not chain submitted requests
gfs2: move msleep to sleepable context
crypto: qat - add shutdown handler to qat_c3xxx
crypto: qat - add shutdown handler to qat_420xx
crypto: qat - add shutdown handler to qat_4xxx
crypto: qat - add shutdown handler to qat_c62x
crypto: qat - add shutdown handler to qat_dh895xcc
ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params()
ASoC: meson: meson-card-utils: use of_property_present() for DT parsing
ASoC: amd: sof_amd_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks()
io_uring: account drain memory to cgroup
io_uring/kbuf: account ring io_buffer_list memory
powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states
s390/pci: Remove redundant bus removal and disable from zpci_release_device()
s390/pci: Prevent self deletion in disable_slot()
s390/pci: Allow re-add of a reserved but not yet removed device
s390/pci: Serialize device addition and removal
regulator: max20086: Fix MAX200086 chip id
regulator: max20086: Change enable gpio to optional
net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr()
net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid()
wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()
wifi: mt76: mt7925: fix host interrupt register initialization
wifi: ath11k: fix rx completion meta data corruption
wifi: rtw88: usb: Upload the firmware in bigger chunks
wifi: ath11k: fix ring-buffer corruption
NFSD: unregister filesystem in case genl_register_family() fails
NFSD: fix race between nfsd registration and exports_proc
NFSD: Implement FATTR4_CLONE_BLKSIZE attribute
nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request
nfsd: Initialize ssc before laundromat_work to prevent NULL dereference
SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls
NFSv4: Don't check for OPEN feature support in v4.1
fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio()
wifi: ath12k: fix ring-buffer corruption
jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
svcrdma: Unregister the device if svc_rdma_accept() fails
wifi: rtw88: usb: Reduce control message timeout to 500 ms
wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723
media: ov8856: suppress probe deferral errors
media: ov5675: suppress probe deferral errors
media: imx335: Use correct register width for HNUM
media: nxp: imx8-isi: better handle the m2m usage_count
media: i2c: ds90ub913: Fix returned fmt from .set_fmt()
media: ccs-pll: Start VT pre-PLL multiplier search from correct value
media: ov2740: Move pm-runtime cleanup on probe-errors to proper place
media: ccs-pll: Start OP pre-PLL multiplier search from correct value
media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div
media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case
media: cxusb: no longer judge rbuf when the write fails
media: davinci: vpif: Fix memory leak in probe error path
media: gspca: Add error handling for stv06xx_read_sensor()
media: i2c: imx335: Fix frame size enumeration
media: imagination: fix a potential memory leak in e5010_probe()
media: intel/ipu6: Fix dma mask for non-secure mode
media: ipu6: Remove workaround for Meteor Lake ES2
media: mediatek: vcodec: Correct vsi_core framebuffer size
media: omap3isp: use sgtable-based scatterlist wrappers
media: v4l2-dev: fix error handling in __video_register_device()
media: venus: Fix probe error handling
media: videobuf2: use sgtable-based scatterlist wrappers
media: vidtv: Terminating the subsequent process of initialization failure
media: vivid: Change the siize of the composing
media: imx-jpeg: Drop the first error frames
media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead
media: imx-jpeg: Reset slot data pointers when freed
media: imx-jpeg: Cleanup after an allocation error
media: uvcvideo: Return the number of processed controls
media: uvcvideo: Send control events for partial succeeds
media: uvcvideo: Fix deferred probing error
arm64/mm: Close theoretical race where stale TLB entry remains valid
ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap()
ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4
ASoC: codecs: wcd9375: Fix double free of regulator supplies
ASoC: codecs: wcd937x: Drop unused buck_supply
block: use plug request list tail for one-shot backmerge attempt
block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion
bus: mhi: ep: Update read pointer only after buffer is written
bus: mhi: host: Fix conflict between power_up and SYSERR
can: kvaser_pciefd: refine error prone echo_skb_max handling logic
can: tcan4x5x: fix power regulator retrieval during probe
ceph: avoid kernel BUG for encrypted inode with unaligned file size
ceph: set superblock s_magic for IMA fsmagic matching
cgroup,freezer: fix incomplete freezing when attaching tasks
bus: firewall: Fix missing static inline annotations for stubs
ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330
ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard
ata: ahci: Disallow LPM for Asus B550-F motherboard
bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device
bus: fsl-mc: fix GET/SET_TAILDROP command ids
ext4: inline: fix len overflow in ext4_prepare_inline_data
ext4: fix calculation of credits for extent tree modification
ext4: factor out ext4_get_maxbytes()
ext4: ensure i_size is smaller than maxbytes
ext4: only dirty folios when data journaling regular files
Input: ims-pcu - check record size in ims_pcu_flash_firmware()
Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer()
f2fs: fix to do sanity check on ino and xnid
f2fs: prevent kernel warning due to negative i_nlink from corrupted image
f2fs: fix to do sanity check on sit_bitmap_size
hwmon: (ftsteutates) Fix TOCTOU race in fts_read()
NFC: nci: uart: Set tty->disc_data only in success path
net/sched: fix use-after-free in taprio_dev_notifier
net: ftgmac100: select FIXED_PHY
iommu/vt-d: Restore context entry setup order for aliased devices
fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var
EDAC/altera: Use correct write width with the INTTEST register
fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var
parisc/unaligned: Fix hex output to show 8 hex chars
vgacon: Add check for vc_origin address range in vgacon_scroll()
parisc: fix building with gcc-15
clk: meson-g12a: add missing fclk_div2 to spicc
ipc: fix to protect IPCS lookups using RCU
watchdog: fix watchdog may detect false positive of softlockup
RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction
mm: fix ratelimit_pages update error in dirty_ratio_handler()
soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events
configfs-tsm-report: Fix NULL dereference of tsm_ops
firmware: arm_scmi: Ensure that the message-id supports fastchannel
mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk
mtd: nand: sunxi: Add randomizer configuration before randomizer enable
KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs
KVM: VMX: Flush shadow VMCS on emergency reboot
dm-mirror: fix a tiny race condition
dm-verity: fix a memory leak if some arguments are specified multiple times
mtd: rawnand: qcom: Fix read len for onfi param page
ftrace: Fix UAF when lookup kallsym after ftrace disabled
dm: lock limits when reading them
phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property()
net: ch9200: fix uninitialised access during mii_nway_restart
KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY
sysfb: Fix screen_info type check for VGA
video: screen_info: Relocate framebuffers behind PCI bridges
pwm: axi-pwmgen: fix missing separate external clock
staging: iio: ad5933: Correct settling cycles encoding per datasheet
mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS
ovl: Fix nested backing file paths
regulator: max14577: Add error check for max14577_read_reg()
remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach()
remoteproc: core: Release rproc->clean_table after rproc_attach() fails
remoteproc: k3-m4: Don't assert reset in detach routine
cifs: reset connections for all channels when reconnect requested
cifs: update dstaddr whenever channel iface is updated
cifs: dns resolution is needed only for primary channel
smb: client: add NULL check in automount_fullpath
Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary
uio_hv_generic: Use correct size for interrupt and monitor pages
uio_hv_generic: Align ring size to system page
PCI: cadence-ep: Correct PBA offset in .set_msix() callback
PCI: dwc: ep: Correct PBA offset in .set_msix() callback
PCI: Add ACS quirk for Loongson PCIe
PCI: Fix lock symmetry in pci_slot_unlock()
PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from rockchip_pcie_link_up()
PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit()
iio: accel: fxls8962af: Fix temperature scan element sign
accel/ivpu: Improve buffer object logging
accel/ivpu: Use firmware names from upstream repo
accel/ivpu: Use dma_resv_lock() instead of a custom mutex
accel/ivpu: Fix warning in ivpu_gem_bo_free()
dummycon: Trigger redraw when switching consoles with deferred takeover
mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
iio: imu: inv_icm42600: Fix temperature calculation
iio: adc: ad7944: mask high bits on direct read
iio: adc: ti-ads1298: Kconfig: add kfifo dependency to fix module build
iio: adc: ad7606_spi: fix reg write value mask
ACPICA: fix acpi operand cache leak in dswstate.c
ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9
clocksource: Fix the CPUs' choice in the watchdog per CPU verification
power: supply: collie: Fix wakeup source leaks on device unbind
mmc: Add quirk to disable DDR50 tuning
ACPICA: Avoid sequence overread in call to strncmp()
ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change
ASoC: intel/sdw_utils: Assign initial value in asoc_sdw_rt_amp_spk_rtd_init()
ACPI: bus: Bail out if acpi_kobj registration fails
ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case
ACPICA: fix acpi parse and parseext cache leaks
ACPICA: Apply pack(1) to union aml_resource
ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios laptops
power: supply: bq27xxx: Retrieve again when busy
pmdomain: core: Reset genpd->states to avoid freeing invalid data
ACPICA: utilities: Fix overflow check in vsnprintf()
platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all()
ASoC: tegra210_ahub: Add check to of_device_get_match_data()
Make 'cc-option' work correctly for the -Wno-xyzzy pattern
gpiolib: of: Add polarity quirk for s5m8767
PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn()
power: supply: max17040: adjust thermal channel scaling
ACPI: battery: negate current when discharging
net: macb: Check return value of dma_set_mask_and_coherent()
net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices
tipc: use kfree_sensitive() for aead cleanup
f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx
bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()
Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922
i2c: designware: Invoke runtime suspend on quick slave re-registration
wifi: mt76: mt7996: drop fragments with multicast or broadcast RA
emulex/benet: correct command version selection in be_cmd_get_stats()
Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925
wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R
wifi: mt76: mt7921: add 160 MHz AP for mt7922 device
wifi: mt76: mt7925: introduce thermal protection
wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO
sctp: Do not wake readers in __sctp_write_space()
libbpf/btf: Fix string handling to support multi-split BTF
cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs
i2c: tegra: check msg length in SMBUS block read
i2c: npcm: Add clock toggle recovery
clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks
net: dlink: add synchronization for stats update
wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET
wifi: ath12k: fix a possible dead lock caused by ab->base_lock
wifi: ath11k: Fix QMI memory reuse logic
iommu/amd: Allow matching ACPI HID devices without matching UIDs
wifi: rtw89: leave idle mode when setting WEP encryption for AP mode
tcp: always seek for minimal rtt in tcp_rcv_rtt_update()
tcp: remove zero TCP TS samples for autotuning
tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows
tcp: add receive queue awareness in tcp_rcv_space_adjust()
x86/sgx: Prevent attempts to reclaim poisoned pages
ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT
net: page_pool: Don't recycle into cache on PREEMPT_RT
xfrm: validate assignment of maximal possible SEQ number
net: atlantic: generate software timestamp just before the doorbell
pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name()
pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction()
bpf: Pass the same orig_call value to trampoline functions
net: stmmac: generate software timestamp just before the doorbell
pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction()
libbpf: Check bpf_map_skeleton link for NULL
pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()
net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info
net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi
wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn()
wifi: mac80211: do not offer a mesh path if forwarding is disabled
clk: rockchip: rk3036: mark ddrphy as critical
hid-asus: check ROG Ally MCU version and warn
wifi: iwlwifi: mvm: fix beacon CCK flag
f2fs: fix to bail out in get_new_segment()
netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX
libbpf: Add identical pointer detection to btf_dedup_is_equiv()
scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands
scsi: smartpqi: Add new PCI IDs
iommu/amd: Ensure GA log notifier callbacks finish running before module unload
wifi: iwlwifi: pcie: make sure to lock rxq->read
wifi: rtw89: 8922a: fix TX fail with wrong VCO setting
wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled
netdevsim: Mark NAPI ID on skb in nsim_rcv
net/mlx5: HWS, Fix IP version decision
bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index
wifi: mac80211: VLAN traffic in multicast path
Revert "mac80211: Dynamically set CoDel parameters per station"
wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0
net: bridge: mcast: update multicast contex when vlan state is changed
net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions
vxlan: Do not treat dst cache initialization errors as fatal
bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp
wifi: ath12k: using msdu end descriptor to check for rx multicast packets
net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER
software node: Correct a OOB check in software_node_get_reference_args()
isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry
pinctrl: mcp23s08: Reset all pins to input at probe
wifi: ath12k: fix failed to set mhi state error during reboot with hardware grouping
scsi: lpfc: Use memcpy() for BIOS version
sock: Correct error checking condition for (assign|release)_proto_idx()
i40e: fix MMIO write access to an invalid page in i40e_clear_hw
ixgbe: Fix unreachable retry logic in combined and byte I2C write functions
RDMA/hns: initialize db in update_srq_db()
ice: fix check for existing switch rule
usbnet: asix AX88772: leave the carrier control to phylink
f2fs: fix to set atomic write status more clear
bpf, sockmap: Fix data lost during EAGAIN retries
net: ethernet: cortina: Use TOE/TSO on all TCP
octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer()
wifi: ath11k: determine PM policy based on machine model
wifi: ath12k: fix link valid field initialization in the monitor Rx
wifi: ath12k: fix incorrect CE addresses
wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160 MHz
net/mlx5: HWS, Harden IP version definer checks
fbcon: Make sure modelist not set on unregistered console
watchdog: da9052_wdt: respect TWDMIN
bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value
ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY
tee: Prevent size calculation wraparound on 32-bit kernels
Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first"
fs/xattr.c: fix simple_xattr_list()
platform/x86/amd: pmc: Clear metrics table at start of cycle
platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice
platform/x86: dell_rbu: Fix list usage
platform/x86: dell_rbu: Stop overwriting data buffer
powerpc/vdso: Fix build of VDSO32 with pcrel
powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery
io_uring/kbuf: don't truncate end buffer for multiple buffer peeks
io_uring: fix task leak issue in io_wq_create()
drivers/rapidio/rio_cm.c: prevent possible heap overwrite
platform/loongarch: laptop: Get brightness setting from EC on probe
platform/loongarch: laptop: Unregister generic_sub_drivers on exit
platform/loongarch: laptop: Add backlight power control support
LoongArch: vDSO: Correctly use asm parameters in syscall wrappers
LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg
LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset()
jffs2: check that raw node were preallocated before writing summary
jffs2: check jffs2_prealloc_raw_node_refs() result in few other places
cifs: deal with the channel loading lag while picking channels
cifs: serialize other channels when query server interfaces is pending
cifs: do not disable interface polling on failure
smb: improve directory cache reuse for readdir operations
scsi: storvsc: Increase the timeouts to storvsc_timeout
scsi: s390: zfcp: Ensure synchronous unit_add
nvme: always punt polled uring_cmd end_io work to task_work
net_sched: sch_sfq: reject invalid perturb period
net: clear the dst when changing skb protocol
mm: close theoretical race where stale TLB entries could linger
udmabuf: use sgtable-based scatterlist wrappers
x86/virt/tdx: Avoid indirect calls to TDX assembly functions
selftests/x86: Add a test to detect infinite SIGTRAP handler loop
ksmbd: fix null pointer dereference in destroy_previous_session
platform/x86: ideapad-laptop: use usleep_range() for EC polling
selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len
platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL
sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group()
atm: Revert atm_account_tx() if copy_from_iter_full() fails.
wifi: rtw89: phy: add dummy C2H event handler for report of TAS power
cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update
Input: sparcspkr - avoid unannotated fall-through
wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path
wifi: cfg80211: init wiphy_work before allocating rfkill fails
arm64: Restrict pagetable teardown to avoid false warning
ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card
ALSA: hda/intel: Add Thinkpad E15 to PM deny list
ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP Victus 15-fa1xxx
ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged
ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X513EA
ALSA: hda/realtek: Add quirk for Asus GU605C
iio: accel: fxls8962af: Fix temperature calculation
mm/hugetlb: unshare page tables during VMA split, not before
drm/amdgpu: read back register after written for VCN v4.0.5
kbuild: rust: add rustc-min-version support function
rust: compile libcore with edition 2024 for 1.87+
net: Fix checksum update for ILA adj-transport
bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE
erofs: remove unused trace event erofs_destroy_inode
nfsd: use threads array as-is in netlink interface
sunrpc: handle SVC_GARBAGE during svc auth processing as auth error
drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()`
Kunit to check the longest symbol length
x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c
ipv6: remove leftover ip6 cookie initializer
ipv6: replace ipcm6_init calls with ipcm6_init_sk
smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels
drm/msm/disp: Correct porch timing for SDM845
drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate
drm/msm: Fix CP_RESET_CONTEXT_STATE bitfield names
drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE
drm/ssd130x: fix ssd132x_clear_screen() columns
ionic: Prevent driver/fw getting out of sync on devcmd(s)
drm/nouveau/bl: increase buffer size to avoid truncate warning
drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled
hwmon: (occ) Rework attribute registration for stack usage
hwmon: (occ) fix unaligned accesses
hwmon: (ltc4282) avoid repeated register write
pldmfw: Select CRC32 when PLDMFW is selected
aoe: clean device rq_list in aoedev_downdev()
io_uring/sqpoll: don't put task_struct on tctx setup failure
net: ice: Perform accurate aRFS flow match
ice: fix eswitch code memory leak in reset scenario
e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13
workqueue: Initialize wq_isolated_cpumask in workqueue_init_early()
ksmbd: add free_transport ops in ksmbd connection
net: netmem: fix skb_ensure_writable with unreadable skbs
bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start()
eth: bnxt: fix out-of-range access of vnic_info array
bnxt_en: Add a helper function to configure MRU and RSS
bnxt_en: Update MRU and RSS table of RSS contexts on queue reset
ptp: fix breakage after ptp_vclock_in_use() rework
ptp: allow reading of currently dialed frequency to succeed on free-running clocks
wifi: carl9170: do not ping device which has failed to load firmware
mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
atm: atmtcp: Free invalid length skb in atmtcp_c_send().
tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior
tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
tcp: fix passive TFO socket having invalid NAPI ID
eth: fbnic: avoid double free when failing to DMA-map FW msg
net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get()
ublk: santizize the arguments from userspace when adding a device
drm/xe: Wire up device shutdown handler
drm/xe/gt: Update handling of xe_force_wake_get return
drm/xe/bmg: Update Wa_16023588340
calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available
net: atm: add lec_mutex
net: atm: fix /proc/net/atm/lec handling
EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh
dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties
smb: Log an error when close_all_cached_dirs fails
serial: sh-sci: Clean sci_ports[0] after at earlycon exit
serial: sh-sci: Increment the runtime usage counter for the earlycon device
smb: client: fix first command failure during re-negotiation
smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma()
s390/pci: Fix __pcilg_mio_inuser() inline assembly
perf: Fix sample vs do_exit()
perf: Fix cgroup state vs ERROR
perf/core: Fix WARN in perf_cgroup_switch()
arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()
scsi: elx: efct: Fix memory leak in efct_hw_parse_filter()
RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls
RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs
gpio: pca953x: fix wrong error probe return value
perf evsel: Missed close() when probing hybrid core PMUs
perf test: Directory file descriptor leak
gpio: mlxbf3: only get IRQ for device instance 0
cifs: Remove duplicate fattr->cf_dtype assignment from wsl_to_fattr() function
bpftool: Fix cgroup command to only show cgroup bpf programs
Linux 6.12.35
Change-Id: Ida57d269272a624bedb979bfad0b3c5e7df7e846
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit 96a30e469ca1d2b8cc7811b40911f8614b558241 ]
Instead of allocating and copying instruction history each time we
enqueue child verifier state, switch to a model where we use one common
dynamically sized array of instruction history entries across all states.
The key observation for proving this is correct is that instruction
history is only relevant while state is active, which means it either is
a current state (and thus we are actively modifying instruction history
and no other state can interfere with us) or we are checkpointed state
with some children still active (either enqueued or being current).
In the latter case our portion of instruction history is finalized and
won't change or grow, so as long as we keep it immutable until the state
is finalized, we are good.
Now, when state is finalized and is put into state hash for potentially
future pruning lookups, instruction history is not used anymore. This is
because instruction history is only used by precision marking logic, and
we never modify precision markings for finalized states.
So, instead of each state having its own small instruction history, we
keep a global dynamically-sized instruction history, where each state in
current DFS path from root to active state remembers its portion of
instruction history. Current state can append to this history, but
cannot modify any of its parent histories.
Async callback state enqueueing, while logically detached from parent
state, still is part of verification backtracking tree, so has to follow
the same schema as normal state checkpoints.
Because the insn_hist array can be grown through realloc, states don't
keep pointers, they instead maintain two indices, [start, end), into
global instruction history array. End is exclusive index, so
`start == end` means there is no relevant instruction history.
This eliminates a lot of allocations and minimizes overall memory usage.
For instance, running a worst-case test from [0] (but without the
heuristics-based fix [1]), it took 12.5 minutes until we get -ENOMEM.
With the changes in this patch the whole test succeeds in 10 minutes
(very slow, so heuristics from [1] is important, of course).
To further validate correctness, veristat-based comparison was performed for
Meta production BPF objects and BPF selftests objects. In both cases there
were no differences *at all* in terms of verdict or instruction and state
counts, providing a good confidence in the change.
Having this low-memory-overhead solution of keeping dynamic
per-instruction history cheaply opens up some new possibilities, like
keeping extra information for literally every single validated
instruction. This will be used for simplifying precision backpropagation
logic in follow up patches.
[0] https://lore.kernel.org/bpf/20241029172641.1042523-2-eddyz87@gmail.com/
[1] https://lore.kernel.org/bpf/20241029172641.1042523-1-eddyz87@gmail.com/
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/r/20241115001303.277272-1-andrii@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Stable-dep-of: e2d2115e56c4 ("bpf: Do not include stack ptr register in precision backtracking bookkeeping")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Steps on the way to 6.12.34
Resolves merge conflicts in:
kernel/sched/core.c
net/netfilter/xt_mark.c
Change-Id: I6df5e27c2a5bfa8b077b1f2814ad98b2a3dc0877
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
GKI (arm64) relevant 137 out of 624 changes, affecting 192 files +1647/-1035
a4f865ecdb nvmem: core: fix bit offsets of more than one byte [1 file, +17/-7]
4327479e55 nvmem: core: verify cell's raw_len [1 file, +12/-0]
410f8b72e0 nvmem: core: update raw_len if the bit reading is required [1 file, +3/-1]
7aea1517fb scsi: ufs: Introduce quirk to extend PA_HIBERN8TIME for UFS devices [2 files, +35/-0]
b730cb1096 virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN [1 file, +1/-1]
2998813177 dma/mapping.c: dev_dbg support for dma_addressing_limited [1 file, +10/-1]
3eec42a17a dma-mapping: avoid potential unused data compilation warning [1 file, +8/-4]
97edaa0ec6 cgroup: Fix compilation issue due to cgroup_mutex not being exported [1 file, +1/-1]
f93675793b vhost_task: fix vhost_task_create() documentation [1 file, +1/-1]
e22034cbee dma-mapping: Fix warning reported for missing prototype [1 file, +8/-8]
4f5553a08f fs/buffer: split locking for pagecache lookups [1 file, +25/-16]
e138fc2316 fs/buffer: introduce sleeping flavors for pagecache lookups [2 files, +17/-0]
a49a4a87ce fs/buffer: use sleeping version of __find_get_block() [1 file, +9/-2]
f1c5aa614b fs/jbd2: use sleeping version of __find_get_block() [1 file, +9/-6]
9ece099e95 fs/ext4: use sleeping version of sb_find_get_block() [1 file, +2/-1]
64f505b08e block: fix race between set_blocksize and read paths [4 files, +43/-1]
218c838d03 io_uring: don't duplicate flushing in io_req_post_cqe [1 file, +8/-3]
8014d3e56e bpf: fix possible endless loop in BPF map iteration [1 file, +1/-1]
d40ca27602 fuse: Return EPERM rather than ENOSYS from link() [1 file, +2/-0]
bab0bd1389 exfat: call bh_read in get_block only when necessary [1 file, +77/-82]
01677e7ee1 io_uring/msg: initialise msg request opcode [1 file, +1/-0]
e506751b7d arm64: Add support for HIP09 Spectre-BHB mitigation [2 files, +3/-0]
4f427ca9ed tracing: Mark binary printing functions with __printf() attribute [4 files, +18/-21]
15787ab82a mailbox: use error ret code of of_parse_phandle_with_args() [1 file, +4/-3]
f48ee562c0 Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken [1 file, +3/-0]
44b79041c4 dql: Fix dql->limit value when reset. [1 file, +1/-1]
ac30595154 lockdep: Fix wait context check on softirq for PREEMPT_RT [1 file, +18/-0]
e63b634806 PCI: dwc: ep: Ensure proper iteration over outbound map windows [1 file, +1/-1]
37ac2434aa ext4: on a remount, only log the ro or r/w state when it has changed [1 file, +4/-3]
1d1e1efad1 libnvdimm/labels: Fix divide error in nd_label_data_init() [1 file, +2/-1]
123bcd8f42 pidfs: improve multi-threaded exec and premature thread-group leader exit polling [3 files, +9/-9]
8f82cf305e cgroup/rstat: avoid disabling irqs for O(num_cpu) [1 file, +5/-7]
a5a507fa5f blk-cgroup: improve policy registration error handling [1 file, +12/-10]
94c3cbc69a ext4: reorder capability check last [1 file, +2/-2]
e658f2d94a bpf: Return prog btf_id without capable check [1 file, +2/-2]
e2520cc19b PCI: dwc: Use resource start as ioremap() input in dw_pcie_pme_turn_off() [1 file, +1/-1]
50452704ec jbd2: do not try to recover wiped journal [1 file, +6/-5]
dab35f4921 tcp: reorganize tcp_in_ack_event() and tcp_count_delivered() [1 file, +32/-24]
555c0b713c bpf: Allow pre-ordering for bpf cgroup progs [5 files, +30/-9]
572ed3fb99 kconfig: do not clear SYMBOL_VALID when reading include/config/auto.conf [1 file, +12/-7]
174dedce64 dm: restrict dm device size to 2^63-512 bytes [1 file, +4/-0]
2f5f326214 ext4: reject the 'data_err=abort' option in nojournal mode [1 file, +12/-0]
d0dc233fe2 posix-timers: Add cond_resched() to posix_timer_add() search loop [1 file, +1/-0]
ae22452d15 posix-timers: Ensure that timer initialization is fully visible [1 file, +14/-7]
3fb9ee05ec timer_list: Don't use %pK through printk() [1 file, +2/-2]
21153e0974 netfilter: conntrack: Bound nf_conntrack sysctl writes [1 file, +9/-3]
236a87e9d2 PNP: Expand length of fixup id string [1 file, +1/-1]
6215143ad3 arm64/mm: Check pmd_table() in pmd_trans_huge() [1 file, +12/-12]
8ad58a7eba arm64/mm: Check PUD_TYPE_TABLE in pud_bad() [1 file, +2/-1]
28306c58da mmc: sdhci: Disable SD card clock before changing parameters [1 file, +7/-2]
3a75fe58a1 usb: xhci: Don't change the status of stalled TDs on failed Stop EP [1 file, +11/-1]
101a3b9920 printk: Check CON_SUSPEND when unblanking a console [1 file, +12/-2]
faba68a86a wifi: cfg80211: allow IR in 20 MHz configurations [5 files, +46/-25]
c1502fc84d ipv6: save dontfrag in cork [2 files, +6/-4]
75ae2a3553 badblocks: Fix a nonsense WARN_ON() which checks whether a u64 variable < 0 [1 file, +3/-2]
7caad075ac crypto: lzo - Fix compression buffer overrun [6 files, +106/-28]
73d01bcbf2 tcp: bring back NUMA dispersion in inet_ehash_locks_alloc() [1 file, +26/-11]
1c17190880 usb: xhci: set page size to the xHCI-supported size [2 files, +22/-20]
93f581d763 drm/gem: Test for imported GEM buffers with helper [2 files, +16/-2]
c4525b513d net: phylink: use pl->link_interface in phylink_expects_phy() [1 file, +1/-1]
f29c876d72 perf/core: Clean up perf_try_init_event() [1 file, +38/-27]
af73c8fd73 ublk: enforce ublks_max only for unprivileged devices [1 file, +27/-15]
592ba27580 perf/hw_breakpoint: Return EOPNOTSUPP for unsupported breakpoint type [1 file, +3/-2]
3de322a98b scsi: logging: Fix scsi_logging_level bounds [1 file, +3/-1]
f33b310eac ipv4: fib: Move fib_valid_key_len() to rtm_to_fib_config(). [2 files, +16/-24]
564f03a797 block: mark bounce buffering as incompatible with integrity [2 files, +5/-2]
82209faa87 ublk: complete command synchronously on error [1 file, +6/-5]
b98aad5e5e media: uvcvideo: Add sanity check to uvc_ioctl_xu_ctrl_map [1 file, +6/-0]
2d6231d5ce media: uvcvideo: Handle uvc menu translation inside uvc_get_le_value [1 file, +32/-45]
e359d62886 perf: arm_pmuv3: Call kvm_vcpu_pmu_resync_el0() before enabling counters [1 file, +2/-2]
673dde8d3c bpf: Search and add kfuncs in struct_ops prologue and epilogue [1 file, +24/-1]
083383aba0 cpuidle: menu: Avoid discarding useful information [1 file, +12/-1]
20a53c3689 loop: check in LO_FLAGS_DIRECT_IO in loop_default_blocksize [1 file, +1/-1]
b55a97d1bd dm: fix unconditional IO throttle caused by REQ_PREFLUSH [1 file, +6/-2]
9f27b38771 crypto: ahash - Set default reqsize from ahash_alg [2 files, +7/-0]
897c98fb32 crypto: skcipher - Zap type in crypto_alloc_sync_skcipher [1 file, +1/-0]
4d9fa2ebc0 net: ipv6: Init tunnel link-netns before registering dev [4 files, +9/-7]
53f42776e4 genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie [2 files, +25/-36]
2b129e89b8 bpf: don't do clean_live_states when state->loop_entry->branches > 0 [1 file, +4/-0]
46ba5757a7 bpf: copy_verifier_state() should copy 'loop_entry' field [1 file, +3/-0]
82b54455b6 PCI: Fix old_size lower bound in calculate_iosize() too [1 file, +2/-4]
dc5f5c9d2b hrtimers: Replace hrtimer_clock_to_base_table with switch-case [1 file, +12/-17]
000dd6e344 ASoC: ops: Enforce platform maximum on initial value [1 file, +28/-1]
c4260bf83b ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot() [1 file, +5/-3]
5b1b4cb46d pinctrl: devicetree: do not goto err when probing hogs in pinctrl_dt_to_map [1 file, +8/-2]
69689d1138 media: v4l: Memset argument to 0 before calling get_mbus_config pad op [2 files, +5/-1]
e6e31b0182 sched: Reduce the default slice to avoid tasks getting an extra tick [1 file, +3/-3]
ef31dc41cf phy: core: don't require set_mode() callback for phy_get_mode() to work [1 file, +4/-3]
06daedb443 xfrm: prevent high SEQ input in non-ESN mode [1 file, +12/-0]
9f2911868a ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure(). [2 files, +4/-4]
7fea5a9140 r8152: add vendor/device ID pair for Dell Alienware AW1022z [2 files, +2/-0]
16ddd67bb5 pstore: Change kmsg_bytes storage size to u32 [3 files, +9/-8]
73733c2fdb ext4: don't write back data before punch hole in nojournal mode [1 file, +5/-13]
1d15319323 f2fs: introduce f2fs_base_attr for global sysfs entries [1 file, +52/-22]
ded26f9e4c ipv4: ip_gre: Fix set but not used warning in ipgre_err() if IPv4-only [1 file, +10/-6]
76e56dbe50 net: flush_backlog() small changes [1 file, +8/-4]
58cdd1ee65 bridge: mdb: Allow replace of a host-joined group [2 files, +2/-2]
fcabb69674 rcu: handle unstable rdp in rcu_read_unlock_strict() [2 files, +11/-2]
d402437cde rcu: fix header guard for rcu_all_qs() [1 file, +1/-1]
887e39ac47 perf: Avoid the read if the count is already updated [3 files, +24/-18]
c80b2d159c bpf: Use kallsyms to find the function name of a struct_ops's stub function [1 file, +44/-54]
46f1c2b508 firmware: arm_scmi: Relax duplicate name constraint across protocol ids [1 file, +6/-13]
1351052877 drm/atomic: clarify the rules around drm_atomic_state->allow_modeset [1 file, +21/-2]
9fddd1f154 drm: Add valid clones check [1 file, +28/-0]
ff214b079d nvme-pci: add quirks for device 126f:1001 [1 file, +3/-0]
6d196cae4b nvme-pci: add quirks for WDC Blue SN550 15b7:5009 [1 file, +3/-0]
6a09b6bad0 ALSA: usb-audio: Fix duplicated name in MIDI substream names [1 file, +12/-4]
ad3e83a6c8 io_uring/fdinfo: annotate racy sq/cq head/tail reads [1 file, +2/-2]
7f7c8c03fe btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref [1 file, +1/-1]
8cafd7266f __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock [1 file, +1/-5]
28756f22de espintcp: fix skb leaks [3 files, +9/-3]
9cbca30102 espintcp: remove encap socket caching to avoid reference leak [4 files, +8/-94]
b1a687eb15 xfrm: Fix UDP GRO handling for some corner cases [2 files, +20/-16]
447c8f0c06 kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork() [1 file, +5/-4]
252f78a931 xfrm: Sanitize marks before insert [2 files, +6/-0]
7207effe47 driver core: Split devres APIs to device/devres.h [2 files, +125/-118]
1e8b7e96f7 Bluetooth: L2CAP: Fix not checking l2cap_chan security level [1 file, +8/-7]
cd7f022296 loop: don't require ->write_iter for writable files in loop_configure [1 file, +0/-3]
873ebaf3c1 io_uring: fix overflow resched cqe reordering [1 file, +1/-0]
689a205cd9 net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done [1 file, +5/-0]
adb05149a9 can: slcan: allow reception of short error messages [1 file, +20/-6]
cc55dd28c2 can: bcm: add locking for bcm_op runtime updates [1 file, +45/-21]
63567ecd99 can: bcm: add missing rcu read protection for procfs content [1 file, +9/-4]
bf85e49aaf ALSA: pcm: Fix race of buffer access at PCM OSS layer [3 files, +14/-2]
e78908caf1 pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id() [1 file, +1/-1]
dc9bdfb9b0 drm/edid: fixed the bug that hdr metadata was not reset [1 file, +1/-0]
cb9a1019a6 Input: xpad - add more controllers [1 file, +3/-0]
9b8263cae6 highmem: add folio_test_partial_kmap() [2 files, +12/-5]
314bf771cb memcg: always call cond_resched() after fn() [1 file, +2/-4]
9da33ce114 mm/page_alloc.c: avoid infinite retries caused by cpuset race [1 file, +8/-0]
9f9517f156 mm: mmap: map MAP_STACK to VM_NOHUGEPAGE only if THP is enabled [1 file, +2/-0]
94efb0d656 mm: vmalloc: actually use the in-place vrealloc region [1 file, +1/-0]
483ac74183 mm: vmalloc: only zero-init on vrealloc shrink [1 file, +7/-5]
1d45e0170c spi: use container_of_cont() for to_spi_device() [1 file, +1/-4]
d28b0305f7 err.h: move IOMEM_ERR_PTR() to err.h [2 files, +3/-2]
80eb73778d bpf: abort verification if env->cur_state->loop_entry != NULL [1 file, +4/-2]
85fb1edd05 drm/gem: Internally test import_attach for imported objects [1 file, +1/-2]
Changes in 6.12.31
drm/amd/display: Configure DTBCLK_P with OPTC only for dcn401
drm/amd/display: Do not enable replay when vtotal update is pending.
drm/amd/display: Correct timing_adjust_pending flag setting.
drm/amd/display: Defer BW-optimization-blocked DRR adjustments
i2c: designware: Use temporary variable for struct device
i2c: designware: Fix an error handling path in i2c_dw_pci_probe()
phy: renesas: rcar-gen3-usb2: Move IRQ request in probe
phy: renesas: rcar-gen3-usb2: Lock around hardware registers and driver data
phy: renesas: rcar-gen3-usb2: Assert PLL reset on PHY power off
cpufreq: Add SM8650 to cpufreq-dt-platdev blocklist
nvmem: rockchip-otp: Move read-offset into variant-data
nvmem: rockchip-otp: add rk3576 variant data
nvmem: core: fix bit offsets of more than one byte
nvmem: core: verify cell's raw_len
nvmem: core: update raw_len if the bit reading is required
nvmem: qfprom: switch to 4-byte aligned reads
scsi: target: iscsi: Fix timeout on deleted connection
scsi: ufs: Introduce quirk to extend PA_HIBERN8TIME for UFS devices
virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN
dma/mapping.c: dev_dbg support for dma_addressing_limited
intel_th: avoid using deprecated page->mapping, index fields
mei: vsc: Use struct vsc_tp_packet as vsc-tp tx_buf and rx_buf type
dma-mapping: avoid potential unused data compilation warning
cgroup: Fix compilation issue due to cgroup_mutex not being exported
vhost_task: fix vhost_task_create() documentation
vhost-scsi: protect vq->log_used with vq->mutex
scsi: mpi3mr: Add level check to control event logging
net: enetc: refactor bulk flipping of RX buffers to separate function
dma-mapping: Fix warning reported for missing prototype
ima: process_measurement() needlessly takes inode_lock() on MAY_READ
fs/buffer: split locking for pagecache lookups
fs/buffer: introduce sleeping flavors for pagecache lookups
fs/buffer: use sleeping version of __find_get_block()
fs/ocfs2: use sleeping version of __find_get_block()
fs/jbd2: use sleeping version of __find_get_block()
fs/ext4: use sleeping version of sb_find_get_block()
drm/amd/display: Enable urgent latency adjustment on DCN35
drm/amdgpu: Allow P2P access through XGMI
selftests/bpf: Mitigate sockmap_ktls disconnect_after_delete failure
block: fix race between set_blocksize and read paths
io_uring: don't duplicate flushing in io_req_post_cqe
bpf: fix possible endless loop in BPF map iteration
samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora
kconfig: merge_config: use an empty file as initfile
x86/fred: Fix system hang during S4 resume with FRED enabled
s390/vfio-ap: Fix no AP queue sharing allowed message written to kernel log
cifs: Add fallback for SMB2 CREATE without FILE_READ_ATTRIBUTES
cifs: Fix querying and creating MF symlinks over SMB1
cifs: Fix negotiate retry functionality
smb: client: Store original IO parameters and prevent zero IO sizes
fuse: Return EPERM rather than ENOSYS from link()
exfat: call bh_read in get_block only when necessary
io_uring/msg: initialise msg request opcode
NFSv4: Check for delegation validity in nfs_start_delegation_return_locked()
NFS: Don't allow waiting for exiting tasks
SUNRPC: Don't allow waiting for exiting tasks
arm64: Add support for HIP09 Spectre-BHB mitigation
iommufd: Extend IOMMU_GET_HW_INFO to report PASID capability
tracing: Mark binary printing functions with __printf() attribute
ACPI: PNP: Add Intel OC Watchdog IDs to non-PNP device list
tpm: Convert warn to dbg in tpm2_start_auth_session()
mailbox: pcc: Use acpi_os_ioremap() instead of ioremap()
mailbox: use error ret code of of_parse_phandle_with_args()
riscv: Allow NOMMU kernels to access all of RAM
fbdev: fsl-diu-fb: add missing device_remove_file()
fbcon: Use correct erase colour for clearing in fbcon
fbdev: core: tileblit: Implement missing margin clearing for tileblit
cifs: Set default Netbios RFC1001 server name to hostname in UNC
cifs: add validation check for the fields in smb_aces
cifs: Fix establishing NetBIOS session for SMB2+ connection
NFSv4: Treat ENETUNREACH errors as fatal for state recovery
SUNRPC: rpc_clnt_set_transport() must not change the autobind setting
SUNRPC: rpcbind should never reset the port to the value '0'
spi-rockchip: Fix register out of bounds access
ASoC: codecs: wsa884x: Correct VI sense channel mask
ASoC: codecs: wsa883x: Correct VI sense channel mask
mctp: Fix incorrect tx flow invalidation condition in mctp-i2c
net: tn40xx: add pci-id of the aqr105-based Tehuti TN4010 cards
net: tn40xx: create swnode for mdio and aqr105 phy and add to mdiobus
thermal/drivers/mediatek/lvts: Start sensor interrupts disabled
thermal/drivers/qoriq: Power down TMU on system suspend
Bluetooth: btmtksdio: Prevent enabling interrupts after IRQ handler removal
Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken
dql: Fix dql->limit value when reset.
lockdep: Fix wait context check on softirq for PREEMPT_RT
objtool: Properly disable uaccess validation
PCI: dwc: ep: Ensure proper iteration over outbound map windows
r8169: disable RTL8126 ZRX-DC timeout
tools/build: Don't pass test log files to linker
pNFS/flexfiles: Report ENETDOWN as a connection error
drm/amdgpu/discovery: check ip_discovery fw file available
drm/amdkfd: set precise mem ops caps to disabled for gfx 11 and 12
PCI: vmd: Disable MSI remapping bypass under Xen
xen/pci: Do not register devices with segments >= 0x10000
ext4: on a remount, only log the ro or r/w state when it has changed
libnvdimm/labels: Fix divide error in nd_label_data_init()
pidfs: improve multi-threaded exec and premature thread-group leader exit polling
staging: vchiq_arm: Create keep-alive thread during probe
mmc: host: Wait for Vdd to settle on card power off
drm/amdgpu: Skip pcie_replay_count sysfs creation for VF
cgroup/rstat: avoid disabling irqs for O(num_cpu)
wifi: mt76: only mark tx-status-failed frames as ACKed on mt76x0/2
wifi: mt76: mt7996: fix SER reset trigger on WED reset
wifi: mt76: mt7996: revise TXS size
wifi: mt76: mt7925: load the appropriate CLC data based on hardware type
wifi: mt76: mt7925: fix fails to enter low power mode in suspend state
x86/headers: Replace __ASSEMBLY__ with __ASSEMBLER__ in UAPI headers
x86/stackprotector/64: Only export __ref_stack_chk_guard on CONFIG_SMP
x86/smpboot: Fix INIT delay assignment for extended Intel Families
x86/microcode: Update the Intel processor flag scan check
x86/mm: Check return value from memblock_phys_alloc_range()
i2c: qup: Vote for interconnect bandwidth to DRAM
i2c: pxa: fix call balance of i2c->clk handling routines
btrfs: make btrfs_discard_workfn() block_group ref explicit
btrfs: avoid linker error in btrfs_find_create_tree_block()
btrfs: run btrfs_error_commit_super() early
btrfs: fix non-empty delayed iputs list on unmount due to async workers
btrfs: get zone unusable bytes while holding lock at btrfs_reclaim_bgs_work()
btrfs: send: return -ENAMETOOLONG when attempting a path that is too long
blk-cgroup: improve policy registration error handling
drm/amdgpu: release xcp_mgr on exit
drm/amd/display: Guard against setting dispclk low for dcn31x
drm/amdgpu: adjust drm_firmware_drivers_only() handling
i3c: master: svc: Fix missing STOP for master request
s390/tlb: Use mm_has_pgste() instead of mm_alloc_pgste()
dlm: make tcp still work in multi-link env
clocksource/drivers/timer-riscv: Stop stimecmp when cpu hotplug
um: Store full CSGSFS and SS register from mcontext
um: Update min_low_pfn to match changes in uml_reserved
wifi: mwifiex: Fix HT40 bandwidth issue.
bnxt_en: Query FW parameters when the CAPS_CHANGE bit is set
riscv: Call secondary mmu notifier when flushing the tlb
ext4: reorder capability check last
hypfs_create_cpu_files(): add missing check for hypfs_mkdir() failure
scsi: st: Tighten the page format heuristics with MODE SELECT
scsi: st: ERASE does not change tape location
vfio/pci: Handle INTx IRQ_NOTCONNECTED
bpf: Return prog btf_id without capable check
PCI: dwc: Use resource start as ioremap() input in dw_pcie_pme_turn_off()
jbd2: do not try to recover wiped journal
tcp: reorganize tcp_in_ack_event() and tcp_count_delivered()
rtc: rv3032: fix EERD location
objtool: Fix error handling inconsistencies in check()
thunderbolt: Do not add non-active NVM if NVM upgrade is disabled for retimer
erofs: initialize decompression early
spi: spi-mux: Fix coverity issue, unchecked return value
ASoC: pcm6240: Drop bogus code handling IRQ as GPIO
ASoC: mediatek: mt6359: Add stub for mt6359_accdet_enable_jack_detect
bpf: Allow pre-ordering for bpf cgroup progs
kbuild: fix argument parsing in scripts/config
kconfig: do not clear SYMBOL_VALID when reading include/config/auto.conf
crypto: octeontx2 - suppress auth failure screaming due to negative tests
dm: restrict dm device size to 2^63-512 bytes
net/smc: use the correct ndev to find pnetid by pnetid table
xen: Add support for XenServer 6.1 platform device
pinctrl-tegra: Restore SFSEL bit when freeing pins
mfd: tps65219: Remove TPS65219_REG_TI_DEV_ID check
drm/amdgpu/gfx12: don't read registers in mqd init
drm/amdgpu/gfx11: don't read registers in mqd init
drm/amdgpu: Update SRIOV video codec caps
ASoC: sun4i-codec: support hp-det-gpios property
clk: qcom: lpassaudiocc-sc7280: Add support for LPASS resets for QCM6490
ext4: reject the 'data_err=abort' option in nojournal mode
ext4: do not convert the unwritten extents if data writeback fails
RDMA/uverbs: Propagate errors from rdma_lookup_get_uobject()
posix-timers: Add cond_resched() to posix_timer_add() search loop
posix-timers: Ensure that timer initialization is fully visible
net: stmmac: dwmac-rk: Validate GRF and peripheral GRF during probe
net: hsr: Fix PRP duplicate detection
timer_list: Don't use %pK through printk()
wifi: rtw89: set force HE TB mode when connecting to 11ax AP
netfilter: conntrack: Bound nf_conntrack sysctl writes
PNP: Expand length of fixup id string
phy: rockchip: usbdp: Only verify link rates/lanes/voltage when the corresponding set flags are set
arm64/mm: Check pmd_table() in pmd_trans_huge()
arm64/mm: Check PUD_TYPE_TABLE in pud_bad()
mmc: dw_mmc: add exynos7870 DW MMC support
mmc: sdhci: Disable SD card clock before changing parameters
usb: xhci: Don't change the status of stalled TDs on failed Stop EP
wifi: iwlwifi: mvm: fix setting the TK when associated
hwmon: (dell-smm) Increment the number of fans
iommu: Keep dev->iommu state consistent
printk: Check CON_SUSPEND when unblanking a console
wifi: iwlwifi: don't warn when if there is a FW error
wifi: iwlwifi: w/a FW SMPS mode selection
wifi: iwlwifi: fix debug actions order
wifi: iwlwifi: mark Br device not integrated
wifi: iwlwifi: fix the ECKV UEFI variable name
wifi: mac80211: fix warning on disconnect during failed ML reconf
wifi: mac80211_hwsim: Fix MLD address translation
wifi: cfg80211: allow IR in 20 MHz configurations
ipv6: save dontfrag in cork
drm/amd/display: remove minimum Dispclk and apply oem panel timing.
drm/amd/display: calculate the remain segments for all pipes
drm/amd/display: not abort link train when bw is low
drm/amd/display: Fix incorrect DPCD configs while Replay/PSR switch
gfs2: Check for empty queue in run_queue
auxdisplay: charlcd: Partially revert "Move hwidth and bwidth to struct hd44780_common"
ASoC: qcom: sm8250: explicitly set format in sm8250_be_hw_params_fixup()
badblocks: Fix a nonsense WARN_ON() which checks whether a u64 variable < 0
coresight-etb10: change etb_drvdata spinlock's type to raw_spinlock_t
iommu/amd/pgtbl_v2: Improve error handling
cpufreq: tegra186: Share policy per cluster
watchdog: aspeed: Update bootstatus handling
PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops
misc: pci_endpoint_test: Give disabled BARs a distinct error code
crypto: lzo - Fix compression buffer overrun
crypto: mxs-dcp - Only set OTP_KEY bit for OTP key
drm/amdkfd: Set per-process flags only once for gfx9/10/11/12
drm/amdkfd: Set per-process flags only once cik/vi
drm/amdgpu: Fix missing drain retry fault the last entry
arm64: tegra: p2597: Fix gpio for vdd-1v8-dis regulator
arm64: tegra: Resize aperture for the IGX PCIe C5 slot
powerpc/prom_init: Fixup missing #size-cells on PowerBook6,7
ALSA: seq: Improve data consistency at polling
tcp: bring back NUMA dispersion in inet_ehash_locks_alloc()
rtc: ds1307: stop disabling alarms on probe
ieee802154: ca8210: Use proper setters and getters for bitwise types
drm/xe: Nuke VM's mapping upon close
drm/xe: Retry BO allocation
soc: samsung: include linux/array_size.h where needed
ARM: tegra: Switch DSI-B clock parent to PLLD on Tegra114
media: c8sectpfe: Call of_node_put(i2c_bus) only once in c8sectpfe_probe()
usb: xhci: set page size to the xHCI-supported size
dm cache: prevent BUG_ON by blocking retries on failed device resumes
soc: mediatek: mtk-mutex: Add DPI1 SOF/EOF to MT8188 mutex tables
orangefs: Do not truncate file size
drm/gem: Test for imported GEM buffers with helper
net: phylink: use pl->link_interface in phylink_expects_phy()
blk-throttle: don't take carryover for prioritized processing of metadata
remoteproc: qcom_wcnss: Handle platforms with only single power domain
drm/amdgpu: Do not program AGP BAR regs under SRIOV in gfxhub_v1_0.c
drm/amd/display: Ensure DMCUB idle before reset on DCN31/DCN35
drm/amd/display: Skip checking FRL_MODE bit for PCON BW determination
drm/amd/display: Fix DMUB reset sequence for DCN401
drm/amd/display: Fix p-state type when p-state is unsupported
drm/amd/display: Request HW cursor on DCN3.2 with SubVP
perf/core: Clean up perf_try_init_event()
media: cx231xx: set device_caps for 417
pinctrl: bcm281xx: Use "unsigned int" instead of bare "unsigned"
rcu: Fix get_state_synchronize_rcu_full() GP-start detection
net: ethernet: ti: cpsw_new: populate netdev of_node
net: phy: nxp-c45-tja11xx: add match_phy_device to TJA1103/TJA1104
dpll: Add an assertion to check freq_supported_num
ublk: enforce ublks_max only for unprivileged devices
iommufd: Disallow allocating nested parent domain with fault ID
media: imx335: Set vblank immediately
net: pktgen: fix mpls maximum labels list parsing
perf/hw_breakpoint: Return EOPNOTSUPP for unsupported breakpoint type
ALSA: hda/realtek: Enable PC beep passthrough for HP EliteBook 855 G7
scsi: logging: Fix scsi_logging_level bounds
ipv4: fib: Move fib_valid_key_len() to rtm_to_fib_config().
drm/rockchip: vop2: Add uv swap for cluster window
block: mark bounce buffering as incompatible with integrity
ublk: complete command synchronously on error
media: uvcvideo: Add sanity check to uvc_ioctl_xu_ctrl_map
media: uvcvideo: Handle uvc menu translation inside uvc_get_le_value
clk: imx8mp: inform CCF of maximum frequency of clocks
x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2
hwmon: (gpio-fan) Add missing mutex locks
ARM: at91: pm: fix at91_suspend_finish for ZQ calibration
drm/mediatek: mtk_dpi: Add checks for reg_h_fre_con existence
fpga: altera-cvp: Increase credit timeout
perf: arm_pmuv3: Call kvm_vcpu_pmu_resync_el0() before enabling counters
soc: apple: rtkit: Use high prio work queue
soc: apple: rtkit: Implement OSLog buffers properly
wifi: ath12k: Report proper tx completion status to mac80211
PCI: brcmstb: Expand inbound window size up to 64GB
PCI: brcmstb: Add a softdep to MIP MSI-X driver
firmware: arm_ffa: Set dma_mask for ffa devices
drm/xe/vf: Retry sending MMIO request to GUC on timeout error
drm/xe/pf: Create a link between PF and VF devices
net/mlx5: Avoid report two health errors on same syndrome
selftests/net: have `gro.sh -t` return a correct exit code
pinctrl: sophgo: avoid to modify untouched bit when setting cv1800 pinconf
drm/amdkfd: KFD release_work possible circular locking
drm/xe: xe_gen_wa_oob: replace program_invocation_short_name
leds: pwm-multicolor: Add check for fwnode_property_read_u32
net: ethernet: mtk_ppe_offload: Allow QinQ, double ETH_P_8021Q only
net: xgene-v2: remove incorrect ACPI_PTR annotation
bonding: report duplicate MAC address in all situations
wifi: ath12k: Improve BSS discovery with hidden SSID in 6 GHz band
soc: ti: k3-socinfo: Do not use syscon helper to build regmap
bpf: Search and add kfuncs in struct_ops prologue and epilogue
Octeontx2-af: RPM: Register driver with PCI subsys IDs
x86/build: Fix broken copy command in genimage.sh when making isoimage
drm/amd/display: handle max_downscale_src_width fail check
drm/amd/display: fix dcn4x init failed
drm/amd/display: Fix mismatch type comparison
ASoC: mediatek: mt8188: Treat DMIC_GAINx_CUR as non-volatile
ASoC: mediatek: mt8188: Add reference for dmic clocks
x86/nmi: Add an emergency handler in nmi_desc & use it in nmi_shootdown_cpus()
vhost-scsi: Return queue full for page alloc failures during copy
vdpa/mlx5: Fix mlx5_vdpa_get_config() endianness on big-endian machines
cpuidle: menu: Avoid discarding useful information
media: adv7180: Disable test-pattern control on adv7180
media: tc358746: improve calculation of the D-PHY timing registers
net/mlx5e: Add correct match to check IPSec syndromes for switchdev mode
scsi: mpi3mr: Update timestamp only for supervisor IOCs
loop: check in LO_FLAGS_DIRECT_IO in loop_default_blocksize
libbpf: Fix out-of-bound read
dm: fix unconditional IO throttle caused by REQ_PREFLUSH
scsi: scsi_debug: First fixes for tapes
net/mlx5: Change POOL_NEXT_SIZE define value and make it global
x86/kaslr: Reduce KASLR entropy on most x86 systems
crypto: ahash - Set default reqsize from ahash_alg
crypto: skcipher - Zap type in crypto_alloc_sync_skcipher
net: ipv6: Init tunnel link-netns before registering dev
drm/xe/oa: Ensure that polled read returns latest data
MIPS: Use arch specific syscall name match function
drm/amdgpu: remove all KFD fences from the BO on release
x86/locking: Use ALT_OUTPUT_SP() for percpu_{,try_}cmpxchg{64,128}_op()
genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie
MIPS: pm-cps: Use per-CPU variables as per-CPU, not per-core
clocksource: mips-gic-timer: Enable counter when CPUs start
PCI: epf-mhi: Update device ID for SA8775P
scsi: mpt3sas: Send a diag reset if target reset fails
wifi: rtw88: Fix rtw_init_vht_cap() for RTL8814AU
wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU
wifi: rtw88: Fix rtw_desc_to_mcsrate() to handle MCS16-31
wifi: rtw89: fw: propagate error code from rtw89_h2c_tx()
wifi: rtw89: fw: get sb_sel_ver via get_unaligned_le32()
wifi: rtw89: fw: add blacklist to avoid obsolete secure firmware
wifi: rtw89: 8922a: fix incorrect STA-ID in EHT MU PPDU
net: pktgen: fix access outside of user given buffer in pktgen_thread_write()
power: supply: axp20x_battery: Update temp sensor for AXP717 from device tree
EDAC/ie31200: work around false positive build warning
i3c: master: svc: Flush FIFO before sending Dynamic Address Assignment(DAA)
mfd: axp20x: AXP717: Add AXP717_TS_PIN_CFG to writeable regs
eeprom: ee1004: Check chip before probing
irqchip/riscv-imsic: Separate next and previous pointers in IMSIC vector
drm/amd/pm: Fetch current power limit from PMFW
drm/amd/display: Add support for disconnected eDP streams
drm/amd/display: Guard against setting dispclk low when active
drm/amd/display: Fix BT2020 YCbCr limited/full range input
drm/amd/display: Read LTTPR ALPM caps during link cap retrieval
Revert "drm/amd/display: Request HW cursor on DCN3.2 with SubVP"
drm/amd/display: Don't treat wb connector as physical in create_validate_stream_for_sink
serial: mctrl_gpio: split disable_ms into sync and no_sync APIs
RDMA/core: Fix best page size finding when it can cross SG entries
pmdomain: imx: gpcv2: use proper helper for property detection
can: c_can: Use of_property_present() to test existence of DT property
bpf: don't do clean_live_states when state->loop_entry->branches > 0
bpf: copy_verifier_state() should copy 'loop_entry' field
eth: mlx4: don't try to complete XDP frames in netpoll
PCI: Fix old_size lower bound in calculate_iosize() too
ACPI: HED: Always initialize before evged
vxlan: Join / leave MC group after remote changes
hrtimers: Replace hrtimer_clock_to_base_table with switch-case
irqchip/riscv-imsic: Set irq_set_affinity() for IMSIC base
media: test-drivers: vivid: don't call schedule in loop
net/mlx5: Modify LSB bitmask in temperature event to include only the first bit
net/mlx5: Apply rate-limiting to high temperature warning
firmware: arm_ffa: Reject higher major version as incompatible
firmware: arm_ffa: Handle the presence of host partition in the partition info
firmware: xilinx: Dont send linux address to get fpga config get status
ASoC: ops: Enforce platform maximum on initial value
ASoC: tas2764: Add reg defaults for TAS2764_INT_CLK_CFG
ASoC: tas2764: Mark SW_RESET as volatile
ASoC: tas2764: Power up/down amp on mute ops
ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot()
pinctrl: devicetree: do not goto err when probing hogs in pinctrl_dt_to_map
smack: recognize ipv4 CIPSO w/o categories
smack: Revert "smackfs: Added check catlen"
kunit: tool: Use qboot on QEMU x86_64
media: i2c: imx219: Correct the minimum vblanking value
media: v4l: Memset argument to 0 before calling get_mbus_config pad op
net/mlx4_core: Avoid impossible mlx4_db_alloc() order value
drm/xe: Stop ignoring errors from xe_ttm_stolen_mgr_init()
drm/xe: Fix xe_tile_init_noalloc() error propagation
clk: qcom: ipq5018: allow it to be bulid on arm32
clk: qcom: clk-alpha-pll: Do not use random stack value for recalc rate
drm/xe/debugfs: fixed the return value of wedged_mode_set
drm/xe/debugfs: Add missing xe_pm_runtime_put in wedge_mode_set
x86/ibt: Handle FineIBT in handle_cfi_failure()
x86/traps: Cleanup and robustify decode_bug()
sched: Reduce the default slice to avoid tasks getting an extra tick
serial: sh-sci: Update the suspend/resume support
pinctrl: renesas: rzg2l: Add suspend/resume support for pull up/down
phy: phy-rockchip-samsung-hdptx: Swap the definitions of LCPLL_REF and ROPLL_REF
phy: core: don't require set_mode() callback for phy_get_mode() to work
phy: exynos5-usbdrd: fix EDS distribution tuning (gs101)
soundwire: amd: change the soundwire wake enable/disable sequence
soundwire: cadence_master: set frame shape and divider based on actual clk freq
net: stmmac: dwmac-loongson: Set correct {tx,rx}_fifo_size
drm/amdgpu/mes11: fix set_hw_resources_1 calculation
drm/amdkfd: fix missing L2 cache info in topology
drm/amdgpu: Set snoop bit for SDMA for MI series
drm/amd/display: pass calculated dram_speed_mts to dml2
drm/amd/display: Don't try AUX transactions on disconnected link
drm/amdgpu: reset psp->cmd to NULL after releasing the buffer
drm/amd/pm: Skip P2S load for SMU v13.0.12
drm/amd/display: Support multiple options during psr entry.
Revert "drm/amd/display: Exit idle optimizations before attempt to access PHY"
drm/amd/display: Update CR AUX RD interval interpretation
drm/amd/display: Initial psr_version with correct setting
drm/amd/display: Increase block_sequence array size
drm/amd/display: Use Nominal vBlank If Provided Instead Of Capping It
drm/amd/display: Populate register address for dentist for dcn401
drm/amdgpu: Use active umc info from discovery
drm/amdgpu: enlarge the VBIOS binary size limit
drm/amd/display/dm: drop hw_support check in amdgpu_dm_i2c_xfer()
scsi: target: spc: Fix loop traversal in spc_rsoc_get_descr()
net/mlx5: XDP, Enable TX side XDP multi-buffer support
net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB
net/mlx5e: set the tx_queue_len for pfifo_fast
net/mlx5e: reduce rep rxq depth to 256 for ECPF
net/mlx5e: reduce the max log mpwrq sz for ECPF and reps
drm/v3d: Add clock handling
xfrm: prevent high SEQ input in non-ESN mode
wifi: ath12k: fix the ampdu id fetch in the HAL_RX_MPDU_START TLV
mptcp: pm: userspace: flags: clearer msg if no remote addr
wifi: iwlwifi: use correct IMR dump variable
wifi: iwlwifi: don't warn during reprobe
wifi: mac80211: don't unconditionally call drv_mgd_complete_tx()
wifi: mac80211: remove misplaced drv_mgd_complete_tx() call
wifi: mac80211: set ieee80211_prep_tx_info::link_id upon Auth Rx
net: fec: Refactor MAC reset to function
powerpc/pseries/iommu: memory notifier incorrectly adds TCEs for pmemory
powerpc/pseries/iommu: create DDW for devices with DMA mask less than 64-bits
arch/powerpc/perf: Check the instruction type before creating sample with perf_mem_data_src
ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure().
r8152: add vendor/device ID pair for Dell Alienware AW1022z
iio: adc: ad7944: don't use storagebits for sizing
pstore: Change kmsg_bytes storage size to u32
leds: trigger: netdev: Configure LED blink interval for HW offload
ext4: don't write back data before punch hole in nojournal mode
ext4: remove writable userspace mappings before truncating page cache
wifi: rtw88: Fix download_firmware_validate() for RTL8814AU
wifi: rtw88: Fix __rtw_download_firmware() for RTL8814AU
wifi: rtw89: coex: Assign value over than 0 to avoid firmware timer hang
wifi: rtw89: fw: validate multi-firmware header before getting its size
wifi: rtw89: fw: validate multi-firmware header before accessing
wifi: rtw89: call power_on ahead before selecting firmware
clk: qcom: camcc-sm8250: Use clk_rcg2_shared_ops for some RCGs
net: page_pool: avoid false positive warning if NAPI was never added
tools/power turbostat: Clustered Uncore MHz counters should honor show/hide options
hwmon: (xgene-hwmon) use appropriate type for the latency value
f2fs: introduce f2fs_base_attr for global sysfs entries
media: qcom: camss: csid: Only add TPG v4l2 ctrl if TPG hardware is available
media: qcom: camss: Add default case in vfe_src_pad_code
drm/rockchip: vop2: Improve display modes handling on RK3588 HDMI0
eth: fbnic: set IFF_UNICAST_FLT to avoid enabling promiscuous mode when adding unicast addrs
tools: ynl-gen: don't output external constants
net/mlx5e: Avoid WARN_ON when configuring MQPRIO with HTB offload enabled
cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost
vxlan: Annotate FDB data races
ipv4: ip_gre: Fix set but not used warning in ipgre_err() if IPv4-only
r8169: don't scan PHY addresses > 0
net: flush_backlog() small changes
bridge: mdb: Allow replace of a host-joined group
ice: init flow director before RDMA
ice: treat dyn_allowed only as suggestion
rcu: handle quiescent states for PREEMPT_RCU=n, PREEMPT_COUNT=y
rcu: handle unstable rdp in rcu_read_unlock_strict()
rcu: fix header guard for rcu_all_qs()
perf: Avoid the read if the count is already updated
ice: count combined queues using Rx/Tx count
drm/xe/relay: Don't use GFP_KERNEL for new transactions
net/mana: fix warning in the writer of client oob
scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine
scsi: lpfc: Ignore ndlp rport mismatch in dev_loss_tmo callbk
scsi: lpfc: Free phba irq in lpfc_sli4_enable_msi() when pci_irq_vector() fails
scsi: st: Restore some drive settings after reset
wifi: ath12k: Avoid napi_sync() before napi_enable()
HID: usbkbd: Fix the bit shift number for LED_KANA
arm64: zynqmp: add clock-output-names property in clock nodes
ASoC: codecs: pcm3168a: Allow for 24-bit in provider mode
ASoC: rt722-sdca: Add some missing readable registers
irqchip/riscv-aplic: Add support for hart indexes
dm vdo indexer: prevent unterminated string warning
dm vdo: use a short static string for thread name prefix
drm/ast: Find VBIOS mode from regular display size
bpf: Use kallsyms to find the function name of a struct_ops's stub function
bpftool: Fix readlink usage in get_fd_type
firmware: arm_scmi: Relax duplicate name constraint across protocol ids
perf/amd/ibs: Fix perf_ibs_op.cnt_mask for CurCnt
perf/amd/ibs: Fix ->config to sample period calculation for OP PMU
clk: renesas: rzg2l-cpg: Refactor Runtime PM clock validation
wifi: rtl8xxxu: retry firmware download on error
wifi: rtw88: Don't use static local variable in rtw8822b_set_tx_power_index_by_rate
wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet
spi: zynqmp-gqspi: Always acknowledge interrupts
regulator: ad5398: Add device tree support
wifi: ath12k: fix ath12k_hal_tx_cmd_ext_desc_setup() info1 override
accel/qaic: Mask out SR-IOV PCI resources
drm/xe/pf: Reset GuC VF config when unprovisioning critical resource
wifi: ath9k: return by of_get_mac_address
wifi: ath12k: Fetch regdb.bin file from board-2.bin
wifi: ath12k: Fix end offset bit definition in monitor ring descriptor
drm: bridge: adv7511: fill stream capabilities
drm/nouveau: fix the broken marco GSP_MSG_MAX_SIZE
wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation
drm/xe: Move suballocator init to after display init
drm/xe: Do not attempt to bootstrap VF in execlists mode
wifi: rtw89: coex: Separated Wi-Fi connecting event from Wi-Fi scan event
drm/xe/sa: Always call drm_suballoc_manager_fini()
drm/xe: Reject BO eviction if BO is bound to current VM
drm/atomic: clarify the rules around drm_atomic_state->allow_modeset
drm/buddy: fix issue that force_merge cannot free all roots
drm/panel-edp: Add Starry 116KHD024006
drm: Add valid clones check
ASoC: imx-card: Adjust over allocation of memory in imx_card_parse_of()
book3s64/radix: Fix compile errors when CONFIG_ARCH_WANT_OPTIMIZE_DAX_VMEMMAP=n
pinctrl: meson: define the pull up/down resistor value as 60 kOhm
smb: server: smb2pdu: check return value of xa_store()
platform/x86/intel: hid: Add Pantherlake support
platform/x86: asus-wmi: Disable OOBE state after resume from hibernation
platform/x86: ideapad-laptop: add support for some new buttons
ASoC: cs42l43: Disable headphone clamps during type detection
ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013
ALSA: hda/realtek: Add quirk for HP Spectre x360 15-df1xxx
nvme-pci: add quirks for device 126f:1001
nvme-pci: add quirks for WDC Blue SN550 15b7:5009
ALSA: usb-audio: Fix duplicated name in MIDI substream names
nvmet-tcp: don't restore null sk_state_change
io_uring/fdinfo: annotate racy sq/cq head/tail reads
cifs: Fix and improve cifs_query_path_info() and cifs_query_file_info()
cifs: Fix changing times and read-only attr over SMB1 smb_set_file_info() function
ASoC: intel/sdw_utils: Add volume limit to cs42l43 speakers
btrfs: compression: adjust cb->compressed_folios allocation type
btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref
btrfs: handle empty eb->folios in num_extent_folios()
btrfs: avoid NULL pointer dereference if no valid csum tree
tools: ynl-gen: validate 0 len strings from kernel
block: only update request sector if needed
wifi: iwlwifi: add support for Killer on MTL
x86/Kconfig: make CFI_AUTO_DEFAULT depend on !RUST or Rust >= 1.88
xenbus: Allow PVH dom0 a non-local xenstore
drm/amd/display: Call FP Protect Before Mode Programming/Mode Support
__legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock
soundwire: bus: Fix race on the creation of the IRQ domain
espintcp: fix skb leaks
espintcp: remove encap socket caching to avoid reference leak
xfrm: Fix UDP GRO handling for some corner cases
dmaengine: idxd: Fix allowing write() from different address spaces
x86/sev: Fix operator precedence in GHCB_MSR_VMPL_REQ_LEVEL macro
kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork()
remoteproc: qcom_wcnss: Fix on platforms without fallback regulators
clk: sunxi-ng: d1: Add missing divider for MMC mod clocks
xfrm: Sanitize marks before insert
dmaengine: idxd: Fix ->poll() return value
dmaengine: fsl-edma: Fix return code for unhandled interrupts
driver core: Split devres APIs to device/devres.h
devres: Introduce devm_kmemdup_array()
ASoC: SOF: Intel: hda: Fix UAF when reloading module
irqchip/riscv-imsic: Start local sync timer on correct CPU
perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq
Bluetooth: L2CAP: Fix not checking l2cap_chan security level
Bluetooth: btusb: use skb_pull to avoid unsafe access in QCA dump handling
ptp: ocp: Limit signal/freq counts in summary output functions
bridge: netfilter: Fix forwarding of fragmented packets
ice: fix vf->num_mac count with port representors
ice: Fix LACP bonds without SRIOV environment
idpf: fix null-ptr-deref in idpf_features_check
loop: don't require ->write_iter for writable files in loop_configure
pinctrl: qcom: switch to devm_register_sys_off_handler()
net: dwmac-sun8i: Use parsed internal PHY address instead of 1
net: lan743x: Restore SGMII CTRL register on resume
io_uring: fix overflow resched cqe reordering
idpf: fix idpf_vport_splitq_napi_poll()
sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()
octeontx2-pf: Add AF_XDP non-zero copy support
net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done
octeontx2-af: Set LMT_ENA bit for APR table entries
octeontx2-af: Fix APR entry mapping based on APR_LMT_CFG
clk: s2mps11: initialise clk_hw_onecell_data::num before accessing ::hws[] in probe()
crypto: algif_hash - fix double free in hash_accept
padata: do not leak refcount in reorder_work
can: slcan: allow reception of short error messages
can: bcm: add locking for bcm_op runtime updates
can: bcm: add missing rcu read protection for procfs content
ASoC: SOF: ipc4-control: Use SOF_CTRL_CMD_BINARY as numid for bytes_ext
ASoC: SOF: Intel: hda-bus: Use PIO mode on ACE2+ platforms
ASoc: SOF: topology: connect DAI to a single DAI link
ASoC: SOF: ipc4-pcm: Delay reporting is only supported for playback direction
ALSA: pcm: Fix race of buffer access at PCM OSS layer
ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14ASP10
llc: fix data loss when reading from a socket in llc_ui_recvmsg()
can: kvaser_pciefd: Continue parsing DMA buf after dropped RX
can: kvaser_pciefd: Fix echo_skb race
net: dsa: microchip: linearize skb for tail-tagging switches
vmxnet3: update MTU after device quiesce
pmdomain: renesas: rcar: Remove obsolete nullify checks
pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id()
platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store()
thermal: intel: x86_pkg_temp_thermal: Fix bogus trip temperature
drm/edid: fixed the bug that hdr metadata was not reset
smb: client: Fix use-after-free in cifs_fill_dirent
arm64: dts: marvell: uDPU: define pinctrl state for alarm LEDs
smb: client: Reset all search buffer pointers when releasing buffer
Revert "drm/amd: Keep display off while going into S4"
Input: xpad - add more controllers
highmem: add folio_test_partial_kmap()
memcg: always call cond_resched() after fn()
mm/page_alloc.c: avoid infinite retries caused by cpuset race
mm: mmap: map MAP_STACK to VM_NOHUGEPAGE only if THP is enabled
mm: vmalloc: actually use the in-place vrealloc region
mm: vmalloc: only zero-init on vrealloc shrink
nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs()
Bluetooth: btmtksdio: Check function enabled before doing close
Bluetooth: btmtksdio: Do close if SDIO card removed without close
Revert "arm64: dts: allwinner: h6: Use RSB for AXP805 PMIC connection"
ksmbd: fix stream write failure
platform/x86: think-lmi: Fix attribute name usage for non-compliant items
spi: use container_of_cont() for to_spi_device()
spi: spi-fsl-dspi: restrict register range for regmap access
spi: spi-fsl-dspi: Halt the module after a new message transfer
spi: spi-fsl-dspi: Reset SR flags before sending a new message
err.h: move IOMEM_ERR_PTR() to err.h
gcc-15: make 'unterminated string initialization' just a warning
gcc-15: disable '-Wunterminated-string-initialization' entirely for now
Fix mis-uses of 'cc-option' for warning disablement
kbuild: Properly disable -Wunterminated-string-initialization for clang
drm/amd/display: Exit idle optimizations before accessing PHY
bpf: abort verification if env->cur_state->loop_entry != NULL
serial: sh-sci: Save and restore more registers
drm/amdkfd: Correct F8_MODE for gfx950
watchdog: aspeed: fix 64-bit division
pinctrl: tegra: Fix off by one in tegra_pinctrl_get_group()
i3c: master: svc: Fix implicit fallthrough in svc_i3c_master_ibi_work()
x86/mm/init: Handle the special case of device private pages in add_pages(), to not increase max_pfn and trigger dma_addressing_limited() bounce buffers bounce buffers
drm/gem: Internally test import_attach for imported objects
Linux 6.12.31
Change-Id: I017795966fb764f9320a6a0df1571d19e5e631fe
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Steps on the way to 6.12.31
Resolves merge conflicts in:
kernel/sched/fair.c
Change-Id: I545f90ce44822f1a0f940be224258533b6581077
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Steps on the way to 6.12.31
Resolves merge conflicts in:
drivers/media/usb/uvc/uvc_ctrl.c
Change-Id: I663a7a27e554e5a9d426532ff17f7dffc9619d22
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit 94bde253d3ae5d8a01cb958663b12daef1d06574 ]
There is currently some confusion in the s390x JIT regarding whether
orig_call can be NULL and what that means. Originally the NULL value
was used to distinguish the struct_ops case, but this was superseded by
BPF_TRAMP_F_INDIRECT (see commit 0c970ed2f8 ("s390/bpf: Fix indirect
trampoline generation").
The remaining reason to have this check is that NULL can actually be
passed to the arch_bpf_trampoline_size() call - but not to the
respective arch_prepare_bpf_trampoline()! call - by
bpf_struct_ops_prepare_trampoline().
Remove this asymmetry by passing stub_func to both functions, so that
JITs may rely on orig_call never being NULL.
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Acked-by: Martin KaFai Lau <martin.lau@kernel.org>
Link: https://lore.kernel.org/r/20250512221911.61314-2-iii@linux.ibm.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 86bc9c742426a16b52a10ef61f5b721aecca2344 ]
syzkaller reported an issue:
WARNING: CPU: 3 PID: 217 at kernel/bpf/core.c:2357 __bpf_prog_ret0_warn+0xa/0x20 kernel/bpf/core.c:2357
Modules linked in:
CPU: 3 UID: 0 PID: 217 Comm: kworker/u32:6 Not tainted 6.15.0-rc4-syzkaller-00040-g8bac8898fe39
RIP: 0010:__bpf_prog_ret0_warn+0xa/0x20 kernel/bpf/core.c:2357
Call Trace:
<TASK>
bpf_dispatcher_nop_func include/linux/bpf.h:1316 [inline]
__bpf_prog_run include/linux/filter.h:718 [inline]
bpf_prog_run include/linux/filter.h:725 [inline]
cls_bpf_classify+0x74a/0x1110 net/sched/cls_bpf.c:105
...
When creating bpf program, 'fp->jit_requested' depends on bpf_jit_enable.
This issue is triggered because of CONFIG_BPF_JIT_ALWAYS_ON is not set
and bpf_jit_enable is set to 1, causing the arch to attempt JIT the prog,
but jit failed due to FAULT_INJECTION. As a result, incorrectly
treats the program as valid, when the program runs it calls
`__bpf_prog_ret0_warn` and triggers the WARN_ON_ONCE(1).
Reported-by: syzbot+0903f6d7f285e41cdf10@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/bpf/6816e34e.a70a0220.254cdc.002c.GAE@google.com
Fixes: fa9dd599b4 ("bpf: get rid of pure_initcall dependency to enable jits")
Signed-off-by: KaFai Wan <mannkafai@gmail.com>
Link: https://lore.kernel.org/r/20250526133358.2594176-1-mannkafai@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 714070c4cb7a10ff57450a618a936775f3036245 ]
In the current implementation if the program is dev-bound to a specific
device, it will not be possible to perform XDP_REDIRECT into a DEVMAP
or CPUMAP even if the program is running in the driver NAPI context and
it is not attached to any map entry. This seems in contrast with the
explanation available in bpf_prog_map_compatible routine.
Fix the issue introducing __bpf_prog_map_compatible utility routine in
order to avoid bpf_prog_is_dev_bound() check running bpf_check_tail_call()
at program load time (bpf_prog_select_runtime()).
Continue forbidding to attach a dev-bound program to XDP maps
(BPF_MAP_TYPE_PROG_ARRAY, BPF_MAP_TYPE_DEVMAP and BPF_MAP_TYPE_CPUMAP).
Fixes: 3d76a4d3d4 ("bpf: XDP metadata RX kfuncs")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Acked-by: Stanislav Fomichev <sdf@fomichev.me>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 12fdd29d5d71d2987a1aec434b704d850a4d7fcb ]
In commit 1611603537 ("bpf: Create argument information for nullable arguments."),
it introduced a "__nullable" tagging at the argument name of a
stub function. Some background on the commit:
it requires to tag the stub function instead of directly tagging
the "ops" of a struct. This is because the btf func_proto of the "ops"
does not have the argument name and the "__nullable" is tagged at
the argument name.
To find the stub function of a "ops", it currently relies on a naming
convention on the stub function "st_ops__ops_name".
e.g. tcp_congestion_ops__ssthresh. However, the new kernel
sub system implementing bpf_struct_ops have missed this and
have been surprised that the "__nullable" and the to-be-landed
"__ref" tagging was not effective.
One option would be to give a warning whenever the stub function does
not follow the naming convention, regardless if it requires arg tagging
or not.
Instead, this patch uses the kallsyms_lookup approach and removes
the requirement on the naming convention. The st_ops->cfi_stubs has
all the stub function kernel addresses. kallsyms_lookup() is used to
lookup the function name. With the function name, BTF can be used to
find the BTF func_proto. The existing "__nullable" arg name searching
logic will then fall through.
One notable change is,
if it failed in kallsyms_lookup or it failed in looking up the stub
function name from the BTF, the bpf_struct_ops registration will fail.
This is different from the previous behavior that it silently ignored
the "st_ops__ops_name" function not found error.
The "tcp_congestion_ops", "sched_ext_ops", and "hid_bpf_ops" can still be
registered successfully after this patch. There is struct_ops_maybe_null
selftest to cover the "__nullable" tagging.
Other minor changes:
1. Removed the "%s__%s" format from the pr_warn because the naming
convention is removed.
2. The existing bpf_struct_ops_supported() is also moved earlier
because prepare_arg_info needs to use it to decide if the
stub function is NULL before calling the prepare_arg_info.
Cc: Tejun Heo <tj@kernel.org>
Cc: Benjamin Tissoires <bentiss@kernel.org>
Cc: Yonghong Song <yonghong.song@linux.dev>
Cc: Amery Hung <ameryhung@gmail.com>
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Reviewed-by: Amery Hung <ameryhung@gmail.com>
Link: https://lore.kernel.org/r/20250127222719.2544255-1-martin.lau@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit d519594ee2445d7cd1ad51f4db4cee58f8213400 ]
Currently, add_kfunc_call() is only invoked once before the main
verification loop. Therefore, the verifier could not find the
bpf_kfunc_btf_tab of a new kfunc call which is not seen in user defined
struct_ops operators but introduced in gen_prologue or gen_epilogue
during do_misc_fixup(). Fix this by searching kfuncs in the patching
instruction buffer and add them to prog->aux->kfunc_tab.
Signed-off-by: Amery Hung <amery.hung@bytedance.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Acked-by: Martin KaFai Lau <martin.lau@kernel.org>
Link: https://lore.kernel.org/r/20250225233545.285481-1-ameryhung@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 4b82b181a26cff8bf7adc3a85a88d121d92edeaf ]
Currently for bpf progs in a cgroup hierarchy, the effective prog array
is computed from bottom cgroup to upper cgroups (post-ordering). For
example, the following cgroup hierarchy
root cgroup: p1, p2
subcgroup: p3, p4
have BPF_F_ALLOW_MULTI for both cgroup levels.
The effective cgroup array ordering looks like
p3 p4 p1 p2
and at run time, progs will execute based on that order.
But in some cases, it is desirable to have root prog executes earlier than
children progs (pre-ordering). For example,
- prog p1 intends to collect original pkt dest addresses.
- prog p3 will modify original pkt dest addresses to a proxy address for
security reason.
The end result is that prog p1 gets proxy address which is not what it
wants. Putting p1 to every child cgroup is not desirable either as it
will duplicate itself in many child cgroups. And this is exactly a use case
we are encountering in Meta.
To fix this issue, let us introduce a flag BPF_F_PREORDER. If the flag
is specified at attachment time, the prog has higher priority and the
ordering with that flag will be from top to bottom (pre-ordering).
For example, in the above example,
root cgroup: p1, p2
subcgroup: p3, p4
Let us say p2 and p4 are marked with BPF_F_PREORDER. The final
effective array ordering will be
p2 p4 p3 p1
Suggested-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
Link: https://lore.kernel.org/r/20250224230116.283071-1-yonghong.song@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
GKI (arm64) relevant 69 out of 278 changes, affecting 88 files +585/-290
0b603e7759 tracing: Add __print_dynamic_array() helper [3 files, +15/-1]
0312735402 tracing: Verify event formats that have "%*p.." [2 files, +13/-2]
1c9798bf81 mm/vmscan: don't try to reclaim hwpoison folio [1 file, +7/-0]
db3b3964af PM: EM: use kfree_rcu() to simplify the code [1 file, +1/-9]
9d5752b853 PM: EM: Address RCU-related sparse warnings [2 files, +26/-25]
3e12e8c273 block: remove the write_hint field from struct request [4 files, +13/-12]
ed7535b141 block: remove the ioprio field from struct request [4 files, +11/-15]
2afa5ea7c4 block: make sure ->nr_integrity_segments is cloned in blk_rq_prep_clone [1 file, +1/-0]
46d3575209 PCI/MSI: Handle the NOMASK flag correctly for all PCI/MSI backends [1 file, +6/-12]
35ba7b2d4d PCI/MSI: Add an option to write MSIX ENTRY_DATA before any reads [2 files, +5/-0]
16c8aa5de1 dma/contiguous: avoid warning about unused size_bytes [1 file, +1/-2]
7ccfadfb25 cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() [1 file, +8/-2]
28fbd7b13b cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() [1 file, +10/-3]
7d002f5914 scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort() [1 file, +5/-7]
5d92e582d1 cgroup/cpuset-v1: Add missing support for cpuset_v2_mode [1 file, +29/-0]
29daa63f2c scsi: core: Clear flags for scsi_cmnd that did not complete [1 file, +5/-1]
eeab661803 scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer() [1 file, +2/-0]
41143e7105 net: phy: leds: fix memory leak [1 file, +13/-10]
0ceef62a32 tipc: fix NULL pointer dereference in tipc_mon_reinit_self() [1 file, +2/-1]
a61afd5482 fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount() [1 file, +36/-33]
7f24ea6a46 block: never reduce ra_pages in blk_apply_bdi_limits [1 file, +7/-1]
3decda1a3c splice: remove duplicate noinline from pipe_clear_nowait [1 file, +1/-1]
30c0d6e778 virtio_console: fix missing byte order handling for cols and rows [1 file, +4/-3]
c2a6b4d78c net: selftests: initialize TCP header and skb payload with zero [1 file, +13/-5]
3939d6f29d irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() [1 file, +1/-1]
7a8a6b627f io_uring: fix 'sync' handling of io_fallback_tw() [1 file, +7/-6]
1f439fe4d8 scsi: Improve CDL control [1 file, +24/-12]
3670dee376 char: misc: register chrdev region with all possible minors [1 file, +1/-1]
ea0d806b94 USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe [2 files, +7/-0]
1777714865 xhci: Limit time spent with xHC interrupts disabled during bus resume [3 files, +20/-16]
bce3055b08 usb: xhci: Fix invalid pointer dereference in Etron workaround [1 file, +1/-1]
52a7c9d930 usb: dwc3: gadget: check that event count does not exceed event buffer length [1 file, +6/-0]
9924ee1bcd usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive [1 file, +3/-0]
d85b7af3bd usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive [1 file, +3/-0]
3e52ae347e USB: VLI disk crashes if LPM is used [1 file, +3/-0]
0486de3c1b crypto: null - Use spin lock instead of mutex [1 file, +26/-13]
7758e308ae bpf: Fix kmemleak warning for percpu hashmap [1 file, +3/-3]
c5c833f637 bpf: Fix deadlock between rcu_tasks_trace and event_mutex. [1 file, +4/-3]
4139072087 clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec() [1 file, +4/-0]
4131411f42 bpf: Only fails the busy counter check in bpf_cgrp_storage_get if it creates storage [1 file, +6/-5]
b817d2bfd6 bpf: Reject attaching fexit/fmod_ret to __noreturn functions [1 file, +32/-0]
2ecae00138 usb: dwc3: gadget: Refactor loop to avoid NULL endpoints [1 file, +18/-4]
cbfa55bda1 usb: xhci: Complete 'error mid TD' transfers when handling Missed Service [1 file, +5/-1]
16a7a8e6c4 usb: xhci: Fix isochronous Ring Underrun/Overrun event handling [1 file, +14/-6]
635be13606 xhci: Handle spurious events on Etron host isoc enpoints [2 files, +27/-13]
9ff59cb815 usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running [1 file, +7/-4]
0485bdf88f objtool, panic: Disable SMAP in __stack_chk_fail() [2 files, +10/-1]
c548f95688 9p/net: fix improper handling of bogus negative read/write replies [1 file, +16/-14]
18296b5951 9p/trans_fd: mark concurrent read and writes to p9_conn->err [1 file, +10/-7]
3568fd9e44 io_uring: always do atomic put from iowq [2 files, +8/-1]
90dc6c1e3b perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init [1 file, +3/-3]
24ede35eb2 nvme: requeue namespace scan on missed AENs [1 file, +4/-0]
b9c89c97d7 nvme: re-read ANA log page after ns scan completes [1 file, +5/-0]
ee5521176a nvme: multipath: fix return value of nvme_available_path [1 file, +1/-1]
5e58b93a12 gpiolib: of: Move Atmel HSMCI quirk up out of the regulator comment [1 file, +3/-3]
9f8eeac3a6 timekeeping: Add a lockdep override in tick_freeze() [1 file, +22/-0]
b14d986413 iommu: Clear iommu-dma ops on cleanup [1 file, +3/-0]
b626bc3c1d ext4: make block validity check resistent to sb bh corruption [2 files, +6/-6]
2ef6eea2ef netfs: Only create /proc/fs/netfs with CONFIG_PROC_FS [1 file, +4/-0]
d53b2d49a8 iomap: skip unnecessary ifs_block_is_uptodate check [1 file, +1/-1]
bfc66c4c28 Revert "drivers: core: synchronize really_probe() and dev_uevent()" [1 file, +0/-3]
de7c24febd usb: typec: class: Fix NULL pointer access [2 files, +14/-2]
45314999f9 ext4: goto right label 'out_mmap_sem' in ext4_setattr() [1 file, +1/-1]
40966fc993 usb: typec: class: Invalidate USB device pointers on partner unregistration [1 file, +6/-2]
4833d0a92b iommu: Handle race with default domain setup [1 file, +5/-0]
1042d22942 nvme: fixup scan failure for non-ANA multipath controllers [1 file, +1/-1]
1b7647efad usb: xhci: Fix Short Packet handling rework ignoring errors [1 file, +1/-1]
ab5281d21e usb: typec: class: Unlocked on error in typec_register_partner() [1 file, +1/-0]
6b9ebcbd31 mq-deadline: don't call req_get_ioprio from the I/O completion handler [1 file, +4/-9]
Changes in 6.12.26
module: sign with sha512 instead of sha1 by default
tracing: Add __print_dynamic_array() helper
tracing: Verify event formats that have "%*p.."
mm/vmscan: don't try to reclaim hwpoison folio
soc: qcom: ice: introduce devm_of_qcom_ice_get
mmc: sdhci-msm: fix dev reference leaked through of_qcom_ice_get
PM: EM: use kfree_rcu() to simplify the code
PM: EM: Address RCU-related sparse warnings
media: i2c: imx214: Use subdev active state
media: i2c: imx214: Simplify with dev_err_probe()
media: i2c: imx214: Convert to CCI register access helpers
media: i2c: imx214: Replace register addresses with macros
media: i2c: imx214: Check number of lanes from device tree
media: i2c: imx214: Fix link frequency validation
media: ov08x40: Move ov08x40_identify_module() function up
media: ov08x40: Add missing ov08x40_identify_module() call on stream-start
block: remove the write_hint field from struct request
block: remove the ioprio field from struct request
block: make sure ->nr_integrity_segments is cloned in blk_rq_prep_clone
net: dsa: mv88e6xxx: fix VTU methods for 6320 family
iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary return value check
iio: adc: ad7768-1: Fix conversion result sign
arm64: dts: ti: Refactor J784s4 SoC files to a common file
arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix serdes_ln_ctrl reg-masks
of: resolver: Simplify of_resolve_phandles() using __free()
of: resolver: Fix device node refcount leakage in of_resolve_phandles()
scsi: ufs: qcom: fix dev reference leaked through of_qcom_ice_get
PCI/MSI: Convert pci_msi_ignore_mask to per MSI domain flag
PCI/MSI: Handle the NOMASK flag correctly for all PCI/MSI backends
PCI/MSI: Add an option to write MSIX ENTRY_DATA before any reads
accel/ivpu: Add auto selection logic for job scheduler
accel/ivpu: Fix the NPU's DPU frequency calculation
ksmbd: use __GFP_RETRY_MAYFAIL
ksmbd: add netdev-up/down event debug print
ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL
ksmbd: fix use-after-free in __smb2_lease_break_noti()
scsi: ufs: exynos: Remove empty drv_init method
scsi: ufs: exynos: Remove superfluous function parameter
scsi: ufs: exynos: Add gs101_ufs_drv_init() hook and enable WriteBooster
scsi: ufs: exynos: Move UFS shareability value to drvdata
scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set
net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads
drm/xe/bmg: Add one additional PCI ID
drm/amd/display: Fix unnecessary cast warnings from checkpatch
drm/amd/display/dml2: use vzalloc rather than kzalloc
lib/Kconfig.ubsan: Remove 'default UBSAN' from UBSAN_INTEGER_WRAP
ceph: Fix incorrect flush end position calculation
cpufreq: sun50i: prevent out-of-bounds access
dma/contiguous: avoid warning about unused size_bytes
cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate()
cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate()
cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate()
scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort()
cpufreq: cppc: Fix invalid return value in .get() callback
cpufreq: Do not enable by default during compile testing
cpufreq: fix compile-test defaults
btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range()
btrfs: zoned: return EIO on RAID1 block group write pointer mismatch
cgroup/cpuset-v1: Add missing support for cpuset_v2_mode
vhost-scsi: Add better resource allocation failure handling
vhost-scsi: Fix vhost_scsi_send_bad_target()
vhost-scsi: Fix vhost_scsi_send_status()
net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table()
net/mlx5: Move ttc allocation after switch case to prevent leaks
scsi: core: Clear flags for scsi_cmnd that did not complete
scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer()
net: lwtunnel: disable BHs when required
net: phy: leds: fix memory leak
tipc: fix NULL pointer dereference in tipc_mon_reinit_self()
net: ethernet: mtk_eth_soc: net: revise NETSYSv3 hardware configuration
fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount()
net_sched: hfsc: Fix a UAF vulnerability in class handling
net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too
net: dsa: mt7530: sync driver-specific behavior of MT7531 variants
pds_core: Prevent possible adminq overflow/stuck condition
pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result
pds_core: Remove unnecessary check in pds_client_adminq_cmd()
pds_core: make wait_context part of q_info
block: never reduce ra_pages in blk_apply_bdi_limits
iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE
riscv: Replace function-like macro by static inline function
riscv: uprobes: Add missing fence.i after building the XOL buffer
splice: remove duplicate noinline from pipe_clear_nowait
bpf: Add namespace to BPF internal symbols
perf/x86: Fix non-sampling (counting) events on certain x86 platforms
LoongArch: Select ARCH_USE_MEMTEST
LoongArch: Make regs_irqs_disabled() more clear
LoongArch: Make do_xyz() exception handlers more robust
KVM: SVM: Disable AVIC on SNP-enabled system without HvInUseWrAllowed feature
netfilter: fib: avoid lookup if socket is available
virtio_console: fix missing byte order handling for cols and rows
sched_ext: Use kvzalloc for large exit_dump allocation
crypto: atmel-sha204a - Set hwrng quality to lowest possible
xen-netfront: handle NULL returned by xdp_convert_buff_to_frame()
net: selftests: initialize TCP header and skb payload with zero
net: phy: microchip: force IRQ polling mode for lan88xx
scsi: mpi3mr: Fix pending I/O counter
rust: firmware: Use `ffi::c_char` type in `FwFunc`
drm: panel: jd9365da: fix reset signal polarity in unprepare
drm/amd/display: Fix gpu reset in multidisplay config
drm/amd/display: Force full update in gpu reset
x86/insn: Fix CTEST instruction decoding
irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()
LoongArch: Handle fp, lsx, lasx and lbt assembly symbols
LoongArch: Return NULL from huge_pte_offset() for invalid PMD
LoongArch: Remove a bogus reference to ZONE_DMA
LoongArch: KVM: Fully clear some CSRs when VM reboot
LoongArch: KVM: Fix PMU pass-through issue if VM exits to host finally
io_uring: fix 'sync' handling of io_fallback_tw()
KVM: SVM: Allocate IR data using atomic allocation
cxl/core/regs.c: Skip Memory Space Enable check for RCD and RCH Ports
mcb: fix a double free bug in chameleon_parse_gdd()
ata: libata-scsi: Improve CDL control
ata: libata-scsi: Fix ata_mselect_control_ata_feature() return type
ata: libata-scsi: Fix ata_msense_control_ata_feature()
USB: storage: quirk for ADATA Portable HDD CH94
scsi: Improve CDL control
mei: me: add panther lake H DID
mei: vsc: Fix fortify-panic caused by invalid counted_by() use
KVM: x86: Explicitly treat routing entry type changes as changes
KVM: x86: Reset IRTE to host control if *new* route isn't postable
KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer
char: misc: register chrdev region with all possible minors
misc: microchip: pci1xxxx: Fix Kernel panic during IRQ handler registration
misc: microchip: pci1xxxx: Fix incorrect IRQ status handling during ack
firmware: stratix10-svc: Add of_platform_default_populate()
tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT
serial: msm: Configure correct working mode before starting earlycon
serial: sifive: lock port in startup()/shutdown() callbacks
USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe
USB: serial: option: add Sierra Wireless EM9291
USB: serial: simple: add OWON HDS200 series oscilloscope support
xhci: Limit time spent with xHC interrupts disabled during bus resume
usb: xhci: Fix invalid pointer dereference in Etron workaround
usb: cdns3: Fix deadlock when using NCM gadget
usb: chipidea: ci_hdrc_imx: fix usbmisc handling
usb: chipidea: ci_hdrc_imx: fix call balance of regulator routines
usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling
USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02)
usb: dwc3: gadget: check that event count does not exceed event buffer length
usb: dwc3: xilinx: Prevent spike in reset signal
usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive
usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive
USB: VLI disk crashes if LPM is used
USB: wdm: handle IO errors in wdm_wwan_port_start
USB: wdm: close race between wdm_open and wdm_wwan_port_stop
USB: wdm: wdm_wwan_port_tx_complete mutex in atomic context
USB: wdm: add annotation
selftests/bpf: Fix stdout race condition in traffic monitor
pinctrl: renesas: rza2: Fix potential NULL pointer dereference
pinctrl: mcp23s08: Get rid of spurious level interrupts
MIPS: cm: Detect CM quirks from device tree
crypto: ccp - Add support for PCI device 0x1134
crypto: lib/Kconfig - Fix lib built-in failure when arch is modular
crypto: null - Use spin lock instead of mutex
bpf: Fix kmemleak warning for percpu hashmap
bpf: Fix deadlock between rcu_tasks_trace and event_mutex.
clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec()
parisc: PDT: Fix missing prototype warning
s390/sclp: Add check for get_zeroed_page()
s390/tty: Fix a potential memory leak bug
bpf: bpftool: Setting error code in do_loader()
bpf: Only fails the busy counter check in bpf_cgrp_storage_get if it creates storage
bpf: Reject attaching fexit/fmod_ret to __noreturn functions
mailbox: pcc: Fix the possible race in updation of chan_in_use flag
mailbox: pcc: Always clear the platform ack interrupt first
usb: host: max3421-hcd: Add missing spi_device_id table
fs/ntfs3: Keep write operations atomic
fs/ntfs3: Fix WARNING in ntfs_extend_initialized_size
usb: dwc3: gadget: Refactor loop to avoid NULL endpoints
usb: dwc3: gadget: Avoid using reserved endpoints on Intel Merrifield
sound/virtio: Fix cancel_sync warnings on uninitialized work_structs
usb: xhci: Complete 'error mid TD' transfers when handling Missed Service
usb: xhci: Fix isochronous Ring Underrun/Overrun event handling
xhci: Handle spurious events on Etron host isoc enpoints
i3c: master: svc: Add support for Nuvoton npcm845 i3c
dmaengine: dmatest: Fix dmatest waiting less when interrupted
usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running
phy: rockchip: usbdp: Avoid call hpd_event_trigger in dp_phy_init
usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev()
usb: host: xhci-plat: mvebu: use ->quirks instead of ->init_quirk() func
thunderbolt: Scan retimers after device router has been enumerated
um: work around sched_yield not yielding in time-travel mode
objtool: Silence more KCOV warnings
objtool, panic: Disable SMAP in __stack_chk_fail()
objtool, ASoC: codecs: wcd934x: Remove potential undefined behavior in wcd934x_slim_irq_handler()
objtool, regulator: rk808: Remove potential undefined behavior in rk806_set_mode_dcdc()
objtool, lkdtm: Obfuscate the do_nothing() pointer
qibfs: fix _another_ leak
ntb: reduce stack usage in idt_scan_mws
ntb_hw_amd: Add NTB PCI ID for new gen CPU
9p/net: fix improper handling of bogus negative read/write replies
9p/trans_fd: mark concurrent read and writes to p9_conn->err
rtc: pcf85063: do a SW reset if POR failed
io_uring: always do atomic put from iowq
kbuild: add dependency from vmlinux to sorttable
sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP
KVM: s390: Don't use %pK through tracepoints
KVM: s390: Don't use %pK through debug printing
cgroup/cpuset: Don't allow creation of local partition over a remote one
selftests: ublk: fix test_stripe_04
perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init
xen: Change xen-acpi-processor dom0 dependency
nvme: requeue namespace scan on missed AENs
ACPI: EC: Set ec_no_wakeup for Lenovo Go S
ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls
drm/amdgpu: Increase KIQ invalidate_tlbs timeout
drm/xe/xe3lpg: Apply Wa_14022293748, Wa_22019794406
nvme: re-read ANA log page after ns scan completes
nvme: multipath: fix return value of nvme_available_path
objtool: Stop UNRET validation on UD2
gpiolib: of: Move Atmel HSMCI quirk up out of the regulator comment
x86/xen: disable CPU idle and frequency drivers for PVH dom0
selftests/mincore: Allow read-ahead pages to reach the end of the file
x86/bugs: Use SBPB in write_ibpb() if applicable
x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline
x86/bugs: Don't fill RSB on context switch with eIBRS
nvmet-fc: take tgtport reference only once
nvmet-fc: put ref when assoc->del_work is already scheduled
cifs: Fix encoding of SMB1 Session Setup Kerberos Request in non-UNICODE mode
timekeeping: Add a lockdep override in tick_freeze()
cifs: Fix querying of WSL CHR and BLK reparse points over SMB1
iommu: Clear iommu-dma ops on cleanup
ext4: make block validity check resistent to sb bh corruption
scsi: hisi_sas: Fix I/O errors caused by hardware port ID changes
scsi: ufs: exynos: Ensure pre_link() executes before exynos_ufs_phy_init()
scsi: ufs: exynos: Enable PRDT pre-fetching with UFSHCD_CAP_CRYPTO
scsi: ufs: exynos: Move phy calls to .exit() callback
scsi: ufs: exynos: gs101: Put UFS device in reset on .suspend()
scsi: pm80xx: Set phy_attached to zero when device is gone
ASoC: fsl_asrc_dma: get codec or cpu dai from backend
x86/i8253: Call clockevent_i8253_disable() with interrupts disabled
netfs: Only create /proc/fs/netfs with CONFIG_PROC_FS
iomap: skip unnecessary ifs_block_is_uptodate check
riscv: Provide all alternative macros all the time
ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING"
spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts
spi: tegra210-quad: add rate limiting and simplify timeout error message
ubsan: Fix panic from test_ubsan_out_of_bounds
x86/cpu: Add CPU model number for Bartlett Lake CPUs with Raptor Cove cores
md/raid1: Add check for missing source disk in process_checks()
drm/amdgpu: use a dummy owner for sysfs triggered cleaner shaders v4
drm/amdgpu: Use the right function for hdp flush
spi: spi-imx: Add check for spi_imx_setupxfer()
Revert "drivers: core: synchronize really_probe() and dev_uevent()"
driver core: introduce device_set_driver() helper
driver core: fix potential NULL pointer dereference in dev_uevent()
xfs: do not check NEEDSREPAIR if ro,norecovery mount.
xfs: Do not allow norecovery mount with quotacheck
xfs: rename xfs_iomap_swapfile_activate to xfs_vm_swap_activate
xfs: flush inodegc before swapon
selftests/bpf: fix bpf_map_redirect call for cpu map test
selftests/bpf: make xdp_cpumap_attach keep redirect prog attached
selftests/bpf: check program redirect in xdp_cpumap_attach
selftests/bpf: Adjust data size to have ETH_HLEN
usb: typec: class: Fix NULL pointer access
vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp
comedi: jr3_pci: Fix synchronous deletion of timer
ext4: goto right label 'out_mmap_sem' in ext4_setattr()
usb: typec: class: Invalidate USB device pointers on partner unregistration
Revert "net: dsa: mv88e6xxx: fix internal PHYs for 6320 family"
net: dsa: mv88e6xxx: fix atu_move_port_mask for 6341 family
net: dsa: mv88e6xxx: enable PVT for 6321 switch
net: dsa: mv88e6xxx: enable .port_set_policy() for 6320 family
net: dsa: mv88e6xxx: enable STU methods for 6320 family
iommu: Handle race with default domain setup
crypto: lib/Kconfig - Hide arch options from user
media: i2c: imx214: Fix uninitialized variable in imx214_set_ctrl()
MIPS: cm: Fix warning if MIPS_CM is disabled
nvme: fixup scan failure for non-ANA multipath controllers
usb: xhci: Fix Short Packet handling rework ignoring errors
objtool: Ignore end-of-section jumps for KCOV/GCOV
objtool: Silence more KCOV warnings, part 2
usb: typec: class: Unlocked on error in typec_register_partner()
crypto: Kconfig - Select LIB generic option
arm64: dts: ti: k3-j784s4-j742s2-main-common: Correct the GICD size
mq-deadline: don't call req_get_ioprio from the I/O completion handler
Linux 6.12.26
Change-Id: Iff5be8c388b8b915652fafb787156a4653f060aa
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This reverts commit 1d572c6048 which is
commit 51081a3f25c742da5a659d7fc6fd77ebfdd555be upstream.
It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.
Bug: 161946584
Change-Id: I3c570f3e9aa480007914e6ad7a166afe1dbfba55
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This reverts commit 3846e2bea5 which is
commit 81f6d0530ba031b5f038a091619bf2ff29568852 upstream.
It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.
Bug: 161946584
Change-Id: Iad790b1cf2b6235887063f8cd4f531a0eea52e9c
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This reverts commit f0946dcccb which is
commit ac6542ad92759cda383ad62b4e4cbfc28136abc1 upstream.
It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.
Bug: 161946584
Change-Id: I118af20de9e39a79659ec9d336a807f7c05a3411
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
GKI (arm64) relevant 33 out of 218 changes, affecting 50 files +373/-248
5ec9039702 driver core: bus: add irq_get_affinity callback to bus_type [1 file, +3/-0]
fe2bdefe86 blk-mq: introduce blk_mq_map_hw_queues [2 files, +39/-0]
6ad0acb56b Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address [1 file, +3/-2]
d49798ecd2 Bluetooth: l2cap: Check encryption key size on incoming connection [1 file, +2/-1]
b02c2ac2f3 ipv6: add exception routes to GC list in rt6_insert_exception [1 file, +1/-0]
61765e1b41 ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll() [1 file, +1/-1]
41e43134dd block: fix resource leak in blk_register_queue() error path [1 file, +2/-0]
0175902f6e loop: aio inherit the ioprio of original request [1 file, +1/-1]
78253d44e9 loop: stop using vfs_iter_{read,write} for buffered I/O [1 file, +17/-95]
28da4dd840 writeback: fix false warning in inode_to_wb() [1 file, +1/-0]
f2e2926e9e Revert "PCI: Avoid reset when disabled via sysfs" [1 file, +0/-4]
569bbe2fc7 Bluetooth: l2cap: Process valid commands in too long frame [1 file, +17/-1]
694521cb3f loop: properly send KOBJ_CHANGED uevent for disk device [1 file, +2/-2]
c45ba83935 loop: LOOP_SET_FD: send uevents for partitions [1 file, +2/-1]
4f34d6f979 mm/compaction: fix bug in hugetlb handling pathway [1 file, +3/-3]
b609a60e31 mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() [1 file, +2/-2]
8338e0723f mm: fix filemap_get_folios_contig returning batches of identical folios [1 file, +1/-0]
029458063e mm: fix apply_to_existing_page_range() [1 file, +2/-2]
b9e3579213 ovl: don't allow datadir only [1 file, +5/-0]
8baa747193 slab: ensure slab->obj_exts is clear in a newly allocated slab page [1 file, +10/-0]
5f878db827 string: Add load_unaligned_zeropad() code path to sized_strscpy() [1 file, +10/-3]
5683eaf4ee tracing: Fix filter string testing [1 file, +2/-2]
c3e31d6139 virtiofs: add filesystem context source name check [1 file, +3/-0]
c1a485c46c cpufreq: Reference count policy in cpufreq_update_limits() [1 file, +8/-0]
5b34f40cda block: remove rq_list_move [1 file, +0/-17]
2ad0f19a4e block: add a rq_list type [11 files, +104/-88]
7e2d224939 block: don't reorder requests in blk_add_rq_to_plug [3 files, +4/-4]
b906c1ad25 mm/vma: add give_up_on_oom option on modify/merge, use in uffd release [3 files, +53/-7]
d30b9c5950 bpf: add find_containing_subprog() utility function [1 file, +24/-4]
1d572c6048 bpf: track changes_pkt_data property for global functions [2 files, +32/-1]
3846e2bea5 bpf: check changes_pkt_data property for extension programs [2 files, +13/-4]
f0946dcccb bpf: fix null dereference when computing changes_pkt_data of prog w/o subprogs [1 file, +5/-2]
f78507c1ef block: make struct rq_list available for !CONFIG_BLOCK [1 file, +1/-1]
Changes in 6.12.25
scsi: hisi_sas: Enable force phy when SATA disk directly connected
wifi: at76c50x: fix use after free access in at76_disconnect
wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()
wifi: mac80211: Purge vif txq in ieee80211_do_stop()
wifi: wl1251: fix memory leak in wl1251_tx_work
scsi: iscsi: Fix missing scsi_host_put() in error path
driver core: bus: add irq_get_affinity callback to bus_type
blk-mq: introduce blk_mq_map_hw_queues
scsi: replace blk_mq_pci_map_queues with blk_mq_map_hw_queues
scsi: smartpqi: Use is_kdump_kernel() to check for kdump
md/raid10: fix missing discard IO accounting
md/md-bitmap: fix stats collection for external bitmaps
ASoC: dwc: always enable/disable i2s irqs
ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe()
crypto: tegra - remove redundant error check on ret
crypto: tegra - Do not use fixed size buffers
crypto: tegra - Fix IV usage for AES ECB
ovl: remove unused forward declaration
RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe()
RDMA/hns: Fix wrong maximum DMA segment size
ALSA: hda/cirrus_scodec_test: Don't select dependencies
ALSA: hda: improve bass speaker support for ASUS Zenbook UM5606WA
ALSA: hda/realtek: Workaround for resume on Dell Venue 11 Pro 7130
ALSA: hda/realtek - Fixed ASUS platform headset Mic issue
ASoC: cs42l43: Reset clamp override on jack removal
RDMA/core: Silence oversized kvmalloc() warning
Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address
Bluetooth: btrtl: Prevent potential NULL dereference
Bluetooth: l2cap: Check encryption key size on incoming connection
ipv6: add exception routes to GC list in rt6_insert_exception
xen: fix multicall debug feature
Revert "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()"
igc: fix PTM cycle trigger logic
igc: increase wait time before retrying PTM
igc: move ktime snapshot into PTM retry loop
igc: handle the IGC_PTP_ENABLED flag correctly
igc: cleanup PTP module if probe fails
igc: add lock preventing multiple simultaneous PTM transactions
dt-bindings: soc: fsl: fsl,ls1028a-reset: Fix maintainer entry
smc: Fix lockdep false-positive for IPPROTO_SMC.
test suite: use %zu to print size_t
pds_core: fix memory leak in pdsc_debugfs_add_qcq()
ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll()
net: mctp: Set SOCK_RCU_FREE
block: fix resource leak in blk_register_queue() error path
netlink: specs: ovs_vport: align with C codegen capabilities
net: openvswitch: fix nested key length validation in the set() action
can: rockchip_canfd: fix broken quirks checks
net: ngbe: fix memory leak in ngbe_probe() error path
net: ethernet: ti: am65-cpsw: fix port_np reference counting
eth: bnxt: fix missing ring index trim on error path
loop: aio inherit the ioprio of original request
loop: stop using vfs_iter_{read,write} for buffered I/O
ata: libata-sata: Save all fields from sense data descriptor
cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path
netlink: specs: rt-link: add an attr layer around alt-ifname
netlink: specs: rt-link: adjust mctp attribute naming
net: b53: enable BPDU reception for management port
net: bridge: switchdev: do not notify new brentries as changed
net: txgbe: fix memory leak in txgbe_probe() error path
net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered
net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported
net: dsa: clean up FDB, MDB, VLAN entries on unbind
net: dsa: free routing table on probe failure
net: dsa: avoid refcount warnings when ds->ops->tag_8021q_vlan_del() fails
ptp: ocp: fix start time alignment in ptp_ocp_signal_set
net: ti: icss-iep: Add pwidth configuration for perout signal
net: ti: icss-iep: Add phase offset configuration for perout signal
net: ti: icss-iep: Fix possible NULL pointer dereference for perout request
net: ethernet: mtk_eth_soc: reapply mdc divider on reset
net: ethernet: mtk_eth_soc: correct the max weight of the queue limit for 100Mbps
net: ethernet: mtk_eth_soc: revise QDMA packet scheduler settings
riscv: Use kvmalloc_array on relocation_hashtable
riscv: Properly export reserved regions in /proc/iomem
riscv: module: Fix out-of-bounds relocation access
riscv: module: Allocate PLT entries for R_RISCV_PLT32
kunit: qemu_configs: SH: Respect kunit cmdline
riscv: KGDB: Do not inline arch_kgdb_breakpoint()
riscv: KGDB: Remove ".option norvc/.option rvc" for kgdb_compiled_break
cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS
objtool/rust: add one more `noreturn` Rust function for Rust 1.86.0
rust: kasan/kbuild: fix missing flags on first build
rust: disable `clippy::needless_continue`
rust: kbuild: use `pound` to support GNU Make < 4.3
writeback: fix false warning in inode_to_wb()
Revert "PCI: Avoid reset when disabled via sysfs"
ASoC: fsl: fsl_qmc_audio: Reset audio data pointers on TRIGGER_START event
ASoC: codecs:lpass-wsa-macro: Fix vi feedback rate
ASoC: codecs:lpass-wsa-macro: Fix logic of enabling vi channels
ASoC: Intel: sof_sdw: Add quirk for Asus Zenbook S16
ASoC: qcom: Fix sc7280 lpass potential buffer overflow
asus-laptop: Fix an uninitialized variable
block: integrity: Do not call set_page_dirty_lock()
drm/v3d: Fix Indirect Dispatch configuration for V3D 7.1.6 and later
dma-buf/sw_sync: Decrement refcount on error in sw_sync_ioctl_get_deadline()
nfs: add missing selections of CONFIG_CRC32
nfsd: decrease sc_count directly if fail to queue dl_recall
i2c: atr: Fix wrong include
ftrace: fix incorrect hash size in register_ftrace_direct()
drm/msm/a6xx+: Don't let IB_SIZE overflow
Bluetooth: l2cap: Process valid commands in too long frame
Bluetooth: vhci: Avoid needless snprintf() calls
btrfs: correctly escape subvol in btrfs_show_options()
cpufreq/sched: Explicitly synchronize limits_changed flag handling
crypto: caam/qi - Fix drv_ctx refcount bug
hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key
i2c: cros-ec-tunnel: defer probe if parent EC is not present
isofs: Prevent the use of too small fid
loop: properly send KOBJ_CHANGED uevent for disk device
loop: LOOP_SET_FD: send uevents for partitions
mm/compaction: fix bug in hugetlb handling pathway
mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable()
mm: fix filemap_get_folios_contig returning batches of identical folios
mm: fix apply_to_existing_page_range()
ovl: don't allow datadir only
ksmbd: Fix dangling pointer in krb_authenticate
ksmbd: fix use-after-free in smb_break_all_levII_oplock()
ksmbd: Prevent integer overflow in calculation of deadtime
ksmbd: fix the warning from __kernel_write_iter
Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free"
Revert "smb: client: fix TCP timers deadlock after rmmod"
riscv: Avoid fortify warning in syscall_get_arguments()
selftests/mm: generate a temporary mountpoint for cgroup filesystem
slab: ensure slab->obj_exts is clear in a newly allocated slab page
smb3 client: fix open hardlink on deferred close file error
string: Add load_unaligned_zeropad() code path to sized_strscpy()
tracing: Fix filter string testing
virtiofs: add filesystem context source name check
x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches
x86/cpu/amd: Fix workaround for erratum 1054
x86/boot/sev: Avoid shared GHCB page for early memory acceptance
scsi: megaraid_sas: Block zero-length ATA VPD inquiry
scsi: ufs: exynos: Ensure consistent phy reference counts
RDMA/cma: Fix workqueue crash in cma_netevent_work_handler
RAS/AMD/ATL: Include row[13] bit in row retirement
RAS/AMD/FMPM: Get masked address
platform/x86: amd: pmf: Fix STT limits
perf/x86/intel: Allow to update user space GPRs from PEBS records
perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR
perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX
perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR
drm/repaper: fix integer overflows in repeat functions
drm/ast: Fix ast_dp connection status
drm/msm/dsi: Add check for devm_kstrdup()
drm/msm/a6xx: Fix stale rpmh votes from GPU
drm/amdgpu: Prefer shadow rom when available
drm/amd/display: prevent hang on link training fail
drm/amd: Handle being compiled without SI or CIK support better
drm/amd/display: Actually do immediate vblank disable
drm/amd/display: Increase vblank offdelay for PSR panels
drm/amd/pm: Prevent division by zero
drm/amd/pm/powerplay: Prevent division by zero
drm/amd/pm/smu11: Prevent division by zero
drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero
drm/amd/pm/swsmu/smu13/smu_v13_0: Prevent division by zero
drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero
drm/amdgpu/mes12: optimize MES pipe FW version fetching
drm/i915/vrr: Add vrr.vsync_{start, end} in vrr_params_changed
drm/xe: Use local fence in error path of xe_migrate_clear
drm/amd/display: Add HP Elitebook 645 to the quirk list for eDP on DP1
drm/amd/display: Protect FPU in dml2_validate()/dml21_validate()
drm/amd/display: Protect FPU in dml21_copy()
drm/amdgpu/mes11: optimize MES pipe FW version fetching
drm/amdgpu/dma_buf: fix page_link check
drm/nouveau: prime: fix ttm_bo_delayed_delete oops
drm/imagination: fix firmware memory leaks
drm/imagination: take paired job reference
drm/sti: remove duplicate object names
drm/xe: Fix an out-of-bounds shift when invalidating TLB
drm/i915/gvt: fix unterminated-string-initialization warning
drm/amdgpu: immediately use GTT for new allocations
drm/amd/display: Do not enable Replay and PSR while VRR is on in amdgpu_dm_commit_planes()
drm/amd/display: Protect FPU in dml2_init()/dml21_init()
drm/amd/display: Add HP Probook 445 and 465 to the quirk list for eDP on DP1
drm/xe/dma_buf: stop relying on placement in unmap
drm/xe/userptr: fix notifier vs folio deadlock
drm/xe: Set LRC addresses before guc load
drm/amdgpu: fix warning of drm_mm_clean
drm/mgag200: Fix value in <VBLKSTR> register
arm64/sysreg: Update register fields for ID_AA64MMFR0_EL1
arm64/sysreg: Add register fields for HDFGRTR2_EL2
arm64/sysreg: Add register fields for HDFGWTR2_EL2
arm64/sysreg: Add register fields for HFGITR2_EL2
arm64/sysreg: Add register fields for HFGRTR2_EL2
arm64/sysreg: Add register fields for HFGWTR2_EL2
arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9
cpufreq: Reference count policy in cpufreq_update_limits()
scripts: generate_rust_analyzer: Add ffi crate
kbuild: Add '-fno-builtin-wcslen'
platform/x86: msi-wmi-platform: Rename "data" variable
platform/x86: msi-wmi-platform: Workaround a ACPI firmware bug
md: fix mddev uaf while iterating all_mddevs list
selftests/bpf: Fix raw_tp null handling test
misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error
misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type
efi/libstub: Bump up EFI_MMAP_NR_SLACK_SLOTS to 32
LoongArch: Eliminate superfluous get_numa_distances_cnt()
drm/amd/display: Temporarily disable hostvm on DCN31
nvmet-fc: Remove unused functions
block: remove rq_list_move
block: add a rq_list type
block: don't reorder requests in blk_add_rq_to_plug
mm/vma: add give_up_on_oom option on modify/merge, use in uffd release
Revert "wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process"
MIPS: dec: Declare which_prom() as static
MIPS: cevt-ds1287: Add missing ds1287.h include
MIPS: ds1287: Match ds1287_set_base_clock() function types
wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process
bpf: add find_containing_subprog() utility function
bpf: track changes_pkt_data property for global functions
selftests/bpf: test for changing packet data from global functions
bpf: check changes_pkt_data property for extension programs
selftests/bpf: freplace tests for tracking of changes_packet_data
selftests/bpf: validate that tail call invalidates packet pointers
bpf: fix null dereference when computing changes_pkt_data of prog w/o subprogs
selftests/bpf: extend changes_pkt_data with cases w/o subprograms
block: make struct rq_list available for !CONFIG_BLOCK
Linux 6.12.25
Change-Id: Ib99b782fabf924c599a3c66bcac37febef9d422e
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Android uses __PAGE_SIZE for larger than 4KB base page size
emulation on x86_64.
Undef this to avoid conflicts with bpf core's usage of
__PAGE_SIZE.
Bug: 383389337
Bug: 383389337
Change-Id: Iae21f4bc7d0541687c98f0ac75ac93a6ed341bc7
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
The commit cdd30ebb1b9f ("module: Convert symbol namespace to string
literal") makes the grammar of MODULE_IMPORT_NS and EXPORT_SYMBOL_NS
different between the stable branches and the mainline. But when
the commit 955f9ede52 ("bpf: Add namespace to BPF internal symbols")
was backported from mainline, only EXPORT_SYMBOL_NS instances are
adapted, leaving the MODULE_IMPORT_NS instance with the "new" grammar
and causing the module fails to build:
ERROR: modpost: module bpf_preload uses symbol bpf_link_get_from_fd from namespace BPF_INTERNAL, but does not import it.
ERROR: modpost: module bpf_preload uses symbol kern_sys_bpf from namespace BPF_INTERNAL, but does not import it.
Reported-by: Mingcong Bai <jeffbai@aosc.io>
Reported-by: Alex Davis <alex47794@gmail.com>
Closes: https://lore.kernel.org/all/CADiockBKBQTVqjA5G+RJ9LBwnEnZ8o0odYnL=LBZ_7QN=_SZ7A@mail.gmail.com/
Fixes: 955f9ede52 ("bpf: Add namespace to BPF internal symbols")
Signed-off-by: Xi Ruoyao <xry111@xry111.site>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit cfe816d469dce9c0864062cf65dd7b3c42adc6f8 ]
If we attach fexit/fmod_ret to __noreturn functions, it will cause an
issue that the bpf trampoline image will be left over even if the bpf
link has been destroyed. Take attaching do_exit() with fexit for example.
The fexit works as follows,
bpf_trampoline
+ __bpf_tramp_enter
+ percpu_ref_get(&tr->pcref);
+ call do_exit()
+ __bpf_tramp_exit
+ percpu_ref_put(&tr->pcref);
Since do_exit() never returns, the refcnt of the trampoline image is
never decremented, preventing it from being freed. That can be verified
with as follows,
$ bpftool link show <<<< nothing output
$ grep "bpf_trampoline_[0-9]" /proc/kallsyms
ffffffffc04cb000 t bpf_trampoline_6442526459 [bpf] <<<< leftover
In this patch, all functions annotated with __noreturn are rejected, except
for the following cases:
- Functions that result in a system reboot, such as panic,
machine_real_restart and rust_begin_unwind
- Functions that are never executed by tasks, such as rest_init and
cpu_startup_entry
- Functions implemented in assembly, such as rewind_stack_and_make_dead and
xen_cpu_bringup_again, lack an associated BTF ID.
With this change, attaching fexit probes to functions like do_exit() will
be rejected.
$ ./fexit
libbpf: prog 'fexit': BPF program load failed: -EINVAL
libbpf: prog 'fexit': -- BEGIN PROG LOAD LOG --
Attaching fexit/fmod_ret to __noreturn functions is rejected.
Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
Link: https://lore.kernel.org/r/20250318114447.75484-2-laoar.shao@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit f4edc66e48a694b3e6d164cc71f059de542dfaec ]
The current cgrp storage has a percpu counter, bpf_cgrp_storage_busy,
to detect potential deadlock at a spin_lock that the local storage
acquires during new storage creation.
There are false positives. It turns out to be too noisy in
production. For example, a bpf prog may be doing a
bpf_cgrp_storage_get on map_a. An IRQ comes in and triggers
another bpf_cgrp_storage_get on a different map_b. It will then
trigger the false positive deadlock check in the percpu counter.
On top of that, both are doing lookup only and no need to create
new storage, so practically it does not need to acquire
the spin_lock.
The bpf_task_storage_get already has a strategy to minimize this
false positive by only failing if the bpf_task_storage_get needs
to create a new storage and the percpu counter is busy. Creating
a new storage is the only time it must acquire the spin_lock.
This patch borrows the same idea. Unlike task storage that
has a separate variant for tracing (_recur) and non-tracing, this
patch stays with one bpf_cgrp_storage_get helper to keep it simple
for now in light of the upcoming res_spin_lock.
The variable could potentially use a better name noTbusy instead
of nobusy. This patch follows the same naming in
bpf_task_storage_get for now.
I have tested it by temporarily adding noinline to
the cgroup_storage_lookup(), traced it by fentry, and the fentry
program succeeded in calling bpf_cgrp_storage_get().
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Link: https://lore.kernel.org/r/20250318182759.3676094-1-martin.lau@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 11ba7ce076e5903e7bdc1fd1498979c331b3c286 ]
Vlad Poenaru reported the following kmemleak issue:
unreferenced object 0x606fd7c44ac8 (size 32):
backtrace (crc 0):
pcpu_alloc_noprof+0x730/0xeb0
bpf_map_alloc_percpu+0x69/0xc0
prealloc_init+0x9d/0x1b0
htab_map_alloc+0x363/0x510
map_create+0x215/0x3a0
__sys_bpf+0x16b/0x3e0
__x64_sys_bpf+0x18/0x20
do_syscall_64+0x7b/0x150
entry_SYSCALL_64_after_hwframe+0x4b/0x53
Further investigation shows the reason is due to not 8-byte aligned
store of percpu pointer in htab_elem_set_ptr():
*(void __percpu **)(l->key + key_size) = pptr;
Note that the whole htab_elem alignment is 8 (for x86_64). If the key_size
is 4, that means pptr is stored in a location which is 4 byte aligned but
not 8 byte aligned. In mm/kmemleak.c, scan_block() scans the memory based
on 8 byte stride, so it won't detect above pptr, hence reporting the memory
leak.
In htab_map_alloc(), we already have
htab->elem_size = sizeof(struct htab_elem) +
round_up(htab->map.key_size, 8);
if (percpu)
htab->elem_size += sizeof(void *);
else
htab->elem_size += round_up(htab->map.value_size, 8);
So storing pptr with 8-byte alignment won't cause any problem and can fix
kmemleak too.
The issue can be reproduced with bpf selftest as well:
1. Enable CONFIG_DEBUG_KMEMLEAK config
2. Add a getchar() before skel destroy in test_hash_map() in prog_tests/for_each.c.
The purpose is to keep map available so kmemleak can be detected.
3. run './test_progs -t for_each/hash_map &' and a kmemleak should be reported.
Reported-by: Vlad Poenaru <thevlad@meta.com>
Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
Acked-by: Martin KaFai Lau <martin.lau@kernel.org>
Link: https://lore.kernel.org/r/20250224175514.2207227-1-yonghong.song@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
commit ac6542ad92759cda383ad62b4e4cbfc28136abc1 upstream.
bpf_prog_aux->func field might be NULL if program does not have
subprograms except for main sub-program. The fixed commit does
bpf_prog_aux->func access unconditionally, which might lead to null
pointer dereference.
The bug could be triggered by replacing the following BPF program:
SEC("tc")
int main_changes(struct __sk_buff *sk)
{
bpf_skb_pull_data(sk, 0);
return 0;
}
With the following BPF program:
SEC("freplace")
long changes_pkt_data(struct __sk_buff *sk)
{
return bpf_skb_pull_data(sk, 0);
}
bpf_prog_aux instance itself represents the main sub-program,
use this property to fix the bug.
Fixes: 81f6d0530ba0 ("bpf: check changes_pkt_data property for extension programs")
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/r/202412111822.qGw6tOyB-lkp@intel.com/
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20241212070711.427443-1-eddyz87@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 81f6d0530ba031b5f038a091619bf2ff29568852 upstream.
When processing calls to global sub-programs, verifier decides whether
to invalidate all packet pointers in current state depending on the
changes_pkt_data property of the global sub-program.
Because of this, an extension program replacing a global sub-program
must be compatible with changes_pkt_data property of the sub-program
being replaced.
This commit:
- adds changes_pkt_data flag to struct bpf_prog_aux:
- this flag is set in check_cfg() for main sub-program;
- in jit_subprogs() for other sub-programs;
- modifies bpf_check_attach_btf_id() to check changes_pkt_data flag;
- moves call to check_attach_btf_id() after the call to check_cfg(),
because it needs changes_pkt_data flag to be set:
bpf_check:
... ...
- check_attach_btf_id resolve_pseudo_ldimm64
resolve_pseudo_ldimm64 --> bpf_prog_is_offloaded
bpf_prog_is_offloaded check_cfg
check_cfg + check_attach_btf_id
... ...
The following fields are set by check_attach_btf_id():
- env->ops
- prog->aux->attach_btf_trace
- prog->aux->attach_func_name
- prog->aux->attach_func_proto
- prog->aux->dst_trampoline
- prog->aux->mod
- prog->aux->saved_dst_attach_type
- prog->aux->saved_dst_prog_type
- prog->expected_attach_type
Neither of these fields are used by resolve_pseudo_ldimm64() or
bpf_prog_offload_verifier_prep() (for netronome and netdevsim
drivers), so the reordering is safe.
Suggested-by: Alexei Starovoitov <alexei.starovoitov@gmail.com>
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20241210041100.1898468-6-eddyz87@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
[ shung-hsi.yu: both jits_use_priv_stack and priv_stack_requested fields are
missing from context because "bpf: Support private stack for bpf progs" series
is not present.]
Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 51081a3f25c742da5a659d7fc6fd77ebfdd555be upstream.
When processing calls to certain helpers, verifier invalidates all
packet pointers in a current state. For example, consider the
following program:
__attribute__((__noinline__))
long skb_pull_data(struct __sk_buff *sk, __u32 len)
{
return bpf_skb_pull_data(sk, len);
}
SEC("tc")
int test_invalidate_checks(struct __sk_buff *sk)
{
int *p = (void *)(long)sk->data;
if ((void *)(p + 1) > (void *)(long)sk->data_end) return TCX_DROP;
skb_pull_data(sk, 0);
*p = 42;
return TCX_PASS;
}
After a call to bpf_skb_pull_data() the pointer 'p' can't be used
safely. See function filter.c:bpf_helper_changes_pkt_data() for a list
of such helpers.
At the moment verifier invalidates packet pointers when processing
helper function calls, and does not traverse global sub-programs when
processing calls to global sub-programs. This means that calls to
helpers done from global sub-programs do not invalidate pointers in
the caller state. E.g. the program above is unsafe, but is not
rejected by verifier.
This commit fixes the omission by computing field
bpf_subprog_info->changes_pkt_data for each sub-program before main
verification pass.
changes_pkt_data should be set if:
- subprogram calls helper for which bpf_helper_changes_pkt_data
returns true;
- subprogram calls a global function,
for which bpf_subprog_info->changes_pkt_data should be set.
The verifier.c:check_cfg() pass is modified to compute this
information. The commit relies on depth first instruction traversal
done by check_cfg() and absence of recursive function calls:
- check_cfg() would eventually visit every call to subprogram S in a
state when S is fully explored;
- when S is fully explored:
- every direct helper call within S is explored
(and thus changes_pkt_data is set if needed);
- every call to subprogram S1 called by S was visited with S1 fully
explored (and thus S inherits changes_pkt_data from S1).
The downside of such approach is that dead code elimination is not
taken into account: if a helper call inside global function is dead
because of current configuration, verifier would conservatively assume
that the call occurs for the purpose of the changes_pkt_data
computation.
Reported-by: Nick Zavaritsky <mejedi@gmail.com>
Closes: https://lore.kernel.org/bpf/0498CA22-5779-4767-9C0C-A9515CEA711F@gmail.com/
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20241210041100.1898468-4-eddyz87@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit 6ebc5030e0c5a698f1dd9a6684cddf6ccaed64a0 ]
may_goto uses an additional 8 bytes on the stack, which causes the
interpreters[] array to go out of bounds when calculating index by
stack_size.
1. If a BPF program is rewritten, re-evaluate the stack size. For non-JIT
cases, reject loading directly.
2. For non-JIT cases, calculating interpreters[idx] may still cause
out-of-bounds array access, and just warn about it.
3. For jit_requested cases, the execution of bpf_func also needs to be
warned. So move the definition of function __bpf_prog_ret0_warn out of
the macro definition CONFIG_BPF_JIT_ALWAYS_ON.
Reported-by: syzbot+d2a2c639d03ac200a4f1@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/bpf/0000000000000f823606139faa5d@google.com/
Fixes: 011832b97b ("bpf: Introduce may_goto instruction")
Signed-off-by: Jiayuan Chen <mrpre@163.com>
Link: https://lore.kernel.org/r/20250214091823.46042-2-mrpre@163.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
GKI (arm64) relevant 39 out of 154 changes, affecting 57 files +585/-415
93745f5f23 arm64: mte: Do not allow PROT_MTE on MAP_HUGETLB user mappings [1 file, +6/-3]
065215ef00 Bluetooth: qca: Update firmware-name to support board specific nvm [1 file, +85/-28]
4a679448ef Bluetooth: qca: Fix poor RF performance for WCN6855 [1 file, +3/-2]
3e0686bc60 Input: serio - define serio_pause_rx guard to pause and resume serio ports [1 file, +3/-0]
1711fd7bd9 PCI: Make pcim_request_all_regions() a public function [2 files, +3/-1]
969c54c82d PCI: Export pci_intx_unmanaged() and pcim_intx() [3 files, +34/-21]
ed020100b6 PCI: Remove devres from pci_intx() [3 files, +4/-44]
75334c9cd6 PCI: Restore original INTX_DISABLE bit by pcim_intx() [1 file, +19/-15]
3284fbfa87 tracing: Switch trace.c code over to use guard() [1 file, +94/-172]
1e6419b1a4 tracing: Have the error of __tracing_resize_ring_buffer() passed to user [1 file, +1/-7]
e9fec6f42c USB: gadget: f_midi: f_midi_complete to call queue_work [1 file, +1/-1]
4381a4fab3 vsock/virtio: fix variables initialization during resuming [1 file, +7/-3]
3e4c56cf41 net/sched: cls_api: fix error handling causing NULL dereference [1 file, +1/-1]
22b683217a sockmap, vsock: For connectible sockets allow only connected [1 file, +3/-0]
478a46f112 vsock/bpf: Warn on socket without transport [2 files, +4/-1]
997ef6117e tcp: adjust rcvq_space after updating scaling ratio [1 file, +9/-3]
90c7f5cd59 flow_dissector: Fix handling of mixed port and port-range keys [1 file, +19/-12]
cbd75b9136 flow_dissector: Fix port range key handling in BPF conversion [1 file, +10/-8]
36d5616bc5 net: Add non-RCU dev_getbyhwaddr() helper [2 files, +36/-3]
c4a0f11532 arp: switch to dev_getbyhwaddr() in arp_req_set_public() [1 file, +1/-1]
cd34a07f74 tcp: drop secpath at the same time as we currently drop dst [4 files, +21/-7]
ed0ca7d212 net: allow small head cache usage with large MAX_SKB_FRAGS values [3 files, +10/-6]
972bafed67 bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() [1 file, +1/-4]
1c81ba1913 bpf: unify VM_WRITE vs VM_MAYWRITE use in BPF map mmaping logic [2 files, +8/-6]
d95607a5f2 bpf: avoid holding freeze_mutex during mmap operation [1 file, +10/-7]
6798f428d8 bpf: Fix wrong copied_seq calculation [5 files, +77/-5]
f91716d5fa bpf: Disable non stream socket for strparser [1 file, +4/-1]
fac674d2bd bpf: Fix deadlock when freeing cgroup storage [1 file, +1/-1]
f579afacd0 net: Add rx_skb of kfree_skb to raw_tp_null_args[]. [1 file, +2/-0]
c1f3f3892d bpf: Fix softlockup in arena_map_free on 64k page kernel [1 file, +1/-1]
d2d5fe4c64 nvme/ioctl: add missing space in err message [1 file, +1/-2]
7b8894ef03 bpf: skip non exist keys in generic_map_lookup_batch [1 file, +5/-13]
79151b47bf io_uring/rw: forbid multishot async reads [1 file, +11/-2]
506b9b5e8c io_uring: prevent opcode speculation [1 file, +2/-0]
6f3edf2d50 gpiolib: protect gpio_chip with SRCU in array_info paths in multi get/set [2 files, +35/-17]
cd1c4113ba lib/iov_iter: fix import_iovec_ubuf iovec management [1 file, +2/-1]
ff673b71f0 mm,madvise,hugetlb: check for 0-length range after end address adjustment [1 file, +10/-1]
ada54b2e81 irqchip/gic-v3: Fix rk3399 workaround when secure interrupts are enabled [1 file, +40/-13]
384c8291f7 tracing: Fix using ret variable in tracing_set_tracer() [1 file, +1/-2]
Changes in 6.12.17
arm64: mte: Do not allow PROT_MTE on MAP_HUGETLB user mappings
drm/xe/oa: Separate batch submission from waiting for completion
drm/xe/oa/uapi: Define and parse OA sync properties
drm/xe/oa: Add input fence dependencies
xe/oa: Fix query mode of operation for OAR/OAC
btrfs: do not assume the full page range is not dirty in extent_writepage_io()
btrfs: move the delalloc range bitmap search into extent_io.c
btrfs: mark all dirty sectors as locked inside writepage_delalloc()
btrfs: remove unused btrfs_folio_start_writer_lock()
btrfs: unify to use writer locks for subpage locking
btrfs: rename btrfs_folio_(set|start|end)_writer_lock()
btrfs: use btrfs_inode in extent_writepage()
btrfs: fix double accounting race when btrfs_run_delalloc_range() failed
btrfs: fix double accounting race when extent_writepage_io() failed
KVM: x86: Get vcpu->arch.apic_base directly and drop kvm_get_apic_base()
KVM: x86: Inline kvm_get_apic_mode() in lapic.h
KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o VID
drm/amd/display: Refactoring if and endif statements to enable DC_LOGGER
drm/amd/display: update dcn351 used clock offset
drm/amd/display: Correct register address in dcn35
Bluetooth: qca: Update firmware-name to support board specific nvm
Bluetooth: qca: Fix poor RF performance for WCN6855
Input: serio - define serio_pause_rx guard to pause and resume serio ports
Input: synaptics - fix crash when enabling pass-through port
ASoC: renesas: rz-ssi: Terminate all the DMA transactions
ASoC: renesas: rz-ssi: Add a check for negative sample_space
PCI: Make pcim_request_all_regions() a public function
PCI: Export pci_intx_unmanaged() and pcim_intx()
PCI: Remove devres from pci_intx()
PCI: Restore original INTX_DISABLE bit by pcim_intx()
arm64: dts: mediatek: mt8183-pumpkin: add HDMI support
arm64: dts: mediatek: mt8183: Disable DSI display output by default
accel/ivpu: Limit FW version string length
accel/ivpu: Add coredump support
accel/ivpu: Add FW state dump on TDR
accel/ivpu: Fix error handling in recovery/reset
drm/amdkfd: Move gfx12 trap handler to separate file
drm/amdkfd: Ensure consistent barrier state saved in gfx12 trap handler
tracing: Switch trace.c code over to use guard()
tracing: Have the error of __tracing_resize_ring_buffer() passed to user
USB: gadget: f_midi: f_midi_complete to call queue_work
sched_ext: Factor out move_task_between_dsqs() from scx_dispatch_from_dsq()
sched_ext: Fix migration disabled handling in targeted dispatches
ASoC: rockchip: i2s-tdm: fix shift config for SND_SOC_DAIFMT_DSP_[AB]
ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers
powerpc/code-patching: Disable KASAN report during patching via temporary mm
powerpc/64s: Rewrite __real_pte() and __rpte_to_hidx() as static inline
ALSA: hda/realtek: Fixup ALC225 depop procedure
powerpc/code-patching: Fix KASAN hit by not flagging text patching area as VM_ALLOC
ASoC: imx-audmix: remove cpu_mclk which is from cpu dai device
vsock/virtio: fix variables initialization during resuming
geneve: Fix use-after-free in geneve_find_dev().
ALSA: hda/cirrus: Correct the full scale volume set logic
net/sched: cls_api: fix error handling causing NULL dereference
ALSA: seq: Drop UMP events when no UMP-conversion is set
s390/ism: add release function for struct device
ibmvnic: Add stat for tx direct vs tx batched
ibmvnic: Don't reference skb after sending to VIOS
sockmap, vsock: For connectible sockets allow only connected
vsock/bpf: Warn on socket without transport
tcp: adjust rcvq_space after updating scaling ratio
net: pse-pd: Avoid setting max_uA in regulator constraints
net: pse-pd: Use power limit at driver side instead of current limit
net: pse-pd: pd692x0: Fix power limit retrieval
gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl().
geneve: Suppress list corruption splat in geneve_destroy_tunnels().
flow_dissector: Fix handling of mixed port and port-range keys
flow_dissector: Fix port range key handling in BPF conversion
net: Add non-RCU dev_getbyhwaddr() helper
arp: switch to dev_getbyhwaddr() in arp_req_set_public()
net: axienet: Set mac_managed_pm
tcp: drop secpath at the same time as we currently drop dst
net: allow small head cache usage with large MAX_SKB_FRAGS values
bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()
bpf: unify VM_WRITE vs VM_MAYWRITE use in BPF map mmaping logic
bpf: avoid holding freeze_mutex during mmap operation
strparser: Add read_sock callback
bpf: Fix wrong copied_seq calculation
bpf: Disable non stream socket for strparser
bpf: Fix deadlock when freeing cgroup storage
arm64: dts: rockchip: Fix lcdpwr_en pin for Cool Pi GenBook
power: supply: da9150-fg: fix potential overflow
power: supply: axp20x_battery: Fix fault handling for AXP717
selftests/bpf: Add tests for raw_tp null handling
net: Add rx_skb of kfree_skb to raw_tp_null_args[].
bpf: Fix softlockup in arena_map_free on 64k page kernel
arm64: dts: rockchip: adjust SMMU interrupt type on rk3588
firmware: arm_scmi: imx: Correct tx size of scmi_imx_misc_ctrl_set
md/raid*: Fix the set_queue_limits implementations
firmware: imx: IMX_SCMI_MISC_DRV should depend on ARCH_MXC
platform: cznic: CZNIC_PLATFORMS should depend on ARCH_MVEBU
nouveau/svm: fix missing folio unlock + put after make_device_exclusive_range()
drm/msm: Avoid rounding up to one jiffy
drm/msm/dpu: skip watchdog timer programming through TOP on >= SM8450
drm/msm/dpu: enable DPU_WB_INPUT_CTRL for DPU 5.x
drm/msm/dpu: Don't leak bits_per_component into random DSC_ENC fields
drm/msm/dsi/phy: Protect PHY_CMN_CLK_CFG0 updated from driver side
drm/msm/dsi/phy: Protect PHY_CMN_CLK_CFG1 against clock driver
drm/msm/dsi/phy: Do not overwite PHY_CMN_CLK_CFG1 when choosing bitclk source
nvme: tcp: Fix compilation warning with W=1
nvme-tcp: fix connect failure on receiving partial ICResp PDU
nvme/ioctl: add missing space in err message
bpf: skip non exist keys in generic_map_lookup_batch
drm/nouveau/pmu: Fix gp10b firmware guard
irqchip/jcore-aic, clocksource/drivers/jcore: Fix jcore-pit interrupt request
drm: panel: jd9365da-h3: fix reset signal polarity
drm/msm/dpu: Disable dither in phys encoder cleanup
drm/i915: Make sure all planes in use by the joiner have their crtc included
drm/i915/dp: Fix error handling during 128b/132b link training
drm/i915/ddi: Fix HDMI port width programming in DDI_BUF_CTL
drm/i915/gt: Use spin_lock_irqsave() in interruptible context
io_uring/rw: forbid multishot async reads
io_uring: prevent opcode speculation
gpiolib: protect gpio_chip with SRCU in array_info paths in multi get/set
tee: optee: Fix supplicant wait loop
drop_monitor: fix incorrect initialization order
mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()
arm64: dts: rockchip: Fix broken tsadc pinctrl names for rk3588
arm64: dts: rockchip: Move uart5 pin configuration to px30 ringneck SoM
arm64: dts: rockchip: Disable DMA for uart5 on px30-ringneck
soc: loongson: loongson2_guts: Add check for devm_kstrdup()
s390/boot: Fix ESSA detection
xfs: fix online repair probing when CONFIG_XFS_ONLINE_REPAIR=n
lib/iov_iter: fix import_iovec_ubuf iovec management
smb: client: fix chmod(2) regression with ATTR_READONLY
nfp: bpf: Add check for nfp_app_ctrl_msg_alloc()
gve: set xdp redirect target only when it is available
ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data()
ASoC: fsl_micfil: Enable default case in micfil_set_quality()
ALSA: hda: Add error check for snd_ctl_rename_id() in snd_hda_create_dig_out_ctls()
ALSA: hda/conexant: Add quirk for HP ProBook 450 G4 mute LED
ASoC: SOF: pcm: Clear the susbstream pointer to NULL on close
acct: perform last write from workqueue
acct: block access to kernel internal filesystems
mm,madvise,hugetlb: check for 0-length range after end address adjustment
mtd: spi-nor: sst: Fix SST write failure
mtd: rawnand: cadence: fix error code in cadence_nand_init()
mtd: rawnand: cadence: use dma_map_resource for sdma address
mtd: rawnand: cadence: fix incorrect device in dma_unmap_single
perf/x86/intel: Fix event constraints for LNC
irqchip/gic-v3: Fix rk3399 workaround when secure interrupts are enabled
smb: client: Add check for next_buffer in receive_encrypted_standard()
EDAC/qcom: Correct interrupt enable register configuration
ftrace: Correct preemption accounting for function tracing.
ftrace: Fix accounting of adding subops to a manager ops
ftrace: Do not add duplicate entries in subops manager ops
tracing: Fix using ret variable in tracing_set_tracer()
net: pse-pd: Fix deadlock in current limit functions
sched_ext: Fix incorrect assumption about migration disabled tasks in task_can_run_on_remote_rq()
selftests/mm: build with -O2
arm64: dts: rockchip: change eth phy mode to rgmii-id for orangepi r1 plus lts
drm/amdgpu/gfx9: manually control gfxoff for CS on RV
drm/amdgpu: bump version for RV/PCO compute fix
Linux 6.12.17
Change-Id: I5ee898299270b3b8a7d037d4b060ab803a3cc8db
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit 5644c6b50ffee0a56c1e01430a8c88e34decb120 ]
The generic_map_lookup_batch currently returns EINTR if it fails with
ENOENT and retries several times on bpf_map_copy_value. The next batch
would start from the same location, presuming it's a transient issue.
This is incorrect if a map can actually have "holes", i.e.
"get_next_key" can return a key that does not point to a valid value. At
least the array of maps type may contain such holes legitly. Right now
these holes show up, generic batch lookup cannot proceed any more. It
will always fail with EINTR errors.
Rather, do not retry in generic_map_lookup_batch. If it finds a non
existing element, skip to the next key. This simple solution comes with
a price that transient errors may not be recovered, and the iteration
might cycle back to the first key under parallel deletion. For example,
Hou Tao <houtao@huaweicloud.com> pointed out a following scenario:
For LPM trie map:
(1) ->map_get_next_key(map, prev_key, key) returns a valid key
(2) bpf_map_copy_value() return -ENOMENT
It means the key must be deleted concurrently.
(3) goto next_key
It swaps the prev_key and key
(4) ->map_get_next_key(map, prev_key, key) again
prev_key points to a non-existing key, for LPM trie it will treat just
like prev_key=NULL case, the returned key will be duplicated.
With the retry logic, the iteration can continue to the key next to the
deleted one. But if we directly skip to the next key, the iteration loop
would restart from the first key for the lpm_trie type.
However, not all races may be recovered. For example, if current key is
deleted after instead of before bpf_map_copy_value, or if the prev_key
also gets deleted, then the loop will still restart from the first key
for lpm_tire anyway. For generic lookup it might be better to stay
simple, i.e. just skip to the next key. To guarantee that the output
keys are not duplicated, it is better to implement map type specific
batch operations, which can properly lock the trie and synchronize with
concurrent mutators.
Fixes: cb4d03ab49 ("bpf: Add generic support for lookup batch op")
Closes: https://lore.kernel.org/bpf/Z6JXtA1M5jAZx8xD@debian.debian/
Signed-off-by: Yan Zhai <yan@cloudflare.com>
Acked-by: Hou Tao <houtao1@huawei.com>
Link: https://lore.kernel.org/r/85618439eea75930630685c467ccefeac0942e2b.1739171594.git.yan@cloudflare.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 517e8a7835e8cfb398a0aeb0133de50e31cae32b ]
On an aarch64 kernel with CONFIG_PAGE_SIZE_64KB=y,
arena_htab tests cause a segmentation fault and soft lockup.
The same failure is not observed with 4k pages on aarch64.
It turns out arena_map_free() is calling
apply_to_existing_page_range() with the address returned by
bpf_arena_get_kern_vm_start(). If this address is not page-aligned
the code ends up calling apply_to_pte_range() with that unaligned
address causing soft lockup.
Fix it by round up GUARD_SZ to PAGE_SIZE << 1 so that the
division by 2 in bpf_arena_get_kern_vm_start() returns
a page-aligned value.
Fixes: 317460317a ("bpf: Introduce bpf_arena.")
Reported-by: Colm Harrington <colm.harrington@oracle.com>
Suggested-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
Link: https://lore.kernel.org/r/20250205170059.427458-1-alan.maguire@oracle.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit c78f4afbd962f43a3989f45f3ca04300252b19b5 ]
The following commit
bc235cdb42 ("bpf: Prevent deadlock from recursive bpf_task_storage_[get|delete]")
first introduced deadlock prevention for fentry/fexit programs attaching
on bpf_task_storage helpers. That commit also employed the logic in map
free path in its v6 version.
Later bpf_cgrp_storage was first introduced in
c4bcfb38a9 ("bpf: Implement cgroup storage available to non-cgroup-attached bpf progs")
which faces the same issue as bpf_task_storage, instead of its busy
counter, NULL was passed to bpf_local_storage_map_free() which opened
a window to cause deadlock:
<TASK>
(acquiring local_storage->lock)
_raw_spin_lock_irqsave+0x3d/0x50
bpf_local_storage_update+0xd1/0x460
bpf_cgrp_storage_get+0x109/0x130
bpf_prog_a4d4a370ba857314_cgrp_ptr+0x139/0x170
? __bpf_prog_enter_recur+0x16/0x80
bpf_trampoline_6442485186+0x43/0xa4
cgroup_storage_ptr+0x9/0x20
(holding local_storage->lock)
bpf_selem_unlink_storage_nolock.constprop.0+0x135/0x160
bpf_selem_unlink_storage+0x6f/0x110
bpf_local_storage_map_free+0xa2/0x110
bpf_map_free_deferred+0x5b/0x90
process_one_work+0x17c/0x390
worker_thread+0x251/0x360
kthread+0xd2/0x100
ret_from_fork+0x34/0x50
ret_from_fork_asm+0x1a/0x30
</TASK>
Progs:
- A: SEC("fentry/cgroup_storage_ptr")
- cgid (BPF_MAP_TYPE_HASH)
Record the id of the cgroup the current task belonging
to in this hash map, using the address of the cgroup
as the map key.
- cgrpa (BPF_MAP_TYPE_CGRP_STORAGE)
If current task is a kworker, lookup the above hash
map using function parameter @owner as the key to get
its corresponding cgroup id which is then used to get
a trusted pointer to the cgroup through
bpf_cgroup_from_id(). This trusted pointer can then
be passed to bpf_cgrp_storage_get() to finally trigger
the deadlock issue.
- B: SEC("tp_btf/sys_enter")
- cgrpb (BPF_MAP_TYPE_CGRP_STORAGE)
The only purpose of this prog is to fill Prog A's
hash map by calling bpf_cgrp_storage_get() for as
many userspace tasks as possible.
Steps to reproduce:
- Run A;
- while (true) { Run B; Destroy B; }
Fix this issue by passing its busy counter to the free procedure so
it can be properly incremented before storage/smap locking.
Fixes: c4bcfb38a9 ("bpf: Implement cgroup storage available to non-cgroup-attached bpf progs")
Signed-off-by: Abel Wu <wuyun.abel@bytedance.com>
Acked-by: Martin KaFai Lau <martin.lau@kernel.org>
Link: https://lore.kernel.org/r/20241221061018.37717-1-wuyun.abel@bytedance.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit bc27c52eea189e8f7492d40739b7746d67b65beb ]
We use map->freeze_mutex to prevent races between map_freeze() and
memory mapping BPF map contents with writable permissions. The way we
naively do this means we'll hold freeze_mutex for entire duration of all
the mm and VMA manipulations, which is completely unnecessary. This can
potentially also lead to deadlocks, as reported by syzbot in [0].
So, instead, hold freeze_mutex only during writeability checks, bump
(proactively) "write active" count for the map, unlock the mutex and
proceed with mmap logic. And only if something went wrong during mmap
logic, then undo that "write active" counter increment.
[0] https://lore.kernel.org/bpf/678dcbc9.050a0220.303755.0066.GAE@google.com/
Fixes: fc9702273e ("bpf: Add mmap() support for BPF_MAP_TYPE_ARRAY")
Reported-by: syzbot+4dc041c686b7c816a71e@syzkaller.appspotmail.com
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/r/20250129012246.1515826-2-andrii@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 98671a0fd1f14e4a518ee06b19037c20014900eb ]
For all BPF maps we ensure that VM_MAYWRITE is cleared when
memory-mapping BPF map contents as initially read-only VMA. This is
because in some cases BPF verifier relies on the underlying data to not
be modified afterwards by user space, so once something is mapped
read-only, it shouldn't be re-mmap'ed as read-write.
As such, it's not necessary to check VM_MAYWRITE in bpf_map_mmap() and
map->ops->map_mmap() callbacks: VM_WRITE should be consistently set for
read-write mappings, and if VM_WRITE is not set, there is no way for
user space to upgrade read-only mapping to read-write one.
This patch cleans up this VM_WRITE vs VM_MAYWRITE handling within
bpf_map_mmap(), which is an entry point for any BPF map mmap()-ing
logic. We also drop unnecessary sanitization of VM_MAYWRITE in BPF
ringbuf's map_mmap() callback implementation, as it is already performed
by common code in bpf_map_mmap().
Note, though, that in bpf_map_mmap_{open,close}() callbacks we can't
drop VM_MAYWRITE use, because it's possible (and is outside of
subsystem's control) to have initially read-write memory mapping, which
is subsequently dropped to read-only by user space through mprotect().
In such case, from BPF verifier POV it's read-write data throughout the
lifetime of BPF map, and is counted as "active writer".
But its VMAs will start out as VM_WRITE|VM_MAYWRITE, then mprotect() can
change it to just VM_MAYWRITE (and no VM_WRITE), so when its finally
munmap()'ed and bpf_map_mmap_close() is called, vm_flags will be just
VM_MAYWRITE, but we still need to decrement active writer count with
bpf_map_write_active_dec() as it's still considered to be a read-write
mapping by the rest of BPF subsystem.
Similar reasoning applies to bpf_map_mmap_open(), which is called
whenever mmap(), munmap(), and/or mprotect() forces mm subsystem to
split original VMA into multiple discontiguous VMAs.
Memory-mapping handling is a bit tricky, yes.
Cc: Jann Horn <jannh@google.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/r/20250129012246.1515826-1-andrii@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Stable-dep-of: bc27c52eea18 ("bpf: avoid holding freeze_mutex during mmap operation")
Signed-off-by: Sasha Levin <sashal@kernel.org>
This is a squash of the cherry-picks of the following commits from
common-android15-6.1 branch
ANDROID: fuse-bpf: Fix flock test compile error
ANDROID: fuse-bpf: Add NULL pointer check in fuse_entry_revalidate
ANDROID: fuse-bpf: Get correct inode in mkdir
ANDROID: fuse-bpf: Use stored bpf for create_open
ANDROID: fuse-bpf: Add bpf to negative fuse_dentry
ANDROID: fuse-bpf: Check inode not null
ANDROID: fuse-bpf: Add partial ioctl support
ANDROID: fuse-bpf: Add partial flock support
ANDROID: fuse-bpf: Add NULL pointer check in fuse_release_in
ANDROID: fuse-bpf: Move FUSE_RELEASE to correct place
ANDROID: fuse-bpf: Ensure bpf field can never be nulled
ANDROID: fuse-bpf: Fix bpf_test_xattr testcase error
ANDROID: fuse-bpf: Simplify and fix setting bpf program
ANDROID: fuse-bpf: Make fuse_test compile and pass
ANDROID: fuse-bpf: Run bpf with migration disabled
ANDROID: fuse-bpf: Do not change bpf program in lookups
ANDROID: fuse-bpf: Correctly put backing files
ANDROID: fuse-bpf: Fix crash from assuming iter is kvec
ANDROID: fuse-bpf: Add /sys/fs flags for fuse-bpf version
ANDROID: fuse-bpf: Make sure to declare functions
ANDROID: fuse-bpf v1.1
Test: Builds, fuse_test does not pass (fixed in followup CL)
Bug: 329877626
Change-Id: Ib94e7c1cdb32df3f852c68e553627aba2b723fd4
Signed-off-by: Paul Lawrence <paullawrence@google.com>
Signed-off-by: Daniel Rosenberg <drosen@google.com>
Greg Kroah-Hartman
Yonghong Song
Andrii Nakryiko
Shung-Hsi Yu
Ilya Leoshkevich
Hou Tao
KaFai Wan
Lorenzo Bianconi
Eduard Zingerman
Martin KaFai Lau
Amery Hung
Mykyta Yatsenko
Brandon Kammerdiener
Kalesh Singh
Xi Ruoyao
Yafang Shao
Alexei Starovoitov
Jiayuan Chen
Yan Zhai
Alan Maguire
Kuniyuki Iwashima
Abel Wu
Daniel Rosenberg