* [PATCH 6.12 000/877] 6.12.112-rc1 review
@ 2026-09-30 15:15 Greg Kroah-Hartman
2026-09-30 15:15 ` [PATCH 6.12 001/877] Revert "hwmon: (emc1403) Drop hysteresis for low limit temperature" Greg Kroah-Hartman
` (884 more replies)
0 siblings, 885 replies; 922+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
This is the start of the stable review cycle for the 6.12.112 release.
There are 877 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri, 02 Oct 2026 15:23:04 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.112-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 6.12.112-rc1
Longlong Xia <xialonglong@kylinos.cn>
mm/hugetlb: keep max_huge_pages when dissolving surplus folios
Jiayuan Chen <jiayuan.chen@linux.dev>
bpf: Reject key-less BTF for hash maps
Pei Xiao <xiaopei01@kylinos.cn>
usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition
Mario Limonciello <mario.limonciello@amd.com>
platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails
Miquel Raynal (DAVE) <miquel.raynal@bootlin.com>
mtd: rawnand: pl353: Fix debug prints
Steven Rostedt <rostedt@goodmis.org>
tracing: Move d_max_latency out of CONFIG_FSNOTIFY protection
Ben Hutchings <benh@debian.org>
bootconfig: Fix negative seeks on 32-bit with LFS enabled
Christoph Hellwig <hch@lst.de>
nvme: revert the cross-controller atomic write size validation
Lin.Cao <lincao12@amd.com>
drm/amdgpu: fix ring timeout issue in gfx10 sr-iov environment
Bernard Pidoux <bernard.f6bvp@gmail.com>
rose: don't free fd-owned sockets when reaping in the heartbeat
Bernard Pidoux <bernard.f6bvp@gmail.com>
rose: clear neighbour pointer in rose_kill_by_device()
Bernard Pidoux <bernard.f6bvp@gmail.com>
rose: cancel neighbour timers in rose_neigh_put() before freeing
Bernard Pidoux <bernard.f6bvp@gmail.com>
rose: drop CALL_REQUEST in loopback timer when device is not running
Bernard Pidoux <bernard.f6bvp@gmail.com>
rose: release netdev ref and destroy orphaned incoming sockets
Bernard Pidoux <bernard.f6bvp@gmail.com>
rose: fix netdev double-hold in rose_make_new()
Bernard Pidoux <bernard.f6bvp@gmail.com>
rose: disconnect orphaned STATE_2 sockets when device is gone
Bernard Pidoux <bernard.f6bvp@gmail.com>
rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup
Bernard Pidoux <bernard.f6bvp@gmail.com>
rose: fix notifier unregistered too early in rose_exit()
Bernard Pidoux <bernard.f6bvp@gmail.com>
rose: fix netdev double-hold in rose_rx_call_request()
Bernard Pidoux <bernard.f6bvp@gmail.com>
rose: guard rose_neigh_put() against NULL in timer expiry
Bernard Pidoux <bernard.f6bvp@gmail.com>
rose: clear neighbour pointer after rose_neigh_put() in state machines
Bernard Pidoux <bernard.f6bvp@gmail.com>
rose: fix race between loopback timer and module removal
Bernard Pidoux <bernard.f6bvp@gmail.com>
rose: hold loopback neighbour reference across timer callback
Bernard Pidoux <bernard.f6bvp@gmail.com>
rose: fix dev_put() leak in rose_loopback_timer()
Xie Bo <xb@ultrarisc.com>
RISC-V: KVM: Serialize IMSIC attributes with vCPU migration
Jiakai Xu <jiakaipeanut@gmail.com>
RISC-V: KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_rw_attr()
Dapeng Mi <dapeng1.mi@linux.intel.com>
perf/x86/intel: Fix GRT PEBS load/store direction for latency events, to fix sample classification
Dapeng Mi <dapeng1.mi@linux.intel.com>
perf/x86/intel: Update event constraints and cache_extra_regsfor ADL
Dapeng Mi <dapeng1.mi@linux.intel.com>
perf/x86/intel: Remove incorrect LionCove PEBS data-source constraints
Dapeng Mi <dapeng1.mi@linux.intel.com>
perf/x86/intel: Update event constraints and cache_extra_regsfor LNL
Sean Christopherson <seanjc@google.com>
KVM: SEV: Do cache maintenance on the source VM during intra-host migration
Zheyun Shen <szy0127@sjtu.edu.cn>
KVM: SVM: Flush cache only on CPUs running SEV guest
Guangshuo Li <lgs201920130244@gmail.com>
net: ena: fix MMIO read buffer leak on probe failure
Dr. David Alan Gilbert <linux@treblig.org>
net: ena: Remove autopolling mode
Yuqi Xu <xuyuqiabc@gmail.com>
net: ipconfig: bound DHCP option construction
Thorsten Blum <thorsten.blum@linux.dev>
net: ipconfig: Remove outdated comment and indent code block
Ilya Maximets <i.maximets@ovn.org>
net/sched: act_ct: avoid modifying shared unconfirmed ct entry
Ilya Maximets <i.maximets@ovn.org>
net/sched: act_ct: fix helper UAF due to extensions realloc
Chen Changcheng <chenchangcheng@kylinos.cn>
HID: alps: unregister DualPoint Stick input device on remove
Bastien Nocera <hadess@hadess.net>
HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM
Willem de Bruijn <willemb@google.com>
packet: use ubuf_info completion for TX_RING packets
Liz Fong-Jones <lizf@honeycomb.io>
PCI: Fix BAR resize for devices on a root bus
Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
PCI: Fix Resizable BAR restore order
Christian Brauner <brauner@kernel.org>
super: make iterate_supers_type() deletion-safe
Longlong Xia <xialonglong@kylinos.cn>
mm/hugetlb: do not dissolve gigantic pages without runtime support
Usama Arif <usamaarif642@gmail.com>
mm/hugetlb: create hstate_is_gigantic_no_runtime helper
Jinjiang Tu <tujinjiang@huawei.com>
mm/hugetlb: fix surplus pages in dissolve_free_huge_page()
SJ Park <sj@kernel.org>
mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold()
Matthew Auld <matthew.auld@intel.com>
drm/xe/vm: nuke PTs only after unlinking contested VMAs
Jinjiang Tu <tujinjiang@huawei.com>
mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish
Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
mm/rmap: allocate anon_vma_chain objects unlocked when possible
Imre Deak <imre.deak@intel.com>
drm/i915/dp_mst: Fix configuring FEC for a disconnected stream
Jani Nikula <jani.nikula@intel.com>
drm/i915/mst: add mst sub-struct to struct intel_dp
shechenglong <shechenglong@xfusion.com>
drm/client: fix restore of partially initialized client
Thomas Zimmermann <tzimmermann@suse.de>
drm/client: Pass force parameter to client restore
Wentao Liang <vulab@iscas.ac.cn>
drm/amdgpu: Fix acpi device leak in amdgpu_acpi_enumerate_xcc()
Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
i2c: qcom-geni: Fix hardcoded clock index in SE_GENI_CLK_SEL
Myeonghun Pak <mhun512@gmail.com>
bna: prevent IOC timer rearm during teardown
Fan Wu <wufan@kernel.org>
ipe: fix use-after-free when auditing a newly loaded policy
Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
gpio: cdev: fix kernel stack leak to user-space in error path
Xiang Mei <xmei5@asu.edu>
vlan: require the MAC header to be present in __vlan_insert_inner_tag()
Fuad Tabba <fuad.tabba@linux.dev>
arm64/boot: Disable trapping of PMZR_EL0 writes to EL2
April Cardenas <april.cardenas@canonical.com>
smb/client: send lease break ACKs thru correct session for multiuser mounts
Frank Sorenson <sorenson@redhat.com>
smb: client: fix reparse buffer bounds in cifs_query_reparse_point()
Mike Lothian <mike@fireburn.co.uk>
drm/amdgpu: hold a runtime PM reference for P2P dma-buf attachments
Yunxiang Li <Yunxiang.Li@amd.com>
drm: add drm_memory_stats_is_zero
Frank Sorenson <sorenson@redhat.com>
smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()
Chengjun Yao <Chengjun.Yao@amd.com>
drm/amdgpu: fix rmmio iounmap skipped on device removal
Christian König <christian.koenig@amd.com>
drm/amdgpu: use GFP_NOWAIT for memory allocations
Saleemkhan Jamadar <saleemkhan.jamadar@amd.com>
drm/amdgpu/umsch: remove vpe test from umsch
Christian König <christian.koenig@amd.com>
drm/amdgpu: set the VM pointer to NULL in amdgpu_job_prepare
Andrew Martin <Andrew.Martin@amd.com>
drm/amdgpu: Failed to check various return code
Joseph Qi <joseph.qi@linux.alibaba.com>
smb: client: fix use-after-free of iface in cifs_try_adding_channels()
Bharath SM <bharathsm@microsoft.com>
smb: mark the new channel addition log as informational log with cifs_info
Devin Wittmayer <lucid_duck@justthetip.ca>
wifi: mac80211: refuse to make a monitor active when it has no queue
Benjamin Berg <benjamin.berg@intel.com>
wifi: mac80211: track MU-MIMO configuration on disabled interfaces
Daehyeon Ko <4ncienth@gmail.com>
wifi: libipw: reject TKIP frames without a full MIC
Saim Shujah <saimzst@gmail.com>
drm/msm/dpu: clear pending peripheral flush state
Yibo Tan <lhfff@tju.edu.cn>
hwmon: (pwm-fan) Stop RPM timer before freeing tach data
Fan Wu <fanwu01@zju.edu.cn>
wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown
Runyu Xiao <runyu.xiao@seu.edu.cn>
Input: hp_sdc - shut down kicker timer on module exit
Arun Easi <aeasi@cisco.com>
scsi: fnic: Fix missed link-up when critical IRQ targets offline CPU
Liu Zhenlong <dragonliu2018@gmail.com>
i2c: qcom-cci: fix device_node refcount leak in cci_probe()/cci_remove()
Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
i2c: qcom-cci: Remove the unused variable cci_clk_rate
Bryan O'Donoghue <bryan.odonoghue@linaro.org>
i2c: qcom-cci: Stop complaining about DT set clock rate
Mark Rutland <mark.rutland@arm.com>
arm64: percpu: Fix LSE operations on {8,16}-bit types
Catalin Marinas <catalin.marinas@arm.com>
arm64: Use load LSE atomics for the non-return per-CPU atomic operations
Hongling Zeng <zenghongling@kylinos.cn>
btrfs: take commit root semaphore when iterating in mark_block_group_to_copy()
Ahmed Naseef <naseefkm@gmail.com>
net: phy: mediatek: do not report link and per-speed LED rules together
Donggeun Yoo <donggeunyoo.kernel@gmail.com>
swiotlb: use the adjusted address for the highmem page lookup
Xiang Mei <xmei5@asu.edu>
ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity
Takashi Iwai <tiwai@suse.de>
ALSA: usb-audio: Optimize the copy of packet sizes for implicit fb handling
Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
phy: renesas: rcar-gen3-usb2: Avoid long delay in atomic context
David Howells <dhowells@redhat.com>
9p: Fix v9fs_issue_write() to update i_size and remote_i_size
David Howells <dhowells@redhat.com>
cifs: Fix specification of function pointers
Darrick J. Wong <djwong@kernel.org>
xfs: fix backwards mergeability logic in refcount scrubber
Darrick J. Wong <djwong@kernel.org>
xfs: fix under-reservation of blocks when repairing sf directories
Christoph Hellwig <hch@lst.de>
xfs: remove the i_ino field in struct xfs_inode
Darrick J. Wong <djwong@kernel.org>
xfs: strengthen the "is cow staging" helpers in scrub
Darrick J. Wong <djwong@kernel.org>
xfs: fix short ifork reaping computation in xreap_bmapi_binval
Darrick J. Wong <djwong@kernel.org>
xfs: report healthy filesystem events in scrub stats
Bjoern Doebel <doebel@amazon.de>
smb: client: fail DACL rewrite when the new DACL exceeds 64K
Ralph Boehme <slow@samba.org>
smb/client: fix security flag calculation when setting security descriptors
Ralph Boehme <slow@samba.org>
smb: client: refactor ACL setting control flow in id_mode_to_cifs_acl()
Paolo Abeni <pabeni@redhat.com>
mptcp: prevent race between disconnect() and rtx
Paolo Abeni <pabeni@redhat.com>
mptcp: do not reschedule the RTX timer for fallback sockets
Eric Dumazet <edumazet@google.com>
tcp: introduce icsk->icsk_keepalive_timer
Kalpan Jani <kalpan.jani@mpiricsoftware.com>
mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0
Matthieu Baerts (NGI0) <matttbe@kernel.org>
mptcp: pm: rename add_entry structure to add_addr
Matthieu Baerts (NGI0) <matttbe@kernel.org>
mptcp: pm: use for_each_subflow helper
Matthieu Baerts (NGI0) <matttbe@kernel.org>
mptcp: pm: reset retrans_time when ADD_ADDR entry is reused
Joe Damato <joe@dama.to>
bnxt_en: Don't free the live ring's TPA state on queue restart failure
Will Chen <will.chen.tty@gmail.com>
bnxt: fix memory leak in bnxt_queue_mem_alloc error cases
Pavel Begunkov <asml.silence@gmail.com>
eth: bnxt: store rx buffer size per queue
Michael Chan <michael.chan@broadcom.com>
bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips
Qing Luo <luoqing@kylinos.cn>
mptcp: pm: userspace: fix address ID overflow
Geliang Tang <geliang@kernel.org>
mptcp: use sock_kmemdup for address entry
Geliang Tang <geliang@kernel.org>
sock: add sock_kmemdup helper
Geliang Tang <geliang@kernel.org>
mptcp: pm: drop match in userspace_pm_append_new_local_addr
Joe Damato <joe@dama.to>
bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc()
Mina Almasry <almasrymina@google.com>
page_pool: disable sync for cpu for dmabuf memory provider
Mina Almasry <almasrymina@google.com>
net: page_pool: rename page_pool_alloc_netmem to *_netmems
Alexander Lobakin <aleksander.lobakin@intel.com>
netmem: add a couple of page helper wrappers
Norbert Szetei <norbert@doyensec.com>
landlock: Fix use-after-free of the source's parent directory
Günther Noack <gnoack3000@gmail.com>
landlock: Clarify documentation for the IOCTL access right
Zhiling Zou <zhilinz@nebusec.ai>
ipv6: flowlabel: cap duplicate leases per socket
Kuniyuki Iwashima <kuniyu@google.com>
ipv6: Move ipv6_fl_list from ipv6_pinfo to inet_sock.
Eric Dumazet <edumazet@google.com>
ipv6: reorganise struct ipv6_pinfo
Eric Dumazet <edumazet@google.com>
ipv6: make ipv6_pinfo.saddr_cache a boolean
Eric Dumazet <edumazet@google.com>
ipv4: remove fib_info_devhash[]
Eric Dumazet <edumazet@google.com>
ipv4: use rcu in ip_fib_check_default()
Eric Dumazet <edumazet@google.com>
ipv4: remove fib_devindex_hashfn()
Myeonghun Pak <mhun512@gmail.com>
idpf: disable DIM work before freeing q_vectors
Pavan Kumar Linga <pavan.kumar.linga@intel.com>
idpf: introduce idpf_q_vec_rsrc struct and move vector resources to it
Andy Shevchenko <andriy.shevchenko@linux.intel.com>
idpf: Fix kernel-doc descriptions to avoid warnings
Jingbo Xu <jefflexu@linux.alibaba.com>
erofs: add sysfs feature entry for xattr prefixes
Runyu Xiao <runyu.xiao@seu.edu.cn>
net: macb: initialize PTP state before registering clock
Théo Lebrun <theo.lebrun@bootlin.com>
net: macb: unify device pointer naming convention
Kevin Hao <haokexin@gmail.com>
net: macb: Use netif_napi_add_tx() instead of netif_napi_add() for TX NAPI
Kevin Hao <haokexin@gmail.com>
net: macb: Replace open-coded implementation with napi_schedule()
Chengfeng Ye <nicoyip.dev@gmail.com>
netfilter: cttimeout: prevent UAF during module unload
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount
Thomas Hellström <thomas.hellstrom@linux.intel.com>
drm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches
Zhiling Zou <zhilinz@nebusec.ai>
net: bridge: use option bits for CFM/MRP frame handlers
Masami Hiramatsu (Google) <mhiramat@kernel.org>
bootconfig: Fix integer overflow in initrd size check
Gabriel Krisman Bertazi <krisman@suse.de>
io_uring/net: don't overconsume buffers when using MSG_TRUNC
Jens Axboe <axboe@kernel.dk>
io_uring/rw: end write accounting from ->ki_complete
Leonardo Costa <leonardo.costa@toradex.com>
drm/bridge: tc358768: Enforce input bus flags via atomic_check
XingWang Xiang <v3rdant.xiang@gmail.com>
genetlink: pin family module during policy dump
Dinh Nguyen <dinguyen@kernel.org>
EDAC/altera: Use parent device for devres in altr_portb_setup()
Rounak Das <rounakdas2025@gmail.com>
EDAC/altera: Use ECC manager compatible to select A10/S10 IRQ layout
Donggeun Yoo <donggeunyoo.kernel@gmail.com>
tracing: Undo the registration when enabling the histogram trigger fails
Donggeun Yoo <donggeunyoo.kernel@gmail.com>
tracing: Take the reference before publishing the named histogram trigger
Steven Rostedt <rostedt@goodmis.org>
tracing: Take trace_array reference when opening a tracer options file
Masami Hiramatsu (Google) <mhiramat@kernel.org>
tools/bootconfig: Fix integer overflow and truncation in size checks
Masami Hiramatsu (Google) <mhiramat@kernel.org>
tools/bootconfig: Cleanup bootconfig footer size calculations
Xiong Weimin <xiongweimin@kylinos.cn>
virtio_mmio: disable IRQ wake before free_irq
Viresh Kumar <viresh.kumar@linaro.org>
virtio-mmio: Remove virtqueue list from mmio device
Donggeun Yoo <donggeunyoo.kernel@gmail.com>
tracing: Set the trace clock before registering the histogram trigger
Steven Rostedt <rostedt@goodmis.org>
tracing: Merge struct event_trigger_ops into struct event_command
Steven Rostedt <rostedt@goodmis.org>
tracing: Remove get_trigger_ops() and add count_func() from trigger ops
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
tracing: Constify struct event_trigger_ops
Vasileios Almpanis <vasilisalmpanis@gmail.com>
configfs: unhash the dentry before dropping the item in rmdir
Cen Zhang (Microsoft) <blbllhy@gmail.com>
reboot: fix cad_pid use-after-free race
Oleg Nesterov <oleg@redhat.com>
sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]
Zihan Xi <zihanx@nebusec.ai>
ipmr: account multicast table and route memory
Donggeun Yoo <donggeunyoo.kernel@gmail.com>
tracing: Fix memory corruption from a "STACKTRACE" histogram key
Vasileios Almpanis <vasilisalmpanis@gmail.com>
configfs: pin the symlink target's dirent instead of chasing ->ci_dentry
Al Viro <viro@zeniv.linux.org.uk>
configfs:get_target() - release path as soon as we grab configfs_item reference
Shixiong Ou <oushixiong@kylinos.cn>
drm/sysfb: ofdrm: Fix is_avivo() constant comparison bug
Shixiong Ou <oushixiong@kylinos.cn>
drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation
Thomas Zimmermann <tzimmermann@suse.de>
drm/sysfb: simpledrm: Improve framebuffer-size validation
Thomas Zimmermann <tzimmermann@suse.de>
firmware: sysfb: Move bpp-depth calculation into screen_info helper
Thomas Zimmermann <tzimmermann@suse.de>
drm/sysfb: simpledrm: Improve stride validation
Thomas Zimmermann <tzimmermann@suse.de>
drm/sysfb: simpledrm: Improve panel-size validation
Roman Li <Roman.Li@amd.com>
drm/amd/display: Set gpuvm min page size to 4K on dcn35/36
Lyude Paul <lyude@redhat.com>
drm/nouveau/disp/r535: Add scanline position support + head state support
Bob Zhou <bobzhou2@amd.com>
drm/amdgpu: avoid force-completing uninitialized UVD rings
Alex Deucher <alexander.deucher@amd.com>
drm/amdgpu: plumb timedout fence through to force completion
Alex Deucher <alexander.deucher@amd.com>
drm/amdgpu: add a helper to calculate ring distance
Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
drm/amdgpu: Fix missing unwind in amdgpu_ib_schedule() error path
Daeho Jeong <daehojeong@google.com>
f2fs: accurately adjust free_sections during free_segment_range
Chao Yu <chao@kernel.org>
f2fs: fix to clear dirty flag on folio in error path
Matthew Wilcox (Oracle) <willy@infradead.org>
f2fs: Convert clear_node_page_dirty() to clear_node_folio_dirty()
Chao Yu <chao@kernel.org>
f2fs: embed f2fs_gc_kthread in f2fs_sb_info
Guanghui Yang <3497809730@qq.com>
f2fs: fix dentry folio leak in find_in_level
Wenjie Qi <qwjhust@gmail.com>
f2fs: limit recovery filename logging to stored length
Joanne Chang <joannechien@google.com>
f2fs: dirty directory inodes on mtime/ctime update
Chao Yu <chao@kernel.org>
f2fs: fix to avoid potential section-unaligned pinfile
wangzijie <wangzijie1@honor.com>
f2fs: don't allow unaligned truncation to smaller/equal size on pinned file
wangzijie <wangzijie1@honor.com>
f2fs: convert F2FS_I_SB to sbi in f2fs_setattr()
Wenjie Qi <qwjhust@gmail.com>
f2fs: validate MOVE_RANGE destination size
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[]
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Clamp max_npiv_vports to VP_CTRL bitmap capacity
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Skip vport under deletion in report ID acquisition
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Fix 64G link speed reporting in get_data_rate
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Use ring-slot helpers in __qla2x00_alloc_iocbs
Jackson Lee <jackson.lee@chipsnmedia.com>
media: chips-media: wave5: Add timeout while stop_streaming
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak
Yosry Ahmed <yosry@kernel.org>
KVM: x86: Disallow EFER.LME and EFER.LMA if long mode is not supported
Christian Borntraeger <borntraeger@linux.ibm.com>
KVM: s390: Zero initialize data structures for inject_pfault_token
Narasimharao Vadlamudi <ahmisaranrao@gmail.com>
media: rkvdec: Propagate platform_get_irq() errors
Dave Stevenson <dave.stevenson@raspberrypi.com>
media: imx355: Avoid calling imx355_power_off twice in error path
Laurent Pinchart <laurent.pinchart@ideasonboard.com>
media: i2c: imx355: Replace client->dev usage
Yosry Ahmed <yosry@kernel.org>
KVM: x86: Check EFER validity on KVM_SET_SREGS*
Sean Christopherson <seanjc@google.com>
KVM: x86: Move the bulk of register specific code from x86.c to regs.c
Sean Christopherson <seanjc@google.com>
KVM: x86: Rename __{g,s}et_sregs2() => kvm_vcpu_ioctl_x86_{g,s}et_sregs2()
Sean Christopherson <seanjc@google.com>
KVM: x86: Extract REGS and SREGS runtime sync code to helpers
Sean Christopherson <seanjc@google.com>
KVM: x86/mmu: Split kvm_mmu_zap_all_fast() into "front" and "back" halves
Sean Christopherson <seanjc@google.com>
KVM: x86/mmu: Dynamically allocate shadow MMU's hashed page list
Lorenzo Stoakes (ARM) <ljs@kernel.org>
mm/mremap: reset unfaulted VMA page offset for MREMAP_DONTUNMAP
Jon Hunter <jonathanh@nvidia.com>
ASoC: tegra: Fix the MIXER enable default value
Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
ASoC: tegra210_mixer: sort the register default table
Imran Shaik <imran.shaik@oss.qualcomm.com>
clk: qcom: Fix test_ctl_hi field for DEFAULT_EVO PLLs
Miquel Raynal (DAVE) <miquel.raynal@bootlin.com>
mtd: rawnand: pl353: Make sure we use the monolithic helpers for raw accesses
Andrea Scian <andrea.scian@dave.eu>
mtd: rawnand: pl353: Add message about ECC mode
Li Chen <me@linux.beauty>
nvdimm: virtio_pmem: refcount requests for token lifetime
Li Chen <me@linux.beauty>
nvdimm: virtio_pmem: use READ_ONCE()/WRITE_ONCE() for wait flags
Li Chen <me@linux.beauty>
nvdimm: virtio_pmem: always wake -ENOSPC waiters
Li Chen <me@linux.beauty>
nvdimm: virtio_pmem: stop allocating child flush bio
Li Chen <me@linux.beauty>
nvdimm: pmem: keep PREFLUSH before data writes
Li Chen <me@linux.beauty>
nvdimm: preserve flush callback -ENOMEM
Baolin Wang <baolin.wang@linux.alibaba.com>
mm: fix incorrect vm_flags usage when checking allowable orders for tmpfs
Anthony Krowiak <akrowiak@linux.ibm.com>
s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects
Chao Shi <coshi036@gmail.com>
nvme: skip the zoned limits update if the zone info query failed
Christoph Hellwig <hch@lst.de>
nvme: fix atomic write size validation
Christoph Hellwig <hch@lst.de>
nvme: refactor the atomic write unit detection
Alan Adamson <alan.adamson@oracle.com>
nvme: all namespaces in a subsystem must adhere to a common atomic write size
Tristan Madani <tristan@talencesecurity.com>
nvme: add missing SRCU grace period in error path
Vincent Donnefort <vdonnefort@google.com>
ring-buffer: Allow splice reads on static buffers
Steven Rostedt <rostedt@goodmis.org>
ring-buffer: Show persistent buffer dropped events in trace_pipe file
Dapeng Mi <dapeng1.mi@linux.intel.com>
perf/x86/intel: Remove anythread_deprecated bit from perf_capabilities
Yabin Cui <yabinc@google.com>
perf/aux: Allocate non-contiguous AUX pages by default
Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
rtc: rzn1: Handle unset alarm weekday in rzn1_rtc_read_alarm
Sebastian Andrzej Siewior <bigeasy@linutronix.de>
futex: Provide rt_mutex_.*_schedule() equivalents for futex scheduling
Marco Elver <elver@google.com>
compiler_types: Move lock checking attributes to compiler-context-analysis.h
Baineng Shou <shoubaineng@gmail.com>
dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds
Steven Rostedt <rostedt@goodmis.org>
ftrace: Take trace_array reference before accessing its ftrace_ops
Steven Rostedt <rostedt@goodmis.org>
tracing: Take trace_array reference when opening options file
Steven Rostedt <rostedt@goodmis.org>
tracing: Clean up use of trace_create_maxlat_file()
Lorenzo Stoakes (ARM) <ljs@kernel.org>
mm/secretmem: properly account locked pages
Masami Hiramatsu (Google) <mhiramat@kernel.org>
tracing/probes: Fix BTF kflag check for anonymous struct member access
Steven Rostedt <rostedt@goodmis.org>
Documentation: tracing: Add documentation about eprobes
Masami Hiramatsu (Google) <mhiramat@kernel.org>
tracing/probes: Fix anon_stack check for unnamed bitfields in btf_find_struct_member
Muhammad Bilal <meatuni001@gmail.com>
staging: sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit()
Muhammad Bilal <meatuni001@gmail.com>
staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()
Vivek BalachandharTN <vivek.balachandhar@gmail.com>
staging: rtl8723bs: fix spacing around operators
Jeffin Philip <jeffinphilip14@gmail.com>
usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()
Myeonghun Pak <mhun512@gmail.com>
usb: storage: realtek_cr: fix use-after-free on disconnect
Pawel Laszczak <pawell@cadence.com>
usb: cdnsp: fix wakeup from S3 after controller context loss
Théo Lebrun <theo.lebrun@bootlin.com>
usb: cdns3: rename hibernated argument of role->resume() to lost_power
Mathias Nyman <mathias.nyman@linux.intel.com>
xhci: Cleanup Candence controller PCI device and vendor ID usage
Bryam Vargas <hexlabsecurity@proton.me>
wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy
Amit Sunil Dhamne <amitsd@google.com>
usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling
Xu Yang <xu.yang_2@nxp.com>
usb: typec: tcpm: fix debug accessory mode detection for sink ports
Yuhang.chen <yhchen312@gmail.com>
wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot
Bitterblue Smith <rtl8821cerfe2@gmail.com>
wifi: rtw89: Hide some errors when the device is unplugged
Zong-Zhe Yang <kevin_yang@realtek.com>
wifi: rtw89: cleanup unused rtwdev::roc_work
Elson Serrao <elson.serrao@oss.qualcomm.com>
usb: dwc3: clear forceRM when issuing EndTransfer
Thinh Nguyen <Thinh.Nguyen@synopsys.com>
usb: dwc3: gadget: Reinitiate stream for all host NoStream behavior
Jan Kara <jack@suse.cz>
udf: Fix data loss when converting inline inodes to out of line
Jan Kara <jack@suse.cz>
udf: Move udf_map_block() up
Adrian Hunter <adrian.hunter@intel.com>
i3c: master: Fix use-after-free of master->this
Bryam Vargas <hexlabsecurity@proton.me>
wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy
StanleyYP Wang <StanleyYP.Wang@mediatek.com>
wifi: mt76: mt7915: set correct background radar capability
Adrian Hunter <adrian.hunter@intel.com>
i3c: master: Do not treat master device as a duplicate target
Can Peng <pengcan@kylinos.cn>
hwrng: stm32 - Fix runtime PM cleanup on registration failure
Uwe Kleine-König <u.kleine-koenig@baylibre.com>
hwrng: drivers - Switch back to struct platform_driver::remove()
Xu Rao <raoxu@uniontech.com>
ALSA: hda/ext: preserve PPLCCTL bits when clearing reset
Glenn Judd <gmj@meta.com>
net/mlx5e: do not HW-GRO coalesce small frames
Dragos Tatulea <dtatulea@nvidia.com>
net/mlx5e: SHAMPO, Always calculate page size
Hidayath Khan <hidayath@linux.ibm.com>
net/smc: stop killed, freed and out_of_sync sharing a byte
Simon Horman <horms@kernel.org>
net/smc: Address spelling errors
Fan Wu <fanwu01@zju.edu.cn>
power: supply: qcom_battmgr: fix use-after-free
Hui Su <sh_def@163.com>
io_uring/waitid: avoid siginfo copy during ring teardown
Jens Axboe <axboe@kernel.dk>
io_uring/waitid: have io_waitid_complete() remove wait queue entry
Mario Limonciello <mario.limonciello@amd.com>
platform/x86/amd/pmc: Propagate SMU errors and validate S2D address
Mario Limonciello <mario.limonciello@amd.com>
platform/x86/amd/pmc: Restore msg_port on amd_stb_s2d_init() error paths
Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
platform/x86/amd/pmc: Define enum for S2D/PMC msg_port and add helper function
Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
platform/x86/amd/pmc: Move STB functionality to a new file for better code organization
Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
platform/x86/amd/pmc: Move STB block into amd_pmc_s2d_init()
Abdun Nihaal <nihaal@cse.iitm.ac.in>
platform/x86: int1092: Fix potential memory leak in sar_probe()
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
platform/x86: intel_sar: Check ACPI_HANDLE() against NULL
Thorsten Blum <thorsten.blum@linux.dev>
platform/x86: think-lmi: Fix certificate thumbprint sysfs output
Mark Pearson <mpearson-lenovo@squebb.ca>
platform/x86: think-lmi: improve check if BIOS account security enabled
Thorsten Blum <thorsten.blum@linux.dev>
platform/x86: think-lmi: Fix current password length check
Farhan Ali <alifm@linux.ibm.com>
PCI: Allow per function PCI slots to fix slot reset on s390
Farhan Ali <alifm@linux.ibm.com>
PCI: Introduce PCI_SLOT_PLACEHOLDER constant for slot_nr placeholder value
Fan Wu <fanwu01@zju.edu.cn>
mmc: via-sdmmc: cancel card-detect work on remove
Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
platform/x86: ISST: Validate max level for set feature
Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
platform/x86: ISST: Check for admin capability for write commands
Peiyang He <peiyang_he@smail.nju.edu.cn>
iommufd: Fix UAF in selftest IOPF reporting
Yi Liu <yi.l.liu@intel.com>
iommufd: Pass @pasid through the device attach/replace path
Weimin Xiong <xiongwm2026@163.com>
iommu/msm: Unwind probe state on registration failure
Zhang Heng <zhangheng@kylinos.cn>
iommu/msm: Use helper function devm_clk_get_prepared()
Ali Tariq <alitariq45892@gmail.com>
PCI: starfive: Fix resource leaks on error paths in host_init()
Hal Feng <hal.feng@starfivetech.com>
PCI: starfive: Use regulator APIs to control the 3v3 power supply of PCIe slots
Fan Wu <fanwu01@zju.edu.cn>
power: supply: ab8500_fg: fix use-after-free on remove
Pan Chuang <panchuang@vivo.com>
power: supply: ab8500_fg: Remove redundant dev_err()/dev_err_probe()
Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
remoteproc: qcom: pas: Guard dtb metadata release with dtb_pas_id check
Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
remoteproc: pas: Replace metadata context with PAS context structure
Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
firmware: qcom_scm: Rename peripheral as pas_id
Oscar Ou <oscarou@synology.com>
lockd: fix swapped arguments in nlmsvc_match_ip()
Ruoyu Wang <ruoyuw560@gmail.com>
i2c: mxs: fix DMA channel leak on probe error
Bence Csókás <csokas.bence@prolan.hu>
dmaengine: Add devm_dma_request_chan()
Vincent Donnefort <vdonnefort@google.com>
ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page
Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>
ASoC: codecs: aw88261: only check PLL and clock state at power-up
Val Packett <val@packett.cool>
ASoC: codecs: aw88261: reduce log spam
Tejun Heo <tj@kernel.org>
sched/core: Make core-sched flips wait for in-flight selections
John Stultz <jstultz@google.com>
sched: Rework prev_balance() to avoid stale prev references
Vincent Donnefort <vdonnefort@google.com>
ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()
Steven Rostedt <rostedt@goodmis.org>
ring-buffer: Add helper functions for allocations
James Clark <james.clark@linaro.org>
perf test: Change all remaining #!/bin/sh to #!/bin/bash
Jakub Kicinski <kuba@kernel.org>
net: tls: fix silent data drop under pipe back-pressure
Darrick J. Wong <djwong@kernel.org>
xfs: fix blockgc group quota scanning when usrquota isn't enforced
Darrick J. Wong <djwong@kernel.org>
xfs: drop dquot flush lock when we can't find a buffer to flush
Darrick J. Wong <djwong@kernel.org>
xfs: check di_forkoff correctly in scrub
Darrick J. Wong <djwong@kernel.org>
xfs: don't call xfs_exchange_range_finish for a dry run
Darrick J. Wong <djwong@kernel.org>
xfs: check padding field in xfs_ioc_commit_range
Darrick J. Wong <djwong@kernel.org>
xfs: use correct jiffies comparison function in xchk_maybe_relax
Darrick J. Wong <djwong@kernel.org>
xfs: release orphanage dir inode if chown fails
Darrick J. Wong <djwong@kernel.org>
xfs: fix attr fork block count checks in xrep_inode_blockcounts
Darrick J. Wong <djwong@kernel.org>
xfs: don't assert when XFS_SCRUB_TYPE_HEALTHY scans return corruption
Zihan Xi <zihanx@nebusec.ai>
smb: client: validate POSIX create context length
Zihan Xi <zihanx@nebusec.ai>
smb: client: clean up failed cached directory opens
Zihan Xi <zihanx@nebusec.ai>
smb: client: fix create context out-of-bounds reads
Hui Peng <benquike@gmail.com>
Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Bluetooth: mgmt: fix race in read_unconf_index_list()
Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Bluetooth: L2CAP: validate frame length before control and FCS access
Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Bluetooth: ISO: balance the parent hold in hci_bind_bis()
Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Bluetooth: hci_sock: reject out-of-range OCF values
Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Bluetooth: hci_sock: validate event length before filtering
Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Bluetooth: hci_conn: fix CIS hold ownership on reuse
Tan Chi <tanchi25@mails.ucas.ac.cn>
RISC-V: KVM: Fix HSM hart status error propagation
Myeonghun Pak <mhun512@gmail.com>
RISC-V: KVM: Synchronize hrtimer callback during teardown
Lorenzo Stoakes (ARM) <ljs@kernel.org>
KVM: arm64: Fix spurious warning for benign stage 2 teardown race
Zeng Chi <zengchi@kylinos.cn>
KVM: Don't treat reserved xarray entries as having memory attributes
David Ballesteros <davimaba.v@proton.me>
KVM: Ensure memory attributes xarray nodes are accounted to the caller's memcg
Anthony Krowiak <akrowiak@linux.ibm.com>
s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config
Peter Oberparleiter <oberpar@linux.ibm.com>
s390/cmf: Fix virtual vs physical address confusion
Vineeth Vijayan <vneethv@linux.ibm.com>
s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()
Ilya Titov <ilya.titov@wirenboard.com>
pinctrl: sunxi: keep a shadow copy of the data register output latches
Myeonghun Pak <mhun512@gmail.com>
pinctrl: single: free the IRQ on domain creation failure
Puranjay Mohan <puranjay@kernel.org>
perf/core: Run sched_task() for PMUs with only CPU-wide events
Puranjay Mohan <puranjay@kernel.org>
perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()
Yehyeong Lee <yhlee@isslab.korea.ac.kr>
scsi: libiscsi_tcp: Check the data direction of a Data-In PDU
Doruk Tan Ozturk <doruk@0sec.ai>
nfc: port100: reject frames whose declared length exceeds the received data
Aamir Ahmed <elb12345@hotmail.co.uk>
nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()
Luxiao Xu <rakukuip@gmail.com>
nfc: fix use-after-free in nfc_get_local_general_bytes
Aohan Mei <henrymei@tencent.com>
netfilter: nf_tables: skip expired catchall elements on insert and delete
Luxiao Xu <rakukuip@gmail.com>
netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read
Weiming Shi <bestswngs@gmail.com>
netfilter: ip6t_rpfilter: reject routes without inet6_dev
Wentao Liang <vulab@iscas.ac.cn>
net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs()
Ming Wang <wangming01@loongson.cn>
net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist
Fourie Zhang <littleddfu@gmail.com>
net: bridge: mdb: restart port group walk after deletion
Gajdos Tamás <tamas@rimpianto.com>
net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read
Gajdos Tamás <tamas@rimpianto.com>
net: atl1c: fix soft lockup on out-of-range tpd_cons read
Ilya Maximets <i.maximets@ovn.org>
net: openvswitch: conntrack: fix helper UAF due to extensions realloc
Ilya Maximets <i.maximets@ovn.org>
net: openvswitch: conntrack: remove 'add_helper' dead code
Ilya Maximets <i.maximets@ovn.org>
net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry
Wentao Liang <vulab@iscas.ac.cn>
net: hisilicon: hns_dsaf_mac: fix mdio device leak in hns_mac_register_phy()
Gajdos Tamás <tamas@rimpianto.com>
net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read
Zijie Huang <milkory@outlook.com>
net: arp: terminate device name before lookup
Weiming Shi <bestswngs@gmail.com>
net/sched: reject IDR error pointers when deleting actions
Ralf Lici <ralf@mandelbit.com>
net/mlx5e: advertise MACsec offload only when supported
Wentao Liang <vulab@iscas.ac.cn>
net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()
Wei Jie LAW <98lawweijie@gmail.com>
HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()
Junjie Cao <junjie.cao@intel.com>
HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard
Chen Changcheng <chenchangcheng@kylinos.cn>
HID: alps: fix use-after-free on input2 registration failure
Angel J <iamanaws@httpd.dev>
PCI: of_property: Omit bus properties without a subordinate bus
Jaewook You <jaewook376@gmail.com>
mm/hugetlb: preserve mremap address delta when skipping page tables
Karl Mehltretter <kmehltretter@gmail.com>
gpio: tps65219: Fix GPIO input value reads
Peiyang He <peiyang_he@smail.nju.edu.cn>
drm/virtio: fix NULL pointer dereference on fence allocation failure
Peiyang He <peiyang_he@smail.nju.edu.cn>
drm/virtio: fix memory leak of fence event on execbuffer failure
Szymon Acedański <accek@invisiblethingslab.com>
drm/xe: Limit sg segment size to PAGE_SIZE on Xen PV
Peiyang He <peiyang_he@smail.nju.edu.cn>
drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked()
Jonghyuk Kim(MalHyuk) <malhyuk97@gmail.com>
drm/nouveau: RCU-free the scheduler-containing nouveau_sched
Wentao Liang <vulab@iscas.ac.cn>
drm/nouveau: Fix runtime PM leak in nouveau_connector_detect()
Wentao Liang <vulab@iscas.ac.cn>
drm/nouveau: Fix gem reference leak in validate_init()
Peiyang He <peiyang_he@smail.nju.edu.cn>
drm/nouveau: fix double-free in nvif_vmm_dtor
Wentao Liang <vulab@iscas.ac.cn>
drm/nouveau: Fix bridge reference leak in nv1a_ram_new()
Guangshuo Li <lgs201920130244@gmail.com>
drm/nouveau: fix autosuspend cleanup during teardown
Peiyang He <peiyang_he@smail.nju.edu.cn>
drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM
Wentao Liang <vulab@iscas.ac.cn>
drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init()
Wentao Liang <vulab@iscas.ac.cn>
drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()
Wentao Liang <vulab@iscas.ac.cn>
drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init()
Ivan Lipski <ivan.lipski@amd.com>
drm/amd/display: Bump frame warning limit for clang builds of dml
Wentao Liang <vulab@iscas.ac.cn>
drm/amd/display: Fix dc stream excess put in dm_update_crtc_state()
Christian König <ckoenig.leichtzumerken@gmail.com>
drm/i915: fix incorrect RCU teardown order
Brajesh Gupta <brajesh.gupta@imgtec.com>
drm/imagination: Fix page count for page table for map() interface
Brajesh Gupta <brajesh.gupta@imgtec.com>
drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl()
Dongliang Qin <cccccccccccc777777@gmail.com>
rds: ib: Clear the sg list when mapping an MR fails
Hui Peng <benquike@gmail.com>
mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()
Zixuan Chai <petalzu987@gmail.com>
llc: reserve device headroom for allocated frames
Ridham Khurana <khurana.ridham222@gmail.com>
gpio: zynq: fix runtime PM leak on request error path
Wentao Liang <vulab@iscas.ac.cn>
gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out()
Hui Peng <benquike@gmail.com>
ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST
Norbert Szetei <norbert@doyensec.com>
ipv6: do not let ipv6_find_hdr() return an offset past the packet end
Fan Wu <wufan@kernel.org>
ipe: protect the dm-verity root hash with RCU
Wentao Liang <vulab@iscas.ac.cn>
fsl/fman: Fix clk reference leak in read_dts_node()
Josef Bacik <josef@toxicpanda.com>
writeback: report a Tasks-RCU quiescent state per cgwb drain pass
Pavankumar Kondeti <pavan.kondeti@oss.qualcomm.com>
workqueue: Fix NULL current_pwq deref in flush dependency check
Patrick Lu (Anthropic) <perf.patrick.lu@gmail.com>
writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes
Christian Brauner <brauner@kernel.org>
fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga
Hui Peng <benquike@gmail.com>
fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT
Guopeng Zhang <zhangguopeng@kylinos.cn>
cgroup/pids: Restore pids.events notifications in local mode
Matthias Goergens <matthias.goergens@gmail.com>
ata: libata-scsi: bound the ATA passthru sense descriptor writes
Dairui Zhang <zhangdairui@gmail.com>
af_packet: fix integer overflow in prb_calc_retire_blk_tmo()
Aohan Mei <henrymei@tencent.com>
sctp: discard the rest of the packet on a stale-cookie error
Willem de Bruijn <willemb@google.com>
tcp: prevent collapsing skbs across boundary in rtx queue
Eric Dumazet <edumazet@google.com>
tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow
Willem de Bruijn <willemb@google.com>
virtio_net: copy zerocopy frags in start_xmit without NAPI
Mario Limonciello <mario.limonciello@amd.com>
x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11
Masami Hiramatsu (Google) <mhiramat@kernel.org>
x86/mce: Fix hardware debug register corruption on task migration
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase
Pablo Neira Ayuso <pablo@netfilter.org>
rculist: add list_splice_rcu() for private lists
Mark Amirkan <markdamirkan@gmail.com>
mptcp: return sk_wait_data() errors from recvmsg()
Sean Christopherson <seanjc@google.com>
perf/x86/intel: Make @data a mandatory param for intel_guest_get_msrs()
Sean Christopherson <seanjc@google.com>
perf/x86/intel: Don't pointlessly context switch DS_AREA (and PEBS config) if PEBS is unused
Sean Christopherson <seanjc@google.com>
perf/x86/intel: Don't write PEBS_ENABLED on host<=>guest xfers if CPU has PEBS isolation, to fix stuck PEBS_ENABLED
Sean Christopherson <seanjc@google.com>
perf/x86/intel: Ensure KVM guest PEBS path doesn't set unwanted PERF_GLOBAL_CTRL bits
Hui Peng <benquike@gmail.com>
autofs: fix sbi->pipe file reference leak in autofs_kill_sb()
Eric Dumazet <edumazet@google.com>
vlan: ensure sufficient headroom in vlan_dev_hard_header()
Eric Dumazet <edumazet@google.com>
net/sched: sch_teql: fix shadowed err in __teql_resolve()
Eric Dumazet <edumazet@google.com>
bridge: check llc_mac_hdr_init() return value in br_send_bpdu()
Eric Dumazet <edumazet@google.com>
llc: fix skb UAF and leaks on llc_mac_hdr_init() failure
Coia Prant <coiaprant@gmail.com>
net: ethernet: stmmac: dwmac-rk: fix bulk clock leak when the PHY clock fails
Ginger Li <ginger.jzllee@gmail.com>
tipc: Fix a data race on mon->peer_cnt in mon_timeout()
Sidraya Jayagond <sidraya@linux.ibm.com>
net/smc: fix UAF on lgr list traversal in smcr_port_err()
Sang-Hoon Choi <csh0052@gmail.com>
nfp: hold IPsec RX state under the XArray lock
Yilin Zhang <yilinzhang@moonshot.ai>
tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()
Aleksei Sviridkin <f@lex.la>
net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621
Haseeb Malik <haseebulhaq55@gmail.com>
macsec: initialize SecY before registering the netdevice
Sabrina Dubroca <sd@queasysnail.net>
macsec: inherit lower device's TSO limits when offloading
Sabrina Dubroca <sd@queasysnail.net>
macsec: add some of the lower device's features when offloading
David Dai <zdai@linux.ibm.com>
bonding: crypto offload enabled, non-offload slave failover, rekey failed
Pengpeng Hou <hppiscas@163.com>
drm/imagination: clamp freelist reconstruction requests
Norbert Szetei <norbert@doyensec.com>
net: xps: reject an out of range traffic class
Sanghyun Park <sanghyun.park.cnu@gmail.com>
vxlan: use one headroom snapshot for neighbour replies
Xuanqiang Luo <luoxuanqiang@kylinos.cn>
ip_gre: Reject enabling collect metadata through changelink
Florian Fainelli <florian.fainelli@broadcom.com>
net: bcmgenet: mask DMA_TIMEOUT_MASK when reading DMA_RING0_TIMEOUT
Florian Fainelli <florian.fainelli@broadcom.com>
net: bcmgenet: validate Ethernet address in bcmgenet_set_mac_addr
Florian Fainelli <florian.fainelli@broadcom.com>
net: bcmgenet: do not skip WoL power up on GENET V1
Doug Berger <opendmb@gmail.com>
net: bcmgenet: allow return of power up status
Doug Berger <opendmb@gmail.com>
net: bcmgenet: move bcmgenet_power_up into resume_noirq
Florian Fainelli <florian.fainelli@broadcom.com>
net: bcmgenet: initialize u64 stats seq counter for all queues
Florian Fainelli <florian.fainelli@broadcom.com>
net: bcmgenet: fix 64-bit RTNL stats reading in ethtool on 32-bit systems
Ivan Delalande <colona@arista.com>
tg3: use random MAC address when tg3_get_device_address fails
Dragan Simic <dsimic@manjaro.org>
driver core: Add device probe log helper dev_warn_probe()
Johan Almbladh <johan.almbladh@anyfinetworks.com>
bpf: Fix BSWAP 32 and 16 on MIPS64
Johan Almbladh <johan.almbladh@anyfinetworks.com>
bpf: Fix immediate JMP JEQ/JNE on MIPS32
Ido Schimmel <idosch@nvidia.com>
vrf: Stop corrupting skb->csum when capturing CHECKSUM_COMPLETE packets
Shihuang Liu <shlomojune6@gmail.com>
net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()
Jakub Kicinski <kuba@kernel.org>
veth: manage XDP program pointers during channel resize
Victor Nogueira <victor@mojatatu.com>
net/sched: act_gate: budget the per-entry list in get_fill_size
Deepanshu Kartikey <kartikey406@gmail.com>
nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()
Ömer Mete Kaya <omermetekaya0@gmail.com>
nfc: llcp: fix slab-out-of-bounds reads when logging service names
Ömer Mete Kaya <omermetekaya0@gmail.com>
nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()
Ömer Mete Kaya <omermetekaya0@gmail.com>
nfc: llcp: fix -ENOMEM on connect with zero-length service name
Pengpeng Hou <pengpeng@iscas.ac.cn>
nfc: st21nfca: validate ISO15693 inventory length
Cong Nguyen <congnt264@gmail.com>
nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure
Chris Gellermann <christian.gellermann@codasip.com>
nfc: virtual_ncidev: Add missing ioctl compat handler
Chris Gellermann <christian.gellermann@codasip.com>
selftests/nci: Fix out-of-bounds store on thread join
Chaithanya Lagisetty <nagachaithanya9911@gmail.com>
selftests: nci: Fix uninitialized family ID on missing attribute
Lee Jones <lee@kernel.org>
nfc: llcp: Fix race condition in accept_queue lifecycle
Lei Zhu <zhulei@kylinos.cn>
selftests: nci: Correct pthread_create return value check
Aldo Ariel Panzardo <qwe.aldo@gmail.com>
nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()
Pengpeng Hou <pengpeng@iscas.ac.cn>
nfc: st21nfca: validate received frame size
Pengpeng Hou <pengpeng@iscas.ac.cn>
nfc: nfcmrvl: validate helper command length before pull
Weiming Shi <bestswngs@gmail.com>
bpf: Reject dev-bound-only programs on other devices
Maxime Chevallier <maxime.chevallier@bootlin.com>
net: stmmac: dwmac4: Use the correct bufzise when the len is exactly 8K
Maxime Chevallier <maxime.chevallier@bootlin.com>
net: stmmac: selftests: Capture all packets for vlan checks
Maxime Chevallier <maxime.chevallier@bootlin.com>
net: stmmac: selftests: Check the dev->features for S-TAG offload testing
Maxime Chevallier <maxime.chevallier@bootlin.com>
net: stmmac: selftests: Support running selftests on DSA conduits
Xin Long <lucien.xin@gmail.com>
sctp: hold asoc or transport before mod_timer() in timer handlers
Bernardo Soares <bsoares.it@gmail.com>
net/mlx5: Bridge, don't fail unlink of untracked/unsupported peer ports
Bernardo Soares <bsoares.it@gmail.com>
net/mlx5: Bridge, don't fail switchdev events of sibling eswitch ports
Zhao Gongyi <zhaogongyi@BYTEDANCE.COM>
bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc
Emil Tsalapatis <emil@etsalapatis.com>
bpf: Fix bpf_sock context code generation
Emil Tsalapatis <emil@etsalapatis.com>
bpf: Fix bounds check for skb-backed dynptrs
Manaf Meethalavalappu Pallikunhi <manaf.pallikunhi@oss.qualcomm.com>
thermal: gov_step_wise: Fix stale mitigation vote with non-zero lower bounds
Coia Prant <coiaprant@gmail.com>
net: pcs: xpcs: fix clock reference leak on xpcs_init_clks failure
Jakub Kicinski <kuba@kernel.org>
genetlink: report the real command id for dump-only ops in policy dumps
bui duc phuc <phucduc.bui@gmail.com>
net: ethernet: ti: netcp: fix pm_runtime usage counter leak on error
Mikhail Zaslonko <zaslonko@linux.ibm.com>
s390/debug: Fix NULL pointer dereference in debug_info_copy()
Mikhail Zaslonko <zaslonko@linux.ibm.com>
s390/debug: Do not register views for failed static debug areas
Nemesa Garg <nemesa.garg@intel.com>
drm/i915/psr: Clear stale sel fetch enable bits on sel fetch disable
Jouni Högander <jouni.hogander@intel.com>
drm/i915/psr: Add new SU area calculation helper to apply workarounds
Myeonghun Pak <mhun512@gmail.com>
tg3: clean up PHYLIB resources on probe failure
Kuniyuki Iwashima <kuniyu@google.com>
ipv6: Fix dst leak for uncached routes.
Pengpeng Hou <hppiscas@163.com>
net: usb: sr9700: include receive overhead in the length check
Ivan Vecera <ivecera@redhat.com>
dpll: use exact lookup for reference sync pin id
Ratheesh Kannoth <rkannoth@marvell.com>
octeontx2-af: Fix memory scaling limitation in SR-IOV mode
Hui Peng <benquike@gmail.com>
Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()
Ravindra <ravindra@intel.com>
Bluetooth: btintel_pcie: validate device-supplied DMA indices
Hui Peng <benquike@gmail.com>
Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough
Li Youhong <liyouhong@kylinos.cn>
drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach
Junrui Luo <moonafterrain@outlook.com>
drm/virtio: release the GEM object on virtio_gpu_vram_create() errors
Junrui Luo <moonafterrain@outlook.com>
drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()
Junrui Luo <moonafterrain@outlook.com>
drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()
Junrui Luo <moonafterrain@outlook.com>
drm/virtio: fix object leak when drm_gem_handle_create() fails
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget
Yuqi Xu <xuyuqiabc@gmail.com>
bpf: Check params size before reading reserved fields
Aamir Ahmed <elb12345@hotmail.co.uk>
net: usb: catc: bound the RX packet length in catc_rx_done()
Kumar Kartikeya Dwivedi <memxor@gmail.com>
bpf: Bound ownership depth through local kptrs and graph roots
Yiqi Sun <sunyiqixm@gmail.com>
sctp: avoid livelock while updating retransmit path
Alexander Duyck <alexanderduyck@fb.com>
eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox
Björn Töpel <bjorn@kernel.org>
eth: fbnic: Handle maximum standalone channels
Kuniyuki Iwashima <kuniyu@google.com>
ip6_gre: Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink().
Lorenzo Bianconi <lorenzo.bianconi@oss.qualcomm.com>
net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure
Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
net: gue: reject invalid REMCSUM offsets
Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure
Giuseppe Ranieri <giuseppe@ranieri.dev>
drm/nouveau/disp: don't reject HDMI config on cards without SCDC
Francesco Magazzu <postadelmaga@gmail.com>
drm/nouveau/clk: don't clobber reclock status when restoring volt/fan
Dan Carpenter <error27@gmail.com>
drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update
Joseph Qi <joseph.qi@linux.alibaba.com>
ocfs2: make ocfs2_calc_xattr_init() return void
Zeng Heng <zengheng4@huawei.com>
arm64: io: Reject non-user protection in ioremap_prot()
Naman Gulati <namangulati@google.com>
netfilter: ctnetlink: fix suspicious RCU usage in expect_iter_name
Julian Anastasov <ja@ssi.bg>
ipvs: revalidate ihl before icmp_send
Karl Mehltretter <kmehltretter@gmail.com>
netfilter: nft_synproxy: use the family-aware checksum helper
Florian Westphal <fw@strlen.de>
netfilter: nfnetlink_queue: hold nfnl mutex in event notifier
Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
netfilter: flowtable: publish HW_DEAD after worker is done
Kumar Kartikeya Dwivedi <memxor@gmail.com>
libbpf: Reject truncated ldimm64 CO-RE relocations
Kumar Kartikeya Dwivedi <memxor@gmail.com>
bpf: Restrict CO-RE poisoning to relocatable instructions
Shay Drory <shayd@nvidia.com>
net/mlx5: devcom, Base component size on linked devices
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: cls_u32: fix manual hash table handle IDR aliasing
Weiming Shi <bestswngs@gmail.com>
bpf: Skip unsettled links in link iterator
Zhiling Zou <zhilinz@nebusec.ai>
xsk: Use a 32-bit compare in xsk_map_gen_lookup
Julian Sun <sunjunchao@bytedance.com>
fs: avoid repeated scans in evict_inodes()
Vineeth Vijayan <vneethv@linux.ibm.com>
s390/cio: Guard PMCW field accesses with dnv check
Vineeth Vijayan <vneethv@linux.ibm.com>
s390/cio: Check pmcw.dnv before pmcw.ena in I/O entry points
Vineeth Vijayan <vneethv@linux.ibm.com>
s390/cio: Fix cio_update_schib() to not cache invalid schib
Karl Mehltretter <kmehltretter@gmail.com>
s390/pci/docs: Fix sriov_numvfs attribute name
Niklas Schnelle <schnelle@linux.ibm.com>
docs: s390/pci: Improve and update PCI documentation
Bart Van Assche <bvanassche@acm.org>
scsi: megaraid_sas: Protect megasas_get_ctrl_info() in megasas_resume()
Eva Kurchatova <eva.kurchatova@virtuozzo.com>
selftests: cgroup: give the O_TMPFILE open in get_temp_fd() a mode
Sean Christopherson <seanjc@google.com>
cgroup: selftests: Move memcontrol specific helpers out of common cgroup_util.c
Lee Jones <lee@kernel.org>
Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel
Christiano Amora <christiano.amora@gmail.com>
Bluetooth: SMP: reject Security Request over BR/EDR
ZHOU Jiaxiang <me@fxti.xyz>
scsi: sd_zbc: Reject disks with too many zones
Ran Hongyun <ranhongyun1@huawei.com>
squashfs: Add dictionary size range check to prevent shift-out-of-bounds
Mark Brown <broonie@kernel.org>
KVM: arm64: Fix FGT mapping for HFGITR_EL2.nGCSEPP
Karl Mehltretter <kmehltretter@gmail.com>
KVM: arm64: Return -EINVAL for an empty SMCCC filter range at base 0
Fuad Tabba <fuad.tabba@linux.dev>
KVM: arm64: vgic-its: Skip unreachable devices instead of failing the save
Marc Zyngier <maz@kernel.org>
KVM: arm64: vgic-its: Add stronger type-checking to the ITS entry sizes
Fuad Tabba <fuad.tabba@linux.dev>
KVM: arm64: vgic-its: Free the caches when GITS_BASER changes
SeungJu Cheon <suunj1331@gmail.com>
RISC-V: KVM: Fix perf-backed counter accounting across stop and read
SeungJu Cheon <suunj1331@gmail.com>
RISC-V: KVM: Report snapshot write failure to the guest
SeungJu Cheon <suunj1331@gmail.com>
RISC-V: KVM: Preserve firmware counter value across stop/start
Benjamin Tissoires <bentiss@kernel.org>
HID: bpf: fix __hid_bpf_hw_check_params report length
Slawomir Stepien <sst@poczta.fm>
HID: amd_sfh: Validate PCI BAR size before mapping
Sean Anderson <sanderson@brivo.com>
pinctrl: meson: Fix typo in s4 group name
Donggeun Yoo <donggeunyoo.kernel@gmail.com>
bpf, arm64: set up the frame pointer for the exception callback
Geliang Tang <geliang@kernel.org>
bpf, sockmap: Fix self-redirect copied_seq double-counting
Pu Lehui <pulehui@huawei.com>
bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk
Kumar Kartikeya Dwivedi <memxor@gmail.com>
bpf: Register dtor for freeing special fields
Hou Tao <houtao1@huawei.com>
bpf: Factor out htab_elem_value helper()
Hou Tao <houtao1@huawei.com>
bpf: Bail out early in __htab_map_lookup_and_delete_elem()
Hou Tao <houtao1@huawei.com>
bpf: Remove migrate_{disable|enable} in ->map_for_each_callback
Jiayuan Chen <jiayuan.chen@linux.dev>
bpf: Fix out-of-bounds read of rtt_min in sock_ops
Jose Fernandez (Anthropic) <jose.fernandez@linux.dev>
bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch()
Jim Mattson <jmattson@google.com>
KVM: x86/pmu: Move Intel PMU global MSRs to intel_is_valid_msr()
Oscar Priego Verdugo <oscar.priegov@gmail.com>
HID: elecom: fix bus type for M-XGL20DLBK
Jiayuan Chen <jiayuan.chen@linux.dev>
tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context
Jiayuan Chen <jiayuan.chen@linux.dev>
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()
Jiayuan Chen <jiayuan.chen@linux.dev>
bpf: Fix divide-by-zero in btf_struct_walk()
Sven Schnelle <svens@linux.ibm.com>
selftests/ftrace: Fix unique symbol check in kprobe_non_uniq_symbol.tc
Weiming Shi <bestswngs@gmail.com>
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
Daniel Borkmann <daniel@iogearbox.net>
bpf: Fix bpf_skb_change_tail wrt csum partial skbs
Claudio Imbrenda <imbrenda@linux.ibm.com>
KVM: s390: Fix IRQ injection with SIGP Stop and Store Status
Mostafa Saleh <smostafa@google.com>
remoteproc: qcom_q6v5_adsp: Fix iommu_unmap() usage
Zhiling Zou <zhilinz@nebusec.ai>
xfrm: save input state data before secpath resets
Dong Chenchen <dongchenchen2@huawei.com>
xfrm: Fix dev use-after-free in xfrm async resumption
Jianbo Liu <jianbol@nvidia.com>
xfrm: Refactor xfrm_input lock to reduce contention with RSS
Phil Sutter <phil@nwl.cc>
netfilter: nf_tables: Simplify chain netdev notifier
Phil Sutter <phil@nwl.cc>
netfilter: nf_tables: Tolerate chains with no remaining hooks
Sean Rhodes <sean@starlabs.systems>
ALSA: hda/realtek: Add StarFighter HDA SSID
Sean Rhodes <sean@starlabs.systems>
ALSA: hda/realtek: Limit Star Labs internal mic boost
Wenwu Hou <hwenwur@gmail.com>
erofs: fix large folio race in erofs_fscache_req_complete
Darrick J. Wong <djwong@kernel.org>
xfs: don't stash removename operations with unknown ftype
Zizhi Wo <wozizhi@huawei.com>
smb: client: fix busy dentry warning on unmount after DIO
Itai Handler <itai.handler@gmail.com>
spi: spi-zynqmp-gqspi: stop the controller on shutdown
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: fix partial normalized name responses
Antheas Kapenekakis <lkml@antheas.dev>
HID: asus: fortify keyboard handshake
Frank Sorenson <sorenson@redhat.com>
smb: client: fix missing iov bounds check in parse_posix_sids()
Frank Sorenson <sorenson@redhat.com>
smb: client: fix missing lower-bound check on DFS referral string offsets
Frank Sorenson <sorenson@redhat.com>
smb: client: fix server->total_read for compound encrypted PDUs
Frank Sorenson <sorenson@redhat.com>
smb: client: fix potential OOB read in smb3_enum_snapshots()
Frank Sorenson <sorenson@redhat.com>
smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs
Paulo Alcantara <pc@manguebit.org>
smb: client: fix unaligned access in WSL reparse point parser
Paulo Alcantara <pc@manguebit.org>
smb: client: fix smbd_connection leak on cifs_get_tcp_session() error
Frank Sorenson <sorenson@redhat.com>
smb: client: reject short Next offsets in parse_server_interfaces()
Paulo Alcantara <pc@manguebit.org>
smb: client: fix rlist race and missing initialization
Paulo Alcantara <pc@manguebit.org>
smb: client: cancel reconnect work in clean_demultiplex_info()
Guangshuo Li <lgs201920130244@gmail.com>
drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure
Guangshuo Li <lgs201920130244@gmail.com>
drm/msm/adreno: fix autosuspend cleanup during teardown
Sajal Gupta <sajal2005gupta@gmail.com>
drm/gud: fix out-of-bounds write in gud_plane_atomic_check()
Rik van Riel <riel@surriel.com>
wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver
Zhao Li <enderaoelyther@gmail.com>
wifi: mwifiex: validate action frame fixed fields
Linmao Li <lilinmao@kylinos.cn>
wifi: mwifiex: prevent authentication frame length truncation
Pengpeng Hou <pengpeng@iscas.ac.cn>
wifi: mwifiex: validate scan response extents
Doruk Tan Ozturk <doruk@0sec.ai>
wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length
Shengzhuo Wei <me@cherr.cc>
wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST
Shengzhuo Wei <me@cherr.cc>
wifi: p54: validate curve data length in the calibration curve converters
Tianchu Chen <flynnnchen@tencent.com>
wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()
Ali Ahmet Memis <ali@iusegentoo.com>
wifi: wilc1000: fix out-of-bounds read in P2P public action frames
Runyu Xiao <runyu.xiao@seu.edu.cn>
wifi: wlcore: release runtime PM ref on regdomain config failure
Tianchu Chen <flynnnchen@tencent.com>
wifi: rsi: fix heap OOB write on key removal
Jiangshan Yi <yijiangshan@kylinos.cn>
wifi: libertas_tf: fix UAF in lbtf_free_adapter()
Stanislaw Gruszka <stf_xl@wp.pl>
wifi: iwlegacy: fix broadcast stations deallocation
Jiangshan Yi <yijiangshan@kylinos.cn>
wifi: brcmsmac: fix UAF in brcms_free_timer()
Wentao Liang <vulab@iscas.ac.cn>
watchdog: starfive-wdt: Fix runtime PM leak in starfive_wdt_pm_start()
Wentao Liang <vulab@iscas.ac.cn>
watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init()
Tzung-Bi Shih <tzungbi@kernel.org>
watchdog: rtd119x: Avoid division by zero
Tzung-Bi Shih <tzungbi@kernel.org>
watchdog: msc313e: Propagate error code in resume()
Tzung-Bi Shih <tzungbi@kernel.org>
watchdog: msc313e: Fix premature reset during timeout update
Tzung-Bi Shih <tzungbi@kernel.org>
watchdog: digicolor: Avoid division by zero
Li Jun <lijun01@kylinos.cn>
watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog
Guangshuo Li <lgs201920130244@gmail.com>
hwmon: (w83793) release probe data through kref
Guangshuo Li <lgs201920130244@gmail.com>
hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove
Sanman Pradhan <psanman@juniper.net>
hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676
Sanman Pradhan <psanman@juniper.net>
hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding
Nuno Sá <nuno.sa@analog.com>
hwmon: (pmbus/core) increase number of phases and add new mask
Muhammad Bilal <meatuni001@gmail.com>
hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show()
Iván Ezequiel Rodriguez <ivanrwcm25@gmail.com>
Input: zero ff_effect before compat copy in input_ff_effect_from_user
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound
Raphaël Larocque <rlarocque@disroot.org>
Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722)
Hans de Goede <johannes.goede@oss.qualcomm.com>
Input: soc_button_array - check btns_desc->package.count
Hans de Goede <johannes.goede@oss.qualcomm.com>
Input: soc_button_array - fix MS Surface Pro 11 probe failure
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()
Chris Sommers <chris.sommers@icloud.com>
Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P
Iván Ezequiel Rodriguez <ivanrwcm25@gmail.com>
Input: evdev - zero absinfo before partial copy in EVIOCSABS
Linkai Gong <gonglinkai@kylinos.cn>
Input: cyttsp5 - clamp the HID report size before memcpy
Alexei Turtanov <9alexei9@gmail.com>
Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026
Alvin Šipraga <alvin.sipraga@analog.com>
Input: adp5588-keys - cache GPIO state before registering the gpiochip
Diogo Ivo (Schneider Electric) <diogo.ivo@bootlin.com>
mmc: sdhci_am654: Fallback to DT-provided itap delay on DDR50 tuning failure
Diogo Ivo (Schneider Electric) <diogo.ivo@bootlin.com>
mmc: sdhci_am654: Clear ITAPDLY on tuning failure
Diogo Ivo (Schneider Electric) <diogo.ivo@bootlin.com>
mmc: sdhci_am654: Reset command and data lines on failed tuning
Diogo Ivo (Schneider Electric) <diogo.ivo@bootlin.com>
mmc: sdhci_am654: Move tuning_loop to local variable
Xu Rao <raoxu@uniontech.com>
mmc: spi: reset bytes_xfered before retrying CRC failures
Runyu Xiao <runyu.xiao@seu.edu.cn>
mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt
Felix Gu <ustc.gu@gmail.com>
mmc: sdio_uart: fix xmit_fifo leak when the port table is full
Myeonghun Pak <mhun512@gmail.com>
mmc: sdhci-of-aspeed: Remove children before releasing SDC resources
Florian Maillard <florian.maillard@mailoo.org>
mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260
Fan Wu <fanwu01@zju.edu.cn>
mmc: mxcmmc: cancel data work and watchdog on remove
Fan Wu <fanwu01@zju.edu.cn>
mmc: mmci: Fix use-after-free in busy-timeout work
Fan Wu <fanwu01@zju.edu.cn>
mmc: hsq: Fix use-after-free in retry work
Zhu Ling <zhuling0805@qq.com>
mmc: core: Fix OF node reference leak on card add failure
Fan Wu <fanwu01@zju.edu.cn>
mmc: core: Cancel SDIO IRQ work before freeing host
Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
power: sequencing: fix NULL-pointer dereference in pwrseq_device_register()
Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new()
Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
power: sequencing: don't call .post_enable() if pwrseq_unit_enable() failed
Christian Göttsche <cgzones@googlemail.com>
selinux: always fill AVC decision in avc_has_perm_noaudit()
Karl Mehltretter <kmehltretter@gmail.com>
selinux: recheck intermediate backing files on mprotect()
Karl Mehltretter <kmehltretter@gmail.com>
selinux: preserve user SID across nested backing files
Shuhei Takeshita <jyohuku.alterego@gmail.com>
IB/hfi1: Fix the PIO_CRED credit-return mmap
Shuhei Takeshita <jyohuku.alterego@gmail.com>
IB/hfi1: Resolve the credit-return buffer through the send context's node
Shuangpeng Bai <shuangpeng.kernel@gmail.com>
IB/mlx4: Fix use-after-free on pkey sysfs registration failure
Guangshuo Li <lgs201920130244@gmail.com>
i2c: imx: disable autosuspend on remove
Shengzhuo Wei <me@cherr.cc>
i2c: imx: release DMA channels on probe error
Linkai Gong <gonglinkai@kylinos.cn>
i2c: atr: fix dangling adapter pointer on add failure
Shengzhuo Wei <me@cherr.cc>
i2c: at91: release DMA channels on remove and probe error
Jarkko Sakkinen <jarkko@kernel.org>
KEYS: trusted: Fix tpm2_load_cmd() boundary check
Maoyi Xie <maoyixie.tju@gmail.com>
keys: translate request_key_auth pid for the reading procfs instance
Cen Zhang <cenzhang@linux.microsoft.com>
KEYS: encrypted: fix integer overflow of datablob_len
Shakeel Butt <shakeel.butt@linux.dev>
mm/mlock: use the IRQ-safe accessor for NR_MLOCK in __munlock_folio()
Yifei Gao <gyf161023@gmail.com>
memstick: ms_block: destroy io_queue workqueue on removal
Siwei Zhang <fourdizhang@tencent.com>
xfrm: use hlist_del_init_rcu for state_cache and state_cache_input
Chengfeng Ye <nicoyip.dev@gmail.com>
xfrm: serialize state GC with device state flush
Alberto Carboneri <acarboneri@drivesec.com>
scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable()
Mark Amirkan <markdamirkan@gmail.com>
net/packet: avoid truncating TPACKET_V3 private size
Mark Amirkan <markdamirkan@gmail.com>
net/packet: clear RX owner on VNET header error
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: hhf: cap hh_flows_limit at change time
Xuanqiang Luo <luoxuanqiang@kylinos.cn>
net/sched: act_api: release tail references on DELACTION failure
Guanglei Zhu <zhugl3@xiaopeng.com>
net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value
Guanglei Zhu <zhugl3@xiaopeng.com>
net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain
Guanglei Zhu <zhugl3@xiaopeng.com>
net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb()
Mark Amirkan <markdamirkan@gmail.com>
net: lan743x: fix RX checksum use-after-free
Zhiling Zou <zhilinz@nebusec.ai>
ipv6: xfrm: use full sockets in local error paths
Alexander Chesnokov <Alexander.Chesnokov@kaspersky.com>
dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn()
Christian Lugnberg <christian.lugnberg@soundtrack.io>
dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status
Christian Lugnberg <christian.lugnberg@soundtrack.io>
dmaengine: sun6i: fix non-atomic read of DMA position registers
Chengfeng Ye <nicoyip.dev@gmail.com>
Bluetooth: hci_sync: Serialize local codec list cleanup
Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
Bluetooth: hci_codec: validate vendor codec count length
Aamir Ahmed <elb12345@hotmail.co.uk>
Bluetooth: eir: validate service data length before reading UUID
Nicolas Thibert <nithibert@gmail.com>
Bluetooth: btusb: fix NXP IW610 composite device handling
Mark Rutland <mark.rutland@arm.com>
arm64: percpu: Fix this_cpu_and() mask generation
Mark Rutland <mark.rutland@arm.com>
arm64: percpu: Fix this_cpu_write() casting
Koichiro Den <den@valinux.co.jp>
arm64: dts: renesas: r8a779f0: Set UFS lane count
Bradley Morgan <include@grrlz.net>
arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc
Thomas Huth <thuth@redhat.com>
kselftest/arm64: Fix size of thread_data values for pthread_join()
Benoît Sevens <bsevens@google.com>
HID: logitech-hidpp: fix race condition when accessing stale stack pointer
Wyatt Feng <wf.kernel.dev@gmail.com>
net: xfrm: reject unrepresentable espintcp transport headers
Zhiling Zou <zhilinz@nebusec.ai>
openvswitch: avoid reallocating confirmed conntrack labels
Jeffin Philip <jeffinphilip14@gmail.com>
RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()
Quanye Yang <quanyeyang@proton.me>
RDMA/ucma: Serialize join and leave on copy_to_user failure
Inbal Schussheim <inbal.lipshtat@mail.huji.ac.il>
tcp: exclude old ACKs from tcp fast path
Chang S. Bae <chang.seok.bae@intel.com>
x86/microcode/intel: Reject problematic loading on Granite Rapids systems
Aohan Mei <henrymei@tencent.com>
rds: ib: use rds_conn_drop() on protocol version mismatch
Hyunwoo Kim <imv4bel@gmail.com>
exec: Cleanup POSIX timers right after de_thread()
Wentao Liang <vulab@iscas.ac.cn>
cifs: Fix server use-after-free in cifs_chan_skip_or_disable()
Wentao Liang <vulab@iscas.ac.cn>
ata: libahci_platform: Fix device reference leak in ahci_platform_get_resources()
Niklas Cassel <cassel@kernel.org>
ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY
Jiangshan Yi <yijiangshan@kylinos.cn>
ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type
Yuho Choi <oss.patchbox@gmail.com>
ALSA: virtio: reset device before deleting virtqueues
Takashi Iwai <tiwai@suse.de>
ALSA: core: Fix potential UAF after asynchronous card release
Jeremy Nyberg <slickstretch3.0@gmail.com>
Input: xpad - fix PDP Marvel Xbox 360 controller
Roberts Kursitis <roberts.kursitis@azeron.eu>
Input: xpad - add support for Azeron devices
Erich Sartison <byt.es@mailbox.org>
Input: xpad - add support for Victrix Pro BFG Controller
Bitterblue Smith <rtl8821cerfe2@gmail.com>
wifi: rtw88: Fix the random "error beacon valid" messages for USB
Bitterblue Smith <rtl8821cerfe2@gmail.com>
wifi: rtw88: TX QOS Null data the same way as Null data
Zi Yan <ziy@nvidia.com>
mm/huge_memory: use folio's memcg inside __folio_split()
Matthew Schwartz <matthew.schwartz@linux.dev>
x86/fred: Reconstruct the #GP context for rejected INT instructions
Filipe Manana <fdmanana@suse.com>
btrfs: abort transaction on failure to update inode for hole punching and reflinking
Dmitriy Chumachenko <Dmitry.Chumachenko@cyberprotect.ru>
drm/amdgpu: check ras and obj before dereference
Eric Dumazet <edumazet@google.com>
net: skbuff: do not leave stale header offsets after pskb_carve()
Dmitriy Okunev <dokunevdmitriy@gmail.com>
net: mvpp2: prevent buffer overflow in page_pool allocation
James Clark <jjc@jclark.com>
net: macb: fix ordering around PTP timestamp read
Lorenzo Bianconi <lorenzo.bianconi@oss.qualcomm.com>
net: stmmac: propagate FPE preemption-class mapping errors
Linus Walleij <linusw@kernel.org>
net: ethernet: cortina: Ack RX overrun interrupt correctly
Eric Dumazet <edumazet@google.com>
net: lock the socket in sock_gettstamp()
Yige Jiang <yigejiang86@gmail.com>
net: netsec: fix device_node reference leak on phy_np
HyeongJun An <sammiee5311@gmail.com>
ASoC: hdmi-codec: Report a change when the channel status moves
Sasha Levin <sashal@kernel.org>
ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments
Shivaprasad G Bhat <sbhat@linux.ibm.com>
powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba
Amit Machhiwal <amachhiw@linux.ibm.com>
KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure
Amit Machhiwal <amachhiw@linux.ibm.com>
KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()
Lorenzo Bianconi <lorenzo.bianconi@oss.qualcomm.com>
net: stmmac: do not overwrite phc_index when no PTP clock is registered
Eric Dumazet <edumazet@google.com>
drop_monitor: fix out-of-bounds write in reset_per_cpu_data()
Eric Dumazet <edumazet@google.com>
drop_monitor: synchronize tracepoint unregistration on error path
Eric Dumazet <edumazet@google.com>
pppoatm: ensure a writable skb header and linear data
Juan Perdomo <jcperdomo100@gmail.com>
Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup
Sai Teja Aluvala <aluvala.sai.teja@intel.com>
Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit
Tzung-Bi Shih <tzungbi@kernel.org>
Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown
Chris Lu <chris.lu@mediatek.com>
Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: ISO: set BT_LISTEN before requesting a BIG sync
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: ISO: Fix parent socket leak in iso_conn_ready()
Weiming Shi <bestswngs@gmail.com>
Bluetooth: coredump: Quiesce dump work on unregister
ThangNN99 <ngocthang2710.1999@gmail.com>
Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: hci_core: Print number of packets in conn->data_q
Baineng Shou <shoubaineng@gmail.com>
dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: keep compound responses on query info errors
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: fix partial file information responses
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: return buffer overflow for partial filesystem info
Eric Dumazet <edumazet@google.com>
tcp: do not let tcp_rmem be set below 4096
Kuniyuki Iwashima <kuniyu@google.com>
tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv().
Nikolay Aleksandrov <razor@blackwall.org>
net: bridge: mst: move switchdev call outside rcu
Karl Mehltretter <kmehltretter@gmail.com>
wifi: brcmfmac: fix lost 802.1x TX completion wakeup
Hohyun Sim <tlaghgus0425@korea.ac.kr>
net: fddi: skfp: fix NULL deref when setting the MAC address while down
Dong Chenchen <dongchenchen2@huawei.com>
ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup
Andrea Mayer <andrea.mayer@uniroma2.it>
seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation
Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL
Filipe Manana <fdmanana@suse.com>
btrfs: tree-checker: print dev extent offset in error message
Nicolas Escande <nico.escande@gmail.com>
wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()
Slavin Liu <bolin.liu@seu.edu.cn>
ALSA: hda: trace PCM open only after assigning a stream
Karl Mehltretter <kmehltretter@gmail.com>
drm/vc4: Use managed KMS polling to fix UAF on unbind
Zihan Xi <zihanx@nebusec.ai>
wifi: virt_wifi: don't transfer operstate before register
Xiang Mei <xmei5@asu.edu>
ALSA: 6fire: fix OOB write from device-reported iso length
Takashi Iwai <tiwai@suse.de>
ALSA: usb: 6fire: Avoid embedded URBs
Takashi Iwai <tiwai@suse.de>
ALSA: 6fire: Clean ups with guard()
Runyu Xiao <runyu.xiao@seu.edu.cn>
gpio: virtuser: skip free_irq when no IRQ is installed
Karl Mehltretter <kmehltretter@gmail.com>
Input: trackpoint - fix the inertia attribute name in the ABI document
Richard Fitzgerald <rf@opensource.cirrus.com>
ASoC: soc-pcm: Apply snd_soc_dai_link_ch_map.codec_ch_mask to codec params
Richard Fitzgerald <rf@opensource.cirrus.com>
ASoC: Add codec_ch_mask to snd_soc_dai_link_ch_map
Richard Fitzgerald <rf@opensource.cirrus.com>
ASoC: Rename snd_soc_dai_link_ch_map.ch_mask to cpu_ch_mask
Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
ALSA: pcm: set timer->private_data before registering the PCM timer
AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting
AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow
Takashi Iwai <tiwai@suse.de>
ALSA: bcd2000: Fix race between rawmidi and disconnect
Kuniyuki Iwashima <kuniyu@google.com>
neighbour: Skip default parms when resumed in neightbl_dump_info().
Kuniyuki Iwashima <kuniyu@google.com>
neighbour: Add missing RCU annotation for neightbl_dump_info().
Kuniyuki Iwashima <kuniyu@google.com>
neighbour: Convert RTM_GETNEIGHTBL to RCU.
Kuniyuki Iwashima <kuniyu@google.com>
neighbour: Convert RTM_GETNEIGH to RCU.
Kuniyuki Iwashima <kuniyu@google.com>
neighbour: Move neigh_find_table() to neigh_get().
Kuniyuki Iwashima <kuniyu@google.com>
neighbour: Allocate skb in neigh_get().
Kuniyuki Iwashima <kuniyu@google.com>
neighbour: Move two validations from neigh_get() to neigh_valid_get_req().
Kuniyuki Iwashima <kuniyu@google.com>
neighbour: Make neigh_valid_get_req() return ndmsg.
Kuniyuki Iwashima <kuniyu@amazon.com>
neighbour: Use rtnl_register_many().
Karl Mehltretter <kmehltretter@gmail.com>
keys: fix lost wakeup when reaping a dead key type
Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr
Breno Leitao <leitao@debian.org>
arm64: hibernate: clone only the linear map that exists at runtime
Shouping Wang <allen.wang@hj-micro.com>
perf/arm-cmn: Fix wp_dev_sel2 setting for multi-DTM configurations
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: flowtable: hold reference on ct until flow is released
Theodor Arsenij Larionov Trichkine <theodorlarionov@gmail.com>
netfilter: nft_nat: fully initialise new_addr in netmap setup
Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
RDMA/siw: Bound fragmented header copies by the remaining length
Leon Romanovsky <leon@kernel.org>
RDMA/efa: Keep EQ resources alive while IRQ is registered
Leon Romanovsky <leon@kernel.org>
RDMA/efa: Keep admin queues alive while IRQ is registered
Alex Bereza <alex@bereza.email>
dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA
Alex Bereza <alex@bereza.email>
dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order
Karl Mehltretter <kmehltretter@gmail.com>
scsi: qla2xxx: Fix the ql2xfc2target parameter description
Meijing Zhao <zhaomeijing@lixiang.com>
mm: memblock: show all region flags in debugfs
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: set up the TX info early to fix failure paths
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: mesh: release the channel if start fails
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: mesh: reset the CSA state when leaving
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: add HE 6 GHz capability in the scan elems len
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: don't access the TSF of a down interface
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: don't allow link changes when iface is down
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: require a peer station for TDLS setup confirm
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: don't allow injecting frames wider than the chanctx
Johannes Berg <johannes.berg@intel.com>
wifi: cfg80211: expose cfg80211_chandef_get_width()
Kavita Kavita <quic_kkavita@quicinc.com>
wifi: cfg80211: skip regulatory for punctured subchannels
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: unlist vifs when their netdev is unregistered
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: reset state when starting AP fails
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: abort chanswitch when leaving a mesh
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: suppress chanctx warning for debugfs reset
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: don't offload TC setup on AP_VLAN interfaces
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: don't warn when an IBSS has no channel to scan
Felix Fietkau <nbd@nbd.name>
wifi: mac80211: use vif radio mask to limit ibss scan frequencies
Felix Fietkau <nbd@nbd.name>
wifi: cfg80211: add option for vif allowed radios
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: don't start a ROC while scanning
Johannes Berg <johannes.berg@intel.com>
wifi: cfg80211: don't filter by BSS type when removing stale entries
Johannes Berg <johannes.berg@intel.com>
wifi: cfg80211: only group hidden BSSes with beacon entries
Shivank Garg <shivankg@amd.com>
dmaengine: wait for RCU readers before releasing dma_device
Shivank Garg <shivankg@amd.com>
dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()
Shivank Garg <shivankg@amd.com>
dmaengine: Fix device kref underflow in dma_chan_put()
Donggeun Yoo <donggeunyoo.kernel@gmail.com>
dma-coherent: report a failed reserved memory assignment
Chen-Yu Tsai <wenst@chromium.org>
dma-coherent: Warn if OF reserved memory is beyond current coherent DMA mask
Orgad Shaneh <orgads@gmail.com>
MIPS: Octeon: apply USB FDT fixups also when USB is modular
Bard Liao <yung-chuan.liao@linux.intel.com>
soundwire: cadence_master: wait and cancel cdns->work before clock stop
Johannes Berg <johannes.berg@intel.com>
wifi: cfg80211: check IP header size in cfg80211_classify8021d()
Johannes Berg <johannes.berg@intel.com>
wifi: cfg80211: don't get the radio mask for netdev-less wdevs
Carolina Jubran <cjubran@nvidia.com>
IB/IPoIB: Avoid restoring OPER_UP after multicast flush
Shmulik Cohen <anuk909@gmail.com>
wifi: libipw: reject too-short association responses
Shmulik Cohen <anuk909@gmail.com>
wifi: libipw: reject too-short beacon and probe responses
Peng Hao <flyingpenghao@gmail.com>
wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path
Mariano Baragiola <mbaragiola@linux.com>
wifi: virt_wifi: free skb when disconnected
Ruoyu Wang <ruoyuw560@gmail.com>
dmaengine: sprd: Fix runtime PM reference leak in probe
Quanye Yang <quanyeyang@proton.me>
RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted
Jacob Moroni <jmoroni@google.com>
RDMA/irdma: Enforce local fence for IB_WR_REG_MR
Li RongQing <lirongqing@baidu.com>
RDMA/mad: Fix receive buffer leak when PKey enforcement fails
Yehyeong Lee <yhlee@isslab.korea.ac.kr>
IB/isert: wait for deferred control PDU completions before releasing the connection
Yehyeong Lee <yhlee@isslab.korea.ac.kr>
IB/iser: reject a remote invalidation of an unregistered direction
Krystian Kaniewski <krystianmkaniewski@gmail.com>
RDMA/core: Reject unregistering netdevs in ib_get_eth_speed
Michael Bommarito <michael.bommarito@gmail.com>
RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds
Xixin Liu <liuxixin@kylinos.cn>
clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate
Xixin Liu <liuxixin@kylinos.cn>
firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS
Gang Yan <yangang@kylinos.cn>
RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access
Norbert Szetei <norbert@doyensec.com>
RDMA/rxe: validate access flags before swapping the MR's PD
Guoqing Jiang <guoqing.jiang@linux.dev>
RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept
Pengpeng Hou <pengpeng@iscas.ac.cn>
ARM: socfpga: select the PL310 erratum 753970 workaround
Maher Azzouzi <maherazz04@gmail.com>
esp: downgrade zerocopy managed frags before mutating skb frags
Eric Dumazet <edumazet@google.com>
xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()
Kyle Zeng <kylebot@openai.com>
xfrm: fix compat ALLOCSPI request use-after-free
Sabrina Dubroca <sd@queasysnail.net>
xfrm: avoid RCU warnings around the per-netns netlink socket
Chen Linxuan <me@black-desk.cn>
pidfd: hold exec_update_lock around namespace ioctl
Ido Schimmel <idosch@nvidia.com>
ipv6: Honor oif when choosing nexthop for locally generated traffic
Ido Schimmel <idosch@nvidia.com>
ipv6: Select best matching nexthop object in fib6_table_lookup()
Arash Golgol <arash.golgol@gmail.com>
media: video-i2c: fix buffer queue ordering
Eric Dumazet <edumazet@google.com>
ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()
Kuniyuki Iwashima <kuniyu@google.com>
ipv6: mcast: Don't hold RTNL for MCAST_ socket options.
Kuniyuki Iwashima <kuniyu@google.com>
ipv6: mcast: Don't hold RTNL for IPV6_DROP_MEMBERSHIP and MCAST_LEAVE_GROUP.
Kuniyuki Iwashima <kuniyu@google.com>
ipv6: mcast: Don't hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP.
Kuniyuki Iwashima <kuniyu@google.com>
ipv6: mcast: Use in6_dev_get() in ipv6_dev_mc_dec().
Kevin Hao <haokexin@gmail.com>
net: cpsw: Execute ndo_set_rx_mode callback in a work queue
Kevin Hao <haokexin@gmail.com>
net: cpsw_new: Execute ndo_set_rx_mode callback in a work queue
Jens Axboe <axboe@kernel.dk>
sunvdc: fix -EIO issue due to lack of retries
Günther Noack <gnoack@google.com>
selftests/landlock: Add tests for whiteout object creation
Vasily Gorbik <gor@linux.ibm.com>
s390/boot: Avoid IPL parameter append past command line
Vasily Gorbik <gor@linux.ibm.com>
s390/boot: Add sized_strscpy() to enable strscpy() usage
Mickaël Salaün <mic@digikod.net>
selftests/landlock: Add disconnected leafs and branch test suites
Tingmao Wang <m@maowtm.org>
selftests/landlock: Add tests for access through disconnected paths
Matthieu Buffet <matthieu@buffet.re>
selftests/landlock: Add missing connect(minimal AF_UNSPEC) test
Matthieu Buffet <matthieu@buffet.re>
selftests/landlock: Add test for TCP fast open
Matthieu Buffet <matthieu@buffet.re>
landlock: Fix TCP Fast Open connection bypass
Sasha Levin <sashal@kernel.org>
Revert "hwmon: (emc1403) Rely on subsystem locking"
Sasha Levin <sashal@kernel.org>
Revert "hwmon: (emc1403) Drop hysteresis for low limit temperature"
-------------
Diffstat:
.../ABI/testing/sysfs-devices-platform-trackpoint | 2 +-
Documentation/ABI/testing/sysfs-fs-erofs | 2 +-
Documentation/arch/arm64/booting.rst | 1 +
Documentation/arch/s390/pci.rst | 144 +-
Documentation/hwmon/emc1403.rst | 8 +-
Documentation/networking/ip-sysctl.rst | 2 +
.../net_cachelines/inet_connection_sock.rst | 1 +
.../networking/net_cachelines/inet_sock.rst | 1 +
.../networking/net_cachelines/net_device.rst | 1 +
Documentation/trace/eprobetrace.rst | 269 ++++
Documentation/trace/index.rst | 1 +
Makefile | 4 +-
arch/arm/mach-socfpga/Kconfig | 2 +-
arch/arm64/boot/dts/renesas/r8a779f0.dtsi | 1 +
arch/arm64/include/asm/el2_setup.h | 8 +-
arch/arm64/include/asm/io.h | 3 +-
arch/arm64/include/asm/percpu.h | 33 +-
arch/arm64/kernel/hibernate-asm.S | 2 +
arch/arm64/kernel/hibernate.c | 4 +-
arch/arm64/kvm/emulate-nested.c | 2 +-
arch/arm64/kvm/hypercalls.c | 3 +-
arch/arm64/kvm/mmu.c | 15 +-
arch/arm64/kvm/vgic/vgic-its.c | 108 +-
arch/arm64/kvm/vgic/vgic.h | 23 -
arch/arm64/net/bpf_jit_comp.c | 2 +
arch/mips/cavium-octeon/octeon-platform.c | 4 +-
arch/mips/net/bpf_jit_comp32.c | 2 +-
arch/mips/net/bpf_jit_comp64.c | 3 +-
arch/powerpc/kernel/iommu.c | 2 +-
arch/powerpc/kvm/book3s_hv_nested.c | 2 +
arch/powerpc/kvm/book3s_hv_uvmem.c | 5 +-
arch/riscv/kvm/aia_imsic.c | 11 +-
arch/riscv/kvm/vcpu_pmu.c | 33 +-
arch/riscv/kvm/vcpu_sbi_hsm.c | 4 +-
arch/riscv/kvm/vcpu_timer.c | 5 +-
arch/s390/boot/ipl_parm.c | 26 +-
arch/s390/boot/string.c | 12 +
arch/s390/include/asm/debug.h | 8 +-
arch/s390/kernel/debug.c | 15 +-
arch/s390/kvm/interrupt.c | 72 +-
arch/s390/kvm/kvm-s390.c | 4 +-
arch/x86/entry/entry_fred.c | 11 +-
arch/x86/events/intel/core.c | 89 +-
arch/x86/events/intel/ds.c | 36 +-
arch/x86/events/intel/pt.c | 2 +
arch/x86/events/perf_event.h | 2 +-
arch/x86/include/asm/kvm_host.h | 4 +-
arch/x86/kernel/cpu/mce/core.c | 27 +-
arch/x86/kernel/cpu/microcode/intel.c | 26 +
arch/x86/kvm/Makefile | 2 +-
arch/x86/kvm/mmu/mmu.c | 60 +-
arch/x86/kvm/pmu.c | 8 -
arch/x86/kvm/regs.c | 872 ++++++++++
arch/x86/kvm/svm/sev.c | 77 +-
arch/x86/kvm/svm/svm.h | 1 +
arch/x86/kvm/vmx/pmu_intel.c | 3 +
arch/x86/kvm/x86.c | 900 +----------
arch/x86/kvm/x86.h | 28 +
arch/x86/pci/fixup.c | 99 ++
drivers/ata/libahci.c | 15 +-
drivers/ata/libahci_platform.c | 2 +-
drivers/ata/libata-scsi.c | 10 +-
drivers/base/core.c | 131 +-
drivers/block/sunvdc.c | 9 +-
drivers/bluetooth/btintel_pcie.c | 18 +-
drivers/bluetooth/btmtk.c | 7 +-
drivers/bluetooth/btmtksdio.c | 4 +-
drivers/bluetooth/btusb.c | 17 +
drivers/char/hw_random/atmel-rng.c | 2 +-
drivers/char/hw_random/cctrng.c | 2 +-
drivers/char/hw_random/exynos-trng.c | 2 +-
drivers/char/hw_random/ingenic-rng.c | 2 +-
drivers/char/hw_random/ks-sa-rng.c | 2 +-
drivers/char/hw_random/mxc-rnga.c | 2 +-
drivers/char/hw_random/n2-drv.c | 2 +-
drivers/char/hw_random/npcm-rng.c | 2 +-
drivers/char/hw_random/omap-rng.c | 2 +-
drivers/char/hw_random/stm32-rng.c | 11 +-
drivers/char/hw_random/timeriomem-rng.c | 2 +-
drivers/char/hw_random/xgene-rng.c | 2 +-
drivers/clk/clk-scpi.c | 2 +-
drivers/clk/qcom/gcc-qcm2290.c | 6 +-
drivers/clk/qcom/gcc-sm6115.c | 6 +-
drivers/dma-buf/dma-heap.c | 80 +-
drivers/dma/dmaengine.c | 40 +-
drivers/dma/mmp_pdma.c | 2 +-
drivers/dma/sprd-dma.c | 3 +-
drivers/dma/sun6i-dma.c | 9 +-
drivers/dma/ti/k3-udma-glue.c | 5 +-
drivers/dma/xilinx/xilinx_dma.c | 26 +-
drivers/dpll/dpll_netlink.c | 3 +-
drivers/edac/altera_edac.c | 115 +-
drivers/edac/altera_edac.h | 1 +
drivers/firmware/arm_scpi.c | 4 +-
drivers/firmware/qcom/qcom_scm.c | 44 +-
drivers/firmware/sysfb_simplefb.c | 31 +-
drivers/gpio/gpio-arizona.c | 8 +-
drivers/gpio/gpio-tps65219.c | 2 +-
drivers/gpio/gpio-virtuser.c | 3 +-
drivers/gpio/gpio-zynq.c | 10 +-
drivers/gpio/gpiolib-cdev.c | 30 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 1 +
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 2 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 20 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 18 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 6 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 11 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c | 36 +
drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | 25 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c | 2 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c | 11 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 9 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c | 4 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 2 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h | 21 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c | 11 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_sync.h | 3 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_umsch_mm.c | 459 +-----
drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 3 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 1 +
drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c | 2 +-
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 +-
drivers/gpu/drm/amd/display/dc/dml/Makefile | 6 +-
.../amd/display/dc/dml2/dml2_translation_helper.c | 1 +
drivers/gpu/drm/armada/armada_fbdev.c | 4 +-
drivers/gpu/drm/bridge/samsung-dsim.c | 2 +-
drivers/gpu/drm/bridge/tc358768.c | 15 +-
drivers/gpu/drm/drm_atomic_uapi.c | 13 +-
drivers/gpu/drm/drm_client.c | 4 +-
drivers/gpu/drm/drm_fb_helper.c | 24 +-
drivers/gpu/drm/drm_fbdev_client.c | 14 +-
drivers/gpu/drm/drm_fbdev_dma.c | 4 +-
drivers/gpu/drm/drm_fbdev_shmem.c | 4 +-
drivers/gpu/drm/drm_fbdev_ttm.c | 4 +-
drivers/gpu/drm/drm_file.c | 12 +-
drivers/gpu/drm/exynos/exynos_drm_fbdev.c | 4 +-
drivers/gpu/drm/gma500/fbdev.c | 4 +-
drivers/gpu/drm/gud/gud_pipe.c | 4 +-
drivers/gpu/drm/i915/display/intel_connector.c | 4 +-
drivers/gpu/drm/i915/display/intel_cursor.c | 7 +-
drivers/gpu/drm/i915/display/intel_ddi.c | 4 +-
.../gpu/drm/i915/display/intel_display_debugfs.c | 8 +-
drivers/gpu/drm/i915/display/intel_display_types.h | 20 +-
drivers/gpu/drm/i915/display/intel_dp.c | 36 +-
drivers/gpu/drm/i915/display/intel_dp_hdcp.c | 6 +-
.../gpu/drm/i915/display/intel_dp_link_training.c | 4 +-
drivers/gpu/drm/i915/display/intel_dp_mst.c | 155 +-
drivers/gpu/drm/i915/display/intel_fbdev.c | 8 +-
drivers/gpu/drm/i915/display/intel_hdcp.c | 8 +-
drivers/gpu/drm/i915/display/intel_psr.c | 39 +-
drivers/gpu/drm/i915/display/skl_universal_plane.c | 9 +-
drivers/gpu/drm/i915/gem/i915_gem_object.c | 2 +-
drivers/gpu/drm/imagination/pvr_free_list.c | 15 +-
drivers/gpu/drm/imagination/pvr_mmu.c | 19 +-
drivers/gpu/drm/imagination/pvr_mmu.h | 2 +-
drivers/gpu/drm/imagination/pvr_vm.c | 4 +-
drivers/gpu/drm/msm/adreno/adreno_gpu.c | 2 +
drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c | 1 +
drivers/gpu/drm/msm/dsi/dsi_host.c | 36 +-
drivers/gpu/drm/msm/hdmi/hdmi_phy.c | 8 +-
drivers/gpu/drm/msm/msm_fbdev.c | 4 +-
drivers/gpu/drm/nouveau/nouveau_bo.c | 3 +-
drivers/gpu/drm/nouveau/nouveau_connector.c | 5 +-
drivers/gpu/drm/nouveau/nouveau_drm.c | 5 +-
drivers/gpu/drm/nouveau/nouveau_gem.c | 2 +
drivers/gpu/drm/nouveau/nouveau_sched.c | 2 +-
drivers/gpu/drm/nouveau/nouveau_sched.h | 1 +
drivers/gpu/drm/nouveau/nouveau_uvmm.c | 13 +-
drivers/gpu/drm/nouveau/nvif/vmm.c | 1 +
drivers/gpu/drm/nouveau/nvkm/engine/disp/gv100.c | 4 +-
drivers/gpu/drm/nouveau/nvkm/engine/disp/head.h | 2 +
drivers/gpu/drm/nouveau/nvkm/engine/disp/r535.c | 8 +-
drivers/gpu/drm/nouveau/nvkm/engine/disp/uoutp.c | 3 +-
drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c | 23 +-
drivers/gpu/drm/nouveau/nvkm/subdev/fb/ramnv1a.c | 2 +
drivers/gpu/drm/omapdrm/omap_fbdev.c | 4 +-
drivers/gpu/drm/radeon/radeon_fbdev.c | 4 +-
drivers/gpu/drm/tegra/fbdev.c | 4 +-
drivers/gpu/drm/tiny/ofdrm.c | 8 +-
drivers/gpu/drm/tiny/simpledrm.c | 61 +-
drivers/gpu/drm/vc4/vc4_kms.c | 2 +-
drivers/gpu/drm/virtio/virtgpu_gem.c | 2 +-
drivers/gpu/drm/virtio/virtgpu_ioctl.c | 6 +-
drivers/gpu/drm/virtio/virtgpu_submit.c | 11 +-
drivers/gpu/drm/virtio/virtgpu_vram.c | 17 +-
drivers/gpu/drm/xe/instructions/xe_gpu_commands.h | 1 +
drivers/gpu/drm/xe/xe_bo.h | 19 +
drivers/gpu/drm/xe/xe_ring_ops.c | 16 +-
drivers/gpu/drm/xe/xe_vm.c | 29 +-
drivers/hid/amd-sfh-hid/amd_sfh_common.h | 4 +
drivers/hid/amd-sfh-hid/amd_sfh_pcie.c | 10 +
drivers/hid/bpf/hid_bpf_dispatch.c | 12 +-
drivers/hid/hid-alps.c | 31 +-
drivers/hid/hid-asus.c | 34 +-
drivers/hid/hid-ids.h | 3 +
drivers/hid/hid-logitech-hidpp.c | 24 +-
drivers/hid/hid-quirks.c | 3 +-
drivers/hid/wacom_sys.c | 5 +-
drivers/hwmon/emc1403.c | 73 +-
drivers/hwmon/hp-wmi-sensors.c | 2 +
drivers/hwmon/pmbus/pmbus.h | 3 +-
drivers/hwmon/pmbus/tps53679.c | 11 +-
drivers/hwmon/pwm-fan.c | 13 +-
drivers/hwmon/w83791d.c | 1 +
drivers/hwmon/w83793.c | 4 +-
drivers/i2c/busses/i2c-at91-core.c | 3 +
drivers/i2c/busses/i2c-at91-master.c | 12 +-
drivers/i2c/busses/i2c-at91.h | 1 +
drivers/i2c/busses/i2c-imx.c | 3 +
drivers/i2c/busses/i2c-mxs.c | 5 +-
drivers/i2c/busses/i2c-qcom-cci.c | 37 +-
drivers/i2c/busses/i2c-qcom-geni.c | 33 +-
drivers/i2c/i2c-atr.c | 1 +
drivers/i3c/master.c | 20 +-
drivers/infiniband/core/iwpm_util.c | 9 +-
drivers/infiniband/core/mad.c | 3 +-
drivers/infiniband/core/ucma.c | 7 +-
drivers/infiniband/core/verbs.c | 12 +-
drivers/infiniband/hw/efa/efa_com.c | 7 +-
drivers/infiniband/hw/efa/efa_com.h | 1 +
drivers/infiniband/hw/efa/efa_main.c | 35 +-
drivers/infiniband/hw/hfi1/file_ops.c | 23 +-
drivers/infiniband/hw/irdma/verbs.c | 2 +-
drivers/infiniband/hw/mlx4/sysfs.c | 4 +
drivers/infiniband/sw/rxe/rxe_mcast.c | 50 +-
drivers/infiniband/sw/rxe/rxe_mr.c | 3 +-
drivers/infiniband/sw/rxe/rxe_verbs.c | 13 +-
drivers/infiniband/sw/siw/siw_cm.c | 7 +-
drivers/infiniband/sw/siw/siw_qp_rx.c | 2 +-
drivers/infiniband/ulp/ipoib/ipoib.h | 7 +
drivers/infiniband/ulp/ipoib/ipoib_ib.c | 12 +-
drivers/infiniband/ulp/ipoib/ipoib_multicast.c | 16 +-
drivers/infiniband/ulp/iser/iser_initiator.c | 16 +-
drivers/infiniband/ulp/isert/ib_isert.c | 22 +
drivers/infiniband/ulp/isert/ib_isert.h | 2 +
drivers/infiniband/ulp/rtrs/rtrs-clt.c | 8 +
drivers/infiniband/ulp/rtrs/rtrs-clt.h | 2 +
drivers/input/evdev.c | 2 +
drivers/input/input-compat.c | 2 +
drivers/input/joystick/xpad.c | 10 +-
drivers/input/keyboard/adp5588-keys.c | 12 +-
drivers/input/keyboard/atkbd.c | 8 +
drivers/input/misc/soc_button_array.c | 16 +-
drivers/input/mouse/synaptics.c | 8 +
drivers/input/rmi4/rmi_driver.c | 13 +
drivers/input/rmi4/rmi_smbus.c | 10 +-
drivers/input/serio/hp_sdc.c | 2 +-
drivers/input/serio/i8042-acpipnpio.h | 7 +
drivers/input/touchscreen/cyttsp5.c | 1 +
drivers/iommu/iommufd/device.c | 70 +-
drivers/iommu/iommufd/hw_pagetable.c | 13 +-
drivers/iommu/iommufd/iommufd_private.h | 8 +-
drivers/iommu/iommufd/selftest.c | 20 +
drivers/iommu/msm_iommu.c | 55 +-
drivers/media/i2c/imx355.c | 62 +-
drivers/media/i2c/video-i2c.c | 5 +-
.../platform/chips-media/wave5/wave5-vpu-dec.c | 12 +-
.../platform/chips-media/wave5/wave5-vpuconfig.h | 1 +
drivers/memstick/core/ms_block.c | 2 +
drivers/mmc/core/bus.c | 2 +-
drivers/mmc/core/host.c | 1 +
drivers/mmc/core/sdio_uart.c | 3 +
drivers/mmc/host/mmc_hsq.c | 8 +-
drivers/mmc/host/mmc_spi.c | 1 +
drivers/mmc/host/mmci.c | 3 +
drivers/mmc/host/mxcmmc.c | 4 +
drivers/mmc/host/rtsx_pci_sdmmc.c | 5 +
drivers/mmc/host/sdhci-of-aspeed.c | 5 +-
drivers/mmc/host/sdhci_am654.c | 43 +-
drivers/mmc/host/sh_mmcif.c | 3 +-
drivers/mmc/host/via-sdmmc.c | 4 +
drivers/mtd/nand/raw/pl35x-nand-controller.c | 10 +-
drivers/net/bonding/bond_main.c | 2 +-
drivers/net/dsa/mt7530-mdio.c | 18 +-
drivers/net/ethernet/amazon/ena/ena_com.c | 25 +-
drivers/net/ethernet/amazon/ena/ena_com.h | 14 -
drivers/net/ethernet/amazon/ena/ena_netdev.c | 1 +
drivers/net/ethernet/atheros/atl1c/atl1c_main.c | 3 +
drivers/net/ethernet/atheros/atl1e/atl1e_main.c | 3 +
drivers/net/ethernet/atheros/atlx/atl1.c | 3 +
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 82 +-
drivers/net/ethernet/broadcom/bnxt/bnxt.h | 2 +
drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 6 +-
drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.h | 2 +-
drivers/net/ethernet/broadcom/genet/bcmgenet.c | 63 +-
drivers/net/ethernet/broadcom/genet/bcmgenet.h | 5 +-
drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c | 20 +-
drivers/net/ethernet/broadcom/tg3.c | 15 +-
drivers/net/ethernet/brocade/bna/bnad.c | 16 +-
drivers/net/ethernet/cadence/macb_main.c | 13 +-
drivers/net/ethernet/cadence/macb_ptp.c | 20 +-
.../chelsio/inline_crypto/chtls/chtls_cm.c | 4 +-
drivers/net/ethernet/cortina/gemini.c | 2 +-
drivers/net/ethernet/freescale/fman/fman.c | 1 +
drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c | 3 +
drivers/net/ethernet/intel/idpf/idpf.h | 24 +-
drivers/net/ethernet/intel/idpf/idpf_dev.c | 10 +-
drivers/net/ethernet/intel/idpf/idpf_lib.c | 35 +-
drivers/net/ethernet/intel/idpf/idpf_txrx.c | 301 ++--
drivers/net/ethernet/intel/idpf/idpf_txrx.h | 14 +-
drivers/net/ethernet/intel/idpf/idpf_vf_dev.c | 10 +-
drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 20 +-
drivers/net/ethernet/intel/idpf/idpf_virtchnl.h | 3 +-
drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 3 +-
drivers/net/ethernet/marvell/octeontx2/af/common.h | 45 +-
drivers/net/ethernet/mediatek/mtk_eth_soc.c | 6 +-
.../ethernet/mellanox/mlx5/core/en/rep/bridge.c | 45 +-
drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c | 3 +
.../ethernet/mellanox/mlx5/core/en_accel/macsec.c | 2 +
drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 1 -
drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 39 +-
.../net/ethernet/mellanox/mlx5/core/esw/bridge.c | 15 +-
.../net/ethernet/mellanox/mlx5/core/esw/bridge.h | 2 +
.../net/ethernet/mellanox/mlx5/core/lib/devcom.c | 5 +-
drivers/net/ethernet/meta/fbnic/fbnic_csr.h | 1 +
drivers/net/ethernet/meta/fbnic/fbnic_fw.c | 9 +-
drivers/net/ethernet/meta/fbnic/fbnic_txrx.c | 2 +-
drivers/net/ethernet/microchip/lan743x_main.c | 2 +-
drivers/net/ethernet/netronome/nfp/crypto/ipsec.c | 3 +-
drivers/net/ethernet/socionext/netsec.c | 2 +
drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c | 5 +-
drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c | 4 +-
drivers/net/ethernet/stmicro/stmmac/hwif.h | 4 +-
drivers/net/ethernet/stmicro/stmmac/ring_mode.c | 4 +-
.../net/ethernet/stmicro/stmmac/stmmac_ethtool.c | 2 -
.../net/ethernet/stmicro/stmmac/stmmac_selftests.c | 106 +-
drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 19 +-
drivers/net/ethernet/ti/cpsw.c | 41 +-
drivers/net/ethernet/ti/cpsw_new.c | 35 +-
drivers/net/ethernet/ti/cpsw_priv.h | 1 +
drivers/net/ethernet/ti/netcp_core.c | 2 +-
drivers/net/fddi/skfp/skfddi.c | 3 +-
drivers/net/macsec.c | 123 +-
drivers/net/pcs/pcs-xpcs.c | 4 +-
drivers/net/phy/mediatek/mtk-ge-soc.c | 23 +-
drivers/net/usb/catc.c | 15 +-
drivers/net/usb/cdc_mbim.c | 5 +
drivers/net/usb/lan78xx.c | 2 +
drivers/net/usb/sr9700.c | 3 +-
drivers/net/veth.c | 2 +
drivers/net/virtio_net.c | 9 +
drivers/net/vrf.c | 2 -
drivers/net/vxlan/vxlan_core.c | 6 +-
drivers/net/wireless/ath/ath11k/mac.c | 25 +-
drivers/net/wireless/ath/wcn36xx/dxe.c | 2 +-
.../wireless/broadcom/brcm80211/brcmfmac/core.c | 2 +
.../broadcom/brcm80211/brcmsmac/mac80211_if.c | 4 +
drivers/net/wireless/intel/ipw2x00/libipw_rx.c | 6 +
drivers/net/wireless/intel/iwlegacy/common.c | 2 +-
drivers/net/wireless/intersil/p54/eeprom.c | 22 +-
drivers/net/wireless/marvell/libertas_tf/main.c | 2 +-
drivers/net/wireless/marvell/mwifiex/cfg80211.c | 12 +-
drivers/net/wireless/marvell/mwifiex/pcie.c | 2 +-
drivers/net/wireless/marvell/mwifiex/scan.c | 54 +-
drivers/net/wireless/marvell/mwifiex/util.c | 10 +-
.../net/wireless/mediatek/mt76/mt7915/debugfs.c | 5 +
drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c | 33 +-
drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h | 1 +
drivers/net/wireless/mediatek/mt76/mt7915/init.c | 7 +-
drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 15 +-
drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h | 3 +-
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 8 +-
drivers/net/wireless/microchip/wilc1000/cfg80211.c | 14 +
drivers/net/wireless/microchip/wilc1000/wlan.c | 9 +
drivers/net/wireless/realtek/rtw88/fw.c | 8 +-
drivers/net/wireless/realtek/rtw88/tx.c | 2 +-
drivers/net/wireless/realtek/rtw89/core.h | 3 +-
drivers/net/wireless/realtek/rtw89/mac.c | 13 +-
drivers/net/wireless/realtek/rtw89/mac80211.c | 3 +-
drivers/net/wireless/realtek/rtw89/pci.c | 13 +
drivers/net/wireless/realtek/rtw89/pci.h | 1 +
drivers/net/wireless/realtek/rtw89/phy.c | 3 +-
drivers/net/wireless/realtek/rtw89/rtw8851be.c | 1 +
drivers/net/wireless/realtek/rtw89/rtw8852ae.c | 1 +
drivers/net/wireless/realtek/rtw89/rtw8852be.c | 1 +
drivers/net/wireless/realtek/rtw89/rtw8852bte.c | 1 +
drivers/net/wireless/realtek/rtw89/rtw8852ce.c | 1 +
drivers/net/wireless/realtek/rtw89/rtw8922ae.c | 1 +
drivers/net/wireless/rsi/rsi_91x_mgmt.c | 2 -
drivers/net/wireless/ti/wlcore/main.c | 4 +-
drivers/net/wireless/virtual/mac80211_hwsim.c | 39 +-
drivers/net/wireless/virtual/virt_wifi.c | 4 +-
drivers/net/wwan/mhi_wwan_mbim.c | 28 +-
drivers/net/wwan/t7xx/t7xx_netdev.c | 4 +
drivers/nfc/microread/microread.c | 6 +-
drivers/nfc/nfcmrvl/fw_dnld.c | 11 +-
drivers/nfc/pn533/pn533.c | 14 +-
drivers/nfc/pn533/pn533.h | 4 +-
drivers/nfc/pn533/usb.c | 4 +-
drivers/nfc/pn544/pn544.c | 7 +-
drivers/nfc/port100.c | 7 +
drivers/nfc/st21nfca/core.c | 12 +-
drivers/nfc/st21nfca/i2c.c | 29 +-
drivers/nfc/virtual_ncidev.c | 3 +-
drivers/nvdimm/nd_virtio.c | 125 +-
drivers/nvdimm/pmem.c | 15 +-
drivers/nvdimm/region_devs.c | 5 +-
drivers/nvdimm/virtio_pmem.c | 14 +-
drivers/nvdimm/virtio_pmem.h | 6 +
drivers/nvme/host/core.c | 83 +-
drivers/nvme/host/nvme.h | 2 +-
drivers/pci/controller/plda/pcie-starfive.c | 36 +-
drivers/pci/hotplug/pnv_php.c | 2 +-
drivers/pci/hotplug/rpaphp_slot.c | 2 +-
drivers/pci/of_property.c | 11 +-
drivers/pci/pci.c | 5 +-
drivers/pci/rebar.c | 19 +-
drivers/pci/setup-bus.c | 56 +-
drivers/pci/slot.c | 67 +-
drivers/perf/arm-cmn.c | 10 +-
drivers/phy/mediatek/phy-mtk-hdmi-mt8195.c | 4 +-
drivers/phy/mediatek/phy-mtk-hdmi-mt8195.h | 3 +
drivers/phy/renesas/phy-rcar-gen3-usb2.c | 302 +++-
drivers/pinctrl/meson/pinctrl-meson-s4.c | 2 +-
drivers/pinctrl/pinctrl-single.c | 3 +-
drivers/pinctrl/sunxi/pinctrl-sunxi.c | 76 +-
drivers/pinctrl/sunxi/pinctrl-sunxi.h | 7 +
drivers/platform/x86/amd/pmc/Makefile | 2 +-
drivers/platform/x86/amd/pmc/mp1_stb.c | 316 ++++
drivers/platform/x86/amd/pmc/pmc.c | 314 +---
drivers/platform/x86/amd/pmc/pmc.h | 18 +-
drivers/platform/x86/intel/int1092/intel_sar.c | 39 +-
.../x86/intel/speed_select_if/isst_tpmi_core.c | 14 +-
drivers/platform/x86/think-lmi.c | 45 +-
drivers/platform/x86/think-lmi.h | 2 +-
drivers/power/sequencing/core.c | 11 +-
drivers/power/supply/ab8500_fg.c | 32 +-
drivers/power/supply/qcom_battmgr.c | 8 +-
drivers/remoteproc/qcom_q6v5_adsp.c | 8 +-
drivers/remoteproc/qcom_q6v5_pas.c | 93 +-
drivers/rtc/rtc-rzn1.c | 16 +-
drivers/s390/cio/chp.c | 3 +
drivers/s390/cio/cio.c | 11 +-
drivers/s390/cio/cio.h | 5 +-
drivers/s390/cio/cmf.c | 2 +-
drivers/s390/cio/device.c | 9 +-
drivers/s390/cio/device_fsm.c | 3 +
drivers/s390/cio/device_ops.c | 23 +
drivers/s390/cio/vfio_ccw_fsm.c | 2 +-
drivers/s390/crypto/vfio_ap_ops.c | 44 +-
drivers/scsi/fnic/fnic.h | 2 +-
drivers/scsi/fnic/fnic_isr.c | 13 +-
drivers/scsi/fnic/fnic_main.c | 33 +-
drivers/scsi/libiscsi_tcp.c | 3 +
drivers/scsi/megaraid/megaraid_sas_base.c | 4 +-
drivers/scsi/qla2xxx/qla_bsg.c | 47 +-
drivers/scsi/qla2xxx/qla_def.h | 2 +
drivers/scsi/qla2xxx/qla_fw.h | 4 +
drivers/scsi/qla2xxx/qla_init.c | 14 +
drivers/scsi/qla2xxx/qla_iocb.c | 23 +-
drivers/scsi/qla2xxx/qla_isr.c | 33 +-
drivers/scsi/qla2xxx/qla_mbx.c | 6 +-
drivers/scsi/qla2xxx/qla_mid.c | 49 +-
drivers/scsi/qla2xxx/qla_nvme.c | 10 +
drivers/scsi/qla2xxx/qla_os.c | 17 +-
drivers/scsi/scsi.c | 24 +-
drivers/scsi/sd_zbc.c | 8 +-
drivers/soc/qcom/mdt_loader.c | 4 +-
drivers/soundwire/cadence_master.c | 7 +
drivers/spi/spi-zynqmp-gqspi.c | 34 +
drivers/staging/media/rkvdec/rkvdec.c | 4 +-
drivers/staging/rtl8723bs/core/rtw_mlme.c | 5 +-
drivers/staging/sm750fb/sm750.c | 2 +-
drivers/staging/sm750fb/sm750.h | 2 +-
drivers/staging/sm750fb/sm750_accel.c | 6 +-
drivers/staging/sm750fb/sm750_accel.h | 4 +-
drivers/thermal/gov_step_wise.c | 10 +-
drivers/usb/cdns3/cdns3-gadget.c | 4 +-
drivers/usb/cdns3/cdnsp-gadget.c | 112 +-
drivers/usb/cdns3/cdnsp-gadget.h | 1 +
drivers/usb/cdns3/cdnsp-mem.c | 98 +-
drivers/usb/cdns3/core.h | 2 +-
drivers/usb/dwc3/core.h | 3 +-
drivers/usb/dwc3/ep0.c | 2 +-
drivers/usb/dwc3/gadget.c | 129 +-
drivers/usb/gadget/function/f_mass_storage.c | 3 +
drivers/usb/host/xhci-pci.c | 8 +-
drivers/usb/storage/realtek_cr.c | 9 +-
drivers/usb/typec/tcpm/tcpm.c | 39 +-
drivers/video/screen_info_generic.c | 36 +
drivers/virtio/virtio_mmio.c | 66 +-
drivers/watchdog/da9063_wdt.c | 4 +-
drivers/watchdog/digicolor_wdt.c | 13 +-
drivers/watchdog/msc313e_wdt.c | 16 +-
drivers/watchdog/rtd119x_wdt.c | 7 +-
drivers/watchdog/sp5100_tco.c | 6 +-
drivers/watchdog/starfive-wdt.c | 2 +-
fs/9p/vfs_addr.c | 12 +
fs/autofs/inode.c | 4 +
fs/btrfs/dev-replace.c | 1 +
fs/btrfs/file.c | 4 +-
fs/btrfs/tree-checker.c | 2 +-
fs/configfs/dir.c | 13 +-
fs/configfs/symlink.c | 51 +-
fs/erofs/fscache.c | 2 +
fs/erofs/sysfs.c | 2 +
fs/exec.c | 29 +-
fs/f2fs/debug.c | 4 -
fs/f2fs/dir.c | 7 +-
fs/f2fs/f2fs.h | 29 +-
fs/f2fs/file.c | 47 +-
fs/f2fs/gc.c | 51 +-
fs/f2fs/gc.h | 25 -
fs/f2fs/inline.c | 2 +-
fs/f2fs/namei.c | 6 +-
fs/f2fs/node.c | 22 +-
fs/f2fs/recovery.c | 41 +-
fs/f2fs/segment.c | 9 +-
fs/f2fs/super.c | 4 +-
fs/f2fs/sysfs.c | 18 +-
fs/fs-writeback.c | 25 +-
fs/inode.c | 11 +-
fs/kernfs/mount.c | 4 +-
fs/lockd/svcsubs.c | 2 +-
fs/ntfs3/inode.c | 7 +-
fs/ocfs2/namei.c | 9 +-
fs/ocfs2/xattr.c | 13 +-
fs/ocfs2/xattr.h | 8 +-
fs/pidfs.c | 43 +-
fs/smb/client/cached_dir.c | 32 +-
fs/smb/client/cifs_fs_sb.h | 1 +
fs/smb/client/cifsacl.c | 69 +-
fs/smb/client/cifsfs.c | 12 +
fs/smb/client/cifsglob.h | 12 +-
fs/smb/client/cifsproto.h | 8 +-
fs/smb/client/cifssmb.c | 2 +-
fs/smb/client/connect.c | 10 +
fs/smb/client/file.c | 11 +-
fs/smb/client/misc.c | 12 +-
fs/smb/client/reparse.c | 4 +-
fs/smb/client/reparse.h | 7 +-
fs/smb/client/sess.c | 106 +-
fs/smb/client/smb2inode.c | 11 +
fs/smb/client/smb2ops.c | 78 +-
fs/smb/client/smb2pdu.c | 64 +-
fs/smb/client/transport.c | 4 +-
fs/smb/server/smb2pdu.c | 89 +-
fs/smb/server/smb2pdu.h | 1 +
fs/squashfs/xz_wrapper.c | 6 +-
fs/super.c | 43 +-
fs/udf/inode.c | 129 +-
fs/xfs/libxfs/xfs_da_btree.c | 2 +-
fs/xfs/libxfs/xfs_da_btree.h | 2 +
fs/xfs/scrub/attr_repair.c | 4 +-
fs/xfs/scrub/dir_repair.c | 23 +-
fs/xfs/scrub/health.c | 6 +-
fs/xfs/scrub/inode.c | 2 +-
fs/xfs/scrub/inode_repair.c | 2 +-
fs/xfs/scrub/orphanage.c | 6 +-
fs/xfs/scrub/reap.c | 2 +-
fs/xfs/scrub/refcount.c | 8 +-
fs/xfs/scrub/scrub.h | 2 +-
fs/xfs/scrub/stats.c | 1 +
fs/xfs/scrub/tempfile.c | 29 +-
fs/xfs/xfs_exchrange.c | 13 +-
fs/xfs/xfs_icache.c | 2 +-
fs/xfs/xfs_inode.h | 3 +
fs/xfs/xfs_qm.c | 10 +-
include/drm/drm_client.h | 10 +-
include/drm/drm_fb_helper.h | 11 +-
include/drm/drm_file.h | 1 +
include/keys/request_key_auth-type.h | 2 +-
include/linux/bpf_mem_alloc.h | 6 +
include/linux/compiler-context-analysis.h | 32 +
include/linux/compiler_types.h | 18 +-
include/linux/dev_printk.h | 1 +
include/linux/dmaengine.h | 7 +
include/linux/firmware/qcom/qcom_scm.h | 20 +-
include/linux/ftrace.h | 5 +-
include/linux/if_vlan.h | 3 +
include/linux/ipv6.h | 40 +-
include/linux/libnvdimm.h | 9 +
include/linux/lockd/lockd.h | 2 +-
include/linux/netdevice.h | 3 +
include/linux/pci.h | 14 +-
include/linux/perf_event.h | 1 +
include/linux/rculist.h | 29 +
include/linux/sched.h | 16 +-
include/linux/sched/rt.h | 2 +
include/linux/sched/signal.h | 5 +-
include/linux/sched/user.h | 3 +-
include/linux/screen_info.h | 2 +
include/linux/skbuff.h | 24 +-
include/linux/soc/qcom/mdt_loader.h | 6 +-
include/linux/virtio.h | 2 +-
include/net/bluetooth/coredump.h | 2 +
include/net/cfg80211.h | 25 +
include/net/gue.h | 19 +-
include/net/if_inet6.h | 2 -
include/net/inet_connection_sock.h | 11 +-
include/net/inet_sock.h | 1 +
include/net/ip6_route.h | 8 +-
include/net/mac80211.h | 5 +-
include/net/netfilter/nf_conntrack.h | 5 +
include/net/netfilter/nf_conntrack_timeout.h | 27 +-
include/net/netfilter/nf_tables.h | 2 -
include/net/netmem.h | 78 +-
include/net/netns/xfrm.h | 2 +-
include/net/nfc/hci.h | 2 +-
include/net/nfc/nfc.h | 3 +-
include/net/page_pool/helpers.h | 35 +-
include/net/page_pool/types.h | 5 +-
include/net/rose.h | 12 +
include/net/sock.h | 8 +-
include/net/tcp.h | 4 +-
include/sound/soc.h | 3 +-
include/uapi/linux/landlock.h | 37 +-
include/uapi/linux/nl80211.h | 5 +
init/main.c | 27 +-
io_uring/net.c | 41 +-
io_uring/rw.c | 32 +-
io_uring/waitid.c | 44 +-
kernel/bpf/arraymap.c | 6 +-
kernel/bpf/btf.c | 140 +-
kernel/bpf/crypto.c | 5 +-
kernel/bpf/hashtab.c | 236 ++-
kernel/bpf/memalloc.c | 106 +-
kernel/bpf/offload.c | 2 +
kernel/bpf/syscall.c | 5 +-
kernel/cgroup/pids.c | 5 +
kernel/dma/coherent.c | 13 +-
kernel/dma/swiotlb.c | 4 +-
kernel/events/core.c | 15 +-
kernel/events/ring_buffer.c | 29 +-
kernel/futex/pi.c | 10 -
kernel/locking/rtmutex_api.c | 2 +
kernel/reboot.c | 55 +-
kernel/sched/core.c | 77 +-
kernel/sched/sched.h | 9 +-
kernel/signal.c | 24 +-
kernel/sysctl.c | 31 -
kernel/trace/ftrace.c | 57 +-
kernel/trace/ring_buffer.c | 135 +-
kernel/trace/trace.c | 155 +-
kernel/trace/trace.h | 131 +-
kernel/trace/trace_btf.c | 31 +-
kernel/trace/trace_btf.h | 3 +-
kernel/trace/trace_eprobe.c | 19 +-
kernel/trace/trace_events_hist.c | 167 +-
kernel/trace/trace_events_trigger.c | 344 ++--
kernel/trace/trace_functions.c | 2 +-
kernel/trace/trace_probe.c | 5 +-
kernel/trace/trace_stack.c | 2 +-
kernel/workqueue.c | 2 +-
mm/backing-dev.c | 5 +-
mm/damon/vaddr.c | 1 +
mm/huge_memory.c | 10 +
mm/hugetlb.c | 55 +-
mm/khugepaged.c | 6 -
mm/madvise.c | 8 +
mm/memblock.c | 18 +-
mm/mlock.c | 2 +-
mm/mremap.c | 12 +-
mm/rmap.c | 23 +-
mm/secretmem.c | 117 +-
mm/vma.c | 8 +
net/8021q/vlan_dev.c | 5 +
net/atm/pppoatm.c | 42 +-
net/bluetooth/bnep/core.c | 17 +-
net/bluetooth/bnep/netdev.c | 8 +-
net/bluetooth/coredump.c | 65 +-
net/bluetooth/eir.c | 10 +-
net/bluetooth/hci_codec.c | 36 +-
net/bluetooth/hci_conn.c | 14 +-
net/bluetooth/hci_core.c | 26 +-
net/bluetooth/hci_sock.c | 20 +-
net/bluetooth/hci_sync.c | 2 +
net/bluetooth/iso.c | 53 +-
net/bluetooth/l2cap_core.c | 10 +-
net/bluetooth/mgmt.c | 27 +-
net/bluetooth/rfcomm/core.c | 3 +-
net/bluetooth/rfcomm/sock.c | 19 +-
net/bluetooth/smp.c | 17 +
net/bridge/br_cfm.c | 11 +-
net/bridge/br_device.c | 1 -
net/bridge/br_input.c | 35 +-
net/bridge/br_mdb.c | 2 +
net/bridge/br_mrp.c | 13 +-
net/bridge/br_mst.c | 20 +-
net/bridge/br_private.h | 26 +-
net/bridge/br_stp_bpdu.c | 5 +-
net/core/dev.c | 2 +-
net/core/devmem.c | 1 +
net/core/drop_monitor.c | 4 +-
net/core/filter.c | 46 +-
net/core/neighbour.c | 241 ++-
net/core/page_pool.c | 9 +-
net/core/skbuff.c | 41 +-
net/core/skmsg.c | 4 +
net/core/sock.c | 25 +-
net/core/sock_map.c | 1 +
net/dccp/ipv6.c | 4 +-
net/dccp/timer.c | 4 +-
net/ipv4/arp.c | 1 +
net/ipv4/esp4.c | 6 +
net/ipv4/fib_semantics.c | 59 +-
net/ipv4/fou_core.c | 4 +
net/ipv4/icmp.c | 17 +-
net/ipv4/inet_connection_sock.c | 13 +-
net/ipv4/inet_diag.c | 4 +-
net/ipv4/ip_gre.c | 12 +
net/ipv4/ipconfig.c | 90 +-
net/ipv4/ipmr.c | 3 +-
net/ipv4/ipmr_base.c | 2 +-
net/ipv4/sysctl_net_ipv4.c | 4 +-
net/ipv4/tcp_input.c | 3 +-
net/ipv4/tcp_ipv4.c | 4 +-
net/ipv4/tcp_output.c | 3 +
net/ipv4/tcp_timer.c | 5 +-
net/ipv4/xfrm4_input.c | 2 -
net/ipv6/addrconf.c | 3 +-
net/ipv6/af_inet6.c | 2 +-
net/ipv6/esp6.c | 6 +
net/ipv6/exthdrs_core.c | 3 +
net/ipv6/inet6_connection_sock.c | 2 +-
net/ipv6/ip6_flowlabel.c | 67 +-
net/ipv6/ip6_gre.c | 2 +-
net/ipv6/ip6_output.c | 3 +-
net/ipv6/ip6mr.c | 2 +-
net/ipv6/ipv6_sockglue.c | 9 -
net/ipv6/mcast.c | 253 +--
net/ipv6/netfilter/ip6t_rpfilter.c | 2 +-
net/ipv6/netfilter/ip6t_rt.c | 11 +-
net/ipv6/route.c | 33 +-
net/ipv6/seg6.c | 4 +-
net/ipv6/seg6_local.c | 3 +
net/ipv6/tcp_ipv6.c | 21 +-
net/ipv6/xfrm6_input.c | 2 -
net/ipv6/xfrm6_output.c | 10 +-
net/llc/llc_c_ac.c | 2 +-
net/llc/llc_s_ac.c | 4 +
net/llc/llc_sap.c | 8 +-
net/mac80211/cfg.c | 55 +-
net/mac80211/debugfs.c | 2 +-
net/mac80211/debugfs_netdev.c | 9 +
net/mac80211/ieee80211_i.h | 5 +-
net/mac80211/iface.c | 76 +-
net/mac80211/main.c | 4 +
net/mac80211/mesh.c | 34 +-
net/mac80211/offchannel.c | 7 +
net/mac80211/pm.c | 8 +-
net/mac80211/scan.c | 24 +-
net/mac80211/tdls.c | 19 +-
net/mac80211/tx.c | 66 +-
net/mac80211/util.c | 3 +-
net/mctp/route.c | 2 +-
net/mptcp/Makefile | 2 +-
net/mptcp/ctrl.c | 4 +-
net/mptcp/mib.c | 5 +
net/mptcp/mib.h | 5 +
net/mptcp/options.c | 6 +-
net/mptcp/{pm_netlink.c => pm_kernel.c} | 71 +-
net/mptcp/pm_userspace.c | 32 +-
net/mptcp/protocol.c | 95 +-
net/mptcp/protocol.h | 36 +-
net/mptcp/subflow.c | 10 +-
net/netfilter/ipvs/ip_vs_core.c | 6 +
net/netfilter/nf_conntrack_core.c | 6 +-
net/netfilter/nf_conntrack_netlink.c | 3 +-
net/netfilter/nf_conntrack_timeout.c | 27 +-
net/netfilter/nf_flow_table_core.c | 12 +-
net/netfilter/nf_flow_table_offload.c | 7 +-
net/netfilter/nf_tables_api.c | 59 +-
net/netfilter/nfnetlink_cttimeout.c | 114 +-
net/netfilter/nfnetlink_queue.c | 8 +-
net/netfilter/nft_chain_filter.c | 50 +-
net/netfilter/nft_ct.c | 7 +-
net/netfilter/nft_nat.c | 2 +-
net/netfilter/nft_synproxy.c | 3 +-
net/netfilter/xt_CT.c | 2 +-
net/netlink/genetlink.c | 29 +-
net/nfc/core.c | 15 +-
net/nfc/digital_dep.c | 8 +-
net/nfc/llcp.h | 1 +
net/nfc/llcp_commands.c | 2 +-
net/nfc/llcp_core.c | 173 +-
net/nfc/llcp_sock.c | 67 +-
net/nfc/nci/core.c | 10 +-
net/nfc/netlink.c | 7 +-
net/nfc/nfc.h | 3 +-
net/openvswitch/conntrack.c | 39 +-
net/packet/af_packet.c | 108 +-
net/packet/internal.h | 2 +-
net/rds/ib_cm.c | 2 +-
net/rds/ib_frmr.c | 11 +-
net/rose/af_rose.c | 49 +-
net/rose/rose_in.c | 6 +
net/rose/rose_loopback.c | 61 +-
net/rose/rose_timer.c | 87 +-
net/sched/act_api.c | 13 +-
net/sched/act_ct.c | 41 +-
net/sched/act_gate.c | 30 +-
net/sched/cls_u32.c | 12 +-
net/sched/sch_hfsc.c | 22 +
net/sched/sch_hhf.c | 9 +-
net/sched/sch_teql.c | 7 +-
net/sctp/associola.c | 15 +-
net/sctp/input.c | 7 +-
net/sctp/ipv6.c | 8 +-
net/sctp/sm_sideeffect.c | 37 +-
net/sctp/sm_statefuns.c | 2 +
net/smc/smc.h | 6 +-
net/smc/smc_clc.h | 2 +-
net/smc/smc_core.c | 4 +-
net/smc/smc_core.h | 4 +-
net/smc/smc_ib.c | 10 +-
net/tipc/group.c | 4 +-
net/tipc/monitor.c | 3 +-
net/tls/tls_sw.c | 6 +-
net/wireless/chan.c | 389 ++---
net/wireless/core.c | 2 +
net/wireless/lib80211_crypt_tkip.c | 13 +-
net/wireless/nl80211.c | 60 +-
net/wireless/scan.c | 22 +-
net/wireless/util.c | 68 +-
net/xdp/xskmap.c | 2 +-
net/xfrm/espintcp.c | 6 +-
net/xfrm/xfrm_input.c | 63 +-
net/xfrm/xfrm_state.c | 9 +-
net/xfrm/xfrm_user.c | 37 +-
security/ipe/eval.c | 12 +-
security/ipe/eval.h | 2 +-
security/ipe/fs.c | 4 -
security/ipe/hooks.c | 22 +-
security/ipe/policy_fs.c | 4 +
security/keys/encrypted-keys/encrypted.c | 20 +-
security/keys/gc.c | 4 +-
security/keys/request_key_auth.c | 12 +-
security/keys/trusted-keys/trusted_tpm2.c | 12 +-
security/landlock/fs.c | 18 +-
security/landlock/net.c | 14 +
security/selinux/avc.c | 5 +-
security/selinux/hooks.c | 158 +-
security/selinux/include/objsec.h | 10 +-
sound/core/init.c | 3 +-
sound/core/pcm_timer.c | 7 +-
sound/hda/ext/hdac_ext_stream.c | 4 +-
sound/pci/hda/hda_controller.c | 2 +-
sound/pci/hda/patch_realtek.c | 9 +
sound/soc/codecs/aw88261.c | 30 +-
sound/soc/codecs/aw88261.h | 6 -
sound/soc/codecs/hdmi-codec.c | 6 +-
sound/soc/codecs/rt712-sdca-dmic.c | 14 +-
sound/soc/sdw_utils/soc_sdw_utils.c | 2 +-
sound/soc/soc-pcm.c | 18 +-
sound/soc/tegra/tegra210_mixer.c | 10 +-
sound/soc/ux500/ux500_msp_i2s.h | 4 +-
sound/usb/6fire/chip.c | 40 +-
sound/usb/6fire/comm.c | 42 +-
sound/usb/6fire/comm.h | 2 +-
sound/usb/6fire/midi.c | 64 +-
sound/usb/6fire/midi.h | 2 +-
sound/usb/6fire/pcm.c | 221 +--
sound/usb/6fire/pcm.h | 5 +-
sound/usb/bcd2000/bcd2000.c | 33 +-
sound/usb/card.h | 3 +-
sound/usb/endpoint.c | 16 +-
sound/virtio/virtio_card.c | 4 +-
tools/bootconfig/main.c | 32 +-
tools/lib/bpf/libbpf.c | 7 +
tools/lib/bpf/relo_core.c | 58 +-
tools/perf/tests/shell/stat_bpf_counters.sh | 2 +-
.../selftests/arm64/mte/check_gcr_el1_cswitch.c | 2 +-
.../testing/selftests/bpf/prog_tests/linked_list.c | 4 +-
tools/testing/selftests/bpf/progs/bpf_iter_tcp4.c | 4 +-
tools/testing/selftests/bpf/progs/bpf_iter_tcp6.c | 4 +-
tools/testing/selftests/cgroup/cgroup_util.c | 82 +-
tools/testing/selftests/cgroup/cgroup_util.h | 8 +-
tools/testing/selftests/cgroup/test_memcontrol.c | 78 +
.../ftrace/test.d/kprobe/kprobe_non_uniq_symbol.tc | 2 +-
tools/testing/selftests/landlock/fs_test.c | 1679 +++++++++++++++++++-
tools/testing/selftests/landlock/net_test.c | 169 +-
tools/testing/selftests/mm/memfd_secret.c | 30 +-
tools/testing/selftests/nci/nci_dev.c | 45 +-
virt/kvm/kvm_main.c | 30 +-
875 files changed, 14469 insertions(+), 7651 deletions(-)
^ permalink raw reply [flat|nested] 922+ messages in thread* [PATCH 6.12 001/877] Revert "hwmon: (emc1403) Drop hysteresis for low limit temperature" 2026-09-30 15:15 [PATCH 6.12 000/877] 6.12.112-rc1 review Greg Kroah-Hartman @ 2026-09-30 15:15 ` Greg Kroah-Hartman 2026-09-30 15:15 ` [PATCH 6.12 002/877] Revert "hwmon: (emc1403) Rely on subsystem locking" Greg Kroah-Hartman ` (883 subsequent siblings) 884 siblings, 0 replies; 922+ messages in thread From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw) To: stable; +Cc: Greg Kroah-Hartman, patches, Sasha Levin 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ This reverts commit 5cc075ffa1c986474c1f56ba6f869dcc41a363d4. Signed-off-by: Sasha Levin <sashal@kernel.org> --- Documentation/hwmon/emc1403.rst | 8 ++++---- drivers/hwmon/emc1403.c | 27 ++++++++++++++++----------- 2 files changed, 20 insertions(+), 15 deletions(-) diff --git a/Documentation/hwmon/emc1403.rst b/Documentation/hwmon/emc1403.rst index ebf2435a76a62..57f833b1a800e 100644 --- a/Documentation/hwmon/emc1403.rst +++ b/Documentation/hwmon/emc1403.rst @@ -71,10 +71,10 @@ and EMC14x8 support eight sensors (one internal, seven external). The chips implement three limits for each sensor: low (tempX_min), high (tempX_max) and critical (tempX_crit.) The chips also implement an -hysteresis mechanism which applies to high and critical limits. The relative -difference is stored in a single register on the chip, which means that the -relative difference between the limit and its hysteresis is always the same -for high and critical limits. +hysteresis mechanism which applies to all limits. The relative difference +is stored in a single register on the chip, which means that the relative +difference between the limit and its hysteresis is always the same for +all three limits. This implementation detail implies the following: diff --git a/drivers/hwmon/emc1403.c b/drivers/hwmon/emc1403.c index 39f69adb88c25..ccce948a4306e 100644 --- a/drivers/hwmon/emc1403.c +++ b/drivers/hwmon/emc1403.c @@ -305,9 +305,10 @@ static int emc1403_get_hyst(struct thermal_data *data, int channel, ret = regmap_read(data->regmap, 0x21, &hyst); if (ret < 0) return ret; - - *val = limit - hyst * 1000; - + if (map == temp_min) + *val = limit + hyst * 1000; + else + *val = limit - hyst * 1000; return 0; } @@ -323,6 +324,9 @@ static int emc1403_temp_read(struct thermal_data *data, u32 attr, int channel, l case hwmon_temp_input: ret = emc1403_get_temp(data, channel, ema1403_temp_map[attr], val); break; + case hwmon_temp_min_hyst: + ret = emc1403_get_hyst(data, channel, temp_min, val); + break; case hwmon_temp_max_hyst: ret = emc1403_get_hyst(data, channel, temp_max, val); break; @@ -544,6 +548,7 @@ static umode_t emc1403_temp_is_visible(const void *_data, u32 attr, int channel) case hwmon_temp_max_alarm: case hwmon_temp_crit_alarm: case hwmon_temp_fault: + case hwmon_temp_min_hyst: case hwmon_temp_max_hyst: return 0444; case hwmon_temp_min: @@ -586,35 +591,35 @@ static const struct hwmon_channel_info * const emc1403_info[] = { HWMON_CHANNEL_INFO(chip, HWMON_C_UPDATE_INTERVAL), HWMON_CHANNEL_INFO(temp, HWMON_T_INPUT | HWMON_T_MIN | HWMON_T_MAX | - HWMON_T_CRIT | HWMON_T_MAX_HYST | + HWMON_T_CRIT | HWMON_T_MIN_HYST | HWMON_T_MAX_HYST | HWMON_T_CRIT_HYST | HWMON_T_MIN_ALARM | HWMON_T_MAX_ALARM | HWMON_T_CRIT_ALARM, HWMON_T_INPUT | HWMON_T_MIN | HWMON_T_MAX | - HWMON_T_CRIT | HWMON_T_MAX_HYST | + HWMON_T_CRIT | HWMON_T_MIN_HYST | HWMON_T_MAX_HYST | HWMON_T_CRIT_HYST | HWMON_T_MIN_ALARM | HWMON_T_MAX_ALARM | HWMON_T_CRIT_ALARM | HWMON_T_FAULT, HWMON_T_INPUT | HWMON_T_MIN | HWMON_T_MAX | - HWMON_T_CRIT | HWMON_T_MAX_HYST | + HWMON_T_CRIT | HWMON_T_MIN_HYST | HWMON_T_MAX_HYST | HWMON_T_CRIT_HYST | HWMON_T_MIN_ALARM | HWMON_T_MAX_ALARM | HWMON_T_CRIT_ALARM | HWMON_T_FAULT, HWMON_T_INPUT | HWMON_T_MIN | HWMON_T_MAX | - HWMON_T_CRIT | HWMON_T_MAX_HYST | + HWMON_T_CRIT | HWMON_T_MIN_HYST | HWMON_T_MAX_HYST | HWMON_T_CRIT_HYST | HWMON_T_MIN_ALARM | HWMON_T_MAX_ALARM | HWMON_T_CRIT_ALARM | HWMON_T_FAULT, HWMON_T_INPUT | HWMON_T_MIN | HWMON_T_MAX | - HWMON_T_CRIT | HWMON_T_MAX_HYST | + HWMON_T_CRIT | HWMON_T_MIN_HYST | HWMON_T_MAX_HYST | HWMON_T_CRIT_HYST | HWMON_T_MIN_ALARM | HWMON_T_MAX_ALARM | HWMON_T_CRIT_ALARM | HWMON_T_FAULT, HWMON_T_INPUT | HWMON_T_MIN | HWMON_T_MAX | - HWMON_T_CRIT | HWMON_T_MAX_HYST | + HWMON_T_CRIT | HWMON_T_MIN_HYST | HWMON_T_MAX_HYST | HWMON_T_CRIT_HYST | HWMON_T_MIN_ALARM | HWMON_T_MAX_ALARM | HWMON_T_CRIT_ALARM | HWMON_T_FAULT, HWMON_T_INPUT | HWMON_T_MIN | HWMON_T_MAX | - HWMON_T_CRIT | HWMON_T_MAX_HYST | + HWMON_T_CRIT | HWMON_T_MIN_HYST | HWMON_T_MAX_HYST | HWMON_T_CRIT_HYST | HWMON_T_MIN_ALARM | HWMON_T_MAX_ALARM | HWMON_T_CRIT_ALARM | HWMON_T_FAULT, HWMON_T_INPUT | HWMON_T_MIN | HWMON_T_MAX | - HWMON_T_CRIT | HWMON_T_MAX_HYST | + HWMON_T_CRIT | HWMON_T_MIN_HYST | HWMON_T_MAX_HYST | HWMON_T_CRIT_HYST | HWMON_T_MIN_ALARM | HWMON_T_MAX_ALARM | HWMON_T_CRIT_ALARM | HWMON_T_FAULT ), -- 2.53.0 ^ permalink raw reply related [flat|nested] 922+ messages in thread
* [PATCH 6.12 002/877] Revert "hwmon: (emc1403) Rely on subsystem locking" 2026-09-30 15:15 [PATCH 6.12 000/877] 6.12.112-rc1 review Greg Kroah-Hartman 2026-09-30 15:15 ` [PATCH 6.12 001/877] Revert "hwmon: (emc1403) Drop hysteresis for low limit temperature" Greg Kroah-Hartman @ 2026-09-30 15:15 ` Greg Kroah-Hartman 2026-09-30 15:15 ` [PATCH 6.12 003/877] landlock: Fix TCP Fast Open connection bypass Greg Kroah-Hartman ` (882 subsequent siblings) 884 siblings, 0 replies; 922+ messages in thread From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw) To: stable; +Cc: Greg Kroah-Hartman, patches, Sasha Levin 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ This reverts commit 52dfb8be29d9918c40b512f3d65529f88304afe4. Signed-off-by: Sasha Levin <sashal@kernel.org> --- drivers/hwmon/emc1403.c | 46 ++++++++++++++++++++++++++++++++--------- 1 file changed, 36 insertions(+), 10 deletions(-) diff --git a/drivers/hwmon/emc1403.c b/drivers/hwmon/emc1403.c index ccce948a4306e..eca33220d34a0 100644 --- a/drivers/hwmon/emc1403.c +++ b/drivers/hwmon/emc1403.c @@ -17,6 +17,7 @@ #include <linux/hwmon-sysfs.h> #include <linux/err.h> #include <linux/sysfs.h> +#include <linux/mutex.h> #include <linux/regmap.h> #include <linux/util_macros.h> @@ -29,6 +30,7 @@ enum emc1403_chip { emc1402, emc1403, emc1404, emc1428 }; struct thermal_data { enum emc1403_chip chip; struct regmap *regmap; + struct mutex mutex; }; static ssize_t power_state_show(struct device *dev, struct device_attribute *attr, char *buf) @@ -266,8 +268,8 @@ static s8 emc1403_temp_regs_low[][4] = { }, }; -static int emc1403_get_temp(struct thermal_data *data, int channel, - enum emc1403_reg_map map, long *val) +static int __emc1403_get_temp(struct thermal_data *data, int channel, + enum emc1403_reg_map map, long *val) { unsigned int regvalh; unsigned int regvall = 0; @@ -293,23 +295,38 @@ static int emc1403_get_temp(struct thermal_data *data, int channel, return 0; } +static int emc1403_get_temp(struct thermal_data *data, int channel, + enum emc1403_reg_map map, long *val) +{ + int ret; + + mutex_lock(&data->mutex); + ret = __emc1403_get_temp(data, channel, map, val); + mutex_unlock(&data->mutex); + + return ret; +} + static int emc1403_get_hyst(struct thermal_data *data, int channel, enum emc1403_reg_map map, long *val) { int hyst, ret; long limit; - ret = emc1403_get_temp(data, channel, map, &limit); + mutex_lock(&data->mutex); + ret = __emc1403_get_temp(data, channel, map, &limit); if (ret < 0) - return ret; + goto unlock; ret = regmap_read(data->regmap, 0x21, &hyst); if (ret < 0) - return ret; + goto unlock; if (map == temp_min) *val = limit + hyst * 1000; else *val = limit - hyst * 1000; - return 0; +unlock: + mutex_unlock(&data->mutex); + return ret; } static int emc1403_temp_read(struct thermal_data *data, u32 attr, int channel, long *val) @@ -434,16 +451,20 @@ static int emc1403_set_hyst(struct thermal_data *data, long val) else val = clamp_val(val, 0, 255000); - ret = emc1403_get_temp(data, 0, temp_crit, &limit); + mutex_lock(&data->mutex); + ret = __emc1403_get_temp(data, 0, temp_crit, &limit); if (ret < 0) - return ret; + goto unlock; hyst = limit - val; if (data->chip == emc1428) hyst = clamp_val(DIV_ROUND_CLOSEST(hyst, 1000), 0, 127); else hyst = clamp_val(DIV_ROUND_CLOSEST(hyst, 1000), 0, 255); - return regmap_write(data->regmap, 0x21, hyst); + ret = regmap_write(data->regmap, 0x21, hyst); +unlock: + mutex_unlock(&data->mutex); + return ret; } static int emc1403_set_temp(struct thermal_data *data, int channel, @@ -457,6 +478,7 @@ static int emc1403_set_temp(struct thermal_data *data, int channel, regh = emc1403_temp_regs[channel][map]; regl = emc1403_temp_regs_low[channel][map]; + mutex_lock(&data->mutex); if (regl >= 0) { if (data->chip == emc1428) val = clamp_val(val, -128000, 127875); @@ -465,7 +487,7 @@ static int emc1403_set_temp(struct thermal_data *data, int channel, regval = DIV_ROUND_CLOSEST(val, 125); ret = regmap_write(data->regmap, regh, (regval >> 3) & 0xff); if (ret < 0) - return ret; + goto unlock; ret = regmap_write(data->regmap, regl, (regval & 0x07) << 5); } else { if (data->chip == emc1428) @@ -475,6 +497,8 @@ static int emc1403_set_temp(struct thermal_data *data, int channel, regval = DIV_ROUND_CLOSEST(val, 1000); ret = regmap_write(data->regmap, regh, regval); } +unlock: + mutex_unlock(&data->mutex); return ret; } @@ -671,6 +695,8 @@ static int emc1403_probe(struct i2c_client *client) if (IS_ERR(data->regmap)) return PTR_ERR(data->regmap); + mutex_init(&data->mutex); + hwmon_dev = devm_hwmon_device_register_with_info(&client->dev, client->name, data, &emc1403_chip_info, -- 2.53.0 ^ permalink raw reply related [flat|nested] 922+ messages in thread
* [PATCH 6.12 003/877] landlock: Fix TCP Fast Open connection bypass 2026-09-30 15:15 [PATCH 6.12 000/877] 6.12.112-rc1 review Greg Kroah-Hartman 2026-09-30 15:15 ` [PATCH 6.12 001/877] Revert "hwmon: (emc1403) Drop hysteresis for low limit temperature" Greg Kroah-Hartman 2026-09-30 15:15 ` [PATCH 6.12 002/877] Revert "hwmon: (emc1403) Rely on subsystem locking" Greg Kroah-Hartman @ 2026-09-30 15:15 ` Greg Kroah-Hartman 2026-09-30 15:15 ` [PATCH 6.12 004/877] selftests/landlock: Add test for TCP fast open Greg Kroah-Hartman ` (881 subsequent siblings) 884 siblings, 0 replies; 922+ messages in thread From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw) To: stable Cc: Greg Kroah-Hartman, patches, Matthieu Buffet, Mickaël Salaün, Sasha Levin 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Matthieu Buffet <matthieu@buffet.re> [ Upstream commit 33cb713db0161b54f04fe830e062c9e102c29a04 ] The documentation of the socket_connect() LSM hook states that it controls connecting a socket to a remote address. It has not been the case since the addition of TCP Fast Open (RFC 7413) support, which allows opening a TCP connection (thus, setting a socket's destination address) via the MSG_FASTOPEN flag passed to sendto()/sendmsg()/sendmmsg(). The problem then got duplicated into MPTCP. Landlock did not take it into account when its TCP support was added, leaving a bypass of TCP connect policy. Ideally a call to the LSM hook would be added in the fastopen code path, in order to fix this generically. But connect() hooks are designed to run with the socket locked, unlike sendmsg() hooks. Closes: https://github.com/landlock-lsm/linux/issues/41 Fixes: fff69fb03dde ("landlock: Support network rules with TCP bind and connect") Signed-off-by: Matthieu Buffet <matthieu@buffet.re> Link: https://patch.msgid.link/20260701214628.33319-1-matthieu@buffet.re Cc: stable@vger.kernel.org [mic: Wrap commit message] Signed-off-by: Mickaël Salaün <mic@digikod.net> [mic: Backport: adapt the TCP Fast Open check to the TCP-only network hooks] Signed-off-by: Mickaël Salaün <mic@digikod.net> Signed-off-by: Sasha Levin <sashal@kernel.org> --- security/landlock/net.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/security/landlock/net.c b/security/landlock/net.c index 9c9608924fbdb..c5c26e9029924 100644 --- a/security/landlock/net.c +++ b/security/landlock/net.c @@ -193,9 +193,23 @@ static int hook_socket_connect(struct socket *const sock, LANDLOCK_ACCESS_NET_CONNECT_TCP); } +static int hook_socket_sendmsg(struct socket *const sock, + struct msghdr *const msg, const int size) +{ + struct sockaddr *const address = msg->msg_name; + + if ((msg->msg_flags & MSG_FASTOPEN) && address) + return current_check_access_socket( + sock, address, msg->msg_namelen, + LANDLOCK_ACCESS_NET_CONNECT_TCP); + + return 0; +} + static struct security_hook_list landlock_hooks[] __ro_after_init = { LSM_HOOK_INIT(socket_bind, hook_socket_bind), LSM_HOOK_INIT(socket_connect, hook_socket_connect), + LSM_HOOK_INIT(socket_sendmsg, hook_socket_sendmsg), }; __init void landlock_add_net_hooks(void) -- 2.53.0 ^ permalink raw reply related [flat|nested] 922+ messages in thread
* [PATCH 6.12 004/877] selftests/landlock: Add test for TCP fast open 2026-09-30 15:15 [PATCH 6.12 000/877] 6.12.112-rc1 review Greg Kroah-Hartman ` (2 preceding siblings ...) 2026-09-30 15:15 ` [PATCH 6.12 003/877] landlock: Fix TCP Fast Open connection bypass Greg Kroah-Hartman @ 2026-09-30 15:15 ` Greg Kroah-Hartman 2026-09-30 15:15 ` [PATCH 6.12 005/877] selftests/landlock: Add missing connect(minimal AF_UNSPEC) test Greg Kroah-Hartman ` (880 subsequent siblings) 884 siblings, 0 replies; 922+ messages in thread From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw) To: stable Cc: Greg Kroah-Hartman, patches, Matthieu Buffet, Mickaël Salaün, Sasha Levin 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Matthieu Buffet <matthieu@buffet.re> [ Upstream commit f4b30e0b1d488e7ffd8ea28d1365b9ba8e551edb ] Enforce that TCP Fast Open is controlled by LANDLOCK_ACCESS_NET_CONNECT_TCP. Semantics of connect() and sendmsg(MSG_FASTOPEN) should be identical from Landlock's perspective. Also enforce error code consistency, since UDP sockets ignore the MSG_FASTOPEN flag while Unix sockets reject it. Signed-off-by: Matthieu Buffet <matthieu@buffet.re> Link: https://patch.msgid.link/20260701214628.33319-2-matthieu@buffet.re Cc: stable@vger.kernel.org [mic: Fix formatting] Signed-off-by: Mickaël Salaün <mic@digikod.net> [mic: Backport: adapt the test to the older network fixture and add the required send helper] Signed-off-by: Mickaël Salaün <mic@digikod.net> Signed-off-by: Sasha Levin <sashal@kernel.org> --- tools/testing/selftests/landlock/net_test.c | 155 ++++++++++++++++++++ 1 file changed, 155 insertions(+) diff --git a/tools/testing/selftests/landlock/net_test.c b/tools/testing/selftests/landlock/net_test.c index 897131bc8a13b..63b1e655afb25 100644 --- a/tools/testing/selftests/landlock/net_test.c +++ b/tools/testing/selftests/landlock/net_test.c @@ -257,6 +257,64 @@ static int connect_variant(const int sock_fd, return connect_variant_addrlen(sock_fd, srv, get_addrlen(srv, false)); } +static int sendto_variant_addrlen(const int sock_fd, + const struct service_fixture *const srv, + const socklen_t addrlen, void *buf, + size_t len, size_t flags) +{ + const struct sockaddr *dst = NULL; + ssize_t ret; + + /* + * We never want our processes to be killed by SIGPIPE: we check return + * codes and errno, so that we have actual error messages. + */ + flags |= MSG_NOSIGNAL; + + if (srv != NULL) { + switch (srv->protocol.domain) { + case AF_UNSPEC: + case AF_INET: + dst = (const struct sockaddr *)&srv->ipv4_addr; + break; + + case AF_INET6: + dst = (const struct sockaddr *)&srv->ipv6_addr; + break; + + case AF_UNIX: + dst = (const struct sockaddr *)&srv->unix_addr; + break; + + default: + errno = EAFNOSUPPORT; + return -errno; + } + } + + ret = sendto(sock_fd, buf, len, flags, dst, addrlen); + if (ret < 0) + return -errno; + + /* errno is not set in cases of partial writes. */ + if (ret != len) + return -EINTR; + + return 0; +} + +static int sendto_variant(const int sock_fd, + const struct service_fixture *const srv, void *buf, + size_t len, size_t flags) +{ + socklen_t addrlen = 0; + + if (srv != NULL) + addrlen = get_addrlen(srv, false); + + return sendto_variant_addrlen(sock_fd, srv, addrlen, buf, len, flags); +} + FIXTURE(protocol) { struct service_fixture srv0, srv1, srv2, unspec_any0, unspec_srv0; @@ -937,6 +995,103 @@ TEST_F(protocol, connect_unspec) EXPECT_EQ(0, close(bind_fd)); } +TEST_F(protocol, tcp_fastopen) +{ + const bool restricted = variant->sandbox == TCP_SANDBOX && + variant->prot.type == SOCK_STREAM && + (variant->prot.protocol == IPPROTO_TCP || + variant->prot.protocol == IPPROTO_IP) && + (variant->prot.domain == AF_INET || + variant->prot.domain == AF_INET6); + const struct landlock_ruleset_attr ruleset_attr = { + .handled_access_net = LANDLOCK_ACCESS_NET_CONNECT_TCP, + }; + int bind_fd, client_fd, status; + char buf; + pid_t child; + + bind_fd = socket_variant(&self->srv0); + ASSERT_LE(0, bind_fd); + EXPECT_EQ(0, bind_variant(bind_fd, &self->srv0)); + if (self->srv0.protocol.type == SOCK_STREAM) + EXPECT_EQ(0, listen(bind_fd, backlog)); + + child = fork(); + ASSERT_LE(0, child); + if (child == 0) { + int connect_fd, ret; + + /* Closes listening socket for the child. */ + EXPECT_EQ(0, close(bind_fd)); + + connect_fd = socket_variant(&self->srv0); + ASSERT_LE(0, connect_fd); + + if (variant->sandbox == TCP_SANDBOX) { + const int ruleset_fd = landlock_create_ruleset( + &ruleset_attr, sizeof(ruleset_attr), 0); + ASSERT_LE(0, ruleset_fd); + + enforce_ruleset(_metadata, ruleset_fd); + EXPECT_EQ(0, close(ruleset_fd)); + } + + /* Fast Open with no address. */ + ret = sendto_variant(connect_fd, NULL, NULL, 0, MSG_FASTOPEN); + if (self->srv0.protocol.domain == AF_UNIX) { + EXPECT_EQ(-ENOTCONN, ret); + } else if (self->srv0.protocol.type == SOCK_DGRAM) { + EXPECT_EQ(-EDESTADDRREQ, ret); + } else { + EXPECT_EQ(-EINVAL, ret); + } + + /* Fast Open to a denied address. */ + ret = sendto_variant(connect_fd, &self->srv0, "A", 1, + MSG_FASTOPEN); + if (restricted) { + EXPECT_EQ(-EACCES, ret); + } else if (self->srv0.protocol.domain == AF_UNIX && + self->srv0.protocol.type == SOCK_STREAM) { + EXPECT_EQ(-EOPNOTSUPP, ret); + } else { + EXPECT_EQ(0, ret); + } + + EXPECT_EQ(0, close(connect_fd)); + _exit(_metadata->exit_code); + return; + } + + client_fd = bind_fd; + if (!restricted && self->srv0.protocol.type == SOCK_STREAM && + self->srv0.protocol.domain != AF_UNIX) { + client_fd = accept(bind_fd, NULL, 0); + ASSERT_LE(0, client_fd); + } + + if (restricted) { + EXPECT_EQ(-1, read(client_fd, &buf, 1)); + EXPECT_EQ(ENOTCONN, errno); + } else if (self->srv0.protocol.domain == AF_UNIX && + self->srv0.protocol.type == SOCK_STREAM) { + EXPECT_EQ(-1, read(client_fd, &buf, 1)); + EXPECT_EQ(EINVAL, errno); + } else { + EXPECT_EQ(1, read(client_fd, &buf, 1)); + EXPECT_EQ('A', buf); + } + + EXPECT_EQ(child, waitpid(child, &status, 0)); + EXPECT_EQ(1, WIFEXITED(status)); + EXPECT_EQ(EXIT_SUCCESS, WEXITSTATUS(status)); + + if (client_fd != bind_fd) + EXPECT_LE(0, close(client_fd)); + + EXPECT_EQ(0, close(bind_fd)); +} + FIXTURE(ipv4) { struct service_fixture srv0, srv1; -- 2.53.0 ^ permalink raw reply related [flat|nested] 922+ messages in thread
* [PATCH 6.12 005/877] selftests/landlock: Add missing connect(minimal AF_UNSPEC) test 2026-09-30 15:15 [PATCH 6.12 000/877] 6.12.112-rc1 review Greg Kroah-Hartman ` (3 preceding siblings ...) 2026-09-30 15:15 ` [PATCH 6.12 004/877] selftests/landlock: Add test for TCP fast open Greg Kroah-Hartman @ 2026-09-30 15:15 ` Greg Kroah-Hartman 2026-09-30 15:15 ` [PATCH 6.12 006/877] selftests/landlock: Add tests for access through disconnected paths Greg Kroah-Hartman ` (879 subsequent siblings) 884 siblings, 0 replies; 922+ messages in thread From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw) To: stable Cc: Greg Kroah-Hartman, patches, Matthieu Buffet, Mickaël Salaün, Sasha Levin 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Matthieu Buffet <matthieu@buffet.re> [ Upstream commit 6685201ebfacff0c889bcd569181fa6e8af5575e ] connect_variant(unspec_any0) is called twice. Both calls end up in connect_variant_addrlen() with an address length of get_addrlen(minimal=false). However, the connect() syscall and its variants (e.g. iouring/compat) accept much shorter addresses of 4 bytes and that behaviour was not tested. Replace one of these calls with one using a minimal address length (just a bare sa_family=AF_UNSPEC field with no actual address). Also add a call using a truncated address for good measure. Signed-off-by: Matthieu Buffet <matthieu@buffet.re> Link: https://lore.kernel.org/r/20251027190726.626244-3-matthieu@buffet.re Signed-off-by: Mickaël Salaün <mic@digikod.net> Signed-off-by: Sasha Levin <sashal@kernel.org> --- tools/testing/selftests/landlock/net_test.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/tools/testing/selftests/landlock/net_test.c b/tools/testing/selftests/landlock/net_test.c index 63b1e655afb25..0be69fcc4efbe 100644 --- a/tools/testing/selftests/landlock/net_test.c +++ b/tools/testing/selftests/landlock/net_test.c @@ -963,7 +963,19 @@ TEST_F(protocol, connect_unspec) EXPECT_EQ(0, close(ruleset_fd)); } - ret = connect_variant(connect_fd, &self->unspec_any0); + /* Try to re-disconnect with a truncated address struct. */ + EXPECT_EQ(-EINVAL, + connect_variant_addrlen( + connect_fd, &self->unspec_any0, + get_addrlen(&self->unspec_any0, true) - 1)); + + /* + * Re-disconnect, with a minimal sockaddr struct (just a + * bare af_family=AF_UNSPEC field). + */ + ret = connect_variant_addrlen(connect_fd, &self->unspec_any0, + get_addrlen(&self->unspec_any0, + true)); if (self->srv0.protocol.domain == AF_UNIX && self->srv0.protocol.type == SOCK_STREAM) { EXPECT_EQ(-EINVAL, ret); -- 2.53.0 ^ permalink raw reply related [flat|nested] 922+ messages in thread
* [PATCH 6.12 006/877] selftests/landlock: Add tests for access through disconnected paths 2026-09-30 15:15 [PATCH 6.12 000/877] 6.12.112-rc1 review Greg Kroah-Hartman ` (4 preceding siblings ...) 2026-09-30 15:15 ` [PATCH 6.12 005/877] selftests/landlock: Add missing connect(minimal AF_UNSPEC) test Greg Kroah-Hartman @ 2026-09-30 15:15 ` Greg Kroah-Hartman 2026-09-30 15:15 ` [PATCH 6.12 007/877] selftests/landlock: Add disconnected leafs and branch test suites Greg Kroah-Hartman ` (878 subsequent siblings) 884 siblings, 0 replies; 922+ messages in thread From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw) To: stable Cc: Greg Kroah-Hartman, patches, Günther Noack, Song Liu, Tingmao Wang, Mickaël Salaün, Sasha Levin 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Tingmao Wang <m@maowtm.org> [ Upstream commit a18ee3f31fd714173a62515d049d77e76ab55649 ] This adds tests for the edge case discussed in [1], with specific ones for rename and link operations when the operands are through disconnected paths, as that go through a separate code path in Landlock. This has resulted in a warning, due to collect_domain_accesses() not expecting to reach a different root from path->mnt: # RUN layout1_bind.path_disconnected ... # OK layout1_bind.path_disconnected ok 96 layout1_bind.path_disconnected # RUN layout1_bind.path_disconnected_rename ... [..] ------------[ cut here ]------------ [..] WARNING: CPU: 3 PID: 385 at security/landlock/fs.c:1065 collect_domain_accesses [..] ... [..] RIP: 0010:collect_domain_accesses (security/landlock/fs.c:1065 (discriminator 2) security/landlock/fs.c:1031 (discriminator 2)) [..] current_check_refer_path (security/landlock/fs.c:1205) [..] ... [..] hook_path_rename (security/landlock/fs.c:1526) [..] security_path_rename (security/security.c:2026 (discriminator 1)) [..] do_renameat2 (fs/namei.c:5264) # OK layout1_bind.path_disconnected_rename ok 97 layout1_bind.path_disconnected_rename Move the const char definitions a bit above so that we can use the path for s4d1 in cleanup code. Cc: Günther Noack <gnoack@google.com> Cc: Song Liu <song@kernel.org> Link: https://lore.kernel.org/r/027d5190-b37a-40a8-84e9-4ccbc352bcdf@maowtm.org [1] Signed-off-by: Tingmao Wang <m@maowtm.org> Link: https://lore.kernel.org/r/20251128172200.760753-4-mic@digikod.net Signed-off-by: Mickaël Salaün <mic@digikod.net> Signed-off-by: Sasha Levin <sashal@kernel.org> --- tools/testing/selftests/landlock/fs_test.c | 423 ++++++++++++++++++++- 1 file changed, 415 insertions(+), 8 deletions(-) diff --git a/tools/testing/selftests/landlock/fs_test.c b/tools/testing/selftests/landlock/fs_test.c index c781014e6a5c6..1109d0e932336 100644 --- a/tools/testing/selftests/landlock/fs_test.c +++ b/tools/testing/selftests/landlock/fs_test.c @@ -4363,6 +4363,18 @@ TEST_F_FORK(ioctl, handle_file_access_file) FIXTURE(layout1_bind) {}; /* clang-format on */ +static const char bind_dir_s1d3[] = TMP_DIR "/s2d1/s2d2/s1d3"; +static const char bind_file1_s1d3[] = TMP_DIR "/s2d1/s2d2/s1d3/f1"; + +/* Move targets for disconnected path tests. */ +static const char dir_s4d1[] = TMP_DIR "/s4d1"; +static const char file1_s4d1[] = TMP_DIR "/s4d1/f1"; +static const char file2_s4d1[] = TMP_DIR "/s4d1/f2"; +static const char dir_s4d2[] = TMP_DIR "/s4d1/s4d2"; +static const char file1_s4d2[] = TMP_DIR "/s4d1/s4d2/f1"; +static const char file1_name[] = "f1"; +static const char file2_name[] = "f2"; + FIXTURE_SETUP(layout1_bind) { prepare_layout(_metadata); @@ -4378,14 +4390,14 @@ FIXTURE_TEARDOWN_PARENT(layout1_bind) { /* umount(dir_s2d2)) is handled by namespace lifetime. */ + remove_path(file1_s4d1); + remove_path(file2_s4d1); + remove_layout1(_metadata); cleanup_layout(_metadata); } -static const char bind_dir_s1d3[] = TMP_DIR "/s2d1/s2d2/s1d3"; -static const char bind_file1_s1d3[] = TMP_DIR "/s2d1/s2d2/s1d3/f1"; - /* * layout1_bind hierarchy: * @@ -4396,20 +4408,25 @@ static const char bind_file1_s1d3[] = TMP_DIR "/s2d1/s2d2/s1d3/f1"; * │ └── s1d2 * │ ├── f1 * │ ├── f2 - * │ └── s1d3 + * │ └── s1d3 [disconnected by path_disconnected] * │ ├── f1 * │ └── f2 * ├── s2d1 * │ ├── f1 - * │ └── s2d2 + * │ └── s2d2 [bind mount from s1d2] * │ ├── f1 * │ ├── f2 * │ └── s1d3 * │ ├── f1 * │ └── f2 - * └── s3d1 - * └── s3d2 - * └── s3d3 + * ├── s3d1 + * │ └── s3d2 + * │ └── s3d3 + * └── s4d1 [renamed from s1d3 by path_disconnected] + * ├── f1 + * ├── f2 + * └── s4d2 + * └── f1 */ TEST_F_FORK(layout1_bind, no_restriction) @@ -4608,6 +4625,396 @@ TEST_F_FORK(layout1_bind, reparent_cross_mount) ASSERT_EQ(0, rename(bind_file1_s1d3, file1_s2d2)); } +/* + * Make sure access to file through a disconnected path works as expected. + * This test moves s1d3 to s4d1. + */ +TEST_F_FORK(layout1_bind, path_disconnected) +{ + const struct rule layer1_allow_all[] = { + { + .path = TMP_DIR, + .access = ACCESS_ALL, + }, + {}, + }; + const struct rule layer2_allow_just_f1[] = { + { + .path = file1_s1d3, + .access = LANDLOCK_ACCESS_FS_READ_FILE, + }, + {}, + }; + const struct rule layer3_only_s1d2[] = { + { + .path = dir_s1d2, + .access = LANDLOCK_ACCESS_FS_READ_FILE, + }, + {}, + }; + + /* Landlock should not deny access just because it is disconnected. */ + int ruleset_fd_l1 = + create_ruleset(_metadata, ACCESS_ALL, layer1_allow_all); + + /* Creates the new ruleset now before we move the dir containing the file. */ + int ruleset_fd_l2 = + create_ruleset(_metadata, ACCESS_RW, layer2_allow_just_f1); + int ruleset_fd_l3 = + create_ruleset(_metadata, ACCESS_RW, layer3_only_s1d2); + int bind_s1d3_fd; + + ASSERT_LE(0, ruleset_fd_l1); + ASSERT_LE(0, ruleset_fd_l2); + ASSERT_LE(0, ruleset_fd_l3); + + enforce_ruleset(_metadata, ruleset_fd_l1); + EXPECT_EQ(0, close(ruleset_fd_l1)); + + bind_s1d3_fd = open(bind_dir_s1d3, O_PATH | O_CLOEXEC); + ASSERT_LE(0, bind_s1d3_fd); + + /* Tests access is possible before we move. */ + EXPECT_EQ(0, test_open_rel(bind_s1d3_fd, file1_name, O_RDONLY)); + EXPECT_EQ(0, test_open_rel(bind_s1d3_fd, file2_name, O_RDONLY)); + EXPECT_EQ(0, test_open_rel(bind_s1d3_fd, "..", O_RDONLY | O_DIRECTORY)); + + /* Makes it disconnected. */ + ASSERT_EQ(0, rename(dir_s1d3, dir_s4d1)) + { + TH_LOG("Failed to rename %s to %s: %s", dir_s1d3, dir_s4d1, + strerror(errno)); + } + + /* Tests that access is still possible. */ + EXPECT_EQ(0, test_open_rel(bind_s1d3_fd, file1_name, O_RDONLY)); + EXPECT_EQ(0, test_open_rel(bind_s1d3_fd, file2_name, O_RDONLY)); + + /* + * Tests that ".." is not possible (not because of Landlock, but just + * because it's disconnected). + */ + EXPECT_EQ(ENOENT, + test_open_rel(bind_s1d3_fd, "..", O_RDONLY | O_DIRECTORY)); + + /* This should still work with a narrower rule. */ + enforce_ruleset(_metadata, ruleset_fd_l2); + EXPECT_EQ(0, close(ruleset_fd_l2)); + + EXPECT_EQ(0, test_open(file1_s4d1, O_RDONLY)); + /* + * Accessing a file through a disconnected file descriptor can still be + * allowed by a rule tied to this file, even if it is no longer visible in + * its mount point. + */ + EXPECT_EQ(0, test_open_rel(bind_s1d3_fd, file1_name, O_RDONLY)); + EXPECT_EQ(EACCES, test_open_rel(bind_s1d3_fd, file2_name, O_RDONLY)); + + enforce_ruleset(_metadata, ruleset_fd_l3); + EXPECT_EQ(0, close(ruleset_fd_l3)); + + EXPECT_EQ(EACCES, test_open(file1_s4d1, O_RDONLY)); + /* + * Accessing a file through a disconnected file descriptor can still be + * allowed by a rule tied to the original mount point, even if it is no + * longer visible in its mount point. + */ + EXPECT_EQ(0, test_open_rel(bind_s1d3_fd, file1_name, O_RDONLY)); + EXPECT_EQ(EACCES, test_open_rel(bind_s1d3_fd, file2_name, O_RDONLY)); +} + +/* + * Test that renameat with disconnected paths works under Landlock. This test + * moves s1d3 to s4d2, so that we can have a rule allowing refers on the move + * target's immediate parent. + */ +TEST_F_FORK(layout1_bind, path_disconnected_rename) +{ + const struct rule layer1[] = { + { + .path = dir_s1d2, + .access = LANDLOCK_ACCESS_FS_REFER | + LANDLOCK_ACCESS_FS_MAKE_DIR | + LANDLOCK_ACCESS_FS_REMOVE_DIR | + LANDLOCK_ACCESS_FS_MAKE_REG | + LANDLOCK_ACCESS_FS_REMOVE_FILE | + LANDLOCK_ACCESS_FS_READ_FILE, + }, + { + .path = dir_s4d1, + .access = LANDLOCK_ACCESS_FS_REFER | + LANDLOCK_ACCESS_FS_MAKE_DIR | + LANDLOCK_ACCESS_FS_REMOVE_DIR | + LANDLOCK_ACCESS_FS_MAKE_REG | + LANDLOCK_ACCESS_FS_REMOVE_FILE | + LANDLOCK_ACCESS_FS_READ_FILE, + }, + {} + }; + + /* This layer only handles LANDLOCK_ACCESS_FS_READ_FILE. */ + const struct rule layer2_only_s1d2[] = { + { + .path = dir_s1d2, + .access = LANDLOCK_ACCESS_FS_READ_FILE, + }, + {}, + }; + int ruleset_fd_l1, ruleset_fd_l2; + pid_t child_pid; + int bind_s1d3_fd, status; + + ASSERT_EQ(0, mkdir(dir_s4d1, 0755)) + { + TH_LOG("Failed to create %s: %s", dir_s4d1, strerror(errno)); + } + ruleset_fd_l1 = create_ruleset(_metadata, ACCESS_ALL, layer1); + ruleset_fd_l2 = create_ruleset(_metadata, LANDLOCK_ACCESS_FS_READ_FILE, + layer2_only_s1d2); + ASSERT_LE(0, ruleset_fd_l1); + ASSERT_LE(0, ruleset_fd_l2); + + enforce_ruleset(_metadata, ruleset_fd_l1); + EXPECT_EQ(0, close(ruleset_fd_l1)); + + bind_s1d3_fd = open(bind_dir_s1d3, O_PATH | O_CLOEXEC); + ASSERT_LE(0, bind_s1d3_fd); + EXPECT_EQ(0, test_open_rel(bind_s1d3_fd, file1_name, O_RDONLY)); + + /* Tests ENOENT priority over EACCES for disconnected directory. */ + EXPECT_EQ(EACCES, test_open_rel(bind_s1d3_fd, "..", O_DIRECTORY)); + ASSERT_EQ(0, rename(dir_s1d3, dir_s4d2)) + { + TH_LOG("Failed to rename %s to %s: %s", dir_s1d3, dir_s4d2, + strerror(errno)); + } + EXPECT_EQ(ENOENT, test_open_rel(bind_s1d3_fd, "..", O_DIRECTORY)); + + /* + * The file is no longer under s1d2 but we should still be able to access it + * with layer 2 because its mount point is evaluated as the first valid + * directory because it was initially a parent. Do a fork to test this so + * we don't prevent ourselves from renaming it back later. + */ + child_pid = fork(); + ASSERT_LE(0, child_pid); + if (child_pid == 0) { + enforce_ruleset(_metadata, ruleset_fd_l2); + EXPECT_EQ(0, close(ruleset_fd_l2)); + EXPECT_EQ(0, test_open_rel(bind_s1d3_fd, file1_name, O_RDONLY)); + EXPECT_EQ(EACCES, test_open(file1_s4d2, O_RDONLY)); + + /* + * Tests that access widening checks indeed prevents us from renaming it + * back. + */ + EXPECT_EQ(-1, rename(dir_s4d2, dir_s1d3)); + EXPECT_EQ(EXDEV, errno); + + /* + * Including through the now disconnected fd (but it should return + * EXDEV). + */ + EXPECT_EQ(-1, renameat(bind_s1d3_fd, file1_name, AT_FDCWD, + file1_s2d2)); + EXPECT_EQ(EXDEV, errno); + _exit(_metadata->exit_code); + return; + } + + EXPECT_EQ(child_pid, waitpid(child_pid, &status, 0)); + EXPECT_EQ(1, WIFEXITED(status)); + EXPECT_EQ(EXIT_SUCCESS, WEXITSTATUS(status)); + + ASSERT_EQ(0, rename(dir_s4d2, dir_s1d3)) + { + TH_LOG("Failed to rename %s back to %s: %s", dir_s4d1, dir_s1d3, + strerror(errno)); + } + + /* Now checks that we can access it under l2. */ + child_pid = fork(); + ASSERT_LE(0, child_pid); + if (child_pid == 0) { + enforce_ruleset(_metadata, ruleset_fd_l2); + EXPECT_EQ(0, close(ruleset_fd_l2)); + EXPECT_EQ(0, test_open_rel(bind_s1d3_fd, file1_name, O_RDONLY)); + EXPECT_EQ(0, test_open(file1_s1d3, O_RDONLY)); + _exit(_metadata->exit_code); + return; + } + + EXPECT_EQ(child_pid, waitpid(child_pid, &status, 0)); + EXPECT_EQ(1, WIFEXITED(status)); + EXPECT_EQ(EXIT_SUCCESS, WEXITSTATUS(status)); + + /* + * Also test that we can rename via a disconnected path. We move the + * dir back to the disconnected place first, then we rename file1 to + * file2 through our dir fd. + */ + ASSERT_EQ(0, rename(dir_s1d3, dir_s4d2)) + { + TH_LOG("Failed to rename %s to %s: %s", dir_s1d3, dir_s4d2, + strerror(errno)); + } + ASSERT_EQ(0, + renameat(bind_s1d3_fd, file1_name, bind_s1d3_fd, file2_name)) + { + TH_LOG("Failed to rename %s to %s within disconnected %s: %s", + file1_name, file2_name, bind_dir_s1d3, strerror(errno)); + } + EXPECT_EQ(0, test_open_rel(bind_s1d3_fd, file2_name, O_RDONLY)); + ASSERT_EQ(0, renameat(bind_s1d3_fd, file2_name, AT_FDCWD, file1_s2d2)) + { + TH_LOG("Failed to rename %s to %s through disconnected %s: %s", + file2_name, file1_s2d2, bind_dir_s1d3, strerror(errno)); + } + EXPECT_EQ(0, test_open(file1_s2d2, O_RDONLY)); + EXPECT_EQ(0, test_open(file1_s1d2, O_RDONLY)); + + /* Move it back using the disconnected path as the target. */ + ASSERT_EQ(0, renameat(AT_FDCWD, file1_s2d2, bind_s1d3_fd, file1_name)) + { + TH_LOG("Failed to rename %s to %s through disconnected %s: %s", + file1_s1d2, file1_name, bind_dir_s1d3, strerror(errno)); + } + + /* Now make it connected again. */ + ASSERT_EQ(0, rename(dir_s4d2, dir_s1d3)) + { + TH_LOG("Failed to rename %s back to %s: %s", dir_s4d2, dir_s1d3, + strerror(errno)); + } + + /* Checks again that we can access it under l2. */ + enforce_ruleset(_metadata, ruleset_fd_l2); + EXPECT_EQ(0, close(ruleset_fd_l2)); + EXPECT_EQ(0, test_open_rel(bind_s1d3_fd, file1_name, O_RDONLY)); + EXPECT_EQ(0, test_open(file1_s1d3, O_RDONLY)); +} + +/* + * Test that linkat(2) with disconnected paths works under Landlock. This + * test moves s1d3 to s4d1. + */ +TEST_F_FORK(layout1_bind, path_disconnected_link) +{ + /* Ruleset to be applied after renaming s1d3 to s4d1. */ + const struct rule layer1[] = { + { + .path = dir_s4d1, + .access = LANDLOCK_ACCESS_FS_REFER | + LANDLOCK_ACCESS_FS_READ_FILE | + LANDLOCK_ACCESS_FS_MAKE_REG | + LANDLOCK_ACCESS_FS_REMOVE_FILE, + }, + { + .path = dir_s2d2, + .access = LANDLOCK_ACCESS_FS_REFER | + LANDLOCK_ACCESS_FS_READ_FILE | + LANDLOCK_ACCESS_FS_MAKE_REG | + LANDLOCK_ACCESS_FS_REMOVE_FILE, + }, + {} + }; + int ruleset_fd, bind_s1d3_fd; + + /* Removes unneeded files created by layout1, otherwise it will EEXIST. */ + ASSERT_EQ(0, unlink(file1_s1d2)); + ASSERT_EQ(0, unlink(file2_s1d3)); + + bind_s1d3_fd = open(bind_dir_s1d3, O_PATH | O_CLOEXEC); + ASSERT_LE(0, bind_s1d3_fd); + EXPECT_EQ(0, test_open_rel(bind_s1d3_fd, file1_name, O_RDONLY)); + + /* Disconnects bind_s1d3_fd. */ + ASSERT_EQ(0, rename(dir_s1d3, dir_s4d1)) + { + TH_LOG("Failed to rename %s to %s: %s", dir_s1d3, dir_s4d1, + strerror(errno)); + } + + /* Need this later to test different parent link. */ + ASSERT_EQ(0, mkdir(dir_s4d2, 0755)) + { + TH_LOG("Failed to create %s: %s", dir_s4d2, strerror(errno)); + } + + ruleset_fd = create_ruleset(_metadata, ACCESS_ALL, layer1); + ASSERT_LE(0, ruleset_fd); + enforce_ruleset(_metadata, ruleset_fd); + EXPECT_EQ(0, close(ruleset_fd)); + + /* From disconnected to connected. */ + ASSERT_EQ(0, linkat(bind_s1d3_fd, file1_name, AT_FDCWD, file1_s2d2, 0)) + { + TH_LOG("Failed to link %s to %s via disconnected %s: %s", + file1_name, file1_s2d2, bind_dir_s1d3, strerror(errno)); + } + + /* Tests that we can access via the new link... */ + EXPECT_EQ(0, test_open(file1_s2d2, O_RDONLY)) + { + TH_LOG("Failed to open newly linked %s: %s", file1_s2d2, + strerror(errno)); + } + + /* ...as well as the old one. */ + EXPECT_EQ(0, test_open(file1_s4d1, O_RDONLY)) + { + TH_LOG("Failed to open original %s: %s", file1_s4d1, + strerror(errno)); + } + + /* From connected to disconnected. */ + ASSERT_EQ(0, unlink(file1_s4d1)); + ASSERT_EQ(0, linkat(AT_FDCWD, file1_s2d2, bind_s1d3_fd, file2_name, 0)) + { + TH_LOG("Failed to link %s to %s via disconnected %s: %s", + file1_s2d2, file2_name, bind_dir_s1d3, strerror(errno)); + } + EXPECT_EQ(0, test_open(file2_s4d1, O_RDONLY)); + ASSERT_EQ(0, unlink(file1_s2d2)); + + /* From disconnected to disconnected (same parent). */ + ASSERT_EQ(0, + linkat(bind_s1d3_fd, file2_name, bind_s1d3_fd, file1_name, 0)) + { + TH_LOG("Failed to link %s to %s within disconnected %s: %s", + file2_name, file1_name, bind_dir_s1d3, strerror(errno)); + } + EXPECT_EQ(0, test_open(file1_s4d1, O_RDONLY)) + { + TH_LOG("Failed to open newly linked %s: %s", file1_s4d1, + strerror(errno)); + } + EXPECT_EQ(0, test_open_rel(bind_s1d3_fd, file1_name, O_RDONLY)) + { + TH_LOG("Failed to open %s through newly created link under disconnected path: %s", + file1_name, strerror(errno)); + } + ASSERT_EQ(0, unlink(file2_s4d1)); + + /* From disconnected to disconnected (different parent). */ + ASSERT_EQ(0, + linkat(bind_s1d3_fd, file1_name, bind_s1d3_fd, "s4d2/f1", 0)) + { + TH_LOG("Failed to link %s to %s within disconnected %s: %s", + file1_name, "s4d2/f1", bind_dir_s1d3, strerror(errno)); + } + EXPECT_EQ(0, test_open(file1_s4d2, O_RDONLY)) + { + TH_LOG("Failed to open %s after link: %s", file1_s4d2, + strerror(errno)); + } + EXPECT_EQ(0, test_open_rel(bind_s1d3_fd, "s4d2/f1", O_RDONLY)) + { + TH_LOG("Failed to open %s through disconnected path after link: %s", + "s4d2/f1", strerror(errno)); + } +} + #define LOWER_BASE TMP_DIR "/lower" #define LOWER_DATA LOWER_BASE "/data" static const char lower_fl1[] = LOWER_DATA "/fl1"; -- 2.53.0 ^ permalink raw reply related [flat|nested] 922+ messages in thread
* [PATCH 6.12 007/877] selftests/landlock: Add disconnected leafs and branch test suites 2026-09-30 15:15 [PATCH 6.12 000/877] 6.12.112-rc1 review Greg Kroah-Hartman ` (5 preceding siblings ...) 2026-09-30 15:15 ` [PATCH 6.12 006/877] selftests/landlock: Add tests for access through disconnected paths Greg Kroah-Hartman @ 2026-09-30 15:15 ` Greg Kroah-Hartman 2026-09-30 15:15 ` [PATCH 6.12 008/877] s390/boot: Add sized_strscpy() to enable strscpy() usage Greg Kroah-Hartman ` (877 subsequent siblings) 884 siblings, 0 replies; 922+ messages in thread From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw) To: stable Cc: Greg Kroah-Hartman, patches, Günther Noack, Song Liu, Tingmao Wang, Mickaël Salaün, Sasha Levin 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Mickaël Salaün <mic@digikod.net> [ Upstream commit 54f9baf537b0a091adad860ec92e3e18e0a0754c ] Test disconnected directories with two test suites (layout4_disconnected_leafs and layout5_disconnected_branch) and 43 variants to cover the main corner cases. These tests are complementary to the previous commit. Add test_renameat() and test_exchangeat() helpers. Test coverage for security/landlock is 92.1% of 1927 lines according to LLVM 20. Cc: Günther Noack <gnoack@google.com> Cc: Song Liu <song@kernel.org> Cc: Tingmao Wang <m@maowtm.org> Link: https://lore.kernel.org/r/20251128172200.760753-5-mic@digikod.net Signed-off-by: Mickaël Salaün <mic@digikod.net> Signed-off-by: Sasha Levin <sashal@kernel.org> --- tools/testing/selftests/landlock/fs_test.c | 1051 ++++++++++++++++++++ 1 file changed, 1051 insertions(+) diff --git a/tools/testing/selftests/landlock/fs_test.c b/tools/testing/selftests/landlock/fs_test.c index 1109d0e932336..732ba5a92df56 100644 --- a/tools/testing/selftests/landlock/fs_test.c +++ b/tools/testing/selftests/landlock/fs_test.c @@ -2109,6 +2109,22 @@ static int test_exchange(const char *const oldpath, const char *const newpath) return 0; } +static int test_renameat(int olddirfd, const char *oldpath, int newdirfd, + const char *newpath) +{ + if (renameat2(olddirfd, oldpath, newdirfd, newpath, 0)) + return errno; + return 0; +} + +static int test_exchangeat(int olddirfd, const char *oldpath, int newdirfd, + const char *newpath) +{ + if (renameat2(olddirfd, oldpath, newdirfd, newpath, RENAME_EXCHANGE)) + return errno; + return 0; +} + TEST_F_FORK(layout1, rename_file) { const struct rule rules[] = { @@ -5015,6 +5031,1041 @@ TEST_F_FORK(layout1_bind, path_disconnected_link) } } +/* + * layout4_disconnected_leafs with bind mount and renames: + * + * tmp + * ├── s1d1 + * │ └── s1d2 [source of the bind mount] + * │ ├── s1d31 + * │ │ └── s1d41 [now renamed beneath s3d1] + * │ │ ├── f1 + * │ │ └── f2 + * │ └── s1d32 + * │ └── s1d42 [now renamed beneath s4d1] + * │ ├── f3 + * │ └── f4 + * ├── s2d1 + * │ └── s2d2 [bind mount of s1d2] + * │ ├── s1d31 + * │ │ └── s1d41 [opened FD, now renamed beneath s3d1] + * │ │ ├── f1 + * │ │ └── f2 + * │ └── s1d32 + * │ └── s1d42 [opened FD, now renamed beneath s4d1] + * │ ├── f3 + * │ └── f4 + * ├── s3d1 + * │ └── s1d41 [renamed here] + * │ ├── f1 + * │ └── f2 + * └── s4d1 + * └── s1d42 [renamed here] + * ├── f3 + * └── f4 + */ +/* clang-format off */ +FIXTURE(layout4_disconnected_leafs) { + int s2d2_fd; +}; +/* clang-format on */ + +FIXTURE_SETUP(layout4_disconnected_leafs) +{ + prepare_layout(_metadata); + + create_file(_metadata, TMP_DIR "/s1d1/s1d2/s1d31/s1d41/f1"); + create_file(_metadata, TMP_DIR "/s1d1/s1d2/s1d31/s1d41/f2"); + create_file(_metadata, TMP_DIR "/s1d1/s1d2/s1d32/s1d42/f3"); + create_file(_metadata, TMP_DIR "/s1d1/s1d2/s1d32/s1d42/f4"); + create_directory(_metadata, TMP_DIR "/s2d1/s2d2"); + create_directory(_metadata, TMP_DIR "/s3d1"); + create_directory(_metadata, TMP_DIR "/s4d1"); + + self->s2d2_fd = + open(TMP_DIR "/s2d1/s2d2", O_DIRECTORY | O_PATH | O_CLOEXEC); + ASSERT_LE(0, self->s2d2_fd); + + set_cap(_metadata, CAP_SYS_ADMIN); + ASSERT_EQ(0, mount(TMP_DIR "/s1d1/s1d2", TMP_DIR "/s2d1/s2d2", NULL, + MS_BIND, NULL)); + clear_cap(_metadata, CAP_SYS_ADMIN); +} + +FIXTURE_TEARDOWN_PARENT(layout4_disconnected_leafs) +{ + /* umount(TMP_DIR "/s2d1") is handled by namespace lifetime. */ + + /* Removes files after renames. */ + remove_path(TMP_DIR "/s3d1/s1d41/f1"); + remove_path(TMP_DIR "/s3d1/s1d41/f2"); + remove_path(TMP_DIR "/s4d1/s1d42/f1"); + remove_path(TMP_DIR "/s4d1/s1d42/f3"); + remove_path(TMP_DIR "/s4d1/s1d42/f4"); + remove_path(TMP_DIR "/s4d1/s1d42/f5"); + + cleanup_layout(_metadata); +} + +FIXTURE_VARIANT(layout4_disconnected_leafs) +{ + /* + * Parent of the bind mount source. It should always be ignored when + * testing against files under the s1d41 or s1d42 disconnected directories. + */ + const __u64 allowed_s1d1; + /* + * Source of bind mount (to s2d2). It should always be enforced when + * testing against files under the s1d41 or s1d42 disconnected directories. + */ + const __u64 allowed_s1d2; + /* + * Original parent of s1d41. It should always be ignored when testing + * against files under the s1d41 disconnected directory. + */ + const __u64 allowed_s1d31; + /* + * Original parent of s1d42. It should always be ignored when testing + * against files under the s1d42 disconnected directory. + */ + const __u64 allowed_s1d32; + /* + * Opened and disconnected source directory. It should always be enforced + * when testing against files under the s1d41 disconnected directory. + */ + const __u64 allowed_s1d41; + /* + * Opened and disconnected source directory. It should always be enforced + * when testing against files under the s1d42 disconnected directory. + */ + const __u64 allowed_s1d42; + /* + * File in the s1d41 disconnected directory. It should always be enforced + * when testing against itself under the s1d41 disconnected directory. + */ + const __u64 allowed_f1; + /* + * File in the s1d41 disconnected directory. It should always be enforced + * when testing against itself under the s1d41 disconnected directory. + */ + const __u64 allowed_f2; + /* + * File in the s1d42 disconnected directory. It should always be enforced + * when testing against itself under the s1d42 disconnected directory. + */ + const __u64 allowed_f3; + /* + * Parent of the bind mount destination. It should always be enforced when + * testing against files under the s1d41 or s1d42 disconnected directories. + */ + const __u64 allowed_s2d1; + /* + * Directory covered by the bind mount. It should always be ignored when + * testing against files under the s1d41 or s1d42 disconnected directories. + */ + const __u64 allowed_s2d2; + /* + * New parent of the renamed s1d41. It should always be ignored when + * testing against files under the s1d41 disconnected directory. + */ + const __u64 allowed_s3d1; + /* + * New parent of the renamed s1d42. It should always be ignored when + * testing against files under the s1d42 disconnected directory. + */ + const __u64 allowed_s4d1; + + /* Expected result of the call to open([fd:s1d41]/f1, O_RDONLY). */ + const int expected_read_result; + /* Expected result of the call to renameat([fd:s1d41]/f1, [fd:s1d42]/f1). */ + const int expected_rename_result; + /* + * Expected result of the call to renameat([fd:s1d41]/f2, [fd:s1d42]/f3, + * RENAME_EXCHANGE). + */ + const int expected_exchange_result; + /* Expected result of the call to renameat([fd:s1d42]/f4, [fd:s1d42]/f5). */ + const int expected_same_dir_rename_result; +}; + +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout4_disconnected_leafs, s1d1_mount_src_parent) { + /* clang-format on */ + .allowed_s1d1 = LANDLOCK_ACCESS_FS_REFER | + LANDLOCK_ACCESS_FS_READ_FILE | + LANDLOCK_ACCESS_FS_EXECUTE | + LANDLOCK_ACCESS_FS_MAKE_REG, + .expected_read_result = EACCES, + .expected_same_dir_rename_result = EACCES, + .expected_rename_result = EACCES, + .expected_exchange_result = EACCES, +}; + +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout4_disconnected_leafs, s1d2_mount_src_refer) { + /* clang-format on */ + .allowed_s1d2 = LANDLOCK_ACCESS_FS_REFER | LANDLOCK_ACCESS_FS_READ_FILE, + .expected_read_result = 0, + .expected_same_dir_rename_result = EACCES, + .expected_rename_result = EACCES, + .expected_exchange_result = EACCES, +}; + +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout4_disconnected_leafs, s1d2_mount_src_create) { + /* clang-format on */ + .allowed_s1d2 = LANDLOCK_ACCESS_FS_READ_FILE | + LANDLOCK_ACCESS_FS_MAKE_REG, + .expected_read_result = 0, + .expected_same_dir_rename_result = 0, + .expected_rename_result = EXDEV, + .expected_exchange_result = EXDEV, +}; + +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout4_disconnected_leafs, s1d2_mount_src_rename) { + /* clang-format on */ + .allowed_s1d2 = LANDLOCK_ACCESS_FS_REFER | LANDLOCK_ACCESS_FS_MAKE_REG, + .expected_read_result = EACCES, + .expected_same_dir_rename_result = 0, + .expected_rename_result = 0, + .expected_exchange_result = 0, +}; + +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout4_disconnected_leafs, s1d31_s1d32_old_parent) { + /* clang-format on */ + .allowed_s1d31 = LANDLOCK_ACCESS_FS_REFER | + LANDLOCK_ACCESS_FS_READ_FILE | + LANDLOCK_ACCESS_FS_EXECUTE | + LANDLOCK_ACCESS_FS_MAKE_REG, + .allowed_s1d32 = LANDLOCK_ACCESS_FS_REFER | + LANDLOCK_ACCESS_FS_READ_FILE | + LANDLOCK_ACCESS_FS_EXECUTE | + LANDLOCK_ACCESS_FS_MAKE_REG, + .expected_read_result = EACCES, + .expected_same_dir_rename_result = EACCES, + .expected_rename_result = EACCES, + .expected_exchange_result = EACCES, +}; + +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout4_disconnected_leafs, s1d41_s1d42_disconnected_refer) { + /* clang-format on */ + .allowed_s1d41 = LANDLOCK_ACCESS_FS_REFER | + LANDLOCK_ACCESS_FS_READ_FILE, + .allowed_s1d42 = LANDLOCK_ACCESS_FS_REFER | + LANDLOCK_ACCESS_FS_READ_FILE, + .expected_read_result = 0, + .expected_same_dir_rename_result = EACCES, + .expected_rename_result = EACCES, + .expected_exchange_result = EACCES, +}; + +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout4_disconnected_leafs, s1d41_s1d42_disconnected_create) { + /* clang-format on */ + .allowed_s1d41 = LANDLOCK_ACCESS_FS_READ_FILE | + LANDLOCK_ACCESS_FS_MAKE_REG, + .allowed_s1d42 = LANDLOCK_ACCESS_FS_READ_FILE | + LANDLOCK_ACCESS_FS_MAKE_REG, + .expected_read_result = 0, + .expected_same_dir_rename_result = 0, + .expected_rename_result = EXDEV, + .expected_exchange_result = EXDEV, +}; + +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout4_disconnected_leafs, s1d41_s1d42_disconnected_rename_even) { + /* clang-format on */ + .allowed_s1d41 = LANDLOCK_ACCESS_FS_REFER | LANDLOCK_ACCESS_FS_MAKE_REG, + .allowed_s1d42 = LANDLOCK_ACCESS_FS_REFER | LANDLOCK_ACCESS_FS_MAKE_REG, + .expected_read_result = EACCES, + .expected_same_dir_rename_result = 0, + .expected_rename_result = 0, + .expected_exchange_result = 0, +}; + +/* The destination directory has more access right. */ +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout4_disconnected_leafs, s1d41_s1d42_disconnected_rename_more) { + /* clang-format on */ + .allowed_s1d41 = LANDLOCK_ACCESS_FS_REFER | LANDLOCK_ACCESS_FS_MAKE_REG, + .allowed_s1d42 = LANDLOCK_ACCESS_FS_REFER | + LANDLOCK_ACCESS_FS_MAKE_REG | + LANDLOCK_ACCESS_FS_EXECUTE, + .expected_read_result = EACCES, + .expected_same_dir_rename_result = 0, + /* Access denied. */ + .expected_rename_result = EXDEV, + .expected_exchange_result = EXDEV, +}; + +/* The destination directory has less access right. */ +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout4_disconnected_leafs, s1d41_s1d42_disconnected_rename_less) { + /* clang-format on */ + .allowed_s1d41 = LANDLOCK_ACCESS_FS_REFER | + LANDLOCK_ACCESS_FS_MAKE_REG | + LANDLOCK_ACCESS_FS_EXECUTE, + .allowed_s1d42 = LANDLOCK_ACCESS_FS_REFER | LANDLOCK_ACCESS_FS_MAKE_REG, + .expected_read_result = EACCES, + .expected_same_dir_rename_result = 0, + /* Access allowed. */ + .expected_rename_result = 0, + .expected_exchange_result = EXDEV, +}; + +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout4_disconnected_leafs, s2d1_mount_dst_parent_create) { + /* clang-format on */ + .allowed_s2d1 = LANDLOCK_ACCESS_FS_READ_FILE | + LANDLOCK_ACCESS_FS_MAKE_REG, + .expected_read_result = 0, + .expected_same_dir_rename_result = 0, + .expected_rename_result = EXDEV, + .expected_exchange_result = EXDEV, +}; + +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout4_disconnected_leafs, s2d1_mount_dst_parent_refer) { + /* clang-format on */ + .allowed_s2d1 = LANDLOCK_ACCESS_FS_REFER | LANDLOCK_ACCESS_FS_READ_FILE, + .expected_read_result = 0, + .expected_same_dir_rename_result = EACCES, + .expected_rename_result = EACCES, + .expected_exchange_result = EACCES, +}; + +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout4_disconnected_leafs, s2d1_mount_dst_parent_mini) { + /* clang-format on */ + .allowed_s2d1 = LANDLOCK_ACCESS_FS_REFER | + LANDLOCK_ACCESS_FS_READ_FILE | + LANDLOCK_ACCESS_FS_MAKE_REG, + .expected_read_result = 0, + .expected_same_dir_rename_result = 0, + .expected_rename_result = 0, + .expected_exchange_result = 0, +}; + +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout4_disconnected_leafs, s2d2_covered_by_mount) { + /* clang-format on */ + .allowed_s2d2 = LANDLOCK_ACCESS_FS_REFER | + LANDLOCK_ACCESS_FS_READ_FILE | + LANDLOCK_ACCESS_FS_EXECUTE | + LANDLOCK_ACCESS_FS_MAKE_REG, + .expected_read_result = EACCES, + .expected_same_dir_rename_result = EACCES, + .expected_rename_result = EACCES, + .expected_exchange_result = EACCES, +}; + +/* Tests collect_domain_accesses(). */ +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout4_disconnected_leafs, s3d1_s4d1_new_parent_refer) { + /* clang-format on */ + .allowed_s3d1 = LANDLOCK_ACCESS_FS_REFER | LANDLOCK_ACCESS_FS_READ_FILE, + .allowed_s4d1 = LANDLOCK_ACCESS_FS_REFER | LANDLOCK_ACCESS_FS_READ_FILE, + .expected_read_result = 0, + .expected_same_dir_rename_result = EACCES, + .expected_rename_result = EACCES, + .expected_exchange_result = EACCES, +}; + +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout4_disconnected_leafs, s3d1_s4d1_new_parent_create) { + /* clang-format on */ + .allowed_s3d1 = LANDLOCK_ACCESS_FS_READ_FILE | + LANDLOCK_ACCESS_FS_MAKE_REG, + .allowed_s4d1 = LANDLOCK_ACCESS_FS_READ_FILE | + LANDLOCK_ACCESS_FS_MAKE_REG, + .expected_read_result = 0, + .expected_same_dir_rename_result = 0, + .expected_rename_result = EXDEV, + .expected_exchange_result = EXDEV, +}; + +FIXTURE_VARIANT_ADD(layout4_disconnected_leafs, + s3d1_s4d1_disconnected_rename_even){ + /* clang-format on */ + .allowed_s3d1 = LANDLOCK_ACCESS_FS_REFER | LANDLOCK_ACCESS_FS_MAKE_REG, + .allowed_s4d1 = LANDLOCK_ACCESS_FS_REFER | LANDLOCK_ACCESS_FS_MAKE_REG, + .expected_read_result = EACCES, + .expected_same_dir_rename_result = 0, + .expected_rename_result = 0, + .expected_exchange_result = 0, +}; + +/* The destination directory has more access right. */ +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout4_disconnected_leafs, s3d1_s4d1_disconnected_rename_more) { + /* clang-format on */ + .allowed_s3d1 = LANDLOCK_ACCESS_FS_REFER | LANDLOCK_ACCESS_FS_MAKE_REG, + .allowed_s4d1 = LANDLOCK_ACCESS_FS_REFER | LANDLOCK_ACCESS_FS_MAKE_REG | + LANDLOCK_ACCESS_FS_EXECUTE, + .expected_read_result = EACCES, + .expected_same_dir_rename_result = 0, + /* Access denied. */ + .expected_rename_result = EXDEV, + .expected_exchange_result = EXDEV, +}; + +/* The destination directory has less access right. */ +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout4_disconnected_leafs, s3d1_s4d1_disconnected_rename_less) { + /* clang-format on */ + .allowed_s3d1 = LANDLOCK_ACCESS_FS_REFER | LANDLOCK_ACCESS_FS_MAKE_REG | + LANDLOCK_ACCESS_FS_EXECUTE, + .allowed_s4d1 = LANDLOCK_ACCESS_FS_REFER | LANDLOCK_ACCESS_FS_MAKE_REG, + .expected_read_result = EACCES, + .expected_same_dir_rename_result = 0, + /* Access allowed. */ + .expected_rename_result = 0, + .expected_exchange_result = EXDEV, +}; + +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout4_disconnected_leafs, f1_f2_f3) { + /* clang-format on */ + .allowed_f1 = LANDLOCK_ACCESS_FS_READ_FILE, + .allowed_f2 = LANDLOCK_ACCESS_FS_READ_FILE, + .allowed_f3 = LANDLOCK_ACCESS_FS_READ_FILE, + .expected_read_result = 0, + .expected_same_dir_rename_result = EACCES, + .expected_rename_result = EACCES, + .expected_exchange_result = EACCES, +}; + +TEST_F_FORK(layout4_disconnected_leafs, read_rename_exchange) +{ + const __u64 handled_access = + LANDLOCK_ACCESS_FS_REFER | LANDLOCK_ACCESS_FS_READ_FILE | + LANDLOCK_ACCESS_FS_EXECUTE | LANDLOCK_ACCESS_FS_MAKE_REG; + const struct rule rules[] = { + { + .path = TMP_DIR "/s1d1", + .access = variant->allowed_s1d1, + }, + { + .path = TMP_DIR "/s1d1/s1d2", + .access = variant->allowed_s1d2, + }, + { + .path = TMP_DIR "/s1d1/s1d2/s1d31", + .access = variant->allowed_s1d31, + }, + { + .path = TMP_DIR "/s1d1/s1d2/s1d32", + .access = variant->allowed_s1d32, + }, + { + .path = TMP_DIR "/s1d1/s1d2/s1d31/s1d41", + .access = variant->allowed_s1d41, + }, + { + .path = TMP_DIR "/s1d1/s1d2/s1d32/s1d42", + .access = variant->allowed_s1d42, + }, + { + .path = TMP_DIR "/s1d1/s1d2/s1d31/s1d41/f1", + .access = variant->allowed_f1, + }, + { + .path = TMP_DIR "/s1d1/s1d2/s1d31/s1d41/f2", + .access = variant->allowed_f2, + }, + { + .path = TMP_DIR "/s1d1/s1d2/s1d32/s1d42/f3", + .access = variant->allowed_f3, + }, + { + .path = TMP_DIR "/s2d1", + .access = variant->allowed_s2d1, + }, + /* s2d2_fd */ + { + .path = TMP_DIR "/s3d1", + .access = variant->allowed_s3d1, + }, + { + .path = TMP_DIR "/s4d1", + .access = variant->allowed_s4d1, + }, + {}, + }; + int ruleset_fd, s1d41_bind_fd, s1d42_bind_fd; + + ruleset_fd = create_ruleset(_metadata, handled_access, rules); + ASSERT_LE(0, ruleset_fd); + + /* Adds rule for the covered directory. */ + if (variant->allowed_s2d2) { + ASSERT_EQ(0, landlock_add_rule( + ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, + &(struct landlock_path_beneath_attr){ + .parent_fd = self->s2d2_fd, + .allowed_access = + variant->allowed_s2d2, + }, + 0)); + } + EXPECT_EQ(0, close(self->s2d2_fd)); + + s1d41_bind_fd = open(TMP_DIR "/s2d1/s2d2/s1d31/s1d41", + O_DIRECTORY | O_PATH | O_CLOEXEC); + ASSERT_LE(0, s1d41_bind_fd); + s1d42_bind_fd = open(TMP_DIR "/s2d1/s2d2/s1d32/s1d42", + O_DIRECTORY | O_PATH | O_CLOEXEC); + ASSERT_LE(0, s1d42_bind_fd); + + /* Disconnects and checks source and destination directories. */ + EXPECT_EQ(0, test_open_rel(s1d41_bind_fd, "..", O_DIRECTORY)); + EXPECT_EQ(0, test_open_rel(s1d42_bind_fd, "..", O_DIRECTORY)); + /* Renames to make it accessible through s3d1/s1d41 */ + ASSERT_EQ(0, test_renameat(AT_FDCWD, TMP_DIR "/s1d1/s1d2/s1d31/s1d41", + AT_FDCWD, TMP_DIR "/s3d1/s1d41")); + /* Renames to make it accessible through s4d1/s1d42 */ + ASSERT_EQ(0, test_renameat(AT_FDCWD, TMP_DIR "/s1d1/s1d2/s1d32/s1d42", + AT_FDCWD, TMP_DIR "/s4d1/s1d42")); + EXPECT_EQ(ENOENT, test_open_rel(s1d41_bind_fd, "..", O_DIRECTORY)); + EXPECT_EQ(ENOENT, test_open_rel(s1d42_bind_fd, "..", O_DIRECTORY)); + + enforce_ruleset(_metadata, ruleset_fd); + EXPECT_EQ(0, close(ruleset_fd)); + + EXPECT_EQ(variant->expected_read_result, + test_open_rel(s1d41_bind_fd, "f1", O_RDONLY)); + + EXPECT_EQ(variant->expected_rename_result, + test_renameat(s1d41_bind_fd, "f1", s1d42_bind_fd, "f1")); + EXPECT_EQ(variant->expected_exchange_result, + test_exchangeat(s1d41_bind_fd, "f2", s1d42_bind_fd, "f3")); + + EXPECT_EQ(variant->expected_same_dir_rename_result, + test_renameat(s1d42_bind_fd, "f4", s1d42_bind_fd, "f5")); +} + +/* + * layout5_disconnected_branch before rename: + * + * tmp + * ├── s1d1 + * │ └── s1d2 [source of the first bind mount] + * │ └── s1d3 + * │ ├── s1d41 + * │ │ ├── f1 + * │ │ └── f2 + * │ └── s1d42 + * │ ├── f3 + * │ └── f4 + * ├── s2d1 + * │ └── s2d2 [source of the second bind mount] + * │ └── s2d3 + * │ └── s2d4 [first s1d2 bind mount] + * │ └── s1d3 + * │ ├── s1d41 + * │ │ ├── f1 + * │ │ └── f2 + * │ └── s1d42 + * │ ├── f3 + * │ └── f4 + * ├── s3d1 + * │ └── s3d2 [second s2d2 bind mount] + * │ └── s2d3 + * │ └── s2d4 [first s1d2 bind mount] + * │ └── s1d3 + * │ ├── s1d41 + * │ │ ├── f1 + * │ │ └── f2 + * │ └── s1d42 + * │ ├── f3 + * │ └── f4 + * └── s4d1 + * + * After rename: + * + * tmp + * ├── s1d1 + * │ └── s1d2 [source of the first bind mount] + * │ └── s1d3 + * │ ├── s1d41 + * │ │ ├── f1 + * │ │ └── f2 + * │ └── s1d42 + * │ ├── f3 + * │ └── f4 + * ├── s2d1 + * │ └── s2d2 [source of the second bind mount] + * ├── s3d1 + * │ └── s3d2 [second s2d2 bind mount] + * └── s4d1 + * └── s2d3 [renamed here] + * └── s2d4 [first s1d2 bind mount] + * └── s1d3 + * ├── s1d41 + * │ ├── f1 + * │ └── f2 + * └── s1d42 + * ├── f3 + * └── f4 + * + * Decision path for access from the s3d1/s3d2/s2d3/s2d4/s1d3 file descriptor: + * 1. first bind mount: s1d3 -> s1d2 + * 2. second bind mount: s2d3 + * 3. tmp mount: s4d1 -> tmp [disconnected branch] + * 4. second bind mount: s2d2 + * 5. tmp mount: s3d1 -> tmp + * 6. parent mounts: [...] -> / + * + * The s4d1 directory is evaluated even if it is not in the s2d2 mount. + */ + +/* clang-format off */ +FIXTURE(layout5_disconnected_branch) { + int s2d4_fd, s3d2_fd; +}; +/* clang-format on */ + +FIXTURE_SETUP(layout5_disconnected_branch) +{ + prepare_layout(_metadata); + + create_file(_metadata, TMP_DIR "/s1d1/s1d2/s1d3/s1d41/f1"); + create_file(_metadata, TMP_DIR "/s1d1/s1d2/s1d3/s1d41/f2"); + create_file(_metadata, TMP_DIR "/s1d1/s1d2/s1d3/s1d42/f3"); + create_file(_metadata, TMP_DIR "/s1d1/s1d2/s1d3/s1d42/f4"); + create_directory(_metadata, TMP_DIR "/s2d1/s2d2/s2d3/s2d4"); + create_directory(_metadata, TMP_DIR "/s3d1/s3d2"); + create_directory(_metadata, TMP_DIR "/s4d1"); + + self->s2d4_fd = open(TMP_DIR "/s2d1/s2d2/s2d3/s2d4", + O_DIRECTORY | O_PATH | O_CLOEXEC); + ASSERT_LE(0, self->s2d4_fd); + + self->s3d2_fd = + open(TMP_DIR "/s3d1/s3d2", O_DIRECTORY | O_PATH | O_CLOEXEC); + ASSERT_LE(0, self->s3d2_fd); + + set_cap(_metadata, CAP_SYS_ADMIN); + ASSERT_EQ(0, mount(TMP_DIR "/s1d1/s1d2", TMP_DIR "/s2d1/s2d2/s2d3/s2d4", + NULL, MS_BIND, NULL)); + ASSERT_EQ(0, mount(TMP_DIR "/s2d1/s2d2", TMP_DIR "/s3d1/s3d2", NULL, + MS_BIND | MS_REC, NULL)); + clear_cap(_metadata, CAP_SYS_ADMIN); +} + +FIXTURE_TEARDOWN_PARENT(layout5_disconnected_branch) +{ + /* Bind mounts are handled by namespace lifetime. */ + + /* Removes files after renames. */ + remove_path(TMP_DIR "/s1d1/s1d2/s1d3/s1d41/f1"); + remove_path(TMP_DIR "/s1d1/s1d2/s1d3/s1d41/f2"); + remove_path(TMP_DIR "/s1d1/s1d2/s1d3/s1d42/f1"); + remove_path(TMP_DIR "/s1d1/s1d2/s1d3/s1d42/f3"); + remove_path(TMP_DIR "/s1d1/s1d2/s1d3/s1d42/f4"); + remove_path(TMP_DIR "/s1d1/s1d2/s1d3/s1d42/f5"); + + cleanup_layout(_metadata); +} + +FIXTURE_VARIANT(layout5_disconnected_branch) +{ + /* + * Parent of all files. It should always be enforced when testing against + * files under the s1d41 or s1d42 disconnected directories. + */ + const __u64 allowed_base; + /* + * Parent of the first bind mount source. It should always be ignored when + * testing against files under the s1d41 or s1d42 disconnected directories. + */ + const __u64 allowed_s1d1; + const __u64 allowed_s1d2; + const __u64 allowed_s1d3; + const __u64 allowed_s2d1; + const __u64 allowed_s2d2; + const __u64 allowed_s2d3; + const __u64 allowed_s2d4; + const __u64 allowed_s3d1; + const __u64 allowed_s3d2; + const __u64 allowed_s4d1; + + /* Expected result of the call to open([fd:s1d3]/s1d41/f1, O_RDONLY). */ + const int expected_read_result; + /* + * Expected result of the call to renameat([fd:s1d3]/s1d41/f1, + * [fd:s1d3]/s1d42/f1). + */ + const int expected_rename_result; + /* + * Expected result of the call to renameat([fd:s1d3]/s1d41/f2, + * [fd:s1d3]/s1d42/f3, RENAME_EXCHANGE). + */ + const int expected_exchange_result; + /* + * Expected result of the call to renameat([fd:s1d3]/s1d42/f4, + * [fd:s1d3]/s1d42/f5). + */ + const int expected_same_dir_rename_result; +}; + +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout5_disconnected_branch, s1d1_mount1_src_parent) { + /* clang-format on */ + .allowed_s1d1 = LANDLOCK_ACCESS_FS_REFER | + LANDLOCK_ACCESS_FS_READ_FILE | + LANDLOCK_ACCESS_FS_EXECUTE | + LANDLOCK_ACCESS_FS_MAKE_REG, + .expected_read_result = EACCES, + .expected_same_dir_rename_result = EACCES, + .expected_rename_result = EACCES, + .expected_exchange_result = EACCES, +}; + +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout5_disconnected_branch, s1d2_mount1_src_refer) { + /* clang-format on */ + .allowed_s1d2 = LANDLOCK_ACCESS_FS_REFER | LANDLOCK_ACCESS_FS_READ_FILE, + .expected_read_result = 0, + .expected_same_dir_rename_result = EACCES, + .expected_rename_result = EACCES, + .expected_exchange_result = EACCES, +}; + +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout5_disconnected_branch, s1d2_mount1_src_create) { + /* clang-format on */ + .allowed_s1d2 = LANDLOCK_ACCESS_FS_READ_FILE | + LANDLOCK_ACCESS_FS_MAKE_REG, + .expected_read_result = 0, + .expected_same_dir_rename_result = 0, + .expected_rename_result = EXDEV, + .expected_exchange_result = EXDEV, +}; + +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout5_disconnected_branch, s1d2_mount1_src_rename) { + /* clang-format on */ + .allowed_s1d2 = LANDLOCK_ACCESS_FS_REFER | LANDLOCK_ACCESS_FS_MAKE_REG, + .expected_read_result = EACCES, + .expected_same_dir_rename_result = 0, + .expected_rename_result = 0, + .expected_exchange_result = 0, +}; + +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout5_disconnected_branch, s1d3_fd_refer) { + /* clang-format on */ + .allowed_s1d3 = LANDLOCK_ACCESS_FS_REFER | LANDLOCK_ACCESS_FS_READ_FILE, + .expected_read_result = 0, + .expected_same_dir_rename_result = EACCES, + .expected_rename_result = EACCES, + .expected_exchange_result = EACCES, +}; + +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout5_disconnected_branch, s1d3_fd_create) { + /* clang-format on */ + .allowed_s1d3 = LANDLOCK_ACCESS_FS_READ_FILE | + LANDLOCK_ACCESS_FS_MAKE_REG, + .expected_read_result = 0, + .expected_same_dir_rename_result = 0, + .expected_rename_result = EXDEV, + .expected_exchange_result = EXDEV, +}; + +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout5_disconnected_branch, s1d3_fd_rename) { + /* clang-format on */ + .allowed_s1d3 = LANDLOCK_ACCESS_FS_REFER | LANDLOCK_ACCESS_FS_MAKE_REG, + .expected_read_result = EACCES, + .expected_same_dir_rename_result = 0, + .expected_rename_result = 0, + .expected_exchange_result = 0, +}; + +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout5_disconnected_branch, s1d3_fd_full) { + /* clang-format on */ + .allowed_s1d3 = LANDLOCK_ACCESS_FS_REFER | + LANDLOCK_ACCESS_FS_READ_FILE | + LANDLOCK_ACCESS_FS_EXECUTE | + LANDLOCK_ACCESS_FS_MAKE_REG, + .expected_read_result = 0, + .expected_same_dir_rename_result = 0, + .expected_rename_result = 0, + .expected_exchange_result = 0, +}; + +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout5_disconnected_branch, s2d1_mount2_src_parent) { + /* clang-format on */ + .allowed_s2d1 = LANDLOCK_ACCESS_FS_REFER | + LANDLOCK_ACCESS_FS_READ_FILE | + LANDLOCK_ACCESS_FS_EXECUTE | + LANDLOCK_ACCESS_FS_MAKE_REG, + .expected_read_result = EACCES, + .expected_same_dir_rename_result = EACCES, + .expected_rename_result = EACCES, + .expected_exchange_result = EACCES, +}; + +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout5_disconnected_branch, s2d2_mount2_src_refer) { + /* clang-format on */ + .allowed_s2d2 = LANDLOCK_ACCESS_FS_REFER | LANDLOCK_ACCESS_FS_READ_FILE, + .expected_read_result = 0, + .expected_same_dir_rename_result = EACCES, + .expected_rename_result = EACCES, + .expected_exchange_result = EACCES, +}; + +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout5_disconnected_branch, s2d2_mount2_src_create) { + /* clang-format on */ + .allowed_s2d2 = LANDLOCK_ACCESS_FS_READ_FILE | + LANDLOCK_ACCESS_FS_MAKE_REG, + .expected_read_result = 0, + .expected_same_dir_rename_result = 0, + .expected_rename_result = EXDEV, + .expected_exchange_result = EXDEV, +}; + +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout5_disconnected_branch, s2d2_mount2_src_rename) { + /* clang-format on */ + .allowed_s2d2 = LANDLOCK_ACCESS_FS_REFER | LANDLOCK_ACCESS_FS_MAKE_REG, + .expected_read_result = EACCES, + .expected_same_dir_rename_result = 0, + .expected_rename_result = 0, + .expected_exchange_result = 0, +}; + +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout5_disconnected_branch, s2d3_mount1_dst_parent_refer) { + /* clang-format on */ + .allowed_s2d3 = LANDLOCK_ACCESS_FS_REFER | LANDLOCK_ACCESS_FS_READ_FILE, + .expected_read_result = 0, + .expected_same_dir_rename_result = EACCES, + .expected_rename_result = EACCES, + .expected_exchange_result = EACCES, +}; + +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout5_disconnected_branch, s2d3_mount1_dst_parent_create) { + /* clang-format on */ + .allowed_s2d3 = LANDLOCK_ACCESS_FS_READ_FILE | + LANDLOCK_ACCESS_FS_MAKE_REG, + .expected_read_result = 0, + .expected_same_dir_rename_result = 0, + .expected_rename_result = EXDEV, + .expected_exchange_result = EXDEV, +}; + +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout5_disconnected_branch, s2d3_mount1_dst_parent_rename) { + /* clang-format on */ + .allowed_s2d3 = LANDLOCK_ACCESS_FS_REFER | LANDLOCK_ACCESS_FS_MAKE_REG, + .expected_read_result = EACCES, + .expected_same_dir_rename_result = 0, + .expected_rename_result = 0, + .expected_exchange_result = 0, +}; + +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout5_disconnected_branch, s2d4_mount1_dst) { + /* clang-format on */ + .allowed_s2d4 = LANDLOCK_ACCESS_FS_REFER | + LANDLOCK_ACCESS_FS_READ_FILE | + LANDLOCK_ACCESS_FS_EXECUTE | + LANDLOCK_ACCESS_FS_MAKE_REG, + .expected_read_result = EACCES, + .expected_same_dir_rename_result = EACCES, + .expected_rename_result = EACCES, + .expected_exchange_result = EACCES, +}; + +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout5_disconnected_branch, s3d1_mount2_dst_parent_refer) { + /* clang-format on */ + .allowed_s3d1 = LANDLOCK_ACCESS_FS_REFER | LANDLOCK_ACCESS_FS_READ_FILE, + .expected_read_result = 0, + .expected_same_dir_rename_result = EACCES, + .expected_rename_result = EACCES, + .expected_exchange_result = EACCES, +}; + +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout5_disconnected_branch, s3d1_mount2_dst_parent_create) { + /* clang-format on */ + .allowed_s3d1 = LANDLOCK_ACCESS_FS_READ_FILE | + LANDLOCK_ACCESS_FS_MAKE_REG, + .expected_read_result = 0, + .expected_same_dir_rename_result = 0, + .expected_rename_result = EXDEV, + .expected_exchange_result = EXDEV, +}; + +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout5_disconnected_branch, s3d1_mount2_dst_parent_rename) { + /* clang-format on */ + .allowed_s3d1 = LANDLOCK_ACCESS_FS_REFER | LANDLOCK_ACCESS_FS_MAKE_REG, + .expected_read_result = EACCES, + .expected_same_dir_rename_result = 0, + .expected_rename_result = 0, + .expected_exchange_result = 0, +}; + +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout5_disconnected_branch, s3d2_mount1_dst) { + /* clang-format on */ + .allowed_s3d2 = LANDLOCK_ACCESS_FS_REFER | + LANDLOCK_ACCESS_FS_READ_FILE | + LANDLOCK_ACCESS_FS_EXECUTE | + LANDLOCK_ACCESS_FS_MAKE_REG, + .expected_read_result = EACCES, + .expected_same_dir_rename_result = EACCES, + .expected_rename_result = EACCES, + .expected_exchange_result = EACCES, +}; + +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout5_disconnected_branch, s4d1_rename_parent_refer) { + /* clang-format on */ + .allowed_s4d1 = LANDLOCK_ACCESS_FS_REFER | LANDLOCK_ACCESS_FS_READ_FILE, + .expected_read_result = 0, + .expected_same_dir_rename_result = EACCES, + .expected_rename_result = EACCES, + .expected_exchange_result = EACCES, +}; + +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout5_disconnected_branch, s4d1_rename_parent_create) { + /* clang-format on */ + .allowed_s4d1 = LANDLOCK_ACCESS_FS_READ_FILE | + LANDLOCK_ACCESS_FS_MAKE_REG, + .expected_read_result = 0, + .expected_same_dir_rename_result = 0, + .expected_rename_result = EXDEV, + .expected_exchange_result = EXDEV, +}; + +/* clang-format off */ +FIXTURE_VARIANT_ADD(layout5_disconnected_branch, s4d1_rename_parent_rename) { + /* clang-format on */ + .allowed_s4d1 = LANDLOCK_ACCESS_FS_REFER | LANDLOCK_ACCESS_FS_MAKE_REG, + .expected_read_result = EACCES, + .expected_same_dir_rename_result = 0, + .expected_rename_result = 0, + .expected_exchange_result = 0, +}; + +TEST_F_FORK(layout5_disconnected_branch, read_rename_exchange) +{ + const __u64 handled_access = + LANDLOCK_ACCESS_FS_REFER | LANDLOCK_ACCESS_FS_READ_FILE | + LANDLOCK_ACCESS_FS_EXECUTE | LANDLOCK_ACCESS_FS_MAKE_REG; + const struct rule rules[] = { + { + .path = TMP_DIR "/s1d1", + .access = variant->allowed_s1d1, + }, + { + .path = TMP_DIR "/s1d1/s1d2", + .access = variant->allowed_s1d2, + }, + { + .path = TMP_DIR "/s1d1/s1d2/s1d3", + .access = variant->allowed_s1d3, + }, + { + .path = TMP_DIR "/s2d1", + .access = variant->allowed_s2d1, + }, + { + .path = TMP_DIR "/s2d1/s2d2", + .access = variant->allowed_s2d2, + }, + { + .path = TMP_DIR "/s2d1/s2d2/s2d3", + .access = variant->allowed_s2d3, + }, + /* s2d4_fd */ + { + .path = TMP_DIR "/s3d1", + .access = variant->allowed_s3d1, + }, + /* s3d2_fd */ + { + .path = TMP_DIR "/s4d1", + .access = variant->allowed_s4d1, + }, + {}, + }; + int ruleset_fd, s1d3_bind_fd; + + ruleset_fd = create_ruleset(_metadata, handled_access, rules); + ASSERT_LE(0, ruleset_fd); + + /* Adds rules for the covered directories. */ + if (variant->allowed_s2d4) { + ASSERT_EQ(0, landlock_add_rule( + ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, + &(struct landlock_path_beneath_attr){ + .parent_fd = self->s2d4_fd, + .allowed_access = + variant->allowed_s2d4, + }, + 0)); + } + EXPECT_EQ(0, close(self->s2d4_fd)); + + if (variant->allowed_s3d2) { + ASSERT_EQ(0, landlock_add_rule( + ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, + &(struct landlock_path_beneath_attr){ + .parent_fd = self->s3d2_fd, + .allowed_access = + variant->allowed_s3d2, + }, + 0)); + } + EXPECT_EQ(0, close(self->s3d2_fd)); + + s1d3_bind_fd = open(TMP_DIR "/s3d1/s3d2/s2d3/s2d4/s1d3", + O_DIRECTORY | O_PATH | O_CLOEXEC); + ASSERT_LE(0, s1d3_bind_fd); + + /* Disconnects and checks source and destination directories. */ + EXPECT_EQ(0, test_open_rel(s1d3_bind_fd, "..", O_DIRECTORY)); + EXPECT_EQ(0, test_open_rel(s1d3_bind_fd, "../..", O_DIRECTORY)); + /* Renames to make it accessible through s3d1/s1d41 */ + ASSERT_EQ(0, test_renameat(AT_FDCWD, TMP_DIR "/s2d1/s2d2/s2d3", + AT_FDCWD, TMP_DIR "/s4d1/s2d3")); + EXPECT_EQ(0, test_open_rel(s1d3_bind_fd, "..", O_DIRECTORY)); + EXPECT_EQ(ENOENT, test_open_rel(s1d3_bind_fd, "../..", O_DIRECTORY)); + + enforce_ruleset(_metadata, ruleset_fd); + EXPECT_EQ(0, close(ruleset_fd)); + + EXPECT_EQ(variant->expected_read_result, + test_open_rel(s1d3_bind_fd, "s1d41/f1", O_RDONLY)); + + EXPECT_EQ(variant->expected_rename_result, + test_renameat(s1d3_bind_fd, "s1d41/f1", s1d3_bind_fd, + "s1d42/f1")); + EXPECT_EQ(variant->expected_exchange_result, + test_exchangeat(s1d3_bind_fd, "s1d41/f2", s1d3_bind_fd, + "s1d42/f3")); + + EXPECT_EQ(variant->expected_same_dir_rename_result, + test_renameat(s1d3_bind_fd, "s1d42/f4", s1d3_bind_fd, + "s1d42/f5")); +} + #define LOWER_BASE TMP_DIR "/lower" #define LOWER_DATA LOWER_BASE "/data" static const char lower_fl1[] = LOWER_DATA "/fl1"; -- 2.53.0 ^ permalink raw reply related [flat|nested] 922+ messages in thread
* [PATCH 6.12 008/877] s390/boot: Add sized_strscpy() to enable strscpy() usage 2026-09-30 15:15 [PATCH 6.12 000/877] 6.12.112-rc1 review Greg Kroah-Hartman ` (6 preceding siblings ...) 2026-09-30 15:15 ` [PATCH 6.12 007/877] selftests/landlock: Add disconnected leafs and branch test suites Greg Kroah-Hartman @ 2026-09-30 15:15 ` Greg Kroah-Hartman 2026-09-30 15:15 ` [PATCH 6.12 009/877] s390/boot: Avoid IPL parameter append past command line Greg Kroah-Hartman ` (876 subsequent siblings) 884 siblings, 0 replies; 922+ messages in thread From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw) To: stable Cc: Greg Kroah-Hartman, patches, Vasily Gorbik, Heiko Carstens, Sasha Levin 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Vasily Gorbik <gor@linux.ibm.com> [ Upstream commit f271df9d41c216f6189c40fa1cb83839a6117c3e ] Add a simple sized_strscpy() implementation to allow the use of strscpy() in the decompressor. Signed-off-by: Vasily Gorbik <gor@linux.ibm.com> Reviewed-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Sasha Levin <sashal@kernel.org> --- arch/s390/boot/string.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/arch/s390/boot/string.c b/arch/s390/boot/string.c index f6b9b1df48a82..bd68161434a60 100644 --- a/arch/s390/boot/string.c +++ b/arch/s390/boot/string.c @@ -29,6 +29,18 @@ int strncmp(const char *cs, const char *ct, size_t count) return 0; } +ssize_t sized_strscpy(char *dst, const char *src, size_t count) +{ + size_t len; + + if (count == 0) + return -E2BIG; + len = strnlen(src, count - 1); + memcpy(dst, src, len); + dst[len] = '\0'; + return src[len] ? -E2BIG : len; +} + void *memset64(uint64_t *s, uint64_t v, size_t count) { uint64_t *xs = s; -- 2.53.0 ^ permalink raw reply related [flat|nested] 922+ messages in thread
* [PATCH 6.12 009/877] s390/boot: Avoid IPL parameter append past command line 2026-09-30 15:15 [PATCH 6.12 000/877] 6.12.112-rc1 review Greg Kroah-Hartman ` (7 preceding siblings ...) 2026-09-30 15:15 ` [PATCH 6.12 008/877] s390/boot: Add sized_strscpy() to enable strscpy() usage Greg Kroah-Hartman @ 2026-09-30 15:15 ` Greg Kroah-Hartman 2026-09-30 15:15 ` [PATCH 6.12 010/877] selftests/landlock: Add tests for whiteout object creation Greg Kroah-Hartman ` (875 subsequent siblings) 884 siblings, 0 replies; 922+ messages in thread From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw) To: stable Cc: Greg Kroah-Hartman, patches, Heiko Carstens, Vasily Gorbik, Sasha Levin 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Vasily Gorbik <gor@linux.ibm.com> [ Upstream commit d76181dfabdaa720703167393704efacba343442 ] A command line may occupy all but the terminating byte of COMMAND_LINE_SIZE. In that case append_ipl_block_parm() passes a zero size to the IPL parameter conversion helpers and points the destination one byte past early_command_line. The helpers subtract one from the unsigned size and write the converted parameter outside the command line buffer. Convert the IPL parameter in the command line parsing buffer first. A parameter beginning with '=' can then replace the existing command line regardless of its length, while other parameters are appended only when space remains. Fixes: 5ecb2da660ab ("s390: support command lines longer than 896 bytes") Reviewed-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Sasha Levin <sashal@kernel.org> --- arch/s390/boot/ipl_parm.c | 26 ++++++++++++-------------- 1 file changed, 12 insertions(+), 14 deletions(-) diff --git a/arch/s390/boot/ipl_parm.c b/arch/s390/boot/ipl_parm.c index 557462e62cd73..6c77afb3b8a11 100644 --- a/arch/s390/boot/ipl_parm.c +++ b/arch/s390/boot/ipl_parm.c @@ -21,6 +21,7 @@ struct parmarea parmarea __section(".parmarea") = { }; char __bootdata(early_command_line)[COMMAND_LINE_SIZE]; +static char command_line_buf[COMMAND_LINE_SIZE]; unsigned int __bootdata_preserved(zlib_dfltcc_support) = ZLIB_DFLTCC_FULL; struct ipl_parameter_block __bootdata_preserved(ipl_block); @@ -148,31 +149,29 @@ static size_t ipl_block_get_ascii_scpdata(char *dest, size_t size, static void append_ipl_block_parm(void) { - char *parm, *delim; - size_t len, rc = 0; + size_t len, extra = 0; + char *delim; len = strlen(early_command_line); - - delim = early_command_line + len; /* '\0' character position */ - parm = early_command_line + len + 1; /* append right after '\0' */ + delim = early_command_line + len; /* '\0' character position */ switch (ipl_block.pb0_hdr.pbt) { case IPL_PBT_CCW: - rc = ipl_block_get_ascii_vmparm( - parm, COMMAND_LINE_SIZE - len - 1, &ipl_block); + extra = ipl_block_get_ascii_vmparm(command_line_buf, sizeof(command_line_buf), &ipl_block); break; case IPL_PBT_FCP: case IPL_PBT_NVME: case IPL_PBT_ECKD: - rc = ipl_block_get_ascii_scpdata( - parm, COMMAND_LINE_SIZE - len - 1, &ipl_block); + extra = ipl_block_get_ascii_scpdata(command_line_buf, sizeof(command_line_buf), &ipl_block); break; } - if (rc) { - if (*parm == '=') - memmove(early_command_line, parm + 1, rc); - else + if (extra) { + if (command_line_buf[0] == '=') { + memmove(early_command_line, command_line_buf + 1, extra); + } else if (len < COMMAND_LINE_SIZE - 2) { *delim = ' '; /* replace '\0' with space */ + sized_strscpy(delim + 1, command_line_buf, COMMAND_LINE_SIZE - len - 1); + } } } @@ -258,7 +257,6 @@ static void modify_fac_list(char *str) check_cleared_facilities(); } -static char command_line_buf[COMMAND_LINE_SIZE]; void parse_boot_command_line(void) { char *param, *val; -- 2.53.0 ^ permalink raw reply related [flat|nested] 922+ messages in thread
* [PATCH 6.12 010/877] selftests/landlock: Add tests for whiteout object creation 2026-09-30 15:15 [PATCH 6.12 000/877] 6.12.112-rc1 review Greg Kroah-Hartman ` (8 preceding siblings ...) 2026-09-30 15:15 ` [PATCH 6.12 009/877] s390/boot: Avoid IPL parameter append past command line Greg Kroah-Hartman @ 2026-09-30 15:15 ` Greg Kroah-Hartman 2026-09-30 15:15 ` [PATCH 6.12 011/877] sunvdc: fix -EIO issue due to lack of retries Greg Kroah-Hartman ` (874 subsequent siblings) 884 siblings, 0 replies; 922+ messages in thread From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw) To: stable Cc: Greg Kroah-Hartman, patches, Günther Noack, Mickaël Salaün, Sasha Levin 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Günther Noack <gnoack@google.com> [ Upstream commit ee890889b30b22f9a21636061def7a04e4f89380 ] Add tests to check that whiteout object creation is guarded by LANDLOCK_ACCESS_FS_MAKE_REG, in the cases where these are created from userspace: * Conventional creation with mknod() * Linking or renaming an existing whiteout object * renameat2() with RENAME_WHITEOUT, which creates a new whiteout object in the source location * renameat2() with RENAME_EXCHANGE, with one of the renamed objects being a whiteout object Signed-off-by: Günther Noack <gnoack@google.com> Link: https://patch.msgid.link/20260813093157.1436894-4-gnoack@google.com [mic: Update commit message as requested] Signed-off-by: Mickaël Salaün <mic@digikod.net> [mic: Backport: adapt the tests to the older filesystem fixture and ruleset helper] Signed-off-by: Mickaël Salaün <mic@digikod.net> Signed-off-by: Sasha Levin <sashal@kernel.org> --- tools/testing/selftests/landlock/fs_test.c | 205 ++++++++++++++++++++- 1 file changed, 203 insertions(+), 2 deletions(-) diff --git a/tools/testing/selftests/landlock/fs_test.c b/tools/testing/selftests/landlock/fs_test.c index 732ba5a92df56..ae96637ad40e9 100644 --- a/tools/testing/selftests/landlock/fs_test.c +++ b/tools/testing/selftests/landlock/fs_test.c @@ -85,6 +85,8 @@ static const char file1_s3d1[] = TMP_DIR "/s3d1/f1"; /* dir_s3d2 is a mount point. */ static const char dir_s3d2[] = TMP_DIR "/s3d1/s3d2"; static const char dir_s3d3[] = TMP_DIR "/s3d1/s3d2/s3d3"; +static const char file1_s3d3[] = TMP_DIR "/s3d1/s3d2/s3d3/f1"; +static const char file1_s3d4[] = TMP_DIR "/s3d1/s3d2/s3d4/f1"; /* * layout1 hierarchy: @@ -358,7 +360,8 @@ static void create_layout1(struct __test_metadata *const _metadata) ASSERT_EQ(0, mount_opt(&mnt_tmp, dir_s3d2)); clear_cap(_metadata, CAP_SYS_ADMIN); - ASSERT_EQ(0, mkdir(dir_s3d3, 0700)); + create_file(_metadata, file1_s3d3); + create_file(_metadata, file1_s3d4); } static void remove_layout1(struct __test_metadata *const _metadata) @@ -378,7 +381,8 @@ static void remove_layout1(struct __test_metadata *const _metadata) EXPECT_EQ(0, remove_path(dir_s2d2)); EXPECT_EQ(0, remove_path(file1_s3d1)); - EXPECT_EQ(0, remove_path(dir_s3d3)); + EXPECT_EQ(0, remove_path(file1_s3d3)); + EXPECT_EQ(0, remove_path(file1_s3d4)); set_cap(_metadata, CAP_SYS_ADMIN); umount(dir_s3d2); clear_cap(_metadata, CAP_SYS_ADMIN); @@ -772,6 +776,27 @@ static int create_ruleset(struct __test_metadata *const _metadata, return ruleset_fd; } +static void enforce_fs(struct __test_metadata *const _metadata, + const __u64 access_fs, const struct rule rules[]) +{ + int ruleset_fd; + + if (rules) { + ruleset_fd = create_ruleset(_metadata, access_fs, rules); + } else { + const struct landlock_ruleset_attr ruleset_attr = { + .handled_access_fs = access_fs, + }; + + ruleset_fd = landlock_create_ruleset(&ruleset_attr, + sizeof(ruleset_attr), 0); + ASSERT_LE(0, ruleset_fd); + } + + enforce_ruleset(_metadata, ruleset_fd); + EXPECT_EQ(0, close(ruleset_fd)); +} + TEST_F_FORK(layout0, proc_nsfs) { const struct rule rules[] = { @@ -2207,6 +2232,170 @@ TEST_F_FORK(layout1, rename_file) RENAME_EXCHANGE)); } +TEST_F_FORK(layout1, rename_whiteout_denied) +{ + /* The affected file is a FIFO. */ + ASSERT_EQ(0, unlink(file1_s3d3)); + ASSERT_EQ(0, mknod(file1_s3d3, S_IFIFO | 0600, 0)); + + /* Deny MAKE_REG, but allow MAKE_FIFO. */ + enforce_fs(_metadata, LANDLOCK_ACCESS_FS_MAKE_REG, NULL); + + /* + * Try to rename a file with RENAME_WHITEOUT. + * file1_s3d3 is in dir_s3d2 (tmpfs), so it supports RENAME_WHITEOUT. + * Denied, because whiteout creation is guarded with MAKE_REG. + */ + EXPECT_EQ(-1, renameat2(AT_FDCWD, file1_s3d3, AT_FDCWD, + TMP_DIR "/s3d1/s3d2/s3d3/f2", RENAME_WHITEOUT)); + EXPECT_EQ(EACCES, errno); +} + +static bool is_whiteout(const char *const path) +{ + struct stat st; + + if (stat(path, &st) == -1) + return false; + + return S_ISCHR(st.st_mode) && st.st_rdev == makedev(0, 0); +} + +static bool is_fifo(const char *const path) +{ + struct stat st; + + return stat(path, &st) == 0 && S_ISFIFO(st.st_mode); +} + +TEST_F_FORK(layout1, rename_whiteout_allowed) +{ + const struct rule rules[] = { + { + .path = dir_s3d3, + .access = LANDLOCK_ACCESS_FS_MAKE_REG, + }, + {}, + }; + + /* The affected file is a FIFO. */ + ASSERT_EQ(0, unlink(file1_s3d3)); + ASSERT_EQ(0, mknod(file1_s3d3, S_IFIFO | 0600, 0)); + + /* Allow MAKE_REG below dir_s3d3. */ + enforce_fs(_metadata, LANDLOCK_ACCESS_FS_MAKE_REG, rules); + + /* + * Rename a file with RENAME_WHITEOUT within the same directory. + * Allowed, because MAKE_REG is granted for the whiteout object which + * gets created in the source location. + */ + EXPECT_EQ(0, renameat2(AT_FDCWD, file1_s3d3, AT_FDCWD, + TMP_DIR "/s3d1/s3d2/s3d3/f2", RENAME_WHITEOUT)); + + /* A whiteout object took the place of the moved FIFO. */ + EXPECT_TRUE(is_whiteout(file1_s3d3)); + EXPECT_TRUE(is_fifo(TMP_DIR "/s3d1/s3d2/s3d3/f2")); +} + +TEST_F_FORK(layout1, rename_whiteout_reparenting) +{ + const struct rule rules[] = { + { + .path = dir_s3d2, + .access = LANDLOCK_ACCESS_FS_REFER, + }, + { + .path = dir_s3d3, + .access = LANDLOCK_ACCESS_FS_MAKE_REG, + }, + {}, + }; + + /* The moved files are FIFOs. */ + ASSERT_EQ(0, unlink(file1_s3d3)); + ASSERT_EQ(0, mknod(file1_s3d3, S_IFIFO | 0600, 0)); + ASSERT_EQ(0, unlink(file1_s3d4)); + ASSERT_EQ(0, mknod(file1_s3d4, S_IFIFO | 0600, 0)); + + /* Allow REFER below dir_s3d2, but MAKE_REG only below dir_s3d3. */ + enforce_fs(_metadata, + LANDLOCK_ACCESS_FS_MAKE_REG | LANDLOCK_ACCESS_FS_REFER, + rules); + + /* + * The whiteout object is created in the source directory: Moving the + * FIFO out of dir_s3d4 is denied because MAKE_REG is not granted + * there, even though it is granted in the destination directory + * dir_s3d3. + */ + EXPECT_EQ(-1, renameat2(AT_FDCWD, file1_s3d4, AT_FDCWD, + TMP_DIR "/s3d1/s3d2/s3d3/f2", RENAME_WHITEOUT)); + EXPECT_EQ(EACCES, errno); + + /* + * Moving the FIFO out of dir_s3d3 is allowed, because MAKE_REG is + * granted there for the created whiteout object. + */ + EXPECT_EQ(0, renameat2(AT_FDCWD, file1_s3d3, AT_FDCWD, + TMP_DIR "/s3d1/s3d2/s3d4/f2", RENAME_WHITEOUT)); + + /* A whiteout object took the place of the moved FIFO. */ + EXPECT_TRUE(is_whiteout(file1_s3d3)); + EXPECT_TRUE(is_fifo(TMP_DIR "/s3d1/s3d2/s3d4/f2")); +} + +TEST_F_FORK(layout1, rename_whiteout_exchange) +{ + const char *const whiteout_s3d3 = TMP_DIR "/s3d1/s3d2/s3d3/f2"; + const struct rule rules[] = { + { + .path = dir_s3d2, + .access = LANDLOCK_ACCESS_FS_REFER, + }, + { + .path = dir_s3d3, + .access = LANDLOCK_ACCESS_FS_MAKE_REG, + }, + {}, + }; + + /* The exchanged files are FIFOs and an existing whiteout object. */ + ASSERT_EQ(0, unlink(file1_s3d3)); + ASSERT_EQ(0, mknod(file1_s3d3, S_IFIFO | 0600, 0)); + ASSERT_EQ(0, mknod(whiteout_s3d3, S_IFCHR | 0600, makedev(0, 0))); + ASSERT_EQ(0, unlink(file1_s3d4)); + ASSERT_EQ(0, mknod(file1_s3d4, S_IFIFO | 0600, 0)); + + /* Allow REFER below dir_s3d2, but MAKE_REG only below dir_s3d3. */ + enforce_fs(_metadata, + LANDLOCK_ACCESS_FS_MAKE_REG | LANDLOCK_ACCESS_FS_REFER, + rules); + + /* + * With RENAME_EXCHANGE, the whiteout object moves into the source + * directory of the rename: Exchanging the FIFO in dir_s3d4 with the + * whiteout object is denied because MAKE_REG is not granted in + * dir_s3d4, even though it is granted in the whiteout object's own + * directory dir_s3d3. + */ + EXPECT_EQ(-1, renameat2(AT_FDCWD, file1_s3d4, AT_FDCWD, whiteout_s3d3, + RENAME_EXCHANGE)); + EXPECT_EQ(EACCES, errno); + + /* + * Exchanging the FIFO in dir_s3d3 with the whiteout object is + * allowed, because MAKE_REG is granted in the directory into which + * the whiteout object moves. + */ + EXPECT_EQ(0, renameat2(AT_FDCWD, file1_s3d3, AT_FDCWD, whiteout_s3d3, + RENAME_EXCHANGE)); + + /* The FIFO and the whiteout object swapped places. */ + EXPECT_TRUE(is_whiteout(file1_s3d3)); + EXPECT_TRUE(is_fifo(whiteout_s3d3)); +} + TEST_F_FORK(layout1, rename_dir) { const struct rule rules[] = { @@ -3260,6 +3449,18 @@ TEST_F_FORK(layout1, make_char) makedev(1, 3)); } +TEST_F_FORK(layout1, make_whiteout) +{ + /* + * Creates a whiteout object (creation guarded by MAKE_REG). + * + * Contrary to the other character devices, this does not require + * CAP_MKNOD, cf. vfs_mknod(). + */ + test_make_file(_metadata, LANDLOCK_ACCESS_FS_MAKE_REG, S_IFCHR, + makedev(0, 0)); +} + TEST_F_FORK(layout1, make_block) { /* Creates a /dev/loop0 device. */ -- 2.53.0 ^ permalink raw reply related [flat|nested] 922+ messages in thread
* [PATCH 6.12 011/877] sunvdc: fix -EIO issue due to lack of retries 2026-09-30 15:15 [PATCH 6.12 000/877] 6.12.112-rc1 review Greg Kroah-Hartman ` (9 preceding siblings ...) 2026-09-30 15:15 ` [PATCH 6.12 010/877] selftests/landlock: Add tests for whiteout object creation Greg Kroah-Hartman @ 2026-09-30 15:15 ` Greg Kroah-Hartman 2026-09-30 15:15 ` [PATCH 6.12 012/877] net: cpsw_new: Execute ndo_set_rx_mode callback in a work queue Greg Kroah-Hartman ` (873 subsequent siblings) 884 siblings, 0 replies; 922+ messages in thread From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw) To: stable Cc: Greg Kroah-Hartman, patches, John Paul Adrian Glaubitz, Stian Halseth, Jens Axboe, Sasha Levin 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jens Axboe <axboe@kernel.dk> [ Upstream commit 5067d4ba713961d8ccea1e06cd4c453793f3121e ] John reports that since commit: a11f6ca9aef9 ("sunvdc: Do not spin in an infinite loop when vio_ldc_send() returns EAGAIN") users of Linux inside Solaris ldom see occasional -EIO errors because the request send loop now times out. The current loop does 10 retries, and inside vio_ldc_send() a further 1000 1usec retries are done as well. Even with 10.5 msec of busy loop retries that's apparently not enough to always succeed. Rather than introduce continued busy looping, requeue the request and have the delayed queue kicking retry the request after another 10ms. This obviously isn't ideal, but there's seemingly no way to wait for this type of event. And if 10ms of busy looping was not enough to make progress, then presumably this is an edge condition and we just need to guarantee to make forward progress at some later point in time. That's more suitably done through letting the CPU tend to other work, rather than sitting in a tight loop retrying. [stian: rebased on top of the cookie-unmap fix, without which every requeued attempt leaks LDC map table entries; tested on an UltraSPARC T4 LDOM where the vdc_tx_trigger failure condition was reproduced and absorbed by the requeue with no I/O error] Reported-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> Link: https://lore.kernel.org/all/20251006100226.4246-2-glaubitz@physik.fu-berlin.de/ Link: https://lore.kernel.org/all/418310b3-2b77-4534-b2fd-27dcc11e333c@kernel.dk/ Signed-off-by: Stian Halseth <stian@itx.no> Link: https://patch.msgid.link/20260901173947.3292110-3-stian@itx.no Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Sasha Levin <sashal@kernel.org> --- drivers/block/sunvdc.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/block/sunvdc.c b/drivers/block/sunvdc.c index 97fe566465d79..16953341e5013 100644 --- a/drivers/block/sunvdc.c +++ b/drivers/block/sunvdc.c @@ -557,6 +557,7 @@ static blk_status_t vdc_queue_rq(struct blk_mq_hw_ctx *hctx, struct vdc_port *port = hctx->queue->queuedata; struct vio_dring_state *dr; unsigned long flags; + int ret; dr = &port->vio.drings[VIO_DRIVER_TX_RING]; @@ -578,7 +579,13 @@ static blk_status_t vdc_queue_rq(struct blk_mq_hw_ctx *hctx, return BLK_STS_DEV_RESOURCE; } - if (__send_request(bd->rq) < 0) { + ret = __send_request(bd->rq); + if (ret == -EAGAIN) { + spin_unlock_irqrestore(&port->vio.lock, flags); + /* already spun for 10msec, defer 10msec and retry */ + blk_mq_delay_kick_requeue_list(hctx->queue, 10); + return BLK_STS_DEV_RESOURCE; + } else if (ret < 0) { spin_unlock_irqrestore(&port->vio.lock, flags); return BLK_STS_IOERR; } -- 2.53.0 ^ permalink raw reply related [flat|nested] 922+ messages in thread
* [PATCH 6.12 012/877] net: cpsw_new: Execute ndo_set_rx_mode callback in a work queue 2026-09-30 15:15 [PATCH 6.12 000/877] 6.12.112-rc1 review Greg Kroah-Hartman ` (10 preceding siblings ...) 2026-09-30 15:15 ` [PATCH 6.12 011/877] sunvdc: fix -EIO issue due to lack of retries Greg Kroah-Hartman @ 2026-09-30 15:15 ` Greg Kroah-Hartman 2026-09-30 15:15 ` [PATCH 6.12 013/877] net: cpsw: " Greg Kroah-Hartman ` (872 subsequent siblings) 884 siblings, 0 replies; 922+ messages in thread From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw) To: stable; +Cc: Greg Kroah-Hartman, patches, Kevin Hao, Jakub Kicinski, Sasha Levin 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Kevin Hao <haokexin@gmail.com> commit c0b5dc73a38f954e780f93a549b8fe225235c07a upstream. Commit 1767bb2d47b7 ("ipv6: mcast: Don't hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP.") removed the RTNL lock for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP operations. However, this change triggered the following call trace on my BeagleBone Black board: WARNING: net/8021q/vlan_core.c:236 at vlan_for_each+0x120/0x124, CPU#0: rpcbind/496 RTNL: assertion failed at net/8021q/vlan_core.c (236) Modules linked in: CPU: 0 UID: 997 PID: 496 Comm: rpcbind Not tainted 6.19.0-rc6-next-20260122-yocto-standard+ #8 PREEMPT Hardware name: Generic AM33XX (Flattened Device Tree) Call trace: unwind_backtrace from show_stack+0x28/0x2c show_stack from dump_stack_lvl+0x30/0x38 dump_stack_lvl from __warn+0xb8/0x11c __warn from warn_slowpath_fmt+0x130/0x194 warn_slowpath_fmt from vlan_for_each+0x120/0x124 vlan_for_each from cpsw_add_mc_addr+0x54/0xd8 cpsw_add_mc_addr from __hw_addr_ref_sync_dev+0xc4/0xec __hw_addr_ref_sync_dev from __dev_mc_add+0x78/0x88 __dev_mc_add from igmp6_group_added+0x84/0xec igmp6_group_added from __ipv6_dev_mc_inc+0x1fc/0x2f0 __ipv6_dev_mc_inc from __ipv6_sock_mc_join+0x124/0x1b4 __ipv6_sock_mc_join from do_ipv6_setsockopt+0x84c/0x1168 do_ipv6_setsockopt from ipv6_setsockopt+0x88/0xc8 ipv6_setsockopt from do_sock_setsockopt+0xe8/0x19c do_sock_setsockopt from __sys_setsockopt+0x84/0xac __sys_setsockopt from ret_fast_syscall+0x0/0x5 This trace occurs because vlan_for_each() is called within cpsw_ndo_set_rx_mode(), which expects the RTNL lock to be held. Since modifying vlan_for_each() to operate without the RTNL lock is not straightforward, and because ndo_set_rx_mode() is invoked both with and without the RTNL lock across different code paths, simply adding rtnl_lock() in cpsw_ndo_set_rx_mode() is not a viable solution. To resolve this issue, we opt to execute the actual processing within a work queue, following the approach used by the icssg-prueth driver. Fixes: 1767bb2d47b7 ("ipv6: mcast: Don't hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP.") Signed-off-by: Kevin Hao <haokexin@gmail.com> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260203-bbb-v5-1-ea0ea217a85c@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> --- drivers/net/ethernet/ti/cpsw_new.c | 35 ++++++++++++++++++++++++----- drivers/net/ethernet/ti/cpsw_priv.h | 1 + 2 files changed, 30 insertions(+), 6 deletions(-) diff --git a/drivers/net/ethernet/ti/cpsw_new.c b/drivers/net/ethernet/ti/cpsw_new.c index 468eaa6f785e6..c2041e46b83d6 100644 --- a/drivers/net/ethernet/ti/cpsw_new.c +++ b/drivers/net/ethernet/ti/cpsw_new.c @@ -248,16 +248,22 @@ static int cpsw_purge_all_mc(struct net_device *ndev, const u8 *addr, int num) return 0; } -static void cpsw_ndo_set_rx_mode(struct net_device *ndev) +static void cpsw_ndo_set_rx_mode_work(struct work_struct *work) { - struct cpsw_priv *priv = netdev_priv(ndev); + struct cpsw_priv *priv = container_of(work, struct cpsw_priv, rx_mode_work); struct cpsw_common *cpsw = priv->cpsw; + struct net_device *ndev = priv->ndev; + + rtnl_lock(); + if (!netif_running(ndev)) + goto unlock_rtnl; + netif_addr_lock_bh(ndev); if (ndev->flags & IFF_PROMISC) { /* Enable promiscuous mode */ cpsw_set_promiscious(ndev, true); cpsw_ale_set_allmulti(cpsw->ale, IFF_ALLMULTI, priv->emac_port); - return; + goto unlock_addr; } /* Disable promiscuous mode */ @@ -270,6 +276,18 @@ static void cpsw_ndo_set_rx_mode(struct net_device *ndev) /* add/remove mcast address either for real netdev or for vlan */ __hw_addr_ref_sync_dev(&ndev->mc, ndev, cpsw_add_mc_addr, cpsw_del_mc_addr); + +unlock_addr: + netif_addr_unlock_bh(ndev); +unlock_rtnl: + rtnl_unlock(); +} + +static void cpsw_ndo_set_rx_mode(struct net_device *ndev) +{ + struct cpsw_priv *priv = netdev_priv(ndev); + + schedule_work(&priv->rx_mode_work); } static unsigned int cpsw_rxbuf_total_len(unsigned int len) @@ -1391,6 +1409,7 @@ static int cpsw_create_ports(struct cpsw_common *cpsw) priv->msg_enable = netif_msg_init(debug_level, CPSW_DEBUG); priv->emac_port = i + 1; priv->tx_packet_min = CPSW_MIN_PACKET_SIZE; + INIT_WORK(&priv->rx_mode_work, cpsw_ndo_set_rx_mode_work); if (is_valid_ether_addr(slave_data->mac_addr)) { ether_addr_copy(priv->mac_addr, slave_data->mac_addr); @@ -1440,14 +1459,18 @@ static int cpsw_create_ports(struct cpsw_common *cpsw) static void cpsw_unregister_ports(struct cpsw_common *cpsw) { + struct net_device *ndev; + struct cpsw_priv *priv; int i = 0; for (i = 0; i < cpsw->data.slaves; i++) { - if (!cpsw->slaves[i].ndev || - cpsw->slaves[i].ndev->reg_state != NETREG_REGISTERED) + ndev = cpsw->slaves[i].ndev; + if (!ndev || ndev->reg_state != NETREG_REGISTERED) continue; - unregister_netdev(cpsw->slaves[i].ndev); + priv = netdev_priv(ndev); + unregister_netdev(ndev); + disable_work_sync(&priv->rx_mode_work); } } diff --git a/drivers/net/ethernet/ti/cpsw_priv.h b/drivers/net/ethernet/ti/cpsw_priv.h index 1f448290b9f4b..bacaa855e6148 100644 --- a/drivers/net/ethernet/ti/cpsw_priv.h +++ b/drivers/net/ethernet/ti/cpsw_priv.h @@ -391,6 +391,7 @@ struct cpsw_priv { u32 tx_packet_min; struct cpsw_ale_ratelimit ale_bc_ratelimit; struct cpsw_ale_ratelimit ale_mc_ratelimit; + struct work_struct rx_mode_work; }; #define ndev_to_cpsw(ndev) (((struct cpsw_priv *)netdev_priv(ndev))->cpsw) -- 2.53.0 ^ permalink raw reply related [flat|nested] 922+ messages in thread
* [PATCH 6.12 013/877] net: cpsw: Execute ndo_set_rx_mode callback in a work queue 2026-09-30 15:15 [PATCH 6.12 000/877] 6.12.112-rc1 review Greg Kroah-Hartman ` (11 preceding siblings ...) 2026-09-30 15:15 ` [PATCH 6.12 012/877] net: cpsw_new: Execute ndo_set_rx_mode callback in a work queue Greg Kroah-Hartman @ 2026-09-30 15:15 ` Greg Kroah-Hartman 2026-09-30 15:15 ` [PATCH 6.12 014/877] ipv6: mcast: Use in6_dev_get() in ipv6_dev_mc_dec() Greg Kroah-Hartman ` (871 subsequent siblings) 884 siblings, 0 replies; 922+ messages in thread From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw) To: stable; +Cc: Greg Kroah-Hartman, patches, Kevin Hao, Jakub Kicinski, Sasha Levin 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Kevin Hao <haokexin@gmail.com> commit 0b8c878d117319f2be34c8391a77e0f4d5c94d79 upstream. Commit 1767bb2d47b7 ("ipv6: mcast: Don't hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP.") removed the RTNL lock for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP operations. However, this change triggered the following call trace on my BeagleBone Black board: WARNING: net/8021q/vlan_core.c:236 at vlan_for_each+0x120/0x124, CPU#0: rpcbind/481 RTNL: assertion failed at net/8021q/vlan_core.c (236) Modules linked in: CPU: 0 UID: 997 PID: 481 Comm: rpcbind Not tainted 6.19.0-rc7-next-20260130-yocto-standard+ #35 PREEMPT Hardware name: Generic AM33XX (Flattened Device Tree) Call trace: unwind_backtrace from show_stack+0x28/0x2c show_stack from dump_stack_lvl+0x30/0x38 dump_stack_lvl from __warn+0xb8/0x11c __warn from warn_slowpath_fmt+0x130/0x194 warn_slowpath_fmt from vlan_for_each+0x120/0x124 vlan_for_each from cpsw_add_mc_addr+0x54/0x98 cpsw_add_mc_addr from __hw_addr_ref_sync_dev+0xc4/0xec __hw_addr_ref_sync_dev from __dev_mc_add+0x78/0x88 __dev_mc_add from igmp6_group_added+0x84/0xec igmp6_group_added from __ipv6_dev_mc_inc+0x1fc/0x2f0 __ipv6_dev_mc_inc from __ipv6_sock_mc_join+0x124/0x1b4 __ipv6_sock_mc_join from do_ipv6_setsockopt+0x84c/0x1168 do_ipv6_setsockopt from ipv6_setsockopt+0x88/0xc8 ipv6_setsockopt from do_sock_setsockopt+0xe8/0x19c do_sock_setsockopt from __sys_setsockopt+0x84/0xac __sys_setsockopt from ret_fast_syscall+0x0/0x54 This trace occurs because vlan_for_each() is called within cpsw_ndo_set_rx_mode(), which expects the RTNL lock to be held. Since modifying vlan_for_each() to operate without the RTNL lock is not straightforward, and because ndo_set_rx_mode() is invoked both with and without the RTNL lock across different code paths, simply adding rtnl_lock() in cpsw_ndo_set_rx_mode() is not a viable solution. To resolve this issue, we opt to execute the actual processing within a work queue, following the approach used by the icssg-prueth driver. Please note: To reproduce this issue, I manually reverted the changes to am335x-bone-common.dtsi from commit c477358e66a3 ("ARM: dts: am335x-bone: switch to new cpsw switch drv") in order to revert to the legacy cpsw driver. Fixes: 1767bb2d47b7 ("ipv6: mcast: Don't hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP.") Signed-off-by: Kevin Hao <haokexin@gmail.com> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260203-bbb-v5-2-ea0ea217a85c@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> --- drivers/net/ethernet/ti/cpsw.c | 41 +++++++++++++++++++++++++++++----- 1 file changed, 35 insertions(+), 6 deletions(-) diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c index c0a5abd8d9a8e..2968b5fbe428c 100644 --- a/drivers/net/ethernet/ti/cpsw.c +++ b/drivers/net/ethernet/ti/cpsw.c @@ -305,12 +305,19 @@ static int cpsw_purge_all_mc(struct net_device *ndev, const u8 *addr, int num) return 0; } -static void cpsw_ndo_set_rx_mode(struct net_device *ndev) +static void cpsw_ndo_set_rx_mode_work(struct work_struct *work) { - struct cpsw_priv *priv = netdev_priv(ndev); + struct cpsw_priv *priv = container_of(work, struct cpsw_priv, rx_mode_work); struct cpsw_common *cpsw = priv->cpsw; + struct net_device *ndev = priv->ndev; int slave_port = -1; + rtnl_lock(); + if (!netif_running(ndev)) + goto unlock_rtnl; + + netif_addr_lock_bh(ndev); + if (cpsw->data.dual_emac) slave_port = priv->emac_port + 1; @@ -318,7 +325,7 @@ static void cpsw_ndo_set_rx_mode(struct net_device *ndev) /* Enable promiscuous mode */ cpsw_set_promiscious(ndev, true); cpsw_ale_set_allmulti(cpsw->ale, IFF_ALLMULTI, slave_port); - return; + goto unlock_addr; } else { /* Disable promiscuous mode */ cpsw_set_promiscious(ndev, false); @@ -331,6 +338,18 @@ static void cpsw_ndo_set_rx_mode(struct net_device *ndev) /* add/remove mcast address either for real netdev or for vlan */ __hw_addr_ref_sync_dev(&ndev->mc, ndev, cpsw_add_mc_addr, cpsw_del_mc_addr); + +unlock_addr: + netif_addr_unlock_bh(ndev); +unlock_rtnl: + rtnl_unlock(); +} + +static void cpsw_ndo_set_rx_mode(struct net_device *ndev) +{ + struct cpsw_priv *priv = netdev_priv(ndev); + + schedule_work(&priv->rx_mode_work); } static unsigned int cpsw_rxbuf_total_len(unsigned int len) @@ -1444,6 +1463,7 @@ static int cpsw_probe_dual_emac(struct cpsw_priv *priv) priv_sl2->ndev = ndev; priv_sl2->dev = &ndev->dev; priv_sl2->msg_enable = netif_msg_init(debug_level, CPSW_DEBUG); + INIT_WORK(&priv_sl2->rx_mode_work, cpsw_ndo_set_rx_mode_work); if (is_valid_ether_addr(data->slave_data[1].mac_addr)) { memcpy(priv_sl2->mac_addr, data->slave_data[1].mac_addr, @@ -1625,6 +1645,7 @@ static int cpsw_probe(struct platform_device *pdev) priv->dev = dev; priv->msg_enable = netif_msg_init(debug_level, CPSW_DEBUG); priv->emac_port = 0; + INIT_WORK(&priv->rx_mode_work, cpsw_ndo_set_rx_mode_work); if (is_valid_ether_addr(data->slave_data[0].mac_addr)) { memcpy(priv->mac_addr, data->slave_data[0].mac_addr, ETH_ALEN); @@ -1727,6 +1748,8 @@ static int cpsw_probe(struct platform_device *pdev) static void cpsw_remove(struct platform_device *pdev) { struct cpsw_common *cpsw = platform_get_drvdata(pdev); + struct net_device *ndev; + struct cpsw_priv *priv; int i, ret; ret = pm_runtime_resume_and_get(&pdev->dev); @@ -1739,9 +1762,15 @@ static void cpsw_remove(struct platform_device *pdev) return; } - for (i = 0; i < cpsw->data.slaves; i++) - if (cpsw->slaves[i].ndev) - unregister_netdev(cpsw->slaves[i].ndev); + for (i = 0; i < cpsw->data.slaves; i++) { + ndev = cpsw->slaves[i].ndev; + if (!ndev) + continue; + + priv = netdev_priv(ndev); + unregister_netdev(ndev); + disable_work_sync(&priv->rx_mode_work); + } cpts_release(cpsw->cpts); cpdma_ctlr_destroy(cpsw->dma); -- 2.53.0 ^ permalink raw reply related [flat|nested] 922+ messages in thread
* [PATCH 6.12 014/877] ipv6: mcast: Use in6_dev_get() in ipv6_dev_mc_dec(). 2026-09-30 15:15 [PATCH 6.12 000/877] 6.12.112-rc1 review Greg Kroah-Hartman ` (12 preceding siblings ...) 2026-09-30 15:15 ` [PATCH 6.12 013/877] net: cpsw: " Greg Kroah-Hartman @ 2026-09-30 15:15 ` Greg Kroah-Hartman 2026-09-30 15:15 ` [PATCH 6.12 015/877] ipv6: mcast: Dont hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP Greg Kroah-Hartman ` (870 subsequent siblings) 884 siblings, 0 replies; 922+ messages in thread From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw) To: stable Cc: Greg Kroah-Hartman, patches, Kuniyuki Iwashima, Eric Dumazet, Jakub Kicinski, Sasha Levin 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Kuniyuki Iwashima <kuniyu@google.com> [ Upstream commit e01b193e0b50ae849bf60067e111446f19ee2f20 ] As well as __ipv6_dev_mc_inc(), all code in __ipv6_dev_mc_dec() are protected by inet6_dev->mc_lock, and RTNL is not needed. Let's use in6_dev_get() in ipv6_dev_mc_dec() and remove ASSERT_RTNL() in __ipv6_dev_mc_dec(). Now, we can remove the RTNL comment above addrconf_leave_solict() too. Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20250702230210.3115355-6-kuni1840@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> --- net/ipv6/addrconf.c | 3 +-- net/ipv6/mcast.c | 14 ++++++-------- 2 files changed, 7 insertions(+), 10 deletions(-) diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c index ef938fb1d7549..fb239e8f83593 100644 --- a/net/ipv6/addrconf.c +++ b/net/ipv6/addrconf.c @@ -2255,12 +2255,11 @@ void addrconf_join_solict(struct net_device *dev, const struct in6_addr *addr) ipv6_dev_mc_inc(dev, &maddr); } -/* caller must hold RTNL */ void addrconf_leave_solict(struct inet6_dev *idev, const struct in6_addr *addr) { struct in6_addr maddr; - if (idev->dev->flags&(IFF_LOOPBACK|IFF_NOARP)) + if (READ_ONCE(idev->dev->flags) & (IFF_LOOPBACK | IFF_NOARP)) return; addrconf_addr_solict_mult(addr, &maddr); diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c index c060954c52757..212c2d8efe0f5 100644 --- a/net/ipv6/mcast.c +++ b/net/ipv6/mcast.c @@ -972,9 +972,8 @@ int __ipv6_dev_mc_dec(struct inet6_dev *idev, const struct in6_addr *addr) { struct ifmcaddr6 *ma, __rcu **map; - ASSERT_RTNL(); - mutex_lock(&idev->mc_lock); + for (map = &idev->mc_list; (ma = mc_dereference(*map, idev)); map = &ma->next) { @@ -1003,13 +1002,12 @@ int ipv6_dev_mc_dec(struct net_device *dev, const struct in6_addr *addr) struct inet6_dev *idev; int err; - ASSERT_RTNL(); - - idev = __in6_dev_get(dev); + idev = in6_dev_get(dev); if (!idev) - err = -ENODEV; - else - err = __ipv6_dev_mc_dec(idev, addr); + return -ENODEV; + + err = __ipv6_dev_mc_dec(idev, addr); + in6_dev_put(idev); return err; } -- 2.53.0 ^ permalink raw reply related [flat|nested] 922+ messages in thread
* [PATCH 6.12 015/877] ipv6: mcast: Dont hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP. 2026-09-30 15:15 [PATCH 6.12 000/877] 6.12.112-rc1 review Greg Kroah-Hartman ` (13 preceding siblings ...) 2026-09-30 15:15 ` [PATCH 6.12 014/877] ipv6: mcast: Use in6_dev_get() in ipv6_dev_mc_dec() Greg Kroah-Hartman @ 2026-09-30 15:15 ` Greg Kroah-Hartman 2026-09-30 15:15 ` [PATCH 6.12 016/877] ipv6: mcast: Dont hold RTNL for IPV6_DROP_MEMBERSHIP and MCAST_LEAVE_GROUP Greg Kroah-Hartman ` (869 subsequent siblings) 884 siblings, 0 replies; 922+ messages in thread From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw) To: stable Cc: Greg Kroah-Hartman, patches, Kuniyuki Iwashima, Eric Dumazet, Jakub Kicinski, Sasha Levin 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Kuniyuki Iwashima <kuniyu@google.com> [ Upstream commit 1767bb2d47b715a106287a8f963d9ec6cbab4e69 ] In __ipv6_sock_mc_join(), per-socket mld data is protected by lock_sock(), and only __dev_get_by_index() requires RTNL. Let's use dev_get_by_index() and drop RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP. Note that we must call rt6_lookup() and dev_hold() under RCU. If rt6_lookup() returns an entry from the exception table, dst_dev_put() could change rt->dev.dst to loopback concurrently, and the original device could lose the refcount before dev_hold() and unblock device registration. dst_dev_put() is called from NETDEV_UNREGISTER and synchronize_net() follows it, so as long as rt6_lookup() and dev_hold() are called within the same RCU critical section, the dev is alive. Even if the race happens, they are synchronised by idev->dead and mcast addresses are cleaned up. For the racy access to rt->dst.dev, we use dst_dev(). Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20250702230210.3115355-7-kuni1840@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> --- net/ipv6/ipv6_sockglue.c | 2 -- net/ipv6/mcast.c | 24 +++++++++++++----------- 2 files changed, 13 insertions(+), 13 deletions(-) diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index c2ea92c0f9166..385321a43a19b 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -121,11 +121,9 @@ static bool setsockopt_needs_rtnl(int optname) { switch (optname) { case IPV6_ADDRFORM: - case IPV6_ADD_MEMBERSHIP: case IPV6_DROP_MEMBERSHIP: case IPV6_JOIN_ANYCAST: case IPV6_LEAVE_ANYCAST: - case MCAST_JOIN_GROUP: case MCAST_LEAVE_GROUP: case MCAST_JOIN_SOURCE_GROUP: case MCAST_LEAVE_SOURCE_GROUP: diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c index 212c2d8efe0f5..61046543302d4 100644 --- a/net/ipv6/mcast.c +++ b/net/ipv6/mcast.c @@ -172,14 +172,12 @@ static int unsolicited_report_interval(struct inet6_dev *idev) static int __ipv6_sock_mc_join(struct sock *sk, int ifindex, const struct in6_addr *addr, unsigned int mode) { - struct net_device *dev = NULL; - struct ipv6_mc_socklist *mc_lst; struct ipv6_pinfo *np = inet6_sk(sk); + struct ipv6_mc_socklist *mc_lst; struct net *net = sock_net(sk); + struct net_device *dev = NULL; int err; - ASSERT_RTNL(); - if (!ipv6_addr_is_multicast(addr)) return -EINVAL; @@ -199,13 +197,18 @@ static int __ipv6_sock_mc_join(struct sock *sk, int ifindex, if (ifindex == 0) { struct rt6_info *rt; + + rcu_read_lock(); rt = rt6_lookup(net, addr, NULL, 0, NULL, 0); if (rt) { - dev = rt->dst.dev; + dev = dst_dev(&rt->dst); + dev_hold(dev); ip6_rt_put(rt); } - } else - dev = __dev_get_by_index(net, ifindex); + rcu_read_unlock(); + } else { + dev = dev_get_by_index(net, ifindex); + } if (!dev) { sock_kfree_s(sk, mc_lst, sizeof(*mc_lst)); @@ -216,12 +219,11 @@ static int __ipv6_sock_mc_join(struct sock *sk, int ifindex, mc_lst->sfmode = mode; RCU_INIT_POINTER(mc_lst->sflist, NULL); - /* - * now add/increase the group membership on the device - */ - + /* now add/increase the group membership on the device */ err = __ipv6_dev_mc_inc(dev, addr, mode); + dev_put(dev); + if (err) { sock_kfree_s(sk, mc_lst, sizeof(*mc_lst)); return err; -- 2.53.0 ^ permalink raw reply related [flat|nested] 922+ messages in thread
* [PATCH 6.12 016/877] ipv6: mcast: Dont hold RTNL for IPV6_DROP_MEMBERSHIP and MCAST_LEAVE_GROUP. 2026-09-30 15:15 [PATCH 6.12 000/877] 6.12.112-rc1 review Greg Kroah-Hartman ` (14 preceding siblings ...) 2026-09-30 15:15 ` [PATCH 6.12 015/877] ipv6: mcast: Dont hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP Greg Kroah-Hartman @ 2026-09-30 15:15 ` Greg Kroah-Hartman 2026-09-30 15:15 ` [PATCH 6.12 017/877] ipv6: mcast: Dont hold RTNL for MCAST_ socket options Greg Kroah-Hartman ` (868 subsequent siblings) 884 siblings, 0 replies; 922+ messages in thread From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw) To: stable Cc: Greg Kroah-Hartman, patches, Kuniyuki Iwashima, Eric Dumazet, Jakub Kicinski, Sasha Levin 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Kuniyuki Iwashima <kuniyu@google.com> [ Upstream commit 2ceb71ce7d34e751f91bbca9da3513a2bc29089c ] In __ipv6_sock_mc_drop(), per-socket mld data is protected by lock_sock(), and only __dev_get_by_index() and __in6_dev_get() require RTNL. Let's use dev_get_by_index() and in6_dev_get() and drop RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP. Note that __ipv6_sock_mc_drop() is factorised to reuse in the next patch. Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20250702230210.3115355-8-kuni1840@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> --- net/ipv6/ipv6_sockglue.c | 2 -- net/ipv6/mcast.c | 47 +++++++++++++++++++++++----------------- 2 files changed, 27 insertions(+), 22 deletions(-) diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index 385321a43a19b..ab6987e72e3a7 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -121,10 +121,8 @@ static bool setsockopt_needs_rtnl(int optname) { switch (optname) { case IPV6_ADDRFORM: - case IPV6_DROP_MEMBERSHIP: case IPV6_JOIN_ANYCAST: case IPV6_LEAVE_ANYCAST: - case MCAST_LEAVE_GROUP: case MCAST_JOIN_SOURCE_GROUP: case MCAST_LEAVE_SOURCE_GROUP: case MCAST_BLOCK_SOURCE: diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c index 61046543302d4..2f485e58a7d49 100644 --- a/net/ipv6/mcast.c +++ b/net/ipv6/mcast.c @@ -250,14 +250,36 @@ int ipv6_sock_mc_join_ssm(struct sock *sk, int ifindex, /* * socket leave on multicast group */ +static void __ipv6_sock_mc_drop(struct sock *sk, struct ipv6_mc_socklist *mc_lst) +{ + struct net *net = sock_net(sk); + struct net_device *dev; + + dev = dev_get_by_index(net, mc_lst->ifindex); + if (dev) { + struct inet6_dev *idev = in6_dev_get(dev); + + ip6_mc_leave_src(sk, mc_lst, idev); + + if (idev) { + __ipv6_dev_mc_dec(idev, &mc_lst->addr); + in6_dev_put(idev); + } + + dev_put(dev); + } else { + ip6_mc_leave_src(sk, mc_lst, NULL); + } + + atomic_sub(sizeof(*mc_lst), &sk->sk_omem_alloc); + kfree_rcu(mc_lst, rcu); +} + int ipv6_sock_mc_drop(struct sock *sk, int ifindex, const struct in6_addr *addr) { struct ipv6_pinfo *np = inet6_sk(sk); - struct ipv6_mc_socklist *mc_lst; struct ipv6_mc_socklist __rcu **lnk; - struct net *net = sock_net(sk); - - ASSERT_RTNL(); + struct ipv6_mc_socklist *mc_lst; if (!ipv6_addr_is_multicast(addr)) return -EINVAL; @@ -267,23 +289,8 @@ int ipv6_sock_mc_drop(struct sock *sk, int ifindex, const struct in6_addr *addr) lnk = &mc_lst->next) { if ((ifindex == 0 || mc_lst->ifindex == ifindex) && ipv6_addr_equal(&mc_lst->addr, addr)) { - struct net_device *dev; - *lnk = mc_lst->next; - - dev = __dev_get_by_index(net, mc_lst->ifindex); - if (dev) { - struct inet6_dev *idev = __in6_dev_get(dev); - - ip6_mc_leave_src(sk, mc_lst, idev); - if (idev) - __ipv6_dev_mc_dec(idev, &mc_lst->addr); - } else { - ip6_mc_leave_src(sk, mc_lst, NULL); - } - - atomic_sub(sizeof(*mc_lst), &sk->sk_omem_alloc); - kfree_rcu(mc_lst, rcu); + __ipv6_sock_mc_drop(sk, mc_lst); return 0; } } -- 2.53.0 ^ permalink raw reply related [flat|nested] 922+ messages in thread
* [PATCH 6.12 017/877] ipv6: mcast: Dont hold RTNL for MCAST_ socket options. 2026-09-30 15:15 [PATCH 6.12 000/877] 6.12.112-rc1 review Greg Kroah-Hartman ` (15 preceding siblings ...) 2026-09-30 15:15 ` [PATCH 6.12 016/877] ipv6: mcast: Dont hold RTNL for IPV6_DROP_MEMBERSHIP and MCAST_LEAVE_GROUP Greg Kroah-Hartman @ 2026-09-30 15:15 ` Greg Kroah-Hartman 2026-09-30 15:15 ` [PATCH 6.12 018/877] ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source() Greg Kroah-Hartman ` (867 subsequent siblings) 884 siblings, 0 replies; 922+ messages in thread From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw) To: stable Cc: Greg Kroah-Hartman, patches, Kuniyuki Iwashima, Eric Dumazet, Jakub Kicinski, Sasha Levin 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Kuniyuki Iwashima <kuniyu@google.com> [ Upstream commit e6e14d582dd2cbee362c48a1865f8d03ca0a5611 ] In ip6_mc_source() and ip6_mc_msfilter(), per-socket mld data is protected by lock_sock() and inet6_dev->mc_lock is also held for some per-interface functions. ip6_mc_find_dev_rtnl() only depends on RTNL. If we want to remove it, we need to check inet6_dev->dead under mc_lock to close the race with addrconf_ifdown(), as mentioned earlier. Let's do that and drop RTNL for the rest of MCAST_ socket options. Note that ip6_mc_msfilter() has unnecessary lock dances and they are integrated into one to avoid the last-minute error and simplify the error handling. Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20250702230210.3115355-10-kuni1840@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> --- net/ipv6/ipv6_sockglue.c | 5 --- net/ipv6/mcast.c | 74 ++++++++++++++++++++++++---------------- 2 files changed, 45 insertions(+), 34 deletions(-) diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index ab6987e72e3a7..0f1242138d176 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -123,11 +123,6 @@ static bool setsockopt_needs_rtnl(int optname) case IPV6_ADDRFORM: case IPV6_JOIN_ANYCAST: case IPV6_LEAVE_ANYCAST: - case MCAST_JOIN_SOURCE_GROUP: - case MCAST_LEAVE_SOURCE_GROUP: - case MCAST_BLOCK_SOURCE: - case MCAST_UNBLOCK_SOURCE: - case MCAST_MSFILTER: return true; } return false; diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c index 2f485e58a7d49..02919944d5570 100644 --- a/net/ipv6/mcast.c +++ b/net/ipv6/mcast.c @@ -299,31 +299,36 @@ int ipv6_sock_mc_drop(struct sock *sk, int ifindex, const struct in6_addr *addr) } EXPORT_SYMBOL(ipv6_sock_mc_drop); -static struct inet6_dev *ip6_mc_find_dev_rtnl(struct net *net, - const struct in6_addr *group, - int ifindex) +static struct inet6_dev *ip6_mc_find_dev(struct net *net, + const struct in6_addr *group, + int ifindex) { struct net_device *dev = NULL; - struct inet6_dev *idev = NULL; + struct inet6_dev *idev; if (ifindex == 0) { - struct rt6_info *rt = rt6_lookup(net, group, NULL, 0, NULL, 0); + struct rt6_info *rt; + rcu_read_lock(); + rt = rt6_lookup(net, group, NULL, 0, NULL, 0); if (rt) { - dev = rt->dst.dev; + dev = dst_dev(&rt->dst); + dev_hold(dev); ip6_rt_put(rt); } + rcu_read_unlock(); } else { - dev = __dev_get_by_index(net, ifindex); + dev = dev_get_by_index(net, ifindex); } - if (!dev) return NULL; - idev = __in6_dev_get(dev); + + idev = in6_dev_get(dev); + dev_put(dev); + if (!idev) return NULL; - if (idev->dead) - return NULL; + return idev; } @@ -371,16 +376,16 @@ void ipv6_sock_mc_close(struct sock *sk) } int ip6_mc_source(int add, int omode, struct sock *sk, - struct group_source_req *pgsr) + struct group_source_req *pgsr) { + struct ipv6_pinfo *inet6 = inet6_sk(sk); struct in6_addr *source, *group; + struct net *net = sock_net(sk); struct ipv6_mc_socklist *pmc; - struct inet6_dev *idev; - struct ipv6_pinfo *inet6 = inet6_sk(sk); struct ip6_sf_socklist *psl; - struct net *net = sock_net(sk); - int i, j, rv; + struct inet6_dev *idev; int leavegroup = 0; + int i, j, rv; int err; source = &((struct sockaddr_in6 *)&pgsr->gsr_source)->sin6_addr; @@ -389,13 +394,19 @@ int ip6_mc_source(int add, int omode, struct sock *sk, if (!ipv6_addr_is_multicast(group)) return -EINVAL; - idev = ip6_mc_find_dev_rtnl(net, group, pgsr->gsr_interface); + idev = ip6_mc_find_dev(net, group, pgsr->gsr_interface); if (!idev) return -ENODEV; + mutex_lock(&idev->mc_lock); + + if (idev->dead) { + err = -ENODEV; + goto done; + } + err = -EADDRNOTAVAIL; - mutex_lock(&idev->mc_lock); for_each_pmc_socklock(inet6, sk, pmc) { if (pgsr->gsr_interface && pmc->ifindex != pgsr->gsr_interface) continue; @@ -492,6 +503,7 @@ int ip6_mc_source(int add, int omode, struct sock *sk, ip6_mc_add_src(idev, group, omode, 1, source, 1); done: mutex_unlock(&idev->mc_lock); + in6_dev_put(idev); if (leavegroup) err = ipv6_sock_mc_drop(sk, pgsr->gsr_interface, group); return err; @@ -500,12 +512,12 @@ int ip6_mc_source(int add, int omode, struct sock *sk, int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf, struct sockaddr_storage *list) { - const struct in6_addr *group; - struct ipv6_mc_socklist *pmc; - struct inet6_dev *idev; struct ipv6_pinfo *inet6 = inet6_sk(sk); struct ip6_sf_socklist *newpsl, *psl; struct net *net = sock_net(sk); + const struct in6_addr *group; + struct ipv6_mc_socklist *pmc; + struct inet6_dev *idev; int leavegroup = 0; int i, err; @@ -517,10 +529,17 @@ int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf, gsf->gf_fmode != MCAST_EXCLUDE) return -EINVAL; - idev = ip6_mc_find_dev_rtnl(net, group, gsf->gf_interface); + idev = ip6_mc_find_dev(net, group, gsf->gf_interface); if (!idev) return -ENODEV; + mutex_lock(&idev->mc_lock); + + if (idev->dead) { + err = -ENODEV; + goto done; + } + err = 0; if (gsf->gf_fmode == MCAST_INCLUDE && gsf->gf_numsrc == 0) { @@ -553,24 +572,19 @@ int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf, psin6 = (struct sockaddr_in6 *)list; newpsl->sl_addr[i] = psin6->sin6_addr; } - mutex_lock(&idev->mc_lock); + err = ip6_mc_add_src(idev, group, gsf->gf_fmode, newpsl->sl_count, newpsl->sl_addr, 0); if (err) { - mutex_unlock(&idev->mc_lock); sock_kfree_s(sk, newpsl, struct_size(newpsl, sl_addr, newpsl->sl_max)); goto done; } - mutex_unlock(&idev->mc_lock); } else { newpsl = NULL; - mutex_lock(&idev->mc_lock); ip6_mc_add_src(idev, group, gsf->gf_fmode, 0, NULL, 0); - mutex_unlock(&idev->mc_lock); } - mutex_lock(&idev->mc_lock); psl = sock_dereference(pmc->sflist, sk); if (psl) { ip6_mc_del_src(idev, group, pmc->sfmode, @@ -580,12 +594,14 @@ int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf, } else { ip6_mc_del_src(idev, group, pmc->sfmode, 0, NULL, 0); } + rcu_assign_pointer(pmc->sflist, newpsl); - mutex_unlock(&idev->mc_lock); kfree_rcu(psl, rcu); pmc->sfmode = gsf->gf_fmode; err = 0; done: + mutex_unlock(&idev->mc_lock); + in6_dev_put(idev); if (leavegroup) err = ipv6_sock_mc_drop(sk, gsf->gf_interface, group); return err; -- 2.53.0 ^ permalink raw reply related [flat|nested] 922+ messages in thread
* [PATCH 6.12 018/877] ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source() 2026-09-30 15:15 [PATCH 6.12 000/877] 6.12.112-rc1 review Greg Kroah-Hartman ` (16 preceding siblings ...) 2026-09-30 15:15 ` [PATCH 6.12 017/877] ipv6: mcast: Dont hold RTNL for MCAST_ socket options Greg Kroah-Hartman @ 2026-09-30 15:15 ` Greg Kroah-Hartman 2026-09-30 15:15 ` [PATCH 6.12 019/877] media: video-i2c: fix buffer queue ordering Greg Kroah-Hartman ` (866 subsequent siblings) 884 siblings, 0 replies; 922+ messages in thread From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw) To: stable Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Taehee Yoo, Ido Schimm