GKI (arm64) relevant 102 out of 584 changes, affecting 165 files +1491/-594
4338831b83 coredump: Do not lock during 'comm' reporting [1 file, +2/-2]
784908004f fs: fix proc_handler for sysctl_nr_open [1 file, +1/-1]
f83f330fc4 block: retry call probe after request_module in blk_request_module [1 file, +17/-5]
e278c7ff75 block: check BLK_FEAT_POLL under q_usage_count [2 files, +22/-12]
d313ff5308 block: don't update BLK_FEAT_POLL in __blk_mq_update_nr_hw_queues [4 files, +22/-26]
4621771de1 nvme: Add error check for xa_store in nvme_get_effects_log [1 file, +6/-2]
e8c390a9a5 nvme: Add error path for xa_store in nvme_init_effects [1 file, +22/-4]
68303b5d38 select: Fix unbalanced user_access_end() [1 file, +2/-2]
1e8c151fb2 nvme: fix bogus kzalloc() return check in nvme_init_effects_log() [1 file, +1/-1]
e4b64d34a4 sched/fair: Untangle NEXT_BUDDY and pick_next_task() [2 files, +11/-2]
5bb4039f77 sched/fair: Fix value reported by hot tasks pulled in /proc/schedstat [2 files, +14/-4]
fd2818c5e0 sched: Split out __schedule() deactivate task logic into a helper [1 file, +40/-27]
3f1215588b sched: psi: pass enqueue/dequeue flags to psi callbacks directly [3 files, +53/-44]
10a7d3e734 psi: Fix race when task wakes up before psi_sched_switch() adjusts flags [2 files, +7/-3]
ebaeca33d3 HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections [1 file, +2/-0]
7d68c20638 OPP: add index check to assert to avoid buffer overflow in _read_freq() [1 file, +27/-15]
ff2def2518 OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized [1 file, +13/-2]
82bd38bd54 net_sched: sch_sfq: handle bigger packets [1 file, +13/-26]
7d8947f215 net_sched: sch_sfq: don't allow 1 packet limit [1 file, +4/-0]
e561d1a2ba clk: fix an OF node reference leak in of_clk_get_parent_name() [1 file, +3/-1]
bd1bb30b9f HID: multitouch: fix support for Goodix PID 0x01e9 [1 file, +1/-1]
d474a73856 inetpeer: remove create argument of inet_getpeer_v[46]() [7 files, +11/-12]
dc4fd82dad inetpeer: remove create argument of inet_getpeer() [2 files, +5/-13]
4622e45097 inetpeer: update inetpeer timestamp in inet_getpeer() [1 file, +4/-8]
9345b588f8 inetpeer: do not get a refcount in inet_getpeer() [7 files, +32/-29]
4f8344fce9 udp: Deal with race between UDP socket address change and rehash [2 files, +106/-0]
a7175e363a dt-bindings: clock: imx93: Drop IMX93_CLK_END macro definition [1 file, +0/-1]
036f2f5109 dt-bindings: clock: imx93: Add SPDIF IPG clk [1 file, +1/-0]
5078123528 regulator: of: Implement the unwind path of of_regulator_match() [1 file, +13/-1]
8937f5e38a ax25: rcu protect dev->ax25_ptr [7 files, +35/-20]
3d62a5037f OPP: OF: Fix an OF node leak in _opp_add_static_v2() [1 file, +3/-1]
a3bdd14936 HID: fix generic desktop D-Pad controls [2 files, +18/-20]
a8251d3a4c mfd: syscon: Fix race in device_node_get_regmap() [1 file, +10/-9]
984e7d2aa0 wifi: mac80211: Fix common size calculation for ML element [1 file, +3/-8]
df2f2d9199 Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name() [1 file, +3/-0]
f98ccd7d77 dev: Acquire netdev_rename_lock before restoring dev->name in dev_change_name(). [1 file, +2/-0]
33e2168788 net: let net.core.dev_weight always be non-zero [1 file, +4/-1]
b382ab9b88 net: avoid race between device unregistration and ethnl ops [1 file, +1/-1]
73c7e1d689 net: sched: Disallow replacing of child qdisc from one parent to another [1 file, +4/-0]
d7fe7e1bbe netfilter: nf_tables: fix set size with rbtree backend [3 files, +96/-2]
5213efec90 net: sched: refine software bypass handling in tc_run [8 files, +55/-45]
a0753466f0 tcp_cubic: fix incorrect HyStart round start detection [1 file, +5/-3]
b7de862bda crypto: api - Fix boot-up self-test race [1 file, +2/-2]
b002750000 bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT [1 file, +6/-2]
eb2e58484b rhashtable: Fix potential deadlock by moving schedule_work outside lock [1 file, +6/-4]
8e7d29b698 bpf: Use refcount_t instead of atomic_t for mmap_count [1 file, +4/-4]
b777b14c2a bpf: Reject struct_ops registration that uses module ptr and the module btf_id is missing [3 files, +26/-5]
78b9778349 bpf: Send signals asynchronously if !preemptible [1 file, +1/-1]
0e272fe6a0 bpf: tcp: Mark bpf_load_hdr_opt() arg2 as read-write [1 file, +1/-1]
f939008a52 rhashtable: Fix rhashtable_try_insert test [1 file, +7/-5]
33e47d9573 bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT [1 file, +16/-2]
6cffdf4838 of: property: Avoiding using uninitialized variable @imaplen in parse_interrupt_map() [1 file, +1/-1]
92ed1efb6a of: reserved-memory: Do not make kmemleak ignore freed address [1 file, +2/-1]
9a0fe62f93 of: reserved_mem: Restructure how the reserved memory regions are processed [3 files, +122/-54]
e61977c714 of/fdt: Restore possibility to use both ACPI and FDT from bootloader [1 file, +1/-9]
45e1246e5c PCI: endpoint: Destroy the EPC device in devm_pci_epc_destroy() [1 file, +1/-1]
58465dfc42 media: uvcvideo: Propagate buf->error to userspace [1 file, +2/-1]
a2c80a1881 PCI: qcom: Update ICC and OPP values after Link Up event [1 file, +2/-0]
a665fab63d PCI: dwc: Always stop link in the dw_pcie_suspend_noirq [1 file, +1/-0]
0e0ac81d51 scsi: ufs: bsg: Delete bsg_dev when setting up bsg fails [1 file, +1/-0]
4896402780 erofs: fix potential return value overflow of z_erofs_shrink_scan() [1 file, +1/-2]
565611d101 module: Extend the preempt disabled section in dereference_symbol_descriptor(). [1 file, +1/-1]
fd41b2e9aa module: Don't fail module loading when setting ro_after_init section RO failed [1 file, +4/-3]
1614e75d1a driver core: class: Fix wild pointer dereferences in API class_dev_iter_next() [1 file, +8/-1]
b35a3edc7c serial: 8250: Adjust the timeout for FIFO mode [1 file, +26/-6]
87fdd4c447 xfrm: replay: Fix the update of replay_esn->oseq_hi for GSO [1 file, +6/-4]
2a64cff2aa xfrm: Add support for per cpu xfrm state handling. [6 files, +112/-22]
aa48a18fdb xfrm: Cache used outbound xfrm states at the policy. [3 files, +71/-0]
5e4334dc39 xfrm: Add an inbound percpu state cache. [6 files, +70/-7]
a16871c783 xfrm: state: fix out-of-bounds read during lookup [1 file, +70/-19]
6945701ca1 xfrm: delete intermediate secpath entry in packet offload mode [1 file, +13/-3]
24ac5b7524 regulator: core: Add missing newline character [1 file, +1/-1]
a099834a51 ipmr: do not call mr_mfc_uses_dev() for unres entries [1 file, +0/-3]
3b732c60a0 PM: hibernate: Add error handling for syscore_suspend() [1 file, +6/-1]
e468aace40 xfrm: Don't disable preemption while looking up cache state. [1 file, +1/-3]
3e44707da8 ptp: Properly handle compat ioctls [1 file, +4/-0]
a68d7a9fb8 ethtool: Fix set RXNFC command with symmetric RSS hash [1 file, +1/-1]
a06bb37d65 vsock: Allow retrying on connect() failure [1 file, +5/-0]
1dd823a46e tcp: correct handling of extreme memory squeeze [1 file, +6/-3]
557707906d net: xdp: Disallow attaching device-bound programs in generic mode [1 file, +4/-0]
a23834b782 genksyms: fix memory leak when the same symbol is added from source [2 files, +15/-2]
52f0a28e17 genksyms: fix memory leak when the same symbol is read from *.symref file [3 files, +9/-5]
206d8e0242 io_uring/uring_cmd: use cached cmd_op in io_uring_cmd_sock() [1 file, +1/-1]
6e26ca1818 kconfig: fix file name in warnings when loading KCONFIG_DEFCONFIG_LIST [1 file, +4/-2]
e4e8ed67e0 kconfig: fix memory leak in sym_warn_unmet_dep() [1 file, +1/-0]
00d1943fe4 f2fs: Introduce linear search for dentries [3 files, +45/-19]
e0216c39b4 ALSA: usb-audio: Add delay quirk for iBasso DC07 Pro [1 file, +2/-0]
f395b7efce net: usb: rtl8150: enable basic endpoint checking [1 file, +22/-0]
ae069cd2ba usb: xhci: Fix NULL pointer dereference on certain command aborts [1 file, +2/-1]
ebba1bebf0 usb: dwc3: core: Defer the probe until USB power supply ready [1 file, +21/-9]
01c74aeac2 usb: dwc3: Skip resume if pm_runtime_set_active() fails [1 file, +4/-1]
ce5c91a1b2 usb: typec: tcpm: set SRC_SEND_CAPABILITIES timeout to PD_T_SENDER_RESPONSE [1 file, +1/-1]
15b50cbc6f usb: typec: tcpci: Prevent Sink disconnection before vPpsShutdown in SPR PPS [3 files, +16/-8]
f2013d19b7 remoteproc: core: Fix ida_free call while not allocated [1 file, +7/-7]
d1f8e69eec media: uvcvideo: Fix double free in error path [1 file, +1/-0]
8de4e5a922 of: reserved-memory: Warn for missing static reserved memory regions [1 file, +5/-0]
698943070e dma-mapping: save base/size instead of pointer to shared DMA pool [1 file, +8/-6]
78b366aa0e xfrm: Add error handling when nla_put_u32() returns an error [1 file, +4/-1]
364d7e7f30 xfrm: Fix acquire state insertion. [1 file, +1/-0]
1cf2177959 ethtool: Fix access to uninitialized fields in set RXNFC command [1 file, +2/-1]
c3a3741db8 memcg: fix soft lockup in the OOM process [2 files, +13/-2]
333f128224 ethtool: ntuple: fix rss + ring_cookie check [1 file, +1/-1]
Changes in 6.12.13
coredump: Do not lock during 'comm' reporting
powerpc/book3s64/hugetlb: Fix disabling hugetlb when fadump is active
dlm: fix removal of rsb struct that is master and dir record
dlm: fix srcu_read_lock() return type to int
afs: Fix EEXIST error returned from afs_rmdir() to be ENOTEMPTY
afs: Fix directory format encoding struct
afs: Fix cleanup of immediately failed async calls
fs: fix proc_handler for sysctl_nr_open
block: copy back bounce buffer to user-space correctly in case of split
block: retry call probe after request_module in blk_request_module
ps3disk: Do not use dev->bounce_size before it is set
nbd: don't allow reconnect after disconnect
pstore/blk: trivial typo fixes
block: check BLK_FEAT_POLL under q_usage_count
block: don't update BLK_FEAT_POLL in __blk_mq_update_nr_hw_queues
nvme-tcp: Fix I/O queue cpu spreading for multiple controllers
nvme: Add error check for xa_store in nvme_get_effects_log
powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW
selftests/powerpc: Fix argument order to timer_sub()
nvme: Add error path for xa_store in nvme_init_effects
btrfs: improve the warning and error message for btrfs_remove_qgroup()
partitions: ldm: remove the initial kernel-doc notation
btrfs: subpage: fix the bitmap dump of the locked flags
select: Fix unbalanced user_access_end()
nvme: fix bogus kzalloc() return check in nvme_init_effects_log()
afs: Fix the fallback handling for the YFS.RemoveFile2 RPC call
perf/core: Save raw sample data conditionally based on sample type
sched/fair: Untangle NEXT_BUDDY and pick_next_task()
sched/fair: Fix value reported by hot tasks pulled in /proc/schedstat
sched: Fix race between yield_to() and try_to_wake_up()
x86/cpu: Enable SD_ASYM_PACKING for PKG domain on AMD
x86/topology: Use x86_sched_itmt_flags for PKG domain unconditionally
sched: Split out __schedule() deactivate task logic into a helper
sched: psi: pass enqueue/dequeue flags to psi callbacks directly
psi: Fix race when task wakes up before psi_sched_switch() adjusts flags
drm/v3d: Fix performance counter source settings on V3D 7.x
drm/rockchip: vop2: fix rk3588 dp+dsi maxclk verification
drm/msm/dp: set safe_to_exit_level before printing it
drm/msm/hdmi: simplify code in pll_get_integloop_gain
drm/etnaviv: Fix page property being used for non writecombine buffers
HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections
drm/amd/pm: Fix an error handling path in vega10_enable_se_edc_force_stall_config()
drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table
drm/rockchip: vop2: Fix cluster windows alpha ctrl regsiters offset
drm/rockchip: vop2: Fix the mixer alpha setup for layer 0
drm/panthor: Preserve the result returned by panthor_fw_resume()
drm/rockchip: vop2: Fix the windows switch between different layers
printk: Defer legacy printing when holding printk_cpu_sync
drm/connector: Allow clearing HDMI infoframes
drm/rockchip: vop2: Set AXI id for rk3588
drm/rockchip: vop2: Setup delay cycle for Esmart2/3
drm/rockchip: vop2: Check linear format for Cluster windows on rk3566/8
drm/rockchip: vop2: Add check for 32 bpp format for rk3588
drm/rockchip: vop2: include rockchip_drm_drv.h
drm/amdgpu/vcn: reset fw_shared under SRIOV
OPP: add index check to assert to avoid buffer overflow in _read_freq()
OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized
drm/msm/dpu: provide DSPP and correct LM config for SDM670
drm/msm/dpu: link DSPP_2/_3 blocks on SM8150
drm/msm/dpu: link DSPP_2/_3 blocks on SC8180X
drm/msm/dpu: link DSPP_2/_3 blocks on SM8250
drm/msm/dpu: link DSPP_2/_3 blocks on SM8350
drm/msm/dpu: link DSPP_2/_3 blocks on SM8550
drm/msm/dpu: link DSPP_2/_3 blocks on SM8650
drm/msm/dpu: link DSPP_2/_3 blocks on X1E80100
drm/msm: Check return value of of_dma_configure()
drm/msm: don't clean up priv->kms prematurely
drm/msm/mdp4: correct LCDC regulator name
drm/bridge: it6505: Change definition of AUX_FIFO_MAX_SIZE
drm/amdgpu: tear down ttm range manager for doorbell in amdgpu_ttm_fini()
Revert "drm/amdgpu/gfx9: put queue resets behind a debug option"
drm/amdgpu: fix gpu recovery disable with per queue reset
genirq: Make handle_enforce_irqctx() unconditionally available
ipmi: ipmb: Add check devm_kasprintf() returned value
wifi: ath11k: Fix unexpected return buffer manager error for WCN6750/WCN6855
wifi: rtlwifi: rtl8821ae: phy: restore removed code to fix infinite loop
wifi: rtlwifi: do not complete firmware loading needlessly
wifi: rtlwifi: rtl8192se: rise completion of firmware loading as last step
wifi: rtlwifi: wait for firmware loading before releasing memory
wifi: rtlwifi: fix init_sw_vars leak when probe fails
wifi: rtlwifi: usb: fix workqueue leak when probe fails
wifi: wcn36xx: fix channel survey memory allocation size
clk: renesas: cpg-mssr: Fix 'soc' node handling in cpg_mssr_reserved_init()
wifi: cfg80211: tests: Fix potential NULL dereference in test_cfg80211_parse_colocated_ap()
selftests/bpf: Actuate tx_metadata_len in xdp_hw_metadata
net_sched: sch_sfq: handle bigger packets
net_sched: sch_sfq: don't allow 1 packet limit
spi: zynq-qspi: Add check for clk_enable()
rxrpc: Fix handling of received connection abort
dt-bindings: mmc: controller: clarify the address-cells description
clk: fix an OF node reference leak in of_clk_get_parent_name()
dt-bindings: leds: class-multicolor: Fix path to color definitions
wifi: rtlwifi: remove unused check_buddy_priv
wifi: rtlwifi: destroy workqueue at rtl_deinit_core
wifi: rtlwifi: fix memory leaks and invalid access at probe error path
wifi: rtlwifi: pci: wait for firmware loading before releasing memory
HID: multitouch: fix support for Goodix PID 0x01e9
regulator: dt-bindings: mt6315: Drop regulator-compatible property
wifi: brcmfmac: add missing header include for brcmf_dbg
module: Convert default symbol namespace to string literal
hwmon: (nct6775): Actually make use of the HWMON_NCT6775 symbol namespace
ACPI: fan: cleanup resources in the error path of .probe()
cpupower: fix TSC MHz calculation
dt-bindings: mfd: bd71815: Fix rsense and typos
leds: netxbig: Fix an OF node reference leak in netxbig_leds_get_of_pdata()
inetpeer: remove create argument of inet_getpeer_v[46]()
inetpeer: remove create argument of inet_getpeer()
inetpeer: update inetpeer timestamp in inet_getpeer()
inetpeer: do not get a refcount in inet_getpeer()
pwm: stm32-lp: Add check for clk_enable()
cpufreq: schedutil: Fix superfluous updates caused by need_freq_update
selftests: ktap_helpers: Fix uninitialized variable
ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple()
net: airoha: Fix error path in airoha_probe()
gpio: pca953x: log an error when failing to get the reset GPIO
cpufreq: qcom: Fix qcom_cpufreq_hw_recalc_rate() to query LUT if LMh IRQ is not available
cpufreq: qcom: Implement clk_ops::determine_rate() for qcom_cpufreq* clocks
udp: Deal with race between UDP socket address change and rehash
clk: imx8mp: Fix clkout1/2 support
dt-bindings: clock: imx93: Drop IMX93_CLK_END macro definition
dt-bindings: clock: Add i.MX91 clock support
dt-bindings: clock: imx93: Add SPDIF IPG clk
clk: imx93: Move IMX93_CLK_END macro to clk driver
clk: imx: add i.MX91 clk
clk: imx93: Add IMX93_CLK_SPDIF_IPG clock
arm64: dts: imx93: Use IMX93_CLK_SPDIF_IPG as SPDIF IPG clock
clk: imx: Apply some clks only for i.MX93
clk: qcom: camcc-x1e80100: Set titan_top_gdsc as the parent GDSC of subordinate GDSCs
team: prevent adding a device which is already a team device lower
dt-bindings: clock: sunxi: Export PLL_VIDEO_2X and PLL_MIPI
clk: sunxi-ng: a64: drop redundant CLK_PLL_VIDEO0_2X and CLK_PLL_MIPI
clk: sunxi-ng: a64: stop force-selecting PLL-MIPI as TCON0 parent
regulator: of: Implement the unwind path of of_regulator_match()
ax25: rcu protect dev->ax25_ptr
net/mlx5: HWS, fix definer's HWS_SET32 macro for negative offset
OPP: OF: Fix an OF node leak in _opp_add_static_v2()
ipmi: ssif_bmc: Fix new request loss when bmc ready for a response
wifi: ath12k: fix tx power, max reg power update to firmware
clk: qcom: gcc-sdm845: Do not use shared clk_ops for QUPs
HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check
HID: fix generic desktop D-Pad controls
leds: cht-wcove: Use devm_led_classdev_register() to avoid memory leak
mfd: syscon: Fix race in device_node_get_regmap()
samples/landlock: Fix possible NULL dereference in parse_path()
wifi: mt76: mt7996: fix invalid interface combinations
wifi: wlcore: fix unbalanced pm_runtime calls
wifi: rtw89: handle entity active flag per PHY
wifi: rtw89: chan: manage active interfaces
wifi: rtw89: tweak setting of channel and TX power for MLO
wifi: rtw89: fix proceeding MCC with wrong scanning state after sequence changes
wifi: rtw89: chan: fix soft lockup in rtw89_entity_recalc_mgnt_roles()
wifi: rtw89: avoid to init mgnt_entry list twice when WoWLAN failed
wifi: rtw89: mcc: consider time limits not divisible by 1024
wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion
hwmon: Fix help text for aspeed-g6-pwm-tach
wifi: mt76: mt7925: fix off by one in mt7925_load_clc()
wifi: mt76: mt7915: Fix mesh scan on MT7916 DBDC
wifi: iwlwifi: fw: read STEP table from correct UEFI var
wifi: iwlwifi: mvm: avoid NULL pointer dereference
wifi: iwlwifi: mvm: don't count mgmt frames as MPDU
wifi: mac80211: prohibit deactivating all links
wifi: cfg80211: Move cfg80211_scan_req_add_chan() n_channels increment earlier
wifi: mac80211: fix tid removal during mesh forwarding
wifi: mac80211: Fix common size calculation for ML element
wifi: mac80211: don't flush non-uploaded STAs
clk: ralink: mtmips: remove duplicated 'xtal' clock for Ralink SoC RT3883
clk: thead: Fix clk gate registration to pass flags
clk: thead: Add CLK_IGNORE_UNUSED to fix TH1520 boot
clk: thead: Fix cpu2vp_clk for TH1520 AP_SUBSYS clocks
net/smc: fix data error when recvmsg with MSG_PEEK flag
landlock: Handle weird files
wifi: mt76: mt76u_vendor_request: Do not print error messages when -EPROTO
wifi: mt76: mt7921: fix using incorrect group cipher after disconnection.
wifi: mt76: mt7915: Fix an error handling path in mt7915_add_interface()
wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links
wifi: mt76: mt7925: fix wrong band_idx setting when enable sniffer mode
wifi: mt76: mt7925: fix get wrong chip cap from incorrect pointer
wifi: mt76: mt7925: fix the invalid ip address for arp offload
wifi: mt76: mt7996: fix overflows seen when writing limit attributes
wifi: mt76: mt7915: fix overflows seen when writing limit attributes
wifi: mt76: connac: Extend mt76_connac_mcu_uni_add_dev for MLO
wifi: mt76: mt7925: Fix incorrect MLD address in bss_mld_tlv for MLO support
wifi: mt76: mt7925: Fix incorrect WCID assignment for MLO
wifi: mt76: mt7925: Fix incorrect WCID phy_idx assignment
wifi: mt76: mt7925: fix wrong parameter for related cmd of chan info
wifi: mt76: mt7925: Fix CNM Timeout with Single Active Link in MLO
wifi: mt76: mt7925: Enhance mt7925_mac_link_bss_add to support MLO
wifi: mt76: Enhance mt7925_mac_link_sta_add to support MLO
wifi: mt76: mt7925: Update mt7925_mcu_sta_update for BC in ASSOC state
wifi: mt76: mt7925: Update mt792x_rx_get_wcid for per-link STA
wifi: mt76: mt7925: Update mt7925_unassign_vif_chanctx for per-link BSS
wifi: mt76: mt7925: Update secondary link PS flow
wifi: mt76: mt7925: Init secondary link PM state
wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO
wifi: mt76: mt7925: Cleanup MLO settings post-disconnection
wifi: mt76: mt7925: Properly handle responses for commands with events
wifi: mt76: mt7996: fix rx filter setting for bfee functionality
wifi: mt76: only enable tx worker after setting the channel
wifi: mt76: mt7915: firmware restart on devices with a second pcie link
wifi: mt76: mt7915: fix omac index assignment after hardware reset
wifi: mt76: mt7915: fix register mapping
wifi: mt76: mt7996: fix register mapping
wifi: mt76: mt7996: add max mpdu len capability
wifi: mt76: mt7996: fix the capability of reception of EHT MU PPDU
wifi: mt76: mt7996: fix HE Phy capability
wifi: mt76: mt7996: fix incorrect indexing of MIB FW event
wifi: mt76: mt7996: fix definition of tx descriptor
wifi: mt76: mt7996: fix ldpc setting
i2c: designware: Actually make use of the I2C_DW_COMMON and I2C_DW symbol namespaces
cpufreq: ACPI: Fix max-frequency computation
selftests: timers: clocksource-switch: Adapt progress to kselftest framework
selftests: harness: fix printing of mismatch values in __EXPECT()
wifi: cfg80211: adjust allocation of colocated AP data
Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name()
Bluetooth: btrtl: check for NULL in btrtl_setup_realtek()
inet: ipmr: fix data-races
clk: analogbits: Fix incorrect calculation of vco rate delta
dev: Acquire netdev_rename_lock before restoring dev->name in dev_change_name().
pwm: stm32: Add check for clk_enable()
selftests/landlock: Fix build with non-default pthread linking
selftests/landlock: Fix error message
net: let net.core.dev_weight always be non-zero
net/mlxfw: Drop hard coded max FW flash image size
octeon_ep: remove firmware stats fetch in ndo_get_stats64
octeon_ep_vf: remove firmware stats fetch in ndo_get_stats64
net: avoid race between device unregistration and ethnl ops
net: sched: Disallow replacing of child qdisc from one parent to another
netfilter: nf_tables: fix set size with rbtree backend
netfilter: nft_flow_offload: update tcp state flags under lock
net: sched: refine software bypass handling in tc_run
net: ethernet: ti: am65-cpsw: fix freeing IRQ in am65_cpsw_nuss_remove_tx_chns()
tcp_cubic: fix incorrect HyStart round start detection
net/rose: prevent integer overflows in rose_setsockopt()
platform/mellanox: mlxbf-pmc: incorrect type in assignment
platform/x86: x86-android-tablets: make platform data be static
pinctrl: samsung: Fix irq handling if an error occurs in exynos_irq_demux_eint16_31()
libbpf: don't adjust USDT semaphore address if .stapsdt.base addr is missing
ASoC: cs40l50: Use *-y for Makefile
ASoC: mediatek: mt8365: Use *-y for Makefile
ASoC: wcd937x: Use *-y for Makefile
tools/testing/selftests/bpf/test_tc_tunnel.sh: Fix wait for server bind
libbpf: Fix segfault due to libelf functions not setting errno
ASoC: Intel: sof_sdw: correct mach_params->dmic_num
ASoC: sun4i-spdif: Add clock multiplier settings
selftests/bpf: Fix fill_link_info selftest on powerpc
iommu/arm-smmuv3: Update comments about ATS and bypass
crypto: tegra - do not transfer req when tegra init fails
crypto: api - Fix boot-up self-test race
crypto: caam - use JobR's space to access page 0 regs
perf header: Fix one memory leakage in process_bpf_btf()
perf header: Fix one memory leakage in process_bpf_prog_info()
perf bpf: Fix two memory leakages when calling perf_env__insert_bpf_prog_info()
ASoC: renesas: rz-ssi: Use only the proper amount of dividers
perf expr: Initialize is_test value in expr__ctx_new()
pinctrl: nomadik: Add check for clk_enable()
ktest.pl: Remove unused declarations in run_bisect_test function
bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT
rhashtable: Fix potential deadlock by moving schedule_work outside lock
crypto: hisilicon/sec2 - fix for aead icv error
crypto: hisilicon/sec2 - fix for aead invalid authsize
crypto: ixp4xx - fix OF node reference leaks in init_ixp_crypto()
crypto: iaa - Fix IAA disabling that occurs when sync_mode is set to 'async'
bpf: Use refcount_t instead of atomic_t for mmap_count
ALSA: seq: Make dependency on UMP clearer
bpf: Reject struct_ops registration that uses module ptr and the module btf_id is missing
padata: fix sysfs store callback check
selftests/bpf: Avoid generating untracked files when running bpf selftests
perf top: Don't complain about lack of vmlinux when not resolving some kernel samples
perf maps: Fix display of kernel symbols
perf machine: Don't ignore _etext when not a text symbol
perf namespaces: Introduce nsinfo__set_in_pidns()
perf namespaces: Fixup the nsinfo__in_pidns() return type, its bool
ASoC: Intel: avs: Do not readq() u32 registers
ASoC: Intel: avs: Fix the minimum firmware version numbers
ASoC: Intel: avs: Fix theoretical infinite loop
ASoC: Intel: avs: Fix init-config parsing
perf MANIFEST: Add arch/*/include/uapi/asm/bpf_perf_event.h to the perf tarball
ALSA: hda: Fix compilation of snd_hdac_adsp_xxx() helpers
perf report: Fix misleading help message about --demangle
pinctrl: stm32: Add check for clk_enable()
pinctrl: amd: Take suspend type into consideration which pins are non-wake
perf inject: Fix use without initialization of local variables
ASoC: Intel: sof_sdw: Fix DMI match for Lenovo 83LC
ASoC: Intel: sof_sdw: Fix DMI match for Lenovo 83JX, 83MC and 83NM
bpf: Send signals asynchronously if !preemptible
selftests/bpf: Fix btf leak on new btf alloc failure in btf_distill test
libbpf: Fix return zero when elf_begin failed
libbpf: Fix incorrect traversal end type ID when marking BTF_IS_EMBEDDED
bpf: tcp: Mark bpf_load_hdr_opt() arg2 as read-write
iommu/amd: Remove unused amd_iommu_domain_update()
ALSA: hda/realtek - Fixed headphone distorted sound on Acer Aspire A115-31 laptop
tools: Sync if_xdp.h uapi tooling header
perf lock: Fix parse_lock_type which only retrieve one lock flag
padata: fix UAF in padata_reorder
padata: add pd get/put refcnt helper
padata: avoid UAF for reorder_work
rhashtable: Fix rhashtable_try_insert test
smb: client: fix oops due to unset link speed
cifs: Use cifs_autodisable_serverino() for disabling CIFS_MOUNT_SERVER_INUM in readdir.c
bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT
soc: atmel: fix device_node release in atmel_soc_device_init()
ARM: at91: pm: change BU Power Switch to automatic mode
ARM: dts: imx7-tqma7: add missing vs-supply for LM75A (rev. 01xxx)
arm64: dts: mediatek: mt8186: Move wakeup to MTU3 to get working suspend
arm64: dts: mt8183: set DMIC one-wire mode on Damu
arm64: dts: mediatek: mt8516: fix GICv2 range
arm64: dts: mediatek: mt8516: fix wdt irq type
arm64: dts: mediatek: mt8516: add i2c clock-div property
arm64: dts: mediatek: mt8516: reserve 192 KiB for TF-A
ARM: dts: stm32: Increase CPU core voltage on STM32MP13xx DHCOR SoM
ARM: dts: stm32: Fix IPCC EXTI declaration on stm32mp151
RDMA/mlx4: Avoid false error about access to uninitialized gids array
arm64: dts: renesas: rzg3s-smarc: Fix the debug serial alias
rdma/cxgb4: Prevent potential integer overflow on 32bit
arm64: dts: mediatek: mt8173-evb: Drop regulator-compatible property
arm64: dts: mediatek: mt8173-elm: Drop regulator-compatible property
arm64: dts: mediatek: mt8192-asurada: Drop regulator-compatible property
arm64: dts: mediatek: mt8195-cherry: Drop regulator-compatible property
arm64: dts: mediatek: mt8195-demo: Drop regulator-compatible property
arm64: dts: medaitek: mt8395-nio-12l: Drop regulator-compatible property
arm64: dts: mediatek: mt8395-genio-1200-evk: Drop regulator-compatible property
arm64: dts: mediatek: mt8173-elm: Fix MT6397 PMIC sub-node names
arm64: dts: mediatek: mt8173-evb: Fix MT6397 PMIC sub-node names
ARM: dts: aspeed: yosemite4: correct the compatible string of adm1272
ARM: dts: aspeed: yosemite4: Add required properties for IOE on fan boards
ARM: dts: aspeed: yosemite4: correct the compatible string for max31790
arm: dts: socfpga: use reset-name "stmmaceth-ocp" instead of "ahb"
RDMA/rxe: Fix mismatched max_msg_sz
arm64: dts: mediatek: mt8183: kenzo: Support second source touchscreen
arm64: dts: mediatek: mt8183: willow: Support second source touchscreen
RDMA/srp: Fix error handling in srp_add_port
arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie1
ARM: dts: stm32: Deduplicate serial aliases and chosen node for STM32MP15xx DHCOM SoM
ARM: dts: stm32: Swap USART3 and UART8 alias on STM32MP15xx DHCOM SoM
memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code()
arm64: dts: mediatek: mt8183-kukui-jacuzzi: Drop pp3300_panel voltage settings
arm64: dts: qcom: msm8996-xiaomi-gemini: Fix LP5562 LED1 reg property
arm64: dts: qcom: sa8775p: Update sleep_clk frequency
arm64: defconfig: remove obsolete CONFIG_SM_DISPCC_8650
arm64: dts: qcom: msm8996: Fix up USB3 interrupts
arm64: dts: qcom: msm8994: Describe USB interrupts
arm64: dts: qcom: sm7225-fairphone-fp4: Drop extra qcom,msm-id value
arm64: dts: qcom: msm8916: correct sleep clock frequency
arm64: dts: qcom: msm8939: correct sleep clock frequency
arm64: dts: qcom: msm8994: correct sleep clock frequency
arm64: dts: qcom: qcs404: correct sleep clock frequency
arm64: dts: qcom: q[dr]u1000: correct sleep clock frequency
arm64: dts: qcom: qrb4210-rb2: correct sleep clock frequency
arm64: dts: qcom: sc7280: correct sleep clock frequency
arm64: dts: qcom: sdx75: correct sleep clock frequency
arm64: dts: qcom: sm4450: correct sleep clock frequency
arm64: dts: qcom: sm6125: correct sleep clock frequency
arm64: dts: qcom: sm6375: correct sleep clock frequency
arm64: dts: qcom: sm8250: correct sleep clock frequency
arm64: dts: qcom: sm8350: correct sleep clock frequency
arm64: dts: qcom: sm8450: correct sleep clock frequency
arm64: dts: qcom: sm8550: correct sleep clock frequency
arm64: dts: qcom: sm8650: correct sleep clock frequency
arm64: dts: qcom: x1e80100: correct sleep clock frequency
arm64: dts: qcom: sm8650: Fix CDSP context banks unit addresses
ARM: dts: microchip: sama5d29_curiosity: Add no-1-8-v property to sdmmc0 node
ARM: dts: microchip: sama5d27_wlsom1_ek: Add no-1-8-v property to sdmmc0 node
arm64: dts: ti: k3-am62: Remove duplicate GICR reg
arm64: dts: ti: k3-am62a: Remove duplicate GICR reg
arm64: dts: rockchip: Fix sdmmc access on rk3308-rock-s0 v1.1 boards
arm64: dts: allwinner: a64: explicitly assign clock parent for TCON0
RDMA/bnxt_re: Fix to drop reference to the mmap entry in case of error
RDMA/rtrs: Add missing deinit() call
RDMA/hns: Clean up the legacy CONFIG_INFINIBAND_HNS
ARM: omap1: Fix up the Retu IRQ on Nokia 770
arm64: dts: qcom: qcm6490-shift-otter: remove invalid orientation-switch
arm64: dts: qcom: sdm845-db845c-navigation-mezzanine: Convert mezzanine riser to dtso
arm64: dts: qcom: sdm845-db845c-navigation-mezzanine: remove disabled ov7251 camera
arm64: dts: qcom: sc7180-trogdor-quackingstick: add missing avee-supply
arm64: dts: qcom: sc7180-trogdor-pompom: rename 5v-choke thermal zone
arm64: dts: qcom: sc7180: change labels to lower-case
arm64: dts: qcom: sc7180: fix psci power domain node names
arm64: dts: qcom: sm8150-microsoft-surface-duo: fix typos in da7280 properties
arm64: dts: qcom: sc8280xp: Fix up remoteproc register space sizes
firmware: qcom: scm: Cleanup global '__scm' on probe failures
arm64: dts: mediatek: mt7988: Add missing clock-div property for i2c
dts: arm64: mediatek: mt8195: Remove MT8183 compatible for OVL
arm64: dts: mediatek: add per-SoC compatibles for keypad nodes
arm64: dts: qcom: sc8280xp: Fix interrupt type of camss interrupts
arm64: dts: qcom: sdm845: Fix interrupt types of camss interrupts
arm64: dts: qcom: sm8250: Fix interrupt types of camss interrupts
arm64: dts: marvell: cn9131-cf-solidwan: fix cp1 comphy links
ARM: dts: mediatek: mt7623: fix IR nodename
arm64: dts: rockchip: fix num-channels property of wolfvision pf5 mic
arm64: dts: ti: k3-am642-hummingboard-t: Convert overlay to board dts
fbdev: omapfb: Fix an OF node leak in dss_of_port_get_parent_device()
arm64: tegra: Fix DMA ID for SPI2
arm64: dts: qcom: x1e80100-romulus: Update firmware nodes
i3c: dw: Fix use-after-free in dw_i3c_master driver due to race condition
RDMA/mlx5: Fix indirect mkey ODP page count
of: property: Avoiding using uninitialized variable @imaplen in parse_interrupt_map()
of: reserved-memory: Do not make kmemleak ignore freed address
efi: sysfb_efi: fix W=1 warnings when EFI is not set
RDMA/cxgb4: Notify rdma stack for IB_EVENT_QP_LAST_WQE_REACHED event
RDMA/rxe: Fix the warning "__rxe_cleanup+0x12c/0x170 [rdma_rxe]"
iommu: iommufd: fix WARNING in iommufd_device_unbind
iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index()
spi: omap2-mcspi: Correctly handle devm_clk_get_optional() errors
of: reserved_mem: Restructure how the reserved memory regions are processed
of/fdt: Restore possibility to use both ACPI and FDT from bootloader
media: rc: iguanair: handle timeouts
media: lmedm04: Handle errors for lme2510_int_read
PCI: endpoint: Destroy the EPC device in devm_pci_epc_destroy()
remoteproc: mtk_scp: Only populate devices for SCP cores
media: marvell: Add check for clk_enable()
media: i2c: imx290: Register 0x3011 varies between imx327 and imx290
media: i2c: imx412: Add missing newline to prints
media: i2c: ov9282: Correct the exposure offset
media: mipi-csis: Add check for clk_enable()
media: camif-core: Add check for clk_enable()
media: uvcvideo: Propagate buf->error to userspace
mtd: rawnand: brcmnand: fix status read of brcmnand_waitfunc
mtd: hyperbus: hbmc-am654: fix an OF node reference leak
media: nxp: imx8-isi: fix v4l2-compliance test errors
watchdog: rti_wdt: Fix an OF node leak in rti_wdt_probe()
staging: media: imx: fix OF node leak in imx_media_add_of_subdevs()
media: dvb-usb-v2: af9035: fix ISO C90 compilation error on af9035_i2c_master_xfer
PCI: rcar-ep: Fix incorrect variable used when calling devm_request_mem_region()
PCI: imx6: Configure PHY based on Root Complex or Endpoint mode
PCI: imx6: Skip controller_id generation logic for i.MX7D
PCI: imx6: Deassert apps_reset in imx_pcie_deassert_core_reset()
PCI: imx6: Add missing reference clock disable logic
PCI: qcom: Update ICC and OPP values after Link Up event
PCI: dwc: Always stop link in the dw_pcie_suspend_noirq
PCI: endpoint: pci-epf-test: Set dma_chan_rx pointer to NULL on error
PCI: endpoint: pci-epf-test: Fix check for DMA MEMCPY test
PCI: microchip: Add support for using either Root Port 1 or 2
PCI: microchip: Set inbound address translation for coherent or non-coherent mode
scsi: mpt3sas: Set ioc->manu_pg11.EEDPTagMode directly to 1
scsi: ufs: bsg: Delete bsg_dev when setting up bsg fails
scsi: mpi3mr: Fix possible crash when setting up bsg fails
firewire: test: Fix potential null dereference in firewire kunit test
erofs: get rid of erofs_{find,insert}_workgroup
erofs: move erofs_workgroup operations into zdata.c
erofs: sunset `struct erofs_workgroup`
erofs: fix potential return value overflow of z_erofs_shrink_scan()
ocfs2: mark dquot as inactive if failed to start trans while releasing dquot
nilfs2: do not force clear folio if buffer is referenced
nilfs2: protect access to buffers with no active references
nilfs2: handle errors that nilfs_prepare_chunk() may return
module: Extend the preempt disabled section in dereference_symbol_descriptor().
module: Don't fail module loading when setting ro_after_init section RO failed
driver core: class: Fix wild pointer dereferences in API class_dev_iter_next()
tty: mips_ejtag_fdc: fix one more u8 warning
serial: 8250: Adjust the timeout for FIFO mode
nfs: fix incorrect error handling in LOCALIO
NFSv4.2: fix COPY_NOTIFY xdr buf size calculation
NFSv4.2: mark OFFLOAD_CANCEL MOVEABLE
LoongArch: Fix warnings during S3 suspend
tools/bootconfig: Fix the wrong format specifier
xfrm: replay: Fix the update of replay_esn->oseq_hi for GSO
xfrm: Add support for per cpu xfrm state handling.
xfrm: Cache used outbound xfrm states at the policy.
xfrm: Add an inbound percpu state cache.
xfrm: state: fix out-of-bounds read during lookup
dmaengine: ti: edma: fix OF node reference leaks in edma_driver
xfrm: delete intermediate secpath entry in packet offload mode
rtc: tps6594: Fix integer overflow on 32bit systems
rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read
rtc: loongson: clear TOY_MATCH0_REG in loongson_rtc_isr()
ubifs: skip dumping tnc tree when zroot is null
regulator: core: Add missing newline character
net: airoha: Fix wrong GDM4 register definition
net: hns3: fix oops when unload drivers paralleling
gpio: mxc: remove dead code after switch to DT-only
net: phy: marvell-88q2xxx: Fix temperature measurement with reset-gpios
net: fec: implement TSO descriptor cleanup
ipmr: do not call mr_mfc_uses_dev() for unres entries
PM: hibernate: Add error handling for syscore_suspend()
perf trace: Fix BPF loading failure (-E2BIG)
xfrm: Don't disable preemption while looking up cache state.
idpf: add read memory barrier when checking descriptor done bit
idpf: fix transaction timeouts on reset
idpf: Acquire the lock before accessing the xn->salt
idpf: convert workqueues to unbound
ice: fix ice_parser_rt::bst_key array size
ice: rework of dump serdes equalizer values feature
ice: extend dump serdes equalizer values feature
ice: remove invalid parameter of equalizer
iavf: allow changing VLAN state without calling PF
s390/mm: Allow large pages for KASAN shadow mapping
net/ncsi: use dev_set_mac_address() for Get MC MAC Address handling
net: rose: fix timer races against user threads
net: netdevsim: try to close UDP port harness races
tools: ynl: c: correct reverse decode of empty attrs
selftests: mptcp: extend CFLAGS to keep options from environment
selftests: net/{lib,openvswitch}: extend CFLAGS to keep options from environment
rxrpc, afs: Fix peer hash locking vs RCU callback
vxlan: Fix uninit-value in vxlan_vnifilter_dump()
net: davicom: fix UAF in dm9000_drv_remove
ptp: Properly handle compat ioctls
net: ethtool: only allow set_rxnfc with rss + ring_cookie if driver opts in
ethtool: Fix set RXNFC command with symmetric RSS hash
net: stmmac: Limit the number of MTL queues to hardware capability
net: stmmac: Limit FIFO size by hardware capability
s390/sclp: Initialize sclp subsystem via arch_cpu_finalize_init()
perf trace: Fix runtime error of index out of bounds
perf test: Skip syscall enum test if no landlock syscall
Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()
Bluetooth: btnxpuart: Fix glitches seen in dual A2DP streaming
vsock: Allow retrying on connect() failure
bgmac: reduce max frame size to support just MTU 1500
tcp: correct handling of extreme memory squeeze
net: xdp: Disallow attaching device-bound programs in generic mode
net: ravb: Fix missing rtnl lock in suspend/resume path
net: sh_eth: Fix missing rtnl lock in suspend/resume path
net: hsr: fix fill_frame_info() regression vs VLAN packets
genksyms: fix memory leak when the same symbol is added from source
genksyms: fix memory leak when the same symbol is read from *.symref file
hostfs: fix string handling in __dentry_name()
tools/power turbostat: Allow using cpu device in perf counters on hybrid platforms
tools/power turbostat: Fix PMT mmaped file size rounding
RISC-V: Mark riscv_v_init() as __init
ASoC: rockchip: i2s_tdm: Re-add the set_sysclk callback
io_uring/uring_cmd: use cached cmd_op in io_uring_cmd_sock()
ASoC: amd: acp: Fix possible deadlock
tools/power turbostat: Fix forked child affinity regression
cifs: Validate EAs for WSL reparse points
cifs: Fix getting and setting SACLs over SMB1
kconfig: fix file name in warnings when loading KCONFIG_DEFCONFIG_LIST
kconfig: fix memory leak in sym_warn_unmet_dep()
hexagon: fix using plain integer as NULL pointer warning in cmpxchg
hexagon: Fix unbalanced spinlock in die()
f2fs: Introduce linear search for dentries
md/md-bitmap: factor behind write counters out from bitmap_{start/end}write()
md/md-bitmap: remove the last parameter for bimtap_ops->endwrite()
md: add a new callback pers->bitmap_sector()
md/raid5: implement pers->bitmap_sector()
md/md-bitmap: move bitmap_{start, end}write to md upper layer
Revert "SUNRPC: Reduce thread wake-up rate when receiving large RPC messages"
kbuild: switch from lz4c to lz4 for compression
netfilter: nf_tables: reject mismatching sum of field_len with set key length
drm/amd/display: Reduce accessing remote DPCD overhead
selftests/rseq: Fix handling of glibc without rseq support
selftests/ftrace: Fix to use remount when testing mount GID option
ktest.pl: Check kernelrelease return in get_version
xfs: check for dead buffers in xfs_buf_find_insert
xfs: don't shut down the filesystem for media failures beyond end of log
ALSA: usb-audio: Add delay quirk for iBasso DC07 Pro
net: usb: rtl8150: enable basic endpoint checking
usb: xhci: Fix NULL pointer dereference on certain command aborts
drivers/card_reader/rtsx_usb: Restore interrupt based detection
usb: gadget: f_tcm: Fix Get/SetInterface return value
usb: dwc3-am62: Fix an OF node leak in phy_syscon_pll_refclk()
usb: dwc3: core: Defer the probe until USB power supply ready
usb: dwc3: Skip resume if pm_runtime_set_active() fails
usb: typec: tcpm: set SRC_SEND_CAPABILITIES timeout to PD_T_SENDER_RESPONSE
usb: typec: tcpci: Prevent Sink disconnection before vPpsShutdown in SPR PPS
clk: qcom: gcc-x1e80100: Do not turn off usb_2 controller GDSC
mptcp: consolidate suboption status
mptcp: pm: only set fullmesh for subflow endp
mptcp: handle fastopen disconnect correctly
mptcp: blackhole only if 1st SYN retrans w/o MPC is accepted
RDMA/mlx5: Fix implicit ODP use after free
remoteproc: core: Fix ida_free call while not allocated
media: uvcvideo: Fix double free in error path
pps: Fix a use-after-free
usb: gadget: f_tcm: Don't free command immediately
staging: media: max96712: fix kernel oops when removing module
media: imx-jpeg: Fix potential error pointer dereference in detach_pm()
powerpc/pseries/iommu: Don't unset window if it was never set
md/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetime
btrfs: output the reason for open_ctree() failure
of: reserved-memory: Warn for missing static reserved memory regions
dma-mapping: save base/size instead of pointer to shared DMA pool
xfrm: Add error handling when nla_put_u32() returns an error
xfrm: Fix acquire state insertion.
ethtool: Fix access to uninitialized fields in set RXNFC command
Revert "s390/mm: Allow large pages for KASAN shadow mapping"
selftests/bpf: Add test to verify tailcall and freplace restrictions
ASoC: da7213: Initialize the mutex
s390: Add '-std=gnu11' to decompressor and purgatory CFLAGS
drm/amd/display: Add hubp cache reset when powergating
KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update()
memcg: fix soft lockup in the OOM process
LoongArch: Change 8 to 14 for LOONGARCH_MAX_{BRP,WRP}
btrfs: do proper folio cleanup when run_delalloc_nocow() failed
ethtool: ntuple: fix rss + ring_cookie check
Linux 6.12.13
Change-Id: I0b4278d2911ea7c72e068418ed56d1514b393980
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit 58f038e6d209d2dd862fcf5de55407855856794d ]
During the update procedure, when overwrite element in a pre-allocated
htab, the freeing of old_element is protected by the bucket lock. The
reason why the bucket lock is necessary is that the old_element has
already been stashed in htab->extra_elems after alloc_htab_elem()
returns. If freeing the old_element after the bucket lock is unlocked,
the stashed element may be reused by concurrent update procedure and the
freeing of old_element will run concurrently with the reuse of the
old_element. However, the invocation of check_and_free_fields() may
acquire a spin-lock which violates the lockdep rule because its caller
has already held a raw-spin-lock (bucket lock). The following warning
will be reported when such race happens:
BUG: scheduling while atomic: test_progs/676/0x00000003
3 locks held by test_progs/676:
#0: ffffffff864b0240 (rcu_read_lock_trace){....}-{0:0}, at: bpf_prog_test_run_syscall+0x2c0/0x830
#1: ffff88810e961188 (&htab->lockdep_key){....}-{2:2}, at: htab_map_update_elem+0x306/0x1500
#2: ffff8881f4eac1b8 (&base->softirq_expiry_lock){....}-{2:2}, at: hrtimer_cancel_wait_running+0xe9/0x1b0
Modules linked in: bpf_testmod(O)
Preemption disabled at:
[<ffffffff817837a3>] htab_map_update_elem+0x293/0x1500
CPU: 0 UID: 0 PID: 676 Comm: test_progs Tainted: G ... 6.12.0+ #11
Tainted: [W]=WARN, [O]=OOT_MODULE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)...
Call Trace:
<TASK>
dump_stack_lvl+0x57/0x70
dump_stack+0x10/0x20
__schedule_bug+0x120/0x170
__schedule+0x300c/0x4800
schedule_rtlock+0x37/0x60
rtlock_slowlock_locked+0x6d9/0x54c0
rt_spin_lock+0x168/0x230
hrtimer_cancel_wait_running+0xe9/0x1b0
hrtimer_cancel+0x24/0x30
bpf_timer_delete_work+0x1d/0x40
bpf_timer_cancel_and_free+0x5e/0x80
bpf_obj_free_fields+0x262/0x4a0
check_and_free_fields+0x1d0/0x280
htab_map_update_elem+0x7fc/0x1500
bpf_prog_9f90bc20768e0cb9_overwrite_cb+0x3f/0x43
bpf_prog_ea601c4649694dbd_overwrite_timer+0x5d/0x7e
bpf_prog_test_run_syscall+0x322/0x830
__sys_bpf+0x135d/0x3ca0
__x64_sys_bpf+0x75/0xb0
x64_sys_call+0x1b5/0xa10
do_syscall_64+0x3b/0xc0
entry_SYSCALL_64_after_hwframe+0x4b/0x53
...
</TASK>
It seems feasible to break the reuse and refill of per-cpu extra_elems
into two independent parts: reuse the per-cpu extra_elems with bucket
lock being held and refill the old_element as per-cpu extra_elems after
the bucket lock is unlocked. However, it will make the concurrent
overwrite procedures on the same CPU return unexpected -E2BIG error when
the map is full.
Therefore, the patch fixes the lock problem by breaking the cancelling
of bpf_timer into two steps for PREEMPT_RT:
1) use hrtimer_try_to_cancel() and check its return value
2) if the timer is running, use hrtimer_cancel() through a kworker to
cancel it again
Considering that the current implementation of hrtimer_cancel() will try
to acquire a being held softirq_expiry_lock when the current timer is
running, these steps above are reasonable. However, it also has
downside. When the timer is running, the cancelling of the timer is
delayed when releasing the last map uref. The delay is also fixable
(e.g., break the cancelling of bpf timer into two parts: one part in
locked scope, another one in unlocked scope), it can be revised later if
necessary.
It is a bit hard to decide the right fix tag. One reason is that the
problem depends on PREEMPT_RT which is enabled in v6.12. Considering the
softirq_expiry_lock lock exists since v5.4 and bpf_timer is introduced
in v5.15, the bpf_timer commit is used in the fixes tag and an extra
depends-on tag is added to state the dependency on PREEMPT_RT.
Fixes: b00628b1c7 ("bpf: Introduce bpf timers.")
Depends-on: v6.12+ with PREEMPT_RT enabled
Reported-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Closes: https://lore.kernel.org/bpf/20241106084527.4gPrMnHt@linutronix.de
Signed-off-by: Hou Tao <houtao1@huawei.com>
Reviewed-by: Toke Høiland-Jørgensen <toke@kernel.org>
Link: https://lore.kernel.org/r/20250117101816.2101857-5-houtao@huaweicloud.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 96ea081ed52bf077cad6d00153b6fba68e510767 ]
There is a UAF report in the bpf_struct_ops when CONFIG_MODULES=n.
In particular, the report is on tcp_congestion_ops that has
a "struct module *owner" member.
For struct_ops that has a "struct module *owner" member,
it can be extended either by the regular kernel module or
by the bpf_struct_ops. bpf_try_module_get() will be used
to do the refcounting and different refcount is done
based on the owner pointer. When CONFIG_MODULES=n,
the btf_id of the "struct module" is missing:
WARN: resolve_btfids: unresolved symbol module
Thus, the bpf_try_module_get() cannot do the correct refcounting.
Not all subsystem's struct_ops requires the "struct module *owner" member.
e.g. the recent sched_ext_ops.
This patch is to disable bpf_struct_ops registration if
the struct_ops has the "struct module *" member and the
"struct module" btf_id is missing. The btf_type_is_fwd() helper
is moved to the btf.h header file for this test.
This has happened since the beginning of bpf_struct_ops which has gone
through many changes. The Fixes tag is set to a recent commit that this
patch can apply cleanly. Considering CONFIG_MODULES=n is not
common and the age of the issue, targeting for bpf-next also.
Fixes: 1611603537 ("bpf: Create argument information for nullable arguments.")
Reported-by: Robert Morris <rtm@csail.mit.edu>
Closes: https://lore.kernel.org/bpf/74665.1733669976@localhost/
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Tested-by: Eduard Zingerman <eddyz87@gmail.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20241220201818.127152-1-martin.lau@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 8eef6ac4d70eb1f0099fff93321d90ce8fa49ee1 ]
In PREEMPT_RT, kmalloc(GFP_ATOMIC) is still not safe in non preemptible
context. bpf_mem_alloc must be used in PREEMPT_RT. This patch is
to enforce bpf_mem_alloc in the bpf_local_storage when CONFIG_PREEMPT_RT
is enabled.
[ 35.118559] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48
[ 35.118566] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1832, name: test_progs
[ 35.118569] preempt_count: 1, expected: 0
[ 35.118571] RCU nest depth: 1, expected: 1
[ 35.118577] INFO: lockdep is turned off.
...
[ 35.118647] __might_resched+0x433/0x5b0
[ 35.118677] rt_spin_lock+0xc3/0x290
[ 35.118700] ___slab_alloc+0x72/0xc40
[ 35.118723] __kmalloc_noprof+0x13f/0x4e0
[ 35.118732] bpf_map_kzalloc+0xe5/0x220
[ 35.118740] bpf_selem_alloc+0x1d2/0x7b0
[ 35.118755] bpf_local_storage_update+0x2fa/0x8b0
[ 35.118784] bpf_sk_storage_get_tracing+0x15a/0x1d0
[ 35.118791] bpf_prog_9a118d86fca78ebb_trace_inet_sock_set_state+0x44/0x66
[ 35.118795] bpf_trace_run3+0x222/0x400
[ 35.118820] __bpf_trace_inet_sock_set_state+0x11/0x20
[ 35.118824] trace_inet_sock_set_state+0x112/0x130
[ 35.118830] inet_sk_state_store+0x41/0x90
[ 35.118836] tcp_set_state+0x3b3/0x640
There is no need to adjust the gfp_flags passing to the
bpf_mem_cache_alloc_flags() which only honors the GFP_KERNEL.
The verifier has ensured GFP_KERNEL is passed only in sleepable context.
It has been an old issue since the first introduction of the
bpf_local_storage ~5 years ago, so this patch targets the bpf-next.
bpf_mem_alloc is needed to solve it, so the Fixes tag is set
to the commit when bpf_mem_alloc was first used in the bpf_local_storage.
Fixes: 08a7ce384e ("bpf: Use bpf_mem_cache_alloc/free in bpf_local_storage_elem")
Reported-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Link: https://lore.kernel.org/r/20241218193000.2084281-1-martin.lau@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
GKI (arm64) relevant 33 out of 157 changes, affecting 48 files +347/-176
efefe36c03 selinux: ignore unknown extended permissions [1 file, +6/-2]
cba9d51794 pmdomain: core: add dummy release function to genpd device [1 file, +6/-0]
92bd18c746 tracing: Have process_string() also allow arrays [1 file, +12/-0]
b983a01f58 netdev-genl: avoid empty messages in napi get [1 file, +5/-1]
b0b190218c net: fix memory leak in tcp_conn_request() [1 file, +1/-0]
0e394dd11e workqueue: add printf attribute to __alloc_workqueue() [1 file, +1/-0]
d24cbc43cc netfilter: nft_set_hash: unaligned atomic read on struct nft_set_ext [1 file, +5/-2]
1ee54d58d5 net: llc: reset skb->transport_header [1 file, +1/-1]
b48a058db3 ALSA: usb-audio: US16x08: Initialize array before use [1 file, +1/-1]
127c280067 io_uring/net: always initialize kmsg->msg.msg_inq upfront [1 file, +1/-0]
d3b7a9c759 net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets [1 file, +3/-1]
3257813a3a net: restrict SO_REUSEPORT to inet sockets [1 file, +4/-1]
b65292a548 af_packet: fix vlan_get_tci() vs MSG_PEEK [1 file, +3/-9]
cd8488fdc7 af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK [2 files, +17/-15]
03c446634f sound: usb: enable DSD output for ddHiFi TC44C [1 file, +2/-0]
d49362b059 sound: usb: format: don't warn that raw DSD is unsupported [1 file, +6/-1]
1da4ebd869 bpf: fix potential error return [1 file, +5/-1]
4a31c018bf Bluetooth: hci_core: Fix sleeping function called from invalid context [6 files, +97/-57]
c88e3ecb94 irqchip/gic: Correct declaration of *percpu_base pointer in union gic_base [1 file, +1/-1]
28bcc80240 bpf: refactor bpf_helper_changes_pkt_data to use helper number [4 files, +31/-38]
1c2244437f bpf: consider that tail calls invalidate packet pointers [2 files, +4/-0]
2a44d48d32 modpost: fix the missed iteration for the max bit in do_input() [1 file, +1/-1]
c7e9cb3db7 io_uring/kbuf: use pre-committed buffer address for non-pollable file [1 file, +3/-1]
90daa2f835 maple_tree: reload mas before the second call for mas_empty_area [1 file, +1/-0]
ffb231471a workqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from !WQ_MEM_RECLAIM worker [1 file, +13/-9]
41ce61328e io_uring/rw: fix downgraded mshot read [1 file, +2/-0]
cabacb18a4 mm: shmem: fix the update of 'shmem_falloc->nr_unswapped' [1 file, +1/-1]
9e4c11d4cc mm: shmem: fix incorrect index alignment for within_size policy [1 file, +3/-2]
d066ab595c fs/proc/task_mmu: fix pagemap flags with PMD THP entries on 32bit [1 file, +1/-1]
5802fe9cfc mm/readahead: fix large folio support in async readahead [1 file, +5/-1]
58d0d02dbc mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() [1 file, +8/-1]
464770df46 mm: reinstate ability to map write-sealed memfd mappings read-only [4 files, +59/-19]
2e31443a0d mm: hugetlb: independent PMD page table shared count [3 files, +38/-9]
Changes in 6.12.9
platform/x86: mlx-platform: call pci_dev_put() to balance the refcount
drm/amdgpu: fix backport of commit 73dae652dcac
platform/x86: thinkpad-acpi: Add support for hotkey 0x1401
platform/x86: hp-wmi: mark 8A15 board for timed OMEN thermal profile
selinux: ignore unknown extended permissions
mmc: sdhci-msm: fix crypto key eviction
pmdomain: imx: gpcv2: fix an OF node reference leak in imx_gpcv2_probe()
pmdomain: core: add dummy release function to genpd device
tracing: Have process_string() also allow arrays
block: lift bio_is_zone_append to bio.h
btrfs: use bio_is_zone_append() in the completion handler
RDMA/bnxt_re: Remove always true dattr validity check
sched_ext: fix application of sizeof to pointer
RDMA/mlx5: Enforce same type port association for multiport RoCE
RDMA/bnxt_re: Fix max SGEs for the Work Request
RDMA/bnxt_re: Avoid initializing the software queue for user queues
RDMA/bnxt_re: Avoid sending the modify QP workaround for latest adapters
RDMA/core: Fix ENODEV error for iWARP test over vlan
nvme-pci: 512 byte aligned dma pool segment quirk
wifi: iwlwifi: fix CRF name for Bz
RDMA/bnxt_re: Fix the check for 9060 condition
RDMA/bnxt_re: Add check for path mtu in modify_qp
RDMA/bnxt_re: Fix reporting hw_ver in query_device
RDMA/nldev: Set error code in rdma_nl_notify_event
RDMA/siw: Remove direct link to net_device
RDMA/bnxt_re: Fix max_qp_wrs reported
RDMA/bnxt_re: Disable use of reserved wqes
RDMA/bnxt_re: Add send queue size check for variable wqe
RDMA/bnxt_re: Fix MSN table size for variable wqe mode
RDMA/bnxt_re: Fix the locking while accessing the QP table
net: phy: micrel: Dynamically control external clock of KSZ PHY
drm/bridge: adv7511_audio: Update Audio InfoFrame properly
net: dsa: microchip: Fix KSZ9477 set_ageing_time function
net: dsa: microchip: Fix LAN937X set_ageing_time function
selftests: net: local_termination: require mausezahn
netdev-genl: avoid empty messages in napi get
RDMA/hns: Fix mapping error of zero-hop WQE buffer
RDMA/hns: Fix accessing invalid dip_ctx during destroying QP
RDMA/hns: Fix warning storm caused by invalid input in IO path
RDMA/hns: Fix missing flush CQE for DWQE
drm/xe: Revert some changes that break a mesa debug tool
drm/xe/pf: Use correct function to check LMEM provisioning
drm/xe: Fix fault on fd close after unbind
net: stmmac: restructure the error path of stmmac_probe_config_dt()
net: fix memory leak in tcp_conn_request()
net: Fix netns for ip_tunnel_init_flow()
netrom: check buffer length before accessing it
net: pse-pd: tps23881: Fix power on/off issue
net/mlx5: DR, select MSIX vector 0 for completion queue creation
net/mlx5e: macsec: Maintain TX SA from encoding_sa
net/mlx5e: Skip restore TC rules for vport rep without loaded flag
net/mlx5e: Keep netdev when leave switchdev for devlink set legacy only
RDMA/rxe: Remove the direct link to net_device
drm/i915/cx0_phy: Fix C10 pll programming sequence
drm/i915/dg1: Fix power gate sequence.
workqueue: add printf attribute to __alloc_workqueue()
netfilter: nft_set_hash: unaligned atomic read on struct nft_set_ext
net: llc: reset skb->transport_header
nvmet: Don't overflow subsysnqn
ALSA: usb-audio: US16x08: Initialize array before use
eth: bcmsysport: fix call balance of priv->clk handling routines
net: mv643xx_eth: fix an OF node reference leak
net: wwan: t7xx: Fix FSM command timeout issue
RDMA/rtrs: Ensure 'ib_sge list' is accessible
RDMA/bnxt_re: Fix error recovery sequence
io_uring/net: always initialize kmsg->msg.msg_inq upfront
net: sfc: Correct key_len for efx_tc_ct_zone_ht_params
net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets
net: restrict SO_REUSEPORT to inet sockets
net: wwan: iosm: Properly check for valid exec stage in ipc_mmio_init()
af_packet: fix vlan_get_tci() vs MSG_PEEK
af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK
ila: serialize calls to nf_register_net_hooks()
net: ti: icssg-prueth: Fix firmware load sequence.
net: ti: icssg-prueth: Fix clearing of IEP_CMP_CFG registers during iep_init
btrfs: allow swap activation to be interruptible
perf/x86/intel: Add Arrow Lake U support
wifi: mac80211: fix mbss changed flags corruption on 32 bit systems
wifi: cfg80211: clear link ID from bitmap during link delete after clean up
wifi: mac80211: wake the queues in case of failure in resume
drm/amdgpu: use sjt mec fw on gfx943 for sriov
drm/amdkfd: Correct the migration DMA map direction
ALSA: hda: cs35l56: Remove calls to cs35l56_force_sync_asp1_registers_from_cache()
ALSA: hda/realtek - Add support for ASUS Zen AIO 27 Z272SD_A272SD audio
btrfs: handle bio_split() errors
btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount
ALSA: hda/ca0132: Use standard HD-audio quirk matching helpers
ALSA: hda/realtek: Add new alc2xx-fixup-headset-mic model
sound: usb: enable DSD output for ddHiFi TC44C
sound: usb: format: don't warn that raw DSD is unsupported
spi: spi-cadence-qspi: Disable STIG mode for Altera SoCFPGA.
ASoC: audio-graph-card: Call of_node_put() on correct node
ARC: build: disallow invalid PAE40 + 4K page config
ARC: build: Use __force to suppress per-CPU cmpxchg warnings
ARC: bpf: Correct conditional check in 'check_jmp_32'
bpf: fix potential error return
ksmbd: retry iterate_dir in smb2_query_dir
ksmbd: set ATTR_CTIME flags when setting mtime
smb: client: destroy cfid_put_wq on module exit
net: usb: qmi_wwan: add Telit FE910C04 compositions
Bluetooth: hci_core: Fix sleeping function called from invalid context
irqchip/gic: Correct declaration of *percpu_base pointer in union gic_base
ARC: build: Try to guess GCC variant of cross compiler
bpf: refactor bpf_helper_changes_pkt_data to use helper number
bpf: consider that tail calls invalidate packet pointers
clk: thead: Fix TH1520 emmc and shdci clock rate
scripts/mksysmap: Fix escape chars '$'
modpost: fix the missed iteration for the max bit in do_input()
kbuild: pacman-pkg: provide versioned linux-api-headers package
Revert "ALSA: ump: Don't enumeration invalid groups for legacy rawmidi"
RDMA/mlx5: Enable multiplane mode only when it is supported
io_uring/kbuf: use pre-committed buffer address for non-pollable file
ALSA: seq: Check UMP support for midi_version change
ftrace: Fix function profiler's filtering functionality
drm/xe: Use non-interruptible wait when moving BO to system
drm/xe: Wait for migration job before unmapping pages
ALSA hda/realtek: Add quirk for Framework F111:000C
ALSA: seq: oss: Fix races at processing SysEx messages
ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
kcov: mark in_softirq_really() as __always_inline
maple_tree: reload mas before the second call for mas_empty_area
clk: clk-imx8mp-audiomix: fix function signature
scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity
sched_ext: Fix invalid irq restore in scx_ops_bypass()
RDMA/uverbs: Prevent integer overflow issue
pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking
workqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from !WQ_MEM_RECLAIM worker
sky2: Add device ID 11ab:4373 for Marvell 88E8075
sched_ext: initialize kit->cursor.flags
net/sctp: Prevent autoclose integer overflow in sctp_association_init()
io_uring/rw: fix downgraded mshot read
drm: adv7511: Drop dsi single lane support
dt-bindings: display: adi,adv7533: Drop single lane support
drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
wifi: iwlwifi: mvm: Fix __counted_by usage in cfg80211_wowlan_nd_*
fgraph: Add READ_ONCE() when accessing fgraph_array[]
net: ethernet: ti: am65-cpsw: default to round-robin for host port receive
mm/damon/core: fix ignored quota goals and filters of newly committed schemes
mm/damon/core: fix new damon_target objects leaks on damon_commit_targets()
mm: shmem: fix the update of 'shmem_falloc->nr_unswapped'
mm: shmem: fix incorrect index alignment for within_size policy
fs/proc/task_mmu: fix pagemap flags with PMD THP entries on 32bit
gve: process XSK TX descriptors as part of RX NAPI
gve: clean XDP queues in gve_tx_stop_ring_gqi
gve: guard XSK operations on the existence of queues
gve: fix XDP allocation path in edge cases
gve: guard XDP xmit NDO on existence of xdp queues
gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup
mm/readahead: fix large folio support in async readahead
mm/kmemleak: fix sleeping function called from invalid context at print message
mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim()
mm: reinstate ability to map write-sealed memfd mappings read-only
mm: hugetlb: independent PMD page table shared count
mptcp: fix TCP options overflow.
mptcp: fix recvbuffer adjust on sleeping rcvmsg
mptcp: don't always assume copied data in mptcp_cleanup_rbuf()
Linux 6.12.9
Change-Id: I539c48fcfd54c483af4858e034bec3477e68efd2
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit b238e187b4a2d3b54d80aec05a9cab6466b79dde ]
Use BPF helper number instead of function pointer in
bpf_helper_changes_pkt_data(). This would simplify usage of this
function in verifier.c:check_cfg() (in a follow-up patch),
where only helper number is easily available and there is no real need
to lookup helper proto.
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20241210041100.1898468-3-eddyz87@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Stable-dep-of: 1a4607ffba35 ("bpf: consider that tail calls invalidate packet pointers")
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit c4441ca86afe4814039ee1b32c39d833c1a16bbc ]
The bpf_remove_insns() function returns WARN_ON_ONCE(error), where
error is a result of bpf_adj_branches(), and thus should be always 0
However, if for any reason it is not 0, then it will be converted to
boolean by WARN_ON_ONCE and returned to user space as 1, not an actual
error value. Fix this by returning the original err after the WARN check.
Signed-off-by: Anton Protopopov <aspsk@isovalent.com>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/r/20241210114245.836164-1-aspsk@isovalent.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
GKI (arm64) relevant 24 out of 115 changes, affecting 34 files +169/-94
f4ab7d7424 bpf: Fix bpf_get_smp_processor_id() on !CONFIG_SMP [1 file, +5/-1]
8cdfb06569 fork: avoid inappropriate uprobe access to invalid mm [1 file, +6/-7]
2175b66c7f mm/vmstat: fix a W=1 clang compiler warning [1 file, +1/-1]
35727f4506 tcp_bpf: Charge receive socket buffer in bpf_tcp_ingress() [2 files, +9/-3]
4aa5dcb389 tcp_bpf: Add sk_rmem_alloc related logic for tcp_bpf ingress redirection [3 files, +16/-5]
997cf2d8c2 bpf: Check negative offsets in __bpf_skb_min_len() [1 file, +15/-6]
a817e938a0 phy: core: Fix an OF node refcount leakage in _of_phy_get() [1 file, +5/-2]
479b6c2a5f phy: core: Fix an OF node refcount leakage in of_phy_provider_lookup() [1 file, +3/-1]
09f17bfb36 phy: core: Fix that API devm_phy_put() fails to release the phy [1 file, +1/-1]
f797151e84 phy: core: Fix that API devm_of_phy_provider_unregister() fails to unregister the phy provider [1 file, +3/-3]
7e7c8ffc01 phy: core: Fix that API devm_phy_destroy() fails to destroy the phy [1 file, +1/-1]
c180c3f42d ALSA: memalloc: prefer dma_mapping_error() over explicit address checking [1 file, +1/-1]
a39ff5bf23 stddef: make __struct_group() UAPI C++-friendly [2 files, +21/-7]
68662d78af tracing/kprobe: Make trace_kprobe's module callback called after jump_label update [1 file, +1/-1]
ca5995f805 regmap: Use correct format specifier for logging range errors [1 file, +2/-2]
fdaaf92943 bpf: Zero index arg error string for dynptr and iter [6 files, +29/-29]
92d5139b91 virtio-blk: don't keep queue frozen during system suspend [1 file, +5/-2]
16b54ee81d blk-mq: register cpuhp callback after hctx is added to xarray table [1 file, +7/-8]
7d680f2f76 ublk: detach gendisk from ublk device if add_disk() fails [1 file, +17/-9]
79a47fd0f1 freezer, sched: Report frozen tasks as 'D' instead of 'R' [1 file, +2/-1]
a744146969 tracing: Constify string literal data member in struct trace_event_call [1 file, +1/-1]
1cca920af1 tracing: Prevent bad count for tracing_cpumask_write [1 file, +3/-0]
8e8494c83c io_uring/sqpoll: fix sqpoll error handling races [1 file, +6/-0]
aed157301c PCI/MSI: Handle lack of irqdomain gracefully [2 files, +9/-2]
Changes in 6.12.8
media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg
ceph: allocate sparse_ext map only for sparse reads
arm64: dts: broadcom: Fix L2 linesize for Raspberry Pi 5
bpf: Fix bpf_get_smp_processor_id() on !CONFIG_SMP
fork: avoid inappropriate uprobe access to invalid mm
mm/vmstat: fix a W=1 clang compiler warning
selftests/bpf: Fix compilation error in get_uprobe_offset()
smb: client: Deduplicate "select NETFS_SUPPORT" in Kconfig
smb: fix bytes written value in /proc/fs/cifs/Stats
tcp_bpf: Charge receive socket buffer in bpf_tcp_ingress()
tcp_bpf: Add sk_rmem_alloc related logic for tcp_bpf ingress redirection
bpf: Check negative offsets in __bpf_skb_min_len()
nfsd: Revert "nfsd: release svc_expkey/svc_export with rcu_work"
nfsd: restore callback functionality for NFSv4.0
mtd: diskonchip: Cast an operand to prevent potential overflow
mtd: rawnand: arasan: Fix double assertion of chip-select
mtd: rawnand: arasan: Fix missing de-registration of NAND
phy: qcom-qmp: Fix register name in RX Lane config of SC8280XP
phy: core: Fix an OF node refcount leakage in _of_phy_get()
phy: core: Fix an OF node refcount leakage in of_phy_provider_lookup()
phy: core: Fix that API devm_phy_put() fails to release the phy
phy: core: Fix that API devm_of_phy_provider_unregister() fails to unregister the phy provider
phy: core: Fix that API devm_phy_destroy() fails to destroy the phy
phy: usb: Toggle the PHY power during init
phy: rockchip: samsung-hdptx: Set drvdata before enabling runtime PM
phy: rockchip: naneng-combphy: fix phy reset
ALSA: memalloc: prefer dma_mapping_error() over explicit address checking
dmaengine: mv_xor: fix child node refcount handling in early exit
dmaengine: dw: Select only supported masters for ACPI devices
dmaengine: tegra: Return correct DMA status when paused
dmaengine: amd: qdma: Remove using the private get and set dma_ops APIs
dmaengine: fsl-edma: implement the cleanup path of fsl_edma3_attach_pd()
dmaengine: apple-admac: Avoid accessing registers in probe
dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset
ASoC: SOF: Intel: hda-dai: Do not release the link DMA on STOP
platform/chrome: cros_ec_lpc: fix product identity for early Framework Laptops
mtd: rawnand: fix double free in atmel_pmecc_create_user()
ASoC: amd: ps: Fix for enabling DMIC on acp63 platform via _DSD entry
ASoC: Intel: sof_sdw: Fix DMI match for Lenovo 21QA and 21QB
ASoC: dt-bindings: realtek,rt5645: Fix CPVDD voltage comment
ASoC: Intel: sof_sdw: Fix DMI match for Lenovo 21Q6 and 21Q7
powerpc/pseries/vas: Add close() callback in vas_vm_ops struct
power: supply: bq24190: Fix BQ24296 Vbus regulator support
stddef: make __struct_group() UAPI C++-friendly
tracing/kprobe: Make trace_kprobe's module callback called after jump_label update
watchdog: it87_wdt: add PWRGD enable quirk for Qotom QCML04
watchdog: rzg2l_wdt: Power on the watchdog domain in the restart handler
Revert "watchdog: s3c2410_wdt: use exynos_get_pmu_regmap_by_phandle() for PMU regs"
watchdog: mediatek: Add support for MT6735 TOPRGU/WDT
scsi: qla1280: Fix hw revision numbering for ISP1020/1040
scsi: megaraid_sas: Fix for a potential deadlock
udf: Skip parent dir link count update if corrupted
udf: Verify inode link counts before performing rename
ALSA: ump: Don't open legacy substream for an inactive group
ALSA: ump: Indicate the inactive group in legacy substream names
ALSA: ump: Update legacy substream names upon FB info update
ALSA: hda/conexant: fix Z60MR100 startup pop issue
ALSA: sh: Use standard helper for buffer accesses
smb: server: Fix building with GCC 15
regmap: Use correct format specifier for logging range errors
LoongArch: Fix reserving screen info memory for above-4G firmware
LoongArch: BPF: Adjust the parameter of emit_jirl()
platform/x86: asus-nb-wmi: Ignore unknown event 0xCF
bpf: Zero index arg error string for dynptr and iter
spi: intel: Add Panther Lake SPI controller support
scsi: mpt3sas: Diag-Reset when Doorbell-In-Use bit is set during driver load time
scsi: mpi3mr: Synchronize access to ioctl data buffer
scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs
scsi: mpi3mr: Start controller indexing from 0
scsi: mpi3mr: Handling of fault code for insufficient power
scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error
ACPI/IORT: Add PMCG platform information for HiSilicon HIP09A
spi: omap2-mcspi: Fix the IS_ERR() bug for devm_clk_get_optional_enabled()
drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req()
virtio-blk: don't keep queue frozen during system suspend
blk-mq: register cpuhp callback after hctx is added to xarray table
wifi: iwlwifi: be less noisy if the NIC is dead in S3
ublk: detach gendisk from ublk device if add_disk() fails
drm/xe: Take PM ref in delayed snapshot capture worker
drm/xe: Move the coredump registration to the worker thread
objtool: Add bch2_trans_unlocked_error() to bcachefs noreturns
freezer, sched: Report frozen tasks as 'D' instead of 'R'
dmaengine: loongson2-apb: Change GENMASK to GENMASK_ULL
perf/x86/intel/uncore: Add Clearwater Forest support
tracing: Constify string literal data member in struct trace_event_call
tracing: Prevent bad count for tracing_cpumask_write
rtla/timerlat: Fix histogram ALL for zero samples
io_uring/sqpoll: fix sqpoll error handling races
i2c: microchip-core: actually use repeated sends
x86/fred: Clear WFE in missing-ENDBRANCH #CPs
virt: tdx-guest: Just leak decrypted memory on unrecoverable errors
PCI/MSI: Handle lack of irqdomain gracefully
perf/x86/intel: Fix bitmask of OCR and FRONTEND events for LNC
i2c: imx: add imx7d compatible string for applying erratum ERR007805
i2c: microchip-core: fix "ghost" detections
perf/x86/intel/ds: Add PEBS format 6
power: supply: cros_charge-control: add mutex for driver data
power: supply: cros_charge-control: allow start_threshold == end_threshold
power: supply: cros_charge-control: hide start threshold on v2 cmd
power: supply: gpio-charger: Fix set charge current limits
btrfs: fix race with memory mapped writes when activating swap file
btrfs: avoid monopolizing a core when activating a swap file
btrfs: fix swap file activation failure due to extents that used to be shared
btrfs: fix transaction atomicity bug when enabling simple quotas
btrfs: sysfs: fix direct super block member reads
btrfs: fix use-after-free when COWing tree bock and tracing is enabled
btrfs: check folio mapping after unlock in put_file_data()
btrfs: check folio mapping after unlock in relocate_one_folio()
Bluetooth: btusb: mediatek: move Bluetooth power off command position
Bluetooth: btusb: mediatek: add callback function in btusb_disconnect
Bluetooth: btusb: mediatek: add intf release flow when usb disconnect
Bluetooth: btusb: mediatek: change the conditions for ISO interface
ALSA: ump: Shut up truncated string warning
ALSA: sh: Fix wrong argument order for copy_from_iter()
Linux 6.12.8
Change-Id: I2f5b46453984dde6ed8c381109655261a6bc3596
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit bd74e238ae6944b462f57ce8752440a011ba4530 ]
Andrii spotted that process_dynptr_func's rejection of incorrect
argument register type will print an error string where argument numbers
are not zero-indexed, unlike elsewhere in the verifier. Fix this by
subtracting 1 from regno. The same scenario exists for iterator
messages. Fix selftest error strings that match on the exact argument
number while we're at it to ensure clean bisection.
Suggested-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20241203002235.3776418-1-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 23579010cf0a12476e96a5f1acdf78a9c5843657 ]
On x86-64 calling bpf_get_smp_processor_id() in a kernel with CONFIG_SMP
disabled can trigger the following bug, as pcpu_hot is unavailable:
[ 8.471774] BUG: unable to handle page fault for address: 00000000936a290c
[ 8.471849] #PF: supervisor read access in kernel mode
[ 8.471881] #PF: error_code(0x0000) - not-present page
Fix by inlining a return 0 in the !CONFIG_SMP case.
Fixes: 1ae6921009 ("bpf: inline bpf_get_smp_processor_id() helper")
Signed-off-by: Andrea Righi <arighi@nvidia.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20241217195813.622568-1-arighi@nvidia.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
GKI (arm64) relevant 39 out of 174 changes, affecting 58 files +843/-596
9b53d2c2a3 bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors [1 file, +7/-0]
26702b3439 splice: do not checksum AF_UNIX sockets [1 file, +1/-0]
8aa9d1ff5b tcp: check space before adding MPTCP SYN options [1 file, +4/-2]
29d1e06560 blk-cgroup: Fix UAF in blkcg_unpin_online() [1 file, +5/-1]
cbd06d9808 block: Switch to using refcount_t for zone write plugs [1 file, +10/-10]
eea49fcea5 block: Use a zone write plug BIO work for REQ_NOWAIT BIOs [1 file, +42/-20]
a4b656ea1b dm: Fix dm-zoned-reclaim zone write pointer alignment [3 files, +124/-26]
7fa80134cf block: Prevent potential deadlocks in zone write plug error recovery [2 files, +61/-249]
825bccd943 memcg: slub: fix SUnreclaim for post charged objects [1 file, +18/-3]
3be6628c47 ALSA: usb-audio: Add implicit feedback quirk for Yamaha THR5 [1 file, +2/-0]
0eae680d03 block: Ignore REQ_NOWAIT for zone reset and zone finish operations [1 file, +9/-0]
2588c29afd usb: core: hcd: only check primary hcd skip_phy_initialization [1 file, +7/-1]
5de70cdf42 bpf: Revert "bpf: Mark raw_tp arguments with PTR_MAYBE_NULL" [4 files, +9/-87]
cab34b0c9d scsi: ufs: core: Update compl_time_stamp_local_clock after completing a cqe [1 file, +1/-0]
dd6b0ca602 usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer [1 file, +6/-3]
d32babf3fe usb: typec: ucsi: Fix completion notifications [1 file, +4/-2]
2c3ca17a07 bpf: Check size for BTF-based ctx access of pointer members [3 files, +10/-4]
e6d1dec142 bpf: Fix theoretical prog_array UAF in __uprobe_perf_func() [2 files, +10/-9]
dfb15ddf3b bpf,perf: Fix invalid prog_array access in perf_event_detach_bpf_prog [1 file, +4/-0]
bf2318e288 bpf, sockmap: Fix race between element replace and close() [1 file, +2/-3]
2bd517bafc bpf, sockmap: Fix update element with same [1 file, +1/-0]
b2fc4b17fc bpf: Augment raw_tp arguments with PTR_MAYBE_NULL [1 file, +138/-0]
a852c82eda tipc: fix NULL deref in cleanup_bearer() [1 file, +6/-1]
6610c7f8a8 net: defer final 'struct net' free in netns dismantle [2 files, +20/-1]
e7b02a0feb block: get wp_offset by bdev_offset_from_zone_start [1 file, +1/-1]
13ba06e260 Bluetooth: Improve setsockopt() handling of malformed user input [6 files, +33/-40]
45fe76573a netfilter: IDLETIMER: Fix for possible ABBA deadlock [1 file, +28/-24]
7cf0bd232b netfilter: nf_tables: do not defer rule destruction via call_rcu [2 files, +15/-21]
356078a5c5 net/sched: netem: account for backlog updates from child qdisc [1 file, +16/-6]
f9ecc90b5d Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating [1 file, +11/-22]
4ca50db1c5 Bluetooth: iso: Always release hdev at the end of iso_listen_bis [1 file, +1/-2]
827f30b1df Bluetooth: iso: Fix recursive locking warning [1 file, +6/-2]
d0f4a51246 Bluetooth: SCO: Add support for 16 bits transparent voice setting [2 files, +16/-14]
c541d7b5e1 Bluetooth: iso: Fix circular lock in iso_listen_bis [1 file, +12/-2]
cbe640d6ca Bluetooth: iso: Fix circular lock in iso_conn_big_sync [1 file, +27/-7]
c1291ea131 blk-mq: move cpuhp callback registering out of q->sysfs_lock [1 file, +92/-6]
f1a494df83 block: Fix potential deadlock while freezing queue and acquiring sysfs_lock [3 files, +26/-23]
1e04ca11a4 KVM: arm64: Disable MPAM visibility by default and ignore VMM writes [1 file, +52/-3]
5013bd1e23 x86/static-call: fix 32-bit build [1 file, +6/-1]
Changes in 6.12.6
usb: misc: onboard_usb_dev: skip suspend/resume sequence for USB5744 SMBus support
serial: sh-sci: Check if TX data was written to device in .tx_empty()
bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors
sched/deadline: Fix replenish_dl_new_period dl_server condition
perf/x86/intel/ds: Unconditionally drain PEBS DS when changing PEBS_DATA_CFG
clk: en7523: Fix wrong BUS clock for EN7581
ksmbd: fix racy issue from session lookup and expire
splice: do not checksum AF_UNIX sockets
tcp: check space before adding MPTCP SYN options
perf ftrace: Fix undefined behavior in cmp_profile_data()
virtio_net: correct netdev_tx_reset_queue() invocation point
virtio_ring: add a func argument 'recycle_done' to virtqueue_resize()
virtio_net: ensure netdev_tx_reset_queue is called on tx ring resize
riscv: mm: Do not call pmd dtor on vmemmap page table teardown
riscv: Fix wrong usage of __pa() on a fixmap address
blk-cgroup: Fix UAF in blkcg_unpin_online()
block: Switch to using refcount_t for zone write plugs
block: Use a zone write plug BIO work for REQ_NOWAIT BIOs
dm: Fix dm-zoned-reclaim zone write pointer alignment
block: Prevent potential deadlocks in zone write plug error recovery
gpio: graniterapids: Fix GPIO Ack functionality
memcg: slub: fix SUnreclaim for post charged objects
spi: rockchip: Fix PM runtime count on no-op cs
gpio: ljca: Initialize num before accessing item in ljca_gpio_config
ALSA: usb-audio: Add implicit feedback quirk for Yamaha THR5
ALSA: hda/realtek: Fix headset mic on Acer Nitro 5
riscv: Fix IPIs usage in kfence_protect_page()
crypto: hisilicon/debugfs - fix the struct pointer incorrectly offset problem
drm/panic: remove spurious empty line to clean warning
usb: host: max3421-hcd: Correctly abort a USB request.
block: Ignore REQ_NOWAIT for zone reset and zone finish operations
gpio: graniterapids: Fix vGPIO driver crash
gpio: graniterapids: Fix incorrect BAR assignment
gpio: graniterapids: Fix invalid GPI_IS register offset
gpio: graniterapids: Fix invalid RXEVCFG register bitmask
gpio: graniterapids: Determine if GPIO pad can be used by driver
gpio: graniterapids: Check if GPIO line can be used for IRQs
usb: core: hcd: only check primary hcd skip_phy_initialization
bpf: Revert "bpf: Mark raw_tp arguments with PTR_MAYBE_NULL"
ata: sata_highbank: fix OF node reference leak in highbank_initialize_phys()
usb: dwc2: Fix HCD resume
usb: dwc2: hcd: Fix GetPortStatus & SetPortFeature
usb: dwc2: Fix HCD port connection race
scsi: ufs: core: Update compl_time_stamp_local_clock after completing a cqe
usb: gadget: midi2: Fix interpretation of is_midi1 bits
usb: ehci-hcd: fix call balance of clocks handling routines
usb: typec: anx7411: fix fwnode_handle reference leak
usb: dwc3: imx8mp: fix software node kernel dump
usb: typec: anx7411: fix OF node reference leaks in anx7411_typec_switch_probe()
usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer
usb: typec: ucsi: Fix completion notifications
usb: dwc3: xilinx: make sure pipe clock is deselected in usb2 only mode
iommu/tegra241-cmdqv: do not use smp_processor_id in preemptible context
iommu/vt-d: Remove cache tags before disabling ATS
iommu/vt-d: Fix qi_batch NULL pointer with nested parent domain
drm/xe: Call invalidation_fence_fini for PT inval fences in error state
drm/amdkfd: pause autosuspend when creating pdd
drm/i915: Fix memory leak by correcting cache object name in error handler
drm/i915/color: Stop using non-posted DSB writes for legacy LUT
drm/i915: Fix NULL pointer dereference in capture_engine
drm/amdgpu: fix UVD contiguous CS mapping problem
drm/amd/pm: Set SMU v13.0.7 default workload type
drm/amdgpu: fix when the cleaner shader is emitted
drm/amdkfd: Dereference null return value
drm/amdkfd: hard-code cacheline size for gfx11
drm/amdkfd: hard-code MALL cacheline size for gfx11, gfx12
xfs: set XFS_SICK_INO_SYMLINK_ZAPPED explicitly when zapping a symlink
xfs: update btree keys correctly when _insrec splits an inode root block
xfs: don't drop errno values when we fail to ficlone the entire range
xfs: return a 64-bit block count from xfs_btree_count_blocks
xfs: fix null bno_hint handling in xfs_rtallocate_rtg
xfs: return from xfs_symlink_verify early on V4 filesystems
xfs: fix scrub tracepoints when inode-rooted btrees are involved
xfs: only run precommits once per transaction object
xfs: unlock inodes when erroring out of xfs_trans_alloc_dir
bpf: Check size for BTF-based ctx access of pointer members
bpf: Fix theoretical prog_array UAF in __uprobe_perf_func()
bpf,perf: Fix invalid prog_array access in perf_event_detach_bpf_prog
bpf, sockmap: Fix race between element replace and close()
bpf, sockmap: Fix update element with same
bpf: Augment raw_tp arguments with PTR_MAYBE_NULL
perf tools: Fix build-id event recording
wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one
wifi: mac80211: init cnt before accessing elem in ieee80211_copy_mbssid_beacon
wifi: mac80211: fix a queue stall in certain cases of CSA
wifi: mac80211: fix station NSS capability initialization order
perf machine: Initialize machine->env to address a segfault
acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl
amdgpu/uvd: get ring reference from rq scheduler
batman-adv: Do not send uninitialized TT changes
batman-adv: Remove uninitialized data in full table TT response
batman-adv: Do not let TT changes list grows indefinitely
tipc: fix NULL deref in cleanup_bearer()
net/mlx5: DR, prevent potential error pointer dereference
wifi: cfg80211: sme: init n_channels before channels[] access
selftests: mlxsw: sharedbuffer: Remove h1 ingress test case
selftests: mlxsw: sharedbuffer: Remove duplicate test cases
selftests: mlxsw: sharedbuffer: Ensure no extra packets are counted
ptp: kvm: x86: Return EOPNOTSUPP instead of ENODEV from kvm_arch_ptp_init()
bnxt_en: Fix GSO type for HW GRO packets on 5750X chips
net: lapb: increase LAPB_HEADER_LEN
net: defer final 'struct net' free in netns dismantle
net: mscc: ocelot: fix memory leak on ocelot_port_add_txtstamp_skb()
net: mscc: ocelot: improve handling of TX timestamp for unknown skb
net: mscc: ocelot: ocelot->ts_id_lock and ocelot_port->tx_skbs.lock are IRQ-safe
net: mscc: ocelot: be resilient to loss of PTP packets during transmission
net: mscc: ocelot: perform error cleanup in ocelot_hwstamp_set()
regulator: axp20x: AXP717: set ramp_delay
spi: aspeed: Fix an error handling path in aspeed_spi_[read|write]_user()
net: sparx5: fix FDMA performance issue
net: sparx5: fix the maximum frame length register
ACPI: resource: Fix memory resource type union access
cxgb4: use port number to set mac addr
qca_spi: Fix clock speed for multiple QCA7000
qca_spi: Make driver probing reliable
ALSA: control: Avoid WARN() for symlink errors
ASoC: amd: yc: Fix the wrong return value
Documentation: PM: Clarify pm_runtime_resume_and_get() return value
block: get wp_offset by bdev_offset_from_zone_start
bnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips
Documentation: networking: Add a caveat to nexthop_compat_mode sysctl
cifs: Fix rmdir failure due to ongoing I/O on deleted file
net: renesas: rswitch: fix possible early skb release
net: renesas: rswitch: fix race window between tx start and complete
net: renesas: rswitch: fix leaked pointer on error path
net: renesas: rswitch: avoid use-after-put for a device tree node
net: renesas: rswitch: handle stop vs interrupt race
ASoC: tas2781: Fix calibration issue in stress test
Bluetooth: Improve setsockopt() handling of malformed user input
libperf: evlist: Fix --cpu argument on hybrid platform
ASoC: fsl_xcvr: change IFACE_PCM to IFACE_MIXER
ASoC: fsl_spdif: change IFACE_PCM to IFACE_MIXER
selftests: netfilter: Stabilize rpath.sh
netfilter: IDLETIMER: Fix for possible ABBA deadlock
netfilter: nf_tables: do not defer rule destruction via call_rcu
net: mana: Fix memory leak in mana_gd_setup_irqs
net: mana: Fix irq_contexts memory leak in mana_gd_setup_irqs
net: dsa: felix: fix stuck CPU-injected packets with short taprio windows
net/sched: netem: account for backlog updates from child qdisc
net, team, bonding: Add netdev_base_features helper
bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features
bonding: Fix feature propagation of NETIF_F_GSO_ENCAP_ALL
team: Fix initial vlan_feature set in __team_compute_features
team: Fix feature propagation of NETIF_F_GSO_ENCAP_ALL
ASoC: Intel: sof_sdw: Add space for a terminator into DAIs array
ACPICA: events/evxfregn: don't release the ContextMutex that was never acquired
Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating
Bluetooth: iso: Always release hdev at the end of iso_listen_bis
Bluetooth: iso: Fix recursive locking warning
Bluetooth: SCO: Add support for 16 bits transparent voice setting
Bluetooth: iso: Fix circular lock in iso_listen_bis
Bluetooth: iso: Fix circular lock in iso_conn_big_sync
Bluetooth: btmtk: avoid UAF in btmtk_process_coredump
net: renesas: rswitch: fix initial MPIC register setting
net: dsa: microchip: KSZ9896 register regmap alignment to 32 bit boundaries
net: dsa: tag_ocelot_8021q: fix broken reception
drm/xe: fix the ERR_PTR() returned on failure to allocate tiny pt
drm/xe/reg_sr: Remove register pool
blk-iocost: Avoid using clamp() on inuse in __propagate_weights()
kselftest/arm64: abi: fix SVCR detection
blk-mq: move cpuhp callback registering out of q->sysfs_lock
block: Fix potential deadlock while freezing queue and acquiring sysfs_lock
rust: kbuild: set `bindgen`'s Rust target version
KVM: arm64: Disable MPAM visibility by default and ignore VMM writes
xen/netfront: fix crash when removing device
x86: make get_cpu_vendor() accessible from Xen code
objtool/x86: allow syscall instruction
x86/static-call: provide a way to do very early static-call updates
x86/xen: don't do PV iret hypercall through hypercall page
x86/xen: add central hypercall functions
x86/xen: use new hypercall functions instead of hypercall page
x86/xen: remove hypercall page
x86/static-call: fix 32-bit build
Linux 6.12.6
Change-Id: I656537654d0b73440e5b76deee63abd58ea68b56
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
commit 838a10bd2ebfe11a60dd67687533a7cfc220cc86 upstream.
Arguments to a raw tracepoint are tagged as trusted, which carries the
semantics that the pointer will be non-NULL. However, in certain cases,
a raw tracepoint argument may end up being NULL. More context about this
issue is available in [0].
Thus, there is a discrepancy between the reality, that raw_tp arguments can
actually be NULL, and the verifier's knowledge, that they are never NULL,
causing explicit NULL check branch to be dead code eliminated.
A previous attempt [1], i.e. the second fixed commit, was made to
simulate symbolic execution as if in most accesses, the argument is a
non-NULL raw_tp, except for conditional jumps. This tried to suppress
branch prediction while preserving compatibility, but surfaced issues
with production programs that were difficult to solve without increasing
verifier complexity. A more complete discussion of issues and fixes is
available at [2].
Fix this by maintaining an explicit list of tracepoints where the
arguments are known to be NULL, and mark the positional arguments as
PTR_MAYBE_NULL. Additionally, capture the tracepoints where arguments
are known to be ERR_PTR, and mark these arguments as scalar values to
prevent potential dereference.
Each hex digit is used to encode NULL-ness (0x1) or ERR_PTR-ness (0x2),
shifted by the zero-indexed argument number x 4. This can be represented
as follows:
1st arg: 0x1
2nd arg: 0x10
3rd arg: 0x100
... and so on (likewise for ERR_PTR case).
In the future, an automated pass will be used to produce such a list, or
insert __nullable annotations automatically for tracepoints. Each
compilation unit will be analyzed and results will be collated to find
whether a tracepoint pointer is definitely not null, maybe null, or an
unknown state where verifier conservatively marks it PTR_MAYBE_NULL.
A proof of concept of this tool from Eduard is available at [3].
Note that in case we don't find a specification in the raw_tp_null_args
array and the tracepoint belongs to a kernel module, we will
conservatively mark the arguments as PTR_MAYBE_NULL. This is because
unlike for in-tree modules, out-of-tree module tracepoints may pass NULL
freely to the tracepoint. We don't protect against such tracepoints
passing ERR_PTR (which is uncommon anyway), lest we mark all such
arguments as SCALAR_VALUE.
While we are it, let's adjust the test raw_tp_null to not perform
dereference of the skb->mark, as that won't be allowed anymore, and make
it more robust by using inline assembly to test the dead code
elimination behavior, which should still stay the same.
[0]: https://lore.kernel.org/bpf/ZrCZS6nisraEqehw@jlelli-thinkpadt14gen4.remote.csb
[1]: https://lore.kernel.org/all/20241104171959.2938862-1-memxor@gmail.com
[2]: https://lore.kernel.org/bpf/20241206161053.809580-1-memxor@gmail.com
[3]: https://github.com/eddyz87/llvm-project/tree/nullness-for-tracepoint-params
Reported-by: Juri Lelli <juri.lelli@redhat.com> # original bug
Reported-by: Manu Bretelle <chantra@meta.com> # bugs in masking fix
Fixes: 3f00c52393 ("bpf: Allow trusted pointers to be passed to KF_TRUSTED_ARGS kfuncs")
Fixes: cb4158ce8ec8 ("bpf: Mark raw_tp arguments with PTR_MAYBE_NULL")
Reviewed-by: Eduard Zingerman <eddyz87@gmail.com>
Co-developed-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20241213221929.3495062-3-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 659b9ba7cb2d7adb64618b87ddfaa528a143766e upstream.
Robert Morris reported the following program type which passes the
verifier in [0]:
SEC("struct_ops/bpf_cubic_init")
void BPF_PROG(bpf_cubic_init, struct sock *sk)
{
asm volatile("r2 = *(u16*)(r1 + 0)"); // verifier should demand u64
asm volatile("*(u32 *)(r2 +1504) = 0"); // 1280 in some configs
}
The second line may or may not work, but the first instruction shouldn't
pass, as it's a narrow load into the context structure of the struct ops
callback. The code falls back to btf_ctx_access to ensure correctness
and obtaining the types of pointers. Ensure that the size of the access
is correctly checked to be 8 bytes, otherwise the verifier thinks the
narrow load obtained a trusted BTF pointer and will permit loads/stores
as it sees fit.
Perform the check on size after we've verified that the load is for a
pointer field, as for scalar values narrow loads are fine. Access to
structs passed as arguments to a BPF program are also treated as
scalars, therefore no adjustment is needed in their case.
Existing verifier selftests are broken by this change, but because they
were incorrect. Verifier tests for d_path were performing narrow load
into context to obtain path pointer, had this program actually run it
would cause a crash. The same holds for verifier_btf_ctx_access tests.
[0]: https://lore.kernel.org/bpf/51338.1732985814@localhost
Fixes: 9e15db6613 ("bpf: Implement accurate raw_tp context access via BTF")
Reported-by: Robert Morris <rtm@mit.edu>
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20241212092050.3204165-2-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit c00d738e1673ab801e1577e4e3c780ccf88b1a5b upstream.
This patch reverts commit
cb4158ce8ec8 ("bpf: Mark raw_tp arguments with PTR_MAYBE_NULL"). The
patch was well-intended and meant to be as a stop-gap fixing branch
prediction when the pointer may actually be NULL at runtime. Eventually,
it was supposed to be replaced by an automated script or compiler pass
detecting possibly NULL arguments and marking them accordingly.
However, it caused two main issues observed for production programs and
failed to preserve backwards compatibility. First, programs relied on
the verifier not exploring == NULL branch when pointer is not NULL, thus
they started failing with a 'dereference of scalar' error. Next,
allowing raw_tp arguments to be modified surfaced the warning in the
verifier that warns against reg->off when PTR_MAYBE_NULL is set.
More information, context, and discusson on both problems is available
in [0]. Overall, this approach had several shortcomings, and the fixes
would further complicate the verifier's logic, and the entire masking
scheme would have to be removed eventually anyway.
Hence, revert the patch in preparation of a better fix avoiding these
issues to replace this commit.
[0]: https://lore.kernel.org/bpf/20241206161053.809580-1-memxor@gmail.com
Reported-by: Manu Bretelle <chantra@meta.com>
Fixes: cb4158ce8ec8 ("bpf: Mark raw_tp arguments with PTR_MAYBE_NULL")
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20241213221929.3495062-2-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
GKI (arm64) relevant 129 out of 468 changes, affecting 180 files +1843/-980
e0964a5778 ptp: Add error handling for adjfine callback in ptp_clock_adjtime [1 file, +2/-1]
a007f8895f net/sched: tbf: correct backlog statistic for GSO packets [1 file, +12/-6]
9545011e7b net: Fix icmp host relookup triggering ip_rt_bug [1 file, +3/-0]
01f95357e4 ipv6: avoid possible NULL deref in modify_prefix_route() [1 file, +7/-6]
8b591bd522 net/ipv6: release expired exception dst cached in socket [1 file, +3/-3]
e48b211c4c tipc: Fix use-after-free of kernel socket in cleanup_bearer(). [1 file, +1/-1]
da5cc778e7 netfilter: nft_inner: incorrect percpu area handling under softirq [2 files, +46/-12]
a36a6d7037 Revert "udp: avoid calling sock_def_readable() if possible" [1 file, +3/-11]
22074dc1d4 ethtool: Fix wrong mod state in case of verbose and no_mask bitset [1 file, +44/-4]
316183d583 net: avoid potential UAF in default_operstate() [1 file, +6/-1]
c00372e41b mmc: sd: SDUC Support Recognition [7 files, +27/-15]
19e22f1e68 mmc: core: Adjust ACMD22 to SDUC [1 file, +18/-6]
42311846d3 mmc: core: Use GFP_NOIO in ACMD22 [1 file, +4/-0]
4e51552bc5 zram: do not mark idle slots that cannot be idle [1 file, +18/-7]
0ab037634b zram: clear IDLE flag in mark_idle() [1 file, +2/-0]
405b6d5f90 ntp: Remove invalid cast in time offset math [1 file, +1/-1]
6358df316d f2fs: clean up w/ F2FS_{BLK_TO_BYTES,BTYES_TO_BLK} [1 file, +29/-39]
e6a91ed4b9 f2fs: fix to adjust appropriate length for fiemap [2 files, +4/-3]
8e9fec7f79 f2fs: fix to requery extent which cross boundary of inquiry [1 file, +15/-5]
815d8f0e52 i3c: master: Replace hard code 2 with macro I3C_ADDR_SLOT_STATUS_BITS [2 files, +5/-3]
c3806cf647 i3c: master: Extend address status bit to 4 and add I3C_ADDR_SLOT_EXT_DESIRED [2 files, +59/-13]
1117462773 i3c: master: Fix dynamic address leak when 'assigned-address' is present [1 file, +5/-10]
7d4e5e33ea scsi: ufs: core: Always initialize the UIC done completion [1 file, +4/-7]
3ad69f2f08 scsi: ufs: core: Add ufshcd_send_bsg_uic_cmd() for UFS BSG [3 files, +38/-1]
47f4ad956b bpf, vsock: Fix poll() missing a queue [1 file, +3/-0]
a222e48fea bpf, vsock: Invoke proto::close on close() [1 file, +40/-27]
dabaf26846 xsk: always clear DMA mapping information when unmapping the pool [1 file, +2/-3]
5c9e3bb43a tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg [1 file, +4/-7]
7bc37dd9ea ALSA: usb-audio: Notify xrun for low-latency mode [1 file, +11/-3]
a78af11806 pmdomain: core: Add missing put_device() [1 file, +1/-0]
913a3f1c06 pmdomain: core: Fix error path in pm_genpd_init() when ida alloc fails [1 file, +19/-17]
5548887987 nvme: don't apply NVME_QUIRK_DEALLOCATE_ZEROES when DSM is not supported [1 file, +2/-1]
bdbf87486d bpf: Ensure reg is PTR_TO_STACK in process_iter_arg [2 files, +7/-2]
2459a0b149 drivers/virt: pkvm: Don't fail ioremap() call if MMIO_GUARD fails [1 file, +1/-5]
0da7d4b7ca bpf: Don't mark STACK_INVALID as STACK_MISC in mark_stack_slot_misc [1 file, +6/-3]
f9f2a2739e bpf: Fix narrow scalar spill onto 64-bit spilled scalar slots [1 file, +1/-0]
845cc4ee8e nvme-fabrics: handle zero MAXCMD without closing the connection [1 file, +3/-2]
c2277e2859 scatterlist: fix incorrect func name in kernel-doc [1 file, +1/-1]
81ec3c6ceb bpf: Handle BPF_EXIST and BPF_NOEXIST for LPM trie [1 file, +20/-3]
6dc076a257 bpf: Remove unnecessary kfree(im_node) in lpm_trie_update_elem [1 file, +1/-3]
7218e441ad bpf: Handle in-place update for full LPM trie correctly [1 file, +21/-23]
412bf01fd5 bpf: Fix exact match conditions in trie_get_next_key() [1 file, +2/-2]
e689bc6697 HID: wacom: fix when get product name maybe null pointer [1 file, +2/-1]
3b0c5bb437 can: dev: can_set_termination(): allow sleeping GPIOs [1 file, +1/-1]
ba0ee489cd tracing: Fix cmp_entries_dup() to respect sort() comparison rules [1 file, +1/-5]
ec643064ab arm64: mm: Fix zone_dma_limit calculation [1 file, +8/-9]
34b6197867 arm64: Ensure bits ASID[15:8] are masked out when the kernel uses 8-bit ASIDs [1 file, +2/-2]
abd614bbfc arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL [1 file, +5/-1]
8ab73c34e3 arm64: ptrace: fix partial SETREGSET for NT_ARM_FPMR [1 file, +2/-0]
4105dd76bc arm64: ptrace: fix partial SETREGSET for NT_ARM_POE [1 file, +2/-0]
7f1292f8d4 ALSA: usb-audio: Fix a DMA to stack memory bug [1 file, +27/-15]
39c5d89b56 ALSA: usb-audio: Add extra PID for RME Digiface USB [3 files, +176/-168]
9c191055c7 scsi: ufs: core: sysfs: Prevent div by zero [1 file, +6/-0]
2e7a3bb033 scsi: ufs: core: Cancel RTC work during ufshcd_remove() [1 file, +1/-0]
5a717f43c2 scsi: ufs: core: Add missing post notify for power mode change [2 files, +10/-7]
793e560a6b io_uring: Change res2 parameter type in io_uring_cmd_done [2 files, +3/-3]
85351e4941 Revert "readahead: properly shorten readahead when falling back to do_page_cache_ra()" [1 file, +2/-3]
95e197354e cacheinfo: Allocate memory during CPU hotplug if not done from the primary CPU [1 file, +8/-6]
bc031095d1 modpost: Add .irqentry.text to OTHER_SECTIONS [1 file, +1/-1]
178e31df1f bpf: fix OOB devmap writes when deleting elements [1 file, +3/-3]
3dcc20418e dma-buf: fix dma_fence_array_signaled v4 [1 file, +27/-1]
f3dbb097d6 dma-fence: Fix reference leak on fence merge failure path [1 file, +2/-0]
4715555964 dma-fence: Use kernel's sort for merging fences [1 file, +61/-67]
d486b5741d xsk: fix OOB map writes when deleting elements [1 file, +1/-1]
14258211d6 regmap: detach regmap from dev on regmap_exit [1 file, +12/-0]
d562b457e1 mmc: core: Further prevent card detect during shutdown [2 files, +5/-0]
9bfeeeff2c stackdepot: fix stack_depot_save_flags() in NMI context [2 files, +12/-4]
a71ddd5b87 sched/numa: fix memory leak due to the overwritten vma->numab_state [1 file, +9/-3]
835ca042df kasan: make report_lock a raw spinlock [1 file, +3/-3]
69d319450d mm/gup: handle NULL pages in unpin_user_pages() [1 file, +10/-1]
1dde3fde62 mm: open-code PageTail in folio_flags() and const_folio_flags() [1 file, +2/-2]
bd4d2333a3 mm: open-code page_folio() in dump_page() [1 file, +5/-2]
536ffb4014 mm: fix vrealloc()'s KASAN poisoning logic [1 file, +2/-1]
fe1a34e92a mm: respect mmap hint address when aligning for THP [1 file, +1/-0]
5c63e24b1b scsi: ufs: pltfrm: Drop PM runtime reference count after ufshcd_remove() [6 files, +2/-5]
2cec2d916a memblock: allow zero threshold in validate_numa_converage() [1 file, +2/-2]
d222934627 epoll: annotate racy check [2 files, +5/-3]
493326c4f1 block: RCU protect disk->conv_zones_bitmap [2 files, +32/-13]
b6ce2dbe98 ext4: partial zero eof block on unaligned inode size extension [2 files, +42/-16]
ff599ad2d2 cleanup: Adjust scoped_guard() macros to avoid potential warning [1 file, +42/-10]
3946e07552 gpio: free irqs that are still requested when the chip is being removed [1 file, +41/-0]
ea74e9675b HID: add per device quirk to force bind to hid-generic [3 files, +8/-2]
17db6ed5a3 media: uvcvideo: RealSense D421 Depth module metadata [1 file, +9/-0]
0c20fadfd0 media: uvcvideo: Add a quirk for the Kaiweets KTI-W02 infrared camera [1 file, +11/-0]
3cc5228d5b media: uvcvideo: Force UVC version to 1.0a for 0408:4033 [1 file, +11/-0]
4150f22342 drm: panel-orientation-quirks: Add quirk for AYA NEO 2 model [1 file, +6/-0]
5d7f35ed5f drm: panel-orientation-quirks: Add quirk for AYA NEO Founder edition [1 file, +6/-0]
187d5ff497 drm: panel-orientation-quirks: Add quirk for AYA NEO GEEK [1 file, +6/-0]
fd09880b16 af_packet: avoid erroring out after sock_init_data() in packet_create() [1 file, +6/-6]
61686abc2f Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() [1 file, +1/-0]
32df687e12 Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() [1 file, +5/-5]
8df832e6b9 net: af_can: do not leave a dangling sk pointer in can_create() [1 file, +1/-0]
03caa9bfb9 net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() [1 file, +7/-5]
691d6d816f net: inet: do not leave a dangling sk pointer in inet_create() [1 file, +10/-12]
f44fceb71d net: inet6: do not leave a dangling sk pointer in inet6_create() [1 file, +10/-12]
987aa730ba bpf: Prevent tailcall infinite loop caused by freplace [5 files, +81/-17]
051f49d517 net/tcp: Add missing lockdep annotations for TCP-AO hlist traversals [4 files, +29/-23]
920159e1bf ALSA: usb-audio: Make mic volume workarounds globally applicable [3 files, +45/-48]
a50b4aa300 bpf: Call free_htab_elem() after htab_unlock_bucket() [1 file, +39/-17]
da561d5fb6 Bluetooth: hci_conn: Reduce hci_conn_drop() calls in two functions [1 file, +3/-10]
c55a4c5a04 Bluetooth: hci_conn: Use disable_delayed_work_sync [1 file, +3/-3]
93a6160dc1 Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet [1 file, +9/-4]
b04b4fb91d Bluetooth: Add new quirks for ATS2851 [2 files, +20/-4]
359fc41e3c Bluetooth: Support new quirks for ATS2851 [2 files, +15/-1]
166cf43070 net/neighbor: clear error in case strict check is not set [1 file, +1/-0]
f63a1caae9 tracing/ftrace: disable preemption in syscall probe [2 files, +44/-4]
d1133dd57e tracing: Use atomic64_inc_return() in trace_clock_counter() [1 file, +1/-1]
09c083fbea ring-buffer: Limit time with disabled interrupts in rb_check_pages() [1 file, +72/-26]
c11e2ec9a7 pinmux: Use sequential access to access desc->pinmux data [3 files, +100/-77]
b865d4e569 scsi: ufs: core: Make DMA mask configuration more flexible [3 files, +13/-9]
2fcb921c27 bpf: put bpf_link's program when link is safe to be deallocated [1 file, +17/-5]
bb4a6236a4 leds: class: Protect brightness_show() with led_cdev->led_access mutex [2 files, +12/-4]
7214d3a64e tracing: Fix function name for trampoline [3 files, +36/-8]
9e28513fd2 f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode. [1 file, +3/-1]
b51aa6a07e PCI: qcom: Add support for IPQ9574 [1 file, +1/-0]
617bd1e6c3 PCI: Add ACS quirk for Wangxun FF5xxx NICs [1 file, +9/-6]
1f51ae217d i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock [1 file, +2/-1]
6d41a2d5c1 f2fs: print message if fscorrupted was found in f2fs_new_node_page() [1 file, +6/-1]
924f7dd1e8 f2fs: fix to shrink read extent node in batches [1 file, +41/-28]
1648c7000f serial: 8250_dw: Add Sophgo SG2044 quirk [1 file, +3/-2]
950210c9c7 Revert "nvme: make keep-alive synchronous operation" [1 file, +10/-7]
d5b2ddf1f9 io_uring/tctx: work around xa_store() allocation error issue [1 file, +12/-1]
cd188519d2 scsi: ufs: pltfrm: Dellocate HBA during ufshcd_pltfrm_remove() [1 file, +1/-0]
a39ad4f507 sched/core: Remove the unnecessary need_resched() check in nohz_csd_func() [1 file, +1/-1]
f9e144a544 sched/fair: Check idle_cpu() before need_resched() to detect ilb CPU turning busy [1 file, +1/-1]
b4ec68868c sched/core: Prevent wakeup of ksoftirqd during idle load balance [1 file, +1/-1]
364dc8070b tracing/eprobe: Fix to release eprobe when failed to add dyn_event [1 file, +5/-0]
1a678f6829 clocksource: Make negative motion detection more robust [4 files, +20/-7]
6aeef0214d softirq: Allow raising SCHED_SOFTIRQ from SMP-call-function on RT kernel [1 file, +11/-4]
Changes in 6.12.5
iTCO_wdt: mask NMI_NOW bit for update_no_reboot_bit() call
watchdog: xilinx_wwdt: Calculate max_hw_heartbeat_ms using clock frequency
watchdog: apple: Actually flush writes after requesting watchdog restart
watchdog: mediatek: Make sure system reset gets asserted in mtk_wdt_restart()
can: gs_usb: add usb endpoint address detection at driver probe step
can: c_can: c_can_handle_bus_err(): update statistics if skb allocation fails
can: sun4i_can: sun4i_can_err(): call can_change_state() even if cf is NULL
can: hi311x: hi3110_can_ist(): fix potential use-after-free
can: m_can: m_can_handle_lec_err(): fix {rx,tx}_errors statistics
can: ifi_canfd: ifi_canfd_handle_lec_err(): fix {rx,tx}_errors statistics
can: hi311x: hi3110_can_ist(): fix {rx,tx}_errors statistics
can: sja1000: sja1000_err(): fix {rx,tx}_errors statistics
can: sun4i_can: sun4i_can_err(): fix {rx,tx}_errors statistics
can: ems_usb: ems_usb_rx_err(): fix {rx,tx}_errors statistics
can: f81604: f81604_handle_can_bus_errors(): fix {rx,tx}_errors statistics
ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()
netfilter: x_tables: fix LED ID check in led_tg_check()
netfilter: nft_socket: remove WARN_ON_ONCE on maximum cgroup level
selftests: hid: fix typo and exit code
net: enetc: Do not configure preemptible TCs if SIs do not support
ptp: Add error handling for adjfine callback in ptp_clock_adjtime
net/sched: tbf: correct backlog statistic for GSO packets
net: hsr: avoid potential out-of-bound access in fill_frame_info()
bnxt_en: ethtool: Supply ntuple rss context action
net: Fix icmp host relookup triggering ip_rt_bug
ipv6: avoid possible NULL deref in modify_prefix_route()
can: j1939: j1939_session_new(): fix skb reference counting
platform/x86: asus-wmi: Ignore return value when writing thermal policy
net: phy: microchip: Reset LAN88xx PHY to ensure clean link state on LAN7800/7850
net/ipv6: release expired exception dst cached in socket
dccp: Fix memory leak in dccp_feat_change_recv
tipc: Fix use-after-free of kernel socket in cleanup_bearer().
net/smc: initialize close_work early to avoid warning
net/smc: fix LGR and link use-after-free issue
net/qed: allow old cards not supporting "num_images" to work
net: hsr: must allocate more bytes for RedBox support
ice: fix PHY Clock Recovery availability check
ice: fix PHY timestamp extraction for ETH56G
ice: Fix VLAN pruning in switchdev mode
idpf: set completion tag for "empty" bufs associated with a packet
ixgbevf: stop attempting IPSEC offload on Mailbox API 1.5
ixgbe: downgrade logging of unsupported VF API version to debug
ixgbe: Correct BASE-BX10 compliance code
igb: Fix potential invalid memory access in igb_init_module()
netfilter: nft_inner: incorrect percpu area handling under softirq
Revert "udp: avoid calling sock_def_readable() if possible"
net: sched: fix erspan_opt settings in cls_flower
netfilter: ipset: Hold module reference while requesting a module
netfilter: nft_set_hash: skip duplicated elements pending gc run
ethtool: Fix wrong mod state in case of verbose and no_mask bitset
mlxsw: spectrum_acl_flex_keys: Constify struct mlxsw_afk_element_inst
mlxsw: spectrum_acl_flex_keys: Use correct key block on Spectrum-4
geneve: do not assume mac header is set in geneve_xmit_skb()
net/mlx5: HWS: Fix memory leak in mlx5hws_definer_calc_layout
net/mlx5: HWS: Properly set bwc queue locks lock classes
net/mlx5e: SD, Use correct mdev to build channel param
net/mlx5e: Remove workaround to avoid syndrome for internal port
vsock/test: fix failures due to wrong SO_RCVLOWAT parameter
vsock/test: fix parameter types in SO_VM_SOCKETS_* calls
net: avoid potential UAF in default_operstate()
gpio: grgpio: use a helper variable to store the address of ofdev->dev
gpio: grgpio: Add NULL check in grgpio_probe
mmc: mtk-sd: use devm_mmc_alloc_host
mmc: mtk-sd: Fix error handle of probe function
mmc: mtk-sd: fix devm_clk_get_optional usage
mmc: mtk-sd: Fix MMC_CAP2_CRYPTO flag setting
mmc: sd: SDUC Support Recognition
mmc: core: Adjust ACMD22 to SDUC
mmc: core: Use GFP_NOIO in ACMD22
zram: do not mark idle slots that cannot be idle
zram: clear IDLE flag in mark_idle()
ntp: Remove invalid cast in time offset math
f2fs: clean up w/ F2FS_{BLK_TO_BYTES,BTYES_TO_BLK}
f2fs: fix to adjust appropriate length for fiemap
f2fs: fix to requery extent which cross boundary of inquiry
i3c: master: Replace hard code 2 with macro I3C_ADDR_SLOT_STATUS_BITS
i3c: master: Extend address status bit to 4 and add I3C_ADDR_SLOT_EXT_DESIRED
i3c: master: Fix dynamic address leak when 'assigned-address' is present
drm/amd/display: calculate final viewport before TAP optimization
drm/amd/display: Ignore scalar validation failure if pipe is phantom
scsi: ufs: core: Always initialize the UIC done completion
scsi: ufs: core: Add ufshcd_send_bsg_uic_cmd() for UFS BSG
bpf, vsock: Fix poll() missing a queue
bpf, vsock: Invoke proto::close on close()
xsk: always clear DMA mapping information when unmapping the pool
bpftool: fix potential NULL pointer dereferencing in prog_dump()
drm/sti: Add __iomem for mixer_dbg_mxn's parameter
tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg
ALSA: seq: ump: Fix seq port updates per FB info notify
ALSA: usb-audio: Notify xrun for low-latency mode
tools: Override makefile ARCH variable if defined, but empty
spi: mpc52xx: Add cancel_work_sync before module remove
ASoC: SOF: ipc3-topology: Convert the topology pin index to ALH dai index
ASoC: SOF: ipc3-topology: fix resource leaks in sof_ipc3_widget_setup_comp_dai()
pmdomain: core: Add missing put_device()
pmdomain: core: Fix error path in pm_genpd_init() when ida alloc fails
nvme: don't apply NVME_QUIRK_DEALLOCATE_ZEROES when DSM is not supported
x86/pkeys: Change caller of update_pkru_in_sigframe()
x86/pkeys: Ensure updated PKRU value is XRSTOR'd
bpf: Ensure reg is PTR_TO_STACK in process_iter_arg
irqchip/stm32mp-exti: CONFIG_STM32MP_EXTI should not default to y when compile-testing
drivers/virt: pkvm: Don't fail ioremap() call if MMIO_GUARD fails
bpf: Don't mark STACK_INVALID as STACK_MISC in mark_stack_slot_misc
bpf: Fix narrow scalar spill onto 64-bit spilled scalar slots
nvme-fabrics: handle zero MAXCMD without closing the connection
nvme-tcp: fix the memleak while create new ctrl failed
nvme-rdma: unquiesce admin_q before destroy it
scsi: sg: Fix slab-use-after-free read in sg_release()
scsi: scsi_debug: Fix hrtimer support for ndelay
ASoC: mediatek: mt8188-mt6359: Remove hardcoded dmic codec
drm/v3d: Enable Performance Counters before clearing them
ocfs2: free inode when ocfs2_get_init_inode() fails
scatterlist: fix incorrect func name in kernel-doc
iio: magnetometer: yas530: use signed integer type for clamp limits
smb: client: fix potential race in cifs_put_tcon()
bpf: Handle BPF_EXIST and BPF_NOEXIST for LPM trie
bpf: Remove unnecessary kfree(im_node) in lpm_trie_update_elem
bpf: Handle in-place update for full LPM trie correctly
bpf: Fix exact match conditions in trie_get_next_key()
x86/CPU/AMD: WARN when setting EFER.AUTOIBRS if and only if the WRMSR fails
rust: allow `clippy::needless_lifetimes`
HID: i2c-hid: Revert to using power commands to wake on resume
HID: wacom: fix when get product name maybe null pointer
LoongArch: Add architecture specific huge_pte_clear()
LoongArch: KVM: Protect kvm_check_requests() with SRCU
ksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_read
ksmbd: fix Out-of-Bounds Write in ksmbd_vfs_stream_write
watchdog: rti: of: honor timeout-sec property
can: dev: can_set_termination(): allow sleeping GPIOs
can: mcp251xfd: mcp251xfd_get_tef_len(): work around erratum DS80000789E 6.
tracing: Fix cmp_entries_dup() to respect sort() comparison rules
net :mana :Request a V2 response version for MANA_QUERY_GF_STAT
iommufd: Fix out_fput in iommufd_fault_alloc()
arm64: mm: Fix zone_dma_limit calculation
arm64: Ensure bits ASID[15:8] are masked out when the kernel uses 8-bit ASIDs
arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL
arm64: ptrace: fix partial SETREGSET for NT_ARM_FPMR
arm64: ptrace: fix partial SETREGSET for NT_ARM_POE
ALSA: usb-audio: Fix a DMA to stack memory bug
ALSA: usb-audio: Add extra PID for RME Digiface USB
ALSA: hda/realtek: fix micmute LEDs don't work on HP Laptops
ALSA: usb-audio: add mixer mapping for Corsair HS80
ALSA: hda/realtek: Enable mute and micmute LED on HP ProBook 430 G8
ALSA: hda/realtek: Add support for Samsung Galaxy Book3 360 (NP730QFG)
scsi: qla2xxx: Fix abort in bsg timeout
scsi: qla2xxx: Fix NVMe and NPIV connect issue
scsi: qla2xxx: Supported speed displayed incorrectly for VPorts
scsi: qla2xxx: Fix use after free on unload
scsi: qla2xxx: Remove check req_sg_cnt should be equal to rsp_sg_cnt
scsi: ufs: core: sysfs: Prevent div by zero
scsi: ufs: core: Cancel RTC work during ufshcd_remove()
scsi: ufs: qcom: Only free platform MSIs when ESI is enabled
scsi: ufs: pltfrm: Disable runtime PM during removal of glue drivers
scsi: ufs: core: Add missing post notify for power mode change
nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()
fs/smb/client: avoid querying SMB2_OP_QUERY_WSL_EA for SMB3 POSIX
fs/smb/client: Implement new SMB3 POSIX type
fs/smb/client: cifs_prime_dcache() for SMB3 POSIX reparse points
smb3.1.1: fix posix mounts to older servers
io_uring: Change res2 parameter type in io_uring_cmd_done
bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again
Revert "readahead: properly shorten readahead when falling back to do_page_cache_ra()"
pmdomain: imx: gpcv2: Adjust delay after power up handshake
selftests/damon: add _damon_sysfs.py to TEST_FILES
selftest: hugetlb_dio: fix test naming
cacheinfo: Allocate memory during CPU hotplug if not done from the primary CPU
x86/cacheinfo: Delete global num_cache_leaves
drm/amdkfd: hard-code cacheline for gc943,gc944
drm/dp_mst: Fix MST sideband message body length check
drm/amdkfd: add MEC version that supports no PCIe atomics for GFX12
drm/amd/pm: fix and simplify workload handling
drm/dp_mst: Verify request type in the corresponding down message reply
drm/dp_mst: Fix resetting msg rx state after topology removal
drm/amd/display: Correct prefetch calculation
drm/amd/display: Limit VTotal range to max hw cap minus fp
drm/amd/display: Add a left edge pixel if in YCbCr422 or YCbCr420 and odm
drm/amdgpu/hdp6.0: do a posting read when flushing HDP
drm/amdgpu/hdp4.0: do a posting read when flushing HDP
drm/amdgpu/hdp5.0: do a posting read when flushing HDP
drm/amdgpu/hdp7.0: do a posting read when flushing HDP
drm/amdgpu/hdp5.2: do a posting read when flushing HDP
modpost: Add .irqentry.text to OTHER_SECTIONS
x86/kexec: Restore GDT on return from ::preserve_context kexec
bpf: fix OOB devmap writes when deleting elements
dma-buf: fix dma_fence_array_signaled v4
dma-fence: Fix reference leak on fence merge failure path
dma-fence: Use kernel's sort for merging fences
xsk: fix OOB map writes when deleting elements
regmap: detach regmap from dev on regmap_exit
arch_numa: Restore nid checks before registering a memblock with a node
mmc: sdhci-pci: Add DMI quirk for missing CD GPIO on Vexia Edu Atla 10 tablet
mmc: core: Further prevent card detect during shutdown
x86/cpu: Add Lunar Lake to list of CPUs with a broken MONITOR implementation
ocfs2: update seq_file index in ocfs2_dlm_seq_next
stackdepot: fix stack_depot_save_flags() in NMI context
lib: stackinit: hide never-taken branch from compiler
sched/numa: fix memory leak due to the overwritten vma->numab_state
kasan: make report_lock a raw spinlock
mm/gup: handle NULL pages in unpin_user_pages()
mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM
x86/cpu/topology: Remove limit of CPUs due to disabled IO/APIC
x86/mm: Add _PAGE_NOPTISHADOW bit to avoid updating userspace page tables
mm/damon: fix order of arguments in damos_before_apply tracepoint
mm: memcg: declare do_memsw_account inline
mm: open-code PageTail in folio_flags() and const_folio_flags()
mm: open-code page_folio() in dump_page()
mm: fix vrealloc()'s KASAN poisoning logic
mm: respect mmap hint address when aligning for THP
scsi: ufs: pltfrm: Drop PM runtime reference count after ufshcd_remove()
memblock: allow zero threshold in validate_numa_converage()
rust: enable arbitrary_self_types and remove `Receiver`
s390/pci: Sort PCI functions prior to creating virtual busses
s390/pci: Use topology ID for multi-function devices
s390/pci: Ignore RID for isolated VFs
epoll: annotate racy check
kselftest/arm64: Log fp-stress child startup errors to stdout
s390/cpum_sf: Handle CPU hotplug remove during sampling
block: RCU protect disk->conv_zones_bitmap
btrfs: don't take dev_replace rwsem on task already holding it
btrfs: avoid unnecessary device path update for the same device
btrfs: canonicalize the device path before adding it
btrfs: do not clear read-only when adding sprout device
kselftest/arm64: Don't leak pipe fds in pac.exec_sign_all()
ext4: partial zero eof block on unaligned inode size extension
crypto: ecdsa - Avoid signed integer overflow on signature decoding
kcsan: Turn report_filterlist_lock into a raw_spinlock
hwmon: (nct6775) Add 665-ACE/600M-CL to ASUS WMI monitoring list
ACPI: x86: Make UART skip quirks work on PCI UARTs without an UID
ACPI: x86: Add adev NULL check to acpi_quirk_skip_serdev_enumeration()
ACPI: video: force native for Apple MacbookPro11,2 and Air7,2
perf/x86/amd: Warn only on new bits set
cleanup: Adjust scoped_guard() macros to avoid potential warning
iio: magnetometer: fix if () scoped_guard() formatting
timekeeping: Always check for negative motion
gpio: free irqs that are still requested when the chip is being removed
spi: spi-fsl-lpspi: Adjust type of scldiv
soc: qcom: llcc: Use designated initializers for LLC settings
HID: add per device quirk to force bind to hid-generic
firmware: qcom: scm: Allow QSEECOM on Lenovo Yoga Slim 7x
soc: qcom: pd-mapper: Add QCM6490 PD maps
media: uvcvideo: RealSense D421 Depth module metadata
media: uvcvideo: Add a quirk for the Kaiweets KTI-W02 infrared camera
media: uvcvideo: Force UVC version to 1.0a for 0408:4033
media: cx231xx: Add support for Dexatek USB Video Grabber 1d19:6108
mmc: core: Add SD card quirk for broken poweroff notification
mmc: sdhci-esdhc-imx: enable quirks SDHCI_QUIRK_NO_LED
firmware: qcom: scm: Allow QSEECOM on Dell XPS 13 9345
soc: imx8m: Probe the SoC driver as platform driver
regmap: maple: Provide lockdep (sub)class for maple tree's internal lock
selftests/resctrl: Protect against array overflow when reading strings
sched_ext: add a missing rcu_read_lock/unlock pair at scx_select_cpu_dfl()
HID: magicmouse: Apple Magic Trackpad 2 USB-C driver support
drm/xe/pciids: separate RPL-U and RPL-P PCI IDs
drm/xe/pciids: separate ARL and MTL PCI IDs
drm/vc4: hdmi: Avoid log spam for audio start failure
drm/vc4: hvs: Set AXI panic modes for the HVS
drm/xe/pciids: Add PVC's PCI device ID macros
wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb
drm/xe/pciid: Add new PCI id for ARL
drm: panel-orientation-quirks: Add quirk for AYA NEO 2 model
drm: panel-orientation-quirks: Add quirk for AYA NEO Founder edition
drm: panel-orientation-quirks: Add quirk for AYA NEO GEEK
drm/bridge: it6505: Enable module autoloading
drm/mcde: Enable module autoloading
wifi: rtw89: check return value of ieee80211_probereq_get() for RNR
drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create'
drm/radeon/r600_cs: Fix possible int overflow in r600_packet3_check()
ASoC: Intel: sof_rt5682: Add HDMI-In capture with rt5682 support for MTL.
dlm: fix possible lkb_resource null dereference
drm/amd/display: skip disable CRTC in seemless bootup case
drm/amd/display: Fix garbage or black screen when resetting otg
drm/amd/display: disable SG displays on cyan skillfish
drm/xe/ptl: L3bank mask is not available on the media GT
drm/xe/xe3: Add initial set of workarounds
drm/display: Fix building with GCC 15
ALSA: hda: Use own quirk lookup helper
ALSA: hda/conexant: Use the new codec SSID matching
ALSA: hda/realtek: Use codec SSID matching for Lenovo devices
r8169: don't apply UDP padding quirk on RTL8126A
samples/bpf: Fix a resource leak
wifi: ath12k: fix atomic calls in ath12k_mac_op_set_bitrate_mask()
accel/qaic: Add AIC080 support
drm/amd/display: Full exit out of IPS2 when all allow signals have been cleared
net: fec_mpc52xx_phy: Use %pa to format resource_size_t
net: ethernet: fs_enet: Use %pa to format resource_size_t
net/sched: cbs: Fix integer overflow in cbs_set_port_rate()
af_packet: avoid erroring out after sock_init_data() in packet_create()
Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()
Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc()
net: af_can: do not leave a dangling sk pointer in can_create()
net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
net: inet: do not leave a dangling sk pointer in inet_create()
net: inet6: do not leave a dangling sk pointer in inet6_create()
wifi: ath10k: avoid NULL pointer error during sdio remove
wifi: ath5k: add PCI ID for SX76X
wifi: ath5k: add PCI ID for Arcadyan devices
fanotify: allow reporting errors on failure to open fd
bpf: Prevent tailcall infinite loop caused by freplace
ASoC: sdw_utils: Add support for exclusion DAI quirks
ASoC: sdw_utils: Add a quirk to allow the cs42l43 mic DAI to be ignored
ASoC: Intel: sof_sdw: Add quirk for cs42l43 system using host DMICs
ASoC: Intel: sof_sdw: Add quirks for some new Lenovo laptops
drm/xe/guc/ct: Flush g2h worker in case of g2h response timeout
drm/panel: simple: Add Microchip AC69T88A LVDS Display panel
net: sfp: change quirks for Alcatel Lucent G-010S-P
net: stmmac: Programming sequence for VLAN packets with split header
drm/sched: memset() 'job' in drm_sched_job_init()
drm/amd/display: Adding array index check to prevent memory corruption
drm/amdgpu/gfx9: Add cleaner shader for GFX9.4.2
drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts for vega20_ih
drm/amdgpu: Dereference the ATCS ACPI buffer
netlink: specs: Add missing bitset attrs to ethtool spec
drm/amdgpu: refine error handling in amdgpu_ttm_tt_pin_userptr
ASoC: sdw_utils: Add quirk to exclude amplifier function
ASoC: Intel: soc-acpi-intel-arl-match: Add rt722 and rt1320 support
drm/amd/display: Fix underflow when playing 8K video in full screen mode
mptcp: annotate data-races around subflow->fully_established
dma-debug: fix a possible deadlock on radix_lock
jfs: array-index-out-of-bounds fix in dtReadFirst
jfs: fix shift-out-of-bounds in dbSplit
jfs: fix array-index-out-of-bounds in jfs_readdir
jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree
fsl/fman: Validate cell-index value obtained from Device Tree
net/tcp: Add missing lockdep annotations for TCP-AO hlist traversals
drm/panic: Add ABGR2101010 support
drm/amd/display: Remove hw w/a toggle if on DP2/HPO
drm/amd/display: parse umc_info or vram_info based on ASIC
drm/amd/display: Prune Invalid Modes For HDMI Output
drm/amdgpu: skip amdgpu_device_cache_pci_state under sriov
virtio-net: fix overflow inside virtnet_rq_alloc
ALSA: usb-audio: Make mic volume workarounds globally applicable
drm/amdgpu: set the right AMDGPU sg segment limitation
wifi: ipw2x00: libipw_rx_any(): fix bad alignment
wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw()
bpf: Call free_htab_elem() after htab_unlock_bucket()
mptcp: fix possible integer overflow in mptcp_reset_tout_timer
dsa: qca8k: Use nested lock to avoid splat
i2c: i801: Add support for Intel Panther Lake
Bluetooth: hci_conn: Reduce hci_conn_drop() calls in two functions
Bluetooth: btusb: Add RTL8852BE device 0489:e123 to device tables
Bluetooth: btusb: Add USB HW IDs for MT7920/MT7925
Bluetooth: hci_conn: Use disable_delayed_work_sync
Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet
Bluetooth: Add new quirks for ATS2851
Bluetooth: Support new quirks for ATS2851
Bluetooth: Set quirks for ATS2851
Bluetooth: btusb: Add new VID/PID 0489/e111 for MT7925
Bluetooth: btusb: Add new VID/PID 0489/e124 for MT7925
Bluetooth: btusb: Add 3 HWIDs for MT7925
ASoC: hdmi-codec: reorder channel allocation list
rocker: fix link status detection in rocker_carrier_init()
net/neighbor: clear error in case strict check is not set
netpoll: Use rcu_access_pointer() in __netpoll_setup
pinctrl: freescale: fix COMPILE_TEST error with PINCTRL_IMX_SCU
rtla: Fix consistency in getopt_long for timerlat_hist
tracing/ftrace: disable preemption in syscall probe
tracing: Use atomic64_inc_return() in trace_clock_counter()
tools/rtla: fix collision with glibc sched_attr/sched_set_attr
rtla/timerlat: Make timerlat_top_cpu->*_count unsigned long long
rtla/timerlat: Make timerlat_hist_cpu->*_count unsigned long long
scsi: hisi_sas: Add cond_resched() for no forced preemption model
scsi: hisi_sas: Create all dump files during debugfs initialization
ring-buffer: Limit time with disabled interrupts in rb_check_pages()
pinmux: Use sequential access to access desc->pinmux data
scsi: ufs: core: Make DMA mask configuration more flexible
iommu/amd: Fix corruption when mapping large pages from 0
bpf: put bpf_link's program when link is safe to be deallocated
scsi: lpfc: Call lpfc_sli4_queue_unset() in restart and rmmod paths
scsi: lpfc: Check SLI_ACTIVE flag in FDMI cmpl before submitting follow up FDMI
scsi: lpfc: Prevent NDLP reference count underflow in dev_loss_tmo callback
clk: qcom: rcg2: add clk_rcg2_shared_floor_ops
clk: qcom: rpmh: add support for SAR2130P
clk: qcom: tcsrcc-sm8550: add SAR2130P support
clk: qcom: dispcc-sm8550: enable support for SAR2130P
clk: qcom: clk-alpha-pll: Add NSS HUAYRA ALPHA PLL support for ipq9574
leds: class: Protect brightness_show() with led_cdev->led_access mutex
scsi: st: Don't modify unknown block number in MTIOCGET
scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset
pinctrl: qcom-pmic-gpio: add support for PM8937
pinctrl: qcom: spmi-mpp: Add PM8937 compatible
thermal/drivers/qcom/tsens-v1: Add support for MSM8937 tsens
nvdimm: rectify the illogical code within nd_dax_probe()
smb: client: memcpy() with surrounding object base address
tracing: Fix function name for trampoline
tools/rtla: Enhance argument parsing in timerlat_load.py
verification/dot2: Improve dot parser robustness
mailbox: pcc: Check before sending MCTP PCC response ACK
f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.
KMSAN: uninit-value in inode_go_dump (5)
i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request
PCI: qcom: Add support for IPQ9574
PCI: vmd: Add DID 8086:B06F and 8086:B60B for Intel client SKUs
PCI: vmd: Set devices to D0 before enabling PM L1 Substates
PCI: Detect and trust built-in Thunderbolt chips
PCI: starfive: Enable controller runtime PM before probing host bridge
PCI: Add 'reset_subordinate' to reset hierarchy below bridge
PCI: Add ACS quirk for Wangxun FF5xxx NICs
remoteproc: qcom: pas: enable SAR2130P audio DSP support
i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock
f2fs: print message if fscorrupted was found in f2fs_new_node_page()
f2fs: fix to shrink read extent node in batches
f2fs: add a sysfs node to limit max read extent count per-inode
ACPI: x86: Add skip i2c clients quirk for Acer Iconia One 8 A1-840
ACPI: x86: Clean up Asus entries in acpi_quirk_skip_dmi_ids[]
LoongArch: Fix sleeping in atomic context for PREEMPT_RT
fs/ntfs3: Fix warning in ni_fiemap
fs/ntfs3: Fix case when unmarked clusters intersect with zone
regulator: qcom-rpmh: Update ranges for FTSMPS525
usb: chipidea: add CI_HDRC_HAS_SHORT_PKT_LIMIT flag
usb: chipidea: udc: limit usb request length to max 16KB
usb: chipidea: udc: create bounce buffer for problem sglist entries if possible
usb: chipidea: udc: handle USB Error Interrupt if IOC not set
usb: typec: ucsi: Do not call ACPI _DSM method for UCSI read operations
iio: adc: ad7192: properly check spi_get_device_match_data()
iio: light: ltr501: Add LTER0303 to the supported devices
usb: typec: ucsi: glink: be more precise on orientation-aware ports
ASoC: amd: yc: fix internal mic on Redmi G 2022
drm/amdgpu/vcn: reset fw_shared when VCPU buffers corrupted on vcn v4.0.3
MIPS: Loongson64: DTS: Really fix PCIe port nodes for ls7a
ASoC: amd: yc: Add quirk for microphone on Lenovo Thinkpad T14s Gen 6 21M1CTO1WW
powerpc/prom_init: Fixup missing powermac #size-cells
misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle
rtc: cmos: avoid taking rtc_lock for extended period of time
serial: 8250_dw: Add Sophgo SG2044 quirk
Revert "nvme: make keep-alive synchronous operation"
irqchip/gicv3-its: Add workaround for hip09 ITS erratum 162100801
smb: client: don't try following DFS links in cifs_tree_connect()
setlocalversion: work around "git describe" performance
io_uring/tctx: work around xa_store() allocation error issue
scsi: ufs: pltfrm: Dellocate HBA during ufshcd_pltfrm_remove()
drm/xe/devcoredump: Use drm_puts and already cached local variables
drm/xe/devcoredump: Improve section headings and add tile info
drm/xe/devcoredump: Add ASCII85 dump helper function
drm/xe/guc: Copy GuC log prior to dumping
drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()
drm/xe/devcoredump: Update handling of xe_force_wake_get return
drm/amd/display: Add option to retrieve detile buffer size
sched: fix warning in sched_setaffinity
sched/core: Remove the unnecessary need_resched() check in nohz_csd_func()
sched/fair: Check idle_cpu() before need_resched() to detect ilb CPU turning busy
sched/core: Prevent wakeup of ksoftirqd during idle load balance
sched/deadline: Fix warning in migrate_enable for boosted tasks
btrfs: drop unused parameter options from open_ctree()
btrfs: drop unused parameter data from btrfs_fill_super()
btrfs: fix mount failure due to remount races
btrfs: fix missing snapshot drew unlock when root is dead during swap activation
clk: en7523: Initialize num before accessing hws in en7523_register_clocks()
tracing/eprobe: Fix to release eprobe when failed to add dyn_event
x86: Fix build regression with CONFIG_KEXEC_JUMP enabled
Revert "unicode: Don't special case ignorable code points"
vfio/mlx5: Align the page tracking max message size with the device capability
selftests/ftrace: adjust offset for kprobe syntax error test
KVM: x86/mmu: Ensure that kvm_release_pfn_clean() takes exact pfn from kvm_faultin_pfn()
jffs2: Prevent rtime decompress memory corruption
jffs2: Fix rtime decompressor
media: ipu6: use the IPU6 DMA mapping APIs to do mapping
ocfs2: Revert "ocfs2: fix the la space leak when unmounting an ocfs2 volume"
net/mlx5: unique names for per device caches
ASoC: Intel: avs: Fix return status of avs_pcm_hw_constraints_init()
drm/amdgpu: rework resume handling for display (v2)
ALSA: hda: Fix build error without CONFIG_SND_DEBUG
Revert "drm/amd/display: parse umc_info or vram_info based on ASIC"
s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails
ALSA: hda/realtek: Fix spelling mistake "Firelfy" -> "Firefly"
timekeeping: Remove CONFIG_DEBUG_TIMEKEEPING
clocksource: Make negative motion detection more robust
softirq: Allow raising SCHED_SOFTIRQ from SMP-call-function on RT kernel
Linux 6.12.5
Change-Id: If1b834954ed2ee1a16886f9a9909c6ca62d93b6c
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit f44ec8733a8469143fde1984b5e6931b2e2f6f3f ]
In general, BPF link's underlying BPF program should be considered to be
reachable through attach hook -> link -> prog chain, and, pessimistically,
we have to assume that as long as link's memory is not safe to free,
attach hook's code might hold a pointer to BPF program and use it.
As such, it's not (generally) correct to put link's program early before
waiting for RCU GPs to go through. More eager bpf_prog_put() that we
currently do is mostly correct due to BPF program's release code doing
similar RCU GP waiting, but as will be shown in the following patches,
BPF program can be non-sleepable (and, thus, reliant on only "classic"
RCU GP), while BPF link's attach hook can have sleepable semantics and
needs to be protected by RCU Tasks Trace, and for such cases BPF link
has to go through RCU Tasks Trace + "classic" RCU GPs before being
deallocated. And so, if we put BPF program early, we might free BPF
program before we free BPF link, leading to use-after-free situation.
So, this patch defers bpf_prog_put() until we are ready to perform
bpf_link's deallocation. At worst, this delays BPF program freeing by
one extra RCU GP, but that seems completely acceptable. Alternatively,
we'd need more elaborate ways to determine BPF hook, BPF link, and BPF
program lifetimes, and how they relate to each other, which seems like
an unnecessary complication.
Note, for most BPF links we still will perform eager bpf_prog_put() and
link dealloc, so for those BPF links there are no observable changes
whatsoever. Only BPF links that use deferred dealloc might notice
slightly delayed freeing of BPF programs.
Also, to reduce code and logic duplication, extract program put + link
dealloc logic into bpf_link_dealloc() helper.
Link: https://lore.kernel.org/20241101181754.782341-1-andrii@kernel.org
Tested-by: Jordan Rife <jrife@google.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit b9e9ed90b10c82a4e9d4d70a2890f06bfcdd3b78 ]
For htab of maps, when the map is removed from the htab, it may hold the
last reference of the map. bpf_map_fd_put_ptr() will invoke
bpf_map_free_id() to free the id of the removed map element. However,
bpf_map_fd_put_ptr() is invoked while holding a bucket lock
(raw_spin_lock_t), and bpf_map_free_id() attempts to acquire map_idr_lock
(spinlock_t), triggering the following lockdep warning:
=============================
[ BUG: Invalid wait context ]
6.11.0-rc4+ #49 Not tainted
-----------------------------
test_maps/4881 is trying to lock:
ffffffff84884578 (map_idr_lock){+...}-{3:3}, at: bpf_map_free_id.part.0+0x21/0x70
other info that might help us debug this:
context-{5:5}
2 locks held by test_maps/4881:
#0: ffffffff846caf60 (rcu_read_lock){....}-{1:3}, at: bpf_fd_htab_map_update_elem+0xf9/0x270
#1: ffff888149ced148 (&htab->lockdep_key#2){....}-{2:2}, at: htab_map_update_elem+0x178/0xa80
stack backtrace:
CPU: 0 UID: 0 PID: 4881 Comm: test_maps Not tainted 6.11.0-rc4+ #49
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), ...
Call Trace:
<TASK>
dump_stack_lvl+0x6e/0xb0
dump_stack+0x10/0x20
__lock_acquire+0x73e/0x36c0
lock_acquire+0x182/0x450
_raw_spin_lock_irqsave+0x43/0x70
bpf_map_free_id.part.0+0x21/0x70
bpf_map_put+0xcf/0x110
bpf_map_fd_put_ptr+0x9a/0xb0
free_htab_elem+0x69/0xe0
htab_map_update_elem+0x50f/0xa80
bpf_fd_htab_map_update_elem+0x131/0x270
htab_map_update_elem+0x50f/0xa80
bpf_fd_htab_map_update_elem+0x131/0x270
bpf_map_update_value+0x266/0x380
__sys_bpf+0x21bb/0x36b0
__x64_sys_bpf+0x45/0x60
x64_sys_call+0x1b2a/0x20d0
do_syscall_64+0x5d/0x100
entry_SYSCALL_64_after_hwframe+0x76/0x7e
One way to fix the lockdep warning is using raw_spinlock_t for
map_idr_lock as well. However, bpf_map_alloc_id() invokes
idr_alloc_cyclic() after acquiring map_idr_lock, it will trigger a
similar lockdep warning because the slab's lock (s->cpu_slab->lock) is
still a spinlock.
Instead of changing map_idr_lock's type, fix the issue by invoking
htab_put_fd_value() after htab_unlock_bucket(). However, only deferring
the invocation of htab_put_fd_value() is not enough, because the old map
pointers in htab of maps can not be saved during batched deletion.
Therefore, also defer the invocation of free_htab_elem(), so these
to-be-freed elements could be linked together similar to lru map.
There are four callers for ->map_fd_put_ptr:
(1) alloc_htab_elem() (through htab_put_fd_value())
It invokes ->map_fd_put_ptr() under a raw_spinlock_t. The invocation of
htab_put_fd_value() can not simply move after htab_unlock_bucket(),
because the old element has already been stashed in htab->extra_elems.
It may be reused immediately after htab_unlock_bucket() and the
invocation of htab_put_fd_value() after htab_unlock_bucket() may release
the newly-added element incorrectly. Therefore, saving the map pointer
of the old element for htab of maps before unlocking the bucket and
releasing the map_ptr after unlock. Beside the map pointer in the old
element, should do the same thing for the special fields in the old
element as well.
(2) free_htab_elem() (through htab_put_fd_value())
Its caller includes __htab_map_lookup_and_delete_elem(),
htab_map_delete_elem() and __htab_map_lookup_and_delete_batch().
For htab_map_delete_elem(), simply invoke free_htab_elem() after
htab_unlock_bucket(). For __htab_map_lookup_and_delete_batch(), just
like lru map, linking the to-be-freed element into node_to_free list
and invoking free_htab_elem() for these element after unlock. It is safe
to reuse batch_flink as the link for node_to_free, because these
elements have been removed from the hash llist.
Because htab of maps doesn't support lookup_and_delete operation,
__htab_map_lookup_and_delete_elem() doesn't have the problem, so kept
it as is.
(3) fd_htab_map_free()
It invokes ->map_fd_put_ptr without raw_spinlock_t.
(4) bpf_fd_htab_map_update_elem()
It invokes ->map_fd_put_ptr without raw_spinlock_t.
After moving free_htab_elem() outside htab bucket lock scope, using
pcpu_freelist_push() instead of __pcpu_freelist_push() to disable
the irq before freeing elements, and protecting the invocations of
bpf_mem_cache_free() with migrate_{disable|enable} pair.
Signed-off-by: Hou Tao <houtao1@huawei.com>
Link: https://lore.kernel.org/r/20241106063542.357743-2-houtao@huaweicloud.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit d6083f040d5d8f8d748462c77e90547097df936e ]
There is a potential infinite loop issue that can occur when using a
combination of tail calls and freplace.
In an upcoming selftest, the attach target for entry_freplace of
tailcall_freplace.c is subprog_tc of tc_bpf2bpf.c, while the tail call in
entry_freplace leads to entry_tc. This results in an infinite loop:
entry_tc -> subprog_tc -> entry_freplace --tailcall-> entry_tc.
The problem arises because the tail_call_cnt in entry_freplace resets to
zero each time entry_freplace is executed, causing the tail call mechanism
to never terminate, eventually leading to a kernel panic.
To fix this issue, the solution is twofold:
1. Prevent updating a program extended by an freplace program to a
prog_array map.
2. Prevent extending a program that is already part of a prog_array map
with an freplace program.
This ensures that:
* If a program or its subprogram has been extended by an freplace program,
it can no longer be updated to a prog_array map.
* If a program has been added to a prog_array map, neither it nor its
subprograms can be extended by an freplace program.
Moreover, an extension program should not be tailcalled. As such, return
-EINVAL if the program has a type of BPF_PROG_TYPE_EXT when adding it to a
prog_array map.
Additionally, fix a minor code style issue by replacing eight spaces with a
tab for proper formatting.
Reviewed-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
Link: https://lore.kernel.org/r/20241015150207.70264-2-leon.hwang@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 27abc7b3fa2e09bbe41e2924d328121546865eda ]
trie_get_next_key() uses node->prefixlen == key->prefixlen to identify
an exact match, However, it is incorrect because when the target key
doesn't fully match the found node (e.g., node->prefixlen != matchlen),
these two nodes may also have the same prefixlen. It will return
expected result when the passed key exist in the trie. However when a
recently-deleted key or nonexistent key is passed to
trie_get_next_key(), it may skip keys and return incorrect result.
Fix it by using node->prefixlen == matchlen to identify exact matches.
When the condition is true after the search, it also implies
node->prefixlen equals key->prefixlen, otherwise, the search would
return NULL instead.
Fixes: b471f2f1de ("bpf: implement MAP_GET_NEXT_KEY command for LPM_TRIE map")
Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com>
Signed-off-by: Hou Tao <houtao1@huawei.com>
Link: https://lore.kernel.org/r/20241206110622.1161752-6-houtao@huaweicloud.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 532d6b36b2bfac5514426a97a4df8d103d700d43 ]
When a LPM trie is full, in-place updates of existing elements
incorrectly return -ENOSPC.
Fix this by deferring the check of trie->n_entries. For new insertions,
n_entries must not exceed max_entries. However, in-place updates are
allowed even when the trie is full.
Fixes: b95a5c4db0 ("bpf: add a longest prefix match trie map implementation")
Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com>
Signed-off-by: Hou Tao <houtao1@huawei.com>
Link: https://lore.kernel.org/r/20241206110622.1161752-5-houtao@huaweicloud.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit b0e66977dc072906bb76555fb1a64261d7f63d0f ]
When CAP_PERFMON and CAP_SYS_ADMIN (allow_ptr_leaks) are disabled, the
verifier aims to reject partial overwrite on an 8-byte stack slot that
contains a spilled pointer.
However, in such a scenario, it rejects all partial stack overwrites as
long as the targeted stack slot is a spilled register, because it does
not check if the stack slot is a spilled pointer.
Incomplete checks will result in the rejection of valid programs, which
spill narrower scalar values onto scalar slots, as shown below.
0: R1=ctx() R10=fp0
; asm volatile ( @ repro.bpf.c:679
0: (7a) *(u64 *)(r10 -8) = 1 ; R10=fp0 fp-8_w=1
1: (62) *(u32 *)(r10 -8) = 1
attempt to corrupt spilled pointer on stack
processed 2 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0.
Fix this by expanding the check to not consider spilled scalar registers
when rejecting the write into the stack.
Previous discussion on this patch is at link [0].
[0]: https://lore.kernel.org/bpf/20240403202409.2615469-1-tao.lyu@epfl.ch
Fixes: ab125ed3ec ("bpf: fix check for attempt to corrupt spilled pointer")
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Tao Lyu <tao.lyu@epfl.ch>
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20241204044757.1483141-3-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 69772f509e084ec6bca12dbcdeeeff41b0103774 ]
Inside mark_stack_slot_misc, we should not upgrade STACK_INVALID to
STACK_MISC when allow_ptr_leaks is false, since invalid contents
shouldn't be read unless the program has the relevant capabilities.
The relaxation only makes sense when env->allow_ptr_leaks is true.
However, such conversion in privileged mode becomes unnecessary, as
invalid slots can be read without being upgraded to STACK_MISC.
Currently, the condition is inverted (i.e. checking for true instead of
false), simply remove it to restore correct behavior.
Fixes: eaf18febd6 ("bpf: preserve STACK_ZERO slots on partial reg spills")
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Reported-by: Tao Lyu <tao.lyu@epfl.ch>
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20241204044757.1483141-2-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 12659d28615d606b36e382f4de2dd05550d202af ]
Currently, KF_ARG_PTR_TO_ITER handling missed checking the reg->type and
ensuring it is PTR_TO_STACK. Instead of enforcing this in the caller of
process_iter_arg, move the check into it instead so that all callers
will gain the check by default. This is similar to process_dynptr_func.
An existing selftest in verifier_bits_iter.c fails due to this change,
but it's because it was passing a NULL pointer into iter_next helper and
getting an error further down the checks, but probably meant to pass an
uninitialized iterator on the stack (as is done in the subsequent test
below it). We will gain coverage for non-PTR_TO_STACK arguments in later
patches hence just change the declaration to zero-ed stack object.
Fixes: 06accc8779 ("bpf: add support for open-coded iterator loops")
Suggested-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Tao Lyu <tao.lyu@epfl.ch>
[ Kartikeya: move check into process_iter_arg, rewrite commit log ]
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20241203000238.3602922-2-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Steps on the way to 6.12.2
Resolves merge conflicts in:
fs/fuse/fuse_i.h
Change-Id: If765bb10099fb7efad53a0a4bcda888cd571ac97
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit 7c8ce4ffb684676039b1ff9ff81c126794e8d88e ]
Without kernel symbols for struct_ops trampoline, the unwinder may
produce unexpected stacktraces.
For example, the x86 ORC and FP unwinders check if an IP is in kernel
text by verifying the presence of the IP's kernel symbol. When a
struct_ops trampoline address is encountered, the unwinder stops due
to the absence of symbol, resulting in an incomplete stacktrace that
consists only of direct and indirect child functions called from the
trampoline.
The arm64 unwinder is another example. While the arm64 unwinder can
proceed across a struct_ops trampoline address, the corresponding
symbol name is displayed as "unknown", which is confusing.
Thus, add kernel symbol for struct_ops trampoline. The name is
bpf__<struct_ops_name>_<member_name>, where <struct_ops_name> is the
type name of the struct_ops, and <member_name> is the name of
the member that the trampoline is linked to.
Below is a comparison of stacktraces captured on x86 by perf record,
before and after this patch.
Before:
ffffffff8116545d __lock_acquire+0xad ([kernel.kallsyms])
ffffffff81167fcc lock_acquire+0xcc ([kernel.kallsyms])
ffffffff813088f4 __bpf_prog_enter+0x34 ([kernel.kallsyms])
After:
ffffffff811656bd __lock_acquire+0x30d ([kernel.kallsyms])
ffffffff81167fcc lock_acquire+0xcc ([kernel.kallsyms])
ffffffff81309024 __bpf_prog_enter+0x34 ([kernel.kallsyms])
ffffffffc000d7e9 bpf__tcp_congestion_ops_cong_avoid+0x3e ([kernel.kallsyms])
ffffffff81f250a5 tcp_ack+0x10d5 ([kernel.kallsyms])
ffffffff81f27c66 tcp_rcv_established+0x3b6 ([kernel.kallsyms])
ffffffff81f3ad03 tcp_v4_do_rcv+0x193 ([kernel.kallsyms])
ffffffff81d65a18 __release_sock+0xd8 ([kernel.kallsyms])
ffffffff81d65af4 release_sock+0x34 ([kernel.kallsyms])
ffffffff81f15c4b tcp_sendmsg+0x3b ([kernel.kallsyms])
ffffffff81f663d7 inet_sendmsg+0x47 ([kernel.kallsyms])
ffffffff81d5ab40 sock_write_iter+0x160 ([kernel.kallsyms])
ffffffff8149c67b vfs_write+0x3fb ([kernel.kallsyms])
ffffffff8149caf6 ksys_write+0xc6 ([kernel.kallsyms])
ffffffff8149cb5d __x64_sys_write+0x1d ([kernel.kallsyms])
ffffffff81009200 x64_sys_call+0x1d30 ([kernel.kallsyms])
ffffffff82232d28 do_syscall_64+0x68 ([kernel.kallsyms])
ffffffff8240012f entry_SYSCALL_64_after_hwframe+0x76 ([kernel.kallsyms])
Fixes: 85d33df357 ("bpf: Introduce BPF_MAP_TYPE_STRUCT_OPS")
Signed-off-by: Xu Kuohai <xukuohai@huawei.com>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Link: https://lore.kernel.org/r/20241112145849.3436772-4-xukuohai@huaweicloud.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 821a3fa32bbe3bc0fa23b3189325d3720a49a24c ]
Only function pointers in a struct_ops structure can be linked to bpf
progs, so set the links count to the function pointers count, instead
of the total members count in the structure.
Suggested-by: Martin KaFai Lau <martin.lau@linux.dev>
Signed-off-by: Xu Kuohai <xukuohai@huawei.com>
Link: https://lore.kernel.org/r/20241112145849.3436772-3-xukuohai@huaweicloud.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Stable-dep-of: 7c8ce4ffb684 ("bpf: Add kernel symbol for struct_ops trampoline")
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit cb4158ce8ec8a5bb528cc1693356a5eb8058094d ]
Arguments to a raw tracepoint are tagged as trusted, which carries the
semantics that the pointer will be non-NULL. However, in certain cases,
a raw tracepoint argument may end up being NULL. More context about this
issue is available in [0].
Thus, there is a discrepancy between the reality, that raw_tp arguments
can actually be NULL, and the verifier's knowledge, that they are never
NULL, causing explicit NULL checks to be deleted, and accesses to such
pointers potentially crashing the kernel.
To fix this, mark raw_tp arguments as PTR_MAYBE_NULL, and then special
case the dereference and pointer arithmetic to permit it, and allow
passing them into helpers/kfuncs; these exceptions are made for raw_tp
programs only. Ensure that we don't do this when ref_obj_id > 0, as in
that case this is an acquired object and doesn't need such adjustment.
The reason we do mask_raw_tp_trusted_reg logic is because other will
recheck in places whether the register is a trusted_reg, and then
consider our register as untrusted when detecting the presence of the
PTR_MAYBE_NULL flag.
To allow safe dereference, we enable PROBE_MEM marking when we see loads
into trusted pointers with PTR_MAYBE_NULL.
While trusted raw_tp arguments can also be passed into helpers or kfuncs
where such broken assumption may cause issues, a future patch set will
tackle their case separately, as PTR_TO_BTF_ID (without PTR_TRUSTED) can
already be passed into helpers and causes similar problems. Thus, they
are left alone for now.
It is possible that these checks also permit passing non-raw_tp args
that are trusted PTR_TO_BTF_ID with null marking. In such a case,
allowing dereference when pointer is NULL expands allowed behavior, so
won't regress existing programs, and the case of passing these into
helpers is the same as above and will be dealt with later.
Also update the failure case in tp_btf_nullable selftest to capture the
new behavior, as the verifier will no longer cause an error when
directly dereference a raw tracepoint argument marked as __nullable.
[0]: https://lore.kernel.org/bpf/ZrCZS6nisraEqehw@jlelli-thinkpadt14gen4.remote.csb
Reviewed-by: Jiri Olsa <jolsa@kernel.org>
Reported-by: Juri Lelli <juri.lelli@redhat.com>
Tested-by: Juri Lelli <juri.lelli@redhat.com>
Fixes: 3f00c52393 ("bpf: Allow trusted pointers to be passed to KF_TRUSTED_ARGS kfuncs")
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20241104171959.2938862-2-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 46f7ed32f7a873d6675ea72e1d6317df41a55f81 ]
There are three situations when a program logically exits and transfers
control to the kernel or another program: bpf_throw, BPF_EXIT, and tail
calls. The former two check for any lingering locks and references, but
tail calls currently do not. Expand the checks to check for spin locks,
RCU read sections and preempt disabled sections.
Spin locks are indirectly preventing tail calls as function calls are
disallowed, but the checks for preemption and RCU are more relaxed,
hence ensure tail calls are prevented in their presence.
Fixes: 9bb00b2895 ("bpf: Add kfunc bpf_rcu_read_lock/unlock()")
Fixes: fc7566ad0a ("bpf: Introduce bpf_preempt_[disable,enable] kfuncs")
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20241103225940.1408302-2-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Pull bpf fixes from Daniel Borkmann:
- Fix BPF verifier to force a checkpoint when the program's jump
history becomes too long (Eduard Zingerman)
- Add several fixes to the BPF bits iterator addressing issues like
memory leaks and overflow problems (Hou Tao)
- Fix an out-of-bounds write in trie_get_next_key (Byeonguk Jeong)
- Fix BPF test infra's LIVE_FRAME frame update after a page has been
recycled (Toke Høiland-Jørgensen)
- Fix BPF verifier and undo the 40-bytes extra stack space for
bpf_fastcall patterns due to various bugs (Eduard Zingerman)
- Fix a BPF sockmap race condition which could trigger a NULL pointer
dereference in sock_map_link_update_prog (Cong Wang)
- Fix tcp_bpf_recvmsg_parser to retrieve seq_copied from tcp_sk under
the socket lock (Jiayuan Chen)
* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
bpf, test_run: Fix LIVE_FRAME frame update after a page has been recycled
selftests/bpf: Add three test cases for bits_iter
bpf: Use __u64 to save the bits in bits iterator
bpf: Check the validity of nr_words in bpf_iter_bits_new()
bpf: Add bpf_mem_alloc_check_size() helper
bpf: Free dynamically allocated bits in bpf_iter_bits_destroy()
bpf: disallow 40-bytes extra stack for bpf_fastcall patterns
selftests/bpf: Add test for trie_get_next_key()
bpf: Fix out-of-bounds write in trie_get_next_key()
selftests/bpf: Test with a very short loop
bpf: Force checkpoint when jmp history is too long
bpf: fix filed access without lock
sock_map: fix a NULL pointer dereference in sock_map_link_update_prog()
On 32-bit hosts (e.g., arm32), when a bpf program passes a u64 to
bpf_iter_bits_new(), bpf_iter_bits_new() will use bits_copy to store the
content of the u64. However, bits_copy is only 4 bytes, leading to stack
corruption.
The straightforward solution would be to replace u64 with unsigned long
in bpf_iter_bits_new(). However, this introduces confusion and problems
for 32-bit hosts because the size of ulong in bpf program is 8 bytes,
but it is treated as 4-bytes after passed to bpf_iter_bits_new().
Fix it by changing the type of both bits and bit_count from unsigned
long to u64. However, the change is not enough. The main reason is that
bpf_iter_bits_next() uses find_next_bit() to find the next bit and the
pointer passed to find_next_bit() is an unsigned long pointer instead
of a u64 pointer. For 32-bit little-endian host, it is fine but it is
not the case for 32-bit big-endian host. Because under 32-bit big-endian
host, the first iterated unsigned long will be the bits 32-63 of the u64
instead of the expected bits 0-31. Therefore, in addition to changing
the type, swap the two unsigned longs within the u64 for 32-bit
big-endian host.
Signed-off-by: Hou Tao <houtao1@huawei.com>
Link: https://lore.kernel.org/r/20241030100516.3633640-5-houtao@huaweicloud.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Check the validity of nr_words in bpf_iter_bits_new(). Without this
check, when multiplication overflow occurs for nr_bits (e.g., when
nr_words = 0x0400-0001, nr_bits becomes 64), stack corruption may occur
due to bpf_probe_read_kernel_common(..., nr_bytes = 0x2000-0008).
Fix it by limiting the maximum value of nr_words to 511. The value is
derived from the current implementation of BPF memory allocator. To
ensure compatibility if the BPF memory allocator's size limitation
changes in the future, use the helper bpf_mem_alloc_check_size() to
check whether nr_bytes is too larger. And return -E2BIG instead of
-ENOMEM for oversized nr_bytes.
Fixes: 4665415975 ("bpf: Add bits iterator")
Signed-off-by: Hou Tao <houtao1@huawei.com>
Link: https://lore.kernel.org/r/20241030100516.3633640-4-houtao@huaweicloud.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Introduce bpf_mem_alloc_check_size() to check whether the allocation
size exceeds the limitation for the kmalloc-equivalent allocator. The
upper limit for percpu allocation is LLIST_NODE_SZ bytes larger than
non-percpu allocation, so a percpu argument is added to the helper.
The helper will be used in the following patch to check whether the size
parameter passed to bpf_mem_alloc() is too big.
Signed-off-by: Hou Tao <houtao1@huawei.com>
Link: https://lore.kernel.org/r/20241030100516.3633640-3-houtao@huaweicloud.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
bpf_iter_bits_destroy() uses "kit->nr_bits <= 64" to check whether the
bits are dynamically allocated. However, the check is incorrect and may
cause a kmemleak as shown below:
unreferenced object 0xffff88812628c8c0 (size 32):
comm "swapper/0", pid 1, jiffies 4294727320
hex dump (first 32 bytes):
b0 c1 55 f5 81 88 ff ff f0 f0 f0 f0 f0 f0 f0 f0 ..U...........
f0 f0 f0 f0 f0 f0 f0 f0 00 00 00 00 00 00 00 00 ..............
backtrace (crc 781e32cc):
[<00000000c452b4ab>] kmemleak_alloc+0x4b/0x80
[<0000000004e09f80>] __kmalloc_node_noprof+0x480/0x5c0
[<00000000597124d6>] __alloc.isra.0+0x89/0xb0
[<000000004ebfffcd>] alloc_bulk+0x2af/0x720
[<00000000d9c10145>] prefill_mem_cache+0x7f/0xb0
[<00000000ff9738ff>] bpf_mem_alloc_init+0x3e2/0x610
[<000000008b616eac>] bpf_global_ma_init+0x19/0x30
[<00000000fc473efc>] do_one_initcall+0xd3/0x3c0
[<00000000ec81498c>] kernel_init_freeable+0x66a/0x940
[<00000000b119f72f>] kernel_init+0x20/0x160
[<00000000f11ac9a7>] ret_from_fork+0x3c/0x70
[<0000000004671da4>] ret_from_fork_asm+0x1a/0x30
That is because nr_bits will be set as zero in bpf_iter_bits_next()
after all bits have been iterated.
Fix the issue by setting kit->bit to kit->nr_bits instead of setting
kit->nr_bits to zero when the iteration completes in
bpf_iter_bits_next(). In addition, use "!nr_bits || bits >= nr_bits" to
check whether the iteration is complete and still use "nr_bits > 64" to
indicate whether bits are dynamically allocated. The "!nr_bits" check is
necessary because bpf_iter_bits_new() may fail before setting
kit->nr_bits, and this condition will stop the iteration early instead
of accessing the zeroed or freed kit->bits.
Considering the initial value of kit->bits is -1 and the type of
kit->nr_bits is unsigned int, change the type of kit->nr_bits to int.
The potential overflow problem will be handled in the following patch.
Fixes: 4665415975 ("bpf: Add bits iterator")
Acked-by: Yafang Shao <laoar.shao@gmail.com>
Signed-off-by: Hou Tao <houtao1@huawei.com>
Link: https://lore.kernel.org/r/20241030100516.3633640-2-houtao@huaweicloud.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Pull cgroup fixes from Tejun Heo:
- cgroup_bpf_release_fn() could saturate system_wq with
cgrp->bpf.release_work which can then form a circular dependency
leading to deadlocks. Fix by using a dedicated workqueue. The
system_wq's max concurrency limit is being increased separately.
- Fix theoretical off-by-one bug when enforcing max cgroup hierarchy
depth
* tag 'cgroup-for-6.12-rc5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
cgroup: Fix potential overflow issue when checking max_depth
cgroup/bpf: use a dedicated workqueue for cgroup bpf destruction
trie_get_next_key() allocates a node stack with size trie->max_prefixlen,
while it writes (trie->max_prefixlen + 1) nodes to the stack when it has
full paths from the root to leaves. For example, consider a trie with
max_prefixlen is 8, and the nodes with key 0x00/0, 0x00/1, 0x00/2, ...
0x00/8 inserted. Subsequent calls to trie_get_next_key with _key with
.prefixlen = 8 make 9 nodes be written on the node stack with size 8.
Fixes: b471f2f1de ("bpf: implement MAP_GET_NEXT_KEY command for LPM_TRIE map")
Signed-off-by: Byeonguk Jeong <jungbu2855@gmail.com>
Reviewed-by: Toke Høiland-Jørgensen <toke@kernel.org>
Tested-by: Hou Tao <houtao1@huawei.com>
Acked-by: Hou Tao <houtao1@huawei.com>
Link: https://lore.kernel.org/r/Zxx384ZfdlFYnz6J@localhost.localdomain
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Greg Kroah-Hartman
Hou Tao
Martin KaFai Lau
Pei Xiao
Darren Chang
Eduard Zingerman
Anton Protopopov
Kumar Kartikeya Dwivedi
Andrea Righi
Andrii Nakryiko
Leon Hwang
Maciej Fijalkowski
Tao Lyu
Xu Kuohai
Jiri Olsa
Matthias Maennich
Linus Torvalds
Lee Jones
Byeonguk Jeong